@almadar/integrations 2.25.0 → 2.26.0

package/dist/index.js

@@ -1,6 +1,8 @@
 import { createLogger } from '@almadar/logger';
 import { integratorsRegistry } from '@almadar/core/patterns';
 import { randomBytes, createCipheriv, createDecipheriv, createHmac, createHash } from 'crypto';
+import { readFileSync, mkdirSync, writeFileSync, renameSync, mkdtempSync, rmSync, promises } from 'fs';
+import { join, dirname } from 'path';
 import Stripe from 'stripe';
 import { google } from 'googleapis';
 import twilio from 'twilio';
@@ -11,8 +13,6 @@ import { Readable } from 'stream';
 import { getAvailableProvider, LLMClient, EmbeddingClient } from '@almadar/llm';
 import { z } from 'zod';
 import { execSync, spawn } from 'child_process';
-import { mkdtempSync, writeFileSync, rmSync, promises } from 'fs';
-import { join } from 'path';
 import { tmpdir } from 'os';
 import * as oidc from 'openid-client';
 import { S3Client, PutObjectCommand, GetObjectCommand, ListObjectsV2Command, DeleteObjectCommand } from '@aws-sdk/client-s3';
@@ -38,6 +38,143 @@ var IntegrationError = class extends Error {
     };
   }
 };
+
+// src/contracts.ts
+var serviceCredentials = {
+  stripe: [
+    { envVar: "STRIPE_SECRET_KEY", required: true, description: "Stripe secret API key" },
+    { envVar: "STRIPE_WEBHOOK_SECRET", required: false, description: "Webhook endpoint signing secret" }
+  ],
+  youtube: [
+    { envVar: "YOUTUBE_API_KEY", required: true, description: "YouTube Data API key" }
+  ],
+  twilio: [
+    { envVar: "TWILIO_ACCOUNT_SID", required: true, description: "Twilio account SID" },
+    { envVar: "TWILIO_AUTH_TOKEN", required: true, description: "Twilio auth token" },
+    { envVar: "TWILIO_PHONE_NUMBER", required: false, description: "Default sender phone number" }
+  ],
+  email: [
+    { envVar: "SENDGRID_API_KEY", required: false, description: "SendGrid API key (use this OR RESEND_API_KEY)" },
+    { envVar: "RESEND_API_KEY", required: false, description: "Resend API key (use this OR SENDGRID_API_KEY)" },
+    { envVar: "FROM_EMAIL", required: false, description: "Default sender email address" }
+  ],
+  webhook: [
+    { envVar: "WEBHOOK_SIGNING_SECRET", required: false, description: "Default HMAC-SHA256 signing secret (per-call secret overrides)" },
+    { envVar: "WEBHOOK_TIMEOUT_MS", required: false, description: "Per-request timeout (ms, default 10000)" }
+  ],
+  push: [
+    { envVar: "VAPID_PUBLIC_KEY", required: true, description: "VAPID public key (web-push generate-vapid-keys)" },
+    { envVar: "VAPID_PRIVATE_KEY", required: true, description: "VAPID private key" },
+    { envVar: "VAPID_SUBJECT", required: true, description: "VAPID subject (mailto: or https: contact URI)" }
+  ],
+  calendar: [
+    { envVar: "GOOGLE_CALENDAR_SA_KEY", required: true, description: "Google service-account key JSON (raw or base64) with calendar scope; store in Secret Manager, bind as env" },
+    { envVar: "GOOGLE_CALENDAR_SUBJECT", required: false, description: "Workspace user to impersonate (domain-wide delegation); empty = act as the service account" },
+    { envVar: "GOOGLE_CALENDAR_ID", required: false, description: "Default calendar id (default: primary)" },
+    { envVar: "GOOGLE_CALENDAR_CHANNEL_TOKEN", required: false, description: "Watch-channel verification token \u2014 required to receive inbound calendar hooks (two-way sync)" }
+  ],
+  drive: [
+    { envVar: "GOOGLE_DRIVE_SA_KEY", required: false, description: "Google service-account key JSON (raw or base64) with drive scope \u2014 serves reads; store in Secret Manager, bind as env" },
+    { envVar: "GOOGLE_DRIVE_SUBJECT", required: false, description: "Workspace user to impersonate (domain-wide delegation); empty = act as the service account" },
+    { envVar: "GOOGLE_DRIVE_REFRESH_TOKEN", required: false, description: "User OAuth refresh token (drive-consent.mjs) \u2014 serves writes; SA uploads are impossible on personal accounts (no SA storage quota)" },
+    { envVar: "GOOGLE_DRIVE_FOLDER_ID", required: false, description: "Default parent folder for uploads/new folders when the call names none" }
+  ],
+  metaAds: [
+    { envVar: "META_ACCESS_TOKEN", required: true, description: "Meta Graph API access token (Marketing API, ads_read)" },
+    { envVar: "META_AD_ACCOUNT_ID", required: false, description: "Default ad account id (act_\u2026); per-call accountId overrides" }
+  ],
+  accounting: [],
+  banking: [
+    { envVar: "GOCARDLESS_SECRET_ID", required: true, description: "GoCardless Bank Account Data secret id" },
+    { envVar: "GOCARDLESS_SECRET_KEY", required: true, description: "GoCardless Bank Account Data secret key" }
+  ],
+  esign: [
+    { envVar: "DOCUSIGN_BASE_URL", required: true, description: "DocuSign REST base (e.g. https://demo.docusign.net/restapi/v2.1/accounts/<accountId>)" },
+    { envVar: "DOCUSIGN_ACCESS_TOKEN", required: true, description: "DocuSign OAuth access token (JWT grant rotation is the deployment concern)" }
+  ],
+  llm: [
+    { envVar: "ANTHROPIC_API_KEY", required: false, description: "Anthropic API key (use this OR OPENAI_API_KEY)" },
+    { envVar: "OPENAI_API_KEY", required: false, description: "OpenAI API key (use this OR ANTHROPIC_API_KEY)" }
+  ],
+  "llm-integration": [
+    { envVar: "ANTHROPIC_API_KEY", required: false, description: "Anthropic API key" },
+    { envVar: "OPENAI_API_KEY", required: false, description: "OpenAI API key" }
+  ],
+  ml: [
+    { envVar: "MASAR_URL", required: true, description: "Base URL of the deployed model-serving orbital" },
+    { envVar: "MASAR_ML_TRAIT", required: true, description: "Kebab-case trait name the serving orbital exposes its /events route under" }
+  ],
+  deepagent: [
+    { envVar: "DEEPAGENT_API_URL", required: true, description: "DeepAgent server URL" },
+    { envVar: "DEEPAGENT_API_KEY", required: false, description: "DeepAgent API key" }
+  ],
+  github: [
+    { envVar: "GITHUB_TOKEN", required: true, description: "GitHub personal access token" },
+    { envVar: "GITHUB_OWNER", required: false, description: "Default repository owner" },
+    { envVar: "GITHUB_REPO", required: false, description: "Default repository name" }
+  ],
+  docker: [
+    { envVar: "DOCKER_HOST", required: false, description: "Docker daemon host URL" }
+  ],
+  storage: [
+    { envVar: "STORAGE_ACCESS_KEY_ID", required: true, description: "S3-compatible access key id" },
+    { envVar: "STORAGE_SECRET_ACCESS_KEY", required: true, description: "S3-compatible secret access key" },
+    { envVar: "STORAGE_BUCKET", required: true, description: "Default bucket name" },
+    { envVar: "STORAGE_REGION", required: false, description: "Region (default us-east-1)" },
+    { envVar: "STORAGE_ENDPOINT", required: false, description: "Custom S3-compatible endpoint (R2/MinIO/\u2026); empty = AWS S3" },
+    { envVar: "STORAGE_PUBLIC_URL_BASE", required: false, description: "Base URL for public-acl object links; empty = endpoint-derived" }
+  ],
+  queue: [
+    { envVar: "QUEUE_URL", required: true, description: "Message queue connection URL" }
+  ],
+  redis: [
+    { envVar: "REDIS_URL", required: true, description: "Redis connection URL" }
+  ],
+  oauth: [
+    { envVar: "OAUTH_CLIENT_ID", required: true, description: "OIDC client ID" },
+    { envVar: "OAUTH_CLIENT_SECRET", required: true, description: "OIDC client secret" },
+    { envVar: "OAUTH_REDIRECT_URI", required: false, description: "OIDC redirect URI (default per-call param)" },
+    { envVar: "OIDC_ISSUER_URL", required: false, description: "OIDC issuer URL (default https://accounts.google.com)" }
+  ],
+  credentials: [
+    { envVar: "ALMADAR_CREDENTIAL_MASTER_KEY", required: false, description: "AES-256 master key (64-char hex) enabling the hosted credential store \u2014 hold it alone in the platform secret store" },
+    { envVar: "ALMADAR_CREDENTIAL_MASTER_KEY_PREVIOUS", required: false, description: "Previous master key, present only during a rotation window \u2014 decrypts old rows until `credentials.rotate` re-encrypts them" }
+  ],
+  otel: [
+    { envVar: "OTEL_EXPORTER_OTLP_ENDPOINT", required: true, description: "OpenTelemetry collector endpoint" },
+    { envVar: "OTEL_SERVICE_NAME", required: false, description: "Service name for traces" }
+  ],
+  cli: [],
+  // No fixed env vars — connection strings are resolved per-query from the
+  // caller-supplied connectionRef, so credentials cannot be declared statically.
+  database: [],
+  wikimedia: [
+    { envVar: "WIKIMEDIA_USER_AGENT", required: false, description: "Descriptive User-Agent for the Wikipedia API" },
+    { envVar: "WIKIMEDIA_TIMEOUT_MS", required: false, description: "Per-request timeout (ms)" }
+  ],
+  iconify: [
+    { envVar: "ICONIFY_USER_AGENT", required: false, description: "User-Agent for the Iconify API" },
+    { envVar: "ICONIFY_TIMEOUT_MS", required: false, description: "Per-request timeout (ms)" }
+  ],
+  arxiv: [
+    { envVar: "ARXIV_TIMEOUT_MS", required: false, description: "Per-request timeout (ms)" }
+  ]
+};
+var serviceHooks = {
+  calendar: [
+    {
+      provider: "google-calendar",
+      event: "CAL_REMOTE_CHANGED",
+      credentialEnv: "GOOGLE_CALENDAR_CHANNEL_TOKEN",
+      providerExport: "googleCalendarHookProvider"
+    }
+  ]
+};
+var serviceProbes = {
+  calendar: { action: "listEvents", params: { maxResults: 1 } },
+  drive: { action: "listFiles", params: { maxResults: 1 } },
+  metaAds: { action: "listCampaigns", params: {} }
+};
 var ConsoleLogger = class {
   constructor(_level = "info") {
     this.log = createLogger("almadar:integrations");
@@ -55,6 +192,7 @@ var ConsoleLogger = class {
     this.log.error(message, meta);
   }
 };
+var RESERVED_ENVELOPE_KEYS = /* @__PURE__ */ new Set(["emit", "onSuccess", "onError", "timeout"]);
 function validateParams(integration, action, params) {
   const typedRegistry = integratorsRegistry;
   const registry = typedRegistry.integrators[integration];
@@ -77,6 +215,16 @@ function validateParams(integration, action, params) {
     };
   }
   const errors = [];
+  const declaredNames = new Set(actionDef.params.map((p) => p.name));
+  for (const key of Object.keys(params)) {
+    if (RESERVED_ENVELOPE_KEYS.has(key)) continue;
+    if (!declaredNames.has(key)) {
+      errors.push({
+        param: key,
+        message: `Unknown parameter: ${key} (declared: ${[...declaredNames].sort().join(", ")})`
+      });
+    }
+  }
   for (const paramDef of actionDef.params) {
     if (paramDef.required && !(paramDef.name in params)) {
       errors.push({
@@ -272,7 +420,7 @@ var IntegrationFactory = class {
    */
   async execute(integration, action, params, context) {
     const instance = this.get(integration, context?.principal);
-    return await instance.execute(action, params);
+    return await instance.execute(action, params, context);
   }
   /**
    * Check if integration is configured
@@ -329,24 +477,31 @@ function resetIntegrationFactory() {
 }
 var CREDENTIAL_ENTITY_TYPE = "AlmadarIntegrationCredential";
 var CREDENTIAL_MASTER_KEY_ENV = "ALMADAR_CREDENTIAL_MASTER_KEY";
+var CREDENTIAL_PREVIOUS_MASTER_KEY_ENV = "ALMADAR_CREDENTIAL_MASTER_KEY_PREVIOUS";
 var ENCRYPTION_ALGORITHM = "aes-256-gcm";
 function isNonEmptyString(v) {
   return typeof v === "string" && v.length > 0;
 }
+function keyIdOf(masterKeyHex) {
+  return createHash("sha256").update(masterKeyHex, "hex").digest("hex").slice(0, 16);
+}
+var MASTER_KEY_SHAPE = /^[0-9a-fA-F]{64}$/;
 var CredentialStore = class {
-  constructor(adapter, masterKey) {
+  constructor(adapter, masterKey, previousMasterKey) {
     this.byEnvVar = /* @__PURE__ */ new Map();
     this.listeners = /* @__PURE__ */ new Set();
     this.warmed = false;
     this.adapter = adapter;
     const key = masterKey ?? process.env[CREDENTIAL_MASTER_KEY_ENV];
-    const valid = typeof key === "string" && /^[0-9a-fA-F]{64}$/.test(key);
+    const valid = typeof key === "string" && MASTER_KEY_SHAPE.test(key);
     if (!valid && process.env.NODE_ENV === "production") {
       throw new Error(
         `${CREDENTIAL_MASTER_KEY_ENV} must be a 64-character hex string (32 bytes) in production \u2014 generate one with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"`
       );
     }
     this.masterKeyHex = valid ? key : void 0;
+    const prev = previousMasterKey ?? process.env[CREDENTIAL_PREVIOUS_MASTER_KEY_ENV];
+    this.previousKeyHex = typeof prev === "string" && MASTER_KEY_SHAPE.test(prev) ? prev : void 0;
   }
   /** True when a valid master key is present (writes and decryption enabled). */
   get enabled() {
@@ -368,15 +523,17 @@ var CredentialStore = class {
     const cipher = createCipheriv(ENCRYPTION_ALGORITHM, Buffer.from(this.masterKeyHex, "hex"), iv);
     let ciphertext = cipher.update(plaintext, "utf8", "hex");
     ciphertext += cipher.final("hex");
-    return { ciphertext, iv: iv.toString("hex"), authTag: cipher.getAuthTag().toString("hex") };
+    return {
+      ciphertext,
+      iv: iv.toString("hex"),
+      authTag: cipher.getAuthTag().toString("hex"),
+      keyId: keyIdOf(this.masterKeyHex)
+    };
   }
-  decrypt(ciphertext, ivHex, authTagHex) {
-    if (!this.masterKeyHex) {
-      throw new Error(`${CREDENTIAL_MASTER_KEY_ENV} is not configured \u2014 cannot decrypt credentials`);
-    }
+  decryptWithKey(keyHex, ciphertext, ivHex, authTagHex) {
     const decipher = createDecipheriv(
       ENCRYPTION_ALGORITHM,
-      Buffer.from(this.masterKeyHex, "hex"),
+      Buffer.from(keyHex, "hex"),
       Buffer.from(ivHex, "hex")
     );
     decipher.setAuthTag(Buffer.from(authTagHex, "hex"));
@@ -384,6 +541,32 @@ var CredentialStore = class {
     plaintext += decipher.final("utf8");
     return plaintext;
   }
+  /**
+   * Decrypt one row, selecting the key by the row's stamped `keyId` (I-28):
+   * current key first, then the rotation-window previous key. Legacy rows
+   * (no `keyId`) try current then previous. Returns null when no held key
+   * decrypts the row — the row is unreadable, never silently wrong (GCM
+   * auth tags make a wrong-key success impossible).
+   */
+  decryptRow(ciphertext, ivHex, authTagHex, rowKeyId) {
+    if (!this.masterKeyHex) {
+      throw new Error(`${CREDENTIAL_MASTER_KEY_ENV} is not configured \u2014 cannot decrypt credentials`);
+    }
+    const candidates = [];
+    if (rowKeyId === void 0 || rowKeyId === keyIdOf(this.masterKeyHex)) {
+      candidates.push(this.masterKeyHex);
+    }
+    if (this.previousKeyHex !== void 0 && (rowKeyId === void 0 || rowKeyId === keyIdOf(this.previousKeyHex))) {
+      candidates.push(this.previousKeyHex);
+    }
+    for (const key of candidates) {
+      try {
+        return this.decryptWithKey(key, ciphertext, ivHex, authTagHex);
+      } catch {
+      }
+    }
+    return null;
+  }
   /**
    * Load and decrypt every stored row into memory. Returns the number of
    * resolvable credentials. Without a master key nothing decrypts (rows are
@@ -399,7 +582,13 @@ var CredentialStore = class {
       if (!isNonEmptyString(id) || !isNonEmptyString(service) || !isNonEmptyString(envVar) || !isNonEmptyString(ciphertext) || !isNonEmptyString(iv) || !isNonEmptyString(authTag)) {
         continue;
       }
-      const value = this.decrypt(ciphertext, iv, authTag);
+      const value = this.decryptRow(
+        ciphertext,
+        iv,
+        authTag,
+        isNonEmptyString(row.keyId) ? row.keyId : void 0
+      );
+      if (value === null) continue;
       this.byEnvVar.set(envVar, {
         id,
         service,
@@ -428,10 +617,10 @@ var CredentialStore = class {
   /** Upsert one credential (encrypts, persists, re-warms the entry, notifies). */
   async set(service, envVar, value) {
     if (!this.warmed) await this.warm();
-    const { ciphertext, iv, authTag } = this.encrypt(value);
+    const { ciphertext, iv, authTag, keyId } = this.encrypt(value);
     const updatedAt = Date.now();
     const existing = this.byEnvVar.get(envVar);
-    const data = { service, envVar, ciphertext, iv, authTag, updatedAt };
+    const data = { service, envVar, ciphertext, iv, authTag, keyId, updatedAt };
     let id;
     if (existing) {
       id = existing.id;
@@ -445,6 +634,58 @@ var CredentialStore = class {
     const { service: s, envVar: e, last4, updatedAt: u } = entry;
     return { service: s, envVar: e, last4, updatedAt: u };
   }
+  /**
+   * Re-encrypt every readable row under the CURRENT master key (I-28).
+   * Rotation window: deploy the new key as `ALMADAR_CREDENTIAL_MASTER_KEY`
+   * with the old one as `..._PREVIOUS`, call `rotate()`, then retire the
+   * previous key. Rows no held key can read are counted, never dropped.
+   */
+  async rotate() {
+    if (!this.masterKeyHex) {
+      throw new Error(`${CREDENTIAL_MASTER_KEY_ENV} is not configured \u2014 cannot rotate`);
+    }
+    const currentKeyId = keyIdOf(this.masterKeyHex);
+    let rotated = 0;
+    let alreadyCurrent = 0;
+    let unreadable = 0;
+    const rows = await this.adapter.list(CREDENTIAL_ENTITY_TYPE);
+    for (const row of rows) {
+      const { id, service, envVar, ciphertext, iv, authTag } = row;
+      if (!isNonEmptyString(id) || !isNonEmptyString(service) || !isNonEmptyString(envVar) || !isNonEmptyString(ciphertext) || !isNonEmptyString(iv) || !isNonEmptyString(authTag)) {
+        unreadable += 1;
+        continue;
+      }
+      const rowKeyId = isNonEmptyString(row.keyId) ? row.keyId : void 0;
+      if (rowKeyId === currentKeyId) {
+        alreadyCurrent += 1;
+        continue;
+      }
+      const value = this.decryptRow(ciphertext, iv, authTag, rowKeyId);
+      if (value === null) {
+        unreadable += 1;
+        continue;
+      }
+      if (rowKeyId === void 0 && this.decryptRow(ciphertext, iv, authTag, currentKeyId) !== null) {
+        alreadyCurrent += 1;
+        await this.adapter.update(CREDENTIAL_ENTITY_TYPE, id, { ...row, keyId: currentKeyId });
+        continue;
+      }
+      const fresh = this.encrypt(value);
+      await this.adapter.update(CREDENTIAL_ENTITY_TYPE, id, {
+        service,
+        envVar,
+        ciphertext: fresh.ciphertext,
+        iv: fresh.iv,
+        authTag: fresh.authTag,
+        keyId: fresh.keyId,
+        updatedAt: Date.now()
+      });
+      rotated += 1;
+    }
+    await this.warm();
+    this.notify();
+    return { rotated, alreadyCurrent, unreadable };
+  }
   /** Delete one credential row; resolution falls back to env afterwards. */
   async remove(envVar) {
     if (!this.warmed) await this.warm();
@@ -478,6 +719,58 @@ function uninstallCredentialStore() {
 function resolveCredentialRef(ref, env = process.env) {
   return installedStore?.resolve(ref) ?? env[ref];
 }
+var CREDENTIALS_FILE_ENV = "ALMADAR_CREDENTIALS_FILE";
+var DEFAULT_RELATIVE_PATH = join(".almadar", "dev-credentials.json");
+var FileCredentialPersistence = class {
+  constructor(path) {
+    this.counter = 0;
+    this.path = path ?? process.env[CREDENTIALS_FILE_ENV] ?? join(process.cwd(), DEFAULT_RELATIVE_PATH);
+  }
+  get filePath() {
+    return this.path;
+  }
+  load() {
+    try {
+      const raw = readFileSync(this.path, "utf-8");
+      const rows = JSON.parse(raw);
+      const map = /* @__PURE__ */ new Map();
+      for (const row of rows) {
+        if (typeof row.id === "string") map.set(row.id, row);
+      }
+      return map;
+    } catch {
+      return /* @__PURE__ */ new Map();
+    }
+  }
+  save(rows) {
+    mkdirSync(dirname(this.path), { recursive: true });
+    const tmp = `${this.path}.tmp`;
+    writeFileSync(tmp, JSON.stringify([...rows.values()], null, 2), "utf-8");
+    renameSync(tmp, this.path);
+  }
+  async create(entityType, data) {
+    const rows = this.load();
+    const id = `${entityType}-${Date.now()}-${++this.counter}`;
+    rows.set(id, { ...data, id });
+    this.save(rows);
+    return { id };
+  }
+  async update(_entityType, id, data) {
+    const rows = this.load();
+    const existing = rows.get(id);
+    if (existing) {
+      rows.set(id, { ...existing, ...data, id });
+      this.save(rows);
+    }
+  }
+  async delete(_entityType, id) {
+    const rows = this.load();
+    if (rows.delete(id)) this.save(rows);
+  }
+  async list(_entityType) {
+    return [...this.load().values()];
+  }
+};
 var STRIPE_API_VERSION = "2025-02-24.acacia";
 function priceToTier(priceId, prices) {
   if (priceId === prices.solo) return "solo";
@@ -1043,10 +1336,10 @@ var TwilioIntegration = class extends BaseIntegration {
     }
   }
   async sendSMS(params) {
-    const { to, body } = params;
+    const { to, body, from } = params;
     this.logger.debug("Sending SMS", { to: String(to ?? "") });
     const message = await this.client.messages.create({
-      from: this.phoneNumber,
+      from: from || this.phoneNumber,
       to,
       body
     });
@@ -1125,31 +1418,35 @@ var EmailIntegration = class extends BaseIntegration {
     }
   }
   async send(params) {
-    const { to, subject, body, from } = params;
+    const { to, subject, body, from, htmlBody, replyTo, templateId } = params;
     this.logger.debug("Sending email", { to: String(to), subject: String(subject), provider: this.provider });
+    const message = {
+      to,
+      subject,
+      body,
+      from: from || this.fromEmail,
+      htmlBody: htmlBody || void 0,
+      replyTo: replyTo || void 0,
+      templateId: templateId || void 0
+    };
     if (this.provider === "sendgrid") {
-      return await this.sendViaSendGrid(
-        to,
-        subject,
-        body,
-        from || this.fromEmail
-      );
+      return await this.sendViaSendGrid(message);
     } else if (this.provider === "resend") {
-      return await this.sendViaResend(
-        to,
-        subject,
-        body,
-        from || this.fromEmail
-      );
+      return await this.sendViaResend(message);
     }
     throw new Error(`Unknown email provider: ${this.provider}`);
   }
-  async sendViaSendGrid(to, subject, body, from) {
+  async sendViaSendGrid(message) {
     const msg = {
-      to,
-      from,
-      subject,
-      html: body
+      to: message.to,
+      from: message.from,
+      subject: message.subject,
+      // htmlBody present → it carries the HTML and body becomes the
+      // plain-text alternative; absent → body renders as HTML (legacy).
+      html: message.htmlBody ?? message.body,
+      ...message.htmlBody ? { text: message.body } : {},
+      ...message.replyTo ? { replyTo: message.replyTo } : {},
+      ...message.templateId ? { templateId: message.templateId } : {}
     };
     const response = await sgMail.send(msg);
     return {
@@ -1157,15 +1454,20 @@ var EmailIntegration = class extends BaseIntegration {
       status: "sent"
     };
   }
-  async sendViaResend(to, subject, body, from) {
+  async sendViaResend(message) {
     if (!this.resendClient) {
       throw new Error("Resend client not initialized");
     }
+    if (message.templateId) {
+      throw new Error("templateId is not supported by the resend provider \u2014 use sendgrid or drop templateId");
+    }
     const response = await this.resendClient.emails.send({
-      from,
-      to,
-      subject,
-      html: body
+      from: message.from,
+      to: message.to,
+      subject: message.subject,
+      html: message.htmlBody ?? message.body,
+      ...message.htmlBody ? { text: message.body } : {},
+      ...message.replyTo ? { replyTo: message.replyTo } : {}
     });
     return {
       id: response.data?.id,
@@ -1595,6 +1897,27 @@ var CalendarIntegration = class extends BaseIntegration {
   }
 };
 registerIntegration("calendar", CalendarIntegration);
+
+// src/hooks.ts
+var HOOK_PROVIDER_FACTORIES = {
+  googleCalendarHookProvider
+};
+function allHookDeclarations() {
+  return Object.values(serviceHooks).flat();
+}
+function registeredHookProviders(env = process.env) {
+  const providers = {};
+  for (const decl of allHookDeclarations()) {
+    const factory = HOOK_PROVIDER_FACTORIES[decl.providerExport];
+    if (!factory) {
+      throw new Error(
+        `serviceHooks declares provider export '${decl.providerExport}' but HOOK_PROVIDER_FACTORIES has no entry for it`
+      );
+    }
+    providers[decl.provider] = factory(env[decl.credentialEnv]);
+  }
+  return providers;
+}
 function decodeContent(content) {
   const dataUrlMatch = /^data:([^;,]+)?(;base64)?,(.*)$/s.exec(content);
   if (dataUrlMatch) {
@@ -1608,20 +1931,53 @@ var DriveIntegration = class extends BaseIntegration {
   constructor(config) {
     super(config);
     const rawKey = config.env.GOOGLE_DRIVE_SA_KEY;
-    if (!rawKey) {
-      throw new Error("GOOGLE_DRIVE_SA_KEY not configured");
+    if (rawKey) {
+      const keyJson = rawKey.trim().startsWith("{") ? rawKey : Buffer.from(rawKey, "base64").toString("utf8");
+      const key = JSON.parse(keyJson);
+      const subject = config.env.GOOGLE_DRIVE_SUBJECT || void 0;
+      const auth = new google.auth.JWT({
+        email: key.client_email,
+        key: key.private_key,
+        scopes: ["https://www.googleapis.com/auth/drive"],
+        subject
+      });
+      this.saClient = google.drive({ version: "v3", auth });
+    } else {
+      this.saClient = null;
+    }
+    const refreshToken = config.env.GOOGLE_DRIVE_REFRESH_TOKEN;
+    const clientId = config.env.OAUTH_CLIENT_ID;
+    const clientSecret = config.env.OAUTH_CLIENT_SECRET;
+    if (refreshToken && clientId && clientSecret) {
+      const oauth2 = new google.auth.OAuth2(clientId, clientSecret);
+      oauth2.setCredentials({ refresh_token: refreshToken });
+      this.userClient = google.drive({ version: "v3", auth: oauth2 });
+    } else {
+      this.userClient = null;
     }
-    const keyJson = rawKey.trim().startsWith("{") ? rawKey : Buffer.from(rawKey, "base64").toString("utf8");
-    const key = JSON.parse(keyJson);
-    const subject = config.env.GOOGLE_DRIVE_SUBJECT || void 0;
-    const auth = new google.auth.JWT({
-      email: key.client_email,
-      key: key.private_key,
-      scopes: ["https://www.googleapis.com/auth/drive"],
-      subject
+    if (!this.saClient && !this.userClient) {
+      throw new Error(
+        "Drive not configured \u2014 set GOOGLE_DRIVE_SA_KEY (reads) and/or GOOGLE_DRIVE_REFRESH_TOKEN + OAUTH_CLIENT_ID/SECRET (writes)"
+      );
+    }
+    this.defaultFolderId = config.env.GOOGLE_DRIVE_FOLDER_ID || void 0;
+    this.logger.info("Drive integration initialized", {
+      serviceAccount: this.saClient !== null,
+      userToken: this.userClient !== null,
+      delegated: Boolean(config.env.GOOGLE_DRIVE_SUBJECT)
     });
-    this.client = google.drive({ version: "v3", auth });
-    this.logger.info("Drive integration initialized", { delegated: Boolean(subject) });
+  }
+  /** Reads prefer the SA client (delegation-aware); user client covers its absence. */
+  readClient() {
+    const client = this.saClient ?? this.userClient;
+    if (!client) throw new Error("Drive not configured");
+    return client;
+  }
+  /** Writes REQUIRE the user client on personal accounts (SA has no storage quota); SA only as a Workspace fallback. */
+  writeClient() {
+    const client = this.userClient ?? this.saClient;
+    if (!client) throw new Error("Drive not configured");
+    return client;
   }
   async execute(action, params) {
     const validation = this.validateParams(action, params);
@@ -1673,7 +2029,7 @@ var DriveIntegration = class extends BaseIntegration {
     const clauses = ["trashed = false"];
     if (folderId) clauses.push(`'${String(folderId).replace(/'/g, "\\'")}' in parents`);
     if (query) clauses.push(String(query));
-    const response = await this.client.files.list({
+    const response = await this.readClient().files.list({
       q: clauses.join(" and "),
       pageSize: maxResults || 100,
       fields: "files(id, name, mimeType, size, modifiedTime, webViewLink)"
@@ -1691,11 +2047,11 @@ var DriveIntegration = class extends BaseIntegration {
   }
   async getFile(params) {
     const fileId = params.fileId;
-    const meta = await this.client.files.get({
+    const meta = await this.readClient().files.get({
       fileId,
       fields: "id, name, mimeType, size"
     });
-    const content = await this.client.files.get(
+    const content = await this.readClient().files.get(
       { fileId, alt: "media" },
       { responseType: "arraybuffer" }
     );
@@ -1711,10 +2067,11 @@ var DriveIntegration = class extends BaseIntegration {
   async uploadFile(params) {
     const { name, content, mimeType, folderId } = params;
     const { bytes, contentType } = decodeContent(content);
-    const response = await this.client.files.create({
+    const parent = folderId || this.defaultFolderId;
+    const response = await this.writeClient().files.create({
       requestBody: {
         name,
-        parents: folderId ? [folderId] : void 0
+        parents: parent ? [parent] : void 0
       },
       media: {
         mimeType: mimeType || contentType || "application/octet-stream",
@@ -1730,11 +2087,12 @@ var DriveIntegration = class extends BaseIntegration {
   }
   async createFolder(params) {
     const { name, parentId } = params;
-    const response = await this.client.files.create({
+    const parent = parentId || this.defaultFolderId;
+    const response = await this.writeClient().files.create({
       requestBody: {
         name,
         mimeType: "application/vnd.google-apps.folder",
-        parents: parentId ? [parentId] : void 0
+        parents: parent ? [parent] : void 0
       },
       fields: "id, name"
     });
@@ -1742,7 +2100,7 @@ var DriveIntegration = class extends BaseIntegration {
   }
   async shareFile(params) {
     const { fileId, email, role } = params;
-    const response = await this.client.permissions.create({
+    const response = await this.readClient().permissions.create({
       fileId,
       requestBody: {
         type: "user",
@@ -3756,6 +4114,31 @@ var PROVIDER_AUTH_URLS = {
 var PROVIDER_ISSUERS = {
   google: "https://accounts.google.com"
 };
+var PENDING_GRANT_TTL_MS = 10 * 60 * 1e3;
+var InMemoryPendingGrantStore = class {
+  constructor() {
+    this.grants = /* @__PURE__ */ new Map();
+  }
+  async put(state, grant, ttlMs) {
+    this.grants.set(state, { grant, expiresAt: Date.now() + ttlMs });
+  }
+  async take(state) {
+    const entry = this.grants.get(state);
+    if (!entry) return null;
+    this.grants.delete(state);
+    return entry.expiresAt >= Date.now() ? entry.grant : null;
+  }
+  async sweep() {
+    const now = Date.now();
+    for (const [state, entry] of this.grants) {
+      if (entry.expiresAt < now) this.grants.delete(state);
+    }
+  }
+};
+var installedPendingGrantStore = null;
+function installPendingGrantStore(store) {
+  installedPendingGrantStore = store;
+}
 var OAuthIntegration = class extends BaseIntegration {
   constructor(config) {
     super(config);
@@ -3767,8 +4150,8 @@ var OAuthIntegration = class extends BaseIntegration {
     this.refreshIndex = /* @__PURE__ */ new Map();
     /** Maps access token -> mock user session */
     this.sessions = /* @__PURE__ */ new Map();
-    /** Maps state -> pending OIDC authorization (real backend) */
-    this.pending = /* @__PURE__ */ new Map();
+    /** Pending OIDC authorizations (real backend) — injectable, in-memory default. */
+    this.fallbackPending = new InMemoryPendingGrantStore();
     /** Maps access token -> ID-token subject, for userinfo subject checks */
     this.subjects = /* @__PURE__ */ new Map();
     /** Discovered issuer configurations, keyed by issuer URL */
@@ -3778,6 +4161,9 @@ var OAuthIntegration = class extends BaseIntegration {
       this.real ? "OAuth integration initialized (OIDC backend via openid-client)" : "OAuth integration initialized (mock backend)"
     );
   }
+  pendingStore() {
+    return installedPendingGrantStore ?? this.fallbackPending;
+  }
   async execute(action, params) {
     const validation = this.validateParams(action, params);
     if (!validation.valid) {
@@ -3869,17 +4255,17 @@ var OAuthIntegration = class extends BaseIntegration {
       parameters.prompt = "consent";
     }
     const authUrl = oidc.buildAuthorizationUrl(configuration, parameters);
-    this.pending.set(state, { provider, redirectUri, pkceVerifier });
+    await this.pendingStore().put(state, { provider, redirectUri, pkceVerifier }, PENDING_GRANT_TTL_MS);
+    void this.pendingStore().sweep();
     return { authUrl: authUrl.toString(), state };
   }
   async oidcToken(params) {
     const code = params.code;
     const state = params.state;
-    const pendingAuth = this.pending.get(state);
+    const pendingAuth = await this.pendingStore().take(state);
     if (!pendingAuth) {
       throw new Error(`Invalid or expired state token: ${state}`);
     }
-    this.pending.delete(state);
     const configuration = await this.configurationFor(pendingAuth.provider);
     const callbackUrl = new URL(pendingAuth.redirectUri);
     callbackUrl.searchParams.set("code", code);
@@ -4066,131 +4452,10 @@ var OAuthIntegration = class extends BaseIntegration {
 };
 registerIntegration("oauth", OAuthIntegration);
 
-// src/contracts.ts
-var serviceCredentials = {
-  stripe: [
-    { envVar: "STRIPE_SECRET_KEY", required: true, description: "Stripe secret API key" },
-    { envVar: "STRIPE_WEBHOOK_SECRET", required: false, description: "Webhook endpoint signing secret" }
-  ],
-  youtube: [
-    { envVar: "YOUTUBE_API_KEY", required: true, description: "YouTube Data API key" }
-  ],
-  twilio: [
-    { envVar: "TWILIO_ACCOUNT_SID", required: true, description: "Twilio account SID" },
-    { envVar: "TWILIO_AUTH_TOKEN", required: true, description: "Twilio auth token" },
-    { envVar: "TWILIO_PHONE_NUMBER", required: false, description: "Default sender phone number" }
-  ],
-  email: [
-    { envVar: "SENDGRID_API_KEY", required: false, description: "SendGrid API key (use this OR RESEND_API_KEY)" },
-    { envVar: "RESEND_API_KEY", required: false, description: "Resend API key (use this OR SENDGRID_API_KEY)" },
-    { envVar: "FROM_EMAIL", required: false, description: "Default sender email address" }
-  ],
-  webhook: [
-    { envVar: "WEBHOOK_SIGNING_SECRET", required: false, description: "Default HMAC-SHA256 signing secret (per-call secret overrides)" },
-    { envVar: "WEBHOOK_TIMEOUT_MS", required: false, description: "Per-request timeout (ms, default 10000)" }
-  ],
-  push: [
-    { envVar: "VAPID_PUBLIC_KEY", required: true, description: "VAPID public key (web-push generate-vapid-keys)" },
-    { envVar: "VAPID_PRIVATE_KEY", required: true, description: "VAPID private key" },
-    { envVar: "VAPID_SUBJECT", required: true, description: "VAPID subject (mailto: or https: contact URI)" }
-  ],
-  calendar: [
-    { envVar: "GOOGLE_CALENDAR_SA_KEY", required: true, description: "Google service-account key JSON (raw or base64) with calendar scope; store in Secret Manager, bind as env" },
-    { envVar: "GOOGLE_CALENDAR_SUBJECT", required: false, description: "Workspace user to impersonate (domain-wide delegation); empty = act as the service account" },
-    { envVar: "GOOGLE_CALENDAR_ID", required: false, description: "Default calendar id (default: primary)" }
-  ],
-  drive: [
-    { envVar: "GOOGLE_DRIVE_SA_KEY", required: true, description: "Google service-account key JSON (raw or base64) with drive scope; store in Secret Manager, bind as env" },
-    { envVar: "GOOGLE_DRIVE_SUBJECT", required: false, description: "Workspace user to impersonate (domain-wide delegation); empty = act as the service account" }
-  ],
-  metaAds: [
-    { envVar: "META_ACCESS_TOKEN", required: true, description: "Meta Graph API access token (Marketing API, ads_read)" },
-    { envVar: "META_AD_ACCOUNT_ID", required: false, description: "Default ad account id (act_\u2026); per-call accountId overrides" }
-  ],
-  accounting: [],
-  banking: [
-    { envVar: "GOCARDLESS_SECRET_ID", required: true, description: "GoCardless Bank Account Data secret id" },
-    { envVar: "GOCARDLESS_SECRET_KEY", required: true, description: "GoCardless Bank Account Data secret key" }
-  ],
-  esign: [
-    { envVar: "DOCUSIGN_BASE_URL", required: true, description: "DocuSign REST base (e.g. https://demo.docusign.net/restapi/v2.1/accounts/<accountId>)" },
-    { envVar: "DOCUSIGN_ACCESS_TOKEN", required: true, description: "DocuSign OAuth access token (JWT grant rotation is the deployment concern)" }
-  ],
-  llm: [
-    { envVar: "ANTHROPIC_API_KEY", required: false, description: "Anthropic API key (use this OR OPENAI_API_KEY)" },
-    { envVar: "OPENAI_API_KEY", required: false, description: "OpenAI API key (use this OR ANTHROPIC_API_KEY)" }
-  ],
-  "llm-integration": [
-    { envVar: "ANTHROPIC_API_KEY", required: false, description: "Anthropic API key" },
-    { envVar: "OPENAI_API_KEY", required: false, description: "OpenAI API key" }
-  ],
-  ml: [
-    { envVar: "MASAR_URL", required: true, description: "Base URL of the deployed model-serving orbital" },
-    { envVar: "MASAR_ML_TRAIT", required: true, description: "Kebab-case trait name the serving orbital exposes its /events route under" }
-  ],
-  deepagent: [
-    { envVar: "DEEPAGENT_API_URL", required: true, description: "DeepAgent server URL" },
-    { envVar: "DEEPAGENT_API_KEY", required: false, description: "DeepAgent API key" }
-  ],
-  github: [
-    { envVar: "GITHUB_TOKEN", required: true, description: "GitHub personal access token" },
-    { envVar: "GITHUB_OWNER", required: false, description: "Default repository owner" },
-    { envVar: "GITHUB_REPO", required: false, description: "Default repository name" }
-  ],
-  docker: [
-    { envVar: "DOCKER_HOST", required: false, description: "Docker daemon host URL" }
-  ],
-  storage: [
-    { envVar: "STORAGE_ACCESS_KEY_ID", required: true, description: "S3-compatible access key id" },
-    { envVar: "STORAGE_SECRET_ACCESS_KEY", required: true, description: "S3-compatible secret access key" },
-    { envVar: "STORAGE_BUCKET", required: true, description: "Default bucket name" },
-    { envVar: "STORAGE_REGION", required: false, description: "Region (default us-east-1)" },
-    { envVar: "STORAGE_ENDPOINT", required: false, description: "Custom S3-compatible endpoint (R2/MinIO/\u2026); empty = AWS S3" },
-    { envVar: "STORAGE_PUBLIC_URL_BASE", required: false, description: "Base URL for public-acl object links; empty = endpoint-derived" }
-  ],
-  queue: [
-    { envVar: "QUEUE_URL", required: true, description: "Message queue connection URL" }
-  ],
-  redis: [
-    { envVar: "REDIS_URL", required: true, description: "Redis connection URL" }
-  ],
-  oauth: [
-    { envVar: "OAUTH_CLIENT_ID", required: true, description: "OIDC client ID" },
-    { envVar: "OAUTH_CLIENT_SECRET", required: true, description: "OIDC client secret" },
-    { envVar: "OAUTH_REDIRECT_URI", required: false, description: "OIDC redirect URI (default per-call param)" },
-    { envVar: "OIDC_ISSUER_URL", required: false, description: "OIDC issuer URL (default https://accounts.google.com)" }
-  ],
-  credentials: [
-    { envVar: "ALMADAR_CREDENTIAL_MASTER_KEY", required: false, description: "AES-256 master key (64-char hex) enabling the hosted credential store \u2014 hold it alone in the platform secret store" }
-  ],
-  otel: [
-    { envVar: "OTEL_EXPORTER_OTLP_ENDPOINT", required: true, description: "OpenTelemetry collector endpoint" },
-    { envVar: "OTEL_SERVICE_NAME", required: false, description: "Service name for traces" }
-  ],
-  cli: [],
-  // No fixed env vars — connection strings are resolved per-query from the
-  // caller-supplied connectionRef, so credentials cannot be declared statically.
-  database: [],
-  wikimedia: [
-    { envVar: "WIKIMEDIA_USER_AGENT", required: false, description: "Descriptive User-Agent for the Wikipedia API" },
-    { envVar: "WIKIMEDIA_TIMEOUT_MS", required: false, description: "Per-request timeout (ms)" }
-  ],
-  iconify: [
-    { envVar: "ICONIFY_USER_AGENT", required: false, description: "User-Agent for the Iconify API" },
-    { envVar: "ICONIFY_TIMEOUT_MS", required: false, description: "Per-request timeout (ms)" }
-  ],
-  arxiv: [
-    { envVar: "ARXIV_TIMEOUT_MS", required: false, description: "Per-request timeout (ms)" }
-  ]
-};
-var serviceProbes = {
-  calendar: { action: "listEvents", params: { maxResults: 1 } },
-  drive: { action: "listFiles", params: { maxResults: 1 } },
-  metaAds: { action: "listCampaigns", params: {} }
-};
-
 // src/integrations/credentials/index.ts
 var ENV_VAR_NAME = /^[A-Z][A-Z0-9_]*$/;
+var ROLE_GATED_ACTIONS = /* @__PURE__ */ new Set(["set", "remove", "test", "rotate"]);
+var DEFAULT_ADMIN_ROLES = ["admin", "owner"];
 function isProbeService(service) {
   return service in serviceProbes;
 }
@@ -4199,7 +4464,20 @@ var CredentialsIntegration = class extends BaseIntegration {
     super(config);
     this.logger.info("Credentials integration initialized (tenant credential store surface)");
   }
-  async execute(action, params) {
+  async execute(action, params, context) {
+    if (ROLE_GATED_ACTIONS.has(action)) {
+      const allowed = this.adminRoles();
+      if (!context?.role || !allowed.includes(context.role)) {
+        return {
+          success: false,
+          error: new IntegrationError(
+            `forbidden: "${action}" requires one of roles: ${allowed.join(", ")}`,
+            "AUTH_ERROR"
+          ),
+          metadata: this.createMetadata(action, 0)
+        };
+      }
+    }
     const validation = this.validateParams(action, params);
     if (!validation.valid) {
       return {
@@ -4227,8 +4505,16 @@ var CredentialsIntegration = class extends BaseIntegration {
           data = await this.remove(params.service, params.envVar);
           break;
         case "test":
-          data = await this.test(params.service);
+          data = await this.test(params.service, context);
+          break;
+        case "rotate": {
+          const store = getInstalledCredentialStore();
+          if (!store) {
+            throw new Error("No credential store is installed on this host");
+          }
+          data = await store.rotate();
           break;
+        }
         default:
           throw new Error(`Unknown action: ${action}`);
       }
@@ -4241,6 +4527,11 @@ var CredentialsIntegration = class extends BaseIntegration {
       return this.handleError(action, error);
     }
   }
+  adminRoles() {
+    const raw = this.config.env["ALMADAR_CREDENTIAL_ADMIN_ROLES"] || process.env["ALMADAR_CREDENTIAL_ADMIN_ROLES"] || "";
+    const roles = raw.split(",").map((r) => r.trim()).filter((r) => r.length > 0);
+    return roles.length > 0 ? roles : DEFAULT_ADMIN_ROLES;
+  }
   declaredFor(service) {
     return serviceCredentials[service] ?? [];
   }
@@ -4260,6 +4551,10 @@ var CredentialsIntegration = class extends BaseIntegration {
       throw new Error(`"${envVar}" is not a declared credential of "${service}" (declared: ${valid})`);
     }
   }
+  storeFirst() {
+    const flag = this.config.env["ALMADAR_CREDENTIALS_SOURCE"] || process.env["ALMADAR_CREDENTIALS_SOURCE"];
+    return flag === "store";
+  }
   list(serviceFilter) {
     const store = getInstalledCredentialStore();
     const stored = new Map((store?.entries() ?? []).map((e) => [`${e.service}\0${e.envVar}`, e]));
@@ -4269,7 +4564,7 @@ var CredentialsIntegration = class extends BaseIntegration {
       for (const { envVar, required, description } of declared) {
         const fromStore = stored.get(`${service}\0${envVar}`);
         stored.delete(`${service}\0${envVar}`);
-        const fromEnv = process.env[envVar];
+        const fromEnv = this.storeFirst() ? void 0 : process.env[envVar];
         const source = fromStore ? "store" : fromEnv ? "env" : "none";
         entries.push({
           service,
@@ -4313,7 +4608,7 @@ var CredentialsIntegration = class extends BaseIntegration {
     this.assertSettable(service, envVar);
     return { removed: await store.remove(envVar) };
   }
-  async test(service) {
+  async test(service, context) {
     const declared = this.declaredFor(service);
     const missing = declared.filter((c) => c.required && !resolveCredentialRef(c.envVar)).map((c) => c.envVar);
     const configured = missing.length === 0;
@@ -4328,7 +4623,7 @@ var CredentialsIntegration = class extends BaseIntegration {
     if (!factory.isConfigured(service)) {
       return { service, configured, missing, probed: false, ok: false, message: "Credentials present but the service is not configured on this host \u2014 restart or re-save a credential" };
     }
-    const result = await factory.execute(service, probe.action, probe.params);
+    const result = await factory.execute(service, probe.action, probe.params, context);
     if (!result.success) {
       return { service, configured, missing, probed: true, ok: false, message: result.error?.message ?? `Probe ${probe.action} failed` };
     }
@@ -4558,10 +4853,16 @@ var StorageIntegration = class extends BaseIntegration {
     const bucket = this.bucketOf(params);
     const prefix = params.prefix ?? "";
     const maxKeys = params.maxKeys ?? 1e3;
+    const continuationToken = params.continuationToken;
     this.logger.debug("Storage LIST", { bucket, prefix, maxKeys });
     if (this.s3) {
       const response = await this.s3.send(
-        new ListObjectsV2Command({ Bucket: bucket, Prefix: prefix || void 0, MaxKeys: maxKeys })
+        new ListObjectsV2Command({
+          Bucket: bucket,
+          Prefix: prefix || void 0,
+          MaxKeys: maxKeys,
+          ContinuationToken: continuationToken
+        })
       );
       return {
         keys: (response.Contents ?? []).map((entry) => ({
@@ -4569,9 +4870,8 @@ var StorageIntegration = class extends BaseIntegration {
           size: entry.Size ?? 0,
           lastModified: entry.LastModified?.getTime() ?? 0
         })),
-        // Continuation tokens are unrepresentable in the result type (ledger
-        // I-11) — surface the clamp honestly.
-        truncated: Boolean(response.IsTruncated)
+        truncated: Boolean(response.IsTruncated),
+        ...response.IsTruncated && response.NextContinuationToken !== void 0 ? { nextToken: response.NextContinuationToken } : {}
       };
     }
     const bucketPrefix = `${bucket}/`;
@@ -4586,7 +4886,14 @@ var StorageIntegration = class extends BaseIntegration {
       });
     }
     results.sort((a, b) => a.key.localeCompare(b.key));
-    return { keys: results.slice(0, maxKeys), truncated: results.length > maxKeys };
+    const offset = continuationToken !== void 0 ? Number.parseInt(continuationToken, 10) || 0 : 0;
+    const page = results.slice(offset, offset + maxKeys);
+    const truncated = offset + maxKeys < results.length;
+    return {
+      keys: page,
+      truncated,
+      ...truncated ? { nextToken: String(offset + maxKeys) } : {}
+    };
   }
   async deleteObject(params) {
     const bucket = this.bucketOf(params);
@@ -5379,6 +5686,6 @@ var ArxivIntegration = class extends BaseIntegration {
 };
 registerIntegration("arxiv", ArxivIntegration);
 
-export { AccountingIntegration, ArxivIntegration, BankingIntegration, BaseIntegration, CLIIntegration, CREDENTIAL_ENTITY_TYPE, CREDENTIAL_MASTER_KEY_ENV, CalendarIntegration, ConsoleLogger, CredentialStore, CredentialsIntegration, DatabaseIntegration, DeepAgentIntegration, DockerIntegration, DriveIntegration, EmailIntegration, EsignIntegration, GitHubIntegration, IconifyIntegration, IntegrationError, IntegrationFactory, LLMIntegration, MLIntegration, MetaAdsIntegration, OAuthIntegration, OtelIntegration, PushIntegration, QueueIntegration, RedisIntegration, StorageIntegration, StripeIntegration, TwilioIntegration, WebhookIntegration, WikimediaIntegration, YouTubeIntegration, assertReadOnlySelect, getActiveFactory, getInstalledCredentialStore, getIntegration, getIntegrationFactory, getRegisteredIntegrations, googleCalendarHookProvider, installActiveFactory, installCredentialStore, isKnownIntegration, parseCalendarPushNotification, registerIntegration, resetIntegrationFactory, resolveCredentialRef, uninstallCredentialStore, validateParams, verifyAndParseStripeEvent, withRetry };
+export { AccountingIntegration, ArxivIntegration, BankingIntegration, BaseIntegration, CLIIntegration, CREDENTIALS_FILE_ENV, CREDENTIAL_ENTITY_TYPE, CREDENTIAL_MASTER_KEY_ENV, CalendarIntegration, ConsoleLogger, CredentialStore, CredentialsIntegration, DatabaseIntegration, DeepAgentIntegration, DockerIntegration, DriveIntegration, EmailIntegration, EsignIntegration, FileCredentialPersistence, GitHubIntegration, IconifyIntegration, InMemoryPendingGrantStore, IntegrationError, IntegrationFactory, LLMIntegration, MLIntegration, MetaAdsIntegration, OAuthIntegration, OtelIntegration, PushIntegration, QueueIntegration, RedisIntegration, StorageIntegration, StripeIntegration, TwilioIntegration, WebhookIntegration, WikimediaIntegration, YouTubeIntegration, allHookDeclarations, assertReadOnlySelect, getActiveFactory, getInstalledCredentialStore, getIntegration, getIntegrationFactory, getRegisteredIntegrations, googleCalendarHookProvider, installActiveFactory, installCredentialStore, installPendingGrantStore, isKnownIntegration, parseCalendarPushNotification, registerIntegration, registeredHookProviders, resetIntegrationFactory, resolveCredentialRef, serviceHooks, uninstallCredentialStore, validateParams, verifyAndParseStripeEvent, withRetry };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map