@checkstack/integration-backend 0.1.30 → 0.3.0

package/src/router.ts

@@ -1,409 +1,58 @@
 import { implement, ORPCError } from "@orpc/server";
-import type { SafeDatabase } from "@checkstack/backend-api";
 import {
   autoAuthMiddleware,
   correlationMiddleware,
-  type RpcContext,
   type Logger,
+  type RpcContext,
+  type SafeDatabase,
 } from "@checkstack/backend-api";
-import type { SignalService } from "@checkstack/signal-common";
-import { eq, desc, and, gte, count } from "drizzle-orm";
+import { extractErrorMessage } from "@checkstack/common";
+import { maskSecrets } from "@checkstack/secrets-common";
+import { integrationContract } from "@checkstack/integration-common";
 
-import type { IntegrationEventRegistry } from "./event-registry";
 import type { IntegrationProviderRegistry } from "./provider-registry";
-import type { DeliveryCoordinator } from "./delivery-coordinator";
 import type { ConnectionStore } from "./connection-store";
 import * as schema from "./schema";
-import {
-  integrationContract,
-  INTEGRATION_SUBSCRIPTION_CHANGED,
-} from "@checkstack/integration-common";
-import { extractErrorMessage } from "@checkstack/common";
-
-/**
- * Recursively extracts flattened property paths from a JSON Schema.
- * Used to provide template hints for payload properties.
- */
-interface JsonSchemaProperty {
-  path: string;
-  type: string;
-  description?: string;
-}
-
-function extractJsonSchemaProperties(
-  schema: Record<string, unknown>,
-  basePath: string = ""
-): JsonSchemaProperty[] {
-  const properties: JsonSchemaProperty[] = [];
-
-  const schemaType = schema["type"] as string | string[] | undefined;
-  const schemaProperties = schema["properties"] as
-    | Record<string, Record<string, unknown>>
-    | undefined;
-  const schemaItems = schema["items"] as Record<string, unknown> | undefined;
-  const schemaDescription = schema["description"] as string | undefined;
-
-  // Handle object with properties
-  if (schemaProperties) {
-    for (const [key, propSchema] of Object.entries(schemaProperties)) {
-      const propPath = basePath ? `${basePath}.${key}` : key;
-      const propType = (propSchema["type"] as string) || "unknown";
-      const propDescription = propSchema["description"] as string | undefined;
-
-      // Add this property
-      properties.push({
-        path: propPath,
-        type: Array.isArray(propType) ? propType.join(" | ") : propType,
-        description: propDescription,
-      });
-
-      // Recurse into nested objects
-      if (propType === "object" || propSchema["properties"]) {
-        properties.push(...extractJsonSchemaProperties(propSchema, propPath));
-      }
-
-      // Recurse into arrays (add [n] notation)
-      if (propType === "array" && propSchema["items"]) {
-        const itemsSchema = propSchema["items"] as Record<string, unknown>;
-        properties.push(
-          ...extractJsonSchemaProperties(itemsSchema, `${propPath}[n]`)
-        );
-      }
-    }
-  }
-
-  // Handle array at root level
-  if (schemaType === "array" && schemaItems) {
-    properties.push(
-      ...extractJsonSchemaProperties(schemaItems, `${basePath}[n]`)
-    );
-  }
-
-  // If this is a primitive with a path, add it
-  if (
-    basePath &&
-    schemaType &&
-    schemaType !== "object" &&
-    schemaType !== "array" &&
-    !schemaProperties
-  ) {
-    properties.push({
-      path: basePath,
-      type: Array.isArray(schemaType) ? schemaType.join(" | ") : schemaType,
-      description: schemaDescription,
-    });
-  }
-
-  return properties;
-}
 
 interface RouterDeps {
   db: SafeDatabase<typeof schema>;
-  eventRegistry: IntegrationEventRegistry;
   providerRegistry: IntegrationProviderRegistry;
-  deliveryCoordinator: DeliveryCoordinator;
   connectionStore: ConnectionStore;
-  signalService: SignalService;
   logger: Logger;
 }
 
 /**
- * Creates the integration router using contract-based implementation.
- *
- * Auth and access rules are automatically enforced via autoAuthMiddleware
- * based on the contract's meta.userType and meta.access.
+ * Integration router — connection management only. The legacy
+ * subscription / event-listing / delivery-log endpoints were removed
+ * when the platform moved to the Automation Platform model.
  */
 export function createIntegrationRouter(deps: RouterDeps) {
-  const {
-    db,
-    eventRegistry,
-    providerRegistry,
-    deliveryCoordinator,
-    connectionStore,
-    signalService,
-    logger,
-  } = deps;
-
-  // Create contract implementer with context type AND auto auth middleware
+  const { db, providerRegistry, connectionStore, logger } = deps;
+
   const os = implement(integrationContract)
     .$context<RpcContext>()
     .use(correlationMiddleware)
     .use(autoAuthMiddleware);
 
   return os.router({
-    // =========================================================================
-    // SUBSCRIPTION MANAGEMENT
-    // =========================================================================
-
-    listSubscriptions: os.listSubscriptions.handler(async ({ input }) => {
-      const { limit, offset, providerId, eventType, enabled } = input;
-
-      // Build where conditions
-      const conditions = [];
-      if (providerId) {
-        conditions.push(eq(schema.webhookSubscriptions.providerId, providerId));
-      }
-      if (enabled !== undefined) {
-        conditions.push(eq(schema.webhookSubscriptions.enabled, enabled));
-      }
-
-      const whereClause =
-        conditions.length > 0 ? and(...conditions) : undefined;
-
-      // Get total count
-      const [{ value: total }] = await db
-        .select({ value: count() })
-        .from(schema.webhookSubscriptions)
-        .where(whereClause);
-
-      // Get paginated results
-      let query = db
-        .select()
-        .from(schema.webhookSubscriptions)
-        .orderBy(desc(schema.webhookSubscriptions.createdAt))
-        .limit(limit)
-        .offset(offset);
-
-      if (whereClause) {
-        query = query.where(whereClause) as typeof query;
-      }
-
-      const subscriptions = await query;
-
-      // Filter by event type if specified
-      const filtered = eventType
-        ? subscriptions.filter((s) => s.eventId === eventType)
-        : subscriptions;
-
-      return {
-        items: filtered.map((s) => ({
-          ...s,
-          description: s.description ?? undefined,
-          systemFilter: s.systemFilter ?? undefined,
-          createdAt: s.createdAt,
-          updatedAt: s.updatedAt,
-        })),
-        total: Number(total),
-        limit,
-        offset,
-      };
-    }),
-
-    getSubscription: os.getSubscription.handler(async ({ input }) => {
-      const [subscription] = await db
-        .select()
-        .from(schema.webhookSubscriptions)
-        .where(eq(schema.webhookSubscriptions.id, input.id));
-
-      if (!subscription) {
-        throw new ORPCError("NOT_FOUND", {
-          message: "Subscription not found",
-        });
-      }
-
-      return {
-        ...subscription,
-        description: subscription.description ?? undefined,
-        systemFilter: subscription.systemFilter ?? undefined,
-        createdAt: subscription.createdAt,
-        updatedAt: subscription.updatedAt,
-      };
-    }),
-
-    createSubscription: os.createSubscription.handler(async ({ input }) => {
-      const {
-        name,
-        description,
-        providerId,
-        providerConfig,
-        eventId,
-        systemFilter,
-      } = input;
-
-      // Validate provider exists
-      const provider = providerRegistry.getProvider(providerId);
-      if (!provider) {
-        throw new ORPCError("BAD_REQUEST", {
-          message: `Provider not found: ${providerId}`,
-        });
-      }
-
-      // Validate event exists
-      if (!eventRegistry.hasEvent(eventId)) {
-        throw new ORPCError("BAD_REQUEST", {
-          message: `Event type not found: ${eventId}`,
-        });
-      }
-
-      // Validate providerConfig against the provider's schema
-      const configParseResult =
-        provider.config.schema.safeParse(providerConfig);
-      if (!configParseResult.success) {
-        throw new ORPCError("BAD_REQUEST", {
-          message: `Invalid provider configuration: ${configParseResult.error.message}`,
-        });
-      }
-
-      const id = crypto.randomUUID();
-      const now = new Date();
-
-      await db.insert(schema.webhookSubscriptions).values({
-        id,
-        name,
-        description,
-        providerId,
-        providerConfig,
-        eventId,
-        systemFilter,
-        enabled: true,
-        createdAt: now,
-        updatedAt: now,
-      });
-
-      // Emit signal
-      await signalService.broadcast(INTEGRATION_SUBSCRIPTION_CHANGED, {
-        action: "created",
-        subscriptionId: id,
-      });
-
-      logger.info(`Created webhook subscription: ${name} (${id})`);
-
-      return {
-        id,
-        name,
-        description,
-        providerId,
-        providerConfig,
-        eventId,
-        systemFilter,
-        enabled: true,
-        createdAt: now,
-        updatedAt: now,
-      };
-    }),
-
-    updateSubscription: os.updateSubscription.handler(async ({ input }) => {
-      const { id, updates } = input;
-
-      // Check subscription exists
-      const [existing] = await db
-        .select()
-        .from(schema.webhookSubscriptions)
-        .where(eq(schema.webhookSubscriptions.id, id));
-
-      if (!existing) {
-        throw new ORPCError("NOT_FOUND", {
-          message: "Subscription not found",
-        });
-      }
-
-      // Validate event if updated
-      if (updates.eventId && !eventRegistry.hasEvent(updates.eventId)) {
-        throw new ORPCError("BAD_REQUEST", {
-          message: `Event type not found: ${updates.eventId}`,
-        });
-      }
-
-      // Validate providerConfig if updated
-      if (updates.providerConfig) {
-        const provider = providerRegistry.getProvider(existing.providerId);
-        if (provider) {
-          const configParseResult = provider.config.schema.safeParse(
-            updates.providerConfig
-          );
-          if (!configParseResult.success) {
-            throw new ORPCError("BAD_REQUEST", {
-              message: `Invalid provider configuration: ${configParseResult.error.message}`,
-            });
-          }
-        }
-      }
-
-      const now = new Date();
-
-      await db
-        .update(schema.webhookSubscriptions)
-        .set({
-          ...updates,
-          updatedAt: now,
-        })
-        .where(eq(schema.webhookSubscriptions.id, id));
-
-      // Emit signal
-      await signalService.broadcast(INTEGRATION_SUBSCRIPTION_CHANGED, {
-        action: "updated",
-        subscriptionId: id,
-      });
-
-      // Re-fetch updated subscription
-      const [updated] = await db
-        .select()
-        .from(schema.webhookSubscriptions)
-        .where(eq(schema.webhookSubscriptions.id, id));
-
-      return {
-        ...updated,
-        description: updated.description ?? undefined,
-        systemFilter: updated.systemFilter ?? undefined,
-        createdAt: updated.createdAt,
-        updatedAt: updated.updatedAt,
-      };
-    }),
-
-    deleteSubscription: os.deleteSubscription.handler(async ({ input }) => {
-      const { id } = input;
-
-      await db
-        .delete(schema.webhookSubscriptions)
-        .where(eq(schema.webhookSubscriptions.id, id));
-
-      // Emit signal
-      await signalService.broadcast(INTEGRATION_SUBSCRIPTION_CHANGED, {
-        action: "deleted",
-        subscriptionId: id,
-      });
-
-      logger.info(`Deleted webhook subscription: ${id}`);
-
-      return { success: true };
-    }),
-
-    toggleSubscription: os.toggleSubscription.handler(async ({ input }) => {
-      const { id, enabled } = input;
-
-      await db
-        .update(schema.webhookSubscriptions)
-        .set({
-          enabled,
-          updatedAt: new Date(),
-        })
-        .where(eq(schema.webhookSubscriptions.id, id));
-
-      // Emit signal
-      await signalService.broadcast(INTEGRATION_SUBSCRIPTION_CHANGED, {
-        action: "updated",
-        subscriptionId: id,
-      });
-
-      return { success: true };
-    }),
-
-    // =========================================================================
-    // PROVIDER DISCOVERY
-    // =========================================================================
+    // ─── Providers ───────────────────────────────────────────────────────
 
     listProviders: os.listProviders.handler(async () => {
       const providers = providerRegistry.getProviders();
-
       return providers.map((p) => ({
         qualifiedId: p.qualifiedId,
         displayName: p.displayName,
         description: p.description,
         icon: p.icon,
         ownerPluginId: p.ownerPluginId,
-        supportedEvents: p.supportedEvents,
-        configSchema:
-          providerRegistry.getProviderConfigSchema(p.qualifiedId) ?? {},
+        // Legacy `supportedEvents` is no longer modelled on providers
+        // (the trigger registry owns event metadata now). Return empty
+        // so the wire schema stays stable.
+        supportedEvents: [],
+        // Legacy `configSchema` was the per-subscription config; that
+        // lives on action definitions now. Returning an empty object
+        // preserves the wire shape until the schema is bumped.
+        configSchema: {},
         hasConnectionSchema: !!p.connectionSchema,
         connectionSchema: p.connectionSchema
           ? providerRegistry.getProviderConnectionSchema(p.qualifiedId)
@@ -432,23 +81,27 @@ export function createIntegrationRouter(deps: RouterDeps) {
           const result = await provider.testConnection(config);
           return result;
         } catch (error) {
+          // Mask any credential the submitted config carries out of the
+          // provider error before returning (same guard as the saved-
+          // connection testConnection path below).
+          const values: string[] = [];
+          collectStringLeaves(config, values);
           return {
             success: false,
-            message: extractErrorMessage(error),
+            message: maskSecrets({
+              text: extractErrorMessage(error),
+              values,
+            }),
           };
         }
-      }
+      },
     ),
 
-    // =========================================================================
-    // CONNECTION MANAGEMENT
-    // Generic CRUD for site-wide provider connections
-    // =========================================================================
+    // ─── Connections ─────────────────────────────────────────────────────
 
     listConnections: os.listConnections.handler(async ({ input }) => {
       const { providerId } = input;
 
-      // Verify provider exists and has connectionSchema
       const provider = providerRegistry.getProvider(providerId);
       if (!provider) {
         throw new ORPCError("NOT_FOUND", {
@@ -481,7 +134,6 @@ export function createIntegrationRouter(deps: RouterDeps) {
     createConnection: os.createConnection.handler(async ({ input }) => {
       const { providerId, name, config } = input;
 
-      // Verify provider exists and has connectionSchema
       const provider = providerRegistry.getProvider(providerId);
       if (!provider) {
         throw new ORPCError("NOT_FOUND", {
@@ -495,7 +147,6 @@ export function createIntegrationRouter(deps: RouterDeps) {
         });
       }
 
-      // Validate config against provider's connectionSchema
       const parseResult = provider.connectionSchema.schema.safeParse(config);
       if (!parseResult.success) {
         throw new ORPCError("BAD_REQUEST", {
@@ -503,7 +154,6 @@ export function createIntegrationRouter(deps: RouterDeps) {
         });
       }
 
-      // parseResult.data is typed correctly after guard
       const validatedConfig = parseResult.data as unknown as Record<
         string,
         unknown
@@ -517,12 +167,15 @@ export function createIntegrationRouter(deps: RouterDeps) {
 
       logger.info(`Created connection "${name}" for provider ${providerId}`);
 
-      // Return redacted version
+      // Return the REDACTED preview (secret fields stripped) rather than
+      // echoing the raw submitted config back — credentials must never
+      // cross back to the browser, even on create.
+      const redacted = await connectionStore.getConnection(connection.id);
       return {
         id: connection.id,
         providerId: connection.providerId,
         name: connection.name,
-        configPreview: config, // Will be redacted in real usage
+        configPreview: redacted?.configPreview ?? {},
         createdAt: connection.createdAt,
         updatedAt: connection.updatedAt,
       };
@@ -537,18 +190,20 @@ export function createIntegrationRouter(deps: RouterDeps) {
           updates,
         });
 
+        // Return the REDACTED preview rather than echoing the submitted
+        // config — credentials must never cross back to the browser.
+        const redacted = await connectionStore.getConnection(connection.id);
         return {
           id: connection.id,
           providerId: connection.providerId,
           name: connection.name,
-          configPreview: (updates.config ?? {}) as Record<string, unknown>,
+          configPreview: redacted?.configPreview ?? {},
           createdAt: connection.createdAt,
           updatedAt: connection.updatedAt,
         };
       } catch (error) {
         throw new ORPCError("NOT_FOUND", {
-          message:
-            extractErrorMessage(error, "Connection not found"),
+          message: extractErrorMessage(error, "Connection not found"),
         });
       }
     }),
@@ -570,7 +225,7 @@ export function createIntegrationRouter(deps: RouterDeps) {
       const { connectionId } = input;
 
       const connection = await connectionStore.getConnectionWithCredentials(
-        connectionId
+        connectionId,
       );
       if (!connection) {
         return { success: false, message: "Connection not found" };
@@ -592,18 +247,44 @@ export function createIntegrationRouter(deps: RouterDeps) {
         const result = await provider.testConnection(connection.config);
         return result;
       } catch (error) {
+        // The resolved connection config carries live credentials. A
+        // provider error may echo a token (e.g. "401 with Bearer <token>").
+        // There is no run-scoped secret registry on this path, so build a
+        // per-call mask set from the resolved config's string leaves and
+        // run the error through it before returning to the browser.
+        const values: string[] = [];
+        collectStringLeaves(connection.config, values);
         return {
           success: false,
-          message: extractErrorMessage(error),
+          message: maskSecrets({
+            text: extractErrorMessage(error),
+            values,
+          }),
         };
       }
     }),
 
+    // ─── One-time migration support ──────────────────────────────────────
+
+    listLegacySubscriptions: os.listLegacySubscriptions.handler(async () => {
+      const rows = await db.select().from(schema.webhookSubscriptions);
+      return rows.map((row) => ({
+        id: row.id,
+        name: row.name,
+        description: row.description ?? undefined,
+        providerId: row.providerId,
+        providerConfig: row.providerConfig,
+        eventId: row.eventId,
+        systemFilter: row.systemFilter ?? undefined,
+        enabled: row.enabled,
+      }));
+    }),
+
     getConnectionOptions: os.getConnectionOptions.handler(async ({ input }) => {
       const { providerId, connectionId, resolverName, context } = input;
 
       logger.debug(
-        `getConnectionOptions called: providerId=${providerId}, connectionId=${connectionId}, resolverName=${resolverName}`
+        `getConnectionOptions called: providerId=${providerId}, connectionId=${connectionId}, resolverName=${resolverName}`,
       );
 
       const provider = providerRegistry.getProvider(providerId);
@@ -629,235 +310,33 @@ export function createIntegrationRouter(deps: RouterDeps) {
             connectionStore.getConnectionWithCredentials.bind(connectionStore),
         });
         logger.debug(
-          `getConnectionOptions returned ${options.length} options for ${resolverName}`
+          `getConnectionOptions returned ${options.length} options for ${resolverName}`,
         );
         return options;
       } catch (error) {
         logger.error(`Failed to get connection options: ${error}`);
         throw new ORPCError("INTERNAL_SERVER_ERROR", {
-          message:
-            extractErrorMessage(error, "Failed to fetch options"),
-        });
-      }
-    }),
-
-    // =========================================================================
-    // EVENT DISCOVERY
-    // =========================================================================
-
-    listEventTypes: os.listEventTypes.handler(async () => {
-      const events = eventRegistry.getEvents();
-
-      return events.map((e) => ({
-        eventId: e.eventId,
-        displayName: e.displayName,
-        description: e.description,
-        category: e.category,
-        ownerPluginId: e.ownerPluginId,
-        payloadSchema: e.payloadJsonSchema,
-      }));
-    }),
-
-    getEventsByCategory: os.getEventsByCategory.handler(async () => {
-      const byCategory = eventRegistry.getEventsByCategory();
-
-      return [...byCategory.entries()].map(([category, events]) => ({
-        category,
-        events: events.map((e) => ({
-          eventId: e.eventId,
-          displayName: e.displayName,
-          description: e.description,
-          category: e.category,
-          ownerPluginId: e.ownerPluginId,
-          payloadSchema: e.payloadJsonSchema,
-        })),
-      }));
-    }),
-
-    getEventPayloadSchema: os.getEventPayloadSchema.handler(
-      async ({ input }) => {
-        const { eventId } = input;
-
-        const event = eventRegistry.getEvent(eventId);
-        if (!event) {
-          throw new ORPCError("NOT_FOUND", {
-            message: `Event not found: ${eventId}`,
-          });
-        }
-
-        // Extract flattened properties from JSON Schema
-        const availableProperties = extractJsonSchemaProperties(
-          event.payloadJsonSchema,
-          "payload"
-        );
-
-        return {
-          eventId: event.eventId,
-          payloadSchema: event.payloadJsonSchema,
-          availableProperties,
-        };
-      }
-    ),
-
-    // =========================================================================
-    // DELIVERY LOGS
-    // =========================================================================
-
-    getDeliveryLogs: os.getDeliveryLogs.handler(async ({ input }) => {
-      const { subscriptionId, eventType, status, limit, offset } = input;
-
-      // Build where conditions
-      const conditions = [];
-      if (subscriptionId) {
-        conditions.push(eq(schema.deliveryLogs.subscriptionId, subscriptionId));
-      }
-      if (eventType) {
-        conditions.push(eq(schema.deliveryLogs.eventType, eventType));
-      }
-      if (status) {
-        conditions.push(eq(schema.deliveryLogs.status, status));
-      }
-
-      const whereClause =
-        conditions.length > 0 ? and(...conditions) : undefined;
-
-      // Get total count
-      const [{ value: total }] = await db
-        .select({ value: count() })
-        .from(schema.deliveryLogs)
-        .where(whereClause);
-
-      // Get paginated results with subscription name
-      const logs = await db
-        .select({
-          log: schema.deliveryLogs,
-          subscriptionName: schema.webhookSubscriptions.name,
-        })
-        .from(schema.deliveryLogs)
-        .leftJoin(
-          schema.webhookSubscriptions,
-          eq(schema.deliveryLogs.subscriptionId, schema.webhookSubscriptions.id)
-        )
-        .where(whereClause)
-        .orderBy(desc(schema.deliveryLogs.createdAt))
-        .limit(limit)
-        .offset(offset);
-
-      return {
-        items: logs.map(({ log, subscriptionName }) => ({
-          ...log,
-          subscriptionName: subscriptionName ?? undefined,
-          createdAt: log.createdAt,
-          lastAttemptAt: log.lastAttemptAt ?? undefined,
-          nextRetryAt: log.nextRetryAt ?? undefined,
-          externalId: log.externalId ?? undefined,
-          errorMessage: log.errorMessage ?? undefined,
-        })),
-        total: Number(total),
-        limit,
-        offset,
-      };
-    }),
-
-    getDeliveryLog: os.getDeliveryLog.handler(async ({ input }) => {
-      const [result] = await db
-        .select({
-          log: schema.deliveryLogs,
-          subscriptionName: schema.webhookSubscriptions.name,
-        })
-        .from(schema.deliveryLogs)
-        .leftJoin(
-          schema.webhookSubscriptions,
-          eq(schema.deliveryLogs.subscriptionId, schema.webhookSubscriptions.id)
-        )
-        .where(eq(schema.deliveryLogs.id, input.id));
-
-      if (!result) {
-        throw new ORPCError("NOT_FOUND", {
-          message: "Delivery log not found",
+          message: extractErrorMessage(error, "Failed to fetch options"),
         });
       }
-
-      return {
-        ...result.log,
-        subscriptionName: result.subscriptionName ?? undefined,
-        createdAt: result.log.createdAt,
-        lastAttemptAt: result.log.lastAttemptAt ?? undefined,
-        nextRetryAt: result.log.nextRetryAt ?? undefined,
-        externalId: result.log.externalId ?? undefined,
-        errorMessage: result.log.errorMessage ?? undefined,
-      };
-    }),
-
-    retryDelivery: os.retryDelivery.handler(async ({ input }) => {
-      return deliveryCoordinator.retryDelivery(input.logId);
-    }),
-
-    getDeliveryStats: os.getDeliveryStats.handler(async ({ input }) => {
-      const { hours } = input;
-      const since = new Date(Date.now() - hours * 60 * 60 * 1000);
-
-      // Get counts by status
-      const statusCounts = await db
-        .select({
-          status: schema.deliveryLogs.status,
-          count: count(),
-        })
-        .from(schema.deliveryLogs)
-        .where(gte(schema.deliveryLogs.createdAt, since))
-        .groupBy(schema.deliveryLogs.status);
-
-      // Get counts by event type
-      const eventCounts = await db
-        .select({
-          eventType: schema.deliveryLogs.eventType,
-          count: count(),
-        })
-        .from(schema.deliveryLogs)
-        .where(gte(schema.deliveryLogs.createdAt, since))
-        .groupBy(schema.deliveryLogs.eventType);
-
-      // Get counts by provider (via subscription)
-      const providerCounts = await db
-        .select({
-          providerId: schema.webhookSubscriptions.providerId,
-          count: count(),
-        })
-        .from(schema.deliveryLogs)
-        .innerJoin(
-          schema.webhookSubscriptions,
-          eq(schema.deliveryLogs.subscriptionId, schema.webhookSubscriptions.id)
-        )
-        .where(gte(schema.deliveryLogs.createdAt, since))
-        .groupBy(schema.webhookSubscriptions.providerId);
-
-      // Build response
-      const statusMap = new Map(
-        statusCounts.map((s) => [s.status, Number(s.count)])
-      );
-      const total =
-        (statusMap.get("success") ?? 0) +
-        (statusMap.get("failed") ?? 0) +
-        (statusMap.get("retrying") ?? 0) +
-        (statusMap.get("pending") ?? 0);
-
-      return {
-        total,
-        successful: statusMap.get("success") ?? 0,
-        failed: statusMap.get("failed") ?? 0,
-        retrying: statusMap.get("retrying") ?? 0,
-        pending: statusMap.get("pending") ?? 0,
-        byEvent: eventCounts.map((e) => ({
-          eventType: e.eventType,
-          count: Number(e.count),
-        })),
-        byProvider: providerCounts.map((p) => ({
-          providerId: p.providerId,
-          count: Number(p.count),
-        })),
-      };
     }),
   });
 }
 
 export type IntegrationRouter = ReturnType<typeof createIntegrationRouter>;
+
+/**
+ * Collect every string leaf in a JSON-like value into `out`. Used to build
+ * a per-call secret mask set from a resolved/submitted connection config so
+ * a provider error echoing a credential can be redacted before it crosses
+ * back to the browser. Mirrors the dispatch engine's run-secret capture.
+ */
+function collectStringLeaves(value: unknown, out: string[]): void {
+  if (typeof value === "string") {
+    out.push(value);
+  } else if (Array.isArray(value)) {
+    for (const v of value) collectStringLeaves(v, out);
+  } else if (value !== null && typeof value === "object") {
+    for (const v of Object.values(value)) collectStringLeaves(v, out);
+  }
+}