@integrity-labs/agt-cli 0.25.1 → 0.25.2

package/dist/{chunk-4K3ERUGE.js → chunk-VWOXS4YP.js}

@@ -1008,6 +1008,33 @@ var CAPACITY_TABLE = {
 };
 var KNOWN_INSTANCE_TYPES = Object.keys(CAPACITY_TABLE);
 
+// ../../packages/core/dist/provisioning/ec2-pricing.js
+var HOURLY_BY_REGION = {
+  "ap-southeast-2": {
+    "t3.micro": 0.0132,
+    "t3.small": 0.0264,
+    "t3.medium": 0.0528,
+    "t3.large": 0.1056,
+    "t3.xlarge": 0.2112,
+    "t3.2xlarge": 0.4224,
+    // m6i — general-purpose; in-fleet as of 2026-05 (ENG-5652).
+    "m6i.large": 0.12,
+    "m6i.xlarge": 0.24
+  },
+  "us-east-1": {
+    "t3.micro": 0.0104,
+    "t3.small": 0.0208,
+    "t3.medium": 0.0416,
+    "t3.large": 0.0832,
+    "t3.xlarge": 0.1664,
+    "t3.2xlarge": 0.3328,
+    // m6i — kept symmetric with ap-southeast-2 (ENG-5652).
+    "m6i.large": 0.096,
+    "m6i.xlarge": 0.192
+  }
+};
+var KNOWN_PRICING_REGIONS = Object.keys(HOURLY_BY_REGION);
+
 // ../../packages/core/dist/scheduled-tasks/suppress.js
 var SENTINEL_REGEX = /<no-delivery\/>/g;
 function classifyOutput(output) {
@@ -2946,6 +2973,302 @@ var ajv2 = new Ajv20202({ allErrors: true, strict: false });
 addFormats2(ajv2);
 var compiledMetaSchema = ajv2.compile(context_meta_schema_default);
 
+// ../../packages/core/dist/integrations/oauth-providers.js
+var OAUTH_PROVIDERS = {
+  "google-workspace": {
+    definitionId: "google-workspace",
+    authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+    tokenUrl: "https://oauth2.googleapis.com/token",
+    revokeUrl: "https://oauth2.googleapis.com/revoke",
+    defaultScopes: [
+      "https://www.googleapis.com/auth/gmail.modify",
+      "https://www.googleapis.com/auth/calendar",
+      "https://www.googleapis.com/auth/drive",
+      "https://www.googleapis.com/auth/spreadsheets",
+      "https://www.googleapis.com/auth/documents",
+      "https://www.googleapis.com/auth/chat.messages",
+      "https://www.googleapis.com/auth/chat.spaces.readonly"
+    ],
+    supportsRefresh: true,
+    extraAuthorizeParams: {
+      access_type: "offline",
+      prompt: "consent"
+    },
+    clientAuthMethod: "body",
+    userInfoUrl: "https://www.googleapis.com/oauth2/v2/userinfo"
+  },
+  "github": {
+    definitionId: "github",
+    authorizeUrl: "https://github.com/login/oauth/authorize",
+    tokenUrl: "https://github.com/login/oauth/access_token",
+    defaultScopes: ["repo", "read:org", "gist", "workflow"],
+    supportsRefresh: true,
+    extraAuthorizeParams: {},
+    clientAuthMethod: "body",
+    userInfoUrl: "https://api.github.com/user"
+  },
+  "granola": {
+    // Granola MCP — remote streamable-HTTP at https://mcp.granola.ai/mcp.
+    // The AS is at mcp-auth.granola.ai and exposes RFC 8414 metadata at
+    // /.well-known/oauth-authorization-server. Auth is OAuth 2.0 with
+    // mandatory PKCE (S256) and a public client (no client_secret) issued
+    // via Dynamic Client Registration (RFC 7591). The bootstrap script
+    // (`packages/api/scripts/dcr-register.ts`) registers a client once at
+    // deploy time; OAUTH_GRANOLA_CLIENT_ID is set from its output.
+    definitionId: "granola",
+    authorizeUrl: "https://mcp-auth.granola.ai/oauth2/authorize",
+    tokenUrl: "https://mcp-auth.granola.ai/oauth2/token",
+    // Minimal scope set: `offline_access` earns the refresh_token so the
+    // refresh cron can rotate the bearer without operator action; `openid`
+    // is required for the OIDC code flow even when we don't request an
+    // id_token. Profile/email are intentionally omitted — we have no
+    // userInfoUrl wired up here, so requesting them would over-ask consent
+    // for fields the callback can't read.
+    defaultScopes: ["openid", "offline_access"],
+    supportsRefresh: true,
+    extraAuthorizeParams: {},
+    clientAuthMethod: "body",
+    pkce: "S256",
+    publicClient: true,
+    mcpUrl: "https://mcp.granola.ai/mcp"
+  },
+  "notion-cli": {
+    // Notion's public OAuth app. Tokens are workspace-scoped and long-lived —
+    // Notion does not issue refresh_tokens, so `supportsRefresh: false` and
+    // the refresh cron skips this provider entirely. Scopes are not part of
+    // Notion's authorize URL contract; consent is governed by what the user
+    // grants in the OAuth screen, so `defaultScopes` stays empty.
+    // `owner=user` forces the user-OAuth variant (vs internal integration).
+    // Requires OAUTH_NOTION_CLI_CLIENT_ID and OAUTH_NOTION_CLI_CLIENT_SECRET.
+    definitionId: "notion-cli",
+    authorizeUrl: "https://api.notion.com/v1/oauth/authorize",
+    tokenUrl: "https://api.notion.com/v1/oauth/token",
+    defaultScopes: [],
+    supportsRefresh: false,
+    extraAuthorizeParams: {
+      owner: "user"
+    },
+    clientAuthMethod: "basic"
+  },
+  "xero": {
+    definitionId: "xero",
+    authorizeUrl: "https://login.xero.com/identity/connect/authorize",
+    tokenUrl: "https://identity.xero.com/connect/token",
+    revokeUrl: "https://identity.xero.com/connect/revocation",
+    defaultScopes: [
+      "openid",
+      "profile",
+      "email",
+      "offline_access",
+      // Granular scopes (required for apps created after March 2, 2026 —
+      // do NOT revert to the broad `accounting.transactions` /
+      // `accounting.contacts` scopes, Xero rejects the manifest).
+      // The variant *without* `.read` is the read+write granular scope.
+      "accounting.settings.read",
+      // contacts: write enables agent-driven supplier/customer creation
+      // (required for bill creation since a bill must reference a contact).
+      "accounting.contacts",
+      // invoices: write enables bill creation (Type=ACCPAY invoices) and
+      // updates to sales invoices alongside the existing read access.
+      "accounting.invoices",
+      // attachments: write enables agents to attach the source PDF to a
+      // bill at creation time. Read-only would force a follow-up manual
+      // upload in Xero; write closes the loop.
+      "accounting.attachments",
+      // accounting.transactions.read → granular read-only replacements
+      // for the surfaces we don't yet need write access on.
+      "accounting.payments.read",
+      "accounting.banktransactions.read",
+      "accounting.manualjournals.read",
+      // accounting.reports.read → granular read-only replacements
+      "accounting.reports.balancesheet.read",
+      "accounting.reports.profitandloss.read",
+      "accounting.reports.trialbalance.read",
+      "accounting.reports.budgetsummary.read",
+      "accounting.reports.banksummary.read",
+      "accounting.reports.executivesummary.read",
+      "accounting.reports.aged.read"
+    ],
+    supportsRefresh: true,
+    extraAuthorizeParams: {},
+    clientAuthMethod: "basic",
+    userInfoUrl: "https://api.xero.com/connections"
+  }
+};
+function getOAuthProvider(definitionId) {
+  return OAUTH_PROVIDERS[definitionId];
+}
+
+// ../../packages/core/dist/integrations/connectivity-probe.js
+var HTTP_PROBE_PROVIDERS = /* @__PURE__ */ new Set([
+  "linear",
+  "google-workspace",
+  "xero",
+  "v0"
+]);
+var CLI_PROBE_ARGS = {
+  gcloud: ["version"]
+  // most CLIs respond to --version; override here only when they don't.
+};
+function cliArgsFor(definitionId) {
+  return CLI_PROBE_ARGS[definitionId] ?? ["--version"];
+}
+function resolveConnectivityProbe(input) {
+  const { definitionId, sourceType, authType } = input;
+  if (authType === "managed" || sourceType === "managed") {
+    return {
+      kind: "composio_account",
+      sourceType: "managed",
+      readOnly: true,
+      label: `${definitionId}: connected-account check`,
+      centralReachable: true
+    };
+  }
+  if (HTTP_PROBE_PROVIDERS.has(definitionId)) {
+    return {
+      kind: "http_provider",
+      sourceType: sourceType ?? "mcp_server",
+      readOnly: true,
+      label: `${definitionId}: read-only API check`,
+      centralReachable: true,
+      httpProvider: definitionId
+    };
+  }
+  if (getOAuthProvider(definitionId)?.mcpUrl) {
+    return {
+      kind: "mcp_tools_list",
+      sourceType: sourceType ?? "mcp_server",
+      readOnly: true,
+      label: `${definitionId}: MCP tools/list`,
+      centralReachable: false
+    };
+  }
+  switch (sourceType) {
+    case "mcp_server":
+      return {
+        kind: "mcp_tools_list",
+        sourceType: "mcp_server",
+        readOnly: true,
+        label: `${definitionId}: MCP tools/list`,
+        centralReachable: false
+      };
+    case "cli_tool":
+      return {
+        kind: "cli_command",
+        sourceType: "cli_tool",
+        readOnly: true,
+        label: `${definitionId}: CLI reachability`,
+        centralReachable: false,
+        cliArgs: cliArgsFor(definitionId)
+      };
+    case "native":
+      return {
+        kind: "builtin",
+        sourceType: "native",
+        readOnly: true,
+        label: `${definitionId}: built-in check`,
+        centralReachable: false
+      };
+    default:
+      return {
+        kind: "unsupported",
+        sourceType: sourceType ?? "native",
+        readOnly: true,
+        label: `${definitionId}: no connectivity probe available`,
+        centralReachable: false
+      };
+  }
+}
+
+// ../../packages/core/dist/integrations/connectivity-http-probes.js
+var PROBE_TIMEOUT_MS = 1e4;
+async function timedFetch(fetchImpl, url, init) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), PROBE_TIMEOUT_MS);
+  try {
+    return await fetchImpl(url, { ...init, signal: controller.signal });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function statusForHttp(httpStatus) {
+  if (httpStatus === 401 || httpStatus === 403)
+    return "down";
+  if (httpStatus >= 500)
+    return "transient_error";
+  return "down";
+}
+function networkOutcome(err) {
+  const isAbort = err?.name === "AbortError";
+  return {
+    status: "transient_error",
+    message: isAbort ? `Connection timed out after ${PROBE_TIMEOUT_MS / 1e3}s` : `Connection failed: ${err.message}`
+  };
+}
+async function probeLinear(creds, fetchImpl) {
+  const key = creds.api_key ?? creds.access_token;
+  if (!key)
+    return { status: "down", message: "No Linear credential present" };
+  try {
+    const res = await timedFetch(fetchImpl, "https://api.linear.app/graphql", {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Authorization: String(key) },
+      body: JSON.stringify({ query: "{ viewer { id name email } }" })
+    });
+    if (!res.ok)
+      return { status: statusForHttp(res.status), message: `Linear API returned ${res.status}` };
+    const body = await res.json();
+    if (body.errors?.length)
+      return { status: "down", message: body.errors[0]?.message ?? "Unknown Linear error" };
+    const viewer = body.data?.viewer;
+    if (!viewer)
+      return { status: "down", message: "Invalid key \u2014 no viewer returned" };
+    return { status: "ok", message: `Connected as ${viewer.name ?? viewer.email ?? "unknown"}` };
+  } catch (err) {
+    return networkOutcome(err);
+  }
+}
+async function probeBearerJson(url, creds, fetchImpl, interpret) {
+  const token = creds.access_token ?? creds.api_key;
+  if (!token)
+    return { status: "down", message: "No credential present" };
+  try {
+    const res = await timedFetch(fetchImpl, url, { headers: { Authorization: `Bearer ${token}` } });
+    if (!res.ok) {
+      const message = res.status === 401 ? "Token expired or revoked \u2014 reconnect required" : `API returned ${res.status}`;
+      return { status: statusForHttp(res.status), message };
+    }
+    return interpret(await res.json());
+  } catch (err) {
+    return networkOutcome(err);
+  }
+}
+async function probeHttpProvider(definitionId, credentials, fetchImpl = fetch) {
+  switch (definitionId) {
+    case "linear":
+      return probeLinear(credentials, fetchImpl);
+    case "google-workspace":
+      return probeBearerJson("https://www.googleapis.com/oauth2/v2/userinfo", credentials, fetchImpl, (body) => {
+        const info = body;
+        return { status: "ok", message: `Connected as ${info.name ?? info.email ?? "unknown"}` };
+      });
+    case "xero":
+      return probeBearerJson("https://api.xero.com/connections", credentials, fetchImpl, (body) => {
+        const conns = body ?? [];
+        if (!conns.length)
+          return { status: "down", message: "No Xero organisations connected" };
+        return { status: "ok", message: `Connected to ${conns[0]?.tenantName ?? "Xero"}` };
+      });
+    case "v0":
+      return probeBearerJson("https://api.v0.dev/v1/user", credentials, fetchImpl, (body) => {
+        const user = body;
+        return { status: "ok", message: `Connected as ${user.name ?? user.email ?? "unknown"}` };
+      });
+    default:
+      return null;
+  }
+}
+
 // ../../packages/core/dist/drift/comparators.js
 function compareToolPolicy(expected, actual) {
   const findings = [];
@@ -3366,6 +3689,14 @@ function attributeTranscriptUsageByRun(jsonl) {
   return { perRunModel: [...agg.values()], runIds: [...runIds] };
 }
 
+// ../../packages/core/dist/conversations/metrics.js
+var PERIOD_CONFIG = {
+  "24h": { windowMs: 24 * 60 * 60 * 1e3, bucket: "hour" },
+  "7d": { windowMs: 7 * 24 * 60 * 60 * 1e3, bucket: "day" },
+  "30d": { windowMs: 30 * 24 * 60 * 60 * 1e3, bucket: "day" }
+};
+var CONVERSATION_METRICS_PERIODS = Object.keys(PERIOD_CONFIG);
+
 export {
   wrapScheduledTaskPrompt,
   parseDeliveryTarget,
@@ -3382,6 +3713,7 @@ export {
   CHANNEL_REGISTRY,
   getChannel,
   getAllChannelIds,
+  OAUTH_PROVIDERS,
   formatActorId,
   isSelfCompletion,
   classifyActor,
@@ -3403,6 +3735,8 @@ export {
   renderTemplate,
   DEPLOYMENT_TEMPLATES,
   getTemplate,
+  resolveConnectivityProbe,
+  probeHttpProvider,
   detectDrift,
   classifyOutput,
   parseUsageBanner,
@@ -3413,4 +3747,4 @@ export {
   KANBAN_LOOP_COMMAND,
   KANBAN_CHECK_COMMAND
 };
-//# sourceMappingURL=chunk-4K3ERUGE.js.map
+//# sourceMappingURL=chunk-VWOXS4YP.js.map