diff --git a/apps/docs/components/icons.tsx b/apps/docs/components/icons.tsx index 00f47d3ac9c..867a81af5c2 100644 --- a/apps/docs/components/icons.tsx +++ b/apps/docs/components/icons.tsx @@ -6864,6 +6864,32 @@ export function SecretsManagerIcon(props: SVGProps) { ) } +export function SSMIcon(props: SVGProps) { + return ( + + + + + + ) +} + export function SQSIcon(props: SVGProps) { return ( ) { ) } +export function CloudTrailIcon(props: SVGProps) { + return ( + + + + + + ) +} + export function CloudWatchIcon(props: SVGProps) { return ( = { clickup: ClickUpIcon, cloudflare: CloudflareIcon, cloudformation: CloudFormationIcon, + cloudtrail: CloudTrailIcon, cloudwatch: CloudWatchIcon, codepipeline: CodePipelineIcon, confluence: ConfluenceIcon, @@ -548,6 +551,7 @@ export const blockTypeToIconMap: Record = { sqs: SQSIcon, square: SquareIcon, ssh: SshIcon, + ssm: SSMIcon, stagehand: StagehandIcon, stripe: StripeIcon, sts: STSIcon, diff --git a/apps/docs/content/docs/integrations/cloudtrail.mdx b/apps/docs/content/docs/integrations/cloudtrail.mdx new file mode 100644 index 00000000000..bffd59d6b61 --- /dev/null +++ b/apps/docs/content/docs/integrations/cloudtrail.mdx @@ -0,0 +1,480 @@ +--- +title: CloudTrail +description: Audit who did what in AWS with CloudTrail event history and Lake queries +--- + +import { BlockInfoCard } from "@/components/ui/block-info-card" + + + +{/* MANUAL-CONTENT-START:intro */} +[AWS CloudTrail](https://aws.amazon.com/cloudtrail/) records who did what in your AWS accounts. An API call — from the console, the CLI, an SDK, or another AWS service — is captured as an event with the calling identity, source IP, parameters, and result. It is the system of record for security investigation, compliance evidence, and answering "what changed?" + +What lands in that record is set by configuration, not assumed. Trails and event data stores log management events by default; data events, network activity events, and Insights events are captured only where you configure selectors for them. Read a trail's selectors before you treat its history as complete. + +With AWS CloudTrail, you can: + +- **Look up recent activity**: Search the last 90 days of management events by user, event name, resource, or event source +- **Inspect trail configuration**: Describe trails, check logging status, and read the event and Insights selectors that decide what gets captured +- **Query history with SQL**: Run CloudTrail Lake queries across event data stores for analysis that reaches further back than event lookup +- **Confirm coverage**: Verify that logging is actually enabled and that multi-region and organization trails are delivering + +In Sim, CloudTrail is the audit half of the AWS story. Where IAM and Identity Center answer *who has access*, CloudTrail answers *what they actually did with it* — so an agent can take a suspicious permission change and trace it back to the principal, the source IP, and the moment it happened, then hand a written timeline to whoever needs to act on it. + +This block is read-only with one narrow exception: `Cancel Query` stops a running CloudTrail Lake query. It never enables or disables logging, alters trail configuration, or deletes a trail. Every operation it ships is covered by this policy, with no residual write risk: + +```json +{ + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "cloudtrail:DescribeTrails", + "cloudtrail:GetTrail", + "cloudtrail:GetTrailStatus", + "cloudtrail:GetEventSelectors", + "cloudtrail:GetInsightSelectors", + "cloudtrail:GetEventDataStore", + "cloudtrail:ListTrails", + "cloudtrail:ListEventDataStores", + "cloudtrail:ListTags", + "cloudtrail:LookupEvents", + "cloudtrail:StartQuery", + "cloudtrail:DescribeQuery", + "cloudtrail:GetQueryResults", + "cloudtrail:CancelQuery" + ], + "Resource": "*" + } + ] +} +``` + +`cloudtrail:CancelQuery` is the action `Cancel Query` needs, and it is not implied by `Describe*`, `Get*`, or `List*` — omit it and that one operation fails with an access-denied error. Note that `Start Query` is billed per GB scanned and consumes your account's concurrent-query quota of 10. + +`Lookup Events` is limited by AWS to two requests per second per account per Region. Each call uses AWS adaptive retry mode and allows up to six attempts, so a throttled request backs off exponentially with jitter and usually succeeds instead of surfacing an error. That is a retry budget, not a guarantee: sustained throttling past six attempts fails the call with a `ThrottlingException`, and because a fresh SDK client is built per invocation, adaptive mode's client-side rate limiter carries no pacing state between calls. `Lookup Events` also returns one page per call — feed `nextToken` back in to walk a broad search, and expect to handle a throttling error on a long paging loop. +{/* MANUAL-CONTENT-END */} + + +## Usage Instructions + +Integrate AWS CloudTrail into workflows. Look up the last 90 days of management and Insights events by user, event name, resource, or access key; inspect trail configuration, logging status, and event selectors; and run SQL queries against CloudTrail Lake event data stores. This block never changes trail or event data store configuration, and never starts or stops logging. Starting and cancelling a Lake query are the only actions that are not reads, and AWS bills Lake queries on the data they scan. Requires AWS access key and secret access key. + + + +## Actions + +### CloudTrail Look Up Events + +Look up AWS CloudTrail management or Insights events from the last 90 days in a Region + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `awsRegion` | string | Yes | AWS region \(e.g., us-east-1\) | +| `awsAccessKeyId` | string | Yes | AWS access key ID | +| `awsSecretAccessKey` | string | Yes | AWS secret access key | +| `attributeKey` | string | No | Lookup attribute to filter on: AccessKeyId, EventId, EventName, EventSource, ReadOnly, ResourceName, ResourceType, or Username. Must be paired with attributeValue | +| `attributeValue` | string | No | Value the lookup attribute must equal. Must be paired with attributeKey | +| `startTime` | string | No | Only return events at or after this ISO 8601 timestamp | +| `endTime` | string | No | Only return events at or before this ISO 8601 timestamp | +| `eventCategory` | string | No | Set to the value insight to return CloudTrail Insights events instead of management events | +| `maxResults` | number | No | Number of events to return, 1 to 50 \(default 50\) | +| `nextToken` | string | No | Pagination token from a previous lookup, which must repeat the same filters | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `events` | array | Matching events, most recent first | +| ↳ `eventId` | string | CloudTrail event ID | +| ↳ `eventName` | string | API action that was called | +| ↳ `readOnly` | string | Whether the action was read-only, as the string 'true' or 'false' | +| ↳ `accessKeyId` | string | Access key ID used to make the call, when applicable | +| ↳ `eventTime` | string | When the event occurred \(ISO 8601\) | +| ↳ `eventSource` | string | AWS service endpoint that recorded the event | +| ↳ `username` | string | Name of the principal that made the call | +| ↳ `resources` | array | Resources referenced by the event, as resourceType and resourceName | +| ↳ `cloudTrailEvent` | object | Full CloudTrail event record parsed from JSON, including userIdentity, sourceIPAddress, userAgent, requestParameters, responseElements, and errorCode | +| ↳ `cloudTrailEventRaw` | string | Raw CloudTrail event JSON string, populated only when it could not be parsed | +| `nextToken` | string | Pagination token for the next page of events | + +### CloudTrail Describe Trails + +Retrieve the full configuration of one or more CloudTrail trails in the current Region + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `awsRegion` | string | Yes | AWS region \(e.g., us-east-1\) | +| `awsAccessKeyId` | string | Yes | AWS access key ID | +| `awsSecretAccessKey` | string | Yes | AWS secret access key | +| `trailNameList` | string | No | Comma-separated trail names or ARNs. Leave empty to describe every trail in the Region. Trails in another Region must be given as ARNs | +| `includeShadowTrails` | boolean | No | Include shadow trails \(replications of trails created in another Region, and organization trails in member accounts\). Defaults to true | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `trails` | array | Full configuration of each matching trail | +| ↳ `name` | string | Trail name | +| ↳ `s3BucketName` | string | S3 bucket that receives log files | +| ↳ `s3KeyPrefix` | string | S3 key prefix for delivered log files | +| ↳ `snsTopicName` | string | SNS topic notified on log delivery | +| ↳ `snsTopicArn` | string | ARN of that SNS topic | +| ↳ `includeGlobalServiceEvents` | boolean | Whether global service events are recorded | +| ↳ `isMultiRegionTrail` | boolean | Whether the trail records events in all Regions | +| ↳ `homeRegion` | string | Region in which the trail was created | +| ↳ `trailArn` | string | ARN of the trail | +| ↳ `logFileValidationEnabled` | boolean | Whether log file integrity validation is enabled | +| ↳ `cloudWatchLogsLogGroupArn` | string | CloudWatch Logs log group receiving events | +| ↳ `cloudWatchLogsRoleArn` | string | Role CloudTrail assumes to write to CloudWatch Logs | +| ↳ `kmsKeyId` | string | KMS key used to encrypt log files | +| ↳ `hasCustomEventSelectors` | boolean | Whether the trail has custom event selectors | +| ↳ `hasInsightSelectors` | boolean | Whether the trail has Insights event selectors | +| ↳ `isOrganizationTrail` | boolean | Whether the trail is an organization trail | + +### CloudTrail Get Trail + +Retrieve the settings of a single CloudTrail trail by name or ARN + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `awsRegion` | string | Yes | AWS region \(e.g., us-east-1\) | +| `awsAccessKeyId` | string | Yes | AWS access key ID | +| `awsSecretAccessKey` | string | Yes | AWS secret access key | +| `name` | string | Yes | Trail name, or the trail ARN for a trail in another Region | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `name` | string | Trail name | +| `s3BucketName` | string | Name of the S3 bucket that receives log files | +| `s3KeyPrefix` | string | S3 key prefix prepended to delivered log files | +| `snsTopicName` | string | Name of the SNS topic notified on log delivery | +| `snsTopicArn` | string | ARN of the SNS topic notified on log delivery | +| `includeGlobalServiceEvents` | boolean | Whether the trail records global service events | +| `isMultiRegionTrail` | boolean | Whether the trail records events in all Regions | +| `homeRegion` | string | Region in which the trail was created | +| `trailArn` | string | ARN of the trail | +| `logFileValidationEnabled` | boolean | Whether log file integrity validation is enabled | +| `cloudWatchLogsLogGroupArn` | string | ARN of the CloudWatch Logs log group receiving events | +| `cloudWatchLogsRoleArn` | string | ARN of the role CloudTrail assumes to write to CloudWatch Logs | +| `kmsKeyId` | string | KMS key used to encrypt log files | +| `hasCustomEventSelectors` | boolean | Whether the trail has custom event selectors | +| `hasInsightSelectors` | boolean | Whether the trail has Insights event selectors | +| `isOrganizationTrail` | boolean | Whether the trail is an organization trail | + +### CloudTrail Get Trail Status + +Check whether a CloudTrail trail is logging and surface its most recent delivery errors + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `awsRegion` | string | Yes | AWS region \(e.g., us-east-1\) | +| `awsAccessKeyId` | string | Yes | AWS access key ID | +| `awsSecretAccessKey` | string | Yes | AWS secret access key | +| `name` | string | Yes | Trail name, or the trail ARN. An organization trail read from a member account must be given as an ARN | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `isLogging` | boolean | Whether the trail is currently recording API calls | +| `latestDeliveryError` | string | Most recent S3 error encountered delivering log files | +| `latestDeliveryTime` | string | When log files were last delivered to S3 \(ISO 8601\) | +| `latestNotificationError` | string | Most recent SNS error encountered sending a notification | +| `latestNotificationTime` | string | When the last SNS notification was sent \(ISO 8601\) | +| `latestCloudWatchLogsDeliveryError` | string | Most recent CloudWatch Logs delivery error | +| `latestCloudWatchLogsDeliveryTime` | string | When events were last delivered to CloudWatch Logs \(ISO 8601\) | +| `latestDigestDeliveryError` | string | Most recent S3 error encountered delivering a digest file | +| `latestDigestDeliveryTime` | string | When a digest file was last delivered to S3 \(ISO 8601\) | +| `startLoggingTime` | string | When logging was most recently started \(ISO 8601\) | +| `stopLoggingTime` | string | When logging was most recently stopped \(ISO 8601\) | + +### CloudTrail List Trails + +List the ARN, name, and home Region of every CloudTrail trail visible to the account + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `awsRegion` | string | Yes | AWS region \(e.g., us-east-1\) | +| `awsAccessKeyId` | string | Yes | AWS access key ID | +| `awsSecretAccessKey` | string | Yes | AWS secret access key | +| `nextToken` | string | No | Pagination token from a previous list request | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `trails` | array | Trail summaries | +| ↳ `trailArn` | string | ARN of the trail | +| ↳ `name` | string | Trail name | +| ↳ `homeRegion` | string | Region in which the trail was created | +| `nextToken` | string | Pagination token for the next page of trails, or null on the last page | + +### CloudTrail Get Event Selectors + +Read which management, data, and network activity events a CloudTrail trail is configured to log + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `awsRegion` | string | Yes | AWS region \(e.g., us-east-1\) | +| `awsAccessKeyId` | string | Yes | AWS access key ID | +| `awsSecretAccessKey` | string | Yes | AWS secret access key | +| `trailName` | string | Yes | Trail name or trail ARN | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `trailArn` | string | ARN of the trail that owns these selectors | +| `eventSelectors` | array | Basic event selectors configured on the trail | +| ↳ `readWriteType` | string | All, ReadOnly, or WriteOnly | +| ↳ `includeManagementEvents` | boolean | Whether management events are recorded | +| ↳ `dataResources` | array | Data resources logged by the selector, as type and values | +| ↳ `excludeManagementEventSources` | array | Event sources excluded from management event logging | +| `advancedEventSelectors` | array | Advanced event selectors configured on the trail | +| ↳ `name` | string | Name of the advanced event selector | +| ↳ `fieldSelectors` | array | Field selectors, each with field plus its equals, startsWith, endsWith, notEquals, notStartsWith, and notEndsWith values | + +### CloudTrail Get Insight Selectors + +Read which CloudTrail Insights types are enabled on a trail or event data store + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `awsRegion` | string | Yes | AWS region \(e.g., us-east-1\) | +| `awsAccessKeyId` | string | Yes | AWS access key ID | +| `awsSecretAccessKey` | string | Yes | AWS secret access key | +| `trailName` | string | No | Trail name or trail ARN. Cannot be combined with eventDataStore | +| `eventDataStore` | string | No | Event data store ARN, or the ID suffix of that ARN. Cannot be combined with trailName | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `trailArn` | string | ARN of the trail whose Insights selectors were read | +| `eventDataStoreArn` | string | ARN of the source event data store that enabled Insights events | +| `insightsDestination` | string | ARN of the destination event data store that logs Insights events | +| `insightSelectors` | array | Enabled Insights types and their event categories | +| ↳ `insightType` | string | ApiCallRateInsight or ApiErrorRateInsight | +| ↳ `eventCategories` | array | Event categories the Insights type applies to: Management, Data, or both | + +### CloudTrail Start Query + +Start a CloudTrail Lake SQL query over an event data store + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `awsRegion` | string | Yes | AWS region \(e.g., us-east-1\) | +| `awsAccessKeyId` | string | Yes | AWS access key ID | +| `awsSecretAccessKey` | string | Yes | AWS secret access key | +| `queryStatement` | string | No | SQL query to run, up to 10,000 characters. The event data store ID is named in the FROM clause. Supply this or queryAlias, not both | +| `queryAlias` | string | No | Alias of a query template used by CloudTrail Lake dashboards. Supply this or queryStatement, not both | +| `queryParameters` | string | No | Comma-separated parameter values for the query alias, up to 10 values | +| `deliveryS3Uri` | string | No | S3 URI where CloudTrail delivers the query results \(e.g., s3://my-bucket/results\) | +| `eventDataStoreOwnerAccountId` | string | No | Account ID of the event data store owner, for a shared event data store | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `queryId` | string | ID of the started query. Pass it to Describe Query to poll status, or to Get Query Results to page through rows | +| `eventDataStoreOwnerAccountId` | string | Account ID of the event data store owner | + +### CloudTrail Describe Query + +Check the status, run time, and scan statistics of a CloudTrail Lake query + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `awsRegion` | string | Yes | AWS region \(e.g., us-east-1\) | +| `awsAccessKeyId` | string | Yes | AWS access key ID | +| `awsSecretAccessKey` | string | Yes | AWS secret access key | +| `queryId` | string | No | ID of the query returned by Start Query. Supply this or queryAlias, not both | +| `queryAlias` | string | No | Query template alias; returns the last run for that alias. Supply this or queryId, not both | +| `refreshId` | string | No | Dashboard refresh ID, used together with queryAlias | +| `eventDataStoreOwnerAccountId` | string | No | Account ID of the event data store owner, for a shared event data store | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `queryId` | string | ID of the query | +| `queryString` | string | SQL body of the query | +| `queryStatus` | string | QUEUED, RUNNING, FINISHED, FAILED, CANCELLED, or TIMED_OUT | +| `errorMessage` | string | Error message returned if the query failed | +| `deliveryS3Uri` | string | S3 URI the results were delivered to, if configured | +| `deliveryStatus` | string | Delivery status of the S3 results \(SUCCESS, FAILED, PENDING, and similar\) | +| `prompt` | string | Natural-language prompt used to generate the query, if it was generated | +| `eventDataStoreOwnerAccountId` | string | Account ID of the event data store owner | +| `eventsMatched` | number | Number of events that matched the query | +| `eventsScanned` | number | Number of events scanned by the query | +| `bytesScanned` | number | Bytes scanned by the query | +| `executionTimeInMillis` | number | Query run time in milliseconds | +| `creationTime` | string | When the query was created \(ISO 8601\) | + +### CloudTrail Get Query Results + +Fetch a page of result rows from a finished CloudTrail Lake query + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `awsRegion` | string | Yes | AWS region \(e.g., us-east-1\) | +| `awsAccessKeyId` | string | Yes | AWS access key ID | +| `awsSecretAccessKey` | string | Yes | AWS secret access key | +| `queryId` | string | Yes | ID of the query returned by Start Query | +| `maxQueryResults` | number | No | Maximum rows to return on a single page, 1 to 1000 | +| `nextToken` | string | No | Pagination token from a previous results request | +| `eventDataStoreOwnerAccountId` | string | No | Account ID of the event data store owner, for a shared event data store | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `queryStatus` | string | QUEUED, RUNNING, FINISHED, FAILED, CANCELLED, or TIMED_OUT | +| `rows` | array | Result rows, each flattened into a single object keyed by the query column names | +| `resultsCount` | number | Number of rows on this page | +| `totalResultsCount` | number | Total number of rows the query produced | +| `bytesScanned` | number | Bytes scanned by the query | +| `errorMessage` | string | Error message returned if the query failed | +| `nextToken` | string | Pagination token for the next page of rows | + +### CloudTrail Cancel Query + +Cancel a running CloudTrail Lake query + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `awsRegion` | string | Yes | AWS region \(e.g., us-east-1\) | +| `awsAccessKeyId` | string | Yes | AWS access key ID | +| `awsSecretAccessKey` | string | Yes | AWS secret access key | +| `queryId` | string | Yes | ID of the query returned by Start Query | +| `eventDataStoreOwnerAccountId` | string | No | Account ID of the event data store owner, for a shared event data store | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `queryId` | string | ID of the cancelled query | +| `queryStatus` | string | Status AWS reported for the query after the cancellation request. Cancellation is asynchronous, so this is typically RUNNING or CANCELLED — poll Describe Lake Query for the terminal status | +| `eventDataStoreOwnerAccountId` | string | Account ID of the event data store owner, when the query was cross-account | + +### CloudTrail List Event Data Stores + +List the CloudTrail Lake event data stores in the account for the current Region + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `awsRegion` | string | Yes | AWS region \(e.g., us-east-1\) | +| `awsAccessKeyId` | string | Yes | AWS access key ID | +| `awsSecretAccessKey` | string | Yes | AWS secret access key | +| `maxResults` | number | No | Maximum event data stores to return on a single page, 1 to 1000 | +| `nextToken` | string | No | Pagination token from a previous list request | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `eventDataStores` | array | Event data stores in the account for the current Region | +| ↳ `eventDataStoreArn` | string | ARN of the event data store | +| ↳ `name` | string | Name of the event data store | +| ↳ `status` | string | CREATED, ENABLED, PENDING_DELETION, or an ingestion state | +| ↳ `advancedEventSelectors` | array | Advanced event selectors that define what the store ingests | +| ↳ `multiRegionEnabled` | boolean | Whether the store collects events from all Regions | +| ↳ `organizationEnabled` | boolean | Whether the store collects events for the organization | +| ↳ `retentionPeriod` | number | Retention period in days | +| ↳ `terminationProtectionEnabled` | boolean | Whether termination protection is enabled | +| ↳ `createdTimestamp` | string | When the store was created \(ISO 8601\) | +| ↳ `updatedTimestamp` | string | When the store was last updated \(ISO 8601\) | +| `nextToken` | string | Pagination token for the next page of event data stores | + +### CloudTrail Get Event Data Store + +Retrieve the configuration of a single CloudTrail Lake event data store + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `awsRegion` | string | Yes | AWS region \(e.g., us-east-1\) | +| `awsAccessKeyId` | string | Yes | AWS access key ID | +| `awsSecretAccessKey` | string | Yes | AWS secret access key | +| `eventDataStore` | string | Yes | Event data store ARN, or the ID suffix of that ARN | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `eventDataStoreArn` | string | ARN of the event data store | +| `name` | string | Name of the event data store | +| `status` | string | CREATED, ENABLED, PENDING_DELETION, or an ingestion state | +| `advancedEventSelectors` | array | Advanced event selectors that define what the store ingests | +| ↳ `name` | string | Name of the advanced event selector | +| ↳ `fieldSelectors` | array | Field selectors, each with field plus its equals, startsWith, endsWith, notEquals, notStartsWith, and notEndsWith values | +| `multiRegionEnabled` | boolean | Whether the store collects events from all Regions | +| `organizationEnabled` | boolean | Whether the store collects events for the organization | +| `retentionPeriod` | number | Retention period in days | +| `terminationProtectionEnabled` | boolean | Whether termination protection is enabled | +| `createdTimestamp` | string | When the store was created \(ISO 8601\) | +| `updatedTimestamp` | string | When the store was last updated \(ISO 8601\) | +| `kmsKeyId` | string | KMS key used to encrypt the store | +| `billingMode` | string | EXTENDABLE_RETENTION_PRICING or FIXED_RETENTION_PRICING | +| `federationStatus` | string | Lake Formation federation status | +| `federationRoleArn` | string | ARN of the role used for Lake Formation federation | +| `partitionKeys` | array | Partition keys of the event data store | +| ↳ `name` | string | Partition key name | +| ↳ `type` | string | Partition key data type | + +### CloudTrail List Tags + +List the tags on CloudTrail trails, event data stores, dashboards, or channels + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `awsRegion` | string | Yes | AWS region \(e.g., us-east-1\) | +| `awsAccessKeyId` | string | Yes | AWS access key ID | +| `awsSecretAccessKey` | string | Yes | AWS secret access key | +| `resourceIdList` | string | Yes | Comma-separated CloudTrail resource ARNs, up to 20 | +| `nextToken` | string | No | Reserved for future use by AWS | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `resourceTags` | array | Tags for each requested resource | +| ↳ `resourceId` | string | ARN of the tagged resource | +| ↳ `tags` | array | Tags on the resource, as key and value | +| `nextToken` | string | Reserved for future use by AWS | + + diff --git a/apps/docs/content/docs/integrations/iam.mdx b/apps/docs/content/docs/integrations/iam.mdx index 03527393ce6..ba14525abd9 100644 --- a/apps/docs/content/docs/integrations/iam.mdx +++ b/apps/docs/content/docs/integrations/iam.mdx @@ -19,9 +19,14 @@ With AWS IAM, you can: - **Create roles**: Define IAM roles with specific permissions that can be assumed by users, services, or applications for temporary access - **Attach policies**: Assign managed policies to users and roles to define what actions they can perform on which resources - **Organize with groups**: Create IAM groups to manage permissions for collections of users, simplifying access management at scale -- **Control access keys**: Generate and manage programmatic access key pairs for API and CLI access to AWS services +- **Control access keys**: Generate, list, deactivate, and delete programmatic access key pairs for API and CLI access to AWS services +- **Simulate policies**: Test whether a principal is allowed to perform specific actions against specific resources, before granting or revoking anything In Sim, the AWS IAM integration allows your workflows to automate identity management tasks such as provisioning new users, assigning roles and permissions, managing group memberships, and rotating access keys. This is particularly useful for onboarding automation, security compliance workflows, access reviews, and incident response — enabling your agents to manage AWS access control programmatically. + +Policy simulation deserves a note, because AWS's model is easy to misread. `Simulate Principal Policy` returns one result per action regardless of how many resource ARNs you pass. The top-level decision is the **aggregate** across every resource — most restrictive wins — and the top-level resource name is an ARN *template* for the resource type, not one of your ARNs. Per-resource answers live in `resourceSpecificResults`, and when you supply concrete ARNs, missing context keys are reported there too rather than at the top level. Read `resourceSpecificResults` whenever you simulate against more than one resource: the aggregate alone will tell you a principal is denied when it is in fact allowed on some of them. + +The secret half of a new access key is returned once and is hidden from block output display and execution logs. It stays resolvable downstream, so rotation workflows can pass it straight to the system that needs it — but a block you pass it into will log it under that block's own inputs. {/* MANUAL-CONTENT-END */} @@ -317,7 +322,7 @@ List managed IAM policies | `region` | string | Yes | AWS region \(e.g., us-east-1\) | | `accessKeyId` | string | Yes | AWS access key ID | | `secretAccessKey` | string | Yes | AWS secret access key | -| `scope` | string | No | Filter by scope: All, AWS \(AWS-managed\), or Local \(customer-managed\) | +| `scope` | string | No | Filter by scope. Must be exactly one of: All, AWS \(AWS-managed\), Local \(customer-managed\) | | `onlyAttached` | boolean | No | If true, only return policies attached to an entity | | `pathPrefix` | string | No | Path prefix to filter policies | | `maxItems` | number | No | Maximum number of policies to return \(1-1000, default 100\) | @@ -327,11 +332,41 @@ List managed IAM policies | Parameter | Type | Description | | --------- | ---- | ----------- | -| `policies` | json | List of policies with policyName, arn, attachmentCount, and dates | +| `policies` | json | List of policies with policyName, policyId, arn, path, attachmentCount, isAttachable, defaultVersionId, permissionsBoundaryUsageCount, and dates. AWS never returns policy descriptions from ListPolicies — use IAM Get Policy for a description. | | `isTruncated` | boolean | Whether there are more results available | | `marker` | string | Pagination marker for the next page of results | | `count` | number | Number of policies returned | +### IAM Get Policy + +Get details about a managed IAM policy, including its description — the field ListPolicies never returns + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `policyArn` | string | Yes | ARN of the managed policy to retrieve \(e.g., arn:aws:iam::aws:policy/ReadOnlyAccess\) | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `policyName` | string | The friendly name of the policy | +| `policyId` | string | The stable unique ID of the policy | +| `arn` | string | The ARN of the policy | +| `path` | string | The path to the policy | +| `attachmentCount` | number | Number of entities the policy is attached to | +| `isAttachable` | boolean | Whether the policy can be attached | +| `createDate` | string | Date the policy was created | +| `updateDate` | string | Date the policy was last updated | +| `description` | string | The policy description | +| `defaultVersionId` | string | The identifier of the default policy version | +| `permissionsBoundaryUsageCount` | number | Number of entities using the policy as a permissions boundary | +| `tags` | json | Tags attached to the policy \(key, value pairs\) | + ### IAM Create Access Key Create a new access key pair for an IAM user @@ -376,6 +411,51 @@ Delete an access key pair for an IAM user | --------- | ---- | ----------- | | `message` | string | Operation status message | +### IAM List Access Keys + +List an IAM user's access key IDs with their status and age — use to find stale keys and to confirm which keys remain after a rotation + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `userName` | string | No | The IAM user whose keys to list \(defaults to the calling user if omitted\) | +| `maxItems` | number | No | Maximum number of access keys to return \(1-1000\) | +| `marker` | string | No | Pagination marker from a previous request | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `accessKeys` | json | Access key metadata: accessKeyId, userName, status \(Active/Inactive\), createDate. The secret access key is never returned by this operation. | +| `isTruncated` | boolean | Whether there are more results available | +| `marker` | string | Pagination marker for the next page of results | +| `count` | number | Number of access keys returned | + +### IAM Update Access Key + +Activate or deactivate an IAM access key — deactivate an old key and verify nothing breaks before deleting it + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `accessKeyIdToUpdate` | string | Yes | The access key ID whose status to change | +| `status` | string | Yes | The status to set. Must be exactly one of: Active, Inactive. An Inactive key is rejected by AWS but can be reactivated. | +| `userName` | string | No | The IAM user that owns the key \(defaults to the calling user if omitted\) | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `message` | string | Operation status message | + ### IAM List Groups List IAM groups in your AWS account @@ -503,7 +583,8 @@ Simulate whether a user, role, or group is allowed to perform specific AWS actio | `secretAccessKey` | string | Yes | AWS secret access key | | `policySourceArn` | string | Yes | ARN of the user, group, or role to simulate \(e.g., arn:aws:iam::123456789012:user/alice\) | | `actionNames` | string | Yes | Comma-separated list of AWS actions to simulate \(e.g., s3:GetObject,ec2:DescribeInstances\) | -| `resourceArns` | string | No | Comma-separated list of resource ARNs to simulate against \(defaults to * if not provided\) | +| `resourceArns` | string | No | Comma-separated list of resource ARNs to simulate against \(defaults to * if not provided\). Read the per-ARN verdict from resourceSpecificResults, not from evalDecision. | +| `contextEntries` | array | No | Condition context keys to supply to the simulation. Without these, any policy gated by a Condition simulates as denied with missing context values. | | `maxResults` | number | No | Maximum number of simulation results to return \(1-1000\) | | `marker` | string | No | Pagination marker from a previous request | @@ -511,7 +592,7 @@ Simulate whether a user, role, or group is allowed to perform specific AWS actio | Parameter | Type | Description | | --------- | ---- | ----------- | -| `evaluationResults` | json | Simulation results per action: evalActionName, evalResourceName, evalDecision \(allowed/explicitDeny/implicitDeny\), matchedStatements \(sourcePolicyId, sourcePolicyType\), missingContextValues | +| `evaluationResults` | json | One result per simulated action. evalDecision is the AGGREGATE, most-restrictive decision across every resource ARN, and evalResourceName is the resource-type ARN template \(e.g. an arn:aws:s3:::BUCKET/KEY shape with the bucket and key left as placeholders\), not a customer ARN. For the verdict on an individual ARN read resourceSpecificResults\[\]: evalResourceName, evalResourceDecision \(allowed/explicitDeny/implicitDeny\), matchedStatements, missingContextValues, permissionsBoundaryAllowed. When concrete resource ARNs are supplied, missing context values appear there rather than at the top level. | | `isTruncated` | boolean | Whether there are more results available | | `marker` | string | Pagination marker for the next page of results | | `count` | number | Number of evaluation results returned | diff --git a/apps/docs/content/docs/integrations/identity_center.mdx b/apps/docs/content/docs/integrations/identity_center.mdx index 22b620939ac..3490979219f 100644 --- a/apps/docs/content/docs/integrations/identity_center.mdx +++ b/apps/docs/content/docs/integrations/identity_center.mdx @@ -21,9 +21,16 @@ With AWS IAM Identity Center, you can: - **List permission sets**: Enumerate the available permission sets (e.g., ReadOnly, PowerUser, AdministratorAccess) defined in your Identity Center instance - **Monitor assignment status**: Poll the provisioning status of create/delete operations, which are asynchronous in AWS - **List accounts in your organization**: Enumerate all AWS accounts in your AWS Organizations structure to populate access request dropdowns -- **Manage groups**: List groups and resolve group IDs by display name for group-based access grants +- **Manage groups**: List groups, resolve group IDs by display name, and enumerate group memberships for group-based access grants +- **Audit an account's access**: List the assignments on a given AWS account for one permission set, then resolve each principal ID back to the user or group behind it In Sim, the AWS Identity Center integration is designed to power **TEAM (Temporary Elevated Access Management)** workflows — automated pipelines where users request elevated access, approvers approve or deny it, access is provisioned with a time limit, and auto-revocation removes it when the window expires. This replaces manual console-based access management with auditable, agent-driven workflows that integrate with Slack, email, ticketing systems, and CloudTrail for full traceability. + +The same operations support the reverse direction — access review. Starting from an account, an agent can list its assignments, resolve the principals, expand groups into their members, and produce a written report of exactly who can reach that account and through which permission set. + +One detail shapes how that review has to be built. AWS requires a permission set ARN alongside the account ID on this call, so *List Assignments For Account* returns only the assignments granted through that one permission set — not every assignment on the account. To cover an account completely, run *List Permission Sets* for the instance first, then call *List Assignments For Account* once per permission set and combine the results. Skipping that loop silently omits access granted through the permission sets you did not ask about. + +Two AWS behaviors are worth knowing. Creating and deleting an account assignment are **asynchronous**: both return a request ID, and each has its own status poller — use *Check Assignment Status* for creations and *Check Assignment Deletion Status* for deletions, as the two request-ID types are not interchangeable. And the account-listing operations call AWS Organizations, which is global per partition; the block resolves the correct endpoint for commercial, GovCloud, and China regions automatically. {/* MANUAL-CONTENT-END */} @@ -53,7 +60,14 @@ List all AWS IAM Identity Center instances in your account | Parameter | Type | Description | | --------- | ---- | ----------- | -| `instances` | json | List of Identity Center instances with instanceArn, identityStoreId, name, status, statusReason | +| `instances` | array | Identity Center instances in the region | +| ↳ `instanceArn` | string | ARN of the Identity Center instance | +| ↳ `identityStoreId` | string | Identity Store ID backing the instance | +| ↳ `name` | string | Instance name | +| ↳ `status` | string | Instance status | +| ↳ `statusReason` | string | Explanation when the instance is not ACTIVE | +| ↳ `ownerAccountId` | string | AWS account that owns the instance | +| ↳ `createdDate` | string | ISO 8601 date the instance was created | | `nextToken` | string | Pagination token for the next page of results | | `count` | number | Number of instances returned | @@ -68,14 +82,20 @@ List all AWS accounts in your organization | `region` | string | Yes | AWS region \(e.g., us-east-1\) | | `accessKeyId` | string | Yes | AWS access key ID | | `secretAccessKey` | string | Yes | AWS secret access key | -| `maxResults` | number | No | Maximum number of accounts to return | +| `maxResults` | number | No | Maximum number of accounts to return \(1-20; the AWS Organizations ceiling\) | | `nextToken` | string | No | Pagination token from a previous request | #### Output | Parameter | Type | Description | | --------- | ---- | ----------- | -| `accounts` | json | List of AWS accounts with id, arn, name, email, status | +| `accounts` | array | Accounts in the AWS organization | +| ↳ `id` | string | AWS account ID | +| ↳ `arn` | string | AWS account ARN | +| ↳ `name` | string | Account name | +| ↳ `email` | string | Root email address of the account | +| ↳ `status` | string | Account status \(e.g., ACTIVE, SUSPENDED\) | +| ↳ `joinedTimestamp` | string | ISO 8601 date the account joined the organization | | `nextToken` | string | Pagination token for the next page of results | | `count` | number | Number of accounts returned | @@ -115,14 +135,19 @@ List all permission sets defined in an IAM Identity Center instance | `accessKeyId` | string | Yes | AWS access key ID | | `secretAccessKey` | string | Yes | AWS secret access key | | `instanceArn` | string | Yes | ARN of the Identity Center instance | -| `maxResults` | number | No | Maximum number of permission sets to return | +| `maxResults` | number | No | Maximum number of permission sets to return \(1-100\) | | `nextToken` | string | No | Pagination token from a previous request | #### Output | Parameter | Type | Description | | --------- | ---- | ----------- | -| `permissionSets` | json | List of permission sets with permissionSetArn, name, description, sessionDuration | +| `permissionSets` | array | Permission sets defined on the instance | +| ↳ `permissionSetArn` | string | ARN of the permission set | +| ↳ `name` | string | Permission set name | +| ↳ `description` | string | Permission set description | +| ↳ `sessionDuration` | string | ISO 8601 session duration \(e.g., PT1H\) | +| ↳ `createdDate` | string | ISO 8601 date the permission set was created | | `nextToken` | string | Pagination token for the next page of results | | `count` | number | Number of permission sets returned | @@ -149,6 +174,34 @@ Look up a user in the Identity Store by email address | `displayName` | string | Display name of the user | | `email` | string | Email address of the user | +### Identity Center Describe User + +Resolve an Identity Store user ID to the user behind it. Use to turn the principalId on an account assignment into a name and email. + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `identityStoreId` | string | Yes | Identity Store ID \(e.g., d-1234567890\) | +| `userId` | string | Yes | Identity Store user ID, such as the principalId on a USER account assignment | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `userId` | string | Identity Store user ID | +| `userName` | string | Username in the Identity Store | +| `displayName` | string | Display name of the user, or null when the Identity Store omits it | +| `email` | string | Primary email address, or null when the user has no email attribute | +| `userStatus` | string | Account status \(ENABLED or DISABLED\), or null when the Identity Store omits it | +| `title` | string | Job title, or null when the Identity Store omits it | +| `externalIds` | array | External identity provider IDs linked to the user | +| ↳ `issuer` | string | Identity provider that issued the ID | +| ↳ `id` | string | Identifier at the issuer | + ### Identity Center Get Group Look up a group in the Identity Store by display name @@ -171,6 +224,31 @@ Look up a group in the Identity Store by display name | `displayName` | string | Display name of the group | | `description` | string | Group description | +### Identity Center Describe Group + +Resolve an Identity Store group ID to the group behind it. Use to turn the principalId on an account assignment into a group name. + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `identityStoreId` | string | Yes | Identity Store ID \(e.g., d-1234567890\) | +| `groupId` | string | Yes | Identity Store group ID, such as the principalId on a GROUP account assignment | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `groupId` | string | Identity Store group ID | +| `displayName` | string | Display name of the group | +| `description` | string | Group description | +| `externalIds` | array | External identity provider IDs linked to the group | +| ↳ `issuer` | string | Identity provider that issued the ID | +| ↳ `id` | string | Identifier at the issuer | + ### Identity Center List Groups List all groups in the Identity Store @@ -183,17 +261,50 @@ List all groups in the Identity Store | `accessKeyId` | string | Yes | AWS access key ID | | `secretAccessKey` | string | Yes | AWS secret access key | | `identityStoreId` | string | Yes | Identity Store ID \(from the Identity Center instance\) | -| `maxResults` | number | No | Maximum number of groups to return | +| `maxResults` | number | No | Maximum number of groups to return \(1-100\) | | `nextToken` | string | No | Pagination token from a previous request | #### Output | Parameter | Type | Description | | --------- | ---- | ----------- | -| `groups` | json | List of groups with groupId, displayName, description | +| `groups` | array | Groups in the Identity Store | +| ↳ `groupId` | string | Identity Store group ID \(use as principalId\) | +| ↳ `displayName` | string | Group display name | +| ↳ `description` | string | Group description | +| ↳ `externalIds` | array | External identity provider IDs linked to the group | +| ↳ `issuer` | string | Identity provider that issued the ID | +| ↳ `id` | string | Identifier at the issuer | | `nextToken` | string | Pagination token for the next page of results | | `count` | number | Number of groups returned | +### Identity Center List Group Memberships + +List the users who belong to an Identity Store group + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `identityStoreId` | string | Yes | Identity Store ID \(e.g., d-1234567890\) | +| `groupId` | string | Yes | Identity Store group ID whose members to list | +| `maxResults` | number | No | Maximum number of memberships to return \(1-100\) | +| `nextToken` | string | No | Pagination token from a previous request | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `memberships` | array | Members of the group | +| ↳ `membershipId` | string | Identity Store membership ID | +| ↳ `groupId` | string | Identity Store group ID | +| ↳ `userId` | string | Identity Store user ID of the member — resolve with Describe User. Null when the member is not a user. | +| `nextToken` | string | Pagination token for the next page of results | +| `count` | number | Number of memberships returned | + ### Identity Center Create Account Assignment Grant a user or group access to an AWS account via a permission set (temporary elevated access) @@ -248,7 +359,7 @@ Revoke a user or group access to an AWS account by removing a permission set ass | --------- | ---- | ----------- | | `message` | string | Status message | | `status` | string | Deprovisioning status: IN_PROGRESS, FAILED, or SUCCEEDED | -| `requestId` | string | Request ID to use with Check Assignment Status | +| `requestId` | string | Request ID to use with Check Assignment Deletion Status | | `accountId` | string | Target AWS account ID | | `permissionSetArn` | string | Permission set ARN | | `principalType` | string | Principal type \(USER or GROUP\) | @@ -268,7 +379,7 @@ Check the provisioning status of an account assignment creation request | `accessKeyId` | string | Yes | AWS access key ID | | `secretAccessKey` | string | Yes | AWS secret access key | | `instanceArn` | string | Yes | ARN of the Identity Center instance | -| `requestId` | string | Yes | Request ID returned from Create or Delete Account Assignment | +| `requestId` | string | Yes | Request ID returned from Create Account Assignment. Deletion request IDs are not accepted — use Check Assignment Deletion Status for those. | #### Output @@ -312,9 +423,9 @@ Check the deprovisioning status of an account assignment deletion request | `failureReason` | string | Reason for failure if status is FAILED | | `createdDate` | string | Date the request was created | -### Identity Center List Account Assignments +### Identity Center List Account Assignments For Principal -List all account assignments for a specific user or group across all accounts +List every account and permission set a specific user or group is assigned. Use List Assignments For Account to go the other way, from an account to its principals. #### Input @@ -326,14 +437,47 @@ List all account assignments for a specific user or group across all accounts | `instanceArn` | string | Yes | ARN of the Identity Center instance | | `principalId` | string | Yes | Identity Store ID of the user or group | | `principalType` | string | Yes | Type of principal: USER or GROUP | -| `maxResults` | number | No | Maximum number of assignments to return | +| `maxResults` | number | No | Maximum number of assignments to return \(1-100\) | +| `nextToken` | string | No | Pagination token from a previous request | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `assignments` | array | Accounts and permission sets the principal is assigned | +| ↳ `accountId` | string | AWS account ID | +| ↳ `permissionSetArn` | string | Permission set ARN | +| ↳ `principalType` | string | Principal type \(USER or GROUP\) | +| ↳ `principalId` | string | Identity Store user or group ID | +| `nextToken` | string | Pagination token for the next page of results | +| `count` | number | Number of assignments returned | + +### Identity Center List Assignments For Account + +List every principal assigned a specific permission set on a specific AWS account. Use for per-account access reviews. + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `instanceArn` | string | Yes | ARN of the Identity Center instance | +| `accountId` | string | Yes | AWS account ID to list assignments for \(12 digits\) | +| `permissionSetArn` | string | Yes | ARN of the permission set to list assignments for | +| `maxResults` | number | No | Maximum number of assignments to return \(1-100\) | | `nextToken` | string | No | Pagination token from a previous request | #### Output | Parameter | Type | Description | | --------- | ---- | ----------- | -| `assignments` | json | List of account assignments with accountId, permissionSetArn, principalType, principalId | +| `assignments` | array | Principals assigned this permission set on the account | +| ↳ `accountId` | string | AWS account ID | +| ↳ `permissionSetArn` | string | Permission set ARN | +| ↳ `principalType` | string | Principal type \(USER or GROUP\) | +| ↳ `principalId` | string | Identity Store user or group ID — resolve with Describe User or Describe Group | | `nextToken` | string | Pagination token for the next page of results | | `count` | number | Number of assignments returned | diff --git a/apps/docs/content/docs/integrations/meta.json b/apps/docs/content/docs/integrations/meta.json index c884107e71e..df2c5f2d169 100644 --- a/apps/docs/content/docs/integrations/meta.json +++ b/apps/docs/content/docs/integrations/meta.json @@ -45,6 +45,7 @@ "clickup-service-account", "cloudflare", "cloudformation", + "cloudtrail", "cloudwatch", "codepipeline", "confluence", @@ -250,6 +251,7 @@ "sqs", "square", "ssh", + "ssm", "stagehand", "stripe", "sts", diff --git a/apps/docs/content/docs/integrations/sqs.mdx b/apps/docs/content/docs/integrations/sqs.mdx index aff6b8179e0..17c9c60c038 100644 --- a/apps/docs/content/docs/integrations/sqs.mdx +++ b/apps/docs/content/docs/integrations/sqs.mdx @@ -21,17 +21,20 @@ With Amazon SQS, you can: - **Ensure reliability**: Built-in redundancy and high availability - **Support FIFO queues**: Maintain strict message ordering and exactly-once processing -In Sim, the SQS integration enables your agents to send messages to Amazon SQS queues securely and programmatically. Supported operations include: +In Sim, the SQS integration gives your agents both sides of the queue — producing work and consuming it. Supported operations cover: -- **Send Message**: Send messages to SQS queues with optional message group ID and deduplication ID for FIFO queues +- **Messages**: Send one message or a batch of up to 10, receive with long polling, delete individually or in batches, and extend visibility timeouts while work is still in flight +- **Queues**: Create, delete, and purge queues, look up a queue URL by name, and read or update queue attributes +- **Dead-letter handling**: List the source queues feeding a dead-letter queue, then start, monitor, and cancel message move tasks to redrive failed messages back +- **Tags**: List, add, and remove queue tags for cost allocation and ownership tracking -This integration allows your agents to automate message sending workflows without manual intervention. By connecting Sim with Amazon SQS, you can build agents that publish messages to queues within your workflows—all without handling queue infrastructure or connections. +Because an agent can now drain a queue rather than only fill it, SQS becomes a way to hand work to Sim as well as from it. A workflow can long-poll a queue for jobs, process each message, delete it on success, and let the visibility timeout return anything it fails to finish — the standard reliable-consumer pattern, without running a worker of your own. {/* MANUAL-CONTENT-END */} ## Usage Instructions -Integrate Amazon SQS into the workflow. Can send messages to SQS queues. +Integrate Amazon SQS into the workflow. Send and receive messages one at a time or in batches of ten, delete messages, extend visibility timeouts, manage queues along with their attributes and tags, and redrive messages out of a dead-letter queue. @@ -49,7 +52,9 @@ Send a message to an Amazon SQS queue | `accessKeyId` | string | Yes | AWS access key ID | | `secretAccessKey` | string | Yes | AWS secret access key | | `queueUrl` | string | Yes | SQS queue URL \(e.g., https://sqs.us-east-1.amazonaws.com/123456789012/my-queue\) | -| `data` | object | Yes | Message body to send as JSON object \(e.g., \{ "action": "process", "payload": \{...\} \}\) | +| `data` | json | Yes | Message body to send as JSON object \(e.g., \{ "action": "process", "payload": \{...\} \}\) | +| `delaySeconds` | number | No | Seconds to delay delivery of this message, 0-900. Not supported per-message on FIFO queues | +| `messageAttributes` | json | No | Message attributes keyed by name, each \{ "dataType": "String" \| "Number", "stringValue": "..." \}. A custom label such as Number.float is allowed; Binary attributes are not supported | | `messageGroupId` | string | No | Message group ID for FIFO queues \(e.g., "order-processing-group"\) | | `messageDeduplicationId` | string | No | Message deduplication ID for FIFO queues \(e.g., "order-12345-v1"\) | @@ -59,5 +64,470 @@ Send a message to an Amazon SQS queue | --------- | ---- | ----------- | | `message` | string | Operation status message | | `id` | string | Message ID | +| `md5OfMessageBody` | string | MD5 digest of the message body, for verifying SQS received it intact | +| `md5OfMessageAttributes` | string | MD5 digest of the message attributes | +| `sequenceNumber` | string | Large, non-consecutive sequence number assigned by a FIFO queue | + +### SQS Send Message Batch + +Send up to 10 messages to an Amazon SQS queue in a single request + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `queueUrl` | string | Yes | SQS queue URL \(e.g., https://sqs.us-east-1.amazonaws.com/123456789012/my-queue\) | +| `entries` | array | Yes | Up to 10 entries, each \{ "id": "unique-id", "data": \{ ... \}, "delaySeconds"?, "messageGroupId"?, "messageDeduplicationId"?, "messageAttributes"? \} | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `message` | string | Operation status message | +| `successful` | array | Entries that were accepted | +| ↳ `id` | string | Id supplied for this batch entry | +| ↳ `messageId` | string | Message ID assigned by SQS | +| ↳ `md5OfMessageBody` | string | MD5 digest of the message body | +| ↳ `md5OfMessageAttributes` | string | MD5 digest of the message attributes | +| ↳ `sequenceNumber` | string | Sequence number assigned by a FIFO queue | +| `failed` | array | Entries that were rejected | +| ↳ `id` | string | Id supplied for this batch entry | +| ↳ `senderFault` | boolean | Whether the sender caused the failure | +| ↳ `code` | string | Error code for the failure | +| ↳ `message` | string | Human-readable failure message | +| `successCount` | number | Number of messages accepted | +| `failureCount` | number | Number of messages rejected | + +### SQS Receive Message + +Receive up to 10 messages from an Amazon SQS queue, with optional long polling + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `queueUrl` | string | Yes | SQS queue URL \(e.g., https://sqs.us-east-1.amazonaws.com/123456789012/my-queue\) | +| `maxNumberOfMessages` | number | No | Maximum number of messages to return, 1-10 \(default 1\) | +| `waitTimeSeconds` | number | No | Long-poll duration in seconds, 0-20. Waits for a message to arrive before returning \(default 0, short poll\) | +| `visibilityTimeout` | number | No | Seconds the returned messages stay hidden from other consumers, 0-43200. Defaults to the queue setting | +| `messageAttributeNames` | array | No | Names of user-defined message attributes to return. Use \["All"\] to return all of them | +| `messageSystemAttributeNames` | array | No | System attributes to return: All, SenderId, SentTimestamp, ApproximateReceiveCount, ApproximateFirstReceiveTimestamp, SequenceNumber, MessageDeduplicationId, MessageGroupId, AWSTraceHeader, DeadLetterQueueSourceArn | +| `receiveRequestAttemptId` | string | No | FIFO queues only: deduplication token that lets a retried receive return the same messages \(max 128 characters\) | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `messages` | array | Received messages. Pass a receiptHandle to sqs_delete_message, sqs_delete_message_batch, sqs_change_message_visibility, or sqs_change_message_visibility_batch | +| ↳ `messageId` | string | Unique ID SQS assigned to the message | +| ↳ `receiptHandle` | string | Handle identifying this receipt of the message, required to delete it | +| ↳ `body` | string | Message body as it was sent | +| ↳ `md5OfBody` | string | MD5 digest of the message body | +| ↳ `md5OfMessageAttributes` | string | MD5 digest of the message attributes | +| ↳ `attributes` | json | Requested system attributes as string values keyed by attribute name | +| ↳ `messageAttributes` | json | Requested user-defined attributes, each with dataType, stringValue, and stringListValues | +| `count` | number | Number of messages returned | + +### SQS Delete Message + +Delete a received message from an Amazon SQS queue using its receipt handle + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `queueUrl` | string | Yes | SQS queue URL \(e.g., https://sqs.us-east-1.amazonaws.com/123456789012/my-queue\) | +| `receiptHandle` | string | Yes | Receipt handle returned by sqs_receive_message for the message to delete | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `message` | string | Operation status message | + +### SQS Delete Message Batch + +Delete up to 10 received messages from an Amazon SQS queue in a single request + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `queueUrl` | string | Yes | SQS queue URL \(e.g., https://sqs.us-east-1.amazonaws.com/123456789012/my-queue\) | +| `entries` | array | Yes | Up to 10 entries, each \{ "id": "unique-id", "receiptHandle": "..." \}. Receipt handles come from sqs_receive_message | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `message` | string | Operation status message | +| `successful` | array | Entries that were deleted | +| ↳ `id` | string | Id supplied for this batch entry | +| `failed` | array | Entries that were rejected | +| ↳ `id` | string | Id supplied for this batch entry | +| ↳ `senderFault` | boolean | Whether the sender caused the failure | +| ↳ `code` | string | Error code for the failure | +| ↳ `message` | string | Human-readable failure message | +| `successCount` | number | Number of messages deleted | +| `failureCount` | number | Number of messages rejected | + +### SQS Change Message Visibility + +Change how long a received Amazon SQS message stays hidden from other consumers + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `queueUrl` | string | Yes | SQS queue URL \(e.g., https://sqs.us-east-1.amazonaws.com/123456789012/my-queue\) | +| `receiptHandle` | string | Yes | Receipt handle returned by sqs_receive_message for the message to update | +| `visibilityTimeout` | number | Yes | New visibility timeout in seconds, 0-43200 \(12 hours\). 0 makes the message immediately visible again | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `message` | string | Operation status message | + +### SQS Change Message Visibility Batch + +Change the visibility timeout of up to 10 received Amazon SQS messages at once + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `queueUrl` | string | Yes | SQS queue URL \(e.g., https://sqs.us-east-1.amazonaws.com/123456789012/my-queue\) | +| `entries` | array | Yes | Up to 10 entries, each \{ "id": "unique-id", "receiptHandle": "...", "visibilityTimeout": 0-43200 \}. Receipt handles come from sqs_receive_message | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `message` | string | Operation status message | +| `successful` | array | Entries that were updated | +| ↳ `id` | string | Id supplied for this batch entry | +| `failed` | array | Entries that were rejected | +| ↳ `id` | string | Id supplied for this batch entry | +| ↳ `senderFault` | boolean | Whether the sender caused the failure | +| ↳ `code` | string | Error code for the failure | +| ↳ `message` | string | Human-readable failure message | +| `successCount` | number | Number of messages updated | +| `failureCount` | number | Number of messages rejected | + +### SQS List Queues + +List Amazon SQS queue URLs in a region, optionally filtered by name prefix + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `queueNamePrefix` | string | No | Return only queues whose name begins with this string \(case-sensitive\) | +| `maxResults` | number | No | Maximum queues to return, 1-1000. Must be set to receive a nextToken \(default returns up to 1000\) | +| `nextToken` | string | No | Pagination token from a previous request | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `queueUrls` | array | Queue URLs returned by the request | +| `nextToken` | string | Pagination token for the next page of results | +| `count` | number | Number of queue URLs returned | + +### SQS Get Queue URL + +Resolve an Amazon SQS queue name to its queue URL + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `queueName` | string | Yes | Queue name, up to 80 characters of letters, digits, hyphens and underscores. A FIFO queue name ends in .fifo | +| `queueOwnerAwsAccountId` | string | No | 12-digit AWS account ID of the queue owner, when the queue belongs to another account | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `queueUrl` | string | URL of the queue | + +### SQS Get Queue Attributes + +Read configuration and message-count attributes of an Amazon SQS queue + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `queueUrl` | string | Yes | SQS queue URL \(e.g., https://sqs.us-east-1.amazonaws.com/123456789012/my-queue\) | +| `attributeNames` | array | No | Attributes to return, e.g. \["All"\], \["ApproximateNumberOfMessages"\], \["QueueArn"\], \["VisibilityTimeout"\], \["RedrivePolicy"\]. Omitting this returns no attributes | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `attributes` | json | Queue attributes as string values keyed by attribute name \(e.g., ApproximateNumberOfMessages, QueueArn, VisibilityTimeout, RedrivePolicy\) | + +### SQS Set Queue Attributes + +Update configuration attributes of an existing Amazon SQS queue + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `queueUrl` | string | Yes | SQS queue URL \(e.g., https://sqs.us-east-1.amazonaws.com/123456789012/my-queue\) | +| `attributes` | json | Yes | Attributes to set as string values, e.g. \{ "VisibilityTimeout": "60", "MessageRetentionPeriod": "345600", "RedrivePolicy": "\{...\}" \}. FifoQueue can only be set at creation | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `message` | string | Operation status message | + +### SQS Create Queue + +Create a standard or FIFO Amazon SQS queue + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `queueName` | string | Yes | Queue name, up to 80 characters of letters, digits, hyphens and underscores. A FIFO queue name must end in .fifo | +| `attributes` | json | No | Queue attributes as string values, e.g. \{ "FifoQueue": "true", "VisibilityTimeout": "30", "DelaySeconds": "0", "RedrivePolicy": "\{...\}" \} | +| `tags` | json | No | Cost-allocation tags to apply to the new queue, as \{ "key": "value" \} pairs | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `message` | string | Operation status message | +| `queueUrl` | string | URL of the created queue | + +### SQS Delete Queue + +Delete an Amazon SQS queue and every message still in it + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `queueUrl` | string | Yes | SQS queue URL \(e.g., https://sqs.us-east-1.amazonaws.com/123456789012/my-queue\) | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `message` | string | Operation status message | + +### SQS Purge Queue + +Delete every message in an Amazon SQS queue while keeping the queue itself + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `queueUrl` | string | Yes | SQS queue URL \(e.g., https://sqs.us-east-1.amazonaws.com/123456789012/my-queue\) | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `message` | string | Operation status message | + +### SQS List Dead-Letter Source Queues + +List the Amazon SQS queues that use a given queue as their dead-letter queue + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `queueUrl` | string | Yes | URL of the dead-letter queue whose source queues should be listed | +| `maxResults` | number | No | Maximum source queues to return, 1-1000. Must be set to receive a nextToken \(default returns up to 1000\) | +| `nextToken` | string | No | Pagination token from a previous request | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `queueUrls` | array | URLs of the source queues that redrive to this dead-letter queue | +| `nextToken` | string | Pagination token for the next page of results | +| `count` | number | Number of source queues returned | + +### SQS List Queue Tags + +List the cost-allocation tags attached to an Amazon SQS queue + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `queueUrl` | string | Yes | SQS queue URL \(e.g., https://sqs.us-east-1.amazonaws.com/123456789012/my-queue\) | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `tags` | json | Tags attached to the queue, as string values keyed by tag key | + +### SQS Tag Queue + +Add or overwrite cost-allocation tags on an Amazon SQS queue + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `queueUrl` | string | Yes | SQS queue URL \(e.g., https://sqs.us-east-1.amazonaws.com/123456789012/my-queue\) | +| `tags` | json | Yes | Tags to apply as \{ "key": "value" \} pairs. An existing key is overwritten. AWS recommends no more than 50 tags per queue | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `message` | string | Operation status message | + +### SQS Untag Queue + +Remove cost-allocation tags from an Amazon SQS queue + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `queueUrl` | string | Yes | SQS queue URL \(e.g., https://sqs.us-east-1.amazonaws.com/123456789012/my-queue\) | +| `tagKeys` | array | Yes | Tag keys to remove, e.g. \["env", "team"\] | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `message` | string | Operation status message | + +### SQS Start Message Move Task + +Start redriving messages out of an Amazon SQS dead-letter queue + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `sourceArn` | string | Yes | ARN of the dead-letter queue to move messages out of \(e.g., arn:aws:sqs:us-east-1:123456789012:my-dlq\) | +| `destinationArn` | string | No | ARN of the queue to move messages into. Omit to redrive each message to its original source queue | +| `maxNumberOfMessagesPerSecond` | number | No | Throttle the move to at most this many messages per second, up to 500. Omit to move as fast as possible | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `message` | string | Operation status message | +| `taskHandle` | string | Handle identifying the move task, accepted by sqs_cancel_message_move_task | + +### SQS List Message Move Tasks + +List the most recent message move tasks for an Amazon SQS source queue + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `sourceArn` | string | Yes | ARN of the queue whose move tasks should be listed \(e.g., arn:aws:sqs:us-east-1:123456789012:my-dlq\) | +| `maxResults` | number | No | Maximum move tasks to return, 1-10 \(default 1\) | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `results` | array | Move tasks for the source queue | +| ↳ `taskHandle` | string | Handle of the task, populated only while its status is RUNNING | +| ↳ `status` | string | RUNNING, COMPLETED, CANCELLING, CANCELLED, or FAILED | +| ↳ `sourceArn` | string | ARN of the source queue | +| ↳ `destinationArn` | string | ARN of the destination queue, absent when redriving to source queues | +| ↳ `maxNumberOfMessagesPerSecond` | number | Per-second throttle applied to the move | +| ↳ `approximateNumberOfMessagesMoved` | number | Approximate number of messages moved so far | +| ↳ `approximateNumberOfMessagesToMove` | number | Approximate number of messages still to move | +| ↳ `failureReason` | string | Why the task failed, set only when the status is FAILED | +| ↳ `startedTimestamp` | number | Epoch milliseconds when the task started | +| `count` | number | Number of move tasks returned | + +### SQS Cancel Message Move Task + +Cancel an in-progress Amazon SQS message move task + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `taskHandle` | string | Yes | Task handle returned by sqs_start_message_move_task or sqs_list_message_move_tasks. Only a RUNNING task can be cancelled | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `message` | string | Operation status message | +| `approximateNumberOfMessagesMoved` | number | Approximate number of messages already moved before the task was cancelled | diff --git a/apps/docs/content/docs/integrations/ssm.mdx b/apps/docs/content/docs/integrations/ssm.mdx new file mode 100644 index 00000000000..a2600c5bec3 --- /dev/null +++ b/apps/docs/content/docs/integrations/ssm.mdx @@ -0,0 +1,636 @@ +--- +title: AWS Systems Manager +description: Run commands, manage parameters, and audit managed nodes +--- + +import { BlockInfoCard } from "@/components/ui/block-info-card" + + + +{/* MANUAL-CONTENT-START:intro */} +[AWS Systems Manager](https://aws.amazon.com/systems-manager/) is the operations hub for AWS. It gives you a single place to run commands across fleets of managed nodes, store configuration and secrets, track patch and compliance state, and execute runbooks — without opening SSH, managing bastion hosts, or distributing long-lived credentials. + +With AWS Systems Manager, you can: + +- **Run commands remotely**: Execute shell or PowerShell across a fleet by instance ID or tag-based targets, with concurrency and error thresholds you control +- **Store configuration and secrets**: Keep parameters in Parameter Store as plain strings, string lists, or KMS-encrypted SecureStrings +- **Inspect your fleet**: List managed nodes with their platform, agent version, and last ping time +- **Track patch state**: Read per-instance patch installations and summary compliance counts +- **Audit compliance**: Query compliance items and summaries across your managed nodes +- **Automate runbooks**: Start, monitor, and stop Automation executions built on SSM documents + +In Sim, the Systems Manager integration is what lets an agent act on infrastructure rather than only report on it. Paired with CloudWatch or CloudTrail for detection, a workflow can investigate an alert, run a diagnostic command against the affected nodes, read the configuration behind the failure from Parameter Store, and kick off an Automation runbook to remediate — end to end, with every step logged in your run history. + +Parameter Store decryption is opt-in: `Get Parameter`, `Get Parameters`, and `Get Parameters By Path` leave `WithDecryption` off unless you explicitly enable it, so a SecureString stays encrypted by default. + +Be precise about what that protects, because it is narrower than it looks. The value you supply to `Put Parameter` is masked in the editor and is never echoed back in the operation's result, and Sim never puts a parameter value into an error message. It is **not** kept out of the run log: block inputs are recorded, and a value typed directly into the field is recorded verbatim. Referencing an environment variable instead — `{{MY_SECRET}}` — keeps the literal out of the log, because references are restored to their placeholder before the log is written. + +Reads are exposed the same way. Once you enable decryption the plaintext is ordinary block output: it flows to downstream blocks as intended, and it is written to the run log and the execution trace like any other output. + +So enable decryption only on the steps that genuinely need the plaintext, prefer environment-variable references over typed literals when writing, and treat the run logs of any workflow that touches SecureString values as secret material. +{/* MANUAL-CONTENT-END */} + + +## Usage Instructions + +Integrate AWS Systems Manager into your workflow. Run commands on managed nodes, read and write Parameter Store values, inspect node inventory and patch compliance, and drive Automation runbooks. + + + +## Actions + +### SSM Send Command + +Run an SSM document on managed nodes with AWS Systems Manager Run Command + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `documentName` | string | Yes | Name of the SSM document to run \(e.g., AWS-RunShellScript\) | +| `instanceIds` | json | No | Managed node IDs to target, as an array of strings \(e.g., \["i-0123456789abcdef0"\]\). Provide instanceIds or targets | +| `targets` | json | No | Tag or resource-group targets, as an array of \{Key, Values\} objects. Provide instanceIds or targets | +| `documentVersion` | string | No | Document version to run \($LATEST, $DEFAULT, or a version number\) | +| `parameters` | json | No | Document parameters, as an object mapping each parameter name to an array of string values | +| `comment` | string | No | Comment describing the command, at most 100 characters | +| `executionTimeoutSeconds` | number | No | Seconds to wait for a node to acknowledge the command before it times out \(30-2592000\) | +| `maxConcurrency` | string | No | Number or percentage of nodes to run the command on at once \(e.g., 10 or 50%\) | +| `maxErrors` | string | No | Number or percentage of errors allowed before the command stops \(e.g., 0 or 10%\) | +| `outputS3BucketName` | string | No | S3 bucket to store command output in | +| `outputS3KeyPrefix` | string | No | S3 key prefix for stored command output | +| `serviceRoleArn` | string | No | ARN of the IAM service role Systems Manager uses to publish notifications | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `commandId` | string | ID of the command; pass it to ssm_get_command_invocation or ssm_list_command_invocations to read per-node results | +| `documentName` | string | Name of the document that was run | +| `documentVersion` | string | Document version that was run | +| `comment` | string | Comment supplied with the command | +| `status` | string | Command status \(Pending, InProgress, Success, Cancelled, Failed, TimedOut, Cancelling\) | +| `statusDetails` | string | Detailed status of the command | +| `requestedDateTime` | string | When the command was requested | +| `expiresAfter` | string | When the command stops being dispatched to nodes that have not run it | +| `instanceIds` | array | Managed node IDs the command targets | +| `targets` | json | Tag or resource-group targets the command was sent to, as an array of \{key, values\} | +| `maxConcurrency` | string | Concurrency setting the command ran with | +| `maxErrors` | string | Error threshold the command ran with | +| `targetCount` | number | Number of targets the command was sent to | +| `completedCount` | number | Number of targets that have completed the command | +| `errorCount` | number | Number of targets whose command execution failed | +| `deliveryTimedOutCount` | number | Number of targets the command could not be delivered to in time | +| `executionTimeoutSeconds` | number | Acknowledgement timeout the command ran with | +| `outputS3BucketName` | string | S3 bucket command output is written to | +| `outputS3KeyPrefix` | string | S3 key prefix command output is written under | +| `outputS3Region` | string | S3 region reported for command output | +| `serviceRole` | string | IAM service role used for notifications | + +### SSM List Commands + +List Run Command executions in an AWS account + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `commandId` | string | No | Return only the command with this ID | +| `instanceId` | string | No | Return only commands sent to this managed node | +| `filters` | json | No | Filters, as an array of \{key, value\} objects. Valid keys: InvokedAfter, InvokedBefore, Status, ExecutionStage, DocumentName | +| `maxResults` | number | No | Maximum number of commands to return \(1-50\) | +| `nextToken` | string | No | Pagination token from a previous request | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `commands` | json | Commands, each with commandId, documentName, status, statusDetails, requestedDateTime, instanceIds, targets, targetCount, completedCount, and errorCount | +| `nextToken` | string | Pagination token for the next page of results | +| `count` | number | Number of commands returned | + +### SSM List Command Invocations + +List the per-node invocations of Run Command executions + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `commandId` | string | No | Return only invocations of this command | +| `instanceId` | string | No | Return only invocations on this managed node | +| `filters` | json | No | Filters, as an array of \{key, value\} objects. Valid keys: InvokedAfter, InvokedBefore, Status, DocumentName | +| `details` | boolean | No | Include per-plugin detail \(command plugins and their output\) for each invocation | +| `maxResults` | number | No | Maximum number of invocations to return \(1-50\) | +| `nextToken` | string | No | Pagination token from a previous request | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `commandInvocations` | json | Invocations, each with commandId, instanceId, instanceName, status, statusDetails, requestedDateTime, standardOutputUrl, standardErrorUrl, and commandPlugins | +| `nextToken` | string | Pagination token for the next page of results | +| `count` | number | Number of invocations returned | + +### SSM Get Command Invocation + +Read the output and status of a Run Command execution on one managed node + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `commandId` | string | Yes | ID of the command, as returned by ssm_send_command | +| `instanceId` | string | Yes | Managed node the command ran on \(e.g., i-0123456789abcdef0\) | +| `pluginName` | string | No | Name of the document plugin to read output for; required for documents with more than one plugin | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `commandId` | string | ID of the command | +| `instanceId` | string | Managed node the command ran on | +| `comment` | string | Comment supplied with the command | +| `documentName` | string | Document that was run | +| `documentVersion` | string | Document version that was run | +| `pluginName` | string | Plugin the output belongs to | +| `responseCode` | number | Exit code of the command, or -1 if it has not started | +| `executionStartDateTime` | string | When the command started running on the node | +| `executionElapsedTime` | string | How long the command ran, as an ISO 8601 duration | +| `executionEndDateTime` | string | When the command finished running on the node | +| `status` | string | Invocation status \(Pending, InProgress, Delayed, Success, Cancelled, TimedOut, Failed, Cancelling\) | +| `statusDetails` | string | Detailed status of the invocation | +| `standardOutputContent` | string | First 24000 characters of stdout; longer output is available at standardOutputUrl | +| `standardOutputUrl` | string | S3 URL of the full stdout, if S3 output was configured | +| `standardErrorContent` | string | First 8000 characters of stderr; longer output is available at standardErrorUrl | +| `standardErrorUrl` | string | S3 URL of the full stderr, if S3 output was configured | + +### SSM Cancel Command + +Cancel an in-flight Run Command execution + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `commandId` | string | Yes | ID of the command to cancel, as returned by ssm_send_command | +| `instanceIds` | array | No | Managed node IDs to cancel on \(e.g., \["i-0123456789abcdef0"\]\); omit to cancel on every targeted node | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `message` | string | Operation status message | +| `commandId` | string | ID of the command that was cancelled | + +### SSM Get Parameter + +Read one parameter from AWS Systems Manager Parameter Store + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `name` | string | Yes | Name of the parameter, optionally with a :version or :label suffix | +| `withDecryption` | boolean | No | Return the decrypted value of a SecureString parameter; ignored for String and StringList parameters | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `name` | string | Name of the parameter | +| `type` | string | Parameter type \(String, StringList, or SecureString\) | +| `value` | string | Parameter value; encrypted unless withDecryption was set for a SecureString | +| `version` | number | Version of the parameter | +| `selector` | string | Version or label selector used to read the parameter | +| `sourceResult` | string | Raw result from the source for a parameter served by another service | +| `lastModifiedDate` | string | When the parameter was last changed | +| `arn` | string | ARN of the parameter | +| `dataType` | string | Data type of the parameter \(text, aws:ec2:image, or aws:ssm:integration\) | + +### SSM Get Parameters + +Read up to ten parameters from AWS Systems Manager Parameter Store by name + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `names` | json | Yes | Parameter names to read, as an array of at most 10 strings | +| `withDecryption` | boolean | No | Return decrypted values for SecureString parameters; ignored for String and StringList parameters | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `parameters` | json | Parameters that were found, each with name, type, value, version, arn, dataType, and lastModifiedDate | +| `invalidParameters` | array | Names that could not be read because they do not exist or are malformed | +| `count` | number | Number of parameters returned | + +### SSM Get Parameters By Path + +Read parameters under a Parameter Store hierarchy path + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `path` | string | Yes | Hierarchy path to read, starting with a slash \(e.g., /prod/app\) | +| `recursive` | boolean | No | Include parameters in nested paths below the given path | +| `withDecryption` | boolean | No | Return decrypted values for SecureString parameters; ignored for String and StringList parameters | +| `parameterFilters` | json | No | Filters, as an array of \{Key, Option, Values\} objects. Valid keys here: Type, KeyId, Label | +| `maxResults` | number | No | Maximum number of parameters to return \(1-10\) | +| `nextToken` | string | No | Pagination token from a previous request | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `parameters` | json | Parameters under the path, each with name, type, value, version, arn, dataType, and lastModifiedDate | +| `nextToken` | string | Pagination token for the next page of results | +| `count` | number | Number of parameters returned | + +### SSM Put Parameter + +Create or update a parameter in AWS Systems Manager Parameter Store + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `name` | string | Yes | Name of the parameter, optionally using a slash-separated hierarchy | +| `value` | string | Yes | Value to store | +| `type` | string | No | Parameter type \(String, StringList, or SecureString\); required when creating a new parameter | +| `description` | string | No | Description of the parameter | +| `keyId` | string | No | KMS key ID or ARN used to encrypt a SecureString parameter; defaults to the account key | +| `overwrite` | boolean | No | Overwrite the parameter if it already exists | +| `allowedPattern` | string | No | Regular expression the value must match | +| `tier` | string | No | Parameter tier \(Standard, Advanced, or Intelligent-Tiering\) | +| `dataType` | string | No | Data type of the parameter \(text, aws:ec2:image, or aws:ssm:integration\) | +| `policies` | string | No | Parameter policies as a JSON array string; Advanced tier only | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `message` | string | Operation status message | +| `name` | string | Name of the parameter that was written | +| `version` | number | Version number the write produced | +| `tier` | string | Tier the parameter was stored in | + +### SSM Delete Parameter + +Delete a parameter from AWS Systems Manager Parameter Store + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `name` | string | Yes | Name of the parameter to delete | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `message` | string | Operation status message | +| `name` | string | Name of the parameter that was deleted | + +### SSM Describe Parameters + +List Parameter Store parameter metadata without reading any values + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `parameterFilters` | json | No | Filters, as an array of \{Key, Option, Values\} objects. Valid keys: Name, Type, KeyId, Path, Tier, DataType, or tag:<key> | +| `shared` | boolean | No | Return parameters shared with this account instead of parameters it owns | +| `maxResults` | number | No | Maximum number of parameters to return \(1-50\) | +| `nextToken` | string | No | Pagination token from a previous request | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `parameters` | json | Parameter metadata, each with name, arn, type, keyId, description, tier, version, dataType, allowedPattern, lastModifiedDate, lastModifiedUser, and policies. Values are never included | +| `nextToken` | string | Pagination token for the next page of results | +| `count` | number | Number of parameters returned | + +### SSM Describe Instance Information + +List managed nodes registered with AWS Systems Manager and their agent status + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `filters` | json | No | Filters, as an array of \{Key, Values\} objects. Valid keys: InstanceIds, AgentVersion, PingStatus, PlatformTypes, ActivationIds, IamRole, ResourceType, AssociationStatus, SourceIds, SourceTypes, tag-key, or tag:<key> | +| `maxResults` | number | No | Maximum number of nodes to return \(5-50\) | +| `nextToken` | string | No | Pagination token from a previous request | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `instances` | json | Managed nodes, each with instanceId, pingStatus, lastPingDateTime, agentVersion, isLatestVersion, platformType, platformName, platformVersion, computerName, ipAddress, iamRole, resourceType, and associationStatus | +| `nextToken` | string | Pagination token for the next page of results | +| `count` | number | Number of managed nodes returned | + +### SSM Describe Instance Patches + +List the patches reported for one managed node + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `instanceId` | string | Yes | Managed node to report patches for \(e.g., i-0123456789abcdef0\) | +| `filters` | json | No | Filters, as an array of \{Key, Values\} objects. Valid keys: Classification, KBId, Severity, State | +| `maxResults` | number | No | Maximum number of patches to return \(10-100\) | +| `nextToken` | string | No | Pagination token from a previous request | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `patches` | json | Patches, each with title, kbId, classification, severity, state, installedTime, and cveIds | +| `nextToken` | string | Pagination token for the next page of results | +| `count` | number | Number of patches returned | + +### SSM Describe Instance Patch States + +Read patch compliance summaries for a set of managed nodes + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `instanceIds` | json | Yes | Managed node IDs to summarize, as an array of at most 50 strings | +| `maxResults` | number | No | Maximum number of patch states to return \(10-100\) | +| `nextToken` | string | No | Pagination token from a previous request | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `instancePatchStates` | json | Patch states, each with instanceId, patchGroup, baselineId, operation, operationStartTime, operationEndTime, installedCount, missingCount, failedCount, notApplicableCount, criticalNonCompliantCount, and securityNonCompliantCount | +| `nextToken` | string | Pagination token for the next page of results | +| `count` | number | Number of patch states returned | + +### SSM List Compliance Items + +List individual compliance findings reported to AWS Systems Manager + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `resourceIds` | json | No | Resource to report on, as an array holding a single managed node ID | +| `resourceTypes` | json | No | Resource type to report on, as an array holding a single value; currently only ManagedInstance is supported | +| `filters` | json | No | Filters, as an array of \{Key, Values, Type\} objects. Type is one of EQUAL, NOT_EQUAL, BEGIN_WITH, LESS_THAN, GREATER_THAN | +| `maxResults` | number | No | Maximum number of compliance items to return \(1-50\) | +| `nextToken` | string | No | Pagination token from a previous request | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `complianceItems` | json | Compliance items, each with complianceType, resourceType, resourceId, id, title, status, severity, executionTime, executionId, executionType, and details | +| `nextToken` | string | Pagination token for the next page of results | +| `count` | number | Number of compliance items returned | + +### SSM List Compliance Summaries + +Read compliant and non-compliant counts per compliance type + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `filters` | json | No | Filters, as an array of \{Key, Values, Type\} objects. Type is one of EQUAL, NOT_EQUAL, BEGIN_WITH, LESS_THAN, GREATER_THAN | +| `maxResults` | number | No | Maximum number of summaries to return \(1-50\) | +| `nextToken` | string | No | Pagination token from a previous request | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `complianceSummaryItems` | json | Summaries, each with complianceType, compliantCount, compliantSeveritySummary, nonCompliantCount, and nonCompliantSeveritySummary | +| `nextToken` | string | Pagination token for the next page of results | +| `count` | number | Number of summaries returned | + +### SSM Start Automation Execution + +Start an AWS Systems Manager Automation runbook execution + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `documentName` | string | Yes | Name of the Automation runbook to run \(e.g., AWS-RestartEC2Instance\) | +| `documentVersion` | string | No | Runbook version to run \($LATEST, $DEFAULT, or a version number\) | +| `parameters` | json | No | Runbook parameters, as an object mapping each parameter name to an array of string values | +| `mode` | string | No | Execution mode, Auto or Interactive | +| `targetParameterName` | string | No | Runbook parameter that receives each resolved target; required when targets is set | +| `targets` | json | No | Rate-control target, as an array holding a single \{Key, Values\} object; requires targetParameterName | +| `maxConcurrency` | string | No | Number or percentage of targets to run against at once \(e.g., 10 or 50%\) | +| `maxErrors` | string | No | Number or percentage of errors allowed before the execution stops \(e.g., 0 or 10%\) | +| `clientToken` | string | No | Idempotency token, exactly 36 characters | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `automationExecutionId` | string | ID of the execution; pass it to ssm_get_automation_execution or ssm_stop_automation_execution | + +### SSM Describe Automation Executions + +List Automation runbook executions in an AWS account + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `filters` | json | No | Filters, as an array of \{Key, Values\} objects. Valid keys: DocumentNamePrefix, ExecutionStatus, ExecutionId, ParentExecutionId, CurrentAction, StartTimeBefore, StartTimeAfter, AutomationType, TagKey, TargetResourceGroup, AutomationSubtype, OpsItemId | +| `maxResults` | number | No | Maximum number of executions to return \(1-50\) | +| `nextToken` | string | No | Pagination token from a previous request | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `automationExecutions` | json | Executions, each with automationExecutionId, documentName, documentVersion, automationExecutionStatus, executionStartTime, executionEndTime, executedBy, currentStepName, currentAction, failureMessage, and outputs | +| `nextToken` | string | Pagination token for the next page of results | +| `count` | number | Number of executions returned | + +### SSM Get Automation Execution + +Read the status, outputs, and step results of one Automation execution + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `automationExecutionId` | string | Yes | ID of the execution, as returned by ssm_start_automation_execution | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `automationExecutionId` | string | ID of the execution | +| `documentName` | string | Runbook that was run | +| `documentVersion` | string | Runbook version that was run | +| `automationExecutionStatus` | string | Execution status \(Pending, InProgress, Waiting, Success, TimedOut, Cancelling, Cancelled, Failed, and related values\) | +| `executionStartTime` | string | When the execution started | +| `executionEndTime` | string | When the execution finished | +| `executedBy` | string | IAM identity that started the execution | +| `mode` | string | Execution mode, Auto or Interactive | +| `parentAutomationExecutionId` | string | ID of the parent execution, for a child execution | +| `currentStepName` | string | Step the execution is currently running | +| `currentAction` | string | Action the execution is currently running | +| `failureMessage` | string | Reason the execution failed | +| `targetParameterName` | string | Runbook parameter that received each resolved target | +| `target` | string | Resource the execution targeted | +| `maxConcurrency` | string | Concurrency setting the execution ran with | +| `maxErrors` | string | Error threshold the execution ran with | +| `parameters` | json | Parameter values the execution was started with | +| `outputs` | json | Outputs the execution produced | +| `stepExecutions` | json | Steps, each with stepName, action, stepStatus, stepExecutionId, executionStartTime, executionEndTime, failureMessage, response, isEnd, and nextStep | +| `stepExecutionsTruncated` | boolean | Whether the returned step list was truncated | + +### SSM Stop Automation Execution + +Stop a running AWS Systems Manager Automation execution + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `automationExecutionId` | string | Yes | ID of the execution to stop, as returned by ssm_start_automation_execution | +| `stopType` | string | No | How to stop the execution: Cancel to stop it immediately, or Complete to let the current step finish | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `message` | string | Operation status message | +| `automationExecutionId` | string | ID of the execution that was stopped | + +### SSM List Documents + +List SSM documents and runbooks available to an AWS account + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `filters` | json | No | Filters, as an array of \{Key, Values\} objects. Valid keys: Name, Owner, DocumentType, PlatformTypes, TargetType, or tag:<key> | +| `maxResults` | number | No | Maximum number of documents to return \(1-50\) | +| `nextToken` | string | No | Pagination token from a previous request | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `documents` | json | Documents, each with name, displayName, owner, documentType, documentFormat, documentVersion, schemaVersion, platformTypes, targetType, createdDate, reviewStatus, author, and tags | +| `nextToken` | string | Pagination token for the next page of results | +| `count` | number | Number of documents returned | + +### SSM Get Document + +Read the content of an SSM document or Automation runbook + +#### Input + +| Parameter | Type | Required | Description | +| --------- | ---- | -------- | ----------- | +| `region` | string | Yes | AWS region \(e.g., us-east-1\) | +| `accessKeyId` | string | Yes | AWS access key ID | +| `secretAccessKey` | string | Yes | AWS secret access key | +| `name` | string | Yes | Name of the document to read, as returned by ssm_list_documents | +| `documentVersion` | string | No | Document version to read \($LATEST, $DEFAULT, or a version number\) | +| `versionName` | string | No | User-defined version name to read | +| `documentFormat` | string | No | Format to return the content in: JSON, YAML, or TEXT | + +#### Output + +| Parameter | Type | Description | +| --------- | ---- | ----------- | +| `name` | string | Name of the document | +| `displayName` | string | Friendly name of the document | +| `createdDate` | string | When the document was created | +| `versionName` | string | User-defined version name | +| `documentVersion` | string | Document version that was returned | +| `status` | string | Document status \(Creating, Active, Updating, Deleting, Failed\) | +| `statusInformation` | string | Detail about the document status | +| `content` | string | Content of the document in the requested format | +| `documentType` | string | Type of the document \(Command, Automation, Policy, Session, and related values\) | +| `documentFormat` | string | Format the content is returned in | +| `reviewStatus` | string | Review status of the document \(APPROVED, NOT_REVIEWED, PENDING, REJECTED\) | + + diff --git a/apps/sim/blocks/blocks/cloudtrail.test.ts b/apps/sim/blocks/blocks/cloudtrail.test.ts new file mode 100644 index 00000000000..fa6527863b9 --- /dev/null +++ b/apps/sim/blocks/blocks/cloudtrail.test.ts @@ -0,0 +1,64 @@ +/** + * @vitest-environment node + * + * A dropdown subBlock with no `value()` seeds and persists its first selectable option, + * so a block's *default* configuration is not necessarily one that runs. These tests + * exercise the default the user actually gets on drop, which no other suite covers. + */ +import { describe, expect, it } from 'vitest' +import { CloudTrailBlock } from '@/blocks/blocks/cloudtrail' + +type SubBlock = (typeof CloudTrailBlock.subBlocks)[number] + +function subBlock(id: string): SubBlock { + const found = CloudTrailBlock.subBlocks.find((block) => block.id === id) + if (!found) throw new Error(`missing subBlock ${id}`) + return found +} + +/** Mirrors the dropdown's seeding rule: an explicit `value()` wins, else the first option. */ +function seededValue(block: SubBlock): unknown { + if (typeof block.value === 'function') return block.value() + const options = block.options + if (!Array.isArray(options)) return undefined + const first = options[0] as { id?: unknown } | undefined + return first?.id +} + +describe('CloudTrail block defaults', () => { + it('seeds no lookup filter attribute, so the default run is unfiltered', () => { + expect(seededValue(subBlock('attributeKey'))).toBe('') + }) + + it('offers a selectable no-filter option so the choice can be undone', () => { + const options = subBlock('attributeKey').options as Array<{ id: string; label: string }> + expect(options[0]).toMatchObject({ id: '' }) + expect(options.filter((option) => option.id === '')).toHaveLength(1) + }) + + it('does not throw on the configuration a freshly dropped block produces', () => { + const params = { + operation: 'lookup_events', + awsRegion: 'us-east-1', + awsAccessKeyId: 'AKIAIOSFODNN7EXAMPLE', + awsSecretAccessKey: 'secret', + attributeKey: seededValue(subBlock('attributeKey')), + attributeValue: '', + } + + expect(() => CloudTrailBlock.tools.config?.params?.(params)).not.toThrow() + }) + + it('still rejects a half-supplied filter', () => { + const params = { + operation: 'lookup_events', + awsRegion: 'us-east-1', + awsAccessKeyId: 'AKIAIOSFODNN7EXAMPLE', + awsSecretAccessKey: 'secret', + attributeKey: 'Username', + attributeValue: '', + } + + expect(() => CloudTrailBlock.tools.config?.params?.(params)).toThrow(/filter/i) + }) +}) diff --git a/apps/sim/blocks/blocks/cloudtrail.ts b/apps/sim/blocks/blocks/cloudtrail.ts new file mode 100644 index 00000000000..c34c8fcc450 --- /dev/null +++ b/apps/sim/blocks/blocks/cloudtrail.ts @@ -0,0 +1,894 @@ +import { CloudTrailIcon } from '@/components/icons' +import type { BlockConfig, BlockMeta } from '@/blocks/types' +import { AuthMode, IntegrationType } from '@/blocks/types' +import type { + CloudTrailCancelQueryResponse, + CloudTrailDescribeQueryResponse, + CloudTrailDescribeTrailsResponse, + CloudTrailGetEventDataStoreResponse, + CloudTrailGetEventSelectorsResponse, + CloudTrailGetInsightSelectorsResponse, + CloudTrailGetQueryResultsResponse, + CloudTrailGetTrailResponse, + CloudTrailGetTrailStatusResponse, + CloudTrailListEventDataStoresResponse, + CloudTrailListTagsResponse, + CloudTrailListTrailsResponse, + CloudTrailLookupEventsResponse, + CloudTrailStartQueryResponse, +} from '@/tools/cloudtrail/types' + +/** Operations that accept an opaque AWS pagination token. */ +const PAGINATED_OPERATIONS = [ + 'lookup_events', + 'list_trails', + 'get_query_results', + 'list_event_data_stores', + 'list_tags', +] + +/** Operations addressed by a single trail name or trail ARN. */ +const TRAIL_SCOPED_OPERATIONS = [ + 'get_trail', + 'get_trail_status', + 'get_event_selectors', + 'get_insight_selectors', +] + +function parseBoundedInt(value: unknown): number | undefined { + if (value === undefined || value === null || value === '') return undefined + const parsed = Number.parseInt(String(value), 10) + return Number.isNaN(parsed) ? undefined : parsed +} + +export const CloudTrailBlock: BlockConfig< + | CloudTrailLookupEventsResponse + | CloudTrailDescribeTrailsResponse + | CloudTrailGetTrailResponse + | CloudTrailGetTrailStatusResponse + | CloudTrailListTrailsResponse + | CloudTrailGetEventSelectorsResponse + | CloudTrailGetInsightSelectorsResponse + | CloudTrailStartQueryResponse + | CloudTrailDescribeQueryResponse + | CloudTrailGetQueryResultsResponse + | CloudTrailCancelQueryResponse + | CloudTrailListEventDataStoresResponse + | CloudTrailGetEventDataStoreResponse + | CloudTrailListTagsResponse +> = { + type: 'cloudtrail', + name: 'CloudTrail', + description: 'Audit who did what in AWS with CloudTrail event history and Lake queries', + longDescription: + 'Integrate AWS CloudTrail into workflows. Look up the last 90 days of management and Insights events by user, event name, resource, or access key; inspect trail configuration, logging status, and event selectors; and run SQL queries against CloudTrail Lake event data stores. This block never changes trail or event data store configuration, and never starts or stops logging. Starting and cancelling a Lake query are the only actions that are not reads, and AWS bills Lake queries on the data they scan. Requires AWS access key and secret access key.', + docsLink: 'https://docs.sim.ai/integrations/cloudtrail', + category: 'tools', + integrationType: IntegrationType.Security, + authMode: AuthMode.ApiKey, + bgColor: 'linear-gradient(45deg, #B0084D 0%, #FF4F8B 100%)', + iconColor: '#FF4F8B', + icon: CloudTrailIcon, + canvasPresentation: { + defaultTitle: 'CloudTrail', + sentences: { + byOperation: { + lookup_events: [ + 'Look up CloudTrail events', + { text: 'where', field: 'attributeKey' }, + { text: 'is', field: 'attributeValue', core: true }, + { text: ', since', field: 'startTime' }, + { text: ', up to', field: 'lookupMaxResults', after: 'events' }, + ], + describe_trails: [ + 'Describe trails', + { text: ', limited to', field: 'trailNameList', core: true }, + ], + get_trail: [{ text: 'Read the settings of trail', field: 'trailName', core: true }], + get_trail_status: [ + { text: 'Check the logging status of trail', field: 'trailName', core: true }, + ], + list_trails: ['List every CloudTrail trail'], + get_event_selectors: [ + { text: 'Read the event selectors of trail', field: 'trailName', core: true }, + ], + get_insight_selectors: [ + 'Read Insights selectors', + { text: 'for trail', field: 'trailName', core: true }, + { text: 'for event data store', field: 'eventDataStore' }, + ], + start_query: [ + { text: 'Run the CloudTrail Lake query', field: 'queryStatement', core: true }, + { text: 'using template', field: 'queryAlias' }, + ], + describe_query: [ + { text: 'Check the status of Lake query', field: 'queryId', core: true }, + { text: 'for template', field: 'queryAlias' }, + ], + get_query_results: [ + { text: 'Fetch the results of Lake query', field: 'queryId', core: true }, + { text: ', up to', field: 'maxQueryResults', after: 'rows' }, + ], + cancel_query: [{ text: 'Cancel Lake query', field: 'queryId', core: true }], + list_event_data_stores: [ + 'List CloudTrail Lake event data stores', + { text: ', up to', field: 'eventDataStoreMaxResults' }, + ], + get_event_data_store: [ + { text: 'Read the event data store', field: 'eventDataStore', core: true }, + ], + list_tags: [{ text: 'List the tags on', field: 'resourceIdList', core: true }], + }, + }, + }, + subBlocks: [ + { + id: 'operation', + title: 'Operation', + type: 'dropdown', + options: [ + { label: 'Look Up Events', id: 'lookup_events' }, + { label: 'Describe Trails', id: 'describe_trails' }, + { label: 'Get Trail', id: 'get_trail' }, + { label: 'Get Trail Status', id: 'get_trail_status' }, + { label: 'List Trails', id: 'list_trails' }, + { label: 'Get Event Selectors', id: 'get_event_selectors' }, + { label: 'Get Insight Selectors', id: 'get_insight_selectors' }, + { label: 'Start Lake Query', id: 'start_query' }, + { label: 'Describe Lake Query', id: 'describe_query' }, + { label: 'Get Lake Query Results', id: 'get_query_results' }, + { label: 'Cancel Lake Query', id: 'cancel_query' }, + { label: 'List Event Data Stores', id: 'list_event_data_stores' }, + { label: 'Get Event Data Store', id: 'get_event_data_store' }, + { label: 'List Tags', id: 'list_tags' }, + ], + value: () => 'lookup_events', + }, + { + id: 'awsRegion', + title: 'AWS Region', + type: 'short-input', + placeholder: 'us-east-1', + required: true, + }, + { + id: 'awsAccessKeyId', + title: 'AWS Access Key ID', + type: 'short-input', + placeholder: 'AKIA...', + password: true, + required: true, + }, + { + id: 'awsSecretAccessKey', + title: 'AWS Secret Access Key', + type: 'short-input', + placeholder: 'Your secret access key', + password: true, + required: true, + }, + { + id: 'attributeKey', + title: 'Filter By', + type: 'dropdown', + /** + * Every LookupEvents attribute is optional, so an unfiltered Region-wide lookup is + * the correct default. A dropdown with no `value()` seeds and persists its first + * selectable option, which would pair an attribute with an empty value and trip the + * both-or-neither guard before any AWS call — so the no-filter sentinel has to be a + * real, selectable option the user can also return to. + */ + value: () => '', + options: [ + { label: 'No filter', id: '' }, + { label: 'User Name', id: 'Username' }, + { label: 'Event Name', id: 'EventName' }, + { label: 'Event Source', id: 'EventSource' }, + { label: 'Event ID', id: 'EventId' }, + { label: 'Resource Name', id: 'ResourceName' }, + { label: 'Resource Type', id: 'ResourceType' }, + { label: 'Access Key ID', id: 'AccessKeyId' }, + { label: 'Read Only', id: 'ReadOnly' }, + ], + condition: { field: 'operation', value: 'lookup_events' }, + }, + { + id: 'attributeValue', + title: 'Filter Value', + type: 'short-input', + placeholder: 'e.g., ConsoleLogin, alice, arn:aws:s3:::my-bucket', + condition: { field: 'operation', value: 'lookup_events' }, + }, + { + id: 'startTime', + title: 'Start Time', + type: 'short-input', + placeholder: '2026-09-01T00:00:00Z', + condition: { field: 'operation', value: 'lookup_events' }, + mode: 'advanced', + wandConfig: { + enabled: true, + prompt: + 'Generate an ISO 8601 timestamp with a UTC offset for the start of the requested CloudTrail lookup window. CloudTrail event history only covers the last 90 days. Return ONLY the timestamp string.', + placeholder: 'Describe the start of the time window...', + generationType: 'timestamp', + }, + }, + { + id: 'endTime', + title: 'End Time', + type: 'short-input', + placeholder: '2026-09-04T00:00:00Z', + condition: { field: 'operation', value: 'lookup_events' }, + mode: 'advanced', + wandConfig: { + enabled: true, + prompt: + 'Generate an ISO 8601 timestamp with a UTC offset for the end of the requested CloudTrail lookup window. Return ONLY the timestamp string.', + placeholder: 'Describe the end of the time window...', + generationType: 'timestamp', + }, + }, + { + id: 'eventCategory', + title: 'Event Category', + type: 'dropdown', + options: [ + { label: 'Management events', id: 'management' }, + { label: 'Insights events', id: 'insight' }, + ], + condition: { field: 'operation', value: 'lookup_events' }, + mode: 'advanced', + value: () => 'management', + }, + { + id: 'lookupMaxResults', + title: 'Max Events', + type: 'short-input', + placeholder: '50 (AWS caps Look Up Events at 50 per page)', + condition: { field: 'operation', value: 'lookup_events' }, + mode: 'advanced', + }, + { + id: 'trailNameList', + title: 'Trail Names or ARNs', + type: 'long-input', + placeholder: 'Comma-separated names or ARNs. Leave empty for every trail in the Region', + condition: { field: 'operation', value: 'describe_trails' }, + }, + { + id: 'includeShadowTrails', + title: 'Shadow Trails', + type: 'dropdown', + options: [ + { label: 'Include (AWS default)', id: 'true' }, + { label: 'Exclude', id: 'false' }, + ], + condition: { field: 'operation', value: 'describe_trails' }, + mode: 'advanced', + value: () => 'true', + }, + { + id: 'trailName', + title: 'Trail Name or ARN', + type: 'short-input', + placeholder: 'my-org-trail, or arn:aws:cloudtrail:us-east-2:123456789012:trail/my-org-trail', + condition: { field: 'operation', value: TRAIL_SCOPED_OPERATIONS }, + required: { + field: 'operation', + value: ['get_trail', 'get_trail_status', 'get_event_selectors'], + }, + }, + { + id: 'eventDataStore', + title: 'Event Data Store', + type: 'short-input', + placeholder: 'ARN, or the ID suffix of the ARN', + condition: { + field: 'operation', + value: ['get_insight_selectors', 'get_event_data_store'], + }, + required: { field: 'operation', value: 'get_event_data_store' }, + }, + { + id: 'queryStatement', + title: 'Lake SQL Query', + type: 'code', + placeholder: + "SELECT eventTime, eventName, userIdentity.arn FROM WHERE eventName = 'ConsoleLogin' LIMIT 100", + condition: { field: 'operation', value: 'start_query' }, + wandConfig: { + enabled: true, + prompt: `Generate a CloudTrail Lake SQL query from the user's description. +CloudTrail Lake uses a Presto-based SQL dialect. The FROM clause names the event data store ID (not a table name). +Common columns: eventTime, eventName, eventSource, awsRegion, sourceIPAddress, userAgent, errorCode, errorMessage, +readOnly, recipientAccountId, requestParameters, responseElements, and the userIdentity struct +(userIdentity.type, userIdentity.arn, userIdentity.principalId, userIdentity.accountId, +userIdentity.sessionContext.sessionIssuer.userName). + +Examples: +- SELECT eventTime, eventName, userIdentity.arn FROM WHERE eventTime > '2026-08-01 00:00:00' LIMIT 100 +- SELECT userIdentity.arn, count(*) AS calls FROM WHERE errorCode IS NOT NULL GROUP BY userIdentity.arn +- SELECT eventName, sourceIPAddress FROM WHERE eventSource = 'iam.amazonaws.com' AND readOnly = false + +Return ONLY the SQL query — no explanations, no markdown code blocks.`, + placeholder: 'Describe the audit question you want answered...', + generationType: 'sql-query', + }, + }, + { + id: 'queryAlias', + title: 'Query Template Alias', + type: 'short-input', + placeholder: 'Alias of a CloudTrail Lake dashboard query template', + condition: { field: 'operation', value: ['start_query', 'describe_query'] }, + mode: 'advanced', + }, + { + id: 'queryParameters', + title: 'Query Template Parameters', + type: 'long-input', + placeholder: 'Comma-separated values for the query template, up to 10', + condition: { field: 'operation', value: 'start_query' }, + mode: 'advanced', + }, + { + id: 'deliveryS3Uri', + title: 'Results S3 URI', + type: 'short-input', + placeholder: 's3://my-cloudtrail-lake-results/', + condition: { field: 'operation', value: 'start_query' }, + mode: 'advanced', + }, + { + id: 'queryId', + title: 'Query ID', + type: 'short-input', + placeholder: 'e.g., a1b2c3d4-5678-90ab-cdef-example11111', + condition: { + field: 'operation', + value: ['describe_query', 'get_query_results', 'cancel_query'], + }, + required: { field: 'operation', value: ['get_query_results', 'cancel_query'] }, + }, + { + id: 'refreshId', + title: 'Dashboard Refresh ID', + type: 'short-input', + placeholder: 'Numeric refresh ID, used with a query template alias', + condition: { field: 'operation', value: 'describe_query' }, + mode: 'advanced', + }, + { + id: 'maxQueryResults', + title: 'Max Rows', + type: 'short-input', + placeholder: '100 (AWS caps Lake query results at 1000 per page)', + condition: { field: 'operation', value: 'get_query_results' }, + mode: 'advanced', + }, + { + id: 'eventDataStoreMaxResults', + title: 'Max Event Data Stores', + type: 'short-input', + placeholder: '50 (AWS caps this at 1000 per page)', + condition: { field: 'operation', value: 'list_event_data_stores' }, + mode: 'advanced', + }, + { + id: 'eventDataStoreOwnerAccountId', + title: 'Event Data Store Owner Account ID', + type: 'short-input', + placeholder: '123456789012', + condition: { + field: 'operation', + value: ['start_query', 'describe_query', 'get_query_results', 'cancel_query'], + }, + mode: 'advanced', + }, + { + id: 'resourceIdList', + title: 'Resource ARNs', + type: 'long-input', + placeholder: 'Comma-separated trail, event data store, dashboard, or channel ARNs (up to 20)', + condition: { field: 'operation', value: 'list_tags' }, + required: { field: 'operation', value: 'list_tags' }, + }, + { + id: 'nextToken', + title: 'Pagination Token', + type: 'short-input', + placeholder: 'Token from a previous request', + condition: { field: 'operation', value: PAGINATED_OPERATIONS }, + mode: 'advanced', + }, + ], + tools: { + access: [ + 'cloudtrail_lookup_events', + 'cloudtrail_describe_trails', + 'cloudtrail_get_trail', + 'cloudtrail_get_trail_status', + 'cloudtrail_list_trails', + 'cloudtrail_get_event_selectors', + 'cloudtrail_get_insight_selectors', + 'cloudtrail_start_query', + 'cloudtrail_describe_query', + 'cloudtrail_get_query_results', + 'cloudtrail_cancel_query', + 'cloudtrail_list_event_data_stores', + 'cloudtrail_get_event_data_store', + 'cloudtrail_list_tags', + ], + config: { + tool: (params) => { + switch (params.operation) { + case 'lookup_events': + return 'cloudtrail_lookup_events' + case 'describe_trails': + return 'cloudtrail_describe_trails' + case 'get_trail': + return 'cloudtrail_get_trail' + case 'get_trail_status': + return 'cloudtrail_get_trail_status' + case 'list_trails': + return 'cloudtrail_list_trails' + case 'get_event_selectors': + return 'cloudtrail_get_event_selectors' + case 'get_insight_selectors': + return 'cloudtrail_get_insight_selectors' + case 'start_query': + return 'cloudtrail_start_query' + case 'describe_query': + return 'cloudtrail_describe_query' + case 'get_query_results': + return 'cloudtrail_get_query_results' + case 'cancel_query': + return 'cloudtrail_cancel_query' + case 'list_event_data_stores': + return 'cloudtrail_list_event_data_stores' + case 'get_event_data_store': + return 'cloudtrail_get_event_data_store' + case 'list_tags': + return 'cloudtrail_list_tags' + default: + throw new Error(`Invalid CloudTrail operation: ${params.operation}`) + } + }, + params: (params) => { + const { operation, ...rest } = params + + const awsRegion = rest.awsRegion + const awsAccessKeyId = rest.awsAccessKeyId + const awsSecretAccessKey = rest.awsSecretAccessKey + const credentials = { awsRegion, awsAccessKeyId, awsSecretAccessKey } + + switch (operation) { + case 'lookup_events': { + const maxResults = parseBoundedInt(rest.lookupMaxResults) + if (Boolean(rest.attributeKey) !== Boolean(rest.attributeValue)) { + throw new Error('Provide both a filter attribute and a filter value, or neither') + } + return { + ...credentials, + ...(rest.attributeKey && { + attributeKey: rest.attributeKey, + attributeValue: rest.attributeValue, + }), + ...(rest.startTime && { startTime: rest.startTime }), + ...(rest.endTime && { endTime: rest.endTime }), + ...(rest.eventCategory === 'insight' && { eventCategory: 'insight' }), + ...(maxResults !== undefined && { maxResults }), + ...(rest.nextToken && { nextToken: rest.nextToken }), + } + } + + case 'describe_trails': + return { + ...credentials, + ...(rest.trailNameList && { trailNameList: rest.trailNameList }), + ...(rest.includeShadowTrails !== undefined && + rest.includeShadowTrails !== '' && { + includeShadowTrails: String(rest.includeShadowTrails) !== 'false', + }), + } + + case 'get_trail': + case 'get_trail_status': + if (!rest.trailName) { + throw new Error('Trail name or ARN is required') + } + return { ...credentials, name: rest.trailName } + + case 'list_trails': + return { + ...credentials, + ...(rest.nextToken && { nextToken: rest.nextToken }), + } + + case 'get_event_selectors': + if (!rest.trailName) { + throw new Error('Trail name or ARN is required') + } + return { ...credentials, trailName: rest.trailName } + + case 'get_insight_selectors': + if (Boolean(rest.trailName) === Boolean(rest.eventDataStore)) { + throw new Error( + 'Specify exactly one of trail name or event data store for Insights selectors' + ) + } + return { + ...credentials, + ...(rest.trailName && { trailName: rest.trailName }), + ...(rest.eventDataStore && { eventDataStore: rest.eventDataStore }), + } + + case 'start_query': + if (Boolean(rest.queryStatement) === Boolean(rest.queryAlias)) { + throw new Error('Specify exactly one of Lake SQL query or query template alias') + } + return { + ...credentials, + ...(rest.queryStatement && { queryStatement: rest.queryStatement }), + ...(rest.queryAlias && { queryAlias: rest.queryAlias }), + ...(rest.queryParameters && { queryParameters: rest.queryParameters }), + ...(rest.deliveryS3Uri && { deliveryS3Uri: rest.deliveryS3Uri }), + ...(rest.eventDataStoreOwnerAccountId && { + eventDataStoreOwnerAccountId: rest.eventDataStoreOwnerAccountId, + }), + } + + case 'describe_query': + if (Boolean(rest.queryId) === Boolean(rest.queryAlias)) { + throw new Error('Specify exactly one of query ID or query template alias') + } + return { + ...credentials, + ...(rest.queryId && { queryId: rest.queryId }), + ...(rest.queryAlias && { queryAlias: rest.queryAlias }), + ...(rest.refreshId && { refreshId: rest.refreshId }), + ...(rest.eventDataStoreOwnerAccountId && { + eventDataStoreOwnerAccountId: rest.eventDataStoreOwnerAccountId, + }), + } + + case 'get_query_results': { + if (!rest.queryId) { + throw new Error('Query ID is required') + } + const maxQueryResults = parseBoundedInt(rest.maxQueryResults) + return { + ...credentials, + queryId: rest.queryId, + ...(maxQueryResults !== undefined && { maxQueryResults }), + ...(rest.nextToken && { nextToken: rest.nextToken }), + ...(rest.eventDataStoreOwnerAccountId && { + eventDataStoreOwnerAccountId: rest.eventDataStoreOwnerAccountId, + }), + } + } + + case 'cancel_query': + if (!rest.queryId) { + throw new Error('Query ID is required') + } + return { + ...credentials, + queryId: rest.queryId, + ...(rest.eventDataStoreOwnerAccountId && { + eventDataStoreOwnerAccountId: rest.eventDataStoreOwnerAccountId, + }), + } + + case 'list_event_data_stores': { + const maxResults = parseBoundedInt(rest.eventDataStoreMaxResults) + return { + ...credentials, + ...(maxResults !== undefined && { maxResults }), + ...(rest.nextToken && { nextToken: rest.nextToken }), + } + } + + case 'get_event_data_store': + if (!rest.eventDataStore) { + throw new Error('Event data store ARN or ID is required') + } + return { ...credentials, eventDataStore: rest.eventDataStore } + + case 'list_tags': + if (!rest.resourceIdList) { + throw new Error('At least one resource ARN is required') + } + return { + ...credentials, + resourceIdList: rest.resourceIdList, + ...(rest.nextToken && { nextToken: rest.nextToken }), + } + + default: + throw new Error(`Invalid CloudTrail operation: ${operation}`) + } + }, + }, + }, + inputs: { + operation: { type: 'string', description: 'CloudTrail operation to perform' }, + awsRegion: { type: 'string', description: 'AWS region' }, + awsAccessKeyId: { type: 'string', description: 'AWS access key ID' }, + awsSecretAccessKey: { type: 'string', description: 'AWS secret access key' }, + attributeKey: { type: 'string', description: 'Lookup attribute to filter events on' }, + attributeValue: { type: 'string', description: 'Value the lookup attribute must equal' }, + startTime: { type: 'string', description: 'Start of the lookup window (ISO 8601)' }, + endTime: { type: 'string', description: 'End of the lookup window (ISO 8601)' }, + eventCategory: { type: 'string', description: 'Management or Insights event category' }, + lookupMaxResults: { type: 'number', description: 'Maximum events to look up (1-50)' }, + trailNameList: { type: 'string', description: 'Comma-separated trail names or ARNs' }, + includeShadowTrails: { type: 'string', description: 'Whether to include shadow trails' }, + trailName: { type: 'string', description: 'Trail name or trail ARN' }, + eventDataStore: { type: 'string', description: 'Event data store ARN or ID suffix' }, + queryStatement: { type: 'string', description: 'CloudTrail Lake SQL query' }, + queryAlias: { type: 'string', description: 'CloudTrail Lake query template alias' }, + queryParameters: { + type: 'string', + description: 'Comma-separated parameter values for a query template', + }, + deliveryS3Uri: { type: 'string', description: 'S3 URI for delivered query results' }, + queryId: { type: 'string', description: 'CloudTrail Lake query ID' }, + refreshId: { type: 'string', description: 'CloudTrail Lake dashboard refresh ID' }, + maxQueryResults: { type: 'number', description: 'Maximum Lake result rows per page (1-1000)' }, + eventDataStoreMaxResults: { + type: 'number', + description: 'Maximum event data stores per page (1-1000)', + }, + eventDataStoreOwnerAccountId: { + type: 'string', + description: 'Account ID of the event data store owner', + }, + resourceIdList: { + type: 'string', + description: 'Comma-separated CloudTrail resource ARNs (up to 20)', + }, + nextToken: { type: 'string', description: 'Pagination token' }, + }, + outputs: { + events: { + type: 'array', + description: + 'Matching CloudTrail events, most recent first, each with the parsed cloudTrailEvent record', + }, + nextToken: { type: 'string', description: 'Pagination token for the next page' }, + trails: { type: 'array', description: 'Trail configurations or trail summaries' }, + name: { type: 'string', description: 'Trail or event data store name' }, + s3BucketName: { type: 'string', description: 'S3 bucket that receives log files' }, + s3KeyPrefix: { type: 'string', description: 'S3 key prefix for delivered log files' }, + snsTopicName: { type: 'string', description: 'SNS topic notified on log delivery' }, + snsTopicArn: { type: 'string', description: 'ARN of the SNS topic notified on log delivery' }, + includeGlobalServiceEvents: { + type: 'boolean', + description: 'Whether the trail records global service events', + }, + isMultiRegionTrail: { + type: 'boolean', + description: 'Whether the trail records events in all Regions', + }, + homeRegion: { type: 'string', description: 'Region in which the trail was created' }, + trailArn: { type: 'string', description: 'ARN of the trail' }, + logFileValidationEnabled: { + type: 'boolean', + description: 'Whether log file integrity validation is enabled', + }, + cloudWatchLogsLogGroupArn: { + type: 'string', + description: 'CloudWatch Logs log group receiving events', + }, + cloudWatchLogsRoleArn: { + type: 'string', + description: 'Role CloudTrail assumes to write to CloudWatch Logs', + }, + kmsKeyId: { type: 'string', description: 'KMS key used for encryption' }, + hasCustomEventSelectors: { + type: 'boolean', + description: 'Whether the trail has custom event selectors', + }, + hasInsightSelectors: { + type: 'boolean', + description: 'Whether the trail has Insights event selectors', + }, + isOrganizationTrail: { + type: 'boolean', + description: 'Whether the trail is an organization trail', + }, + isLogging: { type: 'boolean', description: 'Whether the trail is currently logging' }, + latestDeliveryError: { type: 'string', description: 'Most recent S3 log delivery error' }, + latestDeliveryTime: { type: 'string', description: 'When log files were last delivered to S3' }, + latestNotificationError: { type: 'string', description: 'Most recent SNS notification error' }, + latestNotificationTime: { + type: 'string', + description: 'When the last SNS notification was sent', + }, + latestCloudWatchLogsDeliveryError: { + type: 'string', + description: 'Most recent CloudWatch Logs delivery error', + }, + latestCloudWatchLogsDeliveryTime: { + type: 'string', + description: 'When events were last delivered to CloudWatch Logs', + }, + latestDigestDeliveryError: { type: 'string', description: 'Most recent digest delivery error' }, + latestDigestDeliveryTime: { + type: 'string', + description: 'When a digest file was last delivered', + }, + startLoggingTime: { type: 'string', description: 'When logging was most recently started' }, + stopLoggingTime: { type: 'string', description: 'When logging was most recently stopped' }, + eventSelectors: { type: 'array', description: 'Basic event selectors configured on the trail' }, + advancedEventSelectors: { + type: 'array', + description: 'Advanced event selectors configured on the trail or event data store', + }, + insightSelectors: { type: 'array', description: 'Enabled CloudTrail Insights types' }, + eventDataStoreArn: { type: 'string', description: 'ARN of the event data store' }, + insightsDestination: { + type: 'string', + description: 'Destination event data store that logs Insights events', + }, + queryId: { type: 'string', description: 'CloudTrail Lake query ID' }, + queryString: { type: 'string', description: 'SQL body of the Lake query' }, + queryStatus: { + type: 'string', + description: 'QUEUED, RUNNING, FINISHED, FAILED, CANCELLED, or TIMED_OUT', + }, + errorMessage: { type: 'string', description: 'Error message returned if the query failed' }, + deliveryS3Uri: { type: 'string', description: 'S3 URI the query results were delivered to' }, + deliveryStatus: { type: 'string', description: 'Delivery status of the S3 query results' }, + prompt: { type: 'string', description: 'Prompt used to generate the query, if generated' }, + eventDataStoreOwnerAccountId: { + type: 'string', + description: 'Account ID of the event data store owner', + }, + eventsMatched: { type: 'number', description: 'Number of events that matched the query' }, + eventsScanned: { type: 'number', description: 'Number of events scanned by the query' }, + bytesScanned: { type: 'number', description: 'Bytes scanned by the query' }, + executionTimeInMillis: { type: 'number', description: 'Query run time in milliseconds' }, + creationTime: { type: 'string', description: 'When the query was created' }, + rows: { + type: 'array', + description: 'Lake query result rows, each flattened into a column-to-value object', + }, + resultsCount: { type: 'number', description: 'Number of result rows on this page' }, + totalResultsCount: { type: 'number', description: 'Total rows the query produced' }, + eventDataStores: { type: 'array', description: 'CloudTrail Lake event data stores' }, + status: { type: 'string', description: 'Status of the event data store' }, + multiRegionEnabled: { + type: 'boolean', + description: 'Whether the event data store collects events from all Regions', + }, + organizationEnabled: { + type: 'boolean', + description: 'Whether the event data store collects organization events', + }, + retentionPeriod: { type: 'number', description: 'Event data store retention period in days' }, + terminationProtectionEnabled: { + type: 'boolean', + description: 'Whether termination protection is enabled', + }, + createdTimestamp: { type: 'string', description: 'When the event data store was created' }, + updatedTimestamp: { type: 'string', description: 'When the event data store was last updated' }, + billingMode: { type: 'string', description: 'Event data store billing mode' }, + federationStatus: { type: 'string', description: 'Lake Formation federation status' }, + federationRoleArn: { type: 'string', description: 'Role used for Lake Formation federation' }, + partitionKeys: { type: 'array', description: 'Partition keys of the event data store' }, + resourceTags: { type: 'array', description: 'Tags on each requested CloudTrail resource' }, + }, +} + +export const CloudTrailBlockMeta = { + tags: ['cloud', 'monitoring', 'identity'], + url: 'https://aws.amazon.com/cloudtrail', + templates: [ + { + icon: CloudTrailIcon, + title: 'CloudTrail root login alerter', + prompt: + 'Create a scheduled workflow that looks up AWS CloudTrail ConsoleLogin events every 15 minutes, flags any sign-in by the root user or a login without MFA, and posts the actor, source IP, and time to a Slack security channel.', + modules: ['scheduled', 'agent', 'workflows'], + category: 'operations', + tags: ['security', 'monitoring'], + alsoIntegrations: ['slack'], + }, + { + icon: CloudTrailIcon, + title: 'CloudTrail IAM change review', + prompt: + 'Build a daily workflow that looks up AWS CloudTrail events from iam.amazonaws.com, summarizes every policy attach, role creation, and access key change with the principal who made it, and writes the review to a compliance table.', + modules: ['scheduled', 'tables', 'agent', 'workflows'], + category: 'operations', + tags: ['security', 'compliance'], + alsoIntegrations: ['iam'], + }, + { + icon: CloudTrailIcon, + title: 'CloudTrail trail health monitor', + prompt: + 'Create a scheduled workflow that lists every AWS CloudTrail trail, checks each trail status for logging stopped or recent delivery errors, and opens a PagerDuty incident when a trail stops recording.', + modules: ['scheduled', 'agent', 'workflows'], + category: 'operations', + tags: ['devops', 'monitoring'], + alsoIntegrations: ['pagerduty'], + }, + { + icon: CloudTrailIcon, + title: 'CloudTrail access key forensics', + prompt: + 'Build a workflow that takes an AWS access key ID, looks up every CloudTrail event made with it in the last 90 days, groups the calls by service and source IP, and returns a timeline of what that credential did.', + modules: ['agent', 'workflows'], + category: 'engineering', + tags: ['security', 'analysis'], + alsoIntegrations: ['slack'], + }, + { + icon: CloudTrailIcon, + title: 'CloudTrail Lake audit agent', + prompt: + 'Build a Slack agent that turns natural-language audit questions into CloudTrail Lake SQL, starts the query, polls until it finishes, and returns the result rows with the SQL it ran for review.', + modules: ['agent', 'workflows'], + category: 'engineering', + tags: ['security', 'analysis'], + alsoIntegrations: ['slack'], + }, + { + icon: CloudTrailIcon, + title: 'CloudTrail data-event coverage audit', + prompt: + 'Create a weekly workflow that reads the event selectors of every AWS CloudTrail trail, reports which trails are missing management event logging or S3 data events, and writes the gaps to a compliance table.', + modules: ['scheduled', 'tables', 'agent', 'workflows'], + category: 'operations', + tags: ['compliance', 'devops'], + alsoIntegrations: ['s3'], + }, + { + icon: CloudTrailIcon, + title: 'CloudTrail offboarding evidence pack', + prompt: + 'Build a workflow that, given a departing employee username, looks up all their AWS CloudTrail activity from the last 90 days, summarizes the resources they touched, and emails an evidence pack to the security team.', + modules: ['agent', 'workflows'], + category: 'operations', + tags: ['security', 'compliance'], + alsoIntegrations: ['gmail'], + }, + { + icon: CloudTrailIcon, + title: 'CloudTrail Insights anomaly digest', + prompt: + 'Create a daily workflow that looks up AWS CloudTrail Insights events, correlates each API call-rate or error-rate anomaly with the principals active at that time, and posts a digest to Slack.', + modules: ['scheduled', 'agent', 'workflows'], + category: 'operations', + tags: ['monitoring', 'devops'], + alsoIntegrations: ['slack'], + }, + ], + skills: [ + { + name: 'investigate-aws-actor', + description: + 'Trace everything a specific AWS user, role, or access key did in the last 90 days using CloudTrail event history. Use for incident response and offboarding reviews.', + content: + '# Investigate AWS Actor\n\nBuild a timeline of what one principal did in AWS.\n\n## Steps\n1. Choose the lookup attribute that matches what you were given: Username for an IAM user or role session, AccessKeyId for a credential.\n2. Look up events for that value, setting the start and end time to the window under investigation. CloudTrail event history only covers the last 90 days.\n3. Page through with the returned pagination token until no token comes back. Look up events is limited to 50 events per page and two requests per second per Region, so pace the paging.\n4. Read the parsed cloudTrailEvent record on each event for the source IP, user agent, request parameters, and any error code.\n5. Group the calls by service and by source IP, and call out any write action or permission change.\n\n## Output\nA chronological timeline of the calls, plus a short summary naming the services touched, the source IPs used, and any failed authorization attempts.', + }, + { + name: 'audit-trail-coverage', + description: + 'Verify that CloudTrail trails exist, are logging, and are configured to capture the events an audit requires. Use for SOC 2 and ISO evidence gathering.', + content: + '# Audit Trail Coverage\n\nProve that AWS API activity is actually being recorded.\n\n## Steps\n1. List trails to enumerate every trail visible to the account, noting each home Region.\n2. Describe trails to read the full configuration, including whether each is multi-Region, an organization trail, and whether log file validation is enabled.\n3. Get trail status for each trail and flag any where logging is stopped or a recent delivery error is present.\n4. Get event selectors for each trail to confirm management events are recorded and check which data resources are covered.\n5. Note that trails outside the current Region must be addressed by ARN.\n\n## Output\nA per-trail coverage report: logging state, multi-Region and organization scope, log file validation, delivery errors, and any gap in management or data event coverage.', + }, + { + name: 'run-lake-query', + description: + 'Run a SQL query against a CloudTrail Lake event data store, wait for it to finish, and return the rows. Use for aggregate audit questions that span more than 90 days.', + content: + '# Run Lake Query\n\nAnswer an aggregate audit question with CloudTrail Lake.\n\n## Steps\n1. List event data stores, or get one by ARN, to find the store ID to query and confirm its retention period.\n2. Compose the SQL, naming the event data store ID in the FROM clause.\n3. Start the query to obtain a query ID.\n4. Poll describe query with that query ID until the status is FINISHED, FAILED, CANCELLED, or TIMED_OUT.\n5. On FINISHED, fetch the query results with the same query ID, paging with the returned token until no token comes back.\n6. Cancel the query if it is no longer needed while still RUNNING.\n\n## Output\nThe result rows, plus the query ID, events matched, events scanned, and run time. On failure, surface the error message and the SQL that produced it.', + }, + ], +} as const satisfies BlockMeta diff --git a/apps/sim/blocks/blocks/iam.test.ts b/apps/sim/blocks/blocks/iam.test.ts new file mode 100644 index 00000000000..3f58ce9bd84 --- /dev/null +++ b/apps/sim/blocks/blocks/iam.test.ts @@ -0,0 +1,74 @@ +/** + * @vitest-environment node + */ +import { describe, expect, it } from 'vitest' +import { IAMBlock } from '@/blocks/blocks/iam' + +const SHAPE_ERROR = + 'Condition Context Keys must be a JSON array of { contextKeyName, contextKeyValues, contextKeyType }' + +const CONTEXT_ENTRY = { + contextKeyName: 'aws:SourceIp', + contextKeyValues: ['203.0.113.10'], + contextKeyType: 'ip', +} + +function simulateParams(extra: Record) { + return IAMBlock.tools.config!.params!({ + operation: 'simulate_principal_policy', + region: 'us-east-1', + accessKeyId: 'AKIAIOSFODNN7EXAMPLE', + secretAccessKey: 'secret', + policySourceArn: 'arn:aws:iam::000000000000:role/example', + actionNames: 's3:GetObject', + ...extra, + }) +} + +describe('IAMBlock contextEntries parsing', () => { + it('passes a JSON array string through as parsed context entries', () => { + const result = simulateParams({ contextEntries: JSON.stringify([CONTEXT_ENTRY]) }) + expect(result.contextEntries).toEqual([CONTEXT_ENTRY]) + }) + + it('passes an already-parsed array through unchanged', () => { + const result = simulateParams({ contextEntries: [CONTEXT_ENTRY] }) + expect(result.contextEntries).toEqual([CONTEXT_ENTRY]) + }) + + it('rejects a JSON object rather than silently simulating without the context keys', () => { + expect(() => simulateParams({ contextEntries: JSON.stringify(CONTEXT_ENTRY) })).toThrow( + SHAPE_ERROR + ) + }) + + it('rejects a JSON scalar rather than silently dropping it', () => { + expect(() => simulateParams({ contextEntries: '"aws:SourceIp"' })).toThrow(SHAPE_ERROR) + expect(() => simulateParams({ contextEntries: '42' })).toThrow(SHAPE_ERROR) + }) + + it('rejects a non-array object supplied directly', () => { + expect(() => simulateParams({ contextEntries: CONTEXT_ENTRY })).toThrow(SHAPE_ERROR) + }) + + it('rejects malformed JSON with the same shape message', () => { + expect(() => simulateParams({ contextEntries: '{not json' })).toThrow(SHAPE_ERROR) + }) + + it('omits contextEntries when the field is blank', () => { + const result = simulateParams({ contextEntries: '' }) + expect(result.contextEntries).toBeUndefined() + }) + + it('omits contextEntries for an empty JSON array without throwing', () => { + const result = simulateParams({ contextEntries: '[]' }) + expect(result.contextEntries).toBeUndefined() + }) +}) + +describe('IAMBlock contextEntries wand config', () => { + it('generates a JSON array, matching the prompt and the tool contract', () => { + const subBlock = IAMBlock.subBlocks.find((block) => block.id === 'contextEntries') + expect(subBlock?.wandConfig?.generationType).toBe('json-array') + }) +}) diff --git a/apps/sim/blocks/blocks/iam.ts b/apps/sim/blocks/blocks/iam.ts index 4cc7fa5d16d..2cf3dbfedd7 100644 --- a/apps/sim/blocks/blocks/iam.ts +++ b/apps/sim/blocks/blocks/iam.ts @@ -3,6 +3,16 @@ import type { BlockConfig, BlockMeta } from '@/blocks/types' import { AuthMode, IntegrationType } from '@/blocks/types' import type { IAMBaseResponse } from '@/tools/iam/types' +/** + * Raised when `contextEntries` is not a JSON array of context entries. + * + * A simulation that quietly drops the caller's condition context keys returns a + * *wrong* permission answer — `aws:SourceIp` never applies, so a policy that should + * have denied reports `allowed`. Rejecting the input is the only safe outcome. + */ +const CONTEXT_ENTRIES_SHAPE_ERROR = + 'Condition Context Keys must be a JSON array of { contextKeyName, contextKeyValues, contextKeyType }' + export const IAMBlock: BlockConfig = { type: 'iam', name: 'AWS IAM', @@ -57,6 +67,13 @@ export const IAMBlock: BlockConfig = { { text: 'Detach policy', field: 'policyArn', core: true }, { text: 'from role', field: 'roleName', core: true }, ], + get_policy: [{ text: 'Fetch policy', field: 'policyArn', core: true }], + list_access_keys: ['List access keys', { text: ', for user', field: 'userName' }], + update_access_key: [ + { text: 'Set access key', field: 'accessKeyIdToUpdate', core: true }, + { text: 'to', field: 'accessKeyStatus', core: true }, + { text: 'for user', field: 'userName' }, + ], list_policies: [ 'List managed policies', { text: ', under path', field: 'pathPrefix' }, @@ -117,8 +134,11 @@ export const IAMBlock: BlockConfig = { { label: 'Attach Role Policy', id: 'attach_role_policy' }, { label: 'Detach Role Policy', id: 'detach_role_policy' }, { label: 'List Policies', id: 'list_policies' }, + { label: 'Get Policy', id: 'get_policy' }, { label: 'Create Access Key', id: 'create_access_key' }, { label: 'Delete Access Key', id: 'delete_access_key' }, + { label: 'List Access Keys', id: 'list_access_keys' }, + { label: 'Update Access Key', id: 'update_access_key' }, { label: 'List Groups', id: 'list_groups' }, { label: 'Add User to Group', id: 'add_user_to_group' }, { label: 'Remove User from Group', id: 'remove_user_from_group' }, @@ -166,6 +186,8 @@ export const IAMBlock: BlockConfig = { 'detach_user_policy', 'create_access_key', 'delete_access_key', + 'list_access_keys', + 'update_access_key', 'add_user_to_group', 'remove_user_from_group', 'list_attached_user_policies', @@ -174,7 +196,6 @@ export const IAMBlock: BlockConfig = { required: { field: 'operation', value: [ - 'get_user', 'create_user', 'delete_user', 'attach_user_policy', @@ -225,6 +246,7 @@ export const IAMBlock: BlockConfig = { 'detach_user_policy', 'attach_role_policy', 'detach_role_policy', + 'get_policy', ], }, required: { @@ -234,6 +256,7 @@ export const IAMBlock: BlockConfig = { 'detach_user_policy', 'attach_role_policy', 'detach_role_policy', + 'get_policy', ], }, }, @@ -275,6 +298,27 @@ export const IAMBlock: BlockConfig = { condition: { field: 'operation', value: 'delete_access_key' }, required: { field: 'operation', value: 'delete_access_key' }, }, + { + id: 'accessKeyIdToUpdate', + title: 'Access Key ID to Update', + canvasNoun: 'an access key ID', + type: 'short-input', + placeholder: 'AKIA...', + condition: { field: 'operation', value: 'update_access_key' }, + required: { field: 'operation', value: 'update_access_key' }, + }, + { + id: 'accessKeyStatus', + title: 'Access Key Status', + type: 'dropdown', + options: [ + { label: 'Active', id: 'Active' }, + { label: 'Inactive', id: 'Inactive' }, + ], + value: () => 'Inactive', + condition: { field: 'operation', value: 'update_access_key' }, + required: { field: 'operation', value: 'update_access_key' }, + }, { id: 'path', title: 'Path', @@ -360,6 +404,23 @@ export const IAMBlock: BlockConfig = { required: false, mode: 'advanced', }, + { + id: 'contextEntries', + title: 'Condition Context Keys (JSON)', + type: 'code', + placeholder: + '[{"contextKeyName":"aws:SourceIp","contextKeyValues":["203.0.113.10"],"contextKeyType":"ip"}]', + condition: { field: 'operation', value: 'simulate_principal_policy' }, + required: false, + mode: 'advanced', + wandConfig: { + enabled: true, + prompt: + 'Generate a JSON array of AWS IAM simulation context entries. Each element must have contextKeyName (a full condition context key such as aws:SourceIp), contextKeyValues (an array of strings), and contextKeyType (one of string, stringList, numeric, numericList, boolean, booleanList, ip, ipList, binary, binaryList, date, dateList). Return ONLY the JSON array - no explanations, no extra text.', + generationType: 'json-array', + placeholder: 'Describe the request conditions to simulate, e.g. "from IP 203.0.113.10"', + }, + }, { id: 'pathPrefix', title: 'Path Prefix', @@ -393,6 +454,7 @@ export const IAMBlock: BlockConfig = { 'list_groups', 'list_attached_role_policies', 'list_attached_user_policies', + 'list_access_keys', 'simulate_principal_policy', ], }, @@ -413,6 +475,7 @@ export const IAMBlock: BlockConfig = { 'list_groups', 'list_attached_role_policies', 'list_attached_user_policies', + 'list_access_keys', 'simulate_principal_policy', ], }, @@ -435,8 +498,11 @@ export const IAMBlock: BlockConfig = { 'iam_attach_role_policy', 'iam_detach_role_policy', 'iam_list_policies', + 'iam_get_policy', 'iam_create_access_key', 'iam_delete_access_key', + 'iam_list_access_keys', + 'iam_update_access_key', 'iam_list_groups', 'iam_add_user_to_group', 'iam_remove_user_from_group', @@ -473,10 +539,16 @@ export const IAMBlock: BlockConfig = { return 'iam_detach_role_policy' case 'list_policies': return 'iam_list_policies' + case 'get_policy': + return 'iam_get_policy' case 'create_access_key': return 'iam_create_access_key' case 'delete_access_key': return 'iam_delete_access_key' + case 'list_access_keys': + return 'iam_list_access_keys' + case 'update_access_key': + return 'iam_update_access_key' case 'list_groups': return 'iam_list_groups' case 'add_user_to_group': @@ -494,8 +566,15 @@ export const IAMBlock: BlockConfig = { } }, params: (params) => { - const { operation, maxItems, maxSessionDuration, onlyAttached, resourceArns, ...rest } = - params + const { + operation, + maxItems, + maxSessionDuration, + onlyAttached, + resourceArns, + contextEntries, + ...rest + } = params const connectionConfig = { region: rest.region, @@ -517,6 +596,8 @@ export const IAMBlock: BlockConfig = { if (rest.marker) result.marker = rest.marker break case 'get_user': + if (rest.userName) result.userName = rest.userName + break case 'delete_user': result.userName = rest.userName break @@ -558,6 +639,9 @@ export const IAMBlock: BlockConfig = { } if (rest.marker) result.marker = rest.marker break + case 'get_policy': + result.policyArn = rest.policyArn + break case 'create_access_key': if (rest.userName) result.userName = rest.userName break @@ -565,6 +649,19 @@ export const IAMBlock: BlockConfig = { result.accessKeyIdToDelete = rest.accessKeyIdToDelete if (rest.userName) result.userName = rest.userName break + case 'list_access_keys': + if (rest.userName) result.userName = rest.userName + if (maxItems) { + const parsed = Number.parseInt(String(maxItems), 10) + if (!Number.isNaN(parsed)) result.maxItems = parsed + } + if (rest.marker) result.marker = rest.marker + break + case 'update_access_key': + result.accessKeyIdToUpdate = rest.accessKeyIdToUpdate + result.status = rest.accessKeyStatus + if (rest.userName) result.userName = rest.userName + break case 'add_user_to_group': case 'remove_user_from_group': result.userName = rest.userName @@ -592,6 +689,20 @@ export const IAMBlock: BlockConfig = { result.policySourceArn = rest.policySourceArn result.actionNames = rest.actionNames if (resourceArns) result.resourceArns = resourceArns + if (contextEntries) { + let parsed: unknown = contextEntries + if (typeof contextEntries === 'string') { + try { + parsed = JSON.parse(contextEntries) + } catch { + throw new Error(CONTEXT_ENTRIES_SHAPE_ERROR) + } + } + if (!Array.isArray(parsed)) { + throw new Error(CONTEXT_ENTRIES_SHAPE_ERROR) + } + if (parsed.length > 0) result.contextEntries = parsed + } if (maxItems) { const parsed = Number.parseInt(String(maxItems), 10) if (!Number.isNaN(parsed)) result.maxResults = parsed @@ -615,6 +726,8 @@ export const IAMBlock: BlockConfig = { assumeRolePolicyDocument: { type: 'string', description: 'Trust policy JSON' }, groupName: { type: 'string', description: 'IAM group name' }, accessKeyIdToDelete: { type: 'string', description: 'Access key ID to delete' }, + accessKeyIdToUpdate: { type: 'string', description: 'Access key ID to activate or deactivate' }, + accessKeyStatus: { type: 'string', description: 'Access key status to set (Active, Inactive)' }, path: { type: 'string', description: 'Resource path' }, description: { type: 'string', description: 'Role description' }, maxSessionDuration: { type: 'number', description: 'Max session duration in seconds' }, @@ -629,6 +742,11 @@ export const IAMBlock: BlockConfig = { type: 'string', description: 'Comma-separated resource ARNs to simulate against', }, + contextEntries: { + type: 'json', + description: + 'Condition context keys supplied to the simulation, as a JSON array of { contextKeyName, contextKeyValues, contextKeyType }', + }, }, outputs: { message: { @@ -719,7 +837,9 @@ export const IAMBlock: BlockConfig = { }, secretAccessKey: { type: 'string', - description: 'Secret access key (only shown once)', + description: + 'Secret access key, returned only when the key is created. Hidden from logs and the trace; reference it downstream rather than printing it.', + hiddenFromDisplay: true, }, status: { type: 'string', @@ -741,10 +861,43 @@ export const IAMBlock: BlockConfig = { type: 'json', description: 'List of attached managed policies with policyName and policyArn', }, + accessKeys: { + type: 'json', + description: + "An IAM user's access key metadata (accessKeyId, userName, status, createDate). The secret is never returned by this operation.", + }, + policyName: { + type: 'string', + description: 'Policy name', + }, + policyId: { + type: 'string', + description: 'Policy ID', + }, + attachmentCount: { + type: 'number', + description: 'Number of entities the policy is attached to', + }, + isAttachable: { + type: 'boolean', + description: 'Whether the policy can be attached to an entity', + }, + updateDate: { + type: 'string', + description: 'Date the resource was last updated', + }, + defaultVersionId: { + type: 'string', + description: 'Identifier of the default policy version', + }, + permissionsBoundaryUsageCount: { + type: 'number', + description: 'Number of entities using the policy as a permissions boundary', + }, evaluationResults: { type: 'json', description: - 'Policy simulation results per action: evalActionName, evalResourceName, evalDecision (allowed/explicitDeny/implicitDeny), matchedStatements (sourcePolicyId, sourcePolicyType), missingContextValues', + 'One result per simulated action. evalDecision is the AGGREGATE, most-restrictive decision across every resource ARN (any explicitDeny makes the whole result explicitDeny), and evalResourceName is the resource-type ARN template AWS echoes back, not a customer ARN. Read the verdict for an individual ARN from resourceSpecificResults[]: evalResourceName, evalResourceDecision, matchedStatements, missingContextValues, permissionsBoundaryAllowed.', }, }, } @@ -829,14 +982,14 @@ export const IAMBlockMeta = { description: 'List IAM users, roles, and their attached policies to produce an access audit. Use for security reviews and least-privilege checks.', content: - '# Audit IAM Permissions\n\nReport who and what has access in IAM.\n\n## Steps\n1. List users and roles to establish the inventory.\n2. For each principal of interest, list attached user or role policies.\n3. Optionally simulate principal policy to confirm whether a principal can perform sensitive actions.\n4. Flag overly broad policies, unused principals, or access keys that should be rotated.\n\n## Output\nAn audit summary: principals and their attached policies, with risky or excessive grants called out. Do not expose secret values.', + '# Audit IAM Permissions\n\nReport who and what has access in IAM.\n\n## Steps\n1. List users and roles to establish the inventory.\n2. For each principal of interest, list attached user or role policies. Get a policy by ARN when you need its description to judge intent — list policies never returns one.\n3. List each user’s access keys to find keys that are stale or still Active but unused.\n4. Optionally simulate principal policy to confirm whether a principal can perform sensitive actions, reading the per-resource verdict from resourceSpecificResults.\n5. Flag overly broad policies, unused principals, or access keys that should be rotated.\n\n## Output\nAn audit summary: principals, their attached policies, and their access key inventory, with risky or excessive grants called out. Do not expose secret values.', }, { name: 'check-effective-permissions', description: 'Use IAM policy simulation to verify whether a user or role can perform specific actions on resources. Use for troubleshooting access and validating changes.', content: - '# Check Effective Permissions\n\nDetermine whether a principal is actually allowed to do something.\n\n## Steps\n1. Identify the principal (user or role) and the actions and resource ARNs to test.\n2. Run simulate principal policy for those actions against the resources.\n3. Read the allowed or denied decision for each action, noting which statement governs it.\n4. If denied unexpectedly, inspect the attached policies to explain why.\n\n## Output\nA per-action allow/deny verdict with the governing policy, and a plain-language explanation of any denial.', + '# Check Effective Permissions\n\nDetermine whether a principal is actually allowed to do something.\n\n## Steps\n1. Identify the principal (user or role) and the actions and resource ARNs to test.\n2. Run simulate principal policy for those actions against the resources. If any policy is gated by a condition, supply the condition context keys so it does not simulate as denied for missing context.\n3. Read the per-resource verdict from resourceSpecificResults — evalResourceName plus evalResourceDecision. The top-level evalDecision is the aggregate across every ARN you passed, so one explicitly denied bucket makes the whole action read as explicitDeny; do not report that as a denial on the other resources. The top-level evalResourceName is a resource-type ARN template, not one of your ARNs.\n4. If a resource is denied unexpectedly, read its matchedStatements and missingContextValues, then inspect the attached policies to explain why.\n\n## Output\nA verdict per action AND per resource ARN, with the governing policy for each, and a plain-language explanation of any denial.', }, { name: 'provision-iam-principal', @@ -850,7 +1003,7 @@ export const IAMBlockMeta = { description: 'Create a fresh IAM access key for a user and delete the old one to complete a safe rotation. Use for scheduled key rotation and remediating aged keys.', content: - '# Rotate Access Keys\n\nReplace a user’s access key following the two-step rotation pattern.\n\n## Steps\n1. Create a new access key for the target user so two keys exist briefly.\n2. Hand the new key to its consumer securely and let dependents switch over and verify they still work.\n3. Once the new key is confirmed in use, delete the old access key by its ID.\n4. Confirm only the intended key remains for the user.\n\n## Output\nReport the user, that a new key was issued, and the old key ID that was deleted. Never print the secret access key value — reference keys only by their access key ID.', + '# Rotate Access Keys\n\nReplace a user’s access key following the two-step rotation pattern.\n\n## Steps\n1. List the user’s access keys to see which keys exist, their status, and their age.\n2. Create a new access key for the target user so two keys exist briefly.\n3. Hand the new key to its consumer securely and let dependents switch over and verify they still work.\n4. Deactivate the old key by updating its status to Inactive, and leave it that way long enough to prove nothing still depends on it. Reactivate it if something breaks.\n5. Once the new key is confirmed in use, delete the old access key by its ID.\n6. List the access keys again to confirm only the intended key remains for the user.\n\n## Output\nReport the user, that a new key was issued, and the old key ID that was deactivated and then deleted. Never print the secret access key value — reference keys only by their access key ID.', }, ], } as const satisfies BlockMeta diff --git a/apps/sim/blocks/blocks/identity_center.ts b/apps/sim/blocks/blocks/identity_center.ts index 5541891e6ff..0e02644cfe5 100644 --- a/apps/sim/blocks/blocks/identity_center.ts +++ b/apps/sim/blocks/blocks/identity_center.ts @@ -19,7 +19,7 @@ export const IdentityCenterBlock: BlockConfig = { sentences: { byOperation: { list_instances: ['List all instances', { text: 'in', field: 'region' }], - list_accounts: ['List organization accounts', { text: 'in', field: 'region' }], + list_accounts: ['List every account in the organization'], describe_account: [{ text: 'Read details of account', field: 'accountId', core: true }], list_permission_sets: ['List permission sets', { text: 'in', field: 'region' }], get_user: [{ text: 'Look up the user with email', field: 'email', core: true }], @@ -41,7 +41,16 @@ export const IdentityCenterBlock: BlockConfig = { ], list_account_assignments: [ 'List account assignments', - { text: 'for', field: 'principalId' }, + { text: 'for principal', field: 'principalId' }, + ], + list_assignments_for_account: [ + { text: 'List assignments on account', field: 'accountId', core: true }, + { text: 'for permission set', field: 'permissionSetArn', core: true }, + ], + describe_user: [{ text: 'Look up the user with ID', field: 'userId', core: true }], + describe_group: [{ text: 'Look up the group with ID', field: 'groupId', core: true }], + list_group_memberships: [ + { text: 'List the members of group', field: 'groupId', core: true }, ], }, }, @@ -58,13 +67,17 @@ export const IdentityCenterBlock: BlockConfig = { { label: 'Describe Account', id: 'describe_account' }, { label: 'List Permission Sets', id: 'list_permission_sets' }, { label: 'Get User', id: 'get_user' }, + { label: 'Describe User', id: 'describe_user' }, { label: 'Get Group', id: 'get_group' }, + { label: 'Describe Group', id: 'describe_group' }, { label: 'List Groups', id: 'list_groups' }, + { label: 'List Group Memberships', id: 'list_group_memberships' }, { label: 'Create Account Assignment', id: 'create_account_assignment' }, { label: 'Delete Account Assignment', id: 'delete_account_assignment' }, { label: 'Check Assignment Status', id: 'check_assignment_status' }, { label: 'Check Assignment Deletion Status', id: 'check_assignment_deletion_status' }, - { label: 'List Account Assignments', id: 'list_account_assignments' }, + { label: 'List Account Assignments For Principal', id: 'list_account_assignments' }, + { label: 'List Assignments For Account', id: 'list_assignments_for_account' }, ], value: () => 'list_instances', }, @@ -104,7 +117,10 @@ export const IdentityCenterBlock: BlockConfig = { 'get_user', 'get_group', 'describe_account', + 'describe_user', + 'describe_group', 'list_groups', + 'list_group_memberships', ], not: true, }, @@ -116,7 +132,10 @@ export const IdentityCenterBlock: BlockConfig = { 'get_user', 'get_group', 'describe_account', + 'describe_user', + 'describe_group', 'list_groups', + 'list_group_memberships', ], not: true, }, @@ -126,8 +145,28 @@ export const IdentityCenterBlock: BlockConfig = { title: 'Identity Store ID', type: 'short-input', placeholder: 'd-1234567890', - condition: { field: 'operation', value: ['get_user', 'get_group', 'list_groups'] }, - required: { field: 'operation', value: ['get_user', 'get_group', 'list_groups'] }, + condition: { + field: 'operation', + value: [ + 'get_user', + 'get_group', + 'list_groups', + 'describe_user', + 'describe_group', + 'list_group_memberships', + ], + }, + required: { + field: 'operation', + value: [ + 'get_user', + 'get_group', + 'list_groups', + 'describe_user', + 'describe_group', + 'list_group_memberships', + ], + }, }, { id: 'email', @@ -145,6 +184,22 @@ export const IdentityCenterBlock: BlockConfig = { condition: { field: 'operation', value: 'get_group' }, required: { field: 'operation', value: 'get_group' }, }, + { + id: 'userId', + title: 'User ID', + type: 'short-input', + placeholder: 'Identity Store user ID', + condition: { field: 'operation', value: 'describe_user' }, + required: { field: 'operation', value: 'describe_user' }, + }, + { + id: 'groupId', + title: 'Group ID', + type: 'short-input', + placeholder: 'Identity Store group ID', + condition: { field: 'operation', value: ['describe_group', 'list_group_memberships'] }, + required: { field: 'operation', value: ['describe_group', 'list_group_memberships'] }, + }, { id: 'accountId', title: 'AWS Account ID', @@ -152,11 +207,21 @@ export const IdentityCenterBlock: BlockConfig = { placeholder: '123456789012', condition: { field: 'operation', - value: ['create_account_assignment', 'delete_account_assignment', 'describe_account'], + value: [ + 'create_account_assignment', + 'delete_account_assignment', + 'describe_account', + 'list_assignments_for_account', + ], }, required: { field: 'operation', - value: ['create_account_assignment', 'delete_account_assignment', 'describe_account'], + value: [ + 'create_account_assignment', + 'delete_account_assignment', + 'describe_account', + 'list_assignments_for_account', + ], }, }, { @@ -166,11 +231,19 @@ export const IdentityCenterBlock: BlockConfig = { placeholder: 'arn:aws:sso:::permissionSet/ssoins-.../ps-...', condition: { field: 'operation', - value: ['create_account_assignment', 'delete_account_assignment'], + value: [ + 'create_account_assignment', + 'delete_account_assignment', + 'list_assignments_for_account', + ], }, required: { field: 'operation', - value: ['create_account_assignment', 'delete_account_assignment'], + value: [ + 'create_account_assignment', + 'delete_account_assignment', + 'list_assignments_for_account', + ], }, }, { @@ -239,7 +312,7 @@ export const IdentityCenterBlock: BlockConfig = { id: 'maxResults', title: 'Max Results', type: 'short-input', - placeholder: '20', + placeholder: '1-100 (List Accounts allows at most 20)', condition: { field: 'operation', value: [ @@ -247,7 +320,9 @@ export const IdentityCenterBlock: BlockConfig = { 'list_accounts', 'list_permission_sets', 'list_account_assignments', + 'list_assignments_for_account', 'list_groups', + 'list_group_memberships', ], }, required: false, @@ -265,7 +340,9 @@ export const IdentityCenterBlock: BlockConfig = { 'list_accounts', 'list_permission_sets', 'list_account_assignments', + 'list_assignments_for_account', 'list_groups', + 'list_group_memberships', ], }, required: false, @@ -279,13 +356,17 @@ export const IdentityCenterBlock: BlockConfig = { 'identity_center_describe_account', 'identity_center_list_permission_sets', 'identity_center_get_user', + 'identity_center_describe_user', 'identity_center_get_group', + 'identity_center_describe_group', 'identity_center_list_groups', + 'identity_center_list_group_memberships', 'identity_center_create_account_assignment', 'identity_center_delete_account_assignment', 'identity_center_check_assignment_status', 'identity_center_check_assignment_deletion_status', 'identity_center_list_account_assignments', + 'identity_center_list_assignments_for_account', ], config: { tool: (params) => { @@ -300,10 +381,16 @@ export const IdentityCenterBlock: BlockConfig = { return 'identity_center_list_permission_sets' case 'get_user': return 'identity_center_get_user' + case 'describe_user': + return 'identity_center_describe_user' case 'get_group': return 'identity_center_get_group' + case 'describe_group': + return 'identity_center_describe_group' case 'list_groups': return 'identity_center_list_groups' + case 'list_group_memberships': + return 'identity_center_list_group_memberships' case 'create_account_assignment': return 'identity_center_create_account_assignment' case 'delete_account_assignment': @@ -314,6 +401,8 @@ export const IdentityCenterBlock: BlockConfig = { return 'identity_center_check_assignment_deletion_status' case 'list_account_assignments': return 'identity_center_list_account_assignments' + case 'list_assignments_for_account': + return 'identity_center_list_assignments_for_account' default: throw new Error(`Invalid Identity Center operation: ${params.operation}`) } @@ -359,10 +448,27 @@ export const IdentityCenterBlock: BlockConfig = { result.identityStoreId = rest.identityStoreId result.email = rest.email break + case 'describe_user': + result.identityStoreId = rest.identityStoreId + result.userId = rest.userId + break case 'get_group': result.identityStoreId = rest.identityStoreId result.displayName = rest.displayName break + case 'describe_group': + result.identityStoreId = rest.identityStoreId + result.groupId = rest.groupId + break + case 'list_group_memberships': + result.identityStoreId = rest.identityStoreId + result.groupId = rest.groupId + if (maxResults) { + const parsed = Number.parseInt(String(maxResults), 10) + if (!Number.isNaN(parsed)) result.maxResults = parsed + } + if (rest.nextToken) result.nextToken = rest.nextToken + break case 'list_groups': result.identityStoreId = rest.identityStoreId if (maxResults) { @@ -394,6 +500,16 @@ export const IdentityCenterBlock: BlockConfig = { } if (rest.nextToken) result.nextToken = rest.nextToken break + case 'list_assignments_for_account': + result.instanceArn = rest.instanceArn + result.accountId = rest.accountId + result.permissionSetArn = rest.permissionSetArn + if (maxResults) { + const parsed = Number.parseInt(String(maxResults), 10) + if (!Number.isNaN(parsed)) result.maxResults = parsed + } + if (rest.nextToken) result.nextToken = rest.nextToken + break } return result @@ -413,8 +529,13 @@ export const IdentityCenterBlock: BlockConfig = { permissionSetArn: { type: 'string', description: 'Permission set ARN' }, principalType: { type: 'string', description: 'Principal type: USER or GROUP' }, principalId: { type: 'string', description: 'Identity Store user or group ID' }, + userId: { type: 'string', description: 'Identity Store user ID' }, + groupId: { type: 'string', description: 'Identity Store group ID' }, requestId: { type: 'string', description: 'Assignment creation/deletion request ID' }, - maxResults: { type: 'number', description: 'Maximum number of results to return' }, + maxResults: { + type: 'number', + description: 'Maximum number of results to return (1-100; List Accounts allows at most 20)', + }, nextToken: { type: 'string', description: 'Pagination token from previous request' }, }, outputs: { @@ -422,24 +543,35 @@ export const IdentityCenterBlock: BlockConfig = { instances: { type: 'json', description: - 'List of Identity Center instances (instanceArn, identityStoreId, name, status, statusReason)', + 'List of Identity Center instances (instanceArn, identityStoreId, name, status, statusReason, ownerAccountId, createdDate)', }, accounts: { type: 'json', - description: 'List of AWS accounts (id, arn, name, email, status)', + description: 'List of AWS accounts (id, arn, name, email, status, joinedTimestamp)', }, permissionSets: { type: 'json', - description: 'List of permission sets (permissionSetArn, name, description, sessionDuration)', + description: + 'List of permission sets (permissionSetArn, name, description, sessionDuration, createdDate)', }, groups: { type: 'json', - description: 'List of Identity Store groups (groupId, displayName, description)', + description: 'List of Identity Store groups (groupId, displayName, description, externalIds)', + }, + memberships: { + type: 'json', + description: 'List of group memberships (membershipId, groupId, userId)', }, userId: { type: 'string', description: 'Identity Store user ID (use as principalId)' }, userName: { type: 'string', description: 'Username in the Identity Store' }, displayName: { type: 'string', description: 'Display name of the user or group' }, email: { type: 'string', description: 'Email address of the user' }, + userStatus: { type: 'string', description: 'User account status (ENABLED or DISABLED)' }, + title: { type: 'string', description: 'Job title of the user' }, + externalIds: { + type: 'json', + description: 'External identity provider IDs on the user or group (issuer, id)', + }, groupId: { type: 'string', description: 'Identity Store group ID (use as principalId)' }, description: { type: 'string', description: 'Group description' }, id: { type: 'string', description: 'AWS account ID (from describe_account)' }, @@ -555,14 +687,14 @@ export const IdentityCenterBlockMeta = { description: 'Remove a permission set assignment from a user or group in Identity Center and confirm deletion. Use to wind down temporary or expired access.', content: - '# Revoke Access\n\nRemove an account assignment to revoke access.\n\n## Steps\n1. List account assignments to confirm the principal currently holds the permission set on the account.\n2. Delete the account assignment for that principal, permission set, and account.\n3. Poll check assignment deletion status until it reports SUCCEEDED.\n4. Re-list assignments to verify the grant is gone.\n\n## Output\nConfirm what was revoked and the final deletion status. Note if the assignment did not exist.', + '# Revoke Access\n\nRemove an account assignment to revoke access.\n\n## Steps\n1. List account assignments for principal to confirm the principal currently holds the permission set on the account.\n2. Delete the account assignment for that principal, permission set, and account.\n3. Poll check assignment deletion status until it reports SUCCEEDED.\n4. Re-list assignments to verify the grant is gone.\n\n## Output\nConfirm what was revoked and the final deletion status. Note if the assignment did not exist.', }, { name: 'access-audit-report', description: - 'Enumerate permission sets, group memberships, and account assignments in Identity Center to produce an access report. Use for compliance and periodic reviews.', + 'Enumerate permission sets, account assignments, and group memberships in Identity Center to produce an access report. Use for compliance and periodic reviews.', content: - '# Access Audit Report\n\nReport who has access to what across accounts.\n\n## Steps\n1. List instances and accounts to scope the report.\n2. List permission sets and, per account, list account assignments.\n3. Resolve users and groups behind each assignment with get user and get group.\n4. Compile assignments grouped by account and permission set.\n\n## Output\nAn access report: per account, which principals hold which permission sets, with anything unexpected flagged for review.', + '# Access Audit Report\n\nReport who has access to what across accounts.\n\n## Steps\n1. List instances and accounts to scope the report, and note the instance ARN and Identity Store ID.\n2. List permission sets for the instance.\n3. For every account and permission set pair, list assignments for account to collect the assigned principals.\n4. Resolve each principal by ID — describe user for USER principals, describe group for GROUP principals — and expand groups with list group memberships.\n5. Compile assignments grouped by account and permission set.\n\n## Output\nAn access report: per account, which principals hold which permission sets, with anything unexpected flagged for review.', }, ], } as const satisfies BlockMeta diff --git a/apps/sim/blocks/blocks/sqs.test.ts b/apps/sim/blocks/blocks/sqs.test.ts new file mode 100644 index 00000000000..c04ac1147d6 --- /dev/null +++ b/apps/sim/blocks/blocks/sqs.test.ts @@ -0,0 +1,62 @@ +/** + * @vitest-environment node + */ +import { describe, expect, it } from 'vitest' +import { SQSBlock } from '@/blocks/blocks/sqs' + +const mapParams = SQSBlock.tools.config?.params +if (!mapParams) { + throw new Error('SQS block must define tools.config.params') +} + +const CONNECTION = { + region: 'us-east-1', + accessKeyId: 'AKIAIOSFODNN7EXAMPLE', + secretAccessKey: 'secret', +} + +const QUEUE_URL = 'https://sqs.us-east-1.amazonaws.com/123456789012/test-queue' + +/** Fields whose Wand output the prompt and the contract both describe as an array. */ +const BATCH_ENTRY_FIELDS = ['sendEntries', 'deleteEntries', 'visibilityEntries'] as const + +describe('SQS block integer parsing', () => { + it('rejects a fractional value instead of truncating it', () => { + expect(() => + mapParams({ ...CONNECTION, operation: 'send', queueUrl: QUEUE_URL, delaySeconds: '1.5' }) + ).toThrow('delaySeconds must be a whole number') + }) + + it('rejects a value with a trailing suffix instead of forwarding the digits', () => { + expect(() => + mapParams({ + ...CONNECTION, + operation: 'receive_message', + queueUrl: QUEUE_URL, + maxNumberOfMessages: '10abc', + }) + ).toThrow('maxNumberOfMessages must be a whole number') + }) + + it('forwards a whole number unchanged', () => { + expect( + mapParams({ ...CONNECTION, operation: 'send', queueUrl: QUEUE_URL, delaySeconds: '30' }) + ).toMatchObject({ delaySeconds: 30 }) + }) + + it('treats a blank or whitespace-only field as unset', () => { + for (const delaySeconds of ['', ' ']) { + expect( + mapParams({ ...CONNECTION, operation: 'send', queueUrl: QUEUE_URL, delaySeconds }) + ).not.toHaveProperty('delaySeconds') + } + }) +}) + +describe('SQS block wand generation types', () => { + it.each(BATCH_ENTRY_FIELDS)('generates a JSON array for %s', (fieldId) => { + const subBlock = SQSBlock.subBlocks.find((candidate) => candidate.id === fieldId) + + expect(subBlock?.wandConfig?.generationType).toBe('json-array') + }) +}) diff --git a/apps/sim/blocks/blocks/sqs.ts b/apps/sim/blocks/blocks/sqs.ts index 79795475d7e..45f6119f5af 100644 --- a/apps/sim/blocks/blocks/sqs.ts +++ b/apps/sim/blocks/blocks/sqs.ts @@ -1,20 +1,22 @@ import { getErrorMessage } from '@sim/utils/errors' import { SQSIcon } from '@/components/icons' import type { BlockConfig, BlockMeta } from '@/blocks/types' -import { IntegrationType } from '@/blocks/types' +import { AuthMode, IntegrationType } from '@/blocks/types' import type { SqsResponse } from '@/tools/sqs/types' export const SQSBlock: BlockConfig = { type: 'sqs', name: 'Amazon SQS', description: 'Connect to Amazon SQS', - longDescription: 'Integrate Amazon SQS into the workflow. Can send messages to SQS queues.', + longDescription: + 'Integrate Amazon SQS into the workflow. Send and receive messages one at a time or in batches of ten, delete messages, extend visibility timeouts, manage queues along with their attributes and tags, and redrive messages out of a dead-letter queue.', docsLink: 'https://docs.sim.ai/integrations/sqs', category: 'tools', integrationType: IntegrationType.DevOps, bgColor: 'linear-gradient(45deg, #2E27AD 0%, #527FFF 100%)', iconColor: '#527FFF', icon: SQSIcon, + authMode: AuthMode.ApiKey, canvasPresentation: { defaultTitle: 'Amazon SQS', sentences: { @@ -23,6 +25,74 @@ export const SQSBlock: BlockConfig = { { text: 'Send', field: 'data', core: true }, { text: 'to queue', field: 'queueUrl', core: true }, ], + send_message_batch: [ + { text: 'Send', field: 'sendEntries', core: true }, + { text: 'to queue', field: 'queueUrl', core: true }, + ], + receive_message: [ + { text: 'Receive messages from queue', field: 'queueUrl', core: true }, + { text: ', up to', field: 'maxNumberOfMessages' }, + ], + delete_message: [ + { text: 'Delete', field: 'receiptHandle', core: true }, + { text: 'from queue', field: 'queueUrl', core: true }, + ], + delete_message_batch: [ + { text: 'Delete a batch of received messages from queue', field: 'queueUrl', core: true }, + ], + change_message_visibility: [ + { text: 'Hide', field: 'receiptHandle', core: true }, + { text: 'for', field: 'visibilityTimeout', core: true, after: 'seconds' }, + { text: ', on queue', field: 'queueUrl' }, + ], + change_message_visibility_batch: [ + { + text: 'Change the visibility of a batch of received messages on queue', + field: 'queueUrl', + core: true, + }, + ], + list_queues: [ + 'List queues', + { text: ', named starting with', field: 'queueNamePrefix' }, + { text: ', up to', field: 'maxResults' }, + ], + get_queue_url: [{ text: 'Look up the URL of queue', field: 'queueName', core: true }], + get_queue_attributes: [ + { text: 'Read the attributes of queue', field: 'queueUrl', core: true }, + ], + set_queue_attributes: [ + { text: 'Update the attributes of queue', field: 'queueUrl', core: true }, + ], + create_queue: [{ text: 'Create queue', field: 'queueName', core: true }], + delete_queue: [{ text: 'Delete queue', field: 'queueUrl', core: true }], + purge_queue: [{ text: 'Delete every message in queue', field: 'queueUrl', core: true }], + list_dead_letter_source_queues: [ + { + text: 'List the queues that redrive to dead-letter queue', + field: 'queueUrl', + core: true, + }, + ], + list_queue_tags: [{ text: 'List the tags on queue', field: 'queueUrl', core: true }], + tag_queue: [ + { text: 'Tag queue', field: 'queueUrl', core: true }, + { text: 'with', field: 'queueTags', core: true }, + ], + untag_queue: [ + { text: 'Remove', field: 'tagKeys', core: true }, + { text: 'from queue', field: 'queueUrl', core: true }, + ], + start_message_move_task: [ + { text: 'Redrive the messages held in', field: 'sourceArn', core: true }, + { text: ', delivering them to', field: 'destinationArn' }, + ], + list_message_move_tasks: [ + { text: 'List the message move tasks for', field: 'sourceArn', core: true }, + ], + cancel_message_move_task: [ + { text: 'Cancel message move task', field: 'taskHandle', core: true }, + ], }, }, }, @@ -31,7 +101,29 @@ export const SQSBlock: BlockConfig = { id: 'operation', title: 'Operation', type: 'dropdown', - options: [{ label: 'Send Message', id: 'send' }], + options: [ + { label: 'Send Message', id: 'send' }, + { label: 'Send Message Batch', id: 'send_message_batch' }, + { label: 'Receive Message', id: 'receive_message' }, + { label: 'Delete Message', id: 'delete_message' }, + { label: 'Delete Message Batch', id: 'delete_message_batch' }, + { label: 'Change Message Visibility', id: 'change_message_visibility' }, + { label: 'Change Message Visibility Batch', id: 'change_message_visibility_batch' }, + { label: 'List Queues', id: 'list_queues' }, + { label: 'Get Queue URL', id: 'get_queue_url' }, + { label: 'Get Queue Attributes', id: 'get_queue_attributes' }, + { label: 'Set Queue Attributes', id: 'set_queue_attributes' }, + { label: 'Create Queue', id: 'create_queue' }, + { label: 'Delete Queue', id: 'delete_queue' }, + { label: 'Purge Queue', id: 'purge_queue' }, + { label: 'List Dead-Letter Source Queues', id: 'list_dead_letter_source_queues' }, + { label: 'List Queue Tags', id: 'list_queue_tags' }, + { label: 'Tag Queue', id: 'tag_queue' }, + { label: 'Untag Queue', id: 'untag_queue' }, + { label: 'Start Message Move Task', id: 'start_message_move_task' }, + { label: 'List Message Move Tasks', id: 'list_message_move_tasks' }, + { label: 'Cancel Message Move Task', id: 'cancel_message_move_task' }, + ], value: () => 'send', }, { @@ -62,12 +154,76 @@ export const SQSBlock: BlockConfig = { title: 'Queue URL', type: 'short-input', placeholder: 'https://sqs.us-east-1.amazonaws.com/123456789012/my-queue', - required: true, + condition: { + field: 'operation', + value: [ + 'send', + 'send_message_batch', + 'receive_message', + 'delete_message', + 'delete_message_batch', + 'change_message_visibility', + 'change_message_visibility_batch', + 'get_queue_attributes', + 'set_queue_attributes', + 'delete_queue', + 'purge_queue', + 'list_dead_letter_source_queues', + 'list_queue_tags', + 'tag_queue', + 'untag_queue', + ], + }, + required: { + field: 'operation', + value: [ + 'send', + 'send_message_batch', + 'receive_message', + 'delete_message', + 'delete_message_batch', + 'change_message_visibility', + 'change_message_visibility_batch', + 'get_queue_attributes', + 'set_queue_attributes', + 'delete_queue', + 'purge_queue', + 'list_dead_letter_source_queues', + 'list_queue_tags', + 'tag_queue', + 'untag_queue', + ], + }, + }, + { + id: 'queueName', + title: 'Queue Name', + type: 'short-input', + placeholder: 'my-queue (a FIFO queue name ends in .fifo)', + condition: { field: 'operation', value: ['create_queue', 'get_queue_url'] }, + required: { field: 'operation', value: ['create_queue', 'get_queue_url'] }, + }, + { + id: 'queueOwnerAwsAccountId', + title: 'Queue Owner AWS Account ID', + type: 'short-input', + placeholder: '123456789012', + condition: { field: 'operation', value: 'get_queue_url' }, + required: false, + mode: 'advanced', + }, + { + id: 'data', + title: 'Data (JSON)', + canvasNoun: 'a message body', + type: 'code', + placeholder: '{\n "name": "John Doe",\n "email": "john@example.com",\n "active": true\n}', + condition: { field: 'operation', value: 'send' }, + required: { field: 'operation', value: 'send' }, }, - // Data field for send message operation { id: 'messageGroupId', - title: 'Message Group ID (optional)', + title: 'Message Group ID', type: 'short-input', placeholder: '5FAB0F0B-30C6-4427-9407-5634F4A3984A', condition: { field: 'operation', value: 'send' }, @@ -75,39 +231,381 @@ export const SQSBlock: BlockConfig = { }, { id: 'messageDeduplicationId', - title: 'Message Deduplication ID (optional)', + title: 'Message Deduplication ID', type: 'short-input', placeholder: '5FAB0F0B-30C6-4427-9407-5634F4A3984A', condition: { field: 'operation', value: 'send' }, required: false, }, { - id: 'data', - title: 'Data (JSON)', - canvasNoun: 'a message body', + id: 'delaySeconds', + title: 'Delay Seconds', + type: 'short-input', + placeholder: '0-900', + condition: { field: 'operation', value: 'send' }, + required: false, + mode: 'advanced', + }, + { + id: 'messageAttributes', + title: 'Message Attributes', type: 'code', - placeholder: '{\n "name": "John Doe",\n "email": "john@example.com",\n "active": true\n}', + placeholder: '{\n "priority": { "dataType": "Number", "stringValue": "1" }\n}', condition: { field: 'operation', value: 'send' }, - required: true, + required: false, + mode: 'advanced', + wandConfig: { + enabled: true, + prompt: + 'Generate an SQS message attribute map as JSON. Each key is the attribute name and each value is an object with "dataType" (String or Number, optionally with a custom label such as Number.float) and "stringValue". Binary attributes are not supported. Return ONLY the JSON object.', + generationType: 'json-object', + }, + }, + { + id: 'sendEntries', + title: 'Message Entries', + canvasNoun: 'a batch of messages', + type: 'code', + placeholder: + '[\n { "id": "msg-1", "data": { "orderId": 1 } },\n { "id": "msg-2", "data": { "orderId": 2 } }\n]', + condition: { field: 'operation', value: 'send_message_batch' }, + required: { field: 'operation', value: 'send_message_batch' }, + wandConfig: { + enabled: true, + prompt: + 'Generate an array of at most 10 Amazon SQS batch send entries. Each entry is an object with a unique "id" (letters, digits, hyphens, underscores) and a "data" JSON object holding the message body. Optional per-entry keys are delaySeconds, messageGroupId, messageDeduplicationId, and messageAttributes. Return ONLY the JSON array.', + generationType: 'json-array', + }, + }, + { + id: 'receiptHandle', + title: 'Receipt Handle', + canvasNoun: 'a received message', + type: 'short-input', + placeholder: 'Receipt handle returned by Receive Message', + condition: { field: 'operation', value: ['delete_message', 'change_message_visibility'] }, + required: { field: 'operation', value: ['delete_message', 'change_message_visibility'] }, + }, + { + id: 'visibilityTimeout', + title: 'Visibility Timeout', + canvasNoun: 'a timeout', + type: 'short-input', + placeholder: '0-43200 seconds', + condition: { field: 'operation', value: 'change_message_visibility' }, + required: { field: 'operation', value: 'change_message_visibility' }, + }, + { + id: 'deleteEntries', + title: 'Delete Entries', + type: 'code', + placeholder: + '[\n { "id": "msg-1", "receiptHandle": "AQEB..." },\n { "id": "msg-2", "receiptHandle": "AQEB..." }\n]', + condition: { field: 'operation', value: 'delete_message_batch' }, + required: { field: 'operation', value: 'delete_message_batch' }, + wandConfig: { + enabled: true, + prompt: + 'Generate an array of at most 10 Amazon SQS delete-message batch entries. Each entry is an object with a unique "id" and the "receiptHandle" of a received message. Return ONLY the JSON array.', + generationType: 'json-array', + }, + }, + { + id: 'visibilityEntries', + title: 'Visibility Entries', + type: 'code', + placeholder: + '[\n { "id": "msg-1", "receiptHandle": "AQEB...", "visibilityTimeout": 120 }\n]', + condition: { field: 'operation', value: 'change_message_visibility_batch' }, + required: { field: 'operation', value: 'change_message_visibility_batch' }, + wandConfig: { + enabled: true, + prompt: + 'Generate an array of at most 10 Amazon SQS change-message-visibility batch entries. Each entry is an object with a unique "id", the "receiptHandle" of a received message, and an optional "visibilityTimeout" in seconds between 0 and 43200. Return ONLY the JSON array.', + generationType: 'json-array', + }, + }, + { + id: 'maxNumberOfMessages', + title: 'Max Messages', + type: 'short-input', + placeholder: '1-10 (default 1)', + condition: { field: 'operation', value: 'receive_message' }, + required: false, + mode: 'advanced', + }, + { + id: 'waitTimeSeconds', + title: 'Wait Time (Long Poll)', + type: 'short-input', + placeholder: '0-20 seconds (default 0)', + condition: { field: 'operation', value: 'receive_message' }, + required: false, + mode: 'advanced', + }, + { + id: 'receiveVisibilityTimeout', + title: 'Visibility Timeout', + type: 'short-input', + placeholder: '0-43200 seconds (defaults to the queue setting)', + condition: { field: 'operation', value: 'receive_message' }, + required: false, + mode: 'advanced', + }, + { + id: 'messageAttributeNames', + title: 'Message Attribute Names', + type: 'code', + placeholder: '["All"]', + condition: { field: 'operation', value: 'receive_message' }, + required: false, + mode: 'advanced', + }, + { + id: 'messageSystemAttributeNames', + title: 'Message System Attribute Names', + type: 'code', + placeholder: '["SentTimestamp", "ApproximateReceiveCount"]', + condition: { field: 'operation', value: 'receive_message' }, + required: false, + mode: 'advanced', + }, + { + id: 'receiveRequestAttemptId', + title: 'Receive Request Attempt ID', + type: 'short-input', + placeholder: 'FIFO deduplication token for a retried receive', + condition: { field: 'operation', value: 'receive_message' }, + required: false, + mode: 'advanced', + }, + { + id: 'queueNamePrefix', + title: 'Queue Name Prefix', + type: 'short-input', + placeholder: 'orders-', + condition: { field: 'operation', value: 'list_queues' }, + required: false, + mode: 'advanced', + }, + { + id: 'maxResults', + title: 'Max Results', + type: 'short-input', + placeholder: '1-1000 (set it to receive a next token)', + condition: { + field: 'operation', + value: ['list_queues', 'list_dead_letter_source_queues'], + }, + required: false, + mode: 'advanced', + }, + { + id: 'nextToken', + title: 'Next Token', + type: 'short-input', + placeholder: 'Pagination token from a previous run', + condition: { + field: 'operation', + value: ['list_queues', 'list_dead_letter_source_queues'], + }, + required: false, + mode: 'advanced', + }, + { + id: 'attributeNames', + title: 'Attribute Names', + type: 'code', + placeholder: '["All"]', + condition: { field: 'operation', value: 'get_queue_attributes' }, + required: false, + mode: 'advanced', + }, + { + id: 'queueAttributes', + title: 'Queue Attributes', + type: 'code', + placeholder: '{\n "VisibilityTimeout": "60",\n "MessageRetentionPeriod": "345600"\n}', + condition: { field: 'operation', value: 'set_queue_attributes' }, + required: { field: 'operation', value: 'set_queue_attributes' }, + wandConfig: { + enabled: true, + prompt: + 'Generate an Amazon SQS queue attribute map as JSON. Keys are documented queue attribute names such as VisibilityTimeout, DelaySeconds, MessageRetentionPeriod, MaximumMessageSize, ReceiveMessageWaitTimeSeconds, RedrivePolicy, RedriveAllowPolicy, Policy, KmsMasterKeyId, KmsDataKeyReusePeriodSeconds, SqsManagedSseEnabled, or ContentBasedDeduplication. Every value must be a string. Return ONLY the JSON object.', + generationType: 'json-object', + }, + }, + { + id: 'createQueueAttributes', + title: 'Queue Attributes', + type: 'code', + placeholder: '{\n "FifoQueue": "true",\n "VisibilityTimeout": "30"\n}', + condition: { field: 'operation', value: 'create_queue' }, + required: false, + mode: 'advanced', + wandConfig: { + enabled: true, + prompt: + 'Generate an Amazon SQS queue attribute map as JSON for a new queue. Keys are documented queue attribute names such as FifoQueue, ContentBasedDeduplication, VisibilityTimeout, DelaySeconds, MessageRetentionPeriod, MaximumMessageSize, ReceiveMessageWaitTimeSeconds, RedrivePolicy, or SqsManagedSseEnabled. Every value must be a string. Return ONLY the JSON object.', + generationType: 'json-object', + }, + }, + { + id: 'createQueueTags', + title: 'Tags', + type: 'code', + placeholder: '{\n "env": "prod",\n "team": "payments"\n}', + condition: { field: 'operation', value: 'create_queue' }, + required: false, + mode: 'advanced', + }, + { + id: 'queueTags', + title: 'Tags', + canvasNoun: 'tags', + type: 'code', + placeholder: '{\n "env": "prod",\n "team": "payments"\n}', + condition: { field: 'operation', value: 'tag_queue' }, + required: { field: 'operation', value: 'tag_queue' }, + }, + { + id: 'tagKeys', + title: 'Tag Keys', + canvasNoun: 'tags', + type: 'code', + placeholder: '["env", "team"]', + condition: { field: 'operation', value: 'untag_queue' }, + required: { field: 'operation', value: 'untag_queue' }, + }, + { + id: 'sourceArn', + title: 'Source Queue ARN', + canvasNoun: 'a dead-letter queue', + type: 'short-input', + placeholder: 'arn:aws:sqs:us-east-1:123456789012:my-dlq', + condition: { + field: 'operation', + value: ['start_message_move_task', 'list_message_move_tasks'], + }, + required: { + field: 'operation', + value: ['start_message_move_task', 'list_message_move_tasks'], + }, + }, + { + id: 'destinationArn', + title: 'Destination Queue ARN', + type: 'short-input', + placeholder: 'Leave empty to redrive to each original source queue', + condition: { field: 'operation', value: 'start_message_move_task' }, + required: false, + mode: 'advanced', + }, + { + id: 'maxNumberOfMessagesPerSecond', + title: 'Max Messages Per Second', + type: 'short-input', + placeholder: '1-500 (empty moves as fast as possible)', + condition: { field: 'operation', value: 'start_message_move_task' }, + required: false, + mode: 'advanced', + }, + { + id: 'moveTaskMaxResults', + title: 'Max Results', + type: 'short-input', + placeholder: '1-10 (default 1)', + condition: { field: 'operation', value: 'list_message_move_tasks' }, + required: false, + mode: 'advanced', + }, + { + id: 'taskHandle', + title: 'Task Handle', + type: 'short-input', + placeholder: 'Task handle returned by Start Message Move Task', + condition: { field: 'operation', value: 'cancel_message_move_task' }, + required: { field: 'operation', value: 'cancel_message_move_task' }, }, ], tools: { - access: ['sqs_send'], + access: [ + 'sqs_send', + 'sqs_send_message_batch', + 'sqs_receive_message', + 'sqs_delete_message', + 'sqs_delete_message_batch', + 'sqs_change_message_visibility', + 'sqs_change_message_visibility_batch', + 'sqs_list_queues', + 'sqs_get_queue_url', + 'sqs_get_queue_attributes', + 'sqs_set_queue_attributes', + 'sqs_create_queue', + 'sqs_delete_queue', + 'sqs_purge_queue', + 'sqs_list_dead_letter_source_queues', + 'sqs_list_queue_tags', + 'sqs_tag_queue', + 'sqs_untag_queue', + 'sqs_start_message_move_task', + 'sqs_list_message_move_tasks', + 'sqs_cancel_message_move_task', + ], config: { tool: (params) => { switch (params.operation) { case 'send': return 'sqs_send' + case 'send_message_batch': + return 'sqs_send_message_batch' + case 'receive_message': + return 'sqs_receive_message' + case 'delete_message': + return 'sqs_delete_message' + case 'delete_message_batch': + return 'sqs_delete_message_batch' + case 'change_message_visibility': + return 'sqs_change_message_visibility' + case 'change_message_visibility_batch': + return 'sqs_change_message_visibility_batch' + case 'list_queues': + return 'sqs_list_queues' + case 'get_queue_url': + return 'sqs_get_queue_url' + case 'get_queue_attributes': + return 'sqs_get_queue_attributes' + case 'set_queue_attributes': + return 'sqs_set_queue_attributes' + case 'create_queue': + return 'sqs_create_queue' + case 'delete_queue': + return 'sqs_delete_queue' + case 'purge_queue': + return 'sqs_purge_queue' + case 'list_dead_letter_source_queues': + return 'sqs_list_dead_letter_source_queues' + case 'list_queue_tags': + return 'sqs_list_queue_tags' + case 'tag_queue': + return 'sqs_tag_queue' + case 'untag_queue': + return 'sqs_untag_queue' + case 'start_message_move_task': + return 'sqs_start_message_move_task' + case 'list_message_move_tasks': + return 'sqs_list_message_move_tasks' + case 'cancel_message_move_task': + return 'sqs_cancel_message_move_task' default: throw new Error(`Invalid SQS operation: ${params.operation}`) } }, params: (params) => { - const { operation, data, messageGroupId, messageDeduplicationId, ...rest } = params + const { operation, ...rest } = params - // Parse JSON fields const parseJson = (value: unknown, fieldName: string) => { - if (!value) return undefined + if (value === undefined || value === null || value === '') return undefined if (typeof value === 'object') return value if (typeof value === 'string' && value.trim()) { try { @@ -120,22 +618,186 @@ export const SQSBlock: BlockConfig = { return undefined } - const parsedData = parseJson(data, 'data') + /** + * `Number.parseInt` stops at the first non-digit, so `1.5` and `10abc` + * would forward `1` and `10` — a different setting than the one typed. + * `Number` rejects both by producing a non-integer or `NaN`. + */ + const parseInteger = (value: unknown, fieldName: string) => { + if (value === undefined || value === null || value === '') return undefined + const text = String(value).trim() + if (!text) return undefined + const parsed = Number(text) + if (!Number.isInteger(parsed)) { + throw new Error(`${fieldName} must be a whole number`) + } + return parsed + } - // Build connection config - const connectionConfig = { + const result: Record = { region: rest.region, accessKeyId: rest.accessKeyId, secretAccessKey: rest.secretAccessKey, } - // Build params object - const result: Record = { ...connectionConfig } - - if (rest.queueUrl) result.queueUrl = rest.queueUrl - if (messageGroupId) result.messageGroupId = messageGroupId - if (messageDeduplicationId) result.messageDeduplicationId = messageDeduplicationId - if (parsedData !== undefined) result.data = parsedData + switch (operation) { + case 'send': { + result.queueUrl = rest.queueUrl + const data = parseJson(rest.data, 'data') + if (data !== undefined) result.data = data + const delaySeconds = parseInteger(rest.delaySeconds, 'delaySeconds') + if (delaySeconds !== undefined) result.delaySeconds = delaySeconds + const messageAttributes = parseJson(rest.messageAttributes, 'messageAttributes') + if (messageAttributes !== undefined) result.messageAttributes = messageAttributes + if (rest.messageGroupId) result.messageGroupId = rest.messageGroupId + if (rest.messageDeduplicationId) { + result.messageDeduplicationId = rest.messageDeduplicationId + } + break + } + case 'send_message_batch': { + result.queueUrl = rest.queueUrl + const entries = parseJson(rest.sendEntries, 'entries') + if (entries !== undefined) result.entries = entries + break + } + case 'receive_message': { + result.queueUrl = rest.queueUrl + const maxNumberOfMessages = parseInteger( + rest.maxNumberOfMessages, + 'maxNumberOfMessages' + ) + if (maxNumberOfMessages !== undefined) result.maxNumberOfMessages = maxNumberOfMessages + const waitTimeSeconds = parseInteger(rest.waitTimeSeconds, 'waitTimeSeconds') + if (waitTimeSeconds !== undefined) result.waitTimeSeconds = waitTimeSeconds + const visibilityTimeout = parseInteger( + rest.receiveVisibilityTimeout, + 'visibilityTimeout' + ) + if (visibilityTimeout !== undefined) result.visibilityTimeout = visibilityTimeout + const messageAttributeNames = parseJson( + rest.messageAttributeNames, + 'messageAttributeNames' + ) + if (messageAttributeNames !== undefined) { + result.messageAttributeNames = messageAttributeNames + } + const messageSystemAttributeNames = parseJson( + rest.messageSystemAttributeNames, + 'messageSystemAttributeNames' + ) + if (messageSystemAttributeNames !== undefined) { + result.messageSystemAttributeNames = messageSystemAttributeNames + } + if (rest.receiveRequestAttemptId) { + result.receiveRequestAttemptId = rest.receiveRequestAttemptId + } + break + } + case 'delete_message': { + result.queueUrl = rest.queueUrl + result.receiptHandle = rest.receiptHandle + break + } + case 'delete_message_batch': { + result.queueUrl = rest.queueUrl + const entries = parseJson(rest.deleteEntries, 'entries') + if (entries !== undefined) result.entries = entries + break + } + case 'change_message_visibility': { + result.queueUrl = rest.queueUrl + result.receiptHandle = rest.receiptHandle + const visibilityTimeout = parseInteger(rest.visibilityTimeout, 'visibilityTimeout') + if (visibilityTimeout !== undefined) result.visibilityTimeout = visibilityTimeout + break + } + case 'change_message_visibility_batch': { + result.queueUrl = rest.queueUrl + const entries = parseJson(rest.visibilityEntries, 'entries') + if (entries !== undefined) result.entries = entries + break + } + case 'list_queues': { + if (rest.queueNamePrefix) result.queueNamePrefix = rest.queueNamePrefix + const maxResults = parseInteger(rest.maxResults, 'maxResults') + if (maxResults !== undefined) result.maxResults = maxResults + if (rest.nextToken) result.nextToken = rest.nextToken + break + } + case 'get_queue_url': { + result.queueName = rest.queueName + if (rest.queueOwnerAwsAccountId) { + result.queueOwnerAwsAccountId = rest.queueOwnerAwsAccountId + } + break + } + case 'get_queue_attributes': { + result.queueUrl = rest.queueUrl + const attributeNames = parseJson(rest.attributeNames, 'attributeNames') + if (attributeNames !== undefined) result.attributeNames = attributeNames + break + } + case 'set_queue_attributes': { + result.queueUrl = rest.queueUrl + const attributes = parseJson(rest.queueAttributes, 'attributes') + if (attributes !== undefined) result.attributes = attributes + break + } + case 'create_queue': { + result.queueName = rest.queueName + const attributes = parseJson(rest.createQueueAttributes, 'attributes') + if (attributes !== undefined) result.attributes = attributes + const tags = parseJson(rest.createQueueTags, 'tags') + if (tags !== undefined) result.tags = tags + break + } + case 'delete_queue': + case 'purge_queue': + case 'list_queue_tags': { + result.queueUrl = rest.queueUrl + break + } + case 'list_dead_letter_source_queues': { + result.queueUrl = rest.queueUrl + const maxResults = parseInteger(rest.maxResults, 'maxResults') + if (maxResults !== undefined) result.maxResults = maxResults + if (rest.nextToken) result.nextToken = rest.nextToken + break + } + case 'tag_queue': { + result.queueUrl = rest.queueUrl + const tags = parseJson(rest.queueTags, 'tags') + if (tags !== undefined) result.tags = tags + break + } + case 'untag_queue': { + result.queueUrl = rest.queueUrl + const tagKeys = parseJson(rest.tagKeys, 'tagKeys') + if (tagKeys !== undefined) result.tagKeys = tagKeys + break + } + case 'start_message_move_task': { + result.sourceArn = rest.sourceArn + if (rest.destinationArn) result.destinationArn = rest.destinationArn + const maxPerSecond = parseInteger( + rest.maxNumberOfMessagesPerSecond, + 'maxNumberOfMessagesPerSecond' + ) + if (maxPerSecond !== undefined) result.maxNumberOfMessagesPerSecond = maxPerSecond + break + } + case 'list_message_move_tasks': { + result.sourceArn = rest.sourceArn + const maxResults = parseInteger(rest.moveTaskMaxResults, 'maxResults') + if (maxResults !== undefined) result.maxResults = maxResults + break + } + case 'cancel_message_move_task': { + result.taskHandle = rest.taskHandle + break + } + } return result }, @@ -147,24 +809,133 @@ export const SQSBlock: BlockConfig = { accessKeyId: { type: 'string', description: 'AWS access key ID' }, secretAccessKey: { type: 'string', description: 'AWS secret access key' }, queueUrl: { type: 'string', description: 'SQS queue URL' }, - messageGroupId: { + queueName: { type: 'string', description: 'SQS queue name' }, + queueOwnerAwsAccountId: { type: 'string', - description: 'Message group ID (optional)', + description: '12-digit AWS account ID of the queue owner', }, + data: { type: 'json', description: 'Message body to send, as a JSON object' }, + messageGroupId: { type: 'string', description: 'Message group ID for FIFO queues' }, messageDeduplicationId: { type: 'string', - description: 'Message deduplication ID (optional)', + description: 'Message deduplication ID for FIFO queues', + }, + delaySeconds: { type: 'number', description: 'Seconds to delay delivery of the message' }, + messageAttributes: { + type: 'json', + description: 'Message attributes keyed by name, each with dataType and stringValue', + }, + sendEntries: { + type: 'json', + description: 'Batch send entries, each with id, data, and optional per-message settings', + }, + receiptHandle: { type: 'string', description: 'Receipt handle of a received message' }, + visibilityTimeout: { + type: 'number', + description: 'New visibility timeout in seconds for a received message', + }, + deleteEntries: { + type: 'json', + description: 'Batch delete entries, each with id and receiptHandle', + }, + visibilityEntries: { + type: 'json', + description: + 'Batch visibility entries, each with id, receiptHandle, and an optional visibilityTimeout', + }, + maxNumberOfMessages: { type: 'number', description: 'Maximum messages to receive (1-10)' }, + waitTimeSeconds: { type: 'number', description: 'Long-poll wait time in seconds (0-20)' }, + receiveVisibilityTimeout: { + type: 'number', + description: 'Visibility timeout applied to the received messages', + }, + messageAttributeNames: { + type: 'json', + description: 'Names of user-defined message attributes to return', + }, + messageSystemAttributeNames: { + type: 'json', + description: 'System attribute names to return with each message', + }, + receiveRequestAttemptId: { + type: 'string', + description: 'FIFO deduplication token for a retried receive', + }, + queueNamePrefix: { + type: 'string', + description: 'Return only queues whose name starts with this', + }, + maxResults: { type: 'number', description: 'Maximum results to return (1-1000)' }, + nextToken: { type: 'string', description: 'Pagination token from a previous request' }, + attributeNames: { type: 'json', description: 'Queue attribute names to read' }, + queueAttributes: { type: 'json', description: 'Queue attributes to set, as string values' }, + createQueueAttributes: { + type: 'json', + description: 'Queue attributes for the new queue, as string values', + }, + createQueueTags: { type: 'json', description: 'Tags to apply to the new queue' }, + queueTags: { type: 'json', description: 'Tags to apply to the queue' }, + tagKeys: { type: 'json', description: 'Tag keys to remove, as an array of strings' }, + sourceArn: { type: 'string', description: 'ARN of the source queue for a message move task' }, + destinationArn: { + type: 'string', + description: 'ARN of the destination queue for a message move task', }, - data: { type: 'json', description: 'Data for send message operation' }, + maxNumberOfMessagesPerSecond: { + type: 'number', + description: 'Throttle for a message move task, up to 500 messages per second', + }, + moveTaskMaxResults: { type: 'number', description: 'Maximum move tasks to return (1-10)' }, + taskHandle: { type: 'string', description: 'Handle of a message move task' }, }, outputs: { message: { type: 'string', description: 'Success or error message describing the operation outcome', }, - id: { + id: { type: 'string', description: 'Message ID of the sent message' }, + md5OfMessageBody: { type: 'string', description: 'MD5 digest of the sent message body' }, + md5OfMessageAttributes: { + type: 'string', + description: 'MD5 digest of the sent message attributes', + }, + sequenceNumber: { type: 'string', - description: 'Message ID', + description: 'Sequence number assigned by a FIFO queue', + }, + messages: { + type: 'json', + description: + 'Received messages (messageId, receiptHandle, body, md5OfBody, md5OfMessageAttributes, attributes, messageAttributes)', + }, + successful: { + type: 'json', + description: 'Batch entries that succeeded', + }, + failed: { + type: 'json', + description: 'Batch entries that failed (id, senderFault, code, message)', + }, + successCount: { type: 'number', description: 'Number of batch entries that succeeded' }, + failureCount: { type: 'number', description: 'Number of batch entries that failed' }, + queueUrls: { type: 'json', description: 'Queue URLs returned by a list operation' }, + queueUrl: { type: 'string', description: 'URL of a single queue' }, + nextToken: { type: 'string', description: 'Pagination token for the next page of results' }, + count: { type: 'number', description: 'Number of items returned' }, + attributes: { + type: 'json', + description: 'Queue attributes as string values keyed by attribute name', + }, + tags: { type: 'json', description: 'Queue tags as string values keyed by tag key' }, + results: { + type: 'json', + description: + 'Message move tasks (taskHandle, status, sourceArn, destinationArn, maxNumberOfMessagesPerSecond, approximateNumberOfMessagesMoved, approximateNumberOfMessagesToMove, failureReason, startedTimestamp)', + }, + taskHandle: { type: 'string', description: 'Handle of the started message move task' }, + approximateNumberOfMessagesMoved: { + type: 'number', + description: 'Approximate number of messages moved before a task was cancelled', }, }, } @@ -253,5 +1024,47 @@ export const SQSBlockMeta = { content: '# Send Ordered FIFO Message\n\nDispatch a message to a FIFO queue when ordering within a stream and de-duplication matter.\n\n## Steps\n1. Identify the FIFO queue URL.\n2. Build the JSON message body.\n3. Set the message group ID so messages in the same group stay ordered, and set a deduplication ID to prevent duplicate sends.\n4. Send the message.\n\n## Output\nConfirm the message was sent with its message ID, group ID, and the queue it was placed on.', }, + { + name: 'drain-queue-batch', + description: + 'Receive a batch of Amazon SQS messages with long polling, process them, and delete each one so it is not redelivered.', + content: + '# Drain Queue Batch\n\nPull a batch of work off an SQS queue, act on it, and acknowledge it. This is the standard consumer loop: a message stays invisible for its visibility timeout and reappears unless it is deleted.\n\n## Steps\n1. Receive from the queue with a max message count of up to 10 and a wait time of up to 20 seconds so the call long-polls instead of returning empty.\n2. Process each returned message body.\n3. Delete each processed message by its receipt handle, using the batch delete when more than one succeeded.\n4. Leave any message you could not process undeleted so it becomes visible again or lands in the dead-letter queue.\n\n## Output\nReport how many messages were received, how many were processed, and how many were deleted.', + }, + { + name: 'extend-processing-lease', + description: + 'Extend the visibility timeout of an in-flight Amazon SQS message so long-running work finishes before the message is redelivered.', + content: + '# Extend Processing Lease\n\nWhen handling a message takes longer than the queue visibility timeout, extend the timeout so another consumer does not pick up the same message and the eventual delete does not fail.\n\n## Steps\n1. Note the receipt handle of the message being processed.\n2. Before the current visibility timeout expires, change the message visibility to a new timeout that covers the remaining work, up to 43200 seconds.\n3. Repeat while processing continues.\n4. Delete the message once the work is done.\n\n## Output\nReport the message the lease was extended for and the new timeout in seconds.', + }, + { + name: 'redrive-dead-letter-queue', + description: + 'Move messages out of an Amazon SQS dead-letter queue back to their source queue, and track the move task to completion.', + content: + '# Redrive Dead-Letter Queue\n\nAfter fixing the defect that caused failures, replay the messages parked in a dead-letter queue.\n\n## Steps\n1. List the source queues that redrive to the dead-letter queue to confirm which workloads are affected.\n2. Start a message move task from the dead-letter queue ARN, leaving the destination empty to return each message to its original source queue. Throttle it with a per-second cap if the consumers are fragile.\n3. List the move tasks for the queue to watch status, messages moved, and messages left to move.\n4. Cancel the task if the replay needs to stop; only a running task can be cancelled.\n\n## Output\nReport the task handle, its status, and how many messages were moved.', + }, + { + name: 'check-queue-backlog', + description: + 'Read the message counts and configuration of an Amazon SQS queue to judge backlog and consumer health.', + content: + '# Check Queue Backlog\n\nInspect a queue before scaling consumers or opening an incident.\n\n## Steps\n1. Resolve the queue URL from its name if you only have the name.\n2. Read the queue attributes, requesting ApproximateNumberOfMessages, ApproximateNumberOfMessagesNotVisible, ApproximateNumberOfMessagesDelayed, VisibilityTimeout, and RedrivePolicy.\n3. Compare the visible backlog against the in-flight count to tell a slow consumer from an absent one.\n4. If a redrive policy is set, check the dead-letter queue backlog too.\n\n## Output\nReport the visible, in-flight, and delayed message counts, the visibility timeout, and whether a dead-letter queue is configured.', + }, + { + name: 'provision-worker-queue', + description: + 'Create an Amazon SQS queue with a dead-letter queue, a visibility timeout matched to the work, and cost-allocation tags.', + content: + '# Provision Worker Queue\n\nStand up a queue for a new background workload with the settings a production consumer needs.\n\n## Steps\n1. Create the dead-letter queue first so its ARN exists.\n2. Read the dead-letter queue attributes to get its QueueArn.\n3. Create the main queue, setting VisibilityTimeout to comfortably exceed the expected processing time, MessageRetentionPeriod to the replay window you want, and RedrivePolicy pointing at the dead-letter queue ARN with a maxReceiveCount. Add FifoQueue when ordering matters, naming the queue with a .fifo suffix.\n4. Tag both queues with owner and environment for cost allocation.\n\n## Output\nReport the URLs of the created queues and the redrive policy linking them.', + }, + { + name: 'reset-queue-for-test', + description: + 'Clear every message from a non-production Amazon SQS queue so a test run starts from a known empty state.', + content: + '# Reset Queue For Test\n\nEmpty a scratch or staging queue between test runs. Purging deletes every message and cannot be undone, so confirm the queue is not production.\n\n## Steps\n1. Resolve the queue URL and read its attributes to confirm the environment tag and current message count.\n2. Purge the queue.\n3. Wait before purging again; SQS rejects a second purge within 60 seconds of the first.\n4. Re-read the message count to confirm the queue is empty.\n\n## Output\nReport the queue purged and how many messages it held beforehand.', + }, ], } as const satisfies BlockMeta diff --git a/apps/sim/blocks/blocks/ssm.ts b/apps/sim/blocks/blocks/ssm.ts new file mode 100644 index 00000000000..9d9aec3d3f8 --- /dev/null +++ b/apps/sim/blocks/blocks/ssm.ts @@ -0,0 +1,1354 @@ +import { SSMIcon } from '@/components/icons' +import type { BlockConfig, BlockMeta } from '@/blocks/types' +import { AuthMode, IntegrationType } from '@/blocks/types' +import type { SsmSendCommandResponse } from '@/tools/ssm/types' + +/** Operations whose SSM API caps `MaxResults` at 50. */ +const STANDARD_PAGE_OPERATIONS = [ + 'list_commands', + 'list_command_invocations', + 'describe_parameters', + 'list_compliance_items', + 'list_compliance_summaries', + 'describe_automation_executions', + 'list_documents', +] + +/** Operations that accept a `filters` array of Parameter Store string filters. */ +const PARAMETER_FILTER_OPERATIONS = ['get_parameters_by_path', 'describe_parameters'] + +const PAGINATED_OPERATIONS = [ + ...STANDARD_PAGE_OPERATIONS, + 'get_parameters_by_path', + 'describe_instance_information', + 'describe_instance_patches', + 'describe_instance_patch_states', +] + +function toOptionalNumber(value: unknown): number | undefined { + if (value === undefined || value === null || value === '') return undefined + const parsed = Number.parseInt(String(value), 10) + return Number.isNaN(parsed) ? undefined : parsed +} + +function toOptionalBoolean(value: unknown): boolean | undefined { + if (value === 'true' || value === true) return true + if (value === 'false' || value === false) return false + return undefined +} + +function toParsedJson(value: unknown): unknown { + if (value === undefined || value === null || value === '') return undefined + if (typeof value !== 'string') return value + return JSON.parse(value) +} + +export const SSMBlock: BlockConfig = { + type: 'ssm', + name: 'AWS Systems Manager', + description: 'Run commands, manage parameters, and audit managed nodes', + longDescription: + 'Integrate AWS Systems Manager into your workflow. Run commands on managed nodes, read and write Parameter Store values, inspect node inventory and patch compliance, and drive Automation runbooks.', + docsLink: 'https://docs.sim.ai/integrations/ssm', + category: 'tools', + integrationType: IntegrationType.DevOps, + bgColor: '#E7157B', + icon: SSMIcon, + authMode: AuthMode.ApiKey, + canvasPresentation: { + defaultTitle: 'AWS Systems Manager', + sentences: { + byOperation: { + send_command: [ + { text: 'Run document', field: 'documentName', core: true }, + { text: 'on', field: 'instanceIds' }, + ], + list_commands: [ + 'List commands', + { text: ', for command', field: 'commandId' }, + { text: ', on node', field: 'instanceId' }, + ], + list_command_invocations: [ + 'List command invocations', + { text: ', for command', field: 'commandId' }, + { text: ', on node', field: 'instanceId' }, + ], + get_command_invocation: [ + { text: 'Read output of command', field: 'commandId', core: true }, + { text: 'on node', field: 'instanceId', core: true }, + ], + cancel_command: [{ text: 'Cancel command', field: 'commandId', core: true }], + get_parameter: [{ text: 'Read parameter', field: 'parameterName', core: true }], + get_parameters: [{ text: 'Read parameters', field: 'parameterNames', core: true }], + get_parameters_by_path: [ + { text: 'Read parameters under', field: 'parameterPath', core: true }, + ], + put_parameter: [ + { text: 'Write parameter', field: 'parameterName', core: true }, + { text: ', as type', field: 'parameterType' }, + ], + delete_parameter: [{ text: 'Delete parameter', field: 'parameterName', core: true }], + describe_parameters: ['List parameter metadata', { text: ', up to', field: 'maxResults' }], + describe_instance_information: [ + 'List managed nodes', + { text: ', up to', field: 'instanceInfoMaxResults' }, + ], + describe_instance_patches: [ + { text: 'List patches on node', field: 'instanceId', core: true }, + ], + describe_instance_patch_states: [ + { text: 'Summarize patch state of', field: 'instanceIds', core: true }, + ], + list_compliance_items: ['List compliance items', { text: ', for', field: 'resourceIds' }], + list_compliance_summaries: [ + 'Summarize compliance', + { text: ', up to', field: 'maxResults' }, + ], + start_automation_execution: [ + { text: 'Start runbook', field: 'documentName', core: true }, + { text: ', over', field: 'targets' }, + ], + describe_automation_executions: [ + 'List automation executions', + { text: ', up to', field: 'maxResults' }, + ], + get_automation_execution: [ + { text: 'Read automation execution', field: 'automationExecutionId', core: true }, + ], + stop_automation_execution: [ + { text: 'Stop automation execution', field: 'automationExecutionId', core: true }, + { text: ', with', field: 'stopType' }, + ], + list_documents: ['List documents', { text: ', up to', field: 'maxResults' }], + get_document: [ + { text: 'Read document', field: 'documentName', core: true }, + { text: ', as', field: 'documentFormat' }, + ], + }, + }, + }, + subBlocks: [ + { + id: 'operation', + title: 'Operation', + type: 'dropdown', + options: [ + { label: 'Send Command', id: 'send_command' }, + { label: 'List Commands', id: 'list_commands' }, + { label: 'List Command Invocations', id: 'list_command_invocations' }, + { label: 'Get Command Invocation', id: 'get_command_invocation' }, + { label: 'Cancel Command', id: 'cancel_command' }, + { label: 'Get Parameter', id: 'get_parameter' }, + { label: 'Get Parameters', id: 'get_parameters' }, + { label: 'Get Parameters By Path', id: 'get_parameters_by_path' }, + { label: 'Put Parameter', id: 'put_parameter' }, + { label: 'Delete Parameter', id: 'delete_parameter' }, + { label: 'Describe Parameters', id: 'describe_parameters' }, + { label: 'Describe Instance Information', id: 'describe_instance_information' }, + { label: 'Describe Instance Patches', id: 'describe_instance_patches' }, + { label: 'Describe Instance Patch States', id: 'describe_instance_patch_states' }, + { label: 'List Compliance Items', id: 'list_compliance_items' }, + { label: 'List Compliance Summaries', id: 'list_compliance_summaries' }, + { label: 'Start Automation Execution', id: 'start_automation_execution' }, + { label: 'Describe Automation Executions', id: 'describe_automation_executions' }, + { label: 'Get Automation Execution', id: 'get_automation_execution' }, + { label: 'Stop Automation Execution', id: 'stop_automation_execution' }, + { label: 'List Documents', id: 'list_documents' }, + { label: 'Get Document', id: 'get_document' }, + ], + value: () => 'send_command', + }, + { + id: 'region', + title: 'AWS Region', + type: 'short-input', + placeholder: 'us-east-1', + required: true, + }, + { + id: 'accessKeyId', + title: 'AWS Access Key ID', + type: 'short-input', + placeholder: 'AKIA...', + password: true, + required: true, + }, + { + id: 'secretAccessKey', + title: 'AWS Secret Access Key', + type: 'short-input', + placeholder: 'Your secret access key', + password: true, + required: true, + }, + { + id: 'documentName', + title: 'Document Name', + type: 'short-input', + placeholder: 'AWS-RunShellScript', + condition: { + field: 'operation', + value: ['send_command', 'start_automation_execution', 'get_document'], + }, + required: { + field: 'operation', + value: ['send_command', 'start_automation_execution', 'get_document'], + }, + }, + { + id: 'instanceIds', + title: 'Instance IDs', + type: 'code', + placeholder: '["i-0123456789abcdef0"]', + condition: { + field: 'operation', + value: ['send_command', 'cancel_command', 'describe_instance_patch_states'], + }, + required: { field: 'operation', value: 'describe_instance_patch_states' }, + }, + { + id: 'targets', + title: 'Targets', + type: 'code', + placeholder: '[{"Key":"tag:Environment","Values":["prod"]}]', + condition: { field: 'operation', value: ['send_command', 'start_automation_execution'] }, + required: false, + mode: 'advanced', + }, + { + id: 'parameters', + title: 'Document Parameters', + type: 'code', + placeholder: '{"commands":["df -h"]}', + condition: { field: 'operation', value: ['send_command', 'start_automation_execution'] }, + required: false, + wandConfig: { + enabled: true, + prompt: + 'Generate SSM document parameters as a JSON object mapping each parameter name to an array of string values. Return ONLY the JSON.', + generationType: 'json-object', + }, + }, + { + id: 'documentVersion', + title: 'Document Version', + type: 'short-input', + placeholder: '$LATEST, $DEFAULT, or a version number', + condition: { + field: 'operation', + value: ['send_command', 'start_automation_execution', 'get_document'], + }, + required: false, + mode: 'advanced', + }, + { + id: 'comment', + title: 'Comment', + type: 'short-input', + placeholder: 'Restart the web tier', + condition: { field: 'operation', value: 'send_command' }, + required: false, + mode: 'advanced', + }, + { + id: 'executionTimeoutSeconds', + title: 'Acknowledgement Timeout (Seconds)', + type: 'short-input', + placeholder: '3600 (30-2592000)', + condition: { field: 'operation', value: 'send_command' }, + required: false, + mode: 'advanced', + }, + { + id: 'maxConcurrency', + title: 'Max Concurrency', + type: 'short-input', + placeholder: '50% or 10', + condition: { field: 'operation', value: ['send_command', 'start_automation_execution'] }, + required: false, + mode: 'advanced', + }, + { + id: 'maxErrors', + title: 'Max Errors', + type: 'short-input', + placeholder: '0 or 10%', + condition: { field: 'operation', value: ['send_command', 'start_automation_execution'] }, + required: false, + mode: 'advanced', + }, + { + id: 'outputS3BucketName', + title: 'Output S3 Bucket', + type: 'short-input', + placeholder: 'my-ssm-output-bucket', + condition: { field: 'operation', value: 'send_command' }, + required: false, + mode: 'advanced', + }, + { + id: 'outputS3KeyPrefix', + title: 'Output S3 Key Prefix', + type: 'short-input', + placeholder: 'run-command/', + condition: { field: 'operation', value: 'send_command' }, + required: false, + mode: 'advanced', + }, + { + id: 'serviceRoleArn', + title: 'Notification Service Role ARN', + type: 'short-input', + placeholder: 'arn:aws:iam::123456789012:role/ssm-notifications', + condition: { field: 'operation', value: 'send_command' }, + required: false, + mode: 'advanced', + }, + { + id: 'commandId', + title: 'Command ID', + type: 'short-input', + placeholder: '11111111-2222-3333-4444-555555555555', + condition: { + field: 'operation', + value: [ + 'list_commands', + 'list_command_invocations', + 'get_command_invocation', + 'cancel_command', + ], + }, + required: { field: 'operation', value: ['get_command_invocation', 'cancel_command'] }, + }, + { + id: 'instanceId', + title: 'Instance ID', + type: 'short-input', + placeholder: 'i-0123456789abcdef0', + condition: { + field: 'operation', + value: [ + 'list_commands', + 'list_command_invocations', + 'get_command_invocation', + 'describe_instance_patches', + ], + }, + required: { + field: 'operation', + value: ['get_command_invocation', 'describe_instance_patches'], + }, + }, + { + id: 'commandFilters', + title: 'Command Filters', + type: 'code', + placeholder: '[{"key":"Status","value":"Failed"}]', + condition: { field: 'operation', value: ['list_commands', 'list_command_invocations'] }, + required: false, + mode: 'advanced', + }, + { + id: 'details', + title: 'Include Plugin Detail', + type: 'dropdown', + options: [ + { label: 'No', id: 'false' }, + { label: 'Yes', id: 'true' }, + ], + value: () => 'false', + condition: { field: 'operation', value: 'list_command_invocations' }, + required: false, + mode: 'advanced', + }, + { + id: 'pluginName', + title: 'Plugin Name', + type: 'short-input', + placeholder: 'aws:runShellScript', + condition: { field: 'operation', value: 'get_command_invocation' }, + required: false, + mode: 'advanced', + }, + { + id: 'parameterName', + title: 'Parameter Name', + type: 'short-input', + placeholder: '/prod/app/database-url', + condition: { + field: 'operation', + value: ['get_parameter', 'put_parameter', 'delete_parameter'], + }, + required: { + field: 'operation', + value: ['get_parameter', 'put_parameter', 'delete_parameter'], + }, + }, + { + id: 'parameterNames', + title: 'Parameter Names', + type: 'code', + placeholder: '["/prod/app/database-url","/prod/app/api-host"]', + condition: { field: 'operation', value: 'get_parameters' }, + required: { field: 'operation', value: 'get_parameters' }, + }, + { + id: 'parameterPath', + title: 'Parameter Path', + type: 'short-input', + placeholder: '/prod/app', + condition: { field: 'operation', value: 'get_parameters_by_path' }, + required: { field: 'operation', value: 'get_parameters_by_path' }, + }, + { + id: 'recursive', + title: 'Recursive', + type: 'dropdown', + options: [ + { label: 'No', id: 'false' }, + { label: 'Yes', id: 'true' }, + ], + value: () => 'false', + condition: { field: 'operation', value: 'get_parameters_by_path' }, + required: false, + }, + { + id: 'withDecryption', + title: 'Decrypt SecureString Values', + type: 'dropdown', + options: [ + { label: 'No', id: 'false' }, + { label: 'Yes', id: 'true' }, + ], + value: () => 'false', + condition: { + field: 'operation', + value: ['get_parameter', 'get_parameters', 'get_parameters_by_path'], + }, + required: false, + }, + { + id: 'parameterValue', + title: 'Parameter Value', + type: 'long-input', + password: true, + placeholder: 'The value to store', + condition: { field: 'operation', value: 'put_parameter' }, + required: { field: 'operation', value: 'put_parameter' }, + }, + { + id: 'parameterType', + title: 'Parameter Type', + type: 'dropdown', + options: [ + { label: 'String', id: 'String' }, + { label: 'StringList', id: 'StringList' }, + { label: 'SecureString', id: 'SecureString' }, + ], + value: () => 'String', + condition: { field: 'operation', value: 'put_parameter' }, + required: false, + }, + { + id: 'overwrite', + title: 'Overwrite Existing', + type: 'dropdown', + options: [ + { label: 'No', id: 'false' }, + { label: 'Yes', id: 'true' }, + ], + value: () => 'false', + condition: { field: 'operation', value: 'put_parameter' }, + required: false, + }, + { + id: 'parameterDescription', + title: 'Parameter Description', + type: 'short-input', + placeholder: 'Production database connection string', + condition: { field: 'operation', value: 'put_parameter' }, + required: false, + mode: 'advanced', + }, + { + id: 'kmsKeyId', + title: 'KMS Key ID', + type: 'short-input', + placeholder: 'alias/aws/ssm or a key ARN', + condition: { field: 'operation', value: 'put_parameter' }, + required: false, + mode: 'advanced', + }, + { + id: 'allowedPattern', + title: 'Allowed Pattern', + type: 'short-input', + placeholder: '^\\d+$', + condition: { field: 'operation', value: 'put_parameter' }, + required: false, + mode: 'advanced', + }, + { + id: 'parameterTier', + title: 'Parameter Tier', + type: 'dropdown', + /** + * `Tier` is optional, and omitting it lets the account's own default apply — + * which may be Intelligent-Tiering. A dropdown with no `value()` seeds and + * persists its first option, so without this sentinel the block would silently + * force `Standard` on every write. + */ + value: () => '', + options: [ + { label: 'Account default', id: '' }, + { label: 'Standard', id: 'Standard' }, + { label: 'Advanced', id: 'Advanced' }, + { label: 'Intelligent-Tiering', id: 'Intelligent-Tiering' }, + ], + condition: { field: 'operation', value: 'put_parameter' }, + required: false, + mode: 'advanced', + }, + { + id: 'parameterDataType', + title: 'Parameter Data Type', + type: 'short-input', + placeholder: 'text, aws:ec2:image, or aws:ssm:integration', + condition: { field: 'operation', value: 'put_parameter' }, + required: false, + mode: 'advanced', + }, + { + id: 'parameterPolicies', + title: 'Parameter Policies', + type: 'code', + placeholder: '[{"Type":"Expiration","Version":"1.0","Attributes":{"Timestamp":"..."}}]', + condition: { field: 'operation', value: 'put_parameter' }, + required: false, + mode: 'advanced', + }, + { + id: 'parameterFilters', + title: 'Parameter Filters', + type: 'code', + placeholder: '[{"Key":"Type","Option":"Equals","Values":["SecureString"]}]', + condition: { field: 'operation', value: PARAMETER_FILTER_OPERATIONS }, + required: false, + mode: 'advanced', + }, + { + id: 'shared', + title: 'Shared Parameters', + type: 'dropdown', + options: [ + { label: 'No', id: 'false' }, + { label: 'Yes', id: 'true' }, + ], + value: () => 'false', + condition: { field: 'operation', value: 'describe_parameters' }, + required: false, + mode: 'advanced', + }, + { + id: 'instanceInfoFilters', + title: 'Node Filters', + type: 'code', + placeholder: '[{"Key":"PingStatus","Values":["Online"]}]', + condition: { field: 'operation', value: 'describe_instance_information' }, + required: false, + mode: 'advanced', + }, + { + id: 'patchFilters', + title: 'Patch Filters', + type: 'code', + placeholder: '[{"Key":"State","Values":["Missing"]}]', + condition: { field: 'operation', value: 'describe_instance_patches' }, + required: false, + mode: 'advanced', + }, + { + id: 'resourceIds', + title: 'Resource IDs', + type: 'code', + placeholder: '["i-0123456789abcdef0"]', + condition: { field: 'operation', value: 'list_compliance_items' }, + required: false, + }, + { + id: 'resourceTypes', + title: 'Resource Types', + type: 'code', + placeholder: '["ManagedInstance"]', + condition: { field: 'operation', value: 'list_compliance_items' }, + required: false, + mode: 'advanced', + }, + { + id: 'complianceFilters', + title: 'Compliance Filters', + type: 'code', + placeholder: '[{"Key":"Status","Values":["NON_COMPLIANT"],"Type":"EQUAL"}]', + condition: { + field: 'operation', + value: ['list_compliance_items', 'list_compliance_summaries'], + }, + required: false, + mode: 'advanced', + }, + { + id: 'mode', + title: 'Execution Mode', + type: 'dropdown', + options: [ + { label: 'Auto', id: 'Auto' }, + { label: 'Interactive', id: 'Interactive' }, + ], + value: () => 'Auto', + condition: { field: 'operation', value: 'start_automation_execution' }, + required: false, + mode: 'advanced', + }, + { + id: 'targetParameterName', + title: 'Target Parameter Name', + type: 'short-input', + placeholder: 'InstanceId', + condition: { field: 'operation', value: 'start_automation_execution' }, + required: false, + mode: 'advanced', + }, + { + id: 'clientToken', + title: 'Client Token', + type: 'short-input', + placeholder: 'Idempotency token, exactly 36 characters', + condition: { field: 'operation', value: 'start_automation_execution' }, + required: false, + mode: 'advanced', + }, + { + id: 'automationFilters', + title: 'Automation Filters', + type: 'code', + placeholder: '[{"Key":"ExecutionStatus","Values":["Failed"]}]', + condition: { field: 'operation', value: 'describe_automation_executions' }, + required: false, + mode: 'advanced', + }, + { + id: 'automationExecutionId', + title: 'Automation Execution ID', + type: 'short-input', + placeholder: '11111111-2222-3333-4444-555555555555', + condition: { + field: 'operation', + value: ['get_automation_execution', 'stop_automation_execution'], + }, + required: { + field: 'operation', + value: ['get_automation_execution', 'stop_automation_execution'], + }, + }, + { + id: 'stopType', + title: 'Stop Type', + type: 'dropdown', + options: [ + { label: 'Cancel', id: 'Cancel' }, + { label: 'Complete', id: 'Complete' }, + ], + value: () => 'Cancel', + condition: { field: 'operation', value: 'stop_automation_execution' }, + required: false, + }, + { + id: 'documentFilters', + title: 'Document Filters', + type: 'code', + placeholder: '[{"Key":"DocumentType","Values":["Automation"]}]', + condition: { field: 'operation', value: 'list_documents' }, + required: false, + mode: 'advanced', + }, + { + id: 'versionName', + title: 'Version Name', + type: 'short-input', + placeholder: 'Release-2024-06', + condition: { field: 'operation', value: 'get_document' }, + required: false, + mode: 'advanced', + }, + { + id: 'documentFormat', + title: 'Document Format', + type: 'dropdown', + options: [ + { label: 'JSON', id: 'JSON' }, + { label: 'YAML', id: 'YAML' }, + { label: 'Text', id: 'TEXT' }, + ], + condition: { field: 'operation', value: 'get_document' }, + required: false, + }, + { + id: 'maxResults', + title: 'Max Results', + type: 'short-input', + placeholder: '50 (1-50)', + condition: { field: 'operation', value: STANDARD_PAGE_OPERATIONS }, + required: false, + mode: 'advanced', + }, + { + id: 'pathMaxResults', + title: 'Max Results', + type: 'short-input', + placeholder: '10 (1-10)', + condition: { field: 'operation', value: 'get_parameters_by_path' }, + required: false, + mode: 'advanced', + }, + { + id: 'instanceInfoMaxResults', + title: 'Max Results', + type: 'short-input', + placeholder: '50 (5-50)', + condition: { field: 'operation', value: 'describe_instance_information' }, + required: false, + mode: 'advanced', + }, + { + id: 'patchMaxResults', + title: 'Max Results', + type: 'short-input', + placeholder: '100 (10-100)', + condition: { + field: 'operation', + value: ['describe_instance_patches', 'describe_instance_patch_states'], + }, + required: false, + mode: 'advanced', + }, + { + id: 'nextToken', + title: 'Next Token', + type: 'short-input', + placeholder: 'Pagination token', + condition: { field: 'operation', value: PAGINATED_OPERATIONS }, + required: false, + mode: 'advanced', + }, + ], + tools: { + access: [ + 'ssm_send_command', + 'ssm_list_commands', + 'ssm_list_command_invocations', + 'ssm_get_command_invocation', + 'ssm_cancel_command', + 'ssm_get_parameter', + 'ssm_get_parameters', + 'ssm_get_parameters_by_path', + 'ssm_put_parameter', + 'ssm_delete_parameter', + 'ssm_describe_parameters', + 'ssm_describe_instance_information', + 'ssm_describe_instance_patches', + 'ssm_describe_instance_patch_states', + 'ssm_list_compliance_items', + 'ssm_list_compliance_summaries', + 'ssm_start_automation_execution', + 'ssm_describe_automation_executions', + 'ssm_get_automation_execution', + 'ssm_stop_automation_execution', + 'ssm_list_documents', + 'ssm_get_document', + ], + config: { + tool: (params) => { + switch (params.operation) { + case 'send_command': + case 'list_commands': + case 'list_command_invocations': + case 'get_command_invocation': + case 'cancel_command': + case 'get_parameter': + case 'get_parameters': + case 'get_parameters_by_path': + case 'put_parameter': + case 'delete_parameter': + case 'describe_parameters': + case 'describe_instance_information': + case 'describe_instance_patches': + case 'describe_instance_patch_states': + case 'list_compliance_items': + case 'list_compliance_summaries': + case 'start_automation_execution': + case 'describe_automation_executions': + case 'get_automation_execution': + case 'stop_automation_execution': + case 'list_documents': + case 'get_document': + return `ssm_${params.operation}` + default: + throw new Error(`Invalid Systems Manager operation: ${params.operation}`) + } + }, + params: (params) => { + const result: Record = { + region: params.region, + accessKeyId: params.accessKeyId, + secretAccessKey: params.secretAccessKey, + } + + const setJson = (key: string, value: unknown) => { + const parsed = toParsedJson(value) + if (parsed !== undefined) result[key] = parsed + } + const setNumber = (key: string, value: unknown) => { + const parsed = toOptionalNumber(value) + if (parsed !== undefined) result[key] = parsed + } + const setBoolean = (key: string, value: unknown) => { + const parsed = toOptionalBoolean(value) + if (parsed !== undefined) result[key] = parsed + } + const setString = (key: string, value: unknown) => { + if (value === undefined || value === null || value === '') return + result[key] = String(value) + } + + switch (params.operation) { + case 'send_command': + result.documentName = params.documentName + setJson('instanceIds', params.instanceIds) + setJson('targets', params.targets) + setJson('parameters', params.parameters) + setString('documentVersion', params.documentVersion) + setString('comment', params.comment) + setNumber('executionTimeoutSeconds', params.executionTimeoutSeconds) + setString('maxConcurrency', params.maxConcurrency) + setString('maxErrors', params.maxErrors) + setString('outputS3BucketName', params.outputS3BucketName) + setString('outputS3KeyPrefix', params.outputS3KeyPrefix) + setString('serviceRoleArn', params.serviceRoleArn) + break + case 'list_commands': + setString('commandId', params.commandId) + setString('instanceId', params.instanceId) + setJson('filters', params.commandFilters) + setNumber('maxResults', params.maxResults) + setString('nextToken', params.nextToken) + break + case 'list_command_invocations': + setString('commandId', params.commandId) + setString('instanceId', params.instanceId) + setJson('filters', params.commandFilters) + setBoolean('details', params.details) + setNumber('maxResults', params.maxResults) + setString('nextToken', params.nextToken) + break + case 'get_command_invocation': + result.commandId = params.commandId + result.instanceId = params.instanceId + setString('pluginName', params.pluginName) + break + case 'cancel_command': + result.commandId = params.commandId + setJson('instanceIds', params.instanceIds) + break + case 'get_parameter': + result.name = params.parameterName + setBoolean('withDecryption', params.withDecryption) + break + case 'get_parameters': + setJson('names', params.parameterNames) + setBoolean('withDecryption', params.withDecryption) + break + case 'get_parameters_by_path': + result.path = params.parameterPath + setBoolean('recursive', params.recursive) + setBoolean('withDecryption', params.withDecryption) + setJson('parameterFilters', params.parameterFilters) + setNumber('maxResults', params.pathMaxResults) + setString('nextToken', params.nextToken) + break + case 'put_parameter': + result.name = params.parameterName + result.value = params.parameterValue + setString('type', params.parameterType) + setString('description', params.parameterDescription) + setString('keyId', params.kmsKeyId) + setBoolean('overwrite', params.overwrite) + setString('allowedPattern', params.allowedPattern) + setString('tier', params.parameterTier) + setString('dataType', params.parameterDataType) + setString('policies', params.parameterPolicies) + break + case 'delete_parameter': + result.name = params.parameterName + break + case 'describe_parameters': + setJson('parameterFilters', params.parameterFilters) + setBoolean('shared', params.shared) + setNumber('maxResults', params.maxResults) + setString('nextToken', params.nextToken) + break + case 'describe_instance_information': + setJson('filters', params.instanceInfoFilters) + setNumber('maxResults', params.instanceInfoMaxResults) + setString('nextToken', params.nextToken) + break + case 'describe_instance_patches': + result.instanceId = params.instanceId + setJson('filters', params.patchFilters) + setNumber('maxResults', params.patchMaxResults) + setString('nextToken', params.nextToken) + break + case 'describe_instance_patch_states': + setJson('instanceIds', params.instanceIds) + setNumber('maxResults', params.patchMaxResults) + setString('nextToken', params.nextToken) + break + case 'list_compliance_items': + setJson('resourceIds', params.resourceIds) + setJson('resourceTypes', params.resourceTypes) + setJson('filters', params.complianceFilters) + setNumber('maxResults', params.maxResults) + setString('nextToken', params.nextToken) + break + case 'list_compliance_summaries': + setJson('filters', params.complianceFilters) + setNumber('maxResults', params.maxResults) + setString('nextToken', params.nextToken) + break + case 'start_automation_execution': + result.documentName = params.documentName + setString('documentVersion', params.documentVersion) + setJson('parameters', params.parameters) + setString('mode', params.mode) + setString('targetParameterName', params.targetParameterName) + setJson('targets', params.targets) + setString('maxConcurrency', params.maxConcurrency) + setString('maxErrors', params.maxErrors) + setString('clientToken', params.clientToken) + break + case 'describe_automation_executions': + setJson('filters', params.automationFilters) + setNumber('maxResults', params.maxResults) + setString('nextToken', params.nextToken) + break + case 'get_automation_execution': + result.automationExecutionId = params.automationExecutionId + break + case 'stop_automation_execution': + result.automationExecutionId = params.automationExecutionId + setString('stopType', params.stopType) + break + case 'list_documents': + setJson('filters', params.documentFilters) + setNumber('maxResults', params.maxResults) + setString('nextToken', params.nextToken) + break + case 'get_document': + result.name = params.documentName + setString('documentVersion', params.documentVersion) + setString('versionName', params.versionName) + setString('documentFormat', params.documentFormat) + break + } + + return result + }, + }, + }, + inputs: { + operation: { type: 'string', description: 'Systems Manager operation to perform' }, + region: { type: 'string', description: 'AWS region' }, + accessKeyId: { type: 'string', description: 'AWS access key ID' }, + secretAccessKey: { type: 'string', description: 'AWS secret access key' }, + documentName: { type: 'string', description: 'SSM document or runbook name' }, + documentVersion: { type: 'string', description: 'Document version to use' }, + instanceIds: { type: 'json', description: 'Managed node IDs, as an array of strings' }, + targets: { type: 'json', description: 'Targets, as an array of {Key, Values} objects' }, + parameters: { + type: 'json', + description: 'Document parameters, as an object of name to string array', + }, + comment: { type: 'string', description: 'Comment describing the command' }, + executionTimeoutSeconds: { + type: 'number', + description: 'Seconds a node has to acknowledge the command', + }, + maxConcurrency: { type: 'string', description: 'Concurrency, as a number or percentage' }, + maxErrors: { type: 'string', description: 'Error threshold, as a number or percentage' }, + outputS3BucketName: { type: 'string', description: 'S3 bucket for command output' }, + outputS3KeyPrefix: { type: 'string', description: 'S3 key prefix for command output' }, + serviceRoleArn: { type: 'string', description: 'IAM service role ARN for notifications' }, + commandId: { type: 'string', description: 'Run Command execution ID' }, + instanceId: { type: 'string', description: 'Managed node ID' }, + commandFilters: { + type: 'json', + description: 'Run Command filters, as an array of {key, value} objects', + }, + details: { type: 'string', description: 'Whether to include per-plugin invocation detail' }, + pluginName: { type: 'string', description: 'Document plugin to read output for' }, + parameterName: { type: 'string', description: 'Parameter Store parameter name' }, + parameterNames: { type: 'json', description: 'Parameter names, as an array of strings' }, + parameterPath: { type: 'string', description: 'Parameter Store hierarchy path' }, + recursive: { type: 'string', description: 'Whether to include nested paths' }, + withDecryption: { type: 'string', description: 'Whether to decrypt SecureString values' }, + parameterValue: { type: 'string', description: 'Value to store in the parameter' }, + parameterType: { type: 'string', description: 'String, StringList, or SecureString' }, + overwrite: { type: 'string', description: 'Whether to overwrite an existing parameter' }, + parameterDescription: { type: 'string', description: 'Description of the parameter' }, + kmsKeyId: { type: 'string', description: 'KMS key used to encrypt a SecureString parameter' }, + allowedPattern: { type: 'string', description: 'Regular expression the value must match' }, + parameterTier: { type: 'string', description: 'Standard, Advanced, or Intelligent-Tiering' }, + parameterDataType: { type: 'string', description: 'Data type of the parameter' }, + parameterPolicies: { type: 'string', description: 'Parameter policies as a JSON array string' }, + parameterFilters: { + type: 'json', + description: 'Parameter filters, as an array of {Key, Option, Values} objects', + }, + shared: { type: 'string', description: 'Whether to list parameters shared with this account' }, + instanceInfoFilters: { + type: 'json', + description: 'Managed node filters, as an array of {Key, Values} objects', + }, + patchFilters: { + type: 'json', + description: 'Patch filters, as an array of {Key, Values} objects', + }, + resourceIds: { type: 'json', description: 'Compliance resource IDs, as an array of strings' }, + resourceTypes: { + type: 'json', + description: 'Compliance resource types, as an array of strings', + }, + complianceFilters: { + type: 'json', + description: 'Compliance filters, as an array of {Key, Values, Type} objects', + }, + mode: { type: 'string', description: 'Automation execution mode' }, + targetParameterName: { + type: 'string', + description: 'Runbook parameter that receives each resolved target', + }, + clientToken: { type: 'string', description: 'Idempotency token for the automation execution' }, + automationFilters: { + type: 'json', + description: 'Automation filters, as an array of {Key, Values} objects', + }, + automationExecutionId: { type: 'string', description: 'Automation execution ID' }, + stopType: { type: 'string', description: 'How to stop the automation execution' }, + documentFilters: { + type: 'json', + description: 'Document filters, as an array of {Key, Values} objects', + }, + versionName: { type: 'string', description: 'User-defined document version name' }, + documentFormat: { type: 'string', description: 'Format to return document content in' }, + maxResults: { type: 'number', description: 'Maximum number of results to return' }, + pathMaxResults: { + type: 'number', + description: 'Maximum number of parameters to return for a path read', + }, + instanceInfoMaxResults: { + type: 'number', + description: 'Maximum number of managed nodes to return', + }, + patchMaxResults: { + type: 'number', + description: 'Maximum number of patch records to return', + }, + nextToken: { type: 'string', description: 'Pagination token' }, + }, + outputs: { + message: { type: 'string', description: 'Operation status message' }, + commandId: { type: 'string', description: 'Run Command execution ID' }, + commands: { + type: 'json', + description: + 'Commands, each with commandId, documentName, status, statusDetails, requestedDateTime, instanceIds, targets, targetCount, completedCount, and errorCount', + }, + commandInvocations: { + type: 'json', + description: + 'Per-node invocations, each with commandId, instanceId, instanceName, status, statusDetails, requestedDateTime, standardOutputUrl, standardErrorUrl, and commandPlugins', + }, + documentName: { type: 'string', description: 'Name of the document that was used' }, + documentVersion: { type: 'string', description: 'Document version that was used' }, + comment: { type: 'string', description: 'Comment supplied with the command' }, + status: { type: 'string', description: 'Status of the command, invocation, or document' }, + statusDetails: { type: 'string', description: 'Detailed status text' }, + statusInformation: { type: 'string', description: 'Detail about a document status' }, + requestedDateTime: { type: 'string', description: 'When the command was requested' }, + expiresAfter: { type: 'string', description: 'When the command stops being dispatched' }, + instanceIds: { type: 'array', description: 'Managed node IDs the command targets' }, + instanceId: { type: 'string', description: 'Managed node the invocation ran on' }, + targets: { + type: 'json', + description: 'Targets the command was sent to, as an array of {key, values}', + }, + maxConcurrency: { type: 'string', description: 'Concurrency the execution ran with' }, + maxErrors: { type: 'string', description: 'Error threshold the execution ran with' }, + targetCount: { type: 'number', description: 'Number of targets the command was sent to' }, + completedCount: { type: 'number', description: 'Number of targets that have completed' }, + errorCount: { type: 'number', description: 'Number of targets whose execution failed' }, + deliveryTimedOutCount: { + type: 'number', + description: 'Number of targets the command could not reach in time', + }, + executionTimeoutSeconds: { + type: 'number', + description: 'Acknowledgement timeout the command ran with', + }, + outputS3BucketName: { type: 'string', description: 'S3 bucket command output is written to' }, + outputS3KeyPrefix: { type: 'string', description: 'S3 key prefix for command output' }, + outputS3Region: { type: 'string', description: 'S3 region reported for command output' }, + serviceRole: { type: 'string', description: 'IAM service role used for notifications' }, + pluginName: { type: 'string', description: 'Document plugin the output belongs to' }, + responseCode: { type: 'number', description: 'Exit code of the command on the node' }, + executionStartDateTime: { type: 'string', description: 'When the command started on the node' }, + executionElapsedTime: { type: 'string', description: 'How long the command ran' }, + executionEndDateTime: { type: 'string', description: 'When the command finished on the node' }, + standardOutputContent: { type: 'string', description: 'First 24000 characters of stdout' }, + standardOutputUrl: { type: 'string', description: 'S3 URL of the full stdout' }, + standardErrorContent: { type: 'string', description: 'First 8000 characters of stderr' }, + standardErrorUrl: { type: 'string', description: 'S3 URL of the full stderr' }, + name: { type: 'string', description: 'Name of the parameter or document' }, + type: { type: 'string', description: 'Parameter type' }, + value: { type: 'string', description: 'Parameter value' }, + version: { type: 'number', description: 'Parameter version' }, + selector: { type: 'string', description: 'Version or label selector used to read a parameter' }, + sourceResult: { type: 'string', description: 'Raw result from the parameter source' }, + lastModifiedDate: { type: 'string', description: 'When the parameter was last changed' }, + arn: { type: 'string', description: 'ARN of the parameter' }, + dataType: { type: 'string', description: 'Data type of the parameter' }, + tier: { type: 'string', description: 'Tier the parameter is stored in' }, + parameters: { + type: 'json', + description: + 'Parameters read, or the parameter values an automation execution was started with', + }, + invalidParameters: { + type: 'array', + description: 'Parameter names that could not be read', + }, + instances: { + type: 'json', + description: + 'Managed nodes, each with instanceId, pingStatus, lastPingDateTime, agentVersion, platformType, platformName, platformVersion, computerName, ipAddress, iamRole, and associationStatus', + }, + patches: { + type: 'json', + description: + 'Patches, each with title, kbId, classification, severity, state, installedTime, and cveIds', + }, + instancePatchStates: { + type: 'json', + description: + 'Patch states, each with instanceId, patchGroup, baselineId, operation, installedCount, missingCount, failedCount, criticalNonCompliantCount, and securityNonCompliantCount', + }, + complianceItems: { + type: 'json', + description: + 'Compliance items, each with complianceType, resourceType, resourceId, id, title, status, severity, executionTime, and details', + }, + complianceSummaryItems: { + type: 'json', + description: + 'Compliance summaries, each with complianceType, compliantCount, compliantSeveritySummary, nonCompliantCount, and nonCompliantSeveritySummary', + }, + automationExecutionId: { type: 'string', description: 'Automation execution ID' }, + automationExecutions: { + type: 'json', + description: + 'Automation executions, each with automationExecutionId, documentName, automationExecutionStatus, executionStartTime, executionEndTime, executedBy, currentStepName, and failureMessage', + }, + automationExecutionStatus: { + type: 'string', + description: 'Status of the automation execution', + }, + executionStartTime: { type: 'string', description: 'When the automation execution started' }, + executionEndTime: { type: 'string', description: 'When the automation execution finished' }, + executedBy: { type: 'string', description: 'IAM identity that started the execution' }, + mode: { type: 'string', description: 'Automation execution mode' }, + parentAutomationExecutionId: { type: 'string', description: 'Parent execution ID' }, + currentStepName: { type: 'string', description: 'Step the execution is currently running' }, + currentAction: { type: 'string', description: 'Action the execution is currently running' }, + failureMessage: { type: 'string', description: 'Reason the execution failed' }, + targetParameterName: { + type: 'string', + description: 'Runbook parameter that received each resolved target', + }, + target: { type: 'string', description: 'Resource the execution targeted' }, + outputs: { type: 'json', description: 'Outputs the automation execution produced' }, + stepExecutions: { + type: 'json', + description: + 'Automation steps, each with stepName, action, stepStatus, executionStartTime, executionEndTime, failureMessage, and nextStep', + }, + stepExecutionsTruncated: { + type: 'boolean', + description: 'Whether the returned step list was truncated', + }, + documents: { + type: 'json', + description: + 'Documents, each with name, displayName, owner, documentType, documentFormat, documentVersion, platformTypes, targetType, createdDate, and tags', + }, + displayName: { type: 'string', description: 'Friendly name of the document' }, + createdDate: { type: 'string', description: 'When the document was created' }, + versionName: { type: 'string', description: 'User-defined document version name' }, + content: { type: 'string', description: 'Content of the document' }, + documentType: { type: 'string', description: 'Type of the document' }, + documentFormat: { type: 'string', description: 'Format the document content is returned in' }, + reviewStatus: { type: 'string', description: 'Review status of the document' }, + nextToken: { type: 'string', description: 'Pagination token for the next page of results' }, + count: { type: 'number', description: 'Number of records returned' }, + }, +} + +export const SSMBlockMeta = { + tags: ['cloud', 'automation'], + url: 'https://aws.amazon.com/systems-manager', + templates: [ + { + icon: SSMIcon, + title: 'Systems Manager patch reporter', + prompt: + 'Build a scheduled workflow that reads AWS Systems Manager patch compliance for every managed node, flags nodes with missing critical or security patches, and posts a ranked remediation list to Slack.', + modules: ['scheduled', 'agent', 'workflows'], + category: 'operations', + tags: ['devops', 'monitoring'], + alsoIntegrations: ['slack'], + }, + { + icon: SSMIcon, + title: 'Systems Manager agent health watch', + prompt: + 'Create a scheduled workflow that lists AWS Systems Manager managed nodes, identifies nodes whose agent has lost connection or is running an outdated version, and opens a Jira ticket for each one.', + modules: ['scheduled', 'agent', 'workflows'], + category: 'operations', + tags: ['devops', 'monitoring'], + alsoIntegrations: ['jira'], + }, + { + icon: SSMIcon, + title: 'Systems Manager runbook responder', + prompt: + 'Build a workflow that receives an incident alert, starts the matching AWS Systems Manager Automation runbook, polls the execution until it finishes, and reports the step results back to the incident channel.', + modules: ['agent', 'workflows'], + category: 'operations', + tags: ['devops', 'incident-management'], + alsoIntegrations: ['slack'], + featured: true, + }, + { + icon: SSMIcon, + title: 'Systems Manager config promoter', + prompt: + 'Create a workflow that reads application configuration from one AWS Systems Manager Parameter Store path, requests approval in Slack, writes the approved values to the production path, and records the change in a table.', + modules: ['tables', 'agent', 'workflows'], + category: 'engineering', + tags: ['devops', 'automation'], + alsoIntegrations: ['slack'], + }, + { + icon: SSMIcon, + title: 'Systems Manager fleet command runner', + prompt: + 'Build a workflow that runs a diagnostic shell script on every AWS Systems Manager managed node carrying a chosen tag, collects the per-node output, and summarizes the failures for the on-call engineer.', + modules: ['agent', 'workflows'], + category: 'operations', + tags: ['devops', 'automation'], + }, + { + icon: SSMIcon, + title: 'Systems Manager compliance digest', + prompt: + 'Create a scheduled workflow that pulls AWS Systems Manager compliance summaries, compares them with last week’s counts stored in a table, and emails leadership a short trend report.', + modules: ['scheduled', 'tables', 'agent', 'workflows'], + category: 'operations', + tags: ['enterprise', 'reporting'], + }, + { + icon: SSMIcon, + title: 'Systems Manager parameter auditor', + prompt: + 'Build a scheduled workflow that lists AWS Systems Manager Parameter Store metadata, flags SecureString parameters that have not changed within the rotation window and plaintext parameters that look like credentials, and files the findings for security review.', + modules: ['scheduled', 'agent', 'workflows'], + category: 'operations', + tags: ['devops', 'enterprise'], + }, + { + icon: SSMIcon, + title: 'Systems Manager runbook catalog', + prompt: + 'Create a workflow that lists AWS Systems Manager Automation runbooks, reads the content of each one, and writes a plain-English catalog of what every runbook does and which parameters it needs.', + modules: ['tables', 'agent', 'workflows'], + category: 'engineering', + tags: ['devops', 'reporting'], + }, + ], + skills: [ + { + name: 'run-fleet-command', + description: + 'Run an SSM document such as AWS-RunShellScript across managed nodes and collect the per-node result. Use for fleet-wide diagnostics, log collection, or a scripted remediation.', + content: + '# Run Fleet Command\n\nExecute a command on managed nodes and report what happened on each one.\n\n## Steps\n1. Choose the SSM document to run (for example AWS-RunShellScript or AWS-RunPowerShellScript) and the parameters it needs.\n2. Pick the targets: explicit instance IDs, or tag targets such as tag:Environment = prod. Set concurrency and an error threshold so a bad script cannot roll through the whole fleet.\n3. Send the command and keep the returned command ID.\n4. List the invocations for that command ID to see per-node status, then read the invocation on each node of interest for its stdout and stderr.\n5. Summarize successes, failures, and any node that never acknowledged the command.\n\n## Output\nThe command ID, a per-node status table, and the captured output for every failed node.', + }, + { + name: 'triage-command-failure', + description: + 'Investigate why a Run Command execution failed on specific managed nodes. Use when a deployment or maintenance command reports errors.', + content: + '# Triage Command Failure\n\nFind out which nodes failed a command and why.\n\n## Steps\n1. List recent commands, filtering by status to find the failed execution.\n2. List that command’s invocations to identify the nodes that failed or timed out.\n3. Read the invocation on each failing node, including per-plugin detail, to get the exit code and captured stderr.\n4. Separate genuine script errors from delivery problems, where the node never acknowledged the command.\n5. If the command is still running and clearly wrong, cancel it.\n\n## Output\nThe failing nodes, their exit codes, the error text from each, and whether the cause was the script or node connectivity.', + }, + { + name: 'read-app-configuration', + description: + 'Read application configuration from a Parameter Store hierarchy path so a workflow can act on live settings. Use to load environment configuration without hardcoding it.', + content: + '# Read App Configuration\n\nLoad configuration for an environment from Parameter Store.\n\n## Steps\n1. Identify the hierarchy path that holds the environment’s settings, such as /prod/app.\n2. Read the parameters under that path recursively when the settings are nested.\n3. Only request decryption of SecureString values when the workflow genuinely needs the plaintext; leave it off for a settings inventory.\n4. Map each parameter name to the setting it represents.\n\n## Output\nThe configuration keys and their values. Never echo a decrypted SecureString value into a summary, a log, or a chat message.', + }, + { + name: 'promote-parameter-value', + description: + 'Write or update a Parameter Store value as part of a controlled configuration change. Use to promote a setting between environments or apply an approved change.', + content: + '# Promote Parameter Value\n\nApply a configuration change through Parameter Store.\n\n## Steps\n1. Read the current value and metadata of the target parameter so the change can be reversed.\n2. Confirm the parameter type: use SecureString for anything secret, and name the KMS key when the account default is not wanted.\n3. Write the new value with overwrite enabled for an existing parameter, or set the type explicitly when creating a new one.\n4. Read back the parameter metadata to confirm the new version number.\n\n## Output\nThe parameter name, the new version number, and the tier it was stored in. Never print the value itself.', + }, + { + name: 'audit-node-inventory', + description: + 'Report which managed nodes are registered with Systems Manager, their agent version, and whether they are reachable. Use for fleet hygiene and onboarding checks.', + content: + '# Audit Node Inventory\n\nReport the state of the managed node fleet.\n\n## Steps\n1. List managed nodes, filtering by ping status or platform type when the audit is scoped.\n2. Group nodes by ping status to find ones that have lost connection.\n3. Flag nodes that are not on the latest agent version, and nodes with no recent successful association run.\n4. Note nodes registered as managed instances rather than EC2 instances, since they onboard differently.\n\n## Output\nA fleet summary: total nodes, unreachable nodes, outdated agents, and the platform mix.', + }, + { + name: 'report-patch-compliance', + description: + 'Summarize patch compliance across managed nodes and drill into missing patches on a specific node. Use for monthly patching reviews and vulnerability follow-up.', + content: + '# Report Patch Compliance\n\nShow where the fleet stands on patching.\n\n## Steps\n1. Read patch states for the nodes in scope to get installed, missing, failed, and non-compliant counts per node.\n2. Rank the nodes by critical and security non-compliant counts.\n3. For the worst nodes, list the individual patches and filter to the ones in a Missing or Failed state to get titles, KB IDs, severities, and CVE IDs.\n4. Note nodes whose last patch operation never completed.\n\n## Output\nA ranked compliance table plus, for the top offenders, the specific missing patches and their severities.', + }, + { + name: 'run-automation-runbook', + description: + 'Start an SSM Automation runbook, follow it to completion, and report the step results. Use for scripted remediation such as restarting an instance or rotating an AMI.', + content: + '# Run Automation Runbook\n\nDrive an Automation runbook and report what it did.\n\n## Steps\n1. Find the runbook by listing documents filtered to the Automation type, and read its content to confirm the parameters it expects.\n2. Start the execution with those parameters. For a fleet-wide run, set the target parameter name and a rate-control target, plus concurrency and error limits.\n3. Poll the execution until its status leaves the in-progress states.\n4. Read the step executions to see which step failed and why, if it did not succeed.\n5. Stop the execution if it needs to be aborted; cancelling stops it immediately, completing lets the current step finish.\n\n## Output\nThe execution ID, the final status, the runbook outputs, and the failing step with its failure message when applicable.', + }, + { + name: 'review-compliance-findings', + description: + 'Pull Systems Manager compliance findings for a managed node and explain what is non-compliant. Use when a compliance dashboard flags a resource and someone needs the detail.', + content: + '# Review Compliance Findings\n\nExplain a node’s compliance status in detail.\n\n## Steps\n1. Read the compliance summaries to see which compliance types are non-compliant and at what severity.\n2. For the affected type, list the compliance items for the specific managed node, filtering to non-compliant status.\n3. Read each item’s title, severity, and details to explain what the finding actually is.\n4. Separate association findings from patch findings, since they are remediated differently.\n\n## Output\nA per-node list of non-compliant findings with severity and a short explanation of each, grouped by compliance type.', + }, + ], +} as const satisfies BlockMeta diff --git a/apps/sim/blocks/password-masking.test.ts b/apps/sim/blocks/password-masking.test.ts index aa001531f23..eda870e458d 100644 --- a/apps/sim/blocks/password-masking.test.ts +++ b/apps/sim/blocks/password-masking.test.ts @@ -20,6 +20,7 @@ const FIELDS_REQUIRING_MASKING: ReadonlyArray<{ block: string; subBlock: string { block: 'sftp', subBlock: 'privateKey' }, { block: 'ssh', subBlock: 'privateKey' }, { block: 'secrets_manager', subBlock: 'secretValue' }, + { block: 'ssm', subBlock: 'parameterValue' }, { block: 'kalshi', subBlock: 'privateKey' }, { block: 'sts', subBlock: 'webIdentityToken' }, { block: 'sts', subBlock: 'samlAssertion' }, diff --git a/apps/sim/blocks/registry-maps.ts b/apps/sim/blocks/registry-maps.ts index e1453e261f4..672ebb5e0e1 100644 --- a/apps/sim/blocks/registry-maps.ts +++ b/apps/sim/blocks/registry-maps.ts @@ -42,6 +42,7 @@ import { ClickHouseBlock, ClickHouseBlockMeta } from '@/blocks/blocks/clickhouse import { ClickUpBlock, ClickUpBlockMeta } from '@/blocks/blocks/clickup' import { CloudflareBlock, CloudflareBlockMeta } from '@/blocks/blocks/cloudflare' import { CloudFormationBlock, CloudFormationBlockMeta } from '@/blocks/blocks/cloudformation' +import { CloudTrailBlock, CloudTrailBlockMeta } from '@/blocks/blocks/cloudtrail' import { CloudWatchBlock, CloudWatchBlockMeta } from '@/blocks/blocks/cloudwatch' import { CodePipelineBlock, CodePipelineBlockMeta } from '@/blocks/blocks/codepipeline' import { ConditionBlock } from '@/blocks/blocks/condition' @@ -318,6 +319,7 @@ import { SpotifyBlock, SpotifyBlockMeta } from '@/blocks/blocks/spotify' import { SQSBlock, SQSBlockMeta } from '@/blocks/blocks/sqs' import { SquareBlock, SquareBlockMeta } from '@/blocks/blocks/square' import { SSHBlock, SSHBlockMeta } from '@/blocks/blocks/ssh' +import { SSMBlock, SSMBlockMeta } from '@/blocks/blocks/ssm' import { StagehandBlock, StagehandBlockMeta } from '@/blocks/blocks/stagehand' import { StartTriggerBlock } from '@/blocks/blocks/start_trigger' import { StarterBlock } from '@/blocks/blocks/starter' @@ -420,6 +422,7 @@ export const BLOCK_REGISTRY: Record = { clickup: ClickUpBlock, cloudflare: CloudflareBlock, cloudformation: CloudFormationBlock, + cloudtrail: CloudTrailBlock, cloudwatch: CloudWatchBlock, codepipeline: CodePipelineBlock, condition: ConditionBlock, @@ -667,6 +670,7 @@ export const BLOCK_REGISTRY: Record = { sqs: SQSBlock, square: SquareBlock, ssh: SSHBlock, + ssm: SSMBlock, stagehand: StagehandBlock, start_trigger: StartTriggerBlock, starter: StarterBlock, @@ -776,6 +780,7 @@ export const BLOCK_META_REGISTRY: Record = { clickup: ClickUpBlockMeta, cloudflare: CloudflareBlockMeta, cloudformation: CloudFormationBlockMeta, + cloudtrail: CloudTrailBlockMeta, cloudwatch: CloudWatchBlockMeta, codepipeline: CodePipelineBlockMeta, confluence: ConfluenceBlockMeta, @@ -980,6 +985,7 @@ export const BLOCK_META_REGISTRY: Record = { sqs: SQSBlockMeta, square: SquareBlockMeta, ssh: SSHBlockMeta, + ssm: SSMBlockMeta, stagehand: StagehandBlockMeta, stripe: StripeBlockMeta, sts: STSBlockMeta, diff --git a/apps/sim/components/icons.tsx b/apps/sim/components/icons.tsx index 00f47d3ac9c..867a81af5c2 100644 --- a/apps/sim/components/icons.tsx +++ b/apps/sim/components/icons.tsx @@ -6864,6 +6864,32 @@ export function SecretsManagerIcon(props: SVGProps) { ) } +export function SSMIcon(props: SVGProps) { + return ( + + + + + + ) +} + export function SQSIcon(props: SVGProps) { return ( ) { ) } +export function CloudTrailIcon(props: SVGProps) { + return ( + + + + + + ) +} + export function CloudWatchIcon(props: SVGProps) { return ( validateAwsRegion(v).isValid, { + message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', + }), + accessKeyId: z.string().min(1, 'AWS access key ID is required'), + secretAccessKey: z.string().min(1, 'AWS secret access key is required'), + queryId: z + .string() + .trim() + .regex(/^[a-f0-9-]{36}$/, 'Query ID must be a 36-character query identifier'), + eventDataStoreOwnerAccountId: z + .string() + .trim() + .min(12) + .max(16) + .regex(/^\d+$/, 'Account ID must be numeric') + .optional(), +}) + +const CancelQueryResponseSchema = z.object({ + success: z.literal(true), + output: z.object({ + queryId: z.string(), + queryStatus: z.string().nullable(), + eventDataStoreOwnerAccountId: z.string().nullable(), + }), +}) + +export const awsCloudtrailCancelQueryContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/cloudtrail/cancel-query', + body: CancelQuerySchema, + response: { mode: 'json', schema: CancelQueryResponseSchema }, +}) +export type AwsCloudtrailCancelQueryRequest = ContractBodyInput< + typeof awsCloudtrailCancelQueryContract +> +export type AwsCloudtrailCancelQueryBody = ContractBody +export type AwsCloudtrailCancelQueryResponse = ContractJsonResponse< + typeof awsCloudtrailCancelQueryContract +> diff --git a/apps/sim/lib/api/contracts/tools/aws/cloudtrail-describe-query.ts b/apps/sim/lib/api/contracts/tools/aws/cloudtrail-describe-query.ts new file mode 100644 index 00000000000..1959927de84 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/cloudtrail-describe-query.ts @@ -0,0 +1,101 @@ +import { z } from 'zod' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' +import { validateAwsRegion } from '@/lib/core/security/input-validation' + +/** + * `DescribeQuery` requires either `QueryId` or `QueryAlias`. AWS documents `RefreshId` as + * something you "provide along with `QueryAlias`" to read a dashboard refresh, so it is + * rejected when the query is addressed by ID. + * @see https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_DescribeQuery.html + */ +const DescribeQuerySchema = z + .object({ + region: z + .string() + .min(1, 'AWS region is required') + .refine((v) => validateAwsRegion(v).isValid, { + message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', + }), + accessKeyId: z.string().min(1, 'AWS access key ID is required'), + secretAccessKey: z.string().min(1, 'AWS secret access key is required'), + queryId: z + .string() + .trim() + .regex(/^[a-f0-9-]{36}$/, 'Query ID must be a 36-character query identifier') + .optional(), + queryAlias: z + .string() + .trim() + .min(1) + .max(256) + .regex(/^[a-zA-Z][a-zA-Z0-9._-]*$/, 'Invalid query alias format') + .optional(), + refreshId: z + .string() + .trim() + .min(10) + .max(20) + .regex(/^\d+$/, 'Refresh ID must be numeric') + .optional(), + eventDataStoreOwnerAccountId: z + .string() + .trim() + .min(12) + .max(16) + .regex(/^\d+$/, 'Account ID must be numeric') + .optional(), + }) + .superRefine((v, ctx) => { + if (Boolean(v.queryId) === Boolean(v.queryAlias)) { + ctx.addIssue({ + code: 'custom', + message: 'Specify exactly one of queryId or queryAlias', + path: ['queryId'], + }) + } + if (v.refreshId && !v.queryAlias) { + ctx.addIssue({ + code: 'custom', + message: 'refreshId identifies a dashboard refresh and is only valid with queryAlias', + path: ['refreshId'], + }) + } + }) + +const DescribeQueryResponseSchema = z.object({ + success: z.literal(true), + output: z.object({ + queryId: z.string().nullable(), + queryString: z.string().nullable(), + queryStatus: z.string().nullable(), + errorMessage: z.string().nullable(), + deliveryS3Uri: z.string().nullable(), + deliveryStatus: z.string().nullable(), + prompt: z.string().nullable(), + eventDataStoreOwnerAccountId: z.string().nullable(), + eventsMatched: z.number().nullable(), + eventsScanned: z.number().nullable(), + bytesScanned: z.number().nullable(), + executionTimeInMillis: z.number().nullable(), + creationTime: z.string().nullable(), + }), +}) + +export const awsCloudtrailDescribeQueryContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/cloudtrail/describe-query', + body: DescribeQuerySchema, + response: { mode: 'json', schema: DescribeQueryResponseSchema }, +}) +export type AwsCloudtrailDescribeQueryRequest = ContractBodyInput< + typeof awsCloudtrailDescribeQueryContract +> +export type AwsCloudtrailDescribeQueryBody = ContractBody +export type AwsCloudtrailDescribeQueryResponse = ContractJsonResponse< + typeof awsCloudtrailDescribeQueryContract +> diff --git a/apps/sim/lib/api/contracts/tools/aws/cloudtrail-describe-trails.ts b/apps/sim/lib/api/contracts/tools/aws/cloudtrail-describe-trails.ts new file mode 100644 index 00000000000..6347056c0f7 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/cloudtrail-describe-trails.ts @@ -0,0 +1,75 @@ +import { z } from 'zod' +import { cloudtrailTrailNameOrArnSchema } from '@/lib/api/contracts/tools/aws/cloudtrail-shared' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' +import { validateAwsRegion } from '@/lib/core/security/input-validation' + +const trailSchema = z.object({ + name: z.string(), + s3BucketName: z.string().nullable(), + s3KeyPrefix: z.string().nullable(), + snsTopicName: z.string().nullable(), + snsTopicArn: z.string().nullable(), + includeGlobalServiceEvents: z.boolean().nullable(), + isMultiRegionTrail: z.boolean().nullable(), + homeRegion: z.string().nullable(), + trailArn: z.string().nullable(), + logFileValidationEnabled: z.boolean().nullable(), + cloudWatchLogsLogGroupArn: z.string().nullable(), + cloudWatchLogsRoleArn: z.string().nullable(), + kmsKeyId: z.string().nullable(), + hasCustomEventSelectors: z.boolean().nullable(), + hasInsightSelectors: z.boolean().nullable(), + isOrganizationTrail: z.boolean().nullable(), +}) + +const DescribeTrailsSchema = z.object({ + region: z + .string() + .min(1, 'AWS region is required') + .refine((v) => validateAwsRegion(v).isValid, { + message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', + }), + accessKeyId: z.string().min(1, 'AWS access key ID is required'), + secretAccessKey: z.string().min(1, 'AWS secret access key is required'), + /** + * `DescribeTrails` documents no array-member limit on `trailNameList`, so this ceiling is a + * request-payload guard rather than an AWS constraint. It is deliberately set above anything + * reachable: the trails-per-Region quota is 5, so naming every trail and shadow trail in an + * account across all commercial Regions still stays well under 200. + * @see https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_DescribeTrails.html + * @see https://docs.aws.amazon.com/awscloudtrail/latest/userguide/WhatIsCloudTrail-Limits.html + */ + trailNameList: z + .array(cloudtrailTrailNameOrArnSchema) + .max(200, 'At most 200 trail names or ARNs can be described in one request') + .optional(), + includeShadowTrails: z.boolean().optional(), +}) + +const DescribeTrailsResponseSchema = z.object({ + success: z.literal(true), + output: z.object({ + trails: z.array(trailSchema), + }), +}) + +export const awsCloudtrailDescribeTrailsContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/cloudtrail/describe-trails', + body: DescribeTrailsSchema, + response: { mode: 'json', schema: DescribeTrailsResponseSchema }, +}) +export type AwsCloudtrailDescribeTrailsRequest = ContractBodyInput< + typeof awsCloudtrailDescribeTrailsContract +> +export type AwsCloudtrailDescribeTrailsBody = ContractBody< + typeof awsCloudtrailDescribeTrailsContract +> +export type AwsCloudtrailDescribeTrailsResponse = ContractJsonResponse< + typeof awsCloudtrailDescribeTrailsContract +> diff --git a/apps/sim/lib/api/contracts/tools/aws/cloudtrail-get-event-data-store.ts b/apps/sim/lib/api/contracts/tools/aws/cloudtrail-get-event-data-store.ts new file mode 100644 index 00000000000..a7d4bbf2501 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/cloudtrail-get-event-data-store.ts @@ -0,0 +1,77 @@ +import { z } from 'zod' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' +import { validateAwsRegion } from '@/lib/core/security/input-validation' + +const advancedEventSelectorSchema = z.object({ + name: z.string().nullable(), + fieldSelectors: z.array( + z.object({ + field: z.string(), + equals: z.array(z.string()), + startsWith: z.array(z.string()), + endsWith: z.array(z.string()), + notEquals: z.array(z.string()), + notStartsWith: z.array(z.string()), + notEndsWith: z.array(z.string()), + }) + ), +}) + +const GetEventDataStoreSchema = z.object({ + region: z + .string() + .min(1, 'AWS region is required') + .refine((v) => validateAwsRegion(v).isValid, { + message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', + }), + accessKeyId: z.string().min(1, 'AWS access key ID is required'), + secretAccessKey: z.string().min(1, 'AWS secret access key is required'), + eventDataStore: z + .string() + .trim() + .min(3, 'Event data store ARN or ID is required') + .max(256) + .regex(/^[a-zA-Z0-9._/\-:]+$/, 'Invalid event data store ARN or ID'), +}) + +const GetEventDataStoreResponseSchema = z.object({ + success: z.literal(true), + output: z.object({ + eventDataStoreArn: z.string().nullable(), + name: z.string().nullable(), + status: z.string().nullable(), + advancedEventSelectors: z.array(advancedEventSelectorSchema), + multiRegionEnabled: z.boolean().nullable(), + organizationEnabled: z.boolean().nullable(), + retentionPeriod: z.number().nullable(), + terminationProtectionEnabled: z.boolean().nullable(), + createdTimestamp: z.string().nullable(), + updatedTimestamp: z.string().nullable(), + kmsKeyId: z.string().nullable(), + billingMode: z.string().nullable(), + federationStatus: z.string().nullable(), + federationRoleArn: z.string().nullable(), + partitionKeys: z.array(z.object({ name: z.string(), type: z.string() })), + }), +}) + +export const awsCloudtrailGetEventDataStoreContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/cloudtrail/get-event-data-store', + body: GetEventDataStoreSchema, + response: { mode: 'json', schema: GetEventDataStoreResponseSchema }, +}) +export type AwsCloudtrailGetEventDataStoreRequest = ContractBodyInput< + typeof awsCloudtrailGetEventDataStoreContract +> +export type AwsCloudtrailGetEventDataStoreBody = ContractBody< + typeof awsCloudtrailGetEventDataStoreContract +> +export type AwsCloudtrailGetEventDataStoreResponse = ContractJsonResponse< + typeof awsCloudtrailGetEventDataStoreContract +> diff --git a/apps/sim/lib/api/contracts/tools/aws/cloudtrail-get-event-selectors.ts b/apps/sim/lib/api/contracts/tools/aws/cloudtrail-get-event-selectors.ts new file mode 100644 index 00000000000..0e1218bc50e --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/cloudtrail-get-event-selectors.ts @@ -0,0 +1,73 @@ +import { z } from 'zod' +import { cloudtrailTrailNameOrArnSchema } from '@/lib/api/contracts/tools/aws/cloudtrail-shared' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' +import { validateAwsRegion } from '@/lib/core/security/input-validation' + +const advancedEventSelectorSchema = z.object({ + name: z.string().nullable(), + fieldSelectors: z.array( + z.object({ + field: z.string(), + equals: z.array(z.string()), + startsWith: z.array(z.string()), + endsWith: z.array(z.string()), + notEquals: z.array(z.string()), + notStartsWith: z.array(z.string()), + notEndsWith: z.array(z.string()), + }) + ), +}) + +const GetEventSelectorsSchema = z.object({ + region: z + .string() + .min(1, 'AWS region is required') + .refine((v) => validateAwsRegion(v).isValid, { + message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', + }), + accessKeyId: z.string().min(1, 'AWS access key ID is required'), + secretAccessKey: z.string().min(1, 'AWS secret access key is required'), + trailName: cloudtrailTrailNameOrArnSchema, +}) + +const GetEventSelectorsResponseSchema = z.object({ + success: z.literal(true), + output: z.object({ + trailArn: z.string().nullable(), + eventSelectors: z.array( + z.object({ + readWriteType: z.string().nullable(), + includeManagementEvents: z.boolean().nullable(), + dataResources: z.array( + z.object({ + type: z.string().nullable(), + values: z.array(z.string()), + }) + ), + excludeManagementEventSources: z.array(z.string()), + }) + ), + advancedEventSelectors: z.array(advancedEventSelectorSchema), + }), +}) + +export const awsCloudtrailGetEventSelectorsContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/cloudtrail/get-event-selectors', + body: GetEventSelectorsSchema, + response: { mode: 'json', schema: GetEventSelectorsResponseSchema }, +}) +export type AwsCloudtrailGetEventSelectorsRequest = ContractBodyInput< + typeof awsCloudtrailGetEventSelectorsContract +> +export type AwsCloudtrailGetEventSelectorsBody = ContractBody< + typeof awsCloudtrailGetEventSelectorsContract +> +export type AwsCloudtrailGetEventSelectorsResponse = ContractJsonResponse< + typeof awsCloudtrailGetEventSelectorsContract +> diff --git a/apps/sim/lib/api/contracts/tools/aws/cloudtrail-get-insight-selectors.ts b/apps/sim/lib/api/contracts/tools/aws/cloudtrail-get-insight-selectors.ts new file mode 100644 index 00000000000..a0561b72409 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/cloudtrail-get-insight-selectors.ts @@ -0,0 +1,69 @@ +import { z } from 'zod' +import { cloudtrailTrailNameOrArnSchema } from '@/lib/api/contracts/tools/aws/cloudtrail-shared' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' +import { validateAwsRegion } from '@/lib/core/security/input-validation' + +/** + * The ARN, or the ID suffix of the ARN, of a CloudTrail Lake event data store. + * @see https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_GetEventDataStore.html + */ +const eventDataStoreSchema = z + .string() + .trim() + .min(3, 'Event data store ARN or ID is required') + .max(256, 'Event data store ARN or ID is too long') + .regex(/^[a-zA-Z0-9._/\-:]+$/, 'Invalid event data store ARN or ID') + +const GetInsightSelectorsSchema = z + .object({ + region: z + .string() + .min(1, 'AWS region is required') + .refine((v) => validateAwsRegion(v).isValid, { + message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', + }), + accessKeyId: z.string().min(1, 'AWS access key ID is required'), + secretAccessKey: z.string().min(1, 'AWS secret access key is required'), + trailName: cloudtrailTrailNameOrArnSchema.optional(), + eventDataStore: eventDataStoreSchema.optional(), + }) + .refine((v) => Boolean(v.trailName) !== Boolean(v.eventDataStore), { + message: 'Specify exactly one of trailName or eventDataStore', + path: ['trailName'], + }) + +const GetInsightSelectorsResponseSchema = z.object({ + success: z.literal(true), + output: z.object({ + trailArn: z.string().nullable(), + eventDataStoreArn: z.string().nullable(), + insightsDestination: z.string().nullable(), + insightSelectors: z.array( + z.object({ + insightType: z.string().nullable(), + eventCategories: z.array(z.string()), + }) + ), + }), +}) + +export const awsCloudtrailGetInsightSelectorsContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/cloudtrail/get-insight-selectors', + body: GetInsightSelectorsSchema, + response: { mode: 'json', schema: GetInsightSelectorsResponseSchema }, +}) +export type AwsCloudtrailGetInsightSelectorsRequest = ContractBodyInput< + typeof awsCloudtrailGetInsightSelectorsContract +> +export type AwsCloudtrailGetInsightSelectorsBody = ContractBody< + typeof awsCloudtrailGetInsightSelectorsContract +> +export type AwsCloudtrailGetInsightSelectorsResponse = ContractJsonResponse< + typeof awsCloudtrailGetInsightSelectorsContract +> diff --git a/apps/sim/lib/api/contracts/tools/aws/cloudtrail-get-query-results.ts b/apps/sim/lib/api/contracts/tools/aws/cloudtrail-get-query-results.ts new file mode 100644 index 00000000000..f921b3e7e39 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/cloudtrail-get-query-results.ts @@ -0,0 +1,64 @@ +import { z } from 'zod' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' +import { validateAwsRegion } from '@/lib/core/security/input-validation' + +const GetQueryResultsSchema = z.object({ + region: z + .string() + .min(1, 'AWS region is required') + .refine((v) => validateAwsRegion(v).isValid, { + message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', + }), + accessKeyId: z.string().min(1, 'AWS access key ID is required'), + secretAccessKey: z.string().min(1, 'AWS secret access key is required'), + queryId: z + .string() + .trim() + .regex(/^[a-f0-9-]{36}$/, 'Query ID must be a 36-character query identifier'), + maxQueryResults: z.preprocess( + (v) => (v === '' || v === undefined || v === null ? undefined : v), + z.coerce.number().int().min(1).max(1000).optional() + ), + nextToken: z.string().min(4).max(1000).optional(), + eventDataStoreOwnerAccountId: z + .string() + .trim() + .min(12) + .max(16) + .regex(/^\d+$/, 'Account ID must be numeric') + .optional(), +}) + +const GetQueryResultsResponseSchema = z.object({ + success: z.literal(true), + output: z.object({ + queryStatus: z.string().nullable(), + rows: z.array(z.record(z.string(), z.string())), + resultsCount: z.number().nullable(), + totalResultsCount: z.number().nullable(), + bytesScanned: z.number().nullable(), + errorMessage: z.string().nullable(), + nextToken: z.string().nullable(), + }), +}) + +export const awsCloudtrailGetQueryResultsContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/cloudtrail/get-query-results', + body: GetQueryResultsSchema, + response: { mode: 'json', schema: GetQueryResultsResponseSchema }, +}) +export type AwsCloudtrailGetQueryResultsRequest = ContractBodyInput< + typeof awsCloudtrailGetQueryResultsContract +> +export type AwsCloudtrailGetQueryResultsBody = ContractBody< + typeof awsCloudtrailGetQueryResultsContract +> +export type AwsCloudtrailGetQueryResultsResponse = ContractJsonResponse< + typeof awsCloudtrailGetQueryResultsContract +> diff --git a/apps/sim/lib/api/contracts/tools/aws/cloudtrail-get-trail-status.ts b/apps/sim/lib/api/contracts/tools/aws/cloudtrail-get-trail-status.ts new file mode 100644 index 00000000000..9ae5ad30f18 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/cloudtrail-get-trail-status.ts @@ -0,0 +1,54 @@ +import { z } from 'zod' +import { cloudtrailTrailNameOrArnSchema } from '@/lib/api/contracts/tools/aws/cloudtrail-shared' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' +import { validateAwsRegion } from '@/lib/core/security/input-validation' + +const GetTrailStatusSchema = z.object({ + region: z + .string() + .min(1, 'AWS region is required') + .refine((v) => validateAwsRegion(v).isValid, { + message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', + }), + accessKeyId: z.string().min(1, 'AWS access key ID is required'), + secretAccessKey: z.string().min(1, 'AWS secret access key is required'), + name: cloudtrailTrailNameOrArnSchema, +}) + +const GetTrailStatusResponseSchema = z.object({ + success: z.literal(true), + output: z.object({ + isLogging: z.boolean().nullable(), + latestDeliveryError: z.string().nullable(), + latestDeliveryTime: z.string().nullable(), + latestNotificationError: z.string().nullable(), + latestNotificationTime: z.string().nullable(), + latestCloudWatchLogsDeliveryError: z.string().nullable(), + latestCloudWatchLogsDeliveryTime: z.string().nullable(), + latestDigestDeliveryError: z.string().nullable(), + latestDigestDeliveryTime: z.string().nullable(), + startLoggingTime: z.string().nullable(), + stopLoggingTime: z.string().nullable(), + }), +}) + +export const awsCloudtrailGetTrailStatusContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/cloudtrail/get-trail-status', + body: GetTrailStatusSchema, + response: { mode: 'json', schema: GetTrailStatusResponseSchema }, +}) +export type AwsCloudtrailGetTrailStatusRequest = ContractBodyInput< + typeof awsCloudtrailGetTrailStatusContract +> +export type AwsCloudtrailGetTrailStatusBody = ContractBody< + typeof awsCloudtrailGetTrailStatusContract +> +export type AwsCloudtrailGetTrailStatusResponse = ContractJsonResponse< + typeof awsCloudtrailGetTrailStatusContract +> diff --git a/apps/sim/lib/api/contracts/tools/aws/cloudtrail-get-trail.ts b/apps/sim/lib/api/contracts/tools/aws/cloudtrail-get-trail.ts new file mode 100644 index 00000000000..ef5f3b9074a --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/cloudtrail-get-trail.ts @@ -0,0 +1,55 @@ +import { z } from 'zod' +import { cloudtrailTrailNameOrArnSchema } from '@/lib/api/contracts/tools/aws/cloudtrail-shared' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' +import { validateAwsRegion } from '@/lib/core/security/input-validation' + +const GetTrailSchema = z.object({ + region: z + .string() + .min(1, 'AWS region is required') + .refine((v) => validateAwsRegion(v).isValid, { + message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', + }), + accessKeyId: z.string().min(1, 'AWS access key ID is required'), + secretAccessKey: z.string().min(1, 'AWS secret access key is required'), + name: cloudtrailTrailNameOrArnSchema, +}) + +const GetTrailResponseSchema = z.object({ + success: z.literal(true), + output: z.object({ + name: z.string(), + s3BucketName: z.string().nullable(), + s3KeyPrefix: z.string().nullable(), + snsTopicName: z.string().nullable(), + snsTopicArn: z.string().nullable(), + includeGlobalServiceEvents: z.boolean().nullable(), + isMultiRegionTrail: z.boolean().nullable(), + homeRegion: z.string().nullable(), + trailArn: z.string().nullable(), + logFileValidationEnabled: z.boolean().nullable(), + cloudWatchLogsLogGroupArn: z.string().nullable(), + cloudWatchLogsRoleArn: z.string().nullable(), + kmsKeyId: z.string().nullable(), + hasCustomEventSelectors: z.boolean().nullable(), + hasInsightSelectors: z.boolean().nullable(), + isOrganizationTrail: z.boolean().nullable(), + }), +}) + +export const awsCloudtrailGetTrailContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/cloudtrail/get-trail', + body: GetTrailSchema, + response: { mode: 'json', schema: GetTrailResponseSchema }, +}) +export type AwsCloudtrailGetTrailRequest = ContractBodyInput +export type AwsCloudtrailGetTrailBody = ContractBody +export type AwsCloudtrailGetTrailResponse = ContractJsonResponse< + typeof awsCloudtrailGetTrailContract +> diff --git a/apps/sim/lib/api/contracts/tools/aws/cloudtrail-list-event-data-stores.ts b/apps/sim/lib/api/contracts/tools/aws/cloudtrail-list-event-data-stores.ts new file mode 100644 index 00000000000..c30a351e45b --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/cloudtrail-list-event-data-stores.ts @@ -0,0 +1,76 @@ +import { z } from 'zod' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' +import { validateAwsRegion } from '@/lib/core/security/input-validation' + +const advancedEventSelectorSchema = z.object({ + name: z.string().nullable(), + fieldSelectors: z.array( + z.object({ + field: z.string(), + equals: z.array(z.string()), + startsWith: z.array(z.string()), + endsWith: z.array(z.string()), + notEquals: z.array(z.string()), + notStartsWith: z.array(z.string()), + notEndsWith: z.array(z.string()), + }) + ), +}) + +const ListEventDataStoresSchema = z.object({ + region: z + .string() + .min(1, 'AWS region is required') + .refine((v) => validateAwsRegion(v).isValid, { + message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', + }), + accessKeyId: z.string().min(1, 'AWS access key ID is required'), + secretAccessKey: z.string().min(1, 'AWS secret access key is required'), + maxResults: z.preprocess( + (v) => (v === '' || v === undefined || v === null ? undefined : v), + z.coerce.number().int().min(1).max(1000).optional() + ), + nextToken: z.string().min(4).max(1000).optional(), +}) + +const ListEventDataStoresResponseSchema = z.object({ + success: z.literal(true), + output: z.object({ + eventDataStores: z.array( + z.object({ + eventDataStoreArn: z.string().nullable(), + name: z.string().nullable(), + status: z.string().nullable(), + advancedEventSelectors: z.array(advancedEventSelectorSchema), + multiRegionEnabled: z.boolean().nullable(), + organizationEnabled: z.boolean().nullable(), + retentionPeriod: z.number().nullable(), + terminationProtectionEnabled: z.boolean().nullable(), + createdTimestamp: z.string().nullable(), + updatedTimestamp: z.string().nullable(), + }) + ), + nextToken: z.string().nullable(), + }), +}) + +export const awsCloudtrailListEventDataStoresContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/cloudtrail/list-event-data-stores', + body: ListEventDataStoresSchema, + response: { mode: 'json', schema: ListEventDataStoresResponseSchema }, +}) +export type AwsCloudtrailListEventDataStoresRequest = ContractBodyInput< + typeof awsCloudtrailListEventDataStoresContract +> +export type AwsCloudtrailListEventDataStoresBody = ContractBody< + typeof awsCloudtrailListEventDataStoresContract +> +export type AwsCloudtrailListEventDataStoresResponse = ContractJsonResponse< + typeof awsCloudtrailListEventDataStoresContract +> diff --git a/apps/sim/lib/api/contracts/tools/aws/cloudtrail-list-tags.ts b/apps/sim/lib/api/contracts/tools/aws/cloudtrail-list-tags.ts new file mode 100644 index 00000000000..c79f07e9f31 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/cloudtrail-list-tags.ts @@ -0,0 +1,57 @@ +import { z } from 'zod' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' +import { validateAwsRegion } from '@/lib/core/security/input-validation' + +const ListTagsSchema = z.object({ + region: z + .string() + .min(1, 'AWS region is required') + .refine((v) => validateAwsRegion(v).isValid, { + message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', + }), + accessKeyId: z.string().min(1, 'AWS access key ID is required'), + secretAccessKey: z.string().min(1, 'AWS secret access key is required'), + resourceIdList: z + .array( + z + .string() + .trim() + .regex( + /^arn:aws[a-zA-Z0-9-]*:cloudtrail:[a-z0-9-]+:\d{12}:(?:trail|eventdatastore|dashboard|channel)\/[\w.\-/]+$/, + 'Must be a CloudTrail trail, event data store, dashboard, or channel ARN' + ) + ) + .min(1, 'At least one resource ARN is required') + .max(20, 'A maximum of 20 resource ARNs can be requested at once'), + nextToken: z.string().optional(), +}) + +const ListTagsResponseSchema = z.object({ + success: z.literal(true), + output: z.object({ + resourceTags: z.array( + z.object({ + resourceId: z.string().nullable(), + tags: z.array(z.object({ key: z.string(), value: z.string().nullable() })), + }) + ), + nextToken: z.string().nullable(), + }), +}) + +export const awsCloudtrailListTagsContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/cloudtrail/list-tags', + body: ListTagsSchema, + response: { mode: 'json', schema: ListTagsResponseSchema }, +}) +export type AwsCloudtrailListTagsRequest = ContractBodyInput +export type AwsCloudtrailListTagsBody = ContractBody +export type AwsCloudtrailListTagsResponse = ContractJsonResponse< + typeof awsCloudtrailListTagsContract +> diff --git a/apps/sim/lib/api/contracts/tools/aws/cloudtrail-list-trails.ts b/apps/sim/lib/api/contracts/tools/aws/cloudtrail-list-trails.ts new file mode 100644 index 00000000000..1f6b679c868 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/cloudtrail-list-trails.ts @@ -0,0 +1,48 @@ +import { z } from 'zod' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' +import { validateAwsRegion } from '@/lib/core/security/input-validation' + +const ListTrailsSchema = z.object({ + region: z + .string() + .min(1, 'AWS region is required') + .refine((v) => validateAwsRegion(v).isValid, { + message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', + }), + accessKeyId: z.string().min(1, 'AWS access key ID is required'), + secretAccessKey: z.string().min(1, 'AWS secret access key is required'), + nextToken: z.string().optional(), +}) + +const ListTrailsResponseSchema = z.object({ + success: z.literal(true), + output: z.object({ + trails: z.array( + z.object({ + trailArn: z.string().nullable(), + name: z.string().nullable(), + homeRegion: z.string().nullable(), + }) + ), + nextToken: z.string().nullable(), + }), +}) + +export const awsCloudtrailListTrailsContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/cloudtrail/list-trails', + body: ListTrailsSchema, + response: { mode: 'json', schema: ListTrailsResponseSchema }, +}) +export type AwsCloudtrailListTrailsRequest = ContractBodyInput< + typeof awsCloudtrailListTrailsContract +> +export type AwsCloudtrailListTrailsBody = ContractBody +export type AwsCloudtrailListTrailsResponse = ContractJsonResponse< + typeof awsCloudtrailListTrailsContract +> diff --git a/apps/sim/lib/api/contracts/tools/aws/cloudtrail-lookup-events.ts b/apps/sim/lib/api/contracts/tools/aws/cloudtrail-lookup-events.ts new file mode 100644 index 00000000000..dc940512aef --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/cloudtrail-lookup-events.ts @@ -0,0 +1,90 @@ +import { z } from 'zod' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' +import { validateAwsRegion } from '@/lib/core/security/input-validation' + +const LookupEventsSchema = z + .object({ + region: z + .string() + .min(1, 'AWS region is required') + .refine((v) => validateAwsRegion(v).isValid, { + message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', + }), + accessKeyId: z.string().min(1, 'AWS access key ID is required'), + secretAccessKey: z.string().min(1, 'AWS secret access key is required'), + attributeKey: z + .enum([ + 'AccessKeyId', + 'EventId', + 'EventName', + 'EventSource', + 'ReadOnly', + 'ResourceName', + 'ResourceType', + 'Username', + ]) + .optional(), + attributeValue: z + .string() + .trim() + .min(1, 'Lookup attribute value cannot be empty') + .max(2000, 'Lookup attribute value cannot exceed 2000 characters') + .optional(), + startTime: z.string().datetime({ offset: true }).optional(), + endTime: z.string().datetime({ offset: true }).optional(), + eventCategory: z.literal('insight').optional(), + maxResults: z.preprocess( + (v) => (v === '' || v === undefined || v === null ? undefined : v), + z.coerce.number().int().min(1).max(50).optional() + ), + nextToken: z.string().optional(), + }) + .refine((v) => (v.attributeKey === undefined) === (v.attributeValue === undefined), { + message: 'attributeKey and attributeValue must be provided together', + path: ['attributeValue'], + }) + +const LookupEventsResponseSchema = z.object({ + success: z.literal(true), + output: z.object({ + events: z.array( + z.object({ + eventId: z.string().nullable(), + eventName: z.string().nullable(), + readOnly: z.string().nullable(), + accessKeyId: z.string().nullable(), + eventTime: z.string().nullable(), + eventSource: z.string().nullable(), + username: z.string().nullable(), + resources: z.array( + z.object({ + resourceType: z.string().nullable(), + resourceName: z.string().nullable(), + }) + ), + cloudTrailEvent: z.record(z.string(), z.unknown()).nullable(), + cloudTrailEventRaw: z.string().nullable(), + }) + ), + nextToken: z.string().nullable(), + }), +}) + +export const awsCloudtrailLookupEventsContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/cloudtrail/lookup-events', + body: LookupEventsSchema, + response: { mode: 'json', schema: LookupEventsResponseSchema }, +}) +export type AwsCloudtrailLookupEventsRequest = ContractBodyInput< + typeof awsCloudtrailLookupEventsContract +> +export type AwsCloudtrailLookupEventsBody = ContractBody +export type AwsCloudtrailLookupEventsResponse = ContractJsonResponse< + typeof awsCloudtrailLookupEventsContract +> diff --git a/apps/sim/lib/api/contracts/tools/aws/cloudtrail-shared.ts b/apps/sim/lib/api/contracts/tools/aws/cloudtrail-shared.ts new file mode 100644 index 00000000000..05a91c3b447 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/cloudtrail-shared.ts @@ -0,0 +1,41 @@ +import { z } from 'zod' + +/** + * Boundary primitives shared by the AWS CloudTrail tool contracts. + * + * Every bound and pattern here is transcribed from the CloudTrail API Reference. + */ + +/** Longest trail name CloudTrail accepts, per `InvalidTrailNameException`. */ +const TRAIL_NAME_MAX_LENGTH = 128 + +/** Longest trail ARN CloudTrail accepts wherever a name or ARN is allowed. */ +const TRAIL_ARN_MAX_LENGTH = 256 + +const TRAIL_NAME_OR_ARN_PATTERN = + /^(?:arn:aws[a-zA-Z0-9-]*:cloudtrail:[a-z0-9-]+:\d{12}:trail\/[\w.\-/]+|[a-zA-Z0-9](?:[._-]?[a-zA-Z0-9]+)+)$/ + +/** + * A trail name or a full trail ARN. The two branches carry different ceilings: a bare name + * is 3-128 characters of ASCII alphanumerics plus non-adjacent `.`, `_`, `-`, starting and + * ending alphanumeric, while an ARN may run to 256. Applying only the ARN ceiling would let + * a 129-256 character bare name through to AWS, which rejects it with + * `InvalidTrailNameException`. Shadow trails and organization trails in another Region can + * only be addressed by ARN. + * @see https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_GetTrail.html + * @see https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_DescribeTrails.html + */ +export const cloudtrailTrailNameOrArnSchema = z + .string() + .trim() + .min(3, 'Trail name must be at least 3 characters') + .max(TRAIL_ARN_MAX_LENGTH, 'Trail name or ARN is too long') + .regex(TRAIL_NAME_OR_ARN_PATTERN, 'Must be a valid trail name or trail ARN') + .superRefine((value, ctx) => { + if (!value.startsWith('arn:') && value.length > TRAIL_NAME_MAX_LENGTH) { + ctx.addIssue({ + code: 'custom', + message: `Trail name must be at most ${TRAIL_NAME_MAX_LENGTH} characters; use the trail ARN to address a trail in another Region`, + }) + } + }) diff --git a/apps/sim/lib/api/contracts/tools/aws/cloudtrail-start-query.ts b/apps/sim/lib/api/contracts/tools/aws/cloudtrail-start-query.ts new file mode 100644 index 00000000000..39e5cf2c21c --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/cloudtrail-start-query.ts @@ -0,0 +1,68 @@ +import { z } from 'zod' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' +import { validateAwsRegion } from '@/lib/core/security/input-validation' + +const StartQuerySchema = z + .object({ + region: z + .string() + .min(1, 'AWS region is required') + .refine((v) => validateAwsRegion(v).isValid, { + message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', + }), + accessKeyId: z.string().min(1, 'AWS access key ID is required'), + secretAccessKey: z.string().min(1, 'AWS secret access key is required'), + queryStatement: z.string().trim().min(1).max(10000).optional(), + queryAlias: z + .string() + .trim() + .min(1) + .max(256) + .regex(/^[a-zA-Z][a-zA-Z0-9._-]*$/, 'Invalid query alias format') + .optional(), + queryParameters: z.array(z.string().min(1).max(1024)).min(1).max(10).optional(), + deliveryS3Uri: z + .string() + .trim() + .max(1024) + .regex(/^s3:\/\/[a-z0-9][.\-a-z0-9]{1,61}[a-z0-9](\/.*)?$/, 'Invalid S3 URI') + .optional(), + eventDataStoreOwnerAccountId: z + .string() + .trim() + .min(12) + .max(16) + .regex(/^\d+$/, 'Account ID must be numeric') + .optional(), + }) + .refine((v) => Boolean(v.queryStatement) !== Boolean(v.queryAlias), { + message: 'Specify exactly one of queryStatement or queryAlias', + path: ['queryStatement'], + }) + +const StartQueryResponseSchema = z.object({ + success: z.literal(true), + output: z.object({ + queryId: z.string(), + eventDataStoreOwnerAccountId: z.string().nullable(), + }), +}) + +export const awsCloudtrailStartQueryContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/cloudtrail/start-query', + body: StartQuerySchema, + response: { mode: 'json', schema: StartQueryResponseSchema }, +}) +export type AwsCloudtrailStartQueryRequest = ContractBodyInput< + typeof awsCloudtrailStartQueryContract +> +export type AwsCloudtrailStartQueryBody = ContractBody +export type AwsCloudtrailStartQueryResponse = ContractJsonResponse< + typeof awsCloudtrailStartQueryContract +> diff --git a/apps/sim/lib/api/contracts/tools/aws/iam-add-user-to-group.ts b/apps/sim/lib/api/contracts/tools/aws/iam-add-user-to-group.ts index 68ba95d2e74..68eae0c0714 100644 --- a/apps/sim/lib/api/contracts/tools/aws/iam-add-user-to-group.ts +++ b/apps/sim/lib/api/contracts/tools/aws/iam-add-user-to-group.ts @@ -1,23 +1,20 @@ import { z } from 'zod' +import { + iamConnectionShape, + iamGroupNameSchema, + iamUserName128Schema, +} from '@/lib/api/contracts/tools/aws/iam-shared' import type { ContractBody, ContractBodyInput, ContractJsonResponse, } from '@/lib/api/contracts/types' import { defineRouteContract } from '@/lib/api/contracts/types' -import { validateAwsRegion } from '@/lib/core/security/input-validation' const Schema = z.object({ - region: z - .string() - .min(1, 'AWS region is required') - .refine((v) => validateAwsRegion(v).isValid, { - message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', - }), - accessKeyId: z.string().min(1, 'AWS access key ID is required'), - secretAccessKey: z.string().min(1, 'AWS secret access key is required'), - userName: z.string().min(1, 'User name is required'), - groupName: z.string().min(1, 'Group name is required'), + ...iamConnectionShape, + userName: iamUserName128Schema, + groupName: iamGroupNameSchema, }) export const awsIamAddUserToGroupContract = defineRouteContract({ diff --git a/apps/sim/lib/api/contracts/tools/aws/iam-attach-role-policy.ts b/apps/sim/lib/api/contracts/tools/aws/iam-attach-role-policy.ts index afcbead191f..3592dee3411 100644 --- a/apps/sim/lib/api/contracts/tools/aws/iam-attach-role-policy.ts +++ b/apps/sim/lib/api/contracts/tools/aws/iam-attach-role-policy.ts @@ -1,23 +1,20 @@ import { z } from 'zod' +import { + iamConnectionShape, + iamPolicyArnSchema, + iamRoleNameSchema, +} from '@/lib/api/contracts/tools/aws/iam-shared' import type { ContractBody, ContractBodyInput, ContractJsonResponse, } from '@/lib/api/contracts/types' import { defineRouteContract } from '@/lib/api/contracts/types' -import { validateAwsRegion } from '@/lib/core/security/input-validation' const Schema = z.object({ - region: z - .string() - .min(1, 'AWS region is required') - .refine((v) => validateAwsRegion(v).isValid, { - message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', - }), - accessKeyId: z.string().min(1, 'AWS access key ID is required'), - secretAccessKey: z.string().min(1, 'AWS secret access key is required'), - roleName: z.string().min(1, 'Role name is required'), - policyArn: z.string().min(1, 'Policy ARN is required'), + ...iamConnectionShape, + roleName: iamRoleNameSchema, + policyArn: iamPolicyArnSchema, }) export const awsIamAttachRolePolicyContract = defineRouteContract({ diff --git a/apps/sim/lib/api/contracts/tools/aws/iam-attach-user-policy.ts b/apps/sim/lib/api/contracts/tools/aws/iam-attach-user-policy.ts index 0d841996dd4..0043777a47d 100644 --- a/apps/sim/lib/api/contracts/tools/aws/iam-attach-user-policy.ts +++ b/apps/sim/lib/api/contracts/tools/aws/iam-attach-user-policy.ts @@ -1,23 +1,20 @@ import { z } from 'zod' +import { + iamConnectionShape, + iamPolicyArnSchema, + iamUserName64Schema, +} from '@/lib/api/contracts/tools/aws/iam-shared' import type { ContractBody, ContractBodyInput, ContractJsonResponse, } from '@/lib/api/contracts/types' import { defineRouteContract } from '@/lib/api/contracts/types' -import { validateAwsRegion } from '@/lib/core/security/input-validation' const Schema = z.object({ - region: z - .string() - .min(1, 'AWS region is required') - .refine((v) => validateAwsRegion(v).isValid, { - message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', - }), - accessKeyId: z.string().min(1, 'AWS access key ID is required'), - secretAccessKey: z.string().min(1, 'AWS secret access key is required'), - userName: z.string().min(1, 'User name is required'), - policyArn: z.string().min(1, 'Policy ARN is required'), + ...iamConnectionShape, + userName: iamUserName64Schema, + policyArn: iamPolicyArnSchema, }) export const awsIamAttachUserPolicyContract = defineRouteContract({ diff --git a/apps/sim/lib/api/contracts/tools/aws/iam-create-access-key.ts b/apps/sim/lib/api/contracts/tools/aws/iam-create-access-key.ts index acdbaef011a..d1a44508221 100644 --- a/apps/sim/lib/api/contracts/tools/aws/iam-create-access-key.ts +++ b/apps/sim/lib/api/contracts/tools/aws/iam-create-access-key.ts @@ -1,22 +1,15 @@ import { z } from 'zod' +import { iamConnectionShape, iamUserName128Schema } from '@/lib/api/contracts/tools/aws/iam-shared' import type { ContractBody, ContractBodyInput, ContractJsonResponse, } from '@/lib/api/contracts/types' import { defineRouteContract } from '@/lib/api/contracts/types' -import { validateAwsRegion } from '@/lib/core/security/input-validation' const Schema = z.object({ - region: z - .string() - .min(1, 'AWS region is required') - .refine((v) => validateAwsRegion(v).isValid, { - message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', - }), - accessKeyId: z.string().min(1, 'AWS access key ID is required'), - secretAccessKey: z.string().min(1, 'AWS secret access key is required'), - userName: z.string().optional().nullable(), + ...iamConnectionShape, + userName: iamUserName128Schema.optional().nullable(), }) const CreateAccessKeyResponseSchema = z.object({ diff --git a/apps/sim/lib/api/contracts/tools/aws/iam-create-role.ts b/apps/sim/lib/api/contracts/tools/aws/iam-create-role.ts index 3b1427e1788..ab70e1d0df4 100644 --- a/apps/sim/lib/api/contracts/tools/aws/iam-create-role.ts +++ b/apps/sim/lib/api/contracts/tools/aws/iam-create-role.ts @@ -1,26 +1,31 @@ import { z } from 'zod' +import { + iamAssumeRolePolicyDocumentSchema, + iamConnectionShape, + iamCreatePathSchema, + iamRoleDescriptionSchema, + iamRoleNameSchema, +} from '@/lib/api/contracts/tools/aws/iam-shared' import type { ContractBody, ContractBodyInput, ContractJsonResponse, } from '@/lib/api/contracts/types' import { defineRouteContract } from '@/lib/api/contracts/types' -import { validateAwsRegion } from '@/lib/core/security/input-validation' const Schema = z.object({ - region: z - .string() - .min(1, 'AWS region is required') - .refine((v) => validateAwsRegion(v).isValid, { - message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', - }), - accessKeyId: z.string().min(1, 'AWS access key ID is required'), - secretAccessKey: z.string().min(1, 'AWS secret access key is required'), - roleName: z.string().min(1, 'Role name is required'), - assumeRolePolicyDocument: z.string().min(1, 'Assume role policy document is required'), - description: z.string().optional().nullable(), - path: z.string().optional().nullable(), - maxSessionDuration: z.number().int().min(3600).max(43200).optional().nullable(), + ...iamConnectionShape, + roleName: iamRoleNameSchema, + assumeRolePolicyDocument: iamAssumeRolePolicyDocumentSchema, + description: iamRoleDescriptionSchema.optional().nullable(), + path: iamCreatePathSchema.optional().nullable(), + maxSessionDuration: z + .number() + .int('Max session duration must be a whole number of seconds') + .min(3600, 'Max session duration must be at least 3600 seconds (1 hour)') + .max(43200, 'Max session duration cannot exceed 43200 seconds (12 hours)') + .optional() + .nullable(), }) const CreateRoleResponseSchema = z.object({ diff --git a/apps/sim/lib/api/contracts/tools/aws/iam-create-user.ts b/apps/sim/lib/api/contracts/tools/aws/iam-create-user.ts index 8f925406a68..4e252e679b0 100644 --- a/apps/sim/lib/api/contracts/tools/aws/iam-create-user.ts +++ b/apps/sim/lib/api/contracts/tools/aws/iam-create-user.ts @@ -1,23 +1,20 @@ import { z } from 'zod' +import { + iamConnectionShape, + iamCreatePathSchema, + iamUserName64Schema, +} from '@/lib/api/contracts/tools/aws/iam-shared' import type { ContractBody, ContractBodyInput, ContractJsonResponse, } from '@/lib/api/contracts/types' import { defineRouteContract } from '@/lib/api/contracts/types' -import { validateAwsRegion } from '@/lib/core/security/input-validation' const Schema = z.object({ - region: z - .string() - .min(1, 'AWS region is required') - .refine((v) => validateAwsRegion(v).isValid, { - message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', - }), - accessKeyId: z.string().min(1, 'AWS access key ID is required'), - secretAccessKey: z.string().min(1, 'AWS secret access key is required'), - userName: z.string().min(1, 'User name is required'), - path: z.string().optional().nullable(), + ...iamConnectionShape, + userName: iamUserName64Schema, + path: iamCreatePathSchema.optional().nullable(), }) const CreateUserResponseSchema = z.object({ diff --git a/apps/sim/lib/api/contracts/tools/aws/iam-delete-access-key.ts b/apps/sim/lib/api/contracts/tools/aws/iam-delete-access-key.ts index 195862da0f6..7371cfd78ad 100644 --- a/apps/sim/lib/api/contracts/tools/aws/iam-delete-access-key.ts +++ b/apps/sim/lib/api/contracts/tools/aws/iam-delete-access-key.ts @@ -1,23 +1,20 @@ import { z } from 'zod' +import { + iamAccessKeyIdentifierSchema, + iamConnectionShape, + iamUserName128Schema, +} from '@/lib/api/contracts/tools/aws/iam-shared' import type { ContractBody, ContractBodyInput, ContractJsonResponse, } from '@/lib/api/contracts/types' import { defineRouteContract } from '@/lib/api/contracts/types' -import { validateAwsRegion } from '@/lib/core/security/input-validation' const Schema = z.object({ - region: z - .string() - .min(1, 'AWS region is required') - .refine((v) => validateAwsRegion(v).isValid, { - message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', - }), - accessKeyId: z.string().min(1, 'AWS access key ID is required'), - secretAccessKey: z.string().min(1, 'AWS secret access key is required'), - accessKeyIdToDelete: z.string().min(1, 'Access key ID to delete is required'), - userName: z.string().optional().nullable(), + ...iamConnectionShape, + accessKeyIdToDelete: iamAccessKeyIdentifierSchema, + userName: iamUserName128Schema.optional().nullable(), }) export const awsIamDeleteAccessKeyContract = defineRouteContract({ diff --git a/apps/sim/lib/api/contracts/tools/aws/iam-delete-role.ts b/apps/sim/lib/api/contracts/tools/aws/iam-delete-role.ts index 1e28812b009..1be7856e237 100644 --- a/apps/sim/lib/api/contracts/tools/aws/iam-delete-role.ts +++ b/apps/sim/lib/api/contracts/tools/aws/iam-delete-role.ts @@ -1,22 +1,15 @@ import { z } from 'zod' +import { iamConnectionShape, iamRoleNameSchema } from '@/lib/api/contracts/tools/aws/iam-shared' import type { ContractBody, ContractBodyInput, ContractJsonResponse, } from '@/lib/api/contracts/types' import { defineRouteContract } from '@/lib/api/contracts/types' -import { validateAwsRegion } from '@/lib/core/security/input-validation' const Schema = z.object({ - region: z - .string() - .min(1, 'AWS region is required') - .refine((v) => validateAwsRegion(v).isValid, { - message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', - }), - accessKeyId: z.string().min(1, 'AWS access key ID is required'), - secretAccessKey: z.string().min(1, 'AWS secret access key is required'), - roleName: z.string().min(1, 'Role name is required'), + ...iamConnectionShape, + roleName: iamRoleNameSchema, }) export const awsIamDeleteRoleContract = defineRouteContract({ diff --git a/apps/sim/lib/api/contracts/tools/aws/iam-delete-user.ts b/apps/sim/lib/api/contracts/tools/aws/iam-delete-user.ts index e728b06a808..950c525a857 100644 --- a/apps/sim/lib/api/contracts/tools/aws/iam-delete-user.ts +++ b/apps/sim/lib/api/contracts/tools/aws/iam-delete-user.ts @@ -1,22 +1,15 @@ import { z } from 'zod' +import { iamConnectionShape, iamUserName128Schema } from '@/lib/api/contracts/tools/aws/iam-shared' import type { ContractBody, ContractBodyInput, ContractJsonResponse, } from '@/lib/api/contracts/types' import { defineRouteContract } from '@/lib/api/contracts/types' -import { validateAwsRegion } from '@/lib/core/security/input-validation' const Schema = z.object({ - region: z - .string() - .min(1, 'AWS region is required') - .refine((v) => validateAwsRegion(v).isValid, { - message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', - }), - accessKeyId: z.string().min(1, 'AWS access key ID is required'), - secretAccessKey: z.string().min(1, 'AWS secret access key is required'), - userName: z.string().min(1, 'User name is required'), + ...iamConnectionShape, + userName: iamUserName128Schema, }) export const awsIamDeleteUserContract = defineRouteContract({ diff --git a/apps/sim/lib/api/contracts/tools/aws/iam-detach-role-policy.ts b/apps/sim/lib/api/contracts/tools/aws/iam-detach-role-policy.ts index c09f802af05..d00e0825914 100644 --- a/apps/sim/lib/api/contracts/tools/aws/iam-detach-role-policy.ts +++ b/apps/sim/lib/api/contracts/tools/aws/iam-detach-role-policy.ts @@ -1,23 +1,20 @@ import { z } from 'zod' +import { + iamConnectionShape, + iamPolicyArnSchema, + iamRoleNameSchema, +} from '@/lib/api/contracts/tools/aws/iam-shared' import type { ContractBody, ContractBodyInput, ContractJsonResponse, } from '@/lib/api/contracts/types' import { defineRouteContract } from '@/lib/api/contracts/types' -import { validateAwsRegion } from '@/lib/core/security/input-validation' const Schema = z.object({ - region: z - .string() - .min(1, 'AWS region is required') - .refine((v) => validateAwsRegion(v).isValid, { - message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', - }), - accessKeyId: z.string().min(1, 'AWS access key ID is required'), - secretAccessKey: z.string().min(1, 'AWS secret access key is required'), - roleName: z.string().min(1, 'Role name is required'), - policyArn: z.string().min(1, 'Policy ARN is required'), + ...iamConnectionShape, + roleName: iamRoleNameSchema, + policyArn: iamPolicyArnSchema, }) export const awsIamDetachRolePolicyContract = defineRouteContract({ diff --git a/apps/sim/lib/api/contracts/tools/aws/iam-detach-user-policy.ts b/apps/sim/lib/api/contracts/tools/aws/iam-detach-user-policy.ts index 2ded4cfc918..61942cfd881 100644 --- a/apps/sim/lib/api/contracts/tools/aws/iam-detach-user-policy.ts +++ b/apps/sim/lib/api/contracts/tools/aws/iam-detach-user-policy.ts @@ -1,23 +1,20 @@ import { z } from 'zod' +import { + iamConnectionShape, + iamPolicyArnSchema, + iamUserName64Schema, +} from '@/lib/api/contracts/tools/aws/iam-shared' import type { ContractBody, ContractBodyInput, ContractJsonResponse, } from '@/lib/api/contracts/types' import { defineRouteContract } from '@/lib/api/contracts/types' -import { validateAwsRegion } from '@/lib/core/security/input-validation' const Schema = z.object({ - region: z - .string() - .min(1, 'AWS region is required') - .refine((v) => validateAwsRegion(v).isValid, { - message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', - }), - accessKeyId: z.string().min(1, 'AWS access key ID is required'), - secretAccessKey: z.string().min(1, 'AWS secret access key is required'), - userName: z.string().min(1, 'User name is required'), - policyArn: z.string().min(1, 'Policy ARN is required'), + ...iamConnectionShape, + userName: iamUserName64Schema, + policyArn: iamPolicyArnSchema, }) export const awsIamDetachUserPolicyContract = defineRouteContract({ diff --git a/apps/sim/lib/api/contracts/tools/aws/iam-get-policy.ts b/apps/sim/lib/api/contracts/tools/aws/iam-get-policy.ts new file mode 100644 index 00000000000..c43a932edcb --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/iam-get-policy.ts @@ -0,0 +1,43 @@ +import { z } from 'zod' +import { iamConnectionShape, iamPolicyArnSchema } from '@/lib/api/contracts/tools/aws/iam-shared' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' + +const Schema = z.object({ + ...iamConnectionShape, + policyArn: iamPolicyArnSchema, +}) + +const GetPolicyResponseSchema = z.object({ + policyName: z.string(), + policyId: z.string(), + arn: z.string(), + path: z.string(), + attachmentCount: z.number(), + isAttachable: z.boolean(), + createDate: z.string().nullable(), + updateDate: z.string().nullable(), + description: z.string().nullable(), + defaultVersionId: z.string().nullable(), + permissionsBoundaryUsageCount: z.number(), + tags: z.array( + z.object({ + key: z.string(), + value: z.string(), + }) + ), +}) + +export const awsIamGetPolicyContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/iam/get-policy', + body: Schema, + response: { mode: 'json', schema: GetPolicyResponseSchema }, +}) +export type AwsIamGetPolicyRequest = ContractBodyInput +export type AwsIamGetPolicyBody = ContractBody +export type AwsIamGetPolicyResponse = ContractJsonResponse diff --git a/apps/sim/lib/api/contracts/tools/aws/iam-get-role.ts b/apps/sim/lib/api/contracts/tools/aws/iam-get-role.ts index 2f9113b615d..8ee1d93e5c7 100644 --- a/apps/sim/lib/api/contracts/tools/aws/iam-get-role.ts +++ b/apps/sim/lib/api/contracts/tools/aws/iam-get-role.ts @@ -1,22 +1,15 @@ import { z } from 'zod' +import { iamConnectionShape, iamRoleNameSchema } from '@/lib/api/contracts/tools/aws/iam-shared' import type { ContractBody, ContractBodyInput, ContractJsonResponse, } from '@/lib/api/contracts/types' import { defineRouteContract } from '@/lib/api/contracts/types' -import { validateAwsRegion } from '@/lib/core/security/input-validation' const Schema = z.object({ - region: z - .string() - .min(1, 'AWS region is required') - .refine((v) => validateAwsRegion(v).isValid, { - message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', - }), - accessKeyId: z.string().min(1, 'AWS access key ID is required'), - secretAccessKey: z.string().min(1, 'AWS secret access key is required'), - roleName: z.string().min(1, 'Role name is required'), + ...iamConnectionShape, + roleName: iamRoleNameSchema, }) const GetRoleResponseSchema = z.object({ diff --git a/apps/sim/lib/api/contracts/tools/aws/iam-get-user.ts b/apps/sim/lib/api/contracts/tools/aws/iam-get-user.ts index faa6383fb69..fc56cded29c 100644 --- a/apps/sim/lib/api/contracts/tools/aws/iam-get-user.ts +++ b/apps/sim/lib/api/contracts/tools/aws/iam-get-user.ts @@ -1,22 +1,15 @@ import { z } from 'zod' +import { iamConnectionShape, iamUserName128Schema } from '@/lib/api/contracts/tools/aws/iam-shared' import type { ContractBody, ContractBodyInput, ContractJsonResponse, } from '@/lib/api/contracts/types' import { defineRouteContract } from '@/lib/api/contracts/types' -import { validateAwsRegion } from '@/lib/core/security/input-validation' const Schema = z.object({ - region: z - .string() - .min(1, 'AWS region is required') - .refine((v) => validateAwsRegion(v).isValid, { - message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', - }), - accessKeyId: z.string().min(1, 'AWS access key ID is required'), - secretAccessKey: z.string().min(1, 'AWS secret access key is required'), - userName: z.string().min(1).optional().nullable(), + ...iamConnectionShape, + userName: iamUserName128Schema.optional().nullable(), }) const GetUserResponseSchema = z.object({ diff --git a/apps/sim/lib/api/contracts/tools/aws/iam-list-access-keys.ts b/apps/sim/lib/api/contracts/tools/aws/iam-list-access-keys.ts new file mode 100644 index 00000000000..3b2def57475 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/iam-list-access-keys.ts @@ -0,0 +1,46 @@ +import { z } from 'zod' +import { + iamConnectionShape, + iamMarkerSchema, + iamMaxItemsSchema, + iamPaginationResponseShape, + iamUserName128Schema, +} from '@/lib/api/contracts/tools/aws/iam-shared' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' + +const Schema = z.object({ + ...iamConnectionShape, + userName: iamUserName128Schema.optional().nullable(), + maxItems: iamMaxItemsSchema.optional().nullable(), + marker: iamMarkerSchema.optional().nullable(), +}) + +/** + * The secret access key is never returned by ListAccessKeys; only the key's metadata is. + */ +const ListAccessKeysResponseSchema = z.object({ + accessKeys: z.array( + z.object({ + accessKeyId: z.string(), + userName: z.string(), + status: z.string(), + createDate: z.string().nullable(), + }) + ), + ...iamPaginationResponseShape, +}) + +export const awsIamListAccessKeysContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/iam/list-access-keys', + body: Schema, + response: { mode: 'json', schema: ListAccessKeysResponseSchema }, +}) +export type AwsIamListAccessKeysRequest = ContractBodyInput +export type AwsIamListAccessKeysBody = ContractBody +export type AwsIamListAccessKeysResponse = ContractJsonResponse diff --git a/apps/sim/lib/api/contracts/tools/aws/iam-list-attached-role-policies.ts b/apps/sim/lib/api/contracts/tools/aws/iam-list-attached-role-policies.ts index eee4da1387c..260a94ef7fe 100644 --- a/apps/sim/lib/api/contracts/tools/aws/iam-list-attached-role-policies.ts +++ b/apps/sim/lib/api/contracts/tools/aws/iam-list-attached-role-policies.ts @@ -1,37 +1,35 @@ import { z } from 'zod' +import { + iamConnectionShape, + iamMarkerSchema, + iamMaxItemsSchema, + iamPaginationResponseShape, + iamPolicyPathPrefixSchema, + iamRoleNameSchema, +} from '@/lib/api/contracts/tools/aws/iam-shared' import type { ContractBody, ContractBodyInput, ContractJsonResponse, } from '@/lib/api/contracts/types' import { defineRouteContract } from '@/lib/api/contracts/types' -import { validateAwsRegion } from '@/lib/core/security/input-validation' const Schema = z.object({ - region: z - .string() - .min(1, 'AWS region is required') - .refine((v) => validateAwsRegion(v).isValid, { - message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', - }), - accessKeyId: z.string().min(1, 'AWS access key ID is required'), - secretAccessKey: z.string().min(1, 'AWS secret access key is required'), - roleName: z.string().min(1, 'Role name is required'), - pathPrefix: z.string().optional().nullable(), - maxItems: z.number().int().min(1).max(1000).optional().nullable(), - marker: z.string().optional().nullable(), + ...iamConnectionShape, + roleName: iamRoleNameSchema, + pathPrefix: iamPolicyPathPrefixSchema.optional().nullable(), + maxItems: iamMaxItemsSchema.optional().nullable(), + marker: iamMarkerSchema.optional().nullable(), +}) + +const AttachedPolicySchema = z.object({ + policyName: z.string(), + policyArn: z.string(), }) const ListAttachedRolePoliciesResponseSchema = z.object({ - attachedPolicies: z.array( - z.object({ - policyName: z.string(), - policyArn: z.string(), - }) - ), - isTruncated: z.boolean(), - marker: z.string().nullable(), - count: z.number(), + attachedPolicies: z.array(AttachedPolicySchema), + ...iamPaginationResponseShape, }) export const awsIamListAttachedRolePoliciesContract = defineRouteContract({ diff --git a/apps/sim/lib/api/contracts/tools/aws/iam-list-attached-user-policies.ts b/apps/sim/lib/api/contracts/tools/aws/iam-list-attached-user-policies.ts index b8304da115f..2b148a269f2 100644 --- a/apps/sim/lib/api/contracts/tools/aws/iam-list-attached-user-policies.ts +++ b/apps/sim/lib/api/contracts/tools/aws/iam-list-attached-user-policies.ts @@ -1,37 +1,35 @@ import { z } from 'zod' +import { + iamConnectionShape, + iamMarkerSchema, + iamMaxItemsSchema, + iamPaginationResponseShape, + iamPolicyPathPrefixSchema, + iamUserName64Schema, +} from '@/lib/api/contracts/tools/aws/iam-shared' import type { ContractBody, ContractBodyInput, ContractJsonResponse, } from '@/lib/api/contracts/types' import { defineRouteContract } from '@/lib/api/contracts/types' -import { validateAwsRegion } from '@/lib/core/security/input-validation' const Schema = z.object({ - region: z - .string() - .min(1, 'AWS region is required') - .refine((v) => validateAwsRegion(v).isValid, { - message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', - }), - accessKeyId: z.string().min(1, 'AWS access key ID is required'), - secretAccessKey: z.string().min(1, 'AWS secret access key is required'), - userName: z.string().min(1, 'User name is required'), - pathPrefix: z.string().optional().nullable(), - maxItems: z.number().int().min(1).max(1000).optional().nullable(), - marker: z.string().optional().nullable(), + ...iamConnectionShape, + userName: iamUserName64Schema, + pathPrefix: iamPolicyPathPrefixSchema.optional().nullable(), + maxItems: iamMaxItemsSchema.optional().nullable(), + marker: iamMarkerSchema.optional().nullable(), +}) + +const AttachedPolicySchema = z.object({ + policyName: z.string(), + policyArn: z.string(), }) const ListAttachedUserPoliciesResponseSchema = z.object({ - attachedPolicies: z.array( - z.object({ - policyName: z.string(), - policyArn: z.string(), - }) - ), - isTruncated: z.boolean(), - marker: z.string().nullable(), - count: z.number(), + attachedPolicies: z.array(AttachedPolicySchema), + ...iamPaginationResponseShape, }) export const awsIamListAttachedUserPoliciesContract = defineRouteContract({ diff --git a/apps/sim/lib/api/contracts/tools/aws/iam-list-groups.ts b/apps/sim/lib/api/contracts/tools/aws/iam-list-groups.ts index 63882b6f974..a98717860e2 100644 --- a/apps/sim/lib/api/contracts/tools/aws/iam-list-groups.ts +++ b/apps/sim/lib/api/contracts/tools/aws/iam-list-groups.ts @@ -1,24 +1,23 @@ import { z } from 'zod' +import { + iamConnectionShape, + iamEntityListPathPrefixSchema, + iamMarkerSchema, + iamMaxItemsSchema, + iamPaginationResponseShape, +} from '@/lib/api/contracts/tools/aws/iam-shared' import type { ContractBody, ContractBodyInput, ContractJsonResponse, } from '@/lib/api/contracts/types' import { defineRouteContract } from '@/lib/api/contracts/types' -import { validateAwsRegion } from '@/lib/core/security/input-validation' const Schema = z.object({ - region: z - .string() - .min(1, 'AWS region is required') - .refine((v) => validateAwsRegion(v).isValid, { - message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', - }), - accessKeyId: z.string().min(1, 'AWS access key ID is required'), - secretAccessKey: z.string().min(1, 'AWS secret access key is required'), - pathPrefix: z.string().optional().nullable(), - maxItems: z.number().int().min(1).max(1000).optional().nullable(), - marker: z.string().optional().nullable(), + ...iamConnectionShape, + pathPrefix: iamEntityListPathPrefixSchema.optional().nullable(), + maxItems: iamMaxItemsSchema.optional().nullable(), + marker: iamMarkerSchema.optional().nullable(), }) const ListGroupsResponseSchema = z.object({ @@ -31,9 +30,7 @@ const ListGroupsResponseSchema = z.object({ createDate: z.string().nullable(), }) ), - isTruncated: z.boolean(), - marker: z.string().nullable(), - count: z.number(), + ...iamPaginationResponseShape, }) export const awsIamListGroupsContract = defineRouteContract({ diff --git a/apps/sim/lib/api/contracts/tools/aws/iam-list-policies.ts b/apps/sim/lib/api/contracts/tools/aws/iam-list-policies.ts index 9b898792617..42d0f5a7bba 100644 --- a/apps/sim/lib/api/contracts/tools/aws/iam-list-policies.ts +++ b/apps/sim/lib/api/contracts/tools/aws/iam-list-policies.ts @@ -1,28 +1,32 @@ import { z } from 'zod' +import { + iamConnectionShape, + iamMarkerSchema, + iamMaxItemsSchema, + iamPaginationResponseShape, + iamPolicyPathPrefixSchema, + iamPolicyScopeSchema, +} from '@/lib/api/contracts/tools/aws/iam-shared' import type { ContractBody, ContractBodyInput, ContractJsonResponse, } from '@/lib/api/contracts/types' import { defineRouteContract } from '@/lib/api/contracts/types' -import { validateAwsRegion } from '@/lib/core/security/input-validation' const Schema = z.object({ - region: z - .string() - .min(1, 'AWS region is required') - .refine((v) => validateAwsRegion(v).isValid, { - message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', - }), - accessKeyId: z.string().min(1, 'AWS access key ID is required'), - secretAccessKey: z.string().min(1, 'AWS secret access key is required'), - scope: z.string().optional().nullable(), + ...iamConnectionShape, + scope: iamPolicyScopeSchema.optional().nullable(), onlyAttached: z.boolean().optional().nullable(), - pathPrefix: z.string().optional().nullable(), - maxItems: z.number().int().min(1).max(1000).optional().nullable(), - marker: z.string().optional().nullable(), + pathPrefix: iamPolicyPathPrefixSchema.optional().nullable(), + maxItems: iamMaxItemsSchema.optional().nullable(), + marker: iamMarkerSchema.optional().nullable(), }) +/** + * `description` is deliberately absent: AWS documents it as returned by GetPolicy and + * never by ListPolicies, so surfacing it here would always be null. Use `iam_get_policy`. + */ const ListPoliciesResponseSchema = z.object({ policies: z.array( z.object({ @@ -34,14 +38,11 @@ const ListPoliciesResponseSchema = z.object({ isAttachable: z.boolean(), createDate: z.string().nullable(), updateDate: z.string().nullable(), - description: z.string().nullable(), defaultVersionId: z.string().nullable(), permissionsBoundaryUsageCount: z.number(), }) ), - isTruncated: z.boolean(), - marker: z.string().nullable(), - count: z.number(), + ...iamPaginationResponseShape, }) export const awsIamListPoliciesContract = defineRouteContract({ diff --git a/apps/sim/lib/api/contracts/tools/aws/iam-list-roles.ts b/apps/sim/lib/api/contracts/tools/aws/iam-list-roles.ts index 3d50a47a954..483d45e094c 100644 --- a/apps/sim/lib/api/contracts/tools/aws/iam-list-roles.ts +++ b/apps/sim/lib/api/contracts/tools/aws/iam-list-roles.ts @@ -1,24 +1,23 @@ import { z } from 'zod' +import { + iamConnectionShape, + iamEntityListPathPrefixSchema, + iamMarkerSchema, + iamMaxItemsSchema, + iamPaginationResponseShape, +} from '@/lib/api/contracts/tools/aws/iam-shared' import type { ContractBody, ContractBodyInput, ContractJsonResponse, } from '@/lib/api/contracts/types' import { defineRouteContract } from '@/lib/api/contracts/types' -import { validateAwsRegion } from '@/lib/core/security/input-validation' const Schema = z.object({ - region: z - .string() - .min(1, 'AWS region is required') - .refine((v) => validateAwsRegion(v).isValid, { - message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', - }), - accessKeyId: z.string().min(1, 'AWS access key ID is required'), - secretAccessKey: z.string().min(1, 'AWS secret access key is required'), - pathPrefix: z.string().optional().nullable(), - maxItems: z.number().int().min(1).max(1000).optional().nullable(), - marker: z.string().optional().nullable(), + ...iamConnectionShape, + pathPrefix: iamEntityListPathPrefixSchema.optional().nullable(), + maxItems: iamMaxItemsSchema.optional().nullable(), + marker: iamMarkerSchema.optional().nullable(), }) const ListRolesResponseSchema = z.object({ @@ -33,9 +32,7 @@ const ListRolesResponseSchema = z.object({ maxSessionDuration: z.number().nullable(), }) ), - isTruncated: z.boolean(), - marker: z.string().nullable(), - count: z.number(), + ...iamPaginationResponseShape, }) export const awsIamListRolesContract = defineRouteContract({ diff --git a/apps/sim/lib/api/contracts/tools/aws/iam-list-users.ts b/apps/sim/lib/api/contracts/tools/aws/iam-list-users.ts index 86afec61acb..553f621f7ae 100644 --- a/apps/sim/lib/api/contracts/tools/aws/iam-list-users.ts +++ b/apps/sim/lib/api/contracts/tools/aws/iam-list-users.ts @@ -1,40 +1,37 @@ import { z } from 'zod' +import { + iamConnectionShape, + iamEntityListPathPrefixSchema, + iamMarkerSchema, + iamMaxItemsSchema, + iamPaginationResponseShape, +} from '@/lib/api/contracts/tools/aws/iam-shared' import type { ContractBody, ContractBodyInput, ContractJsonResponse, } from '@/lib/api/contracts/types' import { defineRouteContract } from '@/lib/api/contracts/types' -import { validateAwsRegion } from '@/lib/core/security/input-validation' const Schema = z.object({ - region: z - .string() - .min(1, 'AWS region is required') - .refine((v) => validateAwsRegion(v).isValid, { - message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', - }), - accessKeyId: z.string().min(1, 'AWS access key ID is required'), - secretAccessKey: z.string().min(1, 'AWS secret access key is required'), - pathPrefix: z.string().optional().nullable(), - maxItems: z.number().int().min(1).max(1000).optional().nullable(), - marker: z.string().optional().nullable(), + ...iamConnectionShape, + pathPrefix: iamEntityListPathPrefixSchema.optional().nullable(), + maxItems: iamMaxItemsSchema.optional().nullable(), + marker: iamMarkerSchema.optional().nullable(), +}) + +const UserSchema = z.object({ + userName: z.string(), + userId: z.string(), + arn: z.string(), + path: z.string(), + createDate: z.string().nullable(), + passwordLastUsed: z.string().nullable(), }) const ListUsersResponseSchema = z.object({ - users: z.array( - z.object({ - userName: z.string(), - userId: z.string(), - arn: z.string(), - path: z.string(), - createDate: z.string().nullable(), - passwordLastUsed: z.string().nullable(), - }) - ), - isTruncated: z.boolean(), - marker: z.string().nullable(), - count: z.number(), + users: z.array(UserSchema), + ...iamPaginationResponseShape, }) export const awsIamListUsersContract = defineRouteContract({ diff --git a/apps/sim/lib/api/contracts/tools/aws/iam-remove-user-from-group.ts b/apps/sim/lib/api/contracts/tools/aws/iam-remove-user-from-group.ts index dfaea8b5619..84995bb67b1 100644 --- a/apps/sim/lib/api/contracts/tools/aws/iam-remove-user-from-group.ts +++ b/apps/sim/lib/api/contracts/tools/aws/iam-remove-user-from-group.ts @@ -1,23 +1,20 @@ import { z } from 'zod' +import { + iamConnectionShape, + iamGroupNameSchema, + iamUserName128Schema, +} from '@/lib/api/contracts/tools/aws/iam-shared' import type { ContractBody, ContractBodyInput, ContractJsonResponse, } from '@/lib/api/contracts/types' import { defineRouteContract } from '@/lib/api/contracts/types' -import { validateAwsRegion } from '@/lib/core/security/input-validation' const Schema = z.object({ - region: z - .string() - .min(1, 'AWS region is required') - .refine((v) => validateAwsRegion(v).isValid, { - message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', - }), - accessKeyId: z.string().min(1, 'AWS access key ID is required'), - secretAccessKey: z.string().min(1, 'AWS secret access key is required'), - userName: z.string().min(1, 'User name is required'), - groupName: z.string().min(1, 'Group name is required'), + ...iamConnectionShape, + userName: iamUserName128Schema, + groupName: iamGroupNameSchema, }) export const awsIamRemoveUserFromGroupContract = defineRouteContract({ diff --git a/apps/sim/lib/api/contracts/tools/aws/iam-shared.test.ts b/apps/sim/lib/api/contracts/tools/aws/iam-shared.test.ts new file mode 100644 index 00000000000..77bb6f2e07a --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/iam-shared.test.ts @@ -0,0 +1,65 @@ +/** + * @vitest-environment node + */ +import { describe, expect, it } from 'vitest' +import { iamRegionSchema } from '@/lib/api/contracts/tools/aws/iam-shared' + +describe('iamRegionSchema', () => { + it.each([ + 'us-east-1', + 'eu-west-2', + 'ap-southeast-4', + 'sa-east-1', + 'il-central-1', + 'mx-central-1', + 'ca-west-1', + ])('accepts the commercial region %s', (region) => { + expect(iamRegionSchema.safeParse(region).success).toBe(true) + }) + + it.each(['us-gov-east-1', 'us-gov-west-1', 'cn-north-1', 'cn-northwest-1'])( + 'accepts the partitioned region %s', + (region) => { + expect(iamRegionSchema.safeParse(region).success).toBe(true) + } + ) + + it.each(['us-iso-east-1', 'us-isob-east-1', 'eu-isoe-west-1', 'eusc-de-east-1'])( + 'accepts the isolated region %s', + (region) => { + expect(iamRegionSchema.safeParse(region).success).toBe(true) + } + ) + + /** + * The pinned `@aws-sdk/client-iam` endpoint ruleset maps the ISO-F partition to + * `https://iam.us-isof-south-1.csp.hci.ic.gov`, so IAM demonstrably exists there. + */ + it.each(['us-isof-south-1', 'us-isof-east-1'])('accepts the ISO-F region %s', (region) => { + expect(iamRegionSchema.safeParse(region).success).toBe(true) + }) + + it('rejects an empty region', () => { + expect(iamRegionSchema.safeParse('').success).toBe(false) + }) + + it.each([ + 'us_east_1', + 'US-EAST-1', + 'us east 1', + 'useast1', + 'us-east-1.evil.example.com', + 'us-east-1/../admin', + 'us-east-1:443', + 'user@us-east-1', + 'us-east-1\nx-injected: 1', + '-us-east-1', + 'us-east-1-', + ])('rejects the host-unsafe or malformed value %j', (region) => { + expect(iamRegionSchema.safeParse(region).success).toBe(false) + }) + + it('rejects a region longer than 64 characters', () => { + expect(iamRegionSchema.safeParse(`us-${'a'.repeat(70)}-1`).success).toBe(false) + }) +}) diff --git a/apps/sim/lib/api/contracts/tools/aws/iam-shared.ts b/apps/sim/lib/api/contracts/tools/aws/iam-shared.ts new file mode 100644 index 00000000000..26559165348 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/iam-shared.ts @@ -0,0 +1,268 @@ +import { z } from 'zod' +import { validateAwsRegion } from '@/lib/core/security/input-validation' + +/** + * Boundary primitives for the AWS IAM tool contracts. + * + * Every bound and pattern here is transcribed from the IAM API Reference. AWS documents + * different bounds for the same-named parameter across actions — `UserName` is 1-64 on + * CreateUser/AttachUserPolicy/ListAttachedUserPolicies but 1-128 on GetUser, DeleteUser, + * and the access-key and group-membership actions — so each contract picks the builder + * that matches its own action rather than sharing one bound. + */ + +/** IAM friendly-name character class, shared by user, role, and group names. */ +const IAM_NAME_PATTERN = /^[\w+=,.@-]+$/ + +/** `PathPrefix` on the entity list actions: ListUsers, ListRoles, ListGroups. */ +const ENTITY_LIST_PATH_PREFIX_PATTERN = /^\u002F[\u0021-\u007F]*$/ + +/** `Path` on the create actions: CreateUser, CreateRole. Requires a trailing slash. */ +const CREATE_PATH_PATTERN = /^(?:\u002F|\u002F[\u0021-\u007E]+\u002F)$/ + +/** `PathPrefix` on the policy family: ListPolicies and the ListAttached*Policies actions. */ +const POLICY_PATH_PREFIX_PATTERN = /^(?:\u002F[A-Za-z0-9.,+@=_-]+)*\u002F$/ + +const MARKER_PATTERN = /^[\u0020-\u00FF]+$/ + +const ACCESS_KEY_ID_PATTERN = /^[\w]+$/ + +const POLICY_DOCUMENT_PATTERN = /^[\u0009\u000A\u000D\u0020-\u00FF]+$/ + +const ROLE_DESCRIPTION_PATTERN = /^[\u0009\u000A\u000D\u0020-\u007E\u00A1-\u00FF]*$/ + +export const iamRegionSchema = z + .string() + .min(1, 'AWS region is required') + .refine((v) => validateAwsRegion(v).isValid, { + message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', + }) + +export const iamAccessKeyIdSchema = z.string().min(1, 'AWS access key ID is required') + +export const iamSecretAccessKeySchema = z.string().min(1, 'AWS secret access key is required') + +/** The credential slice every IAM tool contract carries. */ +export const iamConnectionShape = { + region: iamRegionSchema, + accessKeyId: iamAccessKeyIdSchema, + secretAccessKey: iamSecretAccessKeySchema, +} + +/** `UserName` where AWS documents 1-64: CreateUser, AttachUserPolicy, DetachUserPolicy, ListAttachedUserPolicies. */ +export const iamUserName64Schema = z + .string() + .min(1, 'User name cannot be empty') + .max(64, 'User name cannot exceed 64 characters') + .regex(IAM_NAME_PATTERN, 'User name may contain only letters, digits, and _+=,.@-') + +/** `UserName` where AWS documents 1-128: GetUser, DeleteUser, the access-key actions, group membership. */ +export const iamUserName128Schema = z + .string() + .min(1, 'User name cannot be empty') + .max(128, 'User name cannot exceed 128 characters') + .regex(IAM_NAME_PATTERN, 'User name may contain only letters, digits, and _+=,.@-') + +/** `RoleName` is 1-64 on every IAM action that accepts it. */ +export const iamRoleNameSchema = z + .string() + .min(1, 'Role name cannot be empty') + .max(64, 'Role name cannot exceed 64 characters') + .regex(IAM_NAME_PATTERN, 'Role name may contain only letters, digits, and _+=,.@-') + +/** `GroupName` is 1-128 on AddUserToGroup and RemoveUserFromGroup. */ +export const iamGroupNameSchema = z + .string() + .min(1, 'Group name cannot be empty') + .max(128, 'Group name cannot exceed 128 characters') + .regex(IAM_NAME_PATTERN, 'Group name may contain only letters, digits, and _+=,.@-') + +/** `PolicyArn` on the attach/detach and GetPolicy actions: 20-2048, no documented pattern. */ +export const iamPolicyArnSchema = z + .string() + .min(20, 'Policy ARN must be at least 20 characters') + .max(2048, 'Policy ARN cannot exceed 2048 characters') + +/** `PolicySourceArn` on SimulatePrincipalPolicy: 20-2048, no documented pattern. */ +export const iamPolicySourceArnSchema = z + .string() + .min(20, 'Principal ARN must be at least 20 characters') + .max(2048, 'Principal ARN cannot exceed 2048 characters') + +export const iamAssumeRolePolicyDocumentSchema = z + .string() + .min(1, 'Trust policy document cannot be empty') + .max(131072, 'Trust policy document cannot exceed 131072 characters') + .regex(POLICY_DOCUMENT_PATTERN, 'Trust policy document contains unsupported characters') + +/** CreateRole `Description` has no documented minimum and a max of 1000. */ +export const iamRoleDescriptionSchema = z + .string() + .max(1000, 'Role description cannot exceed 1000 characters') + .regex(ROLE_DESCRIPTION_PATTERN, 'Role description contains unsupported characters') + +/** `Path` on CreateUser and CreateRole: 1-512, must begin and end with a slash. */ +export const iamCreatePathSchema = z + .string() + .min(1, 'Path cannot be empty') + .max(512, 'Path cannot exceed 512 characters') + .regex(CREATE_PATH_PATTERN, 'Path must be "/" or begin and end with "/" (e.g., "/division_abc/")') + +/** `PathPrefix` on ListUsers, ListRoles, and ListGroups: 1-512, must begin with a slash. */ +export const iamEntityListPathPrefixSchema = z + .string() + .min(1, 'Path prefix cannot be empty') + .max(512, 'Path prefix cannot exceed 512 characters') + .regex(ENTITY_LIST_PATH_PREFIX_PATTERN, 'Path prefix must begin with "/"') + +/** `PathPrefix` on the policy family, whose documented regex is narrower than the entity list one. */ +export const iamPolicyPathPrefixSchema = z + .string() + .min(1, 'Path prefix cannot be empty') + .max(512, 'Path prefix cannot exceed 512 characters') + .regex( + POLICY_PATH_PREFIX_PATTERN, + 'Path prefix must end with "/" and may contain only letters, digits, and .,+@=_-' + ) + +/** `AccessKeyId` on DeleteAccessKey and UpdateAccessKey: 16-128 word characters. */ +export const iamAccessKeyIdentifierSchema = z + .string() + .min(16, 'Access key ID must be at least 16 characters') + .max(128, 'Access key ID cannot exceed 128 characters') + .regex(ACCESS_KEY_ID_PATTERN, 'Access key ID may contain only letters, digits, and underscores') + +/** `MaxItems` is documented as 1-1000 on every paginated IAM action. */ +export const iamMaxItemsSchema = z + .number() + .int('Max items must be a whole number') + .min(1, 'Max items must be at least 1') + .max(1000, 'Max items cannot exceed 1000') + +/** `Marker` has a documented minimum of 1 and no documented maximum. */ +export const iamMarkerSchema = z + .string() + .min(1, 'Pagination marker cannot be empty') + .regex(MARKER_PATTERN, 'Pagination marker contains unsupported characters') + +export const iamPolicyScopeSchema = z.enum(['All', 'AWS', 'Local'], { + message: 'Policy scope must be one of: All, AWS, Local', +}) + +/** UpdateAccessKey accepts `Expired` on the wire, but only Active/Inactive are settable. */ +export const iamAccessKeyStatusSchema = z.enum(['Active', 'Inactive'], { + message: 'Access key status must be either Active or Inactive', +}) + +export const iamContextKeyTypeSchema = z.enum( + [ + 'binary', + 'binaryList', + 'boolean', + 'booleanList', + 'date', + 'dateList', + 'ip', + 'ipList', + 'numeric', + 'numericList', + 'string', + 'stringList', + ], + { message: 'Context key type must be a documented IAM context key type (e.g., string, ip, date)' } +) + +/** + * Payload guards, not AWS constraints. `SimulatePrincipalPolicy` documents per-member + * bounds but no array count limit, so these are set far above any realistic simulate + * call: they bound request memory without narrowing what previously validated. + */ +const MAX_SIMULATED_ACTIONS = 1000 +const MAX_SIMULATED_RESOURCES = 1000 + +/** + * `ActionNames` reaches the tool as one comma-separated field. AWS documents each member + * as 3-128 characters, so validate the members rather than the joined string. + */ +export const iamActionNamesSchema = z + .string() + .min(1, 'At least one action name is required') + .superRefine((value, ctx) => { + const actions = value + .split(',') + .map((a) => a.trim()) + .filter(Boolean) + if (actions.length === 0) { + ctx.addIssue({ code: 'custom', message: 'At least one action name is required' }) + return + } + if (actions.length > MAX_SIMULATED_ACTIONS) { + ctx.addIssue({ + code: 'custom', + message: `Cannot simulate more than ${MAX_SIMULATED_ACTIONS} actions in one request`, + }) + } + for (const action of actions) { + if (action.length < 3 || action.length > 128) { + ctx.addIssue({ + code: 'custom', + message: `Action name "${action}" must be between 3 and 128 characters (e.g., s3:GetObject)`, + }) + } + } + }) + +/** `ResourceArns` members are documented as 1-2048 characters each. */ +export const iamResourceArnsSchema = z + .string() + .min(1, 'Resource ARNs cannot be empty') + .superRefine((value, ctx) => { + const arns = value + .split(',') + .map((r) => r.trim()) + .filter(Boolean) + if (arns.length === 0) { + ctx.addIssue({ + code: 'custom', + message: 'Resource ARNs must contain at least one ARN, or be omitted to simulate against *', + }) + return + } + if (arns.length > MAX_SIMULATED_RESOURCES) { + ctx.addIssue({ + code: 'custom', + message: `Cannot simulate more than ${MAX_SIMULATED_RESOURCES} resource ARNs in one request`, + }) + } + for (const arn of arns) { + if (arn.length > 2048) { + ctx.addIssue({ + code: 'custom', + message: `Resource ARN "${arn.slice(0, 40)}..." cannot exceed 2048 characters`, + }) + } + } + }) + +export const iamContextEntrySchema = z.object({ + contextKeyName: z + .string() + .min(5, 'Context key name must be at least 5 characters (e.g., aws:SourceIp)') + .max(256, 'Context key name cannot exceed 256 characters'), + contextKeyValues: z + .array(z.string().min(1, 'Context key values cannot contain empty strings')) + .min(1, 'Provide at least one value for each context key') + .max(64, 'A context key cannot carry more than 64 values'), + contextKeyType: iamContextKeyTypeSchema, +}) + +export const iamContextEntriesSchema = z + .array(iamContextEntrySchema) + .max(64, 'Cannot supply more than 64 context entries in one simulation') + +/** The response slice every paginated IAM contract returns. */ +export const iamPaginationResponseShape = { + isTruncated: z.boolean(), + marker: z.string().nullable(), + count: z.number(), +} diff --git a/apps/sim/lib/api/contracts/tools/aws/iam-simulate-principal-policy.ts b/apps/sim/lib/api/contracts/tools/aws/iam-simulate-principal-policy.ts index 0a1edd1d0d0..aff736b0bb1 100644 --- a/apps/sim/lib/api/contracts/tools/aws/iam-simulate-principal-policy.ts +++ b/apps/sim/lib/api/contracts/tools/aws/iam-simulate-principal-policy.ts @@ -1,46 +1,62 @@ import { z } from 'zod' +import { + iamActionNamesSchema, + iamConnectionShape, + iamContextEntriesSchema, + iamMarkerSchema, + iamMaxItemsSchema, + iamPaginationResponseShape, + iamPolicySourceArnSchema, + iamResourceArnsSchema, +} from '@/lib/api/contracts/tools/aws/iam-shared' import type { ContractBody, ContractBodyInput, ContractJsonResponse, } from '@/lib/api/contracts/types' import { defineRouteContract } from '@/lib/api/contracts/types' -import { validateAwsRegion } from '@/lib/core/security/input-validation' const Schema = z.object({ - region: z - .string() - .min(1, 'AWS region is required') - .refine((v) => validateAwsRegion(v).isValid, { - message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', - }), - accessKeyId: z.string().min(1, 'AWS access key ID is required'), - secretAccessKey: z.string().min(1, 'AWS secret access key is required'), - policySourceArn: z.string().min(1, 'Policy source ARN is required'), - actionNames: z.string().min(1, 'Action names are required'), - resourceArns: z.string().optional().nullable(), - maxResults: z.number().int().min(1).max(1000).optional().nullable(), - marker: z.string().optional().nullable(), + ...iamConnectionShape, + policySourceArn: iamPolicySourceArnSchema, + actionNames: iamActionNamesSchema, + resourceArns: iamResourceArnsSchema.optional().nullable(), + contextEntries: iamContextEntriesSchema.optional().nullable(), + maxResults: iamMaxItemsSchema.optional().nullable(), + marker: iamMarkerSchema.optional().nullable(), +}) + +const MatchedStatementSchema = z.object({ + sourcePolicyId: z.string(), + sourcePolicyType: z.string(), +}) + +/** + * The decision for one concrete resource ARN. AWS returns a single evaluation result per + * action no matter how many resource ARNs were simulated, so per-ARN truth lives only + * here — and when concrete ARNs are supplied, so do the missing context values. + */ +const ResourceSpecificResultSchema = z.object({ + evalResourceName: z.string(), + evalResourceDecision: z.string(), + matchedStatements: z.array(MatchedStatementSchema), + missingContextValues: z.array(z.string()), + permissionsBoundaryAllowed: z.boolean().nullable(), +}) + +const EvaluationResultSchema = z.object({ + evalActionName: z.string(), + evalResourceName: z.string(), + evalDecision: z.string(), + matchedStatements: z.array(MatchedStatementSchema), + missingContextValues: z.array(z.string()), + permissionsBoundaryAllowed: z.boolean().nullable(), + resourceSpecificResults: z.array(ResourceSpecificResultSchema), }) const SimulatePrincipalPolicyResponseSchema = z.object({ - evaluationResults: z.array( - z.object({ - evalActionName: z.string(), - evalResourceName: z.string(), - evalDecision: z.string(), - matchedStatements: z.array( - z.object({ - sourcePolicyId: z.string(), - sourcePolicyType: z.string(), - }) - ), - missingContextValues: z.array(z.string()), - }) - ), - isTruncated: z.boolean(), - marker: z.string().nullable(), - count: z.number(), + evaluationResults: z.array(EvaluationResultSchema), + ...iamPaginationResponseShape, }) export const awsIamSimulatePrincipalPolicyContract = defineRouteContract({ diff --git a/apps/sim/lib/api/contracts/tools/aws/iam-update-access-key.ts b/apps/sim/lib/api/contracts/tools/aws/iam-update-access-key.ts new file mode 100644 index 00000000000..aa83d72e85f --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/iam-update-access-key.ts @@ -0,0 +1,32 @@ +import { z } from 'zod' +import { + iamAccessKeyIdentifierSchema, + iamAccessKeyStatusSchema, + iamConnectionShape, + iamUserName128Schema, +} from '@/lib/api/contracts/tools/aws/iam-shared' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' + +const Schema = z.object({ + ...iamConnectionShape, + accessKeyIdToUpdate: iamAccessKeyIdentifierSchema, + status: iamAccessKeyStatusSchema, + userName: iamUserName128Schema.optional().nullable(), +}) + +export const awsIamUpdateAccessKeyContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/iam/update-access-key', + body: Schema, + response: { mode: 'json', schema: z.object({ message: z.string() }) }, +}) +export type AwsIamUpdateAccessKeyRequest = ContractBodyInput +export type AwsIamUpdateAccessKeyBody = ContractBody +export type AwsIamUpdateAccessKeyResponse = ContractJsonResponse< + typeof awsIamUpdateAccessKeyContract +> diff --git a/apps/sim/lib/api/contracts/tools/aws/identity-center-check-assignment-deletion-status.ts b/apps/sim/lib/api/contracts/tools/aws/identity-center-check-assignment-deletion-status.ts index 15c0b61ff5d..5dc2f54d65e 100644 --- a/apps/sim/lib/api/contracts/tools/aws/identity-center-check-assignment-deletion-status.ts +++ b/apps/sim/lib/api/contracts/tools/aws/identity-center-check-assignment-deletion-status.ts @@ -1,42 +1,28 @@ import { z } from 'zod' +import { + identityCenterAssignmentStatusResponseSchema, + identityCenterConnectionShape, + identityCenterInstanceArnSchema, + identityCenterRequestIdSchema, +} from '@/lib/api/contracts/tools/aws/identity-center-shared' import type { ContractBody, ContractBodyInput, ContractJsonResponse, } from '@/lib/api/contracts/types' import { defineRouteContract } from '@/lib/api/contracts/types' -import { validateAwsRegion } from '@/lib/core/security/input-validation' const Schema = z.object({ - region: z - .string() - .min(1, 'AWS region is required') - .refine((v) => validateAwsRegion(v).isValid, { - message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', - }), - accessKeyId: z.string().min(1, 'AWS access key ID is required'), - secretAccessKey: z.string().min(1, 'AWS secret access key is required'), - instanceArn: z.string().min(1, 'Instance ARN is required'), - requestId: z.string().min(1, 'Request ID is required'), -}) - -const ResponseSchema = z.object({ - message: z.string(), - status: z.string(), - requestId: z.string(), - accountId: z.string().nullable(), - permissionSetArn: z.string().nullable(), - principalType: z.string().nullable(), - principalId: z.string().nullable(), - failureReason: z.string().nullable(), - createdDate: z.string().nullable(), + ...identityCenterConnectionShape, + instanceArn: identityCenterInstanceArnSchema, + requestId: identityCenterRequestIdSchema, }) export const awsIdentityCenterCheckAssignmentDeletionStatusContract = defineRouteContract({ method: 'POST', path: '/api/tools/identity-center/check-assignment-deletion-status', body: Schema, - response: { mode: 'json', schema: ResponseSchema }, + response: { mode: 'json', schema: identityCenterAssignmentStatusResponseSchema }, }) export type AwsIdentityCenterCheckAssignmentDeletionStatusRequest = ContractBodyInput< typeof awsIdentityCenterCheckAssignmentDeletionStatusContract diff --git a/apps/sim/lib/api/contracts/tools/aws/identity-center-check-assignment-status.ts b/apps/sim/lib/api/contracts/tools/aws/identity-center-check-assignment-status.ts index d2108e1a949..f591ccef8d9 100644 --- a/apps/sim/lib/api/contracts/tools/aws/identity-center-check-assignment-status.ts +++ b/apps/sim/lib/api/contracts/tools/aws/identity-center-check-assignment-status.ts @@ -1,42 +1,28 @@ import { z } from 'zod' +import { + identityCenterAssignmentStatusResponseSchema, + identityCenterConnectionShape, + identityCenterInstanceArnSchema, + identityCenterRequestIdSchema, +} from '@/lib/api/contracts/tools/aws/identity-center-shared' import type { ContractBody, ContractBodyInput, ContractJsonResponse, } from '@/lib/api/contracts/types' import { defineRouteContract } from '@/lib/api/contracts/types' -import { validateAwsRegion } from '@/lib/core/security/input-validation' const Schema = z.object({ - region: z - .string() - .min(1, 'AWS region is required') - .refine((v) => validateAwsRegion(v).isValid, { - message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', - }), - accessKeyId: z.string().min(1, 'AWS access key ID is required'), - secretAccessKey: z.string().min(1, 'AWS secret access key is required'), - instanceArn: z.string().min(1, 'Instance ARN is required'), - requestId: z.string().min(1, 'Request ID is required'), -}) - -const ResponseSchema = z.object({ - message: z.string(), - status: z.string(), - requestId: z.string(), - accountId: z.string().nullable(), - permissionSetArn: z.string().nullable(), - principalType: z.string().nullable(), - principalId: z.string().nullable(), - failureReason: z.string().nullable(), - createdDate: z.string().nullable(), + ...identityCenterConnectionShape, + instanceArn: identityCenterInstanceArnSchema, + requestId: identityCenterRequestIdSchema, }) export const awsIdentityCenterCheckAssignmentStatusContract = defineRouteContract({ method: 'POST', path: '/api/tools/identity-center/check-assignment-status', body: Schema, - response: { mode: 'json', schema: ResponseSchema }, + response: { mode: 'json', schema: identityCenterAssignmentStatusResponseSchema }, }) export type AwsIdentityCenterCheckAssignmentStatusRequest = ContractBodyInput< typeof awsIdentityCenterCheckAssignmentStatusContract diff --git a/apps/sim/lib/api/contracts/tools/aws/identity-center-create-account-assignment.ts b/apps/sim/lib/api/contracts/tools/aws/identity-center-create-account-assignment.ts index 04279dc2c6d..ffc20a716b8 100644 --- a/apps/sim/lib/api/contracts/tools/aws/identity-center-create-account-assignment.ts +++ b/apps/sim/lib/api/contracts/tools/aws/identity-center-create-account-assignment.ts @@ -1,45 +1,34 @@ import { z } from 'zod' +import { + identityCenterAccountIdSchema, + identityCenterAssignmentStatusResponseSchema, + identityCenterConnectionShape, + identityCenterInstanceArnSchema, + identityCenterPermissionSetArnSchema, + identityCenterPrincipalIdSchema, + identityCenterPrincipalTypeSchema, +} from '@/lib/api/contracts/tools/aws/identity-center-shared' import type { ContractBody, ContractBodyInput, ContractJsonResponse, } from '@/lib/api/contracts/types' import { defineRouteContract } from '@/lib/api/contracts/types' -import { validateAwsRegion } from '@/lib/core/security/input-validation' const Schema = z.object({ - region: z - .string() - .min(1, 'AWS region is required') - .refine((v) => validateAwsRegion(v).isValid, { - message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', - }), - accessKeyId: z.string().min(1, 'AWS access key ID is required'), - secretAccessKey: z.string().min(1, 'AWS secret access key is required'), - instanceArn: z.string().min(1, 'Instance ARN is required'), - accountId: z.string().min(1, 'Account ID is required'), - permissionSetArn: z.string().min(1, 'Permission set ARN is required'), - principalType: z.enum(['USER', 'GROUP']), - principalId: z.string().min(1, 'Principal ID is required'), -}) - -const ResponseSchema = z.object({ - message: z.string(), - status: z.string(), - requestId: z.string(), - accountId: z.string().nullable(), - permissionSetArn: z.string().nullable(), - principalType: z.string().nullable(), - principalId: z.string().nullable(), - failureReason: z.string().nullable(), - createdDate: z.string().nullable(), + ...identityCenterConnectionShape, + instanceArn: identityCenterInstanceArnSchema, + accountId: identityCenterAccountIdSchema, + permissionSetArn: identityCenterPermissionSetArnSchema, + principalType: identityCenterPrincipalTypeSchema, + principalId: identityCenterPrincipalIdSchema, }) export const awsIdentityCenterCreateAccountAssignmentContract = defineRouteContract({ method: 'POST', path: '/api/tools/identity-center/create-account-assignment', body: Schema, - response: { mode: 'json', schema: ResponseSchema }, + response: { mode: 'json', schema: identityCenterAssignmentStatusResponseSchema }, }) export type AwsIdentityCenterCreateAccountAssignmentRequest = ContractBodyInput< typeof awsIdentityCenterCreateAccountAssignmentContract diff --git a/apps/sim/lib/api/contracts/tools/aws/identity-center-delete-account-assignment.ts b/apps/sim/lib/api/contracts/tools/aws/identity-center-delete-account-assignment.ts index 97af0baf98b..7c0b9e5a46a 100644 --- a/apps/sim/lib/api/contracts/tools/aws/identity-center-delete-account-assignment.ts +++ b/apps/sim/lib/api/contracts/tools/aws/identity-center-delete-account-assignment.ts @@ -1,45 +1,34 @@ import { z } from 'zod' +import { + identityCenterAccountIdSchema, + identityCenterAssignmentStatusResponseSchema, + identityCenterConnectionShape, + identityCenterInstanceArnSchema, + identityCenterPermissionSetArnSchema, + identityCenterPrincipalIdSchema, + identityCenterPrincipalTypeSchema, +} from '@/lib/api/contracts/tools/aws/identity-center-shared' import type { ContractBody, ContractBodyInput, ContractJsonResponse, } from '@/lib/api/contracts/types' import { defineRouteContract } from '@/lib/api/contracts/types' -import { validateAwsRegion } from '@/lib/core/security/input-validation' const Schema = z.object({ - region: z - .string() - .min(1, 'AWS region is required') - .refine((v) => validateAwsRegion(v).isValid, { - message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', - }), - accessKeyId: z.string().min(1, 'AWS access key ID is required'), - secretAccessKey: z.string().min(1, 'AWS secret access key is required'), - instanceArn: z.string().min(1, 'Instance ARN is required'), - accountId: z.string().min(1, 'Account ID is required'), - permissionSetArn: z.string().min(1, 'Permission set ARN is required'), - principalType: z.enum(['USER', 'GROUP']), - principalId: z.string().min(1, 'Principal ID is required'), -}) - -const ResponseSchema = z.object({ - message: z.string(), - status: z.string(), - requestId: z.string(), - accountId: z.string().nullable(), - permissionSetArn: z.string().nullable(), - principalType: z.string().nullable(), - principalId: z.string().nullable(), - failureReason: z.string().nullable(), - createdDate: z.string().nullable(), + ...identityCenterConnectionShape, + instanceArn: identityCenterInstanceArnSchema, + accountId: identityCenterAccountIdSchema, + permissionSetArn: identityCenterPermissionSetArnSchema, + principalType: identityCenterPrincipalTypeSchema, + principalId: identityCenterPrincipalIdSchema, }) export const awsIdentityCenterDeleteAccountAssignmentContract = defineRouteContract({ method: 'POST', path: '/api/tools/identity-center/delete-account-assignment', body: Schema, - response: { mode: 'json', schema: ResponseSchema }, + response: { mode: 'json', schema: identityCenterAssignmentStatusResponseSchema }, }) export type AwsIdentityCenterDeleteAccountAssignmentRequest = ContractBodyInput< typeof awsIdentityCenterDeleteAccountAssignmentContract diff --git a/apps/sim/lib/api/contracts/tools/aws/identity-center-describe-account.ts b/apps/sim/lib/api/contracts/tools/aws/identity-center-describe-account.ts index 361a2ae4acf..061d80d9488 100644 --- a/apps/sim/lib/api/contracts/tools/aws/identity-center-describe-account.ts +++ b/apps/sim/lib/api/contracts/tools/aws/identity-center-describe-account.ts @@ -1,22 +1,18 @@ import { z } from 'zod' +import { + identityCenterAccountIdSchema, + identityCenterConnectionShape, +} from '@/lib/api/contracts/tools/aws/identity-center-shared' import type { ContractBody, ContractBodyInput, ContractJsonResponse, } from '@/lib/api/contracts/types' import { defineRouteContract } from '@/lib/api/contracts/types' -import { validateAwsRegion } from '@/lib/core/security/input-validation' const Schema = z.object({ - region: z - .string() - .min(1, 'AWS region is required') - .refine((v) => validateAwsRegion(v).isValid, { - message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', - }), - accessKeyId: z.string().min(1, 'AWS access key ID is required'), - secretAccessKey: z.string().min(1, 'AWS secret access key is required'), - accountId: z.string().min(12, 'Account ID must be 12 digits').max(12), + ...identityCenterConnectionShape, + accountId: identityCenterAccountIdSchema, }) const ResponseSchema = z.object({ diff --git a/apps/sim/lib/api/contracts/tools/aws/identity-center-describe-group.ts b/apps/sim/lib/api/contracts/tools/aws/identity-center-describe-group.ts new file mode 100644 index 00000000000..0e837743ff9 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/identity-center-describe-group.ts @@ -0,0 +1,41 @@ +import { z } from 'zod' +import { + identityCenterConnectionShape, + identityCenterGroupIdSchema, + identityCenterIdentityStoreIdSchema, +} from '@/lib/api/contracts/tools/aws/identity-center-shared' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' + +const Schema = z.object({ + ...identityCenterConnectionShape, + identityStoreId: identityCenterIdentityStoreIdSchema, + groupId: identityCenterGroupIdSchema, +}) + +const ResponseSchema = z.object({ + groupId: z.string(), + displayName: z.string().nullable(), + description: z.string().nullable(), + externalIds: z.array(z.object({ issuer: z.string(), id: z.string() })), +}) + +export const awsIdentityCenterDescribeGroupContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/identity-center/describe-group', + body: Schema, + response: { mode: 'json', schema: ResponseSchema }, +}) +export type AwsIdentityCenterDescribeGroupRequest = ContractBodyInput< + typeof awsIdentityCenterDescribeGroupContract +> +export type AwsIdentityCenterDescribeGroupBody = ContractBody< + typeof awsIdentityCenterDescribeGroupContract +> +export type AwsIdentityCenterDescribeGroupResponse = ContractJsonResponse< + typeof awsIdentityCenterDescribeGroupContract +> diff --git a/apps/sim/lib/api/contracts/tools/aws/identity-center-describe-user.ts b/apps/sim/lib/api/contracts/tools/aws/identity-center-describe-user.ts new file mode 100644 index 00000000000..66915a7dbc5 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/identity-center-describe-user.ts @@ -0,0 +1,44 @@ +import { z } from 'zod' +import { + identityCenterConnectionShape, + identityCenterIdentityStoreIdSchema, + identityCenterUserIdSchema, +} from '@/lib/api/contracts/tools/aws/identity-center-shared' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' + +const Schema = z.object({ + ...identityCenterConnectionShape, + identityStoreId: identityCenterIdentityStoreIdSchema, + userId: identityCenterUserIdSchema, +}) + +const ResponseSchema = z.object({ + userId: z.string(), + userName: z.string(), + displayName: z.string().nullable(), + email: z.string().nullable(), + userStatus: z.string().nullable(), + title: z.string().nullable(), + externalIds: z.array(z.object({ issuer: z.string(), id: z.string() })), +}) + +export const awsIdentityCenterDescribeUserContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/identity-center/describe-user', + body: Schema, + response: { mode: 'json', schema: ResponseSchema }, +}) +export type AwsIdentityCenterDescribeUserRequest = ContractBodyInput< + typeof awsIdentityCenterDescribeUserContract +> +export type AwsIdentityCenterDescribeUserBody = ContractBody< + typeof awsIdentityCenterDescribeUserContract +> +export type AwsIdentityCenterDescribeUserResponse = ContractJsonResponse< + typeof awsIdentityCenterDescribeUserContract +> diff --git a/apps/sim/lib/api/contracts/tools/aws/identity-center-get-group.ts b/apps/sim/lib/api/contracts/tools/aws/identity-center-get-group.ts index 8eb385ee922..a4caa36bc6d 100644 --- a/apps/sim/lib/api/contracts/tools/aws/identity-center-get-group.ts +++ b/apps/sim/lib/api/contracts/tools/aws/identity-center-get-group.ts @@ -1,23 +1,19 @@ import { z } from 'zod' +import { + identityCenterConnectionShape, + identityCenterIdentityStoreIdSchema, +} from '@/lib/api/contracts/tools/aws/identity-center-shared' import type { ContractBody, ContractBodyInput, ContractJsonResponse, } from '@/lib/api/contracts/types' import { defineRouteContract } from '@/lib/api/contracts/types' -import { validateAwsRegion } from '@/lib/core/security/input-validation' const Schema = z.object({ - region: z - .string() - .min(1, 'AWS region is required') - .refine((v) => validateAwsRegion(v).isValid, { - message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', - }), - accessKeyId: z.string().min(1, 'AWS access key ID is required'), - secretAccessKey: z.string().min(1, 'AWS secret access key is required'), - identityStoreId: z.string().min(1, 'Identity Store ID is required'), - displayName: z.string().min(1, 'Group display name is required'), + ...identityCenterConnectionShape, + identityStoreId: identityCenterIdentityStoreIdSchema, + displayName: z.string().min(1, 'Group display name is required').max(1024), }) const ResponseSchema = z.object({ diff --git a/apps/sim/lib/api/contracts/tools/aws/identity-center-get-user.ts b/apps/sim/lib/api/contracts/tools/aws/identity-center-get-user.ts index 61f12c7b3aa..8ed5810ef28 100644 --- a/apps/sim/lib/api/contracts/tools/aws/identity-center-get-user.ts +++ b/apps/sim/lib/api/contracts/tools/aws/identity-center-get-user.ts @@ -1,22 +1,18 @@ import { z } from 'zod' +import { + identityCenterConnectionShape, + identityCenterIdentityStoreIdSchema, +} from '@/lib/api/contracts/tools/aws/identity-center-shared' import type { ContractBody, ContractBodyInput, ContractJsonResponse, } from '@/lib/api/contracts/types' import { defineRouteContract } from '@/lib/api/contracts/types' -import { validateAwsRegion } from '@/lib/core/security/input-validation' const Schema = z.object({ - region: z - .string() - .min(1, 'AWS region is required') - .refine((v) => validateAwsRegion(v).isValid, { - message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', - }), - accessKeyId: z.string().min(1, 'AWS access key ID is required'), - secretAccessKey: z.string().min(1, 'AWS secret access key is required'), - identityStoreId: z.string().min(1, 'Identity Store ID is required'), + ...identityCenterConnectionShape, + identityStoreId: identityCenterIdentityStoreIdSchema, email: z.string().email('Valid email address is required'), }) diff --git a/apps/sim/lib/api/contracts/tools/aws/identity-center-list-account-assignments.ts b/apps/sim/lib/api/contracts/tools/aws/identity-center-list-account-assignments.ts index f16cd2598c1..a1c19b2cf47 100644 --- a/apps/sim/lib/api/contracts/tools/aws/identity-center-list-account-assignments.ts +++ b/apps/sim/lib/api/contracts/tools/aws/identity-center-list-account-assignments.ts @@ -1,26 +1,26 @@ import { z } from 'zod' +import { + identityCenterConnectionShape, + identityCenterInstanceArnSchema, + identityCenterMaxResultsSchema, + identityCenterNextTokenSchema, + identityCenterPrincipalIdSchema, + identityCenterPrincipalTypeSchema, +} from '@/lib/api/contracts/tools/aws/identity-center-shared' import type { ContractBody, ContractBodyInput, ContractJsonResponse, } from '@/lib/api/contracts/types' import { defineRouteContract } from '@/lib/api/contracts/types' -import { validateAwsRegion } from '@/lib/core/security/input-validation' const Schema = z.object({ - region: z - .string() - .min(1, 'AWS region is required') - .refine((v) => validateAwsRegion(v).isValid, { - message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', - }), - accessKeyId: z.string().min(1, 'AWS access key ID is required'), - secretAccessKey: z.string().min(1, 'AWS secret access key is required'), - instanceArn: z.string().min(1, 'Instance ARN is required'), - principalId: z.string().min(1, 'Principal ID is required'), - principalType: z.enum(['USER', 'GROUP']), - maxResults: z.number().min(1).max(100).optional(), - nextToken: z.string().optional(), + ...identityCenterConnectionShape, + instanceArn: identityCenterInstanceArnSchema, + principalId: identityCenterPrincipalIdSchema, + principalType: identityCenterPrincipalTypeSchema, + maxResults: identityCenterMaxResultsSchema.optional(), + nextToken: identityCenterNextTokenSchema.optional(), }) const ResponseSchema = z.object({ diff --git a/apps/sim/lib/api/contracts/tools/aws/identity-center-list-accounts.test.ts b/apps/sim/lib/api/contracts/tools/aws/identity-center-list-accounts.test.ts new file mode 100644 index 00000000000..b4ab3417798 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/identity-center-list-accounts.test.ts @@ -0,0 +1,48 @@ +/** + * @vitest-environment node + */ +import { describe, expect, it } from 'vitest' +import { awsIdentityCenterListAccountsContract } from '@/lib/api/contracts/tools/aws/identity-center-list-accounts' +import { awsIdentityCenterListAssignmentsForAccountContract } from '@/lib/api/contracts/tools/aws/identity-center-list-assignments-for-account' + +const connection = { + region: 'us-east-1', + accessKeyId: 'AKIAEXAMPLE', + secretAccessKey: 'secret', +} + +/** + * Organizations documents a 100,000-character maximum for the `ListAccounts` + * continuation token, well past the Identity Store bound the rest of the family + * shares. + * + * @see https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListAccounts.html + */ +describe('identity center list-accounts nextToken bound', () => { + it('accepts an Organizations token longer than the Identity Store bound', () => { + const parsed = awsIdentityCenterListAccountsContract.body?.safeParse({ + ...connection, + nextToken: 'a'.repeat(100_000), + }) + expect(parsed?.success).toBe(true) + }) + + it('still rejects a token past the documented Organizations maximum', () => { + const parsed = awsIdentityCenterListAccountsContract.body?.safeParse({ + ...connection, + nextToken: 'a'.repeat(100_001), + }) + expect(parsed?.success).toBe(false) + }) + + it('leaves the SSO Admin token bound where it was', () => { + const parsed = awsIdentityCenterListAssignmentsForAccountContract.body?.safeParse({ + ...connection, + instanceArn: 'arn:aws:sso:::instance/ssoins-0123456789abcdef', + accountId: '111111111111', + permissionSetArn: 'arn:aws:sso:::permissionSet/ssoins-0123456789abcdef/ps-0123456789abcdef', + nextToken: 'a'.repeat(100_000), + }) + expect(parsed?.success).toBe(false) + }) +}) diff --git a/apps/sim/lib/api/contracts/tools/aws/identity-center-list-accounts.ts b/apps/sim/lib/api/contracts/tools/aws/identity-center-list-accounts.ts index cbb981266c5..b18abce3939 100644 --- a/apps/sim/lib/api/contracts/tools/aws/identity-center-list-accounts.ts +++ b/apps/sim/lib/api/contracts/tools/aws/identity-center-list-accounts.ts @@ -1,23 +1,20 @@ import { z } from 'zod' +import { + identityCenterAccountsMaxResultsSchema, + identityCenterConnectionShape, + identityCenterOrganizationsNextTokenSchema, +} from '@/lib/api/contracts/tools/aws/identity-center-shared' import type { ContractBody, ContractBodyInput, ContractJsonResponse, } from '@/lib/api/contracts/types' import { defineRouteContract } from '@/lib/api/contracts/types' -import { validateAwsRegion } from '@/lib/core/security/input-validation' const Schema = z.object({ - region: z - .string() - .min(1, 'AWS region is required') - .refine((v) => validateAwsRegion(v).isValid, { - message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', - }), - accessKeyId: z.string().min(1, 'AWS access key ID is required'), - secretAccessKey: z.string().min(1, 'AWS secret access key is required'), - maxResults: z.number().min(1).max(20).optional(), - nextToken: z.string().optional(), + ...identityCenterConnectionShape, + maxResults: identityCenterAccountsMaxResultsSchema.optional(), + nextToken: identityCenterOrganizationsNextTokenSchema.optional(), }) const ResponseSchema = z.object({ diff --git a/apps/sim/lib/api/contracts/tools/aws/identity-center-list-assignments-for-account.ts b/apps/sim/lib/api/contracts/tools/aws/identity-center-list-assignments-for-account.ts new file mode 100644 index 00000000000..82285a54ae3 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/identity-center-list-assignments-for-account.ts @@ -0,0 +1,53 @@ +import { z } from 'zod' +import { + identityCenterAccountIdSchema, + identityCenterConnectionShape, + identityCenterInstanceArnSchema, + identityCenterMaxResultsSchema, + identityCenterNextTokenSchema, + identityCenterPermissionSetArnSchema, +} from '@/lib/api/contracts/tools/aws/identity-center-shared' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' + +const Schema = z.object({ + ...identityCenterConnectionShape, + instanceArn: identityCenterInstanceArnSchema, + accountId: identityCenterAccountIdSchema, + permissionSetArn: identityCenterPermissionSetArnSchema, + maxResults: identityCenterMaxResultsSchema.optional(), + nextToken: identityCenterNextTokenSchema.optional(), +}) + +const ResponseSchema = z.object({ + assignments: z.array( + z.object({ + accountId: z.string(), + permissionSetArn: z.string(), + principalType: z.string(), + principalId: z.string(), + }) + ), + nextToken: z.string().nullable(), + count: z.number(), +}) + +export const awsIdentityCenterListAssignmentsForAccountContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/identity-center/list-assignments-for-account', + body: Schema, + response: { mode: 'json', schema: ResponseSchema }, +}) +export type AwsIdentityCenterListAssignmentsForAccountRequest = ContractBodyInput< + typeof awsIdentityCenterListAssignmentsForAccountContract +> +export type AwsIdentityCenterListAssignmentsForAccountBody = ContractBody< + typeof awsIdentityCenterListAssignmentsForAccountContract +> +export type AwsIdentityCenterListAssignmentsForAccountResponse = ContractJsonResponse< + typeof awsIdentityCenterListAssignmentsForAccountContract +> diff --git a/apps/sim/lib/api/contracts/tools/aws/identity-center-list-group-memberships.ts b/apps/sim/lib/api/contracts/tools/aws/identity-center-list-group-memberships.ts new file mode 100644 index 00000000000..5af0fb0715f --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/identity-center-list-group-memberships.ts @@ -0,0 +1,50 @@ +import { z } from 'zod' +import { + identityCenterConnectionShape, + identityCenterGroupIdSchema, + identityCenterIdentityStoreIdSchema, + identityCenterMaxResultsSchema, + identityCenterNextTokenSchema, +} from '@/lib/api/contracts/tools/aws/identity-center-shared' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' + +const Schema = z.object({ + ...identityCenterConnectionShape, + identityStoreId: identityCenterIdentityStoreIdSchema, + groupId: identityCenterGroupIdSchema, + maxResults: identityCenterMaxResultsSchema.optional(), + nextToken: identityCenterNextTokenSchema.optional(), +}) + +const ResponseSchema = z.object({ + memberships: z.array( + z.object({ + membershipId: z.string(), + groupId: z.string(), + userId: z.string().nullable(), + }) + ), + nextToken: z.string().nullable(), + count: z.number(), +}) + +export const awsIdentityCenterListGroupMembershipsContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/identity-center/list-group-memberships', + body: Schema, + response: { mode: 'json', schema: ResponseSchema }, +}) +export type AwsIdentityCenterListGroupMembershipsRequest = ContractBodyInput< + typeof awsIdentityCenterListGroupMembershipsContract +> +export type AwsIdentityCenterListGroupMembershipsBody = ContractBody< + typeof awsIdentityCenterListGroupMembershipsContract +> +export type AwsIdentityCenterListGroupMembershipsResponse = ContractJsonResponse< + typeof awsIdentityCenterListGroupMembershipsContract +> diff --git a/apps/sim/lib/api/contracts/tools/aws/identity-center-list-groups.ts b/apps/sim/lib/api/contracts/tools/aws/identity-center-list-groups.ts index ae147dc8ddf..e7c61aa5233 100644 --- a/apps/sim/lib/api/contracts/tools/aws/identity-center-list-groups.ts +++ b/apps/sim/lib/api/contracts/tools/aws/identity-center-list-groups.ts @@ -1,24 +1,22 @@ import { z } from 'zod' +import { + identityCenterConnectionShape, + identityCenterIdentityStoreIdSchema, + identityCenterMaxResultsSchema, + identityCenterNextTokenSchema, +} from '@/lib/api/contracts/tools/aws/identity-center-shared' import type { ContractBody, ContractBodyInput, ContractJsonResponse, } from '@/lib/api/contracts/types' import { defineRouteContract } from '@/lib/api/contracts/types' -import { validateAwsRegion } from '@/lib/core/security/input-validation' const Schema = z.object({ - region: z - .string() - .min(1, 'AWS region is required') - .refine((v) => validateAwsRegion(v).isValid, { - message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', - }), - accessKeyId: z.string().min(1, 'AWS access key ID is required'), - secretAccessKey: z.string().min(1, 'AWS secret access key is required'), - identityStoreId: z.string().min(1, 'Identity Store ID is required'), - maxResults: z.number().min(1).max(100).optional(), - nextToken: z.string().optional(), + ...identityCenterConnectionShape, + identityStoreId: identityCenterIdentityStoreIdSchema, + maxResults: identityCenterMaxResultsSchema.optional(), + nextToken: identityCenterNextTokenSchema.optional(), }) const ResponseSchema = z.object({ diff --git a/apps/sim/lib/api/contracts/tools/aws/identity-center-list-instances.ts b/apps/sim/lib/api/contracts/tools/aws/identity-center-list-instances.ts index bfeb996a4ea..2c679932a47 100644 --- a/apps/sim/lib/api/contracts/tools/aws/identity-center-list-instances.ts +++ b/apps/sim/lib/api/contracts/tools/aws/identity-center-list-instances.ts @@ -1,23 +1,20 @@ import { z } from 'zod' +import { + identityCenterConnectionShape, + identityCenterMaxResultsSchema, + identityCenterNextTokenSchema, +} from '@/lib/api/contracts/tools/aws/identity-center-shared' import type { ContractBody, ContractBodyInput, ContractJsonResponse, } from '@/lib/api/contracts/types' import { defineRouteContract } from '@/lib/api/contracts/types' -import { validateAwsRegion } from '@/lib/core/security/input-validation' const Schema = z.object({ - region: z - .string() - .min(1, 'AWS region is required') - .refine((v) => validateAwsRegion(v).isValid, { - message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', - }), - accessKeyId: z.string().min(1, 'AWS access key ID is required'), - secretAccessKey: z.string().min(1, 'AWS secret access key is required'), - maxResults: z.number().min(1).max(100).optional(), - nextToken: z.string().optional(), + ...identityCenterConnectionShape, + maxResults: identityCenterMaxResultsSchema.optional(), + nextToken: identityCenterNextTokenSchema.optional(), }) const ResponseSchema = z.object({ diff --git a/apps/sim/lib/api/contracts/tools/aws/identity-center-list-permission-sets.ts b/apps/sim/lib/api/contracts/tools/aws/identity-center-list-permission-sets.ts index 10788fa49ca..1d978e70bc4 100644 --- a/apps/sim/lib/api/contracts/tools/aws/identity-center-list-permission-sets.ts +++ b/apps/sim/lib/api/contracts/tools/aws/identity-center-list-permission-sets.ts @@ -1,24 +1,22 @@ import { z } from 'zod' +import { + identityCenterConnectionShape, + identityCenterInstanceArnSchema, + identityCenterMaxResultsSchema, + identityCenterNextTokenSchema, +} from '@/lib/api/contracts/tools/aws/identity-center-shared' import type { ContractBody, ContractBodyInput, ContractJsonResponse, } from '@/lib/api/contracts/types' import { defineRouteContract } from '@/lib/api/contracts/types' -import { validateAwsRegion } from '@/lib/core/security/input-validation' const Schema = z.object({ - region: z - .string() - .min(1, 'AWS region is required') - .refine((v) => validateAwsRegion(v).isValid, { - message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', - }), - accessKeyId: z.string().min(1, 'AWS access key ID is required'), - secretAccessKey: z.string().min(1, 'AWS secret access key is required'), - instanceArn: z.string().min(1, 'Instance ARN is required'), - maxResults: z.number().min(1).max(100).optional(), - nextToken: z.string().optional(), + ...identityCenterConnectionShape, + instanceArn: identityCenterInstanceArnSchema, + maxResults: identityCenterMaxResultsSchema.optional(), + nextToken: identityCenterNextTokenSchema.optional(), }) const ResponseSchema = z.object({ diff --git a/apps/sim/lib/api/contracts/tools/aws/identity-center-shared.ts b/apps/sim/lib/api/contracts/tools/aws/identity-center-shared.ts new file mode 100644 index 00000000000..5cda71392ea --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/identity-center-shared.ts @@ -0,0 +1,148 @@ +import { z } from 'zod' +import { validateAwsRegion } from '@/lib/core/security/input-validation' + +/** + * Shared boundary schemas for the AWS IAM Identity Center tool family. + * + * Every pattern and bound below is the one AWS publishes for the shape, so a + * malformed identifier is rejected at the boundary with a readable message + * instead of surfacing as an opaque AWS `ValidationException`. + */ + +export const identityCenterRegionSchema = z + .string() + .min(1, 'AWS region is required') + .refine((value) => validateAwsRegion(value).isValid, { + message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2, us-gov-west-1)', + }) + +/** Region plus static credentials, present on every tool in the family. */ +export const identityCenterConnectionShape = { + region: identityCenterRegionSchema, + accessKeyId: z.string().min(1, 'AWS access key ID is required'), + secretAccessKey: z.string().min(1, 'AWS secret access key is required'), +} + +/** @see https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_ListAccountAssignments.html */ +export const identityCenterInstanceArnSchema = z + .string() + .min(10, 'Instance ARN is required') + .max(1224, 'Instance ARN must be at most 1224 characters') + .regex( + /^arn:aws(-[a-z]{1,5}){0,3}:sso:::instance\/(sso)?ins-[a-zA-Z0-9-.]{16}$/, + 'Instance ARN must look like arn:aws:sso:::instance/ssoins-0123456789abcdef' + ) + +/** @see https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_AccountAssignment.html */ +export const identityCenterPermissionSetArnSchema = z + .string() + .min(10, 'Permission set ARN is required') + .max(1224, 'Permission set ARN must be at most 1224 characters') + .regex( + /^arn:aws(-[a-z]{1,5}){0,3}:sso:::permissionSet\/(sso)?ins-[a-zA-Z0-9-.]{16}\/ps-[a-zA-Z0-9-./]{16}$/, + 'Permission set ARN must look like arn:aws:sso:::permissionSet/ssoins-0123456789abcdef/ps-0123456789abcdef' + ) + +/** + * Identity Store user or group id, as accepted by SSO Admin `PrincipalId` and + * by Identity Store `UserId` / `GroupId`. + * + * @see https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_AccountAssignment.html + */ +const identityStoreObjectIdPattern = + /^([0-9a-f]{10}-)?[A-Fa-f0-9]{8}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{12}$/ + +export const identityCenterPrincipalIdSchema = z + .string() + .min(1, 'Principal ID is required') + .max(47, 'Principal ID must be at most 47 characters') + .regex( + identityStoreObjectIdPattern, + 'Principal ID must be an Identity Store user or group ID (e.g., 9067b2d8-8021-70f8-1234-5c6d7e8f9012)' + ) + +export const identityCenterUserIdSchema = z + .string() + .min(1, 'User ID is required') + .max(47, 'User ID must be at most 47 characters') + .regex(identityStoreObjectIdPattern, 'User ID must be an Identity Store user ID') + +export const identityCenterGroupIdSchema = z + .string() + .min(1, 'Group ID is required') + .max(47, 'Group ID must be at most 47 characters') + .regex(identityStoreObjectIdPattern, 'Group ID must be an Identity Store group ID') + +/** + * Identity Store service id. Narrower than the SSO Admin `IdentityStoreId` + * shape — every tool in this family calls the Identity Store API with it. + * + * @see https://docs.aws.amazon.com/singlesignon/latest/IdentityStoreAPIReference/API_DescribeUser.html + */ +export const identityCenterIdentityStoreIdSchema = z + .string() + .min(1, 'Identity Store ID is required') + .max(36, 'Identity Store ID must be at most 36 characters') + .regex( + /^(d-[0-9a-f]{10}|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/, + 'Identity Store ID must look like d-1234567890' + ) + +/** @see https://docs.aws.amazon.com/singlesignon/latest/APIReference/API_DescribeAccountAssignmentCreationStatus.html */ +export const identityCenterRequestIdSchema = z + .string() + .length(36, 'Request ID must be a 36-character UUID') + .regex( + /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/, + 'Request ID must be a UUID returned by a create or delete assignment call' + ) + +/** @see https://docs.aws.amazon.com/organizations/latest/APIReference/API_Account.html */ +export const identityCenterAccountIdSchema = z + .string() + .regex(/^\d{12}$/, 'AWS account ID must be exactly 12 digits') + +export const identityCenterPrincipalTypeSchema = z.enum(['USER', 'GROUP']) + +export const identityCenterNextTokenSchema = z + .string() + .min(1, 'Pagination token cannot be empty') + .max(65535, 'Pagination token is too long') + +/** + * Organizations pagination tokens are documented far longer than the Identity + * Store bound above, so `ListAccounts` gets its own ceiling rather than sharing + * one that would reject a valid continuation token before AWS sees it. + * + * @see https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListAccounts.html + */ +export const identityCenterOrganizationsNextTokenSchema = z + .string() + .min(1, 'Pagination token cannot be empty') + .max(100000, 'Pagination token is too long') + +/** Every list operation in the family except Organizations `ListAccounts`. */ +export const identityCenterMaxResultsSchema = z + .number() + .int('Max results must be a whole number') + .min(1, 'Max results must be at least 1') + .max(100, 'Max results must be at most 100') + +/** @see https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListAccounts.html */ +export const identityCenterAccountsMaxResultsSchema = z + .number() + .int('Max results must be a whole number') + .min(1, 'Max results must be at least 1') + .max(20, 'AWS Organizations ListAccounts allows at most 20 results per page') + +export const identityCenterAssignmentStatusResponseSchema = z.object({ + message: z.string(), + status: z.string(), + requestId: z.string(), + accountId: z.string().nullable(), + permissionSetArn: z.string().nullable(), + principalType: z.string().nullable(), + principalId: z.string().nullable(), + failureReason: z.string().nullable(), + createdDate: z.string().nullable(), +}) diff --git a/apps/sim/lib/api/contracts/tools/aws/sqs-cancel-message-move-task.ts b/apps/sim/lib/api/contracts/tools/aws/sqs-cancel-message-move-task.ts new file mode 100644 index 00000000000..ffc1ccdbf9f --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/sqs-cancel-message-move-task.ts @@ -0,0 +1,34 @@ +import { z } from 'zod' +import { sqsConnectionFields } from '@/lib/api/contracts/tools/aws/sqs-shared' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' + +const CancelMessageMoveTaskSchema = z.object({ + ...sqsConnectionFields, + taskHandle: z.string().min(1, 'Task handle is required'), +}) + +const CancelMessageMoveTaskResponseSchema = z.object({ + message: z.string(), + approximateNumberOfMessagesMoved: z.number().nullable(), +}) + +export const awsSqsCancelMessageMoveTaskContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/sqs/cancel-message-move-task', + body: CancelMessageMoveTaskSchema, + response: { mode: 'json', schema: CancelMessageMoveTaskResponseSchema }, +}) +export type AwsSqsCancelMessageMoveTaskRequest = ContractBodyInput< + typeof awsSqsCancelMessageMoveTaskContract +> +export type AwsSqsCancelMessageMoveTaskBody = ContractBody< + typeof awsSqsCancelMessageMoveTaskContract +> +export type AwsSqsCancelMessageMoveTaskResponse = ContractJsonResponse< + typeof awsSqsCancelMessageMoveTaskContract +> diff --git a/apps/sim/lib/api/contracts/tools/aws/sqs-change-message-visibility-batch.ts b/apps/sim/lib/api/contracts/tools/aws/sqs-change-message-visibility-batch.ts new file mode 100644 index 00000000000..4976298913a --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/sqs-change-message-visibility-batch.ts @@ -0,0 +1,61 @@ +import { z } from 'zod' +import { + hasDistinctBatchEntryIds, + SQS_DISTINCT_BATCH_ENTRY_IDS_MESSAGE, + SQS_MAX_BATCH_ENTRIES, + sqsBatchEntryIdSchema, + sqsBatchResultErrorEntrySchema, + sqsConnectionFields, + sqsQueueUrlField, +} from '@/lib/api/contracts/tools/aws/sqs-shared' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' + +const ChangeMessageVisibilityBatchSchema = z.object({ + ...sqsConnectionFields, + queueUrl: sqsQueueUrlField, + entries: z + .array( + z.object({ + id: sqsBatchEntryIdSchema, + receiptHandle: z.string().min(1, 'Receipt handle is required'), + visibilityTimeout: z + .number() + .int() + .min(0, 'visibilityTimeout must be at least 0') + .max(43200, 'visibilityTimeout cannot exceed 43200 seconds (12 hours)') + .nullish(), + }) + ) + .min(1, 'At least one entry is required') + .max(SQS_MAX_BATCH_ENTRIES, `A batch can hold at most ${SQS_MAX_BATCH_ENTRIES} entries`) + .refine(hasDistinctBatchEntryIds, SQS_DISTINCT_BATCH_ENTRY_IDS_MESSAGE), +}) + +const ChangeMessageVisibilityBatchResponseSchema = z.object({ + message: z.string(), + successful: z.array(z.object({ id: z.string().nullable() })), + failed: z.array(sqsBatchResultErrorEntrySchema), + successCount: z.number(), + failureCount: z.number(), +}) + +export const awsSqsChangeMessageVisibilityBatchContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/sqs/change-message-visibility-batch', + body: ChangeMessageVisibilityBatchSchema, + response: { mode: 'json', schema: ChangeMessageVisibilityBatchResponseSchema }, +}) +export type AwsSqsChangeMessageVisibilityBatchRequest = ContractBodyInput< + typeof awsSqsChangeMessageVisibilityBatchContract +> +export type AwsSqsChangeMessageVisibilityBatchBody = ContractBody< + typeof awsSqsChangeMessageVisibilityBatchContract +> +export type AwsSqsChangeMessageVisibilityBatchResponse = ContractJsonResponse< + typeof awsSqsChangeMessageVisibilityBatchContract +> diff --git a/apps/sim/lib/api/contracts/tools/aws/sqs-change-message-visibility.ts b/apps/sim/lib/api/contracts/tools/aws/sqs-change-message-visibility.ts new file mode 100644 index 00000000000..c185a772808 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/sqs-change-message-visibility.ts @@ -0,0 +1,39 @@ +import { z } from 'zod' +import { sqsConnectionFields, sqsQueueUrlField } from '@/lib/api/contracts/tools/aws/sqs-shared' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' + +const ChangeMessageVisibilitySchema = z.object({ + ...sqsConnectionFields, + queueUrl: sqsQueueUrlField, + receiptHandle: z.string().min(1, 'Receipt handle is required'), + visibilityTimeout: z + .number() + .int() + .min(0, 'visibilityTimeout must be at least 0') + .max(43200, 'visibilityTimeout cannot exceed 43200 seconds (12 hours)'), +}) + +const ChangeMessageVisibilityResponseSchema = z.object({ + message: z.string(), +}) + +export const awsSqsChangeMessageVisibilityContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/sqs/change-message-visibility', + body: ChangeMessageVisibilitySchema, + response: { mode: 'json', schema: ChangeMessageVisibilityResponseSchema }, +}) +export type AwsSqsChangeMessageVisibilityRequest = ContractBodyInput< + typeof awsSqsChangeMessageVisibilityContract +> +export type AwsSqsChangeMessageVisibilityBody = ContractBody< + typeof awsSqsChangeMessageVisibilityContract +> +export type AwsSqsChangeMessageVisibilityResponse = ContractJsonResponse< + typeof awsSqsChangeMessageVisibilityContract +> diff --git a/apps/sim/lib/api/contracts/tools/aws/sqs-create-queue.ts b/apps/sim/lib/api/contracts/tools/aws/sqs-create-queue.ts new file mode 100644 index 00000000000..30c7113ada6 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/sqs-create-queue.ts @@ -0,0 +1,35 @@ +import { z } from 'zod' +import { + sqsConnectionFields, + sqsCreateQueueAttributesSchema, + sqsQueueNameField, + sqsTagsSchema, +} from '@/lib/api/contracts/tools/aws/sqs-shared' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' + +const CreateQueueSchema = z.object({ + ...sqsConnectionFields, + queueName: sqsQueueNameField, + attributes: sqsCreateQueueAttributesSchema.nullish(), + tags: sqsTagsSchema.nullish(), +}) + +const CreateQueueResponseSchema = z.object({ + message: z.string(), + queueUrl: z.string().nullable(), +}) + +export const awsSqsCreateQueueContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/sqs/create-queue', + body: CreateQueueSchema, + response: { mode: 'json', schema: CreateQueueResponseSchema }, +}) +export type AwsSqsCreateQueueRequest = ContractBodyInput +export type AwsSqsCreateQueueBody = ContractBody +export type AwsSqsCreateQueueResponse = ContractJsonResponse diff --git a/apps/sim/lib/api/contracts/tools/aws/sqs-delete-message-batch.ts b/apps/sim/lib/api/contracts/tools/aws/sqs-delete-message-batch.ts new file mode 100644 index 00000000000..43cdbe25e78 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/sqs-delete-message-batch.ts @@ -0,0 +1,53 @@ +import { z } from 'zod' +import { + hasDistinctBatchEntryIds, + SQS_DISTINCT_BATCH_ENTRY_IDS_MESSAGE, + SQS_MAX_BATCH_ENTRIES, + sqsBatchEntryIdSchema, + sqsBatchResultErrorEntrySchema, + sqsConnectionFields, + sqsQueueUrlField, +} from '@/lib/api/contracts/tools/aws/sqs-shared' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' + +const DeleteMessageBatchSchema = z.object({ + ...sqsConnectionFields, + queueUrl: sqsQueueUrlField, + entries: z + .array( + z.object({ + id: sqsBatchEntryIdSchema, + receiptHandle: z.string().min(1, 'Receipt handle is required'), + }) + ) + .min(1, 'At least one entry is required') + .max(SQS_MAX_BATCH_ENTRIES, `A batch can hold at most ${SQS_MAX_BATCH_ENTRIES} entries`) + .refine(hasDistinctBatchEntryIds, SQS_DISTINCT_BATCH_ENTRY_IDS_MESSAGE), +}) + +const DeleteMessageBatchResponseSchema = z.object({ + message: z.string(), + successful: z.array(z.object({ id: z.string().nullable() })), + failed: z.array(sqsBatchResultErrorEntrySchema), + successCount: z.number(), + failureCount: z.number(), +}) + +export const awsSqsDeleteMessageBatchContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/sqs/delete-message-batch', + body: DeleteMessageBatchSchema, + response: { mode: 'json', schema: DeleteMessageBatchResponseSchema }, +}) +export type AwsSqsDeleteMessageBatchRequest = ContractBodyInput< + typeof awsSqsDeleteMessageBatchContract +> +export type AwsSqsDeleteMessageBatchBody = ContractBody +export type AwsSqsDeleteMessageBatchResponse = ContractJsonResponse< + typeof awsSqsDeleteMessageBatchContract +> diff --git a/apps/sim/lib/api/contracts/tools/aws/sqs-delete-message.ts b/apps/sim/lib/api/contracts/tools/aws/sqs-delete-message.ts new file mode 100644 index 00000000000..8cee8746fb3 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/sqs-delete-message.ts @@ -0,0 +1,28 @@ +import { z } from 'zod' +import { sqsConnectionFields, sqsQueueUrlField } from '@/lib/api/contracts/tools/aws/sqs-shared' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' + +const DeleteMessageSchema = z.object({ + ...sqsConnectionFields, + queueUrl: sqsQueueUrlField, + receiptHandle: z.string().min(1, 'Receipt handle is required'), +}) + +const DeleteMessageResponseSchema = z.object({ + message: z.string(), +}) + +export const awsSqsDeleteMessageContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/sqs/delete-message', + body: DeleteMessageSchema, + response: { mode: 'json', schema: DeleteMessageResponseSchema }, +}) +export type AwsSqsDeleteMessageRequest = ContractBodyInput +export type AwsSqsDeleteMessageBody = ContractBody +export type AwsSqsDeleteMessageResponse = ContractJsonResponse diff --git a/apps/sim/lib/api/contracts/tools/aws/sqs-delete-queue.ts b/apps/sim/lib/api/contracts/tools/aws/sqs-delete-queue.ts new file mode 100644 index 00000000000..1522fa12d17 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/sqs-delete-queue.ts @@ -0,0 +1,27 @@ +import { z } from 'zod' +import { sqsConnectionFields, sqsQueueUrlField } from '@/lib/api/contracts/tools/aws/sqs-shared' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' + +const DeleteQueueSchema = z.object({ + ...sqsConnectionFields, + queueUrl: sqsQueueUrlField, +}) + +const DeleteQueueResponseSchema = z.object({ + message: z.string(), +}) + +export const awsSqsDeleteQueueContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/sqs/delete-queue', + body: DeleteQueueSchema, + response: { mode: 'json', schema: DeleteQueueResponseSchema }, +}) +export type AwsSqsDeleteQueueRequest = ContractBodyInput +export type AwsSqsDeleteQueueBody = ContractBody +export type AwsSqsDeleteQueueResponse = ContractJsonResponse diff --git a/apps/sim/lib/api/contracts/tools/aws/sqs-get-queue-attributes.ts b/apps/sim/lib/api/contracts/tools/aws/sqs-get-queue-attributes.ts new file mode 100644 index 00000000000..2963f648644 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/sqs-get-queue-attributes.ts @@ -0,0 +1,36 @@ +import { z } from 'zod' +import { + sqsConnectionFields, + sqsQueueAttributeNameSchema, + sqsQueueUrlField, +} from '@/lib/api/contracts/tools/aws/sqs-shared' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' + +const GetQueueAttributesSchema = z.object({ + ...sqsConnectionFields, + queueUrl: sqsQueueUrlField, + attributeNames: z.array(sqsQueueAttributeNameSchema).nullish(), +}) + +const GetQueueAttributesResponseSchema = z.object({ + attributes: z.record(z.string(), z.string()), +}) + +export const awsSqsGetQueueAttributesContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/sqs/get-queue-attributes', + body: GetQueueAttributesSchema, + response: { mode: 'json', schema: GetQueueAttributesResponseSchema }, +}) +export type AwsSqsGetQueueAttributesRequest = ContractBodyInput< + typeof awsSqsGetQueueAttributesContract +> +export type AwsSqsGetQueueAttributesBody = ContractBody +export type AwsSqsGetQueueAttributesResponse = ContractJsonResponse< + typeof awsSqsGetQueueAttributesContract +> diff --git a/apps/sim/lib/api/contracts/tools/aws/sqs-get-queue-url.ts b/apps/sim/lib/api/contracts/tools/aws/sqs-get-queue-url.ts new file mode 100644 index 00000000000..df326d44dff --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/sqs-get-queue-url.ts @@ -0,0 +1,32 @@ +import { z } from 'zod' +import { + sqsAwsAccountIdSchema, + sqsConnectionFields, + sqsQueueNameField, +} from '@/lib/api/contracts/tools/aws/sqs-shared' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' + +const GetQueueUrlSchema = z.object({ + ...sqsConnectionFields, + queueName: sqsQueueNameField, + queueOwnerAwsAccountId: sqsAwsAccountIdSchema.nullish(), +}) + +const GetQueueUrlResponseSchema = z.object({ + queueUrl: z.string().nullable(), +}) + +export const awsSqsGetQueueUrlContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/sqs/get-queue-url', + body: GetQueueUrlSchema, + response: { mode: 'json', schema: GetQueueUrlResponseSchema }, +}) +export type AwsSqsGetQueueUrlRequest = ContractBodyInput +export type AwsSqsGetQueueUrlBody = ContractBody +export type AwsSqsGetQueueUrlResponse = ContractJsonResponse diff --git a/apps/sim/lib/api/contracts/tools/aws/sqs-list-dead-letter-source-queues.ts b/apps/sim/lib/api/contracts/tools/aws/sqs-list-dead-letter-source-queues.ts new file mode 100644 index 00000000000..aab8f7d6847 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/sqs-list-dead-letter-source-queues.ts @@ -0,0 +1,42 @@ +import { z } from 'zod' +import { sqsConnectionFields, sqsQueueUrlField } from '@/lib/api/contracts/tools/aws/sqs-shared' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' + +const ListDeadLetterSourceQueuesSchema = z.object({ + ...sqsConnectionFields, + queueUrl: sqsQueueUrlField, + maxResults: z + .number() + .int() + .min(1, 'maxResults must be at least 1') + .max(1000, 'maxResults cannot exceed 1000') + .nullish(), + nextToken: z.string().nullish(), +}) + +const ListDeadLetterSourceQueuesResponseSchema = z.object({ + queueUrls: z.array(z.string()), + nextToken: z.string().nullable(), + count: z.number(), +}) + +export const awsSqsListDeadLetterSourceQueuesContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/sqs/list-dead-letter-source-queues', + body: ListDeadLetterSourceQueuesSchema, + response: { mode: 'json', schema: ListDeadLetterSourceQueuesResponseSchema }, +}) +export type AwsSqsListDeadLetterSourceQueuesRequest = ContractBodyInput< + typeof awsSqsListDeadLetterSourceQueuesContract +> +export type AwsSqsListDeadLetterSourceQueuesBody = ContractBody< + typeof awsSqsListDeadLetterSourceQueuesContract +> +export type AwsSqsListDeadLetterSourceQueuesResponse = ContractJsonResponse< + typeof awsSqsListDeadLetterSourceQueuesContract +> diff --git a/apps/sim/lib/api/contracts/tools/aws/sqs-list-message-move-tasks.ts b/apps/sim/lib/api/contracts/tools/aws/sqs-list-message-move-tasks.ts new file mode 100644 index 00000000000..1128f82d487 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/sqs-list-message-move-tasks.ts @@ -0,0 +1,50 @@ +import { z } from 'zod' +import { sqsConnectionFields, sqsQueueArnSchema } from '@/lib/api/contracts/tools/aws/sqs-shared' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' + +const ListMessageMoveTasksSchema = z.object({ + ...sqsConnectionFields, + sourceArn: sqsQueueArnSchema, + maxResults: z + .number() + .int() + .min(1, 'maxResults must be at least 1') + .max(10, 'maxResults cannot exceed 10') + .nullish(), +}) + +const ListMessageMoveTasksResponseSchema = z.object({ + results: z.array( + z.object({ + taskHandle: z.string().nullable(), + status: z.string().nullable(), + sourceArn: z.string().nullable(), + destinationArn: z.string().nullable(), + maxNumberOfMessagesPerSecond: z.number().nullable(), + approximateNumberOfMessagesMoved: z.number().nullable(), + approximateNumberOfMessagesToMove: z.number().nullable(), + failureReason: z.string().nullable(), + startedTimestamp: z.number().nullable(), + }) + ), + count: z.number(), +}) + +export const awsSqsListMessageMoveTasksContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/sqs/list-message-move-tasks', + body: ListMessageMoveTasksSchema, + response: { mode: 'json', schema: ListMessageMoveTasksResponseSchema }, +}) +export type AwsSqsListMessageMoveTasksRequest = ContractBodyInput< + typeof awsSqsListMessageMoveTasksContract +> +export type AwsSqsListMessageMoveTasksBody = ContractBody +export type AwsSqsListMessageMoveTasksResponse = ContractJsonResponse< + typeof awsSqsListMessageMoveTasksContract +> diff --git a/apps/sim/lib/api/contracts/tools/aws/sqs-list-queue-tags.ts b/apps/sim/lib/api/contracts/tools/aws/sqs-list-queue-tags.ts new file mode 100644 index 00000000000..e445a8b90bf --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/sqs-list-queue-tags.ts @@ -0,0 +1,27 @@ +import { z } from 'zod' +import { sqsConnectionFields, sqsQueueUrlField } from '@/lib/api/contracts/tools/aws/sqs-shared' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' + +const ListQueueTagsSchema = z.object({ + ...sqsConnectionFields, + queueUrl: sqsQueueUrlField, +}) + +const ListQueueTagsResponseSchema = z.object({ + tags: z.record(z.string(), z.string()), +}) + +export const awsSqsListQueueTagsContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/sqs/list-queue-tags', + body: ListQueueTagsSchema, + response: { mode: 'json', schema: ListQueueTagsResponseSchema }, +}) +export type AwsSqsListQueueTagsRequest = ContractBodyInput +export type AwsSqsListQueueTagsBody = ContractBody +export type AwsSqsListQueueTagsResponse = ContractJsonResponse diff --git a/apps/sim/lib/api/contracts/tools/aws/sqs-list-queues.ts b/apps/sim/lib/api/contracts/tools/aws/sqs-list-queues.ts new file mode 100644 index 00000000000..fa571ccfeaa --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/sqs-list-queues.ts @@ -0,0 +1,36 @@ +import { z } from 'zod' +import { sqsConnectionFields } from '@/lib/api/contracts/tools/aws/sqs-shared' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' + +const ListQueuesSchema = z.object({ + ...sqsConnectionFields, + queueNamePrefix: z.string().nullish(), + maxResults: z + .number() + .int() + .min(1, 'maxResults must be at least 1') + .max(1000, 'maxResults cannot exceed 1000') + .nullish(), + nextToken: z.string().nullish(), +}) + +const ListQueuesResponseSchema = z.object({ + queueUrls: z.array(z.string()), + nextToken: z.string().nullable(), + count: z.number(), +}) + +export const awsSqsListQueuesContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/sqs/list-queues', + body: ListQueuesSchema, + response: { mode: 'json', schema: ListQueuesResponseSchema }, +}) +export type AwsSqsListQueuesRequest = ContractBodyInput +export type AwsSqsListQueuesBody = ContractBody +export type AwsSqsListQueuesResponse = ContractJsonResponse diff --git a/apps/sim/lib/api/contracts/tools/aws/sqs-purge-queue.ts b/apps/sim/lib/api/contracts/tools/aws/sqs-purge-queue.ts new file mode 100644 index 00000000000..d77c61e14b1 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/sqs-purge-queue.ts @@ -0,0 +1,27 @@ +import { z } from 'zod' +import { sqsConnectionFields, sqsQueueUrlField } from '@/lib/api/contracts/tools/aws/sqs-shared' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' + +const PurgeQueueSchema = z.object({ + ...sqsConnectionFields, + queueUrl: sqsQueueUrlField, +}) + +const PurgeQueueResponseSchema = z.object({ + message: z.string(), +}) + +export const awsSqsPurgeQueueContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/sqs/purge-queue', + body: PurgeQueueSchema, + response: { mode: 'json', schema: PurgeQueueResponseSchema }, +}) +export type AwsSqsPurgeQueueRequest = ContractBodyInput +export type AwsSqsPurgeQueueBody = ContractBody +export type AwsSqsPurgeQueueResponse = ContractJsonResponse diff --git a/apps/sim/lib/api/contracts/tools/aws/sqs-receive-message.ts b/apps/sim/lib/api/contracts/tools/aws/sqs-receive-message.ts new file mode 100644 index 00000000000..26f9de68847 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/sqs-receive-message.ts @@ -0,0 +1,69 @@ +import { z } from 'zod' +import { + sqsConnectionFields, + sqsMessageAttributesOutputSchema, + sqsMessageSystemAttributeNameSchema, + sqsQueueUrlField, +} from '@/lib/api/contracts/tools/aws/sqs-shared' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' + +const ReceiveMessageSchema = z.object({ + ...sqsConnectionFields, + queueUrl: sqsQueueUrlField, + maxNumberOfMessages: z + .number() + .int() + .min(1, 'maxNumberOfMessages must be at least 1') + .max(10, 'maxNumberOfMessages cannot exceed 10') + .nullish(), + visibilityTimeout: z + .number() + .int() + .min(0, 'visibilityTimeout must be at least 0') + .max(43200, 'visibilityTimeout cannot exceed 43200 seconds (12 hours)') + .nullish(), + waitTimeSeconds: z + .number() + .int() + .min(0, 'waitTimeSeconds must be at least 0') + .max(20, 'waitTimeSeconds cannot exceed 20') + .nullish(), + messageAttributeNames: z + .array(z.string().min(1, 'Message attribute name cannot be empty')) + .nullish(), + messageSystemAttributeNames: z.array(sqsMessageSystemAttributeNameSchema).nullish(), + receiveRequestAttemptId: z + .string() + .max(128, 'receiveRequestAttemptId must be at most 128 characters') + .nullish(), +}) + +const ReceiveMessageResponseSchema = z.object({ + messages: z.array( + z.object({ + messageId: z.string().nullable(), + receiptHandle: z.string().nullable(), + body: z.string().nullable(), + md5OfBody: z.string().nullable(), + md5OfMessageAttributes: z.string().nullable(), + attributes: z.record(z.string(), z.string()), + messageAttributes: sqsMessageAttributesOutputSchema, + }) + ), + count: z.number(), +}) + +export const awsSqsReceiveMessageContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/sqs/receive-message', + body: ReceiveMessageSchema, + response: { mode: 'json', schema: ReceiveMessageResponseSchema }, +}) +export type AwsSqsReceiveMessageRequest = ContractBodyInput +export type AwsSqsReceiveMessageBody = ContractBody +export type AwsSqsReceiveMessageResponse = ContractJsonResponse diff --git a/apps/sim/lib/api/contracts/tools/aws/sqs-send-message-batch.ts b/apps/sim/lib/api/contracts/tools/aws/sqs-send-message-batch.ts new file mode 100644 index 00000000000..2b65d99b7bc --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/sqs-send-message-batch.ts @@ -0,0 +1,73 @@ +import { z } from 'zod' +import { + hasDistinctBatchEntryIds, + SQS_DISTINCT_BATCH_ENTRY_IDS_MESSAGE, + SQS_MAX_BATCH_ENTRIES, + sqsBatchEntryIdSchema, + sqsBatchResultErrorEntrySchema, + sqsConnectionFields, + sqsMessageAttributesInputSchema, + sqsMessageDeduplicationIdField, + sqsMessageGroupIdField, + sqsQueueUrlField, +} from '@/lib/api/contracts/tools/aws/sqs-shared' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' + +const SendMessageBatchEntrySchema = z.object({ + id: sqsBatchEntryIdSchema, + data: z.record(z.string(), z.unknown()).refine((value) => Object.keys(value).length > 0, { + message: 'Each entry data object must have at least one field', + }), + delaySeconds: z + .number() + .int() + .min(0, 'delaySeconds must be at least 0') + .max(900, 'delaySeconds cannot exceed 900') + .nullish(), + messageAttributes: sqsMessageAttributesInputSchema.nullish(), + messageGroupId: sqsMessageGroupIdField.nullish(), + messageDeduplicationId: sqsMessageDeduplicationIdField.nullish(), +}) + +const SendMessageBatchSchema = z.object({ + ...sqsConnectionFields, + queueUrl: sqsQueueUrlField, + entries: z + .array(SendMessageBatchEntrySchema) + .min(1, 'At least one entry is required') + .max(SQS_MAX_BATCH_ENTRIES, `A batch can hold at most ${SQS_MAX_BATCH_ENTRIES} entries`) + .refine(hasDistinctBatchEntryIds, SQS_DISTINCT_BATCH_ENTRY_IDS_MESSAGE), +}) + +const SendMessageBatchResponseSchema = z.object({ + message: z.string(), + successful: z.array( + z.object({ + id: z.string().nullable(), + messageId: z.string().nullable(), + md5OfMessageBody: z.string().nullable(), + md5OfMessageAttributes: z.string().nullable(), + sequenceNumber: z.string().nullable(), + }) + ), + failed: z.array(sqsBatchResultErrorEntrySchema), + successCount: z.number(), + failureCount: z.number(), +}) + +export const awsSqsSendMessageBatchContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/sqs/send-message-batch', + body: SendMessageBatchSchema, + response: { mode: 'json', schema: SendMessageBatchResponseSchema }, +}) +export type AwsSqsSendMessageBatchRequest = ContractBodyInput +export type AwsSqsSendMessageBatchBody = ContractBody +export type AwsSqsSendMessageBatchResponse = ContractJsonResponse< + typeof awsSqsSendMessageBatchContract +> diff --git a/apps/sim/lib/api/contracts/tools/aws/sqs-send-message.ts b/apps/sim/lib/api/contracts/tools/aws/sqs-send-message.ts new file mode 100644 index 00000000000..9be531fafa2 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/sqs-send-message.ts @@ -0,0 +1,49 @@ +import { z } from 'zod' +import { + sqsConnectionFields, + sqsMessageAttributesInputSchema, + sqsMessageDeduplicationIdField, + sqsMessageGroupIdField, + sqsQueueUrlField, +} from '@/lib/api/contracts/tools/aws/sqs-shared' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' + +const SendMessageSchema = z.object({ + ...sqsConnectionFields, + queueUrl: sqsQueueUrlField, + data: z.record(z.string(), z.unknown()).refine((value) => Object.keys(value).length > 0, { + message: 'Data object must have at least one field', + }), + delaySeconds: z + .number() + .int() + .min(0, 'delaySeconds must be at least 0') + .max(900, 'delaySeconds cannot exceed 900') + .nullish(), + messageAttributes: sqsMessageAttributesInputSchema.nullish(), + messageGroupId: sqsMessageGroupIdField.nullish(), + messageDeduplicationId: sqsMessageDeduplicationIdField.nullish(), +}) + +const SendMessageResponseSchema = z.object({ + message: z.string(), + id: z.string().nullable(), + md5OfMessageBody: z.string().nullable(), + md5OfMessageAttributes: z.string().nullable(), + sequenceNumber: z.string().nullable(), +}) + +export const awsSqsSendMessageContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/sqs/send-message', + body: SendMessageSchema, + response: { mode: 'json', schema: SendMessageResponseSchema }, +}) +export type AwsSqsSendMessageRequest = ContractBodyInput +export type AwsSqsSendMessageBody = ContractBody +export type AwsSqsSendMessageResponse = ContractJsonResponse diff --git a/apps/sim/lib/api/contracts/tools/aws/sqs-set-queue-attributes.ts b/apps/sim/lib/api/contracts/tools/aws/sqs-set-queue-attributes.ts new file mode 100644 index 00000000000..853ce567606 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/sqs-set-queue-attributes.ts @@ -0,0 +1,39 @@ +import { z } from 'zod' +import { + sqsConnectionFields, + sqsQueueUrlField, + sqsSetQueueAttributesSchema, +} from '@/lib/api/contracts/tools/aws/sqs-shared' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' + +const SetQueueAttributesSchema = z.object({ + ...sqsConnectionFields, + queueUrl: sqsQueueUrlField, + attributes: sqsSetQueueAttributesSchema.refine( + (value) => Object.keys(value).length > 0, + 'At least one queue attribute is required' + ), +}) + +const SetQueueAttributesResponseSchema = z.object({ + message: z.string(), +}) + +export const awsSqsSetQueueAttributesContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/sqs/set-queue-attributes', + body: SetQueueAttributesSchema, + response: { mode: 'json', schema: SetQueueAttributesResponseSchema }, +}) +export type AwsSqsSetQueueAttributesRequest = ContractBodyInput< + typeof awsSqsSetQueueAttributesContract +> +export type AwsSqsSetQueueAttributesBody = ContractBody +export type AwsSqsSetQueueAttributesResponse = ContractJsonResponse< + typeof awsSqsSetQueueAttributesContract +> diff --git a/apps/sim/lib/api/contracts/tools/aws/sqs-shared.ts b/apps/sim/lib/api/contracts/tools/aws/sqs-shared.ts new file mode 100644 index 00000000000..8f911796127 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/sqs-shared.ts @@ -0,0 +1,253 @@ +import { z } from 'zod' +import { validateAwsRegion } from '@/lib/core/security/input-validation' + +/** + * Connection fields every Amazon SQS tool contract requires. Spread into each + * operation's body schema so the credential shape stays identical across all of them. + */ +export const sqsConnectionFields = { + region: z + .string() + .min(1, 'AWS region is required') + .refine((value) => validateAwsRegion(value).isValid, { + message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', + }), + accessKeyId: z.string().min(1, 'AWS access key ID is required'), + secretAccessKey: z.string().min(1, 'AWS secret access key is required'), +} + +/** `QueueUrl`, required by every action that targets an existing queue. */ +export const sqsQueueUrlField = z.string().min(1, 'Queue URL is required') + +/** + * `QueueName`, required by CreateQueue and GetQueueUrl. Documented as up to 80 + * characters of alphanumerics, hyphens, and underscores; a FIFO queue name ends + * with the `.fifo` suffix. + */ +export const sqsQueueNameField = z + .string() + .min(1, 'Queue name is required') + .max(80, 'Queue name must be at most 80 characters') + .regex( + /^[A-Za-z0-9_-]+(\.fifo)?$/, + 'Queue name may only contain letters, digits, hyphens, and underscores, optionally ending in .fifo' + ) + +/** + * A queue ARN, in the documented `arn::sqs:::` + * form used by the message move task actions. + */ +export const sqsQueueArnSchema = z + .string() + .regex( + /^arn:[a-z0-9-]+:sqs:[a-z0-9-]+:\d{12}:[A-Za-z0-9_-]+(\.fifo)?$/, + 'Must be a queue ARN (e.g., arn:aws:sqs:us-east-1:123456789012:my-queue)' + ) + +/** A 12-digit AWS account ID. */ +export const sqsAwsAccountIdSchema = z + .string() + .regex(/^\d{12}$/, 'AWS account ID must be 12 digits') + +/** + * `Id` of a batch request entry. Documented as up to 80 characters of + * alphanumerics, hyphens, and underscores, unique within the request. + */ +export const sqsBatchEntryIdSchema = z + .string() + .min(1, 'Batch entry id is required') + .max(80, 'Batch entry id must be at most 80 characters') + .regex( + /^[A-Za-z0-9_-]+$/, + 'Batch entry id may only contain letters, digits, hyphens, underscores' + ) + +/** + * The documented batch size for SendMessageBatch, DeleteMessageBatch, and + * ChangeMessageVisibilityBatch. AWS states the limit in the + * `TooManyEntriesInBatchRequest` error rather than on the `Entries` parameter. + */ +export const SQS_MAX_BATCH_ENTRIES = 10 + +/** + * AWS rejects a batch whose entries reuse an `Id` with `BatchEntryIdsNotDistinct` + * ("Two or more batch entries in the request have the same `Id`"), failing the + * whole request rather than the offending entry. Every batch contract refines its + * `entries` array with this so the caller gets a local field error instead of + * losing the batch at the provider. + */ +export function hasDistinctBatchEntryIds(entries: readonly { id: string }[]) { + return new Set(entries.map((entry) => entry.id)).size === entries.length +} + +/** Message reported when {@link hasDistinctBatchEntryIds} rejects a batch. */ +export const SQS_DISTINCT_BATCH_ENTRY_IDS_MESSAGE = + 'Batch entry ids must be unique within a request' + +/** + * `QueueAttributeName` values AWS documents as settable, taken from the "special + * request parameters that the action uses" list shared by CreateQueue and + * SetQueueAttributes. + * + * The read-only names carried by the shared `Valid Keys` enum + * (`ApproximateNumberOfMessages`, `ApproximateNumberOfMessagesDelayed`, + * `ApproximateNumberOfMessagesNotVisible`, `CreatedTimestamp`, + * `LastModifiedTimestamp`, `QueueArn`) and the `All` pseudo-name are deliberately + * absent: neither action documents them as settable, and AWS answers a write with + * `InvalidAttributeName`. + */ +const sqsSettableQueueAttributeNames = [ + 'ContentBasedDeduplication', + 'DeduplicationScope', + 'DelaySeconds', + 'FifoThroughputLimit', + 'KmsDataKeyReusePeriodSeconds', + 'KmsMasterKeyId', + 'MaximumMessageSize', + 'MessageRetentionPeriod', + 'Policy', + 'ReceiveMessageWaitTimeSeconds', + 'RedriveAllowPolicy', + 'RedrivePolicy', + 'SqsManagedSseEnabled', + 'VisibilityTimeout', +] as const + +/** + * Attribute names CreateQueue accepts. `FifoQueue` is create-only, because AWS + * documents that "You can provide this attribute only during queue creation. You + * can't change it for an existing queue." + */ +export const sqsCreateQueueAttributeNameSchema = z.enum([ + ...sqsSettableQueueAttributeNames, + 'FifoQueue', +]) + +/** Attribute names SetQueueAttributes accepts, which excludes create-only `FifoQueue`. */ +export const sqsSetQueueAttributeNameSchema = z.enum(sqsSettableQueueAttributeNames) + +/** Documented `QueueAttributeName` values, including the read-only `All` pseudo-name. */ +export const sqsQueueAttributeNameSchema = z.enum([ + 'All', + 'ApproximateNumberOfMessages', + 'ApproximateNumberOfMessagesDelayed', + 'ApproximateNumberOfMessagesNotVisible', + 'ContentBasedDeduplication', + 'CreatedTimestamp', + 'DeduplicationScope', + 'DelaySeconds', + 'FifoQueue', + 'FifoThroughputLimit', + 'KmsDataKeyReusePeriodSeconds', + 'KmsMasterKeyId', + 'LastModifiedTimestamp', + 'MaximumMessageSize', + 'MessageRetentionPeriod', + 'Policy', + 'QueueArn', + 'ReceiveMessageWaitTimeSeconds', + 'RedriveAllowPolicy', + 'RedrivePolicy', + 'SqsManagedSseEnabled', + 'VisibilityTimeout', +]) + +/** Documented `MessageSystemAttributeName` values accepted by ReceiveMessage. */ +export const sqsMessageSystemAttributeNameSchema = z.enum([ + 'All', + 'ApproximateFirstReceiveTimestamp', + 'ApproximateReceiveCount', + 'AWSTraceHeader', + 'DeadLetterQueueSourceArn', + 'MessageDeduplicationId', + 'MessageGroupId', + 'SenderId', + 'SentTimestamp', + 'SequenceNumber', +]) + +/** Attribute map accepted by CreateQueue, which alone may set `FifoQueue`. */ +export const sqsCreateQueueAttributesSchema = z.partialRecord( + sqsCreateQueueAttributeNameSchema, + z.string({ error: 'Queue attribute values must be strings' }) +) + +/** Attribute map accepted by SetQueueAttributes. */ +export const sqsSetQueueAttributesSchema = z.partialRecord( + sqsSetQueueAttributeNameSchema, + z.string({ error: 'Queue attribute values must be strings' }) +) + +/** + * `MessageGroupId` and `MessageDeduplicationId` are FIFO tokens documented as up + * to 128 characters of alphanumerics and punctuation. Both operations forward the + * value verbatim, so an empty string reaches SQS as a malformed token; the block + * already drops a blank field before mapping, so only an explicitly empty string + * is refused here. + */ +const sqsFifoTokenField = (fieldName: string) => + z + .string() + .min(1, `${fieldName} cannot be empty`) + .max(128, `${fieldName} must be at most 128 characters`) + +/** `MessageGroupId`, shared by SendMessage and each SendMessageBatch entry. */ +export const sqsMessageGroupIdField = sqsFifoTokenField('messageGroupId') + +/** `MessageDeduplicationId`, shared by SendMessage and each SendMessageBatch entry. */ +export const sqsMessageDeduplicationIdField = sqsFifoTokenField('messageDeduplicationId') + +/** + * The documented cap on user-supplied message attributes: "Each message can have + * up to 10 attributes." + */ +export const SQS_MAX_MESSAGE_ATTRIBUTES = 10 + +/** + * User-supplied message attributes. Only the string-valued data types are + * accepted: a `Binary` attribute needs a `BinaryValue` byte array, which cannot + * cross the JSON tool boundary. AWS allows a custom label suffix on the logical + * type, e.g. `Number.float`. + */ +export const sqsMessageAttributesInputSchema = z + .record( + z.string().min(1, 'Message attribute name is required'), + z.object({ + dataType: z + .string() + .min(1, 'Message attribute dataType is required') + .regex( + /^(String|Number)(\.[\w.-]+)?$/, + 'Message attribute dataType must be String or Number, optionally with a custom label such as Number.float. Binary attributes are not supported.' + ), + stringValue: z.string().min(1, 'Message attribute stringValue is required'), + }) + ) + .refine( + (value) => Object.keys(value).length <= SQS_MAX_MESSAGE_ATTRIBUTES, + `A message can have at most ${SQS_MAX_MESSAGE_ATTRIBUTES} message attributes` + ) + +/** Message attributes as projected from a received message. */ +export const sqsMessageAttributesOutputSchema = z.record( + z.string(), + z.object({ + dataType: z.string().nullable(), + stringValue: z.string().nullable(), + stringListValues: z.array(z.string()), + }) +) + +/** `BatchResultErrorEntry`, identical across all three SQS batch actions. */ +export const sqsBatchResultErrorEntrySchema = z.object({ + id: z.string().nullable(), + senderFault: z.boolean().nullable(), + code: z.string().nullable(), + message: z.string().nullable(), +}) + +/** Tag keys and values applied to a queue. */ +export const sqsTagsSchema = z.record( + z.string().min(1, 'Tag key is required').max(128, 'Tag key must be at most 128 characters'), + z.string().max(256, 'Tag value must be at most 256 characters') +) diff --git a/apps/sim/lib/api/contracts/tools/aws/sqs-start-message-move-task.ts b/apps/sim/lib/api/contracts/tools/aws/sqs-start-message-move-task.ts new file mode 100644 index 00000000000..fcbe23d2beb --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/sqs-start-message-move-task.ts @@ -0,0 +1,39 @@ +import { z } from 'zod' +import { sqsConnectionFields, sqsQueueArnSchema } from '@/lib/api/contracts/tools/aws/sqs-shared' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' + +const StartMessageMoveTaskSchema = z.object({ + ...sqsConnectionFields, + sourceArn: sqsQueueArnSchema, + destinationArn: sqsQueueArnSchema.nullish(), + maxNumberOfMessagesPerSecond: z + .number() + .int() + .min(1, 'maxNumberOfMessagesPerSecond must be at least 1') + .max(500, 'maxNumberOfMessagesPerSecond cannot exceed 500') + .nullish(), +}) + +const StartMessageMoveTaskResponseSchema = z.object({ + message: z.string(), + taskHandle: z.string().nullable(), +}) + +export const awsSqsStartMessageMoveTaskContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/sqs/start-message-move-task', + body: StartMessageMoveTaskSchema, + response: { mode: 'json', schema: StartMessageMoveTaskResponseSchema }, +}) +export type AwsSqsStartMessageMoveTaskRequest = ContractBodyInput< + typeof awsSqsStartMessageMoveTaskContract +> +export type AwsSqsStartMessageMoveTaskBody = ContractBody +export type AwsSqsStartMessageMoveTaskResponse = ContractJsonResponse< + typeof awsSqsStartMessageMoveTaskContract +> diff --git a/apps/sim/lib/api/contracts/tools/aws/sqs-tag-queue.ts b/apps/sim/lib/api/contracts/tools/aws/sqs-tag-queue.ts new file mode 100644 index 00000000000..e4a7f241c15 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/sqs-tag-queue.ts @@ -0,0 +1,35 @@ +import { z } from 'zod' +import { + sqsConnectionFields, + sqsQueueUrlField, + sqsTagsSchema, +} from '@/lib/api/contracts/tools/aws/sqs-shared' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' + +const TagQueueSchema = z.object({ + ...sqsConnectionFields, + queueUrl: sqsQueueUrlField, + tags: sqsTagsSchema.refine( + (value) => Object.keys(value).length > 0, + 'At least one tag is required' + ), +}) + +const TagQueueResponseSchema = z.object({ + message: z.string(), +}) + +export const awsSqsTagQueueContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/sqs/tag-queue', + body: TagQueueSchema, + response: { mode: 'json', schema: TagQueueResponseSchema }, +}) +export type AwsSqsTagQueueRequest = ContractBodyInput +export type AwsSqsTagQueueBody = ContractBody +export type AwsSqsTagQueueResponse = ContractJsonResponse diff --git a/apps/sim/lib/api/contracts/tools/aws/sqs-untag-queue.ts b/apps/sim/lib/api/contracts/tools/aws/sqs-untag-queue.ts new file mode 100644 index 00000000000..53ef7bf304d --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/sqs-untag-queue.ts @@ -0,0 +1,30 @@ +import { z } from 'zod' +import { sqsConnectionFields, sqsQueueUrlField } from '@/lib/api/contracts/tools/aws/sqs-shared' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' + +const UntagQueueSchema = z.object({ + ...sqsConnectionFields, + queueUrl: sqsQueueUrlField, + tagKeys: z + .array(z.string().min(1, 'Tag key cannot be empty')) + .min(1, 'At least one tag key is required'), +}) + +const UntagQueueResponseSchema = z.object({ + message: z.string(), +}) + +export const awsSqsUntagQueueContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/sqs/untag-queue', + body: UntagQueueSchema, + response: { mode: 'json', schema: UntagQueueResponseSchema }, +}) +export type AwsSqsUntagQueueRequest = ContractBodyInput +export type AwsSqsUntagQueueBody = ContractBody +export type AwsSqsUntagQueueResponse = ContractJsonResponse diff --git a/apps/sim/lib/api/contracts/tools/aws/ssm-cancel-command.ts b/apps/sim/lib/api/contracts/tools/aws/ssm-cancel-command.ts new file mode 100644 index 00000000000..168329a7f82 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/ssm-cancel-command.ts @@ -0,0 +1,46 @@ +import { z } from 'zod' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' +import { validateAwsRegion } from '@/lib/core/security/input-validation' + +const INSTANCE_ID_PATTERN = /^(i-(\w{8}|\w{17})|mi-\w{17})$/ + +const COMMAND_ID_PATTERN = + /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/ + +const RequestSchema = z.object({ + region: z + .string() + .min(1, 'AWS region is required') + .refine((v) => validateAwsRegion(v).isValid, { + message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', + }), + accessKeyId: z.string().min(1, 'AWS access key ID is required'), + secretAccessKey: z.string().min(1, 'AWS secret access key is required'), + commandId: z.string().regex(COMMAND_ID_PATTERN, 'commandId must be a 36-character command ID'), + instanceIds: z + .array( + z.string().regex(INSTANCE_ID_PATTERN, 'instanceIds entries must look like i-0abc… or mi-…') + ) + .max(50) + .nullish(), +}) + +const ResponseSchema = z.object({ + message: z.string(), + commandId: z.string(), +}) + +export const awsSsmCancelCommandContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/ssm/cancel-command', + body: RequestSchema, + response: { mode: 'json', schema: ResponseSchema }, +}) +export type AwsSsmCancelCommandRequest = ContractBodyInput +export type AwsSsmCancelCommandBody = ContractBody +export type AwsSsmCancelCommandResponse = ContractJsonResponse diff --git a/apps/sim/lib/api/contracts/tools/aws/ssm-delete-parameter.ts b/apps/sim/lib/api/contracts/tools/aws/ssm-delete-parameter.ts new file mode 100644 index 00000000000..5c926edeb00 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/ssm-delete-parameter.ts @@ -0,0 +1,37 @@ +import { z } from 'zod' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' +import { validateAwsRegion } from '@/lib/core/security/input-validation' + +const RequestSchema = z.object({ + region: z + .string() + .min(1, 'AWS region is required') + .refine((v) => validateAwsRegion(v).isValid, { + message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', + }), + accessKeyId: z.string().min(1, 'AWS access key ID is required'), + secretAccessKey: z.string().min(1, 'AWS secret access key is required'), + name: z.string().min(1, 'Parameter name is required').max(2048), +}) + +const ResponseSchema = z.object({ + message: z.string(), + name: z.string(), +}) + +export const awsSsmDeleteParameterContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/ssm/delete-parameter', + body: RequestSchema, + response: { mode: 'json', schema: ResponseSchema }, +}) +export type AwsSsmDeleteParameterRequest = ContractBodyInput +export type AwsSsmDeleteParameterBody = ContractBody +export type AwsSsmDeleteParameterResponse = ContractJsonResponse< + typeof awsSsmDeleteParameterContract +> diff --git a/apps/sim/lib/api/contracts/tools/aws/ssm-describe-automation-executions.ts b/apps/sim/lib/api/contracts/tools/aws/ssm-describe-automation-executions.ts new file mode 100644 index 00000000000..cfde1946555 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/ssm-describe-automation-executions.ts @@ -0,0 +1,84 @@ +import { z } from 'zod' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' +import { validateAwsRegion } from '@/lib/core/security/input-validation' + +const AutomationExecutionFilterSchema = z.object({ + Key: z.enum([ + 'DocumentNamePrefix', + 'ExecutionStatus', + 'ExecutionId', + 'ParentExecutionId', + 'CurrentAction', + 'StartTimeBefore', + 'StartTimeAfter', + 'AutomationType', + 'TagKey', + 'TargetResourceGroup', + 'AutomationSubtype', + 'OpsItemId', + ]), + Values: z.array(z.string().min(1).max(150)).min(1).max(10), +}) + +const AutomationExecutionMetadataSchema = z.object({ + automationExecutionId: z.string(), + documentName: z.string(), + documentVersion: z.string().nullable(), + automationExecutionStatus: z.string(), + executionStartTime: z.string().nullable(), + executionEndTime: z.string().nullable(), + executedBy: z.string().nullable(), + logFile: z.string().nullable(), + mode: z.string().nullable(), + parentAutomationExecutionId: z.string().nullable(), + currentStepName: z.string().nullable(), + currentAction: z.string().nullable(), + failureMessage: z.string().nullable(), + targetParameterName: z.string().nullable(), + target: z.string().nullable(), + automationType: z.string().nullable(), + maxConcurrency: z.string().nullable(), + maxErrors: z.string().nullable(), + outputs: z.record(z.string(), z.array(z.string())).nullable(), +}) + +const RequestSchema = z.object({ + region: z + .string() + .min(1, 'AWS region is required') + .refine((v) => validateAwsRegion(v).isValid, { + message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', + }), + accessKeyId: z.string().min(1, 'AWS access key ID is required'), + secretAccessKey: z.string().min(1, 'AWS secret access key is required'), + filters: z.array(AutomationExecutionFilterSchema).max(10).nullish(), + maxResults: z.number().int().min(1).max(50).nullish(), + nextToken: z.string().nullish(), +}) + +const ResponseSchema = z.object({ + automationExecutions: z.array(AutomationExecutionMetadataSchema), + nextToken: z.string().nullable(), + count: z.number(), +}) + +export const awsSsmDescribeAutomationExecutionsContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/ssm/describe-automation-executions', + body: RequestSchema, + response: { mode: 'json', schema: ResponseSchema }, +}) +export type AwsSsmDescribeAutomationExecutionsRequest = ContractBodyInput< + typeof awsSsmDescribeAutomationExecutionsContract +> +export type AwsSsmDescribeAutomationExecutionsBody = ContractBody< + typeof awsSsmDescribeAutomationExecutionsContract +> +export type AwsSsmDescribeAutomationExecutionsResponse = ContractJsonResponse< + typeof awsSsmDescribeAutomationExecutionsContract +> diff --git a/apps/sim/lib/api/contracts/tools/aws/ssm-describe-instance-information.ts b/apps/sim/lib/api/contracts/tools/aws/ssm-describe-instance-information.ts new file mode 100644 index 00000000000..af759b2ad12 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/ssm-describe-instance-information.ts @@ -0,0 +1,72 @@ +import { z } from 'zod' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' +import { validateAwsRegion } from '@/lib/core/security/input-validation' + +const InstanceInformationStringFilterSchema = z.object({ + Key: z.string().min(1, 'Filter Key is required'), + Values: z.array(z.string().min(1)).min(1).max(100), +}) + +const InstanceInformationSchema = z.object({ + instanceId: z.string(), + pingStatus: z.string(), + lastPingDateTime: z.string().nullable(), + agentVersion: z.string().nullable(), + isLatestVersion: z.boolean().nullable(), + platformType: z.string().nullable(), + platformName: z.string().nullable(), + platformVersion: z.string().nullable(), + activationId: z.string().nullable(), + iamRole: z.string().nullable(), + registrationDate: z.string().nullable(), + resourceType: z.string().nullable(), + name: z.string().nullable(), + ipAddress: z.string().nullable(), + computerName: z.string().nullable(), + associationStatus: z.string().nullable(), + lastAssociationExecutionDate: z.string().nullable(), + lastSuccessfulAssociationExecutionDate: z.string().nullable(), + sourceId: z.string().nullable(), + sourceType: z.string().nullable(), +}) + +const RequestSchema = z.object({ + region: z + .string() + .min(1, 'AWS region is required') + .refine((v) => validateAwsRegion(v).isValid, { + message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', + }), + accessKeyId: z.string().min(1, 'AWS access key ID is required'), + secretAccessKey: z.string().min(1, 'AWS secret access key is required'), + filters: z.array(InstanceInformationStringFilterSchema).nullish(), + maxResults: z.number().int().min(5).max(50).nullish(), + nextToken: z.string().nullish(), +}) + +const ResponseSchema = z.object({ + instances: z.array(InstanceInformationSchema), + nextToken: z.string().nullable(), + count: z.number(), +}) + +export const awsSsmDescribeInstanceInformationContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/ssm/describe-instance-information', + body: RequestSchema, + response: { mode: 'json', schema: ResponseSchema }, +}) +export type AwsSsmDescribeInstanceInformationRequest = ContractBodyInput< + typeof awsSsmDescribeInstanceInformationContract +> +export type AwsSsmDescribeInstanceInformationBody = ContractBody< + typeof awsSsmDescribeInstanceInformationContract +> +export type AwsSsmDescribeInstanceInformationResponse = ContractJsonResponse< + typeof awsSsmDescribeInstanceInformationContract +> diff --git a/apps/sim/lib/api/contracts/tools/aws/ssm-describe-instance-patch-states.ts b/apps/sim/lib/api/contracts/tools/aws/ssm-describe-instance-patch-states.ts new file mode 100644 index 00000000000..08af5d4da47 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/ssm-describe-instance-patch-states.ts @@ -0,0 +1,75 @@ +import { z } from 'zod' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' +import { validateAwsRegion } from '@/lib/core/security/input-validation' + +const INSTANCE_ID_PATTERN = /^(i-(\w{8}|\w{17})|mi-\w{17})$/ + +const InstancePatchStateSchema = z.object({ + instanceId: z.string(), + patchGroup: z.string(), + baselineId: z.string(), + snapshotId: z.string().nullable(), + ownerInformation: z.string().nullable(), + installedCount: z.number().nullable(), + installedOtherCount: z.number().nullable(), + installedPendingRebootCount: z.number().nullable(), + installedRejectedCount: z.number().nullable(), + missingCount: z.number().nullable(), + failedCount: z.number().nullable(), + unreportedNotApplicableCount: z.number().nullable(), + notApplicableCount: z.number().nullable(), + criticalNonCompliantCount: z.number().nullable(), + securityNonCompliantCount: z.number().nullable(), + otherNonCompliantCount: z.number().nullable(), + operation: z.string(), + operationStartTime: z.string().nullable(), + operationEndTime: z.string().nullable(), + lastNoRebootInstallOperationTime: z.string().nullable(), + rebootOption: z.string().nullable(), +}) + +const RequestSchema = z.object({ + region: z + .string() + .min(1, 'AWS region is required') + .refine((v) => validateAwsRegion(v).isValid, { + message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', + }), + accessKeyId: z.string().min(1, 'AWS access key ID is required'), + secretAccessKey: z.string().min(1, 'AWS secret access key is required'), + instanceIds: z + .array( + z.string().regex(INSTANCE_ID_PATTERN, 'instanceIds entries must look like i-0abc… or mi-…') + ) + .min(1, 'At least one instance ID is required') + .max(50, 'DescribeInstancePatchStates accepts at most 50 instance IDs'), + maxResults: z.number().int().min(10).max(100).nullish(), + nextToken: z.string().nullish(), +}) + +const ResponseSchema = z.object({ + instancePatchStates: z.array(InstancePatchStateSchema), + nextToken: z.string().nullable(), + count: z.number(), +}) + +export const awsSsmDescribeInstancePatchStatesContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/ssm/describe-instance-patch-states', + body: RequestSchema, + response: { mode: 'json', schema: ResponseSchema }, +}) +export type AwsSsmDescribeInstancePatchStatesRequest = ContractBodyInput< + typeof awsSsmDescribeInstancePatchStatesContract +> +export type AwsSsmDescribeInstancePatchStatesBody = ContractBody< + typeof awsSsmDescribeInstancePatchStatesContract +> +export type AwsSsmDescribeInstancePatchStatesResponse = ContractJsonResponse< + typeof awsSsmDescribeInstancePatchStatesContract +> diff --git a/apps/sim/lib/api/contracts/tools/aws/ssm-describe-instance-patches.ts b/apps/sim/lib/api/contracts/tools/aws/ssm-describe-instance-patches.ts new file mode 100644 index 00000000000..8f33b4390a0 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/ssm-describe-instance-patches.ts @@ -0,0 +1,62 @@ +import { z } from 'zod' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' +import { validateAwsRegion } from '@/lib/core/security/input-validation' + +const INSTANCE_ID_PATTERN = /^(i-(\w{8}|\w{17})|mi-\w{17})$/ + +const PatchOrchestratorFilterSchema = z.object({ + Key: z.string().min(1, 'Filter Key must not be empty').max(128).optional(), + Values: z.array(z.string().min(1).max(256)).min(1).optional(), +}) + +const PatchComplianceDataSchema = z.object({ + title: z.string(), + kbId: z.string(), + classification: z.string(), + severity: z.string(), + state: z.string(), + installedTime: z.string().nullable(), + cveIds: z.string().nullable(), +}) + +const RequestSchema = z.object({ + region: z + .string() + .min(1, 'AWS region is required') + .refine((v) => validateAwsRegion(v).isValid, { + message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', + }), + accessKeyId: z.string().min(1, 'AWS access key ID is required'), + secretAccessKey: z.string().min(1, 'AWS secret access key is required'), + instanceId: z.string().regex(INSTANCE_ID_PATTERN, 'instanceId must look like i-0abc… or mi-…'), + filters: z.array(PatchOrchestratorFilterSchema).max(5).nullish(), + maxResults: z.number().int().min(10).max(100).nullish(), + nextToken: z.string().nullish(), +}) + +const ResponseSchema = z.object({ + patches: z.array(PatchComplianceDataSchema), + nextToken: z.string().nullable(), + count: z.number(), +}) + +export const awsSsmDescribeInstancePatchesContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/ssm/describe-instance-patches', + body: RequestSchema, + response: { mode: 'json', schema: ResponseSchema }, +}) +export type AwsSsmDescribeInstancePatchesRequest = ContractBodyInput< + typeof awsSsmDescribeInstancePatchesContract +> +export type AwsSsmDescribeInstancePatchesBody = ContractBody< + typeof awsSsmDescribeInstancePatchesContract +> +export type AwsSsmDescribeInstancePatchesResponse = ContractJsonResponse< + typeof awsSsmDescribeInstancePatchesContract +> diff --git a/apps/sim/lib/api/contracts/tools/aws/ssm-describe-parameters.ts b/apps/sim/lib/api/contracts/tools/aws/ssm-describe-parameters.ts new file mode 100644 index 00000000000..85b3f319a8c --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/ssm-describe-parameters.ts @@ -0,0 +1,70 @@ +import { z } from 'zod' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' +import { validateAwsRegion } from '@/lib/core/security/input-validation' + +const ParameterStringFilterSchema = z.object({ + Key: z.string().min(1, 'Filter Key is required'), + Option: z.string().min(1).max(10).optional(), + Values: z.array(z.string().min(1)).min(1).max(50).optional(), +}) + +const ParameterMetadataSchema = z.object({ + name: z.string(), + arn: z.string(), + type: z.string(), + keyId: z.string().nullable(), + lastModifiedDate: z.string().nullable(), + lastModifiedUser: z.string().nullable(), + description: z.string().nullable(), + allowedPattern: z.string().nullable(), + version: z.number().nullable(), + tier: z.string().nullable(), + dataType: z.string().nullable(), + policies: z.array( + z.object({ + policyText: z.string().nullable(), + policyType: z.string().nullable(), + policyStatus: z.string().nullable(), + }) + ), +}) + +const RequestSchema = z.object({ + region: z + .string() + .min(1, 'AWS region is required') + .refine((v) => validateAwsRegion(v).isValid, { + message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', + }), + accessKeyId: z.string().min(1, 'AWS access key ID is required'), + secretAccessKey: z.string().min(1, 'AWS secret access key is required'), + parameterFilters: z.array(ParameterStringFilterSchema).nullish(), + shared: z.boolean().nullish(), + maxResults: z.number().int().min(1).max(50).nullish(), + nextToken: z.string().nullish(), +}) + +const ResponseSchema = z.object({ + parameters: z.array(ParameterMetadataSchema), + nextToken: z.string().nullable(), + count: z.number(), +}) + +export const awsSsmDescribeParametersContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/ssm/describe-parameters', + body: RequestSchema, + response: { mode: 'json', schema: ResponseSchema }, +}) +export type AwsSsmDescribeParametersRequest = ContractBodyInput< + typeof awsSsmDescribeParametersContract +> +export type AwsSsmDescribeParametersBody = ContractBody +export type AwsSsmDescribeParametersResponse = ContractJsonResponse< + typeof awsSsmDescribeParametersContract +> diff --git a/apps/sim/lib/api/contracts/tools/aws/ssm-get-automation-execution.ts b/apps/sim/lib/api/contracts/tools/aws/ssm-get-automation-execution.ts new file mode 100644 index 00000000000..fd45d43edb1 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/ssm-get-automation-execution.ts @@ -0,0 +1,80 @@ +import { z } from 'zod' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' +import { validateAwsRegion } from '@/lib/core/security/input-validation' + +const EXECUTION_ID_PATTERN = + /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/ + +const StepExecutionSchema = z.object({ + stepName: z.string().nullable(), + action: z.string().nullable(), + stepStatus: z.string().nullable(), + stepExecutionId: z.string().nullable(), + executionStartTime: z.string().nullable(), + executionEndTime: z.string().nullable(), + failureMessage: z.string().nullable(), + response: z.string().nullable(), + isEnd: z.boolean().nullable(), + nextStep: z.string().nullable(), +}) + +const RequestSchema = z.object({ + region: z + .string() + .min(1, 'AWS region is required') + .refine((v) => validateAwsRegion(v).isValid, { + message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', + }), + accessKeyId: z.string().min(1, 'AWS access key ID is required'), + secretAccessKey: z.string().min(1, 'AWS secret access key is required'), + automationExecutionId: z + .string() + .regex( + EXECUTION_ID_PATTERN, + 'automationExecutionId must be a 36-character automation execution ID' + ), +}) + +const ResponseSchema = z.object({ + automationExecutionId: z.string(), + documentName: z.string(), + documentVersion: z.string().nullable(), + automationExecutionStatus: z.string(), + executionStartTime: z.string().nullable(), + executionEndTime: z.string().nullable(), + executedBy: z.string().nullable(), + mode: z.string().nullable(), + parentAutomationExecutionId: z.string().nullable(), + currentStepName: z.string().nullable(), + currentAction: z.string().nullable(), + failureMessage: z.string().nullable(), + targetParameterName: z.string().nullable(), + target: z.string().nullable(), + maxConcurrency: z.string().nullable(), + maxErrors: z.string().nullable(), + parameters: z.record(z.string(), z.array(z.string())).nullable(), + outputs: z.record(z.string(), z.array(z.string())).nullable(), + stepExecutions: z.array(StepExecutionSchema), + stepExecutionsTruncated: z.boolean().nullable(), +}) + +export const awsSsmGetAutomationExecutionContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/ssm/get-automation-execution', + body: RequestSchema, + response: { mode: 'json', schema: ResponseSchema }, +}) +export type AwsSsmGetAutomationExecutionRequest = ContractBodyInput< + typeof awsSsmGetAutomationExecutionContract +> +export type AwsSsmGetAutomationExecutionBody = ContractBody< + typeof awsSsmGetAutomationExecutionContract +> +export type AwsSsmGetAutomationExecutionResponse = ContractJsonResponse< + typeof awsSsmGetAutomationExecutionContract +> diff --git a/apps/sim/lib/api/contracts/tools/aws/ssm-get-command-invocation.ts b/apps/sim/lib/api/contracts/tools/aws/ssm-get-command-invocation.ts new file mode 100644 index 00000000000..051a0f312dd --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/ssm-get-command-invocation.ts @@ -0,0 +1,60 @@ +import { z } from 'zod' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' +import { validateAwsRegion } from '@/lib/core/security/input-validation' + +const INSTANCE_ID_PATTERN = /^(i-(\w{8}|\w{17})|mi-\w{17})$/ + +const COMMAND_ID_PATTERN = + /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/ + +const RequestSchema = z.object({ + region: z + .string() + .min(1, 'AWS region is required') + .refine((v) => validateAwsRegion(v).isValid, { + message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', + }), + accessKeyId: z.string().min(1, 'AWS access key ID is required'), + secretAccessKey: z.string().min(1, 'AWS secret access key is required'), + commandId: z.string().regex(COMMAND_ID_PATTERN, 'commandId must be a 36-character command ID'), + instanceId: z.string().regex(INSTANCE_ID_PATTERN, 'instanceId must look like i-0abc… or mi-…'), + pluginName: z.string().min(4).nullish(), +}) + +const ResponseSchema = z.object({ + commandId: z.string(), + instanceId: z.string(), + comment: z.string().nullable(), + documentName: z.string().nullable(), + documentVersion: z.string().nullable(), + pluginName: z.string().nullable(), + responseCode: z.number().nullable(), + executionStartDateTime: z.string().nullable(), + executionElapsedTime: z.string().nullable(), + executionEndDateTime: z.string().nullable(), + status: z.string(), + statusDetails: z.string().nullable(), + standardOutputContent: z.string(), + standardOutputUrl: z.string().nullable(), + standardErrorContent: z.string(), + standardErrorUrl: z.string().nullable(), +}) + +export const awsSsmGetCommandInvocationContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/ssm/get-command-invocation', + body: RequestSchema, + response: { mode: 'json', schema: ResponseSchema }, +}) +export type AwsSsmGetCommandInvocationRequest = ContractBodyInput< + typeof awsSsmGetCommandInvocationContract +> +export type AwsSsmGetCommandInvocationBody = ContractBody +export type AwsSsmGetCommandInvocationResponse = ContractJsonResponse< + typeof awsSsmGetCommandInvocationContract +> diff --git a/apps/sim/lib/api/contracts/tools/aws/ssm-get-document.ts b/apps/sim/lib/api/contracts/tools/aws/ssm-get-document.ts new file mode 100644 index 00000000000..45fabff9958 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/ssm-get-document.ts @@ -0,0 +1,65 @@ +import { z } from 'zod' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' +import { validateAwsRegion } from '@/lib/core/security/input-validation' + +const DOCUMENT_NAME_PATTERN = /^[a-zA-Z0-9_\-.:/]{3,128}$/ + +const DOCUMENT_VERSION_PATTERN = /^(\$LATEST|\$DEFAULT|[1-9][0-9]*)$/ + +const RequestSchema = z.object({ + region: z + .string() + .min(1, 'AWS region is required') + .refine((v) => validateAwsRegion(v).isValid, { + message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', + }), + accessKeyId: z.string().min(1, 'AWS access key ID is required'), + secretAccessKey: z.string().min(1, 'AWS secret access key is required'), + name: z + .string() + .regex(DOCUMENT_NAME_PATTERN, 'name must be 3-128 characters of letters, digits, and _-.:/'), + documentVersion: z + .string() + .regex( + DOCUMENT_VERSION_PATTERN, + 'documentVersion must be $LATEST, $DEFAULT, or a positive version number' + ) + .nullish(), + versionName: z + .string() + .regex( + /^[a-zA-Z0-9_\-.]{1,128}$/, + 'versionName must be 1-128 characters of letters, digits, and _-.' + ) + .nullish(), + documentFormat: z.enum(['YAML', 'JSON', 'TEXT']).nullish(), +}) + +const ResponseSchema = z.object({ + name: z.string(), + displayName: z.string().nullable(), + createdDate: z.string().nullable(), + versionName: z.string().nullable(), + documentVersion: z.string().nullable(), + status: z.string().nullable(), + statusInformation: z.string().nullable(), + content: z.string(), + documentType: z.string().nullable(), + documentFormat: z.string().nullable(), + reviewStatus: z.string().nullable(), +}) + +export const awsSsmGetDocumentContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/ssm/get-document', + body: RequestSchema, + response: { mode: 'json', schema: ResponseSchema }, +}) +export type AwsSsmGetDocumentRequest = ContractBodyInput +export type AwsSsmGetDocumentBody = ContractBody +export type AwsSsmGetDocumentResponse = ContractJsonResponse diff --git a/apps/sim/lib/api/contracts/tools/aws/ssm-get-parameter.ts b/apps/sim/lib/api/contracts/tools/aws/ssm-get-parameter.ts new file mode 100644 index 00000000000..6f50c793d26 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/ssm-get-parameter.ts @@ -0,0 +1,45 @@ +import { z } from 'zod' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' +import { validateAwsRegion } from '@/lib/core/security/input-validation' + +const ParameterSchema = z.object({ + name: z.string(), + type: z.string(), + value: z.string(), + version: z.number().nullable(), + selector: z.string().nullable(), + sourceResult: z.string().nullable(), + lastModifiedDate: z.string().nullable(), + arn: z.string(), + dataType: z.string().nullable(), +}) + +const RequestSchema = z.object({ + region: z + .string() + .min(1, 'AWS region is required') + .refine((v) => validateAwsRegion(v).isValid, { + message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', + }), + accessKeyId: z.string().min(1, 'AWS access key ID is required'), + secretAccessKey: z.string().min(1, 'AWS secret access key is required'), + name: z.string().min(1, 'Parameter name is required').max(2048), + withDecryption: z.boolean().nullish(), +}) + +const ResponseSchema = ParameterSchema + +export const awsSsmGetParameterContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/ssm/get-parameter', + body: RequestSchema, + response: { mode: 'json', schema: ResponseSchema }, +}) +export type AwsSsmGetParameterRequest = ContractBodyInput +export type AwsSsmGetParameterBody = ContractBody +export type AwsSsmGetParameterResponse = ContractJsonResponse diff --git a/apps/sim/lib/api/contracts/tools/aws/ssm-get-parameters-by-path.ts b/apps/sim/lib/api/contracts/tools/aws/ssm-get-parameters-by-path.ts new file mode 100644 index 00000000000..13e03441277 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/ssm-get-parameters-by-path.ts @@ -0,0 +1,67 @@ +import { z } from 'zod' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' +import { validateAwsRegion } from '@/lib/core/security/input-validation' + +const ParameterStringFilterSchema = z.object({ + Key: z.string().min(1, 'Filter Key is required'), + Option: z.string().min(1).max(10).optional(), + Values: z.array(z.string().min(1)).min(1).max(50).optional(), +}) + +const ParameterSchema = z.object({ + name: z.string(), + type: z.string(), + value: z.string(), + version: z.number().nullable(), + selector: z.string().nullable(), + sourceResult: z.string().nullable(), + lastModifiedDate: z.string().nullable(), + arn: z.string(), + dataType: z.string().nullable(), +}) + +const RequestSchema = z.object({ + region: z + .string() + .min(1, 'AWS region is required') + .refine((v) => validateAwsRegion(v).isValid, { + message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', + }), + accessKeyId: z.string().min(1, 'AWS access key ID is required'), + secretAccessKey: z.string().min(1, 'AWS secret access key is required'), + path: z + .string() + .min(1, 'Parameter path is required') + .max(2048) + .startsWith('/', 'path must start with a forward slash (e.g., /prod/app)'), + recursive: z.boolean().nullish(), + withDecryption: z.boolean().nullish(), + parameterFilters: z.array(ParameterStringFilterSchema).nullish(), + maxResults: z.number().int().min(1).max(10).nullish(), + nextToken: z.string().nullish(), +}) + +const ResponseSchema = z.object({ + parameters: z.array(ParameterSchema), + nextToken: z.string().nullable(), + count: z.number(), +}) + +export const awsSsmGetParametersByPathContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/ssm/get-parameters-by-path', + body: RequestSchema, + response: { mode: 'json', schema: ResponseSchema }, +}) +export type AwsSsmGetParametersByPathRequest = ContractBodyInput< + typeof awsSsmGetParametersByPathContract +> +export type AwsSsmGetParametersByPathBody = ContractBody +export type AwsSsmGetParametersByPathResponse = ContractJsonResponse< + typeof awsSsmGetParametersByPathContract +> diff --git a/apps/sim/lib/api/contracts/tools/aws/ssm-get-parameters.ts b/apps/sim/lib/api/contracts/tools/aws/ssm-get-parameters.ts new file mode 100644 index 00000000000..0e529dfeb7a --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/ssm-get-parameters.ts @@ -0,0 +1,52 @@ +import { z } from 'zod' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' +import { validateAwsRegion } from '@/lib/core/security/input-validation' + +const ParameterSchema = z.object({ + name: z.string(), + type: z.string(), + value: z.string(), + version: z.number().nullable(), + selector: z.string().nullable(), + sourceResult: z.string().nullable(), + lastModifiedDate: z.string().nullable(), + arn: z.string(), + dataType: z.string().nullable(), +}) + +const RequestSchema = z.object({ + region: z + .string() + .min(1, 'AWS region is required') + .refine((v) => validateAwsRegion(v).isValid, { + message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', + }), + accessKeyId: z.string().min(1, 'AWS access key ID is required'), + secretAccessKey: z.string().min(1, 'AWS secret access key is required'), + names: z + .array(z.string().min(1).max(2048)) + .min(1, 'At least one parameter name is required') + .max(10, 'GetParameters accepts at most 10 names'), + withDecryption: z.boolean().nullish(), +}) + +const ResponseSchema = z.object({ + parameters: z.array(ParameterSchema), + invalidParameters: z.array(z.string()), + count: z.number(), +}) + +export const awsSsmGetParametersContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/ssm/get-parameters', + body: RequestSchema, + response: { mode: 'json', schema: ResponseSchema }, +}) +export type AwsSsmGetParametersRequest = ContractBodyInput +export type AwsSsmGetParametersBody = ContractBody +export type AwsSsmGetParametersResponse = ContractJsonResponse diff --git a/apps/sim/lib/api/contracts/tools/aws/ssm-list-command-invocations.ts b/apps/sim/lib/api/contracts/tools/aws/ssm-list-command-invocations.ts new file mode 100644 index 00000000000..a6a0850384a --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/ssm-list-command-invocations.ts @@ -0,0 +1,92 @@ +import { z } from 'zod' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' +import { validateAwsRegion } from '@/lib/core/security/input-validation' + +const INSTANCE_ID_PATTERN = /^(i-(\w{8}|\w{17})|mi-\w{17})$/ + +const COMMAND_ID_PATTERN = + /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/ + +const CommandFilterSchema = z.object({ + key: z.enum(['InvokedAfter', 'InvokedBefore', 'Status', 'DocumentName']), + value: z.string().min(1, 'Filter value is required').max(128), +}) + +const CommandPluginSchema = z.object({ + name: z.string(), + status: z.string(), + statusDetails: z.string().nullable(), + responseCode: z.number().nullable(), + responseStartDateTime: z.string().nullable(), + responseFinishDateTime: z.string().nullable(), + output: z.string().nullable(), + standardOutputUrl: z.string().nullable(), + standardErrorUrl: z.string().nullable(), +}) + +const CommandInvocationSchema = z.object({ + commandId: z.string(), + instanceId: z.string(), + instanceName: z.string().nullable(), + documentName: z.string().nullable(), + documentVersion: z.string().nullable(), + comment: z.string().nullable(), + requestedDateTime: z.string().nullable(), + status: z.string(), + statusDetails: z.string().nullable(), + traceOutput: z.string().nullable(), + standardOutputUrl: z.string().nullable(), + standardErrorUrl: z.string().nullable(), + serviceRole: z.string().nullable(), + commandPlugins: z.array(CommandPluginSchema), +}) + +const RequestSchema = z.object({ + region: z + .string() + .min(1, 'AWS region is required') + .refine((v) => validateAwsRegion(v).isValid, { + message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', + }), + accessKeyId: z.string().min(1, 'AWS access key ID is required'), + secretAccessKey: z.string().min(1, 'AWS secret access key is required'), + commandId: z + .string() + .regex(COMMAND_ID_PATTERN, 'commandId must be a 36-character command ID') + .nullish(), + instanceId: z + .string() + .regex(INSTANCE_ID_PATTERN, 'instanceId must look like i-0abc… or mi-…') + .nullish(), + filters: z.array(CommandFilterSchema).max(5).nullish(), + details: z.boolean().nullish(), + maxResults: z.number().int().min(1).max(50).nullish(), + nextToken: z.string().nullish(), +}) + +const ResponseSchema = z.object({ + commandInvocations: z.array(CommandInvocationSchema), + nextToken: z.string().nullable(), + count: z.number(), +}) + +export const awsSsmListCommandInvocationsContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/ssm/list-command-invocations', + body: RequestSchema, + response: { mode: 'json', schema: ResponseSchema }, +}) +export type AwsSsmListCommandInvocationsRequest = ContractBodyInput< + typeof awsSsmListCommandInvocationsContract +> +export type AwsSsmListCommandInvocationsBody = ContractBody< + typeof awsSsmListCommandInvocationsContract +> +export type AwsSsmListCommandInvocationsResponse = ContractJsonResponse< + typeof awsSsmListCommandInvocationsContract +> diff --git a/apps/sim/lib/api/contracts/tools/aws/ssm-list-commands.ts b/apps/sim/lib/api/contracts/tools/aws/ssm-list-commands.ts new file mode 100644 index 00000000000..5303a1ae734 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/ssm-list-commands.ts @@ -0,0 +1,85 @@ +import { z } from 'zod' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' +import { validateAwsRegion } from '@/lib/core/security/input-validation' + +const INSTANCE_ID_PATTERN = /^(i-(\w{8}|\w{17})|mi-\w{17})$/ + +const COMMAND_ID_PATTERN = + /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/ + +const CommandFilterSchema = z.object({ + key: z.enum(['InvokedAfter', 'InvokedBefore', 'Status', 'ExecutionStage', 'DocumentName']), + value: z.string().min(1, 'Filter value is required').max(128), +}) + +const TargetSchema = z.object({ + key: z.string().nullable(), + values: z.array(z.string()), +}) + +const CommandSchema = z.object({ + commandId: z.string(), + documentName: z.string(), + documentVersion: z.string().nullable(), + comment: z.string().nullable(), + status: z.string(), + statusDetails: z.string().nullable(), + requestedDateTime: z.string().nullable(), + expiresAfter: z.string().nullable(), + instanceIds: z.array(z.string()), + targets: z.array(TargetSchema), + maxConcurrency: z.string().nullable(), + maxErrors: z.string().nullable(), + targetCount: z.number().nullable(), + completedCount: z.number().nullable(), + errorCount: z.number().nullable(), + deliveryTimedOutCount: z.number().nullable(), + executionTimeoutSeconds: z.number().nullable(), + outputS3BucketName: z.string().nullable(), + outputS3KeyPrefix: z.string().nullable(), + outputS3Region: z.string().nullable(), + serviceRole: z.string().nullable(), +}) + +const RequestSchema = z.object({ + region: z + .string() + .min(1, 'AWS region is required') + .refine((v) => validateAwsRegion(v).isValid, { + message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', + }), + accessKeyId: z.string().min(1, 'AWS access key ID is required'), + secretAccessKey: z.string().min(1, 'AWS secret access key is required'), + commandId: z + .string() + .regex(COMMAND_ID_PATTERN, 'commandId must be a 36-character command ID') + .nullish(), + instanceId: z + .string() + .regex(INSTANCE_ID_PATTERN, 'instanceId must look like i-0abc… or mi-…') + .nullish(), + filters: z.array(CommandFilterSchema).max(5).nullish(), + maxResults: z.number().int().min(1).max(50).nullish(), + nextToken: z.string().nullish(), +}) + +const ResponseSchema = z.object({ + commands: z.array(CommandSchema), + nextToken: z.string().nullable(), + count: z.number(), +}) + +export const awsSsmListCommandsContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/ssm/list-commands', + body: RequestSchema, + response: { mode: 'json', schema: ResponseSchema }, +}) +export type AwsSsmListCommandsRequest = ContractBodyInput +export type AwsSsmListCommandsBody = ContractBody +export type AwsSsmListCommandsResponse = ContractJsonResponse diff --git a/apps/sim/lib/api/contracts/tools/aws/ssm-list-compliance-items.ts b/apps/sim/lib/api/contracts/tools/aws/ssm-list-compliance-items.ts new file mode 100644 index 00000000000..717e8a61ce6 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/ssm-list-compliance-items.ts @@ -0,0 +1,69 @@ +import { z } from 'zod' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' +import { validateAwsRegion } from '@/lib/core/security/input-validation' + +const ComplianceStringFilterSchema = z.object({ + Key: z.string().min(1).max(200).optional(), + Values: z.array(z.string().min(1)).min(1).max(20).optional(), + Type: z.enum(['EQUAL', 'NOT_EQUAL', 'BEGIN_WITH', 'LESS_THAN', 'GREATER_THAN']).optional(), +}) + +const ComplianceItemSchema = z.object({ + complianceType: z.string(), + resourceType: z.string(), + resourceId: z.string(), + id: z.string(), + title: z.string(), + status: z.string(), + severity: z.string(), + executionTime: z.string().nullable(), + executionId: z.string().nullable(), + executionType: z.string().nullable(), + details: z.record(z.string(), z.string()).nullable(), +}) + +const RequestSchema = z.object({ + region: z + .string() + .min(1, 'AWS region is required') + .refine((v) => validateAwsRegion(v).isValid, { + message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', + }), + accessKeyId: z.string().min(1, 'AWS access key ID is required'), + secretAccessKey: z.string().min(1, 'AWS secret access key is required'), + /** + * AWS documents "you can only specify one resource ID per call" for `ResourceIds`. + * `ResourceTypes` publishes a minimum of 1 item and no maximum, so it is left + * unbounded rather than inheriting a cap AWS never documented. + */ + resourceIds: z.array(z.string().min(1)).max(1).nullish(), + resourceTypes: z.array(z.string().min(1)).min(1).nullish(), + filters: z.array(ComplianceStringFilterSchema).nullish(), + maxResults: z.number().int().min(1).max(50).nullish(), + nextToken: z.string().nullish(), +}) + +const ResponseSchema = z.object({ + complianceItems: z.array(ComplianceItemSchema), + nextToken: z.string().nullable(), + count: z.number(), +}) + +export const awsSsmListComplianceItemsContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/ssm/list-compliance-items', + body: RequestSchema, + response: { mode: 'json', schema: ResponseSchema }, +}) +export type AwsSsmListComplianceItemsRequest = ContractBodyInput< + typeof awsSsmListComplianceItemsContract +> +export type AwsSsmListComplianceItemsBody = ContractBody +export type AwsSsmListComplianceItemsResponse = ContractJsonResponse< + typeof awsSsmListComplianceItemsContract +> diff --git a/apps/sim/lib/api/contracts/tools/aws/ssm-list-compliance-summaries.ts b/apps/sim/lib/api/contracts/tools/aws/ssm-list-compliance-summaries.ts new file mode 100644 index 00000000000..cb2a5d73168 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/ssm-list-compliance-summaries.ts @@ -0,0 +1,67 @@ +import { z } from 'zod' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' +import { validateAwsRegion } from '@/lib/core/security/input-validation' + +const ComplianceStringFilterSchema = z.object({ + Key: z.string().min(1).max(200).optional(), + Values: z.array(z.string().min(1)).min(1).max(20).optional(), + Type: z.enum(['EQUAL', 'NOT_EQUAL', 'BEGIN_WITH', 'LESS_THAN', 'GREATER_THAN']).optional(), +}) + +const SeveritySummarySchema = z.object({ + criticalCount: z.number().nullable(), + highCount: z.number().nullable(), + mediumCount: z.number().nullable(), + lowCount: z.number().nullable(), + informationalCount: z.number().nullable(), + unspecifiedCount: z.number().nullable(), +}) + +const ComplianceSummaryItemSchema = z.object({ + complianceType: z.string(), + compliantCount: z.number().nullable(), + compliantSeveritySummary: SeveritySummarySchema.nullable(), + nonCompliantCount: z.number().nullable(), + nonCompliantSeveritySummary: SeveritySummarySchema.nullable(), +}) + +const RequestSchema = z.object({ + region: z + .string() + .min(1, 'AWS region is required') + .refine((v) => validateAwsRegion(v).isValid, { + message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', + }), + accessKeyId: z.string().min(1, 'AWS access key ID is required'), + secretAccessKey: z.string().min(1, 'AWS secret access key is required'), + filters: z.array(ComplianceStringFilterSchema).nullish(), + maxResults: z.number().int().min(1).max(50).nullish(), + nextToken: z.string().nullish(), +}) + +const ResponseSchema = z.object({ + complianceSummaryItems: z.array(ComplianceSummaryItemSchema), + nextToken: z.string().nullable(), + count: z.number(), +}) + +export const awsSsmListComplianceSummariesContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/ssm/list-compliance-summaries', + body: RequestSchema, + response: { mode: 'json', schema: ResponseSchema }, +}) +export type AwsSsmListComplianceSummariesRequest = ContractBodyInput< + typeof awsSsmListComplianceSummariesContract +> +export type AwsSsmListComplianceSummariesBody = ContractBody< + typeof awsSsmListComplianceSummariesContract +> +export type AwsSsmListComplianceSummariesResponse = ContractJsonResponse< + typeof awsSsmListComplianceSummariesContract +> diff --git a/apps/sim/lib/api/contracts/tools/aws/ssm-list-documents.ts b/apps/sim/lib/api/contracts/tools/aws/ssm-list-documents.ts new file mode 100644 index 00000000000..f7ea4a0c1db --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/ssm-list-documents.ts @@ -0,0 +1,60 @@ +import { z } from 'zod' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' +import { validateAwsRegion } from '@/lib/core/security/input-validation' + +const DocumentKeyValuesFilterSchema = z.object({ + Key: z.string().min(1, 'Filter Key must not be empty').max(128).optional(), + Values: z.array(z.string().min(1).max(256)).optional(), +}) + +const DocumentIdentifierSchema = z.object({ + name: z.string(), + displayName: z.string().nullable(), + owner: z.string().nullable(), + createdDate: z.string().nullable(), + versionName: z.string().nullable(), + documentVersion: z.string().nullable(), + documentType: z.string().nullable(), + documentFormat: z.string().nullable(), + schemaVersion: z.string().nullable(), + platformTypes: z.array(z.string()), + targetType: z.string().nullable(), + reviewStatus: z.string().nullable(), + author: z.string().nullable(), + tags: z.array(z.object({ key: z.string(), value: z.string() })), +}) + +const RequestSchema = z.object({ + region: z + .string() + .min(1, 'AWS region is required') + .refine((v) => validateAwsRegion(v).isValid, { + message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', + }), + accessKeyId: z.string().min(1, 'AWS access key ID is required'), + secretAccessKey: z.string().min(1, 'AWS secret access key is required'), + filters: z.array(DocumentKeyValuesFilterSchema).max(6).nullish(), + maxResults: z.number().int().min(1).max(50).nullish(), + nextToken: z.string().nullish(), +}) + +const ResponseSchema = z.object({ + documents: z.array(DocumentIdentifierSchema), + nextToken: z.string().nullable(), + count: z.number(), +}) + +export const awsSsmListDocumentsContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/ssm/list-documents', + body: RequestSchema, + response: { mode: 'json', schema: ResponseSchema }, +}) +export type AwsSsmListDocumentsRequest = ContractBodyInput +export type AwsSsmListDocumentsBody = ContractBody +export type AwsSsmListDocumentsResponse = ContractJsonResponse diff --git a/apps/sim/lib/api/contracts/tools/aws/ssm-put-parameter.ts b/apps/sim/lib/api/contracts/tools/aws/ssm-put-parameter.ts new file mode 100644 index 00000000000..7801e008e24 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/ssm-put-parameter.ts @@ -0,0 +1,46 @@ +import { z } from 'zod' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' +import { validateAwsRegion } from '@/lib/core/security/input-validation' + +const RequestSchema = z.object({ + region: z + .string() + .min(1, 'AWS region is required') + .refine((v) => validateAwsRegion(v).isValid, { + message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', + }), + accessKeyId: z.string().min(1, 'AWS access key ID is required'), + secretAccessKey: z.string().min(1, 'AWS secret access key is required'), + name: z.string().min(1, 'Parameter name is required').max(2048), + value: z.string().min(1, 'Parameter value is required'), + type: z.enum(['String', 'StringList', 'SecureString']).nullish(), + description: z.string().max(1024).nullish(), + keyId: z.string().min(1).max(256).nullish(), + overwrite: z.boolean().nullish(), + allowedPattern: z.string().max(1024).nullish(), + tier: z.enum(['Standard', 'Advanced', 'Intelligent-Tiering']).nullish(), + dataType: z.string().max(128).nullish(), + policies: z.string().min(1).max(4096).nullish(), +}) + +const ResponseSchema = z.object({ + message: z.string(), + name: z.string(), + version: z.number().nullable(), + tier: z.string().nullable(), +}) + +export const awsSsmPutParameterContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/ssm/put-parameter', + body: RequestSchema, + response: { mode: 'json', schema: ResponseSchema }, +}) +export type AwsSsmPutParameterRequest = ContractBodyInput +export type AwsSsmPutParameterBody = ContractBody +export type AwsSsmPutParameterResponse = ContractJsonResponse diff --git a/apps/sim/lib/api/contracts/tools/aws/ssm-send-command.ts b/apps/sim/lib/api/contracts/tools/aws/ssm-send-command.ts new file mode 100644 index 00000000000..1a6a20d97f2 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/ssm-send-command.ts @@ -0,0 +1,129 @@ +import { z } from 'zod' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' +import { validateAwsRegion } from '@/lib/core/security/input-validation' + +const INSTANCE_ID_PATTERN = /^(i-(\w{8}|\w{17})|mi-\w{17})$/ + +const DOCUMENT_NAME_PATTERN = /^[a-zA-Z0-9_\-.:/]{3,128}$/ + +const DOCUMENT_VERSION_PATTERN = /^(\$LATEST|\$DEFAULT|[1-9][0-9]*)$/ + +const MAX_CONCURRENCY_PATTERN = /^([1-9][0-9]*|[1-9][0-9]%|[1-9]%|100%)$/ + +const MAX_ERRORS_PATTERN = /^([1-9][0-9]*|[0]|[1-9][0-9]%|[0-9]%|100%)$/ + +const TargetInputSchema = z.object({ + Key: z.string().min(1, 'Target Key is required'), + Values: z.array(z.string()).min(1, 'Target Values must contain at least one value'), +}) + +const TargetSchema = z.object({ + key: z.string().nullable(), + values: z.array(z.string()), +}) + +const CommandSchema = z.object({ + commandId: z.string(), + documentName: z.string(), + documentVersion: z.string().nullable(), + comment: z.string().nullable(), + status: z.string(), + statusDetails: z.string().nullable(), + requestedDateTime: z.string().nullable(), + expiresAfter: z.string().nullable(), + instanceIds: z.array(z.string()), + targets: z.array(TargetSchema), + maxConcurrency: z.string().nullable(), + maxErrors: z.string().nullable(), + targetCount: z.number().nullable(), + completedCount: z.number().nullable(), + errorCount: z.number().nullable(), + deliveryTimedOutCount: z.number().nullable(), + executionTimeoutSeconds: z.number().nullable(), + outputS3BucketName: z.string().nullable(), + outputS3KeyPrefix: z.string().nullable(), + outputS3Region: z.string().nullable(), + serviceRole: z.string().nullable(), +}) + +const RequestSchema = z.object({ + region: z + .string() + .min(1, 'AWS region is required') + .refine((v) => validateAwsRegion(v).isValid, { + message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', + }), + accessKeyId: z.string().min(1, 'AWS access key ID is required'), + secretAccessKey: z.string().min(1, 'AWS secret access key is required'), + documentName: z + .string() + .regex( + DOCUMENT_NAME_PATTERN, + 'documentName must be 3-128 characters of letters, digits, and _-.:/' + ), + documentVersion: z + .string() + .regex( + DOCUMENT_VERSION_PATTERN, + 'documentVersion must be $LATEST, $DEFAULT, or a positive version number' + ) + .nullish(), + instanceIds: z + .array( + z.string().regex(INSTANCE_ID_PATTERN, 'instanceIds entries must look like i-0abc… or mi-…') + ) + .max(50) + .nullish(), + targets: z.array(TargetInputSchema).max(5).nullish(), + comment: z.string().max(100, 'comment must be at most 100 characters').nullish(), + parameters: z.record(z.string(), z.array(z.string())).nullish(), + executionTimeoutSeconds: z + .number() + .int() + .min(30, 'executionTimeoutSeconds must be at least 30') + .max(2592000, 'executionTimeoutSeconds must be at most 2592000') + .nullish(), + maxConcurrency: z + .string() + .max(7, 'maxConcurrency must be at most 7 characters') + .regex( + MAX_CONCURRENCY_PATTERN, + 'maxConcurrency must be a positive number or a percentage such as 10%' + ) + .nullish(), + maxErrors: z + .string() + .max(7, 'maxErrors must be at most 7 characters') + .regex(MAX_ERRORS_PATTERN, 'maxErrors must be a number or a percentage such as 10%') + .nullish(), + outputS3BucketName: z.string().min(3).max(63).nullish(), + outputS3KeyPrefix: z.string().max(500).nullish(), + serviceRoleArn: z.string().nullish(), +}) + +const ResponseSchema = CommandSchema + +const SendCommandSchema = RequestSchema.superRefine((value, ctx) => { + if (!value.instanceIds?.length && !value.targets?.length) { + ctx.addIssue({ + code: 'custom', + path: ['instanceIds'], + message: 'Provide instanceIds or targets to say which managed nodes should run the command', + }) + } +}) + +export const awsSsmSendCommandContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/ssm/send-command', + body: SendCommandSchema, + response: { mode: 'json', schema: ResponseSchema }, +}) +export type AwsSsmSendCommandRequest = ContractBodyInput +export type AwsSsmSendCommandBody = ContractBody +export type AwsSsmSendCommandResponse = ContractJsonResponse diff --git a/apps/sim/lib/api/contracts/tools/aws/ssm-start-automation-execution.ts b/apps/sim/lib/api/contracts/tools/aws/ssm-start-automation-execution.ts new file mode 100644 index 00000000000..ec22acff717 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/ssm-start-automation-execution.ts @@ -0,0 +1,106 @@ +import { z } from 'zod' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' +import { validateAwsRegion } from '@/lib/core/security/input-validation' + +const DOCUMENT_NAME_PATTERN = /^[a-zA-Z0-9_\-.:/]{3,128}$/ + +const DOCUMENT_VERSION_PATTERN = /^(\$LATEST|\$DEFAULT|[1-9][0-9]*)$/ + +const MAX_CONCURRENCY_PATTERN = /^([1-9][0-9]*|[1-9][0-9]%|[1-9]%|100%)$/ + +const MAX_ERRORS_PATTERN = /^([1-9][0-9]*|[0]|[1-9][0-9]%|[0-9]%|100%)$/ + +const CLIENT_TOKEN_PATTERN = + /^[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}$/ + +const TargetInputSchema = z.object({ + Key: z.string().min(1, 'Target Key is required'), + Values: z.array(z.string()).min(1, 'Target Values must contain at least one value'), +}) + +const RequestSchema = z.object({ + region: z + .string() + .min(1, 'AWS region is required') + .refine((v) => validateAwsRegion(v).isValid, { + message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', + }), + accessKeyId: z.string().min(1, 'AWS access key ID is required'), + secretAccessKey: z.string().min(1, 'AWS secret access key is required'), + documentName: z + .string() + .regex( + DOCUMENT_NAME_PATTERN, + 'documentName must be 3-128 characters of letters, digits, and _-.:/' + ), + documentVersion: z + .string() + .regex( + DOCUMENT_VERSION_PATTERN, + 'documentVersion must be $LATEST, $DEFAULT, or a positive version number' + ) + .nullish(), + parameters: z.record(z.string(), z.array(z.string())).nullish(), + mode: z.enum(['Auto', 'Interactive']).nullish(), + targetParameterName: z.string().min(1).max(50).nullish(), + targets: z.array(TargetInputSchema).max(1).nullish(), + maxConcurrency: z + .string() + .max(7, 'maxConcurrency must be at most 7 characters') + .regex( + MAX_CONCURRENCY_PATTERN, + 'maxConcurrency must be a positive number or a percentage such as 10%' + ) + .nullish(), + maxErrors: z + .string() + .max(7, 'maxErrors must be at most 7 characters') + .regex(MAX_ERRORS_PATTERN, 'maxErrors must be a number or a percentage such as 10%') + .nullish(), + clientToken: z + .string() + .regex(CLIENT_TOKEN_PATTERN, 'clientToken must be a 36-character UUID') + .nullish(), +}) + +const ResponseSchema = z.object({ + automationExecutionId: z.string(), +}) + +const StartAutomationExecutionSchema = RequestSchema.superRefine((value, ctx) => { + if (value.targets?.length && !value.targetParameterName) { + ctx.addIssue({ + code: 'custom', + path: ['targetParameterName'], + message: 'targetParameterName is required when targets is set', + }) + } + if (value.targetParameterName && !value.targets?.length) { + ctx.addIssue({ + code: 'custom', + path: ['targets'], + message: 'targets is required when targetParameterName is set', + }) + } +}) + +export const awsSsmStartAutomationExecutionContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/ssm/start-automation-execution', + body: StartAutomationExecutionSchema, + response: { mode: 'json', schema: ResponseSchema }, +}) +export type AwsSsmStartAutomationExecutionRequest = ContractBodyInput< + typeof awsSsmStartAutomationExecutionContract +> +export type AwsSsmStartAutomationExecutionBody = ContractBody< + typeof awsSsmStartAutomationExecutionContract +> +export type AwsSsmStartAutomationExecutionResponse = ContractJsonResponse< + typeof awsSsmStartAutomationExecutionContract +> diff --git a/apps/sim/lib/api/contracts/tools/aws/ssm-stop-automation-execution.ts b/apps/sim/lib/api/contracts/tools/aws/ssm-stop-automation-execution.ts new file mode 100644 index 00000000000..b8cfb2571d4 --- /dev/null +++ b/apps/sim/lib/api/contracts/tools/aws/ssm-stop-automation-execution.ts @@ -0,0 +1,50 @@ +import { z } from 'zod' +import type { + ContractBody, + ContractBodyInput, + ContractJsonResponse, +} from '@/lib/api/contracts/types' +import { defineRouteContract } from '@/lib/api/contracts/types' +import { validateAwsRegion } from '@/lib/core/security/input-validation' + +const EXECUTION_ID_PATTERN = + /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/ + +const RequestSchema = z.object({ + region: z + .string() + .min(1, 'AWS region is required') + .refine((v) => validateAwsRegion(v).isValid, { + message: 'Invalid AWS region format (e.g., us-east-1, eu-west-2)', + }), + accessKeyId: z.string().min(1, 'AWS access key ID is required'), + secretAccessKey: z.string().min(1, 'AWS secret access key is required'), + automationExecutionId: z + .string() + .regex( + EXECUTION_ID_PATTERN, + 'automationExecutionId must be a 36-character automation execution ID' + ), + stopType: z.enum(['Complete', 'Cancel']).nullish(), +}) + +const ResponseSchema = z.object({ + message: z.string(), + automationExecutionId: z.string(), +}) + +export const awsSsmStopAutomationExecutionContract = defineRouteContract({ + method: 'POST', + path: '/api/tools/ssm/stop-automation-execution', + body: RequestSchema, + response: { mode: 'json', schema: ResponseSchema }, +}) +export type AwsSsmStopAutomationExecutionRequest = ContractBodyInput< + typeof awsSsmStopAutomationExecutionContract +> +export type AwsSsmStopAutomationExecutionBody = ContractBody< + typeof awsSsmStopAutomationExecutionContract +> +export type AwsSsmStopAutomationExecutionResponse = ContractJsonResponse< + typeof awsSsmStopAutomationExecutionContract +> diff --git a/apps/sim/lib/copilot/generated/docs-manifest.ts b/apps/sim/lib/copilot/generated/docs-manifest.ts index 5ed059db8d4..86005762478 100644 --- a/apps/sim/lib/copilot/generated/docs-manifest.ts +++ b/apps/sim/lib/copilot/generated/docs-manifest.ts @@ -103,6 +103,7 @@ export const DOCS_MANIFEST: readonly string[] = [ 'integrations/clickup.mdx', 'integrations/cloudflare.mdx', 'integrations/cloudformation.mdx', + 'integrations/cloudtrail.mdx', 'integrations/cloudwatch.mdx', 'integrations/codepipeline.mdx', 'integrations/confluence.mdx', @@ -308,6 +309,7 @@ export const DOCS_MANIFEST: readonly string[] = [ 'integrations/sqs.mdx', 'integrations/square.mdx', 'integrations/ssh.mdx', + 'integrations/ssm.mdx', 'integrations/stagehand.mdx', 'integrations/stripe.mdx', 'integrations/sts.mdx', diff --git a/apps/sim/lib/core/security/aws-region-partitions.test.ts b/apps/sim/lib/core/security/aws-region-partitions.test.ts new file mode 100644 index 00000000000..93f58489771 --- /dev/null +++ b/apps/sim/lib/core/security/aws-region-partitions.test.ts @@ -0,0 +1,32 @@ +import { describe, expect, it } from 'vitest' +import { validateAwsRegion } from '@/lib/core/security/input-validation' + +const ok = [ + 'us-east-1', + 'eu-west-2', + 'us-gov-west-1', + 'cn-northwest-1', + 'us-iso-east-1', + 'us-isob-east-1', + 'eu-isoe-west-1', + 'eusc-de-east-1', + 'us-isof-south-1', + 'us-isof-east-1', + 'ap-southeast-4', + 'me-central-1', +] +const bad = [ + '', + 'us-east', + 'US-EAST-1', + 'us-east-1.evil.com', + 'us-east-1/x', + 'us-isog-east-1', + '../us-east-1', + 'us-east-1:80', +] +describe('validateAwsRegion partitions', () => { + for (const r of ok) it(`accepts ${r}`, () => expect(validateAwsRegion(r).isValid).toBe(true)) + for (const r of bad) + it(`rejects ${JSON.stringify(r)}`, () => expect(validateAwsRegion(r).isValid).toBe(false)) +}) diff --git a/apps/sim/lib/core/security/input-validation.ts b/apps/sim/lib/core/security/input-validation.ts index 21f88bef1e1..9aeb1b6eb19 100644 --- a/apps/sim/lib/core/security/input-validation.ts +++ b/apps/sim/lib/core/security/input-validation.ts @@ -630,8 +630,13 @@ export function validateAwsRegion( } } + /** + * Partition prefixes are matched longest-first: `us-isob` and `us-isof` must precede + * `us-iso`, or the shorter alternative wins and the trailing partition letter fails to + * match the following `-`. + */ const awsRegionPattern = - /^(eu-isoe|eusc-[a-z]{2}|us-isob|us-iso|us-gov|af|ap|ca|cn|eu|il|me|mx|sa|us)-(central|north|northeast|northwest|south|southeast|southwest|east|west)-\d{1,2}$/ + /^(eu-isoe|eusc-[a-z]{2}|us-isob|us-isof|us-iso|us-gov|af|ap|ca|cn|eu|il|me|mx|sa|us)-(central|north|northeast|northwest|south|southeast|southwest|east|west)-\d{1,2}$/ if (!awsRegionPattern.test(value)) { logger.warn('Invalid AWS region format', { diff --git a/apps/sim/lib/integrations/icon-mapping.ts b/apps/sim/lib/integrations/icon-mapping.ts index e69efda4d5e..a9318bcd494 100644 --- a/apps/sim/lib/integrations/icon-mapping.ts +++ b/apps/sim/lib/integrations/icon-mapping.ts @@ -44,6 +44,7 @@ import { ClickUpIcon, CloudFormationIcon, CloudflareIcon, + CloudTrailIcon, CloudWatchIcon, CodePipelineIcon, ConfluenceIcon, @@ -233,6 +234,7 @@ import { SportmonksIcon, SQSIcon, SquareIcon, + SSMIcon, SshIcon, STSIcon, STTIcon, @@ -315,6 +317,7 @@ export const blockTypeToIconMap: Record = { clickup: ClickUpIcon, cloudflare: CloudflareIcon, cloudformation: CloudFormationIcon, + cloudtrail: CloudTrailIcon, cloudwatch: CloudWatchIcon, codepipeline: CodePipelineIcon, confluence: ConfluenceIcon, @@ -527,6 +530,7 @@ export const blockTypeToIconMap: Record = { sqs: SQSIcon, square: SquareIcon, ssh: SshIcon, + ssm: SSMIcon, stagehand: StagehandIcon, stripe: StripeIcon, sts: STSIcon, diff --git a/apps/sim/lib/internal/cloudtrail/client.ts b/apps/sim/lib/internal/cloudtrail/client.ts new file mode 100644 index 00000000000..3d5b13d7bd9 --- /dev/null +++ b/apps/sim/lib/internal/cloudtrail/client.ts @@ -0,0 +1,36 @@ +import { CloudTrailClient } from '@aws-sdk/client-cloudtrail' + +export interface CloudTrailConnectionConfig { + region: string + accessKeyId: string + secretAccessKey: string +} + +/** + * Attempts allowed for `LookupEvents`, which AWS throttles at two requests per + * second per account per Region. Paired with adaptive retry mode so the SDK's + * client-side rate limiter absorbs `ThrottlingException` with exponential + * backoff and jitter instead of failing the tool run. + */ +const THROTTLE_SENSITIVE_MAX_ATTEMPTS = 6 + +export interface CreateCloudTrailClientOptions { + /** Use AWS adaptive retry mode with a raised attempt ceiling. */ + throttleSensitive?: boolean +} + +export function createCloudTrailClient( + config: CloudTrailConnectionConfig, + options: CreateCloudTrailClientOptions = {} +): CloudTrailClient { + return new CloudTrailClient({ + region: config.region, + credentials: { + accessKeyId: config.accessKeyId, + secretAccessKey: config.secretAccessKey, + }, + ...(options.throttleSensitive + ? { retryMode: 'adaptive', maxAttempts: THROTTLE_SENSITIVE_MAX_ATTEMPTS } + : {}), + }) +} diff --git a/apps/sim/lib/internal/cloudtrail/execute-tool.test.ts b/apps/sim/lib/internal/cloudtrail/execute-tool.test.ts new file mode 100644 index 00000000000..ffbb518277a --- /dev/null +++ b/apps/sim/lib/internal/cloudtrail/execute-tool.test.ts @@ -0,0 +1,197 @@ +/** + * @vitest-environment node + */ +import { beforeEach, describe, expect, it, vi } from 'vitest' + +const mockOperations = vi.hoisted(() => ({ + executeCloudtrailCancelQuery: vi.fn(), + executeCloudtrailDescribeQuery: vi.fn(), + executeCloudtrailDescribeTrails: vi.fn(), + executeCloudtrailGetEventDataStore: vi.fn(), + executeCloudtrailGetEventSelectors: vi.fn(), + executeCloudtrailGetInsightSelectors: vi.fn(), + executeCloudtrailGetQueryResults: vi.fn(), + executeCloudtrailGetTrail: vi.fn(), + executeCloudtrailGetTrailStatus: vi.fn(), + executeCloudtrailListEventDataStores: vi.fn(), + executeCloudtrailListTags: vi.fn(), + executeCloudtrailListTrails: vi.fn(), + executeCloudtrailLookupEvents: vi.fn(), + executeCloudtrailStartQuery: vi.fn(), +})) + +vi.mock('@/lib/internal/cloudtrail/operations', () => mockOperations) + +import { executeCloudtrailTool } from '@/lib/internal/cloudtrail/execute-tool' +import type { InternalToolOperationCall } from '@/lib/internal/tool-operations/types' + +const CONNECTION = { + region: 'us-east-1', + accessKeyId: 'access-key', + secretAccessKey: 'secret-key', +} + +const TRAIL_ARN = 'arn:aws:cloudtrail:us-east-1:123456789012:trail/my-trail' +const EVENT_DATA_STORE_ARN = + 'arn:aws:cloudtrail:us-east-1:123456789012:eventdatastore/11111111-2222-3333-4444-555555555555' +const QUERY_ID = '11111111-2222-3333-4444-555555555555' + +function createRequest( + overrides: Partial = {} +): InternalToolOperationCall { + return { + toolId: 'cloudtrail_list_trails', + input: CONNECTION, + headers: new Headers({ 'content-type': 'application/json' }), + context: { + workflowId: 'workflow-1', + workspaceId: 'workspace-1', + userId: 'user-1', + metadata: {}, + }, + requestId: 'request-1', + ...overrides, + } +} + +const TOOL_CASES = [ + [ + 'cloudtrail_cancel_query', + { ...CONNECTION, queryId: QUERY_ID }, + mockOperations.executeCloudtrailCancelQuery, + ], + [ + 'cloudtrail_describe_query', + { ...CONNECTION, queryId: QUERY_ID }, + mockOperations.executeCloudtrailDescribeQuery, + ], + ['cloudtrail_describe_trails', CONNECTION, mockOperations.executeCloudtrailDescribeTrails], + [ + 'cloudtrail_get_event_data_store', + { ...CONNECTION, eventDataStore: EVENT_DATA_STORE_ARN }, + mockOperations.executeCloudtrailGetEventDataStore, + ], + [ + 'cloudtrail_get_event_selectors', + { ...CONNECTION, trailName: 'my-trail' }, + mockOperations.executeCloudtrailGetEventSelectors, + ], + [ + 'cloudtrail_get_insight_selectors', + { ...CONNECTION, trailName: 'my-trail' }, + mockOperations.executeCloudtrailGetInsightSelectors, + ], + [ + 'cloudtrail_get_query_results', + { ...CONNECTION, queryId: QUERY_ID }, + mockOperations.executeCloudtrailGetQueryResults, + ], + [ + 'cloudtrail_get_trail', + { ...CONNECTION, name: TRAIL_ARN }, + mockOperations.executeCloudtrailGetTrail, + ], + [ + 'cloudtrail_get_trail_status', + { ...CONNECTION, name: 'my-trail' }, + mockOperations.executeCloudtrailGetTrailStatus, + ], + [ + 'cloudtrail_list_event_data_stores', + CONNECTION, + mockOperations.executeCloudtrailListEventDataStores, + ], + [ + 'cloudtrail_list_tags', + { ...CONNECTION, resourceIdList: [TRAIL_ARN] }, + mockOperations.executeCloudtrailListTags, + ], + ['cloudtrail_list_trails', CONNECTION, mockOperations.executeCloudtrailListTrails], + ['cloudtrail_lookup_events', CONNECTION, mockOperations.executeCloudtrailLookupEvents], + [ + 'cloudtrail_start_query', + { ...CONNECTION, queryStatement: 'SELECT eventID FROM eds LIMIT 1' }, + mockOperations.executeCloudtrailStartQuery, + ], +] as const + +describe('executeCloudtrailTool', () => { + beforeEach(() => { + vi.clearAllMocks() + }) + + it.each(TOOL_CASES)('routes %s to its operation', async (toolId, input, operation) => { + operation.mockResolvedValue({ success: true, output: {} }) + + const response = await executeCloudtrailTool(createRequest({ toolId, input })) + + expect(response.status).toBe(200) + expect(operation).toHaveBeenCalledTimes(1) + }) + + it('rejects an unsupported tool id', async () => { + const response = await executeCloudtrailTool(createRequest({ toolId: 'cloudtrail_nope' })) + + expect(response.status).toBe(500) + await expect(response.json()).resolves.toEqual({ + error: 'Unsupported CloudTrail tool: cloudtrail_nope', + }) + }) + + it('rejects input that fails contract validation before calling the operation', async () => { + const response = await executeCloudtrailTool( + createRequest({ + toolId: 'cloudtrail_get_query_results', + input: { ...CONNECTION, queryId: 'not-a-query-id' }, + }) + ) + + expect(response.status).toBe(400) + expect(mockOperations.executeCloudtrailGetQueryResults).not.toHaveBeenCalled() + }) + + it('rejects a lookup that names an attribute key without a value', async () => { + const response = await executeCloudtrailTool( + createRequest({ + toolId: 'cloudtrail_lookup_events', + input: { ...CONNECTION, attributeKey: 'Username' }, + }) + ) + + expect(response.status).toBe(400) + expect(mockOperations.executeCloudtrailLookupEvents).not.toHaveBeenCalled() + }) + + it('rejects a region outside the documented AWS partitions', async () => { + const response = await executeCloudtrailTool( + createRequest({ toolId: 'cloudtrail_list_trails', input: { ...CONNECTION, region: 'nope' } }) + ) + + expect(response.status).toBe(400) + expect(mockOperations.executeCloudtrailListTrails).not.toHaveBeenCalled() + }) + + it('accepts GovCloud and China partition regions', async () => { + mockOperations.executeCloudtrailListTrails.mockResolvedValue({ success: true, output: {} }) + + for (const region of ['us-gov-west-1', 'cn-north-1']) { + const response = await executeCloudtrailTool( + createRequest({ toolId: 'cloudtrail_list_trails', input: { ...CONNECTION, region } }) + ) + expect(response.status).toBe(200) + } + + expect(mockOperations.executeCloudtrailListTrails).toHaveBeenCalledTimes(2) + }) + + it('surfaces an operation failure as a 500 with its message', async () => { + mockOperations.executeCloudtrailLookupEvents.mockRejectedValue(new Error('Rate exceeded')) + + const response = await executeCloudtrailTool( + createRequest({ toolId: 'cloudtrail_lookup_events' }) + ) + + expect(response.status).toBe(500) + await expect(response.json()).resolves.toEqual({ error: 'Rate exceeded' }) + }) +}) diff --git a/apps/sim/lib/internal/cloudtrail/execute-tool.ts b/apps/sim/lib/internal/cloudtrail/execute-tool.ts new file mode 100644 index 00000000000..b450f3a84ad --- /dev/null +++ b/apps/sim/lib/internal/cloudtrail/execute-tool.ts @@ -0,0 +1,179 @@ +import { getErrorMessage } from '@sim/utils/errors' +import type { AnyApiRouteContract, ContractBody } from '@/lib/api/contracts' +import { awsCloudtrailCancelQueryContract } from '@/lib/api/contracts/tools/aws/cloudtrail-cancel-query' +import { awsCloudtrailDescribeQueryContract } from '@/lib/api/contracts/tools/aws/cloudtrail-describe-query' +import { awsCloudtrailDescribeTrailsContract } from '@/lib/api/contracts/tools/aws/cloudtrail-describe-trails' +import { awsCloudtrailGetEventDataStoreContract } from '@/lib/api/contracts/tools/aws/cloudtrail-get-event-data-store' +import { awsCloudtrailGetEventSelectorsContract } from '@/lib/api/contracts/tools/aws/cloudtrail-get-event-selectors' +import { awsCloudtrailGetInsightSelectorsContract } from '@/lib/api/contracts/tools/aws/cloudtrail-get-insight-selectors' +import { awsCloudtrailGetQueryResultsContract } from '@/lib/api/contracts/tools/aws/cloudtrail-get-query-results' +import { awsCloudtrailGetTrailContract } from '@/lib/api/contracts/tools/aws/cloudtrail-get-trail' +import { awsCloudtrailGetTrailStatusContract } from '@/lib/api/contracts/tools/aws/cloudtrail-get-trail-status' +import { awsCloudtrailListEventDataStoresContract } from '@/lib/api/contracts/tools/aws/cloudtrail-list-event-data-stores' +import { awsCloudtrailListTagsContract } from '@/lib/api/contracts/tools/aws/cloudtrail-list-tags' +import { awsCloudtrailListTrailsContract } from '@/lib/api/contracts/tools/aws/cloudtrail-list-trails' +import { awsCloudtrailLookupEventsContract } from '@/lib/api/contracts/tools/aws/cloudtrail-lookup-events' +import { awsCloudtrailStartQueryContract } from '@/lib/api/contracts/tools/aws/cloudtrail-start-query' +import { + executeCloudtrailCancelQuery, + executeCloudtrailDescribeQuery, + executeCloudtrailDescribeTrails, + executeCloudtrailGetEventDataStore, + executeCloudtrailGetEventSelectors, + executeCloudtrailGetInsightSelectors, + executeCloudtrailGetQueryResults, + executeCloudtrailGetTrail, + executeCloudtrailGetTrailStatus, + executeCloudtrailListEventDataStores, + executeCloudtrailListTags, + executeCloudtrailListTrails, + executeCloudtrailLookupEvents, + executeCloudtrailStartQuery, +} from '@/lib/internal/cloudtrail/operations' +import { parseInternalToolInput } from '@/lib/internal/tool-operations/parse-input' +import type { InternalToolOperationHandler } from '@/lib/internal/tool-operations/types' + +async function executeOperation( + contract: C, + input: unknown, + execute: (input: ContractBody, signal?: AbortSignal) => Promise, + fallbackError: string, + signal?: AbortSignal +): Promise { + signal?.throwIfAborted() + const parsed = parseInternalToolInput(contract, input) + if (!parsed.success) return parsed.response + + try { + const result = await execute(parsed.data, signal) + signal?.throwIfAborted() + return Response.json(result) + } catch (error) { + signal?.throwIfAborted() + return Response.json({ error: getErrorMessage(error, fallbackError) }, { status: 500 }) + } +} + +export const executeCloudtrailTool: InternalToolOperationHandler = async ({ + toolId, + input, + signal, +}) => { + signal?.throwIfAborted() + switch (toolId) { + case 'cloudtrail_cancel_query': + return executeOperation( + awsCloudtrailCancelQueryContract, + input, + executeCloudtrailCancelQuery, + 'Failed to cancel CloudTrail Lake query', + signal + ) + case 'cloudtrail_describe_query': + return executeOperation( + awsCloudtrailDescribeQueryContract, + input, + executeCloudtrailDescribeQuery, + 'Failed to describe CloudTrail Lake query', + signal + ) + case 'cloudtrail_describe_trails': + return executeOperation( + awsCloudtrailDescribeTrailsContract, + input, + executeCloudtrailDescribeTrails, + 'Failed to describe CloudTrail trails', + signal + ) + case 'cloudtrail_get_event_data_store': + return executeOperation( + awsCloudtrailGetEventDataStoreContract, + input, + executeCloudtrailGetEventDataStore, + 'Failed to get CloudTrail event data store', + signal + ) + case 'cloudtrail_get_event_selectors': + return executeOperation( + awsCloudtrailGetEventSelectorsContract, + input, + executeCloudtrailGetEventSelectors, + 'Failed to get CloudTrail event selectors', + signal + ) + case 'cloudtrail_get_insight_selectors': + return executeOperation( + awsCloudtrailGetInsightSelectorsContract, + input, + executeCloudtrailGetInsightSelectors, + 'Failed to get CloudTrail Insights selectors', + signal + ) + case 'cloudtrail_get_query_results': + return executeOperation( + awsCloudtrailGetQueryResultsContract, + input, + executeCloudtrailGetQueryResults, + 'Failed to get CloudTrail Lake query results', + signal + ) + case 'cloudtrail_get_trail': + return executeOperation( + awsCloudtrailGetTrailContract, + input, + executeCloudtrailGetTrail, + 'Failed to get CloudTrail trail', + signal + ) + case 'cloudtrail_get_trail_status': + return executeOperation( + awsCloudtrailGetTrailStatusContract, + input, + executeCloudtrailGetTrailStatus, + 'Failed to get CloudTrail trail status', + signal + ) + case 'cloudtrail_list_event_data_stores': + return executeOperation( + awsCloudtrailListEventDataStoresContract, + input, + executeCloudtrailListEventDataStores, + 'Failed to list CloudTrail event data stores', + signal + ) + case 'cloudtrail_list_tags': + return executeOperation( + awsCloudtrailListTagsContract, + input, + executeCloudtrailListTags, + 'Failed to list CloudTrail resource tags', + signal + ) + case 'cloudtrail_list_trails': + return executeOperation( + awsCloudtrailListTrailsContract, + input, + executeCloudtrailListTrails, + 'Failed to list CloudTrail trails', + signal + ) + case 'cloudtrail_lookup_events': + return executeOperation( + awsCloudtrailLookupEventsContract, + input, + executeCloudtrailLookupEvents, + 'Failed to look up CloudTrail events', + signal + ) + case 'cloudtrail_start_query': + return executeOperation( + awsCloudtrailStartQueryContract, + input, + executeCloudtrailStartQuery, + 'Failed to start CloudTrail Lake query', + signal + ) + default: + return Response.json({ error: `Unsupported CloudTrail tool: ${toolId}` }, { status: 500 }) + } +} diff --git a/apps/sim/lib/internal/cloudtrail/operations.test.ts b/apps/sim/lib/internal/cloudtrail/operations.test.ts new file mode 100644 index 00000000000..62b4f012a2a --- /dev/null +++ b/apps/sim/lib/internal/cloudtrail/operations.test.ts @@ -0,0 +1,167 @@ +/** + * @vitest-environment node + */ +import { beforeEach, describe, expect, it, vi } from 'vitest' + +const mocks = vi.hoisted(() => ({ + createCloudTrailClient: vi.fn(), + destroy: vi.fn(), + send: vi.fn(), +})) + +vi.mock('@/lib/internal/cloudtrail/client', () => ({ + createCloudTrailClient: mocks.createCloudTrailClient, +})) + +import { + executeCloudtrailCancelQuery, + executeCloudtrailDescribeTrails, + executeCloudtrailGetQueryResults, + executeCloudtrailListTrails, + executeCloudtrailLookupEvents, +} from '@/lib/internal/cloudtrail/operations' + +const CONNECTION = { + region: 'eu-west-2', + accessKeyId: 'access-key', + secretAccessKey: 'secret-key', +} + +describe('CloudTrail operations', () => { + beforeEach(() => { + vi.clearAllMocks() + mocks.createCloudTrailClient.mockReturnValue({ send: mocks.send, destroy: mocks.destroy }) + }) + + it('parses CloudTrailEvent into a structured record and forwards cancellation', async () => { + const controller = new AbortController() + mocks.send.mockResolvedValue({ + Events: [ + { + EventId: 'event-1', + EventName: 'ConsoleLogin', + ReadOnly: 'false', + AccessKeyId: 'AKIAEXAMPLE', + EventTime: new Date('2026-09-01T12:00:00.000Z'), + EventSource: 'signin.amazonaws.com', + Username: 'alice', + Resources: [{ ResourceType: 'AWS::S3::Bucket', ResourceName: 'my-bucket' }], + CloudTrailEvent: JSON.stringify({ + sourceIPAddress: '203.0.113.10', + userIdentity: { type: 'IAMUser', arn: 'arn:aws:iam::123456789012:user/alice' }, + }), + }, + ], + NextToken: 'next-page', + }) + + const result = await executeCloudtrailLookupEvents( + { ...CONNECTION, attributeKey: 'Username', attributeValue: 'alice', maxResults: 10 }, + controller.signal + ) + + const [command, options] = mocks.send.mock.calls[0] + expect(command.input).toEqual({ + LookupAttributes: [{ AttributeKey: 'Username', AttributeValue: 'alice' }], + MaxResults: 10, + }) + expect(options).toEqual({ abortSignal: controller.signal }) + + expect(result.output.events[0].cloudTrailEvent).toEqual({ + sourceIPAddress: '203.0.113.10', + userIdentity: { type: 'IAMUser', arn: 'arn:aws:iam::123456789012:user/alice' }, + }) + expect(result.output.events[0].cloudTrailEventRaw).toBeNull() + expect(result.output.events[0].eventTime).toBe('2026-09-01T12:00:00.000Z') + expect(result.output.nextToken).toBe('next-page') + expect(mocks.destroy).toHaveBeenCalledTimes(1) + }) + + it('preserves an unparseable CloudTrailEvent as the raw string rather than dropping it', async () => { + mocks.send.mockResolvedValue({ Events: [{ EventId: 'event-1', CloudTrailEvent: 'not json' }] }) + + const result = await executeCloudtrailLookupEvents(CONNECTION) + + expect(result.output.events[0].cloudTrailEvent).toBeNull() + expect(result.output.events[0].cloudTrailEventRaw).toBe('not json') + }) + + it('uses adaptive retry only for the throttle-limited lookup operation', async () => { + mocks.send.mockResolvedValue({ Trails: [] }) + await executeCloudtrailListTrails(CONNECTION) + expect(mocks.createCloudTrailClient).toHaveBeenLastCalledWith( + expect.objectContaining(CONNECTION), + undefined + ) + + mocks.send.mockResolvedValue({ Events: [] }) + await executeCloudtrailLookupEvents(CONNECTION) + expect(mocks.createCloudTrailClient).toHaveBeenLastCalledWith( + expect.objectContaining(CONNECTION), + { throttleSensitive: true } + ) + }) + + it('threads the caller region through without overriding it', async () => { + mocks.send.mockResolvedValue({ Trails: [] }) + + await executeCloudtrailListTrails({ ...CONNECTION, region: 'us-gov-west-1' }) + + expect(mocks.createCloudTrailClient).toHaveBeenCalledWith( + expect.objectContaining({ region: 'us-gov-west-1' }), + undefined + ) + }) + + it('omits includeShadowTrails when unset so the AWS default applies', async () => { + mocks.send.mockResolvedValue({ trailList: [] }) + + await executeCloudtrailDescribeTrails(CONNECTION) + + expect(mocks.send.mock.calls[0][0].input).toEqual({}) + }) + + it('flattens Lake result rows into one object per row', async () => { + mocks.send.mockResolvedValue({ + QueryStatus: 'FINISHED', + QueryResultRows: [ + [{ eventName: 'ConsoleLogin' }, { eventCount: '12' }], + [{ eventName: 'AssumeRole' }, { eventCount: '4' }], + ], + QueryStatistics: { ResultsCount: 2, TotalResultsCount: 2, BytesScanned: 1024 }, + NextToken: 'next-page', + }) + + const result = await executeCloudtrailGetQueryResults({ + ...CONNECTION, + queryId: '11111111-2222-3333-4444-555555555555', + maxQueryResults: 2, + }) + + expect(result.output.rows).toEqual([ + { eventName: 'ConsoleLogin', eventCount: '12' }, + { eventName: 'AssumeRole', eventCount: '4' }, + ]) + expect(result.output.totalResultsCount).toBe(2) + expect(result.output.nextToken).toBe('next-page') + }) + + it('reports the status AWS returned for a cancellation without inventing a terminal state', async () => { + mocks.send.mockResolvedValue({ QueryId: 'query-1' }) + + const result = await executeCloudtrailCancelQuery({ + ...CONNECTION, + queryId: '11111111-2222-3333-4444-555555555555', + }) + + expect(result.output.queryStatus).toBeNull() + expect(result.output.queryId).toBe('query-1') + }) + + it('destroys the client when the AWS call throws', async () => { + mocks.send.mockRejectedValue(new Error('ThrottlingException')) + + await expect(executeCloudtrailLookupEvents(CONNECTION)).rejects.toThrow('ThrottlingException') + expect(mocks.destroy).toHaveBeenCalledTimes(1) + }) +}) diff --git a/apps/sim/lib/internal/cloudtrail/operations.ts b/apps/sim/lib/internal/cloudtrail/operations.ts new file mode 100644 index 00000000000..ad169ea7566 --- /dev/null +++ b/apps/sim/lib/internal/cloudtrail/operations.ts @@ -0,0 +1,529 @@ +import { + type AdvancedEventSelector, + CancelQueryCommand, + type CloudTrailClient, + DescribeQueryCommand, + DescribeTrailsCommand, + GetEventDataStoreCommand, + GetEventSelectorsCommand, + GetInsightSelectorsCommand, + GetQueryResultsCommand, + GetTrailCommand, + GetTrailStatusCommand, + ListEventDataStoresCommand, + ListTagsCommand, + ListTrailsCommand, + LookupEventsCommand, + StartQueryCommand, + type Trail, +} from '@aws-sdk/client-cloudtrail' +import { createLogger } from '@sim/logger' +import type { AwsCloudtrailCancelQueryBody } from '@/lib/api/contracts/tools/aws/cloudtrail-cancel-query' +import type { AwsCloudtrailDescribeQueryBody } from '@/lib/api/contracts/tools/aws/cloudtrail-describe-query' +import type { AwsCloudtrailDescribeTrailsBody } from '@/lib/api/contracts/tools/aws/cloudtrail-describe-trails' +import type { AwsCloudtrailGetEventDataStoreBody } from '@/lib/api/contracts/tools/aws/cloudtrail-get-event-data-store' +import type { AwsCloudtrailGetEventSelectorsBody } from '@/lib/api/contracts/tools/aws/cloudtrail-get-event-selectors' +import type { AwsCloudtrailGetInsightSelectorsBody } from '@/lib/api/contracts/tools/aws/cloudtrail-get-insight-selectors' +import type { AwsCloudtrailGetQueryResultsBody } from '@/lib/api/contracts/tools/aws/cloudtrail-get-query-results' +import type { AwsCloudtrailGetTrailBody } from '@/lib/api/contracts/tools/aws/cloudtrail-get-trail' +import type { AwsCloudtrailGetTrailStatusBody } from '@/lib/api/contracts/tools/aws/cloudtrail-get-trail-status' +import type { AwsCloudtrailListEventDataStoresBody } from '@/lib/api/contracts/tools/aws/cloudtrail-list-event-data-stores' +import type { AwsCloudtrailListTagsBody } from '@/lib/api/contracts/tools/aws/cloudtrail-list-tags' +import type { AwsCloudtrailListTrailsBody } from '@/lib/api/contracts/tools/aws/cloudtrail-list-trails' +import type { AwsCloudtrailLookupEventsBody } from '@/lib/api/contracts/tools/aws/cloudtrail-lookup-events' +import type { AwsCloudtrailStartQueryBody } from '@/lib/api/contracts/tools/aws/cloudtrail-start-query' +import { + type CloudTrailConnectionConfig, + type CreateCloudTrailClientOptions, + createCloudTrailClient, +} from '@/lib/internal/cloudtrail/client' + +const logger = createLogger('CloudTrailOperations') + +async function withCloudTrailClient( + input: CloudTrailConnectionConfig, + execute: (client: CloudTrailClient) => Promise, + options?: CreateCloudTrailClientOptions +): Promise { + const client = createCloudTrailClient(input, options) + try { + return await execute(client) + } finally { + client.destroy() + } +} + +function mapAdvancedEventSelectors(selectors: AdvancedEventSelector[] | undefined) { + return (selectors ?? []).map((selector) => ({ + name: selector.Name ?? null, + fieldSelectors: (selector.FieldSelectors ?? []).map((field) => ({ + field: field.Field ?? '', + equals: field.Equals ?? [], + startsWith: field.StartsWith ?? [], + endsWith: field.EndsWith ?? [], + notEquals: field.NotEquals ?? [], + notStartsWith: field.NotStartsWith ?? [], + notEndsWith: field.NotEndsWith ?? [], + })), + })) +} + +function mapTrail(trail: Trail | undefined) { + return { + name: trail?.Name ?? '', + s3BucketName: trail?.S3BucketName ?? null, + s3KeyPrefix: trail?.S3KeyPrefix ?? null, + snsTopicName: trail?.SnsTopicName ?? null, + snsTopicArn: trail?.SnsTopicARN ?? null, + includeGlobalServiceEvents: trail?.IncludeGlobalServiceEvents ?? null, + isMultiRegionTrail: trail?.IsMultiRegionTrail ?? null, + homeRegion: trail?.HomeRegion ?? null, + trailArn: trail?.TrailARN ?? null, + logFileValidationEnabled: trail?.LogFileValidationEnabled ?? null, + cloudWatchLogsLogGroupArn: trail?.CloudWatchLogsLogGroupArn ?? null, + cloudWatchLogsRoleArn: trail?.CloudWatchLogsRoleArn ?? null, + kmsKeyId: trail?.KmsKeyId ?? null, + hasCustomEventSelectors: trail?.HasCustomEventSelectors ?? null, + hasInsightSelectors: trail?.HasInsightSelectors ?? null, + isOrganizationTrail: trail?.IsOrganizationTrail ?? null, + } +} + +/** + * `LookupEvents` returns the full event record as a JSON-encoded string in + * `CloudTrailEvent`. Downstream agents want the structured record (userIdentity, + * sourceIPAddress, requestParameters, errorCode), so it is parsed into + * `cloudTrailEvent`. If parsing ever fails the original string is preserved in + * `cloudTrailEventRaw` so no data is lost. + */ +function parseCloudTrailEvent(raw: string | undefined): { + cloudTrailEvent: Record | null + cloudTrailEventRaw: string | null +} { + if (!raw) return { cloudTrailEvent: null, cloudTrailEventRaw: null } + try { + const parsed: unknown = JSON.parse(raw) + if (parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed)) { + return { cloudTrailEvent: parsed as Record, cloudTrailEventRaw: null } + } + } catch { + logger.warn('Failed to parse CloudTrailEvent payload; returning the raw string') + return { cloudTrailEvent: null, cloudTrailEventRaw: raw } + } + return { cloudTrailEvent: null, cloudTrailEventRaw: raw } +} + +export async function executeCloudtrailLookupEvents( + input: AwsCloudtrailLookupEventsBody, + signal?: AbortSignal +) { + return withCloudTrailClient( + input, + async (client) => { + const response = await client.send( + new LookupEventsCommand({ + ...(input.attributeKey && input.attributeValue + ? { + LookupAttributes: [ + { AttributeKey: input.attributeKey, AttributeValue: input.attributeValue }, + ], + } + : {}), + ...(input.startTime ? { StartTime: new Date(input.startTime) } : {}), + ...(input.endTime ? { EndTime: new Date(input.endTime) } : {}), + ...(input.eventCategory ? { EventCategory: input.eventCategory } : {}), + ...(input.maxResults !== undefined ? { MaxResults: input.maxResults } : {}), + ...(input.nextToken ? { NextToken: input.nextToken } : {}), + }), + { abortSignal: signal } + ) + return { + success: true, + output: { + events: (response.Events ?? []).map((event) => ({ + eventId: event.EventId ?? null, + eventName: event.EventName ?? null, + readOnly: event.ReadOnly ?? null, + accessKeyId: event.AccessKeyId ?? null, + eventTime: event.EventTime?.toISOString() ?? null, + eventSource: event.EventSource ?? null, + username: event.Username ?? null, + resources: (event.Resources ?? []).map((resource) => ({ + resourceType: resource.ResourceType ?? null, + resourceName: resource.ResourceName ?? null, + })), + ...parseCloudTrailEvent(event.CloudTrailEvent), + })), + nextToken: response.NextToken ?? null, + }, + } + }, + { throttleSensitive: true } + ) +} + +export async function executeCloudtrailDescribeTrails( + input: AwsCloudtrailDescribeTrailsBody, + signal?: AbortSignal +) { + return withCloudTrailClient(input, async (client) => { + const response = await client.send( + new DescribeTrailsCommand({ + ...(input.trailNameList ? { trailNameList: input.trailNameList } : {}), + ...(input.includeShadowTrails !== undefined + ? { includeShadowTrails: input.includeShadowTrails } + : {}), + }), + { abortSignal: signal } + ) + return { + success: true, + output: { trails: (response.trailList ?? []).map(mapTrail) }, + } + }) +} + +export async function executeCloudtrailGetTrail( + input: AwsCloudtrailGetTrailBody, + signal?: AbortSignal +) { + return withCloudTrailClient(input, async (client) => { + const response = await client.send(new GetTrailCommand({ Name: input.name }), { + abortSignal: signal, + }) + if (!response.Trail) throw new Error('No trail data returned') + return { success: true, output: mapTrail(response.Trail) } + }) +} + +export async function executeCloudtrailGetTrailStatus( + input: AwsCloudtrailGetTrailStatusBody, + signal?: AbortSignal +) { + return withCloudTrailClient(input, async (client) => { + const response = await client.send(new GetTrailStatusCommand({ Name: input.name }), { + abortSignal: signal, + }) + return { + success: true, + output: { + isLogging: response.IsLogging ?? null, + latestDeliveryError: response.LatestDeliveryError ?? null, + latestDeliveryTime: response.LatestDeliveryTime?.toISOString() ?? null, + latestNotificationError: response.LatestNotificationError ?? null, + latestNotificationTime: response.LatestNotificationTime?.toISOString() ?? null, + latestCloudWatchLogsDeliveryError: response.LatestCloudWatchLogsDeliveryError ?? null, + latestCloudWatchLogsDeliveryTime: + response.LatestCloudWatchLogsDeliveryTime?.toISOString() ?? null, + latestDigestDeliveryError: response.LatestDigestDeliveryError ?? null, + latestDigestDeliveryTime: response.LatestDigestDeliveryTime?.toISOString() ?? null, + startLoggingTime: response.StartLoggingTime?.toISOString() ?? null, + stopLoggingTime: response.StopLoggingTime?.toISOString() ?? null, + }, + } + }) +} + +export async function executeCloudtrailListTrails( + input: AwsCloudtrailListTrailsBody, + signal?: AbortSignal +) { + return withCloudTrailClient(input, async (client) => { + const response = await client.send( + new ListTrailsCommand({ ...(input.nextToken ? { NextToken: input.nextToken } : {}) }), + { abortSignal: signal } + ) + return { + success: true, + output: { + trails: (response.Trails ?? []).map((trail) => ({ + trailArn: trail.TrailARN ?? null, + name: trail.Name ?? null, + homeRegion: trail.HomeRegion ?? null, + })), + nextToken: response.NextToken ?? null, + }, + } + }) +} + +export async function executeCloudtrailGetEventSelectors( + input: AwsCloudtrailGetEventSelectorsBody, + signal?: AbortSignal +) { + return withCloudTrailClient(input, async (client) => { + const response = await client.send( + new GetEventSelectorsCommand({ TrailName: input.trailName }), + { abortSignal: signal } + ) + return { + success: true, + output: { + trailArn: response.TrailARN ?? null, + eventSelectors: (response.EventSelectors ?? []).map((selector) => ({ + readWriteType: selector.ReadWriteType ?? null, + includeManagementEvents: selector.IncludeManagementEvents ?? null, + dataResources: (selector.DataResources ?? []).map((resource) => ({ + type: resource.Type ?? null, + values: resource.Values ?? [], + })), + excludeManagementEventSources: selector.ExcludeManagementEventSources ?? [], + })), + advancedEventSelectors: mapAdvancedEventSelectors(response.AdvancedEventSelectors), + }, + } + }) +} + +export async function executeCloudtrailGetInsightSelectors( + input: AwsCloudtrailGetInsightSelectorsBody, + signal?: AbortSignal +) { + return withCloudTrailClient(input, async (client) => { + const response = await client.send( + new GetInsightSelectorsCommand({ + ...(input.trailName ? { TrailName: input.trailName } : {}), + ...(input.eventDataStore ? { EventDataStore: input.eventDataStore } : {}), + }), + { abortSignal: signal } + ) + return { + success: true, + output: { + trailArn: response.TrailARN ?? null, + eventDataStoreArn: response.EventDataStoreArn ?? null, + insightsDestination: response.InsightsDestination ?? null, + insightSelectors: (response.InsightSelectors ?? []).map((selector) => ({ + insightType: selector.InsightType ?? null, + eventCategories: selector.EventCategories ?? [], + })), + }, + } + }) +} + +export async function executeCloudtrailStartQuery( + input: AwsCloudtrailStartQueryBody, + signal?: AbortSignal +) { + return withCloudTrailClient(input, async (client) => { + const response = await client.send( + new StartQueryCommand({ + ...(input.queryStatement ? { QueryStatement: input.queryStatement } : {}), + ...(input.queryAlias ? { QueryAlias: input.queryAlias } : {}), + ...(input.queryParameters ? { QueryParameters: input.queryParameters } : {}), + ...(input.deliveryS3Uri ? { DeliveryS3Uri: input.deliveryS3Uri } : {}), + ...(input.eventDataStoreOwnerAccountId + ? { EventDataStoreOwnerAccountId: input.eventDataStoreOwnerAccountId } + : {}), + }), + { abortSignal: signal } + ) + if (!response.QueryId) throw new Error('No query ID returned') + return { + success: true, + output: { + queryId: response.QueryId, + eventDataStoreOwnerAccountId: response.EventDataStoreOwnerAccountId ?? null, + }, + } + }) +} + +export async function executeCloudtrailDescribeQuery( + input: AwsCloudtrailDescribeQueryBody, + signal?: AbortSignal +) { + return withCloudTrailClient(input, async (client) => { + const response = await client.send( + new DescribeQueryCommand({ + ...(input.queryId ? { QueryId: input.queryId } : {}), + ...(input.queryAlias ? { QueryAlias: input.queryAlias } : {}), + ...(input.refreshId ? { RefreshId: input.refreshId } : {}), + ...(input.eventDataStoreOwnerAccountId + ? { EventDataStoreOwnerAccountId: input.eventDataStoreOwnerAccountId } + : {}), + }), + { abortSignal: signal } + ) + return { + success: true, + output: { + queryId: response.QueryId ?? null, + queryString: response.QueryString ?? null, + queryStatus: response.QueryStatus ?? null, + errorMessage: response.ErrorMessage ?? null, + deliveryS3Uri: response.DeliveryS3Uri ?? null, + deliveryStatus: response.DeliveryStatus ?? null, + prompt: response.Prompt ?? null, + eventDataStoreOwnerAccountId: response.EventDataStoreOwnerAccountId ?? null, + eventsMatched: response.QueryStatistics?.EventsMatched ?? null, + eventsScanned: response.QueryStatistics?.EventsScanned ?? null, + bytesScanned: response.QueryStatistics?.BytesScanned ?? null, + executionTimeInMillis: response.QueryStatistics?.ExecutionTimeInMillis ?? null, + creationTime: response.QueryStatistics?.CreationTime?.toISOString() ?? null, + }, + } + }) +} + +export async function executeCloudtrailGetQueryResults( + input: AwsCloudtrailGetQueryResultsBody, + signal?: AbortSignal +) { + return withCloudTrailClient(input, async (client) => { + const response = await client.send( + new GetQueryResultsCommand({ + QueryId: input.queryId, + ...(input.maxQueryResults !== undefined ? { MaxQueryResults: input.maxQueryResults } : {}), + ...(input.nextToken ? { NextToken: input.nextToken } : {}), + ...(input.eventDataStoreOwnerAccountId + ? { EventDataStoreOwnerAccountId: input.eventDataStoreOwnerAccountId } + : {}), + }), + { abortSignal: signal } + ) + const rows = (response.QueryResultRows ?? []).map((row) => { + const record: Record = {} + for (const cell of row) { + for (const [key, value] of Object.entries(cell)) { + record[key] = value ?? '' + } + } + return record + }) + return { + success: true, + output: { + queryStatus: response.QueryStatus ?? null, + rows, + resultsCount: response.QueryStatistics?.ResultsCount ?? null, + totalResultsCount: response.QueryStatistics?.TotalResultsCount ?? null, + bytesScanned: response.QueryStatistics?.BytesScanned ?? null, + errorMessage: response.ErrorMessage ?? null, + nextToken: response.NextToken ?? null, + }, + } + }) +} + +export async function executeCloudtrailCancelQuery( + input: AwsCloudtrailCancelQueryBody, + signal?: AbortSignal +) { + return withCloudTrailClient(input, async (client) => { + const response = await client.send( + new CancelQueryCommand({ + QueryId: input.queryId, + ...(input.eventDataStoreOwnerAccountId + ? { EventDataStoreOwnerAccountId: input.eventDataStoreOwnerAccountId } + : {}), + }), + { abortSignal: signal } + ) + return { + success: true, + output: { + queryId: response.QueryId ?? input.queryId, + queryStatus: response.QueryStatus ?? null, + eventDataStoreOwnerAccountId: response.EventDataStoreOwnerAccountId ?? null, + }, + } + }) +} + +export async function executeCloudtrailListEventDataStores( + input: AwsCloudtrailListEventDataStoresBody, + signal?: AbortSignal +) { + return withCloudTrailClient(input, async (client) => { + const response = await client.send( + new ListEventDataStoresCommand({ + ...(input.maxResults !== undefined ? { MaxResults: input.maxResults } : {}), + ...(input.nextToken ? { NextToken: input.nextToken } : {}), + }), + { abortSignal: signal } + ) + return { + success: true, + output: { + eventDataStores: (response.EventDataStores ?? []).map((store) => ({ + eventDataStoreArn: store.EventDataStoreArn ?? null, + name: store.Name ?? null, + status: store.Status ?? null, + advancedEventSelectors: mapAdvancedEventSelectors(store.AdvancedEventSelectors), + multiRegionEnabled: store.MultiRegionEnabled ?? null, + organizationEnabled: store.OrganizationEnabled ?? null, + retentionPeriod: store.RetentionPeriod ?? null, + terminationProtectionEnabled: store.TerminationProtectionEnabled ?? null, + createdTimestamp: store.CreatedTimestamp?.toISOString() ?? null, + updatedTimestamp: store.UpdatedTimestamp?.toISOString() ?? null, + })), + nextToken: response.NextToken ?? null, + }, + } + }) +} + +export async function executeCloudtrailGetEventDataStore( + input: AwsCloudtrailGetEventDataStoreBody, + signal?: AbortSignal +) { + return withCloudTrailClient(input, async (client) => { + const response = await client.send( + new GetEventDataStoreCommand({ EventDataStore: input.eventDataStore }), + { abortSignal: signal } + ) + return { + success: true, + output: { + eventDataStoreArn: response.EventDataStoreArn ?? null, + name: response.Name ?? null, + status: response.Status ?? null, + advancedEventSelectors: mapAdvancedEventSelectors(response.AdvancedEventSelectors), + multiRegionEnabled: response.MultiRegionEnabled ?? null, + organizationEnabled: response.OrganizationEnabled ?? null, + retentionPeriod: response.RetentionPeriod ?? null, + terminationProtectionEnabled: response.TerminationProtectionEnabled ?? null, + createdTimestamp: response.CreatedTimestamp?.toISOString() ?? null, + updatedTimestamp: response.UpdatedTimestamp?.toISOString() ?? null, + kmsKeyId: response.KmsKeyId ?? null, + billingMode: response.BillingMode ?? null, + federationStatus: response.FederationStatus ?? null, + federationRoleArn: response.FederationRoleArn ?? null, + partitionKeys: (response.PartitionKeys ?? []).map((key) => ({ + name: key.Name ?? '', + type: key.Type ?? '', + })), + }, + } + }) +} + +export async function executeCloudtrailListTags( + input: AwsCloudtrailListTagsBody, + signal?: AbortSignal +) { + return withCloudTrailClient(input, async (client) => { + const response = await client.send( + new ListTagsCommand({ + ResourceIdList: input.resourceIdList, + ...(input.nextToken ? { NextToken: input.nextToken } : {}), + }), + { abortSignal: signal } + ) + return { + success: true, + output: { + resourceTags: (response.ResourceTagList ?? []).map((resourceTag) => ({ + resourceId: resourceTag.ResourceId ?? null, + tags: (resourceTag.TagsList ?? []).map((tag) => ({ + key: tag.Key ?? '', + value: tag.Value ?? null, + })), + })), + nextToken: response.NextToken ?? null, + }, + } + }) +} diff --git a/apps/sim/lib/internal/iam/client.test.ts b/apps/sim/lib/internal/iam/client.test.ts new file mode 100644 index 00000000000..bb8151131ed --- /dev/null +++ b/apps/sim/lib/internal/iam/client.test.ts @@ -0,0 +1,204 @@ +/** + * @vitest-environment node + */ +import type { IAMClient, SimulatePrincipalPolicyCommandOutput } from '@aws-sdk/client-iam' +import { beforeEach, describe, expect, it, vi } from 'vitest' +import { listPolicies, simulatePrincipalPolicy } from '@/lib/internal/iam/client' + +const mockSend = vi.fn() + +/** A stub standing in for the AWS SDK client; only `send` is exercised. */ +function createStubClient(): IAMClient { + // double-cast-allowed: test stub implements only the single SDK method under test + return { send: mockSend } as unknown as IAMClient +} + +/** + * The literal ARN template AWS echoes back on the top-level result. The braces are escaped + * so the linter does not read AWS's placeholders as JavaScript interpolation. + */ +const AWS_ARN_TEMPLATE = `arn:$\{Partition}:s3:::$\{BucketName}/$\{KeyName}` + +/** + * A realistic SimulatePrincipalPolicy payload for ONE action across TWO buckets: + * allowed on bucket-a, explicitly denied on bucket-b. + * + * AWS returns a single EvaluationResult per action regardless of resource count. Its + * EvalDecision is the aggregate, most-restrictive decision (explicitDeny here, because + * bucket-b denies), its EvalResourceName is an ARN template rather than either bucket, + * and its MissingContextValues is empty because concrete ResourceArns were supplied — + * per-resource missing context moves into ResourceSpecificResults. + */ +const MULTI_RESOURCE_RESPONSE = { + EvaluationResults: [ + { + EvalActionName: 's3:GetObject', + EvalResourceName: AWS_ARN_TEMPLATE, + EvalDecision: 'explicitDeny', + MatchedStatements: [{ SourcePolicyId: 'DenyBucketB', SourcePolicyType: 'IAM Policy' }], + MissingContextValues: [], + PermissionsBoundaryDecisionDetail: { AllowedByPermissionsBoundary: true }, + ResourceSpecificResults: [ + { + EvalResourceName: 'arn:aws:s3:::bucket-a/*', + EvalResourceDecision: 'allowed', + MatchedStatements: [{ SourcePolicyId: 'AllowReadA', SourcePolicyType: 'IAM Policy' }], + MissingContextValues: [], + PermissionsBoundaryDecisionDetail: { AllowedByPermissionsBoundary: true }, + }, + { + EvalResourceName: 'arn:aws:s3:::bucket-b/*', + EvalResourceDecision: 'explicitDeny', + MatchedStatements: [{ SourcePolicyId: 'DenyBucketB', SourcePolicyType: 'IAM Policy' }], + MissingContextValues: ['aws:SourceIp'], + PermissionsBoundaryDecisionDetail: { AllowedByPermissionsBoundary: false }, + }, + ], + }, + ], + IsTruncated: false, +} satisfies Partial + +describe('simulatePrincipalPolicy response mapping', () => { + beforeEach(() => { + vi.clearAllMocks() + }) + + it('preserves the per-resource decision for every simulated ARN', async () => { + mockSend.mockResolvedValue(MULTI_RESOURCE_RESPONSE) + + const result = await simulatePrincipalPolicy(createStubClient(), { + policySourceArn: 'arn:aws:iam::123456789012:user/alice', + actionNames: 's3:GetObject', + resourceArns: 'arn:aws:s3:::bucket-a/*, arn:aws:s3:::bucket-b/*', + }) + + expect(result.evaluationResults).toHaveLength(1) + const [evaluation] = result.evaluationResults + + expect(evaluation.resourceSpecificResults).toEqual([ + { + evalResourceName: 'arn:aws:s3:::bucket-a/*', + evalResourceDecision: 'allowed', + matchedStatements: [{ sourcePolicyId: 'AllowReadA', sourcePolicyType: 'IAM Policy' }], + missingContextValues: [], + permissionsBoundaryAllowed: true, + }, + { + evalResourceName: 'arn:aws:s3:::bucket-b/*', + evalResourceDecision: 'explicitDeny', + matchedStatements: [{ sourcePolicyId: 'DenyBucketB', sourcePolicyType: 'IAM Policy' }], + missingContextValues: ['aws:SourceIp'], + permissionsBoundaryAllowed: false, + }, + ]) + }) + + it('does not let the aggregate decision stand in for the allowed resource', async () => { + mockSend.mockResolvedValue(MULTI_RESOURCE_RESPONSE) + + const result = await simulatePrincipalPolicy(createStubClient(), { + policySourceArn: 'arn:aws:iam::123456789012:user/alice', + actionNames: 's3:GetObject', + resourceArns: 'arn:aws:s3:::bucket-a/*,arn:aws:s3:::bucket-b/*', + }) + + const [evaluation] = result.evaluationResults + expect(evaluation.evalDecision).toBe('explicitDeny') + + const decisionByResource = new Map( + evaluation.resourceSpecificResults.map((r) => [r.evalResourceName, r.evalResourceDecision]) + ) + expect(decisionByResource.get('arn:aws:s3:::bucket-a/*')).toBe('allowed') + expect(decisionByResource.get('arn:aws:s3:::bucket-b/*')).toBe('explicitDeny') + }) + + it('keeps missing context values that AWS moved into the per-resource results', async () => { + mockSend.mockResolvedValue(MULTI_RESOURCE_RESPONSE) + + const result = await simulatePrincipalPolicy(createStubClient(), { + policySourceArn: 'arn:aws:iam::123456789012:user/alice', + actionNames: 's3:GetObject', + resourceArns: 'arn:aws:s3:::bucket-a/*,arn:aws:s3:::bucket-b/*', + }) + + const [evaluation] = result.evaluationResults + expect(evaluation.missingContextValues).toEqual([]) + expect(evaluation.resourceSpecificResults.flatMap((r) => r.missingContextValues)).toEqual([ + 'aws:SourceIp', + ]) + }) + + it('sends both resource ARNs and the supplied condition context keys to AWS', async () => { + mockSend.mockResolvedValue(MULTI_RESOURCE_RESPONSE) + + await simulatePrincipalPolicy(createStubClient(), { + policySourceArn: 'arn:aws:iam::123456789012:user/alice', + actionNames: 's3:GetObject, s3:PutObject', + resourceArns: 'arn:aws:s3:::bucket-a/*,arn:aws:s3:::bucket-b/*', + contextEntries: [ + { + contextKeyName: 'aws:SourceIp', + contextKeyValues: ['203.0.113.10'], + contextKeyType: 'ip', + }, + ], + }) + + expect(mockSend).toHaveBeenCalledOnce() + expect(mockSend.mock.calls[0][0].input).toMatchObject({ + PolicySourceArn: 'arn:aws:iam::123456789012:user/alice', + ActionNames: ['s3:GetObject', 's3:PutObject'], + ResourceArns: ['arn:aws:s3:::bucket-a/*', 'arn:aws:s3:::bucket-b/*'], + ContextEntries: [ + { + ContextKeyName: 'aws:SourceIp', + ContextKeyValues: ['203.0.113.10'], + ContextKeyType: 'ip', + }, + ], + }) + }) + + it('defaults to simulating against * when no resource ARNs are supplied', async () => { + mockSend.mockResolvedValue({ EvaluationResults: [], IsTruncated: false }) + + await simulatePrincipalPolicy(createStubClient(), { + policySourceArn: 'arn:aws:iam::123456789012:user/alice', + actionNames: 'iam:ListUsers', + }) + + expect(mockSend.mock.calls[0][0].input.ResourceArns).toEqual(['*']) + expect(mockSend.mock.calls[0][0].input.ContextEntries).toBeUndefined() + }) +}) + +describe('listPolicies response mapping', () => { + beforeEach(() => { + vi.clearAllMocks() + }) + + it('omits the description AWS never returns from ListPolicies', async () => { + mockSend.mockResolvedValue({ + Policies: [ + { + PolicyName: 'ReadOnlyAccess', + PolicyId: 'ANPAI7XKCFMBPM3QQRRVQ', + Arn: 'arn:aws:iam::aws:policy/ReadOnlyAccess', + Path: '/', + AttachmentCount: 3, + IsAttachable: true, + DefaultVersionId: 'v1', + PermissionsBoundaryUsageCount: 0, + }, + ], + IsTruncated: false, + }) + + const result = await listPolicies(createStubClient(), 'AWS') + + expect(result.policies).toHaveLength(1) + expect(result.policies[0]).not.toHaveProperty('description') + expect(mockSend.mock.calls[0][0].input.Scope).toBe('AWS') + }) +}) diff --git a/apps/sim/lib/internal/iam/client.ts b/apps/sim/lib/internal/iam/client.ts index bb654ca1784..76a2a610692 100644 --- a/apps/sim/lib/internal/iam/client.ts +++ b/apps/sim/lib/internal/iam/client.ts @@ -1,9 +1,14 @@ import type { + AccessKeyMetadata, AttachedPolicy, + ContextEntry, Group, Policy, PolicyScopeType, + ResourceSpecificResult, Role, + Statement, + StatusType, User, } from '@aws-sdk/client-iam' import { @@ -18,9 +23,11 @@ import { DeleteUserCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, + GetPolicyCommand, GetRoleCommand, GetUserCommand, IAMClient, + ListAccessKeysCommand, ListAttachedRolePoliciesCommand, ListAttachedUserPoliciesCommand, ListGroupsCommand, @@ -29,8 +36,9 @@ import { ListUsersCommand, RemoveUserFromGroupCommand, SimulatePrincipalPolicyCommand, + UpdateAccessKeyCommand, } from '@aws-sdk/client-iam' -import type { IAMConnectionConfig } from '@/tools/iam/types' +import type { IAMConnectionConfig, IAMSimulateContextEntry } from '@/tools/iam/types' export function createIAMClient(config: IAMConnectionConfig): IAMClient { return new IAMClient({ @@ -266,7 +274,7 @@ export async function detachRolePolicy( export async function listPolicies( client: IAMClient, - scope?: string | null, + scope?: PolicyScopeType | null, onlyAttached?: boolean | null, pathPrefix?: string | null, maxItems?: number | null, @@ -274,7 +282,7 @@ export async function listPolicies( signal?: AbortSignal ) { const command = new ListPoliciesCommand({ - ...(scope ? { Scope: scope as PolicyScopeType } : {}), + ...(scope ? { Scope: scope } : {}), ...(onlyAttached != null ? { OnlyAttached: onlyAttached } : {}), ...(pathPrefix ? { PathPrefix: pathPrefix } : {}), ...(maxItems ? { MaxItems: maxItems } : {}), @@ -291,7 +299,6 @@ export async function listPolicies( isAttachable: policy.IsAttachable ?? false, createDate: policy.CreateDate?.toISOString() ?? null, updateDate: policy.UpdateDate?.toISOString() ?? null, - description: policy.Description ?? null, defaultVersionId: policy.DefaultVersionId ?? null, permissionsBoundaryUsageCount: policy.PermissionsBoundaryUsageCount ?? 0, })) @@ -452,32 +459,69 @@ export async function listAttachedUserPolicies( } } +function mapMatchedStatements(statements: Statement[] | undefined) { + return (statements ?? []).map((s) => ({ + sourcePolicyId: s.SourcePolicyId ?? '', + sourcePolicyType: s.SourcePolicyType ?? '', + })) +} + +/** + * Projects the per-resource half of a simulation result. AWS reports one + * `EvaluationResult` per action no matter how many resource ARNs were supplied, so this + * is the only place a caller can learn what was decided for an individual ARN. When + * concrete `ResourceArns` are supplied, missing context values are reported here rather + * than on the aggregate result. + */ +function mapResourceSpecificResults(results: ResourceSpecificResult[] | undefined) { + return (results ?? []).map((r) => ({ + evalResourceName: r.EvalResourceName ?? '', + evalResourceDecision: r.EvalResourceDecision ?? '', + matchedStatements: mapMatchedStatements(r.MatchedStatements), + missingContextValues: (r.MissingContextValues ?? []).map((v) => String(v)), + permissionsBoundaryAllowed: + r.PermissionsBoundaryDecisionDetail?.AllowedByPermissionsBoundary ?? null, + })) +} + +export interface SimulatePrincipalPolicyOptions { + policySourceArn: string + actionNames: string + resourceArns?: string | null + contextEntries?: IAMSimulateContextEntry[] | null + maxResults?: number | null + marker?: string | null +} + export async function simulatePrincipalPolicy( client: IAMClient, - policySourceArn: string, - actionNames: string, - resourceArns?: string | null, - maxResults?: number | null, - marker?: string | null, + options: SimulatePrincipalPolicyOptions, signal?: AbortSignal ) { - const actions = actionNames + const actions = options.actionNames .split(',') .map((a) => a.trim()) .filter(Boolean) - const resources = resourceArns - ? resourceArns + const resources = options.resourceArns + ? options.resourceArns .split(',') .map((r) => r.trim()) .filter(Boolean) : ['*'] + const contextEntries: ContextEntry[] = (options.contextEntries ?? []).map((entry) => ({ + ContextKeyName: entry.contextKeyName, + ContextKeyValues: entry.contextKeyValues, + ContextKeyType: entry.contextKeyType, + })) + const command = new SimulatePrincipalPolicyCommand({ - PolicySourceArn: policySourceArn, + PolicySourceArn: options.policySourceArn, ActionNames: actions, ResourceArns: resources, - ...(maxResults ? { MaxItems: maxResults } : {}), - ...(marker ? { Marker: marker } : {}), + ...(contextEntries.length > 0 ? { ContextEntries: contextEntries } : {}), + ...(options.maxResults ? { MaxItems: options.maxResults } : {}), + ...(options.marker ? { Marker: options.marker } : {}), }) const response = await client.send(command, { abortSignal: signal }) @@ -485,11 +529,11 @@ export async function simulatePrincipalPolicy( evalActionName: r.EvalActionName ?? '', evalResourceName: r.EvalResourceName ?? '', evalDecision: r.EvalDecision ?? '', - matchedStatements: (r.MatchedStatements ?? []).map((s) => ({ - sourcePolicyId: s.SourcePolicyId ?? '', - sourcePolicyType: s.SourcePolicyType ?? '', - })), + matchedStatements: mapMatchedStatements(r.MatchedStatements), missingContextValues: (r.MissingContextValues ?? []).map((v) => String(v)), + permissionsBoundaryAllowed: + r.PermissionsBoundaryDecisionDetail?.AllowedByPermissionsBoundary ?? null, + resourceSpecificResults: mapResourceSpecificResults(r.ResourceSpecificResults), })) return { @@ -499,3 +543,68 @@ export async function simulatePrincipalPolicy( count: evaluationResults.length, } } + +export async function getPolicy(client: IAMClient, policyArn: string, signal?: AbortSignal) { + const command = new GetPolicyCommand({ PolicyArn: policyArn }) + const response = await client.send(command, { abortSignal: signal }) + const policy = response.Policy + + return { + policyName: policy?.PolicyName ?? '', + policyId: policy?.PolicyId ?? '', + arn: policy?.Arn ?? '', + path: policy?.Path ?? '', + attachmentCount: policy?.AttachmentCount ?? 0, + isAttachable: policy?.IsAttachable ?? false, + createDate: policy?.CreateDate?.toISOString() ?? null, + updateDate: policy?.UpdateDate?.toISOString() ?? null, + description: policy?.Description ?? null, + defaultVersionId: policy?.DefaultVersionId ?? null, + permissionsBoundaryUsageCount: policy?.PermissionsBoundaryUsageCount ?? 0, + tags: policy?.Tags?.map((t) => ({ key: t.Key ?? '', value: t.Value ?? '' })) ?? [], + } +} + +export async function listAccessKeys( + client: IAMClient, + userName?: string | null, + maxItems?: number | null, + marker?: string | null, + signal?: AbortSignal +) { + const command = new ListAccessKeysCommand({ + ...(userName ? { UserName: userName } : {}), + ...(maxItems ? { MaxItems: maxItems } : {}), + ...(marker ? { Marker: marker } : {}), + }) + + const response = await client.send(command, { abortSignal: signal }) + const accessKeys = (response.AccessKeyMetadata ?? []).map((key: AccessKeyMetadata) => ({ + accessKeyId: key.AccessKeyId ?? '', + userName: key.UserName ?? '', + status: key.Status ?? '', + createDate: key.CreateDate?.toISOString() ?? null, + })) + + return { + accessKeys, + isTruncated: response.IsTruncated ?? false, + marker: response.Marker ?? null, + count: accessKeys.length, + } +} + +export async function updateAccessKey( + client: IAMClient, + accessKeyIdToUpdate: string, + status: StatusType, + userName?: string | null, + signal?: AbortSignal +) { + const command = new UpdateAccessKeyCommand({ + AccessKeyId: accessKeyIdToUpdate, + Status: status, + ...(userName ? { UserName: userName } : {}), + }) + await client.send(command, { abortSignal: signal }) +} diff --git a/apps/sim/lib/internal/iam/execute-tool.test.ts b/apps/sim/lib/internal/iam/execute-tool.test.ts index e8ddad046db..028505e240c 100644 --- a/apps/sim/lib/internal/iam/execute-tool.test.ts +++ b/apps/sim/lib/internal/iam/execute-tool.test.ts @@ -15,8 +15,10 @@ const mockOperations = vi.hoisted(() => ({ executeIamDeleteUser: vi.fn(), executeIamDetachRolePolicy: vi.fn(), executeIamDetachUserPolicy: vi.fn(), + executeIamGetPolicy: vi.fn(), executeIamGetRole: vi.fn(), executeIamGetUser: vi.fn(), + executeIamListAccessKeys: vi.fn(), executeIamListAttachedRolePolicies: vi.fn(), executeIamListAttachedUserPolicies: vi.fn(), executeIamListGroups: vi.fn(), @@ -25,6 +27,7 @@ const mockOperations = vi.hoisted(() => ({ executeIamListUsers: vi.fn(), executeIamRemoveUserFromGroup: vi.fn(), executeIamSimulatePrincipalPolicy: vi.fn(), + executeIamUpdateAccessKey: vi.fn(), })) vi.mock('@/lib/internal/iam/operations', () => mockOperations) @@ -93,9 +96,29 @@ const TOOL_CASES = [ }, { toolId: 'iam_delete_access_key', - input: { ...CONNECTION, accessKeyIdToDelete: 'AKIADELETE' }, + input: { ...CONNECTION, accessKeyIdToDelete: 'AKIAIOSFODNN7EXAMPLE' }, operation: mockOperations.executeIamDeleteAccessKey, }, + { + toolId: 'iam_get_policy', + input: { ...CONNECTION, policyArn: 'arn:aws:iam::aws:policy/ReadOnlyAccess' }, + operation: mockOperations.executeIamGetPolicy, + }, + { + toolId: 'iam_list_access_keys', + input: { ...CONNECTION, userName: 'test-user' }, + operation: mockOperations.executeIamListAccessKeys, + }, + { + toolId: 'iam_update_access_key', + input: { + ...CONNECTION, + accessKeyIdToUpdate: 'AKIAIOSFODNN7EXAMPLE', + status: 'Inactive', + userName: 'test-user', + }, + operation: mockOperations.executeIamUpdateAccessKey, + }, { toolId: 'iam_delete_role', input: { ...CONNECTION, roleName: 'test-role' }, diff --git a/apps/sim/lib/internal/iam/execute-tool.ts b/apps/sim/lib/internal/iam/execute-tool.ts index e9074744ac2..58f266ff3a0 100644 --- a/apps/sim/lib/internal/iam/execute-tool.ts +++ b/apps/sim/lib/internal/iam/execute-tool.ts @@ -9,8 +9,10 @@ import { awsIamDeleteRoleContract } from '@/lib/api/contracts/tools/aws/iam-dele import { awsIamDeleteUserContract } from '@/lib/api/contracts/tools/aws/iam-delete-user' import { awsIamDetachRolePolicyContract } from '@/lib/api/contracts/tools/aws/iam-detach-role-policy' import { awsIamDetachUserPolicyContract } from '@/lib/api/contracts/tools/aws/iam-detach-user-policy' +import { awsIamGetPolicyContract } from '@/lib/api/contracts/tools/aws/iam-get-policy' import { awsIamGetRoleContract } from '@/lib/api/contracts/tools/aws/iam-get-role' import { awsIamGetUserContract } from '@/lib/api/contracts/tools/aws/iam-get-user' +import { awsIamListAccessKeysContract } from '@/lib/api/contracts/tools/aws/iam-list-access-keys' import { awsIamListAttachedRolePoliciesContract } from '@/lib/api/contracts/tools/aws/iam-list-attached-role-policies' import { awsIamListAttachedUserPoliciesContract } from '@/lib/api/contracts/tools/aws/iam-list-attached-user-policies' import { awsIamListGroupsContract } from '@/lib/api/contracts/tools/aws/iam-list-groups' @@ -19,6 +21,7 @@ import { awsIamListRolesContract } from '@/lib/api/contracts/tools/aws/iam-list- import { awsIamListUsersContract } from '@/lib/api/contracts/tools/aws/iam-list-users' import { awsIamRemoveUserFromGroupContract } from '@/lib/api/contracts/tools/aws/iam-remove-user-from-group' import { awsIamSimulatePrincipalPolicyContract } from '@/lib/api/contracts/tools/aws/iam-simulate-principal-policy' +import { awsIamUpdateAccessKeyContract } from '@/lib/api/contracts/tools/aws/iam-update-access-key' import { executeIamAddUserToGroup, executeIamAttachRolePolicy, @@ -31,8 +34,10 @@ import { executeIamDeleteUser, executeIamDetachRolePolicy, executeIamDetachUserPolicy, + executeIamGetPolicy, executeIamGetRole, executeIamGetUser, + executeIamListAccessKeys, executeIamListAttachedRolePolicies, executeIamListAttachedUserPolicies, executeIamListGroups, @@ -41,6 +46,7 @@ import { executeIamListUsers, executeIamRemoveUserFromGroup, executeIamSimulatePrincipalPolicy, + executeIamUpdateAccessKey, } from '@/lib/internal/iam/operations' import { executeInternalJsonToolOperation } from '@/lib/internal/tool-operations/execute-json-operation' import type { InternalToolOperationHandler } from '@/lib/internal/tool-operations/types' @@ -137,6 +143,14 @@ export const executeIamTool: InternalToolOperationHandler = async ({ toolId, inp 'Failed to detach user policy', signal ) + case 'iam_get_policy': + return executeInternalJsonToolOperation( + awsIamGetPolicyContract, + input, + executeIamGetPolicy, + 'Failed to get IAM policy', + signal + ) case 'iam_get_role': return executeInternalJsonToolOperation( awsIamGetRoleContract, @@ -153,6 +167,14 @@ export const executeIamTool: InternalToolOperationHandler = async ({ toolId, inp 'Failed to get IAM user', signal ) + case 'iam_list_access_keys': + return executeInternalJsonToolOperation( + awsIamListAccessKeysContract, + input, + executeIamListAccessKeys, + 'Failed to list access keys', + signal + ) case 'iam_list_attached_role_policies': return executeInternalJsonToolOperation( awsIamListAttachedRolePoliciesContract, @@ -217,6 +239,14 @@ export const executeIamTool: InternalToolOperationHandler = async ({ toolId, inp 'Failed to simulate principal policy', signal ) + case 'iam_update_access_key': + return executeInternalJsonToolOperation( + awsIamUpdateAccessKeyContract, + input, + executeIamUpdateAccessKey, + 'Failed to update access key', + signal + ) default: return Response.json({ error: `Unsupported IAM tool: ${toolId}` }, { status: 500 }) } diff --git a/apps/sim/lib/internal/iam/operations.test.ts b/apps/sim/lib/internal/iam/operations.test.ts index c7b46afcbd0..31a414df49a 100644 --- a/apps/sim/lib/internal/iam/operations.test.ts +++ b/apps/sim/lib/internal/iam/operations.test.ts @@ -22,8 +22,10 @@ vi.mock('@/lib/internal/iam/client', () => ({ deleteUser: vi.fn(), detachRolePolicy: vi.fn(), detachUserPolicy: vi.fn(), + getPolicy: vi.fn(), getRole: vi.fn(), getUser: vi.fn(), + listAccessKeys: vi.fn(), listAttachedRolePolicies: vi.fn(), listAttachedUserPolicies: vi.fn(), listGroups: vi.fn(), @@ -32,6 +34,7 @@ vi.mock('@/lib/internal/iam/client', () => ({ listUsers: mockListUsers, removeUserFromGroup: vi.fn(), simulatePrincipalPolicy: vi.fn(), + updateAccessKey: vi.fn(), })) import { executeIamListUsers } from '@/lib/internal/iam/operations' diff --git a/apps/sim/lib/internal/iam/operations.ts b/apps/sim/lib/internal/iam/operations.ts index 1780c0d4c56..ae136afd44f 100644 --- a/apps/sim/lib/internal/iam/operations.ts +++ b/apps/sim/lib/internal/iam/operations.ts @@ -10,8 +10,10 @@ import type { AwsIamDeleteRoleBody } from '@/lib/api/contracts/tools/aws/iam-del import type { AwsIamDeleteUserBody } from '@/lib/api/contracts/tools/aws/iam-delete-user' import type { AwsIamDetachRolePolicyBody } from '@/lib/api/contracts/tools/aws/iam-detach-role-policy' import type { AwsIamDetachUserPolicyBody } from '@/lib/api/contracts/tools/aws/iam-detach-user-policy' +import type { AwsIamGetPolicyBody } from '@/lib/api/contracts/tools/aws/iam-get-policy' import type { AwsIamGetRoleBody } from '@/lib/api/contracts/tools/aws/iam-get-role' import type { AwsIamGetUserBody } from '@/lib/api/contracts/tools/aws/iam-get-user' +import type { AwsIamListAccessKeysBody } from '@/lib/api/contracts/tools/aws/iam-list-access-keys' import type { AwsIamListAttachedRolePoliciesBody } from '@/lib/api/contracts/tools/aws/iam-list-attached-role-policies' import type { AwsIamListAttachedUserPoliciesBody } from '@/lib/api/contracts/tools/aws/iam-list-attached-user-policies' import type { AwsIamListGroupsBody } from '@/lib/api/contracts/tools/aws/iam-list-groups' @@ -20,6 +22,7 @@ import type { AwsIamListRolesBody } from '@/lib/api/contracts/tools/aws/iam-list import type { AwsIamListUsersBody } from '@/lib/api/contracts/tools/aws/iam-list-users' import type { AwsIamRemoveUserFromGroupBody } from '@/lib/api/contracts/tools/aws/iam-remove-user-from-group' import type { AwsIamSimulatePrincipalPolicyBody } from '@/lib/api/contracts/tools/aws/iam-simulate-principal-policy' +import type { AwsIamUpdateAccessKeyBody } from '@/lib/api/contracts/tools/aws/iam-update-access-key' import { addUserToGroup, attachRolePolicy, @@ -33,8 +36,10 @@ import { deleteUser, detachRolePolicy, detachUserPolicy, + getPolicy, getRole, getUser, + listAccessKeys, listAttachedRolePolicies, listAttachedUserPolicies, listGroups, @@ -43,6 +48,7 @@ import { listUsers, removeUserFromGroup, simulatePrincipalPolicy, + updateAccessKey, } from '@/lib/internal/iam/client' import type { IAMConnectionConfig } from '@/tools/iam/types' @@ -322,13 +328,47 @@ export async function executeIamSimulatePrincipalPolicy( (client) => simulatePrincipalPolicy( client, - input.policySourceArn, - input.actionNames, - input.resourceArns, - input.maxResults, - input.marker, + { + policySourceArn: input.policySourceArn, + actionNames: input.actionNames, + resourceArns: input.resourceArns, + contextEntries: input.contextEntries, + maxResults: input.maxResults, + marker: input.marker, + }, signal ), signal ) } + +export async function executeIamGetPolicy(input: AwsIamGetPolicyBody, signal?: AbortSignal) { + return withIamClient(input, (client) => getPolicy(client, input.policyArn, signal), signal) +} + +export async function executeIamListAccessKeys( + input: AwsIamListAccessKeysBody, + signal?: AbortSignal +) { + return withIamClient( + input, + (client) => listAccessKeys(client, input.userName, input.maxItems, input.marker, signal), + signal + ) +} + +export async function executeIamUpdateAccessKey( + input: AwsIamUpdateAccessKeyBody, + signal?: AbortSignal +) { + return withIamClient( + input, + async (client) => { + await updateAccessKey(client, input.accessKeyIdToUpdate, input.status, input.userName, signal) + return { + message: `Access key "${input.accessKeyIdToUpdate}" set to ${input.status}`, + } + }, + signal + ) +} diff --git a/apps/sim/lib/internal/identity-center/client.ts b/apps/sim/lib/internal/identity-center/client.ts index 539a2381d94..02c5cbeef68 100644 --- a/apps/sim/lib/internal/identity-center/client.ts +++ b/apps/sim/lib/internal/identity-center/client.ts @@ -4,6 +4,7 @@ import { GetGroupIdCommand, GetUserIdCommand, IdentitystoreClient, + ListGroupMembershipsCommand, ListGroupsCommand, } from '@aws-sdk/client-identitystore' import { @@ -18,6 +19,7 @@ import { DescribeAccountAssignmentCreationStatusCommand, DescribeAccountAssignmentDeletionStatusCommand, DescribePermissionSetCommand, + ListAccountAssignmentsCommand, ListAccountAssignmentsForPrincipalCommand, ListInstancesCommand, ListPermissionSetsCommand, @@ -25,6 +27,12 @@ import { SSOAdminClient, type TargetType, } from '@aws-sdk/client-sso-admin' +import { + AWS_FANOUT_CONCURRENCY, + mapWithConcurrency, + withThrottleRetry, +} from '@/lib/internal/identity-center/concurrency' +import { resolveOrganizationsRegion } from '@/lib/internal/identity-center/partition' interface IdentityCenterConnectionConfig { region: string @@ -32,8 +40,6 @@ interface IdentityCenterConnectionConfig { secretAccessKey: string } -const AWS_ORGANIZATIONS_REGION = 'us-east-1' - export function createSSOAdminClient(config: IdentityCenterConnectionConfig): SSOAdminClient { return new SSOAdminClient({ region: config.region, @@ -56,9 +62,13 @@ export function createIdentityStoreClient( }) } +/** + * AWS Organizations is global *per partition*, so the client signs for the + * caller's partition home region rather than the caller's own region. + */ export function createOrganizationsClient(config: IdentityCenterConnectionConfig) { return new OrganizationsClient({ - region: AWS_ORGANIZATIONS_REGION, + region: resolveOrganizationsRegion(config.region), credentials: { accessKeyId: config.accessKeyId, secretAccessKey: config.secretAccessKey, @@ -126,13 +136,18 @@ export async function listPermissionSets( const listResponse = await client.send(listCommand, { abortSignal: signal }) const permissionSetArns = listResponse.PermissionSets ?? [] - const permissionSets = await Promise.all( - permissionSetArns.map(async (arn) => { + const permissionSets = await mapWithConcurrency( + permissionSetArns, + AWS_FANOUT_CONCURRENCY, + async (arn) => { const describeCommand = new DescribePermissionSetCommand({ InstanceArn: instanceArn, PermissionSetArn: arn, }) - const describeResponse = await client.send(describeCommand, { abortSignal: signal }) + const describeResponse = await withThrottleRetry( + () => client.send(describeCommand, { abortSignal: signal }), + signal + ) const permissionSet = describeResponse.PermissionSet return { permissionSetArn: permissionSet?.PermissionSetArn ?? arn, @@ -141,7 +156,7 @@ export async function listPermissionSets( sessionDuration: permissionSet?.SessionDuration ?? null, createdDate: permissionSet?.CreatedDate?.toISOString() ?? null, } - }) + } ) return { @@ -371,3 +386,101 @@ export async function listAccountAssignmentsForPrincipal( })) return { assignments, nextToken: response.NextToken ?? null, count: assignments.length } } + +export async function listAccountAssignmentsForAccount( + client: SSOAdminClient, + instanceArn: string, + accountId: string, + permissionSetArn: string, + maxResults?: number | null, + nextToken?: string | null, + signal?: AbortSignal +) { + const command = new ListAccountAssignmentsCommand({ + InstanceArn: instanceArn, + AccountId: accountId, + PermissionSetArn: permissionSetArn, + ...(maxResults ? { MaxResults: maxResults } : {}), + ...(nextToken ? { NextToken: nextToken } : {}), + }) + const response = await client.send(command, { abortSignal: signal }) + const assignments = (response.AccountAssignments ?? []).map((assignment) => ({ + accountId: assignment.AccountId ?? accountId, + permissionSetArn: assignment.PermissionSetArn ?? permissionSetArn, + principalType: assignment.PrincipalType ?? '', + principalId: assignment.PrincipalId ?? '', + })) + return { assignments, nextToken: response.NextToken ?? null, count: assignments.length } +} + +export async function describeUserById( + client: IdentitystoreClient, + identityStoreId: string, + userId: string, + signal?: AbortSignal +) { + const command = new DescribeUserCommand({ IdentityStoreId: identityStoreId, UserId: userId }) + const response = await client.send(command, { abortSignal: signal }) + const primaryEmail = + response.Emails?.find((entry) => entry.Primary)?.Value ?? response.Emails?.[0]?.Value ?? null + + return { + userId: response.UserId ?? userId, + userName: response.UserName ?? '', + displayName: response.DisplayName ?? null, + email: primaryEmail, + userStatus: response.UserStatus ?? null, + title: response.Title ?? null, + externalIds: + response.ExternalIds?.map((externalId) => ({ + issuer: externalId.Issuer ?? '', + id: externalId.Id ?? '', + })) ?? [], + } +} + +export async function describeGroupById( + client: IdentitystoreClient, + identityStoreId: string, + groupId: string, + signal?: AbortSignal +) { + const command = new DescribeGroupCommand({ IdentityStoreId: identityStoreId, GroupId: groupId }) + const response = await client.send(command, { abortSignal: signal }) + return { + groupId: response.GroupId ?? groupId, + displayName: response.DisplayName ?? null, + description: response.Description ?? null, + externalIds: + response.ExternalIds?.map((externalId) => ({ + issuer: externalId.Issuer ?? '', + id: externalId.Id ?? '', + })) ?? [], + } +} + +export async function listGroupMemberships( + client: IdentitystoreClient, + identityStoreId: string, + groupId: string, + maxResults?: number | null, + nextToken?: string | null, + signal?: AbortSignal +) { + const command = new ListGroupMembershipsCommand({ + IdentityStoreId: identityStoreId, + GroupId: groupId, + ...(maxResults ? { MaxResults: maxResults } : {}), + ...(nextToken ? { NextToken: nextToken } : {}), + }) + const response = await client.send(command, { abortSignal: signal }) + const memberships = (response.GroupMemberships ?? []).map((membership) => ({ + membershipId: membership.MembershipId ?? '', + groupId: membership.GroupId ?? groupId, + userId: + membership.MemberId && 'UserId' in membership.MemberId + ? (membership.MemberId.UserId ?? null) + : null, + })) + return { memberships, nextToken: response.NextToken ?? null, count: memberships.length } +} diff --git a/apps/sim/lib/internal/identity-center/concurrency.test.ts b/apps/sim/lib/internal/identity-center/concurrency.test.ts new file mode 100644 index 00000000000..b0fde53c06c --- /dev/null +++ b/apps/sim/lib/internal/identity-center/concurrency.test.ts @@ -0,0 +1,126 @@ +/** + * @vitest-environment node + */ +import { sleep } from '@sim/utils/helpers' +import { describe, expect, it, vi } from 'vitest' +import { + AWS_FANOUT_CONCURRENCY, + mapWithConcurrency, + withThrottleRetry, +} from '@/lib/internal/identity-center/concurrency' + +function throttlingError(): Error { + const error = new Error('Rate exceeded') + error.name = 'ThrottlingException' + return error +} + +describe('mapWithConcurrency', () => { + it('preserves input order in the result', async () => { + const items = [5, 4, 3, 2, 1] + const results = await mapWithConcurrency(items, 3, async (item) => { + await sleep(item) + return item * 2 + }) + expect(results).toEqual([10, 8, 6, 4, 2]) + }) + + it('never exceeds the concurrency ceiling', async () => { + const items = Array.from({ length: 100 }, (_, index) => index) + let inFlight = 0 + let peak = 0 + + await mapWithConcurrency(items, AWS_FANOUT_CONCURRENCY, async (item) => { + inFlight++ + peak = Math.max(peak, inFlight) + await sleep(1) + inFlight-- + return item + }) + + expect(peak).toBeLessThanOrEqual(AWS_FANOUT_CONCURRENCY) + expect(peak).toBeGreaterThan(1) + }) + + it('stops starting work after a rejection', async () => { + const items = Array.from({ length: 40 }, (_, index) => index) + let started = 0 + + await expect( + mapWithConcurrency(items, 2, async (item) => { + started++ + await sleep(1) + if (item === 0) throw new Error('boom') + return item + }) + ).rejects.toThrow('boom') + + expect(started).toBeLessThan(items.length) + }) +}) + +describe('withThrottleRetry', () => { + it('retries a throttled call until it succeeds', async () => { + const operation = vi + .fn() + .mockRejectedValueOnce(throttlingError()) + .mockRejectedValueOnce(throttlingError()) + .mockResolvedValue('ok') + + await expect(withThrottleRetry(operation)).resolves.toBe('ok') + expect(operation).toHaveBeenCalledTimes(3) + }) + + it('does not retry a non-throttling failure', async () => { + const operation = vi.fn().mockRejectedValue(new Error('AccessDeniedException')) + + await expect(withThrottleRetry(operation)).rejects.toThrow('AccessDeniedException') + expect(operation).toHaveBeenCalledTimes(1) + }) + + it('gives up after the attempt ceiling', async () => { + const operation = vi.fn().mockRejectedValue(throttlingError()) + + await expect(withThrottleRetry(operation)).rejects.toThrow('Rate exceeded') + expect(operation).toHaveBeenCalledTimes(4) + }) + + it('stops immediately when the caller aborts', async () => { + const controller = new AbortController() + controller.abort() + const operation = vi.fn() + + await expect(withThrottleRetry(operation, controller.signal)).rejects.toThrow() + expect(operation).not.toHaveBeenCalled() + }) + + it('exits a throttling backoff as soon as the caller aborts', async () => { + const controller = new AbortController() + let calls = 0 + let abortedAt = 0 + + /** + * Aborts on the third attempt, whose pending backoff is at least 640ms + * (200ms base doubled twice, minus the 20% jitter floor). A backoff that + * ignored the signal would therefore keep the caller waiting far longer + * than the assertion below allows. + */ + const operation = vi.fn(async () => { + calls++ + if (calls === 3) { + abortedAt = Date.now() + controller.abort() + } + throw throttlingError() + }) + + const rejection = await withThrottleRetry(operation, controller.signal).catch( + (error: unknown) => error + ) + const elapsedSinceAbort = Date.now() - abortedAt + + expect((rejection as Error).name).toBe('AbortError') + expect(operation).toHaveBeenCalledTimes(3) + expect(elapsedSinceAbort).toBeLessThan(200) + }) +}) diff --git a/apps/sim/lib/internal/identity-center/concurrency.ts b/apps/sim/lib/internal/identity-center/concurrency.ts new file mode 100644 index 00000000000..a80a4e8acb9 --- /dev/null +++ b/apps/sim/lib/internal/identity-center/concurrency.ts @@ -0,0 +1,89 @@ +import { interruptibleSleep } from '@sim/utils/helpers' +import { backoffWithJitter } from '@sim/utils/retry' + +/** + * Ceiling on simultaneous per-item AWS calls issued while expanding a list + * page. `ListPermissionSets` returns up to 100 ARNs in one page, so an + * uncapped fan-out would fire 100 concurrent `DescribePermissionSet` calls and + * throttle itself. + */ +export const AWS_FANOUT_CONCURRENCY = 6 + +/** Total attempts (initial + retries) for a throttled AWS call. */ +const MAX_THROTTLE_ATTEMPTS = 4 + +const THROTTLE_ERROR_NAMES = new Set([ + 'ThrottlingException', + 'Throttling', + 'ThrottledException', + 'TooManyRequestsException', + 'RequestLimitExceeded', + 'RequestThrottled', + 'RequestThrottledException', + 'SlowDown', +]) + +function isThrottlingError(error: unknown): boolean { + if (typeof error !== 'object' || error === null) return false + const candidate = error as { name?: unknown; $metadata?: { httpStatusCode?: unknown } } + if (typeof candidate.name === 'string' && THROTTLE_ERROR_NAMES.has(candidate.name)) return true + return candidate.$metadata?.httpStatusCode === 429 +} + +/** + * Runs an AWS call, retrying with jittered exponential backoff while the + * service reports throttling. Non-throttling failures and aborts propagate + * immediately. + * + * The backoff itself is interruptible: an abort during the wait resolves it + * early, so the next loop iteration's `throwIfAborted` fires without the caller + * having to sit out the remaining delay. + */ +export async function withThrottleRetry( + operation: () => Promise, + signal?: AbortSignal +): Promise { + for (let attempt = 1; ; attempt++) { + signal?.throwIfAborted() + try { + return await operation() + } catch (error) { + if (attempt >= MAX_THROTTLE_ATTEMPTS || !isThrottlingError(error)) throw error + await interruptibleSleep( + backoffWithJitter(attempt, null, { baseMs: 200, maxMs: 5_000 }), + signal + ) + } + } +} + +/** + * Maps `items` through `fn` with at most `limit` calls in flight, preserving + * input order in the result. The first rejection propagates and no further + * items are started. + */ +export async function mapWithConcurrency( + items: readonly TItem[], + limit: number, + fn: (item: TItem, index: number) => Promise +): Promise { + const results = new Array(items.length) + let cursor = 0 + let failed = false + + const worker = async (): Promise => { + while (!failed && cursor < items.length) { + const index = cursor++ + try { + results[index] = await fn(items[index], index) + } catch (error) { + failed = true + throw error + } + } + } + + const workerCount = Math.min(Math.max(1, limit), items.length) + await Promise.all(Array.from({ length: workerCount }, worker)) + return results +} diff --git a/apps/sim/lib/internal/identity-center/execute-tool.test.ts b/apps/sim/lib/internal/identity-center/execute-tool.test.ts index 8bff280c367..bd14eea48e5 100644 --- a/apps/sim/lib/internal/identity-center/execute-tool.test.ts +++ b/apps/sim/lib/internal/identity-center/execute-tool.test.ts @@ -16,6 +16,10 @@ const mockOperations = vi.hoisted(() => ({ executeIdentityCenterCheckAssignmentStatus: vi.fn(), executeIdentityCenterCheckAssignmentDeletionStatus: vi.fn(), executeIdentityCenterListAccountAssignments: vi.fn(), + executeIdentityCenterListAssignmentsForAccount: vi.fn(), + executeIdentityCenterDescribeUser: vi.fn(), + executeIdentityCenterDescribeGroup: vi.fn(), + executeIdentityCenterListGroupMemberships: vi.fn(), })) vi.mock('@/lib/internal/identity-center/operations', () => mockOperations) @@ -29,6 +33,13 @@ const CONNECTION = { secretAccessKey: 'secret-key', } +const INSTANCE_ARN = 'arn:aws:sso:::instance/ssoins-1234567890abcdef' +const PERMISSION_SET_ARN = 'arn:aws:sso:::permissionSet/ssoins-1234567890abcdef/ps-1234567890abcdef' +const IDENTITY_STORE_ID = 'd-1234567890' +const USER_PRINCIPAL_ID = '9067b2d8-8021-70f8-1234-5c6d7e8f9012' +const GROUP_PRINCIPAL_ID = '1234567890-a1b2c3d4-e5f6-7a8b-9c0d-1e2f3a4b5c6d' +const REQUEST_ID = '11111111-2222-3333-4444-555555555555' + function createRequest( overrides: Partial = {} ): InternalToolOperationCall { @@ -65,33 +76,33 @@ const TOOL_CASES = [ }, { toolId: 'identity_center_list_permission_sets', - input: { ...CONNECTION, instanceArn: 'arn:aws:sso:::instance/ssoins-test' }, + input: { ...CONNECTION, instanceArn: INSTANCE_ARN }, operation: mockOperations.executeIdentityCenterListPermissionSets, }, { toolId: 'identity_center_get_user', - input: { ...CONNECTION, identityStoreId: 'd-test', email: 'user@example.com' }, + input: { ...CONNECTION, identityStoreId: IDENTITY_STORE_ID, email: 'user@example.com' }, operation: mockOperations.executeIdentityCenterGetUser, }, { toolId: 'identity_center_get_group', - input: { ...CONNECTION, identityStoreId: 'd-test', displayName: 'Engineering' }, + input: { ...CONNECTION, identityStoreId: IDENTITY_STORE_ID, displayName: 'Engineering' }, operation: mockOperations.executeIdentityCenterGetGroup, }, { toolId: 'identity_center_list_groups', - input: { ...CONNECTION, identityStoreId: 'd-test' }, + input: { ...CONNECTION, identityStoreId: IDENTITY_STORE_ID }, operation: mockOperations.executeIdentityCenterListGroups, }, { toolId: 'identity_center_create_account_assignment', input: { ...CONNECTION, - instanceArn: 'arn:aws:sso:::instance/ssoins-test', + instanceArn: INSTANCE_ARN, accountId: '123456789012', - permissionSetArn: 'arn:aws:sso:::permissionSet/ssoins-test/ps-test', + permissionSetArn: PERMISSION_SET_ARN, principalType: 'USER', - principalId: 'user-1', + principalId: USER_PRINCIPAL_ID, }, operation: mockOperations.executeIdentityCenterCreateAccountAssignment, }, @@ -99,11 +110,11 @@ const TOOL_CASES = [ toolId: 'identity_center_delete_account_assignment', input: { ...CONNECTION, - instanceArn: 'arn:aws:sso:::instance/ssoins-test', + instanceArn: INSTANCE_ARN, accountId: '123456789012', - permissionSetArn: 'arn:aws:sso:::permissionSet/ssoins-test/ps-test', + permissionSetArn: PERMISSION_SET_ARN, principalType: 'GROUP', - principalId: 'group-1', + principalId: GROUP_PRINCIPAL_ID, }, operation: mockOperations.executeIdentityCenterDeleteAccountAssignment, }, @@ -111,8 +122,8 @@ const TOOL_CASES = [ toolId: 'identity_center_check_assignment_status', input: { ...CONNECTION, - instanceArn: 'arn:aws:sso:::instance/ssoins-test', - requestId: 'request-1', + instanceArn: INSTANCE_ARN, + requestId: REQUEST_ID, }, operation: mockOperations.executeIdentityCenterCheckAssignmentStatus, }, @@ -120,8 +131,8 @@ const TOOL_CASES = [ toolId: 'identity_center_check_assignment_deletion_status', input: { ...CONNECTION, - instanceArn: 'arn:aws:sso:::instance/ssoins-test', - requestId: 'request-1', + instanceArn: INSTANCE_ARN, + requestId: REQUEST_ID, }, operation: mockOperations.executeIdentityCenterCheckAssignmentDeletionStatus, }, @@ -129,12 +140,49 @@ const TOOL_CASES = [ toolId: 'identity_center_list_account_assignments', input: { ...CONNECTION, - instanceArn: 'arn:aws:sso:::instance/ssoins-test', + instanceArn: INSTANCE_ARN, principalType: 'USER', - principalId: 'user-1', + principalId: USER_PRINCIPAL_ID, }, operation: mockOperations.executeIdentityCenterListAccountAssignments, }, + { + toolId: 'identity_center_list_assignments_for_account', + input: { + ...CONNECTION, + instanceArn: INSTANCE_ARN, + accountId: '123456789012', + permissionSetArn: PERMISSION_SET_ARN, + }, + operation: mockOperations.executeIdentityCenterListAssignmentsForAccount, + }, + { + toolId: 'identity_center_describe_user', + input: { + ...CONNECTION, + identityStoreId: IDENTITY_STORE_ID, + userId: USER_PRINCIPAL_ID, + }, + operation: mockOperations.executeIdentityCenterDescribeUser, + }, + { + toolId: 'identity_center_describe_group', + input: { + ...CONNECTION, + identityStoreId: IDENTITY_STORE_ID, + groupId: GROUP_PRINCIPAL_ID, + }, + operation: mockOperations.executeIdentityCenterDescribeGroup, + }, + { + toolId: 'identity_center_list_group_memberships', + input: { + ...CONNECTION, + identityStoreId: IDENTITY_STORE_ID, + groupId: GROUP_PRINCIPAL_ID, + }, + operation: mockOperations.executeIdentityCenterListGroupMemberships, + }, ] as const describe('executeIdentityCenterTool', () => { @@ -181,6 +229,18 @@ describe('executeIdentityCenterTool', () => { }) }) + it.each([ + ['a malformed instance ARN', { ...CONNECTION, instanceArn: 'ssoins-test' }], + ['a truncated request ID', { ...CONNECTION, instanceArn: INSTANCE_ARN, requestId: 'req-1' }], + ])('rejects %s before provider work', async (_label, input) => { + const response = await executeIdentityCenterTool( + createRequest({ toolId: 'identity_center_check_assignment_status', input }) + ) + + expect(response.status).toBe(400) + expect(mockOperations.executeIdentityCenterCheckAssignmentStatus).not.toHaveBeenCalled() + }) + it('propagates cancellation without starting provider work', async () => { const controller = new AbortController() controller.abort(new DOMException('cancelled', 'AbortError')) diff --git a/apps/sim/lib/internal/identity-center/execute-tool.ts b/apps/sim/lib/internal/identity-center/execute-tool.ts index 47e21a478da..9904d9f7d78 100644 --- a/apps/sim/lib/internal/identity-center/execute-tool.ts +++ b/apps/sim/lib/internal/identity-center/execute-tool.ts @@ -3,10 +3,14 @@ import { awsIdentityCenterCheckAssignmentStatusContract } from '@/lib/api/contra import { awsIdentityCenterCreateAccountAssignmentContract } from '@/lib/api/contracts/tools/aws/identity-center-create-account-assignment' import { awsIdentityCenterDeleteAccountAssignmentContract } from '@/lib/api/contracts/tools/aws/identity-center-delete-account-assignment' import { awsIdentityCenterDescribeAccountContract } from '@/lib/api/contracts/tools/aws/identity-center-describe-account' +import { awsIdentityCenterDescribeGroupContract } from '@/lib/api/contracts/tools/aws/identity-center-describe-group' +import { awsIdentityCenterDescribeUserContract } from '@/lib/api/contracts/tools/aws/identity-center-describe-user' import { awsIdentityCenterGetGroupContract } from '@/lib/api/contracts/tools/aws/identity-center-get-group' import { awsIdentityCenterGetUserContract } from '@/lib/api/contracts/tools/aws/identity-center-get-user' import { awsIdentityCenterListAccountAssignmentsContract } from '@/lib/api/contracts/tools/aws/identity-center-list-account-assignments' import { awsIdentityCenterListAccountsContract } from '@/lib/api/contracts/tools/aws/identity-center-list-accounts' +import { awsIdentityCenterListAssignmentsForAccountContract } from '@/lib/api/contracts/tools/aws/identity-center-list-assignments-for-account' +import { awsIdentityCenterListGroupMembershipsContract } from '@/lib/api/contracts/tools/aws/identity-center-list-group-memberships' import { awsIdentityCenterListGroupsContract } from '@/lib/api/contracts/tools/aws/identity-center-list-groups' import { awsIdentityCenterListInstancesContract } from '@/lib/api/contracts/tools/aws/identity-center-list-instances' import { awsIdentityCenterListPermissionSetsContract } from '@/lib/api/contracts/tools/aws/identity-center-list-permission-sets' @@ -16,10 +20,14 @@ import { executeIdentityCenterCreateAccountAssignment, executeIdentityCenterDeleteAccountAssignment, executeIdentityCenterDescribeAccount, + executeIdentityCenterDescribeGroup, + executeIdentityCenterDescribeUser, executeIdentityCenterGetGroup, executeIdentityCenterGetUser, executeIdentityCenterListAccountAssignments, executeIdentityCenterListAccounts, + executeIdentityCenterListAssignmentsForAccount, + executeIdentityCenterListGroupMemberships, executeIdentityCenterListGroups, executeIdentityCenterListInstances, executeIdentityCenterListPermissionSets, @@ -131,6 +139,38 @@ export const executeIdentityCenterTool: InternalToolOperationHandler = async ({ 'Failed to list account assignments', signal ) + case 'identity_center_list_assignments_for_account': + return executeInternalJsonToolOperation( + awsIdentityCenterListAssignmentsForAccountContract, + input, + executeIdentityCenterListAssignmentsForAccount, + 'Failed to list assignments for account', + signal + ) + case 'identity_center_describe_user': + return executeInternalJsonToolOperation( + awsIdentityCenterDescribeUserContract, + input, + executeIdentityCenterDescribeUser, + 'Failed to describe user', + signal + ) + case 'identity_center_describe_group': + return executeInternalJsonToolOperation( + awsIdentityCenterDescribeGroupContract, + input, + executeIdentityCenterDescribeGroup, + 'Failed to describe group', + signal + ) + case 'identity_center_list_group_memberships': + return executeInternalJsonToolOperation( + awsIdentityCenterListGroupMembershipsContract, + input, + executeIdentityCenterListGroupMemberships, + 'Failed to list group memberships', + signal + ) default: return Response.json( { error: `Unsupported Identity Center tool: ${toolId}` }, diff --git a/apps/sim/lib/internal/identity-center/operations.test.ts b/apps/sim/lib/internal/identity-center/operations.test.ts index f78050438e0..52ce4318cbc 100644 --- a/apps/sim/lib/internal/identity-center/operations.test.ts +++ b/apps/sim/lib/internal/identity-center/operations.test.ts @@ -18,10 +18,14 @@ vi.mock('@/lib/internal/identity-center/client', () => ({ createSSOAdminClient: mockCreateSSOAdminClient, deleteAccountAssignment: vi.fn(), describeAccount: vi.fn(), + describeGroupById: vi.fn(), + describeUserById: vi.fn(), getGroupByDisplayName: vi.fn(), getUserByEmail: vi.fn(), + listAccountAssignmentsForAccount: vi.fn(), listAccountAssignmentsForPrincipal: vi.fn(), listAccounts: vi.fn(), + listGroupMemberships: vi.fn(), listGroups: vi.fn(), listInstances: mockListInstances, listPermissionSets: vi.fn(), diff --git a/apps/sim/lib/internal/identity-center/operations.ts b/apps/sim/lib/internal/identity-center/operations.ts index 0f88ce9d9f3..0a1adb7e25d 100644 --- a/apps/sim/lib/internal/identity-center/operations.ts +++ b/apps/sim/lib/internal/identity-center/operations.ts @@ -3,10 +3,14 @@ import type { AwsIdentityCenterCheckAssignmentStatusBody } from '@/lib/api/contr import type { AwsIdentityCenterCreateAccountAssignmentBody } from '@/lib/api/contracts/tools/aws/identity-center-create-account-assignment' import type { AwsIdentityCenterDeleteAccountAssignmentBody } from '@/lib/api/contracts/tools/aws/identity-center-delete-account-assignment' import type { AwsIdentityCenterDescribeAccountBody } from '@/lib/api/contracts/tools/aws/identity-center-describe-account' +import type { AwsIdentityCenterDescribeGroupBody } from '@/lib/api/contracts/tools/aws/identity-center-describe-group' +import type { AwsIdentityCenterDescribeUserBody } from '@/lib/api/contracts/tools/aws/identity-center-describe-user' import type { AwsIdentityCenterGetGroupBody } from '@/lib/api/contracts/tools/aws/identity-center-get-group' import type { AwsIdentityCenterGetUserBody } from '@/lib/api/contracts/tools/aws/identity-center-get-user' import type { AwsIdentityCenterListAccountAssignmentsBody } from '@/lib/api/contracts/tools/aws/identity-center-list-account-assignments' import type { AwsIdentityCenterListAccountsBody } from '@/lib/api/contracts/tools/aws/identity-center-list-accounts' +import type { AwsIdentityCenterListAssignmentsForAccountBody } from '@/lib/api/contracts/tools/aws/identity-center-list-assignments-for-account' +import type { AwsIdentityCenterListGroupMembershipsBody } from '@/lib/api/contracts/tools/aws/identity-center-list-group-memberships' import type { AwsIdentityCenterListGroupsBody } from '@/lib/api/contracts/tools/aws/identity-center-list-groups' import type { AwsIdentityCenterListInstancesBody } from '@/lib/api/contracts/tools/aws/identity-center-list-instances' import type { AwsIdentityCenterListPermissionSetsBody } from '@/lib/api/contracts/tools/aws/identity-center-list-permission-sets' @@ -19,10 +23,14 @@ import { createSSOAdminClient, deleteAccountAssignment, describeAccount, + describeGroupById, + describeUserById, getGroupByDisplayName, getUserByEmail, + listAccountAssignmentsForAccount, listAccountAssignmentsForPrincipal, listAccounts, + listGroupMemberships, listGroups, listInstances, listPermissionSets, @@ -211,3 +219,66 @@ export async function executeIdentityCenterListAccountAssignments( client.destroy() } } + +export async function executeIdentityCenterListAssignmentsForAccount( + input: AwsIdentityCenterListAssignmentsForAccountBody, + signal?: AbortSignal +) { + const client = createSSOAdminClient(input) + try { + return await listAccountAssignmentsForAccount( + client, + input.instanceArn, + input.accountId, + input.permissionSetArn, + input.maxResults, + input.nextToken, + signal + ) + } finally { + client.destroy() + } +} + +export async function executeIdentityCenterDescribeUser( + input: AwsIdentityCenterDescribeUserBody, + signal?: AbortSignal +) { + const client = createIdentityStoreClient(input) + try { + return await describeUserById(client, input.identityStoreId, input.userId, signal) + } finally { + client.destroy() + } +} + +export async function executeIdentityCenterDescribeGroup( + input: AwsIdentityCenterDescribeGroupBody, + signal?: AbortSignal +) { + const client = createIdentityStoreClient(input) + try { + return await describeGroupById(client, input.identityStoreId, input.groupId, signal) + } finally { + client.destroy() + } +} + +export async function executeIdentityCenterListGroupMemberships( + input: AwsIdentityCenterListGroupMembershipsBody, + signal?: AbortSignal +) { + const client = createIdentityStoreClient(input) + try { + return await listGroupMemberships( + client, + input.identityStoreId, + input.groupId, + input.maxResults, + input.nextToken, + signal + ) + } finally { + client.destroy() + } +} diff --git a/apps/sim/lib/internal/identity-center/partition.test.ts b/apps/sim/lib/internal/identity-center/partition.test.ts new file mode 100644 index 00000000000..8c8facd6f69 --- /dev/null +++ b/apps/sim/lib/internal/identity-center/partition.test.ts @@ -0,0 +1,86 @@ +/** + * @vitest-environment node + */ +import { describe, expect, it } from 'vitest' +import { validateAwsRegion } from '@/lib/core/security/input-validation' +import { + getAwsPartition, + resolveOrganizationsRegion, +} from '@/lib/internal/identity-center/partition' + +describe('getAwsPartition', () => { + it.each([ + ['us-east-1', 'aws'], + ['eu-west-2', 'aws'], + ['ap-southeast-1', 'aws'], + ['us-gov-west-1', 'aws-us-gov'], + ['us-gov-east-1', 'aws-us-gov'], + ['cn-north-1', 'aws-cn'], + ['cn-northwest-1', 'aws-cn'], + ['us-iso-east-1', 'aws-iso'], + ['us-isob-east-1', 'aws-iso-b'], + ['us-isof-east-1', 'aws-iso-f'], + ['us-isof-south-1', 'aws-iso-f'], + ['eu-isoe-west-1', 'aws-iso-e'], + ['eusc-de-east-1', 'aws-eusc'], + ])('maps %s to the %s partition', (region, partition) => { + expect(getAwsPartition(region)).toBe(partition) + }) + + /** + * `getAwsPartition` falls through to the commercial `aws` partition for any region + * it does not recognize, so widening `validateAwsRegion` without adding the matching + * rule here silently routes an isolated-partition caller to a commercial endpoint. + * This couples the two so that drift fails the suite instead of shipping. + */ + it('claims a non-commercial partition for every isolated region the shared validator admits', () => { + const isolatedRegions = [ + 'us-gov-west-1', + 'us-gov-east-1', + 'cn-north-1', + 'cn-northwest-1', + 'us-iso-east-1', + 'us-isob-east-1', + 'us-isof-east-1', + 'us-isof-south-1', + 'eu-isoe-west-1', + 'eusc-de-east-1', + ] + + for (const region of isolatedRegions) { + expect(validateAwsRegion(region).isValid).toBe(true) + expect(getAwsPartition(region)).not.toBe('aws') + } + }) +}) + +describe('resolveOrganizationsRegion', () => { + it('signs commercial regions against the us-east-1 Organizations endpoint', () => { + expect(resolveOrganizationsRegion('us-east-1')).toBe('us-east-1') + expect(resolveOrganizationsRegion('eu-west-2')).toBe('us-east-1') + expect(resolveOrganizationsRegion('ap-northeast-1')).toBe('us-east-1') + }) + + it('never sends a GovCloud caller to a commercial endpoint', () => { + for (const region of ['us-gov-west-1', 'us-gov-east-1']) { + const resolved = resolveOrganizationsRegion(region) + expect(resolved).not.toBe('us-east-1') + expect(resolved).toBe('us-gov-west-1') + } + }) + + it('never sends a China caller to a commercial endpoint', () => { + for (const region of ['cn-north-1', 'cn-northwest-1']) { + const resolved = resolveOrganizationsRegion(region) + expect(resolved).not.toBe('us-east-1') + expect(resolved).toBe('cn-northwest-1') + } + }) + + it.each(['us-iso-east-1', 'us-isob-east-1', 'eu-isoe-west-1', 'eusc-de-east-1'])( + 'throws rather than guessing an endpoint for %s', + (region) => { + expect(() => resolveOrganizationsRegion(region)).toThrow(/does not publish/) + } + ) +}) diff --git a/apps/sim/lib/internal/identity-center/partition.ts b/apps/sim/lib/internal/identity-center/partition.ts new file mode 100644 index 00000000000..b1ce41ae739 --- /dev/null +++ b/apps/sim/lib/internal/identity-center/partition.ts @@ -0,0 +1,82 @@ +/** + * AWS partitions Sim can address, derived from the region prefixes the shared + * region validator admits (`validateAwsRegion`). + */ +export type AwsPartition = + | 'aws' + | 'aws-us-gov' + | 'aws-cn' + | 'aws-iso' + | 'aws-iso-b' + | 'aws-iso-e' + | 'aws-iso-f' + | 'aws-eusc' + +interface PartitionRule { + prefix: string + partition: AwsPartition +} + +/** + * Ordered longest-prefix-first so `us-isob-east-1` and `us-isof-south-1` are not + * mistaken for `us-iso-*`. Regions that match no prefix belong to the commercial + * `aws` partition, so every isolated partition the shared region validator admits + * must appear here — otherwise it falls through to `aws` and + * `resolveOrganizationsRegion` hands back a commercial endpoint instead of throwing. + */ +const PARTITION_RULES: readonly PartitionRule[] = [ + { prefix: 'us-gov-', partition: 'aws-us-gov' }, + { prefix: 'us-isob-', partition: 'aws-iso-b' }, + { prefix: 'us-isof-', partition: 'aws-iso-f' }, + { prefix: 'us-iso-', partition: 'aws-iso' }, + { prefix: 'eu-isoe-', partition: 'aws-iso-e' }, + { prefix: 'eusc-', partition: 'aws-eusc' }, + { prefix: 'cn-', partition: 'aws-cn' }, +] as const + +/** + * Resolves the AWS partition a region belongs to. + */ +export function getAwsPartition(region: string): AwsPartition { + const normalized = region.trim().toLowerCase() + for (const rule of PARTITION_RULES) { + if (normalized.startsWith(rule.prefix)) return rule.partition + } + return 'aws' +} + +/** + * AWS Organizations is a global service, but global *per partition* — each + * partition has exactly one Organizations endpoint and a caller must sign for + * that partition's home region. + * + * - `aws` → `organizations.us-east-1.amazonaws.com` + * - `aws-us-gov` → `organizations.us-gov-west-1.amazonaws.com` (both GovCloud regions) + * - `aws-cn` → `organizations.cn-northwest-1.amazonaws.com.cn` + * + * @see https://docs.aws.amazon.com/general/latest/gr/ao.html + * @see https://docs.aws.amazon.com/organizations/latest/APIReference/Welcome.html + */ +const ORGANIZATIONS_REGION_BY_PARTITION: Partial> = { + aws: 'us-east-1', + 'aws-us-gov': 'us-gov-west-1', + 'aws-cn': 'cn-northwest-1', +} + +/** + * Returns the Organizations home region to sign for, given the caller's region. + * + * Throws for the ISO and EU Sovereign partitions rather than silently falling + * back to a commercial endpoint the caller's credentials cannot sign for: AWS + * does not publish Organizations endpoints for those partitions. + */ +export function resolveOrganizationsRegion(region: string): string { + const partition = getAwsPartition(region) + const organizationsRegion = ORGANIZATIONS_REGION_BY_PARTITION[partition] + if (!organizationsRegion) { + throw new Error( + `AWS Organizations is not supported in the ${partition} partition (region "${region}"): AWS does not publish an Organizations endpoint for it. Use an operation that does not read AWS Organizations, such as List Instances or List Permission Sets.` + ) + } + return organizationsRegion +} diff --git a/apps/sim/lib/internal/sqs/client.ts b/apps/sim/lib/internal/sqs/client.ts index ec0f3875cf0..9c762c0439d 100644 --- a/apps/sim/lib/internal/sqs/client.ts +++ b/apps/sim/lib/internal/sqs/client.ts @@ -1,4 +1,4 @@ -import { SendMessageCommand, type SendMessageCommandOutput, SQSClient } from '@aws-sdk/client-sqs' +import { SQSClient } from '@aws-sdk/client-sqs' import type { SqsConnectionConfig } from '@/tools/sqs/types' export function createSqsClient(config: SqsConnectionConfig): SQSClient { @@ -10,32 +10,3 @@ export function createSqsClient(config: SqsConnectionConfig): SQSClient { }, }) } - -export async function sendMessage( - client: SQSClient, - queueUrl: string, - data: Record, - messageGroupId?: string | null, - messageDeduplicationId?: string | null, - signal?: AbortSignal -): Promise | null> { - const command = new SendMessageCommand({ - QueueUrl: queueUrl, - MessageBody: JSON.stringify(data), - MessageGroupId: messageGroupId ?? undefined, - ...(messageDeduplicationId ? { MessageDeduplicationId: messageDeduplicationId } : {}), - }) - - const response = await client.send(command, { abortSignal: signal }) - return parseSendMessageResponse(response) -} - -function parseSendMessageResponse( - response: SendMessageCommandOutput -): Record | null { - if (!response) { - return null - } - - return { id: response.MessageId } -} diff --git a/apps/sim/lib/internal/sqs/execute-tool.test.ts b/apps/sim/lib/internal/sqs/execute-tool.test.ts index 86c798b1206..7e1921d2ffe 100644 --- a/apps/sim/lib/internal/sqs/execute-tool.test.ts +++ b/apps/sim/lib/internal/sqs/execute-tool.test.ts @@ -3,22 +3,51 @@ */ import { beforeEach, describe, expect, it, vi } from 'vitest' -const { mockExecuteSqsSend } = vi.hoisted(() => ({ - mockExecuteSqsSend: vi.fn(), -})) +const { mockExecuteSqsSend, mockExecuteSqsReceiveMessage, mockOperations } = vi.hoisted(() => { + const names = [ + 'executeSqsCancelMessageMoveTask', + 'executeSqsChangeMessageVisibility', + 'executeSqsChangeMessageVisibilityBatch', + 'executeSqsCreateQueue', + 'executeSqsDeleteMessage', + 'executeSqsDeleteMessageBatch', + 'executeSqsDeleteQueue', + 'executeSqsGetQueueAttributes', + 'executeSqsGetQueueUrl', + 'executeSqsListDeadLetterSourceQueues', + 'executeSqsListMessageMoveTasks', + 'executeSqsListQueues', + 'executeSqsListQueueTags', + 'executeSqsPurgeQueue', + 'executeSqsReceiveMessage', + 'executeSqsSend', + 'executeSqsSendMessageBatch', + 'executeSqsSetQueueAttributes', + 'executeSqsStartMessageMoveTask', + 'executeSqsTagQueue', + 'executeSqsUntagQueue', + ] + const operations: Record> = {} + for (const name of names) operations[name] = vi.fn() + return { + mockOperations: operations, + mockExecuteSqsSend: operations.executeSqsSend, + mockExecuteSqsReceiveMessage: operations.executeSqsReceiveMessage, + } +}) -vi.mock('@/lib/internal/sqs/operations', () => ({ - executeSqsSend: mockExecuteSqsSend, -})) +vi.mock('@/lib/internal/sqs/operations', () => mockOperations) import { executeSqsTool } from '@/lib/internal/sqs/execute-tool' import type { InternalToolOperationCall } from '@/lib/internal/tool-operations/types' +const QUEUE_URL = 'https://sqs.us-east-1.amazonaws.com/123456789012/test-queue' + const BODY = { region: 'us-east-1', accessKeyId: 'access-key', secretAccessKey: 'secret-key', - queueUrl: 'https://sqs.us-east-1.amazonaws.com/123456789012/test-queue', + queueUrl: QUEUE_URL, data: { action: 'process' }, messageGroupId: 'group-1', messageDeduplicationId: 'message-1', @@ -35,7 +64,6 @@ function createRequest( workflowId: 'workflow-1', workspaceId: 'workspace-1', userId: 'user-1', - metadata: {}, }, requestId: 'request-1', ...overrides, @@ -49,7 +77,7 @@ describe('executeSqsTool', () => { it('validates and executes the SQS send operation', async () => { const controller = new AbortController() - const result = { message: `Message sent to SQS queue ${BODY.queueUrl}`, id: 'message-id' } + const result = { message: `Message sent to SQS queue ${QUEUE_URL}`, id: 'message-id' } mockExecuteSqsSend.mockResolvedValue(result) const response = await executeSqsTool(createRequest({ signal: controller.signal })) @@ -59,6 +87,27 @@ describe('executeSqsTool', () => { expect(mockExecuteSqsSend).toHaveBeenCalledWith(BODY, controller.signal) }) + it('dispatches each tool id to its own operation', async () => { + mockExecuteSqsReceiveMessage.mockResolvedValue({ messages: [], count: 0 }) + + const response = await executeSqsTool( + createRequest({ + toolId: 'sqs_receive_message', + input: { + region: 'us-east-1', + accessKeyId: 'access-key', + secretAccessKey: 'secret-key', + queueUrl: QUEUE_URL, + waitTimeSeconds: 20, + }, + }) + ) + + expect(response.status).toBe(200) + expect(mockExecuteSqsReceiveMessage).toHaveBeenCalledOnce() + expect(mockExecuteSqsSend).not.toHaveBeenCalled() + }) + it('returns the route-compatible validation envelope before provider work', async () => { const response = await executeSqsTool(createRequest({ input: { ...BODY, data: {} } })) @@ -70,6 +119,92 @@ describe('executeSqsTool', () => { expect(mockExecuteSqsSend).not.toHaveBeenCalled() }) + it('rejects an out-of-range receive batch size before provider work', async () => { + const response = await executeSqsTool( + createRequest({ + toolId: 'sqs_receive_message', + input: { + region: 'us-east-1', + accessKeyId: 'access-key', + secretAccessKey: 'secret-key', + queueUrl: QUEUE_URL, + maxNumberOfMessages: 25, + }, + }) + ) + + expect(response.status).toBe(400) + expect(mockExecuteSqsReceiveMessage).not.toHaveBeenCalled() + }) + + it('rejects a Binary message attribute, which has no JSON-safe value form', async () => { + const response = await executeSqsTool( + createRequest({ + input: { + ...BODY, + messageAttributes: { thumbnail: { dataType: 'Binary', stringValue: 'AAAA' } }, + }, + }) + ) + + expect(response.status).toBe(400) + expect(mockExecuteSqsSend).not.toHaveBeenCalled() + }) + + it('accepts a custom-labelled Number message attribute', async () => { + mockExecuteSqsSend.mockResolvedValue({ message: 'sent', id: 'message-id' }) + + const response = await executeSqsTool( + createRequest({ + input: { + ...BODY, + messageAttributes: { ratio: { dataType: 'Number.float', stringValue: '1.5' } }, + }, + }) + ) + + expect(response.status).toBe(200) + expect(mockExecuteSqsSend).toHaveBeenCalledOnce() + }) + + it('rejects the read-only All pseudo-name on a queue attribute write', async () => { + const response = await executeSqsTool( + createRequest({ + toolId: 'sqs_set_queue_attributes', + input: { + region: 'us-east-1', + accessKeyId: 'access-key', + secretAccessKey: 'secret-key', + queueUrl: QUEUE_URL, + attributes: { All: 'true' }, + }, + }) + ) + + expect(response.status).toBe(400) + expect(mockOperations.executeSqsSetQueueAttributes).not.toHaveBeenCalled() + }) + + it('accepts a real settable queue attribute', async () => { + mockOperations.executeSqsSetQueueAttributes.mockResolvedValue({ message: 'updated' }) + + const response = await executeSqsTool( + createRequest({ + toolId: 'sqs_set_queue_attributes', + input: { + region: 'us-east-1', + accessKeyId: 'access-key', + secretAccessKey: 'secret-key', + queueUrl: QUEUE_URL, + attributes: { VisibilityTimeout: '60' }, + }, + }) + ) + + expect(response.status).toBe(200) + expect(mockOperations.executeSqsSetQueueAttributes).toHaveBeenCalledOnce() + }) + it('preserves the provider error envelope', async () => { mockExecuteSqsSend.mockRejectedValue(new Error('AWS rejected credentials')) @@ -81,6 +216,15 @@ describe('executeSqsTool', () => { }) }) + it('rejects an unsupported SQS tool id', async () => { + const response = await executeSqsTool(createRequest({ toolId: 'sqs_not_a_tool' })) + + expect(response.status).toBe(500) + await expect(response.json()).resolves.toEqual({ + error: 'Unsupported SQS tool: sqs_not_a_tool', + }) + }) + it('propagates cancellation without starting provider work', async () => { const controller = new AbortController() controller.abort(new DOMException('cancelled', 'AbortError')) diff --git a/apps/sim/lib/internal/sqs/execute-tool.ts b/apps/sim/lib/internal/sqs/execute-tool.ts index ddddcb6d6d9..c4d8d4dba4e 100644 --- a/apps/sim/lib/internal/sqs/execute-tool.ts +++ b/apps/sim/lib/internal/sqs/execute-tool.ts @@ -1,30 +1,249 @@ import { getErrorMessage } from '@sim/utils/errors' -import { executeSqsSend } from '@/lib/internal/sqs/operations' -import { sqsSendInputSchema } from '@/lib/internal/sqs/schema' +import type { AnyApiRouteContract, ContractBody } from '@/lib/api/contracts' +import { awsSqsCancelMessageMoveTaskContract } from '@/lib/api/contracts/tools/aws/sqs-cancel-message-move-task' +import { awsSqsChangeMessageVisibilityContract } from '@/lib/api/contracts/tools/aws/sqs-change-message-visibility' +import { awsSqsChangeMessageVisibilityBatchContract } from '@/lib/api/contracts/tools/aws/sqs-change-message-visibility-batch' +import { awsSqsCreateQueueContract } from '@/lib/api/contracts/tools/aws/sqs-create-queue' +import { awsSqsDeleteMessageContract } from '@/lib/api/contracts/tools/aws/sqs-delete-message' +import { awsSqsDeleteMessageBatchContract } from '@/lib/api/contracts/tools/aws/sqs-delete-message-batch' +import { awsSqsDeleteQueueContract } from '@/lib/api/contracts/tools/aws/sqs-delete-queue' +import { awsSqsGetQueueAttributesContract } from '@/lib/api/contracts/tools/aws/sqs-get-queue-attributes' +import { awsSqsGetQueueUrlContract } from '@/lib/api/contracts/tools/aws/sqs-get-queue-url' +import { awsSqsListDeadLetterSourceQueuesContract } from '@/lib/api/contracts/tools/aws/sqs-list-dead-letter-source-queues' +import { awsSqsListMessageMoveTasksContract } from '@/lib/api/contracts/tools/aws/sqs-list-message-move-tasks' +import { awsSqsListQueueTagsContract } from '@/lib/api/contracts/tools/aws/sqs-list-queue-tags' +import { awsSqsListQueuesContract } from '@/lib/api/contracts/tools/aws/sqs-list-queues' +import { awsSqsPurgeQueueContract } from '@/lib/api/contracts/tools/aws/sqs-purge-queue' +import { awsSqsReceiveMessageContract } from '@/lib/api/contracts/tools/aws/sqs-receive-message' +import { awsSqsSendMessageContract } from '@/lib/api/contracts/tools/aws/sqs-send-message' +import { awsSqsSendMessageBatchContract } from '@/lib/api/contracts/tools/aws/sqs-send-message-batch' +import { awsSqsSetQueueAttributesContract } from '@/lib/api/contracts/tools/aws/sqs-set-queue-attributes' +import { awsSqsStartMessageMoveTaskContract } from '@/lib/api/contracts/tools/aws/sqs-start-message-move-task' +import { awsSqsTagQueueContract } from '@/lib/api/contracts/tools/aws/sqs-tag-queue' +import { awsSqsUntagQueueContract } from '@/lib/api/contracts/tools/aws/sqs-untag-queue' +import { + executeSqsCancelMessageMoveTask, + executeSqsChangeMessageVisibility, + executeSqsChangeMessageVisibilityBatch, + executeSqsCreateQueue, + executeSqsDeleteMessage, + executeSqsDeleteMessageBatch, + executeSqsDeleteQueue, + executeSqsGetQueueAttributes, + executeSqsGetQueueUrl, + executeSqsListDeadLetterSourceQueues, + executeSqsListMessageMoveTasks, + executeSqsListQueues, + executeSqsListQueueTags, + executeSqsPurgeQueue, + executeSqsReceiveMessage, + executeSqsSend, + executeSqsSendMessageBatch, + executeSqsSetQueueAttributes, + executeSqsStartMessageMoveTask, + executeSqsTagQueue, + executeSqsUntagQueue, +} from '@/lib/internal/sqs/operations' +import { parseInternalToolInput } from '@/lib/internal/tool-operations/parse-input' import type { InternalToolOperationHandler } from '@/lib/internal/tool-operations/types' -export const executeSqsTool: InternalToolOperationHandler = async ({ toolId, input, signal }) => { +async function executeOperation( + contract: C, + input: unknown, + execute: (input: ContractBody, signal?: AbortSignal) => Promise, + errorMessage: string, + signal?: AbortSignal +): Promise { signal?.throwIfAborted() - - if (toolId !== 'sqs_send') { - return Response.json({ error: `Unsupported SQS tool: ${toolId}` }, { status: 500 }) - } - - const parsed = sqsSendInputSchema.safeParse(input) - if (!parsed.success) { - return Response.json( - { error: 'Invalid request data', details: parsed.error.issues }, - { status: 400 } - ) - } + const parsed = parseInternalToolInput(contract, input) + if (!parsed.success) return parsed.response try { - return Response.json(await executeSqsSend(parsed.data, signal)) + const result = await execute(parsed.data, signal) + signal?.throwIfAborted() + return Response.json(result) } catch (error) { signal?.throwIfAborted() return Response.json( - { error: `SQS send message failed: ${getErrorMessage(error, 'Unknown error occurred')}` }, + { error: `${errorMessage}: ${getErrorMessage(error, 'Unknown error occurred')}` }, { status: 500 } ) } } + +export const executeSqsTool: InternalToolOperationHandler = async ({ toolId, input, signal }) => { + signal?.throwIfAborted() + + switch (toolId) { + case 'sqs_send': + return executeOperation( + awsSqsSendMessageContract, + input, + executeSqsSend, + 'SQS send message failed', + signal + ) + case 'sqs_send_message_batch': + return executeOperation( + awsSqsSendMessageBatchContract, + input, + executeSqsSendMessageBatch, + 'Failed to send SQS message batch', + signal + ) + case 'sqs_receive_message': + return executeOperation( + awsSqsReceiveMessageContract, + input, + executeSqsReceiveMessage, + 'Failed to receive SQS messages', + signal + ) + case 'sqs_delete_message': + return executeOperation( + awsSqsDeleteMessageContract, + input, + executeSqsDeleteMessage, + 'Failed to delete SQS message', + signal + ) + case 'sqs_delete_message_batch': + return executeOperation( + awsSqsDeleteMessageBatchContract, + input, + executeSqsDeleteMessageBatch, + 'Failed to delete SQS message batch', + signal + ) + case 'sqs_change_message_visibility': + return executeOperation( + awsSqsChangeMessageVisibilityContract, + input, + executeSqsChangeMessageVisibility, + 'Failed to change SQS message visibility', + signal + ) + case 'sqs_change_message_visibility_batch': + return executeOperation( + awsSqsChangeMessageVisibilityBatchContract, + input, + executeSqsChangeMessageVisibilityBatch, + 'Failed to change SQS message visibility batch', + signal + ) + case 'sqs_list_queues': + return executeOperation( + awsSqsListQueuesContract, + input, + executeSqsListQueues, + 'Failed to list SQS queues', + signal + ) + case 'sqs_get_queue_url': + return executeOperation( + awsSqsGetQueueUrlContract, + input, + executeSqsGetQueueUrl, + 'Failed to get SQS queue URL', + signal + ) + case 'sqs_get_queue_attributes': + return executeOperation( + awsSqsGetQueueAttributesContract, + input, + executeSqsGetQueueAttributes, + 'Failed to get SQS queue attributes', + signal + ) + case 'sqs_set_queue_attributes': + return executeOperation( + awsSqsSetQueueAttributesContract, + input, + executeSqsSetQueueAttributes, + 'Failed to set SQS queue attributes', + signal + ) + case 'sqs_create_queue': + return executeOperation( + awsSqsCreateQueueContract, + input, + executeSqsCreateQueue, + 'Failed to create SQS queue', + signal + ) + case 'sqs_delete_queue': + return executeOperation( + awsSqsDeleteQueueContract, + input, + executeSqsDeleteQueue, + 'Failed to delete SQS queue', + signal + ) + case 'sqs_purge_queue': + return executeOperation( + awsSqsPurgeQueueContract, + input, + executeSqsPurgeQueue, + 'Failed to purge SQS queue', + signal + ) + case 'sqs_list_dead_letter_source_queues': + return executeOperation( + awsSqsListDeadLetterSourceQueuesContract, + input, + executeSqsListDeadLetterSourceQueues, + 'Failed to list SQS dead-letter source queues', + signal + ) + case 'sqs_list_queue_tags': + return executeOperation( + awsSqsListQueueTagsContract, + input, + executeSqsListQueueTags, + 'Failed to list SQS queue tags', + signal + ) + case 'sqs_tag_queue': + return executeOperation( + awsSqsTagQueueContract, + input, + executeSqsTagQueue, + 'Failed to tag SQS queue', + signal + ) + case 'sqs_untag_queue': + return executeOperation( + awsSqsUntagQueueContract, + input, + executeSqsUntagQueue, + 'Failed to untag SQS queue', + signal + ) + case 'sqs_start_message_move_task': + return executeOperation( + awsSqsStartMessageMoveTaskContract, + input, + executeSqsStartMessageMoveTask, + 'Failed to start SQS message move task', + signal + ) + case 'sqs_list_message_move_tasks': + return executeOperation( + awsSqsListMessageMoveTasksContract, + input, + executeSqsListMessageMoveTasks, + 'Failed to list SQS message move tasks', + signal + ) + case 'sqs_cancel_message_move_task': + return executeOperation( + awsSqsCancelMessageMoveTaskContract, + input, + executeSqsCancelMessageMoveTask, + 'Failed to cancel SQS message move task', + signal + ) + default: + return Response.json({ error: `Unsupported SQS tool: ${toolId}` }, { status: 500 }) + } +} diff --git a/apps/sim/lib/internal/sqs/operations.test.ts b/apps/sim/lib/internal/sqs/operations.test.ts index f1447e6bd4c..a5ec1947173 100644 --- a/apps/sim/lib/internal/sqs/operations.test.ts +++ b/apps/sim/lib/internal/sqs/operations.test.ts @@ -3,58 +3,153 @@ */ import { beforeEach, describe, expect, it, vi } from 'vitest' -const { mockCreateSqsClient, mockDestroy, mockSendMessage } = vi.hoisted(() => ({ +const { mockCreateSqsClient, mockDestroy, mockSend } = vi.hoisted(() => ({ mockCreateSqsClient: vi.fn(), mockDestroy: vi.fn(), - mockSendMessage: vi.fn(), + mockSend: vi.fn(), })) vi.mock('@/lib/internal/sqs/client', () => ({ createSqsClient: mockCreateSqsClient, - sendMessage: mockSendMessage, })) -import { executeSqsSend } from '@/lib/internal/sqs/operations' +import { + executeSqsDeleteMessageBatch, + executeSqsListDeadLetterSourceQueues, + executeSqsReceiveMessage, + executeSqsSend, +} from '@/lib/internal/sqs/operations' -const INPUT = { +const CONNECTION = { region: 'us-east-1', accessKeyId: 'access-key', secretAccessKey: 'secret-key', - queueUrl: 'https://sqs.us-east-1.amazonaws.com/123456789012/test-queue', - data: { action: 'process' }, - messageGroupId: 'group-1', - messageDeduplicationId: 'message-1', } +const QUEUE_URL = 'https://sqs.us-east-1.amazonaws.com/123456789012/test-queue' + describe('SQS operations', () => { beforeEach(() => { vi.clearAllMocks() - mockCreateSqsClient.mockReturnValue({ destroy: mockDestroy }) + mockCreateSqsClient.mockReturnValue({ send: mockSend, destroy: mockDestroy }) }) - it('forwards cancellation and destroys the AWS client after success', async () => { + it('sends a message, forwards cancellation, and destroys the AWS client', async () => { const controller = new AbortController() - mockSendMessage.mockResolvedValue({ id: 'message-id' }) + mockSend.mockResolvedValue({ MessageId: 'message-id', MD5OfMessageBody: 'digest' }) - await expect(executeSqsSend(INPUT, controller.signal)).resolves.toEqual({ - message: `Message sent to SQS queue ${INPUT.queueUrl}`, + await expect( + executeSqsSend( + { ...CONNECTION, queueUrl: QUEUE_URL, data: { action: 'process' } }, + controller.signal + ) + ).resolves.toEqual({ + message: `Message sent to SQS queue ${QUEUE_URL}`, id: 'message-id', + md5OfMessageBody: 'digest', + md5OfMessageAttributes: null, + sequenceNumber: null, + }) + + const [command, options] = mockSend.mock.calls[0] + expect(command.input).toMatchObject({ + QueueUrl: QUEUE_URL, + MessageBody: JSON.stringify({ action: 'process' }), }) - expect(mockSendMessage).toHaveBeenCalledWith( - { destroy: mockDestroy }, - INPUT.queueUrl, - INPUT.data, - INPUT.messageGroupId, - INPUT.messageDeduplicationId, - controller.signal - ) + expect(options).toEqual({ abortSignal: controller.signal }) expect(mockDestroy).toHaveBeenCalledOnce() }) + it('maps message attributes onto the SQS wire shape', async () => { + mockSend.mockResolvedValue({ MessageId: 'message-id' }) + + await executeSqsSend({ + ...CONNECTION, + queueUrl: QUEUE_URL, + data: { action: 'process' }, + delaySeconds: 30, + messageAttributes: { priority: { dataType: 'Number', stringValue: '1' } }, + }) + + expect(mockSend.mock.calls[0][0].input).toMatchObject({ + DelaySeconds: 30, + MessageAttributes: { priority: { DataType: 'Number', StringValue: '1' } }, + }) + }) + + it('projects received messages and their attributes', async () => { + mockSend.mockResolvedValue({ + Messages: [ + { + MessageId: 'message-id', + ReceiptHandle: 'receipt-handle', + Body: '{"action":"process"}', + MD5OfBody: 'digest', + Attributes: { SenderId: 'sender', Unset: undefined }, + MessageAttributes: { + priority: { DataType: 'Number', StringValue: '1' }, + }, + }, + ], + }) + + await expect( + executeSqsReceiveMessage({ ...CONNECTION, queueUrl: QUEUE_URL, waitTimeSeconds: 20 }) + ).resolves.toEqual({ + count: 1, + messages: [ + { + messageId: 'message-id', + receiptHandle: 'receipt-handle', + body: '{"action":"process"}', + md5OfBody: 'digest', + md5OfMessageAttributes: null, + attributes: { SenderId: 'sender' }, + messageAttributes: { + priority: { dataType: 'Number', stringValue: '1', stringListValues: [] }, + }, + }, + ], + }) + }) + + it('reports partial batch failures rather than throwing', async () => { + mockSend.mockResolvedValue({ + Successful: [{ Id: 'msg-1' }], + Failed: [{ Id: 'msg-2', SenderFault: true, Code: 'ReceiptHandleIsInvalid' }], + }) + + await expect( + executeSqsDeleteMessageBatch({ + ...CONNECTION, + queueUrl: QUEUE_URL, + entries: [ + { id: 'msg-1', receiptHandle: 'handle-1' }, + { id: 'msg-2', receiptHandle: 'handle-2' }, + ], + }) + ).resolves.toMatchObject({ + successful: [{ id: 'msg-1' }], + failed: [{ id: 'msg-2', senderFault: true, code: 'ReceiptHandleIsInvalid', message: null }], + successCount: 1, + failureCount: 1, + }) + }) + + it('reads the lowercase queueUrls field ListDeadLetterSourceQueues returns', async () => { + mockSend.mockResolvedValue({ queueUrls: [QUEUE_URL], NextToken: 'next' }) + + await expect( + executeSqsListDeadLetterSourceQueues({ ...CONNECTION, queueUrl: QUEUE_URL }) + ).resolves.toEqual({ queueUrls: [QUEUE_URL], nextToken: 'next', count: 1 }) + }) + it('destroys the AWS client when provider execution fails', async () => { - mockSendMessage.mockRejectedValue(new Error('provider failure')) + mockSend.mockRejectedValue(new Error('provider failure')) - await expect(executeSqsSend(INPUT)).rejects.toThrow('provider failure') + await expect( + executeSqsSend({ ...CONNECTION, queueUrl: QUEUE_URL, data: { action: 'process' } }) + ).rejects.toThrow('provider failure') expect(mockDestroy).toHaveBeenCalledOnce() }) }) diff --git a/apps/sim/lib/internal/sqs/operations.ts b/apps/sim/lib/internal/sqs/operations.ts index 2ad44d2e41f..f445711eb8a 100644 --- a/apps/sim/lib/internal/sqs/operations.ts +++ b/apps/sim/lib/internal/sqs/operations.ts @@ -1,24 +1,495 @@ -import { createSqsClient, sendMessage } from '@/lib/internal/sqs/client' -import type { SqsSendInput } from '@/lib/internal/sqs/schema' +import { + CancelMessageMoveTaskCommand, + ChangeMessageVisibilityBatchCommand, + ChangeMessageVisibilityCommand, + CreateQueueCommand, + DeleteMessageBatchCommand, + DeleteMessageCommand, + DeleteQueueCommand, + GetQueueAttributesCommand, + GetQueueUrlCommand, + ListDeadLetterSourceQueuesCommand, + ListMessageMoveTasksCommand, + ListQueuesCommand, + ListQueueTagsCommand, + type MessageAttributeValue, + PurgeQueueCommand, + ReceiveMessageCommand, + SendMessageBatchCommand, + SendMessageCommand, + SetQueueAttributesCommand, + type SQSClient, + StartMessageMoveTaskCommand, + TagQueueCommand, + UntagQueueCommand, +} from '@aws-sdk/client-sqs' +import type { AwsSqsCancelMessageMoveTaskBody } from '@/lib/api/contracts/tools/aws/sqs-cancel-message-move-task' +import type { AwsSqsChangeMessageVisibilityBody } from '@/lib/api/contracts/tools/aws/sqs-change-message-visibility' +import type { AwsSqsChangeMessageVisibilityBatchBody } from '@/lib/api/contracts/tools/aws/sqs-change-message-visibility-batch' +import type { AwsSqsCreateQueueBody } from '@/lib/api/contracts/tools/aws/sqs-create-queue' +import type { AwsSqsDeleteMessageBody } from '@/lib/api/contracts/tools/aws/sqs-delete-message' +import type { AwsSqsDeleteMessageBatchBody } from '@/lib/api/contracts/tools/aws/sqs-delete-message-batch' +import type { AwsSqsDeleteQueueBody } from '@/lib/api/contracts/tools/aws/sqs-delete-queue' +import type { AwsSqsGetQueueAttributesBody } from '@/lib/api/contracts/tools/aws/sqs-get-queue-attributes' +import type { AwsSqsGetQueueUrlBody } from '@/lib/api/contracts/tools/aws/sqs-get-queue-url' +import type { AwsSqsListDeadLetterSourceQueuesBody } from '@/lib/api/contracts/tools/aws/sqs-list-dead-letter-source-queues' +import type { AwsSqsListMessageMoveTasksBody } from '@/lib/api/contracts/tools/aws/sqs-list-message-move-tasks' +import type { AwsSqsListQueueTagsBody } from '@/lib/api/contracts/tools/aws/sqs-list-queue-tags' +import type { AwsSqsListQueuesBody } from '@/lib/api/contracts/tools/aws/sqs-list-queues' +import type { AwsSqsPurgeQueueBody } from '@/lib/api/contracts/tools/aws/sqs-purge-queue' +import type { AwsSqsReceiveMessageBody } from '@/lib/api/contracts/tools/aws/sqs-receive-message' +import type { AwsSqsSendMessageBody } from '@/lib/api/contracts/tools/aws/sqs-send-message' +import type { AwsSqsSendMessageBatchBody } from '@/lib/api/contracts/tools/aws/sqs-send-message-batch' +import type { AwsSqsSetQueueAttributesBody } from '@/lib/api/contracts/tools/aws/sqs-set-queue-attributes' +import type { AwsSqsStartMessageMoveTaskBody } from '@/lib/api/contracts/tools/aws/sqs-start-message-move-task' +import type { AwsSqsTagQueueBody } from '@/lib/api/contracts/tools/aws/sqs-tag-queue' +import type { AwsSqsUntagQueueBody } from '@/lib/api/contracts/tools/aws/sqs-untag-queue' +import { createSqsClient } from '@/lib/internal/sqs/client' +import type { SqsConnectionConfig } from '@/tools/sqs/types' -export async function executeSqsSend(input: SqsSendInput, signal?: AbortSignal) { - signal?.throwIfAborted() - const client = createSqsClient(input) +async function withSqsClient( + config: SqsConnectionConfig, + execute: (client: SQSClient) => Promise +): Promise { + const client = createSqsClient(config) try { - const result = await sendMessage( - client, - input.queueUrl, - input.data, - input.messageGroupId, - input.messageDeduplicationId, - signal + return await execute(client) + } finally { + client.destroy() + } +} + +/** Map Sim's JSON-safe message attribute input onto the SQS `MessageAttributeValue` shape. */ +function toMessageAttributes( + attributes: Record | null | undefined +): Record | undefined { + if (!attributes) return undefined + const entries = Object.entries(attributes) + if (entries.length === 0) return undefined + const mapped: Record = {} + for (const [name, value] of entries) { + mapped[name] = { DataType: value.dataType, StringValue: value.stringValue } + } + return mapped +} + +/** Project received `MessageAttributeValue` entries into their JSON-safe string forms. */ +function fromMessageAttributes(attributes: Record | undefined) { + const projected: Record< + string, + { dataType: string | null; stringValue: string | null; stringListValues: string[] } + > = {} + for (const [name, value] of Object.entries(attributes ?? {})) { + projected[name] = { + dataType: value.DataType ?? null, + stringValue: value.StringValue ?? null, + stringListValues: value.StringListValues ?? [], + } + } + return projected +} + +/** Drop the undefined values an SQS attribute map may carry so the result is JSON-stable. */ +function toStringMap(map: Record | undefined): Record { + const projected: Record = {} + for (const [key, value] of Object.entries(map ?? {})) { + if (value !== undefined) projected[key] = value + } + return projected +} + +/** Project the `BatchResultErrorEntry` list shared by all three SQS batch actions. */ +function projectBatchFailures( + failed: { Id?: string; SenderFault?: boolean; Code?: string; Message?: string }[] | undefined +) { + return (failed ?? []).map((entry) => ({ + id: entry.Id ?? null, + senderFault: entry.SenderFault ?? null, + code: entry.Code ?? null, + message: entry.Message ?? null, + })) +} + +export async function executeSqsSend(input: AwsSqsSendMessageBody, signal?: AbortSignal) { + return withSqsClient(input, async (client) => { + const response = await client.send( + new SendMessageCommand({ + QueueUrl: input.queueUrl, + MessageBody: JSON.stringify(input.data), + DelaySeconds: input.delaySeconds ?? undefined, + MessageAttributes: toMessageAttributes(input.messageAttributes), + MessageGroupId: input.messageGroupId ?? undefined, + MessageDeduplicationId: input.messageDeduplicationId ?? undefined, + }), + { abortSignal: signal } ) - signal?.throwIfAborted() return { message: `Message sent to SQS queue ${input.queueUrl}`, - id: result?.id, + id: response.MessageId ?? null, + md5OfMessageBody: response.MD5OfMessageBody ?? null, + md5OfMessageAttributes: response.MD5OfMessageAttributes ?? null, + sequenceNumber: response.SequenceNumber ?? null, } - } finally { - client.destroy() - } + }) +} + +export async function executeSqsSendMessageBatch( + input: AwsSqsSendMessageBatchBody, + signal?: AbortSignal +) { + return withSqsClient(input, async (client) => { + const response = await client.send( + new SendMessageBatchCommand({ + QueueUrl: input.queueUrl, + Entries: input.entries.map((entry) => ({ + Id: entry.id, + MessageBody: JSON.stringify(entry.data), + DelaySeconds: entry.delaySeconds ?? undefined, + MessageAttributes: toMessageAttributes(entry.messageAttributes), + MessageGroupId: entry.messageGroupId ?? undefined, + MessageDeduplicationId: entry.messageDeduplicationId ?? undefined, + })), + }), + { abortSignal: signal } + ) + const successful = (response.Successful ?? []).map((entry) => ({ + id: entry.Id ?? null, + messageId: entry.MessageId ?? null, + md5OfMessageBody: entry.MD5OfMessageBody ?? null, + md5OfMessageAttributes: entry.MD5OfMessageAttributes ?? null, + sequenceNumber: entry.SequenceNumber ?? null, + })) + const failed = projectBatchFailures(response.Failed) + return { + message: `Sent ${successful.length} of ${input.entries.length} messages to SQS queue ${input.queueUrl}`, + successful, + failed, + successCount: successful.length, + failureCount: failed.length, + } + }) +} + +export async function executeSqsReceiveMessage( + input: AwsSqsReceiveMessageBody, + signal?: AbortSignal +) { + return withSqsClient(input, async (client) => { + const response = await client.send( + new ReceiveMessageCommand({ + QueueUrl: input.queueUrl, + MaxNumberOfMessages: input.maxNumberOfMessages ?? undefined, + VisibilityTimeout: input.visibilityTimeout ?? undefined, + WaitTimeSeconds: input.waitTimeSeconds ?? undefined, + MessageAttributeNames: input.messageAttributeNames ?? undefined, + MessageSystemAttributeNames: input.messageSystemAttributeNames ?? undefined, + ReceiveRequestAttemptId: input.receiveRequestAttemptId ?? undefined, + }), + { abortSignal: signal } + ) + const messages = (response.Messages ?? []).map((message) => ({ + messageId: message.MessageId ?? null, + receiptHandle: message.ReceiptHandle ?? null, + body: message.Body ?? null, + md5OfBody: message.MD5OfBody ?? null, + md5OfMessageAttributes: message.MD5OfMessageAttributes ?? null, + attributes: toStringMap(message.Attributes), + messageAttributes: fromMessageAttributes(message.MessageAttributes), + })) + return { messages, count: messages.length } + }) +} + +export async function executeSqsDeleteMessage( + input: AwsSqsDeleteMessageBody, + signal?: AbortSignal +) { + return withSqsClient(input, async (client) => { + await client.send( + new DeleteMessageCommand({ + QueueUrl: input.queueUrl, + ReceiptHandle: input.receiptHandle, + }), + { abortSignal: signal } + ) + return { message: `Message deleted from SQS queue ${input.queueUrl}` } + }) +} + +export async function executeSqsDeleteMessageBatch( + input: AwsSqsDeleteMessageBatchBody, + signal?: AbortSignal +) { + return withSqsClient(input, async (client) => { + const response = await client.send( + new DeleteMessageBatchCommand({ + QueueUrl: input.queueUrl, + Entries: input.entries.map((entry) => ({ + Id: entry.id, + ReceiptHandle: entry.receiptHandle, + })), + }), + { abortSignal: signal } + ) + const successful = (response.Successful ?? []).map((entry) => ({ id: entry.Id ?? null })) + const failed = projectBatchFailures(response.Failed) + return { + message: `Deleted ${successful.length} of ${input.entries.length} messages from SQS queue ${input.queueUrl}`, + successful, + failed, + successCount: successful.length, + failureCount: failed.length, + } + }) +} + +export async function executeSqsChangeMessageVisibility( + input: AwsSqsChangeMessageVisibilityBody, + signal?: AbortSignal +) { + return withSqsClient(input, async (client) => { + await client.send( + new ChangeMessageVisibilityCommand({ + QueueUrl: input.queueUrl, + ReceiptHandle: input.receiptHandle, + VisibilityTimeout: input.visibilityTimeout, + }), + { abortSignal: signal } + ) + return { + message: `Visibility timeout set to ${input.visibilityTimeout} seconds on SQS queue ${input.queueUrl}`, + } + }) +} + +export async function executeSqsChangeMessageVisibilityBatch( + input: AwsSqsChangeMessageVisibilityBatchBody, + signal?: AbortSignal +) { + return withSqsClient(input, async (client) => { + const response = await client.send( + new ChangeMessageVisibilityBatchCommand({ + QueueUrl: input.queueUrl, + Entries: input.entries.map((entry) => ({ + Id: entry.id, + ReceiptHandle: entry.receiptHandle, + VisibilityTimeout: entry.visibilityTimeout ?? undefined, + })), + }), + { abortSignal: signal } + ) + const successful = (response.Successful ?? []).map((entry) => ({ id: entry.Id ?? null })) + const failed = projectBatchFailures(response.Failed) + return { + message: `Changed visibility for ${successful.length} of ${input.entries.length} messages on SQS queue ${input.queueUrl}`, + successful, + failed, + successCount: successful.length, + failureCount: failed.length, + } + }) +} + +export async function executeSqsListQueues(input: AwsSqsListQueuesBody, signal?: AbortSignal) { + return withSqsClient(input, async (client) => { + const response = await client.send( + new ListQueuesCommand({ + QueueNamePrefix: input.queueNamePrefix ?? undefined, + MaxResults: input.maxResults ?? undefined, + NextToken: input.nextToken ?? undefined, + }), + { abortSignal: signal } + ) + const queueUrls = response.QueueUrls ?? [] + return { queueUrls, nextToken: response.NextToken ?? null, count: queueUrls.length } + }) +} + +export async function executeSqsGetQueueUrl(input: AwsSqsGetQueueUrlBody, signal?: AbortSignal) { + return withSqsClient(input, async (client) => { + const response = await client.send( + new GetQueueUrlCommand({ + QueueName: input.queueName, + QueueOwnerAWSAccountId: input.queueOwnerAwsAccountId ?? undefined, + }), + { abortSignal: signal } + ) + return { queueUrl: response.QueueUrl ?? null } + }) +} + +export async function executeSqsGetQueueAttributes( + input: AwsSqsGetQueueAttributesBody, + signal?: AbortSignal +) { + return withSqsClient(input, async (client) => { + const response = await client.send( + new GetQueueAttributesCommand({ + QueueUrl: input.queueUrl, + AttributeNames: input.attributeNames ?? undefined, + }), + { abortSignal: signal } + ) + return { attributes: toStringMap(response.Attributes) } + }) +} + +export async function executeSqsSetQueueAttributes( + input: AwsSqsSetQueueAttributesBody, + signal?: AbortSignal +) { + return withSqsClient(input, async (client) => { + await client.send( + new SetQueueAttributesCommand({ + QueueUrl: input.queueUrl, + Attributes: input.attributes, + }), + { abortSignal: signal } + ) + return { message: `Attributes updated on SQS queue ${input.queueUrl}` } + }) +} + +export async function executeSqsCreateQueue(input: AwsSqsCreateQueueBody, signal?: AbortSignal) { + return withSqsClient(input, async (client) => { + const response = await client.send( + new CreateQueueCommand({ + QueueName: input.queueName, + Attributes: input.attributes ?? undefined, + tags: input.tags ?? undefined, + }), + { abortSignal: signal } + ) + return { + message: `SQS queue "${input.queueName}" created`, + queueUrl: response.QueueUrl ?? null, + } + }) +} + +export async function executeSqsDeleteQueue(input: AwsSqsDeleteQueueBody, signal?: AbortSignal) { + return withSqsClient(input, async (client) => { + await client.send(new DeleteQueueCommand({ QueueUrl: input.queueUrl }), { + abortSignal: signal, + }) + return { message: `SQS queue ${input.queueUrl} deleted` } + }) +} + +export async function executeSqsPurgeQueue(input: AwsSqsPurgeQueueBody, signal?: AbortSignal) { + return withSqsClient(input, async (client) => { + await client.send(new PurgeQueueCommand({ QueueUrl: input.queueUrl }), { abortSignal: signal }) + return { message: `SQS queue ${input.queueUrl} purged` } + }) +} + +export async function executeSqsListDeadLetterSourceQueues( + input: AwsSqsListDeadLetterSourceQueuesBody, + signal?: AbortSignal +) { + return withSqsClient(input, async (client) => { + const response = await client.send( + new ListDeadLetterSourceQueuesCommand({ + QueueUrl: input.queueUrl, + MaxResults: input.maxResults ?? undefined, + NextToken: input.nextToken ?? undefined, + }), + { abortSignal: signal } + ) + const queueUrls = response.queueUrls ?? [] + return { queueUrls, nextToken: response.NextToken ?? null, count: queueUrls.length } + }) +} + +export async function executeSqsListQueueTags( + input: AwsSqsListQueueTagsBody, + signal?: AbortSignal +) { + return withSqsClient(input, async (client) => { + const response = await client.send(new ListQueueTagsCommand({ QueueUrl: input.queueUrl }), { + abortSignal: signal, + }) + return { tags: toStringMap(response.Tags) } + }) +} + +export async function executeSqsTagQueue(input: AwsSqsTagQueueBody, signal?: AbortSignal) { + return withSqsClient(input, async (client) => { + await client.send(new TagQueueCommand({ QueueUrl: input.queueUrl, Tags: input.tags }), { + abortSignal: signal, + }) + return { message: `Tags applied to SQS queue ${input.queueUrl}` } + }) +} + +export async function executeSqsUntagQueue(input: AwsSqsUntagQueueBody, signal?: AbortSignal) { + return withSqsClient(input, async (client) => { + await client.send(new UntagQueueCommand({ QueueUrl: input.queueUrl, TagKeys: input.tagKeys }), { + abortSignal: signal, + }) + return { message: `Tags removed from SQS queue ${input.queueUrl}` } + }) +} + +export async function executeSqsStartMessageMoveTask( + input: AwsSqsStartMessageMoveTaskBody, + signal?: AbortSignal +) { + return withSqsClient(input, async (client) => { + const response = await client.send( + new StartMessageMoveTaskCommand({ + SourceArn: input.sourceArn, + DestinationArn: input.destinationArn ?? undefined, + MaxNumberOfMessagesPerSecond: input.maxNumberOfMessagesPerSecond ?? undefined, + }), + { abortSignal: signal } + ) + return { + message: `Message move task started for ${input.sourceArn}`, + taskHandle: response.TaskHandle ?? null, + } + }) +} + +export async function executeSqsListMessageMoveTasks( + input: AwsSqsListMessageMoveTasksBody, + signal?: AbortSignal +) { + return withSqsClient(input, async (client) => { + const response = await client.send( + new ListMessageMoveTasksCommand({ + SourceArn: input.sourceArn, + MaxResults: input.maxResults ?? undefined, + }), + { abortSignal: signal } + ) + const results = (response.Results ?? []).map((task) => ({ + taskHandle: task.TaskHandle ?? null, + status: task.Status ?? null, + sourceArn: task.SourceArn ?? null, + destinationArn: task.DestinationArn ?? null, + maxNumberOfMessagesPerSecond: task.MaxNumberOfMessagesPerSecond ?? null, + approximateNumberOfMessagesMoved: task.ApproximateNumberOfMessagesMoved ?? null, + approximateNumberOfMessagesToMove: task.ApproximateNumberOfMessagesToMove ?? null, + failureReason: task.FailureReason ?? null, + startedTimestamp: task.StartedTimestamp ?? null, + })) + return { results, count: results.length } + }) +} + +export async function executeSqsCancelMessageMoveTask( + input: AwsSqsCancelMessageMoveTaskBody, + signal?: AbortSignal +) { + return withSqsClient(input, async (client) => { + const response = await client.send( + new CancelMessageMoveTaskCommand({ TaskHandle: input.taskHandle }), + { abortSignal: signal } + ) + return { + message: 'Message move task cancelled', + approximateNumberOfMessagesMoved: response.ApproximateNumberOfMessagesMoved ?? null, + } + }) } diff --git a/apps/sim/lib/internal/sqs/schema.ts b/apps/sim/lib/internal/sqs/schema.ts deleted file mode 100644 index 6d56c0a69e6..00000000000 --- a/apps/sim/lib/internal/sqs/schema.ts +++ /dev/null @@ -1,15 +0,0 @@ -import { z } from 'zod' - -export const sqsSendInputSchema = z.object({ - region: z.string().min(1, 'AWS region is required'), - accessKeyId: z.string().min(1, 'AWS access key ID is required'), - secretAccessKey: z.string().min(1, 'AWS secret access key is required'), - queueUrl: z.string().min(1, 'Queue URL is required'), - messageGroupId: z.string().nullish(), - messageDeduplicationId: z.string().nullish(), - data: z.record(z.string(), z.unknown()).refine((obj) => Object.keys(obj).length > 0, { - message: 'Data object must have at least one field', - }), -}) - -export type SqsSendInput = z.output diff --git a/apps/sim/lib/internal/ssm/client.test.ts b/apps/sim/lib/internal/ssm/client.test.ts new file mode 100644 index 00000000000..f253228b236 --- /dev/null +++ b/apps/sim/lib/internal/ssm/client.test.ts @@ -0,0 +1,266 @@ +/** + * @vitest-environment node + */ +import { beforeEach, describe, expect, it, vi } from 'vitest' + +const { mockSend } = vi.hoisted(() => ({ mockSend: vi.fn() })) + +/** + * Stands in for every `@aws-sdk/client-ssm` command class. Each stub keeps the + * request object on `input`, exactly like the real command, so the assertions + * below read the parameter names the client actually sends to AWS. + */ +vi.mock('@aws-sdk/client-ssm', () => { + class CommandStub { + input: unknown + constructor(input: unknown) { + this.input = input + } + } + + const commandNames = [ + 'CancelCommandCommand', + 'DeleteParameterCommand', + 'DescribeAutomationExecutionsCommand', + 'DescribeInstanceInformationCommand', + 'DescribeInstancePatchStatesCommand', + 'DescribeInstancePatchesCommand', + 'DescribeParametersCommand', + 'GetAutomationExecutionCommand', + 'GetCommandInvocationCommand', + 'GetDocumentCommand', + 'GetParameterCommand', + 'GetParametersByPathCommand', + 'GetParametersCommand', + 'ListCommandInvocationsCommand', + 'ListCommandsCommand', + 'ListComplianceItemsCommand', + 'ListComplianceSummariesCommand', + 'ListDocumentsCommand', + 'PutParameterCommand', + 'SendCommandCommand', + 'StartAutomationExecutionCommand', + 'StopAutomationExecutionCommand', + ] as const + + const commands = Object.fromEntries(commandNames.map((name) => [name, CommandStub])) + + return { + ...commands, + SSMClient: class { + send = mockSend + destroy = vi.fn() + }, + } +}) + +import { + createSsmClient, + describeInstancePatchStates, + getCommandInvocation, + getParameter, + listCommands, + putParameter, + sendCommand, +} from '@/lib/internal/ssm/client' + +const CONNECTION = { + region: 'us-east-1', + accessKeyId: 'access-key', + secretAccessKey: 'secret-key', +} + +function lastCommandInput(): Record { + return mockSend.mock.calls.at(-1)?.[0].input +} + +describe('ssm client', () => { + beforeEach(() => { + vi.clearAllMocks() + }) + + it('maps send_command input onto the documented AWS parameter names', async () => { + mockSend.mockResolvedValue({ Command: {} }) + + await sendCommand(createSsmClient(CONNECTION), { + ...CONNECTION, + documentName: 'AWS-RunShellScript', + instanceIds: ['i-0123456789abcdef0'], + parameters: { commands: ['df -h'] }, + comment: 'disk check', + executionTimeoutSeconds: 600, + maxConcurrency: '50%', + maxErrors: '0', + outputS3BucketName: 'bucket', + outputS3KeyPrefix: 'prefix/', + serviceRoleArn: 'arn:aws:iam::123456789012:role/notify', + }) + + expect(lastCommandInput()).toEqual({ + DocumentName: 'AWS-RunShellScript', + InstanceIds: ['i-0123456789abcdef0'], + Parameters: { commands: ['df -h'] }, + Comment: 'disk check', + TimeoutSeconds: 600, + MaxConcurrency: '50%', + MaxErrors: '0', + OutputS3BucketName: 'bucket', + OutputS3KeyPrefix: 'prefix/', + ServiceRoleArn: 'arn:aws:iam::123456789012:role/notify', + }) + }) + + it('omits every optional send_command field the caller did not set', async () => { + mockSend.mockResolvedValue({ Command: {} }) + + await sendCommand(createSsmClient(CONNECTION), { + ...CONNECTION, + documentName: 'AWS-RunShellScript', + targets: [{ Key: 'tag:Environment', Values: ['prod'] }], + }) + + expect(lastCommandInput()).toEqual({ + DocumentName: 'AWS-RunShellScript', + Targets: [{ Key: 'tag:Environment', Values: ['prod'] }], + }) + }) + + it('projects the Command response and defaults absent collections', async () => { + mockSend.mockResolvedValue({ + Command: { + CommandId: 'command-1', + DocumentName: 'AWS-RunShellScript', + Status: 'Pending', + RequestedDateTime: new Date('2026-01-02T03:04:05.000Z'), + TimeoutSeconds: 600, + }, + }) + + const result = await sendCommand(createSsmClient(CONNECTION), { + ...CONNECTION, + documentName: 'AWS-RunShellScript', + instanceIds: ['i-0123456789abcdef0'], + }) + + expect(result).toMatchObject({ + commandId: 'command-1', + status: 'Pending', + requestedDateTime: '2026-01-02T03:04:05.000Z', + executionTimeoutSeconds: 600, + instanceIds: [], + targets: [], + comment: null, + targetCount: null, + }) + }) + + it('passes GetCommandInvocation timestamps through as the strings AWS returns', async () => { + mockSend.mockResolvedValue({ + CommandId: 'command-1', + InstanceId: 'i-0123456789abcdef0', + Status: 'Success', + ExecutionStartDateTime: '2026-01-02T03:04:05.000Z', + ExecutionEndDateTime: '2026-01-02T03:04:09.000Z', + ExecutionElapsedTime: 'PT4S', + StandardOutputContent: 'ok', + }) + + const result = await getCommandInvocation(createSsmClient(CONNECTION), { + ...CONNECTION, + commandId: '11111111-2222-3333-4444-555555555555', + instanceId: 'i-0123456789abcdef0', + }) + + expect(result.executionStartDateTime).toBe('2026-01-02T03:04:05.000Z') + expect(result.executionElapsedTime).toBe('PT4S') + expect(result.standardOutputContent).toBe('ok') + expect(result.standardErrorContent).toBe('') + }) + + it('sends lowercase key/value CommandFilter members', async () => { + mockSend.mockResolvedValue({ Commands: [] }) + + await listCommands(createSsmClient(CONNECTION), { + ...CONNECTION, + filters: [{ key: 'Status', value: 'Failed' }], + }) + + expect(lastCommandInput()).toEqual({ Filters: [{ key: 'Status', value: 'Failed' }] }) + }) + + it('only sends WithDecryption when the caller opted in', async () => { + mockSend.mockResolvedValue({ Parameter: { Name: '/prod/app/db', Value: 'v' } }) + + await getParameter(createSsmClient(CONNECTION), { ...CONNECTION, name: '/prod/app/db' }) + expect(lastCommandInput()).toEqual({ Name: '/prod/app/db' }) + + await getParameter(createSsmClient(CONNECTION), { + ...CONNECTION, + name: '/prod/app/db', + withDecryption: true, + }) + expect(lastCommandInput()).toEqual({ Name: '/prod/app/db', WithDecryption: true }) + }) + + it('never echoes the written value in the put_parameter result', async () => { + mockSend.mockResolvedValue({ Version: 4, Tier: 'Standard' }) + + const result = await putParameter(createSsmClient(CONNECTION), { + ...CONNECTION, + name: '/prod/app/db-password', + value: 'super-secret-value', + type: 'SecureString', + }) + + expect(JSON.stringify(result)).not.toContain('super-secret-value') + expect(result).toEqual({ + message: 'Parameter "/prod/app/db-password" written successfully', + name: '/prod/app/db-password', + version: 4, + tier: 'Standard', + }) + }) + + it('projects InstancePatchState counts and timestamps', async () => { + mockSend.mockResolvedValue({ + InstancePatchStates: [ + { + InstanceId: 'i-0123456789abcdef0', + PatchGroup: 'prod', + BaselineId: 'pb-1', + Operation: 'Scan', + OperationStartTime: new Date('2026-01-02T03:04:05.000Z'), + OperationEndTime: new Date('2026-01-02T03:14:05.000Z'), + MissingCount: 3, + }, + ], + }) + + const result = await describeInstancePatchStates(createSsmClient(CONNECTION), { + ...CONNECTION, + instanceIds: ['i-0123456789abcdef0'], + }) + + expect(result.count).toBe(1) + expect(result.nextToken).toBeNull() + expect(result.instancePatchStates[0]).toMatchObject({ + instanceId: 'i-0123456789abcdef0', + patchGroup: 'prod', + baselineId: 'pb-1', + operation: 'Scan', + operationStartTime: '2026-01-02T03:04:05.000Z', + operationEndTime: '2026-01-02T03:14:05.000Z', + missingCount: 3, + installedCount: null, + }) + }) + + it('forwards the abort signal to every SDK call', async () => { + const controller = new AbortController() + mockSend.mockResolvedValue({ Commands: [] }) + + await listCommands(createSsmClient(CONNECTION), CONNECTION, controller.signal) + + expect(mockSend.mock.calls.at(-1)?.[1]).toEqual({ abortSignal: controller.signal }) + }) +}) diff --git a/apps/sim/lib/internal/ssm/client.ts b/apps/sim/lib/internal/ssm/client.ts new file mode 100644 index 00000000000..584708bad35 --- /dev/null +++ b/apps/sim/lib/internal/ssm/client.ts @@ -0,0 +1,846 @@ +import type { + AutomationExecutionMetadata, + Command, + CommandInvocation, + CommandPlugin, + ComplianceItem, + ComplianceSummaryItem, + DocumentIdentifier, + InstanceInformation, + InstancePatchState, + Parameter, + ParameterMetadata, + PatchComplianceData, + SeveritySummary, + StepExecution, + Tag, + Target, +} from '@aws-sdk/client-ssm' +import { + CancelCommandCommand, + DeleteParameterCommand, + DescribeAutomationExecutionsCommand, + DescribeInstanceInformationCommand, + DescribeInstancePatchesCommand, + DescribeInstancePatchStatesCommand, + DescribeParametersCommand, + GetAutomationExecutionCommand, + GetCommandInvocationCommand, + GetDocumentCommand, + GetParameterCommand, + GetParametersByPathCommand, + GetParametersCommand, + ListCommandInvocationsCommand, + ListCommandsCommand, + ListComplianceItemsCommand, + ListComplianceSummariesCommand, + ListDocumentsCommand, + PutParameterCommand, + SendCommandCommand, + SSMClient, + StartAutomationExecutionCommand, + StopAutomationExecutionCommand, +} from '@aws-sdk/client-ssm' +import type { AwsSsmCancelCommandBody } from '@/lib/api/contracts/tools/aws/ssm-cancel-command' +import type { AwsSsmDeleteParameterBody } from '@/lib/api/contracts/tools/aws/ssm-delete-parameter' +import type { AwsSsmDescribeAutomationExecutionsBody } from '@/lib/api/contracts/tools/aws/ssm-describe-automation-executions' +import type { AwsSsmDescribeInstanceInformationBody } from '@/lib/api/contracts/tools/aws/ssm-describe-instance-information' +import type { AwsSsmDescribeInstancePatchStatesBody } from '@/lib/api/contracts/tools/aws/ssm-describe-instance-patch-states' +import type { AwsSsmDescribeInstancePatchesBody } from '@/lib/api/contracts/tools/aws/ssm-describe-instance-patches' +import type { AwsSsmDescribeParametersBody } from '@/lib/api/contracts/tools/aws/ssm-describe-parameters' +import type { AwsSsmGetAutomationExecutionBody } from '@/lib/api/contracts/tools/aws/ssm-get-automation-execution' +import type { AwsSsmGetCommandInvocationBody } from '@/lib/api/contracts/tools/aws/ssm-get-command-invocation' +import type { AwsSsmGetDocumentBody } from '@/lib/api/contracts/tools/aws/ssm-get-document' +import type { AwsSsmGetParameterBody } from '@/lib/api/contracts/tools/aws/ssm-get-parameter' +import type { AwsSsmGetParametersBody } from '@/lib/api/contracts/tools/aws/ssm-get-parameters' +import type { AwsSsmGetParametersByPathBody } from '@/lib/api/contracts/tools/aws/ssm-get-parameters-by-path' +import type { AwsSsmListCommandInvocationsBody } from '@/lib/api/contracts/tools/aws/ssm-list-command-invocations' +import type { AwsSsmListCommandsBody } from '@/lib/api/contracts/tools/aws/ssm-list-commands' +import type { AwsSsmListComplianceItemsBody } from '@/lib/api/contracts/tools/aws/ssm-list-compliance-items' +import type { AwsSsmListComplianceSummariesBody } from '@/lib/api/contracts/tools/aws/ssm-list-compliance-summaries' +import type { AwsSsmListDocumentsBody } from '@/lib/api/contracts/tools/aws/ssm-list-documents' +import type { AwsSsmPutParameterBody } from '@/lib/api/contracts/tools/aws/ssm-put-parameter' +import type { AwsSsmSendCommandBody } from '@/lib/api/contracts/tools/aws/ssm-send-command' +import type { AwsSsmStartAutomationExecutionBody } from '@/lib/api/contracts/tools/aws/ssm-start-automation-execution' +import type { AwsSsmStopAutomationExecutionBody } from '@/lib/api/contracts/tools/aws/ssm-stop-automation-execution' + +interface SsmConnectionConfig { + region: string + accessKeyId: string + secretAccessKey: string +} + +export function createSsmClient(config: SsmConnectionConfig): SSMClient { + return new SSMClient({ + region: config.region, + credentials: { + accessKeyId: config.accessKeyId, + secretAccessKey: config.secretAccessKey, + }, + }) +} + +function isoDate(value: Date | undefined): string | null { + return value?.toISOString() ?? null +} + +function mapTargets(targets: Target[] | undefined) { + return (targets ?? []).map((target) => ({ + key: target.Key ?? null, + values: target.Values ?? [], + })) +} + +function mapTags(tags: Tag[] | undefined) { + return (tags ?? []).map((tag) => ({ key: tag.Key ?? '', value: tag.Value ?? '' })) +} + +function mapCommand(command: Command | undefined) { + return { + commandId: command?.CommandId ?? '', + documentName: command?.DocumentName ?? '', + documentVersion: command?.DocumentVersion ?? null, + comment: command?.Comment ?? null, + status: command?.Status ?? '', + statusDetails: command?.StatusDetails ?? null, + requestedDateTime: isoDate(command?.RequestedDateTime), + expiresAfter: isoDate(command?.ExpiresAfter), + instanceIds: command?.InstanceIds ?? [], + targets: mapTargets(command?.Targets), + maxConcurrency: command?.MaxConcurrency ?? null, + maxErrors: command?.MaxErrors ?? null, + targetCount: command?.TargetCount ?? null, + completedCount: command?.CompletedCount ?? null, + errorCount: command?.ErrorCount ?? null, + deliveryTimedOutCount: command?.DeliveryTimedOutCount ?? null, + executionTimeoutSeconds: command?.TimeoutSeconds ?? null, + outputS3BucketName: command?.OutputS3BucketName ?? null, + outputS3KeyPrefix: command?.OutputS3KeyPrefix ?? null, + outputS3Region: command?.OutputS3Region ?? null, + serviceRole: command?.ServiceRole ?? null, + } +} + +function mapCommandPlugin(plugin: CommandPlugin) { + return { + name: plugin.Name ?? '', + status: plugin.Status ?? '', + statusDetails: plugin.StatusDetails ?? null, + responseCode: plugin.ResponseCode ?? null, + responseStartDateTime: isoDate(plugin.ResponseStartDateTime), + responseFinishDateTime: isoDate(plugin.ResponseFinishDateTime), + output: plugin.Output ?? null, + standardOutputUrl: plugin.StandardOutputUrl ?? null, + standardErrorUrl: plugin.StandardErrorUrl ?? null, + } +} + +function mapCommandInvocation(invocation: CommandInvocation) { + return { + commandId: invocation.CommandId ?? '', + instanceId: invocation.InstanceId ?? '', + instanceName: invocation.InstanceName ?? null, + documentName: invocation.DocumentName ?? null, + documentVersion: invocation.DocumentVersion ?? null, + comment: invocation.Comment ?? null, + requestedDateTime: isoDate(invocation.RequestedDateTime), + status: invocation.Status ?? '', + statusDetails: invocation.StatusDetails ?? null, + traceOutput: invocation.TraceOutput ?? null, + standardOutputUrl: invocation.StandardOutputUrl ?? null, + standardErrorUrl: invocation.StandardErrorUrl ?? null, + serviceRole: invocation.ServiceRole ?? null, + commandPlugins: (invocation.CommandPlugins ?? []).map(mapCommandPlugin), + } +} + +function mapParameter(parameter: Parameter) { + return { + name: parameter.Name ?? '', + type: parameter.Type ?? '', + value: parameter.Value ?? '', + version: parameter.Version ?? null, + selector: parameter.Selector ?? null, + sourceResult: parameter.SourceResult ?? null, + lastModifiedDate: isoDate(parameter.LastModifiedDate), + arn: parameter.ARN ?? '', + dataType: parameter.DataType ?? null, + } +} + +function mapParameterMetadata(metadata: ParameterMetadata) { + return { + name: metadata.Name ?? '', + arn: metadata.ARN ?? '', + type: metadata.Type ?? '', + keyId: metadata.KeyId ?? null, + lastModifiedDate: isoDate(metadata.LastModifiedDate), + lastModifiedUser: metadata.LastModifiedUser ?? null, + description: metadata.Description ?? null, + allowedPattern: metadata.AllowedPattern ?? null, + version: metadata.Version ?? null, + tier: metadata.Tier ?? null, + dataType: metadata.DataType ?? null, + policies: (metadata.Policies ?? []).map((policy) => ({ + policyText: policy.PolicyText ?? null, + policyType: policy.PolicyType ?? null, + policyStatus: policy.PolicyStatus ?? null, + })), + } +} + +function mapInstanceInformation(instance: InstanceInformation) { + return { + instanceId: instance.InstanceId ?? '', + pingStatus: instance.PingStatus ?? '', + lastPingDateTime: isoDate(instance.LastPingDateTime), + agentVersion: instance.AgentVersion ?? null, + isLatestVersion: instance.IsLatestVersion ?? null, + platformType: instance.PlatformType ?? null, + platformName: instance.PlatformName ?? null, + platformVersion: instance.PlatformVersion ?? null, + activationId: instance.ActivationId ?? null, + iamRole: instance.IamRole ?? null, + registrationDate: isoDate(instance.RegistrationDate), + resourceType: instance.ResourceType ?? null, + name: instance.Name ?? null, + ipAddress: instance.IPAddress ?? null, + computerName: instance.ComputerName ?? null, + associationStatus: instance.AssociationStatus ?? null, + lastAssociationExecutionDate: isoDate(instance.LastAssociationExecutionDate), + lastSuccessfulAssociationExecutionDate: isoDate( + instance.LastSuccessfulAssociationExecutionDate + ), + sourceId: instance.SourceId ?? null, + sourceType: instance.SourceType ?? null, + } +} + +function mapPatchComplianceData(patch: PatchComplianceData) { + return { + title: patch.Title ?? '', + kbId: patch.KBId ?? '', + classification: patch.Classification ?? '', + severity: patch.Severity ?? '', + state: patch.State ?? '', + installedTime: isoDate(patch.InstalledTime), + cveIds: patch.CVEIds ?? null, + } +} + +function mapInstancePatchState(state: InstancePatchState) { + return { + instanceId: state.InstanceId ?? '', + patchGroup: state.PatchGroup ?? '', + baselineId: state.BaselineId ?? '', + snapshotId: state.SnapshotId ?? null, + ownerInformation: state.OwnerInformation ?? null, + installedCount: state.InstalledCount ?? null, + installedOtherCount: state.InstalledOtherCount ?? null, + installedPendingRebootCount: state.InstalledPendingRebootCount ?? null, + installedRejectedCount: state.InstalledRejectedCount ?? null, + missingCount: state.MissingCount ?? null, + failedCount: state.FailedCount ?? null, + unreportedNotApplicableCount: state.UnreportedNotApplicableCount ?? null, + notApplicableCount: state.NotApplicableCount ?? null, + criticalNonCompliantCount: state.CriticalNonCompliantCount ?? null, + securityNonCompliantCount: state.SecurityNonCompliantCount ?? null, + otherNonCompliantCount: state.OtherNonCompliantCount ?? null, + operation: state.Operation ?? '', + operationStartTime: isoDate(state.OperationStartTime), + operationEndTime: isoDate(state.OperationEndTime), + lastNoRebootInstallOperationTime: isoDate(state.LastNoRebootInstallOperationTime), + rebootOption: state.RebootOption ?? null, + } +} + +function mapComplianceItem(item: ComplianceItem) { + return { + complianceType: item.ComplianceType ?? '', + resourceType: item.ResourceType ?? '', + resourceId: item.ResourceId ?? '', + id: item.Id ?? '', + title: item.Title ?? '', + status: item.Status ?? '', + severity: item.Severity ?? '', + executionTime: isoDate(item.ExecutionSummary?.ExecutionTime), + executionId: item.ExecutionSummary?.ExecutionId ?? null, + executionType: item.ExecutionSummary?.ExecutionType ?? null, + details: item.Details ?? null, + } +} + +function mapSeveritySummary(summary: SeveritySummary | undefined) { + if (!summary) return null + return { + criticalCount: summary.CriticalCount ?? null, + highCount: summary.HighCount ?? null, + mediumCount: summary.MediumCount ?? null, + lowCount: summary.LowCount ?? null, + informationalCount: summary.InformationalCount ?? null, + unspecifiedCount: summary.UnspecifiedCount ?? null, + } +} + +function mapComplianceSummaryItem(item: ComplianceSummaryItem) { + return { + complianceType: item.ComplianceType ?? '', + compliantCount: item.CompliantSummary?.CompliantCount ?? null, + compliantSeveritySummary: mapSeveritySummary(item.CompliantSummary?.SeveritySummary), + nonCompliantCount: item.NonCompliantSummary?.NonCompliantCount ?? null, + nonCompliantSeveritySummary: mapSeveritySummary(item.NonCompliantSummary?.SeveritySummary), + } +} + +function mapAutomationExecutionMetadata(execution: AutomationExecutionMetadata) { + return { + automationExecutionId: execution.AutomationExecutionId ?? '', + documentName: execution.DocumentName ?? '', + documentVersion: execution.DocumentVersion ?? null, + automationExecutionStatus: execution.AutomationExecutionStatus ?? '', + executionStartTime: isoDate(execution.ExecutionStartTime), + executionEndTime: isoDate(execution.ExecutionEndTime), + executedBy: execution.ExecutedBy ?? null, + logFile: execution.LogFile ?? null, + mode: execution.Mode ?? null, + parentAutomationExecutionId: execution.ParentAutomationExecutionId ?? null, + currentStepName: execution.CurrentStepName ?? null, + currentAction: execution.CurrentAction ?? null, + failureMessage: execution.FailureMessage ?? null, + targetParameterName: execution.TargetParameterName ?? null, + target: execution.Target ?? null, + automationType: execution.AutomationType ?? null, + maxConcurrency: execution.MaxConcurrency ?? null, + maxErrors: execution.MaxErrors ?? null, + outputs: execution.Outputs ?? null, + } +} + +function mapStepExecution(step: StepExecution) { + return { + stepName: step.StepName ?? null, + action: step.Action ?? null, + stepStatus: step.StepStatus ?? null, + stepExecutionId: step.StepExecutionId ?? null, + executionStartTime: isoDate(step.ExecutionStartTime), + executionEndTime: isoDate(step.ExecutionEndTime), + failureMessage: step.FailureMessage ?? null, + response: step.Response ?? null, + isEnd: step.IsEnd ?? null, + nextStep: step.NextStep ?? null, + } +} + +function mapDocumentIdentifier(document: DocumentIdentifier) { + return { + name: document.Name ?? '', + displayName: document.DisplayName ?? null, + owner: document.Owner ?? null, + createdDate: isoDate(document.CreatedDate), + versionName: document.VersionName ?? null, + documentVersion: document.DocumentVersion ?? null, + documentType: document.DocumentType ?? null, + documentFormat: document.DocumentFormat ?? null, + schemaVersion: document.SchemaVersion ?? null, + platformTypes: document.PlatformTypes ?? [], + targetType: document.TargetType ?? null, + reviewStatus: document.ReviewStatus ?? null, + author: document.Author ?? null, + tags: mapTags(document.Tags), + } +} + +export async function sendCommand( + client: SSMClient, + input: AwsSsmSendCommandBody, + signal?: AbortSignal +) { + const response = await client.send( + new SendCommandCommand({ + DocumentName: input.documentName, + ...(input.documentVersion ? { DocumentVersion: input.documentVersion } : {}), + ...(input.instanceIds?.length ? { InstanceIds: input.instanceIds } : {}), + ...(input.targets?.length ? { Targets: input.targets } : {}), + ...(input.comment ? { Comment: input.comment } : {}), + ...(input.parameters ? { Parameters: input.parameters } : {}), + ...(input.executionTimeoutSeconds != null + ? { TimeoutSeconds: input.executionTimeoutSeconds } + : {}), + ...(input.maxConcurrency ? { MaxConcurrency: input.maxConcurrency } : {}), + ...(input.maxErrors ? { MaxErrors: input.maxErrors } : {}), + ...(input.outputS3BucketName ? { OutputS3BucketName: input.outputS3BucketName } : {}), + ...(input.outputS3KeyPrefix ? { OutputS3KeyPrefix: input.outputS3KeyPrefix } : {}), + ...(input.serviceRoleArn ? { ServiceRoleArn: input.serviceRoleArn } : {}), + }), + { abortSignal: signal } + ) + + return mapCommand(response.Command) +} + +export async function listCommands( + client: SSMClient, + input: AwsSsmListCommandsBody, + signal?: AbortSignal +) { + const response = await client.send( + new ListCommandsCommand({ + ...(input.commandId ? { CommandId: input.commandId } : {}), + ...(input.instanceId ? { InstanceId: input.instanceId } : {}), + ...(input.filters?.length + ? { Filters: input.filters.map((filter) => ({ key: filter.key, value: filter.value })) } + : {}), + ...(input.maxResults != null ? { MaxResults: input.maxResults } : {}), + ...(input.nextToken ? { NextToken: input.nextToken } : {}), + }), + { abortSignal: signal } + ) + + const commands = (response.Commands ?? []).map((command) => mapCommand(command)) + return { commands, nextToken: response.NextToken ?? null, count: commands.length } +} + +export async function listCommandInvocations( + client: SSMClient, + input: AwsSsmListCommandInvocationsBody, + signal?: AbortSignal +) { + const response = await client.send( + new ListCommandInvocationsCommand({ + ...(input.commandId ? { CommandId: input.commandId } : {}), + ...(input.instanceId ? { InstanceId: input.instanceId } : {}), + ...(input.filters?.length + ? { Filters: input.filters.map((filter) => ({ key: filter.key, value: filter.value })) } + : {}), + ...(input.details != null ? { Details: input.details } : {}), + ...(input.maxResults != null ? { MaxResults: input.maxResults } : {}), + ...(input.nextToken ? { NextToken: input.nextToken } : {}), + }), + { abortSignal: signal } + ) + + const commandInvocations = (response.CommandInvocations ?? []).map(mapCommandInvocation) + return { + commandInvocations, + nextToken: response.NextToken ?? null, + count: commandInvocations.length, + } +} + +export async function getCommandInvocation( + client: SSMClient, + input: AwsSsmGetCommandInvocationBody, + signal?: AbortSignal +) { + const response = await client.send( + new GetCommandInvocationCommand({ + CommandId: input.commandId, + InstanceId: input.instanceId, + ...(input.pluginName ? { PluginName: input.pluginName } : {}), + }), + { abortSignal: signal } + ) + + return { + commandId: response.CommandId ?? '', + instanceId: response.InstanceId ?? '', + comment: response.Comment ?? null, + documentName: response.DocumentName ?? null, + documentVersion: response.DocumentVersion ?? null, + pluginName: response.PluginName ?? null, + responseCode: response.ResponseCode ?? null, + executionStartDateTime: response.ExecutionStartDateTime ?? null, + executionElapsedTime: response.ExecutionElapsedTime ?? null, + executionEndDateTime: response.ExecutionEndDateTime ?? null, + status: response.Status ?? '', + statusDetails: response.StatusDetails ?? null, + standardOutputContent: response.StandardOutputContent ?? '', + standardOutputUrl: response.StandardOutputUrl ?? null, + standardErrorContent: response.StandardErrorContent ?? '', + standardErrorUrl: response.StandardErrorUrl ?? null, + } +} + +export async function cancelCommand( + client: SSMClient, + input: AwsSsmCancelCommandBody, + signal?: AbortSignal +) { + await client.send( + new CancelCommandCommand({ + CommandId: input.commandId, + ...(input.instanceIds?.length ? { InstanceIds: input.instanceIds } : {}), + }), + { abortSignal: signal } + ) + + return { message: 'Command cancellation requested', commandId: input.commandId } +} + +export async function getParameter( + client: SSMClient, + input: AwsSsmGetParameterBody, + signal?: AbortSignal +) { + const response = await client.send( + new GetParameterCommand({ + Name: input.name, + ...(input.withDecryption != null ? { WithDecryption: input.withDecryption } : {}), + }), + { abortSignal: signal } + ) + + return mapParameter(response.Parameter ?? {}) +} + +export async function getParameters( + client: SSMClient, + input: AwsSsmGetParametersBody, + signal?: AbortSignal +) { + const response = await client.send( + new GetParametersCommand({ + Names: input.names, + ...(input.withDecryption != null ? { WithDecryption: input.withDecryption } : {}), + }), + { abortSignal: signal } + ) + + const parameters = (response.Parameters ?? []).map(mapParameter) + return { + parameters, + invalidParameters: response.InvalidParameters ?? [], + count: parameters.length, + } +} + +export async function getParametersByPath( + client: SSMClient, + input: AwsSsmGetParametersByPathBody, + signal?: AbortSignal +) { + const response = await client.send( + new GetParametersByPathCommand({ + Path: input.path, + ...(input.recursive != null ? { Recursive: input.recursive } : {}), + ...(input.withDecryption != null ? { WithDecryption: input.withDecryption } : {}), + ...(input.parameterFilters?.length ? { ParameterFilters: input.parameterFilters } : {}), + ...(input.maxResults != null ? { MaxResults: input.maxResults } : {}), + ...(input.nextToken ? { NextToken: input.nextToken } : {}), + }), + { abortSignal: signal } + ) + + const parameters = (response.Parameters ?? []).map(mapParameter) + return { parameters, nextToken: response.NextToken ?? null, count: parameters.length } +} + +export async function putParameter( + client: SSMClient, + input: AwsSsmPutParameterBody, + signal?: AbortSignal +) { + const response = await client.send( + new PutParameterCommand({ + Name: input.name, + Value: input.value, + ...(input.type ? { Type: input.type } : {}), + ...(input.description ? { Description: input.description } : {}), + ...(input.keyId ? { KeyId: input.keyId } : {}), + ...(input.overwrite != null ? { Overwrite: input.overwrite } : {}), + ...(input.allowedPattern ? { AllowedPattern: input.allowedPattern } : {}), + ...(input.tier ? { Tier: input.tier } : {}), + ...(input.dataType ? { DataType: input.dataType } : {}), + ...(input.policies ? { Policies: input.policies } : {}), + }), + { abortSignal: signal } + ) + + return { + message: `Parameter "${input.name}" written successfully`, + name: input.name, + version: response.Version ?? null, + tier: response.Tier ?? null, + } +} + +export async function deleteParameter( + client: SSMClient, + input: AwsSsmDeleteParameterBody, + signal?: AbortSignal +) { + await client.send(new DeleteParameterCommand({ Name: input.name }), { abortSignal: signal }) + return { message: `Parameter "${input.name}" deleted successfully`, name: input.name } +} + +export async function describeParameters( + client: SSMClient, + input: AwsSsmDescribeParametersBody, + signal?: AbortSignal +) { + const response = await client.send( + new DescribeParametersCommand({ + ...(input.parameterFilters?.length ? { ParameterFilters: input.parameterFilters } : {}), + ...(input.shared != null ? { Shared: input.shared } : {}), + ...(input.maxResults != null ? { MaxResults: input.maxResults } : {}), + ...(input.nextToken ? { NextToken: input.nextToken } : {}), + }), + { abortSignal: signal } + ) + + const parameters = (response.Parameters ?? []).map(mapParameterMetadata) + return { parameters, nextToken: response.NextToken ?? null, count: parameters.length } +} + +export async function describeInstanceInformation( + client: SSMClient, + input: AwsSsmDescribeInstanceInformationBody, + signal?: AbortSignal +) { + const response = await client.send( + new DescribeInstanceInformationCommand({ + ...(input.filters?.length ? { Filters: input.filters } : {}), + ...(input.maxResults != null ? { MaxResults: input.maxResults } : {}), + ...(input.nextToken ? { NextToken: input.nextToken } : {}), + }), + { abortSignal: signal } + ) + + const instances = (response.InstanceInformationList ?? []).map(mapInstanceInformation) + return { instances, nextToken: response.NextToken ?? null, count: instances.length } +} + +export async function describeInstancePatches( + client: SSMClient, + input: AwsSsmDescribeInstancePatchesBody, + signal?: AbortSignal +) { + const response = await client.send( + new DescribeInstancePatchesCommand({ + InstanceId: input.instanceId, + ...(input.filters?.length ? { Filters: input.filters } : {}), + ...(input.maxResults != null ? { MaxResults: input.maxResults } : {}), + ...(input.nextToken ? { NextToken: input.nextToken } : {}), + }), + { abortSignal: signal } + ) + + const patches = (response.Patches ?? []).map(mapPatchComplianceData) + return { patches, nextToken: response.NextToken ?? null, count: patches.length } +} + +export async function describeInstancePatchStates( + client: SSMClient, + input: AwsSsmDescribeInstancePatchStatesBody, + signal?: AbortSignal +) { + const response = await client.send( + new DescribeInstancePatchStatesCommand({ + InstanceIds: input.instanceIds, + ...(input.maxResults != null ? { MaxResults: input.maxResults } : {}), + ...(input.nextToken ? { NextToken: input.nextToken } : {}), + }), + { abortSignal: signal } + ) + + const instancePatchStates = (response.InstancePatchStates ?? []).map(mapInstancePatchState) + return { + instancePatchStates, + nextToken: response.NextToken ?? null, + count: instancePatchStates.length, + } +} + +export async function listComplianceItems( + client: SSMClient, + input: AwsSsmListComplianceItemsBody, + signal?: AbortSignal +) { + const response = await client.send( + new ListComplianceItemsCommand({ + ...(input.resourceIds?.length ? { ResourceIds: input.resourceIds } : {}), + ...(input.resourceTypes?.length ? { ResourceTypes: input.resourceTypes } : {}), + ...(input.filters?.length ? { Filters: input.filters } : {}), + ...(input.maxResults != null ? { MaxResults: input.maxResults } : {}), + ...(input.nextToken ? { NextToken: input.nextToken } : {}), + }), + { abortSignal: signal } + ) + + const complianceItems = (response.ComplianceItems ?? []).map(mapComplianceItem) + return { complianceItems, nextToken: response.NextToken ?? null, count: complianceItems.length } +} + +export async function listComplianceSummaries( + client: SSMClient, + input: AwsSsmListComplianceSummariesBody, + signal?: AbortSignal +) { + const response = await client.send( + new ListComplianceSummariesCommand({ + ...(input.filters?.length ? { Filters: input.filters } : {}), + ...(input.maxResults != null ? { MaxResults: input.maxResults } : {}), + ...(input.nextToken ? { NextToken: input.nextToken } : {}), + }), + { abortSignal: signal } + ) + + const complianceSummaryItems = (response.ComplianceSummaryItems ?? []).map( + mapComplianceSummaryItem + ) + return { + complianceSummaryItems, + nextToken: response.NextToken ?? null, + count: complianceSummaryItems.length, + } +} + +export async function startAutomationExecution( + client: SSMClient, + input: AwsSsmStartAutomationExecutionBody, + signal?: AbortSignal +) { + const response = await client.send( + new StartAutomationExecutionCommand({ + DocumentName: input.documentName, + ...(input.documentVersion ? { DocumentVersion: input.documentVersion } : {}), + ...(input.parameters ? { Parameters: input.parameters } : {}), + ...(input.mode ? { Mode: input.mode } : {}), + ...(input.targetParameterName ? { TargetParameterName: input.targetParameterName } : {}), + ...(input.targets?.length ? { Targets: input.targets } : {}), + ...(input.maxConcurrency ? { MaxConcurrency: input.maxConcurrency } : {}), + ...(input.maxErrors ? { MaxErrors: input.maxErrors } : {}), + ...(input.clientToken ? { ClientToken: input.clientToken } : {}), + }), + { abortSignal: signal } + ) + + return { automationExecutionId: response.AutomationExecutionId ?? '' } +} + +export async function describeAutomationExecutions( + client: SSMClient, + input: AwsSsmDescribeAutomationExecutionsBody, + signal?: AbortSignal +) { + const response = await client.send( + new DescribeAutomationExecutionsCommand({ + ...(input.filters?.length ? { Filters: input.filters } : {}), + ...(input.maxResults != null ? { MaxResults: input.maxResults } : {}), + ...(input.nextToken ? { NextToken: input.nextToken } : {}), + }), + { abortSignal: signal } + ) + + const automationExecutions = (response.AutomationExecutionMetadataList ?? []).map( + mapAutomationExecutionMetadata + ) + return { + automationExecutions, + nextToken: response.NextToken ?? null, + count: automationExecutions.length, + } +} + +export async function getAutomationExecution( + client: SSMClient, + input: AwsSsmGetAutomationExecutionBody, + signal?: AbortSignal +) { + const response = await client.send( + new GetAutomationExecutionCommand({ AutomationExecutionId: input.automationExecutionId }), + { abortSignal: signal } + ) + + const execution = response.AutomationExecution + + return { + automationExecutionId: execution?.AutomationExecutionId ?? '', + documentName: execution?.DocumentName ?? '', + documentVersion: execution?.DocumentVersion ?? null, + automationExecutionStatus: execution?.AutomationExecutionStatus ?? '', + executionStartTime: isoDate(execution?.ExecutionStartTime), + executionEndTime: isoDate(execution?.ExecutionEndTime), + executedBy: execution?.ExecutedBy ?? null, + mode: execution?.Mode ?? null, + parentAutomationExecutionId: execution?.ParentAutomationExecutionId ?? null, + currentStepName: execution?.CurrentStepName ?? null, + currentAction: execution?.CurrentAction ?? null, + failureMessage: execution?.FailureMessage ?? null, + targetParameterName: execution?.TargetParameterName ?? null, + target: execution?.Target ?? null, + maxConcurrency: execution?.MaxConcurrency ?? null, + maxErrors: execution?.MaxErrors ?? null, + parameters: execution?.Parameters ?? null, + outputs: execution?.Outputs ?? null, + stepExecutions: (execution?.StepExecutions ?? []).map(mapStepExecution), + stepExecutionsTruncated: execution?.StepExecutionsTruncated ?? null, + } +} + +export async function stopAutomationExecution( + client: SSMClient, + input: AwsSsmStopAutomationExecutionBody, + signal?: AbortSignal +) { + await client.send( + new StopAutomationExecutionCommand({ + AutomationExecutionId: input.automationExecutionId, + ...(input.stopType ? { Type: input.stopType } : {}), + }), + { abortSignal: signal } + ) + + return { + message: 'Automation execution stop requested', + automationExecutionId: input.automationExecutionId, + } +} + +export async function listDocuments( + client: SSMClient, + input: AwsSsmListDocumentsBody, + signal?: AbortSignal +) { + const response = await client.send( + new ListDocumentsCommand({ + ...(input.filters?.length ? { Filters: input.filters } : {}), + ...(input.maxResults != null ? { MaxResults: input.maxResults } : {}), + ...(input.nextToken ? { NextToken: input.nextToken } : {}), + }), + { abortSignal: signal } + ) + + const documents = (response.DocumentIdentifiers ?? []).map(mapDocumentIdentifier) + return { documents, nextToken: response.NextToken ?? null, count: documents.length } +} + +export async function getDocument( + client: SSMClient, + input: AwsSsmGetDocumentBody, + signal?: AbortSignal +) { + const response = await client.send( + new GetDocumentCommand({ + Name: input.name, + ...(input.documentVersion ? { DocumentVersion: input.documentVersion } : {}), + ...(input.versionName ? { VersionName: input.versionName } : {}), + ...(input.documentFormat ? { DocumentFormat: input.documentFormat } : {}), + }), + { abortSignal: signal } + ) + + return { + name: response.Name ?? '', + displayName: response.DisplayName ?? null, + createdDate: isoDate(response.CreatedDate), + versionName: response.VersionName ?? null, + documentVersion: response.DocumentVersion ?? null, + status: response.Status ?? null, + statusInformation: response.StatusInformation ?? null, + content: response.Content ?? '', + documentType: response.DocumentType ?? null, + documentFormat: response.DocumentFormat ?? null, + reviewStatus: response.ReviewStatus ?? null, + } +} diff --git a/apps/sim/lib/internal/ssm/execute-tool.test.ts b/apps/sim/lib/internal/ssm/execute-tool.test.ts new file mode 100644 index 00000000000..9fa92cf8710 --- /dev/null +++ b/apps/sim/lib/internal/ssm/execute-tool.test.ts @@ -0,0 +1,318 @@ +/** + * @vitest-environment node + */ +import { beforeEach, describe, expect, it, vi } from 'vitest' + +const mockOperations = vi.hoisted(() => ({ + executeSsmCancelCommand: vi.fn(), + executeSsmDeleteParameter: vi.fn(), + executeSsmDescribeAutomationExecutions: vi.fn(), + executeSsmDescribeInstanceInformation: vi.fn(), + executeSsmDescribeInstancePatchStates: vi.fn(), + executeSsmDescribeInstancePatches: vi.fn(), + executeSsmDescribeParameters: vi.fn(), + executeSsmGetAutomationExecution: vi.fn(), + executeSsmGetCommandInvocation: vi.fn(), + executeSsmGetDocument: vi.fn(), + executeSsmGetParameter: vi.fn(), + executeSsmGetParameters: vi.fn(), + executeSsmGetParametersByPath: vi.fn(), + executeSsmListCommandInvocations: vi.fn(), + executeSsmListCommands: vi.fn(), + executeSsmListComplianceItems: vi.fn(), + executeSsmListComplianceSummaries: vi.fn(), + executeSsmListDocuments: vi.fn(), + executeSsmPutParameter: vi.fn(), + executeSsmSendCommand: vi.fn(), + executeSsmStartAutomationExecution: vi.fn(), + executeSsmStopAutomationExecution: vi.fn(), +})) + +vi.mock('@/lib/internal/ssm/operations', () => mockOperations) + +import { executeSsmTool } from '@/lib/internal/ssm/execute-tool' +import type { InternalToolOperationCall } from '@/lib/internal/tool-operations/types' + +const CONNECTION = { + region: 'us-east-1', + accessKeyId: 'access-key', + secretAccessKey: 'secret-key', +} + +const COMMAND_ID = '11111111-2222-3333-4444-555555555555' +const INSTANCE_ID = 'i-0123456789abcdef0' + +function createRequest( + overrides: Partial = {} +): InternalToolOperationCall { + return { + toolId: 'ssm_list_commands', + input: CONNECTION, + headers: new Headers({ 'content-type': 'application/json' }), + context: { + workflowId: 'workflow-1', + workspaceId: 'workspace-1', + userId: 'user-1', + metadata: {}, + }, + requestId: 'request-1', + ...overrides, + } +} + +const TOOL_CASES = [ + { + toolId: 'ssm_send_command', + input: { ...CONNECTION, documentName: 'AWS-RunShellScript', instanceIds: [INSTANCE_ID] }, + operation: mockOperations.executeSsmSendCommand, + }, + { + toolId: 'ssm_list_commands', + input: CONNECTION, + operation: mockOperations.executeSsmListCommands, + }, + { + toolId: 'ssm_list_command_invocations', + input: { ...CONNECTION, commandId: COMMAND_ID }, + operation: mockOperations.executeSsmListCommandInvocations, + }, + { + toolId: 'ssm_get_command_invocation', + input: { ...CONNECTION, commandId: COMMAND_ID, instanceId: INSTANCE_ID }, + operation: mockOperations.executeSsmGetCommandInvocation, + }, + { + toolId: 'ssm_cancel_command', + input: { ...CONNECTION, commandId: COMMAND_ID }, + operation: mockOperations.executeSsmCancelCommand, + }, + { + toolId: 'ssm_get_parameter', + input: { ...CONNECTION, name: '/prod/app/database-url' }, + operation: mockOperations.executeSsmGetParameter, + }, + { + toolId: 'ssm_get_parameters', + input: { ...CONNECTION, names: ['/prod/app/database-url'] }, + operation: mockOperations.executeSsmGetParameters, + }, + { + toolId: 'ssm_get_parameters_by_path', + input: { ...CONNECTION, path: '/prod/app' }, + operation: mockOperations.executeSsmGetParametersByPath, + }, + { + toolId: 'ssm_put_parameter', + input: { ...CONNECTION, name: '/prod/app/database-url', value: 'postgres://example' }, + operation: mockOperations.executeSsmPutParameter, + }, + { + toolId: 'ssm_delete_parameter', + input: { ...CONNECTION, name: '/prod/app/database-url' }, + operation: mockOperations.executeSsmDeleteParameter, + }, + { + toolId: 'ssm_describe_parameters', + input: CONNECTION, + operation: mockOperations.executeSsmDescribeParameters, + }, + { + toolId: 'ssm_describe_instance_information', + input: CONNECTION, + operation: mockOperations.executeSsmDescribeInstanceInformation, + }, + { + toolId: 'ssm_describe_instance_patches', + input: { ...CONNECTION, instanceId: INSTANCE_ID }, + operation: mockOperations.executeSsmDescribeInstancePatches, + }, + { + toolId: 'ssm_describe_instance_patch_states', + input: { ...CONNECTION, instanceIds: [INSTANCE_ID] }, + operation: mockOperations.executeSsmDescribeInstancePatchStates, + }, + { + toolId: 'ssm_list_compliance_items', + input: { ...CONNECTION, resourceIds: [INSTANCE_ID] }, + operation: mockOperations.executeSsmListComplianceItems, + }, + { + toolId: 'ssm_list_compliance_summaries', + input: CONNECTION, + operation: mockOperations.executeSsmListComplianceSummaries, + }, + { + toolId: 'ssm_start_automation_execution', + input: { ...CONNECTION, documentName: 'AWS-RestartEC2Instance' }, + operation: mockOperations.executeSsmStartAutomationExecution, + }, + { + toolId: 'ssm_describe_automation_executions', + input: CONNECTION, + operation: mockOperations.executeSsmDescribeAutomationExecutions, + }, + { + toolId: 'ssm_get_automation_execution', + input: { ...CONNECTION, automationExecutionId: COMMAND_ID }, + operation: mockOperations.executeSsmGetAutomationExecution, + }, + { + toolId: 'ssm_stop_automation_execution', + input: { ...CONNECTION, automationExecutionId: COMMAND_ID }, + operation: mockOperations.executeSsmStopAutomationExecution, + }, + { + toolId: 'ssm_list_documents', + input: CONNECTION, + operation: mockOperations.executeSsmListDocuments, + }, + { + toolId: 'ssm_get_document', + input: { ...CONNECTION, name: 'AWS-RunShellScript' }, + operation: mockOperations.executeSsmGetDocument, + }, +] as const + +describe('executeSsmTool', () => { + beforeEach(() => { + vi.clearAllMocks() + }) + + it.each(TOOL_CASES)('validates and dispatches $toolId', async ({ toolId, input, operation }) => { + const controller = new AbortController() + operation.mockResolvedValue({ toolId }) + + const response = await executeSsmTool( + createRequest({ toolId, input, signal: controller.signal }) + ) + + expect(response.status).toBe(200) + await expect(response.json()).resolves.toEqual({ toolId }) + expect(operation).toHaveBeenCalledWith(input, controller.signal) + }) + + it('returns the route-compatible validation envelope before provider work', async () => { + const response = await executeSsmTool(createRequest({ input: { region: 'invalid' } })) + + expect(response.status).toBe(400) + await expect(response.json()).resolves.toMatchObject({ + error: 'Invalid request data', + details: expect.any(Array), + }) + expect(mockOperations.executeSsmListCommands).not.toHaveBeenCalled() + }) + + it('rejects a malformed instance ID before calling the provider', async () => { + const response = await executeSsmTool( + createRequest({ + toolId: 'ssm_get_command_invocation', + input: { ...CONNECTION, commandId: COMMAND_ID, instanceId: 'not-an-instance' }, + }) + ) + + expect(response.status).toBe(400) + expect(mockOperations.executeSsmGetCommandInvocation).not.toHaveBeenCalled() + }) + + it('rejects a hierarchy path without the leading slash AWS requires', async () => { + const response = await executeSsmTool( + createRequest({ + toolId: 'ssm_get_parameters_by_path', + input: { ...CONNECTION, path: 'prod/app' }, + }) + ) + + expect(response.status).toBe(400) + await expect(response.json()).resolves.toMatchObject({ + details: expect.arrayContaining([ + expect.objectContaining({ + message: 'path must start with a forward slash (e.g., /prod/app)', + }), + ]), + }) + expect(mockOperations.executeSsmGetParametersByPath).not.toHaveBeenCalled() + }) + + it('accepts a hierarchy path that starts with a slash', async () => { + mockOperations.executeSsmGetParametersByPath.mockResolvedValue({ parameters: [] }) + + const response = await executeSsmTool( + createRequest({ + toolId: 'ssm_get_parameters_by_path', + input: { ...CONNECTION, path: '/prod/app' }, + }) + ) + + expect(response.status).toBe(200) + expect(mockOperations.executeSsmGetParametersByPath).toHaveBeenCalled() + }) + + it('rejects an unsupported tool id', async () => { + const response = await executeSsmTool(createRequest({ toolId: 'ssm_not_a_tool' })) + + expect(response.status).toBe(500) + await expect(response.json()).resolves.toEqual({ + error: 'Unsupported Systems Manager tool: ssm_not_a_tool', + }) + }) + + describe('Parameter Store secret handling', () => { + it('keeps a decrypted parameter value out of the failure envelope', async () => { + const secret = 'super-secret-database-password' + mockOperations.executeSsmGetParameter.mockRejectedValue( + new Error('AccessDeniedException: not authorized to perform ssm:GetParameter') + ) + + const response = await executeSsmTool( + createRequest({ + toolId: 'ssm_get_parameter', + input: { ...CONNECTION, name: '/prod/app/db-password', withDecryption: true }, + }) + ) + + expect(response.status).toBe(500) + const body = await response.text() + expect(body).not.toContain(secret) + expect(body).not.toContain(CONNECTION.secretAccessKey) + expect(body).toContain('Failed to get parameter') + }) + + it('keeps the written value out of the put_parameter failure envelope', async () => { + const secret = 'postgres://user:hunter2@db.example.com/app' + mockOperations.executeSsmPutParameter.mockRejectedValue( + new Error('ParameterAlreadyExists: the parameter already exists') + ) + + const response = await executeSsmTool( + createRequest({ + toolId: 'ssm_put_parameter', + input: { + ...CONNECTION, + name: '/prod/app/database-url', + value: secret, + type: 'SecureString', + }, + }) + ) + + expect(response.status).toBe(500) + const body = await response.text() + expect(body).not.toContain(secret) + expect(body).not.toContain('hunter2') + }) + + it('does not decrypt unless the caller opts in', async () => { + mockOperations.executeSsmGetParameter.mockResolvedValue({ name: '/prod/app/db-password' }) + + await executeSsmTool( + createRequest({ + toolId: 'ssm_get_parameter', + input: { ...CONNECTION, name: '/prod/app/db-password' }, + }) + ) + + const [passedInput] = mockOperations.executeSsmGetParameter.mock.calls[0] + expect(passedInput.withDecryption).toBeUndefined() + }) + }) +}) diff --git a/apps/sim/lib/internal/ssm/execute-tool.ts b/apps/sim/lib/internal/ssm/execute-tool.ts new file mode 100644 index 00000000000..51abfb1e665 --- /dev/null +++ b/apps/sim/lib/internal/ssm/execute-tool.ts @@ -0,0 +1,261 @@ +import { getErrorMessage } from '@sim/utils/errors' +import type { AnyApiRouteContract, ContractBody } from '@/lib/api/contracts' +import { awsSsmCancelCommandContract } from '@/lib/api/contracts/tools/aws/ssm-cancel-command' +import { awsSsmDeleteParameterContract } from '@/lib/api/contracts/tools/aws/ssm-delete-parameter' +import { awsSsmDescribeAutomationExecutionsContract } from '@/lib/api/contracts/tools/aws/ssm-describe-automation-executions' +import { awsSsmDescribeInstanceInformationContract } from '@/lib/api/contracts/tools/aws/ssm-describe-instance-information' +import { awsSsmDescribeInstancePatchStatesContract } from '@/lib/api/contracts/tools/aws/ssm-describe-instance-patch-states' +import { awsSsmDescribeInstancePatchesContract } from '@/lib/api/contracts/tools/aws/ssm-describe-instance-patches' +import { awsSsmDescribeParametersContract } from '@/lib/api/contracts/tools/aws/ssm-describe-parameters' +import { awsSsmGetAutomationExecutionContract } from '@/lib/api/contracts/tools/aws/ssm-get-automation-execution' +import { awsSsmGetCommandInvocationContract } from '@/lib/api/contracts/tools/aws/ssm-get-command-invocation' +import { awsSsmGetDocumentContract } from '@/lib/api/contracts/tools/aws/ssm-get-document' +import { awsSsmGetParameterContract } from '@/lib/api/contracts/tools/aws/ssm-get-parameter' +import { awsSsmGetParametersContract } from '@/lib/api/contracts/tools/aws/ssm-get-parameters' +import { awsSsmGetParametersByPathContract } from '@/lib/api/contracts/tools/aws/ssm-get-parameters-by-path' +import { awsSsmListCommandInvocationsContract } from '@/lib/api/contracts/tools/aws/ssm-list-command-invocations' +import { awsSsmListCommandsContract } from '@/lib/api/contracts/tools/aws/ssm-list-commands' +import { awsSsmListComplianceItemsContract } from '@/lib/api/contracts/tools/aws/ssm-list-compliance-items' +import { awsSsmListComplianceSummariesContract } from '@/lib/api/contracts/tools/aws/ssm-list-compliance-summaries' +import { awsSsmListDocumentsContract } from '@/lib/api/contracts/tools/aws/ssm-list-documents' +import { awsSsmPutParameterContract } from '@/lib/api/contracts/tools/aws/ssm-put-parameter' +import { awsSsmSendCommandContract } from '@/lib/api/contracts/tools/aws/ssm-send-command' +import { awsSsmStartAutomationExecutionContract } from '@/lib/api/contracts/tools/aws/ssm-start-automation-execution' +import { awsSsmStopAutomationExecutionContract } from '@/lib/api/contracts/tools/aws/ssm-stop-automation-execution' +import { + executeSsmCancelCommand, + executeSsmDeleteParameter, + executeSsmDescribeAutomationExecutions, + executeSsmDescribeInstanceInformation, + executeSsmDescribeInstancePatches, + executeSsmDescribeInstancePatchStates, + executeSsmDescribeParameters, + executeSsmGetAutomationExecution, + executeSsmGetCommandInvocation, + executeSsmGetDocument, + executeSsmGetParameter, + executeSsmGetParameters, + executeSsmGetParametersByPath, + executeSsmListCommandInvocations, + executeSsmListCommands, + executeSsmListComplianceItems, + executeSsmListComplianceSummaries, + executeSsmListDocuments, + executeSsmPutParameter, + executeSsmSendCommand, + executeSsmStartAutomationExecution, + executeSsmStopAutomationExecution, +} from '@/lib/internal/ssm/operations' +import { parseInternalToolInput } from '@/lib/internal/tool-operations/parse-input' +import type { InternalToolOperationHandler } from '@/lib/internal/tool-operations/types' + +async function executeOperation( + contract: C, + input: unknown, + execute: (input: ContractBody, signal?: AbortSignal) => Promise, + errorMessage: string, + signal?: AbortSignal +): Promise { + const parsed = parseInternalToolInput(contract, input) + if (!parsed.success) return parsed.response + + try { + const result = await execute(parsed.data, signal) + signal?.throwIfAborted() + return Response.json(result) + } catch (error) { + signal?.throwIfAborted() + return Response.json( + { error: `${errorMessage}: ${getErrorMessage(error, 'Unknown error occurred')}` }, + { status: 500 } + ) + } +} + +export const executeSsmTool: InternalToolOperationHandler = async ({ toolId, input, signal }) => { + signal?.throwIfAborted() + + switch (toolId) { + case 'ssm_send_command': + return executeOperation( + awsSsmSendCommandContract, + input, + executeSsmSendCommand, + 'Failed to send command', + signal + ) + case 'ssm_list_commands': + return executeOperation( + awsSsmListCommandsContract, + input, + executeSsmListCommands, + 'Failed to list commands', + signal + ) + case 'ssm_list_command_invocations': + return executeOperation( + awsSsmListCommandInvocationsContract, + input, + executeSsmListCommandInvocations, + 'Failed to list command invocations', + signal + ) + case 'ssm_get_command_invocation': + return executeOperation( + awsSsmGetCommandInvocationContract, + input, + executeSsmGetCommandInvocation, + 'Failed to get command invocation', + signal + ) + case 'ssm_cancel_command': + return executeOperation( + awsSsmCancelCommandContract, + input, + executeSsmCancelCommand, + 'Failed to cancel command', + signal + ) + case 'ssm_get_parameter': + return executeOperation( + awsSsmGetParameterContract, + input, + executeSsmGetParameter, + 'Failed to get parameter', + signal + ) + case 'ssm_get_parameters': + return executeOperation( + awsSsmGetParametersContract, + input, + executeSsmGetParameters, + 'Failed to get parameters', + signal + ) + case 'ssm_get_parameters_by_path': + return executeOperation( + awsSsmGetParametersByPathContract, + input, + executeSsmGetParametersByPath, + 'Failed to get parameters by path', + signal + ) + case 'ssm_put_parameter': + return executeOperation( + awsSsmPutParameterContract, + input, + executeSsmPutParameter, + 'Failed to put parameter', + signal + ) + case 'ssm_delete_parameter': + return executeOperation( + awsSsmDeleteParameterContract, + input, + executeSsmDeleteParameter, + 'Failed to delete parameter', + signal + ) + case 'ssm_describe_parameters': + return executeOperation( + awsSsmDescribeParametersContract, + input, + executeSsmDescribeParameters, + 'Failed to describe parameters', + signal + ) + case 'ssm_describe_instance_information': + return executeOperation( + awsSsmDescribeInstanceInformationContract, + input, + executeSsmDescribeInstanceInformation, + 'Failed to describe instance information', + signal + ) + case 'ssm_describe_instance_patches': + return executeOperation( + awsSsmDescribeInstancePatchesContract, + input, + executeSsmDescribeInstancePatches, + 'Failed to describe instance patches', + signal + ) + case 'ssm_describe_instance_patch_states': + return executeOperation( + awsSsmDescribeInstancePatchStatesContract, + input, + executeSsmDescribeInstancePatchStates, + 'Failed to describe instance patch states', + signal + ) + case 'ssm_list_compliance_items': + return executeOperation( + awsSsmListComplianceItemsContract, + input, + executeSsmListComplianceItems, + 'Failed to list compliance items', + signal + ) + case 'ssm_list_compliance_summaries': + return executeOperation( + awsSsmListComplianceSummariesContract, + input, + executeSsmListComplianceSummaries, + 'Failed to list compliance summaries', + signal + ) + case 'ssm_start_automation_execution': + return executeOperation( + awsSsmStartAutomationExecutionContract, + input, + executeSsmStartAutomationExecution, + 'Failed to start automation execution', + signal + ) + case 'ssm_describe_automation_executions': + return executeOperation( + awsSsmDescribeAutomationExecutionsContract, + input, + executeSsmDescribeAutomationExecutions, + 'Failed to describe automation executions', + signal + ) + case 'ssm_get_automation_execution': + return executeOperation( + awsSsmGetAutomationExecutionContract, + input, + executeSsmGetAutomationExecution, + 'Failed to get automation execution', + signal + ) + case 'ssm_stop_automation_execution': + return executeOperation( + awsSsmStopAutomationExecutionContract, + input, + executeSsmStopAutomationExecution, + 'Failed to stop automation execution', + signal + ) + case 'ssm_list_documents': + return executeOperation( + awsSsmListDocumentsContract, + input, + executeSsmListDocuments, + 'Failed to list documents', + signal + ) + case 'ssm_get_document': + return executeOperation( + awsSsmGetDocumentContract, + input, + executeSsmGetDocument, + 'Failed to get document', + signal + ) + default: + return Response.json( + { error: `Unsupported Systems Manager tool: ${toolId}` }, + { status: 500 } + ) + } +} diff --git a/apps/sim/lib/internal/ssm/operations.ts b/apps/sim/lib/internal/ssm/operations.ts new file mode 100644 index 00000000000..350be48fdac --- /dev/null +++ b/apps/sim/lib/internal/ssm/operations.ts @@ -0,0 +1,296 @@ +import type { AwsSsmCancelCommandBody } from '@/lib/api/contracts/tools/aws/ssm-cancel-command' +import type { AwsSsmDeleteParameterBody } from '@/lib/api/contracts/tools/aws/ssm-delete-parameter' +import type { AwsSsmDescribeAutomationExecutionsBody } from '@/lib/api/contracts/tools/aws/ssm-describe-automation-executions' +import type { AwsSsmDescribeInstanceInformationBody } from '@/lib/api/contracts/tools/aws/ssm-describe-instance-information' +import type { AwsSsmDescribeInstancePatchStatesBody } from '@/lib/api/contracts/tools/aws/ssm-describe-instance-patch-states' +import type { AwsSsmDescribeInstancePatchesBody } from '@/lib/api/contracts/tools/aws/ssm-describe-instance-patches' +import type { AwsSsmDescribeParametersBody } from '@/lib/api/contracts/tools/aws/ssm-describe-parameters' +import type { AwsSsmGetAutomationExecutionBody } from '@/lib/api/contracts/tools/aws/ssm-get-automation-execution' +import type { AwsSsmGetCommandInvocationBody } from '@/lib/api/contracts/tools/aws/ssm-get-command-invocation' +import type { AwsSsmGetDocumentBody } from '@/lib/api/contracts/tools/aws/ssm-get-document' +import type { AwsSsmGetParameterBody } from '@/lib/api/contracts/tools/aws/ssm-get-parameter' +import type { AwsSsmGetParametersBody } from '@/lib/api/contracts/tools/aws/ssm-get-parameters' +import type { AwsSsmGetParametersByPathBody } from '@/lib/api/contracts/tools/aws/ssm-get-parameters-by-path' +import type { AwsSsmListCommandInvocationsBody } from '@/lib/api/contracts/tools/aws/ssm-list-command-invocations' +import type { AwsSsmListCommandsBody } from '@/lib/api/contracts/tools/aws/ssm-list-commands' +import type { AwsSsmListComplianceItemsBody } from '@/lib/api/contracts/tools/aws/ssm-list-compliance-items' +import type { AwsSsmListComplianceSummariesBody } from '@/lib/api/contracts/tools/aws/ssm-list-compliance-summaries' +import type { AwsSsmListDocumentsBody } from '@/lib/api/contracts/tools/aws/ssm-list-documents' +import type { AwsSsmPutParameterBody } from '@/lib/api/contracts/tools/aws/ssm-put-parameter' +import type { AwsSsmSendCommandBody } from '@/lib/api/contracts/tools/aws/ssm-send-command' +import type { AwsSsmStartAutomationExecutionBody } from '@/lib/api/contracts/tools/aws/ssm-start-automation-execution' +import type { AwsSsmStopAutomationExecutionBody } from '@/lib/api/contracts/tools/aws/ssm-stop-automation-execution' +import { + cancelCommand, + createSsmClient, + deleteParameter, + describeAutomationExecutions, + describeInstanceInformation, + describeInstancePatches, + describeInstancePatchStates, + describeParameters, + getAutomationExecution, + getCommandInvocation, + getDocument, + getParameter, + getParameters, + getParametersByPath, + listCommandInvocations, + listCommands, + listComplianceItems, + listComplianceSummaries, + listDocuments, + putParameter, + sendCommand, + startAutomationExecution, + stopAutomationExecution, +} from '@/lib/internal/ssm/client' + +export async function executeSsmSendCommand(input: AwsSsmSendCommandBody, signal?: AbortSignal) { + const client = createSsmClient(input) + try { + return await sendCommand(client, input, signal) + } finally { + client.destroy() + } +} + +export async function executeSsmListCommands(input: AwsSsmListCommandsBody, signal?: AbortSignal) { + const client = createSsmClient(input) + try { + return await listCommands(client, input, signal) + } finally { + client.destroy() + } +} + +export async function executeSsmListCommandInvocations( + input: AwsSsmListCommandInvocationsBody, + signal?: AbortSignal +) { + const client = createSsmClient(input) + try { + return await listCommandInvocations(client, input, signal) + } finally { + client.destroy() + } +} + +export async function executeSsmGetCommandInvocation( + input: AwsSsmGetCommandInvocationBody, + signal?: AbortSignal +) { + const client = createSsmClient(input) + try { + return await getCommandInvocation(client, input, signal) + } finally { + client.destroy() + } +} + +export async function executeSsmCancelCommand( + input: AwsSsmCancelCommandBody, + signal?: AbortSignal +) { + const client = createSsmClient(input) + try { + return await cancelCommand(client, input, signal) + } finally { + client.destroy() + } +} + +export async function executeSsmGetParameter(input: AwsSsmGetParameterBody, signal?: AbortSignal) { + const client = createSsmClient(input) + try { + return await getParameter(client, input, signal) + } finally { + client.destroy() + } +} + +export async function executeSsmGetParameters( + input: AwsSsmGetParametersBody, + signal?: AbortSignal +) { + const client = createSsmClient(input) + try { + return await getParameters(client, input, signal) + } finally { + client.destroy() + } +} + +export async function executeSsmGetParametersByPath( + input: AwsSsmGetParametersByPathBody, + signal?: AbortSignal +) { + const client = createSsmClient(input) + try { + return await getParametersByPath(client, input, signal) + } finally { + client.destroy() + } +} + +export async function executeSsmPutParameter(input: AwsSsmPutParameterBody, signal?: AbortSignal) { + const client = createSsmClient(input) + try { + return await putParameter(client, input, signal) + } finally { + client.destroy() + } +} + +export async function executeSsmDeleteParameter( + input: AwsSsmDeleteParameterBody, + signal?: AbortSignal +) { + const client = createSsmClient(input) + try { + return await deleteParameter(client, input, signal) + } finally { + client.destroy() + } +} + +export async function executeSsmDescribeParameters( + input: AwsSsmDescribeParametersBody, + signal?: AbortSignal +) { + const client = createSsmClient(input) + try { + return await describeParameters(client, input, signal) + } finally { + client.destroy() + } +} + +export async function executeSsmDescribeInstanceInformation( + input: AwsSsmDescribeInstanceInformationBody, + signal?: AbortSignal +) { + const client = createSsmClient(input) + try { + return await describeInstanceInformation(client, input, signal) + } finally { + client.destroy() + } +} + +export async function executeSsmDescribeInstancePatches( + input: AwsSsmDescribeInstancePatchesBody, + signal?: AbortSignal +) { + const client = createSsmClient(input) + try { + return await describeInstancePatches(client, input, signal) + } finally { + client.destroy() + } +} + +export async function executeSsmDescribeInstancePatchStates( + input: AwsSsmDescribeInstancePatchStatesBody, + signal?: AbortSignal +) { + const client = createSsmClient(input) + try { + return await describeInstancePatchStates(client, input, signal) + } finally { + client.destroy() + } +} + +export async function executeSsmListComplianceItems( + input: AwsSsmListComplianceItemsBody, + signal?: AbortSignal +) { + const client = createSsmClient(input) + try { + return await listComplianceItems(client, input, signal) + } finally { + client.destroy() + } +} + +export async function executeSsmListComplianceSummaries( + input: AwsSsmListComplianceSummariesBody, + signal?: AbortSignal +) { + const client = createSsmClient(input) + try { + return await listComplianceSummaries(client, input, signal) + } finally { + client.destroy() + } +} + +export async function executeSsmStartAutomationExecution( + input: AwsSsmStartAutomationExecutionBody, + signal?: AbortSignal +) { + const client = createSsmClient(input) + try { + return await startAutomationExecution(client, input, signal) + } finally { + client.destroy() + } +} + +export async function executeSsmDescribeAutomationExecutions( + input: AwsSsmDescribeAutomationExecutionsBody, + signal?: AbortSignal +) { + const client = createSsmClient(input) + try { + return await describeAutomationExecutions(client, input, signal) + } finally { + client.destroy() + } +} + +export async function executeSsmGetAutomationExecution( + input: AwsSsmGetAutomationExecutionBody, + signal?: AbortSignal +) { + const client = createSsmClient(input) + try { + return await getAutomationExecution(client, input, signal) + } finally { + client.destroy() + } +} + +export async function executeSsmStopAutomationExecution( + input: AwsSsmStopAutomationExecutionBody, + signal?: AbortSignal +) { + const client = createSsmClient(input) + try { + return await stopAutomationExecution(client, input, signal) + } finally { + client.destroy() + } +} + +export async function executeSsmListDocuments( + input: AwsSsmListDocumentsBody, + signal?: AbortSignal +) { + const client = createSsmClient(input) + try { + return await listDocuments(client, input, signal) + } finally { + client.destroy() + } +} + +export async function executeSsmGetDocument(input: AwsSsmGetDocumentBody, signal?: AbortSignal) { + const client = createSsmClient(input) + try { + return await getDocument(client, input, signal) + } finally { + client.destroy() + } +} diff --git a/apps/sim/lib/internal/tool-operations/registry.server.ts b/apps/sim/lib/internal/tool-operations/registry.server.ts index ae5994a5054..b683b447938 100644 --- a/apps/sim/lib/internal/tool-operations/registry.server.ts +++ b/apps/sim/lib/internal/tool-operations/registry.server.ts @@ -52,8 +52,10 @@ const IAM_TOOL_IDS = [ 'iam_delete_user', 'iam_detach_role_policy', 'iam_detach_user_policy', + 'iam_get_policy', 'iam_get_role', 'iam_get_user', + 'iam_list_access_keys', 'iam_list_attached_role_policies', 'iam_list_attached_user_policies', 'iam_list_groups', @@ -62,6 +64,7 @@ const IAM_TOOL_IDS = [ 'iam_list_users', 'iam_remove_user_from_group', 'iam_simulate_principal_policy', + 'iam_update_access_key', ] as const const IDENTITY_CENTER_TOOL_IDS = [ @@ -77,6 +80,10 @@ const IDENTITY_CENTER_TOOL_IDS = [ 'identity_center_check_assignment_status', 'identity_center_check_assignment_deletion_status', 'identity_center_list_account_assignments', + 'identity_center_list_assignments_for_account', + 'identity_center_describe_user', + 'identity_center_describe_group', + 'identity_center_list_group_memberships', ] as const const SECRETS_MANAGER_TOOL_IDS = [ @@ -92,6 +99,31 @@ const SECRETS_MANAGER_TOOL_IDS = [ 'secrets_manager_rotate_secret', ] as const +const SSM_TOOL_IDS = [ + 'ssm_send_command', + 'ssm_list_commands', + 'ssm_list_command_invocations', + 'ssm_get_command_invocation', + 'ssm_cancel_command', + 'ssm_get_parameter', + 'ssm_get_parameters', + 'ssm_get_parameters_by_path', + 'ssm_put_parameter', + 'ssm_delete_parameter', + 'ssm_describe_parameters', + 'ssm_describe_instance_information', + 'ssm_describe_instance_patches', + 'ssm_describe_instance_patch_states', + 'ssm_list_compliance_items', + 'ssm_list_compliance_summaries', + 'ssm_start_automation_execution', + 'ssm_describe_automation_executions', + 'ssm_get_automation_execution', + 'ssm_stop_automation_execution', + 'ssm_list_documents', + 'ssm_get_document', +] as const + const DYNAMODB_TOOL_IDS = [ 'dynamodb_delete', 'dynamodb_get', @@ -124,7 +156,29 @@ const SES_TOOL_IDS = [ 'ses_update_template', ] as const -const SQS_TOOL_IDS = ['sqs_send'] as const +const SQS_TOOL_IDS = [ + 'sqs_send', + 'sqs_send_message_batch', + 'sqs_receive_message', + 'sqs_delete_message', + 'sqs_delete_message_batch', + 'sqs_change_message_visibility', + 'sqs_change_message_visibility_batch', + 'sqs_list_queues', + 'sqs_get_queue_url', + 'sqs_get_queue_attributes', + 'sqs_set_queue_attributes', + 'sqs_create_queue', + 'sqs_delete_queue', + 'sqs_purge_queue', + 'sqs_list_dead_letter_source_queues', + 'sqs_list_queue_tags', + 'sqs_tag_queue', + 'sqs_untag_queue', + 'sqs_start_message_move_task', + 'sqs_list_message_move_tasks', + 'sqs_cancel_message_move_task', +] as const const RDS_TOOL_IDS = [ 'rds_query', @@ -142,6 +196,23 @@ const TEXTRACT_TOOL_IDS = [ 'textract_analyze_id', ] as const +const CLOUDTRAIL_TOOL_IDS = [ + 'cloudtrail_cancel_query', + 'cloudtrail_describe_query', + 'cloudtrail_describe_trails', + 'cloudtrail_get_event_data_store', + 'cloudtrail_get_event_selectors', + 'cloudtrail_get_insight_selectors', + 'cloudtrail_get_query_results', + 'cloudtrail_get_trail', + 'cloudtrail_get_trail_status', + 'cloudtrail_list_event_data_stores', + 'cloudtrail_list_tags', + 'cloudtrail_list_trails', + 'cloudtrail_lookup_events', + 'cloudtrail_start_query', +] as const + const CLOUDWATCH_TOOL_IDS = [ 'cloudwatch_describe_alarm_history', 'cloudwatch_describe_alarms', @@ -1321,6 +1392,9 @@ registerFamily(handlerLoaders, IDENTITY_CENTER_TOOL_IDS, async () => { registerFamily(handlerLoaders, SECRETS_MANAGER_TOOL_IDS, async () => { return (await import('@/lib/internal/secrets-manager/execute-tool')).executeSecretsManagerTool }) +registerFamily(handlerLoaders, SSM_TOOL_IDS, async () => { + return (await import('@/lib/internal/ssm/execute-tool')).executeSsmTool +}) registerFamily(handlerLoaders, DYNAMODB_TOOL_IDS, async () => { return (await import('@/lib/internal/dynamodb/execute-tool')).executeDynamodbTool }) @@ -1339,6 +1413,9 @@ registerFamily(handlerLoaders, TEXTRACT_TOOL_IDS, async () => { registerFamily(handlerLoaders, CLOUDWATCH_TOOL_IDS, async () => { return (await import('@/lib/internal/cloudwatch/execute-tool')).executeCloudwatchTool }) +registerFamily(handlerLoaders, CLOUDTRAIL_TOOL_IDS, async () => { + return (await import('@/lib/internal/cloudtrail/execute-tool')).executeCloudtrailTool +}) registerFamily(handlerLoaders, POSTGRESQL_TOOL_IDS, async () => { return (await import('@/lib/internal/postgresql/execute-tool')).executePostgresqlTool }) diff --git a/apps/sim/package.json b/apps/sim/package.json index 6bd3a5015b6..89753ba2f90 100644 --- a/apps/sim/package.json +++ b/apps/sim/package.json @@ -43,6 +43,7 @@ "@aws-sdk/client-athena": "3.1117.0", "@aws-sdk/client-bedrock-runtime": "3.1117.0", "@aws-sdk/client-cloudformation": "3.1117.0", + "@aws-sdk/client-cloudtrail": "3.1117.0", "@aws-sdk/client-cloudwatch": "3.1117.0", "@aws-sdk/client-cloudwatch-logs": "3.1117.0", "@aws-sdk/client-codepipeline": "3.1117.0", @@ -56,6 +57,7 @@ "@aws-sdk/client-secrets-manager": "3.1117.0", "@aws-sdk/client-sesv2": "3.1117.0", "@aws-sdk/client-sqs": "3.1117.0", + "@aws-sdk/client-ssm": "3.1117.0", "@aws-sdk/client-sso-admin": "3.1117.0", "@aws-sdk/client-sts": "3.1117.0", "@aws-sdk/client-textract": "3.1117.0", diff --git a/apps/sim/tools/cloudtrail/cancel_query.ts b/apps/sim/tools/cloudtrail/cancel_query.ts new file mode 100644 index 00000000000..6c769ac8306 --- /dev/null +++ b/apps/sim/tools/cloudtrail/cancel_query.ts @@ -0,0 +1,93 @@ +import type { + CloudTrailCancelQueryParams, + CloudTrailCancelQueryResponse, +} from '@/tools/cloudtrail/types' +import type { InternalToolConfig } from '@/tools/types' + +export const cancelQueryTool: InternalToolConfig< + CloudTrailCancelQueryParams, + CloudTrailCancelQueryResponse +> = { + id: 'cloudtrail_cancel_query', + name: 'CloudTrail Cancel Query', + description: 'Cancel a running CloudTrail Lake query', + version: '1.0.0', + + params: { + awsRegion: { + type: 'string', + required: true, + visibility: 'user-only', + description: 'AWS region (e.g., us-east-1)', + }, + awsAccessKeyId: { + type: 'string', + required: true, + visibility: 'user-only', + description: 'AWS access key ID', + }, + awsSecretAccessKey: { + type: 'string', + required: true, + visibility: 'user-only', + description: 'AWS secret access key', + }, + queryId: { + type: 'string', + required: true, + visibility: 'user-or-llm', + description: 'ID of the query returned by Start Query', + }, + eventDataStoreOwnerAccountId: { + type: 'string', + required: false, + visibility: 'user-or-llm', + description: 'Account ID of the event data store owner, for a shared event data store', + }, + }, + + operation: { + input: (params) => ({ + region: params.awsRegion, + accessKeyId: params.awsAccessKeyId, + secretAccessKey: params.awsSecretAccessKey, + queryId: params.queryId, + ...(params.eventDataStoreOwnerAccountId && { + eventDataStoreOwnerAccountId: params.eventDataStoreOwnerAccountId, + }), + }), + }, + + transformResponse: async (response: Response) => { + const data = await response.json() + if (!response.ok) { + throw new Error(data.error || 'Failed to cancel CloudTrail Lake query') + } + return { + success: true, + output: { + queryId: data.output.queryId, + queryStatus: data.output.queryStatus ?? null, + eventDataStoreOwnerAccountId: data.output.eventDataStoreOwnerAccountId ?? null, + }, + } + }, + + outputs: { + queryId: { + type: 'string', + description: 'ID of the cancelled query', + }, + queryStatus: { + type: 'string', + description: + 'Status AWS reported for the query after the cancellation request. Cancellation is asynchronous, so this is typically RUNNING or CANCELLED — poll Describe Lake Query for the terminal status', + optional: true, + }, + eventDataStoreOwnerAccountId: { + type: 'string', + description: 'Account ID of the event data store owner, when the query was cross-account', + optional: true, + }, + }, +} diff --git a/apps/sim/tools/cloudtrail/contract-validation.test.ts b/apps/sim/tools/cloudtrail/contract-validation.test.ts new file mode 100644 index 00000000000..d3b9c76004e --- /dev/null +++ b/apps/sim/tools/cloudtrail/contract-validation.test.ts @@ -0,0 +1,181 @@ +/** + * @vitest-environment node + * + * Boundary rules the CloudTrail contracts must enforce before a request reaches AWS: + * positional query parameters may not be silently reshaped, `refreshId` is only meaningful + * alongside `queryAlias`, and a bare trail name is capped at 128 characters even though the + * same field accepts a 256-character ARN. + */ +import { describe, expect, it } from 'vitest' +import type { z } from 'zod' +import { awsCloudtrailDescribeQueryContract } from '@/lib/api/contracts/tools/aws/cloudtrail-describe-query' +import { awsCloudtrailDescribeTrailsContract } from '@/lib/api/contracts/tools/aws/cloudtrail-describe-trails' +import { awsCloudtrailGetEventDataStoreContract } from '@/lib/api/contracts/tools/aws/cloudtrail-get-event-data-store' +import { awsCloudtrailGetInsightSelectorsContract } from '@/lib/api/contracts/tools/aws/cloudtrail-get-insight-selectors' +import { awsCloudtrailGetTrailStatusContract } from '@/lib/api/contracts/tools/aws/cloudtrail-get-trail-status' +import { awsCloudtrailListTrailsContract } from '@/lib/api/contracts/tools/aws/cloudtrail-list-trails' +import { awsCloudtrailStartQueryContract } from '@/lib/api/contracts/tools/aws/cloudtrail-start-query' +import { getEventDataStoreTool } from '@/tools/cloudtrail/get_event_data_store' +import { listTrailsTool } from '@/tools/cloudtrail/list_trails' +import type { OutputProperty } from '@/tools/types' + +const CONNECTION = { + region: 'us-east-1', + accessKeyId: 'AKIAIOSFODNN7EXAMPLE', + secretAccessKey: 'secret', +} + +const QUERY_ID = 'abcdef01-2345-6789-abcd-ef0123456789' +const LONGEST_VALID_NAME = 'a'.repeat(128) +const TOO_LONG_NAME = 'a'.repeat(129) +const LONG_TRAIL_ARN = `arn:aws:cloudtrail:us-east-1:123456789012:trail/${'a'.repeat(100)}` + +describe('cloudtrail start query contract', () => { + it('rejects an empty positional query parameter', () => { + const result = awsCloudtrailStartQueryContract.body.safeParse({ + ...CONNECTION, + queryAlias: 'top-errors', + queryParameters: ['us-east-1', '', '2026-01-01'], + }) + + expect(result.success).toBe(false) + }) + + it('accepts a fully populated positional parameter list', () => { + const result = awsCloudtrailStartQueryContract.body.safeParse({ + ...CONNECTION, + queryAlias: 'top-errors', + queryParameters: ['us-east-1', '2026-01-01'], + }) + + expect(result.success).toBe(true) + }) +}) + +describe('cloudtrail describe query contract', () => { + it('rejects refreshId when the query is addressed by queryId', () => { + const result = awsCloudtrailDescribeQueryContract.body.safeParse({ + ...CONNECTION, + queryId: QUERY_ID, + refreshId: '1234567890', + }) + + expect(result.success).toBe(false) + }) + + it('accepts refreshId alongside queryAlias', () => { + const result = awsCloudtrailDescribeQueryContract.body.safeParse({ + ...CONNECTION, + queryAlias: 'top-errors', + refreshId: '1234567890', + }) + + expect(result.success).toBe(true) + }) + + it('accepts queryId on its own', () => { + const result = awsCloudtrailDescribeQueryContract.body.safeParse({ + ...CONNECTION, + queryId: QUERY_ID, + }) + + expect(result.success).toBe(true) + }) +}) + +describe('cloudtrail trail name bounds', () => { + it('rejects a bare trail name longer than 128 characters on get trail status', () => { + const result = awsCloudtrailGetTrailStatusContract.body.safeParse({ + ...CONNECTION, + name: TOO_LONG_NAME, + }) + + expect(result.success).toBe(false) + }) + + it('accepts a 128-character bare trail name on get trail status', () => { + const result = awsCloudtrailGetTrailStatusContract.body.safeParse({ + ...CONNECTION, + name: LONGEST_VALID_NAME, + }) + + expect(result.success).toBe(true) + }) + + it('accepts a trail ARN longer than 128 characters on get trail status', () => { + const result = awsCloudtrailGetTrailStatusContract.body.safeParse({ + ...CONNECTION, + name: LONG_TRAIL_ARN, + }) + + expect(result.success).toBe(true) + }) + + it('rejects a bare trail name longer than 128 characters on get insight selectors', () => { + const result = awsCloudtrailGetInsightSelectorsContract.body.safeParse({ + ...CONNECTION, + trailName: TOO_LONG_NAME, + }) + + expect(result.success).toBe(false) + }) + + it('accepts a trail ARN longer than 128 characters on get insight selectors', () => { + const result = awsCloudtrailGetInsightSelectorsContract.body.safeParse({ + ...CONNECTION, + trailName: LONG_TRAIL_ARN, + }) + + expect(result.success).toBe(true) + }) + + it('rejects a bare trail name longer than 128 characters inside trailNameList', () => { + const result = awsCloudtrailDescribeTrailsContract.body.safeParse({ + ...CONNECTION, + trailNameList: ['audit-trail', TOO_LONG_NAME], + }) + + expect(result.success).toBe(false) + }) + + it('accepts every trail an account can reach in one describe request', () => { + const result = awsCloudtrailDescribeTrailsContract.body.safeParse({ + ...CONNECTION, + trailNameList: Array.from({ length: 200 }, (_, index) => `audit-trail-${index}`), + }) + + expect(result.success).toBe(true) + }) +}) + +/** Top-level output keys whose contract response schema accepts `null`. */ +function nullableResponseKeys(outputSchema: z.ZodObject): string[] { + return Object.entries(outputSchema.shape) + .filter(([, schema]) => schema.safeParse(null).success) + .map(([key]) => key) + .sort() +} + +/** Top-level output keys the tool's published catalog metadata marks nullable. */ +function nullableCatalogKeys(outputs: Record): string[] { + return Object.entries(outputs) + .filter(([, property]) => property.nullable === true) + .map(([key]) => key) + .sort() +} + +describe('cloudtrail output metadata nullability', () => { + it('matches the list trails response contract', () => { + const outputSchema = awsCloudtrailListTrailsContract.response.schema.shape.output + + expect(nullableCatalogKeys(listTrailsTool.outputs)).toEqual(nullableResponseKeys(outputSchema)) + }) + + it('matches the get event data store response contract', () => { + const outputSchema = awsCloudtrailGetEventDataStoreContract.response.schema.shape.output + + expect(nullableCatalogKeys(getEventDataStoreTool.outputs)).toEqual( + nullableResponseKeys(outputSchema) + ) + }) +}) diff --git a/apps/sim/tools/cloudtrail/describe_query.ts b/apps/sim/tools/cloudtrail/describe_query.ts new file mode 100644 index 00000000000..06f69608462 --- /dev/null +++ b/apps/sim/tools/cloudtrail/describe_query.ts @@ -0,0 +1,168 @@ +import type { + CloudTrailDescribeQueryParams, + CloudTrailDescribeQueryResponse, +} from '@/tools/cloudtrail/types' +import type { InternalToolConfig } from '@/tools/types' + +export const describeQueryTool: InternalToolConfig< + CloudTrailDescribeQueryParams, + CloudTrailDescribeQueryResponse +> = { + id: 'cloudtrail_describe_query', + name: 'CloudTrail Describe Query', + description: 'Check the status, run time, and scan statistics of a CloudTrail Lake query', + version: '1.0.0', + + params: { + awsRegion: { + type: 'string', + required: true, + visibility: 'user-only', + description: 'AWS region (e.g., us-east-1)', + }, + awsAccessKeyId: { + type: 'string', + required: true, + visibility: 'user-only', + description: 'AWS access key ID', + }, + awsSecretAccessKey: { + type: 'string', + required: true, + visibility: 'user-only', + description: 'AWS secret access key', + }, + queryId: { + type: 'string', + required: false, + visibility: 'user-or-llm', + description: 'ID of the query returned by Start Query. Supply this or queryAlias, not both', + }, + queryAlias: { + type: 'string', + required: false, + visibility: 'user-or-llm', + description: + 'Query template alias; returns the last run for that alias. Supply this or queryId, not both', + }, + refreshId: { + type: 'string', + required: false, + visibility: 'user-or-llm', + description: 'Dashboard refresh ID, used together with queryAlias', + }, + eventDataStoreOwnerAccountId: { + type: 'string', + required: false, + visibility: 'user-or-llm', + description: 'Account ID of the event data store owner, for a shared event data store', + }, + }, + + operation: { + input: (params) => ({ + region: params.awsRegion, + accessKeyId: params.awsAccessKeyId, + secretAccessKey: params.awsSecretAccessKey, + ...(params.queryId && { queryId: params.queryId }), + ...(params.queryAlias && { queryAlias: params.queryAlias }), + ...(params.refreshId && { refreshId: params.refreshId }), + ...(params.eventDataStoreOwnerAccountId && { + eventDataStoreOwnerAccountId: params.eventDataStoreOwnerAccountId, + }), + }), + }, + + transformResponse: async (response: Response) => { + const data = await response.json() + if (!response.ok) { + throw new Error(data.error || 'Failed to describe CloudTrail Lake query') + } + return { + success: true, + output: { + queryId: data.output.queryId ?? null, + queryString: data.output.queryString ?? null, + queryStatus: data.output.queryStatus ?? null, + errorMessage: data.output.errorMessage ?? null, + deliveryS3Uri: data.output.deliveryS3Uri ?? null, + deliveryStatus: data.output.deliveryStatus ?? null, + prompt: data.output.prompt ?? null, + eventDataStoreOwnerAccountId: data.output.eventDataStoreOwnerAccountId ?? null, + eventsMatched: data.output.eventsMatched ?? null, + eventsScanned: data.output.eventsScanned ?? null, + bytesScanned: data.output.bytesScanned ?? null, + executionTimeInMillis: data.output.executionTimeInMillis ?? null, + creationTime: data.output.creationTime ?? null, + }, + } + }, + + outputs: { + queryId: { + type: 'string', + description: 'ID of the query', + optional: true, + }, + queryString: { + type: 'string', + description: 'SQL body of the query', + optional: true, + }, + queryStatus: { + type: 'string', + description: 'QUEUED, RUNNING, FINISHED, FAILED, CANCELLED, or TIMED_OUT', + optional: true, + }, + errorMessage: { + type: 'string', + description: 'Error message returned if the query failed', + optional: true, + }, + deliveryS3Uri: { + type: 'string', + description: 'S3 URI the results were delivered to, if configured', + optional: true, + }, + deliveryStatus: { + type: 'string', + description: 'Delivery status of the S3 results (SUCCESS, FAILED, PENDING, and similar)', + optional: true, + }, + prompt: { + type: 'string', + description: 'Natural-language prompt used to generate the query, if it was generated', + optional: true, + }, + eventDataStoreOwnerAccountId: { + type: 'string', + description: 'Account ID of the event data store owner', + optional: true, + }, + eventsMatched: { + type: 'number', + description: 'Number of events that matched the query', + optional: true, + }, + eventsScanned: { + type: 'number', + description: 'Number of events scanned by the query', + optional: true, + }, + bytesScanned: { + type: 'number', + description: 'Bytes scanned by the query', + optional: true, + }, + executionTimeInMillis: { + type: 'number', + description: 'Query run time in milliseconds', + optional: true, + }, + creationTime: { + type: 'string', + description: 'When the query was created (ISO 8601)', + optional: true, + }, + }, +} diff --git a/apps/sim/tools/cloudtrail/describe_trails.ts b/apps/sim/tools/cloudtrail/describe_trails.ts new file mode 100644 index 00000000000..b703b652848 --- /dev/null +++ b/apps/sim/tools/cloudtrail/describe_trails.ts @@ -0,0 +1,134 @@ +import type { + CloudTrailDescribeTrailsParams, + CloudTrailDescribeTrailsResponse, +} from '@/tools/cloudtrail/types' +import type { InternalToolConfig } from '@/tools/types' + +export const describeTrailsTool: InternalToolConfig< + CloudTrailDescribeTrailsParams, + CloudTrailDescribeTrailsResponse +> = { + id: 'cloudtrail_describe_trails', + name: 'CloudTrail Describe Trails', + description: + 'Retrieve the full configuration of one or more CloudTrail trails in the current Region', + version: '1.0.0', + + params: { + awsRegion: { + type: 'string', + required: true, + visibility: 'user-only', + description: 'AWS region (e.g., us-east-1)', + }, + awsAccessKeyId: { + type: 'string', + required: true, + visibility: 'user-only', + description: 'AWS access key ID', + }, + awsSecretAccessKey: { + type: 'string', + required: true, + visibility: 'user-only', + description: 'AWS secret access key', + }, + trailNameList: { + type: 'string', + required: false, + visibility: 'user-or-llm', + description: + 'Comma-separated trail names or ARNs. Leave empty to describe every trail in the Region. Trails in another Region must be given as ARNs', + }, + includeShadowTrails: { + type: 'boolean', + required: false, + visibility: 'user-or-llm', + description: + 'Include shadow trails (replications of trails created in another Region, and organization trails in member accounts). Defaults to true', + }, + }, + + operation: { + input: (params) => { + const trailNameList = (params.trailNameList ?? '') + .split(',') + .map((name) => name.trim()) + .filter(Boolean) + return { + region: params.awsRegion, + accessKeyId: params.awsAccessKeyId, + secretAccessKey: params.awsSecretAccessKey, + ...(trailNameList.length > 0 && { trailNameList }), + ...(params.includeShadowTrails !== undefined && { + includeShadowTrails: params.includeShadowTrails, + }), + } + }, + }, + + transformResponse: async (response: Response) => { + const data = await response.json() + if (!response.ok) { + throw new Error(data.error || 'Failed to describe CloudTrail trails') + } + return { + success: true, + output: { + trails: data.output.trails ?? [], + }, + } + }, + + outputs: { + trails: { + type: 'array', + description: 'Full configuration of each matching trail', + items: { + type: 'object', + properties: { + name: { type: 'string', description: 'Trail name' }, + s3BucketName: { type: 'string', description: 'S3 bucket that receives log files' }, + s3KeyPrefix: { type: 'string', description: 'S3 key prefix for delivered log files' }, + snsTopicName: { type: 'string', description: 'SNS topic notified on log delivery' }, + snsTopicArn: { type: 'string', description: 'ARN of that SNS topic' }, + includeGlobalServiceEvents: { + type: 'boolean', + description: 'Whether global service events are recorded', + }, + isMultiRegionTrail: { + type: 'boolean', + description: 'Whether the trail records events in all Regions', + }, + homeRegion: { type: 'string', description: 'Region in which the trail was created' }, + trailArn: { type: 'string', description: 'ARN of the trail' }, + logFileValidationEnabled: { + type: 'boolean', + description: 'Whether log file integrity validation is enabled', + }, + cloudWatchLogsLogGroupArn: { + type: 'string', + description: 'CloudWatch Logs log group receiving events', + }, + cloudWatchLogsRoleArn: { + type: 'string', + description: 'Role CloudTrail assumes to write to CloudWatch Logs', + }, + kmsKeyId: { type: 'string', description: 'KMS key used to encrypt log files' }, + hasCustomEventSelectors: { + type: 'boolean', + description: 'Whether the trail has custom event selectors', + }, + hasInsightSelectors: { + type: 'boolean', + description: 'Whether the trail has Insights event selectors', + }, + isOrganizationTrail: { + type: 'boolean', + description: 'Whether the trail is an organization trail', + }, + }, + }, + }, + }, +} diff --git a/apps/sim/tools/cloudtrail/get_event_data_store.ts b/apps/sim/tools/cloudtrail/get_event_data_store.ts new file mode 100644 index 00000000000..3a9c094be2c --- /dev/null +++ b/apps/sim/tools/cloudtrail/get_event_data_store.ts @@ -0,0 +1,160 @@ +import type { + CloudTrailGetEventDataStoreParams, + CloudTrailGetEventDataStoreResponse, +} from '@/tools/cloudtrail/types' +import type { InternalToolConfig } from '@/tools/types' + +export const getEventDataStoreTool: InternalToolConfig< + CloudTrailGetEventDataStoreParams, + CloudTrailGetEventDataStoreResponse +> = { + id: 'cloudtrail_get_event_data_store', + name: 'CloudTrail Get Event Data Store', + description: 'Retrieve the configuration of a single CloudTrail Lake event data store', + version: '1.0.0', + + params: { + awsRegion: { + type: 'string', + required: true, + visibility: 'user-only', + description: 'AWS region (e.g., us-east-1)', + }, + awsAccessKeyId: { + type: 'string', + required: true, + visibility: 'user-only', + description: 'AWS access key ID', + }, + awsSecretAccessKey: { + type: 'string', + required: true, + visibility: 'user-only', + description: 'AWS secret access key', + }, + eventDataStore: { + type: 'string', + required: true, + visibility: 'user-or-llm', + description: 'Event data store ARN, or the ID suffix of that ARN', + }, + }, + + operation: { + input: (params) => ({ + region: params.awsRegion, + accessKeyId: params.awsAccessKeyId, + secretAccessKey: params.awsSecretAccessKey, + eventDataStore: params.eventDataStore, + }), + }, + + transformResponse: async (response: Response) => { + const data = await response.json() + if (!response.ok) { + throw new Error(data.error || 'Failed to get CloudTrail event data store') + } + return { + success: true, + output: data.output, + } + }, + + outputs: { + eventDataStoreArn: { + type: 'string', + description: 'ARN of the event data store', + nullable: true, + }, + name: { + type: 'string', + description: 'Name of the event data store', + nullable: true, + }, + status: { + type: 'string', + description: 'CREATED, ENABLED, PENDING_DELETION, or an ingestion state', + nullable: true, + }, + advancedEventSelectors: { + type: 'array', + description: 'Advanced event selectors that define what the store ingests', + items: { + type: 'object', + properties: { + name: { + type: 'string', + description: 'Name of the advanced event selector', + nullable: true, + }, + fieldSelectors: { + type: 'array', + description: + 'Field selectors, each with field plus its equals, startsWith, endsWith, notEquals, notStartsWith, and notEndsWith values', + }, + }, + }, + }, + multiRegionEnabled: { + type: 'boolean', + description: 'Whether the store collects events from all Regions', + nullable: true, + }, + organizationEnabled: { + type: 'boolean', + description: 'Whether the store collects events for the organization', + nullable: true, + }, + retentionPeriod: { + type: 'number', + description: 'Retention period in days', + nullable: true, + }, + terminationProtectionEnabled: { + type: 'boolean', + description: 'Whether termination protection is enabled', + nullable: true, + }, + createdTimestamp: { + type: 'string', + description: 'When the store was created (ISO 8601)', + nullable: true, + }, + updatedTimestamp: { + type: 'string', + description: 'When the store was last updated (ISO 8601)', + nullable: true, + }, + kmsKeyId: { + type: 'string', + description: 'KMS key used to encrypt the store', + nullable: true, + }, + billingMode: { + type: 'string', + description: 'EXTENDABLE_RETENTION_PRICING or FIXED_RETENTION_PRICING', + nullable: true, + }, + federationStatus: { + type: 'string', + description: 'Lake Formation federation status', + nullable: true, + }, + federationRoleArn: { + type: 'string', + description: 'ARN of the role used for Lake Formation federation', + nullable: true, + }, + partitionKeys: { + type: 'array', + description: 'Partition keys of the event data store', + items: { + type: 'object', + properties: { + name: { type: 'string', description: 'Partition key name' }, + type: { type: 'string', description: 'Partition key data type' }, + }, + }, + }, + }, +} diff --git a/apps/sim/tools/cloudtrail/get_event_selectors.ts b/apps/sim/tools/cloudtrail/get_event_selectors.ts new file mode 100644 index 00000000000..bd76a403c86 --- /dev/null +++ b/apps/sim/tools/cloudtrail/get_event_selectors.ts @@ -0,0 +1,115 @@ +import type { + CloudTrailGetEventSelectorsParams, + CloudTrailGetEventSelectorsResponse, +} from '@/tools/cloudtrail/types' +import type { InternalToolConfig } from '@/tools/types' + +export const getEventSelectorsTool: InternalToolConfig< + CloudTrailGetEventSelectorsParams, + CloudTrailGetEventSelectorsResponse +> = { + id: 'cloudtrail_get_event_selectors', + name: 'CloudTrail Get Event Selectors', + description: + 'Read which management, data, and network activity events a CloudTrail trail is configured to log', + version: '1.0.0', + + params: { + awsRegion: { + type: 'string', + required: true, + visibility: 'user-only', + description: 'AWS region (e.g., us-east-1)', + }, + awsAccessKeyId: { + type: 'string', + required: true, + visibility: 'user-only', + description: 'AWS access key ID', + }, + awsSecretAccessKey: { + type: 'string', + required: true, + visibility: 'user-only', + description: 'AWS secret access key', + }, + trailName: { + type: 'string', + required: true, + visibility: 'user-or-llm', + description: 'Trail name or trail ARN', + }, + }, + + operation: { + input: (params) => ({ + region: params.awsRegion, + accessKeyId: params.awsAccessKeyId, + secretAccessKey: params.awsSecretAccessKey, + trailName: params.trailName, + }), + }, + + transformResponse: async (response: Response) => { + const data = await response.json() + if (!response.ok) { + throw new Error(data.error || 'Failed to get CloudTrail event selectors') + } + return { + success: true, + output: { + trailArn: data.output.trailArn ?? null, + eventSelectors: data.output.eventSelectors ?? [], + advancedEventSelectors: data.output.advancedEventSelectors ?? [], + }, + } + }, + + outputs: { + trailArn: { + type: 'string', + description: 'ARN of the trail that owns these selectors', + optional: true, + }, + eventSelectors: { + type: 'array', + description: 'Basic event selectors configured on the trail', + items: { + type: 'object', + properties: { + readWriteType: { + type: 'string', + description: 'All, ReadOnly, or WriteOnly', + }, + includeManagementEvents: { + type: 'boolean', + description: 'Whether management events are recorded', + }, + dataResources: { + type: 'array', + description: 'Data resources logged by the selector, as type and values', + }, + excludeManagementEventSources: { + type: 'array', + description: 'Event sources excluded from management event logging', + }, + }, + }, + }, + advancedEventSelectors: { + type: 'array', + description: 'Advanced event selectors configured on the trail', + items: { + type: 'object', + properties: { + name: { type: 'string', description: 'Name of the advanced event selector' }, + fieldSelectors: { + type: 'array', + description: + 'Field selectors, each with field plus its equals, startsWith, endsWith, notEquals, notStartsWith, and notEndsWith values', + }, + }, + }, + }, + }, +} diff --git a/apps/sim/tools/cloudtrail/get_insight_selectors.ts b/apps/sim/tools/cloudtrail/get_insight_selectors.ts new file mode 100644 index 00000000000..8a25671e8c2 --- /dev/null +++ b/apps/sim/tools/cloudtrail/get_insight_selectors.ts @@ -0,0 +1,110 @@ +import type { + CloudTrailGetInsightSelectorsParams, + CloudTrailGetInsightSelectorsResponse, +} from '@/tools/cloudtrail/types' +import type { InternalToolConfig } from '@/tools/types' + +export const getInsightSelectorsTool: InternalToolConfig< + CloudTrailGetInsightSelectorsParams, + CloudTrailGetInsightSelectorsResponse +> = { + id: 'cloudtrail_get_insight_selectors', + name: 'CloudTrail Get Insight Selectors', + description: 'Read which CloudTrail Insights types are enabled on a trail or event data store', + version: '1.0.0', + + params: { + awsRegion: { + type: 'string', + required: true, + visibility: 'user-only', + description: 'AWS region (e.g., us-east-1)', + }, + awsAccessKeyId: { + type: 'string', + required: true, + visibility: 'user-only', + description: 'AWS access key ID', + }, + awsSecretAccessKey: { + type: 'string', + required: true, + visibility: 'user-only', + description: 'AWS secret access key', + }, + trailName: { + type: 'string', + required: false, + visibility: 'user-or-llm', + description: 'Trail name or trail ARN. Cannot be combined with eventDataStore', + }, + eventDataStore: { + type: 'string', + required: false, + visibility: 'user-or-llm', + description: + 'Event data store ARN, or the ID suffix of that ARN. Cannot be combined with trailName', + }, + }, + + operation: { + input: (params) => ({ + region: params.awsRegion, + accessKeyId: params.awsAccessKeyId, + secretAccessKey: params.awsSecretAccessKey, + ...(params.trailName && { trailName: params.trailName }), + ...(params.eventDataStore && { eventDataStore: params.eventDataStore }), + }), + }, + + transformResponse: async (response: Response) => { + const data = await response.json() + if (!response.ok) { + throw new Error(data.error || 'Failed to get CloudTrail Insights selectors') + } + return { + success: true, + output: { + trailArn: data.output.trailArn ?? null, + eventDataStoreArn: data.output.eventDataStoreArn ?? null, + insightsDestination: data.output.insightsDestination ?? null, + insightSelectors: data.output.insightSelectors ?? [], + }, + } + }, + + outputs: { + trailArn: { + type: 'string', + description: 'ARN of the trail whose Insights selectors were read', + optional: true, + }, + eventDataStoreArn: { + type: 'string', + description: 'ARN of the source event data store that enabled Insights events', + optional: true, + }, + insightsDestination: { + type: 'string', + description: 'ARN of the destination event data store that logs Insights events', + optional: true, + }, + insightSelectors: { + type: 'array', + description: 'Enabled Insights types and their event categories', + items: { + type: 'object', + properties: { + insightType: { + type: 'string', + description: 'ApiCallRateInsight or ApiErrorRateInsight', + }, + eventCategories: { + type: 'array', + description: 'Event categories the Insights type applies to: Management, Data, or both', + }, + }, + }, + }, + }, +} diff --git a/apps/sim/tools/cloudtrail/get_query_results.ts b/apps/sim/tools/cloudtrail/get_query_results.ts new file mode 100644 index 00000000000..8e4299cf0b5 --- /dev/null +++ b/apps/sim/tools/cloudtrail/get_query_results.ts @@ -0,0 +1,132 @@ +import type { + CloudTrailGetQueryResultsParams, + CloudTrailGetQueryResultsResponse, +} from '@/tools/cloudtrail/types' +import type { InternalToolConfig } from '@/tools/types' + +export const getQueryResultsTool: InternalToolConfig< + CloudTrailGetQueryResultsParams, + CloudTrailGetQueryResultsResponse +> = { + id: 'cloudtrail_get_query_results', + name: 'CloudTrail Get Query Results', + description: 'Fetch a page of result rows from a finished CloudTrail Lake query', + version: '1.0.0', + + params: { + awsRegion: { + type: 'string', + required: true, + visibility: 'user-only', + description: 'AWS region (e.g., us-east-1)', + }, + awsAccessKeyId: { + type: 'string', + required: true, + visibility: 'user-only', + description: 'AWS access key ID', + }, + awsSecretAccessKey: { + type: 'string', + required: true, + visibility: 'user-only', + description: 'AWS secret access key', + }, + queryId: { + type: 'string', + required: true, + visibility: 'user-or-llm', + description: 'ID of the query returned by Start Query', + }, + maxQueryResults: { + type: 'number', + required: false, + visibility: 'user-or-llm', + description: 'Maximum rows to return on a single page, 1 to 1000', + }, + nextToken: { + type: 'string', + required: false, + visibility: 'user-or-llm', + description: 'Pagination token from a previous results request', + }, + eventDataStoreOwnerAccountId: { + type: 'string', + required: false, + visibility: 'user-or-llm', + description: 'Account ID of the event data store owner, for a shared event data store', + }, + }, + + operation: { + input: (params) => ({ + region: params.awsRegion, + accessKeyId: params.awsAccessKeyId, + secretAccessKey: params.awsSecretAccessKey, + queryId: params.queryId, + ...(params.maxQueryResults !== undefined && { maxQueryResults: params.maxQueryResults }), + ...(params.nextToken && { nextToken: params.nextToken }), + ...(params.eventDataStoreOwnerAccountId && { + eventDataStoreOwnerAccountId: params.eventDataStoreOwnerAccountId, + }), + }), + }, + + transformResponse: async (response: Response) => { + const data = await response.json() + if (!response.ok) { + throw new Error(data.error || 'Failed to get CloudTrail Lake query results') + } + return { + success: true, + output: { + queryStatus: data.output.queryStatus ?? null, + rows: data.output.rows ?? [], + resultsCount: data.output.resultsCount ?? null, + totalResultsCount: data.output.totalResultsCount ?? null, + bytesScanned: data.output.bytesScanned ?? null, + errorMessage: data.output.errorMessage ?? null, + nextToken: data.output.nextToken ?? null, + }, + } + }, + + outputs: { + queryStatus: { + type: 'string', + description: 'QUEUED, RUNNING, FINISHED, FAILED, CANCELLED, or TIMED_OUT', + optional: true, + }, + rows: { + type: 'array', + description: + 'Result rows, each flattened into a single object keyed by the query column names', + items: { type: 'object' }, + }, + resultsCount: { + type: 'number', + description: 'Number of rows on this page', + optional: true, + }, + totalResultsCount: { + type: 'number', + description: 'Total number of rows the query produced', + optional: true, + }, + bytesScanned: { + type: 'number', + description: 'Bytes scanned by the query', + optional: true, + }, + errorMessage: { + type: 'string', + description: 'Error message returned if the query failed', + optional: true, + }, + nextToken: { + type: 'string', + description: 'Pagination token for the next page of rows', + optional: true, + }, + }, +} diff --git a/apps/sim/tools/cloudtrail/get_trail.ts b/apps/sim/tools/cloudtrail/get_trail.ts new file mode 100644 index 00000000000..6acc69a3a83 --- /dev/null +++ b/apps/sim/tools/cloudtrail/get_trail.ts @@ -0,0 +1,141 @@ +import type { CloudTrailGetTrailParams, CloudTrailGetTrailResponse } from '@/tools/cloudtrail/types' +import type { InternalToolConfig } from '@/tools/types' + +export const getTrailTool: InternalToolConfig< + CloudTrailGetTrailParams, + CloudTrailGetTrailResponse +> = { + id: 'cloudtrail_get_trail', + name: 'CloudTrail Get Trail', + description: 'Retrieve the settings of a single CloudTrail trail by name or ARN', + version: '1.0.0', + + params: { + awsRegion: { + type: 'string', + required: true, + visibility: 'user-only', + description: 'AWS region (e.g., us-east-1)', + }, + awsAccessKeyId: { + type: 'string', + required: true, + visibility: 'user-only', + description: 'AWS access key ID', + }, + awsSecretAccessKey: { + type: 'string', + required: true, + visibility: 'user-only', + description: 'AWS secret access key', + }, + name: { + type: 'string', + required: true, + visibility: 'user-or-llm', + description: 'Trail name, or the trail ARN for a trail in another Region', + }, + }, + + operation: { + input: (params) => ({ + region: params.awsRegion, + accessKeyId: params.awsAccessKeyId, + secretAccessKey: params.awsSecretAccessKey, + name: params.name, + }), + }, + + transformResponse: async (response: Response) => { + const data = await response.json() + if (!response.ok) { + throw new Error(data.error || 'Failed to get CloudTrail trail') + } + return { + success: true, + output: data.output, + } + }, + + outputs: { + name: { + type: 'string', + description: 'Trail name', + }, + s3BucketName: { + type: 'string', + description: 'Name of the S3 bucket that receives log files', + optional: true, + }, + s3KeyPrefix: { + type: 'string', + description: 'S3 key prefix prepended to delivered log files', + optional: true, + }, + snsTopicName: { + type: 'string', + description: 'Name of the SNS topic notified on log delivery', + optional: true, + }, + snsTopicArn: { + type: 'string', + description: 'ARN of the SNS topic notified on log delivery', + optional: true, + }, + includeGlobalServiceEvents: { + type: 'boolean', + description: 'Whether the trail records global service events', + optional: true, + }, + isMultiRegionTrail: { + type: 'boolean', + description: 'Whether the trail records events in all Regions', + optional: true, + }, + homeRegion: { + type: 'string', + description: 'Region in which the trail was created', + optional: true, + }, + trailArn: { + type: 'string', + description: 'ARN of the trail', + optional: true, + }, + logFileValidationEnabled: { + type: 'boolean', + description: 'Whether log file integrity validation is enabled', + optional: true, + }, + cloudWatchLogsLogGroupArn: { + type: 'string', + description: 'ARN of the CloudWatch Logs log group receiving events', + optional: true, + }, + cloudWatchLogsRoleArn: { + type: 'string', + description: 'ARN of the role CloudTrail assumes to write to CloudWatch Logs', + optional: true, + }, + kmsKeyId: { + type: 'string', + description: 'KMS key used to encrypt log files', + optional: true, + }, + hasCustomEventSelectors: { + type: 'boolean', + description: 'Whether the trail has custom event selectors', + optional: true, + }, + hasInsightSelectors: { + type: 'boolean', + description: 'Whether the trail has Insights event selectors', + optional: true, + }, + isOrganizationTrail: { + type: 'boolean', + description: 'Whether the trail is an organization trail', + optional: true, + }, + }, +} diff --git a/apps/sim/tools/cloudtrail/get_trail_status.ts b/apps/sim/tools/cloudtrail/get_trail_status.ts new file mode 100644 index 00000000000..d2dac5e5ce4 --- /dev/null +++ b/apps/sim/tools/cloudtrail/get_trail_status.ts @@ -0,0 +1,133 @@ +import type { + CloudTrailGetTrailStatusParams, + CloudTrailGetTrailStatusResponse, +} from '@/tools/cloudtrail/types' +import type { InternalToolConfig } from '@/tools/types' + +export const getTrailStatusTool: InternalToolConfig< + CloudTrailGetTrailStatusParams, + CloudTrailGetTrailStatusResponse +> = { + id: 'cloudtrail_get_trail_status', + name: 'CloudTrail Get Trail Status', + description: + 'Check whether a CloudTrail trail is logging and surface its most recent delivery errors', + version: '1.0.0', + + params: { + awsRegion: { + type: 'string', + required: true, + visibility: 'user-only', + description: 'AWS region (e.g., us-east-1)', + }, + awsAccessKeyId: { + type: 'string', + required: true, + visibility: 'user-only', + description: 'AWS access key ID', + }, + awsSecretAccessKey: { + type: 'string', + required: true, + visibility: 'user-only', + description: 'AWS secret access key', + }, + name: { + type: 'string', + required: true, + visibility: 'user-or-llm', + description: + 'Trail name, or the trail ARN. An organization trail read from a member account must be given as an ARN', + }, + }, + + operation: { + input: (params) => ({ + region: params.awsRegion, + accessKeyId: params.awsAccessKeyId, + secretAccessKey: params.awsSecretAccessKey, + name: params.name, + }), + }, + + transformResponse: async (response: Response) => { + const data = await response.json() + if (!response.ok) { + throw new Error(data.error || 'Failed to get CloudTrail trail status') + } + return { + success: true, + output: { + isLogging: data.output.isLogging ?? null, + latestDeliveryError: data.output.latestDeliveryError ?? null, + latestDeliveryTime: data.output.latestDeliveryTime ?? null, + latestNotificationError: data.output.latestNotificationError ?? null, + latestNotificationTime: data.output.latestNotificationTime ?? null, + latestCloudWatchLogsDeliveryError: data.output.latestCloudWatchLogsDeliveryError ?? null, + latestCloudWatchLogsDeliveryTime: data.output.latestCloudWatchLogsDeliveryTime ?? null, + latestDigestDeliveryError: data.output.latestDigestDeliveryError ?? null, + latestDigestDeliveryTime: data.output.latestDigestDeliveryTime ?? null, + startLoggingTime: data.output.startLoggingTime ?? null, + stopLoggingTime: data.output.stopLoggingTime ?? null, + }, + } + }, + + outputs: { + isLogging: { + type: 'boolean', + description: 'Whether the trail is currently recording API calls', + }, + latestDeliveryError: { + type: 'string', + description: 'Most recent S3 error encountered delivering log files', + optional: true, + }, + latestDeliveryTime: { + type: 'string', + description: 'When log files were last delivered to S3 (ISO 8601)', + optional: true, + }, + latestNotificationError: { + type: 'string', + description: 'Most recent SNS error encountered sending a notification', + optional: true, + }, + latestNotificationTime: { + type: 'string', + description: 'When the last SNS notification was sent (ISO 8601)', + optional: true, + }, + latestCloudWatchLogsDeliveryError: { + type: 'string', + description: 'Most recent CloudWatch Logs delivery error', + optional: true, + }, + latestCloudWatchLogsDeliveryTime: { + type: 'string', + description: 'When events were last delivered to CloudWatch Logs (ISO 8601)', + optional: true, + }, + latestDigestDeliveryError: { + type: 'string', + description: 'Most recent S3 error encountered delivering a digest file', + optional: true, + }, + latestDigestDeliveryTime: { + type: 'string', + description: 'When a digest file was last delivered to S3 (ISO 8601)', + optional: true, + }, + startLoggingTime: { + type: 'string', + description: 'When logging was most recently started (ISO 8601)', + optional: true, + }, + stopLoggingTime: { + type: 'string', + description: 'When logging was most recently stopped (ISO 8601)', + optional: true, + }, + }, +} diff --git a/apps/sim/tools/cloudtrail/index.ts b/apps/sim/tools/cloudtrail/index.ts new file mode 100644 index 00000000000..322f3c09024 --- /dev/null +++ b/apps/sim/tools/cloudtrail/index.ts @@ -0,0 +1,31 @@ +import { cancelQueryTool } from '@/tools/cloudtrail/cancel_query' +import { describeQueryTool } from '@/tools/cloudtrail/describe_query' +import { describeTrailsTool } from '@/tools/cloudtrail/describe_trails' +import { getEventDataStoreTool } from '@/tools/cloudtrail/get_event_data_store' +import { getEventSelectorsTool } from '@/tools/cloudtrail/get_event_selectors' +import { getInsightSelectorsTool } from '@/tools/cloudtrail/get_insight_selectors' +import { getQueryResultsTool } from '@/tools/cloudtrail/get_query_results' +import { getTrailTool } from '@/tools/cloudtrail/get_trail' +import { getTrailStatusTool } from '@/tools/cloudtrail/get_trail_status' +import { listEventDataStoresTool } from '@/tools/cloudtrail/list_event_data_stores' +import { listTagsTool } from '@/tools/cloudtrail/list_tags' +import { listTrailsTool } from '@/tools/cloudtrail/list_trails' +import { lookupEventsTool } from '@/tools/cloudtrail/lookup_events' +import { startQueryTool } from '@/tools/cloudtrail/start_query' + +export const cloudtrailCancelQueryTool = cancelQueryTool +export const cloudtrailDescribeQueryTool = describeQueryTool +export const cloudtrailDescribeTrailsTool = describeTrailsTool +export const cloudtrailGetEventDataStoreTool = getEventDataStoreTool +export const cloudtrailGetEventSelectorsTool = getEventSelectorsTool +export const cloudtrailGetInsightSelectorsTool = getInsightSelectorsTool +export const cloudtrailGetQueryResultsTool = getQueryResultsTool +export const cloudtrailGetTrailStatusTool = getTrailStatusTool +export const cloudtrailGetTrailTool = getTrailTool +export const cloudtrailListEventDataStoresTool = listEventDataStoresTool +export const cloudtrailListTagsTool = listTagsTool +export const cloudtrailListTrailsTool = listTrailsTool +export const cloudtrailLookupEventsTool = lookupEventsTool +export const cloudtrailStartQueryTool = startQueryTool + +export * from '@/tools/cloudtrail/types' diff --git a/apps/sim/tools/cloudtrail/list_event_data_stores.ts b/apps/sim/tools/cloudtrail/list_event_data_stores.ts new file mode 100644 index 00000000000..4a44aad9fe9 --- /dev/null +++ b/apps/sim/tools/cloudtrail/list_event_data_stores.ts @@ -0,0 +1,120 @@ +import type { + CloudTrailListEventDataStoresParams, + CloudTrailListEventDataStoresResponse, +} from '@/tools/cloudtrail/types' +import type { InternalToolConfig } from '@/tools/types' + +export const listEventDataStoresTool: InternalToolConfig< + CloudTrailListEventDataStoresParams, + CloudTrailListEventDataStoresResponse +> = { + id: 'cloudtrail_list_event_data_stores', + name: 'CloudTrail List Event Data Stores', + description: 'List the CloudTrail Lake event data stores in the account for the current Region', + version: '1.0.0', + + params: { + awsRegion: { + type: 'string', + required: true, + visibility: 'user-only', + description: 'AWS region (e.g., us-east-1)', + }, + awsAccessKeyId: { + type: 'string', + required: true, + visibility: 'user-only', + description: 'AWS access key ID', + }, + awsSecretAccessKey: { + type: 'string', + required: true, + visibility: 'user-only', + description: 'AWS secret access key', + }, + maxResults: { + type: 'number', + required: false, + visibility: 'user-or-llm', + description: 'Maximum event data stores to return on a single page, 1 to 1000', + }, + nextToken: { + type: 'string', + required: false, + visibility: 'user-or-llm', + description: 'Pagination token from a previous list request', + }, + }, + + operation: { + input: (params) => ({ + region: params.awsRegion, + accessKeyId: params.awsAccessKeyId, + secretAccessKey: params.awsSecretAccessKey, + ...(params.maxResults !== undefined && { maxResults: params.maxResults }), + ...(params.nextToken && { nextToken: params.nextToken }), + }), + }, + + transformResponse: async (response: Response) => { + const data = await response.json() + if (!response.ok) { + throw new Error(data.error || 'Failed to list CloudTrail event data stores') + } + return { + success: true, + output: { + eventDataStores: data.output.eventDataStores ?? [], + nextToken: data.output.nextToken ?? null, + }, + } + }, + + outputs: { + eventDataStores: { + type: 'array', + description: 'Event data stores in the account for the current Region', + items: { + type: 'object', + properties: { + eventDataStoreArn: { type: 'string', description: 'ARN of the event data store' }, + name: { type: 'string', description: 'Name of the event data store' }, + status: { + type: 'string', + description: 'CREATED, ENABLED, PENDING_DELETION, or an ingestion state', + }, + advancedEventSelectors: { + type: 'array', + description: 'Advanced event selectors that define what the store ingests', + }, + multiRegionEnabled: { + type: 'boolean', + description: 'Whether the store collects events from all Regions', + }, + organizationEnabled: { + type: 'boolean', + description: 'Whether the store collects events for the organization', + }, + retentionPeriod: { type: 'number', description: 'Retention period in days' }, + terminationProtectionEnabled: { + type: 'boolean', + description: 'Whether termination protection is enabled', + }, + createdTimestamp: { + type: 'string', + description: 'When the store was created (ISO 8601)', + }, + updatedTimestamp: { + type: 'string', + description: 'When the store was last updated (ISO 8601)', + }, + }, + }, + }, + nextToken: { + type: 'string', + description: 'Pagination token for the next page of event data stores', + optional: true, + }, + }, +} diff --git a/apps/sim/tools/cloudtrail/list_tags.ts b/apps/sim/tools/cloudtrail/list_tags.ts new file mode 100644 index 00000000000..f71424bf0b2 --- /dev/null +++ b/apps/sim/tools/cloudtrail/list_tags.ts @@ -0,0 +1,94 @@ +import type { CloudTrailListTagsParams, CloudTrailListTagsResponse } from '@/tools/cloudtrail/types' +import type { InternalToolConfig } from '@/tools/types' + +export const listTagsTool: InternalToolConfig< + CloudTrailListTagsParams, + CloudTrailListTagsResponse +> = { + id: 'cloudtrail_list_tags', + name: 'CloudTrail List Tags', + description: 'List the tags on CloudTrail trails, event data stores, dashboards, or channels', + version: '1.0.0', + + params: { + awsRegion: { + type: 'string', + required: true, + visibility: 'user-only', + description: 'AWS region (e.g., us-east-1)', + }, + awsAccessKeyId: { + type: 'string', + required: true, + visibility: 'user-only', + description: 'AWS access key ID', + }, + awsSecretAccessKey: { + type: 'string', + required: true, + visibility: 'user-only', + description: 'AWS secret access key', + }, + resourceIdList: { + type: 'string', + required: true, + visibility: 'user-or-llm', + description: 'Comma-separated CloudTrail resource ARNs, up to 20', + }, + nextToken: { + type: 'string', + required: false, + visibility: 'user-or-llm', + description: 'Reserved for future use by AWS', + }, + }, + + operation: { + input: (params) => { + const resourceIdList = params.resourceIdList + .split(',') + .map((arn) => arn.trim()) + .filter(Boolean) + return { + region: params.awsRegion, + accessKeyId: params.awsAccessKeyId, + secretAccessKey: params.awsSecretAccessKey, + resourceIdList, + ...(params.nextToken && { nextToken: params.nextToken }), + } + }, + }, + + transformResponse: async (response: Response) => { + const data = await response.json() + if (!response.ok) { + throw new Error(data.error || 'Failed to list CloudTrail resource tags') + } + return { + success: true, + output: { + resourceTags: data.output.resourceTags ?? [], + nextToken: data.output.nextToken ?? null, + }, + } + }, + + outputs: { + resourceTags: { + type: 'array', + description: 'Tags for each requested resource', + items: { + type: 'object', + properties: { + resourceId: { type: 'string', description: 'ARN of the tagged resource' }, + tags: { type: 'array', description: 'Tags on the resource, as key and value' }, + }, + }, + }, + nextToken: { + type: 'string', + description: 'Reserved for future use by AWS', + optional: true, + }, + }, +} diff --git a/apps/sim/tools/cloudtrail/list_trails.ts b/apps/sim/tools/cloudtrail/list_trails.ts new file mode 100644 index 00000000000..34506679570 --- /dev/null +++ b/apps/sim/tools/cloudtrail/list_trails.ts @@ -0,0 +1,90 @@ +import type { + CloudTrailListTrailsParams, + CloudTrailListTrailsResponse, +} from '@/tools/cloudtrail/types' +import type { InternalToolConfig } from '@/tools/types' + +export const listTrailsTool: InternalToolConfig< + CloudTrailListTrailsParams, + CloudTrailListTrailsResponse +> = { + id: 'cloudtrail_list_trails', + name: 'CloudTrail List Trails', + description: + 'List the ARN, name, and home Region of every CloudTrail trail visible to the account', + version: '1.0.0', + + params: { + awsRegion: { + type: 'string', + required: true, + visibility: 'user-only', + description: 'AWS region (e.g., us-east-1)', + }, + awsAccessKeyId: { + type: 'string', + required: true, + visibility: 'user-only', + description: 'AWS access key ID', + }, + awsSecretAccessKey: { + type: 'string', + required: true, + visibility: 'user-only', + description: 'AWS secret access key', + }, + nextToken: { + type: 'string', + required: false, + visibility: 'user-or-llm', + description: 'Pagination token from a previous list request', + }, + }, + + operation: { + input: (params) => ({ + region: params.awsRegion, + accessKeyId: params.awsAccessKeyId, + secretAccessKey: params.awsSecretAccessKey, + ...(params.nextToken && { nextToken: params.nextToken }), + }), + }, + + transformResponse: async (response: Response) => { + const data = await response.json() + if (!response.ok) { + throw new Error(data.error || 'Failed to list CloudTrail trails') + } + return { + success: true, + output: { + trails: data.output.trails ?? [], + nextToken: data.output.nextToken ?? null, + }, + } + }, + + outputs: { + trails: { + type: 'array', + description: 'Trail summaries', + items: { + type: 'object', + properties: { + trailArn: { type: 'string', description: 'ARN of the trail', nullable: true }, + name: { type: 'string', description: 'Trail name', nullable: true }, + homeRegion: { + type: 'string', + description: 'Region in which the trail was created', + nullable: true, + }, + }, + }, + }, + nextToken: { + type: 'string', + description: 'Pagination token for the next page of trails, or null on the last page', + nullable: true, + }, + }, +} diff --git a/apps/sim/tools/cloudtrail/lookup_events.ts b/apps/sim/tools/cloudtrail/lookup_events.ts new file mode 100644 index 00000000000..99092c12cff --- /dev/null +++ b/apps/sim/tools/cloudtrail/lookup_events.ts @@ -0,0 +1,157 @@ +import type { + CloudTrailLookupEventsParams, + CloudTrailLookupEventsResponse, +} from '@/tools/cloudtrail/types' +import type { InternalToolConfig } from '@/tools/types' + +export const lookupEventsTool: InternalToolConfig< + CloudTrailLookupEventsParams, + CloudTrailLookupEventsResponse +> = { + id: 'cloudtrail_lookup_events', + name: 'CloudTrail Look Up Events', + description: + 'Look up AWS CloudTrail management or Insights events from the last 90 days in a Region', + version: '1.0.0', + + params: { + awsRegion: { + type: 'string', + required: true, + visibility: 'user-only', + description: 'AWS region (e.g., us-east-1)', + }, + awsAccessKeyId: { + type: 'string', + required: true, + visibility: 'user-only', + description: 'AWS access key ID', + }, + awsSecretAccessKey: { + type: 'string', + required: true, + visibility: 'user-only', + description: 'AWS secret access key', + }, + attributeKey: { + type: 'string', + required: false, + visibility: 'user-or-llm', + description: + 'Lookup attribute to filter on: AccessKeyId, EventId, EventName, EventSource, ReadOnly, ResourceName, ResourceType, or Username. Must be paired with attributeValue', + }, + attributeValue: { + type: 'string', + required: false, + visibility: 'user-or-llm', + description: 'Value the lookup attribute must equal. Must be paired with attributeKey', + }, + startTime: { + type: 'string', + required: false, + visibility: 'user-or-llm', + description: 'Only return events at or after this ISO 8601 timestamp', + }, + endTime: { + type: 'string', + required: false, + visibility: 'user-or-llm', + description: 'Only return events at or before this ISO 8601 timestamp', + }, + eventCategory: { + type: 'string', + required: false, + visibility: 'user-or-llm', + description: + 'Set to the value insight to return CloudTrail Insights events instead of management events', + }, + maxResults: { + type: 'number', + required: false, + visibility: 'user-or-llm', + description: 'Number of events to return, 1 to 50 (default 50)', + }, + nextToken: { + type: 'string', + required: false, + visibility: 'user-or-llm', + description: 'Pagination token from a previous lookup, which must repeat the same filters', + }, + }, + + operation: { + input: (params) => ({ + region: params.awsRegion, + accessKeyId: params.awsAccessKeyId, + secretAccessKey: params.awsSecretAccessKey, + ...(params.attributeKey && { attributeKey: params.attributeKey }), + ...(params.attributeValue && { attributeValue: params.attributeValue }), + ...(params.startTime && { startTime: params.startTime }), + ...(params.endTime && { endTime: params.endTime }), + ...(params.eventCategory === 'insight' && { eventCategory: 'insight' as const }), + ...(params.maxResults !== undefined && { maxResults: params.maxResults }), + ...(params.nextToken && { nextToken: params.nextToken }), + }), + }, + + transformResponse: async (response: Response) => { + const data = await response.json() + if (!response.ok) { + throw new Error(data.error || 'Failed to look up CloudTrail events') + } + return { + success: true, + output: { + events: data.output.events ?? [], + nextToken: data.output.nextToken ?? null, + }, + } + }, + + outputs: { + events: { + type: 'array', + description: 'Matching events, most recent first', + items: { + type: 'object', + properties: { + eventId: { type: 'string', description: 'CloudTrail event ID' }, + eventName: { type: 'string', description: 'API action that was called' }, + readOnly: { + type: 'string', + description: "Whether the action was read-only, as the string 'true' or 'false'", + }, + accessKeyId: { + type: 'string', + description: 'Access key ID used to make the call, when applicable', + }, + eventTime: { type: 'string', description: 'When the event occurred (ISO 8601)' }, + eventSource: { + type: 'string', + description: 'AWS service endpoint that recorded the event', + }, + username: { type: 'string', description: 'Name of the principal that made the call' }, + resources: { + type: 'array', + description: 'Resources referenced by the event, as resourceType and resourceName', + }, + cloudTrailEvent: { + type: 'object', + description: + 'Full CloudTrail event record parsed from JSON, including userIdentity, sourceIPAddress, userAgent, requestParameters, responseElements, and errorCode', + }, + cloudTrailEventRaw: { + type: 'string', + description: + 'Raw CloudTrail event JSON string, populated only when it could not be parsed', + }, + }, + }, + }, + nextToken: { + type: 'string', + description: 'Pagination token for the next page of events', + optional: true, + }, + }, +} diff --git a/apps/sim/tools/cloudtrail/operation-input.test.ts b/apps/sim/tools/cloudtrail/operation-input.test.ts new file mode 100644 index 00000000000..0ee3ac94b65 --- /dev/null +++ b/apps/sim/tools/cloudtrail/operation-input.test.ts @@ -0,0 +1,76 @@ +/** + * @vitest-environment node + * + * The CloudTrail block collects `trailNameList`, `resourceIdList`, and `queryParameters` as + * comma-separated strings, while their contracts require arrays. `operation.input` is the seam + * that converts them, and it runs before contract validation, so these fields must arrive at the + * contract already split. Regressing this would 400 every request that uses them. + */ +import { describe, expect, it } from 'vitest' +import { describeTrailsTool } from '@/tools/cloudtrail/describe_trails' +import { listTagsTool } from '@/tools/cloudtrail/list_tags' +import { startQueryTool } from '@/tools/cloudtrail/start_query' + +const CONNECTION = { + awsRegion: 'us-east-1', + awsAccessKeyId: 'AKIAIOSFODNN7EXAMPLE', + awsSecretAccessKey: 'secret', +} + +const TRAIL_ARN = 'arn:aws:cloudtrail:us-east-1:123456789012:trail/audit-trail' + +describe('cloudtrail operation input', () => { + it('splits comma-separated trail names for describe_trails', () => { + const input = describeTrailsTool.operation.input({ + ...CONNECTION, + trailNameList: 'audit-trail, security-trail', + }) + + expect(input.trailNameList).toEqual(['audit-trail', 'security-trail']) + }) + + it('omits trailNameList entirely when it is blank', () => { + const input = describeTrailsTool.operation.input({ ...CONNECTION, trailNameList: ' ' }) + + expect(input.trailNameList).toBeUndefined() + }) + + it('splits comma-separated resource ARNs for list_tags', () => { + const input = listTagsTool.operation.input({ + ...CONNECTION, + resourceIdList: `${TRAIL_ARN},${TRAIL_ARN}`, + }) + + expect(input.resourceIdList).toEqual([TRAIL_ARN, TRAIL_ARN]) + }) + + it('splits comma-separated query template parameters for start_query', () => { + const input = startQueryTool.operation.input({ + ...CONNECTION, + queryAlias: 'top-errors', + queryParameters: 'us-east-1, 2026-01-01', + }) + + expect(input.queryParameters).toEqual(['us-east-1', '2026-01-01']) + }) + + it('preserves empty positional slots in start_query query parameters', () => { + const input = startQueryTool.operation.input({ + ...CONNECTION, + queryAlias: 'top-errors', + queryParameters: 'us-east-1,,2026-01-01', + }) + + expect(input.queryParameters).toEqual(['us-east-1', '', '2026-01-01']) + }) + + it('omits queryParameters entirely when it is blank', () => { + const input = startQueryTool.operation.input({ + ...CONNECTION, + queryAlias: 'top-errors', + queryParameters: ' ', + }) + + expect(input.queryParameters).toBeUndefined() + }) +}) diff --git a/apps/sim/tools/cloudtrail/start_query.ts b/apps/sim/tools/cloudtrail/start_query.ts new file mode 100644 index 00000000000..26d0c9ecf3d --- /dev/null +++ b/apps/sim/tools/cloudtrail/start_query.ts @@ -0,0 +1,123 @@ +import type { + CloudTrailStartQueryParams, + CloudTrailStartQueryResponse, +} from '@/tools/cloudtrail/types' +import type { InternalToolConfig } from '@/tools/types' + +export const startQueryTool: InternalToolConfig< + CloudTrailStartQueryParams, + CloudTrailStartQueryResponse +> = { + id: 'cloudtrail_start_query', + name: 'CloudTrail Start Query', + description: 'Start a CloudTrail Lake SQL query over an event data store', + version: '1.0.0', + + params: { + awsRegion: { + type: 'string', + required: true, + visibility: 'user-only', + description: 'AWS region (e.g., us-east-1)', + }, + awsAccessKeyId: { + type: 'string', + required: true, + visibility: 'user-only', + description: 'AWS access key ID', + }, + awsSecretAccessKey: { + type: 'string', + required: true, + visibility: 'user-only', + description: 'AWS secret access key', + }, + queryStatement: { + type: 'string', + required: false, + visibility: 'user-or-llm', + description: + 'SQL query to run, up to 10,000 characters. The event data store ID is named in the FROM clause. Supply this or queryAlias, not both', + }, + queryAlias: { + type: 'string', + required: false, + visibility: 'user-or-llm', + description: + 'Alias of a query template used by CloudTrail Lake dashboards. Supply this or queryStatement, not both', + }, + queryParameters: { + type: 'string', + required: false, + visibility: 'user-or-llm', + description: 'Comma-separated parameter values for the query alias, up to 10 values', + }, + deliveryS3Uri: { + type: 'string', + required: false, + visibility: 'user-or-llm', + description: + 'S3 URI where CloudTrail delivers the query results (e.g., s3://my-bucket/results)', + }, + eventDataStoreOwnerAccountId: { + type: 'string', + required: false, + visibility: 'user-or-llm', + description: 'Account ID of the event data store owner, for a shared event data store', + }, + }, + + operation: { + /** + * `QueryParameters` is positional: CloudTrail substitutes each entry into the query + * template by index. Empty slots are preserved rather than dropped, so a malformed + * list such as `a,,c` fails the contract's per-entry minimum length instead of + * silently shifting `c` into the second position. + */ + input: (params) => { + const rawQueryParameters = (params.queryParameters ?? '').trim() + const queryParameters = rawQueryParameters + ? rawQueryParameters.split(',').map((value) => value.trim()) + : [] + return { + region: params.awsRegion, + accessKeyId: params.awsAccessKeyId, + secretAccessKey: params.awsSecretAccessKey, + ...(params.queryStatement && { queryStatement: params.queryStatement }), + ...(params.queryAlias && { queryAlias: params.queryAlias }), + ...(queryParameters.length > 0 && { queryParameters }), + ...(params.deliveryS3Uri && { deliveryS3Uri: params.deliveryS3Uri }), + ...(params.eventDataStoreOwnerAccountId && { + eventDataStoreOwnerAccountId: params.eventDataStoreOwnerAccountId, + }), + } + }, + }, + + transformResponse: async (response: Response) => { + const data = await response.json() + if (!response.ok) { + throw new Error(data.error || 'Failed to start CloudTrail Lake query') + } + return { + success: true, + output: { + queryId: data.output.queryId, + eventDataStoreOwnerAccountId: data.output.eventDataStoreOwnerAccountId ?? null, + }, + } + }, + + outputs: { + queryId: { + type: 'string', + description: + 'ID of the started query. Pass it to Describe Query to poll status, or to Get Query Results to page through rows', + }, + eventDataStoreOwnerAccountId: { + type: 'string', + description: 'Account ID of the event data store owner', + optional: true, + }, + }, +} diff --git a/apps/sim/tools/cloudtrail/types.ts b/apps/sim/tools/cloudtrail/types.ts new file mode 100644 index 00000000000..1bfa127026a --- /dev/null +++ b/apps/sim/tools/cloudtrail/types.ts @@ -0,0 +1,286 @@ +import type { ToolResponse } from '@/tools/types' + +interface CloudTrailConnectionConfig { + awsRegion: string + awsAccessKeyId: string + awsSecretAccessKey: string +} + +export interface CloudTrailAdvancedEventSelector { + name: string | null + fieldSelectors: { + field: string + equals: string[] + startsWith: string[] + endsWith: string[] + notEquals: string[] + notStartsWith: string[] + notEndsWith: string[] + }[] +} + +export interface CloudTrailTrail { + name: string + s3BucketName: string | null + s3KeyPrefix: string | null + snsTopicName: string | null + snsTopicArn: string | null + includeGlobalServiceEvents: boolean | null + isMultiRegionTrail: boolean | null + homeRegion: string | null + trailArn: string | null + logFileValidationEnabled: boolean | null + cloudWatchLogsLogGroupArn: string | null + cloudWatchLogsRoleArn: string | null + kmsKeyId: string | null + hasCustomEventSelectors: boolean | null + hasInsightSelectors: boolean | null + isOrganizationTrail: boolean | null +} + +export type CloudTrailLookupAttributeKey = + | 'AccessKeyId' + | 'EventId' + | 'EventName' + | 'EventSource' + | 'ReadOnly' + | 'ResourceName' + | 'ResourceType' + | 'Username' + +export interface CloudTrailLookupEventsParams extends CloudTrailConnectionConfig { + attributeKey?: CloudTrailLookupAttributeKey + attributeValue?: string + startTime?: string + endTime?: string + eventCategory?: 'insight' + maxResults?: number + nextToken?: string +} + +export interface CloudTrailEvent { + eventId: string | null + eventName: string | null + readOnly: string | null + accessKeyId: string | null + eventTime: string | null + eventSource: string | null + username: string | null + resources: { resourceType: string | null; resourceName: string | null }[] + cloudTrailEvent: Record | null + cloudTrailEventRaw: string | null +} + +export interface CloudTrailLookupEventsResponse extends ToolResponse { + output: { + events: CloudTrailEvent[] + nextToken: string | null + } +} + +export interface CloudTrailDescribeTrailsParams extends CloudTrailConnectionConfig { + trailNameList?: string + includeShadowTrails?: boolean +} + +export interface CloudTrailDescribeTrailsResponse extends ToolResponse { + output: { + trails: CloudTrailTrail[] + } +} + +export interface CloudTrailGetTrailParams extends CloudTrailConnectionConfig { + name: string +} + +export interface CloudTrailGetTrailResponse extends ToolResponse { + output: CloudTrailTrail +} + +export interface CloudTrailGetTrailStatusParams extends CloudTrailConnectionConfig { + name: string +} + +export interface CloudTrailGetTrailStatusResponse extends ToolResponse { + output: { + isLogging: boolean | null + latestDeliveryError: string | null + latestDeliveryTime: string | null + latestNotificationError: string | null + latestNotificationTime: string | null + latestCloudWatchLogsDeliveryError: string | null + latestCloudWatchLogsDeliveryTime: string | null + latestDigestDeliveryError: string | null + latestDigestDeliveryTime: string | null + startLoggingTime: string | null + stopLoggingTime: string | null + } +} + +export interface CloudTrailListTrailsParams extends CloudTrailConnectionConfig { + nextToken?: string +} + +export interface CloudTrailListTrailsResponse extends ToolResponse { + output: { + trails: { trailArn: string | null; name: string | null; homeRegion: string | null }[] + nextToken: string | null + } +} + +export interface CloudTrailGetEventSelectorsParams extends CloudTrailConnectionConfig { + trailName: string +} + +export interface CloudTrailGetEventSelectorsResponse extends ToolResponse { + output: { + trailArn: string | null + eventSelectors: { + readWriteType: string | null + includeManagementEvents: boolean | null + dataResources: { type: string | null; values: string[] }[] + excludeManagementEventSources: string[] + }[] + advancedEventSelectors: CloudTrailAdvancedEventSelector[] + } +} + +export interface CloudTrailGetInsightSelectorsParams extends CloudTrailConnectionConfig { + trailName?: string + eventDataStore?: string +} + +export interface CloudTrailGetInsightSelectorsResponse extends ToolResponse { + output: { + trailArn: string | null + eventDataStoreArn: string | null + insightsDestination: string | null + insightSelectors: { insightType: string | null; eventCategories: string[] }[] + } +} + +export interface CloudTrailStartQueryParams extends CloudTrailConnectionConfig { + queryStatement?: string + queryAlias?: string + queryParameters?: string + deliveryS3Uri?: string + eventDataStoreOwnerAccountId?: string +} + +export interface CloudTrailStartQueryResponse extends ToolResponse { + output: { + queryId: string + eventDataStoreOwnerAccountId: string | null + } +} + +export interface CloudTrailDescribeQueryParams extends CloudTrailConnectionConfig { + queryId?: string + queryAlias?: string + refreshId?: string + eventDataStoreOwnerAccountId?: string +} + +export interface CloudTrailDescribeQueryResponse extends ToolResponse { + output: { + queryId: string | null + queryString: string | null + queryStatus: string | null + errorMessage: string | null + deliveryS3Uri: string | null + deliveryStatus: string | null + prompt: string | null + eventDataStoreOwnerAccountId: string | null + eventsMatched: number | null + eventsScanned: number | null + bytesScanned: number | null + executionTimeInMillis: number | null + creationTime: string | null + } +} + +export interface CloudTrailGetQueryResultsParams extends CloudTrailConnectionConfig { + queryId: string + maxQueryResults?: number + nextToken?: string + eventDataStoreOwnerAccountId?: string +} + +export interface CloudTrailGetQueryResultsResponse extends ToolResponse { + output: { + queryStatus: string | null + rows: Record[] + resultsCount: number | null + totalResultsCount: number | null + bytesScanned: number | null + errorMessage: string | null + nextToken: string | null + } +} + +export interface CloudTrailCancelQueryParams extends CloudTrailConnectionConfig { + queryId: string + eventDataStoreOwnerAccountId?: string +} + +export interface CloudTrailCancelQueryResponse extends ToolResponse { + output: { + queryId: string + queryStatus: string | null + eventDataStoreOwnerAccountId: string | null + } +} + +export interface CloudTrailEventDataStoreSummary { + eventDataStoreArn: string | null + name: string | null + status: string | null + advancedEventSelectors: CloudTrailAdvancedEventSelector[] + multiRegionEnabled: boolean | null + organizationEnabled: boolean | null + retentionPeriod: number | null + terminationProtectionEnabled: boolean | null + createdTimestamp: string | null + updatedTimestamp: string | null +} + +export interface CloudTrailListEventDataStoresParams extends CloudTrailConnectionConfig { + maxResults?: number + nextToken?: string +} + +export interface CloudTrailListEventDataStoresResponse extends ToolResponse { + output: { + eventDataStores: CloudTrailEventDataStoreSummary[] + nextToken: string | null + } +} + +export interface CloudTrailGetEventDataStoreParams extends CloudTrailConnectionConfig { + eventDataStore: string +} + +export interface CloudTrailGetEventDataStoreResponse extends ToolResponse { + output: CloudTrailEventDataStoreSummary & { + kmsKeyId: string | null + billingMode: string | null + federationStatus: string | null + federationRoleArn: string | null + partitionKeys: { name: string; type: string }[] + } +} + +export interface CloudTrailListTagsParams extends CloudTrailConnectionConfig { + resourceIdList: string + nextToken?: string +} + +export interface CloudTrailListTagsResponse extends ToolResponse { + output: { + resourceTags: { + resourceId: string | null + tags: { key: string; value: string | null }[] + }[] + nextToken: string | null + } +} diff --git a/apps/sim/tools/generated/tool-ids.ts b/apps/sim/tools/generated/tool-ids.ts index 1d2578a2def..e4f6f681ab3 100644 --- a/apps/sim/tools/generated/tool-ids.ts +++ b/apps/sim/tools/generated/tool-ids.ts @@ -3,7 +3,7 @@ /** Every registered tool id, including versioned variants. */ const toolIds: string[] = JSON.parse( - '["a2a_cancel_task","a2a_get_agent_card","a2a_get_task","a2a_send_message","affinity_batch_update_entity_fields","affinity_batch_update_list_entry_fields","affinity_create_list","affinity_create_list_field_dropdown_option","affinity_create_merge","affinity_create_note","affinity_create_reminder","affinity_delete_list_field_dropdown_option","affinity_delete_note","affinity_get_company","affinity_get_current_user","affinity_get_entity_field_value","affinity_get_list","affinity_get_list_entry","affinity_get_list_entry_field","affinity_get_list_field_dropdown_option","affinity_get_merge","affinity_get_merge_task","affinity_get_note","affinity_get_opportunity","affinity_get_person","affinity_get_saved_view","affinity_get_transcript","affinity_get_user","affinity_list_calls","affinity_list_chat_messages","affinity_list_companies","affinity_list_coworker_connections","affinity_list_emails","affinity_list_entity_field_values","affinity_list_entity_list_entries","affinity_list_entity_lists","affinity_list_entity_notes","affinity_list_entity_relationships","affinity_list_field_dropdown_options","affinity_list_field_metadata","affinity_list_field_value_changes","affinity_list_investor_executive_connections","affinity_list_list_entries","affinity_list_list_entry_field_value_changes","affinity_list_list_entry_fields","affinity_list_list_field_dropdown_options","affinity_list_list_fields","affinity_list_lists","affinity_list_meetings","affinity_list_merge_tasks","affinity_list_merges","affinity_list_note_attached_companies","affinity_list_note_attached_opportunities","affinity_list_note_attached_persons","affinity_list_note_replies","affinity_list_notes","affinity_list_opportunities","affinity_list_persons","affinity_list_reminders","affinity_list_saved_view_entries","affinity_list_saved_views","affinity_list_transcript_fragments","affinity_list_transcripts","affinity_list_users","affinity_search_companies","affinity_search_files","affinity_search_list_entries","affinity_search_notes","affinity_search_persons","affinity_semantic_search","affinity_update_entity_field_value","affinity_update_list_entry_field","affinity_update_list_field_dropdown_option","affinity_update_note","agentmail_create_draft","agentmail_create_inbox","agentmail_delete_draft","agentmail_delete_inbox","agentmail_delete_thread","agentmail_forward_message","agentmail_get_draft","agentmail_get_inbox","agentmail_get_message","agentmail_get_thread","agentmail_list_drafts","agentmail_list_inboxes","agentmail_list_messages","agentmail_list_threads","agentmail_reply_message","agentmail_send_draft","agentmail_send_message","agentmail_update_draft","agentmail_update_inbox","agentmail_update_message","agentmail_update_thread","agentphone_create_call","agentphone_create_contact","agentphone_create_number","agentphone_delete_contact","agentphone_get_call","agentphone_get_call_transcript","agentphone_get_contact","agentphone_get_conversation","agentphone_get_conversation_messages","agentphone_get_number_messages","agentphone_get_usage","agentphone_get_usage_daily","agentphone_get_usage_monthly","agentphone_list_calls","agentphone_list_contacts","agentphone_list_conversations","agentphone_list_numbers","agentphone_react_to_message","agentphone_release_number","agentphone_send_message","agentphone_update_contact","agentphone_update_conversation","agiloft_async_status","agiloft_attach_file","agiloft_attachment_info","agiloft_create_record","agiloft_delete_record","agiloft_get_choice_line_id","agiloft_list_tables","agiloft_lock_record","agiloft_nlp_search","agiloft_read_record","agiloft_remove_attachment","agiloft_retrieve_attachment","agiloft_run_action_button","agiloft_saved_search","agiloft_search_records","agiloft_select_records","agiloft_update_record","agiloft_upsert_record","ahrefs_anchors","ahrefs_backlinks","ahrefs_backlinks_stats","ahrefs_batch_analysis","ahrefs_broken_backlinks","ahrefs_domain_rating","ahrefs_domain_rating_history","ahrefs_keyword_overview","ahrefs_keywords_history","ahrefs_metrics","ahrefs_metrics_history","ahrefs_organic_competitors","ahrefs_organic_keywords","ahrefs_paid_pages","ahrefs_rank_tracker_competitors_overview","ahrefs_rank_tracker_competitors_stats","ahrefs_rank_tracker_overview","ahrefs_rank_tracker_serp_overview","ahrefs_refdomains_history","ahrefs_referring_domains","ahrefs_related_terms","ahrefs_site_audit_page_explorer","ahrefs_top_pages","airtable_create_records","airtable_delete_records","airtable_get_base_schema","airtable_get_record","airtable_list_bases","airtable_list_records","airtable_list_tables","airtable_update_multiple_records","airtable_update_record","airtable_upsert_records","airweave_search","algolia_add_record","algolia_batch_operations","algolia_browse_records","algolia_clear_records","algolia_copy_move_index","algolia_delete_by_filter","algolia_delete_index","algolia_delete_record","algolia_get_record","algolia_get_records","algolia_get_settings","algolia_get_task_status","algolia_list_indices","algolia_partial_update_record","algolia_search","algolia_update_settings","amplitude_event_segmentation","amplitude_funnels","amplitude_get_active_users","amplitude_get_revenue","amplitude_group_identify","amplitude_identify_user","amplitude_list_events","amplitude_realtime_active_users","amplitude_retention","amplitude_send_event","amplitude_user_activity","amplitude_user_profile","amplitude_user_search","apify_get_dataset_items","apify_get_run","apify_run_actor_async","apify_run_actor_sync","apify_run_task","apollo_account_bulk_create","apollo_account_bulk_update","apollo_account_create","apollo_account_search","apollo_account_update","apollo_contact_bulk_create","apollo_contact_bulk_update","apollo_contact_create","apollo_contact_search","apollo_contact_update","apollo_email_accounts","apollo_opportunity_create","apollo_opportunity_get","apollo_opportunity_search","apollo_opportunity_update","apollo_organization_bulk_enrich","apollo_organization_enrich","apollo_organization_search","apollo_people_bulk_enrich","apollo_people_enrich","apollo_people_search","apollo_sequence_add_contacts","apollo_sequence_search","apollo_task_create","apollo_task_search","appconfig_create_application","appconfig_create_configuration_profile","appconfig_create_environment","appconfig_create_hosted_configuration_version","appconfig_delete_application","appconfig_delete_configuration_profile","appconfig_delete_environment","appconfig_delete_hosted_configuration_version","appconfig_get_application","appconfig_get_configuration","appconfig_get_configuration_profile","appconfig_get_deployment","appconfig_get_environment","appconfig_get_hosted_configuration_version","appconfig_list_applications","appconfig_list_configuration_profiles","appconfig_list_deployment_strategies","appconfig_list_deployments","appconfig_list_environments","appconfig_list_hosted_configuration_versions","appconfig_start_deployment","appconfig_stop_deployment","appconfig_update_application","appconfig_update_configuration_profile","appconfig_update_environment","arxiv_get_author_papers","arxiv_get_paper","arxiv_search","asana_add_comment","asana_add_followers","asana_create_project","asana_create_section","asana_create_subtask","asana_create_task","asana_delete_task","asana_get_project","asana_get_projects","asana_get_task","asana_list_sections","asana_list_workspaces","asana_search_tasks","asana_update_task","ashby_add_candidate_tag","ashby_anonymize_candidate","ashby_change_application_source","ashby_change_application_stage","ashby_create_application","ashby_create_candidate","ashby_create_note","ashby_delete_application","ashby_get_application","ashby_get_candidate","ashby_get_job","ashby_get_job_posting","ashby_get_offer","ashby_get_opening","ashby_list_application_feedback","ashby_list_application_history","ashby_list_applications","ashby_list_archive_reasons","ashby_list_candidate_tags","ashby_list_candidates","ashby_list_custom_fields","ashby_list_departments","ashby_list_interview_plans","ashby_list_interview_stages","ashby_list_interviews","ashby_list_job_postings","ashby_list_jobs","ashby_list_locations","ashby_list_notes","ashby_list_offers","ashby_list_openings","ashby_list_sources","ashby_list_users","ashby_remove_candidate_tag","ashby_search_candidates","ashby_search_jobs","ashby_search_openings","ashby_search_users","ashby_set_custom_field_value","ashby_set_custom_field_values","ashby_transfer_application","ashby_update_candidate","ashby_upload_candidate_file","ashby_upload_resume","athena_batch_get_query_execution","athena_create_named_query","athena_delete_named_query","athena_get_named_query","athena_get_query_execution","athena_get_query_results","athena_list_databases","athena_list_named_queries","athena_list_query_executions","athena_list_table_metadata","athena_start_query","athena_stop_query","attio_assert_record","attio_create_attribute","attio_create_comment","attio_create_list","attio_create_list_entry","attio_create_note","attio_create_object","attio_create_record","attio_create_task","attio_create_webhook","attio_delete_comment","attio_delete_list_entry","attio_delete_note","attio_delete_record","attio_delete_task","attio_delete_webhook","attio_get_attribute","attio_get_comment","attio_get_list","attio_get_list_entry","attio_get_member","attio_get_note","attio_get_object","attio_get_record","attio_get_task","attio_get_thread","attio_get_webhook","attio_list_attributes","attio_list_lists","attio_list_members","attio_list_notes","attio_list_objects","attio_list_records","attio_list_tasks","attio_list_threads","attio_list_webhooks","attio_query_list_entries","attio_search_records","attio_update_attribute","attio_update_list","attio_update_list_entry","attio_update_object","attio_update_record","attio_update_task","attio_update_webhook","azure_data_explorer_create_table","azure_data_explorer_drop_table","azure_data_explorer_ingest_from_query","azure_data_explorer_ingest_inline","azure_data_explorer_list_databases","azure_data_explorer_list_functions","azure_data_explorer_list_tables","azure_data_explorer_management","azure_data_explorer_query","azure_data_explorer_show_database_schema","azure_data_explorer_show_ingestion_failures","azure_data_explorer_show_operations","azure_data_explorer_show_table_details","azure_data_explorer_show_table_schema","azure_devops_add_comment","azure_devops_create_work_item","azure_devops_get_build_log","azure_devops_get_build_timeline","azure_devops_get_comments","azure_devops_get_pipeline","azure_devops_get_pipeline_run","azure_devops_get_work_item","azure_devops_get_work_items_batch","azure_devops_get_work_items_between_builds","azure_devops_list_build_logs","azure_devops_list_builds","azure_devops_list_pipeline_runs","azure_devops_list_pipelines","azure_devops_query_work_items","azure_devops_update_work_item","bitbucket_approve_pull_request","bitbucket_create_branch","bitbucket_create_pull_request","bitbucket_create_pull_request_comment","bitbucket_decline_pull_request","bitbucket_delete_branch","bitbucket_get_commit","bitbucket_get_file","bitbucket_get_file_metadata","bitbucket_get_pipeline","bitbucket_get_pipeline_step_log","bitbucket_get_pull_request","bitbucket_get_pull_request_diff","bitbucket_get_pull_request_diffstat","bitbucket_get_pull_request_merge_task_status","bitbucket_get_repository","bitbucket_list_branches","bitbucket_list_commits","bitbucket_list_directory","bitbucket_list_pipeline_steps","bitbucket_list_pipelines","bitbucket_list_pull_request_comments","bitbucket_list_pull_request_commit_statuses","bitbucket_list_pull_requests","bitbucket_list_repositories","bitbucket_list_workspaces","bitbucket_merge_pull_request","bitbucket_request_pull_request_changes","bitbucket_stop_pipeline","bitbucket_trigger_pipeline","box_copy_file","box_create_folder","box_delete_file","box_delete_folder","box_download_file","box_get_file_info","box_list_folder_items","box_search","box_sign_cancel_request","box_sign_create_request","box_sign_get_request","box_sign_list_requests","box_sign_resend_request","box_update_file","box_upload_file","brandfetch_get_brand","brandfetch_search","brex_archive_budget","brex_create_budget","brex_create_spend_limit","brex_create_transfer","brex_create_vendor","brex_get_budget","brex_get_cash_account","brex_get_company","brex_get_current_user","brex_get_expense","brex_get_spend_limit","brex_get_transfer","brex_get_user","brex_get_vendor","brex_list_budgets","brex_list_card_accounts","brex_list_card_statements","brex_list_card_transactions","brex_list_cards","brex_list_cash_accounts","brex_list_cash_statements","brex_list_cash_transactions","brex_list_departments","brex_list_expenses","brex_list_locations","brex_list_spend_limits","brex_list_titles","brex_list_transfers","brex_list_users","brex_list_vendors","brex_match_receipt","brex_update_expense","brex_update_vendor","brex_upload_receipt","brightdata_cancel_snapshot","brightdata_discover","brightdata_download_snapshot","brightdata_scrape_dataset","brightdata_scrape_url","brightdata_serp_search","brightdata_snapshot_status","brightdata_sync_scrape","browser_use_run_task","buffer_create_idea","buffer_create_post","buffer_delete_post","buffer_edit_post","buffer_get_account","buffer_get_channels","buffer_get_idea_groups","buffer_get_ideas","buffer_get_post","buffer_get_posts","calcom_cancel_booking","calcom_confirm_booking","calcom_create_booking","calcom_create_event_type","calcom_create_schedule","calcom_decline_booking","calcom_delete_event_type","calcom_delete_schedule","calcom_get_booking","calcom_get_default_schedule","calcom_get_event_type","calcom_get_schedule","calcom_get_slots","calcom_list_bookings","calcom_list_event_types","calcom_list_schedules","calcom_reschedule_booking","calcom_update_event_type","calcom_update_schedule","calendly_cancel_event","calendly_create_event_invitee","calendly_create_invitee_no_show","calendly_create_scheduling_link","calendly_create_webhook","calendly_delete_invitee_no_show","calendly_delete_webhook","calendly_get_current_user","calendly_get_event_invitee","calendly_get_event_type","calendly_get_scheduled_event","calendly_get_user","calendly_list_event_invitees","calendly_list_event_type_available_times","calendly_list_event_types","calendly_list_organization_memberships","calendly_list_routing_form_submissions","calendly_list_routing_forms","calendly_list_scheduled_events","calendly_list_user_availability_schedules","calendly_list_user_busy_times","calendly_list_webhooks","cbinsights_chat","cbinsights_get_commercial_maturity_history","cbinsights_get_exit_probability_history","cbinsights_get_mosaic_history","cbinsights_get_org_business_relationships","cbinsights_get_org_funding_window","cbinsights_get_org_fundings","cbinsights_get_org_investments","cbinsights_get_org_management_and_board","cbinsights_get_org_outlook","cbinsights_get_org_portfolio_exits","cbinsights_get_org_revenue","cbinsights_get_scouting_report","cbinsights_get_strategy_map","cbinsights_list_business_relationships","cbinsights_list_funding_window","cbinsights_list_fundings","cbinsights_list_investments","cbinsights_list_management_and_board","cbinsights_list_outlook","cbinsights_list_portfolio_exits","cbinsights_list_revenue","cbinsights_lookup_organizations","cbinsights_rag","cbinsights_search_firmographics","circleback_add_tag_to_meetings","circleback_create_tag","circleback_delete_action_item","circleback_delete_meeting","circleback_delete_tag","circleback_get_company","circleback_get_meeting","circleback_get_person","circleback_get_transcript","circleback_list_action_items","circleback_list_calendar_events","circleback_list_companies","circleback_list_meetings","circleback_list_people","circleback_list_tags","circleback_remove_tag_from_meetings","circleback_search_meetings","circleback_update_action_item","circleback_update_meeting","circleback_update_tag","clay_populate","clerk_add_organization_member","clerk_ban_user","clerk_create_actor_token","clerk_create_allowlist_identifier","clerk_create_blocklist_identifier","clerk_create_organization","clerk_create_organization_invitation","clerk_create_user","clerk_delete_allowlist_identifier","clerk_delete_blocklist_identifier","clerk_delete_organization","clerk_delete_user","clerk_get_jwt_template","clerk_get_organization","clerk_get_session","clerk_get_user","clerk_get_user_oauth_token","clerk_list_allowlist_identifiers","clerk_list_blocklist_identifiers","clerk_list_jwt_templates","clerk_list_organization_invitations","clerk_list_organization_memberships","clerk_list_organizations","clerk_list_sessions","clerk_list_users","clerk_lock_user","clerk_remove_organization_member","clerk_revoke_actor_token","clerk_revoke_session","clerk_unban_user","clerk_unlock_user","clerk_update_organization","clerk_update_organization_membership","clerk_update_user","clickhouse_count_rows","clickhouse_create_database","clickhouse_create_table","clickhouse_delete","clickhouse_describe_table","clickhouse_drop_database","clickhouse_drop_partition","clickhouse_drop_table","clickhouse_execute","clickhouse_insert","clickhouse_insert_rows","clickhouse_introspect","clickhouse_kill_query","clickhouse_list_clusters","clickhouse_list_databases","clickhouse_list_mutations","clickhouse_list_partitions","clickhouse_list_running_queries","clickhouse_list_tables","clickhouse_optimize_table","clickhouse_query","clickhouse_rename_table","clickhouse_show_create_table","clickhouse_table_stats","clickhouse_truncate_table","clickhouse_update","clickup_add_tag_to_task","clickup_create_checklist","clickup_create_checklist_item","clickup_create_comment","clickup_create_folder","clickup_create_list","clickup_create_task","clickup_create_time_entry","clickup_delete_checklist","clickup_delete_checklist_item","clickup_delete_comment","clickup_delete_task","clickup_delete_time_entry","clickup_get_comments","clickup_get_custom_fields","clickup_get_folders","clickup_get_list_members","clickup_get_lists","clickup_get_running_timer","clickup_get_space_tags","clickup_get_spaces","clickup_get_task","clickup_get_task_members","clickup_get_tasks","clickup_get_time_entries","clickup_get_workspaces","clickup_remove_custom_field_value","clickup_remove_tag_from_task","clickup_search_tasks","clickup_set_custom_field_value","clickup_start_timer","clickup_stop_timer","clickup_update_checklist","clickup_update_checklist_item","clickup_update_comment","clickup_update_task","clickup_update_time_entry","clickup_upload_attachment","cloudflare_create_access_application","cloudflare_create_access_policy","cloudflare_create_access_service_token","cloudflare_create_dns_record","cloudflare_create_r2_bucket","cloudflare_create_rate_limit_rule","cloudflare_create_ruleset","cloudflare_create_ruleset_rule","cloudflare_create_zone","cloudflare_delete_access_application","cloudflare_delete_access_policy","cloudflare_delete_dns_record","cloudflare_delete_r2_bucket","cloudflare_delete_ruleset_rule","cloudflare_delete_zone","cloudflare_dns_analytics","cloudflare_get_access_application","cloudflare_get_r2_bucket","cloudflare_get_ruleset","cloudflare_get_ruleset_entrypoint","cloudflare_get_tunnel","cloudflare_get_tunnel_configuration","cloudflare_get_worker_script_settings","cloudflare_get_zone","cloudflare_get_zone_settings","cloudflare_list_access_applications","cloudflare_list_access_groups","cloudflare_list_access_identity_providers","cloudflare_list_access_policies","cloudflare_list_access_service_tokens","cloudflare_list_certificates","cloudflare_list_dns_records","cloudflare_list_managed_ruleset_overrides","cloudflare_list_r2_buckets","cloudflare_list_rate_limit_rules","cloudflare_list_rulesets","cloudflare_list_tunnels","cloudflare_list_worker_routes","cloudflare_list_worker_scripts","cloudflare_list_zones","cloudflare_purge_cache","cloudflare_revoke_access_service_token","cloudflare_update_access_application","cloudflare_update_access_policy","cloudflare_update_dns_record","cloudflare_update_rate_limit_rule","cloudflare_update_ruleset_rule","cloudflare_update_zone_setting","cloudformation_cancel_update_stack","cloudformation_create_change_set","cloudformation_create_stack","cloudformation_delete_stack","cloudformation_describe_change_set","cloudformation_describe_stack_drift_detection_status","cloudformation_describe_stack_events","cloudformation_describe_stacks","cloudformation_detect_stack_drift","cloudformation_execute_change_set","cloudformation_get_template","cloudformation_get_template_summary","cloudformation_list_stack_resources","cloudformation_update_stack","cloudformation_validate_template","cloudwatch_describe_alarm_history","cloudwatch_describe_alarms","cloudwatch_describe_log_groups","cloudwatch_describe_log_streams","cloudwatch_filter_log_events","cloudwatch_get_log_events","cloudwatch_get_metric_statistics","cloudwatch_list_metrics","cloudwatch_mute_alarm","cloudwatch_put_log_group_retention","cloudwatch_put_metric_data","cloudwatch_query_logs","cloudwatch_unmute_alarm","codepipeline_disable_stage_transition","codepipeline_enable_stage_transition","codepipeline_get_pipeline","codepipeline_get_pipeline_execution","codepipeline_get_pipeline_state","codepipeline_list_action_executions","codepipeline_list_pipeline_executions","codepipeline_list_pipelines","codepipeline_put_approval_result","codepipeline_retry_stage_execution","codepipeline_start_execution","codepipeline_stop_execution","confluence_add_label","confluence_create_blogpost","confluence_create_comment","confluence_create_page","confluence_create_page_property","confluence_create_space","confluence_create_space_property","confluence_delete_attachment","confluence_delete_blogpost","confluence_delete_comment","confluence_delete_label","confluence_delete_page","confluence_delete_page_property","confluence_delete_space","confluence_delete_space_property","confluence_get_blogpost","confluence_get_page_ancestors","confluence_get_page_children","confluence_get_page_descendants","confluence_get_page_version","confluence_get_pages_by_label","confluence_get_space","confluence_get_task","confluence_get_user","confluence_list_attachments","confluence_list_blogposts","confluence_list_blogposts_in_space","confluence_list_comments","confluence_list_labels","confluence_list_page_properties","confluence_list_page_versions","confluence_list_pages_in_space","confluence_list_space_labels","confluence_list_space_permissions","confluence_list_space_properties","confluence_list_spaces","confluence_list_tasks","confluence_retrieve","confluence_search","confluence_search_in_space","confluence_update","confluence_update_blogpost","confluence_update_comment","confluence_update_space","confluence_update_task","confluence_upload_attachment","context_dev_classify_naics","context_dev_classify_sic","context_dev_crawl","context_dev_extract","context_dev_extract_product","context_dev_extract_products","context_dev_get_brand","context_dev_get_brand_by_email","context_dev_get_brand_by_name","context_dev_get_brand_by_ticker","context_dev_identify_transaction","context_dev_map","context_dev_scrape_fonts","context_dev_scrape_html","context_dev_scrape_images","context_dev_scrape_markdown","context_dev_scrape_styleguide","context_dev_screenshot","context_dev_search","convex_action","convex_document_deltas","convex_list_documents","convex_list_tables","convex_mutation","convex_query","convex_run_function","crowdstrike_create_indicators","crowdstrike_delete_indicators","crowdstrike_delete_rtr_session","crowdstrike_execute_rtr_command","crowdstrike_get_alert_details","crowdstrike_get_case_details","crowdstrike_get_host_group_details","crowdstrike_get_indicator_details","crowdstrike_get_rtr_command_status","crowdstrike_get_sensor_aggregates","crowdstrike_get_sensor_details","crowdstrike_get_vulnerability_details","crowdstrike_init_rtr_session","crowdstrike_perform_host_action","crowdstrike_perform_host_group_action","crowdstrike_query_alerts","crowdstrike_query_cases","crowdstrike_query_host_groups","crowdstrike_query_indicators","crowdstrike_query_sensors","crowdstrike_query_vulnerabilities","crowdstrike_update_alerts","crowdstrike_update_indicators","crunchbase_autocomplete","crunchbase_get_acquisition","crunchbase_get_entity","crunchbase_get_entity_card","crunchbase_get_fields_metadata","crunchbase_get_funding_round","crunchbase_get_organization","crunchbase_get_person","crunchbase_list_deleted_entities","crunchbase_search_acquisitions","crunchbase_search_entities","crunchbase_search_funding_rounds","crunchbase_search_organizations","crunchbase_search_people","cursor_add_followup","cursor_add_followup_v2","cursor_delete_agent","cursor_delete_agent_v2","cursor_download_artifact","cursor_download_artifact_v2","cursor_get_agent","cursor_get_agent_v2","cursor_get_api_key_info","cursor_get_api_key_info_v2","cursor_get_conversation","cursor_get_conversation_v2","cursor_launch_agent","cursor_launch_agent_v2","cursor_list_agents","cursor_list_agents_v2","cursor_list_artifacts","cursor_list_artifacts_v2","cursor_list_models","cursor_list_models_v2","cursor_list_repositories","cursor_list_repositories_v2","cursor_stop_agent","cursor_stop_agent_v2","dagster_delete_run","dagster_get_asset","dagster_get_run","dagster_get_run_logs","dagster_launch_run","dagster_list_assets","dagster_list_jobs","dagster_list_runs","dagster_list_schedules","dagster_list_sensors","dagster_materialize_assets","dagster_reexecute_run","dagster_report_asset_materialization","dagster_start_schedule","dagster_start_sensor","dagster_stop_schedule","dagster_stop_sensor","dagster_terminate_run","dagster_wipe_asset","databricks_cancel_run","databricks_execute_sql","databricks_get_cluster","databricks_get_job","databricks_get_run","databricks_get_run_output","databricks_get_statement","databricks_list_clusters","databricks_list_jobs","databricks_list_runs","databricks_list_warehouses","databricks_run_job","datadog_add_incident_todo","datadog_cancel_downtime","datadog_create_dashboard","datadog_create_downtime","datadog_create_event","datadog_create_incident","datadog_create_monitor","datadog_create_slo","datadog_delete_dashboard","datadog_delete_slo","datadog_get_browser_synthetics_results","datadog_get_dashboard","datadog_get_incident","datadog_get_monitor","datadog_get_security_signal","datadog_get_slo","datadog_get_slo_history","datadog_get_synthetics_results","datadog_get_synthetics_test","datadog_list_dashboards","datadog_list_downtimes","datadog_list_incidents","datadog_list_monitors","datadog_list_security_rules","datadog_list_security_signals","datadog_list_services","datadog_list_slos","datadog_list_synthetics_tests","datadog_mute_monitor","datadog_query_logs","datadog_query_timeseries","datadog_search_spans","datadog_send_logs","datadog_submit_metrics","datadog_trigger_synthetics_tests","datadog_unmute_monitor","datadog_update_incident","datadog_update_security_signal_assignee","datadog_update_security_signal_state","datadog_update_slo","datadog_update_synthetics_status","datagma_enrich_company","datagma_enrich_person","datagma_find_email","datagma_find_phone","datagma_get_credits","daytona_create_sandbox","daytona_delete_sandbox","daytona_download_file","daytona_execute_command","daytona_get_sandbox","daytona_git_clone","daytona_list_files","daytona_list_sandboxes","daytona_run_code","daytona_start_sandbox","daytona_stop_sandbox","daytona_upload_file","deployed_block_executor","deployments_deploy","deployments_get_version","deployments_list_versions","deployments_promote","deployments_undeploy","devin_append_session_tags","devin_archive_session","devin_create_session","devin_get_session","devin_get_session_tags","devin_list_session_attachments","devin_list_session_messages","devin_list_sessions","devin_replace_session_tags","devin_send_message","devin_terminate_session","discord_add_reaction","discord_archive_thread","discord_assign_role","discord_ban_member","discord_bulk_delete_messages","discord_create_channel","discord_create_invite","discord_create_role","discord_create_thread","discord_create_webhook","discord_delete_channel","discord_delete_invite","discord_delete_message","discord_delete_role","discord_delete_webhook","discord_edit_message","discord_execute_webhook","discord_get_channel","discord_get_invite","discord_get_member","discord_get_messages","discord_get_pinned_messages","discord_get_server","discord_get_user","discord_get_webhook","discord_join_thread","discord_kick_member","discord_leave_thread","discord_list_channels","discord_list_roles","discord_pin_message","discord_remove_reaction","discord_remove_role","discord_send_message","discord_unban_member","discord_unpin_message","discord_update_channel","discord_update_member","discord_update_role","docusign_create_from_template","docusign_download_document","docusign_get_envelope","docusign_list_envelopes","docusign_list_recipients","docusign_list_templates","docusign_send_envelope","docusign_void_envelope","downdetector_get_company","downdetector_get_company_attribution","downdetector_get_company_baseline","downdetector_get_company_events","downdetector_get_company_incidents","downdetector_get_company_indicators","downdetector_get_company_last_15","downdetector_get_company_status","downdetector_get_provider","downdetector_get_reports","downdetector_get_site_companies","downdetector_list_categories","downdetector_list_incidents","downdetector_list_sites","downdetector_search_companies","dropbox_copy","dropbox_create_folder","dropbox_create_shared_link","dropbox_delete","dropbox_download","dropbox_get_metadata","dropbox_list_folder","dropbox_list_revisions","dropbox_list_shared_links","dropbox_move","dropbox_restore","dropbox_search","dropbox_upload","dropcontact_enrich_contact","dspy_chain_of_thought","dspy_predict","dspy_react","dub_bulk_create_links","dub_bulk_delete_links","dub_bulk_update_links","dub_create_link","dub_create_tag","dub_delete_link","dub_get_analytics","dub_get_events","dub_get_link","dub_get_links_count","dub_get_qr_code","dub_list_domains","dub_list_folders","dub_list_links","dub_list_tags","dub_update_link","dub_upsert_link","duckduckgo_search","dynamodb_delete","dynamodb_get","dynamodb_introspect","dynamodb_put","dynamodb_query","dynamodb_scan","dynamodb_update","dynatrace_add_problem_comment","dynatrace_add_tags","dynatrace_close_problem","dynatrace_create_settings_object","dynatrace_create_slo","dynatrace_delete_problem_comment","dynatrace_delete_settings_object","dynatrace_delete_slo","dynatrace_delete_tag","dynatrace_execute_synthetic_monitors","dynatrace_get_attack","dynatrace_get_audit_logs","dynatrace_get_entity","dynatrace_get_event","dynatrace_get_metric","dynatrace_get_problem","dynatrace_get_problem_comment","dynatrace_get_security_problem","dynatrace_get_settings_object","dynatrace_get_slo","dynatrace_get_synthetic_batch","dynatrace_ingest_event","dynatrace_ingest_logs","dynatrace_ingest_metrics","dynatrace_list_attacks","dynatrace_list_entities","dynatrace_list_entity_types","dynatrace_list_events","dynatrace_list_metrics","dynatrace_list_problem_comments","dynatrace_list_problems","dynatrace_list_remediation_items","dynatrace_list_security_problems","dynatrace_list_settings_objects","dynatrace_list_settings_schemas","dynatrace_list_slos","dynatrace_list_synthetic_monitors","dynatrace_list_tags","dynatrace_mute_security_problem","dynatrace_mute_security_problems","dynatrace_query_metrics","dynatrace_search_logs","dynatrace_unmute_security_problem","dynatrace_unmute_security_problems","dynatrace_update_problem_comment","dynatrace_update_settings_object","dynatrace_update_slo","elasticsearch_bulk","elasticsearch_cluster_health","elasticsearch_cluster_stats","elasticsearch_count","elasticsearch_create_index","elasticsearch_delete_document","elasticsearch_delete_index","elasticsearch_get_document","elasticsearch_get_index","elasticsearch_index_document","elasticsearch_list_indices","elasticsearch_search","elasticsearch_update_document","elevenlabs_audio_isolation","elevenlabs_edit_voice_settings","elevenlabs_get_user","elevenlabs_get_voice","elevenlabs_get_voice_settings","elevenlabs_list_models","elevenlabs_list_voices","elevenlabs_sound_effects","elevenlabs_speech_to_speech","elevenlabs_tts","emailbison_attach_leads_to_campaign","emailbison_attach_tags_to_leads","emailbison_create_campaign","emailbison_create_lead","emailbison_create_tag","emailbison_get_lead","emailbison_list_campaigns","emailbison_list_leads","emailbison_list_replies","emailbison_list_tags","emailbison_update_campaign","emailbison_update_campaign_status","emailbison_update_lead","embeddings_cohere","embeddings_gemini","embeddings_mistral","embeddings_ollama","embeddings_openai","embeddings_openrouter","enrich_check_credits","enrich_company_funding","enrich_company_lookup","enrich_company_revenue","enrich_disposable_email_check","enrich_email_to_ip","enrich_email_to_person_lite","enrich_email_to_phone","enrich_email_to_profile","enrich_find_email","enrich_get_post_details","enrich_ip_to_company","enrich_linkedin_profile","enrich_linkedin_to_personal_email","enrich_linkedin_to_work_email","enrich_phone_finder","enrich_reverse_hash_lookup","enrich_sales_pointer_people","enrich_search_company","enrich_search_company_activities","enrich_search_company_employees","enrich_search_jobs","enrich_search_logo","enrich_search_people","enrich_search_people_activities","enrich_search_post_comments","enrich_search_post_comments_by_url","enrich_search_post_reactions","enrich_search_post_reactions_by_url","enrich_search_posts","enrich_search_similar_companies","enrich_verify_email","enrichment_run","enrow_find_email","enrow_verify_email","exa_agent","exa_answer","exa_find_similar_links","exa_get_contents","exa_search","extend_parser","extend_parser_v2","fathom_get_summary","fathom_get_transcript","fathom_list_meeting_types","fathom_list_meetings","fathom_list_team_members","fathom_list_teams","file_append","file_compress","file_create_folder","file_decompress","file_delete_folder","file_edit","file_fetch","file_get","file_get_content","file_list","file_manage_sharing","file_move","file_parser","file_parser_v2","file_parser_v3","file_read","file_restore_folder","file_search","file_update_folder","file_write","findymail_find_email_from_linkedin","findymail_find_email_from_name","findymail_find_emails_by_domain","findymail_find_employees","findymail_find_phone","findymail_get_company","findymail_get_credits","findymail_lookup_technologies","findymail_reverse_email_lookup","findymail_search_technologies","findymail_verify_email","firecrawl_agent","firecrawl_batch_scrape","firecrawl_batch_scrape_status","firecrawl_cancel_crawl","firecrawl_crawl","firecrawl_crawl_status","firecrawl_credit_usage","firecrawl_extract","firecrawl_extract_status","firecrawl_map","firecrawl_parse","firecrawl_scrape","firecrawl_search","fireflies_add_to_live_meeting","fireflies_create_bite","fireflies_delete_transcript","fireflies_get_transcript","fireflies_get_user","fireflies_list_bites","fireflies_list_contacts","fireflies_list_transcripts","fireflies_list_users","fireflies_upload_audio","flint_create_task","flint_generate_pages","flint_get_task","function_execute","gamma_check_status","gamma_generate","gamma_generate_from_template","gamma_list_folders","gamma_list_themes","github_add_assignees","github_add_assignees_v2","github_add_labels","github_add_labels_v2","github_cancel_workflow_run","github_cancel_workflow_run_v2","github_check_star","github_check_star_v2","github_close_issue","github_close_issue_v2","github_close_pr","github_close_pr_v2","github_comment","github_comment_v2","github_compare_commits","github_compare_commits_v2","github_create_branch","github_create_branch_v2","github_create_comment_reaction","github_create_comment_reaction_v2","github_create_file","github_create_file_v2","github_create_gist","github_create_gist_v2","github_create_issue","github_create_issue_reaction","github_create_issue_reaction_v2","github_create_issue_v2","github_create_milestone","github_create_milestone_v2","github_create_pr","github_create_pr_review","github_create_pr_review_v2","github_create_pr_v2","github_create_project","github_create_project_v2","github_create_release","github_create_release_v2","github_delete_branch","github_delete_branch_v2","github_delete_comment","github_delete_comment_reaction","github_delete_comment_reaction_v2","github_delete_comment_v2","github_delete_file","github_delete_file_v2","github_delete_gist","github_delete_gist_v2","github_delete_issue_reaction","github_delete_issue_reaction_v2","github_delete_milestone","github_delete_milestone_v2","github_delete_project","github_delete_project_v2","github_delete_release","github_delete_release_v2","github_fork_gist","github_fork_gist_v2","github_fork_repo","github_fork_repo_v2","github_get_branch","github_get_branch_protection","github_get_branch_protection_v2","github_get_branch_v2","github_get_commit","github_get_commit_v2","github_get_file_content","github_get_file_content_v2","github_get_gist","github_get_gist_v2","github_get_issue","github_get_issue_v2","github_get_latest_release","github_get_latest_release_v2","github_get_milestone","github_get_milestone_v2","github_get_pr_files","github_get_pr_files_v2","github_get_project","github_get_project_v2","github_get_readme","github_get_readme_v2","github_get_release","github_get_release_v2","github_get_tree","github_get_tree_v2","github_get_workflow","github_get_workflow_run","github_get_workflow_run_v2","github_get_workflow_v2","github_issue_comment","github_issue_comment_v2","github_job_logs","github_latest_commit","github_latest_commit_v2","github_list_branches","github_list_branches_v2","github_list_commits","github_list_commits_v2","github_list_forks","github_list_forks_v2","github_list_gists","github_list_gists_v2","github_list_issue_comments","github_list_issue_comments_v2","github_list_issues","github_list_issues_v2","github_list_milestones","github_list_milestones_v2","github_list_pr_comments","github_list_pr_comments_v2","github_list_projects","github_list_projects_v2","github_list_prs","github_list_prs_v2","github_list_releases","github_list_releases_v2","github_list_review_threads","github_list_stargazers","github_list_stargazers_v2","github_list_tags","github_list_tags_v2","github_list_workflow_runs","github_list_workflow_runs_v2","github_list_workflows","github_list_workflows_v2","github_merge_pr","github_merge_pr_v2","github_pr","github_pr_v2","github_remove_label","github_remove_label_v2","github_reply_review_thread","github_repo_info","github_repo_info_v2","github_request_reviewers","github_request_reviewers_v2","github_rerun_workflow","github_rerun_workflow_v2","github_resolve_review_thread","github_search_code","github_search_code_v2","github_search_commits","github_search_commits_v2","github_search_issues","github_search_issues_v2","github_search_repos","github_search_repos_v2","github_search_users","github_search_users_v2","github_star_gist","github_star_gist_v2","github_star_repo","github_star_repo_v2","github_status_check_rollup","github_trigger_workflow","github_trigger_workflow_v2","github_unstar_gist","github_unstar_gist_v2","github_unstar_repo","github_unstar_repo_v2","github_update_branch_protection","github_update_branch_protection_v2","github_update_comment","github_update_comment_v2","github_update_file","github_update_file_v2","github_update_gist","github_update_gist_v2","github_update_issue","github_update_issue_v2","github_update_milestone","github_update_milestone_v2","github_update_pr","github_update_pr_v2","github_update_project","github_update_project_v2","github_update_release","github_update_release_v2","gitlab_activate_user","gitlab_add_member","gitlab_add_saml_group_link","gitlab_approve_access_request","gitlab_approve_merge_request","gitlab_approve_user","gitlab_ban_user","gitlab_block_user","gitlab_cancel_pipeline","gitlab_compare_branches","gitlab_create_branch","gitlab_create_file","gitlab_create_issue","gitlab_create_issue_note","gitlab_create_merge_request","gitlab_create_merge_request_note","gitlab_create_pipeline","gitlab_create_release","gitlab_create_user","gitlab_deactivate_user","gitlab_delete_branch","gitlab_delete_issue","gitlab_delete_saml_group_link","gitlab_delete_user","gitlab_delete_user_identity","gitlab_deny_access_request","gitlab_get_file","gitlab_get_group","gitlab_get_issue","gitlab_get_job_log","gitlab_get_merge_request","gitlab_get_merge_request_changes","gitlab_get_pipeline","gitlab_get_project","gitlab_invite_member","gitlab_list_access_requests","gitlab_list_branches","gitlab_list_commits","gitlab_list_groups","gitlab_list_invitations","gitlab_list_issues","gitlab_list_members","gitlab_list_merge_requests","gitlab_list_pipeline_jobs","gitlab_list_pipelines","gitlab_list_projects","gitlab_list_releases","gitlab_list_repository_tree","gitlab_list_saml_group_links","gitlab_list_user_memberships","gitlab_merge_merge_request","gitlab_play_job","gitlab_reject_user","gitlab_remove_member","gitlab_retry_pipeline","gitlab_revoke_invitation","gitlab_search_users","gitlab_unban_user","gitlab_unblock_user","gitlab_update_file","gitlab_update_invitation","gitlab_update_issue","gitlab_update_member","gitlab_update_merge_request","gitlab_update_user","gmail_add_label","gmail_add_label_v2","gmail_archive","gmail_archive_v2","gmail_create_label_v2","gmail_delete","gmail_delete_draft_v2","gmail_delete_label_v2","gmail_delete_v2","gmail_draft","gmail_draft_v2","gmail_edit_draft_v2","gmail_get_draft_v2","gmail_get_thread_v2","gmail_list_drafts_v2","gmail_list_labels_v2","gmail_list_threads_v2","gmail_mark_read","gmail_mark_read_v2","gmail_mark_unread","gmail_mark_unread_v2","gmail_move","gmail_move_v2","gmail_read","gmail_read_v2","gmail_remove_label","gmail_remove_label_v2","gmail_search","gmail_search_v2","gmail_send","gmail_send_v2","gmail_trash_thread_v2","gmail_unarchive","gmail_unarchive_v2","gmail_untrash_thread_v2","gmail_update_label_v2","gong_aggregate_activity","gong_aggregate_by_period","gong_answered_scorecards","gong_ask_anything","gong_assign_flow_prospects","gong_create_call","gong_day_by_day_activity","gong_get_brief","gong_get_call","gong_get_call_transcript","gong_get_coaching","gong_get_extensive_calls","gong_get_folder_content","gong_get_logs","gong_get_prospect_flows","gong_get_user","gong_interaction_stats","gong_list_calls","gong_list_flows","gong_list_library_folders","gong_list_scorecards","gong_list_trackers","gong_list_users","gong_list_workspaces","gong_lookup_email","gong_lookup_phone","gong_purge_email_address","gong_purge_phone_number","gong_unassign_flow_prospects","google_ads_ad_performance","google_ads_campaign_performance","google_ads_list_ad_groups","google_ads_list_campaigns","google_ads_list_customers","google_ads_search","google_appsheet_add_rows","google_appsheet_delete_rows","google_appsheet_edit_rows","google_appsheet_find_rows","google_bigquery_create_dataset","google_bigquery_create_table","google_bigquery_delete_dataset","google_bigquery_delete_table","google_bigquery_get_query_results","google_bigquery_get_table","google_bigquery_insert_rows","google_bigquery_list_datasets","google_bigquery_list_table_data","google_bigquery_list_tables","google_bigquery_query","google_books_volume_details","google_books_volume_search","google_calendar_create","google_calendar_create_calendar","google_calendar_create_calendar_v2","google_calendar_create_v2","google_calendar_delete","google_calendar_delete_calendar","google_calendar_delete_calendar_v2","google_calendar_delete_v2","google_calendar_freebusy","google_calendar_freebusy_v2","google_calendar_get","google_calendar_get_v2","google_calendar_instances","google_calendar_instances_v2","google_calendar_invite","google_calendar_invite_v2","google_calendar_list","google_calendar_list_acl","google_calendar_list_acl_v2","google_calendar_list_calendars","google_calendar_list_calendars_v2","google_calendar_list_v2","google_calendar_move","google_calendar_move_v2","google_calendar_quick_add","google_calendar_quick_add_v2","google_calendar_share_calendar","google_calendar_share_calendar_v2","google_calendar_unshare_calendar","google_calendar_unshare_calendar_v2","google_calendar_update","google_calendar_update_acl","google_calendar_update_acl_v2","google_calendar_update_calendar","google_calendar_update_calendar_v2","google_calendar_update_v2","google_contacts_create","google_contacts_delete","google_contacts_get","google_contacts_list","google_contacts_search","google_contacts_update","google_docs_create","google_docs_create_named_range","google_docs_create_paragraph_bullets","google_docs_delete_content_range","google_docs_delete_named_range","google_docs_delete_paragraph_bullets","google_docs_insert_image","google_docs_insert_page_break","google_docs_insert_table","google_docs_insert_text","google_docs_read","google_docs_replace_text","google_docs_update_paragraph_style","google_docs_update_text_style","google_docs_write","google_drive_copy","google_drive_create_comment","google_drive_create_folder","google_drive_delete","google_drive_delete_comment","google_drive_download","google_drive_export","google_drive_get_about","google_drive_get_content","google_drive_get_file","google_drive_get_revision","google_drive_list","google_drive_list_comments","google_drive_list_permissions","google_drive_list_revisions","google_drive_move","google_drive_search","google_drive_share","google_drive_trash","google_drive_unshare","google_drive_untrash","google_drive_update","google_drive_upload","google_forms_batch_update","google_forms_create_form","google_forms_create_watch","google_forms_delete_watch","google_forms_get_form","google_forms_get_responses","google_forms_list_watches","google_forms_renew_watch","google_forms_set_publish_settings","google_groups_add_alias","google_groups_add_member","google_groups_create_group","google_groups_delete_group","google_groups_get_group","google_groups_get_member","google_groups_get_settings","google_groups_has_member","google_groups_list_aliases","google_groups_list_groups","google_groups_list_members","google_groups_remove_alias","google_groups_remove_member","google_groups_update_group","google_groups_update_member","google_groups_update_settings","google_maps_air_quality","google_maps_directions","google_maps_distance_matrix","google_maps_elevation","google_maps_geocode","google_maps_geolocate","google_maps_place_details","google_maps_places_nearby","google_maps_places_search","google_maps_pollen","google_maps_reverse_geocode","google_maps_snap_to_roads","google_maps_solar","google_maps_speed_limits","google_maps_timezone","google_maps_validate_address","google_meet_create_space","google_meet_end_conference","google_meet_get_conference_record","google_meet_get_space","google_meet_list_conference_records","google_meet_list_participants","google_pagespeed_analyze","google_search","google_sheets_append","google_sheets_append_v2","google_sheets_batch_clear_v2","google_sheets_batch_get_v2","google_sheets_batch_update_v2","google_sheets_clear_v2","google_sheets_copy_sheet_v2","google_sheets_create_spreadsheet_v2","google_sheets_delete_rows_v2","google_sheets_delete_sheet_v2","google_sheets_delete_spreadsheet_v2","google_sheets_get_spreadsheet_v2","google_sheets_read","google_sheets_read_v2","google_sheets_update","google_sheets_update_v2","google_sheets_write","google_sheets_write_v2","google_slides_add_image","google_slides_add_slide","google_slides_batch_update","google_slides_copy_presentation","google_slides_create","google_slides_create_line","google_slides_create_paragraph_bullets","google_slides_create_shape","google_slides_create_sheets_chart","google_slides_create_table","google_slides_create_video","google_slides_delete_object","google_slides_delete_paragraph_bullets","google_slides_delete_table_column","google_slides_delete_table_row","google_slides_delete_text","google_slides_duplicate_object","google_slides_export_presentation","google_slides_get_page","google_slides_get_thumbnail","google_slides_group_objects","google_slides_insert_table_columns","google_slides_insert_table_rows","google_slides_insert_text","google_slides_merge_table_cells","google_slides_read","google_slides_refresh_sheets_chart","google_slides_replace_all_shapes_with_image","google_slides_replace_all_shapes_with_sheets_chart","google_slides_replace_all_text","google_slides_replace_image","google_slides_reroute_line","google_slides_ungroup_objects","google_slides_unmerge_table_cells","google_slides_update_image_properties","google_slides_update_line_category","google_slides_update_line_properties","google_slides_update_page_element_alt_text","google_slides_update_page_element_transform","google_slides_update_page_elements_z_order","google_slides_update_page_properties","google_slides_update_paragraph_style","google_slides_update_shape_properties","google_slides_update_slide_properties","google_slides_update_slides_position","google_slides_update_table_border_properties","google_slides_update_table_cell_properties","google_slides_update_table_column_properties","google_slides_update_table_row_properties","google_slides_update_text_style","google_slides_update_video_properties","google_slides_write","google_tasks_create","google_tasks_delete","google_tasks_get","google_tasks_list","google_tasks_list_task_lists","google_tasks_update","google_translate_detect","google_translate_text","google_vault_add_held_accounts","google_vault_add_matters_permissions","google_vault_close_matters","google_vault_create_matters","google_vault_create_matters_export","google_vault_create_matters_holds","google_vault_create_saved_query","google_vault_delete_matters","google_vault_delete_matters_export","google_vault_delete_matters_holds","google_vault_delete_saved_query","google_vault_download_export_file","google_vault_list_matters","google_vault_list_matters_export","google_vault_list_matters_holds","google_vault_list_saved_queries","google_vault_remove_held_accounts","google_vault_remove_matters_permissions","google_vault_reopen_matters","google_vault_undelete_matters","google_vault_update_matters","google_vault_update_matters_holds","grafana_check_data_source_health","grafana_create_alert_rule","grafana_create_annotation","grafana_create_contact_point","grafana_create_dashboard","grafana_create_folder","grafana_delete_alert_rule","grafana_delete_annotation","grafana_delete_contact_point","grafana_delete_dashboard","grafana_delete_folder","grafana_get_alert_rule","grafana_get_alert_rule_group","grafana_get_dashboard","grafana_get_data_source","grafana_get_folder","grafana_get_health","grafana_list_alert_rules","grafana_list_annotations","grafana_list_contact_points","grafana_list_dashboards","grafana_list_data_sources","grafana_list_folders","grafana_move_folder","grafana_query_data_source","grafana_update_alert_rule","grafana_update_annotation","grafana_update_contact_point","grafana_update_dashboard","grafana_update_folder","grain_create_hook","grain_create_hook_v2","grain_delete_hook","grain_delete_hook_v2","grain_get_recording","grain_get_transcript","grain_list_hooks","grain_list_hooks_v2","grain_list_meeting_types","grain_list_recordings","grain_list_teams","grain_list_views","granola_create_webhook_endpoint","granola_delete_webhook_endpoint","granola_get_note","granola_get_transcript","granola_list_audit_events","granola_list_folders","granola_list_notes","granola_list_webhook_endpoints","granola_update_webhook_endpoint","greenhouse_get_application","greenhouse_get_candidate","greenhouse_get_job","greenhouse_get_user","greenhouse_list_applications","greenhouse_list_candidates","greenhouse_list_departments","greenhouse_list_job_stages","greenhouse_list_jobs","greenhouse_list_offices","greenhouse_list_users","greptile_index_repo","greptile_query","greptile_search","greptile_status","guardrails_validate","harmonic_batch_get_people","harmonic_clear_people_saved_search_net_new_results","harmonic_enrich_person","harmonic_get_company_employees","harmonic_get_email_enrichment_job","harmonic_get_email_enrichment_usage","harmonic_get_enrichment_status","harmonic_get_people_saved_search_net_new_results","harmonic_get_people_saved_search_results","harmonic_get_person","harmonic_list_people_saved_searches","harmonic_search_people_scout","harmonic_submit_email_enrichment_job","hex_cancel_run","hex_create_collection","hex_create_group","hex_deactivate_user","hex_delete_group","hex_get_collection","hex_get_data_connection","hex_get_group","hex_get_project","hex_get_project_runs","hex_get_queried_tables","hex_get_run_status","hex_list_collections","hex_list_data_connections","hex_list_groups","hex_list_projects","hex_list_users","hex_run_project","hex_update_collection","hex_update_group","hex_update_project","http_request","hubspot_add_list_memberships","hubspot_create_appointment","hubspot_create_association","hubspot_create_company","hubspot_create_contact","hubspot_create_deal","hubspot_create_email","hubspot_create_line_item","hubspot_create_list","hubspot_create_note","hubspot_create_ticket","hubspot_delete_association","hubspot_delete_company","hubspot_delete_contact","hubspot_delete_deal","hubspot_delete_line_item","hubspot_delete_ticket","hubspot_get_appointment","hubspot_get_association_labels","hubspot_get_cart","hubspot_get_company","hubspot_get_contact","hubspot_get_deal","hubspot_get_email","hubspot_get_line_item","hubspot_get_list","hubspot_get_list_memberships","hubspot_get_marketing_event","hubspot_get_note","hubspot_get_properties","hubspot_get_quote","hubspot_get_ticket","hubspot_get_users","hubspot_list_appointments","hubspot_list_associations","hubspot_list_carts","hubspot_list_companies","hubspot_list_contacts","hubspot_list_deals","hubspot_list_emails","hubspot_list_line_items","hubspot_list_lists","hubspot_list_marketing_events","hubspot_list_notes","hubspot_list_owners","hubspot_list_quotes","hubspot_list_tickets","hubspot_remove_list_memberships","hubspot_search_companies","hubspot_search_contacts","hubspot_search_deals","hubspot_search_emails","hubspot_search_line_items","hubspot_search_notes","hubspot_search_quotes","hubspot_search_tickets","hubspot_update_appointment","hubspot_update_company","hubspot_update_contact","hubspot_update_deal","hubspot_update_line_item","hubspot_update_ticket","huggingface_chat","hunter_companies_find","hunter_discover","hunter_domain_search","hunter_email_count","hunter_email_finder","hunter_email_verifier","iam_add_user_to_group","iam_attach_role_policy","iam_attach_user_policy","iam_create_access_key","iam_create_role","iam_create_user","iam_delete_access_key","iam_delete_role","iam_delete_user","iam_detach_role_policy","iam_detach_user_policy","iam_get_role","iam_get_user","iam_list_attached_role_policies","iam_list_attached_user_policies","iam_list_groups","iam_list_policies","iam_list_roles","iam_list_users","iam_remove_user_from_group","iam_simulate_principal_policy","icypeas_find_email","icypeas_verify_email","identity_center_check_assignment_deletion_status","identity_center_check_assignment_status","identity_center_create_account_assignment","identity_center_delete_account_assignment","identity_center_describe_account","identity_center_get_group","identity_center_get_user","identity_center_list_account_assignments","identity_center_list_accounts","identity_center_list_groups","identity_center_list_instances","identity_center_list_permission_sets","image_generate","incidentio_actions_create","incidentio_actions_list","incidentio_actions_show","incidentio_actions_update","incidentio_alert_events_create","incidentio_alerts_list","incidentio_alerts_resolve","incidentio_alerts_show","incidentio_catalog_entries_list","incidentio_catalog_types_list","incidentio_custom_fields_create","incidentio_custom_fields_delete","incidentio_custom_fields_list","incidentio_custom_fields_show","incidentio_custom_fields_update","incidentio_escalation_paths_create","incidentio_escalation_paths_delete","incidentio_escalation_paths_list","incidentio_escalation_paths_show","incidentio_escalation_paths_update","incidentio_escalations_cancel","incidentio_escalations_create","incidentio_escalations_list","incidentio_escalations_show","incidentio_follow_ups_create","incidentio_follow_ups_list","incidentio_follow_ups_show","incidentio_follow_ups_update","incidentio_incident_alerts_list","incidentio_incident_memberships_create","incidentio_incident_memberships_revoke","incidentio_incident_participants_list","incidentio_incident_roles_create","incidentio_incident_roles_delete","incidentio_incident_roles_list","incidentio_incident_roles_show","incidentio_incident_roles_update","incidentio_incident_statuses_list","incidentio_incident_timestamps_list","incidentio_incident_timestamps_show","incidentio_incident_types_list","incidentio_incident_updates_list","incidentio_incidents_create","incidentio_incidents_list","incidentio_incidents_show","incidentio_incidents_update","incidentio_on_call_now","incidentio_schedule_entries_list","incidentio_schedule_overrides_create","incidentio_schedule_overrides_list","incidentio_schedules_create","incidentio_schedules_delete","incidentio_schedules_list","incidentio_schedules_show","incidentio_schedules_update","incidentio_severities_list","incidentio_teams_list","incidentio_teams_show","incidentio_users_list","incidentio_users_show","incidentio_workflows_create","incidentio_workflows_delete","incidentio_workflows_list","incidentio_workflows_show","incidentio_workflows_update","infisical_create_secret","infisical_delete_secret","infisical_get_secret","infisical_list_secrets","infisical_update_secret","instagram_delete_comment","instagram_download_media","instagram_get_account_insights","instagram_get_container_status","instagram_get_conversation_messages","instagram_get_media","instagram_get_media_insights","instagram_get_message","instagram_get_profile","instagram_get_publishing_limit","instagram_hide_comment","instagram_list_comments","instagram_list_conversations","instagram_list_media","instagram_list_stories","instagram_private_reply","instagram_publish_carousel","instagram_publish_image","instagram_publish_reel","instagram_publish_story","instagram_publish_video","instagram_reply_to_comment","instagram_send_text_message","instagram_set_comments_enabled","instantly_activate_campaign","instantly_create_campaign","instantly_create_lead","instantly_create_lead_list","instantly_delete_campaign","instantly_delete_leads","instantly_get_lead","instantly_list_campaigns","instantly_list_emails","instantly_list_lead_lists","instantly_list_leads","instantly_patch_campaign","instantly_patch_lead","instantly_pause_campaign","instantly_reply_to_email","instantly_update_lead_interest_status","intercom_assign_conversation_v2","intercom_attach_contact_to_company_v2","intercom_close_conversation_v2","intercom_create_company","intercom_create_company_v2","intercom_create_contact","intercom_create_contact_v2","intercom_create_event_v2","intercom_create_message","intercom_create_message_v2","intercom_create_note_v2","intercom_create_tag_v2","intercom_create_ticket","intercom_create_ticket_v2","intercom_delete_contact","intercom_delete_contact_v2","intercom_detach_contact_from_company_v2","intercom_get_company","intercom_get_company_v2","intercom_get_contact","intercom_get_contact_v2","intercom_get_conversation","intercom_get_conversation_v2","intercom_get_ticket","intercom_get_ticket_v2","intercom_list_admins_v2","intercom_list_companies","intercom_list_companies_v2","intercom_list_contacts","intercom_list_contacts_v2","intercom_list_conversations","intercom_list_conversations_v2","intercom_list_tags_v2","intercom_open_conversation_v2","intercom_reply_conversation","intercom_reply_conversation_v2","intercom_search_contacts","intercom_search_contacts_v2","intercom_search_conversations","intercom_search_conversations_v2","intercom_snooze_conversation_v2","intercom_tag_contact_v2","intercom_tag_conversation_v2","intercom_untag_contact_v2","intercom_update_contact","intercom_update_contact_v2","intercom_update_ticket_v2","jina_read_url","jina_search","jira_add_attachment","jira_add_comment","jira_add_watcher","jira_add_worklog","jira_assign_issue","jira_bulk_read","jira_create_issue_link","jira_delete_attachment","jira_delete_comment","jira_delete_issue","jira_delete_issue_link","jira_delete_worklog","jira_get_attachments","jira_get_comments","jira_get_fields","jira_get_project","jira_get_transitions","jira_get_users","jira_get_worklogs","jira_list_issue_types","jira_list_projects","jira_remove_watcher","jira_retrieve","jira_search_issues","jira_search_users","jira_transition_issue","jira_update","jira_update_comment","jira_update_worklog","jira_write","jotform_add_label_resources","jotform_clone_form","jotform_create_form","jotform_create_label","jotform_create_question","jotform_create_questions","jotform_create_report","jotform_create_submission","jotform_create_submissions","jotform_create_webhook","jotform_delete_form","jotform_delete_label","jotform_delete_question","jotform_delete_report","jotform_delete_submission","jotform_delete_webhook","jotform_get_form","jotform_get_form_properties","jotform_get_history","jotform_get_label","jotform_get_question","jotform_get_report","jotform_get_settings","jotform_get_submission","jotform_get_usage","jotform_get_user","jotform_list_form_files","jotform_list_form_reports","jotform_list_form_submissions","jotform_list_forms","jotform_list_label_resources","jotform_list_labels","jotform_list_questions","jotform_list_reports","jotform_list_submissions","jotform_list_subusers","jotform_list_webhooks","jotform_remove_label_resources","jotform_update_form_properties","jotform_update_label","jotform_update_question","jotform_update_settings","jotform_update_submission","jsm_add_comment","jsm_add_customer","jsm_add_organization","jsm_add_participants","jsm_answer_approval","jsm_attach_form","jsm_copy_forms","jsm_create_object","jsm_create_organization","jsm_create_request","jsm_delete_form","jsm_delete_object","jsm_externalise_form","jsm_get_approvals","jsm_get_comments","jsm_get_customers","jsm_get_form","jsm_get_form_answers","jsm_get_form_structure","jsm_get_form_templates","jsm_get_issue_forms","jsm_get_object","jsm_get_object_schema","jsm_get_object_type_attributes","jsm_get_organizations","jsm_get_participants","jsm_get_queues","jsm_get_request","jsm_get_request_type_fields","jsm_get_request_types","jsm_get_requests","jsm_get_service_desks","jsm_get_sla","jsm_get_transitions","jsm_internalise_form","jsm_list_object_schemas","jsm_list_object_types","jsm_reopen_form","jsm_save_form_answers","jsm_search_objects_aql","jsm_submit_form","jsm_transition_request","jsm_update_object","jupyter_copy_content","jupyter_create_file","jupyter_create_session","jupyter_delete_content","jupyter_delete_session","jupyter_get_content","jupyter_interrupt_kernel","jupyter_list_contents","jupyter_list_kernels","jupyter_list_kernelspecs","jupyter_list_sessions","jupyter_rename_content","jupyter_restart_kernel","jupyter_start_kernel","jupyter_stop_kernel","jupyter_upload_file","kalshi_amend_order","kalshi_amend_order_v2","kalshi_cancel_order","kalshi_cancel_order_v2","kalshi_create_order","kalshi_create_order_v2","kalshi_get_balance","kalshi_get_balance_v2","kalshi_get_candlesticks","kalshi_get_candlesticks_v2","kalshi_get_event","kalshi_get_event_candlesticks","kalshi_get_event_candlesticks_v2","kalshi_get_event_v2","kalshi_get_events","kalshi_get_events_v2","kalshi_get_exchange_announcements","kalshi_get_exchange_announcements_v2","kalshi_get_exchange_schedule","kalshi_get_exchange_schedule_v2","kalshi_get_exchange_status","kalshi_get_exchange_status_v2","kalshi_get_fills","kalshi_get_fills_v2","kalshi_get_market","kalshi_get_market_v2","kalshi_get_markets","kalshi_get_markets_v2","kalshi_get_order","kalshi_get_order_v2","kalshi_get_orderbook","kalshi_get_orderbook_v2","kalshi_get_orders","kalshi_get_orders_v2","kalshi_get_positions","kalshi_get_positions_v2","kalshi_get_series_by_ticker","kalshi_get_series_by_ticker_v2","kalshi_get_series_list","kalshi_get_series_list_v2","kalshi_get_settlements","kalshi_get_settlements_v2","kalshi_get_trades","kalshi_get_trades_v2","ketch_get_consent","ketch_get_subscriptions","ketch_invoke_right","ketch_set_consent","ketch_set_subscriptions","knowledge_create_document","knowledge_delete_chunk","knowledge_delete_document","knowledge_get_connector","knowledge_get_document","knowledge_list_chunks","knowledge_list_connectors","knowledge_list_documents","knowledge_list_tags","knowledge_search","knowledge_trigger_sync","knowledge_update_chunk","knowledge_upload_chunk","knowledge_upsert_document","lambda_add_permission","lambda_create_alias","lambda_create_event_source_mapping","lambda_create_function","lambda_create_function_url_config","lambda_delete_alias","lambda_delete_event_source_mapping","lambda_delete_function","lambda_delete_function_concurrency","lambda_delete_function_event_invoke_config","lambda_delete_function_url_config","lambda_delete_provisioned_concurrency_config","lambda_get_account_settings","lambda_get_alias","lambda_get_event_source_mapping","lambda_get_function","lambda_get_function_concurrency","lambda_get_function_configuration","lambda_get_function_event_invoke_config","lambda_get_function_recursion_config","lambda_get_function_url_config","lambda_get_layer_version","lambda_get_policy","lambda_get_provisioned_concurrency_config","lambda_get_runtime_management_config","lambda_invoke","lambda_list_aliases","lambda_list_event_source_mappings","lambda_list_function_event_invoke_configs","lambda_list_function_url_configs","lambda_list_functions","lambda_list_layer_versions","lambda_list_layers","lambda_list_provisioned_concurrency_configs","lambda_list_tags","lambda_list_versions_by_function","lambda_publish_version","lambda_put_function_concurrency","lambda_put_function_event_invoke_config","lambda_put_function_recursion_config","lambda_put_provisioned_concurrency_config","lambda_put_runtime_management_config","lambda_remove_permission","lambda_tag_resource","lambda_untag_resource","lambda_update_alias","lambda_update_event_source_mapping","lambda_update_function_code","lambda_update_function_configuration","lambda_update_function_url_config","langsmith_create_feedback","langsmith_create_run","langsmith_create_runs_batch","langsmith_get_run","langsmith_update_run","latex_compile","latex_get_package","latex_list_fonts","latex_search_packages","launchdarkly_create_flag","launchdarkly_delete_flag","launchdarkly_get_audit_log","launchdarkly_get_flag","launchdarkly_get_flag_status","launchdarkly_list_environments","launchdarkly_list_flags","launchdarkly_list_members","launchdarkly_list_projects","launchdarkly_list_segments","launchdarkly_toggle_flag","launchdarkly_update_flag","leadmagic_company_search","leadmagic_email_to_profile","leadmagic_find_email","leadmagic_find_mobile","leadmagic_get_credits","leadmagic_profile_search","leadmagic_profile_to_email","leadmagic_role_finder","leadmagic_validate_email","lemlist_get_activities","lemlist_get_lead","lemlist_send_email","linear_add_label_to_issue","linear_add_label_to_project","linear_archive_issue","linear_archive_label","linear_archive_project","linear_create_attachment","linear_create_comment","linear_create_customer","linear_create_customer_request","linear_create_customer_status","linear_create_customer_tier","linear_create_cycle","linear_create_favorite","linear_create_issue","linear_create_issue_relation","linear_create_label","linear_create_project","linear_create_project_label","linear_create_project_milestone","linear_create_project_status","linear_create_project_update","linear_create_workflow_state","linear_delete_attachment","linear_delete_comment","linear_delete_customer","linear_delete_customer_status","linear_delete_customer_tier","linear_delete_issue","linear_delete_issue_relation","linear_delete_project","linear_delete_project_label","linear_delete_project_milestone","linear_delete_project_status","linear_get_active_cycle","linear_get_customer","linear_get_cycle","linear_get_issue","linear_get_project","linear_get_viewer","linear_list_attachments","linear_list_comments","linear_list_customer_requests","linear_list_customer_statuses","linear_list_customer_tiers","linear_list_customers","linear_list_cycles","linear_list_favorites","linear_list_issue_relations","linear_list_labels","linear_list_notifications","linear_list_project_labels","linear_list_project_milestones","linear_list_project_statuses","linear_list_project_updates","linear_list_projects","linear_list_teams","linear_list_users","linear_list_workflow_states","linear_merge_customers","linear_read_issues","linear_remove_label_from_issue","linear_remove_label_from_project","linear_search_issues","linear_unarchive_issue","linear_update_attachment","linear_update_comment","linear_update_customer","linear_update_customer_request","linear_update_customer_status","linear_update_customer_tier","linear_update_issue","linear_update_label","linear_update_notification","linear_update_project","linear_update_project_label","linear_update_project_milestone","linear_update_project_status","linear_update_workflow_state","linkedin_get_profile","linkedin_share_post","linkup_search","linq_add_participant","linq_check_imessage","linq_check_rcs","linq_create_attachment","linq_create_chat","linq_create_contact_card","linq_create_webhook_subscription","linq_delete_attachment","linq_delete_message","linq_delete_webhook_subscription","linq_edit_message","linq_get_attachment","linq_get_chat","linq_get_contact_card","linq_get_message","linq_get_webhook_subscription","linq_leave_chat","linq_list_chats","linq_list_messages","linq_list_phone_numbers","linq_list_thread","linq_list_webhook_events","linq_list_webhook_subscriptions","linq_mark_chat_read","linq_react_to_message","linq_remove_participant","linq_send_message","linq_send_voice_memo","linq_share_contact_card","linq_start_typing","linq_stop_typing","linq_update_chat","linq_update_contact_card","linq_update_webhook_subscription","llm_chat","logfire_get_token_info","logfire_get_trace","logfire_query","logfire_search_records","logrocket_create_release","logrocket_get_audit_logs","logrocket_get_highlights","logrocket_identify_user","logrocket_list_exported_sessions","logrocket_request_highlights","logs_get","logs_get_execution","logs_get_run_details","logs_query","logs_query_runs","loops_check_contact_suppression","loops_create_contact","loops_create_contact_property","loops_delete_contact","loops_find_contact","loops_get_transactional_email","loops_list_contact_properties","loops_list_mailing_lists","loops_list_transactional_emails","loops_remove_contact_suppression","loops_send_event","loops_send_transactional_email","loops_update_contact","luma_add_guests","luma_cancel_event","luma_create_event","luma_get_event","luma_get_guest","luma_get_guests","luma_list_events","luma_lookup_event","luma_send_invites","luma_update_event","luma_update_guest_status","mailchimp_add_member","mailchimp_add_member_tags","mailchimp_add_or_update_member","mailchimp_add_segment_member","mailchimp_add_subscriber_to_automation","mailchimp_archive_member","mailchimp_create_audience","mailchimp_create_batch_operation","mailchimp_create_campaign","mailchimp_create_interest","mailchimp_create_interest_category","mailchimp_create_landing_page","mailchimp_create_merge_field","mailchimp_create_segment","mailchimp_create_template","mailchimp_delete_audience","mailchimp_delete_batch_operation","mailchimp_delete_campaign","mailchimp_delete_interest","mailchimp_delete_interest_category","mailchimp_delete_landing_page","mailchimp_delete_member","mailchimp_delete_merge_field","mailchimp_delete_segment","mailchimp_delete_template","mailchimp_get_audience","mailchimp_get_audiences","mailchimp_get_automation","mailchimp_get_automations","mailchimp_get_batch_operation","mailchimp_get_batch_operations","mailchimp_get_campaign","mailchimp_get_campaign_content","mailchimp_get_campaign_report","mailchimp_get_campaign_reports","mailchimp_get_campaigns","mailchimp_get_interest","mailchimp_get_interest_categories","mailchimp_get_interest_category","mailchimp_get_interests","mailchimp_get_landing_page","mailchimp_get_landing_pages","mailchimp_get_member","mailchimp_get_member_tags","mailchimp_get_members","mailchimp_get_merge_field","mailchimp_get_merge_fields","mailchimp_get_segment","mailchimp_get_segment_members","mailchimp_get_segments","mailchimp_get_template","mailchimp_get_templates","mailchimp_pause_automation","mailchimp_publish_landing_page","mailchimp_remove_member_tags","mailchimp_remove_segment_member","mailchimp_replicate_campaign","mailchimp_schedule_campaign","mailchimp_send_campaign","mailchimp_set_campaign_content","mailchimp_start_automation","mailchimp_unarchive_member","mailchimp_unpublish_landing_page","mailchimp_unschedule_campaign","mailchimp_update_audience","mailchimp_update_campaign","mailchimp_update_interest","mailchimp_update_interest_category","mailchimp_update_landing_page","mailchimp_update_member","mailchimp_update_merge_field","mailchimp_update_segment","mailchimp_update_template","mailgun_add_list_member","mailgun_create_mailing_list","mailgun_get_domain","mailgun_get_mailing_list","mailgun_get_message","mailgun_list_domains","mailgun_list_messages","mailgun_send_message","managed_agent_archive_session","managed_agent_create_session","managed_agent_delete_session","managed_agent_get_session","managed_agent_interrupt_session","managed_agent_list_events","managed_agent_respond_custom_tool","managed_agent_respond_tool_confirmation","managed_agent_run_session","managed_agent_send_message","managed_agent_update_session","manageengine_sdp_add_change_note","manageengine_sdp_add_problem_note","manageengine_sdp_add_request_note","manageengine_sdp_create_asset","manageengine_sdp_create_change","manageengine_sdp_create_problem","manageengine_sdp_create_request","manageengine_sdp_create_solution","manageengine_sdp_delete_asset","manageengine_sdp_delete_change","manageengine_sdp_delete_problem","manageengine_sdp_delete_request","manageengine_sdp_delete_solution","manageengine_sdp_get_asset","manageengine_sdp_get_change","manageengine_sdp_get_problem","manageengine_sdp_get_request","manageengine_sdp_get_solution","manageengine_sdp_list_assets","manageengine_sdp_list_change_notes","manageengine_sdp_list_changes","manageengine_sdp_list_problem_notes","manageengine_sdp_list_problems","manageengine_sdp_list_request_notes","manageengine_sdp_list_requests","manageengine_sdp_list_solutions","manageengine_sdp_update_asset","manageengine_sdp_update_change","manageengine_sdp_update_problem","manageengine_sdp_update_request","manageengine_sdp_update_solution","mem0_add_memories","mem0_get_memories","mem0_search_memories","memory_add","memory_delete","memory_get","memory_get_all","microsoft_ad_add_directory_role_member","microsoft_ad_add_group_member","microsoft_ad_add_user_app_role_assignment","microsoft_ad_assign_license","microsoft_ad_create_group","microsoft_ad_create_user","microsoft_ad_delete_group","microsoft_ad_delete_user","microsoft_ad_get_conditional_access_policy","microsoft_ad_get_device","microsoft_ad_get_group","microsoft_ad_get_user","microsoft_ad_list_authentication_methods","microsoft_ad_list_conditional_access_policies","microsoft_ad_list_devices","microsoft_ad_list_directory_audits","microsoft_ad_list_directory_role_members","microsoft_ad_list_directory_roles","microsoft_ad_list_group_members","microsoft_ad_list_groups","microsoft_ad_list_service_principal_app_role_assignments","microsoft_ad_list_service_principals","microsoft_ad_list_sign_ins","microsoft_ad_list_subscribed_skus","microsoft_ad_list_user_app_role_assignments","microsoft_ad_list_user_devices","microsoft_ad_list_user_licenses","microsoft_ad_list_users","microsoft_ad_remove_directory_role_member","microsoft_ad_remove_group_member","microsoft_ad_remove_user_app_role_assignment","microsoft_ad_reset_password","microsoft_ad_revoke_sign_in_sessions","microsoft_ad_set_password","microsoft_ad_update_group","microsoft_ad_update_user","microsoft_dataverse_associate","microsoft_dataverse_create_multiple","microsoft_dataverse_create_record","microsoft_dataverse_delete_record","microsoft_dataverse_disassociate","microsoft_dataverse_download_file","microsoft_dataverse_execute_action","microsoft_dataverse_execute_function","microsoft_dataverse_fetchxml_query","microsoft_dataverse_get_entity_metadata","microsoft_dataverse_get_record","microsoft_dataverse_list_records","microsoft_dataverse_search","microsoft_dataverse_update_multiple","microsoft_dataverse_update_record","microsoft_dataverse_upload_file","microsoft_dataverse_upsert_record","microsoft_dataverse_whoami","microsoft_dynamics_365_close_case","microsoft_dynamics_365_close_opportunity","microsoft_dynamics_365_create_record","microsoft_dynamics_365_get_record","microsoft_dynamics_365_list_records","microsoft_dynamics_365_qualify_lead","microsoft_dynamics_365_search_records","microsoft_dynamics_365_update_record","microsoft_excel_clear_range","microsoft_excel_create_table","microsoft_excel_delete_worksheet","microsoft_excel_format_range","microsoft_excel_read","microsoft_excel_read_v2","microsoft_excel_sort_range","microsoft_excel_table_add","microsoft_excel_worksheet_add","microsoft_excel_write","microsoft_excel_write_v2","microsoft_planner_create_bucket","microsoft_planner_create_plan","microsoft_planner_create_task","microsoft_planner_delete_bucket","microsoft_planner_delete_plan","microsoft_planner_delete_task","microsoft_planner_get_plan_details","microsoft_planner_get_task_details","microsoft_planner_list_buckets","microsoft_planner_list_plans","microsoft_planner_read_bucket","microsoft_planner_read_plan","microsoft_planner_read_task","microsoft_planner_update_bucket","microsoft_planner_update_plan","microsoft_planner_update_plan_details","microsoft_planner_update_task","microsoft_planner_update_task_details","microsoft_teams_delete_channel_message","microsoft_teams_delete_chat_message","microsoft_teams_get_message","microsoft_teams_list_channel_members","microsoft_teams_list_channels","microsoft_teams_list_chat_members","microsoft_teams_list_chats","microsoft_teams_list_team_members","microsoft_teams_list_teams","microsoft_teams_read_channel","microsoft_teams_read_chat","microsoft_teams_reply_to_message","microsoft_teams_set_reaction","microsoft_teams_unset_reaction","microsoft_teams_update_channel_message","microsoft_teams_update_chat_message","microsoft_teams_write_channel","microsoft_teams_write_chat","microsoft_word_append","microsoft_word_create","microsoft_word_create_from_template","microsoft_word_export_pdf","microsoft_word_list","microsoft_word_read","microsoft_word_replace_text","microsoft_word_update","millionverifier_get_credits","millionverifier_verify_email","mintlify_create_agent_job","mintlify_create_assistant_message","mintlify_detect_ai_prose","mintlify_get_agent_job","mintlify_get_assistant_caller_stats","mintlify_get_assistant_conversations","mintlify_get_feedback","mintlify_get_feedback_by_page","mintlify_get_page_content","mintlify_get_searches","mintlify_get_update_status","mintlify_get_views","mintlify_get_visitors","mintlify_search","mintlify_send_agent_message","mintlify_trigger_automation","mintlify_trigger_preview","mintlify_trigger_update","mistral_parser","mistral_parser_v2","mistral_parser_v3","modal_call_function","modal_chat_completion","modal_list_models","monday_archive_item","monday_change_column_value","monday_create_board","monday_create_column","monday_create_group","monday_create_item","monday_create_subitem","monday_create_update","monday_delete_item","monday_duplicate_item","monday_get_board","monday_get_groups","monday_get_item","monday_get_items","monday_list_boards","monday_move_item_to_group","monday_search_items","monday_update_item","mongodb_delete","mongodb_execute","mongodb_insert","mongodb_introspect","mongodb_query","mongodb_update","mssql_delete","mssql_execute","mssql_insert","mssql_introspect","mssql_query","mssql_update","mysql_delete","mysql_execute","mysql_insert","mysql_introspect","mysql_query","mysql_update","neo4j_create","neo4j_delete","neo4j_execute","neo4j_introspect","neo4j_merge","neo4j_query","neo4j_update","netsuite_attach_record","netsuite_batch_create_records","netsuite_batch_delete_records","netsuite_batch_get_records","netsuite_batch_update_records","netsuite_batch_upsert_records","netsuite_create_record","netsuite_delete_record","netsuite_detach_record","netsuite_execute_action","netsuite_execute_dataset","netsuite_execute_suiteql","netsuite_get_async_result","netsuite_get_async_status","netsuite_get_governance_limits","netsuite_get_record","netsuite_get_record_form","netsuite_get_record_metadata","netsuite_get_select_options","netsuite_get_server_time","netsuite_get_subresource","netsuite_list_datasets","netsuite_list_record_types","netsuite_list_records","netsuite_transform_record","netsuite_update_record","netsuite_upsert_record","neverbounce_get_credits","neverbounce_verify_email","new_relic_create_deployment_event","new_relic_get_entity","new_relic_nrql_query","new_relic_search_entities","notion_add_database_row","notion_add_database_row_v2","notion_append_blocks","notion_append_blocks_v2","notion_create_comment","notion_create_comment_v2","notion_create_database","notion_create_database_v2","notion_create_page","notion_create_page_v2","notion_delete_block","notion_delete_block_v2","notion_list_comments","notion_list_comments_v2","notion_list_users","notion_list_users_v2","notion_query_database","notion_query_database_v2","notion_read","notion_read_database","notion_read_database_v2","notion_read_v2","notion_retrieve_block","notion_retrieve_block_children","notion_retrieve_block_children_v2","notion_retrieve_block_v2","notion_retrieve_user","notion_retrieve_user_v2","notion_search","notion_search_v2","notion_update_block","notion_update_block_v2","notion_update_page","notion_update_page_v2","notion_write","notion_write_v2","obsidian_append_active","obsidian_append_note","obsidian_append_periodic_note","obsidian_create_note","obsidian_delete_note","obsidian_execute_command","obsidian_get_active","obsidian_get_note","obsidian_get_periodic_note","obsidian_list_commands","obsidian_list_files","obsidian_open_file","obsidian_patch_active","obsidian_patch_note","obsidian_search","okta_activate_group_rule","okta_activate_user","okta_add_user_to_group","okta_assign_group_to_app","okta_assign_user_role","okta_assign_user_to_app","okta_clear_user_sessions","okta_create_group","okta_create_group_rule","okta_create_user","okta_deactivate_group_rule","okta_deactivate_user","okta_delete_group","okta_delete_group_rule","okta_delete_user","okta_enroll_factor","okta_get_app","okta_get_factor","okta_get_group","okta_get_group_rule","okta_get_logs","okta_get_session","okta_get_user","okta_list_app_groups","okta_list_app_users","okta_list_apps","okta_list_factors","okta_list_group_members","okta_list_group_rules","okta_list_groups","okta_list_user_roles","okta_list_users","okta_remove_group_from_app","okta_remove_user_from_app","okta_remove_user_from_group","okta_remove_user_role","okta_reset_all_factors","okta_reset_factor","okta_reset_password","okta_revoke_session","okta_suspend_user","okta_unsuspend_user","okta_update_group","okta_update_user","onedrive_copy","onedrive_create_folder","onedrive_create_share_link","onedrive_delete","onedrive_download","onedrive_get_drive_info","onedrive_get_item","onedrive_list","onedrive_move","onedrive_search","onedrive_upload","onepassword_create_item","onepassword_delete_item","onepassword_get_item","onepassword_get_item_file","onepassword_get_vault","onepassword_list_items","onepassword_list_vaults","onepassword_replace_item","onepassword_resolve_secret","onepassword_update_item","openai_embeddings","openai_image","outlook_calendar_create_event","outlook_calendar_delete_event","outlook_calendar_get_event","outlook_calendar_list_events","outlook_calendar_respond","outlook_calendar_update_event","outlook_copy","outlook_create_folder","outlook_delete","outlook_draft","outlook_forward","outlook_get_attachment","outlook_list_attachments","outlook_list_folders","outlook_mark_read","outlook_mark_unread","outlook_move","outlook_read","outlook_reply","outlook_reply_all","outlook_search","outlook_send","outlook_update_message","pagerduty_add_note","pagerduty_create_incident","pagerduty_get_incident","pagerduty_get_service","pagerduty_list_escalation_policies","pagerduty_list_incident_alerts","pagerduty_list_incidents","pagerduty_list_oncalls","pagerduty_list_schedules","pagerduty_list_services","pagerduty_list_users","pagerduty_merge_incidents","pagerduty_send_event","pagerduty_snooze_incident","pagerduty_update_incident","parallel_deep_research","parallel_extract","parallel_search","pdl_autocomplete","pdl_bulk_company_enrich","pdl_bulk_person_enrich","pdl_clean_company","pdl_clean_location","pdl_clean_school","pdl_company_enrich","pdl_company_search","pdl_person_enrich","pdl_person_identify","pdl_person_search","perplexity_chat","perplexity_search","persona_approve_inquiry","persona_create_account","persona_create_inquiry","persona_create_report","persona_decline_inquiry","persona_expire_inquiry","persona_generate_inquiry_link","persona_get_account","persona_get_case","persona_get_document","persona_get_inquiry","persona_get_report","persona_get_verification","persona_import_accounts","persona_list_accounts","persona_list_cases","persona_list_inquiries","persona_list_inquiry_templates","persona_list_reports","persona_mark_inquiry_for_review","persona_print_inquiry_pdf","persona_redact_account","persona_redact_inquiry","persona_resume_inquiry","persona_update_account","persona_update_inquiry","pinecone_delete_vectors","pinecone_describe_index","pinecone_describe_index_stats","pinecone_fetch","pinecone_generate_embeddings","pinecone_list_indexes","pinecone_list_vector_ids","pinecone_search_text","pinecone_search_vector","pinecone_update_vector","pinecone_upsert_text","pipedrive_create_activity","pipedrive_create_deal","pipedrive_create_lead","pipedrive_create_project","pipedrive_delete_lead","pipedrive_get_activities","pipedrive_get_all_deals","pipedrive_get_deal","pipedrive_get_files","pipedrive_get_leads","pipedrive_get_mail_messages","pipedrive_get_mail_thread","pipedrive_get_pipeline_deals","pipedrive_get_pipelines","pipedrive_get_projects","pipedrive_update_activity","pipedrive_update_deal","pipedrive_update_lead","pitchbook_company_active_investors","pitchbook_company_bio","pitchbook_company_deal_service_providers","pitchbook_company_deals","pitchbook_company_financials","pitchbook_company_general_service_providers","pitchbook_company_industries","pitchbook_company_investors","pitchbook_company_most_recent_debt_financing","pitchbook_company_most_recent_financials","pitchbook_company_most_recent_financing","pitchbook_company_search","pitchbook_company_similar_companies","pitchbook_company_social_analytics","pitchbook_company_updates","pitchbook_company_vc_exit_predictions","pitchbook_contracts_history","pitchbook_cost_of_calls","pitchbook_credit_history","pitchbook_credit_news","pitchbook_credit_news_bulk","pitchbook_credit_news_most_recent","pitchbook_credit_news_search","pitchbook_deal_bio","pitchbook_deal_cap_table_history","pitchbook_deal_debt_lenders","pitchbook_deal_detailed","pitchbook_deal_investors","pitchbook_deal_multiples","pitchbook_deal_search","pitchbook_deal_service_providers","pitchbook_deal_stock_info","pitchbook_deal_tranche_info","pitchbook_deal_updates","pitchbook_deal_valuation","pitchbook_entity_affiliates","pitchbook_entity_locations","pitchbook_entity_news","pitchbook_entity_people","pitchbook_entity_updates","pitchbook_fund_active_investments","pitchbook_fund_benchmark","pitchbook_fund_bio","pitchbook_fund_cash_flows","pitchbook_fund_commitments","pitchbook_fund_investment_preferences","pitchbook_fund_investments","pitchbook_fund_performance","pitchbook_fund_search","pitchbook_fund_team","pitchbook_fund_updates","pitchbook_investor_active_investments","pitchbook_investor_bio","pitchbook_investor_board_seats","pitchbook_investor_deal_service_providers","pitchbook_investor_funds","pitchbook_investor_general_service_providers","pitchbook_investor_investments","pitchbook_investor_last_closed_fund","pitchbook_investor_preferences","pitchbook_investor_search","pitchbook_investor_updates","pitchbook_limited_partner_actual_allocations","pitchbook_limited_partner_bio","pitchbook_limited_partner_commitment_aggregates","pitchbook_limited_partner_commitment_preferences","pitchbook_limited_partner_commitments_detailed","pitchbook_limited_partner_search","pitchbook_limited_partner_service_providers","pitchbook_limited_partner_target_allocations","pitchbook_limited_partner_updates","pitchbook_lookup_table_structure","pitchbook_lookup_tables","pitchbook_patent_detailed","pitchbook_patent_search","pitchbook_people_search","pitchbook_person_bio","pitchbook_person_contact","pitchbook_person_education_work","pitchbook_sandbox_entities","pitchbook_search","pitchbook_service_provider_bio","pitchbook_service_provider_search","pitchbook_service_provider_updates","pitchbook_serviced_companies","pitchbook_serviced_deals","pitchbook_serviced_funds","pitchbook_serviced_investors","pitchbook_serviced_limited_partners","pitchbook_shared_search","pitchbook_usage_report","polymarket_get_activity","polymarket_get_event","polymarket_get_events","polymarket_get_holders","polymarket_get_last_trade_price","polymarket_get_leaderboard","polymarket_get_market","polymarket_get_markets","polymarket_get_midpoint","polymarket_get_orderbook","polymarket_get_positions","polymarket_get_price","polymarket_get_price_history","polymarket_get_series","polymarket_get_series_by_id","polymarket_get_spread","polymarket_get_tags","polymarket_get_tick_size","polymarket_get_trades","polymarket_search","postgresql_delete","postgresql_execute","postgresql_insert","postgresql_introspect","postgresql_query","postgresql_update","posthog_batch_events","posthog_capture_event","posthog_create_annotation","posthog_create_cohort","posthog_create_dashboard","posthog_create_experiment","posthog_create_feature_flag","posthog_create_insight","posthog_create_survey","posthog_delete_feature_flag","posthog_delete_person","posthog_delete_survey","posthog_evaluate_flags","posthog_get_cohort","posthog_get_dashboard","posthog_get_event_definition","posthog_get_experiment","posthog_get_feature_flag","posthog_get_insight","posthog_get_organization","posthog_get_person","posthog_get_project","posthog_get_property_definition","posthog_get_session_recording","posthog_get_survey","posthog_list_actions","posthog_list_annotations","posthog_list_cohorts","posthog_list_dashboards","posthog_list_event_definitions","posthog_list_experiments","posthog_list_feature_flags","posthog_list_insights","posthog_list_organizations","posthog_list_persons","posthog_list_projects","posthog_list_property_definitions","posthog_list_recording_playlists","posthog_list_session_recordings","posthog_list_surveys","posthog_query","posthog_update_cohort","posthog_update_event_definition","posthog_update_experiment","posthog_update_feature_flag","posthog_update_insight","posthog_update_property_definition","posthog_update_survey","profound_bot_logs","profound_bots_report","profound_category_assets","profound_category_personas","profound_category_prompts","profound_category_tags","profound_category_topics","profound_citation_prompts","profound_citations_report","profound_list_assets","profound_list_categories","profound_list_domains","profound_list_models","profound_list_optimizations","profound_list_personas","profound_list_regions","profound_optimization_analysis","profound_prompt_answers","profound_prompt_volume","profound_query_fanouts","profound_raw_logs","profound_referrals_report","profound_sentiment_report","profound_visibility_report","prospeo_account_information","prospeo_bulk_enrich_company","prospeo_bulk_enrich_person","prospeo_enrich_company","prospeo_enrich_person","prospeo_search_company","prospeo_search_person","prospeo_search_suggestions","pulse_parser","pulse_parser_v2","qdrant_fetch_points","qdrant_search_vector","qdrant_upsert_points","quartr_get_audio","quartr_get_company","quartr_get_event","quartr_get_event_summary","quartr_get_report","quartr_get_slide_deck","quartr_get_transcript","quartr_list_audio","quartr_list_companies","quartr_list_document_types","quartr_list_documents","quartr_list_event_types","quartr_list_events","quartr_list_live_events","quartr_list_reports","quartr_list_slide_decks","quartr_list_transcripts","quickbooks_add_attachment","quickbooks_create_bill","quickbooks_create_bill_payment","quickbooks_create_credit_memo","quickbooks_create_customer","quickbooks_create_customer_payment","quickbooks_create_deposit","quickbooks_create_employee","quickbooks_create_estimate","quickbooks_create_invoice","quickbooks_create_item","quickbooks_create_journal_entry","quickbooks_create_purchase","quickbooks_create_purchase_order","quickbooks_create_refund_receipt","quickbooks_create_sales_receipt","quickbooks_create_vendor","quickbooks_create_vendor_credit","quickbooks_download_attachment","quickbooks_download_transaction_pdf","quickbooks_email_transaction","quickbooks_get_company_info","quickbooks_read_accounting_transactions","quickbooks_read_attachments","quickbooks_read_master_data","quickbooks_read_purchasing_transactions","quickbooks_read_sales_transactions","quickbooks_run_financial_report","quickbooks_update_bill","quickbooks_update_bill_payment","quickbooks_update_credit_memo","quickbooks_update_customer","quickbooks_update_customer_payment","quickbooks_update_deposit","quickbooks_update_employee","quickbooks_update_estimate","quickbooks_update_invoice","quickbooks_update_item","quickbooks_update_journal_entry","quickbooks_update_purchase","quickbooks_update_purchase_order","quickbooks_update_refund_receipt","quickbooks_update_sales_receipt","quickbooks_update_vendor","quickbooks_update_vendor_credit","quickbooks_void_customer_payment","quickbooks_void_invoice","quiver_image_to_svg","quiver_list_models","quiver_text_to_svg","rabbitmq_create_binding","rabbitmq_create_exchange","rabbitmq_create_policy","rabbitmq_create_queue","rabbitmq_delete_binding","rabbitmq_delete_exchange","rabbitmq_delete_policy","rabbitmq_delete_queue","rabbitmq_get_exchange","rabbitmq_get_messages","rabbitmq_get_overview","rabbitmq_get_queue","rabbitmq_health_check","rabbitmq_list_bindings","rabbitmq_list_channels","rabbitmq_list_connections","rabbitmq_list_consumers","rabbitmq_list_exchange_bindings","rabbitmq_list_exchanges","rabbitmq_list_nodes","rabbitmq_list_policies","rabbitmq_list_queues","rabbitmq_list_vhosts","rabbitmq_publish_message","rabbitmq_purge_queue","railway_create_environment","railway_create_project","railway_create_service","railway_delete_environment","railway_delete_project","railway_delete_service","railway_delete_variable","railway_deploy_service","railway_get_deployment","railway_get_deployment_logs","railway_get_project","railway_list_deployments","railway_list_project_members","railway_list_projects","railway_list_variables","railway_restart_deployment","railway_rollback_deployment","railway_transfer_project","railway_update_project","railway_upsert_variable","rb2b_credit_check","rb2b_email_to_activity","rb2b_hem_to_best_linkedin","rb2b_hem_to_business_profile","rb2b_hem_to_linkedin","rb2b_hem_to_maid","rb2b_ip_to_company","rb2b_ip_to_hem","rb2b_ip_to_maid","rb2b_linkedin_slug_search","rb2b_linkedin_to_best_personal_email","rb2b_linkedin_to_business_profile","rb2b_linkedin_to_hashed_emails","rb2b_linkedin_to_mobile_phone","rb2b_linkedin_to_personal_email","rds_delete","rds_execute","rds_insert","rds_introspect","rds_query","rds_update","reddit_delete","reddit_edit","reddit_get_comments","reddit_get_controversial","reddit_get_info","reddit_get_me","reddit_get_messages","reddit_get_posts","reddit_get_saved","reddit_get_subreddit_info","reddit_get_subreddit_rules","reddit_get_user","reddit_get_user_comments","reddit_get_user_posts","reddit_hide","reddit_hot_posts","reddit_list_my_subreddits","reddit_lock","reddit_mark_all_read","reddit_mark_read","reddit_marknsfw","reddit_mod_approve","reddit_mod_distinguish","reddit_mod_remove","reddit_mod_sticky","reddit_reply","reddit_report","reddit_save","reddit_search","reddit_search_subreddits","reddit_send_message","reddit_submit_post","reddit_subscribe","reddit_unhide","reddit_unlock","reddit_unmarknsfw","reddit_unsave","reddit_vote","redis_command","redis_delete","redis_exists","redis_expire","redis_get","redis_hdel","redis_hget","redis_hgetall","redis_hset","redis_incr","redis_incrby","redis_keys","redis_llen","redis_lpop","redis_lpush","redis_lrange","redis_persist","redis_rpop","redis_rpush","redis_set","redis_setnx","redis_ttl","reducto_parser","reducto_parser_v2","resend_cancel_email","resend_create_audience","resend_create_broadcast","resend_create_contact","resend_delete_audience","resend_delete_contact","resend_get_audience","resend_get_broadcast","resend_get_contact","resend_get_email","resend_list_audiences","resend_list_contacts","resend_list_domains","resend_send","resend_send_broadcast","resend_update_contact","revenuecat_create_purchase","revenuecat_defer_google_subscription","revenuecat_delete_customer","revenuecat_get_customer","revenuecat_grant_entitlement","revenuecat_list_offerings","revenuecat_refund_google_subscription","revenuecat_revoke_entitlement","revenuecat_revoke_google_subscription","revenuecat_update_subscriber_attributes","rippling_bulk_create_custom_object_records","rippling_bulk_delete_custom_object_records","rippling_bulk_update_custom_object_records","rippling_create_business_partner","rippling_create_business_partner_group","rippling_create_custom_app","rippling_create_custom_object","rippling_create_custom_object_field","rippling_create_custom_object_record","rippling_create_custom_page","rippling_create_custom_setting","rippling_create_department","rippling_create_draft_hires","rippling_create_object_category","rippling_create_title","rippling_create_work_location","rippling_delete_business_partner","rippling_delete_business_partner_group","rippling_delete_custom_app","rippling_delete_custom_object","rippling_delete_custom_object_field","rippling_delete_custom_object_record","rippling_delete_custom_page","rippling_delete_custom_setting","rippling_delete_object_category","rippling_delete_title","rippling_delete_work_location","rippling_get_business_partner","rippling_get_business_partner_group","rippling_get_current_user","rippling_get_custom_app","rippling_get_custom_object","rippling_get_custom_object_field","rippling_get_custom_object_record","rippling_get_custom_object_record_by_external_id","rippling_get_custom_page","rippling_get_custom_setting","rippling_get_department","rippling_get_employment_type","rippling_get_job_function","rippling_get_object_category","rippling_get_report_run","rippling_get_supergroup","rippling_get_team","rippling_get_title","rippling_get_user","rippling_get_work_location","rippling_get_worker","rippling_list_business_partner_groups","rippling_list_business_partners","rippling_list_companies","rippling_list_custom_apps","rippling_list_custom_fields","rippling_list_custom_object_fields","rippling_list_custom_object_records","rippling_list_custom_objects","rippling_list_custom_pages","rippling_list_custom_settings","rippling_list_departments","rippling_list_employment_types","rippling_list_entitlements","rippling_list_job_functions","rippling_list_object_categories","rippling_list_supergroup_exclusion_members","rippling_list_supergroup_inclusion_members","rippling_list_supergroup_members","rippling_list_supergroups","rippling_list_teams","rippling_list_titles","rippling_list_users","rippling_list_work_locations","rippling_list_workers","rippling_query_custom_object_records","rippling_trigger_report_run","rippling_update_custom_app","rippling_update_custom_object","rippling_update_custom_object_field","rippling_update_custom_object_record","rippling_update_custom_page","rippling_update_custom_setting","rippling_update_department","rippling_update_object_category","rippling_update_supergroup_exclusion_members","rippling_update_supergroup_inclusion_members","rippling_update_title","rippling_update_work_location","rocketlane_add_field_option","rocketlane_add_project_members","rocketlane_add_task_assignees","rocketlane_add_task_dependencies","rocketlane_add_task_followers","rocketlane_archive_project","rocketlane_assign_placeholders","rocketlane_create_field","rocketlane_create_phase","rocketlane_create_project","rocketlane_create_space","rocketlane_create_space_document","rocketlane_create_task","rocketlane_create_time_entry","rocketlane_create_time_off","rocketlane_delete_field","rocketlane_delete_phase","rocketlane_delete_project","rocketlane_delete_space","rocketlane_delete_space_document","rocketlane_delete_task","rocketlane_delete_time_entry","rocketlane_delete_time_off","rocketlane_get_field","rocketlane_get_invoice","rocketlane_get_invoice_line_items","rocketlane_get_invoice_payments","rocketlane_get_phase","rocketlane_get_project","rocketlane_get_space","rocketlane_get_space_document","rocketlane_get_task","rocketlane_get_time_entry","rocketlane_get_time_off","rocketlane_get_user","rocketlane_import_template","rocketlane_list_fields","rocketlane_list_invoices","rocketlane_list_phases","rocketlane_list_placeholders","rocketlane_list_projects","rocketlane_list_resource_allocations","rocketlane_list_space_documents","rocketlane_list_spaces","rocketlane_list_tasks","rocketlane_list_time_entries","rocketlane_list_time_entry_categories","rocketlane_list_time_offs","rocketlane_list_users","rocketlane_move_task_to_phase","rocketlane_remove_project_members","rocketlane_remove_task_assignees","rocketlane_remove_task_dependencies","rocketlane_remove_task_followers","rocketlane_search_time_entries","rocketlane_unassign_placeholders","rocketlane_update_field","rocketlane_update_field_option","rocketlane_update_phase","rocketlane_update_project","rocketlane_update_space","rocketlane_update_space_document","rocketlane_update_task","rocketlane_update_time_entry","rootly_acknowledge_alert","rootly_add_incident_event","rootly_add_subscribers","rootly_assign_incident_role","rootly_create_action_item","rootly_create_alert","rootly_create_incident","rootly_create_status_page_event","rootly_delete_action_item","rootly_delete_incident","rootly_escalate_alert","rootly_get_alert","rootly_get_incident","rootly_list_action_items","rootly_list_alerts","rootly_list_causes","rootly_list_environments","rootly_list_escalation_policies","rootly_list_functionalities","rootly_list_incident_events","rootly_list_incident_roles","rootly_list_incident_types","rootly_list_incidents","rootly_list_on_calls","rootly_list_playbooks","rootly_list_retrospectives","rootly_list_schedules","rootly_list_services","rootly_list_severities","rootly_list_teams","rootly_list_users","rootly_mitigate_incident","rootly_remove_subscribers","rootly_resolve_alert","rootly_resolve_incident","rootly_run_workflow","rootly_snooze_alert","rootly_unassign_incident_role","rootly_update_action_item","rootly_update_alert","rootly_update_incident","s3_copy_object","s3_create_bucket","s3_delete_bucket","s3_delete_object","s3_delete_objects","s3_get_object","s3_head_object","s3_list_buckets","s3_list_objects","s3_presigned_url","s3_put_object","sailpoint_approve_access_request","sailpoint_cancel_access_request","sailpoint_decide_certification_review_items","sailpoint_get_access_profile","sailpoint_get_access_profile_entitlements","sailpoint_get_access_request_config","sailpoint_get_access_request_status","sailpoint_get_account","sailpoint_get_account_activity","sailpoint_get_account_entitlements","sailpoint_get_account_selections","sailpoint_get_campaign","sailpoint_get_certification","sailpoint_get_entitlement","sailpoint_get_entitlement_request_config","sailpoint_get_identity","sailpoint_get_role","sailpoint_get_role_entitlements","sailpoint_get_source","sailpoint_get_task_status","sailpoint_list_access_profiles","sailpoint_list_account_activities","sailpoint_list_accounts","sailpoint_list_campaigns","sailpoint_list_certification_review_items","sailpoint_list_certifications","sailpoint_list_entitlements","sailpoint_list_identities","sailpoint_list_identity_entitlements","sailpoint_list_pending_access_request_approvals","sailpoint_list_roles","sailpoint_list_sources","sailpoint_load_accounts","sailpoint_load_entitlements","sailpoint_reject_access_request","sailpoint_request_access","sailpoint_search","sailpoint_search_aggregate","sailpoint_search_count","sailpoint_sign_off_certification","salesforce_create_account","salesforce_create_case","salesforce_create_contact","salesforce_create_custom_field","salesforce_create_custom_object","salesforce_create_lead","salesforce_create_opportunity","salesforce_create_task","salesforce_delete_account","salesforce_delete_case","salesforce_delete_contact","salesforce_delete_custom_field","salesforce_delete_lead","salesforce_delete_opportunity","salesforce_delete_task","salesforce_describe_object","salesforce_get_accounts","salesforce_get_cases","salesforce_get_contacts","salesforce_get_dashboard","salesforce_get_leads","salesforce_get_opportunities","salesforce_get_report","salesforce_get_tasks","salesforce_list_dashboards","salesforce_list_objects","salesforce_list_report_types","salesforce_list_reports","salesforce_query","salesforce_query_more","salesforce_refresh_dashboard","salesforce_run_report","salesforce_tooling_query","salesforce_update_account","salesforce_update_case","salesforce_update_contact","salesforce_update_custom_field","salesforce_update_lead","salesforce_update_opportunity","salesforce_update_task","sap_concur_approve_expense_report","sap_concur_associate_attendees","sap_concur_create_cash_advance","sap_concur_create_expected_expense","sap_concur_create_expense_report","sap_concur_create_list_item","sap_concur_create_purchase_request","sap_concur_create_quick_expense","sap_concur_create_quick_expense_with_image","sap_concur_create_report_comment","sap_concur_create_travel_request","sap_concur_create_user","sap_concur_delete_expected_expense","sap_concur_delete_expense","sap_concur_delete_expense_report","sap_concur_delete_list_item","sap_concur_delete_travel_request","sap_concur_delete_user","sap_concur_get_allocation","sap_concur_get_budget","sap_concur_get_cash_advance","sap_concur_get_expected_expense","sap_concur_get_expense","sap_concur_get_expense_report","sap_concur_get_itemizations","sap_concur_get_itinerary","sap_concur_get_list","sap_concur_get_list_item","sap_concur_get_purchase_request","sap_concur_get_receipt","sap_concur_get_receipt_status","sap_concur_get_request_cash_advance","sap_concur_get_travel_profile","sap_concur_get_travel_request","sap_concur_get_user","sap_concur_issue_cash_advance","sap_concur_list_allocations","sap_concur_list_attendee_associations","sap_concur_list_budget_categories","sap_concur_list_budgets","sap_concur_list_exceptions","sap_concur_list_expected_expenses","sap_concur_list_expense_reports","sap_concur_list_expenses","sap_concur_list_itineraries","sap_concur_list_list_items","sap_concur_list_lists","sap_concur_list_receipts","sap_concur_list_report_comments","sap_concur_list_reports_to_approve","sap_concur_list_travel_profiles_summary","sap_concur_list_travel_request_comments","sap_concur_list_travel_requests","sap_concur_list_users","sap_concur_move_travel_request","sap_concur_recall_expense_report","sap_concur_remove_all_attendees","sap_concur_search_locations","sap_concur_search_users","sap_concur_send_back_expense_report","sap_concur_submit_expense_report","sap_concur_update_allocation","sap_concur_update_expected_expense","sap_concur_update_expense","sap_concur_update_expense_report","sap_concur_update_list_item","sap_concur_update_travel_request","sap_concur_update_user","sap_concur_upload_exchange_rates","sap_concur_upload_receipt_image","sap_s4hana_create_business_partner","sap_s4hana_create_purchase_order","sap_s4hana_create_purchase_requisition","sap_s4hana_create_sales_order","sap_s4hana_delete_sales_order","sap_s4hana_get_billing_document","sap_s4hana_get_business_partner","sap_s4hana_get_customer","sap_s4hana_get_inbound_delivery","sap_s4hana_get_material_document","sap_s4hana_get_outbound_delivery","sap_s4hana_get_product","sap_s4hana_get_purchase_order","sap_s4hana_get_purchase_requisition","sap_s4hana_get_sales_order","sap_s4hana_get_supplier","sap_s4hana_get_supplier_invoice","sap_s4hana_list_billing_documents","sap_s4hana_list_business_partners","sap_s4hana_list_customers","sap_s4hana_list_inbound_deliveries","sap_s4hana_list_material_documents","sap_s4hana_list_material_stock","sap_s4hana_list_outbound_deliveries","sap_s4hana_list_products","sap_s4hana_list_purchase_orders","sap_s4hana_list_purchase_requisitions","sap_s4hana_list_sales_orders","sap_s4hana_list_supplier_invoices","sap_s4hana_list_suppliers","sap_s4hana_odata_query","sap_s4hana_update_business_partner","sap_s4hana_update_customer","sap_s4hana_update_product","sap_s4hana_update_purchase_order","sap_s4hana_update_purchase_requisition","sap_s4hana_update_sales_order","sap_s4hana_update_supplier","search_tool","secrets_manager_create_secret","secrets_manager_delete_secret","secrets_manager_describe_secret","secrets_manager_get_secret","secrets_manager_list_secrets","secrets_manager_restore_secret","secrets_manager_rotate_secret","secrets_manager_tag_resource","secrets_manager_untag_resource","secrets_manager_update_secret","semrush_backlinks","semrush_backlinks_anchors","semrush_backlinks_competitors","semrush_backlinks_geo_distribution","semrush_backlinks_indexed_pages","semrush_backlinks_overview","semrush_backlinks_tld_distribution","semrush_batch_keyword_overview","semrush_broad_match_keywords","semrush_domain_ad_copies","semrush_domain_ad_history","semrush_domain_organic_competitors","semrush_domain_organic_keywords","semrush_domain_overview","semrush_domain_overview_all","semrush_domain_overview_history","semrush_domain_paid_competitors","semrush_domain_paid_keywords","semrush_domain_pla_copies","semrush_domain_pla_keywords","semrush_domain_vs_domain","semrush_keyword_ad_history","semrush_keyword_difficulty","semrush_keyword_overview","semrush_keyword_overview_all","semrush_keyword_questions","semrush_organic_results","semrush_paid_results","semrush_referring_domains","semrush_referring_ips","semrush_related_keywords","semrush_subdomain_ad_copies","semrush_subdomain_organic_keywords","semrush_subdomain_overview","semrush_subdomain_overview_all","semrush_subdomain_overview_history","semrush_subdomain_paid_keywords","semrush_top_domains","semrush_url_organic_keywords","semrush_url_overview","semrush_url_overview_all","semrush_url_overview_history","semrush_url_paid_keywords","semrush_winners_and_losers","sendblue_evaluate_service","sendblue_get_message","sendblue_send_group_message","sendblue_send_message","sendblue_send_typing_indicator","sendgrid_add_contact","sendgrid_add_contacts_to_list","sendgrid_create_list","sendgrid_create_template","sendgrid_create_template_version","sendgrid_delete_contacts","sendgrid_delete_list","sendgrid_delete_template","sendgrid_get_contact","sendgrid_get_list","sendgrid_get_template","sendgrid_list_all_lists","sendgrid_list_templates","sendgrid_remove_contacts_from_list","sendgrid_search_contacts","sendgrid_send_mail","sentry_events_get","sentry_events_list","sentry_issues_get","sentry_issues_list","sentry_issues_update","sentry_projects_create","sentry_projects_get","sentry_projects_list","sentry_projects_update","sentry_releases_create","sentry_releases_deploy","sentry_releases_list","sentry_teams_list","serper_search","servicenow_add_incident_comment","servicenow_aggregate","servicenow_close_incident","servicenow_create_change_request","servicenow_create_incident","servicenow_create_record","servicenow_delete_record","servicenow_download_attachment","servicenow_find_user","servicenow_get_change_next_states","servicenow_get_change_request","servicenow_get_ci","servicenow_get_incident","servicenow_get_knowledge_article","servicenow_get_requested_item","servicenow_list_approvals","servicenow_list_attachments","servicenow_list_catalog_items","servicenow_list_change_requests","servicenow_list_change_tasks","servicenow_list_ci_relationships","servicenow_list_group_members","servicenow_list_incidents","servicenow_list_requested_items","servicenow_order_catalog_item","servicenow_read_record","servicenow_resolve_incident","servicenow_search_cis","servicenow_search_knowledge","servicenow_update_approval","servicenow_update_change_request","servicenow_update_change_state","servicenow_update_incident","servicenow_update_record","servicenow_upload_attachment","ses_create_configuration_set","ses_create_email_identity","ses_create_template","ses_delete_email_identity","ses_delete_suppressed_destination","ses_delete_template","ses_get_account","ses_get_email_identity","ses_get_suppressed_destination","ses_get_template","ses_list_identities","ses_list_suppressed_destinations","ses_list_templates","ses_put_suppressed_destination","ses_send_bulk_email","ses_send_custom_verification_email","ses_send_email","ses_send_templated_email","ses_update_template","sftp_delete","sftp_download","sftp_list","sftp_mkdir","sftp_upload","sharepoint_add_list_items","sharepoint_create_list","sharepoint_create_page","sharepoint_delete_file","sharepoint_delete_list_item","sharepoint_delete_page","sharepoint_download_file","sharepoint_get_drive_item","sharepoint_get_list","sharepoint_get_list_item","sharepoint_list_sites","sharepoint_publish_page","sharepoint_read_page","sharepoint_update_list","sharepoint_update_page","sharepoint_upload_file","shopify_adjust_inventory","shopify_cancel_order","shopify_create_customer","shopify_create_fulfillment","shopify_create_product","shopify_delete_customer","shopify_delete_product","shopify_get_collection","shopify_get_customer","shopify_get_inventory_level","shopify_get_order","shopify_get_product","shopify_list_collections","shopify_list_customers","shopify_list_inventory_items","shopify_list_locations","shopify_list_orders","shopify_list_products","shopify_update_customer","shopify_update_order","shopify_update_product","similarweb_bounce_rate","similarweb_page_views","similarweb_pages_per_visit","similarweb_traffic_visits","similarweb_visit_duration","similarweb_website_overview","sixtyfour_enrich_company","sixtyfour_enrich_lead","sixtyfour_find_email","sixtyfour_find_phone","slack_add_reaction","slack_archive_conversation","slack_canvas","slack_create_channel_canvas","slack_create_conversation","slack_delete_canvas","slack_delete_message","slack_delete_scheduled_message","slack_download","slack_edit_canvas","slack_ephemeral_message","slack_get_canvas","slack_get_channel_history","slack_get_channel_info","slack_get_message","slack_get_permalink","slack_get_thread","slack_get_thread_replies","slack_get_user","slack_get_user_presence","slack_invite_to_conversation","slack_list_canvases","slack_list_channels","slack_list_members","slack_list_scheduled_messages","slack_list_users","slack_lookup_canvas_sections","slack_message","slack_message_reader","slack_open_view","slack_publish_view","slack_push_view","slack_remove_reaction","slack_rename_agent_session_v2","slack_rename_conversation","slack_schedule_message","slack_set_agent_session_status_v2","slack_set_conversation_purpose","slack_set_conversation_topic","slack_set_status","slack_set_suggested_prompts","slack_set_suggested_prompts_v2","slack_set_title","slack_update_message","slack_update_view","smartlead_add_email_accounts_to_campaign","smartlead_add_leads_to_campaign","smartlead_create_campaign","smartlead_create_lead_list","smartlead_delete_campaign","smartlead_delete_campaign_webhook","smartlead_delete_lead_from_campaign","smartlead_delete_lead_list","smartlead_duplicate_campaign","smartlead_export_campaign_leads","smartlead_get_campaign","smartlead_get_campaign_analytics","smartlead_get_campaign_analytics_by_date","smartlead_get_campaign_lead_statistics","smartlead_get_campaign_mailbox_statistics","smartlead_get_campaign_sequences","smartlead_get_campaign_statistics","smartlead_get_campaign_top_level_analytics_by_date","smartlead_get_campaign_webhook_summary","smartlead_get_lead_by_email","smartlead_get_lead_by_id","smartlead_get_lead_list","smartlead_get_lead_message_history","smartlead_list_campaign_email_accounts","smartlead_list_campaign_leads","smartlead_list_campaign_webhooks","smartlead_list_campaigns","smartlead_list_clients","smartlead_list_email_accounts","smartlead_list_inbox_replies","smartlead_list_lead_activities","smartlead_list_lead_categories","smartlead_list_lead_lists","smartlead_mark_lead_complete","smartlead_pause_lead","smartlead_remove_email_accounts_from_campaign","smartlead_resume_lead","smartlead_save_campaign_sequences","smartlead_unsubscribe_lead_from_campaign","smartlead_unsubscribe_lead_globally","smartlead_update_campaign_schedule","smartlead_update_campaign_settings","smartlead_update_campaign_status","smartlead_update_lead","smartlead_update_lead_category","smartlead_update_lead_list","smartlead_upsert_campaign_webhook","sms_send","smtp_send_mail","snowflake_alter_warehouse","snowflake_call_procedure","snowflake_cancel_statement","snowflake_cancel_task_run","snowflake_delete_rows","snowflake_execute_sql","snowflake_get_statement","snowflake_get_task","snowflake_get_task_run","snowflake_get_task_run_output","snowflake_get_warehouse","snowflake_insert_rows","snowflake_introspect_schema","snowflake_list_copy_history","snowflake_list_databases","snowflake_list_query_history","snowflake_list_schemas","snowflake_list_tables","snowflake_list_task_runs","snowflake_list_tasks","snowflake_list_warehouses","snowflake_load_data","snowflake_resume_task","snowflake_resume_warehouse","snowflake_run_task","snowflake_suspend_task","snowflake_suspend_warehouse","snowflake_unload_data","snowflake_update_rows","snowflake_upsert_rows","splunk_cancel_search_job","splunk_create_search_job","splunk_dispatch_saved_search","splunk_get_fired_alerts","splunk_get_saved_search","splunk_get_search_job","splunk_get_search_results","splunk_list_apps","splunk_list_fired_alerts","splunk_list_indexes","splunk_list_saved_searches","splunk_run_search","sportmonks_core_get_cities","sportmonks_core_get_city","sportmonks_core_get_continent","sportmonks_core_get_continents","sportmonks_core_get_countries","sportmonks_core_get_country","sportmonks_core_get_entity_filters","sportmonks_core_get_my_usage","sportmonks_core_get_region","sportmonks_core_get_regions","sportmonks_core_get_timezones","sportmonks_core_get_type","sportmonks_core_get_type_by_entity","sportmonks_core_get_types","sportmonks_core_search_cities","sportmonks_core_search_countries","sportmonks_core_search_regions","sportmonks_football_expected_by_player","sportmonks_football_expected_by_team","sportmonks_football_get_all_commentaries","sportmonks_football_get_all_fixtures","sportmonks_football_get_all_players","sportmonks_football_get_all_rivals","sportmonks_football_get_all_teams","sportmonks_football_get_all_transfer_rumours","sportmonks_football_get_all_transfers","sportmonks_football_get_brackets_by_season","sportmonks_football_get_coach","sportmonks_football_get_coaches","sportmonks_football_get_coaches_by_country","sportmonks_football_get_commentaries_by_fixture","sportmonks_football_get_current_leagues_by_team","sportmonks_football_get_expected_lineups_by_player","sportmonks_football_get_expected_lineups_by_team","sportmonks_football_get_extended_team_squad","sportmonks_football_get_fixture","sportmonks_football_get_fixtures_by_date","sportmonks_football_get_fixtures_by_date_range","sportmonks_football_get_fixtures_by_date_range_for_team","sportmonks_football_get_fixtures_by_ids","sportmonks_football_get_grouped_standings_by_round","sportmonks_football_get_head_to_head","sportmonks_football_get_inplay_livescores","sportmonks_football_get_latest_coaches","sportmonks_football_get_latest_fixtures","sportmonks_football_get_latest_livescores","sportmonks_football_get_latest_players","sportmonks_football_get_latest_totw","sportmonks_football_get_latest_transfers","sportmonks_football_get_league","sportmonks_football_get_leagues","sportmonks_football_get_leagues_by_country","sportmonks_football_get_leagues_by_date","sportmonks_football_get_leagues_by_team","sportmonks_football_get_live_leagues","sportmonks_football_get_live_probabilities","sportmonks_football_get_live_probabilities_by_fixture","sportmonks_football_get_live_standings_by_league","sportmonks_football_get_livescores","sportmonks_football_get_match_facts","sportmonks_football_get_match_facts_by_date_range","sportmonks_football_get_match_facts_by_fixture","sportmonks_football_get_match_facts_by_league","sportmonks_football_get_past_fixtures_by_tv_station","sportmonks_football_get_player","sportmonks_football_get_players_by_country","sportmonks_football_get_postmatch_news","sportmonks_football_get_postmatch_news_by_season","sportmonks_football_get_predictability_by_league","sportmonks_football_get_prematch_news","sportmonks_football_get_prematch_news_by_season","sportmonks_football_get_prematch_news_upcoming","sportmonks_football_get_probabilities","sportmonks_football_get_probabilities_by_fixture","sportmonks_football_get_referee","sportmonks_football_get_referees","sportmonks_football_get_referees_by_country","sportmonks_football_get_referees_by_season","sportmonks_football_get_rivals_by_team","sportmonks_football_get_round","sportmonks_football_get_round_statistics","sportmonks_football_get_rounds","sportmonks_football_get_rounds_by_season","sportmonks_football_get_schedules_by_season","sportmonks_football_get_schedules_by_season_and_team","sportmonks_football_get_schedules_by_team","sportmonks_football_get_season","sportmonks_football_get_seasons","sportmonks_football_get_seasons_by_team","sportmonks_football_get_stage","sportmonks_football_get_stage_statistics","sportmonks_football_get_stages","sportmonks_football_get_stages_by_season","sportmonks_football_get_standing_corrections_by_season","sportmonks_football_get_standings","sportmonks_football_get_standings_by_round","sportmonks_football_get_standings_by_season","sportmonks_football_get_state","sportmonks_football_get_states","sportmonks_football_get_team","sportmonks_football_get_team_rankings","sportmonks_football_get_team_rankings_by_date","sportmonks_football_get_team_rankings_by_team","sportmonks_football_get_team_squad","sportmonks_football_get_team_squad_by_season","sportmonks_football_get_teams_by_country","sportmonks_football_get_teams_by_season","sportmonks_football_get_topscorers_by_season","sportmonks_football_get_topscorers_by_stage","sportmonks_football_get_totw","sportmonks_football_get_totw_by_round","sportmonks_football_get_transfer","sportmonks_football_get_transfer_rumour","sportmonks_football_get_transfer_rumours_between_dates","sportmonks_football_get_transfer_rumours_by_player","sportmonks_football_get_transfer_rumours_by_team","sportmonks_football_get_transfers_between_dates","sportmonks_football_get_transfers_by_player","sportmonks_football_get_transfers_by_team","sportmonks_football_get_tv_station","sportmonks_football_get_tv_stations","sportmonks_football_get_tv_stations_by_fixture","sportmonks_football_get_upcoming_fixtures_by_market","sportmonks_football_get_upcoming_fixtures_by_tv_station","sportmonks_football_get_value_bets","sportmonks_football_get_value_bets_by_fixture","sportmonks_football_get_venue","sportmonks_football_get_venues","sportmonks_football_get_venues_by_season","sportmonks_football_search_coaches","sportmonks_football_search_fixtures","sportmonks_football_search_leagues","sportmonks_football_search_players","sportmonks_football_search_referees","sportmonks_football_search_rounds","sportmonks_football_search_seasons","sportmonks_football_search_stages","sportmonks_football_search_teams","sportmonks_football_search_venues","sportmonks_motorsport_get_all_fixtures","sportmonks_motorsport_get_current_leagues_by_team","sportmonks_motorsport_get_driver","sportmonks_motorsport_get_driver_standings","sportmonks_motorsport_get_driver_standings_by_season","sportmonks_motorsport_get_drivers","sportmonks_motorsport_get_drivers_by_country","sportmonks_motorsport_get_drivers_by_season","sportmonks_motorsport_get_fixture","sportmonks_motorsport_get_fixtures_by_date","sportmonks_motorsport_get_fixtures_by_date_range","sportmonks_motorsport_get_fixtures_by_ids","sportmonks_motorsport_get_laps_by_fixture","sportmonks_motorsport_get_laps_by_fixture_and_driver","sportmonks_motorsport_get_laps_by_fixture_and_lap","sportmonks_motorsport_get_latest_laps_by_fixture","sportmonks_motorsport_get_latest_pitstops_by_fixture","sportmonks_motorsport_get_latest_stints_by_fixture","sportmonks_motorsport_get_latest_updated_drivers","sportmonks_motorsport_get_latest_updated_fixtures","sportmonks_motorsport_get_league","sportmonks_motorsport_get_leagues","sportmonks_motorsport_get_leagues_by_country","sportmonks_motorsport_get_leagues_by_date","sportmonks_motorsport_get_leagues_by_live","sportmonks_motorsport_get_leagues_by_team","sportmonks_motorsport_get_livescores","sportmonks_motorsport_get_pitstops_by_fixture","sportmonks_motorsport_get_pitstops_by_fixture_and_driver","sportmonks_motorsport_get_pitstops_by_fixture_and_lap","sportmonks_motorsport_get_race_results_by_season_and_driver","sportmonks_motorsport_get_race_results_by_season_and_team","sportmonks_motorsport_get_schedules_by_season","sportmonks_motorsport_get_season","sportmonks_motorsport_get_seasons","sportmonks_motorsport_get_stage","sportmonks_motorsport_get_stages","sportmonks_motorsport_get_stages_by_season","sportmonks_motorsport_get_state","sportmonks_motorsport_get_states","sportmonks_motorsport_get_stints_by_fixture","sportmonks_motorsport_get_stints_by_fixture_and_driver","sportmonks_motorsport_get_stints_by_fixture_and_stint","sportmonks_motorsport_get_team","sportmonks_motorsport_get_team_standings","sportmonks_motorsport_get_team_standings_by_season","sportmonks_motorsport_get_teams","sportmonks_motorsport_get_teams_by_country","sportmonks_motorsport_get_teams_by_season","sportmonks_motorsport_get_venue","sportmonks_motorsport_get_venues","sportmonks_motorsport_get_venues_by_season","sportmonks_motorsport_search_drivers","sportmonks_motorsport_search_leagues","sportmonks_motorsport_search_stages","sportmonks_motorsport_search_teams","sportmonks_motorsport_search_venues","sportmonks_odds_get_all_historical_odds","sportmonks_odds_get_all_inplay_odds","sportmonks_odds_get_all_pre_match_odds","sportmonks_odds_get_all_premium_odds","sportmonks_odds_get_bookmaker","sportmonks_odds_get_bookmaker_event_ids_by_fixture","sportmonks_odds_get_bookmakers","sportmonks_odds_get_bookmakers_by_fixture","sportmonks_odds_get_inplay_odds_by_fixture","sportmonks_odds_get_inplay_odds_by_fixture_and_bookmaker","sportmonks_odds_get_inplay_odds_by_fixture_and_market","sportmonks_odds_get_last_updated_inplay_odds","sportmonks_odds_get_last_updated_pre_match_odds","sportmonks_odds_get_market","sportmonks_odds_get_markets","sportmonks_odds_get_pre_match_odds_by_fixture","sportmonks_odds_get_pre_match_odds_by_fixture_and_bookmaker","sportmonks_odds_get_pre_match_odds_by_fixture_and_market","sportmonks_odds_get_premium_odds_by_fixture","sportmonks_odds_get_premium_odds_by_fixture_and_bookmaker","sportmonks_odds_get_premium_odds_by_fixture_and_market","sportmonks_odds_get_updated_historical_odds_between","sportmonks_odds_get_updated_premium_odds_between","sportmonks_odds_search_bookmakers","sportmonks_odds_search_markets","spotify_add_playlist_cover","spotify_add_to_queue","spotify_add_tracks_to_playlist","spotify_check_following","spotify_check_playlist_followers","spotify_check_saved_albums","spotify_check_saved_audiobooks","spotify_check_saved_episodes","spotify_check_saved_shows","spotify_check_saved_tracks","spotify_create_playlist","spotify_follow_artists","spotify_follow_playlist","spotify_get_album","spotify_get_album_tracks","spotify_get_albums","spotify_get_artist","spotify_get_artist_albums","spotify_get_artist_top_tracks","spotify_get_artists","spotify_get_audiobook","spotify_get_audiobook_chapters","spotify_get_audiobooks","spotify_get_categories","spotify_get_current_user","spotify_get_currently_playing","spotify_get_devices","spotify_get_episode","spotify_get_episodes","spotify_get_followed_artists","spotify_get_markets","spotify_get_new_releases","spotify_get_playback_state","spotify_get_playlist","spotify_get_playlist_cover","spotify_get_playlist_tracks","spotify_get_queue","spotify_get_recently_played","spotify_get_saved_albums","spotify_get_saved_audiobooks","spotify_get_saved_episodes","spotify_get_saved_shows","spotify_get_saved_tracks","spotify_get_show","spotify_get_show_episodes","spotify_get_shows","spotify_get_top_artists","spotify_get_top_tracks","spotify_get_track","spotify_get_tracks","spotify_get_user_playlists","spotify_get_user_profile","spotify_pause","spotify_play","spotify_remove_saved_albums","spotify_remove_saved_audiobooks","spotify_remove_saved_episodes","spotify_remove_saved_shows","spotify_remove_saved_tracks","spotify_remove_tracks_from_playlist","spotify_reorder_playlist_items","spotify_replace_playlist_items","spotify_save_albums","spotify_save_audiobooks","spotify_save_episodes","spotify_save_shows","spotify_save_tracks","spotify_search","spotify_seek","spotify_set_repeat","spotify_set_shuffle","spotify_set_volume","spotify_skip_next","spotify_skip_previous","spotify_transfer_playback","spotify_unfollow_artists","spotify_unfollow_playlist","spotify_update_playlist","sqs_send","square_batch_retrieve_inventory_counts","square_cancel_invoice","square_cancel_payment","square_complete_payment","square_create_catalog_image","square_create_customer","square_create_invoice","square_create_order","square_create_payment","square_delete_catalog_object","square_delete_customer","square_delete_invoice","square_get_catalog_object","square_get_customer","square_get_invoice","square_get_location","square_get_order","square_get_payment","square_get_refund","square_list_catalog","square_list_customers","square_list_invoices","square_list_locations","square_list_payments","square_list_refunds","square_pay_order","square_publish_invoice","square_refund_payment","square_search_catalog_objects","square_search_customers","square_search_invoices","square_search_orders","square_update_customer","square_upsert_catalog_object","ssh_check_command_exists","ssh_check_file_exists","ssh_create_directory","ssh_delete_file","ssh_download_file","ssh_execute_command","ssh_execute_script","ssh_get_system_info","ssh_list_directory","ssh_move_rename","ssh_read_file_content","ssh_upload_file","ssh_write_file_content","stagehand_agent","stagehand_extract","stripe_cancel_payment_intent","stripe_cancel_subscription","stripe_capture_charge","stripe_capture_payment_intent","stripe_confirm_payment_intent","stripe_create_charge","stripe_create_customer","stripe_create_invoice","stripe_create_payment_intent","stripe_create_price","stripe_create_product","stripe_create_subscription","stripe_delete_customer","stripe_delete_invoice","stripe_delete_product","stripe_finalize_invoice","stripe_list_charges","stripe_list_customers","stripe_list_events","stripe_list_invoices","stripe_list_payment_intents","stripe_list_prices","stripe_list_products","stripe_list_subscriptions","stripe_pay_invoice","stripe_resume_subscription","stripe_retrieve_charge","stripe_retrieve_customer","stripe_retrieve_event","stripe_retrieve_invoice","stripe_retrieve_payment_intent","stripe_retrieve_price","stripe_retrieve_product","stripe_retrieve_subscription","stripe_search_charges","stripe_search_customers","stripe_search_invoices","stripe_search_payment_intents","stripe_search_prices","stripe_search_products","stripe_search_subscriptions","stripe_send_invoice","stripe_update_charge","stripe_update_customer","stripe_update_invoice","stripe_update_payment_intent","stripe_update_price","stripe_update_product","stripe_update_subscription","stripe_void_invoice","sts_assume_role","sts_assume_role_with_saml","sts_assume_role_with_web_identity","sts_get_access_key_info","sts_get_caller_identity","sts_get_session_token","stt_assemblyai","stt_assemblyai_v2","stt_deepgram","stt_deepgram_v2","stt_elevenlabs","stt_elevenlabs_v2","stt_gemini","stt_gemini_v2","stt_whisper","stt_whisper_v2","supabase_count","supabase_delete","supabase_get_row","supabase_insert","supabase_introspect","supabase_invoke_function","supabase_query","supabase_rpc","supabase_storage_copy","supabase_storage_create_bucket","supabase_storage_create_signed_upload_url","supabase_storage_create_signed_url","supabase_storage_delete","supabase_storage_delete_bucket","supabase_storage_download","supabase_storage_empty_bucket","supabase_storage_get_public_url","supabase_storage_list","supabase_storage_list_buckets","supabase_storage_move","supabase_storage_update_bucket","supabase_storage_upload","supabase_text_search","supabase_update","supabase_upsert","supabase_vector_search","table_batch_insert_rows","table_create","table_delete_row","table_delete_rows_by_filter","table_get_row","table_get_schema","table_insert_row","table_list","table_query_rows","table_query_rows_v2","table_update_row","table_update_rows_by_filter","table_upsert_row","tailscale_authorize_device","tailscale_create_auth_key","tailscale_delete_auth_key","tailscale_delete_device","tailscale_delete_user","tailscale_expire_device_key","tailscale_get_acl","tailscale_get_auth_key","tailscale_get_device","tailscale_get_device_routes","tailscale_get_dns_preferences","tailscale_get_dns_searchpaths","tailscale_list_auth_keys","tailscale_list_devices","tailscale_list_dns_nameservers","tailscale_list_users","tailscale_set_acl","tailscale_set_device_routes","tailscale_set_device_tags","tailscale_set_dns_nameservers","tailscale_set_dns_preferences","tailscale_set_dns_searchpaths","tailscale_suspend_user","tailscale_update_device_key","tavily_crawl","tavily_extract","tavily_map","tavily_search","telegram_copy_message","telegram_delete_message","telegram_edit_message_text","telegram_forward_message","telegram_get_chat","telegram_get_chat_member","telegram_message","telegram_pin_message","telegram_send_animation","telegram_send_audio","telegram_send_chat_action","telegram_send_contact","telegram_send_document","telegram_send_location","telegram_send_photo","telegram_send_poll","telegram_send_video","telegram_set_message_reaction","telegram_unpin_message","temporal_cancel_workflow","temporal_count_workflows","temporal_create_schedule","temporal_delete_schedule","temporal_describe_schedule","temporal_describe_task_queue","temporal_describe_workflow","temporal_get_workflow_history","temporal_list_schedules","temporal_list_workflows","temporal_pause_schedule","temporal_query_workflow","temporal_reset_workflow","temporal_signal_with_start","temporal_signal_workflow","temporal_start_workflow","temporal_terminate_workflow","temporal_trigger_schedule","temporal_unpause_schedule","temporal_update_workflow","textract_analyze_expense","textract_analyze_id","textract_parser","textract_parser_v2","thinking_tool","thrive_add_audience_managers","thrive_add_audience_members","thrive_add_user_tags","thrive_create_assignment","thrive_create_audience","thrive_create_completion","thrive_create_user","thrive_delete_assignment","thrive_delete_audience","thrive_delete_user","thrive_get_activity","thrive_get_assignment","thrive_get_audience","thrive_get_completion","thrive_get_content","thrive_get_cpd_category","thrive_get_cpd_entry","thrive_get_cpd_requirement","thrive_get_enrolment","thrive_get_skill_levels","thrive_get_tag","thrive_get_user_by_id","thrive_get_user_by_ref","thrive_list_assignments","thrive_list_audience_managers","thrive_list_audience_members","thrive_list_audiences","thrive_list_completions","thrive_list_enrolments","thrive_list_tags","thrive_query_activities","thrive_query_content","thrive_query_cpd_categories","thrive_query_cpd_entries","thrive_query_cpd_requirements","thrive_query_cpd_user_summaries","thrive_remove_audience_manager","thrive_remove_audience_member","thrive_remove_user_tags","thrive_replace_audience_managers","thrive_replace_audience_members","thrive_search_users","thrive_suspend_user","thrive_update_assignment","thrive_update_audience","thrive_update_user","thrive_update_user_skills","tiktok_get_post_status","tiktok_get_user","tiktok_list_videos","tiktok_query_videos","tiktok_upload_video_draft","tinybird_append_datasource","tinybird_delete_datasource_rows","tinybird_events","tinybird_get_job","tinybird_query","tinybird_query_pipe","tinybird_truncate_datasource","tinyfish_cancel_run","tinyfish_fetch","tinyfish_get_run","tinyfish_list_profiles","tinyfish_list_runs","tinyfish_list_vault_items","tinyfish_run","tinyfish_run_async","tinyfish_search","trello_add_checklist","trello_add_checklist_item","trello_add_comment","trello_add_label","trello_add_member","trello_create_board","trello_create_card","trello_create_list","trello_delete_card","trello_get_actions","trello_get_board","trello_get_card","trello_list_cards","trello_list_lists","trello_list_members","trello_remove_label","trello_remove_member","trello_search","trello_update_card","trello_update_checklist_item","trello_update_list","trigger_dev_activate_schedule","trigger_dev_add_run_tags","trigger_dev_batch_trigger_task","trigger_dev_cancel_run","trigger_dev_complete_waitpoint_token","trigger_dev_create_env_var","trigger_dev_create_schedule","trigger_dev_create_waitpoint_token","trigger_dev_deactivate_schedule","trigger_dev_delete_env_var","trigger_dev_delete_schedule","trigger_dev_execute_query","trigger_dev_get_batch","trigger_dev_get_batch_results","trigger_dev_get_deployment","trigger_dev_get_env_var","trigger_dev_get_latest_deployment","trigger_dev_get_query_schema","trigger_dev_get_queue","trigger_dev_get_run","trigger_dev_get_run_events","trigger_dev_get_run_result","trigger_dev_get_run_trace","trigger_dev_get_schedule","trigger_dev_get_waitpoint_token","trigger_dev_import_env_vars","trigger_dev_list_deployments","trigger_dev_list_env_vars","trigger_dev_list_queues","trigger_dev_list_runs","trigger_dev_list_schedules","trigger_dev_list_timezones","trigger_dev_list_waitpoint_tokens","trigger_dev_override_queue_concurrency","trigger_dev_pause_queue","trigger_dev_promote_deployment","trigger_dev_replay_run","trigger_dev_reschedule_run","trigger_dev_reset_queue_concurrency","trigger_dev_resume_queue","trigger_dev_trigger_task","trigger_dev_update_env_var","trigger_dev_update_run_metadata","trigger_dev_update_schedule","tts_azure","tts_cartesia","tts_deepgram","tts_elevenlabs","tts_google","tts_openai","tts_playht","twilio_send_sms","twilio_voice_get_recording","twilio_voice_list_calls","twilio_voice_make_call","typeform_create_form","typeform_delete_form","typeform_files","typeform_get_form","typeform_insights","typeform_list_forms","typeform_responses","typeform_update_form","upstash_redis_command","upstash_redis_delete","upstash_redis_exists","upstash_redis_expire","upstash_redis_get","upstash_redis_hget","upstash_redis_hgetall","upstash_redis_hset","upstash_redis_incr","upstash_redis_incrby","upstash_redis_keys","upstash_redis_lpush","upstash_redis_lrange","upstash_redis_set","upstash_redis_setnx","upstash_redis_ttl","uptimerobot_create_alert_contact","uptimerobot_create_maintenance_window","uptimerobot_create_monitor","uptimerobot_create_psp","uptimerobot_delete_alert_contact","uptimerobot_delete_maintenance_window","uptimerobot_delete_monitor","uptimerobot_delete_psp","uptimerobot_get_account","uptimerobot_get_alert_contact","uptimerobot_get_incident","uptimerobot_get_maintenance_window","uptimerobot_get_monitor","uptimerobot_get_psp","uptimerobot_list_alert_contacts","uptimerobot_list_incidents","uptimerobot_list_maintenance_windows","uptimerobot_list_monitors","uptimerobot_list_psps","uptimerobot_pause_monitor","uptimerobot_start_monitor","uptimerobot_update_maintenance_window","uptimerobot_update_monitor","uptimerobot_update_psp","vanta_download_document_file","vanta_get_control","vanta_get_document","vanta_get_framework","vanta_get_person","vanta_get_policy","vanta_get_risk_scenario","vanta_get_test","vanta_get_vendor","vanta_get_vulnerable_asset","vanta_list_control_documents","vanta_list_control_tests","vanta_list_controls","vanta_list_document_uploads","vanta_list_documents","vanta_list_framework_controls","vanta_list_frameworks","vanta_list_monitored_computers","vanta_list_people","vanta_list_policies","vanta_list_risk_scenarios","vanta_list_test_entities","vanta_list_tests","vanta_list_vendors","vanta_list_vulnerabilities","vanta_list_vulnerability_remediations","vanta_list_vulnerable_assets","vanta_submit_document","vanta_upload_document_file","vercel_add_domain","vercel_add_project_domain","vercel_cancel_deployment","vercel_create_alias","vercel_create_check","vercel_create_deployment","vercel_create_dns_record","vercel_create_edge_config","vercel_create_env_var","vercel_create_project","vercel_create_webhook","vercel_delete_alias","vercel_delete_deployment","vercel_delete_dns_record","vercel_delete_domain","vercel_delete_edge_config","vercel_delete_env_var","vercel_delete_project","vercel_delete_webhook","vercel_get_alias","vercel_get_check","vercel_get_deployment","vercel_get_deployment_events","vercel_get_domain","vercel_get_domain_config","vercel_get_edge_config","vercel_get_edge_config_items","vercel_get_env_vars","vercel_get_project","vercel_get_team","vercel_get_user","vercel_get_webhook","vercel_list_aliases","vercel_list_checks","vercel_list_deployment_files","vercel_list_deployments","vercel_list_dns_records","vercel_list_domains","vercel_list_edge_configs","vercel_list_project_domains","vercel_list_projects","vercel_list_team_members","vercel_list_teams","vercel_list_webhooks","vercel_pause_project","vercel_promote_deployment","vercel_remove_project_domain","vercel_rerequest_check","vercel_unpause_project","vercel_update_check","vercel_update_dns_record","vercel_update_edge_config_items","vercel_update_env_var","vercel_update_project","vercel_update_project_domain","vercel_verify_project_domain","video_falai","video_luma","video_minimax","video_runway","video_veo","vision_tool","vision_tool_v2","wealthbox_read_contact","wealthbox_read_note","wealthbox_read_task","wealthbox_write_contact","wealthbox_write_note","wealthbox_write_task","webflow_create_item","webflow_delete_item","webflow_get_item","webflow_list_items","webflow_update_item","webhook_request","whatsapp_get_media","whatsapp_mark_read","whatsapp_send_interactive","whatsapp_send_media","whatsapp_send_message","whatsapp_send_reaction","whatsapp_send_template","whatsapp_upload_media","wikipedia_content","wikipedia_random","wikipedia_search","wikipedia_summary","windchill_check_in_document","windchill_check_in_documents","windchill_check_out_document","windchill_check_out_documents","windchill_create_document","windchill_create_documents","windchill_delete_document","windchill_delete_documents","windchill_download_attachment","windchill_download_primary_content","windchill_get_document","windchill_get_document_structure","windchill_get_primary_content","windchill_get_valid_state_transitions","windchill_list_attachments","windchill_list_documents","windchill_revise_document","windchill_revise_documents","windchill_set_lifecycle_state","windchill_undo_check_out_document","windchill_undo_check_out_documents","windchill_update_common_properties","windchill_update_document","windchill_update_document_security_labels","windchill_update_documents","windchill_upload_attachments","windchill_upload_primary_content","wiza_company_enrichment","wiza_get_credits","wiza_individual_reveal","wiza_prospect_search","wordpress_create_category","wordpress_create_comment","wordpress_create_page","wordpress_create_post","wordpress_create_tag","wordpress_delete_category","wordpress_delete_comment","wordpress_delete_media","wordpress_delete_page","wordpress_delete_post","wordpress_delete_tag","wordpress_get_category","wordpress_get_current_user","wordpress_get_media","wordpress_get_page","wordpress_get_post","wordpress_get_tag","wordpress_get_user","wordpress_list_categories","wordpress_list_comments","wordpress_list_media","wordpress_list_pages","wordpress_list_posts","wordpress_list_tags","wordpress_list_users","wordpress_search_content","wordpress_update_category","wordpress_update_comment","wordpress_update_page","wordpress_update_post","wordpress_update_tag","wordpress_upload_media","workday_assign_onboarding","workday_change_job","workday_create_prehire","workday_get_compensation","workday_get_organizations","workday_get_worker","workday_hire_employee","workday_list_workers","workday_terminate_worker","workday_update_worker","workflow_executor","x_create_bookmark","x_create_tweet","x_delete_bookmark","x_delete_tweet","x_get_blocking","x_get_bookmarks","x_get_followers","x_get_following","x_get_liked_tweets","x_get_liking_users","x_get_me","x_get_personalized_trends","x_get_quote_tweets","x_get_retweeted_by","x_get_trends_by_woeid","x_get_tweets_by_ids","x_get_usage","x_get_user_mentions","x_get_user_timeline","x_get_user_tweets","x_hide_reply","x_manage_block","x_manage_follow","x_manage_like","x_manage_mute","x_manage_retweet","x_read","x_search","x_search_tweets","x_search_users","x_user","x_write","youtube_channel_info","youtube_channel_playlists","youtube_channel_videos","youtube_comments","youtube_playlist_items","youtube_search","youtube_trending","youtube_video_categories","youtube_video_details","zendesk_autocomplete_organizations","zendesk_create_organization","zendesk_create_organizations_bulk","zendesk_create_ticket","zendesk_create_tickets_bulk","zendesk_create_user","zendesk_create_users_bulk","zendesk_delete_organization","zendesk_delete_ticket","zendesk_delete_user","zendesk_get_current_user","zendesk_get_organization","zendesk_get_organizations","zendesk_get_ticket","zendesk_get_tickets","zendesk_get_user","zendesk_get_users","zendesk_merge_tickets","zendesk_search","zendesk_search_count","zendesk_search_users","zendesk_update_organization","zendesk_update_ticket","zendesk_update_tickets_bulk","zendesk_update_user","zendesk_update_users_bulk","zep_add_messages","zep_add_user","zep_create_thread","zep_delete_thread","zep_get_context","zep_get_messages","zep_get_threads","zep_get_user","zep_get_user_threads","zerobounce_get_credits","zerobounce_verify_email","zoho_desk_add_comment","zoho_desk_get_attachment","zoho_desk_get_contact","zoho_desk_get_thread","zoho_desk_get_ticket","zoho_desk_list_comments","zoho_desk_list_organizations","zoho_desk_list_threads","zoho_desk_list_tickets","zoho_desk_update_ticket","zoom_create_meeting","zoom_delete_meeting","zoom_delete_recording","zoom_get_meeting","zoom_get_meeting_invitation","zoom_get_meeting_recordings","zoom_list_meetings","zoom_list_past_participants","zoom_list_recordings","zoom_update_meeting","zoominfo_enrich_companies","zoominfo_enrich_contacts","zoominfo_search_companies","zoominfo_search_contacts","zoominfo_search_intent","zoominfo_search_news"]' + '["a2a_cancel_task","a2a_get_agent_card","a2a_get_task","a2a_send_message","affinity_batch_update_entity_fields","affinity_batch_update_list_entry_fields","affinity_create_list","affinity_create_list_field_dropdown_option","affinity_create_merge","affinity_create_note","affinity_create_reminder","affinity_delete_list_field_dropdown_option","affinity_delete_note","affinity_get_company","affinity_get_current_user","affinity_get_entity_field_value","affinity_get_list","affinity_get_list_entry","affinity_get_list_entry_field","affinity_get_list_field_dropdown_option","affinity_get_merge","affinity_get_merge_task","affinity_get_note","affinity_get_opportunity","affinity_get_person","affinity_get_saved_view","affinity_get_transcript","affinity_get_user","affinity_list_calls","affinity_list_chat_messages","affinity_list_companies","affinity_list_coworker_connections","affinity_list_emails","affinity_list_entity_field_values","affinity_list_entity_list_entries","affinity_list_entity_lists","affinity_list_entity_notes","affinity_list_entity_relationships","affinity_list_field_dropdown_options","affinity_list_field_metadata","affinity_list_field_value_changes","affinity_list_investor_executive_connections","affinity_list_list_entries","affinity_list_list_entry_field_value_changes","affinity_list_list_entry_fields","affinity_list_list_field_dropdown_options","affinity_list_list_fields","affinity_list_lists","affinity_list_meetings","affinity_list_merge_tasks","affinity_list_merges","affinity_list_note_attached_companies","affinity_list_note_attached_opportunities","affinity_list_note_attached_persons","affinity_list_note_replies","affinity_list_notes","affinity_list_opportunities","affinity_list_persons","affinity_list_reminders","affinity_list_saved_view_entries","affinity_list_saved_views","affinity_list_transcript_fragments","affinity_list_transcripts","affinity_list_users","affinity_search_companies","affinity_search_files","affinity_search_list_entries","affinity_search_notes","affinity_search_persons","affinity_semantic_search","affinity_update_entity_field_value","affinity_update_list_entry_field","affinity_update_list_field_dropdown_option","affinity_update_note","agentmail_create_draft","agentmail_create_inbox","agentmail_delete_draft","agentmail_delete_inbox","agentmail_delete_thread","agentmail_forward_message","agentmail_get_draft","agentmail_get_inbox","agentmail_get_message","agentmail_get_thread","agentmail_list_drafts","agentmail_list_inboxes","agentmail_list_messages","agentmail_list_threads","agentmail_reply_message","agentmail_send_draft","agentmail_send_message","agentmail_update_draft","agentmail_update_inbox","agentmail_update_message","agentmail_update_thread","agentphone_create_call","agentphone_create_contact","agentphone_create_number","agentphone_delete_contact","agentphone_get_call","agentphone_get_call_transcript","agentphone_get_contact","agentphone_get_conversation","agentphone_get_conversation_messages","agentphone_get_number_messages","agentphone_get_usage","agentphone_get_usage_daily","agentphone_get_usage_monthly","agentphone_list_calls","agentphone_list_contacts","agentphone_list_conversations","agentphone_list_numbers","agentphone_react_to_message","agentphone_release_number","agentphone_send_message","agentphone_update_contact","agentphone_update_conversation","agiloft_async_status","agiloft_attach_file","agiloft_attachment_info","agiloft_create_record","agiloft_delete_record","agiloft_get_choice_line_id","agiloft_list_tables","agiloft_lock_record","agiloft_nlp_search","agiloft_read_record","agiloft_remove_attachment","agiloft_retrieve_attachment","agiloft_run_action_button","agiloft_saved_search","agiloft_search_records","agiloft_select_records","agiloft_update_record","agiloft_upsert_record","ahrefs_anchors","ahrefs_backlinks","ahrefs_backlinks_stats","ahrefs_batch_analysis","ahrefs_broken_backlinks","ahrefs_domain_rating","ahrefs_domain_rating_history","ahrefs_keyword_overview","ahrefs_keywords_history","ahrefs_metrics","ahrefs_metrics_history","ahrefs_organic_competitors","ahrefs_organic_keywords","ahrefs_paid_pages","ahrefs_rank_tracker_competitors_overview","ahrefs_rank_tracker_competitors_stats","ahrefs_rank_tracker_overview","ahrefs_rank_tracker_serp_overview","ahrefs_refdomains_history","ahrefs_referring_domains","ahrefs_related_terms","ahrefs_site_audit_page_explorer","ahrefs_top_pages","airtable_create_records","airtable_delete_records","airtable_get_base_schema","airtable_get_record","airtable_list_bases","airtable_list_records","airtable_list_tables","airtable_update_multiple_records","airtable_update_record","airtable_upsert_records","airweave_search","algolia_add_record","algolia_batch_operations","algolia_browse_records","algolia_clear_records","algolia_copy_move_index","algolia_delete_by_filter","algolia_delete_index","algolia_delete_record","algolia_get_record","algolia_get_records","algolia_get_settings","algolia_get_task_status","algolia_list_indices","algolia_partial_update_record","algolia_search","algolia_update_settings","amplitude_event_segmentation","amplitude_funnels","amplitude_get_active_users","amplitude_get_revenue","amplitude_group_identify","amplitude_identify_user","amplitude_list_events","amplitude_realtime_active_users","amplitude_retention","amplitude_send_event","amplitude_user_activity","amplitude_user_profile","amplitude_user_search","apify_get_dataset_items","apify_get_run","apify_run_actor_async","apify_run_actor_sync","apify_run_task","apollo_account_bulk_create","apollo_account_bulk_update","apollo_account_create","apollo_account_search","apollo_account_update","apollo_contact_bulk_create","apollo_contact_bulk_update","apollo_contact_create","apollo_contact_search","apollo_contact_update","apollo_email_accounts","apollo_opportunity_create","apollo_opportunity_get","apollo_opportunity_search","apollo_opportunity_update","apollo_organization_bulk_enrich","apollo_organization_enrich","apollo_organization_search","apollo_people_bulk_enrich","apollo_people_enrich","apollo_people_search","apollo_sequence_add_contacts","apollo_sequence_search","apollo_task_create","apollo_task_search","appconfig_create_application","appconfig_create_configuration_profile","appconfig_create_environment","appconfig_create_hosted_configuration_version","appconfig_delete_application","appconfig_delete_configuration_profile","appconfig_delete_environment","appconfig_delete_hosted_configuration_version","appconfig_get_application","appconfig_get_configuration","appconfig_get_configuration_profile","appconfig_get_deployment","appconfig_get_environment","appconfig_get_hosted_configuration_version","appconfig_list_applications","appconfig_list_configuration_profiles","appconfig_list_deployment_strategies","appconfig_list_deployments","appconfig_list_environments","appconfig_list_hosted_configuration_versions","appconfig_start_deployment","appconfig_stop_deployment","appconfig_update_application","appconfig_update_configuration_profile","appconfig_update_environment","arxiv_get_author_papers","arxiv_get_paper","arxiv_search","asana_add_comment","asana_add_followers","asana_create_project","asana_create_section","asana_create_subtask","asana_create_task","asana_delete_task","asana_get_project","asana_get_projects","asana_get_task","asana_list_sections","asana_list_workspaces","asana_search_tasks","asana_update_task","ashby_add_candidate_tag","ashby_anonymize_candidate","ashby_change_application_source","ashby_change_application_stage","ashby_create_application","ashby_create_candidate","ashby_create_note","ashby_delete_application","ashby_get_application","ashby_get_candidate","ashby_get_job","ashby_get_job_posting","ashby_get_offer","ashby_get_opening","ashby_list_application_feedback","ashby_list_application_history","ashby_list_applications","ashby_list_archive_reasons","ashby_list_candidate_tags","ashby_list_candidates","ashby_list_custom_fields","ashby_list_departments","ashby_list_interview_plans","ashby_list_interview_stages","ashby_list_interviews","ashby_list_job_postings","ashby_list_jobs","ashby_list_locations","ashby_list_notes","ashby_list_offers","ashby_list_openings","ashby_list_sources","ashby_list_users","ashby_remove_candidate_tag","ashby_search_candidates","ashby_search_jobs","ashby_search_openings","ashby_search_users","ashby_set_custom_field_value","ashby_set_custom_field_values","ashby_transfer_application","ashby_update_candidate","ashby_upload_candidate_file","ashby_upload_resume","athena_batch_get_query_execution","athena_create_named_query","athena_delete_named_query","athena_get_named_query","athena_get_query_execution","athena_get_query_results","athena_list_databases","athena_list_named_queries","athena_list_query_executions","athena_list_table_metadata","athena_start_query","athena_stop_query","attio_assert_record","attio_create_attribute","attio_create_comment","attio_create_list","attio_create_list_entry","attio_create_note","attio_create_object","attio_create_record","attio_create_task","attio_create_webhook","attio_delete_comment","attio_delete_list_entry","attio_delete_note","attio_delete_record","attio_delete_task","attio_delete_webhook","attio_get_attribute","attio_get_comment","attio_get_list","attio_get_list_entry","attio_get_member","attio_get_note","attio_get_object","attio_get_record","attio_get_task","attio_get_thread","attio_get_webhook","attio_list_attributes","attio_list_lists","attio_list_members","attio_list_notes","attio_list_objects","attio_list_records","attio_list_tasks","attio_list_threads","attio_list_webhooks","attio_query_list_entries","attio_search_records","attio_update_attribute","attio_update_list","attio_update_list_entry","attio_update_object","attio_update_record","attio_update_task","attio_update_webhook","azure_data_explorer_create_table","azure_data_explorer_drop_table","azure_data_explorer_ingest_from_query","azure_data_explorer_ingest_inline","azure_data_explorer_list_databases","azure_data_explorer_list_functions","azure_data_explorer_list_tables","azure_data_explorer_management","azure_data_explorer_query","azure_data_explorer_show_database_schema","azure_data_explorer_show_ingestion_failures","azure_data_explorer_show_operations","azure_data_explorer_show_table_details","azure_data_explorer_show_table_schema","azure_devops_add_comment","azure_devops_create_work_item","azure_devops_get_build_log","azure_devops_get_build_timeline","azure_devops_get_comments","azure_devops_get_pipeline","azure_devops_get_pipeline_run","azure_devops_get_work_item","azure_devops_get_work_items_batch","azure_devops_get_work_items_between_builds","azure_devops_list_build_logs","azure_devops_list_builds","azure_devops_list_pipeline_runs","azure_devops_list_pipelines","azure_devops_query_work_items","azure_devops_update_work_item","bitbucket_approve_pull_request","bitbucket_create_branch","bitbucket_create_pull_request","bitbucket_create_pull_request_comment","bitbucket_decline_pull_request","bitbucket_delete_branch","bitbucket_get_commit","bitbucket_get_file","bitbucket_get_file_metadata","bitbucket_get_pipeline","bitbucket_get_pipeline_step_log","bitbucket_get_pull_request","bitbucket_get_pull_request_diff","bitbucket_get_pull_request_diffstat","bitbucket_get_pull_request_merge_task_status","bitbucket_get_repository","bitbucket_list_branches","bitbucket_list_commits","bitbucket_list_directory","bitbucket_list_pipeline_steps","bitbucket_list_pipelines","bitbucket_list_pull_request_comments","bitbucket_list_pull_request_commit_statuses","bitbucket_list_pull_requests","bitbucket_list_repositories","bitbucket_list_workspaces","bitbucket_merge_pull_request","bitbucket_request_pull_request_changes","bitbucket_stop_pipeline","bitbucket_trigger_pipeline","box_copy_file","box_create_folder","box_delete_file","box_delete_folder","box_download_file","box_get_file_info","box_list_folder_items","box_search","box_sign_cancel_request","box_sign_create_request","box_sign_get_request","box_sign_list_requests","box_sign_resend_request","box_update_file","box_upload_file","brandfetch_get_brand","brandfetch_search","brex_archive_budget","brex_create_budget","brex_create_spend_limit","brex_create_transfer","brex_create_vendor","brex_get_budget","brex_get_cash_account","brex_get_company","brex_get_current_user","brex_get_expense","brex_get_spend_limit","brex_get_transfer","brex_get_user","brex_get_vendor","brex_list_budgets","brex_list_card_accounts","brex_list_card_statements","brex_list_card_transactions","brex_list_cards","brex_list_cash_accounts","brex_list_cash_statements","brex_list_cash_transactions","brex_list_departments","brex_list_expenses","brex_list_locations","brex_list_spend_limits","brex_list_titles","brex_list_transfers","brex_list_users","brex_list_vendors","brex_match_receipt","brex_update_expense","brex_update_vendor","brex_upload_receipt","brightdata_cancel_snapshot","brightdata_discover","brightdata_download_snapshot","brightdata_scrape_dataset","brightdata_scrape_url","brightdata_serp_search","brightdata_snapshot_status","brightdata_sync_scrape","browser_use_run_task","buffer_create_idea","buffer_create_post","buffer_delete_post","buffer_edit_post","buffer_get_account","buffer_get_channels","buffer_get_idea_groups","buffer_get_ideas","buffer_get_post","buffer_get_posts","calcom_cancel_booking","calcom_confirm_booking","calcom_create_booking","calcom_create_event_type","calcom_create_schedule","calcom_decline_booking","calcom_delete_event_type","calcom_delete_schedule","calcom_get_booking","calcom_get_default_schedule","calcom_get_event_type","calcom_get_schedule","calcom_get_slots","calcom_list_bookings","calcom_list_event_types","calcom_list_schedules","calcom_reschedule_booking","calcom_update_event_type","calcom_update_schedule","calendly_cancel_event","calendly_create_event_invitee","calendly_create_invitee_no_show","calendly_create_scheduling_link","calendly_create_webhook","calendly_delete_invitee_no_show","calendly_delete_webhook","calendly_get_current_user","calendly_get_event_invitee","calendly_get_event_type","calendly_get_scheduled_event","calendly_get_user","calendly_list_event_invitees","calendly_list_event_type_available_times","calendly_list_event_types","calendly_list_organization_memberships","calendly_list_routing_form_submissions","calendly_list_routing_forms","calendly_list_scheduled_events","calendly_list_user_availability_schedules","calendly_list_user_busy_times","calendly_list_webhooks","cbinsights_chat","cbinsights_get_commercial_maturity_history","cbinsights_get_exit_probability_history","cbinsights_get_mosaic_history","cbinsights_get_org_business_relationships","cbinsights_get_org_funding_window","cbinsights_get_org_fundings","cbinsights_get_org_investments","cbinsights_get_org_management_and_board","cbinsights_get_org_outlook","cbinsights_get_org_portfolio_exits","cbinsights_get_org_revenue","cbinsights_get_scouting_report","cbinsights_get_strategy_map","cbinsights_list_business_relationships","cbinsights_list_funding_window","cbinsights_list_fundings","cbinsights_list_investments","cbinsights_list_management_and_board","cbinsights_list_outlook","cbinsights_list_portfolio_exits","cbinsights_list_revenue","cbinsights_lookup_organizations","cbinsights_rag","cbinsights_search_firmographics","circleback_add_tag_to_meetings","circleback_create_tag","circleback_delete_action_item","circleback_delete_meeting","circleback_delete_tag","circleback_get_company","circleback_get_meeting","circleback_get_person","circleback_get_transcript","circleback_list_action_items","circleback_list_calendar_events","circleback_list_companies","circleback_list_meetings","circleback_list_people","circleback_list_tags","circleback_remove_tag_from_meetings","circleback_search_meetings","circleback_update_action_item","circleback_update_meeting","circleback_update_tag","clay_populate","clerk_add_organization_member","clerk_ban_user","clerk_create_actor_token","clerk_create_allowlist_identifier","clerk_create_blocklist_identifier","clerk_create_organization","clerk_create_organization_invitation","clerk_create_user","clerk_delete_allowlist_identifier","clerk_delete_blocklist_identifier","clerk_delete_organization","clerk_delete_user","clerk_get_jwt_template","clerk_get_organization","clerk_get_session","clerk_get_user","clerk_get_user_oauth_token","clerk_list_allowlist_identifiers","clerk_list_blocklist_identifiers","clerk_list_jwt_templates","clerk_list_organization_invitations","clerk_list_organization_memberships","clerk_list_organizations","clerk_list_sessions","clerk_list_users","clerk_lock_user","clerk_remove_organization_member","clerk_revoke_actor_token","clerk_revoke_session","clerk_unban_user","clerk_unlock_user","clerk_update_organization","clerk_update_organization_membership","clerk_update_user","clickhouse_count_rows","clickhouse_create_database","clickhouse_create_table","clickhouse_delete","clickhouse_describe_table","clickhouse_drop_database","clickhouse_drop_partition","clickhouse_drop_table","clickhouse_execute","clickhouse_insert","clickhouse_insert_rows","clickhouse_introspect","clickhouse_kill_query","clickhouse_list_clusters","clickhouse_list_databases","clickhouse_list_mutations","clickhouse_list_partitions","clickhouse_list_running_queries","clickhouse_list_tables","clickhouse_optimize_table","clickhouse_query","clickhouse_rename_table","clickhouse_show_create_table","clickhouse_table_stats","clickhouse_truncate_table","clickhouse_update","clickup_add_tag_to_task","clickup_create_checklist","clickup_create_checklist_item","clickup_create_comment","clickup_create_folder","clickup_create_list","clickup_create_task","clickup_create_time_entry","clickup_delete_checklist","clickup_delete_checklist_item","clickup_delete_comment","clickup_delete_task","clickup_delete_time_entry","clickup_get_comments","clickup_get_custom_fields","clickup_get_folders","clickup_get_list_members","clickup_get_lists","clickup_get_running_timer","clickup_get_space_tags","clickup_get_spaces","clickup_get_task","clickup_get_task_members","clickup_get_tasks","clickup_get_time_entries","clickup_get_workspaces","clickup_remove_custom_field_value","clickup_remove_tag_from_task","clickup_search_tasks","clickup_set_custom_field_value","clickup_start_timer","clickup_stop_timer","clickup_update_checklist","clickup_update_checklist_item","clickup_update_comment","clickup_update_task","clickup_update_time_entry","clickup_upload_attachment","cloudflare_create_access_application","cloudflare_create_access_policy","cloudflare_create_access_service_token","cloudflare_create_dns_record","cloudflare_create_r2_bucket","cloudflare_create_rate_limit_rule","cloudflare_create_ruleset","cloudflare_create_ruleset_rule","cloudflare_create_zone","cloudflare_delete_access_application","cloudflare_delete_access_policy","cloudflare_delete_dns_record","cloudflare_delete_r2_bucket","cloudflare_delete_ruleset_rule","cloudflare_delete_zone","cloudflare_dns_analytics","cloudflare_get_access_application","cloudflare_get_r2_bucket","cloudflare_get_ruleset","cloudflare_get_ruleset_entrypoint","cloudflare_get_tunnel","cloudflare_get_tunnel_configuration","cloudflare_get_worker_script_settings","cloudflare_get_zone","cloudflare_get_zone_settings","cloudflare_list_access_applications","cloudflare_list_access_groups","cloudflare_list_access_identity_providers","cloudflare_list_access_policies","cloudflare_list_access_service_tokens","cloudflare_list_certificates","cloudflare_list_dns_records","cloudflare_list_managed_ruleset_overrides","cloudflare_list_r2_buckets","cloudflare_list_rate_limit_rules","cloudflare_list_rulesets","cloudflare_list_tunnels","cloudflare_list_worker_routes","cloudflare_list_worker_scripts","cloudflare_list_zones","cloudflare_purge_cache","cloudflare_revoke_access_service_token","cloudflare_update_access_application","cloudflare_update_access_policy","cloudflare_update_dns_record","cloudflare_update_rate_limit_rule","cloudflare_update_ruleset_rule","cloudflare_update_zone_setting","cloudformation_cancel_update_stack","cloudformation_create_change_set","cloudformation_create_stack","cloudformation_delete_stack","cloudformation_describe_change_set","cloudformation_describe_stack_drift_detection_status","cloudformation_describe_stack_events","cloudformation_describe_stacks","cloudformation_detect_stack_drift","cloudformation_execute_change_set","cloudformation_get_template","cloudformation_get_template_summary","cloudformation_list_stack_resources","cloudformation_update_stack","cloudformation_validate_template","cloudtrail_cancel_query","cloudtrail_describe_query","cloudtrail_describe_trails","cloudtrail_get_event_data_store","cloudtrail_get_event_selectors","cloudtrail_get_insight_selectors","cloudtrail_get_query_results","cloudtrail_get_trail","cloudtrail_get_trail_status","cloudtrail_list_event_data_stores","cloudtrail_list_tags","cloudtrail_list_trails","cloudtrail_lookup_events","cloudtrail_start_query","cloudwatch_describe_alarm_history","cloudwatch_describe_alarms","cloudwatch_describe_log_groups","cloudwatch_describe_log_streams","cloudwatch_filter_log_events","cloudwatch_get_log_events","cloudwatch_get_metric_statistics","cloudwatch_list_metrics","cloudwatch_mute_alarm","cloudwatch_put_log_group_retention","cloudwatch_put_metric_data","cloudwatch_query_logs","cloudwatch_unmute_alarm","codepipeline_disable_stage_transition","codepipeline_enable_stage_transition","codepipeline_get_pipeline","codepipeline_get_pipeline_execution","codepipeline_get_pipeline_state","codepipeline_list_action_executions","codepipeline_list_pipeline_executions","codepipeline_list_pipelines","codepipeline_put_approval_result","codepipeline_retry_stage_execution","codepipeline_start_execution","codepipeline_stop_execution","confluence_add_label","confluence_create_blogpost","confluence_create_comment","confluence_create_page","confluence_create_page_property","confluence_create_space","confluence_create_space_property","confluence_delete_attachment","confluence_delete_blogpost","confluence_delete_comment","confluence_delete_label","confluence_delete_page","confluence_delete_page_property","confluence_delete_space","confluence_delete_space_property","confluence_get_blogpost","confluence_get_page_ancestors","confluence_get_page_children","confluence_get_page_descendants","confluence_get_page_version","confluence_get_pages_by_label","confluence_get_space","confluence_get_task","confluence_get_user","confluence_list_attachments","confluence_list_blogposts","confluence_list_blogposts_in_space","confluence_list_comments","confluence_list_labels","confluence_list_page_properties","confluence_list_page_versions","confluence_list_pages_in_space","confluence_list_space_labels","confluence_list_space_permissions","confluence_list_space_properties","confluence_list_spaces","confluence_list_tasks","confluence_retrieve","confluence_search","confluence_search_in_space","confluence_update","confluence_update_blogpost","confluence_update_comment","confluence_update_space","confluence_update_task","confluence_upload_attachment","context_dev_classify_naics","context_dev_classify_sic","context_dev_crawl","context_dev_extract","context_dev_extract_product","context_dev_extract_products","context_dev_get_brand","context_dev_get_brand_by_email","context_dev_get_brand_by_name","context_dev_get_brand_by_ticker","context_dev_identify_transaction","context_dev_map","context_dev_scrape_fonts","context_dev_scrape_html","context_dev_scrape_images","context_dev_scrape_markdown","context_dev_scrape_styleguide","context_dev_screenshot","context_dev_search","convex_action","convex_document_deltas","convex_list_documents","convex_list_tables","convex_mutation","convex_query","convex_run_function","crowdstrike_create_indicators","crowdstrike_delete_indicators","crowdstrike_delete_rtr_session","crowdstrike_execute_rtr_command","crowdstrike_get_alert_details","crowdstrike_get_case_details","crowdstrike_get_host_group_details","crowdstrike_get_indicator_details","crowdstrike_get_rtr_command_status","crowdstrike_get_sensor_aggregates","crowdstrike_get_sensor_details","crowdstrike_get_vulnerability_details","crowdstrike_init_rtr_session","crowdstrike_perform_host_action","crowdstrike_perform_host_group_action","crowdstrike_query_alerts","crowdstrike_query_cases","crowdstrike_query_host_groups","crowdstrike_query_indicators","crowdstrike_query_sensors","crowdstrike_query_vulnerabilities","crowdstrike_update_alerts","crowdstrike_update_indicators","crunchbase_autocomplete","crunchbase_get_acquisition","crunchbase_get_entity","crunchbase_get_entity_card","crunchbase_get_fields_metadata","crunchbase_get_funding_round","crunchbase_get_organization","crunchbase_get_person","crunchbase_list_deleted_entities","crunchbase_search_acquisitions","crunchbase_search_entities","crunchbase_search_funding_rounds","crunchbase_search_organizations","crunchbase_search_people","cursor_add_followup","cursor_add_followup_v2","cursor_delete_agent","cursor_delete_agent_v2","cursor_download_artifact","cursor_download_artifact_v2","cursor_get_agent","cursor_get_agent_v2","cursor_get_api_key_info","cursor_get_api_key_info_v2","cursor_get_conversation","cursor_get_conversation_v2","cursor_launch_agent","cursor_launch_agent_v2","cursor_list_agents","cursor_list_agents_v2","cursor_list_artifacts","cursor_list_artifacts_v2","cursor_list_models","cursor_list_models_v2","cursor_list_repositories","cursor_list_repositories_v2","cursor_stop_agent","cursor_stop_agent_v2","dagster_delete_run","dagster_get_asset","dagster_get_run","dagster_get_run_logs","dagster_launch_run","dagster_list_assets","dagster_list_jobs","dagster_list_runs","dagster_list_schedules","dagster_list_sensors","dagster_materialize_assets","dagster_reexecute_run","dagster_report_asset_materialization","dagster_start_schedule","dagster_start_sensor","dagster_stop_schedule","dagster_stop_sensor","dagster_terminate_run","dagster_wipe_asset","databricks_cancel_run","databricks_execute_sql","databricks_get_cluster","databricks_get_job","databricks_get_run","databricks_get_run_output","databricks_get_statement","databricks_list_clusters","databricks_list_jobs","databricks_list_runs","databricks_list_warehouses","databricks_run_job","datadog_add_incident_todo","datadog_cancel_downtime","datadog_create_dashboard","datadog_create_downtime","datadog_create_event","datadog_create_incident","datadog_create_monitor","datadog_create_slo","datadog_delete_dashboard","datadog_delete_slo","datadog_get_browser_synthetics_results","datadog_get_dashboard","datadog_get_incident","datadog_get_monitor","datadog_get_security_signal","datadog_get_slo","datadog_get_slo_history","datadog_get_synthetics_results","datadog_get_synthetics_test","datadog_list_dashboards","datadog_list_downtimes","datadog_list_incidents","datadog_list_monitors","datadog_list_security_rules","datadog_list_security_signals","datadog_list_services","datadog_list_slos","datadog_list_synthetics_tests","datadog_mute_monitor","datadog_query_logs","datadog_query_timeseries","datadog_search_spans","datadog_send_logs","datadog_submit_metrics","datadog_trigger_synthetics_tests","datadog_unmute_monitor","datadog_update_incident","datadog_update_security_signal_assignee","datadog_update_security_signal_state","datadog_update_slo","datadog_update_synthetics_status","datagma_enrich_company","datagma_enrich_person","datagma_find_email","datagma_find_phone","datagma_get_credits","daytona_create_sandbox","daytona_delete_sandbox","daytona_download_file","daytona_execute_command","daytona_get_sandbox","daytona_git_clone","daytona_list_files","daytona_list_sandboxes","daytona_run_code","daytona_start_sandbox","daytona_stop_sandbox","daytona_upload_file","deployed_block_executor","deployments_deploy","deployments_get_version","deployments_list_versions","deployments_promote","deployments_undeploy","devin_append_session_tags","devin_archive_session","devin_create_session","devin_get_session","devin_get_session_tags","devin_list_session_attachments","devin_list_session_messages","devin_list_sessions","devin_replace_session_tags","devin_send_message","devin_terminate_session","discord_add_reaction","discord_archive_thread","discord_assign_role","discord_ban_member","discord_bulk_delete_messages","discord_create_channel","discord_create_invite","discord_create_role","discord_create_thread","discord_create_webhook","discord_delete_channel","discord_delete_invite","discord_delete_message","discord_delete_role","discord_delete_webhook","discord_edit_message","discord_execute_webhook","discord_get_channel","discord_get_invite","discord_get_member","discord_get_messages","discord_get_pinned_messages","discord_get_server","discord_get_user","discord_get_webhook","discord_join_thread","discord_kick_member","discord_leave_thread","discord_list_channels","discord_list_roles","discord_pin_message","discord_remove_reaction","discord_remove_role","discord_send_message","discord_unban_member","discord_unpin_message","discord_update_channel","discord_update_member","discord_update_role","docusign_create_from_template","docusign_download_document","docusign_get_envelope","docusign_list_envelopes","docusign_list_recipients","docusign_list_templates","docusign_send_envelope","docusign_void_envelope","downdetector_get_company","downdetector_get_company_attribution","downdetector_get_company_baseline","downdetector_get_company_events","downdetector_get_company_incidents","downdetector_get_company_indicators","downdetector_get_company_last_15","downdetector_get_company_status","downdetector_get_provider","downdetector_get_reports","downdetector_get_site_companies","downdetector_list_categories","downdetector_list_incidents","downdetector_list_sites","downdetector_search_companies","dropbox_copy","dropbox_create_folder","dropbox_create_shared_link","dropbox_delete","dropbox_download","dropbox_get_metadata","dropbox_list_folder","dropbox_list_revisions","dropbox_list_shared_links","dropbox_move","dropbox_restore","dropbox_search","dropbox_upload","dropcontact_enrich_contact","dspy_chain_of_thought","dspy_predict","dspy_react","dub_bulk_create_links","dub_bulk_delete_links","dub_bulk_update_links","dub_create_link","dub_create_tag","dub_delete_link","dub_get_analytics","dub_get_events","dub_get_link","dub_get_links_count","dub_get_qr_code","dub_list_domains","dub_list_folders","dub_list_links","dub_list_tags","dub_update_link","dub_upsert_link","duckduckgo_search","dynamodb_delete","dynamodb_get","dynamodb_introspect","dynamodb_put","dynamodb_query","dynamodb_scan","dynamodb_update","dynatrace_add_problem_comment","dynatrace_add_tags","dynatrace_close_problem","dynatrace_create_settings_object","dynatrace_create_slo","dynatrace_delete_problem_comment","dynatrace_delete_settings_object","dynatrace_delete_slo","dynatrace_delete_tag","dynatrace_execute_synthetic_monitors","dynatrace_get_attack","dynatrace_get_audit_logs","dynatrace_get_entity","dynatrace_get_event","dynatrace_get_metric","dynatrace_get_problem","dynatrace_get_problem_comment","dynatrace_get_security_problem","dynatrace_get_settings_object","dynatrace_get_slo","dynatrace_get_synthetic_batch","dynatrace_ingest_event","dynatrace_ingest_logs","dynatrace_ingest_metrics","dynatrace_list_attacks","dynatrace_list_entities","dynatrace_list_entity_types","dynatrace_list_events","dynatrace_list_metrics","dynatrace_list_problem_comments","dynatrace_list_problems","dynatrace_list_remediation_items","dynatrace_list_security_problems","dynatrace_list_settings_objects","dynatrace_list_settings_schemas","dynatrace_list_slos","dynatrace_list_synthetic_monitors","dynatrace_list_tags","dynatrace_mute_security_problem","dynatrace_mute_security_problems","dynatrace_query_metrics","dynatrace_search_logs","dynatrace_unmute_security_problem","dynatrace_unmute_security_problems","dynatrace_update_problem_comment","dynatrace_update_settings_object","dynatrace_update_slo","elasticsearch_bulk","elasticsearch_cluster_health","elasticsearch_cluster_stats","elasticsearch_count","elasticsearch_create_index","elasticsearch_delete_document","elasticsearch_delete_index","elasticsearch_get_document","elasticsearch_get_index","elasticsearch_index_document","elasticsearch_list_indices","elasticsearch_search","elasticsearch_update_document","elevenlabs_audio_isolation","elevenlabs_edit_voice_settings","elevenlabs_get_user","elevenlabs_get_voice","elevenlabs_get_voice_settings","elevenlabs_list_models","elevenlabs_list_voices","elevenlabs_sound_effects","elevenlabs_speech_to_speech","elevenlabs_tts","emailbison_attach_leads_to_campaign","emailbison_attach_tags_to_leads","emailbison_create_campaign","emailbison_create_lead","emailbison_create_tag","emailbison_get_lead","emailbison_list_campaigns","emailbison_list_leads","emailbison_list_replies","emailbison_list_tags","emailbison_update_campaign","emailbison_update_campaign_status","emailbison_update_lead","embeddings_cohere","embeddings_gemini","embeddings_mistral","embeddings_ollama","embeddings_openai","embeddings_openrouter","enrich_check_credits","enrich_company_funding","enrich_company_lookup","enrich_company_revenue","enrich_disposable_email_check","enrich_email_to_ip","enrich_email_to_person_lite","enrich_email_to_phone","enrich_email_to_profile","enrich_find_email","enrich_get_post_details","enrich_ip_to_company","enrich_linkedin_profile","enrich_linkedin_to_personal_email","enrich_linkedin_to_work_email","enrich_phone_finder","enrich_reverse_hash_lookup","enrich_sales_pointer_people","enrich_search_company","enrich_search_company_activities","enrich_search_company_employees","enrich_search_jobs","enrich_search_logo","enrich_search_people","enrich_search_people_activities","enrich_search_post_comments","enrich_search_post_comments_by_url","enrich_search_post_reactions","enrich_search_post_reactions_by_url","enrich_search_posts","enrich_search_similar_companies","enrich_verify_email","enrichment_run","enrow_find_email","enrow_verify_email","exa_agent","exa_answer","exa_find_similar_links","exa_get_contents","exa_search","extend_parser","extend_parser_v2","fathom_get_summary","fathom_get_transcript","fathom_list_meeting_types","fathom_list_meetings","fathom_list_team_members","fathom_list_teams","file_append","file_compress","file_create_folder","file_decompress","file_delete_folder","file_edit","file_fetch","file_get","file_get_content","file_list","file_manage_sharing","file_move","file_parser","file_parser_v2","file_parser_v3","file_read","file_restore_folder","file_search","file_update_folder","file_write","findymail_find_email_from_linkedin","findymail_find_email_from_name","findymail_find_emails_by_domain","findymail_find_employees","findymail_find_phone","findymail_get_company","findymail_get_credits","findymail_lookup_technologies","findymail_reverse_email_lookup","findymail_search_technologies","findymail_verify_email","firecrawl_agent","firecrawl_batch_scrape","firecrawl_batch_scrape_status","firecrawl_cancel_crawl","firecrawl_crawl","firecrawl_crawl_status","firecrawl_credit_usage","firecrawl_extract","firecrawl_extract_status","firecrawl_map","firecrawl_parse","firecrawl_scrape","firecrawl_search","fireflies_add_to_live_meeting","fireflies_create_bite","fireflies_delete_transcript","fireflies_get_transcript","fireflies_get_user","fireflies_list_bites","fireflies_list_contacts","fireflies_list_transcripts","fireflies_list_users","fireflies_upload_audio","flint_create_task","flint_generate_pages","flint_get_task","function_execute","gamma_check_status","gamma_generate","gamma_generate_from_template","gamma_list_folders","gamma_list_themes","github_add_assignees","github_add_assignees_v2","github_add_labels","github_add_labels_v2","github_cancel_workflow_run","github_cancel_workflow_run_v2","github_check_star","github_check_star_v2","github_close_issue","github_close_issue_v2","github_close_pr","github_close_pr_v2","github_comment","github_comment_v2","github_compare_commits","github_compare_commits_v2","github_create_branch","github_create_branch_v2","github_create_comment_reaction","github_create_comment_reaction_v2","github_create_file","github_create_file_v2","github_create_gist","github_create_gist_v2","github_create_issue","github_create_issue_reaction","github_create_issue_reaction_v2","github_create_issue_v2","github_create_milestone","github_create_milestone_v2","github_create_pr","github_create_pr_review","github_create_pr_review_v2","github_create_pr_v2","github_create_project","github_create_project_v2","github_create_release","github_create_release_v2","github_delete_branch","github_delete_branch_v2","github_delete_comment","github_delete_comment_reaction","github_delete_comment_reaction_v2","github_delete_comment_v2","github_delete_file","github_delete_file_v2","github_delete_gist","github_delete_gist_v2","github_delete_issue_reaction","github_delete_issue_reaction_v2","github_delete_milestone","github_delete_milestone_v2","github_delete_project","github_delete_project_v2","github_delete_release","github_delete_release_v2","github_fork_gist","github_fork_gist_v2","github_fork_repo","github_fork_repo_v2","github_get_branch","github_get_branch_protection","github_get_branch_protection_v2","github_get_branch_v2","github_get_commit","github_get_commit_v2","github_get_file_content","github_get_file_content_v2","github_get_gist","github_get_gist_v2","github_get_issue","github_get_issue_v2","github_get_latest_release","github_get_latest_release_v2","github_get_milestone","github_get_milestone_v2","github_get_pr_files","github_get_pr_files_v2","github_get_project","github_get_project_v2","github_get_readme","github_get_readme_v2","github_get_release","github_get_release_v2","github_get_tree","github_get_tree_v2","github_get_workflow","github_get_workflow_run","github_get_workflow_run_v2","github_get_workflow_v2","github_issue_comment","github_issue_comment_v2","github_job_logs","github_latest_commit","github_latest_commit_v2","github_list_branches","github_list_branches_v2","github_list_commits","github_list_commits_v2","github_list_forks","github_list_forks_v2","github_list_gists","github_list_gists_v2","github_list_issue_comments","github_list_issue_comments_v2","github_list_issues","github_list_issues_v2","github_list_milestones","github_list_milestones_v2","github_list_pr_comments","github_list_pr_comments_v2","github_list_projects","github_list_projects_v2","github_list_prs","github_list_prs_v2","github_list_releases","github_list_releases_v2","github_list_review_threads","github_list_stargazers","github_list_stargazers_v2","github_list_tags","github_list_tags_v2","github_list_workflow_runs","github_list_workflow_runs_v2","github_list_workflows","github_list_workflows_v2","github_merge_pr","github_merge_pr_v2","github_pr","github_pr_v2","github_remove_label","github_remove_label_v2","github_reply_review_thread","github_repo_info","github_repo_info_v2","github_request_reviewers","github_request_reviewers_v2","github_rerun_workflow","github_rerun_workflow_v2","github_resolve_review_thread","github_search_code","github_search_code_v2","github_search_commits","github_search_commits_v2","github_search_issues","github_search_issues_v2","github_search_repos","github_search_repos_v2","github_search_users","github_search_users_v2","github_star_gist","github_star_gist_v2","github_star_repo","github_star_repo_v2","github_status_check_rollup","github_trigger_workflow","github_trigger_workflow_v2","github_unstar_gist","github_unstar_gist_v2","github_unstar_repo","github_unstar_repo_v2","github_update_branch_protection","github_update_branch_protection_v2","github_update_comment","github_update_comment_v2","github_update_file","github_update_file_v2","github_update_gist","github_update_gist_v2","github_update_issue","github_update_issue_v2","github_update_milestone","github_update_milestone_v2","github_update_pr","github_update_pr_v2","github_update_project","github_update_project_v2","github_update_release","github_update_release_v2","gitlab_activate_user","gitlab_add_member","gitlab_add_saml_group_link","gitlab_approve_access_request","gitlab_approve_merge_request","gitlab_approve_user","gitlab_ban_user","gitlab_block_user","gitlab_cancel_pipeline","gitlab_compare_branches","gitlab_create_branch","gitlab_create_file","gitlab_create_issue","gitlab_create_issue_note","gitlab_create_merge_request","gitlab_create_merge_request_note","gitlab_create_pipeline","gitlab_create_release","gitlab_create_user","gitlab_deactivate_user","gitlab_delete_branch","gitlab_delete_issue","gitlab_delete_saml_group_link","gitlab_delete_user","gitlab_delete_user_identity","gitlab_deny_access_request","gitlab_get_file","gitlab_get_group","gitlab_get_issue","gitlab_get_job_log","gitlab_get_merge_request","gitlab_get_merge_request_changes","gitlab_get_pipeline","gitlab_get_project","gitlab_invite_member","gitlab_list_access_requests","gitlab_list_branches","gitlab_list_commits","gitlab_list_groups","gitlab_list_invitations","gitlab_list_issues","gitlab_list_members","gitlab_list_merge_requests","gitlab_list_pipeline_jobs","gitlab_list_pipelines","gitlab_list_projects","gitlab_list_releases","gitlab_list_repository_tree","gitlab_list_saml_group_links","gitlab_list_user_memberships","gitlab_merge_merge_request","gitlab_play_job","gitlab_reject_user","gitlab_remove_member","gitlab_retry_pipeline","gitlab_revoke_invitation","gitlab_search_users","gitlab_unban_user","gitlab_unblock_user","gitlab_update_file","gitlab_update_invitation","gitlab_update_issue","gitlab_update_member","gitlab_update_merge_request","gitlab_update_user","gmail_add_label","gmail_add_label_v2","gmail_archive","gmail_archive_v2","gmail_create_label_v2","gmail_delete","gmail_delete_draft_v2","gmail_delete_label_v2","gmail_delete_v2","gmail_draft","gmail_draft_v2","gmail_edit_draft_v2","gmail_get_draft_v2","gmail_get_thread_v2","gmail_list_drafts_v2","gmail_list_labels_v2","gmail_list_threads_v2","gmail_mark_read","gmail_mark_read_v2","gmail_mark_unread","gmail_mark_unread_v2","gmail_move","gmail_move_v2","gmail_read","gmail_read_v2","gmail_remove_label","gmail_remove_label_v2","gmail_search","gmail_search_v2","gmail_send","gmail_send_v2","gmail_trash_thread_v2","gmail_unarchive","gmail_unarchive_v2","gmail_untrash_thread_v2","gmail_update_label_v2","gong_aggregate_activity","gong_aggregate_by_period","gong_answered_scorecards","gong_ask_anything","gong_assign_flow_prospects","gong_create_call","gong_day_by_day_activity","gong_get_brief","gong_get_call","gong_get_call_transcript","gong_get_coaching","gong_get_extensive_calls","gong_get_folder_content","gong_get_logs","gong_get_prospect_flows","gong_get_user","gong_interaction_stats","gong_list_calls","gong_list_flows","gong_list_library_folders","gong_list_scorecards","gong_list_trackers","gong_list_users","gong_list_workspaces","gong_lookup_email","gong_lookup_phone","gong_purge_email_address","gong_purge_phone_number","gong_unassign_flow_prospects","google_ads_ad_performance","google_ads_campaign_performance","google_ads_list_ad_groups","google_ads_list_campaigns","google_ads_list_customers","google_ads_search","google_appsheet_add_rows","google_appsheet_delete_rows","google_appsheet_edit_rows","google_appsheet_find_rows","google_bigquery_create_dataset","google_bigquery_create_table","google_bigquery_delete_dataset","google_bigquery_delete_table","google_bigquery_get_query_results","google_bigquery_get_table","google_bigquery_insert_rows","google_bigquery_list_datasets","google_bigquery_list_table_data","google_bigquery_list_tables","google_bigquery_query","google_books_volume_details","google_books_volume_search","google_calendar_create","google_calendar_create_calendar","google_calendar_create_calendar_v2","google_calendar_create_v2","google_calendar_delete","google_calendar_delete_calendar","google_calendar_delete_calendar_v2","google_calendar_delete_v2","google_calendar_freebusy","google_calendar_freebusy_v2","google_calendar_get","google_calendar_get_v2","google_calendar_instances","google_calendar_instances_v2","google_calendar_invite","google_calendar_invite_v2","google_calendar_list","google_calendar_list_acl","google_calendar_list_acl_v2","google_calendar_list_calendars","google_calendar_list_calendars_v2","google_calendar_list_v2","google_calendar_move","google_calendar_move_v2","google_calendar_quick_add","google_calendar_quick_add_v2","google_calendar_share_calendar","google_calendar_share_calendar_v2","google_calendar_unshare_calendar","google_calendar_unshare_calendar_v2","google_calendar_update","google_calendar_update_acl","google_calendar_update_acl_v2","google_calendar_update_calendar","google_calendar_update_calendar_v2","google_calendar_update_v2","google_contacts_create","google_contacts_delete","google_contacts_get","google_contacts_list","google_contacts_search","google_contacts_update","google_docs_create","google_docs_create_named_range","google_docs_create_paragraph_bullets","google_docs_delete_content_range","google_docs_delete_named_range","google_docs_delete_paragraph_bullets","google_docs_insert_image","google_docs_insert_page_break","google_docs_insert_table","google_docs_insert_text","google_docs_read","google_docs_replace_text","google_docs_update_paragraph_style","google_docs_update_text_style","google_docs_write","google_drive_copy","google_drive_create_comment","google_drive_create_folder","google_drive_delete","google_drive_delete_comment","google_drive_download","google_drive_export","google_drive_get_about","google_drive_get_content","google_drive_get_file","google_drive_get_revision","google_drive_list","google_drive_list_comments","google_drive_list_permissions","google_drive_list_revisions","google_drive_move","google_drive_search","google_drive_share","google_drive_trash","google_drive_unshare","google_drive_untrash","google_drive_update","google_drive_upload","google_forms_batch_update","google_forms_create_form","google_forms_create_watch","google_forms_delete_watch","google_forms_get_form","google_forms_get_responses","google_forms_list_watches","google_forms_renew_watch","google_forms_set_publish_settings","google_groups_add_alias","google_groups_add_member","google_groups_create_group","google_groups_delete_group","google_groups_get_group","google_groups_get_member","google_groups_get_settings","google_groups_has_member","google_groups_list_aliases","google_groups_list_groups","google_groups_list_members","google_groups_remove_alias","google_groups_remove_member","google_groups_update_group","google_groups_update_member","google_groups_update_settings","google_maps_air_quality","google_maps_directions","google_maps_distance_matrix","google_maps_elevation","google_maps_geocode","google_maps_geolocate","google_maps_place_details","google_maps_places_nearby","google_maps_places_search","google_maps_pollen","google_maps_reverse_geocode","google_maps_snap_to_roads","google_maps_solar","google_maps_speed_limits","google_maps_timezone","google_maps_validate_address","google_meet_create_space","google_meet_end_conference","google_meet_get_conference_record","google_meet_get_space","google_meet_list_conference_records","google_meet_list_participants","google_pagespeed_analyze","google_search","google_sheets_append","google_sheets_append_v2","google_sheets_batch_clear_v2","google_sheets_batch_get_v2","google_sheets_batch_update_v2","google_sheets_clear_v2","google_sheets_copy_sheet_v2","google_sheets_create_spreadsheet_v2","google_sheets_delete_rows_v2","google_sheets_delete_sheet_v2","google_sheets_delete_spreadsheet_v2","google_sheets_get_spreadsheet_v2","google_sheets_read","google_sheets_read_v2","google_sheets_update","google_sheets_update_v2","google_sheets_write","google_sheets_write_v2","google_slides_add_image","google_slides_add_slide","google_slides_batch_update","google_slides_copy_presentation","google_slides_create","google_slides_create_line","google_slides_create_paragraph_bullets","google_slides_create_shape","google_slides_create_sheets_chart","google_slides_create_table","google_slides_create_video","google_slides_delete_object","google_slides_delete_paragraph_bullets","google_slides_delete_table_column","google_slides_delete_table_row","google_slides_delete_text","google_slides_duplicate_object","google_slides_export_presentation","google_slides_get_page","google_slides_get_thumbnail","google_slides_group_objects","google_slides_insert_table_columns","google_slides_insert_table_rows","google_slides_insert_text","google_slides_merge_table_cells","google_slides_read","google_slides_refresh_sheets_chart","google_slides_replace_all_shapes_with_image","google_slides_replace_all_shapes_with_sheets_chart","google_slides_replace_all_text","google_slides_replace_image","google_slides_reroute_line","google_slides_ungroup_objects","google_slides_unmerge_table_cells","google_slides_update_image_properties","google_slides_update_line_category","google_slides_update_line_properties","google_slides_update_page_element_alt_text","google_slides_update_page_element_transform","google_slides_update_page_elements_z_order","google_slides_update_page_properties","google_slides_update_paragraph_style","google_slides_update_shape_properties","google_slides_update_slide_properties","google_slides_update_slides_position","google_slides_update_table_border_properties","google_slides_update_table_cell_properties","google_slides_update_table_column_properties","google_slides_update_table_row_properties","google_slides_update_text_style","google_slides_update_video_properties","google_slides_write","google_tasks_create","google_tasks_delete","google_tasks_get","google_tasks_list","google_tasks_list_task_lists","google_tasks_update","google_translate_detect","google_translate_text","google_vault_add_held_accounts","google_vault_add_matters_permissions","google_vault_close_matters","google_vault_create_matters","google_vault_create_matters_export","google_vault_create_matters_holds","google_vault_create_saved_query","google_vault_delete_matters","google_vault_delete_matters_export","google_vault_delete_matters_holds","google_vault_delete_saved_query","google_vault_download_export_file","google_vault_list_matters","google_vault_list_matters_export","google_vault_list_matters_holds","google_vault_list_saved_queries","google_vault_remove_held_accounts","google_vault_remove_matters_permissions","google_vault_reopen_matters","google_vault_undelete_matters","google_vault_update_matters","google_vault_update_matters_holds","grafana_check_data_source_health","grafana_create_alert_rule","grafana_create_annotation","grafana_create_contact_point","grafana_create_dashboard","grafana_create_folder","grafana_delete_alert_rule","grafana_delete_annotation","grafana_delete_contact_point","grafana_delete_dashboard","grafana_delete_folder","grafana_get_alert_rule","grafana_get_alert_rule_group","grafana_get_dashboard","grafana_get_data_source","grafana_get_folder","grafana_get_health","grafana_list_alert_rules","grafana_list_annotations","grafana_list_contact_points","grafana_list_dashboards","grafana_list_data_sources","grafana_list_folders","grafana_move_folder","grafana_query_data_source","grafana_update_alert_rule","grafana_update_annotation","grafana_update_contact_point","grafana_update_dashboard","grafana_update_folder","grain_create_hook","grain_create_hook_v2","grain_delete_hook","grain_delete_hook_v2","grain_get_recording","grain_get_transcript","grain_list_hooks","grain_list_hooks_v2","grain_list_meeting_types","grain_list_recordings","grain_list_teams","grain_list_views","granola_create_webhook_endpoint","granola_delete_webhook_endpoint","granola_get_note","granola_get_transcript","granola_list_audit_events","granola_list_folders","granola_list_notes","granola_list_webhook_endpoints","granola_update_webhook_endpoint","greenhouse_get_application","greenhouse_get_candidate","greenhouse_get_job","greenhouse_get_user","greenhouse_list_applications","greenhouse_list_candidates","greenhouse_list_departments","greenhouse_list_job_stages","greenhouse_list_jobs","greenhouse_list_offices","greenhouse_list_users","greptile_index_repo","greptile_query","greptile_search","greptile_status","guardrails_validate","harmonic_batch_get_people","harmonic_clear_people_saved_search_net_new_results","harmonic_enrich_person","harmonic_get_company_employees","harmonic_get_email_enrichment_job","harmonic_get_email_enrichment_usage","harmonic_get_enrichment_status","harmonic_get_people_saved_search_net_new_results","harmonic_get_people_saved_search_results","harmonic_get_person","harmonic_list_people_saved_searches","harmonic_search_people_scout","harmonic_submit_email_enrichment_job","hex_cancel_run","hex_create_collection","hex_create_group","hex_deactivate_user","hex_delete_group","hex_get_collection","hex_get_data_connection","hex_get_group","hex_get_project","hex_get_project_runs","hex_get_queried_tables","hex_get_run_status","hex_list_collections","hex_list_data_connections","hex_list_groups","hex_list_projects","hex_list_users","hex_run_project","hex_update_collection","hex_update_group","hex_update_project","http_request","hubspot_add_list_memberships","hubspot_create_appointment","hubspot_create_association","hubspot_create_company","hubspot_create_contact","hubspot_create_deal","hubspot_create_email","hubspot_create_line_item","hubspot_create_list","hubspot_create_note","hubspot_create_ticket","hubspot_delete_association","hubspot_delete_company","hubspot_delete_contact","hubspot_delete_deal","hubspot_delete_line_item","hubspot_delete_ticket","hubspot_get_appointment","hubspot_get_association_labels","hubspot_get_cart","hubspot_get_company","hubspot_get_contact","hubspot_get_deal","hubspot_get_email","hubspot_get_line_item","hubspot_get_list","hubspot_get_list_memberships","hubspot_get_marketing_event","hubspot_get_note","hubspot_get_properties","hubspot_get_quote","hubspot_get_ticket","hubspot_get_users","hubspot_list_appointments","hubspot_list_associations","hubspot_list_carts","hubspot_list_companies","hubspot_list_contacts","hubspot_list_deals","hubspot_list_emails","hubspot_list_line_items","hubspot_list_lists","hubspot_list_marketing_events","hubspot_list_notes","hubspot_list_owners","hubspot_list_quotes","hubspot_list_tickets","hubspot_remove_list_memberships","hubspot_search_companies","hubspot_search_contacts","hubspot_search_deals","hubspot_search_emails","hubspot_search_line_items","hubspot_search_notes","hubspot_search_quotes","hubspot_search_tickets","hubspot_update_appointment","hubspot_update_company","hubspot_update_contact","hubspot_update_deal","hubspot_update_line_item","hubspot_update_ticket","huggingface_chat","hunter_companies_find","hunter_discover","hunter_domain_search","hunter_email_count","hunter_email_finder","hunter_email_verifier","iam_add_user_to_group","iam_attach_role_policy","iam_attach_user_policy","iam_create_access_key","iam_create_role","iam_create_user","iam_delete_access_key","iam_delete_role","iam_delete_user","iam_detach_role_policy","iam_detach_user_policy","iam_get_policy","iam_get_role","iam_get_user","iam_list_access_keys","iam_list_attached_role_policies","iam_list_attached_user_policies","iam_list_groups","iam_list_policies","iam_list_roles","iam_list_users","iam_remove_user_from_group","iam_simulate_principal_policy","iam_update_access_key","icypeas_find_email","icypeas_verify_email","identity_center_check_assignment_deletion_status","identity_center_check_assignment_status","identity_center_create_account_assignment","identity_center_delete_account_assignment","identity_center_describe_account","identity_center_describe_group","identity_center_describe_user","identity_center_get_group","identity_center_get_user","identity_center_list_account_assignments","identity_center_list_accounts","identity_center_list_assignments_for_account","identity_center_list_group_memberships","identity_center_list_groups","identity_center_list_instances","identity_center_list_permission_sets","image_generate","incidentio_actions_create","incidentio_actions_list","incidentio_actions_show","incidentio_actions_update","incidentio_alert_events_create","incidentio_alerts_list","incidentio_alerts_resolve","incidentio_alerts_show","incidentio_catalog_entries_list","incidentio_catalog_types_list","incidentio_custom_fields_create","incidentio_custom_fields_delete","incidentio_custom_fields_list","incidentio_custom_fields_show","incidentio_custom_fields_update","incidentio_escalation_paths_create","incidentio_escalation_paths_delete","incidentio_escalation_paths_list","incidentio_escalation_paths_show","incidentio_escalation_paths_update","incidentio_escalations_cancel","incidentio_escalations_create","incidentio_escalations_list","incidentio_escalations_show","incidentio_follow_ups_create","incidentio_follow_ups_list","incidentio_follow_ups_show","incidentio_follow_ups_update","incidentio_incident_alerts_list","incidentio_incident_memberships_create","incidentio_incident_memberships_revoke","incidentio_incident_participants_list","incidentio_incident_roles_create","incidentio_incident_roles_delete","incidentio_incident_roles_list","incidentio_incident_roles_show","incidentio_incident_roles_update","incidentio_incident_statuses_list","incidentio_incident_timestamps_list","incidentio_incident_timestamps_show","incidentio_incident_types_list","incidentio_incident_updates_list","incidentio_incidents_create","incidentio_incidents_list","incidentio_incidents_show","incidentio_incidents_update","incidentio_on_call_now","incidentio_schedule_entries_list","incidentio_schedule_overrides_create","incidentio_schedule_overrides_list","incidentio_schedules_create","incidentio_schedules_delete","incidentio_schedules_list","incidentio_schedules_show","incidentio_schedules_update","incidentio_severities_list","incidentio_teams_list","incidentio_teams_show","incidentio_users_list","incidentio_users_show","incidentio_workflows_create","incidentio_workflows_delete","incidentio_workflows_list","incidentio_workflows_show","incidentio_workflows_update","infisical_create_secret","infisical_delete_secret","infisical_get_secret","infisical_list_secrets","infisical_update_secret","instagram_delete_comment","instagram_download_media","instagram_get_account_insights","instagram_get_container_status","instagram_get_conversation_messages","instagram_get_media","instagram_get_media_insights","instagram_get_message","instagram_get_profile","instagram_get_publishing_limit","instagram_hide_comment","instagram_list_comments","instagram_list_conversations","instagram_list_media","instagram_list_stories","instagram_private_reply","instagram_publish_carousel","instagram_publish_image","instagram_publish_reel","instagram_publish_story","instagram_publish_video","instagram_reply_to_comment","instagram_send_text_message","instagram_set_comments_enabled","instantly_activate_campaign","instantly_create_campaign","instantly_create_lead","instantly_create_lead_list","instantly_delete_campaign","instantly_delete_leads","instantly_get_lead","instantly_list_campaigns","instantly_list_emails","instantly_list_lead_lists","instantly_list_leads","instantly_patch_campaign","instantly_patch_lead","instantly_pause_campaign","instantly_reply_to_email","instantly_update_lead_interest_status","intercom_assign_conversation_v2","intercom_attach_contact_to_company_v2","intercom_close_conversation_v2","intercom_create_company","intercom_create_company_v2","intercom_create_contact","intercom_create_contact_v2","intercom_create_event_v2","intercom_create_message","intercom_create_message_v2","intercom_create_note_v2","intercom_create_tag_v2","intercom_create_ticket","intercom_create_ticket_v2","intercom_delete_contact","intercom_delete_contact_v2","intercom_detach_contact_from_company_v2","intercom_get_company","intercom_get_company_v2","intercom_get_contact","intercom_get_contact_v2","intercom_get_conversation","intercom_get_conversation_v2","intercom_get_ticket","intercom_get_ticket_v2","intercom_list_admins_v2","intercom_list_companies","intercom_list_companies_v2","intercom_list_contacts","intercom_list_contacts_v2","intercom_list_conversations","intercom_list_conversations_v2","intercom_list_tags_v2","intercom_open_conversation_v2","intercom_reply_conversation","intercom_reply_conversation_v2","intercom_search_contacts","intercom_search_contacts_v2","intercom_search_conversations","intercom_search_conversations_v2","intercom_snooze_conversation_v2","intercom_tag_contact_v2","intercom_tag_conversation_v2","intercom_untag_contact_v2","intercom_update_contact","intercom_update_contact_v2","intercom_update_ticket_v2","jina_read_url","jina_search","jira_add_attachment","jira_add_comment","jira_add_watcher","jira_add_worklog","jira_assign_issue","jira_bulk_read","jira_create_issue_link","jira_delete_attachment","jira_delete_comment","jira_delete_issue","jira_delete_issue_link","jira_delete_worklog","jira_get_attachments","jira_get_comments","jira_get_fields","jira_get_project","jira_get_transitions","jira_get_users","jira_get_worklogs","jira_list_issue_types","jira_list_projects","jira_remove_watcher","jira_retrieve","jira_search_issues","jira_search_users","jira_transition_issue","jira_update","jira_update_comment","jira_update_worklog","jira_write","jotform_add_label_resources","jotform_clone_form","jotform_create_form","jotform_create_label","jotform_create_question","jotform_create_questions","jotform_create_report","jotform_create_submission","jotform_create_submissions","jotform_create_webhook","jotform_delete_form","jotform_delete_label","jotform_delete_question","jotform_delete_report","jotform_delete_submission","jotform_delete_webhook","jotform_get_form","jotform_get_form_properties","jotform_get_history","jotform_get_label","jotform_get_question","jotform_get_report","jotform_get_settings","jotform_get_submission","jotform_get_usage","jotform_get_user","jotform_list_form_files","jotform_list_form_reports","jotform_list_form_submissions","jotform_list_forms","jotform_list_label_resources","jotform_list_labels","jotform_list_questions","jotform_list_reports","jotform_list_submissions","jotform_list_subusers","jotform_list_webhooks","jotform_remove_label_resources","jotform_update_form_properties","jotform_update_label","jotform_update_question","jotform_update_settings","jotform_update_submission","jsm_add_comment","jsm_add_customer","jsm_add_organization","jsm_add_participants","jsm_answer_approval","jsm_attach_form","jsm_copy_forms","jsm_create_object","jsm_create_organization","jsm_create_request","jsm_delete_form","jsm_delete_object","jsm_externalise_form","jsm_get_approvals","jsm_get_comments","jsm_get_customers","jsm_get_form","jsm_get_form_answers","jsm_get_form_structure","jsm_get_form_templates","jsm_get_issue_forms","jsm_get_object","jsm_get_object_schema","jsm_get_object_type_attributes","jsm_get_organizations","jsm_get_participants","jsm_get_queues","jsm_get_request","jsm_get_request_type_fields","jsm_get_request_types","jsm_get_requests","jsm_get_service_desks","jsm_get_sla","jsm_get_transitions","jsm_internalise_form","jsm_list_object_schemas","jsm_list_object_types","jsm_reopen_form","jsm_save_form_answers","jsm_search_objects_aql","jsm_submit_form","jsm_transition_request","jsm_update_object","jupyter_copy_content","jupyter_create_file","jupyter_create_session","jupyter_delete_content","jupyter_delete_session","jupyter_get_content","jupyter_interrupt_kernel","jupyter_list_contents","jupyter_list_kernels","jupyter_list_kernelspecs","jupyter_list_sessions","jupyter_rename_content","jupyter_restart_kernel","jupyter_start_kernel","jupyter_stop_kernel","jupyter_upload_file","kalshi_amend_order","kalshi_amend_order_v2","kalshi_cancel_order","kalshi_cancel_order_v2","kalshi_create_order","kalshi_create_order_v2","kalshi_get_balance","kalshi_get_balance_v2","kalshi_get_candlesticks","kalshi_get_candlesticks_v2","kalshi_get_event","kalshi_get_event_candlesticks","kalshi_get_event_candlesticks_v2","kalshi_get_event_v2","kalshi_get_events","kalshi_get_events_v2","kalshi_get_exchange_announcements","kalshi_get_exchange_announcements_v2","kalshi_get_exchange_schedule","kalshi_get_exchange_schedule_v2","kalshi_get_exchange_status","kalshi_get_exchange_status_v2","kalshi_get_fills","kalshi_get_fills_v2","kalshi_get_market","kalshi_get_market_v2","kalshi_get_markets","kalshi_get_markets_v2","kalshi_get_order","kalshi_get_order_v2","kalshi_get_orderbook","kalshi_get_orderbook_v2","kalshi_get_orders","kalshi_get_orders_v2","kalshi_get_positions","kalshi_get_positions_v2","kalshi_get_series_by_ticker","kalshi_get_series_by_ticker_v2","kalshi_get_series_list","kalshi_get_series_list_v2","kalshi_get_settlements","kalshi_get_settlements_v2","kalshi_get_trades","kalshi_get_trades_v2","ketch_get_consent","ketch_get_subscriptions","ketch_invoke_right","ketch_set_consent","ketch_set_subscriptions","knowledge_create_document","knowledge_delete_chunk","knowledge_delete_document","knowledge_get_connector","knowledge_get_document","knowledge_list_chunks","knowledge_list_connectors","knowledge_list_documents","knowledge_list_tags","knowledge_search","knowledge_trigger_sync","knowledge_update_chunk","knowledge_upload_chunk","knowledge_upsert_document","lambda_add_permission","lambda_create_alias","lambda_create_event_source_mapping","lambda_create_function","lambda_create_function_url_config","lambda_delete_alias","lambda_delete_event_source_mapping","lambda_delete_function","lambda_delete_function_concurrency","lambda_delete_function_event_invoke_config","lambda_delete_function_url_config","lambda_delete_provisioned_concurrency_config","lambda_get_account_settings","lambda_get_alias","lambda_get_event_source_mapping","lambda_get_function","lambda_get_function_concurrency","lambda_get_function_configuration","lambda_get_function_event_invoke_config","lambda_get_function_recursion_config","lambda_get_function_url_config","lambda_get_layer_version","lambda_get_policy","lambda_get_provisioned_concurrency_config","lambda_get_runtime_management_config","lambda_invoke","lambda_list_aliases","lambda_list_event_source_mappings","lambda_list_function_event_invoke_configs","lambda_list_function_url_configs","lambda_list_functions","lambda_list_layer_versions","lambda_list_layers","lambda_list_provisioned_concurrency_configs","lambda_list_tags","lambda_list_versions_by_function","lambda_publish_version","lambda_put_function_concurrency","lambda_put_function_event_invoke_config","lambda_put_function_recursion_config","lambda_put_provisioned_concurrency_config","lambda_put_runtime_management_config","lambda_remove_permission","lambda_tag_resource","lambda_untag_resource","lambda_update_alias","lambda_update_event_source_mapping","lambda_update_function_code","lambda_update_function_configuration","lambda_update_function_url_config","langsmith_create_feedback","langsmith_create_run","langsmith_create_runs_batch","langsmith_get_run","langsmith_update_run","latex_compile","latex_get_package","latex_list_fonts","latex_search_packages","launchdarkly_create_flag","launchdarkly_delete_flag","launchdarkly_get_audit_log","launchdarkly_get_flag","launchdarkly_get_flag_status","launchdarkly_list_environments","launchdarkly_list_flags","launchdarkly_list_members","launchdarkly_list_projects","launchdarkly_list_segments","launchdarkly_toggle_flag","launchdarkly_update_flag","leadmagic_company_search","leadmagic_email_to_profile","leadmagic_find_email","leadmagic_find_mobile","leadmagic_get_credits","leadmagic_profile_search","leadmagic_profile_to_email","leadmagic_role_finder","leadmagic_validate_email","lemlist_get_activities","lemlist_get_lead","lemlist_send_email","linear_add_label_to_issue","linear_add_label_to_project","linear_archive_issue","linear_archive_label","linear_archive_project","linear_create_attachment","linear_create_comment","linear_create_customer","linear_create_customer_request","linear_create_customer_status","linear_create_customer_tier","linear_create_cycle","linear_create_favorite","linear_create_issue","linear_create_issue_relation","linear_create_label","linear_create_project","linear_create_project_label","linear_create_project_milestone","linear_create_project_status","linear_create_project_update","linear_create_workflow_state","linear_delete_attachment","linear_delete_comment","linear_delete_customer","linear_delete_customer_status","linear_delete_customer_tier","linear_delete_issue","linear_delete_issue_relation","linear_delete_project","linear_delete_project_label","linear_delete_project_milestone","linear_delete_project_status","linear_get_active_cycle","linear_get_customer","linear_get_cycle","linear_get_issue","linear_get_project","linear_get_viewer","linear_list_attachments","linear_list_comments","linear_list_customer_requests","linear_list_customer_statuses","linear_list_customer_tiers","linear_list_customers","linear_list_cycles","linear_list_favorites","linear_list_issue_relations","linear_list_labels","linear_list_notifications","linear_list_project_labels","linear_list_project_milestones","linear_list_project_statuses","linear_list_project_updates","linear_list_projects","linear_list_teams","linear_list_users","linear_list_workflow_states","linear_merge_customers","linear_read_issues","linear_remove_label_from_issue","linear_remove_label_from_project","linear_search_issues","linear_unarchive_issue","linear_update_attachment","linear_update_comment","linear_update_customer","linear_update_customer_request","linear_update_customer_status","linear_update_customer_tier","linear_update_issue","linear_update_label","linear_update_notification","linear_update_project","linear_update_project_label","linear_update_project_milestone","linear_update_project_status","linear_update_workflow_state","linkedin_get_profile","linkedin_share_post","linkup_search","linq_add_participant","linq_check_imessage","linq_check_rcs","linq_create_attachment","linq_create_chat","linq_create_contact_card","linq_create_webhook_subscription","linq_delete_attachment","linq_delete_message","linq_delete_webhook_subscription","linq_edit_message","linq_get_attachment","linq_get_chat","linq_get_contact_card","linq_get_message","linq_get_webhook_subscription","linq_leave_chat","linq_list_chats","linq_list_messages","linq_list_phone_numbers","linq_list_thread","linq_list_webhook_events","linq_list_webhook_subscriptions","linq_mark_chat_read","linq_react_to_message","linq_remove_participant","linq_send_message","linq_send_voice_memo","linq_share_contact_card","linq_start_typing","linq_stop_typing","linq_update_chat","linq_update_contact_card","linq_update_webhook_subscription","llm_chat","logfire_get_token_info","logfire_get_trace","logfire_query","logfire_search_records","logrocket_create_release","logrocket_get_audit_logs","logrocket_get_highlights","logrocket_identify_user","logrocket_list_exported_sessions","logrocket_request_highlights","logs_get","logs_get_execution","logs_get_run_details","logs_query","logs_query_runs","loops_check_contact_suppression","loops_create_contact","loops_create_contact_property","loops_delete_contact","loops_find_contact","loops_get_transactional_email","loops_list_contact_properties","loops_list_mailing_lists","loops_list_transactional_emails","loops_remove_contact_suppression","loops_send_event","loops_send_transactional_email","loops_update_contact","luma_add_guests","luma_cancel_event","luma_create_event","luma_get_event","luma_get_guest","luma_get_guests","luma_list_events","luma_lookup_event","luma_send_invites","luma_update_event","luma_update_guest_status","mailchimp_add_member","mailchimp_add_member_tags","mailchimp_add_or_update_member","mailchimp_add_segment_member","mailchimp_add_subscriber_to_automation","mailchimp_archive_member","mailchimp_create_audience","mailchimp_create_batch_operation","mailchimp_create_campaign","mailchimp_create_interest","mailchimp_create_interest_category","mailchimp_create_landing_page","mailchimp_create_merge_field","mailchimp_create_segment","mailchimp_create_template","mailchimp_delete_audience","mailchimp_delete_batch_operation","mailchimp_delete_campaign","mailchimp_delete_interest","mailchimp_delete_interest_category","mailchimp_delete_landing_page","mailchimp_delete_member","mailchimp_delete_merge_field","mailchimp_delete_segment","mailchimp_delete_template","mailchimp_get_audience","mailchimp_get_audiences","mailchimp_get_automation","mailchimp_get_automations","mailchimp_get_batch_operation","mailchimp_get_batch_operations","mailchimp_get_campaign","mailchimp_get_campaign_content","mailchimp_get_campaign_report","mailchimp_get_campaign_reports","mailchimp_get_campaigns","mailchimp_get_interest","mailchimp_get_interest_categories","mailchimp_get_interest_category","mailchimp_get_interests","mailchimp_get_landing_page","mailchimp_get_landing_pages","mailchimp_get_member","mailchimp_get_member_tags","mailchimp_get_members","mailchimp_get_merge_field","mailchimp_get_merge_fields","mailchimp_get_segment","mailchimp_get_segment_members","mailchimp_get_segments","mailchimp_get_template","mailchimp_get_templates","mailchimp_pause_automation","mailchimp_publish_landing_page","mailchimp_remove_member_tags","mailchimp_remove_segment_member","mailchimp_replicate_campaign","mailchimp_schedule_campaign","mailchimp_send_campaign","mailchimp_set_campaign_content","mailchimp_start_automation","mailchimp_unarchive_member","mailchimp_unpublish_landing_page","mailchimp_unschedule_campaign","mailchimp_update_audience","mailchimp_update_campaign","mailchimp_update_interest","mailchimp_update_interest_category","mailchimp_update_landing_page","mailchimp_update_member","mailchimp_update_merge_field","mailchimp_update_segment","mailchimp_update_template","mailgun_add_list_member","mailgun_create_mailing_list","mailgun_get_domain","mailgun_get_mailing_list","mailgun_get_message","mailgun_list_domains","mailgun_list_messages","mailgun_send_message","managed_agent_archive_session","managed_agent_create_session","managed_agent_delete_session","managed_agent_get_session","managed_agent_interrupt_session","managed_agent_list_events","managed_agent_respond_custom_tool","managed_agent_respond_tool_confirmation","managed_agent_run_session","managed_agent_send_message","managed_agent_update_session","manageengine_sdp_add_change_note","manageengine_sdp_add_problem_note","manageengine_sdp_add_request_note","manageengine_sdp_create_asset","manageengine_sdp_create_change","manageengine_sdp_create_problem","manageengine_sdp_create_request","manageengine_sdp_create_solution","manageengine_sdp_delete_asset","manageengine_sdp_delete_change","manageengine_sdp_delete_problem","manageengine_sdp_delete_request","manageengine_sdp_delete_solution","manageengine_sdp_get_asset","manageengine_sdp_get_change","manageengine_sdp_get_problem","manageengine_sdp_get_request","manageengine_sdp_get_solution","manageengine_sdp_list_assets","manageengine_sdp_list_change_notes","manageengine_sdp_list_changes","manageengine_sdp_list_problem_notes","manageengine_sdp_list_problems","manageengine_sdp_list_request_notes","manageengine_sdp_list_requests","manageengine_sdp_list_solutions","manageengine_sdp_update_asset","manageengine_sdp_update_change","manageengine_sdp_update_problem","manageengine_sdp_update_request","manageengine_sdp_update_solution","mem0_add_memories","mem0_get_memories","mem0_search_memories","memory_add","memory_delete","memory_get","memory_get_all","microsoft_ad_add_directory_role_member","microsoft_ad_add_group_member","microsoft_ad_add_user_app_role_assignment","microsoft_ad_assign_license","microsoft_ad_create_group","microsoft_ad_create_user","microsoft_ad_delete_group","microsoft_ad_delete_user","microsoft_ad_get_conditional_access_policy","microsoft_ad_get_device","microsoft_ad_get_group","microsoft_ad_get_user","microsoft_ad_list_authentication_methods","microsoft_ad_list_conditional_access_policies","microsoft_ad_list_devices","microsoft_ad_list_directory_audits","microsoft_ad_list_directory_role_members","microsoft_ad_list_directory_roles","microsoft_ad_list_group_members","microsoft_ad_list_groups","microsoft_ad_list_service_principal_app_role_assignments","microsoft_ad_list_service_principals","microsoft_ad_list_sign_ins","microsoft_ad_list_subscribed_skus","microsoft_ad_list_user_app_role_assignments","microsoft_ad_list_user_devices","microsoft_ad_list_user_licenses","microsoft_ad_list_users","microsoft_ad_remove_directory_role_member","microsoft_ad_remove_group_member","microsoft_ad_remove_user_app_role_assignment","microsoft_ad_reset_password","microsoft_ad_revoke_sign_in_sessions","microsoft_ad_set_password","microsoft_ad_update_group","microsoft_ad_update_user","microsoft_dataverse_associate","microsoft_dataverse_create_multiple","microsoft_dataverse_create_record","microsoft_dataverse_delete_record","microsoft_dataverse_disassociate","microsoft_dataverse_download_file","microsoft_dataverse_execute_action","microsoft_dataverse_execute_function","microsoft_dataverse_fetchxml_query","microsoft_dataverse_get_entity_metadata","microsoft_dataverse_get_record","microsoft_dataverse_list_records","microsoft_dataverse_search","microsoft_dataverse_update_multiple","microsoft_dataverse_update_record","microsoft_dataverse_upload_file","microsoft_dataverse_upsert_record","microsoft_dataverse_whoami","microsoft_dynamics_365_close_case","microsoft_dynamics_365_close_opportunity","microsoft_dynamics_365_create_record","microsoft_dynamics_365_get_record","microsoft_dynamics_365_list_records","microsoft_dynamics_365_qualify_lead","microsoft_dynamics_365_search_records","microsoft_dynamics_365_update_record","microsoft_excel_clear_range","microsoft_excel_create_table","microsoft_excel_delete_worksheet","microsoft_excel_format_range","microsoft_excel_read","microsoft_excel_read_v2","microsoft_excel_sort_range","microsoft_excel_table_add","microsoft_excel_worksheet_add","microsoft_excel_write","microsoft_excel_write_v2","microsoft_planner_create_bucket","microsoft_planner_create_plan","microsoft_planner_create_task","microsoft_planner_delete_bucket","microsoft_planner_delete_plan","microsoft_planner_delete_task","microsoft_planner_get_plan_details","microsoft_planner_get_task_details","microsoft_planner_list_buckets","microsoft_planner_list_plans","microsoft_planner_read_bucket","microsoft_planner_read_plan","microsoft_planner_read_task","microsoft_planner_update_bucket","microsoft_planner_update_plan","microsoft_planner_update_plan_details","microsoft_planner_update_task","microsoft_planner_update_task_details","microsoft_teams_delete_channel_message","microsoft_teams_delete_chat_message","microsoft_teams_get_message","microsoft_teams_list_channel_members","microsoft_teams_list_channels","microsoft_teams_list_chat_members","microsoft_teams_list_chats","microsoft_teams_list_team_members","microsoft_teams_list_teams","microsoft_teams_read_channel","microsoft_teams_read_chat","microsoft_teams_reply_to_message","microsoft_teams_set_reaction","microsoft_teams_unset_reaction","microsoft_teams_update_channel_message","microsoft_teams_update_chat_message","microsoft_teams_write_channel","microsoft_teams_write_chat","microsoft_word_append","microsoft_word_create","microsoft_word_create_from_template","microsoft_word_export_pdf","microsoft_word_list","microsoft_word_read","microsoft_word_replace_text","microsoft_word_update","millionverifier_get_credits","millionverifier_verify_email","mintlify_create_agent_job","mintlify_create_assistant_message","mintlify_detect_ai_prose","mintlify_get_agent_job","mintlify_get_assistant_caller_stats","mintlify_get_assistant_conversations","mintlify_get_feedback","mintlify_get_feedback_by_page","mintlify_get_page_content","mintlify_get_searches","mintlify_get_update_status","mintlify_get_views","mintlify_get_visitors","mintlify_search","mintlify_send_agent_message","mintlify_trigger_automation","mintlify_trigger_preview","mintlify_trigger_update","mistral_parser","mistral_parser_v2","mistral_parser_v3","modal_call_function","modal_chat_completion","modal_list_models","monday_archive_item","monday_change_column_value","monday_create_board","monday_create_column","monday_create_group","monday_create_item","monday_create_subitem","monday_create_update","monday_delete_item","monday_duplicate_item","monday_get_board","monday_get_groups","monday_get_item","monday_get_items","monday_list_boards","monday_move_item_to_group","monday_search_items","monday_update_item","mongodb_delete","mongodb_execute","mongodb_insert","mongodb_introspect","mongodb_query","mongodb_update","mssql_delete","mssql_execute","mssql_insert","mssql_introspect","mssql_query","mssql_update","mysql_delete","mysql_execute","mysql_insert","mysql_introspect","mysql_query","mysql_update","neo4j_create","neo4j_delete","neo4j_execute","neo4j_introspect","neo4j_merge","neo4j_query","neo4j_update","netsuite_attach_record","netsuite_batch_create_records","netsuite_batch_delete_records","netsuite_batch_get_records","netsuite_batch_update_records","netsuite_batch_upsert_records","netsuite_create_record","netsuite_delete_record","netsuite_detach_record","netsuite_execute_action","netsuite_execute_dataset","netsuite_execute_suiteql","netsuite_get_async_result","netsuite_get_async_status","netsuite_get_governance_limits","netsuite_get_record","netsuite_get_record_form","netsuite_get_record_metadata","netsuite_get_select_options","netsuite_get_server_time","netsuite_get_subresource","netsuite_list_datasets","netsuite_list_record_types","netsuite_list_records","netsuite_transform_record","netsuite_update_record","netsuite_upsert_record","neverbounce_get_credits","neverbounce_verify_email","new_relic_create_deployment_event","new_relic_get_entity","new_relic_nrql_query","new_relic_search_entities","notion_add_database_row","notion_add_database_row_v2","notion_append_blocks","notion_append_blocks_v2","notion_create_comment","notion_create_comment_v2","notion_create_database","notion_create_database_v2","notion_create_page","notion_create_page_v2","notion_delete_block","notion_delete_block_v2","notion_list_comments","notion_list_comments_v2","notion_list_users","notion_list_users_v2","notion_query_database","notion_query_database_v2","notion_read","notion_read_database","notion_read_database_v2","notion_read_v2","notion_retrieve_block","notion_retrieve_block_children","notion_retrieve_block_children_v2","notion_retrieve_block_v2","notion_retrieve_user","notion_retrieve_user_v2","notion_search","notion_search_v2","notion_update_block","notion_update_block_v2","notion_update_page","notion_update_page_v2","notion_write","notion_write_v2","obsidian_append_active","obsidian_append_note","obsidian_append_periodic_note","obsidian_create_note","obsidian_delete_note","obsidian_execute_command","obsidian_get_active","obsidian_get_note","obsidian_get_periodic_note","obsidian_list_commands","obsidian_list_files","obsidian_open_file","obsidian_patch_active","obsidian_patch_note","obsidian_search","okta_activate_group_rule","okta_activate_user","okta_add_user_to_group","okta_assign_group_to_app","okta_assign_user_role","okta_assign_user_to_app","okta_clear_user_sessions","okta_create_group","okta_create_group_rule","okta_create_user","okta_deactivate_group_rule","okta_deactivate_user","okta_delete_group","okta_delete_group_rule","okta_delete_user","okta_enroll_factor","okta_get_app","okta_get_factor","okta_get_group","okta_get_group_rule","okta_get_logs","okta_get_session","okta_get_user","okta_list_app_groups","okta_list_app_users","okta_list_apps","okta_list_factors","okta_list_group_members","okta_list_group_rules","okta_list_groups","okta_list_user_roles","okta_list_users","okta_remove_group_from_app","okta_remove_user_from_app","okta_remove_user_from_group","okta_remove_user_role","okta_reset_all_factors","okta_reset_factor","okta_reset_password","okta_revoke_session","okta_suspend_user","okta_unsuspend_user","okta_update_group","okta_update_user","onedrive_copy","onedrive_create_folder","onedrive_create_share_link","onedrive_delete","onedrive_download","onedrive_get_drive_info","onedrive_get_item","onedrive_list","onedrive_move","onedrive_search","onedrive_upload","onepassword_create_item","onepassword_delete_item","onepassword_get_item","onepassword_get_item_file","onepassword_get_vault","onepassword_list_items","onepassword_list_vaults","onepassword_replace_item","onepassword_resolve_secret","onepassword_update_item","openai_embeddings","openai_image","outlook_calendar_create_event","outlook_calendar_delete_event","outlook_calendar_get_event","outlook_calendar_list_events","outlook_calendar_respond","outlook_calendar_update_event","outlook_copy","outlook_create_folder","outlook_delete","outlook_draft","outlook_forward","outlook_get_attachment","outlook_list_attachments","outlook_list_folders","outlook_mark_read","outlook_mark_unread","outlook_move","outlook_read","outlook_reply","outlook_reply_all","outlook_search","outlook_send","outlook_update_message","pagerduty_add_note","pagerduty_create_incident","pagerduty_get_incident","pagerduty_get_service","pagerduty_list_escalation_policies","pagerduty_list_incident_alerts","pagerduty_list_incidents","pagerduty_list_oncalls","pagerduty_list_schedules","pagerduty_list_services","pagerduty_list_users","pagerduty_merge_incidents","pagerduty_send_event","pagerduty_snooze_incident","pagerduty_update_incident","parallel_deep_research","parallel_extract","parallel_search","pdl_autocomplete","pdl_bulk_company_enrich","pdl_bulk_person_enrich","pdl_clean_company","pdl_clean_location","pdl_clean_school","pdl_company_enrich","pdl_company_search","pdl_person_enrich","pdl_person_identify","pdl_person_search","perplexity_chat","perplexity_search","persona_approve_inquiry","persona_create_account","persona_create_inquiry","persona_create_report","persona_decline_inquiry","persona_expire_inquiry","persona_generate_inquiry_link","persona_get_account","persona_get_case","persona_get_document","persona_get_inquiry","persona_get_report","persona_get_verification","persona_import_accounts","persona_list_accounts","persona_list_cases","persona_list_inquiries","persona_list_inquiry_templates","persona_list_reports","persona_mark_inquiry_for_review","persona_print_inquiry_pdf","persona_redact_account","persona_redact_inquiry","persona_resume_inquiry","persona_update_account","persona_update_inquiry","pinecone_delete_vectors","pinecone_describe_index","pinecone_describe_index_stats","pinecone_fetch","pinecone_generate_embeddings","pinecone_list_indexes","pinecone_list_vector_ids","pinecone_search_text","pinecone_search_vector","pinecone_update_vector","pinecone_upsert_text","pipedrive_create_activity","pipedrive_create_deal","pipedrive_create_lead","pipedrive_create_project","pipedrive_delete_lead","pipedrive_get_activities","pipedrive_get_all_deals","pipedrive_get_deal","pipedrive_get_files","pipedrive_get_leads","pipedrive_get_mail_messages","pipedrive_get_mail_thread","pipedrive_get_pipeline_deals","pipedrive_get_pipelines","pipedrive_get_projects","pipedrive_update_activity","pipedrive_update_deal","pipedrive_update_lead","pitchbook_company_active_investors","pitchbook_company_bio","pitchbook_company_deal_service_providers","pitchbook_company_deals","pitchbook_company_financials","pitchbook_company_general_service_providers","pitchbook_company_industries","pitchbook_company_investors","pitchbook_company_most_recent_debt_financing","pitchbook_company_most_recent_financials","pitchbook_company_most_recent_financing","pitchbook_company_search","pitchbook_company_similar_companies","pitchbook_company_social_analytics","pitchbook_company_updates","pitchbook_company_vc_exit_predictions","pitchbook_contracts_history","pitchbook_cost_of_calls","pitchbook_credit_history","pitchbook_credit_news","pitchbook_credit_news_bulk","pitchbook_credit_news_most_recent","pitchbook_credit_news_search","pitchbook_deal_bio","pitchbook_deal_cap_table_history","pitchbook_deal_debt_lenders","pitchbook_deal_detailed","pitchbook_deal_investors","pitchbook_deal_multiples","pitchbook_deal_search","pitchbook_deal_service_providers","pitchbook_deal_stock_info","pitchbook_deal_tranche_info","pitchbook_deal_updates","pitchbook_deal_valuation","pitchbook_entity_affiliates","pitchbook_entity_locations","pitchbook_entity_news","pitchbook_entity_people","pitchbook_entity_updates","pitchbook_fund_active_investments","pitchbook_fund_benchmark","pitchbook_fund_bio","pitchbook_fund_cash_flows","pitchbook_fund_commitments","pitchbook_fund_investment_preferences","pitchbook_fund_investments","pitchbook_fund_performance","pitchbook_fund_search","pitchbook_fund_team","pitchbook_fund_updates","pitchbook_investor_active_investments","pitchbook_investor_bio","pitchbook_investor_board_seats","pitchbook_investor_deal_service_providers","pitchbook_investor_funds","pitchbook_investor_general_service_providers","pitchbook_investor_investments","pitchbook_investor_last_closed_fund","pitchbook_investor_preferences","pitchbook_investor_search","pitchbook_investor_updates","pitchbook_limited_partner_actual_allocations","pitchbook_limited_partner_bio","pitchbook_limited_partner_commitment_aggregates","pitchbook_limited_partner_commitment_preferences","pitchbook_limited_partner_commitments_detailed","pitchbook_limited_partner_search","pitchbook_limited_partner_service_providers","pitchbook_limited_partner_target_allocations","pitchbook_limited_partner_updates","pitchbook_lookup_table_structure","pitchbook_lookup_tables","pitchbook_patent_detailed","pitchbook_patent_search","pitchbook_people_search","pitchbook_person_bio","pitchbook_person_contact","pitchbook_person_education_work","pitchbook_sandbox_entities","pitchbook_search","pitchbook_service_provider_bio","pitchbook_service_provider_search","pitchbook_service_provider_updates","pitchbook_serviced_companies","pitchbook_serviced_deals","pitchbook_serviced_funds","pitchbook_serviced_investors","pitchbook_serviced_limited_partners","pitchbook_shared_search","pitchbook_usage_report","polymarket_get_activity","polymarket_get_event","polymarket_get_events","polymarket_get_holders","polymarket_get_last_trade_price","polymarket_get_leaderboard","polymarket_get_market","polymarket_get_markets","polymarket_get_midpoint","polymarket_get_orderbook","polymarket_get_positions","polymarket_get_price","polymarket_get_price_history","polymarket_get_series","polymarket_get_series_by_id","polymarket_get_spread","polymarket_get_tags","polymarket_get_tick_size","polymarket_get_trades","polymarket_search","postgresql_delete","postgresql_execute","postgresql_insert","postgresql_introspect","postgresql_query","postgresql_update","posthog_batch_events","posthog_capture_event","posthog_create_annotation","posthog_create_cohort","posthog_create_dashboard","posthog_create_experiment","posthog_create_feature_flag","posthog_create_insight","posthog_create_survey","posthog_delete_feature_flag","posthog_delete_person","posthog_delete_survey","posthog_evaluate_flags","posthog_get_cohort","posthog_get_dashboard","posthog_get_event_definition","posthog_get_experiment","posthog_get_feature_flag","posthog_get_insight","posthog_get_organization","posthog_get_person","posthog_get_project","posthog_get_property_definition","posthog_get_session_recording","posthog_get_survey","posthog_list_actions","posthog_list_annotations","posthog_list_cohorts","posthog_list_dashboards","posthog_list_event_definitions","posthog_list_experiments","posthog_list_feature_flags","posthog_list_insights","posthog_list_organizations","posthog_list_persons","posthog_list_projects","posthog_list_property_definitions","posthog_list_recording_playlists","posthog_list_session_recordings","posthog_list_surveys","posthog_query","posthog_update_cohort","posthog_update_event_definition","posthog_update_experiment","posthog_update_feature_flag","posthog_update_insight","posthog_update_property_definition","posthog_update_survey","profound_bot_logs","profound_bots_report","profound_category_assets","profound_category_personas","profound_category_prompts","profound_category_tags","profound_category_topics","profound_citation_prompts","profound_citations_report","profound_list_assets","profound_list_categories","profound_list_domains","profound_list_models","profound_list_optimizations","profound_list_personas","profound_list_regions","profound_optimization_analysis","profound_prompt_answers","profound_prompt_volume","profound_query_fanouts","profound_raw_logs","profound_referrals_report","profound_sentiment_report","profound_visibility_report","prospeo_account_information","prospeo_bulk_enrich_company","prospeo_bulk_enrich_person","prospeo_enrich_company","prospeo_enrich_person","prospeo_search_company","prospeo_search_person","prospeo_search_suggestions","pulse_parser","pulse_parser_v2","qdrant_fetch_points","qdrant_search_vector","qdrant_upsert_points","quartr_get_audio","quartr_get_company","quartr_get_event","quartr_get_event_summary","quartr_get_report","quartr_get_slide_deck","quartr_get_transcript","quartr_list_audio","quartr_list_companies","quartr_list_document_types","quartr_list_documents","quartr_list_event_types","quartr_list_events","quartr_list_live_events","quartr_list_reports","quartr_list_slide_decks","quartr_list_transcripts","quickbooks_add_attachment","quickbooks_create_bill","quickbooks_create_bill_payment","quickbooks_create_credit_memo","quickbooks_create_customer","quickbooks_create_customer_payment","quickbooks_create_deposit","quickbooks_create_employee","quickbooks_create_estimate","quickbooks_create_invoice","quickbooks_create_item","quickbooks_create_journal_entry","quickbooks_create_purchase","quickbooks_create_purchase_order","quickbooks_create_refund_receipt","quickbooks_create_sales_receipt","quickbooks_create_vendor","quickbooks_create_vendor_credit","quickbooks_download_attachment","quickbooks_download_transaction_pdf","quickbooks_email_transaction","quickbooks_get_company_info","quickbooks_read_accounting_transactions","quickbooks_read_attachments","quickbooks_read_master_data","quickbooks_read_purchasing_transactions","quickbooks_read_sales_transactions","quickbooks_run_financial_report","quickbooks_update_bill","quickbooks_update_bill_payment","quickbooks_update_credit_memo","quickbooks_update_customer","quickbooks_update_customer_payment","quickbooks_update_deposit","quickbooks_update_employee","quickbooks_update_estimate","quickbooks_update_invoice","quickbooks_update_item","quickbooks_update_journal_entry","quickbooks_update_purchase","quickbooks_update_purchase_order","quickbooks_update_refund_receipt","quickbooks_update_sales_receipt","quickbooks_update_vendor","quickbooks_update_vendor_credit","quickbooks_void_customer_payment","quickbooks_void_invoice","quiver_image_to_svg","quiver_list_models","quiver_text_to_svg","rabbitmq_create_binding","rabbitmq_create_exchange","rabbitmq_create_policy","rabbitmq_create_queue","rabbitmq_delete_binding","rabbitmq_delete_exchange","rabbitmq_delete_policy","rabbitmq_delete_queue","rabbitmq_get_exchange","rabbitmq_get_messages","rabbitmq_get_overview","rabbitmq_get_queue","rabbitmq_health_check","rabbitmq_list_bindings","rabbitmq_list_channels","rabbitmq_list_connections","rabbitmq_list_consumers","rabbitmq_list_exchange_bindings","rabbitmq_list_exchanges","rabbitmq_list_nodes","rabbitmq_list_policies","rabbitmq_list_queues","rabbitmq_list_vhosts","rabbitmq_publish_message","rabbitmq_purge_queue","railway_create_environment","railway_create_project","railway_create_service","railway_delete_environment","railway_delete_project","railway_delete_service","railway_delete_variable","railway_deploy_service","railway_get_deployment","railway_get_deployment_logs","railway_get_project","railway_list_deployments","railway_list_project_members","railway_list_projects","railway_list_variables","railway_restart_deployment","railway_rollback_deployment","railway_transfer_project","railway_update_project","railway_upsert_variable","rb2b_credit_check","rb2b_email_to_activity","rb2b_hem_to_best_linkedin","rb2b_hem_to_business_profile","rb2b_hem_to_linkedin","rb2b_hem_to_maid","rb2b_ip_to_company","rb2b_ip_to_hem","rb2b_ip_to_maid","rb2b_linkedin_slug_search","rb2b_linkedin_to_best_personal_email","rb2b_linkedin_to_business_profile","rb2b_linkedin_to_hashed_emails","rb2b_linkedin_to_mobile_phone","rb2b_linkedin_to_personal_email","rds_delete","rds_execute","rds_insert","rds_introspect","rds_query","rds_update","reddit_delete","reddit_edit","reddit_get_comments","reddit_get_controversial","reddit_get_info","reddit_get_me","reddit_get_messages","reddit_get_posts","reddit_get_saved","reddit_get_subreddit_info","reddit_get_subreddit_rules","reddit_get_user","reddit_get_user_comments","reddit_get_user_posts","reddit_hide","reddit_hot_posts","reddit_list_my_subreddits","reddit_lock","reddit_mark_all_read","reddit_mark_read","reddit_marknsfw","reddit_mod_approve","reddit_mod_distinguish","reddit_mod_remove","reddit_mod_sticky","reddit_reply","reddit_report","reddit_save","reddit_search","reddit_search_subreddits","reddit_send_message","reddit_submit_post","reddit_subscribe","reddit_unhide","reddit_unlock","reddit_unmarknsfw","reddit_unsave","reddit_vote","redis_command","redis_delete","redis_exists","redis_expire","redis_get","redis_hdel","redis_hget","redis_hgetall","redis_hset","redis_incr","redis_incrby","redis_keys","redis_llen","redis_lpop","redis_lpush","redis_lrange","redis_persist","redis_rpop","redis_rpush","redis_set","redis_setnx","redis_ttl","reducto_parser","reducto_parser_v2","resend_cancel_email","resend_create_audience","resend_create_broadcast","resend_create_contact","resend_delete_audience","resend_delete_contact","resend_get_audience","resend_get_broadcast","resend_get_contact","resend_get_email","resend_list_audiences","resend_list_contacts","resend_list_domains","resend_send","resend_send_broadcast","resend_update_contact","revenuecat_create_purchase","revenuecat_defer_google_subscription","revenuecat_delete_customer","revenuecat_get_customer","revenuecat_grant_entitlement","revenuecat_list_offerings","revenuecat_refund_google_subscription","revenuecat_revoke_entitlement","revenuecat_revoke_google_subscription","revenuecat_update_subscriber_attributes","rippling_bulk_create_custom_object_records","rippling_bulk_delete_custom_object_records","rippling_bulk_update_custom_object_records","rippling_create_business_partner","rippling_create_business_partner_group","rippling_create_custom_app","rippling_create_custom_object","rippling_create_custom_object_field","rippling_create_custom_object_record","rippling_create_custom_page","rippling_create_custom_setting","rippling_create_department","rippling_create_draft_hires","rippling_create_object_category","rippling_create_title","rippling_create_work_location","rippling_delete_business_partner","rippling_delete_business_partner_group","rippling_delete_custom_app","rippling_delete_custom_object","rippling_delete_custom_object_field","rippling_delete_custom_object_record","rippling_delete_custom_page","rippling_delete_custom_setting","rippling_delete_object_category","rippling_delete_title","rippling_delete_work_location","rippling_get_business_partner","rippling_get_business_partner_group","rippling_get_current_user","rippling_get_custom_app","rippling_get_custom_object","rippling_get_custom_object_field","rippling_get_custom_object_record","rippling_get_custom_object_record_by_external_id","rippling_get_custom_page","rippling_get_custom_setting","rippling_get_department","rippling_get_employment_type","rippling_get_job_function","rippling_get_object_category","rippling_get_report_run","rippling_get_supergroup","rippling_get_team","rippling_get_title","rippling_get_user","rippling_get_work_location","rippling_get_worker","rippling_list_business_partner_groups","rippling_list_business_partners","rippling_list_companies","rippling_list_custom_apps","rippling_list_custom_fields","rippling_list_custom_object_fields","rippling_list_custom_object_records","rippling_list_custom_objects","rippling_list_custom_pages","rippling_list_custom_settings","rippling_list_departments","rippling_list_employment_types","rippling_list_entitlements","rippling_list_job_functions","rippling_list_object_categories","rippling_list_supergroup_exclusion_members","rippling_list_supergroup_inclusion_members","rippling_list_supergroup_members","rippling_list_supergroups","rippling_list_teams","rippling_list_titles","rippling_list_users","rippling_list_work_locations","rippling_list_workers","rippling_query_custom_object_records","rippling_trigger_report_run","rippling_update_custom_app","rippling_update_custom_object","rippling_update_custom_object_field","rippling_update_custom_object_record","rippling_update_custom_page","rippling_update_custom_setting","rippling_update_department","rippling_update_object_category","rippling_update_supergroup_exclusion_members","rippling_update_supergroup_inclusion_members","rippling_update_title","rippling_update_work_location","rocketlane_add_field_option","rocketlane_add_project_members","rocketlane_add_task_assignees","rocketlane_add_task_dependencies","rocketlane_add_task_followers","rocketlane_archive_project","rocketlane_assign_placeholders","rocketlane_create_field","rocketlane_create_phase","rocketlane_create_project","rocketlane_create_space","rocketlane_create_space_document","rocketlane_create_task","rocketlane_create_time_entry","rocketlane_create_time_off","rocketlane_delete_field","rocketlane_delete_phase","rocketlane_delete_project","rocketlane_delete_space","rocketlane_delete_space_document","rocketlane_delete_task","rocketlane_delete_time_entry","rocketlane_delete_time_off","rocketlane_get_field","rocketlane_get_invoice","rocketlane_get_invoice_line_items","rocketlane_get_invoice_payments","rocketlane_get_phase","rocketlane_get_project","rocketlane_get_space","rocketlane_get_space_document","rocketlane_get_task","rocketlane_get_time_entry","rocketlane_get_time_off","rocketlane_get_user","rocketlane_import_template","rocketlane_list_fields","rocketlane_list_invoices","rocketlane_list_phases","rocketlane_list_placeholders","rocketlane_list_projects","rocketlane_list_resource_allocations","rocketlane_list_space_documents","rocketlane_list_spaces","rocketlane_list_tasks","rocketlane_list_time_entries","rocketlane_list_time_entry_categories","rocketlane_list_time_offs","rocketlane_list_users","rocketlane_move_task_to_phase","rocketlane_remove_project_members","rocketlane_remove_task_assignees","rocketlane_remove_task_dependencies","rocketlane_remove_task_followers","rocketlane_search_time_entries","rocketlane_unassign_placeholders","rocketlane_update_field","rocketlane_update_field_option","rocketlane_update_phase","rocketlane_update_project","rocketlane_update_space","rocketlane_update_space_document","rocketlane_update_task","rocketlane_update_time_entry","rootly_acknowledge_alert","rootly_add_incident_event","rootly_add_subscribers","rootly_assign_incident_role","rootly_create_action_item","rootly_create_alert","rootly_create_incident","rootly_create_status_page_event","rootly_delete_action_item","rootly_delete_incident","rootly_escalate_alert","rootly_get_alert","rootly_get_incident","rootly_list_action_items","rootly_list_alerts","rootly_list_causes","rootly_list_environments","rootly_list_escalation_policies","rootly_list_functionalities","rootly_list_incident_events","rootly_list_incident_roles","rootly_list_incident_types","rootly_list_incidents","rootly_list_on_calls","rootly_list_playbooks","rootly_list_retrospectives","rootly_list_schedules","rootly_list_services","rootly_list_severities","rootly_list_teams","rootly_list_users","rootly_mitigate_incident","rootly_remove_subscribers","rootly_resolve_alert","rootly_resolve_incident","rootly_run_workflow","rootly_snooze_alert","rootly_unassign_incident_role","rootly_update_action_item","rootly_update_alert","rootly_update_incident","s3_copy_object","s3_create_bucket","s3_delete_bucket","s3_delete_object","s3_delete_objects","s3_get_object","s3_head_object","s3_list_buckets","s3_list_objects","s3_presigned_url","s3_put_object","sailpoint_approve_access_request","sailpoint_cancel_access_request","sailpoint_decide_certification_review_items","sailpoint_get_access_profile","sailpoint_get_access_profile_entitlements","sailpoint_get_access_request_config","sailpoint_get_access_request_status","sailpoint_get_account","sailpoint_get_account_activity","sailpoint_get_account_entitlements","sailpoint_get_account_selections","sailpoint_get_campaign","sailpoint_get_certification","sailpoint_get_entitlement","sailpoint_get_entitlement_request_config","sailpoint_get_identity","sailpoint_get_role","sailpoint_get_role_entitlements","sailpoint_get_source","sailpoint_get_task_status","sailpoint_list_access_profiles","sailpoint_list_account_activities","sailpoint_list_accounts","sailpoint_list_campaigns","sailpoint_list_certification_review_items","sailpoint_list_certifications","sailpoint_list_entitlements","sailpoint_list_identities","sailpoint_list_identity_entitlements","sailpoint_list_pending_access_request_approvals","sailpoint_list_roles","sailpoint_list_sources","sailpoint_load_accounts","sailpoint_load_entitlements","sailpoint_reject_access_request","sailpoint_request_access","sailpoint_search","sailpoint_search_aggregate","sailpoint_search_count","sailpoint_sign_off_certification","salesforce_create_account","salesforce_create_case","salesforce_create_contact","salesforce_create_custom_field","salesforce_create_custom_object","salesforce_create_lead","salesforce_create_opportunity","salesforce_create_task","salesforce_delete_account","salesforce_delete_case","salesforce_delete_contact","salesforce_delete_custom_field","salesforce_delete_lead","salesforce_delete_opportunity","salesforce_delete_task","salesforce_describe_object","salesforce_get_accounts","salesforce_get_cases","salesforce_get_contacts","salesforce_get_dashboard","salesforce_get_leads","salesforce_get_opportunities","salesforce_get_report","salesforce_get_tasks","salesforce_list_dashboards","salesforce_list_objects","salesforce_list_report_types","salesforce_list_reports","salesforce_query","salesforce_query_more","salesforce_refresh_dashboard","salesforce_run_report","salesforce_tooling_query","salesforce_update_account","salesforce_update_case","salesforce_update_contact","salesforce_update_custom_field","salesforce_update_lead","salesforce_update_opportunity","salesforce_update_task","sap_concur_approve_expense_report","sap_concur_associate_attendees","sap_concur_create_cash_advance","sap_concur_create_expected_expense","sap_concur_create_expense_report","sap_concur_create_list_item","sap_concur_create_purchase_request","sap_concur_create_quick_expense","sap_concur_create_quick_expense_with_image","sap_concur_create_report_comment","sap_concur_create_travel_request","sap_concur_create_user","sap_concur_delete_expected_expense","sap_concur_delete_expense","sap_concur_delete_expense_report","sap_concur_delete_list_item","sap_concur_delete_travel_request","sap_concur_delete_user","sap_concur_get_allocation","sap_concur_get_budget","sap_concur_get_cash_advance","sap_concur_get_expected_expense","sap_concur_get_expense","sap_concur_get_expense_report","sap_concur_get_itemizations","sap_concur_get_itinerary","sap_concur_get_list","sap_concur_get_list_item","sap_concur_get_purchase_request","sap_concur_get_receipt","sap_concur_get_receipt_status","sap_concur_get_request_cash_advance","sap_concur_get_travel_profile","sap_concur_get_travel_request","sap_concur_get_user","sap_concur_issue_cash_advance","sap_concur_list_allocations","sap_concur_list_attendee_associations","sap_concur_list_budget_categories","sap_concur_list_budgets","sap_concur_list_exceptions","sap_concur_list_expected_expenses","sap_concur_list_expense_reports","sap_concur_list_expenses","sap_concur_list_itineraries","sap_concur_list_list_items","sap_concur_list_lists","sap_concur_list_receipts","sap_concur_list_report_comments","sap_concur_list_reports_to_approve","sap_concur_list_travel_profiles_summary","sap_concur_list_travel_request_comments","sap_concur_list_travel_requests","sap_concur_list_users","sap_concur_move_travel_request","sap_concur_recall_expense_report","sap_concur_remove_all_attendees","sap_concur_search_locations","sap_concur_search_users","sap_concur_send_back_expense_report","sap_concur_submit_expense_report","sap_concur_update_allocation","sap_concur_update_expected_expense","sap_concur_update_expense","sap_concur_update_expense_report","sap_concur_update_list_item","sap_concur_update_travel_request","sap_concur_update_user","sap_concur_upload_exchange_rates","sap_concur_upload_receipt_image","sap_s4hana_create_business_partner","sap_s4hana_create_purchase_order","sap_s4hana_create_purchase_requisition","sap_s4hana_create_sales_order","sap_s4hana_delete_sales_order","sap_s4hana_get_billing_document","sap_s4hana_get_business_partner","sap_s4hana_get_customer","sap_s4hana_get_inbound_delivery","sap_s4hana_get_material_document","sap_s4hana_get_outbound_delivery","sap_s4hana_get_product","sap_s4hana_get_purchase_order","sap_s4hana_get_purchase_requisition","sap_s4hana_get_sales_order","sap_s4hana_get_supplier","sap_s4hana_get_supplier_invoice","sap_s4hana_list_billing_documents","sap_s4hana_list_business_partners","sap_s4hana_list_customers","sap_s4hana_list_inbound_deliveries","sap_s4hana_list_material_documents","sap_s4hana_list_material_stock","sap_s4hana_list_outbound_deliveries","sap_s4hana_list_products","sap_s4hana_list_purchase_orders","sap_s4hana_list_purchase_requisitions","sap_s4hana_list_sales_orders","sap_s4hana_list_supplier_invoices","sap_s4hana_list_suppliers","sap_s4hana_odata_query","sap_s4hana_update_business_partner","sap_s4hana_update_customer","sap_s4hana_update_product","sap_s4hana_update_purchase_order","sap_s4hana_update_purchase_requisition","sap_s4hana_update_sales_order","sap_s4hana_update_supplier","search_tool","secrets_manager_create_secret","secrets_manager_delete_secret","secrets_manager_describe_secret","secrets_manager_get_secret","secrets_manager_list_secrets","secrets_manager_restore_secret","secrets_manager_rotate_secret","secrets_manager_tag_resource","secrets_manager_untag_resource","secrets_manager_update_secret","semrush_backlinks","semrush_backlinks_anchors","semrush_backlinks_competitors","semrush_backlinks_geo_distribution","semrush_backlinks_indexed_pages","semrush_backlinks_overview","semrush_backlinks_tld_distribution","semrush_batch_keyword_overview","semrush_broad_match_keywords","semrush_domain_ad_copies","semrush_domain_ad_history","semrush_domain_organic_competitors","semrush_domain_organic_keywords","semrush_domain_overview","semrush_domain_overview_all","semrush_domain_overview_history","semrush_domain_paid_competitors","semrush_domain_paid_keywords","semrush_domain_pla_copies","semrush_domain_pla_keywords","semrush_domain_vs_domain","semrush_keyword_ad_history","semrush_keyword_difficulty","semrush_keyword_overview","semrush_keyword_overview_all","semrush_keyword_questions","semrush_organic_results","semrush_paid_results","semrush_referring_domains","semrush_referring_ips","semrush_related_keywords","semrush_subdomain_ad_copies","semrush_subdomain_organic_keywords","semrush_subdomain_overview","semrush_subdomain_overview_all","semrush_subdomain_overview_history","semrush_subdomain_paid_keywords","semrush_top_domains","semrush_url_organic_keywords","semrush_url_overview","semrush_url_overview_all","semrush_url_overview_history","semrush_url_paid_keywords","semrush_winners_and_losers","sendblue_evaluate_service","sendblue_get_message","sendblue_send_group_message","sendblue_send_message","sendblue_send_typing_indicator","sendgrid_add_contact","sendgrid_add_contacts_to_list","sendgrid_create_list","sendgrid_create_template","sendgrid_create_template_version","sendgrid_delete_contacts","sendgrid_delete_list","sendgrid_delete_template","sendgrid_get_contact","sendgrid_get_list","sendgrid_get_template","sendgrid_list_all_lists","sendgrid_list_templates","sendgrid_remove_contacts_from_list","sendgrid_search_contacts","sendgrid_send_mail","sentry_events_get","sentry_events_list","sentry_issues_get","sentry_issues_list","sentry_issues_update","sentry_projects_create","sentry_projects_get","sentry_projects_list","sentry_projects_update","sentry_releases_create","sentry_releases_deploy","sentry_releases_list","sentry_teams_list","serper_search","servicenow_add_incident_comment","servicenow_aggregate","servicenow_close_incident","servicenow_create_change_request","servicenow_create_incident","servicenow_create_record","servicenow_delete_record","servicenow_download_attachment","servicenow_find_user","servicenow_get_change_next_states","servicenow_get_change_request","servicenow_get_ci","servicenow_get_incident","servicenow_get_knowledge_article","servicenow_get_requested_item","servicenow_list_approvals","servicenow_list_attachments","servicenow_list_catalog_items","servicenow_list_change_requests","servicenow_list_change_tasks","servicenow_list_ci_relationships","servicenow_list_group_members","servicenow_list_incidents","servicenow_list_requested_items","servicenow_order_catalog_item","servicenow_read_record","servicenow_resolve_incident","servicenow_search_cis","servicenow_search_knowledge","servicenow_update_approval","servicenow_update_change_request","servicenow_update_change_state","servicenow_update_incident","servicenow_update_record","servicenow_upload_attachment","ses_create_configuration_set","ses_create_email_identity","ses_create_template","ses_delete_email_identity","ses_delete_suppressed_destination","ses_delete_template","ses_get_account","ses_get_email_identity","ses_get_suppressed_destination","ses_get_template","ses_list_identities","ses_list_suppressed_destinations","ses_list_templates","ses_put_suppressed_destination","ses_send_bulk_email","ses_send_custom_verification_email","ses_send_email","ses_send_templated_email","ses_update_template","sftp_delete","sftp_download","sftp_list","sftp_mkdir","sftp_upload","sharepoint_add_list_items","sharepoint_create_list","sharepoint_create_page","sharepoint_delete_file","sharepoint_delete_list_item","sharepoint_delete_page","sharepoint_download_file","sharepoint_get_drive_item","sharepoint_get_list","sharepoint_get_list_item","sharepoint_list_sites","sharepoint_publish_page","sharepoint_read_page","sharepoint_update_list","sharepoint_update_page","sharepoint_upload_file","shopify_adjust_inventory","shopify_cancel_order","shopify_create_customer","shopify_create_fulfillment","shopify_create_product","shopify_delete_customer","shopify_delete_product","shopify_get_collection","shopify_get_customer","shopify_get_inventory_level","shopify_get_order","shopify_get_product","shopify_list_collections","shopify_list_customers","shopify_list_inventory_items","shopify_list_locations","shopify_list_orders","shopify_list_products","shopify_update_customer","shopify_update_order","shopify_update_product","similarweb_bounce_rate","similarweb_page_views","similarweb_pages_per_visit","similarweb_traffic_visits","similarweb_visit_duration","similarweb_website_overview","sixtyfour_enrich_company","sixtyfour_enrich_lead","sixtyfour_find_email","sixtyfour_find_phone","slack_add_reaction","slack_archive_conversation","slack_canvas","slack_create_channel_canvas","slack_create_conversation","slack_delete_canvas","slack_delete_message","slack_delete_scheduled_message","slack_download","slack_edit_canvas","slack_ephemeral_message","slack_get_canvas","slack_get_channel_history","slack_get_channel_info","slack_get_message","slack_get_permalink","slack_get_thread","slack_get_thread_replies","slack_get_user","slack_get_user_presence","slack_invite_to_conversation","slack_list_canvases","slack_list_channels","slack_list_members","slack_list_scheduled_messages","slack_list_users","slack_lookup_canvas_sections","slack_message","slack_message_reader","slack_open_view","slack_publish_view","slack_push_view","slack_remove_reaction","slack_rename_agent_session_v2","slack_rename_conversation","slack_schedule_message","slack_set_agent_session_status_v2","slack_set_conversation_purpose","slack_set_conversation_topic","slack_set_status","slack_set_suggested_prompts","slack_set_suggested_prompts_v2","slack_set_title","slack_update_message","slack_update_view","smartlead_add_email_accounts_to_campaign","smartlead_add_leads_to_campaign","smartlead_create_campaign","smartlead_create_lead_list","smartlead_delete_campaign","smartlead_delete_campaign_webhook","smartlead_delete_lead_from_campaign","smartlead_delete_lead_list","smartlead_duplicate_campaign","smartlead_export_campaign_leads","smartlead_get_campaign","smartlead_get_campaign_analytics","smartlead_get_campaign_analytics_by_date","smartlead_get_campaign_lead_statistics","smartlead_get_campaign_mailbox_statistics","smartlead_get_campaign_sequences","smartlead_get_campaign_statistics","smartlead_get_campaign_top_level_analytics_by_date","smartlead_get_campaign_webhook_summary","smartlead_get_lead_by_email","smartlead_get_lead_by_id","smartlead_get_lead_list","smartlead_get_lead_message_history","smartlead_list_campaign_email_accounts","smartlead_list_campaign_leads","smartlead_list_campaign_webhooks","smartlead_list_campaigns","smartlead_list_clients","smartlead_list_email_accounts","smartlead_list_inbox_replies","smartlead_list_lead_activities","smartlead_list_lead_categories","smartlead_list_lead_lists","smartlead_mark_lead_complete","smartlead_pause_lead","smartlead_remove_email_accounts_from_campaign","smartlead_resume_lead","smartlead_save_campaign_sequences","smartlead_unsubscribe_lead_from_campaign","smartlead_unsubscribe_lead_globally","smartlead_update_campaign_schedule","smartlead_update_campaign_settings","smartlead_update_campaign_status","smartlead_update_lead","smartlead_update_lead_category","smartlead_update_lead_list","smartlead_upsert_campaign_webhook","sms_send","smtp_send_mail","snowflake_alter_warehouse","snowflake_call_procedure","snowflake_cancel_statement","snowflake_cancel_task_run","snowflake_delete_rows","snowflake_execute_sql","snowflake_get_statement","snowflake_get_task","snowflake_get_task_run","snowflake_get_task_run_output","snowflake_get_warehouse","snowflake_insert_rows","snowflake_introspect_schema","snowflake_list_copy_history","snowflake_list_databases","snowflake_list_query_history","snowflake_list_schemas","snowflake_list_tables","snowflake_list_task_runs","snowflake_list_tasks","snowflake_list_warehouses","snowflake_load_data","snowflake_resume_task","snowflake_resume_warehouse","snowflake_run_task","snowflake_suspend_task","snowflake_suspend_warehouse","snowflake_unload_data","snowflake_update_rows","snowflake_upsert_rows","splunk_cancel_search_job","splunk_create_search_job","splunk_dispatch_saved_search","splunk_get_fired_alerts","splunk_get_saved_search","splunk_get_search_job","splunk_get_search_results","splunk_list_apps","splunk_list_fired_alerts","splunk_list_indexes","splunk_list_saved_searches","splunk_run_search","sportmonks_core_get_cities","sportmonks_core_get_city","sportmonks_core_get_continent","sportmonks_core_get_continents","sportmonks_core_get_countries","sportmonks_core_get_country","sportmonks_core_get_entity_filters","sportmonks_core_get_my_usage","sportmonks_core_get_region","sportmonks_core_get_regions","sportmonks_core_get_timezones","sportmonks_core_get_type","sportmonks_core_get_type_by_entity","sportmonks_core_get_types","sportmonks_core_search_cities","sportmonks_core_search_countries","sportmonks_core_search_regions","sportmonks_football_expected_by_player","sportmonks_football_expected_by_team","sportmonks_football_get_all_commentaries","sportmonks_football_get_all_fixtures","sportmonks_football_get_all_players","sportmonks_football_get_all_rivals","sportmonks_football_get_all_teams","sportmonks_football_get_all_transfer_rumours","sportmonks_football_get_all_transfers","sportmonks_football_get_brackets_by_season","sportmonks_football_get_coach","sportmonks_football_get_coaches","sportmonks_football_get_coaches_by_country","sportmonks_football_get_commentaries_by_fixture","sportmonks_football_get_current_leagues_by_team","sportmonks_football_get_expected_lineups_by_player","sportmonks_football_get_expected_lineups_by_team","sportmonks_football_get_extended_team_squad","sportmonks_football_get_fixture","sportmonks_football_get_fixtures_by_date","sportmonks_football_get_fixtures_by_date_range","sportmonks_football_get_fixtures_by_date_range_for_team","sportmonks_football_get_fixtures_by_ids","sportmonks_football_get_grouped_standings_by_round","sportmonks_football_get_head_to_head","sportmonks_football_get_inplay_livescores","sportmonks_football_get_latest_coaches","sportmonks_football_get_latest_fixtures","sportmonks_football_get_latest_livescores","sportmonks_football_get_latest_players","sportmonks_football_get_latest_totw","sportmonks_football_get_latest_transfers","sportmonks_football_get_league","sportmonks_football_get_leagues","sportmonks_football_get_leagues_by_country","sportmonks_football_get_leagues_by_date","sportmonks_football_get_leagues_by_team","sportmonks_football_get_live_leagues","sportmonks_football_get_live_probabilities","sportmonks_football_get_live_probabilities_by_fixture","sportmonks_football_get_live_standings_by_league","sportmonks_football_get_livescores","sportmonks_football_get_match_facts","sportmonks_football_get_match_facts_by_date_range","sportmonks_football_get_match_facts_by_fixture","sportmonks_football_get_match_facts_by_league","sportmonks_football_get_past_fixtures_by_tv_station","sportmonks_football_get_player","sportmonks_football_get_players_by_country","sportmonks_football_get_postmatch_news","sportmonks_football_get_postmatch_news_by_season","sportmonks_football_get_predictability_by_league","sportmonks_football_get_prematch_news","sportmonks_football_get_prematch_news_by_season","sportmonks_football_get_prematch_news_upcoming","sportmonks_football_get_probabilities","sportmonks_football_get_probabilities_by_fixture","sportmonks_football_get_referee","sportmonks_football_get_referees","sportmonks_football_get_referees_by_country","sportmonks_football_get_referees_by_season","sportmonks_football_get_rivals_by_team","sportmonks_football_get_round","sportmonks_football_get_round_statistics","sportmonks_football_get_rounds","sportmonks_football_get_rounds_by_season","sportmonks_football_get_schedules_by_season","sportmonks_football_get_schedules_by_season_and_team","sportmonks_football_get_schedules_by_team","sportmonks_football_get_season","sportmonks_football_get_seasons","sportmonks_football_get_seasons_by_team","sportmonks_football_get_stage","sportmonks_football_get_stage_statistics","sportmonks_football_get_stages","sportmonks_football_get_stages_by_season","sportmonks_football_get_standing_corrections_by_season","sportmonks_football_get_standings","sportmonks_football_get_standings_by_round","sportmonks_football_get_standings_by_season","sportmonks_football_get_state","sportmonks_football_get_states","sportmonks_football_get_team","sportmonks_football_get_team_rankings","sportmonks_football_get_team_rankings_by_date","sportmonks_football_get_team_rankings_by_team","sportmonks_football_get_team_squad","sportmonks_football_get_team_squad_by_season","sportmonks_football_get_teams_by_country","sportmonks_football_get_teams_by_season","sportmonks_football_get_topscorers_by_season","sportmonks_football_get_topscorers_by_stage","sportmonks_football_get_totw","sportmonks_football_get_totw_by_round","sportmonks_football_get_transfer","sportmonks_football_get_transfer_rumour","sportmonks_football_get_transfer_rumours_between_dates","sportmonks_football_get_transfer_rumours_by_player","sportmonks_football_get_transfer_rumours_by_team","sportmonks_football_get_transfers_between_dates","sportmonks_football_get_transfers_by_player","sportmonks_football_get_transfers_by_team","sportmonks_football_get_tv_station","sportmonks_football_get_tv_stations","sportmonks_football_get_tv_stations_by_fixture","sportmonks_football_get_upcoming_fixtures_by_market","sportmonks_football_get_upcoming_fixtures_by_tv_station","sportmonks_football_get_value_bets","sportmonks_football_get_value_bets_by_fixture","sportmonks_football_get_venue","sportmonks_football_get_venues","sportmonks_football_get_venues_by_season","sportmonks_football_search_coaches","sportmonks_football_search_fixtures","sportmonks_football_search_leagues","sportmonks_football_search_players","sportmonks_football_search_referees","sportmonks_football_search_rounds","sportmonks_football_search_seasons","sportmonks_football_search_stages","sportmonks_football_search_teams","sportmonks_football_search_venues","sportmonks_motorsport_get_all_fixtures","sportmonks_motorsport_get_current_leagues_by_team","sportmonks_motorsport_get_driver","sportmonks_motorsport_get_driver_standings","sportmonks_motorsport_get_driver_standings_by_season","sportmonks_motorsport_get_drivers","sportmonks_motorsport_get_drivers_by_country","sportmonks_motorsport_get_drivers_by_season","sportmonks_motorsport_get_fixture","sportmonks_motorsport_get_fixtures_by_date","sportmonks_motorsport_get_fixtures_by_date_range","sportmonks_motorsport_get_fixtures_by_ids","sportmonks_motorsport_get_laps_by_fixture","sportmonks_motorsport_get_laps_by_fixture_and_driver","sportmonks_motorsport_get_laps_by_fixture_and_lap","sportmonks_motorsport_get_latest_laps_by_fixture","sportmonks_motorsport_get_latest_pitstops_by_fixture","sportmonks_motorsport_get_latest_stints_by_fixture","sportmonks_motorsport_get_latest_updated_drivers","sportmonks_motorsport_get_latest_updated_fixtures","sportmonks_motorsport_get_league","sportmonks_motorsport_get_leagues","sportmonks_motorsport_get_leagues_by_country","sportmonks_motorsport_get_leagues_by_date","sportmonks_motorsport_get_leagues_by_live","sportmonks_motorsport_get_leagues_by_team","sportmonks_motorsport_get_livescores","sportmonks_motorsport_get_pitstops_by_fixture","sportmonks_motorsport_get_pitstops_by_fixture_and_driver","sportmonks_motorsport_get_pitstops_by_fixture_and_lap","sportmonks_motorsport_get_race_results_by_season_and_driver","sportmonks_motorsport_get_race_results_by_season_and_team","sportmonks_motorsport_get_schedules_by_season","sportmonks_motorsport_get_season","sportmonks_motorsport_get_seasons","sportmonks_motorsport_get_stage","sportmonks_motorsport_get_stages","sportmonks_motorsport_get_stages_by_season","sportmonks_motorsport_get_state","sportmonks_motorsport_get_states","sportmonks_motorsport_get_stints_by_fixture","sportmonks_motorsport_get_stints_by_fixture_and_driver","sportmonks_motorsport_get_stints_by_fixture_and_stint","sportmonks_motorsport_get_team","sportmonks_motorsport_get_team_standings","sportmonks_motorsport_get_team_standings_by_season","sportmonks_motorsport_get_teams","sportmonks_motorsport_get_teams_by_country","sportmonks_motorsport_get_teams_by_season","sportmonks_motorsport_get_venue","sportmonks_motorsport_get_venues","sportmonks_motorsport_get_venues_by_season","sportmonks_motorsport_search_drivers","sportmonks_motorsport_search_leagues","sportmonks_motorsport_search_stages","sportmonks_motorsport_search_teams","sportmonks_motorsport_search_venues","sportmonks_odds_get_all_historical_odds","sportmonks_odds_get_all_inplay_odds","sportmonks_odds_get_all_pre_match_odds","sportmonks_odds_get_all_premium_odds","sportmonks_odds_get_bookmaker","sportmonks_odds_get_bookmaker_event_ids_by_fixture","sportmonks_odds_get_bookmakers","sportmonks_odds_get_bookmakers_by_fixture","sportmonks_odds_get_inplay_odds_by_fixture","sportmonks_odds_get_inplay_odds_by_fixture_and_bookmaker","sportmonks_odds_get_inplay_odds_by_fixture_and_market","sportmonks_odds_get_last_updated_inplay_odds","sportmonks_odds_get_last_updated_pre_match_odds","sportmonks_odds_get_market","sportmonks_odds_get_markets","sportmonks_odds_get_pre_match_odds_by_fixture","sportmonks_odds_get_pre_match_odds_by_fixture_and_bookmaker","sportmonks_odds_get_pre_match_odds_by_fixture_and_market","sportmonks_odds_get_premium_odds_by_fixture","sportmonks_odds_get_premium_odds_by_fixture_and_bookmaker","sportmonks_odds_get_premium_odds_by_fixture_and_market","sportmonks_odds_get_updated_historical_odds_between","sportmonks_odds_get_updated_premium_odds_between","sportmonks_odds_search_bookmakers","sportmonks_odds_search_markets","spotify_add_playlist_cover","spotify_add_to_queue","spotify_add_tracks_to_playlist","spotify_check_following","spotify_check_playlist_followers","spotify_check_saved_albums","spotify_check_saved_audiobooks","spotify_check_saved_episodes","spotify_check_saved_shows","spotify_check_saved_tracks","spotify_create_playlist","spotify_follow_artists","spotify_follow_playlist","spotify_get_album","spotify_get_album_tracks","spotify_get_albums","spotify_get_artist","spotify_get_artist_albums","spotify_get_artist_top_tracks","spotify_get_artists","spotify_get_audiobook","spotify_get_audiobook_chapters","spotify_get_audiobooks","spotify_get_categories","spotify_get_current_user","spotify_get_currently_playing","spotify_get_devices","spotify_get_episode","spotify_get_episodes","spotify_get_followed_artists","spotify_get_markets","spotify_get_new_releases","spotify_get_playback_state","spotify_get_playlist","spotify_get_playlist_cover","spotify_get_playlist_tracks","spotify_get_queue","spotify_get_recently_played","spotify_get_saved_albums","spotify_get_saved_audiobooks","spotify_get_saved_episodes","spotify_get_saved_shows","spotify_get_saved_tracks","spotify_get_show","spotify_get_show_episodes","spotify_get_shows","spotify_get_top_artists","spotify_get_top_tracks","spotify_get_track","spotify_get_tracks","spotify_get_user_playlists","spotify_get_user_profile","spotify_pause","spotify_play","spotify_remove_saved_albums","spotify_remove_saved_audiobooks","spotify_remove_saved_episodes","spotify_remove_saved_shows","spotify_remove_saved_tracks","spotify_remove_tracks_from_playlist","spotify_reorder_playlist_items","spotify_replace_playlist_items","spotify_save_albums","spotify_save_audiobooks","spotify_save_episodes","spotify_save_shows","spotify_save_tracks","spotify_search","spotify_seek","spotify_set_repeat","spotify_set_shuffle","spotify_set_volume","spotify_skip_next","spotify_skip_previous","spotify_transfer_playback","spotify_unfollow_artists","spotify_unfollow_playlist","spotify_update_playlist","sqs_cancel_message_move_task","sqs_change_message_visibility","sqs_change_message_visibility_batch","sqs_create_queue","sqs_delete_message","sqs_delete_message_batch","sqs_delete_queue","sqs_get_queue_attributes","sqs_get_queue_url","sqs_list_dead_letter_source_queues","sqs_list_message_move_tasks","sqs_list_queue_tags","sqs_list_queues","sqs_purge_queue","sqs_receive_message","sqs_send","sqs_send_message_batch","sqs_set_queue_attributes","sqs_start_message_move_task","sqs_tag_queue","sqs_untag_queue","square_batch_retrieve_inventory_counts","square_cancel_invoice","square_cancel_payment","square_complete_payment","square_create_catalog_image","square_create_customer","square_create_invoice","square_create_order","square_create_payment","square_delete_catalog_object","square_delete_customer","square_delete_invoice","square_get_catalog_object","square_get_customer","square_get_invoice","square_get_location","square_get_order","square_get_payment","square_get_refund","square_list_catalog","square_list_customers","square_list_invoices","square_list_locations","square_list_payments","square_list_refunds","square_pay_order","square_publish_invoice","square_refund_payment","square_search_catalog_objects","square_search_customers","square_search_invoices","square_search_orders","square_update_customer","square_upsert_catalog_object","ssh_check_command_exists","ssh_check_file_exists","ssh_create_directory","ssh_delete_file","ssh_download_file","ssh_execute_command","ssh_execute_script","ssh_get_system_info","ssh_list_directory","ssh_move_rename","ssh_read_file_content","ssh_upload_file","ssh_write_file_content","ssm_cancel_command","ssm_delete_parameter","ssm_describe_automation_executions","ssm_describe_instance_information","ssm_describe_instance_patch_states","ssm_describe_instance_patches","ssm_describe_parameters","ssm_get_automation_execution","ssm_get_command_invocation","ssm_get_document","ssm_get_parameter","ssm_get_parameters","ssm_get_parameters_by_path","ssm_list_command_invocations","ssm_list_commands","ssm_list_compliance_items","ssm_list_compliance_summaries","ssm_list_documents","ssm_put_parameter","ssm_send_command","ssm_start_automation_execution","ssm_stop_automation_execution","stagehand_agent","stagehand_extract","stripe_cancel_payment_intent","stripe_cancel_subscription","stripe_capture_charge","stripe_capture_payment_intent","stripe_confirm_payment_intent","stripe_create_charge","stripe_create_customer","stripe_create_invoice","stripe_create_payment_intent","stripe_create_price","stripe_create_product","stripe_create_subscription","stripe_delete_customer","stripe_delete_invoice","stripe_delete_product","stripe_finalize_invoice","stripe_list_charges","stripe_list_customers","stripe_list_events","stripe_list_invoices","stripe_list_payment_intents","stripe_list_prices","stripe_list_products","stripe_list_subscriptions","stripe_pay_invoice","stripe_resume_subscription","stripe_retrieve_charge","stripe_retrieve_customer","stripe_retrieve_event","stripe_retrieve_invoice","stripe_retrieve_payment_intent","stripe_retrieve_price","stripe_retrieve_product","stripe_retrieve_subscription","stripe_search_charges","stripe_search_customers","stripe_search_invoices","stripe_search_payment_intents","stripe_search_prices","stripe_search_products","stripe_search_subscriptions","stripe_send_invoice","stripe_update_charge","stripe_update_customer","stripe_update_invoice","stripe_update_payment_intent","stripe_update_price","stripe_update_product","stripe_update_subscription","stripe_void_invoice","sts_assume_role","sts_assume_role_with_saml","sts_assume_role_with_web_identity","sts_get_access_key_info","sts_get_caller_identity","sts_get_session_token","stt_assemblyai","stt_assemblyai_v2","stt_deepgram","stt_deepgram_v2","stt_elevenlabs","stt_elevenlabs_v2","stt_gemini","stt_gemini_v2","stt_whisper","stt_whisper_v2","supabase_count","supabase_delete","supabase_get_row","supabase_insert","supabase_introspect","supabase_invoke_function","supabase_query","supabase_rpc","supabase_storage_copy","supabase_storage_create_bucket","supabase_storage_create_signed_upload_url","supabase_storage_create_signed_url","supabase_storage_delete","supabase_storage_delete_bucket","supabase_storage_download","supabase_storage_empty_bucket","supabase_storage_get_public_url","supabase_storage_list","supabase_storage_list_buckets","supabase_storage_move","supabase_storage_update_bucket","supabase_storage_upload","supabase_text_search","supabase_update","supabase_upsert","supabase_vector_search","table_batch_insert_rows","table_create","table_delete_row","table_delete_rows_by_filter","table_get_row","table_get_schema","table_insert_row","table_list","table_query_rows","table_query_rows_v2","table_update_row","table_update_rows_by_filter","table_upsert_row","tailscale_authorize_device","tailscale_create_auth_key","tailscale_delete_auth_key","tailscale_delete_device","tailscale_delete_user","tailscale_expire_device_key","tailscale_get_acl","tailscale_get_auth_key","tailscale_get_device","tailscale_get_device_routes","tailscale_get_dns_preferences","tailscale_get_dns_searchpaths","tailscale_list_auth_keys","tailscale_list_devices","tailscale_list_dns_nameservers","tailscale_list_users","tailscale_set_acl","tailscale_set_device_routes","tailscale_set_device_tags","tailscale_set_dns_nameservers","tailscale_set_dns_preferences","tailscale_set_dns_searchpaths","tailscale_suspend_user","tailscale_update_device_key","tavily_crawl","tavily_extract","tavily_map","tavily_search","telegram_copy_message","telegram_delete_message","telegram_edit_message_text","telegram_forward_message","telegram_get_chat","telegram_get_chat_member","telegram_message","telegram_pin_message","telegram_send_animation","telegram_send_audio","telegram_send_chat_action","telegram_send_contact","telegram_send_document","telegram_send_location","telegram_send_photo","telegram_send_poll","telegram_send_video","telegram_set_message_reaction","telegram_unpin_message","temporal_cancel_workflow","temporal_count_workflows","temporal_create_schedule","temporal_delete_schedule","temporal_describe_schedule","temporal_describe_task_queue","temporal_describe_workflow","temporal_get_workflow_history","temporal_list_schedules","temporal_list_workflows","temporal_pause_schedule","temporal_query_workflow","temporal_reset_workflow","temporal_signal_with_start","temporal_signal_workflow","temporal_start_workflow","temporal_terminate_workflow","temporal_trigger_schedule","temporal_unpause_schedule","temporal_update_workflow","textract_analyze_expense","textract_analyze_id","textract_parser","textract_parser_v2","thinking_tool","thrive_add_audience_managers","thrive_add_audience_members","thrive_add_user_tags","thrive_create_assignment","thrive_create_audience","thrive_create_completion","thrive_create_user","thrive_delete_assignment","thrive_delete_audience","thrive_delete_user","thrive_get_activity","thrive_get_assignment","thrive_get_audience","thrive_get_completion","thrive_get_content","thrive_get_cpd_category","thrive_get_cpd_entry","thrive_get_cpd_requirement","thrive_get_enrolment","thrive_get_skill_levels","thrive_get_tag","thrive_get_user_by_id","thrive_get_user_by_ref","thrive_list_assignments","thrive_list_audience_managers","thrive_list_audience_members","thrive_list_audiences","thrive_list_completions","thrive_list_enrolments","thrive_list_tags","thrive_query_activities","thrive_query_content","thrive_query_cpd_categories","thrive_query_cpd_entries","thrive_query_cpd_requirements","thrive_query_cpd_user_summaries","thrive_remove_audience_manager","thrive_remove_audience_member","thrive_remove_user_tags","thrive_replace_audience_managers","thrive_replace_audience_members","thrive_search_users","thrive_suspend_user","thrive_update_assignment","thrive_update_audience","thrive_update_user","thrive_update_user_skills","tiktok_get_post_status","tiktok_get_user","tiktok_list_videos","tiktok_query_videos","tiktok_upload_video_draft","tinybird_append_datasource","tinybird_delete_datasource_rows","tinybird_events","tinybird_get_job","tinybird_query","tinybird_query_pipe","tinybird_truncate_datasource","tinyfish_cancel_run","tinyfish_fetch","tinyfish_get_run","tinyfish_list_profiles","tinyfish_list_runs","tinyfish_list_vault_items","tinyfish_run","tinyfish_run_async","tinyfish_search","trello_add_checklist","trello_add_checklist_item","trello_add_comment","trello_add_label","trello_add_member","trello_create_board","trello_create_card","trello_create_list","trello_delete_card","trello_get_actions","trello_get_board","trello_get_card","trello_list_cards","trello_list_lists","trello_list_members","trello_remove_label","trello_remove_member","trello_search","trello_update_card","trello_update_checklist_item","trello_update_list","trigger_dev_activate_schedule","trigger_dev_add_run_tags","trigger_dev_batch_trigger_task","trigger_dev_cancel_run","trigger_dev_complete_waitpoint_token","trigger_dev_create_env_var","trigger_dev_create_schedule","trigger_dev_create_waitpoint_token","trigger_dev_deactivate_schedule","trigger_dev_delete_env_var","trigger_dev_delete_schedule","trigger_dev_execute_query","trigger_dev_get_batch","trigger_dev_get_batch_results","trigger_dev_get_deployment","trigger_dev_get_env_var","trigger_dev_get_latest_deployment","trigger_dev_get_query_schema","trigger_dev_get_queue","trigger_dev_get_run","trigger_dev_get_run_events","trigger_dev_get_run_result","trigger_dev_get_run_trace","trigger_dev_get_schedule","trigger_dev_get_waitpoint_token","trigger_dev_import_env_vars","trigger_dev_list_deployments","trigger_dev_list_env_vars","trigger_dev_list_queues","trigger_dev_list_runs","trigger_dev_list_schedules","trigger_dev_list_timezones","trigger_dev_list_waitpoint_tokens","trigger_dev_override_queue_concurrency","trigger_dev_pause_queue","trigger_dev_promote_deployment","trigger_dev_replay_run","trigger_dev_reschedule_run","trigger_dev_reset_queue_concurrency","trigger_dev_resume_queue","trigger_dev_trigger_task","trigger_dev_update_env_var","trigger_dev_update_run_metadata","trigger_dev_update_schedule","tts_azure","tts_cartesia","tts_deepgram","tts_elevenlabs","tts_google","tts_openai","tts_playht","twilio_send_sms","twilio_voice_get_recording","twilio_voice_list_calls","twilio_voice_make_call","typeform_create_form","typeform_delete_form","typeform_files","typeform_get_form","typeform_insights","typeform_list_forms","typeform_responses","typeform_update_form","upstash_redis_command","upstash_redis_delete","upstash_redis_exists","upstash_redis_expire","upstash_redis_get","upstash_redis_hget","upstash_redis_hgetall","upstash_redis_hset","upstash_redis_incr","upstash_redis_incrby","upstash_redis_keys","upstash_redis_lpush","upstash_redis_lrange","upstash_redis_set","upstash_redis_setnx","upstash_redis_ttl","uptimerobot_create_alert_contact","uptimerobot_create_maintenance_window","uptimerobot_create_monitor","uptimerobot_create_psp","uptimerobot_delete_alert_contact","uptimerobot_delete_maintenance_window","uptimerobot_delete_monitor","uptimerobot_delete_psp","uptimerobot_get_account","uptimerobot_get_alert_contact","uptimerobot_get_incident","uptimerobot_get_maintenance_window","uptimerobot_get_monitor","uptimerobot_get_psp","uptimerobot_list_alert_contacts","uptimerobot_list_incidents","uptimerobot_list_maintenance_windows","uptimerobot_list_monitors","uptimerobot_list_psps","uptimerobot_pause_monitor","uptimerobot_start_monitor","uptimerobot_update_maintenance_window","uptimerobot_update_monitor","uptimerobot_update_psp","vanta_download_document_file","vanta_get_control","vanta_get_document","vanta_get_framework","vanta_get_person","vanta_get_policy","vanta_get_risk_scenario","vanta_get_test","vanta_get_vendor","vanta_get_vulnerable_asset","vanta_list_control_documents","vanta_list_control_tests","vanta_list_controls","vanta_list_document_uploads","vanta_list_documents","vanta_list_framework_controls","vanta_list_frameworks","vanta_list_monitored_computers","vanta_list_people","vanta_list_policies","vanta_list_risk_scenarios","vanta_list_test_entities","vanta_list_tests","vanta_list_vendors","vanta_list_vulnerabilities","vanta_list_vulnerability_remediations","vanta_list_vulnerable_assets","vanta_submit_document","vanta_upload_document_file","vercel_add_domain","vercel_add_project_domain","vercel_cancel_deployment","vercel_create_alias","vercel_create_check","vercel_create_deployment","vercel_create_dns_record","vercel_create_edge_config","vercel_create_env_var","vercel_create_project","vercel_create_webhook","vercel_delete_alias","vercel_delete_deployment","vercel_delete_dns_record","vercel_delete_domain","vercel_delete_edge_config","vercel_delete_env_var","vercel_delete_project","vercel_delete_webhook","vercel_get_alias","vercel_get_check","vercel_get_deployment","vercel_get_deployment_events","vercel_get_domain","vercel_get_domain_config","vercel_get_edge_config","vercel_get_edge_config_items","vercel_get_env_vars","vercel_get_project","vercel_get_team","vercel_get_user","vercel_get_webhook","vercel_list_aliases","vercel_list_checks","vercel_list_deployment_files","vercel_list_deployments","vercel_list_dns_records","vercel_list_domains","vercel_list_edge_configs","vercel_list_project_domains","vercel_list_projects","vercel_list_team_members","vercel_list_teams","vercel_list_webhooks","vercel_pause_project","vercel_promote_deployment","vercel_remove_project_domain","vercel_rerequest_check","vercel_unpause_project","vercel_update_check","vercel_update_dns_record","vercel_update_edge_config_items","vercel_update_env_var","vercel_update_project","vercel_update_project_domain","vercel_verify_project_domain","video_falai","video_luma","video_minimax","video_runway","video_veo","vision_tool","vision_tool_v2","wealthbox_read_contact","wealthbox_read_note","wealthbox_read_task","wealthbox_write_contact","wealthbox_write_note","wealthbox_write_task","webflow_create_item","webflow_delete_item","webflow_get_item","webflow_list_items","webflow_update_item","webhook_request","whatsapp_get_media","whatsapp_mark_read","whatsapp_send_interactive","whatsapp_send_media","whatsapp_send_message","whatsapp_send_reaction","whatsapp_send_template","whatsapp_upload_media","wikipedia_content","wikipedia_random","wikipedia_search","wikipedia_summary","windchill_check_in_document","windchill_check_in_documents","windchill_check_out_document","windchill_check_out_documents","windchill_create_document","windchill_create_documents","windchill_delete_document","windchill_delete_documents","windchill_download_attachment","windchill_download_primary_content","windchill_get_document","windchill_get_document_structure","windchill_get_primary_content","windchill_get_valid_state_transitions","windchill_list_attachments","windchill_list_documents","windchill_revise_document","windchill_revise_documents","windchill_set_lifecycle_state","windchill_undo_check_out_document","windchill_undo_check_out_documents","windchill_update_common_properties","windchill_update_document","windchill_update_document_security_labels","windchill_update_documents","windchill_upload_attachments","windchill_upload_primary_content","wiza_company_enrichment","wiza_get_credits","wiza_individual_reveal","wiza_prospect_search","wordpress_create_category","wordpress_create_comment","wordpress_create_page","wordpress_create_post","wordpress_create_tag","wordpress_delete_category","wordpress_delete_comment","wordpress_delete_media","wordpress_delete_page","wordpress_delete_post","wordpress_delete_tag","wordpress_get_category","wordpress_get_current_user","wordpress_get_media","wordpress_get_page","wordpress_get_post","wordpress_get_tag","wordpress_get_user","wordpress_list_categories","wordpress_list_comments","wordpress_list_media","wordpress_list_pages","wordpress_list_posts","wordpress_list_tags","wordpress_list_users","wordpress_search_content","wordpress_update_category","wordpress_update_comment","wordpress_update_page","wordpress_update_post","wordpress_update_tag","wordpress_upload_media","workday_assign_onboarding","workday_change_job","workday_create_prehire","workday_get_compensation","workday_get_organizations","workday_get_worker","workday_hire_employee","workday_list_workers","workday_terminate_worker","workday_update_worker","workflow_executor","x_create_bookmark","x_create_tweet","x_delete_bookmark","x_delete_tweet","x_get_blocking","x_get_bookmarks","x_get_followers","x_get_following","x_get_liked_tweets","x_get_liking_users","x_get_me","x_get_personalized_trends","x_get_quote_tweets","x_get_retweeted_by","x_get_trends_by_woeid","x_get_tweets_by_ids","x_get_usage","x_get_user_mentions","x_get_user_timeline","x_get_user_tweets","x_hide_reply","x_manage_block","x_manage_follow","x_manage_like","x_manage_mute","x_manage_retweet","x_read","x_search","x_search_tweets","x_search_users","x_user","x_write","youtube_channel_info","youtube_channel_playlists","youtube_channel_videos","youtube_comments","youtube_playlist_items","youtube_search","youtube_trending","youtube_video_categories","youtube_video_details","zendesk_autocomplete_organizations","zendesk_create_organization","zendesk_create_organizations_bulk","zendesk_create_ticket","zendesk_create_tickets_bulk","zendesk_create_user","zendesk_create_users_bulk","zendesk_delete_organization","zendesk_delete_ticket","zendesk_delete_user","zendesk_get_current_user","zendesk_get_organization","zendesk_get_organizations","zendesk_get_ticket","zendesk_get_tickets","zendesk_get_user","zendesk_get_users","zendesk_merge_tickets","zendesk_search","zendesk_search_count","zendesk_search_users","zendesk_update_organization","zendesk_update_ticket","zendesk_update_tickets_bulk","zendesk_update_user","zendesk_update_users_bulk","zep_add_messages","zep_add_user","zep_create_thread","zep_delete_thread","zep_get_context","zep_get_messages","zep_get_threads","zep_get_user","zep_get_user_threads","zerobounce_get_credits","zerobounce_verify_email","zoho_desk_add_comment","zoho_desk_get_attachment","zoho_desk_get_contact","zoho_desk_get_thread","zoho_desk_get_ticket","zoho_desk_list_comments","zoho_desk_list_organizations","zoho_desk_list_threads","zoho_desk_list_tickets","zoho_desk_update_ticket","zoom_create_meeting","zoom_delete_meeting","zoom_delete_recording","zoom_get_meeting","zoom_get_meeting_invitation","zoom_get_meeting_recordings","zoom_list_meetings","zoom_list_past_participants","zoom_list_recordings","zoom_update_meeting","zoominfo_enrich_companies","zoominfo_enrich_contacts","zoominfo_search_companies","zoominfo_search_contacts","zoominfo_search_intent","zoominfo_search_news"]' ) export default toolIds diff --git a/apps/sim/tools/generated/tool-metadata.ts b/apps/sim/tools/generated/tool-metadata.ts index 6905efa3368..ec9d306adcd 100644 --- a/apps/sim/tools/generated/tool-metadata.ts +++ b/apps/sim/tools/generated/tool-metadata.ts @@ -3,7 +3,7 @@ /** Serializable metadata for every built-in tool, keyed by tool id. */ const toolMetadata: Record = JSON.parse( - '{"a2a_cancel_task":{"id":"a2a_cancel_task","name":"A2A Cancel Task","description":"Request cancellation of an in-progress A2A task.","version":"1.0.0","params":{"agentUrl":{"type":"string","required":true,"visibility":"user-only","description":"The A2A agent endpoint URL"},"taskId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The task ID to cancel"},"apiKey":{"type":"string","required":false,"visibility":"user-only","description":"API key for authentication (if required)"}},"hostedApiKey":"none"},"a2a_get_agent_card":{"id":"a2a_get_agent_card","name":"A2A Get Agent Card","description":"Fetch the Agent Card (discovery document) for an external A2A agent.","version":"1.0.0","params":{"agentUrl":{"type":"string","required":true,"visibility":"user-only","description":"The A2A agent endpoint URL"},"apiKey":{"type":"string","required":false,"visibility":"user-only","description":"API key for authentication (if required)"}},"hostedApiKey":"none"},"a2a_get_task":{"id":"a2a_get_task","name":"A2A Get Task","description":"Retrieve the current state and result of an A2A task.","version":"1.0.0","params":{"agentUrl":{"type":"string","required":true,"visibility":"user-only","description":"The A2A agent endpoint URL"},"taskId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The task ID to retrieve"},"historyLength":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of history messages to include"},"apiKey":{"type":"string","required":false,"visibility":"user-only","description":"API key for authentication (if required)"}},"hostedApiKey":"none"},"a2a_send_message":{"id":"a2a_send_message","name":"A2A Send Message","description":"Send a message to an external A2A agent and return its response.","version":"1.0.0","params":{"agentUrl":{"type":"string","required":true,"visibility":"user-only","description":"The A2A agent endpoint URL"},"message":{"type":"string","required":true,"visibility":"user-or-llm","description":"The message text to send"},"data":{"type":"json","required":false,"visibility":"user-or-llm","description":"Optional structured JSON data to attach"},"files":{"type":"json","required":false,"visibility":"user-or-llm","description":"Optional files to attach"},"taskId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Existing task ID to continue"},"contextId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Conversation context ID to continue"},"apiKey":{"type":"string","required":false,"visibility":"user-only","description":"API key for authentication (if required)"}},"hostedApiKey":"none"},"affinity_batch_update_entity_fields":{"id":"affinity_batch_update_entity_fields","name":"Affinity Batch Update Entity Fields","description":"Write up to 100 non-list field values on one company or person in a single request.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"entityType":{"type":"string","required":true,"visibility":"user-or-llm","description":"Which entity to write the fields on: companies or persons"},"entityId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of that company or person"},"updates":{"type":"json","required":true,"visibility":"user-or-llm","description":"Up to 100 field updates as [{\\"id\\":\\"\\",\\"value\\":{\\"type\\":\\"…\\",\\"data\\":…}}], using the same value shapes as a single field update"}},"hostedApiKey":"none"},"affinity_batch_update_list_entry_fields":{"id":"affinity_batch_update_list_entry_fields","name":"Affinity Batch Update List Entry Fields","description":"Write up to 100 field values on one list row in a single request. Requires the \\"Export data from Lists\\" permission.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"listId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list ID"},"listEntryId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list entry ID"},"updates":{"type":"json","required":true,"visibility":"user-or-llm","description":"Up to 100 field updates as [{\\"id\\":\\"\\",\\"value\\":{\\"type\\":\\"…\\",\\"data\\":…}}], using the same value shapes as a single field update"}},"hostedApiKey":"none"},"affinity_create_list":{"id":"affinity_create_list","name":"Affinity Create List","description":"Create a list. Its type fixes which entities it can hold, and the API key holder becomes its creator and owner.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"name":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the new list"},"type":{"type":"string","required":true,"visibility":"user-or-llm","description":"Entity kind the list holds: company, opportunity, or person"},"isPublic":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Whether everyone in the organization can see the list"}},"hostedApiKey":"none"},"affinity_create_list_field_dropdown_option":{"id":"affinity_create_list_field_dropdown_option","name":"Affinity Create List Field Dropdown Option","description":"Add a selectable option to a dropdown field on a list. A ranked or status option also needs a rank and a color.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"listId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list ID"},"fieldId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The dropdown field ID on that list"},"type":{"type":"string","required":true,"visibility":"user-or-llm","description":"Kind of option to create, matching the field. dropdown takes only a label; ranked-dropdown also requires rank and color; status-dropdown additionally requires a status category. Sending a field the kind does not accept is rejected"},"text":{"type":"string","required":true,"visibility":"user-or-llm","description":"The option label"},"rank":{"type":"number","required":false,"visibility":"user-or-llm","description":"Sort order. Required on a ranked-dropdown or status-dropdown option"},"color":{"type":"string","required":false,"visibility":"user-or-llm","description":"Option color: white, gray, blue, green, purple, orange, or red. Required on a ranked-dropdown or status-dropdown option"},"statusCategory":{"type":"string","required":false,"visibility":"user-or-llm","description":"Pipeline meaning of the option: open, won, lost, or on-hold. Status-dropdown options only"},"winRate":{"type":"number","required":false,"visibility":"user-or-llm","description":"Expected win rate of the status. Status-dropdown options only"}},"hostedApiKey":"none"},"affinity_create_merge":{"id":"affinity_create_merge","name":"Affinity Create Merge","description":"Fold a duplicate company or person into the record you are keeping. The merge runs asynchronously — poll the returned task to see it finish. Requires the \\"Manage duplicates\\" permission and an admin role.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"entityType":{"type":"string","required":true,"visibility":"user-or-llm","description":"What to merge: companies or persons"},"primaryId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the record to keep"},"duplicateId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the duplicate record to fold in"}},"hostedApiKey":"none"},"affinity_create_note":{"id":"affinity_create_note","name":"Affinity Create Note","description":"Write a note — attached to companies, persons, and opportunities, anchored to a meeting, call, or chat message, or posted as a reply to an existing note.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"type":{"type":"string","required":true,"visibility":"user-or-llm","description":"Note shape: entities to attach it to records, interaction to anchor it to a meeting, call, or chat message, or user-reply to reply to a note"},"html":{"type":"string","required":true,"visibility":"user-or-llm","description":"The note body as HTML"},"companyIds":{"type":"json","required":false,"visibility":"user-or-llm","description":"Companies to attach the note to, e.g. [1, 2]. Not used on a reply"},"personIds":{"type":"json","required":false,"visibility":"user-or-llm","description":"Persons to attach the note to, e.g. [1, 2]. Not used on a reply"},"opportunityIds":{"type":"json","required":false,"visibility":"user-or-llm","description":"Opportunities to attach the note to, e.g. [1, 2]. Not used on a reply"},"interactionId":{"type":"string","required":false,"visibility":"user-or-llm","description":"The interaction to anchor the note to. Required for an interaction note"},"interactionType":{"type":"string","required":false,"visibility":"user-or-llm","description":"Kind of the anchoring interaction: meeting, call, or chat-message. Required for an interaction note"},"parentId":{"type":"string","required":false,"visibility":"user-or-llm","description":"The note being replied to. Required for a user-reply note"},"creatorId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Attribute the note to another internal person. Defaults to the API key holder"},"createdAt":{"type":"string","required":false,"visibility":"user-or-llm","description":"Backdate the note to this ISO 8601 timestamp"}},"hostedApiKey":"none"},"affinity_create_reminder":{"id":"affinity_create_reminder","name":"Affinity Create Reminder","description":"Create a reminder on one company, person, or opportunity. A recurring reminder resets whenever the chosen signal happens instead of firing once.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"type":{"type":"string","required":true,"visibility":"user-or-llm","description":"one-time to fire once, or recurring to reset on a signal"},"entityType":{"type":"string","required":true,"visibility":"user-or-llm","description":"What the reminder is about: company, person, or opportunity"},"entityId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of that company, person, or opportunity"},"dueDate":{"type":"string","required":false,"visibility":"user-or-llm","description":"When the reminder is due, as an ISO 8601 timestamp. Required for a one-time reminder; on a recurring one Affinity computes it from the period when omitted"},"content":{"type":"string","required":false,"visibility":"user-or-llm","description":"What the reminder says"},"ownerId":{"type":"string","required":true,"visibility":"user-or-llm","description":"User the reminder is assigned to. Must be an internal user. The API key holder is recorded as the creator, which is a separate field"},"resetTrigger":{"type":"string","required":false,"visibility":"user-or-llm","description":"What restarts a recurring reminder: interaction, email, or event. Required when the type is recurring"},"periodDays":{"type":"number","required":false,"visibility":"user-or-llm","description":"Days between firings of a recurring reminder. Required when the type is recurring"}},"hostedApiKey":"none"},"affinity_delete_list_field_dropdown_option":{"id":"affinity_delete_list_field_dropdown_option","name":"Affinity Delete List Field Dropdown Option","description":"Permanently delete a dropdown option on a list field. Every list entry currently set to it is cleared, and those values cannot be recovered.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"listId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list ID"},"fieldId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The dropdown field ID on that list"},"dropdownOptionId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The dropdown option ID to delete"}},"hostedApiKey":"none"},"affinity_delete_note":{"id":"affinity_delete_note","name":"Affinity Delete Note","description":"Delete a note you created. Deleting a root note also deletes its replies; deleting a reply removes only that reply.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"noteId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The note ID to delete"}},"hostedApiKey":"none"},"affinity_get_company":{"id":"affinity_get_company","name":"Affinity Get Company","description":"Look up one company by ID. Field data is returned only for the Field IDs or Field Types asked for.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"companyId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The company ID"},"fieldIds":{"type":"json","required":false,"visibility":"user-or-llm","description":"Field IDs to return values for, e.g. [\\"affinity-data-location\\"]. Mutually exclusive with Field Types"},"fieldTypes":{"type":"json","required":false,"visibility":"user-or-llm","description":"Field categories to return values for: enriched, global, or relationship-intelligence. Mutually exclusive with Field IDs"}},"hostedApiKey":"none"},"affinity_get_current_user":{"id":"affinity_get_current_user","name":"Affinity Get Current User","description":"Verify an Affinity API key and return the tenant, the user behind the key, and the scopes the grant carries.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"}},"hostedApiKey":"none"},"affinity_get_entity_field_value":{"id":"affinity_get_entity_field_value","name":"Affinity Get Entity Field Value","description":"Read one non-list field value from a company or person.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"entityType":{"type":"string","required":true,"visibility":"user-or-llm","description":"Which entity to read the field from: companies or persons"},"entityId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of that company or person"},"fieldId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The field ID to read"}},"hostedApiKey":"none"},"affinity_get_list":{"id":"affinity_get_list","name":"Affinity Get List","description":"Read one list — its name, type, owner, and privacy setting.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"listId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list ID"}},"hostedApiKey":"none"},"affinity_get_list_entry":{"id":"affinity_get_list_entry","name":"Affinity Get List Entry","description":"Read one row of a list with its entity. Field data is returned only for the Field IDs or Field Types asked for.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"listId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list ID"},"listEntryId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list entry ID"},"fieldIds":{"type":"json","required":false,"visibility":"user-or-llm","description":"Field IDs to return values for, e.g. [\\"affinity-data-location\\"]. Mutually exclusive with Field Types"},"fieldTypes":{"type":"json","required":false,"visibility":"user-or-llm","description":"Field categories to return values for: enriched, global, list, or relationship-intelligence. Mutually exclusive with Field IDs"}},"hostedApiKey":"none"},"affinity_get_list_entry_field":{"id":"affinity_get_list_entry_field","name":"Affinity Get List Entry Field","description":"Read one field value on a list row.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"listId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list ID"},"listEntryId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list entry ID"},"fieldId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The field ID to read"}},"hostedApiKey":"none"},"affinity_get_list_field_dropdown_option":{"id":"affinity_get_list_field_dropdown_option","name":"Affinity Get List Field Dropdown Option","description":"Read one dropdown option on a list field.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"listId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list ID"},"fieldId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The dropdown field ID on that list"},"dropdownOptionId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The dropdown option ID"}},"hostedApiKey":"none"},"affinity_get_merge":{"id":"affinity_get_merge","name":"Affinity Get Merge","description":"Read the status of one company or person merge, including why it failed if it did.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"entityType":{"type":"string","required":true,"visibility":"user-or-llm","description":"Which merge to read: companies or persons"},"mergeId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The merge ID"}},"hostedApiKey":"none"},"affinity_get_merge_task":{"id":"affinity_get_merge_task","name":"Affinity Get Merge Task","description":"Read one merge task and how its merges are progressing. Poll this after starting a merge.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"entityType":{"type":"string","required":true,"visibility":"user-or-llm","description":"Which merge task to read: companies or persons"},"taskId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The merge task ID"}},"hostedApiKey":"none"},"affinity_get_note":{"id":"affinity_get_note","name":"Affinity Get Note","description":"Read one note with its body, author, mentions, and attached records.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"noteId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The note ID"},"includes":{"type":"json","required":false,"visibility":"user-or-llm","description":"Extra properties to return, e.g. [\\"repliesCount\\",\\"personsPreview\\",\\"companiesPreview\\",\\"opportunitiesPreview\\"]. Those four fields are omitted unless requested here"}},"hostedApiKey":"none"},"affinity_get_opportunity":{"id":"affinity_get_opportunity","name":"Affinity Get Opportunity","description":"Read one opportunity and the list it belongs to. Its field data lives on the list entry.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"opportunityId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The opportunity ID"}},"hostedApiKey":"none"},"affinity_get_person":{"id":"affinity_get_person","name":"Affinity Get Person","description":"Look up one person by ID. Field data is returned only for the Field IDs or Field Types asked for.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"personId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The person ID"},"fieldIds":{"type":"json","required":false,"visibility":"user-or-llm","description":"Field IDs to return values for, e.g. [\\"affinity-data-location\\"]. Mutually exclusive with Field Types"},"fieldTypes":{"type":"json","required":false,"visibility":"user-or-llm","description":"Field categories to return values for: enriched, global, or relationship-intelligence. Mutually exclusive with Field IDs"}},"hostedApiKey":"none"},"affinity_get_saved_view":{"id":"affinity_get_saved_view","name":"Affinity Get Saved View","description":"Read one saved view — its name, kind, and creation date.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"listId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list ID"},"viewId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The saved view ID"}},"hostedApiKey":"none"},"affinity_get_transcript":{"id":"affinity_get_transcript","name":"Affinity Get Transcript","description":"Read one transcript with its first 100 fragments. Page the fragments endpoint for a longer meeting.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"transcriptId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The transcript ID"}},"hostedApiKey":"none"},"affinity_get_user":{"id":"affinity_get_user","name":"Affinity Get User","description":"Read one internal user. A user and their person record share the same numeric ID, so a person ID works here.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"userId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The user ID, which is also their person ID"}},"hostedApiKey":"none"},"affinity_list_calls":{"id":"affinity_list_calls","name":"Affinity List Calls","description":"Page through logged calls and their participants. Only calls the API key holder can see are returned.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"filter":{"type":"string","required":false,"visibility":"user-or-llm","description":"Affinity Filtering Language expression, e.g. \\"createdAt>=2026-01-01\\""},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_list_chat_messages":{"id":"affinity_list_chat_messages","name":"Affinity List Chat Messages","description":"Page through logged chat messages and their participants. Only messages the API key holder can see are returned.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"filter":{"type":"string","required":false,"visibility":"user-or-llm","description":"Affinity Filtering Language expression, e.g. \\"createdAt>=2026-01-01\\""},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_list_companies":{"id":"affinity_list_companies","name":"Affinity List Companies","description":"Page through companies. Companies come back without field data unless Field IDs or Field Types asks for it.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"ids":{"type":"json","required":false,"visibility":"user-or-llm","description":"Restrict the page to these company IDs, e.g. [1, 2, 3]"},"fieldIds":{"type":"json","required":false,"visibility":"user-or-llm","description":"Field IDs to return values for, e.g. [\\"affinity-data-location\\"]. Mutually exclusive with Field Types"},"fieldTypes":{"type":"json","required":false,"visibility":"user-or-llm","description":"Field categories to return values for: enriched, global, or relationship-intelligence. Mutually exclusive with Field IDs"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_list_coworker_connections":{"id":"affinity_list_coworker_connections","name":"Affinity List Coworker Connections","description":"Find warm paths into a company through shared work history: who in your Affinity data once worked alongside the people you want to reach. Grouped by target, strongest first.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"filter":{"type":"string","required":true,"visibility":"user-or-llm","description":"Required scope. The only supported filter is target.currentCompany.id, e.g. \\"target.currentCompany.id=123\\""},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of targets to return per page, 1-50. Defaults to 20"},"totalCount":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Include the total size of the collection. Costs an extra query"}},"hostedApiKey":"none"},"affinity_list_emails":{"id":"affinity_list_emails","name":"Affinity List Emails","description":"Page through email metadata — subject, participants, and timestamps. Affinity never exposes email bodies through the API.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"filter":{"type":"string","required":false,"visibility":"user-or-llm","description":"Affinity Filtering Language expression, e.g. \\"createdAt>=2026-01-01\\""},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_list_entity_field_values":{"id":"affinity_list_entity_field_values","name":"Affinity List Entity Field Values","description":"Page through a company\'s or person\'s non-list field values. List fields are not returned here — read those through the list entry.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"entityType":{"type":"string","required":true,"visibility":"user-or-llm","description":"Which entity to read field values from: companies or persons"},"entityId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of that company or person"},"ids":{"type":"json","required":false,"visibility":"user-or-llm","description":"Restrict to these field IDs. Mutually exclusive with Field Types"},"types":{"type":"json","required":false,"visibility":"user-or-llm","description":"Restrict to these field categories: enriched, global, relationship-intelligence. Mutually exclusive with Field IDs"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 20"}},"hostedApiKey":"none"},"affinity_list_entity_list_entries":{"id":"affinity_list_entity_list_entries","name":"Affinity List Entity List Entries","description":"Page through a company\'s or person\'s rows across every list, each carrying that list\'s field values and when the entity was added.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"entityType":{"type":"string","required":true,"visibility":"user-or-llm","description":"Which entity to look up the rows of: companies or persons"},"entityId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of that company or person"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_list_entity_lists":{"id":"affinity_list_entity_lists","name":"Affinity List Entity Lists","description":"List every list a company or person appears on that the caller can view.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"entityType":{"type":"string","required":true,"visibility":"user-or-llm","description":"Which entity to look up the lists of: companies or persons"},"entityId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of that company or person"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_list_entity_notes":{"id":"affinity_list_entity_notes","name":"Affinity List Entity Notes","description":"List the notes relevant to one company, person, or opportunity — directly attached notes plus notes reaching it through its people and meetings.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"entityType":{"type":"string","required":true,"visibility":"user-or-llm","description":"Which entity the notes hang off: companies, persons, or opportunities"},"entityId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of that company, person, or opportunity"},"filter":{"type":"string","required":false,"visibility":"user-or-llm","description":"Affinity Filtering Language expression, e.g. \\"createdAt>=2026-01-01\\""},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"},"totalCount":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Include the total size of the collection. Costs an extra query"}},"hostedApiKey":"none"},"affinity_list_entity_relationships":{"id":"affinity_list_entity_relationships","name":"Affinity List Entity Relationships","description":"List who knows a company or person, scored 0.0 to 1.0 by how much the two actually interact. Strongest first by default.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"entityType":{"type":"string","required":true,"visibility":"user-or-llm","description":"Which entity to look up relationships for: companies or persons"},"entityId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of that company or person"},"filter":{"type":"string","required":false,"visibility":"user-or-llm","description":"Affinity Filtering Language expression. This endpoint filters on interactionScore only, e.g. \\"interactionScore>=0.5\\""},"orderBy":{"type":"json","required":false,"visibility":"user-or-llm","description":"Sort order: [\\"interactionScore\\"] for weakest first, [\\"-interactionScore\\"] for strongest first (the default)"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"},"totalCount":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Include the total size of the collection. Costs an extra query"}},"hostedApiKey":"none"},"affinity_list_field_dropdown_options":{"id":"affinity_list_field_dropdown_options","name":"Affinity List Field Dropdown Options","description":"List the selectable options on a dropdown or ranked-dropdown company or person field. Writing such a field needs the option ID, not its text.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"entityType":{"type":"string","required":true,"visibility":"user-or-llm","description":"Which field family the field belongs to: companies or persons"},"fieldId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The dropdown or ranked-dropdown field ID"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_list_field_metadata":{"id":"affinity_list_field_metadata","name":"Affinity List Field Metadata","description":"List the non-list company or person fields, with the value type, filter operators, and sort support of each. Start here to find the Field IDs the read and write tools take.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"entityType":{"type":"string","required":true,"visibility":"user-or-llm","description":"Which fields to describe: companies or persons"},"includes":{"type":"json","required":false,"visibility":"user-or-llm","description":"Extra properties to return: [\\"filterability\\",\\"sortability\\"]. Both are omitted unless requested here"},"filter":{"type":"string","required":false,"visibility":"user-or-llm","description":"Affinity Filtering Language expression. This endpoint filters on name only, e.g. \\"name=~Status\\""},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_list_field_value_changes":{"id":"affinity_list_field_value_changes","name":"Affinity List Field Value Changes","description":"Page through field value changes across the whole workspace. Built for delta sync: follow nextCursor to the end of a run, then resume from the last cursor next time.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"filter":{"type":"string","required":false,"visibility":"user-or-llm","description":"Affinity Filtering Language expression over field.id, listEntry.id, changer.id, changedAt, or actionType. Resume a sync with e.g. \\"changedAt>2026-06-01T12:00:00Z\\""},"orderBy":{"type":"json","required":false,"visibility":"user-or-llm","description":"Sort order: [\\"changedAt\\"] for oldest first (the default), [\\"-changedAt\\"] for newest first"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_list_investor_executive_connections":{"id":"affinity_list_investor_executive_connections","name":"Affinity List Investor Executive Connections","description":"Find warm paths into a company through investment history: which investors in your Affinity data backed a company the people you want to reach once led. Grouped by target, strongest first.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"filter":{"type":"string","required":true,"visibility":"user-or-llm","description":"Required scope. The only supported filter is target.currentCompany.id, e.g. \\"target.currentCompany.id=123\\""},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of targets to return per page, 1-50. Defaults to 20"},"totalCount":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Include the total size of the collection. Costs an extra query"}},"hostedApiKey":"none"},"affinity_list_list_entries":{"id":"affinity_list_list_entries","name":"Affinity List List Entries","description":"Page through the rows of a list. Rows come back without field data unless Field IDs or Field Types asks for it.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"listId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list ID"},"fieldIds":{"type":"json","required":false,"visibility":"user-or-llm","description":"Field IDs to return values for, e.g. [\\"affinity-data-location\\"]. Mutually exclusive with Field Types"},"fieldTypes":{"type":"json","required":false,"visibility":"user-or-llm","description":"Field categories to return values for: enriched, global, list, or relationship-intelligence. Mutually exclusive with Field IDs"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_list_list_entry_field_value_changes":{"id":"affinity_list_list_entry_field_value_changes","name":"Affinity List List Entry Field Value Changes","description":"Page through the history of one list row — who changed which field, when, and to what.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"listId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list ID"},"listEntryId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list entry ID"},"filter":{"type":"string","required":false,"visibility":"user-or-llm","description":"Affinity Filtering Language expression over field.id, changer.id, changedAt, or actionType, e.g. \\"field.id=field-1234\\""},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_list_list_entry_fields":{"id":"affinity_list_list_entry_fields","name":"Affinity List List Entry Fields","description":"Page through every field value on one list row, including the list-specific columns. All fields are returned unless narrowed.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"listId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list ID"},"listEntryId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list entry ID"},"ids":{"type":"json","required":false,"visibility":"user-or-llm","description":"Restrict to these field IDs. Mutually exclusive with Field Types"},"types":{"type":"json","required":false,"visibility":"user-or-llm","description":"Restrict to these field categories: enriched, global, list, relationship-intelligence. Mutually exclusive with Field IDs"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 20"}},"hostedApiKey":"none"},"affinity_list_list_field_dropdown_options":{"id":"affinity_list_list_field_dropdown_options","name":"Affinity List List Field Dropdown Options","description":"List the selectable options on a dropdown, ranked-dropdown, or status-dropdown field of a list.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"listId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list ID"},"fieldId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The dropdown field ID on that list"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_list_list_fields":{"id":"affinity_list_list_fields","name":"Affinity List List Fields","description":"List the fields available on one list, including its list-specific columns. Use these Field IDs when reading or writing list entries.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"listId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list ID"},"includes":{"type":"json","required":false,"visibility":"user-or-llm","description":"Extra properties to return: [\\"filterability\\",\\"sortability\\"]. Both are omitted unless requested here"},"filter":{"type":"string","required":false,"visibility":"user-or-llm","description":"Affinity Filtering Language expression. This endpoint filters on name only, e.g. \\"name=~Stage\\""},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_list_lists":{"id":"affinity_list_lists","name":"Affinity List Lists","description":"Page through the lists in the organization that the caller can view.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"term":{"type":"string","required":false,"visibility":"user-or-llm","description":"Case-insensitive substring match on the list name"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_list_meetings":{"id":"affinity_list_meetings","name":"Affinity List Meetings","description":"Page through past and upcoming meetings with their organizer and attendees.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"filter":{"type":"string","required":false,"visibility":"user-or-llm","description":"Affinity Filtering Language expression, e.g. \\"createdAt>=2026-01-01\\""},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_list_merge_tasks":{"id":"affinity_list_merge_tasks","name":"Affinity List Merge Tasks","description":"Page through merge tasks, each summarizing how many of its merges are in progress, succeeded, or failed.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"entityType":{"type":"string","required":true,"visibility":"user-or-llm","description":"Which merge tasks to list: companies or persons"},"filter":{"type":"string","required":false,"visibility":"user-or-llm","description":"Affinity Filtering Language expression. This endpoint filters on status only, e.g. \\"status=in-progress\\""},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_list_merges":{"id":"affinity_list_merges","name":"Affinity List Merges","description":"Page through the company or person merges the organization has run, with the status and the records involved in each.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"entityType":{"type":"string","required":true,"visibility":"user-or-llm","description":"Which merges to list: companies or persons"},"filter":{"type":"string","required":false,"visibility":"user-or-llm","description":"Affinity Filtering Language expression over status or taskId, e.g. \\"status=failed\\""},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_list_note_attached_companies":{"id":"affinity_list_note_attached_companies","name":"Affinity List Note Attached Companies","description":"List the companies directly attached to one note.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"noteId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The note ID"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"},"totalCount":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Include the total size of the collection. Costs an extra query"}},"hostedApiKey":"none"},"affinity_list_note_attached_opportunities":{"id":"affinity_list_note_attached_opportunities","name":"Affinity List Note Attached Opportunities","description":"List the opportunities directly attached to one note.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"noteId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The note ID"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"},"totalCount":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Include the total size of the collection. Costs an extra query"}},"hostedApiKey":"none"},"affinity_list_note_attached_persons":{"id":"affinity_list_note_attached_persons","name":"Affinity List Note Attached Persons","description":"List the persons directly attached to one note.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"noteId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The note ID"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"},"totalCount":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Include the total size of the collection. Costs an extra query"}},"hostedApiKey":"none"},"affinity_list_note_replies":{"id":"affinity_list_note_replies","name":"Affinity List Note Replies","description":"Page through the replies on one note, including AI Notetaker replies.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"noteId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The note ID whose replies to read"},"filter":{"type":"string","required":false,"visibility":"user-or-llm","description":"Affinity Filtering Language expression, e.g. \\"createdAt>=2026-01-01\\""},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"},"totalCount":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Include the total size of the collection. Costs an extra query"}},"hostedApiKey":"none"},"affinity_list_notes":{"id":"affinity_list_notes","name":"Affinity List Notes","description":"Page through every note the caller can see. Replies are excluded.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"includes":{"type":"json","required":false,"visibility":"user-or-llm","description":"Extra properties to return, e.g. [\\"repliesCount\\",\\"personsPreview\\",\\"companiesPreview\\",\\"opportunitiesPreview\\"]. Those four fields are omitted unless requested here"},"filter":{"type":"string","required":false,"visibility":"user-or-llm","description":"Affinity Filtering Language expression, e.g. \\"createdAt>=2026-01-01\\""},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"},"totalCount":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Include the total size of the collection. Costs an extra query"}},"hostedApiKey":"none"},"affinity_list_opportunities":{"id":"affinity_list_opportunities","name":"Affinity List Opportunities","description":"Page through opportunities. Field data lives on the list entry, not here — read it through the list or saved view the opportunity belongs to.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"ids":{"type":"json","required":false,"visibility":"user-or-llm","description":"Restrict the page to these opportunity IDs, e.g. [1, 2, 3]"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_list_persons":{"id":"affinity_list_persons","name":"Affinity List Persons","description":"Page through persons. Persons come back without field data unless Field IDs or Field Types asks for it.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"ids":{"type":"json","required":false,"visibility":"user-or-llm","description":"Restrict the page to these person IDs, e.g. [1, 2, 3]"},"fieldIds":{"type":"json","required":false,"visibility":"user-or-llm","description":"Field IDs to return values for, e.g. [\\"affinity-data-location\\"]. Mutually exclusive with Field Types"},"fieldTypes":{"type":"json","required":false,"visibility":"user-or-llm","description":"Field categories to return values for: enriched, global, or relationship-intelligence. Mutually exclusive with Field IDs"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_list_reminders":{"id":"affinity_list_reminders","name":"Affinity List Reminders","description":"Page through the reminders the caller can see. Filter by status to surface what is overdue.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"filter":{"type":"string","required":false,"visibility":"user-or-llm","description":"Affinity Filtering Language expression, e.g. \\"createdAt>=2026-01-01\\""},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"},"totalCount":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Include the total size of the collection. Costs an extra query"}},"hostedApiKey":"none"},"affinity_list_saved_view_entries":{"id":"affinity_list_saved_view_entries","name":"Affinity List Saved View Entries","description":"Page through the rows of a saved view. The view\'s own filters and columns decide which rows and which field data come back.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"listId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list ID"},"viewId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The saved view ID"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_list_saved_views":{"id":"affinity_list_saved_views","name":"Affinity List Saved Views","description":"List the saved views on a list that the caller can view.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"listId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list ID"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_list_transcript_fragments":{"id":"affinity_list_transcript_fragments","name":"Affinity List Transcript Fragments","description":"Page through everything said in a meeting, segment by segment with the speaker.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"transcriptId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The transcript ID"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"},"totalCount":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Include the total size of the collection. Costs an extra query"}},"hostedApiKey":"none"},"affinity_list_transcripts":{"id":"affinity_list_transcripts","name":"Affinity List Transcripts","description":"Page through meeting transcript metadata. Read one transcript to get what was actually said.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"filter":{"type":"string","required":false,"visibility":"user-or-llm","description":"Affinity Filtering Language expression, e.g. \\"createdAt>=2026-01-01\\""},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"},"totalCount":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Include the total size of the collection. Costs an extra query"}},"hostedApiKey":"none"},"affinity_list_users":{"id":"affinity_list_users","name":"Affinity List Users","description":"Page through the internal users in the organization. Email addresses and roles are returned only to callers with the \\"Manage Users\\" permission.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"term":{"type":"string","required":false,"visibility":"user-or-llm","description":"Case-insensitive match across first name, last name, and primary email"},"filter":{"type":"string","required":false,"visibility":"user-or-llm","description":"Affinity Filtering Language expression over id or status, e.g. \\"status=active\\""},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_search_companies":{"id":"affinity_search_companies","name":"Affinity Search Companies","description":"Search companies by filters, sorts, and a free-text term. Requires the \\"Export All Organizations directory\\" permission.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"filters":{"type":"json","required":false,"visibility":"user-or-llm","description":"Filter group as {operator: \\"and\\"|\\"or\\", filters: [...]}, at most 50 leaves. Each leaf is {valueType, fieldId, operator, value}, and a leaf may itself be a nested group"},"searchTerm":{"type":"string","required":false,"visibility":"user-or-llm","description":"Free-text term matched against the searchable fields. At least 3 characters"},"searchFieldIds":{"type":"json","required":false,"visibility":"user-or-llm","description":"Field IDs the search term is matched against. Defaults to the searchable fields"},"sorts":{"type":"json","required":false,"visibility":"user-or-llm","description":"Sort order as [{fieldId, direction: \\"asc\\"|\\"desc\\", attributeId?}], up to 5, applied in order"},"fieldIds":{"type":"json","required":false,"visibility":"user-or-llm","description":"Field IDs to return values for, e.g. [\\"affinity-data-location\\"]. Mutually exclusive with Field Types"},"fieldTypes":{"type":"json","required":false,"visibility":"user-or-llm","description":"Field categories to return values for: enriched, global, or relationship-intelligence. Mutually exclusive with Field IDs"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"},"totalCount":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Include the total size of the collection. Costs an extra query"}},"hostedApiKey":"none"},"affinity_search_files":{"id":"affinity_search_files","name":"Affinity Search Files","description":"Search files by keyword, ordered by relevance. Narrow to specific files or to one company, or leave both unset to search the whole account.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"prompt":{"type":"string","required":true,"visibility":"user-or-llm","description":"What to search for. Between 3 and 500 characters"},"ids":{"type":"json","required":false,"visibility":"user-or-llm","description":"Restrict the search to these file IDs. Cannot be combined with Company ID"},"companyId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Restrict the search to one company\'s files. Cannot be combined with file IDs"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of files to return, 1-100. Defaults to 20"}},"hostedApiKey":"none"},"affinity_search_list_entries":{"id":"affinity_search_list_entries","name":"Affinity Search List Entries","description":"Search the rows of one list by filters, sorts, and a free-text term. Requires the \\"Export data from Lists\\" permission.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"listId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list ID to search"},"filters":{"type":"json","required":false,"visibility":"user-or-llm","description":"Filter group as {operator: \\"and\\"|\\"or\\", filters: [...]}, at most 50 leaves. Each leaf is {valueType, fieldId, operator, value}, and a leaf may itself be a nested group"},"searchTerm":{"type":"string","required":false,"visibility":"user-or-llm","description":"Free-text term matched against the searchable fields. At least 3 characters"},"searchFieldIds":{"type":"json","required":false,"visibility":"user-or-llm","description":"Field IDs the search term is matched against. Defaults to the searchable fields"},"sorts":{"type":"json","required":false,"visibility":"user-or-llm","description":"Sort order as [{fieldId, direction: \\"asc\\"|\\"desc\\", attributeId?}], up to 5, applied in order"},"fieldIds":{"type":"json","required":false,"visibility":"user-or-llm","description":"Field IDs to return values for, e.g. [\\"affinity-data-location\\"]. Mutually exclusive with Field Types"},"fieldTypes":{"type":"json","required":false,"visibility":"user-or-llm","description":"Field categories to return values for: enriched, global, list, or relationship-intelligence. Mutually exclusive with Field IDs"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"},"totalCount":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Include the total size of the collection. Costs an extra query"}},"hostedApiKey":"none"},"affinity_search_notes":{"id":"affinity_search_notes","name":"Affinity Search Notes","description":"Search notes by keyword, ordered by relevance. Narrow to specific notes or to one company, or leave both unset to search the whole account.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"prompt":{"type":"string","required":true,"visibility":"user-or-llm","description":"What to search for. Between 3 and 500 characters"},"ids":{"type":"json","required":false,"visibility":"user-or-llm","description":"Restrict the search to these note IDs. Cannot be combined with Company ID"},"companyId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Restrict the search to one company\'s notes. Cannot be combined with note IDs"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of notes to return, 1-100. Defaults to 20"}},"hostedApiKey":"none"},"affinity_search_persons":{"id":"affinity_search_persons","name":"Affinity Search Persons","description":"Search persons by filters, sorts, and a free-text term. Requires the \\"Export All People directory\\" permission.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"filters":{"type":"json","required":false,"visibility":"user-or-llm","description":"Filter group as {operator: \\"and\\"|\\"or\\", filters: [...]}, at most 50 leaves. Each leaf is {valueType, fieldId, operator, value}, and a leaf may itself be a nested group"},"searchTerm":{"type":"string","required":false,"visibility":"user-or-llm","description":"Free-text term matched against the searchable fields. At least 3 characters"},"searchFieldIds":{"type":"json","required":false,"visibility":"user-or-llm","description":"Field IDs the search term is matched against. Defaults to the searchable fields"},"sorts":{"type":"json","required":false,"visibility":"user-or-llm","description":"Sort order as [{fieldId, direction: \\"asc\\"|\\"desc\\", attributeId?}], up to 5, applied in order"},"fieldIds":{"type":"json","required":false,"visibility":"user-or-llm","description":"Field IDs to return values for, e.g. [\\"affinity-data-location\\"]. Mutually exclusive with Field Types"},"fieldTypes":{"type":"json","required":false,"visibility":"user-or-llm","description":"Field categories to return values for: enriched, global, or relationship-intelligence. Mutually exclusive with Field IDs"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous page, returned as nextCursor or prevCursor"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to return per page, 1-100. Defaults to 100"},"totalCount":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Include the total size of the collection. Costs an extra query"}},"hostedApiKey":"none"},"affinity_semantic_search":{"id":"affinity_semantic_search","name":"Affinity Semantic Search","description":"Find companies from a description in plain language — industry, technology, stage, or business model. Currently searches companies only.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"prompt":{"type":"string","required":true,"visibility":"user-or-llm","description":"What to look for, in plain language, e.g. \\"climate tech companies in our pipeline\\". Up to 500 characters"},"listIds":{"type":"json","required":false,"visibility":"user-or-llm","description":"Restrict the search to companies on these lists, e.g. [1, 2]"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of companies to return, 1-100. Defaults to 100"}},"hostedApiKey":"none"},"affinity_update_entity_field_value":{"id":"affinity_update_entity_field_value","name":"Affinity Update Entity Field Value","description":"Write one non-list field value on a company or person. The value type must match how the field is defined.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"entityType":{"type":"string","required":true,"visibility":"user-or-llm","description":"Which entity to write the field on: companies or persons"},"entityId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of that company or person"},"fieldId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The field ID to write"},"value":{"type":"json","required":true,"visibility":"user-or-llm","description":"The new value as {type, data}, where type matches the field\'s value type. Examples: {\\"type\\":\\"text\\",\\"data\\":\\"Series B\\"}, {\\"type\\":\\"number\\",\\"data\\":42}, {\\"type\\":\\"dropdown\\",\\"data\\":{\\"dropdownOptionId\\":7}}, {\\"type\\":\\"person\\",\\"data\\":{\\"id\\":123}}, {\\"type\\":\\"person-multi\\",\\"data\\":[{\\"id\\":123}]}. Pass data as null to clear the field"}},"hostedApiKey":"none"},"affinity_update_list_entry_field":{"id":"affinity_update_list_entry_field","name":"Affinity Update List Entry Field","description":"Write one field value on a list row. Requires the \\"Export data from Lists\\" permission.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"listId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list ID"},"listEntryId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list entry ID"},"fieldId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The field ID to write"},"value":{"type":"json","required":true,"visibility":"user-or-llm","description":"The new value as {type, data}, where type matches the field\'s value type. Examples: {\\"type\\":\\"text\\",\\"data\\":\\"Series B\\"}, {\\"type\\":\\"number\\",\\"data\\":42}, {\\"type\\":\\"dropdown\\",\\"data\\":{\\"dropdownOptionId\\":7}}, {\\"type\\":\\"person\\",\\"data\\":{\\"id\\":123}}, {\\"type\\":\\"person-multi\\",\\"data\\":[{\\"id\\":123}]}. Pass data as null to clear the field"}},"hostedApiKey":"none"},"affinity_update_list_field_dropdown_option":{"id":"affinity_update_list_field_dropdown_option","name":"Affinity Update List Field Dropdown Option","description":"Change a dropdown option on a list field. Every field is optional — supply only what should change, and only fields the option\'s kind actually has.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"listId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The list ID"},"fieldId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The dropdown field ID on that list"},"dropdownOptionId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The dropdown option ID to update"},"text":{"type":"string","required":false,"visibility":"user-or-llm","description":"Replacement option label. Supply at least one field to change"},"rank":{"type":"number","required":false,"visibility":"user-or-llm","description":"Sort order. Required on a ranked-dropdown or status-dropdown option"},"color":{"type":"string","required":false,"visibility":"user-or-llm","description":"Option color: white, gray, blue, green, purple, orange, or red. Required on a ranked-dropdown or status-dropdown option"},"statusCategory":{"type":"string","required":false,"visibility":"user-or-llm","description":"Pipeline meaning of the option: open, won, lost, or on-hold. Status-dropdown options only"},"winRate":{"type":"number","required":false,"visibility":"user-or-llm","description":"Expected win rate of the status. Status-dropdown options only"}},"hostedApiKey":"none"},"affinity_update_note":{"id":"affinity_update_note","name":"Affinity Update Note","description":"Rewrite a note\'s body or replace which records it is attached to. Each list of IDs replaces that association wholesale, an empty list clears it, and omitting one leaves it untouched. A note\'s type cannot be changed.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Affinity API key, sent as a bearer token"},"noteId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The note ID to update"},"html":{"type":"string","required":false,"visibility":"user-or-llm","description":"Replacement note body as HTML"},"companyIds":{"type":"json","required":false,"visibility":"user-or-llm","description":"Replacement set of attached companies, e.g. [1, 2]. Send [] to detach every company; omit to leave them unchanged"},"personIds":{"type":"json","required":false,"visibility":"user-or-llm","description":"Replacement set of attached persons, e.g. [1, 2]. Send [] to detach every person; omit to leave them unchanged"},"opportunityIds":{"type":"json","required":false,"visibility":"user-or-llm","description":"Replacement set of attached opportunities, e.g. [1, 2]. Send [] to detach every opportunity; omit to leave them unchanged"}},"hostedApiKey":"none"},"agentmail_create_draft":{"id":"agentmail_create_draft","name":"Create Draft","description":"Create a new email draft in AgentMail","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentMail API key"},"inboxId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the inbox to create the draft in"},"to":{"type":"string","required":false,"visibility":"user-or-llm","description":"Recipient email addresses (comma-separated)"},"subject":{"type":"string","required":false,"visibility":"user-or-llm","description":"Draft subject line"},"text":{"type":"string","required":false,"visibility":"user-or-llm","description":"Plain text draft body"},"html":{"type":"string","required":false,"visibility":"user-or-llm","description":"HTML draft body"},"cc":{"type":"string","required":false,"visibility":"user-or-llm","description":"CC recipient email addresses (comma-separated)"},"bcc":{"type":"string","required":false,"visibility":"user-or-llm","description":"BCC recipient email addresses (comma-separated)"},"inReplyTo":{"type":"string","required":false,"visibility":"user-or-llm","description":"ID of message being replied to"},"sendAt":{"type":"string","required":false,"visibility":"user-or-llm","description":"ISO 8601 timestamp to schedule sending"}},"hostedApiKey":"none"},"agentmail_create_inbox":{"id":"agentmail_create_inbox","name":"Create Inbox","description":"Create a new email inbox with AgentMail","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentMail API key"},"username":{"type":"string","required":false,"visibility":"user-or-llm","description":"Username for the inbox email address"},"domain":{"type":"string","required":false,"visibility":"user-or-llm","description":"Domain for the inbox email address"},"displayName":{"type":"string","required":false,"visibility":"user-or-llm","description":"Display name for the inbox"}},"hostedApiKey":"none"},"agentmail_delete_draft":{"id":"agentmail_delete_draft","name":"Delete Draft","description":"Delete an email draft in AgentMail","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentMail API key"},"inboxId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the inbox containing the draft"},"draftId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the draft to delete"}},"hostedApiKey":"none"},"agentmail_delete_inbox":{"id":"agentmail_delete_inbox","name":"Delete Inbox","description":"Delete an email inbox in AgentMail","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentMail API key"},"inboxId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the inbox to delete"}},"hostedApiKey":"none"},"agentmail_delete_thread":{"id":"agentmail_delete_thread","name":"Delete Thread","description":"Delete an email thread in AgentMail (moves to trash, or permanently deletes if already in trash)","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentMail API key"},"inboxId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the inbox containing the thread"},"threadId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the thread to delete"},"permanent":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Force permanent deletion instead of moving to trash"}},"hostedApiKey":"none"},"agentmail_forward_message":{"id":"agentmail_forward_message","name":"Forward Message","description":"Forward an email message to new recipients in AgentMail","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentMail API key"},"inboxId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the inbox containing the message"},"messageId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the message to forward"},"to":{"type":"string","required":true,"visibility":"user-or-llm","description":"Recipient email addresses (comma-separated)"},"subject":{"type":"string","required":false,"visibility":"user-or-llm","description":"Override subject line"},"text":{"type":"string","required":false,"visibility":"user-or-llm","description":"Additional plain text to prepend"},"html":{"type":"string","required":false,"visibility":"user-or-llm","description":"Additional HTML to prepend"},"cc":{"type":"string","required":false,"visibility":"user-or-llm","description":"CC recipient email addresses (comma-separated)"},"bcc":{"type":"string","required":false,"visibility":"user-or-llm","description":"BCC recipient email addresses (comma-separated)"}},"hostedApiKey":"none"},"agentmail_get_draft":{"id":"agentmail_get_draft","name":"Get Draft","description":"Get details of a specific email draft in AgentMail","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentMail API key"},"inboxId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the inbox the draft belongs to"},"draftId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the draft to retrieve"}},"hostedApiKey":"none"},"agentmail_get_inbox":{"id":"agentmail_get_inbox","name":"Get Inbox","description":"Get details of a specific email inbox in AgentMail","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentMail API key"},"inboxId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the inbox to retrieve"}},"hostedApiKey":"none"},"agentmail_get_message":{"id":"agentmail_get_message","name":"Get Message","description":"Get details of a specific email message in AgentMail","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentMail API key"},"inboxId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the inbox containing the message"},"messageId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the message to retrieve"}},"hostedApiKey":"none"},"agentmail_get_thread":{"id":"agentmail_get_thread","name":"Get Thread","description":"Get details of a specific email thread including messages in AgentMail","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentMail API key"},"inboxId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the inbox containing the thread"},"threadId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the thread to retrieve"}},"hostedApiKey":"none"},"agentmail_list_drafts":{"id":"agentmail_list_drafts","name":"List Drafts","description":"List email drafts in an inbox in AgentMail","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentMail API key"},"inboxId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the inbox to list drafts from"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of drafts to return"},"pageToken":{"type":"string","required":false,"visibility":"user-or-llm","description":"Pagination token for next page of results"}},"hostedApiKey":"none"},"agentmail_list_inboxes":{"id":"agentmail_list_inboxes","name":"List Inboxes","description":"List all email inboxes in AgentMail","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentMail API key"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of inboxes to return"},"pageToken":{"type":"string","required":false,"visibility":"user-or-llm","description":"Pagination token for next page of results"}},"hostedApiKey":"none"},"agentmail_list_messages":{"id":"agentmail_list_messages","name":"List Messages","description":"List messages in an inbox in AgentMail","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentMail API key"},"inboxId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the inbox to list messages from"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of messages to return"},"pageToken":{"type":"string","required":false,"visibility":"user-or-llm","description":"Pagination token for next page of results"}},"hostedApiKey":"none"},"agentmail_list_threads":{"id":"agentmail_list_threads","name":"List Threads","description":"List email threads in AgentMail","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentMail API key"},"inboxId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the inbox to list threads from"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of threads to return"},"pageToken":{"type":"string","required":false,"visibility":"user-or-llm","description":"Pagination token for next page of results"},"labels":{"type":"string","required":false,"visibility":"user-or-llm","description":"Comma-separated labels to filter threads by"},"before":{"type":"string","required":false,"visibility":"user-or-llm","description":"Filter threads before this ISO 8601 timestamp"},"after":{"type":"string","required":false,"visibility":"user-or-llm","description":"Filter threads after this ISO 8601 timestamp"}},"hostedApiKey":"none"},"agentmail_reply_message":{"id":"agentmail_reply_message","name":"Reply to Message","description":"Reply to an existing email message in AgentMail","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentMail API key"},"inboxId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the inbox to reply from"},"messageId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the message to reply to"},"text":{"type":"string","required":false,"visibility":"user-or-llm","description":"Plain text reply body"},"html":{"type":"string","required":false,"visibility":"user-or-llm","description":"HTML reply body"},"to":{"type":"string","required":false,"visibility":"user-or-llm","description":"Override recipient email addresses (comma-separated)"},"cc":{"type":"string","required":false,"visibility":"user-or-llm","description":"CC email addresses (comma-separated)"},"bcc":{"type":"string","required":false,"visibility":"user-or-llm","description":"BCC email addresses (comma-separated)"},"replyAll":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Reply to all recipients of the original message"}},"hostedApiKey":"none"},"agentmail_send_draft":{"id":"agentmail_send_draft","name":"Send Draft","description":"Send an existing email draft in AgentMail","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentMail API key"},"inboxId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the inbox containing the draft"},"draftId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the draft to send"}},"hostedApiKey":"none"},"agentmail_send_message":{"id":"agentmail_send_message","name":"Send Message","description":"Send an email message from an AgentMail inbox","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentMail API key"},"inboxId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the inbox to send from"},"to":{"type":"string","required":true,"visibility":"user-or-llm","description":"Recipient email address (comma-separated for multiple)"},"subject":{"type":"string","required":true,"visibility":"user-or-llm","description":"Email subject line"},"text":{"type":"string","required":false,"visibility":"user-or-llm","description":"Plain text email body"},"html":{"type":"string","required":false,"visibility":"user-or-llm","description":"HTML email body"},"cc":{"type":"string","required":false,"visibility":"user-or-llm","description":"CC recipient email addresses (comma-separated)"},"bcc":{"type":"string","required":false,"visibility":"user-or-llm","description":"BCC recipient email addresses (comma-separated)"}},"hostedApiKey":"none"},"agentmail_update_draft":{"id":"agentmail_update_draft","name":"Update Draft","description":"Update an existing email draft in AgentMail","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentMail API key"},"inboxId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the inbox containing the draft"},"draftId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the draft to update"},"to":{"type":"string","required":false,"visibility":"user-or-llm","description":"Recipient email addresses (comma-separated)"},"subject":{"type":"string","required":false,"visibility":"user-or-llm","description":"Draft subject line"},"text":{"type":"string","required":false,"visibility":"user-or-llm","description":"Plain text draft body"},"html":{"type":"string","required":false,"visibility":"user-or-llm","description":"HTML draft body"},"cc":{"type":"string","required":false,"visibility":"user-or-llm","description":"CC recipient email addresses (comma-separated)"},"bcc":{"type":"string","required":false,"visibility":"user-or-llm","description":"BCC recipient email addresses (comma-separated)"},"sendAt":{"type":"string","required":false,"visibility":"user-or-llm","description":"ISO 8601 timestamp to schedule sending"}},"hostedApiKey":"none"},"agentmail_update_inbox":{"id":"agentmail_update_inbox","name":"Update Inbox","description":"Update the display name of an email inbox in AgentMail","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentMail API key"},"inboxId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the inbox to update"},"displayName":{"type":"string","required":true,"visibility":"user-or-llm","description":"New display name for the inbox"}},"hostedApiKey":"none"},"agentmail_update_message":{"id":"agentmail_update_message","name":"Update Message","description":"Add or remove labels on an email message in AgentMail","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentMail API key"},"inboxId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the inbox containing the message"},"messageId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the message to update"},"addLabels":{"type":"string","required":false,"visibility":"user-or-llm","description":"Comma-separated labels to add to the message"},"removeLabels":{"type":"string","required":false,"visibility":"user-or-llm","description":"Comma-separated labels to remove from the message"}},"hostedApiKey":"none"},"agentmail_update_thread":{"id":"agentmail_update_thread","name":"Update Thread Labels","description":"Add or remove labels on an email thread in AgentMail","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentMail API key"},"inboxId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the inbox containing the thread"},"threadId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the thread to update"},"addLabels":{"type":"string","required":false,"visibility":"user-or-llm","description":"Comma-separated labels to add to the thread"},"removeLabels":{"type":"string","required":false,"visibility":"user-or-llm","description":"Comma-separated labels to remove from the thread"}},"hostedApiKey":"none"},"agentphone_create_call":{"id":"agentphone_create_call","name":"Create Outbound Call","description":"Initiate an outbound voice call from an AgentPhone agent","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"},"agentId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Agent that will handle the call"},"toNumber":{"type":"string","required":true,"visibility":"user-or-llm","description":"Phone number to call in E.164 format (e.g. +14155551234)"},"fromNumberId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Phone number ID to use as caller ID. Must belong to the agent. If omitted, the agent\'s first assigned number is used."},"initialGreeting":{"type":"string","required":false,"visibility":"user-or-llm","description":"Optional greeting spoken when the recipient answers"},"voice":{"type":"string","required":false,"visibility":"user-or-llm","description":"Voice ID override for this call (defaults to the agent\'s configured voice)"},"systemPrompt":{"type":"string","required":false,"visibility":"user-or-llm","description":"When provided, uses a built-in LLM for the conversation instead of forwarding to your webhook"}},"hostedApiKey":"none"},"agentphone_create_contact":{"id":"agentphone_create_contact","name":"Create Contact","description":"Create a new contact in AgentPhone","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"},"phoneNumber":{"type":"string","required":true,"visibility":"user-or-llm","description":"Phone number in E.164 format (e.g. +14155551234)"},"name":{"type":"string","required":true,"visibility":"user-or-llm","description":"Contact\'s full name"},"email":{"type":"string","required":false,"visibility":"user-or-llm","description":"Contact\'s email address"},"notes":{"type":"string","required":false,"visibility":"user-or-llm","description":"Freeform notes stored on the contact"}},"hostedApiKey":"none"},"agentphone_create_number":{"id":"agentphone_create_number","name":"Create Phone Number","description":"Provision a new SMS- and voice-enabled phone number","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"},"country":{"type":"string","required":false,"visibility":"user-or-llm","description":"Two-letter country code (e.g. US, CA). Defaults to US."},"areaCode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Preferred area code (US/CA only, e.g. \\"415\\"). Best-effort — may be ignored if unavailable."},"agentId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Optionally attach the number to an agent immediately"}},"hostedApiKey":"none"},"agentphone_delete_contact":{"id":"agentphone_delete_contact","name":"Delete Contact","description":"Delete a contact by ID","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"},"contactId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Contact ID"}},"hostedApiKey":"none"},"agentphone_get_call":{"id":"agentphone_get_call","name":"Get Call","description":"Fetch a call and its full transcript","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"},"callId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the call to retrieve"}},"hostedApiKey":"none"},"agentphone_get_call_transcript":{"id":"agentphone_get_call_transcript","name":"Get Call Transcript","description":"Get the full ordered transcript for a call","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"},"callId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the call to retrieve the transcript for"}},"hostedApiKey":"none"},"agentphone_get_contact":{"id":"agentphone_get_contact","name":"Get Contact","description":"Fetch a single contact by ID","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"},"contactId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Contact ID"}},"hostedApiKey":"none"},"agentphone_get_conversation":{"id":"agentphone_get_conversation","name":"Get Conversation","description":"Get a conversation along with its recent messages","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"},"conversationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Conversation ID"},"messageLimit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of recent messages to include (default 50, max 100)"}},"hostedApiKey":"none"},"agentphone_get_conversation_messages":{"id":"agentphone_get_conversation_messages","name":"Get Conversation Messages","description":"Get paginated messages for a conversation","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"},"conversationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Conversation ID"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of messages to return (default 50, max 200)"},"before":{"type":"string","required":false,"visibility":"user-or-llm","description":"Return messages received before this ISO 8601 timestamp"},"after":{"type":"string","required":false,"visibility":"user-or-llm","description":"Return messages received after this ISO 8601 timestamp"}},"hostedApiKey":"none"},"agentphone_get_number_messages":{"id":"agentphone_get_number_messages","name":"Get Phone Number Messages","description":"Fetch messages received on a specific phone number","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"},"numberId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the phone number"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of messages to return (default 50, max 200)"},"before":{"type":"string","required":false,"visibility":"user-or-llm","description":"Return messages received before this ISO 8601 timestamp"},"after":{"type":"string","required":false,"visibility":"user-or-llm","description":"Return messages received after this ISO 8601 timestamp"}},"hostedApiKey":"none"},"agentphone_get_usage":{"id":"agentphone_get_usage","name":"Get Usage","description":"Retrieve current usage statistics for the AgentPhone account","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"}},"hostedApiKey":"none"},"agentphone_get_usage_daily":{"id":"agentphone_get_usage_daily","name":"Get Daily Usage","description":"Get a daily breakdown of usage (messages, calls, webhooks) for the last N days","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"},"days":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of days to return (1-365, default 30)"}},"hostedApiKey":"none"},"agentphone_get_usage_monthly":{"id":"agentphone_get_usage_monthly","name":"Get Monthly Usage","description":"Get monthly usage aggregation (messages, calls, webhooks) for the last N months","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"},"months":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of months to return (1-24, default 6)"}},"hostedApiKey":"none"},"agentphone_list_calls":{"id":"agentphone_list_calls","name":"List Calls","description":"List voice calls for this AgentPhone account","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of results to return (default 20, max 100)"},"offset":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of results to skip (min 0)"},"status":{"type":"string","required":false,"visibility":"user-or-llm","description":"Filter by status (completed, in-progress, failed)"},"direction":{"type":"string","required":false,"visibility":"user-or-llm","description":"Filter by direction (inbound, outbound)"},"type":{"type":"string","required":false,"visibility":"user-or-llm","description":"Filter by call type (pstn, web)"},"search":{"type":"string","required":false,"visibility":"user-or-llm","description":"Search by phone number (matches fromNumber or toNumber)"}},"hostedApiKey":"none"},"agentphone_list_contacts":{"id":"agentphone_list_contacts","name":"List Contacts","description":"List contacts for this AgentPhone account","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"},"search":{"type":"string","required":false,"visibility":"user-or-llm","description":"Filter by name or phone number (case-insensitive contains)"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of results to return (default 50, max 200)"},"offset":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of results to skip (min 0)"}},"hostedApiKey":"none"},"agentphone_list_conversations":{"id":"agentphone_list_conversations","name":"List Conversations","description":"List conversations (message threads) for this AgentPhone account","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of results to return (default 20, max 100)"},"offset":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of results to skip (min 0)"}},"hostedApiKey":"none"},"agentphone_list_numbers":{"id":"agentphone_list_numbers","name":"List Phone Numbers","description":"List all phone numbers provisioned for this AgentPhone account","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of results to return (default 20, max 100)"},"offset":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of results to skip (min 0)"}},"hostedApiKey":"none"},"agentphone_react_to_message":{"id":"agentphone_react_to_message","name":"React to Message","description":"Send an iMessage tapback reaction to a message (iMessage only)","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"},"messageId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the message to react to"},"reaction":{"type":"string","required":true,"visibility":"user-or-llm","description":"Reaction type: love, like, dislike, laugh, emphasize, or question"}},"hostedApiKey":"none"},"agentphone_release_number":{"id":"agentphone_release_number","name":"Release Phone Number","description":"Release (delete) a phone number. This action is irreversible.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"},"numberId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the phone number to release"}},"hostedApiKey":"none"},"agentphone_send_message":{"id":"agentphone_send_message","name":"Send Message","description":"Send an outbound SMS or iMessage from an AgentPhone agent","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"},"agentId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Agent sending the message"},"toNumber":{"type":"string","required":true,"visibility":"user-or-llm","description":"Recipient phone number in E.164 format (e.g. +14155551234)"},"body":{"type":"string","required":true,"visibility":"user-or-llm","description":"Message text to send"},"mediaUrl":{"type":"string","required":false,"visibility":"user-or-llm","description":"Optional URL of an image, video, or file to attach"},"numberId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Phone number ID to send from. If omitted, the agent\'s first assigned number is used."}},"hostedApiKey":"none"},"agentphone_update_contact":{"id":"agentphone_update_contact","name":"Update Contact","description":"Update a contact\'s fields","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"},"contactId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Contact ID"},"phoneNumber":{"type":"string","required":false,"visibility":"user-or-llm","description":"New phone number in E.164 format"},"name":{"type":"string","required":false,"visibility":"user-or-llm","description":"New contact name"},"email":{"type":"string","required":false,"visibility":"user-or-llm","description":"New email address"},"notes":{"type":"string","required":false,"visibility":"user-or-llm","description":"New freeform notes"}},"hostedApiKey":"none"},"agentphone_update_conversation":{"id":"agentphone_update_conversation","name":"Update Conversation","description":"Update conversation metadata (stored state). Pass null to clear existing metadata.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"AgentPhone API key"},"conversationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Conversation ID"},"metadata":{"type":"json","required":false,"visibility":"user-or-llm","description":"Custom key-value metadata to store on the conversation. Pass null to clear existing metadata."}},"hostedApiKey":"none"},"agiloft_async_status":{"id":"agiloft_async_status","name":"Agiloft Async Status","description":"Check whether an asynchronous Agiloft call, such as a run action button, has completed.","version":"1.0.0","params":{"instanceUrl":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft instance URL (e.g., https://mycompany.agiloft.com)"},"knowledgeBase":{"type":"string","required":true,"visibility":"user-only","description":"Knowledge base name"},"login":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft username"},"password":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft password"},"table":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table the asynchronous call was made against"},"callbackId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Callback ID returned by the asynchronous call, e.g. from Run Action Button"}},"hostedApiKey":"none"},"agiloft_attach_file":{"id":"agiloft_attach_file","name":"Agiloft Attach File","description":"Attach a file to a field in an Agiloft record.","version":"1.0.0","params":{"instanceUrl":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft instance URL (e.g., https://mycompany.agiloft.com)"},"knowledgeBase":{"type":"string","required":true,"visibility":"user-only","description":"Knowledge base name"},"login":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft username"},"password":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft password"},"table":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table name (e.g., \\"contracts\\")"},"recordId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the record to attach the file to"},"fieldName":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the attachment field"},"file":{"type":"file","required":true,"visibility":"user-or-llm","description":"File to attach"},"fileName":{"type":"string","required":false,"visibility":"user-or-llm","description":"Name to assign to the file (defaults to original file name)"},"overwrite":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Replace the contents of the field instead of adding another file to it"}},"hostedApiKey":"none"},"agiloft_attachment_info":{"id":"agiloft_attachment_info","name":"Agiloft Attachment Info","description":"Get information about file attachments on a record field.","version":"1.0.0","params":{"instanceUrl":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft instance URL (e.g., https://mycompany.agiloft.com)"},"knowledgeBase":{"type":"string","required":true,"visibility":"user-only","description":"Knowledge base name"},"login":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft username"},"password":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft password"},"table":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table name (e.g., \\"contracts\\")"},"recordId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the record to check attachments on"},"fieldName":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the attachment field to inspect"}},"hostedApiKey":"none"},"agiloft_create_record":{"id":"agiloft_create_record","name":"Agiloft Create Record","description":"Create a new record in an Agiloft table.","version":"1.0.0","params":{"instanceUrl":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft instance URL (e.g., https://mycompany.agiloft.com)"},"knowledgeBase":{"type":"string","required":true,"visibility":"user-only","description":"Knowledge base name"},"login":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft username"},"password":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft password"},"table":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table name (e.g., \\"contracts\\", \\"contacts.employees\\")"},"data":{"type":"string","required":true,"visibility":"user-or-llm","description":"Record field values as a JSON object (e.g., {\\"first_name\\": \\"John\\", \\"status\\": \\"Active\\"})"}},"hostedApiKey":"none"},"agiloft_delete_record":{"id":"agiloft_delete_record","name":"Agiloft Delete Record","description":"Delete a record from an Agiloft table.","version":"1.0.0","params":{"instanceUrl":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft instance URL (e.g., https://mycompany.agiloft.com)"},"knowledgeBase":{"type":"string","required":true,"visibility":"user-only","description":"Knowledge base name"},"login":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft username"},"password":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft password"},"table":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table name (e.g., \\"contracts\\", \\"contacts.employees\\")"},"recordId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the record to delete"},"substituteIds":{"type":"string","required":false,"visibility":"user-or-llm","description":"Comma-separated IDs of records that adopt the dependants of the deleted record. Read only when the delete rule is REPLACE_WITH_ANOTHER."},"deleteRule":{"type":"string","required":false,"visibility":"user-or-llm","description":"How to treat records that depend on this one: ERROR_IF_DEPENDANTS (default — fails rather than cascading), APPLY_DELETE_WHERE_POSSIBLE, DELETE_WHERE_POSSIBLE_OTHERWISE_UNLINK, APPLY_UNLINK, UNLINK_WHERE_POSSIBLE_OTHERWISE_DELETE, or REPLACE_WITH_ANOTHER"}},"hostedApiKey":"none"},"agiloft_get_choice_line_id":{"id":"agiloft_get_choice_line_id","name":"Agiloft Get Choice Line ID","description":"Resolve the internal numeric ID of a choice-list value, for use in EWSelect WHERE clauses against choice fields.","version":"1.0.0","params":{"instanceUrl":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft instance URL (e.g., https://mycompany.agiloft.com)"},"knowledgeBase":{"type":"string","required":true,"visibility":"user-only","description":"Knowledge base name"},"login":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft username"},"password":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft password"},"table":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table name (e.g., \\"case\\", \\"contracts\\")"},"fieldName":{"type":"string","required":true,"visibility":"user-or-llm","description":"Choice field name (e.g., \\"priority\\", \\"status\\")"},"value":{"type":"string","required":true,"visibility":"user-or-llm","description":"Choice display value to resolve (e.g., \\"High\\", \\"Active\\")"}},"hostedApiKey":"none"},"agiloft_list_tables":{"id":"agiloft_list_tables","name":"Agiloft List Tables","description":"List the tables and fields in an Agiloft knowledge base, to discover the logical names other operations need.","version":"1.0.0","params":{"instanceUrl":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft instance URL (e.g., https://mycompany.agiloft.com)"},"knowledgeBase":{"type":"string","required":true,"visibility":"user-only","description":"Knowledge base name"},"login":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft username"},"password":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft password"},"table":{"type":"string","required":false,"visibility":"user-or-llm","description":"Logical name of a single table to describe (e.g., \\"contacts\\"). Leave empty to list every table in the knowledge base."},"includeLinkedInfo":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Include the source table and column behind each linked field"},"skipColumnsInfo":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Return table names only, omitting field details, for a much smaller response"}},"hostedApiKey":"none"},"agiloft_lock_record":{"id":"agiloft_lock_record","name":"Agiloft Lock Record","description":"Lock, unlock, or check the lock status of an Agiloft record.","version":"1.0.0","params":{"instanceUrl":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft instance URL (e.g., https://mycompany.agiloft.com)"},"knowledgeBase":{"type":"string","required":true,"visibility":"user-only","description":"Knowledge base name"},"login":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft username"},"password":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft password"},"table":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table name (e.g., \\"contracts\\")"},"recordId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the record to lock, unlock, or check"},"lockAction":{"type":"string","required":true,"visibility":"user-or-llm","description":"Action to perform: \\"lock\\", \\"unlock\\", or \\"check\\""},"force":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Unlock only: release a lock held by another user."}},"hostedApiKey":"none"},"agiloft_nlp_search":{"id":"agiloft_nlp_search","name":"Agiloft Natural Language Search","description":"Search Agiloft records by describing what you want in plain language, such as \\"active NDAs submitted last month\\".","version":"1.0.0","params":{"instanceUrl":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft instance URL (e.g., https://mycompany.agiloft.com)"},"knowledgeBase":{"type":"string","required":true,"visibility":"user-only","description":"Knowledge base name"},"login":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft username"},"password":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft password"},"nlpQuery":{"type":"string","required":true,"visibility":"user-or-llm","description":"The request in plain language, e.g. \\"Show me open, high-priority contracts\\". Structured field filters are not accepted — use Search Records for those."},"fields":{"type":"string","required":true,"visibility":"user-or-llm","description":"Comma-separated field names to return, e.g. \\"id, contract_title1, company_name\\""},"page":{"type":"string","required":false,"visibility":"user-or-llm","description":"Page number, starting from 0"},"limit":{"type":"string","required":false,"visibility":"user-or-llm","description":"Records per page"}},"hostedApiKey":"none"},"agiloft_read_record":{"id":"agiloft_read_record","name":"Agiloft Read Record","description":"Read a record by ID from an Agiloft table.","version":"1.0.0","params":{"instanceUrl":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft instance URL (e.g., https://mycompany.agiloft.com)"},"knowledgeBase":{"type":"string","required":true,"visibility":"user-only","description":"Knowledge base name"},"login":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft username"},"password":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft password"},"table":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table name (e.g., \\"contracts\\", \\"contacts.employees\\")"},"recordId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the record to read"},"fields":{"type":"string","required":false,"visibility":"user-or-llm","description":"Comma-separated list of field names to include in the response"}},"hostedApiKey":"none"},"agiloft_remove_attachment":{"id":"agiloft_remove_attachment","name":"Agiloft Remove Attachment","description":"Remove an attached file from a field in an Agiloft record.","version":"1.0.0","params":{"instanceUrl":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft instance URL (e.g., https://mycompany.agiloft.com)"},"knowledgeBase":{"type":"string","required":true,"visibility":"user-only","description":"Knowledge base name"},"login":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft username"},"password":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft password"},"table":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table name (e.g., \\"contracts\\")"},"recordId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the record containing the attachment"},"fieldName":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the attachment field"},"position":{"type":"string","required":true,"visibility":"user-or-llm","description":"Position index of the file to remove (starting from 0)"}},"hostedApiKey":"none"},"agiloft_retrieve_attachment":{"id":"agiloft_retrieve_attachment","name":"Agiloft Retrieve Attachment","description":"Download an attached file from an Agiloft record field.","version":"1.0.0","params":{"instanceUrl":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft instance URL (e.g., https://mycompany.agiloft.com)"},"knowledgeBase":{"type":"string","required":true,"visibility":"user-only","description":"Knowledge base name"},"login":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft username"},"password":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft password"},"table":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table name (e.g., \\"contracts\\")"},"recordId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the record containing the attachment"},"fieldName":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the attachment field"},"position":{"type":"string","required":true,"visibility":"user-or-llm","description":"Position index of the file in the field (starting from 0)"}},"hostedApiKey":"none"},"agiloft_run_action_button":{"id":"agiloft_run_action_button","name":"Agiloft Run Action Button","description":"Run an action button on an Agiloft record, such as an approval or send-for-signature step.","version":"1.0.0","params":{"instanceUrl":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft instance URL (e.g., https://mycompany.agiloft.com)"},"knowledgeBase":{"type":"string","required":true,"visibility":"user-only","description":"Knowledge base name"},"login":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft username"},"password":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft password"},"table":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table name (e.g., \\"contracts\\", \\"case\\")"},"recordId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the record to run the action button on"},"actionButtonField":{"type":"string","required":true,"visibility":"user-or-llm","description":"Logical name of the field holding the action button (e.g., \\"ab_field\\")"}},"hostedApiKey":"none"},"agiloft_saved_search":{"id":"agiloft_saved_search","name":"Agiloft Saved Search","description":"List the saved searches defined for an Agiloft table.","version":"1.0.0","params":{"instanceUrl":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft instance URL (e.g., https://mycompany.agiloft.com)"},"knowledgeBase":{"type":"string","required":true,"visibility":"user-only","description":"Knowledge base name"},"login":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft username"},"password":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft password"},"table":{"type":"string","required":true,"visibility":"user-or-llm","description":"Logical table name to list saved searches for (e.g., \\"contract\\")"}},"hostedApiKey":"none"},"agiloft_search_records":{"id":"agiloft_search_records","name":"Agiloft Search Records","description":"Search for records in an Agiloft table using a query.","version":"1.0.0","params":{"instanceUrl":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft instance URL (e.g., https://mycompany.agiloft.com)"},"knowledgeBase":{"type":"string","required":true,"visibility":"user-only","description":"Knowledge base name"},"login":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft username"},"password":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft password"},"table":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table name to search in (e.g., \\"contracts\\", \\"contacts.employees\\")"},"query":{"type":"string","required":false,"visibility":"user-or-llm","description":"Ad hoc EWSearch query. Combine conditions with && (and) or || (or) and quote every value — e.g. \\"summary~=\'test\'&&priority=\'High\'\\". Required unless a saved search is given."},"search":{"type":"string","required":false,"visibility":"user-or-llm","description":"Label of a saved search defined on the table (e.g., \\"C: Status is Closed\\"). Can be combined with a query to narrow it further."},"fields":{"type":"string","required":false,"visibility":"user-or-llm","description":"Comma-separated list of field names to include in the results"},"page":{"type":"string","required":false,"visibility":"user-or-llm","description":"Page number for paginated results (starting from 0)"},"limit":{"type":"string","required":false,"visibility":"user-or-llm","description":"Maximum number of records to return per page. Agiloft treats 0 as \\"all records\\", so leave it unset or use a positive value to keep result sizes bounded."}},"hostedApiKey":"none"},"agiloft_select_records":{"id":"agiloft_select_records","name":"Agiloft Select Records","description":"Select record IDs matching a SQL WHERE clause from an Agiloft table.","version":"1.0.0","params":{"instanceUrl":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft instance URL (e.g., https://mycompany.agiloft.com)"},"knowledgeBase":{"type":"string","required":true,"visibility":"user-only","description":"Knowledge base name"},"login":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft username"},"password":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft password"},"table":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table name (e.g., \\"contracts\\", \\"contacts.employees\\")"},"where":{"type":"string","required":true,"visibility":"user-or-llm","description":"SQL WHERE clause using database column names (e.g., \\"summary like \'%new%\'\\" or \\"assigned_person=\'John Doe\'\\"). EWSelect has no page size and returns every matching ID, so append a database limit such as \\"limit 0,200\\" to bound the result."}},"hostedApiKey":"none"},"agiloft_update_record":{"id":"agiloft_update_record","name":"Agiloft Update Record","description":"Update an existing record in an Agiloft table.","version":"1.0.0","params":{"instanceUrl":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft instance URL (e.g., https://mycompany.agiloft.com)"},"knowledgeBase":{"type":"string","required":true,"visibility":"user-only","description":"Knowledge base name"},"login":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft username"},"password":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft password"},"table":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table name (e.g., \\"contracts\\", \\"contacts.employees\\")"},"recordId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the record to update"},"data":{"type":"string","required":true,"visibility":"user-or-llm","description":"Updated field values as a JSON object (e.g., {\\"status\\": \\"Active\\", \\"priority\\": \\"High\\"})"}},"hostedApiKey":"none"},"agiloft_upsert_record":{"id":"agiloft_upsert_record","name":"Agiloft Upsert Record","description":"Create an Agiloft record, or update it when a record already matches the given fields.","version":"1.0.0","params":{"instanceUrl":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft instance URL (e.g., https://mycompany.agiloft.com)"},"knowledgeBase":{"type":"string","required":true,"visibility":"user-only","description":"Knowledge base name"},"login":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft username"},"password":{"type":"string","required":true,"visibility":"user-only","description":"Agiloft password"},"table":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table name (e.g., \\"contracts\\", \\"contacts.employees\\")"},"match":{"type":"string","required":true,"visibility":"user-or-llm","description":"Field used to find an existing record (e.g., \\"ext_id\\"). Pick something that identifies a record uniquely — if more than one record matches, Agiloft writes nothing and returns a conflict."},"async":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Queue the write instead of waiting for it. Returns a callback ID instead of a record ID; pass that to Async Status to poll the result."},"data":{"type":"string","required":true,"visibility":"user-or-llm","description":"Field values as a JSON object. On create these populate the new record; on update only the supplied fields change."}},"hostedApiKey":"none"},"ahrefs_anchors":{"id":"ahrefs_anchors","name":"Ahrefs Anchors","description":"Get the anchor text distribution for a target domain or URL\'s backlinks, showing how many links and referring domains use each anchor text.","version":"1.0.0","params":{"target":{"type":"string","required":true,"visibility":"user-or-llm","description":"The target domain or URL to analyze. Example: \\"example.com\\" or \\"https://example.com/page\\""},"mode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Analysis mode: domain (entire domain), prefix (URL prefix), subdomains (include all subdomains, default), exact (exact URL match)"},"history":{"type":"string","required":false,"visibility":"user-or-llm","description":"Historical scope: \\"live\\" (currently live), \\"all_time\\" (default, includes lost backlinks), or \\"since:YYYY-MM-DD\\" (backlinks found since a date)"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of results to return. Example: 50 (default: 1000)"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_backlinks":{"id":"ahrefs_backlinks","name":"Ahrefs Backlinks","description":"Get a list of backlinks pointing to a target domain or URL. Returns details about each backlink including source URL, anchor text, and domain rating.","version":"1.0.0","params":{"target":{"type":"string","required":true,"visibility":"user-or-llm","description":"The target domain or URL to analyze. Example: \\"example.com\\" or \\"https://example.com/page\\""},"mode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Analysis mode: domain (entire domain), prefix (URL prefix), subdomains (include all subdomains, default), exact (exact URL match). Example: \\"domain\\""},"history":{"type":"string","required":false,"visibility":"user-or-llm","description":"Historical scope: \\"live\\" (currently live backlinks), \\"all_time\\" (default, includes lost backlinks), or \\"since:YYYY-MM-DD\\" (backlinks found since a date)."},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of results to return. Example: 50 (default: 1000)"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_backlinks_stats":{"id":"ahrefs_backlinks_stats","name":"Ahrefs Backlinks Stats","description":"Get backlink and referring domain totals for a target domain or URL, both currently live and across all time.","version":"1.0.0","params":{"target":{"type":"string","required":true,"visibility":"user-or-llm","description":"The target domain or URL to analyze. Example: \\"example.com\\" or \\"https://example.com/page\\""},"mode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Analysis mode: domain (entire domain), prefix (URL prefix), subdomains (include all subdomains, default), exact (exact URL match). Example: \\"domain\\""},"date":{"type":"string","required":false,"visibility":"user-only","description":"Date to report metrics on, in YYYY-MM-DD format (defaults to today)"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_batch_analysis":{"id":"ahrefs_batch_analysis","name":"Ahrefs Batch Analysis","description":"Get bulk SEO metrics (Domain Rating, backlinks, referring domains, organic traffic, and more) for multiple domains or URLs in a single request. Useful for comparing many competitors at once.","version":"1.0.0","params":{"targets":{"type":"string","required":true,"visibility":"user-or-llm","description":"Comma-separated list of domains or URLs to analyze. Example: \\"example.com,competitor.com\\""},"mode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Analysis mode applied to every target: domain (entire domain), prefix (URL prefix), subdomains (include all subdomains, default), exact (exact URL match)"},"protocol":{"type":"string","required":false,"visibility":"user-or-llm","description":"Protocol applied to every target: \\"both\\" (default), \\"http\\", or \\"https\\""},"country":{"type":"string","required":false,"visibility":"user-or-llm","description":"Country code for traffic data. Example: \\"us\\", \\"gb\\", \\"de\\" (default: \\"us\\")"},"volumeMode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Search volume calculation: \\"monthly\\" or \\"average\\" (default: \\"monthly\\")"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_broken_backlinks":{"id":"ahrefs_broken_backlinks","name":"Ahrefs Broken Backlinks","description":"Get a list of broken backlinks pointing to a target domain or URL. Useful for identifying link reclamation opportunities.","version":"1.0.0","params":{"target":{"type":"string","required":true,"visibility":"user-or-llm","description":"The target domain or URL to analyze. Example: \\"example.com\\" or \\"https://example.com/page\\""},"mode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Analysis mode: domain (entire domain), prefix (URL prefix), subdomains (include all subdomains, default), exact (exact URL match). Example: \\"domain\\""},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of results to return. Example: 50 (default: 1000)"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_domain_rating":{"id":"ahrefs_domain_rating","name":"Ahrefs Domain Rating","description":"Get the Domain Rating (DR) and Ahrefs Rank for a target domain. Domain Rating shows the strength of a website\'s backlink profile on a scale from 0 to 100.","version":"1.0.0","params":{"target":{"type":"string","required":true,"visibility":"user-or-llm","description":"The target domain to analyze (e.g., example.com)"},"date":{"type":"string","required":false,"visibility":"user-only","description":"Date for historical data in YYYY-MM-DD format (defaults to today)"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_domain_rating_history":{"id":"ahrefs_domain_rating_history","name":"Ahrefs Domain Rating History","description":"Get the historical Domain Rating (DR) trend for a target domain or URL over a date range, grouped daily, weekly, or monthly.","version":"1.0.0","params":{"target":{"type":"string","required":true,"visibility":"user-or-llm","description":"The target domain or URL to analyze. Example: \\"example.com\\""},"dateFrom":{"type":"string","required":true,"visibility":"user-only","description":"Start date of the historical period, in YYYY-MM-DD format"},"dateTo":{"type":"string","required":false,"visibility":"user-only","description":"End date of the historical period, in YYYY-MM-DD format (defaults to today)"},"historyGrouping":{"type":"string","required":false,"visibility":"user-or-llm","description":"Time interval for grouping data points: \\"daily\\", \\"weekly\\", or \\"monthly\\" (default: \\"monthly\\")"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_keyword_overview":{"id":"ahrefs_keyword_overview","name":"Ahrefs Keyword Overview","description":"Get detailed metrics for a keyword including search volume, keyword difficulty, CPC, clicks, and traffic potential.","version":"1.0.0","params":{"keyword":{"type":"string","required":true,"visibility":"user-or-llm","description":"The keyword to analyze"},"country":{"type":"string","required":false,"visibility":"user-or-llm","description":"Country code for keyword data. Example: \\"us\\", \\"gb\\", \\"de\\" (default: \\"us\\")"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_keywords_history":{"id":"ahrefs_keywords_history","name":"Ahrefs Keywords History","description":"Get the historical organic keyword ranking distribution for a target domain or URL over a date range: how many keywords rank in each position bucket at each point in time.","version":"1.0.0","params":{"target":{"type":"string","required":true,"visibility":"user-or-llm","description":"The target domain or URL to analyze. Example: \\"example.com\\""},"dateFrom":{"type":"string","required":true,"visibility":"user-only","description":"Start date of the historical period, in YYYY-MM-DD format"},"dateTo":{"type":"string","required":false,"visibility":"user-only","description":"End date of the historical period, in YYYY-MM-DD format (defaults to today)"},"historyGrouping":{"type":"string","required":false,"visibility":"user-or-llm","description":"Time interval for grouping data points: \\"daily\\", \\"weekly\\", or \\"monthly\\" (default: \\"monthly\\")"},"country":{"type":"string","required":false,"visibility":"user-or-llm","description":"Country code for search results. Example: \\"us\\", \\"gb\\", \\"de\\" (default: \\"us\\")"},"mode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Analysis mode: domain (entire domain), prefix (URL prefix), subdomains (include all subdomains, default), exact (exact URL match)"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_metrics":{"id":"ahrefs_metrics","name":"Ahrefs Metrics","description":"Get a one-call organic and paid search overview for a target domain or URL: organic traffic, organic keywords, paid traffic, paid keywords, and estimated traffic cost.","version":"1.0.0","params":{"target":{"type":"string","required":true,"visibility":"user-or-llm","description":"The target domain or URL to analyze. Example: \\"example.com\\""},"country":{"type":"string","required":false,"visibility":"user-or-llm","description":"Country code for traffic data. Example: \\"us\\", \\"gb\\", \\"de\\""},"mode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Analysis mode: domain (entire domain), prefix (URL prefix), subdomains (include all subdomains, default), exact (exact URL match). Example: \\"domain\\""},"date":{"type":"string","required":false,"visibility":"user-only","description":"Date to report metrics on, in YYYY-MM-DD format (defaults to today)"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_metrics_history":{"id":"ahrefs_metrics_history","name":"Ahrefs Metrics History","description":"Get the historical organic and paid traffic trend for a target domain or URL over a date range: organic traffic/cost and paid traffic/cost at each point in time.","version":"1.0.0","params":{"target":{"type":"string","required":true,"visibility":"user-or-llm","description":"The target domain or URL to analyze. Example: \\"example.com\\""},"dateFrom":{"type":"string","required":true,"visibility":"user-only","description":"Start date of the historical period, in YYYY-MM-DD format"},"dateTo":{"type":"string","required":false,"visibility":"user-only","description":"End date of the historical period, in YYYY-MM-DD format (defaults to today)"},"volumeMode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Search volume calculation: \\"monthly\\" or \\"average\\" (default: \\"monthly\\")"},"historyGrouping":{"type":"string","required":false,"visibility":"user-or-llm","description":"Time interval for grouping data points: \\"daily\\", \\"weekly\\", or \\"monthly\\" (default: \\"monthly\\")"},"country":{"type":"string","required":false,"visibility":"user-or-llm","description":"Country code for traffic data. Example: \\"us\\", \\"gb\\", \\"de\\" (default: \\"us\\")"},"mode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Analysis mode: domain (entire domain), prefix (URL prefix), subdomains (include all subdomains, default), exact (exact URL match)"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_organic_competitors":{"id":"ahrefs_organic_competitors","name":"Ahrefs Organic Competitors","description":"Get domains that compete with a target domain or URL for the same organic keywords, ranked by keyword overlap.","version":"1.0.0","params":{"target":{"type":"string","required":true,"visibility":"user-or-llm","description":"The target domain or URL to analyze. Example: \\"example.com\\""},"country":{"type":"string","required":false,"visibility":"user-or-llm","description":"Country code for search results. Example: \\"us\\", \\"gb\\", \\"de\\" (default: \\"us\\")"},"mode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Analysis mode: domain (entire domain), prefix (URL prefix), subdomains (include all subdomains, default), exact (exact URL match). Example: \\"domain\\""},"date":{"type":"string","required":false,"visibility":"user-only","description":"Date to report metrics on, in YYYY-MM-DD format (defaults to today)"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of results to return. Example: 50 (default: 1000)"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_organic_keywords":{"id":"ahrefs_organic_keywords","name":"Ahrefs Organic Keywords","description":"Get organic keywords that a target domain or URL ranks for in Google search results. Returns keyword details including search volume, ranking position, and estimated traffic.","version":"1.0.0","params":{"target":{"type":"string","required":true,"visibility":"user-or-llm","description":"The target domain or URL to analyze. Example: \\"example.com\\" or \\"https://example.com/page\\""},"country":{"type":"string","required":false,"visibility":"user-or-llm","description":"Country code for search results. Example: \\"us\\", \\"gb\\", \\"de\\" (default: \\"us\\")"},"mode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Analysis mode: domain (entire domain), prefix (URL prefix), subdomains (include all subdomains, default), exact (exact URL match). Example: \\"domain\\""},"date":{"type":"string","required":false,"visibility":"user-only","description":"Date to report metrics on, in YYYY-MM-DD format (defaults to today)"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of results to return. Example: 50 (default: 1000)"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_paid_pages":{"id":"ahrefs_paid_pages","name":"Ahrefs Paid Pages","description":"Get a target domain\'s pages that receive paid search traffic, sorted by estimated paid traffic. Returns page URLs with their paid traffic, keyword counts, and estimated spend.","version":"1.0.0","params":{"target":{"type":"string","required":true,"visibility":"user-or-llm","description":"The target domain or URL to analyze. Example: \\"example.com\\""},"country":{"type":"string","required":false,"visibility":"user-or-llm","description":"Country code for traffic data. Example: \\"us\\", \\"gb\\", \\"de\\" (default: \\"us\\")"},"mode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Analysis mode: domain (entire domain), prefix (URL prefix), subdomains (include all subdomains, default), exact (exact URL match)"},"date":{"type":"string","required":false,"visibility":"user-only","description":"Date to report metrics on, in YYYY-MM-DD format (defaults to today)"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of results to return. Example: 50 (default: 1000)"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_rank_tracker_competitors_overview":{"id":"ahrefs_rank_tracker_competitors_overview","name":"Ahrefs Rank Tracker Competitors Overview","description":"Get competitor rankings for the keywords tracked in an Ahrefs Rank Tracker project: each tracked keyword\'s volume and difficulty alongside every competitor\'s position, traffic, and traffic value. This endpoint is free and does not consume API units.","version":"1.0.0","params":{"projectId":{"type":"number","required":true,"visibility":"user-or-llm","description":"The Rank Tracker project ID (found in the project URL in Ahrefs)"},"date":{"type":"string","required":true,"visibility":"user-only","description":"Date to report rankings for, in YYYY-MM-DD format"},"device":{"type":"string","required":true,"visibility":"user-or-llm","description":"Rankings device type: \\"desktop\\" or \\"mobile\\""},"dateCompared":{"type":"string","required":false,"visibility":"user-only","description":"Comparison date in YYYY-MM-DD format, to compute position/traffic deltas"},"volumeMode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Search volume calculation: \\"monthly\\" or \\"average\\" (default: \\"monthly\\")"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of results to return. Example: 50 (default: 1000)"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_rank_tracker_competitors_stats":{"id":"ahrefs_rank_tracker_competitors_stats","name":"Ahrefs Rank Tracker Competitors Stats","description":"Get aggregate competitor stats for an Ahrefs Rank Tracker project: each competitor\'s traffic, traffic value, average position, and share of voice across all tracked keywords. This endpoint is free and does not consume API units.","version":"1.0.0","params":{"projectId":{"type":"number","required":true,"visibility":"user-or-llm","description":"The Rank Tracker project ID (found in the project URL in Ahrefs)"},"date":{"type":"string","required":true,"visibility":"user-only","description":"Date to report metrics for, in YYYY-MM-DD format"},"device":{"type":"string","required":true,"visibility":"user-or-llm","description":"Rankings device type: \\"desktop\\" or \\"mobile\\""},"volumeMode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Search volume calculation: \\"monthly\\" or \\"average\\" (default: \\"monthly\\")"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_rank_tracker_overview":{"id":"ahrefs_rank_tracker_overview","name":"Ahrefs Rank Tracker Overview","description":"Get ranking overview metrics for the keywords tracked in an Ahrefs Rank Tracker project: position, search volume, keyword difficulty, and estimated traffic. This endpoint is free and does not consume API units.","version":"1.0.0","params":{"projectId":{"type":"number","required":true,"visibility":"user-or-llm","description":"The Rank Tracker project ID (found in the project URL in Ahrefs)"},"date":{"type":"string","required":true,"visibility":"user-only","description":"Date to report rankings for, in YYYY-MM-DD format"},"device":{"type":"string","required":true,"visibility":"user-or-llm","description":"Rankings device type: \\"desktop\\" or \\"mobile\\""},"dateCompared":{"type":"string","required":false,"visibility":"user-only","description":"Comparison date in YYYY-MM-DD format, to compute position/traffic deltas"},"volumeMode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Search volume calculation: \\"monthly\\" or \\"average\\" (default: \\"monthly\\")"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of results to return. Example: 50 (default: 1000)"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_rank_tracker_serp_overview":{"id":"ahrefs_rank_tracker_serp_overview","name":"Ahrefs Rank Tracker SERP Overview","description":"Get the full SERP (search engine results page) for a keyword tracked in an Ahrefs Rank Tracker project, including every ranking URL with its position, title, and authority metrics. This endpoint is free and does not consume API units.","version":"1.0.0","params":{"projectId":{"type":"number","required":true,"visibility":"user-or-llm","description":"The Rank Tracker project ID (found in the project URL in Ahrefs)"},"keyword":{"type":"string","required":true,"visibility":"user-or-llm","description":"The tracked keyword to retrieve SERP data for"},"country":{"type":"string","required":true,"visibility":"user-or-llm","description":"Country code for the tracked keyword. Example: \\"us\\", \\"gb\\", \\"de\\""},"device":{"type":"string","required":true,"visibility":"user-or-llm","description":"Rankings device type: \\"desktop\\" or \\"mobile\\""},"topPositions":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of top organic positions to return (defaults to all available)"},"date":{"type":"string","required":false,"visibility":"user-only","description":"Timestamp to return the last available SERP Overview at, in YYYY-MM-DDThh:mm:ss format"},"locationId":{"type":"number","required":false,"visibility":"user-or-llm","description":"Location ID of the tracked keyword, if tracked at a specific location"},"languageCode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Language code of the tracked keyword"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_refdomains_history":{"id":"ahrefs_refdomains_history","name":"Ahrefs Referring Domains History","description":"Get the historical referring domains trend for a target domain or URL over a date range, grouped daily, weekly, or monthly.","version":"1.0.0","params":{"target":{"type":"string","required":true,"visibility":"user-or-llm","description":"The target domain or URL to analyze. Example: \\"example.com\\""},"dateFrom":{"type":"string","required":true,"visibility":"user-only","description":"Start date of the historical period, in YYYY-MM-DD format"},"dateTo":{"type":"string","required":false,"visibility":"user-only","description":"End date of the historical period, in YYYY-MM-DD format (defaults to today)"},"historyGrouping":{"type":"string","required":false,"visibility":"user-or-llm","description":"Time interval for grouping data points: \\"daily\\", \\"weekly\\", or \\"monthly\\" (default: \\"monthly\\")"},"mode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Analysis mode: domain (entire domain), prefix (URL prefix), subdomains (include all subdomains, default), exact (exact URL match)"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_referring_domains":{"id":"ahrefs_referring_domains","name":"Ahrefs Referring Domains","description":"Get a list of domains that link to a target domain or URL. Returns unique referring domains with their domain rating, backlink counts, and discovery dates.","version":"1.0.0","params":{"target":{"type":"string","required":true,"visibility":"user-or-llm","description":"The target domain or URL to analyze. Example: \\"example.com\\" or \\"https://example.com/page\\""},"mode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Analysis mode: domain (entire domain), prefix (URL prefix), subdomains (include all subdomains, default), exact (exact URL match). Example: \\"domain\\""},"history":{"type":"string","required":false,"visibility":"user-or-llm","description":"Historical scope: \\"live\\" (currently live), \\"all_time\\" (default, includes lost domains), or \\"since:YYYY-MM-DD\\" (domains found since a date)."},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of results to return. Example: 50 (default: 1000)"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_related_terms":{"id":"ahrefs_related_terms","name":"Ahrefs Related Terms","description":"Get keyword ideas related to a seed keyword: terms the same top-ranking pages also rank for (\\"also rank for\\") or also discuss (\\"also talk about\\"), with volume, difficulty, and CPC.","version":"1.0.0","params":{"keyword":{"type":"string","required":true,"visibility":"user-or-llm","description":"The seed keyword to find related terms for"},"country":{"type":"string","required":false,"visibility":"user-or-llm","description":"Country code for keyword data. Example: \\"us\\", \\"gb\\", \\"de\\" (default: \\"us\\")"},"terms":{"type":"string","required":false,"visibility":"user-or-llm","description":"Type of related keywords to return: \\"also_rank_for\\", \\"also_talk_about\\", or \\"all\\" (default: \\"all\\")"},"viewFor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Whether to derive related terms from the top 10 or top 100 ranking pages (default: \\"top_10\\")"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of results to return. Example: 50 (default: 1000)"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_site_audit_page_explorer":{"id":"ahrefs_site_audit_page_explorer","name":"Ahrefs Site Audit Page Explorer","description":"Get crawled pages from an Ahrefs Site Audit project with health and SEO metrics: HTTP status, title, link counts, backlinks, indexability, and traffic. Optionally filter to pages affected by a specific issue.","version":"1.0.0","params":{"projectId":{"type":"number","required":true,"visibility":"user-or-llm","description":"The Site Audit project ID (found in the project URL in Ahrefs)"},"date":{"type":"string","required":false,"visibility":"user-only","description":"Crawl date in YYYY-MM-DDThh:mm:ss format (defaults to the most recent crawl)"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of results to return. Example: 50 (default: 1000)"},"offset":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of results to skip, for pagination"},"issueId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Only return pages affected by this issue ID"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"ahrefs_top_pages":{"id":"ahrefs_top_pages","name":"Ahrefs Top Pages","description":"Get the top pages of a target domain sorted by organic traffic. Returns page URLs with their traffic, keyword counts, and estimated traffic value.","version":"1.0.0","params":{"target":{"type":"string","required":true,"visibility":"user-or-llm","description":"The target domain to analyze. Example: \\"example.com\\""},"country":{"type":"string","required":false,"visibility":"user-or-llm","description":"Country code for traffic data. Example: \\"us\\", \\"gb\\", \\"de\\" (default: \\"us\\")"},"mode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Analysis mode: domain (entire domain), prefix (URL prefix), subdomains (include all subdomains, default), exact (exact URL match). Example: \\"domain\\""},"date":{"type":"string","required":false,"visibility":"user-only","description":"Date to report metrics on, in YYYY-MM-DD format (defaults to today)"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of results to return. Example: 50 (default: 1000)"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ahrefs API Key"}},"hostedApiKey":"none"},"airtable_create_records":{"id":"airtable_create_records","name":"Airtable Create Records","description":"Write new records to an Airtable table","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token"},"baseId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Airtable base ID (starts with \\"app\\", e.g., \\"appXXXXXXXXXXXXXX\\")"},"tableId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table ID (starts with \\"tbl\\") or table name"},"records":{"type":"json","required":true,"visibility":"user-or-llm","description":"Array of records to create, each with a `fields` object"},"typecast":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"When true, Airtable automatically converts string values to the field type"}},"oauth":{"required":true,"provider":"airtable"},"hostedApiKey":"none"},"airtable_delete_records":{"id":"airtable_delete_records","name":"Airtable Delete Records","description":"Delete one or more records from an Airtable table by ID","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token"},"baseId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Airtable base ID (starts with \\"app\\", e.g., \\"appXXXXXXXXXXXXXX\\")"},"tableId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table ID (starts with \\"tbl\\") or table name"},"recordIds":{"type":"json","required":true,"visibility":"user-or-llm","description":"Array of record IDs to delete (each starts with \\"rec\\", e.g., [\\"recXXXXXXXXXXXXXX\\"]). Pass a single-element array to delete one record."}},"oauth":{"required":true,"provider":"airtable"},"hostedApiKey":"none"},"airtable_get_base_schema":{"id":"airtable_get_base_schema","name":"Airtable Get Base Schema","description":"Get the schema of all tables, fields, and views in an Airtable base","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token"},"baseId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Airtable base ID (starts with \\"app\\", e.g., \\"appXXXXXXXXXXXXXX\\")"}},"oauth":{"required":true,"provider":"airtable"},"hostedApiKey":"none"},"airtable_get_record":{"id":"airtable_get_record","name":"Airtable Get Record","description":"Retrieve a single record from an Airtable table by its ID","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token"},"baseId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Airtable base ID (starts with \\"app\\", e.g., \\"appXXXXXXXXXXXXXX\\")"},"tableId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table ID (starts with \\"tbl\\") or table name"},"recordId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Record ID to retrieve (starts with \\"rec\\", e.g., \\"recXXXXXXXXXXXXXX\\")"}},"oauth":{"required":true,"provider":"airtable"},"hostedApiKey":"none"},"airtable_list_bases":{"id":"airtable_list_bases","name":"Airtable List Bases","description":"List all bases the authenticated user has access to","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token"},"offset":{"type":"string","required":false,"visibility":"user-or-llm","description":"Pagination offset for retrieving additional bases"}},"oauth":{"required":true,"provider":"airtable"},"hostedApiKey":"none"},"airtable_list_records":{"id":"airtable_list_records","name":"Airtable List Records","description":"Read records from an Airtable table","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token"},"baseId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Airtable base ID (starts with \\"app\\", e.g., \\"appXXXXXXXXXXXXXX\\")"},"tableId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table ID (starts with \\"tbl\\") or table name"},"maxRecords":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of records to return (default: all records)"},"filterFormula":{"type":"string","required":false,"visibility":"user-or-llm","description":"Formula to filter records (e.g., \\"({Field Name} = \'Value\')\\")"}},"oauth":{"required":true,"provider":"airtable"},"hostedApiKey":"none"},"airtable_list_tables":{"id":"airtable_list_tables","name":"Airtable List Tables","description":"List all tables and their schema in an Airtable base","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token"},"baseId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Airtable base ID (starts with \\"app\\", e.g., \\"appXXXXXXXXXXXXXX\\")"}},"oauth":{"required":true,"provider":"airtable"},"hostedApiKey":"none"},"airtable_update_multiple_records":{"id":"airtable_update_multiple_records","name":"Airtable Update Multiple Records","description":"Update multiple existing records in an Airtable table","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token"},"baseId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Airtable base ID (starts with \\"app\\", e.g., \\"appXXXXXXXXXXXXXX\\")"},"tableId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table ID (starts with \\"tbl\\") or table name"},"records":{"type":"json","required":true,"visibility":"user-or-llm","description":"Array of records to update, each with an `id` and a `fields` object"},"typecast":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"When true, Airtable automatically converts string values to the field type"}},"oauth":{"required":true,"provider":"airtable"},"hostedApiKey":"none"},"airtable_update_record":{"id":"airtable_update_record","name":"Airtable Update Record","description":"Update an existing record in an Airtable table by ID","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token"},"baseId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Airtable base ID (starts with \\"app\\", e.g., \\"appXXXXXXXXXXXXXX\\")"},"tableId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table ID (starts with \\"tbl\\") or table name"},"recordId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Record ID to update (starts with \\"rec\\", e.g., \\"recXXXXXXXXXXXXXX\\")"},"fields":{"type":"json","required":true,"visibility":"user-or-llm","description":"An object containing the field names and their new values"},"typecast":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"When true, Airtable automatically converts string values to the field type"}},"oauth":{"required":true,"provider":"airtable"},"hostedApiKey":"none"},"airtable_upsert_records":{"id":"airtable_upsert_records","name":"Airtable Upsert Records","description":"Update existing records or create new ones in an Airtable table, matching on the specified merge fields","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token"},"baseId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Airtable base ID (starts with \\"app\\", e.g., \\"appXXXXXXXXXXXXXX\\")"},"tableId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Table ID (starts with \\"tbl\\") or table name"},"records":{"type":"json","required":true,"visibility":"user-or-llm","description":"Array of records to upsert, each with a `fields` object"},"fieldsToMergeOn":{"type":"json","required":true,"visibility":"user-or-llm","description":"Array of field names used to match existing records (max 3). A record is updated when all merge fields match, otherwise it is created. Example: [\\"Name\\"]"},"typecast":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"When true, Airtable automatically converts string values to the field type"}},"oauth":{"required":true,"provider":"airtable"},"hostedApiKey":"none"},"airweave_search":{"id":"airweave_search","name":"Airweave Search","description":"Search your synced data collections using Airweave. Supports semantic search with hybrid, neural, or keyword retrieval strategies. Optionally generate AI-powered answers from search results.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Airweave API Key for authentication"},"collectionId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The readable ID of the collection to search"},"query":{"type":"string","required":true,"visibility":"user-or-llm","description":"The search query text"},"limit":{"type":"number","required":false,"visibility":"user-only","description":"Maximum number of results to return (default: 100)"},"retrievalStrategy":{"type":"string","required":false,"visibility":"user-or-llm","description":"Retrieval strategy: hybrid (default), neural, or keyword"},"expandQuery":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Generate query variations to improve recall"},"rerank":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Reorder results for improved relevance using LLM"},"generateAnswer":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Generate a natural-language answer to the query"}},"hostedApiKey":"none"},"algolia_add_record":{"id":"algolia_add_record","name":"Algolia Add Record","description":"Add or replace a record in an Algolia index","version":"1.0","params":{"applicationId":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Application ID"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Admin API Key"},"indexName":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the Algolia index"},"objectID":{"type":"string","required":false,"visibility":"user-or-llm","description":"Object ID for the record (auto-generated if not provided)"},"record":{"type":"json","required":true,"visibility":"user-or-llm","description":"JSON object representing the record to add"}},"hostedApiKey":"none"},"algolia_batch_operations":{"id":"algolia_batch_operations","name":"Algolia Batch Operations","description":"Perform batch add, update, partial update, or delete operations on records in an Algolia index","version":"1.0","params":{"applicationId":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Application ID"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Admin API Key"},"indexName":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the Algolia index"},"requests":{"type":"json","required":true,"visibility":"user-or-llm","description":"Array of batch operations. Each item has \\"action\\" (addObject, updateObject, partialUpdateObject, partialUpdateObjectNoCreate, deleteObject, delete, clear) and \\"body\\" (the record data; must include objectID for update/delete; use an empty object {} for the index-level delete/clear actions)"}},"hostedApiKey":"none"},"algolia_browse_records":{"id":"algolia_browse_records","name":"Algolia Browse Records","description":"Browse and iterate over all records in an Algolia index using cursor pagination","version":"1.0","params":{"applicationId":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Application ID"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Algolia API Key (must have browse ACL)"},"indexName":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the Algolia index to browse"},"query":{"type":"string","required":false,"visibility":"user-or-llm","description":"Search query to filter browsed records"},"filters":{"type":"string","required":false,"visibility":"user-or-llm","description":"Filter string to narrow down results"},"attributesToRetrieve":{"type":"string","required":false,"visibility":"user-or-llm","description":"Comma-separated list of attributes to retrieve"},"hitsPerPage":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of hits per page (default: 1000, max: 1000)"},"cursor":{"type":"string","required":false,"visibility":"user-or-llm","description":"Cursor from a previous browse response for pagination"},"aroundLatLng":{"type":"string","required":false,"visibility":"user-or-llm","description":"Coordinates for geo-search (e.g., \\"40.71,-74.01\\")"},"aroundRadius":{"type":"string","required":false,"visibility":"user-or-llm","description":"Maximum radius in meters for geo-search, or \\"all\\" for unlimited"},"insideBoundingBox":{"type":"json","required":false,"visibility":"user-or-llm","description":"Bounding box coordinates as [[lat1, lng1, lat2, lng2]] for geo-search"},"insidePolygon":{"type":"json","required":false,"visibility":"user-or-llm","description":"Polygon coordinates as [[lat1, lng1, lat2, lng2, lat3, lng3, ...]] for geo-search"}},"hostedApiKey":"none"},"algolia_clear_records":{"id":"algolia_clear_records","name":"Algolia Clear Records","description":"Clear all records from an Algolia index while keeping settings, synonyms, and rules","version":"1.0","params":{"applicationId":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Application ID"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Admin API Key (must have deleteIndex ACL)"},"indexName":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the Algolia index to clear"}},"hostedApiKey":"none"},"algolia_copy_move_index":{"id":"algolia_copy_move_index","name":"Algolia Copy/Move Index","description":"Copy or move an Algolia index to a new destination","version":"1.0","params":{"applicationId":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Application ID"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Admin API Key"},"indexName":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the source index"},"operation":{"type":"string","required":true,"visibility":"user-or-llm","description":"Operation to perform: \\"copy\\" or \\"move\\""},"destination":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the destination index"},"scope":{"type":"json","required":false,"visibility":"user-or-llm","description":"Array of scopes to copy (only for \\"copy\\" operation): [\\"settings\\", \\"synonyms\\", \\"rules\\"]. Omit to copy everything including records."}},"hostedApiKey":"none"},"algolia_delete_by_filter":{"id":"algolia_delete_by_filter","name":"Algolia Delete By Filter","description":"Delete all records matching a filter from an Algolia index","version":"1.0","params":{"applicationId":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Application ID"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Admin API Key (must have deleteIndex ACL)"},"indexName":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the Algolia index"},"filters":{"type":"string","required":false,"visibility":"user-or-llm","description":"Filter expression to match records for deletion (e.g., \\"category:outdated\\")"},"facetFilters":{"type":"json","required":false,"visibility":"user-or-llm","description":"Array of facet filters (e.g., [\\"brand:Acme\\"])"},"numericFilters":{"type":"json","required":false,"visibility":"user-or-llm","description":"Array of numeric filters (e.g., [\\"price > 100\\"])"},"tagFilters":{"type":"json","required":false,"visibility":"user-or-llm","description":"Array of tag filters using the _tags attribute (e.g., [\\"published\\"])"},"aroundLatLng":{"type":"string","required":false,"visibility":"user-or-llm","description":"Coordinates for geo-search filter (e.g., \\"40.71,-74.01\\")"},"aroundRadius":{"type":"string","required":false,"visibility":"user-or-llm","description":"Maximum radius in meters for geo-search, or \\"all\\" for unlimited"},"insideBoundingBox":{"type":"json","required":false,"visibility":"user-or-llm","description":"Bounding box coordinates as [[lat1, lng1, lat2, lng2]] for geo-search filter"},"insidePolygon":{"type":"json","required":false,"visibility":"user-or-llm","description":"Polygon coordinates as [[lat1, lng1, lat2, lng2, lat3, lng3, ...]] for geo-search filter"}},"hostedApiKey":"none"},"algolia_delete_index":{"id":"algolia_delete_index","name":"Algolia Delete Index","description":"Delete an entire Algolia index and all its records","version":"1.0","params":{"applicationId":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Application ID"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Admin API Key (must have deleteIndex ACL)"},"indexName":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the Algolia index to delete"}},"hostedApiKey":"none"},"algolia_delete_record":{"id":"algolia_delete_record","name":"Algolia Delete Record","description":"Delete a record by objectID from an Algolia index","version":"1.0","params":{"applicationId":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Application ID"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Admin API Key"},"indexName":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the Algolia index"},"objectID":{"type":"string","required":true,"visibility":"user-or-llm","description":"The objectID of the record to delete"}},"hostedApiKey":"none"},"algolia_get_record":{"id":"algolia_get_record","name":"Algolia Get Record","description":"Get a record by objectID from an Algolia index","version":"1.0","params":{"applicationId":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Application ID"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Algolia API Key"},"indexName":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the Algolia index"},"objectID":{"type":"string","required":true,"visibility":"user-or-llm","description":"The objectID of the record to retrieve"},"attributesToRetrieve":{"type":"string","required":false,"visibility":"user-or-llm","description":"Comma-separated list of attributes to retrieve"}},"hostedApiKey":"none"},"algolia_get_records":{"id":"algolia_get_records","name":"Algolia Get Records","description":"Retrieve multiple records by objectID from one or more Algolia indices","version":"1.0","params":{"applicationId":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Application ID"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Algolia API Key"},"indexName":{"type":"string","required":true,"visibility":"user-or-llm","description":"Default index name for all requests"},"requests":{"type":"json","required":true,"visibility":"user-or-llm","description":"Array of objects specifying records to retrieve. Each must have \\"objectID\\" and optionally \\"indexName\\" and \\"attributesToRetrieve\\"."}},"hostedApiKey":"none"},"algolia_get_settings":{"id":"algolia_get_settings","name":"Algolia Get Settings","description":"Retrieve the settings of an Algolia index","version":"1.0","params":{"applicationId":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Application ID"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Algolia API Key"},"indexName":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the Algolia index"}},"hostedApiKey":"none"},"algolia_get_task_status":{"id":"algolia_get_task_status","name":"Algolia Get Task Status","description":"Check whether an Algolia indexing task has finished publishing","version":"1.0","params":{"applicationId":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Application ID"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Algolia API Key"},"indexName":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the Algolia index the task ran against"},"taskID":{"type":"number","required":true,"visibility":"user-or-llm","description":"The taskID returned by a previous write operation"}},"hostedApiKey":"none"},"algolia_list_indices":{"id":"algolia_list_indices","name":"Algolia List Indices","description":"List all indices in an Algolia application","version":"1.0","params":{"applicationId":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Application ID"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Algolia API Key"},"page":{"type":"number","required":false,"visibility":"user-or-llm","description":"Page number for paginating indices (default: not paginated)"},"hitsPerPage":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of indices per page (default: 100)"}},"hostedApiKey":"none"},"algolia_partial_update_record":{"id":"algolia_partial_update_record","name":"Algolia Partial Update Record","description":"Partially update a record in an Algolia index without replacing it entirely","version":"1.0","params":{"applicationId":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Application ID"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Admin API Key"},"indexName":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the Algolia index"},"objectID":{"type":"string","required":true,"visibility":"user-or-llm","description":"The objectID of the record to update"},"attributes":{"type":"json","required":true,"visibility":"user-or-llm","description":"JSON object with attributes to update. Supports built-in operations like {\\"stock\\": {\\"_operation\\": \\"Decrement\\", \\"value\\": 1}}"},"createIfNotExists":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Whether to create the record if it does not exist (default: true)"}},"hostedApiKey":"none"},"algolia_search":{"id":"algolia_search","name":"Algolia Search","description":"Search an Algolia index","version":"1.0","params":{"applicationId":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Application ID"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Algolia API Key"},"indexName":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the Algolia index to search"},"query":{"type":"string","required":true,"visibility":"user-or-llm","description":"Search query text"},"hitsPerPage":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of hits per page (default: 20)"},"page":{"type":"number","required":false,"visibility":"user-or-llm","description":"Page number to retrieve (default: 0)"},"filters":{"type":"string","required":false,"visibility":"user-or-llm","description":"Filter string (e.g., \\"category:electronics AND price < 100\\")"},"attributesToRetrieve":{"type":"string","required":false,"visibility":"user-or-llm","description":"Comma-separated list of attributes to retrieve"},"facets":{"type":"string","required":false,"visibility":"user-or-llm","description":"Comma-separated list of facet attribute names to retrieve counts for (use \\"*\\" for all)"},"getRankingInfo":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Whether to include detailed ranking information in each hit"},"aroundLatLng":{"type":"string","required":false,"visibility":"user-or-llm","description":"Coordinates for geo-search (e.g., \\"40.71,-74.01\\")"},"aroundRadius":{"type":"string","required":false,"visibility":"user-or-llm","description":"Maximum radius in meters for geo-search, or \\"all\\" for unlimited"},"insideBoundingBox":{"type":"json","required":false,"visibility":"user-or-llm","description":"Bounding box coordinates as [[lat1, lng1, lat2, lng2]] for geo-search"},"insidePolygon":{"type":"json","required":false,"visibility":"user-or-llm","description":"Polygon coordinates as [[lat1, lng1, lat2, lng2, lat3, lng3, ...]] for geo-search"}},"hostedApiKey":"none"},"algolia_update_settings":{"id":"algolia_update_settings","name":"Algolia Update Settings","description":"Update the settings of an Algolia index","version":"1.0","params":{"applicationId":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Application ID"},"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Algolia Admin API Key (must have editSettings ACL)"},"indexName":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the Algolia index"},"settings":{"type":"json","required":true,"visibility":"user-or-llm","description":"JSON object with settings to update (e.g., {\\"searchableAttributes\\": [\\"name\\", \\"description\\"], \\"customRanking\\": [\\"desc(popularity)\\"]})"},"forwardToReplicas":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Whether to apply changes to replica indices (default: false)"}},"hostedApiKey":"none"},"amplitude_event_segmentation":{"id":"amplitude_event_segmentation","name":"Amplitude Event Segmentation","description":"Query event analytics data with segmentation. Get event counts, uniques, averages, and more.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude API Key"},"secretKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude Secret Key"},"eventType":{"type":"string","required":true,"visibility":"user-or-llm","description":"Event type name to analyze"},"start":{"type":"string","required":true,"visibility":"user-or-llm","description":"Start date in YYYYMMDD format"},"end":{"type":"string","required":true,"visibility":"user-or-llm","description":"End date in YYYYMMDD format"},"metric":{"type":"string","required":false,"visibility":"user-or-llm","description":"Metric type: uniques, totals, pct_dau, average, histogram, sums, value_avg, or formula (default: uniques)"},"interval":{"type":"string","required":false,"visibility":"user-or-llm","description":"Time interval: 1 (daily), 7 (weekly), or 30 (monthly)"},"groupBy":{"type":"string","required":false,"visibility":"user-or-llm","description":"Property name to group by (prefix custom user properties with \\"gp:\\")"},"groupBy2":{"type":"string","required":false,"visibility":"user-or-llm","description":"Second property name to group by (prefix custom user properties with \\"gp:\\")"},"limit":{"type":"string","required":false,"visibility":"user-or-llm","description":"Maximum number of group-by values (max 1000)"},"filters":{"type":"string","required":false,"visibility":"user-or-llm","description":"JSON array of filter objects applied to the event, e.g. [{\\"subprop_type\\":\\"event\\",\\"subprop_key\\":\\"city\\",\\"subprop_op\\":\\"is\\",\\"subprop_value\\":[\\"San Francisco\\"]}]"},"formula":{"type":"string","required":false,"visibility":"user-or-llm","description":"Required when metric is \\"formula\\", e.g. \\"UNIQUES(A)/UNIQUES(B)\\""},"segment":{"type":"string","required":false,"visibility":"user-or-llm","description":"JSON segment definition(s) applied to the query"},"dataResidency":{"type":"string","required":false,"visibility":"user-or-llm","description":"Data residency region: \\"us\\" (default) or \\"eu\\""}},"hostedApiKey":"none"},"amplitude_funnels":{"id":"amplitude_funnels","name":"Amplitude Funnels","description":"Analyze conversion rates and drop-off between a sequence of events.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude API Key"},"secretKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude Secret Key"},"events":{"type":"string","required":true,"visibility":"user-or-llm","description":"JSON array of event objects, one per funnel step in order, e.g. [{\\"event_type\\":\\"signup\\"},{\\"event_type\\":\\"purchase\\"}]"},"start":{"type":"string","required":true,"visibility":"user-or-llm","description":"Start date in YYYYMMDD format"},"end":{"type":"string","required":true,"visibility":"user-or-llm","description":"End date in YYYYMMDD format"},"mode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Funnel ordering: \\"ordered\\", \\"unordered\\", or \\"sequential\\" (default: ordered)"},"userType":{"type":"string","required":false,"visibility":"user-or-llm","description":"User type: \\"new\\" or \\"active\\" (default: active)"},"interval":{"type":"string","required":false,"visibility":"user-or-llm","description":"Time interval: -300000 (real-time), -3600000 (hourly), 1 (daily), 7 (weekly), or 30 (monthly)"},"conversionWindowSeconds":{"type":"string","required":false,"visibility":"user-or-llm","description":"Conversion window in seconds (default: 2592000, i.e. 30 days)"},"groupBy":{"type":"string","required":false,"visibility":"user-or-llm","description":"Property to group by (limit: one; prefix custom properties with \\"gp:\\")"},"limit":{"type":"string","required":false,"visibility":"user-or-llm","description":"Maximum number of group-by values (default: 100, max: 1000)"},"segment":{"type":"string","required":false,"visibility":"user-or-llm","description":"JSON segment definition(s) applied to the query"},"dataResidency":{"type":"string","required":false,"visibility":"user-or-llm","description":"Data residency region: \\"us\\" (default) or \\"eu\\""}},"hostedApiKey":"none"},"amplitude_get_active_users":{"id":"amplitude_get_active_users","name":"Amplitude Get Active Users","description":"Get active or new user counts over a date range from the Dashboard REST API.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude API Key"},"secretKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude Secret Key"},"start":{"type":"string","required":true,"visibility":"user-or-llm","description":"Start date in YYYYMMDD format"},"end":{"type":"string","required":true,"visibility":"user-or-llm","description":"End date in YYYYMMDD format"},"metric":{"type":"string","required":false,"visibility":"user-or-llm","description":"Metric type: \\"active\\" or \\"new\\" (default: active)"},"interval":{"type":"string","required":false,"visibility":"user-or-llm","description":"Time interval: 1 (daily), 7 (weekly), or 30 (monthly)"},"groupBy":{"type":"string","required":false,"visibility":"user-or-llm","description":"Property name to group by"},"segment":{"type":"string","required":false,"visibility":"user-or-llm","description":"JSON segment definition(s) applied to the query"},"dataResidency":{"type":"string","required":false,"visibility":"user-or-llm","description":"Data residency region: \\"us\\" (default) or \\"eu\\""}},"hostedApiKey":"none"},"amplitude_get_revenue":{"id":"amplitude_get_revenue","name":"Amplitude Get Revenue","description":"Get revenue LTV data including ARPU, ARPPU, total revenue, and paying user counts.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude API Key"},"secretKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude Secret Key"},"start":{"type":"string","required":true,"visibility":"user-or-llm","description":"Start date in YYYYMMDD format"},"end":{"type":"string","required":true,"visibility":"user-or-llm","description":"End date in YYYYMMDD format"},"metric":{"type":"string","required":false,"visibility":"user-or-llm","description":"Metric: 0 (ARPU), 1 (ARPPU), 2 (Total Revenue), 3 (Paying Users)"},"interval":{"type":"string","required":false,"visibility":"user-or-llm","description":"Time interval: 1 (daily), 7 (weekly), or 30 (monthly)"},"groupBy":{"type":"string","required":false,"visibility":"user-or-llm","description":"Property name to group by (limit: one)"},"segment":{"type":"string","required":false,"visibility":"user-or-llm","description":"JSON segment definition(s) applied to the query"},"dataResidency":{"type":"string","required":false,"visibility":"user-or-llm","description":"Data residency region: \\"us\\" (default) or \\"eu\\""}},"hostedApiKey":"none"},"amplitude_group_identify":{"id":"amplitude_group_identify","name":"Amplitude Group Identify","description":"Set group-level properties in Amplitude. Supports $set, $setOnce, $add, $append, $unset operations.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude API Key"},"groupType":{"type":"string","required":true,"visibility":"user-or-llm","description":"Group classification (e.g., \\"company\\", \\"org_id\\")"},"groupValue":{"type":"string","required":true,"visibility":"user-or-llm","description":"Specific group identifier (e.g., \\"Acme Corp\\")"},"groupProperties":{"type":"string","required":true,"visibility":"user-or-llm","description":"JSON object of group properties. Use operations like $set, $setOnce, $add, $append, $unset."},"dataResidency":{"type":"string","required":false,"visibility":"user-or-llm","description":"Data residency region: \\"us\\" (default) or \\"eu\\""}},"hostedApiKey":"none"},"amplitude_identify_user":{"id":"amplitude_identify_user","name":"Amplitude Identify User","description":"Set user properties in Amplitude using the Identify API. Supports $set, $setOnce, $add, $append, $unset operations.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude API Key"},"userId":{"type":"string","required":false,"visibility":"user-or-llm","description":"User ID (required if no device_id)"},"deviceId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Device ID (required if no user_id)"},"userProperties":{"type":"string","required":true,"visibility":"user-or-llm","description":"JSON object of user properties. Use operations like $set, $setOnce, $add, $append, $unset."},"dataResidency":{"type":"string","required":false,"visibility":"user-or-llm","description":"Data residency region: \\"us\\" (default) or \\"eu\\""}},"hostedApiKey":"none"},"amplitude_list_events":{"id":"amplitude_list_events","name":"Amplitude List Events","description":"List all event types in the Amplitude project with their weekly totals and unique counts.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude API Key"},"secretKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude Secret Key"},"dataResidency":{"type":"string","required":false,"visibility":"user-or-llm","description":"Data residency region: \\"us\\" (default) or \\"eu\\""}},"hostedApiKey":"none"},"amplitude_realtime_active_users":{"id":"amplitude_realtime_active_users","name":"Amplitude Real-time Active Users","description":"Get real-time active user counts at 5-minute granularity for the last 2 days.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude API Key"},"secretKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude Secret Key"},"dataResidency":{"type":"string","required":false,"visibility":"user-or-llm","description":"Data residency region: \\"us\\" (default) or \\"eu\\""}},"hostedApiKey":"none"},"amplitude_retention":{"id":"amplitude_retention","name":"Amplitude Retention","description":"Measure how many users return to perform an action after a starting action.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude API Key"},"secretKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude Secret Key"},"startEvent":{"type":"string","required":true,"visibility":"user-or-llm","description":"JSON starting event object, e.g. {\\"event_type\\":\\"_new\\"} or {\\"event_type\\":\\"_active\\"}"},"returnEvent":{"type":"string","required":true,"visibility":"user-or-llm","description":"JSON returning event object, e.g. {\\"event_type\\":\\"_all\\"} or {\\"event_type\\":\\"_active\\"}"},"start":{"type":"string","required":true,"visibility":"user-or-llm","description":"Start date in YYYYMMDD format"},"end":{"type":"string","required":true,"visibility":"user-or-llm","description":"End date in YYYYMMDD format"},"retentionMode":{"type":"string","required":false,"visibility":"user-or-llm","description":"Retention type: \\"bracket\\", \\"rolling\\", or \\"n-day\\" (default: n-day)"},"retentionBrackets":{"type":"string","required":false,"visibility":"user-or-llm","description":"Required when Retention Mode is \\"bracket\\". Day ranges, e.g. [[0,4]]"},"interval":{"type":"string","required":false,"visibility":"user-or-llm","description":"Time interval: 1 (daily), 7 (weekly), or 30 (monthly)"},"groupBy":{"type":"string","required":false,"visibility":"user-or-llm","description":"Property to group by (limit: one; prefix custom properties with \\"gp:\\")"},"segment":{"type":"string","required":false,"visibility":"user-or-llm","description":"JSON segment definition(s) applied to the query"},"dataResidency":{"type":"string","required":false,"visibility":"user-or-llm","description":"Data residency region: \\"us\\" (default) or \\"eu\\""}},"hostedApiKey":"none"},"amplitude_send_event":{"id":"amplitude_send_event","name":"Amplitude Send Event","description":"Track an event in Amplitude using the HTTP V2 API.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude API Key"},"userId":{"type":"string","required":false,"visibility":"user-or-llm","description":"User ID (required if no device_id)"},"deviceId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Device ID (required if no user_id)"},"eventType":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the event (e.g., \\"page_view\\", \\"purchase\\")"},"eventProperties":{"type":"string","required":false,"visibility":"user-or-llm","description":"JSON object of custom event properties"},"userProperties":{"type":"string","required":false,"visibility":"user-or-llm","description":"JSON object of user properties to set (supports $set, $setOnce, $add, $append, $unset)"},"time":{"type":"string","required":false,"visibility":"user-or-llm","description":"Event timestamp in milliseconds since epoch"},"sessionId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Session start time in milliseconds since epoch"},"insertId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Unique ID for deduplication (within 7-day window)"},"appVersion":{"type":"string","required":false,"visibility":"user-or-llm","description":"Application version string"},"platform":{"type":"string","required":false,"visibility":"user-or-llm","description":"Platform (e.g., \\"Web\\", \\"iOS\\", \\"Android\\")"},"country":{"type":"string","required":false,"visibility":"user-or-llm","description":"Two-letter country code"},"language":{"type":"string","required":false,"visibility":"user-or-llm","description":"Language code (e.g., \\"en\\")"},"ip":{"type":"string","required":false,"visibility":"user-or-llm","description":"IP address for geo-location"},"price":{"type":"string","required":false,"visibility":"user-or-llm","description":"Price of the item purchased"},"quantity":{"type":"string","required":false,"visibility":"user-or-llm","description":"Quantity of items purchased"},"revenue":{"type":"string","required":false,"visibility":"user-or-llm","description":"Revenue amount"},"productId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Product identifier"},"revenueType":{"type":"string","required":false,"visibility":"user-or-llm","description":"Revenue type (e.g., \\"purchase\\", \\"refund\\")"},"dataResidency":{"type":"string","required":false,"visibility":"user-or-llm","description":"Data residency region: \\"us\\" (default) or \\"eu\\""}},"hostedApiKey":"none"},"amplitude_user_activity":{"id":"amplitude_user_activity","name":"Amplitude User Activity","description":"Get the event stream for a specific user by their Amplitude ID.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude API Key"},"secretKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude Secret Key"},"amplitudeId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Amplitude internal user ID"},"offset":{"type":"string","required":false,"visibility":"user-or-llm","description":"Offset for pagination (default 0)"},"limit":{"type":"string","required":false,"visibility":"user-or-llm","description":"Maximum number of events to return (default 1000, max 1000)"},"direction":{"type":"string","required":false,"visibility":"user-or-llm","description":"Sort direction: \\"latest\\" or \\"earliest\\" (default: latest)"},"dataResidency":{"type":"string","required":false,"visibility":"user-or-llm","description":"Data residency region: \\"us\\" (default) or \\"eu\\""}},"hostedApiKey":"none"},"amplitude_user_profile":{"id":"amplitude_user_profile","name":"Amplitude User Profile","description":"Get a user profile including properties, cohort memberships, and computed properties. Not available for EU data-residency projects.","version":"1.0.0","params":{"secretKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude Secret Key"},"userId":{"type":"string","required":false,"visibility":"user-or-llm","description":"External user ID (required if no device_id)"},"deviceId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Device ID (required if no user_id)"},"getAmpProps":{"type":"string","required":false,"visibility":"user-or-llm","description":"Include Amplitude user properties (true/false, default: false)"},"getCohortIds":{"type":"string","required":false,"visibility":"user-or-llm","description":"Include cohort IDs the user belongs to (true/false, default: false)"},"getComputations":{"type":"string","required":false,"visibility":"user-or-llm","description":"Include computed user properties (true/false, default: false)"}},"hostedApiKey":"none"},"amplitude_user_search":{"id":"amplitude_user_search","name":"Amplitude User Search","description":"Search for a user by User ID, Device ID, or Amplitude ID using the Dashboard REST API.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude API Key"},"secretKey":{"type":"string","required":true,"visibility":"user-only","description":"Amplitude Secret Key"},"user":{"type":"string","required":true,"visibility":"user-or-llm","description":"User ID, Device ID, or Amplitude ID to search for"},"dataResidency":{"type":"string","required":false,"visibility":"user-or-llm","description":"Data residency region: \\"us\\" (default) or \\"eu\\""}},"hostedApiKey":"none"},"apify_get_dataset_items":{"id":"apify_get_dataset_items","name":"APIFY Get Dataset Items","description":"Retrieve items stored in an APIFY dataset","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"APIFY API token from console.apify.com/account#/integrations"},"datasetId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Dataset ID to read items from. Example: \\"9RnD3Pql2vGZkc5H5\\""},"itemLimit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Max items to return (1-250000). Default: all items. Example: 500"},"offset":{"type":"number","required":false,"visibility":"user-or-llm","description":"Number of items to skip at the start. Default: 0"},"fields":{"type":"string","required":false,"visibility":"user-or-llm","description":"Comma-separated list of fields to include. Example: \\"title,url,price\\""}},"hostedApiKey":"none"},"apify_get_run":{"id":"apify_get_run","name":"APIFY Get Run","description":"Get the status and details of an APIFY actor run","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"APIFY API token from console.apify.com/account#/integrations"},"runId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Actor run ID to fetch. Example: \\"HG7ML7M8z78YcAPEB\\""}},"hostedApiKey":"none"},"apify_run_actor_async":{"id":"apify_run_actor_async","name":"APIFY Run Actor (Async)","description":"Run an APIFY actor asynchronously with polling for long-running tasks","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"APIFY API token from console.apify.com/account#/integrations"},"actorId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Actor ID or username/actor-name. Examples: \\"apify/web-scraper\\", \\"janedoe/my-actor\\", \\"moJRLRc85AitArpNN\\""},"input":{"type":"string","required":false,"visibility":"user-or-llm","description":"Actor input as JSON string. Example: {\\"startUrls\\": [{\\"url\\": \\"https://example.com\\"}], \\"maxPages\\": 10}"},"waitForFinish":{"type":"number","required":false,"visibility":"user-or-llm","description":"Initial wait time in seconds (0-60) before polling starts. Example: 30"},"itemLimit":{"type":"number","required":false,"default":100,"visibility":"user-or-llm","description":"Max dataset items to fetch (1-250000). Default: 100. Example: 500"},"memory":{"type":"number","required":false,"visibility":"user-or-llm","description":"Memory in megabytes allocated for the actor run (128-32768). Example: 1024 for 1GB, 2048 for 2GB"},"timeout":{"type":"number","required":false,"visibility":"user-or-llm","description":"Timeout in seconds for the actor run. Example: 300 for 5 minutes, 3600 for 1 hour"},"build":{"type":"string","required":false,"visibility":"user-or-llm","description":"Actor build to run. Examples: \\"latest\\", \\"beta\\", \\"1.2.3\\", \\"build-tag-name\\""}},"hostedApiKey":"none"},"apify_run_actor_sync":{"id":"apify_run_actor_sync","name":"APIFY Run Actor (Sync)","description":"Run an APIFY actor synchronously and get results (max 5 minutes)","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"APIFY API token from console.apify.com/account#/integrations"},"actorId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Actor ID or username/actor-name. Examples: \\"apify/web-scraper\\", \\"janedoe/my-actor\\", \\"moJRLRc85AitArpNN\\""},"input":{"type":"string","required":false,"visibility":"user-or-llm","description":"Actor input as JSON string. Example: {\\"startUrls\\": [{\\"url\\": \\"https://example.com\\"}], \\"maxPages\\": 10}"},"memory":{"type":"number","required":false,"visibility":"user-or-llm","description":"Memory in megabytes allocated for the actor run (128-32768). Example: 1024 for 1GB, 2048 for 2GB"},"timeout":{"type":"number","required":false,"visibility":"user-or-llm","description":"Timeout in seconds for the actor run. Example: 300 for 5 minutes, 3600 for 1 hour"},"build":{"type":"string","required":false,"visibility":"user-or-llm","description":"Actor build to run. Examples: \\"latest\\", \\"beta\\", \\"1.2.3\\", \\"build-tag-name\\""}},"hostedApiKey":"none"},"apify_run_task":{"id":"apify_run_task","name":"APIFY Run Task","description":"Run a saved APIFY actor task synchronously and get dataset items (max 5 minutes)","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"APIFY API token from console.apify.com/account#/integrations"},"taskId":{"type":"string","required":true,"visibility":"user-or-llm","description":"Task ID or username/task-name. Examples: \\"janedoe/my-task\\", \\"moJRLRc85AitArpNN\\""},"input":{"type":"string","required":false,"visibility":"user-or-llm","description":"JSON string that overrides the task\'s saved input. Example: {\\"startUrls\\": [{\\"url\\": \\"https://example.com\\"}]}"},"itemLimit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Max dataset items to return (1-250000). Example: 500"},"memory":{"type":"number","required":false,"visibility":"user-or-llm","description":"Memory in megabytes allocated for the run (128-32768). Example: 1024 for 1GB"},"timeout":{"type":"number","required":false,"visibility":"user-or-llm","description":"Timeout in seconds for the run. Example: 300 for 5 minutes"},"build":{"type":"string","required":false,"visibility":"user-or-llm","description":"Actor build to run. Examples: \\"latest\\", \\"beta\\", \\"1.2.3\\""}},"hostedApiKey":"none"},"apollo_account_bulk_create":{"id":"apollo_account_bulk_create","name":"Apollo Bulk Create Accounts","description":"Create up to 100 accounts at once in your Apollo database. Set run_dedupe=true to deduplicate by domain, organization_id, and name. Master key required.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key (master key required)"},"accounts":{"type":"array","required":true,"visibility":"user-or-llm","description":"Array of accounts to create (max 100). Each account should include a name, and may optionally include domain, phone, phone_status_cd, raw_address, owner_id, linkedin_url, facebook_url, twitter_url, salesforce_id, and hubspot_id."},"append_label_names":{"type":"array","required":false,"visibility":"user-only","description":"Array of label names to add to ALL accounts in this request"},"run_dedupe":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"When true, performs aggressive deduplication by domain, organization_id, and name (defaults to false)"}},"hostedApiKey":"none"},"apollo_account_bulk_update":{"id":"apollo_account_bulk_update","name":"Apollo Bulk Update Accounts","description":"Update up to 1000 existing accounts at once in your Apollo database (higher limit than contacts!). Each account must include an id field. Master key required.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key (master key required)"},"account_ids":{"type":"array","required":false,"visibility":"user-or-llm","description":"Array of account IDs to update with the same values (max 1000). Use with name/owner_id for uniform updates. Use either this OR account_attributes."},"name":{"type":"string","required":false,"visibility":"user-or-llm","description":"When using account_ids, apply this name to all accounts"},"owner_id":{"type":"string","required":false,"visibility":"user-or-llm","description":"When using account_ids, apply this owner to all accounts"},"account_stage_id":{"type":"string","required":false,"visibility":"user-or-llm","description":"When using account_ids, apply this account stage to all accounts"},"account_attributes":{"type":"json","required":false,"visibility":"user-or-llm","description":"Array of account objects with individual updates (each must include id). Example: [{\\"id\\": \\"acc1\\", \\"name\\": \\"Acme\\", \\"owner_id\\": \\"u1\\", \\"account_stage_id\\": \\"s1\\", \\"typed_custom_fields\\": {\\"field_id\\": \\"value\\"}}]"},"async":{"type":"boolean","required":false,"visibility":"user-only","description":"When true, processes the update asynchronously. Only supported when using account_ids; returns 422 if used with account_attributes."}},"hostedApiKey":"none"},"apollo_account_create":{"id":"apollo_account_create","name":"Apollo Create Account","description":"Create a new account (company) in your Apollo database","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key (master key required)"},"name":{"type":"string","required":true,"visibility":"user-or-llm","description":"Company name (e.g., \\"Acme Corporation\\")"},"domain":{"type":"string","required":false,"visibility":"user-or-llm","description":"Company domain without www. prefix (e.g., \\"acme.com\\")"},"phone":{"type":"string","required":false,"visibility":"user-or-llm","description":"Primary phone number for the account"},"owner_id":{"type":"string","required":false,"visibility":"user-only","description":"Apollo user ID of the account owner"},"account_stage_id":{"type":"string","required":false,"visibility":"user-only","description":"Apollo ID for the account stage to assign this account to"},"raw_address":{"type":"string","required":false,"visibility":"user-or-llm","description":"Corporate location (e.g., \\"San Francisco, CA, USA\\")"},"typed_custom_fields":{"type":"json","required":false,"visibility":"user-only","description":"Custom field values as { custom_field_id: value } map"}},"hostedApiKey":"none"},"apollo_account_search":{"id":"apollo_account_search","name":"Apollo Search Accounts","description":"Search your team\'s accounts in Apollo. Display limit: 50,000 records (100 records per page, 500 pages max). Use filters to narrow results. Master key required.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key (master key required)"},"q_organization_name":{"type":"string","required":false,"visibility":"user-or-llm","description":"Filter accounts by organization name (partial-match search)"},"account_stage_ids":{"type":"array","required":false,"visibility":"user-only","description":"Filter by account stage IDs"},"account_label_ids":{"type":"array","required":false,"visibility":"user-only","description":"Filter by account label IDs"},"sort_by_field":{"type":"string","required":false,"visibility":"user-or-llm","description":"Sort field: \\"account_last_activity_date\\", \\"account_created_at\\", or \\"account_updated_at\\""},"sort_ascending":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Sort ascending when true. Defaults to descending."},"page":{"type":"number","required":false,"visibility":"user-or-llm","description":"Page number for pagination (e.g., 1, 2, 3)"},"per_page":{"type":"number","required":false,"visibility":"user-or-llm","description":"Results per page, max 100 (e.g., 25, 50, 100)"}},"hostedApiKey":"none"},"apollo_account_update":{"id":"apollo_account_update","name":"Apollo Update Account","description":"Update an existing account in your Apollo database","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key"},"account_id":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the account to update (e.g., \\"acc_abc123\\")"},"name":{"type":"string","required":false,"visibility":"user-or-llm","description":"Company name (e.g., \\"Acme Corporation\\")"},"domain":{"type":"string","required":false,"visibility":"user-or-llm","description":"Company domain (e.g., \\"acme.com\\")"},"phone":{"type":"string","required":false,"visibility":"user-or-llm","description":"Company phone number"},"owner_id":{"type":"string","required":false,"visibility":"user-only","description":"Apollo user ID of the account owner"},"account_stage_id":{"type":"string","required":false,"visibility":"user-only","description":"Apollo ID for the account stage to assign this account to"},"raw_address":{"type":"string","required":false,"visibility":"user-or-llm","description":"Corporate location (e.g., \\"San Francisco, CA, USA\\")"},"typed_custom_fields":{"type":"json","required":false,"visibility":"user-only","description":"Custom field values as { custom_field_id: value } map"}},"hostedApiKey":"none"},"apollo_contact_bulk_create":{"id":"apollo_contact_bulk_create","name":"Apollo Bulk Create Contacts","description":"Create up to 100 contacts at once in your Apollo database. Supports deduplication to prevent creating duplicate contacts. Master key required.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key (master key required)"},"contacts":{"type":"array","required":true,"visibility":"user-or-llm","description":"Array of contacts to create (max 100). Each contact may include first_name, last_name, email, title, organization_name, account_id, owner_id, contact_stage_id, linkedin_url, phone (single string) or phone_numbers (array of {raw_number, position}), contact_emails, typed_custom_fields, and CRM IDs (salesforce_contact_id, hubspot_id, team_id) for cross-system matching"},"append_label_names":{"type":"array","required":false,"visibility":"user-or-llm","description":"Label names to add to all contacts in this request (e.g., [\\"Hot Lead\\"])"},"run_dedupe":{"type":"boolean","required":false,"visibility":"user-only","description":"Enable deduplication to prevent creating duplicate contacts. When true, existing contacts are returned without modification"}},"hostedApiKey":"none"},"apollo_contact_bulk_update":{"id":"apollo_contact_bulk_update","name":"Apollo Bulk Update Contacts","description":"Update up to 100 existing contacts at once in your Apollo database. Each contact must include an id field. Master key required.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key (master key required)"},"contact_ids":{"type":"array","required":false,"visibility":"user-or-llm","description":"Array of contact IDs to update. Must be paired with an object-form contact_attributes specifying the fields to apply uniformly to all listed contacts."},"contact_attributes":{"type":"json","required":false,"visibility":"user-or-llm","description":"Required. Either an array of per-contact updates (each with id) — used standalone — or a single object of attributes to apply to all contact_ids. Supported fields: owner_id, email, organization_name, title, first_name, last_name, account_id, present_raw_address, linkedin_url, typed_custom_fields"},"async":{"type":"boolean","required":false,"visibility":"user-only","description":"Force asynchronous processing. Automatically enabled for >100 contacts"}},"hostedApiKey":"none"},"apollo_contact_create":{"id":"apollo_contact_create","name":"Apollo Create Contact","description":"Create a new contact in your Apollo database","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key"},"first_name":{"type":"string","required":true,"visibility":"user-or-llm","description":"First name of the contact"},"last_name":{"type":"string","required":true,"visibility":"user-or-llm","description":"Last name of the contact"},"email":{"type":"string","required":false,"visibility":"user-or-llm","description":"Email address of the contact"},"title":{"type":"string","required":false,"visibility":"user-or-llm","description":"Job title (e.g., \\"VP of Sales\\", \\"Software Engineer\\")"},"account_id":{"type":"string","required":false,"visibility":"user-or-llm","description":"Apollo account ID to associate with (e.g., \\"acc_abc123\\")"},"owner_id":{"type":"string","required":false,"visibility":"user-only","description":"User ID of the contact owner (accepted by Apollo but not officially documented for POST /contacts)"},"organization_name":{"type":"string","required":false,"visibility":"user-or-llm","description":"Name of the contact\'s employer (e.g., \\"Apollo\\")"},"website_url":{"type":"string","required":false,"visibility":"user-or-llm","description":"Corporate website URL (e.g., \\"https://www.apollo.io/\\")"},"label_names":{"type":"array","required":false,"visibility":"user-or-llm","description":"Lists/labels to add the contact to (e.g., [\\"Prospects\\"])"},"contact_stage_id":{"type":"string","required":false,"visibility":"user-or-llm","description":"Apollo ID for the contact stage"},"present_raw_address":{"type":"string","required":false,"visibility":"user-or-llm","description":"Personal location for the contact (e.g., \\"Atlanta, United States\\")"},"direct_phone":{"type":"string","required":false,"visibility":"user-or-llm","description":"Primary phone number"},"corporate_phone":{"type":"string","required":false,"visibility":"user-or-llm","description":"Work/office phone number"},"mobile_phone":{"type":"string","required":false,"visibility":"user-or-llm","description":"Mobile phone number"},"home_phone":{"type":"string","required":false,"visibility":"user-or-llm","description":"Home phone number"},"other_phone":{"type":"string","required":false,"visibility":"user-or-llm","description":"Alternative phone number"},"typed_custom_fields":{"type":"json","required":false,"visibility":"user-or-llm","description":"Custom field values keyed by custom field ID"},"run_dedupe":{"type":"boolean","required":false,"visibility":"user-only","description":"When true, Apollo deduplicates against existing contacts"}},"hostedApiKey":"none"},"apollo_contact_search":{"id":"apollo_contact_search","name":"Apollo Search Contacts","description":"Search your team\'s contacts in Apollo","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key"},"q_keywords":{"type":"string","required":false,"visibility":"user-or-llm","description":"Keywords to search for"},"contact_stage_ids":{"type":"array","required":false,"visibility":"user-only","description":"Filter by contact stage IDs"},"contact_label_ids":{"type":"array","required":false,"visibility":"user-only","description":"Filter by Apollo label IDs (lists)"},"sort_by_field":{"type":"string","required":false,"visibility":"user-only","description":"Sort field: contact_last_activity_date, contact_email_last_opened_at, contact_email_last_clicked_at, contact_created_at, or contact_updated_at"},"sort_ascending":{"type":"boolean","required":false,"visibility":"user-only","description":"When true, sort ascending. Must be used together with sort_by_field"},"page":{"type":"number","required":false,"visibility":"user-or-llm","description":"Page number for pagination (e.g., 1, 2, 3)"},"per_page":{"type":"number","required":false,"visibility":"user-or-llm","description":"Results per page, max 100 (e.g., 25, 50, 100)"}},"hostedApiKey":"none"},"apollo_contact_update":{"id":"apollo_contact_update","name":"Apollo Update Contact","description":"Update an existing contact in your Apollo database","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key"},"contact_id":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the contact to update (e.g., \\"con_abc123\\")"},"first_name":{"type":"string","required":false,"visibility":"user-or-llm","description":"First name of the contact"},"last_name":{"type":"string","required":false,"visibility":"user-or-llm","description":"Last name of the contact"},"email":{"type":"string","required":false,"visibility":"user-or-llm","description":"Email address"},"title":{"type":"string","required":false,"visibility":"user-or-llm","description":"Job title (e.g., \\"VP of Sales\\", \\"Software Engineer\\")"},"account_id":{"type":"string","required":false,"visibility":"user-or-llm","description":"Apollo account ID (e.g., \\"acc_abc123\\")"},"owner_id":{"type":"string","required":false,"visibility":"user-only","description":"User ID of the contact owner (accepted by Apollo but not officially documented for PATCH /contacts/{id})"},"organization_name":{"type":"string","required":false,"visibility":"user-or-llm","description":"Name of the contact\'s employer (e.g., \\"Apollo\\")"},"website_url":{"type":"string","required":false,"visibility":"user-or-llm","description":"Corporate website URL (e.g., \\"https://www.apollo.io/\\")"},"label_names":{"type":"array","required":false,"visibility":"user-or-llm","description":"Lists/labels to add the contact to (e.g., [\\"Prospects\\"])"},"contact_stage_id":{"type":"string","required":false,"visibility":"user-or-llm","description":"Apollo ID for the contact stage"},"present_raw_address":{"type":"string","required":false,"visibility":"user-or-llm","description":"Personal location for the contact (e.g., \\"Atlanta, United States\\")"},"direct_phone":{"type":"string","required":false,"visibility":"user-or-llm","description":"Primary phone number"},"corporate_phone":{"type":"string","required":false,"visibility":"user-or-llm","description":"Work/office phone number"},"mobile_phone":{"type":"string","required":false,"visibility":"user-or-llm","description":"Mobile phone number"},"home_phone":{"type":"string","required":false,"visibility":"user-or-llm","description":"Home phone number"},"other_phone":{"type":"string","required":false,"visibility":"user-or-llm","description":"Alternative phone number"},"typed_custom_fields":{"type":"json","required":false,"visibility":"user-or-llm","description":"Custom field values keyed by custom field ID"}},"hostedApiKey":"none"},"apollo_email_accounts":{"id":"apollo_email_accounts","name":"Apollo Get Email Accounts","description":"Get list of team\'s linked email accounts in Apollo","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key (master key required)"}},"hostedApiKey":"none"},"apollo_opportunity_create":{"id":"apollo_opportunity_create","name":"Apollo Create Opportunity","description":"Create a new deal for an account in your Apollo database (master key required)","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key (master key required)"},"name":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the opportunity/deal (e.g., \\"Enterprise License - Q1\\")"},"account_id":{"type":"string","required":false,"visibility":"user-or-llm","description":"ID of the account this opportunity belongs to (e.g., \\"acc_abc123\\")"},"amount":{"type":"string","required":false,"visibility":"user-or-llm","description":"Monetary value as a plain number string with no commas or currency symbols"},"opportunity_stage_id":{"type":"string","required":false,"visibility":"user-only","description":"ID of the opportunity stage"},"owner_id":{"type":"string","required":false,"visibility":"user-only","description":"User ID of the opportunity owner"},"closed_date":{"type":"string","required":false,"visibility":"user-or-llm","description":"Expected close date in YYYY-MM-DD format"},"typed_custom_fields":{"type":"json","required":false,"visibility":"user-only","description":"Custom field values as { custom_field_id: value } map"}},"hostedApiKey":"none"},"apollo_opportunity_get":{"id":"apollo_opportunity_get","name":"Apollo Get Opportunity","description":"Retrieve complete details of a specific deal/opportunity by ID","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key"},"opportunity_id":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the opportunity to retrieve (e.g., \\"opp_abc123\\")"}},"hostedApiKey":"none"},"apollo_opportunity_search":{"id":"apollo_opportunity_search","name":"Apollo Search Opportunities","description":"Search and list all deals/opportunities in your team\'s Apollo account","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key"},"sort_by_field":{"type":"string","required":false,"visibility":"user-or-llm","description":"Sort field: \\"amount\\", \\"is_closed\\", or \\"is_won\\""},"page":{"type":"number","required":false,"visibility":"user-or-llm","description":"Page number for pagination (e.g., 1, 2, 3)"},"per_page":{"type":"number","required":false,"visibility":"user-or-llm","description":"Results per page, max 100 (e.g., 25, 50, 100)"}},"hostedApiKey":"none"},"apollo_opportunity_update":{"id":"apollo_opportunity_update","name":"Apollo Update Opportunity","description":"Update an existing deal/opportunity in your Apollo database","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key"},"opportunity_id":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the opportunity to update (e.g., \\"opp_abc123\\")"},"name":{"type":"string","required":false,"visibility":"user-or-llm","description":"Name of the opportunity/deal (e.g., \\"Enterprise License - Q1\\")"},"amount":{"type":"string","required":false,"visibility":"user-or-llm","description":"Monetary value as a plain number string with no commas or currency symbols"},"opportunity_stage_id":{"type":"string","required":false,"visibility":"user-only","description":"ID of the opportunity stage"},"owner_id":{"type":"string","required":false,"visibility":"user-only","description":"User ID of the opportunity owner"},"closed_date":{"type":"string","required":false,"visibility":"user-or-llm","description":"Expected close date in YYYY-MM-DD format"},"typed_custom_fields":{"type":"json","required":false,"visibility":"user-only","description":"Custom field values as { custom_field_id: value } map"}},"hostedApiKey":"none"},"apollo_organization_bulk_enrich":{"id":"apollo_organization_bulk_enrich","name":"Apollo Bulk Organization Enrichment","description":"Enrich data for up to 10 organizations at once using Apollo","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key"},"domains":{"type":"array","required":true,"visibility":"user-or-llm","description":"Array of company domains to enrich (max 10, no www. or @, e.g., [\\"apollo.io\\", \\"stripe.com\\"])"}},"hostedApiKey":"none"},"apollo_organization_enrich":{"id":"apollo_organization_enrich","name":"Apollo Organization Enrichment","description":"Enrich data for a single organization using Apollo","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key"},"domain":{"type":"string","required":true,"visibility":"user-or-llm","description":"Company domain (e.g., \\"apollo.io\\", \\"acme.com\\")"}},"hostedApiKey":"none"},"apollo_organization_search":{"id":"apollo_organization_search","name":"Apollo Organization Search","description":"Search Apollo\'s database for companies using filters","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key"},"organization_locations":{"type":"array","required":false,"visibility":"user-or-llm","description":"Company HQ locations (cities, US states, or countries)"},"organization_not_locations":{"type":"array","required":false,"visibility":"user-or-llm","description":"Exclude companies whose HQ is in these locations"},"organization_num_employees_ranges":{"type":"array","required":false,"visibility":"user-or-llm","description":"Employee count ranges as \\"min,max\\" strings (e.g., [\\"1,10\\", \\"250,500\\", \\"10000,20000\\"])"},"q_organization_keyword_tags":{"type":"array","required":false,"visibility":"user-or-llm","description":"Industry or keyword tags"},"q_organization_name":{"type":"string","required":false,"visibility":"user-or-llm","description":"Organization name to search for (e.g., \\"Acme\\", \\"TechCorp\\")"},"organization_ids":{"type":"array","required":false,"visibility":"user-or-llm","description":"Apollo organization IDs to include (e.g., [\\"5e66b6381e05b4008c8331b8\\"])"},"q_organization_domains_list":{"type":"array","required":false,"visibility":"user-or-llm","description":"Domain names to filter by (no www. or @, up to 1,000)"},"page":{"type":"number","required":false,"visibility":"user-or-llm","description":"Page number for pagination (e.g., 1, 2, 3)"},"per_page":{"type":"number","required":false,"visibility":"user-or-llm","description":"Results per page, max 100 (e.g., 25, 50, 100)"}},"hostedApiKey":"none"},"apollo_people_bulk_enrich":{"id":"apollo_people_bulk_enrich","name":"Apollo Bulk People Enrichment","description":"Enrich data for up to 10 people at once using Apollo","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key"},"people":{"type":"array","required":true,"visibility":"user-or-llm","description":"Array of people to enrich (max 10)"},"reveal_personal_emails":{"type":"boolean","required":false,"visibility":"user-only","description":"Reveal personal email addresses (uses credits)"},"reveal_phone_number":{"type":"boolean","required":false,"visibility":"user-only","description":"Reveal phone numbers (uses credits, requires webhook_url)"},"webhook_url":{"type":"string","required":false,"visibility":"user-only","description":"Webhook URL for async phone number delivery (required when reveal_phone_number is true)"}},"hostedApiKey":"none"},"apollo_people_enrich":{"id":"apollo_people_enrich","name":"Apollo People Enrichment","description":"Enrich data for a single person using Apollo","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key"},"first_name":{"type":"string","required":false,"visibility":"user-or-llm","description":"First name of the person"},"last_name":{"type":"string","required":false,"visibility":"user-or-llm","description":"Last name of the person"},"name":{"type":"string","required":false,"visibility":"user-or-llm","description":"Full name of the person (alternative to first_name/last_name)"},"id":{"type":"string","required":false,"visibility":"user-or-llm","description":"Apollo ID for the person"},"hashed_email":{"type":"string","required":false,"visibility":"user-or-llm","description":"MD5 or SHA-256 hashed email"},"email":{"type":"string","required":false,"visibility":"user-or-llm","description":"Email address of the person"},"organization_name":{"type":"string","required":false,"visibility":"user-or-llm","description":"Company name where the person works"},"domain":{"type":"string","required":false,"visibility":"user-or-llm","description":"Company domain (e.g., \\"apollo.io\\", \\"acme.com\\")"},"linkedin_url":{"type":"string","required":false,"visibility":"user-or-llm","description":"LinkedIn profile URL"},"reveal_personal_emails":{"type":"boolean","required":false,"visibility":"user-only","description":"Reveal personal email addresses (uses credits)"},"reveal_phone_number":{"type":"boolean","required":false,"visibility":"user-only","description":"Reveal phone numbers (uses credits, requires webhook_url)"},"webhook_url":{"type":"string","required":false,"visibility":"user-only","description":"Webhook URL for async phone number delivery (required when reveal_phone_number is true)"}},"hostedApiKey":"none"},"apollo_people_search":{"id":"apollo_people_search","name":"Apollo People Search","description":"Search Apollo\'s database for people using demographic filters","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key"},"person_titles":{"type":"array","required":false,"visibility":"user-or-llm","description":"Job titles to search for (e.g., [\\"CEO\\", \\"VP of Sales\\"])"},"include_similar_titles":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Whether to return people with job titles similar to person_titles"},"person_locations":{"type":"array","required":false,"visibility":"user-or-llm","description":"Locations to search in (e.g., [\\"San Francisco, CA\\", \\"New York, NY\\"])"},"person_seniorities":{"type":"array","required":false,"visibility":"user-or-llm","description":"Seniority levels (one of: owner, founder, c_suite, partner, vp, head, director, manager, senior, entry, intern)"},"organization_ids":{"type":"array","required":false,"visibility":"user-or-llm","description":"Apollo organization IDs to filter by (e.g., [\\"5e66b6381e05b4008c8331b8\\"])"},"organization_names":{"type":"array","required":false,"visibility":"user-or-llm","description":"Company names to search within (legacy filter)"},"organization_locations":{"type":"array","required":false,"visibility":"user-or-llm","description":"Headquarters locations of the people\'s current employer (e.g., [\'texas\', \'tokyo\', \'spain\'])"},"q_organization_domains_list":{"type":"array","required":false,"visibility":"user-or-llm","description":"Employer domain names (e.g., [\\"apollo.io\\", \\"microsoft.com\\"]) — up to 1,000, no www. or @"},"organization_num_employees_ranges":{"type":"array","required":false,"visibility":"user-or-llm","description":"Employee count ranges for the person\'s current employer. Each entry is \\"min,max\\" (e.g., [\\"1,10\\", \\"250,500\\", \\"10000,20000\\"])"},"contact_email_status":{"type":"array","required":false,"visibility":"user-or-llm","description":"Email statuses to filter by: \\"verified\\", \\"unverified\\", \\"likely to engage\\", \\"unavailable\\""},"q_keywords":{"type":"string","required":false,"visibility":"user-or-llm","description":"Keywords to search for"},"page":{"type":"number","required":false,"visibility":"user-or-llm","description":"Page number for pagination, default 1 (e.g., 1, 2, 3)"},"per_page":{"type":"number","required":false,"visibility":"user-or-llm","description":"Results per page, default 25, max 100 (e.g., 25, 50, 100)"}},"hostedApiKey":"none"},"apollo_sequence_add_contacts":{"id":"apollo_sequence_add_contacts","name":"Apollo Add Contacts to Sequence","description":"Add contacts to an Apollo sequence","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key (master key required)"},"sequence_id":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the sequence to add contacts to (e.g., \\"seq_abc123\\")"},"contact_ids":{"type":"array","required":false,"visibility":"user-or-llm","description":"Array of contact IDs to add to the sequence (e.g., [\\"con_abc123\\", \\"con_def456\\"]). Either contact_ids or label_names must be provided."},"label_names":{"type":"array","required":false,"visibility":"user-or-llm","description":"Array of label names to identify contacts to add to the sequence. Either contact_ids or label_names must be provided."},"send_email_from_email_account_id":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the email account to send from. Use the Get Email Accounts operation to look this up."},"send_email_from_email_address":{"type":"string","required":false,"visibility":"user-only","description":"Specific email address to send from within the email account."},"sequence_no_email":{"type":"boolean","required":false,"visibility":"user-only","description":"Add contacts even if they have no email address"},"sequence_unverified_email":{"type":"boolean","required":false,"visibility":"user-only","description":"Add contacts with unverified email addresses"},"sequence_job_change":{"type":"boolean","required":false,"visibility":"user-only","description":"Add contacts who recently changed jobs"},"sequence_active_in_other_campaigns":{"type":"boolean","required":false,"visibility":"user-only","description":"Add contacts active in other campaigns"},"sequence_finished_in_other_campaigns":{"type":"boolean","required":false,"visibility":"user-only","description":"Add contacts who finished other campaigns"},"sequence_same_company_in_same_campaign":{"type":"boolean","required":false,"visibility":"user-only","description":"Add contacts even if others from the same company are in the sequence"},"contacts_without_ownership_permission":{"type":"boolean","required":false,"visibility":"user-only","description":"Add contacts without ownership permission"},"add_if_in_queue":{"type":"boolean","required":false,"visibility":"user-only","description":"Add contacts even if they are in the queue"},"contact_verification_skipped":{"type":"boolean","required":false,"visibility":"user-only","description":"Skip contact verification when adding"},"user_id":{"type":"string","required":false,"visibility":"user-only","description":"ID of the user performing the action"},"status":{"type":"string","required":false,"visibility":"user-only","description":"Initial status for added contacts: \\"active\\" or \\"paused\\""},"auto_unpause_at":{"type":"string","required":false,"visibility":"user-only","description":"ISO 8601 datetime to automatically unpause contacts"}},"hostedApiKey":"none"},"apollo_sequence_search":{"id":"apollo_sequence_search","name":"Apollo Search Sequences","description":"Search for sequences/campaigns in your team\'s Apollo account (master key required)","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key (master key required)"},"q_name":{"type":"string","required":false,"visibility":"user-or-llm","description":"Search sequences by name (e.g., \\"Outbound Q1\\", \\"Follow-up\\")"},"page":{"type":"number","required":false,"visibility":"user-or-llm","description":"Page number for pagination (e.g., 1, 2, 3)"},"per_page":{"type":"number","required":false,"visibility":"user-or-llm","description":"Results per page, max 100 (e.g., 25, 50, 100)"}},"hostedApiKey":"none"},"apollo_task_create":{"id":"apollo_task_create","name":"Apollo Create Task","description":"Create one or more tasks in Apollo (one task per contact_id, master key required)","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key (master key required)"},"user_id":{"type":"string","required":true,"visibility":"user-or-llm","description":"ID of the Apollo user the task is assigned to"},"contact_ids":{"type":"array","required":true,"visibility":"user-or-llm","description":"Array of contact IDs. One task is created per contact."},"priority":{"type":"string","required":false,"visibility":"user-or-llm","description":"Task priority: \\"high\\", \\"medium\\", or \\"low\\" (defaults to \\"medium\\")"},"due_at":{"type":"string","required":true,"visibility":"user-or-llm","description":"Due date/time in ISO 8601 format (e.g., \\"2024-12-31T23:59:59Z\\")"},"type":{"type":"string","required":true,"visibility":"user-or-llm","description":"Task type: \\"call\\", \\"outreach_manual_email\\", \\"linkedin_step_connect\\", \\"linkedin_step_message\\", \\"linkedin_step_view_profile\\", \\"linkedin_step_interact_post\\", or \\"action_item\\""},"status":{"type":"string","required":true,"visibility":"user-or-llm","description":"Task status: \\"scheduled\\", \\"completed\\", or \\"skipped\\""},"note":{"type":"string","required":false,"visibility":"user-or-llm","description":"Free-form note providing context for the task"}},"hostedApiKey":"none"},"apollo_task_search":{"id":"apollo_task_search","name":"Apollo Search Tasks","description":"Search for tasks in Apollo","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Apollo API key (master key required)"},"sort_by_field":{"type":"string","required":false,"visibility":"user-or-llm","description":"Sort field: \\"task_due_at\\" or \\"task_priority\\""},"open_factor_names":{"type":"array","required":false,"visibility":"user-or-llm","description":"Filter by status. Common values: [\\"task_types\\"] for open tasks, [\\"task_completed_at\\"] for completed tasks."},"page":{"type":"number","required":false,"visibility":"user-or-llm","description":"Page number for pagination (e.g., 1, 2, 3)"},"per_page":{"type":"number","required":false,"visibility":"user-or-llm","description":"Results per page, max 100 (e.g., 25, 50, 100)"}},"hostedApiKey":"none"},"appconfig_create_application":{"id":"appconfig_create_application","name":"AppConfig Create Application","description":"Create an application in AWS AppConfig","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"name":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the application to create"},"description":{"type":"string","required":false,"visibility":"user-or-llm","description":"Description of the application"}},"hostedApiKey":"none"},"appconfig_create_configuration_profile":{"id":"appconfig_create_configuration_profile","name":"AppConfig Create Configuration Profile","description":"Create a configuration profile in an AWS AppConfig application","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID to create the configuration profile in"},"name":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the configuration profile"},"locationUri":{"type":"string","required":true,"visibility":"user-or-llm","description":"Where the configuration is stored. Use \\"hosted\\" for AppConfig-hosted configurations, or an SSM/S3 URI"},"description":{"type":"string","required":false,"visibility":"user-or-llm","description":"Description of the configuration profile"},"retrievalRoleArn":{"type":"string","required":false,"visibility":"user-or-llm","description":"ARN of an IAM role to retrieve the configuration (required for non-hosted URIs)"},"type":{"type":"string","required":false,"visibility":"user-or-llm","description":"Profile type: AWS.Freeform (default) or AWS.AppConfig.FeatureFlags"}},"hostedApiKey":"none"},"appconfig_create_environment":{"id":"appconfig_create_environment","name":"AppConfig Create Environment","description":"Create an environment for an AWS AppConfig application","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID to create the environment in"},"name":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the environment to create"},"description":{"type":"string","required":false,"visibility":"user-or-llm","description":"Description of the environment"}},"hostedApiKey":"none"},"appconfig_create_hosted_configuration_version":{"id":"appconfig_create_hosted_configuration_version","name":"AppConfig Create Hosted Configuration Version","description":"Create a new hosted configuration version for an AppConfig configuration profile","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID that owns the configuration profile"},"configurationProfileId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The configuration profile ID to add the version to"},"content":{"type":"string","required":true,"visibility":"user-or-llm","description":"The configuration content (e.g., a JSON or YAML document)"},"contentType":{"type":"string","required":true,"visibility":"user-or-llm","description":"Content type of the configuration (e.g., application/json, text/plain)"},"description":{"type":"string","required":false,"visibility":"user-or-llm","description":"Description of the configuration version"},"latestVersionNumber":{"type":"number","required":false,"visibility":"user-or-llm","description":"The version number of the latest version, used for optimistic concurrency"},"versionLabel":{"type":"string","required":false,"visibility":"user-or-llm","description":"A user-defined label for the configuration version"}},"hostedApiKey":"none"},"appconfig_delete_application":{"id":"appconfig_delete_application","name":"AppConfig Delete Application","description":"Delete an AWS AppConfig application","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID to delete"}},"hostedApiKey":"none"},"appconfig_delete_configuration_profile":{"id":"appconfig_delete_configuration_profile","name":"AppConfig Delete Configuration Profile","description":"Delete an AWS AppConfig configuration profile","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID that owns the configuration profile"},"configurationProfileId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The configuration profile ID to delete"}},"hostedApiKey":"none"},"appconfig_delete_environment":{"id":"appconfig_delete_environment","name":"AppConfig Delete Environment","description":"Delete an AWS AppConfig environment","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID that owns the environment"},"environmentId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The environment ID to delete"}},"hostedApiKey":"none"},"appconfig_delete_hosted_configuration_version":{"id":"appconfig_delete_hosted_configuration_version","name":"AppConfig Delete Hosted Configuration Version","description":"Delete a specific hosted configuration version from an AppConfig profile","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID that owns the configuration profile"},"configurationProfileId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The configuration profile ID that owns the version"},"versionNumber":{"type":"number","required":true,"visibility":"user-or-llm","description":"The version number to delete"}},"hostedApiKey":"none"},"appconfig_get_application":{"id":"appconfig_get_application","name":"AppConfig Get Application","description":"Get details about a single AWS AppConfig application","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID to retrieve"}},"hostedApiKey":"none"},"appconfig_get_configuration":{"id":"appconfig_get_configuration","name":"AppConfig Get Configuration","description":"Retrieve the latest deployed configuration for an AppConfig application, environment, and profile","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID or name to retrieve configuration for"},"environmentId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The environment ID or name to retrieve configuration for"},"configurationProfileId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The configuration profile ID or name to retrieve"}},"hostedApiKey":"none"},"appconfig_get_configuration_profile":{"id":"appconfig_get_configuration_profile","name":"AppConfig Get Configuration Profile","description":"Get details about a single AWS AppConfig configuration profile","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID that owns the configuration profile"},"configurationProfileId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The configuration profile ID to retrieve"}},"hostedApiKey":"none"},"appconfig_get_deployment":{"id":"appconfig_get_deployment","name":"AppConfig Get Deployment","description":"Get details about a specific AWS AppConfig deployment","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID of the deployment"},"environmentId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The environment ID of the deployment"},"deploymentNumber":{"type":"number","required":true,"visibility":"user-or-llm","description":"The sequence number of the deployment"}},"hostedApiKey":"none"},"appconfig_get_environment":{"id":"appconfig_get_environment","name":"AppConfig Get Environment","description":"Get details about a single AWS AppConfig environment","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID that owns the environment"},"environmentId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The environment ID to retrieve"}},"hostedApiKey":"none"},"appconfig_get_hosted_configuration_version":{"id":"appconfig_get_hosted_configuration_version","name":"AppConfig Get Hosted Configuration Version","description":"Retrieve a specific hosted configuration version from an AppConfig profile","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID that owns the configuration profile"},"configurationProfileId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The configuration profile ID to read the version from"},"versionNumber":{"type":"number","required":true,"visibility":"user-or-llm","description":"The version number to retrieve"}},"hostedApiKey":"none"},"appconfig_list_applications":{"id":"appconfig_list_applications","name":"AppConfig List Applications","description":"List applications in AWS AppConfig","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"maxResults":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of applications to return (1-50)"},"nextToken":{"type":"string","required":false,"visibility":"user-or-llm","description":"Pagination token from a previous response"}},"hostedApiKey":"none"},"appconfig_list_configuration_profiles":{"id":"appconfig_list_configuration_profiles","name":"AppConfig List Configuration Profiles","description":"List configuration profiles for an AWS AppConfig application","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID that owns the configuration profiles"},"maxResults":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of configuration profiles to return (1-50)"},"nextToken":{"type":"string","required":false,"visibility":"user-or-llm","description":"Pagination token from a previous response"}},"hostedApiKey":"none"},"appconfig_list_deployment_strategies":{"id":"appconfig_list_deployment_strategies","name":"AppConfig List Deployment Strategies","description":"List deployment strategies available in AWS AppConfig","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"maxResults":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of deployment strategies to return (1-50)"},"nextToken":{"type":"string","required":false,"visibility":"user-or-llm","description":"Pagination token from a previous response"}},"hostedApiKey":"none"},"appconfig_list_deployments":{"id":"appconfig_list_deployments","name":"AppConfig List Deployments","description":"List deployments for an AWS AppConfig environment","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID of the deployments"},"environmentId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The environment ID of the deployments"},"maxResults":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of deployments to return (1-50)"},"nextToken":{"type":"string","required":false,"visibility":"user-or-llm","description":"Pagination token from a previous response"}},"hostedApiKey":"none"},"appconfig_list_environments":{"id":"appconfig_list_environments","name":"AppConfig List Environments","description":"List environments for an AWS AppConfig application","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID that owns the environments"},"maxResults":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of environments to return (1-50)"},"nextToken":{"type":"string","required":false,"visibility":"user-or-llm","description":"Pagination token from a previous response"}},"hostedApiKey":"none"},"appconfig_list_hosted_configuration_versions":{"id":"appconfig_list_hosted_configuration_versions","name":"AppConfig List Hosted Configuration Versions","description":"List hosted configuration versions for an AWS AppConfig configuration profile","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID that owns the configuration profile"},"configurationProfileId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The configuration profile ID to list versions for"},"maxResults":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of versions to return (1-50)"},"nextToken":{"type":"string","required":false,"visibility":"user-or-llm","description":"Pagination token from a previous response"}},"hostedApiKey":"none"},"appconfig_start_deployment":{"id":"appconfig_start_deployment","name":"AppConfig Start Deployment","description":"Start deploying a configuration version to an AWS AppConfig environment","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID to deploy in"},"environmentId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The environment ID to deploy to"},"deploymentStrategyId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The deployment strategy ID to use"},"configurationProfileId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The configuration profile ID to deploy"},"configurationVersion":{"type":"string","required":true,"visibility":"user-or-llm","description":"The configuration version to deploy"},"description":{"type":"string","required":false,"visibility":"user-or-llm","description":"Description of the deployment"}},"hostedApiKey":"none"},"appconfig_stop_deployment":{"id":"appconfig_stop_deployment","name":"AppConfig Stop Deployment","description":"Stop an in-progress AWS AppConfig deployment","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID of the deployment"},"environmentId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The environment ID of the deployment"},"deploymentNumber":{"type":"number","required":true,"visibility":"user-or-llm","description":"The sequence number of the deployment to stop"}},"hostedApiKey":"none"},"appconfig_update_application":{"id":"appconfig_update_application","name":"AppConfig Update Application","description":"Update the name or description of an AWS AppConfig application","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID to update"},"name":{"type":"string","required":false,"visibility":"user-or-llm","description":"New name for the application"},"description":{"type":"string","required":false,"visibility":"user-or-llm","description":"New description for the application"}},"hostedApiKey":"none"},"appconfig_update_configuration_profile":{"id":"appconfig_update_configuration_profile","name":"AppConfig Update Configuration Profile","description":"Update the name, description, or retrieval role of an AppConfig configuration profile","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID that owns the configuration profile"},"configurationProfileId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The configuration profile ID to update"},"name":{"type":"string","required":false,"visibility":"user-or-llm","description":"New name for the configuration profile"},"description":{"type":"string","required":false,"visibility":"user-or-llm","description":"New description for the configuration profile"},"retrievalRoleArn":{"type":"string","required":false,"visibility":"user-or-llm","description":"New ARN of the IAM role used to retrieve the configuration"}},"hostedApiKey":"none"},"appconfig_update_environment":{"id":"appconfig_update_environment","name":"AppConfig Update Environment","description":"Update the name or description of an AWS AppConfig environment","version":"1.0","params":{"region":{"type":"string","required":true,"visibility":"user-only","description":"AWS region (e.g., us-east-1)"},"accessKeyId":{"type":"string","required":true,"visibility":"user-only","description":"AWS access key ID"},"secretAccessKey":{"type":"string","required":true,"visibility":"user-only","description":"AWS secret access key"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The application ID that owns the environment"},"environmentId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The environment ID to update"},"name":{"type":"string","required":false,"visibility":"user-or-llm","description":"New name for the environment"},"description":{"type":"string","required":false,"visibility":"user-or-llm","description":"New description for the environment"}},"hostedApiKey":"none"},"arxiv_get_author_papers":{"id":"arxiv_get_author_papers","name":"ArXiv Get Author Papers","description":"Search for papers by a specific author on ArXiv.","version":"1.0.0","params":{"authorName":{"type":"string","required":true,"visibility":"user-or-llm","description":"Author name to search for"},"maxResults":{"type":"number","required":false,"visibility":"user-only","description":"Maximum number of results to return (default: 10, max: 2000)"}},"hostedApiKey":"none"},"arxiv_get_paper":{"id":"arxiv_get_paper","name":"ArXiv Get Paper","description":"Get detailed information about a specific ArXiv paper by its ID.","version":"1.0.0","params":{"paperId":{"type":"string","required":true,"visibility":"user-or-llm","description":"ArXiv paper ID (e.g., \\"1706.03762\\")"}},"hostedApiKey":"none"},"arxiv_search":{"id":"arxiv_search","name":"ArXiv Search","description":"Search for academic papers on ArXiv by keywords, authors, titles, or other fields.","version":"1.0.0","params":{"searchQuery":{"type":"string","required":true,"visibility":"user-or-llm","description":"The search query to execute"},"searchField":{"type":"string","required":false,"visibility":"user-only","description":"Field to search in: all, ti (title), au (author), abs (abstract), co (comment), jr (journal), cat (category), rn (report number)"},"maxResults":{"type":"number","required":false,"visibility":"user-only","description":"Maximum number of results to return (default: 10, max: 2000)"},"sortBy":{"type":"string","required":false,"visibility":"user-only","description":"Sort by: relevance, lastUpdatedDate, submittedDate (default: relevance)"},"sortOrder":{"type":"string","required":false,"visibility":"user-only","description":"Sort order: ascending, descending (default: descending)"}},"hostedApiKey":"none"},"asana_add_comment":{"id":"asana_add_comment","name":"Asana Add Comment","description":"Add a comment (story) to an Asana task","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token for Asana"},"taskGid":{"type":"string","required":true,"visibility":"user-or-llm","description":"Asana task GID (numeric string)"},"text":{"type":"string","required":true,"visibility":"user-or-llm","description":"The text content of the comment"}},"oauth":{"required":true,"provider":"asana"},"hostedApiKey":"none"},"asana_add_followers":{"id":"asana_add_followers","name":"Asana Add Followers","description":"Add one or more followers to an Asana task","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token for Asana"},"taskGid":{"type":"string","required":true,"visibility":"user-or-llm","description":"GID of the Asana task (numeric string)"},"followers":{"type":"array","required":true,"visibility":"user-or-llm","description":"Array of user GIDs to add as followers to the task"}},"oauth":{"required":true,"provider":"asana"},"hostedApiKey":"none"},"asana_create_project":{"id":"asana_create_project","name":"Asana Create Project","description":"Create a new project in an Asana workspace","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token for Asana"},"workspace":{"type":"string","required":true,"visibility":"user-or-llm","description":"Asana workspace GID (numeric string) where the project will be created"},"name":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the project"},"notes":{"type":"string","required":false,"visibility":"user-or-llm","description":"Notes or description for the project"}},"oauth":{"required":true,"provider":"asana"},"hostedApiKey":"none"},"asana_create_section":{"id":"asana_create_section","name":"Asana Create Section","description":"Create a new section in an Asana project","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token for Asana"},"projectGid":{"type":"string","required":true,"visibility":"user-or-llm","description":"GID of the Asana project (numeric string) to add the section to"},"name":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the section"}},"oauth":{"required":true,"provider":"asana"},"hostedApiKey":"none"},"asana_create_subtask":{"id":"asana_create_subtask","name":"Asana Create Subtask","description":"Create a subtask under an existing Asana task","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token for Asana"},"taskGid":{"type":"string","required":true,"visibility":"user-or-llm","description":"GID of the parent Asana task (numeric string)"},"name":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the subtask"},"notes":{"type":"string","required":false,"visibility":"user-or-llm","description":"Notes or description for the subtask"},"assignee":{"type":"string","required":false,"visibility":"user-or-llm","description":"User GID to assign the subtask to"},"due_on":{"type":"string","required":false,"visibility":"user-or-llm","description":"Due date in YYYY-MM-DD format"}},"oauth":{"required":true,"provider":"asana"},"hostedApiKey":"none"},"asana_create_task":{"id":"asana_create_task","name":"Asana Create Task","description":"Create a new task in Asana","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token for Asana"},"workspace":{"type":"string","required":true,"visibility":"user-or-llm","description":"Asana workspace GID (numeric string) where the task will be created"},"name":{"type":"string","required":true,"visibility":"user-or-llm","description":"Name of the task"},"notes":{"type":"string","required":false,"visibility":"user-or-llm","description":"Notes or description for the task"},"assignee":{"type":"string","required":false,"visibility":"user-or-llm","description":"User GID to assign the task to"},"due_on":{"type":"string","required":false,"visibility":"user-or-llm","description":"Due date in YYYY-MM-DD format"}},"oauth":{"required":true,"provider":"asana"},"hostedApiKey":"none"},"asana_delete_task":{"id":"asana_delete_task","name":"Asana Delete Task","description":"Delete an Asana task by its GID (moves it to the trash)","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token for Asana"},"taskGid":{"type":"string","required":true,"visibility":"user-or-llm","description":"GID of the Asana task to delete (numeric string)"}},"oauth":{"required":true,"provider":"asana"},"hostedApiKey":"none"},"asana_get_project":{"id":"asana_get_project","name":"Asana Get Project","description":"Retrieve a single Asana project by its GID","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token for Asana"},"projectGid":{"type":"string","required":true,"visibility":"user-or-llm","description":"Asana project GID (numeric string) to retrieve"}},"oauth":{"required":true,"provider":"asana"},"hostedApiKey":"none"},"asana_get_projects":{"id":"asana_get_projects","name":"Asana Get Projects","description":"Retrieve all projects from an Asana workspace","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token for Asana"},"workspace":{"type":"string","required":true,"visibility":"user-or-llm","description":"Asana workspace GID (numeric string) to retrieve projects from"}},"oauth":{"required":true,"provider":"asana"},"hostedApiKey":"none"},"asana_get_task":{"id":"asana_get_task","name":"Asana Get Task","description":"Retrieve a single task by GID or get multiple tasks with filters","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token for Asana"},"taskGid":{"type":"string","required":false,"visibility":"user-or-llm","description":"The globally unique identifier (GID) of the task. If not provided, will get multiple tasks."},"workspace":{"type":"string","required":false,"visibility":"user-or-llm","description":"Asana workspace GID (numeric string) to filter tasks (required when not using taskGid)"},"project":{"type":"string","required":false,"visibility":"user-or-llm","description":"Asana project GID (numeric string) to filter tasks"},"limit":{"type":"number","required":false,"visibility":"user-or-llm","description":"Maximum number of tasks to return (default: 50)"}},"oauth":{"required":true,"provider":"asana"},"hostedApiKey":"none"},"asana_list_sections":{"id":"asana_list_sections","name":"Asana List Sections","description":"List all sections in an Asana project","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token for Asana"},"projectGid":{"type":"string","required":true,"visibility":"user-or-llm","description":"GID of the Asana project (numeric string) to list sections from"}},"oauth":{"required":true,"provider":"asana"},"hostedApiKey":"none"},"asana_list_workspaces":{"id":"asana_list_workspaces","name":"Asana List Workspaces","description":"List all Asana workspaces and organizations the authenticated user belongs to","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token for Asana"}},"oauth":{"required":true,"provider":"asana"},"hostedApiKey":"none"},"asana_search_tasks":{"id":"asana_search_tasks","name":"Asana Search Tasks","description":"Search for tasks in an Asana workspace","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token for Asana"},"workspace":{"type":"string","required":true,"visibility":"user-or-llm","description":"Asana workspace GID (numeric string) to search tasks in"},"text":{"type":"string","required":false,"visibility":"user-or-llm","description":"Text to search for in task names"},"assignee":{"type":"string","required":false,"visibility":"user-or-llm","description":"Filter tasks by assignee user GID"},"projects":{"type":"array","required":false,"visibility":"user-or-llm","description":"Array of Asana project GIDs (numeric strings) to filter tasks by"},"completed":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Filter by completion status"}},"oauth":{"required":true,"provider":"asana"},"hostedApiKey":"none"},"asana_update_task":{"id":"asana_update_task","name":"Asana Update Task","description":"Update an existing task in Asana","version":"1.0.0","params":{"accessToken":{"type":"string","required":true,"visibility":"hidden","description":"OAuth access token for Asana"},"taskGid":{"type":"string","required":true,"visibility":"user-or-llm","description":"Asana task GID (numeric string) of the task to update"},"name":{"type":"string","required":false,"visibility":"user-or-llm","description":"Updated name for the task"},"notes":{"type":"string","required":false,"visibility":"user-or-llm","description":"Updated notes or description for the task"},"assignee":{"type":"string","required":false,"visibility":"user-or-llm","description":"Updated assignee user GID"},"completed":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Mark task as completed or not completed"},"due_on":{"type":"string","required":false,"visibility":"user-or-llm","description":"Updated due date in YYYY-MM-DD format"}},"oauth":{"required":true,"provider":"asana"},"hostedApiKey":"none"},"ashby_add_candidate_tag":{"id":"ashby_add_candidate_tag","name":"Ashby Add Candidate Tag","description":"Adds a tag to a candidate in Ashby and returns the updated candidate.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ashby API Key"},"onBehalfOfUserId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Active Ashby user UUID to attribute this mutation to; the API key must permit on-behalf-of calls"},"candidateId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The UUID of the candidate to add the tag to"},"tagId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The UUID of the tag to add"}},"hostedApiKey":"none"},"ashby_anonymize_candidate":{"id":"ashby_anonymize_candidate","name":"Ashby Anonymize Candidate","description":"Strips personally identifiable information from a candidate in Ashby. This does not delete the candidate - the record and its applications remain, with the PII removed. Ashby exposes no candidate deletion endpoint; true deletion is UI-only, restricted by role, and limited to a 10-day window. Requires the candidatesWrite permission.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ashby API Key"},"onBehalfOfUserId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Active Ashby user UUID to attribute this mutation to; the API key must permit on-behalf-of calls"},"candidateId":{"type":"string","required":true,"visibility":"user-or-llm","description":"UUID of the candidate to anonymize"}},"hostedApiKey":"none"},"ashby_change_application_source":{"id":"ashby_change_application_source","name":"Ashby Change Application Source","description":"Changes the source attributed to an existing application, so programmatically created applications report correctly on the recruiting side. Requires the candidatesWrite permission.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ashby API Key"},"onBehalfOfUserId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Active Ashby user UUID to attribute this mutation to; the API key must permit on-behalf-of calls"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"UUID of the application whose source should change"},"sourceId":{"type":"string","required":false,"visibility":"user-or-llm","description":"UUID of the source to attribute the application to, as returned by List Sources. Omit only when unsetSource is true."},"unsetSource":{"type":"boolean","required":false,"visibility":"user-or-llm","description":"Set true to deliberately clear the application source. Required to unset, so that a missing or empty sourceId cannot wipe attribution by accident."}},"hostedApiKey":"none"},"ashby_change_application_stage":{"id":"ashby_change_application_stage","name":"Ashby Change Application Stage","description":"Moves an application to a different interview stage. Requires an archive reason when moving to an Archived stage.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ashby API Key"},"onBehalfOfUserId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Active Ashby user UUID to attribute this mutation to; the API key must permit on-behalf-of calls"},"applicationId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The UUID of the application to update the stage of"},"interviewStageId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The UUID of the interview stage to move the application to"},"archiveReasonId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Archive reason UUID. Required when moving to an Archived stage, ignored otherwise"},"archiveEmail":{"type":"json","required":false,"visibility":"user-or-llm","description":"Archive email configuration with communicationTemplateId and optional sendAt ISO 8601 timestamp. Pass null or omit to send no archive email."}},"hostedApiKey":"none"},"ashby_create_application":{"id":"ashby_create_application","name":"Ashby Create Application","description":"Creates a new application for a candidate on a job. Optionally specify interview plan, stage, source, and credited user.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ashby API Key"},"onBehalfOfUserId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Active Ashby user UUID to attribute this mutation to; the API key must permit on-behalf-of calls"},"candidateId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The UUID of the candidate to consider for the job"},"jobId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The UUID of the job to consider the candidate for"},"interviewPlanId":{"type":"string","required":false,"visibility":"user-or-llm","description":"UUID of the interview plan to use (defaults to the job default plan)"},"interviewStageId":{"type":"string","required":false,"visibility":"user-or-llm","description":"UUID of the interview stage to place the application in, or FirstPreInterviewScreen (defaults to the first Lead stage)"},"sourceId":{"type":"string","required":false,"visibility":"user-or-llm","description":"UUID of the source to set on the application"},"creditedToUserId":{"type":"string","required":false,"visibility":"user-or-llm","description":"UUID of the user the application is credited to"},"createdAt":{"type":"string","required":false,"visibility":"user-or-llm","description":"ISO 8601 timestamp to set as the application creation date (defaults to now)"},"applicationHistory":{"type":"json","required":false,"visibility":"user-or-llm","description":"Optional documented application history entries to create with the application"}},"hostedApiKey":"none"},"ashby_create_candidate":{"id":"ashby_create_candidate","name":"Ashby Create Candidate","description":"Creates a new candidate record in Ashby.","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ashby API Key"},"onBehalfOfUserId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Active Ashby user UUID to attribute this mutation to; the API key must permit on-behalf-of calls"},"name":{"type":"string","required":true,"visibility":"user-or-llm","description":"The candidate full name"},"email":{"type":"string","required":false,"visibility":"user-or-llm","description":"Primary email address for the candidate"},"phoneNumber":{"type":"string","required":false,"visibility":"user-or-llm","description":"Primary phone number for the candidate"},"linkedInUrl":{"type":"string","required":false,"visibility":"user-or-llm","description":"LinkedIn profile URL"},"githubUrl":{"type":"string","required":false,"visibility":"user-or-llm","description":"GitHub profile URL"},"website":{"type":"string","required":false,"visibility":"user-or-llm","description":"Personal website URL"},"sourceId":{"type":"string","required":false,"visibility":"user-or-llm","description":"UUID of the source to attribute the candidate to"},"creditedToUserId":{"type":"string","required":false,"visibility":"user-or-llm","description":"UUID of the Ashby user to credit with sourcing this candidate"},"createdAt":{"type":"string","required":false,"visibility":"user-or-llm","description":"Backdated creation timestamp in ISO 8601 (e.g. 2024-01-01T00:00:00Z). Defaults to now."},"alternateEmailAddresses":{"type":"json","required":false,"visibility":"user-or-llm","description":"Array of additional email address strings to add to the candidate, e.g. [\\"a@x.com\\",\\"b@y.com\\"]"},"location":{"type":"json","required":false,"visibility":"user-or-llm","description":"Candidate location object with optional city, region, and country"}},"hostedApiKey":"none"},"ashby_create_note":{"id":"ashby_create_note","name":"Ashby Create Note","description":"Creates a note on a candidate in Ashby. Supports plain text and HTML content (bold, italic, underline, links, lists, code).","version":"1.0.0","params":{"apiKey":{"type":"string","required":true,"visibility":"user-only","description":"Ashby API Key"},"onBehalfOfUserId":{"type":"string","required":false,"visibility":"user-or-llm","description":"Active Ashby user UUID to attribute this mutation to; the API key must permit on-behalf-of calls"},"candidateId":{"type":"string","required":true,"visibility":"user-or-llm","description":"The UUID of the candidate to add the note to"},"note":{"type":"string","required":true,"visibility":"user-or-llm","description":"The note content. If noteType is text/html, supports: , , , ,