@burdenoff/fe-libs 2026.930.3 → 2026.930.5

package/dist/connections/index.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Connecting a workspace to an integration provider — shared by every surface
+ * that does it (the integrations screens and the workflow builder).
+ *
+ * `ConnectionDialog` is the whole flow. The pieces are exported for screens
+ * that show providers or reuse part of it (a provider card's icon, the
+ * standalone vault picker), so none of them keeps a private copy again.
+ */
+export { ConnectionDialog, type ConnectionDialogProps } from './ConnectionDialog';
+export { CONNECTION_DIALOG_FRAME_CLASSES, type ConnectionDialogPresentation } from './frame';
+export { ProviderIcon, type ProviderIconProps } from './ProviderIcon';
+export { CredentialStorageSelector } from './CredentialStorageSelector';
+export { compatibleSecrets, EMPTY_STORAGE } from './storage';
+export { groupByCategory, pickableProviders } from './picker';
+export { ScopePicker } from './ScopePicker';
+export { createConnectionsApi, mapProvider, normalizeAuthType, type ConnectionRecord, type ConnectionsApi, type ConnectionsApiOptions, type CreateConnectionInput, } from './api';
+export { buildCreateInput, collectsOwnClientId, flowForAuthType, resolveFlow, resolveMethod, resolveSchema, submitConnection, submittedValues, validateDraft, type ConnectionDraft, type FlowStep, } from './connectionFlow';
+export { waitForOAuthCompletion, isOAuthCallbackMessage } from './oauthPopup';
+export { getProviderAccent, getProviderIconName, getProviderImageSource, getProviderTextIcon, normalizeProviderCategory, type ProviderIdentity, } from './providerIdentity';
+export { isScopeChecked, parseScopeOptions, requestedScopes, toggleScope, type ScopeOption, type ScopeSelection, } from './scopes';
+export { authTypeLabel, categoryLabel } from './labels';
+export type { ConnectionAuthMethod, ConnectionDialogEvent, ConnectionProvider, CreatedConnection, CredentialStorageState, ProviderAuthType, ProviderCategory, VaultSecretSummary, VaultSummary, } from './types';
+export type { Translator } from '../credentials/translate';
+//# sourceMappingURL=index.d.ts.map

package/dist/connections/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/connections/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,gBAAgB,EAAE,KAAK,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAClF,OAAO,EAAE,+BAA+B,EAAE,KAAK,4BAA4B,EAAE,MAAM,SAAS,CAAC;AAC7F,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,iBAAiB,EACjB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,GAC3B,MAAM,OAAO,CAAC;AACf,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,WAAW,EACX,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,KAAK,eAAe,EACpB,KAAK,QAAQ,GACd,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAC9E,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,yBAAyB,EACzB,KAAK,gBAAgB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,KAAK,WAAW,EAChB,KAAK,cAAc,GACpB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACxD,YAAY,EACV,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,EACjB,sBAAsB,EACtB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,GACb,MAAM,SAAS,CAAC;AACjB,YAAY,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/connections/labels.d.ts

@@ -0,0 +1,5 @@
+import { Translator } from '../credentials/translate';
+import { ProviderAuthType, ProviderCategory } from './types';
+export declare function categoryLabel(category: ProviderCategory, translate: Translator): string;
+export declare function authTypeLabel(authType: ProviderAuthType, translate: Translator): string;
+//# sourceMappingURL=labels.d.ts.map

package/dist/connections/labels.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"labels.d.ts","sourceRoot":"","sources":["../../src/connections/labels.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AA+BlE,wBAAgB,aAAa,CAAC,QAAQ,EAAE,gBAAgB,EAAE,SAAS,EAAE,UAAU,GAAG,MAAM,CAEvF;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,gBAAgB,EAAE,SAAS,EAAE,UAAU,GAAG,MAAM,CAEvF"}

package/dist/connections/labels.js

@@ -0,0 +1,35 @@
+//#region src/connections/labels.ts
+var e = {
+	communication: "Communication",
+	project_management: "Project Management",
+	cloud_storage: "Cloud Storage",
+	crm: "CRM",
+	analytics: "Analytics",
+	developer_tools: "Developer Tools",
+	marketing: "Marketing",
+	finance: "Finance",
+	hr: "Human Resources",
+	support: "Support",
+	social: "Social",
+	ai: "AI & ML",
+	email: "Email",
+	calendar: "Calendar",
+	productivity: "Productivity",
+	other: "Other"
+}, t = {
+	oauth2: "OAuth 2.0",
+	api_key: "API Key",
+	basic_auth: "Basic Auth",
+	bearer_token: "Bearer Token",
+	service_account: "Service Account",
+	workspace_app_token: "Workspace App Token",
+	custom: "Custom Config"
+};
+function n(t, n) {
+	return n(`integrations.category.${t}`, e[t]);
+}
+function r(e, n) {
+	return n(`integrations.authType.${e}`, t[e]);
+}
+//#endregion
+export { r as authTypeLabel, n as categoryLabel };

package/dist/connections/oauthPopup.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Wait for an OAuth popup to finish, however the result arrives.
+ *
+ * The callback page reports back three ways — `postMessage` to the opener, a
+ * `BroadcastChannel`, and a `localStorage` write — but none is reliable on its
+ * own: a provider sending `Cross-Origin-Opener-Policy` (Google does) severs the
+ * opener, and the channel and storage are scoped to the callback's origin,
+ * which is the API gateway rather than the app. So the connection's status is
+ * also polled, and whichever signal comes first settles the wait.
+ *
+ * Previously the integrations screens only listened and the workflow builder
+ * only polled; each missed the cases the other handled.
+ */
+/** What the callback page posts. */
+interface OAuthCallbackMessage {
+    type: 'OAUTH_CALLBACK';
+    success: boolean;
+    connectionId?: string;
+    error?: string;
+}
+/** The part of a connection this wait needs. */
+export interface OAuthConnectionStatus {
+    status?: string | null;
+    errorMessage?: string | null;
+}
+type EventSource = Pick<Window, 'addEventListener' | 'removeEventListener'>;
+export interface WaitForOAuthOptions<T extends OAuthConnectionStatus> {
+    connectionId: string;
+    popup: Pick<Window, 'close' | 'closed'>;
+    /** Reads the connection fresh from the service. */
+    fetchConnection: () => Promise<T | null | undefined>;
+    onSuccess: (connection: T) => void;
+    onError: (message: string) => void;
+    /** Always called exactly once, after success, error or timeout. */
+    onSettled: () => void;
+    pollIntervalMs?: number;
+    timeoutMs?: number;
+    /** Where messages and storage events arrive; the window by default. */
+    eventSource?: EventSource | null;
+}
+export declare function isOAuthCallbackMessage(value: unknown): value is OAuthCallbackMessage;
+/**
+ * Start waiting. Returns a cancel function that stops every listener and timer
+ * without reporting an outcome — for when the dialog closes mid-wait.
+ */
+export declare function waitForOAuthCompletion<T extends OAuthConnectionStatus>({ connectionId, popup, fetchConnection, onSuccess, onError, onSettled, pollIntervalMs, timeoutMs, eventSource, }: WaitForOAuthOptions<T>): () => void;
+export {};
+//# sourceMappingURL=oauthPopup.d.ts.map

package/dist/connections/oauthPopup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthPopup.d.ts","sourceRoot":"","sources":["../../src/connections/oauthPopup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,oCAAoC;AACpC,UAAU,oBAAoB;IAC5B,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,gDAAgD;AAChD,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,KAAK,WAAW,GAAG,IAAI,CAAC,MAAM,EAAE,kBAAkB,GAAG,qBAAqB,CAAC,CAAC;AAE5E,MAAM,WAAW,mBAAmB,CAAC,CAAC,SAAS,qBAAqB;IAClE,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,GAAG,QAAQ,CAAC,CAAC;IACxC,mDAAmD;IACnD,eAAe,EAAE,MAAM,OAAO,CAAC,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IACrD,SAAS,EAAE,CAAC,UAAU,EAAE,CAAC,KAAK,IAAI,CAAC;IACnC,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,mEAAmE;IACnE,SAAS,EAAE,MAAM,IAAI,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;CAClC;AAQD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,oBAAoB,CAQpF;AAYD;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,SAAS,qBAAqB,EAAE,EACtE,YAAY,EACZ,KAAK,EACL,eAAe,EACf,SAAS,EACT,OAAO,EACP,SAAS,EACT,cAAqB,EACrB,SAAmB,EACnB,WAA2D,GAC5D,EAAE,mBAAmB,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAgGrC"}

package/dist/connections/oauthPopup.js

@@ -0,0 +1,70 @@
+//#region src/connections/oauthPopup.ts
+var e = "PENDING_AUTH";
+function t(e) {
+	return typeof e == "object" && !!e;
+}
+function n(e) {
+	return t(e) && e.type === "OAUTH_CALLBACK" && typeof e.success == "boolean" && (e.connectionId === void 0 || typeof e.connectionId == "string") && (e.error === void 0 || typeof e.error == "string");
+}
+function r(e) {
+	if (!e) return null;
+	try {
+		let t = JSON.parse(e);
+		return n(t) ? t : null;
+	} catch {
+		return null;
+	}
+}
+function i({ connectionId: t, popup: i, fetchConnection: a, onSuccess: o, onError: s, onSettled: c, pollIntervalMs: l = 2e3, timeoutMs: u = 3e5, eventSource: d = typeof window > "u" ? null : window }) {
+	let f = !1, p = null, m = null, h = null, g = () => {
+		m && clearInterval(m), h && clearTimeout(h), m = null, h = null, d?.removeEventListener("message", b), d?.removeEventListener("storage", x), p?.close(), p = null;
+	}, _ = (e) => {
+		if (!f) {
+			f = !0, g(), i.closed || i.close();
+			try {
+				e();
+			} finally {
+				c();
+			}
+		}
+	}, v = (e) => {
+		e ? e.status === "ACTIVE" ? o(e) : s(e.errorMessage || "OAuth authorization failed") : s("Connection not found. It may have been deleted.");
+	}, y = async (e) => {
+		if (f || e.connectionId && e.connectionId !== t) return;
+		if (!e.success) {
+			_(() => s(e.error || "OAuth authorization failed"));
+			return;
+		}
+		let n;
+		try {
+			n = await a();
+		} catch (e) {
+			_(() => s(e instanceof Error ? e.message : "OAuth authorization failed"));
+			return;
+		}
+		_(() => v(n));
+	};
+	function b(e) {
+		let t = e.data;
+		n(t) && y(t);
+	}
+	function x(e) {
+		let t = e;
+		if (t.key !== "oauth_callback_result") return;
+		let n = r(t.newValue);
+		n && y(n);
+	}
+	return d?.addEventListener("message", b), d?.addEventListener("storage", x), typeof BroadcastChannel < "u" && (p = new BroadcastChannel("oauth_callback"), p.onmessage = (e) => {
+		n(e.data) && y(e.data);
+	}), m = setInterval(() => {
+		a().then((t) => {
+			!t?.status || t.status === e || _(() => v(t));
+		}).catch(() => void 0);
+	}, l), h = setTimeout(() => {
+		_(() => s("OAuth authorization timed out"));
+	}, u), () => {
+		f || (f = !0, g());
+	};
+}
+//#endregion
+export { n as isOAuthCallbackMessage, i as waitForOAuthCompletion };

package/dist/connections/picker.d.ts

@@ -0,0 +1,7 @@
+import { Translator } from '../credentials/translate';
+import { ConnectionProvider } from './types';
+/** The providers the picker offers, filtered by the search query. */
+export declare function pickableProviders(providers: ConnectionProvider[], source: 'installed' | 'catalog', query: string, translate: Translator): ConnectionProvider[];
+/** Providers grouped by category, in first-seen order. */
+export declare function groupByCategory(providers: ConnectionProvider[]): Array<[ConnectionProvider['category'], ConnectionProvider[]]>;
+//# sourceMappingURL=picker.d.ts.map

package/dist/connections/picker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"picker.d.ts","sourceRoot":"","sources":["../../src/connections/picker.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAE3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAElD,qEAAqE;AACrE,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,kBAAkB,EAAE,EAC/B,MAAM,EAAE,WAAW,GAAG,SAAS,EAC/B,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,UAAU,GACpB,kBAAkB,EAAE,CAatB;AAED,0DAA0D;AAC1D,wBAAgB,eAAe,CAC7B,SAAS,EAAE,kBAAkB,EAAE,GAC9B,KAAK,CAAC,CAAC,kBAAkB,CAAC,UAAU,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAQ/D"}

package/dist/connections/picker.js

@@ -0,0 +1,16 @@
+import { categoryLabel as e } from "./labels.js";
+//#region src/connections/picker.ts
+function t(t, n, r, i) {
+	let a = t.filter((e) => e.isEnabled && (n === "catalog" || e.pluginStatus === "installed")), o = r.trim().toLowerCase();
+	return o ? a.filter((t) => t.name.toLowerCase().includes(o) || t.description.toLowerCase().includes(o) || t.key.toLowerCase().includes(o) || e(t.category, i).toLowerCase().includes(o)) : a;
+}
+function n(e) {
+	let t = /* @__PURE__ */ new Map();
+	for (let n of e) {
+		let e = t.get(n.category);
+		e ? e.push(n) : t.set(n.category, [n]);
+	}
+	return [...t.entries()];
+}
+//#endregion
+export { n as groupByCategory, t as pickableProviders };

package/dist/connections/providerIdentity.d.ts

@@ -0,0 +1,23 @@
+import { ProviderCategory } from './types';
+/** Only the fields identity depends on, so any provider shape can be passed. */
+export interface ProviderIdentity {
+    key: string;
+    icon?: string | null;
+    category?: string | null;
+}
+export declare function normalizeProviderCategory(value: unknown): ProviderCategory;
+/** The label for a named tile, or undefined when the provider has a mark. */
+export declare function getProviderTextIcon(provider: Pick<ProviderIdentity, 'key' | 'icon'>): string | undefined;
+/**
+ * An image to render: an absolute/relative URL or inline image the catalog
+ * supplied, or one of the bundled first-party marks.
+ */
+export declare function getProviderImageSource(provider: Pick<ProviderIdentity, 'icon'>, bundledIcons: Readonly<Record<string, string>>): string | undefined;
+/** The Iconify name to render when there is no tile or image. */
+export declare function getProviderIconName(provider: ProviderIdentity): string;
+/** Tile colours by category, from semantic tokens only. */
+export declare function getProviderAccent(category: unknown): {
+    surface: string;
+    icon: string;
+};
+//# sourceMappingURL=providerIdentity.d.ts.map

package/dist/connections/providerIdentity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providerIdentity.d.ts","sourceRoot":"","sources":["../../src/connections/providerIdentity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAEhD,gFAAgF;AAChF,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAoGD,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,CAG1E;AA4DD,6EAA6E;AAC7E,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE,KAAK,GAAG,MAAM,CAAC,GAC/C,MAAM,GAAG,SAAS,CAQpB;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,EACxC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAC7C,MAAM,GAAG,SAAS,CAOpB;AAED,iEAAiE;AACjE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,CAmBtE;AAkBD,2DAA2D;AAC3D,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,OAAO,GAAG;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd,CAoBA"}

package/dist/connections/providerIdentity.js

@@ -0,0 +1,175 @@
+//#region src/connections/providerIdentity.ts
+var e = {
+	"google-gmail": "logos:google-gmail",
+	"google-drive": "logos:google-drive",
+	"google-calendar": "logos:google-calendar",
+	"google-sheets": "thesvg-color:google-sheets",
+	"google-docs": "thesvg-color:google-docs",
+	"google-chat": "thesvg-color:google-chat",
+	"google-forms": "simple-icons:googleforms",
+	"google-workspace-admin": "thesvg-color:google-workspace-admin",
+	"google-workspace-admin-domain-wide-delegation": "thesvg-color:google-workspace-admin",
+	"microsoft-outlook": "thesvg-color:microsoft-outlook",
+	"microsoft-onedrive": "logos:microsoft-onedrive",
+	"microsoft-teams": "logos:microsoft-teams",
+	"microsoft-excel": "thesvg-color:microsoft-excel",
+	github: "mdi:github",
+	slack: "logos:slack-icon",
+	salesforce: "logos:salesforce",
+	notion: "simple-icons:notion",
+	airtable: "logos:airtable",
+	linear: "simple-icons:linear",
+	facebook: "logos:facebook",
+	instagram: "logos:instagram-icon",
+	twitter: "simple-icons:x",
+	linkedin: "simple-icons:linkedin",
+	youtube: "logos:youtube-icon",
+	tiktok: "logos:tiktok-icon",
+	pinterest: "logos:pinterest",
+	snapchat: "simple-icons:snapchat",
+	"google-ads": "logos:google-ads",
+	"linkedin-ads": "simple-icons:linkedin",
+	quickbooks: "simple-icons:quickbooks",
+	"g2-data-feed": "thesvg-color:g2",
+	openai: "simple-icons:openai",
+	anthropic: "simple-icons:anthropic",
+	sendgrid: "simple-icons:sendgrid",
+	twilio: "logos:twilio-icon",
+	stripe: "logos:stripe",
+	postgres: "logos:postgresql",
+	mysql: "logos:mysql",
+	mongodb: "logos:mongodb-icon",
+	redis: "logos:redis",
+	aws: "logos:aws",
+	gcp: "logos:google-cloud",
+	azure: "logos:azure-icon",
+	"generic-oauth2": "mdi:key-chain",
+	"generic-api-key": "mdi:key-variant",
+	"generic-basic-auth": "mdi:lock-outline"
+}, t = {
+	communication: "mdi:message-text-outline",
+	project_management: "mdi:view-dashboard-outline",
+	cloud_storage: "mdi:cloud-outline",
+	crm: "mdi:account-group-outline",
+	analytics: "mdi:chart-bar",
+	developer_tools: "mdi:code-braces",
+	finance: "mdi:currency-usd",
+	support: "mdi:headset",
+	social: "mdi:share-variant-outline",
+	ai: "mdi:brain",
+	email: "mdi:email-outline",
+	calendar: "mdi:calendar-outline",
+	productivity: "mdi:file-document-outline",
+	marketing: "mdi:bullhorn-outline",
+	hr: "mdi:account-tie-outline",
+	other: "mdi:puzzle-outline"
+}, n = {
+	COMMUNICATION: "communication",
+	PROJECT_MANAGEMENT: "project_management",
+	CLOUD_STORAGE: "cloud_storage",
+	CRM: "crm",
+	ANALYTICS: "analytics",
+	DEVELOPMENT: "developer_tools",
+	DEVELOPER_TOOLS: "developer_tools",
+	MARKETING: "marketing",
+	PAYMENT: "finance",
+	FINANCE: "finance",
+	HR: "hr",
+	SUPPORT: "support",
+	SOCIAL: "social",
+	AI: "ai",
+	EMAIL: "email",
+	CALENDAR: "calendar",
+	PRODUCTIVITY: "productivity",
+	CUSTOM: "other",
+	OTHER: "other"
+};
+function r(e) {
+	return s(n, String(e ?? "").toUpperCase()) ?? "other";
+}
+var i = {
+	bamboohr: "BambooHR",
+	"meta-ads": "Meta Ads",
+	pgvector: "pgvector",
+	"apple-app-store-connect": "Connect",
+	"freshdesk-api": "Freshdesk",
+	hubspot: "HubSpot",
+	pinecone: "Pinecone",
+	ramp: "Ramp",
+	tally: "TallyPrime",
+	woocommerce: "WooCommerce",
+	"zoho-books": "Zoho Books"
+}, a = {
+	bamboohr: "simple-icons:bamboohr",
+	"meta-ads": "meta-ads",
+	pgvector: "iconify:logos:postgresql",
+	"apple-app-store-connect": "simple-icons:appstore",
+	"freshdesk-api": "simple-icons:freshworks",
+	hubspot: "hubspot",
+	pinecone: "iconify:mdi:database-search",
+	ramp: "mdi:credit-card-outline",
+	tally: "tally",
+	woocommerce: "simple-icons:woocommerce",
+	"zoho-books": "zoho-books"
+}, o = { pipedrive: {
+	icon: "simple-icons:pipedrive",
+	replacement: "thesvg-color:pipedrive"
+} };
+function s(e, t) {
+	return Object.prototype.hasOwnProperty.call(e, t) ? e[t] : void 0;
+}
+function c(e) {
+	return t[typeof e == "string" && Object.prototype.hasOwnProperty.call(t, e) ? e : r(e)];
+}
+function l(e) {
+	let t = e.icon ?? "", n = t.startsWith("text:"), r = n ? t.slice(5) : e.key;
+	if (n || t === s(a, e.key)) return s(i, r);
+}
+function u(e, t) {
+	let n = e.icon ?? "";
+	if (n) return /^https?:\/\//i.test(n) || n.startsWith("/") || n.startsWith("data:image/") ? n : s(t, n.startsWith("brand:") ? n.slice(6) : n);
+}
+function d(t) {
+	let n = t.icon ?? "", r = c(t.category), i = s(o, t.key);
+	return i && n === i.icon ? i.replacement : n.startsWith("iconify:") ? n.slice(8) : n.startsWith("text:") ? r : /^[a-z0-9-]+:[a-z0-9-]+$/i.test(n) && !n.startsWith("brand:") ? n : n === "key" && t.key.startsWith("generic-") ? s(e, t.key) ?? r : s(e, n) ?? (n ? r : s(e, t.key) ?? r);
+}
+var f = {
+	primary: {
+		surface: "bg-action-primary-bg/10",
+		icon: "text-primary"
+	},
+	success: {
+		surface: "bg-status-success-bg-subtle",
+		icon: "text-status-success-text"
+	},
+	warning: {
+		surface: "bg-status-warning-bg-subtle",
+		icon: "text-status-warning-text"
+	},
+	info: {
+		surface: "bg-status-info-bg-subtle",
+		icon: "text-status-info-text"
+	},
+	neutral: {
+		surface: "bg-bg-sunken",
+		icon: "text-text-primary"
+	}
+};
+function p(e) {
+	switch (r(e)) {
+		case "communication":
+		case "social":
+		case "support": return f.info;
+		case "crm":
+		case "hr": return f.success;
+		case "finance":
+		case "calendar":
+		case "productivity": return f.warning;
+		case "ai":
+		case "email":
+		case "marketing": return f.neutral;
+		default: return f.primary;
+	}
+}
+//#endregion
+export { p as getProviderAccent, d as getProviderIconName, u as getProviderImageSource, l as getProviderTextIcon, r as normalizeProviderCategory };

package/dist/connections/scopes.d.ts

@@ -0,0 +1,42 @@
+/**
+ * OAuth scope options, read from the service rather than hardcoded.
+ *
+ * Per-provider forms used to carry their scope lists in React (Gmail's five,
+ * with English labels). The service seeds the same list on the provider and on
+ * each auth method, so it is read here and a new scope needs no frontend
+ * change.
+ */
+export interface ScopeOption {
+    scope: string;
+    description?: string;
+    /** Always granted — shown as fixed rather than as a choice. */
+    required: boolean;
+}
+/**
+ * Narrow the service's `availableScopes` JSON to options, discarding anything
+ * malformed rather than rendering a broken row.
+ */
+export declare function parseScopeOptions(raw: unknown): ScopeOption[];
+/**
+ * The user's scope choice. `null` means untouched: the connection requests the
+ * method's defaults, and the service chooses them.
+ */
+export type ScopeSelection = string[] | null;
+/** Whether an optional scope reads as ticked. */
+export declare function isScopeChecked(scope: string, selection: ScopeSelection, defaultScopes: readonly string[]): boolean;
+/**
+ * Toggle one scope, starting from what is currently shown — so the first click
+ * on an untouched picker keeps the ticked defaults instead of discarding them.
+ */
+export declare function toggleScope(scope: string, selection: ScopeSelection, defaultScopes: readonly string[], options: readonly ScopeOption[]): string[];
+/**
+ * The scopes to send, or undefined to let the service use the method's
+ * defaults.
+ *
+ * The service treats a sent list as the whole request — it does not add the
+ * required scopes back. The picker promises those are "always included", so a
+ * user's choice is sent together with them; sending the choice alone dropped
+ * them.
+ */
+export declare function requestedScopes(selection: ScopeSelection, options: readonly ScopeOption[]): string[] | undefined;
+//# sourceMappingURL=scopes.d.ts.map

package/dist/connections/scopes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.d.ts","sourceRoot":"","sources":["../../src/connections/scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+DAA+D;IAC/D,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,WAAW,EAAE,CAkB7D;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;AAE7C,iDAAiD;AACjD,wBAAgB,cAAc,CAC5B,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,cAAc,EACzB,aAAa,EAAE,SAAS,MAAM,EAAE,GAC/B,OAAO,CAET;AAED;;;GAGG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,cAAc,EACzB,aAAa,EAAE,SAAS,MAAM,EAAE,EAChC,OAAO,EAAE,SAAS,WAAW,EAAE,GAC9B,MAAM,EAAE,CAQV;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,cAAc,EACzB,OAAO,EAAE,SAAS,WAAW,EAAE,GAC9B,MAAM,EAAE,GAAG,SAAS,CAItB"}

package/dist/connections/scopes.js

@@ -0,0 +1,30 @@
+//#region src/connections/scopes.ts
+function e(e) {
+	return Array.isArray(e) ? e.flatMap((e) => {
+		if (typeof e == "string") return e ? [{
+			scope: e,
+			required: !1
+		}] : [];
+		if (!e || typeof e != "object") return [];
+		let t = e, n = t.scope ?? t.value;
+		return typeof n != "string" || !n ? [] : [{
+			scope: n,
+			description: typeof t.description == "string" ? t.description : typeof t.label == "string" ? t.label : void 0,
+			required: t.required === !0
+		}];
+	}) : [];
+}
+function t(e, t, n) {
+	return t === null ? n.includes(e) : t.includes(e);
+}
+function n(e, t, n, r) {
+	let i = new Set(n), a = t ?? r.filter((e) => !e.required && i.has(e.scope)).map((e) => e.scope);
+	return a.includes(e) ? a.filter((t) => t !== e) : [...a, e];
+}
+function r(e, t) {
+	if (e === null) return;
+	let n = t.filter((e) => e.required).map((e) => e.scope);
+	return [...new Set([...n, ...e])];
+}
+//#endregion
+export { t as isScopeChecked, e as parseScopeOptions, r as requestedScopes, n as toggleScope };

package/dist/connections/storage.d.ts

@@ -0,0 +1,8 @@
+import { CredentialStorageState, ProviderAuthType, VaultSecretSummary } from './types';
+export declare const EMPTY_STORAGE: CredentialStorageState;
+/**
+ * Secrets that can hold this kind of credential. An OAuth or basic-auth
+ * connection needs a structured secret; a key or token fits a plain one.
+ */
+export declare function compatibleSecrets(secrets: VaultSecretSummary[], authType: ProviderAuthType): VaultSecretSummary[];
+//# sourceMappingURL=storage.d.ts.map

package/dist/connections/storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/connections/storage.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAE5F,eAAO,MAAM,aAAa,EAAE,sBAK3B,CAAC;AAKF;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,kBAAkB,EAAE,EAC7B,QAAQ,EAAE,gBAAgB,GACzB,kBAAkB,EAAE,CAQtB"}

package/dist/connections/storage.js

@@ -0,0 +1,21 @@
+//#region src/connections/storage.ts
+var e = {
+	mode: "managed",
+	vaultId: "",
+	secretId: "",
+	managedSecretName: ""
+}, t = new Set([
+	"TOKEN",
+	"CREDENTIAL",
+	"STRUCTURED_DATA"
+]), n = new Set([
+	"API_KEY",
+	"TOKEN",
+	"TEXT",
+	"STRUCTURED_DATA"
+]);
+function r(e, r) {
+	return r === "oauth2" || r === "basic_auth" ? e.filter((e) => t.has(e.type)) : r === "api_key" || r === "bearer_token" ? e.filter((e) => n.has(e.type)) : e;
+}
+//#endregion
+export { e as EMPTY_STORAGE, r as compatibleSecrets };

package/dist/connections/types.d.ts

@@ -0,0 +1,82 @@
+import { AuthMethodFlow } from '../credentials/types';
+export type ProviderCategory = 'communication' | 'project_management' | 'cloud_storage' | 'crm' | 'analytics' | 'developer_tools' | 'marketing' | 'finance' | 'hr' | 'support' | 'social' | 'ai' | 'email' | 'calendar' | 'productivity' | 'other';
+export type ProviderAuthType = 'oauth2' | 'api_key' | 'basic_auth' | 'bearer_token' | 'service_account' | 'workspace_app_token' | 'custom';
+/** One way of authenticating against a provider. */
+export interface ConnectionAuthMethod {
+    key: string;
+    displayName: string;
+    description: string | null;
+    authType: ProviderAuthType;
+    flow: AuthMethodFlow;
+    defaultScopes: string[];
+    /** Raw `availableScopes` JSON; narrowed by `parseScopeOptions`. */
+    availableScopes: unknown;
+    configSchema: Record<string, unknown> | null;
+    /** False when this environment lacks the credentials the method needs. */
+    isConfigured: boolean;
+    isEnabled: boolean;
+    displayOrder: number;
+}
+export interface ConnectionProvider {
+    id: string;
+    key: string;
+    name: string;
+    description: string;
+    category: ProviderCategory;
+    authType: ProviderAuthType;
+    icon: string;
+    website: string;
+    docsUrl: string;
+    isEnabled: boolean;
+    /** `installed` for providers a workspace has installed from the catalog. */
+    pluginStatus: string;
+    defaultScopes: string[];
+    availableScopes: unknown;
+    configSchema: Record<string, unknown> | null;
+    authMethods: ConnectionAuthMethod[];
+}
+/** What the dialog hands back once a connection is usable. */
+export interface CreatedConnection {
+    id: string;
+    name: string;
+    /** The service's status enum, e.g. `ACTIVE`. */
+    status: string;
+    provider: ConnectionProvider;
+}
+/** Where a new connection's credential is kept. */
+export interface CredentialStorageState {
+    /**
+     * `managed` — a new secret, in `vaultId` when one is chosen, otherwise held
+     * by the integrations service itself. `existing` — reference `secretId`.
+     */
+    mode: 'managed' | 'existing';
+    vaultId: string;
+    secretId: string;
+    managedSecretName: string;
+}
+export interface VaultSummary {
+    id: string;
+    name: string;
+    secretCount: number;
+}
+export interface VaultSecretSummary {
+    id: string;
+    name: string;
+    type: string;
+}
+/** Lifecycle events a host may want to mirror onto its own event bus. */
+export type ConnectionDialogEvent = {
+    type: 'connection-created';
+    connectionId: string;
+    providerKey: string;
+} | {
+    type: 'oauth-started';
+    connectionId: string;
+    providerKey: string;
+} | {
+    type: 'oauth-failed';
+    connectionId: string;
+    providerKey: string;
+    error: string;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/connections/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/connections/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,MAAM,MAAM,gBAAgB,GACxB,eAAe,GACf,oBAAoB,GACpB,eAAe,GACf,KAAK,GACL,WAAW,GACX,iBAAiB,GACjB,WAAW,GACX,SAAS,GACT,IAAI,GACJ,SAAS,GACT,QAAQ,GACR,IAAI,GACJ,OAAO,GACP,UAAU,GACV,cAAc,GACd,OAAO,CAAC;AAEZ,MAAM,MAAM,gBAAgB,GACxB,QAAQ,GACR,SAAS,GACT,YAAY,GACZ,cAAc,GACd,iBAAiB,GACjB,qBAAqB,GACrB,QAAQ,CAAC;AAEb,oDAAoD;AACpD,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,IAAI,EAAE,cAAc,CAAC;IACrB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,mEAAmE;IACnE,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC7C,0EAA0E;IAC1E,YAAY,EAAE,OAAO,CAAC;IACtB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,4EAA4E;IAC5E,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC7C,WAAW,EAAE,oBAAoB,EAAE,CAAC;CACrC;AAED,8DAA8D;AAC9D,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,kBAAkB,CAAC;CAC9B;AAED,mDAAmD;AACnD,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,IAAI,EAAE,SAAS,GAAG,UAAU,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,yEAAyE;AACzE,MAAM,MAAM,qBAAqB,GAC7B;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACzE;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACpE;IACE,IAAI,EAAE,cAAc,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACf,CAAC"}