@tangle-network/agent-integrations 0.53.48 → 0.53.50

package/dist/{chunk-PXOM5AVK.js → chunk-EP6EDAPV.js}

@@ -1,7 +1,7 @@
 import {
   CONNECTOR_ADAPTER_FACTORIES,
   adapters_exports
-} from "./chunk-HNEEIMQC.js";
+} from "./chunk-2JRYKWYX.js";
 
 // src/connectors/bundled-manifests.ts
 var MANIFEST_PROBE_PREFIX = "tangle-adapter-metadata-";
@@ -114,7 +114,8 @@ function bundledOAuth2Auth(manifest) {
       tokenClientIdParam: candidate.tokenClientIdParam ?? "client_id",
       tokenClientSecretParam: candidate.tokenClientSecretParam ?? "client_secret",
       tokenClientAuthMethod: candidate.tokenClientAuthMethod ?? "client_secret_post",
-      extraAuthParams: candidate.extraAuthParams
+      extraAuthParams: candidate.extraAuthParams,
+      tokenRequestHeaders: candidate.tokenRequestHeaders
     };
   }
   return void 0;
@@ -130,4 +131,4 @@ export {
   bundledApiKeyHint,
   bundledOAuth2Auth
 };
-//# sourceMappingURL=chunk-PXOM5AVK.js.map
+//# sourceMappingURL=chunk-EP6EDAPV.js.map

package/dist/{chunk-PXOM5AVK.js.map → chunk-EP6EDAPV.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/connectors/bundled-manifests.ts"],"sourcesContent":["import {\n  CONNECTOR_ADAPTER_FACTORIES,\n  type ConnectorAdapterFactoryDefinition,\n} from './adapters/factories.js'\nimport * as bundledAdapters from './adapters/index.js'\nimport type { ConnectorAdapter, ConnectorManifest } from './types.js'\n\n/**\n * The bundled adapter registry — the single source of truth for \"which\n * connectors does this package actually implement, and how do they really\n * authenticate\".\n *\n * This exists because the answer was previously maintained by hand in two\n * places that drifted apart: `specs/registry.ts` carried an 18-name\n * `EXECUTABLE_KINDS` set while the package shipped 530 adapters, and the\n * platform kept its own private `collectBundledAdapters()` copy. A catalog\n * that describes connectors must derive from the connectors, never restate\n * them — restating is what let QuickBooks and Xero advertise a\n * `https://example.invalid/...` authorization URL behind a live Connect\n * button.\n *\n * Manifests are static data. Factory-style adapters need client credentials\n * to *execute*, but their manifest (auth endpoints, scopes, capability list)\n * is fixed at definition time, so we instantiate them with clearly-marked\n * placeholder options purely to read that static shape. The placeholders are\n * never used to make a request — {@link listBundledAdapterManifests} returns\n * manifests, not adapters.\n */\n\n/** Placeholder marker for factory options resolved only to read a manifest. */\nconst MANIFEST_PROBE_PREFIX = 'tangle-adapter-metadata-'\n\nfunction isConnectorAdapter(value: unknown): value is ConnectorAdapter {\n  if (!value || typeof value !== 'object') return false\n  const manifest = (value as { manifest?: unknown }).manifest\n  if (!manifest || typeof manifest !== 'object') return false\n  return typeof (manifest as { kind?: unknown }).kind === 'string'\n}\n\nfunction manifestFromFactory(\n  definition: ConnectorAdapterFactoryDefinition,\n): ConnectorManifest | undefined {\n  const probeOptions = Object.fromEntries(\n    Object.keys(definition.envMap).map((name) => [name, `${MANIFEST_PROBE_PREFIX}${name}`]),\n  )\n  try {\n    return definition.factory(probeOptions).manifest\n  } catch {\n    // A factory that cannot be constructed from placeholder options cannot\n    // contribute a manifest. Skipping is correct: it means the adapter is not\n    // describable without real credentials, so the catalog must not claim it.\n    return undefined\n  }\n}\n\nlet cachedManifests: ConnectorManifest[] | undefined\nlet cachedByKind: Map<string, ConnectorManifest> | undefined\n\n/**\n * Direct adapter instances that public catalog and action hosts may register.\n *\n * Factory adapters are intentionally absent: their construction requires\n * product-owned OAuth configuration. Inbound-only adapters remain available\n * as named exports for webhook hosts, but never compete with action adapters\n * for a public connector kind.\n */\nexport function listBundledConnectorAdapters(): ConnectorAdapter[] {\n  const byKind = new Map<string, ConnectorAdapter>()\n  const exportByKind = new Map<string, string>()\n  for (const [exportName, value] of Object.entries(bundledAdapters)) {\n    if (!isConnectorAdapter(value) || value.inboundOnly) continue\n    const kind = value.manifest.kind\n    const existingExport = exportByKind.get(kind)\n    if (existingExport) {\n      throw new Error(\n        `Duplicate public connector adapter kind \"${kind}\" exported by \"${existingExport}\" and \"${exportName}\".`,\n      )\n    }\n    exportByKind.set(kind, exportName)\n    byKind.set(kind, value)\n  }\n  return [...byKind.values()]\n}\n\nfunction buildRegistry(): Map<string, ConnectorManifest> {\n  const byKind = new Map<string, ConnectorManifest>()\n  for (const adapter of listBundledConnectorAdapters()) {\n    byKind.set(adapter.manifest.kind, adapter.manifest)\n  }\n  for (const definition of CONNECTOR_ADAPTER_FACTORIES) {\n    if (byKind.has(definition.kind)) continue\n    const manifest = manifestFromFactory(definition)\n    if (manifest) byKind.set(manifest.kind, manifest)\n  }\n  return byKind\n}\n\nfunction registry(): Map<string, ConnectorManifest> {\n  if (!cachedByKind) cachedByKind = buildRegistry()\n  return cachedByKind\n}\n\n/** Every connector manifest this package bundles, sorted by kind. */\nexport function listBundledAdapterManifests(): ConnectorManifest[] {\n  if (!cachedManifests) {\n    cachedManifests = [...registry().values()].sort((a, b) => a.kind.localeCompare(b.kind))\n  }\n  return cachedManifests\n}\n\n/** The bundled manifest for `kind`, or undefined when nothing implements it. */\nexport function getBundledAdapterManifest(kind: string): ConnectorManifest | undefined {\n  return registry().get(kind)\n}\n\n/** Whether this package ships a real, executable adapter for `kind`. */\nexport function hasBundledAdapter(kind: string): boolean {\n  return registry().has(kind)\n}\n\n/** Kinds this package implements. */\nexport function listBundledAdapterKinds(): string[] {\n  return listBundledAdapterManifests().map((manifest) => manifest.kind)\n}\n\n/**\n * How a bundled connector really authenticates.\n *\n * `oauth2_client_credentials` is called out separately because it IS a\n * connectable mode but has no user-facing authorize step — a caller that\n * treats \"oauth2 without an authorizationUrl\" as broken would wrongly condemn\n * these machine-to-machine providers.\n */\nexport type BundledAuthMode =\n  | 'oauth2'\n  | 'oauth2_client_credentials'\n  | 'api_key'\n  | 'hmac'\n  | 'none'\n\n/** The auth mode a connect flow would actually drive for this manifest,\n *  resolving `one_of` through its declared `preferred` mode. */\nexport function bundledAuthMode(manifest: ConnectorManifest): BundledAuthMode | undefined {\n  const auth = manifest.auth\n  const effective =\n    auth.kind === 'one_of'\n      ? (auth.options.find((option) => option.kind === auth.preferred) ?? auth.options[0])\n      : auth\n  switch (effective.kind) {\n    case 'oauth2':\n      return effective.grantType === 'client_credentials' ? 'oauth2_client_credentials' : 'oauth2'\n    case 'api-key':\n      return 'api_key'\n    case 'hmac':\n      return 'hmac'\n    case 'none':\n      return 'none'\n    default:\n      return undefined\n  }\n}\n\n/** The setup hint an api-key connector shows when collecting its credential. */\nexport function bundledApiKeyHint(manifest: ConnectorManifest): string | undefined {\n  const auth = manifest.auth\n  const candidates = auth.kind === 'one_of' ? auth.options : [auth]\n  for (const candidate of candidates) {\n    if (candidate.kind === 'api-key') return candidate.hint\n  }\n  return undefined\n}\n\n/** The authorization-code OAuth2 branch of a manifest's auth spec, if it has\n *  one. `one_of` manifests are resolved through their `preferred` mode, which\n *  is the mode a connect flow would actually drive. Returns undefined for\n *  api-key/hmac/none connectors and for `client_credentials` OAuth (which has\n *  no user-facing authorize step). */\nexport function bundledOAuth2Auth(manifest: ConnectorManifest):\n  | {\n      authorizationUrl: string\n      tokenUrl: string\n      scopes: string[]\n      clientIdEnv: string\n      clientSecretEnv?: string\n      scopeSeparator: ' ' | ','\n      pkce?: 'required' | 'supported' | 'unsupported'\n      authorizationClientIdParam: string\n      tokenClientIdParam: string\n      tokenClientSecretParam: string\n      tokenClientAuthMethod: 'none' | 'client_secret_post' | 'client_secret_basic'\n      extraAuthParams?: Record<string, string>\n    }\n  | undefined {\n  const auth = manifest.auth\n  const candidates =\n    auth.kind === 'one_of'\n      ? auth.options.filter((option) => option.kind === auth.preferred)\n      : [auth]\n  for (const candidate of candidates) {\n    if (candidate.kind !== 'oauth2') continue\n    if (candidate.grantType === 'client_credentials') continue\n    if (!candidate.authorizationUrl) continue\n    return {\n      authorizationUrl: candidate.authorizationUrl,\n      tokenUrl: candidate.tokenUrl,\n      scopes: candidate.scopes,\n      clientIdEnv: candidate.clientIdEnv,\n      clientSecretEnv: candidate.clientSecretEnv,\n      scopeSeparator: candidate.scopeSeparator ?? ' ',\n      pkce: candidate.pkce,\n      authorizationClientIdParam: candidate.authorizationClientIdParam ?? 'client_id',\n      tokenClientIdParam: candidate.tokenClientIdParam ?? 'client_id',\n      tokenClientSecretParam: candidate.tokenClientSecretParam ?? 'client_secret',\n      tokenClientAuthMethod: candidate.tokenClientAuthMethod ?? 'client_secret_post',\n      extraAuthParams: candidate.extraAuthParams,\n    }\n  }\n  return undefined\n}\n"],"mappings":";;;;;;AA8BA,IAAM,wBAAwB;AAE9B,SAAS,mBAAmB,OAA2C;AACrE,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,WAAY,MAAiC;AACnD,MAAI,CAAC,YAAY,OAAO,aAAa,SAAU,QAAO;AACtD,SAAO,OAAQ,SAAgC,SAAS;AAC1D;AAEA,SAAS,oBACP,YAC+B;AAC/B,QAAM,eAAe,OAAO;AAAA,IAC1B,OAAO,KAAK,WAAW,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,qBAAqB,GAAG,IAAI,EAAE,CAAC;AAAA,EACxF;AACA,MAAI;AACF,WAAO,WAAW,QAAQ,YAAY,EAAE;AAAA,EAC1C,QAAQ;AAIN,WAAO;AAAA,EACT;AACF;AAEA,IAAI;AACJ,IAAI;AAUG,SAAS,+BAAmD;AACjE,QAAM,SAAS,oBAAI,IAA8B;AACjD,QAAM,eAAe,oBAAI,IAAoB;AAC7C,aAAW,CAAC,YAAY,KAAK,KAAK,OAAO,QAAQ,gBAAe,GAAG;AACjE,QAAI,CAAC,mBAAmB,KAAK,KAAK,MAAM,YAAa;AACrD,UAAM,OAAO,MAAM,SAAS;AAC5B,UAAM,iBAAiB,aAAa,IAAI,IAAI;AAC5C,QAAI,gBAAgB;AAClB,YAAM,IAAI;AAAA,QACR,4CAA4C,IAAI,kBAAkB,cAAc,UAAU,UAAU;AAAA,MACtG;AAAA,IACF;AACA,iBAAa,IAAI,MAAM,UAAU;AACjC,WAAO,IAAI,MAAM,KAAK;AAAA,EACxB;AACA,SAAO,CAAC,GAAG,OAAO,OAAO,CAAC;AAC5B;AAEA,SAAS,gBAAgD;AACvD,QAAM,SAAS,oBAAI,IAA+B;AAClD,aAAW,WAAW,6BAA6B,GAAG;AACpD,WAAO,IAAI,QAAQ,SAAS,MAAM,QAAQ,QAAQ;AAAA,EACpD;AACA,aAAW,cAAc,6BAA6B;AACpD,QAAI,OAAO,IAAI,WAAW,IAAI,EAAG;AACjC,UAAM,WAAW,oBAAoB,UAAU;AAC/C,QAAI,SAAU,QAAO,IAAI,SAAS,MAAM,QAAQ;AAAA,EAClD;AACA,SAAO;AACT;AAEA,SAAS,WAA2C;AAClD,MAAI,CAAC,aAAc,gBAAe,cAAc;AAChD,SAAO;AACT;AAGO,SAAS,8BAAmD;AACjE,MAAI,CAAC,iBAAiB;AACpB,sBAAkB,CAAC,GAAG,SAAS,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAAA,EACxF;AACA,SAAO;AACT;AAGO,SAAS,0BAA0B,MAA6C;AACrF,SAAO,SAAS,EAAE,IAAI,IAAI;AAC5B;AAGO,SAAS,kBAAkB,MAAuB;AACvD,SAAO,SAAS,EAAE,IAAI,IAAI;AAC5B;AAGO,SAAS,0BAAoC;AAClD,SAAO,4BAA4B,EAAE,IAAI,CAAC,aAAa,SAAS,IAAI;AACtE;AAmBO,SAAS,gBAAgB,UAA0D;AACxF,QAAM,OAAO,SAAS;AACtB,QAAM,YACJ,KAAK,SAAS,WACT,KAAK,QAAQ,KAAK,CAAC,WAAW,OAAO,SAAS,KAAK,SAAS,KAAK,KAAK,QAAQ,CAAC,IAChF;AACN,UAAQ,UAAU,MAAM;AAAA,IACtB,KAAK;AACH,aAAO,UAAU,cAAc,uBAAuB,8BAA8B;AAAA,IACtF,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAGO,SAAS,kBAAkB,UAAiD;AACjF,QAAM,OAAO,SAAS;AACtB,QAAM,aAAa,KAAK,SAAS,WAAW,KAAK,UAAU,CAAC,IAAI;AAChE,aAAW,aAAa,YAAY;AAClC,QAAI,UAAU,SAAS,UAAW,QAAO,UAAU;AAAA,EACrD;AACA,SAAO;AACT;AAOO,SAAS,kBAAkB,UAepB;AACZ,QAAM,OAAO,SAAS;AACtB,QAAM,aACJ,KAAK,SAAS,WACV,KAAK,QAAQ,OAAO,CAAC,WAAW,OAAO,SAAS,KAAK,SAAS,IAC9D,CAAC,IAAI;AACX,aAAW,aAAa,YAAY;AAClC,QAAI,UAAU,SAAS,SAAU;AACjC,QAAI,UAAU,cAAc,qBAAsB;AAClD,QAAI,CAAC,UAAU,iBAAkB;AACjC,WAAO;AAAA,MACL,kBAAkB,UAAU;AAAA,MAC5B,UAAU,UAAU;AAAA,MACpB,QAAQ,UAAU;AAAA,MAClB,aAAa,UAAU;AAAA,MACvB,iBAAiB,UAAU;AAAA,MAC3B,gBAAgB,UAAU,kBAAkB;AAAA,MAC5C,MAAM,UAAU;AAAA,MAChB,4BAA4B,UAAU,8BAA8B;AAAA,MACpE,oBAAoB,UAAU,sBAAsB;AAAA,MACpD,wBAAwB,UAAU,0BAA0B;AAAA,MAC5D,uBAAuB,UAAU,yBAAyB;AAAA,MAC1D,iBAAiB,UAAU;AAAA,IAC7B;AAAA,EACF;AACA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../src/connectors/bundled-manifests.ts"],"sourcesContent":["import {\n  CONNECTOR_ADAPTER_FACTORIES,\n  type ConnectorAdapterFactoryDefinition,\n} from './adapters/factories.js'\nimport * as bundledAdapters from './adapters/index.js'\nimport type { ConnectorAdapter, ConnectorManifest } from './types.js'\n\n/**\n * The bundled adapter registry — the single source of truth for \"which\n * connectors does this package actually implement, and how do they really\n * authenticate\".\n *\n * This exists because the answer was previously maintained by hand in two\n * places that drifted apart: `specs/registry.ts` carried an 18-name\n * `EXECUTABLE_KINDS` set while the package shipped 530 adapters, and the\n * platform kept its own private `collectBundledAdapters()` copy. A catalog\n * that describes connectors must derive from the connectors, never restate\n * them — restating is what let QuickBooks and Xero advertise a\n * `https://example.invalid/...` authorization URL behind a live Connect\n * button.\n *\n * Manifests are static data. Factory-style adapters need client credentials\n * to *execute*, but their manifest (auth endpoints, scopes, capability list)\n * is fixed at definition time, so we instantiate them with clearly-marked\n * placeholder options purely to read that static shape. The placeholders are\n * never used to make a request — {@link listBundledAdapterManifests} returns\n * manifests, not adapters.\n */\n\n/** Placeholder marker for factory options resolved only to read a manifest. */\nconst MANIFEST_PROBE_PREFIX = 'tangle-adapter-metadata-'\n\nfunction isConnectorAdapter(value: unknown): value is ConnectorAdapter {\n  if (!value || typeof value !== 'object') return false\n  const manifest = (value as { manifest?: unknown }).manifest\n  if (!manifest || typeof manifest !== 'object') return false\n  return typeof (manifest as { kind?: unknown }).kind === 'string'\n}\n\nfunction manifestFromFactory(\n  definition: ConnectorAdapterFactoryDefinition,\n): ConnectorManifest | undefined {\n  const probeOptions = Object.fromEntries(\n    Object.keys(definition.envMap).map((name) => [name, `${MANIFEST_PROBE_PREFIX}${name}`]),\n  )\n  try {\n    return definition.factory(probeOptions).manifest\n  } catch {\n    // A factory that cannot be constructed from placeholder options cannot\n    // contribute a manifest. Skipping is correct: it means the adapter is not\n    // describable without real credentials, so the catalog must not claim it.\n    return undefined\n  }\n}\n\nlet cachedManifests: ConnectorManifest[] | undefined\nlet cachedByKind: Map<string, ConnectorManifest> | undefined\n\n/**\n * Direct adapter instances that public catalog and action hosts may register.\n *\n * Factory adapters are intentionally absent: their construction requires\n * product-owned OAuth configuration. Inbound-only adapters remain available\n * as named exports for webhook hosts, but never compete with action adapters\n * for a public connector kind.\n */\nexport function listBundledConnectorAdapters(): ConnectorAdapter[] {\n  const byKind = new Map<string, ConnectorAdapter>()\n  const exportByKind = new Map<string, string>()\n  for (const [exportName, value] of Object.entries(bundledAdapters)) {\n    if (!isConnectorAdapter(value) || value.inboundOnly) continue\n    const kind = value.manifest.kind\n    const existingExport = exportByKind.get(kind)\n    if (existingExport) {\n      throw new Error(\n        `Duplicate public connector adapter kind \"${kind}\" exported by \"${existingExport}\" and \"${exportName}\".`,\n      )\n    }\n    exportByKind.set(kind, exportName)\n    byKind.set(kind, value)\n  }\n  return [...byKind.values()]\n}\n\nfunction buildRegistry(): Map<string, ConnectorManifest> {\n  const byKind = new Map<string, ConnectorManifest>()\n  for (const adapter of listBundledConnectorAdapters()) {\n    byKind.set(adapter.manifest.kind, adapter.manifest)\n  }\n  for (const definition of CONNECTOR_ADAPTER_FACTORIES) {\n    if (byKind.has(definition.kind)) continue\n    const manifest = manifestFromFactory(definition)\n    if (manifest) byKind.set(manifest.kind, manifest)\n  }\n  return byKind\n}\n\nfunction registry(): Map<string, ConnectorManifest> {\n  if (!cachedByKind) cachedByKind = buildRegistry()\n  return cachedByKind\n}\n\n/** Every connector manifest this package bundles, sorted by kind. */\nexport function listBundledAdapterManifests(): ConnectorManifest[] {\n  if (!cachedManifests) {\n    cachedManifests = [...registry().values()].sort((a, b) => a.kind.localeCompare(b.kind))\n  }\n  return cachedManifests\n}\n\n/** The bundled manifest for `kind`, or undefined when nothing implements it. */\nexport function getBundledAdapterManifest(kind: string): ConnectorManifest | undefined {\n  return registry().get(kind)\n}\n\n/** Whether this package ships a real, executable adapter for `kind`. */\nexport function hasBundledAdapter(kind: string): boolean {\n  return registry().has(kind)\n}\n\n/** Kinds this package implements. */\nexport function listBundledAdapterKinds(): string[] {\n  return listBundledAdapterManifests().map((manifest) => manifest.kind)\n}\n\n/**\n * How a bundled connector really authenticates.\n *\n * `oauth2_client_credentials` is called out separately because it IS a\n * connectable mode but has no user-facing authorize step — a caller that\n * treats \"oauth2 without an authorizationUrl\" as broken would wrongly condemn\n * these machine-to-machine providers.\n */\nexport type BundledAuthMode =\n  | 'oauth2'\n  | 'oauth2_client_credentials'\n  | 'api_key'\n  | 'hmac'\n  | 'none'\n\n/** The auth mode a connect flow would actually drive for this manifest,\n *  resolving `one_of` through its declared `preferred` mode. */\nexport function bundledAuthMode(manifest: ConnectorManifest): BundledAuthMode | undefined {\n  const auth = manifest.auth\n  const effective =\n    auth.kind === 'one_of'\n      ? (auth.options.find((option) => option.kind === auth.preferred) ?? auth.options[0])\n      : auth\n  switch (effective.kind) {\n    case 'oauth2':\n      return effective.grantType === 'client_credentials' ? 'oauth2_client_credentials' : 'oauth2'\n    case 'api-key':\n      return 'api_key'\n    case 'hmac':\n      return 'hmac'\n    case 'none':\n      return 'none'\n    default:\n      return undefined\n  }\n}\n\n/** The setup hint an api-key connector shows when collecting its credential. */\nexport function bundledApiKeyHint(manifest: ConnectorManifest): string | undefined {\n  const auth = manifest.auth\n  const candidates = auth.kind === 'one_of' ? auth.options : [auth]\n  for (const candidate of candidates) {\n    if (candidate.kind === 'api-key') return candidate.hint\n  }\n  return undefined\n}\n\n/** The authorization-code OAuth2 branch of a manifest's auth spec, if it has\n *  one. `one_of` manifests are resolved through their `preferred` mode, which\n *  is the mode a connect flow would actually drive. Returns undefined for\n *  api-key/hmac/none connectors and for `client_credentials` OAuth (which has\n *  no user-facing authorize step). */\nexport function bundledOAuth2Auth(manifest: ConnectorManifest):\n  | {\n      authorizationUrl: string\n      tokenUrl: string\n      scopes: string[]\n      clientIdEnv: string\n      clientSecretEnv?: string\n      scopeSeparator: ' ' | ','\n      pkce?: 'required' | 'supported' | 'unsupported'\n      authorizationClientIdParam: string\n      tokenClientIdParam: string\n      tokenClientSecretParam: string\n      tokenClientAuthMethod: 'none' | 'client_secret_post' | 'client_secret_basic'\n      extraAuthParams?: Record<string, string>\n      tokenRequestHeaders?: Record<string, string>\n    }\n  | undefined {\n  const auth = manifest.auth\n  const candidates =\n    auth.kind === 'one_of'\n      ? auth.options.filter((option) => option.kind === auth.preferred)\n      : [auth]\n  for (const candidate of candidates) {\n    if (candidate.kind !== 'oauth2') continue\n    if (candidate.grantType === 'client_credentials') continue\n    if (!candidate.authorizationUrl) continue\n    return {\n      authorizationUrl: candidate.authorizationUrl,\n      tokenUrl: candidate.tokenUrl,\n      scopes: candidate.scopes,\n      clientIdEnv: candidate.clientIdEnv,\n      clientSecretEnv: candidate.clientSecretEnv,\n      scopeSeparator: candidate.scopeSeparator ?? ' ',\n      pkce: candidate.pkce,\n      authorizationClientIdParam: candidate.authorizationClientIdParam ?? 'client_id',\n      tokenClientIdParam: candidate.tokenClientIdParam ?? 'client_id',\n      tokenClientSecretParam: candidate.tokenClientSecretParam ?? 'client_secret',\n      tokenClientAuthMethod: candidate.tokenClientAuthMethod ?? 'client_secret_post',\n      extraAuthParams: candidate.extraAuthParams,\n      tokenRequestHeaders: candidate.tokenRequestHeaders,\n    }\n  }\n  return undefined\n}\n"],"mappings":";;;;;;AA8BA,IAAM,wBAAwB;AAE9B,SAAS,mBAAmB,OAA2C;AACrE,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,WAAY,MAAiC;AACnD,MAAI,CAAC,YAAY,OAAO,aAAa,SAAU,QAAO;AACtD,SAAO,OAAQ,SAAgC,SAAS;AAC1D;AAEA,SAAS,oBACP,YAC+B;AAC/B,QAAM,eAAe,OAAO;AAAA,IAC1B,OAAO,KAAK,WAAW,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,qBAAqB,GAAG,IAAI,EAAE,CAAC;AAAA,EACxF;AACA,MAAI;AACF,WAAO,WAAW,QAAQ,YAAY,EAAE;AAAA,EAC1C,QAAQ;AAIN,WAAO;AAAA,EACT;AACF;AAEA,IAAI;AACJ,IAAI;AAUG,SAAS,+BAAmD;AACjE,QAAM,SAAS,oBAAI,IAA8B;AACjD,QAAM,eAAe,oBAAI,IAAoB;AAC7C,aAAW,CAAC,YAAY,KAAK,KAAK,OAAO,QAAQ,gBAAe,GAAG;AACjE,QAAI,CAAC,mBAAmB,KAAK,KAAK,MAAM,YAAa;AACrD,UAAM,OAAO,MAAM,SAAS;AAC5B,UAAM,iBAAiB,aAAa,IAAI,IAAI;AAC5C,QAAI,gBAAgB;AAClB,YAAM,IAAI;AAAA,QACR,4CAA4C,IAAI,kBAAkB,cAAc,UAAU,UAAU;AAAA,MACtG;AAAA,IACF;AACA,iBAAa,IAAI,MAAM,UAAU;AACjC,WAAO,IAAI,MAAM,KAAK;AAAA,EACxB;AACA,SAAO,CAAC,GAAG,OAAO,OAAO,CAAC;AAC5B;AAEA,SAAS,gBAAgD;AACvD,QAAM,SAAS,oBAAI,IAA+B;AAClD,aAAW,WAAW,6BAA6B,GAAG;AACpD,WAAO,IAAI,QAAQ,SAAS,MAAM,QAAQ,QAAQ;AAAA,EACpD;AACA,aAAW,cAAc,6BAA6B;AACpD,QAAI,OAAO,IAAI,WAAW,IAAI,EAAG;AACjC,UAAM,WAAW,oBAAoB,UAAU;AAC/C,QAAI,SAAU,QAAO,IAAI,SAAS,MAAM,QAAQ;AAAA,EAClD;AACA,SAAO;AACT;AAEA,SAAS,WAA2C;AAClD,MAAI,CAAC,aAAc,gBAAe,cAAc;AAChD,SAAO;AACT;AAGO,SAAS,8BAAmD;AACjE,MAAI,CAAC,iBAAiB;AACpB,sBAAkB,CAAC,GAAG,SAAS,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAAA,EACxF;AACA,SAAO;AACT;AAGO,SAAS,0BAA0B,MAA6C;AACrF,SAAO,SAAS,EAAE,IAAI,IAAI;AAC5B;AAGO,SAAS,kBAAkB,MAAuB;AACvD,SAAO,SAAS,EAAE,IAAI,IAAI;AAC5B;AAGO,SAAS,0BAAoC;AAClD,SAAO,4BAA4B,EAAE,IAAI,CAAC,aAAa,SAAS,IAAI;AACtE;AAmBO,SAAS,gBAAgB,UAA0D;AACxF,QAAM,OAAO,SAAS;AACtB,QAAM,YACJ,KAAK,SAAS,WACT,KAAK,QAAQ,KAAK,CAAC,WAAW,OAAO,SAAS,KAAK,SAAS,KAAK,KAAK,QAAQ,CAAC,IAChF;AACN,UAAQ,UAAU,MAAM;AAAA,IACtB,KAAK;AACH,aAAO,UAAU,cAAc,uBAAuB,8BAA8B;AAAA,IACtF,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAGO,SAAS,kBAAkB,UAAiD;AACjF,QAAM,OAAO,SAAS;AACtB,QAAM,aAAa,KAAK,SAAS,WAAW,KAAK,UAAU,CAAC,IAAI;AAChE,aAAW,aAAa,YAAY;AAClC,QAAI,UAAU,SAAS,UAAW,QAAO,UAAU;AAAA,EACrD;AACA,SAAO;AACT;AAOO,SAAS,kBAAkB,UAgBpB;AACZ,QAAM,OAAO,SAAS;AACtB,QAAM,aACJ,KAAK,SAAS,WACV,KAAK,QAAQ,OAAO,CAAC,WAAW,OAAO,SAAS,KAAK,SAAS,IAC9D,CAAC,IAAI;AACX,aAAW,aAAa,YAAY;AAClC,QAAI,UAAU,SAAS,SAAU;AACjC,QAAI,UAAU,cAAc,qBAAsB;AAClD,QAAI,CAAC,UAAU,iBAAkB;AACjC,WAAO;AAAA,MACL,kBAAkB,UAAU;AAAA,MAC5B,UAAU,UAAU;AAAA,MACpB,QAAQ,UAAU;AAAA,MAClB,aAAa,UAAU;AAAA,MACvB,iBAAiB,UAAU;AAAA,MAC3B,gBAAgB,UAAU,kBAAkB;AAAA,MAC5C,MAAM,UAAU;AAAA,MAChB,4BAA4B,UAAU,8BAA8B;AAAA,MACpE,oBAAoB,UAAU,sBAAsB;AAAA,MACpD,wBAAwB,UAAU,0BAA0B;AAAA,MAC5D,uBAAuB,UAAU,yBAAyB;AAAA,MAC1D,iBAAiB,UAAU;AAAA,MAC3B,qBAAqB,UAAU;AAAA,IACjC;AAAA,EACF;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-EZR72HCQ.js → chunk-KBYYTHXQ.js}

@@ -1,6 +1,6 @@
 import {
   DEFAULT_TANGLE_PLATFORM_URL
-} from "./chunk-RRSNINEV.js";
+} from "./chunk-W72KPXXX.js";
 
 // src/consumer.ts
 var PLATFORM_USER_ID_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
@@ -281,4 +281,4 @@ export {
   IntegrationHubClient,
   createIntegrationHubClient
 };
-//# sourceMappingURL=chunk-EZR72HCQ.js.map
+//# sourceMappingURL=chunk-KBYYTHXQ.js.map

package/dist/{chunk-CBWD2IOL.js → chunk-QE4WFYSK.js}

@@ -7,7 +7,7 @@ import {
   bundledAuthMode,
   bundledOAuth2Auth,
   getBundledAdapterManifest
-} from "./chunk-PXOM5AVK.js";
+} from "./chunk-EP6EDAPV.js";
 
 // src/specs/types.ts
 function specAuthToConnectorAuth(auth) {
@@ -1584,4 +1584,4 @@ export {
   validateCredentialFormat,
   validateCredentialSet
 };
-//# sourceMappingURL=chunk-CBWD2IOL.js.map
+//# sourceMappingURL=chunk-QE4WFYSK.js.map

package/dist/{chunk-GY4PFAWA.js → chunk-T3WH6MMA.js}

@@ -7,13 +7,17 @@ import {
   canonicalIntegrationKind,
   integrationSpecToConnector,
   listIntegrationSpecs
-} from "./chunk-CBWD2IOL.js";
+} from "./chunk-QE4WFYSK.js";
 import {
   listBundledConnectorAdapters
-} from "./chunk-PXOM5AVK.js";
+} from "./chunk-EP6EDAPV.js";
 import {
-  CONNECTOR_ADAPTER_FACTORIES
-} from "./chunk-HNEEIMQC.js";
+  CONNECTOR_ADAPTER_FACTORIES,
+  createOAuthBasicAuthorizationHeader,
+  createOAuthTokenRequestHeaders,
+  oauthClientCredentialRedactionValues,
+  redactOAuthSensitiveText
+} from "./chunk-2JRYKWYX.js";
 
 // src/activepieces-catalog.ts
 import { readFileSync } from "fs";
@@ -368,16 +372,7 @@ function createConnectorAdapterProvider(options) {
       });
       const codeVerifier = pkce === "unsupported" ? void 0 : requirePkceVerifier(request.codeVerifier, request.connectorId);
       if (codeVerifier) body.set("code_verifier", codeVerifier);
-      const headers = {
-        "content-type": "application/x-www-form-urlencoded",
-        accept: "application/json"
-      };
-      const redactionValues = [
-        request.code,
-        client.clientId,
-        ...client.clientSecret ? [client.clientSecret] : [],
-        ...codeVerifier ? [codeVerifier] : []
-      ];
+      const headers = createOAuthTokenRequestHeaders(auth.tokenRequestHeaders);
       if (tokenClientAuthMethod === "none") {
         body.set(
           resolveOAuthParameterName(
@@ -405,10 +400,22 @@ function createConnectorAdapterProvider(options) {
           client.clientSecret
         );
       } else {
-        const authorization = `Basic ${base64Encode(`${client.clientId}:${client.clientSecret}`)}`;
+        const authorization = createOAuthBasicAuthorizationHeader(
+          client.clientId,
+          client.clientSecret,
+          base64Encode
+        );
         headers.authorization = authorization;
-        redactionValues.push(authorization);
       }
+      const redactionValues = [
+        request.code,
+        ...codeVerifier ? [codeVerifier] : [],
+        ...oauthClientCredentialRedactionValues(
+          client.clientId,
+          client.clientSecret,
+          headers.authorization
+        )
+      ];
       const tokenUrl = resolveOAuthUrlTemplate(
         auth.tokenUrl,
         request.metadata,
@@ -422,7 +429,7 @@ function createConnectorAdapterProvider(options) {
           body
         });
       } catch (cause) {
-        const detail = redactSensitiveText(
+        const detail = redactOAuthSensitiveText(
           cause?.message ?? "unknown",
           redactionValues
         );
@@ -433,10 +440,9 @@ function createConnectorAdapterProvider(options) {
       }
       if (!res.ok) {
         const text = await res.text().catch(() => "");
-        const detail = redactSensitiveText(
-          `${res.status} ${res.statusText} \u2014 ${text.slice(0, 200)}`,
-          redactionValues
-        );
+        const statusText = redactOAuthSensitiveText(res.statusText, redactionValues);
+        const redactedText = redactOAuthSensitiveText(text, redactionValues);
+        const detail = `${res.status} ${statusText} \u2014 ${redactedText.slice(0, 200)}`;
         throw new IntegrationError(
           `OAuth token exchange failed for ${request.connectorId}: ${detail}`,
           "provider_failure"
@@ -689,12 +695,6 @@ function base64Encode(value) {
   for (const byte of bytes) binary += String.fromCharCode(byte);
   return btoa2(binary);
 }
-function redactSensitiveText(text, secrets) {
-  return secrets.filter((secret) => secret.length > 0).reduce(
-    (redacted, secret) => redacted.split(secret).join("[REDACTED]"),
-    text
-  );
-}
 function resolveOAuthUrlTemplate(template, metadata, connectorId) {
   const placeholders = [...template.matchAll(/\{([A-Za-z][A-Za-z0-9_]*)\}/g)];
   let resolved = template;
@@ -4743,4 +4743,4 @@ export {
   signCapability,
   verifyCapabilityToken
 };
-//# sourceMappingURL=chunk-GY4PFAWA.js.map
+//# sourceMappingURL=chunk-T3WH6MMA.js.map