@exulu/backend 3.0.0 → 3.1.0

package/dist/index.d.cts

@@ -233,7 +233,8 @@ interface Item {
  * declared in code (source them from env vars or however you like) — none of
  * them are exposed as admin-configurable tool config.
  */
-type ExuluOauthConfig = {
+interface ExuluOauthConfig {
+    authType: "oauth";
     /**
      * Identifier for the OAuth provider (e.g., "google", "jira", "github").
      * Tools sharing the same provider share tokens under (provider, userId) —
@@ -241,7 +242,7 @@ type ExuluOauthConfig = {
      * omitted, defaults to the tool's `id`, preserving per-tool behavior for
      * tools that don't opt in.
      */
-    provider?: string;
+    provider: string;
     /** The provider's authorization endpoint, e.g. https://app.hubspot.com/oauth/authorize */
     authorizationUrl: string;
     /** The provider's token endpoint, e.g. https://api.hubapi.com/oauth/v1/token */
@@ -250,7 +251,7 @@ type ExuluOauthConfig = {
     /** Never leaves the server: used only in the server-side token exchange. */
     clientSecret: string;
     /** Scopes to request; joined with spaces in the authorization URL. */
-    scopes: string[];
+    scopes: readonly string[];
     /** PKCE (S256). Defaults to true; set false for providers that reject PKCE. */
     pkce?: boolean;
     /**
@@ -259,7 +260,26 @@ type ExuluOauthConfig = {
      * refresh token.
      */
     extraAuthParams?: Record<string, string>;
-};
+}
+interface CredentialField {
+    name: string;
+    label: string;
+    type: "text" | "password";
+    placeholder?: string;
+    help?: string;
+}
+interface ExuluUserCredentialsConfig {
+    authType: "user_credentials";
+    provider: string;
+    fields: CredentialField[];
+    validate?: (values: Record<string, string>) => Promise<void>;
+}
+type ExuluAuthConfig = ExuluOauthConfig | ExuluUserCredentialsConfig;
+interface ExuluCredentialsToolContext {
+    userId: string;
+    provider: string;
+    credentials: Record<string, string>;
+}
 /** The oauth context injected into an oauth-enabled tool's execute inputs. */
 type ExuluOauthToolContext = {
     accessToken: string;
@@ -281,14 +301,14 @@ declare class ExuluTool {
     type: ToolType;
     tool: Tool;
     needsApproval: boolean;
-    oauth?: ExuluOauthConfig;
+    authentication?: ExuluAuthConfig;
     config: {
         name: string;
         description: string;
         type: "boolean" | "string" | "number" | "variable" | "json";
         default?: string | boolean | number | object;
     }[];
-    constructor({ id, name, description, category, inputSchema, type, execute, config, needsApproval, oauth, }: {
+    constructor({ id, name, description, category, inputSchema, type, execute, config, needsApproval, authentication, }: {
         id: string;
         name: string;
         description: string;
@@ -302,7 +322,7 @@ declare class ExuluTool {
             default?: string | boolean | number | object;
         }[];
         needsApproval?: boolean;
-        oauth?: ExuluOauthConfig;
+        authentication?: ExuluAuthConfig;
         execute: (inputs: any, options?: any) => Promise<{
             result?: string;
             job?: string;
@@ -658,6 +678,13 @@ type ExuluContextFieldDefinition = {
     index?: boolean;
     enumValues?: string[];
     allowedFileTypes?: allFileTypes[];
+    /**
+     * Write-only secret: excluded from the generated GraphQL object type, Filter
+     * type, SQL read selections, and all read payloads. Still accepted as
+     * mutation INPUT (the mutation layer hashes/stores it) unless additionally
+     * excluded by name in the input generator.
+     */
+    hidden?: boolean;
 };
 type ExuluContextSource = {
     id: string;
@@ -2532,6 +2559,12 @@ declare const JOB_STATUS_ENUM: {
     cancelled: string;
 };
 
+declare class CredentialInvalidError extends Error {
+    readonly provider: string;
+    readonly reason?: string;
+    constructor(provider: string, reason?: string);
+}
+
 declare const ExuluJobs: {
     redis: typeof redisClient;
 };
@@ -2635,4 +2668,4 @@ declare const ExuluPython: {
     instructions: typeof getPythonSetupInstructions;
 };
 
-export { type ChunkerOperation, type ChunkerResponse, type JOB_STATUS as EXULU_JOB_STATUS, JOB_STATUS_ENUM as EXULU_JOB_STATUS_ENUM, type STATISTICS_TYPE as EXULU_STATISTICS_TYPE, STATISTICS_TYPE_ENUM as EXULU_STATISTICS_TYPE_ENUM, type ExuluAgent, ExuluApp, ExuluAuthentication, ExuluChunkers, ExuluContext, type ExuluContextEmbedder, ExuluDatabase, ExuluDefaultProviders, ExuluDefaultTools, ExuluDocumentProcessor, ExuluEval, type Item as ExuluItem, ExuluJobs, type ExuluOauthConfig, type ExuluOauthToolContext, ExuluOtel, ExuluProvider, ExuluPython, queues as ExuluQueues, ExuluReadApi, ExuluReranker, ExuluTool, ExuluVariables, type VectorSearchChunkResult, defaultChunker, enableLiteLLMClientMode, postgresClient };
+export { type ChunkerOperation, type ChunkerResponse, type CredentialField, CredentialInvalidError, type JOB_STATUS as EXULU_JOB_STATUS, JOB_STATUS_ENUM as EXULU_JOB_STATUS_ENUM, type STATISTICS_TYPE as EXULU_STATISTICS_TYPE, STATISTICS_TYPE_ENUM as EXULU_STATISTICS_TYPE_ENUM, type ExuluAgent, ExuluApp, type ExuluAuthConfig, ExuluAuthentication, ExuluChunkers, ExuluContext, type ExuluContextEmbedder, type ExuluCredentialsToolContext, ExuluDatabase, ExuluDefaultProviders, ExuluDefaultTools, ExuluDocumentProcessor, ExuluEval, type Item as ExuluItem, ExuluJobs, type ExuluOauthConfig, type ExuluOauthToolContext, ExuluOtel, ExuluProvider, ExuluPython, queues as ExuluQueues, ExuluReadApi, ExuluReranker, ExuluTool, type ExuluUserCredentialsConfig, ExuluVariables, type VectorSearchChunkResult, defaultChunker, enableLiteLLMClientMode, postgresClient };

package/dist/index.d.ts

@@ -233,7 +233,8 @@ interface Item {
  * declared in code (source them from env vars or however you like) — none of
  * them are exposed as admin-configurable tool config.
  */
-type ExuluOauthConfig = {
+interface ExuluOauthConfig {
+    authType: "oauth";
     /**
      * Identifier for the OAuth provider (e.g., "google", "jira", "github").
      * Tools sharing the same provider share tokens under (provider, userId) —
@@ -241,7 +242,7 @@ type ExuluOauthConfig = {
      * omitted, defaults to the tool's `id`, preserving per-tool behavior for
      * tools that don't opt in.
      */
-    provider?: string;
+    provider: string;
     /** The provider's authorization endpoint, e.g. https://app.hubspot.com/oauth/authorize */
     authorizationUrl: string;
     /** The provider's token endpoint, e.g. https://api.hubapi.com/oauth/v1/token */
@@ -250,7 +251,7 @@ type ExuluOauthConfig = {
     /** Never leaves the server: used only in the server-side token exchange. */
     clientSecret: string;
     /** Scopes to request; joined with spaces in the authorization URL. */
-    scopes: string[];
+    scopes: readonly string[];
     /** PKCE (S256). Defaults to true; set false for providers that reject PKCE. */
     pkce?: boolean;
     /**
@@ -259,7 +260,26 @@ type ExuluOauthConfig = {
      * refresh token.
      */
     extraAuthParams?: Record<string, string>;
-};
+}
+interface CredentialField {
+    name: string;
+    label: string;
+    type: "text" | "password";
+    placeholder?: string;
+    help?: string;
+}
+interface ExuluUserCredentialsConfig {
+    authType: "user_credentials";
+    provider: string;
+    fields: CredentialField[];
+    validate?: (values: Record<string, string>) => Promise<void>;
+}
+type ExuluAuthConfig = ExuluOauthConfig | ExuluUserCredentialsConfig;
+interface ExuluCredentialsToolContext {
+    userId: string;
+    provider: string;
+    credentials: Record<string, string>;
+}
 /** The oauth context injected into an oauth-enabled tool's execute inputs. */
 type ExuluOauthToolContext = {
     accessToken: string;
@@ -281,14 +301,14 @@ declare class ExuluTool {
     type: ToolType;
     tool: Tool;
     needsApproval: boolean;
-    oauth?: ExuluOauthConfig;
+    authentication?: ExuluAuthConfig;
     config: {
         name: string;
         description: string;
         type: "boolean" | "string" | "number" | "variable" | "json";
         default?: string | boolean | number | object;
     }[];
-    constructor({ id, name, description, category, inputSchema, type, execute, config, needsApproval, oauth, }: {
+    constructor({ id, name, description, category, inputSchema, type, execute, config, needsApproval, authentication, }: {
         id: string;
         name: string;
         description: string;
@@ -302,7 +322,7 @@ declare class ExuluTool {
             default?: string | boolean | number | object;
         }[];
         needsApproval?: boolean;
-        oauth?: ExuluOauthConfig;
+        authentication?: ExuluAuthConfig;
         execute: (inputs: any, options?: any) => Promise<{
             result?: string;
             job?: string;
@@ -658,6 +678,13 @@ type ExuluContextFieldDefinition = {
     index?: boolean;
     enumValues?: string[];
     allowedFileTypes?: allFileTypes[];
+    /**
+     * Write-only secret: excluded from the generated GraphQL object type, Filter
+     * type, SQL read selections, and all read payloads. Still accepted as
+     * mutation INPUT (the mutation layer hashes/stores it) unless additionally
+     * excluded by name in the input generator.
+     */
+    hidden?: boolean;
 };
 type ExuluContextSource = {
     id: string;
@@ -2532,6 +2559,12 @@ declare const JOB_STATUS_ENUM: {
     cancelled: string;
 };
 
+declare class CredentialInvalidError extends Error {
+    readonly provider: string;
+    readonly reason?: string;
+    constructor(provider: string, reason?: string);
+}
+
 declare const ExuluJobs: {
     redis: typeof redisClient;
 };
@@ -2635,4 +2668,4 @@ declare const ExuluPython: {
     instructions: typeof getPythonSetupInstructions;
 };
 
-export { type ChunkerOperation, type ChunkerResponse, type JOB_STATUS as EXULU_JOB_STATUS, JOB_STATUS_ENUM as EXULU_JOB_STATUS_ENUM, type STATISTICS_TYPE as EXULU_STATISTICS_TYPE, STATISTICS_TYPE_ENUM as EXULU_STATISTICS_TYPE_ENUM, type ExuluAgent, ExuluApp, ExuluAuthentication, ExuluChunkers, ExuluContext, type ExuluContextEmbedder, ExuluDatabase, ExuluDefaultProviders, ExuluDefaultTools, ExuluDocumentProcessor, ExuluEval, type Item as ExuluItem, ExuluJobs, type ExuluOauthConfig, type ExuluOauthToolContext, ExuluOtel, ExuluProvider, ExuluPython, queues as ExuluQueues, ExuluReadApi, ExuluReranker, ExuluTool, ExuluVariables, type VectorSearchChunkResult, defaultChunker, enableLiteLLMClientMode, postgresClient };
+export { type ChunkerOperation, type ChunkerResponse, type CredentialField, CredentialInvalidError, type JOB_STATUS as EXULU_JOB_STATUS, JOB_STATUS_ENUM as EXULU_JOB_STATUS_ENUM, type STATISTICS_TYPE as EXULU_STATISTICS_TYPE, STATISTICS_TYPE_ENUM as EXULU_STATISTICS_TYPE_ENUM, type ExuluAgent, ExuluApp, type ExuluAuthConfig, ExuluAuthentication, ExuluChunkers, ExuluContext, type ExuluContextEmbedder, type ExuluCredentialsToolContext, ExuluDatabase, ExuluDefaultProviders, ExuluDefaultTools, ExuluDocumentProcessor, ExuluEval, type Item as ExuluItem, ExuluJobs, type ExuluOauthConfig, type ExuluOauthToolContext, ExuluOtel, ExuluProvider, ExuluPython, queues as ExuluQueues, ExuluReadApi, ExuluReranker, ExuluTool, type ExuluUserCredentialsConfig, ExuluVariables, type VectorSearchChunkResult, defaultChunker, enableLiteLLMClientMode, postgresClient };