Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/engine/go.mod`:
- Line 129: The dependency github.com/rabbitmq/amqp091-go is currently marked as
// indirect in the module's go.mod but is directly imported (as amqp
"github.com/rabbitmq/amqp091-go") in internal/connector/rabbitmq.go; update the
module's go.mod to move github.com/rabbitmq/amqp091-go v1.11.0 from an indirect
entry to a direct require entry (i.e., add or change it under require without
the // indirect comment) so the dependency is explicit and versioned for builds.

In `@packages/engine/internal/connector/onedrive_test.go`:
- Around line 11-25: The test HTTP handler (srv created with http.HandlerFunc)
currently ignores r.URL.Path so it doesn't verify nested uploads; update the
handler to assert r.URL.Path matches the expected nested path (e.g.,
"/drive/root:/documents/hello.txt:/content" or whatever the Upload path produced
by the onedrive connector is) to catch slash-escaping bugs introduced by
url.PathEscape in onedrive.go; modify the check inside the handler that
currently inspects r.Method and Authorization to also compare r.URL.Path and
fail the test (t.Errorf) if it differs.

In `@packages/engine/internal/connector/onedrive.go`:
- Around line 44-50: The code builds the OneDrive endpoint using
url.PathEscape(filePath) which escapes slashes and breaks nested paths; update
the endpoint construction in the block that sets endpoint (the branch using
params["drive_id"] and the else branch) to escape each path segment instead of
the whole filePath: split filePath by "/" (use strings.Split), apply
url.PathEscape to each segment, then rejoin with "/" (strings.Join) and pass
that escapedPath into c.apiURL(fmt.Sprintf(..., url.PathEscape(driveID),
escapedPath)) (and similarly for the "/me/drive" branch); add the strings import
if missing.

In `@packages/engine/internal/connector/quickbooks.go`:
- Around line 75-89: The code builds a QuickBooks query by concatenating
params["where"] and params["order_by"] directly into query (see variables query,
params, where, orderBy, and helper extractInt), which allows clause injection;
fix by validating or sanitizing those inputs before concatenation: enforce a
strict whitelist/regex for allowed characters and keywords (e.g., alphanumeric,
dots, spaces, comparison operators and boolean keywords) for where and order_by,
reject or return an error for values that don't match, and/or escape any
disallowed tokens so they cannot inject MAXRESULTS/STARTPOSITION or other
clauses; keep the existing max_results and start_position handling (maxResults,
startPos) but only append where/order_by after validation.

In `@packages/engine/internal/connector/rabbitmq_test.go`:
- Around line 31-51: The tests fail to hit validation because Execute currently
calls amqp.Dial before checking inputs; update the Execute implementations
(e.g., RabbitMQPublishConnector.Execute and RabbitMQConsumeConnector.Execute in
rabbitmq.go) to perform input validation first (ensure publish checks for either
exchange or routing_key and non-empty body; consume checks for queue) and return
a validation error before attempting amqp.Dial/connection; only if validation
passes, proceed to dial and the rest of the logic.

In `@packages/engine/internal/connector/rabbitmq.go`:
- Around line 72-93: The current code defaults params["auto_ack"] -> autoAck to
true which causes at-most-once silent loss; change the default to false (autoAck
:= false) and make autoAck opt-in, then stop auto-acking on Get and instead
perform explicit acknowledgements (use ch.Ack with msg.DeliveryTag) only after
the step is durably checkpointed; if you must preserve the opt-in behavior keep
the params["auto_ack"] override but ensure the normal path uses explicit Ack
after checkpointing (and document that enabling auto_ack opts into at-most-once
delivery).
- Around line 14-31: Move parameter validation before any network dial so
invalid requests are rejected without opening connections: in
RabbitMQPublishConnector.Execute, validate params["exchange"] (or routing_key)
and params["body"] before calling newRabbitMQChannel so the function returns
validation errors first; similarly, in RabbitMQConsumeConnector.Execute validate
params["queue"] before calling newRabbitMQChannel. Keep the same error
messages/formatting when returning fmt.Errorf and only call newRabbitMQChannel
after all required parameter checks pass.
- Around line 123-126: The current call to amqp.Dial(amqpURL) cannot be canceled
via the request ctx; change the connection logic in the RabbitMQ connector so
dialing runs where ctx is available and supply a custom Dial function in
amqp.DialConfig.Config.Dial that uses a net.Dialer with DialContext bound to the
incoming ctx (or applies ctx-aware deadlines). Specifically, replace the direct
amqp.Dial call inside the connector with amqp.DialConfig(amqpURL,
amqp.Config{Dial: func(network, addr string) (net.Conn, error) { return
(&net.Dialer{}).DialContext(ctx, network, addr) }}) (or equivalent closure that
captures ctx) so the dial respects cancellation; ensure the function/method that
provides ctx (the surrounding connector function) passes that ctx into the
DialConfig closure and handle/propagate any dial errors as before.

---

Nitpick comments:
In `@packages/engine/internal/connector/shopify.go`:
- Around line 16-26: Multiple Shopify connectors (e.g.,
ShopifyListOrdersConnector and the two other connectors with identical baseURL
fields and apiURL methods) duplicate the same base-URL / API-version logic; add
a single package-level helper function shopifyAPIURL(baseURL string, shop
string, path string) that returns baseURL+path when baseURL != "" else
fmt.Sprintf("https://%s.myshopify.com/admin/api/%s%s", shop, shopifyAPIVersion,
path), then remove the duplicate apiURL methods from the connector types and
replace their calls with shopifyAPIURL(c.baseURL, shop, path) (leave the structs
with their baseURL fields intact so existing composite literals like
&ShopifyListOrdersConnector{...} keep working).