@tangle-network/agent-integrations 0.53.47 → 0.53.48

package/dist/{chunk-AGXTCR34.js → chunk-HNEEIMQC.js}

@@ -14,7 +14,7 @@ import {
   TangleIdentityUnreachableError,
   createTangleIdentityClient,
   tangleIdentity
-} from "./chunk-WE7SQ7PB.js";
+} from "./chunk-RRSNINEV.js";
 import {
   __export
 } from "./chunk-PZ5AY32C.js";
@@ -50,7 +50,9 @@ __export(adapters_exports, {
   altTextAiConnector: () => altTextAiConnector,
   alttextifyConnector: () => alttextifyConnector,
   amazonBedrockConnector: () => amazonBedrockConnector,
+  amazonCloudWatchConnector: () => amazonCloudWatchConnector,
   amazonEventBridgeConnector: () => amazonEventBridgeConnector,
+  amazonLambdaConnector: () => amazonLambdaConnector,
   amazonS3Connector: () => amazonS3Connector,
   amazonSecretsManagerConnector: () => amazonSecretsManagerConnector,
   amazonSesConnector: () => amazonSesConnector,
@@ -60,6 +62,7 @@ __export(adapters_exports, {
   aminosConnector: () => aminosConnector,
   ampecoConnector: () => ampecoConnector,
   amplemarketConnector: () => amplemarketConnector,
+  amplitudeConnector: () => amplitudeConnector,
   anthropicConnector: () => anthropicConnector,
   anyhookWebsocketConnector: () => anyhookWebsocketConnector,
   apifyConnector: () => apifyConnector,
@@ -118,6 +121,7 @@ __export(adapters_exports, {
   browseAiConnector: () => browseAiConnector,
   builtwithConnector: () => builtwithConnector,
   buttondownConnector: () => buttondownConnector,
+  calCom: () => calCom,
   calComConnector: () => calComConnector,
   calendlyConnector: () => calendlyConnector,
   cambAiConnector: () => cambAiConnector,
@@ -161,6 +165,7 @@ __export(adapters_exports, {
   clockodoConnector: () => clockodoConnector,
   closeConnector: () => closeConnector,
   cloudconvertConnector: () => cloudconvertConnector,
+  cloudflareConnector: () => cloudflareConnector,
   cloudinaryConnector: () => cloudinaryConnector,
   cloutlyConnector: () => cloutlyConnector,
   codaConnector: () => codaConnector,
@@ -604,6 +609,8 @@ __export(adapters_exports, {
   textcortexAiConnector: () => textcortexAiConnector,
   theirstackConnector: () => theirstackConnector,
   ticktickConnector: () => ticktickConnector,
+  tiktok: () => tiktok,
+  tiktokConnector: () => tiktokConnector,
   timeOpsConnector: () => timeOpsConnector,
   timelinesAiConnector: () => timelinesAiConnector,
   tlDvConnector: () => tlDvConnector,
@@ -747,8 +754,8 @@ function signSigV4(input) {
   const authorization = `${ALGORITHM} Credential=${accessKeyId}/${credentialScope}, SignedHeaders=${signedHeaders}, Signature=${signature}`;
   return { amzDate, signedHeaders, canonicalRequest, stringToSign, signature, authorization };
 }
-function amzDateNow(date = /* @__PURE__ */ new Date()) {
-  return date.toISOString().replace(/[:-]|\.\d{3}/g, "");
+function amzDateNow(date2 = /* @__PURE__ */ new Date()) {
+  return date2.toISOString().replace(/[:-]|\.\d{3}/g, "");
 }
 function hashSha256Hex(data4) {
   return createHash("sha256").update(data4, "utf8").digest("hex");
@@ -957,7 +964,7 @@ async function executeRestRequest(spec, request4, inv, requiredArgs) {
   const headers = {
     accept: "application/json",
     ...renderHeaders(spec.defaultHeaders ?? {}, scope, true),
-    ...renderHeaders(renderableHeaders, scope)
+    ...renderHeaders(renderableHeaders, scope, false, requiredArgs)
   };
   const structuredCredentials = placement.kind === "structured-headers" || placement.kind === "structured-json-body" ? readStructuredCredentials(inv.source.credentials, placement.fields) : placement.kind === "basic-structured" ? readStructuredCredentials(inv.source.credentials, {
     [placement.usernameField]: placement.usernameField,
@@ -1011,7 +1018,8 @@ async function executeRestRequest(spec, request4, inv, requiredArgs) {
     body: bodyString,
     signal: AbortSignal.timeout(2e4)
   });
-  if (res.status === 401 || res.status === 403) {
+  const credentialsExpiredStatuses = spec.credentialsExpiredStatuses ?? [401, 403];
+  if (credentialsExpiredStatuses.includes(res.status)) {
     throw new CredentialsExpired(`${spec.displayName} rejected credentials (${res.status})`, inv.source.id);
   }
   if (res.status === 409 || res.status === 412) {
@@ -1188,7 +1196,12 @@ function credentialToken(credentials) {
 }
 function redactCredentialText(text, credentials, additionalSecrets = []) {
   const candidates = credentials.kind === "oauth2" ? [credentials.accessToken, credentials.refreshToken] : credentials.kind === "api-key" ? [credentials.apiKey, ...jsonStringValues(credentials.apiKey)] : credentials.kind === "custom" ? Object.values(credentials.values) : [];
-  const secrets = [...candidates, ...additionalSecrets].filter(
+  const authorizationSecrets = additionalSecrets.flatMap((secret) => {
+    if (typeof secret !== "string") return [];
+    const credential2 = secret.match(/^(?:Basic|Bearer)\s+(.+)$/i)?.[1];
+    return credential2 ? [secret, credential2] : [secret];
+  });
+  const secrets = [...candidates, ...authorizationSecrets].filter(
     (secret) => typeof secret === "string" && secret.length > 0
   );
   return secrets.reduce(
@@ -1270,12 +1283,24 @@ function retryAfterMsFromHeader(raw) {
 function renderScope(inv, credentialDefaults) {
   return { ...credentialDefaults, ...inv.args, connection: inv.source.metadata };
 }
-function renderHeaders(headers, args, rawExact = false) {
-  return Object.fromEntries(Object.entries(headers).map(([key, value]) => {
+function renderHeaders(headers, args, rawExact = false, requiredArgs) {
+  const out = {};
+  for (const [key, value] of Object.entries(headers)) {
     const exact = value.match(/^\{([a-zA-Z0-9_.-]+)\}$/);
-    if (rawExact && exact) return [key, String(readRequiredPath(args, exact[1]))];
-    return [key, interpolate(value, args)];
-  }));
+    if (exact) {
+      const resolved = readPath(args, exact[1]);
+      if (resolved === void 0 || resolved === null) {
+        if (rawExact || requiredArgs?.includes(exact[1])) {
+          throw new Error(`missing required argument: ${exact[1]}`);
+        }
+        continue;
+      }
+      out[key] = rawExact ? String(resolved) : encodeURIComponent(String(resolved));
+      continue;
+    }
+    out[key] = interpolate(value, args);
+  }
+  return out;
 }
 function renderObject(input, args, requiredArgs) {
   const out = {};
@@ -20103,6 +20128,332 @@ function arbitraryBodyParameters() {
   };
 }
 
+// src/connectors/adapters/amplitude.ts
+var date = {
+  type: "string",
+  pattern: "^[0-9]{8}$",
+  description: "Inclusive date in YYYYMMDD format."
+};
+var isoTimestamp = {
+  type: "string",
+  description: "ISO 8601 timestamp with a time-zone offset."
+};
+var annotationId = {
+  annotationId: { type: "integer", minimum: 1, description: "Amplitude annotation ID." }
+};
+var categoryId = {
+  categoryId: { type: "integer", minimum: 1, description: "Amplitude annotation category ID." }
+};
+var annotation = {
+  type: "object",
+  properties: {
+    label: { type: "string", minLength: 1 },
+    start: isoTimestamp,
+    category: { type: "string" },
+    chart_id: { type: ["string", "null"] },
+    details: { type: "string" },
+    end: { ...isoTimestamp, type: ["string", "null"] }
+  },
+  required: ["label", "start"],
+  additionalProperties: false
+};
+var amplitudeConnector = declarativeRestConnector({
+  kind: "amplitude",
+  displayName: "Amplitude",
+  description: "Query project analytics and manage chart annotations with Amplitude project API credentials.",
+  auth: {
+    kind: "api-key",
+    hint: 'JSON credential bundle: {"apiKey":"...","secretKey":"..."} from Project Settings \u2192 General. Set metadata.apiBaseUrl to https://analytics.eu.amplitude.com only for an EU-resident project; the default is https://amplitude.com.'
+  },
+  category: "other",
+  defaultConsistencyModel: "authoritative",
+  baseUrl: { metadataKey: "apiBaseUrl", fallback: "https://amplitude.com" },
+  allowedBaseUrls: ["https://amplitude.com", "https://analytics.eu.amplitude.com"],
+  credentialPlacement: {
+    kind: "basic-structured",
+    usernameField: "apiKey",
+    passwordField: "secretKey"
+  },
+  test: { method: "GET", path: "/api/2/events/list" },
+  capabilities: [
+    {
+      name: "events.list",
+      class: "read",
+      description: "List visible project events with current-week totals, uniques, and daily-active-user share.",
+      parameters: { type: "object", properties: {} },
+      request: { method: "GET", path: "/api/2/events/list" }
+    },
+    {
+      name: "events.segment",
+      class: "read",
+      description: "Query event totals, uniques, percentages, averages, or formulas over a date range.",
+      parameters: {
+        type: "object",
+        properties: {
+          event: {
+            type: "string",
+            description: 'JSON event definition, for example {"event_type":"_active"}.'
+          },
+          secondEvent: { type: "string", description: "Optional second JSON event definition." },
+          metric: {
+            type: "string",
+            enum: ["uniques", "totals", "pct_dau", "average", "histogram", "sums", "value_avg", "formula"]
+          },
+          activeUserType: { type: "string", enum: ["any", "active"] },
+          start: date,
+          end: date,
+          interval: { type: "integer", enum: [-3e5, -36e5, 1, 7, 30] },
+          segment: { type: "string", description: "JSON array of Amplitude segment definitions." },
+          groupBy: { type: "string" },
+          secondGroupBy: { type: "string" },
+          limit: { type: "integer", minimum: 1, maximum: 1e3 },
+          formula: { type: "string" },
+          rollingWindow: { type: "integer", minimum: 1 },
+          rollingAverage: { type: "integer", minimum: 1 }
+        },
+        required: ["event", "start", "end"]
+      },
+      request: {
+        method: "GET",
+        path: "/api/2/events/segmentation",
+        query: {
+          e: "{event}",
+          e2: "{secondEvent}",
+          m: "{metric}",
+          n: "{activeUserType}",
+          start: "{start}",
+          end: "{end}",
+          i: "{interval}",
+          s: "{segment}",
+          g: "{groupBy}",
+          g2: "{secondGroupBy}",
+          limit: "{limit}",
+          formula: "{formula}",
+          rollingWindow: "{rollingWindow}",
+          rollingAverage: "{rollingAverage}"
+        }
+      }
+    },
+    {
+      name: "users.counts",
+      class: "read",
+      description: "Get active or new user counts over a date range.",
+      parameters: {
+        type: "object",
+        properties: {
+          start: date,
+          end: date,
+          mode: { type: "string", enum: ["active", "new"] },
+          interval: { type: "integer", enum: [1, 7, 30] },
+          segment: { type: "string", description: "JSON array of Amplitude segment definitions." },
+          groupBy: { type: "string" }
+        },
+        required: ["start", "end"]
+      },
+      request: {
+        method: "GET",
+        path: "/api/2/users",
+        query: {
+          start: "{start}",
+          end: "{end}",
+          m: "{mode}",
+          i: "{interval}",
+          s: "{segment}",
+          g: "{groupBy}"
+        }
+      }
+    },
+    {
+      name: "sessions.average-length",
+      class: "read",
+      description: "Get average session length in seconds for each day in a date range.",
+      parameters: {
+        type: "object",
+        properties: { start: date, end: date },
+        required: ["start", "end"]
+      },
+      request: {
+        method: "GET",
+        path: "/api/2/sessions/average",
+        query: { start: "{start}", end: "{end}" }
+      }
+    },
+    {
+      name: "users.search",
+      class: "read",
+      description: "Search for a user by Amplitude ID, device ID, user ID, or user ID prefix.",
+      parameters: {
+        type: "object",
+        properties: { user: { type: "string", minLength: 1 } },
+        required: ["user"]
+      },
+      request: { method: "GET", path: "/api/2/usersearch", query: { user: "{user}" } }
+    },
+    {
+      name: "users.activity",
+      class: "read",
+      description: "Read one user summary and a bounded window of recent or earliest events.",
+      parameters: {
+        type: "object",
+        properties: {
+          user: { type: "string", minLength: 1, description: "Amplitude user ID." },
+          offset: { type: "integer", minimum: 0 },
+          limit: { type: "integer", minimum: 0, maximum: 1e3 },
+          direction: { type: "string", enum: ["earliest", "latest"] }
+        },
+        required: ["user"]
+      },
+      request: {
+        method: "GET",
+        path: "/api/2/useractivity",
+        query: { user: "{user}", offset: "{offset}", limit: "{limit}", direction: "{direction}" }
+      }
+    },
+    {
+      name: "charts.results",
+      class: "read",
+      description: "Export results from one saved Amplitude chart by chart ID.",
+      parameters: {
+        type: "object",
+        properties: { chartId: { type: "string", minLength: 1 } },
+        required: ["chartId"]
+      },
+      request: { method: "GET", path: "/api/3/chart/{chartId}/csv" }
+    },
+    {
+      name: "annotations.list",
+      class: "read",
+      description: "List project chart annotations with optional category, chart, and date filters.",
+      parameters: {
+        type: "object",
+        properties: {
+          category: { type: "string" },
+          chartId: { type: "string" },
+          start: isoTimestamp,
+          end: isoTimestamp
+        }
+      },
+      request: {
+        method: "GET",
+        path: "/api/3/annotations",
+        query: { category: "{category}", chart_id: "{chartId}", start: "{start}", end: "{end}" }
+      }
+    },
+    {
+      name: "annotations.get",
+      class: "read",
+      description: "Read one chart annotation by ID.",
+      parameters: { type: "object", properties: annotationId, required: ["annotationId"] },
+      request: { method: "GET", path: "/api/3/annotations/{annotationId}" }
+    },
+    {
+      name: "annotations.create",
+      class: "mutation",
+      description: "Create a project-wide or chart-specific annotation.",
+      parameters: {
+        type: "object",
+        properties: { annotation },
+        required: ["annotation"]
+      },
+      request: { method: "POST", path: "/api/3/annotations", body: "{annotation}" },
+      cas: "none",
+      externalEffect: true
+    },
+    {
+      name: "annotations.update",
+      class: "mutation",
+      description: "Partially update one annotation.",
+      parameters: {
+        type: "object",
+        properties: {
+          ...annotationId,
+          changes: {
+            ...annotation,
+            required: []
+          }
+        },
+        required: ["annotationId", "changes"]
+      },
+      request: { method: "PUT", path: "/api/3/annotations/{annotationId}", body: "{changes}" },
+      cas: "optimistic-read-verify",
+      externalEffect: true
+    },
+    {
+      name: "annotations.delete",
+      class: "mutation",
+      description: "Permanently delete one annotation.",
+      parameters: { type: "object", properties: annotationId, required: ["annotationId"] },
+      request: { method: "DELETE", path: "/api/3/annotations/{annotationId}" },
+      cas: "optimistic-read-verify",
+      externalEffect: true
+    },
+    {
+      name: "annotation-categories.list",
+      class: "read",
+      description: "List annotation categories or filter by exact category name.",
+      parameters: {
+        type: "object",
+        properties: { category: { type: "string" } }
+      },
+      request: {
+        method: "GET",
+        path: "/api/3/annotation-categories",
+        query: { category: "{category}" }
+      }
+    },
+    {
+      name: "annotation-categories.get",
+      class: "read",
+      description: "Read one annotation category by ID.",
+      parameters: { type: "object", properties: categoryId, required: ["categoryId"] },
+      request: { method: "GET", path: "/api/3/annotation-categories/{categoryId}" }
+    },
+    {
+      name: "annotation-categories.create",
+      class: "mutation",
+      description: "Create an annotation category.",
+      parameters: {
+        type: "object",
+        properties: { category: { type: "string", minLength: 1 } },
+        required: ["category"]
+      },
+      request: {
+        method: "POST",
+        path: "/api/3/annotation-categories",
+        body: { category: "{category}" }
+      },
+      cas: "none",
+      externalEffect: true
+    },
+    {
+      name: "annotation-categories.update",
+      class: "mutation",
+      description: "Rename one annotation category.",
+      parameters: {
+        type: "object",
+        properties: { ...categoryId, category: { type: "string", minLength: 1 } },
+        required: ["categoryId", "category"]
+      },
+      request: {
+        method: "PUT",
+        path: "/api/3/annotation-categories/{categoryId}",
+        body: { category: "{category}" }
+      },
+      cas: "optimistic-read-verify",
+      externalEffect: true
+    },
+    {
+      name: "annotation-categories.delete",
+      class: "mutation",
+      description: "Permanently delete one annotation category.",
+      parameters: { type: "object", properties: categoryId, required: ["categoryId"] },
+      request: { method: "DELETE", path: "/api/3/annotation-categories/{categoryId}" },
+      cas: "optimistic-read-verify",
+      externalEffect: true
+    }
+  ]
+});
+
 // src/connectors/adapters/amazon-eventbridge.ts
 var amazonEventBridgeConnector = declarativeRestConnector({
   kind: "amazon-eventbridge",
@@ -20442,6 +20793,717 @@ var amazonEventBridgeConnector = declarativeRestConnector({
   ]
 });
 
+// src/connectors/adapters/amazon-cloudwatch.ts
+var target = (operation) => `GraniteServiceVersion20100801.${operation}`;
+var amazonCloudWatchConnector = declarativeRestConnector({
+  kind: "aws-cloudwatch",
+  displayName: "AWS CloudWatch",
+  description: "Read and publish CloudWatch metrics, manage metric alarms, and manage dashboards.",
+  auth: {
+    kind: "api-key",
+    hint: 'AWS credentials as JSON: {"accessKeyId":"AKIA\u2026","secretAccessKey":"\u2026","region":"us-east-1"}. Optional "sessionToken" and "endpoint" support temporary credentials and local AWS-compatible endpoints.'
+  },
+  category: "other",
+  // Metric publication is eventually consistent and cannot be deduplicated by
+  // a caller-provided key. Alarm and dashboard writes use stronger CAS labels.
+  defaultConsistencyModel: "advisory",
+  credentialPlacement: { kind: "aws-sigv4", service: "monitoring" },
+  baseUrl: {
+    metadataKey: "endpoint",
+    fallback: "https://monitoring.{region}.amazonaws.com"
+  },
+  defaultHeaders: {
+    "Content-Type": "application/x-amz-json-1.0"
+  },
+  test: {
+    method: "POST",
+    path: "/",
+    headers: { "X-Amz-Target": target("ListMetrics") },
+    body: {}
+  },
+  capabilities: [
+    {
+      name: "metrics.list",
+      class: "read",
+      description: "List available CloudWatch metrics and their dimensions.",
+      parameters: {
+        type: "object",
+        properties: {
+          namespace: { type: "string" },
+          metricName: { type: "string" },
+          dimensions: { type: "array", description: "AWS DimensionFilter objects." },
+          nextToken: { type: "string" },
+          recentlyActive: { type: "string", enum: ["PT3H"] },
+          includeLinkedAccounts: { type: "boolean" },
+          owningAccount: { type: "string" }
+        }
+      },
+      request: {
+        method: "POST",
+        path: "/",
+        headers: { "X-Amz-Target": target("ListMetrics") },
+        body: {
+          Namespace: "{namespace}",
+          MetricName: "{metricName}",
+          Dimensions: "{dimensions}",
+          NextToken: "{nextToken}",
+          RecentlyActive: "{recentlyActive}",
+          IncludeLinkedAccounts: "{includeLinkedAccounts}",
+          OwningAccount: "{owningAccount}"
+        }
+      }
+    },
+    {
+      name: "metrics.statistics.get",
+      class: "read",
+      description: "Get statistics for one metric over a time range.",
+      parameters: {
+        type: "object",
+        properties: {
+          namespace: { type: "string" },
+          metricName: { type: "string" },
+          dimensions: { type: "array", description: "AWS Dimension objects." },
+          startTime: { type: "number", description: "Unix epoch seconds." },
+          endTime: { type: "number", description: "Unix epoch seconds." },
+          period: { type: "integer", description: "Aggregation period in seconds." },
+          statistics: { type: "array", items: { type: "string" } },
+          extendedStatistics: { type: "array", items: { type: "string" } },
+          unit: { type: "string" }
+        },
+        required: ["namespace", "metricName", "startTime", "endTime", "period"]
+      },
+      request: {
+        method: "POST",
+        path: "/",
+        headers: { "X-Amz-Target": target("GetMetricStatistics") },
+        body: {
+          Namespace: "{namespace}",
+          MetricName: "{metricName}",
+          Dimensions: "{dimensions}",
+          StartTime: "{startTime}",
+          EndTime: "{endTime}",
+          Period: "{period}",
+          Statistics: "{statistics}",
+          ExtendedStatistics: "{extendedStatistics}",
+          Unit: "{unit}"
+        }
+      }
+    },
+    {
+      name: "metrics.data.get",
+      class: "read",
+      description: "Run up to 500 metric-data or metric-math queries in one request.",
+      parameters: {
+        type: "object",
+        properties: {
+          metricDataQueries: { type: "array", description: "AWS MetricDataQuery objects." },
+          startTime: { type: "number", description: "Unix epoch seconds." },
+          endTime: { type: "number", description: "Unix epoch seconds." },
+          nextToken: { type: "string" },
+          scanBy: { type: "string", enum: ["TimestampDescending", "TimestampAscending"] },
+          maxDatapoints: { type: "integer" },
+          labelOptions: { type: "object" }
+        },
+        required: ["metricDataQueries", "startTime", "endTime"]
+      },
+      request: {
+        method: "POST",
+        path: "/",
+        headers: { "X-Amz-Target": target("GetMetricData") },
+        body: {
+          MetricDataQueries: "{metricDataQueries}",
+          StartTime: "{startTime}",
+          EndTime: "{endTime}",
+          NextToken: "{nextToken}",
+          ScanBy: "{scanBy}",
+          MaxDatapoints: "{maxDatapoints}",
+          LabelOptions: "{labelOptions}"
+        }
+      }
+    },
+    {
+      name: "alarms.list",
+      class: "read",
+      description: "List metric and composite alarms with optional filters.",
+      parameters: {
+        type: "object",
+        properties: {
+          alarmNames: { type: "array", items: { type: "string" } },
+          alarmNamePrefix: { type: "string" },
+          alarmTypes: { type: "array", items: { type: "string" } },
+          childrenOfAlarmName: { type: "string" },
+          parentsOfAlarmName: { type: "string" },
+          stateValue: { type: "string", enum: ["OK", "ALARM", "INSUFFICIENT_DATA"] },
+          actionPrefix: { type: "string" },
+          maxRecords: { type: "integer" },
+          nextToken: { type: "string" }
+        }
+      },
+      request: {
+        method: "POST",
+        path: "/",
+        headers: { "X-Amz-Target": target("DescribeAlarms") },
+        body: {
+          AlarmNames: "{alarmNames}",
+          AlarmNamePrefix: "{alarmNamePrefix}",
+          AlarmTypes: "{alarmTypes}",
+          ChildrenOfAlarmName: "{childrenOfAlarmName}",
+          ParentsOfAlarmName: "{parentsOfAlarmName}",
+          StateValue: "{stateValue}",
+          ActionPrefix: "{actionPrefix}",
+          MaxRecords: "{maxRecords}",
+          NextToken: "{nextToken}"
+        }
+      }
+    },
+    {
+      name: "dashboards.list",
+      class: "read",
+      description: "List CloudWatch dashboards in the account.",
+      parameters: {
+        type: "object",
+        properties: {
+          dashboardNamePrefix: { type: "string" },
+          nextToken: { type: "string" }
+        }
+      },
+      request: {
+        method: "POST",
+        path: "/",
+        headers: { "X-Amz-Target": target("ListDashboards") },
+        body: {
+          DashboardNamePrefix: "{dashboardNamePrefix}",
+          NextToken: "{nextToken}"
+        }
+      }
+    },
+    {
+      name: "dashboards.get",
+      class: "read",
+      description: "Get one CloudWatch dashboard definition.",
+      parameters: {
+        type: "object",
+        properties: { dashboardName: { type: "string" } },
+        required: ["dashboardName"]
+      },
+      request: {
+        method: "POST",
+        path: "/",
+        headers: { "X-Amz-Target": target("GetDashboard") },
+        body: { DashboardName: "{dashboardName}" }
+      }
+    },
+    {
+      name: "metrics.publish",
+      class: "mutation",
+      description: "Publish custom metric data or entity metric data to CloudWatch.",
+      parameters: {
+        type: "object",
+        properties: {
+          namespace: { type: "string" },
+          metricData: { type: "array", description: "AWS MetricDatum objects." },
+          entityMetricData: { type: "array", description: "AWS EntityMetricData objects." },
+          strictEntityValidation: { type: "boolean" }
+        },
+        required: ["namespace"]
+      },
+      request: {
+        method: "POST",
+        path: "/",
+        headers: { "X-Amz-Target": target("PutMetricData") },
+        body: {
+          Namespace: "{namespace}",
+          MetricData: "{metricData}",
+          EntityMetricData: "{entityMetricData}",
+          StrictEntityValidation: "{strictEntityValidation}"
+        }
+      },
+      cas: "none",
+      externalEffect: true
+    },
+    {
+      name: "alarms.put",
+      class: "mutation",
+      description: "Create or fully replace a CloudWatch metric alarm.",
+      parameters: {
+        type: "object",
+        properties: {
+          alarm: {
+            type: "object",
+            description: "AWS PutMetricAlarm input without undeclared transport fields."
+          }
+        },
+        required: ["alarm"]
+      },
+      request: {
+        method: "POST",
+        path: "/",
+        headers: { "X-Amz-Target": target("PutMetricAlarm") },
+        body: "{alarm}"
+      },
+      cas: "optimistic-read-verify",
+      externalEffect: true
+    },
+    {
+      name: "alarms.delete",
+      class: "mutation",
+      description: "Delete up to 100 CloudWatch alarms by name.",
+      parameters: {
+        type: "object",
+        properties: {
+          alarmNames: { type: "array", items: { type: "string" } }
+        },
+        required: ["alarmNames"]
+      },
+      request: {
+        method: "POST",
+        path: "/",
+        headers: { "X-Amz-Target": target("DeleteAlarms") },
+        body: { AlarmNames: "{alarmNames}" }
+      },
+      cas: "native-idempotency",
+      externalEffect: true
+    },
+    {
+      name: "dashboards.put",
+      class: "mutation",
+      description: "Create or fully replace a CloudWatch dashboard.",
+      parameters: {
+        type: "object",
+        properties: {
+          dashboardName: { type: "string" },
+          dashboardBody: { type: "string", description: "CloudWatch dashboard JSON string." }
+        },
+        required: ["dashboardName", "dashboardBody"]
+      },
+      request: {
+        method: "POST",
+        path: "/",
+        headers: { "X-Amz-Target": target("PutDashboard") },
+        body: {
+          DashboardName: "{dashboardName}",
+          DashboardBody: "{dashboardBody}"
+        }
+      },
+      cas: "optimistic-read-verify",
+      externalEffect: true
+    },
+    {
+      name: "dashboards.delete",
+      class: "mutation",
+      description: "Delete up to 100 CloudWatch dashboards by name.",
+      parameters: {
+        type: "object",
+        properties: {
+          dashboardNames: { type: "array", items: { type: "string" } }
+        },
+        required: ["dashboardNames"]
+      },
+      request: {
+        method: "POST",
+        path: "/",
+        headers: { "X-Amz-Target": target("DeleteDashboards") },
+        body: { DashboardNames: "{dashboardNames}" }
+      },
+      cas: "native-idempotency",
+      externalEffect: true
+    }
+  ]
+});
+
+// src/connectors/adapters/amazon-lambda.ts
+var awsCredentialHint = 'AWS credentials as JSON: {"accessKeyId":"AKIA\u2026","secretAccessKey":"\u2026","region":"us-east-1"}. Optional "sessionToken" and "endpoint" support temporary credentials and local AWS-compatible endpoints.';
+var amazonLambdaConnector = declarativeRestConnector({
+  kind: "aws-lambda",
+  displayName: "AWS Lambda",
+  description: "Inspect, invoke, create, update, version, alias, and delete AWS Lambda functions.",
+  auth: { kind: "api-key", hint: awsCredentialHint },
+  category: "other",
+  // Lambda invocation is at-least-once and can cause arbitrary downstream
+  // effects. The connection cannot promise authoritative mutation replay.
+  defaultConsistencyModel: "advisory",
+  credentialPlacement: { kind: "aws-sigv4", service: "lambda" },
+  baseUrl: {
+    metadataKey: "endpoint",
+    fallback: "https://lambda.{region}.amazonaws.com"
+  },
+  test: {
+    method: "GET",
+    path: "/2015-03-31/functions",
+    query: { MaxItems: "1" }
+  },
+  capabilities: [
+    {
+      name: "functions.list",
+      class: "read",
+      description: "List Lambda functions in the configured AWS region.",
+      parameters: {
+        type: "object",
+        properties: {
+          marker: { type: "string", description: "Pagination marker." },
+          maxItems: { type: "integer", description: "Maximum functions to return (1-50)." },
+          functionVersion: {
+            type: "string",
+            enum: ["ALL"],
+            description: "Include published versions when set to ALL."
+          },
+          masterRegion: { type: "string", description: "Filter Lambda@Edge replicas by region." }
+        }
+      },
+      request: {
+        method: "GET",
+        path: "/2015-03-31/functions",
+        query: {
+          Marker: "{marker}",
+          MaxItems: "{maxItems}",
+          FunctionVersion: "{functionVersion}",
+          MasterRegion: "{masterRegion}"
+        }
+      }
+    },
+    {
+      name: "functions.get",
+      class: "read",
+      description: "Get one function configuration and its temporary deployment-package URL.",
+      parameters: {
+        type: "object",
+        properties: {
+          functionName: { type: "string", description: "Function name or ARN." },
+          qualifier: { type: "string", description: "Version number or alias." }
+        },
+        required: ["functionName"]
+      },
+      request: {
+        method: "GET",
+        path: "/2015-03-31/functions/{functionName}",
+        query: { Qualifier: "{qualifier}" }
+      }
+    },
+    {
+      name: "aliases.list",
+      class: "read",
+      description: "List aliases for a Lambda function.",
+      parameters: {
+        type: "object",
+        properties: {
+          functionName: { type: "string" },
+          functionVersion: { type: "string" },
+          marker: { type: "string" },
+          maxItems: { type: "integer" }
+        },
+        required: ["functionName"]
+      },
+      request: {
+        method: "GET",
+        path: "/2015-03-31/functions/{functionName}/aliases",
+        query: {
+          FunctionVersion: "{functionVersion}",
+          Marker: "{marker}",
+          MaxItems: "{maxItems}"
+        }
+      }
+    },
+    {
+      name: "functions.invoke",
+      class: "mutation",
+      description: "Invoke a Lambda function synchronously, asynchronously, or as a dry-run permission check.",
+      parameters: {
+        type: "object",
+        properties: {
+          functionName: { type: "string", description: "Function name or ARN." },
+          qualifier: { type: "string", description: "Version number or alias." },
+          invocationType: {
+            type: "string",
+            enum: ["RequestResponse", "Event", "DryRun"]
+          },
+          logType: { type: "string", enum: ["None", "Tail"] },
+          clientContext: {
+            type: "string",
+            description: "Base64-encoded client context for synchronous invocation."
+          },
+          payload: {
+            description: "JSON payload passed directly to the function."
+          }
+        },
+        required: ["functionName", "payload"]
+      },
+      request: {
+        method: "POST",
+        path: "/2015-03-31/functions/{functionName}/invocations",
+        query: { Qualifier: "{qualifier}" },
+        headers: {
+          "X-Amz-Invocation-Type": "{invocationType}",
+          "X-Amz-Log-Type": "{logType}",
+          "X-Amz-Client-Context": "{clientContext}"
+        },
+        body: "{payload}"
+      },
+      cas: "none",
+      externalEffect: true
+    },
+    {
+      name: "functions.create",
+      class: "mutation",
+      description: "Create a Lambda function from an S3 object, inline zip, or ECR image.",
+      parameters: {
+        type: "object",
+        properties: {
+          functionName: { type: "string" },
+          role: { type: "string", description: "Execution-role ARN." },
+          code: {
+            type: "object",
+            description: "AWS FunctionCode shape: S3Bucket/S3Key/S3ObjectVersion, ZipFile, or ImageUri."
+          },
+          runtime: { type: "string" },
+          handler: { type: "string" },
+          description: { type: "string" },
+          timeout: { type: "integer" },
+          memorySize: { type: "integer" },
+          publish: { type: "boolean" },
+          packageType: { type: "string", enum: ["Zip", "Image"] },
+          architectures: { type: "array", items: { type: "string" } },
+          environment: { type: "object", description: "AWS Environment shape." },
+          vpcConfig: { type: "object", description: "AWS VpcConfig shape." },
+          layers: { type: "array", items: { type: "string" } },
+          tags: { type: "object" },
+          ephemeralStorage: { type: "object" },
+          loggingConfig: { type: "object" }
+        },
+        required: ["functionName", "role", "code"]
+      },
+      request: {
+        method: "POST",
+        path: "/2015-03-31/functions",
+        body: {
+          FunctionName: "{functionName}",
+          Role: "{role}",
+          Code: "{code}",
+          Runtime: "{runtime}",
+          Handler: "{handler}",
+          Description: "{description}",
+          Timeout: "{timeout}",
+          MemorySize: "{memorySize}",
+          Publish: "{publish}",
+          PackageType: "{packageType}",
+          Architectures: "{architectures}",
+          Environment: "{environment}",
+          VpcConfig: "{vpcConfig}",
+          Layers: "{layers}",
+          Tags: "{tags}",
+          EphemeralStorage: "{ephemeralStorage}",
+          LoggingConfig: "{loggingConfig}"
+        }
+      },
+      cas: "native-idempotency",
+      externalEffect: true
+    },
+    {
+      name: "functions.code.update",
+      class: "mutation",
+      description: "Replace the unpublished code for a Lambda function.",
+      parameters: {
+        type: "object",
+        properties: {
+          functionName: { type: "string" },
+          s3Bucket: { type: "string" },
+          s3Key: { type: "string" },
+          s3ObjectVersion: { type: "string" },
+          imageUri: { type: "string" },
+          zipFile: { type: "string", description: "Base64-encoded zip bytes." },
+          publish: { type: "boolean" },
+          dryRun: { type: "boolean" },
+          revisionId: { type: "string" },
+          architectures: { type: "array", items: { type: "string" } }
+        },
+        required: ["functionName"]
+      },
+      request: {
+        method: "PUT",
+        path: "/2015-03-31/functions/{functionName}/code",
+        body: {
+          S3Bucket: "{s3Bucket}",
+          S3Key: "{s3Key}",
+          S3ObjectVersion: "{s3ObjectVersion}",
+          ImageUri: "{imageUri}",
+          ZipFile: "{zipFile}",
+          Publish: "{publish}",
+          DryRun: "{dryRun}",
+          RevisionId: "{revisionId}",
+          Architectures: "{architectures}"
+        }
+      },
+      cas: "optimistic-read-verify",
+      externalEffect: true
+    },
+    {
+      name: "functions.configuration.update",
+      class: "mutation",
+      description: "Update the unpublished configuration for a Lambda function.",
+      parameters: {
+        type: "object",
+        properties: {
+          functionName: { type: "string" },
+          role: { type: "string" },
+          handler: { type: "string" },
+          description: { type: "string" },
+          timeout: { type: "integer" },
+          memorySize: { type: "integer" },
+          runtime: { type: "string" },
+          environment: { type: "object" },
+          layers: { type: "array", items: { type: "string" } },
+          vpcConfig: { type: "object" },
+          revisionId: { type: "string" },
+          ephemeralStorage: { type: "object" },
+          loggingConfig: { type: "object" }
+        },
+        required: ["functionName"]
+      },
+      request: {
+        method: "PUT",
+        path: "/2015-03-31/functions/{functionName}/configuration",
+        body: {
+          Role: "{role}",
+          Handler: "{handler}",
+          Description: "{description}",
+          Timeout: "{timeout}",
+          MemorySize: "{memorySize}",
+          Runtime: "{runtime}",
+          Environment: "{environment}",
+          Layers: "{layers}",
+          VpcConfig: "{vpcConfig}",
+          RevisionId: "{revisionId}",
+          EphemeralStorage: "{ephemeralStorage}",
+          LoggingConfig: "{loggingConfig}"
+        }
+      },
+      cas: "optimistic-read-verify",
+      externalEffect: true
+    },
+    {
+      name: "versions.publish",
+      class: "mutation",
+      description: "Publish an immutable version from the current function code and configuration.",
+      parameters: {
+        type: "object",
+        properties: {
+          functionName: { type: "string" },
+          codeSha256: { type: "string" },
+          description: { type: "string" },
+          revisionId: { type: "string" }
+        },
+        required: ["functionName"]
+      },
+      request: {
+        method: "POST",
+        path: "/2015-03-31/functions/{functionName}/versions",
+        body: {
+          CodeSha256: "{codeSha256}",
+          Description: "{description}",
+          RevisionId: "{revisionId}"
+        }
+      },
+      cas: "optimistic-read-verify",
+      externalEffect: true
+    },
+    {
+      name: "aliases.create",
+      class: "mutation",
+      description: "Create an alias that points to a published function version.",
+      parameters: {
+        type: "object",
+        properties: {
+          functionName: { type: "string" },
+          name: { type: "string" },
+          functionVersion: { type: "string" },
+          description: { type: "string" },
+          routingConfig: { type: "object" }
+        },
+        required: ["functionName", "name", "functionVersion"]
+      },
+      request: {
+        method: "POST",
+        path: "/2015-03-31/functions/{functionName}/aliases",
+        body: {
+          Name: "{name}",
+          FunctionVersion: "{functionVersion}",
+          Description: "{description}",
+          RoutingConfig: "{routingConfig}"
+        }
+      },
+      cas: "native-idempotency",
+      externalEffect: true
+    },
+    {
+      name: "aliases.update",
+      class: "mutation",
+      description: "Move or reconfigure an existing function alias.",
+      parameters: {
+        type: "object",
+        properties: {
+          functionName: { type: "string" },
+          name: { type: "string" },
+          functionVersion: { type: "string" },
+          description: { type: "string" },
+          routingConfig: { type: "object" },
+          revisionId: { type: "string" }
+        },
+        required: ["functionName", "name"]
+      },
+      request: {
+        method: "PUT",
+        path: "/2015-03-31/functions/{functionName}/aliases/{name}",
+        body: {
+          FunctionVersion: "{functionVersion}",
+          Description: "{description}",
+          RoutingConfig: "{routingConfig}",
+          RevisionId: "{revisionId}"
+        }
+      },
+      cas: "optimistic-read-verify",
+      externalEffect: true
+    },
+    {
+      name: "aliases.delete",
+      class: "mutation",
+      description: "Delete a function alias without deleting the function version.",
+      parameters: {
+        type: "object",
+        properties: {
+          functionName: { type: "string" },
+          name: { type: "string" }
+        },
+        required: ["functionName", "name"]
+      },
+      request: {
+        method: "DELETE",
+        path: "/2015-03-31/functions/{functionName}/aliases/{name}"
+      },
+      cas: "native-idempotency",
+      externalEffect: true
+    },
+    {
+      name: "functions.delete",
+      class: "mutation",
+      description: "Permanently delete a Lambda function or one published version.",
+      parameters: {
+        type: "object",
+        properties: {
+          functionName: { type: "string" },
+          qualifier: { type: "string", description: "Version to delete. Omit to delete all versions." }
+        },
+        required: ["functionName"]
+      },
+      request: {
+        method: "DELETE",
+        path: "/2015-03-31/functions/{functionName}",
+        query: { Qualifier: "{qualifier}" }
+      },
+      cas: "native-idempotency",
+      externalEffect: true
+    }
+  ]
+});
+
 // src/connectors/adapters/amazon-s3.ts
 var amazonS3Connector = declarativeRestConnector({
   kind: "amazon-s3",
@@ -23995,9 +25057,9 @@ function requiredString4(value, field) {
 }
 function isoDate(value, field) {
   const parsed = requiredString4(value, field);
-  const date = new Date(parsed);
-  if (!Number.isFinite(date.getTime())) throw new Error(`${field} must be an ISO 8601 timestamp`);
-  return date.toISOString();
+  const date2 = new Date(parsed);
+  if (!Number.isFinite(date2.getTime())) throw new Error(`${field} must be an ISO 8601 timestamp`);
+  return date2.toISOString();
 }
 function requiredJsonValue(value, field) {
   if (value === void 0) throw new Error(`${field} is required`);
@@ -24015,8 +25077,8 @@ function retryAfterMs3(value) {
   if (!value) return 6e4;
   const seconds = Number(value);
   if (Number.isFinite(seconds) && seconds >= 0) return seconds * 1e3;
-  const date = Date.parse(value);
-  return Number.isFinite(date) ? Math.max(0, date - Date.now()) : 6e4;
+  const date2 = Date.parse(value);
+  return Number.isFinite(date2) ? Math.max(0, date2 - Date.now()) : 6e4;
 }
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -24573,8 +25635,8 @@ function retryAfterMs4(value) {
   if (!value) return 6e4;
   const seconds = Number(value);
   if (Number.isFinite(seconds) && seconds >= 0) return seconds * 1e3;
-  const date = Date.parse(value);
-  return Number.isFinite(date) ? Math.max(0, date - Date.now()) : 6e4;
+  const date2 = Date.parse(value);
+  return Number.isFinite(date2) ? Math.max(0, date2 - Date.now()) : 6e4;
 }
 function redactProviderText(value) {
   return value.replace(/SharedAccessSignature\s+[^\s<]+/gi, "SharedAccessSignature [redacted]").replace(/SharedAccessKey=[^;\s<]+/gi, "SharedAccessKey=[redacted]");
@@ -26300,10 +27362,190 @@ var billplzConnector = declarativeRestConnector({
   ]
 });
 
+// src/connectors/oauth.ts
+import { createHash as createHash4, randomBytes } from "crypto";
+var PENDING_TTL_MS = 10 * 60 * 1e3;
+var InMemoryOAuthFlowStore = class {
+  pendingFlows = /* @__PURE__ */ new Map();
+  put(state, flow) {
+    this.pendingFlows.set(state, flow);
+  }
+  consume(state) {
+    const flow = this.pendingFlows.get(state);
+    this.pendingFlows.delete(state);
+    if (!flow || flow.expiresAt <= Date.now()) return void 0;
+    return flow;
+  }
+  sweep(now) {
+    for (const [k, v] of this.pendingFlows) {
+      if (v.expiresAt <= now) this.pendingFlows.delete(k);
+    }
+  }
+  clear() {
+    this.pendingFlows.clear();
+  }
+};
+var defaultFlowStore = new InMemoryOAuthFlowStore();
+function startOAuthFlow(input) {
+  const store = input.store ?? defaultFlowStore;
+  const now = input.now ?? Date.now();
+  store.sweep?.(now);
+  const usePkce = (input.pkce ?? "required") !== "unsupported";
+  const codeVerifier = usePkce ? base64Url(randomBytes(48)) : void 0;
+  const codeChallenge = codeVerifier ? base64Url(createHash4("sha256").update(codeVerifier).digest()) : void 0;
+  const state = base64Url(randomBytes(24));
+  store.put(state, {
+    codeVerifier,
+    state,
+    projectId: input.projectId,
+    kind: input.kind,
+    label: input.label,
+    redirectUri: input.redirectUri,
+    expiresAt: now + PENDING_TTL_MS
+  });
+  const url = new URL(input.authorizationUrl);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set(
+    oauthParameterName(input.authorizationClientIdParam, "client_id"),
+    input.clientId
+  );
+  url.searchParams.set("redirect_uri", input.redirectUri);
+  url.searchParams.set("scope", input.scopes.join(input.scopeSeparator ?? " "));
+  url.searchParams.set("state", state);
+  if (input.extraAuthParams) {
+    for (const [k, v] of Object.entries(input.extraAuthParams)) {
+      url.searchParams.set(k, v);
+    }
+  }
+  if (codeChallenge) {
+    url.searchParams.set("code_challenge", codeChallenge);
+    url.searchParams.set("code_challenge_method", "S256");
+  } else {
+    url.searchParams.delete("code_challenge");
+    url.searchParams.delete("code_challenge_method");
+  }
+  return { authorizationUrl: url.toString(), state };
+}
+async function consumePendingFlow(state, store = defaultFlowStore) {
+  await store.sweep?.(Date.now());
+  const flow = await store.consume(state);
+  if (!flow) {
+    throw new Error("Unknown or expired OAuth state: possible CSRF, replay, or stale flow");
+  }
+  return flow;
+}
+async function exchangeAuthorizationCode(input) {
+  const usePkce = (input.pkce ?? "required") !== "unsupported";
+  if (usePkce && !input.codeVerifier) {
+    throw new Error("OAuth token exchange requires a PKCE code_verifier");
+  }
+  const body = new URLSearchParams({
+    grant_type: "authorization_code",
+    code: input.code,
+    redirect_uri: input.redirectUri
+  });
+  if (usePkce) body.set("code_verifier", input.codeVerifier);
+  const headers = {
+    "content-type": "application/x-www-form-urlencoded",
+    accept: "application/json"
+  };
+  applyTokenClientAuthentication(input, body, headers);
+  const res = await (input.fetchImpl ?? fetch)(input.tokenUrl, {
+    method: "POST",
+    headers,
+    body,
+    signal: input.signal
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new Error(`OAuth token exchange failed: ${res.status} ${res.statusText} \u2014 ${text.slice(0, 200)}`);
+  }
+  const json = await res.json();
+  return {
+    accessToken: json.access_token,
+    refreshToken: json.refresh_token,
+    expiresIn: json.expires_in,
+    scope: json.scope,
+    tokenType: json.token_type,
+    idToken: json.id_token
+  };
+}
+async function refreshAccessToken(input) {
+  const body = new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token: input.refreshToken
+  });
+  const headers = {
+    "content-type": "application/x-www-form-urlencoded",
+    accept: "application/json"
+  };
+  applyTokenClientAuthentication(input, body, headers);
+  const res = await (input.fetchImpl ?? fetch)(input.tokenUrl, {
+    method: "POST",
+    headers,
+    body,
+    signal: input.signal
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new Error(`OAuth refresh failed: ${res.status} ${res.statusText} \u2014 ${text.slice(0, 200)}`);
+  }
+  const json = await res.json();
+  return {
+    accessToken: json.access_token,
+    // Some providers omit refresh_token on refresh — keep the previous one
+    // in that case (caller passes through if undefined).
+    refreshToken: json.refresh_token,
+    expiresIn: json.expires_in,
+    scope: json.scope,
+    tokenType: json.token_type,
+    idToken: json.id_token
+  };
+}
+function applyTokenClientAuthentication(input, body, headers) {
+  const method = input.tokenClientAuthMethod ?? "client_secret_post";
+  if (method === "none") {
+    body.set(oauthParameterName(input.tokenClientIdParam, "client_id"), input.clientId);
+    return;
+  }
+  if (!input.clientSecret) {
+    throw new Error(`OAuth ${method} client authentication requires a client secret`);
+  }
+  if (method === "client_secret_post") {
+    body.set(oauthParameterName(input.tokenClientIdParam, "client_id"), input.clientId);
+    body.set(
+      oauthParameterName(input.tokenClientSecretParam, "client_secret"),
+      input.clientSecret
+    );
+    return;
+  }
+  if (method === "client_secret_basic") {
+    headers.authorization = `Basic ${Buffer.from(
+      `${input.clientId}:${input.clientSecret}`,
+      "utf8"
+    ).toString("base64")}`;
+    return;
+  }
+  throw new Error("Unsupported OAuth token client authentication method");
+}
+function base64Url(buf) {
+  return buf.toString("base64").replace(/=+$/, "").replace(/\+/g, "-").replace(/\//g, "_");
+}
+function oauthParameterName(value, fallback) {
+  const name = value ?? fallback;
+  if (!/^[A-Za-z][A-Za-z0-9_.-]{0,63}$/.test(name)) {
+    throw new Error("Invalid OAuth parameter name");
+  }
+  return name;
+}
+function _resetPendingFlowsForTests() {
+  defaultFlowStore.clear?.();
+}
+
 // src/connectors/adapters/cal-com.ts
 var authorizeUrl = "https://app.cal.com/auth/oauth2/authorize";
 var tokenUrl = "https://api.cal.com/v2/auth/oauth2/token";
-var calComConnector = declarativeRestConnector({
+var calComSpec = {
   kind: "cal-com",
   displayName: "Cal.com",
   description: "Schedule, query, and cancel Cal.com bookings and read event types through the Platform v2 API.",
@@ -26320,8 +27562,9 @@ var calComConnector = declarativeRestConnector({
       "SCHEDULE_READ",
       "SCHEDULE_WRITE"
     ],
-    clientIdEnv: "CALCOM_OAUTH_CLIENT_ID",
-    clientSecretEnv: "CALCOM_OAUTH_CLIENT_SECRET"
+    pkce: "required",
+    tokenClientAuthMethod: "none",
+    clientIdEnv: "CALCOM_OAUTH_CLIENT_ID"
   },
   category: "calendar",
   defaultConsistencyModel: "authoritative",
@@ -26642,7 +27885,100 @@ var calComConnector = declarativeRestConnector({
       requiredScopes: ["EVENT_TYPE_READ"]
     }
   ]
-});
+};
+var calComConnector = declarativeRestConnector(calComSpec);
+function calCom(options) {
+  const adapter = declarativeRestConnector(calComSpec);
+  const now = options.now ?? Date.now;
+  const refreshes = /* @__PURE__ */ new Map();
+  adapter.exchangeOAuth = async (input) => {
+    const tokens = await exchangeAuthorizationCode({
+      tokenUrl,
+      clientId: options.clientId,
+      tokenClientAuthMethod: "none",
+      code: input.code,
+      codeVerifier: input.codeVerifier,
+      redirectUri: input.redirectUri,
+      fetchImpl: options.fetchImpl
+    });
+    return {
+      credentials: {
+        kind: "oauth2",
+        accessToken: tokens.accessToken,
+        refreshToken: tokens.refreshToken,
+        expiresAt: tokens.expiresIn ? now() + tokens.expiresIn * 1e3 : void 0
+      },
+      scopes: tokens.scope?.split(/[\s,]+/).filter(Boolean) ?? calComSpec.auth.scopes,
+      metadata: {}
+    };
+  };
+  adapter.refreshToken = async (credentials) => {
+    if (credentials.kind !== "oauth2" || !credentials.refreshToken) {
+      throw new Error("cal-com.refreshToken: missing refresh token");
+    }
+    const refreshed = await refreshAccessToken({
+      tokenUrl,
+      clientId: options.clientId,
+      tokenClientAuthMethod: "none",
+      refreshToken: credentials.refreshToken,
+      fetchImpl: options.fetchImpl
+    });
+    return {
+      kind: "oauth2",
+      accessToken: refreshed.accessToken,
+      refreshToken: refreshed.refreshToken ?? credentials.refreshToken,
+      expiresAt: refreshed.expiresIn ? now() + refreshed.expiresIn * 1e3 : void 0
+    };
+  };
+  const executeRead2 = adapter.executeRead?.bind(adapter);
+  const executeMutation = adapter.executeMutation?.bind(adapter);
+  if (executeRead2) {
+    adapter.executeRead = async (invocation) => executeRead2(
+      await withFreshCalComCredentials(invocation, adapter, refreshes, now)
+    );
+  }
+  if (executeMutation) {
+    adapter.executeMutation = async (invocation) => executeMutation(
+      await withFreshCalComCredentials(invocation, adapter, refreshes, now)
+    );
+  }
+  return adapter;
+}
+async function withFreshCalComCredentials(invocation, adapter, refreshes, now) {
+  const credentials = invocation.source.credentials;
+  if (credentials.kind !== "oauth2") {
+    throw new CredentialsExpired("Cal.com requires OAuth2 credentials.", invocation.source.id);
+  }
+  if (!credentials.expiresAt || credentials.expiresAt > now() + 6e4) {
+    return invocation;
+  }
+  if (!credentials.refreshToken || !adapter.refreshToken) {
+    throw new CredentialsExpired(
+      "Cal.com access token expired and no refresh token is available.",
+      invocation.source.id
+    );
+  }
+  let refresh = refreshes.get(invocation.source.id);
+  if (!refresh) {
+    refresh = adapter.refreshToken(credentials);
+    refreshes.set(invocation.source.id, refresh);
+    const clear = () => {
+      if (refreshes.get(invocation.source.id) === refresh) {
+        refreshes.delete(invocation.source.id);
+      }
+    };
+    void refresh.then(clear, clear);
+  }
+  const rotated = await refresh;
+  await invocation.onCredentialsRotated?.(rotated);
+  return {
+    ...invocation,
+    source: {
+      ...invocation.source,
+      credentials: rotated
+    }
+  };
+}
 
 // src/connectors/adapters/calendly.ts
 var calendlyConnector = declarativeRestConnector({
@@ -27840,6 +29176,273 @@ var clickupConnector = declarativeRestConnector({
   ]
 });
 
+// src/connectors/adapters/cloudflare.ts
+var pagination = {
+  page: { type: "integer", minimum: 1 },
+  perPage: { type: "integer", minimum: 5, maximum: 50 }
+};
+var paginationQuery = { page: "{page}", per_page: "{perPage}" };
+var zoneId = {
+  zoneId: { type: "string", minLength: 1, description: "Cloudflare zone identifier." }
+};
+var recordId = {
+  recordId: { type: "string", minLength: 1, description: "Cloudflare DNS record identifier." }
+};
+var recordFields = {
+  type: {
+    type: "string",
+    enum: [
+      "A",
+      "AAAA",
+      "CAA",
+      "CERT",
+      "CNAME",
+      "DNSKEY",
+      "DS",
+      "HTTPS",
+      "LOC",
+      "MX",
+      "NAPTR",
+      "NS",
+      "OPENPGPKEY",
+      "PTR",
+      "SMIMEA",
+      "SRV",
+      "SSHFP",
+      "SVCB",
+      "TLSA",
+      "TXT",
+      "URI"
+    ]
+  },
+  name: { type: "string", minLength: 1, description: "Complete DNS record name." },
+  content: { type: "string", description: "Provider-native record content." },
+  ttl: {
+    type: "integer",
+    minimum: 1,
+    maximum: 86400,
+    description: "TTL in seconds. Use 1 for automatic."
+  },
+  proxied: { type: "boolean" },
+  priority: { type: "integer" },
+  comment: { type: ["string", "null"] },
+  tags: { type: "array", items: { type: "string" } },
+  data: { type: "object", description: "Provider-native structured data for records such as SRV or CAA." },
+  settings: { type: "object", description: "Provider-native DNS record settings." }
+};
+var cloudflareConnector = declarativeRestConnector({
+  kind: "cloudflare",
+  displayName: "Cloudflare",
+  description: "Inspect Cloudflare accounts and zones, then manage DNS records with a dedicated scoped API token.",
+  auth: {
+    kind: "api-key",
+    hint: "Create a dedicated Cloudflare API token for Tangle Integration Hub. Grant Account Settings Read, Zone Read, Zone Settings Read, and DNS Read or DNS Edit only on selected resources. Never reuse a Tangle deployment, Workers, Terraform, or infrastructure token."
+  },
+  category: "other",
+  defaultConsistencyModel: "authoritative",
+  baseUrl: "https://api.cloudflare.com/client/v4",
+  credentialPlacement: { kind: "bearer" },
+  test: {
+    method: "GET",
+    path: "/user/tokens/verify",
+    expectResponse: [
+      { path: "success", equals: true },
+      { path: "result.status", equals: "active" }
+    ]
+  },
+  capabilities: [
+    {
+      name: "auth.verify",
+      class: "read",
+      description: "Verify that the current API token is valid and active.",
+      parameters: { type: "object", properties: {} },
+      request: { method: "GET", path: "/user/tokens/verify" }
+    },
+    {
+      name: "accounts.get",
+      class: "read",
+      description: "Read one Cloudflare account and its settings.",
+      parameters: {
+        type: "object",
+        properties: { accountId: { type: "string", minLength: 1 } },
+        required: ["accountId"]
+      },
+      request: { method: "GET", path: "/accounts/{accountId}" }
+    },
+    {
+      name: "zones.list",
+      class: "read",
+      description: "List or filter zones by account, domain, status, and type.",
+      parameters: {
+        type: "object",
+        properties: {
+          ...pagination,
+          accountId: { type: "string" },
+          name: { type: "string" },
+          status: { type: "string", enum: ["initializing", "pending", "active", "moved"] },
+          type: { type: "string", description: "Comma-separated zone types." },
+          match: { type: "string", enum: ["any", "all"] },
+          order: { type: "string", enum: ["name", "status", "account.id", "account.name", "plan.id"] },
+          direction: { type: "string", enum: ["asc", "desc"] }
+        }
+      },
+      request: {
+        method: "GET",
+        path: "/zones",
+        query: {
+          ...paginationQuery,
+          "account.id": "{accountId}",
+          name: "{name}",
+          status: "{status}",
+          type: "{type}",
+          match: "{match}",
+          order: "{order}",
+          direction: "{direction}"
+        }
+      }
+    },
+    {
+      name: "zones.get",
+      class: "read",
+      description: "Read one zone with status, nameservers, plan, and ownership metadata.",
+      parameters: { type: "object", properties: zoneId, required: ["zoneId"] },
+      request: { method: "GET", path: "/zones/{zoneId}" }
+    },
+    {
+      name: "zones.settings.list",
+      class: "read",
+      description: "List all settings for one zone.",
+      parameters: { type: "object", properties: zoneId, required: ["zoneId"] },
+      request: { method: "GET", path: "/zones/{zoneId}/settings" }
+    },
+    {
+      name: "zones.settings.get",
+      class: "read",
+      description: "Read one setting for a zone.",
+      parameters: {
+        type: "object",
+        properties: {
+          ...zoneId,
+          settingId: { type: "string", minLength: 1 }
+        },
+        required: ["zoneId", "settingId"]
+      },
+      request: { method: "GET", path: "/zones/{zoneId}/settings/{settingId}" }
+    },
+    {
+      name: "dns.records.list",
+      class: "read",
+      description: "List and filter DNS records in one zone.",
+      parameters: {
+        type: "object",
+        properties: {
+          ...zoneId,
+          ...pagination,
+          type: { type: "string" },
+          name: { type: "string", description: "Exact record name." },
+          content: { type: "string", description: "Exact record content." },
+          proxied: { type: "boolean" },
+          match: { type: "string", enum: ["any", "all"] },
+          order: { type: "string", enum: ["type", "name", "content", "ttl", "proxied"] },
+          direction: { type: "string", enum: ["asc", "desc"] }
+        },
+        required: ["zoneId"]
+      },
+      request: {
+        method: "GET",
+        path: "/zones/{zoneId}/dns_records",
+        query: {
+          ...paginationQuery,
+          type: "{type}",
+          "name.exact": "{name}",
+          "content.exact": "{content}",
+          proxied: "{proxied}",
+          match: "{match}",
+          order: "{order}",
+          direction: "{direction}"
+        }
+      }
+    },
+    {
+      name: "dns.records.get",
+      class: "read",
+      description: "Read one DNS record by zone and record ID.",
+      parameters: {
+        type: "object",
+        properties: { ...zoneId, ...recordId },
+        required: ["zoneId", "recordId"]
+      },
+      request: { method: "GET", path: "/zones/{zoneId}/dns_records/{recordId}" }
+    },
+    {
+      name: "dns.records.export",
+      class: "read",
+      description: "Export the current zone records as a BIND zone file before a change.",
+      parameters: { type: "object", properties: zoneId, required: ["zoneId"] },
+      request: { method: "GET", path: "/zones/{zoneId}/dns_records/export" }
+    },
+    {
+      name: "dns.records.create",
+      class: "mutation",
+      description: "Create one DNS record in a selected zone.",
+      parameters: {
+        type: "object",
+        properties: {
+          ...zoneId,
+          record: {
+            type: "object",
+            properties: recordFields,
+            required: ["type", "name"],
+            additionalProperties: false
+          }
+        },
+        required: ["zoneId", "record"]
+      },
+      request: { method: "POST", path: "/zones/{zoneId}/dns_records", body: "{record}" },
+      cas: "none",
+      externalEffect: true
+    },
+    {
+      name: "dns.records.update",
+      class: "mutation",
+      description: "Partially update one DNS record.",
+      parameters: {
+        type: "object",
+        properties: {
+          ...zoneId,
+          ...recordId,
+          changes: {
+            type: "object",
+            properties: recordFields,
+            additionalProperties: false
+          }
+        },
+        required: ["zoneId", "recordId", "changes"]
+      },
+      request: {
+        method: "PATCH",
+        path: "/zones/{zoneId}/dns_records/{recordId}",
+        body: "{changes}"
+      },
+      cas: "optimistic-read-verify",
+      externalEffect: true
+    },
+    {
+      name: "dns.records.delete",
+      class: "mutation",
+      description: "Permanently delete one DNS record.",
+      parameters: {
+        type: "object",
+        properties: { ...zoneId, ...recordId },
+        required: ["zoneId", "recordId"]
+      },
+      request: { method: "DELETE", path: "/zones/{zoneId}/dns_records/{recordId}" },
+      cas: "optimistic-read-verify",
+      externalEffect: true
+    }
+  ]
+});
+
 // src/connectors/adapters/cloudinary.ts
 var cloudinaryConnector = declarativeRestConnector({
   kind: "cloudinary",
@@ -36164,134 +37767,6 @@ var frontConnector = declarativeRestConnector({
   ]
 });
 
-// src/connectors/oauth.ts
-import { createHash as createHash4, randomBytes } from "crypto";
-var PENDING_TTL_MS = 10 * 60 * 1e3;
-var InMemoryOAuthFlowStore = class {
-  pendingFlows = /* @__PURE__ */ new Map();
-  put(state, flow) {
-    this.pendingFlows.set(state, flow);
-  }
-  consume(state) {
-    const flow = this.pendingFlows.get(state);
-    this.pendingFlows.delete(state);
-    if (!flow || flow.expiresAt <= Date.now()) return void 0;
-    return flow;
-  }
-  sweep(now) {
-    for (const [k, v] of this.pendingFlows) {
-      if (v.expiresAt <= now) this.pendingFlows.delete(k);
-    }
-  }
-  clear() {
-    this.pendingFlows.clear();
-  }
-};
-var defaultFlowStore = new InMemoryOAuthFlowStore();
-function startOAuthFlow(input) {
-  const store = input.store ?? defaultFlowStore;
-  const now = input.now ?? Date.now();
-  store.sweep?.(now);
-  const codeVerifier = base64Url(randomBytes(48));
-  const codeChallenge = base64Url(createHash4("sha256").update(codeVerifier).digest());
-  const state = base64Url(randomBytes(24));
-  store.put(state, {
-    codeVerifier,
-    state,
-    projectId: input.projectId,
-    kind: input.kind,
-    label: input.label,
-    redirectUri: input.redirectUri,
-    expiresAt: now + PENDING_TTL_MS
-  });
-  const url = new URL(input.authorizationUrl);
-  url.searchParams.set("response_type", "code");
-  url.searchParams.set("client_id", input.clientId);
-  url.searchParams.set("redirect_uri", input.redirectUri);
-  url.searchParams.set("scope", input.scopes.join(input.scopeSeparator ?? " "));
-  url.searchParams.set("state", state);
-  url.searchParams.set("code_challenge", codeChallenge);
-  url.searchParams.set("code_challenge_method", "S256");
-  if (input.extraAuthParams) {
-    for (const [k, v] of Object.entries(input.extraAuthParams)) {
-      url.searchParams.set(k, v);
-    }
-  }
-  return { authorizationUrl: url.toString(), state };
-}
-async function consumePendingFlow(state, store = defaultFlowStore) {
-  await store.sweep?.(Date.now());
-  const flow = await store.consume(state);
-  if (!flow) {
-    throw new Error("Unknown or expired OAuth state: possible CSRF, replay, or stale flow");
-  }
-  return flow;
-}
-async function exchangeAuthorizationCode(input) {
-  const body = new URLSearchParams({
-    grant_type: "authorization_code",
-    client_id: input.clientId,
-    client_secret: input.clientSecret,
-    code: input.code,
-    redirect_uri: input.redirectUri,
-    code_verifier: input.codeVerifier
-  });
-  const res = await (input.fetchImpl ?? fetch)(input.tokenUrl, {
-    method: "POST",
-    headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
-    body,
-    signal: input.signal
-  });
-  if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`OAuth token exchange failed: ${res.status} ${res.statusText} \u2014 ${text.slice(0, 200)}`);
-  }
-  const json = await res.json();
-  return {
-    accessToken: json.access_token,
-    refreshToken: json.refresh_token,
-    expiresIn: json.expires_in,
-    scope: json.scope,
-    tokenType: json.token_type,
-    idToken: json.id_token
-  };
-}
-async function refreshAccessToken(input) {
-  const body = new URLSearchParams({
-    grant_type: "refresh_token",
-    client_id: input.clientId,
-    client_secret: input.clientSecret,
-    refresh_token: input.refreshToken
-  });
-  const res = await (input.fetchImpl ?? fetch)(input.tokenUrl, {
-    method: "POST",
-    headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
-    body,
-    signal: input.signal
-  });
-  if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`OAuth refresh failed: ${res.status} ${res.statusText} \u2014 ${text.slice(0, 200)}`);
-  }
-  const json = await res.json();
-  return {
-    accessToken: json.access_token,
-    // Some providers omit refresh_token on refresh — keep the previous one
-    // in that case (caller passes through if undefined).
-    refreshToken: json.refresh_token,
-    expiresIn: json.expires_in,
-    scope: json.scope,
-    tokenType: json.token_type,
-    idToken: json.id_token
-  };
-}
-function base64Url(buf) {
-  return buf.toString("base64").replace(/=+$/, "").replace(/\+/g, "-").replace(/\//g, "_");
-}
-function _resetPendingFlowsForTests() {
-  defaultFlowStore.clear?.();
-}
-
 // src/connectors/adapters/google-errors.ts
 var AUTH_REASONS = /* @__PURE__ */ new Set([
   "autherror",
@@ -38527,13 +40002,13 @@ var googlePubSubConnector = {
     let data4;
     switch (inv.capabilityName) {
       case "topics.list":
-        data4 = await pubSubRequest(credentials, inv, "GET", projectPath(credentials, "topics"), pagination(inv.args));
+        data4 = await pubSubRequest(credentials, inv, "GET", projectPath(credentials, "topics"), pagination2(inv.args));
         break;
       case "topics.get":
         data4 = await pubSubRequest(credentials, inv, "GET", topicPath(credentials, inv.args.topic));
         break;
       case "subscriptions.list":
-        data4 = await pubSubRequest(credentials, inv, "GET", projectPath(credentials, "subscriptions"), pagination(inv.args));
+        data4 = await pubSubRequest(credentials, inv, "GET", projectPath(credentials, "subscriptions"), pagination2(inv.args));
         break;
       case "subscriptions.get":
         data4 = await pubSubRequest(credentials, inv, "GET", subscriptionPath(credentials, inv.args.subscription));
@@ -38817,7 +40292,7 @@ function resourceId(value, field) {
   }
   return id2;
 }
-function pagination(args) {
+function pagination2(args) {
   const query2 = new URLSearchParams();
   if (args.pageSize !== void 0) query2.set("pageSize", String(boundedInteger2(args.pageSize, "pageSize", 1, 1e3)));
   if (args.pageToken !== void 0) query2.set("pageToken", requiredString6(args.pageToken, "pageToken"));
@@ -38969,8 +40444,8 @@ function retryAfterMs5(value) {
   if (!value) return 6e4;
   const seconds = Number(value);
   if (Number.isFinite(seconds) && seconds >= 0) return seconds * 1e3;
-  const date = Date.parse(value);
-  return Number.isFinite(date) ? Math.max(0, date - Date.now()) : 6e4;
+  const date2 = Date.parse(value);
+  return Number.isFinite(date2) ? Math.max(0, date2 - Date.now()) : 6e4;
 }
 function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -41903,25 +43378,25 @@ async function updateRow(inv, accessToken4, timeoutMs) {
   const meta = readSheetMeta(inv.source.metadata);
   const { rowKey, patch, expectedFingerprint } = inv.args;
   const rows = await fetchAllRows(accessToken4, meta);
-  const target = rows.find((r) => normalizeKey(r.values[meta.keyColumn]) === normalizeKey(rowKey));
-  if (!target) {
+  const target2 = rows.find((r) => normalizeKey(r.values[meta.keyColumn]) === normalizeKey(rowKey));
+  if (!target2) {
     throw new ResourceContention(
       `row with key "${rowKey}" not found`,
       [],
       { availableRows: rows.length }
     );
   }
-  if (expectedFingerprint && expectedFingerprint !== target.fingerprint) {
+  if (expectedFingerprint && expectedFingerprint !== target2.fingerprint) {
     throw new ResourceContention(
       `row "${rowKey}" was modified since the agent last read it; re-read and try again`,
       [],
-      { current: target.values, currentFingerprint: target.fingerprint }
+      { current: target2.values, currentFingerprint: target2.fingerprint }
     );
   }
   const updatedValues = meta.headers.map(
-    (h) => h in patch ? String(patch[h]) : target.values[h] ?? ""
+    (h) => h in patch ? String(patch[h]) : target2.values[h] ?? ""
   );
-  const range = `${meta.sheetName}!A${target.rowIndex + 1}:${columnIndexToLetter(meta.headers.length - 1)}${target.rowIndex + 1}`;
+  const range = `${meta.sheetName}!A${target2.rowIndex + 1}:${columnIndexToLetter(meta.headers.length - 1)}${target2.rowIndex + 1}`;
   const url = `https://sheets.googleapis.com/v4/spreadsheets/${encodeURIComponent(meta.spreadsheetId)}/values/${encodeURIComponent(range)}?valueInputOption=USER_ENTERED`;
   const res = await fetch(url, {
     method: "PUT",
@@ -44534,9 +46009,9 @@ function parseRetryAfterMs(header2) {
   if (!header2) return 1e3;
   const seconds = Number(header2);
   if (Number.isFinite(seconds) && seconds >= 0) return Math.floor(seconds * 1e3);
-  const date = Date.parse(header2);
-  if (!Number.isFinite(date)) return 1e3;
-  return Math.max(0, date - Date.now());
+  const date2 = Date.parse(header2);
+  if (!Number.isFinite(date2)) return 1e3;
+  return Math.max(0, date2 - Date.now());
 }
 function stringify2(value) {
   if (typeof value === "string") return value;
@@ -49683,7 +51158,7 @@ function microsoftCalendar(opts) {
   return adapter;
 }
 async function getScheduleBusy(input) {
-  const target = input.userPrincipal === "me" ? "me" : input.userPrincipal;
+  const target2 = input.userPrincipal === "me" ? "me" : input.userPrincipal;
   const url = "https://graph.microsoft.com/v1.0/me/calendar/getSchedule";
   const res = await fetch(url, {
     method: "POST",
@@ -49692,7 +51167,7 @@ async function getScheduleBusy(input) {
       "content-type": "application/json"
     },
     body: JSON.stringify({
-      schedules: [target],
+      schedules: [target2],
       startTime: { dateTime: input.timeMin, timeZone: "UTC" },
       endTime: { dateTime: input.timeMax, timeZone: "UTC" },
       availabilityViewInterval: 30
@@ -54684,6 +56159,9 @@ function notion(opts) {
       if (!clientId || !clientSecret) {
         throw new Error("Notion OAuth client not configured (NOTION_OAUTH_CLIENT_ID / _SECRET)");
       }
+      if (!input.codeVerifier) {
+        throw new Error("notion.exchangeOAuth: missing PKCE code verifier");
+      }
       const body = new URLSearchParams({
         grant_type: "authorization_code",
         code: input.code,
@@ -61455,9 +62933,9 @@ function mutablePath(rootPath, value) {
 }
 async function canonicalizeExistingPath(client, configuredRoot, path) {
   const root = posix.normalize(await client.realPath(configuredRoot));
-  const target = posix.normalize(await client.realPath(path));
-  assertWithinCanonicalRoot(root, target);
-  return target;
+  const target2 = posix.normalize(await client.realPath(path));
+  assertWithinCanonicalRoot(root, target2);
+  return target2;
 }
 async function canonicalizeDestinationPath(client, configuredRoot, path) {
   const root = posix.normalize(await client.realPath(configuredRoot));
@@ -61479,8 +62957,8 @@ async function canonicalizeDestinationPath(client, configuredRoot, path) {
   assertWithinCanonicalRoot(root, destination);
   return destination;
 }
-function assertWithinCanonicalRoot(root, target) {
-  if (root !== "/" && target !== root && !target.startsWith(`${root}/`)) {
+function assertWithinCanonicalRoot(root, target2) {
+  if (root !== "/" && target2 !== root && !target2.startsWith(`${root}/`)) {
     throw new Error("SFTP path resolves outside the configured root");
   }
 }
@@ -67939,6 +69417,9 @@ function twitter(opts) {
       if (!clientId || !clientSecret) {
         throw new Error("Twitter OAuth client not configured (TWITTER_OAUTH_CLIENT_ID / _SECRET)");
       }
+      if (!input.codeVerifier) {
+        throw new Error("twitter.exchangeOAuth: missing PKCE code verifier");
+      }
       const tokens = await twitterTokenRequest(clientId, clientSecret, {
         grant_type: "authorization_code",
         code: input.code,
@@ -67999,6 +69480,733 @@ async function twitterTokenRequest(clientId, clientSecret, params) {
   };
 }
 
+// src/connectors/adapters/tiktok.ts
+var AUTHORIZATION_URL = "https://www.tiktok.com/v2/auth/authorize/";
+var TOKEN_URL20 = "https://open.tiktokapis.com/v2/oauth/token/";
+var API_BASE_URL = "https://open.tiktokapis.com";
+var SCOPES14 = ["user.info.basic", "video.list", "video.publish"];
+var VIDEO_FIELDS = [
+  "id",
+  "create_time",
+  "cover_image_url",
+  "share_url",
+  "video_description",
+  "duration",
+  "height",
+  "width",
+  "title",
+  "embed_link",
+  "like_count",
+  "comment_count",
+  "share_count",
+  "view_count"
+].join(",");
+var PRIVACY_LEVELS = [
+  "PUBLIC_TO_EVERYONE",
+  "MUTUAL_FOLLOW_FRIENDS",
+  "FOLLOWER_OF_CREATOR",
+  "SELF_ONLY"
+];
+var jsonPostHeaders = {
+  "content-type": "application/json; charset=UTF-8"
+};
+var TIKTOK_SPEC = {
+  kind: "tiktok",
+  displayName: "TikTok",
+  description: "Read the connected TikTok profile and videos, then publish approved videos or photo posts from verified HTTPS URLs.",
+  auth: {
+    kind: "oauth2",
+    authorizationUrl: AUTHORIZATION_URL,
+    tokenUrl: TOKEN_URL20,
+    scopes: [...SCOPES14],
+    scopeSeparator: ",",
+    pkce: "unsupported",
+    authorizationClientIdParam: "client_key",
+    tokenClientIdParam: "client_key",
+    tokenClientSecretParam: "client_secret",
+    clientIdEnv: "TIKTOK_OAUTH_CLIENT_KEY",
+    clientSecretEnv: "TIKTOK_OAUTH_CLIENT_SECRET",
+    tokenMetadata: { openId: "open_id" }
+  },
+  category: "comms",
+  defaultConsistencyModel: "advisory",
+  baseUrl: API_BASE_URL,
+  credentialsExpiredStatuses: [401],
+  test: {
+    method: "GET",
+    path: "/v2/user/info/",
+    query: { fields: "open_id,union_id,avatar_url,display_name" }
+  },
+  capabilities: [
+    {
+      name: "user.info",
+      class: "read",
+      description: "Read the connected TikTok account identity, display name, and avatar.",
+      parameters: { type: "object", properties: {} },
+      requiredScopes: ["user.info.basic"],
+      request: {
+        method: "GET",
+        path: "/v2/user/info/",
+        query: { fields: "open_id,union_id,avatar_url,display_name" }
+      }
+    },
+    {
+      name: "videos.list",
+      class: "read",
+      description: "List videos for the connected creator, including public URLs, dimensions, duration, and engagement counts.",
+      parameters: {
+        type: "object",
+        properties: {
+          cursor: {
+            type: "integer",
+            minimum: 0,
+            description: "UTC millisecond cursor returned by the previous page."
+          },
+          max_count: {
+            type: "integer",
+            minimum: 1,
+            maximum: 20,
+            default: 10
+          }
+        }
+      },
+      requiredScopes: ["video.list"],
+      request: {
+        method: "POST",
+        path: "/v2/video/list/",
+        query: { fields: VIDEO_FIELDS },
+        headers: jsonPostHeaders,
+        body: { cursor: "{cursor}", max_count: "{max_count}" }
+      }
+    },
+    {
+      name: "videos.query",
+      class: "read",
+      description: "Read up to 20 TikTok videos by their exact video ids.",
+      parameters: {
+        type: "object",
+        properties: {
+          video_ids: {
+            type: "array",
+            minItems: 1,
+            maxItems: 20,
+            uniqueItems: true,
+            items: { type: "string", minLength: 1 }
+          }
+        },
+        required: ["video_ids"]
+      },
+      requiredScopes: ["video.list"],
+      request: {
+        method: "POST",
+        path: "/v2/video/query/",
+        query: { fields: VIDEO_FIELDS },
+        headers: jsonPostHeaders,
+        body: { filters: { video_ids: "{video_ids}" } }
+      }
+    },
+    {
+      name: "publishing.creatorInfo",
+      class: "read",
+      description: "Read the latest creator posting limits, privacy choices, and interaction settings before presenting a publish confirmation.",
+      parameters: { type: "object", properties: {} },
+      requiredScopes: ["video.publish"],
+      request: {
+        method: "POST",
+        path: "/v2/post/publish/creator_info/query/",
+        headers: jsonPostHeaders,
+        body: {}
+      }
+    },
+    {
+      name: "publishing.status",
+      class: "read",
+      description: "Read processing, moderation, and publication status for one publish request.",
+      parameters: {
+        type: "object",
+        properties: {
+          publish_id: { type: "string", minLength: 1, maxLength: 64 }
+        },
+        required: ["publish_id"]
+      },
+      requiredScopes: ["video.publish"],
+      request: {
+        method: "POST",
+        path: "/v2/post/publish/status/fetch/",
+        headers: jsonPostHeaders,
+        body: { publish_id: "{publish_id}" }
+      }
+    },
+    {
+      name: "publishing.videoFromUrl",
+      class: "mutation",
+      description: "Directly publish one approved video from an app-verified HTTPS URL. The adapter refreshes creator limits before it sends the post.",
+      parameters: {
+        type: "object",
+        properties: {
+          video_url: {
+            type: "string",
+            format: "uri",
+            pattern: "^https://",
+            description: "Public HTTPS URL covered by the domain or URL prefix verified in the TikTok app."
+          },
+          video_duration_sec: {
+            type: "number",
+            exclusiveMinimum: 0,
+            description: "Measured video duration used to enforce the creator-specific limit."
+          },
+          privacy_level: { type: "string", enum: [...PRIVACY_LEVELS] },
+          title: { type: "string", maxLength: 2200 },
+          disable_duet: { type: "boolean" },
+          disable_comment: { type: "boolean" },
+          disable_stitch: { type: "boolean" },
+          video_cover_timestamp_ms: { type: "integer", minimum: 0 },
+          brand_content_toggle: {
+            type: "boolean",
+            description: "True for a paid partnership that promotes a third-party business."
+          },
+          brand_organic_toggle: {
+            type: "boolean",
+            description: "True when the post promotes the creator's own business."
+          },
+          is_aigc: {
+            type: "boolean",
+            description: "True when TikTok must label the video as AI-generated content."
+          }
+        },
+        required: [
+          "video_url",
+          "video_duration_sec",
+          "privacy_level",
+          "disable_duet",
+          "disable_comment",
+          "disable_stitch",
+          "brand_content_toggle",
+          "brand_organic_toggle"
+        ]
+      },
+      requiredScopes: ["video.publish"],
+      request: {
+        method: "POST",
+        path: "/v2/post/publish/video/init/",
+        headers: jsonPostHeaders,
+        body: {
+          post_info: {
+            title: "{title}",
+            privacy_level: "{privacy_level}",
+            disable_duet: "{disable_duet}",
+            disable_comment: "{disable_comment}",
+            disable_stitch: "{disable_stitch}",
+            video_cover_timestamp_ms: "{video_cover_timestamp_ms}",
+            brand_content_toggle: "{brand_content_toggle}",
+            brand_organic_toggle: "{brand_organic_toggle}",
+            is_aigc: "{is_aigc}"
+          },
+          source_info: {
+            source: "PULL_FROM_URL",
+            video_url: "{video_url}"
+          }
+        }
+      },
+      cas: "none",
+      externalEffect: true
+    },
+    {
+      name: "publishing.photosFromUrls",
+      class: "mutation",
+      description: "Directly publish 1\u201335 approved photos from app-verified HTTPS URLs. The adapter refreshes creator options before it sends the post.",
+      parameters: {
+        type: "object",
+        properties: {
+          photo_images: {
+            type: "array",
+            minItems: 1,
+            maxItems: 35,
+            items: { type: "string", format: "uri", pattern: "^https://" }
+          },
+          photo_cover_index: { type: "integer", minimum: 0 },
+          privacy_level: { type: "string", enum: [...PRIVACY_LEVELS] },
+          title: { type: "string", maxLength: 90 },
+          description: { type: "string", maxLength: 4e3 },
+          disable_comment: { type: "boolean" },
+          auto_add_music: { type: "boolean" },
+          brand_content_toggle: {
+            type: "boolean",
+            description: "True for a paid partnership that promotes a third-party business."
+          },
+          brand_organic_toggle: {
+            type: "boolean",
+            description: "True when the post promotes the creator's own business."
+          }
+        },
+        required: [
+          "photo_images",
+          "photo_cover_index",
+          "privacy_level",
+          "disable_comment",
+          "auto_add_music",
+          "brand_content_toggle",
+          "brand_organic_toggle"
+        ]
+      },
+      requiredScopes: ["video.publish"],
+      request: {
+        method: "POST",
+        path: "/v2/post/publish/content/init/",
+        headers: jsonPostHeaders,
+        body: {
+          media_type: "PHOTO",
+          post_mode: "DIRECT_POST",
+          post_info: {
+            title: "{title}",
+            description: "{description}",
+            privacy_level: "{privacy_level}",
+            disable_comment: "{disable_comment}",
+            auto_add_music: "{auto_add_music}",
+            brand_content_toggle: "{brand_content_toggle}",
+            brand_organic_toggle: "{brand_organic_toggle}"
+          },
+          source_info: {
+            source: "PULL_FROM_URL",
+            photo_images: "{photo_images}",
+            photo_cover_index: "{photo_cover_index}"
+          }
+        }
+      },
+      cas: "none",
+      externalEffect: true
+    }
+  ]
+};
+var tiktokConnector = createTikTokConnector();
+function tiktok(options) {
+  const adapter = createTikTokConnector();
+  const inFlightRefreshes = /* @__PURE__ */ new Map();
+  const refresh = async (credentials) => {
+    assertOAuthClient(options);
+    if (credentials.kind !== "oauth2" || !credentials.refreshToken) {
+      throw new Error("tiktok.refreshToken: missing refresh token");
+    }
+    const token = await tiktokTokenRequest(
+      options,
+      {
+        grant_type: "refresh_token",
+        refresh_token: credentials.refreshToken
+      },
+      [credentials.refreshToken]
+    );
+    if (!token.expiresIn) {
+      throw new Error("tiktok token request returned an incomplete refresh grant");
+    }
+    return {
+      ...tokenCredentials(token),
+      refreshToken: token.refreshToken ?? credentials.refreshToken
+    };
+  };
+  const withFreshCredentials = async (invocation) => {
+    const credentials = invocation.source.credentials;
+    if (credentials.kind !== "oauth2") return invocation;
+    if (credentials.expiresAt !== void 0 && credentials.expiresAt > Date.now() + 6e4) {
+      return invocation;
+    }
+    if (!credentials.refreshToken) {
+      throw new CredentialsExpired(
+        "TikTok access token expired and no refresh token is available",
+        invocation.source.id
+      );
+    }
+    let pending = inFlightRefreshes.get(invocation.source.id);
+    if (!pending) {
+      let next;
+      const promise = Promise.resolve().then(() => {
+        if (!next.onCredentialsRotated) {
+          throw new Error(
+            "tiktok: credential rotation persistence callback is required before refreshing"
+          );
+        }
+        return refresh(credentials);
+      });
+      next = {
+        promise,
+        onCredentialsRotated: invocation.onCredentialsRotated
+      };
+      pending = next;
+      inFlightRefreshes.set(invocation.source.id, pending);
+    } else if (!pending.onCredentialsRotated && invocation.onCredentialsRotated) {
+      pending.onCredentialsRotated = invocation.onCredentialsRotated;
+    }
+    const current = pending;
+    try {
+      const refreshed = await current.promise;
+      current.persistence ??= Promise.resolve().then(
+        () => current.onCredentialsRotated?.(refreshed)
+      );
+      await current.persistence;
+      return {
+        ...invocation,
+        source: { ...invocation.source, credentials: refreshed }
+      };
+    } finally {
+      if (inFlightRefreshes.get(invocation.source.id) === current) {
+        inFlightRefreshes.delete(invocation.source.id);
+      }
+    }
+  };
+  return {
+    ...adapter,
+    async executeRead(invocation) {
+      return adapter.executeRead(await withFreshCredentials(invocation));
+    },
+    async executeMutation(invocation) {
+      return adapter.executeMutation(await withFreshCredentials(invocation));
+    },
+    async test(source, onCredentialsRotated) {
+      try {
+        const invocation = await withFreshCredentials({
+          source,
+          capabilityName: "user.info",
+          args: {},
+          idempotencyKey: "tiktok-connection-test",
+          onCredentialsRotated
+        });
+        return adapter.test(invocation.source);
+      } catch (error) {
+        return {
+          ok: false,
+          reason: error instanceof Error ? error.message : "unknown error"
+        };
+      }
+    },
+    async exchangeOAuth(input) {
+      assertOAuthClient(options);
+      const token = await tiktokTokenRequest(
+        options,
+        {
+          grant_type: "authorization_code",
+          code: input.code,
+          redirect_uri: input.redirectUri
+        },
+        [input.code]
+      );
+      const grant = requireTikTokAuthorizationGrant(token);
+      return {
+        credentials: tokenCredentials(grant),
+        scopes: grant.scopes,
+        metadata: { openId: grant.openId }
+      };
+    },
+    refreshToken: refresh
+  };
+}
+function createTikTokConnector() {
+  const base = declarativeRestConnector(TIKTOK_SPEC);
+  const executeRead2 = async (invocation) => {
+    const result = await base.executeRead(invocation);
+    assertTikTokEnvelope(
+      result.data,
+      invocation.capabilityName,
+      invocation.source.credentials
+    );
+    return result;
+  };
+  return {
+    ...base,
+    executeRead: executeRead2,
+    async executeMutation(invocation) {
+      validatePublishInput(invocation);
+      const creator = await executeRead2({
+        ...invocation,
+        capabilityName: "publishing.creatorInfo",
+        args: {}
+      });
+      validateCreatorLimits(invocation, creator.data);
+      const result = await base.executeMutation(invocation);
+      if (result.status === "committed") {
+        assertTikTokPublishResult(
+          result.data,
+          invocation.capabilityName,
+          invocation.source.credentials
+        );
+      }
+      return result;
+    },
+    async test(source) {
+      try {
+        await executeRead2({
+          source,
+          capabilityName: "user.info",
+          args: {},
+          idempotencyKey: "tiktok-connection-test"
+        });
+        return { ok: true };
+      } catch (error) {
+        return {
+          ok: false,
+          reason: error instanceof Error ? error.message : "unknown error"
+        };
+      }
+    }
+  };
+}
+function validatePublishInput(invocation) {
+  if (invocation.capabilityName === "publishing.videoFromUrl") {
+    const url = requiredString7(invocation.args, "video_url");
+    requireHttpsUrl(url, "video_url");
+    const duration2 = requiredNumber(invocation.args, "video_duration_sec");
+    if (duration2 <= 0) throw new Error("tiktok: video_duration_sec must be greater than zero");
+    requiredPrivacy(invocation.args);
+    requiredBoolean(invocation.args, "disable_duet");
+    requiredBoolean(invocation.args, "disable_comment");
+    requiredBoolean(invocation.args, "disable_stitch");
+    requiredBoolean(invocation.args, "brand_content_toggle");
+    requiredBoolean(invocation.args, "brand_organic_toggle");
+    optionalUtf16Length(invocation.args, "title", 2200);
+    return;
+  }
+  if (invocation.capabilityName === "publishing.photosFromUrls") {
+    const photos = invocation.args.photo_images;
+    if (!Array.isArray(photos) || photos.length < 1 || photos.length > 35) {
+      throw new Error("tiktok: photo_images must contain between 1 and 35 URLs");
+    }
+    for (const [index, value] of photos.entries()) {
+      if (typeof value !== "string") {
+        throw new Error(`tiktok: photo_images[${index}] must be a string`);
+      }
+      requireHttpsUrl(value, `photo_images[${index}]`);
+    }
+    const cover = requiredNumber(invocation.args, "photo_cover_index");
+    if (!Number.isInteger(cover) || cover < 0 || cover >= photos.length) {
+      throw new Error("tiktok: photo_cover_index must identify one supplied photo");
+    }
+    requiredPrivacy(invocation.args);
+    requiredBoolean(invocation.args, "disable_comment");
+    requiredBoolean(invocation.args, "auto_add_music");
+    requiredBoolean(invocation.args, "brand_content_toggle");
+    requiredBoolean(invocation.args, "brand_organic_toggle");
+    optionalUtf16Length(invocation.args, "title", 90);
+    optionalUtf16Length(invocation.args, "description", 4e3);
+    return;
+  }
+  throw new Error(`tiktok: unknown mutation capability ${invocation.capabilityName}`);
+}
+function validateCreatorLimits(invocation, envelope) {
+  const data4 = readEnvelopeData(envelope, "publishing.creatorInfo");
+  const privacy = requiredString7(invocation.args, "privacy_level");
+  const choices = data4.privacy_level_options;
+  if (!Array.isArray(choices) || !choices.every((value) => typeof value === "string")) {
+    throw new Error("tiktok publishing.creatorInfo returned invalid privacy_level_options");
+  }
+  if (!choices.includes(privacy)) {
+    throw new Error(`tiktok: privacy_level ${privacy} is unavailable for this creator`);
+  }
+  requireDisabledInteraction(invocation.args, data4, "disable_comment", "comment_disabled");
+  if (invocation.capabilityName === "publishing.videoFromUrl") {
+    requireDisabledInteraction(invocation.args, data4, "disable_duet", "duet_disabled");
+    requireDisabledInteraction(invocation.args, data4, "disable_stitch", "stitch_disabled");
+    const maximum = data4.max_video_post_duration_sec;
+    if (typeof maximum !== "number" || !Number.isFinite(maximum) || maximum <= 0) {
+      throw new Error("tiktok publishing.creatorInfo returned an invalid video-duration limit");
+    }
+    const duration2 = requiredNumber(invocation.args, "video_duration_sec");
+    if (duration2 > maximum) {
+      throw new Error(
+        `tiktok: video duration ${duration2}s exceeds this creator's ${maximum}s limit`
+      );
+    }
+  }
+}
+function assertTikTokEnvelope(value, capabilityName, credentials) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`tiktok ${capabilityName} returned a malformed response`);
+  }
+  const error = value.error;
+  if (!error || typeof error !== "object" || Array.isArray(error)) {
+    throw new Error(`tiktok ${capabilityName} returned no error status`);
+  }
+  const code = error.code;
+  if (code !== "ok") {
+    const message = error.message;
+    const detail = typeof message === "string" && message ? ` \u2014 ${redact2(message.slice(0, 200), credentialValues(credentials))}` : "";
+    const safeCode = redact2(
+      safeProviderValue(code),
+      credentialValues(credentials)
+    );
+    throw new Error(`tiktok ${capabilityName} failed: ${safeCode}${detail}`);
+  }
+}
+function requireDisabledInteraction(args, creator, argumentName, creatorField) {
+  const disabled = creator[creatorField];
+  if (typeof disabled !== "boolean") {
+    throw new Error(`tiktok publishing.creatorInfo returned invalid ${creatorField}`);
+  }
+  if (disabled && args[argumentName] !== true) {
+    throw new Error(
+      `tiktok: ${argumentName} must be true because the creator disabled this interaction`
+    );
+  }
+}
+function readEnvelopeData(envelope, capabilityName, credentials) {
+  assertTikTokEnvelope(envelope, capabilityName, credentials);
+  const data4 = envelope.data;
+  if (!data4 || typeof data4 !== "object" || Array.isArray(data4)) {
+    throw new Error(`tiktok ${capabilityName} returned malformed data`);
+  }
+  return data4;
+}
+function assertTikTokPublishResult(envelope, capabilityName, credentials) {
+  const data4 = readEnvelopeData(envelope, capabilityName, credentials);
+  const publishId = data4.publish_id;
+  if (typeof publishId !== "string" || !publishId.trim() || publishId.length > 64) {
+    throw new Error(`tiktok ${capabilityName} returned an invalid publish_id`);
+  }
+}
+function requiredString7(args, name) {
+  const value = args[name];
+  if (typeof value !== "string" || !value) {
+    throw new Error(`tiktok: missing required argument: ${name}`);
+  }
+  return value;
+}
+function requiredNumber(args, name) {
+  const value = args[name];
+  if (typeof value !== "number" || !Number.isFinite(value)) {
+    throw new Error(`tiktok: missing required argument: ${name}`);
+  }
+  return value;
+}
+function requiredBoolean(args, name) {
+  const value = args[name];
+  if (typeof value !== "boolean") {
+    throw new Error(`tiktok: missing required argument: ${name}`);
+  }
+  return value;
+}
+function requiredPrivacy(args) {
+  const value = requiredString7(args, "privacy_level");
+  if (!PRIVACY_LEVELS.includes(value)) {
+    throw new Error(`tiktok: unsupported privacy_level ${value}`);
+  }
+  return value;
+}
+function optionalUtf16Length(args, name, maximum) {
+  const value = args[name];
+  if (value === void 0) return;
+  if (typeof value !== "string") throw new Error(`tiktok: ${name} must be a string`);
+  if (value.length > maximum) {
+    throw new Error(`tiktok: ${name} exceeds the ${maximum} UTF-16-unit limit`);
+  }
+}
+function requireHttpsUrl(value, name) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error(`tiktok: ${name} must be a valid HTTPS URL`);
+  }
+  if (url.protocol !== "https:" || url.username || url.password) {
+    throw new Error(`tiktok: ${name} must be a valid HTTPS URL`);
+  }
+}
+async function tiktokTokenRequest(options, grant, extraRedactions) {
+  const body = new URLSearchParams({
+    client_key: options.clientId,
+    client_secret: options.clientSecret,
+    ...grant
+  });
+  let response;
+  try {
+    response = await fetch(TOKEN_URL20, {
+      method: "POST",
+      headers: {
+        accept: "application/json",
+        "content-type": "application/x-www-form-urlencoded",
+        "cache-control": "no-cache"
+      },
+      body,
+      signal: AbortSignal.timeout(15e3)
+    });
+  } catch (cause) {
+    const message = cause instanceof Error ? cause.message : "unknown transport error";
+    throw new Error(`tiktok token request failed: ${redact2(message, [options.clientId, options.clientSecret, ...extraRedactions])}`);
+  }
+  if (!response.ok) {
+    const detail = await response.text().catch(() => "");
+    throw new Error(
+      `tiktok token request failed: ${response.status} ${response.statusText} \u2014 ${redact2(
+        detail.slice(0, 300),
+        [options.clientId, options.clientSecret, ...extraRedactions]
+      )}`
+    );
+  }
+  const json = await response.json();
+  if (typeof json.access_token !== "string" || !json.access_token) {
+    throw new Error("tiktok token request returned no access_token");
+  }
+  return {
+    accessToken: json.access_token,
+    refreshToken: typeof json.refresh_token === "string" && json.refresh_token ? json.refresh_token : void 0,
+    expiresIn: typeof json.expires_in === "number" && json.expires_in > 0 ? json.expires_in : void 0,
+    scope: typeof json.scope === "string" ? json.scope : void 0,
+    openId: typeof json.open_id === "string" ? json.open_id : void 0
+  };
+}
+function tokenCredentials(token) {
+  return {
+    kind: "oauth2",
+    accessToken: token.accessToken,
+    refreshToken: token.refreshToken,
+    expiresAt: token.expiresIn ? Date.now() + token.expiresIn * 1e3 : void 0
+  };
+}
+function requireTikTokAuthorizationGrant(token) {
+  const scopes2 = token.scope ? splitScopes(token.scope) : [];
+  if (!token.refreshToken || !token.expiresIn || !token.openId || scopes2.length === 0) {
+    throw new Error(
+      "tiktok token request returned an incomplete authorization grant"
+    );
+  }
+  return { ...token, scopes: scopes2 };
+}
+function splitScopes(scope) {
+  return scope.split(",").map((value) => value.trim()).filter(Boolean);
+}
+function assertOAuthClient(options) {
+  if (!options.clientId || !options.clientSecret) {
+    throw new Error(
+      "TikTok OAuth client not configured (TIKTOK_OAUTH_CLIENT_KEY / TIKTOK_OAUTH_CLIENT_SECRET)"
+    );
+  }
+}
+function redact2(value, secrets) {
+  let redacted = value;
+  for (const secret of secrets) {
+    if (!secret) continue;
+    redacted = redacted.split(secret).join("[REDACTED]");
+  }
+  return redacted;
+}
+function credentialValues(credentials) {
+  if (!credentials) return [];
+  switch (credentials.kind) {
+    case "oauth2":
+      return [credentials.accessToken, credentials.refreshToken ?? ""];
+    case "api-key":
+      return [credentials.apiKey];
+    case "hmac":
+      return [credentials.secret];
+    case "custom":
+      return Object.values(credentials.values).filter(
+        (value) => typeof value === "string"
+      );
+    case "none":
+      return [];
+  }
+}
+function safeProviderValue(value) {
+  if (typeof value === "string") return value.slice(0, 80);
+  return "unknown_error";
+}
+
 // src/connectors/adapters/twilio-sms.ts
 var API11 = "https://api.twilio.com/2010-04-01";
 var LOOKUP_API = "https://lookups.twilio.com/v1";
@@ -68459,9 +70667,9 @@ var voucheryIoConnector = declarativeRestConnector({
 });
 
 // src/connectors/adapters/whatsapp-business.ts
-var SCOPES14 = ["whatsapp_business_messaging", "whatsapp_business_management", "business_management"];
+var SCOPES15 = ["whatsapp_business_messaging", "whatsapp_business_management", "business_management"];
 var AUTH_URL18 = "https://www.facebook.com/v21.0/dialog/oauth";
-var TOKEN_URL20 = "https://graph.facebook.com/v21.0/oauth/access_token";
+var TOKEN_URL21 = "https://graph.facebook.com/v21.0/oauth/access_token";
 var API12 = "https://graph.facebook.com/v21.0";
 function whatsappBusiness(opts) {
   const { clientId, clientSecret } = opts;
@@ -68473,8 +70681,8 @@ function whatsappBusiness(opts) {
       auth: {
         kind: "oauth2",
         authorizationUrl: AUTH_URL18,
-        tokenUrl: TOKEN_URL20,
-        scopes: SCOPES14,
+        tokenUrl: TOKEN_URL21,
+        scopes: SCOPES15,
         clientIdEnv: "WHATSAPP_BUSINESS_OAUTH_CLIENT_ID",
         clientSecretEnv: "WHATSAPP_BUSINESS_OAUTH_CLIENT_SECRET"
       },
@@ -68744,7 +70952,7 @@ function whatsappBusiness(opts) {
         throw new Error("WhatsApp Business OAuth client not configured (WHATSAPP_BUSINESS_OAUTH_CLIENT_ID / _SECRET)");
       }
       const tokens = await exchangeAuthorizationCode({
-        tokenUrl: TOKEN_URL20,
+        tokenUrl: TOKEN_URL21,
         clientId,
         clientSecret,
         code: input.code,
@@ -68760,7 +70968,7 @@ function whatsappBusiness(opts) {
           refreshToken: tokens.refreshToken,
           expiresAt: tokens.expiresIn ? Date.now() + tokens.expiresIn * 1e3 : void 0
         },
-        scopes: tokens.scope?.split(/[,\s]+/) ?? SCOPES14,
+        scopes: tokens.scope?.split(/[,\s]+/) ?? SCOPES15,
         metadata: {}
       };
     },
@@ -78031,8 +80239,8 @@ var discourseConnector = declarativeRestConnector({
 });
 
 // src/connectors/adapters/digital-ocean.ts
-var pagination2 = { page: { type: "integer", minimum: 1 }, perPage: { type: "integer", minimum: 1, maximum: 200 } };
-var paginationQuery = { page: "{page}", per_page: "{perPage}" };
+var pagination3 = { page: { type: "integer", minimum: 1 }, perPage: { type: "integer", minimum: 1, maximum: 200 } };
+var paginationQuery2 = { page: "{page}", per_page: "{perPage}" };
 var digitalOceanConnector = declarativeRestConnector({
   kind: "digital-ocean",
   displayName: "DigitalOcean",
@@ -78045,24 +80253,24 @@ var digitalOceanConnector = declarativeRestConnector({
   test: { method: "GET", path: "/v2/account" },
   capabilities: [
     { name: "account.get", class: "read", description: "Read the current account and status.", parameters: { type: "object", properties: {} }, request: { method: "GET", path: "/v2/account" } },
-    { name: "projects.list", class: "read", description: "List projects.", parameters: { type: "object", properties: pagination2 }, request: { method: "GET", path: "/v2/projects", query: paginationQuery } },
+    { name: "projects.list", class: "read", description: "List projects.", parameters: { type: "object", properties: pagination3 }, request: { method: "GET", path: "/v2/projects", query: paginationQuery2 } },
     { name: "projects.get", class: "read", description: "Read one project.", parameters: { type: "object", properties: { projectId: { type: "string" } }, required: ["projectId"] }, request: { method: "GET", path: "/v2/projects/{projectId}" } },
     { name: "projects.create", class: "mutation", description: "Create a project.", parameters: { type: "object", properties: { project: { type: "object" } }, required: ["project"] }, request: { method: "POST", path: "/v2/projects", body: "{project}" }, cas: "none", externalEffect: true },
     { name: "projects.update", class: "mutation", description: "Update a project.", parameters: { type: "object", properties: { projectId: { type: "string" }, project: { type: "object" } }, required: ["projectId", "project"] }, request: { method: "PATCH", path: "/v2/projects/{projectId}", body: "{project}" }, cas: "optimistic-read-verify", externalEffect: true },
     { name: "projects.delete", class: "mutation", description: "Delete a project.", parameters: { type: "object", properties: { projectId: { type: "string" } }, required: ["projectId"] }, request: { method: "DELETE", path: "/v2/projects/{projectId}" }, cas: "optimistic-read-verify", externalEffect: true },
-    { name: "droplets.list", class: "read", description: "List Droplets.", parameters: { type: "object", properties: { ...pagination2, tagName: { type: "string" }, name: { type: "string" } } }, request: { method: "GET", path: "/v2/droplets", query: { ...paginationQuery, tag_name: "{tagName}", name: "{name}" } } },
+    { name: "droplets.list", class: "read", description: "List Droplets.", parameters: { type: "object", properties: { ...pagination3, tagName: { type: "string" }, name: { type: "string" } } }, request: { method: "GET", path: "/v2/droplets", query: { ...paginationQuery2, tag_name: "{tagName}", name: "{name}" } } },
     { name: "droplets.get", class: "read", description: "Read one Droplet.", parameters: { type: "object", properties: { dropletId: { type: "integer" } }, required: ["dropletId"] }, request: { method: "GET", path: "/v2/droplets/{dropletId}" } },
     { name: "droplets.create", class: "mutation", description: "Create one or more Droplets.", parameters: { type: "object", properties: { droplet: { type: "object" } }, required: ["droplet"] }, request: { method: "POST", path: "/v2/droplets", body: "{droplet}" }, cas: "none", externalEffect: true },
     { name: "droplets.action", class: "mutation", description: "Run a provider-native Droplet action such as power_on, shutdown, snapshot, resize, or rebuild.", parameters: { type: "object", properties: { dropletId: { type: "integer" }, action: { type: "object" } }, required: ["dropletId", "action"] }, request: { method: "POST", path: "/v2/droplets/{dropletId}/actions", body: "{action}" }, cas: "none", externalEffect: true },
     { name: "droplets.delete", class: "mutation", description: "Delete a Droplet.", parameters: { type: "object", properties: { dropletId: { type: "integer" } }, required: ["dropletId"] }, request: { method: "DELETE", path: "/v2/droplets/{dropletId}" }, cas: "optimistic-read-verify", externalEffect: true },
-    { name: "volumes.list", class: "read", description: "List block-storage volumes.", parameters: { type: "object", properties: { ...pagination2, region: { type: "string" }, name: { type: "string" } } }, request: { method: "GET", path: "/v2/volumes", query: { ...paginationQuery, region: "{region}", name: "{name}" } } },
+    { name: "volumes.list", class: "read", description: "List block-storage volumes.", parameters: { type: "object", properties: { ...pagination3, region: { type: "string" }, name: { type: "string" } } }, request: { method: "GET", path: "/v2/volumes", query: { ...paginationQuery2, region: "{region}", name: "{name}" } } },
     { name: "volumes.create", class: "mutation", description: "Create a block-storage volume.", parameters: { type: "object", properties: { volume: { type: "object" } }, required: ["volume"] }, request: { method: "POST", path: "/v2/volumes", body: "{volume}" }, cas: "none", externalEffect: true },
     { name: "volumes.delete", class: "mutation", description: "Delete a block-storage volume.", parameters: { type: "object", properties: { volumeId: { type: "string" } }, required: ["volumeId"] }, request: { method: "DELETE", path: "/v2/volumes/{volumeId}" }, cas: "optimistic-read-verify", externalEffect: true },
-    { name: "databases.list", class: "read", description: "List managed database clusters.", parameters: { type: "object", properties: { ...pagination2, tagName: { type: "string" } } }, request: { method: "GET", path: "/v2/databases", query: { ...paginationQuery, tag_name: "{tagName}" } } },
+    { name: "databases.list", class: "read", description: "List managed database clusters.", parameters: { type: "object", properties: { ...pagination3, tagName: { type: "string" } } }, request: { method: "GET", path: "/v2/databases", query: { ...paginationQuery2, tag_name: "{tagName}" } } },
     { name: "databases.get", class: "read", description: "Read a managed database cluster.", parameters: { type: "object", properties: { databaseId: { type: "string" } }, required: ["databaseId"] }, request: { method: "GET", path: "/v2/databases/{databaseId}" } },
     { name: "databases.create", class: "mutation", description: "Create a managed database cluster.", parameters: { type: "object", properties: { database: { type: "object" } }, required: ["database"] }, request: { method: "POST", path: "/v2/databases", body: "{database}" }, cas: "none", externalEffect: true },
     { name: "databases.delete", class: "mutation", description: "Delete a managed database cluster.", parameters: { type: "object", properties: { databaseId: { type: "string" } }, required: ["databaseId"] }, request: { method: "DELETE", path: "/v2/databases/{databaseId}" }, cas: "optimistic-read-verify", externalEffect: true },
-    { name: "apps.list", class: "read", description: "List App Platform apps.", parameters: { type: "object", properties: pagination2 }, request: { method: "GET", path: "/v2/apps", query: paginationQuery } },
+    { name: "apps.list", class: "read", description: "List App Platform apps.", parameters: { type: "object", properties: pagination3 }, request: { method: "GET", path: "/v2/apps", query: paginationQuery2 } },
     { name: "apps.get", class: "read", description: "Read an App Platform app.", parameters: { type: "object", properties: { appId: { type: "string" } }, required: ["appId"] }, request: { method: "GET", path: "/v2/apps/{appId}" } },
     { name: "apps.create", class: "mutation", description: "Create an App Platform app.", parameters: { type: "object", properties: { spec: { type: "object" } }, required: ["spec"] }, request: { method: "POST", path: "/v2/apps", body: { spec: "{spec}" } }, cas: "none", externalEffect: true },
     { name: "apps.update", class: "mutation", description: "Update an App Platform app specification.", parameters: { type: "object", properties: { appId: { type: "string" }, spec: { type: "object" } }, required: ["appId", "spec"] }, request: { method: "PUT", path: "/v2/apps/{appId}", body: { spec: "{spec}" } }, cas: "optimistic-read-verify", externalEffect: true },
@@ -78071,11 +80279,11 @@ var digitalOceanConnector = declarativeRestConnector({
 });
 
 // src/connectors/adapters/clicksend.ts
-var pagination3 = {
+var pagination4 = {
   page: { type: "integer", minimum: 1 },
   limit: { type: "integer", minimum: 1 }
 };
-var paginationQuery2 = { page: "{page}", limit: "{limit}" };
+var paginationQuery3 = { page: "{page}", limit: "{limit}" };
 var listId = { listId: { type: "integer" } };
 var contactId = { contactId: { type: "integer" } };
 var clicksendConnector = declarativeRestConnector({
@@ -78107,8 +80315,8 @@ var clicksendConnector = declarativeRestConnector({
       name: "lists.list",
       class: "read",
       description: "List contact lists.",
-      parameters: { type: "object", properties: pagination3 },
-      request: { method: "GET", path: "/lists", query: paginationQuery2 }
+      parameters: { type: "object", properties: pagination4 },
+      request: { method: "GET", path: "/lists", query: paginationQuery3 }
     },
     {
       name: "lists.get",
@@ -78158,13 +80366,13 @@ var clicksendConnector = declarativeRestConnector({
       description: "List contacts in a list.",
       parameters: {
         type: "object",
-        properties: { ...listId, ...pagination3, updatedAfter: { type: "integer" } },
+        properties: { ...listId, ...pagination4, updatedAfter: { type: "integer" } },
         required: ["listId"]
       },
       request: {
         method: "GET",
         path: "/lists/{listId}/contacts",
-        query: { ...paginationQuery2, updated_after: "{updatedAfter}" }
+        query: { ...paginationQuery3, updated_after: "{updatedAfter}" }
       }
     },
     {
@@ -78234,7 +80442,7 @@ var clicksendConnector = declarativeRestConnector({
           query: { type: "string" },
           dateFrom: { type: "integer" },
           dateTo: { type: "integer" },
-          ...pagination3
+          ...pagination4
         }
       },
       request: {
@@ -78244,7 +80452,7 @@ var clicksendConnector = declarativeRestConnector({
           q: "{query}",
           date_from: "{dateFrom}",
           date_to: "{dateTo}",
-          ...paginationQuery2
+          ...paginationQuery3
         }
       }
     },
@@ -78254,16 +80462,16 @@ var clicksendConnector = declarativeRestConnector({
       description: "List inbound SMS messages.",
       parameters: {
         type: "object",
-        properties: { query: { type: "string" }, ...pagination3 }
+        properties: { query: { type: "string" }, ...pagination4 }
       },
-      request: { method: "GET", path: "/sms/inbound", query: { q: "{query}", ...paginationQuery2 } }
+      request: { method: "GET", path: "/sms/inbound", query: { q: "{query}", ...paginationQuery3 } }
     },
     {
       name: "sms.receipts.list",
       class: "read",
       description: "List SMS delivery receipts.",
-      parameters: { type: "object", properties: pagination3 },
-      request: { method: "GET", path: "/sms/receipts", query: paginationQuery2 }
+      parameters: { type: "object", properties: pagination4 },
+      request: { method: "GET", path: "/sms/receipts", query: paginationQuery3 }
     },
     {
       name: "sms.send",
@@ -78299,12 +80507,12 @@ var clicksendConnector = declarativeRestConnector({
       description: "List voice message history.",
       parameters: {
         type: "object",
-        properties: { dateFrom: { type: "integer" }, dateTo: { type: "integer" }, ...pagination3 }
+        properties: { dateFrom: { type: "integer" }, dateTo: { type: "integer" }, ...pagination4 }
       },
       request: {
         method: "GET",
         path: "/voice/history",
-        query: { date_from: "{dateFrom}", date_to: "{dateTo}", ...paginationQuery2 }
+        query: { date_from: "{dateFrom}", date_to: "{dateTo}", ...paginationQuery3 }
       }
     },
     {
@@ -79474,7 +81682,7 @@ function readQuery2(inv) {
   throw new Error(`Unknown MySQL read capability: ${inv.capabilityName}`);
 }
 function readStatementArgs(args) {
-  const statement = requiredString7(args.statement, "statement");
+  const statement = requiredString8(args.statement, "statement");
   if (Buffer.byteLength(statement, "utf8") > 1024 * 1024) throw new Error("statement exceeds the 1 MiB limit");
   const parameters = args.parameters === void 0 ? [] : args.parameters;
   if (!Array.isArray(parameters) || parameters.length > MAX_PARAMETERS) {
@@ -79565,7 +81773,7 @@ function readDatabase(value, source) {
 function queryTimeout(source) {
   return readCredentials7(source).queryTimeoutMs;
 }
-function requiredString7(value, label) {
+function requiredString8(value, label) {
   const parsed = readOptionalString(value, label);
   if (!parsed) throw new Error(`${label} is required`);
   return parsed;
@@ -79577,7 +81785,7 @@ function requiredCredentialString3(value, label, maxLength) {
   return parsed;
 }
 function readIdentifier2(value, label) {
-  const parsed = requiredString7(value, label);
+  const parsed = requiredString8(value, label);
   if (parsed.length > 64) throw new Error(`${label} exceeds 64 characters`);
   return parsed;
 }
@@ -81147,6 +83355,8 @@ var CONNECTOR_ADAPTER_FACTORIES = [
   defineFactoryAdapter(() => segmentConnector, {}),
   defineFactoryAdapter(() => hightouchConnector, {}),
   defineFactoryAdapter(() => datadogConnector, {}),
+  defineFactoryAdapter(() => amplitudeConnector, {}),
+  defineFactoryAdapter(() => cloudflareConnector, {}),
   defineFactoryAdapter(() => discourseConnector, {}),
   defineFactoryAdapter(() => digitalOceanConnector, {}),
   defineFactoryAdapter(() => clicksendConnector, {}),
@@ -81177,6 +83387,10 @@ var CONNECTOR_ADAPTER_FACTORIES = [
     clientId: "TWITTER_OAUTH_CLIENT_ID",
     clientSecret: "TWITTER_OAUTH_CLIENT_SECRET"
   }),
+  defineFactoryAdapter(tiktok, {
+    clientId: "TIKTOK_OAUTH_CLIENT_KEY",
+    clientSecret: "TIKTOK_OAUTH_CLIENT_SECRET"
+  }),
   // Declarative OAuth2 connectors: the manifest already pins clientIdEnv /
   // clientSecretEnv; the envMap re-pins the same names so registration is
   // gated on the OAuth app actually being configured (no half-live connector).
@@ -81204,6 +83418,8 @@ var CONNECTOR_ADAPTER_FACTORIES = [
   // credentials from each connection; OAuth providers are registered only
   // when the shared application credentials are present.
   defineFactoryAdapter(() => amazonEventBridgeConnector, {}),
+  defineFactoryAdapter(() => amazonLambdaConnector, {}),
+  defineFactoryAdapter(() => amazonCloudWatchConnector, {}),
   defineFactoryAdapter(() => amazonS3Connector, {}),
   defineFactoryAdapter(() => amazonSnsConnector, {}),
   defineFactoryAdapter(() => amazonSqsConnector, {}),
@@ -81253,9 +83469,8 @@ var CONNECTOR_ADAPTER_FACTORIES = [
     clientId: "ACUITY_OAUTH_CLIENT_ID",
     clientSecret: "ACUITY_OAUTH_CLIENT_SECRET"
   }),
-  defineFactoryAdapter(() => calComConnector, {
-    clientId: "CALCOM_OAUTH_CLIENT_ID",
-    clientSecret: "CALCOM_OAUTH_CLIENT_SECRET"
+  defineFactoryAdapter(calCom, {
+    clientId: "CALCOM_OAUTH_CLIENT_ID"
   }),
   defineFactoryAdapter(() => savvycalConnector, {
     clientId: "SAVVYCAL_OAUTH_CLIENT_ID",
@@ -146552,7 +148767,10 @@ export {
   adobeSignConnector,
   aircallConnector,
   affinityConnector,
+  amplitudeConnector,
   amazonEventBridgeConnector,
+  amazonCloudWatchConnector,
+  amazonLambdaConnector,
   amazonS3Connector,
   amazonSnsConnector,
   amazonSqsConnector,
@@ -146575,10 +148793,12 @@ export {
   billComConnector,
   billplzConnector,
   calComConnector,
+  calCom,
   calendlyConnector,
   capsuleCrmConnector,
   closeConnector,
   clickupConnector,
+  cloudflareConnector,
   cloudinaryConnector,
   codaConnector,
   confluenceConnector,
@@ -146723,6 +148943,8 @@ export {
   typeformConnector,
   twitterConnector,
   twitter,
+  tiktokConnector,
+  tiktok,
   twilioSmsConnector,
   voucheryIoConnector,
   whatsappBusiness,
@@ -147110,4 +149332,4 @@ export {
   getresponseConnector,
   adapters_exports
 };
-//# sourceMappingURL=chunk-AGXTCR34.js.map
+//# sourceMappingURL=chunk-HNEEIMQC.js.map