wizards 0.1.9

package/apps/runtime/dist/engenty/connections-s3/s3.js

@@ -0,0 +1,328 @@
+import { defineConnector, } from "../shims/connections-sdk.js";
+import { AwsClient } from "aws4fetch";
+import { XMLParser } from "fast-xml-parser";
+const PRESIGN_TTL_SECONDS = 300;
+const xml = new XMLParser({ ignoreAttributes: true });
+function parseCredentials(accessToken) {
+    let parsed;
+    try {
+        parsed = JSON.parse(accessToken);
+    }
+    catch {
+        throw new Error("s3_credentials_invalid: stored credentials are not JSON");
+    }
+    if (!(parsed.access_key_id &&
+        parsed.secret_access_key &&
+        parsed.region &&
+        parsed.bucket)) {
+        throw new Error("s3_credentials_invalid: missing required fields");
+    }
+    return parsed;
+}
+function normalizedPrefix(creds) {
+    const prefix = (creds.prefix ?? "").replace(/^\/+/, "");
+    if (!prefix) {
+        return "";
+    }
+    return prefix.endsWith("/") ? prefix : `${prefix}/`;
+}
+function bucketUrl(creds) {
+    const endpoint = creds.endpoint?.replace(/\/+$/, "") ??
+        `https://s3.${creds.region}.amazonaws.com`;
+    return `${endpoint}/${creds.bucket}`;
+}
+function clientFor(creds) {
+    return new AwsClient({
+        accessKeyId: creds.access_key_id,
+        region: creds.region,
+        secretAccessKey: creds.secret_access_key,
+        service: "s3",
+    });
+}
+async function s3Fetch(ctx, creds, url, init) {
+    const client = clientFor(creds);
+    const signed = await client.sign(url, {
+        method: init?.method ?? "GET",
+        ...(init?.body === undefined ? {} : { body: init.body }),
+        ...(init?.headers ? { headers: init.headers } : {}),
+    });
+    const res = await ctx.fetchImpl(signed);
+    if (!res.ok) {
+        const body = (await res.text()).slice(0, 400);
+        throw new Error(`s3_api_error (${res.status}): ${body}`);
+    }
+    return res;
+}
+/** Bucket URL for one object key, each path segment encoded. */
+function objectUrl(creds, key) {
+    return `${bucketUrl(creds)}/${key
+        .split("/")
+        .map(encodeURIComponent)
+        .join("/")}`;
+}
+/** Compose a connection-relative file ref from a folder ref + file name. */
+export function composeFileRef(folderRef, name) {
+    const folder = (folderRef ?? "").replace(/^\/+/, "");
+    if (!folder) {
+        return name;
+    }
+    return folder.endsWith("/") ? `${folder}${name}` : `${folder}/${name}`;
+}
+function asArray(value) {
+    if (value === undefined) {
+        return [];
+    }
+    return Array.isArray(value) ? value : [value];
+}
+/**
+ * Parse a ListObjectsV2 response into normalized entries. `root` is the
+ * connection's configured prefix; refs are keys relative to it (folders carry a
+ * trailing slash so they round-trip as prefixes).
+ */
+export function parseListResponse(body, root) {
+    const doc = xml.parse(body);
+    const result = doc.ListBucketResult ?? {};
+    const entries = [];
+    for (const cp of asArray(result.CommonPrefixes)) {
+        const full = cp.Prefix ?? "";
+        if (!full.startsWith(root)) {
+            continue;
+        }
+        const rel = full.slice(root.length);
+        entries.push({
+            kind: "folder",
+            mime_type: null,
+            modified_at: null,
+            name: rel.replace(/\/$/, "").split("/").pop() ?? rel,
+            ref: rel,
+            size: null,
+        });
+    }
+    for (const obj of asArray(result.Contents)) {
+        const full = obj.Key ?? "";
+        if (!full.startsWith(root)) {
+            continue;
+        }
+        const rel = full.slice(root.length);
+        // The prefix marker object of the folder itself has an empty relative key.
+        if (!rel || rel.endsWith("/")) {
+            continue;
+        }
+        entries.push({
+            kind: "file",
+            mime_type: null,
+            modified_at: obj.LastModified ?? null,
+            name: rel.split("/").pop() ?? rel,
+            ref: rel,
+            size: obj.Size === undefined ? null : Number(obj.Size),
+        });
+    }
+    return {
+        entries,
+        next_cursor: result.NextContinuationToken ?? null,
+    };
+}
+/** Verify credentials with a 1-key list and resolve the account label. */
+export async function verifyS3Credentials(raw, fetchImpl) {
+    const creds = parseCredentials(JSON.stringify(raw));
+    const root = normalizedPrefix(creds);
+    const url = new URL(bucketUrl(creds));
+    url.searchParams.set("list-type", "2");
+    url.searchParams.set("max-keys", "1");
+    if (root) {
+        url.searchParams.set("prefix", root);
+    }
+    const signed = await clientFor(creds).sign(url.toString(), {
+        method: "GET",
+    });
+    const res = await fetchImpl(signed);
+    if (!res.ok) {
+        const body = (await res.text()).slice(0, 300);
+        throw new Error(`s3_verify_failed (${res.status}): ${body}`);
+    }
+    const label = root
+        ? `${creds.bucket}/${root.replace(/\/$/, "")}`
+        : creds.bucket;
+    return { externalId: label, label };
+}
+export const s3Connector = defineConnector({
+    actions: [],
+    auth: {
+        kind: "api_key",
+        apiKey: {
+            fields: [
+                { key: "access_key_id", label: "Access key ID" },
+                { key: "secret_access_key", label: "Secret access key", secret: true },
+                { key: "region", label: "Region", placeholder: "eu-central-1" },
+                { key: "bucket", label: "Bucket" },
+                {
+                    key: "endpoint",
+                    label: "Endpoint",
+                    placeholder: "https://… (only for R2/MinIO)",
+                    required: false,
+                },
+                {
+                    key: "prefix",
+                    label: "Key prefix",
+                    placeholder: "optional root folder",
+                    required: false,
+                },
+            ],
+            verify: verifyS3Credentials,
+        },
+    },
+    description: "Browse, read, and write objects in an S3-compatible bucket (AWS S3, Cloudflare R2, MinIO). Writes require approval by default.",
+    files: {
+        rootLabel: (connection) => connection.external_account ?? "S3 bucket",
+        async list(ctx, input) {
+            const creds = parseCredentials(ctx.accessToken);
+            const root = normalizedPrefix(creds);
+            const folder = input.folder_ref ?? "";
+            const url = new URL(bucketUrl(creds));
+            url.searchParams.set("list-type", "2");
+            url.searchParams.set("delimiter", "/");
+            url.searchParams.set("prefix", `${root}${folder}`);
+            url.searchParams.set("max-keys", String(input.limit ?? 100));
+            if (input.cursor) {
+                url.searchParams.set("continuation-token", input.cursor);
+            }
+            const res = await s3Fetch(ctx, creds, url.toString());
+            return parseListResponse(await res.text(), root);
+        },
+        async read(ctx, input) {
+            const creds = parseCredentials(ctx.accessToken);
+            const root = normalizedPrefix(creds);
+            const key = `${root}${input.file_ref}`;
+            // HEAD first for size/mime, then presign a GET — no proxying, no cap.
+            const headUrl = `${bucketUrl(creds)}/${key
+                .split("/")
+                .map(encodeURIComponent)
+                .join("/")}`;
+            const head = await s3Fetch(ctx, creds, headUrl, { method: "HEAD" });
+            const size = Number(head.headers.get("content-length") ?? "0") || null;
+            const mime = head.headers.get("content-type");
+            const presigned = await clientFor(creds).sign(`${headUrl}?X-Amz-Expires=${PRESIGN_TTL_SECONDS}`, { aws: { signQuery: true }, method: "GET" });
+            return {
+                expires_at: new Date(Date.now() + PRESIGN_TTL_SECONDS * 1000).toISOString(),
+                kind: "url",
+                mime_type: mime,
+                name: input.file_ref.split("/").pop() ?? input.file_ref,
+                size,
+                url: presigned.url,
+            };
+        },
+        async search(ctx, input) {
+            const creds = parseCredentials(ctx.accessToken);
+            const root = normalizedPrefix(creds);
+            const scope = input.folder_ref ?? "";
+            const url = new URL(bucketUrl(creds));
+            url.searchParams.set("list-type", "2");
+            url.searchParams.set("prefix", `${root}${scope}`);
+            url.searchParams.set("max-keys", "1000");
+            const res = await s3Fetch(ctx, creds, url.toString());
+            const listing = parseListResponse(await res.text(), root);
+            const q = input.query.toLowerCase();
+            const limit = input.limit ?? 100;
+            return {
+                entries: listing.entries
+                    .filter((entry) => entry.name.toLowerCase().includes(q))
+                    .slice(0, limit),
+                next_cursor: null,
+            };
+        },
+        async stat(ctx, input) {
+            const creds = parseCredentials(ctx.accessToken);
+            const root = normalizedPrefix(creds);
+            if (!input.ref || input.ref.endsWith("/")) {
+                return {
+                    kind: "folder",
+                    mime_type: null,
+                    modified_at: null,
+                    name: input.ref.replace(/\/$/, "").split("/").pop() ?? "",
+                    ref: input.ref,
+                    size: null,
+                };
+            }
+            const key = `${root}${input.ref}`;
+            const headUrl = `${bucketUrl(creds)}/${key
+                .split("/")
+                .map(encodeURIComponent)
+                .join("/")}`;
+            const head = await s3Fetch(ctx, creds, headUrl, { method: "HEAD" });
+            return {
+                kind: "file",
+                mime_type: head.headers.get("content-type"),
+                modified_at: head.headers.get("last-modified")
+                    ? new Date(head.headers.get("last-modified")).toISOString()
+                    : null,
+                name: input.ref.split("/").pop() ?? input.ref,
+                ref: input.ref,
+                size: Number(head.headers.get("content-length") ?? "0") || null,
+            };
+        },
+    },
+    icon: "🪣",
+    id: "s3",
+    moduleId: "connections-s3",
+    name: "S3 Bucket",
+    storage: {
+        async write(ctx, input) {
+            const creds = parseCredentials(ctx.accessToken);
+            const root = normalizedPrefix(creds);
+            const ref = composeFileRef(input.folder_ref, input.name);
+            const bytes = typeof input.content_base64 === "string"
+                ? Buffer.from(input.content_base64, "base64")
+                : Buffer.from(input.content_text ?? "", "utf8");
+            const mime = input.mime_type ?? "application/octet-stream";
+            await s3Fetch(ctx, creds, objectUrl(creds, `${root}${ref}`), {
+                body: new Uint8Array(bytes),
+                headers: { "content-type": mime },
+                method: "PUT",
+            });
+            return {
+                kind: "file",
+                mime_type: mime,
+                modified_at: new Date().toISOString(),
+                name: input.name,
+                ref,
+                size: bytes.length,
+            };
+        },
+        async delete(ctx, input) {
+            const creds = parseCredentials(ctx.accessToken);
+            const root = normalizedPrefix(creds);
+            await s3Fetch(ctx, creds, objectUrl(creds, `${root}${input.ref}`), {
+                method: "DELETE",
+            });
+            return { deleted: true, ref: input.ref };
+        },
+        async move(ctx, input) {
+            const creds = parseCredentials(ctx.accessToken);
+            const root = normalizedPrefix(creds);
+            const name = input.new_name ?? (input.ref.split("/").pop() || input.ref);
+            const toRef = composeFileRef(input.to_folder_ref, name);
+            // S3 has no native move: server-side copy, then delete the source.
+            await s3Fetch(ctx, creds, objectUrl(creds, `${root}${toRef}`), {
+                headers: {
+                    "x-amz-copy-source": `/${creds.bucket}/${`${root}${input.ref}`
+                        .split("/")
+                        .map(encodeURIComponent)
+                        .join("/")}`,
+                },
+                method: "PUT",
+            });
+            await s3Fetch(ctx, creds, objectUrl(creds, `${root}${input.ref}`), {
+                method: "DELETE",
+            });
+            return {
+                kind: "file",
+                mime_type: null,
+                modified_at: new Date().toISOString(),
+                name,
+                ref: toRef,
+                size: null,
+            };
+        },
+    },
+    toolPrefix: "s3",
+});

package/apps/runtime/dist/engenty/connections-sdk/files-capability.js

@@ -0,0 +1,86 @@
+import { z } from "zod";
+/**
+ * Synthesize the read actions for a connector's files capability. Each is a
+ * normal `group: "read"` action, so `registerConnectorModule` projects it as a
+ * gateway operation (`<toolPrefix>_files_list`, …) and the policy gate, audit,
+ * approvals, and agent-tool wiring all apply with no extra code. The files
+ * module also drives connected-folder mounts through the same capability.
+ */
+export function filesCapabilityActions(files, providerScopes) {
+    const scopes = providerScopes ?? [];
+    const fileEntryDescription = "A file or folder. `ref` is the provider id to pass back as folder_ref/file_ref/ref.";
+    const listAction = {
+        description: "List one folder's immediate children. Pass folder_ref: null for the root; page with the returned next_cursor.",
+        group: "read",
+        id: "files_list",
+        inputSchema: z.object({
+            cursor: z
+                .string()
+                .nullish()
+                .describe("Opaque pagination cursor from a prior next_cursor."),
+            folder_ref: z
+                .string()
+                .nullable()
+                .describe("Folder id to list; null lists the connection's root."),
+            limit: z
+                .number()
+                .int()
+                .min(1)
+                .max(200)
+                .optional()
+                .describe("Max entries (default 100)."),
+        }),
+        providerScopes: scopes,
+        summary: "List a folder",
+        handler: (input, ctx) => files.list(ctx, input),
+    };
+    const readAction = {
+        description: `Read a file's contents. ${fileEntryDescription} Large or binary files come back base64-encoded or as a short-lived URL.`,
+        group: "read",
+        id: "files_read",
+        inputSchema: z.object({
+            file_ref: z.string().describe("File id to read (an entry's ref)."),
+            max_bytes: z
+                .number()
+                .int()
+                .min(1)
+                .optional()
+                .describe("Cap for proxied bytes; ignored for URL results."),
+        }),
+        providerScopes: scopes,
+        summary: "Read a file",
+        handler: (input, ctx) => files.read(ctx, input),
+    };
+    const statAction = {
+        description: `Get metadata for a single file or folder. ${fileEntryDescription}`,
+        group: "read",
+        id: "files_stat",
+        inputSchema: z.object({
+            ref: z.string().describe("File or folder id."),
+        }),
+        providerScopes: scopes,
+        summary: "Stat a file or folder",
+        handler: (input, ctx) => files.stat(ctx, input),
+    };
+    const actions = [listAction, readAction, statAction];
+    if (files.search) {
+        const search = files.search.bind(files);
+        actions.push({
+            description: "Search files by name. Optionally scope to a folder subtree with folder_ref.",
+            group: "read",
+            id: "files_search",
+            inputSchema: z.object({
+                folder_ref: z
+                    .string()
+                    .nullish()
+                    .describe("Restrict the search to this folder subtree."),
+                limit: z.number().int().min(1).max(200).optional(),
+                query: z.string().min(1).describe("Case-insensitive name query."),
+            }),
+            providerScopes: scopes,
+            summary: "Search files by name",
+            handler: (input, ctx) => search(ctx, input),
+        });
+    }
+    return actions;
+}

package/apps/runtime/dist/engenty/connections-sdk/oauth2.js

@@ -0,0 +1,150 @@
+import { createHash, randomBytes } from "node:crypto";
+async function readClientEnv(key, resolveEnv) {
+    if (!key) {
+        return;
+    }
+    const resolved = await resolveEnv?.(key);
+    return resolved ?? process.env[key];
+}
+/** RFC 7636 S256 PKCE pair for public (and confidential) authorization-code clients. */
+export function createOAuth2Pkce() {
+    const codeVerifier = randomBytes(32).toString("base64url");
+    const codeChallenge = createHash("sha256")
+        .update(codeVerifier)
+        .digest("base64url");
+    return {
+        codeChallenge,
+        codeChallengeMethod: "S256",
+        codeVerifier,
+    };
+}
+export async function resolveOAuth2Env(config, resolveEnv) {
+    const clientId = await readClientEnv(config.clientIdEnv, resolveEnv);
+    const clientSecret = await readClientEnv(config.clientSecretEnv, resolveEnv);
+    if (!(clientId && clientSecret)) {
+        throw new Error(`OAuth client credentials missing: set ${config.clientIdEnv ?? "<clientIdEnv>"} and ${config.clientSecretEnv ?? "<clientSecretEnv>"}`);
+    }
+    return { clientId, clientSecret };
+}
+/**
+ * Resolve the OAuth client for a connector. Precedence: a DB-backed
+ * `resolveClientCredentials` (imported connectors) wins; otherwise the injected
+ * `resolveEnv` (tenant → platform settings) with a process.env fallback.
+ */
+export async function resolveOAuth2Credentials(config, resolveEnv) {
+    if (config.resolveClientCredentials) {
+        const creds = await config.resolveClientCredentials();
+        if (!creds.clientId?.trim()) {
+            throw new Error("OAuth client credentials missing: no client_id");
+        }
+        return {
+            clientId: creds.clientId,
+            clientSecret: creds.clientSecret ?? "",
+        };
+    }
+    return resolveOAuth2Env(config, resolveEnv);
+}
+/**
+ * True when the connector's OAuth client can start a connect flow. Env-backed
+ * connectors still need both id and secret; imported / DCR clients only need a
+ * client id (public clients omit the secret). Never throws.
+ */
+export async function hasOAuth2ClientCredentials(config, resolveEnv) {
+    if (config.resolveClientCredentials) {
+        try {
+            const creds = await config.resolveClientCredentials();
+            return Boolean(creds.clientId?.trim());
+        }
+        catch {
+            return false;
+        }
+    }
+    const clientId = await readClientEnv(config.clientIdEnv, resolveEnv);
+    const clientSecret = await readClientEnv(config.clientSecretEnv, resolveEnv);
+    return Boolean(clientId && clientSecret);
+}
+export async function buildAuthorizationUrl(params) {
+    if (params.connector.auth.kind !== "oauth2") {
+        throw new Error("buildAuthorizationUrl requires an oauth2 connector");
+    }
+    const { oauth2 } = params.connector.auth;
+    const env = await resolveOAuth2Credentials(oauth2, params.resolveEnv);
+    const url = new URL(oauth2.authUrl);
+    url.searchParams.set("client_id", env.clientId);
+    url.searchParams.set("redirect_uri", params.redirectUri);
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("scope", params.scopes.join(oauth2.scopeSeparator ?? " "));
+    url.searchParams.set("state", params.state);
+    if (params.pkce) {
+        url.searchParams.set("code_challenge", params.pkce.codeChallenge);
+        url.searchParams.set("code_challenge_method", params.pkce.codeChallengeMethod);
+    }
+    for (const [key, value] of Object.entries(oauth2.extraAuthParams ?? {})) {
+        url.searchParams.set(key, value);
+    }
+    return url.toString();
+}
+function parseTokenResponse(data, separator) {
+    const nested = data.authed_user?.access_token ? data.authed_user : null;
+    const accessToken = nested?.access_token ?? data.access_token;
+    if (!accessToken) {
+        throw new Error(`Token endpoint returned no access token${data.error ? `: ${data.error} ${data.error_description ?? ""}` : ""}`.trim());
+    }
+    const scopeRaw = nested?.scope ?? data.scope ?? "";
+    return {
+        accessToken,
+        expiresAt: data.expires_in
+            ? new Date(Date.now() + data.expires_in * 1000)
+            : null,
+        grantedScopes: scopeRaw
+            .split(separator === "," ? "," : /[\s,]+/u)
+            .map((s) => s.trim())
+            .filter(Boolean),
+        refreshToken: data.refresh_token ?? null,
+    };
+}
+async function postTokenEndpoint(config, body, fetchImpl, resolveEnv) {
+    const env = await resolveOAuth2Credentials(config, resolveEnv);
+    const form = {
+        client_id: env.clientId,
+        ...body,
+    };
+    // Public clients omit client_secret; sending an empty value breaks some AS.
+    if (env.clientSecret) {
+        form.client_secret = env.clientSecret;
+    }
+    const response = await fetchImpl(config.tokenUrl, {
+        body: new URLSearchParams(form),
+        // Some providers (GitHub) default the token response to form-encoding and
+        // only return JSON when the request opts in via `Accept: application/json`;
+        // `tokenRequestHeaders` lets a connector add that header (parseTokenResponse
+        // always reads JSON). Connector-supplied headers cannot override content-type.
+        headers: {
+            ...config.tokenRequestHeaders,
+            "content-type": "application/x-www-form-urlencoded",
+        },
+        method: "POST",
+    });
+    const data = (await response.json());
+    if (!response.ok) {
+        throw new Error(`Token endpoint failed (${response.status}): ${data.error ?? "unknown"} ${data.error_description ?? ""}`.trim());
+    }
+    return parseTokenResponse(data, config.scopeSeparator ?? " ");
+}
+export function exchangeAuthorizationCode(params) {
+    const body = {
+        code: params.code,
+        grant_type: "authorization_code",
+        redirect_uri: params.redirectUri,
+    };
+    if (params.codeVerifier) {
+        body.code_verifier = params.codeVerifier;
+    }
+    return postTokenEndpoint(params.config, body, params.fetchImpl ?? fetch, params.resolveEnv);
+}
+export function refreshAccessToken(params) {
+    return postTokenEndpoint(params.config, {
+        grant_type: "refresh_token",
+        refresh_token: params.refreshToken,
+    }, params.fetchImpl ?? fetch, params.resolveEnv);
+}

package/apps/runtime/dist/engenty/connections-sdk/registry.js

@@ -0,0 +1,89 @@
+/**
+ * Process-wide connector registry. Connector modules register at plugin load;
+ * the connections module reads it lazily (OAuth routes, management ops, UI
+ * catalog), so registration order between modules does not matter.
+ *
+ * IMPORTANT: core loads every plugin through its OWN jiti instance (fresh
+ * module cache per plugin — see apps/core/src/plugins/loader.ts), so a plain
+ * module-level Map would give each module a private copy. The registry
+ * therefore lives on `globalThis` under a `Symbol.for` key, which is shared
+ * across all module-cache copies in the process.
+ *
+ * Imported (integrations.sh / MCP / OpenAPI) definitions carry `tenantId` and
+ * are stored under `${tenantId}::${id}` so one tenant's import is not listed
+ * or executed as another's. Builtins have no tenantId and use `id` as the key.
+ */
+const REGISTRY_KEY = Symbol.for("engenty.connections.connector-registry");
+function registry() {
+    const host = globalThis;
+    host[REGISTRY_KEY] ??= new Map();
+    return host[REGISTRY_KEY];
+}
+function registryKey(def) {
+    return def.tenantId ? `${def.tenantId}::${def.id}` : def.id;
+}
+export function registerConnectorDefinition(def) {
+    const seen = new Set();
+    for (const action of def.actions) {
+        if (seen.has(action.id)) {
+            throw new Error(`Connector "${def.id}" duplicates action "${action.id}"`);
+        }
+        seen.add(action.id);
+    }
+    // Idempotent on purpose: dev-reload re-runs plugin factories; the latest
+    // definition wins.
+    registry().set(registryKey(def), def);
+}
+/**
+ * Remove a definition (imported-connector delete). Already-registered gateway
+ * operations cannot be unregistered — they dead-end at policy resolution once
+ * the definition is gone; a restart fully clears them.
+ */
+export function removeConnectorDefinition(id, tenantId) {
+    registry().delete(tenantId ? `${tenantId}::${id}` : id);
+}
+export function getConnectorDefinition(id, tenantId) {
+    const map = registry();
+    if (tenantId) {
+        const scoped = map.get(`${tenantId}::${id}`);
+        if (scoped) {
+            return scoped;
+        }
+    }
+    const builtin = map.get(id);
+    if (builtin && !builtin.tenantId) {
+        return builtin;
+    }
+    return;
+}
+/** Builtins plus this tenant's imports. Omit tenantId to list builtins only. */
+export function listConnectorDefinitions(tenantId) {
+    return [...registry().values()]
+        .filter((def) => !def.tenantId || def.tenantId === tenantId)
+        .sort((a, b) => a.name.localeCompare(b.name));
+}
+function connectorsForResolve(tenantId) {
+    if (!tenantId) {
+        return [...registry().values()].filter((def) => !def.tenantId);
+    }
+    return listConnectorDefinitions(tenantId);
+}
+/** Find the connector + action that own a projected operation id. */
+export function resolveConnectorOperation(operationId, tenantId) {
+    for (const connector of connectorsForResolve(tenantId)) {
+        const prefix = `${connector.toolPrefix}_`;
+        if (!operationId.startsWith(prefix)) {
+            continue;
+        }
+        const actionId = operationId.slice(prefix.length);
+        const action = connector.actions.find((a) => a.id === actionId);
+        if (action) {
+            return { action, connector };
+        }
+    }
+    return null;
+}
+/** Test-only: reset the registry between vitest cases. */
+export function __resetConnectorRegistryForTests() {
+    registry().clear();
+}