@tangle-network/agent-integrations 0.59.0 → 0.59.2

package/dist/hub-D13zPQGr.js

@@ -0,0 +1,1004 @@
+import { createOAuthBasicAuthorizationHeader, createOAuthTokenRequestHeaders, oauthClientCredentialRedactionValues, redactOAuthSensitiveText } from "./connectors/oauth.js";
+import { n as composeIntegrationRegistry } from "./registry-core-BZo69C37.js";
+import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+//#region src/core-error.ts
+var IntegrationError = class extends Error {
+	code;
+	constructor(message, code) {
+		super(message);
+		this.code = code;
+		this.name = "IntegrationError";
+	}
+};
+//#endregion
+//#region src/adapter-provider.ts
+function createConnectorAdapterProvider(options) {
+	const providerId = options.id ?? "first-party";
+	const now = options.now ?? (() => /* @__PURE__ */ new Date());
+	const fetchImpl = options.fetchImpl ?? globalThis.fetch?.bind(globalThis);
+	const adapters = /* @__PURE__ */ new Map();
+	for (const adapter of options.adapters) adapters.set(adapter.manifest.kind, adapter);
+	return {
+		id: providerId,
+		kind: options.kind ?? "first_party",
+		listConnectors: () => [...adapters.values()].map((adapter) => manifestToConnector(providerId, adapter)),
+		async startAuth(request) {
+			const adapter = adapters.get(request.connectorId);
+			if (!adapter) throw new IntegrationError(`Connector adapter ${request.connectorId} not found.`, "connector_not_found");
+			const auth = oauthManifestAuth(adapter.manifest.auth);
+			if (!auth) throw new IntegrationError(`Connector ${request.connectorId} does not support OAuth2 authorization (auth kind: ${adapter.manifest.auth.kind}).`, "auth_not_supported");
+			if ((auth.grantType ?? "authorization_code") !== "authorization_code") throw new IntegrationError(`Connector ${request.connectorId} uses client_credentials and requires a machine connection path.`, "auth_not_supported");
+			const pkce = resolveOAuthPkceMode(auth.pkce, request.connectorId);
+			const tokenClientAuthMethod = resolveTokenClientAuthMethod(auth.tokenClientAuthMethod, request.connectorId);
+			if (!options.resolveOAuthClient) throw new IntegrationError(`OAuth client resolver missing on adapter provider; cannot start auth for ${request.connectorId}.`, "config_missing");
+			const client = await options.resolveOAuthClient({ connectorId: request.connectorId });
+			if (!client || !client.clientId || tokenClientAuthMethod !== "none" && !client.clientSecret) throw new IntegrationError(`OAuth client credentials unavailable for ${request.connectorId}.`, "config_missing");
+			if (!auth.authorizationUrl) throw new IntegrationError(`Connector ${request.connectorId} uses the ${auth.grantType ?? "authorization_code"} grant and has no authorization URL to redirect to.`, "auth_not_supported");
+			const scopes = request.requestedScopes && request.requestedScopes.length > 0 ? request.requestedScopes : auth.scopes;
+			const url = new URL(resolveOAuthUrlTemplate(auth.authorizationUrl, request.metadata, request.connectorId, auth.urlTemplateMetadata));
+			url.searchParams.set("response_type", "code");
+			url.searchParams.set(resolveOAuthParameterName(auth.authorizationClientIdParam, "client_id", request.connectorId), client.clientId);
+			url.searchParams.set("redirect_uri", request.redirectUri);
+			if (auth.sendScopeParam !== false && scopes.length > 0) url.searchParams.set("scope", scopes.join(auth.scopeSeparator ?? " "));
+			const state = request.state ?? randomState();
+			url.searchParams.set("state", state);
+			if (auth.extraAuthParams) for (const [key, value] of Object.entries(auth.extraAuthParams)) url.searchParams.set(key, value);
+			if (pkce === "unsupported") {
+				url.searchParams.delete("code_challenge");
+				url.searchParams.delete("code_challenge_method");
+			} else {
+				url.searchParams.set("code_challenge", requirePkceChallenge(request.codeChallenge, request.connectorId));
+				url.searchParams.set("code_challenge_method", "S256");
+			}
+			return {
+				providerId,
+				connectorId: request.connectorId,
+				authUrl: url.toString(),
+				state,
+				metadata: request.metadata
+			};
+		},
+		async completeAuth(request) {
+			const adapter = adapters.get(request.connectorId);
+			if (!adapter) throw new IntegrationError(`Connector adapter ${request.connectorId} not found.`, "connector_not_found");
+			const auth = oauthManifestAuth(adapter.manifest.auth);
+			if (!auth) throw new IntegrationError(`Connector ${request.connectorId} does not support OAuth2 authorization (auth kind: ${adapter.manifest.auth.kind}).`, "auth_not_supported");
+			if ((auth.grantType ?? "authorization_code") !== "authorization_code") throw new IntegrationError(`Connector ${request.connectorId} uses client_credentials and requires a machine connection path.`, "auth_not_supported");
+			const tokenClientAuthMethod = resolveTokenClientAuthMethod(auth.tokenClientAuthMethod, request.connectorId);
+			const pkce = resolveOAuthPkceMode(auth.pkce, request.connectorId);
+			if (!request.code) throw new IntegrationError(`Authorization code missing on completeAuth for ${request.connectorId}.`, "config_missing");
+			if (!options.resolveOAuthClient) throw new IntegrationError(`OAuth client resolver missing on adapter provider; cannot complete auth for ${request.connectorId}.`, "config_missing");
+			const client = await options.resolveOAuthClient({ connectorId: request.connectorId });
+			if (!client || !client.clientId || tokenClientAuthMethod !== "none" && !client.clientSecret) throw new IntegrationError(`OAuth client credentials unavailable for ${request.connectorId}.`, "config_missing");
+			if (!fetchImpl) throw new IntegrationError("No fetch implementation available; inject fetchImpl into createConnectorAdapterProvider.", "config_missing");
+			const body = new URLSearchParams({
+				grant_type: "authorization_code",
+				code: request.code,
+				redirect_uri: request.redirectUri
+			});
+			const codeVerifier = pkce === "unsupported" ? void 0 : requirePkceVerifier(request.codeVerifier, request.connectorId);
+			if (codeVerifier) body.set("code_verifier", codeVerifier);
+			const headers = createOAuthTokenRequestHeaders(auth.tokenRequestHeaders);
+			if (tokenClientAuthMethod === "none") body.set(resolveOAuthParameterName(auth.tokenClientIdParam, "client_id", request.connectorId), client.clientId);
+			else if (tokenClientAuthMethod === "client_secret_post") {
+				body.set(resolveOAuthParameterName(auth.tokenClientIdParam, "client_id", request.connectorId), client.clientId);
+				body.set(resolveOAuthParameterName(auth.tokenClientSecretParam, "client_secret", request.connectorId), client.clientSecret);
+			} else headers.authorization = createOAuthBasicAuthorizationHeader(client.clientId, client.clientSecret, base64Encode);
+			const redactionValues = [
+				request.code,
+				...codeVerifier ? [codeVerifier] : [],
+				...oauthClientCredentialRedactionValues(client.clientId, client.clientSecret, headers.authorization)
+			];
+			const tokenUrl = resolveOAuthUrlTemplate(auth.tokenUrl, request.metadata, request.connectorId, auth.urlTemplateMetadata);
+			let res;
+			try {
+				res = await fetchImpl(tokenUrl, {
+					method: "POST",
+					headers,
+					body
+				});
+			} catch (cause) {
+				const detail = redactOAuthSensitiveText(cause?.message ?? "unknown", redactionValues);
+				throw new IntegrationError(`OAuth token exchange transport error for ${request.connectorId}: ${detail}`, "provider_failure");
+			}
+			if (!res.ok) {
+				const text = await res.text().catch(() => "");
+				const statusText = redactOAuthSensitiveText(res.statusText, redactionValues);
+				const redactedText = redactOAuthSensitiveText(text, redactionValues);
+				const detail = `${res.status} ${statusText} — ${redactedText.slice(0, 200)}`;
+				throw new IntegrationError(`OAuth token exchange failed for ${request.connectorId}: ${detail}`, "provider_failure");
+			}
+			let json;
+			try {
+				json = await res.json();
+			} catch {
+				throw new IntegrationError(`OAuth token exchange returned non-JSON body for ${request.connectorId}.`, "provider_failure");
+			}
+			if (!json.access_token) throw new IntegrationError(`OAuth token exchange returned no access_token for ${request.connectorId}.`, "provider_failure");
+			const grantedScopes = typeof json.scope === "string" && json.scope.length > 0 ? json.scope.split(/[\s,]+/).filter(Boolean) : [];
+			const issued = now();
+			const issuedIso = issued.toISOString();
+			const expiresAt = typeof json.expires_in === "number" && json.expires_in > 0 ? new Date(issued.getTime() + json.expires_in * 1e3).toISOString() : void 0;
+			const capturedMetadata = captureTokenMetadata(auth.tokenMetadata, json, request.connectorId);
+			return {
+				id: randomConnectionId(),
+				owner: request.owner,
+				providerId,
+				connectorId: request.connectorId,
+				status: "active",
+				grantedScopes,
+				createdAt: issuedIso,
+				updatedAt: issuedIso,
+				expiresAt,
+				metadata: {
+					...request.metadata,
+					...capturedMetadata
+				}
+			};
+		},
+		async invokeAction(connection, request) {
+			const adapter = adapters.get(connection.connectorId);
+			if (!adapter) throw new IntegrationError(`Connector adapter ${connection.connectorId} not found.`, "connector_not_found");
+			const capability = adapter.manifest.capabilities.find((candidate) => candidate.name === request.action);
+			if (!capability) throw new IntegrationError(`Capability ${request.action} is not defined by ${connection.connectorId}.`, "action_not_found");
+			const source = await options.resolveDataSource(connection);
+			let rotationPersistence = Promise.resolve();
+			const persistRotation = (credentials) => {
+				if (!options.onCredentialsRotated) return Promise.resolve();
+				rotationPersistence = rotationPersistence.then(() => options.onCredentialsRotated({
+					connection,
+					credentials
+				}));
+				rotationPersistence.catch(() => {});
+				return rotationPersistence;
+			};
+			const invocation = {
+				source,
+				capabilityName: request.action,
+				args: toRecord(request.input),
+				idempotencyKey: request.idempotencyKey ?? `idem_${connection.id}_${request.action}_${now().getTime()}`,
+				expectedEtag: typeof request.metadata?.expectedEtag === "string" ? request.metadata.expectedEtag : void 0,
+				callSessionId: typeof request.metadata?.callSessionId === "string" ? request.metadata.callSessionId : void 0,
+				onCredentialsRotated: options.onCredentialsRotated ? persistRotation : void 0
+			};
+			try {
+				if (capability.class === "read") {
+					if (!adapter.executeRead) throw new IntegrationError(`Connector ${connection.connectorId} does not implement reads.`, "action_not_found");
+					return readResultToAction(request, await adapter.executeRead(invocation));
+				}
+				if (capability.class === "mutation") {
+					if (!adapter.executeMutation) throw new IntegrationError(`Connector ${connection.connectorId} does not implement mutations.`, "action_not_found");
+					return mutationResultToAction(request, await adapter.executeMutation(invocation));
+				}
+				throw new IntegrationError(`Capability ${request.action} is not invokable as an action.`, "action_not_found");
+			} finally {
+				await rotationPersistence;
+			}
+		}
+	};
+}
+function adapterManifestsToConnectors(adapters, providerId = "first-party") {
+	return adapters.map((adapter) => manifestToConnector(providerId, adapter));
+}
+function createConnectorAdapterCatalogSource(options) {
+	const sourceId = options.id ?? "first-party";
+	return {
+		id: sourceId,
+		precedence: options.precedence,
+		connectors: adapterManifestsToConnectors(options.adapters, options.providerId ?? sourceId)
+	};
+}
+function manifestToConnector(providerId, adapter) {
+	const manifest = adapter.manifest;
+	const primaryAuth = primaryManifestAuth(manifest.auth);
+	const oauthAuth = oauthManifestAuth(manifest.auth);
+	return {
+		id: manifest.kind,
+		providerId,
+		title: manifest.displayName,
+		category: mapCategory(manifest.category),
+		auth: mapAuth(primaryAuth.kind),
+		scopes: primaryAuth.kind === "oauth2" ? primaryAuth.scopes : [],
+		actions: manifest.capabilities.filter((capability) => capability.class === "read" || capability.class === "mutation").map((capability) => ({
+			id: capability.name,
+			title: titleFromName(capability.name),
+			risk: capability.class === "read" ? "read" : capability.externalEffect ? "destructive" : "write",
+			requiredScopes: capability.requiredScopes ?? [],
+			dataClass: inferDataClass(manifest.category),
+			...capability.consistencyModel ? { consistencyModel: capability.consistencyModel } : {},
+			description: capability.description,
+			approvalRequired: capability.class === "mutation",
+			inputSchema: capability.parameters
+		})),
+		metadata: {
+			source: "first-party-adapter",
+			supportTier: "firstPartyExecutable",
+			executable: true,
+			oauthPkce: oauthAuth ? resolveOAuthPkceMode(oauthAuth.pkce, manifest.kind) : void 0,
+			authOptions: manifest.auth.kind === "one_of" ? manifest.auth.options.map((auth) => auth.kind) : [manifest.auth.kind],
+			preferredAuth: manifest.auth.kind === "one_of" ? manifest.auth.preferred : manifest.auth.kind
+		}
+	};
+}
+function readResultToAction(request, result) {
+	return {
+		ok: true,
+		action: request.action,
+		output: result.data,
+		metadata: {
+			etag: result.etag,
+			fetchedAt: result.fetchedAt
+		}
+	};
+}
+function mutationResultToAction(request, result) {
+	if (result.status === "committed") return {
+		ok: true,
+		action: request.action,
+		output: result.data,
+		metadata: {
+			etagAfter: result.etagAfter,
+			committedAt: result.committedAt,
+			idempotentReplay: result.idempotentReplay
+		}
+	};
+	if (result.status === "conflict") return {
+		ok: false,
+		action: request.action,
+		output: {
+			conflict: true,
+			message: result.message,
+			alternatives: result.alternatives,
+			currentState: result.currentState
+		}
+	};
+	return {
+		ok: false,
+		action: request.action,
+		output: {
+			rateLimited: true,
+			retryAfterMs: result.retryAfterMs,
+			message: result.message
+		}
+	};
+}
+function mapAuth(kind) {
+	if (kind === "one_of") return "custom";
+	if (kind === "oauth2") return "oauth2";
+	if (kind === "api-key") return "api_key";
+	if (kind === "none") return "none";
+	return "custom";
+}
+function primaryManifestAuth(auth) {
+	if (auth.kind !== "one_of") return auth;
+	return auth.options.find((option) => option.kind === auth.preferred) ?? auth.options[0];
+}
+function oauthManifestAuth(auth) {
+	if (auth.kind === "oauth2") return auth;
+	if (auth.kind !== "one_of") return void 0;
+	return auth.options.find((option) => option.kind === "oauth2");
+}
+/** Resolve the manifest value at the last possible point before an OAuth
+* request. The runtime check matters because adapters can enter through JS or
+* an `any` cast without first passing the static manifest validator. */
+function resolveTokenClientAuthMethod(value, connectorId) {
+	if (value === void 0 || value === "client_secret_post") return "client_secret_post";
+	if (value === "none" || value === "client_secret_basic") return value;
+	throw new IntegrationError(`Connector ${connectorId} has an unsupported OAuth token client authentication method.`, "config_missing");
+}
+function resolveOAuthPkceMode(value, connectorId) {
+	if (value === void 0 || value === "required") return "required";
+	if (value === "supported" || value === "unsupported") return value;
+	throw new IntegrationError(`Connector ${connectorId} has an invalid OAuth PKCE posture.`, "config_missing");
+}
+function requirePkceChallenge(value, connectorId) {
+	if (!value || !/^[A-Za-z0-9_-]{43}$/.test(value)) throw new IntegrationError(`OAuth PKCE S256 challenge missing or invalid for ${connectorId}.`, "config_missing");
+	return value;
+}
+function requirePkceVerifier(value, connectorId) {
+	if (!value || !/^[A-Za-z0-9._~-]{43,128}$/.test(value)) throw new IntegrationError(`OAuth PKCE verifier missing or invalid for ${connectorId}.`, "config_missing");
+	return value;
+}
+function resolveOAuthParameterName(value, fallback, connectorId) {
+	const name = value ?? fallback;
+	if (!/^[A-Za-z][A-Za-z0-9_.-]{0,63}$/.test(name)) throw new IntegrationError(`Connector ${connectorId} declares an invalid OAuth parameter name.`, "config_missing");
+	return name;
+}
+/** Encodes UTF-8 credentials without importing Node's Buffer, so the adapter
+* provider remains usable in browser and edge runtimes. */
+function base64Encode(value) {
+	const btoa = globalThis.btoa;
+	if (typeof btoa !== "function") throw new IntegrationError("OAuth client_secret_basic requires a base64 encoder in this runtime.", "config_missing");
+	const bytes = new TextEncoder().encode(value);
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary);
+}
+/** Resolve provider-owned tenant labels embedded in OAuth URLs.
+*
+* Shopify and Gorgias put the merchant name in the hostname. Only one DNS
+* label is accepted for each placeholder, so connection metadata cannot turn
+* a provider URL into an arbitrary credential destination.
+*/
+function resolveOAuthUrlTemplate(template, metadata, connectorId, metadataSpecs) {
+	const placeholders = [...template.matchAll(/\{([A-Za-z][A-Za-z0-9_]*)\}/g)];
+	let resolved = template;
+	for (const match of placeholders) {
+		const key = match[1];
+		const raw = metadata?.[key];
+		const metadataSpec = metadataSpecs?.[key];
+		if (metadataSpec?.kind === "base-url") {
+			if (typeof raw !== "string") throw new IntegrationError(`OAuth URL for ${connectorId} requires metadata.${key} as a provider base URL.`, "config_missing");
+			resolved = resolved.replaceAll(match[0], resolveOAuthMetadataBaseUrl(raw, metadataSpec, connectorId, key));
+			continue;
+		}
+		if (metadataSpec?.kind === "path-segment") {
+			if (!isOAuthPathSegmentPlaceholder(template, match.index ?? -1, match[0])) throw new IntegrationError(`OAuth URL for ${connectorId} declares metadata.${key} outside a complete path segment.`, "config_missing");
+			if (typeof raw !== "string" || !isOAuthPathSegment(raw.trim())) throw new IntegrationError(`OAuth URL for ${connectorId} requires metadata.${key} as a valid path segment.`, "config_missing");
+			resolved = resolved.replaceAll(match[0], encodeURIComponent(raw.trim()));
+			continue;
+		}
+		if (typeof raw !== "string" || !isDnsLabel(raw.trim())) throw new IntegrationError(`OAuth URL for ${connectorId} requires metadata.${key} as a valid tenant label.`, "config_missing");
+		resolved = resolved.replaceAll(match[0], raw.trim().toLowerCase());
+	}
+	let url;
+	try {
+		url = new URL(resolved);
+	} catch {
+		throw new IntegrationError(`OAuth URL for ${connectorId} is invalid.`, "config_missing");
+	}
+	if (url.protocol !== "https:" || url.username || url.password) throw new IntegrationError(`OAuth URL for ${connectorId} must be HTTPS without embedded credentials.`, "config_missing");
+	return url.toString();
+}
+function isOAuthPathSegment(value) {
+	return value !== "." && value !== ".." && /^[A-Za-z0-9._~-]{1,128}$/.test(value);
+}
+function isOAuthPathSegmentPlaceholder(template, index, placeholder) {
+	if (index < 0) return false;
+	const schemeIndex = template.indexOf("://");
+	const rootEnd = schemeIndex >= 0 ? schemeIndex + 3 : template.startsWith("{") ? template.indexOf("}") + 1 : 0;
+	const pathStart = template.indexOf("/", rootEnd);
+	const end = index + placeholder.length;
+	const queryStart = template.search(/[?#]/);
+	return pathStart >= 0 && index >= pathStart && (queryStart < 0 || index < queryStart) && template[index - 1] === "/" && (end === template.length || template[end] === "/" || template[end] === "?" || template[end] === "#");
+}
+function resolveOAuthMetadataBaseUrl(value, spec, connectorId, metadataKey) {
+	let url;
+	try {
+		url = new URL(value.trim());
+	} catch {
+		throw invalidOAuthMetadataBaseUrl(connectorId, metadataKey);
+	}
+	if (url.protocol !== "https:" || url.username || url.password || url.pathname !== "/" || url.search || url.hash) throw invalidOAuthMetadataBaseUrl(connectorId, metadataKey);
+	const exactAllowed = spec.allowedBaseUrls?.some((candidate) => sameOrigin(candidate, url)) ?? false;
+	const suffixAllowed = spec.allowedBaseUrlSuffixes?.some((suffix) => !url.port && suffix.startsWith(".") && url.hostname.toLowerCase().endsWith(suffix.toLowerCase())) ?? false;
+	if (Boolean(spec.allowedBaseUrls?.length || spec.allowedBaseUrlSuffixes?.length) && !exactAllowed && !suffixAllowed) throw invalidOAuthMetadataBaseUrl(connectorId, metadataKey);
+	if (spec.requirePublicHttps && !isPublicDnsHostname(url.hostname)) throw invalidOAuthMetadataBaseUrl(connectorId, metadataKey);
+	return url.origin;
+}
+function invalidOAuthMetadataBaseUrl(connectorId, metadataKey) {
+	return new IntegrationError(`OAuth URL for ${connectorId} requires metadata.${metadataKey} as an allowed HTTPS provider root.`, "config_missing");
+}
+function sameOrigin(candidate, actual) {
+	try {
+		const allowed = new URL(candidate);
+		return allowed.protocol === "https:" && !allowed.username && !allowed.password && allowed.pathname === "/" && !allowed.search && !allowed.hash && allowed.origin === actual.origin;
+	} catch {
+		return false;
+	}
+}
+function isPublicDnsHostname(hostname) {
+	const normalized = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+	if (normalized === "localhost" || normalized.endsWith(".localhost") || normalized.endsWith(".local") || normalized.endsWith(".internal") || normalized.endsWith(".home.arpa")) return false;
+	if (/^[0-9.]+$/.test(normalized) || normalized.includes(":")) return false;
+	return normalized.includes(".") && normalized.split(".").every(isDnsLabel);
+}
+function isDnsLabel(value) {
+	return value.length > 0 && value.length <= 63 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/i.test(value);
+}
+/** Project the declared `auth.tokenMetadata` mappings out of an OAuth
+*  token-response body into connection metadata. Each entry maps a
+*  connection-metadata key → the token-response field to read (string
+*  shorthand) or `{ field, required }`. Required fields that are absent/empty
+*  throw `provider_failure` so the break surfaces at connect; non-required
+*  fields are captured if present and otherwise skipped. */
+function captureTokenMetadata(tokenMetadata, json, connectorId) {
+	if (!tokenMetadata) return {};
+	const captured = {};
+	for (const [metaKey, source] of Object.entries(tokenMetadata)) {
+		const field = typeof source === "string" ? source : source.field;
+		const required = typeof source === "string" ? false : source.required === true;
+		const raw = json[field];
+		const value = typeof raw === "string" ? raw.trim() : raw;
+		if (value === void 0 || value === null || value === "") {
+			if (required) throw new IntegrationError(`OAuth token exchange for ${connectorId} did not return required field "${field}" for metadata.${metaKey}.`, "provider_failure");
+			continue;
+		}
+		captured[metaKey] = String(value);
+	}
+	return captured;
+}
+function mapCategory(category) {
+	if (category === "comms") return "chat";
+	if (category === "spreadsheet") return "database";
+	if (category === "doc") return "docs";
+	if (category === "commerce") return "workflow";
+	if (category === "sales-intelligence") return "crm";
+	if (category === "market-intelligence" || category === "hr") return "other";
+	return category === "other" ? "other" : category;
+}
+function inferDataClass(category) {
+	if (category === "commerce") return "sensitive";
+	if (category === "webhook") return "internal";
+	return "private";
+}
+function titleFromName(name) {
+	return name.split(/[._-]/g).filter(Boolean).map((part) => part.slice(0, 1).toUpperCase() + part.slice(1)).join(" ");
+}
+function toRecord(input) {
+	if (input && typeof input === "object" && !Array.isArray(input)) return input;
+	return {};
+}
+function randomState() {
+	const bytes = /* @__PURE__ */ new Uint8Array(24);
+	globalThis.crypto.getRandomValues(bytes);
+	return base64UrlEncode$1(bytes);
+}
+function randomConnectionId() {
+	if (typeof globalThis.crypto?.randomUUID === "function") return `conn_${globalThis.crypto.randomUUID().replace(/-/g, "")}`;
+	const bytes = /* @__PURE__ */ new Uint8Array(16);
+	globalThis.crypto.getRandomValues(bytes);
+	return `conn_${base64UrlEncode$1(bytes)}`;
+}
+function base64UrlEncode$1(bytes) {
+	let bin = "";
+	for (const b of bytes) bin += String.fromCharCode(b);
+	return (typeof btoa === "function" ? btoa(bin) : Buffer.from(bin, "binary").toString("base64")).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+//#endregion
+//#region src/credentials.ts
+var CredentialRefreshRevokedError = class extends Error {
+	constructor() {
+		super("Connection was revoked during credential refresh.");
+		this.name = "CredentialRefreshRevokedError";
+	}
+};
+const credentialRefreshes = /* @__PURE__ */ new WeakMap();
+const credentialPersistences = /* @__PURE__ */ new WeakMap();
+const credentialRevocations = /* @__PURE__ */ new WeakMap();
+var InMemoryIntegrationSecretStore = class {
+	secrets = /* @__PURE__ */ new Map();
+	get(ref) {
+		return this.secrets.get(secretKey(ref));
+	}
+	put(ref, credentials) {
+		this.secrets.set(secretKey(ref), credentials);
+	}
+	delete(ref) {
+		this.secrets.delete(secretKey(ref));
+	}
+};
+/** Test/dev double for {@link IntegrationOAuthStateStore}. Production hubs
+*  inject a durable implementation; this one keeps records in a Map and
+*  enforces the single-use + expiry contract. */
+var InMemoryIntegrationOAuthStateStore = class {
+	states = /* @__PURE__ */ new Map();
+	put(state) {
+		this.states.set(state.state, state);
+	}
+	consume(state) {
+		const record = this.states.get(state);
+		this.states.delete(state);
+		if (!record) return {
+			ok: false,
+			reason: "unknown"
+		};
+		if (record.expiresAt <= Date.now()) return {
+			ok: false,
+			reason: "expired"
+		};
+		return {
+			ok: true,
+			state: record
+		};
+	}
+	sweep(now) {
+		for (const [key, record] of this.states) if (record.expiresAt <= now) this.states.delete(key);
+	}
+};
+function createConnectionCredentialResolver(options) {
+	const now = options.now ?? (() => /* @__PURE__ */ new Date());
+	return async function resolveDataSource(connection) {
+		const credentials = await resolveConnectionCredentials(connection, {
+			secrets: options.secrets,
+			connections: options.connections,
+			adapters: options.adapters,
+			now,
+			markConnectionError: options.markConnectionError
+		});
+		return {
+			id: connection.id,
+			projectId: String(connection.metadata?.projectId ?? connection.owner.id),
+			publishedAgentId: typeof connection.metadata?.publishedAgentId === "string" ? connection.metadata.publishedAgentId : null,
+			kind: connection.connectorId,
+			label: connection.account?.displayName ?? connection.account?.email ?? connection.connectorId,
+			consistencyModel: typeof connection.metadata?.consistencyModel === "string" ? connection.metadata.consistencyModel : "authoritative",
+			scopes: connection.grantedScopes,
+			metadata: connection.metadata ?? {},
+			credentials,
+			status: connection.status === "active" ? "active" : connection.status === "revoked" ? "revoked" : "error"
+		};
+	};
+}
+async function resolveConnectionCredentials(input, options) {
+	if (input.status !== "active") throw new Error(`Connection ${input.id} is ${input.status}.`);
+	if (!input.secretRef) return { kind: "none" };
+	const now = options.now ?? (() => /* @__PURE__ */ new Date());
+	const current = await options.secrets.get(input.secretRef);
+	if (!current) throw new Error(`Secret ${input.secretRef.provider}/${input.secretRef.id} not found.`);
+	if (!isExpiredOauth(current, now)) return current;
+	const adapter = options.adapters?.find((candidate) => candidate.manifest.kind === input.connectorId);
+	if (!adapter?.refreshToken) return current;
+	let refresh;
+	try {
+		await assertCredentialRefreshActive(input, options, now);
+		refresh = acquireCredentialRefresh({
+			connectorId: input.connectorId,
+			secretRef: input.secretRef,
+			secrets: options.secrets,
+			now,
+			refreshToken: adapter.refreshToken.bind(adapter)
+		});
+		const refreshed = await refresh.promise;
+		await assertCredentialRefreshActive(input, options, now, refresh);
+		if (options.connections) {
+			await options.connections.put({
+				...input,
+				status: "active",
+				updatedAt: now().toISOString(),
+				expiresAt: refreshed.kind === "oauth2" && refreshed.expiresAt ? new Date(refreshed.expiresAt).toISOString() : input.expiresAt
+			});
+			await assertCredentialRefreshActive(input, options, now, refresh);
+		}
+		return refreshed;
+	} catch (error) {
+		const err = error instanceof Error ? error : /* @__PURE__ */ new Error("Credential refresh failed.");
+		if (err instanceof CredentialRefreshRevokedError) throw err;
+		await options.markConnectionError?.(input, err);
+		if (options.connections) await options.connections.put({
+			...input,
+			status: "expired",
+			updatedAt: now().toISOString()
+		});
+		throw err;
+	} finally {
+		if (refresh) releaseCredentialRefresh(options.secrets, input.connectorId, input.secretRef, refresh);
+	}
+}
+function acquireCredentialRefresh(input) {
+	let refreshes = credentialRefreshes.get(input.secrets);
+	if (!refreshes) {
+		refreshes = /* @__PURE__ */ new Map();
+		credentialRefreshes.set(input.secrets, refreshes);
+	}
+	const key = credentialRefreshKey(input.connectorId, input.secretRef);
+	if (credentialRevocations.get(input.secrets)?.has(key)) throw new CredentialRefreshRevokedError();
+	const existing = refreshes.get(key);
+	if (existing) {
+		existing.waiters += 1;
+		return existing;
+	}
+	let flight;
+	const promise = Promise.resolve().then(async () => {
+		const latest = await input.secrets.get(input.secretRef);
+		if (!latest) throw new Error(`Secret ${input.secretRef.provider}/${input.secretRef.id} not found.`);
+		if (!isExpiredOauth(latest, input.now)) return latest;
+		const refreshed = await input.refreshToken(latest);
+		if (flight.cancelled) throw new CredentialRefreshRevokedError();
+		await input.secrets.put(input.secretRef, refreshed);
+		if (flight.cancelled) {
+			await input.secrets.delete?.(input.secretRef);
+			throw new CredentialRefreshRevokedError();
+		}
+		return refreshed;
+	});
+	flight = {
+		promise,
+		cancelled: false,
+		settled: false,
+		waiters: 1
+	};
+	refreshes.set(key, flight);
+	const settle = () => {
+		flight.settled = true;
+		clearCredentialRefresh(input.secrets, key, flight);
+	};
+	promise.then(settle, settle);
+	return flight;
+}
+function releaseCredentialRefresh(secrets, connectorId, secretRef, flight) {
+	flight.waiters -= 1;
+	clearCredentialRefresh(secrets, credentialRefreshKey(connectorId, secretRef), flight);
+}
+function clearCredentialRefresh(secrets, key, flight) {
+	if (!flight.settled || flight.waiters !== 0) return;
+	const refreshes = credentialRefreshes.get(secrets);
+	if (refreshes?.get(key) !== flight) return;
+	refreshes.delete(key);
+	if (refreshes.size === 0) credentialRefreshes.delete(secrets);
+}
+async function assertCredentialRefreshActive(input, options, now, operation) {
+	const key = input.secretRef ? credentialRefreshKey(input.connectorId, input.secretRef) : void 0;
+	let revoked = operation?.cancelled === true || key !== void 0 && credentialRevocations.get(options.secrets)?.has(key) === true;
+	let stored;
+	if (options.connections) {
+		stored = await options.connections.get(input.id);
+		revoked ||= stored?.status === "revoked";
+	}
+	if (!revoked && input.secretRef) revoked = await options.secrets.get(input.secretRef) === void 0;
+	if (!revoked) return;
+	if (operation) operation.cancelled = true;
+	if (input.secretRef) await options.secrets.delete?.(input.secretRef);
+	if (options.connections && stored?.status !== "revoked") await options.connections.put({
+		...stored ?? input,
+		status: "revoked",
+		updatedAt: now().toISOString()
+	});
+	throw new CredentialRefreshRevokedError();
+}
+function createCredentialBackedAdapterProvider(options) {
+	const now = options.now ?? (() => /* @__PURE__ */ new Date());
+	return createConnectorAdapterProvider({
+		...options,
+		resolveDataSource: createConnectionCredentialResolver(options),
+		onCredentialsRotated: async ({ connection, credentials }) => {
+			const persistence = connection.secretRef ? acquireCredentialPersistence(options.secrets, connection.connectorId, connection.secretRef) : void 0;
+			try {
+				await assertCredentialRefreshActive(connection, options, now, persistence);
+				if (connection.secretRef) await options.secrets.put(connection.secretRef, credentials);
+				await assertCredentialRefreshActive(connection, options, now, persistence);
+				if (options.connections) {
+					await options.connections.put({
+						...connection,
+						status: "active",
+						updatedAt: now().toISOString(),
+						expiresAt: credentials.kind === "oauth2" && credentials.expiresAt ? new Date(credentials.expiresAt).toISOString() : connection.expiresAt
+					});
+					await assertCredentialRefreshActive(connection, options, now, persistence);
+				}
+				await options.onCredentialsRotated?.({
+					connection,
+					secretRef: connection.secretRef,
+					credentials
+				});
+				await assertCredentialRefreshActive(connection, options, now, persistence);
+			} finally {
+				if (persistence && connection.secretRef) releaseCredentialPersistence(options.secrets, connection.connectorId, connection.secretRef, persistence);
+			}
+		}
+	});
+}
+function acquireCredentialPersistence(secrets, connectorId, secretRef) {
+	let persistences = credentialPersistences.get(secrets);
+	if (!persistences) {
+		persistences = /* @__PURE__ */ new Map();
+		credentialPersistences.set(secrets, persistences);
+	}
+	const key = credentialRefreshKey(connectorId, secretRef);
+	let leases = persistences.get(key);
+	if (!leases) {
+		leases = /* @__PURE__ */ new Set();
+		persistences.set(key, leases);
+	}
+	const lease = { cancelled: credentialRevocations.get(secrets)?.has(key) === true };
+	leases.add(lease);
+	return lease;
+}
+function releaseCredentialPersistence(secrets, connectorId, secretRef, lease) {
+	const persistences = credentialPersistences.get(secrets);
+	if (!persistences) return;
+	const key = credentialRefreshKey(connectorId, secretRef);
+	const leases = persistences.get(key);
+	leases?.delete(lease);
+	if (leases?.size === 0) persistences.delete(key);
+	if (persistences.size === 0) credentialPersistences.delete(secrets);
+}
+async function revokeConnection(input) {
+	const finishRevocation = input.connection.secretRef && input.secrets ? beginCredentialRevocation(input.secrets, input.connection.connectorId, input.connection.secretRef) : void 0;
+	try {
+		if (input.connection.secretRef) await input.secrets?.delete?.(input.connection.secretRef);
+		const revoked = {
+			...input.connection,
+			status: "revoked",
+			updatedAt: (input.now?.() ?? /* @__PURE__ */ new Date()).toISOString()
+		};
+		await input.connections?.put(revoked);
+		return revoked;
+	} finally {
+		finishRevocation?.();
+	}
+}
+function beginCredentialRevocation(secrets, connectorId, secretRef) {
+	const key = credentialRefreshKey(connectorId, secretRef);
+	let revocations = credentialRevocations.get(secrets);
+	if (!revocations) {
+		revocations = /* @__PURE__ */ new Map();
+		credentialRevocations.set(secrets, revocations);
+	}
+	revocations.set(key, (revocations.get(key) ?? 0) + 1);
+	const flight = credentialRefreshes.get(secrets)?.get(key);
+	if (flight) flight.cancelled = true;
+	for (const persistence of credentialPersistences.get(secrets)?.get(key) ?? []) persistence.cancelled = true;
+	return () => {
+		const remaining = (revocations?.get(key) ?? 1) - 1;
+		if (remaining > 0) revocations?.set(key, remaining);
+		else revocations?.delete(key);
+		if (revocations?.size === 0) credentialRevocations.delete(secrets);
+	};
+}
+function isExpiredOauth(credentials, now) {
+	return credentials.kind === "oauth2" && typeof credentials.expiresAt === "number" && credentials.expiresAt <= now().getTime() && Boolean(credentials.refreshToken);
+}
+function secretKey(ref) {
+	return `${ref.provider}:${ref.id}`;
+}
+function credentialRefreshKey(connectorId, ref) {
+	return JSON.stringify([
+		connectorId,
+		ref.provider,
+		ref.id
+	]);
+}
+//#endregion
+//#region src/hub.ts
+var IntegrationHub = class {
+	providers = /* @__PURE__ */ new Map();
+	store;
+	capabilitySecret;
+	guard;
+	policy;
+	/** Host-injected (or in-memory default) secret store. The hub re-persists
+	*  rotated credentials here when a connection carries a secretRef. */
+	secretStore;
+	oauthStateStore;
+	oauthStateTtlMs;
+	credentialsRotated;
+	now;
+	constructor(options) {
+		if (!options.capabilitySecret) throw new IntegrationError("capabilitySecret is required.", "capability_invalid");
+		for (const provider of options.providers) this.providers.set(provider.id, provider);
+		this.store = options.store;
+		this.capabilitySecret = options.capabilitySecret;
+		this.guard = options.guard;
+		this.policy = options.policy;
+		this.secretStore = options.secretStore ?? new InMemoryIntegrationSecretStore();
+		this.oauthStateStore = options.oauthStateStore ?? new InMemoryIntegrationOAuthStateStore();
+		this.oauthStateTtlMs = options.oauthStateTtlMs ?? 6e5;
+		this.credentialsRotated = options.credentialsRotated;
+		this.now = options.now ?? (() => /* @__PURE__ */ new Date());
+	}
+	async listConnectors() {
+		return (await Promise.all([...this.providers.values()].map((provider) => provider.listConnectors()))).flat();
+	}
+	async listRegistry(options = {}) {
+		const sources = await Promise.all([...this.providers.values()].map(async (provider) => ({
+			id: provider.id,
+			connectors: await provider.listConnectors()
+		})));
+		return composeIntegrationRegistry(sources, options);
+	}
+	async startAuth(providerId, request) {
+		const provider = this.requireProvider(providerId);
+		if (!provider.startAuth) throw new IntegrationError(`Provider ${providerId} does not support auth start.`, "auth_not_supported");
+		const pkcePair = connectorOAuthPkceMode(await this.requireConnector(provider, request.connectorId)) === "unsupported" ? void 0 : createPkcePair();
+		const result = await provider.startAuth({
+			...request,
+			codeChallenge: pkcePair?.challenge
+		});
+		const record = {
+			state: result.state,
+			providerId,
+			connectorId: request.connectorId,
+			owner: request.owner,
+			requestedScopes: request.requestedScopes,
+			redirectUri: request.redirectUri,
+			codeVerifier: pkcePair?.verifier,
+			expiresAt: this.now().getTime() + this.oauthStateTtlMs,
+			metadata: request.metadata
+		};
+		await this.oauthStateStore.put(record);
+		return result;
+	}
+	async completeAuth(providerId, request) {
+		const provider = this.requireProvider(providerId);
+		if (!provider.completeAuth) throw new IntegrationError(`Provider ${providerId} does not support auth completion.`, "auth_not_supported");
+		const outcome = await this.oauthStateStore.consume(request.state);
+		if (!outcome.ok) throw new IntegrationError(`Integration OAuth state ${outcome.reason}: possible CSRF, replay, or stale flow.`, "capability_invalid");
+		if (outcome.state.providerId !== providerId || outcome.state.connectorId !== request.connectorId) throw new IntegrationError("Integration OAuth state does not match completion request.", "capability_invalid");
+		if (outcome.state.redirectUri !== request.redirectUri) throw new IntegrationError("Integration OAuth redirect URI does not match the start request.", "capability_invalid");
+		const pinnedMetadata = request.metadata || outcome.state.metadata ? {
+			...request.metadata,
+			...outcome.state.metadata
+		} : void 0;
+		const connection = await provider.completeAuth({
+			...request,
+			connectorId: outcome.state.connectorId,
+			owner: outcome.state.owner,
+			state: outcome.state.state,
+			redirectUri: outcome.state.redirectUri,
+			codeVerifier: outcome.state.codeVerifier,
+			metadata: pinnedMetadata
+		});
+		await this.store.put(connection);
+		return connection;
+	}
+	async upsertConnection(connection) {
+		await this.store.put(connection);
+		return connection;
+	}
+	async listConnections(owner) {
+		return this.store.listByOwner(owner);
+	}
+	async getConnection(connectionId) {
+		return this.store.get(connectionId);
+	}
+	async issueCapability(request) {
+		const connection = await this.requireConnection(request.connectionId);
+		this.assertConnectionActive(connection);
+		assertScopes(connection, request.scopes);
+		const now = this.now();
+		const capability = {
+			id: `cap_${randomUUID()}`,
+			subject: request.subject,
+			connectionId: request.connectionId,
+			scopes: unique(request.scopes),
+			allowedActions: unique(request.allowedActions),
+			issuedAt: now.toISOString(),
+			expiresAt: new Date(now.getTime() + request.ttlMs).toISOString(),
+			metadata: request.metadata
+		};
+		return {
+			capability,
+			token: signCapability(capability, this.capabilitySecret)
+		};
+	}
+	verifyCapability(token) {
+		const capability = verifyCapabilityToken(token, this.capabilitySecret);
+		if (Date.parse(capability.expiresAt) <= this.now().getTime()) throw new IntegrationError("Integration capability expired.", "capability_expired");
+		return capability;
+	}
+	async invokeWithCapability(token, request) {
+		const capability = this.verifyCapability(token);
+		if (!capability.allowedActions.includes(request.action)) throw new IntegrationError(`Capability does not allow action ${request.action}.`, "action_denied");
+		const connection = await this.requireConnection(capability.connectionId);
+		this.assertConnectionActive(connection);
+		const provider = this.requireProvider(connection.providerId);
+		const connector = await this.requireConnector(provider, connection.connectorId);
+		const action = connector.actions.find((candidate) => candidate.id === request.action);
+		if (!action) throw new IntegrationError(`Action ${request.action} is not defined by connector ${connector.id}.`, "action_not_found");
+		assertScopes(connection, action.requiredScopes);
+		assertScopes({
+			...connection,
+			grantedScopes: capability.scopes
+		}, action.requiredScopes);
+		const fullRequest = {
+			...request,
+			connectionId: connection.id
+		};
+		const proceed = async () => {
+			if (!this.policy) return provider.invokeAction(connection, fullRequest);
+			const decision = await this.policy.decide({
+				connection,
+				request: fullRequest,
+				action,
+				subject: capability.subject
+			});
+			if (decision.decision === "deny") throw new IntegrationError(decision.reason, "policy_denied");
+			if (decision.decision === "require_approval") return {
+				ok: false,
+				action: request.action,
+				output: {
+					approvalRequired: true,
+					approval: decision.approval
+				},
+				metadata: {
+					policyDecision: decision.decision,
+					reason: decision.reason,
+					...decision.metadata
+				}
+			};
+			return provider.invokeAction(connection, fullRequest);
+		};
+		if (this.guard) return this.guard.invokeAction({
+			connection,
+			request: fullRequest,
+			action
+		}, proceed);
+		return proceed();
+	}
+	async subscribeTrigger(connectionId, trigger, targetUrl) {
+		const connection = await this.requireConnection(connectionId);
+		this.assertConnectionActive(connection);
+		const provider = this.requireProvider(connection.providerId);
+		const connector = await this.requireConnector(provider, connection.connectorId);
+		const spec = connector.triggers?.find((candidate) => candidate.id === trigger);
+		if (!spec) throw new IntegrationError(`Trigger ${trigger} is not defined by connector ${connector.id}.`, "trigger_not_found");
+		assertScopes(connection, spec.requiredScopes);
+		if (!provider.subscribeTrigger) throw new IntegrationError(`Provider ${provider.id} does not support triggers.`, "auth_not_supported");
+		return provider.subscribeTrigger(connection, trigger, targetUrl);
+	}
+	requireProvider(providerId) {
+		const provider = this.providers.get(providerId);
+		if (!provider) throw new IntegrationError(`Provider ${providerId} not found.`, "provider_not_found");
+		return provider;
+	}
+	async requireConnector(provider, connectorId) {
+		const connector = (await provider.listConnectors()).find((candidate) => candidate.id === connectorId);
+		if (!connector) throw new IntegrationError(`Connector ${connectorId} not found.`, "connector_not_found");
+		return connector;
+	}
+	async requireConnection(connectionId) {
+		const connection = await this.store.get(connectionId);
+		if (!connection) throw new IntegrationError(`Connection ${connectionId} not found.`, "connection_not_found");
+		return connection;
+	}
+	assertConnectionActive(connection) {
+		if (connection.status !== "active") throw new IntegrationError(`Connection ${connection.id} is ${connection.status}.`, "connection_not_active");
+		if (connection.expiresAt && Date.parse(connection.expiresAt) <= this.now().getTime()) throw new IntegrationError(`Connection ${connection.id} is expired.`, "connection_not_active");
+	}
+};
+function signCapability(capability, secret) {
+	const payload = base64UrlEncode(JSON.stringify(capability));
+	return `${payload}.${hmac(payload, secret)}`;
+}
+function verifyCapabilityToken(token, secret) {
+	const [payload, signature] = token.split(".");
+	if (!payload || !signature) throw new IntegrationError("Malformed integration capability.", "capability_invalid");
+	if (!constantTimeEqual(signature, hmac(payload, secret))) throw new IntegrationError("Invalid integration capability signature.", "capability_invalid");
+	let parsed;
+	try {
+		parsed = JSON.parse(base64UrlDecode(payload));
+	} catch {
+		throw new IntegrationError("Invalid integration capability payload.", "capability_invalid");
+	}
+	if (!parsed.id || !parsed.connectionId || !Array.isArray(parsed.scopes) || !Array.isArray(parsed.allowedActions)) throw new IntegrationError("Invalid integration capability payload.", "capability_invalid");
+	return parsed;
+}
+function assertScopes(connection, requiredScopes) {
+	const missing = requiredScopes.filter((scope) => !connection.grantedScopes.includes(scope));
+	if (missing.length > 0) throw new IntegrationError(`Missing integration scopes: ${missing.join(", ")}`, "scope_denied");
+}
+function connectorOAuthPkceMode(connector) {
+	const value = connector.metadata?.oauthPkce;
+	if (value === void 0) return "required";
+	if (value === "required" || value === "supported" || value === "unsupported") return value;
+	throw new IntegrationError(`Connector ${connector.id} declares an invalid OAuth PKCE posture.`, "config_missing");
+}
+function createPkcePair() {
+	const verifier = randomBytes(48).toString("base64url");
+	return {
+		verifier,
+		challenge: createHash("sha256").update(verifier).digest("base64url")
+	};
+}
+function hmac(payload, secret) {
+	return createHmac("sha256", secret).update(payload).digest("base64url");
+}
+function constantTimeEqual(a, b) {
+	const left = Buffer.from(a);
+	const right = Buffer.from(b);
+	return left.length === right.length && timingSafeEqual(left, right);
+}
+function base64UrlEncode(value) {
+	return Buffer.from(value, "utf8").toString("base64url");
+}
+function base64UrlDecode(value) {
+	return Buffer.from(value, "base64url").toString("utf8");
+}
+function unique(values) {
+	return [...new Set(values)];
+}
+//#endregion
+export { InMemoryIntegrationSecretStore as a, resolveConnectionCredentials as c, createConnectorAdapterCatalogSource as d, createConnectorAdapterProvider as f, InMemoryIntegrationOAuthStateStore as i, revokeConnection as l, IntegrationError as m, signCapability as n, createConnectionCredentialResolver as o, manifestToConnector as p, verifyCapabilityToken as r, createCredentialBackedAdapterProvider as s, IntegrationHub as t, adapterManifestsToConnectors as u };
+
+//# sourceMappingURL=hub-D13zPQGr.js.map