@assemblyline-agents/runtime 0.1.0

package/dist/connection-stores.d.ts

@@ -0,0 +1,108 @@
+import type { ConnectionAuthorizationChallenge, ConnectionPrincipal, ConnectionResolverContext, JsonObject, JsonSchema, JsonValue } from "@assemblyline-agents/core";
+/**
+ * Connection grant / authorization-session store interfaces, the in-memory
+ * and encrypted-file store implementations, and the connection tool metadata
+ * and search types shared with the registry and clients.
+ */
+export interface StoredConnectionGrant {
+    connectionName: string;
+    principalKey: string;
+    principal: ConnectionPrincipal;
+    token: string;
+    refreshToken?: string;
+    tokenType?: string;
+    scopes?: string[];
+    expiresAt?: number;
+    credential?: JsonObject;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface ConnectionGrantStore {
+    getGrant(connectionName: string, principalKey: string): Promise<StoredConnectionGrant | undefined>;
+    saveGrant(grant: StoredConnectionGrant): Promise<void>;
+    deleteGrant(connectionName: string, principalKey: string): Promise<void>;
+}
+export interface ConnectionAuthorizationSessionRecord {
+    id: string;
+    state: string;
+    connectionName: string;
+    principal: ConnectionPrincipal;
+    principalKey: string;
+    session: ConnectionResolverContext["session"];
+    callbackUrl: string;
+    codeVerifier?: string;
+    resume?: JsonValue;
+    runId?: string;
+    toolCallId?: string;
+    toolName?: string;
+    challenge: ConnectionAuthorizationChallenge;
+    continuation?: JsonObject;
+    status: "pending" | "completed" | "denied" | "expired";
+    expiresAt: number;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface ConnectionAuthorizationSessionStore {
+    createSession(session: ConnectionAuthorizationSessionRecord): Promise<void>;
+    updateSession(id: string, patch: Partial<Omit<ConnectionAuthorizationSessionRecord, "id" | "createdAt">>): Promise<ConnectionAuthorizationSessionRecord>;
+    getSession(id: string): Promise<ConnectionAuthorizationSessionRecord | undefined>;
+    getSessionByState(state: string): Promise<ConnectionAuthorizationSessionRecord | undefined>;
+    findPendingSession(connectionName: string, principalKey: string): Promise<ConnectionAuthorizationSessionRecord | undefined>;
+}
+export interface ConnectionToolMetadata {
+    connection: string;
+    name: string;
+    qualifiedName: string;
+    description: string;
+    inputSchema: JsonSchema;
+    outputSchema?: JsonSchema;
+}
+export interface ConnectionSearchInput {
+    connection?: string;
+    keywords?: string;
+    limit?: number;
+}
+export interface ConnectionSearchResultItem {
+    connection: string;
+    description: string;
+    error?: string;
+    inputSchema?: JsonSchema;
+    needsAuthorization?: boolean;
+    outputSchema?: JsonSchema;
+    qualifiedName?: string;
+    tool?: string;
+}
+export declare const CONNECTION_SEARCH_TOOL_NAME = "connection_search";
+export declare class InMemoryConnectionGrantStore implements ConnectionGrantStore {
+    protected readonly grants: Map<string, StoredConnectionGrant>;
+    getGrant(connectionName: string, principalKey: string): Promise<StoredConnectionGrant | undefined>;
+    saveGrant(grant: StoredConnectionGrant): Promise<void>;
+    deleteGrant(connectionName: string, principalKey: string): Promise<void>;
+}
+export declare class InMemoryConnectionAuthorizationSessionStore implements ConnectionAuthorizationSessionStore {
+    protected readonly sessions: Map<string, ConnectionAuthorizationSessionRecord>;
+    createSession(session: ConnectionAuthorizationSessionRecord): Promise<void>;
+    updateSession(id: string, patch: Partial<Omit<ConnectionAuthorizationSessionRecord, "id" | "createdAt">>): Promise<ConnectionAuthorizationSessionRecord>;
+    getSession(id: string): Promise<ConnectionAuthorizationSessionRecord | undefined>;
+    getSessionByState(state: string): Promise<ConnectionAuthorizationSessionRecord | undefined>;
+    findPendingSession(connectionName: string, principalKey: string): Promise<ConnectionAuthorizationSessionRecord | undefined>;
+}
+export declare class FileConnectionGrantStore extends InMemoryConnectionGrantStore {
+    private readonly path;
+    private readonly secret;
+    constructor(path: string, secret: string);
+    saveGrant(grant: StoredConnectionGrant): Promise<void>;
+    deleteGrant(connectionName: string, principalKey: string): Promise<void>;
+    private load;
+    private persist;
+}
+export declare class FileConnectionAuthorizationSessionStore extends InMemoryConnectionAuthorizationSessionStore {
+    private readonly path;
+    private readonly secret;
+    constructor(path: string, secret: string);
+    createSession(session: ConnectionAuthorizationSessionRecord): Promise<void>;
+    updateSession(id: string, patch: Partial<Omit<ConnectionAuthorizationSessionRecord, "id" | "createdAt">>): Promise<ConnectionAuthorizationSessionRecord>;
+    private load;
+    private persist;
+}
+//# sourceMappingURL=connection-stores.d.ts.map

package/dist/connection-stores.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-stores.d.ts","sourceRoot":"","sources":["../src/connection-stores.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,gCAAgC,EAChC,mBAAmB,EACnB,yBAAyB,EACzB,UAAU,EACV,UAAU,EACV,SAAS,EACV,MAAM,2BAA2B,CAAC;AAGnC;;;;GAIG;AAEH,MAAM,WAAW,qBAAqB;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,mBAAmB,CAAC;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,cAAc,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAAC;IACnG,SAAS,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1E;AAED,MAAM,WAAW,oCAAoC;IACnD,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,mBAAmB,CAAC;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,yBAAyB,CAAC,SAAS,CAAC,CAAC;IAC9C,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,gCAAgC,CAAC;IAC5C,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAC;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mCAAmC;IAClD,aAAa,CAAC,OAAO,EAAE,oCAAoC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,oCAAoC,EAAE,IAAI,GAAG,WAAW,CAAC,CAAC,GAAG,OAAO,CAAC,oCAAoC,CAAC,CAAC;IACzJ,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oCAAoC,GAAG,SAAS,CAAC,CAAC;IAClF,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,oCAAoC,GAAG,SAAS,CAAC,CAAC;IAC5F,kBAAkB,CAAC,cAAc,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,oCAAoC,GAAG,SAAS,CAAC,CAAC;CAC7H;AAED,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,UAAU,CAAC;IACxB,YAAY,CAAC,EAAE,UAAU,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,0BAA0B;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,UAAU,CAAC;IACzB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,eAAO,MAAM,2BAA2B,sBAAsB,CAAC;AAE/D,qBAAa,4BAA6B,YAAW,oBAAoB;IACvE,SAAS,CAAC,QAAQ,CAAC,MAAM,qCAA4C;IAE/D,QAAQ,CAAC,cAAc,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC;IAIlG,SAAS,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC;IAItD,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAG/E;AAED,qBAAa,2CAA4C,YAAW,mCAAmC;IACrG,SAAS,CAAC,QAAQ,CAAC,QAAQ,oDAA2D;IAEhF,aAAa,CAAC,OAAO,EAAE,oCAAoC,GAAG,OAAO,CAAC,IAAI,CAAC;IAI3E,aAAa,CACjB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,oCAAoC,EAAE,IAAI,GAAG,WAAW,CAAC,CAAC,GAC7E,OAAO,CAAC,oCAAoC,CAAC;IAQ1C,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oCAAoC,GAAG,SAAS,CAAC;IAIjF,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,oCAAoC,GAAG,SAAS,CAAC;IAI3F,kBAAkB,CAAC,cAAc,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,oCAAoC,GAAG,SAAS,CAAC;CAUlI;AAED,qBAAa,wBAAyB,SAAQ,4BAA4B;IAEtE,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM;IAMlB,SAAS,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC;IAKtD,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKvF,OAAO,CAAC,IAAI;IAOZ,OAAO,CAAC,OAAO;CAIhB;AAED,qBAAa,uCAAwC,SAAQ,2CAA2C;IAEpG,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM;IAMlB,aAAa,CAAC,OAAO,EAAE,oCAAoC,GAAG,OAAO,CAAC,IAAI,CAAC;IAK3E,aAAa,CAC1B,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,oCAAoC,EAAE,IAAI,GAAG,WAAW,CAAC,CAAC,GAC7E,OAAO,CAAC,oCAAoC,CAAC;IAMhD,OAAO,CAAC,IAAI;IAOZ,OAAO,CAAC,OAAO;CAIhB"}

package/dist/connection-stores.js

@@ -0,0 +1,127 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { connectionGrantKey, timestamp } from "./connection-util.js";
+export const CONNECTION_SEARCH_TOOL_NAME = "connection_search";
+export class InMemoryConnectionGrantStore {
+    grants = new Map();
+    async getGrant(connectionName, principalKey) {
+        return this.grants.get(connectionGrantKey(connectionName, principalKey));
+    }
+    async saveGrant(grant) {
+        this.grants.set(connectionGrantKey(grant.connectionName, grant.principalKey), grant);
+    }
+    async deleteGrant(connectionName, principalKey) {
+        this.grants.delete(connectionGrantKey(connectionName, principalKey));
+    }
+}
+export class InMemoryConnectionAuthorizationSessionStore {
+    sessions = new Map();
+    async createSession(session) {
+        this.sessions.set(session.id, session);
+    }
+    async updateSession(id, patch) {
+        const current = this.sessions.get(id);
+        if (!current)
+            throw new Error(`Connection authorization session not found: ${id}`);
+        const updated = { ...current, ...patch, updatedAt: timestamp() };
+        this.sessions.set(id, updated);
+        return updated;
+    }
+    async getSession(id) {
+        return this.sessions.get(id);
+    }
+    async getSessionByState(state) {
+        return [...this.sessions.values()].find((session) => session.state === state);
+    }
+    async findPendingSession(connectionName, principalKey) {
+        const now = Date.now();
+        return [...this.sessions.values()].find((session) => session.connectionName === connectionName &&
+            session.principalKey === principalKey &&
+            session.status === "pending" &&
+            session.expiresAt > now);
+    }
+}
+export class FileConnectionGrantStore extends InMemoryConnectionGrantStore {
+    path;
+    secret;
+    constructor(path, secret) {
+        super();
+        this.path = path;
+        this.secret = secret;
+        this.load();
+    }
+    async saveGrant(grant) {
+        await super.saveGrant(grant);
+        this.persist();
+    }
+    async deleteGrant(connectionName, principalKey) {
+        await super.deleteGrant(connectionName, principalKey);
+        this.persist();
+    }
+    load() {
+        const parsed = readEncryptedStore(this.path, this.secret) ?? {};
+        for (const grant of parsed.grants ?? []) {
+            void super.saveGrant(grant);
+        }
+    }
+    persist() {
+        const grants = [...this.grants.values()];
+        writeEncryptedStore(this.path, this.secret, { grants });
+    }
+}
+export class FileConnectionAuthorizationSessionStore extends InMemoryConnectionAuthorizationSessionStore {
+    path;
+    secret;
+    constructor(path, secret) {
+        super();
+        this.path = path;
+        this.secret = secret;
+        this.load();
+    }
+    async createSession(session) {
+        await super.createSession(session);
+        this.persist();
+    }
+    async updateSession(id, patch) {
+        const updated = await super.updateSession(id, patch);
+        this.persist();
+        return updated;
+    }
+    load() {
+        const parsed = readEncryptedStore(this.path, this.secret) ?? {};
+        for (const session of parsed.sessions ?? []) {
+            void super.createSession(session);
+        }
+    }
+    persist() {
+        const sessions = [...this.sessions.values()];
+        writeEncryptedStore(this.path, this.secret, { sessions });
+    }
+}
+function readEncryptedStore(path, secret) {
+    if (!existsSync(path))
+        return undefined;
+    const envelope = JSON.parse(readFileSync(path, "utf8"));
+    if (!envelope.iv || !envelope.tag || !envelope.data)
+        return undefined;
+    const decipher = createDecipheriv("aes-256-gcm", encryptionKey(secret), Buffer.from(envelope.iv, "base64"));
+    decipher.setAuthTag(Buffer.from(envelope.tag, "base64"));
+    const plaintext = Buffer.concat([decipher.update(Buffer.from(envelope.data, "base64")), decipher.final()]).toString("utf8");
+    return JSON.parse(plaintext);
+}
+function writeEncryptedStore(path, secret, value) {
+    mkdirSync(dirname(path), { recursive: true });
+    const iv = randomBytes(12);
+    const cipher = createCipheriv("aes-256-gcm", encryptionKey(secret), iv);
+    const encrypted = Buffer.concat([cipher.update(JSON.stringify(value)), cipher.final()]);
+    writeFileSync(path, JSON.stringify({
+        iv: iv.toString("base64"),
+        tag: cipher.getAuthTag().toString("base64"),
+        data: encrypted.toString("base64")
+    }, null, 2));
+}
+function encryptionKey(secret) {
+    return createHash("sha256").update(secret || "openeve-local-dev-connection-secret").digest();
+}
+//# sourceMappingURL=connection-stores.js.map

package/dist/connection-stores.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-stores.js","sourceRoot":"","sources":["../src/connection-stores.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AASpC,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAmFrE,MAAM,CAAC,MAAM,2BAA2B,GAAG,mBAAmB,CAAC;AAE/D,MAAM,OAAO,4BAA4B;IACpB,MAAM,GAAG,IAAI,GAAG,EAAiC,CAAC;IAErE,KAAK,CAAC,QAAQ,CAAC,cAAsB,EAAE,YAAoB;QACzD,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAA4B;QAC1C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;IACvF,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,cAAsB,EAAE,YAAoB;QAC5D,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC,CAAC;IACvE,CAAC;CACF;AAED,MAAM,OAAO,2CAA2C;IACnC,QAAQ,GAAG,IAAI,GAAG,EAAgD,CAAC;IAEtF,KAAK,CAAC,aAAa,CAAC,OAA6C;QAC/D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,EAAU,EACV,KAA8E;QAE9E,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;QACnF,MAAM,OAAO,GAAyC,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC;QACvG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC/B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU;QACzB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,cAAsB,EAAE,YAAoB;QACnE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CACrC,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,cAAc,KAAK,cAAc;YACzC,OAAO,CAAC,YAAY,KAAK,YAAY;YACrC,OAAO,CAAC,MAAM,KAAK,SAAS;YAC5B,OAAO,CAAC,SAAS,GAAG,GAAG,CAC1B,CAAC;IACJ,CAAC;CACF;AAED,MAAM,OAAO,wBAAyB,SAAQ,4BAA4B;IAErD;IACA;IAFnB,YACmB,IAAY,EACZ,MAAc;QAE/B,KAAK,EAAE,CAAC;QAHS,SAAI,GAAJ,IAAI,CAAQ;QACZ,WAAM,GAAN,MAAM,CAAQ;QAG/B,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAEQ,KAAK,CAAC,SAAS,CAAC,KAA4B;QACnD,MAAM,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAEQ,KAAK,CAAC,WAAW,CAAC,cAAsB,EAAE,YAAoB;QACrE,MAAM,KAAK,CAAC,WAAW,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAEO,IAAI;QACV,MAAM,MAAM,GAAG,kBAAkB,CAAuC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACtG,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACxC,KAAK,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAEO,OAAO;QACb,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACzC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1D,CAAC;CACF;AAED,MAAM,OAAO,uCAAwC,SAAQ,2CAA2C;IAEnF;IACA;IAFnB,YACmB,IAAY,EACZ,MAAc;QAE/B,KAAK,EAAE,CAAC;QAHS,SAAI,GAAJ,IAAI,CAAQ;QACZ,WAAM,GAAN,MAAM,CAAQ;QAG/B,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAEQ,KAAK,CAAC,aAAa,CAAC,OAA6C;QACxE,MAAM,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAEQ,KAAK,CAAC,aAAa,CAC1B,EAAU,EACV,KAA8E;QAE9E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,IAAI;QACV,MAAM,MAAM,GAAG,kBAAkB,CAAwD,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACvH,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;YAC5C,KAAK,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAEO,OAAO;QACb,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7C,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC5D,CAAC;CACF;AAED,SAAS,kBAAkB,CAAI,IAAY,EAAE,MAAc;IACzD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAiD,CAAC;IACxG,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IACtE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC5G,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5H,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAM,CAAC;AACpC,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY,EAAE,MAAc,EAAE,KAAc;IACvE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACxF,aAAa,CACX,IAAI,EACJ,IAAI,CAAC,SAAS,CACZ;QACE,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzB,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC3C,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;KACnC,EACD,IAAI,EACJ,CAAC,CACF,CACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,qCAAqC,CAAC,CAAC,MAAM,EAAE,CAAC;AAC/F,CAAC"}

package/dist/connection-util.d.ts

@@ -0,0 +1,27 @@
+import type { CompiledConnection, ConnectionAccessDefinition, HttpApiConnectionDefinition, JsonObject, McpClientConnectionDefinition, OpenAPIConnectionDefinition, SandboxCliConnectionDefinition, ToolFilterDefinition } from "@assemblyline-agents/core";
+import type { ConnectionToolMetadata } from "./connection-stores.js";
+/**
+ * Small shared guards, scoring and misc helpers for the runtime connection
+ * modules (`connections.ts`, `connection-stores.ts`, `connection-auth-util.ts`,
+ * `connection-clients.ts`).
+ */
+export declare function qualifiedConnectionToolName(connectionName: string, toolName: string): string;
+export declare function parseQualifiedName(qualifiedName: string): {
+    connectionName: string;
+    toolName: string;
+} | undefined;
+export declare function tokenize(value: string): string[];
+export declare function scoreMatch(queryTokens: string[], tool: ConnectionToolMetadata): number;
+export declare function stringifyAttributes(metadata: JsonObject): Record<string, string | string[]>;
+export declare function passesFilter(name: string, filter: ToolFilterDefinition | undefined): boolean;
+export type ConnectionToolAccess = "read" | "write" | "none";
+export declare function connectionToolAccess(name: string, access: ConnectionAccessDefinition): ConnectionToolAccess;
+export declare function matchesToolPatterns(name: string, patterns: string[]): boolean;
+export declare function connectionGrantKey(connectionName: string, principalKey: string): string;
+export declare function timestamp(): string;
+export declare function stringValue(value: unknown): string;
+export declare function isLiveConnection(connection: CompiledConnection): boolean;
+export declare function liveDefinitionUrl(definition: McpClientConnectionDefinition | OpenAPIConnectionDefinition | HttpApiConnectionDefinition | SandboxCliConnectionDefinition): string | undefined;
+export declare function isJsonObject(value: unknown): value is JsonObject;
+export declare function isRecord(value: unknown): value is Record<string, unknown>;
+//# sourceMappingURL=connection-util.d.ts.map

package/dist/connection-util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-util.d.ts","sourceRoot":"","sources":["../src/connection-util.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kBAAkB,EAClB,0BAA0B,EAC1B,2BAA2B,EAC3B,UAAU,EACV,6BAA6B,EAC7B,2BAA2B,EAC3B,8BAA8B,EAC9B,oBAAoB,EACrB,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAErE;;;;GAIG;AAEH,wBAAgB,2BAA2B,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE5F;AAED,wBAAgB,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAOlH;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAKhD;AAED,wBAAgB,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,sBAAsB,GAAG,MAAM,CActF;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAO3F;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,GAAG,SAAS,GAAG,OAAO,CAI5F;AAED,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;AAE7D,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,0BAA0B,GAAG,oBAAoB,CAI3G;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAE7E;AAkBD,wBAAgB,kBAAkB,CAAC,cAAc,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAEvF;AAED,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAGlD;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,kBAAkB,GAAG,OAAO,CAKxE;AAED,wBAAgB,iBAAiB,CAC/B,UAAU,EACN,6BAA6B,GAC7B,2BAA2B,GAC3B,2BAA2B,GAC3B,8BAA8B,GACjC,MAAM,GAAG,SAAS,CAKpB;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,UAAU,CAEhE;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzE"}

package/dist/connection-util.js

@@ -0,0 +1,118 @@
+/**
+ * Small shared guards, scoring and misc helpers for the runtime connection
+ * modules (`connections.ts`, `connection-stores.ts`, `connection-auth-util.ts`,
+ * `connection-clients.ts`).
+ */
+export function qualifiedConnectionToolName(connectionName, toolName) {
+    return `${connectionName}__${toolName}`;
+}
+export function parseQualifiedName(qualifiedName) {
+    const index = qualifiedName.indexOf("__");
+    if (index <= 0 || index >= qualifiedName.length - 2)
+        return undefined;
+    return {
+        connectionName: qualifiedName.slice(0, index),
+        toolName: qualifiedName.slice(index + 2)
+    };
+}
+export function tokenize(value) {
+    return value
+        .toLowerCase()
+        .split(/[\s_\-./]+/u)
+        .filter((token) => token.length > 1);
+}
+export function scoreMatch(queryTokens, tool) {
+    if (queryTokens.length === 0)
+        return 1;
+    const nameTokens = tokenize(tool.name);
+    const descriptionTokens = tokenize(tool.description);
+    let score = 0;
+    for (const query of queryTokens) {
+        for (const token of nameTokens) {
+            if (token.includes(query) || query.includes(token))
+                score += 3;
+        }
+        for (const token of descriptionTokens) {
+            if (token.includes(query) || query.includes(token))
+                score += 1;
+        }
+    }
+    return score;
+}
+export function stringifyAttributes(metadata) {
+    const out = {};
+    for (const [key, value] of Object.entries(metadata)) {
+        if (Array.isArray(value))
+            out[key] = value.map((item) => String(item));
+        else if (value !== null && typeof value !== "object")
+            out[key] = String(value);
+    }
+    return out;
+}
+export function passesFilter(name, filter) {
+    if (!filter)
+        return true;
+    if ("allow" in filter)
+        return matchesToolPatterns(name, filter.allow);
+    return !matchesToolPatterns(name, filter.block);
+}
+export function connectionToolAccess(name, access) {
+    if (access.write !== false && matchesToolPatterns(name, access.write.tools))
+        return "write";
+    if (matchesToolPatterns(name, access.read.tools))
+        return "read";
+    return "none";
+}
+export function matchesToolPatterns(name, patterns) {
+    return patterns.some((pattern) => matchesToolPattern(name, pattern));
+}
+function matchesToolPattern(name, pattern) {
+    if (pattern.startsWith("regex:")) {
+        try {
+            return new RegExp(pattern.slice("regex:".length), "iu").test(name);
+        }
+        catch {
+            return false;
+        }
+    }
+    if (!pattern.includes("*"))
+        return name === pattern;
+    const expression = pattern
+        .split("*")
+        .map((part) => part.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&"))
+        .join(".*");
+    return new RegExp(`^${expression}$`, "u").test(name);
+}
+export function connectionGrantKey(connectionName, principalKey) {
+    return `${connectionName}:${principalKey}`;
+}
+export function timestamp() {
+    return new Date().toISOString();
+}
+export function stringValue(value) {
+    if (typeof value === "number" && Number.isFinite(value))
+        return String(value);
+    return typeof value === "string" ? value.trim() : "";
+}
+export function isLiveConnection(connection) {
+    return connection.protocol === "mcp"
+        || connection.protocol === "openapi"
+        || connection.protocol === "http"
+        || connection.protocol === "cli";
+}
+export function liveDefinitionUrl(definition) {
+    if ("url" in definition && typeof definition.url === "string")
+        return definition.url;
+    if ("baseUrl" in definition && definition.baseUrl)
+        return definition.baseUrl;
+    if ("command" in definition && typeof definition.command === "string")
+        return `cli:${definition.command}`;
+    return "spec" in definition && typeof definition.spec === "string" ? definition.spec : undefined;
+}
+export function isJsonObject(value) {
+    return isRecord(value);
+}
+export function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=connection-util.js.map

package/dist/connection-util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-util.js","sourceRoot":"","sources":["../src/connection-util.ts"],"names":[],"mappings":"AAYA;;;;GAIG;AAEH,MAAM,UAAU,2BAA2B,CAAC,cAAsB,EAAE,QAAgB;IAClF,OAAO,GAAG,cAAc,KAAK,QAAQ,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,aAAqB;IACtD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACtE,OAAO;QACL,cAAc,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;QAC7C,QAAQ,EAAE,aAAa,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;KACzC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,OAAO,KAAK;SACT,WAAW,EAAE;SACb,KAAK,CAAC,aAAa,CAAC;SACpB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,WAAqB,EAAE,IAA4B;IAC5E,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,iBAAiB,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACrD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;QAChC,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAC/B,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,KAAK,IAAI,CAAC,CAAC;QACjE,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;YACtC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,KAAK,IAAI,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAoB;IACtD,MAAM,GAAG,GAAsC,EAAE,CAAC;IAClD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;aAClE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,MAAwC;IACjF,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,OAAO,IAAI,MAAM;QAAE,OAAO,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACtE,OAAO,CAAC,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;AAClD,CAAC;AAID,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,MAAkC;IACnF,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,IAAI,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IAC5F,IAAI,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IAChE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,QAAkB;IAClE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAE,OAAe;IACvD,IAAI,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,KAAK,OAAO,CAAC;IACpD,MAAM,UAAU,GAAG,OAAO;SACvB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;SAC3D,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,IAAI,MAAM,CAAC,IAAI,UAAU,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,cAAsB,EAAE,YAAoB;IAC7E,OAAO,GAAG,cAAc,IAAI,YAAY,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9E,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,UAA8B;IAC7D,OAAO,UAAU,CAAC,QAAQ,KAAK,KAAK;WAC/B,UAAU,CAAC,QAAQ,KAAK,SAAS;WACjC,UAAU,CAAC,QAAQ,KAAK,MAAM;WAC9B,UAAU,CAAC,QAAQ,KAAK,KAAK,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,UAIkC;IAElC,IAAI,KAAK,IAAI,UAAU,IAAI,OAAO,UAAU,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAC,GAAG,CAAC;IACrF,IAAI,SAAS,IAAI,UAAU,IAAI,UAAU,CAAC,OAAO;QAAE,OAAO,UAAU,CAAC,OAAO,CAAC;IAC7E,IAAI,SAAS,IAAI,UAAU,IAAI,OAAO,UAAU,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,OAAO,UAAU,CAAC,OAAO,EAAE,CAAC;IAC1G,OAAO,MAAM,IAAI,UAAU,IAAI,OAAO,UAAU,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACnG,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/connections.d.ts

@@ -0,0 +1,152 @@
+import type { CompiledConnection, ConnectionResolverContext, JsonObject, SandboxCliInvocation, SandboxCommandResult } from "@assemblyline-agents/core";
+import { type ConnectionClient, type LiveConnectionDefinition } from "./connection-clients.js";
+import { type ConnectionAuthorizationSessionRecord, type ConnectionAuthorizationSessionStore, type ConnectionGrantStore, type ConnectionSearchInput, type ConnectionSearchResultItem, type ConnectionToolMetadata } from "./connection-stores.js";
+export * from "./connection-auth-util.js";
+export * from "./connection-clients.js";
+export * from "./connection-stores.js";
+export * from "./connection-util.js";
+export * from "./computer-relay-protocol.js";
+export interface RuntimeConnectionOptions {
+    connections: CompiledConnection[];
+    loadDefinition(connection: CompiledConnection): Promise<unknown>;
+    env: Record<string, string | undefined>;
+    fetch: typeof fetch;
+    session: ConnectionResolverContext["session"];
+    grantStore?: ConnectionGrantStore;
+    authorizationSessionStore?: ConnectionAuthorizationSessionStore;
+    callbackBaseUrl?: string;
+    /** Runtime host platform override for tests. Defaults to process.platform. */
+    platform?: string;
+    executeSandboxCli?: (invocation: SandboxCliInvocation & {
+        command: string;
+    }, execution?: ConnectionExecutionContext) => Promise<SandboxCommandResult>;
+}
+export interface ConnectionExecutionContext {
+    runId?: string;
+    toolCallId?: string;
+    toolName?: string;
+}
+export interface MaterializedConnectionCredential {
+    connection: string;
+    files: Array<{
+        path: string;
+        content: string;
+        mode: number;
+    }>;
+}
+export interface ConnectionCredentialMaterialization {
+    materialized: MaterializedConnectionCredential[];
+    pending: Array<{
+        connection: string;
+        reason: string;
+        authorizeUrl?: string;
+    }>;
+}
+export declare function connectionAuthorizationPrompt(store: ConnectionAuthorizationSessionStore, authorizationSessionId: string | undefined, baseResponse: string): Promise<string>;
+/**
+ * Project declared connection credentials into a freshly acquired sandbox.
+ * Tokens resolve host-side (cached grant or refresh exchange — the grant
+ * store is updated before anything reaches the sandbox), so recycling the
+ * sandbox never loses a durable credential and never holds one. Subagent
+ * sandboxes are excluded: they receive only their engine harness credential,
+ * never the parent's connections. The emitted event carries paths only —
+ * credential contents never reach the event log.
+ */
+export declare function materializeConnectionCredentialsIntoSandbox(run: {
+    id: string;
+    input: Record<string, unknown>;
+}, registry: RuntimeConnectionRegistry, sandbox: {
+    writeFile(path: string, contents: string): unknown;
+    shell(command: string): unknown;
+}, appendEvent: (eventType: string, payload: JsonObject) => Promise<unknown>): Promise<void>;
+export declare const CONNECTION_PAIR_TOOL_NAME = "pair";
+export declare class RuntimeConnectionRegistry {
+    private readonly options;
+    private resolved;
+    private clients;
+    private tokenCache;
+    private executionContext;
+    private readonly grantStore;
+    private readonly authorizationSessionStore;
+    constructor(options: RuntimeConnectionOptions);
+    hasLiveConnections(): boolean;
+    liveConnectionNames(): string[];
+    search(input: ConnectionSearchInput, execution?: ConnectionExecutionContext): Promise<ConnectionSearchResultItem[]>;
+    private searchWithContext;
+    private supportsPairing;
+    /**
+     * Redeem a user-provided one-time pairing code host-side and persist the
+     * resulting credentials in the grant store. The durable credential never
+     * enters a sandbox; the model only relays the single-use code.
+     */
+    redeemPairingCode(connectionName: string, code: string): Promise<{
+        connected: true;
+        connection: string;
+        message: string;
+    }>;
+    metadataForQualifiedName(qualifiedName: string): Promise<ConnectionToolMetadata | undefined>;
+    executeQualifiedTool(qualifiedName: string, input: unknown, execution?: ConnectionExecutionContext): Promise<unknown>;
+    getConnectionApproval(connectionName: string, toolName: string): Promise<LiveConnectionDefinition["approval"] | undefined>;
+    getClient(connectionName: string): ConnectionClient;
+    executeSandboxCli(invocation: SandboxCliInvocation & {
+        command: string;
+    }): Promise<SandboxCommandResult>;
+    resolveHeaders(connection: CompiledConnection, definition: LiveConnectionDefinition): Promise<Record<string, string>>;
+    /**
+     * Start (or resume) the authorization flow for a named connection and
+     * report where to send the user's browser. Backs the host's authenticated
+     * GET /openeve/connections/authorize endpoint (agent-control route class,
+     * JSON — deliberately not a public 302, so unauthenticated callers cannot
+     * trigger consent flows or enumerate connection names): the dashboard
+     * fetches the URL and opens it; the provider redirects back to the public,
+     * idempotency-claimed callback. Hitting it when a grant already exists
+     * reports "connected" instead of minting a redundant session; a pending
+     * session's challenge is reused.
+     */
+    beginAuthorization(connectionName: string): Promise<{
+        status: "authorize";
+        url: string;
+    } | {
+        status: "connected";
+    } | {
+        status: "unavailable";
+        reason: string;
+    }>;
+    /**
+     * Resolve every connection that declares `materialize` and render its
+     * credential files for injection into the agent sandbox. Tokens resolve
+     * through the normal host-side flow — cached grant, or a refresh exchange
+     * that persists the rotated grant to the grant store BEFORE anything is
+     * rendered — so the sandbox only ever sees the short-lived access token.
+     *
+     * A connection that cannot resolve (missing grant, pending authorization,
+     * failed refresh) is reported as pending, never thrown: missing credentials
+     * are a recoverable connection-required state, not a boot crash.
+     */
+    materializeCredentials(): Promise<ConnectionCredentialMaterialization>;
+    evictToken(connection: CompiledConnection, definition: LiveConnectionDefinition): Promise<void>;
+    completeAuthorization(callback: {
+        params: Record<string, string>;
+        method: string;
+        body?: string;
+    }): Promise<ConnectionAuthorizationSessionRecord>;
+    getAuthorizationSession(id: string): Promise<ConnectionAuthorizationSessionRecord | undefined>;
+    updateAuthorizationSession(id: string, patch: Partial<Omit<ConnectionAuthorizationSessionRecord, "id" | "createdAt">>): Promise<ConnectionAuthorizationSessionRecord>;
+    close(): Promise<void>;
+    request(input: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]): ReturnType<typeof fetch>;
+    environmentValue(name: string): string | undefined;
+    private resolveConnection;
+    private loadResolvedConnection;
+    private targetConnections;
+    private connectionFailure;
+    private resolveToken;
+    private resolverContext;
+    private withExecutionContext;
+    private createAuthorizationRequiredError;
+    private callbackUrl;
+    private exchangeOAuthAuthorizationCode;
+    private refreshOAuthGrant;
+    private requestOAuthToken;
+    private saveGrantFromToken;
+}
+//# sourceMappingURL=connections.d.ts.map

package/dist/connections.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connections.d.ts","sourceRoot":"","sources":["../src/connections.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,kBAAkB,EAKlB,yBAAyB,EAEzB,UAAU,EAMV,oBAAoB,EACpB,oBAAoB,EAErB,MAAM,2BAA2B,CAAC;AAenC,OAAO,EAML,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAE9B,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAGL,KAAK,oCAAoC,EACzC,KAAK,mCAAmC,EACxC,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,EAE5B,MAAM,wBAAwB,CAAC;AAGhC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,yBAAyB,CAAC;AACxC,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,8BAA8B,CAAC;AAE7C,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAClC,cAAc,CAAC,UAAU,EAAE,kBAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACxC,KAAK,EAAE,OAAO,KAAK,CAAC;IACpB,OAAO,EAAE,yBAAyB,CAAC,SAAS,CAAC,CAAC;IAC9C,UAAU,CAAC,EAAE,oBAAoB,CAAC;IAClC,yBAAyB,CAAC,EAAE,mCAAmC,CAAC;IAChE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,CAClB,UAAU,EAAE,oBAAoB,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,EACtD,SAAS,CAAC,EAAE,0BAA0B,KACnC,OAAO,CAAC,oBAAoB,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gCAAgC;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/D;AAED,MAAM,WAAW,mCAAmC;IAClD,YAAY,EAAE,gCAAgC,EAAE,CAAC;IACjD,OAAO,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/E;AAKD,wBAAsB,6BAA6B,CACjD,KAAK,EAAE,mCAAmC,EAC1C,sBAAsB,EAAE,MAAM,GAAG,SAAS,EAC1C,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,CAMjB;AAED;;;;;;;;GAQG;AACH,wBAAsB,2CAA2C,CAC/D,GAAG,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,EACnD,QAAQ,EAAE,yBAAyB,EACnC,OAAO,EAAE;IAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IAAC,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,EAChG,WAAW,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,KAAK,OAAO,CAAC,OAAO,CAAC,GACxE,OAAO,CAAC,IAAI,CAAC,CAiBf;AAED,eAAO,MAAM,yBAAyB,SAAS,CAAC;AAkDhD,qBAAa,yBAAyB;IAQxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAPpC,OAAO,CAAC,QAAQ,CAAkD;IAClE,OAAO,CAAC,OAAO,CAAuC;IACtD,OAAO,CAAC,UAAU,CAAsC;IACxD,OAAO,CAAC,gBAAgB,CAAyC;IACjE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuB;IAClD,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAsC;gBAEnD,OAAO,EAAE,wBAAwB;IAK9D,kBAAkB,IAAI,OAAO;IAI7B,mBAAmB,IAAI,MAAM,EAAE;IAMzB,MAAM,CAAC,KAAK,EAAE,qBAAqB,EAAE,SAAS,CAAC,EAAE,0BAA0B,GAAG,OAAO,CAAC,0BAA0B,EAAE,CAAC;YAI3G,iBAAiB;YAqDjB,eAAe;IAQ7B;;;;OAIG;IACG,iBAAiB,CAAC,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAyB1H,wBAAwB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC;IAO5F,oBAAoB,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,0BAA0B,GAAG,OAAO,CAAC,OAAO,CAAC;IAgBrH,qBAAqB,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC,UAAU,CAAC,GAAG,SAAS,CAAC;IAYhI,SAAS,CAAC,cAAc,EAAE,MAAM,GAAG,gBAAgB;IAqB7C,iBAAiB,CACrB,UAAU,EAAE,oBAAoB,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GACrD,OAAO,CAAC,oBAAoB,CAAC;IAO1B,cAAc,CAAC,UAAU,EAAE,kBAAkB,EAAE,UAAU,EAAE,wBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAoB3H;;;;;;;;;;OAUG;IACG,kBAAkB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CACvD;QAAE,MAAM,EAAE,WAAW,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,MAAM,EAAE,WAAW,CAAA;KAAE,GAAG;QAAE,MAAM,EAAE,aAAa,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAC3G;IAsBD;;;;;;;;;;OAUG;IACG,sBAAsB,IAAI,OAAO,CAAC,mCAAmC,CAAC;IAgEtE,UAAU,CAAC,UAAU,EAAE,kBAAkB,EAAE,UAAU,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC;IAe/F,qBAAqB,CAAC,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,oCAAoC,CAAC;IAoDjJ,uBAAuB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oCAAoC,GAAG,SAAS,CAAC;IAI9F,0BAA0B,CAC9B,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,oCAAoC,EAAE,IAAI,GAAG,WAAW,CAAC,CAAC,GAC7E,OAAO,CAAC,oCAAoC,CAAC;IAI1C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAK5B,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,OAAO,KAAK,CAAC;IAIzG,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;YAIpC,iBAAiB;YAQjB,sBAAsB;IAyDpC,OAAO,CAAC,iBAAiB;IAOzB,OAAO,CAAC,iBAAiB;YAuBX,YAAY;IA2C1B,OAAO,CAAC,eAAe;YAOT,oBAAoB;YAUpB,gCAAgC;IA6E9C,OAAO,CAAC,WAAW;YAKL,8BAA8B;YAiB9B,iBAAiB;YAgBjB,iBAAiB;YA+CjB,kBAAkB;CA0BjC"}