@ossy/platform 3.25.0 → 3.27.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ossy/platform",
-  "version": "3.25.0",
+  "version": "3.27.0",
   "description": "Ossy application server runtime",
   "repository": {
     "type": "git",
@@ -42,6 +42,7 @@
   "license": "MIT",
   "dependencies": {
     "@aws-sdk/client-s3": "^3.1057.0",
+    "@aws-sdk/client-secrets-manager": "^3.1134.0",
     "@aws-sdk/client-ses": "^3.0.0",
     "@aws-sdk/client-sqs": "^3.1103.0",
     "@aws-sdk/s3-request-presigner": "^3.1057.0",
@@ -49,18 +50,18 @@
     "@aws-sdk/util-format-url": "^3.972.17",
     "@modelcontextprotocol/sdk": "^1.12.1",
     "@ossy/config": "^3.0.9",
-    "@ossy/email": "^3.25.0",
-    "@ossy/event-store": "^3.24.1",
+    "@ossy/email": "^3.27.0",
+    "@ossy/event-store": "^3.26.0",
     "@ossy/locale": "^3.4.0",
-    "@ossy/manifest": "^3.24.0",
+    "@ossy/manifest": "^3.27.0",
     "@ossy/observability": "^3.24.1",
     "@ossy/policies": "^3.24.1",
     "@ossy/router": "^3.25.0",
-    "@ossy/schema": "^3.24.0",
-    "@ossy/sdk": "^3.24.0",
+    "@ossy/schema": "^3.27.0",
+    "@ossy/sdk": "^3.26.0",
     "@ossy/tokens": "^3.24.1",
-    "@ossy/users": "^3.24.1",
-    "@ossy/workspaces": "^3.25.0",
+    "@ossy/users": "^3.27.0",
+    "@ossy/workspaces": "^3.27.0",
     "cookie-parser": "^1.4.7",
     "dotenv": ">=16.0.0 <18.0.0",
     "express": ">=5.0.0 <6.0.0",
@@ -81,5 +82,5 @@
     "Dockerfile",
     "docker-healthcheck.js"
   ],
-  "gitHead": "00dd4b51a94de7e0399c9dfa59380a53e58c8523"
+  "gitHead": "f72042c42723468c010d0d9744ad69257143d0b9"
 }

package/src/integration.service.js

@@ -1,24 +1,38 @@
 import { createLogger, registerBackend, clearBackends } from '@ossy/observability'
+import { getWorkspaceSecret } from './workspace-secrets.js'
 
 const log = createLogger('platform')
 
 /** @type {Record<string, unknown>} */
 const _clients = {}
 
+/**
+ * Workspace integrations declare `secrets` (key names) and `connect(secret)`.
+ * The secret payload stays out of platform env and out of this map.
+ *
+ * @type {Map<string, { secrets: string[], connect: (secret: { type: string, values: Record<string, string> }) => unknown }>}
+ */
+const _workspaceModules = new Map()
+
+/** @type {Map<string, { expiresAt: number, client: unknown }>} */
+const _workspaceClientCache = new Map()
+
+const WORKSPACE_CLIENT_TTL_MS = 60_000
+
 /**
  * Manages third-party integration clients declared via `*.integration.js` files.
  *
- * Integrations are loaded once at server startup. If a required env var is
- * missing, or if `connect()` throws, the integration is skipped with a warning
- * so the server can still boot without every optional credential being present.
+ * Platform integrations are loaded once at server startup from env vars.
+ * Workspace integrations resolve with `get(id, { workspaceId })` from the
+ * workspace secret store. A missing secret does not stop the server.
  */
 export const IntegrationService = {
   /**
-   * Connect all integration modules, storing each resulting client by id.
-   * Pass the array of already-imported integration modules (each exporting
-   * `id`, `credentials`, and `connect`).
+   * Connect platform integration modules and register workspace ones.
+   * A module with `secrets` is workspace-scoped and is not connected at boot.
+   * A module with `credentials` is connected from `env` at boot.
    *
-   * @param {Array<{ id: string, credentials: string[], connect: (opts: { env: NodeJS.ProcessEnv }) => Promise<unknown> | unknown }>} modules
+   * @param {Array<{ id: string, credentials?: string[], secrets?: string[], connect: Function }>} modules
    * @param {NodeJS.ProcessEnv} env  Usually `process.env`.
    */
   async load (modules, env) {
@@ -26,13 +40,23 @@ export const IntegrationService = {
     const loggerBackends = []
 
     for (const mod of modules) {
-      const { id, credentials = [], connect } = mod
+      const { id, connect } = mod
+      const secrets = Array.isArray(mod.secrets)
+        ? mod.secrets.filter((key) => typeof key === 'string' && key.trim())
+        : []
+      const credentials = Array.isArray(mod.credentials) ? mod.credentials : null
 
       if (typeof id !== 'string' || id.trim() === '') {
         log.warn('[IntegrationService] Skipping integration with missing or invalid "id"')
         continue
       }
 
+      if (secrets.length > 0 && typeof connect === 'function') {
+        _workspaceModules.set(id, { secrets, connect })
+      }
+
+      if (!credentials) continue
+
       // An env var set to an empty string is treated as "present" — only
       // vars that are completely absent from the environment are considered missing.
       const missing = credentials.filter((key) => !(key in env))
@@ -72,14 +96,111 @@ export const IntegrationService = {
   },
 
   /**
-   * Retrieve a connected client by integration id.
-   * Returns `null` when the integration was not loaded (missing credentials,
-   * connect failure, or not declared in the manifest).
+   * Drop a cached workspace client after the secret is written or removed.
+   *
+   * @param {{ workspaceId?: string, integrationId?: string }} [filter]
+   */
+  invalidateWorkspaceClient (filter = {}) {
+    const { workspaceId, integrationId } = filter
+    if (!workspaceId && !integrationId) {
+      _workspaceClientCache.clear()
+      return
+    }
+    for (const key of _workspaceClientCache.keys()) {
+      const [ws, cachedId] = key.split('::')
+      if (workspaceId && ws !== workspaceId) continue
+      if (integrationId && cachedId !== integrationId) continue
+      _workspaceClientCache.delete(key)
+    }
+  },
+
+  /**
+   * Retrieve an integration client.
+   *
+   * - `get(id)` — sync; boot-time platform client, or `null` if not loaded.
+   * - `get(id, { workspaceId })` — async; client from that workspace's secret.
    *
    * @param {string} id
-   * @returns {unknown | null}
+   * @param {{ workspaceId?: string }} [options]
+   * @returns {unknown | null | Promise<unknown>}
    */
-  get (id) {
-    return _clients[id] ?? null
+  get (id, options) {
+    if (options === undefined) {
+      return _clients[id] ?? null
+    }
+
+    if (!options || typeof options !== 'object') {
+      throw Object.assign(new Error('Integration options must be an object with workspaceId'), {
+        status: 400,
+        code: 'INVALID_INTEGRATION_OPTIONS',
+      })
+    }
+
+    const workspaceId = options.workspaceId
+    if (typeof workspaceId !== 'string' || !workspaceId.trim()) {
+      throw Object.assign(
+        new Error('workspaceId is required for workspace integrations.get(id, { workspaceId })'),
+        { status: 400, code: 'WORKSPACE_ID_REQUIRED' },
+      )
+    }
+
+    return getWorkspaceClient(id, workspaceId.trim())
   },
 }
+
+/**
+ * @param {string} id
+ * @param {string} workspaceId
+ */
+async function getWorkspaceClient (id, workspaceId) {
+  const mod = _workspaceModules.get(id)
+  if (!mod) {
+    throw Object.assign(new Error(`Workspace integration not registered: ${id}`), {
+      status: 404,
+      code: 'INTEGRATION_NOT_FOUND',
+    })
+  }
+
+  const cacheKey = `${workspaceId}::${id}`
+  const cached = _workspaceClientCache.get(cacheKey)
+  if (cached && cached.expiresAt > Date.now()) {
+    return cached.client
+  }
+
+  let secret
+  try {
+    secret = await getWorkspaceSecret({ workspaceId, integrationId: id })
+  } catch (err) {
+    if (err?.code === 'INTEGRATION_SECRET_NOT_FOUND') {
+      throw Object.assign(new Error(`Integration "${id}" is not connected for this workspace`), {
+        status: 409,
+        code: 'INTEGRATION_NOT_CONNECTED',
+      })
+    }
+    throw err
+  }
+
+  const missing = mod.secrets.filter((key) => {
+    const value = secret?.values?.[key]
+    return typeof value !== 'string' || !value.trim()
+  })
+  if (missing.length > 0) {
+    throw Object.assign(
+      new Error(`Integration "${id}" is missing secret keys: ${missing.join(', ')}`),
+      { status: 409, code: 'INTEGRATION_NOT_CONNECTED' },
+    )
+  }
+
+  const client = await mod.connect(secret)
+  _workspaceClientCache.set(cacheKey, {
+    expiresAt: Date.now() + WORKSPACE_CLIENT_TTL_MS,
+    client,
+  })
+  return client
+}
+
+export {
+  deleteWorkspaceSecret,
+  listWorkspaceIntegrationIds,
+  putWorkspaceSecret,
+} from './workspace-secrets.js'

package/src/integration.service.spec.js

@@ -0,0 +1,41 @@
+import { beforeEach, describe, expect, it } from '@jest/globals'
+import { IntegrationService } from './integration.service.js'
+import {
+  _resetWorkspaceSecretsMemoryForTests,
+  putWorkspaceSecret,
+} from './workspace-secrets.js'
+
+describe('workspace integrations.get', () => {
+  beforeEach(async () => {
+    _resetWorkspaceSecretsMemoryForTests()
+    process.env.WORKSPACE_SECRETS_BACKEND = 'memory'
+    IntegrationService.invalidateWorkspaceClient()
+    await IntegrationService.load([{
+      id: 'linkedin',
+      secrets: ['ACCESS_TOKEN'],
+      connect (secret) {
+        return { token: secret.values.ACCESS_TOKEN }
+      },
+    }], process.env)
+  })
+
+  it('does not connect a workspace integration from platform env', () => {
+    expect(IntegrationService.get('linkedin')).toBeNull()
+  })
+
+  it('resolves the client from that workspace secret only', async () => {
+    await expect(IntegrationService.get('linkedin', { workspaceId: 'ws-1' }))
+      .rejects.toMatchObject({ code: 'INTEGRATION_NOT_CONNECTED' })
+
+    await putWorkspaceSecret({
+      workspaceId: 'ws-1',
+      integrationId: 'linkedin',
+      payload: { values: { ACCESS_TOKEN: 'tok-1' } },
+    })
+
+    await expect(IntegrationService.get('linkedin', { workspaceId: 'ws-1' }))
+      .resolves.toEqual({ token: 'tok-1' })
+    await expect(IntegrationService.get('linkedin', { workspaceId: 'ws-2' }))
+      .rejects.toMatchObject({ code: 'INTEGRATION_NOT_CONNECTED' })
+  })
+})

package/src/list-integrations.action.js

@@ -0,0 +1,5 @@
+export const metadata = {
+  id: '@ossy/platform/actions/list-integrations',
+  access: 'workspace',
+  audit: false,
+}

package/src/list-integrations.task.js

@@ -0,0 +1,13 @@
+import { listWorkspaceIntegrationIds } from './workspace-secrets.js'
+
+export const metadata = {
+  id: '@ossy/platform/tasks/list-integrations',
+  audit: false,
+}
+
+export async function run ({ req, payload }) {
+  const workspaceId = payload?.workspaceId || req?.workspaceId
+  if (!workspaceId) return { integrations: [] }
+  const integrations = await listWorkspaceIntegrationIds(workspaceId)
+  return { integrations }
+}

package/src/server.js

@@ -221,10 +221,9 @@ export async function startServer (options = {}) {
     registerSchema(template)
   }
 
-  // Integration loading — import each bundled integration module, check its
-  // declared credentials, and call connect({ env }) to obtain a client.
-  // Missing credentials or a failing connect() are non-fatal: the integration
-  // is skipped with a warning so the server still starts.
+  // Integration loading — platform modules connect from env at boot.
+  // Workspace modules declare `secrets` and connect later via
+  // integrations.get(id, { workspaceId }). Missing credentials are non-fatal.
   const integrationModules = []
   for (const intEntry of manifest.integrations ?? []) {
     try {

package/src/tasks/task-service.js

@@ -36,6 +36,32 @@ function buildTaskContext (baseContext, extras = {}) {
   }
 }
 
+const NOT_CONNECTED = new Set([
+  'INTEGRATION_NOT_CONNECTED',
+  'INTEGRATION_NOT_FOUND',
+  'INTEGRATION_SECRET_NOT_FOUND',
+])
+
+/**
+ * A task with `metadata.integration` runs only after that workspace has stored the secret.
+ *
+ * @param {object} metadata
+ * @param {string | null | undefined} workspaceId
+ * @returns {Promise<boolean>}
+ */
+async function workspaceIntegrationReady (metadata, workspaceId) {
+  const integrationId = typeof metadata?.integration === 'string' ? metadata.integration.trim() : ''
+  if (!integrationId) return true
+  if (!workspaceId) return false
+  try {
+    await IntegrationService.get(integrationId, { workspaceId })
+    return true
+  } catch (err) {
+    if (NOT_CONNECTED.has(err?.code)) return false
+    throw err
+  }
+}
+
 /**
  * In-process SDK bound to this request. Dynamic import avoids a cycle through
  * ActionService. A missing req loads the bot; callers that have a user or a
@@ -319,6 +345,14 @@ export class TaskService {
     // tasks can always use integrations.get('email') (including local delivery).
     // Nested invokes keep this sdk, so the first actor (the caller, or an sdk
     // the entry point already bound) is the actor for the whole chain.
+    const workspaceId = context.payload?.workspaceId ?? context.req?.workspaceId ?? null
+    if (!(await workspaceIntegrationReady(task.metadata, workspaceId))) {
+      throw Object.assign(
+        new Error(`Task "${id}" requires integration "${task.metadata.integration}"`),
+        { status: 409, code: 'INTEGRATION_NOT_CONNECTED' },
+      )
+    }
+
     const invokeContext = {
       ...context,
       sdk: context.sdk ?? await sdkBoundTo(context.req),
@@ -396,6 +430,13 @@ export class TaskService {
 
       // Multiple startServer processes share Mongo changestreams (#982) — claim before run.
       void (async () => {
+        if (!(await workspaceIntegrationReady(metadata, workspaceId))) {
+          _serviceLog.debug(
+            `Skipping task "${_taskId}" — integration "${metadata.integration}" is not connected`,
+          )
+          return
+        }
+
         const won = await tryClaimDispatch(claimKey)
         if (!won) {
           _serviceLog.debug(`Skipping task "${_taskId}" — dispatch claim lost`)
@@ -601,6 +642,13 @@ export class TaskService {
                 return
               }
 
+              if (!(await workspaceIntegrationReady(metadata, job.workspaceId))) {
+                _serviceLog.debug(
+                  `Skipping schedule for task "${metadata.id}" — integration "${metadata.integration}" is not connected`,
+                )
+                return
+              }
+
               _serviceLog.debug(
                 `Schedule fired for task "${metadata.id}"`
                 + (job.workspaceId ? ` (workspace ${job.workspaceId})` : ''),

package/src/tasks/task-service.spec.js

@@ -1,5 +1,7 @@
 import { describe, expect, it } from '@jest/globals'
 import { jobsForGlobalSchedule, TaskService } from './task-service.js'
+import { IntegrationService, putWorkspaceSecret } from '../integration.service.js'
+import { _resetWorkspaceSecretsMemoryForTests } from '../workspace-secrets.js'
 import { TaskRun } from '../audit/task-run.aggregate.js'
 import { ActionInvocation } from '../audit/action-invocation.aggregate.js'
 import { TaskRunListProjection } from '../audit/task-run-list.aggregate.js'
@@ -391,6 +393,60 @@ describe('ActionInvocation entity fold', () => {
   })
 })
 
+describe('workspace integration gate', () => {
+  it('does not run a task until that workspace has connected', async () => {
+    _resetWorkspaceSecretsMemoryForTests()
+    process.env.WORKSPACE_SECRETS_BACKEND = 'memory'
+    IntegrationService.invalidateWorkspaceClient()
+    await IntegrationService.load([{
+      id: 'linkedin',
+      secrets: ['ACCESS_TOKEN'],
+      connect (secret) {
+        return { token: secret.values.ACCESS_TOKEN }
+      },
+    }], process.env)
+
+    const previousTasks = TaskService._tasks
+    const previousById = TaskService._tasksById
+    TaskService._tasks = []
+    TaskService._tasksById = new Map()
+    const calls = []
+    TaskService.registerTask({
+      metadata: {
+        id: '@ossy/linkedin/tasks/publish',
+        integration: 'linkedin',
+        audit: false,
+      },
+      run (context) {
+        calls.push(context.payload?.workspaceId)
+        return { ok: true }
+      },
+    })
+
+    try {
+      await expect(TaskService.invoke('@ossy/linkedin/tasks/publish', {
+        sdk: {},
+        payload: { workspaceId: 'ws-1' },
+      })).rejects.toMatchObject({ code: 'INTEGRATION_NOT_CONNECTED' })
+      expect(calls).toEqual([])
+
+      await putWorkspaceSecret({
+        workspaceId: 'ws-1',
+        integrationId: 'linkedin',
+        payload: { values: { ACCESS_TOKEN: 'tok' } },
+      })
+      await expect(TaskService.invoke('@ossy/linkedin/tasks/publish', {
+        sdk: {},
+        payload: { workspaceId: 'ws-1' },
+      })).resolves.toEqual({ ok: true })
+      expect(calls).toEqual(['ws-1'])
+    } finally {
+      TaskService._tasks = previousTasks
+      TaskService._tasksById = previousById
+    }
+  })
+})
+
 describe('audit helpers', () => {
   it('detects channel from request shape', () => {
     expect(detectChannel({ originalUrl: '/mcp', signedCookies: {} })).toBe('mcp')

package/src/test/flow-runner.js

@@ -204,6 +204,16 @@ export async function runFlow (flow, options = {}) {
   const context = contextIn ?? { fields: {} }
   const steps = flow.steps ?? []
 
+  // SSR paints controls before React attaches listeners. A submit in that
+  // window is a native GET, and a button click never opens its dialog.
+  const waitForHydration = async (timeout = 20000) => {
+    if (!page) return
+    await page.locator('html[data-hydrated="true"]').waitFor({
+      state: 'attached',
+      timeout,
+    })
+  }
+
   for (const step of steps) {
     if (!step || typeof step !== 'object') continue
 
@@ -231,6 +241,7 @@ export async function runFlow (flow, options = {}) {
     }
 
     if (step.click != null) {
+      await waitForHydration(step.timeout ?? 20000)
       if (!page) throw new Error('click step requires a Playwright page')
       const { selector, position } = resolveClickTarget(step.click)
       const resolvedSelector = interpolateContextString(selector, context, {
@@ -306,6 +317,7 @@ export async function runFlow (flow, options = {}) {
 
     if (step.form) {
       if (!page) throw new Error('form step requires a Playwright page')
+      await waitForHydration(step.timeout ?? 20000)
       const formMeta = step.form
       const schemaId = formMeta?.schemaId
       if (!formMeta || typeof formMeta !== 'object' || typeof formMeta.id !== 'string' || typeof schemaId !== 'string') {
@@ -427,6 +439,7 @@ export async function runFlow (flow, options = {}) {
 
     if (step.action != null) {
       if (!page) throw new Error('action step requires a Playwright page')
+      await waitForHydration(step.timeout ?? 20000)
       const actionStep = typeof step.action === 'object' && step.action != null
         ? resolveContextObject(step.action, context)
         : step.action
@@ -546,6 +559,7 @@ export async function runFlow (flow, options = {}) {
 
     if (step.download != null) {
       if (!page) throw new Error('download step requires a Playwright page')
+      await waitForHydration(step.timeout ?? 20000)
       const target = resolveDownloadTarget(step.download)
       const timeout = step.timeout ?? target.timeout
       const locator = target.actionId
@@ -585,6 +599,7 @@ export async function runFlow (flow, options = {}) {
 
     if (step.inputs != null) {
       if (!page) throw new Error('inputs step requires a Playwright page')
+      await waitForHydration(step.timeout ?? 20000)
       const inputsTimeout = step.timeout ?? 15000
       for (const [selector, valueSpec] of Object.entries(step.inputs)) {
         const value = resolveContextValue(valueSpec, context)

package/src/vector/vector-store.js

@@ -2,21 +2,22 @@
  * Vector embedding store backed by MongoDB.
  *
  * Collection: `resource_embeddings`
- * Schema: { resourceId, workspaceId, model, dimensions, vector, textSource, textLength, updatedAt }
+ * Schema: { resourceId, workspaceId, kind, model, dimensions, vector, textSource, textLength, textHash, updatedAt }
  *
  * Search strategy:
  * - If Atlas Vector Search index `resource_embedding_vector` is present → $vectorSearch
- * - Otherwise → in-memory cosine similarity (works fine for <10k resources per workspace)
+ * - Otherwise → cosine similarity over the workspace (and kind, when set)
  *
- * Atlas Vector Search index definition (create via Atlas UI or Admin API):
+ * `workspaceId` and `kind` must be filter fields on that index. A filter on a
+ * field the index does not declare fails the query, and search falls back to
+ * the in-memory scan. Atlas index definition:
  * ```json
  * {
- *   "mappings": {
- *     "dynamic": false,
- *     "fields": {
- *       "vector": { "type": "knnVector", "dimensions": 1536, "similarity": "cosine" }
- *     }
- *   }
+ *   "fields": [
+ *     { "type": "vector", "path": "vector", "numDimensions": 1536, "similarity": "cosine" },
+ *     { "type": "filter", "path": "workspaceId" },
+ *     { "type": "filter", "path": "kind" }
+ *   ]
  * }
  * ```
  */
@@ -67,6 +68,8 @@ function col () {
  *   vector: number[],
  *   textSource: string,
  *   textLength: number,
+ *   kind?: string,
+ *   textHash?: string,
  * }} doc
  */
 export async function upsertEmbedding (doc) {
@@ -97,6 +100,43 @@ export async function deleteEmbedding (resourceId) {
   await col().deleteOne({ resourceId })
 }
 
+/**
+ * Filter for `$vectorSearch` and the in-memory fallback.
+ * `kind` keeps a request vector from matching other requests.
+ *
+ * Atlas `$vectorSearch` filters do not support `$exists`, so the Atlas query
+ * matches `kind` exactly. A changed document writes `kind` when it is embedded
+ * or scored. The in-memory fallback can include legacy rows that predate the field.
+ *
+ * @param {{ workspaceId?: string, kind?: string, includeMissingKind?: boolean }} [scope]
+ */
+export function embeddingSearchFilter ({ workspaceId, kind, includeMissingKind = false } = {}) {
+  const filter = {}
+  if (workspaceId) filter.workspaceId = workspaceId
+  if (!kind) return filter
+  if (!includeMissingKind) {
+    filter.kind = kind
+    return filter
+  }
+  filter.$or = [
+    { kind },
+    { kind: { $exists: false } },
+    { kind: null },
+  ]
+  return filter
+}
+
+/**
+ * Record what a stored vector represents without rewriting the vector.
+ *
+ * @param {string} resourceId
+ * @param {string} kind
+ */
+export async function setEmbeddingKind (resourceId, kind) {
+  if (!resourceId || !kind) return
+  await col().updateOne({ resourceId }, { $set: { kind, updatedAt: new Date() } })
+}
+
 /**
  * Semantic search within a workspace using cosine similarity.
  * Tries Atlas $vectorSearch first; falls back to in-memory similarity.
@@ -106,11 +146,16 @@ export async function deleteEmbedding (resourceId) {
  *   queryVector: number[],
  *   limit?: number,
  *   threshold?: number,
+ *   kind?: string,
  * }} opts
  * @returns {Promise<Array<{ resourceId: string, score: number }>>}
  */
-export async function searchEmbeddings ({ workspaceId, queryVector, limit = 20, threshold = 0 }) {
+export async function searchEmbeddings ({ workspaceId, queryVector, limit = 20, threshold = 0, kind } = {}) {
+  if (!workspaceId || !Array.isArray(queryVector) || !queryVector.length) return []
+  const filter = embeddingSearchFilter({ workspaceId, kind })
+  const capped = Math.max(1, limit)
   // Try Atlas Vector Search (requires index on Atlas M10+).
+  // An empty result is the index answer. A missing index throws and falls back.
   try {
     const pipeline = [
       {
@@ -118,9 +163,9 @@ export async function searchEmbeddings ({ workspaceId, queryVector, limit = 20,
           index: ATLAS_INDEX,
           path: 'vector',
           queryVector,
-          numCandidates: limit * 10,
-          limit,
-          filter: { workspaceId },
+          numCandidates: capped * 10,
+          limit: capped,
+          filter,
         },
       },
       {
@@ -132,17 +177,14 @@ export async function searchEmbeddings ({ workspaceId, queryVector, limit = 20,
       },
     ]
     const results = await col().aggregate(pipeline).toArray()
-    if (results.length > 0) {
-      return results.filter((r) => r.score >= threshold)
-    }
+    return results.filter((r) => r.score >= threshold)
   } catch {
     // Atlas Vector Search not available — fall through to cosine similarity.
   }
 
-  // In-memory cosine similarity fallback.
   log.debug('[VectorStore] Atlas $vectorSearch unavailable — using in-memory cosine similarity')
   const docs = await col()
-    .find({ workspaceId })
+    .find(embeddingSearchFilter({ workspaceId, kind, includeMissingKind: true }))
     .project({ resourceId: 1, vector: 1 })
     .toArray()
 
@@ -153,7 +195,7 @@ export async function searchEmbeddings ({ workspaceId, queryVector, limit = 20,
     }))
     .filter((r) => r.score >= threshold)
     .sort((a, b) => b.score - a.score)
-    .slice(0, limit)
+    .slice(0, capped)
 }
 
 /**
@@ -178,5 +220,6 @@ export async function ensureEmbeddingIndexes () {
   await c.createIndex({ resourceId: 1 }, { name: 'resourceId', unique: true, background: true })
   await c.createIndex({ workspaceId: 1 }, { name: 'workspaceId', background: true })
   await c.createIndex({ workspaceId: 1, updatedAt: -1 }, { name: 'workspaceId_updatedAt', background: true })
+  await c.createIndex({ workspaceId: 1, kind: 1 }, { name: 'workspaceId_kind', background: true })
   log.info('[VectorStore] resource_embeddings indexes ensured')
 }

package/src/vector/vector-store.spec.js

@@ -0,0 +1,35 @@
+import { describe, expect, it, jest } from '@jest/globals'
+
+jest.unstable_mockModule('@ossy/observability', () => ({
+  createLogger: () => ({ debug () {}, info () {}, warn () {}, error () {} }),
+}))
+
+jest.unstable_mockModule('@ossy/event-store', () => ({
+  Mongo: { db: { collection () { return {} } } },
+}))
+
+const { embeddingSearchFilter } = await import('./vector-store.js')
+
+describe('embeddingSearchFilter', () => {
+  it('scopes by workspace and kind for Atlas-compatible filters', () => {
+    expect(embeddingSearchFilter({ workspaceId: 'ws-1', kind: 'resume' })).toEqual({
+      workspaceId: 'ws-1',
+      kind: 'resume',
+    })
+  })
+
+  it('includes legacy rows without kind for the in-memory fallback', () => {
+    expect(embeddingSearchFilter({
+      workspaceId: 'ws-1',
+      kind: 'resume',
+      includeMissingKind: true,
+    })).toEqual({
+      workspaceId: 'ws-1',
+      $or: [
+        { kind: 'resume' },
+        { kind: { $exists: false } },
+        { kind: null },
+      ],
+    })
+  })
+})

package/src/workspace-secrets.js

@@ -0,0 +1,336 @@
+import { createLogger } from '@ossy/observability'
+
+const log = createLogger('platform')
+
+/**
+ * Workspace integration secrets (SPEC #556).
+ * Payload: { type, values: Record<string, string> }
+ *
+ * Backend:
+ * - `memory` (default for local/tests) — in-process Map
+ * - `aws` — Secrets Manager (`WORKSPACE_SECRETS_BACKEND=aws`)
+ */
+
+/** @type {Map<string, string>} */
+const memoryStore = new Map()
+
+/**
+ * @param {string} workspaceId
+ * @param {string} integrationId
+ * @returns {string}
+ */
+export function workspaceSecretName (workspaceId, integrationId) {
+  return `ossybot/workspaces/${workspaceId}/integrations/${integrationId}`
+}
+
+/**
+ * Name portion of a secret id. Accepts a secret name, a `memory:` name,
+ * or a Secrets Manager ARN (`…:secret:{name}-{suffix}`).
+ *
+ * @param {unknown} secretId
+ * @returns {string}
+ */
+export function secretNameFromId (secretId) {
+  if (typeof secretId !== 'string') return ''
+  let id = secretId.trim()
+  if (!id) return ''
+  if (id.startsWith('memory:')) id = id.slice('memory:'.length)
+  const marker = ':secret:'
+  const at = id.indexOf(marker)
+  if (id.startsWith('arn:') && at !== -1) id = id.slice(at + marker.length)
+  return id
+}
+
+function crossTenantSecretError () {
+  return Object.assign(new Error('Secret is outside this workspace'), {
+    status: 403,
+    code: 'CROSS_TENANT_SECRET',
+  })
+}
+
+/**
+ * Level-1 tenant check (#849). The id must be this workspace's secret path.
+ * A caller-supplied ARN is not trusted on its own.
+ *
+ * @param {unknown} secretId
+ * @param {unknown} workspaceId
+ */
+export function assertWorkspaceSecretId (secretId, workspaceId) {
+  if (
+    typeof workspaceId !== 'string'
+    || !workspaceId
+    || workspaceId.includes('/')
+    || workspaceId.includes('\\')
+    || workspaceId.includes('..')
+  ) {
+    throw crossTenantSecretError()
+  }
+  const prefix = `ossybot/workspaces/${workspaceId}/`
+  const name = secretNameFromId(secretId)
+  if (!name.startsWith(prefix)) throw crossTenantSecretError()
+}
+
+/**
+ * @returns {'memory' | 'aws'}
+ */
+export function workspaceSecretsBackend () {
+  const raw = typeof process.env.WORKSPACE_SECRETS_BACKEND === 'string'
+    ? process.env.WORKSPACE_SECRETS_BACKEND.trim().toLowerCase()
+    : ''
+  if (raw === 'aws') return 'aws'
+  if (raw === 'memory') return 'memory'
+  // Local / test default — avoid requiring AWS for unit tests and app-test.
+  if (process.env.BUILD_ENVIRONMENT === 'local' || process.env.NODE_ENV === 'test') {
+    return 'memory'
+  }
+  return process.env.AWS_ACCESS_KEY_ID ? 'aws' : 'memory'
+}
+
+/**
+ * @param {unknown} payload
+ * @returns {{ type: string, values: Record<string, string> }}
+ */
+export function normalizeSecretPayload (payload) {
+  if (!payload || typeof payload !== 'object' || Array.isArray(payload)) {
+    throw Object.assign(new Error('Secret payload must be an object'), {
+      status: 400,
+      code: 'INVALID_SECRET_PAYLOAD',
+    })
+  }
+  const type = typeof payload.type === 'string' && payload.type.trim()
+    ? payload.type.trim()
+    : 'oauth2'
+  const rawValues = payload.values
+  if (!rawValues || typeof rawValues !== 'object' || Array.isArray(rawValues)) {
+    throw Object.assign(new Error('Secret payload.values must be an object'), {
+      status: 400,
+      code: 'INVALID_SECRET_VALUES',
+    })
+  }
+  /** @type {Record<string, string>} */
+  const values = {}
+  for (const [key, value] of Object.entries(rawValues)) {
+    if (typeof key !== 'string' || !key.trim()) continue
+    if (typeof value !== 'string' || !value.trim()) continue
+    values[key.trim()] = value
+  }
+  if (!Object.keys(values).length) {
+    throw Object.assign(new Error('Secret payload.values must include at least one string'), {
+      status: 400,
+      code: 'EMPTY_SECRET_VALUES',
+    })
+  }
+  return { type, values }
+}
+
+function awsClientConfig () {
+  const region = process.env.AWS_REGION
+    || process.env.SES_REGION
+    || 'eu-north-1'
+  /** @type {{ region: string, credentials?: { accessKeyId: string, secretAccessKey: string } }} */
+  const config = { region }
+  if (process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SECRET_ACCESS_KEY) {
+    config.credentials = {
+      accessKeyId: process.env.AWS_ACCESS_KEY_ID,
+      secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY,
+    }
+  }
+  return config
+}
+
+async function getAwsClient () {
+  const { SecretsManagerClient } = await import('@aws-sdk/client-secrets-manager')
+  return new SecretsManagerClient(awsClientConfig())
+}
+
+/**
+ * @param {{ workspaceId: string, integrationId: string, payload: unknown }} args
+ * @returns {Promise<{ secretName: string, secretArn: string, credentialKeys: string[] }>}
+ */
+export async function putWorkspaceSecret ({ workspaceId, integrationId, payload }) {
+  if (!workspaceId || !integrationId) {
+    throw Object.assign(new Error('workspaceId and integrationId are required'), { status: 400 })
+  }
+  const normalized = normalizeSecretPayload(payload)
+  const secretName = workspaceSecretName(workspaceId, integrationId)
+  assertWorkspaceSecretId(secretName, workspaceId)
+  const secretString = JSON.stringify(normalized)
+  const credentialKeys = Object.keys(normalized.values).sort()
+  const backend = workspaceSecretsBackend()
+
+  if (backend === 'memory') {
+    memoryStore.set(secretName, secretString)
+    return {
+      secretName,
+      secretArn: `memory:${secretName}`,
+      credentialKeys,
+    }
+  }
+
+  const client = await getAwsClient()
+  const {
+    CreateSecretCommand,
+    PutSecretValueCommand,
+    DescribeSecretCommand,
+  } = await import('@aws-sdk/client-secrets-manager')
+
+  try {
+    await client.send(new DescribeSecretCommand({ SecretId: secretName }))
+    await client.send(new PutSecretValueCommand({
+      SecretId: secretName,
+      SecretString: secretString,
+    }))
+    const described = await client.send(new DescribeSecretCommand({ SecretId: secretName }))
+    return {
+      secretName,
+      secretArn: described.ARN || secretName,
+      credentialKeys,
+    }
+  } catch (err) {
+    if (err?.name !== 'ResourceNotFoundException') {
+      log.warn(`[workspace-secrets] put failed for ${secretName}: ${err?.message || err}`)
+      throw err
+    }
+  }
+
+  const created = await client.send(new CreateSecretCommand({
+    Name: secretName,
+    SecretString: secretString,
+    Tags: [
+      { Key: 'ossy:kind', Value: 'workspace-integration' },
+      { Key: 'ossy:workspaceId', Value: workspaceId },
+      { Key: 'ossy:integrationId', Value: integrationId },
+    ],
+  }))
+
+  return {
+    secretName,
+    secretArn: created.ARN || secretName,
+    credentialKeys,
+  }
+}
+
+/**
+ * @param {{ workspaceId: string, integrationId: string, secretArn?: string | null }} args
+ * @returns {Promise<{ type: string, values: Record<string, string> }>}
+ */
+export async function getWorkspaceSecret ({ workspaceId, integrationId, secretArn = null }) {
+  if (!workspaceId || !integrationId) {
+    throw Object.assign(new Error('workspaceId and integrationId are required'), {
+      status: 400,
+      code: 'INTEGRATION_SECRET_NOT_FOUND',
+    })
+  }
+  const secretName = workspaceSecretName(workspaceId, integrationId)
+  assertWorkspaceSecretId(secretName, workspaceId)
+  if (secretArn) assertWorkspaceSecretId(secretArn, workspaceId)
+  const backend = workspaceSecretsBackend()
+
+  if (backend === 'memory') {
+    const raw = memoryStore.get(secretName)
+    if (!raw) {
+      throw Object.assign(new Error('Integration secret not found'), {
+        status: 404,
+        code: 'INTEGRATION_SECRET_NOT_FOUND',
+      })
+    }
+    return normalizeSecretPayload(JSON.parse(raw))
+  }
+
+  const client = await getAwsClient()
+  const { GetSecretValueCommand } = await import('@aws-sdk/client-secrets-manager')
+  try {
+    const result = await client.send(new GetSecretValueCommand({
+      SecretId: secretArn || secretName,
+    }))
+    if (!result.SecretString) {
+      throw Object.assign(new Error('Integration secret is empty'), {
+        status: 404,
+        code: 'INTEGRATION_SECRET_NOT_FOUND',
+      })
+    }
+    return normalizeSecretPayload(JSON.parse(result.SecretString))
+  } catch (err) {
+    if (err?.code === 'INTEGRATION_SECRET_NOT_FOUND') throw err
+    if (err?.name === 'ResourceNotFoundException') {
+      throw Object.assign(new Error('Integration secret not found'), {
+        status: 404,
+        code: 'INTEGRATION_SECRET_NOT_FOUND',
+      })
+    }
+    log.warn(`[workspace-secrets] get failed for ${secretName}: ${err?.message || err}`)
+    throw err
+  }
+}
+
+/**
+ * @param {{ workspaceId: string, integrationId: string, secretArn?: string | null }} args
+ */
+export async function deleteWorkspaceSecret ({ workspaceId, integrationId, secretArn = null }) {
+  if (!workspaceId || !integrationId) return
+  const secretName = workspaceSecretName(workspaceId, integrationId)
+  assertWorkspaceSecretId(secretName, workspaceId)
+  if (secretArn) assertWorkspaceSecretId(secretArn, workspaceId)
+  const backend = workspaceSecretsBackend()
+
+  if (backend === 'memory') {
+    memoryStore.delete(secretName)
+    return
+  }
+
+  const client = await getAwsClient()
+  const { DeleteSecretCommand } = await import('@aws-sdk/client-secrets-manager')
+  try {
+    await client.send(new DeleteSecretCommand({
+      SecretId: secretArn || secretName,
+      ForceDeleteWithoutRecovery: true,
+    }))
+  } catch (err) {
+    if (err?.name === 'ResourceNotFoundException') return
+    log.warn(`[workspace-secrets] delete failed for ${secretName}: ${err?.message || err}`)
+    throw err
+  }
+}
+
+/**
+ * Integration ids this workspace has stored. Names only — never the secret values.
+ *
+ * @param {string} workspaceId
+ * @returns {Promise<string[]>}
+ */
+export async function listWorkspaceIntegrationIds (workspaceId) {
+  if (!workspaceId) return []
+  const prefix = `ossybot/workspaces/${workspaceId}/integrations/`
+  assertWorkspaceSecretId(prefix, workspaceId)
+  if (workspaceSecretsBackend() === 'memory') {
+    return [...memoryStore.keys()]
+      .filter((name) => name.startsWith(prefix))
+      .map((name) => name.slice(prefix.length))
+      .sort()
+  }
+
+  const client = await getAwsClient()
+  const { ListSecretsCommand } = await import('@aws-sdk/client-secrets-manager')
+  /** @type {string[]} */
+  const ids = []
+  let nextToken
+  for (let page = 0; page < 10; page += 1) {
+    const result = await client.send(new ListSecretsCommand({
+      NextToken: nextToken,
+      Filters: [{ Key: 'name', Values: [prefix] }],
+    }))
+    for (const entry of result.SecretList || []) {
+      if (typeof entry.Name === 'string' && entry.Name.startsWith(prefix)) {
+        ids.push(entry.Name.slice(prefix.length))
+      }
+    }
+    nextToken = result.NextToken
+    if (!nextToken) break
+  }
+  return ids.sort()
+}
+
+/** Test helper — clear memory backend. */
+export function _resetWorkspaceSecretsMemoryForTests () {
+  memoryStore.clear()
+}

package/src/workspace-secrets.spec.js

@@ -0,0 +1,140 @@
+import { beforeEach, describe, expect, it } from '@jest/globals'
+import {
+  putWorkspaceSecret,
+  getWorkspaceSecret,
+  deleteWorkspaceSecret,
+  listWorkspaceIntegrationIds,
+  workspaceSecretName,
+  _resetWorkspaceSecretsMemoryForTests,
+} from './workspace-secrets.js'
+
+describe('workspace-secrets (memory backend)', () => {
+  beforeEach(() => {
+    _resetWorkspaceSecretsMemoryForTests()
+    process.env.WORKSPACE_SECRETS_BACKEND = 'memory'
+  })
+
+  it('puts and gets a normalized payload', async () => {
+    const stored = await putWorkspaceSecret({
+      workspaceId: 'ws-1',
+      integrationId: 'linkedin-primary',
+      payload: { type: 'oauth2', values: { ACCESS_TOKEN: 'tok', REFRESH_TOKEN: 'ref' } },
+    })
+
+    expect(stored.secretName).toBe(workspaceSecretName('ws-1', 'linkedin-primary'))
+    expect(stored.credentialKeys).toEqual(['ACCESS_TOKEN', 'REFRESH_TOKEN'])
+
+    const loaded = await getWorkspaceSecret({
+      workspaceId: 'ws-1',
+      integrationId: 'linkedin-primary',
+    })
+    expect(loaded).toEqual({
+      type: 'oauth2',
+      values: { ACCESS_TOKEN: 'tok', REFRESH_TOKEN: 'ref' },
+    })
+  })
+
+  it('lists integration ids for one workspace and not another', async () => {
+    await putWorkspaceSecret({
+      workspaceId: 'ws-1',
+      integrationId: 'linkedin',
+      payload: { values: { ACCESS_TOKEN: 'tok' } },
+    })
+    await putWorkspaceSecret({
+      workspaceId: 'ws-2',
+      integrationId: 'linkedin',
+      payload: { values: { ACCESS_TOKEN: 'other' } },
+    })
+
+    expect(await listWorkspaceIntegrationIds('ws-1')).toEqual(['linkedin'])
+    expect(await listWorkspaceIntegrationIds('ws-2')).toEqual(['linkedin'])
+    await expect(getWorkspaceSecret({
+      workspaceId: 'ws-2',
+      integrationId: 'linkedin',
+    })).resolves.toEqual({ type: 'oauth2', values: { ACCESS_TOKEN: 'other' } })
+  })
+
+  it('reads and deletes through this workspace secret id', async () => {
+    const stored = await putWorkspaceSecret({
+      workspaceId: 'ws-1',
+      integrationId: 'linkedin',
+      payload: { values: { ACCESS_TOKEN: 'tok' } },
+    })
+    const arn = 'arn:aws:secretsmanager:eu-north-1:111122223333:secret:ossybot/workspaces/ws-1/integrations/linkedin-a1B2c3'
+
+    await expect(getWorkspaceSecret({
+      workspaceId: 'ws-1',
+      integrationId: 'linkedin',
+      secretArn: stored.secretArn,
+    })).resolves.toEqual({ type: 'oauth2', values: { ACCESS_TOKEN: 'tok' } })
+    await expect(getWorkspaceSecret({
+      workspaceId: 'ws-1',
+      integrationId: 'linkedin',
+      secretArn: arn,
+    })).resolves.toEqual({ type: 'oauth2', values: { ACCESS_TOKEN: 'tok' } })
+    await deleteWorkspaceSecret({
+      workspaceId: 'ws-1',
+      integrationId: 'linkedin',
+      secretArn: arn,
+    })
+    await expect(getWorkspaceSecret({
+      workspaceId: 'ws-1',
+      integrationId: 'linkedin',
+    })).rejects.toMatchObject({ code: 'INTEGRATION_SECRET_NOT_FOUND' })
+  })
+
+  it('rejects a secret id from another workspace', async () => {
+    await putWorkspaceSecret({
+      workspaceId: 'ws-1',
+      integrationId: 'linkedin',
+      payload: { values: { ACCESS_TOKEN: 'tok' } },
+    })
+    await putWorkspaceSecret({
+      workspaceId: 'ws-2',
+      integrationId: 'linkedin',
+      payload: { values: { ACCESS_TOKEN: 'other' } },
+    })
+    const otherArn = 'arn:aws:secretsmanager:eu-north-1:111122223333:secret:ossybot/workspaces/ws-2/integrations/linkedin-a1B2c3'
+
+    await expect(getWorkspaceSecret({
+      workspaceId: 'ws-1',
+      integrationId: 'linkedin',
+      secretArn: otherArn,
+    })).rejects.toMatchObject({ status: 403, code: 'CROSS_TENANT_SECRET' })
+    await expect(getWorkspaceSecret({
+      workspaceId: 'ws-1',
+      integrationId: 'linkedin',
+      secretArn: workspaceSecretName('ws-2', 'linkedin'),
+    })).rejects.toMatchObject({ code: 'CROSS_TENANT_SECRET' })
+    await expect(getWorkspaceSecret({
+      workspaceId: 'ws-1',
+      integrationId: 'linkedin',
+      secretArn: 'ossybot/workspaces/ws-1-evil/integrations/linkedin',
+    })).rejects.toMatchObject({ code: 'CROSS_TENANT_SECRET' })
+    await expect(deleteWorkspaceSecret({
+      workspaceId: 'ws-1',
+      integrationId: 'linkedin',
+      secretArn: otherArn,
+    })).rejects.toMatchObject({ code: 'CROSS_TENANT_SECRET' })
+    await expect(getWorkspaceSecret({
+      workspaceId: 'ws-2',
+      integrationId: 'linkedin',
+    })).resolves.toEqual({ type: 'oauth2', values: { ACCESS_TOKEN: 'other' } })
+    await expect(listWorkspaceIntegrationIds('ws-1/../ws-2')).rejects.toMatchObject({
+      code: 'CROSS_TENANT_SECRET',
+    })
+  })
+
+  it('deletes secrets', async () => {
+    await putWorkspaceSecret({
+      workspaceId: 'ws-1',
+      integrationId: 'x-primary',
+      payload: { values: { ACCESS_TOKEN: 'x' } },
+    })
+    await deleteWorkspaceSecret({ workspaceId: 'ws-1', integrationId: 'x-primary' })
+    await expect(getWorkspaceSecret({
+      workspaceId: 'ws-1',
+      integrationId: 'x-primary',
+    })).rejects.toMatchObject({ code: 'INTEGRATION_SECRET_NOT_FOUND' })
+  })
+})