@xopcai/xopc 0.0.306 → 0.0.307

package/dist/src/connectors/connected-source-ingestion.js

@@ -2,6 +2,7 @@ import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { getConnectorInstallation, listConnectorConnections } from "../storage/sqlite/connector-repository.js";
 import "../storage/sqlite/index.js";
+import { canAccessConnectorAccount, currentAccountConnections } from "./account-access.js";
 import { ComposioSessionsAdapter } from "./composio-sessions.js";
 import { decodeConnectedSourceCursor, encodeConnectedSourceCursor } from "./connected-source-cursor.js";
 import { scopeForComposioAction } from "./composio.js";
@@ -288,11 +289,11 @@ async function ingestComposioConnectedSource(input) {
 	const installation = getConnectorInstallation(`${connectorId}-local-owner`);
 	if (!installation?.enabled) throw new Error("Connector installation is not enabled.");
 	if (installation.allowedAgentIds.length && !installation.allowedAgentIds.includes(input.agentId)) throw new Error("This agent is not allowed to sync from the connector.");
-	const activeConnections = listConnectorConnections({
+	const activeConnections = currentAccountConnections(listConnectorConnections({
 		principalId: "local-owner",
 		connectorId
-	}).filter((connection) => connection.status === "active");
-	const connection = input.connectionId ? activeConnections.find((candidate) => candidate.id === input.connectionId) : activeConnections.find((candidate) => candidate.isDefault) ?? activeConnections[0];
+	}).filter((connection) => canAccessConnectorAccount(connection, installation, input.agentId)));
+	const connection = input.connectionId ? activeConnections.find((candidate) => candidate.id === input.connectionId) : activeConnections.length === 1 ? activeConnections[0] : void 0;
 	if (!connection) throw new Error("No active connector account is available for connected source ingestion.");
 	if (!connection.accountId) throw new Error("The connector authorization is not assigned to an account.");
 	const adapter = input.adapter ?? new ComposioSessionsAdapter();

package/dist/src/connectors/connection-recovery-service.js

@@ -3,17 +3,18 @@ import { init_logger } from "../utils/logger.js";
 import { getSqliteDatabase, init_transaction } from "../storage/sqlite/transaction.js";
 import { readCurrentTranscriptId } from "../storage/sqlite/session-instance-repository.js";
 import { getSessionInputState, init_session_input_repository } from "../storage/sqlite/session-input-repository.js";
+import { getConnectorAccount, init_connector_account_repository } from "../storage/sqlite/connector-account-repository.js";
+import { getConnectorConnection, getConnectorInstallation, init_connector_repository, listConnectorConnections, upsertConnectorInstallation } from "../storage/sqlite/connector-repository.js";
 import { cancelConnectionObjective, getActiveConnectionWait, getConnectionWait, init_connection_wait_repository, listConnectionWaitsToCheck, publishConnectionWait, queueConnectionResolution, updateConnectionWait } from "../storage/sqlite/connection-wait-repository.js";
 import { init_session_repository } from "../storage/sqlite/session-repository.js";
-import { getConnectorInstallation, listConnectorConnections, upsertConnectorInstallation } from "../storage/sqlite/connector-repository.js";
-import { getConnectorAccount } from "../storage/sqlite/connector-account-repository.js";
+import { canAccessConnectorAccount, currentAccountConnections } from "./account-access.js";
 import { ComposioSessionsAdapter } from "./composio-sessions.js";
 import { getConfiguredComposioAuthConfigs, isComposioActionAllowedByCatalog, scopeForComposioAction } from "./composio.js";
 import { getConnectorDefinition } from "./catalog.js";
+import { listConnectorInstances } from "./instances.js";
 import { capabilityActions, isToolInputSchema, missingConnectionCapabilities } from "./connection-capabilities.js";
 import { connectorPrincipalForSession } from "./principal.js";
 import { resolveConnectionCandidate } from "./connection-candidates.js";
-import { listConnectorInstances } from "./instances.js";
 import { installConnector } from "./install.js";
 import { persistConfigMutation } from "../config/config-mutation.js";
 import { randomUUID } from "node:crypto";
@@ -22,6 +23,8 @@ init_transaction();
 init_session_repository();
 init_session_input_repository();
 init_connection_wait_repository();
+init_connector_repository();
+init_connector_account_repository();
 init_logger();
 const log = createLogger("Connectors:Recovery");
 const SCOPE_ORDER = {
@@ -88,12 +91,13 @@ var ConnectionRecoveryService = class {
 			const instance = listConnectorInstances(this.deps.getConfig()).find((instance) => instance.connectorId === need.connectorId);
 			const installation = getConnectorInstallation(`${need.connectorId}-${wait.principalId}`);
 			const scopeBlocked = Math.max(1, ...need.capabilities.filter((capability) => /^[A-Z]+_/.test(capability)).map((capability) => SCOPE_ORDER[scopeForComposioAction(capability).scope])) > SCOPE_ORDER[installation?.maxScope ?? "read"];
-			const blocked = scopeBlocked || instance?.enabled === false || installation?.enabled === false || Boolean(installation?.allowedAgentIds.length && !installation.allowedAgentIds.includes(wait.agentId));
 			const all = listConnectorConnections({
 				principalId: wait.principalId,
 				connectorId: need.connectorId
 			});
-			const eligible = all.filter((connection) => connection.status === "active" && (!verifiedIds || verifiedIds.has(connection.id)) && (!need.accountId || connection.accountId === need.accountId) && (!installation?.selectedConnectionIds.length || installation.selectedConnectionIds.includes(connection.id)));
+			const requested = need.accountId ? all.find((connection) => connection.accountId === need.accountId) : void 0;
+			const blocked = scopeBlocked || instance?.enabled === false || installation?.enabled === false || installation?.selectedAccountIds?.length === 0 || Boolean(installation && requested && !canAccessConnectorAccount(requested, installation, wait.agentId)) || Boolean(installation?.allowedAgentIds.length && !installation.allowedAgentIds.includes(wait.agentId));
+			const eligible = all.filter((connection) => connection.status === "active" && (!installation || canAccessConnectorAccount(connection, installation, wait.agentId)) && (!verifiedIds || verifiedIds.has(connection.id)) && (!need.accountId || connection.accountId === need.accountId) && (installation?.selectedAccountIds == null || Boolean(connection.accountId && installation.selectedAccountIds.includes(connection.accountId))));
 			const byAccount = /* @__PURE__ */ new Map();
 			for (const connection of eligible) {
 				const key = connection.accountId ?? connection.id;
@@ -102,7 +106,7 @@ var ConnectionRecoveryService = class {
 				if (!previous || connection.id === preferredId || previous.id !== preferredId && connection.updatedAt > previous.updatedAt) byAccount.set(key, connection);
 			}
 			const active = [...byAccount.values()];
-			const selected = !verifiedIds && need.unavailable ? void 0 : need.attempt ? active.find((connection) => connection.providerConnectionId === need.attempt?.connectionId) : need.connectionId ? active.find((connection) => connection.id === need.connectionId) : active.length === 1 && !need.accountSelector ? active[0] : void 0;
+			const selected = !verifiedIds && need.unavailable ? void 0 : need.attempt ? active.find((connection) => connection.providerConnectionId === need.attempt?.connectionId) : need.accountId ? active.find((connection) => connection.accountId === need.accountId) : need.connectionId ? active.find((connection) => connection.id === need.connectionId) : active.length === 1 && !need.accountSelector ? active[0] : void 0;
 			const phase = blocked || selected && need.capabilityError ? "blocked" : selected ? "ready" : active.length > 1 || need.accountSelector && active.length > 0 && !need.connectionId ? "choose_account" : need.attempt && need.attempt.expiresAt > Date.now() ? "authorizing" : need.unavailable || all.some((connection) => [
 				"expired",
 				"revoked",
@@ -115,11 +119,12 @@ var ConnectionRecoveryService = class {
 			return {
 				...need,
 				alternatives,
+				accountId: selected?.accountId ?? need.accountId,
 				connectionId: selected?.id ?? need.connectionId,
 				phase,
 				accounts: active.map((connection) => ({
-					id: connection.id,
-					label: connection.alias ?? String(connection.identity.email ?? connection.identity.name ?? connection.id)
+					id: connection.accountId,
+					label: [getConnectorAccount(connection.accountId)?.label, connection.identity.email ?? connection.identity.name ?? connection.accountId].filter(Boolean).join(" · ")
 				})),
 				...need.capabilityError && selected ? { reason: need.capabilityError } : {},
 				...blocked ? { reason: scopeBlocked ? "This action needs broader permissions. Review connector permissions in settings." : "This app is disabled or unavailable to the current agent. Review connector settings." } : {}
@@ -154,7 +159,7 @@ var ConnectionRecoveryService = class {
 			allowedAgentIds: [],
 			maxScope: "read",
 			confirmationPolicy: "writes",
-			selectedConnectionIds: []
+			selectedAccountIds: null
 		});
 	}
 	async checkCapabilities(wait, verified) {
@@ -175,10 +180,15 @@ var ConnectionRecoveryService = class {
 				const definition = getConnectorDefinition(need.connectorId);
 				if (definition?.runtime.type !== "composio" || definition.runtime.role !== "toolkit") throw new Error("Unsupported connector");
 				const toolkit = definition.runtime.toolkit;
+				const selected = views.find((view) => view.key === need.key);
+				const connection = selected?.connectionId ? getConnectorConnection(selected.connectionId) : void 0;
 				const result = await (await this.adapter.createSession({
 					principalId: wait.principalId,
 					toolkits: [toolkit],
-					authConfigs: getConfiguredComposioAuthConfigs(this.deps.getConfig(), [toolkit])
+					backendId: selected?.accountId ? getConnectorAccount(selected.accountId)?.backendId : void 0,
+					...typeof connection?.metadata.providerPrincipalId === "string" ? { providerPrincipalId: connection.metadata.providerPrincipalId } : {},
+					...connection ? { connectedAccounts: { [toolkit]: [connection.providerConnectionId] } } : {},
+					authConfigs: typeof connection?.metadata.authConfigId === "string" ? { [toolkit]: connection.metadata.authConfigId } : void 0
 				})).search({
 					query: `${toolkit} ${need.capabilities.join(" ")} ${capabilityActions(need).flat().join(" ")}`,
 					toolkits: [toolkit]
@@ -303,6 +313,8 @@ var ConnectionRecoveryService = class {
 				const auth = await this.adapter.authorize({
 					principalId: wait.principalId,
 					toolkit: definition.runtime.toolkit,
+					expectedAccountId: need.accountId,
+					backendId: need.accountId ? getConnectorAccount(need.accountId)?.backendId : void 0,
 					installationId,
 					authConfigId: getConfiguredComposioAuthConfigs(config, [definition.runtime.toolkit])?.[definition.runtime.toolkit]
 				});
@@ -336,7 +348,7 @@ var ConnectionRecoveryService = class {
 				const latest = getConnectionWait(wait.id);
 				if (!latest || latest.version !== wait.version || latest.status !== "open") throw new Error("WAIT_CHANGED");
 				let needs = wait.needs.map((need) => {
-					const authorized = fresh.find((item) => item.providerConnectionId === need.attempt?.connectionId && item.status === "active");
+					const authorized = fresh.find((item) => item.providerConnectionId === need.attempt?.connectionId && item.status === "active" && item.connectorId === need.connectorId && (!need.accountId || item.accountId === need.accountId));
 					return authorized ? {
 						...need,
 						unavailable: false,
@@ -352,8 +364,8 @@ var ConnectionRecoveryService = class {
 				});
 				if (action.action === "select_account") {
 					const need = needs.find((item) => item.key === action.needKey);
-					const connection = fresh.find((item) => item.id === action.accountId && item.connectorId === need?.connectorId && item.status === "active");
-					if (!need || !connection || !this.view(wait, verified).needs.find((item) => item.key === need.key)?.accounts.some((item) => item.id === connection.id)) throw new Error("Account is unavailable.");
+					const connection = currentAccountConnections(fresh).find((item) => item.accountId === action.accountId && item.connectorId === need?.connectorId);
+					if (!need || !connection || !this.view(wait, verified).needs.find((item) => item.key === need.key)?.accounts.some((item) => item.id === connection.accountId)) throw new Error("Account is unavailable.");
 					needs = needs.map((item) => item.key === need.key ? {
 						...item,
 						connectionId: connection.id,

package/dist/src/connectors/connector-identity.d.ts

@@ -1,4 +1,6 @@
 import type { ConnectorConnection } from './types.js';
+/** Only verified display fields may enter model context or account summaries. */
+export declare function connectorIdentitySummary(identity: Record<string, unknown>): Record<string, string>;
 export declare function normalizeConnectorIdentity(toolkit: string, result: unknown): ConnectorConnection['identity'];
 export declare function connectorIdentityKey(toolkit: string, identity: Record<string, unknown>): string | undefined;
 export declare function mergeConnectorIdentity(toolkit: string, current: Record<string, unknown>, incoming: Record<string, unknown>): Record<string, unknown>;

package/dist/src/connectors/connector-identity.js

@@ -1,4 +1,17 @@
 //#region src/connectors/connector-identity.ts
+/** Only verified display fields may enter model context or account summaries. */
+function connectorIdentitySummary(identity) {
+	return Object.fromEntries([
+		"email",
+		"username",
+		"displayName",
+		"workspace",
+		"workspaceId",
+		"userId",
+		"enterpriseId",
+		"botUserId"
+	].flatMap((key) => typeof identity[key] === "string" && identity[key].trim() ? [[key, identity[key].slice(0, 320)]] : []));
+}
 function object(value) {
 	if (!value || typeof value !== "object" || Array.isArray(value)) return {};
 	return value;
@@ -85,16 +98,16 @@ function mergeConnectorIdentity(toolkit, current, incoming) {
 		"googledrive",
 		"github",
 		"slack"
-	].includes(normalizedToolkit)) return {
+	].includes(normalizedToolkit)) return connectorIdentitySummary({
 		...current,
 		...incoming
-	};
+	});
 	const normalized = Object.fromEntries(Object.entries(normalizeConnectorIdentity(normalizedToolkit, incoming)).filter(([, value]) => value !== void 0 && value !== null && value !== ""));
-	return {
+	return connectorIdentitySummary({
 		...current,
 		...incoming,
 		...normalized
-	};
+	});
 }
 //#endregion
-export { connectorIdentityKey, mergeConnectorIdentity, normalizeConnectorIdentity };
+export { connectorIdentityKey, connectorIdentitySummary, mergeConnectorIdentity, normalizeConnectorIdentity };

package/dist/src/connectors/content-enrichment.js

@@ -1,5 +1,5 @@
-import { getKnowledgeSourceItem, listKnowledgeSourceItems, upsertKnowledgeSourceItems } from "../storage/sqlite/knowledge-repository.js";
 import { getConnectorConnection, getConnectorInstallation } from "../storage/sqlite/connector-repository.js";
+import { getKnowledgeSourceItem, listKnowledgeSourceItems, upsertKnowledgeSourceItems } from "../storage/sqlite/knowledge-repository.js";
 import "../storage/sqlite/index.js";
 import { ComposioSessionsAdapter } from "./composio-sessions.js";
 import { ConnectedKnowledgePipeline } from "../knowledge/connected-knowledge-pipeline.js";

package/dist/src/connectors/instances.js

@@ -27,7 +27,7 @@ function connectorInstanceFromRecord(instanceId, record) {
 	const definition = connectorDefinitionFromManagedMarker(markerRecord) ?? getConnectorDefinition(connectorId);
 	const runtime = record.runtime && typeof record.runtime === "object" && !Array.isArray(record.runtime) ? record.runtime : {};
 	const runtimeType = runtime.type;
-	if (runtimeType !== "composio" && runtimeType !== "channel" && runtimeType !== "nativeTool" && runtimeType !== "memorySource") return [];
+	if (runtimeType !== "composio" && runtimeType !== "memorySource") return [];
 	if (runtimeType === "composio" && (typeof runtime.toolkit !== "string" || runtime.role !== "credential" && runtime.role !== "toolkit")) return [];
 	const enabled = markerRecord.enabled !== false;
 	return [{
@@ -47,12 +47,6 @@ function connectorInstanceFromRecord(instanceId, record) {
 			id: instanceId,
 			toolkit: runtime.toolkit,
 			role: runtime.role
-		} : runtimeType === "channel" ? {
-			type: "channel",
-			id: instanceId
-		} : runtimeType === "nativeTool" ? {
-			type: "nativeTool",
-			id: instanceId
 		} : {
 			type: "memorySource",
 			id: instanceId

package/dist/src/connectors/learning-coordinator.js

@@ -1,8 +1,8 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
 import { claimNextConnectorLearningJob, enqueueConnectorLearningJob, listConnectorLearningJobs, recoverStaleConnectorLearningJobs, setConnectorLearningPaused, updateConnectorLearningJob } from "../storage/sqlite/connector-learning-repository.js";
-import { getConnectorInstallation, listConnectorConnections, upsertConnectorConnection } from "../storage/sqlite/connector-repository.js";
 import { getConnectorAccount, reconcileConnectorAccount } from "../storage/sqlite/connector-account-repository.js";
+import { getConnectorInstallation, listConnectorConnections, upsertConnectorConnection } from "../storage/sqlite/connector-repository.js";
 import { getConnectorSyncPolicyForConnection } from "../storage/sqlite/connector-sync-policy-repository.js";
 import "../storage/sqlite/index.js";
 import { connectorIdentityKey, normalizeConnectorIdentity } from "./connector-identity.js";
@@ -74,8 +74,9 @@ function startConnectorLearningCoordinator(options) {
 		const connection = listConnectorConnections().find((item) => item.id === connectionId && item.status === "active");
 		if (!connection) return null;
 		if (!connection.accountId) throw new Error(`Connector account is missing for connection ${connection.id}.`);
+		if (!getConnectorAccount(connection.accountId)?.enabled) return null;
 		const syncPolicy = getConnectorSyncPolicyForConnection(connection.id);
-		if (request.reason !== "manual" && syncPolicy?.scanEnabled === false) return null;
+		if (request.reason !== "manual" && syncPolicy?.scanEnabled !== true) return null;
 		const definition = getConnectorDefinition(connection.connectorId);
 		if (definition?.runtime.type !== "composio" || definition.runtime.role !== "toolkit") return null;
 		if (!getConnectorLearningPlan(definition.runtime.toolkit)) return null;
@@ -275,7 +276,7 @@ function startConnectorLearningCoordinator(options) {
 			...retention
 		}, "Connected source retention pruned");
 		const syncPolicy = getConnectorSyncPolicyForConnection(job.connectionId);
-		if (syncPolicy?.scanEnabled === false) return;
+		if (syncPolicy?.scanEnabled !== true) return;
 		const intervalMinutes = syncPolicy?.intervalMinutes ?? plan.intervalMinutes;
 		const nextRunAt = Date.now() + intervalMinutes * 6e4;
 		enqueueConnection(getConnectorAccount(job.accountId)?.currentConnectionId ?? job.connectionId, {

package/dist/src/connectors/materialize.js

@@ -4,6 +4,7 @@ import { createConnectorSecretReference } from "./secret-store.js";
 init_schema();
 const SERVER_ID_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/;
 const TEMPLATE_PATTERN = /^\{\{(secrets|config)\.([A-Za-z0-9_.-]+)\}\}$/;
+const EMBEDDED_SECRET_PATTERN = /\{\{secrets\.([A-Za-z0-9_.-]+)\}\}/g;
 function assertValidConnectorServerId(serverId) {
 	if (!SERVER_ID_PATTERN.test(serverId)) throw new Error("Connector server name must start with a lowercase letter and only contain lowercase letters, numbers, dashes, and underscores.");
 }
@@ -14,7 +15,19 @@ function readInputValue(definition, input, scope, key) {
 function resolveTemplateValue(value, definition, input) {
 	if (typeof value !== "string") return value;
 	const match = TEMPLATE_PATTERN.exec(value.trim());
-	if (!match) return value;
+	if (!match) {
+		const matches = [...value.matchAll(EMBEDDED_SECRET_PATTERN)];
+		if (matches.length === 0) return value;
+		if (matches.length > 1) throw new Error("Connector template values may contain at most one embedded secret.");
+		const embedded = matches[0];
+		const token = embedded[0];
+		const fieldKey = embedded[1];
+		const offset = embedded.index ?? 0;
+		return createConnectorSecretReference(definition.id, fieldKey, {
+			prefix: value.slice(0, offset),
+			suffix: value.slice(offset + token.length)
+		});
+	}
 	return readInputValue(definition, input, match[1], match[2]);
 }
 function materializeTemplate(value, definition, input) {

package/dist/src/connectors/policy.d.ts

@@ -8,6 +8,6 @@ export declare function evaluateConnectorExecutionPolicy(input: {
     installation: ConnectorInstallationPolicy;
     action: Pick<ConnectorActionMetadata, 'scope' | 'curated'>;
     agentId?: string;
-    connectionId?: string;
+    accountId?: string;
     confirmed?: boolean;
 }): ConnectorPolicyEvaluation;

package/dist/src/connectors/policy.js

@@ -21,7 +21,7 @@ function evaluateConnectorExecutionPolicy(input) {
 		decision: "denied",
 		reason: "Agent is not allowed to use this connector."
 	};
-	if (installation.selectedConnectionIds.length > 0 && (!input.connectionId || !installation.selectedConnectionIds.includes(input.connectionId))) return {
+	if (installation.selectedAccountIds !== null && (!input.accountId || !installation.selectedAccountIds.includes(input.accountId))) return {
 		decision: "denied",
 		reason: "Connection is not allowed by this connector policy."
 	};

package/dist/src/connectors/principal.js

@@ -1,17 +1,38 @@
+import { getSessionMetadata, init_session_repository } from "../storage/sqlite/session-repository.js";
 import { getConversationRouting } from "../storage/sqlite/conversation-repository.js";
 import { init_session_key } from "../routing/session-key.js";
 //#region src/connectors/principal.ts
 init_session_key();
+init_session_repository();
 function connectorPrincipalForSession(conversationId) {
-	const parsed = getConversationRouting(conversationId);
+	let parsed = getConversationRouting(conversationId);
+	const agentId = parsed?.agentId;
+	const visited = /* @__PURE__ */ new Set();
+	while (conversationId && parsed?.source === "workflow" && !visited.has(conversationId) && visited.size < 8) {
+		visited.add(conversationId);
+		const metadata = getSessionMetadata(conversationId);
+		const parent = metadata?.parentConversationId ?? metadata?.customData?.parentConversationId;
+		if (typeof parent !== "string") {
+			if (metadata?.sessionType === "workflow-run") return {
+				principalId: "local-owner",
+				agentId,
+				isLocalOwner: true
+			};
+			break;
+		}
+		const parentRouting = getConversationRouting(parent);
+		if (!parentRouting) break;
+		conversationId = parent;
+		parsed = parentRouting;
+	}
 	if (!parsed || parsed.source === "cli" || parsed.source === "webchat") return {
 		principalId: "local-owner",
-		agentId: parsed?.agentId,
+		agentId,
 		isLocalOwner: true
 	};
 	return {
 		principalId: `channel:${parsed.source}:${parsed.accountId}:${parsed.peerKind}:${parsed.peerId}`,
-		agentId: parsed.agentId,
+		agentId,
 		isLocalOwner: false
 	};
 }

package/dist/src/connectors/providers.d.ts

@@ -6,5 +6,6 @@ export type ConnectorProvider = {
 };
 export declare const builtinConnectorProvider: ConnectorProvider;
 export declare const composioConnectorProvider: ConnectorProvider;
+export declare const chinaConnectorProvider: ConnectorProvider;
 export declare function listConnectorProviders(): ConnectorProvider[];
 export declare function listConnectorProviderDefinitions(): ConnectorDefinition[];

package/dist/src/connectors/providers.js

@@ -1,4 +1,5 @@
 import { BUILTIN_CONNECTORS } from "./builtin-catalog.js";
+import { CHINA_CONNECTORS } from "./china-catalog.js";
 import { COMPOSIO_CONNECTORS } from "./composio.js";
 //#region src/connectors/providers.ts
 const builtinConnectorProvider = {
@@ -15,7 +16,18 @@ const composioConnectorProvider = {
 		return COMPOSIO_CONNECTORS;
 	}
 };
-const CONNECTOR_PROVIDERS = [builtinConnectorProvider, composioConnectorProvider];
+const chinaConnectorProvider = {
+	id: "china",
+	displayName: "China connectors",
+	listConnectors() {
+		return CHINA_CONNECTORS;
+	}
+};
+const CONNECTOR_PROVIDERS = [
+	builtinConnectorProvider,
+	chinaConnectorProvider,
+	composioConnectorProvider
+];
 function listConnectorProviders() {
 	return [...CONNECTOR_PROVIDERS];
 }
@@ -23,4 +35,4 @@ function listConnectorProviderDefinitions() {
 	return CONNECTOR_PROVIDERS.flatMap((provider) => provider.listConnectors());
 }
 //#endregion
-export { builtinConnectorProvider, composioConnectorProvider, listConnectorProviderDefinitions, listConnectorProviders };
+export { builtinConnectorProvider, chinaConnectorProvider, composioConnectorProvider, listConnectorProviderDefinitions, listConnectorProviders };

package/dist/src/connectors/runtime-adapter-registry.js

@@ -2,7 +2,6 @@ import { isXopcDatabaseOpen } from "../storage/sqlite/connection.js";
 import { deleteConnectorInstallation, getConnectorInstallation, upsertConnectorInstallation } from "../storage/sqlite/connector-repository.js";
 import "../storage/sqlite/index.js";
 import { assertComposioAccessConfigured } from "./composio-sessions.js";
-import { saveComposioApiKey } from "./composio.js";
 import { saveConnectorSecrets } from "./secret-store.js";
 import { isManagedConnectorServer, materializeConnectorMcpServer } from "./materialize.js";
 import { appendConnectorAuditRecord } from "./usage.js";
@@ -106,7 +105,7 @@ registerConnectorRuntimeAdapter({
 	type: "composio",
 	async install({ config, definition, input, resolver }) {
 		if (definition.runtime.type !== "composio") throw new Error(`Invalid Composio connector definition: ${definition.id}`);
-		if (definition.runtime.role === "credential") await saveComposioApiKey(input, resolver);
+		if (definition.runtime.role !== "toolkit") throw new Error("Configure Composio in connection service settings.");
 		if (definition.runtime.role === "toolkit") await assertComposioAccessConfigured(resolver);
 		const instance = installRecord(config, definition, definition.runtime.role === "toolkit" ? { scope: "read" } : {}, definition.runtime.role === "toolkit" ? { config: input.config ?? {} } : {});
 		if (definition.runtime.role === "toolkit" && isXopcDatabaseOpen()) {
@@ -120,7 +119,7 @@ registerConnectorRuntimeAdapter({
 				allowedAgentIds: existing?.allowedAgentIds ?? [],
 				maxScope: "read",
 				confirmationPolicy: existing?.confirmationPolicy ?? "writes",
-				selectedConnectionIds: existing?.selectedConnectionIds ?? [],
+				selectedAccountIds: existing?.selectedAccountIds ?? null,
 				createdAt: existing?.createdAt
 			});
 		}
@@ -145,12 +144,8 @@ registerConnectorRuntimeAdapter({
 		return installedInstance(config, instanceId, definition.id);
 	}
 });
-for (const type of [
-	"channel",
-	"nativeTool",
-	"memorySource"
-]) registerConnectorRuntimeAdapter({
-	type,
+registerConnectorRuntimeAdapter({
+	type: "memorySource",
 	async install({ config, definition, input }) {
 		return installRecord(config, definition, {}, { config: input.config ?? {} });
 	},

package/dist/src/connectors/secret-store.d.ts

@@ -1,7 +1,10 @@
 import { CredentialResolver } from '../auth/credentials.js';
 import type { ConnectorDefinition, ConnectorInstallInput, ConnectorSecretReference } from './types.js';
 export declare function connectorSecretProviderId(connectorId: string, fieldKey: string): string;
-export declare function createConnectorSecretReference(connectorId: string, fieldKey: string): ConnectorSecretReference;
+export declare function createConnectorSecretReference(connectorId: string, fieldKey: string, affixes?: {
+    prefix?: string;
+    suffix?: string;
+}): ConnectorSecretReference;
 export declare function isConnectorSecretReference(value: unknown): value is ConnectorSecretReference;
 export declare function saveConnectorSecrets(definition: ConnectorDefinition, input: ConnectorInstallInput, resolver?: CredentialResolver): Promise<void>;
 export declare function resolveConnectorSecretReferences(value: unknown, resolver?: CredentialResolver): Promise<unknown>;

package/dist/src/connectors/secret-store.js

@@ -8,10 +8,12 @@ function normalizeSecretSegment(value) {
 function connectorSecretProviderId(connectorId, fieldKey) {
 	return `connector-${normalizeSecretSegment(connectorId)}-${normalizeSecretSegment(fieldKey)}`;
 }
-function createConnectorSecretReference(connectorId, fieldKey) {
+function createConnectorSecretReference(connectorId, fieldKey, affixes = {}) {
 	return { xopcSecretRef: {
 		provider: connectorSecretProviderId(connectorId, fieldKey),
-		fieldKey
+		fieldKey,
+		...affixes.prefix ? { prefix: affixes.prefix } : {},
+		...affixes.suffix ? { suffix: affixes.suffix } : {}
 	} };
 }
 function isConnectorSecretReference(value) {
@@ -28,7 +30,9 @@ async function saveConnectorSecrets(definition, input, resolver = new Credential
 	}
 }
 async function resolveSecretReference(reference, resolver) {
-	return await resolver.resolveApiKey(reference.xopcSecretRef.provider) ?? void 0;
+	const value = await resolver.resolveApiKey(reference.xopcSecretRef.provider);
+	if (!value) return void 0;
+	return `${reference.xopcSecretRef.prefix ?? ""}${value}${reference.xopcSecretRef.suffix ?? ""}`;
 }
 async function resolveConnectorSecretReferences(value, resolver = new CredentialResolver()) {
 	if (isConnectorSecretReference(value)) return resolveSecretReference(value, resolver);

package/dist/src/connectors/source-change-publisher.js

@@ -1,10 +1,12 @@
 import { createLogger } from "../utils/logger/index.js";
 import { init_logger } from "../utils/logger.js";
+import { getConnectorAccount, init_connector_account_repository } from "../storage/sqlite/connector-account-repository.js";
+import { init_connector_repository, listConnectorConnections } from "../storage/sqlite/connector-repository.js";
 import { getKnowledgeConsumerWatermark, getKnowledgeSourceItem, listKnowledgeSourceChanges, setKnowledgeConsumerWatermark } from "../storage/sqlite/knowledge-repository.js";
-import { listConnectorConnections } from "../storage/sqlite/connector-repository.js";
-import { getConnectorAccount } from "../storage/sqlite/connector-account-repository.js";
 import { getConnectorSyncPolicyForConnection } from "../storage/sqlite/connector-sync-policy-repository.js";
 //#region src/connectors/source-change-publisher.ts
+init_connector_account_repository();
+init_connector_repository();
 init_logger();
 const log = createLogger("Connector:SourceChanges");
 const CONSUMER_ID = "proactive-connected-source-v1";

package/dist/src/connectors/types.d.ts

@@ -1,4 +1,4 @@
-export type ConnectorKind = 'mcp' | 'cli' | 'http' | 'channel' | 'browser' | 'extension' | 'builtin' | 'composio' | 'nativeTool' | 'memorySource';
+export type ConnectorKind = 'mcp' | 'cli' | 'http' | 'browser' | 'extension' | 'builtin' | 'composio' | 'memorySource';
 export type ConnectorCategory = 'code' | 'docs' | 'browser' | 'data' | 'automation' | 'custom';
 export type ConnectorCapability = 'tools' | 'resources' | 'prompts' | 'context' | 'channel' | 'events' | 'ui' | 'memory_source' | 'workflows' | 'auth.apiKey' | 'auth.oauth' | 'runtime.mcp.stdio' | 'runtime.mcp.sse' | 'runtime.mcp.streamableHttp';
 export type ConnectorAuthMode = 'none' | 'apiKey' | 'oauth';
@@ -17,7 +17,6 @@ export type ConnectorBenefit = 'understand' | 'act' | 'reach';
 export type ConnectorBranding = {
     logoUrl?: string;
     source?: 'builtin' | 'composio-catalog' | 'registry' | 'extension' | 'custom';
-    backgroundColor?: string;
     fetchedAt?: string;
 };
 export type ConnectorConfirmationPolicy = 'always' | 'writes' | 'admin' | 'never';
@@ -40,6 +39,8 @@ export type ConnectorSecretReference = {
     xopcSecretRef: {
         provider: string;
         fieldKey: string;
+        prefix?: string;
+        suffix?: string;
     };
 };
 export type ConnectorSecretField = {
@@ -48,6 +49,11 @@ export type ConnectorSecretField = {
     description?: string;
     required: boolean;
 };
+export type ConnectorSetupLink = {
+    label: string;
+    href: string;
+    external?: boolean;
+};
 export type ConnectorConfigField = {
     key: string;
     label: string;
@@ -66,17 +72,10 @@ export type ConnectorRuntimeDefinition = {
         name: string;
         version: string;
     };
-} | {
-    type: 'channel';
-    channelId: string;
-    pluginId: string;
 } | {
     type: 'composio';
     toolkit: string;
     role: 'credential' | 'toolkit';
-} | {
-    type: 'nativeTool';
-    toolsetId: string;
 } | {
     type: 'memorySource';
     sourceKind: string;
@@ -103,6 +102,7 @@ export type ConnectorDefinition = {
     setup: {
         secrets?: ConnectorSecretField[];
         config?: ConnectorConfigField[];
+        links?: ConnectorSetupLink[];
     };
     runtime: ConnectorRuntimeDefinition;
     permissions?: ConnectorPermissions;
@@ -120,7 +120,7 @@ export type ConnectorInstallationPolicy = {
     allowedAgentIds: string[];
     maxScope: ConnectorScope;
     confirmationPolicy: ConnectorConfirmationPolicy;
-    selectedConnectionIds: string[];
+    selectedAccountIds: string[] | null;
     createdAt: string;
     updatedAt: string;
 };
@@ -149,8 +149,12 @@ export type ConnectorAccount = {
     connectorId: string;
     principalId: string;
     identityKey?: string;
+    backendId?: string;
     identity: Record<string, unknown>;
     currentConnectionId?: string;
+    label?: string;
+    enabled: boolean;
+    allowedAgentIds: string[] | null;
     createdAt: string;
     updatedAt: string;
 };
@@ -184,6 +188,7 @@ export type ConnectorExecutionAuditRecord = {
 export type ConnectorApprovalStatus = 'pending' | 'approved' | 'denied' | 'expired' | 'consumed';
 export type ConnectorApprovalRecord = {
     id: string;
+    waitId?: string;
     principalId: string;
     connectorId: string;
     connectionId?: string;
@@ -240,7 +245,7 @@ export type ConnectorInstance = {
         toolkit: string;
         role: 'credential' | 'toolkit';
     } | {
-        type: 'channel' | 'nativeTool' | 'memorySource';
+        type: 'memorySource';
         id: string;
     };
     usage: ConnectorUsageRecord;

package/dist/src/connectors/workflow-preflight.d.ts

@@ -1,6 +1,6 @@
 import type { Config } from '../config/schema.js';
 import type { WorkflowDefinition } from '../workflows/domain/definition.js';
-export type ConnectorPreflightIssueCode = 'not_installed' | 'disabled' | 'agent_not_allowed' | 'scope_too_narrow' | 'connection_missing' | 'reauthorization_required';
+export type ConnectorPreflightIssueCode = 'not_installed' | 'disabled' | 'agent_not_allowed' | 'scope_too_narrow' | 'connection_missing' | 'account_selection_required' | 'reauthorization_required';
 export type ConnectorPreflightIssue = {
     connectorId: string;
     code: ConnectorPreflightIssueCode;
@@ -9,6 +9,7 @@ export type ConnectorPreflightIssue = {
 };
 export type ConnectorPreflightResult = {
     ok: boolean;
+    accounts: Record<string, string[]>;
     issues: ConnectorPreflightIssue[];
     optionalIssues: ConnectorPreflightIssue[];
 };