@open-mercato/core 0.4.6-develop-6d72ec5960 → 0.4.6-develop-cd1e2a9a0e

package/src/modules/integrations/i18n/de.json

@@ -0,0 +1,70 @@
+{
+  "integrations.bundle.configureIntegration": "Konfigurieren",
+  "integrations.bundle.integrationToggles": "Integrationen",
+  "integrations.bundle.sharedCredentials": "Gemeinsame Zugangsdaten",
+  "integrations.bundle.title": "Paket",
+  "integrations.detail.back": "Zur\u00fcck zu Integrationen",
+  "integrations.detail.credentials.bundleShared": "Gemeinsame Zugangsdaten aus Paket: {bundle}",
+  "integrations.detail.credentials.notConfigured": "Noch keine Zugangsdaten konfiguriert",
+  "integrations.detail.credentials.save": "Zugangsdaten speichern",
+  "integrations.detail.credentials.saveError": "Zugangsdaten konnten nicht gespeichert werden",
+  "integrations.detail.credentials.saved": "Zugangsdaten gespeichert",
+  "integrations.detail.disable": "Deaktivieren",
+  "integrations.detail.enable": "Aktivieren",
+  "integrations.detail.health.check": "Pr\u00fcfung ausf\u00fchren",
+  "integrations.detail.health.checkError": "Statuspr\u00fcfung fehlgeschlagen",
+  "integrations.detail.health.checking": "Pr\u00fcfe\u2026",
+  "integrations.detail.health.degraded": "Beeintr\u00e4chtigt",
+  "integrations.detail.health.healthy": "Gesund",
+  "integrations.detail.health.lastChecked": "Zuletzt gepr\u00fcft: {date}",
+  "integrations.detail.health.neverChecked": "Nie gepr\u00fcft",
+  "integrations.detail.health.title": "Gesundheitsstatus",
+  "integrations.detail.health.unhealthy": "Nicht gesund",
+  "integrations.detail.health.unknown": "Unbekannt",
+  "integrations.detail.loadError": "Integration konnte nicht geladen werden",
+  "integrations.detail.logs.columns.level": "Stufe",
+  "integrations.detail.logs.columns.message": "Nachricht",
+  "integrations.detail.logs.columns.time": "Zeit",
+  "integrations.detail.logs.empty": "Noch keine Protokolleintr\u00e4ge",
+  "integrations.detail.logs.level.all": "Alle Stufen",
+  "integrations.detail.logs.level.error": "Fehler",
+  "integrations.detail.logs.level.info": "Info",
+  "integrations.detail.logs.level.warn": "Warnung",
+  "integrations.detail.logs.title": "Betriebsprotokolle",
+  "integrations.detail.stateError": "Status konnte nicht aktualisiert werden",
+  "integrations.detail.stateUpdated": "Integrationsstatus aktualisiert",
+  "integrations.detail.tabs.credentials": "Zugangsdaten",
+  "integrations.detail.tabs.health": "Status",
+  "integrations.detail.tabs.logs": "Protokolle",
+  "integrations.detail.tabs.version": "Version",
+  "integrations.detail.title": "Integration",
+  "integrations.detail.version.current": "Aktuelle Version",
+  "integrations.detail.version.deprecated": "Veraltet",
+  "integrations.detail.version.experimental": "Experimentell",
+  "integrations.detail.version.noVersions": "Diese Integration verwendet keine API-Versionierung",
+  "integrations.detail.version.saveError": "Version konnte nicht aktualisiert werden",
+  "integrations.detail.version.saved": "API-Version aktualisiert",
+  "integrations.detail.version.select": "Version ausw\u00e4hlen",
+  "integrations.detail.version.stable": "Stabil",
+  "integrations.detail.version.sunsetAt": "Ablauf: {date}",
+  "integrations.marketplace.categories.all": "Alle",
+  "integrations.marketplace.categories.communication": "Kommunikation",
+  "integrations.marketplace.categories.data_sync": "Datensynchronisation",
+  "integrations.marketplace.categories.notification": "Benachrichtigung",
+  "integrations.marketplace.categories.payment": "Zahlung",
+  "integrations.marketplace.categories.shipping": "Versand",
+  "integrations.marketplace.categories.storage": "Speicher",
+  "integrations.marketplace.categories.webhook": "Webhook",
+  "integrations.marketplace.configure": "Konfigurieren",
+  "integrations.marketplace.description": "Externe Dienste verbinden, Zugangsdaten verwalten und Integrationsstatus \u00fcberwachen.",
+  "integrations.marketplace.disableAll": "Alle deaktivieren",
+  "integrations.marketplace.disabled": "Deaktiviert",
+  "integrations.marketplace.enableAll": "Alle aktivieren",
+  "integrations.marketplace.enabled": "Aktiviert",
+  "integrations.marketplace.integrations": "{count} Integrationen",
+  "integrations.marketplace.loadError": "Integrationen konnten nicht geladen werden",
+  "integrations.marketplace.noResults": "Keine Integrationen gefunden",
+  "integrations.marketplace.search": "Integrationen suchen\u2026",
+  "integrations.marketplace.title": "Integrationen",
+  "integrations.nav.title": "Integrationen"
+}

package/src/modules/integrations/i18n/en.json

@@ -0,0 +1,70 @@
+{
+  "integrations.bundle.configureIntegration": "Configure",
+  "integrations.bundle.integrationToggles": "Integrations",
+  "integrations.bundle.sharedCredentials": "Shared Credentials",
+  "integrations.bundle.title": "Bundle",
+  "integrations.detail.back": "Back to Integrations",
+  "integrations.detail.credentials.bundleShared": "Shared credentials from bundle: {bundle}",
+  "integrations.detail.credentials.notConfigured": "No credentials configured yet",
+  "integrations.detail.credentials.save": "Save Credentials",
+  "integrations.detail.credentials.saveError": "Failed to save credentials",
+  "integrations.detail.credentials.saved": "Credentials saved",
+  "integrations.detail.disable": "Disable",
+  "integrations.detail.enable": "Enable",
+  "integrations.detail.health.check": "Run Check",
+  "integrations.detail.health.checkError": "Health check failed",
+  "integrations.detail.health.checking": "Checking\u2026",
+  "integrations.detail.health.degraded": "Degraded",
+  "integrations.detail.health.healthy": "Healthy",
+  "integrations.detail.health.lastChecked": "Last checked: {date}",
+  "integrations.detail.health.neverChecked": "Never checked",
+  "integrations.detail.health.title": "Health Status",
+  "integrations.detail.health.unhealthy": "Unhealthy",
+  "integrations.detail.health.unknown": "Unknown",
+  "integrations.detail.loadError": "Failed to load integration",
+  "integrations.detail.logs.columns.level": "Level",
+  "integrations.detail.logs.columns.message": "Message",
+  "integrations.detail.logs.columns.time": "Time",
+  "integrations.detail.logs.empty": "No log entries yet",
+  "integrations.detail.logs.level.all": "All Levels",
+  "integrations.detail.logs.level.error": "Error",
+  "integrations.detail.logs.level.info": "Info",
+  "integrations.detail.logs.level.warn": "Warning",
+  "integrations.detail.logs.title": "Operation Logs",
+  "integrations.detail.stateError": "Failed to update state",
+  "integrations.detail.stateUpdated": "Integration state updated",
+  "integrations.detail.tabs.credentials": "Credentials",
+  "integrations.detail.tabs.health": "Health",
+  "integrations.detail.tabs.logs": "Logs",
+  "integrations.detail.tabs.version": "Version",
+  "integrations.detail.title": "Integration",
+  "integrations.detail.version.current": "Current Version",
+  "integrations.detail.version.deprecated": "Deprecated",
+  "integrations.detail.version.experimental": "Experimental",
+  "integrations.detail.version.noVersions": "This integration does not use API versioning",
+  "integrations.detail.version.saveError": "Failed to update version",
+  "integrations.detail.version.saved": "API version updated",
+  "integrations.detail.version.select": "Select Version",
+  "integrations.detail.version.stable": "Stable",
+  "integrations.detail.version.sunsetAt": "Sunset: {date}",
+  "integrations.marketplace.categories.all": "All",
+  "integrations.marketplace.categories.communication": "Communication",
+  "integrations.marketplace.categories.data_sync": "Data Sync",
+  "integrations.marketplace.categories.notification": "Notification",
+  "integrations.marketplace.categories.payment": "Payment",
+  "integrations.marketplace.categories.shipping": "Shipping",
+  "integrations.marketplace.categories.storage": "Storage",
+  "integrations.marketplace.categories.webhook": "Webhook",
+  "integrations.marketplace.configure": "Configure",
+  "integrations.marketplace.description": "Connect external services, manage credentials, and monitor integration health.",
+  "integrations.marketplace.disableAll": "Disable All",
+  "integrations.marketplace.disabled": "Disabled",
+  "integrations.marketplace.enableAll": "Enable All",
+  "integrations.marketplace.enabled": "Enabled",
+  "integrations.marketplace.integrations": "{count} integrations",
+  "integrations.marketplace.loadError": "Failed to load integrations",
+  "integrations.marketplace.noResults": "No integrations found",
+  "integrations.marketplace.search": "Search integrations\u2026",
+  "integrations.marketplace.title": "Integrations",
+  "integrations.nav.title": "Integrations"
+}

package/src/modules/integrations/i18n/es.json

@@ -0,0 +1,70 @@
+{
+  "integrations.bundle.configureIntegration": "Configurar",
+  "integrations.bundle.integrationToggles": "Integraciones",
+  "integrations.bundle.sharedCredentials": "Credenciales compartidas",
+  "integrations.bundle.title": "Paquete",
+  "integrations.detail.back": "Volver a integraciones",
+  "integrations.detail.credentials.bundleShared": "Credenciales compartidas del paquete: {bundle}",
+  "integrations.detail.credentials.notConfigured": "No hay credenciales configuradas",
+  "integrations.detail.credentials.save": "Guardar credenciales",
+  "integrations.detail.credentials.saveError": "No se pudieron guardar las credenciales",
+  "integrations.detail.credentials.saved": "Credenciales guardadas",
+  "integrations.detail.disable": "Desactivar",
+  "integrations.detail.enable": "Activar",
+  "integrations.detail.health.check": "Ejecutar verificaci\u00f3n",
+  "integrations.detail.health.checkError": "La verificaci\u00f3n de estado fall\u00f3",
+  "integrations.detail.health.checking": "Verificando\u2026",
+  "integrations.detail.health.degraded": "Degradado",
+  "integrations.detail.health.healthy": "Saludable",
+  "integrations.detail.health.lastChecked": "\u00daltima verificaci\u00f3n: {date}",
+  "integrations.detail.health.neverChecked": "Nunca verificado",
+  "integrations.detail.health.title": "Estado de salud",
+  "integrations.detail.health.unhealthy": "No saludable",
+  "integrations.detail.health.unknown": "Desconocido",
+  "integrations.detail.loadError": "No se pudo cargar la integraci\u00f3n",
+  "integrations.detail.logs.columns.level": "Nivel",
+  "integrations.detail.logs.columns.message": "Mensaje",
+  "integrations.detail.logs.columns.time": "Hora",
+  "integrations.detail.logs.empty": "Sin entradas de registro",
+  "integrations.detail.logs.level.all": "Todos los niveles",
+  "integrations.detail.logs.level.error": "Error",
+  "integrations.detail.logs.level.info": "Info",
+  "integrations.detail.logs.level.warn": "Advertencia",
+  "integrations.detail.logs.title": "Registros de operaci\u00f3n",
+  "integrations.detail.stateError": "No se pudo actualizar el estado",
+  "integrations.detail.stateUpdated": "Estado de integraci\u00f3n actualizado",
+  "integrations.detail.tabs.credentials": "Credenciales",
+  "integrations.detail.tabs.health": "Estado",
+  "integrations.detail.tabs.logs": "Registros",
+  "integrations.detail.tabs.version": "Versi\u00f3n",
+  "integrations.detail.title": "Integraci\u00f3n",
+  "integrations.detail.version.current": "Versi\u00f3n actual",
+  "integrations.detail.version.deprecated": "Obsoleta",
+  "integrations.detail.version.experimental": "Experimental",
+  "integrations.detail.version.noVersions": "Esta integraci\u00f3n no usa versionado de API",
+  "integrations.detail.version.saveError": "No se pudo actualizar la versi\u00f3n",
+  "integrations.detail.version.saved": "Versi\u00f3n de API actualizada",
+  "integrations.detail.version.select": "Seleccionar versi\u00f3n",
+  "integrations.detail.version.stable": "Estable",
+  "integrations.detail.version.sunsetAt": "Fin de soporte: {date}",
+  "integrations.marketplace.categories.all": "Todas",
+  "integrations.marketplace.categories.communication": "Comunicaci\u00f3n",
+  "integrations.marketplace.categories.data_sync": "Sincronizaci\u00f3n",
+  "integrations.marketplace.categories.notification": "Notificaci\u00f3n",
+  "integrations.marketplace.categories.payment": "Pagos",
+  "integrations.marketplace.categories.shipping": "Env\u00edo",
+  "integrations.marketplace.categories.storage": "Almacenamiento",
+  "integrations.marketplace.categories.webhook": "Webhook",
+  "integrations.marketplace.configure": "Configurar",
+  "integrations.marketplace.description": "Conecta servicios externos, gestiona credenciales y monitorea el estado de las integraciones.",
+  "integrations.marketplace.disableAll": "Desactivar todas",
+  "integrations.marketplace.disabled": "Desactivada",
+  "integrations.marketplace.enableAll": "Activar todas",
+  "integrations.marketplace.enabled": "Activada",
+  "integrations.marketplace.integrations": "{count} integraciones",
+  "integrations.marketplace.loadError": "No se pudieron cargar las integraciones",
+  "integrations.marketplace.noResults": "No se encontraron integraciones",
+  "integrations.marketplace.search": "Buscar integraciones\u2026",
+  "integrations.marketplace.title": "Integraciones",
+  "integrations.nav.title": "Integraciones"
+}

package/src/modules/integrations/i18n/pl.json

@@ -0,0 +1,70 @@
+{
+  "integrations.bundle.configureIntegration": "Konfiguruj",
+  "integrations.bundle.integrationToggles": "Integracje",
+  "integrations.bundle.sharedCredentials": "Wsp\u00f3\u0142dzielone dane",
+  "integrations.bundle.title": "Pakiet",
+  "integrations.detail.back": "Powr\u00f3t do integracji",
+  "integrations.detail.credentials.bundleShared": "Wsp\u00f3\u0142dzielone dane z pakietu: {bundle}",
+  "integrations.detail.credentials.notConfigured": "Brak skonfigurowanych danych",
+  "integrations.detail.credentials.save": "Zapisz dane",
+  "integrations.detail.credentials.saveError": "Nie uda\u0142o si\u0119 zapisa\u0107 danych",
+  "integrations.detail.credentials.saved": "Dane zapisane",
+  "integrations.detail.disable": "Wy\u0142\u0105cz",
+  "integrations.detail.enable": "W\u0142\u0105cz",
+  "integrations.detail.health.check": "Sprawd\u017a",
+  "integrations.detail.health.checkError": "Sprawdzenie stanu nie powiod\u0142o si\u0119",
+  "integrations.detail.health.checking": "Sprawdzanie\u2026",
+  "integrations.detail.health.degraded": "Pogorszony",
+  "integrations.detail.health.healthy": "Zdrowy",
+  "integrations.detail.health.lastChecked": "Ostatnie sprawdzenie: {date}",
+  "integrations.detail.health.neverChecked": "Nigdy nie sprawdzano",
+  "integrations.detail.health.title": "Stan zdrowia",
+  "integrations.detail.health.unhealthy": "Niezdrowy",
+  "integrations.detail.health.unknown": "Nieznany",
+  "integrations.detail.loadError": "Nie uda\u0142o si\u0119 za\u0142adowa\u0107 integracji",
+  "integrations.detail.logs.columns.level": "Poziom",
+  "integrations.detail.logs.columns.message": "Wiadomo\u015b\u0107",
+  "integrations.detail.logs.columns.time": "Czas",
+  "integrations.detail.logs.empty": "Brak wpis\u00f3w w logach",
+  "integrations.detail.logs.level.all": "Wszystkie poziomy",
+  "integrations.detail.logs.level.error": "B\u0142\u0105d",
+  "integrations.detail.logs.level.info": "Info",
+  "integrations.detail.logs.level.warn": "Ostrze\u017cenie",
+  "integrations.detail.logs.title": "Logi operacji",
+  "integrations.detail.stateError": "Nie uda\u0142o si\u0119 zaktualizowa\u0107 stanu",
+  "integrations.detail.stateUpdated": "Stan integracji zaktualizowany",
+  "integrations.detail.tabs.credentials": "Dane uwierzytelniaj\u0105ce",
+  "integrations.detail.tabs.health": "Stan",
+  "integrations.detail.tabs.logs": "Logi",
+  "integrations.detail.tabs.version": "Wersja",
+  "integrations.detail.title": "Integracja",
+  "integrations.detail.version.current": "Aktualna wersja",
+  "integrations.detail.version.deprecated": "Wycofana",
+  "integrations.detail.version.experimental": "Eksperymentalna",
+  "integrations.detail.version.noVersions": "Ta integracja nie u\u017cywa wersjonowania API",
+  "integrations.detail.version.saveError": "Nie uda\u0142o si\u0119 zaktualizowa\u0107 wersji",
+  "integrations.detail.version.saved": "Wersja API zaktualizowana",
+  "integrations.detail.version.select": "Wybierz wersj\u0119",
+  "integrations.detail.version.stable": "Stabilna",
+  "integrations.detail.version.sunsetAt": "Wygasa: {date}",
+  "integrations.marketplace.categories.all": "Wszystkie",
+  "integrations.marketplace.categories.communication": "Komunikacja",
+  "integrations.marketplace.categories.data_sync": "Synchronizacja",
+  "integrations.marketplace.categories.notification": "Powiadomienia",
+  "integrations.marketplace.categories.payment": "P\u0142atno\u015bci",
+  "integrations.marketplace.categories.shipping": "Wysy\u0142ka",
+  "integrations.marketplace.categories.storage": "Przechowywanie",
+  "integrations.marketplace.categories.webhook": "Webhook",
+  "integrations.marketplace.configure": "Konfiguruj",
+  "integrations.marketplace.description": "Po\u0142\u0105cz zewn\u0119trzne us\u0142ugi, zarz\u0105dzaj danymi uwierzytelniaj\u0105cymi i monitoruj stan integracji.",
+  "integrations.marketplace.disableAll": "Wy\u0142\u0105cz wszystkie",
+  "integrations.marketplace.disabled": "Wy\u0142\u0105czona",
+  "integrations.marketplace.enableAll": "W\u0142\u0105cz wszystkie",
+  "integrations.marketplace.enabled": "W\u0142\u0105czona",
+  "integrations.marketplace.integrations": "{count} integracji",
+  "integrations.marketplace.loadError": "Nie uda\u0142o si\u0119 za\u0142adowa\u0107 integracji",
+  "integrations.marketplace.noResults": "Nie znaleziono integracji",
+  "integrations.marketplace.search": "Szukaj integracji\u2026",
+  "integrations.marketplace.title": "Integracje",
+  "integrations.nav.title": "Integracje"
+}

package/src/modules/integrations/lib/credentials-service.ts

@@ -0,0 +1,204 @@
+import crypto from 'node:crypto'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { decryptWithAesGcm, encryptWithAesGcm } from '@open-mercato/shared/lib/encryption/aes'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { createKmsService } from '@open-mercato/shared/lib/encryption/kms'
+import { getBundle, getIntegration, resolveIntegrationCredentialsSchema } from '@open-mercato/shared/modules/integrations/types'
+import { EncryptionMap } from '../../entities/data/entities'
+import { IntegrationCredentials } from '../data/entities'
+import type { IntegrationScope } from './types'
+
+const ENCRYPTED_CREDENTIALS_BLOB_KEY = '__om_encrypted_credentials_blob_v1'
+const DERIVED_KEY_CONTEXT = 'integrations.credentials'
+
+function resolveFallbackEncryptionSecret(): string {
+  const candidates = [
+    process.env.TENANT_DATA_ENCRYPTION_FALLBACK_KEY,
+    process.env.TENANT_DATA_ENCRYPTION_KEY,
+    process.env.AUTH_SECRET,
+    process.env.NEXTAUTH_SECRET,
+  ]
+
+  for (const value of candidates) {
+    const normalized = value?.trim()
+    if (normalized) return normalized
+  }
+
+  if (process.env.NODE_ENV !== 'production') return 'om-dev-tenant-encryption'
+
+  console.warn(
+    '[integrations.credentials] No encryption secret configured; using emergency fallback secret. Configure TENANT_DATA_ENCRYPTION_FALLBACK_KEY immediately.',
+  )
+  return 'om-emergency-fallback-rotate-me'
+}
+
+function deriveDekFromSecret(secret: string, tenantId: string): string {
+  return crypto
+    .createHash('sha256')
+    .update(`${DERIVED_KEY_CONTEXT}:${tenantId}:${secret}`)
+    .digest()
+    .toString('base64')
+}
+
+export function createCredentialsService(em: EntityManager) {
+  const credentialsEncryptionSpec = [{ field: 'credentials' }]
+
+  async function ensureCredentialsEncryptionMap(scope: IntegrationScope): Promise<void> {
+    const existing = await findOneWithDecryption(
+      em,
+      EncryptionMap,
+      {
+        entityId: 'integrations:integration_credentials',
+        tenantId: scope.tenantId,
+        organizationId: scope.organizationId,
+        deletedAt: null,
+      },
+      undefined,
+      scope,
+    )
+
+    if (!existing) {
+      const created = em.create(EncryptionMap, {
+        entityId: 'integrations:integration_credentials',
+        tenantId: scope.tenantId,
+        organizationId: scope.organizationId,
+        fieldsJson: credentialsEncryptionSpec,
+        isActive: true,
+        createdAt: new Date(),
+        updatedAt: new Date(),
+      })
+      em.persist(created)
+      return
+    }
+
+    existing.fieldsJson = credentialsEncryptionSpec
+    existing.isActive = true
+  }
+
+  async function resolveCredentialsDek(scope: IntegrationScope): Promise<string> {
+    const kms = createKmsService()
+    const existing = await kms.getTenantDek(scope.tenantId)
+    if (existing?.key) return existing.key
+
+    const created = await kms.createTenantDek(scope.tenantId)
+    if (created?.key) return created.key
+
+    return deriveDekFromSecret(resolveFallbackEncryptionSecret(), scope.tenantId)
+  }
+
+  async function encryptCredentialsBlob(
+    credentials: Record<string, unknown>,
+    scope: IntegrationScope,
+  ): Promise<Record<string, unknown>> {
+    const dek = await resolveCredentialsDek(scope)
+    const payload = encryptWithAesGcm(JSON.stringify(credentials), dek)
+    return { [ENCRYPTED_CREDENTIALS_BLOB_KEY]: payload.value }
+  }
+
+  async function decryptCredentialsBlob(
+    credentials: Record<string, unknown>,
+    scope: IntegrationScope,
+  ): Promise<Record<string, unknown>> {
+    const encrypted = credentials[ENCRYPTED_CREDENTIALS_BLOB_KEY]
+    if (typeof encrypted !== 'string' || !encrypted) return credentials
+
+    const dek = await resolveCredentialsDek(scope)
+    const decryptedRaw = decryptWithAesGcm(encrypted, dek)
+    if (!decryptedRaw) return {}
+
+    try {
+      const parsed = JSON.parse(decryptedRaw) as unknown
+      return parsed && typeof parsed === 'object' && !Array.isArray(parsed)
+        ? (parsed as Record<string, unknown>)
+        : {}
+    } catch {
+      return {}
+    }
+  }
+
+  return {
+    async getRaw(integrationId: string, scope: IntegrationScope): Promise<Record<string, unknown> | null> {
+      const row = await findOneWithDecryption(
+        em,
+        IntegrationCredentials,
+        {
+          integrationId,
+          organizationId: scope.organizationId,
+          tenantId: scope.tenantId,
+          deletedAt: null,
+        },
+        undefined,
+        scope,
+      )
+      if (!row) return null
+      return decryptCredentialsBlob(row.credentials, scope)
+    },
+
+    async resolve(integrationId: string, scope: IntegrationScope): Promise<Record<string, unknown> | null> {
+      const direct = await this.getRaw(integrationId, scope)
+      if (direct) return direct
+
+      const definition = getIntegration(integrationId)
+      if (!definition?.bundleId) return null
+      return this.getRaw(definition.bundleId, scope)
+    },
+
+    async save(integrationId: string, credentials: Record<string, unknown>, scope: IntegrationScope): Promise<void> {
+      await ensureCredentialsEncryptionMap(scope)
+      const encryptedCredentials = await encryptCredentialsBlob(credentials, scope)
+
+      const row = await findOneWithDecryption(
+        em,
+        IntegrationCredentials,
+        {
+          integrationId,
+          organizationId: scope.organizationId,
+          tenantId: scope.tenantId,
+          deletedAt: null,
+        },
+        undefined,
+        scope,
+      )
+
+      if (row) {
+        row.credentials = encryptedCredentials
+        await em.flush()
+        return
+      }
+
+      const created = em.create(IntegrationCredentials, {
+        integrationId,
+        credentials: encryptedCredentials,
+        organizationId: scope.organizationId,
+        tenantId: scope.tenantId,
+      })
+      await em.persistAndFlush(created)
+    },
+
+    async saveField(
+      integrationId: string,
+      fieldKey: string,
+      value: unknown,
+      scope: IntegrationScope,
+    ): Promise<Record<string, unknown>> {
+      const current = (await this.getRaw(integrationId, scope)) ?? {}
+      const updated = { ...current, [fieldKey]: value }
+      await this.save(integrationId, updated, scope)
+      return updated
+    },
+
+    getSchema(integrationId: string) {
+      const definition = getIntegration(integrationId)
+      if (!definition) return undefined
+
+      if (definition.bundleId) {
+        const bundle = getBundle(definition.bundleId)
+        return bundle?.credentials ?? resolveIntegrationCredentialsSchema(integrationId)
+      }
+
+      return definition.credentials ?? resolveIntegrationCredentialsSchema(integrationId)
+    },
+  }
+}
+
+export type CredentialsService = ReturnType<typeof createCredentialsService>

package/src/modules/integrations/lib/health-service.ts

@@ -0,0 +1,59 @@
+import type { AwilixContainer } from 'awilix'
+import type { IntegrationStateService } from './state-service'
+import type { IntegrationLogService } from './log-service'
+import { getIntegration, getBundle } from '@open-mercato/shared/modules/integrations/types'
+import type { IntegrationScope } from './types'
+
+type HealthCheckResult = {
+  status: 'healthy' | 'degraded' | 'unhealthy'
+  message?: string
+  details?: Record<string, unknown>
+}
+
+type HealthCheckService = {
+  check: (credentials: Record<string, unknown> | null, scope: IntegrationScope) => Promise<HealthCheckResult>
+}
+
+export function createHealthService(
+  container: AwilixContainer,
+  stateService: IntegrationStateService,
+  logService: IntegrationLogService,
+) {
+  return {
+    async runHealthCheck(integrationId: string, scope: IntegrationScope): Promise<HealthCheckResult> {
+      const definition = getIntegration(integrationId)
+      const healthConfig = definition?.healthCheck ?? (definition?.bundleId ? getBundle(definition.bundleId)?.healthCheck : undefined)
+
+      if (!healthConfig?.service) {
+        return { status: 'unhealthy', message: 'No health check configured' }
+      }
+
+      let result: HealthCheckResult
+      try {
+        const checker = container.resolve<HealthCheckService>(healthConfig.service)
+        const credentialsService = container.resolve<{ resolve: (id: string, scope: IntegrationScope) => Promise<Record<string, unknown> | null> }>('integrationCredentialsService')
+        const credentials = await credentialsService.resolve(integrationId, scope)
+        result = await checker.check(credentials, scope)
+      } catch (error) {
+        const message = error instanceof Error ? error.message : 'Health check failed'
+        result = { status: 'unhealthy', message }
+      }
+
+      await stateService.upsert(integrationId, {
+        lastHealthStatus: result.status,
+        lastHealthCheckedAt: new Date(),
+      }, scope)
+
+      const logger = logService.scoped(integrationId, scope)
+      if (result.status === 'healthy') {
+        await logger.info(`Health check passed`, { status: result.status, ...result.details })
+      } else {
+        await logger.warn(`Health check: ${result.status}`, { status: result.status, message: result.message, ...result.details })
+      }
+
+      return result
+    },
+  }
+}
+
+export type IntegrationHealthService = ReturnType<typeof createHealthService>

package/src/modules/integrations/lib/log-service.ts

@@ -0,0 +1,84 @@
+import type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'
+import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import type { ListIntegrationLogsQuery } from '../data/validators'
+import { IntegrationLog } from '../data/entities'
+import type { IntegrationScope } from './types'
+
+type LogInput = {
+  integrationId: string
+  runId?: string | null
+  scopeEntityType?: string | null
+  scopeEntityId?: string | null
+  level: 'info' | 'warn' | 'error'
+  message: string
+  code?: string | null
+  payload?: Record<string, unknown> | null
+}
+
+export function createIntegrationLogService(em: EntityManager) {
+  return {
+    async write(input: LogInput, scope: IntegrationScope): Promise<IntegrationLog> {
+      const row = em.create(IntegrationLog, {
+        integrationId: input.integrationId,
+        runId: input.runId,
+        scopeEntityType: input.scopeEntityType,
+        scopeEntityId: input.scopeEntityId,
+        level: input.level,
+        message: input.message,
+        code: input.code,
+        payload: input.payload,
+        organizationId: scope.organizationId,
+        tenantId: scope.tenantId,
+      })
+      await em.persistAndFlush(row)
+      return row
+    },
+
+    scoped(integrationId: string, scope: IntegrationScope) {
+      return {
+        info: (message: string, payload?: Record<string, unknown>) => this.write({ integrationId, level: 'info', message, payload }, scope),
+        warn: (message: string, payload?: Record<string, unknown>) => this.write({ integrationId, level: 'warn', message, payload }, scope),
+        error: (message: string, payload?: Record<string, unknown>) => this.write({ integrationId, level: 'error', message, payload }, scope),
+      }
+    },
+
+    async query(query: ListIntegrationLogsQuery, scope: IntegrationScope): Promise<{ items: IntegrationLog[]; total: number }> {
+      const where: FilterQuery<IntegrationLog> = {
+        organizationId: scope.organizationId,
+        tenantId: scope.tenantId,
+      }
+
+      if (query.integrationId) where.integrationId = query.integrationId
+      if (query.level) where.level = query.level
+      if (query.runId) where.runId = query.runId
+      if (query.entityType) where.scopeEntityType = query.entityType
+      if (query.entityId) where.scopeEntityId = query.entityId
+
+      const items = await findWithDecryption(
+        em,
+        IntegrationLog,
+        where,
+        {
+          orderBy: { createdAt: 'DESC' },
+          limit: query.pageSize,
+          offset: (query.page - 1) * query.pageSize,
+        },
+        scope,
+      )
+      const total = await em.count(IntegrationLog, where)
+      return { items, total }
+    },
+
+    async pruneOlderThan(days: number, scope: IntegrationScope): Promise<number> {
+      const threshold = new Date(Date.now() - days * 24 * 60 * 60 * 1000)
+      const deletedCount = await em.nativeDelete(IntegrationLog, {
+        organizationId: scope.organizationId,
+        tenantId: scope.tenantId,
+        createdAt: { $lt: threshold },
+      })
+      return deletedCount
+    },
+  }
+}
+
+export type IntegrationLogService = ReturnType<typeof createIntegrationLogService>