@wfgraph/plugins 3.1.0 → 4.0.0

package/dist/index.js

@@ -1,14 +1,18 @@
-import { n as getClerkApiErrorMessage, r as toClerkApiUser, t as createClerkBackendClient } from "./client-BEcFnbOB.js";
-import { t as describeLinearFailure } from "./errors-C4i6-DQE.js";
-import { i as sendResendEmail, t as describeResendFailure } from "./client-C2NIQxhb.js";
-import { n as describeSlackFailure, t as callSlack } from "./client-DDDCNLId.js";
-import { n as describeTwilioFailure, t as createTwilioMessage } from "./client-LRwmIiPU.js";
-import { StepFailure, defineIntegration, readAs } from "@wfgraph/core/plugin";
-import { omitBy } from "es-toolkit/object";
-import { isNil } from "es-toolkit/predicate";
+import { t as omitUndefined } from "./omit-undefined-CnDMZgmp.js";
+import { n as getClerkApiErrorMessage, r as toClerkApiUser, t as createClerkBackendClient } from "./client-B0dhD5OA.js";
+import { t as describeLinearFailure } from "./errors-DQPf9k4I.js";
+import { a as resolvePostHogHost, n as describePostHogFailure, t as captureEvent } from "./client-B0M2Cle4.js";
+import { c as sendResendEmail, n as describeResendFailure, r as getResendEmail } from "./client-D3ALurAR.js";
+import { n as describeSlackFailure, t as callSlack } from "./client-BQmwEhSH.js";
+import { n as describeTwilioFailure, t as createTwilioMessage } from "./client-C32OdgmT.js";
+import { SignatureRejected, StepFailure, callExternal, callExternalAsync, defineEvent, defineIntegration, isoTimestampString, parsePayload, readAs, readJsonValue } from "@wfgraph/core/plugin";
 import { Effect, Result, Schema, SchemaTransformation } from "effect";
 import { LinearClient } from "@linear/sdk";
-//#region src/clerk/metadata.ts
+import { isEmptyObject } from "es-toolkit/predicate";
+import { compact } from "es-toolkit/array";
+import { Webhook } from "svix";
+import { Base64 } from "effect/encoding";
+// src/clerk/metadata.ts
 /**
 * The JSON a workflow author types into a metadata field, as Clerk takes it.
 *
@@ -24,7 +28,7 @@ const readClerkMetadata = readAs(Schema.Record(Schema.String, Schema.Unknown));
 * wrong answer.
 */
 function parseClerkMetadata(value, fieldName) {
-	if (!value) return Effect.succeed(void 0);
+	if (!value) return Effect.undefined;
 	let parsed;
 	try {
 		parsed = JSON.parse(value);
@@ -34,12 +38,11 @@ function parseClerkMetadata(value, fieldName) {
 	const metadata = readClerkMetadata(parsed);
 	return metadata ? Effect.succeed(metadata) : Effect.fail(new StepFailure({ message: `Invalid JSON format for ${fieldName}` }));
 }
-//#endregion
-//#region src/clerk/types.ts
+// src/clerk/types.ts
 /**
 * Clerk's user resource as the three user-returning steps answer with it: the
 * primary address picked out of the address list, and the metadata objects left
-* behind, since a downstream node has no shape to address them by.
+* behind, because a downstream node has no shape to address them by.
 */
 function toClerkUserData(apiUser) {
 	const primaryEmail = apiUser.email_addresses.find((e) => e.id === apiUser.primary_email_address_id);
@@ -52,8 +55,7 @@ function toClerkUserData(apiUser) {
 		updatedAt: apiUser.updated_at
 	};
 }
-//#endregion
-//#region src/clerk/index.ts
+// src/clerk/index.ts
 /**
 * The Clerk integration: its credentials, its four actions, and what each takes
 * and gives back.
@@ -61,7 +63,7 @@ function toClerkUserData(apiUser) {
 * One file, because only the server imports it. The editor gets this plugin's
 * metadata as JSON over `/api/extensions`, so nothing here reaches a browser
 * bundle and `@clerk/backend`, which `client.ts` pulls in, costs the browser
-* nothing. The icon is the exception, since a React component cannot be
+* nothing. The icon is the exception, because a React component cannot be
 * serialized: it stays in `ui.ts`, which only the browser imports.
 */
 const clerkCredentialFields = { CLERK_SECRET_KEY: {
@@ -77,8 +79,8 @@ const clerkCredentialFields = { CLERK_SECRET_KEY: {
 /**
 * The user three of the four actions answer with, flattened out of Clerk's
 * resource: the primary address is picked out of the address list, and the
-* metadata objects stay behind, since a downstream node has no shape to address
-* them by.
+* metadata objects stay behind, because a downstream node has no shape to
+* address them by.
 *
 * The three Clerk may have nothing to give are `optionalKey(NullOr(...))`, which is
 * the one spelling that survives an absent key and an explicit null alike. The
@@ -86,10 +88,10 @@ const clerkCredentialFields = { CLERK_SECRET_KEY: {
 * right question about a missing name.
 */
 const clerkUserOutput = {
-	id: Schema.String.annotate({ description: "User ID" }),
-	firstName: Schema.optionalKey(Schema.NullOr(Schema.String.annotate({ description: "First name" }))),
-	lastName: Schema.optionalKey(Schema.NullOr(Schema.String.annotate({ description: "Last name" }))),
-	primaryEmailAddress: Schema.optionalKey(Schema.NullOr(Schema.String.annotate({ description: "Primary email address" }))),
+	id: Schema.String.annotate({ title: "User ID" }),
+	firstName: Schema.optionalKey(Schema.NullOr(Schema.String)),
+	lastName: Schema.optionalKey(Schema.NullOr(Schema.String)),
+	primaryEmailAddress: Schema.optionalKey(Schema.NullOr(Schema.String)),
 	createdAt: Schema.Number.annotate({ description: "When the user was created, epoch milliseconds" }).check(Schema.isFinite()),
 	updatedAt: Schema.Number.annotate({ description: "When the user was last updated, epoch milliseconds" }).check(Schema.isFinite())
 };
@@ -115,13 +117,13 @@ const updateUserInput = Schema.Struct({
 });
 const updateUserOutput = Schema.Struct(clerkUserOutput);
 const deleteUserInput = Schema.Struct({ userId: Schema.String });
-const deleteUserOutput = Schema.Struct({ deleted: Schema.Boolean.annotate({ description: "Deletion success" }) });
+const deleteUserOutput = Schema.Struct({ deleted: Schema.Boolean.annotate({ title: "Deletion success" }) });
 const clerk = defineIntegration({
 	type: "clerk",
 	label: "Clerk",
 	description: "User authentication and management",
 	credentials: clerkCredentialFields,
-	test: async () => (await import("./test-Dsrib2EJ.js")).testClerk,
+	test: async () => (await import("./test-CiIt-3_x.js")).testClerk,
 	actions: {
 		"get-user": {
 			label: "Get User",
@@ -211,14 +213,14 @@ const clerk = defineIntegration({
 				const publicMetadata = yield* parseClerkMetadata(input.publicMetadata, "publicMetadata");
 				const privateMetadata = yield* parseClerkMetadata(input.privateMetadata, "privateMetadata");
 				const client = createClerkBackendClient(secretKey);
-				const createPayload = omitBy({
+				const createPayload = omitUndefined({
 					emailAddress: [input.emailAddress],
 					firstName: input.firstName,
 					lastName: input.lastName,
 					password: input.password,
 					publicMetadata,
 					privateMetadata
-				}, isNil);
+				});
 				return yield* bag.step.run("create-user", Effect.tryPromise({
 					try: () => client.users.createUser(createPayload),
 					catch: (error) => new StepFailure({ message: `Failed to create user: ${getClerkApiErrorMessage(error)}` })
@@ -279,12 +281,12 @@ const clerk = defineIntegration({
 				const publicMetadata = yield* parseClerkMetadata(input.publicMetadata, "publicMetadata");
 				const privateMetadata = yield* parseClerkMetadata(input.privateMetadata, "privateMetadata");
 				const client = createClerkBackendClient(secretKey);
-				const updatePayload = omitBy({
+				const updatePayload = omitUndefined({
 					firstName: input.firstName,
 					lastName: input.lastName,
 					publicMetadata,
 					privateMetadata
-				}, isNil);
+				});
 				return yield* bag.step.run("update-user", Effect.tryPromise({
 					try: () => client.users.updateUser(input.userId, updatePayload),
 					catch: (error) => new StepFailure({ message: `Failed to update user: ${getClerkApiErrorMessage(error)}` })
@@ -320,14 +322,12 @@ const clerk = defineIntegration({
 		}
 	}
 });
-//#endregion
-//#region src/linear/client.ts
+// src/linear/client.ts
 /** Production Linear SDK client construction from an API key. */
 function createLinearClient(apiKey) {
 	return new LinearClient({ apiKey });
 }
-//#endregion
-//#region src/linear/index.ts
+// src/linear/index.ts
 const linearCredentialFields = {
 	LINEAR_API_KEY: {
 		label: "API Key",
@@ -358,9 +358,9 @@ const createTicketInput = Schema.Struct({
 	ticketDescription: Schema.optionalKey(Schema.String)
 });
 const createTicketOutput = Schema.Struct({
-	id: Schema.String.annotate({ description: "Ticket ID" }),
-	url: Schema.String.annotate({ description: "Ticket URL" }),
-	title: Schema.String.annotate({ description: "Ticket title" })
+	id: Schema.String.annotate({ title: "Ticket ID" }),
+	url: Schema.String.annotate({ title: "Ticket URL" }),
+	title: Schema.String.annotate({ title: "Ticket title" })
 });
 const findIssuesInput = Schema.Struct({
 	linearAssigneeId: Schema.optionalKey(Schema.String),
@@ -394,16 +394,19 @@ const linearStateType = {
 * as a field beside it does.
 */
 const linearIssueSchema = Schema.Struct({
-	id: Schema.String.annotate({ description: "Issue ID" }),
-	title: Schema.String.annotate({ description: "Issue title" }),
-	url: Schema.String.annotate({ description: "Issue URL" }),
-	state: Schema.String.annotate({ description: "Workflow state name" }),
+	id: Schema.String.annotate({ title: "Issue ID" }),
+	title: Schema.String.annotate({ title: "Issue title" }),
+	url: Schema.String.annotate({ title: "Issue URL" }),
+	state: Schema.String.annotate({ title: "Workflow state name" }),
 	priority: Schema.Number.annotate({ description: "Priority, 0 (none) through 4 (low)" }).check(Schema.isFinite()),
-	assigneeId: Schema.optionalKey(Schema.NullOr(Schema.String.annotate({ description: "Assigned user ID" })))
+	assigneeId: Schema.optionalKey(Schema.NullOr(Schema.String.annotate({ title: "Assigned user ID" })))
 });
 const findIssuesOutput = Schema.Struct({
-	issues: Schema.Array(linearIssueSchema).annotate({ description: "Array of issues found" }),
-	count: Schema.Number.annotate({ description: "Number of issues" }).check(Schema.isFinite())
+	issues: Schema.Array(linearIssueSchema).annotate({
+		title: "Issues",
+		description: "The issues that matched the search."
+	}),
+	count: Schema.Number.annotate({ title: "Number of issues" }).check(Schema.isFinite())
 });
 /**
 * Everything the Linear SDK does is a Promise that throws, so every call goes
@@ -437,7 +440,7 @@ function buildIssueFilter(input) {
 	if (input.linearTeamId) filter.team = { id: { eq: input.linearTeamId } };
 	if (input.linearStatus && input.linearStatus !== "any") filter.state = { type: { eq: linearStateType[input.linearStatus] } };
 	if (input.linearLabel) filter.labels = { name: { eqIgnoreCase: input.linearLabel } };
-	return Object.keys(filter).length > 0 ? filter : void 0;
+	return isEmptyObject(filter) ? void 0 : filter;
 }
 function createLinear(createClient) {
 	return defineIntegration({
@@ -446,7 +449,7 @@ function createLinear(createClient) {
 		description: "Create and manage issues in Linear",
 		credentials: linearCredentialFields,
 		test: async () => {
-			const { testLinear } = await import("./test-DWVpiQNl.js");
+			const { testLinear } = await import("./test-CTWGAckT.js");
 			return (creds) => testLinear(creds, createClient);
 		},
 		actions: {
@@ -479,11 +482,11 @@ function createLinear(createClient) {
 					const client = createClient(apiKey);
 					const teamId = credentials.LINEAR_TEAM_ID || (yield* bag.step.run("first-team", firstTeamId(client)));
 					const issue = yield* bag.step.run("create-ticket", callLinear("Failed to create ticket", async () => {
-						const created = await client.createIssue({
+						const created = await client.createIssue(omitUndefined({
 							title: input.ticketTitle,
 							description: input.ticketDescription,
 							teamId
-						});
+						}));
 						const made = created.issue ? await created.issue : void 0;
 						return made ? {
 							id: made.id,
@@ -560,7 +563,7 @@ function createLinear(createClient) {
 					const client = createClient(apiKey);
 					const issues = yield* bag.step.run("find-issues", Effect.tryPromise({
 						try: async () => {
-							const found = await client.issues({ filter: buildIssueFilter(input) });
+							const found = await client.issues(omitUndefined({ filter: buildIssueFilter(input) }));
 							while (found.pageInfo.hasNextPage) await found.fetchNext();
 							return await Promise.all(found.nodes.map(async (issue) => {
 								const state = issue.state ? await issue.state : void 0;
@@ -586,19 +589,1135 @@ function createLinear(createClient) {
 	});
 }
 const linear = createLinear(createLinearClient);
-//#endregion
-//#region src/resend/index.ts
+// src/posthog/capture.ts
 /**
-* The Resend integration: its credentials, its one action, and what that action
-* takes and gives back.
+* The shared `/i/v0/e/` path both PostHog actions take.
+*
+* Handlers stay inline in `defineIntegration` so `bag.input` keeps its
+* contextual type. What they share is the connection, the memoized identity,
+* and turning a client failure into the step's.
+*/
+const MISSING_CREDENTIAL = "POSTHOG_PROJECT_API_KEY is not configured. Please add it in Project Integrations.";
+/**
+* The uuid and timestamp an event is sent under, taken in a step of their own.
+*
+* This is what makes a resend safe. PostHog has no idempotency key and
+* deduplicates on `[timestamp, distinct_id, event, uuid]`, so two attempts
+* collapse only when both of these are the same on each. Memoizing them means
+* every attempt -- `callExternal`'s retry inside the step, a resumed run
+* replaying it, Inngest retrying the whole function -- sends bytes identical to
+* the ones that may already have arrived. Taking either inside the send itself
+* would leave two events instead of one.
+*
+* PostHog's dedup runs during background merges, so it is eventual: a duplicate
+* can show in insights before it merges away. The trade is deliberate, because
+* a dropped analytics event is a hole nobody can reconstruct.
+*/
+const eventIdentity = Effect.sync(() => ({
+	uuid: globalThis.crypto.randomUUID(),
+	timestamp: (/* @__PURE__ */ new Date()).toISOString()
+}));
+function connectionFrom(credentials) {
+	const projectApiKey = credentials.POSTHOG_PROJECT_API_KEY;
+	if (!projectApiKey) return Effect.fail(new StepFailure({ message: MISSING_CREDENTIAL }));
+	return Effect.succeed({
+		projectApiKey,
+		host: resolvePostHogHost(credentials.POSTHOG_HOST)
+	});
+}
+function captureOrFail(message, connection, event) {
+	return captureEvent(connection, event).pipe(Effect.mapError((error) => new StepFailure({ message: `${message}: ${describePostHogFailure(error)}` })));
+}
+// src/oauth-cimd.ts
+/**
+* CIMD public-client token writes.
+*
+* Resend and PostHog both post form bodies to a metadata-document client with
+* no secret and no retry. The provider-specific mapping from a token response
+* to credentials stays in each adapter.
+*/
+const oauthErrorSchema = Schema.Struct({
+	error: Schema.optionalKey(Schema.String),
+	error_description: Schema.optionalKey(Schema.String),
+	error_uri: Schema.optionalKey(Schema.String)
+});
+/** A successful revocation has an empty 200 response body. */
+const emptyOAuthRevokeResponseSchema = Schema.Undefined.pipe(Schema.decodeTo(Schema.Literal(true), SchemaTransformation.transform({
+	decode: () => true,
+	encode: () => void 0
+})));
+function sanitize$1(value, secrets) {
+	let sanitized = value;
+	for (const secret of secrets) {
+		if (secret.length === 0) continue;
+		sanitized = sanitized.replaceAll(secret, "[redacted]").replaceAll(encodeURIComponent(secret), "[redacted]");
+	}
+	return sanitized;
+}
+function safeOAuthError(payload, secrets) {
+	const parsed = parsePayload(payload, oauthErrorSchema);
+	const code = parsed?.error;
+	const safeCode = code !== void 0 && /^[a-z0-9_]{1,100}$/.test(code) ? code : void 0;
+	const description = parsed?.error_description;
+	const safeDescription = description ? sanitize$1(description, secrets).slice(0, 500) : void 0;
+	return compact([safeCode, safeDescription]).join(": ") || "unknown error";
+}
+function describeOAuthFailure$1(system, error, secrets) {
+	if (error._tag === "ExternalUnreachable") return `${system} request failed: ${sanitize$1(error.message, secrets)}`;
+	if (error._tag === "ExternalRejected") return `${system} request rejected: ${safeOAuthError(error.payload, secrets)}`;
+	return `${system} request failed: HTTP ${error.status}`;
+}
+async function requestCimdToken(options) {
+	const result = await callExternalAsync(callExternal({
+		system: options.system,
+		url: options.url,
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded" },
+		body: {
+			kind: "form",
+			value: options.body
+		},
+		schema: options.schema
+	}), (error) => error);
+	if (!result.ok) throw new Error(describeOAuthFailure$1(options.system, result.failure, options.secrets));
+	return result.data;
+}
+function currentRefreshToken(provider, grant) {
+	const refreshToken = grant.tokens.refreshToken;
+	if (!refreshToken) throw new Error(`${provider} OAuth refresh requires the current refresh token`);
+	return refreshToken;
+}
+// src/posthog/oauth.ts
+const POSTHOG_AUTHORIZE_URL = "https://oauth.posthog.com/oauth/authorize/";
+const POSTHOG_TOKEN_URL = "https://oauth.posthog.com/oauth/token/";
+const POSTHOG_REVOKE_URL = "https://oauth.posthog.com/oauth/revoke/";
+/**
+* The only scope capture needs from the private API: reading the project so
+* the adapter can copy its `api_token`. Naming none would request PostHog's
+* entire vocabulary, and PostHog's consent page has no permission chooser that
+* would narrow that for us.
+*/
+const POSTHOG_PROJECT_READ_SCOPE = "project:read";
+const GRANTED_ACCESS_LABEL = "Project access";
+const POSTHOG_REGIONS = [{
+	apiHost: "https://us.posthog.com",
+	captureHost: "https://us.i.posthog.com"
+}, {
+	apiHost: "https://eu.posthog.com",
+	captureHost: "https://eu.i.posthog.com"
+}];
+const NonEmptyTrimmedString = Schema.String.pipe(Schema.decodeTo(Schema.String, SchemaTransformation.trim())).check(Schema.isMinLength(1));
+const posthogOAuthTokenResponseSchema = Schema.Struct({
+	access_token: Schema.String,
+	token_type: Schema.Literal("Bearer"),
+	expires_in: Schema.Finite.check(Schema.isGreaterThan(0)),
+	refresh_token: Schema.String,
+	scope: Schema.optionalKey(Schema.String),
+	scoped_teams: Schema.optionalKey(Schema.Array(Schema.Finite))
+});
+const posthogProjectSchema = Schema.Struct({
+	id: Schema.Finite,
+	name: Schema.String,
+	api_token: NonEmptyTrimmedString
+});
+const posthogProjectListSchema = Schema.Struct({ results: Schema.Array(posthogProjectSchema) });
+const NO_PROJECT = "PostHog OAuth could not find a project for this grant.";
+const MANY_PROJECTS = "PostHog OAuth must be scoped to a single project.";
+const NO_API_KEY = "PostHog did not return a project API key for this grant.";
+function soleItem(items) {
+	if (items.length === 1) {
+		const item = items[0];
+		if (item !== void 0) return item;
+	}
+	if (items.length === 0) throw new Error(NO_PROJECT);
+	throw new Error(MANY_PROJECTS);
+}
+function sanitize(value, secrets) {
+	let sanitized = value;
+	for (const secret of secrets) {
+		if (secret.length === 0) continue;
+		sanitized = sanitized.replaceAll(secret, "[redacted]").replaceAll(encodeURIComponent(secret), "[redacted]");
+	}
+	return sanitized;
+}
+function describeApiFailure(error, secrets) {
+	if (error._tag === "ExternalUnreadable" && error.status === 200) return NO_API_KEY;
+	if (error._tag === "ExternalUnreachable") return `PostHog API request failed: ${sanitize(error.message, secrets)}`;
+	return `PostHog API request failed: HTTP ${error.status}`;
+}
+/**
+* Probe the other cloud only when this one said the token is not for it.
+*
+* A GET is safe to repeat, so a 503 is retried against the same host. Treating
+* that, or a timeout, as a region miss would hide a 5xx from the right cloud
+* behind a second request to the wrong one.
+*/
+function shouldProbeNextRegion(error) {
+	return error._tag === "ExternalRejected" && (error.status === 401 || error.status === 403 || error.status === 404);
+}
+function requestPostHogToken(url, body, schema, secrets) {
+	return requestCimdToken({
+		system: "PostHog OAuth",
+		url,
+		body,
+		schema,
+		secrets
+	});
+}
+async function fetchProjectById(region, accessToken, projectId) {
+	const result = await callExternalAsync(callExternal({
+		system: "PostHog",
+		url: `${region.apiHost}/api/projects/${projectId}/`,
+		method: "GET",
+		headers: { authorization: `Bearer ${accessToken}` },
+		schema: posthogProjectSchema
+	}), (error) => error);
+	if (!result.ok) return result;
+	return {
+		ok: true,
+		project: result.data
+	};
+}
+async function fetchSoleListedProject(region, accessToken) {
+	const result = await callExternalAsync(callExternal({
+		system: "PostHog",
+		url: `${region.apiHost}/api/projects/`,
+		method: "GET",
+		headers: { authorization: `Bearer ${accessToken}` },
+		schema: posthogProjectListSchema
+	}), (error) => error);
+	if (!result.ok) return result;
+	return {
+		ok: true,
+		project: soleItem(result.data.results)
+	};
+}
+function credentialsFromProject(project, captureHost) {
+	return {
+		credentials: {
+			POSTHOG_PROJECT_API_KEY: project.api_token,
+			POSTHOG_HOST: captureHost
+		},
+		accountLabel: project.name
+	};
+}
+/**
+* US first, then EU. Parallel would spend a request on the wrong cloud on
+* every grant, and a 5xx from the right cloud must not be hidden by trying
+* the other.
+*/
+async function resolveProject(accessToken, projectId, secrets) {
+	const us = POSTHOG_REGIONS[0];
+	const eu = POSTHOG_REGIONS[1];
+	const fetch = projectId === void 0 ? (region) => fetchSoleListedProject(region, accessToken) : (region) => fetchProjectById(region, accessToken, projectId);
+	const first = await fetch(us);
+	if (first.ok) return credentialsFromProject(first.project, us.captureHost);
+	if (!shouldProbeNextRegion(first.failure)) throw new Error(describeApiFailure(first.failure, secrets));
+	const second = await fetch(eu);
+	if (second.ok) return credentialsFromProject(second.project, eu.captureHost);
+	throw new Error(describeApiFailure(second.failure, secrets));
+}
+function tokenSet$2(response, credentials, accountLabel) {
+	return {
+		credentials,
+		grantedAccessLabel: GRANTED_ACCESS_LABEL,
+		accountLabel,
+		tokens: {
+			accessToken: response.access_token,
+			refreshToken: response.refresh_token,
+			expiresAt: new Date(Date.now() + response.expires_in * 1e3).toISOString()
+		}
+	};
+}
+function projectCredentialsFromGrant(grant) {
+	const projectApiKey = grant.credentials.POSTHOG_PROJECT_API_KEY;
+	const host = grant.credentials.POSTHOG_HOST;
+	if (!(projectApiKey && host)) throw new Error("PostHog OAuth refresh requires the stored project API key and host.");
+	return {
+		POSTHOG_PROJECT_API_KEY: projectApiKey,
+		POSTHOG_HOST: host
+	};
+}
+/**
+* Empty `scoped_teams` means list and take the only project. One id means
+* fetch that project. More than one is the same refusal as a list of two.
+*/
+function projectIdFromGrant(scopedTeams) {
+	if (scopedTeams === void 0 || scopedTeams.length === 0) return;
+	return soleItem(scopedTeams);
+}
+const posthogOAuth = {
+	label: "PostHog",
+	pkce: "S256",
+	registerClient: (context) => ({
+		clientId: context.metadataDocumentUrl,
+		metadataDocument: {
+			client_id: context.metadataDocumentUrl,
+			client_name: "Workflow Graph",
+			client_uri: context.publicUrl,
+			redirect_uris: [context.callbackUrl],
+			grant_types: ["authorization_code", "refresh_token"],
+			response_types: ["code"],
+			token_endpoint_auth_method: "none",
+			scope: POSTHOG_PROJECT_READ_SCOPE
+		}
+	}),
+	authorize: ({ client, redirectUri, state, codeChallenge }) => {
+		const url = new URL(POSTHOG_AUTHORIZE_URL);
+		url.searchParams.set("client_id", client.clientId);
+		url.searchParams.set("response_type", "code");
+		url.searchParams.set("redirect_uri", redirectUri);
+		url.searchParams.set("state", state);
+		url.searchParams.set("scope", POSTHOG_PROJECT_READ_SCOPE);
+		url.searchParams.set("required_access_level", "project");
+		url.searchParams.set("code_challenge", codeChallenge);
+		url.searchParams.set("code_challenge_method", "S256");
+		return url;
+	},
+	exchange: async ({ client, code, redirectUri, codeVerifier }) => {
+		const secrets = [
+			client.clientId,
+			code,
+			codeVerifier
+		];
+		const response = await requestPostHogToken(POSTHOG_TOKEN_URL, new URLSearchParams({
+			grant_type: "authorization_code",
+			client_id: client.clientId,
+			code,
+			redirect_uri: redirectUri,
+			code_verifier: codeVerifier
+		}), posthogOAuthTokenResponseSchema, secrets);
+		const project = await resolveProject(response.access_token, projectIdFromGrant(response.scoped_teams), [
+			...secrets,
+			response.access_token,
+			response.refresh_token
+		]);
+		return tokenSet$2(response, project.credentials, project.accountLabel);
+	},
+	refresh: async ({ client, grant }) => {
+		const refreshToken = currentRefreshToken("PostHog", grant);
+		const credentials = projectCredentialsFromGrant(grant);
+		return tokenSet$2(await requestPostHogToken(POSTHOG_TOKEN_URL, new URLSearchParams({
+			grant_type: "refresh_token",
+			client_id: client.clientId,
+			refresh_token: refreshToken
+		}), posthogOAuthTokenResponseSchema, [
+			client.clientId,
+			refreshToken,
+			grant.tokens.accessToken
+		]), credentials);
+	},
+	revoke: async ({ client, grant }) => {
+		const refreshToken = currentRefreshToken("PostHog", grant);
+		await requestPostHogToken(POSTHOG_REVOKE_URL, new URLSearchParams({
+			client_id: client.clientId,
+			token: refreshToken,
+			token_type_hint: "refresh_token"
+		}), emptyOAuthRevokeResponseSchema, [
+			client.clientId,
+			refreshToken,
+			grant.tokens.accessToken
+		]);
+	}
+};
+// src/posthog/properties.ts
+/**
+* The JSON a workflow author types into a PostHog property field.
+*
+* Capture Event and Identify Person both offer key-value rows and a JSON box,
+* so the reading of them is written once here rather than twice beside the
+* steps. Capture drops unreadable text so a bad box does not lose the event.
+* Identify fails the step, because a parser miss would otherwise look like
+* "no properties were authored".
+*/
+const propertyEntriesSchema = Schema.Array(Schema.Struct({
+	name: Schema.String,
+	value: Schema.String
+}));
+const decodePropertyEntries = Schema.decodeUnknownResult(propertyEntriesSchema, { errors: "all" });
+function asObject(entries) {
+	return entries ?? {};
+}
+function namedEntries(entries) {
+	const properties = {};
+	for (const entry of entries) if (entry.name.trim()) properties[entry.name] = entry.value;
+	return properties;
+}
+function readKeyValueProperties(entriesJson, invalid) {
+	let parsed;
+	try {
+		parsed = JSON.parse(entriesJson);
+	} catch (error) {
+		if (invalid === "fail") return Effect.fail(new StepFailure({ message: "Properties is not valid JSON." }));
+		console.error("[PostHog] Failed to parse properties JSON:", error);
+		return Effect.undefined;
+	}
+	const result = decodePropertyEntries(parsed);
+	if (Result.isFailure(result)) {
+		if (invalid === "fail") return Effect.fail(new StepFailure({ message: "Properties must be a list of { name, value } entries." }));
+		console.error("[PostHog] Properties must be a list of { name, value } entries:", result.failure.message);
+		return Effect.undefined;
+	}
+	return Effect.succeed(namedEntries(result.success));
+}
+function readJsonProperties(text, invalid) {
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch (error) {
+		if (invalid === "fail") return Effect.fail(new StepFailure({ message: "Properties JSON is not valid JSON." }));
+		console.error("[PostHog] Failed to parse the properties JSON box:", error);
+		return Effect.undefined;
+	}
+	const json = readJsonValue(parsed);
+	if (json === null || typeof json !== "object" || Array.isArray(json)) {
+		if (invalid === "fail") return Effect.fail(new StepFailure({ message: "Properties JSON must hold a JSON object of property names to values." }));
+		console.error("[PostHog] The properties JSON box must hold a JSON object of property names to values.");
+		return Effect.undefined;
+	}
+	return Effect.succeed(json);
+}
+/**
+* One property bag out of the two fields that feed it.
+*
+* Each source is read on its own, so a dropped JSON box does not wipe rows that
+* parsed. The JSON box goes on last, so a builder can override a single key the
+* key-value rows set without rewriting the rows as JSON. Answers `undefined`
+* when neither field contributed anything, which keeps the key off the wire
+* rather than sending an empty object.
+*/
+function readProperties(entriesJson, text, invalid) {
+	return Effect.gen(function* () {
+		const fromRows = entriesJson ? yield* readKeyValueProperties(entriesJson, invalid) : void 0;
+		const fromJson = text?.trim() ? yield* readJsonProperties(text, invalid) : void 0;
+		const merged = {
+			...asObject(fromRows),
+			...asObject(fromJson)
+		};
+		return isEmptyObject(merged) ? void 0 : merged;
+	});
+}
+// src/posthog/index.ts
+/**
+* The PostHog integration: its credentials, its two actions, and what each takes
+* and gives back.
 *
 * One file, because only the server imports it. The editor gets this plugin's
 * metadata as JSON over `/api/extensions`, so nothing here reaches a browser
-* bundle and the system client below costs the browser nothing. The icon is the
-* exception, since a React component cannot be serialized: it stays in `ui.ts`,
-* which only the browser imports.
+* bundle. The icon is the exception, because a React component cannot be
+* serialized: it stays in `ui.ts`, which only the browser imports.
+*
+* Both actions post to the same endpoint. Capturing an event and identifying a
+* person are one call to PostHog with a different event name, and the split into
+* two actions is for the person configuring them, not for the wire.
+*/
+const posthogCredentialFields = {
+	POSTHOG_PROJECT_API_KEY: {
+		label: "Project API Key",
+		type: "password",
+		placeholder: "phc_...",
+		helpText: "Find your project API key in ",
+		helpLink: {
+			text: "PostHog project settings",
+			url: "https://posthog.com/docs/api/capture"
+		}
+	},
+	POSTHOG_HOST: {
+		label: "API Host",
+		type: "url",
+		placeholder: "https://us.i.posthog.com",
+		helpText: "https://us.i.posthog.com for US Cloud, https://eu.i.posthog.com for EU Cloud, or your own domain. Blank means US Cloud."
+	}
+};
+/** The distinct id PostHog will not accept an event without. */
+const MISSING_DISTINCT_ID = "distinctId resolved to nothing. PostHog needs a distinct id to attach the event to a person.";
+/**
+* The Capture Event config, as the step reads it.
+*
+* Every field is a string because that is what a resolved config field is: the
+* editor writes text, and a template variable resolves to text. `optionalKey` for
+* a field a builder may leave blank, which reaches a step as an absent key.
+*/
+const captureEventInput = Schema.Struct({
+	eventName: Schema.String,
+	distinctId: Schema.String,
+	/** The key-value widget's rows, as JSON the step parses. */
+	properties: Schema.optionalKey(Schema.String),
+	/** JSON the workflow author typed, for a property that is not a string. */
+	propertiesJson: Schema.optionalKey(Schema.String),
+	timestamp: Schema.optionalKey(Schema.String),
+	personProfile: Schema.optionalKey(Schema.String),
+	testBehavior: Schema.optionalKey(Schema.String)
+});
+/** The Identify Person config. `$set` and `$set_once` are PostHog's own names. */
+const identifyPersonInput = Schema.Struct({
+	distinctId: Schema.String,
+	setProperties: Schema.optionalKey(Schema.String),
+	setPropertiesJson: Schema.optionalKey(Schema.String),
+	setOnceProperties: Schema.optionalKey(Schema.String),
+	testBehavior: Schema.optionalKey(Schema.String)
+});
+/**
+* What a captured event leaves for the nodes downstream of it.
+*
+* PostHog answers nothing that identifies the event, so what is worth passing on
+* is what this step decided: the uuid it minted, which is what the event can be
+* found by, and the timestamp it was stamped with.
+*
+* `optionalKey(NullOr(...))` on the way out, which is the one spelling that
+* survives both a key the handler leaves out and a null it writes.
+*/
+const captureEventOutput = Schema.Struct({
+	eventName: Schema.String,
+	distinctId: Schema.String.annotate({ title: "Person distinct ID" }),
+	eventUuid: Schema.String,
+	timestamp: Schema.String.annotate({ title: "Event timestamp" }),
+	/** Absent on a real capture: this is why a test run made none. */
+	reasonCode: Schema.optionalKey(Schema.NullOr(Schema.String.annotate({ description: "Why a test run did not capture" })))
+});
+const identifyPersonOutput = Schema.Struct({
+	distinctId: Schema.String.annotate({ title: "Person distinct ID" }),
+	eventUuid: Schema.String,
+	timestamp: Schema.String.annotate({ title: "Event timestamp" }),
+	reasonCode: Schema.optionalKey(Schema.NullOr(Schema.String.annotate({ description: "Why a test run did not identify" })))
+});
+function resolvePostHogTestBehavior(value) {
+	return value === "send" ? "send" : "log_only";
+}
+const posthog = defineIntegration({
+	type: "posthog",
+	label: "PostHog",
+	description: "Capture product analytics events and identify people",
+	credentials: posthogCredentialFields,
+	oauth: posthogOAuth,
+	test: async () => (await import("./test-CTNffdZM.js")).testPostHog,
+	actions: {
+		"capture-event": {
+			label: "Capture Event",
+			description: "Send an event to PostHog",
+			sideEffect: true,
+			input: captureEventInput,
+			output: captureEventOutput,
+			configFields: [
+				{
+					key: "eventName",
+					label: "Event Name",
+					type: "template-input",
+					placeholder: "user_signed_up",
+					example: "user_signed_up",
+					required: true
+				},
+				{
+					key: "distinctId",
+					label: "Distinct ID",
+					type: "template-input",
+					placeholder: "The person this event belongs to",
+					example: "user_12345",
+					required: true
+				},
+				{
+					key: "properties",
+					label: "Properties",
+					type: "key-value"
+				},
+				{
+					key: "personProfile",
+					label: "Person Profile",
+					type: "select",
+					defaultValue: "identified",
+					options: [{
+						value: "identified",
+						label: "Identified (creates a person)"
+					}, {
+						value: "anonymous",
+						label: "Anonymous (no person profile)"
+					}]
+				},
+				{
+					key: "testBehavior",
+					label: "Test Mode Behavior",
+					type: "select",
+					defaultValue: "log_only",
+					options: [{
+						value: "log_only",
+						label: "Log only (do nothing)"
+					}, {
+						value: "send",
+						label: "Capture a real event"
+					}]
+				},
+				{
+					type: "group",
+					label: "Advanced",
+					fields: [{
+						key: "propertiesJson",
+						label: "Properties JSON",
+						type: "template-textarea",
+						placeholder: "For a property that is not text: {\"plan\": \"pro\", \"seats\": 12, \"trial\": false}",
+						rows: 4,
+						example: "{\"seats\": 12}"
+					}, {
+						key: "timestamp",
+						label: "Timestamp (ISO 8601)",
+						type: "template-input",
+						placeholder: "Blank means the moment the step runs",
+						example: "2024-12-25T09:00:00Z"
+					}]
+				}
+			],
+			handler: Effect.fn(function* (bag) {
+				const { input } = bag;
+				const testBehavior = resolvePostHogTestBehavior(input.testBehavior);
+				if (bag.runMode === "test" && testBehavior === "log_only") return {
+					eventName: input.eventName,
+					distinctId: input.distinctId,
+					eventUuid: "",
+					timestamp: "",
+					reasonCode: "test_mode_log_only"
+				};
+				const connection = yield* connectionFrom(yield* bag.credentials);
+				const eventName = input.eventName.trim();
+				const distinctId = input.distinctId.trim();
+				if (!eventName) return yield* new StepFailure({ message: "eventName resolved to nothing. PostHog needs an event name." });
+				if (!distinctId) return yield* new StepFailure({ message: MISSING_DISTINCT_ID });
+				const identity = yield* bag.step.run("identity", eventIdentity);
+				const timestamp = input.timestamp?.trim() || identity.timestamp;
+				const authored = yield* readProperties(input.properties, input.propertiesJson, "drop");
+				const properties = input.personProfile === "anonymous" ? {
+					...authored,
+					$process_person_profile: false
+				} : authored;
+				yield* bag.step.run("capture", captureOrFail("Failed to capture event", connection, omitUndefined({
+					event: eventName,
+					distinct_id: distinctId,
+					uuid: identity.uuid,
+					timestamp,
+					properties
+				})));
+				return {
+					eventName,
+					distinctId,
+					eventUuid: identity.uuid,
+					timestamp
+				};
+			})
+		},
+		"identify-person": {
+			label: "Identify Person",
+			description: "Set properties on a person in PostHog",
+			sideEffect: true,
+			input: identifyPersonInput,
+			output: identifyPersonOutput,
+			configFields: [
+				{
+					key: "distinctId",
+					label: "Distinct ID",
+					type: "template-input",
+					placeholder: "The person to identify",
+					example: "user_12345",
+					required: true
+				},
+				{
+					key: "setProperties",
+					label: "Set Properties (overwrites)",
+					type: "key-value"
+				},
+				{
+					key: "setOnceProperties",
+					label: "Set Once (keeps any existing value)",
+					type: "key-value"
+				},
+				{
+					key: "testBehavior",
+					label: "Test Mode Behavior",
+					type: "select",
+					defaultValue: "log_only",
+					options: [{
+						value: "log_only",
+						label: "Log only (do nothing)"
+					}, {
+						value: "send",
+						label: "Identify for real"
+					}]
+				},
+				{
+					type: "group",
+					label: "Advanced",
+					fields: [{
+						key: "setPropertiesJson",
+						label: "Set Properties JSON",
+						type: "template-textarea",
+						placeholder: "For a property that is not text: {\"plan\": \"pro\", \"seats\": 12}",
+						rows: 4,
+						example: "{\"seats\": 12}"
+					}]
+				}
+			],
+			handler: Effect.fn(function* (bag) {
+				const { input } = bag;
+				const testBehavior = resolvePostHogTestBehavior(input.testBehavior);
+				if (bag.runMode === "test" && testBehavior === "log_only") return {
+					distinctId: input.distinctId,
+					eventUuid: "",
+					timestamp: "",
+					reasonCode: "test_mode_log_only"
+				};
+				const connection = yield* connectionFrom(yield* bag.credentials);
+				const distinctId = input.distinctId.trim();
+				if (!distinctId) return yield* new StepFailure({ message: MISSING_DISTINCT_ID });
+				const set = yield* readProperties(input.setProperties, input.setPropertiesJson, "fail");
+				const setOnce = yield* readProperties(input.setOnceProperties, void 0, "fail");
+				if (!(set || setOnce)) return yield* new StepFailure({ message: "Identify Person needs at least one property to set. Add a row to Set Properties or Set Once." });
+				const identity = yield* bag.step.run("identity", eventIdentity);
+				yield* bag.step.run("identify", captureOrFail("Failed to identify person", connection, omitUndefined({
+					event: "$identify",
+					distinct_id: distinctId,
+					uuid: identity.uuid,
+					timestamp: identity.timestamp,
+					$set: set,
+					$set_once: setOnce
+				})));
+				return {
+					distinctId,
+					eventUuid: identity.uuid,
+					timestamp: identity.timestamp
+				};
+			})
+		}
+	}
+});
+// src/resend/events.ts
+/**
+* The 19 Events Resend's webhook can raise, each a Workflow Graph Event on the
+* umbrella Inngest source `resend/webhook`.
+*
+* Identity is `resend/{type}` so the Lifecycle Node inspector lists one Event per thing
+* that happened. The listener filter is `source.when` on the envelope's `type`.
+* Payload is the Svix envelope `{ type, created_at, data }`. Extra keys pass
+* the intake gate; the structs below name the fields the editor offers.
+*
+* One rule decides every spelling here. A key is required where Resend's docs
+* and `resend-node`'s webhook types agree it is always sent, and
+* `Schema.optionalKey` where either source omits it or calls it conditional, as
+* the docs do for `template_id` with "(if applicable)". A field Resend documents
+* as an explicit null takes `NullOr` around whatever it holds. Where the sources
+* disagree the looser reading wins, because a refused payload never reaches
+* Resend: the POST was answered 200 at intake, so the refusal is visible only
+* to whoever reads the Inngest run history.
+*
+* The rule is worth following closely, since an optional key reaches the
+* condition picker as a nullable field, which is what offers a builder `is set`
+* and `is not set` on the path. Marking a field Resend always sends costs those
+* two operators their meaning.
+*/
+const RESEND_WEBHOOK_SOURCE = "resend/webhook";
+const RESEND_WEBHOOK_EVENT_TYPES = [
+	"email.sent",
+	"email.delivered",
+	"email.delivery_delayed",
+	"email.bounced",
+	"email.complained",
+	"email.opened",
+	"email.clicked",
+	"email.failed",
+	"email.scheduled",
+	"email.suppressed",
+	"email.received",
+	"domain.created",
+	"domain.updated",
+	"domain.deleted",
+	"contact.created",
+	"contact.updated",
+	"contact.deleted",
+	"suppression.added",
+	"suppression.removed"
+];
+const createdAt = isoTimestampString("When Resend created this Event");
+/**
+* What every outbound `email.*` payload carries.
+*
+* Resend documents `broadcast_id` and `template_id` as "(if applicable)" and
+* types `tags` optional, so those three are the keys a run can arrive without.
+* The rest are on every documented example and non-optional in `resend-node`.
+*/
+const emailFields = {
+	email_id: Schema.String,
+	created_at: isoTimestampString("When the email was created"),
+	from: Schema.String.annotate({ title: "Sender" }),
+	to: Schema.mutable(Schema.Array(Schema.String)).annotate({ title: "Recipients" }),
+	subject: Schema.String,
+	message_id: Schema.String.annotate({ title: "RFC Message-ID" }),
+	broadcast_id: Schema.optionalKey(Schema.String),
+	template_id: Schema.optionalKey(Schema.String),
+	tags: Schema.optionalKey(Schema.Record(Schema.String, Schema.String).annotate({ title: "Email tags" }))
+};
+const emailData = Schema.Struct(emailFields);
+const emailClickedData = Schema.Struct({
+	...emailFields,
+	click: Schema.Struct({
+		ipAddress: Schema.String.annotate({ title: "Clicker IP address" }),
+		link: Schema.String.annotate({ title: "Clicked URL" }),
+		timestamp: isoTimestampString("When the link was clicked"),
+		userAgent: Schema.String.annotate({ title: "Clicker user agent" })
+	}).annotate({ title: "Click tracking details" })
+});
+const emailBouncedData = Schema.Struct({
+	...emailFields,
+	bounce: Schema.Struct({
+		message: Schema.String.annotate({ title: "Bounce message" }),
+		subType: Schema.String.annotate({ title: "Bounce sub-type" }),
+		type: Schema.String.annotate({ title: "Bounce type" }),
+		diagnosticCode: Schema.optionalKey(Schema.mutable(Schema.Array(Schema.String)).annotate({ description: "Raw SMTP responses from the receiving server" }))
+	}).annotate({ title: "Bounce details" })
+});
+const emailFailedData = Schema.Struct({
+	...emailFields,
+	failed: Schema.Struct({ reason: Schema.String.annotate({ description: "Why sending failed" }) }).annotate({ title: "Failure details" })
+});
+const emailSuppressedData = Schema.Struct({
+	...emailFields,
+	suppressed: Schema.Struct({
+		message: Schema.String.annotate({ title: "Suppression message" }),
+		type: Schema.String.annotate({ title: "Suppression type" })
+	}).annotate({ title: "Suppression details" })
+});
+/**
+* An inbound email, which carries its own set of keys.
+*
+* `resend-node` gives `email.received` its own payload type carrying the
+* addressing fields and the attachment metadata, with no `broadcast_id`,
+* `template_id` or `tags`, so this names its fields rather than spreading
+* `emailFields`.
+*
+* The received docs page does list those three, which looks like the source
+* disagreement the header rule resolves in favour of the looser reading. It is
+* a different question: that page renders the parameter list every email page
+* shares, and its own JSON example carries none of the three. Whether a key is
+* required is what the looser reading settles. Whether a path is declared at
+* all follows the evidence about this payload, and the example and the SDK
+* agree against the shared list.
+*
+* The body, the headers and the attachment contents are outside the payload;
+* Resend's Received emails and Attachments APIs are where those are read.
+*/
+const emailReceivedData = Schema.Struct({
+	email_id: Schema.String,
+	created_at: isoTimestampString("When the email was received"),
+	from: Schema.String.annotate({
+		title: "Sender",
+		description: "The sender as a bare address with no display name."
+	}),
+	to: Schema.mutable(Schema.Array(Schema.String)).annotate({ title: "Recipients" }),
+	cc: Schema.mutable(Schema.Array(Schema.String)).annotate({ title: "CC recipients" }),
+	bcc: Schema.mutable(Schema.Array(Schema.String)).annotate({ title: "BCC recipients" }),
+	received_for: Schema.mutable(Schema.Array(Schema.String)).annotate({
+		title: "Received for",
+		description: "Addresses the email was received for."
+	}),
+	message_id: Schema.String.annotate({ title: "RFC Message-ID" }),
+	subject: Schema.String,
+	attachments: Schema.mutable(Schema.Array(Schema.Struct({
+		id: Schema.String.annotate({ title: "Attachment ID" }),
+		filename: Schema.NullOr(Schema.String),
+		content_type: Schema.String,
+		content_disposition: Schema.NullOr(Schema.String),
+		content_id: Schema.NullOr(Schema.String)
+	}))).annotate({ title: "Attachment metadata" })
+});
+const domainData = Schema.Struct({
+	id: Schema.String.annotate({ title: "Domain ID" }),
+	name: Schema.String.annotate({ title: "Domain name" }),
+	status: Schema.String.annotate({ title: "Verification status" }),
+	created_at: isoTimestampString("When the domain was created"),
+	region: Schema.String.annotate({ title: "AWS region" }),
+	capabilities: Schema.optionalKey(Schema.Struct({
+		sending: Schema.String.annotate({ title: "Sending capability" }),
+		receiving: Schema.String.annotate({ title: "Receiving capability" })
+	}).annotate({ title: "Domain capabilities" })),
+	records: Schema.mutable(Schema.Array(Schema.Struct({
+		record: Schema.String.annotate({ title: "Record purpose" }),
+		name: Schema.String.annotate({ title: "DNS name" }),
+		type: Schema.String.annotate({ title: "DNS type" }),
+		value: Schema.String.annotate({ title: "DNS value" }),
+		ttl: Schema.String,
+		status: Schema.String.annotate({ title: "Record status" }),
+		priority: Schema.optionalKey(Schema.Number.annotate({ title: "MX priority" }))
+	}))).annotate({ title: "DNS records" })
+});
+const contactData = Schema.Struct({
+	id: Schema.String.annotate({ title: "Contact ID" }),
+	audience_id: Schema.optionalKey(Schema.String),
+	segment_ids: Schema.optionalKey(Schema.mutable(Schema.Array(Schema.String))),
+	created_at: isoTimestampString("When the contact was created"),
+	updated_at: isoTimestampString("When the contact was last updated"),
+	email: Schema.String.annotate({ title: "Contact email" }),
+	first_name: Schema.optionalKey(Schema.NullOr(Schema.String)),
+	last_name: Schema.optionalKey(Schema.NullOr(Schema.String)),
+	unsubscribed: Schema.Boolean.annotate({ title: "Unsubscribed from all emails" })
+});
+const suppressionData = Schema.Struct({
+	id: Schema.String.annotate({ title: "Suppression ID" }),
+	email: Schema.String.annotate({ title: "Suppressed address" }),
+	origin: Schema.Literals([
+		"bounce",
+		"complaint",
+		"manual"
+	]).annotate({ description: "How the address was suppressed" }),
+	source_id: Schema.NullOr(Schema.String).annotate({ description: "Email that triggered the suppression" }),
+	created_at: isoTimestampString("When the suppression was created")
+});
+function resendEnvelope(data) {
+	return Schema.Struct({
+		type: Schema.String.annotate({ title: "Resend event type" }),
+		created_at: createdAt,
+		data
+	});
+}
+function emailEvent(type, label, description, data = emailData) {
+	return defineEvent({
+		name: `resend/${type}`,
+		label,
+		description,
+		schema: resendEnvelope(data),
+		correlationPath: "data.email_id",
+		source: {
+			event: RESEND_WEBHOOK_SOURCE,
+			when: {
+				path: "type",
+				equals: type
+			}
+		}
+	});
+}
+function idEvent(type, label, description, data) {
+	return defineEvent({
+		name: `resend/${type}`,
+		label,
+		description,
+		schema: resendEnvelope(data),
+		correlationPath: "data.id",
+		source: {
+			event: RESEND_WEBHOOK_SOURCE,
+			when: {
+				path: "type",
+				equals: type
+			}
+		}
+	});
+}
+const resendEvents = [
+	emailEvent("email.sent", "Email sent", "Resend accepted the email and queued it for delivery."),
+	emailEvent("email.delivered", "Email delivered", "The recipient's mail server accepted the email."),
+	emailEvent("email.delivery_delayed", "Email delivery delayed", "Delivery was delayed by a temporary issue at the receiving server."),
+	emailEvent("email.bounced", "Email bounced", "The recipient's mail server permanently rejected the email.", emailBouncedData),
+	emailEvent("email.complained", "Email complained", "The recipient marked the email as spam."),
+	emailEvent("email.opened", "Email opened", "The recipient opened the email."),
+	emailEvent("email.clicked", "Email clicked", "The recipient clicked a link in the email.", emailClickedData),
+	emailEvent("email.failed", "Email failed", "Resend could not send the email.", emailFailedData),
+	emailEvent("email.scheduled", "Email scheduled", "The email was scheduled for later sending."),
+	emailEvent("email.suppressed", "Email suppressed", "Resend did not send the email because the address is suppressed.", emailSuppressedData),
+	emailEvent("email.received", "Email received", "Resend received an inbound email. The body is not in the payload.", emailReceivedData),
+	idEvent("domain.created", "Domain created", "A sending or receiving domain was created.", domainData),
+	idEvent("domain.updated", "Domain updated", "A domain's records or status changed.", domainData),
+	idEvent("domain.deleted", "Domain deleted", "A domain was deleted.", domainData),
+	idEvent("contact.created", "Contact created", "A contact was created in an audience.", contactData),
+	idEvent("contact.updated", "Contact updated", "A contact was updated.", contactData),
+	idEvent("contact.deleted", "Contact deleted", "A contact was deleted.", contactData),
+	idEvent("suppression.added", "Suppression added", "An address was added to the suppression list.", suppressionData),
+	idEvent("suppression.removed", "Suppression removed", "An address was removed from the suppression list.", suppressionData)
+];
+// src/resend/oauth.ts
+/**
+* Resend's public OAuth client.
+*
+* Resend identifies a metadata-document client by its document URL. The adapter
+* keeps that URL in every provider request and sends all token material as form
+* data so the server can apply the same rules to exchange, refresh, and revoke.
+*/
+const RESEND_AUTHORIZE_URL = "https://api.resend.com/oauth/authorize";
+const RESEND_TOKEN_URL = "https://api.resend.com/oauth/token";
+const RESEND_REVOKE_URL = "https://api.resend.com/oauth/revoke";
+/**
+* Resend's whole scope vocabulary. There are two and nothing between them:
+* `emails:send` covers the send routes, `full_access` covers every other route,
+* which is why reading a template means asking for the account.
+*
+* The client registers both. The authorization then asks for neither by name,
+* because Resend's own consent page carries the Permission chooser and an
+* omitted `scope` requests the client's whole registered set. Naming one here
+* would only preselect it, and this app has no business deciding for an
+* operator looking at the page.
+*/
+const RESEND_SEND_SCOPE = "emails:send";
+const RESEND_FULL_SCOPE = "full_access";
+/**
+* What Resend granted, worded as its consent page words it, so an operator
+* recognizes the connection's access as the thing they just approved.
+*
+* A scope this cannot name answers nothing rather than throwing. The label is
+* what a dialog draws; the tokens beside it are what the connection runs on, and
+* a refresh that threw here would turn a working grant into one an operator has
+* to reauthorize over a word.
+*/
+function accessLabelFromScope(scope) {
+	const granted = new Set(compact(scope.split(/\s+/u)));
+	if (granted.has(RESEND_FULL_SCOPE)) return "Full access";
+	if (granted.has(RESEND_SEND_SCOPE)) return "Sending access";
+}
+const resendOAuthTokenResponseSchema = Schema.Struct({
+	access_token: Schema.String,
+	token_type: Schema.Literal("Bearer"),
+	expires_in: Schema.Finite.check(Schema.isGreaterThan(0)),
+	refresh_token: Schema.String,
+	scope: Schema.String
+});
+function tokenSet$1(response) {
+	const accessLabel = accessLabelFromScope(response.scope);
+	return {
+		credentials: { RESEND_API_KEY: response.access_token },
+		grantedAccessLabel: accessLabel,
+		tokens: {
+			accessToken: response.access_token,
+			refreshToken: response.refresh_token,
+			expiresAt: new Date(Date.now() + response.expires_in * 1e3).toISOString()
+		}
+	};
+}
+function requestResendToken(url, body, schema, secrets) {
+	return requestCimdToken({
+		system: "Resend OAuth",
+		url,
+		body,
+		schema,
+		secrets
+	});
+}
+const resendOAuth = {
+	label: "Resend",
+	pkce: "S256",
+	registerClient: (context) => ({
+		clientId: context.metadataDocumentUrl,
+		metadataDocument: {
+			client_id: context.metadataDocumentUrl,
+			client_name: "Workflow Graph",
+			client_uri: context.publicUrl,
+			redirect_uris: [context.callbackUrl],
+			grant_types: ["authorization_code", "refresh_token"],
+			response_types: ["code"],
+			token_endpoint_auth_method: "none",
+			scope: `${RESEND_SEND_SCOPE} ${RESEND_FULL_SCOPE}`
+		}
+	}),
+	authorize: ({ client, redirectUri, state, codeChallenge }) => {
+		const url = new URL(RESEND_AUTHORIZE_URL);
+		url.searchParams.set("client_id", client.clientId);
+		url.searchParams.set("response_type", "code");
+		url.searchParams.set("redirect_uri", redirectUri);
+		url.searchParams.set("state", state);
+		url.searchParams.set("code_challenge", codeChallenge);
+		url.searchParams.set("code_challenge_method", "S256");
+		return url;
+	},
+	exchange: async ({ client, code, redirectUri, codeVerifier }) => {
+		return tokenSet$1(await requestResendToken(RESEND_TOKEN_URL, new URLSearchParams({
+			grant_type: "authorization_code",
+			client_id: client.clientId,
+			code,
+			redirect_uri: redirectUri,
+			code_verifier: codeVerifier
+		}), resendOAuthTokenResponseSchema, [
+			client.clientId,
+			code,
+			codeVerifier
+		]));
+	},
+	refresh: async ({ client, grant }) => {
+		const refreshToken = currentRefreshToken("Resend", grant);
+		return tokenSet$1(await requestResendToken(RESEND_TOKEN_URL, new URLSearchParams({
+			grant_type: "refresh_token",
+			client_id: client.clientId,
+			refresh_token: refreshToken
+		}), resendOAuthTokenResponseSchema, [
+			client.clientId,
+			refreshToken,
+			grant.tokens.accessToken
+		]));
+	},
+	revoke: async ({ client, grant }) => {
+		const refreshToken = currentRefreshToken("Resend", grant);
+		await requestResendToken(RESEND_REVOKE_URL, new URLSearchParams({
+			client_id: client.clientId,
+			token: refreshToken,
+			token_type_hint: "refresh_token"
+		}), emptyOAuthRevokeResponseSchema, [
+			client.clientId,
+			refreshToken,
+			grant.tokens.accessToken
+		]);
+	}
+};
+// src/resend/webhook.ts
+/**
+* Resend webhook intake: Svix verify on the raw body, then map a known
+* envelope type onto the umbrella `resend/webhook` send.
+*
+* The API key cannot verify a Svix signature. A Connection without
+* `RESEND_WEBHOOK_SECRET` is send-only; a POST to it is 401. Resend has no
+* URL-challenge handshake. An unknown `type` is ignored (200, no send).
+*/
+const knownTypes = new Set(RESEND_WEBHOOK_EVENT_TYPES);
+function isResendWebhookEventType(value) {
+	return knownTypes.has(value);
+}
+const resendWebhook = {
+	source: RESEND_WEBHOOK_SOURCE,
+	helpText: "Paste this URL into Resend.",
+	secret: "RESEND_WEBHOOK_SECRET",
+	verify: ({ rawBody, headers, credentials }) => {
+		const secret = credentials.RESEND_WEBHOOK_SECRET;
+		if (!secret) return Effect.fail(new SignatureRejected({ error: "This Connection has no webhook signing secret." }));
+		return Effect.try({
+			try: () => {
+				new Webhook(secret).verify(rawBody, {
+					"svix-id": headers.get("svix-id") ?? "",
+					"svix-timestamp": headers.get("svix-timestamp") ?? "",
+					"svix-signature": headers.get("svix-signature") ?? ""
+				});
+			},
+			catch: () => new SignatureRejected({ error: "The webhook signature did not match this Connection's secret." })
+		});
+	},
+	receive: (body, headers) => {
+		const type = body.type;
+		if (typeof type !== "string" || !isResendWebhookEventType(type)) return;
+		return {
+			data: body,
+			id: headers.get("svix-id") || void 0
+		};
+	}
+};
+// src/resend/index.ts
+/**
+* The Resend integration: its credentials, its actions, the Events a
+* webhook raises, and the webhook that produces them.
+*
+* The `defineIntegration` call stays in this file. Event schemas and Svix
+* verify live in sibling modules, because they are large enough on their own.
+* The editor gets this plugin's metadata as JSON over `/api/extensions`, so
+* nothing here reaches a browser bundle. The icon is the exception, because a
+* React component cannot be serialized: it stays in `ui.ts`.
 */
 const resendCredentialFields = {
+	RESEND_WEBHOOK_SECRET: {
+		label: "Webhook Signing Secret",
+		type: "password",
+		placeholder: "whsec_...",
+		helpText: "From the webhook details page in Resend. Optional on a send-only Connection; a POST without it is refused.",
+		helpLink: {
+			text: "resend.com/webhooks",
+			url: "https://resend.com/docs/webhooks/event-types"
+		}
+	},
 	RESEND_API_KEY: {
 		label: "API Key",
 		type: "password",
@@ -620,11 +1739,13 @@ const TEST_EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 /**
 * The Send Email config, as the step reads it.
 *
-* Every field is a string because that is what a resolved config field is: the
-* editor writes text, and a template variable resolves to text. Which of them a
+* Every field a builder types into is a string because that is what a resolved
+* config field is: the editor writes text, and a template variable resolves to
+* text. `emailContentMode` and `testBehavior` are the exception, because a
+* `select` writes one of its own option values and nothing else. Which fields a
 * builder has to fill in is stated in `configFields`; what this schema says is
-* what the step may read. `optionalKey` for a field left blank, which reaches a
-* step as an absent key.
+* what the step may read.
+* `optionalKey` for a field left blank, which reaches a step as an absent key.
 */
 const sendEmailInput = Schema.Struct({
 	emailTo: Schema.String,
@@ -632,7 +1753,11 @@ const sendEmailInput = Schema.Struct({
 	emailFrom: Schema.optionalKey(Schema.String),
 	emailBody: Schema.optionalKey(Schema.String),
 	emailHtml: Schema.optionalKey(Schema.String),
-	emailContentMode: Schema.optionalKey(Schema.String),
+	emailContentMode: Schema.optionalKey(Schema.Literals([
+		"text",
+		"html",
+		"template"
+	])),
 	emailTemplateId: Schema.optionalKey(Schema.String),
 	/** JSON the workflow author typed, parsed by the step. */
 	emailTemplateVariables: Schema.optionalKey(Schema.String),
@@ -643,326 +1768,554 @@ const sendEmailInput = Schema.Struct({
 	emailTopicId: Schema.optionalKey(Schema.String),
 	/** JSON the workflow author typed, parsed by the step. */
 	emailTags: Schema.optionalKey(Schema.String),
-	testBehavior: Schema.optionalKey(Schema.String),
+	testBehavior: Schema.optionalKey(Schema.Literals(["log_only", "send_to_test_email"])),
 	testEmailTo: Schema.optionalKey(Schema.String)
 });
 /**
-* What a sent email leaves for the nodes downstream of it.
-*
-* `optionalKey(NullOr(...))` on the way out, which is the one spelling that survives
-* both a key the handler leaves out and a null it writes where the system sent
-* nothing.
+* What a sent email leaves for the nodes downstream of it.
+*
+* `optionalKey(NullOr(...))` on the way out, which is the one spelling that survives
+* both a key the handler leaves out and a null it writes where the system sent
+* nothing.
+*/
+const sendEmailOutput = Schema.Struct({
+	id: Schema.String.annotate({ title: "Email ID" }),
+	/** Absent on a real send: this is why a test run did not make one. */
+	reasonCode: Schema.optionalKey(Schema.NullOr(Schema.String.annotate({ description: "Why a test run did not send" }))),
+	/**
+	* The tags this send carried, in the shape Resend's own webhooks echo them:
+	* a key per tag name. The wire body sends the list Resend's send API takes,
+	* so the boundary translates and `tags.order_id` then means the same thing
+	* here and on a `resend/email.delivered` payload. A repeated tag name folds
+	* to one key, which is what the webhook does with it too.
+	*/
+	tags: Schema.optionalKey(Schema.Record(Schema.String, Schema.String).annotate({ title: "Email tags" }))
+});
+const findEmailInput = Schema.Struct({ emailId: Schema.String });
+const findEmailOutput = Schema.Struct({
+	id: Schema.String.annotate({ title: "Email ID" }),
+	messageId: Schema.String.annotate({ title: "Provider message ID" }),
+	from: Schema.String.annotate({ title: "Sender" }),
+	to: Schema.Array(Schema.String).annotate({ title: "Recipients" }),
+	cc: Schema.NullOr(Schema.Array(Schema.String).annotate({ title: "CC recipients" })),
+	bcc: Schema.NullOr(Schema.Array(Schema.String).annotate({ title: "BCC recipients" })),
+	replyTo: Schema.NullOr(Schema.Array(Schema.String).annotate({ title: "Reply-to addresses" })),
+	subject: Schema.String.annotate({ title: "Email subject" }),
+	html: Schema.NullOr(Schema.String.annotate({ title: "HTML body" })),
+	text: Schema.NullOr(Schema.String.annotate({ title: "Plain-text body" })),
+	createdAt: isoTimestampString("When the email was created"),
+	lastEvent: Schema.String.annotate({ title: "Latest email event" }),
+	scheduledAt: Schema.NullOr(isoTimestampString("When the email was scheduled to send")),
+	tags: Schema.optionalKey(Schema.Record(Schema.String, Schema.String).annotate({ title: "Email tags" }))
+});
+function isValidTestEmailAddress(value) {
+	return TEST_EMAIL_PATTERN.test(value);
+}
+const emailTagsSchema = Schema.mutable(Schema.Array(Schema.Struct({
+	name: Schema.String,
+	value: Schema.String
+})));
+const templateVariablesSchema = Schema.Record(Schema.String, Schema.Union([Schema.String, Schema.Finite]));
+const decodeEmailTags = Schema.decodeUnknownResult(emailTagsSchema, { errors: "all" });
+const decodeTemplateVariables = Schema.decodeUnknownResult(templateVariablesSchema, { errors: "all" });
+/**
+* The value a JSON config box holds, or the failure naming a box whose text does
+* not describe what Resend accepts.
+*
+* Each decode asks for every issue rather than the first, so one failure accounts
+* for the whole string the author typed. The message names the field as the form
+* labels it and the shape it wanted, never the value it rejected.
+*/
+function readAuthoredJson(text, decode, field) {
+	return Effect.gen(function* () {
+		const result = decode(yield* Effect.try({
+			try: () => JSON.parse(text),
+			catch: () => new StepFailure({ message: `${field.label} is not valid JSON.` })
+		}));
+		if (Result.isFailure(result)) return yield* new StepFailure({ message: `${field.label} must be ${field.shape}.` });
+		return result.success;
+	});
+}
+function readTags(tagsJson) {
+	return readAuthoredJson(tagsJson, decodeEmailTags, {
+		label: "Tags",
+		shape: "a list of name and value entries"
+	});
+}
+function readTemplateVariables(templateVariables) {
+	return readAuthoredJson(templateVariables, decodeTemplateVariables, {
+		label: "Template Variables",
+		shape: "a JSON object of names to strings or numbers"
+	});
+}
+/**
+* Email tags keyed by name, or nothing where Resend returned no tags.
+*
+* Resend's email API uses a list while its webhooks use a record, so this fold
+* gives both actions and Events the same reference shape. A repeated name keeps
+* the last row, matching what Resend does with one.
+*/
+function tagsByName(tags) {
+	return tags?.length ? Object.fromEntries(tags.map((tag) => [tag.name, tag.value])) : void 0;
+}
+/**
+* The body fields the chosen content mode contributes, or the failure naming the
+* box a builder still has to fill in.
+*
+* A template request carries neither html nor text, which Resend rejects, so each
+* mode adds its own fields and nothing else.
+*/
+function emailContent(input) {
+	return Effect.gen(function* () {
+		switch (input.emailContentMode ?? "text") {
+			case "template": {
+				if (!input.emailTemplateId) return yield* new StepFailure({ message: "Content Mode is Template, so a Template must be chosen." });
+				const variables = input.emailTemplateVariables ? yield* readTemplateVariables(input.emailTemplateVariables) : void 0;
+				return { template: omitUndefined({
+					id: input.emailTemplateId,
+					variables
+				}) };
+			}
+			case "html":
+				if (!input.emailHtml) return yield* new StepFailure({ message: "Content Mode is HTML, so HTML Body must be filled in." });
+				return omitUndefined({
+					html: input.emailHtml,
+					text: input.emailBody
+				});
+			default:
+				if (!input.emailBody) return yield* new StepFailure({ message: "Content Mode is Text, so Text Body must be filled in." });
+				return omitUndefined({
+					text: input.emailBody,
+					html: input.emailHtml
+				});
+		}
+	});
+}
+/** The body Resend is sent. */
+const buildEmailPayload = Effect.fn(function* (input, senderEmail, recipients, tags) {
+	const content = yield* emailContent(input);
+	return omitUndefined({
+		from: senderEmail,
+		to: recipients.to,
+		subject: input.emailSubject,
+		cc: recipients.cc,
+		bcc: recipients.bcc,
+		reply_to: input.emailReplyTo,
+		scheduled_at: input.emailScheduledAt,
+		topic_id: input.emailTopicId,
+		tags,
+		...content
+	});
+});
+const resend = defineIntegration({
+	type: "resend",
+	label: "Resend",
+	description: "Send transactional emails",
+	credentials: resendCredentialFields,
+	oauth: resendOAuth,
+	events: resendEvents,
+	webhook: resendWebhook,
+	test: async () => (await import("./test-B5WBOt4r.js")).testResend,
+	configOptions: {
+		templates: {
+			answers: "options",
+			load: async () => (await import("./config-options-BgSb_XqZ.js")).resendTemplateOptions
+		},
+		"template-variables": {
+			answers: "fields",
+			load: async () => (await import("./config-options-BgSb_XqZ.js")).resendTemplateVariableFields
+		}
+	},
+	actions: {
+		"send-email": {
+			label: "Send Email",
+			description: "Send an email via Resend",
+			sideEffect: true,
+			input: sendEmailInput,
+			output: sendEmailOutput,
+			configFields: [
+				{
+					key: "emailFrom",
+					label: "From (Sender)",
+					type: "template-input",
+					placeholder: "Your Name <noreply@example.com>",
+					connectionDefaultKey: "RESEND_FROM_EMAIL",
+					example: "Support <support@example.com>"
+				},
+				{
+					key: "emailTo",
+					label: "To",
+					type: "template-input",
+					placeholder: "recipient@example.com",
+					example: "user@example.com",
+					required: true
+				},
+				{
+					key: "testBehavior",
+					label: "Test Mode Behavior",
+					type: "select",
+					defaultValue: "log_only",
+					options: [{
+						value: "log_only",
+						label: "Log only (do nothing)"
+					}, {
+						value: "send_to_test_email",
+						label: "Send to test email"
+					}]
+				},
+				{
+					key: "testEmailTo",
+					label: "Test Email Address",
+					type: "text",
+					placeholder: "test@example.com",
+					literal: true,
+					showWhen: {
+						field: "testBehavior",
+						equals: "send_to_test_email"
+					}
+				},
+				{
+					key: "emailSubject",
+					label: "Subject",
+					type: "template-input",
+					placeholder: "Subject or {{NodeName.title}}",
+					example: "Hello from my workflow",
+					required: true
+				},
+				{
+					key: "emailContentMode",
+					label: "Content Mode",
+					type: "select",
+					defaultValue: "text",
+					options: [
+						{
+							value: "text",
+							label: "Text"
+						},
+						{
+							value: "html",
+							label: "HTML"
+						},
+						{
+							value: "template",
+							label: "Template"
+						}
+					]
+				},
+				{
+					key: "emailBody",
+					label: "Text Body",
+					type: "template-textarea",
+					placeholder: "Email content or {{NodeName.description}}",
+					rows: 5,
+					example: "This is the email body content.",
+					required: true,
+					showWhen: {
+						field: "emailContentMode",
+						equals: "text"
+					}
+				},
+				{
+					key: "emailHtml",
+					label: "HTML Body",
+					type: "template-textarea",
+					placeholder: "<p>Hello {{NodeName.name}}</p>",
+					rows: 8,
+					showWhen: {
+						field: "emailContentMode",
+						equals: "html"
+					}
+				},
+				{
+					key: "emailTemplateId",
+					label: "Template",
+					type: "provider-select",
+					placeholder: "Choose a template",
+					optionsSource: { provider: "templates" },
+					showWhen: {
+						field: "emailContentMode",
+						equals: "template"
+					}
+				},
+				{
+					key: "emailTemplateVariables",
+					label: "Template Variables",
+					type: "provider-fields",
+					rows: 6,
+					placeholder: "{\"FIRST_NAME\":\"Alice\",\"APPOINTMENT_AT\":\"2026-03-10\"}",
+					optionsSource: {
+						provider: "template-variables",
+						parameters: ["emailTemplateId"]
+					},
+					showWhen: {
+						field: "emailContentMode",
+						equals: "template"
+					}
+				},
+				{
+					type: "group",
+					label: "Additional Recipients",
+					fields: [
+						{
+							key: "emailCc",
+							label: "CC",
+							type: "template-input",
+							placeholder: "cc@example.com",
+							example: "manager@example.com"
+						},
+						{
+							key: "emailBcc",
+							label: "BCC",
+							type: "template-input",
+							placeholder: "bcc@example.com",
+							example: "archive@example.com"
+						},
+						{
+							key: "emailReplyTo",
+							label: "Reply-To",
+							type: "template-input",
+							placeholder: "reply@example.com",
+							example: "support@example.com"
+						}
+					]
+				},
+				{
+					type: "group",
+					label: "Scheduling",
+					fields: [{
+						key: "emailScheduledAt",
+						label: "Schedule At (ISO 8601)",
+						type: "template-input",
+						placeholder: "2024-12-25T09:00:00Z",
+						example: "2024-12-25T09:00:00Z"
+					}, {
+						key: "emailTopicId",
+						label: "Topic ID",
+						type: "template-input",
+						placeholder: "topic_abc123",
+						example: "topic_abc123"
+					}]
+				},
+				{
+					type: "group",
+					label: "Tags",
+					fields: [{
+						key: "emailTags",
+						label: "",
+						type: "key-value",
+						fillsRecords: ["tags", "data.tags"]
+					}]
+				}
+			],
+			handler: Effect.fn(function* (bag) {
+				const { input } = bag;
+				const idempotencyKey = bag.executionId;
+				const syntheticIdSuffix = idempotencyKey ?? "no_execution";
+				const testBehavior = input.testBehavior ?? "log_only";
+				const tags = input.emailTags ? yield* readTags(input.emailTags) : void 0;
+				const tagOutput = omitUndefined({ tags: tagsByName(tags) });
+				if (bag.runMode === "test" && testBehavior === "log_only") return {
+					...tagOutput,
+					id: `resend:test-log-only:${syntheticIdSuffix}`,
+					reasonCode: "test_mode_log_only"
+				};
+				const testRecipient = input.testEmailTo?.trim() ?? "";
+				const routeToTestRecipient = bag.runMode === "test" && testBehavior === "send_to_test_email";
+				if (routeToTestRecipient && testRecipient.length === 0) return {
+					...tagOutput,
+					id: `resend:test-log-fallback:${syntheticIdSuffix}`,
+					reasonCode: "test_mode_log_fallback_missing_test_email"
+				};
+				if (routeToTestRecipient && !isValidTestEmailAddress(testRecipient)) return {
+					...tagOutput,
+					id: `resend:test-log-fallback:${syntheticIdSuffix}`,
+					reasonCode: "test_mode_log_fallback_invalid_test_email"
+				};
+				const credentials = yield* bag.credentials;
+				const apiKey = credentials.RESEND_API_KEY;
+				if (!apiKey) return yield* new StepFailure({ message: "RESEND_API_KEY is not configured. Please add it in Project Integrations." });
+				const senderEmail = input.emailFrom || credentials.RESEND_FROM_EMAIL;
+				if (!senderEmail) return yield* new StepFailure({ message: "No sender is configured. Please add it in the action or in Project Integrations." });
+				const payload = yield* buildEmailPayload(input, senderEmail, routeToTestRecipient ? { to: testRecipient } : {
+					to: input.emailTo,
+					cc: input.emailCc,
+					bcc: input.emailBcc
+				}, tags);
+				const sent = yield* bag.step.run("send", sendResendEmail(apiKey, payload, idempotencyKey).pipe(Effect.mapError((error) => new StepFailure({ message: `Failed to send email: ${describeResendFailure(error)}` }))));
+				return {
+					...tagOutput,
+					id: sent.id
+				};
+			})
+		},
+		"find-email": {
+			label: "Find Email",
+			description: "Retrieve a sent email by ID from Resend",
+			input: findEmailInput,
+			output: findEmailOutput,
+			configFields: [{
+				key: "emailId",
+				label: "Email ID",
+				type: "template-input",
+				placeholder: "Email ID or {{NodeName.id}}",
+				example: "4ef9a417-02e9-4d39-ad75-9611e0fcc33c",
+				required: true
+			}],
+			handler: Effect.fn(function* (bag) {
+				const emailId = bag.input.emailId.trim();
+				if (!emailId) return yield* new StepFailure({ message: "Email ID is required." });
+				const apiKey = (yield* bag.credentials).RESEND_API_KEY;
+				if (!apiKey) return yield* new StepFailure({ message: "RESEND_API_KEY is not configured. Please add it in Project Integrations." });
+				return yield* bag.step.run("find-email", getResendEmail(apiKey, emailId).pipe(Effect.mapBoth({
+					onFailure: (error) => new StepFailure({ message: `Failed to find email: ${describeResendFailure(error)}` }),
+					onSuccess: (email) => ({
+						id: email.id,
+						messageId: email.message_id,
+						from: email.from,
+						to: email.to,
+						cc: email.cc,
+						bcc: email.bcc,
+						replyTo: email.reply_to,
+						subject: email.subject,
+						html: email.html,
+						text: email.text,
+						createdAt: email.created_at.toISOString(),
+						lastEvent: email.last_event,
+						scheduledAt: email.scheduled_at?.toISOString() ?? null,
+						...omitUndefined({ tags: tagsByName(email.tags) })
+					})
+				})));
+			})
+		}
+	}
+});
+// src/slack/oauth.ts
+const SLACK_OAUTH_URL = "https://slack.com/api/oauth.v2.access";
+const SLACK_UNINSTALL_URL = "https://slack.com/api/apps.uninstall";
+const slackEnvelopeSchema = Schema.Struct({
+	ok: Schema.Boolean,
+	error: Schema.optionalKey(Schema.String)
+});
+const slackOAuthResponseSchema = Schema.Struct({
+	ok: Schema.Boolean,
+	access_token: Schema.String,
+	expires_in: Schema.optionalKey(Schema.Finite),
+	refresh_token: Schema.optionalKey(Schema.String),
+	team: Schema.optionalKey(Schema.NullOr(Schema.Struct({
+		id: Schema.optionalKey(Schema.String),
+		name: Schema.optionalKey(Schema.String)
+	})))
+});
+const slackOkResponseSchema = Schema.Struct({ ok: Schema.Boolean });
+/**
+* Keep provider failures useful while keeping authorization material out of
+* messages. Slack's documented error values are lowercase identifier slugs.
 */
-const sendEmailOutput = Schema.Struct({
-	id: Schema.String.annotate({ description: "Email ID" }),
-	/** Absent on a real send: this is why a test run did not make one. */
-	reasonCode: Schema.optionalKey(Schema.NullOr(Schema.String.annotate({ description: "Why a test run did not send" })))
-});
-function resolveResendTestBehavior(value) {
-	return value === "send_to_test_email" ? "send_to_test_email" : "log_only";
-}
-function isValidTestEmailAddress(value) {
-	return TEST_EMAIL_PATTERN.test(value);
+function readSafeSlackError(payload, sensitiveValues) {
+	const error = parsePayload(payload, slackEnvelopeSchema)?.error;
+	if (error === void 0) return;
+	const errorCode = error.match(/^[a-z0-9_]{1,100}(?=$|:)/)?.[0];
+	if (errorCode === void 0 || sensitiveValues.some((value) => value.length > 0 && errorCode === value)) return;
+	return errorCode;
 }
-const emailTagsSchema = Schema.mutable(Schema.Array(Schema.Struct({
-	name: Schema.String,
-	value: Schema.String
-})));
-const templateVariablesSchema = Schema.Record(Schema.String, Schema.Union([Schema.String, Schema.Finite]));
-const decodeEmailTags = Schema.decodeUnknownResult(emailTagsSchema, { errors: "all" });
-const decodeTemplateVariables = Schema.decodeUnknownResult(templateVariablesSchema, { errors: "all" });
-function parseTags(tagsJson) {
-	let parsed;
-	try {
-		parsed = JSON.parse(tagsJson);
-	} catch (error) {
-		console.error("[Resend] Failed to parse tags JSON:", error);
-		return;
-	}
-	const result = decodeEmailTags(parsed);
-	if (Result.isFailure(result)) {
-		console.error("[Resend] Tags JSON must be a list of { name, value } entries:", result.failure.message);
-		return;
+function describeOAuthFailure(error, sensitiveValues) {
+	if (error._tag === "ExternalUnreachable") return `Slack OAuth request failed: ${redactSensitive(error.message, sensitiveValues)}`;
+	if (error._tag === "ExternalRejected") {
+		const slackError = readSafeSlackError(error.payload, sensitiveValues);
+		return slackError ? `Slack OAuth request rejected: ${slackError}` : `Slack OAuth request failed: HTTP ${error.status}`;
 	}
-	return result.success;
+	return `Slack OAuth request failed: HTTP ${error.status}`;
 }
-function parseTemplateVariables(templateVariables) {
-	if (!templateVariables) return;
-	let parsed;
-	try {
-		parsed = JSON.parse(templateVariables);
-	} catch (error) {
-		console.error("[Resend] Failed to parse template variables JSON:", error);
-		return;
-	}
-	const result = decodeTemplateVariables(parsed);
-	if (Result.isFailure(result)) {
-		console.error("[Resend] Template variables JSON must map names to strings or numbers:", result.failure.message);
-		return;
-	}
-	return result.success;
+function redactSensitive(message, sensitiveValues) {
+	return sensitiveValues.reduce((safeMessage, value) => value.length === 0 ? safeMessage : safeMessage.replaceAll(value, "[redacted]"), message);
 }
-/**
-* The body Resend is sent, or the failure that says why one could not be built.
-*
-* The three content modes differ only in which fields they add to a common set,
-* and each names the field it cannot do without, so the message tells an author
-* which box to fill in.
-*/
-function buildEmailPayload(input, senderEmail, recipients) {
-	const basePayload = {
-		from: senderEmail,
-		to: recipients.to,
-		subject: input.emailSubject,
-		...omitBy({
-			cc: recipients.cc,
-			bcc: recipients.bcc,
-			reply_to: input.emailReplyTo,
-			scheduled_at: input.emailScheduledAt,
-			topic_id: input.emailTopicId,
-			tags: input.emailTags ? parseTags(input.emailTags) : void 0
-		}, isNil)
-	};
-	const contentMode = input.emailContentMode || "text";
-	if (contentMode === "template") return input.emailTemplateId ? Effect.succeed({
-		...basePayload,
-		template: {
-			id: input.emailTemplateId,
-			...omitBy({ variables: parseTemplateVariables(input.emailTemplateVariables) }, isNil)
+function basicAuthorization(client) {
+	return `Basic ${Base64.encode(`${client.clientId}:${client.clientSecret ?? ""}`)}`;
+}
+async function requestSlackOAuth(client, url, body, schema, options = {}) {
+	const result = await callExternalAsync(callExternal({
+		system: "Slack OAuth",
+		url,
+		method: "POST",
+		headers: options.basicAuth === false ? {} : { authorization: basicAuthorization(client) },
+		body: {
+			kind: "form",
+			value: body
+		},
+		schema,
+		refusedInBody: (payload) => parsePayload(payload, slackEnvelopeSchema)?.ok !== true
+	}), (error) => error);
+	if (!result.ok) throw new Error(describeOAuthFailure(result.failure, [client.clientSecret ?? "", ...body.values()]));
+	return result.data;
+}
+function tokenSet(response, options) {
+	const hasExpiry = response.expires_in !== void 0;
+	const hasRefreshToken = response.refresh_token !== void 0;
+	if (options.requireRefreshToken && !hasRefreshToken) throw new Error("Slack OAuth refresh response must include a replacement refresh_token.");
+	if (hasExpiry !== hasRefreshToken) throw new Error("Slack OAuth token response must include both expires_in and refresh_token for token rotation.");
+	if (response.expires_in !== void 0 && response.expires_in <= 0) throw new Error("Slack OAuth token response has an invalid expires_in.");
+	return {
+		credentials: { SLACK_API_KEY: response.access_token },
+		tokens: {
+			accessToken: response.access_token,
+			refreshToken: response.refresh_token,
+			expiresAt: response.expires_in === void 0 ? void 0 : new Date(Date.now() + response.expires_in * 1e3).toISOString()
 		}
-	}) : Effect.fail(new StepFailure({ message: "Template mode requires emailTemplateId." }));
-	if (contentMode === "html") return input.emailHtml ? Effect.succeed({
-		...basePayload,
-		html: input.emailHtml,
-		...omitBy({ text: input.emailBody }, isNil)
-	}) : Effect.fail(new StepFailure({ message: "HTML mode requires emailHtml." }));
-	return input.emailBody ? Effect.succeed({
-		...basePayload,
-		text: input.emailBody,
-		...omitBy({ html: input.emailHtml }, isNil)
-	}) : Effect.fail(new StepFailure({ message: "Text mode requires emailBody." }));
+	};
 }
-const resend = defineIntegration({
-	type: "resend",
-	label: "Resend",
-	description: "Send transactional emails",
-	credentials: resendCredentialFields,
-	test: async () => (await import("./test-B8I6nxMN.js")).testResend,
-	actions: { "send-email": {
-		label: "Send Email",
-		description: "Send an email via Resend",
-		sideEffect: true,
-		input: sendEmailInput,
-		output: sendEmailOutput,
-		configFields: [
-			{
-				key: "emailFrom",
-				label: "From (Sender)",
-				type: "template-input",
-				placeholder: "Your Name <noreply@example.com>",
-				example: "Support <support@example.com>"
-			},
-			{
-				key: "emailTo",
-				label: "To",
-				type: "template-input",
-				placeholder: "recipient@example.com",
-				example: "user@example.com",
-				required: true
-			},
-			{
-				key: "testBehavior",
-				label: "Test Mode Behavior",
-				type: "select",
-				defaultValue: "log_only",
-				options: [{
-					value: "log_only",
-					label: "Log only (do nothing)"
-				}, {
-					value: "send_to_test_email",
-					label: "Send to test email"
-				}]
-			},
-			{
-				key: "testEmailTo",
-				label: "Test Email Address",
-				type: "text",
-				placeholder: "test@example.com",
-				literal: true,
-				showWhen: {
-					field: "testBehavior",
-					equals: "send_to_test_email"
-				}
-			},
-			{
-				key: "emailSubject",
-				label: "Subject",
-				type: "template-input",
-				placeholder: "Subject or {{NodeName.title}}",
-				example: "Hello from my workflow",
-				required: true
-			},
-			{
-				key: "emailContentMode",
-				label: "Content Mode",
-				type: "select",
-				defaultValue: "text",
-				options: [
-					{
-						value: "text",
-						label: "Text"
-					},
-					{
-						value: "html",
-						label: "HTML"
-					},
-					{
-						value: "template",
-						label: "Template"
-					}
-				]
-			},
-			{
-				key: "emailBody",
-				label: "Text Body",
-				type: "template-textarea",
-				placeholder: "Email content or {{NodeName.description}}",
-				rows: 5,
-				example: "This is the email body content.",
-				required: true,
-				showWhen: {
-					field: "emailContentMode",
-					equals: "text"
-				}
-			},
-			{
-				key: "emailHtml",
-				label: "HTML Body",
-				type: "template-textarea",
-				placeholder: "<p>Hello {{NodeName.name}}</p>",
-				rows: 8,
-				showWhen: {
-					field: "emailContentMode",
-					equals: "html"
-				}
-			},
-			{
-				key: "emailTemplateId",
-				label: "Template ID",
-				type: "template-input",
-				placeholder: "tpl_xxxxxxxx",
-				showWhen: {
-					field: "emailContentMode",
-					equals: "template"
-				}
-			},
-			{
-				key: "emailTemplateVariables",
-				label: "Template Variables (JSON)",
-				type: "template-textarea",
-				rows: 6,
-				placeholder: "{\"FIRST_NAME\":\"Alice\",\"APPOINTMENT_AT\":\"2026-03-10\"}",
-				showWhen: {
-					field: "emailContentMode",
-					equals: "template"
-				}
-			},
-			{
-				type: "group",
-				label: "Additional Recipients",
-				fields: [
-					{
-						key: "emailCc",
-						label: "CC",
-						type: "template-input",
-						placeholder: "cc@example.com",
-						example: "manager@example.com"
-					},
-					{
-						key: "emailBcc",
-						label: "BCC",
-						type: "template-input",
-						placeholder: "bcc@example.com",
-						example: "archive@example.com"
-					},
-					{
-						key: "emailReplyTo",
-						label: "Reply-To",
-						type: "template-input",
-						placeholder: "reply@example.com",
-						example: "support@example.com"
-					}
-				]
-			},
-			{
-				type: "group",
-				label: "Scheduling",
-				fields: [{
-					key: "emailScheduledAt",
-					label: "Schedule At (ISO 8601)",
-					type: "template-input",
-					placeholder: "2024-12-25T09:00:00Z",
-					example: "2024-12-25T09:00:00Z"
-				}, {
-					key: "emailTopicId",
-					label: "Topic ID",
-					type: "template-input",
-					placeholder: "topic_abc123",
-					example: "topic_abc123"
-				}]
-			},
-			{
-				type: "group",
-				label: "Tags",
-				fields: [{
-					key: "emailTags",
-					label: "",
-					type: "key-value"
-				}]
-			}
-		],
-		handler: Effect.fn(function* (bag) {
-			const { input } = bag;
-			const idempotencyKey = bag.executionId;
-			const syntheticIdSuffix = idempotencyKey ?? "no_execution";
-			const testBehavior = resolveResendTestBehavior(input.testBehavior);
-			if (bag.runMode === "test" && testBehavior === "log_only") return {
-				id: `resend:test-log-only:${syntheticIdSuffix}`,
-				reasonCode: "test_mode_log_only"
-			};
-			const testRecipient = input.testEmailTo?.trim() ?? "";
-			const routeToTestRecipient = bag.runMode === "test" && testBehavior === "send_to_test_email";
-			if (routeToTestRecipient && testRecipient.length === 0) return {
-				id: `resend:test-log-fallback:${syntheticIdSuffix}`,
-				reasonCode: "test_mode_log_fallback_missing_test_email"
-			};
-			if (routeToTestRecipient && !isValidTestEmailAddress(testRecipient)) return {
-				id: `resend:test-log-fallback:${syntheticIdSuffix}`,
-				reasonCode: "test_mode_log_fallback_invalid_test_email"
+function createSlackOAuth(clientId, clientSecret) {
+	const client = {
+		clientId,
+		clientSecret
+	};
+	return {
+		label: "Slack",
+		registerClient: () => client,
+		authorize: ({ redirectUri, state }) => {
+			const url = new URL("https://slack.com/oauth/v2/authorize");
+			url.searchParams.set("client_id", client.clientId);
+			url.searchParams.set("scope", "chat:write");
+			url.searchParams.set("redirect_uri", redirectUri);
+			url.searchParams.set("state", state);
+			return url;
+		},
+		exchange: async ({ code, redirectUri }) => {
+			const response = await requestSlackOAuth(client, SLACK_OAUTH_URL, new URLSearchParams({
+				code,
+				redirect_uri: redirectUri
+			}), slackOAuthResponseSchema);
+			return {
+				...tokenSet(response, { requireRefreshToken: false }),
+				accountLabel: response.team?.name
 			};
-			const credentials = yield* bag.credentials;
-			const apiKey = credentials.RESEND_API_KEY;
-			if (!apiKey) return yield* new StepFailure({ message: "RESEND_API_KEY is not configured. Please add it in Project Integrations." });
-			const senderEmail = input.emailFrom || credentials.RESEND_FROM_EMAIL;
-			if (!senderEmail) return yield* new StepFailure({ message: "No sender is configured. Please add it in the action or in Project Integrations." });
-			const payload = yield* buildEmailPayload(input, senderEmail, routeToTestRecipient ? { to: testRecipient } : {
-				to: input.emailTo,
-				cc: input.emailCc,
-				bcc: input.emailBcc
-			});
-			return { id: (yield* bag.step.run("send", sendResendEmail(apiKey, payload, idempotencyKey).pipe(Effect.mapError((error) => new StepFailure({ message: `Failed to send email: ${describeResendFailure(error)}` }))))).id };
-		})
-	} }
-});
-//#endregion
-//#region src/slack/index.ts
+		},
+		refresh: async ({ grant }) => {
+			const currentRefreshToken = grant.tokens.refreshToken;
+			if (!currentRefreshToken) throw new Error("Slack OAuth refresh requires the current refresh_token.");
+			return tokenSet(await requestSlackOAuth(client, SLACK_OAUTH_URL, new URLSearchParams({
+				grant_type: "refresh_token",
+				refresh_token: currentRefreshToken
+			}), slackOAuthResponseSchema), { requireRefreshToken: true });
+		},
+		revoke: async ({ grant }) => {
+			await requestSlackOAuth({
+				clientId: client.clientId,
+				clientSecret: void 0
+			}, SLACK_UNINSTALL_URL, new URLSearchParams({
+				token: grant.tokens.accessToken,
+				client_id: client.clientId,
+				client_secret: client.clientSecret ?? ""
+			}), slackOkResponseSchema, { basicAuth: false });
+		}
+	};
+}
+// src/slack/index.ts
 /**
-* The Slack integration: its credentials, its one action, and what that action
-* does.
+* The Slack integration: its credentials, actions, and what those actions do.
 *
 * One file, because only the server imports it. The editor gets this plugin's
 * metadata as JSON over `/api/extensions`, so nothing here reaches a browser
-* bundle. The icon is the exception, since a React component cannot be
+* bundle. The icon is the exception, because a React component cannot be
 * serialized: it stays in `ui.ts`, which only the browser imports.
 */
 const slackCredentialFields = { SLACK_API_KEY: {
@@ -999,81 +2352,167 @@ const sendSlackMessageInput = Schema.Struct({
 * nothing.
 */
 const sendSlackMessageOutput = Schema.Struct({
-	ts: Schema.String.annotate({ description: "Message timestamp" }),
-	channel: Schema.String.annotate({ description: "Channel ID" }),
+	ts: Schema.String.annotate({ title: "Message timestamp" }),
+	channel: Schema.String.annotate({ title: "Channel ID" }),
 	/** Absent on a real send: this is why a test run did not make one. */
 	reasonCode: Schema.optionalKey(Schema.NullOr(Schema.String.annotate({ description: "Why a test run did not send" })))
 });
+const replyToThreadInput = Schema.Struct({
+	slackChannel: Schema.String,
+	slackThreadTs: Schema.String,
+	slackMessage: Schema.String,
+	testBehavior: Schema.optionalKey(Schema.String)
+});
+const replyToThreadOutput = Schema.Struct({
+	ts: Schema.String.annotate({ title: "Message timestamp" }),
+	channel: Schema.String.annotate({ title: "Channel ID" }),
+	threadTs: Schema.String.annotate({ title: "Parent message timestamp" }),
+	reasonCode: Schema.optionalKey(Schema.NullOr(Schema.String.annotate({ description: "Why a test run did not send" })))
+});
 function resolveSlackTestBehavior(value) {
 	return value === "send_message" ? "send_message" : "log_only";
 }
-const slack = defineIntegration({
-	type: "slack",
-	label: "Slack",
-	description: "Send messages to Slack channels",
-	credentials: slackCredentialFields,
-	test: async () => (await import("./test-8wDSAiFQ.js")).testSlack,
-	actions: { "send-message": {
-		label: "Send Slack Message",
-		description: "Send a message to a Slack channel",
-		sideEffect: true,
-		input: sendSlackMessageInput,
-		output: sendSlackMessageOutput,
-		configFields: [
-			{
-				key: "slackChannel",
-				label: "Channel",
-				type: "text",
-				placeholder: "#general or {{NodeName.channel}}",
-				example: "#general",
-				required: true
-			},
-			{
-				key: "slackMessage",
-				label: "Message",
-				type: "template-textarea",
-				placeholder: "Your message. Use {{NodeName.field}} to insert data from previous nodes.",
-				rows: 4,
-				example: "Hello from my workflow!",
-				required: true
+const slack = (options) => {
+	const clientId = options?.oauthClient?.clientId?.trim();
+	const clientSecret = options?.oauthClient?.clientSecret?.trim();
+	if (Boolean(clientId) !== Boolean(clientSecret)) throw new Error("Slack OAuth requires non-empty oauthClient.clientId and oauthClient.clientSecret.");
+	return defineIntegration({
+		type: "slack",
+		label: "Slack",
+		description: "Send messages to Slack channels and threads",
+		credentials: slackCredentialFields,
+		oauth: clientId && clientSecret ? createSlackOAuth(clientId, clientSecret) : void 0,
+		test: async () => (await import("./test-x2qD6zdE.js")).testSlack,
+		actions: {
+			"send-message": {
+				label: "Send Slack Message",
+				description: "Send a message to a Slack channel",
+				sideEffect: true,
+				input: sendSlackMessageInput,
+				output: sendSlackMessageOutput,
+				configFields: [
+					{
+						key: "slackChannel",
+						label: "Channel",
+						type: "text",
+						placeholder: "#general or {{NodeName.channel}}",
+						example: "#general",
+						required: true
+					},
+					{
+						key: "slackMessage",
+						label: "Message",
+						type: "template-textarea",
+						placeholder: "Your message. Use {{NodeName.field}} to insert data from previous nodes.",
+						rows: 4,
+						example: "Hello from my workflow!",
+						required: true
+					},
+					{
+						key: "testBehavior",
+						label: "Test Mode Behavior",
+						type: "select",
+						defaultValue: "log_only",
+						options: [{
+							value: "log_only",
+							label: "Log only (do nothing)"
+						}, {
+							value: "send_message",
+							label: "Send real Slack message"
+						}]
+					}
+				],
+				handler: Effect.fn(function* (bag) {
+					const { input } = bag;
+					const testBehavior = resolveSlackTestBehavior(input.testBehavior);
+					if (bag.runMode === "test" && testBehavior === "log_only") return {
+						ts: "",
+						channel: input.slackChannel,
+						reasonCode: "test_mode_log_only"
+					};
+					const apiKey = (yield* bag.credentials).SLACK_API_KEY;
+					if (!apiKey) return yield* new StepFailure({ message: "SLACK_API_KEY is not configured. Please add it in Project Integrations." });
+					const posted = yield* bag.step.run("post", callSlack(apiKey, "chat.postMessage", postMessageSchema, { body: {
+						channel: input.slackChannel,
+						text: input.slackMessage
+					} }).pipe(Effect.mapError((error) => new StepFailure({ message: `Failed to send Slack message: ${describeSlackFailure(error)}` }))));
+					return {
+						ts: posted.ts,
+						channel: posted.channel
+					};
+				})
 			},
-			{
-				key: "testBehavior",
-				label: "Test Mode Behavior",
-				type: "select",
-				defaultValue: "log_only",
-				options: [{
-					value: "log_only",
-					label: "Log only (do nothing)"
-				}, {
-					value: "send_message",
-					label: "Send real Slack message"
-				}]
+			"reply-to-thread": {
+				label: "Reply to Slack Thread",
+				description: "Send a reply to a Slack message thread",
+				sideEffect: true,
+				input: replyToThreadInput,
+				output: replyToThreadOutput,
+				configFields: [
+					{
+						key: "slackChannel",
+						label: "Channel ID",
+						type: "template-input",
+						placeholder: "C1234567890",
+						required: true
+					},
+					{
+						key: "slackThreadTs",
+						label: "Parent Message Timestamp",
+						type: "template-input",
+						placeholder: "1739.123456",
+						required: true
+					},
+					{
+						key: "slackMessage",
+						label: "Message",
+						type: "template-textarea",
+						placeholder: "Your reply. Use {{NodeName.field}} to insert data from previous nodes.",
+						rows: 4,
+						example: "Following up in this thread.",
+						required: true
+					},
+					{
+						key: "testBehavior",
+						label: "Test Mode Behavior",
+						type: "select",
+						defaultValue: "log_only",
+						options: [{
+							value: "log_only",
+							label: "Log only (do nothing)"
+						}, {
+							value: "send_message",
+							label: "Send real Slack message"
+						}]
+					}
+				],
+				handler: Effect.fn(function* (bag) {
+					const { input } = bag;
+					const testBehavior = resolveSlackTestBehavior(input.testBehavior);
+					if (bag.runMode === "test" && testBehavior === "log_only") return {
+						ts: "",
+						channel: input.slackChannel,
+						threadTs: input.slackThreadTs,
+						reasonCode: "test_mode_log_only"
+					};
+					const apiKey = (yield* bag.credentials).SLACK_API_KEY;
+					if (!apiKey) return yield* new StepFailure({ message: "SLACK_API_KEY is not configured. Please add it in Project Integrations." });
+					const posted = yield* bag.step.run("post", callSlack(apiKey, "chat.postMessage", postMessageSchema, { body: {
+						channel: input.slackChannel,
+						text: input.slackMessage,
+						thread_ts: input.slackThreadTs
+					} }).pipe(Effect.mapError((error) => new StepFailure({ message: `Failed to reply to Slack thread: ${describeSlackFailure(error)}` }))));
+					return {
+						ts: posted.ts,
+						channel: posted.channel,
+						threadTs: input.slackThreadTs
+					};
+				})
 			}
-		],
-		handler: Effect.fn(function* (bag) {
-			const { input } = bag;
-			const testBehavior = resolveSlackTestBehavior(input.testBehavior);
-			if (bag.runMode === "test" && testBehavior === "log_only") return {
-				ts: "",
-				channel: input.slackChannel,
-				reasonCode: "test_mode_log_only"
-			};
-			const apiKey = (yield* bag.credentials).SLACK_API_KEY;
-			if (!apiKey) return yield* new StepFailure({ message: "SLACK_API_KEY is not configured. Please add it in Project Integrations." });
-			const posted = yield* bag.step.run("post", callSlack(apiKey, "chat.postMessage", postMessageSchema, { body: {
-				channel: input.slackChannel,
-				text: input.slackMessage
-			} }).pipe(Effect.mapError((error) => new StepFailure({ message: `Failed to send Slack message: ${describeSlackFailure(error)}` }))));
-			return {
-				ts: posted.ts,
-				channel: posted.channel
-			};
-		})
-	} }
-});
-//#endregion
-//#region src/twilio/index.ts
+		}
+	});
+};
+// src/twilio/index.ts
 /**
 * The Twilio integration: its credentials, its actions, and what each action
 * does.
@@ -1081,8 +2520,8 @@ const slack = defineIntegration({
 * One file, because only the server imports it. The editor gets this plugin's
 * metadata as JSON over `/api/extensions`, so nothing here reaches a browser
 * bundle and the system client below costs the browser nothing. The icon is the
-* exception, since a React component cannot be serialized: it stays in `ui.ts`,
-* which only the browser imports.
+* exception, because a React component cannot be serialized: it stays in
+* `ui.ts`, which only the browser imports.
 */
 const twilioCredentialFields = {
 	TWILIO_ACCOUNT_SID: {
@@ -1154,11 +2593,11 @@ const sendSmsInput = Schema.Struct({
 * holds `undefined`, which is why the handler writes the null.
 */
 const sendSmsOutput = Schema.Struct({
-	sid: Schema.String.annotate({ description: "Message SID" }),
-	status: Schema.String.annotate({ description: "Delivery status" }),
-	to: Schema.String.annotate({ description: "Recipient phone number" }),
-	from: Schema.optionalKey(Schema.NullOr(Schema.String.annotate({ description: "Sender phone number" }))),
-	messagingServiceSid: Schema.optionalKey(Schema.NullOr(Schema.String.annotate({ description: "Messaging Service SID" }))),
+	sid: Schema.String.annotate({ title: "Message SID" }),
+	status: Schema.String.annotate({ title: "Delivery status" }),
+	to: Schema.String.annotate({ title: "Recipient phone number" }),
+	from: Schema.optionalKey(Schema.NullOr(Schema.String.annotate({ title: "Sender phone number" }))),
+	messagingServiceSid: Schema.optionalKey(Schema.NullOr(Schema.String.annotate({ title: "Messaging Service SID" }))),
 	/** Absent on a real send: this is why a test run did not make one. */
 	reasonCode: Schema.optionalKey(Schema.NullOr(Schema.String.annotate({ description: "Why a test run did not send" })))
 });
@@ -1170,7 +2609,7 @@ const twilio = defineIntegration({
 	label: "Twilio",
 	description: "Send SMS messages with Twilio Programmable Messaging",
 	credentials: twilioCredentialFields,
-	test: async () => (await import("./test-DN4ZApY4.js")).testTwilio,
+	test: async () => (await import("./test-Beetxizr.js")).testTwilio,
 	actions: { "send-sms": {
 		label: "Send SMS",
 		description: "Send an SMS via Twilio",
@@ -1225,12 +2664,14 @@ const twilio = defineIntegration({
 					key: "smsFrom",
 					label: "From Number",
 					type: "template-input",
-					placeholder: "+15557654321"
+					placeholder: "+15557654321",
+					connectionDefaultKey: "TWILIO_FROM_NUMBER"
 				}, {
 					key: "smsMessagingServiceSid",
 					label: "Messaging Service SID",
 					type: "template-input",
-					placeholder: "MGxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
+					placeholder: "MGxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
+					connectionDefaultKey: "TWILIO_MESSAGING_SERVICE_SID"
 				}]
 			},
 			{
@@ -1304,14 +2745,13 @@ const twilio = defineIntegration({
 		})
 	} }
 });
-//#endregion
-//#region src/index.ts
-const builtInIntegrations = [
+// src/index.ts
+const builtInIntegrations = (options) => [
 	clerk,
 	linear,
+	posthog,
 	resend,
-	slack,
+	slack(options?.slack),
 	twilio
 ];
-//#endregion
-export { builtInIntegrations, clerk, linear, resend, slack, twilio };
+export { builtInIntegrations, clerk, linear, posthog, resend, slack, twilio };