@codeam/shared 2.61.62 → 2.61.64

package/dist/index.d.mts

@@ -351,7 +351,7 @@ declare function isHeadroomWrappable(agentId: string): boolean;
  * ubiquitous CLI for the tool → `cliEnv`; otherwise → `mcp`. A tool may
  * declare both.
  */
-type IntegrationId = 'jira' | 'sentry' | 'linear' | 'slack' | 'notion' | 'azure_devops' | 'figma' | 'microsoft_teams' | 'google_chat' | 'discord' | 'resend' | 'posthog' | 'datadog' | 'stitch' | 'github_issues' | 'github' | 'gitlab' | 'vercel' | 'trello' | 'clickup' | 'n8n' | 'postman' | 'mixpanel';
+type IntegrationId = 'jira' | 'sentry' | 'linear' | 'slack' | 'notion' | 'azure_devops' | 'figma' | 'microsoft_teams' | 'google_chat' | 'discord' | 'resend' | 'posthog' | 'datadog' | 'stitch' | 'github_issues' | 'github' | 'gitlab' | 'vercel' | 'trello' | 'clickup' | 'n8n' | 'postman' | 'mixpanel' | 'supabase' | 'confluence';
 /**
  * `derived` = no link flow of its own: the credential is BORROWED live from a
  * connection the user already made elsewhere (see `derivedFrom`). The backend
@@ -380,7 +380,7 @@ type DerivedCredentialSource = 'github';
 /** Grouping used by category-driven surfaces (Start-from-Work-Item picker,
  *  catalog sections). A future tracker integration joins those features with
  *  ZERO feature code — they resolve sources from the registry by category. */
-type IntegrationCategory = 'version_control' | 'tracker' | 'design' | 'comms' | 'docs' | 'observability' | 'deployment' | 'automation' | 'analytics' | 'api_tools';
+type IntegrationCategory = 'version_control' | 'tracker' | 'design' | 'comms' | 'docs' | 'observability' | 'deployment' | 'automation' | 'analytics' | 'api_tools' | 'database';
 /**
  * One user-entered field for an `api_key` integration (no browser OAuth — the
  * user pastes credentials directly, e.g. a PAT + an org URL). The mobile form
@@ -462,6 +462,13 @@ interface IntegrationDefinition {
          *  (performed by the module that owns the connection, not by the generic
          *  integrations OAuth path). */
         connection?: DerivedCredentialSource;
+        /** For `kind: 'derived'` — the OTHER integration whose vaulted credential
+         *  this one reuses (Confluence → `jira`, since one Atlassian OAuth + the one
+         *  `mcp-atlassian` server serves both). Like `derivedFrom` but the source is
+         *  a vault-backed integration, not a `ProviderToken` connection: the backend
+         *  resolves the credential by delegating to the source integration, and the
+         *  client renders it as "part of <source>" with no Connect action of its own. */
+        aliasOf?: IntegrationId;
     };
     delivery: IntegrationDelivery;
 }
@@ -568,7 +575,7 @@ interface IntegrationBranding {
     logoSvg: string;
 }
 declare const INTEGRATION_BRANDING: Record<string, IntegrationBranding>;
-declare const UPCOMING_INTEGRATION_IDS: readonly ["gmail", "figma", "supabase", "asana", "stripe", "pendo", "pagerduty", "amplitude"];
+declare const UPCOMING_INTEGRATION_IDS: readonly ["gmail", "figma", "asana", "stripe", "pendo", "pagerduty", "amplitude"];
 declare function getIntegrationBranding(id: string): IntegrationBranding | null;
 
 /**

package/dist/index.d.ts

@@ -351,7 +351,7 @@ declare function isHeadroomWrappable(agentId: string): boolean;
  * ubiquitous CLI for the tool → `cliEnv`; otherwise → `mcp`. A tool may
  * declare both.
  */
-type IntegrationId = 'jira' | 'sentry' | 'linear' | 'slack' | 'notion' | 'azure_devops' | 'figma' | 'microsoft_teams' | 'google_chat' | 'discord' | 'resend' | 'posthog' | 'datadog' | 'stitch' | 'github_issues' | 'github' | 'gitlab' | 'vercel' | 'trello' | 'clickup' | 'n8n' | 'postman' | 'mixpanel';
+type IntegrationId = 'jira' | 'sentry' | 'linear' | 'slack' | 'notion' | 'azure_devops' | 'figma' | 'microsoft_teams' | 'google_chat' | 'discord' | 'resend' | 'posthog' | 'datadog' | 'stitch' | 'github_issues' | 'github' | 'gitlab' | 'vercel' | 'trello' | 'clickup' | 'n8n' | 'postman' | 'mixpanel' | 'supabase' | 'confluence';
 /**
  * `derived` = no link flow of its own: the credential is BORROWED live from a
  * connection the user already made elsewhere (see `derivedFrom`). The backend
@@ -380,7 +380,7 @@ type DerivedCredentialSource = 'github';
 /** Grouping used by category-driven surfaces (Start-from-Work-Item picker,
  *  catalog sections). A future tracker integration joins those features with
  *  ZERO feature code — they resolve sources from the registry by category. */
-type IntegrationCategory = 'version_control' | 'tracker' | 'design' | 'comms' | 'docs' | 'observability' | 'deployment' | 'automation' | 'analytics' | 'api_tools';
+type IntegrationCategory = 'version_control' | 'tracker' | 'design' | 'comms' | 'docs' | 'observability' | 'deployment' | 'automation' | 'analytics' | 'api_tools' | 'database';
 /**
  * One user-entered field for an `api_key` integration (no browser OAuth — the
  * user pastes credentials directly, e.g. a PAT + an org URL). The mobile form
@@ -462,6 +462,13 @@ interface IntegrationDefinition {
          *  (performed by the module that owns the connection, not by the generic
          *  integrations OAuth path). */
         connection?: DerivedCredentialSource;
+        /** For `kind: 'derived'` — the OTHER integration whose vaulted credential
+         *  this one reuses (Confluence → `jira`, since one Atlassian OAuth + the one
+         *  `mcp-atlassian` server serves both). Like `derivedFrom` but the source is
+         *  a vault-backed integration, not a `ProviderToken` connection: the backend
+         *  resolves the credential by delegating to the source integration, and the
+         *  client renders it as "part of <source>" with no Connect action of its own. */
+        aliasOf?: IntegrationId;
     };
     delivery: IntegrationDelivery;
 }
@@ -568,7 +575,7 @@ interface IntegrationBranding {
     logoSvg: string;
 }
 declare const INTEGRATION_BRANDING: Record<string, IntegrationBranding>;
-declare const UPCOMING_INTEGRATION_IDS: readonly ["gmail", "figma", "supabase", "asana", "stripe", "pendo", "pagerduty", "amplitude"];
+declare const UPCOMING_INTEGRATION_IDS: readonly ["gmail", "figma", "asana", "stripe", "pendo", "pagerduty", "amplitude"];
 declare function getIntegrationBranding(id: string): IntegrationBranding | null;
 
 /**

package/dist/index.js

@@ -1424,6 +1424,65 @@ var INTEGRATION_REGISTRY = {
         }
       }
     }
+  },
+  supabase: {
+    id: "supabase",
+    name: "Supabase",
+    icon: "supabase",
+    category: "database",
+    // LIVE — OAuth 2.0 (authorization code, Confidential). authorize
+    // api.supabase.com/v1/oauth/authorize; token /v1/oauth/token
+    // (form-urlencoded, client creds via HTTP Basic); rotating refresh tokens.
+    // The OAuth app (Organization → OAuth Apps) is registered and
+    // SUPABASE_OAUTH_CLIENT_ID/SECRET/REDIRECT_URI are in Secret Manager
+    // (prod+dev); the config-gated 503 keeps this safe mid-rollout.
+    enabled: true,
+    auth: {
+      kind: "oauth_redirect",
+      // ⚠️ Supabase scopes are configured ON THE OAUTH APP, NOT sent in the
+      // authorize URL — this list is informational (what the app was granted).
+      scopes: ["all"]
+    },
+    delivery: {
+      mcp: {
+        // Supabase's OFFICIAL MCP server (Node). The OAuth access token IS a
+        // Management API token → fed via SUPABASE_ACCESS_TOKEN (env only, never
+        // argv). Version PINNED; bump only after re-verifying headless.
+        command: "npx",
+        args: ["-y", "@supabase/mcp-server-supabase@0.9.0"],
+        envMapping: {
+          SUPABASE_ACCESS_TOKEN: "accessToken"
+        }
+      }
+    }
+  },
+  confluence: {
+    id: "confluence",
+    name: "Confluence",
+    icon: "confluence",
+    category: "docs",
+    // Confluence is served by the SAME Atlassian OAuth + the SAME `mcp-atlassian`
+    // server as Jira (the `jira` entry already requests Confluence scopes). This
+    // entry is a DISPLAY ALIAS so Confluence is explicit in the Knowledge tab: it
+    // BORROWS jira's vaulted credential (`aliasOf: 'jira'`) and has no link flow of
+    // its own — connecting Atlassian (the Jira/Atlassian card) lights it up, and
+    // the backend resolves its token by delegating to `jira`.
+    enabled: true,
+    auth: { kind: "derived", aliasOf: "jira" },
+    delivery: {
+      mcp: {
+        // Same mcp-atlassian server + BYO-token env as Jira — it exposes the
+        // Confluence tools when the deploy selects Confluence without Jira. If
+        // BOTH are selected the deploy manifest dedupes identical MCP specs.
+        command: "uvx",
+        args: ["mcp-atlassian==0.22.1"],
+        envMapping: {
+          ATLASSIAN_OAUTH_ACCESS_TOKEN: "accessToken",
+          ATLASSIAN_OAUTH_CLOUD_ID: "cloudId"
+        },
+        staticEnv: { ATLASSIAN_OAUTH_ENABLE: "true" }
+      }
+    }
   }
 };
 function getEnabledIntegrations() {
@@ -1502,6 +1561,14 @@ var INTEGRATION_BRANDING = {
     brandColor: "#357DE8",
     logoSvg: '<svg viewBox="0 0 32 32" height="32" xmlns="http://www.w3.org/2000/svg" focusable="false" aria-hidden="true"><defs><linearGradient id="uid18" x1="14.8402" y1="15.8324" x2="8.6599" y2="26.5369" gradientUnits="userSpaceOnUse"><stop stop-color="#2684FF" stop-opacity="0.4" offset="0%"></stop><stop stop-color="#2684FF" offset="0.9228"></stop></linearGradient></defs><path fill="url(#uid18)" d="M11.6397 14.0398C11.2789 13.643 10.7378 13.679 10.4852 14.148L4.64091 25.8728C4.42446 26.3418 4.74912 26.8829 5.25419 26.8829H13.4074C13.6599 26.8829 13.9125 26.7386 14.0207 26.4861C15.7885 22.8424 14.7061 17.3227 11.6397 14.0398Z"></path><path fill="#357DE8" d="M15.9343 3.36124C12.6513 8.55622 12.8678 14.2923 15.0324 18.6215C17.1969 22.9506 18.8565 26.2336 18.9647 26.4861C19.0729 26.7386 19.3254 26.8829 19.578 26.8829H27.7312C28.2363 26.8829 28.597 26.3418 28.3445 25.8728C28.3445 25.8728 17.3774 3.93846 17.0887 3.39732C16.8723 2.89225 16.259 2.85618 15.9343 3.36124Z"></path></svg>'
   },
+  confluence: {
+    id: "confluence",
+    name: "Confluence",
+    vendor: "Atlassian",
+    tagline: "Part of Atlassian \xB7 docs & wiki",
+    brandColor: "#1868DB",
+    logoSvg: '<svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><title>Confluence</title><path fill="#FFFFFF" d="M.87 18.257c-.248.382-.53.875-.763 1.245a.764.764 0 0 0 .255 1.04l4.965 3.054a.764.764 0 0 0 1.058-.26c.199-.332.454-.763.733-1.221 1.967-3.247 3.945-2.853 7.508-1.146l4.957 2.337a.764.764 0 0 0 1.028-.382l2.364-5.346a.764.764 0 0 0-.382-1c-1.048-.494-3.124-1.478-4.965-2.361C10.911 10.97 5.224 11.185.87 18.257zM23.131 5.743c.249-.405.531-.875.764-1.25a.764.764 0 0 0-.256-1.034L18.675.404a.764.764 0 0 0-1.058.26c-.195.335-.451.763-.734 1.225-1.966 3.246-3.945 2.85-7.508 1.146L4.437.694a.764.764 0 0 0-1.027.382L1.046 6.422a.764.764 0 0 0 .382 1c1.039.49 3.105 1.467 4.965 2.361 6.698 3.246 12.392 3.029 16.738-4.04z"/></svg>'
+  },
   slack: {
     id: "slack",
     name: "Slack",
@@ -1716,7 +1783,6 @@ var INTEGRATION_BRANDING = {
 var UPCOMING_INTEGRATION_IDS = [
   "gmail",
   "figma",
-  "supabase",
   "asana",
   "stripe",
   "pendo",