feat: reusable Router search, verified phone, and Twilio webhook primitives

[drewstone]

Reusable primitives in the existing integrations library

Extract generally useful provider protocol behavior from SUPER without introducing another agent loop, evaluator, permission engine, signup database or provider registry.

• /tangle-search: TangleSearchClient and pure request/response functions for consumers with an existing transport. One Router endpoint, explicit host-selected credentials, optional provider pinning, query/provider correlation and preservation of unknown costs. No direct You.com client, automatic paid fallback or retry.
• /twilio: managed verification, native SMS form encoding with delivery callbacks, original-body preservation, account/phone/receipt correlation, phone normalization and exact native form-signature authentication. A messaging-only consumer needs no Verify service. Sends have no automatic retry or claimed native idempotency.
• createTwilioWebhookProvider extends the existing /webhooks router. Event identity includes status so an accepted event does not deduplicate a later delivery event. It does not create another webhook engine.
• A small shared internal JSON transport supplies bounded reads, cancellation before and after response headers, and withholding of error bodies that could reflect credentials.

Enrollment, Terms/Privacy consent, sessions, workspace ownership, reply shortening, sender registration and billing policy stay in consuming products. These are host APIs, not model-callable session-creation tools. Existing Hub tool adapters are unchanged; this does not claim the current Twilio Hub connector now exposes Verify.

Packaging and documentation

Two additive subpath exports, matching tsup entries, no new dependency or manual version bump. CHANGELOG.md records Unreleased changes; docs/host-search-and-phone.md documents usage, correlation, transport limits, webhook/replay boundaries and rollout. Existing release automation owns the published version.

Companion non-draft PRs:

• feat(web): share conversation attribution across agent applications agent-app#594
• https://github.com/drewstone/super-agent/pull/4 — actual consumer cutover, not a future plan.

SUPER imports exact generated modules pinned to this source until a compatible release is published. It removes its independent protocol bodies; no silent local fallback remains.

Full-checkout verification

Passed on ad0e48ccf8fd191be5e1628949249047547bc634:

• Frozen pnpm install.
• Package typecheck.
• 5,569 tests across 702 test files, all passed.
• Existing pnpm run release packed-artifact verification, without --publish. The package and 627 bundled manifests verified successfully.

Evidence: https://github.com/tangle-network/agent-integrations/actions/runs/35030132223 (artifact shared-primitives-304 contains exact source, commit, typecheck/test/release logs).

This supersedes the earlier isolated authoring-test limitation. The existing 28 focused provider/webhook checks are part of the tested repository; no provider credentials or live paid calls are used by these tests.

Non-draft and ready for review. No main merge, tag, npm publication, live search, OTP, SMS, account changes or deployment was performed. Passing protocol tests is not evidence of a delivered customer conversation or completed logistics task.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.