@tangle-network/agent-integrations 0.53.48 → 0.53.50

package/dist/{chunk-HNEEIMQC.js → chunk-2JRYKWYX.js}

@@ -14,7 +14,7 @@ import {
   TangleIdentityUnreachableError,
   createTangleIdentityClient,
   tangleIdentity
-} from "./chunk-RRSNINEV.js";
+} from "./chunk-W72KPXXX.js";
 import {
   __export
 } from "./chunk-PZ5AY32C.js";
@@ -530,6 +530,7 @@ __export(adapters_exports, {
   reachinboxConnector: () => reachinboxConnector,
   recallAiConnector: () => recallAiConnector,
   recurlyConnector: () => recurlyConnector,
+  reddit: () => reddit,
   redditConnector: () => redditConnector,
   redisConnector: () => redisConnector,
   redshiftConnector: () => redshiftConnector,
@@ -978,8 +979,9 @@ async function executeRestRequest(spec, request4, inv, requiredArgs) {
   if (hostOverride) url.host = hostOverride.replace(/\{region\}/g, awsRegion);
   if (inv.expectedEtag) headers["if-match"] = inv.expectedEtag;
   const sendsBody = request4.method !== "GET" && (request4.method !== "DELETE" || request4.body !== void 0);
+  const bodyEncoding = request4.bodyEncoding ?? "json";
   if (sendsBody && getHeaderCI(headers, "content-type") === void 0) {
-    headers["content-type"] = "application/json";
+    headers["content-type"] = bodyEncoding === "form" ? "application/x-www-form-urlencoded" : "application/json";
   }
   let resolvedBody = sendsBody ? resolveBody(request4.body, inv.args, scope, requiredArgs) : void 0;
   if (placement.kind === "structured-json-body") {
@@ -996,7 +998,7 @@ async function executeRestRequest(spec, request4, inv, requiredArgs) {
       )
     };
   }
-  const bodyString = sendsBody ? JSON.stringify(resolvedBody) : void 0;
+  const bodyString = sendsBody ? serializeRequestBody(spec.kind, bodyEncoding, resolvedBody) : void 0;
   if (placement.kind === "aws-sigv4") {
     signAwsRequest(headers, url, {
       method: request4.method,
@@ -1072,6 +1074,21 @@ async function executeRestRequest(spec, request4, inv, requiredArgs) {
   }
   return { data: data4, etag: res.headers.get("etag") ?? void 0 };
 }
+function serializeRequestBody(connectorKind, encoding, body) {
+  if (encoding === "json") return JSON.stringify(body);
+  if (!body || typeof body !== "object" || Array.isArray(body)) {
+    throw new Error(`${connectorKind}: form request bodies require a flat object`);
+  }
+  const form2 = new URLSearchParams();
+  for (const [key, value] of Object.entries(body)) {
+    if (value === void 0 || value === null) continue;
+    if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean") {
+      throw new Error(`${connectorKind}: form field ${key} must be a scalar value`);
+    }
+    form2.set(key, String(value));
+  }
+  return form2.toString();
+}
 function resolveBaseUrl(baseUrl4, metadata, allowedBaseUrls, allowedBaseUrlSuffixes, requirePublicHttpsBaseUrl) {
   let resolved;
   if (typeof baseUrl4 === "string") {
@@ -1628,7 +1645,325 @@ function membershipCapability(name, method, description) {
 }
 
 // src/connectors/adapters/client-credentials-rest.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
+
+// src/connectors/oauth.ts
+import { createHash as createHash2, randomBytes } from "crypto";
+var PENDING_TTL_MS = 10 * 60 * 1e3;
+var InMemoryOAuthFlowStore = class {
+  pendingFlows = /* @__PURE__ */ new Map();
+  put(state, flow) {
+    this.pendingFlows.set(state, flow);
+  }
+  consume(state) {
+    const flow = this.pendingFlows.get(state);
+    this.pendingFlows.delete(state);
+    if (!flow || flow.expiresAt <= Date.now()) return void 0;
+    return flow;
+  }
+  sweep(now) {
+    for (const [k, v] of this.pendingFlows) {
+      if (v.expiresAt <= now) this.pendingFlows.delete(k);
+    }
+  }
+  clear() {
+    this.pendingFlows.clear();
+  }
+};
+var defaultFlowStore = new InMemoryOAuthFlowStore();
+function startOAuthFlow(input) {
+  const store = input.store ?? defaultFlowStore;
+  const now = input.now ?? Date.now();
+  store.sweep?.(now);
+  const usePkce = (input.pkce ?? "required") !== "unsupported";
+  const codeVerifier = usePkce ? base64Url(randomBytes(48)) : void 0;
+  const codeChallenge = codeVerifier ? base64Url(createHash2("sha256").update(codeVerifier).digest()) : void 0;
+  const state = base64Url(randomBytes(24));
+  store.put(state, {
+    codeVerifier,
+    state,
+    projectId: input.projectId,
+    kind: input.kind,
+    label: input.label,
+    redirectUri: input.redirectUri,
+    expiresAt: now + PENDING_TTL_MS
+  });
+  const url = new URL(input.authorizationUrl);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set(
+    oauthParameterName(input.authorizationClientIdParam, "client_id"),
+    input.clientId
+  );
+  url.searchParams.set("redirect_uri", input.redirectUri);
+  url.searchParams.set("scope", input.scopes.join(input.scopeSeparator ?? " "));
+  url.searchParams.set("state", state);
+  if (input.extraAuthParams) {
+    for (const [k, v] of Object.entries(input.extraAuthParams)) {
+      url.searchParams.set(k, v);
+    }
+  }
+  if (codeChallenge) {
+    url.searchParams.set("code_challenge", codeChallenge);
+    url.searchParams.set("code_challenge_method", "S256");
+  } else {
+    url.searchParams.delete("code_challenge");
+    url.searchParams.delete("code_challenge_method");
+  }
+  return { authorizationUrl: url.toString(), state };
+}
+async function consumePendingFlow(state, store = defaultFlowStore) {
+  await store.sweep?.(Date.now());
+  const flow = await store.consume(state);
+  if (!flow) {
+    throw new Error("Unknown or expired OAuth state: possible CSRF, replay, or stale flow");
+  }
+  return flow;
+}
+async function exchangeAuthorizationCode(input) {
+  const usePkce = (input.pkce ?? "required") !== "unsupported";
+  if (usePkce && !input.codeVerifier) {
+    throw new Error("OAuth token exchange requires a PKCE code_verifier");
+  }
+  const body = new URLSearchParams({
+    grant_type: "authorization_code",
+    code: input.code,
+    redirect_uri: input.redirectUri
+  });
+  if (usePkce) body.set("code_verifier", input.codeVerifier);
+  const headers = createOAuthTokenRequestHeaders(input.tokenRequestHeaders);
+  applyTokenClientAuthentication(input, body, headers);
+  const redactionValues = [
+    input.code,
+    ...input.codeVerifier ? [input.codeVerifier] : [],
+    ...oauthClientCredentialRedactionValues(
+      input.clientId,
+      input.clientSecret,
+      headers.authorization
+    )
+  ];
+  let res;
+  try {
+    res = await (input.fetchImpl ?? fetch)(input.tokenUrl, {
+      method: "POST",
+      headers,
+      body,
+      signal: input.signal
+    });
+  } catch (cause) {
+    const detail = redactOAuthSensitiveText(
+      cause?.message ?? "unknown",
+      redactionValues
+    );
+    throw new Error(`OAuth token exchange transport error: ${detail}`);
+  }
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    const statusText = redactOAuthSensitiveText(res.statusText, redactionValues);
+    const detail = redactOAuthSensitiveText(text, redactionValues).slice(0, 200);
+    throw new Error(
+      `OAuth token exchange failed: ${res.status} ${statusText} \u2014 ${detail}`
+    );
+  }
+  let json;
+  try {
+    json = await res.json();
+  } catch {
+    throw new Error("OAuth token exchange returned invalid JSON");
+  }
+  return {
+    accessToken: json.access_token,
+    refreshToken: json.refresh_token,
+    expiresIn: json.expires_in,
+    scope: json.scope,
+    tokenType: json.token_type,
+    idToken: json.id_token
+  };
+}
+async function refreshAccessToken(input) {
+  const body = new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token: input.refreshToken
+  });
+  const headers = createOAuthTokenRequestHeaders(input.tokenRequestHeaders);
+  applyTokenClientAuthentication(input, body, headers);
+  const redactionValues = [
+    input.refreshToken,
+    ...oauthClientCredentialRedactionValues(
+      input.clientId,
+      input.clientSecret,
+      headers.authorization
+    )
+  ];
+  let res;
+  try {
+    res = await (input.fetchImpl ?? fetch)(input.tokenUrl, {
+      method: "POST",
+      headers,
+      body,
+      signal: input.signal
+    });
+  } catch (cause) {
+    const detail = redactOAuthSensitiveText(
+      cause?.message ?? "unknown",
+      redactionValues
+    );
+    throw new Error(`OAuth refresh transport error: ${detail}`);
+  }
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    const statusText = redactOAuthSensitiveText(res.statusText, redactionValues);
+    const detail = redactOAuthSensitiveText(text, redactionValues).slice(0, 200);
+    throw new Error(`OAuth refresh failed: ${res.status} ${statusText} \u2014 ${detail}`);
+  }
+  let json;
+  try {
+    json = await res.json();
+  } catch {
+    throw new Error("OAuth refresh returned invalid JSON");
+  }
+  return {
+    accessToken: json.access_token,
+    // Some providers omit refresh_token on refresh — keep the previous one
+    // in that case (caller passes through if undefined).
+    refreshToken: json.refresh_token,
+    expiresIn: json.expires_in,
+    scope: json.scope,
+    tokenType: json.token_type,
+    idToken: json.id_token
+  };
+}
+function createOAuthTokenRequestHeaders(additional) {
+  const headers = new Headers(additional);
+  headers.set("content-type", "application/x-www-form-urlencoded");
+  headers.set("accept", "application/json");
+  headers.delete("authorization");
+  return Object.fromEntries(headers.entries());
+}
+function formEncodeOAuthClientCredential(value) {
+  return new URLSearchParams({ value }).toString().slice("value=".length);
+}
+function createOAuthBasicAuthorizationHeader(clientId, clientSecret, encodeBase64 = defaultOAuthBase64Encode) {
+  const encodedClientId = formEncodeOAuthClientCredential(clientId);
+  const encodedClientSecret = formEncodeOAuthClientCredential(clientSecret);
+  return `Basic ${encodeBase64(`${encodedClientId}:${encodedClientSecret}`)}`;
+}
+function defaultOAuthBase64Encode(value) {
+  const encode = globalThis.btoa;
+  if (typeof encode !== "function") {
+    throw new Error(
+      "OAuth client_secret_basic requires a base64 encoder in this runtime."
+    );
+  }
+  return encode(value);
+}
+function oauthClientCredentialRedactionValues(clientId, clientSecret, authorization) {
+  return [
+    clientId,
+    ...clientSecret ? [clientSecret] : [],
+    ...authorization ? [
+      authorization,
+      ...authorization.startsWith("Basic ") ? [authorization.slice("Basic ".length)] : []
+    ] : []
+  ];
+}
+function redactOAuthSensitiveText(text, secrets) {
+  const matchers = /* @__PURE__ */ new Map();
+  for (const secret of new Set(secrets)) {
+    if (secret.length === 0) continue;
+    addOAuthRedactionMatcher(matchers, escapeRegExp(secret), secret.length);
+    const jsonEscaped = JSON.stringify(secret).slice(1, -1);
+    addOAuthRedactionMatcher(
+      matchers,
+      escapeRegExp(jsonEscaped),
+      jsonEscaped.length
+    );
+    const formEncoded = formEncodeOAuthClientCredential(secret);
+    addOAuthRedactionMatcher(
+      matchers,
+      formEncodedRedactionPattern(formEncoded),
+      Math.max(formEncoded.length, formEncoded.replaceAll("+", "%20").length)
+    );
+  }
+  return [...matchers.values()].sort((left, right) => right.representedLength - left.representedLength).reduce(
+    (redacted, matcher) => redacted.replace(matcher.pattern, "[REDACTED]"),
+    text
+  );
+}
+function addOAuthRedactionMatcher(matchers, source, representedLength) {
+  const existing = matchers.get(source);
+  if (existing && existing.representedLength >= representedLength) return;
+  matchers.set(source, {
+    pattern: new RegExp(source, "g"),
+    representedLength
+  });
+}
+function formEncodedRedactionPattern(formEncoded) {
+  let pattern = "";
+  for (let index = 0; index < formEncoded.length; index += 1) {
+    const character = formEncoded[index];
+    const encodedByte = formEncoded.slice(index + 1, index + 3);
+    if (character === "%" && /^[0-9A-F]{2}$/.test(encodedByte)) {
+      pattern += `%${percentEncodedBytePattern(encodedByte)}`;
+      index += 2;
+      continue;
+    }
+    if (character === "+") {
+      pattern += "(?:\\+|%20)";
+      continue;
+    }
+    pattern += escapeRegExp(character);
+  }
+  return pattern;
+}
+function percentEncodedBytePattern(encodedByte) {
+  return [...encodedByte].map(
+    (character) => /[A-F]/.test(character) ? `[${character}${character.toLowerCase()}]` : character
+  ).join("");
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function applyTokenClientAuthentication(input, body, headers) {
+  const method = input.tokenClientAuthMethod ?? "client_secret_post";
+  if (method === "none") {
+    body.set(oauthParameterName(input.tokenClientIdParam, "client_id"), input.clientId);
+    return;
+  }
+  if (!input.clientSecret) {
+    throw new Error(`OAuth ${method} client authentication requires a client secret`);
+  }
+  if (method === "client_secret_post") {
+    body.set(oauthParameterName(input.tokenClientIdParam, "client_id"), input.clientId);
+    body.set(
+      oauthParameterName(input.tokenClientSecretParam, "client_secret"),
+      input.clientSecret
+    );
+    return;
+  }
+  if (method === "client_secret_basic") {
+    headers.authorization = createOAuthBasicAuthorizationHeader(
+      input.clientId,
+      input.clientSecret
+    );
+    return;
+  }
+  throw new Error("Unsupported OAuth token client authentication method");
+}
+function base64Url(buf) {
+  return buf.toString("base64").replace(/=+$/, "").replace(/\+/g, "-").replace(/\//g, "_");
+}
+function oauthParameterName(value, fallback) {
+  const name = value ?? fallback;
+  if (!/^[A-Za-z][A-Za-z0-9_.-]{0,63}$/.test(name)) {
+    throw new Error("Invalid OAuth parameter name");
+  }
+  return name;
+}
+function _resetPendingFlowsForTests() {
+  defaultFlowStore.clear?.();
+}
+
+// src/connectors/adapters/client-credentials-rest.ts
 function clientCredentialsRestConnector(spec) {
   const regionMetadataKey = spec.regionMetadataKey ?? "region";
   const delegated = declarativeRestConnector({
@@ -1747,7 +2082,7 @@ function readRegionName(bundle, metadata, metadataKey, fallback) {
   return (bundle.region ?? metadataRegion ?? fallback).toLowerCase().trim();
 }
 function credentialFingerprint(bundle, region, scope) {
-  return createHash2("sha256").update(bundle.clientId).update("\0").update(bundle.clientSecret).update("\0").update(region.tokenUrl).update("\0").update(scope ?? "").digest("hex");
+  return createHash3("sha256").update(bundle.clientId).update("\0").update(bundle.clientSecret).update("\0").update(region.tokenUrl).update("\0").update(scope ?? "").digest("hex");
 }
 function renderConnectionMetadata(template, metadata) {
   const rendered = template.replace(/\{connection\.([a-zA-Z0-9_.-]+)\}/g, (_match, key) => {
@@ -1778,7 +2113,10 @@ async function exchangeClientCredentials(displayName, sourceId, bundle, region,
     "content-type": "application/x-www-form-urlencoded"
   };
   if (credentialPlacement === "basic") {
-    headers.authorization = `Basic ${Buffer.from(`${bundle.clientId}:${bundle.clientSecret}`).toString("base64")}`;
+    headers.authorization = createOAuthBasicAuthorizationHeader(
+      bundle.clientId,
+      bundle.clientSecret
+    );
   }
   const response = await fetch(region.tokenUrl, {
     method: "POST",
@@ -16132,39 +16470,46 @@ var pushbulletConnector = declarativeRestConnector({
 });
 
 // src/connectors/adapters/reddit.ts
-var redditConnector = declarativeRestConnector({
+var REDDIT_USER_AGENT = "web:tools.tangle.integration-hub:v1.0 (contact: https://tangle.tools)";
+var REDDIT_TOKEN_URL = "https://www.reddit.com/api/v1/access_token";
+var redditSpec = {
   kind: "reddit",
   displayName: "Reddit",
   description: "Interact with Reddit \u2014 fetch and submit posts, retrieve comments, create and edit posts/comments.",
   auth: {
     kind: "oauth2",
     authorizationUrl: "https://www.reddit.com/api/v1/authorize",
-    tokenUrl: "https://www.reddit.com/api/v1/access_token",
-    scopes: ["read", "submit", "edit"],
+    tokenUrl: REDDIT_TOKEN_URL,
+    scopes: ["identity", "read", "submit", "edit"],
+    pkce: "unsupported",
+    tokenClientAuthMethod: "client_secret_basic",
+    extraAuthParams: { duration: "permanent" },
+    tokenRequestHeaders: { "User-Agent": REDDIT_USER_AGENT },
     clientIdEnv: "REDDIT_OAUTH_CLIENT_ID",
     clientSecretEnv: "REDDIT_OAUTH_CLIENT_SECRET"
   },
   category: "comms",
   defaultConsistencyModel: "authoritative",
   baseUrl: "https://oauth.reddit.com",
+  defaultHeaders: { "User-Agent": REDDIT_USER_AGENT },
   test: { method: "GET", path: "/api/v1/me" },
   capabilities: [
     {
       name: "post.retrieve",
       class: "read",
-      description: "Retrieve a Reddit post by its ID or fullname.",
+      description: "Retrieve a Reddit post by its fullname, such as t3_abc123.",
       parameters: {
         type: "object",
         properties: {
-          postId: { type: "string" }
+          postId: { type: "string", description: "Reddit post fullname, such as t3_abc123." }
         },
         required: ["postId"]
       },
       request: {
         method: "GET",
-        path: "/r/{subreddit}/comments/{postId}",
-        headers: {
-          "User-Agent": "AgentDev/1.0"
+        path: "/api/info",
+        query: {
+          id: "{postId}"
         }
       },
       requiredScopes: ["read"]
@@ -16183,10 +16528,7 @@ var redditConnector = declarativeRestConnector({
       },
       request: {
         method: "GET",
-        path: "/r/{subreddit}/comments/{postId}",
-        headers: {
-          "User-Agent": "AgentDev/1.0"
-        }
+        path: "/r/{subreddit}/comments/{postId}"
       },
       requiredScopes: ["read"]
     },
@@ -16199,27 +16541,28 @@ var redditConnector = declarativeRestConnector({
         properties: {
           subreddit: { type: "string" },
           title: { type: "string" },
+          kind: { type: "string", enum: ["self", "link"] },
           text: { type: "string" },
           url: { type: "string" },
           flair_id: { type: "string" }
         },
-        required: ["subreddit", "title"]
+        required: ["subreddit", "title", "kind"]
       },
       request: {
         method: "POST",
-        path: "/r/{subreddit}/submit",
+        path: "/api/submit",
+        bodyEncoding: "form",
         body: {
+          api_type: "json",
+          sr: "{subreddit}",
           title: "{title}",
+          kind: "{kind}",
           text: "{text}",
           url: "{url}",
-          flair_id: "{flair_id}",
-          kind: "self"
-        },
-        headers: {
-          "User-Agent": "AgentDev/1.0"
+          flair_id: "{flair_id}"
         }
       },
-      cas: "native-idempotency",
+      cas: "none",
       externalEffect: true,
       requiredScopes: ["submit"]
     },
@@ -16238,15 +16581,14 @@ var redditConnector = declarativeRestConnector({
       request: {
         method: "POST",
         path: "/api/comment",
+        bodyEncoding: "form",
         body: {
+          api_type: "json",
           thing_id: "{parentId}",
           text: "{text}"
-        },
-        headers: {
-          "User-Agent": "AgentDev/1.0"
         }
       },
-      cas: "native-idempotency",
+      cas: "none",
       externalEffect: true,
       requiredScopes: ["submit"]
     },
@@ -16270,9 +16612,6 @@ var redditConnector = declarativeRestConnector({
         query: {
           sort: "{sort}",
           limit: "{limit}"
-        },
-        headers: {
-          "User-Agent": "AgentDev/1.0"
         }
       },
       requiredScopes: ["read"]
@@ -16292,15 +16631,15 @@ var redditConnector = declarativeRestConnector({
       request: {
         method: "POST",
         path: "/api/editusertext",
+        bodyEncoding: "form",
         body: {
+          api_type: "json",
           thing_id: "{thingId}",
           text: "{text}"
-        },
-        headers: {
-          "User-Agent": "AgentDev/1.0"
         }
       },
-      cas: "optimistic-read-verify",
+      cas: "none",
+      externalEffect: true,
       requiredScopes: ["edit"]
     },
     {
@@ -16318,15 +16657,15 @@ var redditConnector = declarativeRestConnector({
       request: {
         method: "POST",
         path: "/api/editusertext",
+        bodyEncoding: "form",
         body: {
+          api_type: "json",
           thing_id: "{thingId}",
           text: "{text}"
-        },
-        headers: {
-          "User-Agent": "AgentDev/1.0"
         }
       },
-      cas: "optimistic-read-verify",
+      cas: "none",
+      externalEffect: true,
       requiredScopes: ["edit"]
     },
     {
@@ -16343,13 +16682,12 @@ var redditConnector = declarativeRestConnector({
       request: {
         method: "POST",
         path: "/api/del",
+        bodyEncoding: "form",
         body: {
           id: "{thingId}"
-        },
-        headers: {
-          "User-Agent": "AgentDev/1.0"
         }
       },
+      cas: "none",
       externalEffect: true,
       requiredScopes: ["edit"]
     },
@@ -16367,18 +16705,150 @@ var redditConnector = declarativeRestConnector({
       request: {
         method: "POST",
         path: "/api/del",
+        bodyEncoding: "form",
         body: {
           id: "{thingId}"
-        },
-        headers: {
-          "User-Agent": "AgentDev/1.0"
         }
       },
+      cas: "none",
       externalEffect: true,
       requiredScopes: ["edit"]
     }
   ]
-});
+};
+var redditConnector = declarativeRestConnector(redditSpec);
+function reddit(options) {
+  const adapter = declarativeRestConnector(redditSpec);
+  const now = options.now ?? Date.now;
+  const refreshes = /* @__PURE__ */ new Map();
+  const refresh = async (credentials) => {
+    if (credentials.kind !== "oauth2" || !credentials.refreshToken) {
+      throw new Error("reddit.refreshToken: missing refresh token");
+    }
+    const tokens = await refreshAccessToken({
+      tokenUrl: REDDIT_TOKEN_URL,
+      clientId: options.clientId,
+      clientSecret: options.clientSecret,
+      tokenClientAuthMethod: "client_secret_basic",
+      refreshToken: credentials.refreshToken,
+      tokenRequestHeaders: { "User-Agent": REDDIT_USER_AGENT },
+      fetchImpl: options.fetchImpl
+    });
+    if (!tokens.accessToken || !tokens.expiresIn) {
+      throw new Error("Reddit token refresh returned an incomplete grant");
+    }
+    return {
+      kind: "oauth2",
+      accessToken: tokens.accessToken,
+      refreshToken: tokens.refreshToken ?? credentials.refreshToken,
+      expiresAt: now() + tokens.expiresIn * 1e3
+    };
+  };
+  adapter.refreshToken = refresh;
+  const withFreshCredentials = async (invocation) => {
+    const credentials = invocation.source.credentials;
+    if (credentials.kind !== "oauth2") {
+      throw new CredentialsExpired("Reddit requires OAuth2 credentials.", invocation.source.id);
+    }
+    if (credentials.expiresAt !== void 0 && credentials.expiresAt > now() + 6e4) {
+      return invocation;
+    }
+    if (!credentials.refreshToken) {
+      throw new CredentialsExpired(
+        "Reddit access token expired and no refresh token is available.",
+        invocation.source.id
+      );
+    }
+    let pending = refreshes.get(invocation.source.id);
+    if (!pending) {
+      let next;
+      const promise = Promise.resolve().then(() => {
+        if (!next.onCredentialsRotated) {
+          throw new Error("reddit: credential rotation persistence callback is required before refreshing");
+        }
+        return refresh(credentials);
+      });
+      next = {
+        promise,
+        onCredentialsRotated: invocation.onCredentialsRotated
+      };
+      pending = next;
+      refreshes.set(invocation.source.id, pending);
+    } else if (!pending.onCredentialsRotated && invocation.onCredentialsRotated) {
+      pending.onCredentialsRotated = invocation.onCredentialsRotated;
+    }
+    const current = pending;
+    try {
+      const refreshed = await current.promise;
+      current.persistence ??= Promise.resolve().then(
+        () => current.onCredentialsRotated?.(refreshed)
+      );
+      await current.persistence;
+      return {
+        ...invocation,
+        source: { ...invocation.source, credentials: refreshed }
+      };
+    } finally {
+      if (refreshes.get(invocation.source.id) === current) {
+        refreshes.delete(invocation.source.id);
+      }
+    }
+  };
+  return {
+    ...adapter,
+    async exchangeOAuth(input) {
+      const tokens = await exchangeAuthorizationCode({
+        tokenUrl: REDDIT_TOKEN_URL,
+        clientId: options.clientId,
+        clientSecret: options.clientSecret,
+        tokenClientAuthMethod: "client_secret_basic",
+        code: input.code,
+        codeVerifier: input.codeVerifier,
+        pkce: "unsupported",
+        redirectUri: input.redirectUri,
+        tokenRequestHeaders: { "User-Agent": REDDIT_USER_AGENT },
+        fetchImpl: options.fetchImpl
+      });
+      if (!tokens.accessToken || !tokens.refreshToken || !tokens.expiresIn) {
+        throw new Error("Reddit token exchange returned an incomplete permanent grant");
+      }
+      return {
+        credentials: {
+          kind: "oauth2",
+          accessToken: tokens.accessToken,
+          refreshToken: tokens.refreshToken,
+          expiresAt: now() + tokens.expiresIn * 1e3
+        },
+        scopes: tokens.scope?.split(/[\s,]+/).filter(Boolean) ?? [...redditSpec.auth.scopes],
+        metadata: {}
+      };
+    },
+    refreshToken: refresh,
+    async executeRead(invocation) {
+      return adapter.executeRead(await withFreshCredentials(invocation));
+    },
+    async executeMutation(invocation) {
+      return adapter.executeMutation(await withFreshCredentials(invocation));
+    },
+    async test(source, onCredentialsRotated) {
+      try {
+        const invocation = await withFreshCredentials({
+          source,
+          capabilityName: "__test__",
+          args: {},
+          idempotencyKey: "reddit-connection-test",
+          onCredentialsRotated
+        });
+        return adapter.test(invocation.source);
+      } catch (error) {
+        return {
+          ok: false,
+          reason: error instanceof Error ? error.message : "unknown error"
+        };
+      }
+    }
+  };
+}
 
 // src/connectors/adapters/rippling.ts
 var ripplingConnector = declarativeRestConnector({
@@ -24774,7 +25244,7 @@ function numberOrUndefined(value) {
 }
 
 // src/connectors/adapters/azure-event-grid.ts
-import { createHash as createHash3, timingSafeEqual } from "crypto";
+import { createHash as createHash4, timingSafeEqual } from "crypto";
 var API_VERSION2 = "2018-01-01";
 var MAX_BATCH_BYTES = 1024 * 1024;
 var MAX_EVENTS = 5e3;
@@ -24843,8 +25313,8 @@ var azureEventGridConnector = {
     }
     const provided = headerValue(headers, "x-tangle-eventgrid-secret");
     if (!provided) return { valid: false, reason: "Missing x-tangle-eventgrid-secret delivery header" };
-    const expectedDigest = createHash3("sha256").update(credentials.deliverySecret).digest();
-    const providedDigest = createHash3("sha256").update(provided).digest();
+    const expectedDigest = createHash4("sha256").update(credentials.deliverySecret).digest();
+    const providedDigest = createHash4("sha256").update(provided).digest();
     return timingSafeEqual(expectedDigest, providedDigest) ? { valid: true } : { valid: false, reason: "Invalid x-tangle-eventgrid-secret delivery header" };
   },
   async handleInboundEvent({ rawBody }) {
@@ -27362,186 +27832,6 @@ var billplzConnector = declarativeRestConnector({
   ]
 });
 
-// src/connectors/oauth.ts
-import { createHash as createHash4, randomBytes } from "crypto";
-var PENDING_TTL_MS = 10 * 60 * 1e3;
-var InMemoryOAuthFlowStore = class {
-  pendingFlows = /* @__PURE__ */ new Map();
-  put(state, flow) {
-    this.pendingFlows.set(state, flow);
-  }
-  consume(state) {
-    const flow = this.pendingFlows.get(state);
-    this.pendingFlows.delete(state);
-    if (!flow || flow.expiresAt <= Date.now()) return void 0;
-    return flow;
-  }
-  sweep(now) {
-    for (const [k, v] of this.pendingFlows) {
-      if (v.expiresAt <= now) this.pendingFlows.delete(k);
-    }
-  }
-  clear() {
-    this.pendingFlows.clear();
-  }
-};
-var defaultFlowStore = new InMemoryOAuthFlowStore();
-function startOAuthFlow(input) {
-  const store = input.store ?? defaultFlowStore;
-  const now = input.now ?? Date.now();
-  store.sweep?.(now);
-  const usePkce = (input.pkce ?? "required") !== "unsupported";
-  const codeVerifier = usePkce ? base64Url(randomBytes(48)) : void 0;
-  const codeChallenge = codeVerifier ? base64Url(createHash4("sha256").update(codeVerifier).digest()) : void 0;
-  const state = base64Url(randomBytes(24));
-  store.put(state, {
-    codeVerifier,
-    state,
-    projectId: input.projectId,
-    kind: input.kind,
-    label: input.label,
-    redirectUri: input.redirectUri,
-    expiresAt: now + PENDING_TTL_MS
-  });
-  const url = new URL(input.authorizationUrl);
-  url.searchParams.set("response_type", "code");
-  url.searchParams.set(
-    oauthParameterName(input.authorizationClientIdParam, "client_id"),
-    input.clientId
-  );
-  url.searchParams.set("redirect_uri", input.redirectUri);
-  url.searchParams.set("scope", input.scopes.join(input.scopeSeparator ?? " "));
-  url.searchParams.set("state", state);
-  if (input.extraAuthParams) {
-    for (const [k, v] of Object.entries(input.extraAuthParams)) {
-      url.searchParams.set(k, v);
-    }
-  }
-  if (codeChallenge) {
-    url.searchParams.set("code_challenge", codeChallenge);
-    url.searchParams.set("code_challenge_method", "S256");
-  } else {
-    url.searchParams.delete("code_challenge");
-    url.searchParams.delete("code_challenge_method");
-  }
-  return { authorizationUrl: url.toString(), state };
-}
-async function consumePendingFlow(state, store = defaultFlowStore) {
-  await store.sweep?.(Date.now());
-  const flow = await store.consume(state);
-  if (!flow) {
-    throw new Error("Unknown or expired OAuth state: possible CSRF, replay, or stale flow");
-  }
-  return flow;
-}
-async function exchangeAuthorizationCode(input) {
-  const usePkce = (input.pkce ?? "required") !== "unsupported";
-  if (usePkce && !input.codeVerifier) {
-    throw new Error("OAuth token exchange requires a PKCE code_verifier");
-  }
-  const body = new URLSearchParams({
-    grant_type: "authorization_code",
-    code: input.code,
-    redirect_uri: input.redirectUri
-  });
-  if (usePkce) body.set("code_verifier", input.codeVerifier);
-  const headers = {
-    "content-type": "application/x-www-form-urlencoded",
-    accept: "application/json"
-  };
-  applyTokenClientAuthentication(input, body, headers);
-  const res = await (input.fetchImpl ?? fetch)(input.tokenUrl, {
-    method: "POST",
-    headers,
-    body,
-    signal: input.signal
-  });
-  if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`OAuth token exchange failed: ${res.status} ${res.statusText} \u2014 ${text.slice(0, 200)}`);
-  }
-  const json = await res.json();
-  return {
-    accessToken: json.access_token,
-    refreshToken: json.refresh_token,
-    expiresIn: json.expires_in,
-    scope: json.scope,
-    tokenType: json.token_type,
-    idToken: json.id_token
-  };
-}
-async function refreshAccessToken(input) {
-  const body = new URLSearchParams({
-    grant_type: "refresh_token",
-    refresh_token: input.refreshToken
-  });
-  const headers = {
-    "content-type": "application/x-www-form-urlencoded",
-    accept: "application/json"
-  };
-  applyTokenClientAuthentication(input, body, headers);
-  const res = await (input.fetchImpl ?? fetch)(input.tokenUrl, {
-    method: "POST",
-    headers,
-    body,
-    signal: input.signal
-  });
-  if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`OAuth refresh failed: ${res.status} ${res.statusText} \u2014 ${text.slice(0, 200)}`);
-  }
-  const json = await res.json();
-  return {
-    accessToken: json.access_token,
-    // Some providers omit refresh_token on refresh — keep the previous one
-    // in that case (caller passes through if undefined).
-    refreshToken: json.refresh_token,
-    expiresIn: json.expires_in,
-    scope: json.scope,
-    tokenType: json.token_type,
-    idToken: json.id_token
-  };
-}
-function applyTokenClientAuthentication(input, body, headers) {
-  const method = input.tokenClientAuthMethod ?? "client_secret_post";
-  if (method === "none") {
-    body.set(oauthParameterName(input.tokenClientIdParam, "client_id"), input.clientId);
-    return;
-  }
-  if (!input.clientSecret) {
-    throw new Error(`OAuth ${method} client authentication requires a client secret`);
-  }
-  if (method === "client_secret_post") {
-    body.set(oauthParameterName(input.tokenClientIdParam, "client_id"), input.clientId);
-    body.set(
-      oauthParameterName(input.tokenClientSecretParam, "client_secret"),
-      input.clientSecret
-    );
-    return;
-  }
-  if (method === "client_secret_basic") {
-    headers.authorization = `Basic ${Buffer.from(
-      `${input.clientId}:${input.clientSecret}`,
-      "utf8"
-    ).toString("base64")}`;
-    return;
-  }
-  throw new Error("Unsupported OAuth token client authentication method");
-}
-function base64Url(buf) {
-  return buf.toString("base64").replace(/=+$/, "").replace(/\+/g, "-").replace(/\//g, "_");
-}
-function oauthParameterName(value, fallback) {
-  const name = value ?? fallback;
-  if (!/^[A-Za-z][A-Za-z0-9_.-]{0,63}$/.test(name)) {
-    throw new Error("Invalid OAuth parameter name");
-  }
-  return name;
-}
-function _resetPendingFlowsForTests() {
-  defaultFlowStore.clear?.();
-}
-
 // src/connectors/adapters/cal-com.ts
 var authorizeUrl = "https://app.cal.com/auth/oauth2/authorize";
 var tokenUrl = "https://api.cal.com/v2/auth/oauth2/token";
@@ -52737,13 +53027,11 @@ function microsoftTeams(opts) {
     async test(source) {
       try {
         const accessToken4 = await ensureFreshAccessToken11(source.credentials, clientId, clientSecret);
-        const res = await fetch(`${GRAPH2}/me?$select=id`, {
+        const res = await fetch(`${GRAPH2}/me/joinedTeams`, {
           headers: { authorization: `Bearer ${accessToken4}` },
           signal: AbortSignal.timeout(8e3)
         });
-        if (res.status === 401 || res.status === 403) {
-          return { ok: false, reason: `Microsoft rejected token (${res.status}) \u2014 reconnect required` };
-        }
+        if (res.status === 401 || res.status === 403) return microsoftGraphTestFailure(res);
         if (!res.ok) return { ok: false, reason: `Microsoft Graph returned ${res.status}` };
         return { ok: true };
       } catch (err) {
@@ -52804,7 +53092,7 @@ async function graphGet2(url, accessToken4, dataSourceId) {
     signal: AbortSignal.timeout(1e4)
   });
   if (res.status === 401 || res.status === 403) {
-    throw new CredentialsExpired(`Microsoft Graph rejected token (${res.status})`, dataSourceId);
+    await throwMicrosoftGraphAccessError(res, dataSourceId);
   }
   if (!res.ok) {
     const text = await res.text().catch(() => "");
@@ -52824,7 +53112,7 @@ async function graphPost(url, accessToken4, body, dataSourceId, op) {
     signal: AbortSignal.timeout(15e3)
   });
   if (res.status === 401 || res.status === 403) {
-    throw new CredentialsExpired(`Microsoft Graph rejected token (${res.status})`, dataSourceId);
+    await throwMicrosoftGraphAccessError(res, dataSourceId);
   }
   if (!res.ok) {
     const text = await res.text().catch(() => "");
@@ -52832,6 +53120,57 @@ async function graphPost(url, accessToken4, body, dataSourceId, op) {
   }
   return await res.json();
 }
+async function microsoftGraphErrorBody(res) {
+  try {
+    const body = await res.json();
+    return body && typeof body === "object" ? body : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function microsoftGraphErrorText(body) {
+  const code = typeof body?.error?.code === "string" ? body.error.code : "";
+  const message = typeof body?.error?.message === "string" ? body.error.message : "";
+  return `${code} ${message}`.trim();
+}
+function microsoftGraphRequiresLicense(body) {
+  return /\b(?:valid\s+)?licen[cs]e\b/i.test(microsoftGraphErrorText(body));
+}
+async function throwMicrosoftGraphAccessError(res, dataSourceId) {
+  const body = await microsoftGraphErrorBody(res);
+  if (microsoftGraphRequiresLicense(body)) {
+    throw new ProviderConfigError(
+      "Microsoft Teams requires a valid Microsoft 365 or Teams license",
+      dataSourceId,
+      { status: res.status, reason: "licenseRequired", body }
+    );
+  }
+  if (res.status === 403) {
+    throw new ProviderConfigError("Microsoft Graph denied the requested permission", dataSourceId, {
+      status: res.status,
+      reason: typeof body?.error?.code === "string" && body.error.code ? body.error.code : "forbidden",
+      body
+    });
+  }
+  throw new CredentialsExpired(`Microsoft Graph rejected token (${res.status})`, dataSourceId, {
+    status: res.status,
+    reason: typeof body?.error?.code === "string" && body.error.code ? body.error.code : "unauthorized",
+    body
+  });
+}
+async function microsoftGraphTestFailure(res) {
+  const body = await microsoftGraphErrorBody(res);
+  if (microsoftGraphRequiresLicense(body)) {
+    return {
+      ok: false,
+      reason: "Microsoft Teams requires a valid Microsoft 365 or Teams license"
+    };
+  }
+  if (res.status === 403) {
+    return { ok: false, reason: "Microsoft Graph denied the requested permission" };
+  }
+  return { ok: false, reason: `Microsoft rejected token (${res.status}) \u2014 reconnect required` };
+}
 function escapeOData2(value) {
   return value.replace(/'/g, "''");
 }
@@ -55827,6 +56166,7 @@ var NOTION_SPEC = {
     scopes: [],
     clientIdEnv: "NOTION_OAUTH_CLIENT_ID",
     clientSecretEnv: "NOTION_OAUTH_CLIENT_SECRET",
+    tokenClientAuthMethod: "client_secret_basic",
     extraAuthParams: { owner: "user" }
   },
   category: "doc",
@@ -56149,11 +56489,9 @@ function notion(opts) {
     ...withNotionOverrides(declarativeRestConnector(NOTION_SPEC)),
     /**
      * Notion's token endpoint follows RFC 6749 with one twist — it REQUIRES
-     * HTTP Basic auth (client_id:client_secret) and does NOT accept the client
-     * credentials in the form body, so we POST inline rather than via the
-     * generic `exchangeAuthorizationCode` helper. The workspace_id/bot_id come
-     * back in the response and we stash them in `metadata` so the agent can
-     * address resources by workspace where useful.
+     * HTTP Basic auth and returns workspace metadata with the grant. We use
+     * the shared Basic encoding and redaction primitives, then retain that
+     * metadata for resource selection.
      */
     async exchangeOAuth(input) {
       if (!clientId || !clientSecret) {
@@ -56168,22 +56506,62 @@ function notion(opts) {
         redirect_uri: input.redirectUri,
         code_verifier: input.codeVerifier
       });
-      const res = await fetch(TOKEN_URL13, {
-        method: "POST",
-        headers: {
-          authorization: `Basic ${Buffer.from(`${clientId}:${clientSecret}`).toString("base64")}`,
-          "content-type": "application/x-www-form-urlencoded",
-          accept: "application/json",
-          "Notion-Version": NOTION_VERSION
-        },
-        body,
-        signal: AbortSignal.timeout(15e3)
-      });
+      const authorization = createOAuthBasicAuthorizationHeader(
+        clientId,
+        clientSecret
+      );
+      const redactionValues = [
+        input.code,
+        input.codeVerifier,
+        ...oauthClientCredentialRedactionValues(
+          clientId,
+          clientSecret,
+          authorization
+        )
+      ];
+      let res;
+      try {
+        res = await fetch(TOKEN_URL13, {
+          method: "POST",
+          headers: {
+            authorization,
+            "content-type": "application/x-www-form-urlencoded",
+            accept: "application/json",
+            "Notion-Version": NOTION_VERSION
+          },
+          body,
+          signal: AbortSignal.timeout(15e3)
+        });
+      } catch (cause) {
+        const detail = redactOAuthSensitiveText(
+          cause?.message ?? "unknown",
+          redactionValues
+        );
+        throw new Error(`Notion OAuth token exchange transport error: ${detail}`);
+      }
       if (!res.ok) {
         const text = await res.text().catch(() => "");
-        throw new Error(`Notion OAuth token exchange failed: ${res.status} \u2014 ${text.slice(0, 200)}`);
+        const statusText = redactOAuthSensitiveText(
+          res.statusText,
+          redactionValues
+        );
+        const detail = redactOAuthSensitiveText(text, redactionValues).slice(
+          0,
+          200
+        );
+        throw new Error(
+          `Notion OAuth token exchange failed: ${res.status} ${statusText} \u2014 ${detail}`
+        );
+      }
+      let json;
+      try {
+        json = await res.json();
+      } catch {
+        throw new Error("Notion OAuth token exchange returned invalid JSON");
+      }
+      if (!json.access_token) {
+        throw new Error("Notion OAuth token exchange returned no access_token");
       }
-      const json = await res.json();
       return {
         credentials: {
           kind: "oauth2",
@@ -56214,6 +56592,7 @@ function notion(opts) {
         tokenUrl: TOKEN_URL13,
         clientId,
         clientSecret,
+        tokenClientAuthMethod: "client_secret_basic",
         refreshToken: creds.refreshToken
       });
       return {
@@ -69160,7 +69539,8 @@ var TWITTER_SPEC = {
         tokenUrl: TOKEN_URL19,
         scopes: SCOPES13,
         clientIdEnv: "TWITTER_OAUTH_CLIENT_ID",
-        clientSecretEnv: "TWITTER_OAUTH_CLIENT_SECRET"
+        clientSecretEnv: "TWITTER_OAUTH_CLIENT_SECRET",
+        tokenClientAuthMethod: "client_secret_basic"
       },
       {
         kind: "api-key",
@@ -69457,21 +69837,61 @@ function twitter(opts) {
   };
 }
 async function twitterTokenRequest(clientId, clientSecret, params) {
-  const res = await fetch(TOKEN_URL19, {
-    method: "POST",
-    headers: {
-      authorization: `Basic ${Buffer.from(`${clientId}:${clientSecret}`).toString("base64")}`,
-      "content-type": "application/x-www-form-urlencoded",
-      accept: "application/json"
-    },
-    body: new URLSearchParams(params),
-    signal: AbortSignal.timeout(15e3)
-  });
+  const authorization = createOAuthBasicAuthorizationHeader(
+    clientId,
+    clientSecret
+  );
+  const requestSecrets = [
+    params.code,
+    params.code_verifier,
+    params.refresh_token
+  ].filter((value) => typeof value === "string" && value.length > 0);
+  const redactionValues = [
+    ...requestSecrets,
+    ...oauthClientCredentialRedactionValues(
+      clientId,
+      clientSecret,
+      authorization
+    )
+  ];
+  let res;
+  try {
+    res = await fetch(TOKEN_URL19, {
+      method: "POST",
+      headers: {
+        authorization,
+        "content-type": "application/x-www-form-urlencoded",
+        accept: "application/json"
+      },
+      body: new URLSearchParams(params),
+      signal: AbortSignal.timeout(15e3)
+    });
+  } catch (cause) {
+    const detail = redactOAuthSensitiveText(
+      cause?.message ?? "unknown",
+      redactionValues
+    );
+    throw new Error(
+      `twitter ${params.grant_type} token transport error: ${detail}`
+    );
+  }
   if (!res.ok) {
     const text = await res.text().catch(() => "");
-    throw new Error(`twitter ${params.grant_type} token request failed: ${res.status} ${res.statusText} \u2014 ${text.slice(0, 200)}`);
+    const statusText = redactOAuthSensitiveText(res.statusText, redactionValues);
+    const detail = redactOAuthSensitiveText(text, redactionValues).slice(0, 200);
+    throw new Error(
+      `twitter ${params.grant_type} token request failed: ${res.status} ${statusText} \u2014 ${detail}`
+    );
+  }
+  let json;
+  try {
+    json = await res.json();
+  } catch {
+    throw new Error(`twitter ${params.grant_type} token request returned invalid JSON`);
+  }
+  if (!json.access_token) {
+    throw new Error(`twitter ${params.grant_type} token request returned no access_token`);
   }
-  const json = await res.json();
   return {
     accessToken: json.access_token,
     refreshToken: json.refresh_token,
@@ -83842,7 +84262,7 @@ var CONNECTOR_ADAPTER_FACTORIES = [
     clientId: "PUSHBULLET_OAUTH_CLIENT_ID",
     clientSecret: "PUSHBULLET_OAUTH_CLIENT_SECRET"
   }),
-  defineFactoryAdapter(() => redditConnector, {
+  defineFactoryAdapter(reddit, {
     clientId: "REDDIT_OAUTH_CLIENT_ID",
     clientSecret: "REDDIT_OAUTH_CLIENT_SECRET"
   }),
@@ -148676,6 +149096,11 @@ export {
   consumePendingFlow,
   exchangeAuthorizationCode,
   refreshAccessToken,
+  createOAuthTokenRequestHeaders,
+  formEncodeOAuthClientCredential,
+  createOAuthBasicAuthorizationHeader,
+  oauthClientCredentialRedactionValues,
+  redactOAuthSensitiveText,
   _resetPendingFlowsForTests,
   declarativeRestConnector,
   oktaConnector,
@@ -148752,6 +149177,7 @@ export {
   paychexConnector,
   pushbulletConnector,
   redditConnector,
+  reddit,
   ripplingConnector,
   sanityConnector,
   sendpulseConnector,
@@ -149332,4 +149758,4 @@ export {
   getresponseConnector,
   adapters_exports
 };
-//# sourceMappingURL=chunk-HNEEIMQC.js.map
+//# sourceMappingURL=chunk-2JRYKWYX.js.map