@xopcai/xopc 0.0.303 → 0.0.307

package/dist/src/connectors/composio-sessions.d.ts

@@ -12,6 +12,7 @@ export type ComposioToolkitCatalogItem = {
     providerConnectionId?: string;
 };
 export type ComposioAuthorizeResult = {
+    attemptId: string;
     toolkit: string;
     connectionId: string;
     connectUrl?: string;
@@ -19,6 +20,7 @@ export type ComposioAuthorizeResult = {
 };
 export type { ComposioAuthConfigOption, ComposioSessionLike, ComposioSessionsClient, ComposioToolkitAuthState, } from './composio-session-types.js';
 export type ComposioSessionContext = {
+    backendId?: string;
     principalId: string;
     installationScope?: string;
     providerPrincipalId?: string;
@@ -27,15 +29,18 @@ export type ComposioSessionContext = {
     connectedAccounts?: Record<string, string[]>;
     callbackUrl?: string;
 };
-type ClientFactory = () => Promise<ComposioSessionsClient>;
+type ClientFactory = (backendId?: string) => Promise<ComposioSessionsClient>;
 /** Convert local identities to stable opaque Composio user IDs without disclosing user data. */
 export declare function createComposioPrincipalId(principalId: string, installationScope?: string): string;
 export declare class ComposioSessionsAdapter {
     private readonly createClient;
+    private readonly injectedClient;
+    private readonly resolver;
     constructor(options?: {
         resolver?: CredentialResolver;
         clientFactory?: ClientFactory;
         fileDownloadDir?: string;
+        apiKey?: string;
     });
     createSession(context: ComposioSessionContext): Promise<ComposioSessionLike>;
     getToolkitAuthState(toolkit: string): Promise<ComposioToolkitAuthState>;
@@ -45,8 +50,12 @@ export declare class ComposioSessionsAdapter {
         authConfigId?: string;
         installationId?: string;
         alias?: string;
+        expectedAccountId?: string;
     }): Promise<ComposioAuthorizeResult>;
-    syncConnections(context: Pick<ComposioSessionContext, 'principalId' | 'installationScope'>): Promise<ConnectorConnection[]>;
+    /** Verify a replacement credential without changing local authorizations. */
+    verifyConnections(connections: ConnectorConnection[]): Promise<void>;
+    private listAllAccounts;
+    syncConnections(context: Pick<ComposioSessionContext, 'principalId' | 'installationScope' | 'backendId'>): Promise<ConnectorConnection[]>;
     revokeConnection(connection: ConnectorConnection): Promise<void>;
     refreshConnection(connection: ConnectorConnection): Promise<ConnectorConnection>;
     executeWithPolicy(input: {

package/dist/src/connectors/composio-sessions.js

@@ -1,32 +1,39 @@
-import { init_paths_state, resolveStateDir } from "../config/paths-state.js";
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
-import { appendConnectorExecutionAudit, getConnectorConnection, getConnectorInstallation, listConnectorConnections, upsertConnectorConnection } from "../storage/sqlite/connector-repository.js";
-import { reconcileConnectorAccount } from "../storage/sqlite/connector-account-repository.js";
+import { getSqliteDatabase, init_transaction } from "../storage/sqlite/transaction.js";
+import { getConnectorAccount, init_connector_account_repository, reconcileConnectorAccount } from "../storage/sqlite/connector-account-repository.js";
+import { appendConnectorExecutionAudit, getConnectorConnection, getConnectorInstallation, init_connector_repository, listConnectorConnections, upsertConnectorConnection } from "../storage/sqlite/connector-repository.js";
 import { CredentialResolver, init_credentials } from "../auth/credentials.js";
+import { ensureComposioBackend, getComposioBackend, listComposioBackends, resolveBackendKey } from "./composio-backends.js";
+import { saveAuthorizationAttempt } from "./authorization-attempts.js";
 import { connectorIdentityKey, mergeConnectorIdentity } from "./connector-identity.js";
 import { evaluateConnectorExecutionPolicy } from "./policy.js";
-import { resolve } from "node:path";
+import { canAccessConnectorAccount } from "./account-access.js";
 import { createHash } from "node:crypto";
 //#region src/connectors/composio-sessions.ts
 init_credentials();
-init_paths_state();
+init_transaction();
+init_connector_account_repository();
+init_connector_repository();
 init_logger();
 const log = createLogger("Connectors:ComposioSessions");
-const COMPOSIO_API_KEY_PROVIDER = "connector-composio-api-key";
 async function resolveComposioApiKey(resolver = new CredentialResolver()) {
-	return (await resolver.resolveApiKey(COMPOSIO_API_KEY_PROVIDER).catch(() => void 0))?.trim() || process.env.XOPC_COMPOSIO_API_KEY?.trim() || process.env.COMPOSIO_API_KEY?.trim() || null;
+	return resolveBackendKey(await ensureComposioBackend(resolver), resolver);
 }
 async function assertComposioAccessConfigured(resolver = new CredentialResolver()) {
-	if (await resolveComposioApiKey(resolver)) return "byok";
+	const backend = await ensureComposioBackend(resolver);
+	if (backend.mode === "byok") {
+		if (await resolveBackendKey(backend, resolver)) return "byok";
+		throw new Error("This Composio project needs its API key. Open connection service settings.");
+	}
 	if ((await resolver.resolveApiKey("xopc-cloud").catch(() => null))?.trim()) return "managed";
-	throw new Error("Composio API key is not configured and XOPC Cloud is not signed in. Install the \"Composio API Key\" connector first or sign in to XOPC Cloud.");
+	throw new Error("Composio API key is not configured and XOPC Cloud is not signed in. Open connection service settings or sign in to XOPC Cloud.");
 }
 function stableHash(value) {
 	return createHash("sha256").update(value).digest("hex").slice(0, 24);
 }
 function defaultInstallationScope() {
-	return resolve(resolveStateDir());
+	return getSqliteDatabase().prepare("SELECT installation_id FROM connector_runtime_identity WHERE id = 1").get().installation_id;
 }
 /** Convert local identities to stable opaque Composio user IDs without disclosing user data. */
 function createComposioPrincipalId(principalId, installationScope = defaultInstallationScope()) {
@@ -84,17 +91,26 @@ function missingAuthConfigMessage(error, toolkit, authConfigId) {
 }
 var ComposioSessionsAdapter = class {
 	createClient;
+	injectedClient;
+	resolver;
 	constructor(options = {}) {
+		this.resolver = options.resolver ?? new CredentialResolver();
+		this.injectedClient = Boolean(options.clientFactory || options.apiKey);
 		if (options.clientFactory) {
 			this.createClient = options.clientFactory;
 			return;
 		}
-		const resolver = options.resolver ?? new CredentialResolver();
-		this.createClient = async () => {
-			const apiKey = await resolveComposioApiKey(resolver);
-			if (!apiKey) {
+		const resolver = this.resolver;
+		this.createClient = async (backendId) => {
+			const backend = options.apiKey ? void 0 : backendId ? getComposioBackend(backendId) : await ensureComposioBackend(resolver);
+			if (backendId && !backend) throw new Error("Connection service is unavailable.");
+			const apiKey = options.apiKey ?? (backend ? await resolveBackendKey(backend, resolver) : null);
+			if (backend?.mode === "byok" && !apiKey) throw new Error("This Composio project needs its API key.");
+			if (backend?.mode === "managed") {
 				const { ManagedComposioClient } = await import("./composio-managed-client.js");
-				return new ManagedComposioClient();
+				const client = new ManagedComposioClient();
+				client.backendId = backend.id;
+				return client;
 			}
 			let Composio;
 			try {
@@ -112,11 +128,12 @@ var ComposioSessionsAdapter = class {
 				host: "xopc"
 			});
 			client.mode = "byok";
+			client.backendId = backend?.id;
 			return client;
 		};
 	}
 	async createSession(context) {
-		const client = await this.createClient();
+		const client = await this.createClient(context.backendId);
 		const config = {
 			manageConnections: {
 				enable: true,
@@ -183,11 +200,13 @@ var ComposioSessionsAdapter = class {
 		return items;
 	}
 	async authorize(context) {
+		const backendId = (await this.createClient(context.backendId)).backendId;
 		const providerPrincipalId = createComposioPrincipalId(context.principalId, context.installationScope);
 		let session;
 		try {
 			session = await this.createSession({
 				...context,
+				backendId,
 				providerPrincipalId,
 				toolkits: [context.toolkit],
 				...context.authConfigId ? { authConfigs: { [context.toolkit]: context.authConfigId } } : {}
@@ -202,8 +221,8 @@ var ComposioSessionsAdapter = class {
 			alias: context.alias
 		});
 		const connectorId = `composio-${context.toolkit}`;
-		upsertConnectorConnection({
-			id: `composio-${request.id}`,
+		const pending = upsertConnectorConnection({
+			id: `composio-${backendId ? `${backendId}-` : ""}${request.id}`,
 			installationId: context.installationId && getConnectorInstallation(context.installationId) ? context.installationId : void 0,
 			connectorId,
 			provider: "composio",
@@ -212,29 +231,74 @@ var ComposioSessionsAdapter = class {
 			alias: context.alias,
 			identity: {},
 			status: connectionStatus(request.status),
-			isDefault: listConnectorConnections({
-				principalId: context.principalId,
-				connectorId
-			}).length === 0,
+			isDefault: false,
 			metadata: {
 				toolkit: context.toolkit,
 				providerPrincipalId,
-				...context.authConfigId ? { authConfigId: context.authConfigId } : {}
+				...context.authConfigId ? { authConfigId: context.authConfigId } : {},
+				...backendId ? { backendId } : {}
 			}
 		});
+		if (backendId && pending.accountId) getSqliteDatabase().prepare("UPDATE connector_accounts SET backend_id = ? WHERE id = ?").run(backendId, pending.accountId);
 		return {
+			attemptId: saveAuthorizationAttempt({
+				connectionId: pending.id,
+				principalId: context.principalId,
+				connectorId,
+				backendId,
+				expectedAccountId: context.expectedAccountId,
+				url: request.redirectUrl ?? void 0
+			}),
 			toolkit: context.toolkit,
 			connectionId: request.id,
 			connectUrl: request.redirectUrl ?? void 0,
 			status: request.status
 		};
 	}
-	async syncConnections(context) {
+	/** Verify a replacement credential without changing local authorizations. */
+	async verifyConnections(connections) {
 		const client = await this.createClient();
+		const users = [...new Set(connections.map((connection) => connection.metadata.providerPrincipalId))];
+		for (const userId of users) {
+			if (typeof userId !== "string" || !userId) throw new Error("Refresh existing account identities before replacing this key.");
+			const rows = await this.listAllAccounts(client, [userId]);
+			const ids = new Set(rows.flatMap((row) => row && typeof row === "object" ? [readString(row, ["id", "connected_account_id"])] : []));
+			if (connections.some((connection) => connection.metadata.providerPrincipalId === userId && !ids.has(connection.providerConnectionId))) throw new Error("This key cannot access the existing accounts. Add it as a new project instead.");
+		}
+	}
+	async listAllAccounts(client, userIds) {
+		const rows = [];
+		const cursors = /* @__PURE__ */ new Set();
+		let cursor;
+		do {
+			const payload = await client.connectedAccounts.list({
+				userIds,
+				...cursor ? { cursor } : {}
+			});
+			rows.push(...readArray(payload));
+			cursor = payload && typeof payload === "object" ? readString(payload, ["nextCursor", "next_cursor"]) : void 0;
+			if (cursor && (cursors.has(cursor) || cursors.size >= 100)) throw new Error("Unable to retrieve the complete connected account list. Retry syncing.");
+			if (cursor) cursors.add(cursor);
+		} while (cursor);
+		return rows;
+	}
+	async syncConnections(context) {
+		if (!this.injectedClient && !context.backendId) {
+			await ensureComposioBackend(this.resolver);
+			const results = await Promise.allSettled(listComposioBackends().map((backend) => this.syncConnections({
+				...context,
+				backendId: backend.id
+			})));
+			if (results.every((result) => result.status === "rejected")) throw results[0].reason;
+			return results.flatMap((result) => result.status === "fulfilled" ? result.value : []);
+		}
+		const client = await this.createClient(context.backendId);
 		const providerPrincipalId = createComposioPrincipalId(context.principalId, context.installationScope);
-		const payload = await client.connectedAccounts.list({ userIds: [providerPrincipalId] });
+		const stored = listConnectorConnections({ principalId: context.principalId }).filter((connection) => (connection.metadata.backendId ?? getConnectorAccount(connection.accountId)?.backendId) === client.backendId);
+		const userIds = [...new Set([providerPrincipalId, ...stored.flatMap((connection) => typeof connection.metadata.providerPrincipalId === "string" ? [connection.metadata.providerPrincipalId] : [])])];
+		const rows = await this.listAllAccounts(client, userIds);
 		const synced = [];
-		for (const item of readArray(payload)) {
+		for (const item of rows) {
 			if (!item || typeof item !== "object" || Array.isArray(item)) continue;
 			const row = item;
 			const toolkitRecord = row.toolkit && typeof row.toolkit === "object" && !Array.isArray(row.toolkit) ? row.toolkit : {};
@@ -250,10 +314,10 @@ var ComposioSessionsAdapter = class {
 			const existing = listConnectorConnections({
 				principalId: context.principalId,
 				connectorId
-			}).find((connection) => connection.providerConnectionId === providerConnectionId);
+			}).find((connection) => connection.providerConnectionId === providerConnectionId && (connection.metadata.backendId ?? getConnectorAccount(connection.accountId)?.backendId) === client.backendId);
 			const identity = row.connectionData && typeof row.connectionData === "object" && !Array.isArray(row.connectionData) ? row.connectionData : {};
 			const connection = upsertConnectorConnection({
-				id: existing?.id ?? `composio-${providerConnectionId}`,
+				id: existing?.id ?? `composio-${client.backendId ? `${client.backendId}-` : ""}${providerConnectionId}`,
 				accountId: existing?.accountId,
 				installationId: existing?.installationId,
 				connectorId,
@@ -269,12 +333,37 @@ var ComposioSessionsAdapter = class {
 				metadata: {
 					...existing?.metadata,
 					toolkit,
-					providerPrincipalId
+					providerPrincipalId: existing?.metadata.providerPrincipalId ?? readString(row, ["userId", "user_id"]) ?? providerPrincipalId,
+					...client.backendId ? { backendId: client.backendId } : {}
 				}
 			});
-			const identityKey = connectorIdentityKey(toolkit, connection.identity);
+			if (client.backendId && connection.accountId && !connectorIdentityKey(toolkit, connection.identity)) getSqliteDatabase().prepare("UPDATE connector_accounts SET backend_id = ? WHERE id = ?").run(client.backendId, connection.accountId);
+			let identityKey = connectorIdentityKey(toolkit, connection.identity);
+			const probe = {
+				gmail: "GMAIL_GET_PROFILE",
+				googledrive: "GOOGLEDRIVE_GET_ABOUT",
+				github: "GITHUB_GET_THE_AUTHENTICATED_USER",
+				slack: "SLACK_TEST_AUTH"
+			}[toolkit];
+			if (!identityKey && probe && connection.status === "active" && Date.now() - Number(connection.metadata.identityCheckedAt ?? 0) > 3e5) {
+				try {
+					const profile = await (await this.createSession({
+						...context,
+						backendId: client.backendId,
+						toolkits: [toolkit],
+						authConfigs: typeof connection.metadata.authConfigId === "string" ? { [toolkit]: connection.metadata.authConfigId } : void 0,
+						providerPrincipalId: String(connection.metadata.providerPrincipalId),
+						connectedAccounts: { [toolkit]: [providerConnectionId] }
+					})).execute(probe, {}, { account: providerConnectionId });
+					connection.identity = mergeConnectorIdentity(toolkit, connection.identity, profile && typeof profile === "object" ? profile : {});
+					identityKey = connectorIdentityKey(toolkit, connection.identity);
+				} catch {}
+				connection.metadata.identityCheckedAt = Date.now();
+				upsertConnectorConnection(connection);
+			}
 			if (identityKey) reconcileConnectorAccount({
 				connectionId: connection.id,
+				backendId: client.backendId,
 				identityKey,
 				identity: connection.identity
 			});
@@ -283,7 +372,9 @@ var ComposioSessionsAdapter = class {
 		return synced;
 	}
 	async revokeConnection(connection) {
-		await (await this.createClient()).connectedAccounts.delete(connection.providerConnectionId);
+		const backendId = getConnectorAccount(connection.accountId)?.backendId;
+		if (!this.injectedClient && !backendId) throw new Error("Refresh account status to verify its connection service first.");
+		await (await this.createClient(backendId)).connectedAccounts.delete(connection.providerConnectionId);
 		upsertConnectorConnection({
 			...connection,
 			status: "revoked",
@@ -292,16 +383,25 @@ var ComposioSessionsAdapter = class {
 		});
 	}
 	async refreshConnection(connection) {
-		await (await this.createClient()).connectedAccounts.refresh(connection.providerConnectionId);
-		const synced = await this.syncConnections({ principalId: connection.principalId });
+		const backendId = getConnectorAccount(connection.accountId)?.backendId;
+		if (!this.injectedClient && !backendId) throw new Error("Refresh account status to verify its connection service first.");
+		await (await this.createClient(backendId)).connectedAccounts.refresh(connection.providerConnectionId);
+		const synced = await this.syncConnections({
+			principalId: connection.principalId,
+			backendId
+		});
 		return synced.find((candidate) => candidate.id === connection.id) ?? synced.find((candidate) => candidate.providerConnectionId === connection.providerConnectionId) ?? connection;
 	}
 	async executeWithPolicy(input) {
+		if (!input.connection || input.connection.status !== "active" || !canAccessConnectorAccount(input.connection, input.installation, input.agentId)) return {
+			decision: "denied",
+			reason: "Account is unavailable to this agent."
+		};
 		const evaluation = evaluateConnectorExecutionPolicy({
 			installation: input.installation,
 			action: input.action,
 			agentId: input.agentId,
-			connectionId: input.connection?.id,
+			accountId: input.connection?.accountId,
 			confirmed: input.confirmed
 		});
 		if (evaluation.decision !== "allowed") {
@@ -324,6 +424,7 @@ var ComposioSessionsAdapter = class {
 		}
 		const startedAt = Date.now();
 		try {
+			if (!this.injectedClient && input.connection && !getConnectorAccount(input.connection.accountId)?.backendId) throw new Error("The account connection service has not been verified. Refresh account status first.");
 			const toolkit = input.action.toolkit;
 			const connectedAccounts = toolkit && input.connection ? { [toolkit]: [input.connection.providerConnectionId] } : input.context.connectedAccounts;
 			const providerPrincipalId = input.connection?.metadata.providerPrincipalId;
@@ -331,8 +432,9 @@ var ComposioSessionsAdapter = class {
 			if (input.connection && (typeof providerPrincipalId !== "string" || !providerPrincipalId.trim())) throw new Error("Connected account is missing its provider identity. Reconnect the account and try again.");
 			const result = await (await this.createSession({
 				...input.context,
+				backendId: input.connection?.accountId ? getConnectorAccount(input.connection.accountId)?.backendId : input.context.backendId,
 				connectedAccounts,
-				...toolkit && typeof connectionAuthConfigId === "string" && connectionAuthConfigId.trim() ? { authConfigs: { [toolkit]: connectionAuthConfigId.trim() } } : {},
+				...toolkit && typeof connectionAuthConfigId === "string" && connectionAuthConfigId.trim() ? { authConfigs: { [toolkit]: connectionAuthConfigId.trim() } } : { authConfigs: void 0 },
 				...typeof providerPrincipalId === "string" ? { providerPrincipalId } : {}
 			})).execute(input.action.actionId, input.args ?? {}, input.connection ? { account: input.connection.providerConnectionId } : void 0);
 			appendConnectorExecutionAudit({

package/dist/src/connectors/composio-triggers.js

@@ -1,7 +1,8 @@
-import { listConnectorConnections, upsertConnectorConnection } from "../storage/sqlite/connector-repository.js";
+import { init_connector_repository, listConnectorConnections, upsertConnectorConnection } from "../storage/sqlite/connector-repository.js";
 import { DurableState } from "../storage/sqlite/durable-state.js";
 import crypto, { createHmac, timingSafeEqual } from "node:crypto";
 //#region src/connectors/composio-triggers.ts
+init_connector_repository();
 function readString(value) {
 	return typeof value === "string" && value.trim() ? value.trim() : void 0;
 }
@@ -35,7 +36,8 @@ function applyComposioConnectionLifecycleEvent(payload) {
 	if (normalized.type !== "composio.connected_account.expired" && normalized.type !== "composio.connected_account.deleted") return void 0;
 	const providerConnectionId = readString(normalized.data.id ?? normalized.data.nanoid ?? normalized.data.connected_account_id);
 	if (!providerConnectionId) return void 0;
-	const connection = listConnectorConnections().find((candidate) => candidate.provider === "composio" && candidate.providerConnectionId === providerConnectionId);
+	const candidates = listConnectorConnections().filter((candidate) => candidate.provider === "composio" && candidate.providerConnectionId === providerConnectionId);
+	const connection = candidates.length === 1 ? candidates[0] : void 0;
 	if (!connection) return void 0;
 	upsertConnectorConnection({
 		...connection,

package/dist/src/connectors/composio.d.ts

@@ -3,13 +3,16 @@ import type { Config } from '../config/schema.js';
 import { type ComposioToolkitAuthState } from './composio-sessions.js';
 import type { ConnectorConfirmationPolicy, ConnectorDefinition, ConnectorInstallationPolicy } from './types.js';
 export type ComposioConnection = {
+    supportsLearning: boolean;
+    backendLabel?: string;
     id: string;
     accountId?: string;
+    accountEnabled: boolean;
+    allowedAgentIds: string[] | null;
     providerConnectionId: string;
     toolkit: string;
     status: string;
     alias?: string;
-    isDefault: boolean;
     isCurrentAuthorization: boolean;
     accountEmail?: string;
     workspace?: string;
@@ -60,22 +63,20 @@ export declare function canUseComposioAction(config: Config | undefined, slug: s
     scope: ComposioScope;
 };
 export declare const COMPOSIO_CONNECTORS: readonly ConnectorDefinition[];
-export declare function saveComposioApiKey(input: {
-    secrets?: Record<string, unknown>;
-}, resolver?: CredentialResolver): Promise<void>;
-export declare function configureComposioApiKey(apiKey: string, resolver?: CredentialResolver): Promise<void>;
+export declare function configureComposioApiKey(apiKey: string, resolver?: CredentialResolver, replaceBackendId?: string): Promise<void>;
 export declare function listComposioConnections(resolver?: CredentialResolver): Promise<ComposioConnection[]>;
 export declare function inspectComposioConnectorHealth(toolkit: string, resolver?: CredentialResolver): Promise<ComposioConnectorHealth>;
-export declare function getComposioToolkitAuthState(toolkit: string, resolver?: CredentialResolver): Promise<ComposioToolkitAuthState>;
+export declare function getComposioToolkitAuthState(toolkit: string, resolver?: CredentialResolver): Promise<ComposioToolkitAuthState & {
+    mode: 'managed' | 'byok';
+}>;
 export declare function getComposioInstallationPolicy(config: Config | undefined, toolkit: string): ConnectorInstallationPolicy;
 export declare function updateComposioInstallationPolicy(config: Config | undefined, toolkit: string, patch: {
     allowedAgentIds?: string[];
     confirmationPolicy?: ConnectorConfirmationPolicy;
-    selectedConnectionIds?: string[];
+    selectedAccountIds?: string[] | null;
 }): ConnectorInstallationPolicy;
 export declare function updateComposioConnection(id: string, patch: {
     alias?: string;
-    isDefault?: boolean;
 }): ComposioConnection;
 export declare function refreshComposioConnection(id: string, resolver?: CredentialResolver): Promise<void>;
 export declare function revokeComposioConnection(id: string, resolver?: CredentialResolver): Promise<void>;
@@ -83,10 +84,12 @@ export declare function startComposioAuthorize(connectorId: string, toolkit: str
     toolkit: string;
     connectUrl: string;
     connectionId?: string;
+    attemptId: string;
 }>;
 export declare function listComposioTools(toolkit: string, config?: Config, resolver?: CredentialResolver): Promise<ComposioTool[]>;
 export declare function executeComposioTool(params: {
     slug: string;
+    accountId?: string;
     arguments?: unknown;
     config?: Config;
 }, resolver?: CredentialResolver): Promise<unknown>;