@vibesdotdev/integrations 0.0.0-stage → 1.0.0-rc.2

package/dist/schemas/credential-resolution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-resolution.d.ts","sourceRoot":"","sources":["../../src/schemas/credential-resolution.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAOpE,eAAO,MAAM,uBAAuB;;kBAIzB,CAAC;AACZ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,iBAAiB;;;;;gCAAmD,CAAC;AAClF,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;KAGtC,CAAC"}

package/dist/schemas/credential-resolution.js

@@ -0,0 +1,14 @@
+import * as z from 'zod/v4';
+import { CredentialReferenceSchema } from '@vibesdotdev/kernel/credentials';
+const CredentialResolverRuntimeSchema = z.object({
+    resolveCredential: z.function()
+}).passthrough();
+export const ResolutionOptionsSchema = z.object({
+    runtime: z.custom((value) => CredentialResolverRuntimeSchema.safeParse(value).success)
+}).strict();
+export const ConfigValueSchema = z.union([z.string(), CredentialReferenceSchema]);
+export const ResolvableConfigValueSchema = z.union([
+    z.string().transform((value) => ({ kind: 'inline', value })),
+    CredentialReferenceSchema.transform((reference) => ({ kind: 'reference', reference }))
+]);
+//# sourceMappingURL=credential-resolution.js.map

package/dist/schemas/credential-resolution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-resolution.js","sourceRoot":"","sources":["../../src/schemas/credential-resolution.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAE5E,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,iBAAiB,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC,WAAW,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,OAAO,EAAE,CAAC,CAAC,MAAM,CAAe,CAAC,KAAK,EAAE,EAAE,CACzC,+BAA+B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CACxD;CACD,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC,CAAC;AAClF,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC;IAClD,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAiB,EAAE,KAAK,EAAE,CAAC,CAAC;IACrE,yBAAyB,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,WAAoB,EAAE,SAAS,EAAE,CAAC,CAAC;CAC/F,CAAC,CAAC"}

package/dist/schemas/http-retry.d.ts

@@ -0,0 +1,9 @@
+import * as z from 'zod/v4';
+export declare const RetryOptionsSchema: z.ZodObject<{
+    maxAttempts: z.ZodDefault<z.ZodNumber>;
+    baseDelayMs: z.ZodDefault<z.ZodNumber>;
+    maxDelayMs: z.ZodDefault<z.ZodNumber>;
+    retryStatuses: z.ZodDefault<z.ZodArray<z.ZodNumber>>;
+}, z.core.$strip>;
+export type RetryOptions = z.input<typeof RetryOptionsSchema>;
+//# sourceMappingURL=http-retry.d.ts.map

package/dist/schemas/http-retry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-retry.d.ts","sourceRoot":"","sources":["../../src/schemas/http-retry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,eAAO,MAAM,kBAAkB;;;;;iBAK7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC"}

package/dist/schemas/http-retry.js

@@ -0,0 +1,8 @@
+import * as z from 'zod/v4';
+export const RetryOptionsSchema = z.object({
+    maxAttempts: z.number().int().positive().default(4),
+    baseDelayMs: z.number().finite().nonnegative().default(250),
+    maxDelayMs: z.number().finite().nonnegative().default(8000),
+    retryStatuses: z.array(z.number().int().min(100).max(599)).default([429, 500, 502, 503, 504])
+});
+//# sourceMappingURL=http-retry.js.map

package/dist/schemas/http-retry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-retry.js","sourceRoot":"","sources":["../../src/schemas/http-retry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACnD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IAC3D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3D,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;CAC7F,CAAC,CAAC"}

package/dist/schemas/integration-connection.d.ts

@@ -0,0 +1,79 @@
+import * as z from 'zod/v4';
+/**
+ * How a provider authenticates, as the provider declares it. The vocabulary
+ * describes behavior; it never admits or excludes a provider by identity.
+ *
+ * - `'oauth'` — a platform-driven or manual connect flow produces a
+ *   tenant-scoped saved credential; "connected" is answerable for the caller.
+ * - `'delegated'` — the provider acts as the signed-in user through the
+ *   host's identity accounts; this package's credential store holds nothing.
+ * - `'system-config'` — only an operator with deploy/env access configures
+ *   it; no end-user action connects it.
+ * - `'webhook'` — delivery-oriented; no persistent connect relationship.
+ */
+export declare const IntegrationAuthModeSchema: z.ZodEnum<{
+    oauth: "oauth";
+    delegated: "delegated";
+    "system-config": "system-config";
+    webhook: "webhook";
+}>;
+export type IntegrationAuthMode = z.infer<typeof IntegrationAuthModeSchema>;
+/**
+ * Explicit authentication/connection metadata a provider descriptor declares.
+ * The provider descriptor composes this schema; nothing infers it from an id
+ * suffix, a provider admission list or a credential-value shape. A host
+ * reference credential alone never implies tenant connection support: only
+ * this declaration does.
+ */
+export declare const IntegrationConnectionMetadataSchema: z.ZodObject<{
+    authMode: z.ZodOptional<z.ZodEnum<{
+        oauth: "oauth";
+        delegated: "delegated";
+        "system-config": "system-config";
+        webhook: "webhook";
+    }>>;
+    connectable: z.ZodDefault<z.ZodBoolean>;
+    checkable: z.ZodDefault<z.ZodBoolean>;
+    requiresProviderAdmin: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+export type IntegrationConnectionMetadata = z.infer<typeof IntegrationConnectionMetadataSchema>;
+/** One provider's connection state, scoped to the calling user/org. */
+export declare const IntegrationConnectionStatusSchema: z.ZodObject<{
+    integrationId: z.ZodString;
+    authMode: z.ZodEnum<{
+        oauth: "oauth";
+        delegated: "delegated";
+        "system-config": "system-config";
+        webhook: "webhook";
+    }>;
+    connected: z.ZodBoolean;
+    connectionCount: z.ZodNumber;
+    canCheck: z.ZodBoolean;
+    requiresProviderAdmin: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export type IntegrationConnectionStatus = z.infer<typeof IntegrationConnectionStatusSchema>;
+/** A connection request the capability refuses; the code/reason are typed. */
+export declare const IntegrationConnectionRefusalSchema: z.ZodObject<{
+    refused: z.ZodLiteral<true>;
+    code: z.ZodEnum<{
+        UNAVAILABLE: "UNAVAILABLE";
+        PERMISSION_DENIED: "PERMISSION_DENIED";
+        INVALID_INPUT: "INVALID_INPUT";
+    }>;
+    reason: z.ZodString;
+}, z.core.$strip>;
+export type IntegrationConnectionRefusal = z.infer<typeof IntegrationConnectionRefusalSchema>;
+/** Outcome of a connect request: the host owns authorization and the flow. */
+export declare const IntegrationConnectRequestResultSchema: z.ZodUnion<readonly [z.ZodObject<{
+    accepted: z.ZodLiteral<true>;
+}, z.core.$strip>, z.ZodObject<{
+    refused: z.ZodLiteral<true>;
+    code: z.ZodEnum<{
+        UNAVAILABLE: "UNAVAILABLE";
+        PERMISSION_DENIED: "PERMISSION_DENIED";
+        INVALID_INPUT: "INVALID_INPUT";
+    }>;
+    reason: z.ZodString;
+}, z.core.$strip>]>;
+export type IntegrationConnectRequestResult = z.infer<typeof IntegrationConnectRequestResultSchema>;
+//# sourceMappingURL=integration-connection.d.ts.map

package/dist/schemas/integration-connection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration-connection.d.ts","sourceRoot":"","sources":["../../src/schemas/integration-connection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,yBAAyB;;;;;EAA6D,CAAC;AACpG,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;GAMG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;iBAS9C,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG,uEAAuE;AACvE,eAAO,MAAM,iCAAiC;;;;;;;;;;;;iBAU5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,8EAA8E;AAC9E,eAAO,MAAM,kCAAkC;;;;;;;;iBAI7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,8EAA8E;AAC9E,eAAO,MAAM,qCAAqC;;;;;;;;;;mBAGhD,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC"}

package/dist/schemas/integration-connection.js

@@ -0,0 +1,55 @@
+import * as z from 'zod/v4';
+/**
+ * How a provider authenticates, as the provider declares it. The vocabulary
+ * describes behavior; it never admits or excludes a provider by identity.
+ *
+ * - `'oauth'` — a platform-driven or manual connect flow produces a
+ *   tenant-scoped saved credential; "connected" is answerable for the caller.
+ * - `'delegated'` — the provider acts as the signed-in user through the
+ *   host's identity accounts; this package's credential store holds nothing.
+ * - `'system-config'` — only an operator with deploy/env access configures
+ *   it; no end-user action connects it.
+ * - `'webhook'` — delivery-oriented; no persistent connect relationship.
+ */
+export const IntegrationAuthModeSchema = z.enum(['oauth', 'delegated', 'system-config', 'webhook']);
+/**
+ * Explicit authentication/connection metadata a provider descriptor declares.
+ * The provider descriptor composes this schema; nothing infers it from an id
+ * suffix, a provider admission list or a credential-value shape. A host
+ * reference credential alone never implies tenant connection support: only
+ * this declaration does.
+ */
+export const IntegrationConnectionMetadataSchema = z.object({
+    /** How the provider authenticates. Absent means undeclared, not inferred. */
+    authMode: IntegrationAuthModeSchema.optional(),
+    /** The provider supports a tenant connect flow this host can drive. */
+    connectable: z.boolean().default(false),
+    /** A meaningful connected/not-connected answer exists for this provider. */
+    checkable: z.boolean().default(false),
+    /** Connecting requires organization-admin authority, not any member. */
+    requiresProviderAdmin: z.boolean().default(false)
+});
+/** One provider's connection state, scoped to the calling user/org. */
+export const IntegrationConnectionStatusSchema = z.object({
+    integrationId: z.string().min(1),
+    authMode: IntegrationAuthModeSchema,
+    /** True only when the CALLING user/org has a live connection. */
+    connected: z.boolean(),
+    /** Number of org/user-scoped credentials backing the connection. */
+    connectionCount: z.number().int().nonnegative(),
+    /** Whether a meaningful connected/not-connected answer exists at all. */
+    canCheck: z.boolean(),
+    requiresProviderAdmin: z.boolean().optional()
+});
+/** A connection request the capability refuses; the code/reason are typed. */
+export const IntegrationConnectionRefusalSchema = z.object({
+    refused: z.literal(true),
+    code: z.enum(['UNAVAILABLE', 'PERMISSION_DENIED', 'INVALID_INPUT']),
+    reason: z.string().min(1)
+});
+/** Outcome of a connect request: the host owns authorization and the flow. */
+export const IntegrationConnectRequestResultSchema = z.union([
+    z.object({ accepted: z.literal(true) }),
+    IntegrationConnectionRefusalSchema
+]);
+//# sourceMappingURL=integration-connection.js.map

package/dist/schemas/integration-connection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration-connection.js","sourceRoot":"","sources":["../../src/schemas/integration-connection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC,CAAC;AAGpG;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D,6EAA6E;IAC7E,QAAQ,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC9C,uEAAuE;IACvE,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC,4EAA4E;IAC5E,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACrC,wEAAwE;IACxE,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACjD,CAAC,CAAC;AAGH,uEAAuE;AACvE,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,QAAQ,EAAE,yBAAyB;IACnC,iEAAiE;IACjE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,oEAAoE;IACpE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC/C,yEAAyE;IACzE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAGH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,mBAAmB,EAAE,eAAe,CAAC,CAAC;IACnE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACzB,CAAC,CAAC;AAGH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC;IAC5D,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;IACvC,kCAAkC;CAClC,CAAC,CAAC"}

package/dist/schemas/integration-descriptor.d.ts

@@ -0,0 +1,358 @@
+import * as z from 'zod/v4';
+import { type CredentialCandidates } from '@vibesdotdev/secrets/schemas';
+export declare const IntegrationConfigValueSchema: z.ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>;
+export type IntegrationConfigValue = z.infer<typeof IntegrationConfigValueSchema>;
+export declare const IntegrationConfigSchema: z.ZodRecord<z.ZodString, z.ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>;
+export declare const IntegrationOperationInputSchema: z.ZodOptional<z.ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>;
+export declare const IntegrationCredentialKeySchema: z.ZodString;
+export declare const IntegrationCredentialReferenceCandidatesSchema: z.ZodArray<z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+    source: z.ZodLiteral<"secret">;
+    key: z.ZodString;
+    store: z.ZodOptional<z.ZodString>;
+    operation: z.ZodOptional<z.ZodCustom<object, object>>;
+}, z.core.$strict>], "source">, z.ZodObject<{
+    source: z.ZodLiteral<"oauth-account">;
+    providerId: z.ZodString;
+    token: z.ZodDefault<z.ZodEnum<{
+        accessToken: "accessToken";
+        refreshToken: "refreshToken";
+    }>>;
+}, z.core.$strict>]>>;
+export type IntegrationCredentialReferenceCandidates = CredentialCandidates;
+export declare const IntegrationCredentialSourceSchema: z.ZodObject<{
+    key: z.ZodString;
+    source: z.ZodEnum<{
+        secret: "secret";
+        setting: "setting";
+    }>;
+    reference: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        source: z.ZodLiteral<"secret">;
+        key: z.ZodString;
+        store: z.ZodOptional<z.ZodString>;
+        operation: z.ZodOptional<z.ZodCustom<object, object>>;
+    }, z.core.$strict>], "source">>;
+    providerType: z.ZodOptional<z.ZodString>;
+    scope: z.ZodOptional<z.ZodEnum<{
+        user: "user";
+        platform: "platform";
+        project: "project";
+        org: "org";
+    }>>;
+    scopeId: z.ZodOptional<z.ZodString>;
+    settingKey: z.ZodOptional<z.ZodString>;
+    required: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+/**
+ * OAuth 2.0 endpoint metadata. When present, the runtime's generic
+ * `/api/integrations/[id]/connect` + `/[id]/callback` routes can drive the
+ * authorization-code flow without provider-specific wiring. Per-provider
+ * quirks (e.g. QuickBooks `realmId`, Microsoft `tenant`) are forwarded
+ * through `IntegrationOAuthCompletion.params` and handled by the
+ * implementation override of `completeAuthorization`.
+ */
+export declare const IntegrationOAuthMetadataSchema: z.ZodObject<{
+    authorizationEndpoint: z.ZodURL;
+    tokenEndpoint: z.ZodURL;
+    scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    authorizationParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    configFromCallback: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    clientAuthentication: z.ZodDefault<z.ZodEnum<{
+        form: "form";
+        basic: "basic";
+    }>>;
+    bodyEncoding: z.ZodDefault<z.ZodEnum<{
+        json: "json";
+        form: "form";
+    }>>;
+    headers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    scopeIdCallbackParam: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * Declarative operation registry on an integration descriptor. Each
+ * operation is a named verb (e.g. `'sync'`, `'invalidate-cache'`) that the
+ * provider implementation handles via `invokeOperation(id, args)`. The
+ * runtime exposes operations through generic
+ * `POST /api/integrations/[id]/operations/[opId]` routes, so apps never
+ * need provider-specific endpoints.
+ */
+export declare const IntegrationOperationSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    requiresOrg: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+/**
+ * Functional category of an integration provider. Filters the catalog by
+ * the *kind of work* a provider does (email delivery vs accounting sync vs
+ * vcs hosting), independent of the vendor identity. Higher-level features
+ * (e.g. `packages/email`) query `integration/provider` by category to
+ * discover all eligible vendors at dispatch time.
+ *
+ * The enum is closed on purpose — vendors can't typo a category, and
+ * higher-level features can pattern-match exhaustively. Grow it as new
+ * categories appear in the codebase; passthrough strings are not allowed.
+ */
+export declare const IntegrationCategorySchema: z.ZodEnum<{
+    webhook: "webhook";
+    accounting: "accounting";
+    vcs: "vcs";
+    "issue-tracker": "issue-tracker";
+    productivity: "productivity";
+    ocr: "ocr";
+    email: "email";
+    messaging: "messaging";
+    sms: "sms";
+    push: "push";
+    storage: "storage";
+    analytics: "analytics";
+    observability: "observability";
+    crm: "crm";
+    calendar: "calendar";
+    other: "other";
+}>;
+export type IntegrationCategory = z.infer<typeof IntegrationCategorySchema>;
+export declare const IntegrationProviderDescriptorSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    hardware: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    capabilityId: z.ZodOptional<z.ZodString>;
+    retention: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        maxAgeDays: z.ZodOptional<z.ZodNumber>;
+        maxEntries: z.ZodOptional<z.ZodNumber>;
+        maxBytes: z.ZodOptional<z.ZodNumber>;
+        cascadeFrom: z.ZodOptional<z.ZodString>;
+        ageField: z.ZodOptional<z.ZodString>;
+        reason: z.ZodString;
+        enforcedBy: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>]>>;
+    kind: z.ZodLiteral<"integration/provider">;
+    requiredContext: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString>>>;
+    optionalContext: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString>>>;
+    provider: z.ZodDefault<z.ZodString>;
+    category: z.ZodDefault<z.ZodEnum<{
+        webhook: "webhook";
+        accounting: "accounting";
+        vcs: "vcs";
+        "issue-tracker": "issue-tracker";
+        productivity: "productivity";
+        ocr: "ocr";
+        email: "email";
+        messaging: "messaging";
+        sms: "sms";
+        push: "push";
+        storage: "storage";
+        analytics: "analytics";
+        observability: "observability";
+        crm: "crm";
+        calendar: "calendar";
+        other: "other";
+    }>>;
+    priority: z.ZodDefault<z.ZodNumber>;
+    baseUrl: z.ZodOptional<z.ZodURL>;
+    config: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>>;
+    protectedConfigKeys: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    configurationSource: z.ZodOptional<z.ZodEnum<{
+        account: "account";
+        host: "host";
+    }>>;
+    configSettingKey: z.ZodOptional<z.ZodString>;
+    credentials: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        key: z.ZodString;
+        source: z.ZodEnum<{
+            secret: "secret";
+            setting: "setting";
+        }>;
+        reference: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            source: z.ZodLiteral<"secret">;
+            key: z.ZodString;
+            store: z.ZodOptional<z.ZodString>;
+            operation: z.ZodOptional<z.ZodCustom<object, object>>;
+        }, z.core.$strict>], "source">>;
+        providerType: z.ZodOptional<z.ZodString>;
+        scope: z.ZodOptional<z.ZodEnum<{
+            user: "user";
+            platform: "platform";
+            project: "project";
+            org: "org";
+        }>>;
+        scopeId: z.ZodOptional<z.ZodString>;
+        settingKey: z.ZodOptional<z.ZodString>;
+        required: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>>>;
+    oauth: z.ZodOptional<z.ZodObject<{
+        authorizationEndpoint: z.ZodURL;
+        tokenEndpoint: z.ZodURL;
+        scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        authorizationParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        configFromCallback: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        clientAuthentication: z.ZodDefault<z.ZodEnum<{
+            form: "form";
+            basic: "basic";
+        }>>;
+        bodyEncoding: z.ZodDefault<z.ZodEnum<{
+            json: "json";
+            form: "form";
+        }>>;
+        headers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+        scopeIdCallbackParam: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    operations: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        requiresOrg: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>>>;
+    connection: z.ZodOptional<z.ZodObject<{
+        authMode: z.ZodOptional<z.ZodEnum<{
+            oauth: "oauth";
+            delegated: "delegated";
+            "system-config": "system-config";
+            webhook: "webhook";
+        }>>;
+        connectable: z.ZodDefault<z.ZodBoolean>;
+        checkable: z.ZodDefault<z.ZodBoolean>;
+        requiresProviderAdmin: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type IntegrationCredentialSource = z.infer<typeof IntegrationCredentialSourceSchema>;
+export type IntegrationOAuthMetadata = z.infer<typeof IntegrationOAuthMetadataSchema>;
+export type IntegrationOperation = z.infer<typeof IntegrationOperationSchema>;
+export type IntegrationProviderDescriptorInput = z.input<typeof IntegrationProviderDescriptorSchema>;
+export type IntegrationProviderDescriptor = z.infer<typeof IntegrationProviderDescriptorSchema>;
+export type IntegrationConfig = z.infer<typeof IntegrationConfigSchema>;
+/**
+ * Result of invoking a provider operation. Generic shape so providers can
+ * return arbitrary data; route handlers cast to provider-specific types
+ * when consuming. `errors` is non-empty when the operation partially
+ * succeeded — implementations should still throw for hard failures.
+ */
+export interface IntegrationOperationResult<T = unknown> {
+    ok: boolean;
+    data?: T;
+    errors?: string[];
+}
+export declare const IntegrationOAuthStartSchema: z.ZodObject<{
+    redirectUri: z.ZodURL;
+    state: z.ZodString;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export type IntegrationOAuthStart = z.infer<typeof IntegrationOAuthStartSchema>;
+export declare const IntegrationOAuthAuthorizationSchema: z.ZodObject<{
+    authorizationUrl: z.ZodURL;
+}, z.core.$strip>;
+export type IntegrationOAuthAuthorization = z.infer<typeof IntegrationOAuthAuthorizationSchema>;
+export declare const IntegrationOAuthCompletionSchema: z.ZodObject<{
+    code: z.ZodString;
+    redirectUri: z.ZodURL;
+    params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, z.core.$strip>;
+export type IntegrationOAuthCompletion = z.infer<typeof IntegrationOAuthCompletionSchema>;
+export declare const IntegrationProviderResolvedConfigurationSchema: z.ZodObject<{
+    config: z.ZodRecord<z.ZodString, z.ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>;
+    credentials: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    credentialReferences: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+        source: z.ZodLiteral<"secret">;
+        key: z.ZodString;
+        store: z.ZodOptional<z.ZodString>;
+        operation: z.ZodOptional<z.ZodCustom<object, object>>;
+    }, z.core.$strict>], "source">, z.ZodObject<{
+        source: z.ZodLiteral<"oauth-account">;
+        providerId: z.ZodString;
+        token: z.ZodDefault<z.ZodEnum<{
+            accessToken: "accessToken";
+            refreshToken: "refreshToken";
+        }>>;
+    }, z.core.$strict>]>>>>;
+}, z.core.$strip>;
+export type IntegrationProviderResolvedConfiguration = z.infer<typeof IntegrationProviderResolvedConfigurationSchema>;
+export type IntegrationResolvedConfigurationInput = z.input<typeof IntegrationProviderResolvedConfigurationSchema>;
+export declare const IntegrationConnectionSelectorSchema: z.ZodObject<{
+    connectionId: z.ZodString;
+}, z.core.$strip>;
+export type IntegrationConnectionSelector = z.infer<typeof IntegrationConnectionSelectorSchema>;
+export declare const IntegrationConnectionActorSchema: z.ZodObject<{
+    userId: z.ZodString;
+    organizationId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type IntegrationConnectionActor = z.infer<typeof IntegrationConnectionActorSchema>;
+export declare const IntegrationCredentialWriteMetadataSchema: z.ZodObject<{
+    expiresAt: z.ZodOptional<z.ZodISODateTime>;
+    tags: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, z.core.$strip>;
+export type IntegrationCredentialWriteMetadata = z.infer<typeof IntegrationCredentialWriteMetadataSchema>;
+export declare const IntegrationCredentialWriteRequestSchema: z.ZodObject<{
+    key: z.ZodString;
+    value: z.ZodString;
+    metadata: z.ZodOptional<z.ZodObject<{
+        expiresAt: z.ZodOptional<z.ZodISODateTime>;
+        tags: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>>;
+}, z.core.$strict>;
+export type IntegrationCredentialWriteRequest = z.infer<typeof IntegrationCredentialWriteRequestSchema>;
+export declare const IntegrationOAuthTokensSchema: z.ZodObject<{
+    access_token: z.ZodString;
+    refresh_token: z.ZodOptional<z.ZodString>;
+    expires_in: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>, z.ZodTransform<number, string | number>>>;
+    x_refresh_token_expires_in: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>, z.ZodTransform<number, string | number>>>;
+    refresh_token_expires_in: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>, z.ZodTransform<number, string | number>>>;
+}, z.core.$catchall<z.ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>>;
+export type IntegrationOAuthTokens = z.infer<typeof IntegrationOAuthTokensSchema>;
+export interface IntegrationProviderImplementation {
+    readonly descriptor: IntegrationProviderDescriptor;
+    getConfig(): Promise<IntegrationConfig>;
+    getCredentials(): Promise<Record<string, string>>;
+    getCredential(key: string): Promise<string | undefined>;
+    getCredentialCandidates?(key: string): Promise<CredentialCandidates>;
+    /** Reference-only request configuration; legacy implementations may not support it. */
+    getCredentialUseConfiguration?(selector?: Readonly<IntegrationConnectionSelector>): Promise<IntegrationProviderResolvedConfiguration>;
+    getResolvedConfiguration(selector?: Readonly<IntegrationConnectionSelector>): Promise<IntegrationProviderResolvedConfiguration>;
+    /** A bound invocation requires explicit provider support, with no legacy fallback. */
+    invokeOperationForConnection?<T = unknown>(selector: Readonly<IntegrationConnectionSelector>, opId: string, args?: IntegrationConfigValue): Promise<IntegrationOperationResult<T>>;
+    /**
+     * Persist a credential value. The descriptor's matching credential source
+     * determines storage backend: `source: 'secret'` writes to the integration
+     * secret store with org-scoped composite scopeId; `'setting'` / `'inline'` are read-only and throw on write.
+     *
+     * OAuth flows call this after exchange/refresh to persist access and
+     * refresh tokens. Provider implementations override when scopeId
+     * composition needs extra inputs (e.g. realmId / tenant); the base
+     * implementation handles the common case.
+     */
+    setCredential(key: string, value: string, metadata?: IntegrationCredentialWriteMetadata): Promise<void>;
+    /**
+     * Remove a credential value. Used by OAuth disconnect / revoke flows.
+     * Symmetric to `setCredential`.
+     */
+    unsetCredential(key: string): Promise<void>;
+    /**
+     * Build the provider's OAuth 2.0 authorization URL. Generic dispatch
+     * routes (e.g. `/api/integrations/[id]/connect`) call this with the
+     * caller-controlled `redirectUri` and a fresh `state` token. The default
+     * implementation reads `descriptor.oauth` and `clientId` from
+     * credentials; providers without `descriptor.oauth` set must override
+     * this method or throw.
+     */
+    startAuthorization(input: IntegrationOAuthStart): Promise<IntegrationOAuthAuthorization>;
+    /**
+     * Exchange an authorization code for tokens and persist them through the
+     * secret store (`setCredential('accessToken' | 'refreshToken')`). The
+     * default implementation handles the standard OAuth 2.0
+     * authorization-code grant; provider-specific callback params (e.g.
+     * QuickBooks `realmId`) are persisted via the descriptor's
+     * `oauth.configFromCallback` list.
+     */
+    completeAuthorization(input: IntegrationOAuthCompletion): Promise<void>;
+    /**
+     * Invoke a declarative operation defined on the descriptor's
+     * `operations[]` list. Generic dispatch routes (e.g.
+     * `/api/integrations/[id]/operations/[opId]`) call this so apps never
+     * have to know provider-specific URL shapes. The default implementation
+     * throws for any opId — provider impls override to handle their
+     * declared verbs (e.g. QuickBooks `'sync'` returns items + customers).
+     */
+    invokeOperation<T = unknown>(opId: string, args?: IntegrationConfigValue): Promise<IntegrationOperationResult<T>>;
+}
+//# sourceMappingURL=integration-descriptor.d.ts.map

package/dist/schemas/integration-descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration-descriptor.d.ts","sourceRoot":"","sources":["../../src/schemas/integration-descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAK5B,OAAO,EAAkM,KAAK,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEzQ,eAAO,MAAM,4BAA4B,iPAAkB,CAAC;AAC5D,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,eAAO,MAAM,uBAAuB,2QAAqD,CAAC;AAC1F,eAAO,MAAM,+BAA+B,gQAA0C,CAAC;AACvF,eAAO,MAAM,8BAA8B,aAAoC,CAAC;AAChF,eAAO,MAAM,8CAA8C;;;;;;;;;;;;qBAA6B,CAAC;AACzF,MAAM,MAAM,wCAAwC,GAAG,oBAAoB,CAAC;AAE5E,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;iBAqB5C,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;iBAczC,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B;;;;;iBAKrC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;EAiBpC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAyB9C,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAC5F,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACtF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AACrG,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAChG,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B,CAAC,CAAC,GAAG,OAAO;IACtD,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,CAAC,EAAE,CAAC,CAAC;IACT,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,eAAO,MAAM,2BAA2B;;;;iBAEtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,eAAO,MAAM,mCAAmC;;iBAA0C,CAAC;AAC3F,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAChG,eAAO,MAAM,gCAAgC;;;;iBAE3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC1F,eAAO,MAAM,8CAA8C;;;;;;;;;;;;;;;;iBAIzD,CAAC;AACH,MAAM,MAAM,wCAAwC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8CAA8C,CAAC,CAAC;AACtH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8CAA8C,CAAC,CAAC;AACnH,eAAO,MAAM,mCAAmC;;iBAAuD,CAAC;AACxG,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAChG,eAAO,MAAM,gCAAgC;;;iBAE3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC1F,eAAO,MAAM,wCAAwC;;;iBAGnD,CAAC;AACH,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAC1G,eAAO,MAAM,uCAAuC;;;;;;;kBAIzC,CAAC;AACZ,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AACxG,eAAO,MAAM,4BAA4B;;;;;;qQAA4C,CAAC;AACtF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,MAAM,WAAW,iCAAiC;IACjD,QAAQ,CAAC,UAAU,EAAE,6BAA6B,CAAC;IACnD,SAAS,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACxC,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACxD,uBAAuB,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACrE,uFAAuF;IACvF,6BAA6B,CAAC,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,6BAA6B,CAAC,GAAG,OAAO,CAAC,wCAAwC,CAAC,CAAC;IACtI,wBAAwB,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,6BAA6B,CAAC,GAAG,OAAO,CAAC,wCAAwC,CAAC,CAAC;IAChI,sFAAsF;IACtF,4BAA4B,CAAC,CAAC,CAAC,GAAG,OAAO,EACxC,QAAQ,EAAE,QAAQ,CAAC,6BAA6B,CAAC,EACjD,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,sBAAsB,GAC3B,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C;;;;;;;;;OASG;IACH,aAAa,CACZ,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,QAAQ,CAAC,EAAE,kCAAkC,GAC3C,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB;;;OAGG;IACH,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C;;;;;;;OAOG;IACH,kBAAkB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;IACzF;;;;;;;OAOG;IACH,qBAAqB,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE;;;;;;;OAOG;IACH,eAAe,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC;CAClH"}