@polpo-ai/connect-server 0.15.143 → 0.16.0

package/README.md

@@ -12,4 +12,355 @@ This package implements the backend lifecycle for API-key and OAuth2 connections
 - policy checks before token release
 - revocation and secret deletion
 
-It is intentionally framework-agnostic. Cloud/OSS servers can mount it through Hono, Express, Workers, or another transport without coupling the core lifecycle to HTTP routes.
+It is independent of the HTTP framework. Node hosts can mount it through Hono,
+Express, or another transport. Its default DNS and crypto adapters use Node APIs;
+do not infer direct Workers compatibility without a tested host adapter.
+
+## Host responsibilities
+
+Pass legacy providers or version 2 Connector definitions to
+`createConnectService`. `listCatalog()` returns a normalized asynchronous
+catalog including registered custom definitions; `listProviders()` retains the
+static compatibility catalog. Configure these ports as needed:
+
+- `store`, `secrets`, `links`, `setupSessions`: durable account, encrypted
+  credential, project-link and single-use setup/state storage.
+- `oauthClients`: explicit operator/customer/managed registration resolution.
+  A missing selected client must fail, not fall back to another owner.
+- `definitions`: tenant-scoped `ConnectorDefinitionStore`; duplicate creation
+  must be atomic and IDs cannot be reused after disablement.
+- `verifyMcp`: a host adapter that initializes the native MCP client and lists
+  tools using the resolved credential and supplied abort signal. Use
+  `discoverRemoteMcpTools({ url, transport, headers, signal })` after resolving
+  headers inside the trusted host. It supports HTTPS Streamable HTTP and SSE,
+  refuses cross-origin credential forwarding, pins public DNS and bounds time,
+  response size and pagination. It throws on failure; an empty array means a
+  successful `tools/list` response with no tools. It never calls a tool.
+- `verifications`: optional persistence for sanitized verification results.
+- `policy` and the trusted capability resolver: authorization checks before
+  execution, including user/tenant binding and operation restrictions.
+- `refreshCoordinator`: distributed coordination for multi-replica hosts.
+
+Multi-replica OAuth refresh also requires a `VersionedConnectionSecretStore`
+with atomic compare-and-set, as supplied by the Memory and Drizzle adapters.
+Before an API or MCP refresh consumes a potentially single-use token, the service
+stores a private intent inside the encrypted credential. A replica acquiring an
+expired coordinator lease cannot reuse a token whose attempt is still pending.
+The result is committed against that intent, including a receipt for recovering
+a lost storage acknowledgement. This state is never public Connection metadata.
+
+A lost provider response or crash after dispatch leaves the outcome uncertain.
+Automatic retries of that old refresh token are denied; a still-running owner
+can finish its commit, otherwise the account needs a new authorization. Replacing
+the credential creates a new lineage. Unversioned secret adapters retain their
+single-process coordinator behavior and do not provide this cross-replica fence.
+All refresh writers must be upgraded before enabling this guarantee: older
+binaries do not understand the intent, and must be drained during cutover.
+
+Memory adapters are for tests or ephemeral hosts. They do not make setup state,
+credentials or custom definitions durable across process restarts. For durable
+self-hosting, `@polpo-ai/drizzle/connect` provides SQLite and PostgreSQL adapters
+for these ports, with encrypted payloads and atomic state/secret updates.
+See [self-hosted setup](../../drizzle/README.md#connect-storage).
+
+The Node `PolpoServer` and `createApp` accept an explicit `connectService` and
+`connectionCapabilityResolver`. Management routes mount at `/api/v1/connect`
+behind the normal server authentication. The public browser callback is
+`/api/v1/connect/oauth/callback`; register that exact canonical URL at the
+provider. It exposes no credential or account record, and redirects only to a
+return URL previously validated during setup. Installing packages alone does
+not configure providers, OAuth apps, grants or a Cloud dashboard.
+
+## Lifecycle guarantees
+
+If a reference write loses its acknowledgement, the service recovers only a
+positively confirmed matching credential generation or OAuth state. A failed
+read or absent row does not prove rollback: the service preserves the staged
+secret and reports the original error. Cleanup is immediate only before a
+reference write is attempted or after an explicit reconnect CAS miss. Hosts
+must reconcile uncertain writes before reclaiming genuinely unreferenced
+credentials; the included adapters currently provide no orphan-secret GC/TTL.
+Durable secret stores encrypt retained material; memory stores are ephemeral.
+
+Static API/public/MCP creation and MCP OAuth share `ConnectionCreationContext`:
+explicit audience, owner and optional trusted binding. The default remains
+shared for compatibility. Personal and end-user owners produce a matching
+principal restriction; conflicting, missing or null constraints fail before
+secret persistence or provider discovery. Hosts authorize the caller before
+accepting these control-plane inputs. They must not populate them from model
+arguments or unverified browser identity.
+
+The OSS HTTP surface includes `POST /connections/mcp`, `/mcp/inspect` and
+`/mcp/oauth/start` under the authenticated Connect mount. API/public creation
+preserves the same context. MCP OAuth state and callback preserve namespace,
+audience and bindings. A selected Connector's auth method remains authoritative;
+generic MCP header injection is validated and persisted in the initial write.
+Creation strips host-observed discovery metadata rather than accepting a caller's
+tool inventory. Durable hosts must condition discovery persistence on unchanged
+account, credential generation, scopes, binding and endpoint metadata, so an old
+network response cannot replace newer configuration or discovery evidence.
+
+The selected authentication method is persisted through setup and callback.
+New authorizations pin the registered OAuth client ID and endpoints; replacing
+the app requires reconnect, while rotating its secret does not. Store adapters
+must preserve `authenticationId`, `oauthClientFingerprint` and
+`credentialVersion`. Existing records without those fields remain compatible
+and need an explicit migration/reconnect strategy at the host boundary.
+
+Code exchange and refresh use bounded HTTPS requests with public-address checks,
+no redirects, validated token responses and sanitized errors. Gateway deadlines
+cover DNS, redirects and streamed response bodies. Hosts still need appropriate
+network egress controls. The default Node transport validates DNS in the socket
+connector and supplies those exact public addresses to TLS, preventing a second
+unvalidated DNS resolution. A custom `fetch` adapter must enforce the equivalent
+socket/egress policy itself. MCP OAuth discovery, registration and token bodies
+are bounded before the protocol SDK parses them.
+
+`verifyConnection` runs configured read probes through the same gateway and
+scope policy. Results report the checked generation, never response bodies or
+credentials. Hosts must rotate `credentialVersion` on credential replacement
+and disregard cached checks after relevant configuration or credential changes.
+Verified account identities populate `Connection.providerAccountId`.
+
+`getSetupReadiness` is a separate, local configuration check. It resolves the
+chosen OAuth Client from the same resolver used by setup and validates the
+exact callback. A `passed` / `consent_required` result means authorization can
+be attempted; it cannot certify the app's provider publication or approval.
+Static-key setup still needs the account key; MCP requires discovery of the
+actual server. No readiness check calls the provider or exposes client secrets.
+
+An OAuth provider can return scopes granted by a previous consent to the same
+app. Actual token scopes remain in encrypted token storage; a Connection keeps
+only its explicitly requested scope ceiling. Neither extra scopes nor refresh
+can silently widen the Connection or a narrower Polpo grant.
+
+Both API and MCP OAuth refreshes preserve that ceiling, recheck revocation and
+use versioned secret writes when supplied. Multi-process hosts must also supply
+a shared refresh coordinator. Revocation first denies access, then removes the
+credential; if vault deletion fails, repeating revocation retries cleanup.
+
+## Connection-backed MCP execution
+
+`createConnectionMcpCapabilityResolver` uses the same exact-account selection
+and live authorization as HTTP capabilities. The host supplies `resolveSpec`,
+`resolveEndpoint` and `resolveHeaders`; the endpoint comes from the installed
+Connection, and credential resolution/refresh stays in the Connect service.
+The MCP SDK does not start OAuth or write tokens during a tool call.
+
+Each resolved capability authorizes one named operation. Its deadline includes
+account acquisition, host policy and credential refresh. Before every HTTP
+send it rechecks the account, binding, project link, grant, credential generation
+and endpoint. Cancellation cannot fall back to another account or transport.
+The native transport checks public HTTPS destinations, refuses redirects, bounds
+response bodies and terminates stateful Streamable HTTP sessions. Cleanup is
+bounded and cannot turn an already completed operation into a retryable failure.
+
+Agent runtimes use `ResolveMcpRuntimeCapabilities` from `@polpo-ai/core` and
+`resolveRuntimeMcpTools` from `@polpo-ai/tools`. A host returns a non-secret,
+verified inventory with a resolver for each server namespace. Tool execution
+acquires capabilities with the actual immutable invocation and tool-call ID;
+model arguments never select credentials or account identity. The optional
+`onError(error, input)` hook is host-only. Model-visible errors are redacted.
+
+Node hosts inject `resolveMcpCapabilities` through server options or the
+in-process run dependencies. Chat and task/Loop execution share the adapter,
+tool policy and cancellation semantics. Connection-backed configuration requires
+that host port; `connectionId` survives API serialization and cannot downgrade
+to an authored URL when the port is unavailable. The standalone subprocess
+runner can bootstrap this port through the broker contract below; without an
+explicit host-issued lease it rejects Connection-backed configuration. Task
+engines keep legacy stdio/URL loading disabled; standalone
+chat retains its explicit compatibility path for unclaimed namespaces.
+
+### Subprocess broker contract
+
+Core exports `createRemoteMcpRuntimeCapabilities` and strict schemas for a
+versioned `McpRunnerLeasePayload`, inventory and requests. Connect Server exports
+`createMcpRunnerBroker`, an HTTP-neutral Request/Response handler. Hosts supply
+opaque lease storage, immutable invocation and inventory, a native capability
+factory restricted to the minted grants, live run/generation authorization and
+an atomic per-lease `claimCall` callback. Repeated call IDs must return 409 even
+if the first operation failed or its response was lost. There is no automatic
+retry of provider mutations.
+
+Only `inventory` and `call { capability, toolCallId, arguments }` cross the
+runner boundary. The runner cannot submit identity, destination, credentials or
+permission overrides. The host checks the inventory against current tool
+descriptors, then uses the existing native MCP resolver. Its authorization must
+also recheck lease/run/rollout during every native transport send. Requests have
+a 30-second total deadline, 256-KiB input and 2-MiB response limits. Disposal is
+bounded, including cancellation during acquisition. Responses and errors never
+include the host's raw diagnostics.
+
+The Node runner accepts `--capabilities-stdin`. Before loading configuration it
+emits `POLPO_RUNNER_CAPABILITIES_READY_V3`, consumes one newline-delimited JSON
+envelope (16-KiB maximum, 30-second timeout), pauses stdin and removes listeners.
+The version-3 envelope carries a shared agent/run/sandbox identity and optional
+`mcp`, `data` and `customTools` leases; at least one must exist. MCP and custom
+tools bind the captured agent incarnation as well as its name. It validates every
+nested binding before constructing ports. Absent Data and custom-tool bindings
+explicitly disable ambient Data and local tool-import fallbacks. The remote
+protocols remain independent (MCP lease version 2, custom-tool lease version 1).
+Old bootstrap versions are rejected; deploy the host and runner together. The host must
+disable input echo, wait for readiness, send the frame once, and revoke it on
+every exit. Do not put the bearer in argv, shell commands, persistent sandbox
+environment, RunnerConfig or RunStore. A late or uncertain delivery requires
+revocation and process termination, not retransmission. This is a host adapter
+contract; providing these OSS primitives does not itself configure Cloud lease
+storage or a remote sandbox lifecycle.
+
+### Remote custom tools
+
+`ResolveCustomTools` lets a trusted host own custom-tool loading and isolated
+execution. The Node runtime keeps exact-name/`*` assignment and narrower tool
+policies. A configured host returning no tools or throwing never enables local
+bundle imports; an unconfigured standalone OSS runtime retains its local loader.
+
+`createRemoteCustomTools` implements this port using a run lease, and
+`createCustomToolRunnerBroker` supplies its HTTP-neutral host endpoint. The wire
+contains only `inventory` and `call { toolName, toolCallId, arguments }`.
+The host supplies a frozen inventory, immutable invocation, absolute lease expiry, atomic call-ID
+consumption, live lease/run authorization and an isolated tool resolver. The
+broker compares current public metadata with the issued inventory before
+execution. The host must recheck authorization after asynchronous preparation
+and immediately before delivering credentials, and clean up on cancellation.
+Provider/account choice, Connection slots and gateway/direct credential mode
+remain host-owned. This is an agent-run endpoint, not a public integration API.
+
+The transport never retries calls or follows redirects, strips raw diagnostic
+errors, and limits requests to 2 MiB and results to 8 MiB. Inventory has a
+30-second deadline; execution allows the existing 30-minute tool ceiling plus
+30 seconds for setup/cleanup, bounded by lease expiry in both client and server
+even when a caller ignores client limits. The host applies
+each tool's narrower timeout. Neither bearer tokens nor provider credentials
+appear in the model-visible inventory.
+
+### OAuth host authorization
+
+`createConnectService({ authorizeOAuth })` accepts an optional host-only hook.
+It receives a frozen `OAuthOperationContext`: `operation` (`setup`, `authorize`,
+`callback`, `credential`, `refresh`), `protocol` (`api` or `mcp`), and Connector,
+Connection and tenant identifiers. It never receives OAuth codes, tokens,
+client secrets or metadata. Throw to deny the operation. Without the hook,
+self-hosted operation is unchanged.
+
+The shared service checks before onboarding side effects, before exchanging a
+callback code, before reading OAuth credentials, inside the refresh coordinator,
+and before releasing a credential or sending an API request. Disabling the host
+policy during provider exchange prevents activation. If a provider has already
+rotated tokens, their encrypted replacement is retained, but disabled callers
+receive no credential. Configuration reads and revocation remain available;
+static API keys, static MCP tokens and public MCP do not use this OAuth hook.
+
+Hosts must bind runtime evaluation to the **invoking** project. A shared
+Connection's original `projectId` is not the execution context. This hook is
+additional host authorization; it does not replace Connection selection,
+tenant visibility, grants or provider scopes. It cannot recall credentials that
+a host previously exported to a legacy consumer.
+
+### Setup status, cancellation and receipt recovery
+
+`getSetupStatus(id)` returns a public projection without owner, binding, OAuth
+client, callback metadata or private persistence references. `cancelSetupSession`
+competes atomically with authorization start; cancellation is idempotent but
+cannot undo an authorization already started. Legacy rows without an explicit
+status derive pending/started from `consumedAt`. Setup-link expiry is the start
+window; OAuth state expiry becomes the status deadline after start.
+
+Memory and Drizzle stores implement status, cancellation and terminal receipts.
+For separate account/link/receipt writes, they also persist a private completion
+intent before account persistence. A subsequent status read reconciles only the
+exact recorded account generation and active project link. It does not exchange
+tokens, search caller metadata, create links or reactivate revoked access. Drizzle
+persists the intent encrypted and supports recovery after process restart.
+
+Hosts with an atomic credential/account/link/receipt transaction may instead
+implement `finishConnectionSetupSession` by verifying that transaction's receipt.
+Custom adapters must implement the optional cancellation/completion ports to
+provide the full lifecycle, and either atomic completion or the preparation and
+reconciliation ports for durable receipt recovery. A missing or modified account
+or link is never reported as a recovered success. Older interrupted flows without
+a prepared intent cannot be reconstructed safely and require operator review.
+
+
+### Reusable MCP client configuration contract
+
+`McpOAuthClientResolver` resolves host-owned configurations independently of
+user consent. Ownership (`managed`, `customer`, `instance`) is distinct from
+MCP client registration (`dynamic`, `metadata_document`, `pre_registered`). A
+configuration pins its Connector/authentication, owner, MCP resource/transport,
+callback and registration identity. A backend may select a configuration ID;
+the host must reject an out-of-scope or ambiguous selection.
+
+`resolveMcpOAuthSetupClient` validates a scoped selection and returns the private
+resolved client plus a non-secret reference/fingerprint. Only that reference
+belongs in a setup session. `verifyMcpOAuthSetupClient` re-resolves it and refuses
+identity, owner, endpoint or callback changes; secret-only rotation is permitted.
+Supply the resolver as `mcpOAuthClients` to enable MCP on `createSetupSession`.
+`configurationId` selects an approved configuration; identity comes from the
+authenticated application backend. `startOAuthSetup` and `completeOAuthCallback`
+use the same setup lifecycle for all three registration methods and ownership
+modes. The account belongs to the saved subject and is linked to the initiating
+project. Neither caller metadata nor direct MCP start can create setup authority.
+
+MCP DCR adapters receive `registrationKey`. When present they must use it and must
+not fall back to old unkeyed entries. It incorporates the private configuration
+namespace, resource, authorization/registration/token endpoints, callback, client
+branding and requested scopes. Reusing the same MCP URL is insufficient evidence
+that its authorization server or client identity is unchanged. User tokens remain
+separate from this client-registration cache.
+
+### Atomic MCP OAuth callback activation
+
+MCP OAuth hosts must implement `ConnectStore.commitMcpOAuthConnection` and the
+versioned secret store contract. The runtime refuses new consent before discovery
+if either is missing; it never falls back to separate account/receipt writes.
+The commit inserts a new account and completes the current callback claim in one
+atomic operation. Expired/replaced claims and conflicting account IDs are denied,
+and a delayed token exchange cannot overwrite a newer secret generation.
+Memory and the encrypted SQLite/PostgreSQL adapters implement this contract.
+Custom adapters must implement it before adopting this runtime version.
+Embedded MCP hosts instead need `commitMcpOAuthSetup`, `failMcpOAuthSetup`, private
+setup-reference lookup, setup completion, link storage, callback claims and
+versioned secrets. Creation checks these capabilities before issuing a session.
+Activation commits the account, project link, setup receipt and OAuth receipt in
+one operation. Provider denial conditionally ends both receipts under the current
+unexpired claim; a stale callback cannot fail a newer attempt. Completed callbacks
+can be retried after a lost acknowledgement, but never recreate revoked links.
+
+The generic resolver is rechecked before consent, exchange, activation and
+credential delivery. Its last successful lookup is the configuration authorization
+boundary in OSS: an external resolver cannot participate atomically in the generic
+store's transaction. Hosts requiring atomic configuration revocation must also
+check/lock the live configuration in their `commitMcpOAuthSetup` implementation.
+Project authorization and approved return-origin policy likewise belong to the
+host. These contracts do not imply a deployed managed implementation.
+
+### Host dispatch budgets
+
+`createConnectService({ beforeDispatch })` accepts an optional trusted host
+quota callback. It runs before each API send, including allowed redirects and
+API verification probes. A runtime may provide the request-level `beforeDispatch`
+instead to use its authenticated invocation principal; the service calls one
+quota callback per send, never both. Authorization and credential preflight do
+not consume quota. After the asynchronous callback, the service rechecks the
+account generation, granted scopes and invocation authorization before sending.
+An authorization change can consume budget without sending; budget is not a
+billing record and is not refunded after uncertain writes.
+
+Native MCP accepts the corresponding transport callback for every HTTP request
+(initialization, notifications, discovery, calls, listening and cleanup). The
+Connection capability resolver also rechecks the selected account, current grant,
+project visibility and endpoint after waiting. A custom `verifyMcp` adapter must
+call its supplied `beforeDispatch` immediately before every provider request;
+`discoverRemoteMcpTools` accepts it directly. Do not expose these callbacks or
+quota identity to authored tools or model arguments.
+
+Hosts may throw `ConnectError("rate_limited", ..., { details: {
+retryAfterSeconds } })` for a quota refusal (HTTP 429), or `dispatch_unavailable`
+for unavailable quota infrastructure (HTTP 503). The MCP broker/subprocess/tool
+path preserves only the allowlisted quota code and a bounded integer retry time,
+using a canonical message; arbitrary provider errors stay redacted. Neither
+path retries mutations automatically. Cleanup failures cannot turn an already
+completed tool operation into an apparent failure. Self-hosted instances may
+omit quotas; distributed persistence and tenant budgets belong to the host.

package/dist/custom-tool-runner-broker.d.ts

@@ -0,0 +1,29 @@
+import { type CustomToolRunnerInventory, type ResolveCustomTools, type ToolInvocationContext } from "@polpo-ai/core";
+export declare class CustomToolRunnerBrokerError extends Error {
+    readonly status: 400 | 401 | 403 | 408 | 409 | 413 | 429 | 503;
+    constructor(status: 400 | 401 | 403 | 408 | 409 | 413 | 429 | 503);
+}
+/** Host-owned lease, loaded using the opaque bearer and sandbox identity.
+ * No provider secret or tenant executable belongs in this broker. */
+export interface AuthorizedCustomToolRunnerLease {
+    readonly agentName: string;
+    readonly invocation: ToolInvocationContext;
+    readonly inventory: Readonly<CustomToolRunnerInventory>;
+    /** Absolute host-stored expiry in epoch milliseconds, never caller input. */
+    readonly expiresAt: number;
+    /** The host owns isolated execution and cancellation/cleanup. Its resolver
+     * must also call assertActive after asynchronous preparation, immediately
+     * before handing any credentials to tool code. */
+    readonly resolveTools: ResolveCustomTools;
+    /** Live expiry, run state, agent incarnation, lease generation and rollout. */
+    assertActive(): Promise<void>;
+    /** Atomically consumes the ID for the entire lease lifetime, including failed
+     * calls. A repeated ID throws 409: mutation delivery is never retried. */
+    claimCall(toolCallId: string): Promise<void>;
+}
+/** HTTP-neutral agent-run endpoint for OSS and managed hosts. This does not
+ * expose a general integration API; only the host's fixed inventory is callable. */
+export declare function createCustomToolRunnerBroker(options: {
+    authorize(token: string, sandboxId: string): Promise<AuthorizedCustomToolRunnerLease>;
+}): (request: Request) => Promise<Response>;
+//# sourceMappingURL=custom-tool-runner-broker.d.ts.map

package/dist/custom-tool-runner-broker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-tool-runner-broker.d.ts","sourceRoot":"","sources":["../src/custom-tool-runner-broker.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,yBAAyB,EAAE,KAAK,kBAAkB,EAAE,KAAK,qBAAqB,EACpF,MAAM,gBAAgB,CAAC;AAGxB,qBAAa,2BAA4B,SAAQ,KAAK;IACxC,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG;gBAArD,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG;CAI3E;AAED;qEACqE;AACrE,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,qBAAqB,CAAC;IAC3C,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,yBAAyB,CAAC,CAAC;IACxD,6EAA6E;IAC7E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;sDAEkD;IAClD,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC;IAC1C,+EAA+E;IAC/E,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B;8EAC0E;IAC1E,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9C;AAED;oFACoF;AACpF,wBAAgB,4BAA4B,CAAC,OAAO,EAAE;IACpD,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,+BAA+B,CAAC,CAAC;CACvF,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CA6F1C"}

package/dist/custom-tool-runner-broker.js

@@ -0,0 +1,140 @@
+import { createToolInvocationContext, CustomToolRunnerRequestSchema, CustomToolRunnerInventorySchema, CustomToolRunnerResultSchema, MAX_CUSTOM_TOOL_RUNNER_REQUEST_BYTES, MAX_CUSTOM_TOOL_RUNNER_RESPONSE_BYTES, CUSTOM_TOOL_RUNNER_INVENTORY_TIMEOUT_MS, CUSTOM_TOOL_RUNNER_CALL_TIMEOUT_MS, } from "@polpo-ai/core";
+import { isDeepStrictEqual } from "node:util";
+export class CustomToolRunnerBrokerError extends Error {
+    status;
+    constructor(status) {
+        super("Custom tool broker request failed");
+        this.status = status;
+        this.name = "CustomToolRunnerBrokerError";
+    }
+}
+/** HTTP-neutral agent-run endpoint for OSS and managed hosts. This does not
+ * expose a general integration API; only the host's fixed inventory is callable. */
+export function createCustomToolRunnerBroker(options) {
+    const json = (data, status = 200) => {
+        const body = JSON.stringify(data);
+        if (new TextEncoder().encode(body).byteLength > MAX_CUSTOM_TOOL_RUNNER_RESPONSE_BYTES)
+            throw new CustomToolRunnerBrokerError(413);
+        return new Response(body, { status, headers: { "content-type": "application/json", "cache-control": "no-store" } });
+    };
+    return async (request) => {
+        const denied = (status) => json({ ok: false, error: { code: "custom_tool_broker_denied", message: "Custom tool broker request failed" } }, status);
+        if (request.method !== "POST")
+            return denied(405);
+        const controller = new AbortController();
+        const startedAt = Date.now();
+        const abort = () => controller.abort();
+        request.signal.addEventListener("abort", abort, { once: true });
+        if (request.signal.aborted)
+            abort();
+        let timer = setTimeout(abort, CUSTOM_TOOL_RUNNER_INVENTORY_TIMEOUT_MS);
+        const bounded = (work) => new Promise((resolve, reject) => {
+            if (controller.signal.aborted) {
+                reject(new CustomToolRunnerBrokerError(408));
+                return;
+            }
+            const cancelled = () => reject(new CustomToolRunnerBrokerError(408));
+            controller.signal.addEventListener("abort", cancelled, { once: true });
+            Promise.resolve().then(() => {
+                if (controller.signal.aborted)
+                    throw new CustomToolRunnerBrokerError(408);
+                return work();
+            }).then(resolve, reject).finally(() => controller.signal.removeEventListener("abort", cancelled));
+        });
+        try {
+            const token = /^Bearer ([A-Za-z0-9_-]+)$/.exec(request.headers.get("authorization") ?? "")?.[1];
+            const sandboxId = request.headers.get("x-polpo-sandbox-id");
+            if (!token || token.length > 512 || !sandboxId || sandboxId.length > 512)
+                throw new CustomToolRunnerBrokerError(401);
+            const lease = await bounded(() => options.authorize(token, sandboxId));
+            if (!Number.isFinite(lease.expiresAt) || lease.expiresAt <= Date.now())
+                throw new CustomToolRunnerBrokerError(401);
+            clearTimeout(timer);
+            timer = setTimeout(abort, Math.max(0, Math.min(lease.expiresAt - Date.now(), CUSTOM_TOOL_RUNNER_INVENTORY_TIMEOUT_MS - (Date.now() - startedAt))));
+            await bounded(() => lease.assertActive());
+            if (Number(request.headers.get("content-length")) > MAX_CUSTOM_TOOL_RUNNER_REQUEST_BYTES)
+                throw new CustomToolRunnerBrokerError(413);
+            if (!request.body)
+                throw new CustomToolRunnerBrokerError(400);
+            const reader = request.body.getReader();
+            const chunks = [];
+            let size = 0;
+            try {
+                while (true) {
+                    const chunk = await bounded(() => reader.read());
+                    if (chunk.done)
+                        break;
+                    size += chunk.value.byteLength;
+                    if (size > MAX_CUSTOM_TOOL_RUNNER_REQUEST_BYTES)
+                        throw new CustomToolRunnerBrokerError(413);
+                    chunks.push(chunk.value);
+                }
+            }
+            finally {
+                void reader.cancel().catch(() => undefined);
+            }
+            const bytes = new Uint8Array(size);
+            let offset = 0;
+            for (const chunk of chunks) {
+                bytes.set(chunk, offset);
+                offset += chunk.byteLength;
+            }
+            let raw;
+            try {
+                raw = JSON.parse(new TextDecoder().decode(bytes));
+            }
+            catch {
+                throw new CustomToolRunnerBrokerError(400);
+            }
+            const parsed = CustomToolRunnerRequestSchema.safeParse(raw);
+            if (!parsed.success)
+                throw new CustomToolRunnerBrokerError(400);
+            // TypeBox schemas may carry internal symbol keys. Only their JSON schema
+            // representation is part of the wire inventory or equality contract.
+            const inventory = CustomToolRunnerInventorySchema.safeParse(JSON.parse(JSON.stringify(lease.inventory)));
+            if (!inventory.success)
+                throw new CustomToolRunnerBrokerError(403);
+            const invocation = createToolInvocationContext(lease.invocation);
+            if (!invocation.agent || invocation.agent.name !== lease.agentName)
+                throw new CustomToolRunnerBrokerError(403);
+            const operation = parsed.data;
+            if (operation.operation === "inventory")
+                return json({ ok: true, data: inventory.data });
+            const selected = inventory.data.find(tool => tool.name === operation.toolName);
+            if (!selected)
+                throw new CustomToolRunnerBrokerError(403);
+            await bounded(() => lease.claimCall(operation.toolCallId));
+            clearTimeout(timer);
+            timer = setTimeout(abort, Math.max(0, Math.min(CUSTOM_TOOL_RUNNER_CALL_TIMEOUT_MS, lease.expiresAt - Date.now())));
+            const tools = await bounded(() => lease.resolveTools({ agentName: lease.agentName, invocation,
+                allowedTools: [selected.name], signal: controller.signal }));
+            const candidates = tools.filter(tool => tool.name === selected.name);
+            if (candidates.length !== 1)
+                throw new CustomToolRunnerBrokerError(403);
+            const tool = candidates[0];
+            const current = CustomToolRunnerInventorySchema.safeParse(JSON.parse(JSON.stringify([{
+                    name: tool.name, label: tool.label, description: tool.description, parameters: tool.parameters,
+                    ...(tool.requiresSandbox === undefined ? {} : { requiresSandbox: tool.requiresSandbox }),
+                }])));
+            if (!current.success || !isDeepStrictEqual(current.data[0], selected))
+                throw new CustomToolRunnerBrokerError(403);
+            await bounded(() => lease.assertActive());
+            const result = await bounded(() => tool.execute(operation.toolCallId, operation.arguments, controller.signal));
+            await bounded(() => lease.assertActive());
+            const valid = CustomToolRunnerResultSchema.safeParse(result);
+            if (!valid.success)
+                throw new CustomToolRunnerBrokerError(503);
+            return json({ ok: true, data: valid.data });
+        }
+        catch (error) {
+            // Do not send host errors, raw transport causes, credentials or schemas.
+            return denied(error instanceof CustomToolRunnerBrokerError ? error.status : 503);
+        }
+        finally {
+            clearTimeout(timer);
+            request.signal.removeEventListener("abort", abort);
+            controller.abort();
+        }
+    };
+}
+//# sourceMappingURL=custom-tool-runner-broker.js.map

package/dist/custom-tool-runner-broker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-tool-runner-broker.js","sourceRoot":"","sources":["../src/custom-tool-runner-broker.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,EAAE,6BAA6B,EAAE,+BAA+B,EAC3F,4BAA4B,EAAE,oCAAoC,EAAE,qCAAqC,EACzG,uCAAuC,EAAE,kCAAkC,GAE5E,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IAC/B;IAArB,YAAqB,MAAqD;QACxE,KAAK,CAAC,mCAAmC,CAAC,CAAC;QADxB,WAAM,GAAN,MAAM,CAA+C;QAExE,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC5C,CAAC;CACF;AAqBD;oFACoF;AACpF,MAAM,UAAU,4BAA4B,CAAC,OAE5C;IACC,MAAM,IAAI,GAAG,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG,EAAE,EAAE;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,GAAG,qCAAqC;YAAE,MAAM,IAAI,2BAA2B,CAAC,GAAG,CAAC,CAAC;QAClI,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IACtH,CAAC,CAAC;IACF,OAAO,KAAK,EAAC,OAAO,EAAC,EAAE;QACrB,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,mCAAmC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QAC3J,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACvC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;YAAE,KAAK,EAAE,CAAC;QACpC,IAAI,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,uCAAuC,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,CAAI,IAA0B,EAAc,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC7F,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAAC,MAAM,CAAC,IAAI,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YACxF,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC;YACrE,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACvE,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC1B,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;oBAAE,MAAM,IAAI,2BAA2B,CAAC,GAAG,CAAC,CAAC;gBAC1E,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;QACpG,CAAC,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAChG,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;YAC5D,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,GAAG;gBAAE,MAAM,IAAI,2BAA2B,CAAC,GAAG,CAAC,CAAC;YACrH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;YACvE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;gBAAE,MAAM,IAAI,2BAA2B,CAAC,GAAG,CAAC,CAAC;YACnH,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EACzE,uCAAuC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YACxE,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;YAC1C,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,GAAG,oCAAoC;gBAAE,MAAM,IAAI,2BAA2B,CAAC,GAAG,CAAC,CAAC;YACrI,IAAI,CAAC,OAAO,CAAC,IAAI;gBAAE,MAAM,IAAI,2BAA2B,CAAC,GAAG,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACxC,MAAM,MAAM,GAAiB,EAAE,CAAC;YAChC,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,IAAI,CAAC;gBACH,OAAO,IAAI,EAAE,CAAC;oBACZ,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;oBACjD,IAAI,KAAK,CAAC,IAAI;wBAAE,MAAM;oBACtB,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;oBAC/B,IAAI,IAAI,GAAG,oCAAoC;wBAAE,MAAM,IAAI,2BAA2B,CAAC,GAAG,CAAC,CAAC;oBAC5F,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC3B,CAAC;YACH,CAAC;oBAAS,CAAC;gBAAC,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAAC,CAAC;YAC1D,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,MAAM,GAAG,CAAC,CAAC;YACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gBAAC,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;YAAC,CAAC;YACrF,IAAI,GAAY,CAAC;YACjB,IAAI,CAAC;gBAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,MAAM,IAAI,2BAA2B,CAAC,GAAG,CAAC,CAAC;YAAC,CAAC;YAChH,MAAM,MAAM,GAAG,6BAA6B,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAC5D,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,2BAA2B,CAAC,GAAG,CAAC,CAAC;YAChE,yEAAyE;YACzE,qEAAqE;YACrE,MAAM,SAAS,GAAG,+BAA+B,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACzG,IAAI,CAAC,SAAS,CAAC,OAAO;gBAAE,MAAM,IAAI,2BAA2B,CAAC,GAAG,CAAC,CAAC;YACnE,MAAM,UAAU,GAAG,2BAA2B,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACjE,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,SAAS;gBAAE,MAAM,IAAI,2BAA2B,CAAC,GAAG,CAAC,CAAC;YAC/G,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC;YAC9B,IAAI,SAAS,CAAC,SAAS,KAAK,WAAW;gBAAE,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;YACzF,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,QAAQ,CAAC,CAAC;YAC/E,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,2BAA2B,CAAC,GAAG,CAAC,CAAC;YAC1D,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC;YAC3D,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,kCAAkC,EAAE,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;YACnH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,UAAU;gBAC3F,YAAY,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAC/D,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAC,CAAC;YACrE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,2BAA2B,CAAC,GAAG,CAAC,CAAC;YACxE,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,OAAO,GAAG,+BAA+B,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBACnF,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC9F,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC;iBACzF,CAAC,CAAC,CAAC,CAAC,CAAC;YACN,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;gBAAE,MAAM,IAAI,2BAA2B,CAAC,GAAG,CAAC,CAAC;YAClH,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;YAC/G,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;YAC1C,MAAM,KAAK,GAAG,4BAA4B,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC7D,IAAI,CAAC,KAAK,CAAC,OAAO;gBAAE,MAAM,IAAI,2BAA2B,CAAC,GAAG,CAAC,CAAC;YAC/D,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yEAAyE;YACzE,OAAO,MAAM,CAAC,KAAK,YAAY,2BAA2B,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACnF,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACnD,UAAU,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/definition-store.d.ts

@@ -0,0 +1,10 @@
+import { type ConnectorDefinitionStore, type StoredConnectorDefinition } from "@polpo-ai/connect";
+/** In-memory host adapter for tests and ephemeral self-hosted deployments. */
+export declare class MemoryConnectorDefinitionStore implements ConnectorDefinitionStore {
+    private readonly definitions;
+    listConnectorDefinitions(): Promise<StoredConnectorDefinition[]>;
+    getConnectorDefinition(id: string): Promise<StoredConnectorDefinition | null>;
+    createConnectorDefinition(record: StoredConnectorDefinition): Promise<void>;
+    disableConnectorDefinition(id: string, disabledAt: string): Promise<StoredConnectorDefinition>;
+}
+//# sourceMappingURL=definition-store.d.ts.map

package/dist/definition-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"definition-store.d.ts","sourceRoot":"","sources":["../src/definition-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,wBAAwB,EAAE,KAAK,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAEhH,8EAA8E;AAC9E,qBAAa,8BAA+B,YAAW,wBAAwB;IAC7E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAgD;IAEtE,wBAAwB,IAAI,OAAO,CAAC,yBAAyB,EAAE,CAAC;IAGhE,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC;IAG7E,yBAAyB,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;IAI3E,0BAA0B,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC;CAMrG"}

package/dist/definition-store.js

@@ -0,0 +1,25 @@
+import { ConnectError } from "@polpo-ai/connect";
+/** In-memory host adapter for tests and ephemeral self-hosted deployments. */
+export class MemoryConnectorDefinitionStore {
+    definitions = new Map();
+    async listConnectorDefinitions() {
+        return structuredClone([...this.definitions.values()]);
+    }
+    async getConnectorDefinition(id) {
+        return structuredClone(this.definitions.get(id) ?? null);
+    }
+    async createConnectorDefinition(record) {
+        if (this.definitions.has(record.definition.id))
+            throw new ConnectError("invalid_provider", "Connector id is already registered");
+        this.definitions.set(record.definition.id, structuredClone(record));
+    }
+    async disableConnectorDefinition(id, disabledAt) {
+        const record = this.definitions.get(id);
+        if (!record)
+            throw new ConnectError("provider_not_found", "Custom Connector not found");
+        if (!record.disabledAt)
+            record.disabledAt = disabledAt;
+        return structuredClone(record);
+    }
+}
+//# sourceMappingURL=definition-store.js.map

package/dist/definition-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"definition-store.js","sourceRoot":"","sources":["../src/definition-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAiE,MAAM,mBAAmB,CAAC;AAEhH,8EAA8E;AAC9E,MAAM,OAAO,8BAA8B;IACxB,WAAW,GAAG,IAAI,GAAG,EAAqC,CAAC;IAE5E,KAAK,CAAC,wBAAwB;QAC5B,OAAO,eAAe,CAAC,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,KAAK,CAAC,sBAAsB,CAAC,EAAU;QACrC,OAAO,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC;IAC3D,CAAC;IACD,KAAK,CAAC,yBAAyB,CAAC,MAAiC;QAC/D,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,YAAY,CAAC,kBAAkB,EAAE,oCAAoC,CAAC,CAAC;QACjI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,KAAK,CAAC,0BAA0B,CAAC,EAAU,EAAE,UAAkB;QAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,YAAY,CAAC,oBAAoB,EAAE,4BAA4B,CAAC,CAAC;QACxF,IAAI,CAAC,MAAM,CAAC,UAAU;YAAE,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC;QACvD,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;CACF"}

package/dist/index.d.ts

@@ -3,4 +3,12 @@ export * from "./oauth.js";
 export * from "./secrets.js";
 export * from "./service.js";
 export * from "./mcp-oauth.js";
+export * from "./definition-store.js";
+export * from "./mcp-discovery.js";
+export * from "./mcp-execution.js";
+export * from "./mcp-capability-resolver.js";
+export * from "./mcp-runner-broker.js";
+export * from "./custom-tool-runner-broker.js";
+export { observeConnectionSetupSession, cancelConnectionSetupSession } from "./setup-lifecycle.js";
+export { resolveMcpOAuthSetupClient, verifyMcpOAuthSetupClient, type McpOAuthSetupClientReference } from "./mcp-setup-clients.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,gCAAgC,CAAC;AAE/C,OAAO,EAAE,6BAA6B,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAC;AACnG,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,KAAK,4BAA4B,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/index.js

@@ -3,4 +3,12 @@ export * from "./oauth.js";
 export * from "./secrets.js";
 export * from "./service.js";
 export * from "./mcp-oauth.js";
+export * from "./definition-store.js";
+export * from "./mcp-discovery.js";
+export * from "./mcp-execution.js";
+export * from "./mcp-capability-resolver.js";
+export * from "./mcp-runner-broker.js";
+export * from "./custom-tool-runner-broker.js";
+export { observeConnectionSetupSession, cancelConnectionSetupSession } from "./setup-lifecycle.js";
+export { resolveMcpOAuthSetupClient, verifyMcpOAuthSetupClient } from "./mcp-setup-clients.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,gCAAgC,CAAC;AAE/C,OAAO,EAAE,6BAA6B,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAC;AACnG,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAqC,MAAM,wBAAwB,CAAC"}