@tangle-network/agent-integrations 0.25.4 → 0.25.5

package/dist/{chunk-IOO75SJH.js → chunk-ZEDXLDOV.js}

@@ -1,7 +1,3 @@
-import {
-  buildIntegrationToolCatalog,
-  parseIntegrationToolName
-} from "./chunk-6KWCC42J.js";
 import {
   integrationSpecToConnector,
   listIntegrationSpecs
@@ -1222,6 +1218,9 @@ async function receiveIntegrationWebhook(input) {
   if (!input.adapter.handleInboundEvent) {
     return { status: 405, body: { ok: false, error: "Connector does not support inbound webhooks." }, received: [], duplicates: [] };
   }
+  if (!input.adapter.verifySignature && !input.allowUnsignedWebhook) {
+    return { status: 401, body: { ok: false, error: "Webhook signature verification is required." }, received: [], duplicates: [] };
+  }
   const signature = input.adapter.verifySignature?.({
     rawBody: input.rawBody,
     headers: input.headers,
@@ -1305,16 +1304,28 @@ var DefaultIntegrationActionGuard = class {
   idempotency;
   audit;
   rateLimiter;
+  requireIdempotencyForMutations;
   now;
   constructor(options = {}) {
     this.idempotency = options.idempotency;
     this.audit = options.audit;
     this.rateLimiter = options.rateLimiter;
+    this.requireIdempotencyForMutations = options.requireIdempotencyForMutations ?? false;
     this.now = options.now ?? (() => /* @__PURE__ */ new Date());
   }
   async invokeAction(ctx, proceed) {
     const idempotencyKey = ctx.request.idempotencyKey;
     const requestHash = hashRequest(ctx);
+    if (this.requireIdempotencyForMutations && ctx.action?.risk !== "read" && !idempotencyKey) {
+      return {
+        ok: false,
+        action: ctx.request.action,
+        output: {
+          idempotencyRequired: true,
+          message: "State-changing integration actions require an idempotency key."
+        }
+      };
+    }
     if (idempotencyKey && this.idempotency) {
       const existing = await this.idempotency.get(idempotencyKey);
       if (existing) {
@@ -2934,6 +2945,260 @@ async function checkActivepiecesPublicCatalog(input) {
   }
 }
 
+// src/runtime.ts
+var InMemoryIntegrationGrantStore = class {
+  grants = /* @__PURE__ */ new Map();
+  get(grantId) {
+    return this.grants.get(grantId);
+  }
+  put(grant) {
+    this.grants.set(grant.id, grant);
+  }
+  listByManifest(manifestId, grantee) {
+    return [...this.grants.values()].filter(
+      (grant) => grant.manifestId === manifestId && (!grantee || sameActor(grant.grantee, grantee))
+    );
+  }
+  listByGrantee(grantee) {
+    return [...this.grants.values()].filter((grant) => sameActor(grant.grantee, grantee));
+  }
+  listByIds(grantIds) {
+    const wanted = new Set(grantIds);
+    return [...this.grants.values()].filter((grant) => wanted.has(grant.id));
+  }
+  delete(grantId) {
+    this.grants.delete(grantId);
+  }
+};
+var IntegrationRuntime = class {
+  hub;
+  grants;
+  now;
+  constructor(options) {
+    this.hub = options.hub;
+    this.grants = options.grants ?? new InMemoryIntegrationGrantStore();
+    this.now = options.now ?? (() => /* @__PURE__ */ new Date());
+  }
+  async registry() {
+    return this.hub.listRegistry();
+  }
+  async resolveManifest(manifest, owner) {
+    const registry = await this.registry();
+    const connections = await this.hub.listConnections(owner);
+    const resolutions = manifest.requirements.map(
+      (requirement) => resolveRequirement(requirement, owner, registry, connections)
+    );
+    return {
+      manifest,
+      owner,
+      ready: resolutions.filter((resolution) => resolution.status === "ready"),
+      missing: resolutions.filter((resolution) => resolution.status !== "ready" && !resolution.requirement.optional),
+      optionalMissing: resolutions.filter((resolution) => resolution.status !== "ready" && resolution.requirement.optional === true)
+    };
+  }
+  async createGrants(input) {
+    const resolution = await this.resolveManifest(input.manifest, input.owner);
+    if (resolution.missing.length > 0) {
+      throw new Error(`Cannot create integration grants; missing requirements: ${resolution.missing.map((r) => r.requirement.id).join(", ")}`);
+    }
+    const now = this.now().toISOString();
+    const grants = resolution.ready.map((ready) => ({
+      id: `grant_${input.manifest.id}_${ready.requirement.id}_${ready.connection.id}`,
+      manifestId: input.manifest.id,
+      requirementId: ready.requirement.id,
+      owner: input.owner,
+      grantee: input.grantee,
+      connectionId: ready.connection.id,
+      connectorId: ready.connector.id,
+      scopes: requiredScopes(ready.requirement, ready.connector),
+      allowedActions: requiredActions(ready.requirement, ready.connector),
+      allowedTriggers: requiredTriggers(ready.requirement, ready.connector),
+      status: "active",
+      createdAt: now,
+      updatedAt: now,
+      metadata: input.metadata
+    }));
+    for (const grant of grants) await this.grants.put(grant);
+    return grants;
+  }
+  async buildSandboxBundle(input) {
+    const grants = await this.resolveBundleGrants(input);
+    const registry = await this.registry();
+    const bindings = [];
+    const connectors = [];
+    let expiresAt = "";
+    for (const grant of grants) {
+      const connection = await this.hub.getConnection(grant.connectionId);
+      if (!connection) {
+        throw new Error(`Cannot build integration bundle; connection ${grant.connectionId} not found.`);
+      }
+      if (!sameActor(connection.owner, input.owner)) {
+        throw new Error(`Cannot build integration bundle; connection ${connection.id} belongs to a different owner.`);
+      }
+      if (connection.status !== "active") {
+        throw new Error(`Cannot build integration bundle; connection ${connection.id} is ${connection.status}.`);
+      }
+      const entry = registry.byId.get(grant.connectorId);
+      if (!entry) continue;
+      const connector = {
+        ...entry.connector,
+        actions: entry.connector.actions.filter((action) => grant.allowedActions.includes(action.id)),
+        triggers: entry.connector.triggers?.filter((trigger2) => grant.allowedTriggers.includes(trigger2.id)),
+        scopes: entry.connector.scopes.filter((scope) => grant.scopes.includes(scope))
+      };
+      const capability = await this.hub.issueCapability({
+        subject: input.subject,
+        connectionId: grant.connectionId,
+        scopes: grant.scopes,
+        allowedActions: grant.allowedActions,
+        ttlMs: input.ttlMs,
+        metadata: {
+          manifestId: grant.manifestId,
+          grantId: grant.id,
+          requirementId: grant.requirementId
+        }
+      });
+      bindings.push({
+        requirementId: grant.requirementId,
+        connectorId: grant.connectorId,
+        connectionId: grant.connectionId,
+        grantId: grant.id,
+        scopes: grant.scopes,
+        allowedActions: grant.allowedActions,
+        allowedTriggers: grant.allowedTriggers,
+        capability
+      });
+      connectors.push(connector);
+      expiresAt = capability.capability.expiresAt;
+    }
+    return {
+      manifestId: input.manifestId ?? grants[0]?.manifestId ?? "explicit-grants",
+      subject: input.subject,
+      capabilities: bindings,
+      connectors,
+      tools: buildIntegrationToolCatalog(connectors),
+      expiresAt
+    };
+  }
+  async resolveBundleGrants(input) {
+    if (input.grantIds?.length) {
+      const uniqueGrantIds = unique5(input.grantIds);
+      const grants = this.grants.listByIds ? await this.grants.listByIds(uniqueGrantIds) : await Promise.all(uniqueGrantIds.map((grantId) => this.grants.get(grantId)));
+      const found = grants.filter((grant) => Boolean(grant));
+      const foundIds = new Set(found.map((grant) => grant.id));
+      const missing2 = uniqueGrantIds.filter((grantId) => !foundIds.has(grantId));
+      if (missing2.length > 0) {
+        throw new Error(`Cannot build integration bundle; unknown grant id(s): ${missing2.join(", ")}`);
+      }
+      const badOwner = found.find((grant) => !sameActor(grant.owner, input.owner));
+      if (badOwner) {
+        throw new Error(`Cannot build integration bundle; grant ${badOwner.id} belongs to a different owner.`);
+      }
+      const badGrantee = input.grantee ? found.find((grant) => !sameActor(grant.grantee, input.grantee)) : void 0;
+      if (badGrantee) {
+        throw new Error(`Cannot build integration bundle; grant ${badGrantee.id} belongs to a different grantee.`);
+      }
+      const badManifest = input.manifestId ? found.find((grant) => grant.manifestId !== input.manifestId) : void 0;
+      if (badManifest) {
+        throw new Error(`Cannot build integration bundle; grant ${badManifest.id} is not for manifest ${input.manifestId}.`);
+      }
+      const inactive = found.find((grant) => grant.status !== "active");
+      if (inactive) {
+        throw new Error(`Cannot build integration bundle; grant ${inactive.id} is ${inactive.status}.`);
+      }
+      return found;
+    }
+    if (!input.manifestId) {
+      throw new Error("Cannot build integration bundle; manifestId or grantIds is required.");
+    }
+    return (await this.grants.listByManifest(input.manifestId, input.grantee)).filter((grant) => sameActor(grant.owner, input.owner)).filter((grant) => grant.status === "active");
+  }
+};
+function createIntegrationRuntime(options) {
+  return new IntegrationRuntime(options);
+}
+function resolveRequirement(requirement, owner, registry, connections) {
+  const entry = registry.byId.get(requirement.connectorId);
+  if (!entry) {
+    return missing(requirement, "unknown_connector", `Unknown connector ${requirement.connectorId}.`);
+  }
+  const connector = entry.connector;
+  if (connector.actions.length === 0 && (connector.triggers?.length ?? 0) === 0) {
+    return missing(requirement, "not_executable", `${connector.title} is catalog-only and cannot be invoked yet.`, connector, entry);
+  }
+  const scopes = requiredScopes(requirement, connector);
+  const actions = requiredActions(requirement, connector);
+  const triggers = requiredTriggers(requirement, connector);
+  const connection = connections.find(
+    (candidate) => sameActor(candidate.owner, owner) && candidate.status === "active" && (candidate.connectorId === connector.id || entry.aliases.includes(candidate.connectorId)) && scopes.every((scope) => candidate.grantedScopes.includes(scope))
+  );
+  if (!connection) {
+    return {
+      requirement,
+      status: "missing_connection",
+      connector,
+      registryEntry: entry,
+      missingScopes: scopes,
+      missingActions: actions,
+      missingTriggers: triggers,
+      message: `${connector.title} needs an active user connection with the required scopes.`
+    };
+  }
+  return {
+    requirement,
+    status: "ready",
+    connector,
+    registryEntry: entry,
+    connection,
+    missingScopes: [],
+    missingActions: [],
+    missingTriggers: [],
+    message: `${connector.title} is ready.`
+  };
+}
+function missing(requirement, status, message, connector, registryEntry2) {
+  return {
+    requirement,
+    status,
+    connector,
+    registryEntry: registryEntry2,
+    missingScopes: [],
+    missingActions: [],
+    missingTriggers: [],
+    message
+  };
+}
+function requiredActions(requirement, connector) {
+  if (requirement.mode === "trigger") return [];
+  if (requirement.requiredActions?.length) return unique5(requirement.requiredActions);
+  const actions = connector.actions.filter((action) => {
+    if (requirement.mode === "read") return action.risk === "read";
+    if (requirement.mode === "write") return action.risk === "write";
+    return false;
+  });
+  return unique5(actions.map((action) => action.id));
+}
+function requiredTriggers(requirement, connector) {
+  if (requirement.requiredTriggers?.length) return unique5(requirement.requiredTriggers);
+  if (requirement.mode !== "trigger") return [];
+  return unique5((connector.triggers ?? []).map((trigger2) => trigger2.id));
+}
+function requiredScopes(requirement, connector) {
+  if (requirement.requiredScopes?.length) return unique5(requirement.requiredScopes);
+  const actionIds = new Set(requiredActions(requirement, connector));
+  const triggerIds = new Set(requiredTriggers(requirement, connector));
+  return unique5([
+    ...connector.actions.filter((action) => actionIds.has(action.id)).flatMap((action) => action.requiredScopes),
+    ...(connector.triggers ?? []).filter((trigger2) => triggerIds.has(trigger2.id)).flatMap((trigger2) => trigger2.requiredScopes)
+  ]);
+}
+function sameActor(a, b) {
+  return a.type === b.type && a.id === b.id;
+}
+function unique5(values) {
+  return [...new Set(values)];
+}
+
 // src/workflow.ts
 var InMemoryIntegrationWorkflowStore = class {
   workflows = /* @__PURE__ */ new Map();
@@ -2950,7 +3215,7 @@ var InMemoryIntegrationWorkflowStore = class {
     return [...this.workflows.values()].filter((workflow) => workflow.workflowId === workflowId);
   }
   listByOwner(owner) {
-    return [...this.workflows.values()].filter((workflow) => sameActor(workflow.owner, owner));
+    return [...this.workflows.values()].filter((workflow) => sameActor2(workflow.owner, owner));
   }
 };
 var IntegrationWorkflowRuntime = class {
@@ -3012,7 +3277,7 @@ function findTriggerGrant(grants, requirementId, triggerId) {
   if (!grant) throw new Error(`Missing trigger grant ${requirementId}/${triggerId}.`);
   return grant;
 }
-function sameActor(a, b) {
+function sameActor2(a, b) {
   return a.type === b.type && a.id === b.id;
 }
 
@@ -3091,6 +3356,9 @@ var IntegrationHub = class {
   async listConnections(owner) {
     return this.store.listByOwner(owner);
   }
+  async getConnection(connectionId) {
+    return this.store.get(connectionId);
+  }
   async issueCapability(request) {
     const connection = await this.requireConnection(request.connectionId);
     this.assertConnectionActive(connection);
@@ -3100,8 +3368,8 @@ var IntegrationHub = class {
       id: `cap_${randomUUID5()}`,
       subject: request.subject,
       connectionId: request.connectionId,
-      scopes: unique5(request.scopes),
-      allowedActions: unique5(request.allowedActions),
+      scopes: unique6(request.scopes),
+      allowedActions: unique6(request.allowedActions),
       issuedAt: now.toISOString(),
       expiresAt: new Date(now.getTime() + request.ttlMs).toISOString(),
       metadata: request.metadata
@@ -3329,9 +3597,9 @@ async function postJson(fetcher, url, body, bearer) {
   if (!response.ok) throw new IntegrationError(`Integration provider returned HTTP ${response.status}.`, "provider_not_found");
   return response.json();
 }
-function assertScopes(connection, requiredScopes) {
-  const missing = requiredScopes.filter((scope) => !connection.grantedScopes.includes(scope));
-  if (missing.length > 0) throw new IntegrationError(`Missing integration scopes: ${missing.join(", ")}`, "scope_denied");
+function assertScopes(connection, requiredScopes2) {
+  const missing2 = requiredScopes2.filter((scope) => !connection.grantedScopes.includes(scope));
+  if (missing2.length > 0) throw new IntegrationError(`Missing integration scopes: ${missing2.join(", ")}`, "scope_denied");
 }
 function hmac(payload, secret) {
   return createHmac2("sha256", secret).update(payload).digest("base64url");
@@ -3347,7 +3615,7 @@ function base64UrlEncode(value) {
 function base64UrlDecode(value) {
   return Buffer.from(value, "base64url").toString("utf8");
 }
-function unique5(values) {
+function unique6(values) {
   return [...new Set(values)];
 }
 
@@ -3770,12 +4038,12 @@ function registryEntry(canonicalId, candidates, precedence, aliases) {
   const primary = ordered[0];
   const actions = mergeActions(ordered);
   const triggers = mergeTriggers(ordered);
-  const scopes = unique6(toolBindableCandidates(ordered).flatMap((candidate) => candidate.connector.scopes ?? []));
+  const scopes = unique7(toolBindableCandidates(ordered).flatMap((candidate) => candidate.connector.scopes ?? []));
   const supportTier = ordered.reduce(
     (best, candidate) => SUPPORT_RANK[candidate.supportTier] > SUPPORT_RANK[best] ? candidate.supportTier : best,
     primary.supportTier
   );
-  const aliasesForEntry = unique6([
+  const aliasesForEntry = unique7([
     ...ordered.map((candidate) => candidate.connector.id),
     ...Object.entries(aliases).filter(([, target]) => canonicalConnectorId(target, aliases) === canonicalId).map(([alias]) => alias)
   ].map(slug2).filter((id) => id && id !== canonicalId)).sort();
@@ -3871,9 +4139,157 @@ function isSupportTier(value) {
 function slug2(value) {
   return value.trim().toLowerCase().replace(/&/g, "and").replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
 }
-function unique6(values) {
+function unique7(values) {
+  return [...new Set(values)];
+}
+
+// src/catalog.ts
+var riskRank2 = {
+  read: 0,
+  write: 1,
+  destructive: 2
+};
+function integrationToolName(providerId, connectorId, actionId) {
+  return `int_${encodeToolPart(providerId)}_${encodeToolPart(connectorId)}_${encodeToolPart(actionId)}`;
+}
+function parseIntegrationToolName(name) {
+  const parts = name.split("_");
+  if (parts.length !== 4 || parts[0] !== "int") {
+    throw new Error(`Invalid integration tool name: ${name}`);
+  }
+  return {
+    providerId: decodeToolPart(parts[1]),
+    connectorId: decodeToolPart(parts[2]),
+    actionId: decodeToolPart(parts[3])
+  };
+}
+function buildIntegrationToolCatalog(connectors) {
+  const tools = [];
+  for (const connector of connectors) {
+    for (const action of connector.actions) {
+      const tags = unique8([
+        connector.id,
+        connector.providerId,
+        connector.title,
+        connector.category,
+        action.id,
+        action.title,
+        action.risk,
+        action.dataClass,
+        ...connector.scopes ?? [],
+        ...action.requiredScopes ?? []
+      ].flatMap(tokenize));
+      tools.push({
+        name: integrationToolName(connector.providerId, connector.id, action.id),
+        title: `${connector.title}: ${action.title}`,
+        description: action.description ?? `${action.risk} action ${action.id} on ${connector.title}`,
+        providerId: connector.providerId,
+        connectorId: connector.id,
+        connectorTitle: connector.title,
+        category: connector.category,
+        action,
+        risk: action.risk,
+        dataClass: action.dataClass,
+        requiredScopes: action.requiredScopes,
+        inputSchema: action.inputSchema,
+        outputSchema: action.outputSchema,
+        tags,
+        supportTier: toolSupportTier(connector),
+        runnable: toolRunnable(connector)
+      });
+    }
+  }
+  return tools;
+}
+function buildIntegrationCatalogView(input) {
+  const runtimeConnectors = input.executableRegistry?.connectors ?? input.discoveryRegistry.connectors.filter((connector) => toolRunnable(connector));
+  const runtimeTools = buildIntegrationToolCatalog(runtimeConnectors);
+  const discoveryTools = buildIntegrationToolCatalog(input.discoveryRegistry.connectors);
+  return {
+    connectors: input.discoveryRegistry.connectors,
+    conflicts: input.discoveryRegistry.entries.flatMap((entry) => entry.conflicts),
+    summary: summarizeIntegrationRegistry(input.discoveryRegistry),
+    tools: runtimeTools,
+    runtimeTools,
+    discoveryTools
+  };
+}
+function searchIntegrationTools(catalog, query, filters = {}) {
+  const terms = tokenize(query);
+  const filtered = catalog.filter((tool) => {
+    if (filters.providerId && tool.providerId !== filters.providerId) return false;
+    if (filters.connectorId && tool.connectorId !== filters.connectorId) return false;
+    if (filters.category && tool.category !== filters.category) return false;
+    if (filters.dataClass && tool.dataClass !== filters.dataClass) return false;
+    if (filters.maxRisk && riskRank2[tool.risk] > riskRank2[filters.maxRisk]) return false;
+    return true;
+  });
+  const scored = filtered.map((tool) => scoreTool(tool, terms));
+  return scored.filter((result) => terms.length === 0 || result.score > 0).sort((a, b) => b.score - a.score || a.tool.name.localeCompare(b.tool.name)).slice(0, filters.limit ?? 20);
+}
+function toMcpTools(tools) {
+  return tools.map((tool) => ({
+    name: tool.name,
+    description: `${tool.title}. ${tool.description}`,
+    inputSchema: tool.inputSchema ?? {
+      type: "object",
+      additionalProperties: true,
+      properties: {}
+    }
+  }));
+}
+function scoreTool(tool, terms) {
+  if (terms.length === 0) return { tool, score: 1, matched: [] };
+  const haystack = new Set(tool.tags);
+  const matched = [];
+  let score = 0;
+  for (const term of terms) {
+    if (haystack.has(term)) {
+      matched.push(term);
+      score += 4;
+      continue;
+    }
+    if (tool.tags.some((tag) => tag.includes(term))) {
+      matched.push(term);
+      score += 1;
+    }
+  }
+  if (tool.risk === "read") score += 0.25;
+  return { tool, score, matched: unique8(matched) };
+}
+function tokenize(value) {
+  return value.toLowerCase().split(/[^a-z0-9]+/g).map((part) => part.trim()).filter(Boolean);
+}
+function encodeToolPart(value) {
+  return Buffer.from(value, "utf8").toString("base64url").replace(/_/g, ".");
+}
+function decodeToolPart(value) {
+  return Buffer.from(value.replace(/\./g, "_"), "base64url").toString("utf8");
+}
+function unique8(values) {
   return [...new Set(values)];
 }
+function toolSupportTier(connector) {
+  const registry = connector.metadata?.registry;
+  if (registry && typeof registry === "object" && !Array.isArray(registry)) {
+    const supportTier2 = registry.supportTier;
+    return isIntegrationSupportTier(supportTier2) ? supportTier2 : void 0;
+  }
+  const supportTier = connector.metadata?.supportTier;
+  return isIntegrationSupportTier(supportTier) ? supportTier : void 0;
+}
+function toolRunnable(connector) {
+  const registry = connector.metadata?.registry;
+  if (registry && typeof registry === "object" && !Array.isArray(registry)) {
+    const toolBindable = registry.toolBindable;
+    if (typeof toolBindable === "boolean") return toolBindable;
+  }
+  const tier = toolSupportTier(connector);
+  return tier === "gatewayExecutable" || tier === "firstPartyExecutable" || tier === "sandboxExecutable";
+}
+function isIntegrationSupportTier(value) {
+  return value === "catalogOnly" || value === "setupReady" || value === "gatewayExecutable" || value === "firstPartyExecutable" || value === "sandboxExecutable";
+}
 
 export {
   ACTIVEPIECES_OVERRIDES,
@@ -3882,6 +4298,12 @@ export {
   buildActivepiecesConnectors,
   createCatalogExecutorProvider,
   createActivepiecesExecutorProvider,
+  integrationToolName,
+  parseIntegrationToolName,
+  buildIntegrationToolCatalog,
+  buildIntegrationCatalogView,
+  searchIntegrationTools,
+  toMcpTools,
   ACTIVEPIECES_PUBLIC_CATALOG_URL,
   extractActivepiecesPublicPieceCount,
   auditIntegrationCatalogFreshness,
@@ -3988,6 +4410,9 @@ export {
   tangleCatalogAuthValue,
   createTangleCatalogRuntimeNodeRequestListener,
   startTangleCatalogRuntimeNodeServer,
+  InMemoryIntegrationGrantStore,
+  IntegrationRuntime,
+  createIntegrationRuntime,
   InMemoryIntegrationWorkflowStore,
   IntegrationWorkflowRuntime,
   createIntegrationWorkflowRuntime,
@@ -4000,4 +4425,4 @@ export {
   signCapability,
   verifyCapabilityToken
 };
-//# sourceMappingURL=chunk-IOO75SJH.js.map
+//# sourceMappingURL=chunk-ZEDXLDOV.js.map