@nebutra/integration-vault 0.1.0

package/dist/chunk-6YC3QBSB.js

@@ -0,0 +1,274 @@
+// src/index.ts
+import { randomUUID } from "crypto";
+import { CapabilityError } from "@nebutra/errors";
+import { LocalProvider } from "@nebutra/vault";
+import { CapabilityError as CapabilityError2 } from "@nebutra/errors";
+function requireTenant(tenantId) {
+  if (!tenantId.trim()) {
+    throw new CapabilityError("integration-vault", "Tenant context is required", {
+      suggestion: "Pass tenantId from the Sailor tenant context before starting OAuth or invoking SaaS tools.",
+      statusCode: 400
+    });
+  }
+}
+function consentKey(grant) {
+  return [grant.tenantId, grant.app, grant.action].join(":");
+}
+var InMemorySaasConsentStore = class {
+  #grants = /* @__PURE__ */ new Map();
+  async grant(grant) {
+    this.#grants.set(consentKey(grant), { ...grant, scopes: [...grant.scopes] });
+  }
+  async hasConsent(grant) {
+    const existing = this.#grants.get(consentKey(grant));
+    if (!existing) return false;
+    const scopes = new Set(existing.scopes);
+    return grant.scopes.every((scope) => scopes.has(scope));
+  }
+  async list(tenantId) {
+    return Array.from(this.#grants.values()).filter(
+      (grant) => tenantId === void 0 || grant.tenantId === tenantId
+    );
+  }
+};
+var InMemoryIntegrationProvider = class {
+  id;
+  #apps;
+  constructor(options) {
+    this.id = options.id;
+    this.#apps = new Set(options.apps);
+  }
+  supports(app) {
+    return this.#apps.has(app) || this.#apps.has("*");
+  }
+  async startOAuth(request) {
+    return {
+      provider: this.id,
+      app: request.app,
+      url: `http://127.0.0.1:8787/oauth/${request.app}?tenant=${request.tenantId}`,
+      state: `state_${request.tenantId}_${request.app}`,
+      scopes: request.scopes ?? []
+    };
+  }
+  async invoke(request, _token, _scopes) {
+    return { app: request.app, action: request.action, ...request.args };
+  }
+  async doctor() {
+    return { ok: true, provider: this.id };
+  }
+};
+var HttpIntegrationProvider = class {
+  id;
+  #baseUrl;
+  #apps;
+  #fetch;
+  constructor(options) {
+    this.id = options.id;
+    this.#baseUrl = options.baseUrl.replace(/\/$/, "");
+    this.#apps = new Set(options.apps ?? ["*"]);
+    this.#fetch = options.fetch ?? fetch;
+  }
+  supports(app) {
+    return this.#apps.has(app) || this.#apps.has("*");
+  }
+  async startOAuth(request) {
+    return {
+      provider: this.id,
+      app: request.app,
+      url: `${this.#baseUrl}/oauth/${request.app}/start?tenant=${encodeURIComponent(request.tenantId)}`,
+      state: `state_${request.tenantId}_${request.app}`,
+      scopes: request.scopes ?? []
+    };
+  }
+  async invoke(request, token) {
+    const response = await this.#fetch(`${this.#baseUrl}/invoke`, {
+      method: "POST",
+      headers: {
+        authorization: `Bearer ${token}`,
+        "content-type": "application/json"
+      },
+      body: JSON.stringify(request)
+    });
+    if (!response.ok) {
+      throw new CapabilityError(
+        "integration-vault",
+        `Provider ${this.id} returned ${response.status}`,
+        {
+          suggestion: "Run `pnpm vault:doctor` and refresh or reconnect this SaaS app.",
+          metadata: { provider: this.id, app: request.app, status: response.status }
+        }
+      );
+    }
+    return response.json();
+  }
+  async doctor() {
+    return {
+      ok: true,
+      provider: this.id,
+      suggestion: "Network health is checked on invoke; configure provider API keys in the sidecar environment."
+    };
+  }
+};
+var InMemoryConnectionStore = class {
+  #connections = /* @__PURE__ */ new Map();
+  upsert(connection) {
+    this.#connections.set(`${connection.tenantId}:${connection.app}`, connection);
+    return connection;
+  }
+  get(tenantId, app) {
+    return this.#connections.get(`${tenantId}:${app}`);
+  }
+  list(tenantId) {
+    return Array.from(this.#connections.values()).filter((connection) => connection.tenantId === tenantId).map((connection) => ({
+      id: connection.id,
+      app: connection.app,
+      provider: connection.provider,
+      tokenId: connection.tokenId,
+      scopes: connection.scopes,
+      connectedAt: connection.connectedAt
+    }));
+  }
+};
+var IntegrationVault = class _IntegrationVault {
+  #vault;
+  #providers;
+  #connections = new InMemoryConnectionStore();
+  #consent;
+  constructor(options) {
+    this.#vault = options.vault ?? new LocalProvider({
+      provider: "local",
+      masterKey: process.env.VAULT_LOCAL_MASTER_KEY ?? "integration-vault-local-development-key"
+    });
+    this.#providers = options.providers && options.providers.length > 0 ? [...options.providers] : [new InMemoryIntegrationProvider({ id: "local", apps: ["*"] })];
+    this.#consent = options.consent ?? new InMemorySaasConsentStore();
+  }
+  static local(options = {}) {
+    return new _IntegrationVault(options);
+  }
+  async startOAuth(request) {
+    requireTenant(request.tenantId);
+    return this.#providerFor(request.app).startOAuth(request);
+  }
+  async connectToken(request) {
+    requireTenant(request.tenantId);
+    const provider = request.provider ? this.#providers.find((candidate) => candidate.id === request.provider) : this.#providerFor(request.app);
+    if (!provider) {
+      throw new CapabilityError("integration-vault", "Integration provider not found", {
+        suggestion: "Configure a provider adapter before connecting this app.",
+        metadata: { app: request.app, provider: request.provider },
+        statusCode: 404
+      });
+    }
+    const tokenId = `tok_${randomUUID()}`;
+    const encrypted = await this.#vault.encrypt(request.accessToken, {
+      id: tokenId,
+      tenantId: request.tenantId,
+      metadata: { name: `${request.app}:access-token`, type: "oauth_token" }
+    });
+    const connection = this.#connections.upsert({
+      id: `conn_${randomUUID()}`,
+      tenantId: request.tenantId,
+      app: request.app,
+      provider: provider.id,
+      tokenId,
+      scopes: [...request.scopes],
+      encrypted,
+      connectedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    return this.#redact(connection);
+  }
+  async grantConsent(grant) {
+    requireTenant(grant.tenantId);
+    await this.#consent.grant(grant);
+  }
+  async invoke(request) {
+    requireTenant(request.tenantId);
+    const connection = this.#connections.get(request.tenantId, request.app);
+    if (!connection) {
+      return {
+        ok: false,
+        error: "App is not connected",
+        suggestion: `Run \`pnpm vault:connect ${request.app}\` before invoking ${request.app}.${request.action}.`
+      };
+    }
+    const hasConsent = await this.#consent.hasConsent({
+      tenantId: request.tenantId,
+      app: request.app,
+      action: request.action,
+      scopes: connection.scopes
+    });
+    if (!hasConsent) {
+      return {
+        ok: false,
+        error: "SaaS action is not authorized",
+        suggestion: `Run \`pnpm vault:connect ${request.app}\` and grant ${request.app}.${request.action} for this tenant.`
+      };
+    }
+    try {
+      const token = await this.#vault.decrypt(connection.encrypted, { tenantId: request.tenantId });
+      const provider = this.#providerById(connection.provider);
+      const result = await provider.invoke(request, token, connection.scopes);
+      return { ok: true, provider: provider.id, result };
+    } catch (error) {
+      return {
+        ok: false,
+        error: error instanceof Error ? error.message : String(error),
+        suggestion: "Refresh the connection or inspect provider health with `pnpm vault:doctor`."
+      };
+    }
+  }
+  async list(tenantId) {
+    requireTenant(tenantId);
+    return this.#connections.list(tenantId);
+  }
+  async doctor() {
+    const providers = await Promise.all(this.#providers.map((provider) => provider.doctor()));
+    return { ok: providers.some((provider) => provider.ok), providers };
+  }
+  async close() {
+    await this.#vault.close();
+  }
+  #providerFor(app) {
+    const provider = this.#providers.find((candidate) => candidate.supports(app));
+    if (!provider) {
+      throw new CapabilityError("integration-vault", "No provider supports this app", {
+        suggestion: "Configure a provider adapter or local connector for this SaaS app.",
+        metadata: { app },
+        statusCode: 404
+      });
+    }
+    return provider;
+  }
+  #providerById(id) {
+    const provider = this.#providers.find((candidate) => candidate.id === id);
+    if (!provider) {
+      throw new CapabilityError("integration-vault", "Connection provider is unavailable", {
+        suggestion: "Reconnect this app or enable the provider adapter.",
+        metadata: { provider: id },
+        statusCode: 404
+      });
+    }
+    return provider;
+  }
+  #redact(connection) {
+    return {
+      id: connection.id,
+      app: connection.app,
+      provider: connection.provider,
+      tokenId: connection.tokenId,
+      scopes: connection.scopes,
+      connectedAt: connection.connectedAt
+    };
+  }
+};
+var vault = IntegrationVault.local();
+
+export {
+  InMemorySaasConsentStore,
+  InMemoryIntegrationProvider,
+  HttpIntegrationProvider,
+  IntegrationVault,
+  vault,
+  CapabilityError2 as CapabilityError
+};
+//# sourceMappingURL=chunk-6YC3QBSB.js.map

package/dist/chunk-6YC3QBSB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { CapabilityError } from \"@nebutra/errors\";\nimport { type EncryptedSecret, LocalProvider, type VaultProvider } from \"@nebutra/vault\";\n\nexport { CapabilityError } from \"@nebutra/errors\";\n\nexport interface OAuthStartRequest {\n  readonly app: string;\n  readonly tenantId: string;\n  readonly scopes?: readonly string[];\n}\n\nexport interface OAuthStartResult {\n  readonly provider: string;\n  readonly app: string;\n  readonly url: string;\n  readonly state: string;\n  readonly scopes: readonly string[];\n}\n\nexport interface ConnectTokenRequest {\n  readonly tenantId: string;\n  readonly app: string;\n  readonly accessToken: string;\n  readonly scopes: readonly string[];\n  readonly provider?: string;\n}\n\nexport interface InvokeRequest {\n  readonly tenantId: string;\n  readonly app: string;\n  readonly action: string;\n  readonly args: Record<string, unknown>;\n}\n\nexport interface InvokeResult {\n  readonly ok: boolean;\n  readonly provider?: string;\n  readonly result?: unknown;\n  readonly suggestion?: string;\n  readonly error?: string;\n}\n\nexport interface IntegrationConnection {\n  readonly id: string;\n  readonly tenantId: string;\n  readonly app: string;\n  readonly provider: string;\n  readonly tokenId: string;\n  readonly scopes: readonly string[];\n  readonly encrypted: EncryptedSecret;\n  readonly connectedAt: string;\n}\n\nexport interface ListedConnection {\n  readonly id: string;\n  readonly app: string;\n  readonly provider: string;\n  readonly tokenId: string;\n  readonly scopes: readonly string[];\n  readonly connectedAt: string;\n}\n\nexport interface IntegrationProvider {\n  readonly id: string;\n  supports(app: string): boolean;\n  startOAuth(request: OAuthStartRequest): Promise<OAuthStartResult>;\n  invoke(request: InvokeRequest, token: string, scopes: readonly string[]): Promise<unknown>;\n  doctor(): Promise<{ ok: boolean; provider: string; suggestion?: string }>;\n}\n\nexport interface SaasConsentGrant {\n  readonly tenantId: string;\n  readonly app: string;\n  readonly action: string;\n  readonly scopes: readonly string[];\n}\n\nexport interface SaasConsentStore {\n  grant(grant: SaasConsentGrant): Promise<void>;\n  hasConsent(grant: SaasConsentGrant): Promise<boolean>;\n  list(tenantId?: string): Promise<SaasConsentGrant[]>;\n}\n\nexport interface IntegrationVaultOptions {\n  readonly vault?: VaultProvider;\n  readonly providers?: readonly IntegrationProvider[];\n  readonly consent?: SaasConsentStore;\n}\n\nfunction requireTenant(tenantId: string): void {\n  if (!tenantId.trim()) {\n    throw new CapabilityError(\"integration-vault\", \"Tenant context is required\", {\n      suggestion:\n        \"Pass tenantId from the Sailor tenant context before starting OAuth or invoking SaaS tools.\",\n      statusCode: 400,\n    });\n  }\n}\n\nfunction consentKey(grant: Omit<SaasConsentGrant, \"scopes\">): string {\n  return [grant.tenantId, grant.app, grant.action].join(\":\");\n}\n\nexport class InMemorySaasConsentStore implements SaasConsentStore {\n  readonly #grants = new Map<string, SaasConsentGrant>();\n\n  async grant(grant: SaasConsentGrant): Promise<void> {\n    this.#grants.set(consentKey(grant), { ...grant, scopes: [...grant.scopes] });\n  }\n\n  async hasConsent(grant: SaasConsentGrant): Promise<boolean> {\n    const existing = this.#grants.get(consentKey(grant));\n    if (!existing) return false;\n    const scopes = new Set(existing.scopes);\n    return grant.scopes.every((scope) => scopes.has(scope));\n  }\n\n  async list(tenantId?: string): Promise<SaasConsentGrant[]> {\n    return Array.from(this.#grants.values()).filter(\n      (grant) => tenantId === undefined || grant.tenantId === tenantId,\n    );\n  }\n}\n\nexport class InMemoryIntegrationProvider implements IntegrationProvider {\n  readonly id: string;\n  readonly #apps: ReadonlySet<string>;\n\n  constructor(options: { id: string; apps: readonly string[] }) {\n    this.id = options.id;\n    this.#apps = new Set(options.apps);\n  }\n\n  supports(app: string): boolean {\n    return this.#apps.has(app) || this.#apps.has(\"*\");\n  }\n\n  async startOAuth(request: OAuthStartRequest): Promise<OAuthStartResult> {\n    return {\n      provider: this.id,\n      app: request.app,\n      url: `http://127.0.0.1:8787/oauth/${request.app}?tenant=${request.tenantId}`,\n      state: `state_${request.tenantId}_${request.app}`,\n      scopes: request.scopes ?? [],\n    };\n  }\n\n  async invoke(\n    request: InvokeRequest,\n    _token: string,\n    _scopes: readonly string[],\n  ): Promise<unknown> {\n    return { app: request.app, action: request.action, ...request.args };\n  }\n\n  async doctor(): Promise<{ ok: boolean; provider: string }> {\n    return { ok: true, provider: this.id };\n  }\n}\n\nexport class HttpIntegrationProvider implements IntegrationProvider {\n  readonly id: string;\n  readonly #baseUrl: string;\n  readonly #apps: ReadonlySet<string>;\n  readonly #fetch: typeof fetch;\n\n  constructor(options: {\n    id: string;\n    baseUrl: string;\n    apps?: readonly string[];\n    fetch?: typeof fetch;\n  }) {\n    this.id = options.id;\n    this.#baseUrl = options.baseUrl.replace(/\\/$/, \"\");\n    this.#apps = new Set(options.apps ?? [\"*\"]);\n    this.#fetch = options.fetch ?? fetch;\n  }\n\n  supports(app: string): boolean {\n    return this.#apps.has(app) || this.#apps.has(\"*\");\n  }\n\n  async startOAuth(request: OAuthStartRequest): Promise<OAuthStartResult> {\n    return {\n      provider: this.id,\n      app: request.app,\n      url: `${this.#baseUrl}/oauth/${request.app}/start?tenant=${encodeURIComponent(request.tenantId)}`,\n      state: `state_${request.tenantId}_${request.app}`,\n      scopes: request.scopes ?? [],\n    };\n  }\n\n  async invoke(request: InvokeRequest, token: string): Promise<unknown> {\n    const response = await this.#fetch(`${this.#baseUrl}/invoke`, {\n      method: \"POST\",\n      headers: {\n        authorization: `Bearer ${token}`,\n        \"content-type\": \"application/json\",\n      },\n      body: JSON.stringify(request),\n    });\n    if (!response.ok) {\n      throw new CapabilityError(\n        \"integration-vault\",\n        `Provider ${this.id} returned ${response.status}`,\n        {\n          suggestion: \"Run `pnpm vault:doctor` and refresh or reconnect this SaaS app.\",\n          metadata: { provider: this.id, app: request.app, status: response.status },\n        },\n      );\n    }\n    return response.json();\n  }\n\n  async doctor(): Promise<{ ok: boolean; provider: string; suggestion?: string }> {\n    return {\n      ok: true,\n      provider: this.id,\n      suggestion:\n        \"Network health is checked on invoke; configure provider API keys in the sidecar environment.\",\n    };\n  }\n}\n\nclass InMemoryConnectionStore {\n  readonly #connections = new Map<string, IntegrationConnection>();\n\n  upsert(connection: IntegrationConnection): IntegrationConnection {\n    this.#connections.set(`${connection.tenantId}:${connection.app}`, connection);\n    return connection;\n  }\n\n  get(tenantId: string, app: string): IntegrationConnection | undefined {\n    return this.#connections.get(`${tenantId}:${app}`);\n  }\n\n  list(tenantId: string): ListedConnection[] {\n    return Array.from(this.#connections.values())\n      .filter((connection) => connection.tenantId === tenantId)\n      .map((connection) => ({\n        id: connection.id,\n        app: connection.app,\n        provider: connection.provider,\n        tokenId: connection.tokenId,\n        scopes: connection.scopes,\n        connectedAt: connection.connectedAt,\n      }));\n  }\n}\n\nexport class IntegrationVault {\n  readonly #vault: VaultProvider;\n  readonly #providers: IntegrationProvider[];\n  readonly #connections = new InMemoryConnectionStore();\n  readonly #consent: SaasConsentStore;\n\n  constructor(options: IntegrationVaultOptions) {\n    this.#vault =\n      options.vault ??\n      new LocalProvider({\n        provider: \"local\",\n        masterKey: process.env.VAULT_LOCAL_MASTER_KEY ?? \"integration-vault-local-development-key\",\n      });\n    this.#providers =\n      options.providers && options.providers.length > 0\n        ? [...options.providers]\n        : [new InMemoryIntegrationProvider({ id: \"local\", apps: [\"*\"] })];\n    this.#consent = options.consent ?? new InMemorySaasConsentStore();\n  }\n\n  static local(options: IntegrationVaultOptions = {}): IntegrationVault {\n    return new IntegrationVault(options);\n  }\n\n  async startOAuth(request: OAuthStartRequest): Promise<OAuthStartResult> {\n    requireTenant(request.tenantId);\n    return this.#providerFor(request.app).startOAuth(request);\n  }\n\n  async connectToken(request: ConnectTokenRequest): Promise<ListedConnection> {\n    requireTenant(request.tenantId);\n    const provider = request.provider\n      ? this.#providers.find((candidate) => candidate.id === request.provider)\n      : this.#providerFor(request.app);\n    if (!provider) {\n      throw new CapabilityError(\"integration-vault\", \"Integration provider not found\", {\n        suggestion: \"Configure a provider adapter before connecting this app.\",\n        metadata: { app: request.app, provider: request.provider },\n        statusCode: 404,\n      });\n    }\n    const tokenId = `tok_${randomUUID()}`;\n    const encrypted = await this.#vault.encrypt(request.accessToken, {\n      id: tokenId,\n      tenantId: request.tenantId,\n      metadata: { name: `${request.app}:access-token`, type: \"oauth_token\" },\n    });\n    const connection = this.#connections.upsert({\n      id: `conn_${randomUUID()}`,\n      tenantId: request.tenantId,\n      app: request.app,\n      provider: provider.id,\n      tokenId,\n      scopes: [...request.scopes],\n      encrypted,\n      connectedAt: new Date().toISOString(),\n    });\n    return this.#redact(connection);\n  }\n\n  async grantConsent(grant: SaasConsentGrant): Promise<void> {\n    requireTenant(grant.tenantId);\n    await this.#consent.grant(grant);\n  }\n\n  async invoke(request: InvokeRequest): Promise<InvokeResult> {\n    requireTenant(request.tenantId);\n    const connection = this.#connections.get(request.tenantId, request.app);\n    if (!connection) {\n      return {\n        ok: false,\n        error: \"App is not connected\",\n        suggestion: `Run \\`pnpm vault:connect ${request.app}\\` before invoking ${request.app}.${request.action}.`,\n      };\n    }\n    const hasConsent = await this.#consent.hasConsent({\n      tenantId: request.tenantId,\n      app: request.app,\n      action: request.action,\n      scopes: connection.scopes,\n    });\n    if (!hasConsent) {\n      return {\n        ok: false,\n        error: \"SaaS action is not authorized\",\n        suggestion: `Run \\`pnpm vault:connect ${request.app}\\` and grant ${request.app}.${request.action} for this tenant.`,\n      };\n    }\n    try {\n      const token = await this.#vault.decrypt(connection.encrypted, { tenantId: request.tenantId });\n      const provider = this.#providerById(connection.provider);\n      const result = await provider.invoke(request, token, connection.scopes);\n      return { ok: true, provider: provider.id, result };\n    } catch (error) {\n      return {\n        ok: false,\n        error: error instanceof Error ? error.message : String(error),\n        suggestion: \"Refresh the connection or inspect provider health with `pnpm vault:doctor`.\",\n      };\n    }\n  }\n\n  async list(tenantId: string): Promise<ListedConnection[]> {\n    requireTenant(tenantId);\n    return this.#connections.list(tenantId);\n  }\n\n  async doctor(): Promise<{\n    ok: boolean;\n    providers: Array<{ ok: boolean; provider: string; suggestion?: string }>;\n  }> {\n    const providers = await Promise.all(this.#providers.map((provider) => provider.doctor()));\n    return { ok: providers.some((provider) => provider.ok), providers };\n  }\n\n  async close(): Promise<void> {\n    await this.#vault.close();\n  }\n\n  #providerFor(app: string): IntegrationProvider {\n    const provider = this.#providers.find((candidate) => candidate.supports(app));\n    if (!provider) {\n      throw new CapabilityError(\"integration-vault\", \"No provider supports this app\", {\n        suggestion: \"Configure a provider adapter or local connector for this SaaS app.\",\n        metadata: { app },\n        statusCode: 404,\n      });\n    }\n    return provider;\n  }\n\n  #providerById(id: string): IntegrationProvider {\n    const provider = this.#providers.find((candidate) => candidate.id === id);\n    if (!provider) {\n      throw new CapabilityError(\"integration-vault\", \"Connection provider is unavailable\", {\n        suggestion: \"Reconnect this app or enable the provider adapter.\",\n        metadata: { provider: id },\n        statusCode: 404,\n      });\n    }\n    return provider;\n  }\n\n  #redact(connection: IntegrationConnection): ListedConnection {\n    return {\n      id: connection.id,\n      app: connection.app,\n      provider: connection.provider,\n      tokenId: connection.tokenId,\n      scopes: connection.scopes,\n      connectedAt: connection.connectedAt,\n    };\n  }\n}\n\nexport const vault = IntegrationVault.local();\n"],"mappings":";AAAA,SAAS,kBAAkB;AAC3B,SAAS,uBAAuB;AAChC,SAA+B,qBAAyC;AAExE,SAAS,mBAAAA,wBAAuB;AAsFhC,SAAS,cAAc,UAAwB;AAC7C,MAAI,CAAC,SAAS,KAAK,GAAG;AACpB,UAAM,IAAI,gBAAgB,qBAAqB,8BAA8B;AAAA,MAC3E,YACE;AAAA,MACF,YAAY;AAAA,IACd,CAAC;AAAA,EACH;AACF;AAEA,SAAS,WAAW,OAAiD;AACnE,SAAO,CAAC,MAAM,UAAU,MAAM,KAAK,MAAM,MAAM,EAAE,KAAK,GAAG;AAC3D;AAEO,IAAM,2BAAN,MAA2D;AAAA,EACvD,UAAU,oBAAI,IAA8B;AAAA,EAErD,MAAM,MAAM,OAAwC;AAClD,SAAK,QAAQ,IAAI,WAAW,KAAK,GAAG,EAAE,GAAG,OAAO,QAAQ,CAAC,GAAG,MAAM,MAAM,EAAE,CAAC;AAAA,EAC7E;AAAA,EAEA,MAAM,WAAW,OAA2C;AAC1D,UAAM,WAAW,KAAK,QAAQ,IAAI,WAAW,KAAK,CAAC;AACnD,QAAI,CAAC,SAAU,QAAO;AACtB,UAAM,SAAS,IAAI,IAAI,SAAS,MAAM;AACtC,WAAO,MAAM,OAAO,MAAM,CAAC,UAAU,OAAO,IAAI,KAAK,CAAC;AAAA,EACxD;AAAA,EAEA,MAAM,KAAK,UAAgD;AACzD,WAAO,MAAM,KAAK,KAAK,QAAQ,OAAO,CAAC,EAAE;AAAA,MACvC,CAAC,UAAU,aAAa,UAAa,MAAM,aAAa;AAAA,IAC1D;AAAA,EACF;AACF;AAEO,IAAM,8BAAN,MAAiE;AAAA,EAC7D;AAAA,EACA;AAAA,EAET,YAAY,SAAkD;AAC5D,SAAK,KAAK,QAAQ;AAClB,SAAK,QAAQ,IAAI,IAAI,QAAQ,IAAI;AAAA,EACnC;AAAA,EAEA,SAAS,KAAsB;AAC7B,WAAO,KAAK,MAAM,IAAI,GAAG,KAAK,KAAK,MAAM,IAAI,GAAG;AAAA,EAClD;AAAA,EAEA,MAAM,WAAW,SAAuD;AACtE,WAAO;AAAA,MACL,UAAU,KAAK;AAAA,MACf,KAAK,QAAQ;AAAA,MACb,KAAK,+BAA+B,QAAQ,GAAG,WAAW,QAAQ,QAAQ;AAAA,MAC1E,OAAO,SAAS,QAAQ,QAAQ,IAAI,QAAQ,GAAG;AAAA,MAC/C,QAAQ,QAAQ,UAAU,CAAC;AAAA,IAC7B;AAAA,EACF;AAAA,EAEA,MAAM,OACJ,SACA,QACA,SACkB;AAClB,WAAO,EAAE,KAAK,QAAQ,KAAK,QAAQ,QAAQ,QAAQ,GAAG,QAAQ,KAAK;AAAA,EACrE;AAAA,EAEA,MAAM,SAAqD;AACzD,WAAO,EAAE,IAAI,MAAM,UAAU,KAAK,GAAG;AAAA,EACvC;AACF;AAEO,IAAM,0BAAN,MAA6D;AAAA,EACzD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,SAKT;AACD,SAAK,KAAK,QAAQ;AAClB,SAAK,WAAW,QAAQ,QAAQ,QAAQ,OAAO,EAAE;AACjD,SAAK,QAAQ,IAAI,IAAI,QAAQ,QAAQ,CAAC,GAAG,CAAC;AAC1C,SAAK,SAAS,QAAQ,SAAS;AAAA,EACjC;AAAA,EAEA,SAAS,KAAsB;AAC7B,WAAO,KAAK,MAAM,IAAI,GAAG,KAAK,KAAK,MAAM,IAAI,GAAG;AAAA,EAClD;AAAA,EAEA,MAAM,WAAW,SAAuD;AACtE,WAAO;AAAA,MACL,UAAU,KAAK;AAAA,MACf,KAAK,QAAQ;AAAA,MACb,KAAK,GAAG,KAAK,QAAQ,UAAU,QAAQ,GAAG,iBAAiB,mBAAmB,QAAQ,QAAQ,CAAC;AAAA,MAC/F,OAAO,SAAS,QAAQ,QAAQ,IAAI,QAAQ,GAAG;AAAA,MAC/C,QAAQ,QAAQ,UAAU,CAAC;AAAA,IAC7B;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,SAAwB,OAAiC;AACpE,UAAM,WAAW,MAAM,KAAK,OAAO,GAAG,KAAK,QAAQ,WAAW;AAAA,MAC5D,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,eAAe,UAAU,KAAK;AAAA,QAC9B,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,KAAK,UAAU,OAAO;AAAA,IAC9B,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR;AAAA,QACA,YAAY,KAAK,EAAE,aAAa,SAAS,MAAM;AAAA,QAC/C;AAAA,UACE,YAAY;AAAA,UACZ,UAAU,EAAE,UAAU,KAAK,IAAI,KAAK,QAAQ,KAAK,QAAQ,SAAS,OAAO;AAAA,QAC3E;AAAA,MACF;AAAA,IACF;AACA,WAAO,SAAS,KAAK;AAAA,EACvB;AAAA,EAEA,MAAM,SAA0E;AAC9E,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,UAAU,KAAK;AAAA,MACf,YACE;AAAA,IACJ;AAAA,EACF;AACF;AAEA,IAAM,0BAAN,MAA8B;AAAA,EACnB,eAAe,oBAAI,IAAmC;AAAA,EAE/D,OAAO,YAA0D;AAC/D,SAAK,aAAa,IAAI,GAAG,WAAW,QAAQ,IAAI,WAAW,GAAG,IAAI,UAAU;AAC5E,WAAO;AAAA,EACT;AAAA,EAEA,IAAI,UAAkB,KAAgD;AACpE,WAAO,KAAK,aAAa,IAAI,GAAG,QAAQ,IAAI,GAAG,EAAE;AAAA,EACnD;AAAA,EAEA,KAAK,UAAsC;AACzC,WAAO,MAAM,KAAK,KAAK,aAAa,OAAO,CAAC,EACzC,OAAO,CAAC,eAAe,WAAW,aAAa,QAAQ,EACvD,IAAI,CAAC,gBAAgB;AAAA,MACpB,IAAI,WAAW;AAAA,MACf,KAAK,WAAW;AAAA,MAChB,UAAU,WAAW;AAAA,MACrB,SAAS,WAAW;AAAA,MACpB,QAAQ,WAAW;AAAA,MACnB,aAAa,WAAW;AAAA,IAC1B,EAAE;AAAA,EACN;AACF;AAEO,IAAM,mBAAN,MAAM,kBAAiB;AAAA,EACnB;AAAA,EACA;AAAA,EACA,eAAe,IAAI,wBAAwB;AAAA,EAC3C;AAAA,EAET,YAAY,SAAkC;AAC5C,SAAK,SACH,QAAQ,SACR,IAAI,cAAc;AAAA,MAChB,UAAU;AAAA,MACV,WAAW,QAAQ,IAAI,0BAA0B;AAAA,IACnD,CAAC;AACH,SAAK,aACH,QAAQ,aAAa,QAAQ,UAAU,SAAS,IAC5C,CAAC,GAAG,QAAQ,SAAS,IACrB,CAAC,IAAI,4BAA4B,EAAE,IAAI,SAAS,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;AACpE,SAAK,WAAW,QAAQ,WAAW,IAAI,yBAAyB;AAAA,EAClE;AAAA,EAEA,OAAO,MAAM,UAAmC,CAAC,GAAqB;AACpE,WAAO,IAAI,kBAAiB,OAAO;AAAA,EACrC;AAAA,EAEA,MAAM,WAAW,SAAuD;AACtE,kBAAc,QAAQ,QAAQ;AAC9B,WAAO,KAAK,aAAa,QAAQ,GAAG,EAAE,WAAW,OAAO;AAAA,EAC1D;AAAA,EAEA,MAAM,aAAa,SAAyD;AAC1E,kBAAc,QAAQ,QAAQ;AAC9B,UAAM,WAAW,QAAQ,WACrB,KAAK,WAAW,KAAK,CAAC,cAAc,UAAU,OAAO,QAAQ,QAAQ,IACrE,KAAK,aAAa,QAAQ,GAAG;AACjC,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,gBAAgB,qBAAqB,kCAAkC;AAAA,QAC/E,YAAY;AAAA,QACZ,UAAU,EAAE,KAAK,QAAQ,KAAK,UAAU,QAAQ,SAAS;AAAA,QACzD,YAAY;AAAA,MACd,CAAC;AAAA,IACH;AACA,UAAM,UAAU,OAAO,WAAW,CAAC;AACnC,UAAM,YAAY,MAAM,KAAK,OAAO,QAAQ,QAAQ,aAAa;AAAA,MAC/D,IAAI;AAAA,MACJ,UAAU,QAAQ;AAAA,MAClB,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,iBAAiB,MAAM,cAAc;AAAA,IACvE,CAAC;AACD,UAAM,aAAa,KAAK,aAAa,OAAO;AAAA,MAC1C,IAAI,QAAQ,WAAW,CAAC;AAAA,MACxB,UAAU,QAAQ;AAAA,MAClB,KAAK,QAAQ;AAAA,MACb,UAAU,SAAS;AAAA,MACnB;AAAA,MACA,QAAQ,CAAC,GAAG,QAAQ,MAAM;AAAA,MAC1B;AAAA,MACA,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,IACtC,CAAC;AACD,WAAO,KAAK,QAAQ,UAAU;AAAA,EAChC;AAAA,EAEA,MAAM,aAAa,OAAwC;AACzD,kBAAc,MAAM,QAAQ;AAC5B,UAAM,KAAK,SAAS,MAAM,KAAK;AAAA,EACjC;AAAA,EAEA,MAAM,OAAO,SAA+C;AAC1D,kBAAc,QAAQ,QAAQ;AAC9B,UAAM,aAAa,KAAK,aAAa,IAAI,QAAQ,UAAU,QAAQ,GAAG;AACtE,QAAI,CAAC,YAAY;AACf,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,YAAY,4BAA4B,QAAQ,GAAG,sBAAsB,QAAQ,GAAG,IAAI,QAAQ,MAAM;AAAA,MACxG;AAAA,IACF;AACA,UAAM,aAAa,MAAM,KAAK,SAAS,WAAW;AAAA,MAChD,UAAU,QAAQ;AAAA,MAClB,KAAK,QAAQ;AAAA,MACb,QAAQ,QAAQ;AAAA,MAChB,QAAQ,WAAW;AAAA,IACrB,CAAC;AACD,QAAI,CAAC,YAAY;AACf,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,YAAY,4BAA4B,QAAQ,GAAG,gBAAgB,QAAQ,GAAG,IAAI,QAAQ,MAAM;AAAA,MAClG;AAAA,IACF;AACA,QAAI;AACF,YAAM,QAAQ,MAAM,KAAK,OAAO,QAAQ,WAAW,WAAW,EAAE,UAAU,QAAQ,SAAS,CAAC;AAC5F,YAAM,WAAW,KAAK,cAAc,WAAW,QAAQ;AACvD,YAAM,SAAS,MAAM,SAAS,OAAO,SAAS,OAAO,WAAW,MAAM;AACtE,aAAO,EAAE,IAAI,MAAM,UAAU,SAAS,IAAI,OAAO;AAAA,IACnD,SAAS,OAAO;AACd,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,QAC5D,YAAY;AAAA,MACd;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,KAAK,UAA+C;AACxD,kBAAc,QAAQ;AACtB,WAAO,KAAK,aAAa,KAAK,QAAQ;AAAA,EACxC;AAAA,EAEA,MAAM,SAGH;AACD,UAAM,YAAY,MAAM,QAAQ,IAAI,KAAK,WAAW,IAAI,CAAC,aAAa,SAAS,OAAO,CAAC,CAAC;AACxF,WAAO,EAAE,IAAI,UAAU,KAAK,CAAC,aAAa,SAAS,EAAE,GAAG,UAAU;AAAA,EACpE;AAAA,EAEA,MAAM,QAAuB;AAC3B,UAAM,KAAK,OAAO,MAAM;AAAA,EAC1B;AAAA,EAEA,aAAa,KAAkC;AAC7C,UAAM,WAAW,KAAK,WAAW,KAAK,CAAC,cAAc,UAAU,SAAS,GAAG,CAAC;AAC5E,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,gBAAgB,qBAAqB,iCAAiC;AAAA,QAC9E,YAAY;AAAA,QACZ,UAAU,EAAE,IAAI;AAAA,QAChB,YAAY;AAAA,MACd,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAAA,EAEA,cAAc,IAAiC;AAC7C,UAAM,WAAW,KAAK,WAAW,KAAK,CAAC,cAAc,UAAU,OAAO,EAAE;AACxE,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,gBAAgB,qBAAqB,sCAAsC;AAAA,QACnF,YAAY;AAAA,QACZ,UAAU,EAAE,UAAU,GAAG;AAAA,QACzB,YAAY;AAAA,MACd,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAAA,EAEA,QAAQ,YAAqD;AAC3D,WAAO;AAAA,MACL,IAAI,WAAW;AAAA,MACf,KAAK,WAAW;AAAA,MAChB,UAAU,WAAW;AAAA,MACrB,SAAS,WAAW;AAAA,MACpB,QAAQ,WAAW;AAAA,MACnB,aAAa,WAAW;AAAA,IAC1B;AAAA,EACF;AACF;AAEO,IAAM,QAAQ,iBAAiB,MAAM;","names":["CapabilityError"]}

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+
+export {  }

package/dist/cli.js

@@ -0,0 +1,62 @@
+import {
+  IntegrationVault
+} from "./chunk-6YC3QBSB.js";
+
+// src/cli.ts
+import { readFile, writeFile } from "fs/promises";
+import { dirname, join } from "path";
+var command = process.argv[2] ?? "doctor";
+var tenantId = process.env.TENANT_ID ?? "local";
+var statePath = join(process.cwd(), ".nebutra", "debug", "integration-vault.jsonl");
+var vault = IntegrationVault.local();
+async function appendState(entry) {
+  await writeFile(statePath, `${JSON.stringify({ at: (/* @__PURE__ */ new Date()).toISOString(), ...entry })}
+`, {
+    flag: "a"
+  }).catch(async (error) => {
+    if (error.code !== "ENOENT") throw error;
+    await import("fs/promises").then(
+      ({ mkdir }) => mkdir(dirname(statePath), { recursive: true })
+    );
+    await writeFile(statePath, `${JSON.stringify({ at: (/* @__PURE__ */ new Date()).toISOString(), ...entry })}
+`, {
+      flag: "a"
+    });
+  });
+}
+try {
+  if (command === "doctor") {
+    process.stdout.write(
+      `${JSON.stringify({ capability: "integration-vault", ...await vault.doctor() }, null, 2)}
+`
+    );
+  } else if (command === "connect") {
+    const app = process.argv[3];
+    if (!app) throw new Error("Missing app name");
+    const flow = await vault.startOAuth({ app, tenantId });
+    await appendState({ type: "connect", app, tenantId, flow });
+    process.stdout.write(
+      `${JSON.stringify({ capability: "integration-vault", auth_url: flow.url, state: flow.state }, null, 2)}
+`
+    );
+  } else if (command === "list") {
+    process.stdout.write(
+      `${JSON.stringify({ capability: "integration-vault", connections: await vault.list(tenantId) }, null, 2)}
+`
+    );
+  } else if (command === "debug") {
+    const raw = await readFile(statePath, "utf8").catch(() => "");
+    const entries = raw.trim().split("\n").filter(Boolean).map((line) => JSON.parse(line));
+    process.stdout.write(
+      `${JSON.stringify({ capability: "integration-vault", entries }, null, 2)}
+`
+    );
+  } else {
+    process.stderr.write(`Unknown integration-vault command: ${command}
+`);
+    process.exitCode = 1;
+  }
+} finally {
+  await vault.close();
+}
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli.ts"],"sourcesContent":["import { readFile, writeFile } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\nimport { IntegrationVault } from \"./index\";\n\nconst command = process.argv[2] ?? \"doctor\";\nconst tenantId = process.env.TENANT_ID ?? \"local\";\nconst statePath = join(process.cwd(), \".nebutra\", \"debug\", \"integration-vault.jsonl\");\nconst vault = IntegrationVault.local();\n\nasync function appendState(entry: Record<string, unknown>): Promise<void> {\n  await writeFile(statePath, `${JSON.stringify({ at: new Date().toISOString(), ...entry })}\\n`, {\n    flag: \"a\",\n  }).catch(async (error) => {\n    if ((error as NodeJS.ErrnoException).code !== \"ENOENT\") throw error;\n    await import(\"node:fs/promises\").then(({ mkdir }) =>\n      mkdir(dirname(statePath), { recursive: true }),\n    );\n    await writeFile(statePath, `${JSON.stringify({ at: new Date().toISOString(), ...entry })}\\n`, {\n      flag: \"a\",\n    });\n  });\n}\n\ntry {\n  if (command === \"doctor\") {\n    process.stdout.write(\n      `${JSON.stringify({ capability: \"integration-vault\", ...(await vault.doctor()) }, null, 2)}\\n`,\n    );\n  } else if (command === \"connect\") {\n    const app = process.argv[3];\n    if (!app) throw new Error(\"Missing app name\");\n    const flow = await vault.startOAuth({ app, tenantId });\n    await appendState({ type: \"connect\", app, tenantId, flow });\n    process.stdout.write(\n      `${JSON.stringify({ capability: \"integration-vault\", auth_url: flow.url, state: flow.state }, null, 2)}\\n`,\n    );\n  } else if (command === \"list\") {\n    process.stdout.write(\n      `${JSON.stringify({ capability: \"integration-vault\", connections: await vault.list(tenantId) }, null, 2)}\\n`,\n    );\n  } else if (command === \"debug\") {\n    const raw = await readFile(statePath, \"utf8\").catch(() => \"\");\n    const entries = raw\n      .trim()\n      .split(\"\\n\")\n      .filter(Boolean)\n      .map((line) => JSON.parse(line) as unknown);\n    process.stdout.write(\n      `${JSON.stringify({ capability: \"integration-vault\", entries }, null, 2)}\\n`,\n    );\n  } else {\n    process.stderr.write(`Unknown integration-vault command: ${command}\\n`);\n    process.exitCode = 1;\n  }\n} finally {\n  await vault.close();\n}\n"],"mappings":";;;;;AAAA,SAAS,UAAU,iBAAiB;AACpC,SAAS,SAAS,YAAY;AAG9B,IAAM,UAAU,QAAQ,KAAK,CAAC,KAAK;AACnC,IAAM,WAAW,QAAQ,IAAI,aAAa;AAC1C,IAAM,YAAY,KAAK,QAAQ,IAAI,GAAG,YAAY,SAAS,yBAAyB;AACpF,IAAM,QAAQ,iBAAiB,MAAM;AAErC,eAAe,YAAY,OAA+C;AACxE,QAAM,UAAU,WAAW,GAAG,KAAK,UAAU,EAAE,KAAI,oBAAI,KAAK,GAAE,YAAY,GAAG,GAAG,MAAM,CAAC,CAAC;AAAA,GAAM;AAAA,IAC5F,MAAM;AAAA,EACR,CAAC,EAAE,MAAM,OAAO,UAAU;AACxB,QAAK,MAAgC,SAAS,SAAU,OAAM;AAC9D,UAAM,OAAO,aAAkB,EAAE;AAAA,MAAK,CAAC,EAAE,MAAM,MAC7C,MAAM,QAAQ,SAAS,GAAG,EAAE,WAAW,KAAK,CAAC;AAAA,IAC/C;AACA,UAAM,UAAU,WAAW,GAAG,KAAK,UAAU,EAAE,KAAI,oBAAI,KAAK,GAAE,YAAY,GAAG,GAAG,MAAM,CAAC,CAAC;AAAA,GAAM;AAAA,MAC5F,MAAM;AAAA,IACR,CAAC;AAAA,EACH,CAAC;AACH;AAEA,IAAI;AACF,MAAI,YAAY,UAAU;AACxB,YAAQ,OAAO;AAAA,MACb,GAAG,KAAK,UAAU,EAAE,YAAY,qBAAqB,GAAI,MAAM,MAAM,OAAO,EAAG,GAAG,MAAM,CAAC,CAAC;AAAA;AAAA,IAC5F;AAAA,EACF,WAAW,YAAY,WAAW;AAChC,UAAM,MAAM,QAAQ,KAAK,CAAC;AAC1B,QAAI,CAAC,IAAK,OAAM,IAAI,MAAM,kBAAkB;AAC5C,UAAM,OAAO,MAAM,MAAM,WAAW,EAAE,KAAK,SAAS,CAAC;AACrD,UAAM,YAAY,EAAE,MAAM,WAAW,KAAK,UAAU,KAAK,CAAC;AAC1D,YAAQ,OAAO;AAAA,MACb,GAAG,KAAK,UAAU,EAAE,YAAY,qBAAqB,UAAU,KAAK,KAAK,OAAO,KAAK,MAAM,GAAG,MAAM,CAAC,CAAC;AAAA;AAAA,IACxG;AAAA,EACF,WAAW,YAAY,QAAQ;AAC7B,YAAQ,OAAO;AAAA,MACb,GAAG,KAAK,UAAU,EAAE,YAAY,qBAAqB,aAAa,MAAM,MAAM,KAAK,QAAQ,EAAE,GAAG,MAAM,CAAC,CAAC;AAAA;AAAA,IAC1G;AAAA,EACF,WAAW,YAAY,SAAS;AAC9B,UAAM,MAAM,MAAM,SAAS,WAAW,MAAM,EAAE,MAAM,MAAM,EAAE;AAC5D,UAAM,UAAU,IACb,KAAK,EACL,MAAM,IAAI,EACV,OAAO,OAAO,EACd,IAAI,CAAC,SAAS,KAAK,MAAM,IAAI,CAAY;AAC5C,YAAQ,OAAO;AAAA,MACb,GAAG,KAAK,UAAU,EAAE,YAAY,qBAAqB,QAAQ,GAAG,MAAM,CAAC,CAAC;AAAA;AAAA,IAC1E;AAAA,EACF,OAAO;AACL,YAAQ,OAAO,MAAM,sCAAsC,OAAO;AAAA,CAAI;AACtE,YAAQ,WAAW;AAAA,EACrB;AACF,UAAE;AACA,QAAM,MAAM,MAAM;AACpB;","names":[]}

package/dist/index.d.ts

@@ -0,0 +1,141 @@
+import { EncryptedSecret, VaultProvider } from '@nebutra/vault';
+export { CapabilityError } from '@nebutra/errors';
+
+interface OAuthStartRequest {
+    readonly app: string;
+    readonly tenantId: string;
+    readonly scopes?: readonly string[];
+}
+interface OAuthStartResult {
+    readonly provider: string;
+    readonly app: string;
+    readonly url: string;
+    readonly state: string;
+    readonly scopes: readonly string[];
+}
+interface ConnectTokenRequest {
+    readonly tenantId: string;
+    readonly app: string;
+    readonly accessToken: string;
+    readonly scopes: readonly string[];
+    readonly provider?: string;
+}
+interface InvokeRequest {
+    readonly tenantId: string;
+    readonly app: string;
+    readonly action: string;
+    readonly args: Record<string, unknown>;
+}
+interface InvokeResult {
+    readonly ok: boolean;
+    readonly provider?: string;
+    readonly result?: unknown;
+    readonly suggestion?: string;
+    readonly error?: string;
+}
+interface IntegrationConnection {
+    readonly id: string;
+    readonly tenantId: string;
+    readonly app: string;
+    readonly provider: string;
+    readonly tokenId: string;
+    readonly scopes: readonly string[];
+    readonly encrypted: EncryptedSecret;
+    readonly connectedAt: string;
+}
+interface ListedConnection {
+    readonly id: string;
+    readonly app: string;
+    readonly provider: string;
+    readonly tokenId: string;
+    readonly scopes: readonly string[];
+    readonly connectedAt: string;
+}
+interface IntegrationProvider {
+    readonly id: string;
+    supports(app: string): boolean;
+    startOAuth(request: OAuthStartRequest): Promise<OAuthStartResult>;
+    invoke(request: InvokeRequest, token: string, scopes: readonly string[]): Promise<unknown>;
+    doctor(): Promise<{
+        ok: boolean;
+        provider: string;
+        suggestion?: string;
+    }>;
+}
+interface SaasConsentGrant {
+    readonly tenantId: string;
+    readonly app: string;
+    readonly action: string;
+    readonly scopes: readonly string[];
+}
+interface SaasConsentStore {
+    grant(grant: SaasConsentGrant): Promise<void>;
+    hasConsent(grant: SaasConsentGrant): Promise<boolean>;
+    list(tenantId?: string): Promise<SaasConsentGrant[]>;
+}
+interface IntegrationVaultOptions {
+    readonly vault?: VaultProvider;
+    readonly providers?: readonly IntegrationProvider[];
+    readonly consent?: SaasConsentStore;
+}
+declare class InMemorySaasConsentStore implements SaasConsentStore {
+    #private;
+    grant(grant: SaasConsentGrant): Promise<void>;
+    hasConsent(grant: SaasConsentGrant): Promise<boolean>;
+    list(tenantId?: string): Promise<SaasConsentGrant[]>;
+}
+declare class InMemoryIntegrationProvider implements IntegrationProvider {
+    #private;
+    readonly id: string;
+    constructor(options: {
+        id: string;
+        apps: readonly string[];
+    });
+    supports(app: string): boolean;
+    startOAuth(request: OAuthStartRequest): Promise<OAuthStartResult>;
+    invoke(request: InvokeRequest, _token: string, _scopes: readonly string[]): Promise<unknown>;
+    doctor(): Promise<{
+        ok: boolean;
+        provider: string;
+    }>;
+}
+declare class HttpIntegrationProvider implements IntegrationProvider {
+    #private;
+    readonly id: string;
+    constructor(options: {
+        id: string;
+        baseUrl: string;
+        apps?: readonly string[];
+        fetch?: typeof fetch;
+    });
+    supports(app: string): boolean;
+    startOAuth(request: OAuthStartRequest): Promise<OAuthStartResult>;
+    invoke(request: InvokeRequest, token: string): Promise<unknown>;
+    doctor(): Promise<{
+        ok: boolean;
+        provider: string;
+        suggestion?: string;
+    }>;
+}
+declare class IntegrationVault {
+    #private;
+    constructor(options: IntegrationVaultOptions);
+    static local(options?: IntegrationVaultOptions): IntegrationVault;
+    startOAuth(request: OAuthStartRequest): Promise<OAuthStartResult>;
+    connectToken(request: ConnectTokenRequest): Promise<ListedConnection>;
+    grantConsent(grant: SaasConsentGrant): Promise<void>;
+    invoke(request: InvokeRequest): Promise<InvokeResult>;
+    list(tenantId: string): Promise<ListedConnection[]>;
+    doctor(): Promise<{
+        ok: boolean;
+        providers: Array<{
+            ok: boolean;
+            provider: string;
+            suggestion?: string;
+        }>;
+    }>;
+    close(): Promise<void>;
+}
+declare const vault: IntegrationVault;
+
+export { type ConnectTokenRequest, HttpIntegrationProvider, InMemoryIntegrationProvider, InMemorySaasConsentStore, type IntegrationConnection, type IntegrationProvider, IntegrationVault, type IntegrationVaultOptions, type InvokeRequest, type InvokeResult, type ListedConnection, type OAuthStartRequest, type OAuthStartResult, type SaasConsentGrant, type SaasConsentStore, vault };

package/dist/index.js

@@ -0,0 +1,17 @@
+import {
+  CapabilityError,
+  HttpIntegrationProvider,
+  InMemoryIntegrationProvider,
+  InMemorySaasConsentStore,
+  IntegrationVault,
+  vault
+} from "./chunk-6YC3QBSB.js";
+export {
+  CapabilityError,
+  HttpIntegrationProvider,
+  InMemoryIntegrationProvider,
+  InMemorySaasConsentStore,
+  IntegrationVault,
+  vault
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/examples/connect-token.ts

@@ -0,0 +1,34 @@
+import { InMemoryIntegrationProvider, IntegrationVault } from "../src";
+
+const vault = IntegrationVault.local({
+  providers: [new InMemoryIntegrationProvider({ id: "local", apps: ["docs"] })],
+});
+
+try {
+  const flow = await vault.startOAuth({
+    tenantId: "tenant_demo",
+    app: "docs",
+    scopes: ["documents:write"],
+  });
+
+  const connection = await vault.connectToken({
+    tenantId: "tenant_demo",
+    app: "docs",
+    accessToken: "local-development-token",
+    scopes: flow.scopes,
+  });
+
+  process.stdout.write(
+    `${JSON.stringify(
+      {
+        auth_url: flow.url,
+        token_id: connection.tokenId,
+        scopes: connection.scopes,
+      },
+      null,
+      2,
+    )}\n`,
+  );
+} finally {
+  await vault.close();
+}

package/examples/invoke-consented.ts

@@ -0,0 +1,32 @@
+import { InMemoryIntegrationProvider, IntegrationVault } from "../src";
+
+const vault = IntegrationVault.local({
+  providers: [new InMemoryIntegrationProvider({ id: "local", apps: ["docs"] })],
+});
+
+try {
+  await vault.connectToken({
+    tenantId: "tenant_demo",
+    app: "docs",
+    accessToken: "local-development-token",
+    scopes: ["documents:write"],
+  });
+
+  await vault.grantConsent({
+    tenantId: "tenant_demo",
+    app: "docs",
+    action: "create_page",
+    scopes: ["documents:write"],
+  });
+
+  const result = await vault.invoke({
+    tenantId: "tenant_demo",
+    app: "docs",
+    action: "create_page",
+    args: { title: "Layer 1", body: "Published through the integration vault." },
+  });
+
+  process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+} finally {
+  await vault.close();
+}

package/examples/provider-fallback.ts

@@ -0,0 +1,26 @@
+import { InMemoryIntegrationProvider, IntegrationVault } from "../src";
+
+const vault = IntegrationVault.local({
+  providers: [
+    new InMemoryIntegrationProvider({ id: "primary", apps: ["crm"] }),
+    new InMemoryIntegrationProvider({ id: "fallback", apps: ["*"] }),
+  ],
+});
+
+try {
+  const direct = await vault.startOAuth({ tenantId: "tenant_demo", app: "crm" });
+  const fallback = await vault.startOAuth({ tenantId: "tenant_demo", app: "calendar" });
+
+  process.stdout.write(
+    `${JSON.stringify(
+      {
+        direct_provider: direct.provider,
+        fallback_provider: fallback.provider,
+      },
+      null,
+      2,
+    )}\n`,
+  );
+} finally {
+  await vault.close();
+}