@tangle-network/agent-integrations 0.25.7 → 0.27.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (46) hide show
  1. package/README.md +11 -2
  2. package/dist/bin/tangle-catalog-runtime.js +6 -2
  3. package/dist/bin/tangle-catalog-runtime.js.map +1 -1
  4. package/dist/catalog.d.ts +4 -1
  5. package/dist/catalog.js +6 -2
  6. package/dist/chunk-2TW2QKGZ.js +94 -0
  7. package/dist/chunk-2TW2QKGZ.js.map +1 -0
  8. package/dist/chunk-ATYHZXLL.js +457 -0
  9. package/dist/chunk-ATYHZXLL.js.map +1 -0
  10. package/dist/{chunk-A5I3EYU5.js → chunk-ICSBYCE2.js} +122 -1
  11. package/dist/chunk-ICSBYCE2.js.map +1 -0
  12. package/dist/{chunk-WC63AI4Q.js → chunk-JU25UDN2.js} +1252 -225
  13. package/dist/chunk-JU25UDN2.js.map +1 -0
  14. package/dist/chunk-P24T3MLM.js +106 -0
  15. package/dist/chunk-P24T3MLM.js.map +1 -0
  16. package/dist/chunk-SVQ4PHDZ.js +129 -0
  17. package/dist/chunk-SVQ4PHDZ.js.map +1 -0
  18. package/dist/connect/index.d.ts +112 -0
  19. package/dist/connect/index.js +14 -0
  20. package/dist/connect/index.js.map +1 -0
  21. package/dist/connectors/adapters/index.d.ts +593 -1
  22. package/dist/connectors/adapters/index.js +22 -1
  23. package/dist/connectors/index.d.ts +2 -1
  24. package/dist/connectors/index.js +32 -10
  25. package/dist/index.d.ts +5 -2
  26. package/dist/index.js +57 -11
  27. package/dist/middleware/index.d.ts +137 -0
  28. package/dist/middleware/index.js +14 -0
  29. package/dist/middleware/index.js.map +1 -0
  30. package/dist/registry.d.ts +165 -2
  31. package/dist/registry.js +6 -2
  32. package/dist/runtime.d.ts +4 -1
  33. package/dist/runtime.js +6 -2
  34. package/dist/specs.d.ts +4 -1
  35. package/dist/tangle-catalog-runtime.d.ts +4 -1
  36. package/dist/tangle-catalog-runtime.js +6 -2
  37. package/dist/tangle-id-CTU4kGId.d.ts +553 -0
  38. package/dist/webhooks/index.d.ts +193 -0
  39. package/dist/webhooks/index.js +285 -0
  40. package/dist/webhooks/index.js.map +1 -0
  41. package/examples/discover-capabilities.ts +46 -0
  42. package/examples/webhook-router.ts +56 -0
  43. package/package.json +25 -12
  44. package/dist/chunk-A5I3EYU5.js.map +0 -1
  45. package/dist/chunk-WC63AI4Q.js.map +0 -1
  46. package/dist/index-BQY5ry2s.d.ts +0 -808
@@ -1,25 +1,22 @@
1
1
  import "../chunk-376UBTNB.js";
2
2
  import {
3
- CredentialsExpired,
4
- DEFAULT_SIGNATURE_TOLERANCE_SECONDS,
5
3
  InMemoryOAuthFlowStore,
6
- ResourceContention,
7
4
  _resetPendingFlowsForTests,
8
5
  airtableConnector,
9
6
  asanaConnector,
10
- assertValidConnectorManifest,
11
7
  consumePendingFlow,
12
8
  declarativeRestConnector,
9
+ docuseal,
13
10
  exchangeAuthorizationCode,
14
- firstHeader,
15
11
  githubConnector,
16
12
  gitlabConnector,
13
+ gmail,
17
14
  googleCalendar,
15
+ googleDrive,
18
16
  googleSheets,
19
17
  hubspot,
20
18
  microsoftCalendar,
21
19
  notionDatabase,
22
- parseStripeSignatureHeader,
23
20
  refreshAccessToken,
24
21
  salesforceConnector,
25
22
  slack,
@@ -28,29 +25,53 @@ import {
28
25
  stripePackConnector,
29
26
  stripeWebhookReceiverConnector,
30
27
  twilioSmsConnector,
31
- validateConnectorManifest,
28
+ webhookConnector
29
+ } from "../chunk-JU25UDN2.js";
30
+ import {
31
+ DEFAULT_SIGNATURE_TOLERANCE_SECONDS,
32
+ firstHeader,
33
+ parseStripeSignatureHeader,
32
34
  verifyHmacSignature,
33
35
  verifySlackSignature,
34
36
  verifyStripeSignature,
35
- verifyTwilioSignature,
36
- webhookConnector
37
- } from "../chunk-WC63AI4Q.js";
37
+ verifyTwilioSignature
38
+ } from "../chunk-2TW2QKGZ.js";
39
+ import {
40
+ CredentialsExpired,
41
+ DEFAULT_TANGLE_PLATFORM_URL,
42
+ ResourceContention,
43
+ TANGLE_API_KEY_PREFIX,
44
+ TANGLE_SERVICE_TOKEN_PREFIX,
45
+ TangleIdentityUnreachableError,
46
+ assertValidConnectorManifest,
47
+ createTangleIdentityClient,
48
+ tangleIdentity,
49
+ validateConnectorManifest
50
+ } from "../chunk-ATYHZXLL.js";
38
51
  export {
39
52
  CredentialsExpired,
40
53
  DEFAULT_SIGNATURE_TOLERANCE_SECONDS,
54
+ DEFAULT_TANGLE_PLATFORM_URL,
41
55
  InMemoryOAuthFlowStore,
42
56
  ResourceContention,
57
+ TANGLE_API_KEY_PREFIX,
58
+ TANGLE_SERVICE_TOKEN_PREFIX,
59
+ TangleIdentityUnreachableError,
43
60
  _resetPendingFlowsForTests,
44
61
  airtableConnector,
45
62
  asanaConnector,
46
63
  assertValidConnectorManifest,
47
64
  consumePendingFlow,
65
+ createTangleIdentityClient,
48
66
  declarativeRestConnector,
67
+ docuseal,
49
68
  exchangeAuthorizationCode,
50
69
  firstHeader,
51
70
  githubConnector,
52
71
  gitlabConnector,
72
+ gmail,
53
73
  googleCalendar,
74
+ googleDrive,
54
75
  googleSheets,
55
76
  hubspot,
56
77
  microsoftCalendar,
@@ -63,6 +84,7 @@ export {
63
84
  startOAuthFlow,
64
85
  stripePackConnector,
65
86
  stripeWebhookReceiverConnector,
87
+ tangleIdentity,
66
88
  twilioSmsConnector,
67
89
  validateConnectorManifest,
68
90
  verifyHmacSignature,
package/dist/index.d.ts CHANGED
@@ -1,4 +1,7 @@
1
- export { aB as ACTIVEPIECES_OVERRIDES, aC as ACTIVEPIECES_PUBLIC_CATALOG_URL, aD as ACTIVEPIECES_RUNTIME_SIGNATURE_HEADER, aE as ActivepiecesCatalogAuthField, aF as ActivepiecesCatalogEntry, aG as ActivepiecesExecutorInvocation, aH as ActivepiecesExecutorProviderOptions, aI as ActivepiecesHttpExecutorOptions, aJ as ActivepiecesPieceOverride, aK as ActivepiecesRuntimeRequest, U as ApiKeyAuthSpec, aL as ApprovalBackedPolicyEngine, aM as ApprovalBackedPolicyOptions, aN as CANONICAL_INTEGRATION_ACTIONS, aO as CanonicalIntegrationActionId, aP as CanonicalLaunchConnectorOptions, aQ as CatalogExecutorInvocation, aR as CatalogExecutorProviderOptions, aS as CompleteAuthRequest, ComposeIntegrationRegistryOptions, aT as ConnectionCredentialResolverOptions, aU as ConnectorAdapterProviderOptions, aV as ConsentSummary, V as ConsoleStep, W as CredentialFieldSpec, X as CredentialValidationInput, Y as CredentialValidationResult, Z as CustomAuthSpec, aW as DEFAULT_INTEGRATION_BRIDGE_ENV, aX as DefaultIntegrationActionGuard, aY as GatewayCatalogAction, aZ as GatewayCatalogEntry, a_ as GatewayCatalogProviderOptions, a$ as GatewayCatalogTrigger, b0 as GraphqlOperationSpec, _ as HealthcheckPlan, $ as HealthcheckSpec, a0 as HmacAuthSpec, b1 as HttpIntegrationProviderOptions, a1 as INTEGRATION_FAMILIES, b2 as ImportCatalogOptions, b3 as InMemoryConnectionStore, b4 as InMemoryIntegrationApprovalStore, b5 as InMemoryIntegrationAuditStore, b6 as InMemoryIntegrationEventStore, f as InMemoryIntegrationGrantStore, b7 as InMemoryIntegrationHealthcheckStore, b8 as InMemoryIntegrationIdempotencyStore, b9 as InMemoryIntegrationSecretStore, ba as InMemoryIntegrationWorkflowStore, bb as InferIntegrationRequirementsOptions, bc as InstalledIntegrationWorkflow, bd as IntegrationActionGuard, be as IntegrationActionPack, bf as IntegrationActionRequest, bg as IntegrationActionResult, bh as IntegrationActionRisk, bi as IntegrationActor, bj as IntegrationApprovalFilter, bk as IntegrationApprovalRecord, bl as IntegrationApprovalRequest, bm as IntegrationApprovalResolution, bn as IntegrationApprovalStatus, bo as IntegrationApprovalStore, bp as IntegrationAuditEvent, bq as IntegrationAuditEventType, br as IntegrationAuditFilter, bs as IntegrationAuditSink, bt as IntegrationAuditStore, a2 as IntegrationAuthMode, a3 as IntegrationAuthSpec, bu as IntegrationBridgePayload, bv as IntegrationBridgeToolBinding, bw as IntegrationCapability, g as IntegrationCapabilityBinding, bx as IntegrationCatalogFreshnessOptions, by as IntegrationCatalogFreshnessResult, IntegrationCatalogSource, I as IntegrationCatalogView, bz as IntegrationConnection, bA as IntegrationConnectionStore, bB as IntegrationConnector, bC as IntegrationConnectorAction, bD as IntegrationConnectorCategory, bE as IntegrationConnectorTrigger, bF as IntegrationCoveragePriority, bG as IntegrationCoverageSpec, bH as IntegrationDataClass, bI as IntegrationError, bJ as IntegrationErrorCode, bK as IntegrationEventStore, a4 as IntegrationFamilyId, a5 as IntegrationFamilySpec, h as IntegrationGrant, j as IntegrationGrantStore, bL as IntegrationGuardContext, bM as IntegrationHealthcheckCheck, bN as IntegrationHealthcheckResult, bO as IntegrationHealthcheckStatus, bP as IntegrationHealthcheckStore, bQ as IntegrationHub, bR as IntegrationHubOptions, bS as IntegrationIdempotencyRecord, bT as IntegrationIdempotencyStore, bU as IntegrationInvocationEnvelope, bV as IntegrationInvocationEnvelopeValidationOptions, a6 as IntegrationLifecycleSpec, k as IntegrationManifest, l as IntegrationManifestResolution, a7 as IntegrationPlannerHints, bW as IntegrationPolicyDecision, bX as IntegrationPolicyEffect, bY as IntegrationPolicyEngine, bZ as IntegrationPolicyRule, b_ as IntegrationProvider, b$ as IntegrationProviderKind, c0 as IntegrationRateLimitDecision, c1 as IntegrationRateLimiter, IntegrationRegistry, IntegrationRegistryConflict, IntegrationRegistryEntry, IntegrationRegistrySourceRef, IntegrationRegistrySummary, m as IntegrationRequirement, n as IntegrationRequirementMode, o as IntegrationRequirementResolution, q as IntegrationRequirementStatus, r as IntegrationRuntime, c2 as IntegrationRuntimeError, u as IntegrationRuntimeHub, v as IntegrationRuntimeOptions, w as IntegrationSandboxBundle, c3 as IntegrationSandboxHost, c4 as IntegrationSandboxHostHub, c5 as IntegrationSandboxHostOptions, c6 as IntegrationSecretStore, a8 as IntegrationSetupSpec, a9 as IntegrationSpec, aa as IntegrationSpecStatus, ab as IntegrationSpecValidationIssue, ac as IntegrationSpecValidationResult, IntegrationSupportTier, a as IntegrationToolDefinition, b as IntegrationToolSearchFilters, c as IntegrationToolSearchResult, c7 as IntegrationTriggerEvent, c8 as IntegrationTriggerSubscription, c9 as IntegrationUserAction, ca as IntegrationWebhookReceiverResult, cb as IntegrationWorkflowDefinition, cc as IntegrationWorkflowRuntime, cd as IntegrationWorkflowRuntimeHub, ce as IntegrationWorkflowRuntimeOptions, cf as IntegrationWorkflowStore, cg as InvokeWithCapabilityRequest, ch as IssueCapabilityRequest, ci as IssuedIntegrationCapability, cj as ManifestValidationIssue, ck as ManifestValidationResult, cl as McpCatalog, cm as McpCatalogTool, M as McpToolDefinition, cn as MissingRequirementExplanation, ad as NoneAuthSpec, co as NormalizedIntegrationError, cp as NormalizedIntegrationResult, ae as NormalizedPermission, af as OAuth2AuthSpec, cq as OpenApiDocument, cr as OpenApiOperation, cs as PROVIDER_PASSTHROUGH_ACTION, ag as PermissionDescriptor, ct as PlatformIntegrationPolicyPresetOptions, ah as PostSetupCheck, cu as ProviderHttpRequestInput, cv as ProviderPassthroughPolicy, ai as Quirk, cw as RenderConsentOptions, aj as RenderSpecOptions, ak as RenderedConsoleStep, al as ScopeDescriptor, cx as SecretRef, cy as StartAuthRequest, cz as StartAuthResult, cA as StartedTangleCatalogRuntimeNodeServer, cB as StaticIntegrationPolicyEngine, cC as StaticIntegrationPolicyOptions, cD as StoredIntegrationEvent, T as TANGLE_CATALOG_RUNTIME_SIGNATURE_HEADER, cE as TANGLE_INTEGRATIONS_CATALOG_PROVIDER_ID, cF as TANGLE_INTEGRATIONS_CATALOG_SOURCE, y as TangleCatalogAuthResolverOptions, cG as TangleCatalogExecutorInvocation, cH as TangleCatalogExecutorProviderOptions, z as TangleCatalogHttpAuthResolverOptions, A as TangleCatalogHttpAuthResolverRequest, cI as TangleCatalogHttpExecutorInvocation, cJ as TangleCatalogHttpExecutorOptions, B as TangleCatalogInstalledPackageExecutorOptions, cK as TangleCatalogRuntimeActionRequest, C as TangleCatalogRuntimeHandlerOptions, D as TangleCatalogRuntimeHttpRequest, E as TangleCatalogRuntimeHttpResponse, F as TangleCatalogRuntimeInvocation, G as TangleCatalogRuntimeModuleAction, cL as TangleCatalogRuntimeNodeServerOptions, H as TangleCatalogRuntimePackageCoverageOptions, J as TangleCatalogRuntimePackageCoverageRow, cM as TangleCatalogRuntimePackageManifest, cN as TangleCatalogRuntimePackageManifestOptions, cO as TangleCatalogRuntimePiece, cP as TangleCatalogRuntimeRequest, cQ as TangleCatalogTriggerInvocation, cR as TangleIntegrationCatalogEntry, cS as TangleIntegrationCatalogFreshnessOptions, cT as TangleIntegrationCatalogFreshnessResult, cU as TangleIntegrationContract, cV as TangleIntegrationContractStatus, cW as TangleIntegrationImplementationKind, cX as TangleIntegrationInvokeInput, cY as TangleIntegrationInvokeResult, cZ as TangleIntegrationsClient, c_ as TangleIntegrationsClientOptions, c$ as adapterManifestsToConnectors, d0 as assertValidIntegrationManifest, am as assertValidIntegrationSpec, d1 as auditIntegrationCatalogFreshness, K as auditTangleCatalogRuntimePackages, d2 as auditTangleIntegrationCatalogFreshness, d3 as buildActivepiecesConnectors, d4 as buildActivepiecesRuntimeRequest, d5 as buildApprovalRequest, d6 as buildCanonicalLaunchConnectors, buildDefaultIntegrationRegistry, an as buildHealthcheckPlan, d7 as buildIntegrationBridgeEnvironment, d8 as buildIntegrationBridgePayload, d as buildIntegrationCatalogView, d9 as buildIntegrationCoverageConnectors, da as buildIntegrationInvocationEnvelope, e as buildIntegrationToolCatalog, db as buildTangleCatalogRuntimePackageManifest, dc as buildTangleCatalogRuntimeRequest, dd as buildTangleIntegrationCatalogConnectors, de as calendarExercisePlannerManifest, df as canonicalActionConnectorId, canonicalConnectorId, composeIntegrationRegistry, ao as consoleStepsToText, dg as createActivepiecesExecutorProvider, dh as createActivepiecesHttpExecutor, di as createApprovalBackedPolicyEngine, dj as createAuditingActionGuard, dk as createCatalogExecutorProvider, dl as createConnectionCredentialResolver, dm as createConnectorAdapterCatalogSource, dn as createConnectorAdapterProvider, dp as createCredentialBackedAdapterProvider, dq as createDefaultIntegrationActionGuard, dr as createDefaultIntegrationPolicyEngine, ds as createGatewayCatalogProvider, dt as createHttpIntegrationProvider, du as createIntegrationAuditEvent, x as createIntegrationRuntime, dv as createIntegrationWorkflowRuntime, dw as createMockIntegrationProvider, dx as createPlatformIntegrationPolicyPreset, L as createTangleCatalogCredentialAuthResolver, dy as createTangleCatalogExecutorProvider, N as createTangleCatalogHttpAuthResolver, dz as createTangleCatalogHttpExecutor, O as createTangleCatalogInstalledPackageExecutor, P as createTangleCatalogRuntimeHandler, dA as createTangleCatalogRuntimeNodeRequestListener, dB as createTangleIntegrationsClient, dC as decodeIntegrationBridgePayload, dD as dispatchIntegrationInvocation, dE as encodeIntegrationBridgePayload, dF as explainMissingRequirements, dG as extractActivepiecesPublicPieceCount, dH as extractExternalCatalogPublicCount, dI as getActivepiecesOverride, ap as getIntegrationFamily, aq as getIntegrationSpec, dJ as healthcheckRequest, dK as importGraphqlConnector, dL as importMcpConnector, dM as importOpenApiConnector, dN as inferIntegrationManifestFromTools, inferIntegrationSupportTier, dO as integrationCoverageChecklistMarkdown, ar as integrationSpecToConnector, i as integrationToolName, dP as invocationRequestFromEnvelope, dQ as listActivepiecesCatalogEntries, as as listExecutableIntegrationSpecs, dR as listIntegrationCoverageSpecs, at as listIntegrationSpecs, dS as listTangleIntegrationCatalogEntries, dT as listTangleIntegrationCatalogRuntimePackages, dU as listTangleIntegrationContracts, dV as manifestToConnector, dW as normalizeGatewayCatalog, dX as normalizeIntegrationError, dY as normalizeIntegrationResult, dZ as parseIntegrationBridgeEnvironment, p as parseIntegrationToolName, d_ as receiveIntegrationWebhook, d$ as redactApprovalRequest, e0 as redactCapability, e1 as redactIntegrationBridgePayload, e2 as redactInvocationEnvelope, au as renderAgentToolDescription, e3 as renderApprovalCopy, e4 as renderConsentSummary, av as renderConsoleSteps, aw as renderRunbookMarkdown, e5 as renderTangleCatalogRuntimePnpmAddCommand, e6 as resolveConnectionCredentials, e7 as resolveIntegrationApproval, e8 as revokeConnection, e9 as runIntegrationHealthcheck, ea as runIntegrationHealthchecks, eb as sanitizeAuditConnection, ec as sanitizeConnection, s as searchIntegrationTools, ed as signActivepiecesRuntimeRequest, ee as signCapability, Q as signTangleCatalogRuntimeRequest, ax as specAuthToConnectorAuth, ef as startTangleCatalogRuntimeNodeServer, eg as statusForCode, eh as storedEventToTriggerEvent, summarizeIntegrationRegistry, R as tangleCatalogAuthValue, t as toMcpTools, ay as validateCredentialFormat, az as validateCredentialSet, ei as validateIntegrationInvocationEnvelope, ej as validateIntegrationManifest, aA as validateIntegrationSpec, ek as validateProviderPassthroughRequest, el as verifyActivepiecesRuntimeSignature, em as verifyCapabilityToken, S as verifyTangleCatalogRuntimeSignature } from './registry.js';
2
- export { A as AuthSpec, b as CASStrategy, c as Capability, d as CapabilityClass, e as CapabilityMutation, f as CapabilityMutationResult, g as CapabilityParameterSchema, h as CapabilityRead, i as CapabilityReadResult, C as ConnectorAdapter, a as ConnectorCredentials, j as ConnectorInvocation, k as ConnectorManifest, l as ConnectorManifestValidationIssue, m as ConnectorManifestValidationResult, n as ConsistencyModel, o as CredentialsExpired, D as DataSourceMetadata, E as EventHandlerResult, G as GoogleCalendarOptions, p as GoogleSheetsOptions, H as HubSpotOptions, I as InboundEvent, M as MicrosoftCalendarOptions, N as NotionDatabaseOptions, q as RateLimitSpec, R as ResolvedDataSource, r as ResourceContention, s as RestConnectorSpec, t as RestCredentialPlacement, u as RestOperationSpec, v as RestRequestSpec, S as SlackOptions, w as airtableConnector, x as asanaConnector, y as assertValidConnectorManifest, z as declarativeRestConnector, B as githubConnector, F as gitlabConnector, J as googleCalendar, K as googleSheets, L as hubspot, O as microsoftCalendar, P as notionDatabase, Q as salesforceConnector, T as slack, U as slackEventsConnector, V as stripePackConnector, W as stripeWebhookReceiverConnector, X as twilioSmsConnector, Y as validateConnectorManifest, Z as webhookConnector } from './index-BQY5ry2s.js';
1
+ export { aB as ACTIVEPIECES_OVERRIDES, aC as ACTIVEPIECES_PUBLIC_CATALOG_URL, aD as ACTIVEPIECES_RUNTIME_SIGNATURE_HEADER, aE as ActivepiecesCatalogAuthField, aF as ActivepiecesCatalogEntry, aG as ActivepiecesExecutorInvocation, aH as ActivepiecesExecutorProviderOptions, aI as ActivepiecesHttpExecutorOptions, aJ as ActivepiecesPieceOverride, aK as ActivepiecesRuntimeRequest, U as ApiKeyAuthSpec, aL as ApprovalBackedPolicyEngine, aM as ApprovalBackedPolicyOptions, aN as CANONICAL_INTEGRATION_ACTIONS, aO as CanonicalIntegrationActionId, aP as CanonicalLaunchConnectorOptions, aQ as CatalogExecutorInvocation, aR as CatalogExecutorProviderOptions, aS as CompleteAuthRequest, ComposeIntegrationRegistryOptions, aT as ConnectionCredentialResolverOptions, aU as ConnectorAdapterProviderOptions, aV as ConsentSummary, V as ConsoleStep, W as CredentialFieldSpec, X as CredentialValidationInput, Y as CredentialValidationResult, Z as CustomAuthSpec, aW as DEFAULT_INTEGRATION_BRIDGE_ENV, aX as DefaultIntegrationActionGuard, aY as DiscoverWorkspaceCapabilitiesInput, aZ as GatewayCatalogAction, a_ as GatewayCatalogEntry, a$ as GatewayCatalogProviderOptions, b0 as GatewayCatalogTrigger, b1 as GraphqlOperationSpec, _ as HealthcheckPlan, $ as HealthcheckSpec, a0 as HmacAuthSpec, b2 as HttpIntegrationProviderOptions, a1 as INTEGRATION_FAMILIES, b3 as ImportCatalogOptions, b4 as InMemoryConnectionStore, b5 as InMemoryIntegrationApprovalStore, b6 as InMemoryIntegrationAuditStore, b7 as InMemoryIntegrationEventStore, f as InMemoryIntegrationGrantStore, b8 as InMemoryIntegrationHealthcheckStore, b9 as InMemoryIntegrationIdempotencyStore, ba as InMemoryIntegrationSecretStore, bb as InMemoryIntegrationWorkflowStore, bc as InferIntegrationRequirementsOptions, bd as InstalledIntegrationWorkflow, be as IntegrationActionGuard, bf as IntegrationActionPack, bg as IntegrationActionRequest, bh as IntegrationActionResult, bi as IntegrationActionRisk, bj as IntegrationActor, bk as IntegrationApprovalFilter, bl as IntegrationApprovalRecord, bm as IntegrationApprovalRequest, bn as IntegrationApprovalResolution, bo as IntegrationApprovalStatus, bp as IntegrationApprovalStore, bq as IntegrationAuditEvent, br as IntegrationAuditEventType, bs as IntegrationAuditFilter, bt as IntegrationAuditSink, bu as IntegrationAuditStore, a2 as IntegrationAuthMode, a3 as IntegrationAuthSpec, bv as IntegrationBridgePayload, bw as IntegrationBridgeToolBinding, bx as IntegrationCapability, g as IntegrationCapabilityBinding, by as IntegrationCatalogFreshnessOptions, bz as IntegrationCatalogFreshnessResult, IntegrationCatalogSource, I as IntegrationCatalogView, bA as IntegrationConnection, bB as IntegrationConnectionStore, bC as IntegrationConnector, bD as IntegrationConnectorAction, bE as IntegrationConnectorCategory, bF as IntegrationConnectorTrigger, bG as IntegrationCoveragePriority, bH as IntegrationCoverageSpec, bI as IntegrationDataClass, bJ as IntegrationError, bK as IntegrationErrorCode, bL as IntegrationEventStore, a4 as IntegrationFamilyId, a5 as IntegrationFamilySpec, h as IntegrationGrant, j as IntegrationGrantStore, bM as IntegrationGuardContext, bN as IntegrationHealthcheckCheck, bO as IntegrationHealthcheckResult, bP as IntegrationHealthcheckStatus, bQ as IntegrationHealthcheckStore, bR as IntegrationHub, bS as IntegrationHubOptions, bT as IntegrationIdempotencyRecord, bU as IntegrationIdempotencyStore, bV as IntegrationInvocationEnvelope, bW as IntegrationInvocationEnvelopeValidationOptions, a6 as IntegrationLifecycleSpec, k as IntegrationManifest, l as IntegrationManifestResolution, a7 as IntegrationPlannerHints, bX as IntegrationPolicyDecision, bY as IntegrationPolicyEffect, bZ as IntegrationPolicyEngine, b_ as IntegrationPolicyRule, b$ as IntegrationProvider, c0 as IntegrationProviderKind, c1 as IntegrationRateLimitDecision, c2 as IntegrationRateLimiter, IntegrationRegistry, IntegrationRegistryConflict, IntegrationRegistryEntry, IntegrationRegistrySourceRef, IntegrationRegistrySummary, m as IntegrationRequirement, n as IntegrationRequirementMode, o as IntegrationRequirementResolution, q as IntegrationRequirementStatus, r as IntegrationRuntime, c3 as IntegrationRuntimeError, u as IntegrationRuntimeHub, v as IntegrationRuntimeOptions, w as IntegrationSandboxBundle, c4 as IntegrationSandboxHost, c5 as IntegrationSandboxHostHub, c6 as IntegrationSandboxHostOptions, c7 as IntegrationSecretStore, a8 as IntegrationSetupSpec, a9 as IntegrationSpec, aa as IntegrationSpecStatus, ab as IntegrationSpecValidationIssue, ac as IntegrationSpecValidationResult, IntegrationSupportTier, a as IntegrationToolDefinition, b as IntegrationToolSearchFilters, c as IntegrationToolSearchResult, c8 as IntegrationTriggerEvent, c9 as IntegrationTriggerSubscription, ca as IntegrationUserAction, cb as IntegrationWebhookReceiverResult, cc as IntegrationWorkflowDefinition, cd as IntegrationWorkflowRuntime, ce as IntegrationWorkflowRuntimeHub, cf as IntegrationWorkflowRuntimeOptions, cg as IntegrationWorkflowStore, ch as InvokeWithCapabilityRequest, ci as IssueCapabilityRequest, cj as IssuedIntegrationCapability, ck as ManifestValidationIssue, cl as ManifestValidationResult, cm as McpCatalog, cn as McpCatalogTool, M as McpToolDefinition, co as MissingRequirementExplanation, ad as NoneAuthSpec, cp as NormalizedIntegrationError, cq as NormalizedIntegrationResult, ae as NormalizedPermission, af as OAuth2AuthSpec, cr as OpenApiDocument, cs as OpenApiOperation, ct as PROVIDER_PASSTHROUGH_ACTION, ag as PermissionDescriptor, cu as PlatformIntegrationPolicyPresetOptions, ah as PostSetupCheck, cv as ProviderHttpRequestInput, cw as ProviderPassthroughPolicy, ai as Quirk, cx as RenderConsentOptions, aj as RenderSpecOptions, ak as RenderedConsoleStep, al as ScopeDescriptor, cy as SecretRef, cz as StartAuthRequest, cA as StartAuthResult, cB as StartedTangleCatalogRuntimeNodeServer, cC as StaticIntegrationPolicyEngine, cD as StaticIntegrationPolicyOptions, cE as StoredIntegrationEvent, T as TANGLE_CATALOG_RUNTIME_SIGNATURE_HEADER, cF as TANGLE_INTEGRATIONS_CATALOG_PROVIDER_ID, cG as TANGLE_INTEGRATIONS_CATALOG_SOURCE, y as TangleCatalogAuthResolverOptions, cH as TangleCatalogExecutorInvocation, cI as TangleCatalogExecutorProviderOptions, z as TangleCatalogHttpAuthResolverOptions, A as TangleCatalogHttpAuthResolverRequest, cJ as TangleCatalogHttpExecutorInvocation, cK as TangleCatalogHttpExecutorOptions, B as TangleCatalogInstalledPackageExecutorOptions, cL as TangleCatalogRuntimeActionRequest, C as TangleCatalogRuntimeHandlerOptions, D as TangleCatalogRuntimeHttpRequest, E as TangleCatalogRuntimeHttpResponse, F as TangleCatalogRuntimeInvocation, G as TangleCatalogRuntimeModuleAction, cM as TangleCatalogRuntimeNodeServerOptions, H as TangleCatalogRuntimePackageCoverageOptions, J as TangleCatalogRuntimePackageCoverageRow, cN as TangleCatalogRuntimePackageManifest, cO as TangleCatalogRuntimePackageManifestOptions, cP as TangleCatalogRuntimePiece, cQ as TangleCatalogRuntimeRequest, cR as TangleCatalogTriggerInvocation, cS as TangleIntegrationCatalogEntry, cT as TangleIntegrationCatalogFreshnessOptions, cU as TangleIntegrationCatalogFreshnessResult, cV as TangleIntegrationContract, cW as TangleIntegrationContractStatus, cX as TangleIntegrationImplementationKind, cY as TangleIntegrationInvokeInput, cZ as TangleIntegrationInvokeResult, c_ as TangleIntegrationsClient, c$ as TangleIntegrationsClientOptions, d0 as WorkspaceCapability, d1 as WorkspaceCapabilityDiscovery, d2 as WorkspaceToolSchema, d3 as WorkspaceTrigger, d4 as adapterManifestsToConnectors, d5 as assertValidIntegrationManifest, am as assertValidIntegrationSpec, d6 as auditIntegrationCatalogFreshness, K as auditTangleCatalogRuntimePackages, d7 as auditTangleIntegrationCatalogFreshness, d8 as buildActivepiecesConnectors, d9 as buildActivepiecesRuntimeRequest, da as buildApprovalRequest, db as buildCanonicalLaunchConnectors, buildDefaultIntegrationRegistry, an as buildHealthcheckPlan, dc as buildIntegrationBridgeEnvironment, dd as buildIntegrationBridgePayload, d as buildIntegrationCatalogView, de as buildIntegrationCoverageConnectors, df as buildIntegrationInvocationEnvelope, e as buildIntegrationToolCatalog, dg as buildTangleCatalogRuntimePackageManifest, dh as buildTangleCatalogRuntimeRequest, di as buildTangleIntegrationCatalogConnectors, dj as calendarExercisePlannerManifest, dk as canonicalActionConnectorId, canonicalConnectorId, composeIntegrationRegistry, ao as consoleStepsToText, dl as createActivepiecesExecutorProvider, dm as createActivepiecesHttpExecutor, dn as createApprovalBackedPolicyEngine, dp as createAuditingActionGuard, dq as createCatalogExecutorProvider, dr as createConnectionCredentialResolver, ds as createConnectorAdapterCatalogSource, dt as createConnectorAdapterProvider, du as createCredentialBackedAdapterProvider, dv as createDefaultIntegrationActionGuard, dw as createDefaultIntegrationPolicyEngine, dx as createGatewayCatalogProvider, dy as createHttpIntegrationProvider, dz as createIntegrationAuditEvent, x as createIntegrationRuntime, dA as createIntegrationWorkflowRuntime, dB as createMockIntegrationProvider, dC as createPlatformIntegrationPolicyPreset, L as createTangleCatalogCredentialAuthResolver, dD as createTangleCatalogExecutorProvider, N as createTangleCatalogHttpAuthResolver, dE as createTangleCatalogHttpExecutor, O as createTangleCatalogInstalledPackageExecutor, P as createTangleCatalogRuntimeHandler, dF as createTangleCatalogRuntimeNodeRequestListener, dG as createTangleIntegrationsClient, dH as decodeIntegrationBridgePayload, dI as discoverWorkspaceCapabilities, dJ as dispatchIntegrationInvocation, dK as encodeIntegrationBridgePayload, dL as explainMissingRequirements, dM as extractActivepiecesPublicPieceCount, dN as extractExternalCatalogPublicCount, dO as filterDiscoveryByWorkspaceScopes, dP as getActivepiecesOverride, ap as getIntegrationFamily, aq as getIntegrationSpec, dQ as healthcheckRequest, dR as importGraphqlConnector, dS as importMcpConnector, dT as importOpenApiConnector, dU as inferIntegrationManifestFromTools, inferIntegrationSupportTier, dV as integrationCoverageChecklistMarkdown, ar as integrationSpecToConnector, i as integrationToolName, dW as invocationRequestFromEnvelope, dX as listActivepiecesCatalogEntries, as as listExecutableIntegrationSpecs, dY as listIntegrationCoverageSpecs, at as listIntegrationSpecs, dZ as listTangleIntegrationCatalogEntries, d_ as listTangleIntegrationCatalogRuntimePackages, d$ as listTangleIntegrationContracts, e0 as manifestToConnector, e1 as normalizeGatewayCatalog, e2 as normalizeIntegrationError, e3 as normalizeIntegrationResult, e4 as parseIntegrationBridgeEnvironment, p as parseIntegrationToolName, e5 as receiveIntegrationWebhook, e6 as redactApprovalRequest, e7 as redactCapability, e8 as redactIntegrationBridgePayload, e9 as redactInvocationEnvelope, au as renderAgentToolDescription, ea as renderApprovalCopy, eb as renderConsentSummary, av as renderConsoleSteps, aw as renderRunbookMarkdown, ec as renderTangleCatalogRuntimePnpmAddCommand, ed as resolveConnectionCredentials, ee as resolveIntegrationApproval, ef as revokeConnection, eg as runIntegrationHealthcheck, eh as runIntegrationHealthchecks, ei as sanitizeAuditConnection, ej as sanitizeConnection, s as searchIntegrationTools, ek as signActivepiecesRuntimeRequest, el as signCapability, Q as signTangleCatalogRuntimeRequest, ax as specAuthToConnectorAuth, em as startTangleCatalogRuntimeNodeServer, en as statusForCode, eo as storedEventToTriggerEvent, summarizeIntegrationRegistry, R as tangleCatalogAuthValue, t as toMcpTools, ay as validateCredentialFormat, az as validateCredentialSet, ep as validateIntegrationInvocationEnvelope, eq as validateIntegrationManifest, aA as validateIntegrationSpec, er as validateProviderPassthroughRequest, es as verifyActivepiecesRuntimeSignature, et as verifyCapabilityToken, S as verifyTangleCatalogRuntimeSignature } from './registry.js';
2
+ export { ConnectFlowOptions, FinishConnectInput, FinishConnectOutput, InMemoryConnectStateStore, StartConnectInput, StartConnectOutput, finishConnectFlow, revokeConnectFlow, startConnectFlow } from './connect/index.js';
3
+ export { ExpressLikeRequest, ExpressLikeResponse, HonoLikeContext, RequireTangleAuthOptions, TangleAuthContext, TangleAuthOutcome, TangleAuthReason, expressTangleAuthMiddleware, extractToken, honoTangleAuthMiddleware, requireTangleAuth } from './middleware/index.js';
4
+ export { A as AuthSpec, e as CASStrategy, f as Capability, g as CapabilityClass, h as CapabilityMutation, i as CapabilityMutationResult, j as CapabilityParameterSchema, k as CapabilityRead, l as CapabilityReadResult, C as ConnectorAdapter, d as ConnectorCredentials, m as ConnectorInvocation, n as ConnectorManifest, o as ConnectorManifestValidationIssue, p as ConnectorManifestValidationResult, q as ConsistencyModel, r as CredentialsExpired, D as DEFAULT_TANGLE_PLATFORM_URL, s as DataSourceMetadata, E as EventHandlerResult, I as InboundEvent, t as RateLimitSpec, R as ResolvedDataSource, u as ResourceContention, v as TANGLE_API_KEY_PREFIX, w as TANGLE_SERVICE_TOKEN_PREFIX, b as TangleIdentityClient, T as TangleIdentityOptions, x as TangleIdentityUnreachableError, c as TangleTokenVerifyFailure, y as TangleTokenVerifyResult, a as TangleUserSummary, z as TangleWorkspaceSummary, B as assertValidConnectorManifest, F as createTangleIdentityClient, G as tangleIdentity, H as validateConnectorManifest } from './tangle-id-CTU4kGId.js';
3
5
  export { DEFAULT_SIGNATURE_TOLERANCE_SECONDS, ExchangeCodeInput, GenericHmacVerifyOptions, InMemoryOAuthFlowStore, OAuthFlowStore, OAuthTokens, ParsedStripeSignatureHeader, PendingOAuthFlow, RefreshInput, SlackVerifyOptions, StartOAuthInput, StartOAuthOutput, StripeVerifyOptions, TwilioVerifyOptions, _resetPendingFlowsForTests, consumePendingFlow, exchangeAuthorizationCode, firstHeader, parseStripeSignatureHeader, refreshAccessToken, startOAuthFlow, verifyHmacSignature, verifySlackSignature, verifyStripeSignature, verifyTwilioSignature } from './connectors/index.js';
6
+ export { DocuSealOptions, GmailOptions, GoogleCalendarOptions, GoogleDriveOptions, GoogleSheetsOptions, HubSpotOptions, MicrosoftCalendarOptions, NotionDatabaseOptions, RestConnectorSpec, RestCredentialPlacement, RestOperationSpec, RestRequestSpec, SlackOptions, airtableConnector, asanaConnector, declarativeRestConnector, docuseal, githubConnector, gitlabConnector, gmail, googleCalendar, googleDrive, googleSheets, hubspot, microsoftCalendar, notionDatabase, salesforceConnector, slack, slackEventsConnector, stripePackConnector, stripeWebhookReceiverConnector, twilioSmsConnector, webhookConnector } from './connectors/adapters/index.js';
4
7
  import 'node:http';
package/dist/index.js CHANGED
@@ -76,11 +76,13 @@ import {
76
76
  createTangleCatalogRuntimeNodeRequestListener,
77
77
  createTangleIntegrationsClient,
78
78
  decodeIntegrationBridgePayload,
79
+ discoverWorkspaceCapabilities,
79
80
  dispatchIntegrationInvocation,
80
81
  encodeIntegrationBridgePayload,
81
82
  explainMissingRequirements,
82
83
  extractActivepiecesPublicPieceCount,
83
84
  extractExternalCatalogPublicCount,
85
+ filterDiscoveryByWorkspaceScopes,
84
86
  getActivepiecesOverride,
85
87
  healthcheckRequest,
86
88
  importGraphqlConnector,
@@ -131,7 +133,13 @@ import {
131
133
  verifyActivepiecesRuntimeSignature,
132
134
  verifyCapabilityToken,
133
135
  verifyTangleCatalogRuntimeSignature
134
- } from "./chunk-A5I3EYU5.js";
136
+ } from "./chunk-ICSBYCE2.js";
137
+ import {
138
+ expressTangleAuthMiddleware,
139
+ extractToken,
140
+ honoTangleAuthMiddleware,
141
+ requireTangleAuth
142
+ } from "./chunk-SVQ4PHDZ.js";
135
143
  import {
136
144
  INTEGRATION_FAMILIES,
137
145
  assertValidIntegrationSpec,
@@ -155,26 +163,23 @@ import {
155
163
  } from "./chunk-4JQ754PA.js";
156
164
  import "./chunk-376UBTNB.js";
157
165
  import {
158
- CredentialsExpired,
159
- DEFAULT_SIGNATURE_TOLERANCE_SECONDS,
160
166
  InMemoryOAuthFlowStore,
161
- ResourceContention,
162
167
  _resetPendingFlowsForTests,
163
168
  airtableConnector,
164
169
  asanaConnector,
165
- assertValidConnectorManifest,
166
170
  consumePendingFlow,
167
171
  declarativeRestConnector,
172
+ docuseal,
168
173
  exchangeAuthorizationCode,
169
- firstHeader,
170
174
  githubConnector,
171
175
  gitlabConnector,
176
+ gmail,
172
177
  googleCalendar,
178
+ googleDrive,
173
179
  googleSheets,
174
180
  hubspot,
175
181
  microsoftCalendar,
176
182
  notionDatabase,
177
- parseStripeSignatureHeader,
178
183
  refreshAccessToken,
179
184
  salesforceConnector,
180
185
  slack,
@@ -183,13 +188,35 @@ import {
183
188
  stripePackConnector,
184
189
  stripeWebhookReceiverConnector,
185
190
  twilioSmsConnector,
186
- validateConnectorManifest,
191
+ webhookConnector
192
+ } from "./chunk-JU25UDN2.js";
193
+ import {
194
+ DEFAULT_SIGNATURE_TOLERANCE_SECONDS,
195
+ firstHeader,
196
+ parseStripeSignatureHeader,
187
197
  verifyHmacSignature,
188
198
  verifySlackSignature,
189
199
  verifyStripeSignature,
190
- verifyTwilioSignature,
191
- webhookConnector
192
- } from "./chunk-WC63AI4Q.js";
200
+ verifyTwilioSignature
201
+ } from "./chunk-2TW2QKGZ.js";
202
+ import {
203
+ InMemoryConnectStateStore,
204
+ finishConnectFlow,
205
+ revokeConnectFlow,
206
+ startConnectFlow
207
+ } from "./chunk-P24T3MLM.js";
208
+ import {
209
+ CredentialsExpired,
210
+ DEFAULT_TANGLE_PLATFORM_URL,
211
+ ResourceContention,
212
+ TANGLE_API_KEY_PREFIX,
213
+ TANGLE_SERVICE_TOKEN_PREFIX,
214
+ TangleIdentityUnreachableError,
215
+ assertValidConnectorManifest,
216
+ createTangleIdentityClient,
217
+ tangleIdentity,
218
+ validateConnectorManifest
219
+ } from "./chunk-ATYHZXLL.js";
193
220
  export {
194
221
  ACTIVEPIECES_OVERRIDES,
195
222
  ACTIVEPIECES_PUBLIC_CATALOG_URL,
@@ -199,8 +226,10 @@ export {
199
226
  CredentialsExpired,
200
227
  DEFAULT_INTEGRATION_BRIDGE_ENV,
201
228
  DEFAULT_SIGNATURE_TOLERANCE_SECONDS,
229
+ DEFAULT_TANGLE_PLATFORM_URL,
202
230
  DefaultIntegrationActionGuard,
203
231
  INTEGRATION_FAMILIES,
232
+ InMemoryConnectStateStore,
204
233
  InMemoryConnectionStore,
205
234
  InMemoryIntegrationApprovalStore,
206
235
  InMemoryIntegrationAuditStore,
@@ -220,9 +249,12 @@ export {
220
249
  PROVIDER_PASSTHROUGH_ACTION,
221
250
  ResourceContention,
222
251
  StaticIntegrationPolicyEngine,
252
+ TANGLE_API_KEY_PREFIX,
223
253
  TANGLE_CATALOG_RUNTIME_SIGNATURE_HEADER,
224
254
  TANGLE_INTEGRATIONS_CATALOG_PROVIDER_ID,
225
255
  TANGLE_INTEGRATIONS_CATALOG_SOURCE,
256
+ TANGLE_SERVICE_TOKEN_PREFIX,
257
+ TangleIdentityUnreachableError,
226
258
  TangleIntegrationsClient,
227
259
  _resetPendingFlowsForTests,
228
260
  adapterManifestsToConnectors,
@@ -280,24 +312,34 @@ export {
280
312
  createTangleCatalogInstalledPackageExecutor,
281
313
  createTangleCatalogRuntimeHandler,
282
314
  createTangleCatalogRuntimeNodeRequestListener,
315
+ createTangleIdentityClient,
283
316
  createTangleIntegrationsClient,
284
317
  declarativeRestConnector,
285
318
  decodeIntegrationBridgePayload,
319
+ discoverWorkspaceCapabilities,
286
320
  dispatchIntegrationInvocation,
321
+ docuseal,
287
322
  encodeIntegrationBridgePayload,
288
323
  exchangeAuthorizationCode,
289
324
  explainMissingRequirements,
325
+ expressTangleAuthMiddleware,
290
326
  extractActivepiecesPublicPieceCount,
291
327
  extractExternalCatalogPublicCount,
328
+ extractToken,
329
+ filterDiscoveryByWorkspaceScopes,
330
+ finishConnectFlow,
292
331
  firstHeader,
293
332
  getActivepiecesOverride,
294
333
  getIntegrationFamily,
295
334
  getIntegrationSpec,
296
335
  githubConnector,
297
336
  gitlabConnector,
337
+ gmail,
298
338
  googleCalendar,
339
+ googleDrive,
299
340
  googleSheets,
300
341
  healthcheckRequest,
342
+ honoTangleAuthMiddleware,
301
343
  hubspot,
302
344
  importGraphqlConnector,
303
345
  importMcpConnector,
@@ -336,8 +378,10 @@ export {
336
378
  renderConsoleSteps,
337
379
  renderRunbookMarkdown,
338
380
  renderTangleCatalogRuntimePnpmAddCommand,
381
+ requireTangleAuth,
339
382
  resolveConnectionCredentials,
340
383
  resolveIntegrationApproval,
384
+ revokeConnectFlow,
341
385
  revokeConnection,
342
386
  runIntegrationHealthcheck,
343
387
  runIntegrationHealthchecks,
@@ -351,6 +395,7 @@ export {
351
395
  slack,
352
396
  slackEventsConnector,
353
397
  specAuthToConnectorAuth,
398
+ startConnectFlow,
354
399
  startOAuthFlow,
355
400
  startTangleCatalogRuntimeNodeServer,
356
401
  statusForCode,
@@ -359,6 +404,7 @@ export {
359
404
  stripeWebhookReceiverConnector,
360
405
  summarizeIntegrationRegistry,
361
406
  tangleCatalogAuthValue,
407
+ tangleIdentity,
362
408
  toMcpTools,
363
409
  twilioSmsConnector,
364
410
  validateConnectorManifest,
@@ -0,0 +1,137 @@
1
+ import { T as TangleIdentityOptions, b as TangleIdentityClient, c as TangleTokenVerifyFailure } from '../tangle-id-CTU4kGId.js';
2
+
3
+ /**
4
+ * @stable Drop-in request middleware that verifies id.tangle.tools
5
+ * credentials and attaches `{ userId, workspaceId, scopes, kind }` to the
6
+ * request.
7
+ *
8
+ * The middleware is framework-agnostic. Instead of binding to express /
9
+ * hono / itty-router specifically (each has its own request typings and
10
+ * lifecycle), the helper accepts either a `Request` (web standard) or a
11
+ * `{ headers }`-shaped object and returns a typed result the caller wires
12
+ * into its own context. Concrete adapters for hono / express / fetch live
13
+ * one call below in the same module so a product can pick the shape it
14
+ * uses without dragging in framework types from the rest.
15
+ *
16
+ * Why this matters: legal-agent runs on Bun + Hono. tax-agent runs on
17
+ * CF Workers + itty-router. gtm-agent runs on Node + Express. Wiring an
18
+ * identical "is this caller authed" check across all three is what
19
+ * unblocks shipping product apps in parallel.
20
+ *
21
+ * Token sources (checked in order):
22
+ *
23
+ * 1. `Authorization: Bearer <token>` — handles both sk-tan-* API keys
24
+ * and Better Auth-issued session bearers.
25
+ * 2. `Cookie: better-auth.session_token=<jwt>` — the canonical browser
26
+ * flow. We forward the cookie value as a Bearer to the platform's
27
+ * `/api/auth/get-session` endpoint.
28
+ *
29
+ * On success the middleware returns:
30
+ *
31
+ * { ok: true, auth: { userId, workspaceId, scopes, kind, expiresAt? } }
32
+ *
33
+ * On failure:
34
+ *
35
+ * { ok: false, status: 401|403, reason: '<stable-code>' }
36
+ *
37
+ * The caller decides whether to short-circuit the request (production) or
38
+ * downgrade to anonymous (read-only public endpoints). The middleware
39
+ * NEVER throws on bad-token; only true platform unreachability bubbles up
40
+ * as a `TangleIdentityUnreachableError`.
41
+ */
42
+
43
+ /** Auth context the middleware attaches to the request on success. */
44
+ interface TangleAuthContext {
45
+ userId: string;
46
+ workspaceId: string;
47
+ scopes: string[];
48
+ kind: 'api_key' | 'session';
49
+ /** Wall-clock ms epoch when the credential expires, when known. */
50
+ expiresAt?: number;
51
+ /** Stable credential id (key id for API keys, session id for sessions). */
52
+ credentialId?: string;
53
+ /** Owner-shape on the platform side. */
54
+ ownerType: 'user' | 'team';
55
+ /** Product the credential is scoped to, when known. */
56
+ product?: string;
57
+ }
58
+ type TangleAuthOutcome = {
59
+ ok: true;
60
+ auth: TangleAuthContext;
61
+ } | {
62
+ ok: false;
63
+ status: 401 | 403 | 503;
64
+ reason: TangleAuthReason;
65
+ };
66
+ /** Stable failure reasons surfaced to the caller. */
67
+ type TangleAuthReason = 'missing_credential' | 'malformed_credential' | 'service_token_refused' | TangleTokenVerifyFailure | 'platform_unreachable';
68
+ interface RequireTangleAuthOptions extends TangleIdentityOptions {
69
+ /** Pre-built client. When supplied, all `TangleIdentityOptions` fields
70
+ * are ignored. Tests pass a stub here; production code typically
71
+ * constructs the client once at boot and passes it in. */
72
+ client?: TangleIdentityClient;
73
+ /** Override the cookie name where the session bearer lives. Defaults
74
+ * to `better-auth.session_token` — matches the platform's Better Auth
75
+ * configuration. */
76
+ sessionCookieName?: string;
77
+ /** If true, missing-credential returns `ok: false, status: 401`
78
+ * (default). If false, the middleware returns `ok: true` with a
79
+ * synthetic anonymous context — useful for public endpoints that want
80
+ * to opportunistically hydrate identity. */
81
+ requireCredential?: boolean;
82
+ }
83
+ /**
84
+ * Verify the credential on `request` against id.tangle.tools and resolve
85
+ * to a typed {@link TangleAuthContext}. Request type is the web-standard
86
+ * `Request` shape — works in Bun, Workers, Deno, Node 20+, Hono context's
87
+ * `c.req.raw`, and Express adapters that surface `req` via `webRequest()`.
88
+ */
89
+ declare function requireTangleAuth(request: Pick<Request, 'headers'>, opts?: RequireTangleAuthOptions): Promise<TangleAuthOutcome>;
90
+ /**
91
+ * Extract the bearer credential from a request. Public so callers that
92
+ * want to reuse the same token-discovery logic outside the middleware
93
+ * (e.g. to attribute audit log entries) don't have to re-implement it.
94
+ *
95
+ * Order: Authorization header first (canonical), session cookie second.
96
+ * Service tokens (`svc_*`) are explicitly dropped — the platform's
97
+ * middleware refuses to map them to a user, so accepting them here
98
+ * would invite the exact "service-as-user" privilege escalation the
99
+ * platform's `resolveServiceIdentity` already guards against.
100
+ */
101
+ declare function extractToken(request: Pick<Request, 'headers'>, sessionCookieName?: string): string | undefined;
102
+ /**
103
+ * Hono-flavored convenience wrapper. Returns a hono middleware factory
104
+ * that calls {@link requireTangleAuth} and stashes the result on the
105
+ * Hono context under `c.set('tangleAuth', auth)`. On failure short-
106
+ * circuits with the canonical {success:false} envelope the platform uses.
107
+ *
108
+ * Kept typed against a structural `Context`-like shape so this module
109
+ * does NOT take a hono peerDep. Consumers pass `c` directly.
110
+ */
111
+ declare function honoTangleAuthMiddleware(opts?: RequireTangleAuthOptions): (c: HonoLikeContext, next: () => Promise<void>) => Promise<Response | void>;
112
+ /** Minimal Hono Context-shaped surface. Avoids the hono peerDep. */
113
+ interface HonoLikeContext {
114
+ req: {
115
+ raw: Request;
116
+ };
117
+ set(key: 'tangleAuth', value: TangleAuthContext): void;
118
+ }
119
+ /**
120
+ * Express-flavored convenience wrapper. Same outcome shape as the Hono
121
+ * helper, expressed via the Node `req` / `res` / `next` triple. Consumers
122
+ * pass the triple as positional args. Returns a function compatible with
123
+ * any express-like `app.use(fn)`.
124
+ */
125
+ declare function expressTangleAuthMiddleware(opts?: RequireTangleAuthOptions): (req: ExpressLikeRequest, res: ExpressLikeResponse, next: (err?: unknown) => void) => Promise<void>;
126
+ /** Minimal Express-shaped surfaces. Avoids the express peerDep. */
127
+ interface ExpressLikeRequest {
128
+ headers: Record<string, string | string[] | undefined>;
129
+ tangleAuth?: TangleAuthContext;
130
+ }
131
+ interface ExpressLikeResponse {
132
+ status(code: number): unknown;
133
+ setHeader?(name: string, value: string): unknown;
134
+ end(body: string): unknown;
135
+ }
136
+
137
+ export { type ExpressLikeRequest, type ExpressLikeResponse, type HonoLikeContext, type RequireTangleAuthOptions, type TangleAuthContext, type TangleAuthOutcome, type TangleAuthReason, expressTangleAuthMiddleware, extractToken, honoTangleAuthMiddleware, requireTangleAuth };
@@ -0,0 +1,14 @@
1
+ import {
2
+ expressTangleAuthMiddleware,
3
+ extractToken,
4
+ honoTangleAuthMiddleware,
5
+ requireTangleAuth
6
+ } from "../chunk-SVQ4PHDZ.js";
7
+ import "../chunk-ATYHZXLL.js";
8
+ export {
9
+ expressTangleAuthMiddleware,
10
+ extractToken,
11
+ honoTangleAuthMiddleware,
12
+ requireTangleAuth
13
+ };
14
+ //# sourceMappingURL=index.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}