@almadar/integrations 2.24.0 → 2.26.0

package/dist/{contracts-Dv9PM_Cz.d.ts → store-tehIm2rt.d.ts}

@@ -1,5 +1,5 @@
-import { ServiceParamsValue, ServiceParams } from '@almadar/core';
-import { d as IntegrationParamValue, e as IntegrationParams } from './BaseIntegration-MA-b4fh8.js';
+import { ServiceParamsValue, ServiceParams, EntityRow } from '@almadar/core';
+import { f as IntegrationParamValue, g as IntegrationParams } from './BaseIntegration-C_5q54DM.js';
 
 /** Scalar value admissible as a SQL bind parameter. */
 type DatabaseQueryParamValue = string | number | boolean | Date | null;
@@ -79,8 +79,9 @@ type GitHubActions = {
         params: {
             title: string;
             body: string;
-            head: string;
-            base: string;
+            baseBranch: string;
+            headBranch: string;
+            draft?: boolean;
         };
         result: {
             number: number;
@@ -322,6 +323,7 @@ type TwilioActions = {
         params: {
             to: string;
             body: string;
+            from?: string;
         };
         result: {
             sid: string;
@@ -346,6 +348,11 @@ type EmailActions = {
             subject: string;
             body: string;
             from?: string;
+            /** HTML content; when present `body` becomes the plain-text alternative. */
+            htmlBody?: string;
+            replyTo?: string;
+            /** Provider template reference (SendGrid dynamic templates; Resend rejects it loudly). */
+            templateId?: string;
         };
         result: {
             id: string;
@@ -368,6 +375,336 @@ type WebhookActions = {
         };
     };
 };
+type PushActions = {
+    send: {
+        params: {
+            subscription: {
+                endpoint: string;
+                keys: {
+                    p256dh: string;
+                    auth: string;
+                };
+            };
+            title: string;
+            body: string;
+            url?: string;
+            icon?: string;
+        };
+        result: {
+            statusCode: number;
+            ok: boolean;
+            expired: boolean;
+        };
+    };
+};
+type CalendarActions = {
+    listEvents: {
+        params: {
+            calendarId?: string;
+            timeMin?: string;
+            timeMax?: string;
+            syncToken?: string;
+            maxResults?: number;
+        };
+        result: {
+            events: Array<{
+                id: string;
+                summary: string;
+                description: string;
+                location: string;
+                start: string;
+                end: string;
+                status: string;
+                updated: string;
+            }>;
+            nextSyncToken: string | null;
+        };
+    };
+    createEvent: {
+        params: {
+            calendarId?: string;
+            summary: string;
+            description?: string;
+            location?: string;
+            start: string;
+            end?: string;
+            durationMinutes?: number;
+        };
+        result: {
+            id: string;
+            status: string;
+            htmlLink: string;
+        };
+    };
+    updateEvent: {
+        params: {
+            calendarId?: string;
+            eventId: string;
+            summary?: string;
+            description?: string;
+            location?: string;
+            start?: string;
+            end?: string;
+        };
+        result: {
+            id: string;
+            status: string;
+        };
+    };
+    deleteEvent: {
+        params: {
+            calendarId?: string;
+            eventId: string;
+        };
+        result: {
+            id: string;
+            deleted: boolean;
+        };
+    };
+    freeBusy: {
+        params: {
+            calendarId?: string;
+            timeMin: string;
+            timeMax: string;
+        };
+        result: {
+            busy: Array<{
+                start: string;
+                end: string;
+            }>;
+        };
+    };
+    watch: {
+        params: {
+            calendarId?: string;
+            channelId: string;
+            address: string;
+            ttlSeconds?: number;
+        };
+        result: {
+            channelId: string;
+            resourceId: string;
+            expiration: string;
+        };
+    };
+    stopWatch: {
+        params: {
+            channelId: string;
+            resourceId: string;
+        };
+        result: {
+            stopped: boolean;
+        };
+    };
+};
+type DriveActions = {
+    listFiles: {
+        params: {
+            folderId?: string;
+            query?: string;
+            maxResults?: number;
+        };
+        result: {
+            files: Array<{
+                id: string;
+                name: string;
+                mimeType: string;
+                size: number;
+                modifiedTime: string;
+                webViewLink: string;
+            }>;
+        };
+    };
+    getFile: {
+        params: {
+            fileId: string;
+        };
+        result: {
+            id: string;
+            name: string;
+            mimeType: string;
+            content: string;
+            size: number;
+        };
+    };
+    uploadFile: {
+        params: {
+            name: string;
+            content: string;
+            mimeType?: string;
+            folderId?: string;
+        };
+        result: {
+            id: string;
+            name: string;
+            webViewLink: string;
+        };
+    };
+    createFolder: {
+        params: {
+            name: string;
+            parentId?: string;
+        };
+        result: {
+            id: string;
+            name: string;
+        };
+    };
+    shareFile: {
+        params: {
+            fileId: string;
+            email: string;
+            role?: 'reader' | 'writer' | 'commenter';
+        };
+        result: {
+            shared: boolean;
+            permissionId: string;
+        };
+    };
+};
+type MetaAdsActions = {
+    getSpend: {
+        params: {
+            accountId?: string;
+            since: string;
+            until: string;
+            clientTag?: string;
+        };
+        result: {
+            spend: number;
+            currency: string;
+            impressions: number;
+            clicks: number;
+        };
+    };
+    listCampaigns: {
+        params: {
+            accountId?: string;
+            status?: string;
+        };
+        result: {
+            campaigns: Array<{
+                id: string;
+                name: string;
+                status: string;
+                dailyBudget: number;
+            }>;
+        };
+    };
+};
+type AccountingActions = {
+    exportInvoices: {
+        params: {
+            invoices: Array<{
+                id: string;
+                number: string;
+                customer: string;
+                issuedAt: string;
+                dueAt: string;
+                currency: string;
+                net: number;
+                tax: number;
+                gross: number;
+                status: string;
+            }>;
+            format?: 'csv';
+        };
+        result: {
+            content: string;
+            filename: string;
+            count: number;
+        };
+    };
+    exportJournal: {
+        params: {
+            entries: Array<{
+                date: string;
+                account: string;
+                description: string;
+                debit: number;
+                credit: number;
+                reference: string;
+            }>;
+            format?: 'csv';
+        };
+        result: {
+            content: string;
+            filename: string;
+            count: number;
+        };
+    };
+};
+type BankingActions = {
+    createRequisition: {
+        params: {
+            institutionId: string;
+            redirectUrl: string;
+            reference?: string;
+        };
+        result: {
+            requisitionId: string;
+            link: string;
+        };
+    };
+    listAccounts: {
+        params: {
+            requisitionId: string;
+        };
+        result: {
+            accounts: string[];
+        };
+    };
+    listTransactions: {
+        params: {
+            accountId: string;
+            dateFrom?: string;
+            dateTo?: string;
+        };
+        result: {
+            transactions: Array<{
+                id: string;
+                amount: number;
+                currency: string;
+                date: string;
+                description: string;
+                counterparty: string;
+            }>;
+        };
+    };
+};
+type EsignActions = {
+    sendEnvelope: {
+        params: {
+            recipientEmail: string;
+            recipientName: string;
+            documentName: string;
+            documentContent: string;
+            emailSubject?: string;
+        };
+        result: {
+            envelopeId: string;
+            status: string;
+        };
+    };
+    getEnvelopeStatus: {
+        params: {
+            envelopeId: string;
+        };
+        result: {
+            status: string;
+            completedAt: string;
+        };
+    };
+    downloadDocument: {
+        params: {
+            envelopeId: string;
+        };
+        result: {
+            content: string;
+            documentName: string;
+        };
+    };
+};
 type DockerActions = {
     build: {
         params: {
@@ -490,7 +827,12 @@ type StorageActions = {
             key?: string;
             content?: string;
             contentType?: string;
-            file?: IntegrationParams;
+            file?: {
+                name: string;
+                size: number;
+                type: string;
+                content?: string;
+            };
             acl?: 'public' | 'private';
             maxSize?: number;
             metadata?: IntegrationParams;
@@ -500,6 +842,8 @@ type StorageActions = {
             bucket: string;
             size: number;
             etag: string;
+            id: string;
+            url: string;
         };
     };
     download: {
@@ -519,6 +863,7 @@ type StorageActions = {
             bucket: string;
             prefix?: string;
             maxKeys?: number;
+            continuationToken?: string;
         };
         result: {
             keys: Array<{
@@ -527,6 +872,7 @@ type StorageActions = {
                 lastModified: number;
             }>;
             truncated: boolean;
+            nextToken?: string;
         };
     };
     delete: {
@@ -763,6 +1109,68 @@ type OAuthActions = {
         };
     };
 };
+type CredentialsActions = {
+    list: {
+        params: {
+            service?: string;
+        };
+        result: {
+            enabled: boolean;
+            entries: Array<{
+                service: string;
+                envVar: string;
+                required: boolean;
+                description: string;
+                configured: boolean;
+                source: 'store' | 'env' | 'none';
+                last4: string;
+            }>;
+        };
+    };
+    set: {
+        params: {
+            service: string;
+            envVar: string;
+            value: string;
+        };
+        result: {
+            saved: boolean;
+            service: string;
+            envVar: string;
+            last4: string;
+        };
+    };
+    remove: {
+        params: {
+            service: string;
+            envVar: string;
+        };
+        result: {
+            removed: boolean;
+        };
+    };
+    test: {
+        params: {
+            service: string;
+        };
+        result: {
+            service: string;
+            configured: boolean;
+            missing: string[];
+            probed: boolean;
+            ok: boolean;
+            message: string;
+        };
+    };
+    rotate: {
+        params: Record<string, never>;
+        result: {
+            rotated: number;
+            alreadyCurrent: number;
+            unreadable: number;
+        };
+    };
+};
 type OtelActions = {
     startSpan: {
         params: {
@@ -989,11 +1397,19 @@ type IntegrationContracts = {
     twilio: TwilioActions;
     email: EmailActions;
     webhook: WebhookActions;
+    push: PushActions;
+    calendar: CalendarActions;
+    drive: DriveActions;
+    metaAds: MetaAdsActions;
+    accounting: AccountingActions;
+    banking: BankingActions;
+    esign: EsignActions;
     docker: DockerActions;
     storage: StorageActions;
     queue: QueueActions;
     redis: RedisActions;
     oauth: OAuthActions;
+    credentials: CredentialsActions;
     otel: OtelActions;
     cli: CLIActions;
     deepagent: DeepAgentActions;
@@ -1014,5 +1430,124 @@ type IntegrationName = keyof IntegrationContracts;
  * ```
  */
 type IntegrationActionName<K extends IntegrationName> = keyof IntegrationContracts[K] & string;
+/**
+ * Declared side-effect-free "Test connection" probes, executed by the
+ * `credentials.test` action through the normal factory path. Only services
+ * with a genuinely cheap, read-only, env-defaulted action carry one; the
+ * rest report credential presence + constructor validation.
+ */
+/**
+ * One inbound-hook mount a service's provider needs in a deployed app:
+ * `POST /api/hooks/:provider` verified by the provider's own token/signature,
+ * dispatching `event` onto the app bus. A hook is a PROVIDER property — the
+ * service invocation is the `.lolo` surface; codegen derives the mount from
+ * the app's invoked services × these declarations (I-26).
+ */
+interface HookDeclaration {
+    /** Provider key mounted at POST /api/hooks/:provider */
+    provider: string;
+    /** Bus event dispatched into the app on a verified callback */
+    event: string;
+    /** Env var carrying the provider's verification secret/channel token */
+    credentialEnv: string;
+    /** Factory export in @almadar/integrations: (secret?) => HookProvider */
+    providerExport: string;
+}
+/**
+ * Inbound-hook declarations per service — the single source the registry,
+ * codegen, and the playground mount derive from.
+ */
+declare const serviceHooks: Record<string, HookDeclaration[]>;
+
+/** Entity type the credential rows persist under (never a `.lolo`-declared entity). */
+declare const CREDENTIAL_ENTITY_TYPE = "AlmadarIntegrationCredential";
+/** Env var holding the 64-char-hex AES-256 master key (Secret Manager in production). */
+declare const CREDENTIAL_MASTER_KEY_ENV = "ALMADAR_CREDENTIAL_MASTER_KEY";
+/**
+ * Structural subset of `@almadar/runtime`'s `PersistenceAdapter` — declared
+ * here because the dependency axis runs integrations → runtime, never the
+ * reverse. Every `PersistenceAdapter` implementation satisfies it as-is.
+ */
+interface CredentialPersistence {
+    create(entityType: string, data: EntityRow): Promise<{
+        id: string;
+    }>;
+    update(entityType: string, id: string, data: EntityRow): Promise<void>;
+    delete(entityType: string, id: string): Promise<void>;
+    list(entityType: string): Promise<EntityRow[]>;
+}
+/** Masked view of one stored credential — safe to return to a settings page. */
+interface CredentialEntry {
+    service: string;
+    envVar: string;
+    last4: string;
+    updatedAt: number;
+}
+/**
+ * Tenant-scoped (app-wide) credential store: one AES-256-GCM-encrypted row
+ * per (service, envVar) through the host's persistence adapter, master key
+ * `ALMADAR_CREDENTIAL_MASTER_KEY` held alone in the platform secret store.
+ *
+ * Resolution contract: credential keys ARE env-var names (the same names
+ * `serviceCredentials` declares and `connectionRef` carries), so a stored
+ * value transparently shadows its env counterpart — store → env →
+ * unconfigured, everywhere.
+ *
+ * `warm()` decrypts all rows into memory so resolution stays synchronous;
+ * every write re-warms the affected entry and notifies subscribers (the
+ * `RuntimeIntegrationManager` re-configures on that signal, so new keys go
+ * live without a restart).
+ */
+declare class CredentialStore {
+    private readonly adapter;
+    private readonly masterKeyHex;
+    private readonly previousKeyHex;
+    private readonly byEnvVar;
+    private readonly listeners;
+    private warmed;
+    constructor(adapter: CredentialPersistence, masterKey?: string, previousMasterKey?: string);
+    /** True when a valid master key is present (writes and decryption enabled). */
+    get enabled(): boolean;
+    /** Subscribe to credential changes; returns an unsubscribe function. */
+    subscribe(listener: () => void): () => void;
+    private notify;
+    private encrypt;
+    private decryptWithKey;
+    /**
+     * Decrypt one row, selecting the key by the row's stamped `keyId` (I-28):
+     * current key first, then the rotation-window previous key. Legacy rows
+     * (no `keyId`) try current then previous. Returns null when no held key
+     * decrypts the row — the row is unreadable, never silently wrong (GCM
+     * auth tags make a wrong-key success impossible).
+     */
+    private decryptRow;
+    /**
+     * Load and decrypt every stored row into memory. Returns the number of
+     * resolvable credentials. Without a master key nothing decrypts (rows are
+     * left in place, resolution falls through to env).
+     */
+    warm(): Promise<number>;
+    /** Resolve one credential by env-var name (warmed values only). */
+    resolve(envVar: string): string | undefined;
+    /** All warmed values as an env-shaped map, for merging over the process env. */
+    snapshotEnv(): Record<string, string>;
+    /** Masked entries for display — never includes plaintext. */
+    entries(): CredentialEntry[];
+    /** Upsert one credential (encrypts, persists, re-warms the entry, notifies). */
+    set(service: string, envVar: string, value: string): Promise<CredentialEntry>;
+    /**
+     * Re-encrypt every readable row under the CURRENT master key (I-28).
+     * Rotation window: deploy the new key as `ALMADAR_CREDENTIAL_MASTER_KEY`
+     * with the old one as `..._PREVIOUS`, call `rotate()`, then retire the
+     * previous key. Rows no held key can read are counted, never dropped.
+     */
+    rotate(): Promise<{
+        rotated: number;
+        alreadyCurrent: number;
+        unreadable: number;
+    }>;
+    /** Delete one credential row; resolution falls back to env afterwards. */
+    remove(envVar: string): Promise<boolean>;
+}
 
-export type { ArxivActions as A, CLIActions as C, DatabaseActions as D, EmailActions as E, GitHubActions as G, IconifyActions as I, LLMIntegrationActions as L, MLActions as M, OAuthActions as O, QueueActions as Q, RedisActions as R, StorageActions as S, TwilioActions as T, WebhookActions as W, YouTubeActions as Y, DatabaseDriver as a, DatabaseQueryParamValue as b, DatabaseQueryParams as c, DatabaseQueryResult as d, DatabaseRow as e, DeepAgentActions as f, DockerActions as g, IntegrationActionName as h, IntegrationContracts as i, IntegrationName as j, OtelActions as k, StripeActions as l, WikimediaActions as m };
+export { type ArxivActions as A, type CLIActions as C, type DatabaseActions as D, type EmailActions as E, type GitHubActions as G, type HookDeclaration as H, type IconifyActions as I, type LLMIntegrationActions as L, type MLActions as M, type OAuthActions as O, type QueueActions as Q, type RedisActions as R, type StorageActions as S, type TwilioActions as T, type WebhookActions as W, type YouTubeActions as Y, CREDENTIAL_ENTITY_TYPE as a, CREDENTIAL_MASTER_KEY_ENV as b, type CredentialEntry as c, type CredentialPersistence as d, CredentialStore as e, type DatabaseDriver as f, type DatabaseQueryParamValue as g, type DatabaseQueryParams as h, type DatabaseQueryResult as i, type DatabaseRow as j, type DeepAgentActions as k, type DockerActions as l, type IntegrationActionName as m, type IntegrationContracts as n, type IntegrationName as o, type OtelActions as p, type StripeActions as q, type WikimediaActions as r, serviceHooks as s };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@almadar/integrations",
-  "version": "2.24.0",
+  "version": "2.26.0",
   "description": "External service integrations for Almadar applications",
   "type": "module",
   "main": "./dist/index.js",
@@ -33,29 +33,34 @@
     "access": "public"
   },
   "dependencies": {
-    "@almadar/core": "^10.58.0",
-    "@almadar/llm": "^2.40.0",
+    "@almadar/core": "^10.67.0",
+    "@almadar/llm": "^2.41.0",
     "@almadar/logger": "^1.11.0",
+    "@aws-sdk/client-s3": "^3.700.0",
+    "@aws-sdk/s3-request-presigner": "^3.700.0",
     "@sendgrid/mail": "^8.1.4",
     "dotenv": "^16.4.0",
     "googleapis": "^144.0.0",
+    "openid-client": "6.8.7",
     "pg": "^8.13.1",
     "resend": "^4.0.1",
     "stripe": "^17.5.0",
     "twilio": "^5.3.6",
+    "web-push": "^3.6.7",
     "zod": "^3.23.0"
   },
   "devDependencies": {
     "@almadar/eslint-plugin": "^2.15.0",
     "@types/node": "^20.0.0",
     "@types/pg": "^8.11.10",
+    "@types/web-push": "^3.6.4",
     "@typescript-eslint/parser": "8.65.0",
+    "@typescript/native": "npm:typescript@^7.0.2",
     "eslint": "10.0.0",
     "tsup": "^8.0.0",
-    "vitest": "^2.1.0",
     "turbo": "^2.8.17",
-    "@typescript/native": "npm:typescript@^7.0.2",
-    "typescript": "npm:@typescript/typescript6@^6.0.2"
+    "typescript": "npm:@typescript/typescript6@^6.0.2",
+    "vitest": "^2.1.0"
   },
   "repository": {
     "type": "git",
@@ -75,7 +80,7 @@
   ],
   "homepage": "https://github.com/almadar-io/almadar#readme",
   "scripts": {
-    "build": "tsup",
+    "build": "NODE_OPTIONS=--max-old-space-size=8192 tsup",
     "build:watch": "tsup --watch",
     "test": "vitest --run",
     "test:watch": "vitest",