@agentlang/agentmanager 0.0.3 → 0.0.4

package/dist/apps/monolith/apps/integrations/src/modules/auth-flow/auth-flow.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-flow.module.js","sourceRoot":"","sources":["../../../../../../../../apps/integrations/src/modules/auth-flow/auth-flow.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,0EAAsE;AACtE,0EAAsE;AACtE,iEAA6D;AAC7D,oEAAgE;AAChE,gFAA2E;AAC3E,2DAAsD;AACtD,2DAAgE;AAazD,IAAM,cAAc,GAApB,MAAM,cAAc;CAAG,CAAA;AAAjB,wCAAc;yBAAd,cAAc;IAX1B,IAAA,eAAM,EAAC;QACN,OAAO,EAAE;YACP,gCAAc;YACd,kCAAe;YACf,sCAAiB;YACjB,yCAAkB;YAClB,sCAAiB;SAClB;QACD,SAAS,EAAE,CAAC,mCAAe,EAAE,6CAAyB,CAAC;QACvD,OAAO,EAAE,CAAC,mCAAe,CAAC;KAC3B,CAAC;GACW,cAAc,CAAG"}

package/dist/apps/monolith/apps/integrations/src/modules/auth-flow/auth-flow.service.d.ts

@@ -0,0 +1,52 @@
+import { ConfigService } from '@nestjs/config';
+import { EncryptionService } from '../credentials/encryption.service';
+import { TokenStoreService } from '../credentials/token-store.service';
+import { ConnectionsService } from '../connections/connections.service';
+import { MetadataStoreService } from '../platform/metadata-store.service';
+import { ProviderRegistry } from '../providers/provider.registry';
+import { ConnectionStatus, TokenSet } from '../providers/provider.types';
+import { TenantConfigService } from '../tenant-config/tenant-config.service';
+import { AppConfiguration } from '../../config/configuration';
+export interface InitiateAuthInput {
+    providerId: string;
+    tenantId: string;
+    redirectUri: string;
+    scopes?: string[];
+    userId?: string;
+}
+export interface InitiateAuthResult {
+    authorizeUrl: string;
+    connectionId: string;
+    state: string;
+}
+export interface CompleteAuthInput {
+    state: string;
+    code: string;
+}
+export interface CompleteAuthResult {
+    connectionId: string;
+    providerId: string;
+    status: ConnectionStatus;
+}
+export declare class AuthFlowService {
+    private readonly providerRegistry;
+    private readonly tenantConfig;
+    private readonly connections;
+    private readonly tokenStore;
+    private readonly encryption;
+    private readonly metadataStore;
+    private readonly configService;
+    private readonly logger;
+    private readonly authStateTtlMs;
+    private readonly refreshInFlight;
+    constructor(providerRegistry: ProviderRegistry, tenantConfig: TenantConfigService, connections: ConnectionsService, tokenStore: TokenStoreService, encryption: EncryptionService, metadataStore: MetadataStoreService, configService: ConfigService<AppConfiguration>);
+    initiateAuth(input: InitiateAuthInput): Promise<InitiateAuthResult>;
+    completeAuth(input: CompleteAuthInput): Promise<CompleteAuthResult>;
+    refreshCredentials(connectionId: string): Promise<TokenSet>;
+    private doRefresh;
+    revokeCredentials(connectionId: string): Promise<void>;
+    validateCredentials(connectionId: string): Promise<{
+        valid: boolean;
+        expiresAt?: number;
+    }>;
+}

package/dist/apps/monolith/apps/integrations/src/modules/auth-flow/auth-flow.service.js

@@ -0,0 +1,185 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var AuthFlowService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthFlowService = void 0;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+const node_crypto_1 = require("node:crypto");
+const encryption_service_1 = require("../credentials/encryption.service");
+const token_store_service_1 = require("../credentials/token-store.service");
+const connections_service_1 = require("../connections/connections.service");
+const metadata_store_service_1 = require("../platform/metadata-store.service");
+const provider_registry_1 = require("../providers/provider.registry");
+const provider_types_1 = require("../providers/provider.types");
+const tenant_config_service_1 = require("../tenant-config/tenant-config.service");
+let AuthFlowService = AuthFlowService_1 = class AuthFlowService {
+    providerRegistry;
+    tenantConfig;
+    connections;
+    tokenStore;
+    encryption;
+    metadataStore;
+    configService;
+    logger = new common_1.Logger(AuthFlowService_1.name);
+    authStateTtlMs;
+    refreshInFlight = new Map();
+    constructor(providerRegistry, tenantConfig, connections, tokenStore, encryption, metadataStore, configService) {
+        this.providerRegistry = providerRegistry;
+        this.tenantConfig = tenantConfig;
+        this.connections = connections;
+        this.tokenStore = tokenStore;
+        this.encryption = encryption;
+        this.metadataStore = metadataStore;
+        this.configService = configService;
+        this.authStateTtlMs =
+            this.configService.get('authStateTtlMs', { infer: true }) ??
+                600000;
+    }
+    async initiateAuth(input) {
+        const provider = this.providerRegistry.get(input.providerId);
+        const config = await this.tenantConfig.getFullConfig(input.tenantId, input.providerId);
+        const clientSecret = this.tenantConfig.decryptClientSecret(config);
+        const scopes = this.tenantConfig.resolveScopes(input.scopes, config.scopes, provider.metadata.defaultScopes);
+        const connection = await this.connections.create({
+            tenantId: input.tenantId,
+            providerId: input.providerId,
+            userId: input.userId,
+            status: provider_types_1.ConnectionStatus.Pending,
+        });
+        const codeVerifier = (0, node_crypto_1.randomBytes)(32).toString('hex');
+        const result = await provider.initiateAuth({
+            providerId: input.providerId,
+            tenantId: input.tenantId,
+            connectionId: connection.id,
+            redirectUri: input.redirectUri,
+            scopes,
+            clientId: config.clientId,
+            clientSecret,
+            codeVerifier,
+        });
+        const encryptedSecret = this.encryption.encrypt(clientSecret);
+        const authState = {
+            id: result.state,
+            connectionId: connection.id,
+            tenantId: input.tenantId,
+            providerId: input.providerId,
+            state: result.state,
+            codeVerifier: result.codeVerifier,
+            redirectUri: input.redirectUri,
+            clientId: config.clientId,
+            encryptedClientSecret: encryptedSecret.ciphertext,
+            clientSecretIv: encryptedSecret.iv,
+            clientSecretAuthTag: encryptedSecret.authTag,
+            scopes,
+            expiresAt: new Date(Date.now() + this.authStateTtlMs).toISOString(),
+            createdAt: new Date().toISOString(),
+        };
+        await this.metadataStore.upsert('AuthState', authState);
+        return {
+            authorizeUrl: result.authorizeUrl,
+            connectionId: connection.id,
+            state: result.state,
+        };
+    }
+    async completeAuth(input) {
+        const stateRecord = await this.metadataStore.getById('AuthState', input.state);
+        if (!stateRecord) {
+            throw new common_1.NotFoundException('Auth state not found or expired');
+        }
+        const authState = stateRecord;
+        if (new Date(authState.expiresAt) < new Date()) {
+            await this.metadataStore.remove('AuthState', input.state);
+            throw new common_1.BadRequestException('Auth state has expired');
+        }
+        const provider = this.providerRegistry.get(authState.providerId);
+        const clientSecret = this.encryption.decrypt(authState.encryptedClientSecret, authState.clientSecretIv, authState.clientSecretAuthTag);
+        const result = await provider.completeAuth({
+            providerId: authState.providerId,
+            tenantId: authState.tenantId,
+            connectionId: authState.connectionId,
+            redirectUri: authState.redirectUri,
+            code: input.code,
+            clientId: authState.clientId,
+            clientSecret,
+            codeVerifier: authState.codeVerifier,
+        });
+        await this.tokenStore.store(authState.connectionId, authState.tenantId, authState.providerId, result.tokenSet);
+        await this.connections.updateStatus(authState.connectionId, provider_types_1.ConnectionStatus.Active);
+        await this.metadataStore.remove('AuthState', input.state);
+        return {
+            connectionId: authState.connectionId,
+            providerId: authState.providerId,
+            status: provider_types_1.ConnectionStatus.Active,
+        };
+    }
+    async refreshCredentials(connectionId) {
+        const existing = this.refreshInFlight.get(connectionId);
+        if (existing) {
+            return existing;
+        }
+        const promise = this.doRefresh(connectionId).finally(() => {
+            this.refreshInFlight.delete(connectionId);
+        });
+        this.refreshInFlight.set(connectionId, promise);
+        return promise;
+    }
+    async doRefresh(connectionId) {
+        const connection = await this.connections.getById(connectionId);
+        const tokenSet = await this.tokenStore.retrieve(connectionId);
+        if (!tokenSet.refreshToken) {
+            throw new common_1.BadRequestException('No refresh token available');
+        }
+        const provider = this.providerRegistry.get(connection.providerId);
+        const config = await this.tenantConfig.getFullConfig(connection.tenantId, connection.providerId);
+        const clientSecret = this.tenantConfig.decryptClientSecret(config);
+        const newTokenSet = await provider.refreshToken(tokenSet.refreshToken, config.clientId, clientSecret);
+        await this.tokenStore.store(connectionId, connection.tenantId, connection.providerId, newTokenSet);
+        await this.connections.updateStatus(connectionId, provider_types_1.ConnectionStatus.Active);
+        return newTokenSet;
+    }
+    async revokeCredentials(connectionId) {
+        const connection = await this.connections.getById(connectionId);
+        try {
+            const tokenSet = await this.tokenStore.retrieve(connectionId);
+            const provider = this.providerRegistry.get(connection.providerId);
+            const config = await this.tenantConfig.getFullConfig(connection.tenantId, connection.providerId);
+            const clientSecret = this.tenantConfig.decryptClientSecret(config);
+            await provider.revokeToken(tokenSet.accessToken, config.clientId, clientSecret);
+        }
+        catch (error) {
+            this.logger.warn(`Failed to revoke token for connection ${connectionId}: ${error}`);
+        }
+        await this.tokenStore.remove(connectionId);
+        await this.connections.updateStatus(connectionId, provider_types_1.ConnectionStatus.Revoked);
+    }
+    async validateCredentials(connectionId) {
+        const tokenSet = await this.tokenStore.retrieve(connectionId);
+        if (!tokenSet.expiresAt) {
+            return { valid: true };
+        }
+        const now = Math.floor(Date.now() / 1000);
+        const valid = tokenSet.expiresAt > now;
+        return { valid, expiresAt: tokenSet.expiresAt };
+    }
+};
+exports.AuthFlowService = AuthFlowService;
+exports.AuthFlowService = AuthFlowService = AuthFlowService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [provider_registry_1.ProviderRegistry,
+        tenant_config_service_1.TenantConfigService,
+        connections_service_1.ConnectionsService,
+        token_store_service_1.TokenStoreService,
+        encryption_service_1.EncryptionService,
+        metadata_store_service_1.MetadataStoreService,
+        config_1.ConfigService])
+], AuthFlowService);
+//# sourceMappingURL=auth-flow.service.js.map

package/dist/apps/monolith/apps/integrations/src/modules/auth-flow/auth-flow.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-flow.service.js","sourceRoot":"","sources":["../../../../../../../../apps/integrations/src/modules/auth-flow/auth-flow.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAKwB;AACxB,2CAA+C;AAC/C,6CAA0C;AAC1C,0EAAsE;AACtE,4EAAuE;AACvE,4EAAwE;AACxE,+EAA0E;AAC1E,sEAAkE;AAClE,gEAIqC;AACrC,kFAA6E;AA6BtE,IAAM,eAAe,uBAArB,MAAM,eAAe;IAMP;IACA;IACA;IACA;IACA;IACA;IACA;IAXF,MAAM,GAAG,IAAI,eAAM,CAAC,iBAAe,CAAC,IAAI,CAAC,CAAC;IAC1C,cAAc,CAAS;IACvB,eAAe,GAAG,IAAI,GAAG,EAA6B,CAAC;IAExE,YACmB,gBAAkC,EAClC,YAAiC,EACjC,WAA+B,EAC/B,UAA6B,EAC7B,UAA6B,EAC7B,aAAmC,EACnC,aAA8C;QAN9C,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,iBAAY,GAAZ,YAAY,CAAqB;QACjC,gBAAW,GAAX,WAAW,CAAoB;QAC/B,eAAU,GAAV,UAAU,CAAmB;QAC7B,eAAU,GAAV,UAAU,CAAmB;QAC7B,kBAAa,GAAb,aAAa,CAAsB;QACnC,kBAAa,GAAb,aAAa,CAAiC;QAE/D,IAAI,CAAC,cAAc;YACjB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAS,gBAAgB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;gBACjE,MAAM,CAAC;IACX,CAAC;IAEM,KAAK,CAAC,YAAY,CACvB,KAAwB;QAExB,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,CAClD,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,UAAU,CACjB,CAAC;QAEF,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,aAAa,CAC5C,KAAK,CAAC,MAAM,EACZ,MAAM,CAAC,MAAM,EACb,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAChC,CAAC;QAEF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;YAC/C,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,iCAAgB,CAAC,OAAO;SACjC,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAErD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC;YACzC,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,UAAU,CAAC,EAAE;YAC3B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM;YACN,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,YAAY;YACZ,YAAY;SACb,CAAC,CAAC;QAEH,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAE9D,MAAM,SAAS,GAAkB;YAC/B,EAAE,EAAE,MAAM,CAAC,KAAK;YAChB,YAAY,EAAE,UAAU,CAAC,EAAE;YAC3B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,qBAAqB,EAAE,eAAe,CAAC,UAAU;YACjD,cAAc,EAAE,eAAe,CAAC,EAAE;YAClC,mBAAmB,EAAE,eAAe,CAAC,OAAO;YAC5C,MAAM;YACN,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE;YACnE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAExD,OAAO;YACL,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,YAAY,EAAE,UAAU,CAAC,EAAE;YAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,YAAY,CACvB,KAAwB;QAExB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAClD,WAAW,EACX,KAAK,CAAC,KAAK,CACZ,CAAC;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,0BAAiB,CAAC,iCAAiC,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,SAAS,GAAG,WAAuC,CAAC;QAE1D,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YAC/C,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1D,MAAM,IAAI,4BAAmB,CAAC,wBAAwB,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACjE,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAC1C,SAAS,CAAC,qBAAqB,EAC/B,SAAS,CAAC,cAAc,EACxB,SAAS,CAAC,mBAAmB,CAC9B,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC;YACzC,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,YAAY,EAAE,SAAS,CAAC,YAAY;YACpC,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,YAAY;YACZ,YAAY,EAAE,SAAS,CAAC,YAAY;SACrC,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACzB,SAAS,CAAC,YAAY,EACtB,SAAS,CAAC,QAAQ,EAClB,SAAS,CAAC,UAAU,EACpB,MAAM,CAAC,QAAQ,CAChB,CAAC;QAEF,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CACjC,SAAS,CAAC,YAAY,EACtB,iCAAgB,CAAC,MAAM,CACxB,CAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAE1D,OAAO;YACL,YAAY,EAAE,SAAS,CAAC,YAAY;YACpC,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,MAAM,EAAE,iCAAgB,CAAC,MAAM;SAChC,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAAC,YAAoB;QAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACxD,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAChD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,YAAoB;QAC1C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAE9D,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC3B,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,CAClD,UAAU,CAAC,QAAQ,EACnB,UAAU,CAAC,UAAU,CACtB,CAAC;QACF,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAEnE,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,YAAY,CAC7C,QAAQ,CAAC,YAAY,EACrB,MAAM,CAAC,QAAQ,EACf,YAAY,CACb,CAAC;QAEF,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACzB,YAAY,EACZ,UAAU,CAAC,QAAQ,EACnB,UAAU,CAAC,UAAU,EACrB,WAAW,CACZ,CAAC;QAEF,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,YAAY,EAAE,iCAAgB,CAAC,MAAM,CAAC,CAAC;QAE3E,OAAO,WAAW,CAAC;IACrB,CAAC;IAEM,KAAK,CAAC,iBAAiB,CAAC,YAAoB;QACjD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAEhE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAClE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,CAClD,UAAU,CAAC,QAAQ,EACnB,UAAU,CAAC,UAAU,CACtB,CAAC;YACF,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;YAEnE,MAAM,QAAQ,CAAC,WAAW,CACxB,QAAQ,CAAC,WAAW,EACpB,MAAM,CAAC,QAAQ,EACf,YAAY,CACb,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,yCAAyC,YAAY,KAAK,KAAK,EAAE,CAClE,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC3C,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,YAAY,EAAE,iCAAgB,CAAC,OAAO,CAAC,CAAC;IAC9E,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAC9B,YAAoB;QAEpB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAE9D,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;YACxB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACzB,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,GAAG,GAAG,CAAC;QAEvC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;IAClD,CAAC;CACF,CAAA;AAnOY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,GAAE;qCAO0B,oCAAgB;QACpB,2CAAmB;QACpB,wCAAkB;QACnB,uCAAiB;QACjB,sCAAiB;QACd,6CAAoB;QACpB,sBAAa;GAZpC,eAAe,CAmO3B"}

package/dist/apps/monolith/apps/integrations/src/modules/auth-flow/scheduler.service.d.ts

@@ -0,0 +1,14 @@
+import { OnModuleDestroy, OnModuleInit } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { MetadataStoreService } from '../platform/metadata-store.service';
+import { AppConfiguration } from '../../config/configuration';
+export declare class AuthStateSchedulerService implements OnModuleInit, OnModuleDestroy {
+    private readonly configService;
+    private readonly metadataStore;
+    private readonly logger;
+    private intervalHandle;
+    constructor(configService: ConfigService<AppConfiguration>, metadataStore: MetadataStoreService);
+    onModuleInit(): void;
+    onModuleDestroy(): void;
+    cleanExpiredAuthStates(): Promise<number>;
+}

package/dist/apps/monolith/apps/integrations/src/modules/auth-flow/scheduler.service.js

@@ -0,0 +1,69 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var AuthStateSchedulerService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthStateSchedulerService = void 0;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+const metadata_store_service_1 = require("../platform/metadata-store.service");
+let AuthStateSchedulerService = AuthStateSchedulerService_1 = class AuthStateSchedulerService {
+    configService;
+    metadataStore;
+    logger = new common_1.Logger(AuthStateSchedulerService_1.name);
+    intervalHandle = null;
+    constructor(configService, metadataStore) {
+        this.configService = configService;
+        this.metadataStore = metadataStore;
+    }
+    onModuleInit() {
+        const enabled = this.configService.get('schedulerEnabled', { infer: true }) ??
+            true;
+        if (!enabled) {
+            this.logger.log('Auth state cleanup scheduler is disabled');
+            return;
+        }
+        const intervalMs = this.configService.get('schedulerIntervalMs', { infer: true }) ??
+            300000;
+        this.logger.log(`Starting auth state cleanup scheduler (interval=${intervalMs}ms)`);
+        this.intervalHandle = setInterval(() => {
+            void this.cleanExpiredAuthStates();
+        }, intervalMs);
+    }
+    onModuleDestroy() {
+        if (this.intervalHandle) {
+            clearInterval(this.intervalHandle);
+            this.intervalHandle = null;
+        }
+    }
+    async cleanExpiredAuthStates() {
+        const states = await this.metadataStore.list('AuthState');
+        const now = new Date();
+        let cleaned = 0;
+        for (const state of states) {
+            const authState = state;
+            if (authState.expiresAt && new Date(authState.expiresAt) < now) {
+                await this.metadataStore.remove('AuthState', authState.id);
+                cleaned++;
+            }
+        }
+        if (cleaned > 0) {
+            this.logger.log(`Cleaned ${cleaned} expired auth state(s)`);
+        }
+        return cleaned;
+    }
+};
+exports.AuthStateSchedulerService = AuthStateSchedulerService;
+exports.AuthStateSchedulerService = AuthStateSchedulerService = AuthStateSchedulerService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [config_1.ConfigService,
+        metadata_store_service_1.MetadataStoreService])
+], AuthStateSchedulerService);
+//# sourceMappingURL=scheduler.service.js.map

package/dist/apps/monolith/apps/integrations/src/modules/auth-flow/scheduler.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scheduler.service.js","sourceRoot":"","sources":["../../../../../../../../apps/integrations/src/modules/auth-flow/scheduler.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAKwB;AACxB,2CAA+C;AAC/C,+EAA0E;AAKnE,IAAM,yBAAyB,iCAA/B,MAAM,yBAAyB;IAOjB;IACA;IALF,MAAM,GAAG,IAAI,eAAM,CAAC,2BAAyB,CAAC,IAAI,CAAC,CAAC;IAC7D,cAAc,GAA0C,IAAI,CAAC;IAErE,YACmB,aAA8C,EAC9C,aAAmC;QADnC,kBAAa,GAAb,aAAa,CAAiC;QAC9C,kBAAa,GAAb,aAAa,CAAsB;IACnD,CAAC;IAEG,YAAY;QACjB,MAAM,OAAO,GACX,IAAI,CAAC,aAAa,CAAC,GAAG,CAAU,kBAAkB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACpE,IAAI,CAAC;QAEP,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GACd,IAAI,CAAC,aAAa,CAAC,GAAG,CAAS,qBAAqB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACtE,MAAM,CAAC;QAET,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,mDAAmD,UAAU,KAAK,CACnE,CAAC;QAEF,IAAI,CAAC,cAAc,GAAG,WAAW,CAAC,GAAG,EAAE;YACrC,KAAK,IAAI,CAAC,sBAAsB,EAAE,CAAC;QACrC,CAAC,EAAE,UAAU,CAAC,CAAC;IACjB,CAAC;IAEM,eAAe;QACpB,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACnC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC7B,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,sBAAsB;QACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,OAAO,GAAG,CAAC,CAAC;QAEhB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG,KAAiC,CAAC;YACpD,IAAI,SAAS,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,GAAG,EAAE,CAAC;gBAC/D,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;gBAC3D,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QAED,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,OAAO,wBAAwB,CAAC,CAAC;QAC9D,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAA;AA5DY,8DAAyB;oCAAzB,yBAAyB;IADrC,IAAA,mBAAU,GAAE;qCAQuB,sBAAa;QACb,6CAAoB;GAR3C,yBAAyB,CA4DrC"}

package/dist/apps/monolith/apps/integrations/src/modules/connections/connections.module.d.ts

@@ -0,0 +1,2 @@
+export declare class ConnectionsModule {
+}

package/dist/apps/monolith/apps/integrations/src/modules/connections/connections.module.js

@@ -0,0 +1,24 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConnectionsModule = void 0;
+const common_1 = require("@nestjs/common");
+const credentials_module_1 = require("../credentials/credentials.module");
+const platform_module_1 = require("../platform/platform.module");
+const connections_service_1 = require("./connections.service");
+let ConnectionsModule = class ConnectionsModule {
+};
+exports.ConnectionsModule = ConnectionsModule;
+exports.ConnectionsModule = ConnectionsModule = __decorate([
+    (0, common_1.Module)({
+        imports: [platform_module_1.PlatformModule, credentials_module_1.CredentialsModule],
+        providers: [connections_service_1.ConnectionsService],
+        exports: [connections_service_1.ConnectionsService],
+    })
+], ConnectionsModule);
+//# sourceMappingURL=connections.module.js.map

package/dist/apps/monolith/apps/integrations/src/modules/connections/connections.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connections.module.js","sourceRoot":"","sources":["../../../../../../../../apps/integrations/src/modules/connections/connections.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,0EAAsE;AACtE,iEAA6D;AAC7D,+DAA2D;AAOpD,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;CAAG,CAAA;AAApB,8CAAiB;4BAAjB,iBAAiB;IAL7B,IAAA,eAAM,EAAC;QACN,OAAO,EAAE,CAAC,gCAAc,EAAE,sCAAiB,CAAC;QAC5C,SAAS,EAAE,CAAC,wCAAkB,CAAC;QAC/B,OAAO,EAAE,CAAC,wCAAkB,CAAC;KAC9B,CAAC;GACW,iBAAiB,CAAG"}

package/dist/apps/monolith/apps/integrations/src/modules/connections/connections.service.d.ts

@@ -0,0 +1,31 @@
+import { TokenStoreService } from '../credentials/token-store.service';
+import { MetadataStoreService } from '../platform/metadata-store.service';
+import { ConnectionData, ConnectionStatus } from '../providers/provider.types';
+export interface CreateConnectionInput {
+    tenantId: string;
+    providerId: string;
+    userId?: string;
+    status?: ConnectionStatus;
+    metadata?: Record<string, unknown>;
+}
+export interface ListConnectionsFilters {
+    tenantId?: string;
+    providerId?: string;
+    status?: string;
+    limit?: number;
+    offset?: number;
+}
+export declare class ConnectionsService {
+    private readonly metadataStore;
+    private readonly tokenStore;
+    private readonly logger;
+    constructor(metadataStore: MetadataStoreService, tokenStore: TokenStoreService);
+    create(input: CreateConnectionInput): Promise<ConnectionData>;
+    getById(id: string): Promise<ConnectionData>;
+    list(filters: ListConnectionsFilters): Promise<ConnectionData[]>;
+    updateStatus(id: string, status: ConnectionStatus): Promise<ConnectionData>;
+    remove(id: string): Promise<{
+        success: boolean;
+        id: string;
+    }>;
+}

package/dist/apps/monolith/apps/integrations/src/modules/connections/connections.service.js

@@ -0,0 +1,91 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var ConnectionsService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConnectionsService = void 0;
+const common_1 = require("@nestjs/common");
+const node_crypto_1 = require("node:crypto");
+const token_store_service_1 = require("../credentials/token-store.service");
+const metadata_store_service_1 = require("../platform/metadata-store.service");
+const provider_types_1 = require("../providers/provider.types");
+let ConnectionsService = ConnectionsService_1 = class ConnectionsService {
+    metadataStore;
+    tokenStore;
+    logger = new common_1.Logger(ConnectionsService_1.name);
+    constructor(metadataStore, tokenStore) {
+        this.metadataStore = metadataStore;
+        this.tokenStore = tokenStore;
+    }
+    async create(input) {
+        const now = new Date().toISOString();
+        const connection = {
+            id: (0, node_crypto_1.randomUUID)(),
+            tenantId: input.tenantId,
+            providerId: input.providerId,
+            userId: input.userId,
+            status: input.status ?? provider_types_1.ConnectionStatus.Pending,
+            metadata: input.metadata,
+            createdAt: now,
+            updatedAt: now,
+        };
+        await this.metadataStore.upsert('Connection', connection);
+        return connection;
+    }
+    async getById(id) {
+        const record = await this.metadataStore.getById('Connection', id);
+        if (!record) {
+            throw new common_1.NotFoundException(`Connection/${id} not found`);
+        }
+        return record;
+    }
+    async list(filters) {
+        const queryFilters = {};
+        if (filters.tenantId) {
+            queryFilters.tenantId = filters.tenantId;
+        }
+        if (filters.providerId) {
+            queryFilters.providerId = filters.providerId;
+        }
+        if (filters.status) {
+            queryFilters.status = filters.status;
+        }
+        const records = await this.metadataStore.list('Connection', {
+            filters: Object.keys(queryFilters).length > 0 ? queryFilters : undefined,
+            limit: filters.limit,
+            offset: filters.offset,
+        });
+        return records;
+    }
+    async updateStatus(id, status) {
+        const connection = await this.getById(id);
+        const updated = {
+            ...connection,
+            status,
+            updatedAt: new Date().toISOString(),
+        };
+        await this.metadataStore.upsert('Connection', updated);
+        return updated;
+    }
+    async remove(id) {
+        await this.tokenStore.remove(id).catch((err) => {
+            this.logger.warn(`Failed to remove credentials for connection ${id}: ${String(err)}`);
+        });
+        const deleted = await this.metadataStore.remove('Connection', id);
+        return { success: deleted, id };
+    }
+};
+exports.ConnectionsService = ConnectionsService;
+exports.ConnectionsService = ConnectionsService = ConnectionsService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [metadata_store_service_1.MetadataStoreService,
+        token_store_service_1.TokenStoreService])
+], ConnectionsService);
+//# sourceMappingURL=connections.service.js.map

package/dist/apps/monolith/apps/integrations/src/modules/connections/connections.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connections.service.js","sourceRoot":"","sources":["../../../../../../../../apps/integrations/src/modules/connections/connections.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAAuE;AACvE,6CAAyC;AACzC,4EAAuE;AACvE,+EAA0E;AAC1E,gEAA+E;AAmBxE,IAAM,kBAAkB,0BAAxB,MAAM,kBAAkB;IAIV;IACA;IAJF,MAAM,GAAG,IAAI,eAAM,CAAC,oBAAkB,CAAC,IAAI,CAAC,CAAC;IAE9D,YACmB,aAAmC,EACnC,UAA6B;QAD7B,kBAAa,GAAb,aAAa,CAAsB;QACnC,eAAU,GAAV,UAAU,CAAmB;IAC7C,CAAC;IAEG,KAAK,CAAC,MAAM,CAAC,KAA4B;QAC9C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAErC,MAAM,UAAU,GAAmB;YACjC,EAAE,EAAE,IAAA,wBAAU,GAAE;YAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,iCAAgB,CAAC,OAAO;YAChD,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;SACf,CAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAC1D,OAAO,UAAU,CAAC;IACpB,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,EAAU;QAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,0BAAiB,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;QAC5D,CAAC;QAED,OAAO,MAAmC,CAAC;IAC7C,CAAC;IAEM,KAAK,CAAC,IAAI,CACf,OAA+B;QAE/B,MAAM,YAAY,GAA2B,EAAE,CAAC;QAEhD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,YAAY,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAC3C,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,YAAY,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QAC/C,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,YAAY,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QACvC,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,YAAY,EAAE;YAC1D,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;YACxE,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;QAEH,OAAO,OAAsC,CAAC;IAChD,CAAC;IAEM,KAAK,CAAC,YAAY,CACvB,EAAU,EACV,MAAwB;QAExB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAE1C,MAAM,OAAO,GAAmB;YAC9B,GAAG,UAAU;YACb,MAAM;YACN,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QAEF,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACvD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,EAAU;QAC5B,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,+CAA+C,EAAE,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE,CACpE,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAElE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAClC,CAAC;CACF,CAAA;AArFY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,mBAAU,GAAE;qCAKuB,6CAAoB;QACvB,uCAAiB;GALrC,kBAAkB,CAqF9B"}

package/dist/apps/monolith/apps/integrations/src/modules/credentials/credentials.module.d.ts

@@ -0,0 +1,2 @@
+export declare class CredentialsModule {
+}

package/dist/apps/monolith/apps/integrations/src/modules/credentials/credentials.module.js

@@ -0,0 +1,24 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CredentialsModule = void 0;
+const common_1 = require("@nestjs/common");
+const platform_module_1 = require("../platform/platform.module");
+const encryption_service_1 = require("./encryption.service");
+const token_store_service_1 = require("./token-store.service");
+let CredentialsModule = class CredentialsModule {
+};
+exports.CredentialsModule = CredentialsModule;
+exports.CredentialsModule = CredentialsModule = __decorate([
+    (0, common_1.Module)({
+        imports: [platform_module_1.PlatformModule],
+        providers: [encryption_service_1.EncryptionService, token_store_service_1.TokenStoreService],
+        exports: [encryption_service_1.EncryptionService, token_store_service_1.TokenStoreService],
+    })
+], CredentialsModule);
+//# sourceMappingURL=credentials.module.js.map

package/dist/apps/monolith/apps/integrations/src/modules/credentials/credentials.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.module.js","sourceRoot":"","sources":["../../../../../../../../apps/integrations/src/modules/credentials/credentials.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,iEAA6D;AAC7D,6DAAyD;AACzD,+DAA0D;AAOnD,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;CAAG,CAAA;AAApB,8CAAiB;4BAAjB,iBAAiB;IAL7B,IAAA,eAAM,EAAC;QACN,OAAO,EAAE,CAAC,gCAAc,CAAC;QACzB,SAAS,EAAE,CAAC,sCAAiB,EAAE,uCAAiB,CAAC;QACjD,OAAO,EAAE,CAAC,sCAAiB,EAAE,uCAAiB,CAAC;KAChD,CAAC;GACW,iBAAiB,CAAG"}

package/dist/apps/monolith/apps/integrations/src/modules/credentials/encryption.service.d.ts

@@ -0,0 +1,14 @@
+import { ConfigService } from '@nestjs/config';
+import { AppConfiguration } from '../../config/configuration';
+export interface EncryptedPayload {
+    ciphertext: string;
+    iv: string;
+    authTag: string;
+}
+export declare class EncryptionService {
+    private readonly logger;
+    private readonly key;
+    constructor(configService: ConfigService<AppConfiguration>);
+    encrypt(plaintext: string): EncryptedPayload;
+    decrypt(ciphertext: string, iv: string, authTag: string): string;
+}

package/dist/apps/monolith/apps/integrations/src/modules/credentials/encryption.service.js

@@ -0,0 +1,62 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var EncryptionService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EncryptionService = void 0;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+const node_crypto_1 = require("node:crypto");
+let EncryptionService = EncryptionService_1 = class EncryptionService {
+    logger = new common_1.Logger(EncryptionService_1.name);
+    key;
+    constructor(configService) {
+        const rawKey = configService.get('encryptionKey', { infer: true });
+        if (!rawKey) {
+            this.logger.warn('ENCRYPTION_KEY not set — using default dev key. Do NOT use this in production!');
+        }
+        this.key = (0, node_crypto_1.createHash)('sha256')
+            .update(rawKey ?? 'default-dev-encryption-key-change-me')
+            .digest();
+    }
+    encrypt(plaintext) {
+        const iv = (0, node_crypto_1.randomBytes)(12);
+        const cipher = (0, node_crypto_1.createCipheriv)('aes-256-gcm', this.key, iv);
+        const encrypted = Buffer.concat([
+            cipher.update(plaintext, 'utf8'),
+            cipher.final(),
+        ]);
+        return {
+            ciphertext: encrypted.toString('base64'),
+            iv: iv.toString('base64'),
+            authTag: cipher.getAuthTag().toString('base64'),
+        };
+    }
+    decrypt(ciphertext, iv, authTag) {
+        try {
+            const decipher = (0, node_crypto_1.createDecipheriv)('aes-256-gcm', this.key, Buffer.from(iv, 'base64'));
+            decipher.setAuthTag(Buffer.from(authTag, 'base64'));
+            const decrypted = Buffer.concat([
+                decipher.update(Buffer.from(ciphertext, 'base64')),
+                decipher.final(),
+            ]);
+            return decrypted.toString('utf8');
+        }
+        catch (error) {
+            throw new Error(`Decryption failed — data may be corrupted or the encryption key may have changed: ${String(error)}`);
+        }
+    }
+};
+exports.EncryptionService = EncryptionService;
+exports.EncryptionService = EncryptionService = EncryptionService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [config_1.ConfigService])
+], EncryptionService);
+//# sourceMappingURL=encryption.service.js.map

package/dist/apps/monolith/apps/integrations/src/modules/credentials/encryption.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.service.js","sourceRoot":"","sources":["../../../../../../../../apps/integrations/src/modules/credentials/encryption.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAAoD;AACpD,2CAA+C;AAC/C,6CAKqB;AAUd,IAAM,iBAAiB,yBAAvB,MAAM,iBAAiB;IACX,MAAM,GAAG,IAAI,eAAM,CAAC,mBAAiB,CAAC,IAAI,CAAC,CAAC;IAC5C,GAAG,CAAS;IAE7B,YAAmB,aAA8C;QAC/D,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAS,eAAe,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,gFAAgF,CACjF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC;aAC5B,MAAM,CAAC,MAAM,IAAI,sCAAsC,CAAC;aACxD,MAAM,EAAE,CAAC;IACd,CAAC;IAEM,OAAO,CAAC,SAAiB;QAC9B,MAAM,EAAE,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,IAAA,4BAAc,EAAC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAE3D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC;YAChC,MAAM,CAAC,KAAK,EAAE;SACf,CAAC,CAAC;QAEH,OAAO;YACL,UAAU,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACxC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACzB,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;SAChD,CAAC;IACJ,CAAC;IAEM,OAAO,CAAC,UAAkB,EAAE,EAAU,EAAE,OAAe;QAC5D,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAA,8BAAgB,EAC/B,aAAa,EACb,IAAI,CAAC,GAAG,EACR,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAC1B,CAAC;YACF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;YAEpD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC9B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;gBAClD,QAAQ,CAAC,KAAK,EAAE;aACjB,CAAC,CAAC;YAEH,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,qFAAqF,MAAM,CAAC,KAAK,CAAC,EAAE,CACrG,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAA;AArDY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;qCAKuB,sBAAa;GAJpC,iBAAiB,CAqD7B"}

package/dist/apps/monolith/apps/integrations/src/modules/credentials/token-store.service.d.ts

@@ -0,0 +1,12 @@
+import { MetadataStoreService } from '../platform/metadata-store.service';
+import { TokenSet } from '../providers/provider.types';
+import { EncryptionService } from './encryption.service';
+export declare class TokenStoreService {
+    private readonly metadataStore;
+    private readonly encryption;
+    private readonly logger;
+    constructor(metadataStore: MetadataStoreService, encryption: EncryptionService);
+    store(connectionId: string, tenantId: string, providerId: string, tokenSet: TokenSet): Promise<void>;
+    retrieve(connectionId: string): Promise<TokenSet>;
+    remove(connectionId: string): Promise<boolean>;
+}