@almadar/integrations 2.22.0 → 2.23.0

package/dist/runtime/index.js

@@ -1,11 +1,216 @@
-import { createRequire } from 'module';
 import { createLogger } from '@almadar/logger';
 import { integratorsRegistry } from '@almadar/core/patterns';
+import Stripe2 from 'stripe';
+import { google } from 'googleapis';
+import twilio from 'twilio';
+import sgMail from '@sendgrid/mail';
+import { Resend } from 'resend';
+import { getAvailableProvider, LLMClient, EmbeddingClient } from '@almadar/llm';
+import { z } from 'zod';
+import { execSync, spawn } from 'child_process';
+import { mkdtempSync, writeFileSync, rmSync, promises } from 'fs';
+import { join } from 'path';
+import { tmpdir } from 'os';
+import { Pool } from 'pg';
+import { createRequire } from 'module';
 
-// src/runtime/RuntimeIntegrationManager.ts
+// src/types.ts
+var IntegrationError = class extends Error {
+  constructor(message, code = "UNKNOWN_ERROR", details) {
+    super(message);
+    this.name = "IntegrationError";
+    this.code = code;
+    this.details = details;
+  }
+  toJSON() {
+    return {
+      name: this.name,
+      message: this.message,
+      code: this.code,
+      integration: this.integration,
+      action: this.action,
+      details: this.details
+    };
+  }
+};
+var ConsoleLogger = class {
+  constructor(_level = "info") {
+    this.log = createLogger("almadar:integrations");
+  }
+  debug(message, meta) {
+    this.log.debug(message, meta);
+  }
+  info(message, meta) {
+    this.log.info(message, meta);
+  }
+  warn(message, meta) {
+    this.log.warn(message, meta);
+  }
+  error(message, meta) {
+    this.log.error(message, meta);
+  }
+};
+function validateParams(integration, action, params) {
+  const typedRegistry = integratorsRegistry;
+  const registry = typedRegistry.integrators[integration];
+  if (!registry) {
+    return {
+      valid: false,
+      errors: [
+        {
+          param: "integration",
+          message: `Unknown integration: ${integration}`
+        }
+      ]
+    };
+  }
+  const actionDef = registry.actions.find((a) => a.name === action);
+  if (!actionDef) {
+    return {
+      valid: false,
+      errors: [{ param: "action", message: `Unknown action: ${action}` }]
+    };
+  }
+  const errors = [];
+  for (const paramDef of actionDef.params) {
+    if (paramDef.required && !(paramDef.name in params)) {
+      errors.push({
+        param: paramDef.name,
+        message: `Missing required parameter: ${paramDef.name}`
+      });
+    }
+    if (paramDef.name in params) {
+      const value = params[paramDef.name];
+      const expectedType = paramDef.type;
+      const actualType = typeof value;
+      if (expectedType === "number" && actualType !== "number") {
+        errors.push({
+          param: paramDef.name,
+          message: `Expected ${expectedType}, got ${actualType}`
+        });
+      }
+      if (expectedType === "string" && actualType !== "string") {
+        errors.push({
+          param: paramDef.name,
+          message: `Expected ${expectedType}, got ${actualType}`
+        });
+      }
+      if (expectedType === "array" && !Array.isArray(value)) {
+        errors.push({
+          param: paramDef.name,
+          message: `Expected array, got ${actualType}`
+        });
+      }
+      if (expectedType === "object" && (actualType !== "object" || Array.isArray(value) || value === null)) {
+        errors.push({
+          param: paramDef.name,
+          message: `Expected object, got ${actualType}`
+        });
+      }
+    }
+  }
+  return {
+    valid: errors.length === 0,
+    errors
+  };
+}
+
+// src/core/retry.ts
+async function withRetry(fn, config) {
+  const {
+    maxAttempts,
+    backoffMs,
+    maxBackoffMs = 3e4,
+    retryableErrors
+  } = config;
+  let lastError;
+  for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+    try {
+      return await fn();
+    } catch (error) {
+      lastError = error;
+      if (error && typeof error === "object" && "code" in error && retryableErrors) {
+        const integrationError = error;
+        if (!retryableErrors.includes(integrationError.code)) {
+          throw error;
+        }
+      }
+      if (attempt === maxAttempts) {
+        throw error;
+      }
+      const delay = Math.min(
+        backoffMs * Math.pow(2, attempt - 1),
+        maxBackoffMs
+      );
+      await new Promise((resolve) => setTimeout(resolve, delay));
+    }
+  }
+  throw lastError;
+}
+
+// src/core/BaseIntegration.ts
+var BaseIntegration = class {
+  constructor(config) {
+    this.config = config;
+    this.logger = config.logger || new ConsoleLogger();
+  }
+  /**
+   * Validate action params against registry
+   */
+  validateParams(action, params) {
+    return validateParams(this.config.name, action, params);
+  }
+  /**
+   * Handle errors uniformly
+   */
+  handleError(action, error) {
+    this.logger.error(`Integration error in ${this.config.name}.${action}`, {
+      error: error instanceof Error ? error : new Error(String(error))
+    });
+    const integrationError = error instanceof Error ? error : new Error(String(error));
+    return {
+      success: false,
+      error: integrationError,
+      metadata: this.createMetadata(action, 0, 0)
+    };
+  }
+  /**
+   * Create metadata for result
+   */
+  createMetadata(action, duration, retries = 0) {
+    return {
+      integration: this.config.name,
+      action,
+      duration,
+      retries,
+      timestamp: Date.now()
+    };
+  }
+  /**
+   * Execute with retry logic
+   */
+  async executeWithRetry(fn) {
+    if (!this.config.retry) {
+      return fn();
+    }
+    return withRetry(fn, {
+      maxAttempts: this.config.retry.maxAttempts,
+      backoffMs: this.config.retry.backoffMs,
+      maxBackoffMs: this.config.retry.maxBackoffMs,
+      retryableErrors: [
+        "TIMEOUT_ERROR",
+        "NETWORK_ERROR",
+        "RATE_LIMIT_ERROR"
+      ]
+    });
+  }
+};
 
 // src/registry.ts
 var INTEGRATION_REGISTRY = {};
+function registerIntegration(name, constructor) {
+  INTEGRATION_REGISTRY[name] = constructor;
+}
 function getIntegration(name) {
   return INTEGRATION_REGISTRY[name];
 }
@@ -76,198 +281,3270 @@ var IntegrationFactory = class {
     this.configs.clear();
   }
 };
-var ConsoleLogger = class {
-  constructor(_level = "info") {
-    this.log = createLogger("almadar:integrations");
+
+// src/integrations/stripe/index.ts
+var STRIPE_API_VERSION = "2025-02-24.acacia";
+function isoFromUnix(seconds) {
+  return new Date(seconds * 1e3).toISOString();
+}
+function priceToTier(priceId, prices) {
+  if (priceId === prices.solo) return "solo";
+  if (priceId === prices.teams) return "teams";
+  return null;
+}
+function mapStatus(status) {
+  switch (status) {
+    case "active":
+    case "past_due":
+    case "canceled":
+    case "incomplete":
+    case "incomplete_expired":
+    case "trialing":
+    case "unpaid":
+      return status;
+    case "paused":
+      return "unpaid";
+    default: {
+      return "incomplete";
+    }
   }
-  debug(message, meta) {
-    this.log.debug(message, meta);
+}
+function shapeSubscription(sub, prices) {
+  const firstItem = sub.items.data[0];
+  const priceId = firstItem?.price.id ?? "";
+  const quantity = firstItem?.quantity ?? 1;
+  const customerId = typeof sub.customer === "string" ? sub.customer : sub.customer.id;
+  return {
+    subscriptionId: sub.id,
+    customerId,
+    status: mapStatus(sub.status),
+    priceId,
+    quantity,
+    currentPeriodStart: isoFromUnix(sub.current_period_start),
+    currentPeriodEnd: isoFromUnix(sub.current_period_end),
+    cancelAtPeriodEnd: sub.cancel_at_period_end,
+    tier: priceToTier(priceId, prices)
+  };
+}
+function shapeCustomer(customer) {
+  return {
+    customerId: customer.id,
+    email: customer.email ?? null,
+    almadarUid: customer.metadata?.almadarUid ?? null
+  };
+}
+var StripeIntegration = class extends BaseIntegration {
+  constructor(config) {
+    super(config);
+    const apiKey = config.env.STRIPE_SECRET_KEY;
+    if (!apiKey) {
+      throw new Error("STRIPE_SECRET_KEY not configured");
+    }
+    this.client = new Stripe2(apiKey, {
+      apiVersion: STRIPE_API_VERSION
+    });
+    this.prices = {
+      solo: config.env.STRIPE_PRICE_SOLO ?? "",
+      teams: config.env.STRIPE_PRICE_TEAMS ?? ""
+    };
+    this.logger.info("Stripe integration initialized");
   }
-  info(message, meta) {
-    this.log.info(message, meta);
+  /** Provisioned Price IDs the integration was constructed with. */
+  getPrices() {
+    return this.prices;
   }
-  warn(message, meta) {
-    this.log.warn(message, meta);
+  async execute(action, params) {
+    const validation = this.validateParams(action, params);
+    if (!validation.valid) {
+      return {
+        success: false,
+        error: {
+          name: "IntegrationError",
+          message: "Validation failed",
+          code: "VALIDATION_ERROR",
+          details: validation.errors
+        },
+        metadata: this.createMetadata(action, 0)
+      };
+    }
+    const startTime = Date.now();
+    const retries = 0;
+    try {
+      let data;
+      switch (action) {
+        case "createPaymentIntent":
+          data = await this.executeWithRetry(
+            () => this.createPaymentIntent(params)
+          );
+          break;
+        case "confirmPayment":
+          data = await this.executeWithRetry(() => this.confirmPayment(params));
+          break;
+        case "refund":
+          data = await this.executeWithRetry(() => this.refund(params));
+          break;
+        default:
+          throw new Error(`Unknown action: ${action}`);
+      }
+      return {
+        success: true,
+        data,
+        metadata: this.createMetadata(action, Date.now() - startTime, retries)
+      };
+    } catch (error) {
+      return this.handleError(action, error);
+    }
   }
-  error(message, meta) {
-    this.log.error(message, meta);
+  async createPaymentIntent(params) {
+    const { amount, currency, metadata } = params;
+    this.logger.debug("Creating payment intent", {
+      amount: Number(amount),
+      currency: String(currency ?? "")
+    });
+    return await this.client.paymentIntents.create({
+      amount,
+      currency,
+      metadata
+    });
   }
-};
-function validateParams(integration, action, params) {
-  const typedRegistry = integratorsRegistry;
-  const registry = typedRegistry.integrators[integration];
-  if (!registry) {
-    return {
-      valid: false,
-      errors: [
-        {
-          param: "integration",
-          message: `Unknown integration: ${integration}`
-        }
-      ]
-    };
+  async confirmPayment(params) {
+    const { paymentIntentId } = params;
+    this.logger.debug("Confirming payment", {
+      paymentIntentId: String(paymentIntentId ?? "")
+    });
+    return await this.client.paymentIntents.confirm(paymentIntentId);
   }
-  const actionDef = registry.actions.find((a) => a.name === action);
-  if (!actionDef) {
-    return {
-      valid: false,
-      errors: [{ param: "action", message: `Unknown action: ${action}` }]
+  async refund(params) {
+    const { paymentIntentId, amount } = params;
+    this.logger.debug("Creating refund", {
+      paymentIntentId: String(paymentIntentId ?? ""),
+      amount: Number(amount)
+    });
+    return await this.client.refunds.create({
+      payment_intent: paymentIntentId,
+      amount
+    });
+  }
+  // ───────────────────────────────────────────────────────────────────
+  // Typed action surface — canonical Almadar shapes only.
+  // ───────────────────────────────────────────────────────────────────
+  /** Look up an existing customer by Stripe ID. */
+  async getCustomer(customerId) {
+    this.logger.debug("Fetching customer", { customerId });
+    const customer = await this.client.customers.retrieve(customerId);
+    if (customer.deleted === true) return null;
+    return shapeCustomer(customer);
+  }
+  /**
+   * Create a Stripe Customer for the given Almadar user. `almadarUid` is
+   * stored as Stripe metadata so webhook handlers can resolve back to
+   * the right `users/{uid}` document.
+   */
+  async createCustomer(input) {
+    this.logger.debug("Creating customer", { almadarUid: input.almadarUid });
+    const customer = await this.client.customers.create({
+      email: input.email,
+      name: input.displayName ?? void 0,
+      metadata: { almadarUid: input.almadarUid }
+    });
+    return shapeCustomer(customer);
+  }
+  /**
+   * Create a Stripe-hosted Checkout Session for the given tier. Client
+   * redirects the user to the returned `url`; on success Stripe fires
+   * `customer.subscription.created`, which the apps/builder webhook
+   * handler turns into a `users/{uid}.tier` write.
+   */
+  async createCheckoutSession(input) {
+    const price = input.tier === "solo" ? this.prices.solo : this.prices.teams;
+    if (!price) {
+      throw new Error(`STRIPE_PRICE_${input.tier.toUpperCase()} not configured`);
+    }
+    this.logger.debug("Creating Checkout session", {
+      tier: input.tier,
+      quantity: input.quantity,
+      hasCustomer: input.customerId !== null
+    });
+    const session = await this.client.checkout.sessions.create({
+      mode: "subscription",
+      customer: input.customerId ?? void 0,
+      line_items: [{ price, quantity: input.quantity }],
+      success_url: input.successUrl,
+      cancel_url: input.cancelUrl,
+      subscription_data: {
+        metadata: input.metadata
+      },
+      automatic_tax: { enabled: true },
+      allow_promotion_codes: true
+    });
+    return {
+      url: session.url ?? "",
+      sessionId: session.id,
+      customerId: typeof session.customer === "string" ? session.customer : session.customer?.id ?? null
+    };
+  }
+  /** Create a Billing Portal session for self-service plan management. */
+  async createBillingPortalSession(input) {
+    this.logger.debug("Creating Portal session", { customerId: input.customerId });
+    const session = await this.client.billingPortal.sessions.create({
+      customer: input.customerId,
+      return_url: input.returnUrl
+    });
+    return {
+      url: session.url,
+      customerId: input.customerId
+    };
+  }
+  /** Fetch a subscription and shape it into the canonical form. */
+  async getSubscription(subscriptionId) {
+    this.logger.debug("Fetching subscription", { subscriptionId });
+    const sub = await this.client.subscriptions.retrieve(subscriptionId);
+    return shapeSubscription(sub, this.prices);
+  }
+  /**
+   * Create a subscription directly (server-side, no Checkout). Used by
+   * P13.3 Solo → Teams upgrade flow.
+   */
+  async createSubscription(input) {
+    const price = input.tier === "solo" ? this.prices.solo : this.prices.teams;
+    if (!price) {
+      throw new Error(`STRIPE_PRICE_${input.tier.toUpperCase()} not configured`);
+    }
+    this.logger.debug("Creating subscription", {
+      customerId: input.customerId,
+      tier: input.tier,
+      quantity: input.quantity
+    });
+    const sub = await this.client.subscriptions.create({
+      customer: input.customerId,
+      items: [{ price, quantity: input.quantity }],
+      metadata: input.metadata,
+      proration_behavior: "create_prorations",
+      automatic_tax: { enabled: true }
+    });
+    return shapeSubscription(sub, this.prices);
+  }
+  /**
+   * Update quantity or cancel-at-period-end. Used for Teams seat resize
+   * and Solo → Teams transition.
+   */
+  async updateSubscription(input) {
+    this.logger.debug("Updating subscription", { subscriptionId: input.subscriptionId });
+    const update = {
+      proration_behavior: "create_prorations"
+    };
+    if (typeof input.quantity === "number") {
+      const existing = await this.client.subscriptions.retrieve(input.subscriptionId);
+      const itemId = existing.items.data[0]?.id;
+      if (itemId !== void 0) {
+        update.items = [{ id: itemId, quantity: input.quantity }];
+      }
+    }
+    if (typeof input.cancelAtPeriodEnd === "boolean") {
+      update.cancel_at_period_end = input.cancelAtPeriodEnd;
+    }
+    const sub = await this.client.subscriptions.update(
+      input.subscriptionId,
+      update
+    );
+    return shapeSubscription(sub, this.prices);
+  }
+  /**
+   * Cancel a subscription. Defaults to `atPeriodEnd: true` so the user
+   * keeps access until the current period ends.
+   */
+  async cancelSubscription(input) {
+    this.logger.debug("Canceling subscription", {
+      subscriptionId: input.subscriptionId,
+      atPeriodEnd: input.atPeriodEnd
+    });
+    if (input.atPeriodEnd) {
+      const sub2 = await this.client.subscriptions.update(input.subscriptionId, {
+        cancel_at_period_end: true
+      });
+      return shapeSubscription(sub2, this.prices);
+    }
+    const sub = await this.client.subscriptions.cancel(input.subscriptionId);
+    return shapeSubscription(sub, this.prices);
+  }
+};
+registerIntegration("stripe", StripeIntegration);
+var YouTubeIntegration = class extends BaseIntegration {
+  constructor(config) {
+    super(config);
+    const apiKey = config.env.YOUTUBE_API_KEY;
+    if (!apiKey) {
+      throw new Error("YOUTUBE_API_KEY not configured");
+    }
+    this.client = google.youtube({
+      version: "v3",
+      auth: apiKey
+    });
+    this.logger.info("YouTube integration initialized");
+  }
+  async execute(action, params) {
+    const validation = this.validateParams(action, params);
+    if (!validation.valid) {
+      return {
+        success: false,
+        error: {
+          name: "IntegrationError",
+          message: "Validation failed",
+          code: "VALIDATION_ERROR",
+          details: validation.errors
+        },
+        metadata: this.createMetadata(action, 0)
+      };
+    }
+    const startTime = Date.now();
+    let retries = 0;
+    try {
+      let data;
+      switch (action) {
+        case "search":
+          data = await this.executeWithRetry(() => this.search(params));
+          break;
+        case "getVideo":
+          data = await this.executeWithRetry(() => this.getVideo(params));
+          break;
+        case "getChannel":
+          data = await this.executeWithRetry(() => this.getChannel(params));
+          break;
+        default:
+          throw new Error(`Unknown action: ${action}`);
+      }
+      return {
+        success: true,
+        data,
+        metadata: this.createMetadata(action, Date.now() - startTime, retries)
+      };
+    } catch (error) {
+      return this.handleError(action, error);
+    }
+  }
+  async search(params) {
+    const { query, maxResults, type } = params;
+    this.logger.debug("Searching YouTube", { query: String(query ?? ""), maxResults: Number(maxResults ?? 10), type: String(type ?? "") });
+    const response = await this.client.search.list({
+      part: ["snippet"],
+      q: query,
+      maxResults: maxResults || 10,
+      type: type ? [type] : void 0
+    });
+    return response.data.items?.map((item) => ({
+      videoId: item.id?.videoId,
+      title: item.snippet?.title,
+      thumbnail: item.snippet?.thumbnails?.default?.url,
+      description: item.snippet?.description
+    }));
+  }
+  async getVideo(params) {
+    const { videoId } = params;
+    this.logger.debug("Getting video details", { videoId: String(videoId ?? "") });
+    const response = await this.client.videos.list({
+      part: ["snippet", "statistics"],
+      id: [videoId]
+    });
+    const video = response.data.items?.[0];
+    if (!video) {
+      throw new Error(`Video not found: ${videoId}`);
+    }
+    return {
+      title: video.snippet?.title,
+      description: video.snippet?.description,
+      viewCount: video.statistics?.viewCount,
+      likeCount: video.statistics?.likeCount
+    };
+  }
+  async getChannel(params) {
+    const { channelId } = params;
+    this.logger.debug("Getting channel details", { channelId: String(channelId ?? "") });
+    const response = await this.client.channels.list({
+      part: ["snippet", "statistics"],
+      id: [channelId]
+    });
+    const channel = response.data.items?.[0];
+    if (!channel) {
+      throw new Error(`Channel not found: ${channelId}`);
+    }
+    return {
+      name: channel.snippet?.title,
+      description: channel.snippet?.description,
+      subscriberCount: channel.statistics?.subscriberCount
+    };
+  }
+};
+registerIntegration("youtube", YouTubeIntegration);
+var TwilioIntegration = class extends BaseIntegration {
+  constructor(config) {
+    super(config);
+    const accountSid = config.env.TWILIO_ACCOUNT_SID;
+    const authToken = config.env.TWILIO_AUTH_TOKEN;
+    this.phoneNumber = config.env.TWILIO_PHONE_NUMBER || "";
+    if (!accountSid || !authToken) {
+      throw new Error("TWILIO_ACCOUNT_SID and TWILIO_AUTH_TOKEN not configured");
+    }
+    this.client = twilio(accountSid, authToken);
+    this.logger.info("Twilio integration initialized");
+  }
+  async execute(action, params) {
+    const validation = this.validateParams(action, params);
+    if (!validation.valid) {
+      return {
+        success: false,
+        error: {
+          name: "IntegrationError",
+          message: "Validation failed",
+          code: "VALIDATION_ERROR",
+          details: validation.errors
+        },
+        metadata: this.createMetadata(action, 0)
+      };
+    }
+    const startTime = Date.now();
+    let retries = 0;
+    try {
+      let data;
+      switch (action) {
+        case "sendSMS":
+          data = await this.executeWithRetry(() => this.sendSMS(params));
+          break;
+        case "sendWhatsApp":
+          data = await this.executeWithRetry(() => this.sendWhatsApp(params));
+          break;
+        default:
+          throw new Error(`Unknown action: ${action}`);
+      }
+      return {
+        success: true,
+        data,
+        metadata: this.createMetadata(action, Date.now() - startTime, retries)
+      };
+    } catch (error) {
+      return this.handleError(action, error);
+    }
+  }
+  async sendSMS(params) {
+    const { to, body } = params;
+    this.logger.debug("Sending SMS", { to: String(to ?? "") });
+    const message = await this.client.messages.create({
+      from: this.phoneNumber,
+      to,
+      body
+    });
+    return {
+      sid: message.sid,
+      status: message.status
+    };
+  }
+  async sendWhatsApp(params) {
+    const { to, body } = params;
+    this.logger.debug("Sending WhatsApp message", { to: String(to ?? "") });
+    const message = await this.client.messages.create({
+      from: `whatsapp:${this.phoneNumber}`,
+      to: `whatsapp:${to}`,
+      body
+    });
+    return {
+      sid: message.sid,
+      status: message.status
+    };
+  }
+};
+registerIntegration("twilio", TwilioIntegration);
+var EmailIntegration = class extends BaseIntegration {
+  constructor(config) {
+    super(config);
+    this.provider = config.env.PROVIDER || "sendgrid";
+    this.fromEmail = config.env.FROM_EMAIL || "noreply@example.com";
+    if (this.provider === "sendgrid") {
+      const apiKey = config.env.SENDGRID_API_KEY;
+      if (!apiKey) {
+        throw new Error("SENDGRID_API_KEY not configured");
+      }
+      sgMail.setApiKey(apiKey);
+    } else if (this.provider === "resend") {
+      const apiKey = config.env.RESEND_API_KEY;
+      if (!apiKey) {
+        throw new Error("RESEND_API_KEY not configured");
+      }
+      this.resendClient = new Resend(apiKey);
+    }
+    this.logger.info(`Email integration initialized (${this.provider})`);
+  }
+  async execute(action, params) {
+    const validation = this.validateParams(action, params);
+    if (!validation.valid) {
+      return {
+        success: false,
+        error: {
+          name: "IntegrationError",
+          message: "Validation failed",
+          code: "VALIDATION_ERROR",
+          details: validation.errors
+        },
+        metadata: this.createMetadata(action, 0)
+      };
+    }
+    const startTime = Date.now();
+    let retries = 0;
+    try {
+      let data;
+      switch (action) {
+        case "send":
+          data = await this.executeWithRetry(() => this.send(params));
+          break;
+        default:
+          throw new Error(`Unknown action: ${action}`);
+      }
+      return {
+        success: true,
+        data,
+        metadata: this.createMetadata(action, Date.now() - startTime, retries)
+      };
+    } catch (error) {
+      return this.handleError(action, error);
+    }
+  }
+  async send(params) {
+    const { to, subject, body, from } = params;
+    this.logger.debug("Sending email", { to: String(to), subject: String(subject), provider: this.provider });
+    if (this.provider === "sendgrid") {
+      return await this.sendViaSendGrid(
+        to,
+        subject,
+        body,
+        from || this.fromEmail
+      );
+    } else if (this.provider === "resend") {
+      return await this.sendViaResend(
+        to,
+        subject,
+        body,
+        from || this.fromEmail
+      );
+    }
+    throw new Error(`Unknown email provider: ${this.provider}`);
+  }
+  async sendViaSendGrid(to, subject, body, from) {
+    const msg = {
+      to,
+      from,
+      subject,
+      html: body
+    };
+    const response = await sgMail.send(msg);
+    return {
+      id: response[0].headers["x-message-id"],
+      status: "sent"
+    };
+  }
+  async sendViaResend(to, subject, body, from) {
+    if (!this.resendClient) {
+      throw new Error("Resend client not initialized");
+    }
+    const response = await this.resendClient.emails.send({
+      from,
+      to,
+      subject,
+      html: body
+    });
+    return {
+      id: response.data?.id,
+      status: "sent"
+    };
+  }
+};
+registerIntegration("email", EmailIntegration);
+var LLMIntegration = class extends BaseIntegration {
+  constructor(config) {
+    super(config);
+    this.client = null;
+    this.embeddings = null;
+    const configuredProvider = config.env.PROVIDER;
+    this.provider = configuredProvider || getAvailableProvider() || "anthropic";
+    this.logger.info(`LLM integration initialized (provider: ${this.provider})`);
+  }
+  /**
+   * Lazily create client — avoids throwing on construction if API key is missing.
+   * The client will throw a clear error when actually used without a key.
+   */
+  getClient() {
+    if (!this.client) {
+      this.client = new LLMClient({
+        provider: this.provider,
+        temperature: 0.7,
+        trackTokens: true
+      });
+    }
+    return this.client;
+  }
+  /**
+   * Lazily create the embeddings client. Embeddings route through a dedicated
+   * embedding model (default OpenRouter `baai/bge-base-en-v1.5`, matching
+   * `@almadar/curation-core`), independent of the chat provider/key, because
+   * most chat providers do not expose an embeddings endpoint. Override via
+   * `EMBEDDING_PROVIDER` / `EMBEDDING_MODEL` / `EMBEDDING_API_KEY`.
+   */
+  getEmbeddings() {
+    if (!this.embeddings) {
+      this.embeddings = new EmbeddingClient({
+        provider: this.config.env.EMBEDDING_PROVIDER ?? "openrouter",
+        model: this.config.env.EMBEDDING_MODEL ?? "baai/bge-base-en-v1.5",
+        apiKey: this.config.env.EMBEDDING_API_KEY
+      });
+    }
+    return this.embeddings;
+  }
+  async execute(action, params) {
+    const validation = this.validateParams(action, params);
+    if (!validation.valid) {
+      return {
+        success: false,
+        error: {
+          name: "IntegrationError",
+          message: "Validation failed",
+          code: "VALIDATION_ERROR",
+          details: validation.errors
+        },
+        metadata: this.createMetadata(action, 0)
+      };
+    }
+    const startTime = Date.now();
+    try {
+      let data;
+      switch (action) {
+        case "generate":
+          data = await this.executeWithRetry(() => this.generate(params));
+          break;
+        case "classify":
+          data = await this.executeWithRetry(() => this.classify(params));
+          break;
+        case "extract":
+          data = await this.executeWithRetry(() => this.extract(params));
+          break;
+        case "summarize":
+          data = await this.executeWithRetry(() => this.summarize(params));
+          break;
+        case "embed":
+          data = await this.executeWithRetry(() => this.embed(params));
+          break;
+        default:
+          throw new Error(`Unknown action: ${action}`);
+      }
+      return {
+        success: true,
+        data,
+        metadata: this.createMetadata(action, Date.now() - startTime)
+      };
+    } catch (error) {
+      return this.handleError(action, error);
+    }
+  }
+  async generate(params) {
+    const {
+      systemPrompt,
+      userPrompt,
+      model,
+      temperature,
+      maxTokens
+    } = params;
+    this.logger.debug("Generating content", { model, temperature });
+    const client = model ? new LLMClient({ provider: this.provider, model, temperature: temperature ?? 0.7 }) : this.getClient();
+    const response = await client.callWithMetadata({
+      systemPrompt: systemPrompt || "You are a helpful assistant.",
+      userPrompt,
+      maxTokens: maxTokens ?? 1024,
+      temperature,
+      skipSchemaValidation: true
+    });
+    return {
+      content: response.data,
+      usage: response.usage ? {
+        promptTokens: response.usage.promptTokens,
+        completionTokens: response.usage.completionTokens,
+        totalTokens: response.usage.totalTokens
+      } : { tokens: 0 }
+    };
+  }
+  async classify(params) {
+    const { text, categories, model } = params;
+    this.logger.debug("Classifying text", { categories: categories.join(", ") });
+    const ClassificationSchema = z.object({
+      category: z.enum(categories),
+      confidence: z.number().min(0).max(1),
+      reasoning: z.string()
+    });
+    const client = model ? new LLMClient({ provider: this.provider, model, temperature: 0.1 }) : this.getClient();
+    const result = await client.call({
+      systemPrompt: `You are a text classifier. Classify the given text into one of these categories: ${categories.join(", ")}. Return JSON with: category, confidence (0-1), and reasoning.`,
+      userPrompt: text,
+      schema: ClassificationSchema,
+      temperature: 0.1
+    });
+    return result;
+  }
+  async extract(params) {
+    const { text, schema, model } = params;
+    this.logger.debug("Extracting structured data", { schema: String(schema ?? "") });
+    const ExtractSchema = z.record(z.unknown());
+    const client = model ? new LLMClient({ provider: this.provider, model, temperature: 0.2 }) : this.getClient();
+    const schemaDescription = JSON.stringify(schema, null, 2);
+    const result = await client.call({
+      systemPrompt: `You are a structured data extractor. Extract data from the given text according to this schema:
+
+${schemaDescription}
+
+Return ONLY valid JSON matching the schema.`,
+      userPrompt: text,
+      schema: ExtractSchema,
+      temperature: 0.2,
+      skipSchemaValidation: true
+    });
+    return result;
+  }
+  async summarize(params) {
+    const { text, maxLength, style, model } = params;
+    this.logger.debug("Summarizing text", { maxLength, style });
+    const SummarySchema = z.object({
+      summary: z.string(),
+      keyPoints: z.array(z.string())
+    });
+    const styleInstructions = style === "bullet" ? "Use bullet points." : style === "detailed" ? "Be thorough and detailed." : "Be concise.";
+    const lengthInstructions = maxLength ? `Keep the summary under ${maxLength} words.` : "";
+    const client = model ? new LLMClient({ provider: this.provider, model, temperature: 0.3 }) : this.getClient();
+    const result = await client.call({
+      systemPrompt: `You are a text summarizer. ${styleInstructions} ${lengthInstructions} Return JSON with: summary (string) and keyPoints (array of strings).`,
+      userPrompt: text,
+      schema: SummarySchema,
+      temperature: 0.3
+    });
+    return result;
+  }
+  async embed(params) {
+    const { texts } = params;
+    if (!Array.isArray(texts)) {
+      throw new Error("llm.embed: `texts` must be an array of strings");
+    }
+    this.logger.debug("Embedding texts", { count: texts.length });
+    const batch = await this.getEmbeddings().embedBatch(texts);
+    return { embeddings: batch.embeddings };
+  }
+};
+registerIntegration("llm", LLMIntegration);
+
+// src/integrations/ml/index.ts
+var INFERRED_EVENT = "INFERRED";
+var INFER_FAILED_EVENT = "INFER_FAILED";
+var DEFAULT_TIMEOUT_MS = 6e4;
+function isServiceParams(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) && !(value instanceof Date);
+}
+function extractInferResult(response) {
+  const emitted = (response.effectResults ?? []).find(
+    (result) => result.effect === "emit" && result.success && isServiceParams(result.data) && result.data.event === INFERRED_EVENT
+  );
+  if (!emitted || !isServiceParams(emitted.data)) {
+    return null;
+  }
+  const payload = emitted.data.payload;
+  if (!isServiceParams(payload)) {
+    return null;
+  }
+  if (!("output" in payload) || typeof payload.confidence !== "number" || !Array.isArray(payload.violations)) {
+    return null;
+  }
+  return {
+    output: payload.output,
+    confidence: payload.confidence,
+    violations: payload.violations
+  };
+}
+var MLIntegration = class extends BaseIntegration {
+  constructor(config) {
+    super(config);
+    const baseUrl = config.env.MASAR_URL;
+    const traitPrefix = config.env.MASAR_ML_TRAIT;
+    if (!baseUrl || !traitPrefix) {
+      throw new Error(
+        "ML integration requires MASAR_URL (serving orbital host) and MASAR_ML_TRAIT (kebab-case trait name of its /events route) to be configured"
+      );
+    }
+    this.eventsUrl = `${baseUrl.replace(/\/+$/, "")}/api/${traitPrefix}/events`;
+    this.timeoutMs = config.env.MASAR_ML_TIMEOUT_MS ? Number(config.env.MASAR_ML_TIMEOUT_MS) : DEFAULT_TIMEOUT_MS;
+    this.logger.info("ML integration initialized", { eventsUrl: this.eventsUrl });
+  }
+  async execute(action, params) {
+    const validation = this.validateParams(action, params);
+    if (!validation.valid) {
+      return {
+        success: false,
+        error: {
+          name: "IntegrationError",
+          message: "Validation failed",
+          code: "VALIDATION_ERROR",
+          details: validation.errors
+        },
+        metadata: this.createMetadata(action, 0)
+      };
+    }
+    const startTime = Date.now();
+    try {
+      let data;
+      switch (action) {
+        case "infer":
+          data = await this.executeWithRetry(() => this.infer(params));
+          break;
+        default:
+          throw new Error(`Unknown action: ${action}`);
+      }
+      return {
+        success: true,
+        data,
+        metadata: this.createMetadata(action, Date.now() - startTime)
+      };
+    } catch (error) {
+      return this.handleError(action, error);
+    }
+  }
+  async infer(params) {
+    const { model, input } = params;
+    this.logger.debug("Running ML inference", { model });
+    const response = await this.postEvent(model, input);
+    if (!response.success) {
+      throw new IntegrationError(
+        `ML service reported failure: ${response.error ?? "unknown error"}`,
+        "SERVICE_ERROR",
+        { model, response }
+      );
+    }
+    const failed = (response.effectResults ?? []).find(
+      (result) => result.effect === "emit" && isServiceParams(result.data) && result.data.event === INFER_FAILED_EVENT
+    );
+    if (failed) {
+      throw new IntegrationError(
+        `ML service could not infer: ${failed.error ?? "model unavailable"}`,
+        "SERVICE_ERROR",
+        { model, response }
+      );
+    }
+    const inferred = extractInferResult(response);
+    if (!inferred) {
+      throw new IntegrationError(
+        "ML service response did not include a valid inference result",
+        "SERVICE_ERROR",
+        { model, response }
+      );
+    }
+    return inferred;
+  }
+  async postEvent(model, input) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+    let httpResponse;
+    try {
+      httpResponse = await fetch(this.eventsUrl, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ event: "INFER", payload: { model, input } }),
+        signal: controller.signal
+      });
+    } catch (error) {
+      if (error instanceof DOMException && error.name === "AbortError") {
+        throw new IntegrationError(
+          `ML service request timed out after ${this.timeoutMs}ms (model may be cold-starting)`,
+          "TIMEOUT_ERROR",
+          { model, eventsUrl: this.eventsUrl }
+        );
+      }
+      throw new IntegrationError(
+        `ML service request failed: ${error instanceof Error ? error.message : String(error)}`,
+        "NETWORK_ERROR",
+        { model, eventsUrl: this.eventsUrl }
+      );
+    } finally {
+      clearTimeout(timer);
+    }
+    if (!httpResponse.ok) {
+      const body = await httpResponse.text().catch(() => "");
+      throw new IntegrationError(
+        `ML service responded with status ${httpResponse.status}`,
+        "SERVICE_ERROR",
+        { model, status: httpResponse.status, body }
+      );
+    }
+    try {
+      return await httpResponse.json();
+    } catch (error) {
+      throw new IntegrationError(
+        `ML service returned a malformed response body: ${error instanceof Error ? error.message : String(error)}`,
+        "SERVICE_ERROR",
+        { model }
+      );
+    }
+  }
+};
+registerIntegration("ml", MLIntegration);
+
+// src/integrations/deepagent/index.ts
+var DeepAgentIntegration = class extends BaseIntegration {
+  constructor(config) {
+    super(config);
+    this.apiUrl = config.env.DEEPAGENT_API_URL || "http://localhost:3000";
+    this.apiKey = config.env.DEEPAGENT_API_KEY || "";
+    this.logger.info("DeepAgent integration initialized", { apiUrl: this.apiUrl });
+  }
+  async execute(action, params) {
+    const validation = this.validateParams(action, params);
+    if (!validation.valid) {
+      return {
+        success: false,
+        error: {
+          name: "IntegrationError",
+          message: "Validation failed",
+          code: "VALIDATION_ERROR",
+          details: validation.errors
+        },
+        metadata: this.createMetadata(action, 0)
+      };
+    }
+    const startTime = Date.now();
+    let retries = 0;
+    try {
+      let data;
+      switch (action) {
+        case "sendMessage":
+          data = await this.executeWithRetry(() => this.sendMessage(params));
+          break;
+        case "cancelGeneration":
+          data = await this.executeWithRetry(
+            () => this.cancelGeneration(params)
+          );
+          break;
+        case "validateSchema":
+          data = await this.executeWithRetry(() => this.validateSchema(params));
+          break;
+        case "compileSchema":
+          data = await this.executeWithRetry(() => this.compileSchema(params));
+          break;
+        case "getThreadHistory":
+          data = await this.executeWithRetry(
+            () => this.getThreadHistory(params)
+          );
+          break;
+        default:
+          throw new Error(`Unknown action: ${action}`);
+      }
+      return {
+        success: true,
+        data,
+        metadata: this.createMetadata(action, Date.now() - startTime, retries)
+      };
+    } catch (error) {
+      return this.handleError(action, error);
+    }
+  }
+  async sendMessage(params) {
+    const { message, threadId, skill, context } = params;
+    this.logger.debug("Sending message to DeepAgent", { threadId: String(threadId ?? ""), skill: String(skill ?? "") });
+    const response = await this.request("/api/agent/message", {
+      message,
+      threadId,
+      skill,
+      context
+    });
+    return response;
+  }
+  async cancelGeneration(params) {
+    const { threadId } = params;
+    this.logger.debug("Cancelling generation", { threadId: String(threadId ?? "") });
+    const response = await this.request("/api/agent/cancel", {
+      threadId
+    });
+    return response;
+  }
+  async validateSchema(params) {
+    const { schema } = params;
+    this.logger.debug("Validating schema");
+    const response = await this.request("/api/schema/validate", {
+      schema
+    });
+    return response;
+  }
+  async compileSchema(params) {
+    const { schema, shell } = params;
+    this.logger.debug("Compiling schema", { shell: String(shell ?? "") });
+    const response = await this.request("/api/schema/compile", {
+      schema,
+      shell
+    });
+    return response;
+  }
+  async getThreadHistory(params) {
+    const { threadId } = params;
+    this.logger.debug("Getting thread history", { threadId: String(threadId ?? "") });
+    const response = await this.request("/api/agent/history", {
+      threadId
+    });
+    return response;
+  }
+  async request(endpoint, body) {
+    const url = `${this.apiUrl}${endpoint}`;
+    const response = await fetch(url, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        ...this.apiKey ? { Authorization: `Bearer ${this.apiKey}` } : {}
+      },
+      body: JSON.stringify(body)
+    });
+    if (!response.ok) {
+      throw new Error(
+        `DeepAgent request failed: ${response.status} ${response.statusText}`
+      );
+    }
+    return await response.json();
+  }
+};
+registerIntegration("deepagent", DeepAgentIntegration);
+async function execGit(args, cwd, env) {
+  return new Promise((resolve, reject) => {
+    const proc = spawn("git", args, {
+      cwd,
+      env: { ...process.env, ...env },
+      stdio: "pipe"
+    });
+    let stdout = "";
+    let stderr = "";
+    proc.stdout?.on("data", (data) => {
+      stdout += data.toString();
+    });
+    proc.stderr?.on("data", (data) => {
+      stderr += data.toString();
+    });
+    proc.on("close", (code) => {
+      if (code === 0) {
+        resolve({ stdout, stderr });
+      } else {
+        reject(
+          new IntegrationError(
+            `Git command failed: ${args.join(" ")}
+${stderr}`,
+            "SERVICE_ERROR",
+            { code, stderr }
+          )
+        );
+      }
+    });
+    proc.on("error", (error) => {
+      reject(
+        new IntegrationError(
+          `Failed to execute git: ${error.message}`,
+          "SERVICE_ERROR",
+          { error }
+        )
+      );
+    });
+  });
+}
+async function cloneRepo(params, token) {
+  const { repoUrl, targetDir, branch, depth = 1 } = params;
+  const authUrl = injectTokenIntoUrl(repoUrl, token);
+  const args = ["clone"];
+  if (depth > 0) {
+    args.push("--depth", depth.toString());
+  }
+  if (branch) {
+    args.push("--branch", branch);
+  }
+  args.push(authUrl, targetDir);
+  try {
+    await execGit(args, process.cwd());
+    await scrubTokenFromRemote(targetDir, repoUrl);
+  } catch (error) {
+    throw new IntegrationError(
+      `Failed to clone repository: ${error instanceof Error ? error.message : String(error)}`,
+      "SERVICE_ERROR",
+      { repoUrl, error }
+    );
+  }
+}
+async function createBranch(params, workDir) {
+  const { branchName, baseBranch } = params;
+  const cwd = params.workDir || workDir;
+  try {
+    if (baseBranch) {
+      await execGit(["checkout", baseBranch], cwd);
+    }
+    await execGit(["checkout", "-b", branchName], cwd);
+  } catch (error) {
+    throw new IntegrationError(
+      `Failed to create branch: ${error instanceof Error ? error.message : String(error)}`,
+      "SERVICE_ERROR",
+      { branchName, baseBranch, error }
+    );
+  }
+}
+async function commit(params, workDir) {
+  const { message, files } = params;
+  const cwd = params.workDir || workDir;
+  try {
+    if (files && files.length > 0) {
+      await execGit(["add", ...files], cwd);
+    } else {
+      await execGit(["add", "."], cwd);
+    }
+    await execGit(["commit", "-m", message], cwd);
+  } catch (error) {
+    throw new IntegrationError(
+      `Failed to commit: ${error instanceof Error ? error.message : String(error)}`,
+      "SERVICE_ERROR",
+      { message, error }
+    );
+  }
+}
+async function push(params, workDir, token) {
+  const { branchName, force = false } = params;
+  const cwd = params.workDir || workDir;
+  const protectedBranches = ["main", "master", "production", "prod"];
+  if (force && protectedBranches.includes(branchName.toLowerCase())) {
+    throw new IntegrationError(
+      `Force push to protected branch '${branchName}' is not allowed`,
+      "VALIDATION_ERROR"
+    );
+  }
+  try {
+    const credHelper = await createTempCredentialHelper(token);
+    const args = ["push"];
+    if (force) {
+      args.push("--force");
+    }
+    args.push("-u", "origin", branchName);
+    await execGit(args, cwd, {
+      GIT_ASKPASS: credHelper,
+      GIT_TERMINAL_PROMPT: "0"
+    });
+    await promises.unlink(credHelper);
+  } catch (error) {
+    throw new IntegrationError(
+      `Failed to push: ${error instanceof Error ? error.message : String(error)}`,
+      "SERVICE_ERROR",
+      { branchName, error }
+    );
+  }
+}
+function injectTokenIntoUrl(repoUrl, token) {
+  const url = new URL(repoUrl);
+  url.username = "x-access-token";
+  url.password = token;
+  return url.toString();
+}
+async function scrubTokenFromRemote(workDir, originalUrl) {
+  try {
+    const url = new URL(originalUrl);
+    url.username = "";
+    url.password = "";
+    const cleanUrl = url.toString();
+    await execGit(["remote", "set-url", "origin", cleanUrl], workDir);
+  } catch (error) {
+    console.error("Warning: Failed to scrub token from remote URL:", error);
+  }
+}
+async function createTempCredentialHelper(token) {
+  const tmpDir = process.env.TMPDIR || "/tmp";
+  const helperPath = join(tmpDir, `git-cred-${Date.now()}.sh`);
+  const script = `#!/bin/sh
+echo "${token}"`;
+  await promises.writeFile(helperPath, script, { mode: 448 });
+  return helperPath;
+}
+
+// src/integrations/github/github-api.ts
+async function githubFetch(endpoint, config, options = {}) {
+  const url = `https://api.github.com${endpoint}`;
+  const headers = {
+    "Authorization": `Bearer ${config.token}`,
+    "Accept": "application/vnd.github+json",
+    "X-GitHub-Api-Version": "2022-11-28",
+    ...options.headers
+  };
+  try {
+    const response = await fetch(url, {
+      ...options,
+      headers
+    });
+    const rateLimit = {
+      remaining: parseInt(response.headers.get("x-ratelimit-remaining") || "0", 10),
+      limit: parseInt(response.headers.get("x-ratelimit-limit") || "5000", 10),
+      reset: parseInt(response.headers.get("x-ratelimit-reset") || "0", 10)
+    };
+    if (!response.ok) {
+      const error = await response.json().catch(() => ({ message: response.statusText }));
+      if (response.status === 429) {
+        throw new IntegrationError(
+          "GitHub API rate limit exceeded",
+          "RATE_LIMIT_ERROR",
+          { rateLimit, error }
+        );
+      }
+      if (response.status === 401 || response.status === 403) {
+        throw new IntegrationError(
+          `GitHub API authentication failed: ${error.message || response.statusText}`,
+          "AUTH_ERROR",
+          { status: response.status, error }
+        );
+      }
+      throw new IntegrationError(
+        `GitHub API request failed: ${error.message || response.statusText}`,
+        "SERVICE_ERROR",
+        { status: response.status, error }
+      );
+    }
+    const data = await response.json();
+    return { data, rateLimit };
+  } catch (error) {
+    if (error instanceof IntegrationError) {
+      throw error;
+    }
+    throw new IntegrationError(
+      `GitHub API request failed: ${error instanceof Error ? error.message : String(error)}`,
+      "NETWORK_ERROR",
+      { error }
+    );
+  }
+}
+async function createPR(params, config) {
+  const { title, body, baseBranch, headBranch, draft = false } = params;
+  const endpoint = `/repos/${config.owner}/${config.repo}/pulls`;
+  const { data } = await githubFetch(endpoint, config, {
+    method: "POST",
+    body: JSON.stringify({
+      title,
+      body,
+      base: baseBranch,
+      head: headBranch,
+      draft
+    })
+  });
+  return data;
+}
+async function getPRComments(params, config) {
+  const { prNumber } = params;
+  const endpoint = `/repos/${config.owner}/${config.repo}/pulls/${prNumber}/comments`;
+  const { data } = await githubFetch(endpoint, config);
+  return data;
+}
+async function listIssues(params, config) {
+  const { state = "open", labels = [], limit = 30 } = params;
+  const queryParams = new URLSearchParams({
+    state,
+    per_page: Math.min(limit, 100).toString()
+  });
+  if (labels.length > 0) {
+    queryParams.append("labels", labels.join(","));
+  }
+  const endpoint = `/repos/${config.owner}/${config.repo}/issues?${queryParams}`;
+  const { data } = await githubFetch(endpoint, config);
+  return data;
+}
+async function getIssue(params, config) {
+  const { issueNumber } = params;
+  const issueEndpoint = `/repos/${config.owner}/${config.repo}/issues/${issueNumber}`;
+  const { data: issue } = await githubFetch(issueEndpoint, config);
+  const commentsEndpoint = `/repos/${config.owner}/${config.repo}/issues/${issueNumber}/comments`;
+  const { data: comments } = await githubFetch(commentsEndpoint, config);
+  return { issue, comments };
+}
+function parseRepoUrl(repoUrl) {
+  try {
+    const url = new URL(repoUrl);
+    const pathParts = url.pathname.split("/").filter(Boolean);
+    if (pathParts.length < 2) {
+      throw new Error("Invalid repository URL format");
+    }
+    const owner = pathParts[0];
+    const repo = pathParts[1].replace(/\.git$/, "");
+    return { owner, repo };
+  } catch (error) {
+    throw new IntegrationError(
+      `Failed to parse repository URL: ${repoUrl}`,
+      "VALIDATION_ERROR",
+      { error }
+    );
+  }
+}
+
+// src/integrations/github/index.ts
+var GitHubIntegration = class extends BaseIntegration {
+  constructor(config) {
+    super(config);
+    this.token = config.env.GITHUB_TOKEN;
+    if (!this.token) {
+      throw new Error("GITHUB_TOKEN not configured");
+    }
+    this.owner = config.env.GITHUB_OWNER || "";
+    this.repo = config.env.GITHUB_REPO || "";
+    this.workDir = config.env.GITHUB_WORK_DIR || process.cwd();
+    this.logger.info("GitHub integration initialized", {
+      owner: this.owner,
+      repo: this.repo
+    });
+  }
+  /**
+   * Execute a GitHub action
+   */
+  async execute(action, params) {
+    const validation = this.validateParams(action, params);
+    if (!validation.valid) {
+      return {
+        success: false,
+        error: {
+          name: "IntegrationError",
+          message: "Validation failed",
+          code: "VALIDATION_ERROR",
+          details: validation.errors
+        },
+        metadata: this.createMetadata(action, 0)
+      };
+    }
+    const startTime = Date.now();
+    let retries = 0;
+    try {
+      let data;
+      switch (action) {
+        case "cloneRepo":
+          data = await this.executeWithRetry(
+            () => this.cloneRepo(params)
+          );
+          break;
+        case "createBranch":
+          data = await this.executeWithRetry(
+            () => this.createBranch(params)
+          );
+          break;
+        case "commit":
+          data = await this.executeWithRetry(
+            () => this.commit(params)
+          );
+          break;
+        case "push":
+          data = await this.executeWithRetry(
+            () => this.push(params)
+          );
+          break;
+        case "createPR":
+          data = await this.executeWithRetry(
+            () => this.createPR(params)
+          );
+          break;
+        case "getPRComments":
+          data = await this.executeWithRetry(
+            () => this.getPRComments(params)
+          );
+          break;
+        case "listIssues":
+          data = await this.executeWithRetry(
+            () => this.listIssues(params)
+          );
+          break;
+        case "getIssue":
+          data = await this.executeWithRetry(
+            () => this.getIssue(params)
+          );
+          break;
+        default:
+          throw new Error(`Unknown GitHub action: ${action}`);
+      }
+      return {
+        success: true,
+        data,
+        metadata: this.createMetadata(action, Date.now() - startTime, retries)
+      };
+    } catch (error) {
+      return this.handleError(action, error);
+    }
+  }
+  /**
+   * Clone a repository
+   */
+  async cloneRepo(params) {
+    this.logger.debug("Cloning repository", { repoUrl: params.repoUrl });
+    if (!this.owner || !this.repo) {
+      const parsed = parseRepoUrl(params.repoUrl);
+      this.owner = parsed.owner;
+      this.repo = parsed.repo;
+    }
+    await cloneRepo(params, this.token);
+    return {
+      message: `Successfully cloned ${params.repoUrl} to ${params.targetDir}`
+    };
+  }
+  /**
+   * Create a branch
+   */
+  async createBranch(params) {
+    this.logger.debug("Creating branch", { branchName: params.branchName });
+    await createBranch(params, this.workDir);
+    return {
+      message: `Successfully created branch: ${params.branchName}`
+    };
+  }
+  /**
+   * Commit changes
+   */
+  async commit(params) {
+    this.logger.debug("Committing changes", { message: params.message });
+    await commit(params, this.workDir);
+    return {
+      message: `Successfully committed changes: ${params.message}`
+    };
+  }
+  /**
+   * Push branch
+   */
+  async push(params) {
+    this.logger.debug("Pushing branch", { branchName: params.branchName });
+    await push(params, this.workDir, this.token);
+    return {
+      message: `Successfully pushed branch: ${params.branchName}`
+    };
+  }
+  /**
+   * Create a pull request
+   */
+  async createPR(params) {
+    this.logger.debug("Creating pull request", { title: params.title });
+    const apiConfig = this.getAPIConfig();
+    const pr = await createPR(params, apiConfig);
+    this.logger.info("Pull request created", { number: pr.number, url: pr.url });
+    return pr;
+  }
+  /**
+   * Get PR comments
+   */
+  async getPRComments(params) {
+    this.logger.debug("Getting PR comments", { prNumber: params.prNumber });
+    const apiConfig = this.getAPIConfig();
+    const comments = await getPRComments(params, apiConfig);
+    return { comments };
+  }
+  /**
+   * List issues
+   */
+  async listIssues(params) {
+    this.logger.debug("Listing issues", { state: params.state, labels: params.labels?.join(", "), limit: params.limit });
+    const apiConfig = this.getAPIConfig();
+    const issues = await listIssues(params, apiConfig);
+    return { issues };
+  }
+  /**
+   * Get issue details
+   */
+  async getIssue(params) {
+    this.logger.debug("Getting issue", { issueNumber: params.issueNumber });
+    const apiConfig = this.getAPIConfig();
+    const result = await getIssue(params, apiConfig);
+    return result;
+  }
+  /**
+   * Get API config for GitHub API calls
+   */
+  getAPIConfig() {
+    if (!this.owner || !this.repo) {
+      throw new Error(
+        "GitHub owner and repo must be configured. Either set GITHUB_OWNER/GITHUB_REPO or clone a repository first."
+      );
+    }
+    return {
+      token: this.token,
+      owner: this.owner,
+      repo: this.repo
+    };
+  }
+};
+registerIntegration("github", GitHubIntegration);
+var CLIIntegration = class extends BaseIntegration {
+  constructor(config) {
+    super(config);
+    this.logger.info("CLI integration initialized");
+  }
+  async execute(action, params) {
+    const startTime = Date.now();
+    try {
+      let data;
+      switch (action) {
+        case "validate":
+          data = await this.validate(params);
+          break;
+        default:
+          throw new Error(`Unknown CLI action: ${action}`);
+      }
+      return {
+        success: true,
+        data,
+        metadata: this.createMetadata(action, Date.now() - startTime)
+      };
+    } catch (error) {
+      return this.handleError(action, error);
+    }
+  }
+  async validate(params) {
+    const { schema } = params;
+    if (!schema || typeof schema !== "string") {
+      throw new Error('validate requires a "schema" parameter (string)');
+    }
+    const tempDir = mkdtempSync(join(tmpdir(), "almadar-validate-"));
+    const schemaPath = join(tempDir, "schema.orb");
+    try {
+      writeFileSync(schemaPath, schema, "utf-8");
+      this.logger.debug("Validating schema", { path: schemaPath });
+      const output = execSync(
+        `npx @almadar/cli validate "${schemaPath}" --format=json`,
+        {
+          encoding: "utf-8",
+          timeout: 3e4,
+          cwd: tempDir,
+          stdio: ["pipe", "pipe", "pipe"]
+        }
+      );
+      const result = JSON.parse(output.trim());
+      return {
+        valid: result.valid ?? true,
+        errors: result.errors || [],
+        warnings: result.warnings || [],
+        summary: result.summary || ""
+      };
+    } catch (error) {
+      const execError = error;
+      if (execError.stdout) {
+        try {
+          const result = JSON.parse(execError.stdout.trim());
+          return {
+            valid: false,
+            errors: result.errors || [],
+            warnings: result.warnings || [],
+            summary: result.summary || ""
+          };
+        } catch {
+        }
+      }
+      throw new Error(
+        `CLI validation failed: ${execError.message || String(error)}`
+      );
+    } finally {
+      try {
+        rmSync(tempDir, { recursive: true, force: true });
+      } catch {
+      }
+    }
+  }
+};
+registerIntegration("cli", CLIIntegration);
+
+// src/integrations/redis/index.ts
+var RedisIntegration = class extends BaseIntegration {
+  constructor(config) {
+    super(config);
+    this.store = /* @__PURE__ */ new Map();
+    this.locks = /* @__PURE__ */ new Map();
+    this.channels = /* @__PURE__ */ new Map();
+    const redisUrl = config.env.REDIS_URL;
+    if (redisUrl) {
+      this.logger.warn(
+        "REDIS_URL is configured but real Redis client is not yet implemented. Falling back to in-memory store.",
+        { redisUrl }
+      );
+    }
+    this.logger.info("Redis integration initialized (in-memory backend)");
+  }
+  async execute(action, params) {
+    const validation = this.validateParams(action, params);
+    if (!validation.valid) {
+      return {
+        success: false,
+        error: {
+          name: "IntegrationError",
+          message: "Validation failed",
+          code: "VALIDATION_ERROR",
+          details: validation.errors
+        },
+        metadata: this.createMetadata(action, 0)
+      };
+    }
+    const startTime = Date.now();
+    try {
+      let data;
+      switch (action) {
+        case "get":
+          data = await this.executeWithRetry(() => this.getKey(params));
+          break;
+        case "set":
+          data = await this.executeWithRetry(() => this.setKey(params));
+          break;
+        case "delete":
+          data = await this.executeWithRetry(() => this.deleteKey(params));
+          break;
+        case "lock":
+          data = await this.executeWithRetry(() => this.acquireLock(params));
+          break;
+        case "unlock":
+          data = await this.executeWithRetry(() => this.releaseLock(params));
+          break;
+        case "increment":
+          data = await this.executeWithRetry(() => this.incrementKey(params));
+          break;
+        case "expire":
+          data = await this.executeWithRetry(() => this.expireKey(params));
+          break;
+        case "publish":
+          data = await this.executeWithRetry(() => this.publishMessage(params));
+          break;
+        case "subscribe":
+          data = await this.executeWithRetry(
+            () => this.subscribeChannel(params)
+          );
+          break;
+        default:
+          throw new Error(`Unknown action: ${action}`);
+      }
+      return {
+        success: true,
+        data,
+        metadata: this.createMetadata(action, Date.now() - startTime)
+      };
+    } catch (error) {
+      return this.handleError(action, error);
+    }
+  }
+  // ---------------------------------------------------------------------------
+  // Helpers
+  // ---------------------------------------------------------------------------
+  /** Remove expired entries on access and return whether a key is alive. */
+  isAlive(key) {
+    const entry = this.store.get(key);
+    if (!entry) return false;
+    if (entry.expiresAt !== void 0 && Date.now() > entry.expiresAt) {
+      this.store.delete(key);
+      return false;
+    }
+    return true;
+  }
+  /** Generate a unique lock identifier. */
+  generateLockId() {
+    return `lock_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`;
+  }
+  // ---------------------------------------------------------------------------
+  // Actions
+  // ---------------------------------------------------------------------------
+  async getKey(params) {
+    const key = params.key;
+    this.logger.debug("Cache GET", { key });
+    if (!this.isAlive(key)) {
+      return { value: null };
+    }
+    const entry = this.store.get(key);
+    return { value: entry ? entry.value : null };
+  }
+  async setKey(params) {
+    const key = params.key;
+    const value = params.value;
+    const ttl = params.ttl;
+    this.logger.debug("Cache SET", { key, ttl });
+    const entry = { value };
+    if (ttl !== void 0 && ttl > 0) {
+      entry.expiresAt = Date.now() + ttl * 1e3;
+    }
+    this.store.set(key, entry);
+    return { ok: true };
+  }
+  async deleteKey(params) {
+    const key = params.key;
+    this.logger.debug("Cache DELETE", { key });
+    const existed = this.store.has(key);
+    this.store.delete(key);
+    return { deleted: existed };
+  }
+  async acquireLock(params) {
+    const key = params.key;
+    const ttl = params.ttl ?? 3e4;
+    this.logger.debug("Cache LOCK", { key, ttl });
+    const existingLockId = this.locks.get(key);
+    if (existingLockId) {
+      if (this.isAlive(`__lock:${key}`)) {
+        return { acquired: false, lockId: "" };
+      }
+      this.locks.delete(key);
+      this.store.delete(`__lock:${key}`);
+    }
+    const lockId = this.generateLockId();
+    this.locks.set(key, lockId);
+    this.store.set(`__lock:${key}`, {
+      value: lockId,
+      expiresAt: Date.now() + ttl
+    });
+    return { acquired: true, lockId };
+  }
+  async releaseLock(params) {
+    const key = params.key;
+    const lockId = params.lockId;
+    this.logger.debug("Cache UNLOCK", { key, lockId });
+    const currentLockId = this.locks.get(key);
+    if (currentLockId !== lockId) {
+      return { released: false };
+    }
+    this.locks.delete(key);
+    this.store.delete(`__lock:${key}`);
+    return { released: true };
+  }
+  async incrementKey(params) {
+    const key = params.key;
+    const by = params.by ?? 1;
+    this.logger.debug("Cache INCR", { key, by });
+    let current = 0;
+    if (this.isAlive(key)) {
+      const entry = this.store.get(key);
+      if (entry) {
+        current = typeof entry.value === "number" ? entry.value : 0;
+      }
+    }
+    const newValue = current + by;
+    const existing = this.store.get(key);
+    this.store.set(key, {
+      value: newValue,
+      expiresAt: existing?.expiresAt
+    });
+    return { value: newValue };
+  }
+  async expireKey(params) {
+    const key = params.key;
+    const ttl = params.ttl;
+    this.logger.debug("Cache EXPIRE", { key, ttl });
+    if (!this.isAlive(key)) {
+      return { set: false };
+    }
+    const entry = this.store.get(key);
+    if (!entry) {
+      return { set: false };
+    }
+    entry.expiresAt = Date.now() + ttl * 1e3;
+    this.store.set(key, entry);
+    return { set: true };
+  }
+  async publishMessage(params) {
+    const channel = params.channel;
+    const message = params.message;
+    this.logger.debug("Cache PUBLISH", { channel });
+    const subscribers = this.channels.get(channel);
+    if (!subscribers || subscribers.size === 0) {
+      return { receivers: 0 };
+    }
+    for (const callback of subscribers) {
+      try {
+        callback(message);
+      } catch (err) {
+        this.logger.error("Subscriber callback error", {
+          channel,
+          error: err instanceof Error ? err.message : String(err)
+        });
+      }
+    }
+    return { receivers: subscribers.size };
+  }
+  async subscribeChannel(params) {
+    const channel = params.channel;
+    this.logger.debug("Cache SUBSCRIBE", { channel });
+    if (!this.channels.has(channel)) {
+      this.channels.set(channel, /* @__PURE__ */ new Set());
+    }
+    return { subscribed: true };
+  }
+};
+registerIntegration("redis", RedisIntegration);
+
+// src/integrations/queue/index.ts
+var QueueIntegration = class extends BaseIntegration {
+  constructor(config) {
+    super(config);
+    /** Map from queue name to ordered list of job IDs */
+    this.queues = /* @__PURE__ */ new Map();
+    /** Map from job ID to job data */
+    this.jobs = /* @__PURE__ */ new Map();
+    this.logger.info("Queue integration initialized (in-memory backend)");
+  }
+  async execute(action, params) {
+    const validation = this.validateParams(action, params);
+    if (!validation.valid) {
+      return {
+        success: false,
+        error: {
+          name: "IntegrationError",
+          message: "Validation failed",
+          code: "VALIDATION_ERROR",
+          details: validation.errors
+        },
+        metadata: this.createMetadata(action, 0)
+      };
+    }
+    const startTime = Date.now();
+    try {
+      let data;
+      switch (action) {
+        case "enqueue":
+          data = await this.executeWithRetry(() => this.enqueue(params));
+          break;
+        case "dequeue":
+          data = await this.executeWithRetry(() => this.dequeue(params));
+          break;
+        case "status":
+          data = await this.executeWithRetry(() => this.status(params));
+          break;
+        case "complete":
+          data = await this.executeWithRetry(() => this.complete(params));
+          break;
+        case "fail":
+          data = await this.executeWithRetry(() => this.failJob(params));
+          break;
+        case "cancel":
+          data = await this.executeWithRetry(() => this.cancel(params));
+          break;
+        case "size":
+          data = await this.executeWithRetry(() => this.size(params));
+          break;
+        default:
+          throw new Error(`Unknown action: ${action}`);
+      }
+      return {
+        success: true,
+        data,
+        metadata: this.createMetadata(action, Date.now() - startTime)
+      };
+    } catch (error) {
+      return this.handleError(action, error);
+    }
+  }
+  // ---------------------------------------------------------------------------
+  // Helpers
+  // ---------------------------------------------------------------------------
+  /** Generate a unique job identifier. */
+  generateJobId() {
+    return `job_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
+  }
+  /** Get or create the queue array for a given queue name. */
+  getQueue(name) {
+    let queue = this.queues.get(name);
+    if (!queue) {
+      queue = [];
+      this.queues.set(name, queue);
+    }
+    return queue;
+  }
+  // ---------------------------------------------------------------------------
+  // Actions
+  // ---------------------------------------------------------------------------
+  async enqueue(params) {
+    const queueName = params.queue;
+    const payload = params.payload;
+    const delay = params.delay ?? 0;
+    const priority = params.priority ?? 0;
+    this.logger.debug("Queue ENQUEUE", { queue: queueName, delay, priority });
+    const jobId = this.generateJobId();
+    const job = {
+      id: jobId,
+      queue: queueName,
+      payload,
+      priority,
+      status: "pending",
+      enqueuedAt: Date.now(),
+      delay
     };
+    this.jobs.set(jobId, job);
+    const queue = this.getQueue(queueName);
+    let insertIndex = queue.length;
+    for (let i = 0; i < queue.length; i++) {
+      const existingJob = this.jobs.get(queue[i]);
+      if (existingJob && existingJob.priority < priority) {
+        insertIndex = i;
+        break;
+      }
+    }
+    queue.splice(insertIndex, 0, jobId);
+    return { jobId, position: insertIndex };
   }
-  const errors = [];
-  for (const paramDef of actionDef.params) {
-    if (paramDef.required && !(paramDef.name in params)) {
-      errors.push({
-        param: paramDef.name,
-        message: `Missing required parameter: ${paramDef.name}`
+  async dequeue(params) {
+    const queueName = params.queue;
+    this.logger.debug("Queue DEQUEUE", { queue: queueName });
+    const queue = this.getQueue(queueName);
+    const now = Date.now();
+    for (let i = 0; i < queue.length; i++) {
+      const job = this.jobs.get(queue[i]);
+      if (!job || job.status !== "pending") continue;
+      const readyAt = job.enqueuedAt + job.delay;
+      if (now < readyAt) continue;
+      job.status = "processing";
+      queue.splice(i, 1);
+      return {
+        job: {
+          id: job.id,
+          payload: job.payload,
+          enqueuedAt: job.enqueuedAt,
+          priority: job.priority
+        }
+      };
+    }
+    return { job: null };
+  }
+  async status(params) {
+    const jobId = params.jobId;
+    this.logger.debug("Queue STATUS", { jobId });
+    const job = this.jobs.get(jobId);
+    if (!job) {
+      return { status: "pending", job: null };
+    }
+    return {
+      status: job.status,
+      job: {
+        id: job.id,
+        payload: job.payload,
+        enqueuedAt: job.enqueuedAt,
+        priority: job.priority
+      }
+    };
+  }
+  async complete(params) {
+    const jobId = params.jobId;
+    const result = params.result;
+    this.logger.debug("Queue COMPLETE", { jobId });
+    const job = this.jobs.get(jobId);
+    if (!job || job.status !== "processing") {
+      return { completed: false };
+    }
+    job.status = "completed";
+    job.result = result;
+    return { completed: true };
+  }
+  async failJob(params) {
+    const jobId = params.jobId;
+    const error = params.error;
+    this.logger.debug("Queue FAIL", { jobId });
+    const job = this.jobs.get(jobId);
+    if (!job || job.status !== "processing") {
+      return { failed: false };
+    }
+    job.status = "failed";
+    job.error = error;
+    return { failed: true };
+  }
+  async cancel(params) {
+    const jobId = params.jobId;
+    this.logger.debug("Queue CANCEL", { jobId });
+    const job = this.jobs.get(jobId);
+    if (!job || job.status !== "pending") {
+      return { cancelled: false };
+    }
+    const queue = this.queues.get(job.queue);
+    if (queue) {
+      const idx = queue.indexOf(jobId);
+      if (idx !== -1) {
+        queue.splice(idx, 1);
+      }
+    }
+    this.jobs.delete(jobId);
+    return { cancelled: true };
+  }
+  async size(params) {
+    const queueName = params.queue;
+    this.logger.debug("Queue SIZE", { queue: queueName });
+    let pending = 0;
+    let processing = 0;
+    for (const job of this.jobs.values()) {
+      if (job.queue !== queueName) continue;
+      if (job.status === "pending") pending++;
+      if (job.status === "processing") processing++;
+    }
+    return { size: pending + processing, pending, processing };
+  }
+};
+registerIntegration("queue", QueueIntegration);
+
+// src/integrations/otel/index.ts
+function randomHexId(bytes) {
+  const arr = [];
+  for (let i = 0; i < bytes; i++) {
+    arr.push(Math.floor(Math.random() * 256).toString(16).padStart(2, "0"));
+  }
+  return arr.join("");
+}
+var OtelIntegration = class extends BaseIntegration {
+  constructor(config) {
+    super(config);
+    this.spans = /* @__PURE__ */ new Map();
+    this.metrics = /* @__PURE__ */ new Map();
+    this.logger.info("OTel integration initialized (in-memory backend)");
+  }
+  async execute(action, params) {
+    const validation = this.validateParams(action, params);
+    if (!validation.valid) {
+      return {
+        success: false,
+        error: {
+          name: "IntegrationError",
+          message: "Validation failed",
+          code: "VALIDATION_ERROR",
+          details: validation.errors
+        },
+        metadata: this.createMetadata(action, 0)
+      };
+    }
+    const startTime = Date.now();
+    try {
+      let data;
+      switch (action) {
+        case "startSpan":
+          data = await this.executeWithRetry(() => this.startSpan(params));
+          break;
+        case "endSpan":
+          data = await this.executeWithRetry(() => this.endSpan(params));
+          break;
+        case "addEvent":
+          data = await this.executeWithRetry(() => this.addEvent(params));
+          break;
+        case "recordMetric":
+          data = await this.executeWithRetry(() => this.recordMetric(params));
+          break;
+        case "getSpan":
+          data = await this.executeWithRetry(() => this.getSpan(params));
+          break;
+        case "getMetrics":
+          data = await this.executeWithRetry(() => this.getAllMetrics());
+          break;
+        default:
+          throw new Error(`Unknown action: ${action}`);
+      }
+      return {
+        success: true,
+        data,
+        metadata: this.createMetadata(action, Date.now() - startTime)
+      };
+    } catch (error) {
+      return this.handleError(action, error);
+    }
+  }
+  // ---------------------------------------------------------------------------
+  // Actions
+  // ---------------------------------------------------------------------------
+  async startSpan(params) {
+    const name = params.name;
+    const attributes = params.attributes ?? {};
+    const spanId = randomHexId(8);
+    const traceId = params.traceId ?? randomHexId(16);
+    const span = {
+      spanId,
+      traceId,
+      name,
+      startTime: Date.now(),
+      attributes,
+      events: []
+    };
+    this.spans.set(spanId, span);
+    this.logger.debug("Span started", { spanId, traceId, name });
+    return { spanId, traceId };
+  }
+  async endSpan(params) {
+    const spanId = params.spanId;
+    const status = params.status;
+    const span = this.spans.get(spanId);
+    if (!span) {
+      this.logger.warn("endSpan called for unknown span", { spanId });
+      return { ended: false };
+    }
+    span.endTime = Date.now();
+    if (status) {
+      span.status = status;
+    }
+    this.logger.debug("Span ended", { spanId, status, duration: span.endTime - span.startTime });
+    return { ended: true };
+  }
+  async addEvent(params) {
+    const spanId = params.spanId;
+    const name = params.name;
+    const attributes = params.attributes;
+    const span = this.spans.get(spanId);
+    if (!span) {
+      this.logger.warn("addEvent called for unknown span", { spanId });
+      return { added: false };
+    }
+    span.events.push({
+      name,
+      timestamp: Date.now(),
+      attributes
+    });
+    this.logger.debug("Event added to span", { spanId, eventName: name });
+    return { added: true };
+  }
+  async recordMetric(params) {
+    const name = params.name;
+    const value = params.value;
+    const type = params.type ?? "counter";
+    const labels = params.labels ?? {};
+    const existing = this.metrics.get(name);
+    if (existing) {
+      switch (type) {
+        case "counter":
+          existing.value += value;
+          break;
+        case "gauge":
+          existing.value = value;
+          break;
+        case "histogram":
+          existing.values.push(value);
+          break;
+      }
+      existing.labels = labels;
+    } else {
+      this.metrics.set(name, {
+        name,
+        type,
+        value: type === "histogram" ? 0 : value,
+        values: type === "histogram" ? [value] : [],
+        labels
+      });
+    }
+    this.logger.debug("Metric recorded", { name, value, type });
+    return { recorded: true };
+  }
+  async getSpan(params) {
+    const spanId = params.spanId;
+    const span = this.spans.get(spanId);
+    return span ?? null;
+  }
+  async getAllMetrics() {
+    const result = {};
+    for (const [key, metric] of this.metrics) {
+      result[key] = metric;
+    }
+    return result;
+  }
+};
+registerIntegration("otel", OtelIntegration);
+
+// src/integrations/oauth/index.ts
+var PROVIDER_AUTH_URLS = {
+  google: "https://accounts.google.com/o/oauth2/v2/auth",
+  github: "https://github.com/login/oauth/authorize",
+  auth0: "https://auth.example.com/authorize"
+};
+var OAuthIntegration = class extends BaseIntegration {
+  constructor(config) {
+    super(config);
+    /** Maps state token -> provider for pending authorization flows */
+    this.states = /* @__PURE__ */ new Map();
+    /** Maps access token -> token set */
+    this.tokens = /* @__PURE__ */ new Map();
+    /** Maps refresh token -> access token for refresh lookups */
+    this.refreshIndex = /* @__PURE__ */ new Map();
+    /** Maps access token -> mock user session */
+    this.sessions = /* @__PURE__ */ new Map();
+    this.logger.info("OAuth integration initialized (mock backend)");
+  }
+  async execute(action, params) {
+    const validation = this.validateParams(action, params);
+    if (!validation.valid) {
+      return {
+        success: false,
+        error: {
+          name: "IntegrationError",
+          message: "Validation failed",
+          code: "VALIDATION_ERROR",
+          details: validation.errors
+        },
+        metadata: this.createMetadata(action, 0)
+      };
+    }
+    const startTime = Date.now();
+    try {
+      let data;
+      switch (action) {
+        case "authorize":
+          data = await this.executeWithRetry(() => this.authorize(params));
+          break;
+        case "token":
+          data = await this.executeWithRetry(() => this.token(params));
+          break;
+        case "refresh":
+          data = await this.executeWithRetry(() => this.refresh(params));
+          break;
+        case "revoke":
+          data = await this.executeWithRetry(() => this.revoke(params));
+          break;
+        case "userinfo":
+          data = await this.executeWithRetry(() => this.userinfo(params));
+          break;
+        default:
+          throw new Error(`Unknown action: ${action}`);
+      }
+      return {
+        success: true,
+        data,
+        metadata: this.createMetadata(action, Date.now() - startTime)
+      };
+    } catch (error) {
+      return this.handleError(action, error);
+    }
+  }
+  // ---------------------------------------------------------------------------
+  // Helpers
+  // ---------------------------------------------------------------------------
+  /** Generate a random hex token of the given byte length. */
+  generateToken(bytes = 32) {
+    const chars = "abcdef0123456789";
+    let result = "";
+    for (let i = 0; i < bytes * 2; i++) {
+      result += chars[Math.floor(Math.random() * chars.length)];
+    }
+    return result;
+  }
+  /** Generate a mock user profile from a provider and access token. */
+  generateMockUser(provider, sub) {
+    return {
+      sub,
+      email: `user-${sub.slice(0, 8)}@${provider}.example.com`,
+      name: `Mock User (${provider})`,
+      picture: `https://${provider}.example.com/avatar/${sub.slice(0, 8)}.png`
+    };
+  }
+  // ---------------------------------------------------------------------------
+  // Actions
+  // ---------------------------------------------------------------------------
+  async authorize(params) {
+    const provider = params.provider;
+    const scopes = params.scopes;
+    const redirectUri = params.redirectUri;
+    this.logger.debug("OAuth AUTHORIZE", { provider, scopes: scopes.join(", "), redirectUri });
+    const state = this.generateToken(16);
+    this.states.set(state, provider);
+    const baseUrl = PROVIDER_AUTH_URLS[provider];
+    const queryParams = new URLSearchParams({
+      response_type: "code",
+      scope: scopes.join(" "),
+      redirect_uri: redirectUri,
+      state,
+      client_id: this.config.env.CLIENT_ID ?? "mock-client-id"
+    });
+    const authUrl = `${baseUrl}?${queryParams.toString()}`;
+    return { authUrl, state };
+  }
+  async token(params) {
+    const code = params.code;
+    const state = params.state;
+    this.logger.debug("OAuth TOKEN", { code, state });
+    const provider = this.states.get(state);
+    if (!provider) {
+      throw new Error(
+        `Invalid or expired state token: ${state}`
+      );
+    }
+    this.states.delete(state);
+    const accessToken = this.generateToken(32);
+    const refreshToken = this.generateToken(32);
+    const expiresIn = 3600;
+    const tokenSet = {
+      accessToken,
+      refreshToken,
+      expiresAt: Date.now() + expiresIn * 1e3
+    };
+    this.tokens.set(accessToken, tokenSet);
+    this.refreshIndex.set(refreshToken, accessToken);
+    const sub = this.generateToken(8);
+    this.sessions.set(accessToken, this.generateMockUser(provider, sub));
+    return { accessToken, refreshToken, expiresIn, tokenType: "bearer" };
+  }
+  async refresh(params) {
+    const refreshToken = params.refreshToken;
+    this.logger.debug("OAuth REFRESH", { refreshToken: refreshToken.slice(0, 8) + "..." });
+    const oldAccessToken = this.refreshIndex.get(refreshToken);
+    if (!oldAccessToken) {
+      throw new Error("Invalid refresh token");
+    }
+    const userInfo = this.sessions.get(oldAccessToken);
+    this.tokens.delete(oldAccessToken);
+    this.sessions.delete(oldAccessToken);
+    const newAccessToken = this.generateToken(32);
+    const expiresIn = 3600;
+    const tokenSet = {
+      accessToken: newAccessToken,
+      refreshToken,
+      expiresAt: Date.now() + expiresIn * 1e3
+    };
+    this.tokens.set(newAccessToken, tokenSet);
+    this.refreshIndex.set(refreshToken, newAccessToken);
+    if (userInfo) {
+      this.sessions.set(newAccessToken, userInfo);
+    }
+    return { accessToken: newAccessToken, expiresIn };
+  }
+  async revoke(params) {
+    const token = params.token;
+    this.logger.debug("OAuth REVOKE", { token: token.slice(0, 8) + "..." });
+    const tokenSet = this.tokens.get(token);
+    if (tokenSet) {
+      this.refreshIndex.delete(tokenSet.refreshToken);
+      this.tokens.delete(token);
+      this.sessions.delete(token);
+      return { revoked: true };
+    }
+    const accessToken = this.refreshIndex.get(token);
+    if (accessToken) {
+      this.tokens.delete(accessToken);
+      this.sessions.delete(accessToken);
+      this.refreshIndex.delete(token);
+      return { revoked: true };
+    }
+    return { revoked: false };
+  }
+  async userinfo(params) {
+    const accessToken = params.accessToken;
+    this.logger.debug("OAuth USERINFO", { accessToken: accessToken.slice(0, 8) + "..." });
+    const tokenSet = this.tokens.get(accessToken);
+    if (!tokenSet) {
+      throw new Error("Invalid access token");
+    }
+    if (Date.now() > tokenSet.expiresAt) {
+      this.tokens.delete(accessToken);
+      this.sessions.delete(accessToken);
+      throw new Error("Access token expired");
+    }
+    const userInfo = this.sessions.get(accessToken);
+    if (!userInfo) {
+      throw new Error("No session found for access token");
+    }
+    return userInfo;
+  }
+};
+registerIntegration("oauth", OAuthIntegration);
+
+// src/integrations/storage/index.ts
+var StorageIntegration = class extends BaseIntegration {
+  constructor(config) {
+    super(config);
+    this.objects = /* @__PURE__ */ new Map();
+    const storageUrl = config.env.STORAGE_URL;
+    if (storageUrl) {
+      this.logger.warn(
+        "STORAGE_URL is configured but real storage client is not yet implemented. Falling back to in-memory store.",
+        { storageUrl }
+      );
+    }
+    this.logger.info("Storage integration initialized (in-memory backend)");
+  }
+  async execute(action, params) {
+    const validation = this.validateParams(action, params);
+    if (!validation.valid) {
+      return {
+        success: false,
+        error: {
+          name: "IntegrationError",
+          message: "Validation failed",
+          code: "VALIDATION_ERROR",
+          details: validation.errors
+        },
+        metadata: this.createMetadata(action, 0)
+      };
+    }
+    const startTime = Date.now();
+    try {
+      let data;
+      switch (action) {
+        case "upload":
+          data = await this.executeWithRetry(() => this.upload(params));
+          break;
+        case "download":
+          data = await this.executeWithRetry(() => this.download(params));
+          break;
+        case "list":
+          data = await this.executeWithRetry(() => this.list(params));
+          break;
+        case "delete":
+          data = await this.executeWithRetry(() => this.deleteObject(params));
+          break;
+        case "getSignedUrl":
+          data = await this.executeWithRetry(() => this.getSignedUrl(params));
+          break;
+        default:
+          throw new Error(`Unknown action: ${action}`);
+      }
+      return {
+        success: true,
+        data,
+        metadata: this.createMetadata(action, Date.now() - startTime)
+      };
+    } catch (error) {
+      return this.handleError(action, error);
+    }
+  }
+  // ---------------------------------------------------------------------------
+  // Helpers
+  // ---------------------------------------------------------------------------
+  /** Build a composite key from bucket and object key. */
+  compositeKey(bucket, key) {
+    return `${bucket}/${key}`;
+  }
+  /** Generate a deterministic etag from content. */
+  generateEtag(content) {
+    const raw = typeof content === "string" ? content : JSON.stringify(content);
+    let hash = 0;
+    for (let i = 0; i < raw.length; i++) {
+      const ch = raw.charCodeAt(i);
+      hash = (hash << 5) - hash + ch | 0;
+    }
+    return `"${Math.abs(hash).toString(16).padStart(8, "0")}"`;
+  }
+  /** Compute the byte size of content. */
+  computeSize(content) {
+    if (typeof content === "string") {
+      return new TextEncoder().encode(content).byteLength;
+    }
+    return JSON.stringify(content).length;
+  }
+  // ---------------------------------------------------------------------------
+  // Actions
+  // ---------------------------------------------------------------------------
+  async upload(params) {
+    const bucket = params.bucket;
+    const key = params.key;
+    const content = params.content;
+    const contentType = params.contentType ?? "application/octet-stream";
+    const metadata = params.metadata ?? {};
+    this.logger.debug("Storage UPLOAD", { bucket, key, contentType });
+    const size = this.computeSize(content);
+    const etag = this.generateEtag(content);
+    const obj = {
+      content,
+      contentType,
+      size,
+      metadata,
+      lastModified: Date.now(),
+      etag
+    };
+    this.objects.set(this.compositeKey(bucket, key), obj);
+    return { key, bucket, size, etag };
+  }
+  async download(params) {
+    const bucket = params.bucket;
+    const key = params.key;
+    this.logger.debug("Storage DOWNLOAD", { bucket, key });
+    const obj = this.objects.get(this.compositeKey(bucket, key));
+    if (!obj) {
+      throw new Error(`Object not found: ${bucket}/${key}`);
+    }
+    return {
+      content: obj.content,
+      contentType: obj.contentType,
+      size: obj.size,
+      metadata: obj.metadata
+    };
+  }
+  async list(params) {
+    const bucket = params.bucket;
+    const prefix = params.prefix ?? "";
+    const maxKeys = params.maxKeys ?? 1e3;
+    this.logger.debug("Storage LIST", { bucket, prefix, maxKeys });
+    const bucketPrefix = `${bucket}/`;
+    const fullPrefix = `${bucket}/${prefix}`;
+    const results = [];
+    for (const [compositeKey, obj] of this.objects) {
+      if (!compositeKey.startsWith(fullPrefix)) continue;
+      const objectKey = compositeKey.slice(bucketPrefix.length);
+      results.push({
+        key: objectKey,
+        size: obj.size,
+        lastModified: obj.lastModified
       });
     }
-    if (paramDef.name in params) {
-      const value = params[paramDef.name];
-      const expectedType = paramDef.type;
-      const actualType = typeof value;
-      if (expectedType === "number" && actualType !== "number") {
-        errors.push({
-          param: paramDef.name,
-          message: `Expected ${expectedType}, got ${actualType}`
-        });
-      }
-      if (expectedType === "string" && actualType !== "string") {
-        errors.push({
-          param: paramDef.name,
-          message: `Expected ${expectedType}, got ${actualType}`
-        });
-      }
-      if (expectedType === "array" && !Array.isArray(value)) {
-        errors.push({
-          param: paramDef.name,
-          message: `Expected array, got ${actualType}`
-        });
+    results.sort((a, b) => a.key.localeCompare(b.key));
+    const truncated = results.length > maxKeys;
+    return {
+      keys: results.slice(0, maxKeys),
+      truncated
+    };
+  }
+  async deleteObject(params) {
+    const bucket = params.bucket;
+    const key = params.key;
+    this.logger.debug("Storage DELETE", { bucket, key });
+    const existed = this.objects.has(this.compositeKey(bucket, key));
+    this.objects.delete(this.compositeKey(bucket, key));
+    return { deleted: existed };
+  }
+  async getSignedUrl(params) {
+    const bucket = params.bucket;
+    const key = params.key;
+    const expiresIn = params.expiresIn ?? 3600;
+    const operation = params.operation ?? "get";
+    this.logger.debug("Storage GET_SIGNED_URL", { bucket, key, expiresIn, operation });
+    const expiresAt = Date.now() + expiresIn * 1e3;
+    const token = Math.random().toString(36).slice(2, 18);
+    const url = `https://storage.mock.local/${bucket}/${key}?X-Amz-Algorithm=MOCK-HMAC-SHA256&X-Amz-Expires=${expiresIn}&X-Amz-SignedHeaders=host&X-Amz-Signature=${token}&operation=${operation}`;
+    return { url, expiresAt };
+  }
+};
+registerIntegration("storage", StorageIntegration);
+
+// src/integrations/docker/index.ts
+var DockerIntegration = class extends BaseIntegration {
+  constructor(config) {
+    super(config);
+    this.containers = /* @__PURE__ */ new Map();
+    this.images = /* @__PURE__ */ new Map();
+    const dockerHost = config.env.DOCKER_HOST;
+    if (dockerHost) {
+      this.logger.warn(
+        "DOCKER_HOST is configured but real Docker client is not yet implemented. Falling back to in-memory simulation.",
+        { dockerHost }
+      );
+    }
+    this.logger.info("Docker integration initialized (in-memory simulation)");
+  }
+  async execute(action, params) {
+    const validation = this.validateParams(action, params);
+    if (!validation.valid) {
+      return {
+        success: false,
+        error: {
+          name: "IntegrationError",
+          message: "Validation failed",
+          code: "VALIDATION_ERROR",
+          details: validation.errors
+        },
+        metadata: this.createMetadata(action, 0)
+      };
+    }
+    const startTime = Date.now();
+    try {
+      let data;
+      switch (action) {
+        case "build":
+          data = await this.executeWithRetry(() => this.build(params));
+          break;
+        case "run":
+          data = await this.executeWithRetry(() => this.run(params));
+          break;
+        case "stop":
+          data = await this.executeWithRetry(() => this.stop(params));
+          break;
+        case "remove":
+          data = await this.executeWithRetry(() => this.removeContainer(params));
+          break;
+        case "logs":
+          data = await this.executeWithRetry(() => this.logs(params));
+          break;
+        case "status":
+          data = await this.executeWithRetry(() => this.status(params));
+          break;
+        case "list":
+          data = await this.executeWithRetry(() => this.list(params));
+          break;
+        default:
+          throw new Error(`Unknown action: ${action}`);
+      }
+      return {
+        success: true,
+        data,
+        metadata: this.createMetadata(action, Date.now() - startTime)
+      };
+    } catch (error) {
+      return this.handleError(action, error);
+    }
+  }
+  // ---------------------------------------------------------------------------
+  // Helpers
+  // ---------------------------------------------------------------------------
+  /** Generate a random hex container/image ID. */
+  generateId() {
+    const segments = [];
+    for (let i = 0; i < 16; i++) {
+      segments.push(Math.floor(Math.random() * 256).toString(16).padStart(2, "0"));
+    }
+    return segments.join("");
+  }
+  /** Find a container by ID (prefix match supported). */
+  findContainer(containerId) {
+    const exact = this.containers.get(containerId);
+    if (exact) return exact;
+    for (const [id, container] of this.containers) {
+      if (id.startsWith(containerId)) {
+        return container;
+      }
+    }
+    return void 0;
+  }
+  /** Generate realistic log lines for a container. */
+  generateLogLines(container, count) {
+    const lines = [...container.logs];
+    const baseTime = container.startedAt ?? container.createdAt;
+    while (lines.length < count) {
+      const ts = new Date(baseTime + lines.length * 1e3).toISOString();
+      lines.push(`${ts} [info] Container ${container.name} \u2014 heartbeat #${lines.length + 1}`);
+    }
+    return lines;
+  }
+  // ---------------------------------------------------------------------------
+  // Actions
+  // ---------------------------------------------------------------------------
+  async build(params) {
+    const dockerfile = params.dockerfile ?? "Dockerfile";
+    const tag = params.tag;
+    const context = params.context ?? ".";
+    const buildArgs = params.buildArgs ?? {};
+    this.logger.debug("Docker BUILD", { dockerfile, tag, context, buildArgs });
+    const imageId = `sha256:${this.generateId()}`;
+    const size = 15e7 + Math.floor(Math.random() * 35e7);
+    const buildTime = 2e3 + Math.floor(Math.random() * 8e3);
+    const image = {
+      id: imageId,
+      tag,
+      dockerfile,
+      size,
+      createdAt: Date.now()
+    };
+    this.images.set(tag, image);
+    return { imageId, tag, size, buildTime };
+  }
+  async run(params) {
+    const image = params.image;
+    const name = params.name ?? `container-${this.generateId().slice(0, 12)}`;
+    const rawPorts = params.ports ?? [];
+    const env = params.env ?? {};
+    const rawVolumes = params.volumes ?? [];
+    const command = params.command ?? "";
+    this.logger.debug("Docker RUN", { image, name, ports: rawPorts.map((p) => `${p.host}:${p.container}`).join(", "), volumes: rawVolumes.map((v) => `${v.host}:${v.container}`).join(", "), command });
+    const containerId = this.generateId();
+    const ports = rawPorts.map((p) => ({
+      host: p.host,
+      container: p.container,
+      protocol: p.protocol ?? "tcp"
+    }));
+    const volumes = rawVolumes.map((v) => ({
+      host: v.host,
+      container: v.container
+    }));
+    const container = {
+      id: containerId,
+      name,
+      image,
+      status: "running",
+      ports,
+      env,
+      volumes,
+      command,
+      labels: {},
+      createdAt: Date.now(),
+      startedAt: Date.now(),
+      stoppedAt: null,
+      logs: [
+        `${(/* @__PURE__ */ new Date()).toISOString()} [info] Starting container ${name} from image ${image}`,
+        `${(/* @__PURE__ */ new Date()).toISOString()} [info] Container ${name} is now running`
+      ]
+    };
+    this.containers.set(containerId, container);
+    return {
+      containerId,
+      name,
+      status: container.status,
+      ports
+    };
+  }
+  async stop(params) {
+    const containerId = params.containerId;
+    this.logger.debug("Docker STOP", { containerId });
+    const container = this.findContainer(containerId);
+    if (!container) {
+      throw new Error(`Container not found: ${containerId}`);
+    }
+    if (container.status !== "running" && container.status !== "paused") {
+      throw new Error(`Container ${containerId} is not running (current status: ${container.status})`);
+    }
+    container.status = "exited";
+    container.stoppedAt = Date.now();
+    container.logs.push(
+      `${(/* @__PURE__ */ new Date()).toISOString()} [info] Container ${container.name} stopped`
+    );
+    return {
+      containerId: container.id,
+      status: container.status,
+      stoppedAt: container.stoppedAt
+    };
+  }
+  async removeContainer(params) {
+    const containerId = params.containerId;
+    const force = params.force ?? false;
+    this.logger.debug("Docker REMOVE", { containerId, force });
+    const container = this.findContainer(containerId);
+    if (!container) {
+      throw new Error(`Container not found: ${containerId}`);
+    }
+    if (container.status === "running" && !force) {
+      throw new Error(
+        `Container ${containerId} is running. Stop it first or use force=true.`
+      );
+    }
+    this.containers.delete(container.id);
+    return { containerId: container.id, removed: true };
+  }
+  async logs(params) {
+    const containerId = params.containerId;
+    const tail = params.tail ?? 100;
+    const since = params.since ?? void 0;
+    this.logger.debug("Docker LOGS", { containerId, tail, since });
+    const container = this.findContainer(containerId);
+    if (!container) {
+      throw new Error(`Container not found: ${containerId}`);
+    }
+    let logLines = this.generateLogLines(container, tail);
+    if (since) {
+      const sinceMs = new Date(since).getTime();
+      logLines = logLines.filter((line) => {
+        const timestampMatch = /^\d{4}-\d{2}-\d{2}T[\d:.]+Z/.exec(line);
+        if (!timestampMatch) return true;
+        return new Date(timestampMatch[0]).getTime() >= sinceMs;
+      });
+    }
+    const tailedLines = logLines.slice(-tail);
+    return {
+      containerId: container.id,
+      logs: tailedLines,
+      lineCount: tailedLines.length
+    };
+  }
+  async status(params) {
+    const containerId = params.containerId;
+    this.logger.debug("Docker STATUS", { containerId });
+    const container = this.findContainer(containerId);
+    if (!container) {
+      throw new Error(`Container not found: ${containerId}`);
+    }
+    return {
+      containerId: container.id,
+      name: container.name,
+      image: container.image,
+      status: container.status,
+      ports: container.ports,
+      createdAt: container.createdAt,
+      startedAt: container.startedAt,
+      stoppedAt: container.stoppedAt
+    };
+  }
+  async list(params) {
+    const showAll = params.all ?? false;
+    const filterByLabel = params.filterByLabel ?? void 0;
+    this.logger.debug("Docker LIST", { all: showAll, filterByLabel });
+    let entries = Array.from(this.containers.values());
+    if (!showAll) {
+      entries = entries.filter((c) => c.status === "running");
+    }
+    if (filterByLabel) {
+      const [labelKey, labelValue] = filterByLabel.split("=");
+      entries = entries.filter((c) => {
+        if (labelValue !== void 0) {
+          return c.labels[labelKey] === labelValue;
+        }
+        return labelKey in c.labels;
+      });
+    }
+    entries.sort((a, b) => b.createdAt - a.createdAt);
+    const containers = entries.map((c) => ({
+      id: c.id,
+      name: c.name,
+      image: c.image,
+      status: c.status,
+      ports: c.ports,
+      createdAt: c.createdAt
+    }));
+    return { containers, total: containers.length };
+  }
+};
+registerIntegration("docker", DockerIntegration);
+
+// src/integrations/database/sql-guard.ts
+var DENIED_KEYWORDS = /* @__PURE__ */ new Set(["INSERT", "UPDATE", "DELETE", "MERGE", "INTO", "FOR"]);
+function isWordChar(ch) {
+  return ch >= "a" && ch <= "z" || ch >= "A" && ch <= "Z" || ch >= "0" && ch <= "9" || ch === "_" || ch === "$";
+}
+function skipSingleQuoted(sql, start, eString) {
+  let i = start + 1;
+  while (i < sql.length) {
+    if (eString && sql[i] === "\\") {
+      i += 2;
+      continue;
+    }
+    if (sql[i] === "'") {
+      if (sql[i + 1] === "'") {
+        i += 2;
+        continue;
       }
-      if (expectedType === "object" && (actualType !== "object" || Array.isArray(value) || value === null)) {
-        errors.push({
-          param: paramDef.name,
-          message: `Expected object, got ${actualType}`
-        });
+      return i + 1;
+    }
+    i++;
+  }
+  return sql.length;
+}
+function skipDoubleQuoted(sql, start) {
+  let i = start + 1;
+  while (i < sql.length) {
+    if (sql[i] === '"') {
+      if (sql[i + 1] === '"') {
+        i += 2;
+        continue;
       }
+      return i + 1;
     }
+    i++;
   }
-  return {
-    valid: errors.length === 0,
-    errors
-  };
+  return sql.length;
 }
-
-// src/core/retry.ts
-async function withRetry(fn, config) {
-  const {
-    maxAttempts,
-    backoffMs,
-    maxBackoffMs = 3e4,
-    retryableErrors
-  } = config;
-  let lastError;
-  for (let attempt = 1; attempt <= maxAttempts; attempt++) {
-    try {
-      return await fn();
-    } catch (error) {
-      lastError = error;
-      if (error && typeof error === "object" && "code" in error && retryableErrors) {
-        const integrationError = error;
-        if (!retryableErrors.includes(integrationError.code)) {
-          throw error;
+function matchDollarTag(sql, start) {
+  let i = start + 1;
+  if (sql[i] === "$") return "$$";
+  const first = sql[i];
+  if (!first || !(first >= "a" && first <= "z" || first >= "A" && first <= "Z" || first === "_")) {
+    return void 0;
+  }
+  i++;
+  while (i < sql.length && isWordChar(sql[i]) && sql[i] !== "$") i++;
+  if (sql[i] !== "$") return void 0;
+  return sql.slice(start, i + 1);
+}
+function sanitizeSql(sql) {
+  const out = [];
+  let i = 0;
+  while (i < sql.length) {
+    const ch = sql[i];
+    if (ch === "-" && sql[i + 1] === "-") {
+      while (i < sql.length && sql[i] !== "\n") i++;
+      out.push(" ");
+      continue;
+    }
+    if (ch === "/" && sql[i + 1] === "*") {
+      let depth = 1;
+      i += 2;
+      while (i < sql.length && depth > 0) {
+        if (sql[i] === "/" && sql[i + 1] === "*") {
+          depth++;
+          i += 2;
+        } else if (sql[i] === "*" && sql[i + 1] === "/") {
+          depth--;
+          i += 2;
+        } else {
+          i++;
         }
       }
-      if (attempt === maxAttempts) {
-        throw error;
+      out.push(" ");
+      continue;
+    }
+    if (ch === "'") {
+      let j = i - 1;
+      while (j >= 0 && (sql[j] === " " || sql[j] === "	" || sql[j] === "\n" || sql[j] === "\r")) j--;
+      const prev = j >= 0 ? sql[j] : "";
+      const eString = (prev === "e" || prev === "E") && (j === 0 || !isWordChar(sql[j - 1]));
+      i = skipSingleQuoted(sql, i, eString);
+      out.push("''");
+      continue;
+    }
+    if (ch === '"') {
+      i = skipDoubleQuoted(sql, i);
+      out.push('""');
+      continue;
+    }
+    if (ch === "$") {
+      const tag = matchDollarTag(sql, i);
+      if (tag) {
+        const close = sql.indexOf(tag, i + tag.length);
+        i = close === -1 ? sql.length : close + tag.length;
+        out.push("$$");
+        continue;
       }
-      const delay = Math.min(
-        backoffMs * Math.pow(2, attempt - 1),
-        maxBackoffMs
-      );
-      await new Promise((resolve) => setTimeout(resolve, delay));
     }
+    out.push(ch);
+    i++;
   }
-  throw lastError;
+  return out.join("");
 }
-
-// src/core/BaseIntegration.ts
-var BaseIntegration = class {
-  constructor(config) {
-    this.config = config;
-    this.logger = config.logger || new ConsoleLogger();
+function assertReadOnlySelect(sql) {
+  const sanitized = sanitizeSql(sql);
+  const statements = sanitized.split(";").map((s) => s.trim()).filter((s) => s.length > 0);
+  if (statements.length === 0) {
+    return { ok: false, reason: "Empty statement" };
   }
-  /**
-   * Validate action params against registry
-   */
-  validateParams(action, params) {
-    return validateParams(this.config.name, action, params);
+  if (statements.length > 1) {
+    return { ok: false, reason: "Only a single statement is allowed" };
   }
-  /**
-   * Handle errors uniformly
-   */
-  handleError(action, error) {
-    this.logger.error(`Integration error in ${this.config.name}.${action}`, {
-      error: error instanceof Error ? error : new Error(String(error))
+  const words = (statements[0].match(/\b[A-Za-z_][A-Za-z0-9_]*\b/g) ?? []).map(
+    (w) => w.toUpperCase()
+  );
+  const first = words[0];
+  if (first !== "SELECT" && first !== "WITH") {
+    return { ok: false, reason: "Only SELECT statements are allowed" };
+  }
+  const denied = words.find((w) => DENIED_KEYWORDS.has(w));
+  if (denied) {
+    return { ok: false, reason: `Keyword not allowed in a read-only query: ${denied}` };
+  }
+  return { ok: true };
+}
+
+// src/integrations/database/index.ts
+var DEFAULT_STATEMENT_TIMEOUT_MS = 1e4;
+var PG_QUERY_CANCELED = "57014";
+var PostgresDriver = class {
+  constructor(connectionString, statementTimeoutMs) {
+    this.pool = new Pool({
+      connectionString,
+      statement_timeout: statementTimeoutMs,
+      query_timeout: statementTimeoutMs
     });
-    const integrationError = error instanceof Error ? error : new Error(String(error));
-    return {
-      success: false,
-      error: integrationError,
-      metadata: this.createMetadata(action, 0, 0)
-    };
   }
-  /**
-   * Create metadata for result
-   */
-  createMetadata(action, duration, retries = 0) {
+  async query(sql, params) {
+    const result = await this.pool.query(sql, [...params]);
     return {
-      integration: this.config.name,
-      action,
-      duration,
-      retries,
-      timestamp: Date.now()
+      rows: result.rows,
+      rowCount: result.rowCount ?? result.rows.length
     };
   }
-  /**
-   * Execute with retry logic
-   */
-  async executeWithRetry(fn) {
-    if (!this.config.retry) {
-      return fn();
+  async end() {
+    await this.pool.end();
+  }
+};
+function mapDriverError(error) {
+  if (error instanceof IntegrationError) return error;
+  const code = error.code;
+  if (code === PG_QUERY_CANCELED) {
+    return new IntegrationError("Statement timeout exceeded", "TIMEOUT_ERROR");
+  }
+  const message = error instanceof Error ? error.message : String(error);
+  return new IntegrationError(message, "SERVICE_ERROR");
+}
+var DatabaseIntegration = class extends BaseIntegration {
+  constructor(config) {
+    super(config);
+    this.drivers = /* @__PURE__ */ new Map();
+    const fromEnv = config.env.DATABASE_STATEMENT_TIMEOUT_MS;
+    if (fromEnv) {
+      const parsed = Number(fromEnv);
+      if (!Number.isFinite(parsed) || parsed <= 0) {
+        throw new Error(`Invalid DATABASE_STATEMENT_TIMEOUT_MS: ${fromEnv}`);
+      }
+      this.statementTimeoutMs = parsed;
+    } else {
+      this.statementTimeoutMs = config.timeout ?? DEFAULT_STATEMENT_TIMEOUT_MS;
     }
-    return withRetry(fn, {
-      maxAttempts: this.config.retry.maxAttempts,
-      backoffMs: this.config.retry.backoffMs,
-      maxBackoffMs: this.config.retry.maxBackoffMs,
-      retryableErrors: [
-        "TIMEOUT_ERROR",
-        "NETWORK_ERROR",
-        "RATE_LIMIT_ERROR"
-      ]
+    this.logger.info("Database integration initialized", {
+      statementTimeoutMs: this.statementTimeoutMs
     });
   }
+  async execute(action, params) {
+    const validation = this.validateParams(action, params);
+    if (!validation.valid) {
+      return {
+        success: false,
+        error: {
+          name: "IntegrationError",
+          message: "Validation failed",
+          code: "VALIDATION_ERROR",
+          details: validation.errors
+        },
+        metadata: this.createMetadata(action, 0)
+      };
+    }
+    const startTime = Date.now();
+    try {
+      let data;
+      switch (action) {
+        case "query":
+          data = await this.executeWithRetry(() => this.runQuery(params));
+          break;
+        default:
+          throw new Error(`Unknown action: ${action}`);
+      }
+      return {
+        success: true,
+        data,
+        metadata: this.createMetadata(action, Date.now() - startTime)
+      };
+    } catch (error) {
+      return this.handleError(action, error);
+    }
+  }
+  async runQuery(params) {
+    const guard = assertReadOnlySelect(params.sql);
+    if (!guard.ok) {
+      throw new IntegrationError(
+        `Read-only violation: ${guard.reason ?? "not a SELECT statement"}`,
+        "VALIDATION_ERROR"
+      );
+    }
+    const driver = this.driverFor(params.connectionRef);
+    this.logger.debug("Database QUERY", { connectionRef: params.connectionRef });
+    try {
+      return await driver.query(params.sql, params.params ?? []);
+    } catch (error) {
+      throw mapDriverError(error);
+    }
+  }
+  /** Resolve (and cache) the driver for a connection reference. */
+  driverFor(connectionRef) {
+    const connectionString = process.env[connectionRef];
+    if (!connectionString) {
+      throw new IntegrationError(
+        `Connection reference "${connectionRef}" is not set in the environment`,
+        "AUTH_ERROR"
+      );
+    }
+    const cached = this.drivers.get(connectionString);
+    if (cached) return cached;
+    const driver = new PostgresDriver(connectionString, this.statementTimeoutMs);
+    this.drivers.set(connectionString, driver);
+    return driver;
+  }
 };
+registerIntegration("database", DatabaseIntegration);
 
-// src/types.ts
-var IntegrationError = class extends Error {
-  constructor(message, code = "UNKNOWN_ERROR", details) {
-    super(message);
-    this.name = "IntegrationError";
-    this.code = code;
-    this.details = details;
+// src/integrations/wikimedia/index.ts
+var WIKI_ENDPOINT = "https://en.wikipedia.org/w/api.php";
+var DEFAULT_UA = "Almadar/1.0 (https://almadar.dev)";
+var DEFAULT_TIMEOUT_MS2 = 6e3;
+var EXTRACT_CHAR_CAP = 2e3;
+var WikimediaIntegration = class extends BaseIntegration {
+  constructor(config) {
+    super(config);
+    this.userAgent = config.env?.WIKIMEDIA_USER_AGENT ?? DEFAULT_UA;
+    this.timeoutMs = Number(config.env?.WIKIMEDIA_TIMEOUT_MS ?? DEFAULT_TIMEOUT_MS2);
+    this.logger.info("Wikimedia integration initialized");
   }
-  toJSON() {
-    return {
-      name: this.name,
-      message: this.message,
-      code: this.code,
-      integration: this.integration,
-      action: this.action,
-      details: this.details
+  async execute(action, params) {
+    const validation = this.validateParams(action, params);
+    if (!validation.valid) {
+      return {
+        success: false,
+        error: {
+          name: "IntegrationError",
+          message: "Validation failed",
+          code: "VALIDATION_ERROR",
+          details: validation.errors
+        },
+        metadata: this.createMetadata(action, 0)
+      };
+    }
+    const startTime = Date.now();
+    try {
+      let data;
+      switch (action) {
+        case "getPage":
+          data = await this.executeWithRetry(() => this.getPage(params));
+          break;
+        default:
+          throw new Error(`Unknown action: ${action}`);
+      }
+      return { success: true, data, metadata: this.createMetadata(action, Date.now() - startTime) };
+    } catch (error) {
+      return this.handleError(action, error);
+    }
+  }
+  /** Look up a title on Wikipedia: description, portrait, lead extract. Empty fields on miss. */
+  async getPage(params) {
+    const title = String(params.title ?? "").trim();
+    if (!title) return {};
+    const url = `${WIKI_ENDPOINT}?action=query&format=json&redirects=1&prop=pageimages|description|extracts&explaintext=1&exintro=1&piprop=thumbnail&pithumbsize=240&titles=${encodeURIComponent(title)}`;
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), this.timeoutMs);
+    try {
+      const res = await fetch(url, { headers: { "User-Agent": this.userAgent }, signal: ctrl.signal });
+      if (!res.ok) return {};
+      const data = await res.json();
+      const pages = data.query?.pages;
+      if (!pages) return {};
+      const page = Object.values(pages)[0];
+      if (!page || page.missing !== void 0) return {};
+      const extract = typeof page.extract === "string" ? page.extract.slice(0, EXTRACT_CHAR_CAP).trim() : void 0;
+      return {
+        title: page.title,
+        description: page.description ?? (typeof page.extract === "string" ? page.extract.split(".")[0] : void 0),
+        portraitUrl: page.thumbnail?.source,
+        extract
+      };
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+};
+registerIntegration("wikimedia", WikimediaIntegration);
+
+// src/integrations/iconify/index.ts
+var ICONIFY_API = "https://api.iconify.design";
+var DEFAULT_UA2 = "Almadar/1.0 (https://almadar.dev)";
+var DEFAULT_TIMEOUT_MS3 = 6e3;
+var IconifyIntegration = class extends BaseIntegration {
+  constructor(config) {
+    super(config);
+    this.userAgent = config.env?.ICONIFY_USER_AGENT ?? DEFAULT_UA2;
+    this.timeoutMs = Number(config.env?.ICONIFY_TIMEOUT_MS ?? DEFAULT_TIMEOUT_MS3);
+    this.logger.info("Iconify integration initialized");
+  }
+  async execute(action, params) {
+    const validation = this.validateParams(action, params);
+    if (!validation.valid) {
+      return {
+        success: false,
+        error: {
+          name: "IntegrationError",
+          message: "Validation failed",
+          code: "VALIDATION_ERROR",
+          details: validation.errors
+        },
+        metadata: this.createMetadata(action, 0)
+      };
+    }
+    const startTime = Date.now();
+    try {
+      let data;
+      switch (action) {
+        case "svgExists":
+          data = await this.executeWithRetry(() => this.svgExists(params));
+          break;
+        case "search":
+          data = await this.executeWithRetry(() => this.search(params));
+          break;
+        case "getIconBody":
+          data = await this.executeWithRetry(() => this.getIconBody(params));
+          break;
+        default:
+          throw new Error(`Unknown action: ${action}`);
+      }
+      return { success: true, data, metadata: this.createMetadata(action, Date.now() - startTime) };
+    } catch (error) {
+      return this.handleError(action, error);
+    }
+  }
+  async svgExists(params) {
+    const path = String(params.path ?? "");
+    if (!path) return { exists: false };
+    return { exists: await this.headOk(`${ICONIFY_API}/${path}`) };
+  }
+  async search(params) {
+    const query = String(params.query ?? "");
+    if (!query) return { icons: [] };
+    const limit = Number(params.limit ?? 1);
+    const data = await this.getJson(`${ICONIFY_API}/search?query=${encodeURIComponent(query)}&limit=${limit}`);
+    return { icons: data?.icons ?? [] };
+  }
+  async getIconBody(params) {
+    const iconId = String(params.iconId ?? "");
+    const [prefix, name] = iconId.split(":");
+    if (!prefix || !name) return { body: null };
+    const data = await this.getJson(`${ICONIFY_API}/${prefix}.json?icons=${encodeURIComponent(name)}`);
+    return { body: data?.icons?.[name]?.body ?? data?.aliases?.[name]?.body ?? null };
+  }
+  async headOk(url) {
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), this.timeoutMs);
+    try {
+      const res = await fetch(url, { method: "GET", headers: { "User-Agent": this.userAgent }, signal: ctrl.signal });
+      return res.ok;
+    } catch {
+      return false;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  async getJson(url) {
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), this.timeoutMs);
+    try {
+      const res = await fetch(url, { headers: { "User-Agent": this.userAgent }, signal: ctrl.signal });
+      if (!res.ok) return null;
+      return await res.json();
+    } catch {
+      return null;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+};
+registerIntegration("iconify", IconifyIntegration);
+
+// src/integrations/arxiv/index.ts
+var ARXIV_ENDPOINT = "https://export.arxiv.org/api/query";
+var DEFAULT_TIMEOUT_MS4 = 1e4;
+var DEFAULT_MAX_RESULTS = 8;
+function parseAtom(xml) {
+  const entries = [];
+  for (const block of xml.split("<entry>").slice(1)) {
+    const grab = (tag) => {
+      const m = block.match(new RegExp(`<${tag}[^>]*>([\\s\\S]*?)</${tag}>`, "i"));
+      return m ? m[1].replace(/<[^>]+>/g, "").trim() : "";
     };
+    const id = grab("id");
+    const title = grab("title").replace(/\s+/g, " ");
+    const summary = grab("summary").replace(/\s+/g, " ");
+    const published = grab("published");
+    const authors = Array.from(block.matchAll(/<author>\s*<name>([^<]+)<\/name>/g)).map((m) => m[1].trim());
+    const linkMatch = block.match(/<link[^>]*rel="alternate"[^>]*href="([^"]+)"/i);
+    const url = linkMatch ? linkMatch[1] : id;
+    if (id || title) entries.push({ id, title, summary, authors, published, url });
+  }
+  return entries;
+}
+var ArxivIntegration = class extends BaseIntegration {
+  constructor(config) {
+    super(config);
+    this.timeoutMs = Number(config.env?.ARXIV_TIMEOUT_MS ?? DEFAULT_TIMEOUT_MS4);
+    this.logger.info("arXiv integration initialized");
+  }
+  async execute(action, params) {
+    const validation = this.validateParams(action, params);
+    if (!validation.valid) {
+      return {
+        success: false,
+        error: {
+          name: "IntegrationError",
+          message: "Validation failed",
+          code: "VALIDATION_ERROR",
+          details: validation.errors
+        },
+        metadata: this.createMetadata(action, 0)
+      };
+    }
+    const startTime = Date.now();
+    try {
+      let data;
+      switch (action) {
+        case "search":
+          data = await this.executeWithRetry(() => this.search(params));
+          break;
+        default:
+          throw new Error(`Unknown action: ${action}`);
+      }
+      return { success: true, data, metadata: this.createMetadata(action, Date.now() - startTime) };
+    } catch (error) {
+      return this.handleError(action, error);
+    }
+  }
+  async search(params) {
+    const query = String(params.query ?? "").trim();
+    if (!query) return { results: [] };
+    const maxResults = Number(params.maxResults ?? DEFAULT_MAX_RESULTS);
+    const url = `${ARXIV_ENDPOINT}?search_query=${encodeURIComponent(`all:${query}`)}&start=0&max_results=${maxResults}&sortBy=relevance`;
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), this.timeoutMs);
+    try {
+      const res = await fetch(url, { headers: { "Accept": "application/atom+xml" }, signal: ctrl.signal });
+      if (!res.ok) return { results: [] };
+      const xml = await res.text();
+      return { results: parseAtom(xml) };
+    } finally {
+      clearTimeout(timer);
+    }
   }
 };
+registerIntegration("arxiv", ArxivIntegration);
 
 // src/mocks/MockIntegration.ts
 var MockIntegration = class extends BaseIntegration {
@@ -356,6 +3633,35 @@ function generateMockFromShape(shape) {
 var RuntimeIntegrationManager = class {
   constructor() {
     this.factory = new IntegrationFactory();
+    this.installNotConfiguredFallback();
+  }
+  /**
+   * Wrap `factory.execute` so an unknown/unconfigured service echoes its
+   * params instead of throwing. This makes the manager safe to install as a
+   * default `callService` handler (e.g. the playground sidecar) without every
+   * service being configured. REAL execution errors (API failures, bad
+   * params, schema violations) still propagate so the circuit's failure
+   * events fire — only the two "not set up" errors (`Unknown integration`,
+   * `Integration not configured`) are caught. Subsumes the broader wrapper
+   * that previously lived inside `configureMockMode`.
+   */
+  installNotConfiguredFallback() {
+    const originalExecute = this.factory.execute.bind(this.factory);
+    this.factory.execute = async (integration, action, params) => {
+      try {
+        return await originalExecute(integration, action, params);
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        if (/Unknown integration|not configured/i.test(msg)) {
+          return {
+            success: true,
+            data: { ...params, _mock: true, _service: integration, _action: action },
+            metadata: { integration, action, duration: 0, retries: 0, timestamp: Date.now() }
+          };
+        }
+        throw err;
+      }
+    };
   }
   /**
    * Configure from environment variables.
@@ -407,20 +3713,16 @@ var RuntimeIntegrationManager = class {
         }
       });
     }
-    if (env.ANTHROPIC_API_KEY) {
-      this.factory.configure("llm", {
-        env: {
-          PROVIDER: "anthropic",
-          ANTHROPIC_API_KEY: env.ANTHROPIC_API_KEY
-        }
-      });
-    } else if (env.OPENAI_API_KEY) {
-      this.factory.configure("llm", {
-        env: {
-          PROVIDER: "openai",
-          OPENAI_API_KEY: env.OPENAI_API_KEY
-        }
-      });
+    const llmEnv = {};
+    for (const k of ["ANTHROPIC_API_KEY", "OPENAI_API_KEY", "DEEPSEEK_API_KEY", "KIMI_API_KEY", "OPEN_ROUTER_API_KEY"]) {
+      if (env[k]) llmEnv[k] = env[k];
+    }
+    if (env.PROVIDER) llmEnv.PROVIDER = env.PROVIDER;
+    for (const k of ["EMBEDDING_PROVIDER", "EMBEDDING_MODEL", "EMBEDDING_API_KEY"]) {
+      if (env[k]) llmEnv[k] = env[k];
+    }
+    if (Object.keys(llmEnv).length > 0) {
+      this.factory.configure("llm", { env: llmEnv });
     }
     if (env.MASAR_URL && env.MASAR_ML_TRAIT) {
       this.factory.configure("ml", {
@@ -468,18 +3770,6 @@ var RuntimeIntegrationManager = class {
       this.factory.configure(serviceName, { env: {} });
       this.factory.registerInstance(serviceName, mock);
     }
-    const originalExecute = this.factory.execute.bind(this.factory);
-    this.factory.execute = async (integration, action, params) => {
-      try {
-        return await originalExecute(integration, action, params);
-      } catch {
-        return {
-          success: true,
-          data: { ...params, _mock: true, _service: integration, _action: action },
-          metadata: { integration, action, duration: 0, retries: 0, timestamp: Date.now() }
-        };
-      }
-    };
   }
   /**
    * Load services registry from @almadar/core/patterns.