@agent-native/core 0.16.1 → 0.16.3

package/dist/connections/reader.js

@@ -0,0 +1,461 @@
+import { getWorkspaceConnectionProvider, } from "./catalog.js";
+import { resolveWorkspaceConnectionCredentialsForApp, } from "../workspace-connections/index.js";
+import { resolveWorkspaceConnectionForApp, } from "../workspace-connections/store.js";
+export class ProviderReaderRuntimeError extends Error {
+    code;
+    providerId;
+    operation;
+    constructor(code, message, options) {
+        super(message);
+        this.name = "ProviderReaderRuntimeError";
+        this.code = code;
+        this.providerId = options.providerId;
+        this.operation = options.operation;
+    }
+}
+export function defineProviderReader(reader) {
+    return reader;
+}
+export function defineProviderReaderImplementation(implementation) {
+    return implementation;
+}
+const searchParameters = [
+    {
+        name: "query",
+        type: "string",
+        required: true,
+        description: "Provider-native search text.",
+    },
+    {
+        name: "limit",
+        type: "number",
+        description: "Maximum normalized results to return.",
+    },
+];
+const getParameters = [
+    {
+        name: "id",
+        type: "string",
+        required: true,
+        description: "Provider-native object identifier.",
+    },
+];
+const listRecentParameters = [
+    {
+        name: "limit",
+        type: "number",
+        description: "Maximum recent objects to return.",
+    },
+];
+function operation(operationName, label, description, implementationStatus, parameters) {
+    return {
+        operation: operationName,
+        label,
+        description,
+        implementationStatus,
+        parameters,
+    };
+}
+function providerCredentialKeys(providerId) {
+    return getWorkspaceConnectionProvider(providerId)?.credentialKeys ?? [];
+}
+function requiredCredentialKeys(providerId) {
+    return providerCredentialKeys(providerId)
+        .filter((credential) => credential.required !== false)
+        .map((credential) => credential.key);
+}
+export const PROVIDER_READERS = [
+    defineProviderReader({
+        providerId: "slack",
+        label: "Slack reader",
+        description: "Normalized metadata for reading Slack messages and channel history through template-owned Slack implementations.",
+        implementationStatus: "template-owned",
+        credentialKeys: providerCredentialKeys("slack"),
+        requiredCredentialKeys: requiredCredentialKeys("slack"),
+        capabilities: [
+            {
+                capability: "search",
+                label: "Message search",
+                description: "Search conversation history using Slack's message search semantics.",
+            },
+            {
+                capability: "messages",
+                label: "Message retrieval",
+                description: "Read individual messages or recent channel activity when a template owns the Slack client.",
+            },
+        ],
+        operations: [
+            operation("search", "Search Slack messages", "Find Slack messages matching text and optional channel filters.", "template-owned", [
+                ...searchParameters,
+                {
+                    name: "channelId",
+                    type: "string",
+                    description: "Optional Slack channel id to narrow the search.",
+                },
+            ]),
+            operation("get", "Get Slack message", "Load one Slack message by channel and timestamp/id.", "template-owned", [
+                ...getParameters,
+                {
+                    name: "channelId",
+                    type: "string",
+                    required: true,
+                    description: "Slack channel id containing the message.",
+                },
+            ]),
+            operation("listRecent", "List recent Slack messages", "List recent messages from channels visible to the connected Slack app.", "template-owned", listRecentParameters),
+        ],
+        notes: "Core only exposes the contract; templates still own Slack API calls and provider-specific pagination.",
+    }),
+    defineProviderReader({
+        providerId: "github",
+        label: "GitHub reader",
+        description: "Normalized metadata for reading repositories, issues, pull requests, and code search results.",
+        implementationStatus: "template-owned",
+        credentialKeys: providerCredentialKeys("github"),
+        requiredCredentialKeys: requiredCredentialKeys("github"),
+        capabilities: [
+            {
+                capability: "search",
+                label: "Repository search",
+                description: "Search GitHub issues, pull requests, repositories, code, or docs using template-owned clients.",
+            },
+            {
+                capability: "code",
+                label: "Code context",
+                description: "Read code-oriented objects such as repositories, files, issues, and pull requests.",
+            },
+        ],
+        operations: [
+            operation("search", "Search GitHub", "Find repositories, issues, pull requests, code, or documentation matching a query.", "template-owned", [
+                ...searchParameters,
+                {
+                    name: "owner",
+                    type: "string",
+                    description: "Optional repository owner or organization filter.",
+                },
+                {
+                    name: "repo",
+                    type: "string",
+                    description: "Optional repository filter.",
+                },
+            ]),
+            operation("get", "Get GitHub object", "Load one repository, issue, pull request, or file by provider-native id or URL.", "template-owned", getParameters),
+            operation("listRecent", "List recent GitHub activity", "List recent issues, pull requests, or repository activity visible to the connection.", "template-owned", listRecentParameters),
+        ],
+        notes: "No shared Octokit client is exported from core in this spike; templates remain responsible for API calls.",
+    }),
+    defineProviderReader({
+        providerId: "notion",
+        label: "Notion reader",
+        description: "Normalized metadata for reading Notion pages, databases, and workspace docs.",
+        implementationStatus: "template-owned",
+        credentialKeys: providerCredentialKeys("notion"),
+        requiredCredentialKeys: requiredCredentialKeys("notion"),
+        capabilities: [
+            {
+                capability: "search",
+                label: "Page search",
+                description: "Search pages and databases shared with the Notion integration.",
+            },
+            {
+                capability: "docs",
+                label: "Document retrieval",
+                description: "Read Notion page or database metadata through template-owned clients.",
+            },
+        ],
+        operations: [
+            operation("search", "Search Notion", "Find Notion pages or databases matching text and optional object type filters.", "template-owned", searchParameters),
+            operation("get", "Get Notion object", "Load one Notion page or database by id.", "template-owned", getParameters),
+            operation("listRecent", "List recent Notion objects", "List recently edited pages or databases visible to the integration.", "template-owned", listRecentParameters),
+        ],
+        notes: "Core does not traverse Notion blocks yet; templates own page hydration and rate-limit behavior.",
+    }),
+    defineProviderReader({
+        providerId: "hubspot",
+        label: "HubSpot reader",
+        description: "Normalized metadata for CRM object lookup through template-owned HubSpot integrations.",
+        implementationStatus: "template-owned",
+        credentialKeys: providerCredentialKeys("hubspot"),
+        requiredCredentialKeys: requiredCredentialKeys("hubspot"),
+        capabilities: [
+            {
+                capability: "search",
+                label: "CRM search",
+                description: "Search CRM contacts, companies, deals, tickets, and engagements.",
+            },
+            {
+                capability: "crm",
+                label: "CRM retrieval",
+                description: "Read CRM objects when a template owns HubSpot object mapping.",
+            },
+        ],
+        operations: [
+            operation("search", "Search HubSpot CRM", "Find CRM records matching text or provider-native filters.", "template-owned", [
+                ...searchParameters,
+                {
+                    name: "objectType",
+                    type: "string",
+                    description: "Optional HubSpot object type such as contact, company, deal, or ticket.",
+                },
+            ]),
+            operation("get", "Get HubSpot CRM object", "Load one CRM record by object type and id.", "template-owned", [
+                ...getParameters,
+                {
+                    name: "objectType",
+                    type: "string",
+                    required: true,
+                    description: "HubSpot object type such as contact, company, deal, or ticket.",
+                },
+            ]),
+            operation("listRecent", "List recent HubSpot CRM objects", "List recently updated CRM records visible to the private app token.", "template-owned", listRecentParameters),
+        ],
+        notes: "Templates define object allow-lists and property projections; core only documents the reader shape.",
+    }),
+    defineProviderReader({
+        providerId: "gmail",
+        label: "Gmail reader",
+        description: "Normalized metadata for mailbox search and thread/message reads through app-owned Google OAuth flows.",
+        implementationStatus: "template-owned",
+        credentialKeys: providerCredentialKeys("gmail"),
+        requiredCredentialKeys: requiredCredentialKeys("gmail"),
+        capabilities: [
+            {
+                capability: "search",
+                label: "Mailbox search",
+                description: "Search Gmail messages and threads.",
+            },
+            {
+                capability: "messages",
+                label: "Mail retrieval",
+                description: "Read Gmail messages and threads when a template owns OAuth token handling.",
+            },
+        ],
+        operations: [
+            operation("search", "Search Gmail", "Find Gmail messages or threads matching a query.", "template-owned", searchParameters),
+            operation("get", "Get Gmail message or thread", "Load one Gmail message or thread by provider-native id.", "template-owned", getParameters),
+            operation("listRecent", "List recent Gmail messages", "List recent mailbox messages visible to the connected Google account.", "template-owned", listRecentParameters),
+        ],
+        notes: "This is metadata for templates with Google OAuth; core does not expose a shared Gmail network client here.",
+    }),
+    defineProviderReader({
+        providerId: "google_drive",
+        label: "Google Drive reader",
+        description: "Normalized metadata for Drive file search and document lookup through app-owned Google OAuth flows.",
+        implementationStatus: "template-owned",
+        credentialKeys: providerCredentialKeys("google_drive"),
+        requiredCredentialKeys: requiredCredentialKeys("google_drive"),
+        capabilities: [
+            {
+                capability: "search",
+                label: "Drive search",
+                description: "Search files visible to the connected Google account.",
+            },
+            {
+                capability: "docs",
+                label: "Drive document retrieval",
+                description: "Read file metadata or exported document content through template-owned Google clients.",
+            },
+        ],
+        operations: [
+            operation("search", "Search Google Drive", "Find Drive files matching text, MIME type, or folder filters.", "template-owned", [
+                ...searchParameters,
+                {
+                    name: "mimeType",
+                    type: "string",
+                    description: "Optional MIME type filter.",
+                },
+            ]),
+            operation("get", "Get Google Drive file", "Load one Drive file by id.", "template-owned", getParameters),
+            operation("listRecent", "List recent Google Drive files", "List recently modified files visible to the connected Google account.", "template-owned", listRecentParameters),
+        ],
+        notes: "Templates still own file export formats, Docs/Sheets/Slides handling, and OAuth token refresh.",
+    }),
+    defineProviderReader({
+        providerId: "generic",
+        label: "Generic metadata reader",
+        description: "Placeholder reader metadata for custom sources that expose searchable documents through a template-specific adapter.",
+        implementationStatus: "metadata-only",
+        credentialKeys: providerCredentialKeys("generic"),
+        requiredCredentialKeys: requiredCredentialKeys("generic"),
+        capabilities: [
+            {
+                capability: "search",
+                label: "Custom search",
+                description: "Describe a template-specific search interface for one-off sources.",
+            },
+            {
+                capability: "docs",
+                label: "Custom document retrieval",
+                description: "Describe a template-specific document retrieval interface.",
+            },
+        ],
+        operations: [
+            operation("search", "Search custom source", "Metadata-only descriptor for searching a custom source.", "metadata-only", searchParameters),
+            operation("get", "Get custom source object", "Metadata-only descriptor for loading one custom source object by id.", "metadata-only", getParameters),
+        ],
+        notes: "Use this only to document a template-owned adapter; core cannot execute generic provider reads.",
+    }),
+];
+const READERS_BY_PROVIDER_ID = new Map(PROVIDER_READERS.map((reader) => [reader.providerId, reader]));
+export function listProviderReaders(options = {}) {
+    return PROVIDER_READERS.filter((reader) => {
+        if (options.providerId && reader.providerId !== options.providerId) {
+            return false;
+        }
+        if (options.capability &&
+            !reader.capabilities.some((capability) => capability.capability === options.capability)) {
+            return false;
+        }
+        if (options.operation &&
+            !reader.operations.some((operation) => operation.operation === options.operation)) {
+            return false;
+        }
+        if (options.implementationStatus &&
+            reader.implementationStatus !== options.implementationStatus) {
+            return false;
+        }
+        return true;
+    }).map(cloneProviderReader);
+}
+export function getProviderReader(providerId) {
+    const reader = READERS_BY_PROVIDER_ID.get(providerId);
+    return reader ? cloneProviderReader(reader) : undefined;
+}
+export function providerReaderSupports(providerOrReader, operationName) {
+    const reader = typeof providerOrReader === "string"
+        ? getProviderReader(providerOrReader)
+        : providerOrReader;
+    return (reader?.operations.some((operation) => operation.operation === operationName) ?? false);
+}
+export function createProviderReaderRuntime(options) {
+    const appId = options.appId.trim();
+    if (!appId) {
+        throw new Error("createProviderReaderRuntime appId is required.");
+    }
+    const implementations = new Map();
+    for (const implementation of options.readers) {
+        implementations.set(implementation.providerId, implementation);
+    }
+    const connectionResolver = options.resolveConnection ??
+        ((resolverOptions) => resolveWorkspaceConnectionForApp({
+            appId: resolverOptions.appId,
+            provider: resolverOptions.providerId,
+            connectionId: resolverOptions.connectionId,
+            includeDisabled: false,
+            requireConnected: true,
+        }));
+    const credentialsResolver = options.resolveCredentials ??
+        ((resolverOptions) => resolveWorkspaceConnectionCredentialsForApp({
+            appId: resolverOptions.appId,
+            provider: resolverOptions.providerId,
+            connectionId: resolverOptions.connectionId,
+            keys: resolverOptions.keys,
+            userEmail: resolverOptions.userEmail,
+            orgId: resolverOptions.orgId,
+        }));
+    return {
+        async read(request) {
+            const reader = getProviderReader(request.providerId);
+            if (!reader) {
+                throw new ProviderReaderRuntimeError("unsupported_provider", `No provider reader metadata is registered for ${request.providerId}.`, { providerId: request.providerId, operation: request.operation });
+            }
+            const operation = reader.operations.find((entry) => entry.operation === request.operation);
+            if (!operation) {
+                throw new ProviderReaderRuntimeError("unsupported_operation", `${reader.label} does not support ${request.operation}.`, { providerId: request.providerId, operation: request.operation });
+            }
+            const implementation = implementations.get(request.providerId);
+            if (!implementation) {
+                throw new ProviderReaderRuntimeError("unsupported_provider", `${reader.label} has no runtime implementation registered.`, { providerId: request.providerId, operation: request.operation });
+            }
+            const handler = implementation.operations[request.operation];
+            if (!handler) {
+                throw new ProviderReaderRuntimeError("unsupported_operation", `${reader.label} has no runtime handler for ${request.operation}.`, { providerId: request.providerId, operation: request.operation });
+            }
+            const resolvedConnection = await connectionResolver({
+                appId,
+                providerId: request.providerId,
+                connectionId: request.connectionId?.trim() || undefined,
+            });
+            if (!resolvedConnection.available || !resolvedConnection.connection) {
+                throw new ProviderReaderRuntimeError("connection_not_available", resolvedConnection.reason, { providerId: request.providerId, operation: request.operation });
+            }
+            const connection = publicRuntimeConnection(resolvedConnection.connection);
+            const context = {
+                appId,
+                providerId: request.providerId,
+                reader,
+                connection,
+                resolveCredentials: (keys = reader.requiredCredentialKeys) => credentialsResolver({
+                    appId,
+                    providerId: request.providerId,
+                    connectionId: connection.id,
+                    keys: [...keys],
+                    userEmail: request.userEmail,
+                    orgId: request.orgId,
+                }),
+                requireCredentials: async (keys = reader.requiredCredentialKeys) => {
+                    const resolution = await credentialsResolver({
+                        appId,
+                        providerId: request.providerId,
+                        connectionId: connection.id,
+                        keys: [...keys],
+                        userEmail: request.userEmail,
+                        orgId: request.orgId,
+                    });
+                    if (!resolution.available) {
+                        throw new ProviderReaderRuntimeError("credentials_unavailable", `Missing workspace connection credentials for ${reader.label}: ${resolution.missingKeys.join(", ")}.`, {
+                            providerId: request.providerId,
+                            operation: request.operation,
+                        });
+                    }
+                    return { values: resolution.values, resolution };
+                },
+            };
+            return handler((request.params ?? {}), context);
+        },
+    };
+}
+function cloneProviderReader(reader) {
+    return {
+        ...reader,
+        credentialKeys: reader.credentialKeys.map((credential) => ({
+            ...credential,
+        })),
+        requiredCredentialKeys: [...reader.requiredCredentialKeys],
+        capabilities: reader.capabilities.map((capability) => ({
+            ...capability,
+        })),
+        operations: reader.operations.map((operation) => ({
+            ...operation,
+            parameters: operation.parameters.map((parameter) => ({
+                ...parameter,
+            })),
+        })),
+    };
+}
+function publicRuntimeConnection(connection) {
+    return {
+        id: connection.id,
+        provider: connection.provider,
+        label: connection.label,
+        accountId: connection.accountId,
+        accountLabel: connection.accountLabel,
+        credentialRefs: publicCredentialRefs(connection),
+    };
+}
+function publicCredentialRefs(connection) {
+    return [
+        ...(connection.explicitGrant?.credentialRefs ?? []).map((ref) => publicCredentialRef(ref, "grant")),
+        ...connection.credentialRefs.map((ref) => publicCredentialRef(ref, "connection")),
+    ];
+}
+function publicCredentialRef(ref, source) {
+    return {
+        key: ref.key,
+        scope: ref.scope,
+        provider: ref.provider,
+        label: ref.label,
+        source,
+    };
+}
+//# sourceMappingURL=reader.js.map

package/dist/connections/reader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reader.js","sourceRoot":"","sources":["../../src/connections/reader.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,GAI/B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,2CAA2C,GAM5C,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,gCAAgC,GAGjC,MAAM,mCAAmC,CAAC;AA+J3C,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAC1C,IAAI,CAAiC;IACrC,UAAU,CAAS;IACnB,SAAS,CAA2B;IAE7C,YACE,IAAoC,EACpC,OAAe,EACf,OAGC;QAED,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;QACzC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACrC,CAAC;CACF;AAED,MAAM,UAAU,oBAAoB,CAClC,MAAS;IAET,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,kCAAkC,CAEhD,cAAiB;IACjB,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,MAAM,gBAAgB,GAAG;IACvB;QACE,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,8BAA8B;KAC5C;IACD;QACE,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,uCAAuC;KACrD;CAC6D,CAAC;AAEjE,MAAM,aAAa,GAAG;IACpB;QACE,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,oCAAoC;KAClD;CAC6D,CAAC;AAEjE,MAAM,oBAAoB,GAAG;IAC3B;QACE,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,mCAAmC;KACjD;CAC6D,CAAC;AAEjE,SAAS,SAAS,CAChB,aAAsC,EACtC,KAAa,EACb,WAAmB,EACnB,oBAAwD,EACxD,UAAuD;IAEvD,OAAO;QACL,SAAS,EAAE,aAAa;QACxB,KAAK;QACL,WAAW;QACX,oBAAoB;QACpB,UAAU;KACX,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,UAAyC;IAEzC,OAAO,8BAA8B,CAAC,UAAU,CAAC,EAAE,cAAc,IAAI,EAAE,CAAC;AAC1E,CAAC;AAED,SAAS,sBAAsB,CAC7B,UAAyC;IAEzC,OAAO,sBAAsB,CAAC,UAAU,CAAC;SACtC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,KAAK,CAAC;SACrD,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,oBAAoB,CAAC;QACnB,UAAU,EAAE,OAAO;QACnB,KAAK,EAAE,cAAc;QACrB,WAAW,EACT,kHAAkH;QACpH,oBAAoB,EAAE,gBAAgB;QACtC,cAAc,EAAE,sBAAsB,CAAC,OAAO,CAAC;QAC/C,sBAAsB,EAAE,sBAAsB,CAAC,OAAO,CAAC;QACvD,YAAY,EAAE;YACZ;gBACE,UAAU,EAAE,QAAQ;gBACpB,KAAK,EAAE,gBAAgB;gBACvB,WAAW,EACT,qEAAqE;aACxE;YACD;gBACE,UAAU,EAAE,UAAU;gBACtB,KAAK,EAAE,mBAAmB;gBAC1B,WAAW,EACT,4FAA4F;aAC/F;SACF;QACD,UAAU,EAAE;YACV,SAAS,CACP,QAAQ,EACR,uBAAuB,EACvB,iEAAiE,EACjE,gBAAgB,EAChB;gBACE,GAAG,gBAAgB;gBACnB;oBACE,IAAI,EAAE,WAAW;oBACjB,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,iDAAiD;iBAC/D;aACF,CACF;YACD,SAAS,CACP,KAAK,EACL,mBAAmB,EACnB,qDAAqD,EACrD,gBAAgB,EAChB;gBACE,GAAG,aAAa;gBAChB;oBACE,IAAI,EAAE,WAAW;oBACjB,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,IAAI;oBACd,WAAW,EAAE,0CAA0C;iBACxD;aACF,CACF;YACD,SAAS,CACP,YAAY,EACZ,4BAA4B,EAC5B,wEAAwE,EACxE,gBAAgB,EAChB,oBAAoB,CACrB;SACF;QACD,KAAK,EACH,uGAAuG;KAC1G,CAAC;IACF,oBAAoB,CAAC;QACnB,UAAU,EAAE,QAAQ;QACpB,KAAK,EAAE,eAAe;QACtB,WAAW,EACT,+FAA+F;QACjG,oBAAoB,EAAE,gBAAgB;QACtC,cAAc,EAAE,sBAAsB,CAAC,QAAQ,CAAC;QAChD,sBAAsB,EAAE,sBAAsB,CAAC,QAAQ,CAAC;QACxD,YAAY,EAAE;YACZ;gBACE,UAAU,EAAE,QAAQ;gBACpB,KAAK,EAAE,mBAAmB;gBAC1B,WAAW,EACT,gGAAgG;aACnG;YACD;gBACE,UAAU,EAAE,MAAM;gBAClB,KAAK,EAAE,cAAc;gBACrB,WAAW,EACT,oFAAoF;aACvF;SACF;QACD,UAAU,EAAE;YACV,SAAS,CACP,QAAQ,EACR,eAAe,EACf,oFAAoF,EACpF,gBAAgB,EAChB;gBACE,GAAG,gBAAgB;gBACnB;oBACE,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,mDAAmD;iBACjE;gBACD;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,6BAA6B;iBAC3C;aACF,CACF;YACD,SAAS,CACP,KAAK,EACL,mBAAmB,EACnB,iFAAiF,EACjF,gBAAgB,EAChB,aAAa,CACd;YACD,SAAS,CACP,YAAY,EACZ,6BAA6B,EAC7B,sFAAsF,EACtF,gBAAgB,EAChB,oBAAoB,CACrB;SACF;QACD,KAAK,EACH,2GAA2G;KAC9G,CAAC;IACF,oBAAoB,CAAC;QACnB,UAAU,EAAE,QAAQ;QACpB,KAAK,EAAE,eAAe;QACtB,WAAW,EACT,8EAA8E;QAChF,oBAAoB,EAAE,gBAAgB;QACtC,cAAc,EAAE,sBAAsB,CAAC,QAAQ,CAAC;QAChD,sBAAsB,EAAE,sBAAsB,CAAC,QAAQ,CAAC;QACxD,YAAY,EAAE;YACZ;gBACE,UAAU,EAAE,QAAQ;gBACpB,KAAK,EAAE,aAAa;gBACpB,WAAW,EACT,gEAAgE;aACnE;YACD;gBACE,UAAU,EAAE,MAAM;gBAClB,KAAK,EAAE,oBAAoB;gBAC3B,WAAW,EACT,uEAAuE;aAC1E;SACF;QACD,UAAU,EAAE;YACV,SAAS,CACP,QAAQ,EACR,eAAe,EACf,gFAAgF,EAChF,gBAAgB,EAChB,gBAAgB,CACjB;YACD,SAAS,CACP,KAAK,EACL,mBAAmB,EACnB,yCAAyC,EACzC,gBAAgB,EAChB,aAAa,CACd;YACD,SAAS,CACP,YAAY,EACZ,4BAA4B,EAC5B,qEAAqE,EACrE,gBAAgB,EAChB,oBAAoB,CACrB;SACF;QACD,KAAK,EACH,iGAAiG;KACpG,CAAC;IACF,oBAAoB,CAAC;QACnB,UAAU,EAAE,SAAS;QACrB,KAAK,EAAE,gBAAgB;QACvB,WAAW,EACT,wFAAwF;QAC1F,oBAAoB,EAAE,gBAAgB;QACtC,cAAc,EAAE,sBAAsB,CAAC,SAAS,CAAC;QACjD,sBAAsB,EAAE,sBAAsB,CAAC,SAAS,CAAC;QACzD,YAAY,EAAE;YACZ;gBACE,UAAU,EAAE,QAAQ;gBACpB,KAAK,EAAE,YAAY;gBACnB,WAAW,EACT,kEAAkE;aACrE;YACD;gBACE,UAAU,EAAE,KAAK;gBACjB,KAAK,EAAE,eAAe;gBACtB,WAAW,EACT,+DAA+D;aAClE;SACF;QACD,UAAU,EAAE;YACV,SAAS,CACP,QAAQ,EACR,oBAAoB,EACpB,4DAA4D,EAC5D,gBAAgB,EAChB;gBACE,GAAG,gBAAgB;gBACnB;oBACE,IAAI,EAAE,YAAY;oBAClB,IAAI,EAAE,QAAQ;oBACd,WAAW,EACT,yEAAyE;iBAC5E;aACF,CACF;YACD,SAAS,CACP,KAAK,EACL,wBAAwB,EACxB,4CAA4C,EAC5C,gBAAgB,EAChB;gBACE,GAAG,aAAa;gBAChB;oBACE,IAAI,EAAE,YAAY;oBAClB,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,IAAI;oBACd,WAAW,EACT,gEAAgE;iBACnE;aACF,CACF;YACD,SAAS,CACP,YAAY,EACZ,iCAAiC,EACjC,qEAAqE,EACrE,gBAAgB,EAChB,oBAAoB,CACrB;SACF;QACD,KAAK,EACH,qGAAqG;KACxG,CAAC;IACF,oBAAoB,CAAC;QACnB,UAAU,EAAE,OAAO;QACnB,KAAK,EAAE,cAAc;QACrB,WAAW,EACT,uGAAuG;QACzG,oBAAoB,EAAE,gBAAgB;QACtC,cAAc,EAAE,sBAAsB,CAAC,OAAO,CAAC;QAC/C,sBAAsB,EAAE,sBAAsB,CAAC,OAAO,CAAC;QACvD,YAAY,EAAE;YACZ;gBACE,UAAU,EAAE,QAAQ;gBACpB,KAAK,EAAE,gBAAgB;gBACvB,WAAW,EAAE,oCAAoC;aAClD;YACD;gBACE,UAAU,EAAE,UAAU;gBACtB,KAAK,EAAE,gBAAgB;gBACvB,WAAW,EACT,4EAA4E;aAC/E;SACF;QACD,UAAU,EAAE;YACV,SAAS,CACP,QAAQ,EACR,cAAc,EACd,kDAAkD,EAClD,gBAAgB,EAChB,gBAAgB,CACjB;YACD,SAAS,CACP,KAAK,EACL,6BAA6B,EAC7B,yDAAyD,EACzD,gBAAgB,EAChB,aAAa,CACd;YACD,SAAS,CACP,YAAY,EACZ,4BAA4B,EAC5B,uEAAuE,EACvE,gBAAgB,EAChB,oBAAoB,CACrB;SACF;QACD,KAAK,EACH,4GAA4G;KAC/G,CAAC;IACF,oBAAoB,CAAC;QACnB,UAAU,EAAE,cAAc;QAC1B,KAAK,EAAE,qBAAqB;QAC5B,WAAW,EACT,qGAAqG;QACvG,oBAAoB,EAAE,gBAAgB;QACtC,cAAc,EAAE,sBAAsB,CAAC,cAAc,CAAC;QACtD,sBAAsB,EAAE,sBAAsB,CAAC,cAAc,CAAC;QAC9D,YAAY,EAAE;YACZ;gBACE,UAAU,EAAE,QAAQ;gBACpB,KAAK,EAAE,cAAc;gBACrB,WAAW,EAAE,uDAAuD;aACrE;YACD;gBACE,UAAU,EAAE,MAAM;gBAClB,KAAK,EAAE,0BAA0B;gBACjC,WAAW,EACT,wFAAwF;aAC3F;SACF;QACD,UAAU,EAAE;YACV,SAAS,CACP,QAAQ,EACR,qBAAqB,EACrB,+DAA+D,EAC/D,gBAAgB,EAChB;gBACE,GAAG,gBAAgB;gBACnB;oBACE,IAAI,EAAE,UAAU;oBAChB,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,4BAA4B;iBAC1C;aACF,CACF;YACD,SAAS,CACP,KAAK,EACL,uBAAuB,EACvB,4BAA4B,EAC5B,gBAAgB,EAChB,aAAa,CACd;YACD,SAAS,CACP,YAAY,EACZ,gCAAgC,EAChC,uEAAuE,EACvE,gBAAgB,EAChB,oBAAoB,CACrB;SACF;QACD,KAAK,EACH,gGAAgG;KACnG,CAAC;IACF,oBAAoB,CAAC;QACnB,UAAU,EAAE,SAAS;QACrB,KAAK,EAAE,yBAAyB;QAChC,WAAW,EACT,sHAAsH;QACxH,oBAAoB,EAAE,eAAe;QACrC,cAAc,EAAE,sBAAsB,CAAC,SAAS,CAAC;QACjD,sBAAsB,EAAE,sBAAsB,CAAC,SAAS,CAAC;QACzD,YAAY,EAAE;YACZ;gBACE,UAAU,EAAE,QAAQ;gBACpB,KAAK,EAAE,eAAe;gBACtB,WAAW,EACT,oEAAoE;aACvE;YACD;gBACE,UAAU,EAAE,MAAM;gBAClB,KAAK,EAAE,2BAA2B;gBAClC,WAAW,EACT,4DAA4D;aAC/D;SACF;QACD,UAAU,EAAE;YACV,SAAS,CACP,QAAQ,EACR,sBAAsB,EACtB,yDAAyD,EACzD,eAAe,EACf,gBAAgB,CACjB;YACD,SAAS,CACP,KAAK,EACL,0BAA0B,EAC1B,sEAAsE,EACtE,eAAe,EACf,aAAa,CACd;SACF;QACD,KAAK,EACH,iGAAiG;KACpG,CAAC;CACoD,CAAC;AAEzD,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAGpC,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AAEjE,MAAM,UAAU,mBAAmB,CACjC,UAAsC,EAAE;IAExC,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;QACxC,IAAI,OAAO,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;YACnE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IACE,OAAO,CAAC,UAAU;YAClB,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CACvB,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU,CAC7D,EACD,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IACE,OAAO,CAAC,SAAS;YACjB,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CACrB,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,CACzD,EACD,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IACE,OAAO,CAAC,oBAAoB;YAC5B,MAAM,CAAC,oBAAoB,KAAK,OAAO,CAAC,oBAAoB,EAC5D,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,UAAkB;IAElB,MAAM,MAAM,GAAG,sBAAsB,CAAC,GAAG,CACvC,UAA2C,CAC5C,CAAC;IACF,OAAO,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,gBAA0E,EAC1E,aAAsC;IAEtC,MAAM,MAAM,GACV,OAAO,gBAAgB,KAAK,QAAQ;QAClC,CAAC,CAAC,iBAAiB,CAAC,gBAAgB,CAAC;QACrC,CAAC,CAAC,gBAAgB,CAAC;IACvB,OAAO,CACL,MAAM,EAAE,UAAU,CAAC,IAAI,CACrB,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,aAAa,CACrD,IAAI,KAAK,CACX,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,OAAqC;IAErC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,GAAG,EAG5B,CAAC;IACJ,KAAK,MAAM,cAAc,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QAC7C,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,kBAAkB,GACtB,OAAO,CAAC,iBAAiB;QACzB,CAAC,CAAC,eAA+D,EAAE,EAAE,CACnE,gCAAgC,CAAC;YAC/B,KAAK,EAAE,eAAe,CAAC,KAAK;YAC5B,QAAQ,EAAE,eAAe,CAAC,UAAU;YACpC,YAAY,EAAE,eAAe,CAAC,YAAY;YAC1C,eAAe,EAAE,KAAK;YACtB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAC,CAAC;IACR,MAAM,mBAAmB,GACvB,OAAO,CAAC,kBAAkB;QAC1B,CAAC,CAAC,eAAgE,EAAE,EAAE,CACpE,2CAA2C,CAAC;YAC1C,KAAK,EAAE,eAAe,CAAC,KAAK;YAC5B,QAAQ,EAAE,eAAe,CAAC,UAAU;YACpC,YAAY,EAAE,eAAe,CAAC,YAAY;YAC1C,IAAI,EAAE,eAAe,CAAC,IAAI;YAC1B,SAAS,EAAE,eAAe,CAAC,SAAS;YACpC,KAAK,EAAE,eAAe,CAAC,KAAK;SAC7B,CAAC,CAAC,CAAC;IAER,OAAO;QACL,KAAK,CAAC,IAAI,CAGR,OAAuC;YAEvC,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACrD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,0BAA0B,CAClC,sBAAsB,EACtB,iDAAiD,OAAO,CAAC,UAAU,GAAG,EACtE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CACjE,CAAC;YACJ,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CACtC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,CACjD,CAAC;YACF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,0BAA0B,CAClC,uBAAuB,EACvB,GAAG,MAAM,CAAC,KAAK,qBAAqB,OAAO,CAAC,SAAS,GAAG,EACxD,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CACjE,CAAC;YACJ,CAAC;YAED,MAAM,cAAc,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAC/D,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,IAAI,0BAA0B,CAClC,sBAAsB,EACtB,GAAG,MAAM,CAAC,KAAK,4CAA4C,EAC3D,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CACjE,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC7D,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,0BAA0B,CAClC,uBAAuB,EACvB,GAAG,MAAM,CAAC,KAAK,+BAA+B,OAAO,CAAC,SAAS,GAAG,EAClE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CACjE,CAAC;YACJ,CAAC;YAED,MAAM,kBAAkB,GAAG,MAAM,kBAAkB,CAAC;gBAClD,KAAK;gBACL,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,SAAS;aACxD,CAAC,CAAC;YACH,IAAI,CAAC,kBAAkB,CAAC,SAAS,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE,CAAC;gBACpE,MAAM,IAAI,0BAA0B,CAClC,0BAA0B,EAC1B,kBAAkB,CAAC,MAAM,EACzB,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CACjE,CAAC;YACJ,CAAC;YAED,MAAM,UAAU,GAAG,uBAAuB,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;YAC1E,MAAM,OAAO,GAAiC;gBAC5C,KAAK;gBACL,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,MAAM;gBACN,UAAU;gBACV,kBAAkB,EAAE,CAAC,IAAI,GAAG,MAAM,CAAC,sBAAsB,EAAE,EAAE,CAC3D,mBAAmB,CAAC;oBAClB,KAAK;oBACL,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,YAAY,EAAE,UAAU,CAAC,EAAE;oBAC3B,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;oBACf,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;iBACrB,CAAC;gBACJ,kBAAkB,EAAE,KAAK,EAAE,IAAI,GAAG,MAAM,CAAC,sBAAsB,EAAE,EAAE;oBACjE,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC;wBAC3C,KAAK;wBACL,UAAU,EAAE,OAAO,CAAC,UAAU;wBAC9B,YAAY,EAAE,UAAU,CAAC,EAAE;wBAC3B,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;wBACf,SAAS,EAAE,OAAO,CAAC,SAAS;wBAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;qBACrB,CAAC,CAAC;oBACH,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;wBAC1B,MAAM,IAAI,0BAA0B,CAClC,yBAAyB,EACzB,gDAAgD,MAAM,CAAC,KAAK,KAAK,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EACrG;4BACE,UAAU,EAAE,OAAO,CAAC,UAAU;4BAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;yBAC7B,CACF,CAAC;oBACJ,CAAC;oBACD,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC;gBACnD,CAAC;aACF,CAAC;YAEF,OAAO,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAY,EAAE,OAAO,CAAC,CAAC;QAC7D,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAAgC;IAEhC,OAAO;QACL,GAAG,MAAM;QACT,cAAc,EAAE,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YACzD,GAAG,UAAU;SACd,CAAC,CAAC;QACH,sBAAsB,EAAE,CAAC,GAAG,MAAM,CAAC,sBAAsB,CAAC;QAC1D,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YACrD,GAAG,UAAU;SACd,CAAC,CAAC;QACH,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YAChD,GAAG,SAAS;YACZ,UAAU,EAAE,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;gBACnD,GAAG,SAAS;aACb,CAAC,CAAC;SACJ,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,UAAqC;IAErC,OAAO;QACL,EAAE,EAAE,UAAU,CAAC,EAAE;QACjB,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,cAAc,EAAE,oBAAoB,CAAC,UAAU,CAAC;KACjD,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAC3B,UAAqC;IAErC,OAAO;QACL,GAAG,CAAC,UAAU,CAAC,aAAa,EAAE,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAC9D,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,CAClC;QACD,GAAG,UAAU,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CACvC,mBAAmB,CAAC,GAAG,EAAE,YAAY,CAAC,CACvC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,GAAqC,EACrC,MAAwD;IAExD,OAAO;QACL,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,MAAM;KACP,CAAC;AACJ,CAAC","sourcesContent":["import {\n  getWorkspaceConnectionProvider,\n  type WorkspaceConnectionCapability,\n  type WorkspaceConnectionCredentialKey,\n  type WorkspaceConnectionProviderId,\n} from \"./catalog.js\";\nimport {\n  resolveWorkspaceConnectionCredentialsForApp,\n  type ResolveWorkspaceConnectionCredentialsForAppOptions,\n  type WorkspaceConnectionCredentialRef,\n  type WorkspaceConnectionCredentialsResolution,\n  type WorkspaceConnectionForApp,\n  type WorkspaceConnectionPublicCredentialRef,\n} from \"../workspace-connections/index.js\";\nimport {\n  resolveWorkspaceConnectionForApp,\n  type ResolvedWorkspaceConnectionForApp,\n  type ResolveWorkspaceConnectionForAppOptions,\n} from \"../workspace-connections/store.js\";\n\nexport type ProviderReaderOperation = \"search\" | \"get\" | \"listRecent\";\n\nexport type ProviderReaderImplementationStatus =\n  | \"metadata-only\"\n  | \"template-owned\"\n  | \"shared\";\n\nexport interface ProviderReaderCapability {\n  capability: WorkspaceConnectionCapability;\n  label: string;\n  description: string;\n}\n\nexport interface ProviderReaderOperationParameter {\n  name: string;\n  type: \"string\" | \"number\" | \"boolean\" | \"string[]\";\n  required?: boolean;\n  description: string;\n}\n\nexport interface ProviderReaderOperationDescriptor {\n  operation: ProviderReaderOperation;\n  label: string;\n  description: string;\n  implementationStatus: ProviderReaderImplementationStatus;\n  parameters: readonly ProviderReaderOperationParameter[];\n}\n\nexport interface ProviderReaderDefinition {\n  providerId: WorkspaceConnectionProviderId;\n  label: string;\n  description: string;\n  implementationStatus: ProviderReaderImplementationStatus;\n  credentialKeys: readonly WorkspaceConnectionCredentialKey[];\n  requiredCredentialKeys: readonly string[];\n  capabilities: readonly ProviderReaderCapability[];\n  operations: readonly ProviderReaderOperationDescriptor[];\n  notes?: string;\n}\n\nexport interface ListProviderReadersOptions {\n  providerId?: WorkspaceConnectionProviderId;\n  capability?: WorkspaceConnectionCapability;\n  operation?: ProviderReaderOperation;\n  implementationStatus?: ProviderReaderImplementationStatus;\n}\n\nexport type ProviderReaderRuntimeErrorCode =\n  | \"unsupported_provider\"\n  | \"unsupported_operation\"\n  | \"connection_not_available\"\n  | \"credentials_unavailable\";\n\nexport interface ProviderReaderRequest<\n  TParams extends Record<string, unknown> = Record<string, unknown>,\n> {\n  providerId: WorkspaceConnectionProviderId;\n  operation: ProviderReaderOperation;\n  params?: TParams;\n  connectionId?: string | null;\n  userEmail?: string | null;\n  orgId?: string | null;\n}\n\nexport interface ProviderReaderRuntimeItem {\n  id: string;\n  type: string;\n  title?: string;\n  url?: string;\n  text?: string;\n  metadata?: Record<string, unknown>;\n}\n\nexport interface ProviderReaderRuntimeResponse {\n  providerId: WorkspaceConnectionProviderId;\n  operation: ProviderReaderOperation;\n  connectionId: string;\n  items?: ProviderReaderRuntimeItem[];\n  item?: ProviderReaderRuntimeItem | null;\n  metadata?: Record<string, unknown>;\n}\n\nexport interface ProviderReaderRuntimeConnection {\n  id: string;\n  provider: string;\n  label: string;\n  accountId: string | null;\n  accountLabel: string | null;\n  credentialRefs: WorkspaceConnectionPublicCredentialRef[];\n}\n\nexport interface ProviderReaderCredentialRequirement {\n  values: Record<string, string>;\n  resolution: WorkspaceConnectionCredentialsResolution;\n}\n\nexport interface ProviderReaderRuntimeContext {\n  appId: string;\n  providerId: WorkspaceConnectionProviderId;\n  reader: ProviderReaderDefinition;\n  connection: ProviderReaderRuntimeConnection;\n  resolveCredentials(\n    keys?: readonly string[],\n  ): Promise<WorkspaceConnectionCredentialsResolution>;\n  requireCredentials(\n    keys?: readonly string[],\n  ): Promise<ProviderReaderCredentialRequirement>;\n}\n\nexport type ProviderReaderRuntimeHandler<\n  TParams extends Record<string, unknown> = Record<string, unknown>,\n> = (\n  params: TParams,\n  context: ProviderReaderRuntimeContext,\n) => ProviderReaderRuntimeResponse | Promise<ProviderReaderRuntimeResponse>;\n\nexport interface ProviderReaderRuntimeImplementation<\n  TProviderId extends WorkspaceConnectionProviderId =\n    WorkspaceConnectionProviderId,\n> {\n  providerId: TProviderId;\n  operations: Partial<\n    Record<ProviderReaderOperation, ProviderReaderRuntimeHandler>\n  >;\n}\n\nexport interface ProviderReaderRuntimeConnectionResolverOptions extends Pick<\n  ResolveWorkspaceConnectionForAppOptions,\n  \"appId\" | \"connectionId\"\n> {\n  providerId: WorkspaceConnectionProviderId;\n}\n\nexport interface ProviderReaderRuntimeCredentialsResolverOptions extends Pick<\n  ResolveWorkspaceConnectionCredentialsForAppOptions,\n  \"appId\" | \"connectionId\" | \"keys\" | \"userEmail\" | \"orgId\"\n> {\n  providerId: WorkspaceConnectionProviderId;\n}\n\nexport interface ProviderReaderRuntimeOptions {\n  appId: string;\n  readers: readonly ProviderReaderRuntimeImplementation[];\n  resolveConnection?: (\n    options: ProviderReaderRuntimeConnectionResolverOptions,\n  ) => Promise<ResolvedWorkspaceConnectionForApp>;\n  resolveCredentials?: (\n    options: ProviderReaderRuntimeCredentialsResolverOptions,\n  ) => Promise<WorkspaceConnectionCredentialsResolution>;\n}\n\nexport interface ProviderReaderRuntime {\n  read<TParams extends Record<string, unknown> = Record<string, unknown>>(\n    request: ProviderReaderRequest<TParams>,\n  ): Promise<ProviderReaderRuntimeResponse>;\n}\n\nexport class ProviderReaderRuntimeError extends Error {\n  readonly code: ProviderReaderRuntimeErrorCode;\n  readonly providerId: string;\n  readonly operation?: ProviderReaderOperation;\n\n  constructor(\n    code: ProviderReaderRuntimeErrorCode,\n    message: string,\n    options: {\n      providerId: string;\n      operation?: ProviderReaderOperation;\n    },\n  ) {\n    super(message);\n    this.name = \"ProviderReaderRuntimeError\";\n    this.code = code;\n    this.providerId = options.providerId;\n    this.operation = options.operation;\n  }\n}\n\nexport function defineProviderReader<const T extends ProviderReaderDefinition>(\n  reader: T,\n): T {\n  return reader;\n}\n\nexport function defineProviderReaderImplementation<\n  const T extends ProviderReaderRuntimeImplementation,\n>(implementation: T): T {\n  return implementation;\n}\n\nconst searchParameters = [\n  {\n    name: \"query\",\n    type: \"string\",\n    required: true,\n    description: \"Provider-native search text.\",\n  },\n  {\n    name: \"limit\",\n    type: \"number\",\n    description: \"Maximum normalized results to return.\",\n  },\n] as const satisfies readonly ProviderReaderOperationParameter[];\n\nconst getParameters = [\n  {\n    name: \"id\",\n    type: \"string\",\n    required: true,\n    description: \"Provider-native object identifier.\",\n  },\n] as const satisfies readonly ProviderReaderOperationParameter[];\n\nconst listRecentParameters = [\n  {\n    name: \"limit\",\n    type: \"number\",\n    description: \"Maximum recent objects to return.\",\n  },\n] as const satisfies readonly ProviderReaderOperationParameter[];\n\nfunction operation(\n  operationName: ProviderReaderOperation,\n  label: string,\n  description: string,\n  implementationStatus: ProviderReaderImplementationStatus,\n  parameters: readonly ProviderReaderOperationParameter[],\n): ProviderReaderOperationDescriptor {\n  return {\n    operation: operationName,\n    label,\n    description,\n    implementationStatus,\n    parameters,\n  };\n}\n\nfunction providerCredentialKeys(\n  providerId: WorkspaceConnectionProviderId,\n): readonly WorkspaceConnectionCredentialKey[] {\n  return getWorkspaceConnectionProvider(providerId)?.credentialKeys ?? [];\n}\n\nfunction requiredCredentialKeys(\n  providerId: WorkspaceConnectionProviderId,\n): readonly string[] {\n  return providerCredentialKeys(providerId)\n    .filter((credential) => credential.required !== false)\n    .map((credential) => credential.key);\n}\n\nexport const PROVIDER_READERS = [\n  defineProviderReader({\n    providerId: \"slack\",\n    label: \"Slack reader\",\n    description:\n      \"Normalized metadata for reading Slack messages and channel history through template-owned Slack implementations.\",\n    implementationStatus: \"template-owned\",\n    credentialKeys: providerCredentialKeys(\"slack\"),\n    requiredCredentialKeys: requiredCredentialKeys(\"slack\"),\n    capabilities: [\n      {\n        capability: \"search\",\n        label: \"Message search\",\n        description:\n          \"Search conversation history using Slack's message search semantics.\",\n      },\n      {\n        capability: \"messages\",\n        label: \"Message retrieval\",\n        description:\n          \"Read individual messages or recent channel activity when a template owns the Slack client.\",\n      },\n    ],\n    operations: [\n      operation(\n        \"search\",\n        \"Search Slack messages\",\n        \"Find Slack messages matching text and optional channel filters.\",\n        \"template-owned\",\n        [\n          ...searchParameters,\n          {\n            name: \"channelId\",\n            type: \"string\",\n            description: \"Optional Slack channel id to narrow the search.\",\n          },\n        ],\n      ),\n      operation(\n        \"get\",\n        \"Get Slack message\",\n        \"Load one Slack message by channel and timestamp/id.\",\n        \"template-owned\",\n        [\n          ...getParameters,\n          {\n            name: \"channelId\",\n            type: \"string\",\n            required: true,\n            description: \"Slack channel id containing the message.\",\n          },\n        ],\n      ),\n      operation(\n        \"listRecent\",\n        \"List recent Slack messages\",\n        \"List recent messages from channels visible to the connected Slack app.\",\n        \"template-owned\",\n        listRecentParameters,\n      ),\n    ],\n    notes:\n      \"Core only exposes the contract; templates still own Slack API calls and provider-specific pagination.\",\n  }),\n  defineProviderReader({\n    providerId: \"github\",\n    label: \"GitHub reader\",\n    description:\n      \"Normalized metadata for reading repositories, issues, pull requests, and code search results.\",\n    implementationStatus: \"template-owned\",\n    credentialKeys: providerCredentialKeys(\"github\"),\n    requiredCredentialKeys: requiredCredentialKeys(\"github\"),\n    capabilities: [\n      {\n        capability: \"search\",\n        label: \"Repository search\",\n        description:\n          \"Search GitHub issues, pull requests, repositories, code, or docs using template-owned clients.\",\n      },\n      {\n        capability: \"code\",\n        label: \"Code context\",\n        description:\n          \"Read code-oriented objects such as repositories, files, issues, and pull requests.\",\n      },\n    ],\n    operations: [\n      operation(\n        \"search\",\n        \"Search GitHub\",\n        \"Find repositories, issues, pull requests, code, or documentation matching a query.\",\n        \"template-owned\",\n        [\n          ...searchParameters,\n          {\n            name: \"owner\",\n            type: \"string\",\n            description: \"Optional repository owner or organization filter.\",\n          },\n          {\n            name: \"repo\",\n            type: \"string\",\n            description: \"Optional repository filter.\",\n          },\n        ],\n      ),\n      operation(\n        \"get\",\n        \"Get GitHub object\",\n        \"Load one repository, issue, pull request, or file by provider-native id or URL.\",\n        \"template-owned\",\n        getParameters,\n      ),\n      operation(\n        \"listRecent\",\n        \"List recent GitHub activity\",\n        \"List recent issues, pull requests, or repository activity visible to the connection.\",\n        \"template-owned\",\n        listRecentParameters,\n      ),\n    ],\n    notes:\n      \"No shared Octokit client is exported from core in this spike; templates remain responsible for API calls.\",\n  }),\n  defineProviderReader({\n    providerId: \"notion\",\n    label: \"Notion reader\",\n    description:\n      \"Normalized metadata for reading Notion pages, databases, and workspace docs.\",\n    implementationStatus: \"template-owned\",\n    credentialKeys: providerCredentialKeys(\"notion\"),\n    requiredCredentialKeys: requiredCredentialKeys(\"notion\"),\n    capabilities: [\n      {\n        capability: \"search\",\n        label: \"Page search\",\n        description:\n          \"Search pages and databases shared with the Notion integration.\",\n      },\n      {\n        capability: \"docs\",\n        label: \"Document retrieval\",\n        description:\n          \"Read Notion page or database metadata through template-owned clients.\",\n      },\n    ],\n    operations: [\n      operation(\n        \"search\",\n        \"Search Notion\",\n        \"Find Notion pages or databases matching text and optional object type filters.\",\n        \"template-owned\",\n        searchParameters,\n      ),\n      operation(\n        \"get\",\n        \"Get Notion object\",\n        \"Load one Notion page or database by id.\",\n        \"template-owned\",\n        getParameters,\n      ),\n      operation(\n        \"listRecent\",\n        \"List recent Notion objects\",\n        \"List recently edited pages or databases visible to the integration.\",\n        \"template-owned\",\n        listRecentParameters,\n      ),\n    ],\n    notes:\n      \"Core does not traverse Notion blocks yet; templates own page hydration and rate-limit behavior.\",\n  }),\n  defineProviderReader({\n    providerId: \"hubspot\",\n    label: \"HubSpot reader\",\n    description:\n      \"Normalized metadata for CRM object lookup through template-owned HubSpot integrations.\",\n    implementationStatus: \"template-owned\",\n    credentialKeys: providerCredentialKeys(\"hubspot\"),\n    requiredCredentialKeys: requiredCredentialKeys(\"hubspot\"),\n    capabilities: [\n      {\n        capability: \"search\",\n        label: \"CRM search\",\n        description:\n          \"Search CRM contacts, companies, deals, tickets, and engagements.\",\n      },\n      {\n        capability: \"crm\",\n        label: \"CRM retrieval\",\n        description:\n          \"Read CRM objects when a template owns HubSpot object mapping.\",\n      },\n    ],\n    operations: [\n      operation(\n        \"search\",\n        \"Search HubSpot CRM\",\n        \"Find CRM records matching text or provider-native filters.\",\n        \"template-owned\",\n        [\n          ...searchParameters,\n          {\n            name: \"objectType\",\n            type: \"string\",\n            description:\n              \"Optional HubSpot object type such as contact, company, deal, or ticket.\",\n          },\n        ],\n      ),\n      operation(\n        \"get\",\n        \"Get HubSpot CRM object\",\n        \"Load one CRM record by object type and id.\",\n        \"template-owned\",\n        [\n          ...getParameters,\n          {\n            name: \"objectType\",\n            type: \"string\",\n            required: true,\n            description:\n              \"HubSpot object type such as contact, company, deal, or ticket.\",\n          },\n        ],\n      ),\n      operation(\n        \"listRecent\",\n        \"List recent HubSpot CRM objects\",\n        \"List recently updated CRM records visible to the private app token.\",\n        \"template-owned\",\n        listRecentParameters,\n      ),\n    ],\n    notes:\n      \"Templates define object allow-lists and property projections; core only documents the reader shape.\",\n  }),\n  defineProviderReader({\n    providerId: \"gmail\",\n    label: \"Gmail reader\",\n    description:\n      \"Normalized metadata for mailbox search and thread/message reads through app-owned Google OAuth flows.\",\n    implementationStatus: \"template-owned\",\n    credentialKeys: providerCredentialKeys(\"gmail\"),\n    requiredCredentialKeys: requiredCredentialKeys(\"gmail\"),\n    capabilities: [\n      {\n        capability: \"search\",\n        label: \"Mailbox search\",\n        description: \"Search Gmail messages and threads.\",\n      },\n      {\n        capability: \"messages\",\n        label: \"Mail retrieval\",\n        description:\n          \"Read Gmail messages and threads when a template owns OAuth token handling.\",\n      },\n    ],\n    operations: [\n      operation(\n        \"search\",\n        \"Search Gmail\",\n        \"Find Gmail messages or threads matching a query.\",\n        \"template-owned\",\n        searchParameters,\n      ),\n      operation(\n        \"get\",\n        \"Get Gmail message or thread\",\n        \"Load one Gmail message or thread by provider-native id.\",\n        \"template-owned\",\n        getParameters,\n      ),\n      operation(\n        \"listRecent\",\n        \"List recent Gmail messages\",\n        \"List recent mailbox messages visible to the connected Google account.\",\n        \"template-owned\",\n        listRecentParameters,\n      ),\n    ],\n    notes:\n      \"This is metadata for templates with Google OAuth; core does not expose a shared Gmail network client here.\",\n  }),\n  defineProviderReader({\n    providerId: \"google_drive\",\n    label: \"Google Drive reader\",\n    description:\n      \"Normalized metadata for Drive file search and document lookup through app-owned Google OAuth flows.\",\n    implementationStatus: \"template-owned\",\n    credentialKeys: providerCredentialKeys(\"google_drive\"),\n    requiredCredentialKeys: requiredCredentialKeys(\"google_drive\"),\n    capabilities: [\n      {\n        capability: \"search\",\n        label: \"Drive search\",\n        description: \"Search files visible to the connected Google account.\",\n      },\n      {\n        capability: \"docs\",\n        label: \"Drive document retrieval\",\n        description:\n          \"Read file metadata or exported document content through template-owned Google clients.\",\n      },\n    ],\n    operations: [\n      operation(\n        \"search\",\n        \"Search Google Drive\",\n        \"Find Drive files matching text, MIME type, or folder filters.\",\n        \"template-owned\",\n        [\n          ...searchParameters,\n          {\n            name: \"mimeType\",\n            type: \"string\",\n            description: \"Optional MIME type filter.\",\n          },\n        ],\n      ),\n      operation(\n        \"get\",\n        \"Get Google Drive file\",\n        \"Load one Drive file by id.\",\n        \"template-owned\",\n        getParameters,\n      ),\n      operation(\n        \"listRecent\",\n        \"List recent Google Drive files\",\n        \"List recently modified files visible to the connected Google account.\",\n        \"template-owned\",\n        listRecentParameters,\n      ),\n    ],\n    notes:\n      \"Templates still own file export formats, Docs/Sheets/Slides handling, and OAuth token refresh.\",\n  }),\n  defineProviderReader({\n    providerId: \"generic\",\n    label: \"Generic metadata reader\",\n    description:\n      \"Placeholder reader metadata for custom sources that expose searchable documents through a template-specific adapter.\",\n    implementationStatus: \"metadata-only\",\n    credentialKeys: providerCredentialKeys(\"generic\"),\n    requiredCredentialKeys: requiredCredentialKeys(\"generic\"),\n    capabilities: [\n      {\n        capability: \"search\",\n        label: \"Custom search\",\n        description:\n          \"Describe a template-specific search interface for one-off sources.\",\n      },\n      {\n        capability: \"docs\",\n        label: \"Custom document retrieval\",\n        description:\n          \"Describe a template-specific document retrieval interface.\",\n      },\n    ],\n    operations: [\n      operation(\n        \"search\",\n        \"Search custom source\",\n        \"Metadata-only descriptor for searching a custom source.\",\n        \"metadata-only\",\n        searchParameters,\n      ),\n      operation(\n        \"get\",\n        \"Get custom source object\",\n        \"Metadata-only descriptor for loading one custom source object by id.\",\n        \"metadata-only\",\n        getParameters,\n      ),\n    ],\n    notes:\n      \"Use this only to document a template-owned adapter; core cannot execute generic provider reads.\",\n  }),\n] as const satisfies readonly ProviderReaderDefinition[];\n\nconst READERS_BY_PROVIDER_ID = new Map<\n  WorkspaceConnectionProviderId,\n  ProviderReaderDefinition\n>(PROVIDER_READERS.map((reader) => [reader.providerId, reader]));\n\nexport function listProviderReaders(\n  options: ListProviderReadersOptions = {},\n): ProviderReaderDefinition[] {\n  return PROVIDER_READERS.filter((reader) => {\n    if (options.providerId && reader.providerId !== options.providerId) {\n      return false;\n    }\n    if (\n      options.capability &&\n      !reader.capabilities.some(\n        (capability) => capability.capability === options.capability,\n      )\n    ) {\n      return false;\n    }\n    if (\n      options.operation &&\n      !reader.operations.some(\n        (operation) => operation.operation === options.operation,\n      )\n    ) {\n      return false;\n    }\n    if (\n      options.implementationStatus &&\n      reader.implementationStatus !== options.implementationStatus\n    ) {\n      return false;\n    }\n    return true;\n  }).map(cloneProviderReader);\n}\n\nexport function getProviderReader(\n  providerId: string,\n): ProviderReaderDefinition | undefined {\n  const reader = READERS_BY_PROVIDER_ID.get(\n    providerId as WorkspaceConnectionProviderId,\n  );\n  return reader ? cloneProviderReader(reader) : undefined;\n}\n\nexport function providerReaderSupports(\n  providerOrReader: ProviderReaderDefinition | WorkspaceConnectionProviderId,\n  operationName: ProviderReaderOperation,\n): boolean {\n  const reader =\n    typeof providerOrReader === \"string\"\n      ? getProviderReader(providerOrReader)\n      : providerOrReader;\n  return (\n    reader?.operations.some(\n      (operation) => operation.operation === operationName,\n    ) ?? false\n  );\n}\n\nexport function createProviderReaderRuntime(\n  options: ProviderReaderRuntimeOptions,\n): ProviderReaderRuntime {\n  const appId = options.appId.trim();\n  if (!appId) {\n    throw new Error(\"createProviderReaderRuntime appId is required.\");\n  }\n\n  const implementations = new Map<\n    WorkspaceConnectionProviderId,\n    ProviderReaderRuntimeImplementation\n  >();\n  for (const implementation of options.readers) {\n    implementations.set(implementation.providerId, implementation);\n  }\n\n  const connectionResolver =\n    options.resolveConnection ??\n    ((resolverOptions: ProviderReaderRuntimeConnectionResolverOptions) =>\n      resolveWorkspaceConnectionForApp({\n        appId: resolverOptions.appId,\n        provider: resolverOptions.providerId,\n        connectionId: resolverOptions.connectionId,\n        includeDisabled: false,\n        requireConnected: true,\n      }));\n  const credentialsResolver =\n    options.resolveCredentials ??\n    ((resolverOptions: ProviderReaderRuntimeCredentialsResolverOptions) =>\n      resolveWorkspaceConnectionCredentialsForApp({\n        appId: resolverOptions.appId,\n        provider: resolverOptions.providerId,\n        connectionId: resolverOptions.connectionId,\n        keys: resolverOptions.keys,\n        userEmail: resolverOptions.userEmail,\n        orgId: resolverOptions.orgId,\n      }));\n\n  return {\n    async read<\n      TParams extends Record<string, unknown> = Record<string, unknown>,\n    >(\n      request: ProviderReaderRequest<TParams>,\n    ): Promise<ProviderReaderRuntimeResponse> {\n      const reader = getProviderReader(request.providerId);\n      if (!reader) {\n        throw new ProviderReaderRuntimeError(\n          \"unsupported_provider\",\n          `No provider reader metadata is registered for ${request.providerId}.`,\n          { providerId: request.providerId, operation: request.operation },\n        );\n      }\n\n      const operation = reader.operations.find(\n        (entry) => entry.operation === request.operation,\n      );\n      if (!operation) {\n        throw new ProviderReaderRuntimeError(\n          \"unsupported_operation\",\n          `${reader.label} does not support ${request.operation}.`,\n          { providerId: request.providerId, operation: request.operation },\n        );\n      }\n\n      const implementation = implementations.get(request.providerId);\n      if (!implementation) {\n        throw new ProviderReaderRuntimeError(\n          \"unsupported_provider\",\n          `${reader.label} has no runtime implementation registered.`,\n          { providerId: request.providerId, operation: request.operation },\n        );\n      }\n\n      const handler = implementation.operations[request.operation];\n      if (!handler) {\n        throw new ProviderReaderRuntimeError(\n          \"unsupported_operation\",\n          `${reader.label} has no runtime handler for ${request.operation}.`,\n          { providerId: request.providerId, operation: request.operation },\n        );\n      }\n\n      const resolvedConnection = await connectionResolver({\n        appId,\n        providerId: request.providerId,\n        connectionId: request.connectionId?.trim() || undefined,\n      });\n      if (!resolvedConnection.available || !resolvedConnection.connection) {\n        throw new ProviderReaderRuntimeError(\n          \"connection_not_available\",\n          resolvedConnection.reason,\n          { providerId: request.providerId, operation: request.operation },\n        );\n      }\n\n      const connection = publicRuntimeConnection(resolvedConnection.connection);\n      const context: ProviderReaderRuntimeContext = {\n        appId,\n        providerId: request.providerId,\n        reader,\n        connection,\n        resolveCredentials: (keys = reader.requiredCredentialKeys) =>\n          credentialsResolver({\n            appId,\n            providerId: request.providerId,\n            connectionId: connection.id,\n            keys: [...keys],\n            userEmail: request.userEmail,\n            orgId: request.orgId,\n          }),\n        requireCredentials: async (keys = reader.requiredCredentialKeys) => {\n          const resolution = await credentialsResolver({\n            appId,\n            providerId: request.providerId,\n            connectionId: connection.id,\n            keys: [...keys],\n            userEmail: request.userEmail,\n            orgId: request.orgId,\n          });\n          if (!resolution.available) {\n            throw new ProviderReaderRuntimeError(\n              \"credentials_unavailable\",\n              `Missing workspace connection credentials for ${reader.label}: ${resolution.missingKeys.join(\", \")}.`,\n              {\n                providerId: request.providerId,\n                operation: request.operation,\n              },\n            );\n          }\n          return { values: resolution.values, resolution };\n        },\n      };\n\n      return handler((request.params ?? {}) as TParams, context);\n    },\n  };\n}\n\nfunction cloneProviderReader(\n  reader: ProviderReaderDefinition,\n): ProviderReaderDefinition {\n  return {\n    ...reader,\n    credentialKeys: reader.credentialKeys.map((credential) => ({\n      ...credential,\n    })),\n    requiredCredentialKeys: [...reader.requiredCredentialKeys],\n    capabilities: reader.capabilities.map((capability) => ({\n      ...capability,\n    })),\n    operations: reader.operations.map((operation) => ({\n      ...operation,\n      parameters: operation.parameters.map((parameter) => ({\n        ...parameter,\n      })),\n    })),\n  };\n}\n\nfunction publicRuntimeConnection(\n  connection: WorkspaceConnectionForApp,\n): ProviderReaderRuntimeConnection {\n  return {\n    id: connection.id,\n    provider: connection.provider,\n    label: connection.label,\n    accountId: connection.accountId,\n    accountLabel: connection.accountLabel,\n    credentialRefs: publicCredentialRefs(connection),\n  };\n}\n\nfunction publicCredentialRefs(\n  connection: WorkspaceConnectionForApp,\n): WorkspaceConnectionPublicCredentialRef[] {\n  return [\n    ...(connection.explicitGrant?.credentialRefs ?? []).map((ref) =>\n      publicCredentialRef(ref, \"grant\"),\n    ),\n    ...connection.credentialRefs.map((ref) =>\n      publicCredentialRef(ref, \"connection\"),\n    ),\n  ];\n}\n\nfunction publicCredentialRef(\n  ref: WorkspaceConnectionCredentialRef,\n  source: WorkspaceConnectionPublicCredentialRef[\"source\"],\n): WorkspaceConnectionPublicCredentialRef {\n  return {\n    key: ref.key,\n    scope: ref.scope,\n    provider: ref.provider,\n    label: ref.label,\n    source,\n  };\n}\n"]}

package/dist/credentials/index.d.ts

@@ -2,6 +2,17 @@ export interface CredentialContext {
     userEmail: string;
     orgId?: string | null;
 }
+export type CredentialStorageScope = "user" | "org";
+/**
+ * Resolve a credential from one explicit legacy SQL credential scope.
+ *
+ * Prefer `resolveCredential()` for normal app-local credential lookup. This
+ * helper exists for workspace connection refs, where a ref can explicitly say
+ * "use the org-scoped key" and must not accidentally read a user override.
+ */
+export declare function resolveCredentialForScope(key: string, ctx: CredentialContext & {
+    scope: CredentialStorageScope;
+}): Promise<string | undefined>;
 /**
  * Resolve a credential, scoped to the caller's user (and falling back to
  * the active org's shared credential, if any).

package/dist/credentials/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credentials/index.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAmB7B;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,OAAO,CAAC,CAElB;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,iBAAiB,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;CAAE,GAClD,OAAO,CAAC,IAAI,CAAC,CAcf;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,iBAAiB,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;CAAE,GAClD,OAAO,CAAC,IAAI,CAAC,CAgBf"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credentials/index.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,MAAM,sBAAsB,GAAG,MAAM,GAAG,KAAK,CAAC;AAmBpD;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,iBAAiB,GAAG;IAAE,KAAK,EAAE,sBAAsB,CAAA;CAAE,GACzD,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAO7B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAc7B;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,OAAO,CAAC,CAElB;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,iBAAiB,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;CAAE,GAClD,OAAO,CAAC,IAAI,CAAC,CAcf;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,iBAAiB,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;CAAE,GAClD,OAAO,CAAC,IAAI,CAAC,CAcf"}