xaq-cli 0.0.0 → 0.1.0-nightly.72

package/dist/web/assets/webhook-sheet-B8h0skDe.js

@@ -0,0 +1,34 @@
+import{r as e}from"./rolldown-runtime-XKyaHtl9.js";import{D as t,N as n,Ut as r,Wt as i,n as a,t as o,w as s,yt as c}from"./queries-Cv3nXx0U.js";import{t as l}from"./useQuery-MrTwwNy5.js";import{i as u,n as d,o as f,s as p,t as ee}from"./select-Bb806bpq.js";import{a as m,c as h,i as te,l as g,n as _,o as v,s as y,t as b}from"./label-multi-select-sH8mllw8.js";import{c as x,l as S,u as C}from"./card-GSO5o-Ug.js";import{I as w,c as T,i as ne,r as E,t as D}from"./common-BPZV8TFb.js";import{t as O}from"./shield-alert-CSYB-ThV.js";import{t as re}from"./sparkles-CUTiob4K.js";import{t as k}from"./checkbox-B937U-Fd.js";import{a as A,c as j,i as ie,n as M,o as N,r as P,s as F,t as I}from"./field-C6ejurju.js";import{n as L,t as R}from"./chips-input-2xWDofmE.js";import{n as z,t as ae}from"./toggle-group-Bdo1gmQ1.js";import{J as B,Ot as V,U as H,V as oe}from"./index-DGzo3kGh.js";import{a as se,i as ce,n as le,o as ue,r as U,s as de,t as fe}from"./mutations-CLPqJ6cj.js";import{t as W}from"./input-CWwJgozn.js";import{a as pe,i as me,n as he,o as ge,r as _e,t as G}from"./sheet-CYPwpUsH.js";import{u as K}from"./labels-B5UqVwFo.js";import{n as ve}from"./use-label-names-BXicesnP.js";var q=r(),ye=`// npm install standardwebhooks
+import { Webhook } from "standardwebhooks";
+
+const wh = new Webhook(process.env.XAQ_WEBHOOK_SECRET); // "whsec_…"
+
+// Verify the raw request body (before JSON parsing). Throws if invalid.
+const event = wh.verify(rawBody, {
+  "webhook-id": req.headers["webhook-id"],
+  "webhook-timestamp": req.headers["webhook-timestamp"],
+  "webhook-signature": req.headers["webhook-signature"],
+});`,be=`# pip install standardwebhooks
+import os
+from standardwebhooks.webhooks import Webhook
+
+wh = Webhook(os.environ["XAQ_WEBHOOK_SECRET"])  # "whsec_…"
+
+# Verify the raw request body. Raises if invalid.
+event = wh.verify(raw_body, dict(request.headers))`,xe=`import crypto from "node:crypto";
+
+// Signed content: "<webhook-id>.<webhook-timestamp>.<raw body>"
+// Key: base64-decoded secret after the "whsec_" prefix. Signature: HMAC-SHA256, base64.
+function verify(secret, headers, rawBody) {
+  const id = headers["webhook-id"];
+  const ts = headers["webhook-timestamp"];
+  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false; // reject replays
+  const key = Buffer.from(secret.replace(/^whsec_/, ""), "base64");
+  const expected = crypto.createHmac("sha256", key).update(\`\${id}.\${ts}.\${rawBody}\`).digest("base64");
+  // The header may hold several space-separated "v1,<signature>" entries.
+  return headers["webhook-signature"].split(" ").some((entry) => {
+    const sig = Buffer.from(entry.split(",")[1] ?? "");
+    const want = Buffer.from(expected);
+    return sig.length === want.length && crypto.timingSafeEqual(sig, want);
+  });
+}`;function J(){return(0,q.jsxs)(`div`,{className:`space-y-2`,children:[(0,q.jsxs)(`p`,{className:`text-sm text-muted-foreground`,children:[`Requests are signed per `,(0,q.jsx)(`a`,{className:`underline underline-offset-4`,href:`https://www.standardwebhooks.com`,target:`_blank`,rel:`noopener noreferrer`,children:`Standard Webhooks`}),` with the headers `,(0,q.jsx)(`code`,{className:`font-mono text-foreground`,children:`webhook-id`}),`, `,(0,q.jsx)(`code`,{className:`font-mono text-foreground`,children:`webhook-timestamp`}),` and`,` `,(0,q.jsx)(`code`,{className:`font-mono text-foreground`,children:`webhook-signature`}),`. Reply with any 2xx quickly; anything else is retried with backoff.`]}),(0,q.jsxs)(v,{defaultValue:`node`,children:[(0,q.jsxs)(h,{children:[(0,q.jsx)(g,{value:`node`,children:`Node.js`}),(0,q.jsx)(g,{value:`python`,children:`Python`}),(0,q.jsx)(g,{value:`manual`,children:`No library`})]}),(0,q.jsx)(y,{value:`node`,children:(0,q.jsx)(D,{code:ye})}),(0,q.jsx)(y,{value:`python`,children:(0,q.jsx)(D,{code:be})}),(0,q.jsx)(y,{value:`manual`,children:(0,q.jsx)(D,{code:xe})})]})]})}function Se({secret:e}){return(0,q.jsxs)(`div`,{className:`space-y-5`,children:[(0,q.jsxs)(`div`,{className:`space-y-2`,children:[(0,q.jsx)(T,{children:`Signing secret`}),(0,q.jsx)(E,{value:e,size:`lg`}),(0,q.jsxs)(x,{variant:`warning`,children:[(0,q.jsx)(O,{}),(0,q.jsx)(C,{children:`Copy the secret now. It won't be shown again.`}),(0,q.jsx)(S,{children:`Store it with your receiver (e.g. as XAQ_WEBHOOK_SECRET). If it's lost, rotate it from the webhook's page.`})]})]}),(0,q.jsxs)(`div`,{className:`space-y-2`,children:[(0,q.jsx)(T,{children:`Verify requests`}),(0,q.jsx)(J,{})]})]})}function Ce({secret:e,title:t,description:r,onClose:i}){return(0,q.jsx)(le,{open:!!e,children:(0,q.jsxs)(U,{className:`max-h-[calc(100svh-2rem)] overflow-y-auto sm:max-w-2xl`,showCloseButton:!1,onInteractOutside:e=>e.preventDefault(),onEscapeKeyDown:e=>e.preventDefault(),children:[(0,q.jsxs)(ue,{children:[(0,q.jsx)(de,{children:t}),(0,q.jsx)(ce,{children:r})]}),e&&(0,q.jsx)(Se,{secret:e}),(0,q.jsx)(se,{children:(0,q.jsx)(n,{onClick:i,children:`I've saved the secret`})})]})})}var Y=e(i(),1);function X(e){if(!e)return null;if(/\(\?<?[=!]/.test(e))return`lookarounds like (?=…) or (?!…) aren't supported (RE2). Match the text directly instead.`;if(/\\[1-9]|\\k</.test(e))return`backreferences like \\1 aren't supported (RE2).`;for(let t of e.matchAll(/\{(\d+)(?:,(\d*))?\}/g))if(Number(t[1])>1e3||t[2]&&Number(t[2])>1e3)return`repeat counts above 1000 aren't supported (RE2).`;let t=e.replace(/\(\?[imsU]+\)/g,``).replace(/\(\?[imsU-]+:/g,`(?:`).replace(/\(\?P</g,`(?<`);try{return new RegExp(t,`i`),null}catch(e){return e.message.replace(/^Invalid regular expression: \/.*\/[a-z]*: /,``).replace(/^Invalid regular expression: /,``)}}function we(e){let t={};return e.accountIds?.length&&(t.accountIds=e.accountIds),e.labelIds?.length&&(t.labelIds=e.labelIds),e.from?.length&&(t.from=e.from),e.to?.length&&(t.to=e.to),e.subject?.trim()&&(t.subject=e.subject.trim()),e.hasAttachments!==void 0&&(t.hasAttachments=e.hasAttachments),e.calendarIds?.length&&(t.calendarIds=e.calendarIds),t}var Z=(e,t=3)=>e.length<=t?e.join(`, `):`${e.slice(0,t).join(`, `)} and ${e.length-t} more`;function Q(e,t,n=e=>e,r=e=>e){let i=e.filter,a=e.eventTypes.some(B),o=e.eventTypes.some(e=>!B(e)),s=e.eventTypes.map(e=>K[e]?.label.toLowerCase()??e),c=[s.length?`Sends ${Z(s)} events`:`Sends nothing yet: pick at least one event type`];c.push(i.accountIds?.length?`from ${Z(i.accountIds.map(e=>t.find(t=>t.id===e)?.email??e))}`:`from every account the agent can read`);let l=(e,t)=>a&&o?`${e} (or ${t})`:a?t:e;return a&&i.calendarIds?.length&&c.push(`only for calendar events on ${Z(i.calendarIds.map(r))}`),o&&i.labelIds?.length&&c.push(`only for messages labeled ${Z(i.labelIds.map(n))}`),i.from?.length&&c.push(`where the ${l(`sender`,`organizer`)} matches ${Z(i.from)}`),i.to?.length&&c.push(`where a ${l(`recipient`,`guest`)} matches ${Z(i.to)}`),i.subject&&c.push(`where the ${l(`subject`,`event title`)} matches /${i.subject}/i`),o&&i.hasAttachments===!0&&c.push(`with attachments only`),o&&i.hasAttachments===!1&&c.push(`without attachments only`),c.push(e.includeBody?`including the cleaned ${l(`message body`,`event description`)}`:`with metadata only (no body)`),c}var Te=[{label:`Mail and account`,types:H.filter(e=>!B(e))},{label:`Calendar`,hint:`Needs the agent to have Calendar: read on the account, and the event's calendar in its scope.`,types:oe}];function Ee({value:e,onChange:t,invalid:n}){let r=(n,r)=>t(H.filter(t=>t===n?r:e.includes(t)));return(0,q.jsxs)(F,{"data-invalid":n,children:[(0,q.jsx)(N,{variant:`label`,children:`Events`}),Te.map(t=>(0,q.jsxs)(`div`,{className:`space-y-1.5`,children:[(0,q.jsx)(`div`,{className:`text-xs font-medium text-muted-foreground`,children:t.label}),t.hint&&(0,q.jsx)(`p`,{className:`text-xs text-muted-foreground`,children:t.hint}),(0,q.jsx)(`div`,{className:`grid gap-1.5`,children:t.types.map(t=>(0,q.jsxs)(`label`,{className:`flex cursor-pointer items-start gap-2.5 rounded-lg border px-3 py-2 has-[:focus-visible]:ring-3 has-[:focus-visible]:ring-ring/50 has-[[data-state=checked]]:bg-muted/40`,children:[(0,q.jsx)(k,{className:`mt-0.5`,checked:e.includes(t),onCheckedChange:e=>r(t,e===!0)}),(0,q.jsxs)(`span`,{className:`min-w-0 space-y-0.5`,children:[(0,q.jsxs)(`span`,{className:`flex flex-wrap items-baseline gap-x-2 text-sm font-medium`,children:[K[t]?.label??t,(0,q.jsx)(`code`,{className:`font-mono text-xs font-normal text-muted-foreground`,children:t})]}),(0,q.jsx)(`span`,{className:`block text-xs text-muted-foreground`,children:K[t]?.description})]})]},t))})]},t.label)),n&&(0,q.jsx)(P,{children:`Pick at least one event type.`})]})}var $=e=>/\s/.test(e)?`no spaces allowed`:e.length>254?`too long`:null;function De({value:e,onChange:t,accounts:n,eventTypes:r,onPendingChange:i}){let a=r.some(B),o=r.some(e=>!B(e)),[s,c]=(0,Y.useState)({from:!1,to:!1}),l=s.from||s.to;(0,Y.useEffect)(()=>{i?.(l)},[l,i]);let u=n=>t({...e,...n}),d=e.accountIds??[],f=X(e.subject),p=(e,t)=>u({accountIds:t?[...new Set([...d,e])]:d.filter(t=>t!==e)});return(0,q.jsxs)(`div`,{className:`space-y-5`,children:[(0,q.jsxs)(F,{children:[(0,q.jsx)(N,{variant:`label`,children:`Accounts`}),(0,q.jsx)(M,{children:`Leave all unchecked for every account the agent can read. Accounts it has no read grant for are never sent.`}),(0,q.jsx)(`div`,{className:`grid gap-1.5 sm:grid-cols-2`,children:n.map(e=>(0,q.jsxs)(`label`,{className:`flex cursor-pointer items-center gap-2 rounded-lg border px-3 py-2 text-sm has-[:focus-visible]:ring-3 has-[:focus-visible]:ring-ring/50`,children:[(0,q.jsx)(k,{checked:d.includes(e.id),onCheckedChange:t=>p(e.id,t===!0)}),(0,q.jsx)(`span`,{className:`truncate`,children:e.email})]},e.id))})]}),a&&(0,q.jsxs)(F,{children:[(0,q.jsx)(N,{variant:`label`,children:`Calendars`}),(0,q.jsx)(M,{children:`Leave all unchecked for every calendar the agent can read. Applies to calendar events only.`}),(0,q.jsx)(Oe,{accountIds:d.length?d:n.map(e=>e.id),emailOf:e=>n.find(t=>t.id===e)?.email??e,value:e.calendarIds??[],onChange:e=>u({calendarIds:e})})]}),o&&(0,q.jsxs)(I,{children:[(0,q.jsx)(A,{htmlFor:`wf-labels`,children:`Labels`}),(0,q.jsx)(b,{id:`wf-labels`,accountIds:d.length?d:n.map(e=>e.id),value:e.labelIds??[],onChange:e=>u({labelIds:e}),placeholder:`Any label`}),(0,q.jsxs)(M,{children:[`Fire only for messages carrying any of these labels.`,a&&` Calendar events ignore it.`]})]}),(0,q.jsxs)(`div`,{className:`grid gap-4 sm:grid-cols-2`,children:[(0,q.jsxs)(I,{children:[(0,q.jsx)(A,{htmlFor:`wf-from`,children:a&&!o?`Organizer`:a?`From (or organizer)`:`From`}),(0,q.jsx)(R,{id:`wf-from`,value:e.from??[],onChange:e=>u({from:e}),placeholder:`Any sender`,validate:$,onPendingChange:e=>c(t=>({...t,from:e}))}),(0,q.jsxs)(M,{children:[`Globs like `,(0,q.jsx)(`code`,{className:`font-mono`,children:`*@stripe.com`})]})]}),(0,q.jsxs)(I,{children:[(0,q.jsx)(A,{htmlFor:`wf-to`,children:a&&!o?`Guest`:a?`To or Cc (or guest)`:`To or Cc`}),(0,q.jsx)(R,{id:`wf-to`,value:e.to??[],onChange:e=>u({to:e}),placeholder:`Any recipient`,validate:$,onPendingChange:e=>c(t=>({...t,to:e}))}),(0,q.jsxs)(M,{children:[`e.g. `,(0,q.jsx)(`code`,{className:`font-mono`,children:`support@yourco.com`})]})]})]}),(0,q.jsxs)(I,{"data-invalid":!!f,children:[(0,q.jsxs)(A,{htmlFor:`wf-subject`,children:[a&&!o?`Event title`:a?`Subject or event title`:`Subject`,` pattern (RE2 regular expression)`]}),(0,q.jsx)(W,{id:`wf-subject`,className:`font-mono`,placeholder:`e.g. invoice|receipt`,spellCheck:!1,value:e.subject??``,onChange:e=>u({subject:e.target.value}),"aria-invalid":!!f}),f?(0,q.jsxs)(P,{children:[`Not a valid pattern: `,f]}):(0,q.jsxs)(M,{children:[`Case-insensitive, checked against the first 256 characters of the subject`,a&&` (the title on calendar events)`,`. RE2 syntax: no lookarounds or backreferences. Leave empty for any subject.`]})]}),o&&(0,q.jsxs)(I,{children:[(0,q.jsxs)(A,{children:[`Attachments`,a&&` (mail only)`]}),(0,q.jsxs)(ae,{type:`single`,variant:`outline`,size:`sm`,value:e.hasAttachments===void 0?`any`:e.hasAttachments?`with`:`without`,onValueChange:e=>e&&u({hasAttachments:e===`any`?void 0:e===`with`}),"aria-label":`Attachments`,children:[(0,q.jsx)(z,{value:`any`,children:`Any`}),(0,q.jsx)(z,{value:`with`,children:`With attachments`}),(0,q.jsx)(z,{value:`without`,children:`Without`})]})]})]})}function Oe({accountIds:e,emailOf:t,value:n,onChange:r}){let i=m(e);if(i.some(e=>e.query.isPending))return(0,q.jsx)(w,{className:`h-10`});let a=i.filter(e=>e.query.data?.length),o=new Set(a.flatMap(e=>e.query.data.map(e=>e.id))),s=n.filter(e=>!o.has(e));return(0,q.jsxs)(`div`,{className:`space-y-3`,children:[a.length===0&&(0,q.jsx)(`p`,{className:`text-xs text-muted-foreground`,children:`None of these accounts can list its calendars yet (add Google Calendar to them on Accounts).`}),a.map(i=>(0,q.jsxs)(`div`,{className:`space-y-1.5`,children:[e.length>1&&(0,q.jsx)(`div`,{className:`truncate text-xs text-muted-foreground`,children:t(i.accountId)}),(0,q.jsx)(_,{calendars:i.query.data,value:n,onChange:r,unlisted:!1})]},i.accountId)),s.length>0&&(0,q.jsx)(_,{calendars:[],value:s,onChange:e=>r(n.filter(t=>o.has(t)||e.includes(t)))})]})}function ke({value:e,onChange:t,calendar:n}){return(0,q.jsxs)(`div`,{className:`space-y-2`,children:[(0,q.jsxs)(I,{orientation:`horizontal`,children:[(0,q.jsx)(L,{id:`wf-body`,checked:e,onCheckedChange:t}),(0,q.jsxs)(`div`,{className:`space-y-0.5`,children:[(0,q.jsxs)(A,{htmlFor:`wf-body`,children:[`Include message body`,n&&` or event description`]}),(0,q.jsxs)(M,{children:[`Adds the message as clean Markdown, plus attachment info and safety signals, so the agent can act without a fetch.`,n&&` Calendar events get the event's cleaned description instead.`]})]})]}),e&&(0,q.jsxs)(`p`,{className:`flex items-start gap-2 rounded-lg border border-warning/40 bg-warning/10 px-3 py-2 text-xs`,children:[(0,q.jsx)(O,{className:`mt-px size-3.5 shrink-0 text-warning`}),(0,q.jsxs)(`span`,{children:[`Bodies are cleaned (hidden text and invisible characters removed) but are still `,(0,q.jsx)(`strong`,{children:`untrusted input`}),`: anyone can email you`,n&&` or invite you to an event`,`. Your receiver should treat the content as data, never as instructions.`]})]})]})}var Ae=/^(localhost|127\.|10\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.|\[?::1\]?$|.*\.(local|internal|lan|home)$)/i;function je(e){if(!e.trim())return{error:`Enter the URL xaq should POST events to.`};let t;try{t=new URL(e.trim())}catch{return{error:`Enter a full URL, including https://`}}return t.protocol!==`https:`&&t.protocol!==`http:`?{error:`Only http and https URLs are supported.`}:Ae.test(t.hostname)?{note:`private`}:t.protocol===`http:`?{note:`http`}:{}}function Me({open:e,onOpenChange:t,webhook:n,defaultAgentId:r,onCreated:i}){return(0,q.jsx)(G,{open:e,onOpenChange:t,children:(0,q.jsx)(he,{className:`w-full gap-0 sm:max-w-xl`,children:e&&(0,q.jsx)(Ne,{webhook:n,defaultAgentId:r,onDone:()=>t(!1),onCreated:i})})})}function Ne({webhook:e,defaultAgentId:r,onDone:i,onCreated:m}){let h=l(a.agents()),g=l(a.accounts()),_=ve(g.data??[]),[v,y]=(0,Y.useState)(()=>e?{agentId:e.agentId,name:e.name,url:e.url,eventTypes:e.eventTypes,filter:e.filter,includeBody:e.includeBody,enabled:e.enabled}:{agentId:r??``,name:``,url:``,eventTypes:[`message.received`],filter:{},includeBody:!1,enabled:!0}),[b,x]=(0,Y.useState)(!1),S=e=>y(t=>({...t,...e})),C=v.agentId||(h.data?.length===1?h.data[0].id:``),w=fe({mutationFn:n=>e?t(`/api/webhooks/${encodeURIComponent(e.id)}`,{method:`PATCH`,body:n}):t(`/api/webhooks`,{body:n}),invalidate:[o.webhooks],success:e?`Webhook saved`:void 0,errorTitle:!1,onSuccess:e=>{i(),`secret`in e&&m?.(e)}}),E=je(v.url),D={agent:C?null:`Choose the agent this webhook delivers to.`,name:v.name.trim()?null:`Give it a name, e.g. “Support inbox → n8n”.`,url:E.error??null,events:v.eventTypes.length===0,subject:X(v.filter.subject)},[O,k]=(0,Y.useState)(!1),N=v.eventTypes.some(B),F=h.data?.find(e=>e.id===C),L=te(N?v.filter.accountIds?.length?v.filter.accountIds:(g.data??[]).map(e=>e.id):[]),R=!D.agent&&!D.name&&!D.url&&!D.events&&!D.subject&&!O;return(0,q.jsxs)(`form`,{onSubmit:e=>{if(e.preventDefault(),x(!0),!R)return;let t=we(N?v.filter:{...v.filter,calendarIds:void 0});w.mutate({...v,agentId:C,name:v.name.trim(),url:v.url.trim(),filter:t})},noValidate:!0,className:`flex min-h-0 flex-1 flex-col`,children:[(0,q.jsxs)(pe,{className:`border-b`,children:[(0,q.jsx)(ge,{children:e?`Edit ${e.name}`:`New webhook`}),(0,q.jsx)(_e,{children:`xaq POSTs a signed JSON payload to your URL for each matching event, retrying failures.`})]}),(0,q.jsx)(`div`,{className:`min-h-0 flex-1 overflow-y-auto p-4`,children:(0,q.jsxs)(ie,{children:[(0,q.jsxs)(I,{"data-invalid":b&&!!D.agent,children:[(0,q.jsx)(A,{htmlFor:`wh-agent`,children:`Agent`}),(0,q.jsxs)(ee,{value:C,onValueChange:e=>S({agentId:e}),children:[(0,q.jsx)(f,{id:`wh-agent`,className:`w-full`,"aria-invalid":b&&!!D.agent,children:(0,q.jsx)(p,{placeholder:h.data?.length===0?`Create an agent first`:`Choose an agent`})}),(0,q.jsx)(d,{children:h.data?.map(e=>(0,q.jsx)(u,{value:e.id,children:e.name},e.id))})]}),b&&D.agent?(0,q.jsx)(P,{children:D.agent}):(0,q.jsx)(M,{children:`Events are limited to what this agent's grants let it read.`})]}),(0,q.jsxs)(I,{"data-invalid":b&&!!D.name,children:[(0,q.jsx)(A,{htmlFor:`wh-name`,children:`Name`}),(0,q.jsx)(W,{id:`wh-name`,value:v.name,onChange:e=>S({name:e.target.value}),placeholder:`Support inbox → n8n`,"aria-invalid":b&&!!D.name}),b&&D.name&&(0,q.jsx)(P,{children:D.name})]}),(0,q.jsxs)(I,{"data-invalid":b&&!!D.url,children:[(0,q.jsx)(A,{htmlFor:`wh-url`,children:`Endpoint URL`}),(0,q.jsx)(W,{id:`wh-url`,type:`url`,inputMode:`url`,spellCheck:!1,className:`font-mono`,placeholder:`https://example.com/hooks/xaq`,value:v.url,onChange:e=>S({url:e.target.value}),"aria-invalid":b&&!!D.url}),b&&D.url?(0,q.jsx)(P,{children:D.url}):E.note===`private`?(0,q.jsxs)(M,{className:`flex items-start gap-1.5`,children:[(0,q.jsx)(V,{className:`mt-0.5 size-3.5 shrink-0`}),(0,q.jsxs)(`span`,{children:[`Private and loopback addresses are blocked unless they're on the`,` `,(0,q.jsx)(c,{to:`/settings`,hash:`webhook-allowlist`,className:`underline underline-offset-4`,children:`webhook allowlist`}),` `,`(protects your network from forged targets).`]})]}):E.note===`http`?(0,q.jsx)(M,{children:`Plain http sends mail metadata unencrypted. Prefer https for anything off this machine.`}):null]}),(0,q.jsx)(j,{}),(0,q.jsx)(Ee,{value:v.eventTypes,onChange:e=>S({eventTypes:e}),invalid:b&&D.events}),N&&F&&!F.grants.some(e=>e.capabilities.includes(`calendar.read`))&&(0,q.jsxs)(`p`,{className:`flex items-start gap-2 rounded-lg border border-warning/40 bg-warning/10 px-3 py-2 text-xs`,children:[(0,q.jsx)(V,{className:`mt-px size-3.5 shrink-0 text-warning`}),(0,q.jsxs)(`span`,{children:[F.name,` can't read any calendar, so calendar events never reach this webhook. Give it Calendar: read on its`,` `,(0,q.jsx)(c,{to:`/agents/$agentId`,params:{agentId:F.id},className:`underline underline-offset-4`,children:`agent page`}),`.`]})]}),(0,q.jsx)(j,{}),(0,q.jsxs)(`div`,{className:`space-y-1`,children:[(0,q.jsx)(T,{children:N?`Only when the event matches`:`Only when the message matches`}),(0,q.jsx)(`p`,{className:`text-xs text-muted-foreground`,children:`All conditions you set must match. Leave everything empty to get every event.`})]}),(0,q.jsx)(De,{value:v.filter,onChange:e=>S({filter:e}),accounts:g.data??[],eventTypes:v.eventTypes,onPendingChange:k}),(0,q.jsx)(j,{}),(0,q.jsx)(ke,{value:v.includeBody,onChange:e=>S({includeBody:e}),calendar:N}),(0,q.jsxs)(`div`,{className:`rounded-lg border bg-muted/30 p-3 text-sm`,children:[(0,q.jsxs)(`div`,{className:`mb-1 flex items-center gap-1.5 text-xs font-medium text-muted-foreground`,children:[(0,q.jsx)(re,{className:`size-3.5`}),` In plain words`]}),(0,q.jsxs)(`p`,{children:[Q(v,g.data??[],_,L).join(`, `),`.`]})]}),w.isError&&(0,q.jsx)(ne,{error:w.error,title:`Couldn't save the webhook`})]})}),(0,q.jsxs)(me,{className:`flex-row justify-end border-t`,children:[(0,q.jsx)(n,{type:`button`,variant:`ghost`,onClick:i,children:`Cancel`}),(0,q.jsxs)(n,{type:`submit`,disabled:w.isPending||b&&!R||O,children:[w.isPending&&(0,q.jsx)(s,{}),e?`Save changes`:`Create webhook`]})]})]})}export{J as i,Q as n,Ce as r,Me as t};

package/dist/web/assets/webhooks-Cfsdpoyd.js

@@ -0,0 +1 @@
+import{r as e}from"./rolldown-runtime-XKyaHtl9.js";import{N as t,Ut as n,Wt as r,bt as i,n as a,yt as o}from"./queries-Cv3nXx0U.js";import{t as s}from"./useQuery-MrTwwNy5.js";import{t as c}from"./bot-Zk76q_39.js";import{t as l}from"./chevron-right-Cqh4mDk1.js";import{t as u}from"./card-GSO5o-Ug.js";import{I as d,L as f,f as p,o as m,s as h}from"./common-BPZV8TFb.js";import{t as g}from"./plus-B_TUslu3.js";import{t as _}from"./webhook-DjeeZiNC.js";import{n as v}from"./index-DGzo3kGh.js";import{a as y,i as b,n as x,o as S,r as C,t as w}from"./empty-DzTDioBP.js";import{u as T}from"./labels-B5UqVwFo.js";import{n as E,t as D}from"./use-delivery-speed-BBh7W2q6.js";import{n as O,r as k}from"./webhook-bits-jw-y2D3u.js";import{r as A,t as j}from"./webhook-sheet-B8h0skDe.js";var M=e(r()),N=n();function P({webhook:e,agentName:t,agentDisabled:n}){return(0,N.jsxs)(o,{to:`/webhooks/$webhookId`,params:{webhookId:e.id},className:`flex items-center gap-3 p-4 outline-none hover:bg-muted/40 focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-inset`,children:[(0,N.jsxs)(`div`,{className:`min-w-0 flex-1 space-y-1.5`,children:[(0,N.jsxs)(`div`,{className:`flex flex-wrap items-center gap-2`,children:[(0,N.jsx)(`span`,{className:`truncate font-medium`,children:e.name}),(0,N.jsx)(O,{enabled:e.enabled}),t&&(0,N.jsxs)(`span`,{className:`flex items-center gap-1 text-xs text-muted-foreground`,children:[(0,N.jsx)(c,{className:`size-3.5`}),` `,t]}),n&&(0,N.jsx)(p,{tone:`idle`,children:`Agent disabled: nothing is sent`})]}),(0,N.jsx)(`div`,{className:`truncate font-mono text-xs text-muted-foreground`,children:e.url}),(0,N.jsx)(`div`,{className:`flex flex-wrap gap-1`,children:e.eventTypes.map(e=>(0,N.jsx)(f,{variant:`outline`,className:`font-normal`,children:T[e]?.label??e},e))}),(0,N.jsx)(k,{webhook:e})]}),(0,N.jsx)(l,{className:`size-4 shrink-0 text-muted-foreground`})]})}function F(){let{new:e}=v.useSearch(),n=i({from:v.fullPath}),r=s(a.webhooks()),o=s(a.agents()),[c,l]=(0,M.useState)(),f=e=>void n({search:{new:e},replace:!0}),p=o.data?.length===0,T=E(),O=(0,N.jsxs)(t,{onClick:()=>f(`1`),disabled:p,children:[(0,N.jsx)(g,{}),` New webhook`]});return(0,N.jsxs)(N.Fragment,{children:[(0,N.jsx)(m,{title:`Webhooks`,description:(0,N.jsxs)(N.Fragment,{children:[`Calls your agents when mail arrives, a thread gets a reply or labels change`,T.ready&&(0,N.jsxs)(N.Fragment,{children:[`, `,(0,N.jsx)(D,{neutral:null,it:`them`})]}),`. Payloads are signed, retried on failure and logged for replay.`]}),actions:O}),r.isPending?(0,N.jsx)(d,{className:`h-40 rounded-xl`}):r.isError?(0,N.jsx)(h,{error:r.error,onRetry:()=>void r.refetch()}):r.data.length===0?(0,N.jsx)(u,{children:(0,N.jsxs)(w,{children:[(0,N.jsxs)(b,{children:[(0,N.jsx)(y,{variant:`icon`,children:(0,N.jsx)(_,{})}),(0,N.jsx)(S,{children:`No webhooks yet`}),(0,N.jsx)(C,{children:p?`Webhooks deliver events to an agent. Create an agent first.`:`Add one to have xaq call your agent (n8n, a serverless function, your own service) when matching mail arrives.`})]}),(0,N.jsx)(x,{children:p?(0,N.jsx)(t,{onClick:()=>void n({to:`/agents`}),children:`Go to agents`}):(0,N.jsxs)(t,{onClick:()=>f(`1`),children:[(0,N.jsx)(g,{}),` Create a webhook`]})})]})}):(0,N.jsx)(u,{className:`gap-0 divide-y py-0`,children:r.data.map(e=>(0,N.jsx)(P,{webhook:e,agentName:o.data?.find(t=>t.id===e.agentId)?.name,agentDisabled:o.data?.find(t=>t.id===e.agentId)?.disabled},e.id))}),(0,N.jsx)(j,{open:!!e,onOpenChange:e=>!e&&f(void 0),defaultAgentId:e&&e!==`1`?e:void 0,onCreated:l}),(0,N.jsx)(A,{secret:c?.secret,title:`${c?.webhook.name??`Webhook`} created`,description:`Use this secret to verify that requests really come from xaq.`,onClose:()=>{let e=c?.webhook.id;l(void 0),e&&n({to:`/webhooks/$webhookId`,params:{webhookId:e}})}})]})}export{F as component};

package/dist/web/assets/x-MF2TZ9aG.js

@@ -0,0 +1 @@
+import{r as e}from"./rolldown-runtime-XKyaHtl9.js";import{Ht as t,Wt as n,_t as r}from"./queries-Cv3nXx0U.js";import{A as i,E as a,S as o,b as s,j as c,v as l}from"./useQuery-MrTwwNy5.js";import{Pt as u}from"./index-DGzo3kGh.js";var d=class extends s{#e;#t=void 0;#n;#r;constructor(e,t){super(),this.#e=e,this.setOptions(t),this.bindMethods(),this.#i()}bindMethods(){this.mutate=this.mutate.bind(this),this.reset=this.reset.bind(this)}setOptions(e){let t=this.options;this.options=this.#e.defaultMutationOptions(e),i(this.options,t)||this.#e.getMutationCache().notify({type:`observerOptionsUpdated`,mutation:this.#n,observer:this}),t?.mutationKey&&this.options.mutationKey&&o(t.mutationKey)!==o(this.options.mutationKey)?this.reset():this.#n?.state.status===`pending`&&this.#n.setOptions(this.options)}onSubscribe(){this.listeners.size===1&&this.#n&&(this.#n.addObserver(this),this.#i())}onUnsubscribe(){this.hasListeners()||this.#n?.removeObserver(this)}onMutationUpdate(e){this.#i(),this.#a(e)}getCurrentResult(){return this.#t}reset(){this.#n?.removeObserver(this),this.#n=void 0,this.#i(),this.#a()}mutate(e,t){return this.#r=t,this.#n?.removeObserver(this),this.#n=this.#e.getMutationCache().build(this.#e,this.options),this.#n.addObserver(this),this.#n.execute(e)}#i(){let e=this.#n?.state??u();this.#t={...e,isPending:e.status===`pending`,isSuccess:e.status===`success`,isError:e.status===`error`,isIdle:e.status===`idle`,mutate:this.mutate,reset:this.reset}}#a(e){l.batch(()=>{let t=this.#r;if(t&&this.hasListeners()){let n=this.#t.variables,r=this.#t.context,i={client:this.#e,meta:this.options.meta,mutationKey:this.options.mutationKey};if(e?.type===`success`){try{t.onSuccess?.(e.data,n,r,i)}catch(e){Promise.reject(e)}try{t.onSettled?.(e.data,null,n,r,i)}catch(e){Promise.reject(e)}}else if(e?.type===`error`){try{t.onError?.(e.error,n,r,i)}catch(e){Promise.reject(e)}try{t.onSettled?.(void 0,e.error,n,r,i)}catch(e){Promise.reject(e)}}}this.listeners.forEach(e=>{e(this.#t)})})}},f=e(n(),1);function p(e,n){let r=t(n),[i]=f.useState(()=>new d(r,e));f.useEffect(()=>{i.setOptions(e)},[i,e]);let o=f.useSyncExternalStore(f.useCallback(e=>i.subscribe(l.batchCalls(e)),[i]),()=>i.getCurrentResult(),()=>i.getCurrentResult()),s=f.useCallback((...e)=>{i.mutate(e[0],e[1]).catch(a)},[i]);if(o.error&&c(i.options.throwOnError,[o.error]))throw o.error;return{...o,mutate:s,mutateAsync:o.mutate}}var m={name:`x`,size:24,node:[[`path`,{d:`M18 6 6 18`,key:`1bl5f8`}],[`path`,{d:`m6 6 12 12`,key:`d8bk6v`}]]};m.node;var h=r(m);export{p as n,h as t};

package/dist/web/favicon.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32" fill="none"><rect width="32" height="32" rx="8" fill="#171717"/><rect x="7.5" y="10" width="17" height="12.5" rx="2" stroke="#fafafa" stroke-width="2"/><path d="M8.5 11.5 16 17l7.5-5.5" stroke="#fafafa" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/><circle cx="24.5" cy="9" r="3.5" fill="#3987e5" stroke="#171717" stroke-width="1.5"/></svg>

package/dist/web/index.html

@@ -0,0 +1,27 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <link rel="icon" type="image/svg+xml" href="/favicon.svg" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <meta name="color-scheme" content="light dark" />
+    <title>xaq</title>
+    <script>
+      // Apply the saved theme before first paint to avoid a light flash in dark mode.
+      try {
+        var t = localStorage.getItem("xaq.theme") || localStorage.getItem("agentinbox.theme") || "system";
+        if (t === "dark" || (t === "system" && matchMedia("(prefers-color-scheme: dark)").matches))
+          document.documentElement.classList.add("dark");
+      } catch (e) {}
+    </script>
+    <script type="module" crossorigin src="/assets/index-DGzo3kGh.js"></script>
+    <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-XKyaHtl9.js">
+    <link rel="modulepreload" crossorigin href="/assets/queries-Cv3nXx0U.js">
+    <link rel="modulepreload" crossorigin href="/assets/useQuery-MrTwwNy5.js">
+    <link rel="modulepreload" crossorigin href="/assets/preload-helper-Cc_aKyUb.js">
+    <link rel="stylesheet" crossorigin href="/assets/index-zKOCQLGX.css">
+  </head>
+  <body>
+    <div id="root"></div>
+  </body>
+</html>

package/package.json

@@ -1 +1,98 @@
-{"name":"xaq-cli","version":"0.0.0","description":"placeholder, first release soon","license":"MIT","repository":"github:wynn-dev/xaq"}
+{
+  "name": "xaq-cli",
+  "version": "0.1.0-nightly.72",
+  "description": "Self-hosted Gmail broker for AI agents (formerly agentinbox): one place for credentials, MCP tools, real-time webhooks, guardrails, and a web console.",
+  "license": "MIT",
+  "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/wynn-dev/xaq.git"
+  },
+  "homepage": "https://github.com/wynn-dev/xaq#readme",
+  "keywords": [
+    "mcp",
+    "gmail",
+    "agents",
+    "webhooks",
+    "email",
+    "self-hosted",
+    "ai"
+  ],
+  "bin": {
+    "xaq": "dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=22.13"
+  },
+  "scripts": {
+    "dev": "concurrently -k -n server,web -c blue,magenta \"pnpm dev:server\" \"pnpm dev:web\"",
+    "dev:server": "tsx watch server/cli.ts start --dev",
+    "dev:web": "vite",
+    "build": "vite build && tsdown --config-loader native",
+    "start": "node dist/cli.js",
+    "typecheck": "tsc -p tsconfig.server.json --noEmit && tsc -p tsconfig.app.json --noEmit",
+    "lint": "oxlint",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "prepublishOnly": "node -e \"const m=['dist/cli.js','dist/web/index.html'].filter(f=>!require('fs').existsSync(f));if(m.length){console.error('Missing '+m.join(', ')+': run pnpm build before publishing.');process.exit(1)}\""
+  },
+  "dependencies": {
+    "@hono/node-server": "^2.1.5",
+    "@modelcontextprotocol/client": "2.3.1",
+    "@modelcontextprotocol/sdk": "1.32.1",
+    "ajv": "^8.20.0",
+    "commander": "^15.0.0",
+    "hono": "^4.13.13",
+    "linkedom": "^0.18.13",
+    "nodemailer": "^10.1.1",
+    "open": "^11.0.4",
+    "picocolors": "^1.1.1",
+    "re2js": "^2.8.6",
+    "turndown": "^7.2.4",
+    "turndown-plugin-gfm": "^1.0.2",
+    "undici": "^7.30.1",
+    "zod": "^4.6.7"
+  },
+  "devDependencies": {
+    "@fontsource-variable/geist": "^5.3.0",
+    "@fontsource-variable/geist-mono": "^5.3.0",
+    "@tailwindcss/vite": "^4.3.3",
+    "@tanstack/react-form": "^1.33.5",
+    "@tanstack/react-query": "^5.104.2",
+    "@tanstack/react-router": "^1.170.44",
+    "@tanstack/react-table": "^9.3.1",
+    "@tanstack/router-plugin": "^1.168.45",
+    "@types/node": "^26.6.5",
+    "@types/nodemailer": "^8.0.2",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "^19.3.0",
+    "@types/turndown": "^5.0.6",
+    "@vitejs/plugin-react": "^6.1.2",
+    "class-variance-authority": "^0.7.1",
+    "clsx": "^2.1.1",
+    "cmdk": "^1.1.1",
+    "concurrently": "^10.0.6",
+    "date-fns": "^4.4.0",
+    "lucide-react": "^1.57.0",
+    "oxlint": "^1.88.0",
+    "radix-ui": "^1.8.1",
+    "react": "^19.3.0",
+    "react-dom": "^19.3.0",
+    "recharts": "^3.10.1",
+    "sonner": "^2.0.8",
+    "tailwind-merge": "^3.7.0",
+    "tailwindcss": "^4.3.3",
+    "tsdown": "^0.23.1",
+    "tsx": "^4.23.15",
+    "tw-animate-css": "^1.4.0",
+    "typescript": "^7.0.2",
+    "vite": "^8.3.4",
+    "vitest": "^5.0.4"
+  },
+  "packageManager": "pnpm@12.11.2"
+}