@lssm/lib.contracts 1.2.0

package/dist/integrations/providers/qdrant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"qdrant.js","names":["qdrantIntegrationSpec: IntegrationSpec"],"sources":["../../../src/integrations/providers/qdrant.ts"],"sourcesContent":["import { StabilityEnum } from '../../ownership';\nimport type { IntegrationSpec, IntegrationSpecRegistry } from '../spec';\n\nexport const qdrantIntegrationSpec: IntegrationSpec = {\n  meta: {\n    key: 'vectordb.qdrant',\n    version: 1,\n    category: 'vector-db',\n    displayName: 'Qdrant',\n    title: 'Qdrant Vector Database',\n    description: 'Qdrant integration for vector search and embeddings storage.',\n    domain: 'ai',\n    owners: ['platform.ai'],\n    tags: ['vector-db', 'search'],\n    stability: StabilityEnum.Experimental,\n  },\n  supportedModes: ['managed', 'byok'],\n  capabilities: {\n    provides: [\n      { key: 'vector-db.search', version: 1 },\n      { key: 'vector-db.storage', version: 1 },\n    ],\n    requires: [\n      {\n        key: 'ai.embeddings',\n        optional: true,\n        reason: 'Required if vectors are generated via hosted embedding services',\n      },\n    ],\n  },\n  configSchema: {\n    schema: {\n      type: 'object',\n      properties: {\n        apiUrl: {\n          type: 'string',\n          description: 'Base URL for the Qdrant instance (e.g., https://qdrant.example.com).',\n        },\n        collectionPrefix: {\n          type: 'string',\n          description: 'Prefix applied to all collection names for this tenant.',\n        },\n      },\n    },\n    example: {\n      apiUrl: 'https://qdrant.example.com',\n      collectionPrefix: 'tenant_',\n    },\n  },\n  secretSchema: {\n    schema: {\n      type: 'object',\n      properties: {\n        apiKey: {\n          type: 'string',\n          description: 'API key or token when authentication is enabled.',\n        },\n      },\n    },\n    example: {\n      apiKey: 'qdrant-api-key',\n    },\n  },\n  healthCheck: {\n    method: 'ping',\n    timeoutMs: 4000,\n  },\n  docsUrl: 'https://qdrant.tech/documentation/quick-start/',\n  constraints: {\n    quotas: {\n      collections: 100,\n      pointsPerCollection: 1_000_000,\n    },\n  },\n  byokSetup: {\n    setupInstructions:\n      'Provide the HTTPS endpoint of your Qdrant cluster and generate an API key with read/write access to the collections that will be managed.',\n  },\n};\n\nexport function registerQdrantIntegration(\n  registry: IntegrationSpecRegistry\n): IntegrationSpecRegistry {\n  return registry.register(qdrantIntegrationSpec);\n}\n\n"],"mappings":"mDAGA,MAAaA,EAAyC,CACpD,KAAM,CACJ,IAAK,kBACL,QAAS,EACT,SAAU,YACV,YAAa,SACb,MAAO,yBACP,YAAa,+DACb,OAAQ,KACR,OAAQ,CAAC,cAAc,CACvB,KAAM,CAAC,YAAa,SAAS,CAC7B,UAAW,EAAc,aAC1B,CACD,eAAgB,CAAC,UAAW,OAAO,CACnC,aAAc,CACZ,SAAU,CACR,CAAE,IAAK,mBAAoB,QAAS,EAAG,CACvC,CAAE,IAAK,oBAAqB,QAAS,EAAG,CACzC,CACD,SAAU,CACR,CACE,IAAK,gBACL,SAAU,GACV,OAAQ,kEACT,CACF,CACF,CACD,aAAc,CACZ,OAAQ,CACN,KAAM,SACN,WAAY,CACV,OAAQ,CACN,KAAM,SACN,YAAa,uEACd,CACD,iBAAkB,CAChB,KAAM,SACN,YAAa,0DACd,CACF,CACF,CACD,QAAS,CACP,OAAQ,6BACR,iBAAkB,UACnB,CACF,CACD,aAAc,CACZ,OAAQ,CACN,KAAM,SACN,WAAY,CACV,OAAQ,CACN,KAAM,SACN,YAAa,mDACd,CACF,CACF,CACD,QAAS,CACP,OAAQ,iBACT,CACF,CACD,YAAa,CACX,OAAQ,OACR,UAAW,IACZ,CACD,QAAS,iDACT,YAAa,CACX,OAAQ,CACN,YAAa,IACb,oBAAqB,IACtB,CACF,CACD,UAAW,CACT,kBACE,4IACH,CACF,CAED,SAAgB,EACd,EACyB,CACzB,OAAO,EAAS,SAAS,EAAsB"}

package/dist/integrations/providers/sms.d.ts

@@ -0,0 +1,35 @@
+//#region src/integrations/providers/sms.d.ts
+interface SmsMessage {
+  id: string;
+  to: string;
+  from: string;
+  body: string;
+  status: 'queued' | 'sending' | 'sent' | 'delivered' | 'undelivered' | 'failed';
+  providerMessageId?: string;
+  carrier?: string;
+  price?: number;
+  priceCurrency?: string;
+  sentAt?: Date;
+  deliveredAt?: Date;
+  errorCode?: string;
+  errorMessage?: string;
+}
+interface SendSmsInput {
+  to: string;
+  from?: string;
+  body: string;
+  metadata?: Record<string, string>;
+}
+interface SmsDeliveryStatus {
+  status: SmsMessage['status'];
+  errorCode?: string;
+  errorMessage?: string;
+  updatedAt: Date;
+}
+interface SmsProvider {
+  sendSms(input: SendSmsInput): Promise<SmsMessage>;
+  getDeliveryStatus(messageId: string): Promise<SmsDeliveryStatus>;
+}
+//#endregion
+export { SendSmsInput, SmsDeliveryStatus, SmsMessage, SmsProvider };
+//# sourceMappingURL=sms.d.ts.map

package/dist/integrations/providers/sms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sms.d.ts","names":[],"sources":["../../../src/integrations/providers/sms.ts"],"sourcesContent":[],"mappings":";UAAiB,UAAA;EAAA,EAAA,EAAA,MAAA;EAsBA,EAAA,EAAA,MAAA;EAOA,IAAA,EAAA,MAAA;EAOA,IAAA,EAAA,MAAA;EACA,MAAA,EAAA,QAAA,GAAA,SAAA,GAAA,MAAA,GAAA,WAAA,GAAA,aAAA,GAAA,QAAA;EAAuB,iBAAA,CAAA,EAAA,MAAA;EAAR,OAAA,CAAA,EAAA,MAAA;EACgB,KAAA,CAAA,EAAA,MAAA;EAAR,aAAA,CAAA,EAAA,MAAA;EAAO,MAAA,CAAA,EAtBpC,IAsBoC;gBArB/B;;;;UAKC,YAAA;;;;aAIJ;;UAGI,iBAAA;UACP;;;aAGG;;UAGI,WAAA;iBACA,eAAe,QAAQ;wCACA,QAAQ"}

package/dist/integrations/providers/storage.d.ts

@@ -0,0 +1,61 @@
+//#region src/integrations/providers/storage.d.ts
+interface StorageObjectMetadata {
+  bucket: string;
+  key: string;
+  sizeBytes?: number;
+  contentType?: string;
+  etag?: string;
+  checksum?: string;
+  lastModified?: Date;
+  metadata?: Record<string, string>;
+}
+type StorageObjectBody = {
+  data: Uint8Array;
+  stream?: never;
+} | {
+  data?: never;
+  stream: AsyncIterable<Uint8Array>;
+};
+type GetObjectResult = StorageObjectMetadata & StorageObjectBody;
+interface PutObjectInput {
+  bucket: string;
+  key: string;
+  data: Uint8Array | ArrayBuffer;
+  contentType?: string;
+  metadata?: Record<string, string>;
+  makePublic?: boolean;
+}
+interface DeleteObjectInput {
+  bucket: string;
+  key: string;
+}
+interface SignedUrlOptions {
+  bucket: string;
+  key: string;
+  expiresInSeconds: number;
+  method?: 'GET' | 'PUT';
+  contentType?: string;
+}
+interface ListObjectsQuery {
+  bucket: string;
+  prefix?: string;
+  maxResults?: number;
+  pageToken?: string;
+}
+interface ListObjectsResult {
+  objects: StorageObjectMetadata[];
+  nextPageToken?: string;
+}
+interface ObjectStorageProvider {
+  putObject(input: PutObjectInput): Promise<StorageObjectMetadata>;
+  getObject(input: DeleteObjectInput): Promise<GetObjectResult | null>;
+  deleteObject(input: DeleteObjectInput): Promise<void>;
+  generateSignedUrl(options: SignedUrlOptions): Promise<{
+    url: string;
+    expiresAt: Date;
+  }>;
+  listObjects(query: ListObjectsQuery): Promise<ListObjectsResult>;
+}
+//#endregion
+export { DeleteObjectInput, GetObjectResult, ListObjectsQuery, ListObjectsResult, ObjectStorageProvider, PutObjectInput, SignedUrlOptions, StorageObjectBody, StorageObjectMetadata };
+//# sourceMappingURL=storage.d.ts.map

package/dist/integrations/providers/storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.d.ts","names":[],"sources":["../../../src/integrations/providers/storage.ts"],"sourcesContent":[],"mappings":";UAAiB,qBAAA;EAAA,MAAA,EAAA,MAAA;EAWL,GAAA,EAAA,MAAA;EACA,SAAA,CAAA,EAAA,MAAA;EAC8B,WAAA,CAAA,EAAA,MAAA;EAAd,IAAA,CAAA,EAAA,MAAA;EAAa,QAAA,CAAA,EAAA,MAAA;EAE7B,YAAA,CAAA,EARK,IAQU;EAEV,QAAA,CAAA,EATJ,MASkB,CAAA,MAAA,EAAA,MAAA,CAAA;;AAGV,KATT,iBAAA,GASS;EAER,IAAA,EAVD,UAUC;EAAM,MAAA,CAAA,EAAA,KAAA;AAInB,CAAA,GAAiB;EAKA,IAAA,CAAA,EAAA,KAAA;EAQA,MAAA,EA1BW,aA0BK,CA1BS,UA0BT,CAAA;AAOjC,CAAA;AAKiB,KApCL,eAAA,GAAkB,qBAoCQ,GApCgB,iBAoChB;AACnB,UAnCF,cAAA,CAmCE;EAAyB,MAAA,EAAA,MAAA;EAAR,GAAA,EAAA,MAAA;EACjB,IAAA,EAjCX,UAiCW,GAjCE,WAiCF;EAA4B,WAAA,CAAA,EAAA,MAAA;EAAR,QAAA,CAAA,EA/B1B,MA+B0B,CAAA,MAAA,EAAA,MAAA,CAAA;EACjB,UAAA,CAAA,EAAA,OAAA;;AAET,UA9BI,iBAAA,CA8BJ;EAC0B,MAAA,EAAA,MAAA;EAAlC,GAAA,EAAA,MAAA;;AAC2C,UA3B/B,gBAAA,CA2B+B;EAAR,MAAA,EAAA,MAAA;EAAO,GAAA,EAAA,MAAA;;;;;UAnB9B,gBAAA;;;;;;UAOA,iBAAA;WACN;;;UAIM,qBAAA;mBACE,iBAAiB,QAAQ;mBACzB,oBAAoB,QAAQ;sBACzB,oBAAoB;6BAE7B,mBACR;;eAAkC;;qBAClB,mBAAmB,QAAQ"}

package/dist/integrations/providers/stripe.d.ts

@@ -0,0 +1,8 @@
+import { IntegrationSpec, IntegrationSpecRegistry } from "../spec.js";
+
+//#region src/integrations/providers/stripe.d.ts
+declare const stripeIntegrationSpec: IntegrationSpec;
+declare function registerStripeIntegration(registry: IntegrationSpecRegistry): IntegrationSpecRegistry;
+//#endregion
+export { registerStripeIntegration, stripeIntegrationSpec };
+//# sourceMappingURL=stripe.d.ts.map

package/dist/integrations/providers/stripe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stripe.d.ts","names":[],"sources":["../../../src/integrations/providers/stripe.ts"],"sourcesContent":[],"mappings":";;;cAIa,uBAAuB;AAAvB,iBAkFG,yBAAA,CAlFoB,QAgFnC,EAGW,uBAHX,CAAA,EAIE,uBAJF"}

package/dist/integrations/providers/stripe.js

@@ -0,0 +1,2 @@
+import{StabilityEnum as e}from"../../ownership.js";const t={meta:{key:`payments.stripe`,version:1,category:`payments`,displayName:`Stripe`,title:`Stripe Payments`,description:`Stripe integration for payment processing, charges, and payouts.`,domain:`payments`,owners:[`platform.payments`],tags:[`payments`,`psp`],stability:e.Stable},supportedModes:[`managed`,`byok`],capabilities:{provides:[{key:`payments.psp`,version:1}],requires:[{key:`platform.webhooks`,optional:!0,reason:`Recommended for reliable event ingestion`}]},configSchema:{schema:{type:`object`,properties:{accountId:{type:`string`,description:`Connected account ID when using Stripe Connect (BYOK).`},region:{type:`string`,description:`Optional Stripe region or data residency hint.`}}},example:{accountId:`acct_123`,region:`us-east-1`}},secretSchema:{schema:{type:`object`,required:[`apiKey`,`webhookSecret`],properties:{apiKey:{type:`string`,description:`Stripe secret API key (sk_live_... or sk_test_...).`},webhookSecret:{type:`string`,description:`Signing secret for webhook verification.`}}},example:{apiKey:`sk_live_***`,webhookSecret:`whsec_***`}},healthCheck:{method:`ping`,timeoutMs:5e3},docsUrl:`https://stripe.com/docs/api`,constraints:{rateLimit:{rpm:1e3,rph:2e4}},byokSetup:{setupInstructions:`Create a restricted Stripe API key with write access to Charges and provide a webhook signing secret.`,requiredScopes:[`charges:write`,`customers:read`]}};function n(e){return e.register(t)}export{n as registerStripeIntegration,t as stripeIntegrationSpec};
+//# sourceMappingURL=stripe.js.map

package/dist/integrations/providers/stripe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stripe.js","names":["stripeIntegrationSpec: IntegrationSpec"],"sources":["../../../src/integrations/providers/stripe.ts"],"sourcesContent":["import { StabilityEnum } from '../../ownership';\nimport type { IntegrationSpec } from '../spec';\nimport type { IntegrationSpecRegistry } from '../spec';\n\nexport const stripeIntegrationSpec: IntegrationSpec = {\n  meta: {\n    key: 'payments.stripe',\n    version: 1,\n    category: 'payments',\n    displayName: 'Stripe',\n    title: 'Stripe Payments',\n    description:\n      'Stripe integration for payment processing, charges, and payouts.',\n    domain: 'payments',\n    owners: ['platform.payments'],\n    tags: ['payments', 'psp'],\n    stability: StabilityEnum.Stable,\n  },\n  supportedModes: ['managed', 'byok'],\n  capabilities: {\n    provides: [{ key: 'payments.psp', version: 1 }],\n    requires: [\n      {\n        key: 'platform.webhooks',\n        optional: true,\n        reason: 'Recommended for reliable event ingestion',\n      },\n    ],\n  },\n  configSchema: {\n    schema: {\n      type: 'object',\n      properties: {\n        accountId: {\n          type: 'string',\n          description: 'Connected account ID when using Stripe Connect (BYOK).',\n        },\n        region: {\n          type: 'string',\n          description: 'Optional Stripe region or data residency hint.',\n        },\n      },\n    },\n    example: {\n      accountId: 'acct_123',\n      region: 'us-east-1',\n    },\n  },\n  secretSchema: {\n    schema: {\n      type: 'object',\n      required: ['apiKey', 'webhookSecret'],\n      properties: {\n        apiKey: {\n          type: 'string',\n          description: 'Stripe secret API key (sk_live_... or sk_test_...).',\n        },\n        webhookSecret: {\n          type: 'string',\n          description: 'Signing secret for webhook verification.',\n        },\n      },\n    },\n    example: {\n      apiKey: 'sk_live_***',\n      webhookSecret: 'whsec_***',\n    },\n  },\n  healthCheck: {\n    method: 'ping',\n    timeoutMs: 5000,\n  },\n  docsUrl: 'https://stripe.com/docs/api',\n  constraints: {\n    rateLimit: {\n      rpm: 1000,\n      rph: 20000,\n    },\n  },\n  byokSetup: {\n    setupInstructions:\n      'Create a restricted Stripe API key with write access to Charges and provide a webhook signing secret.',\n    requiredScopes: ['charges:write', 'customers:read'],\n  },\n};\n\nexport function registerStripeIntegration(\n  registry: IntegrationSpecRegistry\n): IntegrationSpecRegistry {\n  return registry.register(stripeIntegrationSpec);\n}\n\n"],"mappings":"mDAIA,MAAaA,EAAyC,CACpD,KAAM,CACJ,IAAK,kBACL,QAAS,EACT,SAAU,WACV,YAAa,SACb,MAAO,kBACP,YACE,mEACF,OAAQ,WACR,OAAQ,CAAC,oBAAoB,CAC7B,KAAM,CAAC,WAAY,MAAM,CACzB,UAAW,EAAc,OAC1B,CACD,eAAgB,CAAC,UAAW,OAAO,CACnC,aAAc,CACZ,SAAU,CAAC,CAAE,IAAK,eAAgB,QAAS,EAAG,CAAC,CAC/C,SAAU,CACR,CACE,IAAK,oBACL,SAAU,GACV,OAAQ,2CACT,CACF,CACF,CACD,aAAc,CACZ,OAAQ,CACN,KAAM,SACN,WAAY,CACV,UAAW,CACT,KAAM,SACN,YAAa,yDACd,CACD,OAAQ,CACN,KAAM,SACN,YAAa,iDACd,CACF,CACF,CACD,QAAS,CACP,UAAW,WACX,OAAQ,YACT,CACF,CACD,aAAc,CACZ,OAAQ,CACN,KAAM,SACN,SAAU,CAAC,SAAU,gBAAgB,CACrC,WAAY,CACV,OAAQ,CACN,KAAM,SACN,YAAa,sDACd,CACD,cAAe,CACb,KAAM,SACN,YAAa,2CACd,CACF,CACF,CACD,QAAS,CACP,OAAQ,cACR,cAAe,YAChB,CACF,CACD,YAAa,CACX,OAAQ,OACR,UAAW,IACZ,CACD,QAAS,8BACT,YAAa,CACX,UAAW,CACT,IAAK,IACL,IAAK,IACN,CACF,CACD,UAAW,CACT,kBACE,wGACF,eAAgB,CAAC,gBAAiB,iBAAiB,CACpD,CACF,CAED,SAAgB,EACd,EACyB,CACzB,OAAO,EAAS,SAAS,EAAsB"}

package/dist/integrations/providers/twilio-sms.d.ts

@@ -0,0 +1,8 @@
+import { IntegrationSpec, IntegrationSpecRegistry } from "../spec.js";
+
+//#region src/integrations/providers/twilio-sms.d.ts
+declare const twilioSmsIntegrationSpec: IntegrationSpec;
+declare function registerTwilioSmsIntegration(registry: IntegrationSpecRegistry): IntegrationSpecRegistry;
+//#endregion
+export { registerTwilioSmsIntegration, twilioSmsIntegrationSpec };
+//# sourceMappingURL=twilio-sms.d.ts.map

package/dist/integrations/providers/twilio-sms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"twilio-sms.d.ts","names":[],"sources":["../../../src/integrations/providers/twilio-sms.ts"],"sourcesContent":[],"mappings":";;;cAGa,0BAA0B;iBAoEvB,4BAAA,WACJ,0BACT"}

package/dist/integrations/providers/twilio-sms.js

@@ -0,0 +1,2 @@
+import{StabilityEnum as e}from"../../ownership.js";const t={meta:{key:`sms.twilio`,version:1,category:`sms`,displayName:`Twilio SMS`,title:`Twilio Messaging`,description:`Twilio SMS integration for transactional and notification messaging.`,domain:`communications`,owners:[`platform.messaging`],tags:[`sms`,`messaging`],stability:e.Stable},supportedModes:[`managed`,`byok`],capabilities:{provides:[{key:`sms.outbound`,version:1}]},configSchema:{schema:{type:`object`,properties:{fromNumber:{type:`string`,description:`Default Twilio phone number used as sender.`}}},example:{fromNumber:`+15551234567`}},secretSchema:{schema:{type:`object`,required:[`accountSid`,`authToken`],properties:{accountSid:{type:`string`,description:`Twilio Account SID.`},authToken:{type:`string`,description:`Twilio Auth Token.`}}},example:{accountSid:`ACxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx`,authToken:`auth-token`}},healthCheck:{method:`custom`,timeoutMs:3e3},docsUrl:`https://www.twilio.com/docs/sms/api`,constraints:{rateLimit:{rpm:200}},byokSetup:{setupInstructions:`Provide a Twilio account SID, auth token, and verify the outbound sending numbers used by the integration.`}};function n(e){return e.register(t)}export{n as registerTwilioSmsIntegration,t as twilioSmsIntegrationSpec};
+//# sourceMappingURL=twilio-sms.js.map

package/dist/integrations/providers/twilio-sms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"twilio-sms.js","names":["twilioSmsIntegrationSpec: IntegrationSpec"],"sources":["../../../src/integrations/providers/twilio-sms.ts"],"sourcesContent":["import { StabilityEnum } from '../../ownership';\nimport type { IntegrationSpec, IntegrationSpecRegistry } from '../spec';\n\nexport const twilioSmsIntegrationSpec: IntegrationSpec = {\n  meta: {\n    key: 'sms.twilio',\n    version: 1,\n    category: 'sms',\n    displayName: 'Twilio SMS',\n    title: 'Twilio Messaging',\n    description:\n      'Twilio SMS integration for transactional and notification messaging.',\n    domain: 'communications',\n    owners: ['platform.messaging'],\n    tags: ['sms', 'messaging'],\n    stability: StabilityEnum.Stable,\n  },\n  supportedModes: ['managed', 'byok'],\n  capabilities: {\n    provides: [{ key: 'sms.outbound', version: 1 }],\n  },\n  configSchema: {\n    schema: {\n      type: 'object',\n      properties: {\n        fromNumber: {\n          type: 'string',\n          description: 'Default Twilio phone number used as sender.',\n        },\n      },\n    },\n    example: {\n      fromNumber: '+15551234567',\n    },\n  },\n  secretSchema: {\n    schema: {\n      type: 'object',\n      required: ['accountSid', 'authToken'],\n      properties: {\n        accountSid: {\n          type: 'string',\n          description: 'Twilio Account SID.',\n        },\n        authToken: {\n          type: 'string',\n          description: 'Twilio Auth Token.',\n        },\n      },\n    },\n    example: {\n      accountSid: 'ACxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',\n      authToken: 'auth-token',\n    },\n  },\n  healthCheck: {\n    method: 'custom',\n    timeoutMs: 3000,\n  },\n  docsUrl: 'https://www.twilio.com/docs/sms/api',\n  constraints: {\n    rateLimit: {\n      rpm: 200,\n    },\n  },\n  byokSetup: {\n    setupInstructions:\n      'Provide a Twilio account SID, auth token, and verify the outbound sending numbers used by the integration.',\n  },\n};\n\nexport function registerTwilioSmsIntegration(\n  registry: IntegrationSpecRegistry\n): IntegrationSpecRegistry {\n  return registry.register(twilioSmsIntegrationSpec);\n}\n\n\n"],"mappings":"mDAGA,MAAaA,EAA4C,CACvD,KAAM,CACJ,IAAK,aACL,QAAS,EACT,SAAU,MACV,YAAa,aACb,MAAO,mBACP,YACE,uEACF,OAAQ,iBACR,OAAQ,CAAC,qBAAqB,CAC9B,KAAM,CAAC,MAAO,YAAY,CAC1B,UAAW,EAAc,OAC1B,CACD,eAAgB,CAAC,UAAW,OAAO,CACnC,aAAc,CACZ,SAAU,CAAC,CAAE,IAAK,eAAgB,QAAS,EAAG,CAAC,CAChD,CACD,aAAc,CACZ,OAAQ,CACN,KAAM,SACN,WAAY,CACV,WAAY,CACV,KAAM,SACN,YAAa,8CACd,CACF,CACF,CACD,QAAS,CACP,WAAY,eACb,CACF,CACD,aAAc,CACZ,OAAQ,CACN,KAAM,SACN,SAAU,CAAC,aAAc,YAAY,CACrC,WAAY,CACV,WAAY,CACV,KAAM,SACN,YAAa,sBACd,CACD,UAAW,CACT,KAAM,SACN,YAAa,qBACd,CACF,CACF,CACD,QAAS,CACP,WAAY,mCACZ,UAAW,aACZ,CACF,CACD,YAAa,CACX,OAAQ,SACR,UAAW,IACZ,CACD,QAAS,sCACT,YAAa,CACX,UAAW,CACT,IAAK,IACN,CACF,CACD,UAAW,CACT,kBACE,6GACH,CACF,CAED,SAAgB,EACd,EACyB,CACzB,OAAO,EAAS,SAAS,EAAyB"}

package/dist/integrations/providers/vector-store.d.ts

@@ -0,0 +1,44 @@
+import { EmbeddingVector } from "./embedding.js";
+
+//#region src/integrations/providers/vector-store.d.ts
+interface VectorDocument {
+  id: string;
+  vector: EmbeddingVector;
+  payload?: Record<string, unknown>;
+  namespace?: string;
+  expiresAt?: Date;
+}
+interface VectorUpsertRequest {
+  collection: string;
+  documents: VectorDocument[];
+  waitForSync?: boolean;
+}
+interface VectorDeleteRequest {
+  collection: string;
+  ids: string[];
+  namespace?: string;
+}
+interface VectorSearchQuery {
+  collection: string;
+  vector: EmbeddingVector;
+  topK: number;
+  namespace?: string;
+  filter?: Record<string, unknown>;
+  scoreThreshold?: number;
+  consistent?: boolean;
+}
+interface VectorSearchResult {
+  id: string;
+  score: number;
+  payload?: Record<string, unknown>;
+  vector?: EmbeddingVector;
+  namespace?: string;
+}
+interface VectorStoreProvider {
+  upsert(request: VectorUpsertRequest): Promise<void>;
+  search(query: VectorSearchQuery): Promise<VectorSearchResult[]>;
+  delete(request: VectorDeleteRequest): Promise<void>;
+}
+//#endregion
+export { VectorDeleteRequest, VectorDocument, VectorSearchQuery, VectorSearchResult, VectorStoreProvider, VectorUpsertRequest };
+//# sourceMappingURL=vector-store.d.ts.map

package/dist/integrations/providers/vector-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vector-store.d.ts","names":[],"sources":["../../../src/integrations/providers/vector-store.ts"],"sourcesContent":[],"mappings":";;;UAEiB,cAAA;;EAAA,MAAA,EAEP,eAFqB;EAErB,OAAA,CAAA,EACE,MADF,CAAA,MAAA,EAAA,OAAA,CAAA;EACE,SAAA,CAAA,EAAA,MAAA;EAEE,SAAA,CAAA,EAAA,IAAA;;AAGG,UAAA,mBAAA,CAAmB;EAMnB,UAAA,EAAA,MAAA;EAMA,SAAA,EAVJ,cAUqB,EAAA;EAUjB,WAAA,CAAA,EAAA,OAAkB;AAQnC;AACkB,UAzBD,mBAAA,CAyBC;EAAsB,UAAA,EAAA,MAAA;EACxB,GAAA,EAAA,MAAA,EAAA;EAA4B,SAAA,CAAA,EAAA,MAAA;;AAC1B,UArBD,iBAAA,CAqBC;EAAsB,UAAA,EAAA,MAAA;EAAO,MAAA,EAnBrC,eAmBqC;;;WAhBpC;;;;UAKM,kBAAA;;;YAGL;WACD;;;UAIM,mBAAA;kBACC,sBAAsB;gBACxB,oBAAoB,QAAQ;kBAC1B,sBAAsB"}

package/dist/integrations/providers/voice.d.ts

@@ -0,0 +1,35 @@
+//#region src/integrations/providers/voice.d.ts
+interface Voice {
+  id: string;
+  name: string;
+  description?: string;
+  language?: string;
+  gender?: 'male' | 'female' | 'neutral';
+  previewUrl?: string;
+  metadata?: Record<string, string>;
+}
+interface VoiceSynthesisInput {
+  text: string;
+  voiceId?: string;
+  language?: string;
+  style?: number;
+  stability?: number;
+  similarityBoost?: number;
+  format?: 'mp3' | 'wav' | 'ogg' | 'pcm';
+  sampleRateHz?: number;
+  metadata?: Record<string, string>;
+}
+interface VoiceSynthesisResult {
+  audio: Uint8Array;
+  format: string;
+  sampleRateHz: number;
+  durationSeconds?: number;
+  url?: string;
+}
+interface VoiceProvider {
+  listVoices(): Promise<Voice[]>;
+  synthesize(input: VoiceSynthesisInput): Promise<VoiceSynthesisResult>;
+}
+//#endregion
+export { Voice, VoiceProvider, VoiceSynthesisInput, VoiceSynthesisResult };
+//# sourceMappingURL=voice.d.ts.map

package/dist/integrations/providers/voice.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"voice.d.ts","names":[],"sources":["../../../src/integrations/providers/voice.ts"],"sourcesContent":[],"mappings":";UAAiB,KAAA;EAAA,EAAA,EAAA,MAAK;EAUL,IAAA,EAAA,MAAA;EAYA,WAAA,CAAA,EAAA,MAAA;EAQA,QAAA,CAAA,EAAA,MAAa;EACN,MAAA,CAAA,EAAA,MAAA,GAAA,QAAA,GAAA,SAAA;EAAR,UAAA,CAAA,EAAA,MAAA;EACI,QAAA,CAAA,EAzBP,MAyBO,CAAA,MAAA,EAAA,MAAA,CAAA;;AAAsB,UAtBzB,mBAAA,CAsByB;EAAO,IAAA,EAAA,MAAA;;;;;;;;aAbpC;;UAGI,oBAAA;SACR;;;;;;UAOQ,aAAA;gBACD,QAAQ;oBACJ,sBAAsB,QAAQ"}

package/dist/integrations/runtime.d.ts

@@ -0,0 +1,100 @@
+import { IntegrationSpec } from "./spec.js";
+import { ConnectionStatus, IntegrationConnection } from "./connection.js";
+import { ResolvedAppConfig, ResolvedIntegration } from "../app-config/runtime.js";
+import { SecretProvider } from "./secrets/provider.js";
+
+//#region src/integrations/runtime.d.ts
+interface IntegrationTraceMetadata {
+  blueprintName: string;
+  blueprintVersion: number;
+  configVersion: number;
+}
+interface IntegrationTelemetryEvent {
+  tenantId: string;
+  appId: string;
+  environment?: string;
+  slotId?: string;
+  integrationKey: string;
+  integrationVersion: number;
+  connectionId: string;
+  status: 'success' | 'error';
+  durationMs?: number;
+  errorCode?: string;
+  errorMessage?: string;
+  occurredAt: Date;
+  metadata?: Record<string, string | number | boolean>;
+}
+interface IntegrationTelemetryEmitter {
+  record(event: IntegrationTelemetryEvent): Promise<void> | void;
+}
+type IntegrationInvocationStatus = 'success' | 'error';
+interface IntegrationContext {
+  tenantId: string;
+  appId: string;
+  environment?: string;
+  slotId?: string;
+  spec: IntegrationSpec;
+  connection: IntegrationConnection;
+  secretProvider: SecretProvider;
+  secretReference: string;
+  trace: IntegrationTraceMetadata;
+  config?: Record<string, unknown>;
+}
+interface IntegrationCallContext {
+  tenantId: string;
+  appId: string;
+  environment?: string;
+  blueprintName: string;
+  blueprintVersion: number;
+  configVersion: number;
+  slotId: string;
+  operation: string;
+}
+interface IntegrationCallError {
+  code: string;
+  message: string;
+  retryable: boolean;
+  cause?: unknown;
+}
+interface IntegrationCallResult<T> {
+  success: boolean;
+  data?: T;
+  error?: IntegrationCallError;
+  metadata: {
+    latencyMs: number;
+    connectionId: string;
+    ownershipMode: IntegrationConnection['ownershipMode'];
+    attempts: number;
+  };
+}
+interface IntegrationCallGuardOptions {
+  telemetry?: IntegrationTelemetryEmitter;
+  maxAttempts?: number;
+  backoffMs?: number;
+  shouldRetry?: (error: unknown, attempt: number) => boolean;
+  sleep?: (ms: number) => Promise<void>;
+  now?: () => Date;
+}
+declare class IntegrationCallGuard {
+  private readonly secretProvider;
+  private readonly telemetry?;
+  private readonly maxAttempts;
+  private readonly backoffMs;
+  private readonly shouldRetry;
+  private readonly sleep;
+  private readonly now;
+  constructor(secretProvider: SecretProvider, options?: IntegrationCallGuardOptions);
+  executeWithGuards<T>(slotId: string, operation: string, input: unknown, resolvedConfig: ResolvedAppConfig, executor: (connection: IntegrationConnection, secrets: Record<string, string>) => Promise<T>): Promise<IntegrationCallResult<T>>;
+  private findIntegration;
+  private fetchSecrets;
+  private parseSecret;
+  private emitTelemetry;
+  private failure;
+  private makeContext;
+  private errorCodeFor;
+}
+declare function ensureConnectionReady(integration: ResolvedIntegration): void;
+declare function connectionStatusLabel(status: ConnectionStatus): string;
+//#endregion
+export { IntegrationCallContext, IntegrationCallError, IntegrationCallGuard, IntegrationCallGuardOptions, IntegrationCallResult, IntegrationContext, IntegrationInvocationStatus, IntegrationTelemetryEmitter, IntegrationTelemetryEvent, IntegrationTraceMetadata, connectionStatusLabel, ensureConnectionReady };
+//# sourceMappingURL=runtime.d.ts.map

package/dist/integrations/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","names":[],"sources":["../../src/integrations/runtime.ts"],"sourcesContent":[],"mappings":";;;;;;UAMiB,wBAAA;;EAAA,gBAAA,EAAA,MAAA;EAMA,aAAA,EAAA,MAAA;AAgBjB;AAIY,UApBK,yBAAA,CAoBsB;EAEtB,QAAA,EAAA,MAAA;EAKT,KAAA,EAAA,MAAA;EACM,WAAA,CAAA,EAAA,MAAA;EACI,MAAA,CAAA,EAAA,MAAA;EAET,cAAA,EAAA,MAAA;EACE,kBAAA,EAAA,MAAA;EAAM,YAAA,EAAA,MAAA;EAGA,MAAA,EAAA,SAAA,GAAA,OAAsB;EAWtB,UAAA,CAAA,EAAA,MAAA;EAOA,SAAA,CAAA,EAAA,MAAA;EAER,YAAA,CAAA,EAAA,MAAA;EACC,UAAA,EA5CI,IA4CJ;EAIS,QAAA,CAAA,EA/CN,MA+CM,CAAA,MAAA,EAAA,MAAA,GAAA,MAAA,GAAA,OAAA,CAAA;;AAKF,UAjDA,2BAAA,CAiD2B;EAC9B,MAAA,CAAA,KAAA,EAjDE,yBAiDF,CAAA,EAjD8B,OAiD9B,CAAA,IAAA,CAAA,GAAA,IAAA;;AAKA,KAnDF,2BAAA,GAmDE,SAAA,GAAA,OAAA;AAAI,UAjDD,kBAAA,CAiDC;EAML,QAAA,EAAA,MAAA;EASwB,KAAA,EAAA,MAAA;EACxB,WAAA,CAAA,EAAA,MAAA;EA4BO,MAAA,CAAA,EAAA,MAAA;EAEF,IAAA,EA1FV,eA0FU;EACH,UAAA,EA1FD,qBA0FC;EACE,cAAA,EA1FC,cA0FD;EAAR,eAAA,EAAA,MAAA;EAC0B,KAAA,EAzF1B,wBAyF0B;EAAtB,MAAA,CAAA,EAxFF,MAwFE,CAAA,MAAA,EAAA,OAAA,CAAA;;AAAD,UArFK,sBAAA,CAqFL;EAwPI,QAAA,EAAA,MAAA;EAWA,KAAA,EAAA,MAAA;;;;;;;;UA7UC,oBAAA;;;;;;UAOA;;SAER;UACC;;;;mBAIS;;;;UAKF,2BAAA;cACH;;;;0BAIY;cACZ;;cAMD,oBAAA;;;;;;;;8BASwB,0BACxB;0FA4BO,0CAEF,gCACH,2BACN,QAAQ,KACZ,QAAQ,sBAAsB;;;;;;;;;iBAwPnB,qBAAA,cACD;iBAUC,qBAAA,SAA8B"}

package/dist/integrations/runtime.js

@@ -0,0 +1,2 @@
+import{performance as e}from"node:perf_hooks";var t=class{telemetry;maxAttempts;backoffMs;shouldRetry;sleep;now;constructor(e,t={}){this.secretProvider=e,this.telemetry=t.telemetry,this.maxAttempts=Math.max(1,t.maxAttempts??3),this.backoffMs=t.backoffMs??250,this.shouldRetry=t.shouldRetry??(e=>typeof e==`object`&&!!e&&`retryable`in e&&!!e.retryable),this.sleep=t.sleep??(e=>e<=0?Promise.resolve():new Promise(t=>setTimeout(t,e))),this.now=t.now??(()=>new Date)}async executeWithGuards(t,n,r,i,a){let o=this.findIntegration(t,i);if(!o)return this.failure({tenantId:i.tenantId,appId:i.appId,environment:i.environment,blueprintName:i.blueprintName,blueprintVersion:i.blueprintVersion,configVersion:i.configVersion,slotId:t,operation:n},void 0,{code:`SLOT_NOT_BOUND`,message:`Integration slot "${t}" is not bound for tenant "${i.tenantId}".`,retryable:!1},0);let s=o.connection.status;if(s===`disconnected`||s===`error`)return this.failure(this.makeContext(t,n,i),o,{code:`CONNECTION_NOT_READY`,message:`Integration connection "${o.connection.meta.label}" is in status "${s}".`,retryable:!1},0);let c=await this.fetchSecrets(o.connection),l=0,u=e.now();for(;l<this.maxAttempts;){l+=1;try{let r=await a(o.connection,c),s=e.now()-u;return this.emitTelemetry(this.makeContext(t,n,i),o,`success`,s),{success:!0,data:r,metadata:{latencyMs:s,connectionId:o.connection.meta.id,ownershipMode:o.connection.ownershipMode,attempts:l}}}catch(r){let a=e.now()-u;this.emitTelemetry(this.makeContext(t,n,i),o,`error`,a,this.errorCodeFor(r),r instanceof Error?r.message:String(r));let s=this.shouldRetry(r,l);if(!s||l>=this.maxAttempts)return{success:!1,error:{code:this.errorCodeFor(r),message:r instanceof Error?r.message:String(r),retryable:s,cause:r},metadata:{latencyMs:a,connectionId:o.connection.meta.id,ownershipMode:o.connection.ownershipMode,attempts:l}};await this.sleep(this.backoffMs)}}return{success:!1,error:{code:`UNKNOWN_ERROR`,message:`Integration call failed after retries.`,retryable:!1},metadata:{latencyMs:e.now()-u,connectionId:o.connection.meta.id,ownershipMode:o.connection.ownershipMode,attempts:this.maxAttempts}}}findIntegration(e,t){return t.integrations.find(t=>t.slot.slotId===e)}async fetchSecrets(e){if(!this.secretProvider.canHandle(e.secretRef))throw Error(`Secret provider "${this.secretProvider.id}" cannot handle reference "${e.secretRef}".`);let t=await this.secretProvider.getSecret(e.secretRef);return this.parseSecret(t)}parseSecret(e){let t=new TextDecoder().decode(e.data);try{let e=JSON.parse(t);if(e&&typeof e==`object`&&!Array.isArray(e)){let t=Object.entries(e).filter(([,e])=>typeof e==`string`||typeof e==`number`||typeof e==`boolean`);return Object.fromEntries(t.map(([e,t])=>[e,String(t)]))}}catch{}return{secret:t}}emitTelemetry(e,t,n,r,i,a){!this.telemetry||!t||this.telemetry.record({tenantId:e.tenantId,appId:e.appId,environment:e.environment,slotId:e.slotId,integrationKey:t.connection.meta.integrationKey,integrationVersion:t.connection.meta.integrationVersion,connectionId:t.connection.meta.id,status:n,durationMs:r,errorCode:i,errorMessage:a,occurredAt:this.now(),metadata:{blueprint:`${e.blueprintName}.v${e.blueprintVersion}`,configVersion:e.configVersion,operation:e.operation}})}failure(e,t,n,r){return t&&this.emitTelemetry(e,t,`error`,0,n.code,n.message),{success:!1,error:n,metadata:{latencyMs:0,connectionId:t?.connection.meta.id??`unknown`,ownershipMode:t?.connection.ownershipMode??`managed`,attempts:r}}}makeContext(e,t,n){return{tenantId:n.tenantId,appId:n.appId,environment:n.environment,blueprintName:n.blueprintName,blueprintVersion:n.blueprintVersion,configVersion:n.configVersion,slotId:e,operation:t}}errorCodeFor(e){return typeof e==`object`&&e&&`code`in e&&typeof e.code==`string`?e.code:`PROVIDER_ERROR`}};function n(e){let t=e.connection.status;if(t===`disconnected`||t===`error`)throw Error(`Integration connection "${e.connection.meta.label}" is in status "${t}".`)}function r(e){switch(e){case`connected`:return`connected`;case`disconnected`:return`disconnected`;case`error`:return`error`;case`unknown`:default:return`unknown`}}export{t as IntegrationCallGuard,r as connectionStatusLabel,n as ensureConnectionReady};
+//# sourceMappingURL=runtime.js.map

package/dist/integrations/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","names":["secretProvider: SecretProvider"],"sources":["../../src/integrations/runtime.ts"],"sourcesContent":["import { performance } from 'node:perf_hooks';\nimport type { ResolvedAppConfig, ResolvedIntegration } from '../app-config/runtime';\nimport type { ConnectionStatus, IntegrationConnection } from './connection';\nimport type { IntegrationSpec } from './spec';\nimport type { SecretProvider, SecretValue } from './secrets/provider';\n\nexport interface IntegrationTraceMetadata {\n  blueprintName: string;\n  blueprintVersion: number;\n  configVersion: number;\n}\n\nexport interface IntegrationTelemetryEvent {\n  tenantId: string;\n  appId: string;\n  environment?: string;\n  slotId?: string;\n  integrationKey: string;\n  integrationVersion: number;\n  connectionId: string;\n  status: 'success' | 'error';\n  durationMs?: number;\n  errorCode?: string;\n  errorMessage?: string;\n  occurredAt: Date;\n  metadata?: Record<string, string | number | boolean>;\n}\n\nexport interface IntegrationTelemetryEmitter {\n  record(event: IntegrationTelemetryEvent): Promise<void> | void;\n}\n\nexport type IntegrationInvocationStatus = 'success' | 'error';\n\nexport interface IntegrationContext {\n  tenantId: string;\n  appId: string;\n  environment?: string;\n  slotId?: string;\n  spec: IntegrationSpec;\n  connection: IntegrationConnection;\n  secretProvider: SecretProvider;\n  secretReference: string;\n  trace: IntegrationTraceMetadata;\n  config?: Record<string, unknown>;\n}\n\nexport interface IntegrationCallContext {\n  tenantId: string;\n  appId: string;\n  environment?: string;\n  blueprintName: string;\n  blueprintVersion: number;\n  configVersion: number;\n  slotId: string;\n  operation: string;\n}\n\nexport interface IntegrationCallError {\n  code: string;\n  message: string;\n  retryable: boolean;\n  cause?: unknown;\n}\n\nexport interface IntegrationCallResult<T> {\n  success: boolean;\n  data?: T;\n  error?: IntegrationCallError;\n  metadata: {\n    latencyMs: number;\n    connectionId: string;\n    ownershipMode: IntegrationConnection['ownershipMode'];\n    attempts: number;\n  };\n}\n\nexport interface IntegrationCallGuardOptions {\n  telemetry?: IntegrationTelemetryEmitter;\n  maxAttempts?: number;\n  backoffMs?: number;\n  shouldRetry?: (error: unknown, attempt: number) => boolean;\n  sleep?: (ms: number) => Promise<void>;\n  now?: () => Date;\n}\n\nconst DEFAULT_MAX_ATTEMPTS = 3;\nconst DEFAULT_BACKOFF_MS = 250;\n\nexport class IntegrationCallGuard {\n  private readonly telemetry?: IntegrationTelemetryEmitter;\n  private readonly maxAttempts: number;\n  private readonly backoffMs: number;\n  private readonly shouldRetry: (error: unknown, attempt: number) => boolean;\n  private readonly sleep: (ms: number) => Promise<void>;\n  private readonly now: () => Date;\n\n  constructor(\n    private readonly secretProvider: SecretProvider,\n    options: IntegrationCallGuardOptions = {}\n  ) {\n    this.telemetry = options.telemetry;\n    this.maxAttempts = Math.max(\n      1,\n      options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS\n    );\n    this.backoffMs = options.backoffMs ?? DEFAULT_BACKOFF_MS;\n    this.shouldRetry =\n      options.shouldRetry ??\n      ((error: unknown) =>\n        typeof error === 'object' &&\n        error !== null &&\n        'retryable' in error &&\n        Boolean((error as { retryable?: unknown }).retryable));\n    this.sleep =\n      options.sleep ??\n      ((ms: number) =>\n        ms <= 0\n          ? Promise.resolve()\n          : new Promise((resolve) => setTimeout(resolve, ms)));\n    this.now = options.now ?? (() => new Date());\n  }\n\n  async executeWithGuards<T>(\n    slotId: string,\n    operation: string,\n    input: unknown,\n    resolvedConfig: ResolvedAppConfig,\n    executor: (\n      connection: IntegrationConnection,\n      secrets: Record<string, string>\n    ) => Promise<T>\n  ): Promise<IntegrationCallResult<T>> {\n    const integration = this.findIntegration(slotId, resolvedConfig);\n    if (!integration) {\n      return this.failure(\n        {\n          tenantId: resolvedConfig.tenantId,\n          appId: resolvedConfig.appId,\n          environment: resolvedConfig.environment,\n          blueprintName: resolvedConfig.blueprintName,\n          blueprintVersion: resolvedConfig.blueprintVersion,\n          configVersion: resolvedConfig.configVersion,\n          slotId,\n          operation,\n        },\n        undefined,\n        {\n          code: 'SLOT_NOT_BOUND',\n          message: `Integration slot \"${slotId}\" is not bound for tenant \"${resolvedConfig.tenantId}\".`,\n          retryable: false,\n        },\n        0\n      );\n    }\n\n    const status = integration.connection.status;\n    if (status === 'disconnected' || status === 'error') {\n      return this.failure(\n        this.makeContext(slotId, operation, resolvedConfig),\n        integration,\n        {\n          code: 'CONNECTION_NOT_READY',\n          message: `Integration connection \"${integration.connection.meta.label}\" is in status \"${status}\".`,\n          retryable: false,\n        },\n        0\n      );\n    }\n\n    const secrets = await this.fetchSecrets(integration.connection);\n\n    let attempt = 0;\n    const started = performance.now();\n    while (attempt < this.maxAttempts) {\n      attempt += 1;\n      try {\n        const data = await executor(integration.connection, secrets);\n        const duration = performance.now() - started;\n        this.emitTelemetry(\n          this.makeContext(slotId, operation, resolvedConfig),\n          integration,\n          'success',\n          duration\n        );\n        return {\n          success: true,\n          data,\n          metadata: {\n            latencyMs: duration,\n            connectionId: integration.connection.meta.id,\n            ownershipMode: integration.connection.ownershipMode,\n            attempts: attempt,\n          },\n        };\n      } catch (error) {\n        const duration = performance.now() - started;\n        this.emitTelemetry(\n          this.makeContext(slotId, operation, resolvedConfig),\n          integration,\n          'error',\n          duration,\n          this.errorCodeFor(error),\n          error instanceof Error ? error.message : String(error)\n        );\n        const retryable = this.shouldRetry(error, attempt);\n        if (!retryable || attempt >= this.maxAttempts) {\n          return {\n            success: false,\n            error: {\n              code: this.errorCodeFor(error),\n              message:\n                error instanceof Error ? error.message : String(error),\n              retryable,\n              cause: error,\n            },\n            metadata: {\n              latencyMs: duration,\n              connectionId: integration.connection.meta.id,\n              ownershipMode: integration.connection.ownershipMode,\n              attempts: attempt,\n            },\n          };\n        }\n        await this.sleep(this.backoffMs);\n      }\n    }\n\n    // Should never reach here due to loop logic.\n    return {\n      success: false,\n      error: {\n        code: 'UNKNOWN_ERROR',\n        message: 'Integration call failed after retries.',\n        retryable: false,\n      },\n      metadata: {\n        latencyMs: performance.now() - started,\n        connectionId: integration.connection.meta.id,\n        ownershipMode: integration.connection.ownershipMode,\n        attempts: this.maxAttempts,\n      },\n    };\n  }\n\n  private findIntegration(\n    slotId: string,\n    config: ResolvedAppConfig\n  ): ResolvedIntegration | undefined {\n    return config.integrations.find(\n      (integration) => integration.slot.slotId === slotId\n    );\n  }\n\n  private async fetchSecrets(\n    connection: IntegrationConnection\n  ): Promise<Record<string, string>> {\n    if (!this.secretProvider.canHandle(connection.secretRef)) {\n      throw new Error(\n        `Secret provider \"${this.secretProvider.id}\" cannot handle reference \"${connection.secretRef}\".`\n      );\n    }\n    const secret = await this.secretProvider.getSecret(connection.secretRef);\n    return this.parseSecret(secret);\n  }\n\n  private parseSecret(secret: SecretValue): Record<string, string> {\n    const text = new TextDecoder().decode(secret.data);\n    try {\n      const parsed = JSON.parse(text);\n      if (\n        parsed &&\n        typeof parsed === 'object' &&\n        !Array.isArray(parsed)\n      ) {\n        const entries = Object.entries(parsed).filter(\n          ([, value]) =>\n            typeof value === 'string' ||\n            typeof value === 'number' ||\n            typeof value === 'boolean'\n        );\n        return Object.fromEntries(\n          entries.map(([key, value]) => [key, String(value)])\n        );\n      }\n    } catch {\n      // Fall through to raw secret.\n    }\n    return { secret: text };\n  }\n\n  private emitTelemetry(\n    context: IntegrationCallContext,\n    integration: ResolvedIntegration | undefined,\n    status: 'success' | 'error',\n    durationMs: number,\n    errorCode?: string,\n    errorMessage?: string\n  ) {\n    if (!this.telemetry || !integration) return;\n    this.telemetry.record({\n      tenantId: context.tenantId,\n      appId: context.appId,\n      environment: context.environment,\n      slotId: context.slotId,\n      integrationKey: integration.connection.meta.integrationKey,\n      integrationVersion: integration.connection.meta.integrationVersion,\n      connectionId: integration.connection.meta.id,\n      status,\n      durationMs,\n      errorCode,\n      errorMessage,\n      occurredAt: this.now(),\n      metadata: {\n        blueprint: `${context.blueprintName}.v${context.blueprintVersion}`,\n        configVersion: context.configVersion,\n        operation: context.operation,\n      },\n    });\n  }\n\n  private failure<T>(\n    context: IntegrationCallContext,\n    integration: ResolvedIntegration | undefined,\n    error: IntegrationCallError,\n    attempts: number\n  ): IntegrationCallResult<T> {\n    if (integration) {\n      this.emitTelemetry(\n        context,\n        integration,\n        'error',\n        0,\n        error.code,\n        error.message\n      );\n    }\n    return {\n      success: false,\n      error,\n      metadata: {\n        latencyMs: 0,\n        connectionId: integration?.connection.meta.id ?? 'unknown',\n        ownershipMode:\n          integration?.connection.ownershipMode ?? 'managed',\n        attempts,\n      },\n    };\n  }\n\n  private makeContext(\n    slotId: string,\n    operation: string,\n    config: ResolvedAppConfig\n  ): IntegrationCallContext {\n    return {\n      tenantId: config.tenantId,\n      appId: config.appId,\n      environment: config.environment,\n      blueprintName: config.blueprintName,\n      blueprintVersion: config.blueprintVersion,\n      configVersion: config.configVersion,\n      slotId,\n      operation,\n    };\n  }\n\n  private errorCodeFor(error: unknown): string {\n    if (\n      typeof error === 'object' &&\n      error !== null &&\n      'code' in error &&\n      typeof (error as { code?: unknown }).code === 'string'\n    ) {\n      return (error as { code: string }).code;\n    }\n    return 'PROVIDER_ERROR';\n  }\n}\n\nexport function ensureConnectionReady(\n  integration: ResolvedIntegration\n): void {\n  const status = integration.connection.status;\n  if (status === 'disconnected' || status === 'error') {\n    throw new Error(\n      `Integration connection \"${integration.connection.meta.label}\" is in status \"${status}\".`\n    );\n  }\n}\n\nexport function connectionStatusLabel(status: ConnectionStatus): string {\n  switch (status) {\n    case 'connected':\n      return 'connected';\n    case 'disconnected':\n      return 'disconnected';\n    case 'error':\n      return 'error';\n    case 'unknown':\n    default:\n      return 'unknown';\n  }\n}\n"],"mappings":"8CAyFA,IAAa,EAAb,KAAkC,CAChC,UACA,YACA,UACA,YACA,MACA,IAEA,YACE,EACA,EAAuC,EAAE,CACzC,CAFiB,KAAA,eAAA,EAGjB,KAAK,UAAY,EAAQ,UACzB,KAAK,YAAc,KAAK,IACtB,EACA,EAAQ,aAAe,EACxB,CACD,KAAK,UAAY,EAAQ,WAAa,IACtC,KAAK,YACH,EAAQ,cACN,GACA,OAAO,GAAU,YACjB,GACA,cAAe,GACf,EAAS,EAAkC,WAC/C,KAAK,MACH,EAAQ,QACN,GACA,GAAM,EACF,QAAQ,SAAS,CACjB,IAAI,QAAS,GAAY,WAAW,EAAS,EAAG,CAAC,EACzD,KAAK,IAAM,EAAQ,UAAc,IAAI,MAGvC,MAAM,kBACJ,EACA,EACA,EACA,EACA,EAImC,CACnC,IAAM,EAAc,KAAK,gBAAgB,EAAQ,EAAe,CAChE,GAAI,CAAC,EACH,OAAO,KAAK,QACV,CACE,SAAU,EAAe,SACzB,MAAO,EAAe,MACtB,YAAa,EAAe,YAC5B,cAAe,EAAe,cAC9B,iBAAkB,EAAe,iBACjC,cAAe,EAAe,cAC9B,SACA,YACD,CACD,IAAA,GACA,CACE,KAAM,iBACN,QAAS,qBAAqB,EAAO,6BAA6B,EAAe,SAAS,IAC1F,UAAW,GACZ,CACD,EACD,CAGH,IAAM,EAAS,EAAY,WAAW,OACtC,GAAI,IAAW,gBAAkB,IAAW,QAC1C,OAAO,KAAK,QACV,KAAK,YAAY,EAAQ,EAAW,EAAe,CACnD,EACA,CACE,KAAM,uBACN,QAAS,2BAA2B,EAAY,WAAW,KAAK,MAAM,kBAAkB,EAAO,IAC/F,UAAW,GACZ,CACD,EACD,CAGH,IAAM,EAAU,MAAM,KAAK,aAAa,EAAY,WAAW,CAE3D,EAAU,EACR,EAAU,EAAY,KAAK,CACjC,KAAO,EAAU,KAAK,aAAa,CACjC,GAAW,EACX,GAAI,CACF,IAAM,EAAO,MAAM,EAAS,EAAY,WAAY,EAAQ,CACtD,EAAW,EAAY,KAAK,CAAG,EAOrC,OANA,KAAK,cACH,KAAK,YAAY,EAAQ,EAAW,EAAe,CACnD,EACA,UACA,EACD,CACM,CACL,QAAS,GACT,OACA,SAAU,CACR,UAAW,EACX,aAAc,EAAY,WAAW,KAAK,GAC1C,cAAe,EAAY,WAAW,cACtC,SAAU,EACX,CACF,OACM,EAAO,CACd,IAAM,EAAW,EAAY,KAAK,CAAG,EACrC,KAAK,cACH,KAAK,YAAY,EAAQ,EAAW,EAAe,CACnD,EACA,QACA,EACA,KAAK,aAAa,EAAM,CACxB,aAAiB,MAAQ,EAAM,QAAU,OAAO,EAAM,CACvD,CACD,IAAM,EAAY,KAAK,YAAY,EAAO,EAAQ,CAClD,GAAI,CAAC,GAAa,GAAW,KAAK,YAChC,MAAO,CACL,QAAS,GACT,MAAO,CACL,KAAM,KAAK,aAAa,EAAM,CAC9B,QACE,aAAiB,MAAQ,EAAM,QAAU,OAAO,EAAM,CACxD,YACA,MAAO,EACR,CACD,SAAU,CACR,UAAW,EACX,aAAc,EAAY,WAAW,KAAK,GAC1C,cAAe,EAAY,WAAW,cACtC,SAAU,EACX,CACF,CAEH,MAAM,KAAK,MAAM,KAAK,UAAU,EAKpC,MAAO,CACL,QAAS,GACT,MAAO,CACL,KAAM,gBACN,QAAS,yCACT,UAAW,GACZ,CACD,SAAU,CACR,UAAW,EAAY,KAAK,CAAG,EAC/B,aAAc,EAAY,WAAW,KAAK,GAC1C,cAAe,EAAY,WAAW,cACtC,SAAU,KAAK,YAChB,CACF,CAGH,gBACE,EACA,EACiC,CACjC,OAAO,EAAO,aAAa,KACxB,GAAgB,EAAY,KAAK,SAAW,EAC9C,CAGH,MAAc,aACZ,EACiC,CACjC,GAAI,CAAC,KAAK,eAAe,UAAU,EAAW,UAAU,CACtD,MAAU,MACR,oBAAoB,KAAK,eAAe,GAAG,6BAA6B,EAAW,UAAU,IAC9F,CAEH,IAAM,EAAS,MAAM,KAAK,eAAe,UAAU,EAAW,UAAU,CACxE,OAAO,KAAK,YAAY,EAAO,CAGjC,YAAoB,EAA6C,CAC/D,IAAM,EAAO,IAAI,aAAa,CAAC,OAAO,EAAO,KAAK,CAClD,GAAI,CACF,IAAM,EAAS,KAAK,MAAM,EAAK,CAC/B,GACE,GACA,OAAO,GAAW,UAClB,CAAC,MAAM,QAAQ,EAAO,CACtB,CACA,IAAM,EAAU,OAAO,QAAQ,EAAO,CAAC,QACpC,EAAG,KACF,OAAO,GAAU,UACjB,OAAO,GAAU,UACjB,OAAO,GAAU,UACpB,CACD,OAAO,OAAO,YACZ,EAAQ,KAAK,CAAC,EAAK,KAAW,CAAC,EAAK,OAAO,EAAM,CAAC,CAAC,CACpD,OAEG,EAGR,MAAO,CAAE,OAAQ,EAAM,CAGzB,cACE,EACA,EACA,EACA,EACA,EACA,EACA,CACI,CAAC,KAAK,WAAa,CAAC,GACxB,KAAK,UAAU,OAAO,CACpB,SAAU,EAAQ,SAClB,MAAO,EAAQ,MACf,YAAa,EAAQ,YACrB,OAAQ,EAAQ,OAChB,eAAgB,EAAY,WAAW,KAAK,eAC5C,mBAAoB,EAAY,WAAW,KAAK,mBAChD,aAAc,EAAY,WAAW,KAAK,GAC1C,SACA,aACA,YACA,eACA,WAAY,KAAK,KAAK,CACtB,SAAU,CACR,UAAW,GAAG,EAAQ,cAAc,IAAI,EAAQ,mBAChD,cAAe,EAAQ,cACvB,UAAW,EAAQ,UACpB,CACF,CAAC,CAGJ,QACE,EACA,EACA,EACA,EAC0B,CAW1B,OAVI,GACF,KAAK,cACH,EACA,EACA,QACA,EACA,EAAM,KACN,EAAM,QACP,CAEI,CACL,QAAS,GACT,QACA,SAAU,CACR,UAAW,EACX,aAAc,GAAa,WAAW,KAAK,IAAM,UACjD,cACE,GAAa,WAAW,eAAiB,UAC3C,WACD,CACF,CAGH,YACE,EACA,EACA,EACwB,CACxB,MAAO,CACL,SAAU,EAAO,SACjB,MAAO,EAAO,MACd,YAAa,EAAO,YACpB,cAAe,EAAO,cACtB,iBAAkB,EAAO,iBACzB,cAAe,EAAO,cACtB,SACA,YACD,CAGH,aAAqB,EAAwB,CAS3C,OAPE,OAAO,GAAU,UACjB,GACA,SAAU,GACV,OAAQ,EAA6B,MAAS,SAEtC,EAA2B,KAE9B,mBAIX,SAAgB,EACd,EACM,CACN,IAAM,EAAS,EAAY,WAAW,OACtC,GAAI,IAAW,gBAAkB,IAAW,QAC1C,MAAU,MACR,2BAA2B,EAAY,WAAW,KAAK,MAAM,kBAAkB,EAAO,IACvF,CAIL,SAAgB,EAAsB,EAAkC,CACtE,OAAQ,EAAR,CACE,IAAK,YACH,MAAO,YACT,IAAK,eACH,MAAO,eACT,IAAK,QACH,MAAO,QACT,IAAK,UACL,QACE,MAAO"}

package/dist/integrations/secrets/env-secret-provider.d.ts

@@ -0,0 +1,32 @@
+import { SecretProvider, SecretReference, SecretRotationResult, SecretValue, SecretWritePayload } from "./provider.js";
+
+//#region src/integrations/secrets/env-secret-provider.d.ts
+interface EnvSecretProviderOptions {
+  /**
+   * Optional map to alias secret references to environment variable names.
+   * Useful when referencing secrets from other providers (e.g. gcp://...)
+   * while still allowing local overrides.
+   */
+  aliases?: Record<string, string>;
+}
+/**
+ * Environment-variable backed secret provider. Read-only by design.
+ * Allows overriding other secret providers by deriving environment variable
+ * names from secret references (or by using explicit aliases).
+ */
+declare class EnvSecretProvider implements SecretProvider {
+  readonly id = "env";
+  private readonly aliases;
+  constructor(options?: EnvSecretProviderOptions);
+  canHandle(reference: SecretReference): boolean;
+  getSecret(reference: SecretReference): Promise<SecretValue>;
+  setSecret(reference: SecretReference, _payload: SecretWritePayload): Promise<SecretRotationResult>;
+  rotateSecret(reference: SecretReference, _payload: SecretWritePayload): Promise<SecretRotationResult>;
+  deleteSecret(reference: SecretReference): Promise<void>;
+  private resolveEnvKey;
+  private deriveEnvKey;
+  private forbiddenError;
+}
+//#endregion
+export { EnvSecretProvider };
+//# sourceMappingURL=env-secret-provider.d.ts.map

package/dist/integrations/secrets/env-secret-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-secret-provider.d.ts","names":[],"sources":["../../../src/integrations/secrets/env-secret-provider.ts"],"sourcesContent":[],"mappings":";;;UASU,wBAAA;;AAFU;AAgBpB;;;EAc6B,OAAA,CAAA,EAtBjB,MAsBiB,CAAA,MAAA,EAAA,MAAA,CAAA;;;;;;;AAwCd,cAtDF,iBAAA,YAA6B,cAsD3B,CAAA;EACD,SAAA,EAAA,GAAA,KAAA;EACD,iBAAA,OAAA;EAAR,WAAA,CAAA,OAAA,CAAA,EAnDkB,wBAmDlB;EAI2B,SAAA,CAAA,SAAA,EAnDT,eAmDS,CAAA,EAAA,OAAA;EAAkB,SAAA,CAAA,SAAA,EA9CrB,eA8CqB,CAAA,EA9CH,OA8CG,CA9CK,WA8CL,CAAA;EA5DR,SAAA,CAAA,SAAA,EA+C3B,eA/C2B,EAAA,QAAA,EAgD5B,kBAhD4B,CAAA,EAiDrC,OAjDqC,CAiD7B,oBAjD6B,CAAA;EAAc,YAAA,CAAA,SAAA,EAsDzC,eAtDyC,EAAA,QAAA,EAuD1C,kBAvD0C,CAAA,EAwDnD,OAxDmD,CAwD3C,oBAxD2C,CAAA;0BA4DxB,kBAAkB"}

package/dist/integrations/secrets/env-secret-provider.js

@@ -0,0 +1,2 @@
+import{SecretProviderError as e,parseSecretUri as t}from"./provider.js";var n=class{id=`env`;aliases;constructor(e={}){this.aliases=e.aliases??{}}canHandle(e){let t=this.resolveEnvKey(e);return t!==void 0&&process.env[t]!==void 0}async getSecret(t){let n=this.resolveEnvKey(t);if(!n)throw new e({message:`Unable to resolve environment variable for reference "${t}".`,provider:this.id,reference:t,code:`INVALID`});let r=process.env[n];if(r===void 0)throw new e({message:`Environment variable "${n}" not found for reference "${t}".`,provider:this.id,reference:t,code:`NOT_FOUND`});return{data:Buffer.from(r,`utf-8`),version:`current`,metadata:{source:`env`,envKey:n},retrievedAt:new Date}}async setSecret(e,t){throw this.forbiddenError(`setSecret`,e)}async rotateSecret(e,t){throw this.forbiddenError(`rotateSecret`,e)}async deleteSecret(e){throw this.forbiddenError(`deleteSecret`,e)}resolveEnvKey(e){if(e){if(this.aliases[e])return this.aliases[e];if(!e.includes(`://`))return e;try{let n=t(e);return n.provider===`env`?n.path:n.extras?.env?n.extras.env:this.deriveEnvKey(n.path)}catch{return e}}}deriveEnvKey(e){if(e)return e.split(/[\/:\-\.]/).filter(Boolean).map(e=>e.replace(/[^a-zA-Z0-9]/g,`_`).replace(/_{2,}/g,`_`).toUpperCase()).join(`_`)}forbiddenError(t,n){return new e({message:`EnvSecretProvider is read-only. "${t}" is not allowed for ${n}.`,provider:this.id,reference:n,code:`FORBIDDEN`})}};export{n as EnvSecretProvider};
+//# sourceMappingURL=env-secret-provider.js.map

package/dist/integrations/secrets/env-secret-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-secret-provider.js","names":[],"sources":["../../../src/integrations/secrets/env-secret-provider.ts"],"sourcesContent":["import { parseSecretUri, SecretProviderError } from './provider';\nimport type {\n  SecretProvider,\n  SecretReference,\n  SecretRotationResult,\n  SecretValue,\n  SecretWritePayload,\n} from './provider';\n\ninterface EnvSecretProviderOptions {\n  /**\n   * Optional map to alias secret references to environment variable names.\n   * Useful when referencing secrets from other providers (e.g. gcp://...)\n   * while still allowing local overrides.\n   */\n  aliases?: Record<string, string>;\n}\n\n/**\n * Environment-variable backed secret provider. Read-only by design.\n * Allows overriding other secret providers by deriving environment variable\n * names from secret references (or by using explicit aliases).\n */\nexport class EnvSecretProvider implements SecretProvider {\n  readonly id = 'env';\n\n  private readonly aliases: Record<string, string>;\n\n  constructor(options: EnvSecretProviderOptions = {}) {\n    this.aliases = options.aliases ?? {};\n  }\n\n  canHandle(reference: SecretReference): boolean {\n    const envKey = this.resolveEnvKey(reference);\n    return envKey !== undefined && process.env[envKey] !== undefined;\n  }\n\n  async getSecret(reference: SecretReference): Promise<SecretValue> {\n    const envKey = this.resolveEnvKey(reference);\n    if (!envKey) {\n      throw new SecretProviderError({\n        message: `Unable to resolve environment variable for reference \"${reference}\".`,\n        provider: this.id,\n        reference,\n        code: 'INVALID',\n      });\n    }\n\n    const value = process.env[envKey];\n    if (value === undefined) {\n      throw new SecretProviderError({\n        message: `Environment variable \"${envKey}\" not found for reference \"${reference}\".`,\n        provider: this.id,\n        reference,\n        code: 'NOT_FOUND',\n      });\n    }\n\n    return {\n      data: Buffer.from(value, 'utf-8'),\n      version: 'current',\n      metadata: {\n        source: 'env',\n        envKey,\n      },\n      retrievedAt: new Date(),\n    };\n  }\n\n  async setSecret(\n    reference: SecretReference,\n    _payload: SecretWritePayload\n  ): Promise<SecretRotationResult> {\n    throw this.forbiddenError('setSecret', reference);\n  }\n\n  async rotateSecret(\n    reference: SecretReference,\n    _payload: SecretWritePayload\n  ): Promise<SecretRotationResult> {\n    throw this.forbiddenError('rotateSecret', reference);\n  }\n\n  async deleteSecret(reference: SecretReference): Promise<void> {\n    throw this.forbiddenError('deleteSecret', reference);\n  }\n\n  private resolveEnvKey(reference: SecretReference): string | undefined {\n    if (!reference) {\n      return undefined;\n    }\n\n    if (this.aliases[reference]) {\n      return this.aliases[reference];\n    }\n\n    if (!reference.includes('://')) {\n      return reference;\n    }\n\n    try {\n      const parsed = parseSecretUri(reference);\n      if (parsed.provider === 'env') {\n        return parsed.path;\n      }\n\n      if (parsed.extras?.env) {\n        return parsed.extras.env;\n      }\n\n      return this.deriveEnvKey(parsed.path);\n    } catch {\n      return reference;\n    }\n  }\n\n  private deriveEnvKey(path: string): string | undefined {\n    if (!path) return undefined;\n    return path\n      .split(/[\\/:\\-\\.]/)\n      .filter(Boolean)\n      .map((segment) =>\n        segment\n          .replace(/[^a-zA-Z0-9]/g, '_')\n          .replace(/_{2,}/g, '_')\n          .toUpperCase()\n      )\n      .join('_');\n  }\n\n  private forbiddenError(\n    operation: string,\n    reference: SecretReference\n  ): SecretProviderError {\n    return new SecretProviderError({\n      message: `EnvSecretProvider is read-only. \"${operation}\" is not allowed for ${reference}.`,\n      provider: this.id,\n      reference,\n      code: 'FORBIDDEN',\n    });\n  }\n}\n\n\n"],"mappings":"wEAuBA,IAAa,EAAb,KAAyD,CACvD,GAAc,MAEd,QAEA,YAAY,EAAoC,EAAE,CAAE,CAClD,KAAK,QAAU,EAAQ,SAAW,EAAE,CAGtC,UAAU,EAAqC,CAC7C,IAAM,EAAS,KAAK,cAAc,EAAU,CAC5C,OAAO,IAAW,IAAA,IAAa,QAAQ,IAAI,KAAY,IAAA,GAGzD,MAAM,UAAU,EAAkD,CAChE,IAAM,EAAS,KAAK,cAAc,EAAU,CAC5C,GAAI,CAAC,EACH,MAAM,IAAI,EAAoB,CAC5B,QAAS,yDAAyD,EAAU,IAC5E,SAAU,KAAK,GACf,YACA,KAAM,UACP,CAAC,CAGJ,IAAM,EAAQ,QAAQ,IAAI,GAC1B,GAAI,IAAU,IAAA,GACZ,MAAM,IAAI,EAAoB,CAC5B,QAAS,yBAAyB,EAAO,6BAA6B,EAAU,IAChF,SAAU,KAAK,GACf,YACA,KAAM,YACP,CAAC,CAGJ,MAAO,CACL,KAAM,OAAO,KAAK,EAAO,QAAQ,CACjC,QAAS,UACT,SAAU,CACR,OAAQ,MACR,SACD,CACD,YAAa,IAAI,KAClB,CAGH,MAAM,UACJ,EACA,EAC+B,CAC/B,MAAM,KAAK,eAAe,YAAa,EAAU,CAGnD,MAAM,aACJ,EACA,EAC+B,CAC/B,MAAM,KAAK,eAAe,eAAgB,EAAU,CAGtD,MAAM,aAAa,EAA2C,CAC5D,MAAM,KAAK,eAAe,eAAgB,EAAU,CAGtD,cAAsB,EAAgD,CAC/D,KAIL,IAAI,KAAK,QAAQ,GACf,OAAO,KAAK,QAAQ,GAGtB,GAAI,CAAC,EAAU,SAAS,MAAM,CAC5B,OAAO,EAGT,GAAI,CACF,IAAM,EAAS,EAAe,EAAU,CASxC,OARI,EAAO,WAAa,MACf,EAAO,KAGZ,EAAO,QAAQ,IACV,EAAO,OAAO,IAGhB,KAAK,aAAa,EAAO,KAAK,MAC/B,CACN,OAAO,IAIX,aAAqB,EAAkC,CAChD,KACL,OAAO,EACJ,MAAM,YAAY,CAClB,OAAO,QAAQ,CACf,IAAK,GACJ,EACG,QAAQ,gBAAiB,IAAI,CAC7B,QAAQ,SAAU,IAAI,CACtB,aAAa,CACjB,CACA,KAAK,IAAI,CAGd,eACE,EACA,EACqB,CACrB,OAAO,IAAI,EAAoB,CAC7B,QAAS,oCAAoC,EAAU,uBAAuB,EAAU,GACxF,SAAU,KAAK,GACf,YACA,KAAM,YACP,CAAC"}

package/dist/integrations/secrets/gcp-secret-manager.d.ts

@@ -0,0 +1,33 @@
+import { SecretProvider, SecretReference, SecretRotationResult, SecretValue, SecretWritePayload } from "./provider.js";
+import { SecretManagerServiceClient, protos } from "@google-cloud/secret-manager";
+import { CallOptions } from "google-gax";
+
+//#region src/integrations/secrets/gcp-secret-manager.d.ts
+type SecretManagerClient = SecretManagerServiceClient;
+interface GcpSecretManagerProviderOptions {
+  projectId?: string;
+  client?: SecretManagerClient;
+  clientOptions?: ConstructorParameters<typeof SecretManagerServiceClient>[0];
+  defaultReplication?: protos.google.cloud.secretmanager.v1.IReplication;
+}
+declare class GcpSecretManagerProvider implements SecretProvider {
+  readonly id = "gcp-secret-manager";
+  private readonly client;
+  private readonly explicitProjectId?;
+  private readonly replication;
+  constructor(options?: GcpSecretManagerProviderOptions);
+  canHandle(reference: SecretReference): boolean;
+  getSecret(reference: SecretReference, options?: {
+    version?: string;
+  }, callOptions?: CallOptions): Promise<SecretValue>;
+  setSecret(reference: SecretReference, payload: SecretWritePayload): Promise<SecretRotationResult>;
+  rotateSecret(reference: SecretReference, payload: SecretWritePayload): Promise<SecretRotationResult>;
+  deleteSecret(reference: SecretReference): Promise<void>;
+  private parseReference;
+  private buildNames;
+  private buildVersionName;
+  private ensureSecretExists;
+}
+//#endregion
+export { GcpSecretManagerProvider };
+//# sourceMappingURL=gcp-secret-manager.d.ts.map

package/dist/integrations/secrets/gcp-secret-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gcp-secret-manager.d.ts","names":[],"sources":["../../../src/integrations/secrets/gcp-secret-manager.ts"],"sourcesContent":[],"mappings":";;;;;KAYK,mBAAA,GAAsB;UAEjB,+BAAA;EAFL,SAAA,CAAA,EAAA,MAAA;EAEK,MAAA,CAAA,EAEC,mBAFD;EAEC,aAAA,CAAA,EACO,qBADP,CAAA,OACoC,0BADpC,CAAA,CAAA,CAAA,CAAA;EACoC,kBAAA,CAAA,EACxB,MAAA,CAAO,MAAA,CAAO,KAAA,CAAM,aAAA,CAAc,EAAA,CAAG,YADb;;AACxB,cAaV,wBAAA,YAAoC,cAbW,CAAA;EAAY,SAAA,EAAA,GAAA,oBAAA;EAa3D,iBAAA,MAAA;EAMU,iBAAA,iBAAA;EAQA,iBAAA,WAAA;EAUR,WAAA,CAAA,OAAA,CAAA,EAlBQ,+BAkBR;EAEG,SAAA,CAAA,SAAA,EAZK,eAYL,CAAA,EAAA,OAAA;EACL,SAAA,CAAA,SAAA,EAHE,eAGF,EAAA,OAyCE,CAzCF,EAAA;IAAR,OAAA,CAAA,EAAA,MAAA;EAyCU,CAAA,EAAA,WAAA,CAAA,EA1CG,WA0CH,CAAA,EAzCV,OAyCU,CAzCF,WAyCE,CAAA;EACF,SAAA,CAAA,SAAA,EADE,eACF,EAAA,OAAA,EAAA,kBAAA,CAAA,EACR,OADQ,CACA,oBADA,CAAA;EACA,YAAA,CAAA,SAAA,EAsCE,eAtCF,EAAA,OAAA,EAuCA,kBAvCA,CAAA,EAwCR,OAxCQ,CAwCA,oBAxCA,CAAA;EAAR,YAAA,CAAA,SAAA,EA4C2B,eA5C3B,CAAA,EA4C6C,OA5C7C,CAAA,IAAA,CAAA;EAsCU,QAAA,cAAA;EACF,QAAA,UAAA;EACA,QAAA,gBAAA;EAAR,QAAA,kBAAA"}

package/dist/integrations/secrets/gcp-secret-manager.js

@@ -0,0 +1,2 @@
+import{SecretProviderError as e,normalizeSecretPayload as t,parseSecretUri as n}from"./provider.js";import{SecretManagerServiceClient as r,protos as i}from"@google-cloud/secret-manager";const a={automatic:{}};var o=class{id=`gcp-secret-manager`;client;explicitProjectId;replication;constructor(e={}){this.client=e.client??new r(e.clientOptions??{}),this.explicitProjectId=e.projectId,this.replication=e.defaultReplication??a}canHandle(e){try{return n(e).provider===`gcp`}catch{return!1}}async getSecret(t,n,r){let i=this.parseReference(t),a=this.buildVersionName(i,n?.version);try{let[n]=await this.client.accessSecretVersion({name:a},r??{}),i=n.payload;if(!i?.data)throw new e({message:`Secret payload empty for ${a}`,provider:this.id,reference:t,code:`UNKNOWN`});let o=s(n.name??a);return{data:i.data,version:o,metadata:i.dataCrc32c?{crc32c:i.dataCrc32c.toString()}:void 0,retrievedAt:new Date}}catch(e){throw c({error:e,provider:this.id,reference:t,operation:`access`})}}async setSecret(n,r){let i=this.parseReference(n),{secretName:a}=this.buildNames(i),o=t(r);await this.ensureSecretExists(i,r);try{let t=await this.client.addSecretVersion({parent:a,payload:{data:o}});if(!t)throw new e({message:`No version returned when adding secret version for ${a}`,provider:this.id,reference:n,code:`UNKNOWN`});let[r]=t,i=r?.name??`${a}/versions/latest`;return{reference:`gcp://${i}`,version:s(i)??`latest`}}catch(e){throw c({error:e,provider:this.id,reference:n,operation:`addSecretVersion`})}}async rotateSecret(e,t){return this.setSecret(e,t)}async deleteSecret(e){let t=this.parseReference(e),{secretName:n}=this.buildNames(t);try{await this.client.deleteSecret({name:n})}catch(t){throw c({error:t,provider:this.id,reference:e,operation:`delete`})}}parseReference(t){let r=n(t);if(r.provider!==`gcp`)throw new e({message:`Unsupported secret provider: ${r.provider}`,provider:this.id,reference:t,code:`INVALID`});let i=r.path.split(`/`).filter(Boolean);if(i.length<4||i[0]!==`projects`)throw new e({message:`Expected secret reference format gcp://projects/{project}/secrets/{secret}[(/versions/{version})] but received "${r.path}"`,provider:this.id,reference:t,code:`INVALID`});let a=i[1]??this.explicitProjectId;if(!a)throw new e({message:`Unable to resolve project or secret from reference "${r.path}"`,provider:this.id,reference:t,code:`INVALID`});let o=i.indexOf(`secrets`);if(o===-1||o+1>=i.length)throw new e({message:`Unable to resolve project or secret from reference "${r.path}"`,provider:this.id,reference:t,code:`INVALID`});let s=a,c=i[o+1];if(!c)throw new e({message:`Unable to resolve secret ID from reference "${r.path}"`,provider:this.id,reference:t,code:`INVALID`});let l=c,u=i.indexOf(`versions`);return{projectId:s,secretId:l,version:r.extras?.version??(u!==-1&&u+1<i.length?i[u+1]:void 0)}}buildNames(t){let n=t.projectId??this.explicitProjectId;if(!n)throw new e({message:`Project ID must be provided either in reference or provider configuration`,provider:this.id,reference:`gcp://projects//secrets/${t.secretId}`,code:`INVALID`});let r=`projects/${n}`;return{projectParent:r,secretName:`${r}/secrets/${t.secretId}`}}buildVersionName(e,t){let{secretName:n}=this.buildNames(e);return`${n}/versions/${t??e.version??`latest`}`}async ensureSecretExists(e,t){let{secretName:n,projectParent:r}=this.buildNames(e);try{await this.client.getSecret({name:n})}catch(i){let a=c({error:i,provider:this.id,reference:`gcp://${n}`,operation:`getSecret`,suppressThrow:!0});if(!a||a.code!==`NOT_FOUND`)throw a||i;try{await this.client.createSecret({parent:r,secretId:e.secretId,secret:{replication:this.replication,labels:t.labels}})}catch(e){throw c({error:e,provider:this.id,reference:`gcp://${n}`,operation:`createSecret`})}}}};function s(e){let t=e.split(`/`).filter(Boolean),n=t.indexOf(`versions`);if(!(n===-1||n+1>=t.length))return t[n+1]}function c(t){let{error:n,provider:r,reference:i,operation:a,suppressThrow:o}=t;if(n instanceof e)return n;let s=l(n),c=new e({message:n instanceof Error?n.message:`Unknown error during ${a}`,provider:r,reference:i,code:s,cause:n});if(o)return c;throw c}function l(e){if(typeof e!=`object`||!e)return`UNKNOWN`;let t=e.code;return t===5||t===`NOT_FOUND`?`NOT_FOUND`:t===6||t===`ALREADY_EXISTS`?`INVALID`:t===7||t===`PERMISSION_DENIED`||t===403?`FORBIDDEN`:t===3||t===`INVALID_ARGUMENT`?`INVALID`:`UNKNOWN`}export{o as GcpSecretManagerProvider};
+//# sourceMappingURL=gcp-secret-manager.js.map

package/dist/integrations/secrets/gcp-secret-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gcp-secret-manager.js","names":["DEFAULT_REPLICATION: protos.google.cloud.secretmanager.v1.IReplication"],"sources":["../../../src/integrations/secrets/gcp-secret-manager.ts"],"sourcesContent":["import { protos, SecretManagerServiceClient } from '@google-cloud/secret-manager';\nimport type { CallOptions } from 'google-gax';\n\nimport { normalizeSecretPayload, parseSecretUri, SecretProviderError } from './provider';\nimport type {\n  SecretProvider,\n  SecretReference,\n  SecretRotationResult,\n  SecretValue,\n  SecretWritePayload,\n} from './provider';\n\ntype SecretManagerClient = SecretManagerServiceClient;\n\ninterface GcpSecretManagerProviderOptions {\n  projectId?: string;\n  client?: SecretManagerClient;\n  clientOptions?: ConstructorParameters<typeof SecretManagerServiceClient>[0];\n  defaultReplication?: protos.google.cloud.secretmanager.v1.IReplication;\n}\n\ninterface GcpSecretLocation {\n  projectId: string;\n  secretId: string;\n  version?: string;\n}\n\nconst DEFAULT_REPLICATION: protos.google.cloud.secretmanager.v1.IReplication = {\n  automatic: {},\n};\n\nexport class GcpSecretManagerProvider implements SecretProvider {\n  readonly id = 'gcp-secret-manager';\n  private readonly client: SecretManagerClient;\n  private readonly explicitProjectId?: string;\n  private readonly replication: protos.google.cloud.secretmanager.v1.IReplication;\n\n  constructor(options: GcpSecretManagerProviderOptions = {}) {\n    this.client =\n      options.client ??\n      new SecretManagerServiceClient(options.clientOptions ?? {});\n    this.explicitProjectId = options.projectId;\n    this.replication = options.defaultReplication ?? DEFAULT_REPLICATION;\n  }\n\n  canHandle(reference: SecretReference): boolean {\n    try {\n      const parsed = parseSecretUri(reference);\n      return parsed.provider === 'gcp';\n    } catch {\n      return false;\n    }\n  }\n\n  async getSecret(\n    reference: SecretReference,\n    options?: { version?: string },\n    callOptions?: CallOptions\n  ): Promise<SecretValue> {\n    const location = this.parseReference(reference);\n    const secretVersionName = this.buildVersionName(location, options?.version);\n    try {\n      const response = await this.client.accessSecretVersion(\n        {\n          name: secretVersionName,\n        },\n        callOptions ?? {}\n      );\n      const [result] = response;\n      const payload = result.payload;\n      if (!payload?.data) {\n        throw new SecretProviderError({\n          message: `Secret payload empty for ${secretVersionName}`,\n          provider: this.id,\n          reference,\n          code: 'UNKNOWN',\n        });\n      }\n\n      const version = extractVersionFromName(result.name ?? secretVersionName);\n      return {\n        data: payload.data as Uint8Array,\n        version,\n        metadata: payload.dataCrc32c\n          ? { crc32c: payload.dataCrc32c.toString() }\n          : undefined,\n        retrievedAt: new Date(),\n      };\n    } catch (error) {\n      throw toSecretProviderError({\n        error,\n        provider: this.id,\n        reference,\n        operation: 'access',\n      });\n    }\n  }\n\n  async setSecret(\n    reference: SecretReference,\n    payload: SecretWritePayload\n  ): Promise<SecretRotationResult> {\n    const location = this.parseReference(reference);\n    const { secretName } = this.buildNames(location);\n    const data = normalizeSecretPayload(payload);\n    await this.ensureSecretExists(location, payload);\n\n    try {\n      const response = await this.client.addSecretVersion({\n        parent: secretName,\n        payload: {\n          data,\n        },\n      });\n      if (!response) {\n        throw new SecretProviderError({\n          message: `No version returned when adding secret version for ${secretName}`,\n          provider: this.id,\n          reference,\n          code: 'UNKNOWN',\n        });\n      }\n      const [version] = response;\n      const versionName = version?.name ?? `${secretName}/versions/latest`;\n      return {\n        reference: `gcp://${versionName}`,\n        version: extractVersionFromName(versionName) ?? 'latest',\n      };\n    } catch (error) {\n      throw toSecretProviderError({\n        error,\n        provider: this.id,\n        reference,\n        operation: 'addSecretVersion',\n      });\n    }\n  }\n\n  async rotateSecret(\n    reference: SecretReference,\n    payload: SecretWritePayload\n  ): Promise<SecretRotationResult> {\n    return this.setSecret(reference, payload);\n  }\n\n  async deleteSecret(reference: SecretReference): Promise<void> {\n    const location = this.parseReference(reference);\n    const { secretName } = this.buildNames(location);\n    try {\n      await this.client.deleteSecret({\n        name: secretName,\n      });\n    } catch (error) {\n      throw toSecretProviderError({\n        error,\n        provider: this.id,\n        reference,\n        operation: 'delete',\n      });\n    }\n  }\n\n  private parseReference(reference: SecretReference): GcpSecretLocation {\n    const parsed = parseSecretUri(reference);\n    if (parsed.provider !== 'gcp') {\n      throw new SecretProviderError({\n        message: `Unsupported secret provider: ${parsed.provider}`,\n        provider: this.id,\n        reference,\n        code: 'INVALID',\n      });\n    }\n\n    const segments = parsed.path.split('/').filter(Boolean);\n    if (segments.length < 4 || segments[0] !== 'projects') {\n      throw new SecretProviderError({\n        message: `Expected secret reference format gcp://projects/{project}/secrets/{secret}[(/versions/{version})] but received \"${parsed.path}\"`,\n        provider: this.id,\n        reference,\n        code: 'INVALID',\n      });\n    }\n\n    const projectIdCandidate = segments[1] ?? this.explicitProjectId;\n    if (!projectIdCandidate) {\n      throw new SecretProviderError({\n        message: `Unable to resolve project or secret from reference \"${parsed.path}\"`,\n        provider: this.id,\n        reference,\n        code: 'INVALID',\n      });\n    }\n\n    const indexOfSecrets = segments.indexOf('secrets');\n    if (indexOfSecrets === -1 || indexOfSecrets + 1 >= segments.length) {\n      throw new SecretProviderError({\n        message: `Unable to resolve project or secret from reference \"${parsed.path}\"`,\n        provider: this.id,\n        reference,\n        code: 'INVALID',\n      });\n    }\n\n    const resolvedProjectId = projectIdCandidate;\n    const secretIdCandidate = segments[indexOfSecrets + 1];\n    if (!secretIdCandidate) {\n      throw new SecretProviderError({\n        message: `Unable to resolve secret ID from reference \"${parsed.path}\"`,\n        provider: this.id,\n        reference,\n        code: 'INVALID',\n      });\n    }\n    const secretId = secretIdCandidate;\n    const indexOfVersions = segments.indexOf('versions');\n    const version =\n      parsed.extras?.version ??\n      (indexOfVersions !== -1 && indexOfVersions + 1 < segments.length\n        ? segments[indexOfVersions + 1]\n        : undefined);\n\n    return {\n      projectId: resolvedProjectId,\n      secretId,\n      version,\n    };\n  }\n\n  private buildNames(location: GcpSecretLocation): {\n    secretName: string;\n    projectParent: string;\n  } {\n    const projectId = location.projectId ?? this.explicitProjectId;\n    if (!projectId) {\n      throw new SecretProviderError({\n        message: 'Project ID must be provided either in reference or provider configuration',\n        provider: this.id,\n        reference: `gcp://projects//secrets/${location.secretId}`,\n        code: 'INVALID',\n      });\n    }\n\n    const projectParent = `projects/${projectId}`;\n    const secretName = `${projectParent}/secrets/${location.secretId}`;\n    return {\n      projectParent,\n      secretName,\n    };\n  }\n\n  private buildVersionName(\n    location: GcpSecretLocation,\n    explicitVersion?: string\n  ): string {\n    const { secretName } = this.buildNames(location);\n    const version = explicitVersion ?? location.version ?? 'latest';\n    return `${secretName}/versions/${version}`;\n  }\n\n  private async ensureSecretExists(\n    location: GcpSecretLocation,\n    payload: SecretWritePayload\n  ): Promise<void> {\n    const { secretName, projectParent } = this.buildNames(location);\n    try {\n      await this.client.getSecret({ name: secretName });\n    } catch (error) {\n      const providerError = toSecretProviderError({\n        error,\n        provider: this.id,\n        reference: `gcp://${secretName}`,\n        operation: 'getSecret',\n        suppressThrow: true,\n      });\n      if (!providerError || providerError.code !== 'NOT_FOUND') {\n        if (providerError) {\n          throw providerError;\n        }\n        throw error;\n      }\n      try {\n        await this.client.createSecret({\n          parent: projectParent,\n          secretId: location.secretId,\n          secret: {\n            replication: this.replication,\n            labels: payload.labels,\n          },\n        });\n      } catch (creationError) {\n        const creationProviderError = toSecretProviderError({\n          error: creationError,\n          provider: this.id,\n          reference: `gcp://${secretName}`,\n          operation: 'createSecret',\n        });\n        throw creationProviderError;\n      }\n    }\n  }\n}\n\nfunction extractVersionFromName(name: string): string | undefined {\n  const segments = name.split('/').filter(Boolean);\n  const index = segments.indexOf('versions');\n  if (index === -1 || index + 1 >= segments.length) {\n    return undefined;\n  }\n  return segments[index + 1];\n}\n\nfunction toSecretProviderError(params: {\n  error: unknown;\n  provider: string;\n  reference: SecretReference;\n  operation: string;\n  suppressThrow?: boolean;\n}): SecretProviderError {\n  const { error, provider, reference, operation, suppressThrow } = params;\n  if (error instanceof SecretProviderError) {\n    return error;\n  }\n\n  const code = deriveErrorCode(error);\n  const message =\n    error instanceof Error ? error.message : `Unknown error during ${operation}`;\n\n  const providerError = new SecretProviderError({\n    message,\n    provider,\n    reference,\n    code,\n    cause: error,\n  });\n\n  if (suppressThrow) {\n    return providerError;\n  }\n\n  throw providerError;\n}\n\nfunction deriveErrorCode(error: unknown): SecretProviderError['code'] {\n  if (typeof error !== 'object' || error === null) {\n    return 'UNKNOWN';\n  }\n\n  const errorAny = error as { code?: number | string };\n  const code = errorAny.code;\n  if (code === 5 || code === 'NOT_FOUND') return 'NOT_FOUND';\n  if (code === 6 || code === 'ALREADY_EXISTS') return 'INVALID';\n  if (code === 7 || code === 'PERMISSION_DENIED' || code === 403) {\n    return 'FORBIDDEN';\n  }\n  if (code === 3 || code === 'INVALID_ARGUMENT') return 'INVALID';\n  return 'UNKNOWN';\n}\n\n\n"],"mappings":"0LA2BA,MAAMA,EAAyE,CAC7E,UAAW,EAAE,CACd,CAED,IAAa,EAAb,KAAgE,CAC9D,GAAc,qBACd,OACA,kBACA,YAEA,YAAY,EAA2C,EAAE,CAAE,CACzD,KAAK,OACH,EAAQ,QACR,IAAI,EAA2B,EAAQ,eAAiB,EAAE,CAAC,CAC7D,KAAK,kBAAoB,EAAQ,UACjC,KAAK,YAAc,EAAQ,oBAAsB,EAGnD,UAAU,EAAqC,CAC7C,GAAI,CAEF,OADe,EAAe,EAAU,CAC1B,WAAa,WACrB,CACN,MAAO,IAIX,MAAM,UACJ,EACA,EACA,EACsB,CACtB,IAAM,EAAW,KAAK,eAAe,EAAU,CACzC,EAAoB,KAAK,iBAAiB,EAAU,GAAS,QAAQ,CAC3E,GAAI,CAOF,GAAM,CAAC,GANU,MAAM,KAAK,OAAO,oBACjC,CACE,KAAM,EACP,CACD,GAAe,EAAE,CAClB,CAEK,EAAU,EAAO,QACvB,GAAI,CAAC,GAAS,KACZ,MAAM,IAAI,EAAoB,CAC5B,QAAS,4BAA4B,IACrC,SAAU,KAAK,GACf,YACA,KAAM,UACP,CAAC,CAGJ,IAAM,EAAU,EAAuB,EAAO,MAAQ,EAAkB,CACxE,MAAO,CACL,KAAM,EAAQ,KACd,UACA,SAAU,EAAQ,WACd,CAAE,OAAQ,EAAQ,WAAW,UAAU,CAAE,CACzC,IAAA,GACJ,YAAa,IAAI,KAClB,OACM,EAAO,CACd,MAAM,EAAsB,CAC1B,QACA,SAAU,KAAK,GACf,YACA,UAAW,SACZ,CAAC,EAIN,MAAM,UACJ,EACA,EAC+B,CAC/B,IAAM,EAAW,KAAK,eAAe,EAAU,CACzC,CAAE,cAAe,KAAK,WAAW,EAAS,CAC1C,EAAO,EAAuB,EAAQ,CAC5C,MAAM,KAAK,mBAAmB,EAAU,EAAQ,CAEhD,GAAI,CACF,IAAM,EAAW,MAAM,KAAK,OAAO,iBAAiB,CAClD,OAAQ,EACR,QAAS,CACP,OACD,CACF,CAAC,CACF,GAAI,CAAC,EACH,MAAM,IAAI,EAAoB,CAC5B,QAAS,sDAAsD,IAC/D,SAAU,KAAK,GACf,YACA,KAAM,UACP,CAAC,CAEJ,GAAM,CAAC,GAAW,EACZ,EAAc,GAAS,MAAQ,GAAG,EAAW,kBACnD,MAAO,CACL,UAAW,SAAS,IACpB,QAAS,EAAuB,EAAY,EAAI,SACjD,OACM,EAAO,CACd,MAAM,EAAsB,CAC1B,QACA,SAAU,KAAK,GACf,YACA,UAAW,mBACZ,CAAC,EAIN,MAAM,aACJ,EACA,EAC+B,CAC/B,OAAO,KAAK,UAAU,EAAW,EAAQ,CAG3C,MAAM,aAAa,EAA2C,CAC5D,IAAM,EAAW,KAAK,eAAe,EAAU,CACzC,CAAE,cAAe,KAAK,WAAW,EAAS,CAChD,GAAI,CACF,MAAM,KAAK,OAAO,aAAa,CAC7B,KAAM,EACP,CAAC,OACK,EAAO,CACd,MAAM,EAAsB,CAC1B,QACA,SAAU,KAAK,GACf,YACA,UAAW,SACZ,CAAC,EAIN,eAAuB,EAA+C,CACpE,IAAM,EAAS,EAAe,EAAU,CACxC,GAAI,EAAO,WAAa,MACtB,MAAM,IAAI,EAAoB,CAC5B,QAAS,gCAAgC,EAAO,WAChD,SAAU,KAAK,GACf,YACA,KAAM,UACP,CAAC,CAGJ,IAAM,EAAW,EAAO,KAAK,MAAM,IAAI,CAAC,OAAO,QAAQ,CACvD,GAAI,EAAS,OAAS,GAAK,EAAS,KAAO,WACzC,MAAM,IAAI,EAAoB,CAC5B,QAAS,mHAAmH,EAAO,KAAK,GACxI,SAAU,KAAK,GACf,YACA,KAAM,UACP,CAAC,CAGJ,IAAM,EAAqB,EAAS,IAAM,KAAK,kBAC/C,GAAI,CAAC,EACH,MAAM,IAAI,EAAoB,CAC5B,QAAS,uDAAuD,EAAO,KAAK,GAC5E,SAAU,KAAK,GACf,YACA,KAAM,UACP,CAAC,CAGJ,IAAM,EAAiB,EAAS,QAAQ,UAAU,CAClD,GAAI,IAAmB,IAAM,EAAiB,GAAK,EAAS,OAC1D,MAAM,IAAI,EAAoB,CAC5B,QAAS,uDAAuD,EAAO,KAAK,GAC5E,SAAU,KAAK,GACf,YACA,KAAM,UACP,CAAC,CAGJ,IAAM,EAAoB,EACpB,EAAoB,EAAS,EAAiB,GACpD,GAAI,CAAC,EACH,MAAM,IAAI,EAAoB,CAC5B,QAAS,+CAA+C,EAAO,KAAK,GACpE,SAAU,KAAK,GACf,YACA,KAAM,UACP,CAAC,CAEJ,IAAM,EAAW,EACX,EAAkB,EAAS,QAAQ,WAAW,CAOpD,MAAO,CACL,UAAW,EACX,WACA,QARA,EAAO,QAAQ,UACd,IAAoB,IAAM,EAAkB,EAAI,EAAS,OACtD,EAAS,EAAkB,GAC3B,IAAA,IAML,CAGH,WAAmB,EAGjB,CACA,IAAM,EAAY,EAAS,WAAa,KAAK,kBAC7C,GAAI,CAAC,EACH,MAAM,IAAI,EAAoB,CAC5B,QAAS,4EACT,SAAU,KAAK,GACf,UAAW,2BAA2B,EAAS,WAC/C,KAAM,UACP,CAAC,CAGJ,IAAM,EAAgB,YAAY,IAElC,MAAO,CACL,gBACA,WAHiB,GAAG,EAAc,WAAW,EAAS,WAIvD,CAGH,iBACE,EACA,EACQ,CACR,GAAM,CAAE,cAAe,KAAK,WAAW,EAAS,CAEhD,MAAO,GAAG,EAAW,YADL,GAAmB,EAAS,SAAW,WAIzD,MAAc,mBACZ,EACA,EACe,CACf,GAAM,CAAE,aAAY,iBAAkB,KAAK,WAAW,EAAS,CAC/D,GAAI,CACF,MAAM,KAAK,OAAO,UAAU,CAAE,KAAM,EAAY,CAAC,OAC1C,EAAO,CACd,IAAM,EAAgB,EAAsB,CAC1C,QACA,SAAU,KAAK,GACf,UAAW,SAAS,IACpB,UAAW,YACX,cAAe,GAChB,CAAC,CACF,GAAI,CAAC,GAAiB,EAAc,OAAS,YAI3C,MAHI,GAGE,EAER,GAAI,CACF,MAAM,KAAK,OAAO,aAAa,CAC7B,OAAQ,EACR,SAAU,EAAS,SACnB,OAAQ,CACN,YAAa,KAAK,YAClB,OAAQ,EAAQ,OACjB,CACF,CAAC,OACK,EAAe,CAOtB,MAN8B,EAAsB,CAClD,MAAO,EACP,SAAU,KAAK,GACf,UAAW,SAAS,IACpB,UAAW,eACZ,CAAC,KAOV,SAAS,EAAuB,EAAkC,CAChE,IAAM,EAAW,EAAK,MAAM,IAAI,CAAC,OAAO,QAAQ,CAC1C,EAAQ,EAAS,QAAQ,WAAW,CACtC,SAAU,IAAM,EAAQ,GAAK,EAAS,QAG1C,OAAO,EAAS,EAAQ,GAG1B,SAAS,EAAsB,EAMP,CACtB,GAAM,CAAE,QAAO,WAAU,YAAW,YAAW,iBAAkB,EACjE,GAAI,aAAiB,EACnB,OAAO,EAGT,IAAM,EAAO,EAAgB,EAAM,CAI7B,EAAgB,IAAI,EAAoB,CAC5C,QAHA,aAAiB,MAAQ,EAAM,QAAU,wBAAwB,IAIjE,WACA,YACA,OACA,MAAO,EACR,CAAC,CAEF,GAAI,EACF,OAAO,EAGT,MAAM,EAGR,SAAS,EAAgB,EAA6C,CACpE,GAAI,OAAO,GAAU,WAAY,EAC/B,MAAO,UAIT,IAAM,EADW,EACK,KAOtB,OANI,IAAS,GAAK,IAAS,YAAoB,YAC3C,IAAS,GAAK,IAAS,iBAAyB,UAChD,IAAS,GAAK,IAAS,qBAAuB,IAAS,IAClD,YAEL,IAAS,GAAK,IAAS,mBAA2B,UAC/C"}

package/dist/integrations/secrets/index.d.ts

@@ -0,0 +1,5 @@
+import { ParsedSecretUri, SecretFetchOptions, SecretPayloadEncoding, SecretProvider, SecretProviderError, SecretReference, SecretRotationResult, SecretValue, SecretWritePayload, normalizeSecretPayload, parseSecretUri } from "./provider.js";
+import { GcpSecretManagerProvider } from "./gcp-secret-manager.js";
+import { EnvSecretProvider } from "./env-secret-provider.js";
+import { SecretProviderManager, SecretProviderManagerOptions } from "./manager.js";
+export { EnvSecretProvider, GcpSecretManagerProvider, ParsedSecretUri, SecretFetchOptions, SecretPayloadEncoding, SecretProvider, SecretProviderError, SecretProviderManager, SecretProviderManagerOptions, SecretReference, SecretRotationResult, SecretValue, SecretWritePayload, normalizeSecretPayload, parseSecretUri };

package/dist/integrations/secrets/index.js

@@ -0,0 +1 @@
+import{SecretProviderError as e,normalizeSecretPayload as t,parseSecretUri as n}from"./provider.js";import{GcpSecretManagerProvider as r}from"./gcp-secret-manager.js";import{EnvSecretProvider as i}from"./env-secret-provider.js";import{SecretProviderManager as a}from"./manager.js";export{i as EnvSecretProvider,r as GcpSecretManagerProvider,e as SecretProviderError,a as SecretProviderManager,t as normalizeSecretPayload,n as parseSecretUri};