npm - eve - Versions diffs - 0.5.4 → 0.6.0-beta.3 - Mend

eve 0.5.4 → 0.6.0-beta.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1743) hide show

package/dist/src/runtime/compiled-artifacts-source.js ADDED Viewed

@@ -0,0 +1 @@

+ function createBundledRuntimeCompiledArtifactsSource(){return{kind:`bundled`}}function createDiskRuntimeCompiledArtifactsSource(e,t={}){return t.moduleMapLoaderPath===void 0?{appRoot:e,kind:`disk`}:{appRoot:e,kind:`disk`,moduleMapLoaderPath:t.moduleMapLoaderPath}}function getRuntimeCompiledArtifactsAppRoot(e){return e.kind===`disk`?e.appRoot:void 0}function getRuntimeCompiledArtifactsCacheKey(e){return e.kind===`disk`?e.moduleMapLoaderPath===void 0?`disk:${e.appRoot}`:`disk:${e.appRoot}:authored-source:${e.moduleMapLoaderPath}`:`bundled`}export{createBundledRuntimeCompiledArtifactsSource,createDiskRuntimeCompiledArtifactsSource,getRuntimeCompiledArtifactsAppRoot,getRuntimeCompiledArtifactsCacheKey};

package/dist/src/runtime/connections/authorization-complete-page.d.ts ADDED Viewed

@@ -0,0 +1,11 @@
+/**
+ * Renders the static HTML landing page that the user's browser sees
+ * after an OAuth IdP redirects back to the framework's connection
+ * callback route.
+ *
+ * The framework would otherwise respond with an empty `202 Accepted`
+ * body, which looks broken. This helper is intentionally self-contained:
+ * no external assets, no script, so it renders identically regardless
+ * of where the runtime serves the callback from.
+ */
+export declare function buildAuthorizationCompletePage(): Response;

package/dist/src/runtime/connections/authorization-complete-page.js ADDED Viewed

@@ -0,0 +1,53 @@
+function buildAuthorizationCompletePage(){return new Response(`<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Authorization complete</title>
+    <style>
+      :root {
+        color-scheme: light dark;
+        --bg: #fafafa;
+        --fg: #111111;
+        --muted: #525252;
+        --card-bg: #ffffff;
+        --card-border: #e5e5e5;
+      }
+      @media (prefers-color-scheme: dark) {
+        :root {
+          --bg: #0a0a0a;
+          --fg: #fafafa;
+          --muted: #a3a3a3;
+          --card-bg: #171717;
+          --card-border: #262626;
+        }
+      }
+      body {
+        margin: 0;
+        min-height: 100vh;
+        display: grid;
+        place-items: center;
+        font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Helvetica, Arial, sans-serif;
+        background: var(--bg);
+        color: var(--fg);
+      }
+      .card {
+        max-width: 28rem;
+        padding: 2rem 2.25rem;
+        border: 1px solid var(--card-border);
+        border-radius: 12px;
+        background: var(--card-bg);
+        color: var(--fg);
+        text-align: center;
+      }
+      h1 { font-size: 1.25rem; margin: 0 0 0.5rem; color: var(--fg); }
+      p { margin: 0; color: var(--muted); line-height: 1.5; }
+    </style>
+  </head>
+  <body>
+    <main class="card">
+      <h1>Authorization complete</h1>
+      <p>You can close this tab and return to your app.</p>
+    </main>
+  </body>
+</html>`,{headers:{"cache-control":`no-store`,"content-type":`text/html; charset=utf-8`},status:200})}export{buildAuthorizationCompletePage};

package/dist/src/runtime/connections/authorization-tokens.d.ts ADDED Viewed

@@ -0,0 +1,51 @@
+/**
+ * Per-step cache of resolved connection authorization tokens.
+ *
+ * Keyed by `(connectionName, principalKey)` so two users on the same
+ * session never share a user-scoped token. Stored as a virtual
+ * context value and wiped between workflow steps, so bearer tokens
+ * are never serialized into the durable step payload. Cross-step
+ * reuse is delegated to the upstream authorization provider (for
+ * example Connect's server-side cache), which owns the refresh grant.
+ *
+ * TODO(eve): once a server-derivable session key is available, promote
+ * this back to durable context via an AEAD codec so cross-step reuse
+ * is possible without exposing plaintext bearers in the WDK payload.
+ */
+import type { AlsContext } from "#context/container.js";
+import { ContextKey } from "#context/key.js";
+import type { TokenResult } from "#runtime/connections/types.js";
+/**
+ * Virtual context key mapping connection name to a per-principal
+ * {@link TokenResult} cache.
+ *
+ * The principal sub-key is produced by
+ * {@link principalKey} so identical string keys (for example
+ * `"user:${issuer}:${id}"`) collide only when the resolved principal
+ * genuinely matches.
+ */
+export declare const ConnectionAuthorizationTokensKey: ContextKey<Readonly<Record<string, Readonly<Record<string, TokenResult>>>>>;
+/**
+ * Returns the cached {@link TokenResult} for
+ * `(connectionName, principalKey)` when the entry is still valid
+ * (not expired). Expired entries are treated as a cache miss so
+ * callers re-run the authorization flow.
+ */
+export declare function readCachedToken(ctx: AlsContext, connectionName: string, principalKey: string): TokenResult | undefined;
+/**
+ * Persists a freshly resolved {@link TokenResult} on the cache under
+ * `(connectionName, principalKey)`. Existing entries for other
+ * principals on the same connection are left in place.
+ *
+ * Writes to the virtual context slot so the bearer is never serialized
+ * into the durable step payload. See the module docblock.
+ */
+export declare function writeCachedToken(ctx: AlsContext, connectionName: string, principalKey: string, token: TokenResult): void;
+/**
+ * Drops the cached {@link TokenResult} for `(connectionName, principalKey)`,
+ * if present. Used when the remote server rejects an already-resolved
+ * bearer (HTTP 401) so the subsequent re-authorization attempt does not
+ * re-read the stale token from the per-step cache. No-op when nothing is
+ * cached for the principal.
+ */
+export declare function evictCachedToken(ctx: AlsContext, connectionName: string, principalKey: string): void;

package/dist/src/runtime/connections/authorization-tokens.js ADDED Viewed

@@ -0,0 +1 @@

+ import{ContextKey}from"#context/key.js";const ConnectionAuthorizationTokensKey=new ContextKey(`eve.connectionAuthorizationTokens`);function readCachedToken(e,t,n){let r=e.get(ConnectionAuthorizationTokensKey)?.[t]?.[n];if(r!==void 0&&!(r.expiresAt!==void 0&&r.expiresAt<=Date.now()))return r}function writeCachedToken(e,t,n,r){let i=e.get(ConnectionAuthorizationTokensKey)??{},a=i[t]??{};asContainer(e).setVirtualContext(ConnectionAuthorizationTokensKey,{...i,[t]:{...a,[n]:r}})}function evictCachedToken(e,t,n){let r=e.get(ConnectionAuthorizationTokensKey),i=r?.[t];if(r===void 0||i===void 0||i[n]===void 0)return;let{[n]:a,...o}=i;asContainer(e).setVirtualContext(ConnectionAuthorizationTokensKey,{...r,[t]:o})}function asContainer(e){return e}export{ConnectionAuthorizationTokensKey,evictCachedToken,readCachedToken,writeCachedToken};

package/dist/src/runtime/connections/callback-route.d.ts ADDED Viewed

@@ -0,0 +1,55 @@
+/**
+ * Framework-shipped callback route used by in-turn interactive
+ * connection authorization.
+ *
+ * The route at {@link EVE_CONNECTION_CALLBACK_ROUTE_PATTERN} is the
+ * redirect target the workflow body hands to the IdP via
+ * `startAuthorization`. When the IdP redirects the user's browser back
+ * with the OAuth `code`/`state` (or whatever payload the protocol
+ * carries), this handler:
+ *
+ * 1. Parses the inbound request into a JSON-serializable
+ *    {@link AuthorizationCallback} (params only — never request headers).
+ * 2. Calls `resumeHook(token, payload)` to wake the suspended workflow.
+ * 3. Renders the standard "Authorization complete" landing page so the
+ *    user sees a friendly UI instead of an empty `202 Accepted`.
+ *
+ * Owning this route in the framework - instead of routing the IdP at the
+ * workflow runtime's raw `/.well-known/workflow/v1/webhook/:token` -
+ * keeps the public surface namespaced under Eve and lets the framework
+ * decide delivery policy (auth, throttling, logging) for connection
+ * callbacks without leaking generic workflow primitives to the public
+ * internet.
+ */
+import type { RouteContext } from "#public/definitions/channel.js";
+import type { ResolvedChannelDefinition } from "#runtime/types.js";
+/**
+ * Logical name prefix of the framework-shipped connection callback
+ * channel. The trailing method segment (`get` or `post`) keeps each
+ * `(method, urlPath)` pair distinct in the channel registry.
+ */
+export declare const HTTP_CONNECTION_CALLBACK_CHANNEL_NAME_PREFIX = "eve/v1/connections/callback";
+/**
+ * Returns the framework-shipped channel definitions that mount the
+ * connection callback route at {@link EVE_CONNECTION_CALLBACK_ROUTE_PATTERN}.
+ *
+ * Returns one definition per accepted HTTP method (see
+ * {@link HANDLED_METHODS}). The framework channel resolver mounts each
+ * `(method, urlPath)` pair as a separate Nitro route; sharing one URL
+ * pattern across multiple methods is not supported by the channel
+ * model.
+ */
+export declare function getConnectionCallbackChannelDefinitions(): readonly ResolvedChannelDefinition[];
+/**
+ * Returns the set of logical channel names registered by the connection
+ * callback route. Used by `getAllFrameworkChannelNames` so authors who
+ * `disableRoute()` one of these names get a useful diagnostic instead
+ * of a silent no-op.
+ */
+export declare function getConnectionCallbackChannelNames(): ReadonlySet<string>;
+/**
+ * Inbound handler for the connection callback route. Exported for test
+ * coverage; the framework channel resolver wires it into Nitro via
+ * {@link getConnectionCallbackChannelDefinitions}.
+ */
+export declare function handleConnectionCallbackRequest(request: Request, ctx: RouteContext): Promise<Response>;

package/dist/src/runtime/connections/callback-route.js ADDED Viewed

@@ -0,0 +1 @@

+ import{EVE_CONNECTION_CALLBACK_ROUTE_PATTERN}from"#protocol/routes.js";import{resumeHook}from"#compiled/@workflow/core/runtime.js";import{buildAuthorizationCompletePage}from"#runtime/connections/authorization-complete-page.js";const HTTP_CONNECTION_CALLBACK_CHANNEL_NAME_PREFIX=`eve/v1/connections/callback`,HANDLED_METHODS=[`GET`,`POST`];function getConnectionCallbackChannelDefinitions(){return HANDLED_METHODS.map(e=>buildCallbackChannelDefinition(e))}function getConnectionCallbackChannelNames(){return new Set(HANDLED_METHODS.map(channelNameForMethod))}function buildCallbackChannelDefinition(t){let n=channelNameForMethod(t);return{name:n,method:t,urlPath:EVE_CONNECTION_CALLBACK_ROUTE_PATTERN,fetch:handleConnectionCallbackRequest,logicalPath:`framework://channels/${n}`,sourceId:`eve:framework:connection-callback-${t.toLowerCase()}`,sourceKind:`module`}}function channelNameForMethod(e){return`${HTTP_CONNECTION_CALLBACK_CHANNEL_NAME_PREFIX}/${e.toLowerCase()}`}async function handleConnectionCallbackRequest(e,r){let i=r.params.name,a=r.params.token;if(typeof i!=`string`||i.length===0)return Response.json({error:`Missing connection name.`,ok:!1},{status:400});if(typeof a!=`string`||a.length===0)return Response.json({error:`Missing callback token.`,ok:!1},{status:400});let o=await projectAuthorizationCallback(e);try{await resumeHook(a,{kind:`deliver`,payloads:[{authorizationCallback:{connectionName:i,callback:o}}]})}catch{return Response.json({error:`Connection callback not pending.`,ok:!1},{status:404})}return buildAuthorizationCompletePage()}async function projectAuthorizationCallback(e){let t={};for(let[n,r]of new URL(e.url).searchParams)t[n]=r;let n;if(e.method!==`GET`&&e.method!==`HEAD`){try{n=await e.text()}catch{n=void 0}let r=e.headers.get(`content-type`)??``;if(n&&r.includes(`application/x-www-form-urlencoded`))for(let[e,r]of new URLSearchParams(n))t[e]=r}return n===void 0?{params:t,method:e.method}:{params:t,method:e.method,body:n}}export{HTTP_CONNECTION_CALLBACK_CHANNEL_NAME_PREFIX,getConnectionCallbackChannelDefinitions,getConnectionCallbackChannelNames,handleConnectionCallbackRequest};

package/dist/src/runtime/connections/mcp-client.d.ts ADDED Viewed

@@ -0,0 +1,74 @@
+import { type MCPClient } from "#compiled/@ai-sdk/mcp/index.js";
+import type { ToolSet } from "ai";
+import type { ResolvedConnectionDefinition } from "#runtime/types.js";
+import type { ConnectionClient, ConnectionToolMetadata, ToolFilterDefinition } from "#runtime/connections/types.js";
+/**
+ * Wraps one `MCPClient` from `@ai-sdk/mcp` for a single connection.
+ *
+ * Created lazily per-connection per-session. Caches tool metadata after
+ * the first `getToolMetadata()` call.
+ */
+export declare class McpConnectionClient implements ConnectionClient {
+    #private;
+    constructor(connection: ResolvedConnectionDefinition);
+    /**
+     * Connects to the MCP server, trying Streamable HTTP first and
+     * falling back to SSE for transport-compatibility failures.
+     *
+     * Concurrent callers share the same connection promise to avoid
+     * duplicate connections.
+     */
+    connect(): Promise<MCPClient>;
+    /**
+     * Returns cached tool metadata for all tools this connection exposes,
+     * after applying any configured tool filter.
+     *
+     * The first call fetches tools from the server via `listTools()` and
+     * creates the AI SDK tool set in parallel. Subsequent calls return
+     * the cached result. Concurrent callers share the same in-flight
+     * promise.
+     */
+    getToolMetadata(): Promise<readonly ConnectionToolMetadata[]>;
+    /**
+     * Returns the AI SDK `ToolSet` produced by `@ai-sdk/mcp`'s
+     * `toolsFromDefinitions()`. Each entry is a full SDK `Tool` with
+     * `inputSchema`, `description`, and `execute` already set.
+     */
+    getTools(): Promise<ToolSet>;
+    /**
+     * Executes a named tool through the AI SDK's tool executor, which
+     * handles the JSON-RPC `tools/call` internally.
+     *
+     * A `401`/`invalid_token` from the remote server is translated into
+     * {@link ConnectionAuthorizationRequiredError} via {@link #rethrowClassified}
+     * so callers re-enter the authorization flow instead of surfacing an
+     * opaque transport error.
+     */
+    executeTool(toolName: string, args: unknown): Promise<unknown>;
+    close(): Promise<void>;
+}
+/**
+ * Returns `true` when an error from the MCP transport indicates the
+ * bearer was rejected by the remote server — an HTTP `401`. Per
+ * RFC 6750 a `401` means the access token is missing, expired, or
+ * revoked, all of which are recoverable by re-authorizing. (A `403`
+ * is an insufficient-scope / permission problem and is intentionally
+ * left to propagate, since re-running the same grant would not help.)
+ */
+export declare function isMcpAuthRequiredError(error: unknown): boolean;
+/**
+ * Returns `true` when a tool name passes the configured filter.
+ */
+export declare function passesToolFilter(toolName: string, filter: Readonly<ToolFilterDefinition> | undefined): boolean;
+/**
+ * Merges `authorization` (Bearer token) and `headers` into one
+ * flat `Record<string, string>` for the transport layer.
+ *
+ * Resolves the {@link ConnectionPrincipal} from the active session
+ * and invokes
+ * `authorization.getToken({ principal })` to produce the bearer.
+ * `getToken` may throw {@link ConnectionAuthorizationRequiredError};
+ * callers (`connection_search`, wrapped connection tools) catch it
+ * and it propagates as-is from here.
+ */
+export declare function resolveHeaders(connection: ResolvedConnectionDefinition): Promise<Record<string, string>>;

package/dist/src/runtime/connections/mcp-client.js ADDED Viewed

@@ -0,0 +1 @@

+ import{isObject}from"#shared/guards.js";import{contextStorage}from"#context/container.js";import{ConnectionAuthorizationRequiredError}from"#public/connections/errors.js";import{resolveScopedToken}from"#runtime/connections/scoped-authorization.js";import{createMCPClient}from"#compiled/@ai-sdk/mcp/index.js";import{evictCachedToken}from"#runtime/connections/authorization-tokens.js";import{principalKey,resolveConnectionPrincipal}from"#runtime/connections/principal.js";var McpConnectionClient=class{#e;#t;#n;#r;#i;constructor(e){this.#i=e}async connect(){if(this.#t!==void 0)return this.#t;if(this.#e!==void 0)return this.#e;this.#e=this.#a();try{return this.#t=await this.#e,this.#t}catch(e){throw this.#e=void 0,e}}async#a(){let e=await resolveHeaders(this.#i),t=this.#i.url;try{return await createMCPClient({transport:{type:`http`,url:t,headers:e}})}catch(n){if(!isMcpHttpFallbackRetryableError(n))throw n;return await createMCPClient({transport:{type:`sse`,url:t,headers:e}})}}async getToolMetadata(){return(await this.#o()).metadata}async getTools(){return(await this.#o()).tools}async executeTool(e,t){try{let{tools:n}=await this.#o(),r=n[e];if(r?.execute===void 0)throw Error(`Tool "${e}" not found in connection "${this.#i.connectionName}".`);return await r.execute(t,{})}catch(e){return await this.#l(e)}}async#o(){if(this.#r!==void 0)return this.#r;if(this.#n!==void 0)return this.#n;this.#n=this.#s();try{return this.#r=await this.#n,this.#r}catch(e){throw this.#n=void 0,e}}async#s(){try{return await this.#c()}catch(e){return await this.#l(e)}}async#c(){let e=await this.connect(),t=await e.listTools(),n=this.#i.tools,r=n===void 0?t.tools:t.tools.filter(e=>passesToolFilter(e.name,n)),i=e.toolsFromDefinitions({tools:r});return{metadata:r.map(e=>({annotations:e.annotations,description:e.description??``,inputSchema:e.inputSchema??{},name:e.name,outputSchema:`outputSchema`in e&&e.outputSchema!==void 0?e.outputSchema:void 0})),tools:i}}async close(){this.#t!==void 0&&(await this.#t.close(),this.#t=void 0),this.#e=void 0,this.#n=void 0,this.#r=void 0}async#l(e){throw isMcpAuthRequiredError(e)?(this.#u(),await this.close(),new ConnectionAuthorizationRequiredError(this.#i.connectionName,{message:`Connection "${this.#i.connectionName}" requires authorization (the server rejected the token).`})):e}#u(){let e=this.#i.authorization;if(e===void 0)return;let n=contextStorage.getStore();if(n!==void 0)try{let t=resolveConnectionPrincipal(this.#i.connectionName,e,n);evictCachedToken(n,this.#i.connectionName,principalKey(t))}catch{}}};function isMcpAuthRequiredError(e){return readHttpStatus(e)===401}function isMcpHttpFallbackRetryableError(e){let t=readHttpStatus(e);return t===400||t===404||t===405}function readHttpStatus(t){for(let n of walkErrorChain(t)){if(!isObject(n))continue;let t=readStatusField(n);if(t!==void 0)return t;let r=n.response;if(isObject(r)){let e=readStatusField(r);if(e!==void 0)return e}if(typeof n.message==`string`){let e=/\bHTTP\s+(\d{3})\b/u.exec(n.message);if(e?.[1]!==void 0)return Number(e[1])}}}function readStatusField(e){if(typeof e.status==`number`)return e.status;if(typeof e.statusCode==`number`)return e.statusCode}function*walkErrorChain(t){let n=t,r=new Set;for(;n!=null&&!r.has(n);){if(r.add(n),yield n,!isObject(n)||!(`cause`in n))return;n=n.cause}}function passesToolFilter(e,t){return t===void 0?!0:`allow`in t?t.allow.includes(e):!t.block.includes(e)}async function resolveHeaders(e){let t={};if(e.authorization!==void 0&&(t.Authorization=`Bearer ${(await resolveToken(e)).token}`),e.headers!==void 0){let n=await resolveHeadersDefinition(e.headers);for(let[r,i]of Object.entries(n)){if(e.authorization!==void 0&&r.toLowerCase()===`authorization`)throw Error(`Connection "${e.connectionName}" headers must not include an "Authorization" key when "authorization" is also provided.`);t[r]=i}}return t}async function resolveToken(e){if(e.authorization===void 0)throw Error(`Connection "${e.connectionName}" does not define authorization.`);return await resolveScopedToken({authorization:e.authorization,connection:{url:e.url},scope:e.connectionName})}async function resolveHeadersDefinition(e){if(typeof e==`function`)return await e();let t={},n=Object.entries(e);for(let[e,r]of n)t[e]=await resolveHeaderValue(r);return t}async function resolveHeaderValue(e){return typeof e==`function`?await e():await e}export{McpConnectionClient,isMcpAuthRequiredError,passesToolFilter,resolveHeaders};

package/dist/src/runtime/connections/openapi-client.d.ts ADDED Viewed

@@ -0,0 +1,43 @@
+import { type ToolSet } from "ai";
+import type { ResolvedConnectionDefinition } from "#runtime/types.js";
+import { type OpenApiOperation } from "#runtime/connections/openapi-operations.js";
+import type { ConnectionClient, ConnectionToolMetadata } from "#runtime/connections/types.js";
+interface OpenApiToolCache {
+    readonly metadata: readonly ConnectionToolMetadata[];
+    readonly operations: ReadonlyMap<string, OpenApiOperation>;
+    readonly tools: ToolSet;
+    readonly baseUrl: string;
+}
+/**
+ * Result of executing an OpenAPI operation. Returned to the model as the
+ * tool result so it can react to the status and body of any response,
+ * including non-2xx responses.
+ */
+export interface OpenApiToolResult {
+    readonly status: number;
+    readonly statusText: string;
+    readonly body: unknown;
+}
+/**
+ * A {@link ConnectionClient} that turns an OpenAPI 3.x document into
+ * connection tools.
+ *
+ * Created lazily per-connection per-session. On first use it loads the
+ * document (fetching it when `spec` is a URL), dereferences local
+ * `$ref` pointers, and maps each operation to a tool whose name is the
+ * operation's `operationId`. Tool calls reconstruct the HTTP request —
+ * substituting path parameters, appending query parameters, attaching
+ * resolved auth and headers — and return the response as a serializable
+ * `{ status, statusText, body }`.
+ */
+export declare class OpenApiConnectionClient implements ConnectionClient {
+    #private;
+    constructor(connection: ResolvedConnectionDefinition);
+    /** Loads and parses the OpenAPI document, sharing one in-flight load. */
+    connect(): Promise<OpenApiToolCache>;
+    getToolMetadata(): Promise<readonly ConnectionToolMetadata[]>;
+    getTools(): Promise<ToolSet>;
+    executeTool(toolName: string, args: unknown): Promise<OpenApiToolResult>;
+    close(): Promise<void>;
+}
+export {};

package/dist/src/runtime/connections/openapi-client.js ADDED Viewed

@@ -0,0 +1 @@

+ import{isObject}from"#shared/guards.js";import{jsonSchema,tool}from"ai";import{passesToolFilter,resolveHeaders}from"#runtime/connections/mcp-client.js";import{HTTP_METHODS,operationDescription,operationName,uniqueName}from"#runtime/connections/openapi-operations.js";import{buildInputSchema,deref,derefSchema,isArray}from"#runtime/connections/openapi-schema.js";import{applySecurity,resolveSecurity}from"#runtime/connections/openapi-security.js";import{extractServerUrl,parseSpecDocument}from"#runtime/connections/openapi-spec.js";var OpenApiConnectionClient=class{#e;#t;#n;constructor(e){this.#n=e}async connect(){return this.#r()}async getToolMetadata(){return(await this.#r()).metadata}async getTools(){return(await this.#r()).tools}async executeTool(t,n){let r=await this.#r(),i=r.operations.get(t);if(i===void 0)throw Error(`Tool "${t}" not found in connection "${this.#n.connectionName}".`);return this.#u(i,r.baseUrl,isObject(n)?n:{})}async close(){this.#e=void 0,this.#t=void 0}async#r(){if(this.#t!==void 0)return this.#t;if(this.#e!==void 0)return this.#e;this.#e=this.#i();try{return this.#t=await this.#e,this.#t}catch(e){throw this.#e=void 0,e}}async#i(){let i=await this.#o(),a=this.#a(i),o=this.#s(i),s=this.#n.tools,c=s===void 0?o:o.filter(e=>passesToolFilter(e.toolName,s)),l=[],u=new Map,d={};for(let r of c)u.set(r.toolName,r),l.push({description:r.description,inputSchema:r.inputSchema,name:r.toolName}),d[r.toolName]=tool({description:r.description,inputSchema:jsonSchema(r.inputSchema),execute:async t=>this.#u(r,a,isObject(t)?t:{})});return{metadata:l,operations:u,tools:d,baseUrl:a}}#a(e){let t=this.#n.url;if(typeof t==`string`&&t.trim().length>0)return t;let n=extractServerUrl(e,this.#n.spec);if(n!==void 0)return n;throw Error(`OpenAPI connection "${this.#n.connectionName}" has no base URL: set "baseUrl" or ensure the document declares an absolute "servers" entry.`)}async#o(){let t=this.#n.spec;if(t===void 0)throw Error(`OpenAPI connection "${this.#n.connectionName}" is missing its "spec" source.`);if(typeof t!=`string`)return t;let n;try{n=await fetch(t,{headers:{accept:`application/json, application/yaml, text/yaml, */*`}})}catch(e){throw Error(`OpenAPI connection "${this.#n.connectionName}" failed to fetch its spec from "${t}": ${String(e)}`)}if(!n.ok)throw Error(`OpenAPI connection "${this.#n.connectionName}" failed to fetch its spec from "${t}": HTTP ${n.status}.`);let r=await n.text(),i;try{i=parseSpecDocument(r)}catch(e){throw Error(`OpenAPI connection "${this.#n.connectionName}" spec at "${t}" could not be parsed as JSON or YAML: ${String(e)}`)}if(!isObject(i))throw Error(`OpenAPI connection "${this.#n.connectionName}" spec at "${t}" is not an OpenAPI document object.`);return i}#s(t){let n=t.paths;if(!isObject(n))return[];let r=[],i=new Set;for(let[u,d]of Object.entries(n)){if(!isObject(d))continue;let n=isArray(d.parameters)?d.parameters:[];for(let f of HTTP_METHODS){let a=d[f];if(!isObject(a))continue;let p=uniqueName(operationName(a,f,u),i),m=isArray(a.parameters)?a.parameters:[],h=this.#c(t,[...n,...m]),g=this.#l(t,a.requestBody);r.push({toolName:p,method:f,pathTemplate:u,description:operationDescription(a),parameters:h,requestBody:g,inputSchema:buildInputSchema(h,g),security:resolveSecurity(t,a)})}}return r}#c(t,n){let r=[];for(let i of n){let n=isObject(i)?deref(t,i):i;if(!isObject(n))continue;let a=n.in;if(a!==`path`&&a!==`query`&&a!==`header`&&a!==`cookie`||typeof n.name!=`string`)continue;let o=isObject(n.schema)?derefSchema(t,n.schema):{};r.push({name:n.name,location:a,required:n.required===!0||a===`path`,schema:o,description:typeof n.description==`string`?n.description:void 0})}return r}#l(t,n){if(!isObject(n))return;let r=deref(t,n);if(!isObject(r)||!isObject(r.content))return;let i=r.content,a=`application/json`in i?`application/json`:Object.keys(i)[0];if(a===void 0)return;let o=i[a],s=isObject(o)&&isObject(o.schema)?derefSchema(t,o.schema):{};return{required:r.required===!0,contentType:a,schema:s}}async#u(e,t,n){let r=await resolveHeaders(this.#n),a=e.pathTemplate,o=new URLSearchParams,s=[];for(let t of e.parameters){let e=n[t.name];e!=null&&(t.location===`path`?a=a.replace(`{${t.name}}`,encodeURIComponent(String(e))):t.location===`query`?appendQuery(o,t.name,e):t.location===`cookie`?s.push(`${t.name}=${encodeURIComponent(String(e))}`):r[t.name]=String(e))}if(applySecurity(e.security,this.#n,r,o,s),s.length>0){let e=r.cookie??r.Cookie;delete r.Cookie,r.cookie=[e,...s].filter(e=>!!e).join(`; `)}let c=new URL(joinPath(t,a));c.search=o.toString();let l;e.requestBody!==void 0&&n.body!==void 0&&(l=JSON.stringify(n.body),r[`content-type`]=e.requestBody.contentType);let u=await fetch(c,{method:e.method.toUpperCase(),headers:r,body:l});return{status:u.status,statusText:u.statusText,body:await readResponseBody(u)}}};function appendQuery(e,t,n){if(isArray(n)){for(let r of n)e.append(t,String(r));return}e.append(t,String(n))}function joinPath(e,t){return`${e.endsWith(`/`)?e.slice(0,-1):e}${t.startsWith(`/`)?t:`/${t}`}`}async function readResponseBody(e){let t=await e.text();if(t.length===0)return null;if((e.headers.get(`content-type`)??``).includes(`application/json`))try{return JSON.parse(t)}catch{return t}return t}export{OpenApiConnectionClient};

package/dist/src/runtime/connections/openapi-operations.d.ts ADDED Viewed

@@ -0,0 +1,30 @@
+import type { OpenApiParameter, OpenApiRequestBody } from "#runtime/connections/openapi-schema.js";
+import type { SecurityPlacement } from "#runtime/connections/openapi-security.js";
+/** HTTP methods OpenAPI defines operations for. */
+export declare const HTTP_METHODS: readonly ["get", "put", "post", "delete", "patch", "head", "options"];
+export type HttpMethod = (typeof HTTP_METHODS)[number];
+/** Internal descriptor for one resolved OpenAPI operation. */
+export interface OpenApiOperation {
+    readonly toolName: string;
+    readonly method: HttpMethod;
+    readonly pathTemplate: string;
+    readonly description: string;
+    readonly parameters: readonly OpenApiParameter[];
+    readonly requestBody: OpenApiRequestBody | undefined;
+    readonly inputSchema: Record<string, unknown>;
+    readonly security: SecurityPlacement | undefined;
+}
+/**
+ * Derives a tool name for an operation that is legal for model providers.
+ *
+ * Provider tool-name rules (Anthropic, OpenAI) only permit
+ * `[a-zA-Z0-9_-]`, so an `operationId` is sanitized rather than used
+ * verbatim — characters like dots or slashes (common in real specs)
+ * would otherwise be rejected and break the whole connection. Operations
+ * without an `operationId` get a deterministic `<method>_<path>` name.
+ */
+export declare function operationName(operation: Record<string, unknown>, method: HttpMethod, pathTemplate: string): string;
+/** Disambiguates a tool name against names already used in the same connection. */
+export declare function uniqueName(name: string, used: Set<string>): string;
+/** Picks a human description for an operation, preferring `summary` over `description`. */
+export declare function operationDescription(operation: Record<string, unknown>): string;

package/dist/src/runtime/connections/openapi-operations.js ADDED Viewed

@@ -0,0 +1 @@

+ const HTTP_METHODS=[`get`,`put`,`post`,`delete`,`patch`,`head`,`options`];function operationName(e,t,n){if(typeof e.operationId==`string`&&e.operationId.length>0){let t=sanitizeToolName(e.operationId);if(t.length>0)return t}return sanitizeToolName(`${t}_${n.replace(/[{}]/g,``).replace(/[^a-zA-Z0-9]+/g,`_`).replace(/^_+|_+$/g,``)}`)}function sanitizeToolName(e){return e.replace(/[^a-zA-Z0-9_-]+/g,`_`).replace(/^[_-]+|[_-]+$/g,``).slice(0,64)}function uniqueName(e,t){let n=e,r=2;for(;t.has(n);)n=`${e}_${r}`,r+=1;return t.add(n),n}function operationDescription(e){return typeof e.summary==`string`&&e.summary.length>0?e.summary:typeof e.description==`string`?e.description:``}export{HTTP_METHODS,operationDescription,operationName,uniqueName};

package/dist/src/runtime/connections/openapi-schema.d.ts ADDED Viewed

@@ -0,0 +1,39 @@
+/** A path, query, header, or cookie parameter resolved from an operation. */
+export interface OpenApiParameter {
+    readonly name: string;
+    readonly location: "path" | "query" | "header" | "cookie";
+    readonly required: boolean;
+    readonly schema: Record<string, unknown>;
+    readonly description?: string;
+}
+/** A request body resolved from an operation. */
+export interface OpenApiRequestBody {
+    readonly required: boolean;
+    readonly contentType: string;
+    readonly schema: Record<string, unknown>;
+}
+/**
+ * Builds the combined JSON Schema the model fills in: each path, query,
+ * and header parameter becomes a top-level property; the request body
+ * (when present) is nested under `body`.
+ */
+export declare function buildInputSchema(parameters: readonly OpenApiParameter[], requestBody: OpenApiRequestBody | undefined): Record<string, unknown>;
+/** Resolves a single `$ref` node one hop; returns the node unchanged otherwise. */
+export declare function deref(document: Record<string, unknown>, node: Record<string, unknown>): unknown;
+/**
+ * Deeply resolves local `$ref` pointers in a JSON Schema, truncating
+ * `$ref` cycles and over-deep nesting so the result stays finite and
+ * serializable.
+ *
+ * Truncation only ever happens at an **object** node — which is always a
+ * schema position — by replacing it with an empty schema (`{}`). Scalars
+ * (`type` strings, `required` entries, `enum` values) pass through
+ * unchanged and arrays are always preserved as arrays, so array-valued
+ * keywords like `oneOf`/`anyOf`/`allOf` and `type: [..., "null"]` keep
+ * their shape. This keeps the output valid JSON Schema (draft 2020-12)
+ * for strict model providers, while the depth bound prevents recursive
+ * specs (e.g. Notion blocks) from expanding without limit.
+ */
+export declare function derefSchema(document: Record<string, unknown>, node: unknown, depth?: number, seen?: ReadonlySet<string>): unknown;
+/** Narrows `unknown` to a readonly array, used pervasively when duck-typing spec nodes. */
+export declare function isArray(value: unknown): value is readonly unknown[];

package/dist/src/runtime/connections/openapi-schema.js ADDED Viewed

@@ -0,0 +1 @@

+ import{isObject}from"#shared/guards.js";function buildInputSchema(e,t){let n={},r=[];for(let t of e)n[t.name]=t.description===void 0?t.schema:{...t.schema,description:t.description},t.required&&r.push(t.name);t!==void 0&&(n.body=t.schema,t.required&&r.push(`body`));let i={type:`object`,properties:n};return r.length>0&&(i.required=r),i}function deref(e,t){return typeof t.$ref==`string`?resolveRef(e,t.$ref)??{}:t}function derefSchema(t,n,r=0,i=new Set){if(isArray(n))return n.map(e=>derefSchema(t,e,r+1,i));if(!isObject(n))return n;if(r>12)return{};if(typeof n.$ref==`string`){if(i.has(n.$ref))return{};let e=resolveRef(t,n.$ref);return e===void 0?{}:derefSchema(t,e,r+1,new Set([...i,n.$ref]))}let a={};for(let[e,o]of Object.entries(n))a[e]=derefSchema(t,o,r+1,i);return normalizeSchemaType(a),normalizeNullable(a),a}const VALID_JSON_SCHEMA_TYPES=new Set([`string`,`number`,`integer`,`boolean`,`object`,`array`,`null`]);function normalizeSchemaType(e){let n=e.type;if(typeof n==`string`&&!VALID_JSON_SCHEMA_TYPES.has(n))delete e.type;else if(isArray(n)){let r=n.filter(e=>typeof e==`string`&&VALID_JSON_SCHEMA_TYPES.has(e));r.length===0?delete e.type:e.type=r}}function normalizeNullable(e){if(!(`nullable`in e))return;let t=e.nullable===!0;if(delete e.nullable,!t)return;let n=e.type;typeof n==`string`?n!==`null`&&(e.type=[n,`null`]):isArray(n)?n.includes(`null`)||(e.type=[...n,`null`]):isArray(e.enum)&&!e.enum.includes(null)&&(e.enum=[...e.enum,null])}function resolveRef(t,n){if(!n.startsWith(`#/`))return;let r=n.slice(2).split(`/`).map(e=>e.replace(/~1/g,`/`).replace(/~0/g,`~`)),i=t;for(let t of r){if(!isObject(i))return;i=i[t]}return i}function isArray(e){return Array.isArray(e)}export{buildInputSchema,deref,derefSchema,isArray};

package/dist/src/runtime/connections/openapi-security.d.ts ADDED Viewed

@@ -0,0 +1,41 @@
+import type { ResolvedConnectionDefinition } from "#runtime/types.js";
+/**
+ * How the connection's resolved credential is placed on a request,
+ * derived from the operation's effective `security` requirement and the
+ * document's `securitySchemes`.
+ *
+ * - `bearer` — `Authorization: Bearer <token>` (the default; also covers
+ *   `oauth2` / `openIdConnect`, whose access tokens are bearer tokens).
+ * - `basic` — `Authorization: Basic <token>` (the author supplies the
+ *   base64-encoded `user:pass` as the token).
+ * - `apiKey` — the token is placed in the named header, query param, or
+ *   cookie instead of `Authorization`.
+ */
+export type SecurityPlacement = {
+    readonly kind: "bearer";
+} | {
+    readonly kind: "basic";
+} | {
+    readonly kind: "apiKey";
+    readonly in: "header" | "query" | "cookie";
+    readonly name: string;
+};
+/**
+ * Resolves how an operation's credential should be placed, from its
+ * effective `security` requirement (operation-level overrides the
+ * document-level default) and the document's `securitySchemes`.
+ *
+ * Returns `undefined` when no requirement applies, in which case the
+ * default `Authorization: Bearer` behavior is used. The first recognized
+ * scheme in the first requirement object wins.
+ */
+export declare function resolveSecurity(document: Record<string, unknown>, operation: Record<string, unknown>): SecurityPlacement | undefined;
+/**
+ * Reshapes the resolved credential according to the operation's
+ * {@link SecurityPlacement}. The credential is resolved once by
+ * `resolveHeaders` as `Authorization: Bearer <token>`; this moves
+ * it where the scheme says (api-key header/query/cookie) or rewrites the
+ * `Authorization` scheme (basic). A `bearer` placement, a missing
+ * placement, or a connection without `authorization` is a no-op.
+ */
+export declare function applySecurity(placement: SecurityPlacement | undefined, connection: ResolvedConnectionDefinition, headers: Record<string, string>, query: URLSearchParams, cookies: string[]): void;

package/dist/src/runtime/connections/openapi-security.js ADDED Viewed

@@ -0,0 +1 @@

+ import{isObject}from"#shared/guards.js";import{deref,isArray}from"#runtime/connections/openapi-schema.js";function resolveSecurity(r,i){let a=isArray(i.security)?i.security:isArray(r.security)?r.security:void 0;if(a===void 0||a.length===0)return;let o=isObject(r.components)?r.components:void 0,s=o!==void 0&&isObject(o.securitySchemes)?o.securitySchemes:void 0;if(s!==void 0)for(let n of a){if(!isObject(n))continue;let i=Object.keys(n)[0];if(i===void 0)continue;let a=s[i],o=isObject(a)?deref(r,a):void 0;if(!isObject(o))continue;let c=mapSecurityScheme(o);if(c!==void 0)return c}}function mapSecurityScheme(e){if(e.type===`apiKey`){let t=e.in;return(t===`header`||t===`query`||t===`cookie`)&&typeof e.name==`string`&&e.name.length>0?{kind:`apiKey`,in:t,name:e.name}:void 0}if(e.type===`http`)return(typeof e.scheme==`string`?e.scheme.toLowerCase():``)===`basic`?{kind:`basic`}:{kind:`bearer`};if(e.type===`oauth2`||e.type===`openIdConnect`)return{kind:`bearer`}}function applySecurity(e,t,n,r,i){if(e===void 0||t.authorization===void 0)return;let a=extractBearerToken(n);if(a!==void 0&&e.kind!==`bearer`){if(e.kind===`basic`){n.Authorization=`Basic ${a}`;return}delete n.Authorization,e.in===`header`?n[e.name]=a:e.in===`query`?r.set(e.name,a):i.push(`${e.name}=${a}`)}}function extractBearerToken(e){let t=e.Authorization??e.authorization;return typeof t==`string`?/^Bearer\s+(.+)$/i.exec(t)?.[1]:void 0}export{applySecurity,resolveSecurity};

package/dist/src/runtime/connections/openapi-spec.d.ts ADDED Viewed

@@ -0,0 +1,20 @@
+/**
+ * Parses a fetched spec body as either JSON or YAML.
+ *
+ * JSON is tried first (the common case and fastest path); on a parse
+ * failure the body is treated as YAML. YAML is parsed by wrapping the
+ * document in front-matter delimiters so the bundled `gray-matter`
+ * engine reads the whole file — the same approach the eval YAML loader
+ * uses, avoiding a second YAML dependency.
+ */
+export declare function parseSpecDocument(text: string): unknown;
+/**
+ * Picks a base URL from an OpenAPI document's `servers` array.
+ *
+ * Returns the first server whose URL resolves to an absolute `http(s)`
+ * origin: `{var}` placeholders are substituted with each variable's
+ * `default`, and a relative URL (e.g. `/api/v3`) is resolved against
+ * `specSource` when the spec was supplied as a URL. Returns `undefined`
+ * when no entry yields an absolute URL.
+ */
+export declare function extractServerUrl(document: Record<string, unknown>, specSource: string | Record<string, unknown> | undefined): string | undefined;

package/dist/src/runtime/connections/openapi-spec.js ADDED Viewed

@@ -0,0 +1 @@

+ import{isObject}from"#shared/guards.js";import matter from"#compiled/gray-matter/index.js";import{isArray}from"#runtime/connections/openapi-schema.js";function parseSpecDocument(e){try{return JSON.parse(e)}catch{}let n=e.replace(/^\uFEFF/,``);return matter(n.trimStart().startsWith(`---`)?n:`---\n${n}\n---`).data??{}}function extractServerUrl(t,r){let i=t.servers;if(isArray(i))for(let t of i){if(!isObject(t)||typeof t.url!=`string`||t.url.length===0)continue;let n=isObject(t.variables)?substituteServerVariables(t.url,t.variables):t.url;if(n.startsWith(`http://`)||n.startsWith(`https://`))return n;if(typeof r==`string`&&URL.canParse(r))try{return new URL(n,r).toString()}catch{}}}function substituteServerVariables(t,n){return t.replace(/\{([^}]+)\}/g,(t,r)=>{let i=n[r];return isObject(i)&&typeof i.default==`string`?i.default:t})}export{extractServerUrl,parseSpecDocument};

package/dist/src/runtime/connections/principal.d.ts ADDED Viewed

@@ -0,0 +1,66 @@
+/**
+ * Principal resolution for connections.
+ *
+ * This module is the one place the runtime bridges session-layer
+ * vocabulary (`"service" | "user" | "runtime" | "unknown"`) to the
+ * connection-layer vocabulary (`"app" | "user"`) that connection
+ * authors see. Every runtime call site that needs a
+ * {@link ConnectionPrincipal} routes through
+ * {@link resolveConnectionPrincipal}, and every cache lookup keyed
+ * by principal routes through {@link principalKey}.
+ */
+import { type AlsContext } from "#context/container.js";
+import type { AuthorizationDefinition, ConnectionPrincipal } from "#runtime/connections/types.js";
+/**
+ * Stable string key identifying one principal within a connection's
+ * per-principal token cache.
+ *
+ * - `{ type: "app" }` → `"app"`. Shared across all sessions.
+ * - `{ type: "user", issuer, id }` → `"user:${issuer}:${id}"`. The
+ *   issuer prefix prevents collisions when the same `id` across
+ *   identity providers (for example Slack `U123` vs Google `U123`)
+ *   would otherwise alias to the same cache slot.
+ */
+export declare function principalKey(principal: ConnectionPrincipal): string;
+/**
+ * Resolves the {@link ConnectionPrincipal} for one connection.
+ *
+ * Single entry point for principal resolution — every runtime
+ * call site that needs a {@link ConnectionPrincipal} (wrapped tool
+ * execution, `startAuthorization` step, `mcp-client` header
+ * resolution) routes through here so the decision tree lives in
+ * exactly one place.
+ *
+ * Resolution order:
+ *
+ * 1. For `authorization.principalType === "app"`, return
+ *    `{ type: "app" }` regardless of the session. App-scoped
+ *    connections share one credential across all callers and can
+ *    be resolved with or without an active context.
+ * 2. For `authorization.principalType === "user"`, project the
+ *    current caller's {@link SessionAuthContext} (read directly from
+ *    the durable {@link AuthKey} seed) into a user principal. A
+ *    missing context, an unauthenticated caller, or a non-`"user"`
+ *    current principal all fail fast with
+ *    `reason: "principal_required"` — no amount of retrying will
+ *    recover a misconfigured route, so the runtime does not treat
+ *    it as retryable.
+ *
+ *    {@link AuthKey} is used instead of the derived `SessionKey`
+ *    so resolution works in both `runStep` scopes (where
+ *    `sessionProvider` has populated `SessionKey`) and durable
+ *    `"use step"` boundaries where only the seed keys survive
+ *    context serialization. The two are equivalent inside a step
+ *    because `sessionProvider` projects `AuthKey` into
+ *    `session.auth.current`.
+ *
+ * `ctx` defaults to {@link contextStorage.getStore}. Pass it
+ * explicitly when the caller already has a context handle (for
+ * example inside a durable step that deserialized its own
+ * {@link AlsContext}) to avoid a redundant ALS lookup.
+ *
+ * The caller is responsible for passing a matching
+ * {@link AuthorizationDefinition}. This helper does not validate
+ * the definition shape beyond reading `principalType`.
+ */
+export declare function resolveConnectionPrincipal(connectionName: string, authorization: AuthorizationDefinition, ctx?: AlsContext | undefined): ConnectionPrincipal;

package/dist/src/runtime/connections/principal.js ADDED Viewed

@@ -0,0 +1 @@

+ import{AuthKey}from"#context/keys.js";import{contextStorage}from"#context/container.js";import{ConnectionAuthorizationFailedError}from"#public/connections/errors.js";function principalKey(e){return e.type===`app`?`app`:`user:${e.issuer}:${e.id}`}function resolveConnectionPrincipal(t,n,r=contextStorage.getStore()){if(n.principalType===`app`)return{type:`app`};let i=r?.get(AuthKey);if(i==null||i.principalType!==`user`)throw new ConnectionAuthorizationFailedError(t,{message:r===void 0?`Connection "${t}" declares principalType "user" but was invoked outside an Eve context, so no user principal can be resolved.`:`Connection "${t}" declares principalType "user" but the active session has no authenticated user principal.`,reason:`principal_required`,retryable:!1});return{attributes:i.attributes,id:i.principalId,issuer:i.issuer??i.authenticator,type:`user`}}export{principalKey,resolveConnectionPrincipal};

package/dist/src/runtime/connections/registry.d.ts ADDED Viewed

@@ -0,0 +1,36 @@
+import type { NeedsApprovalContext } from "#public/definitions/tool.js";
+import type { ResolvedConnectionDefinition } from "#runtime/types.js";
+import type { ConnectionClient, ConnectionRegistry } from "#runtime/connections/types.js";
+/**
+ * Per-session container mapping connection names to lazily-initialized
+ * client wrappers.
+ *
+ * The registry is protocol-agnostic: it dispatches to the client
+ * implementation matching each connection's `protocol` (MCP or OpenAPI).
+ */
+export declare class ConnectionRegistryImpl implements ConnectionRegistry {
+    #private;
+    constructor(connections: readonly ResolvedConnectionDefinition[]);
+    /**
+     * Returns the client for the named connection, creating it on first
+     * access. The connection's `protocol` selects the client type.
+     */
+    getClient(connectionName: string): ConnectionClient;
+    /**
+     * Returns the authored approval function for the named connection,
+     * or `undefined` if the connection did not specify one.
+     */
+    getConnectionApproval(connectionName: string): ((ctx: NeedsApprovalContext) => boolean) | undefined;
+    /**
+     * Returns all registered connection names.
+     */
+    getConnectionNames(): readonly string[];
+    /**
+     * Returns the resolved definitions for all connections.
+     */
+    getConnections(): readonly ResolvedConnectionDefinition[];
+    /**
+     * Closes all active client connections.
+     */
+    dispose(): Promise<void>;
+}

package/dist/src/runtime/connections/registry.js ADDED Viewed

@@ -0,0 +1 @@

+ import{McpConnectionClient}from"#runtime/connections/mcp-client.js";import{OpenApiConnectionClient}from"#runtime/connections/openapi-client.js";var ConnectionRegistryImpl=class{#e=new Map;#t;constructor(e){this.#t=e}getClient(n){let r=this.#e.get(n);if(r!==void 0)return r;let i=this.#t.find(e=>e.connectionName===n);if(i===void 0)throw Error(`Connection "${n}" is not registered.`);let a=i.protocol===`openapi`?new OpenApiConnectionClient(i):new McpConnectionClient(i);return this.#e.set(n,a),a}getConnectionApproval(e){return this.#t.find(t=>t.connectionName===e)?.approval}getConnectionNames(){return this.#t.map(e=>e.connectionName)}getConnections(){return this.#t}async dispose(){let e=[...this.#e.values()].map(e=>e.close());await Promise.allSettled(e),this.#e.clear()}};export{ConnectionRegistryImpl};