@slates/provider 1.0.0-rc.21 → 1.0.0-rc.23

package/src/adapter/index.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, it } from 'vitest';
 import { z } from 'zod';
 import { SlateTool } from '../action/tool';
+import { SlateTriggerGroup } from '../action/triggerGroup';
 import { SlateAuth } from '../auth';
 import { SlateConfig } from '../config';
 import { Slate } from '../specification/slate';
@@ -41,6 +42,16 @@ describe('SlateAdapterSpec', () => {
       }))
       .build();
 
+    let emailTriggerGroup = SlateTriggerGroup.create(spec, {
+      key: 'emails',
+      name: 'Emails'
+    })
+      .polling({
+        pollEvents: async () => ({ events: [] })
+      })
+      .routingMatchers(async () => [])
+      .build();
+
     let emailReceivedTrigger = gmailAdapterSpec
       .trigger(spec, {
         key: 'email_received',
@@ -48,13 +59,13 @@ describe('SlateAdapterSpec', () => {
       })
       .input(z.object({ messageId: z.string() }))
       .output(z.object({ type: z.literal('email.received') }))
-      .polling({
-        handleEvent: async ctx => ({
-          type: 'email.received',
-          id: ctx.input.messageId,
-          output: { type: 'email.received' as const }
-        })
-      })
+      .triggerGroup(emailTriggerGroup)
+      .matches(() => true)
+      .map(async ctx => ({
+        type: 'email.received',
+        id: ctx.input.messageId,
+        output: { type: 'email.received' as const }
+      }))
       .build();
 
     expect(sendEmailTool.adapter).toBe('gmail');
@@ -218,6 +229,16 @@ describe('SlateAdapterSpec', () => {
       }))
       .build();
 
+    let sendEmailTriggerGroup = SlateTriggerGroup.create(spec, {
+      key: 'sent_emails',
+      name: 'Sent Emails'
+    })
+      .polling({
+        pollEvents: async () => ({ events: [] })
+      })
+      .routingMatchers(async () => [])
+      .build();
+
     let sendEmailTrigger = gmailAdapterSpec
       .trigger(spec, {
         key: 'send_email',
@@ -225,13 +246,13 @@ describe('SlateAdapterSpec', () => {
       })
       .input(z.object({}))
       .output(z.object({ type: z.string() }))
-      .polling({
-        handleEvent: async () => ({
-          type: 'email.sent',
-          id: '1',
-          output: { type: 'email.sent' }
-        })
-      })
+      .triggerGroup(sendEmailTriggerGroup)
+      .matches(() => true)
+      .map(async () => ({
+        type: 'email.sent',
+        id: '1',
+        output: { type: 'email.sent' }
+      }))
       .build();
 
     expect(() =>

package/src/auth/redact.test.ts

@@ -49,6 +49,98 @@ describe('AuthConfigSecretRedactor', () => {
   });
 });
 
+describe('AuthConfigSecretRedactor.redactEmbedded', () => {
+  it('preserves the legacy placeholder format for whole-value matches', () => {
+    let redactor = new AuthConfigSecretRedactor({
+      token: 'ABC',
+      nested: { tokens: ['XYZ'] }
+    });
+
+    expect(redactor.redactEmbedded({ values: ['ABC', 'XYZ', 'plain', 42, null] })).toEqual({
+      values: [
+        '$$MT$secret$authConfig$token',
+        '$$MT$secret$authConfig$nested.tokens.0',
+        'plain',
+        42,
+        null
+      ]
+    });
+  });
+
+  it('terminates embedded placeholders before prefixes, suffixes, and adjacent literals', () => {
+    let redactor = new AuthConfigSecretRedactor({ token: 'ABC', token2: 'XYZ' });
+
+    expect(
+      redactor.redactEmbedded({
+        bearer: 'Bearer ABC',
+        suffix: 'ABC2',
+        multiple: 'ABC:XYZ:ABC',
+        adjacent: 'ABCXYZ'
+      })
+    ).toEqual({
+      bearer: 'Bearer $$MT$secret$authConfig$token$$',
+      suffix: '$$MT$secret$authConfig$token$$2',
+      multiple:
+        '$$MT$secret$authConfig$token$$:$$MT$secret$authConfig$token2$$:$$MT$secret$authConfig$token$$',
+      adjacent: '$$MT$secret$authConfig$token$$$$MT$secret$authConfig$token2$$'
+    });
+  });
+
+  it('matches overlapping secrets longest-first', () => {
+    let redactor = new AuthConfigSecretRedactor({ token: 'ABC', longer: 'ABC2' });
+
+    expect(redactor.redactEmbedded('ABC2 ABC')).toBe(
+      '$$MT$secret$authConfig$longer$$ $$MT$secret$authConfig$token$$'
+    );
+    expect(redactor.redactEmbedded('ABC2')).toBe('$$MT$secret$authConfig$longer');
+  });
+
+  it('does not scan emitted placeholders again', () => {
+    let redactor = new AuthConfigSecretRedactor({ token: 'ABC', other: 'token' });
+
+    expect(redactor.redactEmbedded('Bearer ABC token')).toBe(
+      'Bearer $$MT$secret$authConfig$token$$ $$MT$secret$authConfig$other$$'
+    );
+  });
+
+  it.each([
+    '.',
+    '*',
+    '+',
+    '?',
+    '^',
+    '$',
+    '{',
+    '}',
+    '(',
+    ')',
+    '|',
+    '[',
+    ']',
+    '\\'
+  ])('treats %s literally in secret values', character => {
+    let secret = `${character}secret`;
+    let redactor = new AuthConfigSecretRedactor({ token: secret });
+
+    expect(redactor.redactEmbedded(`prefix ${secret} suffix`)).toBe(
+      'prefix $$MT$secret$authConfig$token$$ suffix'
+    );
+    expect(redactor.redactEmbedded('prefix secret suffix')).toBe('prefix secret suffix');
+  });
+
+  it('ignores empty secrets and leaves unrelated values unchanged', () => {
+    let redactor = new AuthConfigSecretRedactor({ empty: '', token: 'ABC' });
+
+    expect(redactor.redactEmbedded({ empty: '', plain: 'plain', token: 'ABC' })).toEqual({
+      empty: '',
+      plain: 'plain',
+      token: '$$MT$secret$authConfig$token'
+    });
+    expect(new AuthConfigSecretRedactor({ empty: '' }).redactEmbedded('plain')).toBe('plain');
+    expect(new AuthConfigSecretRedactor(undefined).redactEmbedded('plain')).toBe('plain');
+  });
+});
+
 describe('redactUrlAttachmentSecrets', () => {
   let authConfig = { token: '123SECRET', nested: { token2: 'also_secret' } };
 
@@ -69,12 +161,40 @@ describe('redactUrlAttachmentSecrets', () => {
 
     expect(redactUrlAttachmentSecrets(attachments, authConfig)).toEqual([
       urlAttachment({
-        headers: { Authorization: 'Bearer 123SECRET' },
+        headers: { Authorization: 'Bearer $$MT$secret$authConfig$token$$' },
         query: { key: '$$MT$secret$authConfig$nested.token2' }
       })
     ]);
   });
 
+  it('only changes header and query values, preserving metadata and the original attachment', () => {
+    let attachment: SlateAttachment = {
+      mimeType: 'application/pdf',
+      attachmentHash: 'file-hash',
+      content: {
+        type: 'url',
+        url: 'https://example.com/123SECRET/file.pdf',
+        headers: { Authorization: 'Bearer 123SECRET' },
+        query: { key: 'also_secret-suffix' },
+        refreshReference: { id: 'file-1' },
+        refreshAt: '2026-09-10T00:00:00Z'
+      }
+    };
+    let original = structuredClone(attachment);
+
+    expect(redactUrlAttachmentSecrets([attachment], authConfig)).toEqual([
+      {
+        ...original,
+        content: {
+          ...original.content,
+          headers: { Authorization: 'Bearer $$MT$secret$authConfig$token$$' },
+          query: { key: '$$MT$secret$authConfig$nested.token2$$-suffix' }
+        }
+      }
+    ]);
+    expect(attachment).toEqual(original);
+  });
+
   it('leaves url attachments with no headers/query untouched', () => {
     let attachments = [urlAttachment()];
     expect(redactUrlAttachmentSecrets(attachments, authConfig)).toEqual(attachments);

package/src/auth/redact.ts

@@ -8,10 +8,9 @@ import type { SlateAttachment } from '../action/attachment';
 export let AUTH_CONFIG_SECRET_PLACEHOLDER_PREFIX = '$$MT$secret$authConfig$';
 
 /**
- * Walks an auth config object and replaces any string value that exactly matches one of its
- * leaf values with a `$$MT$secret$authConfig$<path>` placeholder. Literal, whole-value
- * substitution only -- not a substring scan, and not a heuristic key-name/value-shape guess
- * like the http trace redactor in '../axios/trace'.
+ * Maps auth-config string leaves to `$$MT$secret$authConfig$<path>` placeholders.
+ * `redact` preserves whole-value substitution for HTTP traces; `redactEmbedded` also
+ * replaces embedded values in attachment credentials, terminating those placeholders with `$$`.
  */
 export class AuthConfigSecretRedactor {
   private readonly secretToPlaceholder = new Map<string, string>();
@@ -26,6 +25,29 @@ export class AuthConfigSecretRedactor {
     });
   }
 
+  public redactEmbedded<T>(value: T): T {
+    if (this.secretToPlaceholder.size === 0) return value;
+
+    let pattern = new RegExp(
+      [...this.secretToPlaceholder.keys()]
+        .sort((a, b) => b.length - a.length)
+        // Escape regex metacharacters so values match literally; $& inserts the matched character.
+        .map(secret => secret.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'))
+        .join('|'),
+      'g'
+    );
+
+    return this.transform(value, stringValue => {
+      let exactPlaceholder = this.secretToPlaceholder.get(stringValue);
+      if (exactPlaceholder) return exactPlaceholder;
+
+      return stringValue.replace(
+        pattern,
+        secret => `${this.secretToPlaceholder.get(secret)}$$`
+      );
+    });
+  }
+
   private buildSecretMap(value: unknown, path: string[] = []): void {
     if (typeof value === 'string') {
       // Never register "" -- it would replace every empty header/query value with a placeholder.
@@ -102,9 +124,11 @@ export let redactUrlAttachmentSecrets = (
       content: {
         ...attachment.content,
         headers: attachment.content.headers
-          ? redactor.redact(attachment.content.headers)
+          ? redactor.redactEmbedded(attachment.content.headers)
           : undefined,
-        query: attachment.content.query ? redactor.redact(attachment.content.query) : undefined
+        query: attachment.content.query
+          ? redactor.redactEmbedded(attachment.content.query)
+          : undefined
       }
     };
   });

package/src/module/resolveDefaultExport.test.ts

@@ -19,9 +19,9 @@ describe('resolveDefaultExport', () => {
   });
 
   it('unwraps nested default exports from double-bundling', () => {
-    expect(
-      resolveDefaultExport<typeof Example>({ default: { default: Example } })
-    ).toBe(Example);
+    expect(resolveDefaultExport<typeof Example>({ default: { default: Example } })).toBe(
+      Example
+    );
   });
 
   it('throws when the export is not a constructor', () => {

package/src/specification/slate.test.ts

@@ -0,0 +1,102 @@
+import { describe, expect, it } from 'vitest';
+import { z } from 'zod';
+import { SlateTrigger, SlateTriggerGroup } from '../action';
+import { SlateAuth } from '../auth';
+import { SlateConfig } from '../config';
+import { Slate } from './slate';
+import { SlateSpecification } from './specification';
+
+let createTestSpec = () => {
+  let config = SlateConfig.create(z.object({}));
+  let auth = SlateAuth.create<{}>().output(z.object({}));
+
+  return SlateSpecification.create({
+    key: 'demo',
+    name: 'Demo',
+    config,
+    auth
+  });
+};
+
+let createManualWebhookTriggerGroup = (spec: ReturnType<typeof createTestSpec>, key: string) =>
+  SlateTriggerGroup.create(spec, {
+    key,
+    name: key
+  })
+    .webhook({
+      manualRegistration: {
+        userConfigSchema: z.object({}),
+        fullConfigSchema: z.object({}),
+        setup: async () => ({
+          webhookSetupDocument: '',
+          partialWebhookRegistrationPayload: {}
+        })
+      },
+      process: async () => ({ events: [] })
+    })
+    .routingMatchers(async () => [])
+    .build();
+
+let createAutoWebhookTriggerGroup = (spec: ReturnType<typeof createTestSpec>, key: string) =>
+  SlateTriggerGroup.create(spec, {
+    key,
+    name: key
+  })
+    .webhook({
+      autoRegistration: {
+        webhookTargetList: async () => ({ targets: [], nextPageToken: null }),
+        webhookRegister: async () => ({
+          webhookRegistrationIdentifier: 'reg',
+          webhookRegistrationPayload: {}
+        }),
+        webhookUnregister: async () => {}
+      },
+      process: async () => ({ events: [] })
+    })
+    .routingMatchers(async () => [])
+    .build();
+
+describe('Slate.create', () => {
+  it('rejects more than one manual webhook trigger group', () => {
+    let spec = createTestSpec();
+    let first = createManualWebhookTriggerGroup(spec, 'manual_one');
+    let second = createManualWebhookTriggerGroup(spec, 'manual_two');
+
+    expect(() =>
+      Slate.create({
+        spec,
+        tools: [],
+        triggers: [],
+        triggerGroups: [first, second]
+      })
+    ).toThrow(
+      'Only one trigger group may use manual webhook registration, but found: manual_one, manual_two'
+    );
+  });
+
+  it('allows a single manual webhook trigger group alongside other trigger groups', () => {
+    let spec = createTestSpec();
+    let manual = createManualWebhookTriggerGroup(spec, 'manual_group');
+    let auto = createAutoWebhookTriggerGroup(spec, 'auto_group');
+
+    let manualTrigger = SlateTrigger.create(spec, {
+      key: 'manual_trigger',
+      name: 'Manual Trigger'
+    })
+      .input(z.object({}))
+      .output(z.object({ type: z.literal('demo') }))
+      .triggerGroup(manual)
+      .matches(() => true)
+      .map(async () => ({ type: 'demo', id: '1', output: { type: 'demo' as const } }))
+      .build();
+
+    let slate = Slate.create({
+      spec,
+      tools: [],
+      triggers: [manualTrigger],
+      triggerGroups: [manual, auto]
+    });
+
+    expect(slate.triggerGroups.map(group => group.key)).toEqual(['manual_group', 'auto_group']);
+  });
+});

package/src/specification/slate.ts

@@ -1,4 +1,4 @@
-import type { SlateTool, SlateTrigger } from '../action';
+import type { SlateTool, SlateTrigger, SlateTriggerGroup } from '../action';
 import type { SlateAdapter } from '../adapter';
 import { SlateDeclarationError } from '../error';
 import type { SlateSpecification } from './specification';
@@ -10,7 +10,8 @@ export class Slate<ConfigType extends {}, AuthType extends {}> {
       | SlateTrigger<ConfigType, AuthType, any, any>
       | SlateTool<ConfigType, AuthType, any, any>
     )[],
-    private readonly _adapters: SlateAdapter<ConfigType, AuthType>[]
+    private readonly _adapters: SlateAdapter<ConfigType, AuthType>[],
+    private readonly _triggerGroups: SlateTriggerGroup<ConfigType, AuthType>[]
   ) {}
 
   static create<ConfigType extends {}, AuthType extends {}>(params: {
@@ -18,6 +19,7 @@ export class Slate<ConfigType extends {}, AuthType extends {}> {
     triggers: SlateTrigger<ConfigType, AuthType, any, any>[];
     tools: SlateTool<ConfigType, AuthType, any, any>[];
     adapters?: SlateAdapter<ConfigType, AuthType>[];
+    triggerGroups?: SlateTriggerGroup<ConfigType, AuthType>[];
   }) {
     let adapters = params.adapters ?? [];
     let actions = [...params.triggers, ...params.tools];
@@ -47,7 +49,29 @@ export class Slate<ConfigType extends {}, AuthType extends {}> {
       }
     }
 
-    return new Slate(params.spec, actions, adapters);
+    let triggerGroups = params.triggerGroups ?? [];
+    let seenTriggerGroupKeys = new Set<string>();
+    for (let group of triggerGroups) {
+      if (seenTriggerGroupKeys.has(group.key)) {
+        throw new SlateDeclarationError(
+          `Trigger group "${group.key}" is registered more than once`
+        );
+      }
+      seenTriggerGroupKeys.add(group.key);
+    }
+
+    let manualWebhookTriggerGroups = triggerGroups.filter(
+      group => group.source === 'webhook' && group.webhook?.manualRegistration
+    );
+    if (manualWebhookTriggerGroups.length > 1) {
+      throw new SlateDeclarationError(
+        `Only one trigger group may use manual webhook registration, but found: ${manualWebhookTriggerGroups
+          .map(group => group.key)
+          .join(', ')}`
+      );
+    }
+
+    return new Slate(params.spec, actions, adapters, triggerGroups);
   }
 
   get spec() {
@@ -61,4 +85,8 @@ export class Slate<ConfigType extends {}, AuthType extends {}> {
   get adapters() {
     return this._adapters;
   }
+
+  get triggerGroups() {
+    return this._triggerGroups;
+  }
 }

package/src/webhook/graph.ts

@@ -1,4 +1,4 @@
-import type { SlateWebhookHttpOptions, SlateWebhookHttpResponseInit } from '../action';
+import type { SlateWebhookHttpResponseInit } from '../action';
 
 export const graphWebhookHttp = {
   methods: ['POST'],
@@ -6,7 +6,7 @@ export const graphWebhookHttp = {
     mode: 'match',
     match: [{ hasQueryParam: 'validationToken' }]
   }
-} satisfies SlateWebhookHttpOptions;
+};
 
 export let getGraphWebhookValidationResponse = (
   request: Request

package/src/webhook/meta.ts

@@ -1,4 +1,4 @@
-import type { SlateWebhookHttpOptions, SlateWebhookHttpResponseInit } from '../action';
+import type { SlateWebhookHttpResponseInit } from '../action';
 
 export const metaWebhookHttp = {
   methods: ['GET', 'POST'],
@@ -6,7 +6,7 @@ export const metaWebhookHttp = {
     mode: 'match',
     match: [{ method: 'GET', hasQueryParam: 'hub.mode' }]
   }
-} satisfies SlateWebhookHttpOptions;
+};
 
 export let getMetaWebhookVerificationResponse = (
   request: Request,