@agent-native/core 0.112.0 → 0.113.0

package/corpus/core/src/provider-api/actions/custom-provider-registration.ts

@@ -0,0 +1,197 @@
+import { z, type ZodTypeAny } from "zod";
+
+import { defineAction } from "../../action.js";
+import { getCredentialContext } from "../../server/request-context.js";
+import {
+  assertCanMutateCustomProviderScope,
+  deleteCustomProvider,
+  getCustomProvider,
+  listCustomProviders,
+  upsertCustomProvider,
+} from "../index.js";
+
+const AuthSchema = z.discriminatedUnion("type", [
+  z.object({ type: z.literal("none") }),
+  z.object({
+    type: z.literal("bearer"),
+    credentialKey: z
+      .string()
+      .min(1)
+      .describe(
+        "Name of the credential key. The secret value must already be stored; this action never accepts secret values.",
+      ),
+  }),
+  z.object({
+    type: z.literal("basic"),
+    usernameKey: z.string().min(1).describe("Credential key for the username."),
+    passwordKey: z.string().min(1).describe("Credential key for the password."),
+  }),
+  z.object({
+    type: z.literal("api-key-header"),
+    credentialKey: z
+      .string()
+      .min(1)
+      .describe("Credential key for the API key."),
+    headerName: z.string().min(1).describe("HTTP header name for the API key."),
+  }),
+]);
+
+export const CustomProviderRegistrationSchema = z.object({
+  operation: z
+    .enum(["upsert", "delete", "list", "get"])
+    .default("upsert")
+    .describe("Operation to perform."),
+  id: z
+    .string()
+    .min(1)
+    .max(64)
+    .optional()
+    .describe("Provider slug. Required for upsert, delete, and get."),
+  label: z
+    .string()
+    .min(1)
+    .max(200)
+    .optional()
+    .describe("Human-readable provider name. Required for upsert."),
+  baseUrl: z
+    .string()
+    .url()
+    .optional()
+    .describe("Public HTTP(S) API base URL. Required for upsert."),
+  auth: AuthSchema.optional().describe("Authentication configuration."),
+  docsUrls: z
+    .array(z.string().url())
+    .optional()
+    .describe("Optional provider documentation URLs."),
+  allowedHostSuffixes: z
+    .array(z.string())
+    .optional()
+    .describe("Optional additional allowed host suffixes."),
+  defaultHeaders: z
+    .record(z.string(), z.string())
+    .optional()
+    .describe("Optional non-secret headers included with every request."),
+  notes: z
+    .string()
+    .max(1000)
+    .optional()
+    .describe("Optional notes shown in the provider catalog."),
+  scope: z
+    .enum(["user", "org"])
+    .default("org")
+    .describe("Store for the current user or the current organization."),
+});
+
+type RegistrationArgs = z.output<typeof CustomProviderRegistrationSchema>;
+
+export interface CustomProviderRegistrationContext {
+  userEmail: string;
+  orgId: string | null;
+}
+
+export interface CreateCustomProviderRegistrationActionOptions<
+  TSchema extends ZodTypeAny = typeof CustomProviderRegistrationSchema,
+> {
+  schema?: TSchema;
+  description?: string;
+  getContext?: () => CustomProviderRegistrationContext | null;
+  resolveOrgRole?: (orgId: string, userEmail: string) => Promise<string | null>;
+}
+
+export function createCustomProviderRegistrationAction<
+  TSchema extends ZodTypeAny = typeof CustomProviderRegistrationSchema,
+>(options: CreateCustomProviderRegistrationActionOptions<TSchema> = {}) {
+  const schema = options.schema ?? CustomProviderRegistrationSchema;
+  return defineAction({
+    description:
+      options.description ??
+      "Register, inspect, or delete a custom API provider for provider-api-request. This stores credential key names only, never secret values. Save required credentials through the app's secrets surface before registration.",
+    schema,
+    http: false,
+    run: async (rawArgs) => {
+      const args = rawArgs as RegistrationArgs;
+      const ctx = options.getContext?.() ?? getCredentialContext();
+      if (!ctx) {
+        throw new Error(
+          "provider-api-register requires an authenticated request context.",
+        );
+      }
+      const scopeId =
+        args.scope === "org" ? (ctx.orgId ?? ctx.userEmail) : ctx.userEmail;
+
+      let orgRole: string | null = null;
+      if (
+        (args.operation === "upsert" || args.operation === "delete") &&
+        args.scope === "org"
+      ) {
+        orgRole = ctx.orgId
+          ? ((await options.resolveOrgRole?.(ctx.orgId, ctx.userEmail)) ?? null)
+          : "owner";
+        assertCanMutateCustomProviderScope(args.scope, scopeId, orgRole);
+      }
+
+      if (args.operation === "list") {
+        const providers = await listCustomProviders(args.scope, scopeId);
+        return {
+          providers: providers.map((provider) => ({
+            id: provider.id,
+            label: provider.label,
+            baseUrl: provider.baseUrl,
+            authType: provider.auth.type,
+            docsUrls: provider.docsUrls,
+            notes: provider.notes,
+            updatedAt: provider.updatedAt,
+          })),
+          count: providers.length,
+        };
+      }
+
+      if (args.operation === "get") {
+        if (!args.id) throw new Error("id is required for get operation.");
+        const provider = await getCustomProvider(args.scope, scopeId, args.id);
+        return provider
+          ? { found: true, provider }
+          : { found: false, id: args.id };
+      }
+
+      if (args.operation === "delete") {
+        if (!args.id) throw new Error("id is required for delete operation.");
+        const deleted = await deleteCustomProvider(
+          args.scope,
+          scopeId,
+          args.id,
+          orgRole,
+        );
+        return { deleted, id: args.id };
+      }
+
+      if (!args.id) throw new Error("id is required for upsert operation.");
+      if (!args.label)
+        throw new Error("label is required for upsert operation.");
+      if (!args.baseUrl)
+        throw new Error("baseUrl is required for upsert operation.");
+      if (!args.auth) throw new Error("auth is required for upsert operation.");
+
+      await upsertCustomProvider({
+        scope: args.scope,
+        scopeId,
+        id: args.id,
+        label: args.label,
+        baseUrl: args.baseUrl,
+        auth: args.auth,
+        docsUrls: args.docsUrls,
+        allowedHostSuffixes: args.allowedHostSuffixes,
+        defaultHeaders: args.defaultHeaders,
+        notes: args.notes,
+        orgRole,
+      });
+
+      return {
+        registered: true,
+        id: args.id,
+        label: args.label,
+        message: `Custom provider "${args.id}" registered. Use provider-api-catalog to inspect it and provider-api-request to call it.`,
+      };
+    },
+  });
+}

package/corpus/core/src/provider-api/actions/delete-staged-dataset.ts

@@ -1,44 +1,5 @@
-import { z } from "zod";
+import { createDeleteStagedDatasetAction } from "./staged-datasets.js";
 
-/**
- * delete-staged-dataset — remove a staged dataset and free its storage.
- */
-import { defineAction } from "../../action.js";
-import { getCredentialContext } from "../../server/request-context.js";
-import { deleteStagedDataset } from "../staged-datasets-store.js";
+export { createDeleteStagedDatasetAction } from "./staged-datasets.js";
 
-export default defineAction({
-  description:
-    "Delete a staged dataset by id, freeing its scratch storage. " +
-    "Use after analysis is complete or before re-staging a large dataset under the same name. " +
-    "Only the owner who staged the dataset can delete it.",
-  schema: z.object({
-    datasetId: z
-      .string()
-      .min(1)
-      .describe(
-        "Dataset id to delete (from list-staged-datasets or provider-api-request stageAs result).",
-      ),
-    appId: z.string().min(1).describe("App id that owns the dataset."),
-  }),
-  http: false,
-  run: async (args) => {
-    const ctx = getCredentialContext();
-    if (!ctx)
-      throw new Error("No authenticated context for delete-staged-dataset.");
-
-    const deleted = await deleteStagedDataset({
-      id: args.datasetId,
-      appId: args.appId,
-      ownerEmail: ctx.userEmail,
-    });
-
-    if (!deleted) {
-      throw new Error(
-        `Dataset ${args.datasetId} not found (or belongs to a different owner/app).`,
-      );
-    }
-
-    return { deleted: true, datasetId: args.datasetId };
-  },
-});
+export default createDeleteStagedDatasetAction();

package/corpus/core/src/provider-api/actions/list-staged-datasets.ts

@@ -1,47 +1,5 @@
-import { z } from "zod";
+import { createListStagedDatasetsAction } from "./staged-datasets.js";
 
-/**
- * list-staged-datasets — enumerate scratch datasets staged by the current user.
- */
-import { defineAction } from "../../action.js";
-import { getCredentialContext } from "../../server/request-context.js";
-import { listStagedDatasets } from "../staged-datasets-store.js";
+export { createListStagedDatasetsAction } from "./staged-datasets.js";
 
-export default defineAction({
-  description:
-    "List staged datasets stored by provider-api-request (stageAs) for the current user and app. " +
-    "Returns dataset ids, names, row counts, columns, and sizes. " +
-    "Use these ids with query-staged-dataset to run aggregations, or with delete-staged-dataset to free space.",
-  schema: z.object({
-    appId: z
-      .string()
-      .min(1)
-      .describe(
-        "App id that owns the datasets (must match the staging context).",
-      ),
-  }),
-  http: { method: "GET" },
-  readOnly: true,
-  run: async (args) => {
-    const ctx = getCredentialContext();
-    if (!ctx)
-      throw new Error("No authenticated context for list-staged-datasets.");
-
-    const datasets = await listStagedDatasets({
-      appId: args.appId,
-      ownerEmail: ctx.userEmail,
-    });
-
-    return {
-      datasets: datasets.map((d) => ({
-        id: d.id,
-        name: d.name,
-        rowCount: d.rowCount,
-        columns: d.columns,
-        byteSize: d.byteSize,
-        updatedAt: new Date(d.updatedAt).toISOString(),
-      })),
-      total: datasets.length,
-    };
-  },
-});
+export default createListStagedDatasetsAction();

package/corpus/core/src/provider-api/actions/provider-api-audit.ts

@@ -0,0 +1,88 @@
+const REDACTED = "[redacted]";
+
+const CREDENTIAL_NAME =
+  /^(?:api[-_]?key|access[-_]?token|auth(?:orization)?|bearer|credential|password|secret|signature|sig|token|x-amz-credential|x-amz-signature)$/i;
+
+function decodePathSegment(segment: string): string {
+  try {
+    return decodeURIComponent(segment);
+  } catch {
+    return segment;
+  }
+}
+
+function looksLikeCredentialValue(segment: string): boolean {
+  const value = decodePathSegment(segment);
+  if (/^eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value)) {
+    return true;
+  }
+  if (
+    /^(?:sk|pk|rk|ghp|github_pat|xox[baprs]|ya29|AIza)[-_][A-Za-z0-9_-]+$/i.test(
+      value,
+    )
+  ) {
+    return true;
+  }
+  return value.length >= 32 && /^[A-Za-z0-9._~-]+$/.test(value);
+}
+
+function sanitizePathname(pathname: string): string {
+  let redactNext = false;
+  return pathname
+    .split("/")
+    .map((segment) => {
+      if (!segment) return segment;
+      const decoded = decodePathSegment(segment);
+      if (redactNext) {
+        redactNext = false;
+        return REDACTED;
+      }
+
+      const assignment = decoded.match(/^([^=:]+)([=:])(.+)$/);
+      if (assignment && CREDENTIAL_NAME.test(assignment[1]!)) {
+        return `${assignment[1]}${assignment[2]}${REDACTED}`;
+      }
+      if (CREDENTIAL_NAME.test(decoded)) {
+        redactNext = true;
+        return segment;
+      }
+      return looksLikeCredentialValue(segment) ? REDACTED : segment;
+    })
+    .join("/");
+}
+
+function sanitizeQuery(search: string): string {
+  if (!search) return "";
+  const redacted = Array.from(new URLSearchParams(search).keys(), (key) => {
+    const safeKey = encodeURIComponent(key.slice(0, 100));
+    return `${safeKey}=${REDACTED}`;
+  });
+  return redacted.length > 0 ? `?${redacted.join("&")}` : "";
+}
+
+export function sanitizeProviderApiAuditPath(path: unknown): string {
+  const raw = String(path ?? "");
+  const withoutFragment = raw.split("#", 1)[0] ?? "";
+
+  try {
+    const url = new URL(withoutFragment);
+    return `${url.protocol}//${url.host}${sanitizePathname(url.pathname)}${sanitizeQuery(url.search)}`;
+  } catch {
+    const queryIndex = withoutFragment.indexOf("?");
+    const pathname =
+      queryIndex >= 0 ? withoutFragment.slice(0, queryIndex) : withoutFragment;
+    const search = queryIndex >= 0 ? withoutFragment.slice(queryIndex + 1) : "";
+    return `${sanitizePathname(pathname)}${sanitizeQuery(search)}`;
+  }
+}
+
+export function buildProviderApiAuditSummary(args: {
+  method?: unknown;
+  provider?: unknown;
+  path?: unknown;
+}): string {
+  const method = String(args.method || "GET").toUpperCase();
+  const provider = String(args.provider ?? "");
+  const path = sanitizeProviderApiAuditPath(args.path);
+  return `${method} ${provider} ${path}`.slice(0, 200);
+}