@peanut-admin/admin 0.1.0-alpha.2

package/integration-security/src/IntegrationSecurityPage.vue

@@ -0,0 +1,402 @@
+<script setup lang="ts">
+import { computed, onMounted, reactive, ref } from 'vue'
+import { useIntegrationSecurityRuntime } from './runtime'
+
+const runtime = useIntegrationSecurityRuntime()
+const machineDialog = ref(false); const webhookDialog = ref(false); const attemptDialog = ref(false)
+const machineForm = reactive({ name: '', scopes: '', expiresAt: '' })
+const webhookForm = reactive({ name: '', url: '', events: '' })
+const activeMachines = computed(() => runtime.state.machines.items.filter(item => item.status === 'active').length)
+const activeWebhooks = computed(() => runtime.state.webhooks.items.filter(item => item.status === 'active').length)
+const csv = (value: string) => [...new Set(value.split(',').map(item => item.trim()).filter(Boolean))]
+const createMachine = async () => { await runtime.createMachine({ name: machineForm.name, scopes: csv(machineForm.scopes), expires_at: machineForm.expiresAt || null }); if (runtime.state.machines.error === null) machineDialog.value = false }
+const createWebhook = async () => { await runtime.createWebhook({ name: webhookForm.name, url: webhookForm.url, events: csv(webhookForm.events) }); if (runtime.state.webhooks.error === null) webhookDialog.value = false }
+const showAttempts = async (deliveryKey: string) => { attemptDialog.value = true; await runtime.loadAttempts(deliveryKey) }
+onMounted(runtime.load)
+</script>
+
+<template>
+  <main class="integration-security-page">
+    <header class="page-header">
+      <div><h1>Integration security</h1><p>Machine credentials, outbound endpoints, delivery evidence, and signed-in devices</p></div>
+      <el-button @click="runtime.load">
+        Refresh
+      </el-button>
+    </header>
+    <el-alert
+      v-if="runtime.state.disclosure"
+      type="warning"
+      :closable="false"
+      show-icon
+    >
+      <template #title>
+        Store this {{ runtime.state.disclosure.kind === 'machine-token' ? 'token' : 'secret' }} now. It will not be shown again.
+      </template>
+      <code class="disclosure">{{ runtime.state.disclosure.value }}</code>
+      <el-button
+        text
+        @click="runtime.clearDisclosure"
+      >
+        Dismiss
+      </el-button>
+    </el-alert>
+    <section
+      class="summary"
+      aria-label="Security summary"
+    >
+      <div><strong>{{ activeMachines }}</strong><span>Active machines</span></div>
+      <div><strong>{{ activeWebhooks }}</strong><span>Active webhooks</span></div>
+      <div><strong>{{ runtime.state.deliveries.total }}</strong><span>Webhook deliveries</span></div>
+      <div><strong>{{ runtime.state.sessions.items.length }}</strong><span>Signed-in devices</span></div>
+    </section>
+
+    <section>
+      <div class="section-header">
+        <h2>Machine identities</h2><el-button
+          v-if="runtime.can.canManageMachines()"
+          @click="machineDialog = true"
+        >
+          Create
+        </el-button>
+      </div>
+      <el-alert
+        v-if="runtime.state.machines.error"
+        type="error"
+        :title="runtime.state.machines.error.message"
+        :closable="false"
+      />
+      <el-table
+        v-loading="runtime.state.machines.loading"
+        :data="runtime.state.machines.items"
+        empty-text="No machine identities"
+      >
+        <el-table-column
+          prop="name"
+          label="Name"
+          min-width="180"
+        /><el-table-column
+          prop="status"
+          label="Status"
+          width="120"
+        />
+        <el-table-column
+          label="Token"
+          min-width="180"
+        >
+          <template #default="{ row }">
+            {{ row.tokenPrefix }}...{{ row.tokenLastFour }}
+          </template>
+        </el-table-column>
+        <el-table-column
+          label="Scopes"
+          min-width="240"
+        >
+          <template #default="{ row }">
+            {{ row.scopes.join(', ') }}
+          </template>
+        </el-table-column>
+        <el-table-column
+          v-if="runtime.can.canManageMachines()"
+          label=""
+          width="170"
+          align="right"
+        >
+          <template #default="{ row }">
+            <el-button
+              text
+              :disabled="row.status !== 'active' || runtime.state.mutating"
+              @click="runtime.rotateMachine(row)"
+            >
+              Rotate
+            </el-button><el-button
+              text
+              type="danger"
+              :disabled="row.status !== 'active' || runtime.state.mutating"
+              @click="runtime.revokeMachine(row)"
+            >
+              Revoke
+            </el-button>
+          </template>
+        </el-table-column>
+      </el-table>
+    </section>
+
+    <section>
+      <div class="section-header">
+        <h2>Webhook endpoints</h2><el-button
+          v-if="runtime.can.canManageWebhooks()"
+          @click="webhookDialog = true"
+        >
+          Create
+        </el-button>
+      </div>
+      <el-alert
+        v-if="runtime.state.webhooks.error"
+        type="error"
+        :title="runtime.state.webhooks.error.message"
+        :closable="false"
+      />
+      <el-table
+        v-loading="runtime.state.webhooks.loading"
+        :data="runtime.state.webhooks.items"
+        empty-text="No webhook endpoints"
+      >
+        <el-table-column
+          prop="name"
+          label="Name"
+          min-width="160"
+        /><el-table-column
+          prop="url"
+          label="HTTPS destination"
+          min-width="280"
+          show-overflow-tooltip
+        />
+        <el-table-column
+          prop="status"
+          label="Status"
+          width="120"
+        /><el-table-column
+          label="Events"
+          min-width="220"
+        >
+          <template #default="{ row }">
+            {{ row.events.join(', ') }}
+          </template>
+        </el-table-column>
+        <el-table-column
+          v-if="runtime.can.canManageWebhooks()"
+          label=""
+          width="180"
+          align="right"
+        >
+          <template #default="{ row }">
+            <el-button
+              text
+              :disabled="row.status !== 'active' || runtime.state.mutating"
+              @click="runtime.rotateWebhook(row)"
+            >
+              Rotate secret
+            </el-button><el-button
+              text
+              type="danger"
+              :disabled="row.status !== 'active' || runtime.state.mutating"
+              @click="runtime.disableWebhook(row)"
+            >
+              Disable
+            </el-button>
+          </template>
+        </el-table-column>
+      </el-table>
+    </section>
+
+    <section>
+      <h2>Webhook deliveries</h2>
+      <el-alert
+        v-if="runtime.state.deliveries.error"
+        type="error"
+        :title="runtime.state.deliveries.error.message"
+        :closable="false"
+      />
+      <el-table
+        v-loading="runtime.state.deliveries.loading"
+        :data="runtime.state.deliveries.items"
+        empty-text="No webhook deliveries"
+      >
+        <el-table-column
+          prop="eventType"
+          label="Event"
+          min-width="180"
+        /><el-table-column
+          prop="status"
+          label="Status"
+          width="150"
+        />
+        <el-table-column
+          prop="attemptCount"
+          label="Attempts"
+          width="100"
+        /><el-table-column
+          prop="lastStatusCode"
+          label="HTTP"
+          width="90"
+        />
+        <el-table-column
+          prop="lastErrorCode"
+          label="Result"
+          min-width="190"
+        /><el-table-column
+          label=""
+          width="100"
+          align="right"
+        >
+          <template #default="{ row }">
+            <el-button
+              text
+              @click="showAttempts(row.deliveryKey)"
+            >
+              Attempts
+            </el-button>
+          </template>
+        </el-table-column>
+      </el-table>
+      <el-pagination
+        v-if="runtime.state.deliveries.total > runtime.state.deliveries.pageSize"
+        layout="prev, pager, next"
+        :page-size="runtime.state.deliveries.pageSize"
+        :total="runtime.state.deliveries.total"
+        :current-page="runtime.state.deliveries.page"
+        @current-change="runtime.loadDeliveries"
+      />
+    </section>
+
+    <section>
+      <h2>Signed-in devices</h2>
+      <el-alert
+        v-if="runtime.state.sessions.error"
+        type="error"
+        :title="runtime.state.sessions.error.message"
+        :closable="false"
+      />
+      <el-table
+        v-loading="runtime.state.sessions.loading"
+        :data="runtime.state.sessions.items"
+        empty-text="No sessions"
+      >
+        <el-table-column
+          label="Device"
+          min-width="180"
+        >
+          <template #default="{ row }">
+            {{ row.clientKey }}<span v-if="row.current"> (current)</span>
+          </template>
+        </el-table-column>
+        <el-table-column
+          prop="maskedIp"
+          label="Network"
+          min-width="140"
+        /><el-table-column
+          prop="lastSeenAt"
+          label="Last seen"
+          min-width="190"
+        />
+        <el-table-column
+          v-if="runtime.can.canRevokeSession()"
+          label=""
+          width="112"
+          align="right"
+        >
+          <template #default="{ row }">
+            <el-button
+              text
+              :disabled="row.status !== 'active' || runtime.state.mutating"
+              @click="runtime.revokeSession(row)"
+            >
+              Revoke
+            </el-button>
+          </template>
+        </el-table-column>
+      </el-table>
+    </section>
+
+    <el-dialog
+      v-model="machineDialog"
+      title="Create machine identity"
+      width="min(520px, 92vw)"
+    >
+      <el-form label-position="top">
+        <el-form-item label="Name">
+          <el-input v-model="machineForm.name" />
+        </el-form-item><el-form-item label="Scopes">
+          <el-input
+            v-model="machineForm.scopes"
+            placeholder="webhook.publish, data.export.read"
+          />
+        </el-form-item><el-form-item label="Expires at">
+          <el-input
+            v-model="machineForm.expiresAt"
+            placeholder="2030-01-01T00:00:00.000Z"
+          />
+        </el-form-item>
+      </el-form><template #footer>
+        <el-button @click="machineDialog = false">
+          Cancel
+        </el-button><el-button
+          type="primary"
+          :loading="runtime.state.mutating"
+          @click="createMachine"
+        >
+          Create
+        </el-button>
+      </template>
+    </el-dialog>
+    <el-dialog
+      v-model="webhookDialog"
+      title="Create webhook endpoint"
+      width="min(520px, 92vw)"
+    >
+      <el-form label-position="top">
+        <el-form-item label="Name">
+          <el-input v-model="webhookForm.name" />
+        </el-form-item><el-form-item label="HTTPS URL">
+          <el-input v-model="webhookForm.url" />
+        </el-form-item><el-form-item label="Events">
+          <el-input
+            v-model="webhookForm.events"
+            placeholder="audit.event.created"
+          />
+        </el-form-item>
+      </el-form><template #footer>
+        <el-button @click="webhookDialog = false">
+          Cancel
+        </el-button><el-button
+          type="primary"
+          :loading="runtime.state.mutating"
+          @click="createWebhook"
+        >
+          Create
+        </el-button>
+      </template>
+    </el-dialog>
+    <el-dialog
+      v-model="attemptDialog"
+      title="Delivery attempts"
+      width="min(720px, 94vw)"
+    >
+      <el-alert
+        v-if="runtime.state.attempts.error"
+        type="error"
+        :title="runtime.state.attempts.error.message"
+        :closable="false"
+      /><el-table
+        v-loading="runtime.state.attempts.loading"
+        :data="runtime.state.attempts.items"
+      >
+        <el-table-column
+          prop="attemptNumber"
+          label="#"
+          width="64"
+        /><el-table-column
+          prop="outcome"
+          label="Outcome"
+          min-width="150"
+        /><el-table-column
+          prop="responseStatus"
+          label="HTTP"
+          width="90"
+        /><el-table-column
+          prop="errorCode"
+          label="Result"
+          min-width="190"
+        /><el-table-column
+          prop="durationMs"
+          label="ms"
+          width="90"
+        />
+      </el-table>
+    </el-dialog>
+  </main>
+</template>
+
+<style scoped>
+.integration-security-page{display:grid;gap:24px;max-width:1280px;margin:0 auto;padding:24px}.page-header,.section-header{display:flex;align-items:flex-start;justify-content:space-between;gap:16px}.page-header h1,.section-header h2{margin:0}.page-header h1{font-size:24px}.page-header p{margin:6px 0 0;color:var(--el-text-color-secondary)}.summary{display:grid;grid-template-columns:repeat(4,minmax(0,1fr));border:1px solid var(--el-border-color);border-radius:6px}.summary div{display:grid;gap:4px;padding:16px;border-right:1px solid var(--el-border-color)}.summary div:last-child{border-right:0}.summary strong{font-size:20px}.summary span{color:var(--el-text-color-secondary)}section h2{font-size:16px;margin:0 0 12px}.disclosure{display:block;overflow-wrap:anywhere;margin-top:8px}@media(max-width:720px){.integration-security-page{padding:16px}.summary{grid-template-columns:1fr}.summary div{border-right:0;border-bottom:1px solid var(--el-border-color)}.summary div:last-child{border-bottom:0}}
+</style>

package/integration-security/src/contracts.ts

@@ -0,0 +1,171 @@
+export type MachineStatus = 'active' | 'rotated' | 'revoked'
+export type WebhookStatus = 'active' | 'disabled'
+export type DeliveryStatus = 'pending' | 'delivering' | 'retryable' | 'delivered' | 'permanent_failed'
+
+export interface MachineIdentity {
+  readonly identityKey: string; readonly name: string; readonly scopes: readonly string[]
+  readonly status: MachineStatus; readonly tokenPrefix: string; readonly tokenLastFour: string
+  readonly expiresAt: string | null; readonly lastUsedAt: string | null; readonly revision: number; readonly createdAt: string
+}
+export interface ProvisionedMachineIdentity { readonly identity: MachineIdentity; readonly token: string }
+export interface WebhookEndpoint {
+  readonly endpointKey: string; readonly name: string; readonly url: string; readonly events: readonly string[]
+  readonly status: WebhookStatus; readonly revision: number; readonly createdAt: string
+}
+export interface ProvisionedWebhookEndpoint { readonly endpoint: WebhookEndpoint; readonly signingSecret: string }
+export interface WebhookDeliveryRecord {
+  readonly deliveryKey: string; readonly endpointKey: string; readonly eventType: string; readonly status: DeliveryStatus
+  readonly attemptCount: number; readonly lastStatusCode: number | null; readonly lastErrorCode: string | null
+  readonly createdAt: string; readonly updatedAt: string; readonly deliveredAt: string | null
+}
+export interface WebhookAttemptRecord {
+  readonly attemptNumber: number; readonly outcome: 'retryable' | 'delivered' | 'permanent_failed'
+  readonly responseStatus: number | null; readonly errorCode: string | null; readonly durationMs: number; readonly attemptedAt: string
+}
+export interface SessionDevice {
+  readonly sessionKey: string; readonly clientKey: string; readonly status: 'active' | 'revoked' | 'expired'
+  readonly current: boolean; readonly maskedIp: string | null; readonly userAgentFingerprint: string | null
+  readonly issuedAt: string; readonly lastSeenAt: string; readonly absoluteExpiresAt: string; readonly revokedAt: string | null
+}
+export interface Page<T> { readonly items: T[]; readonly page: number; readonly pageSize: number; readonly total: number }
+export interface TransportResult { readonly body: unknown; readonly headers: Headers; readonly status: number }
+export interface IntegrationSecurityTransport {
+  machines: (signal: AbortSignal) => Promise<TransportResult>
+  createMachine: (input: { name: string; scopes: string[]; expires_at: string | null }, signal: AbortSignal) => Promise<TransportResult>
+  rotateMachine: (identityKey: string, revision: number, signal: AbortSignal) => Promise<TransportResult>
+  revokeMachine: (identityKey: string, revision: number, signal: AbortSignal) => Promise<TransportResult>
+  webhooks: (signal: AbortSignal) => Promise<TransportResult>
+  createWebhook: (input: { name: string; url: string; events: string[] }, signal: AbortSignal) => Promise<TransportResult>
+  rotateWebhook: (endpointKey: string, revision: number, signal: AbortSignal) => Promise<TransportResult>
+  disableWebhook: (endpointKey: string, revision: number, signal: AbortSignal) => Promise<TransportResult>
+  deliveries: (page: number, pageSize: number, signal: AbortSignal) => Promise<TransportResult>
+  deliveryAttempts: (deliveryKey: string, page: number, pageSize: number, signal: AbortSignal) => Promise<TransportResult>
+  sessions: (signal: AbortSignal) => Promise<TransportResult>
+  revokeSession: (sessionKey: string, signal: AbortSignal) => Promise<TransportResult>
+}
+
+const record = (value: unknown): Record<string, unknown> => {
+  if (typeof value !== 'object' || value === null || Array.isArray(value)) throw new Error('INTEGRATION_RESPONSE_INVALID')
+  return value as Record<string, unknown>
+}
+const exact = (value: Record<string, unknown>, keys: readonly string[]): void => {
+  const actual = Object.keys(value).sort(); const expected = [...keys].sort()
+  if (actual.length !== expected.length || actual.some((key, index) => key !== expected[index])) throw new Error('INTEGRATION_RESPONSE_INVALID')
+}
+const instant = (value: unknown): value is string => typeof value === 'string'
+  && /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(value) && Number.isFinite(Date.parse(value))
+const qualified = /^[a-z][a-z0-9]*(?:[.-][a-z0-9]+)+$/
+const requestId = (value: unknown): value is string => typeof value === 'string' && /^[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$/.test(value)
+const statusCode = (value: unknown): value is number => typeof value === 'number' && Number.isSafeInteger(value) && value >= 100 && value <= 599
+const safeCode = (value: unknown): value is string => typeof value === 'string' && /^[A-Z][A-Z0-9_]{2,63}$/.test(value)
+
+export const parseMachine = (value: unknown): MachineIdentity => {
+  const item = record(value)
+  const scopes = item.scopes
+  exact(item, ['identity_key', 'name', 'scopes', 'status', 'token_prefix', 'token_last_four', 'expires_at', 'last_used_at', 'revision', 'created_at'])
+  if (typeof item.identity_key !== 'string' || !/^machine_[0-9a-f]{32}$/.test(item.identity_key)
+    || typeof item.name !== 'string' || item.name === '' || [...item.name].length > 120
+    || !Array.isArray(scopes) || scopes.length < 1 || scopes.length > 32 || scopes.some(scope => typeof scope !== 'string' || !qualified.test(scope))
+    || new Set(scopes).size !== scopes.length || [...scopes].sort().some((scope, index) => scope !== scopes[index])
+    || !['active', 'rotated', 'revoked'].includes(String(item.status))
+    || typeof item.token_prefix !== 'string' || !item.token_prefix.startsWith('pa_mi_')
+    || typeof item.token_last_four !== 'string' || !/^[A-Za-z0-9_-]{4}$/.test(item.token_last_four)
+    || (item.expires_at !== null && !instant(item.expires_at)) || (item.last_used_at !== null && !instant(item.last_used_at))
+    || typeof item.revision !== 'number' || !Number.isSafeInteger(item.revision) || item.revision < 1 || !instant(item.created_at)
+  ) throw new Error('INTEGRATION_RESPONSE_INVALID')
+  return { identityKey: item.identity_key, name: item.name, scopes: scopes as string[], status: item.status as MachineStatus, tokenPrefix: item.token_prefix, tokenLastFour: item.token_last_four, expiresAt: item.expires_at as string | null, lastUsedAt: item.last_used_at as string | null, revision: item.revision, createdAt: item.created_at }
+}
+export const parseProvisionedMachine = (value: unknown): ProvisionedMachineIdentity => {
+  const item = record(value); exact(item, ['identity', 'token'])
+  if (typeof item.token !== 'string' || !/^pa_mi_[A-Za-z0-9_-]{43}$/.test(item.token)) throw new Error('INTEGRATION_RESPONSE_INVALID')
+  return { identity: parseMachine(item.identity), token: item.token }
+}
+export const parseWebhook = (value: unknown): WebhookEndpoint => {
+  const item = record(value)
+  exact(item, ['endpoint_key', 'name', 'url', 'events', 'status', 'revision', 'created_at'])
+  if (typeof item.endpoint_key !== 'string' || !/^webhook_[0-9a-f]{32}$/.test(item.endpoint_key)
+    || typeof item.name !== 'string' || item.name === '' || [...item.name].length > 120
+    || typeof item.url !== 'string' || !item.url.startsWith('https://') || item.url.length > 2048
+    || !Array.isArray(item.events) || item.events.length < 1 || item.events.length > 32 || item.events.some(event => typeof event !== 'string' || !qualified.test(event))
+    || new Set(item.events).size !== item.events.length || !['active', 'disabled'].includes(String(item.status))
+    || typeof item.revision !== 'number' || !Number.isSafeInteger(item.revision) || item.revision < 1 || !instant(item.created_at)
+  ) throw new Error('INTEGRATION_RESPONSE_INVALID')
+  return { endpointKey: item.endpoint_key, name: item.name, url: item.url, events: item.events as string[], status: item.status as WebhookStatus, revision: item.revision, createdAt: item.created_at }
+}
+export const parseProvisionedWebhook = (value: unknown): ProvisionedWebhookEndpoint => {
+  const item = record(value); exact(item, ['endpoint', 'signing_secret'])
+  if (typeof item.signing_secret !== 'string' || !/^whsec_[A-Za-z0-9_-]{43}$/.test(item.signing_secret)) throw new Error('INTEGRATION_RESPONSE_INVALID')
+  return { endpoint: parseWebhook(item.endpoint), signingSecret: item.signing_secret }
+}
+export const parseDelivery = (value: unknown): WebhookDeliveryRecord => {
+  const item = record(value)
+  exact(item, ['delivery_key', 'endpoint_key', 'event_type', 'status', 'attempt_count', 'last_status_code', 'last_error_code', 'created_at', 'updated_at', 'delivered_at'])
+  if (typeof item.delivery_key !== 'string' || !/^delivery_[0-9a-f]{32}$/.test(item.delivery_key)
+    || typeof item.endpoint_key !== 'string' || !/^webhook_[0-9a-f]{32}$/.test(item.endpoint_key)
+    || typeof item.event_type !== 'string' || !qualified.test(item.event_type)
+    || !['pending', 'delivering', 'retryable', 'delivered', 'permanent_failed'].includes(String(item.status))
+    || typeof item.attempt_count !== 'number' || !Number.isSafeInteger(item.attempt_count) || item.attempt_count < 0 || item.attempt_count > 8
+    || (item.last_status_code !== null && !statusCode(item.last_status_code)) || (item.last_error_code !== null && !safeCode(item.last_error_code))
+    || !instant(item.created_at) || !instant(item.updated_at) || (item.delivered_at !== null && !instant(item.delivered_at))) throw new Error('INTEGRATION_RESPONSE_INVALID')
+  return { deliveryKey: item.delivery_key, endpointKey: item.endpoint_key, eventType: item.event_type, status: item.status as DeliveryStatus, attemptCount: item.attempt_count, lastStatusCode: item.last_status_code as number | null, lastErrorCode: item.last_error_code as string | null, createdAt: item.created_at, updatedAt: item.updated_at, deliveredAt: item.delivered_at as string | null }
+}
+export const parseAttempt = (value: unknown): WebhookAttemptRecord => {
+  const item = record(value); exact(item, ['attempt_number', 'outcome', 'response_status', 'error_code', 'duration_ms', 'attempted_at'])
+  if (typeof item.attempt_number !== 'number' || !Number.isSafeInteger(item.attempt_number) || item.attempt_number < 1 || item.attempt_number > 8
+    || !['retryable', 'delivered', 'permanent_failed'].includes(String(item.outcome))
+    || (item.response_status !== null && !statusCode(item.response_status)) || (item.error_code !== null && !safeCode(item.error_code))
+    || typeof item.duration_ms !== 'number' || !Number.isSafeInteger(item.duration_ms) || item.duration_ms < 0 || item.duration_ms > 30000 || !instant(item.attempted_at)) throw new Error('INTEGRATION_RESPONSE_INVALID')
+  return { attemptNumber: item.attempt_number, outcome: item.outcome as WebhookAttemptRecord['outcome'], responseStatus: item.response_status as number | null, errorCode: item.error_code as string | null, durationMs: item.duration_ms, attemptedAt: item.attempted_at }
+}
+export const parseSession = (value: unknown): SessionDevice => {
+  const item = record(value)
+  exact(item, ['session_key', 'client_key', 'status', 'current', 'masked_ip', 'user_agent_fingerprint', 'issued_at', 'last_seen_at', 'absolute_expires_at', 'revoked_at'])
+  if (typeof item.session_key !== 'string' || !/^[0-9A-HJKMNP-TV-Z]{26}$/.test(item.session_key) || item.client_key !== 'admin-web'
+    || !['active', 'revoked', 'expired'].includes(String(item.status)) || typeof item.current !== 'boolean'
+    || (item.masked_ip !== null && (typeof item.masked_ip !== 'string' || item.masked_ip.length > 45))
+    || (item.user_agent_fingerprint !== null && (typeof item.user_agent_fingerprint !== 'string' || !/^[0-9a-f]{12}$/.test(item.user_agent_fingerprint)))
+    || !instant(item.issued_at) || !instant(item.last_seen_at) || !instant(item.absolute_expires_at) || (item.revoked_at !== null && !instant(item.revoked_at))) throw new Error('INTEGRATION_RESPONSE_INVALID')
+  return { sessionKey: item.session_key, clientKey: item.client_key, status: item.status as SessionDevice['status'], current: item.current, maskedIp: item.masked_ip as string | null, userAgentFingerprint: item.user_agent_fingerprint as string | null, issuedAt: item.issued_at, lastSeenAt: item.last_seen_at, absoluteExpiresAt: item.absolute_expires_at, revokedAt: item.revoked_at as string | null }
+}
+export const parseList = <T>(value: unknown, parser: (item: unknown) => T): T[] => {
+  const body = record(value); exact(body, ['data', 'meta']); const data = record(body.data); const meta = record(body.meta)
+  exact(data, ['items']); exact(meta, ['request_id'])
+  if (!Array.isArray(data.items) || !requestId(meta.request_id)) throw new Error('INTEGRATION_RESPONSE_INVALID')
+  return data.items.map(parser)
+}
+export const parseItem = <T>(value: unknown, parser: (item: unknown) => T): T => {
+  const body = record(value); exact(body, ['data', 'meta']); const meta = record(body.meta); exact(meta, ['request_id'])
+  if (!requestId(meta.request_id)) throw new Error('INTEGRATION_RESPONSE_INVALID')
+  return parser(body.data)
+}
+export const parsePage = <T>(value: unknown, parser: (item: unknown) => T): Page<T> => {
+  const body = record(value); exact(body, ['data', 'meta']); const data = record(body.data); const meta = record(body.meta)
+  exact(data, ['items', 'page', 'page_size', 'total']); exact(meta, ['request_id'])
+  if (!Array.isArray(data.items) || !requestId(meta.request_id) || typeof data.page !== 'number' || !Number.isSafeInteger(data.page) || data.page < 1
+    || typeof data.page_size !== 'number' || !Number.isSafeInteger(data.page_size) || data.page_size < 1 || data.page_size > 100
+    || typeof data.total !== 'number' || !Number.isSafeInteger(data.total) || data.total < 0) throw new Error('INTEGRATION_RESPONSE_INVALID')
+  return { items: data.items.map(parser), page: data.page, pageSize: data.page_size, total: data.total }
+}
+const json = (value: unknown): string => JSON.stringify(value)
+export const createIntegrationSecurityFetchTransport = (options: { readonly baseUrl: string; readonly fetch?: (request: Request) => Promise<Response> }): IntegrationSecurityTransport => {
+  const fetcher = options.fetch ?? fetch
+  const request = async (path: string, init: RequestInit): Promise<TransportResult> => {
+    const response = await fetcher(new Request(new URL(path, options.baseUrl), { credentials: 'include', ...init, headers: { Accept: 'application/json', ...init.headers } }))
+    return { body: await response.json(), headers: response.headers, status: response.status }
+  }
+  const write = (path: string, method: string, body: unknown, signal: AbortSignal) => request(path, { method, body: json(body), headers: { 'Content-Type': 'application/json' }, signal })
+  return {
+    machines: signal => request('/api/v1/integration-security/machine-identities', { method: 'GET', signal }),
+    createMachine: (input, signal) => write('/api/v1/integration-security/machine-identities', 'POST', input, signal),
+    rotateMachine: (key, revision, signal) => write(`/api/v1/integration-security/machine-identities/${encodeURIComponent(key)}/rotate`, 'POST', { revision }, signal),
+    revokeMachine: (key, revision, signal) => write(`/api/v1/integration-security/machine-identities/${encodeURIComponent(key)}`, 'DELETE', { revision }, signal),
+    webhooks: signal => request('/api/v1/integration-security/webhooks', { method: 'GET', signal }),
+    createWebhook: (input, signal) => write('/api/v1/integration-security/webhooks', 'POST', input, signal),
+    rotateWebhook: (key, revision, signal) => write(`/api/v1/integration-security/webhooks/${encodeURIComponent(key)}/rotate-secret`, 'POST', { revision }, signal),
+    disableWebhook: (key, revision, signal) => write(`/api/v1/integration-security/webhooks/${encodeURIComponent(key)}`, 'DELETE', { revision }, signal),
+    deliveries: (page, pageSize, signal) => request(`/api/v1/integration-security/deliveries?page=${page}&page_size=${pageSize}`, { method: 'GET', signal }),
+    deliveryAttempts: (key, page, pageSize, signal) => request(`/api/v1/integration-security/deliveries/${encodeURIComponent(key)}/attempts?page=${page}&page_size=${pageSize}`, { method: 'GET', signal }),
+    sessions: signal => request('/api/v1/integration-security/sessions', { method: 'GET', signal }),
+    revokeSession: (key, signal) => write(`/api/v1/integration-security/sessions/${encodeURIComponent(key)}/revoke`, 'POST', {}, signal),
+  }
+}

package/integration-security/src/index.ts

@@ -0,0 +1,3 @@
+export * from './contracts'
+export * from './runtime'
+export { default as IntegrationSecurityPage } from './IntegrationSecurityPage.vue'