@flowdular/sdk 0.2.4 → 0.3.0

package/modules/connectors/src/domain/calls.ts

@@ -0,0 +1,70 @@
+import type {
+	ConnectorCaller,
+	ConnectorCallOutcome,
+	ConnectorErrorClass,
+} from './types.ts';
+
+/**
+ * The capability a workflow action or an agent tool resolves to reach an
+ * external system. It carries the caller kind because consent is granted per
+ * caller: an instance may be open to workflows and closed to agents.
+ */
+export const CONNECTORS_CALLS_CAPABILITY = 'connectors.calls.v1';
+
+export type ConnectorJsonValue =
+	| string
+	| number
+	| boolean
+	| null
+	| readonly ConnectorJsonValue[]
+	| { readonly [key: string]: ConnectorJsonValue };
+
+export interface ConnectorCallRequest {
+	readonly tenantId: string;
+	readonly instanceId: string;
+	readonly operation: string;
+	readonly input: Readonly<Record<string, unknown>>;
+	readonly caller: ConnectorCaller;
+	/** The run this call belongs to, recorded with the call. */
+	readonly callerRef?: string | undefined;
+	/**
+	 * Binds this call to one durable key. A repeat of the key answers the call
+	 * it already produced instead of reaching the external system again, so an
+	 * unattended caller replayed after a crash writes at most once.
+	 */
+	readonly idempotencyKey?: string | undefined;
+	readonly signal?: AbortSignal | undefined;
+}
+
+export interface ConnectorCallResult {
+	readonly callId: string;
+	readonly outcome: ConnectorCallOutcome;
+	readonly status: number | null;
+	readonly errorClass: ConnectorErrorClass | null;
+	readonly durationMs: number;
+	readonly requestBytes: number;
+	readonly responseBytes: number;
+	/** Parsed JSON response. Returned to the caller, never written to the log. */
+	readonly body: ConnectorJsonValue | null;
+	/** Bounded text of the response for diagnosis. Never written to the log. */
+	readonly bodyPreview: string;
+	/**
+	 * True when the idempotency ledger answered with a call that already ran.
+	 * Nothing left the process, and the log keeps no body, so `body` and
+	 * `bodyPreview` are empty rather than the original answer.
+	 */
+	readonly replayed: boolean;
+}
+
+export interface ConnectorCallCapability {
+	call(request: ConnectorCallRequest): Promise<ConnectorCallResult>;
+	/**
+	 * Whether this caller kind may use the instance right now. A caller that
+	 * admits a tool before running it asks this instead of making a call.
+	 */
+	consented(
+		tenantId: string,
+		instanceId: string,
+		caller: ConnectorCaller,
+	): Promise<boolean>;
+}

package/modules/connectors/src/domain/definitions.ts

@@ -0,0 +1,190 @@
+import {
+	CONNECTOR_AUTH_KINDS,
+	CONNECTOR_METHODS,
+	type ConnectorDefinition,
+	type ConnectorOperation,
+} from './types.ts';
+
+/**
+ * The registry a module obtains with `context.capabilities.get` to ship its own
+ * connector kind. Registration happens while modules compose; the first read
+ * seals the registry, so the set a workspace sees cannot change under a call.
+ */
+export const CONNECTORS_DEFINITIONS_CAPABILITY = 'connectors.definitions.v1';
+
+export interface ConnectorDefinitionRegistry {
+	register(definition: ConnectorDefinition): void;
+	list(): readonly ConnectorDefinition[];
+	get(key: string): ConnectorDefinition | null;
+}
+
+/** Definitions are code, not tenant data, so the bound is a boot-time bug guard. */
+export const MAX_DEFINITIONS = 64;
+export const MAX_OPERATIONS_PER_DEFINITION = 64;
+export const MAX_PORTS_PER_DEFINITION = 8;
+
+/** The one port every connector reaches unless its definition names more. */
+export const DEFAULT_ALLOWED_PORTS: readonly number[] = Object.freeze([443]);
+
+/** The ports an instance of this definition may reach, defaulted. */
+export function definitionAllowedPorts(
+	definition: ConnectorDefinition,
+): readonly number[] {
+	return definition.allowedPorts ?? DEFAULT_ALLOWED_PORTS;
+}
+
+export class ConnectorDefinitionError extends Error {
+	constructor(
+		readonly code: string,
+		message: string,
+	) {
+		super(message);
+		this.name = 'ConnectorDefinitionError';
+	}
+}
+
+function identifier(value: string, field: string, max: number): string {
+	if (!new RegExp(`^[a-z][a-z0-9-]{0,${max - 1}}$`).test(value)) {
+		throw new ConnectorDefinitionError(
+			'DEFINITION_INVALID',
+			`${field} must be a lowercase identifier of at most ${max} characters.`,
+		);
+	}
+	return value;
+}
+
+function text(value: string, field: string, max: number): string {
+	const normalized = value.trim();
+	if (normalized.length === 0 || normalized.length > max) {
+		throw new ConnectorDefinitionError(
+			'DEFINITION_INVALID',
+			`${field} must contain between 1 and ${max} characters.`,
+		);
+	}
+	return normalized;
+}
+
+function operation(value: ConnectorOperation): ConnectorOperation {
+	identifier(value.key, 'operation key', 64);
+	text(value.label, 'operation label', 120);
+	if (!CONNECTOR_METHODS.includes(value.method)) {
+		throw new ConnectorDefinitionError(
+			'DEFINITION_INVALID',
+			`operation ${value.key} declares an unsupported method.`,
+		);
+	}
+	const path = text(value.path, 'operation path', 1_024);
+	/* The expanded path is always absolute: either the template starts with the
+	   slash, or it opens with a reserved expansion whose value must. */
+	if (!path.startsWith('/') && !path.startsWith('{+')) {
+		throw new ConnectorDefinitionError(
+			'DEFINITION_INVALID',
+			`operation ${value.key} must declare a path template that expands to an absolute path.`,
+		);
+	}
+	return value;
+}
+
+export function assertConnectorDefinition(
+	definition: ConnectorDefinition,
+): ConnectorDefinition {
+	identifier(definition.key, 'definition key', 96);
+	text(definition.moduleId, 'definition moduleId', 64);
+	text(definition.label, 'definition label', 120);
+	if (definition.authKinds.length === 0) {
+		throw new ConnectorDefinitionError(
+			'DEFINITION_INVALID',
+			`definition ${definition.key} must support at least one authentication kind.`,
+		);
+	}
+	for (const kind of definition.authKinds) {
+		if (!CONNECTOR_AUTH_KINDS.includes(kind)) {
+			throw new ConnectorDefinitionError(
+				'DEFINITION_INVALID',
+				`definition ${definition.key} declares an unknown authentication kind.`,
+			);
+		}
+	}
+	if (
+		definition.operations.length === 0 ||
+		definition.operations.length > MAX_OPERATIONS_PER_DEFINITION
+	) {
+		throw new ConnectorDefinitionError(
+			'DEFINITION_INVALID',
+			`definition ${definition.key} must declare between 1 and ${MAX_OPERATIONS_PER_DEFINITION} operations.`,
+		);
+	}
+	const keys = new Set<string>();
+	for (const item of definition.operations) {
+		operation(item);
+		if (keys.has(item.key)) {
+			throw new ConnectorDefinitionError(
+				'DEFINITION_INVALID',
+				`definition ${definition.key} declares operation ${item.key} twice.`,
+			);
+		}
+		keys.add(item.key);
+	}
+	for (const host of definition.defaultAllowedHosts) {
+		text(host, 'definition host', 253);
+	}
+	if (definition.allowedPorts !== undefined) {
+		if (
+			definition.allowedPorts.length === 0 ||
+			definition.allowedPorts.length > MAX_PORTS_PER_DEFINITION
+		) {
+			throw new ConnectorDefinitionError(
+				'DEFINITION_INVALID',
+				`definition ${definition.key} must declare between 1 and ${MAX_PORTS_PER_DEFINITION} allowed ports, or none at all.`,
+			);
+		}
+		for (const port of definition.allowedPorts) {
+			if (!Number.isSafeInteger(port) || port < 1 || port > 65_535) {
+				throw new ConnectorDefinitionError(
+					'DEFINITION_INVALID',
+					`definition ${definition.key} declares ${String(port)}, which is not a port.`,
+				);
+			}
+		}
+	}
+	return definition;
+}
+
+export function createConnectorDefinitionRegistry(): ConnectorDefinitionRegistry {
+	const definitions = new Map<string, ConnectorDefinition>();
+	let sealed = false;
+	return {
+		register(definition) {
+			if (sealed) {
+				throw new ConnectorDefinitionError(
+					'DEFINITIONS_SEALED',
+					'Connector definitions are registered while modules compose, not afterwards.',
+				);
+			}
+			assertConnectorDefinition(definition);
+			if (definitions.has(definition.key)) {
+				throw new ConnectorDefinitionError(
+					'DEFINITION_DUPLICATE',
+					`A connector definition with key ${definition.key} is already registered.`,
+				);
+			}
+			if (definitions.size >= MAX_DEFINITIONS) {
+				throw new ConnectorDefinitionError(
+					'DEFINITIONS_EXHAUSTED',
+					`At most ${MAX_DEFINITIONS} connector definitions may be registered.`,
+				);
+			}
+			definitions.set(definition.key, Object.freeze({ ...definition }));
+		},
+		list() {
+			sealed = true;
+			return [...definitions.values()].sort((left, right) =>
+				left.key.localeCompare(right.key),
+			);
+		},
+		get(key) {
+			sealed = true;
+			return definitions.get(key) ?? null;
+		},
+	};
+}

package/modules/connectors/src/domain/http-json.ts

@@ -0,0 +1,68 @@
+import type { ConnectorDefinition, ConnectorOperation } from './types.ts';
+
+export const HTTP_JSON_DEFINITION_KEY = 'http-json';
+
+const PATH = {
+	type: 'string',
+	maxLength: 1024,
+} as const;
+
+const QUERY = {
+	type: 'object',
+	description: 'Flat query parameters appended to the path.',
+} as const;
+
+const BODY = {
+	type: 'object',
+	description: 'JSON request body.',
+} as const;
+
+const OUTPUT = {
+	type: 'object',
+	description: 'The parsed JSON response of the external system.',
+} as const;
+
+function operation(
+	key: string,
+	label: string,
+	method: ConnectorOperation['method'],
+	body: boolean,
+): ConnectorOperation {
+	return {
+		key,
+		label,
+		method,
+		/* The whole path comes from the call, so the template is one reserved
+		   expansion: the generic connector has no fixed resource of its own. */
+		path: '{+path}',
+		inputSchema: {
+			type: 'object',
+			additionalProperties: false,
+			required: ['path'],
+			properties: body
+				? { path: PATH, query: QUERY, body: BODY }
+				: { path: PATH, query: QUERY },
+		},
+		outputSchema: OUTPUT,
+	};
+}
+
+/**
+ * The connector the platform ships so a workspace can reach a JSON API without
+ * a module of its own. It fixes no host: the instance base URL, its allowlist
+ * and the egress policy are the only bounds.
+ */
+export const HTTP_JSON_DEFINITION: ConnectorDefinition = {
+	key: HTTP_JSON_DEFINITION_KEY,
+	moduleId: 'connectors.core',
+	label: 'Generic HTTP JSON',
+	authKinds: ['none', 'api-key', 'bearer', 'oauth2-client-credentials'],
+	operations: [
+		operation('get', 'GET', 'GET', false),
+		operation('post', 'POST', 'POST', true),
+		operation('put', 'PUT', 'PUT', true),
+		operation('patch', 'PATCH', 'PATCH', true),
+		operation('delete', 'DELETE', 'DELETE', false),
+	],
+	defaultAllowedHosts: [],
+};

package/modules/connectors/src/domain/types.ts

@@ -0,0 +1,185 @@
+export const CONNECTOR_AUTH_KINDS = [
+	'none',
+	'api-key',
+	'bearer',
+	'oauth2-client-credentials',
+] as const;
+export type ConnectorAuthKind = (typeof CONNECTOR_AUTH_KINDS)[number];
+
+export const CONNECTOR_METHODS = [
+	'GET',
+	'POST',
+	'PUT',
+	'PATCH',
+	'DELETE',
+] as const;
+export type ConnectorMethod = (typeof CONNECTOR_METHODS)[number];
+
+export const CONNECTOR_INSTANCE_STATUSES = ['active', 'disabled'] as const;
+export type ConnectorInstanceStatus =
+	(typeof CONNECTOR_INSTANCE_STATUSES)[number];
+
+export const CONNECTOR_CALLERS = ['test', 'workflow', 'agent'] as const;
+export type ConnectorCaller = (typeof CONNECTOR_CALLERS)[number];
+
+export const CONNECTOR_CALL_OUTCOMES = [
+	'succeeded',
+	'failed',
+	'refused',
+] as const;
+export type ConnectorCallOutcome = (typeof CONNECTOR_CALL_OUTCOMES)[number];
+
+/**
+ * The closed set the call log stores. `refused` outcomes never reached the
+ * network; `failed` ones did, or were stopped by the transport itself.
+ */
+export const CONNECTOR_ERROR_CLASSES = [
+	'egress-refused',
+	'instance-disabled',
+	'consent-missing',
+	'definition-missing',
+	'operation-unknown',
+	'invalid-input',
+	'credential-unavailable',
+	'dns',
+	'timeout',
+	'network',
+	'response-4xx',
+	'response-5xx',
+	'response-too-large',
+] as const;
+export type ConnectorErrorClass = (typeof CONNECTOR_ERROR_CLASSES)[number];
+
+/** One operation of a definition. `path` is a template over the base URL. */
+export interface ConnectorOperation {
+	readonly key: string;
+	readonly label: string;
+	readonly method: ConnectorMethod;
+	/**
+	 * `{name}` expands one path segment and `{+name}` expands a whole path,
+	 * both from the call input. Nothing else is substituted.
+	 */
+	readonly path: string;
+	readonly inputSchema: Readonly<Record<string, unknown>>;
+	readonly outputSchema: Readonly<Record<string, unknown>>;
+}
+
+export interface ConnectorDefinition {
+	readonly key: string;
+	readonly moduleId: string;
+	readonly label: string;
+	readonly authKinds: readonly ConnectorAuthKind[];
+	readonly operations: readonly ConnectorOperation[];
+	/**
+	 * Hosts an instance of this definition may reach. Empty means the definition
+	 * names no host of its own and the instance allowlist is the only bound.
+	 */
+	readonly defaultAllowedHosts: readonly string[];
+	/**
+	 * Ports an instance of this definition may reach. Absent means 443 only; a
+	 * definition that needs another port names every port it accepts, so an
+	 * instance can never be aimed at a service that answers on an unnamed one.
+	 */
+	readonly allowedPorts?: readonly number[] | undefined;
+}
+
+/** An instance as every reader sees it. A credential never appears here. */
+export interface ConnectorInstance {
+	readonly id: string;
+	readonly tenantId: string;
+	readonly definitionKey: string;
+	readonly name: string;
+	readonly baseUrl: string;
+	readonly authKind: ConnectorAuthKind;
+	readonly credentialFingerprint: string | null;
+	readonly allowedHosts: readonly string[];
+	readonly allowWorkflows: boolean;
+	readonly allowAgents: boolean;
+	readonly status: ConnectorInstanceStatus;
+	readonly lastCallAt: number | null;
+	readonly createdAt: number;
+	readonly updatedAt: number;
+}
+
+export interface ConnectorCall {
+	readonly id: string;
+	readonly tenantId: string;
+	readonly instanceId: string;
+	readonly operation: string;
+	readonly caller: ConnectorCaller;
+	readonly callerRef: string | null;
+	readonly outcome: ConnectorCallOutcome;
+	readonly status: number | null;
+	readonly errorClass: ConnectorErrorClass | null;
+	readonly durationMs: number;
+	readonly requestBytes: number;
+	readonly responseBytes: number;
+	readonly occurredAt: number;
+}
+
+/** A call as the log screen lists it: the row plus the name of its instance. */
+export interface ConnectorCallListRow extends ConnectorCall {
+	/** Null once the instance was deleted; the call log outlives it. */
+	readonly instanceName: string | null;
+}
+
+export type ConnectorCredentials =
+	| { readonly kind: 'none' }
+	| {
+			readonly kind: 'api-key';
+			readonly header: string;
+			readonly value: string;
+	  }
+	| { readonly kind: 'bearer'; readonly token: string }
+	| {
+			readonly kind: 'oauth2-client-credentials';
+			readonly tokenUrl: string;
+			readonly clientId: string;
+			readonly clientSecret: string;
+			readonly scope: string | null;
+	  };
+
+export interface CreateConnectorInstanceInput {
+	readonly definitionKey: string;
+	readonly name: string;
+	readonly baseUrl: string;
+	readonly authKind: ConnectorAuthKind;
+	/** Accepted once and sealed; never returned again. */
+	readonly credentials: Record<string, unknown>;
+	readonly allowedHosts: readonly string[];
+}
+
+export interface UpdateConnectorInstanceInput {
+	readonly name: string;
+	readonly baseUrl: string;
+	readonly allowedHosts: readonly string[];
+	/** Absent keeps the sealed credential the instance already holds. */
+	readonly credentials?: Record<string, unknown> | undefined;
+}
+
+export interface ConnectorConsentInput {
+	readonly allowWorkflows: boolean;
+	readonly allowAgents: boolean;
+	/** The owner's explicit confirmation, recorded with the audit row. */
+	readonly confirmed: boolean;
+}
+
+export const CONNECTOR_AUDIT_ACTIONS = [
+	'instance.created',
+	'instance.updated',
+	'instance.consent-changed',
+	'instance.enabled',
+	'instance.disabled',
+	'instance.deleted',
+] as const;
+export type ConnectorAuditAction = (typeof CONNECTOR_AUDIT_ACTIONS)[number];
+
+export interface ConnectorAuditEvent {
+	readonly id: string;
+	readonly tenantId: string;
+	readonly actorId: string;
+	readonly action: ConnectorAuditAction;
+	readonly instanceId: string;
+	readonly metadata: Readonly<Record<string, string | number | boolean>>;
+	readonly occurredAt: number;
+}

package/modules/connectors/src/index.ts

@@ -0,0 +1,64 @@
+import type { ModuleManifest, RegisteredModule } from '@flowdular/sdk/contracts';
+import manifest from '../module.json' with { type: 'json' };
+import { CONNECTORS_PERMISSIONS } from './acl/permissions.ts';
+
+export const moduleDefinition = {
+	manifest: manifest as ModuleManifest,
+	navigation: [
+		{
+			id: 'connectors.navigation',
+			label: 'Connectors',
+			href: '/connectors',
+			order: 50,
+			permission: CONNECTORS_PERMISSIONS.read,
+		},
+	],
+	permissions: Object.values(CONNECTORS_PERMISSIONS),
+} satisfies RegisteredModule;
+
+export { CONNECTORS_PERMISSIONS } from './acl/permissions.ts';
+
+/* The cross-module contract. A module shipping its own connector kind, and a
+   caller invoking one, import the identifiers and types from here and resolve
+   the implementations through the capability registry. */
+export {
+	CONNECTORS_DEFINITIONS_CAPABILITY,
+	ConnectorDefinitionError,
+} from './domain/definitions.ts';
+export type { ConnectorDefinitionRegistry } from './domain/definitions.ts';
+export { CONNECTORS_CALLS_CAPABILITY } from './domain/calls.ts';
+export type {
+	ConnectorCallCapability,
+	ConnectorCallRequest,
+	ConnectorCallResult,
+	ConnectorJsonValue,
+} from './domain/calls.ts';
+export {
+	HTTP_JSON_DEFINITION,
+	HTTP_JSON_DEFINITION_KEY,
+} from './domain/http-json.ts';
+
+export {
+	CONNECTOR_AUTH_KINDS,
+	CONNECTOR_CALL_OUTCOMES,
+	CONNECTOR_CALLERS,
+	CONNECTOR_ERROR_CLASSES,
+	CONNECTOR_INSTANCE_STATUSES,
+	CONNECTOR_METHODS,
+} from './domain/types.ts';
+export type {
+	ConnectorAuditEvent,
+	ConnectorAuthKind,
+	ConnectorCall,
+	ConnectorCaller,
+	ConnectorCallOutcome,
+	ConnectorDefinition,
+	ConnectorErrorClass,
+	ConnectorInstance,
+	ConnectorInstanceStatus,
+	ConnectorOperation,
+	CreateConnectorInstanceInput,
+	UpdateConnectorInstanceInput,
+} from './domain/types.ts';
+
+export { ConnectorsServiceError } from './services/service-error.ts';

package/modules/connectors/src/platform.ts

@@ -0,0 +1,56 @@
+import type {
+	PlatformServerComposition,
+	PlatformServerContext,
+} from '@flowdular/sdk/modules/auth/server';
+import { connectorsAgentTools } from './agent/tools.ts';
+import { connectorsDataClasses } from './services/data-classes.ts';
+import { CONNECTORS_CALLS_CAPABILITY } from './domain/calls.ts';
+import { CONNECTORS_DEFINITIONS_CAPABILITY } from './domain/definitions.ts';
+import type { ConnectorCallCapability } from './domain/calls.ts';
+import {
+	createConnectorsRoutes,
+	createConnectorsRuntime,
+} from './server/index.ts';
+import { connectorCallLimits, CONNECTORS_MODULE_SETTINGS } from './settings.ts';
+
+export function createServerComposition(
+	context: PlatformServerContext,
+): PlatformServerComposition {
+	const runtime = createConnectorsRuntime({
+		databases: context.databases,
+		purpose:
+			context.environment.NODE_ENV === 'test'
+				? 'test'
+				: context.environment.NODE_ENV === 'production'
+					? 'runtime'
+					: 'preview',
+		environment: context.environment,
+		workspaceRoot: context.workspaceRoot,
+		limits: () => connectorCallLimits(context.settings),
+	});
+	/* Registered while modules compose: a module shipping its own definition
+	   resolves this during its own composition, before the first read seals it. */
+	context.capabilities.register(
+		CONNECTORS_DEFINITIONS_CAPABILITY,
+		runtime.definitions,
+	);
+	context.capabilities.register<ConnectorCallCapability>(
+		CONNECTORS_CALLS_CAPABILITY,
+		{
+			call: async (request) => (await runtime.calls()).call(request),
+			consented: async (tenantId, instanceId, caller) =>
+				(await runtime.calls()).consented(tenantId, instanceId, caller),
+		},
+	);
+	context.agentTools.register(connectorsAgentTools(runtime));
+	/* The sweep and the export run here, on this module's own lease and under
+	   its own tenant transaction; the platform only holds the declaration. */
+	context.dataClasses.declare(
+		connectorsDataClasses(() => runtime.repository()),
+	);
+	return {
+		routes: createConnectorsRoutes(context.auth, runtime),
+		settings: CONNECTORS_MODULE_SETTINGS,
+		dispose: () => runtime.dispose(),
+	};
+}

package/modules/connectors/src/server/index.ts

@@ -0,0 +1,66 @@
+export { createConnectorsRoutes, endpoints } from '../api/endpoints.ts';
+export {
+	CONNECTORS_CALL_TOOL_TARGET,
+	connectorsAgentTools,
+} from '../agent/tools.ts';
+export {
+	DatabaseConnectorsRepository,
+	migrateConnectorsDatabase,
+	normalizedInstanceName,
+	withoutCredential,
+} from '../services/database-repository.ts';
+export { createConnectorsRuntime } from './runtime.ts';
+export type { ConnectorsRuntime, ConnectorsRuntimeOptions } from './runtime.ts';
+export {
+	ConnectorCallService,
+	CALL_BODY_PREVIEW_BYTES,
+	CALL_KEY_CLAIM_MS,
+	MAX_CACHED_TOKENS,
+	MAX_QUERY_PARAMETERS,
+	MAX_REQUEST_BYTES,
+	prepareRequest,
+} from '../services/call-service.ts';
+export type {
+	ConnectorCallLimits,
+	ConnectorCallServiceOptions,
+	ConnectorConnectSeam,
+} from '../services/call-service.ts';
+export {
+	CALL_RETENTION_DAYS,
+	connectorsDataClasses,
+} from '../services/data-classes.ts';
+export { ConnectorsService } from '../services/connectors-service.ts';
+export type { ConnectorsServiceOptions } from '../services/connectors-service.ts';
+export {
+	AesGcmCredentialVault,
+	credentialContext,
+	credentialVaultFromEnvironment,
+} from '../services/credential-vault.ts';
+export type {
+	CredentialVault,
+	SealedCredential,
+} from '../services/credential-vault.ts';
+export {
+	blockedAddress,
+	connectorHostAllowlist,
+	ConnectorEgressError,
+	createConnectorEgressPolicy,
+	normalizeHost,
+	pinnedLookup,
+	systemHostResolver,
+} from '../services/egress.ts';
+export type {
+	ConnectorEgressPolicy,
+	HostAddressResolver,
+	PinnedLookup,
+	ResolvedAddress,
+} from '../services/egress.ts';
+export { ConnectorsServiceError } from '../services/service-error.ts';
+export {
+	DuplicateConnectorNameError,
+	type ConnectorCallKeyClaim,
+	type ConnectorCallKeyDecision,
+	type ConnectorExportCursor,
+	type ConnectorsRepository,
+	type StoredConnectorInstance,
+} from '../services/repository.ts';