@rubytech/create-maxy-code 0.1.351 → 0.1.353

package/payload/platform/plugins/connector/mcp/dist/index.js

@@ -0,0 +1,119 @@
+import { initStderrTee } from "../../../../lib/mcp-stderr-tee/dist/index.js";
+initStderrTee("connector");
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+import { lifelineTool } from "../../../../lib/mcp-lifeline/dist/index.js";
+import { readRegistry, listConnectors, registerConnector, deregisterConnector, resolveConnector, } from "./lib/store.js";
+import { performCall } from "./lib/call.js";
+import { hostResolvesPrivate } from "./lib/ssrf.js";
+// Plugin-system boot tolerance: module init must never throw. tools/list is enumerated
+// with empty env, so account context is resolved per call; all tools are registered
+// unconditionally and each handler refuses per-call when context is absent.
+const ACCOUNT_ID = process.env.ACCOUNT_ID ?? null;
+const PLATFORM_ROOT = process.env.PLATFORM_ROOT ?? null;
+function countRegistered() {
+    if (!ACCOUNT_ID || !PLATFORM_ROOT)
+        return "n/a";
+    try {
+        return Object.keys(readRegistry(PLATFORM_ROOT, ACCOUNT_ID)).length;
+    }
+    catch {
+        return "n/a";
+    }
+}
+process.stderr.write(`[connector] op=init account=${ACCOUNT_ID ?? "null"} connectors=${countRegistered()}\n`);
+let callSeq = 0;
+const nextReqId = () => (++callSeq).toString(16).padStart(6, "0");
+function ok(data) {
+    return {
+        content: [{ type: "text", text: typeof data === "string" ? data : JSON.stringify(data, null, 2) }],
+    };
+}
+function fail(msg) {
+    return { content: [{ type: "text", text: msg }], isError: true };
+}
+function refuseNoAccount(tool) {
+    process.stderr.write(`[connector] tool=${tool} refuse reason=no-account-context\n`);
+    return fail(`${tool} cannot execute: launched without ACCOUNT_ID/PLATFORM_ROOT (metadata-only mode).`);
+}
+function ctx(tool) {
+    if (!ACCOUNT_ID || !PLATFORM_ROOT)
+        return { refusal: refuseNoAccount(tool) };
+    return { platformRoot: PLATFORM_ROOT, accountId: ACCOUNT_ID };
+}
+const server = new McpServer({ name: "connector", version: "0.1.0" });
+lifelineTool(server, "connector-register", "Register a named third-party REST API: store its base URL and a static credential so the agent can call it. auth.scheme is bearer | api-key-header | basic; headerName is required for api-key-header. The credential is stored in the account secrets file and is never returned or logged. Returns the non-secret record only.", {
+    name: z.string().min(1),
+    baseUrl: z.string().min(1),
+    auth: z.object({
+        scheme: z.enum(["bearer", "api-key-header", "basic"]),
+        value: z.string().min(1),
+        headerName: z.string().min(1).optional(),
+    }),
+}, async ({ name, baseUrl, auth }) => {
+    const c = ctx("connector-register");
+    if ("refusal" in c)
+        return c.refusal;
+    let url;
+    try {
+        url = new URL(baseUrl);
+    }
+    catch {
+        return fail("connector-register: baseUrl is not a valid URL.");
+    }
+    if (url.protocol !== "http:" && url.protocol !== "https:")
+        return fail("connector-register: baseUrl must be http(s).");
+    if (auth.scheme === "api-key-header" && !auth.headerName)
+        return fail("connector-register: headerName is required for the api-key-header scheme.");
+    if (await hostResolvesPrivate(url.hostname)) {
+        process.stderr.write(`[connector] op=register-refused name=${name} reason=private-ip target=${url.hostname}\n`);
+        return fail("connector-register: refused — baseUrl host resolves to a private or loopback address.");
+    }
+    const rec = {
+        baseUrl,
+        host: url.hostname,
+        authScheme: auth.scheme,
+        ...(auth.scheme === "api-key-header" ? { headerName: auth.headerName } : {}),
+    };
+    registerConnector(c.platformRoot, c.accountId, name, rec, auth.value);
+    process.stderr.write(`[connector] op=register name=${name} host=${url.hostname} scheme=${auth.scheme}\n`);
+    return ok({ name, baseUrl, host: url.hostname, authScheme: auth.scheme });
+});
+lifelineTool(server, "connector-call", "Make an authenticated request to a registered connector. The credential is injected from the secret store; the request is confined to the registered host (a different host, a private address, or a cross-host redirect is refused). Returns { status, headers (redacted), body (capped) }.", {
+    name: z.string().min(1),
+    method: z.enum(["GET", "POST", "PUT", "PATCH", "DELETE"]),
+    path: z.string(),
+    query: z.record(z.string()).optional(),
+    body: z.unknown().optional(),
+    headers: z.record(z.string()).optional(),
+}, async ({ name, method, path, query, body, headers }) => {
+    const c = ctx("connector-call");
+    if ("refusal" in c)
+        return c.refusal;
+    const resolved = resolveConnector(c.platformRoot, c.accountId, name);
+    if (!resolved)
+        return fail(`connector-call: no connector named '${name}' is registered.`);
+    const reqId = nextReqId();
+    const result = await performCall(resolved.rec, resolved.secret, { method, path, query, body, headers }, { log: (line) => process.stderr.write(`[connector] ${line}\n`), reqId });
+    if (!result.ok)
+        return fail(`connector-call refused: ${result.refused}.`);
+    return ok({ status: result.status, headers: result.headers, body: result.body, truncated: result.truncated });
+});
+lifelineTool(server, "connector-list", "List the registered connectors for this account (names and base URLs only — never credentials).", {}, async () => {
+    const c = ctx("connector-list");
+    if ("refusal" in c)
+        return c.refusal;
+    return ok(listConnectors(c.platformRoot, c.accountId));
+});
+lifelineTool(server, "connector-deregister", "Remove a registered connector and its stored credential. Idempotent: removing an unknown name is reported, not an error.", { name: z.string().min(1) }, async ({ name }) => {
+    const c = ctx("connector-deregister");
+    if ("refusal" in c)
+        return c.refusal;
+    const had = deregisterConnector(c.platformRoot, c.accountId, name);
+    process.stderr.write(`[connector] op=deregister name=${name} existed=${had}\n`);
+    return ok(had ? `Deregistered connector '${name}'.` : `No connector named '${name}' was registered.`);
+});
+const transport = new StdioServerTransport();
+await server.connect(transport);
+//# sourceMappingURL=index.js.map

package/payload/platform/plugins/connector/mcp/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,8CAA8C,CAAC;AAC7E,aAAa,CAAC,WAAW,CAAC,CAAC;AAE3B,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,4CAA4C,CAAC;AAC1E,OAAO,EACL,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,GAEjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEpD,uFAAuF;AACvF,oFAAoF;AACpF,4EAA4E;AAC5E,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC;AAClD,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC;AAExD,SAAS,eAAe;IACtB,IAAI,CAAC,UAAU,IAAI,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,UAAU,IAAI,MAAM,eAAe,eAAe,EAAE,IAAI,CAAC,CAAC;AAE9G,IAAI,OAAO,GAAG,CAAC,CAAC;AAChB,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAElE,SAAS,EAAE,CAAC,IAAa;IACvB,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;KAC5G,CAAC;AACJ,CAAC;AACD,SAAS,IAAI,CAAC,GAAW;IACvB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,IAAa,EAAE,CAAC;AACrF,CAAC;AACD,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,IAAI,qCAAqC,CAAC,CAAC;IACpF,OAAO,IAAI,CAAC,GAAG,IAAI,kFAAkF,CAAC,CAAC;AACzG,CAAC;AAED,SAAS,GAAG,CAAC,IAAY;IACvB,IAAI,CAAC,UAAU,IAAI,CAAC,aAAa;QAAE,OAAO,EAAE,OAAO,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;IAC7E,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AAChE,CAAC;AAED,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;AAEtE,YAAY,CACV,MAAM,EACN,oBAAoB,EACpB,kUAAkU,EAClU;IACE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;QACrD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KACzC,CAAC;CACH,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;IAChC,MAAM,CAAC,GAAG,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACpC,IAAI,SAAS,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC,OAAO,CAAC;IACrC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,iDAAiD,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,8CAA8C,CAAC,CAAC;IACvH,IAAI,IAAI,CAAC,MAAM,KAAK,gBAAgB,IAAI,CAAC,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC,2EAA2E,CAAC,CAAC;IACnJ,IAAI,MAAM,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAwC,IAAI,6BAA6B,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC;QAChH,OAAO,IAAI,CAAC,uFAAuF,CAAC,CAAC;IACvG,CAAC;IACD,MAAM,GAAG,GAAoB;QAC3B,OAAO;QACP,IAAI,EAAE,GAAG,CAAC,QAAQ;QAClB,UAAU,EAAE,IAAI,CAAC,MAAM;QACvB,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,gBAAgB,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7E,CAAC;IACF,iBAAiB,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACtE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,IAAI,SAAS,GAAG,CAAC,QAAQ,WAAW,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;IAC1G,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AAC5E,CAAC,CACF,CAAC;AAEF,YAAY,CACV,MAAM,EACN,gBAAgB,EAChB,8RAA8R,EAC9R;IACE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACzD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC5B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACzC,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;IACrD,MAAM,CAAC,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAChC,IAAI,SAAS,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC,OAAO,CAAC;IACrC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACrE,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC,uCAAuC,IAAI,kBAAkB,CAAC,CAAC;IAC1F,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,MAAM,WAAW,CAC9B,QAAQ,CAAC,GAAG,EACZ,QAAQ,CAAC,MAAM,EACf,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EACtC,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,IAAI,IAAI,CAAC,EAAE,KAAK,EAAE,CACxE,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,2BAA2B,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;IAC1E,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;AAChH,CAAC,CACF,CAAC;AAEF,YAAY,CAAC,MAAM,EAAE,gBAAgB,EAAE,iGAAiG,EAAE,EAAE,EAAE,KAAK,IAAI,EAAE;IACvJ,MAAM,CAAC,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAChC,IAAI,SAAS,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC,OAAO,CAAC;IACrC,OAAO,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AACzD,CAAC,CAAC,CAAC;AAEH,YAAY,CACV,MAAM,EACN,sBAAsB,EACtB,0HAA0H,EAC1H,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;IACjB,MAAM,CAAC,GAAG,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACtC,IAAI,SAAS,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC,OAAO,CAAC;IACrC,MAAM,GAAG,GAAG,mBAAmB,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACnE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,IAAI,YAAY,GAAG,IAAI,CAAC,CAAC;IAChF,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,2BAA2B,IAAI,IAAI,CAAC,CAAC,CAAC,uBAAuB,IAAI,mBAAmB,CAAC,CAAC;AACxG,CAAC,CACF,CAAC;AAEF,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;AAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC"}

package/payload/platform/plugins/connector/mcp/dist/lib/call.d.ts

@@ -0,0 +1,54 @@
+import type { LookupFunction } from "node:net";
+import { fetch as undiciFetch, type Dispatcher } from "undici";
+import { type Refusal, type Resolution } from "./ssrf.js";
+import type { ConnectorRecord } from "./store.js";
+export interface CallParams {
+    method: string;
+    path: string;
+    query?: Record<string, string>;
+    body?: unknown;
+    headers?: Record<string, string>;
+}
+export interface CallDeps {
+    /** Override for tests; defaults to undici's fetch (same instance as the pinned dispatcher). */
+    fetchImpl?: typeof undiciFetch;
+    /** Override for tests so a loopback stub resolves; defaults to the real address-validating resolve. */
+    resolve?: (targetHost: string, registeredHost: string, kind: "request" | "redirect") => Promise<Resolution>;
+    /**
+     * Build the dispatcher that pins the connection to the validated addresses. Defaults to
+     * the real pinned dispatcher. Tests return `undefined` to skip pinning (a pinned loopback
+     * address would otherwise fail the public re-validation).
+     */
+    makeDispatcher?: (addresses: string[]) => Dispatcher | undefined;
+    /** Sink for `[connector]` lifecycle lines; the secret is never passed to it. */
+    log?: (line: string) => void;
+    reqId?: string;
+}
+export type CallResult = {
+    ok: true;
+    status: number;
+    headers: Record<string, string>;
+    body: string;
+    truncated: boolean;
+} | {
+    ok: false;
+    refused: Refusal;
+};
+/**
+ * Build the DNS lookup an undici dispatcher uses to dial a connector. It returns the
+ * pre-validated addresses without consulting DNS — so no second, independent lookup
+ * happens at connect time — and re-validates each is public, failing closed. undici
+ * always calls it with `{ all: true }`; the single-result branch is kept for completeness.
+ */
+export declare function pinnedLookup(addresses: string[]): LookupFunction;
+/** Dispatcher that dials only the validated addresses; TLS/SNI still use the hostname, so cert validation is unchanged. */
+export declare function pinnedDispatcher(addresses: string[]): Dispatcher;
+/**
+ * Make one authenticated, host-bound request to a registered connector. The host is resolved
+ * and validated before the request and before every redirect hop, and the socket is pinned to
+ * the validated addresses so no second connect-time lookup can land on a rebind. The credential
+ * is injected from the caller-supplied secret and never logged. Returns status + redacted headers
+ * + capped body, or a refusal when resolution rejects the target.
+ */
+export declare function performCall(rec: ConnectorRecord, secret: string, params: CallParams, deps?: CallDeps): Promise<CallResult>;
+//# sourceMappingURL=call.d.ts.map

package/payload/platform/plugins/connector/mcp/dist/lib/call.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"call.d.ts","sourceRoot":"","sources":["../../src/lib/call.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EAAS,KAAK,IAAI,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEtE,OAAO,EAA8B,KAAK,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AACtF,OAAO,KAAK,EAAc,eAAe,EAAE,MAAM,YAAY,CAAC;AAE9D,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,QAAQ;IACvB,+FAA+F;IAC/F,SAAS,CAAC,EAAE,OAAO,WAAW,CAAC;IAC/B,uGAAuG;IACvG,OAAO,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,UAAU,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IAC5G;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,UAAU,GAAG,SAAS,CAAC;IACjE,gFAAgF;IAChF,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,GAC/F;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC;AAQpC;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,cAAc,CAUhE;AAED,2HAA2H;AAC3H,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,UAAU,CAEhE;AAkBD;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,IAAI,GAAE,QAAa,GAClB,OAAO,CAAC,UAAU,CAAC,CA8FrB"}

package/payload/platform/plugins/connector/mcp/dist/lib/call.js

@@ -0,0 +1,157 @@
+import { isIP } from "node:net";
+import { Agent, fetch as undiciFetch } from "undici";
+import { redactHeaders, scrubSecret } from "./redact.js";
+import { isPrivateIp, resolveTarget } from "./ssrf.js";
+const BODY_CAP = 262144; // 256 KiB
+const MAX_REDIRECTS = 5;
+/** Tag carried by the fail-closed error a pinned lookup raises, so the connect-time refusal is distinguishable from a genuine network fault. */
+const PIN_REFUSAL = "__connectorPinRefusal";
+/**
+ * Build the DNS lookup an undici dispatcher uses to dial a connector. It returns the
+ * pre-validated addresses without consulting DNS — so no second, independent lookup
+ * happens at connect time — and re-validates each is public, failing closed. undici
+ * always calls it with `{ all: true }`; the single-result branch is kept for completeness.
+ */
+export function pinnedLookup(addresses) {
+    return ((_hostname, options, cb) => {
+        const safe = addresses.filter((a) => !isPrivateIp(a));
+        if (safe.length === 0) {
+            cb(Object.assign(new Error("connector: pinned address failed public re-validation"), { [PIN_REFUSAL]: true }), "", 0);
+            return;
+        }
+        if (options?.all)
+            cb(null, safe.map((a) => ({ address: a, family: isIP(a) || 4 })));
+        else
+            cb(null, safe[0], isIP(safe[0]) || 4);
+    });
+}
+/** Dispatcher that dials only the validated addresses; TLS/SNI still use the hostname, so cert validation is unchanged. */
+export function pinnedDispatcher(addresses) {
+    return new Agent({ connect: { lookup: pinnedLookup(addresses) } });
+}
+/** True when an error's cause chain carries the pinned-lookup fail-closed tag. */
+function isPinRefusal(err) {
+    for (let cur = err; cur != null; cur = cur.cause) {
+        if (cur[PIN_REFUSAL] === true)
+            return true;
+    }
+    return false;
+}
+/** Inject the credential per scheme. Returns the scheme label for the auth-applied log line. */
+function applyAuth(headers, rec, secret) {
+    if (rec.authScheme === "bearer")
+        headers["Authorization"] = `Bearer ${secret}`;
+    else if (rec.authScheme === "basic")
+        headers["Authorization"] = `Basic ${Buffer.from(secret).toString("base64")}`;
+    else
+        headers[rec.headerName] = secret; // api-key-header (headerName validated at register)
+    return rec.authScheme;
+}
+/**
+ * Make one authenticated, host-bound request to a registered connector. The host is resolved
+ * and validated before the request and before every redirect hop, and the socket is pinned to
+ * the validated addresses so no second connect-time lookup can land on a rebind. The credential
+ * is injected from the caller-supplied secret and never logged. Returns status + redacted headers
+ * + capped body, or a refusal when resolution rejects the target.
+ */
+export async function performCall(rec, secret, params, deps = {}) {
+    const fetchImpl = deps.fetchImpl ?? undiciFetch;
+    const resolve = deps.resolve ?? resolveTarget;
+    const makeDispatcher = deps.makeDispatcher ?? pinnedDispatcher;
+    const log = deps.log ?? (() => { });
+    const reqId = deps.reqId ?? "—";
+    const url = new URL(params.path, rec.baseUrl);
+    // A caller-supplied path may carry userinfo (user:pass@host); strip it so the only credential
+    // sent is the one the connector injects, and so userinfo cannot smuggle alternate auth.
+    url.username = "";
+    url.password = "";
+    if (params.query)
+        for (const [k, v] of Object.entries(params.query))
+            url.searchParams.set(k, v);
+    log(`op=call reqId=${reqId} method=${params.method} host=${url.hostname} path=${url.pathname}`);
+    const reqResolution = await resolve(url.hostname, rec.host, "request");
+    if (!reqResolution.ok) {
+        log(`op=call-refused reqId=${reqId} reason=${reqResolution.refused} target=${url.hostname}`);
+        return { ok: false, refused: reqResolution.refused };
+    }
+    // Track every pinned dispatcher this call creates (initial + each redirect hop) so the
+    // finally can close them — an undici Agent holds a connection pool and timers and would
+    // otherwise leak in this long-lived process. A test seam returning undefined is untracked:
+    // that is the shared global dispatcher, which is never ours to close.
+    const createdDispatchers = [];
+    const pin = (addresses) => {
+        const d = makeDispatcher(addresses);
+        if (d)
+            createdDispatchers.push(d);
+        return d;
+    };
+    let dispatcher = pin(reqResolution.addresses);
+    // Caller headers may not set the auth header or Host — those are ours to control.
+    const headers = {};
+    if (params.headers) {
+        for (const [k, v] of Object.entries(params.headers)) {
+            const lk = k.toLowerCase();
+            if (lk === "authorization" || lk === "host")
+                continue;
+            if (rec.headerName && lk === rec.headerName.toLowerCase())
+                continue;
+            headers[k] = v;
+        }
+    }
+    let bodyStr;
+    if (params.body !== undefined) {
+        if (!Object.keys(headers).some((k) => k.toLowerCase() === "content-type"))
+            headers["Content-Type"] = "application/json";
+        bodyStr = typeof params.body === "string" ? params.body : JSON.stringify(params.body);
+    }
+    const scheme = applyAuth(headers, rec, secret);
+    log(`op=auth-applied reqId=${reqId} scheme=${scheme === "api-key-header" ? "api-key" : scheme}`);
+    const start = Date.now();
+    let current = url;
+    let hops = 0;
+    try {
+        let res;
+        for (;;) {
+            res = await fetchImpl(current.toString(), {
+                method: params.method, headers, body: bodyStr, redirect: "manual",
+                // Omit when undefined so undici falls back to the global dispatcher (the test seam for
+                // a loopback stub); in production pin always returns the pinned dispatcher.
+                ...(dispatcher ? { dispatcher } : {}),
+            });
+            const location = res.status >= 300 && res.status < 400 ? res.headers.get("location") : null;
+            if (!location || hops++ >= MAX_REDIRECTS)
+                break;
+            const next = new URL(location, current);
+            const redirectResolution = await resolve(next.hostname, rec.host, "redirect");
+            if (!redirectResolution.ok) {
+                log(`op=call-refused reqId=${reqId} reason=${redirectResolution.refused} target=${next.hostname}`);
+                return { ok: false, refused: redirectResolution.refused };
+            }
+            dispatcher = pin(redirectResolution.addresses);
+            current = next;
+        }
+        const raw = await res.text();
+        const truncated = raw.length > BODY_CAP;
+        // Scrub the credential from the body in case the upstream reflects it (debug/echo endpoints).
+        const body = scrubSecret(truncated ? raw.slice(0, BODY_CAP) : raw, secret);
+        log(`op=response reqId=${reqId} status=${res.status} bytes=${raw.length} ms=${Date.now() - start}`);
+        return { ok: true, status: res.status, headers: redactHeaders(res.headers, rec.headerName, secret), body, truncated };
+    }
+    catch (err) {
+        // A pinned lookup that fails its public re-validation at connect time surfaces here. The
+        // reason is the same as a resolve-time private address; the trigger is the pinned-lookup
+        // re-validation. Any other fetch error is a genuine fault, not a refusal — rethrow it.
+        if (isPinRefusal(err)) {
+            log(`op=call-refused reqId=${reqId} reason=private-ip target=${current.hostname}`);
+            return { ok: false, refused: "private-ip" };
+        }
+        throw err;
+    }
+    finally {
+        // The body is already buffered by now; close every dispatcher this call created. Fire-and-forget
+        // so socket teardown never delays the tool response.
+        for (const d of createdDispatchers)
+            void d.close().catch(() => { });
+    }
+}
+//# sourceMappingURL=call.js.map

package/payload/platform/plugins/connector/mcp/dist/lib/call.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"call.js","sourceRoot":"","sources":["../../src/lib/call.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI,WAAW,EAAmB,MAAM,QAAQ,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAiC,MAAM,WAAW,CAAC;AA+BtF,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,UAAU;AACnC,MAAM,aAAa,GAAG,CAAC,CAAC;AAExB,gJAAgJ;AAChJ,MAAM,WAAW,GAAG,uBAAuB,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,SAAmB;IAC9C,OAAO,CAAC,CAAC,SAAiB,EAAE,OAA0B,EAAE,EAA+D,EAAE,EAAE;QACzH,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,uDAAuD,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;YACtH,OAAO;QACT,CAAC;QACD,IAAI,OAAO,EAAE,GAAG;YAAE,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;;YAC/E,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7C,CAAC,CAA8B,CAAC;AAClC,CAAC;AAED,2HAA2H;AAC3H,MAAM,UAAU,gBAAgB,CAAC,SAAmB;IAClD,OAAO,IAAI,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,kFAAkF;AAClF,SAAS,YAAY,CAAC,GAAY;IAChC,KAAK,IAAI,GAAG,GAAY,GAAG,EAAE,GAAG,IAAI,IAAI,EAAE,GAAG,GAAI,GAA2B,CAAC,KAAK,EAAE,CAAC;QACnF,IAAK,GAA+B,CAAC,WAAW,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;IAC1E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gGAAgG;AAChG,SAAS,SAAS,CAAC,OAA+B,EAAE,GAAoB,EAAE,MAAc;IACtF,IAAI,GAAG,CAAC,UAAU,KAAK,QAAQ;QAAE,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,MAAM,EAAE,CAAC;SAC1E,IAAI,GAAG,CAAC,UAAU,KAAK,OAAO;QAAE,OAAO,CAAC,eAAe,CAAC,GAAG,SAAS,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;;QAC7G,OAAO,CAAC,GAAG,CAAC,UAAoB,CAAC,GAAG,MAAM,CAAC,CAAC,oDAAoD;IACrG,OAAO,GAAG,CAAC,UAAU,CAAC;AACxB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAoB,EACpB,MAAc,EACd,MAAkB,EAClB,OAAiB,EAAE;IAEnB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,WAAW,CAAC;IAChD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,aAAa,CAAC;IAC9C,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,gBAAgB,CAAC;IAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC;IAEhC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9C,8FAA8F;IAC9F,wFAAwF;IACxF,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;IAClB,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,MAAM,CAAC,KAAK;QAAE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAEhG,GAAG,CAAC,iBAAiB,KAAK,WAAW,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,QAAQ,SAAS,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAChG,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACvE,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;QACtB,GAAG,CAAC,yBAAyB,KAAK,WAAW,aAAa,CAAC,OAAO,WAAW,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,CAAC,OAAO,EAAE,CAAC;IACvD,CAAC;IACD,uFAAuF;IACvF,wFAAwF;IACxF,2FAA2F;IAC3F,sEAAsE;IACtE,MAAM,kBAAkB,GAAiB,EAAE,CAAC;IAC5C,MAAM,GAAG,GAAG,CAAC,SAAmB,EAA0B,EAAE;QAC1D,MAAM,CAAC,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,CAAC;YAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClC,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,IAAI,UAAU,GAAG,GAAG,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;IAE9C,kFAAkF;IAClF,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACpD,MAAM,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;YAC3B,IAAI,EAAE,KAAK,eAAe,IAAI,EAAE,KAAK,MAAM;gBAAE,SAAS;YACtD,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,KAAK,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE;gBAAE,SAAS;YACpE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,IAAI,OAA2B,CAAC;IAChC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,cAAc,CAAC;YAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QACxH,OAAO,GAAG,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC/C,GAAG,CAAC,yBAAyB,KAAK,WAAW,MAAM,KAAK,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAEjG,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,IAAI,OAAO,GAAG,GAAG,CAAC;IAClB,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,CAAC;QACH,IAAI,GAA4C,CAAC;QACjD,SAAS,CAAC;YACR,GAAG,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE;gBACxC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ;gBACjE,uFAAuF;gBACvF,4EAA4E;gBAC5E,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtC,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC5F,IAAI,CAAC,QAAQ,IAAI,IAAI,EAAE,IAAI,aAAa;gBAAE,MAAM;YAChD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACxC,MAAM,kBAAkB,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAC9E,IAAI,CAAC,kBAAkB,CAAC,EAAE,EAAE,CAAC;gBAC3B,GAAG,CAAC,yBAAyB,KAAK,WAAW,kBAAkB,CAAC,OAAO,WAAW,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACnG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,kBAAkB,CAAC,OAAO,EAAE,CAAC;YAC5D,CAAC;YACD,UAAU,GAAG,GAAG,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;YAC/C,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC;QACxC,8FAA8F;QAC9F,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC3E,GAAG,CAAC,qBAAqB,KAAK,WAAW,GAAG,CAAC,MAAM,UAAU,GAAG,CAAC,MAAM,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QACpG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACxH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,yFAAyF;QACzF,yFAAyF;QACzF,uFAAuF;QACvF,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,GAAG,CAAC,yBAAyB,KAAK,6BAA6B,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;YACnF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;QAC9C,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,iGAAiG;QACjG,qDAAqD;QACrD,KAAK,MAAM,CAAC,IAAI,kBAAkB;YAAE,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrE,CAAC;AACH,CAAC"}

package/payload/platform/plugins/connector/mcp/dist/lib/redact.d.ts

@@ -0,0 +1,10 @@
+/** Replace every occurrence of a credential (raw and base64 forms) with a marker. */
+export declare function scrubSecret(text: string, secret: string): string;
+/**
+ * Copy response headers into a plain object, masking the auth-bearing ones so a returned
+ * response never re-exposes a credential or session token. The connector's own api-key header
+ * (if any) is masked alongside Authorization and Set-Cookie, and the known secret value is
+ * scrubbed from every remaining header value in case the upstream reflects it.
+ */
+export declare function redactHeaders(headers: Headers, apiKeyHeader?: string, secret?: string): Record<string, string>;
+//# sourceMappingURL=redact.d.ts.map

package/payload/platform/plugins/connector/mcp/dist/lib/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../src/lib/redact.ts"],"names":[],"mappings":"AAGA,qFAAqF;AACrF,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAMhE;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQ9G"}

package/payload/platform/plugins/connector/mcp/dist/lib/redact.js

@@ -0,0 +1,29 @@
+/** Header names always redacted from a returned response (case-insensitive). */
+const ALWAYS_DROP = ["authorization", "set-cookie"];
+/** Replace every occurrence of a credential (raw and base64 forms) with a marker. */
+export function scrubSecret(text, secret) {
+    if (!secret)
+        return text;
+    let out = text.split(secret).join("<redacted>");
+    const b64 = Buffer.from(secret).toString("base64");
+    if (b64)
+        out = out.split(b64).join("<redacted>");
+    return out;
+}
+/**
+ * Copy response headers into a plain object, masking the auth-bearing ones so a returned
+ * response never re-exposes a credential or session token. The connector's own api-key header
+ * (if any) is masked alongside Authorization and Set-Cookie, and the known secret value is
+ * scrubbed from every remaining header value in case the upstream reflects it.
+ */
+export function redactHeaders(headers, apiKeyHeader, secret) {
+    const drop = new Set(ALWAYS_DROP);
+    if (apiKeyHeader)
+        drop.add(apiKeyHeader.toLowerCase());
+    const out = {};
+    headers.forEach((value, key) => {
+        out[key] = drop.has(key.toLowerCase()) ? "<redacted>" : secret ? scrubSecret(value, secret) : value;
+    });
+    return out;
+}
+//# sourceMappingURL=redact.js.map

package/payload/platform/plugins/connector/mcp/dist/lib/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../src/lib/redact.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,MAAM,WAAW,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;AAEpD,qFAAqF;AACrF,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,MAAc;IACtD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,GAAG;QAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACjD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,OAAgB,EAAE,YAAqB,EAAE,MAAe;IACpF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IAClC,IAAI,YAAY;QAAE,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,CAAC;IACvD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC7B,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACtG,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/payload/platform/plugins/connector/mcp/dist/lib/ssrf.d.ts

@@ -0,0 +1,29 @@
+/** True for any loopback, private, link-local, or unique-local address (v4 or v6). */
+export declare function isPrivateIp(ip: string): boolean;
+/**
+ * Resolve a host and judge whether any of its addresses is private. IP literals (incl.
+ * bracketed IPv6) skip DNS. Fails closed: an unresolvable or lookup-erroring host is treated
+ * as unsafe (returns true), so the caller refuses rather than throwing.
+ */
+export declare function hostResolvesPrivate(host: string): Promise<boolean>;
+export type Refusal = "host-mismatch" | "private-ip" | "redirect-escape";
+export type Resolution = {
+    ok: true;
+    addresses: string[];
+} | {
+    ok: false;
+    refused: Refusal;
+};
+/**
+ * Resolve a request/redirect target to the validated public addresses the connection
+ * must pin to, or a refusal. The target must be the registered host (an off-host initial
+ * request is "host-mismatch", an off-host redirect is "redirect-escape"); the resolved set
+ * must be non-empty and every address public, else "private-ip". IP literals (incl.
+ * bracketed IPv6) skip DNS. Fails closed: a lookup error or empty result is a refusal.
+ *
+ * This is the single DNS lookup for a call. The caller pins the socket to the returned
+ * addresses so `fetch` performs no second, independent lookup — closing the window where
+ * a host could answer public here and private to the connect-time lookup.
+ */
+export declare function resolveTarget(targetHost: string, registeredHost: string, kind: "request" | "redirect"): Promise<Resolution>;
+//# sourceMappingURL=ssrf.d.ts.map

package/payload/platform/plugins/connector/mcp/dist/lib/ssrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf.d.ts","sourceRoot":"","sources":["../../src/lib/ssrf.ts"],"names":[],"mappings":"AAwBA,sFAAsF;AACtF,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAqB/C;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAWxE;AAED,MAAM,MAAM,OAAO,GAAG,eAAe,GAAG,YAAY,GAAG,iBAAiB,CAAC;AAEzE,MAAM,MAAM,UAAU,GAClB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,GACjC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC;AAEpC;;;;;;;;;;GAUG;AACH,wBAAsB,aAAa,CACjC,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,SAAS,GAAG,UAAU,GAC3B,OAAO,CAAC,UAAU,CAAC,CAmBrB"}

package/payload/platform/plugins/connector/mcp/dist/lib/ssrf.js

@@ -0,0 +1,112 @@
+import { lookup } from "node:dns/promises";
+import { isIP } from "node:net";
+/** Strip the `[ ]` that URL.hostname keeps around an IPv6 literal, and a trailing FQDN dot. */
+function normalizeHost(host) {
+    let s = host.toLowerCase();
+    if (s.startsWith("[") && s.endsWith("]"))
+        s = s.slice(1, -1);
+    if (s.endsWith("."))
+        s = s.slice(0, -1);
+    return s;
+}
+/** True for an IPv4 address in any loopback/private/link-local/CGNAT/"this-host" range. */
+function v4Private(ip) {
+    const o = ip.split(".").map((s) => Number(s));
+    if (o.length !== 4 || o.some((n) => Number.isNaN(n) || n < 0 || n > 255))
+        return false;
+    const [a, b] = o;
+    if (a === 10 || a === 127 || a === 0)
+        return true; // private, loopback, "this host"
+    if (a === 172 && b >= 16 && b <= 31)
+        return true; // private
+    if (a === 192 && b === 168)
+        return true; // private
+    if (a === 169 && b === 254)
+        return true; // link-local
+    if (a === 100 && b >= 64 && b <= 127)
+        return true; // CGNAT (100.64/10)
+    return false;
+}
+/** True for any loopback, private, link-local, or unique-local address (v4 or v6). */
+export function isPrivateIp(ip) {
+    const bare = normalizeHost(ip);
+    const fam = isIP(bare);
+    if (fam === 4)
+        return v4Private(bare);
+    if (fam === 6) {
+        const lower = bare;
+        if (lower === "::1" || lower === "::")
+            return true; // loopback, unspecified
+        const dotted = lower.match(/::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/); // IPv4-mapped, dotted
+        if (dotted)
+            return v4Private(dotted[1]);
+        const hex = lower.match(/::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/); // IPv4-mapped, hex
+        if (hex) {
+            const hi = parseInt(hex[1], 16);
+            const lo = parseInt(hex[2], 16);
+            return v4Private(`${(hi >> 8) & 255}.${hi & 255}.${(lo >> 8) & 255}.${lo & 255}`);
+        }
+        if (lower.startsWith("fc") || lower.startsWith("fd"))
+            return true; // fc00::/7 ULA
+        // fe80::/10 link-local spans fe80–febf, i.e. fe8/fe9/fea/feb prefixes.
+        if (/^fe[89ab]/.test(lower))
+            return true;
+        return false;
+    }
+    return false;
+}
+/**
+ * Resolve a host and judge whether any of its addresses is private. IP literals (incl.
+ * bracketed IPv6) skip DNS. Fails closed: an unresolvable or lookup-erroring host is treated
+ * as unsafe (returns true), so the caller refuses rather than throwing.
+ */
+export async function hostResolvesPrivate(host) {
+    const bare = normalizeHost(host);
+    if (!bare)
+        return true; // empty/malformed host can never be a safe public target
+    if (isIP(bare))
+        return isPrivateIp(bare);
+    try {
+        const addrs = await lookup(bare, { all: true });
+        if (addrs.length === 0)
+            return true;
+        return addrs.some((a) => isPrivateIp(a.address));
+    }
+    catch {
+        return true; // DNS failure → fail closed
+    }
+}
+/**
+ * Resolve a request/redirect target to the validated public addresses the connection
+ * must pin to, or a refusal. The target must be the registered host (an off-host initial
+ * request is "host-mismatch", an off-host redirect is "redirect-escape"); the resolved set
+ * must be non-empty and every address public, else "private-ip". IP literals (incl.
+ * bracketed IPv6) skip DNS. Fails closed: a lookup error or empty result is a refusal.
+ *
+ * This is the single DNS lookup for a call. The caller pins the socket to the returned
+ * addresses so `fetch` performs no second, independent lookup — closing the window where
+ * a host could answer public here and private to the connect-time lookup.
+ */
+export async function resolveTarget(targetHost, registeredHost, kind) {
+    if (normalizeHost(targetHost) !== normalizeHost(registeredHost)) {
+        return { ok: false, refused: kind === "redirect" ? "redirect-escape" : "host-mismatch" };
+    }
+    const bare = normalizeHost(targetHost);
+    if (!bare)
+        return { ok: false, refused: "private-ip" }; // empty/malformed host is never a safe target
+    if (isIP(bare)) {
+        return isPrivateIp(bare) ? { ok: false, refused: "private-ip" } : { ok: true, addresses: [bare] };
+    }
+    let addrs;
+    try {
+        addrs = await lookup(bare, { all: true });
+    }
+    catch {
+        return { ok: false, refused: "private-ip" }; // DNS failure → fail closed
+    }
+    if (addrs.length === 0 || addrs.some((a) => isPrivateIp(a.address))) {
+        return { ok: false, refused: "private-ip" };
+    }
+    return { ok: true, addresses: addrs.map((a) => a.address) };
+}
+//# sourceMappingURL=ssrf.js.map

package/payload/platform/plugins/connector/mcp/dist/lib/ssrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf.js","sourceRoot":"","sources":["../../src/lib/ssrf.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC,+FAA+F;AAC/F,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC3B,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7D,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,2FAA2F;AAC3F,SAAS,SAAS,CAAC,EAAU;IAC3B,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACvF,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IACjB,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,iCAAiC;IACpF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,CAAC,UAAU;IAC5D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,UAAU;IACnD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,aAAa;IACtD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,oBAAoB;IACvE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,WAAW,CAAC,EAAU;IACpC,MAAM,IAAI,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,GAAG,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,IAAI,CAAC;QACnB,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,CAAC,wBAAwB;QAC5E,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC,CAAC,sBAAsB;QAClG,IAAI,MAAM;YAAE,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC,CAAC,mBAAmB;QACvF,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChC,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChC,OAAO,SAAS,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,GAAG,IAAI,EAAE,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,GAAG,IAAI,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,eAAe;QAClF,uEAAuE;QACvE,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAY;IACpD,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,yDAAyD;IACjF,IAAI,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,4BAA4B;IAC3C,CAAC;AACH,CAAC;AAQD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,UAAkB,EAClB,cAAsB,EACtB,IAA4B;IAE5B,IAAI,aAAa,CAAC,UAAU,CAAC,KAAK,aAAa,CAAC,cAAc,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;IAC3F,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IACvC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,8CAA8C;IACtG,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACf,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;IACpG,CAAC;IACD,IAAI,KAA4B,CAAC;IACjC,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,4BAA4B;IAC3E,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACpE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;IAC9C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;AAC9D,CAAC"}

package/payload/platform/plugins/connector/mcp/dist/lib/store.d.ts

@@ -0,0 +1,25 @@
+export type AuthScheme = "bearer" | "api-key-header" | "basic";
+export interface ConnectorRecord {
+    baseUrl: string;
+    host: string;
+    authScheme: AuthScheme;
+    /** Required when authScheme is "api-key-header"; the header the credential is sent in. */
+    headerName?: string;
+}
+type Registry = Record<string, ConnectorRecord>;
+type Secrets = Record<string, string>;
+export declare function readRegistry(platformRoot: string, accountId: string): Registry;
+export declare function readSecrets(platformRoot: string, accountId: string): Secrets;
+export declare function registerConnector(platformRoot: string, accountId: string, name: string, rec: ConnectorRecord, secret: string): void;
+/** Remove a connector from both files. Returns whether it existed in either. */
+export declare function deregisterConnector(platformRoot: string, accountId: string, name: string): boolean;
+export declare function resolveConnector(platformRoot: string, accountId: string, name: string): {
+    rec: ConnectorRecord;
+    secret: string;
+} | null;
+export declare function listConnectors(platformRoot: string, accountId: string): {
+    name: string;
+    baseUrl: string;
+}[];
+export {};
+//# sourceMappingURL=store.d.ts.map

package/payload/platform/plugins/connector/mcp/dist/lib/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/lib/store.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,gBAAgB,GAAG,OAAO,CAAC;AAE/D,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,UAAU,CAAC;IACvB,0FAA0F;IAC1F,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,KAAK,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;AAChD,KAAK,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAyBtC,wBAAgB,YAAY,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,QAAQ,CAE9E;AAED,wBAAgB,WAAW,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAE5E;AAED,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,MAAM,GACb,IAAI,CAON;AAED,gFAAgF;AAChF,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CASlG;AAED,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX;IAAE,GAAG,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAKjD;AAED,wBAAgB,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAAE,CAK3G"}