@agent-native/core 0.112.0 → 0.113.0

package/dist/provider-api/actions/custom-provider-registration.d.ts

@@ -0,0 +1,136 @@
+import { z, type ZodTypeAny } from "zod";
+export declare const CustomProviderRegistrationSchema: z.ZodObject<{
+    operation: z.ZodDefault<z.ZodEnum<{
+        delete: "delete";
+        get: "get";
+        list: "list";
+        upsert: "upsert";
+    }>>;
+    id: z.ZodOptional<z.ZodString>;
+    label: z.ZodOptional<z.ZodString>;
+    baseUrl: z.ZodOptional<z.ZodString>;
+    auth: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"none">;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"bearer">;
+        credentialKey: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"basic">;
+        usernameKey: z.ZodString;
+        passwordKey: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api-key-header">;
+        credentialKey: z.ZodString;
+        headerName: z.ZodString;
+    }, z.core.$strip>], "type">>;
+    docsUrls: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    allowedHostSuffixes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    defaultHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    notes: z.ZodOptional<z.ZodString>;
+    scope: z.ZodDefault<z.ZodEnum<{
+        org: "org";
+        user: "user";
+    }>>;
+}, z.core.$strip>;
+export interface CustomProviderRegistrationContext {
+    userEmail: string;
+    orgId: string | null;
+}
+export interface CreateCustomProviderRegistrationActionOptions<TSchema extends ZodTypeAny = typeof CustomProviderRegistrationSchema> {
+    schema?: TSchema;
+    description?: string;
+    getContext?: () => CustomProviderRegistrationContext | null;
+    resolveOrgRole?: (orgId: string, userEmail: string) => Promise<string | null>;
+}
+export declare function createCustomProviderRegistrationAction<TSchema extends ZodTypeAny = typeof CustomProviderRegistrationSchema>(options?: CreateCustomProviderRegistrationActionOptions<TSchema>): import("../../action.js").ActionDefinition<import("better-auth").StandardSchemaV1.InferInput<TSchema | z.ZodObject<{
+    operation: z.ZodDefault<z.ZodEnum<{
+        delete: "delete";
+        get: "get";
+        list: "list";
+        upsert: "upsert";
+    }>>;
+    id: z.ZodOptional<z.ZodString>;
+    label: z.ZodOptional<z.ZodString>;
+    baseUrl: z.ZodOptional<z.ZodString>;
+    auth: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"none">;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"bearer">;
+        credentialKey: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"basic">;
+        usernameKey: z.ZodString;
+        passwordKey: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api-key-header">;
+        credentialKey: z.ZodString;
+        headerName: z.ZodString;
+    }, z.core.$strip>], "type">>;
+    docsUrls: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    allowedHostSuffixes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    defaultHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    notes: z.ZodOptional<z.ZodString>;
+    scope: z.ZodDefault<z.ZodEnum<{
+        org: "org";
+        user: "user";
+    }>>;
+}, z.core.$strip>>, {
+    deleted?: undefined;
+    id?: undefined;
+    found?: undefined;
+    providers: {
+        id: string;
+        label: string;
+        baseUrl: string;
+        authType: "api-key-header" | "basic" | "bearer" | "none";
+        docsUrls: string[];
+        notes: string;
+        updatedAt: number;
+    }[];
+    count: number;
+    provider?: undefined;
+    registered?: undefined;
+    label?: undefined;
+    message?: undefined;
+} | {
+    deleted?: undefined;
+    count?: undefined;
+    id?: undefined;
+    providers?: undefined;
+    found: boolean;
+    provider: import("../custom-registry.js").CustomProviderConfig;
+    registered?: undefined;
+    label?: undefined;
+    message?: undefined;
+} | {
+    deleted?: undefined;
+    count?: undefined;
+    providers?: undefined;
+    provider?: undefined;
+    found: boolean;
+    id: string;
+    registered?: undefined;
+    label?: undefined;
+    message?: undefined;
+} | {
+    count?: undefined;
+    found?: undefined;
+    providers?: undefined;
+    provider?: undefined;
+    deleted: boolean;
+    id: string;
+    registered?: undefined;
+    label?: undefined;
+    message?: undefined;
+} | {
+    deleted?: undefined;
+    count?: undefined;
+    found?: undefined;
+    providers?: undefined;
+    provider?: undefined;
+    registered: boolean;
+    id: string;
+    label: string;
+    message: string;
+}>;
+//# sourceMappingURL=custom-provider-registration.d.ts.map

package/dist/provider-api/actions/custom-provider-registration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-provider-registration.d.ts","sourceRoot":"","sources":["../../../src/provider-api/actions/custom-provider-registration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,KAAK,UAAU,EAAE,MAAM,KAAK,CAAC;AAsCzC,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4C3C,CAAC;AAIH,MAAM,WAAW,iCAAiC;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,6CAA6C,CAC5D,OAAO,SAAS,UAAU,GAAG,OAAO,gCAAgC;IAEpE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,iCAAiC,GAAG,IAAI,CAAC;IAC5D,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC/E;AAED,wBAAgB,sCAAsC,CACpD,OAAO,SAAS,UAAU,GAAG,OAAO,gCAAgC,EACpE,OAAO,GAAE,6CAA6C,CAAC,OAAO,CAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8FrE"}

package/dist/provider-api/actions/custom-provider-registration.js

@@ -0,0 +1,154 @@
+import { z } from "zod";
+import { defineAction } from "../../action.js";
+import { getCredentialContext } from "../../server/request-context.js";
+import { assertCanMutateCustomProviderScope, deleteCustomProvider, getCustomProvider, listCustomProviders, upsertCustomProvider, } from "../index.js";
+const AuthSchema = z.discriminatedUnion("type", [
+    z.object({ type: z.literal("none") }),
+    z.object({
+        type: z.literal("bearer"),
+        credentialKey: z
+            .string()
+            .min(1)
+            .describe("Name of the credential key. The secret value must already be stored; this action never accepts secret values."),
+    }),
+    z.object({
+        type: z.literal("basic"),
+        usernameKey: z.string().min(1).describe("Credential key for the username."),
+        passwordKey: z.string().min(1).describe("Credential key for the password."),
+    }),
+    z.object({
+        type: z.literal("api-key-header"),
+        credentialKey: z
+            .string()
+            .min(1)
+            .describe("Credential key for the API key."),
+        headerName: z.string().min(1).describe("HTTP header name for the API key."),
+    }),
+]);
+export const CustomProviderRegistrationSchema = z.object({
+    operation: z
+        .enum(["upsert", "delete", "list", "get"])
+        .default("upsert")
+        .describe("Operation to perform."),
+    id: z
+        .string()
+        .min(1)
+        .max(64)
+        .optional()
+        .describe("Provider slug. Required for upsert, delete, and get."),
+    label: z
+        .string()
+        .min(1)
+        .max(200)
+        .optional()
+        .describe("Human-readable provider name. Required for upsert."),
+    baseUrl: z
+        .string()
+        .url()
+        .optional()
+        .describe("Public HTTP(S) API base URL. Required for upsert."),
+    auth: AuthSchema.optional().describe("Authentication configuration."),
+    docsUrls: z
+        .array(z.string().url())
+        .optional()
+        .describe("Optional provider documentation URLs."),
+    allowedHostSuffixes: z
+        .array(z.string())
+        .optional()
+        .describe("Optional additional allowed host suffixes."),
+    defaultHeaders: z
+        .record(z.string(), z.string())
+        .optional()
+        .describe("Optional non-secret headers included with every request."),
+    notes: z
+        .string()
+        .max(1000)
+        .optional()
+        .describe("Optional notes shown in the provider catalog."),
+    scope: z
+        .enum(["user", "org"])
+        .default("org")
+        .describe("Store for the current user or the current organization."),
+});
+export function createCustomProviderRegistrationAction(options = {}) {
+    const schema = options.schema ?? CustomProviderRegistrationSchema;
+    return defineAction({
+        description: options.description ??
+            "Register, inspect, or delete a custom API provider for provider-api-request. This stores credential key names only, never secret values. Save required credentials through the app's secrets surface before registration.",
+        schema,
+        http: false,
+        run: async (rawArgs) => {
+            const args = rawArgs;
+            const ctx = options.getContext?.() ?? getCredentialContext();
+            if (!ctx) {
+                throw new Error("provider-api-register requires an authenticated request context.");
+            }
+            const scopeId = args.scope === "org" ? (ctx.orgId ?? ctx.userEmail) : ctx.userEmail;
+            let orgRole = null;
+            if ((args.operation === "upsert" || args.operation === "delete") &&
+                args.scope === "org") {
+                orgRole = ctx.orgId
+                    ? ((await options.resolveOrgRole?.(ctx.orgId, ctx.userEmail)) ?? null)
+                    : "owner";
+                assertCanMutateCustomProviderScope(args.scope, scopeId, orgRole);
+            }
+            if (args.operation === "list") {
+                const providers = await listCustomProviders(args.scope, scopeId);
+                return {
+                    providers: providers.map((provider) => ({
+                        id: provider.id,
+                        label: provider.label,
+                        baseUrl: provider.baseUrl,
+                        authType: provider.auth.type,
+                        docsUrls: provider.docsUrls,
+                        notes: provider.notes,
+                        updatedAt: provider.updatedAt,
+                    })),
+                    count: providers.length,
+                };
+            }
+            if (args.operation === "get") {
+                if (!args.id)
+                    throw new Error("id is required for get operation.");
+                const provider = await getCustomProvider(args.scope, scopeId, args.id);
+                return provider
+                    ? { found: true, provider }
+                    : { found: false, id: args.id };
+            }
+            if (args.operation === "delete") {
+                if (!args.id)
+                    throw new Error("id is required for delete operation.");
+                const deleted = await deleteCustomProvider(args.scope, scopeId, args.id, orgRole);
+                return { deleted, id: args.id };
+            }
+            if (!args.id)
+                throw new Error("id is required for upsert operation.");
+            if (!args.label)
+                throw new Error("label is required for upsert operation.");
+            if (!args.baseUrl)
+                throw new Error("baseUrl is required for upsert operation.");
+            if (!args.auth)
+                throw new Error("auth is required for upsert operation.");
+            await upsertCustomProvider({
+                scope: args.scope,
+                scopeId,
+                id: args.id,
+                label: args.label,
+                baseUrl: args.baseUrl,
+                auth: args.auth,
+                docsUrls: args.docsUrls,
+                allowedHostSuffixes: args.allowedHostSuffixes,
+                defaultHeaders: args.defaultHeaders,
+                notes: args.notes,
+                orgRole,
+            });
+            return {
+                registered: true,
+                id: args.id,
+                label: args.label,
+                message: `Custom provider "${args.id}" registered. Use provider-api-catalog to inspect it and provider-api-request to call it.`,
+            };
+        },
+    });
+}
+//# sourceMappingURL=custom-provider-registration.js.map

package/dist/provider-api/actions/custom-provider-registration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-provider-registration.js","sourceRoot":"","sources":["../../../src/provider-api/actions/custom-provider-registration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAmB,MAAM,KAAK,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EACL,kCAAkC,EAClC,oBAAoB,EACpB,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAErB,MAAM,UAAU,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC9C,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;IACrC,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,aAAa,EAAE,CAAC;aACb,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,CACP,+GAA+G,CAChH;KACJ,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,kCAAkC,CAAC;QAC3E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,kCAAkC,CAAC;KAC5E,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;QACjC,aAAa,EAAE,CAAC;aACb,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,CAAC,iCAAiC,CAAC;QAC9C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,mCAAmC,CAAC;KAC5E,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,SAAS,EAAE,CAAC;SACT,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;SACzC,OAAO,CAAC,QAAQ,CAAC;SACjB,QAAQ,CAAC,uBAAuB,CAAC;IACpC,EAAE,EAAE,CAAC;SACF,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;SACP,QAAQ,EAAE;SACV,QAAQ,CAAC,sDAAsD,CAAC;IACnE,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,oDAAoD,CAAC;IACjE,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,CAAC,mDAAmD,CAAC;IAChE,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;IACrE,QAAQ,EAAE,CAAC;SACR,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC;SACvB,QAAQ,EAAE;SACV,QAAQ,CAAC,uCAAuC,CAAC;IACpD,mBAAmB,EAAE,CAAC;SACnB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,EAAE;SACV,QAAQ,CAAC,4CAA4C,CAAC;IACzD,cAAc,EAAE,CAAC;SACd,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;SAC9B,QAAQ,EAAE;SACV,QAAQ,CAAC,0DAA0D,CAAC;IACvE,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,GAAG,CAAC,IAAI,CAAC;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,+CAA+C,CAAC;IAC5D,KAAK,EAAE,CAAC;SACL,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;SACrB,OAAO,CAAC,KAAK,CAAC;SACd,QAAQ,CAAC,yDAAyD,CAAC;CACvE,CAAC,CAAC;AAkBH,MAAM,UAAU,sCAAsC,CAEpD,OAAO,GAA2D,EAAE;IACpE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,gCAAgC,CAAC;IAClE,OAAO,YAAY,CAAC;QAClB,WAAW,EACT,OAAO,CAAC,WAAW;YACnB,2NAA2N;QAC7N,MAAM;QACN,IAAI,EAAE,KAAK;QACX,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACrB,MAAM,IAAI,GAAG,OAA2B,CAAC;YACzC,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,EAAE,EAAE,IAAI,oBAAoB,EAAE,CAAC;YAC7D,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GACX,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;YAEtE,IAAI,OAAO,GAAkB,IAAI,CAAC;YAClC,IACE,CAAC,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC;gBAC5D,IAAI,CAAC,KAAK,KAAK,KAAK,EACpB,CAAC;gBACD,OAAO,GAAG,GAAG,CAAC,KAAK;oBACjB,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC;oBACtE,CAAC,CAAC,OAAO,CAAC;gBACZ,kCAAkC,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YACnE,CAAC;YAED,IAAI,IAAI,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;gBAC9B,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBACjE,OAAO;oBACL,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;wBACtC,EAAE,EAAE,QAAQ,CAAC,EAAE;wBACf,KAAK,EAAE,QAAQ,CAAC,KAAK;wBACrB,OAAO,EAAE,QAAQ,CAAC,OAAO;wBACzB,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI;wBAC5B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;wBAC3B,KAAK,EAAE,QAAQ,CAAC,KAAK;wBACrB,SAAS,EAAE,QAAQ,CAAC,SAAS;qBAC9B,CAAC,CAAC;oBACH,KAAK,EAAE,SAAS,CAAC,MAAM;iBACxB,CAAC;YACJ,CAAC;YAED,IAAI,IAAI,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;gBAC7B,IAAI,CAAC,IAAI,CAAC,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;gBACnE,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;gBACvE,OAAO,QAAQ;oBACb,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC3B,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;YACpC,CAAC;YAED,IAAI,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAChC,IAAI,CAAC,IAAI,CAAC,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;gBACtE,MAAM,OAAO,GAAG,MAAM,oBAAoB,CACxC,IAAI,CAAC,KAAK,EACV,OAAO,EACP,IAAI,CAAC,EAAE,EACP,OAAO,CACR,CAAC;gBACF,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;YAClC,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YACtE,IAAI,CAAC,IAAI,CAAC,KAAK;gBACb,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YAC7D,IAAI,CAAC,IAAI,CAAC,OAAO;gBACf,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YAC/D,IAAI,CAAC,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAE1E,MAAM,oBAAoB,CAAC;gBACzB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,OAAO;gBACP,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;gBAC7C,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,OAAO;aACR,CAAC,CAAC;YAEH,OAAO;gBACL,UAAU,EAAE,IAAI;gBAChB,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,OAAO,EAAE,oBAAoB,IAAI,CAAC,EAAE,2FAA2F;aAChI,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { z, type ZodTypeAny } from \"zod\";\n\nimport { defineAction } from \"../../action.js\";\nimport { getCredentialContext } from \"../../server/request-context.js\";\nimport {\n  assertCanMutateCustomProviderScope,\n  deleteCustomProvider,\n  getCustomProvider,\n  listCustomProviders,\n  upsertCustomProvider,\n} from \"../index.js\";\n\nconst AuthSchema = z.discriminatedUnion(\"type\", [\n  z.object({ type: z.literal(\"none\") }),\n  z.object({\n    type: z.literal(\"bearer\"),\n    credentialKey: z\n      .string()\n      .min(1)\n      .describe(\n        \"Name of the credential key. The secret value must already be stored; this action never accepts secret values.\",\n      ),\n  }),\n  z.object({\n    type: z.literal(\"basic\"),\n    usernameKey: z.string().min(1).describe(\"Credential key for the username.\"),\n    passwordKey: z.string().min(1).describe(\"Credential key for the password.\"),\n  }),\n  z.object({\n    type: z.literal(\"api-key-header\"),\n    credentialKey: z\n      .string()\n      .min(1)\n      .describe(\"Credential key for the API key.\"),\n    headerName: z.string().min(1).describe(\"HTTP header name for the API key.\"),\n  }),\n]);\n\nexport const CustomProviderRegistrationSchema = z.object({\n  operation: z\n    .enum([\"upsert\", \"delete\", \"list\", \"get\"])\n    .default(\"upsert\")\n    .describe(\"Operation to perform.\"),\n  id: z\n    .string()\n    .min(1)\n    .max(64)\n    .optional()\n    .describe(\"Provider slug. Required for upsert, delete, and get.\"),\n  label: z\n    .string()\n    .min(1)\n    .max(200)\n    .optional()\n    .describe(\"Human-readable provider name. Required for upsert.\"),\n  baseUrl: z\n    .string()\n    .url()\n    .optional()\n    .describe(\"Public HTTP(S) API base URL. Required for upsert.\"),\n  auth: AuthSchema.optional().describe(\"Authentication configuration.\"),\n  docsUrls: z\n    .array(z.string().url())\n    .optional()\n    .describe(\"Optional provider documentation URLs.\"),\n  allowedHostSuffixes: z\n    .array(z.string())\n    .optional()\n    .describe(\"Optional additional allowed host suffixes.\"),\n  defaultHeaders: z\n    .record(z.string(), z.string())\n    .optional()\n    .describe(\"Optional non-secret headers included with every request.\"),\n  notes: z\n    .string()\n    .max(1000)\n    .optional()\n    .describe(\"Optional notes shown in the provider catalog.\"),\n  scope: z\n    .enum([\"user\", \"org\"])\n    .default(\"org\")\n    .describe(\"Store for the current user or the current organization.\"),\n});\n\ntype RegistrationArgs = z.output<typeof CustomProviderRegistrationSchema>;\n\nexport interface CustomProviderRegistrationContext {\n  userEmail: string;\n  orgId: string | null;\n}\n\nexport interface CreateCustomProviderRegistrationActionOptions<\n  TSchema extends ZodTypeAny = typeof CustomProviderRegistrationSchema,\n> {\n  schema?: TSchema;\n  description?: string;\n  getContext?: () => CustomProviderRegistrationContext | null;\n  resolveOrgRole?: (orgId: string, userEmail: string) => Promise<string | null>;\n}\n\nexport function createCustomProviderRegistrationAction<\n  TSchema extends ZodTypeAny = typeof CustomProviderRegistrationSchema,\n>(options: CreateCustomProviderRegistrationActionOptions<TSchema> = {}) {\n  const schema = options.schema ?? CustomProviderRegistrationSchema;\n  return defineAction({\n    description:\n      options.description ??\n      \"Register, inspect, or delete a custom API provider for provider-api-request. This stores credential key names only, never secret values. Save required credentials through the app's secrets surface before registration.\",\n    schema,\n    http: false,\n    run: async (rawArgs) => {\n      const args = rawArgs as RegistrationArgs;\n      const ctx = options.getContext?.() ?? getCredentialContext();\n      if (!ctx) {\n        throw new Error(\n          \"provider-api-register requires an authenticated request context.\",\n        );\n      }\n      const scopeId =\n        args.scope === \"org\" ? (ctx.orgId ?? ctx.userEmail) : ctx.userEmail;\n\n      let orgRole: string | null = null;\n      if (\n        (args.operation === \"upsert\" || args.operation === \"delete\") &&\n        args.scope === \"org\"\n      ) {\n        orgRole = ctx.orgId\n          ? ((await options.resolveOrgRole?.(ctx.orgId, ctx.userEmail)) ?? null)\n          : \"owner\";\n        assertCanMutateCustomProviderScope(args.scope, scopeId, orgRole);\n      }\n\n      if (args.operation === \"list\") {\n        const providers = await listCustomProviders(args.scope, scopeId);\n        return {\n          providers: providers.map((provider) => ({\n            id: provider.id,\n            label: provider.label,\n            baseUrl: provider.baseUrl,\n            authType: provider.auth.type,\n            docsUrls: provider.docsUrls,\n            notes: provider.notes,\n            updatedAt: provider.updatedAt,\n          })),\n          count: providers.length,\n        };\n      }\n\n      if (args.operation === \"get\") {\n        if (!args.id) throw new Error(\"id is required for get operation.\");\n        const provider = await getCustomProvider(args.scope, scopeId, args.id);\n        return provider\n          ? { found: true, provider }\n          : { found: false, id: args.id };\n      }\n\n      if (args.operation === \"delete\") {\n        if (!args.id) throw new Error(\"id is required for delete operation.\");\n        const deleted = await deleteCustomProvider(\n          args.scope,\n          scopeId,\n          args.id,\n          orgRole,\n        );\n        return { deleted, id: args.id };\n      }\n\n      if (!args.id) throw new Error(\"id is required for upsert operation.\");\n      if (!args.label)\n        throw new Error(\"label is required for upsert operation.\");\n      if (!args.baseUrl)\n        throw new Error(\"baseUrl is required for upsert operation.\");\n      if (!args.auth) throw new Error(\"auth is required for upsert operation.\");\n\n      await upsertCustomProvider({\n        scope: args.scope,\n        scopeId,\n        id: args.id,\n        label: args.label,\n        baseUrl: args.baseUrl,\n        auth: args.auth,\n        docsUrls: args.docsUrls,\n        allowedHostSuffixes: args.allowedHostSuffixes,\n        defaultHeaders: args.defaultHeaders,\n        notes: args.notes,\n        orgRole,\n      });\n\n      return {\n        registered: true,\n        id: args.id,\n        label: args.label,\n        message: `Custom provider \"${args.id}\" registered. Use provider-api-catalog to inspect it and provider-api-request to call it.`,\n      };\n    },\n  });\n}\n"]}

package/dist/provider-api/actions/delete-staged-dataset.d.ts

@@ -1,6 +1,6 @@
+export { createDeleteStagedDatasetAction } from "./staged-datasets.js";
 declare const _default: import("../../action.js").ActionDefinition<{
     datasetId: string;
-    appId: string;
 }, {
     deleted: boolean;
     datasetId: string;

package/dist/provider-api/actions/delete-staged-dataset.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delete-staged-dataset.d.ts","sourceRoot":"","sources":["../../../src/provider-api/actions/delete-staged-dataset.ts"],"names":[],"mappings":""}
+{"version":3,"file":"delete-staged-dataset.d.ts","sourceRoot":"","sources":["../../../src/provider-api/actions/delete-staged-dataset.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,+BAA+B,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/provider-api/actions/delete-staged-dataset.js

@@ -1,35 +1,4 @@
-import { z } from "zod";
-/**
- * delete-staged-dataset — remove a staged dataset and free its storage.
- */
-import { defineAction } from "../../action.js";
-import { getCredentialContext } from "../../server/request-context.js";
-import { deleteStagedDataset } from "../staged-datasets-store.js";
-export default defineAction({
-    description: "Delete a staged dataset by id, freeing its scratch storage. " +
-        "Use after analysis is complete or before re-staging a large dataset under the same name. " +
-        "Only the owner who staged the dataset can delete it.",
-    schema: z.object({
-        datasetId: z
-            .string()
-            .min(1)
-            .describe("Dataset id to delete (from list-staged-datasets or provider-api-request stageAs result)."),
-        appId: z.string().min(1).describe("App id that owns the dataset."),
-    }),
-    http: false,
-    run: async (args) => {
-        const ctx = getCredentialContext();
-        if (!ctx)
-            throw new Error("No authenticated context for delete-staged-dataset.");
-        const deleted = await deleteStagedDataset({
-            id: args.datasetId,
-            appId: args.appId,
-            ownerEmail: ctx.userEmail,
-        });
-        if (!deleted) {
-            throw new Error(`Dataset ${args.datasetId} not found (or belongs to a different owner/app).`);
-        }
-        return { deleted: true, datasetId: args.datasetId };
-    },
-});
+import { createDeleteStagedDatasetAction } from "./staged-datasets.js";
+export { createDeleteStagedDatasetAction } from "./staged-datasets.js";
+export default createDeleteStagedDatasetAction();
 //# sourceMappingURL=delete-staged-dataset.js.map

package/dist/provider-api/actions/delete-staged-dataset.js.map

@@ -1 +1 @@
-{"version":3,"file":"delete-staged-dataset.js","sourceRoot":"","sources":["../../../src/provider-api/actions/delete-staged-dataset.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;GAEG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE,eAAe,YAAY,CAAC;IAC1B,WAAW,EACT,8DAA8D;QAC9D,2FAA2F;QAC3F,sDAAsD;IACxD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,SAAS,EAAE,CAAC;aACT,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,CACP,0FAA0F,CAC3F;QACH,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,+BAA+B,CAAC;KACnE,CAAC;IACF,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClB,MAAM,GAAG,GAAG,oBAAoB,EAAE,CAAC;QACnC,IAAI,CAAC,GAAG;YACN,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAEzE,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;YACxC,EAAE,EAAE,IAAI,CAAC,SAAS;YAClB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU,EAAE,GAAG,CAAC,SAAS;SAC1B,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,CAAC,SAAS,mDAAmD,CAC7E,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IACtD,CAAC;CACF,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\n\n/**\n * delete-staged-dataset — remove a staged dataset and free its storage.\n */\nimport { defineAction } from \"../../action.js\";\nimport { getCredentialContext } from \"../../server/request-context.js\";\nimport { deleteStagedDataset } from \"../staged-datasets-store.js\";\n\nexport default defineAction({\n  description:\n    \"Delete a staged dataset by id, freeing its scratch storage. \" +\n    \"Use after analysis is complete or before re-staging a large dataset under the same name. \" +\n    \"Only the owner who staged the dataset can delete it.\",\n  schema: z.object({\n    datasetId: z\n      .string()\n      .min(1)\n      .describe(\n        \"Dataset id to delete (from list-staged-datasets or provider-api-request stageAs result).\",\n      ),\n    appId: z.string().min(1).describe(\"App id that owns the dataset.\"),\n  }),\n  http: false,\n  run: async (args) => {\n    const ctx = getCredentialContext();\n    if (!ctx)\n      throw new Error(\"No authenticated context for delete-staged-dataset.\");\n\n    const deleted = await deleteStagedDataset({\n      id: args.datasetId,\n      appId: args.appId,\n      ownerEmail: ctx.userEmail,\n    });\n\n    if (!deleted) {\n      throw new Error(\n        `Dataset ${args.datasetId} not found (or belongs to a different owner/app).`,\n      );\n    }\n\n    return { deleted: true, datasetId: args.datasetId };\n  },\n});\n"]}
+{"version":3,"file":"delete-staged-dataset.js","sourceRoot":"","sources":["../../../src/provider-api/actions/delete-staged-dataset.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,sBAAsB,CAAC;AAEvE,OAAO,EAAE,+BAA+B,EAAE,MAAM,sBAAsB,CAAC;AAEvE,eAAe,+BAA+B,EAAE,CAAC","sourcesContent":["import { createDeleteStagedDatasetAction } from \"./staged-datasets.js\";\n\nexport { createDeleteStagedDatasetAction } from \"./staged-datasets.js\";\n\nexport default createDeleteStagedDatasetAction();\n"]}

package/dist/provider-api/actions/list-staged-datasets.d.ts

@@ -1,6 +1,5 @@
-declare const _default: import("../../action.js").ActionDefinition<{
-    appId: string;
-}, {
+export { createListStagedDatasetsAction } from "./staged-datasets.js";
+declare const _default: import("../../action.js").ActionDefinition<Record<string, never>, {
     datasets: {
         id: string;
         name: string;

package/dist/provider-api/actions/list-staged-datasets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list-staged-datasets.d.ts","sourceRoot":"","sources":["../../../src/provider-api/actions/list-staged-datasets.ts"],"names":[],"mappings":""}
+{"version":3,"file":"list-staged-datasets.d.ts","sourceRoot":"","sources":["../../../src/provider-api/actions/list-staged-datasets.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/provider-api/actions/list-staged-datasets.js

@@ -1,41 +1,4 @@
-import { z } from "zod";
-/**
- * list-staged-datasets — enumerate scratch datasets staged by the current user.
- */
-import { defineAction } from "../../action.js";
-import { getCredentialContext } from "../../server/request-context.js";
-import { listStagedDatasets } from "../staged-datasets-store.js";
-export default defineAction({
-    description: "List staged datasets stored by provider-api-request (stageAs) for the current user and app. " +
-        "Returns dataset ids, names, row counts, columns, and sizes. " +
-        "Use these ids with query-staged-dataset to run aggregations, or with delete-staged-dataset to free space.",
-    schema: z.object({
-        appId: z
-            .string()
-            .min(1)
-            .describe("App id that owns the datasets (must match the staging context)."),
-    }),
-    http: { method: "GET" },
-    readOnly: true,
-    run: async (args) => {
-        const ctx = getCredentialContext();
-        if (!ctx)
-            throw new Error("No authenticated context for list-staged-datasets.");
-        const datasets = await listStagedDatasets({
-            appId: args.appId,
-            ownerEmail: ctx.userEmail,
-        });
-        return {
-            datasets: datasets.map((d) => ({
-                id: d.id,
-                name: d.name,
-                rowCount: d.rowCount,
-                columns: d.columns,
-                byteSize: d.byteSize,
-                updatedAt: new Date(d.updatedAt).toISOString(),
-            })),
-            total: datasets.length,
-        };
-    },
-});
+import { createListStagedDatasetsAction } from "./staged-datasets.js";
+export { createListStagedDatasetsAction } from "./staged-datasets.js";
+export default createListStagedDatasetsAction();
 //# sourceMappingURL=list-staged-datasets.js.map

package/dist/provider-api/actions/list-staged-datasets.js.map

@@ -1 +1 @@
-{"version":3,"file":"list-staged-datasets.js","sourceRoot":"","sources":["../../../src/provider-api/actions/list-staged-datasets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;GAEG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEjE,eAAe,YAAY,CAAC;IAC1B,WAAW,EACT,8FAA8F;QAC9F,8DAA8D;QAC9D,2GAA2G;IAC7G,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,KAAK,EAAE,CAAC;aACL,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,CACP,iEAAiE,CAClE;KACJ,CAAC;IACF,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;IACvB,QAAQ,EAAE,IAAI;IACd,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClB,MAAM,GAAG,GAAG,oBAAoB,EAAE,CAAC;QACnC,IAAI,CAAC,GAAG;YACN,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QAExE,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC;YACxC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU,EAAE,GAAG,CAAC,SAAS;SAC1B,CAAC,CAAC;QAEH,OAAO;YACL,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC7B,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;aAC/C,CAAC,CAAC;YACH,KAAK,EAAE,QAAQ,CAAC,MAAM;SACvB,CAAC;IACJ,CAAC;CACF,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\n\n/**\n * list-staged-datasets — enumerate scratch datasets staged by the current user.\n */\nimport { defineAction } from \"../../action.js\";\nimport { getCredentialContext } from \"../../server/request-context.js\";\nimport { listStagedDatasets } from \"../staged-datasets-store.js\";\n\nexport default defineAction({\n  description:\n    \"List staged datasets stored by provider-api-request (stageAs) for the current user and app. \" +\n    \"Returns dataset ids, names, row counts, columns, and sizes. \" +\n    \"Use these ids with query-staged-dataset to run aggregations, or with delete-staged-dataset to free space.\",\n  schema: z.object({\n    appId: z\n      .string()\n      .min(1)\n      .describe(\n        \"App id that owns the datasets (must match the staging context).\",\n      ),\n  }),\n  http: { method: \"GET\" },\n  readOnly: true,\n  run: async (args) => {\n    const ctx = getCredentialContext();\n    if (!ctx)\n      throw new Error(\"No authenticated context for list-staged-datasets.\");\n\n    const datasets = await listStagedDatasets({\n      appId: args.appId,\n      ownerEmail: ctx.userEmail,\n    });\n\n    return {\n      datasets: datasets.map((d) => ({\n        id: d.id,\n        name: d.name,\n        rowCount: d.rowCount,\n        columns: d.columns,\n        byteSize: d.byteSize,\n        updatedAt: new Date(d.updatedAt).toISOString(),\n      })),\n      total: datasets.length,\n    };\n  },\n});\n"]}
+{"version":3,"file":"list-staged-datasets.js","sourceRoot":"","sources":["../../../src/provider-api/actions/list-staged-datasets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAC;AAEtE,OAAO,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAC;AAEtE,eAAe,8BAA8B,EAAE,CAAC","sourcesContent":["import { createListStagedDatasetsAction } from \"./staged-datasets.js\";\n\nexport { createListStagedDatasetsAction } from \"./staged-datasets.js\";\n\nexport default createListStagedDatasetsAction();\n"]}

package/dist/provider-api/actions/provider-api-audit.d.ts

@@ -0,0 +1,7 @@
+export declare function sanitizeProviderApiAuditPath(path: unknown): string;
+export declare function buildProviderApiAuditSummary(args: {
+    method?: unknown;
+    provider?: unknown;
+    path?: unknown;
+}): string;
+//# sourceMappingURL=provider-api-audit.d.ts.map

package/dist/provider-api/actions/provider-api-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-api-audit.d.ts","sourceRoot":"","sources":["../../../src/provider-api/actions/provider-api-audit.ts"],"names":[],"mappings":"AA8DA,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAclE;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE;IACjD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,GAAG,MAAM,CAKT"}

package/dist/provider-api/actions/provider-api-audit.js

@@ -0,0 +1,74 @@
+const REDACTED = "[redacted]";
+const CREDENTIAL_NAME = /^(?:api[-_]?key|access[-_]?token|auth(?:orization)?|bearer|credential|password|secret|signature|sig|token|x-amz-credential|x-amz-signature)$/i;
+function decodePathSegment(segment) {
+    try {
+        return decodeURIComponent(segment);
+    }
+    catch {
+        return segment;
+    }
+}
+function looksLikeCredentialValue(segment) {
+    const value = decodePathSegment(segment);
+    if (/^eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value)) {
+        return true;
+    }
+    if (/^(?:sk|pk|rk|ghp|github_pat|xox[baprs]|ya29|AIza)[-_][A-Za-z0-9_-]+$/i.test(value)) {
+        return true;
+    }
+    return value.length >= 32 && /^[A-Za-z0-9._~-]+$/.test(value);
+}
+function sanitizePathname(pathname) {
+    let redactNext = false;
+    return pathname
+        .split("/")
+        .map((segment) => {
+        if (!segment)
+            return segment;
+        const decoded = decodePathSegment(segment);
+        if (redactNext) {
+            redactNext = false;
+            return REDACTED;
+        }
+        const assignment = decoded.match(/^([^=:]+)([=:])(.+)$/);
+        if (assignment && CREDENTIAL_NAME.test(assignment[1])) {
+            return `${assignment[1]}${assignment[2]}${REDACTED}`;
+        }
+        if (CREDENTIAL_NAME.test(decoded)) {
+            redactNext = true;
+            return segment;
+        }
+        return looksLikeCredentialValue(segment) ? REDACTED : segment;
+    })
+        .join("/");
+}
+function sanitizeQuery(search) {
+    if (!search)
+        return "";
+    const redacted = Array.from(new URLSearchParams(search).keys(), (key) => {
+        const safeKey = encodeURIComponent(key.slice(0, 100));
+        return `${safeKey}=${REDACTED}`;
+    });
+    return redacted.length > 0 ? `?${redacted.join("&")}` : "";
+}
+export function sanitizeProviderApiAuditPath(path) {
+    const raw = String(path ?? "");
+    const withoutFragment = raw.split("#", 1)[0] ?? "";
+    try {
+        const url = new URL(withoutFragment);
+        return `${url.protocol}//${url.host}${sanitizePathname(url.pathname)}${sanitizeQuery(url.search)}`;
+    }
+    catch {
+        const queryIndex = withoutFragment.indexOf("?");
+        const pathname = queryIndex >= 0 ? withoutFragment.slice(0, queryIndex) : withoutFragment;
+        const search = queryIndex >= 0 ? withoutFragment.slice(queryIndex + 1) : "";
+        return `${sanitizePathname(pathname)}${sanitizeQuery(search)}`;
+    }
+}
+export function buildProviderApiAuditSummary(args) {
+    const method = String(args.method || "GET").toUpperCase();
+    const provider = String(args.provider ?? "");
+    const path = sanitizeProviderApiAuditPath(args.path);
+    return `${method} ${provider} ${path}`.slice(0, 200);
+}
+//# sourceMappingURL=provider-api-audit.js.map

package/dist/provider-api/actions/provider-api-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-api-audit.js","sourceRoot":"","sources":["../../../src/provider-api/actions/provider-api-audit.ts"],"names":[],"mappings":"AAAA,MAAM,QAAQ,GAAG,YAAY,CAAC;AAE9B,MAAM,eAAe,GACnB,+IAA+I,CAAC;AAElJ,SAAS,iBAAiB,CAAC,OAAe;IACxC,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAe;IAC/C,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,qDAAqD,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,uEAAuE,CAAC,IAAI,CAC1E,KAAK,CACN,EACD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,IAAI,EAAE,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,OAAO,QAAQ;SACZ,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QACf,IAAI,CAAC,OAAO;YAAE,OAAO,OAAO,CAAC;QAC7B,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,UAAU,EAAE,CAAC;YACf,UAAU,GAAG,KAAK,CAAC;YACnB,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACzD,IAAI,UAAU,IAAI,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;YACvD,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,QAAQ,EAAE,CAAC;QACvD,CAAC;QACD,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,UAAU,GAAG,IAAI,CAAC;YAClB,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,OAAO,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IAChE,CAAC,CAAC;SACD,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;QACtE,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACtD,OAAO,GAAG,OAAO,IAAI,QAAQ,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,IAAa;IACxD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC/B,MAAM,eAAe,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAEnD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;QACrC,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;IACrG,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChD,MAAM,QAAQ,GACZ,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;QAC3E,MAAM,MAAM,GAAG,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,OAAO,GAAG,gBAAgB,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;IACjE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,IAI5C;IACC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrD,OAAO,GAAG,MAAM,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACvD,CAAC","sourcesContent":["const REDACTED = \"[redacted]\";\n\nconst CREDENTIAL_NAME =\n  /^(?:api[-_]?key|access[-_]?token|auth(?:orization)?|bearer|credential|password|secret|signature|sig|token|x-amz-credential|x-amz-signature)$/i;\n\nfunction decodePathSegment(segment: string): string {\n  try {\n    return decodeURIComponent(segment);\n  } catch {\n    return segment;\n  }\n}\n\nfunction looksLikeCredentialValue(segment: string): boolean {\n  const value = decodePathSegment(segment);\n  if (/^eyJ[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]+$/.test(value)) {\n    return true;\n  }\n  if (\n    /^(?:sk|pk|rk|ghp|github_pat|xox[baprs]|ya29|AIza)[-_][A-Za-z0-9_-]+$/i.test(\n      value,\n    )\n  ) {\n    return true;\n  }\n  return value.length >= 32 && /^[A-Za-z0-9._~-]+$/.test(value);\n}\n\nfunction sanitizePathname(pathname: string): string {\n  let redactNext = false;\n  return pathname\n    .split(\"/\")\n    .map((segment) => {\n      if (!segment) return segment;\n      const decoded = decodePathSegment(segment);\n      if (redactNext) {\n        redactNext = false;\n        return REDACTED;\n      }\n\n      const assignment = decoded.match(/^([^=:]+)([=:])(.+)$/);\n      if (assignment && CREDENTIAL_NAME.test(assignment[1]!)) {\n        return `${assignment[1]}${assignment[2]}${REDACTED}`;\n      }\n      if (CREDENTIAL_NAME.test(decoded)) {\n        redactNext = true;\n        return segment;\n      }\n      return looksLikeCredentialValue(segment) ? REDACTED : segment;\n    })\n    .join(\"/\");\n}\n\nfunction sanitizeQuery(search: string): string {\n  if (!search) return \"\";\n  const redacted = Array.from(new URLSearchParams(search).keys(), (key) => {\n    const safeKey = encodeURIComponent(key.slice(0, 100));\n    return `${safeKey}=${REDACTED}`;\n  });\n  return redacted.length > 0 ? `?${redacted.join(\"&\")}` : \"\";\n}\n\nexport function sanitizeProviderApiAuditPath(path: unknown): string {\n  const raw = String(path ?? \"\");\n  const withoutFragment = raw.split(\"#\", 1)[0] ?? \"\";\n\n  try {\n    const url = new URL(withoutFragment);\n    return `${url.protocol}//${url.host}${sanitizePathname(url.pathname)}${sanitizeQuery(url.search)}`;\n  } catch {\n    const queryIndex = withoutFragment.indexOf(\"?\");\n    const pathname =\n      queryIndex >= 0 ? withoutFragment.slice(0, queryIndex) : withoutFragment;\n    const search = queryIndex >= 0 ? withoutFragment.slice(queryIndex + 1) : \"\";\n    return `${sanitizePathname(pathname)}${sanitizeQuery(search)}`;\n  }\n}\n\nexport function buildProviderApiAuditSummary(args: {\n  method?: unknown;\n  provider?: unknown;\n  path?: unknown;\n}): string {\n  const method = String(args.method || \"GET\").toUpperCase();\n  const provider = String(args.provider ?? \"\");\n  const path = sanitizeProviderApiAuditPath(args.path);\n  return `${method} ${provider} ${path}`.slice(0, 200);\n}\n"]}