@nebutra/integration-vault 0.1.1 → 0.1.3

package/dist/{chunk-6YC3QBSB.js → chunk-TQULRIQM.js}

@@ -2,7 +2,9 @@
 import { randomUUID } from "crypto";
 import { CapabilityError } from "@nebutra/errors";
 import { LocalProvider } from "@nebutra/vault";
+import pLimit from "p-limit";
 import { CapabilityError as CapabilityError2 } from "@nebutra/errors";
+var PROVIDER_DOCTOR_CONCURRENCY = 4;
 function requireTenant(tenantId) {
   if (!tenantId.trim()) {
     throw new CapabilityError("integration-vault", "Tenant context is required", {
@@ -222,7 +224,10 @@ var IntegrationVault = class _IntegrationVault {
     return this.#connections.list(tenantId);
   }
   async doctor() {
-    const providers = await Promise.all(this.#providers.map((provider) => provider.doctor()));
+    const limit = pLimit(PROVIDER_DOCTOR_CONCURRENCY);
+    const providers = await Promise.all(
+      this.#providers.map((provider) => limit(() => provider.doctor()))
+    );
     return { ok: providers.some((provider) => provider.ok), providers };
   }
   async close() {
@@ -271,4 +276,4 @@ export {
   vault,
   CapabilityError2 as CapabilityError
 };
-//# sourceMappingURL=chunk-6YC3QBSB.js.map
+//# sourceMappingURL=chunk-TQULRIQM.js.map

package/dist/chunk-TQULRIQM.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { CapabilityError } from \"@nebutra/errors\";\nimport { type EncryptedSecret, LocalProvider, type VaultProvider } from \"@nebutra/vault\";\nimport pLimit from \"p-limit\";\n\nexport { CapabilityError } from \"@nebutra/errors\";\n\nexport interface OAuthStartRequest {\n  readonly app: string;\n  readonly tenantId: string;\n  readonly scopes?: readonly string[];\n}\n\nexport interface OAuthStartResult {\n  readonly provider: string;\n  readonly app: string;\n  readonly url: string;\n  readonly state: string;\n  readonly scopes: readonly string[];\n}\n\nexport interface ConnectTokenRequest {\n  readonly tenantId: string;\n  readonly app: string;\n  readonly accessToken: string;\n  readonly scopes: readonly string[];\n  readonly provider?: string;\n}\n\nexport interface InvokeRequest {\n  readonly tenantId: string;\n  readonly app: string;\n  readonly action: string;\n  readonly args: Record<string, unknown>;\n}\n\nexport interface InvokeResult {\n  readonly ok: boolean;\n  readonly provider?: string;\n  readonly result?: unknown;\n  readonly suggestion?: string;\n  readonly error?: string;\n}\n\nexport interface IntegrationConnection {\n  readonly id: string;\n  readonly tenantId: string;\n  readonly app: string;\n  readonly provider: string;\n  readonly tokenId: string;\n  readonly scopes: readonly string[];\n  readonly encrypted: EncryptedSecret;\n  readonly connectedAt: string;\n}\n\nexport interface ListedConnection {\n  readonly id: string;\n  readonly app: string;\n  readonly provider: string;\n  readonly tokenId: string;\n  readonly scopes: readonly string[];\n  readonly connectedAt: string;\n}\n\nexport interface IntegrationProvider {\n  readonly id: string;\n  supports(app: string): boolean;\n  startOAuth(request: OAuthStartRequest): Promise<OAuthStartResult>;\n  invoke(request: InvokeRequest, token: string, scopes: readonly string[]): Promise<unknown>;\n  doctor(): Promise<{ ok: boolean; provider: string; suggestion?: string }>;\n}\n\nexport interface SaasConsentGrant {\n  readonly tenantId: string;\n  readonly app: string;\n  readonly action: string;\n  readonly scopes: readonly string[];\n}\n\nexport interface SaasConsentStore {\n  grant(grant: SaasConsentGrant): Promise<void>;\n  hasConsent(grant: SaasConsentGrant): Promise<boolean>;\n  list(tenantId?: string): Promise<SaasConsentGrant[]>;\n}\n\nexport interface IntegrationVaultOptions {\n  readonly vault?: VaultProvider;\n  readonly providers?: readonly IntegrationProvider[];\n  readonly consent?: SaasConsentStore;\n}\n\nconst PROVIDER_DOCTOR_CONCURRENCY = 4;\n\nfunction requireTenant(tenantId: string): void {\n  if (!tenantId.trim()) {\n    throw new CapabilityError(\"integration-vault\", \"Tenant context is required\", {\n      suggestion:\n        \"Pass tenantId from the Sailor tenant context before starting OAuth or invoking SaaS tools.\",\n      statusCode: 400,\n    });\n  }\n}\n\nfunction consentKey(grant: Omit<SaasConsentGrant, \"scopes\">): string {\n  return [grant.tenantId, grant.app, grant.action].join(\":\");\n}\n\nexport class InMemorySaasConsentStore implements SaasConsentStore {\n  readonly #grants = new Map<string, SaasConsentGrant>();\n\n  async grant(grant: SaasConsentGrant): Promise<void> {\n    this.#grants.set(consentKey(grant), { ...grant, scopes: [...grant.scopes] });\n  }\n\n  async hasConsent(grant: SaasConsentGrant): Promise<boolean> {\n    const existing = this.#grants.get(consentKey(grant));\n    if (!existing) return false;\n    const scopes = new Set(existing.scopes);\n    return grant.scopes.every((scope) => scopes.has(scope));\n  }\n\n  async list(tenantId?: string): Promise<SaasConsentGrant[]> {\n    return Array.from(this.#grants.values()).filter(\n      (grant) => tenantId === undefined || grant.tenantId === tenantId,\n    );\n  }\n}\n\nexport class InMemoryIntegrationProvider implements IntegrationProvider {\n  readonly id: string;\n  readonly #apps: ReadonlySet<string>;\n\n  constructor(options: { id: string; apps: readonly string[] }) {\n    this.id = options.id;\n    this.#apps = new Set(options.apps);\n  }\n\n  supports(app: string): boolean {\n    return this.#apps.has(app) || this.#apps.has(\"*\");\n  }\n\n  async startOAuth(request: OAuthStartRequest): Promise<OAuthStartResult> {\n    return {\n      provider: this.id,\n      app: request.app,\n      url: `http://127.0.0.1:8787/oauth/${request.app}?tenant=${request.tenantId}`,\n      state: `state_${request.tenantId}_${request.app}`,\n      scopes: request.scopes ?? [],\n    };\n  }\n\n  async invoke(\n    request: InvokeRequest,\n    _token: string,\n    _scopes: readonly string[],\n  ): Promise<unknown> {\n    return { app: request.app, action: request.action, ...request.args };\n  }\n\n  async doctor(): Promise<{ ok: boolean; provider: string }> {\n    return { ok: true, provider: this.id };\n  }\n}\n\nexport class HttpIntegrationProvider implements IntegrationProvider {\n  readonly id: string;\n  readonly #baseUrl: string;\n  readonly #apps: ReadonlySet<string>;\n  readonly #fetch: typeof fetch;\n\n  constructor(options: {\n    id: string;\n    baseUrl: string;\n    apps?: readonly string[];\n    fetch?: typeof fetch;\n  }) {\n    this.id = options.id;\n    this.#baseUrl = options.baseUrl.replace(/\\/$/, \"\");\n    this.#apps = new Set(options.apps ?? [\"*\"]);\n    this.#fetch = options.fetch ?? fetch;\n  }\n\n  supports(app: string): boolean {\n    return this.#apps.has(app) || this.#apps.has(\"*\");\n  }\n\n  async startOAuth(request: OAuthStartRequest): Promise<OAuthStartResult> {\n    return {\n      provider: this.id,\n      app: request.app,\n      url: `${this.#baseUrl}/oauth/${request.app}/start?tenant=${encodeURIComponent(request.tenantId)}`,\n      state: `state_${request.tenantId}_${request.app}`,\n      scopes: request.scopes ?? [],\n    };\n  }\n\n  async invoke(request: InvokeRequest, token: string): Promise<unknown> {\n    const response = await this.#fetch(`${this.#baseUrl}/invoke`, {\n      method: \"POST\",\n      headers: {\n        authorization: `Bearer ${token}`,\n        \"content-type\": \"application/json\",\n      },\n      body: JSON.stringify(request),\n    });\n    if (!response.ok) {\n      throw new CapabilityError(\n        \"integration-vault\",\n        `Provider ${this.id} returned ${response.status}`,\n        {\n          suggestion: \"Run `pnpm vault:doctor` and refresh or reconnect this SaaS app.\",\n          metadata: { provider: this.id, app: request.app, status: response.status },\n        },\n      );\n    }\n    return response.json();\n  }\n\n  async doctor(): Promise<{ ok: boolean; provider: string; suggestion?: string }> {\n    return {\n      ok: true,\n      provider: this.id,\n      suggestion:\n        \"Network health is checked on invoke; configure provider API keys in the sidecar environment.\",\n    };\n  }\n}\n\nclass InMemoryConnectionStore {\n  readonly #connections = new Map<string, IntegrationConnection>();\n\n  upsert(connection: IntegrationConnection): IntegrationConnection {\n    this.#connections.set(`${connection.tenantId}:${connection.app}`, connection);\n    return connection;\n  }\n\n  get(tenantId: string, app: string): IntegrationConnection | undefined {\n    return this.#connections.get(`${tenantId}:${app}`);\n  }\n\n  list(tenantId: string): ListedConnection[] {\n    return Array.from(this.#connections.values())\n      .filter((connection) => connection.tenantId === tenantId)\n      .map((connection) => ({\n        id: connection.id,\n        app: connection.app,\n        provider: connection.provider,\n        tokenId: connection.tokenId,\n        scopes: connection.scopes,\n        connectedAt: connection.connectedAt,\n      }));\n  }\n}\n\nexport class IntegrationVault {\n  readonly #vault: VaultProvider;\n  readonly #providers: IntegrationProvider[];\n  readonly #connections = new InMemoryConnectionStore();\n  readonly #consent: SaasConsentStore;\n\n  constructor(options: IntegrationVaultOptions) {\n    this.#vault =\n      options.vault ??\n      new LocalProvider({\n        provider: \"local\",\n        masterKey: process.env.VAULT_LOCAL_MASTER_KEY ?? \"integration-vault-local-development-key\",\n      });\n    this.#providers =\n      options.providers && options.providers.length > 0\n        ? [...options.providers]\n        : [new InMemoryIntegrationProvider({ id: \"local\", apps: [\"*\"] })];\n    this.#consent = options.consent ?? new InMemorySaasConsentStore();\n  }\n\n  static local(options: IntegrationVaultOptions = {}): IntegrationVault {\n    return new IntegrationVault(options);\n  }\n\n  async startOAuth(request: OAuthStartRequest): Promise<OAuthStartResult> {\n    requireTenant(request.tenantId);\n    return this.#providerFor(request.app).startOAuth(request);\n  }\n\n  async connectToken(request: ConnectTokenRequest): Promise<ListedConnection> {\n    requireTenant(request.tenantId);\n    const provider = request.provider\n      ? this.#providers.find((candidate) => candidate.id === request.provider)\n      : this.#providerFor(request.app);\n    if (!provider) {\n      throw new CapabilityError(\"integration-vault\", \"Integration provider not found\", {\n        suggestion: \"Configure a provider adapter before connecting this app.\",\n        metadata: { app: request.app, provider: request.provider },\n        statusCode: 404,\n      });\n    }\n    const tokenId = `tok_${randomUUID()}`;\n    const encrypted = await this.#vault.encrypt(request.accessToken, {\n      id: tokenId,\n      tenantId: request.tenantId,\n      metadata: { name: `${request.app}:access-token`, type: \"oauth_token\" },\n    });\n    const connection = this.#connections.upsert({\n      id: `conn_${randomUUID()}`,\n      tenantId: request.tenantId,\n      app: request.app,\n      provider: provider.id,\n      tokenId,\n      scopes: [...request.scopes],\n      encrypted,\n      connectedAt: new Date().toISOString(),\n    });\n    return this.#redact(connection);\n  }\n\n  async grantConsent(grant: SaasConsentGrant): Promise<void> {\n    requireTenant(grant.tenantId);\n    await this.#consent.grant(grant);\n  }\n\n  async invoke(request: InvokeRequest): Promise<InvokeResult> {\n    requireTenant(request.tenantId);\n    const connection = this.#connections.get(request.tenantId, request.app);\n    if (!connection) {\n      return {\n        ok: false,\n        error: \"App is not connected\",\n        suggestion: `Run \\`pnpm vault:connect ${request.app}\\` before invoking ${request.app}.${request.action}.`,\n      };\n    }\n    const hasConsent = await this.#consent.hasConsent({\n      tenantId: request.tenantId,\n      app: request.app,\n      action: request.action,\n      scopes: connection.scopes,\n    });\n    if (!hasConsent) {\n      return {\n        ok: false,\n        error: \"SaaS action is not authorized\",\n        suggestion: `Run \\`pnpm vault:connect ${request.app}\\` and grant ${request.app}.${request.action} for this tenant.`,\n      };\n    }\n    try {\n      const token = await this.#vault.decrypt(connection.encrypted, { tenantId: request.tenantId });\n      const provider = this.#providerById(connection.provider);\n      const result = await provider.invoke(request, token, connection.scopes);\n      return { ok: true, provider: provider.id, result };\n    } catch (error) {\n      return {\n        ok: false,\n        error: error instanceof Error ? error.message : String(error),\n        suggestion: \"Refresh the connection or inspect provider health with `pnpm vault:doctor`.\",\n      };\n    }\n  }\n\n  async list(tenantId: string): Promise<ListedConnection[]> {\n    requireTenant(tenantId);\n    return this.#connections.list(tenantId);\n  }\n\n  async doctor(): Promise<{\n    ok: boolean;\n    providers: Array<{ ok: boolean; provider: string; suggestion?: string }>;\n  }> {\n    const limit = pLimit(PROVIDER_DOCTOR_CONCURRENCY);\n    const providers = await Promise.all(\n      this.#providers.map((provider) => limit(() => provider.doctor())),\n    );\n    return { ok: providers.some((provider) => provider.ok), providers };\n  }\n\n  async close(): Promise<void> {\n    await this.#vault.close();\n  }\n\n  #providerFor(app: string): IntegrationProvider {\n    const provider = this.#providers.find((candidate) => candidate.supports(app));\n    if (!provider) {\n      throw new CapabilityError(\"integration-vault\", \"No provider supports this app\", {\n        suggestion: \"Configure a provider adapter or local connector for this SaaS app.\",\n        metadata: { app },\n        statusCode: 404,\n      });\n    }\n    return provider;\n  }\n\n  #providerById(id: string): IntegrationProvider {\n    const provider = this.#providers.find((candidate) => candidate.id === id);\n    if (!provider) {\n      throw new CapabilityError(\"integration-vault\", \"Connection provider is unavailable\", {\n        suggestion: \"Reconnect this app or enable the provider adapter.\",\n        metadata: { provider: id },\n        statusCode: 404,\n      });\n    }\n    return provider;\n  }\n\n  #redact(connection: IntegrationConnection): ListedConnection {\n    return {\n      id: connection.id,\n      app: connection.app,\n      provider: connection.provider,\n      tokenId: connection.tokenId,\n      scopes: connection.scopes,\n      connectedAt: connection.connectedAt,\n    };\n  }\n}\n\nexport const vault = IntegrationVault.local();\n"],"mappings":";AAAA,SAAS,kBAAkB;AAC3B,SAAS,uBAAuB;AAChC,SAA+B,qBAAyC;AACxE,OAAO,YAAY;AAEnB,SAAS,mBAAAA,wBAAuB;AAsFhC,IAAM,8BAA8B;AAEpC,SAAS,cAAc,UAAwB;AAC7C,MAAI,CAAC,SAAS,KAAK,GAAG;AACpB,UAAM,IAAI,gBAAgB,qBAAqB,8BAA8B;AAAA,MAC3E,YACE;AAAA,MACF,YAAY;AAAA,IACd,CAAC;AAAA,EACH;AACF;AAEA,SAAS,WAAW,OAAiD;AACnE,SAAO,CAAC,MAAM,UAAU,MAAM,KAAK,MAAM,MAAM,EAAE,KAAK,GAAG;AAC3D;AAEO,IAAM,2BAAN,MAA2D;AAAA,EACvD,UAAU,oBAAI,IAA8B;AAAA,EAErD,MAAM,MAAM,OAAwC;AAClD,SAAK,QAAQ,IAAI,WAAW,KAAK,GAAG,EAAE,GAAG,OAAO,QAAQ,CAAC,GAAG,MAAM,MAAM,EAAE,CAAC;AAAA,EAC7E;AAAA,EAEA,MAAM,WAAW,OAA2C;AAC1D,UAAM,WAAW,KAAK,QAAQ,IAAI,WAAW,KAAK,CAAC;AACnD,QAAI,CAAC,SAAU,QAAO;AACtB,UAAM,SAAS,IAAI,IAAI,SAAS,MAAM;AACtC,WAAO,MAAM,OAAO,MAAM,CAAC,UAAU,OAAO,IAAI,KAAK,CAAC;AAAA,EACxD;AAAA,EAEA,MAAM,KAAK,UAAgD;AACzD,WAAO,MAAM,KAAK,KAAK,QAAQ,OAAO,CAAC,EAAE;AAAA,MACvC,CAAC,UAAU,aAAa,UAAa,MAAM,aAAa;AAAA,IAC1D;AAAA,EACF;AACF;AAEO,IAAM,8BAAN,MAAiE;AAAA,EAC7D;AAAA,EACA;AAAA,EAET,YAAY,SAAkD;AAC5D,SAAK,KAAK,QAAQ;AAClB,SAAK,QAAQ,IAAI,IAAI,QAAQ,IAAI;AAAA,EACnC;AAAA,EAEA,SAAS,KAAsB;AAC7B,WAAO,KAAK,MAAM,IAAI,GAAG,KAAK,KAAK,MAAM,IAAI,GAAG;AAAA,EAClD;AAAA,EAEA,MAAM,WAAW,SAAuD;AACtE,WAAO;AAAA,MACL,UAAU,KAAK;AAAA,MACf,KAAK,QAAQ;AAAA,MACb,KAAK,+BAA+B,QAAQ,GAAG,WAAW,QAAQ,QAAQ;AAAA,MAC1E,OAAO,SAAS,QAAQ,QAAQ,IAAI,QAAQ,GAAG;AAAA,MAC/C,QAAQ,QAAQ,UAAU,CAAC;AAAA,IAC7B;AAAA,EACF;AAAA,EAEA,MAAM,OACJ,SACA,QACA,SACkB;AAClB,WAAO,EAAE,KAAK,QAAQ,KAAK,QAAQ,QAAQ,QAAQ,GAAG,QAAQ,KAAK;AAAA,EACrE;AAAA,EAEA,MAAM,SAAqD;AACzD,WAAO,EAAE,IAAI,MAAM,UAAU,KAAK,GAAG;AAAA,EACvC;AACF;AAEO,IAAM,0BAAN,MAA6D;AAAA,EACzD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,SAKT;AACD,SAAK,KAAK,QAAQ;AAClB,SAAK,WAAW,QAAQ,QAAQ,QAAQ,OAAO,EAAE;AACjD,SAAK,QAAQ,IAAI,IAAI,QAAQ,QAAQ,CAAC,GAAG,CAAC;AAC1C,SAAK,SAAS,QAAQ,SAAS;AAAA,EACjC;AAAA,EAEA,SAAS,KAAsB;AAC7B,WAAO,KAAK,MAAM,IAAI,GAAG,KAAK,KAAK,MAAM,IAAI,GAAG;AAAA,EAClD;AAAA,EAEA,MAAM,WAAW,SAAuD;AACtE,WAAO;AAAA,MACL,UAAU,KAAK;AAAA,MACf,KAAK,QAAQ;AAAA,MACb,KAAK,GAAG,KAAK,QAAQ,UAAU,QAAQ,GAAG,iBAAiB,mBAAmB,QAAQ,QAAQ,CAAC;AAAA,MAC/F,OAAO,SAAS,QAAQ,QAAQ,IAAI,QAAQ,GAAG;AAAA,MAC/C,QAAQ,QAAQ,UAAU,CAAC;AAAA,IAC7B;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,SAAwB,OAAiC;AACpE,UAAM,WAAW,MAAM,KAAK,OAAO,GAAG,KAAK,QAAQ,WAAW;AAAA,MAC5D,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,eAAe,UAAU,KAAK;AAAA,QAC9B,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,KAAK,UAAU,OAAO;AAAA,IAC9B,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR;AAAA,QACA,YAAY,KAAK,EAAE,aAAa,SAAS,MAAM;AAAA,QAC/C;AAAA,UACE,YAAY;AAAA,UACZ,UAAU,EAAE,UAAU,KAAK,IAAI,KAAK,QAAQ,KAAK,QAAQ,SAAS,OAAO;AAAA,QAC3E;AAAA,MACF;AAAA,IACF;AACA,WAAO,SAAS,KAAK;AAAA,EACvB;AAAA,EAEA,MAAM,SAA0E;AAC9E,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,UAAU,KAAK;AAAA,MACf,YACE;AAAA,IACJ;AAAA,EACF;AACF;AAEA,IAAM,0BAAN,MAA8B;AAAA,EACnB,eAAe,oBAAI,IAAmC;AAAA,EAE/D,OAAO,YAA0D;AAC/D,SAAK,aAAa,IAAI,GAAG,WAAW,QAAQ,IAAI,WAAW,GAAG,IAAI,UAAU;AAC5E,WAAO;AAAA,EACT;AAAA,EAEA,IAAI,UAAkB,KAAgD;AACpE,WAAO,KAAK,aAAa,IAAI,GAAG,QAAQ,IAAI,GAAG,EAAE;AAAA,EACnD;AAAA,EAEA,KAAK,UAAsC;AACzC,WAAO,MAAM,KAAK,KAAK,aAAa,OAAO,CAAC,EACzC,OAAO,CAAC,eAAe,WAAW,aAAa,QAAQ,EACvD,IAAI,CAAC,gBAAgB;AAAA,MACpB,IAAI,WAAW;AAAA,MACf,KAAK,WAAW;AAAA,MAChB,UAAU,WAAW;AAAA,MACrB,SAAS,WAAW;AAAA,MACpB,QAAQ,WAAW;AAAA,MACnB,aAAa,WAAW;AAAA,IAC1B,EAAE;AAAA,EACN;AACF;AAEO,IAAM,mBAAN,MAAM,kBAAiB;AAAA,EACnB;AAAA,EACA;AAAA,EACA,eAAe,IAAI,wBAAwB;AAAA,EAC3C;AAAA,EAET,YAAY,SAAkC;AAC5C,SAAK,SACH,QAAQ,SACR,IAAI,cAAc;AAAA,MAChB,UAAU;AAAA,MACV,WAAW,QAAQ,IAAI,0BAA0B;AAAA,IACnD,CAAC;AACH,SAAK,aACH,QAAQ,aAAa,QAAQ,UAAU,SAAS,IAC5C,CAAC,GAAG,QAAQ,SAAS,IACrB,CAAC,IAAI,4BAA4B,EAAE,IAAI,SAAS,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;AACpE,SAAK,WAAW,QAAQ,WAAW,IAAI,yBAAyB;AAAA,EAClE;AAAA,EAEA,OAAO,MAAM,UAAmC,CAAC,GAAqB;AACpE,WAAO,IAAI,kBAAiB,OAAO;AAAA,EACrC;AAAA,EAEA,MAAM,WAAW,SAAuD;AACtE,kBAAc,QAAQ,QAAQ;AAC9B,WAAO,KAAK,aAAa,QAAQ,GAAG,EAAE,WAAW,OAAO;AAAA,EAC1D;AAAA,EAEA,MAAM,aAAa,SAAyD;AAC1E,kBAAc,QAAQ,QAAQ;AAC9B,UAAM,WAAW,QAAQ,WACrB,KAAK,WAAW,KAAK,CAAC,cAAc,UAAU,OAAO,QAAQ,QAAQ,IACrE,KAAK,aAAa,QAAQ,GAAG;AACjC,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,gBAAgB,qBAAqB,kCAAkC;AAAA,QAC/E,YAAY;AAAA,QACZ,UAAU,EAAE,KAAK,QAAQ,KAAK,UAAU,QAAQ,SAAS;AAAA,QACzD,YAAY;AAAA,MACd,CAAC;AAAA,IACH;AACA,UAAM,UAAU,OAAO,WAAW,CAAC;AACnC,UAAM,YAAY,MAAM,KAAK,OAAO,QAAQ,QAAQ,aAAa;AAAA,MAC/D,IAAI;AAAA,MACJ,UAAU,QAAQ;AAAA,MAClB,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,iBAAiB,MAAM,cAAc;AAAA,IACvE,CAAC;AACD,UAAM,aAAa,KAAK,aAAa,OAAO;AAAA,MAC1C,IAAI,QAAQ,WAAW,CAAC;AAAA,MACxB,UAAU,QAAQ;AAAA,MAClB,KAAK,QAAQ;AAAA,MACb,UAAU,SAAS;AAAA,MACnB;AAAA,MACA,QAAQ,CAAC,GAAG,QAAQ,MAAM;AAAA,MAC1B;AAAA,MACA,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,IACtC,CAAC;AACD,WAAO,KAAK,QAAQ,UAAU;AAAA,EAChC;AAAA,EAEA,MAAM,aAAa,OAAwC;AACzD,kBAAc,MAAM,QAAQ;AAC5B,UAAM,KAAK,SAAS,MAAM,KAAK;AAAA,EACjC;AAAA,EAEA,MAAM,OAAO,SAA+C;AAC1D,kBAAc,QAAQ,QAAQ;AAC9B,UAAM,aAAa,KAAK,aAAa,IAAI,QAAQ,UAAU,QAAQ,GAAG;AACtE,QAAI,CAAC,YAAY;AACf,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,YAAY,4BAA4B,QAAQ,GAAG,sBAAsB,QAAQ,GAAG,IAAI,QAAQ,MAAM;AAAA,MACxG;AAAA,IACF;AACA,UAAM,aAAa,MAAM,KAAK,SAAS,WAAW;AAAA,MAChD,UAAU,QAAQ;AAAA,MAClB,KAAK,QAAQ;AAAA,MACb,QAAQ,QAAQ;AAAA,MAChB,QAAQ,WAAW;AAAA,IACrB,CAAC;AACD,QAAI,CAAC,YAAY;AACf,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,YAAY,4BAA4B,QAAQ,GAAG,gBAAgB,QAAQ,GAAG,IAAI,QAAQ,MAAM;AAAA,MAClG;AAAA,IACF;AACA,QAAI;AACF,YAAM,QAAQ,MAAM,KAAK,OAAO,QAAQ,WAAW,WAAW,EAAE,UAAU,QAAQ,SAAS,CAAC;AAC5F,YAAM,WAAW,KAAK,cAAc,WAAW,QAAQ;AACvD,YAAM,SAAS,MAAM,SAAS,OAAO,SAAS,OAAO,WAAW,MAAM;AACtE,aAAO,EAAE,IAAI,MAAM,UAAU,SAAS,IAAI,OAAO;AAAA,IACnD,SAAS,OAAO;AACd,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,QAC5D,YAAY;AAAA,MACd;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,KAAK,UAA+C;AACxD,kBAAc,QAAQ;AACtB,WAAO,KAAK,aAAa,KAAK,QAAQ;AAAA,EACxC;AAAA,EAEA,MAAM,SAGH;AACD,UAAM,QAAQ,OAAO,2BAA2B;AAChD,UAAM,YAAY,MAAM,QAAQ;AAAA,MAC9B,KAAK,WAAW,IAAI,CAAC,aAAa,MAAM,MAAM,SAAS,OAAO,CAAC,CAAC;AAAA,IAClE;AACA,WAAO,EAAE,IAAI,UAAU,KAAK,CAAC,aAAa,SAAS,EAAE,GAAG,UAAU;AAAA,EACpE;AAAA,EAEA,MAAM,QAAuB;AAC3B,UAAM,KAAK,OAAO,MAAM;AAAA,EAC1B;AAAA,EAEA,aAAa,KAAkC;AAC7C,UAAM,WAAW,KAAK,WAAW,KAAK,CAAC,cAAc,UAAU,SAAS,GAAG,CAAC;AAC5E,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,gBAAgB,qBAAqB,iCAAiC;AAAA,QAC9E,YAAY;AAAA,QACZ,UAAU,EAAE,IAAI;AAAA,QAChB,YAAY;AAAA,MACd,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAAA,EAEA,cAAc,IAAiC;AAC7C,UAAM,WAAW,KAAK,WAAW,KAAK,CAAC,cAAc,UAAU,OAAO,EAAE;AACxE,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,gBAAgB,qBAAqB,sCAAsC;AAAA,QACnF,YAAY;AAAA,QACZ,UAAU,EAAE,UAAU,GAAG;AAAA,QACzB,YAAY;AAAA,MACd,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAAA,EAEA,QAAQ,YAAqD;AAC3D,WAAO;AAAA,MACL,IAAI,WAAW;AAAA,MACf,KAAK,WAAW;AAAA,MAChB,UAAU,WAAW;AAAA,MACrB,SAAS,WAAW;AAAA,MACpB,QAAQ,WAAW;AAAA,MACnB,aAAa,WAAW;AAAA,IAC1B;AAAA,EACF;AACF;AAEO,IAAM,QAAQ,iBAAiB,MAAM;","names":["CapabilityError"]}

package/dist/cli.js

@@ -1,6 +1,6 @@
 import {
   IntegrationVault
-} from "./chunk-6YC3QBSB.js";
+} from "./chunk-TQULRIQM.js";
 
 // src/cli.ts
 import { readFile, writeFile } from "fs/promises";

package/dist/index.js

@@ -5,7 +5,7 @@ import {
   InMemorySaasConsentStore,
   IntegrationVault,
   vault
-} from "./chunk-6YC3QBSB.js";
+} from "./chunk-TQULRIQM.js";
 export {
   CapabilityError,
   HttpIntegrationProvider,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nebutra/integration-vault",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Tenant-scoped SaaS OAuth and credential vault for tool calling",
   "private": false,
   "license": "MIT",
@@ -10,17 +10,22 @@
     "category": "integrations",
     "summary": "OAuth, secret storage, and SaaS action invocation boundary"
   },
-  "main": "./src/index.ts",
-  "types": "./src/index.ts",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
   "exports": {
-    ".": "./src/index.ts"
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
   },
   "dependencies": {
-    "@nebutra/errors": "0.1.1",
-    "@nebutra/vault": "0.1.1"
+    "p-limit": "^7.3.0",
+    "@nebutra/vault": "0.1.2",
+    "@nebutra/errors": "0.1.2"
   },
   "devDependencies": {
-    "@types/node": "^22.19.15",
+    "@types/node": "^25.9.1",
     "tsup": "^8.5.1",
     "typescript": "^5.9.3",
     "vitest": "^4.1.4"
@@ -37,6 +42,12 @@
   "publishConfig": {
     "access": "public"
   },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md"
+  ],
   "scripts": {
     "build": "tsup",
     "test": "vitest run",

package/.turbo/turbo-build.log

@@ -1,22 +0,0 @@
-
-> @nebutra/integration-vault@0.1.1 build /home/runner/work/Nebutra-Sailor/Nebutra-Sailor/packages/integrations/integration-vault
-> tsup
-
-CLI Building entry: src/cli.ts, src/index.ts
-CLI Using tsconfig: tsconfig.json
-CLI tsup v8.5.1
-CLI Using tsup config: /home/runner/work/Nebutra-Sailor/Nebutra-Sailor/packages/integrations/integration-vault/tsup.config.ts
-CLI Target: es2022
-CLI Cleaning output folder
-ESM Build start
-ESM dist/cli.js                2.07 KB
-ESM dist/index.js              350.00 B
-ESM dist/chunk-6YC3QBSB.js     8.84 KB
-ESM dist/cli.js.map            3.96 KB
-ESM dist/index.js.map          71.00 B
-ESM dist/chunk-6YC3QBSB.js.map 19.37 KB
-ESM ⚡️ Build success in 82ms
-DTS Build start
-DTS ⚡️ Build success in 13234ms
-DTS dist/cli.d.ts   13.00 B
-DTS dist/index.d.ts 4.66 KB

package/.turbo/turbo-test.log

@@ -1,14 +0,0 @@
-
-> @nebutra/integration-vault@0.1.1 test /home/runner/work/Nebutra-Sailor/Nebutra-Sailor/packages/integrations/integration-vault
-> vitest run
-
-
- RUN  v4.1.4 /home/runner/work/Nebutra-Sailor/Nebutra-Sailor/packages/integrations/integration-vault
-
- ✓ src/index.test.ts (3 tests) 49ms
-
- Test Files  1 passed (1)
-      Tests  3 passed (3)
-   Start at  08:15:06
-   Duration  3.41s (transform 1.01s, setup 0ms, import 2.23s, tests 49ms, environment 0ms)
-

package/.turbo/turbo-typecheck.log

@@ -1,4 +0,0 @@
-
-> @nebutra/integration-vault@0.1.1 typecheck /home/runner/work/Nebutra-Sailor/Nebutra-Sailor/packages/integrations/integration-vault
-> tsc --noEmit
-

package/dist/chunk-6YC3QBSB.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { CapabilityError } from \"@nebutra/errors\";\nimport { type EncryptedSecret, LocalProvider, type VaultProvider } from \"@nebutra/vault\";\n\nexport { CapabilityError } from \"@nebutra/errors\";\n\nexport interface OAuthStartRequest {\n  readonly app: string;\n  readonly tenantId: string;\n  readonly scopes?: readonly string[];\n}\n\nexport interface OAuthStartResult {\n  readonly provider: string;\n  readonly app: string;\n  readonly url: string;\n  readonly state: string;\n  readonly scopes: readonly string[];\n}\n\nexport interface ConnectTokenRequest {\n  readonly tenantId: string;\n  readonly app: string;\n  readonly accessToken: string;\n  readonly scopes: readonly string[];\n  readonly provider?: string;\n}\n\nexport interface InvokeRequest {\n  readonly tenantId: string;\n  readonly app: string;\n  readonly action: string;\n  readonly args: Record<string, unknown>;\n}\n\nexport interface InvokeResult {\n  readonly ok: boolean;\n  readonly provider?: string;\n  readonly result?: unknown;\n  readonly suggestion?: string;\n  readonly error?: string;\n}\n\nexport interface IntegrationConnection {\n  readonly id: string;\n  readonly tenantId: string;\n  readonly app: string;\n  readonly provider: string;\n  readonly tokenId: string;\n  readonly scopes: readonly string[];\n  readonly encrypted: EncryptedSecret;\n  readonly connectedAt: string;\n}\n\nexport interface ListedConnection {\n  readonly id: string;\n  readonly app: string;\n  readonly provider: string;\n  readonly tokenId: string;\n  readonly scopes: readonly string[];\n  readonly connectedAt: string;\n}\n\nexport interface IntegrationProvider {\n  readonly id: string;\n  supports(app: string): boolean;\n  startOAuth(request: OAuthStartRequest): Promise<OAuthStartResult>;\n  invoke(request: InvokeRequest, token: string, scopes: readonly string[]): Promise<unknown>;\n  doctor(): Promise<{ ok: boolean; provider: string; suggestion?: string }>;\n}\n\nexport interface SaasConsentGrant {\n  readonly tenantId: string;\n  readonly app: string;\n  readonly action: string;\n  readonly scopes: readonly string[];\n}\n\nexport interface SaasConsentStore {\n  grant(grant: SaasConsentGrant): Promise<void>;\n  hasConsent(grant: SaasConsentGrant): Promise<boolean>;\n  list(tenantId?: string): Promise<SaasConsentGrant[]>;\n}\n\nexport interface IntegrationVaultOptions {\n  readonly vault?: VaultProvider;\n  readonly providers?: readonly IntegrationProvider[];\n  readonly consent?: SaasConsentStore;\n}\n\nfunction requireTenant(tenantId: string): void {\n  if (!tenantId.trim()) {\n    throw new CapabilityError(\"integration-vault\", \"Tenant context is required\", {\n      suggestion:\n        \"Pass tenantId from the Sailor tenant context before starting OAuth or invoking SaaS tools.\",\n      statusCode: 400,\n    });\n  }\n}\n\nfunction consentKey(grant: Omit<SaasConsentGrant, \"scopes\">): string {\n  return [grant.tenantId, grant.app, grant.action].join(\":\");\n}\n\nexport class InMemorySaasConsentStore implements SaasConsentStore {\n  readonly #grants = new Map<string, SaasConsentGrant>();\n\n  async grant(grant: SaasConsentGrant): Promise<void> {\n    this.#grants.set(consentKey(grant), { ...grant, scopes: [...grant.scopes] });\n  }\n\n  async hasConsent(grant: SaasConsentGrant): Promise<boolean> {\n    const existing = this.#grants.get(consentKey(grant));\n    if (!existing) return false;\n    const scopes = new Set(existing.scopes);\n    return grant.scopes.every((scope) => scopes.has(scope));\n  }\n\n  async list(tenantId?: string): Promise<SaasConsentGrant[]> {\n    return Array.from(this.#grants.values()).filter(\n      (grant) => tenantId === undefined || grant.tenantId === tenantId,\n    );\n  }\n}\n\nexport class InMemoryIntegrationProvider implements IntegrationProvider {\n  readonly id: string;\n  readonly #apps: ReadonlySet<string>;\n\n  constructor(options: { id: string; apps: readonly string[] }) {\n    this.id = options.id;\n    this.#apps = new Set(options.apps);\n  }\n\n  supports(app: string): boolean {\n    return this.#apps.has(app) || this.#apps.has(\"*\");\n  }\n\n  async startOAuth(request: OAuthStartRequest): Promise<OAuthStartResult> {\n    return {\n      provider: this.id,\n      app: request.app,\n      url: `http://127.0.0.1:8787/oauth/${request.app}?tenant=${request.tenantId}`,\n      state: `state_${request.tenantId}_${request.app}`,\n      scopes: request.scopes ?? [],\n    };\n  }\n\n  async invoke(\n    request: InvokeRequest,\n    _token: string,\n    _scopes: readonly string[],\n  ): Promise<unknown> {\n    return { app: request.app, action: request.action, ...request.args };\n  }\n\n  async doctor(): Promise<{ ok: boolean; provider: string }> {\n    return { ok: true, provider: this.id };\n  }\n}\n\nexport class HttpIntegrationProvider implements IntegrationProvider {\n  readonly id: string;\n  readonly #baseUrl: string;\n  readonly #apps: ReadonlySet<string>;\n  readonly #fetch: typeof fetch;\n\n  constructor(options: {\n    id: string;\n    baseUrl: string;\n    apps?: readonly string[];\n    fetch?: typeof fetch;\n  }) {\n    this.id = options.id;\n    this.#baseUrl = options.baseUrl.replace(/\\/$/, \"\");\n    this.#apps = new Set(options.apps ?? [\"*\"]);\n    this.#fetch = options.fetch ?? fetch;\n  }\n\n  supports(app: string): boolean {\n    return this.#apps.has(app) || this.#apps.has(\"*\");\n  }\n\n  async startOAuth(request: OAuthStartRequest): Promise<OAuthStartResult> {\n    return {\n      provider: this.id,\n      app: request.app,\n      url: `${this.#baseUrl}/oauth/${request.app}/start?tenant=${encodeURIComponent(request.tenantId)}`,\n      state: `state_${request.tenantId}_${request.app}`,\n      scopes: request.scopes ?? [],\n    };\n  }\n\n  async invoke(request: InvokeRequest, token: string): Promise<unknown> {\n    const response = await this.#fetch(`${this.#baseUrl}/invoke`, {\n      method: \"POST\",\n      headers: {\n        authorization: `Bearer ${token}`,\n        \"content-type\": \"application/json\",\n      },\n      body: JSON.stringify(request),\n    });\n    if (!response.ok) {\n      throw new CapabilityError(\n        \"integration-vault\",\n        `Provider ${this.id} returned ${response.status}`,\n        {\n          suggestion: \"Run `pnpm vault:doctor` and refresh or reconnect this SaaS app.\",\n          metadata: { provider: this.id, app: request.app, status: response.status },\n        },\n      );\n    }\n    return response.json();\n  }\n\n  async doctor(): Promise<{ ok: boolean; provider: string; suggestion?: string }> {\n    return {\n      ok: true,\n      provider: this.id,\n      suggestion:\n        \"Network health is checked on invoke; configure provider API keys in the sidecar environment.\",\n    };\n  }\n}\n\nclass InMemoryConnectionStore {\n  readonly #connections = new Map<string, IntegrationConnection>();\n\n  upsert(connection: IntegrationConnection): IntegrationConnection {\n    this.#connections.set(`${connection.tenantId}:${connection.app}`, connection);\n    return connection;\n  }\n\n  get(tenantId: string, app: string): IntegrationConnection | undefined {\n    return this.#connections.get(`${tenantId}:${app}`);\n  }\n\n  list(tenantId: string): ListedConnection[] {\n    return Array.from(this.#connections.values())\n      .filter((connection) => connection.tenantId === tenantId)\n      .map((connection) => ({\n        id: connection.id,\n        app: connection.app,\n        provider: connection.provider,\n        tokenId: connection.tokenId,\n        scopes: connection.scopes,\n        connectedAt: connection.connectedAt,\n      }));\n  }\n}\n\nexport class IntegrationVault {\n  readonly #vault: VaultProvider;\n  readonly #providers: IntegrationProvider[];\n  readonly #connections = new InMemoryConnectionStore();\n  readonly #consent: SaasConsentStore;\n\n  constructor(options: IntegrationVaultOptions) {\n    this.#vault =\n      options.vault ??\n      new LocalProvider({\n        provider: \"local\",\n        masterKey: process.env.VAULT_LOCAL_MASTER_KEY ?? \"integration-vault-local-development-key\",\n      });\n    this.#providers =\n      options.providers && options.providers.length > 0\n        ? [...options.providers]\n        : [new InMemoryIntegrationProvider({ id: \"local\", apps: [\"*\"] })];\n    this.#consent = options.consent ?? new InMemorySaasConsentStore();\n  }\n\n  static local(options: IntegrationVaultOptions = {}): IntegrationVault {\n    return new IntegrationVault(options);\n  }\n\n  async startOAuth(request: OAuthStartRequest): Promise<OAuthStartResult> {\n    requireTenant(request.tenantId);\n    return this.#providerFor(request.app).startOAuth(request);\n  }\n\n  async connectToken(request: ConnectTokenRequest): Promise<ListedConnection> {\n    requireTenant(request.tenantId);\n    const provider = request.provider\n      ? this.#providers.find((candidate) => candidate.id === request.provider)\n      : this.#providerFor(request.app);\n    if (!provider) {\n      throw new CapabilityError(\"integration-vault\", \"Integration provider not found\", {\n        suggestion: \"Configure a provider adapter before connecting this app.\",\n        metadata: { app: request.app, provider: request.provider },\n        statusCode: 404,\n      });\n    }\n    const tokenId = `tok_${randomUUID()}`;\n    const encrypted = await this.#vault.encrypt(request.accessToken, {\n      id: tokenId,\n      tenantId: request.tenantId,\n      metadata: { name: `${request.app}:access-token`, type: \"oauth_token\" },\n    });\n    const connection = this.#connections.upsert({\n      id: `conn_${randomUUID()}`,\n      tenantId: request.tenantId,\n      app: request.app,\n      provider: provider.id,\n      tokenId,\n      scopes: [...request.scopes],\n      encrypted,\n      connectedAt: new Date().toISOString(),\n    });\n    return this.#redact(connection);\n  }\n\n  async grantConsent(grant: SaasConsentGrant): Promise<void> {\n    requireTenant(grant.tenantId);\n    await this.#consent.grant(grant);\n  }\n\n  async invoke(request: InvokeRequest): Promise<InvokeResult> {\n    requireTenant(request.tenantId);\n    const connection = this.#connections.get(request.tenantId, request.app);\n    if (!connection) {\n      return {\n        ok: false,\n        error: \"App is not connected\",\n        suggestion: `Run \\`pnpm vault:connect ${request.app}\\` before invoking ${request.app}.${request.action}.`,\n      };\n    }\n    const hasConsent = await this.#consent.hasConsent({\n      tenantId: request.tenantId,\n      app: request.app,\n      action: request.action,\n      scopes: connection.scopes,\n    });\n    if (!hasConsent) {\n      return {\n        ok: false,\n        error: \"SaaS action is not authorized\",\n        suggestion: `Run \\`pnpm vault:connect ${request.app}\\` and grant ${request.app}.${request.action} for this tenant.`,\n      };\n    }\n    try {\n      const token = await this.#vault.decrypt(connection.encrypted, { tenantId: request.tenantId });\n      const provider = this.#providerById(connection.provider);\n      const result = await provider.invoke(request, token, connection.scopes);\n      return { ok: true, provider: provider.id, result };\n    } catch (error) {\n      return {\n        ok: false,\n        error: error instanceof Error ? error.message : String(error),\n        suggestion: \"Refresh the connection or inspect provider health with `pnpm vault:doctor`.\",\n      };\n    }\n  }\n\n  async list(tenantId: string): Promise<ListedConnection[]> {\n    requireTenant(tenantId);\n    return this.#connections.list(tenantId);\n  }\n\n  async doctor(): Promise<{\n    ok: boolean;\n    providers: Array<{ ok: boolean; provider: string; suggestion?: string }>;\n  }> {\n    const providers = await Promise.all(this.#providers.map((provider) => provider.doctor()));\n    return { ok: providers.some((provider) => provider.ok), providers };\n  }\n\n  async close(): Promise<void> {\n    await this.#vault.close();\n  }\n\n  #providerFor(app: string): IntegrationProvider {\n    const provider = this.#providers.find((candidate) => candidate.supports(app));\n    if (!provider) {\n      throw new CapabilityError(\"integration-vault\", \"No provider supports this app\", {\n        suggestion: \"Configure a provider adapter or local connector for this SaaS app.\",\n        metadata: { app },\n        statusCode: 404,\n      });\n    }\n    return provider;\n  }\n\n  #providerById(id: string): IntegrationProvider {\n    const provider = this.#providers.find((candidate) => candidate.id === id);\n    if (!provider) {\n      throw new CapabilityError(\"integration-vault\", \"Connection provider is unavailable\", {\n        suggestion: \"Reconnect this app or enable the provider adapter.\",\n        metadata: { provider: id },\n        statusCode: 404,\n      });\n    }\n    return provider;\n  }\n\n  #redact(connection: IntegrationConnection): ListedConnection {\n    return {\n      id: connection.id,\n      app: connection.app,\n      provider: connection.provider,\n      tokenId: connection.tokenId,\n      scopes: connection.scopes,\n      connectedAt: connection.connectedAt,\n    };\n  }\n}\n\nexport const vault = IntegrationVault.local();\n"],"mappings":";AAAA,SAAS,kBAAkB;AAC3B,SAAS,uBAAuB;AAChC,SAA+B,qBAAyC;AAExE,SAAS,mBAAAA,wBAAuB;AAsFhC,SAAS,cAAc,UAAwB;AAC7C,MAAI,CAAC,SAAS,KAAK,GAAG;AACpB,UAAM,IAAI,gBAAgB,qBAAqB,8BAA8B;AAAA,MAC3E,YACE;AAAA,MACF,YAAY;AAAA,IACd,CAAC;AAAA,EACH;AACF;AAEA,SAAS,WAAW,OAAiD;AACnE,SAAO,CAAC,MAAM,UAAU,MAAM,KAAK,MAAM,MAAM,EAAE,KAAK,GAAG;AAC3D;AAEO,IAAM,2BAAN,MAA2D;AAAA,EACvD,UAAU,oBAAI,IAA8B;AAAA,EAErD,MAAM,MAAM,OAAwC;AAClD,SAAK,QAAQ,IAAI,WAAW,KAAK,GAAG,EAAE,GAAG,OAAO,QAAQ,CAAC,GAAG,MAAM,MAAM,EAAE,CAAC;AAAA,EAC7E;AAAA,EAEA,MAAM,WAAW,OAA2C;AAC1D,UAAM,WAAW,KAAK,QAAQ,IAAI,WAAW,KAAK,CAAC;AACnD,QAAI,CAAC,SAAU,QAAO;AACtB,UAAM,SAAS,IAAI,IAAI,SAAS,MAAM;AACtC,WAAO,MAAM,OAAO,MAAM,CAAC,UAAU,OAAO,IAAI,KAAK,CAAC;AAAA,EACxD;AAAA,EAEA,MAAM,KAAK,UAAgD;AACzD,WAAO,MAAM,KAAK,KAAK,QAAQ,OAAO,CAAC,EAAE;AAAA,MACvC,CAAC,UAAU,aAAa,UAAa,MAAM,aAAa;AAAA,IAC1D;AAAA,EACF;AACF;AAEO,IAAM,8BAAN,MAAiE;AAAA,EAC7D;AAAA,EACA;AAAA,EAET,YAAY,SAAkD;AAC5D,SAAK,KAAK,QAAQ;AAClB,SAAK,QAAQ,IAAI,IAAI,QAAQ,IAAI;AAAA,EACnC;AAAA,EAEA,SAAS,KAAsB;AAC7B,WAAO,KAAK,MAAM,IAAI,GAAG,KAAK,KAAK,MAAM,IAAI,GAAG;AAAA,EAClD;AAAA,EAEA,MAAM,WAAW,SAAuD;AACtE,WAAO;AAAA,MACL,UAAU,KAAK;AAAA,MACf,KAAK,QAAQ;AAAA,MACb,KAAK,+BAA+B,QAAQ,GAAG,WAAW,QAAQ,QAAQ;AAAA,MAC1E,OAAO,SAAS,QAAQ,QAAQ,IAAI,QAAQ,GAAG;AAAA,MAC/C,QAAQ,QAAQ,UAAU,CAAC;AAAA,IAC7B;AAAA,EACF;AAAA,EAEA,MAAM,OACJ,SACA,QACA,SACkB;AAClB,WAAO,EAAE,KAAK,QAAQ,KAAK,QAAQ,QAAQ,QAAQ,GAAG,QAAQ,KAAK;AAAA,EACrE;AAAA,EAEA,MAAM,SAAqD;AACzD,WAAO,EAAE,IAAI,MAAM,UAAU,KAAK,GAAG;AAAA,EACvC;AACF;AAEO,IAAM,0BAAN,MAA6D;AAAA,EACzD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,SAKT;AACD,SAAK,KAAK,QAAQ;AAClB,SAAK,WAAW,QAAQ,QAAQ,QAAQ,OAAO,EAAE;AACjD,SAAK,QAAQ,IAAI,IAAI,QAAQ,QAAQ,CAAC,GAAG,CAAC;AAC1C,SAAK,SAAS,QAAQ,SAAS;AAAA,EACjC;AAAA,EAEA,SAAS,KAAsB;AAC7B,WAAO,KAAK,MAAM,IAAI,GAAG,KAAK,KAAK,MAAM,IAAI,GAAG;AAAA,EAClD;AAAA,EAEA,MAAM,WAAW,SAAuD;AACtE,WAAO;AAAA,MACL,UAAU,KAAK;AAAA,MACf,KAAK,QAAQ;AAAA,MACb,KAAK,GAAG,KAAK,QAAQ,UAAU,QAAQ,GAAG,iBAAiB,mBAAmB,QAAQ,QAAQ,CAAC;AAAA,MAC/F,OAAO,SAAS,QAAQ,QAAQ,IAAI,QAAQ,GAAG;AAAA,MAC/C,QAAQ,QAAQ,UAAU,CAAC;AAAA,IAC7B;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,SAAwB,OAAiC;AACpE,UAAM,WAAW,MAAM,KAAK,OAAO,GAAG,KAAK,QAAQ,WAAW;AAAA,MAC5D,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,eAAe,UAAU,KAAK;AAAA,QAC9B,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,KAAK,UAAU,OAAO;AAAA,IAC9B,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR;AAAA,QACA,YAAY,KAAK,EAAE,aAAa,SAAS,MAAM;AAAA,QAC/C;AAAA,UACE,YAAY;AAAA,UACZ,UAAU,EAAE,UAAU,KAAK,IAAI,KAAK,QAAQ,KAAK,QAAQ,SAAS,OAAO;AAAA,QAC3E;AAAA,MACF;AAAA,IACF;AACA,WAAO,SAAS,KAAK;AAAA,EACvB;AAAA,EAEA,MAAM,SAA0E;AAC9E,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,UAAU,KAAK;AAAA,MACf,YACE;AAAA,IACJ;AAAA,EACF;AACF;AAEA,IAAM,0BAAN,MAA8B;AAAA,EACnB,eAAe,oBAAI,IAAmC;AAAA,EAE/D,OAAO,YAA0D;AAC/D,SAAK,aAAa,IAAI,GAAG,WAAW,QAAQ,IAAI,WAAW,GAAG,IAAI,UAAU;AAC5E,WAAO;AAAA,EACT;AAAA,EAEA,IAAI,UAAkB,KAAgD;AACpE,WAAO,KAAK,aAAa,IAAI,GAAG,QAAQ,IAAI,GAAG,EAAE;AAAA,EACnD;AAAA,EAEA,KAAK,UAAsC;AACzC,WAAO,MAAM,KAAK,KAAK,aAAa,OAAO,CAAC,EACzC,OAAO,CAAC,eAAe,WAAW,aAAa,QAAQ,EACvD,IAAI,CAAC,gBAAgB;AAAA,MACpB,IAAI,WAAW;AAAA,MACf,KAAK,WAAW;AAAA,MAChB,UAAU,WAAW;AAAA,MACrB,SAAS,WAAW;AAAA,MACpB,QAAQ,WAAW;AAAA,MACnB,aAAa,WAAW;AAAA,IAC1B,EAAE;AAAA,EACN;AACF;AAEO,IAAM,mBAAN,MAAM,kBAAiB;AAAA,EACnB;AAAA,EACA;AAAA,EACA,eAAe,IAAI,wBAAwB;AAAA,EAC3C;AAAA,EAET,YAAY,SAAkC;AAC5C,SAAK,SACH,QAAQ,SACR,IAAI,cAAc;AAAA,MAChB,UAAU;AAAA,MACV,WAAW,QAAQ,IAAI,0BAA0B;AAAA,IACnD,CAAC;AACH,SAAK,aACH,QAAQ,aAAa,QAAQ,UAAU,SAAS,IAC5C,CAAC,GAAG,QAAQ,SAAS,IACrB,CAAC,IAAI,4BAA4B,EAAE,IAAI,SAAS,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;AACpE,SAAK,WAAW,QAAQ,WAAW,IAAI,yBAAyB;AAAA,EAClE;AAAA,EAEA,OAAO,MAAM,UAAmC,CAAC,GAAqB;AACpE,WAAO,IAAI,kBAAiB,OAAO;AAAA,EACrC;AAAA,EAEA,MAAM,WAAW,SAAuD;AACtE,kBAAc,QAAQ,QAAQ;AAC9B,WAAO,KAAK,aAAa,QAAQ,GAAG,EAAE,WAAW,OAAO;AAAA,EAC1D;AAAA,EAEA,MAAM,aAAa,SAAyD;AAC1E,kBAAc,QAAQ,QAAQ;AAC9B,UAAM,WAAW,QAAQ,WACrB,KAAK,WAAW,KAAK,CAAC,cAAc,UAAU,OAAO,QAAQ,QAAQ,IACrE,KAAK,aAAa,QAAQ,GAAG;AACjC,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,gBAAgB,qBAAqB,kCAAkC;AAAA,QAC/E,YAAY;AAAA,QACZ,UAAU,EAAE,KAAK,QAAQ,KAAK,UAAU,QAAQ,SAAS;AAAA,QACzD,YAAY;AAAA,MACd,CAAC;AAAA,IACH;AACA,UAAM,UAAU,OAAO,WAAW,CAAC;AACnC,UAAM,YAAY,MAAM,KAAK,OAAO,QAAQ,QAAQ,aAAa;AAAA,MAC/D,IAAI;AAAA,MACJ,UAAU,QAAQ;AAAA,MAClB,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,iBAAiB,MAAM,cAAc;AAAA,IACvE,CAAC;AACD,UAAM,aAAa,KAAK,aAAa,OAAO;AAAA,MAC1C,IAAI,QAAQ,WAAW,CAAC;AAAA,MACxB,UAAU,QAAQ;AAAA,MAClB,KAAK,QAAQ;AAAA,MACb,UAAU,SAAS;AAAA,MACnB;AAAA,MACA,QAAQ,CAAC,GAAG,QAAQ,MAAM;AAAA,MAC1B;AAAA,MACA,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,IACtC,CAAC;AACD,WAAO,KAAK,QAAQ,UAAU;AAAA,EAChC;AAAA,EAEA,MAAM,aAAa,OAAwC;AACzD,kBAAc,MAAM,QAAQ;AAC5B,UAAM,KAAK,SAAS,MAAM,KAAK;AAAA,EACjC;AAAA,EAEA,MAAM,OAAO,SAA+C;AAC1D,kBAAc,QAAQ,QAAQ;AAC9B,UAAM,aAAa,KAAK,aAAa,IAAI,QAAQ,UAAU,QAAQ,GAAG;AACtE,QAAI,CAAC,YAAY;AACf,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,YAAY,4BAA4B,QAAQ,GAAG,sBAAsB,QAAQ,GAAG,IAAI,QAAQ,MAAM;AAAA,MACxG;AAAA,IACF;AACA,UAAM,aAAa,MAAM,KAAK,SAAS,WAAW;AAAA,MAChD,UAAU,QAAQ;AAAA,MAClB,KAAK,QAAQ;AAAA,MACb,QAAQ,QAAQ;AAAA,MAChB,QAAQ,WAAW;AAAA,IACrB,CAAC;AACD,QAAI,CAAC,YAAY;AACf,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO;AAAA,QACP,YAAY,4BAA4B,QAAQ,GAAG,gBAAgB,QAAQ,GAAG,IAAI,QAAQ,MAAM;AAAA,MAClG;AAAA,IACF;AACA,QAAI;AACF,YAAM,QAAQ,MAAM,KAAK,OAAO,QAAQ,WAAW,WAAW,EAAE,UAAU,QAAQ,SAAS,CAAC;AAC5F,YAAM,WAAW,KAAK,cAAc,WAAW,QAAQ;AACvD,YAAM,SAAS,MAAM,SAAS,OAAO,SAAS,OAAO,WAAW,MAAM;AACtE,aAAO,EAAE,IAAI,MAAM,UAAU,SAAS,IAAI,OAAO;AAAA,IACnD,SAAS,OAAO;AACd,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,QAC5D,YAAY;AAAA,MACd;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,KAAK,UAA+C;AACxD,kBAAc,QAAQ;AACtB,WAAO,KAAK,aAAa,KAAK,QAAQ;AAAA,EACxC;AAAA,EAEA,MAAM,SAGH;AACD,UAAM,YAAY,MAAM,QAAQ,IAAI,KAAK,WAAW,IAAI,CAAC,aAAa,SAAS,OAAO,CAAC,CAAC;AACxF,WAAO,EAAE,IAAI,UAAU,KAAK,CAAC,aAAa,SAAS,EAAE,GAAG,UAAU;AAAA,EACpE;AAAA,EAEA,MAAM,QAAuB;AAC3B,UAAM,KAAK,OAAO,MAAM;AAAA,EAC1B;AAAA,EAEA,aAAa,KAAkC;AAC7C,UAAM,WAAW,KAAK,WAAW,KAAK,CAAC,cAAc,UAAU,SAAS,GAAG,CAAC;AAC5E,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,gBAAgB,qBAAqB,iCAAiC;AAAA,QAC9E,YAAY;AAAA,QACZ,UAAU,EAAE,IAAI;AAAA,QAChB,YAAY;AAAA,MACd,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAAA,EAEA,cAAc,IAAiC;AAC7C,UAAM,WAAW,KAAK,WAAW,KAAK,CAAC,cAAc,UAAU,OAAO,EAAE;AACxE,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,gBAAgB,qBAAqB,sCAAsC;AAAA,QACnF,YAAY;AAAA,QACZ,UAAU,EAAE,UAAU,GAAG;AAAA,QACzB,YAAY;AAAA,MACd,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAAA,EAEA,QAAQ,YAAqD;AAC3D,WAAO;AAAA,MACL,IAAI,WAAW;AAAA,MACf,KAAK,WAAW;AAAA,MAChB,UAAU,WAAW;AAAA,MACrB,SAAS,WAAW;AAAA,MACpB,QAAQ,WAAW;AAAA,MACnB,aAAa,WAAW;AAAA,IAC1B;AAAA,EACF;AACF;AAEO,IAAM,QAAQ,iBAAiB,MAAM;","names":["CapabilityError"]}

package/examples/connect-token.ts

@@ -1,34 +0,0 @@
-import { InMemoryIntegrationProvider, IntegrationVault } from "../src";
-
-const vault = IntegrationVault.local({
-  providers: [new InMemoryIntegrationProvider({ id: "local", apps: ["docs"] })],
-});
-
-try {
-  const flow = await vault.startOAuth({
-    tenantId: "tenant_demo",
-    app: "docs",
-    scopes: ["documents:write"],
-  });
-
-  const connection = await vault.connectToken({
-    tenantId: "tenant_demo",
-    app: "docs",
-    accessToken: "local-development-token",
-    scopes: flow.scopes,
-  });
-
-  process.stdout.write(
-    `${JSON.stringify(
-      {
-        auth_url: flow.url,
-        token_id: connection.tokenId,
-        scopes: connection.scopes,
-      },
-      null,
-      2,
-    )}\n`,
-  );
-} finally {
-  await vault.close();
-}

package/examples/invoke-consented.ts

@@ -1,32 +0,0 @@
-import { InMemoryIntegrationProvider, IntegrationVault } from "../src";
-
-const vault = IntegrationVault.local({
-  providers: [new InMemoryIntegrationProvider({ id: "local", apps: ["docs"] })],
-});
-
-try {
-  await vault.connectToken({
-    tenantId: "tenant_demo",
-    app: "docs",
-    accessToken: "local-development-token",
-    scopes: ["documents:write"],
-  });
-
-  await vault.grantConsent({
-    tenantId: "tenant_demo",
-    app: "docs",
-    action: "create_page",
-    scopes: ["documents:write"],
-  });
-
-  const result = await vault.invoke({
-    tenantId: "tenant_demo",
-    app: "docs",
-    action: "create_page",
-    args: { title: "Layer 1", body: "Published through the integration vault." },
-  });
-
-  process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
-} finally {
-  await vault.close();
-}

package/examples/provider-fallback.ts

@@ -1,26 +0,0 @@
-import { InMemoryIntegrationProvider, IntegrationVault } from "../src";
-
-const vault = IntegrationVault.local({
-  providers: [
-    new InMemoryIntegrationProvider({ id: "primary", apps: ["crm"] }),
-    new InMemoryIntegrationProvider({ id: "fallback", apps: ["*"] }),
-  ],
-});
-
-try {
-  const direct = await vault.startOAuth({ tenantId: "tenant_demo", app: "crm" });
-  const fallback = await vault.startOAuth({ tenantId: "tenant_demo", app: "calendar" });
-
-  process.stdout.write(
-    `${JSON.stringify(
-      {
-        direct_provider: direct.provider,
-        fallback_provider: fallback.provider,
-      },
-      null,
-      2,
-    )}\n`,
-  );
-} finally {
-  await vault.close();
-}

package/src/cli.ts

@@ -1,57 +0,0 @@
-import { readFile, writeFile } from "node:fs/promises";
-import { dirname, join } from "node:path";
-import { IntegrationVault } from "./index";
-
-const command = process.argv[2] ?? "doctor";
-const tenantId = process.env.TENANT_ID ?? "local";
-const statePath = join(process.cwd(), ".nebutra", "debug", "integration-vault.jsonl");
-const vault = IntegrationVault.local();
-
-async function appendState(entry: Record<string, unknown>): Promise<void> {
-  await writeFile(statePath, `${JSON.stringify({ at: new Date().toISOString(), ...entry })}\n`, {
-    flag: "a",
-  }).catch(async (error) => {
-    if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
-    await import("node:fs/promises").then(({ mkdir }) =>
-      mkdir(dirname(statePath), { recursive: true }),
-    );
-    await writeFile(statePath, `${JSON.stringify({ at: new Date().toISOString(), ...entry })}\n`, {
-      flag: "a",
-    });
-  });
-}
-
-try {
-  if (command === "doctor") {
-    process.stdout.write(
-      `${JSON.stringify({ capability: "integration-vault", ...(await vault.doctor()) }, null, 2)}\n`,
-    );
-  } else if (command === "connect") {
-    const app = process.argv[3];
-    if (!app) throw new Error("Missing app name");
-    const flow = await vault.startOAuth({ app, tenantId });
-    await appendState({ type: "connect", app, tenantId, flow });
-    process.stdout.write(
-      `${JSON.stringify({ capability: "integration-vault", auth_url: flow.url, state: flow.state }, null, 2)}\n`,
-    );
-  } else if (command === "list") {
-    process.stdout.write(
-      `${JSON.stringify({ capability: "integration-vault", connections: await vault.list(tenantId) }, null, 2)}\n`,
-    );
-  } else if (command === "debug") {
-    const raw = await readFile(statePath, "utf8").catch(() => "");
-    const entries = raw
-      .trim()
-      .split("\n")
-      .filter(Boolean)
-      .map((line) => JSON.parse(line) as unknown);
-    process.stdout.write(
-      `${JSON.stringify({ capability: "integration-vault", entries }, null, 2)}\n`,
-    );
-  } else {
-    process.stderr.write(`Unknown integration-vault command: ${command}\n`);
-    process.exitCode = 1;
-  }
-} finally {
-  await vault.close();
-}

package/src/index.test.ts

@@ -1,86 +0,0 @@
-import { describe, expect, it } from "vitest";
-import {
-  CapabilityError,
-  InMemoryIntegrationProvider,
-  InMemorySaasConsentStore,
-  IntegrationVault,
-} from "./index";
-
-describe("IntegrationVault", () => {
-  it("requires tenant context before starting OAuth", async () => {
-    const vault = IntegrationVault.local({
-      providers: [new InMemoryIntegrationProvider({ id: "local", apps: ["notion"] })],
-    });
-
-    await expect(vault.startOAuth({ app: "notion", tenantId: "" })).rejects.toThrow(
-      CapabilityError,
-    );
-  });
-
-  it("stores tokens encrypted and lists only token ids and scopes", async () => {
-    const vault = IntegrationVault.local({
-      providers: [new InMemoryIntegrationProvider({ id: "local", apps: ["notion"] })],
-    });
-    const connection = await vault.connectToken({
-      tenantId: "tenant_a",
-      app: "notion",
-      accessToken: "secret-token",
-      scopes: ["pages:write"],
-    });
-
-    await expect(vault.list("tenant_a")).resolves.toEqual([
-      expect.objectContaining({
-        app: "notion",
-        tokenId: connection.tokenId,
-        scopes: ["pages:write"],
-      }),
-    ]);
-    expect(JSON.stringify(await vault.list("tenant_a"))).not.toContain("secret-token");
-  });
-
-  it("requires explicit per-action consent before invoking a SaaS action", async () => {
-    const consent = new InMemorySaasConsentStore();
-    const vault = IntegrationVault.local({
-      consent,
-      providers: [new InMemoryIntegrationProvider({ id: "local", apps: ["notion"] })],
-    });
-    await vault.connectToken({
-      tenantId: "tenant_a",
-      app: "notion",
-      accessToken: "secret-token",
-      scopes: ["pages:write"],
-    });
-
-    await expect(
-      vault.invoke({
-        tenantId: "tenant_a",
-        app: "notion",
-        action: "create_page",
-        args: { title: "Layer 1" },
-      }),
-    ).resolves.toMatchObject({
-      ok: false,
-      suggestion: expect.stringContaining("vault:connect"),
-    });
-
-    await consent.grant({
-      tenantId: "tenant_a",
-      app: "notion",
-      action: "create_page",
-      scopes: ["pages:write"],
-    });
-
-    await expect(
-      vault.invoke({
-        tenantId: "tenant_a",
-        app: "notion",
-        action: "create_page",
-        args: { title: "Layer 1" },
-      }),
-    ).resolves.toMatchObject({
-      ok: true,
-      provider: "local",
-      result: { app: "notion", action: "create_page", title: "Layer 1" },
-    });
-  });
-});