import {  createSdkMcpConnector,  discoverMcpToolsFromConnector,  type McpDiscoveryElicitationContext,} from "@executor/codemode-mcp";import {  AccountId,  type CredentialSlot,  ExecutionIdSchema,  McpSourceAuthSessionDataJsonSchema,  type McpSourceAuthSessionData,  OAuth2PkceSourceAuthSessionDataJsonSchema,  type OAuth2PkceSourceAuthSessionData,  type ProviderAuthGrant,  ProviderAuthGrantIdSchema,  ProviderOauthBatchSourceAuthSessionDataJsonSchema,  type ProviderOauthBatchSourceAuthSessionData,  type SecretMaterialPurpose,  Source,  type SourceImportAuthPolicy,  type SourceTransport,  SourceAuthSession,  SourceAuthSessionIdSchema,  SourceIdSchema,  type SourceOauthClientInput,  SourceSchema,  type SecretRef,  type StringMap,  WorkspaceOauthClientIdSchema,  WorkspaceSourceOauthClientIdSchema,  WorkspaceSourceOauthClientMetadataJsonSchema,  type WorkspaceOauthClient,  type WorkspaceSourceOauthClientRedirectMode,  type WorkspaceId,} from "#schema";import * as Context from "effect/Context";import * as Either from "effect/Either";import * as Effect from "effect/Effect";import * as Layer from "effect/Layer";import * as Option from "effect/Option";import * as ParseResult from "effect/ParseResult";import * as Schema from "effect/Schema"; import {  LiveExecutionManagerService,  sanitizePersistedElicitationResponse,  type LiveExecutionManager,} from "./live-execution";import {  getRuntimeLocalWorkspaceOption,  provideOptionalRuntimeLocalWorkspace,  type RuntimeLocalWorkspaceState,} from "./local-runtime-context";import {  exchangeMcpOAuthAuthorizationCode,  startMcpOAuthAuthorization,} from "./mcp-oauth";import { createPersistedMcpOAuthSourceAuth } from "./mcp-auth-provider";import {  createSourceFromPayload,  updateSourceFromPayload,} from "./source-definitions";import {  getSourceAdapter,  getSourceAdapterForSource,  hasSourceAdapterFamily,  sourceBindingStateFromSource,} from "./source-adapters";import type { SourceAdapterOauth2SetupConfig } from "./source-adapters/types";import { isSourceCredentialRequiredError } from "./source-adapters/shared";import {  createDefaultSecretMaterialDeleter,  type ResolveSecretMaterial,  SecretMaterialResolverService,  SecretMaterialStorerService,  type StoreSecretMaterial,} from "./secret-material-providers";import {  removeAuthLeaseAndSecrets,  upsertOauth2AuthorizedUserLeaseFromTokenResponse,} from "./auth-leases";import {  listProviderGrantRefArtifacts,  removeProviderAuthGrantSecret,} from "./provider-grant-lifecycle";import {  RuntimeSourceCatalogSyncService,  type RuntimeSourceCatalogSyncShape,} from "./source-catalog-sync";import {  buildOAuth2AuthorizationUrl,  createPkceCodeVerifier,  exchangeOAuth2AuthorizationCode,} from "./oauth2-pkce";import { startOauthLoopbackRedirectServer } from "./oauth-loopback";import {  loadSourceById,  loadSourcesInWorkspace,  persistSource,  type RuntimeSourceStore,  RuntimeSourceStoreService,} from "./source-store";import type { WorkspaceStorageServices } from "./local-storage";import { ControlPlaneStore, type ControlPlaneStoreShape } from "./store"; const trimOrNull = (value: string | null | undefined): string | null => {  if (value === null || value === undefined) {    return null;  }   const trimmed = value.trim();  return trimmed.length > 0 ? trimmed : null;}; const defaultSourceNameFromEndpoint = (endpoint: string): string => {  const url = new URL(endpoint);  return url.hostname;}; const defaultNamespaceFromName = (name: string): string => {  const normalized = name    .trim()    .toLowerCase()    .replace(/[^a-z0-9]+/g, ".")    .replace(/^\.+|\.+$/g, "");   return normalized.length > 0 ? normalized : "source";}; const resolveSourceCredentialOauthCompleteUrl = (input: {  baseUrl: string;  workspaceId: WorkspaceId;  sourceId: Source["id"];}): string =>  new URL(    `/v1/workspaces/${encodeURIComponent(input.workspaceId)}/sources/${encodeURIComponent(input.sourceId)}/credentials/oauth/complete`,    input.baseUrl,  ).toString(); const resolveSourceOAuthCallbackUrl = (input: {  baseUrl: string;}): string =>  new URL(    "/v1/oauth/source-auth/callback",    input.baseUrl,  ).toString(); const resolveWorkspaceProviderOauthCompleteUrl = (input: {  baseUrl: string;  workspaceId: WorkspaceId;}): string =>  new URL(    `/v1/workspaces/${encodeURIComponent(input.workspaceId)}/oauth/provider/callback`,    input.baseUrl,  ).toString(); const normalizeEndpoint = (endpoint: string): string => {  const url = new URL(endpoint.trim());  return url.toString();}; const defaultGoogleDiscoveryUrl = (service: string, version: string): string =>  `https://www.googleapis.com/discovery/v1/apis/${encodeURIComponent(service)}/${encodeURIComponent(version)}/rest`; const defaultGoogleDiscoverySourceName = (service: string, version: string): string => {  const titleService = service    .split(/[^a-zA-Z0-9]+/)    .filter(Boolean)    .map((segment) => segment[0]?.toUpperCase() + segment.slice(1))    .join(" ");   return `Google ${titleService || service} ${version}`;}; const defaultGoogleDiscoveryNamespace = (service: string): string =>  `google.${service.trim().toLowerCase().replace(/[^a-z0-9]+/g, ".").replace(/^\.+|\.+$/g, "")}`; const SourceOAuthSessionStatePayloadSchema = Schema.Struct({  kind: Schema.Literal("source_oauth"),  nonce: Schema.String,  displayName: Schema.NullOr(Schema.String),}); const encodeSourceOAuthSessionStatePayload = Schema.encodeSync(  Schema.parseJson(SourceOAuthSessionStatePayloadSchema),); const decodeSourceOAuthSessionStatePayloadOption = Schema.decodeUnknownOption(  Schema.parseJson(SourceOAuthSessionStatePayloadSchema),); const createSourceOAuthSessionState = (input: {  displayName?: string | null;}): string =>  encodeSourceOAuthSessionStatePayload({    kind: "source_oauth",    nonce: crypto.randomUUID(),    displayName: trimOrNull(input.displayName),  }); const readSourceOAuthSessionDisplayName = (state: string): string | null => {  const decoded = decodeSourceOAuthSessionStatePayloadOption(state);  return Option.isSome(decoded) ? trimOrNull(decoded.value.displayName) : null;}; const resolveSourceOAuthSecretName = (input: {  displayName?: string | null;  endpoint: string;}): string => {  const sourceName = trimOrNull(input.displayName) ?? defaultSourceNameFromEndpoint(input.endpoint);  return /\boauth\b/i.test(sourceName) ? sourceName : `${sourceName} OAuth`;}; const probeMcpSourceWithoutAuth = (  source: Source,  mcpDiscoveryElicitation?: McpDiscoveryElicitationContext,) =>  Effect.gen(function* () {    if (source.kind !== "mcp") {      return yield* Effect.fail(new Error(`Expected MCP source, received ${source.kind}`));    }    const bindingState = yield* sourceBindingStateFromSource(source);     const connector = yield* Effect.try({      try: () =>        createSdkMcpConnector({          endpoint: source.endpoint,          transport: bindingState.transport ?? undefined,          queryParams: bindingState.queryParams ?? undefined,          headers: bindingState.headers ?? undefined,        }),      catch: (cause) =>        cause instanceof Error ? cause : new Error(String(cause)),    });     return yield* discoverMcpToolsFromConnector({      connect: connector,      namespace: source.namespace ?? defaultNamespaceFromName(source.name),      sourceKey: source.id,      mcpDiscoveryElicitation,    });  }); export const createTerminalSourceAuthSessionPatch = (input: {  sessionDataJson: string;  status: Extract<SourceAuthSession["status"], "completed" | "failed" | "cancelled">;  now: number;  errorText: string | null;}) => ({  status: input.status,  errorText: input.errorText,  completedAt: input.now,  updatedAt: input.now,  sessionDataJson: input.sessionDataJson,}) satisfies Partial<SourceAuthSession>; const encodeMcpSourceAuthSessionData = (  sessionData: McpSourceAuthSessionData,): string => Schema.encodeSync(McpSourceAuthSessionDataJsonSchema)(sessionData); const decodeMcpSourceAuthSessionDataJson = Schema.decodeUnknownEither(  McpSourceAuthSessionDataJsonSchema,); const decodeMcpSourceAuthSessionData = (  session: Pick<SourceAuthSession, "id" | "providerKind" | "sessionDataJson">,): McpSourceAuthSessionData => {  if (session.providerKind !== "mcp_oauth") {    throw new Error(`Unsupported source auth provider for session ${session.id}`);  }   const decoded = decodeMcpSourceAuthSessionDataJson(session.sessionDataJson);  if (Either.isLeft(decoded)) {    throw new Error(      `Invalid source auth session data for ${session.id}: ${ParseResult.TreeFormatter.formatErrorSync(decoded.left)}`,    );  }   return decoded.right;}; const mergeMcpSourceAuthSessionData = (input: {  session: Pick<SourceAuthSession, "id" | "providerKind" | "sessionDataJson">;  patch: Partial<McpSourceAuthSessionData>;}): string => {  const existing = decodeMcpSourceAuthSessionData(input.session);  return encodeMcpSourceAuthSessionData({    ...existing,    ...input.patch,  });}; const encodeOauth2PkceSourceAuthSessionData = (  sessionData: OAuth2PkceSourceAuthSessionData,): string => Schema.encodeSync(OAuth2PkceSourceAuthSessionDataJsonSchema)(sessionData); const decodeOauth2PkceSourceAuthSessionDataJson = Schema.decodeUnknownEither(  OAuth2PkceSourceAuthSessionDataJsonSchema,); const decodeOauth2PkceSourceAuthSessionData = (  session: Pick<SourceAuthSession, "id" | "providerKind" | "sessionDataJson">,): OAuth2PkceSourceAuthSessionData => {  if (session.providerKind !== "oauth2_pkce") {    throw new Error(`Unsupported source auth provider for session ${session.id}`);  }   const decoded = decodeOauth2PkceSourceAuthSessionDataJson(session.sessionDataJson);  if (Either.isLeft(decoded)) {    throw new Error(      `Invalid source auth session data for ${session.id}: ${ParseResult.TreeFormatter.formatErrorSync(decoded.left)}`,    );  }   return decoded.right;}; const mergeOauth2PkceSourceAuthSessionData = (input: {  session: Pick<SourceAuthSession, "id" | "providerKind" | "sessionDataJson">;  patch: Partial<OAuth2PkceSourceAuthSessionData>;}): string => {  const existing = decodeOauth2PkceSourceAuthSessionData(input.session);  return encodeOauth2PkceSourceAuthSessionData({    ...existing,    ...input.patch,  });}; const encodeProviderOauthBatchSourceAuthSessionData = (  sessionData: ProviderOauthBatchSourceAuthSessionData,): string => Schema.encodeSync(ProviderOauthBatchSourceAuthSessionDataJsonSchema)(sessionData); const decodeProviderOauthBatchSourceAuthSessionDataJson = Schema.decodeUnknownEither(  ProviderOauthBatchSourceAuthSessionDataJsonSchema,); const decodeProviderOauthBatchSourceAuthSessionData = (  session: Pick<SourceAuthSession, "id" | "providerKind" | "sessionDataJson">,): ProviderOauthBatchSourceAuthSessionData => {  if (session.providerKind !== "oauth2_provider_batch") {    throw new Error(`Unsupported source auth provider for session ${session.id}`);  }   const decoded = decodeProviderOauthBatchSourceAuthSessionDataJson(session.sessionDataJson);  if (Either.isLeft(decoded)) {    throw new Error(      `Invalid source auth session data for ${session.id}: ${ParseResult.TreeFormatter.formatErrorSync(decoded.left)}`,    );  }   return decoded.right;}; const mergeProviderOauthBatchSourceAuthSessionData = (input: {  session: Pick<SourceAuthSession, "id" | "providerKind" | "sessionDataJson">;  patch: Partial<ProviderOauthBatchSourceAuthSessionData>;}): string => {  const existing = decodeProviderOauthBatchSourceAuthSessionData(input.session);  return encodeProviderOauthBatchSourceAuthSessionData({    ...existing,    ...input.patch,  });};  const completeLiveInteraction = (input: {  rows: ControlPlaneStoreShape;  liveExecutionManager: LiveExecutionManager;  session: SourceAuthSession;  response: {    action: "accept" | "cancel";    reason?: string;  };}) =>  Effect.gen(function* () {    if (input.session.executionId === null) {      return;    }     const response =      input.response.action === "accept"        ? { action: "accept" as const }        : {            action: "cancel" as const,            ...(input.response.reason              ? {                  content: {                    reason: input.response.reason,                  },                }              : {}),          };     const resumed = yield* input.liveExecutionManager.resolveInteraction({      executionId: input.session.executionId,      response,    });     if (!resumed) {      const pendingInteraction = yield* input.rows.executionInteractions        .getPendingByExecutionId(input.session.executionId);       if (Option.isSome(pendingInteraction)) {        yield* input.rows.executionInteractions.update(pendingInteraction.value.id, {          status: response.action === "cancel" ? "cancelled" : "resolved",          responseJson: serializeJson(            sanitizePersistedElicitationResponse(response),          ),          responsePrivateJson: serializeJson(response),          updatedAt: Date.now(),        });      }    }  }); const serializeJson = (value: unknown): string | null => {  if (value === undefined) {    return null;  }   return JSON.stringify(value);}; const updateSourceStatus = Effect.fn("source.status.update")((sourceStore: RuntimeSourceStore, source: Source, input: {  actorAccountId?: AccountId | null;  status: Source["status"];  lastError?: string | null;  auth?: Source["auth"];  importAuth?: Source["importAuth"];}) =>  Effect.gen(function* () {    const latest = yield* sourceStore.loadSourceById({      workspaceId: source.workspaceId,      sourceId: source.id,      actorAccountId: input.actorAccountId,    });     return yield* sourceStore.persistSource({      ...latest,      status: input.status,      lastError: input.lastError ?? null,      auth: input.auth ?? latest.auth,      importAuth: input.importAuth ?? latest.importAuth,      updatedAt: Date.now(),    }, {      actorAccountId: input.actorAccountId,    });  }).pipe(    Effect.withSpan("source.status.update", {      attributes: {        "executor.source.id": source.id,        "executor.source.status": input.status,      },    }),  )); export type ExecutorSourceAddResult =  | {      kind: "connected";      source: Source;    }  | {      kind: "credential_required";      source: Source;      credentialSlot: CredentialSlot;    }  | {      kind: "oauth_required";      source: Source;      sessionId: SourceAuthSession["id"];      authorizationUrl: string;    }; export type ExecutorHttpSourceAuthInput =  | {      kind: "none";    }  | {      kind: "bearer";      headerName?: string | null;      prefix?: string | null;      token?: string | null;      tokenRef?: SecretRef | null;    }  | {      kind: "oauth2";      headerName?: string | null;      prefix?: string | null;      accessToken?: string | null;      accessTokenRef?: SecretRef | null;      refreshToken?: string | null;      refreshTokenRef?: SecretRef | null;    }; export type ExecutorAddSourceInput =  | {      kind?: "mcp";      workspaceId: WorkspaceId;      actorAccountId?: AccountId | null;      executionId: SourceAuthSession["executionId"];

Lines 1–500 of 3561. Load more