@tangle-network/agent-integrations 0.53.53 → 0.53.54

package/dist/mcp.js

@@ -2,18 +2,23 @@ import {
   IntegrationError,
   createCatalogExecutorProvider,
   importMcpConnector
-} from "./chunk-ZC3ZE7TN.js";
+} from "./chunk-A4OJ5EQT.js";
+import "./chunk-DED3J7F6.js";
 import "./chunk-PIF635BP.js";
 import "./chunk-PIEBVPSW.js";
 import "./chunk-H4XYLS7T.js";
 import "./chunk-ABWBYMCF.js";
-import "./chunk-2GEGKSL5.js";
-import "./chunk-TWR2KAZG.js";
-import "./chunk-P4FFI752.js";
-import "./chunk-E2QYXDJQ.js";
+import "./chunk-RSJRICPU.js";
+import "./chunk-ABA4HWIQ.js";
 import "./chunk-QL6CRJ3E.js";
 import "./chunk-XC54EOUQ.js";
 import "./chunk-DCSQH4O6.js";
+import "./chunk-QVWTBQXP.js";
+import "./chunk-WPQJK4S4.js";
+import "./chunk-QWOX5SIM.js";
+import "./chunk-MH4IEJCL.js";
+import "./chunk-GIK6EXU2.js";
+import "./chunk-ESY2FBBM.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/mcp.ts

package/dist/mcp.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/mcp.ts"],"sourcesContent":["/**\n * Live MCP connector — attach a remote MCP (Model Context Protocol) server\n * as an {@link IntegrationProvider}, so its tools flow through the same\n * catalog / grants / approvals machinery as every other connector instead of\n * forming a parallel, ungoverned tool path.\n *\n * Transport is Streamable HTTP only (single POST endpoint, JSON or SSE\n * response framing) — this package runs in edge workers, so stdio servers are\n * out of scope; front them with any HTTP-bridging MCP host.\n *\n * Discovery reuses {@link importMcpConnector}: `tools/list` output becomes an\n * `IntegrationConnector` whose per-action risk comes from MCP tool\n * annotations (readOnlyHint / destructiveHint) with a text-heuristic\n * fallback, so non-read MCP tools default to `approvalRequired` — fail-closed\n * against servers that don't annotate.\n *\n * Credentials: the server's auth header is supplied at construction by the\n * product (which owns secret storage) and held in memory only. Connection\n * rows carry no MCP secrets.\n */\n\nimport { IntegrationError } from './core-error.js'\nimport type {\n  IntegrationActionResult,\n  IntegrationActionRisk,\n  IntegrationConnector,\n  IntegrationConnectorCategory,\n  IntegrationDataClass,\n  IntegrationProvider,\n} from './core-types.js'\nimport { createCatalogExecutorProvider } from './catalog-executor.js'\nimport { importMcpConnector, type McpCatalogTool } from './importers.js'\n\n/** Protocol revision sent on `initialize` and the `MCP-Protocol-Version`\n *  header. Servers negotiate down from this. */\nexport const MCP_PROTOCOL_VERSION = '2025-06-18'\n\nexport interface McpServerConfig {\n  /** The server's single Streamable-HTTP endpoint. */\n  url: string\n  /** Static request headers — typically `{ Authorization: 'Bearer …' }`.\n   *  Held in memory only; never persisted by this module. */\n  headers?: Record<string, string>\n  protocolVersion?: string\n  clientInfo?: { name: string; version: string }\n  /** Injectable for tests / custom egress policies (SSRF pinning). */\n  fetchImpl?: typeof fetch\n}\n\nexport interface McpToolCallResult {\n  /** MCP content blocks (text, image, resource, …) verbatim. */\n  content: unknown[]\n  isError: boolean\n  /** `structuredContent` from servers that return it. */\n  structured?: unknown\n}\n\ninterface JsonRpcResponse {\n  jsonrpc: '2.0'\n  id?: number | string | null\n  result?: unknown\n  error?: { code: number; message: string; data?: unknown }\n}\n\n/**\n * Minimal Streamable-HTTP MCP client: `initialize` handshake (capturing the\n * server's `Mcp-Session-Id`), paginated `tools/list`, and `tools/call`.\n * Lazily initializes on first use; safe to share across calls within an\n * isolate.\n */\nexport class McpHttpClient {\n  private nextId = 1\n  private sessionId: string | undefined\n  private negotiatedVersion: string | undefined\n  private initializing: Promise<void> | undefined\n\n  constructor(private readonly config: McpServerConfig) {}\n\n  private get fetchImpl(): typeof fetch {\n    return this.config.fetchImpl ?? fetch\n  }\n\n  private async post(body: Record<string, unknown>): Promise<JsonRpcResponse | undefined> {\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/json',\n      Accept: 'application/json, text/event-stream',\n      ...(this.config.headers ?? {}),\n    }\n    const version = this.negotiatedVersion ?? this.config.protocolVersion ?? MCP_PROTOCOL_VERSION\n    headers['MCP-Protocol-Version'] = version\n    if (this.sessionId) headers['Mcp-Session-Id'] = this.sessionId\n\n    let response: Response\n    try {\n      response = await this.fetchImpl(this.config.url, {\n        method: 'POST',\n        headers,\n        body: JSON.stringify(body),\n      })\n    } catch (error) {\n      throw new IntegrationError(\n        `MCP server unreachable: ${error instanceof Error ? error.message : String(error)}`,\n        'provider_failure',\n      )\n    }\n    const session = response.headers.get('mcp-session-id')\n    if (session) this.sessionId = session\n\n    if (!response.ok) {\n      throw new IntegrationError(`MCP server returned HTTP ${response.status}`, 'provider_failure')\n    }\n    // Notifications get 202/204 with no body.\n    if (body.id === undefined) return undefined\n    const contentType = response.headers.get('content-type') ?? ''\n    const text = await response.text()\n    const message = contentType.includes('text/event-stream')\n      ? findSseResponse(text, body.id as number)\n      : (JSON.parse(text) as JsonRpcResponse)\n    if (!message) {\n      throw new IntegrationError('MCP server response missing a result for the request', 'provider_failure')\n    }\n    if (message.error) {\n      throw new IntegrationError(`MCP error ${message.error.code}: ${message.error.message}`, 'provider_failure')\n    }\n    return message\n  }\n\n  private async request(method: string, params?: Record<string, unknown>): Promise<unknown> {\n    const response = await this.post({ jsonrpc: '2.0', id: this.nextId++, method, ...(params ? { params } : {}) })\n    return response?.result\n  }\n\n  /** Idempotent handshake; concurrent callers share one in-flight init. */\n  async initialize(): Promise<void> {\n    if (this.negotiatedVersion) return\n    this.initializing ??= (async () => {\n      const result = (await this.request('initialize', {\n        protocolVersion: this.config.protocolVersion ?? MCP_PROTOCOL_VERSION,\n        capabilities: {},\n        clientInfo: this.config.clientInfo ?? { name: 'tangle-agent-integrations', version: '1' },\n      })) as { protocolVersion?: string } | undefined\n      this.negotiatedVersion = result?.protocolVersion ?? this.config.protocolVersion ?? MCP_PROTOCOL_VERSION\n      await this.post({ jsonrpc: '2.0', method: 'notifications/initialized' })\n    })().catch((error) => {\n      this.initializing = undefined\n      throw error\n    })\n    await this.initializing\n  }\n\n  /** Full tool catalog, following `nextCursor` pagination. */\n  async listTools(): Promise<McpCatalogTool[]> {\n    await this.initialize()\n    const tools: McpCatalogTool[] = []\n    let cursor: string | undefined\n    do {\n      const result = (await this.request('tools/list', cursor ? { cursor } : {})) as\n        | { tools?: McpCatalogTool[]; nextCursor?: string }\n        | undefined\n      tools.push(...(result?.tools ?? []))\n      cursor = result?.nextCursor\n    } while (cursor)\n    return tools\n  }\n\n  async callTool(name: string, args: unknown): Promise<McpToolCallResult> {\n    await this.initialize()\n    const result = (await this.request('tools/call', { name, arguments: args ?? {} })) as\n      | { content?: unknown[]; isError?: boolean; structuredContent?: unknown }\n      | undefined\n    return {\n      content: result?.content ?? [],\n      isError: result?.isError === true,\n      structured: result?.structuredContent,\n    }\n  }\n}\n\nexport interface CreateMcpProviderOptions {\n  /** Provider id, unique within the hub (e.g. `mcp:linear`). */\n  id: string\n  server: McpServerConfig\n  connectorId: string\n  connectorTitle: string\n  category?: IntegrationConnectorCategory\n  scopes?: string[]\n  dataClass?: IntegrationDataClass\n  /** Risk for tools whose annotations/name don't classify them. Defaults to\n   *  'write' (⇒ approvalRequired) — fail-closed. */\n  defaultRisk?: IntegrationActionRisk\n}\n\n/** Discover a live MCP server's tools as an {@link IntegrationConnector}. */\nexport async function discoverMcpConnector(\n  client: McpHttpClient,\n  options: CreateMcpProviderOptions,\n): Promise<IntegrationConnector> {\n  const tools = await client.listTools()\n  return importMcpConnector(\n    { tools },\n    {\n      providerId: options.id,\n      connectorId: options.connectorId,\n      connectorTitle: options.connectorTitle,\n      category: options.category,\n      auth: 'custom',\n      scopes: options.scopes,\n      dataClass: options.dataClass,\n      defaultRisk: options.defaultRisk ?? 'write',\n    },\n  )\n}\n\n/**\n * Build an {@link IntegrationProvider} over one remote MCP server: live\n * `tools/list` discovery at construction, `tools/call` on invoke. A tool\n * result with `isError` maps to `{ ok: false }` (the model sees the failure\n * content); transport and JSON-RPC failures throw {@link IntegrationError}.\n */\nexport async function createMcpProvider(options: CreateMcpProviderOptions): Promise<IntegrationProvider> {\n  const client = new McpHttpClient(options.server)\n  const connector = await discoverMcpConnector(client, options)\n  return createCatalogExecutorProvider({\n    id: options.id,\n    kind: 'mcp',\n    connectors: [connector],\n    async executeAction({ request, action }): Promise<IntegrationActionResult> {\n      const result = await client.callTool(action.id, request.input)\n      return {\n        ok: !result.isError,\n        action: action.id,\n        output: result.structured ?? result.content,\n        metadata: { mcp: true, ...(result.isError ? { isError: true } : {}) },\n      }\n    },\n  })\n}\n\nfunction findSseResponse(body: string, id: number): JsonRpcResponse | undefined {\n  for (const event of body.split(/\\n\\n/)) {\n    const data = event\n      .split('\\n')\n      .filter((line) => line.startsWith('data:'))\n      .map((line) => line.slice(5).trim())\n      .join('')\n    if (!data) continue\n    try {\n      const parsed = JSON.parse(data) as JsonRpcResponse\n      if (parsed.id === id) return parsed\n    } catch {\n      // non-JSON SSE frame (keepalive/comment) — skip\n    }\n  }\n  return undefined\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAmCO,IAAM,uBAAuB;AAmC7B,IAAM,gBAAN,MAAoB;AAAA,EAMzB,YAA6B,QAAyB;AAAzB;AAAA,EAA0B;AAAA,EAA1B;AAAA,EALrB,SAAS;AAAA,EACT;AAAA,EACA;AAAA,EACA;AAAA,EAIR,IAAY,YAA0B;AACpC,WAAO,KAAK,OAAO,aAAa;AAAA,EAClC;AAAA,EAEA,MAAc,KAAK,MAAqE;AACtF,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,MAChB,QAAQ;AAAA,MACR,GAAI,KAAK,OAAO,WAAW,CAAC;AAAA,IAC9B;AACA,UAAM,UAAU,KAAK,qBAAqB,KAAK,OAAO,mBAAmB;AACzE,YAAQ,sBAAsB,IAAI;AAClC,QAAI,KAAK,UAAW,SAAQ,gBAAgB,IAAI,KAAK;AAErD,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,KAAK,UAAU,KAAK,OAAO,KAAK;AAAA,QAC/C,QAAQ;AAAA,QACR;AAAA,QACA,MAAM,KAAK,UAAU,IAAI;AAAA,MAC3B,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,IAAI;AAAA,QACR,2BAA2B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,QACjF;AAAA,MACF;AAAA,IACF;AACA,UAAM,UAAU,SAAS,QAAQ,IAAI,gBAAgB;AACrD,QAAI,QAAS,MAAK,YAAY;AAE9B,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI,iBAAiB,4BAA4B,SAAS,MAAM,IAAI,kBAAkB;AAAA,IAC9F;AAEA,QAAI,KAAK,OAAO,OAAW,QAAO;AAClC,UAAM,cAAc,SAAS,QAAQ,IAAI,cAAc,KAAK;AAC5D,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,UAAM,UAAU,YAAY,SAAS,mBAAmB,IACpD,gBAAgB,MAAM,KAAK,EAAY,IACtC,KAAK,MAAM,IAAI;AACpB,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,iBAAiB,wDAAwD,kBAAkB;AAAA,IACvG;AACA,QAAI,QAAQ,OAAO;AACjB,YAAM,IAAI,iBAAiB,aAAa,QAAQ,MAAM,IAAI,KAAK,QAAQ,MAAM,OAAO,IAAI,kBAAkB;AAAA,IAC5G;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,QAAQ,QAAgB,QAAoD;AACxF,UAAM,WAAW,MAAM,KAAK,KAAK,EAAE,SAAS,OAAO,IAAI,KAAK,UAAU,QAAQ,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC,EAAG,CAAC;AAC7G,WAAO,UAAU;AAAA,EACnB;AAAA;AAAA,EAGA,MAAM,aAA4B;AAChC,QAAI,KAAK,kBAAmB;AAC5B,SAAK,kBAAkB,YAAY;AACjC,YAAM,SAAU,MAAM,KAAK,QAAQ,cAAc;AAAA,QAC/C,iBAAiB,KAAK,OAAO,mBAAmB;AAAA,QAChD,cAAc,CAAC;AAAA,QACf,YAAY,KAAK,OAAO,cAAc,EAAE,MAAM,6BAA6B,SAAS,IAAI;AAAA,MAC1F,CAAC;AACD,WAAK,oBAAoB,QAAQ,mBAAmB,KAAK,OAAO,mBAAmB;AACnF,YAAM,KAAK,KAAK,EAAE,SAAS,OAAO,QAAQ,4BAA4B,CAAC;AAAA,IACzE,GAAG,EAAE,MAAM,CAAC,UAAU;AACpB,WAAK,eAAe;AACpB,YAAM;AAAA,IACR,CAAC;AACD,UAAM,KAAK;AAAA,EACb;AAAA;AAAA,EAGA,MAAM,YAAuC;AAC3C,UAAM,KAAK,WAAW;AACtB,UAAM,QAA0B,CAAC;AACjC,QAAI;AACJ,OAAG;AACD,YAAM,SAAU,MAAM,KAAK,QAAQ,cAAc,SAAS,EAAE,OAAO,IAAI,CAAC,CAAC;AAGzE,YAAM,KAAK,GAAI,QAAQ,SAAS,CAAC,CAAE;AACnC,eAAS,QAAQ;AAAA,IACnB,SAAS;AACT,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,SAAS,MAAc,MAA2C;AACtE,UAAM,KAAK,WAAW;AACtB,UAAM,SAAU,MAAM,KAAK,QAAQ,cAAc,EAAE,MAAM,WAAW,QAAQ,CAAC,EAAE,CAAC;AAGhF,WAAO;AAAA,MACL,SAAS,QAAQ,WAAW,CAAC;AAAA,MAC7B,SAAS,QAAQ,YAAY;AAAA,MAC7B,YAAY,QAAQ;AAAA,IACtB;AAAA,EACF;AACF;AAiBA,eAAsB,qBACpB,QACA,SAC+B;AAC/B,QAAM,QAAQ,MAAM,OAAO,UAAU;AACrC,SAAO;AAAA,IACL,EAAE,MAAM;AAAA,IACR;AAAA,MACE,YAAY,QAAQ;AAAA,MACpB,aAAa,QAAQ;AAAA,MACrB,gBAAgB,QAAQ;AAAA,MACxB,UAAU,QAAQ;AAAA,MAClB,MAAM;AAAA,MACN,QAAQ,QAAQ;AAAA,MAChB,WAAW,QAAQ;AAAA,MACnB,aAAa,QAAQ,eAAe;AAAA,IACtC;AAAA,EACF;AACF;AAQA,eAAsB,kBAAkB,SAAiE;AACvG,QAAM,SAAS,IAAI,cAAc,QAAQ,MAAM;AAC/C,QAAM,YAAY,MAAM,qBAAqB,QAAQ,OAAO;AAC5D,SAAO,8BAA8B;AAAA,IACnC,IAAI,QAAQ;AAAA,IACZ,MAAM;AAAA,IACN,YAAY,CAAC,SAAS;AAAA,IACtB,MAAM,cAAc,EAAE,SAAS,OAAO,GAAqC;AACzE,YAAM,SAAS,MAAM,OAAO,SAAS,OAAO,IAAI,QAAQ,KAAK;AAC7D,aAAO;AAAA,QACL,IAAI,CAAC,OAAO;AAAA,QACZ,QAAQ,OAAO;AAAA,QACf,QAAQ,OAAO,cAAc,OAAO;AAAA,QACpC,UAAU,EAAE,KAAK,MAAM,GAAI,OAAO,UAAU,EAAE,SAAS,KAAK,IAAI,CAAC,EAAG;AAAA,MACtE;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEA,SAAS,gBAAgB,MAAc,IAAyC;AAC9E,aAAW,SAAS,KAAK,MAAM,MAAM,GAAG;AACtC,UAAM,OAAO,MACV,MAAM,IAAI,EACV,OAAO,CAAC,SAAS,KAAK,WAAW,OAAO,CAAC,EACzC,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,EAClC,KAAK,EAAE;AACV,QAAI,CAAC,KAAM;AACX,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,UAAI,OAAO,OAAO,GAAI,QAAO;AAAA,IAC/B,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../src/mcp.ts"],"sourcesContent":["/**\n * Live MCP connector — attach a remote MCP (Model Context Protocol) server\n * as an {@link IntegrationProvider}, so its tools flow through the same\n * catalog / grants / approvals machinery as every other connector instead of\n * forming a parallel, ungoverned tool path.\n *\n * Transport is Streamable HTTP only (single POST endpoint, JSON or SSE\n * response framing) — this package runs in edge workers, so stdio servers are\n * out of scope; front them with any HTTP-bridging MCP host.\n *\n * Discovery reuses {@link importMcpConnector}: `tools/list` output becomes an\n * `IntegrationConnector` whose per-action risk comes from MCP tool\n * annotations (readOnlyHint / destructiveHint) with a text-heuristic\n * fallback, so non-read MCP tools default to `approvalRequired` — fail-closed\n * against servers that don't annotate.\n *\n * Credentials: the server's auth header is supplied at construction by the\n * product (which owns secret storage) and held in memory only. Connection\n * rows carry no MCP secrets.\n */\n\nimport { IntegrationError } from './core-error.js'\nimport type {\n  IntegrationActionResult,\n  IntegrationActionRisk,\n  IntegrationConnector,\n  IntegrationConnectorCategory,\n  IntegrationDataClass,\n  IntegrationProvider,\n} from './core-types.js'\nimport { createCatalogExecutorProvider } from './catalog-executor.js'\nimport { importMcpConnector, type McpCatalogTool } from './importers.js'\n\n/** Protocol revision sent on `initialize` and the `MCP-Protocol-Version`\n *  header. Servers negotiate down from this. */\nexport const MCP_PROTOCOL_VERSION = '2025-06-18'\n\nexport interface McpServerConfig {\n  /** The server's single Streamable-HTTP endpoint. */\n  url: string\n  /** Static request headers — typically `{ Authorization: 'Bearer …' }`.\n   *  Held in memory only; never persisted by this module. */\n  headers?: Record<string, string>\n  protocolVersion?: string\n  clientInfo?: { name: string; version: string }\n  /** Injectable for tests / custom egress policies (SSRF pinning). */\n  fetchImpl?: typeof fetch\n}\n\nexport interface McpToolCallResult {\n  /** MCP content blocks (text, image, resource, …) verbatim. */\n  content: unknown[]\n  isError: boolean\n  /** `structuredContent` from servers that return it. */\n  structured?: unknown\n}\n\ninterface JsonRpcResponse {\n  jsonrpc: '2.0'\n  id?: number | string | null\n  result?: unknown\n  error?: { code: number; message: string; data?: unknown }\n}\n\n/**\n * Minimal Streamable-HTTP MCP client: `initialize` handshake (capturing the\n * server's `Mcp-Session-Id`), paginated `tools/list`, and `tools/call`.\n * Lazily initializes on first use; safe to share across calls within an\n * isolate.\n */\nexport class McpHttpClient {\n  private nextId = 1\n  private sessionId: string | undefined\n  private negotiatedVersion: string | undefined\n  private initializing: Promise<void> | undefined\n\n  constructor(private readonly config: McpServerConfig) {}\n\n  private get fetchImpl(): typeof fetch {\n    return this.config.fetchImpl ?? fetch\n  }\n\n  private async post(body: Record<string, unknown>): Promise<JsonRpcResponse | undefined> {\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/json',\n      Accept: 'application/json, text/event-stream',\n      ...(this.config.headers ?? {}),\n    }\n    const version = this.negotiatedVersion ?? this.config.protocolVersion ?? MCP_PROTOCOL_VERSION\n    headers['MCP-Protocol-Version'] = version\n    if (this.sessionId) headers['Mcp-Session-Id'] = this.sessionId\n\n    let response: Response\n    try {\n      response = await this.fetchImpl(this.config.url, {\n        method: 'POST',\n        headers,\n        body: JSON.stringify(body),\n      })\n    } catch (error) {\n      throw new IntegrationError(\n        `MCP server unreachable: ${error instanceof Error ? error.message : String(error)}`,\n        'provider_failure',\n      )\n    }\n    const session = response.headers.get('mcp-session-id')\n    if (session) this.sessionId = session\n\n    if (!response.ok) {\n      throw new IntegrationError(`MCP server returned HTTP ${response.status}`, 'provider_failure')\n    }\n    // Notifications get 202/204 with no body.\n    if (body.id === undefined) return undefined\n    const contentType = response.headers.get('content-type') ?? ''\n    const text = await response.text()\n    const message = contentType.includes('text/event-stream')\n      ? findSseResponse(text, body.id as number)\n      : (JSON.parse(text) as JsonRpcResponse)\n    if (!message) {\n      throw new IntegrationError('MCP server response missing a result for the request', 'provider_failure')\n    }\n    if (message.error) {\n      throw new IntegrationError(`MCP error ${message.error.code}: ${message.error.message}`, 'provider_failure')\n    }\n    return message\n  }\n\n  private async request(method: string, params?: Record<string, unknown>): Promise<unknown> {\n    const response = await this.post({ jsonrpc: '2.0', id: this.nextId++, method, ...(params ? { params } : {}) })\n    return response?.result\n  }\n\n  /** Idempotent handshake; concurrent callers share one in-flight init. */\n  async initialize(): Promise<void> {\n    if (this.negotiatedVersion) return\n    this.initializing ??= (async () => {\n      const result = (await this.request('initialize', {\n        protocolVersion: this.config.protocolVersion ?? MCP_PROTOCOL_VERSION,\n        capabilities: {},\n        clientInfo: this.config.clientInfo ?? { name: 'tangle-agent-integrations', version: '1' },\n      })) as { protocolVersion?: string } | undefined\n      this.negotiatedVersion = result?.protocolVersion ?? this.config.protocolVersion ?? MCP_PROTOCOL_VERSION\n      await this.post({ jsonrpc: '2.0', method: 'notifications/initialized' })\n    })().catch((error) => {\n      this.initializing = undefined\n      throw error\n    })\n    await this.initializing\n  }\n\n  /** Full tool catalog, following `nextCursor` pagination. */\n  async listTools(): Promise<McpCatalogTool[]> {\n    await this.initialize()\n    const tools: McpCatalogTool[] = []\n    let cursor: string | undefined\n    do {\n      const result = (await this.request('tools/list', cursor ? { cursor } : {})) as\n        | { tools?: McpCatalogTool[]; nextCursor?: string }\n        | undefined\n      tools.push(...(result?.tools ?? []))\n      cursor = result?.nextCursor\n    } while (cursor)\n    return tools\n  }\n\n  async callTool(name: string, args: unknown): Promise<McpToolCallResult> {\n    await this.initialize()\n    const result = (await this.request('tools/call', { name, arguments: args ?? {} })) as\n      | { content?: unknown[]; isError?: boolean; structuredContent?: unknown }\n      | undefined\n    return {\n      content: result?.content ?? [],\n      isError: result?.isError === true,\n      structured: result?.structuredContent,\n    }\n  }\n}\n\nexport interface CreateMcpProviderOptions {\n  /** Provider id, unique within the hub (e.g. `mcp:linear`). */\n  id: string\n  server: McpServerConfig\n  connectorId: string\n  connectorTitle: string\n  category?: IntegrationConnectorCategory\n  scopes?: string[]\n  dataClass?: IntegrationDataClass\n  /** Risk for tools whose annotations/name don't classify them. Defaults to\n   *  'write' (⇒ approvalRequired) — fail-closed. */\n  defaultRisk?: IntegrationActionRisk\n}\n\n/** Discover a live MCP server's tools as an {@link IntegrationConnector}. */\nexport async function discoverMcpConnector(\n  client: McpHttpClient,\n  options: CreateMcpProviderOptions,\n): Promise<IntegrationConnector> {\n  const tools = await client.listTools()\n  return importMcpConnector(\n    { tools },\n    {\n      providerId: options.id,\n      connectorId: options.connectorId,\n      connectorTitle: options.connectorTitle,\n      category: options.category,\n      auth: 'custom',\n      scopes: options.scopes,\n      dataClass: options.dataClass,\n      defaultRisk: options.defaultRisk ?? 'write',\n    },\n  )\n}\n\n/**\n * Build an {@link IntegrationProvider} over one remote MCP server: live\n * `tools/list` discovery at construction, `tools/call` on invoke. A tool\n * result with `isError` maps to `{ ok: false }` (the model sees the failure\n * content); transport and JSON-RPC failures throw {@link IntegrationError}.\n */\nexport async function createMcpProvider(options: CreateMcpProviderOptions): Promise<IntegrationProvider> {\n  const client = new McpHttpClient(options.server)\n  const connector = await discoverMcpConnector(client, options)\n  return createCatalogExecutorProvider({\n    id: options.id,\n    kind: 'mcp',\n    connectors: [connector],\n    async executeAction({ request, action }): Promise<IntegrationActionResult> {\n      const result = await client.callTool(action.id, request.input)\n      return {\n        ok: !result.isError,\n        action: action.id,\n        output: result.structured ?? result.content,\n        metadata: { mcp: true, ...(result.isError ? { isError: true } : {}) },\n      }\n    },\n  })\n}\n\nfunction findSseResponse(body: string, id: number): JsonRpcResponse | undefined {\n  for (const event of body.split(/\\n\\n/)) {\n    const data = event\n      .split('\\n')\n      .filter((line) => line.startsWith('data:'))\n      .map((line) => line.slice(5).trim())\n      .join('')\n    if (!data) continue\n    try {\n      const parsed = JSON.parse(data) as JsonRpcResponse\n      if (parsed.id === id) return parsed\n    } catch {\n      // non-JSON SSE frame (keepalive/comment) — skip\n    }\n  }\n  return undefined\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAmCO,IAAM,uBAAuB;AAmC7B,IAAM,gBAAN,MAAoB;AAAA,EAMzB,YAA6B,QAAyB;AAAzB;AAAA,EAA0B;AAAA,EAA1B;AAAA,EALrB,SAAS;AAAA,EACT;AAAA,EACA;AAAA,EACA;AAAA,EAIR,IAAY,YAA0B;AACpC,WAAO,KAAK,OAAO,aAAa;AAAA,EAClC;AAAA,EAEA,MAAc,KAAK,MAAqE;AACtF,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,MAChB,QAAQ;AAAA,MACR,GAAI,KAAK,OAAO,WAAW,CAAC;AAAA,IAC9B;AACA,UAAM,UAAU,KAAK,qBAAqB,KAAK,OAAO,mBAAmB;AACzE,YAAQ,sBAAsB,IAAI;AAClC,QAAI,KAAK,UAAW,SAAQ,gBAAgB,IAAI,KAAK;AAErD,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,KAAK,UAAU,KAAK,OAAO,KAAK;AAAA,QAC/C,QAAQ;AAAA,QACR;AAAA,QACA,MAAM,KAAK,UAAU,IAAI;AAAA,MAC3B,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,IAAI;AAAA,QACR,2BAA2B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,QACjF;AAAA,MACF;AAAA,IACF;AACA,UAAM,UAAU,SAAS,QAAQ,IAAI,gBAAgB;AACrD,QAAI,QAAS,MAAK,YAAY;AAE9B,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI,iBAAiB,4BAA4B,SAAS,MAAM,IAAI,kBAAkB;AAAA,IAC9F;AAEA,QAAI,KAAK,OAAO,OAAW,QAAO;AAClC,UAAM,cAAc,SAAS,QAAQ,IAAI,cAAc,KAAK;AAC5D,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,UAAM,UAAU,YAAY,SAAS,mBAAmB,IACpD,gBAAgB,MAAM,KAAK,EAAY,IACtC,KAAK,MAAM,IAAI;AACpB,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,iBAAiB,wDAAwD,kBAAkB;AAAA,IACvG;AACA,QAAI,QAAQ,OAAO;AACjB,YAAM,IAAI,iBAAiB,aAAa,QAAQ,MAAM,IAAI,KAAK,QAAQ,MAAM,OAAO,IAAI,kBAAkB;AAAA,IAC5G;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,QAAQ,QAAgB,QAAoD;AACxF,UAAM,WAAW,MAAM,KAAK,KAAK,EAAE,SAAS,OAAO,IAAI,KAAK,UAAU,QAAQ,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC,EAAG,CAAC;AAC7G,WAAO,UAAU;AAAA,EACnB;AAAA;AAAA,EAGA,MAAM,aAA4B;AAChC,QAAI,KAAK,kBAAmB;AAC5B,SAAK,kBAAkB,YAAY;AACjC,YAAM,SAAU,MAAM,KAAK,QAAQ,cAAc;AAAA,QAC/C,iBAAiB,KAAK,OAAO,mBAAmB;AAAA,QAChD,cAAc,CAAC;AAAA,QACf,YAAY,KAAK,OAAO,cAAc,EAAE,MAAM,6BAA6B,SAAS,IAAI;AAAA,MAC1F,CAAC;AACD,WAAK,oBAAoB,QAAQ,mBAAmB,KAAK,OAAO,mBAAmB;AACnF,YAAM,KAAK,KAAK,EAAE,SAAS,OAAO,QAAQ,4BAA4B,CAAC;AAAA,IACzE,GAAG,EAAE,MAAM,CAAC,UAAU;AACpB,WAAK,eAAe;AACpB,YAAM;AAAA,IACR,CAAC;AACD,UAAM,KAAK;AAAA,EACb;AAAA;AAAA,EAGA,MAAM,YAAuC;AAC3C,UAAM,KAAK,WAAW;AACtB,UAAM,QAA0B,CAAC;AACjC,QAAI;AACJ,OAAG;AACD,YAAM,SAAU,MAAM,KAAK,QAAQ,cAAc,SAAS,EAAE,OAAO,IAAI,CAAC,CAAC;AAGzE,YAAM,KAAK,GAAI,QAAQ,SAAS,CAAC,CAAE;AACnC,eAAS,QAAQ;AAAA,IACnB,SAAS;AACT,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,SAAS,MAAc,MAA2C;AACtE,UAAM,KAAK,WAAW;AACtB,UAAM,SAAU,MAAM,KAAK,QAAQ,cAAc,EAAE,MAAM,WAAW,QAAQ,CAAC,EAAE,CAAC;AAGhF,WAAO;AAAA,MACL,SAAS,QAAQ,WAAW,CAAC;AAAA,MAC7B,SAAS,QAAQ,YAAY;AAAA,MAC7B,YAAY,QAAQ;AAAA,IACtB;AAAA,EACF;AACF;AAiBA,eAAsB,qBACpB,QACA,SAC+B;AAC/B,QAAM,QAAQ,MAAM,OAAO,UAAU;AACrC,SAAO;AAAA,IACL,EAAE,MAAM;AAAA,IACR;AAAA,MACE,YAAY,QAAQ;AAAA,MACpB,aAAa,QAAQ;AAAA,MACrB,gBAAgB,QAAQ;AAAA,MACxB,UAAU,QAAQ;AAAA,MAClB,MAAM;AAAA,MACN,QAAQ,QAAQ;AAAA,MAChB,WAAW,QAAQ;AAAA,MACnB,aAAa,QAAQ,eAAe;AAAA,IACtC;AAAA,EACF;AACF;AAQA,eAAsB,kBAAkB,SAAiE;AACvG,QAAM,SAAS,IAAI,cAAc,QAAQ,MAAM;AAC/C,QAAM,YAAY,MAAM,qBAAqB,QAAQ,OAAO;AAC5D,SAAO,8BAA8B;AAAA,IACnC,IAAI,QAAQ;AAAA,IACZ,MAAM;AAAA,IACN,YAAY,CAAC,SAAS;AAAA,IACtB,MAAM,cAAc,EAAE,SAAS,OAAO,GAAqC;AACzE,YAAM,SAAS,MAAM,OAAO,SAAS,OAAO,IAAI,QAAQ,KAAK;AAC7D,aAAO;AAAA,QACL,IAAI,CAAC,OAAO;AAAA,QACZ,QAAQ,OAAO;AAAA,QACf,QAAQ,OAAO,cAAc,OAAO;AAAA,QACpC,UAAU,EAAE,KAAK,MAAM,GAAI,OAAO,UAAU,EAAE,SAAS,KAAK,IAAI,CAAC,EAAG;AAAA,MACtE;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEA,SAAS,gBAAgB,MAAc,IAAyC;AAC9E,aAAW,SAAS,KAAK,MAAM,MAAM,GAAG;AACtC,UAAM,OAAO,MACV,MAAM,IAAI,EACV,OAAO,CAAC,SAAS,KAAK,WAAW,OAAO,CAAC,EACzC,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,EAClC,KAAK,EAAE;AACV,QAAI,CAAC,KAAM;AACX,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,UAAI,OAAO,OAAO,GAAI,QAAO;AAAA,IAC/B,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;","names":[]}

package/dist/middleware/index.d.ts

@@ -1,5 +1,5 @@
-import { T as TangleIdentityOptions, b as TangleIdentityClient, c as TangleTokenVerifyFailure } from '../tangle-id-gFOGXe4Y.js';
-import '../types-DpKEBiX6.js';
+import { T as TangleIdentityOptions, b as TangleIdentityClient, c as TangleTokenVerifyFailure } from '../tangle-id-Oy2z4W3p.js';
+import '../types-DIis6QtV.js';
 
 /**
  * @stable Drop-in request middleware that verifies id.tangle.tools

package/dist/registry-core-DqdQjTkh.d.ts

@@ -0,0 +1,49 @@
+import { e as IntegrationConnector, i as IntegrationCatalogSource } from './core-types-DZJQRBya.js';
+
+type IntegrationSupportTier = 'catalogOnly' | 'setupReady' | 'gatewayExecutable' | 'firstPartyExecutable' | 'sandboxExecutable';
+interface IntegrationRegistrySourceRef {
+    sourceId: string;
+    providerId: string;
+    connectorId: string;
+    supportTier: IntegrationSupportTier;
+    actionCount: number;
+    triggerCount: number;
+}
+interface IntegrationRegistryConflict {
+    field: 'auth' | 'category';
+    values: Array<{
+        value: string;
+        sourceId: string;
+        connectorId: string;
+    }>;
+}
+interface IntegrationRegistryEntry {
+    canonicalId: string;
+    connector: IntegrationConnector;
+    aliases: string[];
+    supportTier: IntegrationSupportTier;
+    sources: IntegrationRegistrySourceRef[];
+    conflicts: IntegrationRegistryConflict[];
+}
+interface IntegrationRegistry {
+    entries: IntegrationRegistryEntry[];
+    connectors: IntegrationConnector[];
+    byId: Map<string, IntegrationRegistryEntry>;
+}
+interface IntegrationRegistrySummary {
+    totalEntries: number;
+    totalSources: number;
+    toolBindableEntries: number;
+    conflictEntries: number;
+    bySupportTier: Record<IntegrationSupportTier, number>;
+}
+interface ComposeIntegrationRegistryOptions {
+    aliases?: Record<string, string>;
+    sourcePrecedence?: Record<string, number>;
+}
+declare function composeIntegrationRegistry(sources: IntegrationCatalogSource[], options?: ComposeIntegrationRegistryOptions): IntegrationRegistry;
+declare function summarizeIntegrationRegistry(registry: IntegrationRegistry): IntegrationRegistrySummary;
+declare function canonicalConnectorId(id: string, aliases?: Record<string, string>): string;
+declare function inferIntegrationSupportTier(connector: IntegrationConnector): IntegrationSupportTier;
+
+export { type ComposeIntegrationRegistryOptions as C, type IntegrationSupportTier as I, type IntegrationRegistry as a, type IntegrationRegistryConflict as b, type IntegrationRegistryEntry as c, type IntegrationRegistrySourceRef as d, type IntegrationRegistrySummary as e, canonicalConnectorId as f, composeIntegrationRegistry as g, inferIntegrationSupportTier as i, summarizeIntegrationRegistry as s };

package/dist/registry.d.ts

@@ -1,47 +1,8 @@
-import { b as IntegrationConnector, h as IntegrationCatalogSource } from './core-types-A-xIaTzb.js';
-import './types-DpKEBiX6.js';
+import { e as IntegrationConnector } from './core-types-DZJQRBya.js';
+import { I as IntegrationSupportTier, a as IntegrationRegistry } from './registry-core-DqdQjTkh.js';
+export { C as ComposeIntegrationRegistryOptions, b as IntegrationRegistryConflict, c as IntegrationRegistryEntry, d as IntegrationRegistrySourceRef, e as IntegrationRegistrySummary, f as canonicalConnectorId, g as composeIntegrationRegistry, i as inferIntegrationSupportTier, s as summarizeIntegrationRegistry } from './registry-core-DqdQjTkh.js';
+import './types-DIis6QtV.js';
 
-type IntegrationSupportTier = 'catalogOnly' | 'setupReady' | 'gatewayExecutable' | 'firstPartyExecutable' | 'sandboxExecutable';
-interface IntegrationRegistrySourceRef {
-    sourceId: string;
-    providerId: string;
-    connectorId: string;
-    supportTier: IntegrationSupportTier;
-    actionCount: number;
-    triggerCount: number;
-}
-interface IntegrationRegistryConflict {
-    field: 'auth' | 'category';
-    values: Array<{
-        value: string;
-        sourceId: string;
-        connectorId: string;
-    }>;
-}
-interface IntegrationRegistryEntry {
-    canonicalId: string;
-    connector: IntegrationConnector;
-    aliases: string[];
-    supportTier: IntegrationSupportTier;
-    sources: IntegrationRegistrySourceRef[];
-    conflicts: IntegrationRegistryConflict[];
-}
-interface IntegrationRegistry {
-    entries: IntegrationRegistryEntry[];
-    connectors: IntegrationConnector[];
-    byId: Map<string, IntegrationRegistryEntry>;
-}
-interface IntegrationRegistrySummary {
-    totalEntries: number;
-    totalSources: number;
-    toolBindableEntries: number;
-    conflictEntries: number;
-    bySupportTier: Record<IntegrationSupportTier, number>;
-}
-interface ComposeIntegrationRegistryOptions {
-    aliases?: Record<string, string>;
-    sourcePrecedence?: Record<string, number>;
-}
 declare function buildDefaultIntegrationRegistry(options?: {
     includeSpecs?: boolean;
     includeTangleCatalog?: boolean;
@@ -68,11 +29,7 @@ interface IntegrationCatalogExecutability {
     triggerCount: number;
 }
 /** Classify every entry in a composed registry by executability + auth kind
- *  WITHOUT executing anything. Defaults to {@link buildDefaultIntegrationRegistry}. */
+ * WITHOUT executing anything. Defaults to {@link buildDefaultIntegrationRegistry}. */
 declare function classifyIntegrationCatalogExecutability(registry?: IntegrationRegistry): IntegrationCatalogExecutability[];
-declare function composeIntegrationRegistry(sources: IntegrationCatalogSource[], options?: ComposeIntegrationRegistryOptions): IntegrationRegistry;
-declare function summarizeIntegrationRegistry(registry: IntegrationRegistry): IntegrationRegistrySummary;
-declare function canonicalConnectorId(id: string, aliases?: Record<string, string>): string;
-declare function inferIntegrationSupportTier(connector: IntegrationConnector): IntegrationSupportTier;
 
-export { type ComposeIntegrationRegistryOptions, type IntegrationCatalogExecutability, type IntegrationRegistry, type IntegrationRegistryConflict, type IntegrationRegistryEntry, type IntegrationRegistrySourceRef, type IntegrationRegistrySummary, type IntegrationSupportTier, buildDefaultIntegrationRegistry, canonicalConnectorId, classifyIntegrationCatalogExecutability, composeIntegrationRegistry, inferIntegrationSupportTier, summarizeIntegrationRegistry };
+export { type IntegrationCatalogExecutability, IntegrationRegistry, IntegrationSupportTier, buildDefaultIntegrationRegistry, classifyIntegrationCatalogExecutability };

package/dist/registry.js

@@ -1,22 +1,28 @@
 import {
   buildDefaultIntegrationRegistry,
-  canonicalConnectorId,
-  classifyIntegrationCatalogExecutability,
-  composeIntegrationRegistry,
-  inferIntegrationSupportTier,
-  summarizeIntegrationRegistry
-} from "./chunk-ZC3ZE7TN.js";
+  classifyIntegrationCatalogExecutability
+} from "./chunk-A4OJ5EQT.js";
+import "./chunk-DED3J7F6.js";
 import "./chunk-PIF635BP.js";
 import "./chunk-PIEBVPSW.js";
 import "./chunk-H4XYLS7T.js";
 import "./chunk-ABWBYMCF.js";
-import "./chunk-2GEGKSL5.js";
-import "./chunk-TWR2KAZG.js";
-import "./chunk-P4FFI752.js";
-import "./chunk-E2QYXDJQ.js";
+import "./chunk-RSJRICPU.js";
+import "./chunk-ABA4HWIQ.js";
 import "./chunk-QL6CRJ3E.js";
 import "./chunk-XC54EOUQ.js";
 import "./chunk-DCSQH4O6.js";
+import "./chunk-QVWTBQXP.js";
+import {
+  canonicalConnectorId,
+  composeIntegrationRegistry,
+  inferIntegrationSupportTier,
+  summarizeIntegrationRegistry
+} from "./chunk-WPQJK4S4.js";
+import "./chunk-QWOX5SIM.js";
+import "./chunk-MH4IEJCL.js";
+import "./chunk-GIK6EXU2.js";
+import "./chunk-ESY2FBBM.js";
 import "./chunk-PZ5AY32C.js";
 export {
   buildDefaultIntegrationRegistry,

package/dist/runtime.d.ts

@@ -1,7 +1,7 @@
 import { IntegrationToolDefinition } from './catalog.js';
-import { IntegrationRegistryEntry, IntegrationRegistry } from './registry.js';
-import { I as IntegrationActor, a as IssuedIntegrationCapability, b as IntegrationConnector, c as IntegrationConnection } from './core-types-A-xIaTzb.js';
-import './types-DpKEBiX6.js';
+import { I as IntegrationActor, f as IssuedIntegrationCapability, e as IntegrationConnector, d as IntegrationConnection } from './core-types-DZJQRBya.js';
+import { c as IntegrationRegistryEntry, a as IntegrationRegistry } from './registry-core-DqdQjTkh.js';
+import './types-DIis6QtV.js';
 
 type IntegrationRequirementMode = 'read' | 'write' | 'trigger';
 type IntegrationRequirementStatus = 'ready' | 'missing_connection' | 'not_executable' | 'unknown_connector';

package/dist/runtime.js

@@ -2,18 +2,9 @@ import {
   InMemoryIntegrationGrantStore,
   IntegrationRuntime,
   createIntegrationRuntime
-} from "./chunk-ZC3ZE7TN.js";
-import "./chunk-PIF635BP.js";
-import "./chunk-PIEBVPSW.js";
-import "./chunk-H4XYLS7T.js";
-import "./chunk-ABWBYMCF.js";
-import "./chunk-2GEGKSL5.js";
-import "./chunk-TWR2KAZG.js";
-import "./chunk-P4FFI752.js";
-import "./chunk-E2QYXDJQ.js";
-import "./chunk-QL6CRJ3E.js";
-import "./chunk-XC54EOUQ.js";
-import "./chunk-DCSQH4O6.js";
+} from "./chunk-QVWTBQXP.js";
+import "./chunk-WPQJK4S4.js";
+import "./chunk-ESY2FBBM.js";
 import "./chunk-PZ5AY32C.js";
 export {
   InMemoryIntegrationGrantStore,

package/dist/specs.d.ts

@@ -1,5 +1,5 @@
-import { f as IntegrationActionRisk, g as IntegrationDataClass, d as IntegrationConnectorCategory, e as IntegrationConnectorAction, G as IntegrationConnectorTrigger, b as IntegrationConnector } from './core-types-A-xIaTzb.js';
-import { O as OAuth2TokenClientAuthMethod, p as OAuth2UrlTemplateMetadataSpec } from './types-DpKEBiX6.js';
+import { h as IntegrationActionRisk, b as IntegrationDataClass, g as IntegrationConnectorCategory, a as IntegrationConnectorAction, G as IntegrationConnectorTrigger, e as IntegrationConnector } from './core-types-DZJQRBya.js';
+import { O as OAuth2TokenClientAuthMethod, p as OAuth2UrlTemplateMetadataSpec } from './types-DIis6QtV.js';
 
 type IntegrationAuthMode = 'oauth2' | 'api_key' | 'hmac' | 'none' | 'custom';
 type IntegrationSpecStatus = 'catalog' | 'executable' | 'deprecated';

package/dist/specs.js

@@ -16,12 +16,10 @@ import {
   validateCredentialFormat,
   validateCredentialSet,
   validateIntegrationSpec
-} from "./chunk-2GEGKSL5.js";
-import "./chunk-TWR2KAZG.js";
-import "./chunk-E2QYXDJQ.js";
-import "./chunk-QL6CRJ3E.js";
-import "./chunk-XC54EOUQ.js";
-import "./chunk-DCSQH4O6.js";
+} from "./chunk-QWOX5SIM.js";
+import "./chunk-MH4IEJCL.js";
+import "./chunk-GIK6EXU2.js";
+import "./chunk-ESY2FBBM.js";
 import "./chunk-PZ5AY32C.js";
 export {
   INTEGRATION_FAMILIES,

package/dist/{tangle-id-gFOGXe4Y.d.ts → tangle-id-Oy2z4W3p.d.ts}

@@ -1,4 +1,4 @@
-import { C as ConnectorAdapter } from './types-DpKEBiX6.js';
+import { C as ConnectorAdapter } from './types-DIis6QtV.js';
 
 /**
  * @stable Tangle Identity — `id.tangle.tools` connector + verifier.

package/dist/{types-DpKEBiX6.d.ts → types-DIis6QtV.d.ts}

@@ -539,4 +539,4 @@ interface ConnectorManifestValidationResult {
 declare function validateConnectorManifest(manifest: ConnectorManifest): ConnectorManifestValidationResult;
 declare function assertValidConnectorManifest(manifest: ConnectorManifest): void;
 
-export { type AuthSpec as A, type ConnectorAdapter as C, type DataSourceMetadata as D, type EventHandlerResult as E, type InboundEvent as I, type OAuth2TokenClientAuthMethod as O, ProviderConfigError as P, type ResolvedDataSource as R, type TokenMetadataSource as T, type ConnectorCredentials as a, type CASStrategy as b, type Capability as c, type CapabilityClass as d, type CapabilityMutation as e, type CapabilityMutationResult as f, type CapabilityParameterSchema as g, type CapabilityRead as h, type CapabilityReadResult as i, type ConnectorInvocation as j, type ConnectorManifest as k, type ConnectorManifestValidationIssue as l, type ConnectorManifestValidationResult as m, type ConsistencyModel as n, CredentialsExpired as o, type OAuth2UrlTemplateMetadataSpec as p, type ProviderHttpErrorInit as q, ProviderRateLimited as r, type ProviderRateLimitedInit as s, type RateLimitSpec as t, ResourceContention as u, assertValidConnectorManifest as v, validateConnectorManifest as w };
+export { type AuthSpec as A, type ConnectorAdapter as C, type DataSourceMetadata as D, type EventHandlerResult as E, type InboundEvent as I, type OAuth2TokenClientAuthMethod as O, ProviderConfigError as P, type ResolvedDataSource as R, type TokenMetadataSource as T, type ConnectorManifest as a, type ConnectorCredentials as b, type CASStrategy as c, type Capability as d, type CapabilityClass as e, type CapabilityMutation as f, type CapabilityMutationResult as g, type CapabilityParameterSchema as h, type CapabilityRead as i, type CapabilityReadResult as j, type ConnectorInvocation as k, type ConnectorManifestValidationIssue as l, type ConnectorManifestValidationResult as m, type ConsistencyModel as n, CredentialsExpired as o, type OAuth2UrlTemplateMetadataSpec as p, type ProviderHttpErrorInit as q, ProviderRateLimited as r, type ProviderRateLimitedInit as s, type RateLimitSpec as t, ResourceContention as u, assertValidConnectorManifest as v, validateConnectorManifest as w };

package/dist/worker.d.ts

@@ -0,0 +1,99 @@
+import { c as IntegrationActionGuard, m as IntegrationActionResult, p as IntegrationGuardContext, h as IntegrationActionRisk, b as IntegrationDataClass, n as IntegrationPolicyEngine, q as IntegrationPolicyDecision, o as IntegrationApprovalRequest } from './core-types-DZJQRBya.js';
+export { C as CompleteAuthRequest, H as HttpIntegrationProviderOptions, l as IntegrationActionRequest, I as IntegrationActor, D as IntegrationCapability, i as IntegrationCatalogSource, d as IntegrationConnection, s as IntegrationConnectionStore, e as IntegrationConnector, a as IntegrationConnectorAction, g as IntegrationConnectorCategory, G as IntegrationConnectorTrigger, t as IntegrationCredentialsRotatedEvent, E as IntegrationHubOptions, v as IntegrationOAuthState, w as IntegrationOAuthStateOutcome, u as IntegrationOAuthStateStore, k as IntegrationProvider, j as IntegrationProviderKind, r as IntegrationSecretStore, y as IntegrationTriggerEvent, x as IntegrationTriggerSubscription, B as InvokeWithCapabilityRequest, F as IssueCapabilityRequest, f as IssuedIntegrationCapability, S as SecretRef, z as StartAuthRequest, A as StartAuthResult } from './core-types-DZJQRBya.js';
+import { I as IntegrationAuditSink } from './audit-DMTzJQJU.js';
+export { a as InMemoryIntegrationAuditStore, b as IntegrationAuditEvent, c as IntegrationAuditEventType, d as IntegrationAuditFilter, e as IntegrationAuditStore, f as createAuditingActionGuard, g as createIntegrationAuditEvent, s as sanitizeAuditConnection } from './audit-DMTzJQJU.js';
+import './types-DIis6QtV.js';
+
+interface IntegrationIdempotencyRecord {
+    key: string;
+    requestHash: string;
+    result: IntegrationActionResult;
+    createdAt: string;
+}
+interface IntegrationIdempotencyStore {
+    get(key: string): Promise<IntegrationIdempotencyRecord | undefined> | IntegrationIdempotencyRecord | undefined;
+    put(record: IntegrationIdempotencyRecord): Promise<void> | void;
+}
+interface IntegrationRateLimitDecision {
+    allowed: boolean;
+    retryAfterMs?: number;
+    reason?: string;
+}
+interface IntegrationRateLimiter {
+    check(ctx: IntegrationGuardContext): Promise<IntegrationRateLimitDecision> | IntegrationRateLimitDecision;
+}
+declare class InMemoryIntegrationIdempotencyStore implements IntegrationIdempotencyStore {
+    private readonly records;
+    get(key: string): IntegrationIdempotencyRecord | undefined;
+    put(record: IntegrationIdempotencyRecord): void;
+}
+declare class DefaultIntegrationActionGuard implements IntegrationActionGuard {
+    private readonly idempotency;
+    private readonly audit;
+    private readonly rateLimiter;
+    private readonly requireIdempotencyForMutations;
+    private readonly now;
+    constructor(options?: {
+        idempotency?: IntegrationIdempotencyStore;
+        audit?: IntegrationAuditSink;
+        rateLimiter?: IntegrationRateLimiter;
+        requireIdempotencyForMutations?: boolean;
+        now?: () => Date;
+    });
+    invokeAction(ctx: IntegrationGuardContext, proceed: () => Promise<IntegrationActionResult>): Promise<IntegrationActionResult>;
+    private writeIdempotency;
+}
+declare function createDefaultIntegrationActionGuard(options?: ConstructorParameters<typeof DefaultIntegrationActionGuard>[0]): DefaultIntegrationActionGuard;
+
+type IntegrationPolicyEffect = 'allow' | 'require_approval' | 'deny';
+interface IntegrationPolicyRule {
+    id: string;
+    effect: IntegrationPolicyEffect;
+    reason: string;
+    providerId?: string;
+    connectorId?: string;
+    action?: string;
+    maxRisk?: IntegrationActionRisk;
+    risk?: IntegrationActionRisk;
+    dataClass?: IntegrationDataClass;
+}
+interface StaticIntegrationPolicyOptions {
+    rules?: IntegrationPolicyRule[];
+    defaultReadEffect?: IntegrationPolicyEffect;
+    defaultWriteEffect?: IntegrationPolicyEffect;
+    defaultDestructiveEffect?: IntegrationPolicyEffect;
+    now?: () => Date;
+}
+interface IntegrationApprovalResolution {
+    approvalId: string;
+    approved: boolean;
+    resolvedBy: string;
+    resolvedAt: string;
+    reason?: string;
+    metadata?: Record<string, unknown>;
+}
+declare class StaticIntegrationPolicyEngine implements IntegrationPolicyEngine {
+    private readonly rules;
+    private readonly defaultReadEffect;
+    private readonly defaultWriteEffect;
+    private readonly defaultDestructiveEffect;
+    private readonly now;
+    constructor(options?: StaticIntegrationPolicyOptions);
+    decide(ctx: IntegrationGuardContext & {
+        subject: {
+            type: string;
+            id: string;
+        };
+    }): IntegrationPolicyDecision;
+    private defaultEffect;
+}
+declare function createDefaultIntegrationPolicyEngine(options?: Omit<StaticIntegrationPolicyOptions, 'rules'>): StaticIntegrationPolicyEngine;
+declare function buildApprovalRequest(ctx: IntegrationGuardContext & {
+    subject: {
+        type: string;
+        id: string;
+    };
+}, reason: string, requestedAt: Date): IntegrationApprovalRequest;
+declare function redactApprovalRequest(request: IntegrationApprovalRequest): IntegrationApprovalRequest;
+
+export { DefaultIntegrationActionGuard, InMemoryIntegrationIdempotencyStore, IntegrationActionGuard, IntegrationActionResult, IntegrationActionRisk, IntegrationApprovalRequest, type IntegrationApprovalResolution, IntegrationAuditSink, IntegrationDataClass, IntegrationGuardContext, type IntegrationIdempotencyRecord, type IntegrationIdempotencyStore, IntegrationPolicyDecision, type IntegrationPolicyEffect, IntegrationPolicyEngine, type IntegrationPolicyRule, type IntegrationRateLimitDecision, type IntegrationRateLimiter, StaticIntegrationPolicyEngine, type StaticIntegrationPolicyOptions, buildApprovalRequest, createDefaultIntegrationActionGuard, createDefaultIntegrationPolicyEngine, redactApprovalRequest };

package/dist/worker.js

@@ -0,0 +1,28 @@
+import {
+  DefaultIntegrationActionGuard,
+  InMemoryIntegrationAuditStore,
+  InMemoryIntegrationIdempotencyStore,
+  StaticIntegrationPolicyEngine,
+  buildApprovalRequest,
+  createAuditingActionGuard,
+  createDefaultIntegrationActionGuard,
+  createDefaultIntegrationPolicyEngine,
+  createIntegrationAuditEvent,
+  redactApprovalRequest,
+  sanitizeAuditConnection
+} from "./chunk-RSJRICPU.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  DefaultIntegrationActionGuard,
+  InMemoryIntegrationAuditStore,
+  InMemoryIntegrationIdempotencyStore,
+  StaticIntegrationPolicyEngine,
+  buildApprovalRequest,
+  createAuditingActionGuard,
+  createDefaultIntegrationActionGuard,
+  createDefaultIntegrationPolicyEngine,
+  createIntegrationAuditEvent,
+  redactApprovalRequest,
+  sanitizeAuditConnection
+};
+//# sourceMappingURL=worker.js.map

package/dist/worker.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/docs/repo-structure.md

@@ -20,17 +20,24 @@ This repo intentionally separates catalog breadth from executable runtime code.
   `src/audit.ts`, `src/healthcheck.ts`, `src/credentials.ts`, and
   `src/events.ts` are production control-plane primitives.
 - `src/connectors/` contains first-party adapter contracts and implementations.
+- `src/connectors/bundled-manifest-data.ts` contains the static manifest snapshot;
+  `src/connectors/bundled-manifests.ts` keeps runtime adapter discovery separate.
 - `src/specs/` is the structured OAuth/setup/runbook source of truth.
-- `src/registry.ts`, `src/gateway-catalog.ts`, `src/coverage-catalog.ts`, and
-  `src/tangle-catalog.ts` compose broad connector catalogs while keeping
-  execution behind configured native, gateway, or sandbox runtimes.
+- `src/registry-core.ts`, `src/registry.ts`, `src/gateway-catalog.ts`,
+  `src/coverage-catalog.ts`, and `src/tangle-catalog.ts` compose broad connector
+  catalogs while keeping execution behind configured native, gateway, or
+  sandbox runtimes.
+- `src/worker.ts` is the Worker-safe entry point for guard, audit, policy, and
+  core contracts.
+- `src/web-crypto.ts` provides the Web Crypto hashing and UUID helpers used by
+  the Worker-safe security primitives.
 
 ## Data
 
-- Imported catalog JSON is large by design. It is lazy-loaded and keeps
+- Imported catalog JSON is large by design. Data-only runtime modules keep
   long-tail discovery out of TypeScript source so `tsc --watch` does not
-  re-check a generated 40k-line module. It is catalog metadata, not executable
-  support.
+  re-check a generated 40k-line module. Bundled `/specs` and `/catalog` data
+  does not import executable adapters or their Node-only clients.
 
 ## Build Artifacts
 
@@ -38,6 +45,22 @@ This repo intentionally separates catalog breadth from executable runtime code.
   files to npm.
 - `node_modules/` is local development state and is not published.
 
+## Release Checks
+
+- `scripts/generate-bundled-manifest-data.mjs` writes the adapter manifest
+  snapshot from the built runtime registry.
+- `scripts/check-bundled-manifest-freshness.mjs` rejects stale snapshots during
+  `prepack` and in the publish workflow.
+- `scripts/release.mjs` is the lifecycle-independent release entry point.
+  It builds, generates into a temporary file, checks freshness, packs one exact
+  archive, tests that archive, and publishes it only when `--publish` is set.
+  It skips an existing version only when the registry integrity matches the
+  tested archive.
+- `scripts/test-release-artifact.mjs` verifies the metadata, exports, bundled
+  manifest freshness, and Worker entry point inside the exact archive.
+- `tests/worker-safe-bundles.test.ts` packs the npm artifact and verifies the
+  `/worker`, `/specs`, and `/catalog` exports as browser bundles.
+
 ## Docs
 
 - `docs/production-completion-checklist.md` defines what this package owns and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-integrations",
-  "version": "0.53.53",
+  "version": "0.53.54",
   "description": "Vendor-neutral integration contracts and runtime helpers for sandbox and agent apps.",
   "homepage": "https://github.com/tangle-network/agent-integrations#readme",
   "repository": {
@@ -24,6 +24,11 @@
       "import": "./dist/catalog.js",
       "default": "./dist/catalog.js"
     },
+    "./worker": {
+      "types": "./dist/worker.d.ts",
+      "import": "./dist/worker.js",
+      "default": "./dist/worker.js"
+    },
     "./connectors": {
       "types": "./dist/connectors/index.d.ts",
       "import": "./dist/connectors/index.js",
@@ -109,6 +114,7 @@
     "@types/node": "^26.1.2",
     "@types/pg": "8.20.0",
     "@types/ssh2-sftp-client": "9.0.6",
+    "esbuild": "0.28.1",
     "tsup": "^8.0.0",
     "typescript": "^5.9.3",
     "vite": "^8.1.5",
@@ -138,7 +144,10 @@
   },
   "scripts": {
     "build": "tsup",
+    "generate:bundled-manifests": "pnpm build && node scripts/generate-bundled-manifest-data.mjs && pnpm build",
+    "check:bundled-manifest-freshness": "node scripts/check-bundled-manifest-freshness.mjs",
     "dev": "tsup --watch",
+    "release": "node scripts/release.mjs",
     "audit:execution": "pnpm build >/dev/null && node scripts/audit-integration-execution.mjs",
     "test": "vitest run",
     "test:watch": "vitest",