@agent-native/core 0.47.1 → 0.48.1

package/dist/provider-api/custom-registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"custom-registry.js","sourceRoot":"","sources":["../../src/provider-api/custom-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AA2C3E,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E,MAAM,UAAU,GAAG;;;;;;;;;;;;;;EAcjB,CAAC;AAEH,IAAI,YAAuC,CAAC;AAE5C,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,UAAU,EAAE;gBACtB,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,cAAc,EAAE,QAAQ,CAAC;gBAC9C,CAAC,CAAC,UAAU,CAAC;YACf,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACjB,YAAY,GAAG,SAAS,CAAC;YACzB,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,MAAM,cAAc,GAAG,8CAA8C,CAAC;AACtE,MAAM,cAAc,GAAG,+BAA+B,CAAC;AAEvD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAAc;IACxD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CACb,0DAA0D,GAAG,CAAC,QAAQ,GAAG,CAC1E,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,4BAA4B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,EAAU;IACpC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,+EAA+E,EAAE,KAAK,CACvF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAA4B;IAChD,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,aAAa;YACrB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC1D,CAAC;SAAM,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,WAAW;YACxC,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACvE,CAAC;SAAM,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,UAAU;YACzC,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;QACJ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,gDAAgD,IAAI,CAAC,UAAU,EAAE,CAClE,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,KAAK;IACL,KAAK;IACL,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,KAAK;IACL,KAAK;IACL,IAAI;IACJ,OAAO;IACP,MAAM;IACN,KAAK;IACL,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,OAAO;IACP,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,OAAO;IACP,WAAW;IACX,eAAe;IACf,YAAY;IACZ,aAAa;IACb,WAAW;IACX,aAAa;IACb,mBAAmB;IACnB,gBAAgB;IAChB,eAAe;IACf,UAAU;IACV,WAAW;CACZ,CAAC,CAAC;AAEH,MAAM,cAAc,GAClB,mEAAmE,CAAC;AAEtE;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAAkB;IAC5D,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,gCAAgC,GAAG,sEAAsE,CAC1G,CAAC;QACJ,CAAC;QACD,IAAI,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,wBAAwB,GAAG,gKAAgK,CAC5L,CAAC;QACJ,CAAC;QACD,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAA8B;IAE9B,MAAM,WAAW,EAAE,CAAC;IACpB,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,mBAAmB,GAAG,2BAA2B,CACrD,IAAI,CAAC,mBAAmB,IAAI,EAAE,CAC/B,CAAC;IAEF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,yFAAyF;QAC9F,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;KAC1C,CAAC,CAAC;IAEH,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,MAAM,CAAC,OAAO,CAAC;YACnB,GAAG,EAAE,uMAAuM;YAC5M,IAAI,EAAE;gBACJ,IAAI,CAAC,KAAK;gBACV,OAAO;gBACP,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;gBACzB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;gBACnC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC;gBACnC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC;gBACzC,IAAI,CAAC,KAAK,IAAI,EAAE;gBAChB,GAAG;gBACH,IAAI,CAAC,KAAK;gBACV,IAAI,CAAC,OAAO;gBACZ,IAAI,CAAC,EAAE;aACR;SACF,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,CAAC,OAAO,CAAC;YACnB,GAAG,EAAE,sNAAsN;YAC3N,IAAI,EAAE;gBACJ,IAAI,CAAC,EAAE;gBACP,IAAI,CAAC,KAAK;gBACV,IAAI,CAAC,OAAO;gBACZ,IAAI,CAAC,KAAK;gBACV,OAAO;gBACP,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;gBACzB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;gBACnC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC;gBACnC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC;gBACzC,IAAI,CAAC,KAAK,IAAI,EAAE;gBAChB,GAAG;gBACH,GAAG;aACJ;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,IAAI,CAAC,EAAE,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAA0B,EAC1B,OAAe,EACf,EAAU;IAEV,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAC5C,GAAG,EAAE,wEAAwE;QAC7E,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;KAC3B,CAAC,CAAC;IACH,OAAO,YAAY,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAA0B,EAC1B,OAAe;IAEf,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,yOAAyO;QAC9O,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;KACvB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAA0B,EAC1B,OAAe,EACf,EAAU;IAEV,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,iOAAiO;QACtO,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;KAC3B,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,WAAW,CAAC,GAA4B;IAC/C,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAY;QACpB,KAAK,EAAE,GAAG,CAAC,KAA4B;QACvC,OAAO,EAAE,GAAG,CAAC,QAAkB;QAC/B,KAAK,EAAE,GAAG,CAAC,KAAe;QAC1B,OAAO,EAAE,GAAG,CAAC,QAAkB;QAC/B,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAmB,CAA2B;QACnE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAwB,CAAa;QAC9D,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAC7B,GAAG,CAAC,0BAAoC,CAC7B;QACb,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,oBAA8B,CAG5D;QACD,KAAK,EAAE,GAAG,CAAC,KAAe;QAC1B,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;QACjC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;KAClC,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Custom provider registry — runtime storage and resolution.\n *\n * Lets apps register arbitrary HTTP API providers at runtime without touching\n * the static PROVIDER_CONFIGS list. Provider rows live in the\n * `custom_api_providers` SQL table (created on first use). Credentials\n * referenced in the provider row continue to live in the existing secrets /\n * credentials store — this table stores only key NAMES, never values.\n *\n * Scoping mirrors the `app_secrets` table: each row is scoped to a user\n * (by email) or an organisation (by orgId).\n *\n * Supported auth kinds for custom providers:\n *   - bearer         → Authorization: Bearer <credential>\n *   - basic          → Authorization: Basic base64(user:pass)\n *   - api-key-header → custom header: <credential>\n *\n * google-service-account and oauth-bearer are intentionally unsupported for\n * custom providers because they require additional out-of-band setup that\n * cannot be expressed in the simple header/key model.\n */\n\nimport { randomUUID } from \"node:crypto\";\nimport { getDbExec, isPostgres } from \"../db/client.js\";\nimport { isBlockedExtensionUrlWithDns } from \"../extensions/url-safety.js\";\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\nexport type CustomProviderScope = \"user\" | \"org\";\n\nexport type CustomProviderAuthKind =\n  | { type: \"bearer\"; credentialKey: string }\n  | { type: \"basic\"; usernameKey: string; passwordKey: string }\n  | { type: \"api-key-header\"; credentialKey: string; headerName: string }\n  | { type: \"none\" };\n\nexport interface CustomProviderConfig {\n  id: string;\n  scope: CustomProviderScope;\n  scopeId: string;\n  label: string;\n  baseUrl: string;\n  auth: CustomProviderAuthKind;\n  docsUrls: string[];\n  allowedHostSuffixes: string[];\n  defaultHeaders: Record<string, string>;\n  notes: string;\n  createdAt: number;\n  updatedAt: number;\n}\n\nexport interface UpsertCustomProviderArgs {\n  scope: CustomProviderScope;\n  scopeId: string;\n  /** Slug used as the provider id (e.g. \"my-api\"). Must be lowercase, letters/digits/hyphens. */\n  id: string;\n  label: string;\n  baseUrl: string;\n  auth: CustomProviderAuthKind;\n  docsUrls?: string[];\n  allowedHostSuffixes?: string[];\n  defaultHeaders?: Record<string, string>;\n  notes?: string;\n}\n\n// ---------------------------------------------------------------------------\n// Table bootstrap\n// ---------------------------------------------------------------------------\n\nconst CREATE_SQL = `CREATE TABLE IF NOT EXISTS custom_api_providers (\n  id TEXT NOT NULL,\n  scope TEXT NOT NULL,\n  scope_id TEXT NOT NULL,\n  label TEXT NOT NULL,\n  base_url TEXT NOT NULL,\n  auth_json TEXT NOT NULL,\n  docs_urls_json TEXT NOT NULL,\n  allowed_host_suffixes_json TEXT NOT NULL,\n  default_headers_json TEXT NOT NULL,\n  notes TEXT NOT NULL DEFAULT '',\n  created_at INTEGER NOT NULL,\n  updated_at INTEGER NOT NULL,\n  PRIMARY KEY (scope, scope_id, id)\n)`;\n\nlet _initPromise: Promise<void> | undefined;\n\nasync function ensureTable(): Promise<void> {\n  if (!_initPromise) {\n    _initPromise = (async () => {\n      const client = getDbExec();\n      const sql = isPostgres()\n        ? CREATE_SQL.replace(/\\bINTEGER\\b/g, \"BIGINT\")\n        : CREATE_SQL;\n      await client.execute(sql);\n    })().catch((err) => {\n      _initPromise = undefined;\n      throw err;\n    });\n  }\n  return _initPromise;\n}\n\n// ---------------------------------------------------------------------------\n// Validation\n// ---------------------------------------------------------------------------\n\nconst PROVIDER_ID_RE = /^[a-z0-9][a-z0-9-]{0,62}[a-z0-9]$|^[a-z0-9]$/;\nconst HEADER_NAME_RE = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;\n\n/**\n * Validate and normalise a custom provider base URL. Throws when the URL is\n * invalid, uses a non-http(s) scheme, or resolves to a private/internal host.\n */\nexport async function validateCustomBaseUrl(rawUrl: string): Promise<URL> {\n  let url: URL;\n  try {\n    url = new URL(rawUrl);\n  } catch {\n    throw new Error(`Invalid base URL: ${rawUrl}`);\n  }\n  if (url.protocol !== \"https:\" && url.protocol !== \"http:\") {\n    throw new Error(\n      `Custom provider base URL must use https: or http: (got ${url.protocol})`,\n    );\n  }\n  if (await isBlockedExtensionUrlWithDns(url.href)) {\n    throw new Error(\n      `Custom provider base URL resolves to a private/internal address — SSRF not allowed.`,\n    );\n  }\n  return url;\n}\n\nfunction validateProviderId(id: string): void {\n  if (!PROVIDER_ID_RE.test(id)) {\n    throw new Error(\n      `Custom provider id must be 1–64 lowercase letters, digits, or hyphens (got \"${id}\").`,\n    );\n  }\n}\n\nfunction validateAuth(auth: CustomProviderAuthKind): void {\n  if (auth.type === \"bearer\") {\n    if (!auth.credentialKey)\n      throw new Error(\"bearer auth requires credentialKey\");\n  } else if (auth.type === \"basic\") {\n    if (!auth.usernameKey || !auth.passwordKey)\n      throw new Error(\"basic auth requires usernameKey and passwordKey\");\n  } else if (auth.type === \"api-key-header\") {\n    if (!auth.credentialKey || !auth.headerName)\n      throw new Error(\n        \"api-key-header auth requires credentialKey and headerName\",\n      );\n    if (!HEADER_NAME_RE.test(auth.headerName)) {\n      throw new Error(\n        `Invalid header name for api-key-header auth: ${auth.headerName}`,\n      );\n    }\n  }\n}\n\n/**\n * Public suffixes that must never be used as an allowed host suffix — a\n * suffix like \"com\" would attach the provider's credentials to requests for\n * any host under that TLD, creating a credential-exfiltration vector. Not an\n * exhaustive public-suffix list; combined with the structural checks below.\n */\nconst FORBIDDEN_HOST_SUFFIXES = new Set([\n  \"com\",\n  \"net\",\n  \"org\",\n  \"io\",\n  \"co\",\n  \"dev\",\n  \"app\",\n  \"ai\",\n  \"cloud\",\n  \"info\",\n  \"biz\",\n  \"xyz\",\n  \"me\",\n  \"us\",\n  \"uk\",\n  \"eu\",\n  \"co.uk\",\n  \"org.uk\",\n  \"ac.uk\",\n  \"gov.uk\",\n  \"com.au\",\n  \"net.au\",\n  \"org.au\",\n  \"co.nz\",\n  \"co.jp\",\n  \"com.br\",\n  \"com.cn\",\n  \"co.in\",\n  \"com.mx\",\n  \"co.za\",\n  \"github.io\",\n  \"herokuapp.com\",\n  \"vercel.app\",\n  \"netlify.app\",\n  \"pages.dev\",\n  \"workers.dev\",\n  \"azurewebsites.net\",\n  \"cloudfront.net\",\n  \"amazonaws.com\",\n  \"ngrok.io\",\n  \"ngrok.app\",\n]);\n\nconst HOST_SUFFIX_RE =\n  /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/;\n\n/**\n * Validate user-supplied allowed host suffixes. Each suffix must look like a\n * real registrable domain (at least two labels) and must not be a bare TLD or\n * shared-hosting public suffix where unrelated parties control subdomains.\n */\nexport function validateAllowedHostSuffixes(suffixes: string[]): string[] {\n  const normalized: string[] = [];\n  for (const raw of suffixes) {\n    const suffix = String(raw).trim().toLowerCase().replace(/^\\.+/, \"\");\n    if (!suffix) continue;\n    if (!HOST_SUFFIX_RE.test(suffix)) {\n      throw new Error(\n        `Invalid allowed host suffix \"${raw}\": must be a domain like \"api.example.com\" with at least two labels.`,\n      );\n    }\n    if (FORBIDDEN_HOST_SUFFIXES.has(suffix)) {\n      throw new Error(\n        `Allowed host suffix \"${raw}\" is too broad: it would attach this provider's credentials to any host under a public suffix. Use the provider's own registrable domain (e.g. \"example.com\").`,\n      );\n    }\n    normalized.push(suffix);\n  }\n  return normalized;\n}\n\n// ---------------------------------------------------------------------------\n// CRUD\n// ---------------------------------------------------------------------------\n\n/**\n * Create or update a custom provider. Validates the base URL against SSRF\n * rules at write time. Returns the provider id.\n */\nexport async function upsertCustomProvider(\n  args: UpsertCustomProviderArgs,\n): Promise<string> {\n  await ensureTable();\n  validateProviderId(args.id);\n  validateAuth(args.auth);\n  const url = await validateCustomBaseUrl(args.baseUrl);\n  const baseUrl = url.href.replace(/\\/+$/, \"\");\n  const allowedHostSuffixes = validateAllowedHostSuffixes(\n    args.allowedHostSuffixes ?? [],\n  );\n\n  const now = Date.now();\n  const client = getDbExec();\n\n  const { rows } = await client.execute({\n    sql: `SELECT created_at FROM custom_api_providers WHERE scope = ? AND scope_id = ? AND id = ?`,\n    args: [args.scope, args.scopeId, args.id],\n  });\n\n  if (rows.length > 0) {\n    await client.execute({\n      sql: `UPDATE custom_api_providers SET label=?, base_url=?, auth_json=?, docs_urls_json=?, allowed_host_suffixes_json=?, default_headers_json=?, notes=?, updated_at=? WHERE scope=? AND scope_id=? AND id=?`,\n      args: [\n        args.label,\n        baseUrl,\n        JSON.stringify(args.auth),\n        JSON.stringify(args.docsUrls ?? []),\n        JSON.stringify(allowedHostSuffixes),\n        JSON.stringify(args.defaultHeaders ?? {}),\n        args.notes ?? \"\",\n        now,\n        args.scope,\n        args.scopeId,\n        args.id,\n      ],\n    });\n  } else {\n    await client.execute({\n      sql: `INSERT INTO custom_api_providers (id, scope, scope_id, label, base_url, auth_json, docs_urls_json, allowed_host_suffixes_json, default_headers_json, notes, created_at, updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?)`,\n      args: [\n        args.id,\n        args.scope,\n        args.scopeId,\n        args.label,\n        baseUrl,\n        JSON.stringify(args.auth),\n        JSON.stringify(args.docsUrls ?? []),\n        JSON.stringify(allowedHostSuffixes),\n        JSON.stringify(args.defaultHeaders ?? {}),\n        args.notes ?? \"\",\n        now,\n        now,\n      ],\n    });\n  }\n\n  return args.id;\n}\n\n/**\n * Delete a custom provider. Returns true if a row was deleted.\n */\nexport async function deleteCustomProvider(\n  scope: CustomProviderScope,\n  scopeId: string,\n  id: string,\n): Promise<boolean> {\n  await ensureTable();\n  const client = getDbExec();\n  const { rowsAffected } = await client.execute({\n    sql: `DELETE FROM custom_api_providers WHERE scope=? AND scope_id=? AND id=?`,\n    args: [scope, scopeId, id],\n  });\n  return rowsAffected > 0;\n}\n\n/**\n * List all custom providers visible to a given (scope, scopeId) pair.\n */\nexport async function listCustomProviders(\n  scope: CustomProviderScope,\n  scopeId: string,\n): Promise<CustomProviderConfig[]> {\n  await ensureTable();\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT id, scope, scope_id, label, base_url, auth_json, docs_urls_json, allowed_host_suffixes_json, default_headers_json, notes, created_at, updated_at FROM custom_api_providers WHERE scope=? AND scope_id=? ORDER BY updated_at DESC`,\n    args: [scope, scopeId],\n  });\n  return rows.map(rowToConfig);\n}\n\n/**\n * Look up one custom provider. Returns null when not found.\n */\nexport async function getCustomProvider(\n  scope: CustomProviderScope,\n  scopeId: string,\n  id: string,\n): Promise<CustomProviderConfig | null> {\n  await ensureTable();\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT id, scope, scope_id, label, base_url, auth_json, docs_urls_json, allowed_host_suffixes_json, default_headers_json, notes, created_at, updated_at FROM custom_api_providers WHERE scope=? AND scope_id=? AND id=? LIMIT 1`,\n    args: [scope, scopeId, id],\n  });\n  if (rows.length === 0) return null;\n  return rowToConfig(rows[0]);\n}\n\nfunction rowToConfig(row: Record<string, unknown>): CustomProviderConfig {\n  return {\n    id: row.id as string,\n    scope: row.scope as CustomProviderScope,\n    scopeId: row.scope_id as string,\n    label: row.label as string,\n    baseUrl: row.base_url as string,\n    auth: JSON.parse(row.auth_json as string) as CustomProviderAuthKind,\n    docsUrls: JSON.parse(row.docs_urls_json as string) as string[],\n    allowedHostSuffixes: JSON.parse(\n      row.allowed_host_suffixes_json as string,\n    ) as string[],\n    defaultHeaders: JSON.parse(row.default_headers_json as string) as Record<\n      string,\n      string\n    >,\n    notes: row.notes as string,\n    createdAt: Number(row.created_at),\n    updatedAt: Number(row.updated_at),\n  };\n}\n"]}
+{"version":3,"file":"custom-registry.js","sourceRoot":"","sources":["../../src/provider-api/custom-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AA2C3E,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E,MAAM,UAAU,GAAG;;;;;;;;;;;;;;EAcjB,CAAC;AAEH,IAAI,YAAuC,CAAC;AAE5C,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,UAAU,EAAE;gBACtB,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,cAAc,EAAE,QAAQ,CAAC;gBAC9C,CAAC,CAAC,UAAU,CAAC;YACf,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACjB,YAAY,GAAG,SAAS,CAAC;YACzB,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,MAAM,cAAc,GAAG,8CAA8C,CAAC;AACtE,MAAM,cAAc,GAAG,+BAA+B,CAAC;AAEvD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAAc;IACxD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CACb,0DAA0D,GAAG,CAAC,QAAQ,GAAG,CAC1E,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,4BAA4B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,qFAAqF,CACtF,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,EAAU;IACpC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,+EAA+E,EAAE,KAAK,CACvF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAA4B;IAChD,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,aAAa;YACrB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC1D,CAAC;SAAM,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,WAAW;YACxC,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACvE,CAAC;SAAM,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,UAAU;YACzC,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;QACJ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,gDAAgD,IAAI,CAAC,UAAU,EAAE,CAClE,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,KAAK;IACL,KAAK;IACL,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,KAAK;IACL,KAAK;IACL,IAAI;IACJ,OAAO;IACP,MAAM;IACN,KAAK;IACL,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,OAAO;IACP,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,OAAO;IACP,WAAW;IACX,eAAe;IACf,YAAY;IACZ,aAAa;IACb,WAAW;IACX,aAAa;IACb,mBAAmB;IACnB,gBAAgB;IAChB,eAAe;IACf,UAAU;IACV,WAAW;CACZ,CAAC,CAAC;AAEH,MAAM,cAAc,GAClB,mEAAmE,CAAC;AAEtE;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAAkB;IAC5D,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,gCAAgC,GAAG,sEAAsE,CAC1G,CAAC;QACJ,CAAC;QACD,IAAI,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,wBAAwB,GAAG,gKAAgK,CAC5L,CAAC;QACJ,CAAC;QACD,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAA8B;IAE9B,MAAM,WAAW,EAAE,CAAC;IACpB,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,mBAAmB,GAAG,2BAA2B,CACrD,IAAI,CAAC,mBAAmB,IAAI,EAAE,CAC/B,CAAC;IAEF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,yFAAyF;QAC9F,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;KAC1C,CAAC,CAAC;IAEH,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,MAAM,CAAC,OAAO,CAAC;YACnB,GAAG,EAAE,uMAAuM;YAC5M,IAAI,EAAE;gBACJ,IAAI,CAAC,KAAK;gBACV,OAAO;gBACP,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;gBACzB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;gBACnC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC;gBACnC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC;gBACzC,IAAI,CAAC,KAAK,IAAI,EAAE;gBAChB,GAAG;gBACH,IAAI,CAAC,KAAK;gBACV,IAAI,CAAC,OAAO;gBACZ,IAAI,CAAC,EAAE;aACR;SACF,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,CAAC,OAAO,CAAC;YACnB,GAAG,EAAE,sNAAsN;YAC3N,IAAI,EAAE;gBACJ,IAAI,CAAC,EAAE;gBACP,IAAI,CAAC,KAAK;gBACV,IAAI,CAAC,OAAO;gBACZ,IAAI,CAAC,KAAK;gBACV,OAAO;gBACP,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;gBACzB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;gBACnC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC;gBACnC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC;gBACzC,IAAI,CAAC,KAAK,IAAI,EAAE;gBAChB,GAAG;gBACH,GAAG;aACJ;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,IAAI,CAAC,EAAE,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAA0B,EAC1B,OAAe,EACf,EAAU;IAEV,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAC5C,GAAG,EAAE,wEAAwE;QAC7E,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;KAC3B,CAAC,CAAC;IACH,OAAO,YAAY,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAA0B,EAC1B,OAAe;IAEf,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,yOAAyO;QAC9O,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;KACvB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAA0B,EAC1B,OAAe,EACf,EAAU;IAEV,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,iOAAiO;QACtO,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;KAC3B,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,WAAW,CAAC,GAA4B;IAC/C,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAY;QACpB,KAAK,EAAE,GAAG,CAAC,KAA4B;QACvC,OAAO,EAAE,GAAG,CAAC,QAAkB;QAC/B,KAAK,EAAE,GAAG,CAAC,KAAe;QAC1B,OAAO,EAAE,GAAG,CAAC,QAAkB;QAC/B,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAmB,CAA2B;QACnE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAwB,CAAa;QAC9D,mBAAmB,EAAE,IAAI,CAAC,KAAK,CAC7B,GAAG,CAAC,0BAAoC,CAC7B;QACb,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,oBAA8B,CAG5D;QACD,KAAK,EAAE,GAAG,CAAC,KAAe;QAC1B,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;QACjC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;KAClC,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Custom provider registry — runtime storage and resolution.\n *\n * Lets apps register arbitrary HTTP API providers at runtime without touching\n * the static PROVIDER_CONFIGS list. Provider rows live in the\n * `custom_api_providers` SQL table (created on first use). Credentials\n * referenced in the provider row continue to live in the existing secrets /\n * credentials store — this table stores only key NAMES, never values.\n *\n * Scoping mirrors the `app_secrets` table: each row is scoped to a user\n * (by email) or an organisation (by orgId).\n *\n * Supported auth kinds for custom providers:\n *   - bearer         → Authorization: Bearer <credential>\n *   - basic          → Authorization: Basic base64(user:pass)\n *   - api-key-header → custom header: <credential>\n *\n * google-service-account and oauth-bearer are intentionally unsupported for\n * custom providers because they require additional out-of-band setup that\n * cannot be expressed in the simple header/key model.\n */\n\nimport { getDbExec, isPostgres } from \"../db/client.js\";\nimport { isBlockedExtensionUrlWithDns } from \"../extensions/url-safety.js\";\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\nexport type CustomProviderScope = \"user\" | \"org\";\n\nexport type CustomProviderAuthKind =\n  | { type: \"bearer\"; credentialKey: string }\n  | { type: \"basic\"; usernameKey: string; passwordKey: string }\n  | { type: \"api-key-header\"; credentialKey: string; headerName: string }\n  | { type: \"none\" };\n\nexport interface CustomProviderConfig {\n  id: string;\n  scope: CustomProviderScope;\n  scopeId: string;\n  label: string;\n  baseUrl: string;\n  auth: CustomProviderAuthKind;\n  docsUrls: string[];\n  allowedHostSuffixes: string[];\n  defaultHeaders: Record<string, string>;\n  notes: string;\n  createdAt: number;\n  updatedAt: number;\n}\n\nexport interface UpsertCustomProviderArgs {\n  scope: CustomProviderScope;\n  scopeId: string;\n  /** Slug used as the provider id (e.g. \"my-api\"). Must be lowercase, letters/digits/hyphens. */\n  id: string;\n  label: string;\n  baseUrl: string;\n  auth: CustomProviderAuthKind;\n  docsUrls?: string[];\n  allowedHostSuffixes?: string[];\n  defaultHeaders?: Record<string, string>;\n  notes?: string;\n}\n\n// ---------------------------------------------------------------------------\n// Table bootstrap\n// ---------------------------------------------------------------------------\n\nconst CREATE_SQL = `CREATE TABLE IF NOT EXISTS custom_api_providers (\n  id TEXT NOT NULL,\n  scope TEXT NOT NULL,\n  scope_id TEXT NOT NULL,\n  label TEXT NOT NULL,\n  base_url TEXT NOT NULL,\n  auth_json TEXT NOT NULL,\n  docs_urls_json TEXT NOT NULL,\n  allowed_host_suffixes_json TEXT NOT NULL,\n  default_headers_json TEXT NOT NULL,\n  notes TEXT NOT NULL DEFAULT '',\n  created_at INTEGER NOT NULL,\n  updated_at INTEGER NOT NULL,\n  PRIMARY KEY (scope, scope_id, id)\n)`;\n\nlet _initPromise: Promise<void> | undefined;\n\nasync function ensureTable(): Promise<void> {\n  if (!_initPromise) {\n    _initPromise = (async () => {\n      const client = getDbExec();\n      const sql = isPostgres()\n        ? CREATE_SQL.replace(/\\bINTEGER\\b/g, \"BIGINT\")\n        : CREATE_SQL;\n      await client.execute(sql);\n    })().catch((err) => {\n      _initPromise = undefined;\n      throw err;\n    });\n  }\n  return _initPromise;\n}\n\n// ---------------------------------------------------------------------------\n// Validation\n// ---------------------------------------------------------------------------\n\nconst PROVIDER_ID_RE = /^[a-z0-9][a-z0-9-]{0,62}[a-z0-9]$|^[a-z0-9]$/;\nconst HEADER_NAME_RE = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;\n\n/**\n * Validate and normalise a custom provider base URL. Throws when the URL is\n * invalid, uses a non-http(s) scheme, or resolves to a private/internal host.\n */\nexport async function validateCustomBaseUrl(rawUrl: string): Promise<URL> {\n  let url: URL;\n  try {\n    url = new URL(rawUrl);\n  } catch {\n    throw new Error(`Invalid base URL: ${rawUrl}`);\n  }\n  if (url.protocol !== \"https:\" && url.protocol !== \"http:\") {\n    throw new Error(\n      `Custom provider base URL must use https: or http: (got ${url.protocol})`,\n    );\n  }\n  if (await isBlockedExtensionUrlWithDns(url.href)) {\n    throw new Error(\n      `Custom provider base URL resolves to a private/internal address — SSRF not allowed.`,\n    );\n  }\n  return url;\n}\n\nfunction validateProviderId(id: string): void {\n  if (!PROVIDER_ID_RE.test(id)) {\n    throw new Error(\n      `Custom provider id must be 1–64 lowercase letters, digits, or hyphens (got \"${id}\").`,\n    );\n  }\n}\n\nfunction validateAuth(auth: CustomProviderAuthKind): void {\n  if (auth.type === \"bearer\") {\n    if (!auth.credentialKey)\n      throw new Error(\"bearer auth requires credentialKey\");\n  } else if (auth.type === \"basic\") {\n    if (!auth.usernameKey || !auth.passwordKey)\n      throw new Error(\"basic auth requires usernameKey and passwordKey\");\n  } else if (auth.type === \"api-key-header\") {\n    if (!auth.credentialKey || !auth.headerName)\n      throw new Error(\n        \"api-key-header auth requires credentialKey and headerName\",\n      );\n    if (!HEADER_NAME_RE.test(auth.headerName)) {\n      throw new Error(\n        `Invalid header name for api-key-header auth: ${auth.headerName}`,\n      );\n    }\n  }\n}\n\n/**\n * Public suffixes that must never be used as an allowed host suffix — a\n * suffix like \"com\" would attach the provider's credentials to requests for\n * any host under that TLD, creating a credential-exfiltration vector. Not an\n * exhaustive public-suffix list; combined with the structural checks below.\n */\nconst FORBIDDEN_HOST_SUFFIXES = new Set([\n  \"com\",\n  \"net\",\n  \"org\",\n  \"io\",\n  \"co\",\n  \"dev\",\n  \"app\",\n  \"ai\",\n  \"cloud\",\n  \"info\",\n  \"biz\",\n  \"xyz\",\n  \"me\",\n  \"us\",\n  \"uk\",\n  \"eu\",\n  \"co.uk\",\n  \"org.uk\",\n  \"ac.uk\",\n  \"gov.uk\",\n  \"com.au\",\n  \"net.au\",\n  \"org.au\",\n  \"co.nz\",\n  \"co.jp\",\n  \"com.br\",\n  \"com.cn\",\n  \"co.in\",\n  \"com.mx\",\n  \"co.za\",\n  \"github.io\",\n  \"herokuapp.com\",\n  \"vercel.app\",\n  \"netlify.app\",\n  \"pages.dev\",\n  \"workers.dev\",\n  \"azurewebsites.net\",\n  \"cloudfront.net\",\n  \"amazonaws.com\",\n  \"ngrok.io\",\n  \"ngrok.app\",\n]);\n\nconst HOST_SUFFIX_RE =\n  /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/;\n\n/**\n * Validate user-supplied allowed host suffixes. Each suffix must look like a\n * real registrable domain (at least two labels) and must not be a bare TLD or\n * shared-hosting public suffix where unrelated parties control subdomains.\n */\nexport function validateAllowedHostSuffixes(suffixes: string[]): string[] {\n  const normalized: string[] = [];\n  for (const raw of suffixes) {\n    const suffix = String(raw).trim().toLowerCase().replace(/^\\.+/, \"\");\n    if (!suffix) continue;\n    if (!HOST_SUFFIX_RE.test(suffix)) {\n      throw new Error(\n        `Invalid allowed host suffix \"${raw}\": must be a domain like \"api.example.com\" with at least two labels.`,\n      );\n    }\n    if (FORBIDDEN_HOST_SUFFIXES.has(suffix)) {\n      throw new Error(\n        `Allowed host suffix \"${raw}\" is too broad: it would attach this provider's credentials to any host under a public suffix. Use the provider's own registrable domain (e.g. \"example.com\").`,\n      );\n    }\n    normalized.push(suffix);\n  }\n  return normalized;\n}\n\n// ---------------------------------------------------------------------------\n// CRUD\n// ---------------------------------------------------------------------------\n\n/**\n * Create or update a custom provider. Validates the base URL against SSRF\n * rules at write time. Returns the provider id.\n */\nexport async function upsertCustomProvider(\n  args: UpsertCustomProviderArgs,\n): Promise<string> {\n  await ensureTable();\n  validateProviderId(args.id);\n  validateAuth(args.auth);\n  const url = await validateCustomBaseUrl(args.baseUrl);\n  const baseUrl = url.href.replace(/\\/+$/, \"\");\n  const allowedHostSuffixes = validateAllowedHostSuffixes(\n    args.allowedHostSuffixes ?? [],\n  );\n\n  const now = Date.now();\n  const client = getDbExec();\n\n  const { rows } = await client.execute({\n    sql: `SELECT created_at FROM custom_api_providers WHERE scope = ? AND scope_id = ? AND id = ?`,\n    args: [args.scope, args.scopeId, args.id],\n  });\n\n  if (rows.length > 0) {\n    await client.execute({\n      sql: `UPDATE custom_api_providers SET label=?, base_url=?, auth_json=?, docs_urls_json=?, allowed_host_suffixes_json=?, default_headers_json=?, notes=?, updated_at=? WHERE scope=? AND scope_id=? AND id=?`,\n      args: [\n        args.label,\n        baseUrl,\n        JSON.stringify(args.auth),\n        JSON.stringify(args.docsUrls ?? []),\n        JSON.stringify(allowedHostSuffixes),\n        JSON.stringify(args.defaultHeaders ?? {}),\n        args.notes ?? \"\",\n        now,\n        args.scope,\n        args.scopeId,\n        args.id,\n      ],\n    });\n  } else {\n    await client.execute({\n      sql: `INSERT INTO custom_api_providers (id, scope, scope_id, label, base_url, auth_json, docs_urls_json, allowed_host_suffixes_json, default_headers_json, notes, created_at, updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?)`,\n      args: [\n        args.id,\n        args.scope,\n        args.scopeId,\n        args.label,\n        baseUrl,\n        JSON.stringify(args.auth),\n        JSON.stringify(args.docsUrls ?? []),\n        JSON.stringify(allowedHostSuffixes),\n        JSON.stringify(args.defaultHeaders ?? {}),\n        args.notes ?? \"\",\n        now,\n        now,\n      ],\n    });\n  }\n\n  return args.id;\n}\n\n/**\n * Delete a custom provider. Returns true if a row was deleted.\n */\nexport async function deleteCustomProvider(\n  scope: CustomProviderScope,\n  scopeId: string,\n  id: string,\n): Promise<boolean> {\n  await ensureTable();\n  const client = getDbExec();\n  const { rowsAffected } = await client.execute({\n    sql: `DELETE FROM custom_api_providers WHERE scope=? AND scope_id=? AND id=?`,\n    args: [scope, scopeId, id],\n  });\n  return rowsAffected > 0;\n}\n\n/**\n * List all custom providers visible to a given (scope, scopeId) pair.\n */\nexport async function listCustomProviders(\n  scope: CustomProviderScope,\n  scopeId: string,\n): Promise<CustomProviderConfig[]> {\n  await ensureTable();\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT id, scope, scope_id, label, base_url, auth_json, docs_urls_json, allowed_host_suffixes_json, default_headers_json, notes, created_at, updated_at FROM custom_api_providers WHERE scope=? AND scope_id=? ORDER BY updated_at DESC`,\n    args: [scope, scopeId],\n  });\n  return rows.map(rowToConfig);\n}\n\n/**\n * Look up one custom provider. Returns null when not found.\n */\nexport async function getCustomProvider(\n  scope: CustomProviderScope,\n  scopeId: string,\n  id: string,\n): Promise<CustomProviderConfig | null> {\n  await ensureTable();\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT id, scope, scope_id, label, base_url, auth_json, docs_urls_json, allowed_host_suffixes_json, default_headers_json, notes, created_at, updated_at FROM custom_api_providers WHERE scope=? AND scope_id=? AND id=? LIMIT 1`,\n    args: [scope, scopeId, id],\n  });\n  if (rows.length === 0) return null;\n  return rowToConfig(rows[0]);\n}\n\nfunction rowToConfig(row: Record<string, unknown>): CustomProviderConfig {\n  return {\n    id: row.id as string,\n    scope: row.scope as CustomProviderScope,\n    scopeId: row.scope_id as string,\n    label: row.label as string,\n    baseUrl: row.base_url as string,\n    auth: JSON.parse(row.auth_json as string) as CustomProviderAuthKind,\n    docsUrls: JSON.parse(row.docs_urls_json as string) as string[],\n    allowedHostSuffixes: JSON.parse(\n      row.allowed_host_suffixes_json as string,\n    ) as string[],\n    defaultHeaders: JSON.parse(row.default_headers_json as string) as Record<\n      string,\n      string\n    >,\n    notes: row.notes as string,\n    createdAt: Number(row.created_at),\n    updatedAt: Number(row.updated_at),\n  };\n}\n"]}

package/dist/provider-api/index.d.ts

@@ -160,10 +160,10 @@ export declare function listProviderApiIdsForTemplateUse(templateUse: WorkspaceC
 export declare function listProviderApiCatalog(provider?: ProviderApiId | string, options?: {
     providerIds?: readonly (ProviderApiId | string)[];
 }): {
-    id: "amplitude" | "bigquery" | "sentry" | "posthog" | "mixpanel" | "github" | "slack" | "twitter" | "notion" | "gmail" | "google_drive" | "hubspot" | "granola" | "apollo" | "commonroom" | "dataforseo" | "ga4" | "gcloud" | "gong" | "google_calendar" | "grafana" | "jira" | "prometheus" | "pylon" | "stripe";
+    id: "amplitude" | "bigquery" | "sentry" | "posthog" | "mixpanel" | "github" | "slack" | "twitter" | "notion" | "jira" | "gmail" | "google_drive" | "hubspot" | "granola" | "apollo" | "commonroom" | "dataforseo" | "ga4" | "gcloud" | "gong" | "google_calendar" | "grafana" | "prometheus" | "pylon" | "stripe";
     label: string;
     defaultBaseUrl: string;
-    baseUrlCredentialKey: string;
+    baseUrlCredentialKey: string | null;
     auth: string;
     credentialKeys: readonly string[];
     docsUrls: readonly string[];
@@ -183,10 +183,10 @@ export declare function fetchProviderApiDocs(options: {
 }, runtime?: ProviderApiRuntimeOptions): Promise<{
     provider: string;
     catalog: {
-        id: "amplitude" | "bigquery" | "sentry" | "posthog" | "mixpanel" | "github" | "slack" | "twitter" | "notion" | "gmail" | "google_drive" | "hubspot" | "granola" | "apollo" | "commonroom" | "dataforseo" | "ga4" | "gcloud" | "gong" | "google_calendar" | "grafana" | "jira" | "prometheus" | "pylon" | "stripe";
+        id: "amplitude" | "bigquery" | "sentry" | "posthog" | "mixpanel" | "github" | "slack" | "twitter" | "notion" | "jira" | "gmail" | "google_drive" | "hubspot" | "granola" | "apollo" | "commonroom" | "dataforseo" | "ga4" | "gcloud" | "gong" | "google_calendar" | "grafana" | "prometheus" | "pylon" | "stripe";
         label: string;
         defaultBaseUrl: string;
-        baseUrlCredentialKey: string;
+        baseUrlCredentialKey: string | null;
         auth: string;
         credentialKeys: readonly string[];
         docsUrls: readonly string[];
@@ -201,7 +201,7 @@ export declare function fetchProviderApiDocs(options: {
         id: string;
         label: string;
         defaultBaseUrl: string;
-        baseUrlCredentialKey: any;
+        baseUrlCredentialKey: null;
         auth: string;
         credentialKeys: string[];
         docsUrls: string[];
@@ -220,10 +220,10 @@ export declare function fetchProviderApiDocs(options: {
 } | {
     provider: string;
     catalog: {
-        id: "amplitude" | "bigquery" | "sentry" | "posthog" | "mixpanel" | "github" | "slack" | "twitter" | "notion" | "gmail" | "google_drive" | "hubspot" | "granola" | "apollo" | "commonroom" | "dataforseo" | "ga4" | "gcloud" | "gong" | "google_calendar" | "grafana" | "jira" | "prometheus" | "pylon" | "stripe";
+        id: "amplitude" | "bigquery" | "sentry" | "posthog" | "mixpanel" | "github" | "slack" | "twitter" | "notion" | "jira" | "gmail" | "google_drive" | "hubspot" | "granola" | "apollo" | "commonroom" | "dataforseo" | "ga4" | "gcloud" | "gong" | "google_calendar" | "grafana" | "prometheus" | "pylon" | "stripe";
         label: string;
         defaultBaseUrl: string;
-        baseUrlCredentialKey: string;
+        baseUrlCredentialKey: string | null;
         auth: string;
         credentialKeys: readonly string[];
         docsUrls: readonly string[];
@@ -238,7 +238,7 @@ export declare function fetchProviderApiDocs(options: {
         id: string;
         label: string;
         defaultBaseUrl: string;
-        baseUrlCredentialKey: any;
+        baseUrlCredentialKey: null;
         auth: string;
         credentialKeys: string[];
         docsUrls: string[];
@@ -260,10 +260,10 @@ export declare function fetchProviderApiDocs(options: {
         ok: boolean;
         elapsedMs: number;
         headers: Record<string, string>;
-        contentType: string;
+        contentType: string | null;
         size: number;
         truncated: boolean;
-        text: string;
+        text: string | undefined;
         json: unknown;
     };
     guidance?: undefined;

package/dist/provider-api/index.js

@@ -1414,11 +1414,6 @@ function isAllowedProviderUrl(url, base, config) {
         return host === normalized || host.endsWith(`.${normalized}`);
     });
 }
-function sameOriginOrChild(candidate, allowed) {
-    return (candidate.origin === allowed.origin &&
-        (candidate.pathname === allowed.pathname ||
-            candidate.pathname.startsWith(allowed.pathname.replace(/\/?$/, "/"))));
-}
 function queryEntries(value) {
     if (!value)
         return [];