@open-mercato/core 0.6.6-develop.6343.1.8120f84f30 → 0.6.6-develop.6345.1.b236ea3d4b

package/.turbo/turbo-build.log

@@ -1,4 +1,4 @@
-[build:core] found 3427 entry points
+[build:core] found 3428 entry points
 [build:core] built successfully
 [build:core:generated] found 186 entry points
 [build:core:generated] built successfully

package/dist/modules/integrations/api/[id]/credentials/route.js

@@ -11,6 +11,10 @@ import {
   isCredentialsEncryptionUnavailableError
 } from "../../../lib/credentials-service.js";
 import { collectCredentialUrlValidationErrors } from "../../../lib/credentials-field-validation.js";
+import {
+  maskSecretCredentials,
+  mergeMaskedSecretCredentials
+} from "../../../lib/credentials-masking.js";
 import {
   resolveUserFeatures,
   runIntegrationMutationGuardAfterSuccess,
@@ -60,10 +64,13 @@ async function GET(req, ctx) {
     }
     throw error;
   }
+  const schema = credentialsService.getSchema(integration.id);
+  const { credentials, secretFieldsConfigured } = maskSecretCredentials(schema, values ?? {});
   return NextResponse.json({
     integrationId: integration.id,
-    schema: credentialsService.getSchema(integration.id),
-    credentials: values ?? {},
+    schema,
+    credentials,
+    secretFieldsConfigured,
     updatedAt: updatedAt?.toISOString() ?? null
   });
 }
@@ -116,6 +123,7 @@ async function PUT(req, ctx) {
   }
   const credentialsService = container.resolve("integrationCredentialsService");
   const scope = { organizationId: auth.orgId, tenantId: auth.tenantId };
+  const schema = credentialsService.getSchema(integration.id);
   try {
     const currentUpdatedAt = await credentialsService.resolveUpdatedAt(integration.id, scope);
     enforceCommandOptimisticLock({
@@ -134,7 +142,7 @@ async function PUT(req, ctx) {
     throw error;
   }
   const credentialFieldErrors = collectCredentialUrlValidationErrors(
-    credentialsService.getSchema(integration.id),
+    schema,
     payloadData.credentials
   );
   if (Object.keys(credentialFieldErrors).length > 0) {
@@ -144,7 +152,9 @@ async function PUT(req, ctx) {
     );
   }
   try {
-    await credentialsService.save(integration.id, payloadData.credentials, scope);
+    const existing = await credentialsService.resolve(integration.id, scope);
+    const credentialsToSave = mergeMaskedSecretCredentials(schema, payloadData.credentials, existing ?? {});
+    await credentialsService.save(integration.id, credentialsToSave, scope);
   } catch (error) {
     if (isCredentialsEncryptionUnavailableError(error)) {
       return NextResponse.json({ error: "Integration credentials encryption is unavailable" }, { status: 503 });

package/dist/modules/integrations/api/[id]/credentials/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/integrations/api/%5Bid%5D/credentials/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getIntegration } from '@open-mercato/shared/modules/integrations/types'\nimport { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { emitIntegrationsEvent } from '../../../events'\nimport { saveCredentialsSchema } from '../../../data/validators'\nimport {\n  isCredentialsEncryptionUnavailableError,\n  type CredentialsService,\n} from '../../../lib/credentials-service'\nimport { collectCredentialUrlValidationErrors } from '../../../lib/credentials-field-validation'\nimport {\n  resolveUserFeatures,\n  runIntegrationMutationGuardAfterSuccess,\n  runIntegrationMutationGuards,\n} from '../../guards'\n\nconst idParamsSchema = z.object({ id: z.string().min(1) })\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['integrations.credentials.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['integrations.credentials.manage'] },\n}\n\nexport const openApi = {\n  tags: ['Integrations'],\n  summary: 'Get or save integration credentials',\n}\n\nfunction resolveParams(ctx: { params?: Promise<{ id?: string }> | { id?: string } }): Promise<{ id?: string } | undefined> | { id?: string } | undefined {\n  if (!ctx.params) return undefined\n  if (typeof (ctx.params as Promise<unknown>).then === 'function') {\n    return ctx.params as Promise<{ id?: string }>\n  }\n  return ctx.params as { id?: string }\n}\n\nexport async function GET(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const rawParams = await resolveParams(ctx)\n  const parsedParams = idParamsSchema.safeParse(rawParams)\n  if (!parsedParams.success) {\n    return NextResponse.json({ error: 'Invalid integration id' }, { status: 400 })\n  }\n\n  const integration = getIntegration(parsedParams.data.id)\n  if (!integration) {\n    return NextResponse.json({ error: 'Integration not found' }, { status: 404 })\n  }\n\n  const container = await createRequestContainer()\n  const credentialsService = container.resolve('integrationCredentialsService') as CredentialsService\n  const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }\n\n  let values: Record<string, unknown> | null\n  let updatedAt: Date | null\n  try {\n    values = await credentialsService.resolve(integration.id, scope)\n    updatedAt = await credentialsService.resolveUpdatedAt(integration.id, scope)\n  } catch (error) {\n    if (isCredentialsEncryptionUnavailableError(error)) {\n      return NextResponse.json({ error: 'Integration credentials encryption is unavailable' }, { status: 503 })\n    }\n    throw error\n  }\n\n  return NextResponse.json({\n    integrationId: integration.id,\n    schema: credentialsService.getSchema(integration.id),\n    credentials: values ?? {},\n    updatedAt: updatedAt?.toISOString() ?? null,\n  })\n}\n\nexport async function PUT(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const rawParams = await resolveParams(ctx)\n  const parsedParams = idParamsSchema.safeParse(rawParams)\n  if (!parsedParams.success) {\n    return NextResponse.json({ error: 'Invalid integration id' }, { status: 400 })\n  }\n\n  const integration = getIntegration(parsedParams.data.id)\n  if (!integration) {\n    return NextResponse.json({ error: 'Integration not found' }, { status: 404 })\n  }\n\n  const payload = await req.json().catch(() => null)\n  const parsedBody = saveCredentialsSchema.safeParse(payload)\n  if (!parsedBody.success) {\n    return NextResponse.json({ error: 'Invalid credentials payload', details: parsedBody.error.flatten() }, { status: 422 })\n  }\n\n  const container = await createRequestContainer()\n  const guardResult = await runIntegrationMutationGuards(\n    container,\n    {\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n    userId: auth.sub ?? '',\n    resourceKind: 'integrations.integration',\n    resourceId: integration.id,\n    operation: 'update',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: parsedBody.data as Record<string, unknown>,\n    },\n    resolveUserFeatures(auth),\n  )\n  if (!guardResult.ok) {\n    return NextResponse.json(guardResult.errorBody ?? { error: 'Operation blocked by guard' }, { status: guardResult.errorStatus ?? 422 })\n  }\n\n  let payloadData = parsedBody.data\n  if (guardResult.modifiedPayload) {\n    const mergedPayload = { ...parsedBody.data, ...guardResult.modifiedPayload }\n    const reparsed = saveCredentialsSchema.safeParse(mergedPayload)\n    if (!reparsed.success) {\n      return NextResponse.json({ error: 'Invalid credentials payload after guard transform', details: reparsed.error.flatten() }, { status: 422 })\n    }\n    payloadData = reparsed.data\n  }\n\n  const credentialsService = container.resolve('integrationCredentialsService') as CredentialsService\n  const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }\n\n  try {\n    const currentUpdatedAt = await credentialsService.resolveUpdatedAt(integration.id, scope)\n    enforceCommandOptimisticLock({\n      resourceKind: 'integrations.integration',\n      resourceId: integration.id,\n      current: currentUpdatedAt,\n      request: req,\n    })\n  } catch (error) {\n    if (isCrudHttpError(error)) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n    if (isCredentialsEncryptionUnavailableError(error)) {\n      return NextResponse.json({ error: 'Integration credentials encryption is unavailable' }, { status: 503 })\n    }\n    throw error\n  }\n\n  const credentialFieldErrors = collectCredentialUrlValidationErrors(\n    credentialsService.getSchema(integration.id),\n    payloadData.credentials,\n  )\n  if (Object.keys(credentialFieldErrors).length > 0) {\n    return NextResponse.json(\n      { error: 'Invalid credentials payload', details: { fieldErrors: credentialFieldErrors } },\n      { status: 422 },\n    )\n  }\n\n  try {\n    await credentialsService.save(integration.id, payloadData.credentials, scope)\n  } catch (error) {\n    if (isCredentialsEncryptionUnavailableError(error)) {\n      return NextResponse.json({ error: 'Integration credentials encryption is unavailable' }, { status: 503 })\n    }\n    throw error\n  }\n\n  await emitIntegrationsEvent('integrations.credentials.updated', {\n    integrationId: integration.id,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n    userId: auth.sub,\n  })\n\n  await runIntegrationMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n      tenantId: auth.tenantId,\n      organizationId: auth.orgId,\n      userId: auth.sub ?? '',\n      resourceKind: 'integrations.integration',\n      resourceId: integration.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n\n  return NextResponse.json({ ok: true })\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,sBAAsB;AAC/B,SAAS,oCAAoC;AAC7C,SAAS,uBAAuB;AAChC,SAAS,6BAA6B;AACtC,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,OAEK;AACP,SAAS,4CAA4C;AACrD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAElD,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iCAAiC,EAAE;AAAA,EAC/E,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iCAAiC,EAAE;AACjF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,cAAc;AAAA,EACrB,SAAS;AACX;AAEA,SAAS,cAAc,KAAkI;AACvJ,MAAI,CAAC,IAAI,OAAQ,QAAO;AACxB,MAAI,OAAQ,IAAI,OAA4B,SAAS,YAAY;AAC/D,WAAO,IAAI;AAAA,EACb;AACA,SAAO,IAAI;AACb;AAEA,eAAsB,IAAI,KAAc,KAA8D;AACpG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,YAAY,MAAM,cAAc,GAAG;AACzC,QAAM,eAAe,eAAe,UAAU,SAAS;AACvD,MAAI,CAAC,aAAa,SAAS;AACzB,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AAEA,QAAM,cAAc,eAAe,aAAa,KAAK,EAAE;AACvD,MAAI,CAAC,aAAa;AAChB,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,qBAAqB,UAAU,QAAQ,+BAA+B;AAC5E,QAAM,QAAQ,EAAE,gBAAgB,KAAK,OAAiB,UAAU,KAAK,SAAS;AAE9E,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,mBAAmB,QAAQ,YAAY,IAAI,KAAK;AAC/D,gBAAY,MAAM,mBAAmB,iBAAiB,YAAY,IAAI,KAAK;AAAA,EAC7E,SAAS,OAAO;AACd,QAAI,wCAAwC,KAAK,GAAG;AAClD,aAAO,aAAa,KAAK,EAAE,OAAO,oDAAoD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1G;AACA,UAAM;AAAA,EACR;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,eAAe,YAAY;AAAA,IAC3B,QAAQ,mBAAmB,UAAU,YAAY,EAAE;AAAA,IACnD,aAAa,UAAU,CAAC;AAAA,IACxB,WAAW,WAAW,YAAY,KAAK;AAAA,EACzC,CAAC;AACH;AAEA,eAAsB,IAAI,KAAc,KAA8D;AACpG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,YAAY,MAAM,cAAc,GAAG;AACzC,QAAM,eAAe,eAAe,UAAU,SAAS;AACvD,MAAI,CAAC,aAAa,SAAS;AACzB,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AAEA,QAAM,cAAc,eAAe,aAAa,KAAK,EAAE;AACvD,MAAI,CAAC,aAAa;AAChB,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AAEA,QAAM,UAAU,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AACjD,QAAM,aAAa,sBAAsB,UAAU,OAAO;AAC1D,MAAI,CAAC,WAAW,SAAS;AACvB,WAAO,aAAa,KAAK,EAAE,OAAO,+BAA+B,SAAS,WAAW,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzH;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,MACA,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY,YAAY;AAAA,MACxB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB,WAAW;AAAA,IAC5B;AAAA,IACA,oBAAoB,IAAI;AAAA,EAC1B;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,aAAa,KAAK,YAAY,aAAa,EAAE,OAAO,6BAA6B,GAAG,EAAE,QAAQ,YAAY,eAAe,IAAI,CAAC;AAAA,EACvI;AAEA,MAAI,cAAc,WAAW;AAC7B,MAAI,YAAY,iBAAiB;AAC/B,UAAM,gBAAgB,EAAE,GAAG,WAAW,MAAM,GAAG,YAAY,gBAAgB;AAC3E,UAAM,WAAW,sBAAsB,UAAU,aAAa;AAC9D,QAAI,CAAC,SAAS,SAAS;AACrB,aAAO,aAAa,KAAK,EAAE,OAAO,qDAAqD,SAAS,SAAS,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7I;AACA,kBAAc,SAAS;AAAA,EACzB;AAEA,QAAM,qBAAqB,UAAU,QAAQ,+BAA+B;AAC5E,QAAM,QAAQ,EAAE,gBAAgB,KAAK,OAAiB,UAAU,KAAK,SAAS;AAE9E,MAAI;AACF,UAAM,mBAAmB,MAAM,mBAAmB,iBAAiB,YAAY,IAAI,KAAK;AACxF,iCAA6B;AAAA,MAC3B,cAAc;AAAA,MACd,YAAY,YAAY;AAAA,MACxB,SAAS;AAAA,MACT,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,GAAG;AAC1B,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AACA,QAAI,wCAAwC,KAAK,GAAG;AAClD,aAAO,aAAa,KAAK,EAAE,OAAO,oDAAoD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1G;AACA,UAAM;AAAA,EACR;AAEA,QAAM,wBAAwB;AAAA,IAC5B,mBAAmB,UAAU,YAAY,EAAE;AAAA,IAC3C,YAAY;AAAA,EACd;AACA,MAAI,OAAO,KAAK,qBAAqB,EAAE,SAAS,GAAG;AACjD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,+BAA+B,SAAS,EAAE,aAAa,sBAAsB,EAAE;AAAA,MACxF,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,MAAI;AACF,UAAM,mBAAmB,KAAK,YAAY,IAAI,YAAY,aAAa,KAAK;AAAA,EAC9E,SAAS,OAAO;AACd,QAAI,wCAAwC,KAAK,GAAG;AAClD,aAAO,aAAa,KAAK,EAAE,OAAO,oDAAoD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1G;AACA,UAAM;AAAA,EACR;AAEA,QAAM,sBAAsB,oCAAoC;AAAA,IAC9D,eAAe,YAAY;AAAA,IAC3B,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK;AAAA,EACf,CAAC;AAED,QAAM,wCAAwC,YAAY,uBAAuB;AAAA,IAC7E,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK,OAAO;AAAA,IACpB,cAAc;AAAA,IACd,YAAY,YAAY;AAAA,IACxB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,EACtB,CAAC;AAEH,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getIntegration } from '@open-mercato/shared/modules/integrations/types'\nimport { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { emitIntegrationsEvent } from '../../../events'\nimport { saveCredentialsSchema } from '../../../data/validators'\nimport {\n  isCredentialsEncryptionUnavailableError,\n  type CredentialsService,\n} from '../../../lib/credentials-service'\nimport { collectCredentialUrlValidationErrors } from '../../../lib/credentials-field-validation'\nimport {\n  maskSecretCredentials,\n  mergeMaskedSecretCredentials,\n} from '../../../lib/credentials-masking'\nimport {\n  resolveUserFeatures,\n  runIntegrationMutationGuardAfterSuccess,\n  runIntegrationMutationGuards,\n} from '../../guards'\n\nconst idParamsSchema = z.object({ id: z.string().min(1) })\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['integrations.credentials.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['integrations.credentials.manage'] },\n}\n\nexport const openApi = {\n  tags: ['Integrations'],\n  summary: 'Get or save integration credentials',\n}\n\nfunction resolveParams(ctx: { params?: Promise<{ id?: string }> | { id?: string } }): Promise<{ id?: string } | undefined> | { id?: string } | undefined {\n  if (!ctx.params) return undefined\n  if (typeof (ctx.params as Promise<unknown>).then === 'function') {\n    return ctx.params as Promise<{ id?: string }>\n  }\n  return ctx.params as { id?: string }\n}\n\nexport async function GET(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const rawParams = await resolveParams(ctx)\n  const parsedParams = idParamsSchema.safeParse(rawParams)\n  if (!parsedParams.success) {\n    return NextResponse.json({ error: 'Invalid integration id' }, { status: 400 })\n  }\n\n  const integration = getIntegration(parsedParams.data.id)\n  if (!integration) {\n    return NextResponse.json({ error: 'Integration not found' }, { status: 404 })\n  }\n\n  const container = await createRequestContainer()\n  const credentialsService = container.resolve('integrationCredentialsService') as CredentialsService\n  const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }\n\n  let values: Record<string, unknown> | null\n  let updatedAt: Date | null\n  try {\n    values = await credentialsService.resolve(integration.id, scope)\n    updatedAt = await credentialsService.resolveUpdatedAt(integration.id, scope)\n  } catch (error) {\n    if (isCredentialsEncryptionUnavailableError(error)) {\n      return NextResponse.json({ error: 'Integration credentials encryption is unavailable' }, { status: 503 })\n    }\n    throw error\n  }\n\n  const schema = credentialsService.getSchema(integration.id)\n  const { credentials, secretFieldsConfigured } = maskSecretCredentials(schema, values ?? {})\n\n  return NextResponse.json({\n    integrationId: integration.id,\n    schema,\n    credentials,\n    secretFieldsConfigured,\n    updatedAt: updatedAt?.toISOString() ?? null,\n  })\n}\n\nexport async function PUT(req: Request, ctx: { params?: Promise<{ id?: string }> | { id?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  const rawParams = await resolveParams(ctx)\n  const parsedParams = idParamsSchema.safeParse(rawParams)\n  if (!parsedParams.success) {\n    return NextResponse.json({ error: 'Invalid integration id' }, { status: 400 })\n  }\n\n  const integration = getIntegration(parsedParams.data.id)\n  if (!integration) {\n    return NextResponse.json({ error: 'Integration not found' }, { status: 404 })\n  }\n\n  const payload = await req.json().catch(() => null)\n  const parsedBody = saveCredentialsSchema.safeParse(payload)\n  if (!parsedBody.success) {\n    return NextResponse.json({ error: 'Invalid credentials payload', details: parsedBody.error.flatten() }, { status: 422 })\n  }\n\n  const container = await createRequestContainer()\n  const guardResult = await runIntegrationMutationGuards(\n    container,\n    {\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n    userId: auth.sub ?? '',\n    resourceKind: 'integrations.integration',\n    resourceId: integration.id,\n    operation: 'update',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: parsedBody.data as Record<string, unknown>,\n    },\n    resolveUserFeatures(auth),\n  )\n  if (!guardResult.ok) {\n    return NextResponse.json(guardResult.errorBody ?? { error: 'Operation blocked by guard' }, { status: guardResult.errorStatus ?? 422 })\n  }\n\n  let payloadData = parsedBody.data\n  if (guardResult.modifiedPayload) {\n    const mergedPayload = { ...parsedBody.data, ...guardResult.modifiedPayload }\n    const reparsed = saveCredentialsSchema.safeParse(mergedPayload)\n    if (!reparsed.success) {\n      return NextResponse.json({ error: 'Invalid credentials payload after guard transform', details: reparsed.error.flatten() }, { status: 422 })\n    }\n    payloadData = reparsed.data\n  }\n\n  const credentialsService = container.resolve('integrationCredentialsService') as CredentialsService\n  const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }\n  const schema = credentialsService.getSchema(integration.id)\n\n  try {\n    const currentUpdatedAt = await credentialsService.resolveUpdatedAt(integration.id, scope)\n    enforceCommandOptimisticLock({\n      resourceKind: 'integrations.integration',\n      resourceId: integration.id,\n      current: currentUpdatedAt,\n      request: req,\n    })\n  } catch (error) {\n    if (isCrudHttpError(error)) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n    if (isCredentialsEncryptionUnavailableError(error)) {\n      return NextResponse.json({ error: 'Integration credentials encryption is unavailable' }, { status: 503 })\n    }\n    throw error\n  }\n\n  const credentialFieldErrors = collectCredentialUrlValidationErrors(\n    schema,\n    payloadData.credentials,\n  )\n  if (Object.keys(credentialFieldErrors).length > 0) {\n    return NextResponse.json(\n      { error: 'Invalid credentials payload', details: { fieldErrors: credentialFieldErrors } },\n      { status: 422 },\n    )\n  }\n\n  try {\n    // Secret fields are returned masked on GET; when the client round-trips the\n    // mask sentinel it means \"unchanged\", so restore the existing stored secret\n    // instead of overwriting it with the placeholder.\n    const existing = await credentialsService.resolve(integration.id, scope)\n    const credentialsToSave = mergeMaskedSecretCredentials(schema, payloadData.credentials, existing ?? {})\n    await credentialsService.save(integration.id, credentialsToSave, scope)\n  } catch (error) {\n    if (isCredentialsEncryptionUnavailableError(error)) {\n      return NextResponse.json({ error: 'Integration credentials encryption is unavailable' }, { status: 503 })\n    }\n    throw error\n  }\n\n  await emitIntegrationsEvent('integrations.credentials.updated', {\n    integrationId: integration.id,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n    userId: auth.sub,\n  })\n\n  await runIntegrationMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n      tenantId: auth.tenantId,\n      organizationId: auth.orgId,\n      userId: auth.sub ?? '',\n      resourceKind: 'integrations.integration',\n      resourceId: integration.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n\n  return NextResponse.json({ ok: true })\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,sBAAsB;AAC/B,SAAS,oCAAoC;AAC7C,SAAS,uBAAuB;AAChC,SAAS,6BAA6B;AACtC,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,OAEK;AACP,SAAS,4CAA4C;AACrD;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAElD,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iCAAiC,EAAE;AAAA,EAC/E,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iCAAiC,EAAE;AACjF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,cAAc;AAAA,EACrB,SAAS;AACX;AAEA,SAAS,cAAc,KAAkI;AACvJ,MAAI,CAAC,IAAI,OAAQ,QAAO;AACxB,MAAI,OAAQ,IAAI,OAA4B,SAAS,YAAY;AAC/D,WAAO,IAAI;AAAA,EACb;AACA,SAAO,IAAI;AACb;AAEA,eAAsB,IAAI,KAAc,KAA8D;AACpG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,YAAY,MAAM,cAAc,GAAG;AACzC,QAAM,eAAe,eAAe,UAAU,SAAS;AACvD,MAAI,CAAC,aAAa,SAAS;AACzB,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AAEA,QAAM,cAAc,eAAe,aAAa,KAAK,EAAE;AACvD,MAAI,CAAC,aAAa;AAChB,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,qBAAqB,UAAU,QAAQ,+BAA+B;AAC5E,QAAM,QAAQ,EAAE,gBAAgB,KAAK,OAAiB,UAAU,KAAK,SAAS;AAE9E,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,mBAAmB,QAAQ,YAAY,IAAI,KAAK;AAC/D,gBAAY,MAAM,mBAAmB,iBAAiB,YAAY,IAAI,KAAK;AAAA,EAC7E,SAAS,OAAO;AACd,QAAI,wCAAwC,KAAK,GAAG;AAClD,aAAO,aAAa,KAAK,EAAE,OAAO,oDAAoD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1G;AACA,UAAM;AAAA,EACR;AAEA,QAAM,SAAS,mBAAmB,UAAU,YAAY,EAAE;AAC1D,QAAM,EAAE,aAAa,uBAAuB,IAAI,sBAAsB,QAAQ,UAAU,CAAC,CAAC;AAE1F,SAAO,aAAa,KAAK;AAAA,IACvB,eAAe,YAAY;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW,WAAW,YAAY,KAAK;AAAA,EACzC,CAAC;AACH;AAEA,eAAsB,IAAI,KAAc,KAA8D;AACpG,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,YAAY,CAAC,KAAK,OAAO;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,QAAM,YAAY,MAAM,cAAc,GAAG;AACzC,QAAM,eAAe,eAAe,UAAU,SAAS;AACvD,MAAI,CAAC,aAAa,SAAS;AACzB,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AAEA,QAAM,cAAc,eAAe,aAAa,KAAK,EAAE;AACvD,MAAI,CAAC,aAAa;AAChB,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AAEA,QAAM,UAAU,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AACjD,QAAM,aAAa,sBAAsB,UAAU,OAAO;AAC1D,MAAI,CAAC,WAAW,SAAS;AACvB,WAAO,aAAa,KAAK,EAAE,OAAO,+BAA+B,SAAS,WAAW,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzH;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,MACA,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,QAAQ,KAAK,OAAO;AAAA,MACpB,cAAc;AAAA,MACd,YAAY,YAAY;AAAA,MACxB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB,WAAW;AAAA,IAC5B;AAAA,IACA,oBAAoB,IAAI;AAAA,EAC1B;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,aAAa,KAAK,YAAY,aAAa,EAAE,OAAO,6BAA6B,GAAG,EAAE,QAAQ,YAAY,eAAe,IAAI,CAAC;AAAA,EACvI;AAEA,MAAI,cAAc,WAAW;AAC7B,MAAI,YAAY,iBAAiB;AAC/B,UAAM,gBAAgB,EAAE,GAAG,WAAW,MAAM,GAAG,YAAY,gBAAgB;AAC3E,UAAM,WAAW,sBAAsB,UAAU,aAAa;AAC9D,QAAI,CAAC,SAAS,SAAS;AACrB,aAAO,aAAa,KAAK,EAAE,OAAO,qDAAqD,SAAS,SAAS,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7I;AACA,kBAAc,SAAS;AAAA,EACzB;AAEA,QAAM,qBAAqB,UAAU,QAAQ,+BAA+B;AAC5E,QAAM,QAAQ,EAAE,gBAAgB,KAAK,OAAiB,UAAU,KAAK,SAAS;AAC9E,QAAM,SAAS,mBAAmB,UAAU,YAAY,EAAE;AAE1D,MAAI;AACF,UAAM,mBAAmB,MAAM,mBAAmB,iBAAiB,YAAY,IAAI,KAAK;AACxF,iCAA6B;AAAA,MAC3B,cAAc;AAAA,MACd,YAAY,YAAY;AAAA,MACxB,SAAS;AAAA,MACT,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,GAAG;AAC1B,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AACA,QAAI,wCAAwC,KAAK,GAAG;AAClD,aAAO,aAAa,KAAK,EAAE,OAAO,oDAAoD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1G;AACA,UAAM;AAAA,EACR;AAEA,QAAM,wBAAwB;AAAA,IAC5B;AAAA,IACA,YAAY;AAAA,EACd;AACA,MAAI,OAAO,KAAK,qBAAqB,EAAE,SAAS,GAAG;AACjD,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,+BAA+B,SAAS,EAAE,aAAa,sBAAsB,EAAE;AAAA,MACxF,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,MAAI;AAIF,UAAM,WAAW,MAAM,mBAAmB,QAAQ,YAAY,IAAI,KAAK;AACvE,UAAM,oBAAoB,6BAA6B,QAAQ,YAAY,aAAa,YAAY,CAAC,CAAC;AACtG,UAAM,mBAAmB,KAAK,YAAY,IAAI,mBAAmB,KAAK;AAAA,EACxE,SAAS,OAAO;AACd,QAAI,wCAAwC,KAAK,GAAG;AAClD,aAAO,aAAa,KAAK,EAAE,OAAO,oDAAoD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1G;AACA,UAAM;AAAA,EACR;AAEA,QAAM,sBAAsB,oCAAoC;AAAA,IAC9D,eAAe,YAAY;AAAA,IAC3B,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK;AAAA,EACf,CAAC;AAED,QAAM,wCAAwC,YAAY,uBAAuB;AAAA,IAC7E,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK,OAAO;AAAA,IACpB,cAAc;AAAA,IACd,YAAY,YAAY;AAAA,IACxB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,EACtB,CAAC;AAEH,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;",
   "names": []
 }

package/dist/modules/integrations/lib/credentials-masking.js

@@ -0,0 +1,50 @@
+const SECRET_CREDENTIAL_FIELD_TYPES = /* @__PURE__ */ new Set([
+  "secret",
+  "oauth",
+  "ssh_keypair"
+]);
+const MASKED_SECRET_VALUE = "__om_secret_unchanged__";
+function isSecretField(type) {
+  return SECRET_CREDENTIAL_FIELD_TYPES.has(type);
+}
+function hasPresentValue(value) {
+  if (value === void 0 || value === null) return false;
+  if (typeof value === "string") return value.length > 0;
+  if (typeof value === "object") return Object.keys(value).length > 0;
+  return true;
+}
+function maskSecretCredentials(schema, values) {
+  const credentials = { ...values };
+  const secretFieldsConfigured = {};
+  for (const field of schema?.fields ?? []) {
+    if (!isSecretField(field.type)) continue;
+    const configured = hasPresentValue(credentials[field.key]);
+    secretFieldsConfigured[field.key] = configured;
+    if (configured) {
+      credentials[field.key] = MASKED_SECRET_VALUE;
+    } else {
+      delete credentials[field.key];
+    }
+  }
+  return { credentials, secretFieldsConfigured };
+}
+function mergeMaskedSecretCredentials(schema, incoming, existing) {
+  const merged = { ...incoming };
+  for (const field of schema?.fields ?? []) {
+    if (!isSecretField(field.type)) continue;
+    if (merged[field.key] !== MASKED_SECRET_VALUE) continue;
+    if (hasPresentValue(existing[field.key])) {
+      merged[field.key] = existing[field.key];
+    } else {
+      delete merged[field.key];
+    }
+  }
+  return merged;
+}
+export {
+  MASKED_SECRET_VALUE,
+  SECRET_CREDENTIAL_FIELD_TYPES,
+  maskSecretCredentials,
+  mergeMaskedSecretCredentials
+};
+//# sourceMappingURL=credentials-masking.js.map

package/dist/modules/integrations/lib/credentials-masking.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/integrations/lib/credentials-masking.ts"],
+  "sourcesContent": ["import type {\n  CredentialFieldType,\n  IntegrationCredentialsSchema,\n} from '@open-mercato/shared/modules/integrations/types'\n\n/**\n * Credential field types whose stored value is a secret (API keys, OAuth client\n * secrets/tokens, SSH private keys). These MUST never be returned in plaintext\n * from the credentials API \u2014 they are masked on read and treated as write-only.\n */\nexport const SECRET_CREDENTIAL_FIELD_TYPES: ReadonlySet<CredentialFieldType> = new Set<CredentialFieldType>([\n  'secret',\n  'oauth',\n  'ssh_keypair',\n])\n\n/**\n * Opaque sentinel returned in place of a configured secret value. The client\n * round-trips this value back on save when the user did not change the field;\n * the PUT handler then preserves the existing stored secret instead of writing\n * the sentinel. Chosen to be extremely unlikely to collide with a real secret.\n */\nexport const MASKED_SECRET_VALUE = '__om_secret_unchanged__'\n\nfunction isSecretField(type: CredentialFieldType): boolean {\n  return SECRET_CREDENTIAL_FIELD_TYPES.has(type)\n}\n\nfunction hasPresentValue(value: unknown): boolean {\n  if (value === undefined || value === null) return false\n  if (typeof value === 'string') return value.length > 0\n  if (typeof value === 'object') return Object.keys(value as Record<string, unknown>).length > 0\n  return true\n}\n\nexport type MaskSecretCredentialsResult = {\n  credentials: Record<string, unknown>\n  secretFieldsConfigured: Record<string, boolean>\n}\n\n/**\n * Replace every configured secret-typed field with an opaque sentinel so the\n * decrypted plaintext never reaches the API response (and therefore the\n * browser, devtools, proxies, or editable DOM inputs). Non-secret config fields\n * pass through unchanged. A `secretFieldsConfigured` map reports which secret\n * fields currently hold a value without exposing it.\n */\nexport function maskSecretCredentials(\n  schema: IntegrationCredentialsSchema | undefined,\n  values: Record<string, unknown>,\n): MaskSecretCredentialsResult {\n  const credentials: Record<string, unknown> = { ...values }\n  const secretFieldsConfigured: Record<string, boolean> = {}\n\n  for (const field of schema?.fields ?? []) {\n    if (!isSecretField(field.type)) continue\n    const configured = hasPresentValue(credentials[field.key])\n    secretFieldsConfigured[field.key] = configured\n    if (configured) {\n      credentials[field.key] = MASKED_SECRET_VALUE\n    } else {\n      delete credentials[field.key]\n    }\n  }\n\n  return { credentials, secretFieldsConfigured }\n}\n\n/**\n * Reverse of {@link maskSecretCredentials} for the save path. When the client\n * submits the mask sentinel for a secret field it means \"leave it unchanged\":\n * restore the existing stored secret, or drop the field entirely when nothing\n * was previously stored (so the literal sentinel is never persisted). Any other\n * value (including an empty string, which clears the secret) is written as-is.\n */\nexport function mergeMaskedSecretCredentials(\n  schema: IntegrationCredentialsSchema | undefined,\n  incoming: Record<string, unknown>,\n  existing: Record<string, unknown>,\n): Record<string, unknown> {\n  const merged: Record<string, unknown> = { ...incoming }\n\n  for (const field of schema?.fields ?? []) {\n    if (!isSecretField(field.type)) continue\n    if (merged[field.key] !== MASKED_SECRET_VALUE) continue\n\n    if (hasPresentValue(existing[field.key])) {\n      merged[field.key] = existing[field.key]\n    } else {\n      delete merged[field.key]\n    }\n  }\n\n  return merged\n}\n"],
+  "mappings": "AAUO,MAAM,gCAAkE,oBAAI,IAAyB;AAAA,EAC1G;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAQM,MAAM,sBAAsB;AAEnC,SAAS,cAAc,MAAoC;AACzD,SAAO,8BAA8B,IAAI,IAAI;AAC/C;AAEA,SAAS,gBAAgB,OAAyB;AAChD,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAClD,MAAI,OAAO,UAAU,SAAU,QAAO,MAAM,SAAS;AACrD,MAAI,OAAO,UAAU,SAAU,QAAO,OAAO,KAAK,KAAgC,EAAE,SAAS;AAC7F,SAAO;AACT;AAcO,SAAS,sBACd,QACA,QAC6B;AAC7B,QAAM,cAAuC,EAAE,GAAG,OAAO;AACzD,QAAM,yBAAkD,CAAC;AAEzD,aAAW,SAAS,QAAQ,UAAU,CAAC,GAAG;AACxC,QAAI,CAAC,cAAc,MAAM,IAAI,EAAG;AAChC,UAAM,aAAa,gBAAgB,YAAY,MAAM,GAAG,CAAC;AACzD,2BAAuB,MAAM,GAAG,IAAI;AACpC,QAAI,YAAY;AACd,kBAAY,MAAM,GAAG,IAAI;AAAA,IAC3B,OAAO;AACL,aAAO,YAAY,MAAM,GAAG;AAAA,IAC9B;AAAA,EACF;AAEA,SAAO,EAAE,aAAa,uBAAuB;AAC/C;AASO,SAAS,6BACd,QACA,UACA,UACyB;AACzB,QAAM,SAAkC,EAAE,GAAG,SAAS;AAEtD,aAAW,SAAS,QAAQ,UAAU,CAAC,GAAG;AACxC,QAAI,CAAC,cAAc,MAAM,IAAI,EAAG;AAChC,QAAI,OAAO,MAAM,GAAG,MAAM,oBAAqB;AAE/C,QAAI,gBAAgB,SAAS,MAAM,GAAG,CAAC,GAAG;AACxC,aAAO,MAAM,GAAG,IAAI,SAAS,MAAM,GAAG;AAAA,IACxC,OAAO;AACL,aAAO,OAAO,MAAM,GAAG;AAAA,IACzB;AAAA,EACF;AAEA,SAAO;AACT;",
+  "names": []
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.6.6-develop.6343.1.8120f84f30",
+  "version": "0.6.6-develop.6345.1.b236ea3d4b",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -246,16 +246,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.6.6-develop.6343.1.8120f84f30",
-    "@open-mercato/shared": "0.6.6-develop.6343.1.8120f84f30",
-    "@open-mercato/ui": "0.6.6-develop.6343.1.8120f84f30",
+    "@open-mercato/ai-assistant": "0.6.6-develop.6345.1.b236ea3d4b",
+    "@open-mercato/shared": "0.6.6-develop.6345.1.b236ea3d4b",
+    "@open-mercato/ui": "0.6.6-develop.6345.1.b236ea3d4b",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.6.6-develop.6343.1.8120f84f30",
-    "@open-mercato/shared": "0.6.6-develop.6343.1.8120f84f30",
-    "@open-mercato/ui": "0.6.6-develop.6343.1.8120f84f30",
+    "@open-mercato/ai-assistant": "0.6.6-develop.6345.1.b236ea3d4b",
+    "@open-mercato/shared": "0.6.6-develop.6345.1.b236ea3d4b",
+    "@open-mercato/ui": "0.6.6-develop.6345.1.b236ea3d4b",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.1",

package/src/modules/integrations/api/[id]/credentials/route.ts

@@ -12,6 +12,10 @@ import {
   type CredentialsService,
 } from '../../../lib/credentials-service'
 import { collectCredentialUrlValidationErrors } from '../../../lib/credentials-field-validation'
+import {
+  maskSecretCredentials,
+  mergeMaskedSecretCredentials,
+} from '../../../lib/credentials-masking'
 import {
   resolveUserFeatures,
   runIntegrationMutationGuardAfterSuccess,
@@ -71,10 +75,14 @@ export async function GET(req: Request, ctx: { params?: Promise<{ id?: string }>
     throw error
   }
 
+  const schema = credentialsService.getSchema(integration.id)
+  const { credentials, secretFieldsConfigured } = maskSecretCredentials(schema, values ?? {})
+
   return NextResponse.json({
     integrationId: integration.id,
-    schema: credentialsService.getSchema(integration.id),
-    credentials: values ?? {},
+    schema,
+    credentials,
+    secretFieldsConfigured,
     updatedAt: updatedAt?.toISOString() ?? null,
   })
 }
@@ -134,6 +142,7 @@ export async function PUT(req: Request, ctx: { params?: Promise<{ id?: string }>
 
   const credentialsService = container.resolve('integrationCredentialsService') as CredentialsService
   const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }
+  const schema = credentialsService.getSchema(integration.id)
 
   try {
     const currentUpdatedAt = await credentialsService.resolveUpdatedAt(integration.id, scope)
@@ -154,7 +163,7 @@ export async function PUT(req: Request, ctx: { params?: Promise<{ id?: string }>
   }
 
   const credentialFieldErrors = collectCredentialUrlValidationErrors(
-    credentialsService.getSchema(integration.id),
+    schema,
     payloadData.credentials,
   )
   if (Object.keys(credentialFieldErrors).length > 0) {
@@ -165,7 +174,12 @@ export async function PUT(req: Request, ctx: { params?: Promise<{ id?: string }>
   }
 
   try {
-    await credentialsService.save(integration.id, payloadData.credentials, scope)
+    // Secret fields are returned masked on GET; when the client round-trips the
+    // mask sentinel it means "unchanged", so restore the existing stored secret
+    // instead of overwriting it with the placeholder.
+    const existing = await credentialsService.resolve(integration.id, scope)
+    const credentialsToSave = mergeMaskedSecretCredentials(schema, payloadData.credentials, existing ?? {})
+    await credentialsService.save(integration.id, credentialsToSave, scope)
   } catch (error) {
     if (isCredentialsEncryptionUnavailableError(error)) {
       return NextResponse.json({ error: 'Integration credentials encryption is unavailable' }, { status: 503 })

package/src/modules/integrations/lib/credentials-masking.ts

@@ -0,0 +1,95 @@
+import type {
+  CredentialFieldType,
+  IntegrationCredentialsSchema,
+} from '@open-mercato/shared/modules/integrations/types'
+
+/**
+ * Credential field types whose stored value is a secret (API keys, OAuth client
+ * secrets/tokens, SSH private keys). These MUST never be returned in plaintext
+ * from the credentials API — they are masked on read and treated as write-only.
+ */
+export const SECRET_CREDENTIAL_FIELD_TYPES: ReadonlySet<CredentialFieldType> = new Set<CredentialFieldType>([
+  'secret',
+  'oauth',
+  'ssh_keypair',
+])
+
+/**
+ * Opaque sentinel returned in place of a configured secret value. The client
+ * round-trips this value back on save when the user did not change the field;
+ * the PUT handler then preserves the existing stored secret instead of writing
+ * the sentinel. Chosen to be extremely unlikely to collide with a real secret.
+ */
+export const MASKED_SECRET_VALUE = '__om_secret_unchanged__'
+
+function isSecretField(type: CredentialFieldType): boolean {
+  return SECRET_CREDENTIAL_FIELD_TYPES.has(type)
+}
+
+function hasPresentValue(value: unknown): boolean {
+  if (value === undefined || value === null) return false
+  if (typeof value === 'string') return value.length > 0
+  if (typeof value === 'object') return Object.keys(value as Record<string, unknown>).length > 0
+  return true
+}
+
+export type MaskSecretCredentialsResult = {
+  credentials: Record<string, unknown>
+  secretFieldsConfigured: Record<string, boolean>
+}
+
+/**
+ * Replace every configured secret-typed field with an opaque sentinel so the
+ * decrypted plaintext never reaches the API response (and therefore the
+ * browser, devtools, proxies, or editable DOM inputs). Non-secret config fields
+ * pass through unchanged. A `secretFieldsConfigured` map reports which secret
+ * fields currently hold a value without exposing it.
+ */
+export function maskSecretCredentials(
+  schema: IntegrationCredentialsSchema | undefined,
+  values: Record<string, unknown>,
+): MaskSecretCredentialsResult {
+  const credentials: Record<string, unknown> = { ...values }
+  const secretFieldsConfigured: Record<string, boolean> = {}
+
+  for (const field of schema?.fields ?? []) {
+    if (!isSecretField(field.type)) continue
+    const configured = hasPresentValue(credentials[field.key])
+    secretFieldsConfigured[field.key] = configured
+    if (configured) {
+      credentials[field.key] = MASKED_SECRET_VALUE
+    } else {
+      delete credentials[field.key]
+    }
+  }
+
+  return { credentials, secretFieldsConfigured }
+}
+
+/**
+ * Reverse of {@link maskSecretCredentials} for the save path. When the client
+ * submits the mask sentinel for a secret field it means "leave it unchanged":
+ * restore the existing stored secret, or drop the field entirely when nothing
+ * was previously stored (so the literal sentinel is never persisted). Any other
+ * value (including an empty string, which clears the secret) is written as-is.
+ */
+export function mergeMaskedSecretCredentials(
+  schema: IntegrationCredentialsSchema | undefined,
+  incoming: Record<string, unknown>,
+  existing: Record<string, unknown>,
+): Record<string, unknown> {
+  const merged: Record<string, unknown> = { ...incoming }
+
+  for (const field of schema?.fields ?? []) {
+    if (!isSecretField(field.type)) continue
+    if (merged[field.key] !== MASKED_SECRET_VALUE) continue
+
+    if (hasPresentValue(existing[field.key])) {
+      merged[field.key] = existing[field.key]
+    } else {
+      delete merged[field.key]
+    }
+  }
+
+  return merged
+}