@agenticmail/enterprise 0.5.326 → 0.5.328

package/src/mcp/framework/types.ts

@@ -1,130 +0,0 @@
-/**
- * MCP Skill Framework — Shared Types
- *
- * Defines the interfaces that every skill adapter implements.
- * The framework handles boilerplate (auth, retry, circuit breaking, vault);
- * adapters focus on API endpoint mapping and response formatting.
- */
-
-// ─── Auth Configuration ─────────────────────────────────
-
-export type AuthType = 'oauth2' | 'api_key' | 'token' | 'credentials';
-
-export interface AuthConfig {
-  type: AuthType;
-
-  // oauth2
-  provider?: string;
-  scopes?: string[];
-
-  // api_key / token
-  headerName?: string;      // Default: 'Authorization'
-  headerPrefix?: string;    // Default: 'Bearer'
-  envVar?: string;
-
-  // credentials (multi-field, e.g. AWS accessKeyId + secretAccessKey)
-  fields?: string[];
-  envVars?: Record<string, string>;
-}
-
-export interface ResolvedCredentials {
-  type: AuthType;
-  accessToken?: string;
-  refreshToken?: string;
-  apiKey?: string;
-  token?: string;
-  fields?: Record<string, string>;
-  expiresAt?: Date;
-}
-
-// ─── API Executor ────────────────────────────────────────
-
-export interface ApiRequestOptions {
-  method: string;
-  url?: string;             // Full URL override
-  path?: string;            // Appended to adapter's baseUrl
-  headers?: Record<string, string>;
-  query?: Record<string, string>;
-  body?: any;
-  formEncoded?: boolean;    // Send as application/x-www-form-urlencoded
-  multipart?: boolean;      // Send as multipart/form-data
-  rawBody?: Buffer | Uint8Array;  // Pre-built body (bypass JSON/form serialization)
-  rawContentType?: string;  // Content-Type for rawBody
-  timeoutMs?: number;
-}
-
-export interface ApiExecutor {
-  get(path: string, query?: Record<string, string>): Promise<any>;
-  post(path: string, body?: any): Promise<any>;
-  put(path: string, body?: any): Promise<any>;
-  patch(path: string, body?: any): Promise<any>;
-  delete(path: string, query?: Record<string, string>): Promise<any>;
-  request(opts: ApiRequestOptions): Promise<any>;
-}
-
-// ─── Tool Handler ────────────────────────────────────────
-
-export interface ToolResult {
-  /** Text content returned to the LLM */
-  content: string;
-  /** Structured data for activity logging */
-  metadata?: Record<string, any>;
-  /** Mark as error */
-  isError?: boolean;
-}
-
-export interface ToolExecutionContext {
-  credentials: ResolvedCredentials;
-  skillConfig: Record<string, any>;
-  orgId: string;
-  agentId: string;
-  apiExecutor: ApiExecutor;
-}
-
-export interface ToolHandler {
-  /** JSON Schema for the tool's input parameters */
-  inputSchema: Record<string, any>;
-  /** Human-readable description for the LLM */
-  description?: string;
-  /** Execute the tool */
-  execute(params: Record<string, any>, ctx: ToolExecutionContext): Promise<ToolResult>;
-}
-
-// ─── Config Schema ──────────────────────────────────────
-
-export interface ConfigField {
-  type: 'string' | 'number' | 'boolean' | 'select' | 'secret';
-  label: string;
-  description?: string;
-  required?: boolean;
-  default?: any;
-  placeholder?: string;
-  options?: { label: string; value: string }[];
-}
-
-// ─── Skill Adapter ───────────────────────────────────────
-
-export interface SkillAdapter {
-  /** Must match the community-skills manifest id */
-  skillId: string;
-  /** Human-readable skill name */
-  name: string;
-  /** Base URL for all API calls (e.g. 'https://slack.com/api') */
-  baseUrl: string;
-  /** Auth configuration — matches manifest auth block */
-  auth: AuthConfig;
-  /** Extra default headers sent with every request */
-  defaultHeaders?: Record<string, string>;
-  /** Tool implementations keyed by tool ID */
-  tools: Record<string, ToolHandler>;
-  /** Called once after credentials are resolved (e.g. set dynamic base URL) */
-  initialize?(credentials: ResolvedCredentials): Promise<void>;
-  /** Per-adapter rate limits for proactive throttling */
-  rateLimits?: {
-    requestsPerSecond?: number;
-    requestsPerMinute?: number;
-    burstLimit?: number;
-  };
-  /** JSON Schema for configurable fields (rendered in dashboard) */
-  configSchema?: Record<string, ConfigField>;
-}

package/src/mcp/index.ts

@@ -1,124 +0,0 @@
-#!/usr/bin/env node
-/**
- * AgenticMail Enterprise — Community Skills MCP Server
- *
- * Unified MCP server that serves all installed community skill tools.
- * Each skill has a thin adapter; the framework handles auth, retry,
- * circuit breaking, and credential management via the vault.
- *
- * Usage:
- *   AGENTICMAIL_ENGINE_URL=http://localhost:3200 \
- *   AGENTICMAIL_ORG_ID=default \
- *   AGENTICMAIL_AGENT_ID=agent-1 \
- *   AGENTICMAIL_VAULT_KEY=your-vault-key \
- *   node dist/mcp/index.js
- */
-
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import { SecureVault } from '../engine/vault.js';
-import { SkillMcpFramework } from './framework/skill-mcp-framework.js';
-import { allAdapters } from './adapters/index.js';
-
-const ORG_ID = process.env.AGENTICMAIL_ORG_ID ?? 'default';
-const AGENT_ID = process.env.AGENTICMAIL_AGENT_ID ?? 'mcp-skills';
-
-async function main() {
-  // ─── Initialize vault ──────────────────────────────────
-  const vault = new SecureVault();
-  // Vault reads AGENTICMAIL_VAULT_KEY from env and decrypts in-memory
-
-  // ─── Load installed skill configs ────────────────────────
-  let skillConfigs: Record<string, Record<string, any>> = {};
-  const engineUrl = process.env.AGENTICMAIL_ENGINE_URL;
-  if (engineUrl) {
-    try {
-      const resp = await fetch(`${engineUrl}/api/engine/community/installed?orgId=${ORG_ID}`);
-      if (resp.ok) {
-        const data = await resp.json() as { installed?: Array<{ skillId: string; config?: Record<string, any> }> };
-        for (const inst of data.installed || []) {
-          if (inst.config && Object.keys(inst.config).length > 0) {
-            skillConfigs[inst.skillId] = inst.config;
-          }
-        }
-        console.error(`[mcp-skills] Loaded configs for ${Object.keys(skillConfigs).length} skill(s)`);
-      }
-    } catch (err: any) {
-      console.error(`[mcp-skills] Could not load skill configs: ${err.message}`);
-    }
-  }
-
-  // ─── Initialize framework ──────────────────────────────
-  const framework = new SkillMcpFramework({
-    vault,
-    orgId: ORG_ID,
-    agentId: AGENT_ID,
-    skillConfigs,
-  });
-
-  // Register all available adapters
-  framework.registerAll(allAdapters);
-
-  // Initialize: resolve credentials, build executors
-  const initialized = await framework.initialize();
-
-  const totalTools = Array.from(initialized.values()).reduce((sum, t) => sum + t.length, 0);
-  console.error(
-    `[mcp-skills] Ready: ${initialized.size} skills, ${totalTools} tools`,
-  );
-
-  // ─── Create MCP server ─────────────────────────────────
-  const server = new McpServer({
-    name: 'AgenticMail Enterprise Skills',
-    version: '0.3.2',
-    description: 'Community skill integrations for AgenticMail AI agents',
-  });
-
-  // Register all initialized tools
-  const tools = framework.getTools();
-  for (const tool of tools) {
-    server.tool(
-      tool.toolId,
-      tool.description,
-      tool.inputSchema,
-      async (args: any) => {
-        const result = await tool.handler(args as Record<string, any>);
-        return {
-          content: [{ type: 'text' as const, text: result.content }],
-          isError: result.isError,
-        };
-      },
-    );
-  }
-
-  // ─── Status resource ───────────────────────────────────
-  server.resource(
-    'skill-status',
-    'agenticmail://skills/status',
-    { description: 'Status of all registered community skill adapters', mimeType: 'application/json' },
-    async () => ({
-      contents: [{
-        uri: 'agenticmail://skills/status',
-        text: JSON.stringify(framework.getStatus(), null, 2),
-        mimeType: 'application/json',
-      }],
-    }),
-  );
-
-  // ─── Start stdio transport ─────────────────────────────
-  const transport = new StdioServerTransport();
-  await server.connect(transport);
-
-  // Graceful shutdown
-  const shutdown = async () => {
-    try { await server.close(); } catch { /* ignore */ }
-    process.exit(0);
-  };
-  process.on('SIGTERM', shutdown);
-  process.on('SIGINT', shutdown);
-}
-
-main().catch((err) => {
-  console.error('[mcp-skills] Fatal:', err);
-  process.exit(1);
-});

package/src/mcp/integration-catalog.ts

@@ -1,178 +0,0 @@
-/**
- * Integration Catalog — Auto-generated from MCP adapters.
- * Single source of truth for all 3rd-party integrations.
- * Used by dashboard Integrations tab and MCP bridge credential resolution.
- */
-
-export interface IntegrationEntry {
-  skillId: string;
-  name: string;
-  authType: "oauth2" | "api_key" | "token" | "credentials";
-  category: string;
-  toolCount: number;
-  /** For credentials type: required field names */
-  fields?: string[];
-  /** Human-readable labels for credential fields */
-  fieldLabels?: Record<string, string>;
-  /** OAuth provider key (for oauth2 type) — maps to OAUTH_PROVIDERS registry */
-  oauthProvider?: string;
-  /** OAuth scopes hint for this specific skill */
-  oauthScopes?: string[];
-}
-
-export const INTEGRATION_CATALOG: IntegrationEntry[] = [
-  { skillId: "activecampaign", name: "ActiveCampaign", authType: "credentials", category: "marketing", toolCount: 5, fields: ["apiKey", "accountName"], fieldLabels: { apiKey: "API Key", accountName: "Account Name (subdomain before .api-us1.com)" } },
-  { skillId: "adobe-sign", name: "Adobe Acrobat Sign", authType: "oauth2", category: "design", toolCount: 5, oauthProvider: "adobe" },
-  { skillId: "adp", name: "ADP Workforce", authType: "oauth2", category: "hr", toolCount: 5, oauthProvider: "adp" },
-  { skillId: "airtable-bases", name: "Airtable", authType: "oauth2", category: "productivity", toolCount: 3, oauthProvider: "airtable" },
-  { skillId: "apollo-io", name: "Apollo.io Sales Intelligence", authType: "api_key", category: "crm", toolCount: 5 },
-  { skillId: "asana-tasks", name: "Asana", authType: "oauth2", category: "productivity", toolCount: 4, oauthProvider: "asana" },
-  { skillId: "auth0", name: "Auth0", authType: "credentials", category: "security", toolCount: 5, fields: ["token", "domain"], fieldLabels: { token: "Management API Token", domain: "Auth0 Domain (e.g. mycompany.auth0.com)" } },
-  { skillId: "aws-services", name: "AWS Services", authType: "credentials", category: "infrastructure", toolCount: 3, fields: ["accessKeyId", "secretAccessKey", "region"], fieldLabels: { accessKeyId: "Access Key ID", secretAccessKey: "Secret Access Key", region: "Region (e.g. us-east-1)" } },
-  { skillId: "azure-devops", name: "Azure DevOps", authType: "credentials", category: "devops", toolCount: 5, fields: ["token", "organization"], fieldLabels: { token: "Personal Access Token", organization: "Organization Name" } },
-  { skillId: "bamboohr", name: "BambooHR", authType: "credentials", category: "hr", toolCount: 5, fields: ["apiKey", "companyDomain"], fieldLabels: { apiKey: "API Key", companyDomain: "Company Subdomain (e.g. mycompany)" } },
-  { skillId: "basecamp", name: "Basecamp", authType: "oauth2", category: "productivity", toolCount: 5, oauthProvider: "basecamp" },
-  { skillId: "bigcommerce", name: "BigCommerce", authType: "credentials", category: "ecommerce", toolCount: 5, fields: ["accessToken", "storeHash"], fieldLabels: { accessToken: "Access Token", storeHash: "Store Hash" } },
-  { skillId: "bitbucket-repos", name: "Bitbucket", authType: "oauth2", category: "devops", toolCount: 3, oauthProvider: "atlassian" },
-  { skillId: "box", name: "Box", authType: "oauth2", category: "design", toolCount: 5, oauthProvider: "box" },
-  { skillId: "brex", name: "Brex", authType: "token", category: "finance", toolCount: 5 },
-  { skillId: "buffer", name: "Buffer Social Media", authType: "oauth2", category: "marketing", toolCount: 5, oauthProvider: "buffer" },
-  { skillId: "calendly", name: "Calendly", authType: "token", category: "communication", toolCount: 4 },
-  { skillId: "canva-design", name: "Canva", authType: "oauth2", category: "design", toolCount: 3, oauthProvider: "canva" },
-  { skillId: "chargebee", name: "Chargebee", authType: "credentials", category: "finance", toolCount: 5, fields: ["apiKey", "siteName"], fieldLabels: { apiKey: "API Key", siteName: "Site Name (subdomain)" } },
-  { skillId: "circleci-pipelines", name: "CircleCI", authType: "token", category: "devops", toolCount: 3 },
-  { skillId: "clickup", name: "ClickUp", authType: "token", category: "productivity", toolCount: 5 },
-  { skillId: "close-crm", name: "Close CRM", authType: "api_key", category: "crm", toolCount: 5 },
-  { skillId: "cloudflare-cdn", name: "Cloudflare", authType: "credentials", category: "infrastructure", toolCount: 4, fields: ["token", "accountId"], fieldLabels: { token: "API Token", accountId: "Account ID" } },
-  { skillId: "confluence-wiki", name: "Confluence", authType: "oauth2", category: "productivity", toolCount: 3, oauthProvider: "atlassian" },
-  { skillId: "contentful", name: "Contentful CMS", authType: "token", category: "marketing", toolCount: 5 },
-  { skillId: "copper-crm", name: "Copper CRM", authType: "api_key", category: "crm", toolCount: 5 },
-  { skillId: "crisp", name: "Crisp Chat", authType: "credentials", category: "communication", toolCount: 5, fields: ["identifier", "key"], fieldLabels: { identifier: "Identifier (Plugin ID)", key: "API Key" } },
-  { skillId: "crowdstrike", name: "CrowdStrike", authType: "oauth2", category: "security", toolCount: 5, oauthProvider: "crowdstrike" },
-  { skillId: "datadog-monitoring", name: "Datadog", authType: "credentials", category: "monitoring", toolCount: 4, fields: ["apiKey", "applicationKey"], fieldLabels: { apiKey: "API Key", applicationKey: "Application Key" } },
-  { skillId: "digitalocean", name: "DigitalOcean", authType: "token", category: "infrastructure", toolCount: 5 },
-  { skillId: "discord", name: "Discord", authType: "token", category: "communication", toolCount: 4 },
-  { skillId: "docker-containers", name: "Docker Hub", authType: "token", category: "devops", toolCount: 3 },
-  { skillId: "docusign-esign", name: "DocuSign", authType: "oauth2", category: "finance", toolCount: 3, oauthProvider: "docusign" },
-  { skillId: "drift", name: "Drift Conversational Marketing", authType: "oauth2", category: "communication", toolCount: 5, oauthProvider: "drift" },
-  { skillId: "dropbox-storage", name: "Dropbox", authType: "oauth2", category: "productivity", toolCount: 4, oauthProvider: "dropbox" },
-  { skillId: "figma-design", name: "Figma", authType: "oauth2", category: "design", toolCount: 4, oauthProvider: "figma" },
-  { skillId: "firebase", name: "Firebase", authType: "oauth2", category: "data-ai", toolCount: 5, oauthProvider: "google" },
-  { skillId: "flyio", name: "Fly.io", authType: "token", category: "infrastructure", toolCount: 5 },
-  { skillId: "freshbooks", name: "FreshBooks", authType: "oauth2", category: "finance", toolCount: 5, oauthProvider: "freshbooks" },
-  { skillId: "freshdesk", name: "Freshdesk Support", authType: "credentials", category: "crm", toolCount: 5, fields: ["apiKey", "domain"], fieldLabels: { apiKey: "API Key", domain: "Domain (e.g. mycompany.freshdesk.com)" } },
-  { skillId: "freshsales", name: "Freshsales CRM", authType: "credentials", category: "crm", toolCount: 5, fields: ["token", "domain"], fieldLabels: { token: "API Token", domain: "Domain (e.g. mycompany.myfreshworks.com)" } },
-  { skillId: "freshservice", name: "Freshservice ITSM", authType: "credentials", category: "general", toolCount: 5, fields: ["apiKey", "domain"], fieldLabels: { apiKey: "API Key", domain: "Domain (e.g. mycompany.freshservice.com)" } },
-  { skillId: "front", name: "Front", authType: "token", category: "communication", toolCount: 5 },
-  { skillId: "github-actions", name: "GitHub Actions", authType: "oauth2", category: "devops", toolCount: 4, oauthProvider: "github" },
-  { skillId: "github", name: "GitHub", authType: "oauth2", category: "devops", toolCount: 5, oauthProvider: "github" },
-  { skillId: "gitlab-ci", name: "GitLab", authType: "oauth2", category: "devops", toolCount: 5, oauthProvider: "gitlab" },
-  { skillId: "gong", name: "Gong Revenue Intelligence", authType: "token", category: "crm", toolCount: 5 },
-  { skillId: "google-ads", name: "Google Ads", authType: "oauth2", category: "marketing", toolCount: 3, oauthProvider: "google" },
-  { skillId: "google-analytics", name: "Google Analytics", authType: "oauth2", category: "monitoring", toolCount: 3, oauthProvider: "google" },
-  { skillId: "google-cloud", name: "Google Cloud Platform", authType: "oauth2", category: "infrastructure", toolCount: 3, oauthProvider: "google" },
-  { skillId: "gotomeeting", name: "GoTo Meeting", authType: "oauth2", category: "communication", toolCount: 4, oauthProvider: "gotomeeting" },
-  { skillId: "grafana", name: "Grafana", authType: "credentials", category: "monitoring", toolCount: 5, fields: ["apiKey", "instanceUrl"], fieldLabels: { apiKey: "API Key", instanceUrl: "Instance URL (e.g. https://grafana.example.com)" } },
-  { skillId: "greenhouse", name: "Greenhouse Recruiting", authType: "api_key", category: "hr", toolCount: 5 },
-  { skillId: "gusto", name: "Gusto Payroll", authType: "oauth2", category: "hr", toolCount: 5, oauthProvider: "gusto" },
-  { skillId: "hashicorp-vault", name: "HashiCorp Vault", authType: "credentials", category: "infrastructure", toolCount: 5, fields: ["token", "vaultUrl"], fieldLabels: { token: "Vault Token", vaultUrl: "Vault URL (e.g. https://vault.example.com)" } },
-  { skillId: "heroku", name: "Heroku", authType: "token", category: "infrastructure", toolCount: 5 },
-  { skillId: "hibob", name: "HiBob", authType: "token", category: "hr", toolCount: 5 },
-  { skillId: "hootsuite", name: "Hootsuite", authType: "oauth2", category: "marketing", toolCount: 5, oauthProvider: "hootsuite" },
-  { skillId: "hubspot-crm", name: "HubSpot CRM", authType: "oauth2", category: "crm", toolCount: 5, oauthProvider: "hubspot" },
-  { skillId: "huggingface", name: "HuggingFace", authType: "token", category: "data-ai", toolCount: 5 },
-  { skillId: "intercom-support", name: "Intercom Support", authType: "oauth2", category: "communication", toolCount: 3, oauthProvider: "intercom" },
-  { skillId: "jira", name: "Jira", authType: "oauth2", category: "general", toolCount: 5, oauthProvider: "atlassian" },
-  { skillId: "klaviyo", name: "Klaviyo", authType: "api_key", category: "marketing", toolCount: 5 },
-  { skillId: "kubernetes-cluster", name: "Kubernetes", authType: "credentials", category: "infrastructure", toolCount: 4, fields: ["token", "clusterUrl"], fieldLabels: { token: "Service Account Token", clusterUrl: "Cluster API URL (e.g. https://k8s.example.com:6443)" } },
-  { skillId: "lattice", name: "Lattice Performance", authType: "api_key", category: "hr", toolCount: 5 },
-  { skillId: "launchdarkly", name: "LaunchDarkly", authType: "api_key", category: "devops", toolCount: 5 },
-  { skillId: "lever", name: "Lever Recruiting", authType: "oauth2", category: "hr", toolCount: 5, oauthProvider: "lever" },
-  { skillId: "linear", name: "Linear", authType: "oauth2", category: "general", toolCount: 3, oauthProvider: "linear" },
-  { skillId: "linkedin", name: "LinkedIn", authType: "oauth2", category: "social", toolCount: 5, oauthProvider: "linkedin" },
-  { skillId: "livechat", name: "LiveChat", authType: "token", category: "communication", toolCount: 4 },
-  { skillId: "loom-video", name: "Loom", authType: "token", category: "communication", toolCount: 4 },
-  { skillId: "mailchimp-campaigns", name: "Mailchimp", authType: "oauth2", category: "communication", toolCount: 4, oauthProvider: "mailchimp" },
-  { skillId: "mailgun", name: "Mailgun", authType: "credentials", category: "communication", toolCount: 5, fields: ["apiKey", "domain"], fieldLabels: { apiKey: "API Key", domain: "Sending Domain (e.g. mg.example.com)" } },
-  { skillId: "miro-boards", name: "Miro", authType: "oauth2", category: "communication", toolCount: 4, oauthProvider: "miro" },
-  { skillId: "mixpanel-analytics", name: "Mixpanel", authType: "credentials", category: "monitoring", toolCount: 3, fields: ["projectToken", "apiSecret"], fieldLabels: { projectToken: "Project Token", apiSecret: "API Secret" } },
-  { skillId: "monday-boards", name: "Monday.com", authType: "oauth2", category: "productivity", toolCount: 3, oauthProvider: "monday" },
-  { skillId: "mongodb-atlas", name: "MongoDB Atlas", authType: "credentials", category: "data-ai", toolCount: 5, fields: ["publicKey", "privateKey"], fieldLabels: { publicKey: "Public Key", privateKey: "Private Key" } },
-  { skillId: "neon", name: "Neon Serverless Postgres", authType: "api_key", category: "data-ai", toolCount: 5 },
-  { skillId: "netlify", name: "Netlify", authType: "token", category: "infrastructure", toolCount: 5 },
-  { skillId: "netsuite", name: "NetSuite ERP", authType: "oauth2", category: "finance", toolCount: 5, oauthProvider: "netsuite" },
-  { skillId: "newrelic", name: "New Relic", authType: "api_key", category: "monitoring", toolCount: 5 },
-  { skillId: "notion", name: "Notion", authType: "oauth2", category: "productivity", toolCount: 3, oauthProvider: "notion" },
-  { skillId: "okta", name: "Okta Identity", authType: "credentials", category: "security", toolCount: 5, fields: ["apiToken", "domain"], fieldLabels: { apiToken: "API Token", domain: "Okta Domain (e.g. mycompany.okta.com)" } },
-  { skillId: "openai", name: "OpenAI", authType: "api_key", category: "data-ai", toolCount: 5 },
-  { skillId: "opsgenie", name: "OpsGenie", authType: "api_key", category: "monitoring", toolCount: 5 },
-  { skillId: "outreach", name: "Outreach Sales Engagement", authType: "oauth2", category: "crm", toolCount: 5, oauthProvider: "outreach" },
-  { skillId: "paddle", name: "Paddle", authType: "api_key", category: "finance", toolCount: 5 },
-  { skillId: "pagerduty", name: "PagerDuty", authType: "api_key", category: "monitoring", toolCount: 5 },
-  { skillId: "pandadoc", name: "PandaDoc", authType: "api_key", category: "design", toolCount: 5 },
-  { skillId: "paypal", name: "PayPal", authType: "oauth2", category: "finance", toolCount: 5, oauthProvider: "paypal" },
-  { skillId: "personio", name: "Personio", authType: "token", category: "hr", toolCount: 5 },
-  { skillId: "pinecone", name: "Pinecone", authType: "api_key", category: "data-ai", toolCount: 5 },
-  { skillId: "pipedrive-deals", name: "Pipedrive Deals", authType: "api_key", category: "crm", toolCount: 3 },
-  { skillId: "plaid", name: "Plaid", authType: "credentials", category: "finance", toolCount: 5, fields: ["clientId", "secret", "environment"], fieldLabels: { clientId: "Client ID", secret: "Secret", environment: "Environment (sandbox, development, or production)" } },
-  { skillId: "postmark", name: "Postmark", authType: "api_key", category: "communication", toolCount: 5 },
-  { skillId: "power-automate", name: "Microsoft Power Automate", authType: "oauth2", category: "enterprise", toolCount: 5, oauthProvider: "microsoft" },
-  { skillId: "quickbooks-accounting", name: "QuickBooks", authType: "oauth2", category: "finance", toolCount: 4, oauthProvider: "quickbooks" },
-  { skillId: "recurly", name: "Recurly", authType: "api_key", category: "finance", toolCount: 5 },
-  { skillId: "reddit", name: "Reddit", authType: "oauth2", category: "social", toolCount: 5, oauthProvider: "reddit" },
-  { skillId: "render", name: "Render", authType: "api_key", category: "infrastructure", toolCount: 5 },
-  { skillId: "ringcentral", name: "RingCentral", authType: "oauth2", category: "communication", toolCount: 4, oauthProvider: "ringcentral" },
-  { skillId: "rippling", name: "Rippling HR", authType: "token", category: "hr", toolCount: 5 },
-  { skillId: "salesforce", name: "Salesforce", authType: "oauth2", category: "crm", toolCount: 5, oauthProvider: "salesforce" },
-  { skillId: "salesloft", name: "SalesLoft", authType: "oauth2", category: "crm", toolCount: 5, oauthProvider: "salesloft" },
-  { skillId: "sanity", name: "Sanity CMS", authType: "credentials", category: "marketing", toolCount: 5, fields: ["token", "projectId"], fieldLabels: { token: "API Token", projectId: "Project ID" } },
-  { skillId: "sap", name: "SAP S/4HANA", authType: "oauth2", category: "enterprise", toolCount: 5, oauthProvider: "sap" },
-  { skillId: "segment-cdp", name: "Segment", authType: "token", category: "monitoring", toolCount: 3 },
-  { skillId: "sendgrid-email", name: "SendGrid Email", authType: "api_key", category: "communication", toolCount: 3 },
-  { skillId: "sentry", name: "Sentry Error Tracking", authType: "token", category: "monitoring", toolCount: 5 },
-  { skillId: "servicenow", name: "ServiceNow", authType: "oauth2", category: "enterprise", toolCount: 5, oauthProvider: "servicenow" },
-  { skillId: "shopify", name: "Shopify", authType: "credentials", category: "ecommerce", toolCount: 5, fields: ["accessToken", "storeName"], fieldLabels: { accessToken: "Admin API Access Token", storeName: "Store Name (e.g. mystore from mystore.myshopify.com)" } },
-  { skillId: "shortcut", name: "Shortcut", authType: "api_key", category: "productivity", toolCount: 5 },
-  { skillId: "slack", name: "Slack", authType: "oauth2", category: "communication", toolCount: 6, oauthProvider: "slack" },
-  { skillId: "smartsheet", name: "Smartsheet", authType: "token", category: "productivity", toolCount: 5 },
-  { skillId: "snowflake-warehouse", name: "Snowflake", authType: "credentials", category: "infrastructure", toolCount: 4, fields: ["account", "username", "password"], fieldLabels: { account: "Account Identifier", username: "Username", password: "Password" } },
-  { skillId: "snyk", name: "Snyk Security", authType: "api_key", category: "security", toolCount: 5 },
-  { skillId: "splunk", name: "Splunk", authType: "credentials", category: "monitoring", toolCount: 5, fields: ["token", "instanceUrl"], fieldLabels: { token: "Bearer Token", instanceUrl: "Splunk Instance URL (e.g. https://splunk.example.com:8089)" } },
-  { skillId: "square", name: "Square", authType: "oauth2", category: "finance", toolCount: 5, oauthProvider: "square" },
-  { skillId: "statuspage", name: "Atlassian Statuspage", authType: "api_key", category: "monitoring", toolCount: 5 },
-  { skillId: "stripe", name: "Stripe", authType: "api_key", category: "finance", toolCount: 5 },
-  { skillId: "supabase", name: "Supabase", authType: "credentials", category: "data-ai", toolCount: 5, fields: ["apiKey", "projectRef"], fieldLabels: { apiKey: "API Key (anon or service_role)", projectRef: "Project Reference ID" } },
-  { skillId: "teamwork", name: "Teamwork", authType: "credentials", category: "productivity", toolCount: 5, fields: ["token", "siteName"], fieldLabels: { token: "API Token", siteName: "Site Name (e.g. mycompany from mycompany.teamwork.com)" } },
-  { skillId: "telegram-bot", name: "Telegram Bot", authType: "api_key", category: "communication", toolCount: 4 },
-  { skillId: "terraform-iac", name: "Terraform Cloud", authType: "token", category: "infrastructure", toolCount: 3 },
-  { skillId: "todoist-tasks", name: "Todoist", authType: "oauth2", category: "productivity", toolCount: 4, oauthProvider: "todoist" },
-  { skillId: "trello-cards", name: "Trello", authType: "credentials", category: "productivity", toolCount: 4, fields: ["apiKey", "token"], fieldLabels: { apiKey: "API Key", token: "Token" } },
-  { skillId: "twilio-sms", name: "Twilio SMS", authType: "credentials", category: "communication", toolCount: 3, fields: ["accountSid", "authToken"], fieldLabels: { accountSid: "Account SID", authToken: "Auth Token" } },
-  { skillId: "twitter", name: "Twitter/X", authType: "oauth2", category: "social", toolCount: 5, oauthProvider: "twitter" },
-  { skillId: "vercel-deployments", name: "Vercel", authType: "oauth2", category: "devops", toolCount: 3, oauthProvider: "vercel" },
-  { skillId: "weaviate", name: "Weaviate", authType: "credentials", category: "data-ai", toolCount: 5, fields: ["apiKey", "clusterUrl"], fieldLabels: { apiKey: "API Key", clusterUrl: "Cluster URL (e.g. https://mycluster.weaviate.network)" } },
-  { skillId: "webex", name: "Webex", authType: "oauth2", category: "communication", toolCount: 4, oauthProvider: "webex" },
-  { skillId: "webflow", name: "Webflow", authType: "oauth2", category: "marketing", toolCount: 5, oauthProvider: "webflow" },
-  { skillId: "whatsapp-business", name: "WhatsApp Business", authType: "token", category: "communication", toolCount: 4 },
-  { skillId: "whereby", name: "Whereby", authType: "api_key", category: "communication", toolCount: 4 },
-  { skillId: "woocommerce", name: "WooCommerce", authType: "credentials", category: "ecommerce", toolCount: 5, fields: ["consumerKey", "consumerSecret", "siteUrl"], fieldLabels: { consumerKey: "Consumer Key", consumerSecret: "Consumer Secret", siteUrl: "Store URL (e.g. https://mystore.com)" } },
-  { skillId: "wordpress", name: "WordPress", authType: "credentials", category: "cms", toolCount: 5, fields: ["token", "siteUrl"], fieldLabels: { token: "Application Password", siteUrl: "Site URL (e.g. https://mysite.com)" } },
-  { skillId: "workday", name: "Workday", authType: "oauth2", category: "hr", toolCount: 5, oauthProvider: "workday" },
-  { skillId: "wrike", name: "Wrike", authType: "oauth2", category: "productivity", toolCount: 5, oauthProvider: "wrike" },
-  { skillId: "xero", name: "Xero Accounting", authType: "oauth2", category: "finance", toolCount: 5, oauthProvider: "xero" },
-  { skillId: "youtube", name: "YouTube", authType: "oauth2", category: "social", toolCount: 5, oauthProvider: "google" },
-  { skillId: "zendesk-tickets", name: "Zendesk Tickets", authType: "oauth2", category: "crm", toolCount: 4, oauthProvider: "zendesk" },
-  { skillId: "zoho-crm", name: "Zoho CRM", authType: "oauth2", category: "crm", toolCount: 6, oauthProvider: "zoho" },
-  { skillId: "zoom-meetings", name: "Zoom Meetings", authType: "oauth2", category: "communication", toolCount: 3, oauthProvider: "zoom" },
-  { skillId: "zuora", name: "Zuora", authType: "oauth2", category: "finance", toolCount: 5, oauthProvider: "zuora" },
-];
-
-export const INTEGRATION_MAP = new Map(INTEGRATION_CATALOG.map(e => [e.skillId, e]));
-
-/** Get all integrations in a category */
-export function getIntegrationsByCategory(category: string): IntegrationEntry[] {
-  return INTEGRATION_CATALOG.filter(e => e.category === category);
-}
-
-/** All unique categories */
-export const INTEGRATION_CATEGORIES = [...new Set(INTEGRATION_CATALOG.map(e => e.category))];

package/src/middleware/dns-rebinding.ts

@@ -1,44 +0,0 @@
-/**
- * AgenticMail Enterprise — DNS Rebinding Protection
- *
- * Validates the Host header against a configured allowlist to prevent
- * DNS rebinding attacks. Reads config from centralized network config.
- */
-
-import type { MiddlewareHandler } from 'hono';
-import { getNetworkConfig } from './network-config.js';
-
-/**
- * DNS rebinding protection middleware.
- * Rejects requests whose Host header doesn't match configured allowed hosts.
- */
-export function dnsRebindingProtection(): MiddlewareHandler {
-  return async (c, next) => {
-    const config = await getNetworkConfig();
-    const dns = config.dnsRebinding;
-
-    if (!dns?.enabled || !dns.allowedHosts?.length) return next();
-
-    const host = c.req.header('host')?.split(':')[0]?.toLowerCase();
-    if (!host) return next(); // No host header — likely internal
-
-    const allowed = dns.allowedHosts.some(h => {
-      const pattern = h.toLowerCase();
-      if (pattern === host) return true;
-      if (pattern.startsWith('*.')) {
-        const suffix = pattern.slice(1);
-        return host.endsWith(suffix) || host === pattern.slice(2);
-      }
-      return false;
-    });
-
-    if (!allowed) {
-      return c.json(
-        { error: 'Invalid Host header', code: 'DNS_REBINDING_BLOCKED' },
-        403,
-      );
-    }
-
-    return next();
-  };
-}

package/src/middleware/egress-filter.ts

@@ -1,104 +0,0 @@
-/**
- * AgenticMail Enterprise — Outbound Egress Filter
- *
- * Controls which external hosts and ports agent tool HTTP calls
- * are allowed to reach. Supports allowlist and blocklist modes
- * with wildcard host patterns (e.g., "*.example.com").
- *
- * Now supports hot-reload via centralized network config.
- */
-
-import type { FirewallConfig } from '../db/adapter.js';
-import { hostMatchesPattern } from '../lib/cidr.js';
-import { onNetworkConfigChange, getNetworkConfigSync } from './network-config.js';
-
-export interface EgressFilter {
-  /** Throws if the outbound URL is blocked by policy. */
-  validateOutbound(url: string): void;
-}
-
-// ─── Singleton Egress Filter (hot-reloaded) ─────────────
-
-let _currentConfig: FirewallConfig['egress'] | undefined;
-
-onNetworkConfigChange((config) => {
-  _currentConfig = config.egress;
-});
-
-function _validate(url: string, config?: FirewallConfig['egress']): void {
-  if (!config?.enabled) return;
-
-  let parsed: URL;
-  try {
-    parsed = new URL(url);
-  } catch {
-    throw new Error(`Outbound request blocked by egress policy: invalid URL "${url}"`);
-  }
-
-  const host = parsed.hostname;
-  const port = parsed.port
-    ? parseInt(parsed.port, 10)
-    : parsed.protocol === 'https:' ? 443 : 80;
-
-  const mode = config.mode || 'blocklist';
-
-  // Host filtering
-  if (mode === 'allowlist') {
-    const allowed = (config.allowedHosts || []).some((pattern) =>
-      hostMatchesPattern(host, pattern),
-    );
-    if (!allowed) {
-      throw new Error(
-        `Outbound request to ${host}:${port} blocked by egress policy (host not in allowlist)`,
-      );
-    }
-  } else if (mode === 'blocklist') {
-    const blocked = (config.blockedHosts || []).some((pattern) =>
-      hostMatchesPattern(host, pattern),
-    );
-    if (blocked) {
-      throw new Error(
-        `Outbound request to ${host}:${port} blocked by egress policy (host in blocklist)`,
-      );
-    }
-  }
-
-  // Port filtering
-  if (config.allowedPorts && config.allowedPorts.length > 0) {
-    if (!config.allowedPorts.includes(port)) {
-      throw new Error(
-        `Outbound request to ${host}:${port} blocked by egress policy (port ${port} not in allowed ports)`,
-      );
-    }
-  }
-
-  if (config.blockedPorts && config.blockedPorts.length > 0) {
-    if (config.blockedPorts.includes(port)) {
-      throw new Error(
-        `Outbound request to ${host}:${port} blocked by egress policy (port ${port} blocked)`,
-      );
-    }
-  }
-}
-
-/**
- * Create an egress filter from explicit config (for backward compat).
- */
-export function createEgressFilter(
-  config?: FirewallConfig['egress'],
-): EgressFilter {
-  return {
-    validateOutbound(url: string): void {
-      _validate(url, config);
-    },
-  };
-}
-
-/**
- * Global egress filter that reads from the centralized network config.
- * Use this in agent tools — always up to date with dashboard settings.
- */
-export function validateEgress(url: string): void {
-  const config = _currentConfig || getNetworkConfigSync().egress;
-  _validate(url, config);
-}