npm - @kaddo/cli - Versions diffs - 3.82.0 → 3.83.0 - Mend

@kaddo/cli 3.82.0 → 3.83.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (6) hide show

package/dist/admin-dist/assets/{index-DIfpc20n.js → index-CsOMxNTw.js} +15 -15
package/dist/admin-dist/index.html +1 -1
package/dist/admin-server/index.js +136 -0
package/dist/core.js +322 -10
package/dist/index.js +143 -10
package/package.json +1 -1

package/dist/admin-dist/index.html CHANGED Viewed

@@ -5,7 +5,7 @@
     <link rel="icon" type="image/svg+xml" href="/favicon.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>admin</title>
-    <script type="module" crossorigin src="/assets/index-DIfpc20n.js"></script>
+    <script type="module" crossorigin src="/assets/index-CsOMxNTw.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-DNkI-1xG.css">
   </head>
   <body>

package/dist/admin-server/index.js CHANGED Viewed

@@ -71,6 +71,16 @@ import {
   getSystemMapProjection as coreGetSystemMapProjection,
   buildTopologyEnrichmentHandoff as coreBuildTopologyHandoff,
   listIntegrations as coreListIntegrations,
+  getIntegration as coreGetIntegration,
+  getIntegrationSecretStatus as coreGetIntegrationSecretStatus,
+  getAvailableIntegrationTypes as coreGetAvailableIntegrationTypes,
+  createIntegration as coreCreateIntegration,
+  updateIntegration as coreUpdateIntegration,
+  deleteIntegration as coreDeleteIntegration,
+  enableIntegration as coreEnableIntegration,
+  disableIntegration as coreDisableIntegration,
+  setIntegrationSecret as coreSetIntegrationSecret,
+  removeIntegrationSecret as coreRemoveIntegrationSecret,
   verifyIntegration as coreVerifyIntegration,
   listExternalWorkItems as coreListExternalWorkItems,
   getExternalWorkItem as coreGetExternalWorkItem,
@@ -395,6 +405,72 @@ async function importIntegrationWorkItem(dir, id, externalId, opts) {
     mapIntegrationError(err);
   }
 }
+function getIntegrationDetail(dir, id) {
+  try {
+    return coreGetIntegration(dir, id);
+  } catch (err) {
+    mapIntegrationError(err);
+  }
+}
+async function getIntegrationSecretStatusAdmin(dir, id) {
+  try {
+    return await coreGetIntegrationSecretStatus(dir, id);
+  } catch (err) {
+    mapIntegrationError(err);
+  }
+}
+function getAvailableIntegrationTypesAdmin() {
+  return coreGetAvailableIntegrationTypes();
+}
+function createIntegrationAdmin(dir, body) {
+  try {
+    return coreCreateIntegration(dir, body);
+  } catch (err) {
+    mapIntegrationError(err);
+  }
+}
+function updateIntegrationAdmin(dir, id, body) {
+  try {
+    return coreUpdateIntegration(dir, id, body);
+  } catch (err) {
+    mapIntegrationError(err);
+  }
+}
+function deleteIntegrationAdmin(dir, id) {
+  try {
+    coreDeleteIntegration(dir, id);
+  } catch (err) {
+    mapIntegrationError(err);
+  }
+}
+function enableIntegrationAdmin(dir, id) {
+  try {
+    return coreEnableIntegration(dir, id);
+  } catch (err) {
+    mapIntegrationError(err);
+  }
+}
+function disableIntegrationAdmin(dir, id) {
+  try {
+    return coreDisableIntegration(dir, id);
+  } catch (err) {
+    mapIntegrationError(err);
+  }
+}
+async function setIntegrationSecretAdmin(dir, id, secretName, value) {
+  try {
+    await coreSetIntegrationSecret(dir, id, secretName, value);
+  } catch (err) {
+    mapIntegrationError(err);
+  }
+}
+async function removeIntegrationSecretAdmin(dir, id, secretName) {
+  try {
+    await coreRemoveIntegrationSecret(dir, id, secretName);
+  } catch (err) {
+    mapIntegrationError(err);
+  }
+}
 // src/contracts/schemas.ts
 import { z } from "zod";
@@ -896,10 +972,70 @@ async function createAdminServer(opts) {
     }
   };
   app.get("/api/v1/admin/integrations", coreRoute(getIntegrations));
+  app.get("/api/v1/admin/integrations/types", coreRoute(() => getAvailableIntegrationTypesAdmin()));
+  app.get("/api/v1/admin/integrations/:id", async (request, reply) => {
+    try {
+      return getIntegrationDetail(projectDir, request.params.id);
+    } catch (err) {
+      if (err instanceof CoreError) return reply.code(statusForCode(err.code)).send({ error: { code: err.code, message: err.message } });
+      throw err;
+    }
+  });
+  app.get(
+    "/api/v1/admin/integrations/:id/secrets",
+    async (request, reply) => asyncCore(reply, () => getIntegrationSecretStatusAdmin(projectDir, request.params.id))
+  );
   app.get(
     "/api/v1/admin/integrations/:id/status",
     async (request, reply) => asyncCore(reply, () => getIntegrationStatus(projectDir, request.params.id))
   );
+  app.post(
+    "/api/v1/admin/integrations",
+    async (request, reply) => {
+      const { id, adapter, enabled, config, secrets } = request.body ?? {};
+      if (!id || !adapter) return reply.code(400).send({ error: { code: "INVALID_INPUT", message: "id and adapter are required." } });
+      return writeHandler(reply, () => createIntegrationAdmin(projectDir, { id, adapter, enabled, config, secrets }));
+    }
+  );
+  app.put(
+    "/api/v1/admin/integrations/:id",
+    async (request, reply) => writeHandler(reply, () => updateIntegrationAdmin(projectDir, request.params.id, request.body ?? {}))
+  );
+  app.delete("/api/v1/admin/integrations/:id", async (request, reply) => {
+    try {
+      deleteIntegrationAdmin(projectDir, request.params.id);
+      return { ok: true };
+    } catch (err) {
+      if (err instanceof CoreError) return reply.code(statusForCode(err.code)).send({ error: { code: err.code, message: err.message } });
+      throw err;
+    }
+  });
+  app.post(
+    "/api/v1/admin/integrations/:id/enable",
+    async (request, reply) => writeHandler(reply, () => enableIntegrationAdmin(projectDir, request.params.id))
+  );
+  app.post(
+    "/api/v1/admin/integrations/:id/disable",
+    async (request, reply) => writeHandler(reply, () => disableIntegrationAdmin(projectDir, request.params.id))
+  );
+  app.post(
+    "/api/v1/admin/integrations/:id/secrets/:name",
+    async (request, reply) => {
+      const { value } = request.body ?? {};
+      if (!value || typeof value !== "string") return reply.code(400).send({ error: { code: "INVALID_INPUT", message: "A secret value is required." } });
+      return asyncCore(reply, async () => {
+        await setIntegrationSecretAdmin(projectDir, request.params.id, request.params.name, value);
+        return { ok: true };
+      });
+    }
+  );
+  app.delete(
+    "/api/v1/admin/integrations/:id/secrets/:name",
+    async (request, reply) => asyncCore(reply, async () => {
+      await removeIntegrationSecretAdmin(projectDir, request.params.id, request.params.name);
+      return { ok: true };
+    })
+  );
   app.get(
     "/api/v1/admin/integrations/:id/work-items",
     async (request, reply) => asyncCore(reply, () => getExternalWorkItems(projectDir, request.params.id, {

package/dist/core.js CHANGED Viewed

@@ -7,6 +7,10 @@ function exists(p2) {
 function readFile(p2) {
   return fs.readFileSync(p2, "utf-8");
 }
+function writeFile(filePath, content) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, content, "utf-8");
+}
 function readDir(dirPath) {
   if (!exists(dirPath)) return [];
   return fs.readdirSync(dirPath);
@@ -9371,7 +9375,7 @@ function buildRefinementHandoff(dir, workItemId) {
 // src/services/integrations.ts
 import matter8 from "gray-matter";
-import { parse as parseYaml9 } from "yaml";
+import { parse as parseYaml9, stringify as stringifyYaml5 } from "yaml";
 // ../integrations/src/errors.ts
 var RETRYABLE = /* @__PURE__ */ new Set([
@@ -9456,6 +9460,26 @@ function parseCredentials(raw, id, findings) {
   }
   return creds;
 }
+function parseSecrets(raw, id, findings) {
+  const secrets = {};
+  if (raw == null) return secrets;
+  if (typeof raw !== "object" || Array.isArray(raw)) {
+    findings.push({ level: "blocking", id, message: `Integration "${id}": secrets must be a mapping of logical references.` });
+    return secrets;
+  }
+  for (const [key, value] of Object.entries(raw)) {
+    if (typeof value === "string" && value.trim()) {
+      if (value.length > 100 || /^(ghp_|sk-|xox[bpsa]-|glpat-|ey[A-Za-z0-9])/i.test(value)) {
+        findings.push({ level: "blocking", id, message: `Integration "${id}": secret "${key}" appears to contain an actual credential, not a reference name.` });
+        continue;
+      }
+      secrets[key] = value.trim();
+    } else {
+      findings.push({ level: "warning", id, message: `Integration "${id}": ignoring non-string secret entry "${key}".` });
+    }
+  }
+  return secrets;
+}
 function parseIntegrationsConfig(raw, opts) {
   const findings = [];
   const integrations = [];
@@ -9488,12 +9512,13 @@ function parseIntegrationsConfig(raw, opts) {
     const enabled = o.enabled === void 0 ? true : o.enabled === true || o.enabled === "true";
     const config = o.config && typeof o.config === "object" && !Array.isArray(o.config) ? o.config : {};
     const credentials = parseCredentials(o.credentials, id, findings);
+    const secrets = parseSecrets(o.secrets, id, findings);
     const timeoutMs = typeof o.timeout_ms === "number" ? o.timeout_ms : typeof o.timeoutMs === "number" ? o.timeoutMs : void 0;
-    integrations.push({ id, adapter, enabled, config, credentials, timeoutMs });
+    integrations.push({ id, adapter, enabled, config, credentials, secrets, timeoutMs });
   }
   return { integrations, findings };
 }
-function resolveCredentials(integration, env) {
+async function resolveAllCredentials(integration, resolver, env) {
   const credentials = {};
   const missing = [];
   for (const [name, ref] of Object.entries(integration.credentials)) {
@@ -9501,8 +9526,47 @@ function resolveCredentials(integration, env) {
     if (value && value.length > 0) credentials[name] = value;
     else missing.push(ref.env);
   }
+  for (const [name, ref] of Object.entries(integration.secrets)) {
+    if (credentials[name]) continue;
+    const value = await resolver.resolve(ref);
+    if (value !== void 0) credentials[name] = value;
+    else missing.push(ref);
+  }
   return { credentials, missing };
 }
+function serializeIntegrationsConfig(integrations) {
+  return {
+    integrations: integrations.map((i) => {
+      const entry = {
+        id: i.id,
+        adapter: i.adapter,
+        enabled: i.enabled
+      };
+      if (Object.keys(i.config).length > 0) entry.config = i.config;
+      if (Object.keys(i.credentials).length > 0) {
+        const creds = {};
+        for (const [name, ref] of Object.entries(i.credentials)) {
+          creds[`${name}${ENV_SUFFIX}`] = ref.env;
+        }
+        entry.credentials = creds;
+      }
+      if (Object.keys(i.secrets).length > 0) entry.secrets = i.secrets;
+      if (i.timeoutMs !== void 0) entry.timeout_ms = i.timeoutMs;
+      return entry;
+    })
+  };
+}
+function integrationConfigFromInput(input) {
+  return {
+    id: input.id,
+    adapter: input.adapter,
+    enabled: input.enabled ?? true,
+    config: input.config ?? {},
+    credentials: {},
+    secrets: input.secrets ?? {},
+    timeoutMs: input.timeoutMs
+  };
+}
 // ../integrations/src/preview.ts
 function buildImportPreview(item, opts) {
@@ -9525,6 +9589,85 @@ function buildImportPreview(item, opts) {
   };
 }
+// ../integrations/src/secrets.ts
+import { readFileSync as readFileSync2, writeFileSync, mkdirSync, existsSync as existsSync2, unlinkSync } from "fs";
+import { dirname as dirname2 } from "path";
+function secretRefKey(integrationId, secretName) {
+  return `${integrationId}.${secretName}`;
+}
+var SECRETS_FILENAME = ".secrets.json";
+function secretsPath(projectDir) {
+  return `${projectDir}/.kaddo/${SECRETS_FILENAME}`;
+}
+function loadStore(filePath) {
+  if (!existsSync2(filePath)) return {};
+  try {
+    const raw = readFileSync2(filePath, "utf-8");
+    const parsed = JSON.parse(raw);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) return parsed;
+    return {};
+  } catch {
+    return {};
+  }
+}
+function saveStore(filePath, store) {
+  mkdirSync(dirname2(filePath), { recursive: true });
+  writeFileSync(filePath, JSON.stringify(store, null, 2) + "\n", "utf-8");
+}
+function createLocalSecretProvider(projectDir) {
+  const fp = secretsPath(projectDir);
+  return {
+    async get(key) {
+      const store = loadStore(fp);
+      const val = store[key];
+      return val !== void 0 && val !== "" ? val : void 0;
+    },
+    async set(key, value) {
+      const store = loadStore(fp);
+      store[key] = value;
+      saveStore(fp, store);
+    },
+    async delete(key) {
+      const store = loadStore(fp);
+      delete store[key];
+      saveStore(fp, store);
+    },
+    async exists(key) {
+      const store = loadStore(fp);
+      return key in store && store[key] !== void 0 && store[key] !== "";
+    }
+  };
+}
+function createEnvSecretProvider(env = process.env) {
+  return {
+    async get(key) {
+      const val = env[key];
+      return val !== void 0 && val !== "" ? val : void 0;
+    },
+    async set() {
+      throw new Error("Environment secret provider is read-only.");
+    },
+    async delete() {
+      throw new Error("Environment secret provider is read-only.");
+    },
+    async exists(key) {
+      const val = env[key];
+      return val !== void 0 && val !== "";
+    }
+  };
+}
+function createCompositeResolver(...providers) {
+  return {
+    async resolve(reference) {
+      for (const provider of providers) {
+        const val = await provider.get(reference);
+        if (val !== void 0) return val;
+      }
+      return void 0;
+    }
+  };
+}
 // ../integrations/src/registry.ts
 var DuplicateAdapterError = class extends Error {
   constructor(id) {
@@ -9609,7 +9752,31 @@ function createMockAdapter(opts = {}) {
       id: MOCK_ADAPTER_ID,
       displayName: "Mock Work Source",
       version: "1.0.0",
-      description: "Deterministic offline reference adapter for validating the integration foundation."
+      description: "Deterministic offline reference adapter for validating the integration foundation.",
+      configSchema: {
+        simulate: {
+          type: "select",
+          required: false,
+          label: "Simulation mode",
+          description: "Controls what the mock adapter simulates during verify/read operations.",
+          options: [
+            { value: "available", label: "Available" },
+            { value: "unauthorized", label: "Unauthorized" },
+            { value: "rate-limited", label: "Rate Limited" },
+            { value: "unavailable", label: "Unavailable" },
+            { value: "timeout", label: "Timeout" }
+          ],
+          defaultValue: "available"
+        }
+      },
+      secretSchema: {
+        token: {
+          type: "string",
+          required: false,
+          label: "API Token",
+          description: "Optional token for testing secret handling (not used by the mock adapter)."
+        }
+      }
     },
     capabilities: {
       workItems: { list: true, read: true, import: true, write: false, statusSync: false, comments: false, webhooks: false }
@@ -9683,12 +9850,23 @@ function loadRaw(dir) {
 function loadIntegrations(dir) {
   return parseIntegrationsConfig(loadRaw(dir), { adapterIds: registry.ids() });
 }
+function saveIntegrations(dir, integrations) {
+  const abs = join(dir, INTEGRATIONS_FILE);
+  const data = serializeIntegrationsConfig(integrations);
+  writeFile(abs, stringifyYaml5(data, { lineWidth: 120 }));
+}
 function configStatus(integration, findings) {
   if (!integration.enabled) return "disabled";
   const blocking = findings.some((f) => f.id === integration.id && f.level === "blocking");
   if (blocking || !registry.has(integration.adapter)) return "invalid-config";
   return "configured";
 }
+function secretProvider(dir) {
+  return createLocalSecretProvider(dir);
+}
+function secretResolver(dir, env) {
+  return createCompositeResolver(createLocalSecretProvider(dir), createEnvSecretProvider(env));
+}
 function listIntegrations(dir) {
   const { integrations, findings } = loadIntegrations(dir);
   return integrations.map((integration) => {
@@ -9702,23 +9880,70 @@ function listIntegrations(dir) {
       capabilities: adapter?.capabilities ?? null,
       metadata: adapter?.metadata ?? null,
       credentialRefs: Object.values(integration.credentials).map((c) => c.env),
+      secretRefs: Object.values(integration.secrets),
+      secretStatus: {},
       findings: findings.filter((f) => f.id === integration.id)
     };
   });
 }
+function getIntegration(dir, id) {
+  const { integrations, findings } = loadIntegrations(dir);
+  const integration = integrations.find((i) => i.id === id);
+  if (!integration) throw new IntegrationServiceError("INTEGRATION_NOT_CONFIGURED", `No integration "${id}" is configured in this project.`);
+  const adapter = registry.get(integration.adapter);
+  return {
+    id: integration.id,
+    adapter: integration.adapter,
+    enabled: integration.enabled,
+    status: configStatus(integration, findings),
+    displayName: adapter?.metadata.displayName ?? integration.adapter,
+    capabilities: adapter?.capabilities ?? null,
+    metadata: adapter?.metadata ?? null,
+    credentialRefs: Object.values(integration.credentials).map((c) => c.env),
+    secretRefs: Object.values(integration.secrets),
+    secretStatus: {},
+    findings: findings.filter((f) => f.id === integration.id)
+  };
+}
+async function getIntegrationSecretStatus(dir, id) {
+  const { integrations } = loadIntegrations(dir);
+  const integration = integrations.find((i) => i.id === id);
+  if (!integration) throw new IntegrationServiceError("INTEGRATION_NOT_CONFIGURED", `No integration "${id}" is configured.`);
+  const sp = secretProvider(dir);
+  const status = {};
+  for (const [name, ref] of Object.entries(integration.secrets)) {
+    status[name] = await sp.exists(ref);
+  }
+  for (const [name, ref] of Object.entries(integration.credentials)) {
+    const val = process.env[ref.env];
+    status[name] = val !== void 0 && val !== "";
+  }
+  return status;
+}
+function getAvailableIntegrationTypes() {
+  return registry.list().map((a) => ({
+    id: a.id,
+    displayName: a.metadata.displayName,
+    description: a.metadata.description,
+    configSchema: a.metadata.configSchema ?? {},
+    secretSchema: a.metadata.secretSchema ?? {},
+    capabilities: a.capabilities
+  }));
+}
 function requireIntegration(dir, id) {
   const { integrations, findings } = loadIntegrations(dir);
   const integration = integrations.find((i) => i.id === id);
   if (!integration) throw new IntegrationServiceError("INTEGRATION_NOT_CONFIGURED", `No integration "${id}" is configured in this project.`);
-  return { integration, findings };
+  return { integration, findings, all: integrations };
 }
 function resolveAdapter(integration) {
   const adapter = registry.get(integration.adapter);
   if (!adapter) throw new IntegrationServiceError("ADAPTER_NOT_FOUND", `Unknown integration adapter "${integration.adapter}".`);
   return adapter;
 }
-function buildContext(integration, env) {
-  const { credentials, missing } = resolveCredentials(integration, env);
+async function buildContextWithSecrets(dir, integration, env) {
+  const resolver = secretResolver(dir, env);
+  const { credentials, missing } = await resolveAllCredentials(integration, resolver, env);
   return {
     context: { integrationId: integration.id, config: integration.config, credentials, timeoutMs: integration.timeoutMs ?? DEFAULT_TIMEOUT_MS },
     missing
@@ -9735,13 +9960,90 @@ async function withTimeout(op, ms) {
     if (timer) clearTimeout(timer);
   }
 }
+function validateId(id) {
+  if (!id || !id.trim()) throw new IntegrationServiceError("INTEGRATION_INVALID_INPUT", "Integration id is required.");
+  if (!/^[a-z0-9][a-z0-9._-]*$/i.test(id)) throw new IntegrationServiceError("INTEGRATION_INVALID_INPUT", "Integration id must be alphanumeric with dashes, dots or underscores.");
+  if (id.length > 64) throw new IntegrationServiceError("INTEGRATION_INVALID_INPUT", "Integration id must be 64 characters or fewer.");
+}
+function createIntegration(dir, input) {
+  validateId(input.id);
+  if (!input.adapter || !input.adapter.trim()) throw new IntegrationServiceError("INTEGRATION_INVALID_INPUT", "An adapter type is required.");
+  const { integrations } = loadIntegrations(dir);
+  if (integrations.find((i) => i.id === input.id)) {
+    throw new IntegrationServiceError("INTEGRATION_ALREADY_EXISTS", `An integration with id "${input.id}" already exists.`);
+  }
+  const newConfig = integrationConfigFromInput(input);
+  integrations.push(newConfig);
+  saveIntegrations(dir, integrations);
+  return getIntegration(dir, input.id);
+}
+function updateIntegration(dir, id, input) {
+  const { integrations } = loadIntegrations(dir);
+  const idx = integrations.findIndex((i) => i.id === id);
+  if (idx < 0) throw new IntegrationServiceError("INTEGRATION_NOT_CONFIGURED", `No integration "${id}" is configured.`);
+  const existing = integrations[idx];
+  if (input.enabled !== void 0) existing.enabled = input.enabled;
+  if (input.config !== void 0) existing.config = input.config;
+  if (input.secrets !== void 0) existing.secrets = input.secrets;
+  if (input.timeoutMs !== void 0) existing.timeoutMs = input.timeoutMs;
+  integrations[idx] = existing;
+  saveIntegrations(dir, integrations);
+  return getIntegration(dir, id);
+}
+function deleteIntegration(dir, id) {
+  const { integrations } = loadIntegrations(dir);
+  const idx = integrations.findIndex((i) => i.id === id);
+  if (idx < 0) throw new IntegrationServiceError("INTEGRATION_NOT_CONFIGURED", `No integration "${id}" is configured.`);
+  const removed = integrations[idx];
+  integrations.splice(idx, 1);
+  saveIntegrations(dir, integrations);
+  const sp = secretProvider(dir);
+  for (const ref of Object.values(removed.secrets)) {
+    sp.delete(ref).catch(() => {
+    });
+  }
+}
+function enableIntegration(dir, id) {
+  return updateIntegration(dir, id, { enabled: true });
+}
+function disableIntegration(dir, id) {
+  return updateIntegration(dir, id, { enabled: false });
+}
+async function setIntegrationSecret(dir, id, secretName, value) {
+  const { integration } = requireIntegration(dir, id);
+  const refKey = secretRefKey(id, secretName);
+  const sp = secretProvider(dir);
+  await sp.set(refKey, value);
+  if (!integration.secrets[secretName] || integration.secrets[secretName] !== refKey) {
+    const { integrations } = loadIntegrations(dir);
+    const idx = integrations.findIndex((i) => i.id === id);
+    if (idx >= 0) {
+      integrations[idx].secrets[secretName] = refKey;
+      saveIntegrations(dir, integrations);
+    }
+  }
+}
+async function removeIntegrationSecret(dir, id, secretName) {
+  const { integration } = requireIntegration(dir, id);
+  const refKey = integration.secrets[secretName];
+  if (refKey) {
+    const sp = secretProvider(dir);
+    await sp.delete(refKey);
+  }
+  const { integrations } = loadIntegrations(dir);
+  const idx = integrations.findIndex((i) => i.id === id);
+  if (idx >= 0 && integrations[idx].secrets[secretName]) {
+    delete integrations[idx].secrets[secretName];
+    saveIntegrations(dir, integrations);
+  }
+}
 async function verifyIntegration(dir, id, env = process.env) {
   const { integration, findings } = requireIntegration(dir, id);
   const cfgStatus = configStatus(integration, findings);
   if (cfgStatus === "disabled") return { id, status: "disabled", connection: null, missingCredentials: [] };
   if (cfgStatus === "invalid-config") return { id, status: "invalid-config", connection: null, missingCredentials: [] };
   const adapter = resolveAdapter(integration);
-  const { context, missing } = buildContext(integration, env);
+  const { context, missing } = await buildContextWithSecrets(dir, integration, env);
   try {
     const connection = await withTimeout(adapter.verifyConnection(context), context.timeoutMs);
     return { id, status: statusOf(connection), connection, missingCredentials: missing, message: connection.message };
@@ -9766,14 +10068,14 @@ async function listExternalWorkItems(dir, id, opts = {}, env = process.env) {
   const { integration } = requireIntegration(dir, id);
   const adapter = resolveAdapter(integration);
   if (!adapter.capabilities.workItems.list) throw integrationError("UNSUPPORTED_CAPABILITY", `Adapter "${adapter.id}" cannot list work items.`);
-  const { context } = buildContext(integration, env);
+  const { context } = await buildContextWithSecrets(dir, integration, env);
   return withTimeout(adapter.listWorkItems({ context, cursor: opts.cursor, pageSize: opts.pageSize, filters: opts.filters }), context.timeoutMs);
 }
 async function getExternalWorkItem(dir, id, externalId, env = process.env) {
   const { integration } = requireIntegration(dir, id);
   const adapter = resolveAdapter(integration);
   if (!adapter.capabilities.workItems.read) throw integrationError("UNSUPPORTED_CAPABILITY", `Adapter "${adapter.id}" cannot read work items.`);
-  const { context } = buildContext(integration, env);
+  const { context } = await buildContextWithSecrets(dir, integration, env);
   return withTimeout(adapter.getWorkItem({ context, externalId }), context.timeoutMs);
 }
 function findLinkedWorkItem(dir, integrationId, externalId) {
@@ -9837,15 +10139,22 @@ export {
   buildRefinementHandoff,
   buildTopologyEnrichmentHandoff,
   computeRefinementStatus,
+  createIntegration,
   createWorkItem,
   cwd,
+  deleteIntegration,
+  disableIntegration,
   discoverKnowledge,
   discoverWorkItems,
+  enableIntegration,
   exists,
   findLinkedWorkItem,
   findSystemPaths,
+  getAvailableIntegrationTypes,
   getExternalWorkItem,
   getImpactCandidates,
+  getIntegration,
+  getIntegrationSecretStatus,
   getSystemMapProjection,
   getSystemNeighbors,
   getSystemNodeContext,
@@ -9869,9 +10178,12 @@ export {
   loadSystemTopology,
   previewImport,
   readFile,
+  removeIntegrationSecret,
   searchSystemNodes,
+  setIntegrationSecret,
   topologyRevision,
   transitionWorkItem,
+  updateIntegration,
   updateWorkItem,
   validateSystemTopology,
   validateTopologyProposal,