@arbium/enterprise-agent-connect 0.0.0-stage → 0.1.2-dev.9022f22

package/dist/packages/server/src/builtin.js

@@ -0,0 +1,42 @@
+import dellTechdirect from "../../../connectors/dell-techdirect/index.js";
+import dynamics365 from "../../../connectors/dynamics-365/index.js";
+import entra from "../../../connectors/entra/index.js";
+import fedex from "../../../connectors/fedex/index.js";
+import gong from "../../../connectors/gong/index.js";
+import intune from "../../../connectors/intune/index.js";
+import jamf from "../../../connectors/jamf/index.js";
+import jira from "../../../connectors/jira/index.js";
+import netsuite from "../../../connectors/netsuite/index.js";
+import okta from "../../../connectors/okta/index.js";
+import outlookCalendar from "../../../connectors/outlook-calendar/index.js";
+import outlookMail from "../../../connectors/outlook-mail/index.js";
+import salesforce from "../../../connectors/salesforce/index.js";
+import sapS4hana from "../../../connectors/sap-s4hana/index.js";
+import servicenow from "../../../connectors/servicenow/index.js";
+import sharepointFiles from "../../../connectors/sharepoint-files/index.js";
+import slack from "../../../connectors/slack/index.js";
+import teams from "../../../connectors/teams/index.js";
+import workday from "../../../connectors/workday/index.js";
+/** The code behind each connector folder in connectors/ (index.ts beside its connector.json). */
+export const builtinConnectors = [
+    jira,
+    outlookMail,
+    outlookCalendar,
+    sharepointFiles,
+    salesforce,
+    servicenow,
+    fedex,
+    dellTechdirect,
+    teams,
+    entra,
+    intune,
+    slack,
+    okta,
+    jamf,
+    sapS4hana,
+    workday,
+    netsuite,
+    dynamics365,
+    gong,
+];
+//# sourceMappingURL=builtin.js.map

package/dist/packages/server/src/builtin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"builtin.js","sourceRoot":"","sources":["../../../../packages/server/src/builtin.ts"],"names":[],"mappings":"AAAA,OAAO,cAAc,MAAM,8CAA8C,CAAC;AAC1E,OAAO,WAAW,MAAM,2CAA2C,CAAC;AACpE,OAAO,KAAK,MAAM,oCAAoC,CAAC;AACvD,OAAO,KAAK,MAAM,oCAAoC,CAAC;AACvD,OAAO,IAAI,MAAM,mCAAmC,CAAC;AACrD,OAAO,MAAM,MAAM,qCAAqC,CAAC;AACzD,OAAO,IAAI,MAAM,mCAAmC,CAAC;AACrD,OAAO,IAAI,MAAM,mCAAmC,CAAC;AACrD,OAAO,QAAQ,MAAM,uCAAuC,CAAC;AAC7D,OAAO,IAAI,MAAM,mCAAmC,CAAC;AACrD,OAAO,eAAe,MAAM,+CAA+C,CAAC;AAC5E,OAAO,WAAW,MAAM,2CAA2C,CAAC;AACpE,OAAO,UAAU,MAAM,yCAAyC,CAAC;AACjE,OAAO,SAAS,MAAM,yCAAyC,CAAC;AAChE,OAAO,UAAU,MAAM,yCAAyC,CAAC;AACjE,OAAO,eAAe,MAAM,+CAA+C,CAAC;AAC5E,OAAO,KAAK,MAAM,oCAAoC,CAAC;AACvD,OAAO,KAAK,MAAM,oCAAoC,CAAC;AACvD,OAAO,OAAO,MAAM,sCAAsC,CAAC;AAM3D,iGAAiG;AACjG,MAAM,CAAC,MAAM,iBAAiB,GAAoB;IAChD,IAAI;IACJ,WAAW;IACX,eAAe;IACf,eAAe;IACf,UAAU;IACV,UAAU;IACV,KAAK;IACL,cAAc;IACd,KAAK;IACL,KAAK;IACL,MAAM;IACN,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,SAAS;IACT,OAAO;IACP,QAAQ;IACR,WAAW;IACX,IAAI;CACL,CAAC"}

package/dist/packages/server/src/consent.d.ts

@@ -0,0 +1,27 @@
+export type ConsentState = {
+    org: string;
+    app: string;
+    ceiling: string[];
+    redirectUri: string;
+    tenant?: string;
+    nonce: string;
+    exp: number;
+};
+export declare const signInNonce: (nonce: string) => string;
+export declare function signState(key: Buffer, input: {
+    org: string;
+    app: string;
+    ceiling: string[];
+    redirectUri: string;
+    tenant?: string;
+}, now?: number, nonce?: string): {
+    state: string;
+    nonce: string;
+};
+export declare function verifyState(key: Buffer, state: string, expect: {
+    org: string;
+    app: string;
+    nonce: string;
+}, now?: number): ConsentState;
+/** The app a state names, unverified: only to choose what verifyState then checks it against. */
+export declare function stateApp(state: string): string | null;

package/dist/packages/server/src/consent.js

@@ -0,0 +1,36 @@
+import { createHash, createHmac, randomBytes } from "node:crypto";
+import { tokensEqual } from "./secrets.js";
+import { ConnectError } from "../../connector-kit/src/types.js";
+// The OpenID Connect nonce for the sign-in leg. Derived, so the browser-held nonce itself
+// never appears in a URL.
+export const signInNonce = (nonce) => createHash("sha256").update(`sign-in:${nonce}`).digest("base64url");
+const TTL_MS = 15 * 60 * 1000;
+const mac = (key, body) => createHmac("sha256", key).update(body).digest("base64url");
+export function signState(key, input, now = Date.now(), nonce = randomBytes(16).toString("base64url")) {
+    const body = Buffer.from(JSON.stringify({ ...input, nonce, exp: now + TTL_MS })).toString("base64url");
+    return { state: `${body}.${mac(key, body)}`, nonce };
+}
+export function verifyState(key, state, expect, now = Date.now()) {
+    const [body, sig, extra] = state.split(".");
+    if (!body || !sig || extra !== undefined || !tokensEqual(sig, mac(key, body)))
+        throw new ConnectError("This approval did not start here. Start again from Integrations.");
+    const parsed = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+    if (parsed.org !== expect.org ||
+        parsed.app !== expect.app ||
+        !tokensEqual(parsed.nonce, expect.nonce))
+        throw new ConnectError("This approval did not start here. Start again from Integrations.");
+    if (!(parsed.exp > now))
+        throw new ConnectError("This approval took too long. Start again.");
+    return parsed;
+}
+/** The app a state names, unverified: only to choose what verifyState then checks it against. */
+export function stateApp(state) {
+    try {
+        const app = JSON.parse(Buffer.from(state.split(".")[0], "base64url").toString("utf8")).app;
+        return typeof app === "string" ? app : null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=consent.js.map

package/dist/packages/server/src/consent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent.js","sourceRoot":"","sources":["../../../../packages/server/src/consent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAkBhE,0FAA0F;AAC1F,0BAA0B;AAC1B,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAa,EAAE,EAAE,CAC3C,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAEtE,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE9B,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,IAAY,EAAE,EAAE,CACxC,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAE7D,MAAM,UAAU,SAAS,CACvB,GAAW,EACX,KAA4F,EAC5F,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,EAChB,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;IAE7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,CACvF,WAAW,CACZ,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,GAAG,IAAI,IAAI,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,GAAW,EACX,KAAa,EACb,MAAmD,EACnD,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC3E,MAAM,IAAI,YAAY,CAAC,kEAAkE,CAAC,CAAC;IAC7F,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAiB,CAAC;IAC3F,IACE,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;QACzB,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;QACzB,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;QAExC,MAAM,IAAI,YAAY,CAAC,kEAAkE,CAAC,CAAC;IAC7F,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,2CAA2C,CAAC,CAAC;IAC7F,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC;QAC3F,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/packages/server/src/events/admin.d.ts

@@ -0,0 +1,156 @@
+import { z } from "zod";
+import type { Connector } from "../../../connector-kit/src/connector.js";
+import { type VendorRequest, type VendorResponse } from "../../../connector-kit/src/types.js";
+import type { CredentialKey } from "../secrets.js";
+import type { Store } from "../store.js";
+import { type TriggerRunner } from "../teams/runner.js";
+import type { EventsStore } from "./store.js";
+type Steps = NonNullable<NonNullable<Connector["events"]>["webhook"]>["setup"];
+export declare const subscriptionSchema: z.ZodObject<{
+    app: z.ZodString;
+    source: z.ZodEnum<{
+        webhook: "webhook";
+        poll: "poll";
+    }>;
+    filter: z.ZodDefault<z.ZodString>;
+    intervalSeconds: z.ZodDefault<z.ZodNumber>;
+    register: z.ZodDefault<z.ZodBoolean>;
+    by: z.ZodString;
+}, z.core.$strip>;
+export declare const eventTriggerSchema: z.ZodObject<{
+    enabled: z.ZodBoolean;
+    eventTypes: z.ZodArray<z.ZodString>;
+    conditions: z.ZodDefault<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+        field: z.ZodString;
+        in: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        field: z.ZodString;
+        notIn: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>]>>>;
+    prompt: z.ZodString;
+    runner: z.ZodDefault<z.ZodString>;
+    managedAgentId: z.ZodOptional<z.ZodString>;
+    environmentId: z.ZodOptional<z.ZodString>;
+    vaultIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    settings: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    signingSecret: z.ZodOptional<z.ZodString>;
+    budgetCents: z.ZodNumber;
+    maxRunsPerHour: z.ZodDefault<z.ZodNumber>;
+    maxCentsPerDay: z.ZodDefault<z.ZodNumber>;
+    maxConcurrent: z.ZodDefault<z.ZodNumber>;
+    by: z.ZodString;
+}, z.core.$strip>;
+export declare function createEventsAdmin(deps: {
+    store: Store;
+    events: EventsStore;
+    key: CredentialKey;
+    connectors: Map<string, Connector>;
+    appCall(org: string, app: string, request: VendorRequest): Promise<VendorResponse | null>;
+    runners: Map<string, TriggerRunner>;
+    publicUrl: string | null;
+}): {
+    subscriptions(org: string): Promise<{
+        url: string | null;
+        id: string;
+        connectorId: string;
+        source: "webhook" | "poll";
+        filter: string;
+        intervalSeconds: number;
+        cursor: string | null;
+        polledAt: string | null;
+        lastError: string | null;
+        registered: string | null;
+        createdBy: string;
+        createdAt: string;
+    }[]>;
+    /** The secret is in this answer only. */
+    subscribe(org: string, input: z.output<typeof subscriptionSchema>): Promise<{
+        subscription: {
+            url: string | null;
+            id: string;
+            connectorId: string;
+            source: "webhook" | "poll";
+            filter: string;
+            intervalSeconds: number;
+            cursor: string | null;
+            polledAt: string | null;
+            lastError: string | null;
+            registered: string | null;
+            createdBy: string;
+            createdAt: string;
+        };
+        secret: string | null;
+        setup: Steps;
+        registration: {
+            ok: boolean;
+            message: string;
+        } | null;
+    }>;
+    rotateSecret(org: string, subId: string, who: string): Promise<{
+        subscription: {
+            url: string | null;
+            id: string;
+            connectorId: string;
+            source: "webhook" | "poll";
+            filter: string;
+            intervalSeconds: number;
+            cursor: string | null;
+            polledAt: string | null;
+            lastError: string | null;
+            registered: string | null;
+            createdBy: string;
+            createdAt: string;
+        };
+        secret: string;
+    } | null>;
+    unsubscribe(org: string, subId: string, who: string): Promise<boolean>;
+    triggers(org: string, agentId: string): Promise<{
+        hasSigningSecret: boolean;
+        id: string;
+        agentId: string;
+        connectorId: string;
+        enabled: boolean;
+        eventTypes: string[];
+        conditions: import("./store.js").Condition[];
+        prompt: string;
+        runner: string;
+        settings: Record<string, unknown>;
+        managedAgentId: string | null;
+        environmentId: string | null;
+        vaultIds: string[];
+        budgetCents: number;
+        maxRunsPerHour: number;
+        maxCentsPerDay: number;
+        maxConcurrent: number;
+        updatedBy: string | null;
+        updatedAt: string;
+    }[]>;
+    setTrigger(org: string, agentId: string, app: string, input: z.output<typeof eventTriggerSchema>): Promise<{
+        hasSigningSecret: boolean;
+        id: string;
+        agentId: string;
+        connectorId: string;
+        enabled: boolean;
+        eventTypes: string[];
+        conditions: import("./store.js").Condition[];
+        prompt: string;
+        runner: string;
+        settings: Record<string, unknown>;
+        managedAgentId: string | null;
+        environmentId: string | null;
+        vaultIds: string[];
+        budgetCents: number;
+        maxRunsPerHour: number;
+        maxCentsPerDay: number;
+        maxConcurrent: number;
+        updatedBy: string | null;
+        updatedAt: string;
+    } | null>;
+    removeTrigger(org: string, agentId: string, app: string, who: string): Promise<boolean>;
+    runs(org: string, agentId: string, limit: number): Promise<import("./store.js").EventRunRow[]>;
+};
+export type EventsAdmin = ReturnType<typeof createEventsAdmin>;
+/** During a key rotation, moves every webhook and trigger secret still sealed with an old key
+ *  onto the current one. */
+export declare function resealEventSecrets(events: EventsStore, key: CredentialKey): Promise<number>;
+export {};

package/dist/packages/server/src/events/admin.js

@@ -0,0 +1,255 @@
+import { randomBytes, randomUUID } from "node:crypto";
+import { z } from "zod";
+import { brand } from "../../../connector-kit/src/branding.js";
+import { ConnectError, } from "../../../connector-kit/src/types.js";
+import { InvalidInput } from "../service.js";
+import { CLAUDE_RUNNER } from "../teams/runner.js";
+import { fill, rawAt } from "./deliver.js";
+import { eventTriggerAad, subscriptionAad } from "./runtime.js";
+const id = z.string().regex(/^[A-Za-z0-9_-]{1,128}$/);
+const by = z.string().trim().min(1).max(200);
+export const subscriptionSchema = z.object({
+    app: z.string().regex(/^[a-z0-9-]+$/),
+    source: z.enum(["webhook", "poll"]),
+    // In the app's own terms, e.g. Jira JQL: what it sends, or what a poll reads.
+    filter: z.string().max(2000).default(""),
+    intervalSeconds: z.number().int().min(60).max(86400).default(300),
+    // Webhooks: register it through the app's API with the connection, where the app allows.
+    register: z.boolean().default(false),
+    by,
+});
+const condition = z.union([
+    z.strictObject({ field: z.string(), in: z.array(z.string().max(500)).min(1).max(100) }),
+    z.strictObject({ field: z.string(), notIn: z.array(z.string().max(500)).min(1).max(100) }),
+]);
+export const eventTriggerSchema = z
+    .object({
+    enabled: z.boolean(),
+    eventTypes: z.array(z.string().max(100)).min(1).max(50),
+    // All must hold, on the event's fields (the app's `events.fields`).
+    conditions: z.array(condition).max(20).default([]),
+    // What the agent is asked to do; {app} and {event} are filled in. The event's data follows.
+    prompt: z.string().trim().min(1).max(4000),
+    runner: z
+        .string()
+        .regex(/^[a-z][a-z0-9-]{1,40}$/)
+        .default(CLAUDE_RUNNER),
+    managedAgentId: id.optional(),
+    environmentId: id.optional(),
+    vaultIds: z.array(id).max(20).default([]),
+    settings: z.record(z.string(), z.unknown()).default({}),
+    signingSecret: z.string().min(32).max(256).optional(),
+    budgetCents: z.number().int().min(1).max(2000),
+    maxRunsPerHour: z.number().int().min(1).max(100).default(20),
+    maxCentsPerDay: z.number().int().min(1).max(100_000).default(500),
+    maxConcurrent: z.number().int().min(1).max(10).default(2),
+    by,
+})
+    .refine((t) => t.maxCentsPerDay >= t.budgetCents, {
+    message: "The daily limit must be at least the limit per run",
+    path: ["maxCentsPerDay"],
+});
+export function createEventsAdmin(deps) {
+    const { store, events, key } = deps;
+    const log = (org, who, app, action, target) => store.audit({
+        organizationId: org,
+        agentId: null,
+        agentName: who,
+        connectorId: app,
+        tool: `admin:${action}`,
+        target,
+        decision: "allowed",
+        reason: null,
+        vendorStatus: null,
+    });
+    function eventsOf(app) {
+        const connector = deps.connectors.get(app);
+        if (!connector?.events)
+            throw new InvalidInput(`${app} has no events agents can start from`);
+        return { connector, events: connector.events };
+    }
+    const urlOf = (sub) => sub.source === "webhook" && deps.publicUrl ? `${deps.publicUrl}/events/${sub.id}` : null;
+    function publicSubscription(sub) {
+        const { secret: _s, secretKeyId: _k, organizationId: _o, ...rest } = sub;
+        return { ...rest, url: urlOf(sub) };
+    }
+    function publicTrigger(row) {
+        const { secret, secretKeyId: _k, ...rest } = row;
+        return { ...rest, hasSigningSecret: secret !== null };
+    }
+    const newSecret = () => randomBytes(32).toString("hex");
+    // Live runs of a trigger are stopped before it changes runner or goes.
+    async function stopRuns(org, triggerId, runner) {
+        for (const run of await events.runningRuns()) {
+            if (run.triggerId !== triggerId || (runner && run.runner !== runner))
+                continue;
+            await deps.runners.get(run.runner)?.stop(run.sessionId, org);
+            await events.updateRun(run.id, { state: "failed", error: "Stopped by an administrator" });
+        }
+    }
+    return {
+        async subscriptions(org) {
+            return (await events.subscriptions(org)).map(publicSubscription);
+        },
+        /** The secret is in this answer only. */
+        async subscribe(org, input) {
+            const { connector, events: declared } = eventsOf(input.app);
+            const hook = declared.webhook;
+            if (input.source === "webhook" && !hook)
+                throw new InvalidInput(`${connector.name} sends no webhooks; read it on an interval instead`);
+            if (input.source === "poll" && !declared.poll)
+                throw new InvalidInput(`${connector.name} cannot be read on an interval; use its webhook`);
+            if (!(await store.getConnection(org, input.app)))
+                throw new InvalidInput(`Connect ${connector.name} first`);
+            if (input.source === "webhook" && !deps.publicUrl)
+                throw new ConnectError("This deployment has no public address for the app to send to");
+            const subId = randomUUID();
+            const secret = input.source === "webhook" ? newSecret() : null;
+            const sealed = secret ? key.seal({ secret }, subscriptionAad(org, subId)) : null;
+            const sub = await events.createSubscription({
+                id: subId,
+                organizationId: org,
+                connectorId: input.app,
+                source: input.source,
+                secret: sealed?.ciphertext ?? null,
+                secretKeyId: sealed?.keyId ?? null,
+                filter: input.filter,
+                intervalSeconds: input.intervalSeconds,
+                // A poll starts from now: what changed before it is not news.
+                cursor: input.source === "poll" ? new Date().toISOString() : null,
+                createdBy: input.by,
+            });
+            if (!sub)
+                throw new InvalidInput(`${connector.name} already sends events here; remove that first`);
+            const url = urlOf(sub);
+            let registration = null;
+            if (input.register && hook?.register && url && secret) {
+                const res = await deps.appCall(org, input.app, fill(hook.register, {
+                    name: `${brand().productName} events`,
+                    url,
+                    secret,
+                    events: declared.types.map((t) => t.id),
+                    filter: input.filter,
+                }));
+                const location = res && res.status < 300 ? rawAt(res.data, hook.register.location) : null;
+                if (res && res.status >= 200 && res.status < 300) {
+                    await events.setRegistered(sub.id, typeof location === "string" ? location : "yes");
+                    registration = { ok: true, message: `Registered in ${connector.name}` };
+                }
+                else
+                    registration = {
+                        ok: false,
+                        message: `${connector.name} did not let its connection register the webhook (${res?.status ?? "not connected"}). Add it by hand with the steps.`,
+                    };
+            }
+            await log(org, input.by, input.app, "subscribe_events", `${input.source} ${sub.id}`);
+            const fresh = (await events.subscription(sub.id));
+            return {
+                subscription: publicSubscription(fresh),
+                secret,
+                setup: (input.source === "webhook" ? hook.setup : []).map((step) => fill(step, { url: url ?? "", filter: input.filter || "(none)" })),
+                registration,
+            };
+        },
+        async rotateSecret(org, subId, who) {
+            const sub = await events.subscription(subId);
+            if (!sub || sub.organizationId !== org || sub.source !== "webhook")
+                return null;
+            const secret = newSecret();
+            const sealed = key.seal({ secret }, subscriptionAad(org, subId));
+            if (!(await events.setSecret(org, subId, sealed.ciphertext, sealed.keyId)))
+                return null;
+            await log(org, who, sub.connectorId, "rotate_event_secret", subId);
+            return { subscription: publicSubscription(sub), secret };
+        },
+        async unsubscribe(org, subId, who) {
+            const sub = await events.deleteSubscription(org, subId);
+            if (sub)
+                await log(org, who, sub.connectorId, "unsubscribe_events", subId);
+            return sub !== null;
+        },
+        async triggers(org, agentId) {
+            return (await events.agentTriggers(org, agentId)).map(publicTrigger);
+        },
+        // Proven by its runner first, as Teams triggers are.
+        async setTrigger(org, agentId, app, input) {
+            const { connector, events: declared } = eventsOf(app);
+            const { by: who, signingSecret, settings: rawSettings, ...rest } = input;
+            const unknownType = rest.eventTypes.find((t) => !declared.types.some((x) => x.id === t));
+            if (unknownType)
+                throw new InvalidInput(`${connector.name} has no event ${unknownType}`);
+            const unknownField = rest.conditions.find((c) => !(c.field in declared.fields));
+            if (unknownField)
+                throw new InvalidInput(`${connector.name} events have no field ${unknownField.field}; they have ${Object.keys(declared.fields).join(", ")}`);
+            const runner = deps.runners.get(rest.runner);
+            if (!runner?.startEvent)
+                throw new InvalidInput(`This deployment offers no runner ${rest.runner} for app events`);
+            const settings = runner.settings.safeParse(rawSettings);
+            if (!settings.success)
+                throw new InvalidInput(z.prettifyError(settings.error));
+            if (!deps.publicUrl)
+                throw new ConnectError("This deployment has no public address");
+            const existing = await events.trigger(org, agentId, app);
+            const aad = eventTriggerAad(org, agentId, app);
+            const sealed = signingSecret
+                ? key.seal({ secret: signingSecret }, aad)
+                : existing?.secret
+                    ? { ciphertext: existing.secret, keyId: existing.secretKeyId }
+                    : null;
+            const row = {
+                ...rest,
+                agentId,
+                connectorId: app,
+                managedAgentId: rest.managedAgentId ?? null,
+                environmentId: rest.environmentId ?? null,
+                settings: settings.data,
+                secret: sealed?.ciphertext ?? null,
+                secretKeyId: sealed?.keyId ?? null,
+                updatedBy: who,
+            };
+            const secret = sealed ? key.open(sealed, aad).secret : null;
+            await runner.verify(row, org, secret, "save");
+            if (existing && existing.runner !== rest.runner)
+                await stopRuns(org, existing.id, existing.runner);
+            if (!(await events.setTrigger(org, row)))
+                return null;
+            await log(org, who, app, "set_event_trigger", `agent ${agentId} ${rest.enabled ? "on" : "off"} ${rest.eventTypes.join(", ")} runner ${rest.runner} budget ${rest.budgetCents}c`);
+            return publicTrigger((await events.trigger(org, agentId, app)));
+        },
+        async removeTrigger(org, agentId, app, who) {
+            const existing = await events.trigger(org, agentId, app);
+            if (!existing)
+                return false;
+            await stopRuns(org, existing.id);
+            if (!(await events.removeTrigger(org, agentId, app)))
+                return false;
+            await log(org, who, app, "remove_event_trigger", `agent ${agentId}`);
+            return true;
+        },
+        async runs(org, agentId, limit) {
+            return events.recentRuns(org, agentId, limit);
+        },
+    };
+}
+/** During a key rotation, moves every webhook and trigger secret still sealed with an old key
+ *  onto the current one. */
+export async function resealEventSecrets(events, key) {
+    if (!key.previousIds.length)
+        return 0;
+    const stale = await events.staleSecrets(key.id);
+    let n = 0;
+    for (const s of stale.subscriptions) {
+        const aad = subscriptionAad(s.organizationId, s.id);
+        const sealed = key.seal(key.open({ ciphertext: s.secret, keyId: s.secretKeyId }, aad), aad);
+        if (await events.reseal("event_subscriptions", s.id, s.secret, sealed.ciphertext, sealed.keyId))
+            n++;
+    }
+    for (const t of stale.triggers) {
+        const aad = eventTriggerAad(t.organizationId, t.agentId, t.connectorId);
+        const sealed = key.seal(key.open({ ciphertext: t.secret, keyId: t.secretKeyId }, aad), aad);
+        if (await events.reseal("event_triggers", t.id, t.secret, sealed.ciphertext, sealed.keyId))
+            n++;
+    }
+    return n;
+}
+//# sourceMappingURL=admin.js.map

package/dist/packages/server/src/events/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../../../../../packages/server/src/events/admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,KAAK,EAAE,MAAM,wCAAwC,CAAC;AAE/D,OAAO,EACL,YAAY,GAGb,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,EAAE,aAAa,EAAsB,MAAM,oBAAoB,CAAC;AACvE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAQhE,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;AACtD,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAE7C,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC;IACrC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACnC,8EAA8E;IAC9E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACxC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACjE,yFAAyF;IACzF,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACpC,EAAE;CACH,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC;IACxB,CAAC,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;IACvF,CAAC,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;CAC3F,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACvD,oEAAoE;IACpE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAClD,4FAA4F;IAC5F,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IAC1C,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,KAAK,CAAC,wBAAwB,CAAC;SAC/B,OAAO,CAAC,aAAa,CAAC;IACzB,cAAc,EAAE,EAAE,CAAC,QAAQ,EAAE;IAC7B,aAAa,EAAE,EAAE,CAAC,QAAQ,EAAE;IAC5B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACvD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACrD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IAC9C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACjE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,EAAE;CACH,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,WAAW,EAAE;IAChD,OAAO,EAAE,oDAAoD;IAC7D,IAAI,EAAE,CAAC,gBAAgB,CAAC;CACzB,CAAC,CAAC;AAEL,MAAM,UAAU,iBAAiB,CAAC,IAQjC;IACC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAEpC,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,GAAW,EAAE,GAAW,EAAE,MAAc,EAAE,MAAc,EAAE,EAAE,CACpF,KAAK,CAAC,KAAK,CAAC;QACV,cAAc,EAAE,GAAG;QACnB,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,GAAG;QACd,WAAW,EAAE,GAAG;QAChB,IAAI,EAAE,SAAS,MAAM,EAAE;QACvB,MAAM;QACN,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,IAAI;QACZ,YAAY,EAAE,IAAI;KACnB,CAAC,CAAC;IAEL,SAAS,QAAQ,CAAC,GAAW;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,SAAS,EAAE,MAAM;YAAE,MAAM,IAAI,YAAY,CAAC,GAAG,GAAG,sCAAsC,CAAC,CAAC;QAC7F,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;IACjD,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,GAAoB,EAAE,EAAE,CACrC,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,WAAW,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAE3F,SAAS,kBAAkB,CAAC,GAAoB;QAC9C,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;QACzE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;IACtC,CAAC;IAED,SAAS,aAAa,CAAC,GAAoB;QACzC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;QACjD,OAAO,EAAE,GAAG,IAAI,EAAE,gBAAgB,EAAE,MAAM,KAAK,IAAI,EAAE,CAAC;IACxD,CAAC;IAED,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAExD,uEAAuE;IACvE,KAAK,UAAU,QAAQ,CAAC,GAAW,EAAE,SAAiB,EAAE,MAAe;QACrE,KAAK,MAAM,GAAG,IAAI,MAAM,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;YAC7C,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC;gBAAE,SAAS;YAC/E,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,SAAU,EAAE,GAAG,CAAC,CAAC;YAC9D,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,CAAC,aAAa,CAAC,GAAW;YAC7B,OAAO,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACnE,CAAC;QAED,yCAAyC;QACzC,KAAK,CAAC,SAAS,CAAC,GAAW,EAAE,KAA0C;YACrE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5D,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC;YAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,IAAI;gBACrC,MAAM,IAAI,YAAY,CACpB,GAAG,SAAS,CAAC,IAAI,oDAAoD,CACtE,CAAC;YACJ,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI;gBAC3C,MAAM,IAAI,YAAY,CAAC,GAAG,SAAS,CAAC,IAAI,iDAAiD,CAAC,CAAC;YAC7F,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC9C,MAAM,IAAI,YAAY,CAAC,WAAW,SAAS,CAAC,IAAI,QAAQ,CAAC,CAAC;YAC5D,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS;gBAC/C,MAAM,IAAI,YAAY,CAAC,8DAA8D,CAAC,CAAC;YACzF,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAC/D,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACjF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC;gBAC1C,EAAE,EAAE,KAAK;gBACT,cAAc,EAAE,GAAG;gBACnB,WAAW,EAAE,KAAK,CAAC,GAAG;gBACtB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,MAAM,EAAE,UAAU,IAAI,IAAI;gBAClC,WAAW,EAAE,MAAM,EAAE,KAAK,IAAI,IAAI;gBAClC,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,8DAA8D;gBAC9D,MAAM,EAAE,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI;gBACjE,SAAS,EAAE,KAAK,CAAC,EAAE;aACpB,CAAC,CAAC;YACH,IAAI,CAAC,GAAG;gBACN,MAAM,IAAI,YAAY,CAAC,GAAG,SAAS,CAAC,IAAI,+CAA+C,CAAC,CAAC;YAC3F,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;YACvB,IAAI,YAAY,GAA4C,IAAI,CAAC;YACjE,IAAI,KAAK,CAAC,QAAQ,IAAI,IAAI,EAAE,QAAQ,IAAI,GAAG,IAAI,MAAM,EAAE,CAAC;gBACtD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAC5B,GAAG,EACH,KAAK,CAAC,GAAG,EACT,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE;oBAClB,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC,WAAW,SAAS;oBACrC,GAAG;oBACH,MAAM;oBACN,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvC,MAAM,EAAE,KAAK,CAAC,MAAM;iBACrB,CAAkB,CACpB,CAAC;gBACF,MAAM,QAAQ,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC1F,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;oBACjD,MAAM,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;oBACpF,YAAY,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,iBAAiB,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC1E,CAAC;;oBACC,YAAY,GAAG;wBACb,EAAE,EAAE,KAAK;wBACT,OAAO,EAAE,GAAG,SAAS,CAAC,IAAI,qDAAqD,GAAG,EAAE,MAAM,IAAI,eAAe,mCAAmC;qBACjJ,CAAC;YACN,CAAC;YACD,MAAM,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,EAAE,kBAAkB,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YACrF,MAAM,KAAK,GAAG,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAE,CAAC;YACnD,OAAO;gBACL,YAAY,EAAE,kBAAkB,CAAC,KAAK,CAAC;gBACvC,MAAM;gBACN,KAAK,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAClE,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC,CACxD;gBACV,YAAY;aACb,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,GAAW,EAAE,KAAa,EAAE,GAAW;YACxD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YAC7C,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YAChF,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;YACjE,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YACxF,MAAM,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE,qBAAqB,EAAE,KAAK,CAAC,CAAC;YACnE,OAAO,EAAE,YAAY,EAAE,kBAAkB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3D,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,GAAW,EAAE,KAAa,EAAE,GAAW;YACvD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACxD,IAAI,GAAG;gBAAE,MAAM,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE,oBAAoB,EAAE,KAAK,CAAC,CAAC;YAC3E,OAAO,GAAG,KAAK,IAAI,CAAC;QACtB,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,GAAW,EAAE,OAAe;YACzC,OAAO,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACvE,CAAC;QAED,qDAAqD;QACrD,KAAK,CAAC,UAAU,CACd,GAAW,EACX,OAAe,EACf,GAAW,EACX,KAA0C;YAE1C,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YACtD,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;YACzE,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;YACzF,IAAI,WAAW;gBAAE,MAAM,IAAI,YAAY,CAAC,GAAG,SAAS,CAAC,IAAI,iBAAiB,WAAW,EAAE,CAAC,CAAC;YACzF,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAChF,IAAI,YAAY;gBACd,MAAM,IAAI,YAAY,CACpB,GAAG,SAAS,CAAC,IAAI,yBAAyB,YAAY,CAAC,KAAK,eAAe,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACrH,CAAC;YACJ,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC7C,IAAI,CAAC,MAAM,EAAE,UAAU;gBACrB,MAAM,IAAI,YAAY,CAAC,oCAAoC,IAAI,CAAC,MAAM,iBAAiB,CAAC,CAAC;YAC3F,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;YACxD,IAAI,CAAC,QAAQ,CAAC,OAAO;gBAAE,MAAM,IAAI,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/E,IAAI,CAAC,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,YAAY,CAAC,uCAAuC,CAAC,CAAC;YACrF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YACzD,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YAC/C,MAAM,MAAM,GAAG,aAAa;gBAC1B,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,GAAG,CAAC;gBAC1C,CAAC,CAAC,QAAQ,EAAE,MAAM;oBAChB,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,WAAY,EAAE;oBAC/D,CAAC,CAAC,IAAI,CAAC;YACX,MAAM,GAAG,GAAG;gBACV,GAAG,IAAI;gBACP,OAAO;gBACP,WAAW,EAAE,GAAG;gBAChB,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,IAAI;gBAC3C,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,IAAI;gBACzC,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,MAAM,EAAE,MAAM,EAAE,UAAU,IAAI,IAAI;gBAClC,WAAW,EAAE,MAAM,EAAE,KAAK,IAAI,IAAI;gBAClC,SAAS,EAAE,GAAG;aACf,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;YAC5D,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAC9C,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;gBAC7C,MAAM,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YACpD,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YACtD,MAAM,GAAG,CACP,GAAG,EACH,GAAG,EACH,GAAG,EACH,mBAAmB,EACnB,SAAS,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,WAAW,IAAI,CAAC,WAAW,GAAG,CAClI,CAAC;YACF,OAAO,aAAa,CAAC,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAE,CAAC,CAAC;QACnE,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,GAAW,EAAE,OAAe,EAAE,GAAW,EAAE,GAAW;YACxE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YACzD,IAAI,CAAC,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAC5B,MAAM,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;YACjC,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;YACnE,MAAM,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,sBAAsB,EAAE,SAAS,OAAO,EAAE,CAAC,CAAC;YACrE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,OAAe,EAAE,KAAa;YACpD,OAAO,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC;AAID;4BAC4B;AAC5B,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAmB,EAAE,GAAkB;IAC9E,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,eAAe,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QAC5F,IAAI,MAAM,MAAM,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC;YAC7F,CAAC,EAAE,CAAC;IACR,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,eAAe,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QAC5F,IAAI,MAAM,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC;YAAE,CAAC,EAAE,CAAC;IAClG,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/packages/server/src/events/deliver.d.ts

@@ -0,0 +1,43 @@
+import type { ConnectorEvents } from "../../../connector-kit/src/connector.js";
+import type { Condition } from "./store.js";
+type Webhook = NonNullable<ConnectorEvents["webhook"]>;
+type Locator = Webhook["type"];
+export type Scalar = string | number | boolean;
+export type EventData = Record<string, Scalar | Scalar[] | null>;
+/** A dot path's value in JSON, as is (no `[]`). */
+export declare function rawAt(data: unknown, path: string): unknown;
+/** A path's value: the list of scalars for a path through `[]`, else one scalar or null.
+ *  Objects are left out; text is cut to 2000 characters, lists to 50 items. */
+export declare function valueAt(data: unknown, path: string): Scalar | Scalar[] | null;
+export declare function locate(at: Locator, body: unknown, headers: Headers): string | null;
+/** Whether the delivery carries the subscription's proof. Constant time for both kinds. */
+export declare function signed(verify: Webhook["verify"], secret: string, body: Buffer, headers: Headers): boolean;
+/** Within the replay window. A missing or unreadable time is not. */
+export declare function fresh(ts: NonNullable<Webhook["timestamp"]>, body: unknown, headers: Headers, now?: number): boolean;
+export declare const bodyHash: (body: Buffer) => string;
+/** The fields the connector keeps: all an agent, a condition or a limit ever reads. */
+export declare function pickFields(fields: Record<string, string>, body: unknown): EventData;
+/** The first of the agent's limits the event is outside of, or null. A limit left empty
+ *  allows everything; a set one needs every value of the event's field within it (an event
+ *  missing the field is outside it). */
+export declare function outsideLimits(eventLimits: Record<string, string>, data: EventData, limits: Record<string, unknown>): string | null;
+/** The first condition the event fails, or null. `in`: one of the field's values (any item of
+ *  a list) is listed; `notIn`: none is. */
+export declare function failedCondition(conditions: Condition[], data: EventData): Condition | null;
+/** Fills {name} placeholders in a request: a string that is only a placeholder takes the
+ *  value as is (a list stays a list), others have it written in. */
+export declare function fill(value: unknown, vars: Record<string, string | string[]>): unknown;
+/** The admin's instructions, then the event: its data quoted as untrusted, since people in
+ *  the app wrote it. Only trusted values ({app}, {event}: the app's name and the declared
+ *  event's label) are filled into the instructions. */
+export declare function eventPrompt(input: {
+    prompt: string;
+    appName: string;
+    type: {
+        id: string;
+        label: string;
+    };
+    deliveryId: string;
+    data: EventData;
+}): string;
+export {};