@tangle-network/agent-integrations 0.53.48 → 0.53.49

package/dist/{chunk-HNEEIMQC.js → chunk-H5UCSRF4.js}

@@ -14,7 +14,7 @@ import {
   TangleIdentityUnreachableError,
   createTangleIdentityClient,
   tangleIdentity
-} from "./chunk-RRSNINEV.js";
+} from "./chunk-W72KPXXX.js";
 import {
   __export
 } from "./chunk-PZ5AY32C.js";
@@ -530,6 +530,7 @@ __export(adapters_exports, {
   reachinboxConnector: () => reachinboxConnector,
   recallAiConnector: () => recallAiConnector,
   recurlyConnector: () => recurlyConnector,
+  reddit: () => reddit,
   redditConnector: () => redditConnector,
   redisConnector: () => redisConnector,
   redshiftConnector: () => redshiftConnector,
@@ -978,8 +979,9 @@ async function executeRestRequest(spec, request4, inv, requiredArgs) {
   if (hostOverride) url.host = hostOverride.replace(/\{region\}/g, awsRegion);
   if (inv.expectedEtag) headers["if-match"] = inv.expectedEtag;
   const sendsBody = request4.method !== "GET" && (request4.method !== "DELETE" || request4.body !== void 0);
+  const bodyEncoding = request4.bodyEncoding ?? "json";
   if (sendsBody && getHeaderCI(headers, "content-type") === void 0) {
-    headers["content-type"] = "application/json";
+    headers["content-type"] = bodyEncoding === "form" ? "application/x-www-form-urlencoded" : "application/json";
   }
   let resolvedBody = sendsBody ? resolveBody(request4.body, inv.args, scope, requiredArgs) : void 0;
   if (placement.kind === "structured-json-body") {
@@ -996,7 +998,7 @@ async function executeRestRequest(spec, request4, inv, requiredArgs) {
       )
     };
   }
-  const bodyString = sendsBody ? JSON.stringify(resolvedBody) : void 0;
+  const bodyString = sendsBody ? serializeRequestBody(spec.kind, bodyEncoding, resolvedBody) : void 0;
   if (placement.kind === "aws-sigv4") {
     signAwsRequest(headers, url, {
       method: request4.method,
@@ -1072,6 +1074,21 @@ async function executeRestRequest(spec, request4, inv, requiredArgs) {
   }
   return { data: data4, etag: res.headers.get("etag") ?? void 0 };
 }
+function serializeRequestBody(connectorKind, encoding, body) {
+  if (encoding === "json") return JSON.stringify(body);
+  if (!body || typeof body !== "object" || Array.isArray(body)) {
+    throw new Error(`${connectorKind}: form request bodies require a flat object`);
+  }
+  const form2 = new URLSearchParams();
+  for (const [key, value] of Object.entries(body)) {
+    if (value === void 0 || value === null) continue;
+    if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean") {
+      throw new Error(`${connectorKind}: form field ${key} must be a scalar value`);
+    }
+    form2.set(key, String(value));
+  }
+  return form2.toString();
+}
 function resolveBaseUrl(baseUrl4, metadata, allowedBaseUrls, allowedBaseUrlSuffixes, requirePublicHttpsBaseUrl) {
   let resolved;
   if (typeof baseUrl4 === "string") {
@@ -16131,40 +16148,228 @@ var pushbulletConnector = declarativeRestConnector({
   ]
 });
 
+// src/connectors/oauth.ts
+import { createHash as createHash3, randomBytes } from "crypto";
+var PENDING_TTL_MS = 10 * 60 * 1e3;
+var InMemoryOAuthFlowStore = class {
+  pendingFlows = /* @__PURE__ */ new Map();
+  put(state, flow) {
+    this.pendingFlows.set(state, flow);
+  }
+  consume(state) {
+    const flow = this.pendingFlows.get(state);
+    this.pendingFlows.delete(state);
+    if (!flow || flow.expiresAt <= Date.now()) return void 0;
+    return flow;
+  }
+  sweep(now) {
+    for (const [k, v] of this.pendingFlows) {
+      if (v.expiresAt <= now) this.pendingFlows.delete(k);
+    }
+  }
+  clear() {
+    this.pendingFlows.clear();
+  }
+};
+var defaultFlowStore = new InMemoryOAuthFlowStore();
+function startOAuthFlow(input) {
+  const store = input.store ?? defaultFlowStore;
+  const now = input.now ?? Date.now();
+  store.sweep?.(now);
+  const usePkce = (input.pkce ?? "required") !== "unsupported";
+  const codeVerifier = usePkce ? base64Url(randomBytes(48)) : void 0;
+  const codeChallenge = codeVerifier ? base64Url(createHash3("sha256").update(codeVerifier).digest()) : void 0;
+  const state = base64Url(randomBytes(24));
+  store.put(state, {
+    codeVerifier,
+    state,
+    projectId: input.projectId,
+    kind: input.kind,
+    label: input.label,
+    redirectUri: input.redirectUri,
+    expiresAt: now + PENDING_TTL_MS
+  });
+  const url = new URL(input.authorizationUrl);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set(
+    oauthParameterName(input.authorizationClientIdParam, "client_id"),
+    input.clientId
+  );
+  url.searchParams.set("redirect_uri", input.redirectUri);
+  url.searchParams.set("scope", input.scopes.join(input.scopeSeparator ?? " "));
+  url.searchParams.set("state", state);
+  if (input.extraAuthParams) {
+    for (const [k, v] of Object.entries(input.extraAuthParams)) {
+      url.searchParams.set(k, v);
+    }
+  }
+  if (codeChallenge) {
+    url.searchParams.set("code_challenge", codeChallenge);
+    url.searchParams.set("code_challenge_method", "S256");
+  } else {
+    url.searchParams.delete("code_challenge");
+    url.searchParams.delete("code_challenge_method");
+  }
+  return { authorizationUrl: url.toString(), state };
+}
+async function consumePendingFlow(state, store = defaultFlowStore) {
+  await store.sweep?.(Date.now());
+  const flow = await store.consume(state);
+  if (!flow) {
+    throw new Error("Unknown or expired OAuth state: possible CSRF, replay, or stale flow");
+  }
+  return flow;
+}
+async function exchangeAuthorizationCode(input) {
+  const usePkce = (input.pkce ?? "required") !== "unsupported";
+  if (usePkce && !input.codeVerifier) {
+    throw new Error("OAuth token exchange requires a PKCE code_verifier");
+  }
+  const body = new URLSearchParams({
+    grant_type: "authorization_code",
+    code: input.code,
+    redirect_uri: input.redirectUri
+  });
+  if (usePkce) body.set("code_verifier", input.codeVerifier);
+  const headers = createOAuthTokenRequestHeaders(input.tokenRequestHeaders);
+  applyTokenClientAuthentication(input, body, headers);
+  const res = await (input.fetchImpl ?? fetch)(input.tokenUrl, {
+    method: "POST",
+    headers,
+    body,
+    signal: input.signal
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new Error(`OAuth token exchange failed: ${res.status} ${res.statusText} \u2014 ${text.slice(0, 200)}`);
+  }
+  const json = await res.json();
+  return {
+    accessToken: json.access_token,
+    refreshToken: json.refresh_token,
+    expiresIn: json.expires_in,
+    scope: json.scope,
+    tokenType: json.token_type,
+    idToken: json.id_token
+  };
+}
+async function refreshAccessToken(input) {
+  const body = new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token: input.refreshToken
+  });
+  const headers = createOAuthTokenRequestHeaders(input.tokenRequestHeaders);
+  applyTokenClientAuthentication(input, body, headers);
+  const res = await (input.fetchImpl ?? fetch)(input.tokenUrl, {
+    method: "POST",
+    headers,
+    body,
+    signal: input.signal
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new Error(`OAuth refresh failed: ${res.status} ${res.statusText} \u2014 ${text.slice(0, 200)}`);
+  }
+  const json = await res.json();
+  return {
+    accessToken: json.access_token,
+    // Some providers omit refresh_token on refresh — keep the previous one
+    // in that case (caller passes through if undefined).
+    refreshToken: json.refresh_token,
+    expiresIn: json.expires_in,
+    scope: json.scope,
+    tokenType: json.token_type,
+    idToken: json.id_token
+  };
+}
+function createOAuthTokenRequestHeaders(additional) {
+  const headers = new Headers(additional);
+  headers.set("content-type", "application/x-www-form-urlencoded");
+  headers.set("accept", "application/json");
+  headers.delete("authorization");
+  return Object.fromEntries(headers.entries());
+}
+function applyTokenClientAuthentication(input, body, headers) {
+  const method = input.tokenClientAuthMethod ?? "client_secret_post";
+  if (method === "none") {
+    body.set(oauthParameterName(input.tokenClientIdParam, "client_id"), input.clientId);
+    return;
+  }
+  if (!input.clientSecret) {
+    throw new Error(`OAuth ${method} client authentication requires a client secret`);
+  }
+  if (method === "client_secret_post") {
+    body.set(oauthParameterName(input.tokenClientIdParam, "client_id"), input.clientId);
+    body.set(
+      oauthParameterName(input.tokenClientSecretParam, "client_secret"),
+      input.clientSecret
+    );
+    return;
+  }
+  if (method === "client_secret_basic") {
+    headers.authorization = `Basic ${Buffer.from(
+      `${input.clientId}:${input.clientSecret}`,
+      "utf8"
+    ).toString("base64")}`;
+    return;
+  }
+  throw new Error("Unsupported OAuth token client authentication method");
+}
+function base64Url(buf) {
+  return buf.toString("base64").replace(/=+$/, "").replace(/\+/g, "-").replace(/\//g, "_");
+}
+function oauthParameterName(value, fallback) {
+  const name = value ?? fallback;
+  if (!/^[A-Za-z][A-Za-z0-9_.-]{0,63}$/.test(name)) {
+    throw new Error("Invalid OAuth parameter name");
+  }
+  return name;
+}
+function _resetPendingFlowsForTests() {
+  defaultFlowStore.clear?.();
+}
+
 // src/connectors/adapters/reddit.ts
-var redditConnector = declarativeRestConnector({
+var REDDIT_USER_AGENT = "web:tools.tangle.integration-hub:v1.0 (contact: https://tangle.tools)";
+var REDDIT_TOKEN_URL = "https://www.reddit.com/api/v1/access_token";
+var redditSpec = {
   kind: "reddit",
   displayName: "Reddit",
   description: "Interact with Reddit \u2014 fetch and submit posts, retrieve comments, create and edit posts/comments.",
   auth: {
     kind: "oauth2",
     authorizationUrl: "https://www.reddit.com/api/v1/authorize",
-    tokenUrl: "https://www.reddit.com/api/v1/access_token",
-    scopes: ["read", "submit", "edit"],
+    tokenUrl: REDDIT_TOKEN_URL,
+    scopes: ["identity", "read", "submit", "edit"],
+    pkce: "unsupported",
+    tokenClientAuthMethod: "client_secret_basic",
+    extraAuthParams: { duration: "permanent" },
+    tokenRequestHeaders: { "User-Agent": REDDIT_USER_AGENT },
     clientIdEnv: "REDDIT_OAUTH_CLIENT_ID",
     clientSecretEnv: "REDDIT_OAUTH_CLIENT_SECRET"
   },
   category: "comms",
   defaultConsistencyModel: "authoritative",
   baseUrl: "https://oauth.reddit.com",
+  defaultHeaders: { "User-Agent": REDDIT_USER_AGENT },
   test: { method: "GET", path: "/api/v1/me" },
   capabilities: [
     {
       name: "post.retrieve",
       class: "read",
-      description: "Retrieve a Reddit post by its ID or fullname.",
+      description: "Retrieve a Reddit post by its fullname, such as t3_abc123.",
       parameters: {
         type: "object",
         properties: {
-          postId: { type: "string" }
+          postId: { type: "string", description: "Reddit post fullname, such as t3_abc123." }
         },
         required: ["postId"]
       },
       request: {
         method: "GET",
-        path: "/r/{subreddit}/comments/{postId}",
-        headers: {
-          "User-Agent": "AgentDev/1.0"
+        path: "/api/info",
+        query: {
+          id: "{postId}"
         }
       },
       requiredScopes: ["read"]
@@ -16183,10 +16388,7 @@ var redditConnector = declarativeRestConnector({
       },
       request: {
         method: "GET",
-        path: "/r/{subreddit}/comments/{postId}",
-        headers: {
-          "User-Agent": "AgentDev/1.0"
-        }
+        path: "/r/{subreddit}/comments/{postId}"
       },
       requiredScopes: ["read"]
     },
@@ -16199,27 +16401,28 @@ var redditConnector = declarativeRestConnector({
         properties: {
           subreddit: { type: "string" },
           title: { type: "string" },
+          kind: { type: "string", enum: ["self", "link"] },
           text: { type: "string" },
           url: { type: "string" },
           flair_id: { type: "string" }
         },
-        required: ["subreddit", "title"]
+        required: ["subreddit", "title", "kind"]
       },
       request: {
         method: "POST",
-        path: "/r/{subreddit}/submit",
+        path: "/api/submit",
+        bodyEncoding: "form",
         body: {
+          api_type: "json",
+          sr: "{subreddit}",
           title: "{title}",
+          kind: "{kind}",
           text: "{text}",
           url: "{url}",
-          flair_id: "{flair_id}",
-          kind: "self"
-        },
-        headers: {
-          "User-Agent": "AgentDev/1.0"
+          flair_id: "{flair_id}"
         }
       },
-      cas: "native-idempotency",
+      cas: "none",
       externalEffect: true,
       requiredScopes: ["submit"]
     },
@@ -16238,15 +16441,14 @@ var redditConnector = declarativeRestConnector({
       request: {
         method: "POST",
         path: "/api/comment",
+        bodyEncoding: "form",
         body: {
+          api_type: "json",
           thing_id: "{parentId}",
           text: "{text}"
-        },
-        headers: {
-          "User-Agent": "AgentDev/1.0"
         }
       },
-      cas: "native-idempotency",
+      cas: "none",
       externalEffect: true,
       requiredScopes: ["submit"]
     },
@@ -16270,9 +16472,6 @@ var redditConnector = declarativeRestConnector({
         query: {
           sort: "{sort}",
           limit: "{limit}"
-        },
-        headers: {
-          "User-Agent": "AgentDev/1.0"
         }
       },
       requiredScopes: ["read"]
@@ -16292,15 +16491,15 @@ var redditConnector = declarativeRestConnector({
       request: {
         method: "POST",
         path: "/api/editusertext",
+        bodyEncoding: "form",
         body: {
+          api_type: "json",
           thing_id: "{thingId}",
           text: "{text}"
-        },
-        headers: {
-          "User-Agent": "AgentDev/1.0"
         }
       },
-      cas: "optimistic-read-verify",
+      cas: "none",
+      externalEffect: true,
       requiredScopes: ["edit"]
     },
     {
@@ -16318,15 +16517,15 @@ var redditConnector = declarativeRestConnector({
       request: {
         method: "POST",
         path: "/api/editusertext",
+        bodyEncoding: "form",
         body: {
+          api_type: "json",
           thing_id: "{thingId}",
           text: "{text}"
-        },
-        headers: {
-          "User-Agent": "AgentDev/1.0"
         }
       },
-      cas: "optimistic-read-verify",
+      cas: "none",
+      externalEffect: true,
       requiredScopes: ["edit"]
     },
     {
@@ -16343,13 +16542,12 @@ var redditConnector = declarativeRestConnector({
       request: {
         method: "POST",
         path: "/api/del",
+        bodyEncoding: "form",
         body: {
           id: "{thingId}"
-        },
-        headers: {
-          "User-Agent": "AgentDev/1.0"
         }
       },
+      cas: "none",
       externalEffect: true,
       requiredScopes: ["edit"]
     },
@@ -16367,18 +16565,150 @@ var redditConnector = declarativeRestConnector({
       request: {
         method: "POST",
         path: "/api/del",
+        bodyEncoding: "form",
         body: {
           id: "{thingId}"
-        },
-        headers: {
-          "User-Agent": "AgentDev/1.0"
         }
       },
+      cas: "none",
       externalEffect: true,
       requiredScopes: ["edit"]
     }
   ]
-});
+};
+var redditConnector = declarativeRestConnector(redditSpec);
+function reddit(options) {
+  const adapter = declarativeRestConnector(redditSpec);
+  const now = options.now ?? Date.now;
+  const refreshes = /* @__PURE__ */ new Map();
+  const refresh = async (credentials) => {
+    if (credentials.kind !== "oauth2" || !credentials.refreshToken) {
+      throw new Error("reddit.refreshToken: missing refresh token");
+    }
+    const tokens = await refreshAccessToken({
+      tokenUrl: REDDIT_TOKEN_URL,
+      clientId: options.clientId,
+      clientSecret: options.clientSecret,
+      tokenClientAuthMethod: "client_secret_basic",
+      refreshToken: credentials.refreshToken,
+      tokenRequestHeaders: { "User-Agent": REDDIT_USER_AGENT },
+      fetchImpl: options.fetchImpl
+    });
+    if (!tokens.accessToken || !tokens.expiresIn) {
+      throw new Error("Reddit token refresh returned an incomplete grant");
+    }
+    return {
+      kind: "oauth2",
+      accessToken: tokens.accessToken,
+      refreshToken: tokens.refreshToken ?? credentials.refreshToken,
+      expiresAt: now() + tokens.expiresIn * 1e3
+    };
+  };
+  adapter.refreshToken = refresh;
+  const withFreshCredentials = async (invocation) => {
+    const credentials = invocation.source.credentials;
+    if (credentials.kind !== "oauth2") {
+      throw new CredentialsExpired("Reddit requires OAuth2 credentials.", invocation.source.id);
+    }
+    if (credentials.expiresAt !== void 0 && credentials.expiresAt > now() + 6e4) {
+      return invocation;
+    }
+    if (!credentials.refreshToken) {
+      throw new CredentialsExpired(
+        "Reddit access token expired and no refresh token is available.",
+        invocation.source.id
+      );
+    }
+    let pending = refreshes.get(invocation.source.id);
+    if (!pending) {
+      let next;
+      const promise = Promise.resolve().then(() => {
+        if (!next.onCredentialsRotated) {
+          throw new Error("reddit: credential rotation persistence callback is required before refreshing");
+        }
+        return refresh(credentials);
+      });
+      next = {
+        promise,
+        onCredentialsRotated: invocation.onCredentialsRotated
+      };
+      pending = next;
+      refreshes.set(invocation.source.id, pending);
+    } else if (!pending.onCredentialsRotated && invocation.onCredentialsRotated) {
+      pending.onCredentialsRotated = invocation.onCredentialsRotated;
+    }
+    const current = pending;
+    try {
+      const refreshed = await current.promise;
+      current.persistence ??= Promise.resolve().then(
+        () => current.onCredentialsRotated?.(refreshed)
+      );
+      await current.persistence;
+      return {
+        ...invocation,
+        source: { ...invocation.source, credentials: refreshed }
+      };
+    } finally {
+      if (refreshes.get(invocation.source.id) === current) {
+        refreshes.delete(invocation.source.id);
+      }
+    }
+  };
+  return {
+    ...adapter,
+    async exchangeOAuth(input) {
+      const tokens = await exchangeAuthorizationCode({
+        tokenUrl: REDDIT_TOKEN_URL,
+        clientId: options.clientId,
+        clientSecret: options.clientSecret,
+        tokenClientAuthMethod: "client_secret_basic",
+        code: input.code,
+        codeVerifier: input.codeVerifier,
+        pkce: "unsupported",
+        redirectUri: input.redirectUri,
+        tokenRequestHeaders: { "User-Agent": REDDIT_USER_AGENT },
+        fetchImpl: options.fetchImpl
+      });
+      if (!tokens.accessToken || !tokens.refreshToken || !tokens.expiresIn) {
+        throw new Error("Reddit token exchange returned an incomplete permanent grant");
+      }
+      return {
+        credentials: {
+          kind: "oauth2",
+          accessToken: tokens.accessToken,
+          refreshToken: tokens.refreshToken,
+          expiresAt: now() + tokens.expiresIn * 1e3
+        },
+        scopes: tokens.scope?.split(/[\s,]+/).filter(Boolean) ?? [...redditSpec.auth.scopes],
+        metadata: {}
+      };
+    },
+    refreshToken: refresh,
+    async executeRead(invocation) {
+      return adapter.executeRead(await withFreshCredentials(invocation));
+    },
+    async executeMutation(invocation) {
+      return adapter.executeMutation(await withFreshCredentials(invocation));
+    },
+    async test(source, onCredentialsRotated) {
+      try {
+        const invocation = await withFreshCredentials({
+          source,
+          capabilityName: "__test__",
+          args: {},
+          idempotencyKey: "reddit-connection-test",
+          onCredentialsRotated
+        });
+        return adapter.test(invocation.source);
+      } catch (error) {
+        return {
+          ok: false,
+          reason: error instanceof Error ? error.message : "unknown error"
+        };
+      }
+    }
+  };
+}
 
 // src/connectors/adapters/rippling.ts
 var ripplingConnector = declarativeRestConnector({
@@ -24774,7 +25104,7 @@ function numberOrUndefined(value) {
 }
 
 // src/connectors/adapters/azure-event-grid.ts
-import { createHash as createHash3, timingSafeEqual } from "crypto";
+import { createHash as createHash4, timingSafeEqual } from "crypto";
 var API_VERSION2 = "2018-01-01";
 var MAX_BATCH_BYTES = 1024 * 1024;
 var MAX_EVENTS = 5e3;
@@ -24843,8 +25173,8 @@ var azureEventGridConnector = {
     }
     const provided = headerValue(headers, "x-tangle-eventgrid-secret");
     if (!provided) return { valid: false, reason: "Missing x-tangle-eventgrid-secret delivery header" };
-    const expectedDigest = createHash3("sha256").update(credentials.deliverySecret).digest();
-    const providedDigest = createHash3("sha256").update(provided).digest();
+    const expectedDigest = createHash4("sha256").update(credentials.deliverySecret).digest();
+    const providedDigest = createHash4("sha256").update(provided).digest();
     return timingSafeEqual(expectedDigest, providedDigest) ? { valid: true } : { valid: false, reason: "Invalid x-tangle-eventgrid-secret delivery header" };
   },
   async handleInboundEvent({ rawBody }) {
@@ -27362,186 +27692,6 @@ var billplzConnector = declarativeRestConnector({
   ]
 });
 
-// src/connectors/oauth.ts
-import { createHash as createHash4, randomBytes } from "crypto";
-var PENDING_TTL_MS = 10 * 60 * 1e3;
-var InMemoryOAuthFlowStore = class {
-  pendingFlows = /* @__PURE__ */ new Map();
-  put(state, flow) {
-    this.pendingFlows.set(state, flow);
-  }
-  consume(state) {
-    const flow = this.pendingFlows.get(state);
-    this.pendingFlows.delete(state);
-    if (!flow || flow.expiresAt <= Date.now()) return void 0;
-    return flow;
-  }
-  sweep(now) {
-    for (const [k, v] of this.pendingFlows) {
-      if (v.expiresAt <= now) this.pendingFlows.delete(k);
-    }
-  }
-  clear() {
-    this.pendingFlows.clear();
-  }
-};
-var defaultFlowStore = new InMemoryOAuthFlowStore();
-function startOAuthFlow(input) {
-  const store = input.store ?? defaultFlowStore;
-  const now = input.now ?? Date.now();
-  store.sweep?.(now);
-  const usePkce = (input.pkce ?? "required") !== "unsupported";
-  const codeVerifier = usePkce ? base64Url(randomBytes(48)) : void 0;
-  const codeChallenge = codeVerifier ? base64Url(createHash4("sha256").update(codeVerifier).digest()) : void 0;
-  const state = base64Url(randomBytes(24));
-  store.put(state, {
-    codeVerifier,
-    state,
-    projectId: input.projectId,
-    kind: input.kind,
-    label: input.label,
-    redirectUri: input.redirectUri,
-    expiresAt: now + PENDING_TTL_MS
-  });
-  const url = new URL(input.authorizationUrl);
-  url.searchParams.set("response_type", "code");
-  url.searchParams.set(
-    oauthParameterName(input.authorizationClientIdParam, "client_id"),
-    input.clientId
-  );
-  url.searchParams.set("redirect_uri", input.redirectUri);
-  url.searchParams.set("scope", input.scopes.join(input.scopeSeparator ?? " "));
-  url.searchParams.set("state", state);
-  if (input.extraAuthParams) {
-    for (const [k, v] of Object.entries(input.extraAuthParams)) {
-      url.searchParams.set(k, v);
-    }
-  }
-  if (codeChallenge) {
-    url.searchParams.set("code_challenge", codeChallenge);
-    url.searchParams.set("code_challenge_method", "S256");
-  } else {
-    url.searchParams.delete("code_challenge");
-    url.searchParams.delete("code_challenge_method");
-  }
-  return { authorizationUrl: url.toString(), state };
-}
-async function consumePendingFlow(state, store = defaultFlowStore) {
-  await store.sweep?.(Date.now());
-  const flow = await store.consume(state);
-  if (!flow) {
-    throw new Error("Unknown or expired OAuth state: possible CSRF, replay, or stale flow");
-  }
-  return flow;
-}
-async function exchangeAuthorizationCode(input) {
-  const usePkce = (input.pkce ?? "required") !== "unsupported";
-  if (usePkce && !input.codeVerifier) {
-    throw new Error("OAuth token exchange requires a PKCE code_verifier");
-  }
-  const body = new URLSearchParams({
-    grant_type: "authorization_code",
-    code: input.code,
-    redirect_uri: input.redirectUri
-  });
-  if (usePkce) body.set("code_verifier", input.codeVerifier);
-  const headers = {
-    "content-type": "application/x-www-form-urlencoded",
-    accept: "application/json"
-  };
-  applyTokenClientAuthentication(input, body, headers);
-  const res = await (input.fetchImpl ?? fetch)(input.tokenUrl, {
-    method: "POST",
-    headers,
-    body,
-    signal: input.signal
-  });
-  if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`OAuth token exchange failed: ${res.status} ${res.statusText} \u2014 ${text.slice(0, 200)}`);
-  }
-  const json = await res.json();
-  return {
-    accessToken: json.access_token,
-    refreshToken: json.refresh_token,
-    expiresIn: json.expires_in,
-    scope: json.scope,
-    tokenType: json.token_type,
-    idToken: json.id_token
-  };
-}
-async function refreshAccessToken(input) {
-  const body = new URLSearchParams({
-    grant_type: "refresh_token",
-    refresh_token: input.refreshToken
-  });
-  const headers = {
-    "content-type": "application/x-www-form-urlencoded",
-    accept: "application/json"
-  };
-  applyTokenClientAuthentication(input, body, headers);
-  const res = await (input.fetchImpl ?? fetch)(input.tokenUrl, {
-    method: "POST",
-    headers,
-    body,
-    signal: input.signal
-  });
-  if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`OAuth refresh failed: ${res.status} ${res.statusText} \u2014 ${text.slice(0, 200)}`);
-  }
-  const json = await res.json();
-  return {
-    accessToken: json.access_token,
-    // Some providers omit refresh_token on refresh — keep the previous one
-    // in that case (caller passes through if undefined).
-    refreshToken: json.refresh_token,
-    expiresIn: json.expires_in,
-    scope: json.scope,
-    tokenType: json.token_type,
-    idToken: json.id_token
-  };
-}
-function applyTokenClientAuthentication(input, body, headers) {
-  const method = input.tokenClientAuthMethod ?? "client_secret_post";
-  if (method === "none") {
-    body.set(oauthParameterName(input.tokenClientIdParam, "client_id"), input.clientId);
-    return;
-  }
-  if (!input.clientSecret) {
-    throw new Error(`OAuth ${method} client authentication requires a client secret`);
-  }
-  if (method === "client_secret_post") {
-    body.set(oauthParameterName(input.tokenClientIdParam, "client_id"), input.clientId);
-    body.set(
-      oauthParameterName(input.tokenClientSecretParam, "client_secret"),
-      input.clientSecret
-    );
-    return;
-  }
-  if (method === "client_secret_basic") {
-    headers.authorization = `Basic ${Buffer.from(
-      `${input.clientId}:${input.clientSecret}`,
-      "utf8"
-    ).toString("base64")}`;
-    return;
-  }
-  throw new Error("Unsupported OAuth token client authentication method");
-}
-function base64Url(buf) {
-  return buf.toString("base64").replace(/=+$/, "").replace(/\+/g, "-").replace(/\//g, "_");
-}
-function oauthParameterName(value, fallback) {
-  const name = value ?? fallback;
-  if (!/^[A-Za-z][A-Za-z0-9_.-]{0,63}$/.test(name)) {
-    throw new Error("Invalid OAuth parameter name");
-  }
-  return name;
-}
-function _resetPendingFlowsForTests() {
-  defaultFlowStore.clear?.();
-}
-
 // src/connectors/adapters/cal-com.ts
 var authorizeUrl = "https://app.cal.com/auth/oauth2/authorize";
 var tokenUrl = "https://api.cal.com/v2/auth/oauth2/token";
@@ -52737,13 +52887,11 @@ function microsoftTeams(opts) {
     async test(source) {
       try {
         const accessToken4 = await ensureFreshAccessToken11(source.credentials, clientId, clientSecret);
-        const res = await fetch(`${GRAPH2}/me?$select=id`, {
+        const res = await fetch(`${GRAPH2}/me/joinedTeams`, {
           headers: { authorization: `Bearer ${accessToken4}` },
           signal: AbortSignal.timeout(8e3)
         });
-        if (res.status === 401 || res.status === 403) {
-          return { ok: false, reason: `Microsoft rejected token (${res.status}) \u2014 reconnect required` };
-        }
+        if (res.status === 401 || res.status === 403) return microsoftGraphTestFailure(res);
         if (!res.ok) return { ok: false, reason: `Microsoft Graph returned ${res.status}` };
         return { ok: true };
       } catch (err) {
@@ -52804,7 +52952,7 @@ async function graphGet2(url, accessToken4, dataSourceId) {
     signal: AbortSignal.timeout(1e4)
   });
   if (res.status === 401 || res.status === 403) {
-    throw new CredentialsExpired(`Microsoft Graph rejected token (${res.status})`, dataSourceId);
+    await throwMicrosoftGraphAccessError(res, dataSourceId);
   }
   if (!res.ok) {
     const text = await res.text().catch(() => "");
@@ -52824,7 +52972,7 @@ async function graphPost(url, accessToken4, body, dataSourceId, op) {
     signal: AbortSignal.timeout(15e3)
   });
   if (res.status === 401 || res.status === 403) {
-    throw new CredentialsExpired(`Microsoft Graph rejected token (${res.status})`, dataSourceId);
+    await throwMicrosoftGraphAccessError(res, dataSourceId);
   }
   if (!res.ok) {
     const text = await res.text().catch(() => "");
@@ -52832,6 +52980,57 @@ async function graphPost(url, accessToken4, body, dataSourceId, op) {
   }
   return await res.json();
 }
+async function microsoftGraphErrorBody(res) {
+  try {
+    const body = await res.json();
+    return body && typeof body === "object" ? body : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function microsoftGraphErrorText(body) {
+  const code = typeof body?.error?.code === "string" ? body.error.code : "";
+  const message = typeof body?.error?.message === "string" ? body.error.message : "";
+  return `${code} ${message}`.trim();
+}
+function microsoftGraphRequiresLicense(body) {
+  return /\b(?:valid\s+)?licen[cs]e\b/i.test(microsoftGraphErrorText(body));
+}
+async function throwMicrosoftGraphAccessError(res, dataSourceId) {
+  const body = await microsoftGraphErrorBody(res);
+  if (microsoftGraphRequiresLicense(body)) {
+    throw new ProviderConfigError(
+      "Microsoft Teams requires a valid Microsoft 365 or Teams license",
+      dataSourceId,
+      { status: res.status, reason: "licenseRequired", body }
+    );
+  }
+  if (res.status === 403) {
+    throw new ProviderConfigError("Microsoft Graph denied the requested permission", dataSourceId, {
+      status: res.status,
+      reason: typeof body?.error?.code === "string" && body.error.code ? body.error.code : "forbidden",
+      body
+    });
+  }
+  throw new CredentialsExpired(`Microsoft Graph rejected token (${res.status})`, dataSourceId, {
+    status: res.status,
+    reason: typeof body?.error?.code === "string" && body.error.code ? body.error.code : "unauthorized",
+    body
+  });
+}
+async function microsoftGraphTestFailure(res) {
+  const body = await microsoftGraphErrorBody(res);
+  if (microsoftGraphRequiresLicense(body)) {
+    return {
+      ok: false,
+      reason: "Microsoft Teams requires a valid Microsoft 365 or Teams license"
+    };
+  }
+  if (res.status === 403) {
+    return { ok: false, reason: "Microsoft Graph denied the requested permission" };
+  }
+  return { ok: false, reason: `Microsoft rejected token (${res.status}) \u2014 reconnect required` };
+}
 function escapeOData2(value) {
   return value.replace(/'/g, "''");
 }
@@ -83842,7 +84041,7 @@ var CONNECTOR_ADAPTER_FACTORIES = [
     clientId: "PUSHBULLET_OAUTH_CLIENT_ID",
     clientSecret: "PUSHBULLET_OAUTH_CLIENT_SECRET"
   }),
-  defineFactoryAdapter(() => redditConnector, {
+  defineFactoryAdapter(reddit, {
     clientId: "REDDIT_OAUTH_CLIENT_ID",
     clientSecret: "REDDIT_OAUTH_CLIENT_SECRET"
   }),
@@ -148676,6 +148875,7 @@ export {
   consumePendingFlow,
   exchangeAuthorizationCode,
   refreshAccessToken,
+  createOAuthTokenRequestHeaders,
   _resetPendingFlowsForTests,
   declarativeRestConnector,
   oktaConnector,
@@ -148752,6 +148952,7 @@ export {
   paychexConnector,
   pushbulletConnector,
   redditConnector,
+  reddit,
   ripplingConnector,
   sanityConnector,
   sendpulseConnector,
@@ -149332,4 +149533,4 @@ export {
   getresponseConnector,
   adapters_exports
 };
-//# sourceMappingURL=chunk-HNEEIMQC.js.map
+//# sourceMappingURL=chunk-H5UCSRF4.js.map