@codeam/shared 2.61.61 → 2.61.63

package/dist/index.d.mts

@@ -351,7 +351,7 @@ declare function isHeadroomWrappable(agentId: string): boolean;
  * ubiquitous CLI for the tool → `cliEnv`; otherwise → `mcp`. A tool may
  * declare both.
  */
-type IntegrationId = 'jira' | 'sentry' | 'linear' | 'slack' | 'notion' | 'azure_devops' | 'figma' | 'microsoft_teams' | 'google_chat' | 'discord' | 'resend' | 'posthog' | 'datadog' | 'stitch' | 'github_issues' | 'github' | 'gitlab' | 'vercel' | 'trello' | 'clickup' | 'n8n';
+type IntegrationId = 'jira' | 'sentry' | 'linear' | 'slack' | 'notion' | 'azure_devops' | 'figma' | 'microsoft_teams' | 'google_chat' | 'discord' | 'resend' | 'posthog' | 'datadog' | 'stitch' | 'github_issues' | 'github' | 'gitlab' | 'vercel' | 'trello' | 'clickup' | 'n8n' | 'postman' | 'mixpanel' | 'supabase';
 /**
  * `derived` = no link flow of its own: the credential is BORROWED live from a
  * connection the user already made elsewhere (see `derivedFrom`). The backend
@@ -380,7 +380,7 @@ type DerivedCredentialSource = 'github';
 /** Grouping used by category-driven surfaces (Start-from-Work-Item picker,
  *  catalog sections). A future tracker integration joins those features with
  *  ZERO feature code — they resolve sources from the registry by category. */
-type IntegrationCategory = 'version_control' | 'tracker' | 'design' | 'comms' | 'docs' | 'observability' | 'deployment' | 'automation';
+type IntegrationCategory = 'version_control' | 'tracker' | 'design' | 'comms' | 'docs' | 'observability' | 'deployment' | 'automation' | 'analytics' | 'api_tools' | 'database';
 /**
  * One user-entered field for an `api_key` integration (no browser OAuth — the
  * user pastes credentials directly, e.g. a PAT + an org URL). The mobile form
@@ -390,7 +390,7 @@ type IntegrationCategory = 'version_control' | 'tracker' | 'design' | 'comms' |
 interface IntegrationApiKeyField {
     /** Maps to a BrokeredIntegrationToken field (`accessToken`, `orgUrl`,
      *  `appKey`, `host`, …). */
-    key: 'accessToken' | 'orgUrl' | 'appKey' | 'host' | 'apiKey' | 'instanceUrl';
+    key: 'accessToken' | 'orgUrl' | 'appKey' | 'host' | 'apiKey' | 'instanceUrl' | 'secretKey' | 'projectId';
     /** Form label. */
     label: string;
     /** Example / placeholder. */
@@ -516,6 +516,11 @@ interface BrokeredIntegrationToken {
     /** n8n instance base URL (self-hosted or n8n.cloud) — the MCP server needs it
      *  alongside the API key (N8N_API_URL + N8N_API_KEY). Absent for non-n8n. */
     instanceUrl?: string;
+    /** Secret half of a 2-part api_key credential (Amplitude secret, Mixpanel
+     *  service-account password, etc.). Absent for single-key integrations. */
+    secretKey?: string;
+    /** Project/workspace id some analytics APIs require (Mixpanel project id). */
+    projectId?: string;
 }
 
 /**
@@ -563,7 +568,7 @@ interface IntegrationBranding {
     logoSvg: string;
 }
 declare const INTEGRATION_BRANDING: Record<string, IntegrationBranding>;
-declare const UPCOMING_INTEGRATION_IDS: readonly ["gmail", "figma", "supabase", "asana", "postman", "stripe", "mixpanel", "pendo", "pagerduty", "amplitude"];
+declare const UPCOMING_INTEGRATION_IDS: readonly ["gmail", "figma", "asana", "stripe", "pendo", "pagerduty", "amplitude"];
 declare function getIntegrationBranding(id: string): IntegrationBranding | null;
 
 /**

package/dist/index.d.ts

@@ -351,7 +351,7 @@ declare function isHeadroomWrappable(agentId: string): boolean;
  * ubiquitous CLI for the tool → `cliEnv`; otherwise → `mcp`. A tool may
  * declare both.
  */
-type IntegrationId = 'jira' | 'sentry' | 'linear' | 'slack' | 'notion' | 'azure_devops' | 'figma' | 'microsoft_teams' | 'google_chat' | 'discord' | 'resend' | 'posthog' | 'datadog' | 'stitch' | 'github_issues' | 'github' | 'gitlab' | 'vercel' | 'trello' | 'clickup' | 'n8n';
+type IntegrationId = 'jira' | 'sentry' | 'linear' | 'slack' | 'notion' | 'azure_devops' | 'figma' | 'microsoft_teams' | 'google_chat' | 'discord' | 'resend' | 'posthog' | 'datadog' | 'stitch' | 'github_issues' | 'github' | 'gitlab' | 'vercel' | 'trello' | 'clickup' | 'n8n' | 'postman' | 'mixpanel' | 'supabase';
 /**
  * `derived` = no link flow of its own: the credential is BORROWED live from a
  * connection the user already made elsewhere (see `derivedFrom`). The backend
@@ -380,7 +380,7 @@ type DerivedCredentialSource = 'github';
 /** Grouping used by category-driven surfaces (Start-from-Work-Item picker,
  *  catalog sections). A future tracker integration joins those features with
  *  ZERO feature code — they resolve sources from the registry by category. */
-type IntegrationCategory = 'version_control' | 'tracker' | 'design' | 'comms' | 'docs' | 'observability' | 'deployment' | 'automation';
+type IntegrationCategory = 'version_control' | 'tracker' | 'design' | 'comms' | 'docs' | 'observability' | 'deployment' | 'automation' | 'analytics' | 'api_tools' | 'database';
 /**
  * One user-entered field for an `api_key` integration (no browser OAuth — the
  * user pastes credentials directly, e.g. a PAT + an org URL). The mobile form
@@ -390,7 +390,7 @@ type IntegrationCategory = 'version_control' | 'tracker' | 'design' | 'comms' |
 interface IntegrationApiKeyField {
     /** Maps to a BrokeredIntegrationToken field (`accessToken`, `orgUrl`,
      *  `appKey`, `host`, …). */
-    key: 'accessToken' | 'orgUrl' | 'appKey' | 'host' | 'apiKey' | 'instanceUrl';
+    key: 'accessToken' | 'orgUrl' | 'appKey' | 'host' | 'apiKey' | 'instanceUrl' | 'secretKey' | 'projectId';
     /** Form label. */
     label: string;
     /** Example / placeholder. */
@@ -516,6 +516,11 @@ interface BrokeredIntegrationToken {
     /** n8n instance base URL (self-hosted or n8n.cloud) — the MCP server needs it
      *  alongside the API key (N8N_API_URL + N8N_API_KEY). Absent for non-n8n. */
     instanceUrl?: string;
+    /** Secret half of a 2-part api_key credential (Amplitude secret, Mixpanel
+     *  service-account password, etc.). Absent for single-key integrations. */
+    secretKey?: string;
+    /** Project/workspace id some analytics APIs require (Mixpanel project id). */
+    projectId?: string;
 }
 
 /**
@@ -563,7 +568,7 @@ interface IntegrationBranding {
     logoSvg: string;
 }
 declare const INTEGRATION_BRANDING: Record<string, IntegrationBranding>;
-declare const UPCOMING_INTEGRATION_IDS: readonly ["gmail", "figma", "supabase", "asana", "postman", "stripe", "mixpanel", "pendo", "pagerduty", "amplitude"];
+declare const UPCOMING_INTEGRATION_IDS: readonly ["gmail", "figma", "asana", "stripe", "pendo", "pagerduty", "amplitude"];
 declare function getIntegrationBranding(id: string): IntegrationBranding | null;
 
 /**

package/dist/index.js

@@ -1340,6 +1340,121 @@ var INTEGRATION_REGISTRY = {
         staticEnv: { MCP_MODE: "stdio" }
       }
     }
+  },
+  postman: {
+    id: "postman",
+    name: "Postman",
+    icon: "postman",
+    category: "api_tools",
+    // LIVE — api_key rail. Postman auth is a personal API key (Settings → API
+    // keys). The user pastes it; the backend validates via GET /me + vaults it.
+    // No OAuth (Postman's API has no user OAuth), no secrets, no config-503.
+    enabled: true,
+    auth: {
+      kind: "api_key",
+      fields: [
+        {
+          key: "accessToken",
+          label: "API Key",
+          placeholder: "PMAK-\u2026",
+          secret: true,
+          help: "Postman \u2192 Settings \u2192 API keys \u2192 Generate API Key."
+        }
+      ]
+    },
+    delivery: {
+      mcp: {
+        // Postman's OFFICIAL stdio MCP server (Node). BYO key via POSTMAN_API_KEY
+        // (env only). Version PINNED; bump only after re-verifying headless.
+        command: "npx",
+        args: ["-y", "@postman/postman-mcp-server@2.11.2"],
+        envMapping: {
+          POSTMAN_API_KEY: "accessToken"
+        }
+      }
+    }
+  },
+  mixpanel: {
+    id: "mixpanel",
+    name: "Mixpanel",
+    icon: "mixpanel",
+    category: "analytics",
+    // LIVE — api_key rail. Mixpanel query/export auth is a SERVICE ACCOUNT
+    // (username + password, Basic auth) scoped to a project (project id). The
+    // user pastes all three; the backend validates + vaults them. No OAuth
+    // redirect (service accounts are machine-to-machine), no GSM secrets.
+    enabled: true,
+    auth: {
+      kind: "api_key",
+      fields: [
+        {
+          key: "accessToken",
+          label: "Service Account Username",
+          placeholder: "your-sa.mp-service-account",
+          secret: false,
+          help: "Mixpanel \u2192 Organization Settings \u2192 Service Accounts \u2192 create one with project access."
+        },
+        {
+          key: "secretKey",
+          label: "Service Account Secret",
+          placeholder: "the service account secret",
+          secret: true,
+          help: "Shown once when you create the service account \u2014 copy it then."
+        },
+        {
+          key: "projectId",
+          label: "Project ID",
+          placeholder: "1234567",
+          secret: false,
+          help: "Mixpanel \u2192 Project Settings \u2192 Project ID."
+        }
+      ]
+    },
+    delivery: {
+      mcp: {
+        // @mendeel/mcp-mixpanel (Node): the service account + project id via env
+        // only (MIXPANEL_SERVICE_ACCOUNT_USERNAME/PASSWORD + MIXPANEL_PROJECT_ID).
+        // Version PINNED; bump only after re-verifying headless. Default region US.
+        command: "npx",
+        args: ["-y", "@mendeel/mcp-mixpanel@1.0.4"],
+        envMapping: {
+          MIXPANEL_SERVICE_ACCOUNT_USERNAME: "accessToken",
+          MIXPANEL_SERVICE_ACCOUNT_PASSWORD: "secretKey",
+          MIXPANEL_PROJECT_ID: "projectId"
+        }
+      }
+    }
+  },
+  supabase: {
+    id: "supabase",
+    name: "Supabase",
+    icon: "supabase",
+    category: "database",
+    // LIVE — OAuth 2.0 (authorization code, Confidential). authorize
+    // api.supabase.com/v1/oauth/authorize; token /v1/oauth/token
+    // (form-urlencoded, client creds via HTTP Basic); rotating refresh tokens.
+    // The OAuth app (Organization → OAuth Apps) is registered and
+    // SUPABASE_OAUTH_CLIENT_ID/SECRET/REDIRECT_URI are in Secret Manager
+    // (prod+dev); the config-gated 503 keeps this safe mid-rollout.
+    enabled: true,
+    auth: {
+      kind: "oauth_redirect",
+      // ⚠️ Supabase scopes are configured ON THE OAUTH APP, NOT sent in the
+      // authorize URL — this list is informational (what the app was granted).
+      scopes: ["all"]
+    },
+    delivery: {
+      mcp: {
+        // Supabase's OFFICIAL MCP server (Node). The OAuth access token IS a
+        // Management API token → fed via SUPABASE_ACCESS_TOKEN (env only, never
+        // argv). Version PINNED; bump only after re-verifying headless.
+        command: "npx",
+        args: ["-y", "@supabase/mcp-server-supabase@0.9.0"],
+        envMapping: {
+          SUPABASE_ACCESS_TOKEN: "accessToken"
+        }
+      }
+    }
   }
 };
 function getEnabledIntegrations() {
@@ -1632,11 +1747,8 @@ var INTEGRATION_BRANDING = {
 var UPCOMING_INTEGRATION_IDS = [
   "gmail",
   "figma",
-  "supabase",
   "asana",
-  "postman",
   "stripe",
-  "mixpanel",
   "pendo",
   "pagerduty",
   "amplitude"