@wolpertingerlabs/drawlatch 1.0.0-alpha.2 → 1.0.0-alpha.29

package/dist/shared/config.d.ts

@@ -11,6 +11,10 @@
  * Keys directory: ~/.drawlatch/keys/
  */
 import type { IngestorConfig } from '../remote/ingestors/types.js';
+import type { TriggerRule } from '../remote/triggers/types.js';
+import type { TestConnectionConfig, TestIngestorConfig, ListenerConfigSchema } from './listener-config.js';
+export type { TestConnectionConfig, TestIngestorConfig, ListenerConfigSchema, } from './listener-config.js';
+export type { ListenerConfigField, ListenerConfigOption } from './listener-config.js';
 /** Resolve the base config directory at call time (not import time).
  *  Defaults to ~/.drawlatch in the user's home directory.
  *  Override with MCP_CONFIG_DIR env var for custom deployments.
@@ -23,22 +27,16 @@ export declare function getConfigPath(): string;
 export declare function getProxyConfigPath(): string;
 export declare function getRemoteConfigPath(): string;
 export declare function getKeysDir(): string;
-export declare function getLocalKeysDir(): string;
-export declare function getRemoteKeysDir(): string;
-export declare function getPeerKeysDir(): string;
+export declare function getCallerKeysDir(): string;
+export declare function getServerKeysDir(): string;
 export declare function getEnvFilePath(): string;
+/** Category grouping for built-in connection templates.
+ *  Matches the subdirectory name under src/connections/. */
+export type ConnectionCategory = 'ai' | 'developer-tools' | 'gaming' | 'messaging' | 'productivity' | 'social-media';
 /** MCP proxy (local) configuration */
 export interface ProxyConfig {
     /** Remote server URL */
     remoteUrl: string;
-    /** Key alias — resolved to keys/local/<alias>/.
-     *  Overridden by the MCP_KEY_ALIAS env var at runtime.
-     *  When set, takes precedence over localKeysDir. */
-    localKeyAlias?: string;
-    /** Path to our own key bundle (full-path override; ignored when alias is set) */
-    localKeysDir: string;
-    /** Path to the remote server's public keys */
-    remotePublicKeysDir: string;
     /** Connection timeout (ms) */
     connectTimeout: number;
     /** Request timeout (ms) */
@@ -61,6 +59,14 @@ export interface Route {
     /** URL to an OpenAPI / Swagger spec (JSON or YAML) for this route's API.
      *  Optional — provides more structured, agent-friendly documentation. */
     openApiUrl?: string;
+    /** Stability level of this connection: "stable", "beta", or "dev".
+     *  Defaults to "dev" if omitted. Helps agents and UIs communicate
+     *  whether a connection is production-ready, in testing, or experimental. */
+    stability?: 'stable' | 'beta' | 'dev';
+    /** Category grouping for this connection template (e.g., "ai", "messaging").
+     *  Matches the subdirectory under src/connections/. Only present on built-in
+     *  connection templates; custom connectors may omit it. */
+    category?: ConnectionCategory;
     /** Headers to inject automatically into outgoing requests for this route.
      *  These MUST NOT conflict with client-provided headers (request is rejected on conflict).
      *  Values may contain ${VAR} placeholders resolved against this route's secrets. */
@@ -79,9 +85,22 @@ export interface Route {
      *  When present, the remote server can start a long-lived ingestor
      *  (WebSocket, webhook listener, or poller) for this connection. */
     ingestor?: IngestorConfig;
+    /** Pre-configured test request for verifying connection credentials.
+     *  Must be a non-destructive, read-only endpoint with zero side effects. */
+    testConnection?: TestConnectionConfig;
+    /** Pre-configured test for verifying ingestor / event listener configuration.
+     *  Set to null to explicitly indicate this listener cannot be tested.
+     *  Omitted if the connection has no ingestor. */
+    testIngestor?: TestIngestorConfig | null;
+    /** Schema describing configurable fields for this connection's event listener.
+     *  Used by UIs and management tools to render configuration forms.
+     *  Only present on connections that have an ingestor. */
+    listenerConfig?: ListenerConfigSchema;
 }
 /** A route after secret/header resolution — used at runtime */
 export interface ResolvedRoute {
+    /** Connection alias (e.g., "github", "discord-bot"). Populated during caller route resolution. */
+    alias?: string;
     /** Human-readable name for this route (carried from config) */
     name?: string;
     /** Short description of this route's purpose (carried from config) */
@@ -90,11 +109,23 @@ export interface ResolvedRoute {
     docsUrl?: string;
     /** URL to an OpenAPI / Swagger spec for this route's API (carried from config) */
     openApiUrl?: string;
+    /** Stability level (carried from config) */
+    stability?: 'stable' | 'beta' | 'dev';
+    /** Category grouping (carried from config) */
+    category?: ConnectionCategory;
     headers: Record<string, string>;
     secrets: Record<string, string>;
     allowedEndpoints: string[];
     /** Whether to resolve ${VAR} placeholders in request bodies (default: false) */
     resolveSecretsInBody: boolean;
+    /** Pre-configured test request for verifying connection credentials (carried from config) */
+    testConnection?: TestConnectionConfig;
+    /** Pre-configured test for verifying ingestor / event listener (carried from config) */
+    testIngestor?: TestIngestorConfig | null;
+    /** Listener configuration schema for UI rendering (carried from config) */
+    listenerConfig?: ListenerConfigSchema;
+    /** Raw ingestor configuration (carried from config, needed by tool handlers) */
+    ingestorConfig?: IngestorConfig;
 }
 /** Per-connection ingestor overrides (all fields optional — omitted fields inherit from template). */
 export interface IngestorOverrides {
@@ -114,13 +145,16 @@ export interface IngestorOverrides {
     disabled?: boolean;
     /** Override the poll interval in milliseconds (poll ingestors only). */
     intervalMs?: number;
+    /** Generic parameter bag for listener configuration.
+     *  Keys correspond to ListenerConfigField.key values from the connection's
+     *  listenerConfig schema. Values are mapped to typed ingestor config fields
+     *  during mergeIngestorConfig(). */
+    params?: Record<string, unknown>;
 }
 /** Per-caller access configuration */
 export interface CallerConfig {
     /** Human-readable name for this caller (used in audit logs) */
     name?: string;
-    /** Path to this caller's public key files (signing.pub.pem + exchange.pub.pem) */
-    peerKeyDir: string;
     /** List of connection aliases — references built-in templates (e.g., "github")
      *  or custom connector aliases defined in the top-level connectors array. */
     connections: string[];
@@ -133,6 +167,26 @@ export interface CallerConfig {
      *  Allows callers to customize intents, event filters, guild/channel/user ID filters,
      *  buffer size, or disable an ingestor without modifying the connection template. */
     ingestorOverrides?: Record<string, IngestorOverrides>;
+    /** Multi-instance listener definitions keyed by connection alias.
+     *  Value is a map of instanceId → IngestorOverrides.
+     *  When present for a connection, spawns one ingestor per instanceId instead of
+     *  a single default instance. Takes precedence over ingestorOverrides for that connection.
+     *  Instance IDs must match /^[a-zA-Z0-9_-]+$/.
+     *
+     *  Example:
+     *  ```json
+     *  {
+     *    "trello": {
+     *      "project-board": { "params": { "boardId": "abc123" } },
+     *      "sprint-board":  { "params": { "boardId": "def456" } }
+     *    }
+     *  }
+     *  ``` */
+    listenerInstances?: Record<string, Record<string, IngestorOverrides>>;
+    /** Trigger rules that map ingestor events to Claude Code remote trigger invocations.
+     *  When an ingestor event matches a rule's criteria (source, event type, filter),
+     *  the engine dispatches the event to the configured remote trigger. */
+    triggerRules?: TriggerRule[];
 }
 /** Remote server configuration */
 export interface RemoteServerConfig {
@@ -140,16 +194,21 @@ export interface RemoteServerConfig {
     host: string;
     /** Port to listen on */
     port: number;
-    /** Path to our own key bundle */
-    localKeysDir: string;
     /** Custom connector definitions — a reusable pool referenced by alias from callers.
      *  Each connector scopes secrets and headers to endpoint patterns. */
     connectors?: Route[];
     /** Per-caller access control. Keys are caller aliases (used in audit logs).
-     *  Each caller specifies their peer key directory and which connections they can use. */
+     *  Each caller specifies which connections they can use.
+     *  Caller public keys are loaded from keys/callers/<alias>/. */
     callers: Record<string, CallerConfig>;
     /** Rate limit: max requests per minute per session */
     rateLimitPerMinute: number;
+    /** When true, drawlatch brings up and supervises its own cloudflared quick
+     *  tunnel on startup, injecting the public URL into callback-dependent
+     *  connection configs before secret resolution and ingestor start (item C).
+     *  Equivalent to setting DRAWLATCH_TUNNEL=1. Not a control surface — just a
+     *  config flag. Default: false. */
+    tunnel?: boolean;
 }
 /**
  * Load the MCP proxy (local) config.
@@ -159,13 +218,17 @@ export interface RemoteServerConfig {
  *   2. config.json → .proxy section (legacy combined format)
  *   3. Built-in defaults
  *
- * Key alias resolution (applied after loading):
- *   1. MCP_KEY_ALIAS env var (highest — set per agent at spawn time)
- *   2. localKeyAlias in config file
- *   3. localKeysDir in config file (explicit full path)
- *   4. Default: keys/local/default
+ * Key paths are derived automatically:
+ *   - Caller keys: keys/callers/{MCP_KEY_ALIAS || "default"}/
+ *   - Server keys: keys/server/
  */
 export declare function loadProxyConfig(): ProxyConfig;
+/**
+ * Resolve the caller key alias for the MCP proxy.
+ *
+ * Resolution: MCP_KEY_ALIAS env var > "default"
+ */
+export declare function resolveCallerKeyAlias(): string;
 /**
  * Load the remote server config.
  *
@@ -199,16 +262,25 @@ export declare function resolvePlaceholders(str: string, secretsMap: Record<stri
  * Load secrets from the config's secrets map, resolving from environment
  * variables. Value can be a literal string or "${VAR_NAME}" to read from env.
  *
- * When `envOverrides` is provided (pre-resolved caller env map), those values
- * are checked BEFORE process.env, allowing per-caller secret redirection.
+ * Resolution order for each ${VAR} reference:
+ *   1. `envOverrides[VAR]` — caller's explicit env mapping (pre-resolved)
+ *   2. `process.env[PREFIX_VAR]` — prefixed env var (e.g., ALICE_GITHUB_TOKEN)
+ *   3. Warning if not found (bare process.env fallback intentionally removed
+ *      to prevent cross-caller secret leakage)
+ *
+ * When `callerAlias` is omitted, step 2 is skipped (used for resolving
+ * the caller's own env mapping where prefixing doesn't apply).
  */
-export declare function resolveSecrets(secretsMap: Record<string, string>, envOverrides?: Record<string, string>): Record<string, string>;
+export declare function resolveSecrets(secretsMap: Record<string, string>, envOverrides?: Record<string, string>, callerAlias?: string): Record<string, string>;
 /**
  * Resolve all routes: resolve secrets from env vars, then resolve header
  * placeholders against each route's own resolved secrets.
  *
  * When `envOverrides` is provided, those pre-resolved values are checked
  * before process.env during secret resolution (used for per-caller env).
+ *
+ * When `callerAlias` is provided, prefixed env vars (e.g., ALICE_GITHUB_TOKEN)
+ * are checked as a fallback before giving up on a ${VAR} reference.
  */
-export declare function resolveRoutes(routes: Route[], envOverrides?: Record<string, string>): ResolvedRoute[];
+export declare function resolveRoutes(routes: Route[], envOverrides?: Record<string, string>, callerAlias?: string): ResolvedRoute[];
 //# sourceMappingURL=config.d.ts.map

package/dist/shared/config.js

@@ -36,14 +36,11 @@ export function getRemoteConfigPath() {
 export function getKeysDir() {
     return path.join(getConfigDir(), 'keys');
 }
-export function getLocalKeysDir() {
-    return path.join(getKeysDir(), 'local');
+export function getCallerKeysDir() {
+    return path.join(getKeysDir(), 'callers');
 }
-export function getRemoteKeysDir() {
-    return path.join(getKeysDir(), 'remote');
-}
-export function getPeerKeysDir() {
-    return path.join(getKeysDir(), 'peers');
+export function getServerKeysDir() {
+    return path.join(getKeysDir(), 'server');
 }
 export function getEnvFilePath() {
     return path.join(getConfigDir(), '.env');
@@ -52,8 +49,6 @@ export function getEnvFilePath() {
 function proxyDefaults() {
     return {
         remoteUrl: 'http://localhost:9999',
-        localKeysDir: path.join(getLocalKeysDir(), 'default'),
-        remotePublicKeysDir: path.join(getPeerKeysDir(), 'remote-server'),
         connectTimeout: 10_000,
         requestTimeout: 30_000,
     };
@@ -62,7 +57,6 @@ function remoteDefaults() {
     return {
         host: '127.0.0.1',
         port: 9999,
-        localKeysDir: getRemoteKeysDir(),
         callers: {},
         rateLimitPerMinute: 60,
     };
@@ -76,11 +70,9 @@ function remoteDefaults() {
  *   2. config.json → .proxy section (legacy combined format)
  *   3. Built-in defaults
  *
- * Key alias resolution (applied after loading):
- *   1. MCP_KEY_ALIAS env var (highest — set per agent at spawn time)
- *   2. localKeyAlias in config file
- *   3. localKeysDir in config file (explicit full path)
- *   4. Default: keys/local/default
+ * Key paths are derived automatically:
+ *   - Caller keys: keys/callers/{MCP_KEY_ALIAS || "default"}/
+ *   - Server keys: keys/server/
  */
 export function loadProxyConfig() {
     const def = proxyDefaults();
@@ -98,15 +90,17 @@ export function loadProxyConfig() {
     else {
         config = def;
     }
-    // Alias resolution: env var > config alias > localKeysDir > default
-    // eslint-disable-next-line @typescript-eslint/prefer-nullish-coalescing -- intentionally coerces empty string to undefined
-    const envAlias = process.env.MCP_KEY_ALIAS?.trim() || undefined;
-    const alias = envAlias ?? config.localKeyAlias;
-    if (alias) {
-        config.localKeysDir = path.join(getLocalKeysDir(), alias);
-    }
     return config;
 }
+/**
+ * Resolve the caller key alias for the MCP proxy.
+ *
+ * Resolution: MCP_KEY_ALIAS env var > "default"
+ */
+export function resolveCallerKeyAlias() {
+    // eslint-disable-next-line @typescript-eslint/prefer-nullish-coalescing -- intentionally coerces empty string
+    return process.env.MCP_KEY_ALIAS?.trim() || 'default';
+}
 /**
  * Load the remote server config.
  *
@@ -142,7 +136,6 @@ export function loadRemoteConfig() {
             'Migrating to caller-centric format. Please update your remote.config.json.');
         const legacyRoutes = rawConfig.routes;
         const legacyConnections = rawConfig.connections ?? [];
-        const legacyPeersDir = rawConfig.authorizedPeersDir ?? path.join(getPeerKeysDir(), 'authorized-clients');
         // Auto-assign aliases to unnamed routes for the default caller
         const connectors = legacyRoutes.map((r, i) => ({
             ...r,
@@ -153,11 +146,9 @@ export function loadRemoteConfig() {
             ...def,
             host: config.host,
             port: config.port,
-            localKeysDir: config.localKeysDir,
             connectors,
             callers: {
                 default: {
-                    peerKeyDir: legacyPeersDir,
                     connections: allConnectionNames,
                 },
             },
@@ -198,9 +189,9 @@ export function resolveCallerRoutes(config, callerAlias) {
     return caller.connections.map((name) => {
         // Custom connectors take precedence over built-in templates
         const custom = connectorsByAlias.get(name);
-        if (custom)
-            return custom;
-        return loadConnection(name);
+        const route = custom ?? loadConnection(name);
+        // Ensure every route carries its alias so it survives resolution
+        return route.alias === name ? route : { ...route, alias: name };
     });
 }
 // ── Secret / placeholder resolution ──────────────────────────────────────────
@@ -220,21 +211,33 @@ export function resolvePlaceholders(str, secretsMap) {
  * Load secrets from the config's secrets map, resolving from environment
  * variables. Value can be a literal string or "${VAR_NAME}" to read from env.
  *
- * When `envOverrides` is provided (pre-resolved caller env map), those values
- * are checked BEFORE process.env, allowing per-caller secret redirection.
+ * Resolution order for each ${VAR} reference:
+ *   1. `envOverrides[VAR]` — caller's explicit env mapping (pre-resolved)
+ *   2. `process.env[PREFIX_VAR]` — prefixed env var (e.g., ALICE_GITHUB_TOKEN)
+ *   3. Warning if not found (bare process.env fallback intentionally removed
+ *      to prevent cross-caller secret leakage)
+ *
+ * When `callerAlias` is omitted, step 2 is skipped (used for resolving
+ * the caller's own env mapping where prefixing doesn't apply).
  */
-export function resolveSecrets(secretsMap, envOverrides) {
+export function resolveSecrets(secretsMap, envOverrides, callerAlias) {
     const resolved = {};
     for (const [key, value] of Object.entries(secretsMap)) {
         const envMatch = /^\$\{(.+)\}$/.exec(value);
         if (envMatch) {
             const varName = envMatch[1];
-            const envVal = envOverrides?.[varName] ?? process.env[varName];
+            // 1. Caller's explicit env mapping (pre-resolved values)
+            let envVal = envOverrides?.[varName];
+            // 2. Prefixed env var (e.g., ALICE_GITHUB_TOKEN for caller "alice" + var "GITHUB_TOKEN")
+            if (envVal === undefined && callerAlias) {
+                const prefix = callerAlias.toUpperCase().replace(/-/g, '_');
+                envVal = process.env[`${prefix}_${varName}`];
+            }
             if (envVal !== undefined) {
                 resolved[key] = envVal;
             }
             else {
-                console.error(`[secrets] Warning: env var ${varName} not found for key ${key}`);
+                console.error(`[secrets] Warning: env var ${varName} not found for key ${key}${callerAlias ? ` (caller: ${callerAlias})` : ''}`);
             }
         }
         else {
@@ -249,23 +252,33 @@ export function resolveSecrets(secretsMap, envOverrides) {
  *
  * When `envOverrides` is provided, those pre-resolved values are checked
  * before process.env during secret resolution (used for per-caller env).
+ *
+ * When `callerAlias` is provided, prefixed env vars (e.g., ALICE_GITHUB_TOKEN)
+ * are checked as a fallback before giving up on a ${VAR} reference.
  */
-export function resolveRoutes(routes, envOverrides) {
+export function resolveRoutes(routes, envOverrides, callerAlias) {
     return routes.map((route) => {
-        const resolvedSecrets = resolveSecrets(route.secrets ?? {}, envOverrides);
+        const resolvedSecrets = resolveSecrets(route.secrets ?? {}, envOverrides, callerAlias);
         const resolvedHeaders = {};
         for (const [key, value] of Object.entries(route.headers ?? {})) {
             resolvedHeaders[key] = resolvePlaceholders(value, resolvedSecrets);
         }
         return {
+            ...(route.alias !== undefined && { alias: route.alias }),
             ...(route.name !== undefined && { name: route.name }),
             ...(route.description !== undefined && { description: route.description }),
             ...(route.docsUrl !== undefined && { docsUrl: route.docsUrl }),
             ...(route.openApiUrl !== undefined && { openApiUrl: route.openApiUrl }),
+            ...(route.stability !== undefined && { stability: route.stability }),
+            ...(route.category !== undefined && { category: route.category }),
             headers: resolvedHeaders,
             secrets: resolvedSecrets,
             allowedEndpoints: route.allowedEndpoints,
             resolveSecretsInBody: route.resolveSecretsInBody ?? false,
+            ...(route.testConnection !== undefined && { testConnection: route.testConnection }),
+            ...(route.testIngestor !== undefined && { testIngestor: route.testIngestor }),
+            ...(route.listenerConfig !== undefined && { listenerConfig: route.listenerConfig }),
+            ...(route.ingestor !== undefined && { ingestorConfig: route.ingestor }),
         };
     });
 }

package/dist/shared/connections.d.ts

@@ -2,13 +2,13 @@
  * Connection template loading.
  *
  * Connections are pre-built Route templates (JSON files) that ship with
- * the package in the connections/ directory. They provide ready-made
- * configurations for popular APIs (GitHub, Stripe, Trello, etc.).
+ * the package in the connections/ directory, organized into category
+ * subdirectories (ai/, messaging/, social-media/, etc.).
  *
  * At runtime, templates are loaded from disk relative to this module's
  * location, so they work from both src/ (dev via tsx) and dist/ (production).
  */
-import type { Route } from './config.js';
+import type { Route, ConnectionCategory } from './config.js';
 /** Metadata about a built-in connection template — used by UIs to render
  *  connection cards, form fields, and badges without parsing raw JSON. */
 export interface ConnectionTemplateInfo {
@@ -22,6 +22,10 @@ export interface ConnectionTemplateInfo {
     docsUrl?: string;
     /** URL to an OpenAPI / Swagger spec. */
     openApiUrl?: string;
+    /** Stability level: "stable", "beta", or "dev". */
+    stability: 'stable' | 'beta' | 'dev';
+    /** Category grouping (e.g., "ai", "messaging", "social-media"). */
+    category: ConnectionCategory;
     /** Secret names referenced in route headers — these are auto-injected
      *  into every request, so they must always be configured. */
     requiredSecrets: string[];
@@ -32,9 +36,20 @@ export interface ConnectionTemplateInfo {
     hasIngestor: boolean;
     /** Ingestor type, when present. */
     ingestorType?: 'websocket' | 'webhook' | 'poll';
+    /** Whether this connection has a pre-configured test request. */
+    hasTestConnection: boolean;
+    /** Whether this connection's ingestor has a pre-configured test. */
+    hasTestIngestor: boolean;
+    /** Whether this connection has a listener configuration schema. */
+    hasListenerConfig: boolean;
+    /** Whether this connection's listener supports multiple concurrent instances
+     *  (e.g., watching multiple Trello boards or Reddit subreddits simultaneously). */
+    supportsMultiInstance: boolean;
     /** Allowlisted URL patterns (glob). */
     allowedEndpoints: string[];
 }
+/** Invalidate the cached index. Exported for testing only. */
+export declare function _resetConnectionIndex(): void;
 /**
  * Load a single connection template by name.
  *
@@ -47,8 +62,9 @@ export declare function loadConnection(name: string): Route;
 /**
  * List all available connection template names.
  *
- * Scans the connections directory for .json files and returns their
- * basenames (without extension), sorted alphabetically.
+ * Scans the connections directory (including category subdirectories) for
+ * .json files and returns their basenames (without extension), sorted
+ * alphabetically.
  */
 export declare function listAvailableConnections(): string[];
 /**

package/dist/shared/connections.js

@@ -2,8 +2,8 @@
  * Connection template loading.
  *
  * Connections are pre-built Route templates (JSON files) that ship with
- * the package in the connections/ directory. They provide ready-made
- * configurations for popular APIs (GitHub, Stripe, Trello, etc.).
+ * the package in the connections/ directory, organized into category
+ * subdirectories (ai/, messaging/, social-media/, etc.).
  *
  * At runtime, templates are loaded from disk relative to this module's
  * location, so they work from both src/ (dev via tsx) and dist/ (production).
@@ -13,6 +13,46 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 /** Directory containing connection template JSON files. */
 const CONNECTIONS_DIR = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', 'connections');
+// ── Lazy-cached alias→filepath index ──────────────────────────────────────
+/** Cached alias → absolute filepath index. Built lazily on first access.
+ *  Supports both flat files (connections/foo.json) and category
+ *  subdirectories (connections/ai/anthropic.json). */
+let connectionIndex = null;
+/** Build the alias→filepath index by scanning CONNECTIONS_DIR.
+ *  Files at the top level and files in one level of subdirectories are
+ *  both indexed. The alias is always the filename without .json. */
+function getConnectionIndex() {
+    if (connectionIndex)
+        return connectionIndex;
+    connectionIndex = new Map();
+    if (!fs.existsSync(CONNECTIONS_DIR))
+        return connectionIndex;
+    const entries = fs.readdirSync(CONNECTIONS_DIR, { withFileTypes: true });
+    for (const entry of entries) {
+        if (entry.isFile() && entry.name.endsWith('.json')) {
+            // Top-level JSON file (backward compat)
+            const alias = entry.name.replace(/\.json$/, '');
+            connectionIndex.set(alias, path.join(CONNECTIONS_DIR, entry.name));
+        }
+        else if (entry.isDirectory()) {
+            // Category subdirectory — scan one level deep
+            const subdir = path.join(CONNECTIONS_DIR, entry.name);
+            const subEntries = fs.readdirSync(subdir, 'utf-8');
+            for (const subFile of subEntries) {
+                if (subFile.endsWith('.json')) {
+                    const alias = subFile.replace(/\.json$/, '');
+                    connectionIndex.set(alias, path.join(subdir, subFile));
+                }
+            }
+        }
+    }
+    return connectionIndex;
+}
+/** Invalidate the cached index. Exported for testing only. */
+export function _resetConnectionIndex() {
+    connectionIndex = null;
+}
+// ── Public API ────────────────────────────────────────────────────────────
 /**
  * Load a single connection template by name.
  *
@@ -22,8 +62,9 @@ const CONNECTIONS_DIR = path.join(path.dirname(fileURLToPath(import.meta.url)),
  * @throws If the template file does not exist or contains invalid JSON.
  */
 export function loadConnection(name) {
-    const filePath = path.join(CONNECTIONS_DIR, `${name}.json`);
-    if (!fs.existsSync(filePath)) {
+    const index = getConnectionIndex();
+    const filePath = index.get(name);
+    if (!filePath) {
         const available = listAvailableConnections();
         throw new Error(`Unknown connection "${name}". Available connections: ${available.join(', ') || '(none)'}`);
     }
@@ -33,18 +74,13 @@ export function loadConnection(name) {
 /**
  * List all available connection template names.
  *
- * Scans the connections directory for .json files and returns their
- * basenames (without extension), sorted alphabetically.
+ * Scans the connections directory (including category subdirectories) for
+ * .json files and returns their basenames (without extension), sorted
+ * alphabetically.
  */
 export function listAvailableConnections() {
-    if (!fs.existsSync(CONNECTIONS_DIR)) {
-        return [];
-    }
-    return fs
-        .readdirSync(CONNECTIONS_DIR, 'utf-8')
-        .filter((f) => f.endsWith('.json'))
-        .map((f) => f.replace(/\.json$/, ''))
-        .sort();
+    const index = getConnectionIndex();
+    return [...index.keys()].sort();
 }
 // ── Template introspection ────────────────────────────────────────────────
 /** Extract ${VAR} placeholder names from a string. */
@@ -92,10 +128,16 @@ export function listConnectionTemplates() {
             ...(route.description !== undefined && { description: route.description }),
             ...(route.docsUrl !== undefined && { docsUrl: route.docsUrl }),
             ...(route.openApiUrl !== undefined && { openApiUrl: route.openApiUrl }),
+            stability: route.stability ?? 'dev',
+            category: route.category,
             requiredSecrets,
             optionalSecrets,
             hasIngestor: route.ingestor !== undefined,
             ...(route.ingestor !== undefined && { ingestorType: route.ingestor.type }),
+            hasTestConnection: route.testConnection !== undefined,
+            hasTestIngestor: route.testIngestor !== undefined && route.testIngestor !== null,
+            hasListenerConfig: route.listenerConfig !== undefined,
+            supportsMultiInstance: route.listenerConfig?.supportsMultiInstance ?? false,
             allowedEndpoints: route.allowedEndpoints,
         };
     });

package/dist/shared/crypto/index.d.ts

@@ -1,3 +1,4 @@
 export { type KeyBundle, type SerializedKeyBundle, type PublicKeyBundle, type SerializedPublicKeys, generateKeyBundle, extractPublicKeys, serializeKeyBundle, deserializeKeyBundle, serializePublicKeys, deserializePublicKeys, saveKeyBundle, loadKeyBundle, loadPublicKeys, fingerprint, } from './keys.js';
 export { type DirectionalKey, type SessionKeys, deriveSessionKeys, EncryptedChannel, } from './channel.js';
+export { type CreateCallerResult, createCaller, exportCallerPublicKeys, exportServerPublicKeys, importCallerPublicKeys, saveServerPublicKeys, listCallers, callerExists, serverExists, callerFingerprint, serverFingerprint, } from './key-manager.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/shared/crypto/index.js

@@ -1,3 +1,4 @@
 export { generateKeyBundle, extractPublicKeys, serializeKeyBundle, deserializeKeyBundle, serializePublicKeys, deserializePublicKeys, saveKeyBundle, loadKeyBundle, loadPublicKeys, fingerprint, } from './keys.js';
 export { deriveSessionKeys, EncryptedChannel, } from './channel.js';
+export { createCaller, exportCallerPublicKeys, exportServerPublicKeys, importCallerPublicKeys, saveServerPublicKeys, listCallers, callerExists, serverExists, callerFingerprint, serverFingerprint, } from './key-manager.js';
 //# sourceMappingURL=index.js.map

package/dist/shared/crypto/key-manager.d.ts

@@ -0,0 +1,67 @@
+/**
+ * High-level key management API.
+ *
+ * Provides CRUD operations over the drawlatch key directory structure
+ * so that callboard (and other consumers) can manage keys programmatically
+ * without touching the filesystem directly.
+ *
+ * Key layout:
+ *   keys/callers/<alias>/  — Caller keypairs (one per alias)
+ *   keys/server/           — Server keypair (single, flat)
+ */
+import { type SerializedPublicKeys } from './keys.js';
+export interface CreateCallerResult {
+    publicKeys: SerializedPublicKeys;
+    fingerprint: string;
+}
+interface KeyManagerOpts {
+    configDir?: string;
+}
+/**
+ * Create a new caller identity (Ed25519 + X25519 keypairs).
+ * Saves under `keys/callers/<alias>/`.
+ * Throws if the alias already exists.
+ */
+export declare function createCaller(alias: string, opts?: KeyManagerOpts): CreateCallerResult;
+/**
+ * Export public keys for a caller identity.
+ * Reads from `keys/callers/<alias>/`.
+ */
+export declare function exportCallerPublicKeys(alias: string, opts?: KeyManagerOpts): SerializedPublicKeys;
+/**
+ * Export public keys for the server.
+ * Reads from `keys/server/`.
+ */
+export declare function exportServerPublicKeys(opts?: KeyManagerOpts): SerializedPublicKeys;
+/**
+ * Import a caller's public keys. Saves under `keys/callers/<alias>/`.
+ * Used by the server to store received caller public keys (e.g., via sync).
+ */
+export declare function importCallerPublicKeys(alias: string, keys: SerializedPublicKeys, opts?: KeyManagerOpts): void;
+/**
+ * Save server public keys. Writes to `keys/server/`.
+ * Used by callboard to store the remote server's public keys (e.g., via sync).
+ */
+export declare function saveServerPublicKeys(keys: SerializedPublicKeys, opts?: KeyManagerOpts): void;
+/**
+ * List all caller aliases (scans `keys/callers/`).
+ */
+export declare function listCallers(opts?: KeyManagerOpts): string[];
+/**
+ * Check if a caller identity exists (has at least public keys).
+ */
+export declare function callerExists(alias: string, opts?: KeyManagerOpts): boolean;
+/**
+ * Check if server keys exist.
+ */
+export declare function serverExists(opts?: KeyManagerOpts): boolean;
+/**
+ * Get the fingerprint of a caller's keys.
+ */
+export declare function callerFingerprint(alias: string, opts?: KeyManagerOpts): string;
+/**
+ * Get the fingerprint of the server's keys.
+ */
+export declare function serverFingerprint(opts?: KeyManagerOpts): string;
+export {};
+//# sourceMappingURL=key-manager.d.ts.map