@growthub/cli 0.13.4 → 0.13.6

package/assets/worker-kits/growthub-custom-workspace-starter-v1/apps/workspace/lib/adapters/integrations/nango/nango-config-loader.js

@@ -0,0 +1,202 @@
+/**
+ * Nango config-driven resolver registration.
+ *
+ * Scans `dataModel.objects[]` for `objectType: "api-registry"` rows with
+ * `connectorKind: "nango"` and registers a source resolver for each one.
+ * The resolver key is the row's `integrationId`, matching the rest of the
+ * resolver registry contract — `getSourceResolver(integrationId)` returns
+ * a resolver that fans out via Nango Proxy.
+ *
+ * Invariants:
+ *   - No file authoring is required. Operators add api-registry rows; the
+ *     loader picks them up at the next route invocation.
+ *   - The Nango secret is resolved from env at proxy time, never read here.
+ *   - This loader is idempotent: re-registration with the same integrationId
+ *     replaces the previous resolver (matching the existing registry behavior).
+ *
+ * This module is server-only. Browser code must not import it.
+ */
+
+import { registerSourceResolver } from "../source-resolver-registry.js";
+import {
+  executeAction as nangoExecuteAction,
+  projectNangoBinding,
+  proxyRequest as nangoProxyRequest
+} from "./nango-adapter.js";
+
+function isPlainObject(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+function pickArray(value) {
+  return Array.isArray(value)
+    ? value.filter((v) => typeof v === "string" && v.trim()).map((v) => v.trim())
+    : typeof value === "string"
+      ? value.split(",").map((v) => v.trim()).filter(Boolean)
+      : [];
+}
+
+/**
+ * Build the resolver object for a single Nango-backed api-registry row.
+ *
+ * The resolver:
+ *   - fetchRecords(binding) — proxies one request per connectionId; records
+ *     are flattened (with `_nangoConnectionId` stamped) and returned. The
+ *     binding can override `endpoint`, `method`, `params`, and `data`.
+ *   - listEntities() — returns the configured connection IDs as
+ *     NormalizedIntegrationEntity records so the no-code reference UI can
+ *     pick one to bind against.
+ *   - runAction(actionName, input) — runs a Nango action function for the
+ *     binding's `connectionId` (or the first one when the binding omits it).
+ */
+function buildNangoResolver(row) {
+  const binding = projectNangoBinding(row);
+  if (!binding) return null;
+  const integrationId = binding.integrationId || binding.providerConfigKey;
+  if (!integrationId) return null;
+
+  async function fetchRecords(_config, _connection, callBinding = {}) {
+    const connectionIds = Array.isArray(callBinding?.connectionIds) && callBinding.connectionIds.length
+      ? pickArray(callBinding.connectionIds)
+      : binding.connectionIds;
+    const targets = connectionIds.length
+      ? connectionIds
+      : (typeof callBinding?.connectionId === "string" && callBinding.connectionId.trim()
+        ? [callBinding.connectionId.trim()]
+        : []);
+    if (!targets.length) {
+      const error = new Error("No Nango connectionId provided. Set connectionIds on the api-registry row, or pass connectionId in the binding.");
+      error.code = "NANGO_NO_CONNECTION";
+      throw error;
+    }
+    const endpoint = (callBinding?.endpoint || binding.endpoint || "").trim();
+    if (!endpoint) {
+      const error = new Error("No Nango proxy endpoint configured. Set endpoint on the api-registry row, or pass endpoint in the binding.");
+      error.code = "NANGO_NO_ENDPOINT";
+      throw error;
+    }
+    const method = String(callBinding?.method || binding.method || "GET").toUpperCase();
+    const params = isPlainObject(callBinding?.params) ? callBinding.params : undefined;
+    const data = callBinding?.data;
+    const aggregated = [];
+    for (const connectionId of targets) {
+      const result = await nangoProxyRequest({
+        providerConfigKey: binding.providerConfigKey,
+        connectionId,
+        method,
+        endpoint,
+        params,
+        data,
+        secretEnvName: binding.secretEnvName
+      });
+      const payload = result?.data;
+      if (Array.isArray(payload)) {
+        for (const record of payload) {
+          aggregated.push(isPlainObject(record)
+            ? { ...record, _nangoConnectionId: connectionId }
+            : { value: record, _nangoConnectionId: connectionId });
+        }
+      } else if (isPlainObject(payload)) {
+        for (const key of ["records", "results", "data", "items", "rows"]) {
+          if (Array.isArray(payload[key])) {
+            for (const record of payload[key]) {
+              aggregated.push(isPlainObject(record)
+                ? { ...record, _nangoConnectionId: connectionId }
+                : { value: record, _nangoConnectionId: connectionId });
+            }
+            break;
+          }
+        }
+        if (aggregated.length === 0) {
+          aggregated.push({ ...payload, _nangoConnectionId: connectionId });
+        }
+      }
+    }
+    return aggregated;
+  }
+
+  async function listEntities(_config, _connection) {
+    return binding.connectionIds.map((connectionId) => ({
+      id: connectionId,
+      label: connectionId,
+      secondaryLabel: binding.providerConfigKey,
+      entityType: "nango.connection",
+      provider: integrationId,
+      lane: "workspace-integration",
+      status: "configured",
+      metadata: {
+        providerConfigKey: binding.providerConfigKey,
+        environment: binding.environment || null
+      }
+    }));
+  }
+
+  async function runAction(_config, _connection, callBinding = {}) {
+    const actionName = String(callBinding?.action || "").trim();
+    if (!actionName) {
+      const error = new Error("action name is required");
+      error.code = "NANGO_NO_ACTION";
+      throw error;
+    }
+    if (binding.enabledActions.length && !binding.enabledActions.includes(actionName)) {
+      const error = new Error(`action "${actionName}" is not in the api-registry row's enabledActions allowlist`);
+      error.code = "NANGO_ACTION_NOT_ALLOWED";
+      throw error;
+    }
+    const connectionId = String(callBinding?.connectionId || binding.connectionIds[0] || "").trim();
+    if (!connectionId) {
+      const error = new Error("No Nango connectionId provided for the action.");
+      error.code = "NANGO_NO_CONNECTION";
+      throw error;
+    }
+    return nangoExecuteAction({
+      providerConfigKey: binding.providerConfigKey,
+      connectionId,
+      action: actionName,
+      input: callBinding?.input,
+      secretEnvName: binding.secretEnvName
+    });
+  }
+
+  return {
+    integrationId,
+    entityTypes: ["nango.connection"],
+    connectorKind: "nango",
+    templateId: "nango",
+    capabilities: binding.enabledActions.length ? ["listEntities", "fetchRecords", "runAction"] : ["listEntities", "fetchRecords"],
+    referenceSchema: {
+      valueField: "id",
+      labelField: "label",
+      secondaryLabelField: "secondaryLabel"
+    },
+    listEntities,
+    fetchRecords,
+    runAction
+  };
+}
+
+/**
+ * Register a Nango source resolver for every api-registry row in the given
+ * workspace config that declares `connectorKind: "nango"`. Returns the list
+ * of integrationIds registered (useful for diagnostics).
+ */
+function registerNangoResolversFromConfig(workspaceConfig) {
+  if (!isPlainObject(workspaceConfig)) return [];
+  const objects = workspaceConfig?.dataModel?.objects;
+  if (!Array.isArray(objects)) return [];
+  const registered = [];
+  for (const object of objects) {
+    if (!isPlainObject(object) || object.objectType !== "api-registry") continue;
+    const rows = Array.isArray(object.rows) ? object.rows : [];
+    for (const row of rows) {
+      if (!isPlainObject(row) || row.connectorKind !== "nango") continue;
+      const resolver = buildNangoResolver(row);
+      if (!resolver) continue;
+      registerSourceResolver(resolver);
+      registered.push(resolver.integrationId);
+    }
+  }
+  return registered;
+}
+
+export { buildNangoResolver, registerNangoResolversFromConfig };

package/assets/worker-kits/growthub-custom-workspace-starter-v1/apps/workspace/lib/adapters/integrations/nango/nango-schema.js

@@ -0,0 +1,303 @@
+/**
+ * Nango adapter — input validation.
+ *
+ * Pure server-side input validation for the Nango API routes. Mirrors the
+ * `api-registry` row contract owned by `lib/workspace-schema.js`. No
+ * @nangohq/node import here — this module only validates shapes.
+ *
+ * Authority contract: every value passed to a Nango SDK call must flow
+ * through these validators first. Credentials never appear in inputs; the
+ * server resolves the Nango secret key from env (`NANGO_SECRET_KEY`).
+ */
+
+import {
+  KNOWN_NANGO_MODES,
+  NANGO_PROVIDER_CONFIG_KEY_MAX,
+  NANGO_PROVIDER_CONFIG_KEY_PATTERN
+} from "../../../workspace-schema.js";
+
+const KNOWN_HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"];
+
+function isPlainObject(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+function makeInvalidInputError(message, details) {
+  const error = new Error(message);
+  error.code = "NANGO_INVALID_INPUT";
+  if (Array.isArray(details) && details.length) {
+    error.details = details;
+  }
+  return error;
+}
+
+function validateProviderConfigKey(value, fieldPath = "providerConfigKey") {
+  const errors = [];
+  if (typeof value !== "string" || !value.trim()) {
+    errors.push(`${fieldPath} must be a non-empty string`);
+  } else if (
+    value.length > NANGO_PROVIDER_CONFIG_KEY_MAX
+    || !NANGO_PROVIDER_CONFIG_KEY_PATTERN.test(value)
+  ) {
+    errors.push(`${fieldPath} must be alphanumeric (with _.- separators), starting alphanumeric, and <= ${NANGO_PROVIDER_CONFIG_KEY_MAX} chars`);
+  }
+  return errors;
+}
+
+function validateConnectionId(value, fieldPath = "connectionId") {
+  const errors = [];
+  if (typeof value !== "string" || !value.trim()) {
+    errors.push(`${fieldPath} must be a non-empty string`);
+  } else if (value.length > 256) {
+    errors.push(`${fieldPath} must be <= 256 chars`);
+  }
+  return errors;
+}
+
+function validateNangoMode(value, fieldPath = "mode") {
+  if (value === undefined || value === null || value === "") return [];
+  if (!KNOWN_NANGO_MODES.includes(value)) {
+    return [`${fieldPath} must be one of ${KNOWN_NANGO_MODES.join(", ")}`];
+  }
+  return [];
+}
+
+function validateHostUrl(value, fieldPath = "hostUrl") {
+  if (value === undefined || value === null || value === "") return [];
+  if (typeof value !== "string") {
+    return [`${fieldPath} must be a string when present`];
+  }
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return [`${fieldPath} must be a valid URL`];
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    return [`${fieldPath} must use http:// or https://`];
+  }
+  return [];
+}
+
+/**
+ * Proxy request shape used by POST /api/workspace/integrations/nango/proxy.
+ * Mirrors the upstream `@nangohq/node` proxy contract (method, endpoint,
+ * optional headers/params/data) while keeping credentials out of band.
+ */
+function validateProxyRequest(input) {
+  if (!isPlainObject(input)) {
+    throw makeInvalidInputError("proxy request body must be a plain object");
+  }
+  const errors = [];
+  errors.push(...validateProviderConfigKey(input.providerConfigKey));
+  errors.push(...validateConnectionId(input.connectionId));
+
+  const method = String(input.method || "GET").toUpperCase();
+  if (!KNOWN_HTTP_METHODS.includes(method)) {
+    errors.push(`method must be one of ${KNOWN_HTTP_METHODS.join(", ")}`);
+  }
+  if (typeof input.endpoint !== "string" || !input.endpoint.trim()) {
+    errors.push("endpoint must be a non-empty string (path or absolute URL)");
+  } else if (input.endpoint.length > 2048) {
+    errors.push("endpoint must be <= 2048 chars");
+  }
+  if (input.headers !== undefined && !isPlainObject(input.headers)) {
+    errors.push("headers must be a plain object when present");
+  }
+  if (input.params !== undefined && !isPlainObject(input.params)) {
+    errors.push("params must be a plain object when present");
+  }
+  if (input.retries !== undefined) {
+    const r = Number(input.retries);
+    if (!Number.isFinite(r) || r < 0 || r > 10) {
+      errors.push("retries must be a finite number between 0 and 10");
+    }
+  }
+  if (input.timeoutMs !== undefined) {
+    const ms = Number(input.timeoutMs);
+    if (!Number.isFinite(ms) || ms < 0 || ms > 60000) {
+      errors.push("timeoutMs must be between 0 and 60000");
+    }
+  }
+  // Reject any header that looks like an auth-credential carrier. The Nango
+  // SDK injects credentials server-side from the connection — callers MUST
+  // NOT forward Authorization headers from the browser.
+  if (isPlainObject(input.headers)) {
+    const forbiddenHeaders = ["authorization", "x-api-key", "x-auth-token", "cookie"];
+    for (const key of Object.keys(input.headers)) {
+      if (forbiddenHeaders.includes(key.toLowerCase())) {
+        errors.push(`headers.${key} is not allowed — Nango injects credentials from the connection`);
+      }
+    }
+  }
+
+  if (errors.length) {
+    throw makeInvalidInputError("invalid proxy request", errors);
+  }
+
+  return {
+    providerConfigKey: input.providerConfigKey.trim(),
+    connectionId: input.connectionId.trim(),
+    method,
+    endpoint: input.endpoint.trim(),
+    headers: isPlainObject(input.headers) ? { ...input.headers } : undefined,
+    params: isPlainObject(input.params) ? { ...input.params } : undefined,
+    data: input.data,
+    retries: input.retries !== undefined ? Number(input.retries) : undefined,
+    timeoutMs: input.timeoutMs !== undefined ? Number(input.timeoutMs) : undefined
+  };
+}
+
+function validateActionsListInput(input) {
+  if (input === null || input === undefined) {
+    return { providerConfigKey: undefined };
+  }
+  if (!isPlainObject(input)) {
+    throw makeInvalidInputError("actions list input must be a plain object");
+  }
+  if (input.providerConfigKey === undefined || input.providerConfigKey === null || input.providerConfigKey === "") {
+    return { providerConfigKey: undefined };
+  }
+  const errors = validateProviderConfigKey(input.providerConfigKey);
+  if (errors.length) throw makeInvalidInputError("invalid actions list input", errors);
+  return { providerConfigKey: input.providerConfigKey.trim() };
+}
+
+function validateActionExecuteRequest(input) {
+  if (!isPlainObject(input)) {
+    throw makeInvalidInputError("action execute body must be a plain object");
+  }
+  const errors = [];
+  errors.push(...validateProviderConfigKey(input.providerConfigKey));
+  errors.push(...validateConnectionId(input.connectionId));
+  if (typeof input.action !== "string" || !input.action.trim()) {
+    errors.push("action must be a non-empty string");
+  } else if (!/^[A-Za-z0-9][A-Za-z0-9_.-]*$/.test(input.action) || input.action.length > 128) {
+    errors.push("action must be alphanumeric (with _.- separators), <= 128 chars");
+  }
+  if (input.input !== undefined && !isPlainObject(input.input) && !Array.isArray(input.input)) {
+    errors.push("input must be a plain object or array when present");
+  }
+  if (errors.length) throw makeInvalidInputError("invalid action execute request", errors);
+  return {
+    providerConfigKey: input.providerConfigKey.trim(),
+    connectionId: input.connectionId.trim(),
+    action: input.action.trim(),
+    input: input.input
+  };
+}
+
+function validateConnectSessionRequest(input) {
+  if (!isPlainObject(input)) {
+    throw makeInvalidInputError("connect session body must be a plain object");
+  }
+  const errors = [];
+  errors.push(...validateProviderConfigKey(input.providerConfigKey));
+  // connectionId is OPTIONAL on Create Connect Session — Nango mints the
+  // connection during OAuth and delivers the id via the auth webhook. The
+  // field is only meaningful for explicit Reconnect flows against a known
+  // existing connection.
+  if (input.connectionId !== undefined && input.connectionId !== null && input.connectionId !== "") {
+    errors.push(...validateConnectionId(input.connectionId));
+  }
+  if (input.reconnect !== undefined && typeof input.reconnect !== "boolean") {
+    errors.push("reconnect must be a boolean when present");
+  }
+  if (input.reconnect === true && (typeof input.connectionId !== "string" || !input.connectionId.trim())) {
+    errors.push("connectionId is required when reconnect=true");
+  }
+  if (input.endUser !== undefined && input.endUser !== null) {
+    if (!isPlainObject(input.endUser)) {
+      errors.push("endUser must be a plain object when present");
+    } else {
+      if (input.endUser.id !== undefined && typeof input.endUser.id !== "string") {
+        errors.push("endUser.id must be a string when present");
+      }
+      if (input.endUser.email !== undefined && typeof input.endUser.email !== "string") {
+        errors.push("endUser.email must be a string when present");
+      }
+    }
+  }
+  // Tags: arbitrary string→string map that Nango echoes back in the auth
+  // webhook so the workspace can correlate "which row asked for OAuth" once
+  // a connectionId is minted. Keys constrained to identifier-shape and
+  // values constrained to short strings — no secret payloads.
+  if (input.tags !== undefined && input.tags !== null) {
+    if (!isPlainObject(input.tags)) {
+      errors.push("tags must be a plain object when present");
+    } else {
+      for (const [key, value] of Object.entries(input.tags)) {
+        if (!/^[A-Za-z0-9_.-]{1,64}$/.test(key)) {
+          errors.push(`tags.${key} must match [A-Za-z0-9_.-]{1,64}`);
+          continue;
+        }
+        if (typeof value !== "string" || value.length > 256) {
+          errors.push(`tags.${key} must be a string (<= 256 chars)`);
+        }
+      }
+    }
+  }
+  if (errors.length) throw makeInvalidInputError("invalid connect session request", errors);
+  return {
+    providerConfigKey: input.providerConfigKey.trim(),
+    connectionId: input.connectionId ? input.connectionId.trim() : undefined,
+    reconnect: input.reconnect === true,
+    endUser: isPlainObject(input.endUser) ? { ...input.endUser } : undefined,
+    tags: isPlainObject(input.tags) ? { ...input.tags } : undefined
+  };
+}
+
+function validateConnectionSummaryRequest(input) {
+  if (!isPlainObject(input)) {
+    throw makeInvalidInputError("connection status body must be a plain object");
+  }
+  const errors = [];
+  errors.push(...validateProviderConfigKey(input.providerConfigKey));
+  errors.push(...validateConnectionId(input.connectionId));
+  if (errors.length) throw makeInvalidInputError("invalid connection status request", errors);
+  return {
+    providerConfigKey: input.providerConfigKey.trim(),
+    connectionId: input.connectionId.trim()
+  };
+}
+
+function validateConnectionStatusRequest(input) {
+  if (input === null || input === undefined) return {};
+  if (!isPlainObject(input)) {
+    throw makeInvalidInputError("status request must be a plain object");
+  }
+  const errors = [];
+  if (input.providerConfigKey !== undefined) {
+    errors.push(...validateProviderConfigKey(input.providerConfigKey));
+  }
+  if (input.connectionId !== undefined) {
+    errors.push(...validateConnectionId(input.connectionId));
+  }
+  if (input.mode !== undefined) {
+    errors.push(...validateNangoMode(input.mode));
+  }
+  if (input.hostUrl !== undefined) {
+    errors.push(...validateHostUrl(input.hostUrl));
+  }
+  if (errors.length) throw makeInvalidInputError("invalid status request", errors);
+  return {
+    providerConfigKey: input.providerConfigKey ? input.providerConfigKey.trim() : undefined,
+    connectionId: input.connectionId ? input.connectionId.trim() : undefined,
+    mode: input.mode || undefined,
+    hostUrl: input.hostUrl ? input.hostUrl.trim() : undefined
+  };
+}
+
+export {
+  KNOWN_HTTP_METHODS,
+  validateActionExecuteRequest,
+  validateActionsListInput,
+  validateConnectSessionRequest,
+  validateConnectionId,
+  validateConnectionStatusRequest,
+  validateConnectionSummaryRequest,
+  validateHostUrl,
+  validateNangoMode,
+  validateProviderConfigKey,
+  validateProxyRequest
+};

package/assets/worker-kits/growthub-custom-workspace-starter-v1/apps/workspace/lib/adapters/integrations/resolver-loader.js

@@ -9,31 +9,41 @@
  * stays empty — the refresh button and test route gracefully skip unknown
  * integrationIds and surface them in the `skipped` array.
  *
- * Called once per route handler invocation (Next.js module cache means it
- * will only do real I/O on the first call in each worker process).
+ * Two cadences:
+ *   - `loadStaticResolversOnce()` — imports `.js` files in the resolvers/
+ *     directory exactly once per worker process. Static resolvers register
+ *     themselves at module-load time; re-importing would be a no-op anyway.
+ *   - `refreshConfigDrivenResolvers()` — re-scans growthub.config.json on
+ *     EVERY call. New Nango-backed api-registry rows are picked up without
+ *     a server restart. The source-resolver registry's `registerSourceResolver`
+ *     contract is "calling again with the same integrationId replaces the
+ *     existing resolver", so repeated registration is safe.
+ *
+ * `loadAllResolvers()` calls both and remains the single entry point that
+ * existing routes (test-source, refresh-source) consume.
  */
 
 import { promises as fs } from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 
-const loaded = new Set();
-let loadAttempted = false;
+const staticLoaded = new Set();
+let staticLoadDone = false;
 
-async function loadAllResolvers() {
-  if (loadAttempted) return;
-  loadAttempted = true;
+async function loadStaticResolversOnce() {
+  if (staticLoadDone) return;
+  staticLoadDone = true;
   const resolversDir = path.resolve(/*turbopackIgnore: true*/ process.cwd(), "lib/adapters/integrations/resolvers");
   try {
     const entries = await fs.readdir(resolversDir);
     const jsFiles = entries.filter((f) => f.endsWith(".js") && !f.startsWith("_") && !f.startsWith("."));
     await Promise.all(
       jsFiles.map(async (file) => {
-        if (loaded.has(file)) return;
+        if (staticLoaded.has(file)) return;
         try {
           const absolutePath = path.join(resolversDir, file);
           await import(/*turbopackIgnore: true*/ pathToFileURL(absolutePath).href);
-          loaded.add(file);
+          staticLoaded.add(file);
         } catch {
           // Malformed resolver — skip silently; operator needs to fix the file
         }
@@ -44,6 +54,30 @@ async function loadAllResolvers() {
   }
 }
 
+/**
+ * Re-scan growthub.config.json for Nango-backed api-registry rows and
+ * register one source resolver per row. Runs on every invocation so newly
+ * added rows are picked up between requests without a server restart.
+ *
+ * Returns the list of integrationIds registered on this call (or `[]` on
+ * any non-fatal error — the static resolvers still work).
+ */
+async function refreshConfigDrivenResolvers() {
+  try {
+    const { readWorkspaceConfig } = await import("../../workspace-config.js");
+    const { registerNangoResolversFromConfig } = await import("./nango/index.js");
+    const workspaceConfig = await readWorkspaceConfig();
+    return registerNangoResolversFromConfig(workspaceConfig) || [];
+  } catch {
+    return [];
+  }
+}
+
+async function loadAllResolvers() {
+  await loadStaticResolversOnce();
+  await refreshConfigDrivenResolvers();
+}
+
 async function listResolverFiles() {
   const resolversDir = path.resolve(/*turbopackIgnore: true*/ process.cwd(), "lib/adapters/integrations/resolvers");
   try {
@@ -54,4 +88,9 @@ async function listResolverFiles() {
   }
 }
 
-export { loadAllResolvers, listResolverFiles };
+export {
+  loadAllResolvers,
+  loadStaticResolversOnce,
+  listResolverFiles,
+  refreshConfigDrivenResolvers
+};

package/assets/worker-kits/growthub-custom-workspace-starter-v1/apps/workspace/lib/adapters/integrations/source-resolver-registry.js

@@ -12,7 +12,7 @@
  *   entityTypes: string[],           // e.g. ["project.tasks", "workspace.users"]
  *   listEntities: async (config, connection) => NormalizedEntity[],
  *   fetchRecords: async (config, connection, binding) => Record[]
- *   connectorKind?: string,          // http | mcp | chrome | tool | custom
+ *   connectorKind?: string,          // http | mcp | chrome | tool | custom | nango
  *   templateId?: string,
  *   capabilities?: string[],
  *   configSchema?: SchemaField[],

package/assets/worker-kits/growthub-custom-workspace-starter-v1/apps/workspace/lib/adapters/integrations/templates/nango.js

@@ -0,0 +1,49 @@
+/**
+ * Nango — resolver template.
+ *
+ * Seeds API Registry rows whose proxy + auth flow is delegated to Nango.
+ * Each row carries the Nango `providerConfigKey` (defaults to the
+ * `integrationId` when not set explicitly), the connection ID set, and the
+ * list of enabled action functions. The Nango secret lives in env (default
+ * env-ref name: `NANGO_SECRET_KEY`) and is resolved server-side at proxy
+ * time. The browser never holds the secret.
+ *
+ * `connectorKind: "nango"` is recognized by the resolver registry and the
+ * config-driven loader at `lib/adapters/integrations/nango/index.js`, which
+ * registers a resolver for each api-registry row tagged with this kind.
+ */
+
+const template = {
+  schemaVersion: "growthub-resolver-template-v1",
+  templateId: "nango",
+  label: "Nango integration backbone",
+  connectorKind: "nango",
+  capabilities: ["listEntities", "fetchRecords", "runAction"],
+  apiRegistryDefaults: {
+    integrationId: "nango-provider",
+    authRef: "NANGO_SECRET_KEY",
+    method: "GET",
+    connectorKind: "nango",
+    resolverTemplateId: "nango",
+    schemaVersion: "growthub-resolver-template-v1"
+  },
+  dataSourceDefaults: {
+    objectType: "data-source",
+    binding: { sourceStorage: "workspace-source-records" }
+  },
+  configSchema: [
+    { name: "integrationId", label: "Integration ID", type: "text", required: true, description: "Stable provider slug. Used as the resolver key and (when no override is set) as the Nango providerConfigKey." },
+    { name: "providerConfigKey", label: "Nango provider config key", type: "text", required: false, description: "Overrides integrationId when the Nango key differs from the workspace slug." },
+    { name: "endpoint", label: "Proxy endpoint", type: "text", required: false, description: "Path or absolute URL forwarded through Nango Proxy. Leave blank when the resolver derives the endpoint from listEntities." },
+    { name: "method", label: "HTTP method", type: "text", required: false, description: "GET (default) | POST | PUT | PATCH | DELETE." },
+    { name: "authRef", label: "Nango secret env ref", type: "secretRef", required: false, description: "Defaults to NANGO_SECRET_KEY. The env value is the Nango secret key; the workspace never sees it in the browser." },
+    { name: "connectionIds", label: "Connection IDs", type: "text", required: false, description: "Comma-separated Nango connection IDs (one per tenant). The resolver fans out across them when more than one is set." },
+    { name: "enabledActions", label: "Enabled actions", type: "text", required: false, description: "Comma-separated names of Nango action functions exposed as agent tools." },
+    { name: "nangoMode", label: "Nango mode", type: "text", required: false, description: "cloud (default) or self-hosted. Self-hosted requires nangoHostUrl." },
+    { name: "nangoHostUrl", label: "Nango host URL", type: "url", required: false, description: "Required when nangoMode = self-hosted." },
+    { name: "nangoEnvironment", label: "Nango environment", type: "text", required: false, description: "dev (default) or prod. Maps to the Nango environment header." }
+  ],
+  supportedLanes: ["data-source", "sandbox-local", "sandbox-serverless"]
+};
+
+export default template;

package/assets/worker-kits/growthub-custom-workspace-starter-v1/apps/workspace/lib/adapters/integrations/templates/template-registry.js

@@ -5,7 +5,7 @@
  * @property {"growthub-resolver-template-v1"} schemaVersion
  * @property {string} templateId
  * @property {string} label
- * @property {"http"|"mcp"|"chrome"|"tool"|"custom"} connectorKind
+ * @property {"http"|"mcp"|"chrome"|"tool"|"custom"|"nango"} connectorKind
  * @property {Array<"listEntities"|"fetchRecords"|"runAction">} capabilities
  * @property {Object} apiRegistryDefaults
  * @property {string} apiRegistryDefaults.integrationId
@@ -26,6 +26,7 @@ import genericCrm from "./generic-crm.js";
 import genericSpreadsheet from "./generic-spreadsheet.js";
 import genericProjectManagement from "./generic-project-management.js";
 import genericCommerce from "./generic-commerce.js";
+import nango from "./nango.js";
 
 const ALL = [
   customHttp,
@@ -35,7 +36,8 @@ const ALL = [
   genericCrm,
   genericSpreadsheet,
   genericProjectManagement,
-  genericCommerce
+  genericCommerce,
+  nango
 ];
 
 function listResolverTemplates() {