@assemblyline-agents/core 0.1.0

package/dist/plugin.js

@@ -0,0 +1,830 @@
+import { LEGACY_PLUGIN_EXPORT_NAME, PLUGIN_EXPORT_NAME, readAliasedExport } from "./brand.js";
+import { defineMcpClientConnection, defineMcpRelayConnection, defineMcpStdioConnection, defineOpenAPIConnection, defineSandboxCliConnection } from "./definitions.js";
+export function definePlugin(module) {
+    return module;
+}
+/**
+ * Reads `assemblyLinePlugin` (falling back to the legacy `openevePlugin`
+ * name) from a dynamically imported module namespace. Exporting both names
+ * with different values is a packaging error.
+ */
+export function pluginModuleFromImport(imported) {
+    const candidates = [imported, imported?.default];
+    for (const candidate of candidates) {
+        if (!candidate || typeof candidate !== "object")
+            continue;
+        const { value, conflict } = readAliasedExport(candidate, PLUGIN_EXPORT_NAME, LEGACY_PLUGIN_EXPORT_NAME);
+        if (conflict) {
+            throw new Error(`Module exports both ${PLUGIN_EXPORT_NAME} and ${LEGACY_PLUGIN_EXPORT_NAME} with different values; export one (they are aliases).`);
+        }
+        if (isPluginModule(value))
+            return value;
+    }
+    return undefined;
+}
+/**
+ * Provider packages use this factory instead of implementing transport or
+ * credential plumbing. The developer still owns the provider application,
+ * token/OAuth grant, and any required MCP bridge.
+ */
+export function defineMcpPluginConnection(plugin, options) {
+    if (plugin.protocol !== "mcp") {
+        throw new Error(`${plugin.helper}: ${plugin.provider} uses OpenAPI; call defineOpenAPIPluginConnection instead.`);
+    }
+    if ((plugin.transport ?? "http") !== "http") {
+        throw new Error(`${plugin.helper}: ${plugin.provider} uses stdio; call defineStdioMcpPluginConnection instead.`);
+    }
+    validatePluginAccess(plugin, options.access);
+    const url = options.url ?? environmentValue(plugin.urlEnv) ?? plugin.defaultUrl;
+    if (!url)
+        throw new Error(`${plugin.helper}: set ${plugin.urlEnv ?? "a connection URL"} or pass url.`);
+    const definition = {
+        transport: "http",
+        url,
+        description: options.description ?? plugin.description,
+        access: pluginAccessDefinition(plugin, options.access),
+        required: options.required ?? true,
+        subject: options.subject ?? plugin.subject ?? "user",
+        metadata: {
+            provider: plugin.provider,
+            plugin: plugin.packageName ?? plugin.provider,
+            ...(options.metadata ?? {})
+        }
+    };
+    const auth = options.auth === false || plugin.tokenHeader
+        ? (options.auth === false ? undefined : options.auth)
+        : options.auth ?? (plugin.tokenRequired === false ? undefined : tokenAuth(plugin.tokenEnv));
+    if (auth)
+        definition.auth = auth;
+    const tokenHeaders = options.auth === undefined && plugin.tokenHeader
+        ? tokenHeader(plugin.tokenHeader, plugin.tokenEnv)
+        : undefined;
+    const headers = mergeHeaders(tokenHeaders, options.headers);
+    if (headers)
+        definition.headers = headers;
+    const tools = options.tools ?? cloneToolFilter(plugin.tools);
+    if (tools)
+        definition.tools = tools;
+    return defineMcpClientConnection(definition);
+}
+export function defineStdioMcpPluginConnection(plugin, options) {
+    if (plugin.protocol !== "mcp" || plugin.transport !== "stdio") {
+        throw new Error(`${plugin.helper}: ${plugin.provider} uses HTTP; call defineMcpPluginConnection instead.`);
+    }
+    validatePluginAccess(plugin, options.access);
+    const definition = {
+        transport: "stdio",
+        command: options.command,
+        ...(options.args ? { args: [...options.args] } : {}),
+        ...(options.cwd ? { cwd: options.cwd } : {}),
+        ...(options.env ? { env: { ...options.env } } : {}),
+        description: options.description ?? plugin.description,
+        access: pluginAccessDefinition(plugin, options.access),
+        required: options.required ?? true,
+        subject: options.subject ?? plugin.subject ?? "environment",
+        metadata: {
+            provider: plugin.provider,
+            plugin: plugin.packageName ?? plugin.provider,
+            ...(options.metadata ?? {})
+        }
+    };
+    const tools = options.tools ?? cloneToolFilter(plugin.tools);
+    if (tools)
+        definition.tools = tools;
+    return defineMcpStdioConnection(definition);
+}
+export function defineRelayMcpPluginConnection(plugin, options) {
+    if (plugin.protocol !== "mcp" || plugin.transport !== "relay") {
+        throw new Error(`${plugin.helper}: ${plugin.provider} does not use the OpenEve relay transport.`);
+    }
+    validatePluginAccess(plugin, options.access);
+    const url = options.url ?? environmentValue(plugin.urlEnv) ?? plugin.defaultUrl;
+    if (!url)
+        throw new Error(`${plugin.helper}: set ${plugin.urlEnv ?? "a relay URL"} or pass url.`);
+    const credentialEnv = options.credentialEnv ?? plugin.credentialEnv;
+    if (!credentialEnv)
+        throw new Error(`${plugin.helper}: relay metadata must declare credentialEnv.`);
+    const definition = {
+        transport: "relay",
+        url,
+        credentialEnv,
+        ...(options.timeoutMs !== undefined ? { timeoutMs: options.timeoutMs } : {}),
+        description: options.description ?? plugin.description,
+        access: pluginAccessDefinition(plugin, options.access),
+        required: options.required ?? true,
+        subject: options.subject ?? plugin.subject ?? "environment",
+        metadata: {
+            provider: plugin.provider,
+            plugin: plugin.packageName ?? plugin.provider,
+            ...(options.metadata ?? {})
+        }
+    };
+    const tools = options.tools ?? cloneToolFilter(plugin.tools);
+    if (tools)
+        definition.tools = tools;
+    return defineMcpRelayConnection(definition);
+}
+/** Build a direct HTTP API connection from a provider's reviewed OpenAPI metadata. */
+export function defineOpenAPIPluginConnection(plugin, options) {
+    if (plugin.protocol !== "openapi") {
+        throw new Error(`${plugin.helper}: ${plugin.provider} uses MCP; call defineMcpPluginConnection instead.`);
+    }
+    validatePluginAccess(plugin, options.access);
+    const spec = options.spec ?? environmentValue(plugin.specEnv) ?? plugin.defaultSpec;
+    if (!spec)
+        throw new Error(`${plugin.helper}: set ${plugin.specEnv ?? "an OpenAPI specification"} or pass spec.`);
+    const baseUrl = options.baseUrl ?? environmentValue(plugin.baseUrlEnv) ?? plugin.defaultBaseUrl;
+    const definition = {
+        spec,
+        ...(baseUrl ? { baseUrl } : {}),
+        description: options.description ?? plugin.description,
+        access: pluginAccessDefinition(plugin, options.access),
+        required: options.required ?? true,
+        subject: options.subject ?? plugin.subject ?? "user",
+        metadata: {
+            provider: plugin.provider,
+            plugin: plugin.packageName ?? plugin.provider,
+            ...(options.metadata ?? {})
+        }
+    };
+    const auth = options.auth === false
+        ? undefined
+        : options.auth ?? (plugin.tokenRequired === false ? undefined : tokenAuth(plugin.tokenEnv));
+    if (auth)
+        definition.auth = auth;
+    if (options.headers)
+        definition.headers = options.headers;
+    const operations = options.operations ?? cloneToolFilter(plugin.tools);
+    if (operations)
+        definition.operations = operations;
+    return defineOpenAPIConnection(definition);
+}
+/**
+ * Build a connection whose reviewed operations run through a provider CLI in
+ * the agent sandbox rather than on the OpenEve gateway host.
+ */
+export function defineSandboxCliPluginConnection(plugin, options) {
+    if (plugin.protocol !== "cli" || plugin.transport !== "sandbox") {
+        throw new Error(`${plugin.helper}: ${plugin.provider} does not use the sandbox CLI transport.`);
+    }
+    validatePluginAccess(plugin, options.access);
+    const command = options.command ?? plugin.command;
+    if (!command)
+        throw new Error(`${plugin.helper}: sandbox CLI metadata must declare command.`);
+    return defineSandboxCliConnection({
+        transport: "sandbox",
+        command,
+        description: options.description ?? plugin.description,
+        tools: options.tools,
+        access: pluginAccessDefinition(plugin, options.access),
+        ...(options.auth ? { auth: options.auth } : {}),
+        ...(options.maxOutputChars !== undefined ? { maxOutputChars: options.maxOutputChars } : {}),
+        required: options.required ?? true,
+        subject: options.subject ?? plugin.subject ?? "environment",
+        metadata: {
+            provider: plugin.provider,
+            plugin: plugin.packageName ?? plugin.provider,
+            ...(options.metadata ?? {})
+        }
+    });
+}
+export function connectionPluginMetadata(kind) {
+    return CONNECTION_PLUGIN_CATALOG.find((entry) => entry.kind === kind);
+}
+export function connectionPluginMetadataForHelper(helper) {
+    return helper ? CONNECTION_PLUGIN_CATALOG.find((entry) => entry.helper === helper) : undefined;
+}
+export function allConnectionPluginMetadata() {
+    return CONNECTION_PLUGIN_CATALOG.map(cloneMetadata);
+}
+const READ_PATTERNS = [
+    "regex:(^|[-_])(search|read|list|fetch|get|retrieve|query|lookup|find|describe|details?|discover)([-_]|$)"
+];
+const WRITE_PATTERNS = [
+    "regex:(^|[-_])(add|append|archive|assign|book|buy|cancel|checkout|close|complete|create|delete|draft|duplicate|edit|execute|insert|invite|kick|link|merge|modify|move|mutate|open|pay|post|publish|purchase|push|react|reaction|remove|rename|reply|reserve|resolve|reopen|run|schedule|send|set|share|submit|transfer|transition|unassign|unlink|update|upload|write)([-_]|$)"
+];
+function catalogEntry(input) {
+    const requiredEnv = [
+        ...(input.urlEnv && !input.defaultUrl ? [input.urlEnv] : []),
+        ...(input.tokenEnv && input.tokenRequired !== false ? [input.tokenEnv] : []),
+        ...(input.credentialEnv ? [input.credentialEnv] : [])
+    ];
+    const optionalEnv = [
+        ...(input.urlEnv && input.defaultUrl ? [input.urlEnv] : []),
+        ...(input.tokenEnv && input.tokenRequired === false ? [input.tokenEnv] : []),
+        ...(input.optionalEnv ?? [])
+    ];
+    return {
+        kind: input.kind,
+        role: "connection",
+        packageName: input.packageName ?? `@assemblyline-agents/${input.kind}`,
+        helper: input.helper,
+        protocol: "mcp",
+        transport: input.transport ?? "http",
+        provider: input.provider ?? input.kind,
+        description: input.description,
+        ...(input.defaultUrl ? { defaultUrl: input.defaultUrl } : {}),
+        ...(input.urlEnv ? { urlEnv: input.urlEnv } : {}),
+        ...(input.tokenEnv ? { tokenEnv: input.tokenEnv } : {}),
+        ...(input.tokenEnv ? { tokenRequired: input.tokenRequired !== false } : {}),
+        ...(input.tokenHeader ? { tokenHeader: input.tokenHeader } : {}),
+        ...(input.credentialEnv ? { credentialEnv: input.credentialEnv } : {}),
+        requiredEnv,
+        optionalEnv,
+        capabilities: ["mcp", "live-tools", input.transport === "stdio" ? "stdio" : input.transport === "relay" ? "e2ee-device-relay" : "streamable-http"],
+        scopes: [...(input.scopes ?? [])],
+        subject: input.subject ?? "user",
+        ...(input.tools ? { tools: cloneToolFilter(input.tools) } : {}),
+        ...(input.hostRequirements ? { hostRequirements: cloneHostRequirements(input.hostRequirements) } : {}),
+        readToolPatterns: input.readToolPatterns ?? READ_PATTERNS,
+        writeToolPatterns: input.writeToolPatterns ?? (input.write ? WRITE_PATTERNS : []),
+        skill: input.kind,
+        setup: [{
+                kind: "connection",
+                name: `${input.kind}-developer-configuration`,
+                required: true,
+                message: input.setupMessage ?? `Configure ${input.displayName} credentials, OAuth application, or MCP bridge for this deployment.`
+            }]
+    };
+}
+const HIGGSFIELD_PLUGIN = {
+    kind: "higgsfield",
+    role: "connection",
+    packageName: "@assemblyline-agents/higgsfield",
+    helper: "defineHiggsfieldConnection",
+    protocol: "cli",
+    transport: "sandbox",
+    provider: "higgsfield",
+    description: "Higgsfield creative media generation, analysis, and editing through the official CLI inside the agent sandbox.",
+    command: "higgsfield",
+    requiredEnv: [],
+    optionalEnv: [],
+    capabilities: ["sandbox-cli", "native-file-inputs", "media-generation", "video-analysis", "video-editing"],
+    scopes: [],
+    subject: "user",
+    readToolPatterns: ["read"],
+    writeToolPatterns: ["write"],
+    skills: [
+        "higgsfield-generate",
+        "higgsfield-soul-id",
+        "higgsfield-product-photoshoot"
+    ],
+    setup: [{
+            kind: "sandbox",
+            name: "higgsfield-cli",
+            required: true,
+            message: "Install the official Higgsfield CLI in the sandbox image with `curl -fsSL https://raw.githubusercontent.com/higgsfield-ai/cli/main/install.sh | sh`, then run `higgsfield auth login` interactively inside each persistent, user-scoped sandbox. Do not bake account credentials into a shared image. Higgsfield generation and editing consume account credits."
+        }]
+};
+const MIRROR_PLUGIN = {
+    kind: "mirror",
+    role: "connection",
+    packageName: "@assemblyline-agents/mirror",
+    helper: "defineMirrorConnection",
+    protocol: "mcp",
+    transport: "http",
+    provider: "mirror",
+    description: "User-scoped connected accounts, mirrored source records, live reads, and approval-gated actions through Mirror.",
+    defaultUrl: "https://mirror.artificialillumination.co/mcp",
+    urlEnv: "MIRROR_MCP_URL",
+    requiredEnv: ["MIRROR_OAUTH_CLIENT_ID"],
+    optionalEnv: ["MIRROR_MCP_URL", "MIRROR_OAUTH_ISSUER", "MIRROR_OAUTH_REDIRECT_URI"],
+    capabilities: ["mcp", "oauth", "pkce", "live-tools", "streamable-http", "connected-accounts", "approval-gated-writes"],
+    scopes: [],
+    subject: "user",
+    tools: {
+        allow: [
+            "mirror.connected_providers",
+            "mirror.connected_provider_call",
+            "mirror.create_connections_link",
+            "mirror.query_records",
+            "mirror.get_source",
+            "mirror.live_read",
+            "mirror.sync_now",
+            "mirror.request_action",
+            "mirror.get_pending_approvals",
+            "mirror.approve_code",
+            "mirror.agentcash_wallet_export",
+            "mirror.register_agent",
+            "mirror.whoami"
+        ]
+    },
+    readToolPatterns: [
+        "mirror.connected_providers",
+        "mirror.query_records",
+        "mirror.get_source",
+        "mirror.live_read",
+        "mirror.get_pending_approvals",
+        "mirror.whoami"
+    ],
+    writeToolPatterns: [
+        "mirror.connected_provider_call",
+        "mirror.create_connections_link",
+        "mirror.sync_now",
+        "mirror.request_action",
+        "mirror.approve_code",
+        "mirror.agentcash_wallet_export",
+        "mirror.register_agent"
+    ],
+    skill: "mirror",
+    setup: [{
+            kind: "connection",
+            name: "mirror-oauth-configuration",
+            required: true,
+            message: "Choose a stable public client id for this agent, set MIRROR_OAUTH_CLIENT_ID, and deploy with a reachable OpenEve connection callback URL. Mirror uses OAuth Authorization Code + PKCE and stores provider credentials behind the user's Mirror account."
+        }]
+};
+const PROVENANCE_PLUGIN = {
+    kind: "provenance",
+    role: "connection",
+    packageName: "@assemblyline-agents/provenance",
+    helper: "defineProvenanceConnection",
+    protocol: "mcp",
+    transport: "http",
+    provider: "provenance",
+    description: "User-scoped append-only agent evidence, session reconstruction, tool traces, handoff bundles, and artifacts through Provenance.",
+    defaultUrl: "https://provenance.artificialillumination.co/mcp",
+    urlEnv: "PROVENANCE_MCP_URL",
+    requiredEnv: ["PROVENANCE_OAUTH_CLIENT_ID"],
+    optionalEnv: [
+        "PROVENANCE_MCP_URL",
+        "PROVENANCE_OAUTH_ISSUER",
+        "PROVENANCE_OAUTH_REDIRECT_URI",
+        "PROVENANCE_AGENT_ID",
+        "PROVENANCE_AGENT_NAME",
+        "PROVENANCE_AGENT_RUNTIME"
+    ],
+    capabilities: ["mcp", "oauth", "pkce", "live-tools", "streamable-http", "append-only-ledger", "agent-handoffs"],
+    scopes: ["provenance:ledger"],
+    subject: "user",
+    tools: {
+        allow: [
+            "provenance.search_events",
+            "provenance.get_event",
+            "provenance.get_event_range",
+            "provenance.get_turn_trace",
+            "provenance.get_tool_trace",
+            "provenance.get_related_events",
+            "provenance.list_sessions",
+            "provenance.handoff_bundle",
+            "provenance.get_artifact",
+            "provenance.get_session_definition",
+            "provenance.register_agent",
+            "provenance.list_agents",
+            "provenance.agent_activity"
+        ]
+    },
+    readToolPatterns: [
+        "provenance.search_events",
+        "provenance.get_event",
+        "provenance.get_event_range",
+        "provenance.get_turn_trace",
+        "provenance.get_tool_trace",
+        "provenance.get_related_events",
+        "provenance.list_sessions",
+        "provenance.handoff_bundle",
+        "provenance.get_artifact",
+        "provenance.get_session_definition",
+        "provenance.list_agents",
+        "provenance.agent_activity"
+    ],
+    writeToolPatterns: ["provenance.register_agent"],
+    skills: [
+        "provenance-reconstruction",
+        "provenance-handoff-bundle",
+        "provenance-ambient-capture"
+    ],
+    setup: [{
+            kind: "connection",
+            name: "provenance-oauth-configuration",
+            required: true,
+            message: "Register this OpenEve deployment as a Provenance public OAuth client with its exact /openeve/connections/callback URI, then set PROVENANCE_OAUTH_CLIENT_ID. Provenance uses Authorization Code + PKCE and binds the issued token to the authenticated user and agent identity."
+        }]
+};
+const CONNECTION_PLUGIN_CATALOG = [
+    HIGGSFIELD_PLUGIN,
+    MIRROR_PLUGIN,
+    PROVENANCE_PLUGIN,
+    {
+        kind: "arcads",
+        role: "connection",
+        packageName: "@assemblyline-agents/arcads",
+        helper: "defineArcadsConnection",
+        protocol: "mcp",
+        transport: "http",
+        provider: "arcads",
+        description: "Arcads media analysis, generation, and editing through the official hosted MCP server.",
+        defaultUrl: "https://mcp.arcads.ai",
+        requiredEnv: ["ARCADS_MCP_CLIENT_ID"],
+        optionalEnv: ["ARCADS_MCP_REDIRECT_URI"],
+        capabilities: ["mcp", "oauth", "live-tools", "streamable-http"],
+        scopes: ["mcp", "offline_access"],
+        subject: "user",
+        readToolPatterns: [
+            "regex:^arcads_(get_(?!upload_url$)|list|search|watch)"
+        ],
+        writeToolPatterns: [
+            "arcads_get_upload_url",
+            "regex:^arcads_(?!get_(?!upload_url$)|list|search|watch).+"
+        ],
+        skill: "arcads",
+        setup: [{
+                kind: "connection",
+                name: "arcads-oauth-configuration",
+                required: true,
+                message: "Register an OAuth client with https://api.arcads.ai/oauth/register, set ARCADS_MCP_CLIENT_ID, and register the OpenEve connection callback URL. Arcads generation and editing consume account credits."
+            }]
+    },
+    catalogEntry({
+        kind: "gmail",
+        displayName: "Gmail",
+        helper: "defineGmailConnection",
+        description: "Gmail threads, messages, attachments, drafts, and sends through an independently authorized MCP connection.",
+        urlEnv: "GMAIL_MCP_URL",
+        tokenEnv: "GMAIL_MCP_TOKEN",
+        scopes: [
+            "openid",
+            "email",
+            "profile",
+            "https://www.googleapis.com/auth/gmail.readonly",
+            "https://www.googleapis.com/auth/gmail.compose",
+            "https://www.googleapis.com/auth/gmail.send"
+        ],
+        readToolPatterns: ["rest_get", ...READ_PATTERNS],
+        writeToolPatterns: ["rest_request", ...WRITE_PATTERNS],
+        write: true,
+        setupMessage: "Configure a Gmail-only OAuth grant or MCP bridge for this deployment. Do not reuse an umbrella Google grant that also exposes Calendar or Drive."
+    }),
+    catalogEntry({
+        kind: "google-calendar",
+        displayName: "Google Calendar",
+        helper: "defineGoogleCalendarConnection",
+        provider: "google_calendar",
+        description: "Google Calendar events, availability, and event changes through an independently authorized MCP connection.",
+        urlEnv: "GOOGLE_CALENDAR_MCP_URL",
+        tokenEnv: "GOOGLE_CALENDAR_MCP_TOKEN",
+        scopes: [
+            "openid",
+            "email",
+            "profile",
+            "https://www.googleapis.com/auth/calendar.readonly",
+            "https://www.googleapis.com/auth/calendar.events"
+        ],
+        readToolPatterns: ["rest_get", ...READ_PATTERNS],
+        writeToolPatterns: ["rest_request", ...WRITE_PATTERNS],
+        write: true,
+        setupMessage: "Configure a Google Calendar-only OAuth grant or MCP bridge for this deployment. Do not reuse an umbrella Google grant that also exposes Gmail or Drive."
+    }),
+    catalogEntry({
+        kind: "google-drive",
+        displayName: "Google Drive",
+        helper: "defineGoogleDriveConnection",
+        provider: "google_drive",
+        description: "Google Drive file search, downloads, uploads, organization, and sharing through an independently authorized MCP connection.",
+        urlEnv: "GOOGLE_DRIVE_MCP_URL",
+        tokenEnv: "GOOGLE_DRIVE_MCP_TOKEN",
+        scopes: [
+            "openid",
+            "email",
+            "profile",
+            "https://www.googleapis.com/auth/drive"
+        ],
+        readToolPatterns: ["rest_get", ...READ_PATTERNS],
+        writeToolPatterns: ["rest_request", ...WRITE_PATTERNS],
+        write: true,
+        setupMessage: "Configure a Google Drive-only OAuth grant or MCP bridge for this deployment. Do not reuse an umbrella Google grant that also exposes Gmail or Calendar."
+    }),
+    catalogEntry({ kind: "github", displayName: "GitHub", helper: "defineGitHubMcpConnection", packageName: "@assemblyline-agents/github", description: "GitHub repositories, issues, pull requests, and Actions through GitHub MCP.", defaultUrl: "https://api.githubcopilot.com/mcp/", urlEnv: "GITHUB_MCP_URL", tokenEnv: "GITHUB_MCP_TOKEN", write: true }),
+    catalogEntry({ kind: "slack", displayName: "Slack", helper: "defineSlackConnection", packageName: "@assemblyline-agents/slack", description: "Slack workspace search, channels, messages, files, and users through Slack MCP.", defaultUrl: "https://mcp.slack.com/mcp", urlEnv: "SLACK_MCP_URL", tokenEnv: "SLACK_MCP_TOKEN", write: true }),
+    catalogEntry({ kind: "telegram", displayName: "Telegram", helper: "defineTelegramConnection", packageName: "@assemblyline-agents/telegram", description: "Telegram account tools through a developer-operated MCP bridge.", urlEnv: "TELEGRAM_MCP_URL", tokenEnv: "TELEGRAM_MCP_TOKEN" }),
+    catalogEntry({ kind: "strava", displayName: "Strava", helper: "defineStravaConnection", description: "Strava profile and fitness activity tools through a developer-configured MCP server.", urlEnv: "STRAVA_MCP_URL", tokenEnv: "STRAVA_MCP_TOKEN" }),
+    catalogEntry({ kind: "polar", displayName: "Polar", helper: "definePolarConnection", description: "Polar workout and heart-rate tools through a developer-configured MCP server.", urlEnv: "POLAR_MCP_URL", tokenEnv: "POLAR_MCP_TOKEN" }),
+    catalogEntry({ kind: "spotify", displayName: "Spotify", helper: "defineSpotifyConnection", description: "Spotify library, playlist, and playback tools through a developer-configured MCP server.", urlEnv: "SPOTIFY_MCP_URL", tokenEnv: "SPOTIFY_MCP_TOKEN", write: true }),
+    catalogEntry({ kind: "xai", displayName: "xAI", helper: "defineXaiConnection", description: "xAI and X search tools through a developer-configured MCP server.", urlEnv: "XAI_MCP_URL", tokenEnv: "XAI_MCP_TOKEN" }),
+    catalogEntry({
+        kind: "exa",
+        displayName: "Exa",
+        helper: "defineExaConnection",
+        description: "Current web search, page retrieval, and advanced filtered search through Exa's official hosted MCP server.",
+        defaultUrl: "https://mcp.exa.ai/mcp",
+        urlEnv: "EXA_MCP_URL",
+        tokenEnv: "EXA_API_KEY",
+        tokenRequired: false,
+        subject: "environment",
+        tools: {
+            allow: [
+                "web_search_exa",
+                "web_fetch_exa",
+                "web_search_advanced_exa"
+            ]
+        },
+        readToolPatterns: [
+            "web_search_exa",
+            "web_fetch_exa",
+            "web_search_advanced_exa"
+        ],
+        setupMessage: "Exa's hosted MCP works without credentials. Optionally set EXA_API_KEY to raise production rate limits; OpenEve sends it only as the x-api-key header."
+    }),
+    catalogEntry({ kind: "plaid", displayName: "Plaid", helper: "definePlaidConnection", description: "Read-only Plaid financial tools through a developer-configured MCP bridge.", urlEnv: "PLAID_MCP_URL", tokenEnv: "PLAID_MCP_TOKEN" }),
+    catalogEntry({ kind: "granola", displayName: "Granola", helper: "defineGranolaConnection", description: "Granola meeting notes, transcripts, and action items through Granola MCP.", defaultUrl: "https://mcp.granola.ai/mcp", urlEnv: "GRANOLA_MCP_URL", tokenEnv: "GRANOLA_MCP_TOKEN" }),
+    catalogEntry({ kind: "linear", displayName: "Linear", helper: "defineLinearConnection", description: "Linear issues, projects, cycles, and teams through Linear MCP.", defaultUrl: "https://mcp.linear.app/mcp", urlEnv: "LINEAR_MCP_URL", tokenEnv: "LINEAR_MCP_TOKEN", write: true }),
+    catalogEntry({ kind: "notion", displayName: "Notion", helper: "defineNotionConnection", description: "Notion pages, databases, comments, and workspace search through Notion MCP.", defaultUrl: "https://mcp.notion.com/mcp", urlEnv: "NOTION_MCP_URL", tokenEnv: "NOTION_MCP_TOKEN", write: true }),
+    catalogEntry({ kind: "monday", displayName: "monday.com", helper: "defineMondayConnection", description: "monday.com boards, items, workspaces, and docs through Platform MCP.", defaultUrl: "https://mcp.monday.com/mcp", urlEnv: "MONDAY_MCP_URL", tokenEnv: "MONDAY_MCP_TOKEN", write: true }),
+    catalogEntry({ kind: "jira", displayName: "Jira", helper: "defineJiraConnection", description: "Jira issues, projects, transitions, and JQL search through Atlassian MCP.", defaultUrl: "https://mcp.atlassian.com/v1/mcp/authv2", urlEnv: "JIRA_MCP_URL", tokenEnv: "JIRA_MCP_TOKEN", write: true }),
+    catalogEntry({ kind: "hubspot", displayName: "HubSpot", helper: "defineHubSpotConnection", description: "HubSpot CRM records and associations through HubSpot MCP.", defaultUrl: "https://mcp.hubspot.com", urlEnv: "HUBSPOT_MCP_URL", tokenEnv: "HUBSPOT_MCP_TOKEN" }),
+    catalogEntry({ kind: "figma", displayName: "Figma", helper: "defineFigmaConnection", description: "Figma design, FigJam, Slides, and Dev Mode context through Figma MCP.", defaultUrl: "https://mcp.figma.com/mcp", urlEnv: "FIGMA_MCP_URL", tokenEnv: "FIGMA_MCP_TOKEN", write: true }),
+    catalogEntry({ kind: "paper", displayName: "Paper", helper: "definePaperConnection", description: "Paper design tools through a developer-exposed local MCP bridge.", urlEnv: "PAPER_MCP_URL", tokenEnv: "PAPER_MCP_TOKEN", tokenRequired: false, write: true }),
+    catalogEntry({ kind: "sentry", displayName: "Sentry", helper: "defineSentryConnection", description: "Sentry issues, events, projects, and teams through Sentry MCP.", defaultUrl: "https://mcp.sentry.dev/mcp", urlEnv: "SENTRY_MCP_URL", tokenEnv: "SENTRY_MCP_TOKEN", write: true }),
+    catalogEntry({ kind: "supabase", displayName: "Supabase", helper: "defineSupabaseConnection", description: "Supabase projects, databases, docs, and Edge Functions through Supabase MCP.", defaultUrl: "https://mcp.supabase.com/mcp", urlEnv: "SUPABASE_MCP_URL", tokenEnv: "SUPABASE_MCP_TOKEN", write: true }),
+    catalogEntry({ kind: "metabase", displayName: "Metabase", helper: "defineMetabaseConnection", description: "Metabase semantic-layer queries, questions, and dashboards through an instance MCP endpoint.", urlEnv: "METABASE_MCP_URL", tokenEnv: "METABASE_MCP_TOKEN", tokenRequired: false, write: true }),
+    catalogEntry({ kind: "cloudflare", displayName: "Cloudflare", helper: "defineCloudflareConnection", description: "Cloudflare API and account tools through Cloudflare MCP.", defaultUrl: "https://mcp.cloudflare.com/mcp", urlEnv: "CLOUDFLARE_MCP_URL", tokenEnv: "CLOUDFLARE_MCP_TOKEN", write: true }),
+    catalogEntry({ kind: "vercel", displayName: "Vercel", helper: "defineVercelConnection", description: "Vercel projects, deployments, logs, and teams through Vercel MCP.", defaultUrl: "https://mcp.vercel.com", urlEnv: "VERCEL_MCP_URL", tokenEnv: "VERCEL_MCP_TOKEN", write: true }),
+    catalogEntry({ kind: "railway", displayName: "Railway", helper: "defineRailwayConnection", packageName: "@assemblyline-agents/railway", description: "Railway projects, services, variables, and deployments through Railway MCP.", defaultUrl: "https://mcp.railway.com", urlEnv: "RAILWAY_MCP_URL", tokenEnv: "RAILWAY_MCP_TOKEN", write: true }),
+    catalogEntry({ kind: "refero", displayName: "Refero", helper: "defineReferoConnection", description: "Refero design references, screens, and product flows through Refero MCP.", defaultUrl: "https://api.refero.design/mcp", urlEnv: "REFERO_MCP_URL", tokenEnv: "REFERO_MCP_BEARER_TOKEN" }),
+    catalogEntry({ kind: "agentcash", displayName: "AgentCash", helper: "defineAgentCashConnection", description: "Paid API discovery, schema, balance, and request tools through an AgentCash MCP bridge.", urlEnv: "AGENTCASH_MCP_URL", tokenEnv: "AGENTCASH_MCP_BRIDGE_TOKEN", write: true }),
+    {
+        kind: "soundcloud",
+        role: "connection",
+        packageName: "@assemblyline-agents/soundcloud",
+        helper: "defineSoundCloudConnection",
+        protocol: "openapi",
+        provider: "soundcloud",
+        description: "SoundCloud tracks, playlists, users, likes, follows, reposts, and comments through the official API.",
+        defaultSpec: "https://developers.soundcloud.com/docs/api/explorer/api.json",
+        defaultBaseUrl: "https://api.soundcloud.com",
+        requiredEnv: ["SOUNDCLOUD_CLIENT_ID", "SOUNDCLOUD_CLIENT_SECRET"],
+        optionalEnv: ["SOUNDCLOUD_REDIRECT_URI"],
+        capabilities: ["openapi", "oauth", "live-tools"],
+        scopes: [],
+        subject: "user",
+        tools: { block: ["post_tracks"] },
+        readToolPatterns: ["regex:^get_"],
+        writeToolPatterns: ["regex:^(post|put|patch|delete)_"],
+        skill: "soundcloud",
+        setup: [{
+                kind: "connection",
+                name: "soundcloud-developer-configuration",
+                required: true,
+                message: "Register a SoundCloud application and set SOUNDCLOUD_CLIENT_ID and SOUNDCLOUD_CLIENT_SECRET. OpenEve handles OAuth 2.1 PKCE; the developer owns the app and redirect URI."
+            }]
+    },
+    catalogEntry({
+        kind: "browser-use",
+        displayName: "Browser Use Cloud",
+        helper: "defineBrowserUseConnection",
+        description: "Hosted browser automation sessions through Browser Use Cloud MCP.",
+        defaultUrl: "https://api.browser-use.com/v3/mcp",
+        tokenEnv: "BROWSER_USE_API_KEY",
+        tokenHeader: "x-browser-use-api-key",
+        subject: "environment",
+        tools: { allow: ["get_session", "get_session_messages", "list_sessions", "list_browser_profiles", "run_session", "send_task", "stop_session"] },
+        readToolPatterns: ["get_session", "get_session_messages", "list_sessions", "list_browser_profiles"],
+        writeToolPatterns: ["run_session", "send_task", "stop_session"],
+        setupMessage: "Set BROWSER_USE_API_KEY for the OpenEve host. Browser profiles, cost limits, and write authority remain developer-controlled."
+    }),
+    catalogEntry({
+        kind: "orgo",
+        displayName: "Orgo",
+        helper: "defineOrgoConnection",
+        description: "Persistent Orgo cloud desktops controlled through a packaged, credential-scrubbing REST bridge.",
+        transport: "stdio",
+        tokenEnv: "ORGO_API_KEY",
+        subject: "environment",
+        tools: {
+            allow: [
+                "list_workspaces",
+                "create_workspace",
+                "list_computers",
+                "get_computer",
+                "create_computer",
+                "delete_computer",
+                "start_computer",
+                "stop_computer",
+                "restart_computer",
+                "screenshot",
+                "click",
+                "drag",
+                "type_text",
+                "press_key",
+                "scroll",
+                "wait",
+                "execute_bash",
+                "execute_python"
+            ]
+        },
+        readToolPatterns: [
+            "list_workspaces",
+            "list_computers",
+            "get_computer",
+            "screenshot"
+        ],
+        writeToolPatterns: [
+            "create_workspace",
+            "create_computer",
+            "delete_computer",
+            "start_computer",
+            "stop_computer",
+            "restart_computer",
+            "click",
+            "drag",
+            "type_text",
+            "press_key",
+            "scroll",
+            "wait",
+            "execute_bash",
+            "execute_python"
+        ],
+        optionalEnv: ["ORGO_API_BASE_URL"],
+        setupMessage: "Set ORGO_API_KEY on the OpenEve runtime host. The developer owns Orgo workspaces, account limits, auto-stop policy, login state, and billing; the packaged bridge strips VNC credentials from results."
+    }),
+    catalogEntry({
+        kind: "peekaboo",
+        displayName: "Peekaboo",
+        helper: "definePeekabooConnection",
+        description: "Same-host macOS accessibility and input automation through Peekaboo's stdio MCP server.",
+        transport: "stdio",
+        subject: "environment",
+        tools: { allow: ["inspect_ui", "list", "permissions", "click", "type", "hotkey", "scroll", "drag", "swipe", "move", "set_value", "perform_action", "app", "window", "menu", "dock", "dialog", "space"] },
+        hostRequirements: {
+            deployTargets: ["local"],
+            platforms: ["darwin"],
+            message: "Peekaboo is a same-host macOS connection. Run this agent with the local deploy target on the Mac being controlled; hosted Railway, Docker, Fly, and VPS deployments cannot reach back to that Mac."
+        },
+        readToolPatterns: ["inspect_ui", "list", "permissions"],
+        writeToolPatterns: ["click", "type", "hotkey", "scroll", "drag", "swipe", "move", "set_value", "perform_action", "app", "window", "menu", "dock", "dialog", "space"],
+        setupMessage: "Local deployment only: install Peekaboo on the OpenEve Mac (macOS 15+), grant that host process Accessibility and Screen Recording permissions, and use the local deploy target. Hosted targets are rejected."
+    }),
+    catalogEntry({
+        kind: "computer-use",
+        displayName: "OpenEve Computer Use",
+        helper: "defineComputerUseConnection",
+        description: "End-to-end encrypted accessibility and input automation on a paired Mac through the OpenEve device relay.",
+        transport: "relay",
+        defaultUrl: "https://computer-use.openeve.dev/v1",
+        urlEnv: "OPENEVE_COMPUTER_USE_RELAY_URL",
+        credentialEnv: "OPENEVE_COMPUTER_USE_BINDING",
+        subject: "environment",
+        tools: { allow: ["inspect_ui", "list", "permissions", "click", "type", "hotkey", "scroll", "drag", "swipe", "move", "set_value", "perform_action", "app", "window", "menu", "dock", "dialog", "space"] },
+        readToolPatterns: ["inspect_ui", "list", "permissions"],
+        writeToolPatterns: ["click", "type", "hotkey", "scroll", "drag", "swipe", "move", "set_value", "perform_action", "app", "window", "menu", "dock", "dialog", "space"],
+        setupMessage: "Install OpenEve Agent Builder on the Mac, enable Computer Host, pair this deployment, and set the generated OPENEVE_COMPUTER_USE_BINDING secret on the remote runtime. The binding is device-scoped and must not be placed in prompts or source control."
+    }),
+    catalogEntry({
+        kind: "ffmpeg",
+        displayName: "FFmpeg",
+        helper: "defineFfmpegConnection",
+        description: "Workspace-scoped media inspection, trimming, transcoding, stitching, audio replacement, frame extraction, and vertical reframing through FFmpeg.",
+        transport: "stdio",
+        subject: "environment",
+        tools: {
+            allow: [
+                "probe_media",
+                "trim_media",
+                "transcode_media",
+                "concat_media",
+                "replace_audio",
+                "extract_frames",
+                "reframe_vertical"
+            ]
+        },
+        readToolPatterns: ["probe_media"],
+        writeToolPatterns: [
+            "trim_media",
+            "transcode_media",
+            "concat_media",
+            "replace_audio",
+            "extract_frames",
+            "reframe_vertical"
+        ],
+        setupMessage: "Install ffmpeg and ffprobe on the OpenEve runtime host. The plugin keeps all media paths inside its configured workspace root and exposes typed operations instead of arbitrary FFmpeg flags."
+    }),
+    catalogEntry({
+        kind: "remotion",
+        displayName: "Remotion",
+        helper: "defineRemotionConnection",
+        description: "Workspace-scoped Remotion composition discovery, version checks, video renders, and still renders through the project CLI.",
+        transport: "stdio",
+        subject: "environment",
+        tools: {
+            allow: [
+                "list_compositions",
+                "check_versions",
+                "render_video",
+                "render_still"
+            ]
+        },
+        readToolPatterns: ["list_compositions", "check_versions"],
+        writeToolPatterns: ["render_video", "render_still"],
+        setupMessage: "Install Remotion and @remotion/cli in the configured project. OpenEve uses Remotion's supported CLI and Agent Skills workflow; it does not depend on Remotion's deprecated hosted MCP server."
+    })
+];
+function validatePluginAccess(plugin, access) {
+    if (!access)
+        throw new Error(`${plugin.helper}: access must explicitly select read and write authority.`);
+    if (access.write !== false && plugin.writeToolPatterns.length === 0) {
+        throw new Error(`${plugin.helper}: ${plugin.provider} is a read-only plugin and cannot enable writes.`);
+    }
+}
+function pluginAccessDefinition(plugin, access) {
+    return {
+        read: { tools: [...plugin.readToolPatterns] },
+        write: access.write === false
+            ? false
+            : {
+                tools: [...plugin.writeToolPatterns],
+                approval: normalizePluginApproval(access.write.approval)
+            }
+    };
+}
+function tokenAuth(tokenEnv) {
+    if (!tokenEnv)
+        return undefined;
+    return ({ env }) => ({
+        principalType: "user",
+        displayName: `${tokenEnv} bearer token`,
+        getToken: async () => {
+            const token = env[tokenEnv]?.trim();
+            if (!token)
+                throw new Error(`Missing ${tokenEnv}. Configure the provider credential or pass a custom auth definition.`);
+            return { token };
+        }
+    });
+}
+function environmentValue(name) {
+    if (!name || typeof process === "undefined")
+        return undefined;
+    return process.env[name]?.trim() || undefined;
+}
+function tokenHeader(name, tokenEnv) {
+    if (!tokenEnv)
+        return undefined;
+    return ({ env }) => {
+        const token = env[tokenEnv]?.trim();
+        if (!token)
+            throw new Error(`Missing ${tokenEnv}. Configure the provider credential or pass custom headers.`);
+        return { [name]: token };
+    };
+}
+function mergeHeaders(first, second) {
+    if (!first)
+        return second;
+    if (!second)
+        return first;
+    return async (context) => ({
+        ...(await resolveHeaders(first, context)),
+        ...(await resolveHeaders(second, context))
+    });
+}
+async function resolveHeaders(definition, context) {
+    if (typeof definition === "function")
+        return definition(context);
+    const resolved = {};
+    for (const [name, value] of Object.entries(definition)) {
+        resolved[name] = await resolveHeaderValue(value, context);
+    }
+    return resolved;
+}
+async function resolveHeaderValue(value, context) {
+    return typeof value === "function" ? value(context) : value;
+}
+function cloneToolFilter(filter) {
+    if (!filter)
+        return undefined;
+    return "allow" in filter ? { allow: [...filter.allow] } : { block: [...filter.block] };
+}
+function cloneHostRequirements(requirements) {
+    return {
+        ...requirements,
+        ...(requirements.deployTargets ? { deployTargets: [...requirements.deployTargets] } : {}),
+        ...(requirements.platforms ? { platforms: [...requirements.platforms] } : {})
+    };
+}
+function normalizePluginApproval(approval) {
+    if (approval === "always" || approval === "once" || approval === "never")
+        return { mode: approval };
+    return approval;
+}
+function cloneMetadata(entry) {
+    return {
+        ...entry,
+        requiredEnv: [...(entry.requiredEnv ?? [])],
+        optionalEnv: [...(entry.optionalEnv ?? [])],
+        capabilities: [...(entry.capabilities ?? [])],
+        scopes: [...(entry.scopes ?? [])],
+        readToolPatterns: [...entry.readToolPatterns],
+        writeToolPatterns: [...entry.writeToolPatterns],
+        ...(entry.skills ? { skills: [...entry.skills] } : {}),
+        ...(entry.tools ? { tools: cloneToolFilter(entry.tools) } : {}),
+        ...(entry.hostRequirements ? { hostRequirements: cloneHostRequirements(entry.hostRequirements) } : {})
+    };
+}
+function isPluginModule(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const connections = value.connections;
+    return connections === undefined || (Array.isArray(connections) && connections.every((entry) => Boolean(entry) && entry.role === "connection" && typeof entry.kind === "string" && typeof entry.helper === "string"));
+}
+export function connectionPluginBinding(metadata) {
+    return { kind: metadata.kind };
+}
+//# sourceMappingURL=plugin.js.map