@tangle-network/agent-integrations 0.53.49 → 0.53.50

package/dist/{chunk-H5UCSRF4.js → chunk-2JRYKWYX.js}

@@ -1645,7 +1645,325 @@ function membershipCapability(name, method, description) {
 }
 
 // src/connectors/adapters/client-credentials-rest.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
+
+// src/connectors/oauth.ts
+import { createHash as createHash2, randomBytes } from "crypto";
+var PENDING_TTL_MS = 10 * 60 * 1e3;
+var InMemoryOAuthFlowStore = class {
+  pendingFlows = /* @__PURE__ */ new Map();
+  put(state, flow) {
+    this.pendingFlows.set(state, flow);
+  }
+  consume(state) {
+    const flow = this.pendingFlows.get(state);
+    this.pendingFlows.delete(state);
+    if (!flow || flow.expiresAt <= Date.now()) return void 0;
+    return flow;
+  }
+  sweep(now) {
+    for (const [k, v] of this.pendingFlows) {
+      if (v.expiresAt <= now) this.pendingFlows.delete(k);
+    }
+  }
+  clear() {
+    this.pendingFlows.clear();
+  }
+};
+var defaultFlowStore = new InMemoryOAuthFlowStore();
+function startOAuthFlow(input) {
+  const store = input.store ?? defaultFlowStore;
+  const now = input.now ?? Date.now();
+  store.sweep?.(now);
+  const usePkce = (input.pkce ?? "required") !== "unsupported";
+  const codeVerifier = usePkce ? base64Url(randomBytes(48)) : void 0;
+  const codeChallenge = codeVerifier ? base64Url(createHash2("sha256").update(codeVerifier).digest()) : void 0;
+  const state = base64Url(randomBytes(24));
+  store.put(state, {
+    codeVerifier,
+    state,
+    projectId: input.projectId,
+    kind: input.kind,
+    label: input.label,
+    redirectUri: input.redirectUri,
+    expiresAt: now + PENDING_TTL_MS
+  });
+  const url = new URL(input.authorizationUrl);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set(
+    oauthParameterName(input.authorizationClientIdParam, "client_id"),
+    input.clientId
+  );
+  url.searchParams.set("redirect_uri", input.redirectUri);
+  url.searchParams.set("scope", input.scopes.join(input.scopeSeparator ?? " "));
+  url.searchParams.set("state", state);
+  if (input.extraAuthParams) {
+    for (const [k, v] of Object.entries(input.extraAuthParams)) {
+      url.searchParams.set(k, v);
+    }
+  }
+  if (codeChallenge) {
+    url.searchParams.set("code_challenge", codeChallenge);
+    url.searchParams.set("code_challenge_method", "S256");
+  } else {
+    url.searchParams.delete("code_challenge");
+    url.searchParams.delete("code_challenge_method");
+  }
+  return { authorizationUrl: url.toString(), state };
+}
+async function consumePendingFlow(state, store = defaultFlowStore) {
+  await store.sweep?.(Date.now());
+  const flow = await store.consume(state);
+  if (!flow) {
+    throw new Error("Unknown or expired OAuth state: possible CSRF, replay, or stale flow");
+  }
+  return flow;
+}
+async function exchangeAuthorizationCode(input) {
+  const usePkce = (input.pkce ?? "required") !== "unsupported";
+  if (usePkce && !input.codeVerifier) {
+    throw new Error("OAuth token exchange requires a PKCE code_verifier");
+  }
+  const body = new URLSearchParams({
+    grant_type: "authorization_code",
+    code: input.code,
+    redirect_uri: input.redirectUri
+  });
+  if (usePkce) body.set("code_verifier", input.codeVerifier);
+  const headers = createOAuthTokenRequestHeaders(input.tokenRequestHeaders);
+  applyTokenClientAuthentication(input, body, headers);
+  const redactionValues = [
+    input.code,
+    ...input.codeVerifier ? [input.codeVerifier] : [],
+    ...oauthClientCredentialRedactionValues(
+      input.clientId,
+      input.clientSecret,
+      headers.authorization
+    )
+  ];
+  let res;
+  try {
+    res = await (input.fetchImpl ?? fetch)(input.tokenUrl, {
+      method: "POST",
+      headers,
+      body,
+      signal: input.signal
+    });
+  } catch (cause) {
+    const detail = redactOAuthSensitiveText(
+      cause?.message ?? "unknown",
+      redactionValues
+    );
+    throw new Error(`OAuth token exchange transport error: ${detail}`);
+  }
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    const statusText = redactOAuthSensitiveText(res.statusText, redactionValues);
+    const detail = redactOAuthSensitiveText(text, redactionValues).slice(0, 200);
+    throw new Error(
+      `OAuth token exchange failed: ${res.status} ${statusText} \u2014 ${detail}`
+    );
+  }
+  let json;
+  try {
+    json = await res.json();
+  } catch {
+    throw new Error("OAuth token exchange returned invalid JSON");
+  }
+  return {
+    accessToken: json.access_token,
+    refreshToken: json.refresh_token,
+    expiresIn: json.expires_in,
+    scope: json.scope,
+    tokenType: json.token_type,
+    idToken: json.id_token
+  };
+}
+async function refreshAccessToken(input) {
+  const body = new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token: input.refreshToken
+  });
+  const headers = createOAuthTokenRequestHeaders(input.tokenRequestHeaders);
+  applyTokenClientAuthentication(input, body, headers);
+  const redactionValues = [
+    input.refreshToken,
+    ...oauthClientCredentialRedactionValues(
+      input.clientId,
+      input.clientSecret,
+      headers.authorization
+    )
+  ];
+  let res;
+  try {
+    res = await (input.fetchImpl ?? fetch)(input.tokenUrl, {
+      method: "POST",
+      headers,
+      body,
+      signal: input.signal
+    });
+  } catch (cause) {
+    const detail = redactOAuthSensitiveText(
+      cause?.message ?? "unknown",
+      redactionValues
+    );
+    throw new Error(`OAuth refresh transport error: ${detail}`);
+  }
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    const statusText = redactOAuthSensitiveText(res.statusText, redactionValues);
+    const detail = redactOAuthSensitiveText(text, redactionValues).slice(0, 200);
+    throw new Error(`OAuth refresh failed: ${res.status} ${statusText} \u2014 ${detail}`);
+  }
+  let json;
+  try {
+    json = await res.json();
+  } catch {
+    throw new Error("OAuth refresh returned invalid JSON");
+  }
+  return {
+    accessToken: json.access_token,
+    // Some providers omit refresh_token on refresh — keep the previous one
+    // in that case (caller passes through if undefined).
+    refreshToken: json.refresh_token,
+    expiresIn: json.expires_in,
+    scope: json.scope,
+    tokenType: json.token_type,
+    idToken: json.id_token
+  };
+}
+function createOAuthTokenRequestHeaders(additional) {
+  const headers = new Headers(additional);
+  headers.set("content-type", "application/x-www-form-urlencoded");
+  headers.set("accept", "application/json");
+  headers.delete("authorization");
+  return Object.fromEntries(headers.entries());
+}
+function formEncodeOAuthClientCredential(value) {
+  return new URLSearchParams({ value }).toString().slice("value=".length);
+}
+function createOAuthBasicAuthorizationHeader(clientId, clientSecret, encodeBase64 = defaultOAuthBase64Encode) {
+  const encodedClientId = formEncodeOAuthClientCredential(clientId);
+  const encodedClientSecret = formEncodeOAuthClientCredential(clientSecret);
+  return `Basic ${encodeBase64(`${encodedClientId}:${encodedClientSecret}`)}`;
+}
+function defaultOAuthBase64Encode(value) {
+  const encode = globalThis.btoa;
+  if (typeof encode !== "function") {
+    throw new Error(
+      "OAuth client_secret_basic requires a base64 encoder in this runtime."
+    );
+  }
+  return encode(value);
+}
+function oauthClientCredentialRedactionValues(clientId, clientSecret, authorization) {
+  return [
+    clientId,
+    ...clientSecret ? [clientSecret] : [],
+    ...authorization ? [
+      authorization,
+      ...authorization.startsWith("Basic ") ? [authorization.slice("Basic ".length)] : []
+    ] : []
+  ];
+}
+function redactOAuthSensitiveText(text, secrets) {
+  const matchers = /* @__PURE__ */ new Map();
+  for (const secret of new Set(secrets)) {
+    if (secret.length === 0) continue;
+    addOAuthRedactionMatcher(matchers, escapeRegExp(secret), secret.length);
+    const jsonEscaped = JSON.stringify(secret).slice(1, -1);
+    addOAuthRedactionMatcher(
+      matchers,
+      escapeRegExp(jsonEscaped),
+      jsonEscaped.length
+    );
+    const formEncoded = formEncodeOAuthClientCredential(secret);
+    addOAuthRedactionMatcher(
+      matchers,
+      formEncodedRedactionPattern(formEncoded),
+      Math.max(formEncoded.length, formEncoded.replaceAll("+", "%20").length)
+    );
+  }
+  return [...matchers.values()].sort((left, right) => right.representedLength - left.representedLength).reduce(
+    (redacted, matcher) => redacted.replace(matcher.pattern, "[REDACTED]"),
+    text
+  );
+}
+function addOAuthRedactionMatcher(matchers, source, representedLength) {
+  const existing = matchers.get(source);
+  if (existing && existing.representedLength >= representedLength) return;
+  matchers.set(source, {
+    pattern: new RegExp(source, "g"),
+    representedLength
+  });
+}
+function formEncodedRedactionPattern(formEncoded) {
+  let pattern = "";
+  for (let index = 0; index < formEncoded.length; index += 1) {
+    const character = formEncoded[index];
+    const encodedByte = formEncoded.slice(index + 1, index + 3);
+    if (character === "%" && /^[0-9A-F]{2}$/.test(encodedByte)) {
+      pattern += `%${percentEncodedBytePattern(encodedByte)}`;
+      index += 2;
+      continue;
+    }
+    if (character === "+") {
+      pattern += "(?:\\+|%20)";
+      continue;
+    }
+    pattern += escapeRegExp(character);
+  }
+  return pattern;
+}
+function percentEncodedBytePattern(encodedByte) {
+  return [...encodedByte].map(
+    (character) => /[A-F]/.test(character) ? `[${character}${character.toLowerCase()}]` : character
+  ).join("");
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function applyTokenClientAuthentication(input, body, headers) {
+  const method = input.tokenClientAuthMethod ?? "client_secret_post";
+  if (method === "none") {
+    body.set(oauthParameterName(input.tokenClientIdParam, "client_id"), input.clientId);
+    return;
+  }
+  if (!input.clientSecret) {
+    throw new Error(`OAuth ${method} client authentication requires a client secret`);
+  }
+  if (method === "client_secret_post") {
+    body.set(oauthParameterName(input.tokenClientIdParam, "client_id"), input.clientId);
+    body.set(
+      oauthParameterName(input.tokenClientSecretParam, "client_secret"),
+      input.clientSecret
+    );
+    return;
+  }
+  if (method === "client_secret_basic") {
+    headers.authorization = createOAuthBasicAuthorizationHeader(
+      input.clientId,
+      input.clientSecret
+    );
+    return;
+  }
+  throw new Error("Unsupported OAuth token client authentication method");
+}
+function base64Url(buf) {
+  return buf.toString("base64").replace(/=+$/, "").replace(/\+/g, "-").replace(/\//g, "_");
+}
+function oauthParameterName(value, fallback) {
+  const name = value ?? fallback;
+  if (!/^[A-Za-z][A-Za-z0-9_.-]{0,63}$/.test(name)) {
+    throw new Error("Invalid OAuth parameter name");
+  }
+  return name;
+}
+function _resetPendingFlowsForTests() {
+  defaultFlowStore.clear?.();
+}
+
+// src/connectors/adapters/client-credentials-rest.ts
 function clientCredentialsRestConnector(spec) {
   const regionMetadataKey = spec.regionMetadataKey ?? "region";
   const delegated = declarativeRestConnector({
@@ -1764,7 +2082,7 @@ function readRegionName(bundle, metadata, metadataKey, fallback) {
   return (bundle.region ?? metadataRegion ?? fallback).toLowerCase().trim();
 }
 function credentialFingerprint(bundle, region, scope) {
-  return createHash2("sha256").update(bundle.clientId).update("\0").update(bundle.clientSecret).update("\0").update(region.tokenUrl).update("\0").update(scope ?? "").digest("hex");
+  return createHash3("sha256").update(bundle.clientId).update("\0").update(bundle.clientSecret).update("\0").update(region.tokenUrl).update("\0").update(scope ?? "").digest("hex");
 }
 function renderConnectionMetadata(template, metadata) {
   const rendered = template.replace(/\{connection\.([a-zA-Z0-9_.-]+)\}/g, (_match, key) => {
@@ -1795,7 +2113,10 @@ async function exchangeClientCredentials(displayName, sourceId, bundle, region,
     "content-type": "application/x-www-form-urlencoded"
   };
   if (credentialPlacement === "basic") {
-    headers.authorization = `Basic ${Buffer.from(`${bundle.clientId}:${bundle.clientSecret}`).toString("base64")}`;
+    headers.authorization = createOAuthBasicAuthorizationHeader(
+      bundle.clientId,
+      bundle.clientSecret
+    );
   }
   const response = await fetch(region.tokenUrl, {
     method: "POST",
@@ -16148,187 +16469,6 @@ var pushbulletConnector = declarativeRestConnector({
   ]
 });
 
-// src/connectors/oauth.ts
-import { createHash as createHash3, randomBytes } from "crypto";
-var PENDING_TTL_MS = 10 * 60 * 1e3;
-var InMemoryOAuthFlowStore = class {
-  pendingFlows = /* @__PURE__ */ new Map();
-  put(state, flow) {
-    this.pendingFlows.set(state, flow);
-  }
-  consume(state) {
-    const flow = this.pendingFlows.get(state);
-    this.pendingFlows.delete(state);
-    if (!flow || flow.expiresAt <= Date.now()) return void 0;
-    return flow;
-  }
-  sweep(now) {
-    for (const [k, v] of this.pendingFlows) {
-      if (v.expiresAt <= now) this.pendingFlows.delete(k);
-    }
-  }
-  clear() {
-    this.pendingFlows.clear();
-  }
-};
-var defaultFlowStore = new InMemoryOAuthFlowStore();
-function startOAuthFlow(input) {
-  const store = input.store ?? defaultFlowStore;
-  const now = input.now ?? Date.now();
-  store.sweep?.(now);
-  const usePkce = (input.pkce ?? "required") !== "unsupported";
-  const codeVerifier = usePkce ? base64Url(randomBytes(48)) : void 0;
-  const codeChallenge = codeVerifier ? base64Url(createHash3("sha256").update(codeVerifier).digest()) : void 0;
-  const state = base64Url(randomBytes(24));
-  store.put(state, {
-    codeVerifier,
-    state,
-    projectId: input.projectId,
-    kind: input.kind,
-    label: input.label,
-    redirectUri: input.redirectUri,
-    expiresAt: now + PENDING_TTL_MS
-  });
-  const url = new URL(input.authorizationUrl);
-  url.searchParams.set("response_type", "code");
-  url.searchParams.set(
-    oauthParameterName(input.authorizationClientIdParam, "client_id"),
-    input.clientId
-  );
-  url.searchParams.set("redirect_uri", input.redirectUri);
-  url.searchParams.set("scope", input.scopes.join(input.scopeSeparator ?? " "));
-  url.searchParams.set("state", state);
-  if (input.extraAuthParams) {
-    for (const [k, v] of Object.entries(input.extraAuthParams)) {
-      url.searchParams.set(k, v);
-    }
-  }
-  if (codeChallenge) {
-    url.searchParams.set("code_challenge", codeChallenge);
-    url.searchParams.set("code_challenge_method", "S256");
-  } else {
-    url.searchParams.delete("code_challenge");
-    url.searchParams.delete("code_challenge_method");
-  }
-  return { authorizationUrl: url.toString(), state };
-}
-async function consumePendingFlow(state, store = defaultFlowStore) {
-  await store.sweep?.(Date.now());
-  const flow = await store.consume(state);
-  if (!flow) {
-    throw new Error("Unknown or expired OAuth state: possible CSRF, replay, or stale flow");
-  }
-  return flow;
-}
-async function exchangeAuthorizationCode(input) {
-  const usePkce = (input.pkce ?? "required") !== "unsupported";
-  if (usePkce && !input.codeVerifier) {
-    throw new Error("OAuth token exchange requires a PKCE code_verifier");
-  }
-  const body = new URLSearchParams({
-    grant_type: "authorization_code",
-    code: input.code,
-    redirect_uri: input.redirectUri
-  });
-  if (usePkce) body.set("code_verifier", input.codeVerifier);
-  const headers = createOAuthTokenRequestHeaders(input.tokenRequestHeaders);
-  applyTokenClientAuthentication(input, body, headers);
-  const res = await (input.fetchImpl ?? fetch)(input.tokenUrl, {
-    method: "POST",
-    headers,
-    body,
-    signal: input.signal
-  });
-  if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`OAuth token exchange failed: ${res.status} ${res.statusText} \u2014 ${text.slice(0, 200)}`);
-  }
-  const json = await res.json();
-  return {
-    accessToken: json.access_token,
-    refreshToken: json.refresh_token,
-    expiresIn: json.expires_in,
-    scope: json.scope,
-    tokenType: json.token_type,
-    idToken: json.id_token
-  };
-}
-async function refreshAccessToken(input) {
-  const body = new URLSearchParams({
-    grant_type: "refresh_token",
-    refresh_token: input.refreshToken
-  });
-  const headers = createOAuthTokenRequestHeaders(input.tokenRequestHeaders);
-  applyTokenClientAuthentication(input, body, headers);
-  const res = await (input.fetchImpl ?? fetch)(input.tokenUrl, {
-    method: "POST",
-    headers,
-    body,
-    signal: input.signal
-  });
-  if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`OAuth refresh failed: ${res.status} ${res.statusText} \u2014 ${text.slice(0, 200)}`);
-  }
-  const json = await res.json();
-  return {
-    accessToken: json.access_token,
-    // Some providers omit refresh_token on refresh — keep the previous one
-    // in that case (caller passes through if undefined).
-    refreshToken: json.refresh_token,
-    expiresIn: json.expires_in,
-    scope: json.scope,
-    tokenType: json.token_type,
-    idToken: json.id_token
-  };
-}
-function createOAuthTokenRequestHeaders(additional) {
-  const headers = new Headers(additional);
-  headers.set("content-type", "application/x-www-form-urlencoded");
-  headers.set("accept", "application/json");
-  headers.delete("authorization");
-  return Object.fromEntries(headers.entries());
-}
-function applyTokenClientAuthentication(input, body, headers) {
-  const method = input.tokenClientAuthMethod ?? "client_secret_post";
-  if (method === "none") {
-    body.set(oauthParameterName(input.tokenClientIdParam, "client_id"), input.clientId);
-    return;
-  }
-  if (!input.clientSecret) {
-    throw new Error(`OAuth ${method} client authentication requires a client secret`);
-  }
-  if (method === "client_secret_post") {
-    body.set(oauthParameterName(input.tokenClientIdParam, "client_id"), input.clientId);
-    body.set(
-      oauthParameterName(input.tokenClientSecretParam, "client_secret"),
-      input.clientSecret
-    );
-    return;
-  }
-  if (method === "client_secret_basic") {
-    headers.authorization = `Basic ${Buffer.from(
-      `${input.clientId}:${input.clientSecret}`,
-      "utf8"
-    ).toString("base64")}`;
-    return;
-  }
-  throw new Error("Unsupported OAuth token client authentication method");
-}
-function base64Url(buf) {
-  return buf.toString("base64").replace(/=+$/, "").replace(/\+/g, "-").replace(/\//g, "_");
-}
-function oauthParameterName(value, fallback) {
-  const name = value ?? fallback;
-  if (!/^[A-Za-z][A-Za-z0-9_.-]{0,63}$/.test(name)) {
-    throw new Error("Invalid OAuth parameter name");
-  }
-  return name;
-}
-function _resetPendingFlowsForTests() {
-  defaultFlowStore.clear?.();
-}
-
 // src/connectors/adapters/reddit.ts
 var REDDIT_USER_AGENT = "web:tools.tangle.integration-hub:v1.0 (contact: https://tangle.tools)";
 var REDDIT_TOKEN_URL = "https://www.reddit.com/api/v1/access_token";
@@ -56026,6 +56166,7 @@ var NOTION_SPEC = {
     scopes: [],
     clientIdEnv: "NOTION_OAUTH_CLIENT_ID",
     clientSecretEnv: "NOTION_OAUTH_CLIENT_SECRET",
+    tokenClientAuthMethod: "client_secret_basic",
     extraAuthParams: { owner: "user" }
   },
   category: "doc",
@@ -56348,11 +56489,9 @@ function notion(opts) {
     ...withNotionOverrides(declarativeRestConnector(NOTION_SPEC)),
     /**
      * Notion's token endpoint follows RFC 6749 with one twist — it REQUIRES
-     * HTTP Basic auth (client_id:client_secret) and does NOT accept the client
-     * credentials in the form body, so we POST inline rather than via the
-     * generic `exchangeAuthorizationCode` helper. The workspace_id/bot_id come
-     * back in the response and we stash them in `metadata` so the agent can
-     * address resources by workspace where useful.
+     * HTTP Basic auth and returns workspace metadata with the grant. We use
+     * the shared Basic encoding and redaction primitives, then retain that
+     * metadata for resource selection.
      */
     async exchangeOAuth(input) {
       if (!clientId || !clientSecret) {
@@ -56367,22 +56506,62 @@ function notion(opts) {
         redirect_uri: input.redirectUri,
         code_verifier: input.codeVerifier
       });
-      const res = await fetch(TOKEN_URL13, {
-        method: "POST",
-        headers: {
-          authorization: `Basic ${Buffer.from(`${clientId}:${clientSecret}`).toString("base64")}`,
-          "content-type": "application/x-www-form-urlencoded",
-          accept: "application/json",
-          "Notion-Version": NOTION_VERSION
-        },
-        body,
-        signal: AbortSignal.timeout(15e3)
-      });
+      const authorization = createOAuthBasicAuthorizationHeader(
+        clientId,
+        clientSecret
+      );
+      const redactionValues = [
+        input.code,
+        input.codeVerifier,
+        ...oauthClientCredentialRedactionValues(
+          clientId,
+          clientSecret,
+          authorization
+        )
+      ];
+      let res;
+      try {
+        res = await fetch(TOKEN_URL13, {
+          method: "POST",
+          headers: {
+            authorization,
+            "content-type": "application/x-www-form-urlencoded",
+            accept: "application/json",
+            "Notion-Version": NOTION_VERSION
+          },
+          body,
+          signal: AbortSignal.timeout(15e3)
+        });
+      } catch (cause) {
+        const detail = redactOAuthSensitiveText(
+          cause?.message ?? "unknown",
+          redactionValues
+        );
+        throw new Error(`Notion OAuth token exchange transport error: ${detail}`);
+      }
       if (!res.ok) {
         const text = await res.text().catch(() => "");
-        throw new Error(`Notion OAuth token exchange failed: ${res.status} \u2014 ${text.slice(0, 200)}`);
+        const statusText = redactOAuthSensitiveText(
+          res.statusText,
+          redactionValues
+        );
+        const detail = redactOAuthSensitiveText(text, redactionValues).slice(
+          0,
+          200
+        );
+        throw new Error(
+          `Notion OAuth token exchange failed: ${res.status} ${statusText} \u2014 ${detail}`
+        );
+      }
+      let json;
+      try {
+        json = await res.json();
+      } catch {
+        throw new Error("Notion OAuth token exchange returned invalid JSON");
+      }
+      if (!json.access_token) {
+        throw new Error("Notion OAuth token exchange returned no access_token");
       }
-      const json = await res.json();
       return {
         credentials: {
           kind: "oauth2",
@@ -56413,6 +56592,7 @@ function notion(opts) {
         tokenUrl: TOKEN_URL13,
         clientId,
         clientSecret,
+        tokenClientAuthMethod: "client_secret_basic",
         refreshToken: creds.refreshToken
       });
       return {
@@ -69359,7 +69539,8 @@ var TWITTER_SPEC = {
         tokenUrl: TOKEN_URL19,
         scopes: SCOPES13,
         clientIdEnv: "TWITTER_OAUTH_CLIENT_ID",
-        clientSecretEnv: "TWITTER_OAUTH_CLIENT_SECRET"
+        clientSecretEnv: "TWITTER_OAUTH_CLIENT_SECRET",
+        tokenClientAuthMethod: "client_secret_basic"
       },
       {
         kind: "api-key",
@@ -69656,21 +69837,61 @@ function twitter(opts) {
   };
 }
 async function twitterTokenRequest(clientId, clientSecret, params) {
-  const res = await fetch(TOKEN_URL19, {
-    method: "POST",
-    headers: {
-      authorization: `Basic ${Buffer.from(`${clientId}:${clientSecret}`).toString("base64")}`,
-      "content-type": "application/x-www-form-urlencoded",
-      accept: "application/json"
-    },
-    body: new URLSearchParams(params),
-    signal: AbortSignal.timeout(15e3)
-  });
+  const authorization = createOAuthBasicAuthorizationHeader(
+    clientId,
+    clientSecret
+  );
+  const requestSecrets = [
+    params.code,
+    params.code_verifier,
+    params.refresh_token
+  ].filter((value) => typeof value === "string" && value.length > 0);
+  const redactionValues = [
+    ...requestSecrets,
+    ...oauthClientCredentialRedactionValues(
+      clientId,
+      clientSecret,
+      authorization
+    )
+  ];
+  let res;
+  try {
+    res = await fetch(TOKEN_URL19, {
+      method: "POST",
+      headers: {
+        authorization,
+        "content-type": "application/x-www-form-urlencoded",
+        accept: "application/json"
+      },
+      body: new URLSearchParams(params),
+      signal: AbortSignal.timeout(15e3)
+    });
+  } catch (cause) {
+    const detail = redactOAuthSensitiveText(
+      cause?.message ?? "unknown",
+      redactionValues
+    );
+    throw new Error(
+      `twitter ${params.grant_type} token transport error: ${detail}`
+    );
+  }
   if (!res.ok) {
     const text = await res.text().catch(() => "");
-    throw new Error(`twitter ${params.grant_type} token request failed: ${res.status} ${res.statusText} \u2014 ${text.slice(0, 200)}`);
+    const statusText = redactOAuthSensitiveText(res.statusText, redactionValues);
+    const detail = redactOAuthSensitiveText(text, redactionValues).slice(0, 200);
+    throw new Error(
+      `twitter ${params.grant_type} token request failed: ${res.status} ${statusText} \u2014 ${detail}`
+    );
+  }
+  let json;
+  try {
+    json = await res.json();
+  } catch {
+    throw new Error(`twitter ${params.grant_type} token request returned invalid JSON`);
+  }
+  if (!json.access_token) {
+    throw new Error(`twitter ${params.grant_type} token request returned no access_token`);
   }
-  const json = await res.json();
   return {
     accessToken: json.access_token,
     refreshToken: json.refresh_token,
@@ -148876,6 +149097,10 @@ export {
   exchangeAuthorizationCode,
   refreshAccessToken,
   createOAuthTokenRequestHeaders,
+  formEncodeOAuthClientCredential,
+  createOAuthBasicAuthorizationHeader,
+  oauthClientCredentialRedactionValues,
+  redactOAuthSensitiveText,
   _resetPendingFlowsForTests,
   declarativeRestConnector,
   oktaConnector,
@@ -149533,4 +149758,4 @@ export {
   getresponseConnector,
   adapters_exports
 };
-//# sourceMappingURL=chunk-H5UCSRF4.js.map
+//# sourceMappingURL=chunk-2JRYKWYX.js.map