@tangle-network/agent-integrations 0.58.0 → 0.59.1

package/dist/index-j2QziJA5.d.ts

@@ -1,263 +0,0 @@
-import { S as OAuth2UrlTemplateMetadataSpec, p as ConnectorManifest, x as OAuth2TokenClientAuthMethod } from "./types-CauVC-Gr.js";
-import "./index-CDVPZuIY.js";
-//#region src/connectors/oauth.d.ts
-type OAuthPkceMode = 'required' | 'supported' | 'unsupported';
-interface PendingOAuthFlow {
-  /** code_verifier for PKCE. Absent when the provider rejects PKCE. */
-  codeVerifier?: string;
-  /** Opaque-state value also returned in the OAuth redirect. */
-  state: string;
-  /** Project the user is connecting under. */
-  projectId: string;
-  /** Connector kind (e.g. 'google-calendar'). */
-  kind: string;
-  /** Operator-supplied label that becomes DataSource.label. */
-  label: string;
-  /** When we drop the entry. */
-  expiresAt: number;
-  /** The redirectUri we used in the start step — must match exactly on
-   *  the callback exchange. */
-  redirectUri: string;
-}
-interface OAuthFlowStore {
-  put(state: string, flow: PendingOAuthFlow): Promise<void> | void;
-  consume(state: string): Promise<PendingOAuthFlow | undefined> | PendingOAuthFlow | undefined;
-  sweep?(now: number): Promise<void> | void;
-  clear?(): Promise<void> | void;
-}
-declare class InMemoryOAuthFlowStore implements OAuthFlowStore {
-  private readonly pendingFlows;
-  put(state: string, flow: PendingOAuthFlow): void;
-  consume(state: string): PendingOAuthFlow | undefined;
-  sweep(now: number): void;
-  clear(): void;
-}
-interface StartOAuthInput {
-  projectId: string;
-  kind: string;
-  label: string;
-  authorizationUrl: string;
-  scopes: string[];
-  /** OAuth defaults to spaces; set `,` for providers such as Zoho. */
-  scopeSeparator?: ' ' | ',';
-  clientId: string;
-  /** Authorization query parameter for the client id. Defaults to
-   *  `client_id`; TikTok uses `client_key`. */
-  authorizationClientIdParam?: string;
-  /** PKCE posture. Defaults to required to preserve the existing safe flow. */
-  pkce?: OAuthPkceMode;
-  redirectUri: string;
-  /** Optional extra query params; Google needs `access_type=offline` and
-   *  `prompt=consent` to issue refresh tokens reliably. */
-  extraAuthParams?: Record<string, string>;
-  /** Optional flow store. Use a durable store in distributed production
-   *  runtimes; omitted means local in-memory storage. */
-  store?: OAuthFlowStore;
-  /** Override clock for tests. */
-  now?: number;
-}
-interface StartOAuthOutput {
-  /** URL the SPA should redirect the user to. */
-  authorizationUrl: string;
-  /** State token — caller stashes this in localStorage to verify on
-   *  callback. */
-  state: string;
-}
-/** Build the authorization URL + state. SPA navigates the user there;
- *  user consents; provider redirects back to redirectUri with `code` +
- *  `state`. The caller's callback then invokes `consumePendingFlow`. */
-declare function startOAuthFlow(input: StartOAuthInput): StartOAuthOutput;
-/** Look up + remove the pending flow record. Throws if state is unknown
- *  or expired (CSRF guard / replay protection). */
-declare function consumePendingFlow(state: string, store?: OAuthFlowStore): Promise<PendingOAuthFlow>;
-interface ExchangeCodeInput {
-  tokenUrl: string;
-  clientId: string;
-  /** Required unless tokenClientAuthMethod is `none`. */
-  clientSecret?: string;
-  /** Defaults to client_secret_post for backward compatibility. */
-  tokenClientAuthMethod?: OAuth2TokenClientAuthMethod;
-  tokenClientIdParam?: string;
-  tokenClientSecretParam?: string;
-  code: string;
-  /** Required unless pkce is explicitly unsupported. */
-  codeVerifier?: string;
-  /** PKCE posture. Defaults to required. */
-  pkce?: OAuthPkceMode;
-  redirectUri: string;
-  /** Non-secret provider identification headers for the token request. */
-  tokenRequestHeaders?: Readonly<Record<string, string>>;
-  fetchImpl?: typeof fetch;
-  signal?: AbortSignal;
-}
-interface OAuthTokens {
-  accessToken: string;
-  refreshToken?: string;
-  expiresIn?: number;
-  scope?: string;
-  tokenType?: string;
-  /** OpenID Connect identity token returned when the connector requests
-   *  `openid`. Kept separate from the access credential so adapters can
-   *  capture stable account metadata without persisting the ID token. */
-  idToken?: string;
-}
-/** POST authorization code → token endpoint. Provider-agnostic; if a
- *  provider returns a non-standard JSON shape, the adapter wraps this
- *  call rather than reaching into the helper. */
-declare function exchangeAuthorizationCode(input: ExchangeCodeInput): Promise<OAuthTokens>;
-interface RefreshInput {
-  tokenUrl: string;
-  clientId: string;
-  /** Required unless tokenClientAuthMethod is `none`. */
-  clientSecret?: string;
-  /** Defaults to client_secret_post for backward compatibility. */
-  tokenClientAuthMethod?: OAuth2TokenClientAuthMethod;
-  tokenClientIdParam?: string;
-  tokenClientSecretParam?: string;
-  refreshToken: string;
-  /** Non-secret provider identification headers for the token request. */
-  tokenRequestHeaders?: Readonly<Record<string, string>>;
-  fetchImpl?: typeof fetch;
-  signal?: AbortSignal;
-}
-/** Refresh an access token. Returns the new tokens — the connector layer
- *  is responsible for re-encrypting + persisting the envelope. */
-declare function refreshAccessToken(input: RefreshInput): Promise<OAuthTokens>;
-/** Build token-endpoint headers without permitting an adapter-supplied value
- *  to replace the authentication or form-media-type headers owned here. */
-declare function createOAuthTokenRequestHeaders(additional?: Readonly<Record<string, string>>): Record<string, string>;
-declare function formEncodeOAuthClientCredential(value: string): string;
-declare function createOAuthBasicAuthorizationHeader(clientId: string, clientSecret: string, encodeBase64?: (value: string) => string): string;
-declare function oauthClientCredentialRedactionValues(clientId: string, clientSecret?: string, authorization?: string): string[];
-declare function redactOAuthSensitiveText(text: string, secrets: readonly string[]): string;
-/** Test-only — drop pending flows between unit-test runs. */
-declare function _resetPendingFlowsForTests(): void;
-//#endregion
-//#region src/connectors/webhooks.d.ts
-/**
- * Inbound webhook signature verifiers — provider-specific HMAC schemes.
- *
- * Each signature scheme is a pure function:
- *   (rawBody: string, headers, secret, now?) → boolean
- *
- * Constant-time comparison via `crypto.timingSafeEqual`. Timestamps are
- * checked against a configurable tolerance to bound replay risk; the default
- * mirrors the upstream provider's documented window (Stripe: 5 min, Slack: 5 min).
- *
- * These verifiers are the building blocks for any inbound-webhook receiver
- * (a route + a `verify` call + a per-event handler). They live in this
- * package so every consumer of the integration substrate gets correct
- * verification — not just one product reimplementing it.
- */
-/** Default replay-protection window. Providers commonly use 5 minutes. */
-declare const DEFAULT_SIGNATURE_TOLERANCE_SECONDS: number;
-interface ParsedStripeSignatureHeader {
-  t: number;
-  sigs: string[];
-}
-declare function parseStripeSignatureHeader(header: string): ParsedStripeSignatureHeader | null;
-interface StripeVerifyOptions {
-  /** Replay-protection window in seconds. Default 300. */
-  toleranceSeconds?: number;
-  /** Override `now()` for tests. UTC seconds. */
-  now?: number;
-}
-/** Verify a Stripe webhook signature against the raw request body. */
-declare function verifyStripeSignature(rawBody: string, signatureHeader: string, secret: string, options?: StripeVerifyOptions): boolean;
-interface SlackVerifyOptions {
-  toleranceSeconds?: number;
-  now?: number;
-}
-declare function verifySlackSignature(rawBody: string, signatureHeader: string, timestampHeader: string, secret: string, options?: SlackVerifyOptions): boolean;
-interface GenericHmacVerifyOptions {
-  /** sha256 (default) | sha1 | sha512 — matches the algorithm the receiver
-   *  computed at sign time. */
-  algorithm?: 'sha256' | 'sha1' | 'sha512';
-  /** Optional prefix the receiver prepends to the signature in the header
-   *  (e.g., `'sha256='`). Stripped before constant-time comparison. */
-  signaturePrefix?: string;
-  /** Lowercase comparison (most providers emit hex-lowercase). Default true. */
-  lowercaseHex?: boolean;
-}
-declare function verifyHmacSignature(rawBody: string, signatureHeader: string, secret: string, options?: GenericHmacVerifyOptions): boolean;
-interface TwilioVerifyOptions {
-  /** Skip verification when the auth token isn't configured. Useful in
-   *  dev where the receiver wants to accept any payload. Default `false`
-   *  — production should always require a configured token. */
-  skipWhenAuthTokenMissing?: boolean;
-  /** When true, sign the raw body instead of the URL-encoded sorted-params
-   *  reduction. Twilio uses raw-body signing for `application/json`
-   *  webhook bodies. Default `false`. */
-  bodyAsRaw?: boolean;
-  /** When `bodyAsRaw` is true, the raw body to sign. Ignored otherwise. */
-  rawBody?: string;
-}
-/** Verify a Twilio webhook signature. */
-declare function verifyTwilioSignature(input: {
-  authToken: string | null | undefined;
-  signatureHeader: string | string[] | undefined;
-  fullUrl: string | null | undefined;
-  params: Record<string, string> | undefined;
-}, options?: TwilioVerifyOptions): boolean;
-interface EmailVerifyOptions {
-  /** Replay-protection window in seconds. Default 300. */
-  toleranceSeconds?: number;
-  /** Override `now()` for tests. UTC seconds. */
-  now?: number;
-}
-/** Verify a Tangle inbound-email signature against the raw request body. */
-declare function verifyEmailSignature(rawBody: string, signatureHeader: string, timestampHeader: string, secret: string, options?: EmailVerifyOptions): boolean;
-declare function firstHeader(headers: Record<string, string | string[] | undefined>, name: string): string | undefined;
-//#endregion
-//#region src/connectors/bundled-manifest-data.d.ts
-/** Every connector manifest this package bundles, sorted by kind. */
-declare function listBundledAdapterManifests(): ConnectorManifest[];
-/** The bundled manifest for `kind`, or undefined when nothing implements it. */
-declare function getBundledAdapterManifest(kind: string): ConnectorManifest | undefined;
-/** Whether this package ships a real, executable adapter for `kind`. */
-declare function hasBundledAdapter(kind: string): boolean;
-/** Kinds this package implements. */
-declare function listBundledAdapterKinds(): string[];
-/**
- * How a bundled connector really authenticates.
- *
- * `oauth2_client_credentials` is called out separately because it IS a
- * connectable mode but has no user-facing authorize step — a caller that
- * treats "oauth2 without an authorizationUrl" as broken would wrongly
- * condemn these machine-to-machine providers.
- */
-type BundledAuthMode = 'oauth2' | 'oauth2_client_credentials' | 'api_key' | 'hmac' | 'none';
-/** The auth mode a connect flow would actually drive for this manifest,
- * resolving `one_of` through its declared `preferred` mode. */
-declare function bundledAuthMode(manifest: ConnectorManifest): BundledAuthMode | undefined;
-/** The setup hint an api-key connector shows when collecting its credential. */
-declare function bundledApiKeyHint(manifest: ConnectorManifest): string | undefined;
-interface BundledOAuth2AuthContract {
-  grantType: 'authorization_code' | 'client_credentials';
-  authorizationUrl?: string;
-  tokenUrl: string;
-  scopes: string[];
-  clientIdEnv: string;
-  clientSecretEnv?: string;
-  scopeSeparator: ' ' | ',';
-  pkce?: 'required' | 'supported' | 'unsupported';
-  authorizationClientIdParam: string;
-  tokenClientIdParam: string;
-  tokenClientSecretParam: string;
-  tokenClientAuthMethod: 'none' | 'client_secret_post' | 'client_secret_basic';
-  sendScopeParam?: boolean;
-  extraAuthParams?: Record<string, string>;
-  tokenRequestHeaders?: Record<string, string>;
-  urlTemplateMetadata?: Readonly<Record<string, OAuth2UrlTemplateMetadataSpec>>;
-}
-/** The selected OAuth2 contract for a manifest, including non-redirect
- * client-credentials providers and validated provider-root templates. */
-declare function bundledOAuth2AuthContract(manifest: ConnectorManifest): BundledOAuth2AuthContract | undefined;
-/** The authorization-code OAuth2 branch of a manifest, if it has one. */
-declare function bundledOAuth2Auth(manifest: ConnectorManifest): (BundledOAuth2AuthContract & {
-  grantType: 'authorization_code';
-  authorizationUrl: string;
-}) | undefined;
-//#endregion
-export { PendingOAuthFlow as A, oauthClientCredentialRedactionValues as B, verifyStripeSignature as C, OAuthFlowStore as D, InMemoryOAuthFlowStore as E, consumePendingFlow as F, refreshAccessToken as H, createOAuthBasicAuthorizationHeader as I, createOAuthTokenRequestHeaders as L, StartOAuthInput as M, StartOAuthOutput as N, OAuthPkceMode as O, _resetPendingFlowsForTests as P, exchangeAuthorizationCode as R, verifySlackSignature as S, ExchangeCodeInput as T, startOAuthFlow as U, redactOAuthSensitiveText as V, TwilioVerifyOptions as _, bundledOAuth2Auth as a, verifyEmailSignature as b, hasBundledAdapter as c, DEFAULT_SIGNATURE_TOLERANCE_SECONDS as d, EmailVerifyOptions as f, StripeVerifyOptions as g, SlackVerifyOptions as h, bundledAuthMode as i, RefreshInput as j, OAuthTokens as k, listBundledAdapterKinds as l, ParsedStripeSignatureHeader as m, BundledOAuth2AuthContract as n, bundledOAuth2AuthContract as o, GenericHmacVerifyOptions as p, bundledApiKeyHint as r, getBundledAdapterManifest as s, BundledAuthMode as t, listBundledAdapterManifests as u, firstHeader as v, verifyTwilioSignature as w, verifyHmacSignature as x, parseStripeSignatureHeader as y, formEncodeOAuthClientCredential as z };
-//# sourceMappingURL=index-j2QziJA5.d.ts.map

package/dist/index-j2QziJA5.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index-j2QziJA5.d.ts","names":[],"sources":["../src/connectors/oauth.ts","../src/connectors/webhooks.ts","../src/connectors/bundled-manifest-data.ts"],"mappings":";;;KAkBY;UAEK;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;;EAGA;;UAKe;EACf,IAAI,eAAe,MAAM,mBAAmB;EAC5C,QAAQ,gBAAgB,QAAQ,gCAAgC;EAChE,OAAO,cAAc;EACrB,UAAU;;cAGC,kCAAkC;mBAC5B;EAEjB,IAAI,eAAe,MAAM;EAIzB,QAAQ,gBAAgB;EAOxB,MAAM;EAMN;;UAOe;EACf;EACA;EACA;EACA;EACA;;EAEA;EACA;;;EAGA;;EAEA,OAAO;EACP;;;EAGA,kBAAkB;;;EAGlB,QAAQ;;EAER;;UAGe;;EAEf;;;EAGA;;;;;iBAMc,eAAe,OAAO,kBAAkB;;;iBA+ClC,mBAAmB,eAAe,QAAO,iBAAoC,QAAQ;UAS1F;EACf;EACA;;EAEA;;EAEA,wBAAwB;EACxB;EACA;EACA;;EAEA;;EAEA,OAAO;EACP;;EAEA,sBAAsB,SAAS;EAC/B,mBAAmB;EACnB,SAAS;;UAGM;EACf;EACA;EACA;EACA;EACA;;;;EAIA;;;;;iBAMoB,0BAA0B,OAAO,oBAAoB,QAAQ;UAoElE;EACf;EACA;;EAEA;;EAEA,wBAAwB;EACxB;EACA;EACA;;EAEA,sBAAsB,SAAS;EAC/B,mBAAmB;EACnB,SAAS;;;;iBAKW,mBAAmB,OAAO,eAAe,QAAQ;;;iBA+DvD,+BACd,aAAa,SAAS,0BACrB;iBAQa,gCAAgC;iBAIhC,oCACd,kBACA,sBACA,gBAAe;iBAiBD,qCACd,kBACA,uBACA;iBAgBc,yBACd,cACA;;iBA8Hc;;;;;;;;;;;;;;;;;;;cCjgBH;UAcI;EACf;EACA;;iBAGc,2BAA2B,iBAAiB;UAkB3C;;EAEf;;EAEA;;;iBAIc,sBACd,iBACA,yBACA,gBACA,UAAS;UA0BM;EACf;EACA;;iBAGc,qBACd,iBACA,yBACA,yBACA,gBACA,UAAS;UAuBM;;;EAGf;;;EAGA;;EAEA;;iBAGc,oBACd,iBACA,yBACA,gBACA,UAAS;UAqCM;;;;EAIf;;;;EAIA;;EAEA;;;iBAIc,sBACd;EACE;EACA;EACA;EACA,QAAQ;GAEV,UAAS;UAkCM;;EAEf;;EAEA;;;iBAIc,qBACd,iBACA,yBACA,yBACA,gBACA,UAAS;iBAoBK,YACd,SAAS,+CACT;;;;iBCrPc,+BAA+B;;iBAK/B,0BAA0B,eAAe;;iBAKzC,kBAAkB;;iBAKlB;;;;;;;;;KAYJ;;;iBASI,gBAAgB,UAAU,oBAAoB;;iBAqB9C,kBAAkB,UAAU;UAS3B;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,kBAAkB;EAClB,sBAAsB;EACtB,sBAAsB,SAAS,eAAe;;;;iBAKhC,0BACd,UAAU,oBACT;;iBAiCa,kBAAkB,UAAU,qBACvC;EACC;EACA"}