@tangle-network/agent-integrations 0.53.49 → 0.53.51

package/dist/{chunk-H5UCSRF4.js → chunk-BYTP5QJQ.js}

@@ -14,7 +14,7 @@ import {
   TangleIdentityUnreachableError,
   createTangleIdentityClient,
   tangleIdentity
-} from "./chunk-W72KPXXX.js";
+} from "./chunk-P4YUWB77.js";
 import {
   __export
 } from "./chunk-PZ5AY32C.js";
@@ -1146,7 +1146,7 @@ function hasHttpsHostnameSuffix(value, suffix) {
   try {
     const url = new URL(value);
     const normalized = suffix.toLowerCase();
-    return url.protocol === "https:" && normalized.startsWith(".") && url.hostname.toLowerCase().endsWith(normalized);
+    return url.protocol === "https:" && !url.username && !url.password && !url.port && !url.search && !url.hash && normalized.startsWith(".") && url.hostname.toLowerCase().endsWith(normalized);
   } catch {
     return false;
   }
@@ -1645,7 +1645,325 @@ function membershipCapability(name, method, description) {
 }
 
 // src/connectors/adapters/client-credentials-rest.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
+
+// src/connectors/oauth.ts
+import { createHash as createHash2, randomBytes } from "crypto";
+var PENDING_TTL_MS = 10 * 60 * 1e3;
+var InMemoryOAuthFlowStore = class {
+  pendingFlows = /* @__PURE__ */ new Map();
+  put(state, flow) {
+    this.pendingFlows.set(state, flow);
+  }
+  consume(state) {
+    const flow = this.pendingFlows.get(state);
+    this.pendingFlows.delete(state);
+    if (!flow || flow.expiresAt <= Date.now()) return void 0;
+    return flow;
+  }
+  sweep(now) {
+    for (const [k, v] of this.pendingFlows) {
+      if (v.expiresAt <= now) this.pendingFlows.delete(k);
+    }
+  }
+  clear() {
+    this.pendingFlows.clear();
+  }
+};
+var defaultFlowStore = new InMemoryOAuthFlowStore();
+function startOAuthFlow(input) {
+  const store = input.store ?? defaultFlowStore;
+  const now = input.now ?? Date.now();
+  store.sweep?.(now);
+  const usePkce = (input.pkce ?? "required") !== "unsupported";
+  const codeVerifier = usePkce ? base64Url(randomBytes(48)) : void 0;
+  const codeChallenge = codeVerifier ? base64Url(createHash2("sha256").update(codeVerifier).digest()) : void 0;
+  const state = base64Url(randomBytes(24));
+  store.put(state, {
+    codeVerifier,
+    state,
+    projectId: input.projectId,
+    kind: input.kind,
+    label: input.label,
+    redirectUri: input.redirectUri,
+    expiresAt: now + PENDING_TTL_MS
+  });
+  const url = new URL(input.authorizationUrl);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set(
+    oauthParameterName(input.authorizationClientIdParam, "client_id"),
+    input.clientId
+  );
+  url.searchParams.set("redirect_uri", input.redirectUri);
+  url.searchParams.set("scope", input.scopes.join(input.scopeSeparator ?? " "));
+  url.searchParams.set("state", state);
+  if (input.extraAuthParams) {
+    for (const [k, v] of Object.entries(input.extraAuthParams)) {
+      url.searchParams.set(k, v);
+    }
+  }
+  if (codeChallenge) {
+    url.searchParams.set("code_challenge", codeChallenge);
+    url.searchParams.set("code_challenge_method", "S256");
+  } else {
+    url.searchParams.delete("code_challenge");
+    url.searchParams.delete("code_challenge_method");
+  }
+  return { authorizationUrl: url.toString(), state };
+}
+async function consumePendingFlow(state, store = defaultFlowStore) {
+  await store.sweep?.(Date.now());
+  const flow = await store.consume(state);
+  if (!flow) {
+    throw new Error("Unknown or expired OAuth state: possible CSRF, replay, or stale flow");
+  }
+  return flow;
+}
+async function exchangeAuthorizationCode(input) {
+  const usePkce = (input.pkce ?? "required") !== "unsupported";
+  if (usePkce && !input.codeVerifier) {
+    throw new Error("OAuth token exchange requires a PKCE code_verifier");
+  }
+  const body = new URLSearchParams({
+    grant_type: "authorization_code",
+    code: input.code,
+    redirect_uri: input.redirectUri
+  });
+  if (usePkce) body.set("code_verifier", input.codeVerifier);
+  const headers = createOAuthTokenRequestHeaders(input.tokenRequestHeaders);
+  applyTokenClientAuthentication(input, body, headers);
+  const redactionValues = [
+    input.code,
+    ...input.codeVerifier ? [input.codeVerifier] : [],
+    ...oauthClientCredentialRedactionValues(
+      input.clientId,
+      input.clientSecret,
+      headers.authorization
+    )
+  ];
+  let res;
+  try {
+    res = await (input.fetchImpl ?? fetch)(input.tokenUrl, {
+      method: "POST",
+      headers,
+      body,
+      signal: input.signal
+    });
+  } catch (cause) {
+    const detail = redactOAuthSensitiveText(
+      cause?.message ?? "unknown",
+      redactionValues
+    );
+    throw new Error(`OAuth token exchange transport error: ${detail}`);
+  }
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    const statusText = redactOAuthSensitiveText(res.statusText, redactionValues);
+    const detail = redactOAuthSensitiveText(text, redactionValues).slice(0, 200);
+    throw new Error(
+      `OAuth token exchange failed: ${res.status} ${statusText} \u2014 ${detail}`
+    );
+  }
+  let json;
+  try {
+    json = await res.json();
+  } catch {
+    throw new Error("OAuth token exchange returned invalid JSON");
+  }
+  return {
+    accessToken: json.access_token,
+    refreshToken: json.refresh_token,
+    expiresIn: json.expires_in,
+    scope: json.scope,
+    tokenType: json.token_type,
+    idToken: json.id_token
+  };
+}
+async function refreshAccessToken(input) {
+  const body = new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token: input.refreshToken
+  });
+  const headers = createOAuthTokenRequestHeaders(input.tokenRequestHeaders);
+  applyTokenClientAuthentication(input, body, headers);
+  const redactionValues = [
+    input.refreshToken,
+    ...oauthClientCredentialRedactionValues(
+      input.clientId,
+      input.clientSecret,
+      headers.authorization
+    )
+  ];
+  let res;
+  try {
+    res = await (input.fetchImpl ?? fetch)(input.tokenUrl, {
+      method: "POST",
+      headers,
+      body,
+      signal: input.signal
+    });
+  } catch (cause) {
+    const detail = redactOAuthSensitiveText(
+      cause?.message ?? "unknown",
+      redactionValues
+    );
+    throw new Error(`OAuth refresh transport error: ${detail}`);
+  }
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    const statusText = redactOAuthSensitiveText(res.statusText, redactionValues);
+    const detail = redactOAuthSensitiveText(text, redactionValues).slice(0, 200);
+    throw new Error(`OAuth refresh failed: ${res.status} ${statusText} \u2014 ${detail}`);
+  }
+  let json;
+  try {
+    json = await res.json();
+  } catch {
+    throw new Error("OAuth refresh returned invalid JSON");
+  }
+  return {
+    accessToken: json.access_token,
+    // Some providers omit refresh_token on refresh — keep the previous one
+    // in that case (caller passes through if undefined).
+    refreshToken: json.refresh_token,
+    expiresIn: json.expires_in,
+    scope: json.scope,
+    tokenType: json.token_type,
+    idToken: json.id_token
+  };
+}
+function createOAuthTokenRequestHeaders(additional) {
+  const headers = new Headers(additional);
+  headers.set("content-type", "application/x-www-form-urlencoded");
+  headers.set("accept", "application/json");
+  headers.delete("authorization");
+  return Object.fromEntries(headers.entries());
+}
+function formEncodeOAuthClientCredential(value) {
+  return new URLSearchParams({ value }).toString().slice("value=".length);
+}
+function createOAuthBasicAuthorizationHeader(clientId, clientSecret, encodeBase64 = defaultOAuthBase64Encode) {
+  const encodedClientId = formEncodeOAuthClientCredential(clientId);
+  const encodedClientSecret = formEncodeOAuthClientCredential(clientSecret);
+  return `Basic ${encodeBase64(`${encodedClientId}:${encodedClientSecret}`)}`;
+}
+function defaultOAuthBase64Encode(value) {
+  const encode = globalThis.btoa;
+  if (typeof encode !== "function") {
+    throw new Error(
+      "OAuth client_secret_basic requires a base64 encoder in this runtime."
+    );
+  }
+  return encode(value);
+}
+function oauthClientCredentialRedactionValues(clientId, clientSecret, authorization) {
+  return [
+    clientId,
+    ...clientSecret ? [clientSecret] : [],
+    ...authorization ? [
+      authorization,
+      ...authorization.startsWith("Basic ") ? [authorization.slice("Basic ".length)] : []
+    ] : []
+  ];
+}
+function redactOAuthSensitiveText(text, secrets) {
+  const matchers = /* @__PURE__ */ new Map();
+  for (const secret of new Set(secrets)) {
+    if (secret.length === 0) continue;
+    addOAuthRedactionMatcher(matchers, escapeRegExp(secret), secret.length);
+    const jsonEscaped = JSON.stringify(secret).slice(1, -1);
+    addOAuthRedactionMatcher(
+      matchers,
+      escapeRegExp(jsonEscaped),
+      jsonEscaped.length
+    );
+    const formEncoded = formEncodeOAuthClientCredential(secret);
+    addOAuthRedactionMatcher(
+      matchers,
+      formEncodedRedactionPattern(formEncoded),
+      Math.max(formEncoded.length, formEncoded.replaceAll("+", "%20").length)
+    );
+  }
+  return [...matchers.values()].sort((left, right) => right.representedLength - left.representedLength).reduce(
+    (redacted, matcher) => redacted.replace(matcher.pattern, "[REDACTED]"),
+    text
+  );
+}
+function addOAuthRedactionMatcher(matchers, source, representedLength) {
+  const existing = matchers.get(source);
+  if (existing && existing.representedLength >= representedLength) return;
+  matchers.set(source, {
+    pattern: new RegExp(source, "g"),
+    representedLength
+  });
+}
+function formEncodedRedactionPattern(formEncoded) {
+  let pattern = "";
+  for (let index = 0; index < formEncoded.length; index += 1) {
+    const character = formEncoded[index];
+    const encodedByte = formEncoded.slice(index + 1, index + 3);
+    if (character === "%" && /^[0-9A-F]{2}$/.test(encodedByte)) {
+      pattern += `%${percentEncodedBytePattern(encodedByte)}`;
+      index += 2;
+      continue;
+    }
+    if (character === "+") {
+      pattern += "(?:\\+|%20)";
+      continue;
+    }
+    pattern += escapeRegExp(character);
+  }
+  return pattern;
+}
+function percentEncodedBytePattern(encodedByte) {
+  return [...encodedByte].map(
+    (character) => /[A-F]/.test(character) ? `[${character}${character.toLowerCase()}]` : character
+  ).join("");
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function applyTokenClientAuthentication(input, body, headers) {
+  const method = input.tokenClientAuthMethod ?? "client_secret_post";
+  if (method === "none") {
+    body.set(oauthParameterName(input.tokenClientIdParam, "client_id"), input.clientId);
+    return;
+  }
+  if (!input.clientSecret) {
+    throw new Error(`OAuth ${method} client authentication requires a client secret`);
+  }
+  if (method === "client_secret_post") {
+    body.set(oauthParameterName(input.tokenClientIdParam, "client_id"), input.clientId);
+    body.set(
+      oauthParameterName(input.tokenClientSecretParam, "client_secret"),
+      input.clientSecret
+    );
+    return;
+  }
+  if (method === "client_secret_basic") {
+    headers.authorization = createOAuthBasicAuthorizationHeader(
+      input.clientId,
+      input.clientSecret
+    );
+    return;
+  }
+  throw new Error("Unsupported OAuth token client authentication method");
+}
+function base64Url(buf) {
+  return buf.toString("base64").replace(/=+$/, "").replace(/\+/g, "-").replace(/\//g, "_");
+}
+function oauthParameterName(value, fallback) {
+  const name = value ?? fallback;
+  if (!/^[A-Za-z][A-Za-z0-9_.-]{0,63}$/.test(name)) {
+    throw new Error("Invalid OAuth parameter name");
+  }
+  return name;
+}
+function _resetPendingFlowsForTests() {
+  defaultFlowStore.clear?.();
+}
+
+// src/connectors/adapters/client-credentials-rest.ts
 function clientCredentialsRestConnector(spec) {
   const regionMetadataKey = spec.regionMetadataKey ?? "region";
   const delegated = declarativeRestConnector({
@@ -1764,7 +2082,7 @@ function readRegionName(bundle, metadata, metadataKey, fallback) {
   return (bundle.region ?? metadataRegion ?? fallback).toLowerCase().trim();
 }
 function credentialFingerprint(bundle, region, scope) {
-  return createHash2("sha256").update(bundle.clientId).update("\0").update(bundle.clientSecret).update("\0").update(region.tokenUrl).update("\0").update(scope ?? "").digest("hex");
+  return createHash3("sha256").update(bundle.clientId).update("\0").update(bundle.clientSecret).update("\0").update(region.tokenUrl).update("\0").update(scope ?? "").digest("hex");
 }
 function renderConnectionMetadata(template, metadata) {
   const rendered = template.replace(/\{connection\.([a-zA-Z0-9_.-]+)\}/g, (_match, key) => {
@@ -1795,7 +2113,10 @@ async function exchangeClientCredentials(displayName, sourceId, bundle, region,
     "content-type": "application/x-www-form-urlencoded"
   };
   if (credentialPlacement === "basic") {
-    headers.authorization = `Basic ${Buffer.from(`${bundle.clientId}:${bundle.clientSecret}`).toString("base64")}`;
+    headers.authorization = createOAuthBasicAuthorizationHeader(
+      bundle.clientId,
+      bundle.clientSecret
+    );
   }
   const response = await fetch(region.tokenUrl, {
     method: "POST",
@@ -12666,16 +12987,31 @@ var giteaConnector = declarativeRestConnector({
   description: "Self-hosted Git service for creating and managing repositories, issues, and pull requests.",
   auth: {
     kind: "oauth2",
-    authorizationUrl: "https://api.gitea.io/login/oauth/authorize",
-    tokenUrl: "https://api.gitea.io/login/oauth/access_token",
-    scopes: ["repo", "admin"],
+    authorizationUrl: "{instanceUrl}/login/oauth/authorize",
+    tokenUrl: "{instanceUrl}/login/oauth/access_token",
+    scopes: [
+      "read:user",
+      "write:user",
+      "read:issue",
+      "write:issue",
+      "read:repository",
+      "write:repository"
+    ],
     clientIdEnv: "GITEA_OAUTH_CLIENT_ID",
-    clientSecretEnv: "GITEA_OAUTH_CLIENT_SECRET"
+    clientSecretEnv: "GITEA_OAUTH_CLIENT_SECRET",
+    pkce: "supported",
+    urlTemplateMetadata: {
+      instanceUrl: {
+        kind: "base-url",
+        requirePublicHttps: true
+      }
+    }
   },
   category: "other",
   defaultConsistencyModel: "authoritative",
-  baseUrl: "https://api.gitea.io/api/v1",
-  test: { method: "GET", path: "/user" },
+  baseUrl: { metadataKey: "instanceUrl" },
+  requirePublicHttpsBaseUrl: true,
+  test: { method: "GET", path: "/api/v1/user" },
   capabilities: [
     {
       name: "repos.list",
@@ -12689,8 +13025,8 @@ var giteaConnector = declarativeRestConnector({
         },
         required: ["owner"]
       },
-      request: { method: "GET", path: "/users/{owner}/repos", query: { limit: "{limit}" } },
-      requiredScopes: ["repo"]
+      request: { method: "GET", path: "/api/v1/users/{owner}/repos", query: { limit: "{limit}" } },
+      requiredScopes: ["read:user"]
     },
     {
       name: "issues.create",
@@ -12710,7 +13046,7 @@ var giteaConnector = declarativeRestConnector({
       },
       request: {
         method: "POST",
-        path: "/repos/{owner}/{repo}/issues",
+        path: "/api/v1/repos/{owner}/{repo}/issues",
         body: {
           title: "{title}",
           body: "{body}",
@@ -12719,7 +13055,7 @@ var giteaConnector = declarativeRestConnector({
         }
       },
       cas: "native-idempotency",
-      requiredScopes: ["repo"]
+      requiredScopes: ["write:issue"]
     },
     {
       name: "issues.update",
@@ -12739,7 +13075,7 @@ var giteaConnector = declarativeRestConnector({
       },
       request: {
         method: "PATCH",
-        path: "/repos/{owner}/{repo}/issues/{index}",
+        path: "/api/v1/repos/{owner}/{repo}/issues/{index}",
         body: {
           title: "{title}",
           body: "{body}",
@@ -12747,7 +13083,7 @@ var giteaConnector = declarativeRestConnector({
         }
       },
       cas: "etag-if-match",
-      requiredScopes: ["repo"]
+      requiredScopes: ["write:issue"]
     },
     {
       name: "comments.create",
@@ -12765,11 +13101,11 @@ var giteaConnector = declarativeRestConnector({
       },
       request: {
         method: "POST",
-        path: "/repos/{owner}/{repo}/issues/{index}/comments",
+        path: "/api/v1/repos/{owner}/{repo}/issues/{index}/comments",
         body: { body: "{body}" }
       },
       cas: "native-idempotency",
-      requiredScopes: ["repo"]
+      requiredScopes: ["write:issue"]
     },
     {
       name: "pull-requests.list",
@@ -12787,10 +13123,10 @@ var giteaConnector = declarativeRestConnector({
       },
       request: {
         method: "GET",
-        path: "/repos/{owner}/{repo}/pulls",
+        path: "/api/v1/repos/{owner}/{repo}/pulls",
         query: { state: "{state}", limit: "{limit}" }
       },
-      requiredScopes: ["repo"]
+      requiredScopes: ["read:repository"]
     },
     {
       name: "pull-requests.create",
@@ -12810,7 +13146,7 @@ var giteaConnector = declarativeRestConnector({
       },
       request: {
         method: "POST",
-        path: "/repos/{owner}/{repo}/pulls",
+        path: "/api/v1/repos/{owner}/{repo}/pulls",
         body: {
           title: "{title}",
           body: "{body}",
@@ -12819,7 +13155,7 @@ var giteaConnector = declarativeRestConnector({
         }
       },
       cas: "native-idempotency",
-      requiredScopes: ["repo"]
+      requiredScopes: ["write:repository"]
     },
     {
       name: "branches.list",
@@ -12835,9 +13171,9 @@ var giteaConnector = declarativeRestConnector({
       },
       request: {
         method: "GET",
-        path: "/repos/{owner}/{repo}/branches"
+        path: "/api/v1/repos/{owner}/{repo}/branches"
       },
-      requiredScopes: ["repo"]
+      requiredScopes: ["read:repository"]
     },
     {
       name: "repos.create",
@@ -12856,12 +13192,12 @@ var giteaConnector = declarativeRestConnector({
       },
       request: {
         method: "POST",
-        path: "/user/repos",
+        path: "/api/v1/user/repos",
         body: "args"
       },
       cas: "native-idempotency",
       externalEffect: true,
-      requiredScopes: ["repo"]
+      requiredScopes: ["write:user"]
     },
     {
       name: "repos.delete",
@@ -12877,11 +13213,11 @@ var giteaConnector = declarativeRestConnector({
       },
       request: {
         method: "DELETE",
-        path: "/repos/{owner}/{repo}"
+        path: "/api/v1/repos/{owner}/{repo}"
       },
       cas: "native-idempotency",
       externalEffect: true,
-      requiredScopes: ["repo", "admin"]
+      requiredScopes: ["write:repository"]
     },
     {
       name: "pull-requests.merge",
@@ -12901,12 +13237,12 @@ var giteaConnector = declarativeRestConnector({
       },
       request: {
         method: "POST",
-        path: "/repos/{owner}/{repo}/pulls/{index}/merge",
+        path: "/api/v1/repos/{owner}/{repo}/pulls/{index}/merge",
         body: "args"
       },
       cas: "native-idempotency",
       externalEffect: true,
-      requiredScopes: ["repo"]
+      requiredScopes: ["write:repository"]
     }
   ]
 });
@@ -14745,32 +15081,25 @@ var niftyConnector = declarativeRestConnector({
 });
 
 // src/connectors/adapters/opsgenie.ts
+var OPSGENIE_API_BASE_URLS = [
+  "https://api.opsgenie.com",
+  "https://api.eu.opsgenie.com"
+];
 var opsgenieConnector = declarativeRestConnector({
   kind: "opsgenie",
   displayName: "Opsgenie",
-  description: "Create, acknowledge, and close Opsgenie alerts and incidents, attach notes, and read schedules, on-call assignments, teams, and users against a connected Opsgenie account.",
+  description: "Use an existing Opsgenie account to manage alerts and incidents, attach notes, and read schedules, on-call assignments, teams, and users.",
   auth: {
-    kind: "oauth2",
-    authorizationUrl: "https://app.opsgenie.com/oauth/authorize",
-    tokenUrl: "https://app.opsgenie.com/oauth/token",
-    scopes: [
-      "alert.read",
-      "alert.write",
-      "incident.read",
-      "incident.write",
-      "schedule.read",
-      "oncall.read",
-      "team.read",
-      "user.read"
-    ],
-    clientIdEnv: "OPSGENIE_OAUTH_CLIENT_ID",
-    clientSecretEnv: "OPSGENIE_OAUTH_CLIENT_SECRET"
+    kind: "api-key",
+    hint: "Opsgenie API key with access to the selected alert, incident, schedule, team, and user operations."
   },
   category: "other",
   defaultConsistencyModel: "authoritative",
   // Default to the US REST host; EU-rooted accounts override
   // metadata.apiBaseUrl to https://api.eu.opsgenie.com.
   baseUrl: { metadataKey: "apiBaseUrl", fallback: "https://api.opsgenie.com" },
+  allowedBaseUrls: OPSGENIE_API_BASE_URLS,
+  credentialPlacement: { kind: "header", header: "authorization", prefix: "GenieKey " },
   defaultHeaders: {
     accept: "application/json",
     "content-type": "application/json"
@@ -14821,8 +15150,7 @@ var opsgenieConnector = declarativeRestConnector({
           sort: "{sort}",
           order: "{order}"
         }
-      },
-      requiredScopes: ["alert.read"]
+      }
     },
     {
       name: "alerts.get",
@@ -14840,8 +15168,7 @@ var opsgenieConnector = declarativeRestConnector({
         method: "GET",
         path: "/v2/alerts/{identifier}",
         query: { identifierType: "{identifierType}" }
-      },
-      requiredScopes: ["alert.read"]
+      }
     },
     {
       name: "alerts.create",
@@ -14902,8 +15229,7 @@ var opsgenieConnector = declarativeRestConnector({
           note: "{note}"
         }
       },
-      cas: "native-idempotency",
-      requiredScopes: ["alert.write"]
+      cas: "native-idempotency"
     },
     {
       name: "alerts.acknowledge",
@@ -14926,8 +15252,7 @@ var opsgenieConnector = declarativeRestConnector({
         query: { identifierType: "{identifierType}" },
         body: { user: "{user}", source: "{source}", note: "{note}" }
       },
-      cas: "native-idempotency",
-      requiredScopes: ["alert.write"]
+      cas: "native-idempotency"
     },
     {
       name: "alerts.close",
@@ -14950,8 +15275,7 @@ var opsgenieConnector = declarativeRestConnector({
         query: { identifierType: "{identifierType}" },
         body: { user: "{user}", source: "{source}", note: "{note}" }
       },
-      cas: "native-idempotency",
-      requiredScopes: ["alert.write"]
+      cas: "native-idempotency"
     },
     {
       name: "alerts.notes.list",
@@ -14979,8 +15303,7 @@ var opsgenieConnector = declarativeRestConnector({
           limit: "{limit}",
           order: "{order}"
         }
-      },
-      requiredScopes: ["alert.read"]
+      }
     },
     {
       name: "alerts.notes.add",
@@ -15003,8 +15326,7 @@ var opsgenieConnector = declarativeRestConnector({
         query: { identifierType: "{identifierType}" },
         body: { note: "{note}", user: "{user}", source: "{source}" }
       },
-      cas: "native-idempotency",
-      requiredScopes: ["alert.write"]
+      cas: "native-idempotency"
     },
     {
       name: "incidents.list",
@@ -15033,8 +15355,7 @@ var opsgenieConnector = declarativeRestConnector({
           sort: "{sort}",
           order: "{order}"
         }
-      },
-      requiredScopes: ["incident.read"]
+      }
     },
     {
       name: "incidents.get",
@@ -15052,8 +15373,7 @@ var opsgenieConnector = declarativeRestConnector({
         method: "GET",
         path: "/v1/incidents/{identifier}",
         query: { identifierType: "{identifierType}" }
-      },
-      requiredScopes: ["incident.read"]
+      }
     },
     {
       name: "incidents.create",
@@ -15099,8 +15419,7 @@ var opsgenieConnector = declarativeRestConnector({
           impactedServices: "{impactedServices}"
         }
       },
-      cas: "native-idempotency",
-      requiredScopes: ["incident.write"]
+      cas: "native-idempotency"
     },
     {
       name: "incidents.close",
@@ -15121,8 +15440,7 @@ var opsgenieConnector = declarativeRestConnector({
         query: { identifierType: "{identifierType}" },
         body: { note: "{note}" }
       },
-      cas: "native-idempotency",
-      requiredScopes: ["incident.write"]
+      cas: "native-idempotency"
     },
     {
       name: "incidents.notes.add",
@@ -15143,8 +15461,7 @@ var opsgenieConnector = declarativeRestConnector({
         query: { identifierType: "{identifierType}" },
         body: { note: "{note}" }
       },
-      cas: "native-idempotency",
-      requiredScopes: ["incident.write"]
+      cas: "native-idempotency"
     },
     {
       name: "schedules.list",
@@ -15164,8 +15481,7 @@ var opsgenieConnector = declarativeRestConnector({
         method: "GET",
         path: "/v2/schedules",
         query: { expand: "{expand}" }
-      },
-      requiredScopes: ["schedule.read"]
+      }
     },
     {
       name: "schedules.get",
@@ -15183,8 +15499,7 @@ var opsgenieConnector = declarativeRestConnector({
         method: "GET",
         path: "/v2/schedules/{identifier}",
         query: { identifierType: "{identifierType}" }
-      },
-      requiredScopes: ["schedule.read"]
+      }
     },
     {
       name: "schedules.timeline",
@@ -15215,8 +15530,7 @@ var opsgenieConnector = declarativeRestConnector({
           date: "{date}",
           expand: "{expand}"
         }
-      },
-      requiredScopes: ["schedule.read"]
+      }
     },
     {
       name: "oncalls.current",
@@ -15240,8 +15554,7 @@ var opsgenieConnector = declarativeRestConnector({
           flat: "{flat}",
           date: "{date}"
         }
-      },
-      requiredScopes: ["oncall.read"]
+      }
     },
     {
       name: "oncalls.next",
@@ -15265,16 +15578,14 @@ var opsgenieConnector = declarativeRestConnector({
           flat: "{flat}",
           date: "{date}"
         }
-      },
-      requiredScopes: ["oncall.read"]
+      }
     },
     {
       name: "teams.list",
       class: "read",
       description: "List all teams in the Opsgenie workspace.",
       parameters: { type: "object", properties: {} },
-      request: { method: "GET", path: "/v2/teams" },
-      requiredScopes: ["team.read"]
+      request: { method: "GET", path: "/v2/teams" }
     },
     {
       name: "teams.get",
@@ -15292,8 +15603,7 @@ var opsgenieConnector = declarativeRestConnector({
         method: "GET",
         path: "/v2/teams/{identifier}",
         query: { identifierType: "{identifierType}" }
-      },
-      requiredScopes: ["team.read"]
+      }
     },
     {
       name: "users.list",
@@ -15319,8 +15629,7 @@ var opsgenieConnector = declarativeRestConnector({
           sort: "{sort}",
           order: "{order}"
         }
-      },
-      requiredScopes: ["user.read"]
+      }
     },
     {
       name: "users.get",
@@ -15338,8 +15647,7 @@ var opsgenieConnector = declarativeRestConnector({
         method: "GET",
         path: "/v2/users/{identifier}",
         query: { expand: "{expand}" }
-      },
-      requiredScopes: ["user.read"]
+      }
     }
   ]
 });
@@ -16148,187 +16456,6 @@ var pushbulletConnector = declarativeRestConnector({
   ]
 });
 
-// src/connectors/oauth.ts
-import { createHash as createHash3, randomBytes } from "crypto";
-var PENDING_TTL_MS = 10 * 60 * 1e3;
-var InMemoryOAuthFlowStore = class {
-  pendingFlows = /* @__PURE__ */ new Map();
-  put(state, flow) {
-    this.pendingFlows.set(state, flow);
-  }
-  consume(state) {
-    const flow = this.pendingFlows.get(state);
-    this.pendingFlows.delete(state);
-    if (!flow || flow.expiresAt <= Date.now()) return void 0;
-    return flow;
-  }
-  sweep(now) {
-    for (const [k, v] of this.pendingFlows) {
-      if (v.expiresAt <= now) this.pendingFlows.delete(k);
-    }
-  }
-  clear() {
-    this.pendingFlows.clear();
-  }
-};
-var defaultFlowStore = new InMemoryOAuthFlowStore();
-function startOAuthFlow(input) {
-  const store = input.store ?? defaultFlowStore;
-  const now = input.now ?? Date.now();
-  store.sweep?.(now);
-  const usePkce = (input.pkce ?? "required") !== "unsupported";
-  const codeVerifier = usePkce ? base64Url(randomBytes(48)) : void 0;
-  const codeChallenge = codeVerifier ? base64Url(createHash3("sha256").update(codeVerifier).digest()) : void 0;
-  const state = base64Url(randomBytes(24));
-  store.put(state, {
-    codeVerifier,
-    state,
-    projectId: input.projectId,
-    kind: input.kind,
-    label: input.label,
-    redirectUri: input.redirectUri,
-    expiresAt: now + PENDING_TTL_MS
-  });
-  const url = new URL(input.authorizationUrl);
-  url.searchParams.set("response_type", "code");
-  url.searchParams.set(
-    oauthParameterName(input.authorizationClientIdParam, "client_id"),
-    input.clientId
-  );
-  url.searchParams.set("redirect_uri", input.redirectUri);
-  url.searchParams.set("scope", input.scopes.join(input.scopeSeparator ?? " "));
-  url.searchParams.set("state", state);
-  if (input.extraAuthParams) {
-    for (const [k, v] of Object.entries(input.extraAuthParams)) {
-      url.searchParams.set(k, v);
-    }
-  }
-  if (codeChallenge) {
-    url.searchParams.set("code_challenge", codeChallenge);
-    url.searchParams.set("code_challenge_method", "S256");
-  } else {
-    url.searchParams.delete("code_challenge");
-    url.searchParams.delete("code_challenge_method");
-  }
-  return { authorizationUrl: url.toString(), state };
-}
-async function consumePendingFlow(state, store = defaultFlowStore) {
-  await store.sweep?.(Date.now());
-  const flow = await store.consume(state);
-  if (!flow) {
-    throw new Error("Unknown or expired OAuth state: possible CSRF, replay, or stale flow");
-  }
-  return flow;
-}
-async function exchangeAuthorizationCode(input) {
-  const usePkce = (input.pkce ?? "required") !== "unsupported";
-  if (usePkce && !input.codeVerifier) {
-    throw new Error("OAuth token exchange requires a PKCE code_verifier");
-  }
-  const body = new URLSearchParams({
-    grant_type: "authorization_code",
-    code: input.code,
-    redirect_uri: input.redirectUri
-  });
-  if (usePkce) body.set("code_verifier", input.codeVerifier);
-  const headers = createOAuthTokenRequestHeaders(input.tokenRequestHeaders);
-  applyTokenClientAuthentication(input, body, headers);
-  const res = await (input.fetchImpl ?? fetch)(input.tokenUrl, {
-    method: "POST",
-    headers,
-    body,
-    signal: input.signal
-  });
-  if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`OAuth token exchange failed: ${res.status} ${res.statusText} \u2014 ${text.slice(0, 200)}`);
-  }
-  const json = await res.json();
-  return {
-    accessToken: json.access_token,
-    refreshToken: json.refresh_token,
-    expiresIn: json.expires_in,
-    scope: json.scope,
-    tokenType: json.token_type,
-    idToken: json.id_token
-  };
-}
-async function refreshAccessToken(input) {
-  const body = new URLSearchParams({
-    grant_type: "refresh_token",
-    refresh_token: input.refreshToken
-  });
-  const headers = createOAuthTokenRequestHeaders(input.tokenRequestHeaders);
-  applyTokenClientAuthentication(input, body, headers);
-  const res = await (input.fetchImpl ?? fetch)(input.tokenUrl, {
-    method: "POST",
-    headers,
-    body,
-    signal: input.signal
-  });
-  if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`OAuth refresh failed: ${res.status} ${res.statusText} \u2014 ${text.slice(0, 200)}`);
-  }
-  const json = await res.json();
-  return {
-    accessToken: json.access_token,
-    // Some providers omit refresh_token on refresh — keep the previous one
-    // in that case (caller passes through if undefined).
-    refreshToken: json.refresh_token,
-    expiresIn: json.expires_in,
-    scope: json.scope,
-    tokenType: json.token_type,
-    idToken: json.id_token
-  };
-}
-function createOAuthTokenRequestHeaders(additional) {
-  const headers = new Headers(additional);
-  headers.set("content-type", "application/x-www-form-urlencoded");
-  headers.set("accept", "application/json");
-  headers.delete("authorization");
-  return Object.fromEntries(headers.entries());
-}
-function applyTokenClientAuthentication(input, body, headers) {
-  const method = input.tokenClientAuthMethod ?? "client_secret_post";
-  if (method === "none") {
-    body.set(oauthParameterName(input.tokenClientIdParam, "client_id"), input.clientId);
-    return;
-  }
-  if (!input.clientSecret) {
-    throw new Error(`OAuth ${method} client authentication requires a client secret`);
-  }
-  if (method === "client_secret_post") {
-    body.set(oauthParameterName(input.tokenClientIdParam, "client_id"), input.clientId);
-    body.set(
-      oauthParameterName(input.tokenClientSecretParam, "client_secret"),
-      input.clientSecret
-    );
-    return;
-  }
-  if (method === "client_secret_basic") {
-    headers.authorization = `Basic ${Buffer.from(
-      `${input.clientId}:${input.clientSecret}`,
-      "utf8"
-    ).toString("base64")}`;
-    return;
-  }
-  throw new Error("Unsupported OAuth token client authentication method");
-}
-function base64Url(buf) {
-  return buf.toString("base64").replace(/=+$/, "").replace(/\+/g, "-").replace(/\//g, "_");
-}
-function oauthParameterName(value, fallback) {
-  const name = value ?? fallback;
-  if (!/^[A-Za-z][A-Za-z0-9_.-]{0,63}$/.test(name)) {
-    throw new Error("Invalid OAuth parameter name");
-  }
-  return name;
-}
-function _resetPendingFlowsForTests() {
-  defaultFlowStore.clear?.();
-}
-
 // src/connectors/adapters/reddit.ts
 var REDDIT_USER_AGENT = "web:tools.tangle.integration-hub:v1.0 (contact: https://tangle.tools)";
 var REDDIT_TOKEN_URL = "https://www.reddit.com/api/v1/access_token";
@@ -17511,421 +17638,148 @@ var sendpulseConnector = declarativeRestConnector({
 var snowflakeConnector = declarativeRestConnector({
   kind: "snowflake",
   displayName: "Snowflake",
-  description: "Data warehouse built for the cloud. Query, insert, update, delete, and upsert rows.",
+  description: "Execute and monitor SQL statements through a connected Snowflake account SQL API.",
   auth: {
     kind: "oauth2",
-    authorizationUrl: "https://app.snowflake.com/oauth/authorize",
-    tokenUrl: "https://app.snowflake.com/oauth/token",
-    scopes: ["session:role:manage"],
+    authorizationUrl: "{accountUrl}/oauth/authorize",
+    tokenUrl: "{accountUrl}/oauth/token-request",
+    scopes: ["refresh_token"],
     clientIdEnv: "SNOWFLAKE_OAUTH_CLIENT_ID",
-    clientSecretEnv: "SNOWFLAKE_OAUTH_CLIENT_SECRET"
+    clientSecretEnv: "SNOWFLAKE_OAUTH_CLIENT_SECRET",
+    tokenClientAuthMethod: "client_secret_post",
+    pkce: "supported",
+    urlTemplateMetadata: {
+      accountUrl: {
+        kind: "base-url",
+        allowedBaseUrlSuffixes: [".snowflakecomputing.com"]
+      }
+    }
   },
   category: "database",
   defaultConsistencyModel: "authoritative",
-  baseUrl: "https://api.snowflakecomputing.com/api/v2",
-  test: { method: "GET", path: "/accounts/whoami" },
+  baseUrl: { metadataKey: "accountUrl" },
+  allowedBaseUrlSuffixes: [".snowflakecomputing.com"],
+  defaultHeaders: {
+    "content-type": "application/json",
+    "x-snowflake-authorization-token-type": "OAUTH"
+  },
+  test: {
+    method: "POST",
+    path: "/api/v2/statements",
+    body: { statement: "SELECT CURRENT_ACCOUNT(), CURRENT_USER(), CURRENT_ROLE()" }
+  },
   capabilities: [
     {
       name: "queries.run",
-      class: "read",
-      description: "Run a SQL query.",
-      parameters: {
-        type: "object",
-        properties: { statement: { type: "string" } },
-        required: ["statement"]
-      },
-      request: { method: "POST", path: "/statements", body: { statement: "{statement}" } },
-      requiredScopes: ["session:role:manage"]
-    },
-    {
-      name: "queries.runMultiple",
-      class: "read",
-      description: "Run multiple SQL queries.",
-      parameters: {
-        type: "object",
-        properties: { statements: { type: "array", items: { type: "string" } } },
-        required: ["statements"]
-      },
-      request: { method: "POST", path: "/statements", body: { statements: "{statements}" } },
-      requiredScopes: ["session:role:manage"]
-    },
-    {
-      name: "rows.insert",
       class: "mutation",
-      description: "Insert a row into a table.",
+      description: "Execute one SQL statement. Every statement requires approval because Snowflake SQL can mutate account data and configuration.",
       parameters: {
         type: "object",
         properties: {
+          statement: { type: "string", description: "One Snowflake SQL statement." },
+          timeout: { type: "integer", minimum: 1, description: "Maximum execution time in seconds." },
           database: { type: "string" },
           schema: { type: "string" },
-          table: { type: "string" },
-          values: { type: "object" }
+          warehouse: { type: "string" },
+          role: { type: "string" },
+          bindings: {
+            type: "object",
+            description: "Snowflake SQL API bind variables keyed by one-based position."
+          },
+          async: { type: "boolean", description: "Return a statement handle without waiting for completion." }
         },
-        required: ["database", "schema", "table", "values"]
+        required: ["statement"]
       },
       request: {
         method: "POST",
-        path: "/databases/{database}/schemas/{schema}/tables/{table}/rows",
-        body: { values: "{values}" }
+        path: "/api/v2/statements",
+        query: { async: "{async}" },
+        body: {
+          statement: "{statement}",
+          timeout: "{timeout}",
+          database: "{database}",
+          schema: "{schema}",
+          warehouse: "{warehouse}",
+          role: "{role}",
+          bindings: "{bindings}"
+        }
       },
-      cas: "native-idempotency",
-      requiredScopes: ["session:role:manage"]
+      cas: "none",
+      externalEffect: true
     },
     {
-      name: "rows.insertMultiple",
+      name: "queries.runMultiple",
       class: "mutation",
-      description: "Insert multiple rows into a table.",
+      description: "Execute a semicolon-delimited SQL string as multiple statements. Snowflake does not support bind variables for this operation.",
       parameters: {
         type: "object",
         properties: {
+          statement: { type: "string", description: "Semicolon-delimited Snowflake SQL statements." },
+          multiStatementCount: {
+            type: "string",
+            pattern: "^[1-9][0-9]*$",
+            description: "Number of statements in the SQL string."
+          },
+          timeout: { type: "integer", minimum: 1 },
           database: { type: "string" },
           schema: { type: "string" },
-          table: { type: "string" },
-          rows: { type: "array", items: { type: "object" } }
+          warehouse: { type: "string" },
+          role: { type: "string" },
+          async: { type: "boolean" }
         },
-        required: ["database", "schema", "table", "rows"]
+        required: ["statement", "multiStatementCount"]
       },
       request: {
         method: "POST",
-        path: "/databases/{database}/schemas/{schema}/tables/{table}/rows/bulk",
-        body: { rows: "{rows}" }
-      },
-      cas: "native-idempotency",
-      requiredScopes: ["session:role:manage"]
-    },
-    {
-      name: "rows.update",
-      class: "mutation",
-      description: "Update a row in a table.",
-      parameters: {
-        type: "object",
-        properties: {
-          database: { type: "string" },
-          schema: { type: "string" },
-          table: { type: "string" },
-          rowId: { type: "string" },
-          values: { type: "object" }
-        },
-        required: ["database", "schema", "table", "rowId", "values"]
-      },
-      request: {
-        method: "PATCH",
-        path: "/databases/{database}/schemas/{schema}/tables/{table}/rows/{rowId}",
-        body: { values: "{values}" }
-      },
-      cas: "optimistic-read-verify",
-      requiredScopes: ["session:role:manage"]
-    },
-    {
-      name: "rows.upsert",
-      class: "mutation",
-      description: "Insert or update a row in a table.",
-      parameters: {
-        type: "object",
-        properties: {
-          database: { type: "string" },
-          schema: { type: "string" },
-          table: { type: "string" },
-          values: { type: "object" },
-          keyColumns: { type: "array", items: { type: "string" } }
-        },
-        required: ["database", "schema", "table", "values", "keyColumns"]
-      },
-      request: {
-        method: "PUT",
-        path: "/databases/{database}/schemas/{schema}/tables/{table}/rows/upsert",
-        body: { values: "{values}", keyColumns: "{keyColumns}" }
-      },
-      cas: "native-idempotency",
-      requiredScopes: ["session:role:manage"]
-    },
-    {
-      name: "rows.delete",
-      class: "mutation",
-      description: "Delete a row from a table.",
-      parameters: {
-        type: "object",
-        properties: {
-          database: { type: "string" },
-          schema: { type: "string" },
-          table: { type: "string" },
-          rowId: { type: "string" }
-        },
-        required: ["database", "schema", "table", "rowId"]
-      },
-      request: {
-        method: "DELETE",
-        path: "/databases/{database}/schemas/{schema}/tables/{table}/rows/{rowId}"
-      },
-      requiredScopes: ["session:role:manage"]
-    },
-    {
-      name: "rows.getById",
-      class: "read",
-      description: "Get a row by ID from a table.",
-      parameters: {
-        type: "object",
-        properties: {
-          database: { type: "string" },
-          schema: { type: "string" },
-          table: { type: "string" },
-          rowId: { type: "string" }
-        },
-        required: ["database", "schema", "table", "rowId"]
-      },
-      request: {
-        method: "GET",
-        path: "/databases/{database}/schemas/{schema}/tables/{table}/rows/{rowId}"
-      },
-      requiredScopes: ["session:role:manage"]
-    },
-    {
-      name: "rows.search",
-      class: "read",
-      description: "Search rows in a table.",
-      parameters: {
-        type: "object",
-        properties: {
-          database: { type: "string" },
-          schema: { type: "string" },
-          table: { type: "string" },
-          filter: { type: "object" },
-          limit: { type: "integer" }
-        },
-        required: ["database", "schema", "table"]
-      },
-      request: {
-        method: "GET",
-        path: "/databases/{database}/schemas/{schema}/tables/{table}/rows",
-        query: { filter: "{filter}", limit: "{limit}" }
-      },
-      requiredScopes: ["session:role:manage"]
-    },
-    {
-      name: "tables.list",
-      class: "read",
-      description: "List tables in a schema.",
-      parameters: {
-        type: "object",
-        properties: {
-          database: { type: "string" },
-          schema: { type: "string" }
-        },
-        required: ["database", "schema"]
-      },
-      request: {
-        method: "GET",
-        path: "/databases/{database}/schemas/{schema}/tables"
+        path: "/api/v2/statements",
+        query: { async: "{async}" },
+        body: {
+          statement: "{statement}",
+          timeout: "{timeout}",
+          database: "{database}",
+          schema: "{schema}",
+          warehouse: "{warehouse}",
+          role: "{role}",
+          parameters: { MULTI_STATEMENT_COUNT: "{multiStatementCount}" }
+        }
       },
-      requiredScopes: ["session:role:manage"]
+      cas: "none",
+      externalEffect: true
     },
     {
-      name: "tables.getSchema",
+      name: "statements.get",
       class: "read",
-      description: "Get the schema of a table.",
+      description: "Check a statement and retrieve one result partition.",
       parameters: {
         type: "object",
         properties: {
-          database: { type: "string" },
-          schema: { type: "string" },
-          table: { type: "string" }
+          statementHandle: { type: "string" },
+          partition: { type: "integer", minimum: 0 }
         },
-        required: ["database", "schema", "table"]
+        required: ["statementHandle"]
       },
       request: {
         method: "GET",
-        path: "/databases/{database}/schemas/{schema}/tables/{table}/schema"
-      },
-      requiredScopes: ["session:role:manage"]
-    },
-    {
-      name: "procedures.execute",
-      class: "mutation",
-      description: "Execute a stored procedure.",
-      parameters: {
-        type: "object",
-        properties: {
-          database: { type: "string" },
-          schema: { type: "string" },
-          procedureName: { type: "string" },
-          arguments: { type: "array", items: { type: "string" } }
-        },
-        required: ["database", "schema", "procedureName"]
-      },
-      request: {
-        method: "POST",
-        path: "/databases/{database}/schemas/{schema}/procedures/{procedureName}/execute",
-        body: { arguments: "{arguments}" }
-      },
-      requiredScopes: ["session:role:manage"]
-    },
-    {
-      name: "stages.loadData",
-      class: "mutation",
-      description: "Load data from a stage into a table.",
-      parameters: {
-        type: "object",
-        properties: {
-          database: { type: "string" },
-          schema: { type: "string" },
-          table: { type: "string" },
-          stage: { type: "string" },
-          files: { type: "array", items: { type: "string" } }
-        },
-        required: ["database", "schema", "table", "stage"]
-      },
-      request: {
-        method: "POST",
-        path: "/databases/{database}/schemas/{schema}/tables/{table}/load",
-        body: { stage: "{stage}", files: "{files}" }
-      },
-      cas: "native-idempotency",
-      requiredScopes: ["session:role:manage"]
-    },
-    {
-      name: "dynamicTables.create",
-      class: "mutation",
-      description: "Create a dynamic table.",
-      parameters: {
-        type: "object",
-        properties: {
-          database: { type: "string" },
-          schema: { type: "string" },
-          name: { type: "string" },
-          query: { type: "string" }
-        },
-        required: ["database", "schema", "name", "query"]
-      },
-      request: {
-        method: "POST",
-        path: "/databases/{database}/schemas/{schema}/dynamic-tables",
-        body: { name: "{name}", query: "{query}" }
-      },
-      cas: "native-idempotency",
-      requiredScopes: ["session:role:manage"]
-    },
-    {
-      name: "tables.create",
-      class: "mutation",
-      description: "Create a table in a schema.",
-      parameters: {
-        type: "object",
-        properties: {
-          database: { type: "string" },
-          schema: { type: "string" },
-          name: { type: "string" },
-          columns: {
-            type: "array",
-            description: 'Column definitions: name + Snowflake type, e.g. {name: "id", type: "NUMBER"}.',
-            items: {
-              type: "object",
-              properties: {
-                name: { type: "string" },
-                type: { type: "string" },
-                nullable: { type: "boolean" },
-                default: {}
-              },
-              required: ["name", "type"]
-            }
-          }
-        },
-        required: ["database", "schema", "name", "columns"]
-      },
-      request: {
-        method: "POST",
-        path: "/databases/{database}/schemas/{schema}/tables",
-        body: { name: "{name}", columns: "{columns}" }
-      },
-      cas: "native-idempotency",
-      externalEffect: true,
-      requiredScopes: ["session:role:manage"]
-    },
-    {
-      name: "tables.drop",
-      class: "mutation",
-      description: "Drop a table from a schema.",
-      parameters: {
-        type: "object",
-        properties: {
-          database: { type: "string" },
-          schema: { type: "string" },
-          table: { type: "string" }
-        },
-        required: ["database", "schema", "table"]
-      },
-      request: {
-        method: "DELETE",
-        path: "/databases/{database}/schemas/{schema}/tables/{table}"
-      },
-      cas: "native-idempotency",
-      externalEffect: true,
-      requiredScopes: ["session:role:manage"]
-    },
-    {
-      name: "stages.create",
-      class: "mutation",
-      description: "Create an internal stage for file loads.",
-      parameters: {
-        type: "object",
-        properties: {
-          database: { type: "string" },
-          schema: { type: "string" },
-          name: { type: "string" },
-          fileFormat: { type: "string", description: 'Optional named file format, e.g. "CSV".' },
-          comment: { type: "string" }
-        },
-        required: ["database", "schema", "name"]
-      },
-      request: {
-        method: "POST",
-        path: "/databases/{database}/schemas/{schema}/stages",
-        body: "args"
-      },
-      cas: "native-idempotency",
-      externalEffect: true,
-      requiredScopes: ["session:role:manage"]
+        path: "/api/v2/statements/{statementHandle}",
+        query: { partition: "{partition}" }
+      }
     },
     {
-      name: "stages.unloadData",
+      name: "statements.cancel",
       class: "mutation",
-      description: "Unload table data to a stage (COPY INTO @stage FROM table).",
+      description: "Cancel a running SQL statement by its Snowflake handle.",
       parameters: {
         type: "object",
-        properties: {
-          database: { type: "string" },
-          schema: { type: "string" },
-          table: { type: "string" },
-          stage: { type: "string" },
-          fileFormat: { type: "string" },
-          overwrite: { type: "boolean" }
-        },
-        required: ["database", "schema", "table", "stage"]
+        properties: { statementHandle: { type: "string" } },
+        required: ["statementHandle"]
       },
       request: {
         method: "POST",
-        path: "/databases/{database}/schemas/{schema}/tables/{table}/unload",
-        body: "args"
-      },
-      cas: "native-idempotency",
-      externalEffect: true,
-      requiredScopes: ["session:role:manage"]
-    },
-    {
-      name: "warehouses.list",
-      class: "read",
-      description: "List warehouses available to the authenticated identity.",
-      parameters: {
-        type: "object",
-        properties: {
-          like: { type: "string", description: "Optional name pattern (SQL LIKE syntax)." }
-        }
-      },
-      request: {
-        method: "GET",
-        path: "/warehouses",
-        query: { like: "{like}" }
+        path: "/api/v2/statements/{statementHandle}/cancel",
+        body: {}
       },
-      requiredScopes: ["session:role:manage"]
+      cas: "none",
+      externalEffect: true
     }
   ]
 });
@@ -17934,19 +17788,29 @@ var snowflakeConnector = declarativeRestConnector({
 var teableConnector = declarativeRestConnector({
   kind: "teable",
   displayName: "Teable",
-  description: "Create, read, update, and delete records in Teable databases, plus upload attachments.",
+  description: "Read and write records, tables, fields, and views in Teable databases.",
   auth: {
     kind: "oauth2",
-    authorizationUrl: "https://app.teable.io/oauth/authorize",
-    tokenUrl: "https://app.teable.io/oauth/token",
-    scopes: ["database:read", "database:write"],
+    authorizationUrl: "https://app.teable.ai/api/oauth/authorize",
+    tokenUrl: "https://app.teable.ai/api/oauth/access_token",
+    scopes: [
+      "base|read",
+      "table|read",
+      "table|create",
+      "field|create",
+      "view|create",
+      "record|read",
+      "record|create",
+      "record|update"
+    ],
     clientIdEnv: "TEABLE_OAUTH_CLIENT_ID",
-    clientSecretEnv: "TEABLE_OAUTH_CLIENT_SECRET"
+    clientSecretEnv: "TEABLE_OAUTH_CLIENT_SECRET",
+    pkce: "supported"
   },
   category: "doc",
   defaultConsistencyModel: "authoritative",
-  baseUrl: "https://app.teable.io/api/v1",
-  test: { method: "GET", path: "/bases" },
+  baseUrl: "https://app.teable.ai/api",
+  test: { method: "GET", path: "/auth/user/me" },
   capabilities: [
     {
       name: "records.create",
@@ -17956,16 +17820,23 @@ var teableConnector = declarativeRestConnector({
         type: "object",
         properties: {
           tableId: { type: "string" },
-          fields: { type: "object" }
+          fields: { type: "object" },
+          fieldKeyType: { type: "string", enum: ["name", "id", "dbFieldName"] },
+          typecast: { type: "boolean" }
         },
         required: ["tableId", "fields"]
       },
       request: {
         method: "POST",
-        path: "/tables/{tableId}/records",
-        body: { fields: "{fields}" }
+        path: "/table/{tableId}/record",
+        body: {
+          records: [{ fields: "{fields}" }],
+          fieldKeyType: "{fieldKeyType}",
+          typecast: "{typecast}"
+        }
       },
-      cas: "native-idempotency"
+      cas: "native-idempotency",
+      requiredScopes: ["record|create"]
     },
     {
       name: "records.find",
@@ -17976,20 +17847,27 @@ var teableConnector = declarativeRestConnector({
         properties: {
           tableId: { type: "string" },
           filter: { type: "string" },
-          limit: { type: "integer" },
-          offset: { type: "integer" }
+          take: { type: "integer", minimum: 1, maximum: 1e3 },
+          skip: { type: "integer", minimum: 0 },
+          viewId: { type: "string" },
+          fieldKeyType: { type: "string", enum: ["name", "id", "dbFieldName"] },
+          cellFormat: { type: "string", enum: ["json", "text"] }
         },
         required: ["tableId"]
       },
       request: {
         method: "GET",
-        path: "/tables/{tableId}/records",
+        path: "/table/{tableId}/record",
         query: {
           filter: "{filter}",
-          limit: "{limit}",
-          offset: "{offset}"
+          take: "{take}",
+          skip: "{skip}",
+          viewId: "{viewId}",
+          fieldKeyType: "{fieldKeyType}",
+          cellFormat: "{cellFormat}"
         }
-      }
+      },
+      requiredScopes: ["record|read"]
     },
     {
       name: "records.get",
@@ -17999,14 +17877,21 @@ var teableConnector = declarativeRestConnector({
         type: "object",
         properties: {
           tableId: { type: "string" },
-          recordId: { type: "string" }
+          recordId: { type: "string" },
+          fieldKeyType: { type: "string", enum: ["name", "id", "dbFieldName"] },
+          cellFormat: { type: "string", enum: ["json", "text"] }
         },
         required: ["tableId", "recordId"]
       },
       request: {
         method: "GET",
-        path: "/tables/{tableId}/records/{recordId}"
-      }
+        path: "/table/{tableId}/record/{recordId}",
+        query: {
+          fieldKeyType: "{fieldKeyType}",
+          cellFormat: "{cellFormat}"
+        }
+      },
+      requiredScopes: ["record|read"]
     },
     {
       name: "records.update",
@@ -18017,60 +17902,23 @@ var teableConnector = declarativeRestConnector({
         properties: {
           tableId: { type: "string" },
           recordId: { type: "string" },
-          fields: { type: "object" }
+          fields: { type: "object" },
+          fieldKeyType: { type: "string", enum: ["name", "id", "dbFieldName"] },
+          typecast: { type: "boolean" }
         },
         required: ["tableId", "recordId", "fields"]
       },
       request: {
         method: "PATCH",
-        path: "/tables/{tableId}/records/{recordId}",
-        body: { fields: "{fields}" }
-      },
-      cas: "optimistic-read-verify"
-    },
-    {
-      name: "records.delete",
-      class: "mutation",
-      description: "Delete a record from a Teable table.",
-      parameters: {
-        type: "object",
-        properties: {
-          tableId: { type: "string" },
-          recordId: { type: "string" }
-        },
-        required: ["tableId", "recordId"]
-      },
-      request: {
-        method: "DELETE",
-        path: "/tables/{tableId}/records/{recordId}"
-      },
-      cas: "native-idempotency"
-    },
-    {
-      name: "attachments.upload",
-      class: "mutation",
-      description: "Upload an attachment to a Teable record field.",
-      parameters: {
-        type: "object",
-        properties: {
-          tableId: { type: "string" },
-          recordId: { type: "string" },
-          fieldId: { type: "string" },
-          fileUrl: { type: "string" },
-          fileName: { type: "string" }
-        },
-        required: ["tableId", "recordId", "fieldId", "fileUrl"]
-      },
-      request: {
-        method: "POST",
-        path: "/tables/{tableId}/records/{recordId}/attachments",
+        path: "/table/{tableId}/record/{recordId}",
         body: {
-          fieldId: "{fieldId}",
-          fileUrl: "{fileUrl}",
-          fileName: "{fileName}"
+          record: { fields: "{fields}" },
+          fieldKeyType: "{fieldKeyType}",
+          typecast: "{typecast}"
         }
       },
-      cas: "native-idempotency"
+      cas: "optimistic-read-verify",
+      requiredScopes: ["record|update"]
     },
     {
       name: "tables.list",
@@ -18086,7 +17934,8 @@ var teableConnector = declarativeRestConnector({
       request: {
         method: "GET",
         path: "/base/{baseId}/table"
-      }
+      },
+      requiredScopes: ["table|read"]
     },
     {
       name: "tables.create",
@@ -18108,7 +17957,8 @@ var teableConnector = declarativeRestConnector({
         }
       },
       cas: "native-idempotency",
-      externalEffect: true
+      externalEffect: true,
+      requiredScopes: ["table|create"]
     },
     {
       name: "fields.create",
@@ -18132,7 +17982,8 @@ var teableConnector = declarativeRestConnector({
         }
       },
       cas: "native-idempotency",
-      externalEffect: true
+      externalEffect: true,
+      requiredScopes: ["field|create"]
     },
     {
       name: "views.create",
@@ -18156,7 +18007,8 @@ var teableConnector = declarativeRestConnector({
         }
       },
       cas: "native-idempotency",
-      externalEffect: true
+      externalEffect: true,
+      requiredScopes: ["view|create"]
     }
   ]
 });
@@ -19491,21 +19343,42 @@ var zoominfoConnector = declarativeRestConnector({
 });
 
 // src/connectors/adapters/zuora.ts
+var ZUORA_API_BASE_URLS = [
+  "https://rest.test.zuora.com",
+  "https://rest.sandbox.na.zuora.com",
+  "https://rest.apisandbox.zuora.com",
+  "https://rest.na.zuora.com",
+  "https://rest.zuora.com",
+  "https://rest.test.eu.zuora.com",
+  "https://rest.sandbox.eu.zuora.com",
+  "https://rest.eu.zuora.com",
+  "https://rest.test.ap.zuora.com",
+  "https://rest.ap.zuora.com"
+];
 var zuoraConnector = declarativeRestConnector({
   kind: "zuora",
   displayName: "Zuora",
   description: "Cloud-based subscription management platform. Query accounts, products, and rate plans; create invoices.",
   auth: {
     kind: "oauth2",
-    authorizationUrl: "https://www.zuora.com/apps/PersonalSettings.do?method=oauth",
-    tokenUrl: "https://rest.zuora.com/oauth/token",
-    scopes: ["api"],
+    grantType: "client_credentials",
+    tokenUrl: "{apiBaseUrl}/oauth/token",
+    scopes: [],
     clientIdEnv: "ZUORA_OAUTH_CLIENT_ID",
-    clientSecretEnv: "ZUORA_OAUTH_CLIENT_SECRET"
+    clientSecretEnv: "ZUORA_OAUTH_CLIENT_SECRET",
+    tokenClientAuthMethod: "client_secret_post",
+    pkce: "unsupported",
+    urlTemplateMetadata: {
+      apiBaseUrl: {
+        kind: "base-url",
+        allowedBaseUrls: ZUORA_API_BASE_URLS
+      }
+    }
   },
   category: "crm",
   defaultConsistencyModel: "authoritative",
-  baseUrl: "https://rest.zuora.com",
+  baseUrl: { metadataKey: "apiBaseUrl" },
+  allowedBaseUrls: ZUORA_API_BASE_URLS,
   test: { method: "GET", path: "/v1/accounts" },
   capabilities: [
     {
@@ -19519,8 +19392,7 @@ var zuoraConnector = declarativeRestConnector({
         },
         required: ["accountId"]
       },
-      request: { method: "GET", path: "/v1/accounts/{accountId}" },
-      requiredScopes: ["api"]
+      request: { method: "GET", path: "/v1/accounts/{accountId}" }
     },
     {
       name: "products.find",
@@ -19533,8 +19405,7 @@ var zuoraConnector = declarativeRestConnector({
         },
         required: ["productId"]
       },
-      request: { method: "GET", path: "/v1/products/{productId}" },
-      requiredScopes: ["api"]
+      request: { method: "GET", path: "/v1/products/{productId}" }
     },
     {
       name: "products.rate_plans.find",
@@ -19548,8 +19419,7 @@ var zuoraConnector = declarativeRestConnector({
         },
         required: ["productId", "ratePlanId"]
       },
-      request: { method: "GET", path: "/v1/products/{productId}/rate-plans/{ratePlanId}" },
-      requiredScopes: ["api"]
+      request: { method: "GET", path: "/v1/products/{productId}/rate-plans/{ratePlanId}" }
     },
     {
       name: "invoices.create",
@@ -19573,8 +19443,7 @@ var zuoraConnector = declarativeRestConnector({
         path: "/v1/invoices",
         body: { accountId: "{accountId}", subscriptionId: "{subscriptionId}", items: "{invoiceItems}" }
       },
-      cas: "native-idempotency",
-      requiredScopes: ["api"]
+      cas: "native-idempotency"
     },
     {
       name: "subscriptions.create",
@@ -19600,8 +19469,7 @@ var zuoraConnector = declarativeRestConnector({
         body: "args"
       },
       cas: "native-idempotency",
-      externalEffect: true,
-      requiredScopes: ["api"]
+      externalEffect: true
     },
     {
       name: "subscriptions.cancel",
@@ -19629,8 +19497,7 @@ var zuoraConnector = declarativeRestConnector({
         body: "args"
       },
       cas: "native-idempotency",
-      externalEffect: true,
-      requiredScopes: ["api"]
+      externalEffect: true
     },
     {
       name: "subscriptions.update",
@@ -19653,8 +19520,7 @@ var zuoraConnector = declarativeRestConnector({
         body: "args"
       },
       cas: "native-idempotency",
-      externalEffect: true,
-      requiredScopes: ["api"]
+      externalEffect: true
     },
     {
       name: "payments.create",
@@ -19682,8 +19548,7 @@ var zuoraConnector = declarativeRestConnector({
         body: "args"
       },
       cas: "native-idempotency",
-      externalEffect: true,
-      requiredScopes: ["api"]
+      externalEffect: true
     }
   ]
 });
@@ -56026,6 +55891,7 @@ var NOTION_SPEC = {
     scopes: [],
     clientIdEnv: "NOTION_OAUTH_CLIENT_ID",
     clientSecretEnv: "NOTION_OAUTH_CLIENT_SECRET",
+    tokenClientAuthMethod: "client_secret_basic",
     extraAuthParams: { owner: "user" }
   },
   category: "doc",
@@ -56348,11 +56214,9 @@ function notion(opts) {
     ...withNotionOverrides(declarativeRestConnector(NOTION_SPEC)),
     /**
      * Notion's token endpoint follows RFC 6749 with one twist — it REQUIRES
-     * HTTP Basic auth (client_id:client_secret) and does NOT accept the client
-     * credentials in the form body, so we POST inline rather than via the
-     * generic `exchangeAuthorizationCode` helper. The workspace_id/bot_id come
-     * back in the response and we stash them in `metadata` so the agent can
-     * address resources by workspace where useful.
+     * HTTP Basic auth and returns workspace metadata with the grant. We use
+     * the shared Basic encoding and redaction primitives, then retain that
+     * metadata for resource selection.
      */
     async exchangeOAuth(input) {
       if (!clientId || !clientSecret) {
@@ -56367,22 +56231,62 @@ function notion(opts) {
         redirect_uri: input.redirectUri,
         code_verifier: input.codeVerifier
       });
-      const res = await fetch(TOKEN_URL13, {
-        method: "POST",
-        headers: {
-          authorization: `Basic ${Buffer.from(`${clientId}:${clientSecret}`).toString("base64")}`,
-          "content-type": "application/x-www-form-urlencoded",
-          accept: "application/json",
-          "Notion-Version": NOTION_VERSION
-        },
-        body,
-        signal: AbortSignal.timeout(15e3)
-      });
+      const authorization = createOAuthBasicAuthorizationHeader(
+        clientId,
+        clientSecret
+      );
+      const redactionValues = [
+        input.code,
+        input.codeVerifier,
+        ...oauthClientCredentialRedactionValues(
+          clientId,
+          clientSecret,
+          authorization
+        )
+      ];
+      let res;
+      try {
+        res = await fetch(TOKEN_URL13, {
+          method: "POST",
+          headers: {
+            authorization,
+            "content-type": "application/x-www-form-urlencoded",
+            accept: "application/json",
+            "Notion-Version": NOTION_VERSION
+          },
+          body,
+          signal: AbortSignal.timeout(15e3)
+        });
+      } catch (cause) {
+        const detail = redactOAuthSensitiveText(
+          cause?.message ?? "unknown",
+          redactionValues
+        );
+        throw new Error(`Notion OAuth token exchange transport error: ${detail}`);
+      }
       if (!res.ok) {
         const text = await res.text().catch(() => "");
-        throw new Error(`Notion OAuth token exchange failed: ${res.status} \u2014 ${text.slice(0, 200)}`);
+        const statusText = redactOAuthSensitiveText(
+          res.statusText,
+          redactionValues
+        );
+        const detail = redactOAuthSensitiveText(text, redactionValues).slice(
+          0,
+          200
+        );
+        throw new Error(
+          `Notion OAuth token exchange failed: ${res.status} ${statusText} \u2014 ${detail}`
+        );
+      }
+      let json;
+      try {
+        json = await res.json();
+      } catch {
+        throw new Error("Notion OAuth token exchange returned invalid JSON");
+      }
+      if (!json.access_token) {
+        throw new Error("Notion OAuth token exchange returned no access_token");
       }
-      const json = await res.json();
       return {
         credentials: {
           kind: "oauth2",
@@ -56413,6 +56317,7 @@ function notion(opts) {
         tokenUrl: TOKEN_URL13,
         clientId,
         clientSecret,
+        tokenClientAuthMethod: "client_secret_basic",
         refreshToken: creds.refreshToken
       });
       return {
@@ -69359,7 +69264,8 @@ var TWITTER_SPEC = {
         tokenUrl: TOKEN_URL19,
         scopes: SCOPES13,
         clientIdEnv: "TWITTER_OAUTH_CLIENT_ID",
-        clientSecretEnv: "TWITTER_OAUTH_CLIENT_SECRET"
+        clientSecretEnv: "TWITTER_OAUTH_CLIENT_SECRET",
+        tokenClientAuthMethod: "client_secret_basic"
       },
       {
         kind: "api-key",
@@ -69656,21 +69562,61 @@ function twitter(opts) {
   };
 }
 async function twitterTokenRequest(clientId, clientSecret, params) {
-  const res = await fetch(TOKEN_URL19, {
-    method: "POST",
-    headers: {
-      authorization: `Basic ${Buffer.from(`${clientId}:${clientSecret}`).toString("base64")}`,
-      "content-type": "application/x-www-form-urlencoded",
-      accept: "application/json"
-    },
-    body: new URLSearchParams(params),
-    signal: AbortSignal.timeout(15e3)
-  });
+  const authorization = createOAuthBasicAuthorizationHeader(
+    clientId,
+    clientSecret
+  );
+  const requestSecrets = [
+    params.code,
+    params.code_verifier,
+    params.refresh_token
+  ].filter((value) => typeof value === "string" && value.length > 0);
+  const redactionValues = [
+    ...requestSecrets,
+    ...oauthClientCredentialRedactionValues(
+      clientId,
+      clientSecret,
+      authorization
+    )
+  ];
+  let res;
+  try {
+    res = await fetch(TOKEN_URL19, {
+      method: "POST",
+      headers: {
+        authorization,
+        "content-type": "application/x-www-form-urlencoded",
+        accept: "application/json"
+      },
+      body: new URLSearchParams(params),
+      signal: AbortSignal.timeout(15e3)
+    });
+  } catch (cause) {
+    const detail = redactOAuthSensitiveText(
+      cause?.message ?? "unknown",
+      redactionValues
+    );
+    throw new Error(
+      `twitter ${params.grant_type} token transport error: ${detail}`
+    );
+  }
   if (!res.ok) {
     const text = await res.text().catch(() => "");
-    throw new Error(`twitter ${params.grant_type} token request failed: ${res.status} ${res.statusText} \u2014 ${text.slice(0, 200)}`);
+    const statusText = redactOAuthSensitiveText(res.statusText, redactionValues);
+    const detail = redactOAuthSensitiveText(text, redactionValues).slice(0, 200);
+    throw new Error(
+      `twitter ${params.grant_type} token request failed: ${res.status} ${statusText} \u2014 ${detail}`
+    );
+  }
+  let json;
+  try {
+    json = await res.json();
+  } catch {
+    throw new Error(`twitter ${params.grant_type} token request returned invalid JSON`);
+  }
+  if (!json.access_token) {
+    throw new Error(`twitter ${params.grant_type} token request returned no access_token`);
   }
-  const json = await res.json();
   return {
     accessToken: json.access_token,
     refreshToken: json.refresh_token,
@@ -77669,11 +77615,19 @@ var marketoConnector = declarativeRestConnector({
   description: "Manage Marketo leads, static lists, and smart campaigns through the REST API v1.",
   auth: {
     kind: "oauth2",
-    authorizationUrl: "https://app.marketo.com/identity/oauth/authorize",
-    tokenUrl: "https://app.marketo.com/identity/oauth/token",
+    grantType: "client_credentials",
+    tokenUrl: "{restEndpoint}/identity/oauth/token",
     scopes: [],
     clientIdEnv: "MARKETO_OAUTH_CLIENT_ID",
-    clientSecretEnv: "MARKETO_OAUTH_CLIENT_SECRET"
+    clientSecretEnv: "MARKETO_OAUTH_CLIENT_SECRET",
+    tokenClientAuthMethod: "client_secret_post",
+    pkce: "unsupported",
+    urlTemplateMetadata: {
+      restEndpoint: {
+        kind: "base-url",
+        allowedBaseUrlSuffixes: [".mktorest.com"]
+      }
+    }
   },
   category: "crm",
   defaultConsistencyModel: "authoritative",
@@ -84025,10 +83979,7 @@ var CONNECTOR_ADAPTER_FACTORIES = [
     clientId: "NIFTY_OAUTH_CLIENT_ID",
     clientSecret: "NIFTY_OAUTH_CLIENT_SECRET"
   }),
-  defineFactoryAdapter(() => opsgenieConnector, {
-    clientId: "OPSGENIE_OAUTH_CLIENT_ID",
-    clientSecret: "OPSGENIE_OAUTH_CLIENT_SECRET"
-  }),
+  defineFactoryAdapter(() => opsgenieConnector, {}),
   defineFactoryAdapter(() => pagerdutyConnector, {
     clientId: "PAGERDUTY_OAUTH_CLIENT_ID",
     clientSecret: "PAGERDUTY_OAUTH_CLIENT_SECRET"
@@ -148876,6 +148827,10 @@ export {
   exchangeAuthorizationCode,
   refreshAccessToken,
   createOAuthTokenRequestHeaders,
+  formEncodeOAuthClientCredential,
+  createOAuthBasicAuthorizationHeader,
+  oauthClientCredentialRedactionValues,
+  redactOAuthSensitiveText,
   _resetPendingFlowsForTests,
   declarativeRestConnector,
   oktaConnector,
@@ -149533,4 +149488,4 @@ export {
   getresponseConnector,
   adapters_exports
 };
-//# sourceMappingURL=chunk-H5UCSRF4.js.map
+//# sourceMappingURL=chunk-BYTP5QJQ.js.map