@slates/provider 1.0.0-rc.17 → 1.0.0-rc.19

package/dist/index.cjs

@@ -30,8 +30,14 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  AUTH_CONFIG_SECRET_PLACEHOLDER_PREFIX: () => AUTH_CONFIG_SECRET_PLACEHOLDER_PREFIX,
+  AuthConfigSecretRedactor: () => AuthConfigSecretRedactor,
+  GET_FILE_URL_TOOL_ID: () => GET_FILE_URL_TOOL_ID,
   Slate: () => Slate,
   SlateAction: () => SlateAction,
+  SlateActionBuilder: () => SlateActionBuilder,
+  SlateAdapter: () => SlateAdapter,
+  SlateAdapterSpec: () => SlateAdapterSpec,
   SlateAuth: () => SlateAuth,
   SlateConfig: () => SlateConfig,
   SlateContext: () => SlateContext,
@@ -39,9 +45,12 @@ __export(index_exports, {
   SlateDefaultPollingIntervalSeconds: () => SlateDefaultPollingIntervalSeconds,
   SlateError: () => SlateError,
   SlateLogger: () => SlateLogger,
+  SlatePublicContext: () => SlatePublicContext,
+  SlatePublicTool: () => SlatePublicTool,
   SlateSpecification: () => SlateSpecification,
   SlateTool: () => SlateTool,
   SlateTrigger: () => SlateTrigger,
+  adapterSpec: () => adapterSpec,
   allOf: () => allOf,
   anyOf: () => anyOf,
   auth: () => auth,
@@ -62,6 +71,9 @@ __export(index_exports, {
   getApiErrorStatus: () => getApiErrorStatus,
   getBase64ByteLength: () => getBase64ByteLength,
   getCurrentContext: () => getCurrentContext,
+  getFileUrlTool: () => getFileUrlTool,
+  getFileUrlToolInputSchema: () => getFileUrlToolInputSchema,
+  getFileUrlToolOutputSchema: () => getFileUrlToolOutputSchema,
   getGraphWebhookValidationResponse: () => getGraphWebhookValidationResponse,
   getMetaWebhookVerificationResponse: () => getMetaWebhookVerificationResponse,
   getOAuthExpiresAtFromExpiresIn: () => getOAuthExpiresAtFromExpiresIn,
@@ -78,6 +90,8 @@ __export(index_exports, {
   metaWebhookHttp: () => metaWebhookHttp,
   normalizeOAuthTokenResponse: () => normalizeOAuthTokenResponse,
   pickDefined: () => pickDefined,
+  publicTool: () => publicTool,
+  redactUrlAttachmentSecrets: () => redactUrlAttachmentSecrets,
   requestAxios: () => requestAxios,
   requestAxiosData: () => requestAxiosData,
   runWithContext: () => runWithContext,
@@ -87,6 +101,7 @@ __export(index_exports, {
   statusLabelForApiError: () => statusLabelForApiError,
   tool: () => tool,
   trigger: () => trigger,
+  uploadAttachmentDirect: () => uploadAttachmentDirect,
   validateScopes: () => validateScopes,
   verifyHmacSignature: () => verifyHmacSignature
 });
@@ -148,6 +163,12 @@ var SlateAction = class {
   get docs() {
     return this._params.docs;
   }
+  get adapter() {
+    return this._params.adapter ?? null;
+  }
+  get isPublic() {
+    return this._params.isPublic === true;
+  }
 };
 
 // src/error/api.ts
@@ -892,11 +913,12 @@ var isScopes = (value) => typeof value === "object" && value !== null && "AND" i
 
 // src/action/builder.ts
 var SlateActionBuilder = class {
-  constructor(type, spec2, params, factory) {
+  constructor(type, spec2, params, factory, isPublicTool = false) {
     this.type = type;
     this.spec = spec2;
     this.params = params;
     this.factory = factory;
+    this.isPublicTool = isPublicTool;
     this.#configSchema = spec2.configSchema;
     this.#authSchema = spec2.authSchema;
   }
@@ -904,6 +926,7 @@ var SlateActionBuilder = class {
   spec;
   params;
   factory;
+  isPublicTool;
   #configSchema;
   #authSchema;
   #inputSchema = null;
@@ -912,20 +935,34 @@ var SlateActionBuilder = class {
   #authMethods;
   #toolParams = null;
   #triggerParams = null;
+  #interfaceLocked = false;
   input(schema) {
+    if (this.#interfaceLocked) {
+      throw new SlateDeclarationError("Adapter contract input schema cannot be changed");
+    }
     this.#inputSchema = schema;
     return this;
   }
   output(schema) {
+    if (this.#interfaceLocked) {
+      throw new SlateDeclarationError("Adapter contract output schema cannot be changed");
+    }
     this.#outputSchema = schema;
     return this;
   }
+  lockInterface() {
+    this.#interfaceLocked = true;
+    return this;
+  }
   scopes(scopes) {
     validateScopes(scopes);
     this.#scopes = scopes;
     return this;
   }
   authMethods(authMethods) {
+    if (this.isPublicTool) {
+      throw new SlateDeclarationError("Public tools cannot require authentication methods");
+    }
     this.#authMethods = this.validateAuthMethods(authMethods);
     return this;
   }
@@ -981,6 +1018,9 @@ var SlateActionBuilder = class {
       validateScopes(scopes);
     }
     let authMethods = this.validateAuthMethods(this.#authMethods ?? this.params.authMethods);
+    if (this.isPublicTool && authMethods) {
+      throw new SlateDeclarationError("Public tools cannot require authentication methods");
+    }
     if (!this.#inputSchema) {
       throw new SlateDeclarationError("Input schema is not defined");
     }
@@ -997,6 +1037,7 @@ var SlateActionBuilder = class {
       ...this.params,
       scopes,
       authMethods,
+      isPublic: this.isPublicTool === true,
       configSchema: this.#configSchema,
       authSchema: this.#authSchema,
       inputSchema: this.#inputSchema,
@@ -1007,6 +1048,9 @@ var SlateActionBuilder = class {
   }
 };
 
+// src/action/getFileUrlTool.ts
+var import_zod = require("zod");
+
 // src/action/tool.ts
 var SlateTool = class _SlateTool extends SlateAction {
   #handleInvocation;
@@ -1016,16 +1060,61 @@ var SlateTool = class _SlateTool extends SlateAction {
   }
   static create(spec2, params) {
     return new SlateActionBuilder("tool", spec2, params, (params2) => {
-      if (params2.type !== "tool") throw new Error("Invalid action type for tool");
-      return new _SlateTool(spec2, params2.inputSchema, params2.outputSchema, params2);
+      return _SlateTool.fromCreateParameters(spec2, params2);
     });
   }
+  static fromCreateParameters(spec2, params) {
+    if (params.type !== "tool") throw new Error("Invalid action type for tool");
+    return new _SlateTool(spec2, params.inputSchema, params.outputSchema, params);
+  }
   get handleInvocation() {
     return this.#handleInvocation;
   }
 };
 var tool = (spec2, params) => SlateTool.create(spec2, params);
 
+// src/action/getFileUrlTool.ts
+var GET_FILE_URL_TOOL_ID = "metorial$getFileUrl";
+var getFileUrlToolInputSchema = import_zod.z.object({
+  url: import_zod.z.string(),
+  reference: import_zod.z.any().nullable()
+});
+var getFileUrlToolOutputSchema = import_zod.z.object({
+  url: import_zod.z.string(),
+  expiresAt: import_zod.z.string(),
+  headers: import_zod.z.record(import_zod.z.string(), import_zod.z.string()).optional(),
+  query: import_zod.z.record(import_zod.z.string(), import_zod.z.string()).optional()
+});
+var getFileUrlTool = (spec2, handleGetFileUrl) => tool(spec2, {
+  key: GET_FILE_URL_TOOL_ID,
+  name: "Get File URL",
+  description: "Reserved: refreshes an expiring attachment download URL. Hub-internal only."
+}).input(getFileUrlToolInputSchema).output(getFileUrlToolOutputSchema).handleInvocation(async (ctx) => ({
+  output: await handleGetFileUrl(ctx),
+  message: "ok"
+})).build();
+
+// src/action/publicTool.ts
+var SlatePublicTool = class {
+  constructor() {
+  }
+  static create(spec2, params) {
+    return new SlateActionBuilder(
+      "tool",
+      spec2,
+      params,
+      (params2) => {
+        return SlateTool.fromCreateParameters(spec2, {
+          ...params2,
+          isPublic: true
+        });
+      },
+      true
+    );
+  }
+};
+var publicTool = (spec2, params) => SlatePublicTool.create(spec2, params);
+
 // src/action/trigger.ts
 var SlateDefaultPollingIntervalSeconds = 60 * 10;
 var SlateTrigger = class _SlateTrigger extends SlateAction {
@@ -1084,23 +1173,35 @@ var SlateTrigger = class _SlateTrigger extends SlateAction {
 var trigger = (spec2, params) => SlateTrigger.create(spec2, params);
 
 // src/action/attachment.ts
-var createUrlAttachment = (url, mimeType) => ({
-  mimeType,
-  content: {
-    type: "url",
-    url
+var createUrlAttachment = (url, opts = {}) => {
+  if (opts.refreshReference !== void 0 && !opts.refreshAt) {
+    throw new Error("createUrlAttachment: refreshAt is required when refreshReference is set");
   }
-});
-var createBase64Attachment = (content, mimeType) => ({
+  return {
+    mimeType: opts.mimeType,
+    attachmentHash: opts.attachmentHash,
+    content: {
+      type: "url",
+      url,
+      ...opts.headers ? { headers: opts.headers } : {},
+      ...opts.query ? { query: opts.query } : {},
+      ...opts.refreshReference !== void 0 ? { refreshReference: opts.refreshReference } : {},
+      ...opts.refreshAt ? { refreshAt: opts.refreshAt } : {}
+    }
+  };
+};
+var createBase64Attachment = (content, mimeType, attachmentHash) => ({
   mimeType,
+  attachmentHash,
   content: {
     type: "content",
     encoding: "base64",
     content
   }
 });
-var createTextAttachment = (content, mimeType) => ({
+var createTextAttachment = (content, mimeType, attachmentHash) => ({
   mimeType,
+  attachmentHash,
   content: {
     type: "content",
     encoding: "utf-8",
@@ -1108,6 +1209,173 @@ var createTextAttachment = (content, mimeType) => ({
   }
 });
 
+// src/action/directUpload.ts
+var uploadAttachmentDirect = async (d) => {
+  let baseUrl = d.live.baseUrl.replace(/\/$/, "");
+  let registerRes = await fetch(`${baseUrl}/slates-hub/live-invocation/attachments`, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      authorization: `Bearer ${d.live.token}`
+    },
+    body: JSON.stringify({
+      attachments: [{ mimeType: d.mimeType, filename: d.filename }]
+    })
+  });
+  if (!registerRes.ok) {
+    throw new Error(
+      `Failed to register attachment for direct upload (status ${registerRes.status})`
+    );
+  }
+  let { attachments } = await registerRes.json();
+  let registration = attachments[0];
+  if (!registration) {
+    throw new Error("Live invocation API returned no attachment registrations");
+  }
+  let putRes = await fetch(registration.uploadUrl, {
+    method: "PUT",
+    ...d.body instanceof Uint8Array ? {} : { duplex: "half" },
+    headers: d.mimeType ? { "content-type": d.mimeType } : void 0,
+    body: d.body
+  });
+  if (!putRes.ok) {
+    throw new Error(`Failed to upload attachment content (status ${putRes.status})`);
+  }
+  return {
+    mimeType: d.mimeType,
+    content: { type: "upload_reference", referenceId: registration.referenceId }
+  };
+};
+
+// src/adapter/adapter.ts
+var SlateAdapter = class {
+  constructor(_spec, _tools, _triggers) {
+    this._spec = _spec;
+    this._tools = _tools;
+    this._triggers = _triggers;
+  }
+  _spec;
+  _tools;
+  _triggers;
+  get spec() {
+    return this._spec;
+  }
+  get id() {
+    return this._spec.id;
+  }
+  get name() {
+    return this._spec.name;
+  }
+  get capabilities() {
+    return this._spec.capabilities;
+  }
+  get tools() {
+    return this._tools;
+  }
+  get triggers() {
+    return this._triggers;
+  }
+  get actions() {
+    return [...this._triggers, ...this._tools];
+  }
+};
+
+// src/adapter/spec.ts
+var SlateAdapterSpec = class _SlateAdapterSpec {
+  constructor(_params) {
+    this._params = _params;
+  }
+  _params;
+  static create(params) {
+    let id = params.id?.trim();
+    let name = params.name?.trim();
+    if (!id) {
+      throw new SlateDeclarationError("Adapter id must be a non-empty string");
+    }
+    if (!name) {
+      throw new SlateDeclarationError("Adapter name must be a non-empty string");
+    }
+    return new _SlateAdapterSpec({
+      id,
+      name,
+      capabilities: validateCapabilities(params.capabilities ?? [])
+    });
+  }
+  get id() {
+    return this._params.id;
+  }
+  get name() {
+    return this._params.name;
+  }
+  get capabilities() {
+    return this._params.capabilities;
+  }
+  get parameters() {
+    return this._params;
+  }
+  tool(spec2, params) {
+    return SlateTool.create(spec2, this.linkAction(params));
+  }
+  publicTool(spec2, params) {
+    return SlatePublicTool.create(spec2, this.linkAction(params));
+  }
+  trigger(spec2, params) {
+    return SlateTrigger.create(spec2, this.linkAction(params));
+  }
+  register(params) {
+    let actions = [...params.tools, ...params.triggers];
+    let seenKeys = /* @__PURE__ */ new Set();
+    for (let action of actions) {
+      if (action.adapter && action.adapter !== this.id) {
+        throw new SlateDeclarationError(
+          `Action "${action.key}" is linked to adapter "${action.adapter}", not "${this.id}"`
+        );
+      }
+      if (!action.adapter) {
+        throw new SlateDeclarationError(
+          `Action "${action.key}" must be created with this adapter's tool(), publicTool(), or trigger() helpers`
+        );
+      }
+      if (seenKeys.has(action.key)) {
+        throw new SlateDeclarationError(
+          `Adapter "${this.id}" already has an action with key "${action.key}"`
+        );
+      }
+      seenKeys.add(action.key);
+    }
+    return new SlateAdapter(this, params.tools, params.triggers);
+  }
+  linkAction(params) {
+    if (params.adapter != null && params.adapter !== this.id) {
+      throw new SlateDeclarationError(
+        `Action "${params.key}" cannot be linked to adapter "${this.id}" because it is already linked to "${params.adapter}"`
+      );
+    }
+    return {
+      ...params,
+      adapter: this.id
+    };
+  }
+};
+var adapterSpec = (params) => SlateAdapterSpec.create(params);
+var validateCapabilities = (capabilities) => {
+  let seenIds = /* @__PURE__ */ new Set();
+  return capabilities.map((capability) => {
+    let id = capability.id?.trim();
+    if (!id) {
+      throw new SlateDeclarationError("Adapter capability ids must be non-empty strings");
+    }
+    if (seenIds.has(id)) {
+      throw new SlateDeclarationError(`Adapter capability "${id}" is defined more than once`);
+    }
+    seenIds.add(id);
+    return {
+      id,
+      value: capability.value
+    };
+  });
+};
+
 // src/auth/auth.ts
 var SlateAuth = class _SlateAuth {
   #outputSchema = null;
@@ -1249,6 +1517,76 @@ var normalizeOAuthTokenResponse = (data, options = {}) => {
   };
 };
 
+// src/auth/redact.ts
+var AUTH_CONFIG_SECRET_PLACEHOLDER_PREFIX = "$$MT$secret$authConfig$";
+var AuthConfigSecretRedactor = class {
+  secretToPlaceholder = /* @__PURE__ */ new Map();
+  constructor(authConfig) {
+    if (authConfig) this.buildSecretMap(authConfig);
+  }
+  redact(value) {
+    return this.transform(value, (stringValue) => {
+      return this.secretToPlaceholder.get(stringValue) ?? stringValue;
+    });
+  }
+  buildSecretMap(value, path = []) {
+    if (typeof value === "string") {
+      if (value.length === 0) return;
+      this.secretToPlaceholder.set(
+        value,
+        `${AUTH_CONFIG_SECRET_PLACEHOLDER_PREFIX}${path.join(".")}`
+      );
+      return;
+    }
+    if (Array.isArray(value)) {
+      value.forEach((item, index) => {
+        this.buildSecretMap(item, [...path, String(index)]);
+      });
+      return;
+    }
+    if (this.isPlainObject(value)) {
+      Object.entries(value).forEach(([key, nestedValue]) => {
+        this.buildSecretMap(nestedValue, [...path, key]);
+      });
+    }
+  }
+  transform(value, transformString) {
+    if (typeof value === "string") {
+      return transformString(value);
+    }
+    if (Array.isArray(value)) {
+      return value.map((item) => this.transform(item, transformString));
+    }
+    if (this.isPlainObject(value)) {
+      let result = {};
+      Object.entries(value).forEach(([key, nestedValue]) => {
+        result[key] = this.transform(nestedValue, transformString);
+      });
+      return result;
+    }
+    return value;
+  }
+  isPlainObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+  }
+};
+var redactUrlAttachmentSecrets = (attachments, authConfig) => {
+  if (!authConfig || !attachments) return attachments;
+  let redactor = new AuthConfigSecretRedactor(authConfig);
+  return attachments.map((attachment) => {
+    if (attachment.content.type !== "url") return attachment;
+    if (!attachment.content.headers && !attachment.content.query) return attachment;
+    return {
+      ...attachment,
+      content: {
+        ...attachment.content,
+        headers: attachment.content.headers ? redactor.redact(attachment.content.headers) : void 0,
+        query: attachment.content.query ? redactor.redact(attachment.content.query) : void 0
+      }
+    };
+  });
+};
+
 // src/axios/index.ts
 var import_axios3 = __toESM(require("axios"), 1);
 
@@ -1527,9 +1865,9 @@ var truncateText = (text) => {
     truncated: true
   };
 };
-var sanitizeFreeText = (text) => {
+var sanitizeFreeText = (text, redactor) => {
   if (!text) return text;
-  let result = text;
+  let result = redactor ? redactor.redact(text) : text;
   result = result.replace(
     HTTP_AUTH_SCHEME_PATTERN,
     (_match, scheme) => `${scheme} ${REDACTED_VALUE}`
@@ -1547,21 +1885,21 @@ var sanitizeFreeText = (text) => {
   );
   return result;
 };
-var sanitizeScalar = (value) => truncateText(sanitizeFreeText(value));
-var redactStructuredValue = (value, depth = 0) => {
+var sanitizeScalar = (value, redactor) => truncateText(sanitizeFreeText(value, redactor));
+var redactStructuredValue = (value, depth = 0, redactor) => {
   if (value == null) return value;
   if (depth >= STRUCTURED_DEPTH_LIMIT) return "[truncated]";
   if (typeof value === "string" || typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
-    return typeof value === "string" ? sanitizeFreeText(value) : value;
+    return typeof value === "string" ? sanitizeFreeText(value, redactor) : value;
   }
   if (Array.isArray(value)) {
-    return value.slice(0, STRUCTURED_ENTRY_LIMIT).map((entry) => redactStructuredValue(entry, depth + 1));
+    return value.slice(0, STRUCTURED_ENTRY_LIMIT).map((entry) => redactStructuredValue(entry, depth + 1, redactor));
   }
   if (isRecord2(value)) {
     return Object.fromEntries(
       Object.entries(value).slice(0, STRUCTURED_ENTRY_LIMIT).map(([key, entry]) => [
         key,
-        isSecretKeyName(key) ? REDACTED_VALUE : redactStructuredValue(entry, depth + 1)
+        isSecretKeyName(key) ? REDACTED_VALUE : redactStructuredValue(entry, depth + 1, redactor)
       ])
     );
   }
@@ -1579,11 +1917,11 @@ var maybeParseJson = (text, contentType) => {
     return null;
   }
 };
-var sanitizeTextBody = (text, contentType) => {
+var sanitizeTextBody = (text, contentType, redactor) => {
   if (!text) return void 0;
   let normalizedContentType = normalizeContentType(contentType);
   let parsedJson = maybeParseJson(text, normalizedContentType);
-  let normalizedText = parsedJson !== null ? JSON.stringify(redactStructuredValue(parsedJson)) : sanitizeFreeText(text);
+  let normalizedText = parsedJson !== null ? JSON.stringify(redactStructuredValue(parsedJson, 0, redactor)) : sanitizeFreeText(text, redactor);
   let { text: truncatedText, truncated } = truncateText(normalizedText);
   return {
     ...normalizedContentType ? { contentType: normalizedContentType } : {},
@@ -1599,22 +1937,26 @@ var isBinaryLike = (value) => {
   if (typeof FormData !== "undefined" && value instanceof FormData) return true;
   return false;
 };
-var serializeTextBody = (value, contentType) => {
+var serializeTextBody = (value, contentType, redactor) => {
   let normalizedContentType = normalizeContentType(contentType);
   if (value == null || isBinaryLike(value) || !isTextContentType(normalizedContentType)) {
     return void 0;
   }
   if (typeof value === "string") {
-    return sanitizeTextBody(value, normalizedContentType);
+    return sanitizeTextBody(value, normalizedContentType, redactor);
   }
   if (value instanceof URLSearchParams) {
-    return sanitizeTextBody(value.toString(), normalizedContentType);
+    return sanitizeTextBody(value.toString(), normalizedContentType, redactor);
   }
   if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
-    return sanitizeTextBody(String(value), normalizedContentType);
+    return sanitizeTextBody(String(value), normalizedContentType, redactor);
   }
   if (Array.isArray(value) || isRecord2(value)) {
-    return sanitizeTextBody(JSON.stringify(redactStructuredValue(value)), "application/json");
+    return sanitizeTextBody(
+      JSON.stringify(redactStructuredValue(value, 0, redactor)),
+      "application/json",
+      redactor
+    );
   }
   return void 0;
 };
@@ -1629,16 +1971,20 @@ var buildUrl = (baseURL, url) => {
 };
 var REDACTED_ENCODED = encodeURIComponent(REDACTED_VALUE);
 var decodeRedactedMarker = (value) => REDACTED_ENCODED === REDACTED_VALUE ? value : value.split(REDACTED_ENCODED).join(REDACTED_VALUE);
-var redactHashFragment = (hash) => {
+var redactHashFragment = (hash, redactor) => {
   if (!hash?.includes("=")) return hash;
   let withoutHash = hash.startsWith("#") ? hash.slice(1) : hash;
   let redacted = withoutHash.replace(
     /(?<![A-Za-z0-9])([A-Za-z0-9][A-Za-z0-9_\-.]*)=([^&]*)/g,
-    (match, key, _rawValue) => isUrlFormSecretKeyName(key) ? `${key}=${REDACTED_VALUE}` : match
+    (match, key, rawValue) => {
+      if (isUrlFormSecretKeyName(key)) return `${key}=${REDACTED_VALUE}`;
+      let literalRedacted = redactor ? redactor.redact(rawValue) : rawValue;
+      return literalRedacted !== rawValue ? `${key}=${literalRedacted}` : match;
+    }
   );
   return redacted ? `#${redacted}` : "";
 };
-var sanitizeUrl = (value) => {
+var sanitizeUrl = (value, redactor) => {
   if (!value) return value;
   try {
     let url = new URL(value);
@@ -1649,12 +1995,17 @@ var sanitizeUrl = (value) => {
     for (let key of Array.from(url.searchParams.keys())) {
       if (isUrlFormSecretKeyName(key)) {
         url.searchParams.set(key, REDACTED_VALUE);
+        continue;
       }
+      let rawValue = url.searchParams.get(key) ?? "";
+      let literalRedacted = redactor ? redactor.redact(rawValue) : rawValue;
+      if (literalRedacted !== rawValue) url.searchParams.set(key, literalRedacted);
     }
-    url.hash = redactHashFragment(url.hash);
+    url.hash = redactHashFragment(url.hash, redactor);
     return decodeRedactedMarker(url.toString());
   } catch {
-    return value.replace(
+    let text = redactor ? redactor.redact(value) : value;
+    return text.replace(
       /([?&]([^=&#]+)=)([^&#]+)/g,
       (_match, prefix, key, rawValue) => isUrlFormSecretKeyName(key) ? `${prefix}${REDACTED_VALUE}` : `${prefix}${rawValue}`
     );
@@ -1693,8 +2044,10 @@ var headerEntries = (headers) => {
   }
   return [];
 };
-var sanitizeHeaders = (headers) => {
-  let entries = headerEntries(headers).map(([key, value]) => [key.toLowerCase(), sanitizeScalar(value).text]).filter(([key]) => isSafeHeaderName(key));
+var sanitizeHeaders = (headers, redactor) => {
+  let entries = headerEntries(headers).map(
+    ([key, value]) => [key.toLowerCase(), sanitizeScalar(value, redactor).text]
+  ).filter(([key]) => isSafeHeaderName(key));
   if (entries.length === 0) return void 0;
   return Object.fromEntries(entries);
 };
@@ -1720,15 +2073,16 @@ var clearTraceDraft = (config2, draft) => {
 var attachHttpTraceDraft = (config2, context) => {
   let traceAwareConfig = config2;
   let contentType = getContentType(config2.headers);
+  let redactor = new AuthConfigSecretRedactor(context._getAuthConfigForRedaction());
   traceAwareConfig.__slatesHttpTraceDraft = {
     context,
     startedAt: (/* @__PURE__ */ new Date()).toISOString(),
     startedAtMs: Date.now(),
     request: {
       method: (config2.method ?? "GET").toUpperCase(),
-      url: sanitizeUrl(buildUrl(config2.baseURL, config2.url)),
-      ...sanitizeHeaders(config2.headers) ? { headers: sanitizeHeaders(config2.headers) } : {},
-      ...serializeTextBody(config2.data, contentType) ? { body: serializeTextBody(config2.data, contentType) } : {}
+      url: sanitizeUrl(buildUrl(config2.baseURL, config2.url), redactor),
+      ...sanitizeHeaders(config2.headers, redactor) ? { headers: sanitizeHeaders(config2.headers, redactor) } : {},
+      ...serializeTextBody(config2.data, contentType, redactor) ? { body: serializeTextBody(config2.data, contentType, redactor) } : {}
     }
   };
   if (isObjectLike(traceAwareConfig)) {
@@ -1747,6 +2101,7 @@ var recordHttpTraceFromResponse = (response) => {
   let draft = takeTraceDraft(config2);
   if (!draft) return response;
   clearTraceDraft(config2, draft);
+  let redactor = new AuthConfigSecretRedactor(draft.context._getAuthConfigForRedaction());
   let contentType = getContentType(response.headers);
   draft.context.recordHttpTrace({
     startedAt: draft.startedAt,
@@ -1755,8 +2110,8 @@ var recordHttpTraceFromResponse = (response) => {
     response: {
       status: response.status,
       ...response.statusText ? { statusText: response.statusText } : {},
-      ...sanitizeHeaders(response.headers) ? { headers: sanitizeHeaders(response.headers) } : {},
-      ...serializeTextBody(response.data, contentType) ? { body: serializeTextBody(response.data, contentType) } : {}
+      ...sanitizeHeaders(response.headers, redactor) ? { headers: sanitizeHeaders(response.headers, redactor) } : {},
+      ...serializeTextBody(response.data, contentType, redactor) ? { body: serializeTextBody(response.data, contentType, redactor) } : {}
     }
   });
   return response;
@@ -1766,6 +2121,7 @@ var recordHttpTraceFromError = (error) => {
   let draft = takeTraceDraft(config2);
   if (!draft) return;
   clearTraceDraft(config2, draft);
+  let redactor = new AuthConfigSecretRedactor(draft.context._getAuthConfigForRedaction());
   let responseContentType = getContentType(error.response?.headers);
   draft.context.recordHttpTrace({
     startedAt: draft.startedAt,
@@ -1775,8 +2131,8 @@ var recordHttpTraceFromError = (error) => {
       response: {
         status: error.response.status,
         ...error.response.statusText ? { statusText: error.response.statusText } : {},
-        ...sanitizeHeaders(error.response.headers) ? { headers: sanitizeHeaders(error.response.headers) } : {},
-        ...serializeTextBody(error.response.data, responseContentType) ? { body: serializeTextBody(error.response.data, responseContentType) } : {}
+        ...sanitizeHeaders(error.response.headers, redactor) ? { headers: sanitizeHeaders(error.response.headers, redactor) } : {},
+        ...serializeTextBody(error.response.data, responseContentType, redactor) ? { body: serializeTextBody(error.response.data, responseContentType, redactor) } : {}
       }
     } : {},
     error: {
@@ -1907,26 +2263,42 @@ var SlateConfig = class _SlateConfig {
 var config = (schema) => SlateConfig.create(schema);
 
 // src/context/context.ts
-var SlateContext = class {
-  constructor(config2, input, auth2, spec2, logger) {
+var import_node_stream = require("stream");
+var import_p_queue = __toESM(require("p-queue"), 1);
+var isBufferLike = (value) => value instanceof Uint8Array || value instanceof ArrayBuffer;
+var toUint8Array = (value) => value instanceof ArrayBuffer ? new Uint8Array(value) : value;
+var isReadableStream = (value) => typeof ReadableStream !== "undefined" && value instanceof ReadableStream;
+var isNodeReadable = (value) => !!value && typeof value === "object" && typeof value.pipe === "function" && typeof value.on === "function";
+var isResponseLike = (value) => typeof Response !== "undefined" && value instanceof Response;
+var readStreamToBuffer = async (stream) => {
+  let reader = stream.getReader();
+  let chunks = [];
+  while (true) {
+    let { done, value } = await reader.read();
+    if (done) break;
+    if (value) chunks.push(value);
+  }
+  return Buffer.concat(chunks);
+};
+var SlatePublicContext = class {
+  constructor(input, spec2, logger, liveInvocation = null) {
     this.spec = spec2;
     this.logger = logger;
-    this.#config = config2;
     this.#input = input;
-    this.#auth = auth2;
+    this.#liveInvocation = liveInvocation;
   }
   spec;
   logger;
-  #config;
   #input;
-  #auth;
   #httpTraces = [];
+  #liveInvocation;
+  #attachmentsDisabled = false;
+  #attachments = [];
+  #pendingUploads = [];
+  #uploadQueue = new import_p_queue.default({ concurrency: 10 });
   get specification() {
     return this.spec;
   }
-  get config() {
-    return Object.freeze(this.#config);
-  }
   get input() {
     return Object.freeze(this.#input);
   }
@@ -1944,9 +2316,6 @@ var SlateContext = class {
       this.#input.registrationDetails
     );
   }
-  get auth() {
-    return Object.freeze(this.#auth);
-  }
   recordHttpTrace(trace) {
     this.#httpTraces.push(trace);
   }
@@ -1980,6 +2349,107 @@ var SlateContext = class {
   progress(message) {
     this.logger.progress(message);
   }
+  async addAttachment(input) {
+    if (input.type === "url") {
+      this.#attachments.push(
+        createUrlAttachment(input.url.toString(), {
+          mimeType: input.mimeType,
+          headers: input.headers,
+          query: input.query,
+          refreshReference: input.refreshReference,
+          refreshAt: input.refreshAt
+        })
+      );
+      return;
+    }
+    let content = input.content;
+    if (isBufferLike(content)) {
+      let bytes = toUint8Array(content);
+      this.#attachments.push(
+        createBase64Attachment(Buffer.from(bytes).toString("base64"), input.mimeType)
+      );
+      return;
+    }
+    let normalized = await this.#normalizeStreamInput(content, {
+      mimeType: input.mimeType,
+      filename: input.filename
+    });
+    if (!normalized) return;
+    if (!this.#liveInvocation || this.#attachmentsDisabled) {
+      let buffer = await readStreamToBuffer(normalized.stream);
+      this.#attachments.push(
+        createBase64Attachment(buffer.toString("base64"), normalized.mimeType)
+      );
+      return;
+    }
+    let live = this.#liveInvocation;
+    let task = this.#uploadQueue.add(
+      () => uploadAttachmentDirect({
+        live,
+        mimeType: normalized.mimeType,
+        filename: normalized.filename,
+        body: normalized.stream
+      })
+    ).then((attachment) => {
+      this.#attachments.push(attachment);
+    }).catch((err) => {
+      this.#attachmentsDisabled = true;
+      this.warn({
+        message: `Attachment dropped: direct upload failed (${err instanceof Error ? err.message : String(err)}).`
+      });
+    });
+    this.#pendingUploads.push(task);
+  }
+  async #normalizeStreamInput(input, opts) {
+    if (isResponseLike(input)) {
+      if (!input.body) {
+        this.warn({ message: "Attachment dropped: response has no body." });
+        return null;
+      }
+      return {
+        stream: input.body,
+        mimeType: opts.mimeType ?? input.headers.get("content-type") ?? void 0,
+        filename: opts.filename
+      };
+    }
+    if (isReadableStream(input)) {
+      return { stream: input, mimeType: opts.mimeType, filename: opts.filename };
+    }
+    if (isNodeReadable(input)) {
+      return {
+        stream: import_node_stream.Readable.toWeb(input),
+        mimeType: opts.mimeType,
+        filename: opts.filename
+      };
+    }
+    this.warn({ message: "Attachment dropped: unsupported attachment input type." });
+    return null;
+  }
+  async _finalizeAttachments() {
+    await Promise.allSettled(this.#pendingUploads);
+    return this.#attachments;
+  }
+  _getAuthConfigForRedaction() {
+    return void 0;
+  }
+};
+var SlateContext = class extends SlatePublicContext {
+  #config;
+  #auth;
+  constructor(config2, input, auth2, spec2, logger, liveInvocation = null) {
+    super(input, spec2, logger, liveInvocation);
+    this.#config = config2;
+    this.#auth = auth2;
+  }
+  get config() {
+    return Object.freeze(this.#config);
+  }
+  get auth() {
+    return Object.freeze(this.#auth);
+  }
+  _getAuthConfigForRedaction() {
+    return this.#auth;
+  }
 };
 
 // src/crypto/hmac.ts
@@ -2129,14 +2599,40 @@ var setIfDefined = (target, key, value) => {
 
 // src/specification/slate.ts
 var Slate = class _Slate {
-  constructor(_spec, _actions) {
+  constructor(_spec, _actions, _adapters) {
     this._spec = _spec;
     this._actions = _actions;
+    this._adapters = _adapters;
   }
   _spec;
   _actions;
+  _adapters;
   static create(params) {
-    return new _Slate(params.spec, [...params.triggers, ...params.tools]);
+    let adapters = params.adapters ?? [];
+    let actions = [...params.triggers, ...params.tools];
+    let seenAdapterIds = /* @__PURE__ */ new Set();
+    let seenActionKeys = new Map(actions.map((action) => [action.key, action]));
+    for (let adapter of adapters) {
+      if (seenAdapterIds.has(adapter.id)) {
+        throw new SlateDeclarationError(
+          `Adapter "${adapter.id}" is registered more than once`
+        );
+      }
+      seenAdapterIds.add(adapter.id);
+      for (let action of adapter.actions) {
+        let existing = seenActionKeys.get(action.key);
+        if (existing && existing !== action) {
+          throw new SlateDeclarationError(
+            `Adapter "${adapter.id}" action "${action.key}" conflicts with another action`
+          );
+        }
+        if (!existing) {
+          actions.push(action);
+          seenActionKeys.set(action.key, action);
+        }
+      }
+    }
+    return new _Slate(params.spec, actions, adapters);
   }
   get spec() {
     return this._spec;
@@ -2144,10 +2640,13 @@ var Slate = class _Slate {
   get actions() {
     return this._actions;
   }
+  get adapters() {
+    return this._adapters;
+  }
 };
 
 // src/specification/specification.ts
-var import_zod = __toESM(require("zod"), 1);
+var import_zod2 = __toESM(require("zod"), 1);
 var SlateSpecification = class _SlateSpecification {
   constructor(_config, _auth, _params) {
     this._config = _config;
@@ -2164,7 +2663,7 @@ var SlateSpecification = class _SlateSpecification {
     return this._config.configSchema;
   }
   get authSchema() {
-    return "outputSchema" in this._auth ? this._auth.outputSchema : import_zod.default.object({});
+    return "outputSchema" in this._auth ? this._auth.outputSchema : import_zod2.default.object({});
   }
   get config() {
     return this._config;
@@ -2244,8 +2743,14 @@ var getMetaWebhookVerificationResponse = (request, expectedVerifyToken) => {
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  AUTH_CONFIG_SECRET_PLACEHOLDER_PREFIX,
+  AuthConfigSecretRedactor,
+  GET_FILE_URL_TOOL_ID,
   Slate,
   SlateAction,
+  SlateActionBuilder,
+  SlateAdapter,
+  SlateAdapterSpec,
   SlateAuth,
   SlateConfig,
   SlateContext,
@@ -2253,9 +2758,12 @@ var getMetaWebhookVerificationResponse = (request, expectedVerifyToken) => {
   SlateDefaultPollingIntervalSeconds,
   SlateError,
   SlateLogger,
+  SlatePublicContext,
+  SlatePublicTool,
   SlateSpecification,
   SlateTool,
   SlateTrigger,
+  adapterSpec,
   allOf,
   anyOf,
   auth,
@@ -2276,6 +2784,9 @@ var getMetaWebhookVerificationResponse = (request, expectedVerifyToken) => {
   getApiErrorStatus,
   getBase64ByteLength,
   getCurrentContext,
+  getFileUrlTool,
+  getFileUrlToolInputSchema,
+  getFileUrlToolOutputSchema,
   getGraphWebhookValidationResponse,
   getMetaWebhookVerificationResponse,
   getOAuthExpiresAtFromExpiresIn,
@@ -2292,6 +2803,8 @@ var getMetaWebhookVerificationResponse = (request, expectedVerifyToken) => {
   metaWebhookHttp,
   normalizeOAuthTokenResponse,
   pickDefined,
+  publicTool,
+  redactUrlAttachmentSecrets,
   requestAxios,
   requestAxiosData,
   runWithContext,
@@ -2301,6 +2814,7 @@ var getMetaWebhookVerificationResponse = (request, expectedVerifyToken) => {
   statusLabelForApiError,
   tool,
   trigger,
+  uploadAttachmentDirect,
   validateScopes,
   verifyHmacSignature
 });