@vibesdotdev/integrations 0.0.0-stage → 1.0.0-rc.2

package/dist/schemas/integration-descriptor.js

@@ -0,0 +1,153 @@
+import * as z from 'zod/v4';
+import { RuntimeDescriptorSchema } from '@vibesdotdev/kernel/schemas/descriptor';
+import { CredentialReferenceSchema } from '@vibesdotdev/kernel/credentials';
+import { JsonValueSchema } from '@vibesdotdev/kernel/schemas/json';
+import { IntegrationConnectionMetadataSchema } from "./integration-connection.js";
+import { managedSecretScopeSchema, CredentialCandidatesSchema, OAuthClientAuthenticationSchema, OAuthTokenBodyEncodingSchema, OAuthTokenRequestHeadersSchema, OAuthAuthorizationCodeTokenResponseSchema } from '@vibesdotdev/secrets/schemas';
+export const IntegrationConfigValueSchema = JsonValueSchema;
+export const IntegrationConfigSchema = z.record(z.string(), IntegrationConfigValueSchema);
+export const IntegrationOperationInputSchema = IntegrationConfigValueSchema.optional();
+export const IntegrationCredentialKeySchema = z.string().trim().min(1).max(128);
+export const IntegrationCredentialReferenceCandidatesSchema = CredentialCandidatesSchema;
+export const IntegrationCredentialSourceSchema = z.object({
+    key: IntegrationCredentialKeySchema,
+    source: z.enum(['secret', 'setting']),
+    /** Runtime-owned credential reference; settings must contain this shape too. */
+    reference: CredentialReferenceSchema.optional(),
+    providerType: z.string().optional(),
+    /** A selected scope marks a tenant-managed credential; no scope is a host reference. */
+    scope: managedSecretScopeSchema.optional(),
+    scopeId: z.string().trim().min(1).optional(),
+    settingKey: z.string().optional(),
+    required: z.boolean().default(false)
+}).superRefine((source, context) => {
+    if (source.source === 'setting' && !source.settingKey) {
+        context.addIssue({ code: 'custom', path: ['settingKey'], message: 'A credential setting key is required.' });
+    }
+    if (source.source === 'secret' && source.settingKey) {
+        context.addIssue({ code: 'custom', path: ['settingKey'], message: 'A direct secret source cannot select a setting.' });
+    }
+    if (source.scope !== undefined && source.scope !== 'org' && !source.scopeId) {
+        context.addIssue({ code: 'custom', path: ['scopeId'], message: 'A non-organization credential scope requires a scope id.' });
+    }
+});
+/**
+ * OAuth 2.0 endpoint metadata. When present, the runtime's generic
+ * `/api/integrations/[id]/connect` + `/[id]/callback` routes can drive the
+ * authorization-code flow without provider-specific wiring. Per-provider
+ * quirks (e.g. QuickBooks `realmId`, Microsoft `tenant`) are forwarded
+ * through `IntegrationOAuthCompletion.params` and handled by the
+ * implementation override of `completeAuthorization`.
+ */
+export const IntegrationOAuthMetadataSchema = z.object({
+    authorizationEndpoint: z.url(),
+    tokenEndpoint: z.url(),
+    scopes: z.array(z.string()).default([]),
+    authorizationParams: z.record(z.string(), z.string()).superRefine((params, context) => {
+        for (const key of Object.keys(params)) {
+            if (['clientid', 'clientsecret', 'redirecturi', 'responsetype', 'state'].includes(key.replaceAll('_', '').toLowerCase()))
+                context.addIssue({ code: 'custom', path: [key], message: 'OAuth control and secret fields belong to the owner.' });
+        }
+    }).optional(),
+    configFromCallback: z.array(z.string().refine(key => !['clientsecret', 'accesstoken', 'refreshtoken', 'code', 'state'].includes(key.replaceAll('_', '').toLowerCase()), 'Credentials and OAuth control data cannot become configuration.')).default([]),
+    clientAuthentication: OAuthClientAuthenticationSchema.default('basic'),
+    bodyEncoding: OAuthTokenBodyEncodingSchema.default('form'),
+    headers: OAuthTokenRequestHeadersSchema.default({}),
+    scopeIdCallbackParam: z.string().optional()
+});
+/**
+ * Declarative operation registry on an integration descriptor. Each
+ * operation is a named verb (e.g. `'sync'`, `'invalidate-cache'`) that the
+ * provider implementation handles via `invokeOperation(id, args)`. The
+ * runtime exposes operations through generic
+ * `POST /api/integrations/[id]/operations/[opId]` routes, so apps never
+ * need provider-specific endpoints.
+ */
+export const IntegrationOperationSchema = z.object({
+    id: z.string().min(1),
+    name: z.string().min(1),
+    description: z.string().optional(),
+    requiresOrg: z.boolean().default(true)
+});
+/**
+ * Functional category of an integration provider. Filters the catalog by
+ * the *kind of work* a provider does (email delivery vs accounting sync vs
+ * vcs hosting), independent of the vendor identity. Higher-level features
+ * (e.g. `packages/email`) query `integration/provider` by category to
+ * discover all eligible vendors at dispatch time.
+ *
+ * The enum is closed on purpose — vendors can't typo a category, and
+ * higher-level features can pattern-match exhaustively. Grow it as new
+ * categories appear in the codebase; passthrough strings are not allowed.
+ */
+export const IntegrationCategorySchema = z.enum([
+    'accounting',
+    'vcs',
+    'issue-tracker',
+    'productivity',
+    'ocr',
+    'email',
+    'messaging',
+    'sms',
+    'push',
+    'storage',
+    'analytics',
+    'observability',
+    'crm',
+    'calendar',
+    'webhook',
+    'other'
+]);
+export const IntegrationProviderDescriptorSchema = RuntimeDescriptorSchema.extend({
+    kind: z.literal('integration/provider'),
+    requiredContext: RuntimeDescriptorSchema.shape.requiredContext.default(['integration/store']),
+    optionalContext: RuntimeDescriptorSchema.shape.optionalContext.default(['system/settings-reader']),
+    provider: z.string().default('custom'),
+    category: IntegrationCategorySchema.default('other'),
+    priority: z.number().int().default(0),
+    baseUrl: z.url().optional(),
+    config: IntegrationConfigSchema.default({}),
+    /** Host-credential destinations/configuration stay declared by the provider. */
+    protectedConfigKeys: z.array(z.string().min(1)).default([]),
+    /** Host declarations never read or select tenant account configuration. */
+    configurationSource: z.enum(['account', 'host']).optional(),
+    configSettingKey: z.string().optional(),
+    credentials: z.array(IntegrationCredentialSourceSchema).default([]),
+    oauth: IntegrationOAuthMetadataSchema.optional(),
+    operations: z.array(IntegrationOperationSchema).default([]),
+    /**
+     * Declared authentication/connection behavior. Absent means undeclared —
+     * never inferred from the id, category or credential shape. A provider
+     * that wants connect/check behavior declares it here (or supplies an
+     * `integration/connection` capability); host-reference credentials alone
+     * do not make a provider tenant-connectable.
+     */
+    connection: IntegrationConnectionMetadataSchema.optional()
+});
+export const IntegrationOAuthStartSchema = z.object({
+    redirectUri: z.url(), state: z.string().min(1), scopes: z.array(z.string()).optional()
+});
+export const IntegrationOAuthAuthorizationSchema = z.object({ authorizationUrl: z.url() });
+export const IntegrationOAuthCompletionSchema = z.object({
+    code: z.string().min(1), redirectUri: z.url(), params: z.record(z.string(), z.string()).optional()
+});
+export const IntegrationProviderResolvedConfigurationSchema = z.object({
+    config: IntegrationConfigSchema,
+    credentials: z.record(z.string(), z.string()).default({}),
+    credentialReferences: z.record(z.string(), CredentialCandidatesSchema).default({})
+});
+export const IntegrationConnectionSelectorSchema = z.object({ connectionId: z.string().trim().min(1) });
+export const IntegrationConnectionActorSchema = z.object({
+    userId: z.string().min(1), organizationId: z.string().optional()
+});
+export const IntegrationCredentialWriteMetadataSchema = z.object({
+    expiresAt: z.iso.datetime({ offset: true }).optional(),
+    tags: z.record(z.string(), z.string()).optional()
+});
+export const IntegrationCredentialWriteRequestSchema = z.object({
+    key: IntegrationCredentialKeySchema,
+    value: z.string().min(1),
+    metadata: IntegrationCredentialWriteMetadataSchema.optional()
+}).strict();
+export const IntegrationOAuthTokensSchema = OAuthAuthorizationCodeTokenResponseSchema;
+//# sourceMappingURL=integration-descriptor.js.map

package/dist/schemas/integration-descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration-descriptor.js","sourceRoot":"","sources":["../../src/schemas/integration-descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,mCAAmC,EAAE,MAAM,6BAA6B,CAAC;AAClF,OAAO,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,+BAA+B,EAAE,4BAA4B,EAAE,8BAA8B,EAAE,yCAAyC,EAA6B,MAAM,8BAA8B,CAAC;AAEzQ,MAAM,CAAC,MAAM,4BAA4B,GAAG,eAAe,CAAC;AAE5D,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,4BAA4B,CAAC,CAAC;AAC1F,MAAM,CAAC,MAAM,+BAA+B,GAAG,4BAA4B,CAAC,QAAQ,EAAE,CAAC;AACvF,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAChF,MAAM,CAAC,MAAM,8CAA8C,GAAG,0BAA0B,CAAC;AAGzF,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,GAAG,EAAE,8BAA8B;IACnC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACrC,gFAAgF;IAChF,SAAS,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAC/C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,wFAAwF;IACxF,KAAK,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IAC1C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACpC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;IAClC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACvD,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAAC;IAC9G,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACrD,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAAC,CAAC;IACxH,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAC7E,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,0DAA0D,EAAE,CAAC,CAAC;IAC9H,CAAC;AACF,CAAC,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,qBAAqB,EAAE,CAAC,CAAC,GAAG,EAAE;IAC9B,aAAa,EAAE,CAAC,CAAC,GAAG,EAAE;IACtB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACvC,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;QACrF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;gBAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,sDAAsD,EAAE,CAAC,CAAC;QAC9O,CAAC;IACF,CAAC,CAAC,CAAC,QAAQ,EAAE;IACb,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,iEAAiE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACvP,oBAAoB,EAAE,+BAA+B,CAAC,OAAO,CAAC,OAAO,CAAC;IACtE,YAAY,EAAE,4BAA4B,CAAC,OAAO,CAAC,MAAM,CAAC;IAC1D,OAAO,EAAE,8BAA8B,CAAC,OAAO,CAAC,EAAE,CAAC;IACnD,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACtC,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC/C,YAAY;IACZ,KAAK;IACL,eAAe;IACf,cAAc;IACd,KAAK;IACL,OAAO;IACP,WAAW;IACX,KAAK;IACL,MAAM;IACN,SAAS;IACT,WAAW;IACX,eAAe;IACf,KAAK;IACL,UAAU;IACV,SAAS;IACT,OAAO;CACP,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,mCAAmC,GAAG,uBAAuB,CAAC,MAAM,CAAC;IACjF,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC;IACvC,eAAe,EAAE,uBAAuB,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,mBAAmB,CAAC,CAAC;IAC7F,eAAe,EAAE,uBAAuB,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,wBAAwB,CAAC,CAAC;IAClG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IACtC,QAAQ,EAAE,yBAAyB,CAAC,OAAO,CAAC,OAAO,CAAC;IACpD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC3B,MAAM,EAAE,uBAAuB,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3C,gFAAgF;IAChF,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3D,2EAA2E;IAC3E,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3D,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACnE,KAAK,EAAE,8BAA8B,CAAC,QAAQ,EAAE;IAChD,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3D;;;;;;OAMG;IACH,UAAU,EAAE,mCAAmC,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC;AAqBH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACtF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAE3F,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAClG,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,8CAA8C,GAAG,CAAC,CAAC,MAAM,CAAC;IACtE,MAAM,EAAE,uBAAuB;IAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACzD,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAClF,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAExG,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtD,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,GAAG,EAAE,8BAA8B;IACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,QAAQ,EAAE,wCAAwC,CAAC,QAAQ,EAAE;CAC7D,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,4BAA4B,GAAG,yCAAyC,CAAC"}

package/dist/schemas/oauth-state.d.ts

@@ -0,0 +1,30 @@
+import * as z from 'zod/v4';
+export declare const OauthStateOptionsSchema: z.ZodObject<{
+    callbackPath: z.ZodDefault<z.ZodString>;
+    ttlSeconds: z.ZodDefault<z.ZodNumber>;
+    secure: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+export type OauthStateOptions = z.input<typeof OauthStateOptionsSchema>;
+export declare const SignedOauthStatePayloadSchema: z.ZodObject<{
+    v: z.ZodLiteral<1>;
+    nonce: z.ZodString;
+    iat: z.ZodNumber;
+    orgId: z.ZodString;
+    returnTo: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type SignedOauthStatePayload = z.infer<typeof SignedOauthStatePayloadSchema>;
+export declare const IssueSignedOauthStateSchema: z.ZodObject<{
+    orgId: z.ZodString;
+    returnTo: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    secret: z.ZodString;
+    now: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export type IssueSignedOauthStateInput = z.infer<typeof IssueSignedOauthStateSchema>;
+export declare const ReadSignedOauthStateSchema: z.ZodObject<{
+    state: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    secret: z.ZodString;
+    now: z.ZodOptional<z.ZodNumber>;
+    ttlMs: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strip>;
+export type ReadSignedOauthStateInput = z.input<typeof ReadSignedOauthStateSchema>;
+//# sourceMappingURL=oauth-state.d.ts.map

package/dist/schemas/oauth-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-state.d.ts","sourceRoot":"","sources":["../../src/schemas/oauth-state.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,eAAO,MAAM,uBAAuB;;;;iBAIlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,eAAO,MAAM,6BAA6B;;;;;;iBAMxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,eAAO,MAAM,2BAA2B;;;;;iBAKtC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AACrF,eAAO,MAAM,0BAA0B;;;;;iBAKrC,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC"}

package/dist/schemas/oauth-state.js

@@ -0,0 +1,26 @@
+import * as z from 'zod/v4';
+export const OauthStateOptionsSchema = z.object({
+    callbackPath: z.string().startsWith('/').default('/api/integrations/'),
+    ttlSeconds: z.number().int().positive().default(600),
+    secure: z.boolean().default(true)
+});
+export const SignedOauthStatePayloadSchema = z.object({
+    v: z.literal(1),
+    nonce: z.string().min(1),
+    iat: z.number().int().nonnegative(),
+    orgId: z.string().min(1),
+    returnTo: z.string().optional()
+});
+export const IssueSignedOauthStateSchema = z.object({
+    orgId: z.string().min(1),
+    returnTo: z.string().nullable().optional(),
+    secret: z.string().min(1),
+    now: z.number().int().nonnegative().optional()
+});
+export const ReadSignedOauthStateSchema = z.object({
+    state: z.string().nullish(),
+    secret: z.string().min(1),
+    now: z.number().int().nonnegative().optional(),
+    ttlMs: z.number().int().positive().default(600000)
+});
+//# sourceMappingURL=oauth-state.js.map

package/dist/schemas/oauth-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-state.js","sourceRoot":"","sources":["../../src/schemas/oauth-state.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC;IACtE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IACpD,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACf,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC1C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IAC9C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;CAClD,CAAC,CAAC"}

package/dist/schemas/settings.d.ts

@@ -0,0 +1,9 @@
+import * as z from 'zod/v4';
+import { type IntegrationConfigValue } from './integration-descriptor.ts';
+export declare const IntegrationSettingsSchema: z.ZodRecord<z.ZodString, z.ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>;
+export declare const SystemSettingsReaderSchema: z.ZodObject<{
+    get: z.ZodCustom<(key: string) => IntegrationConfigValue | undefined | Promise<IntegrationConfigValue | undefined>, (key: string) => IntegrationConfigValue | undefined | Promise<IntegrationConfigValue | undefined>>;
+    getAll: z.ZodOptional<z.ZodCustom<() => Record<string, IntegrationConfigValue> | Promise<Record<string, IntegrationConfigValue>>, () => Record<string, IntegrationConfigValue> | Promise<Record<string, IntegrationConfigValue>>>>;
+}, z.core.$strip>;
+export type SystemSettingsReader = z.infer<typeof SystemSettingsReaderSchema>;
+//# sourceMappingURL=settings.d.ts.map

package/dist/schemas/settings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings.d.ts","sourceRoot":"","sources":["../../src/schemas/settings.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAgC,KAAK,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAExG,eAAO,MAAM,yBAAyB,2QAAqD,CAAC;AAC5F,eAAO,MAAM,0BAA0B;2BAClB,MAAM,KAAK,sBAAsB,GAAG,SAAS,GAAG,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,QAA3F,MAAM,KAAK,sBAAsB,GAAG,SAAS,GAAG,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC;4CAGxF,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC,QAAxF,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;iBAG9G,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC"}

package/dist/schemas/settings.js

@@ -0,0 +1,8 @@
+import * as z from 'zod/v4';
+import { IntegrationConfigValueSchema } from "./integration-descriptor.js";
+export const IntegrationSettingsSchema = z.record(z.string(), IntegrationConfigValueSchema);
+export const SystemSettingsReaderSchema = z.object({
+    get: z.custom((value) => value instanceof Function),
+    getAll: z.custom((value) => value instanceof Function).optional()
+});
+//# sourceMappingURL=settings.js.map

package/dist/schemas/settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings.js","sourceRoot":"","sources":["../../src/schemas/settings.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,4BAA4B,EAA+B,MAAM,6BAA6B,CAAC;AAExG,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,4BAA4B,CAAC,CAAC;AAC5F,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,GAAG,EAAE,CAAC,CAAC,MAAM,CACZ,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,YAAY,QAAQ,CACpC;IACD,MAAM,EAAE,CAAC,CAAC,MAAM,CACf,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,YAAY,QAAQ,CACpC,CAAC,QAAQ,EAAE;CACZ,CAAC,CAAC"}

package/dist/schemas/store.d.ts

@@ -0,0 +1,68 @@
+import * as z from 'zod/v4';
+import type { QueryBuilderDatabase } from '@vibesdotdev/storage';
+import type { CredentialReference } from '@vibesdotdev/kernel/credentials';
+import { type IntegrationConfigValue } from './integration-descriptor.ts';
+/** Derive the database dialect from storage's native query builders. */
+type SelectBuilder = ReturnType<QueryBuilderDatabase['select']>;
+type SelectedFields = NonNullable<Parameters<QueryBuilderDatabase['select']>[0]>;
+type Column = Extract<SelectedFields[string], {
+    table: object;
+    name: string;
+}>;
+type Table = Parameters<QueryBuilderDatabase['insert']>[0];
+type Where = Parameters<ReturnType<SelectBuilder['from']>['where']>[0];
+export type IntegrationStoreCondition = Extract<Where, {
+    getSQL: object;
+}> | undefined;
+export type IntegrationStoreDbOps = {
+    eq: (column: Column, value: IntegrationConfigValue | Date | Column) => IntegrationStoreCondition;
+    and: (...conditions: IntegrationStoreCondition[]) => IntegrationStoreCondition;
+    desc: (column: Column) => NonNullable<IntegrationStoreCondition>;
+};
+export type IntegrationStoreTable<Keys extends string = string> = Table & Record<Keys, Column>;
+/**
+ * Integration-owned configuration and service-to-secret selection metadata.
+ * Secret values and secret records belong to @vibesdotdev/secrets.
+ */
+export type IntegrationStoreTables = {
+    integrationServices: IntegrationStoreTable<'id' | 'integrationId' | 'enabled' | 'scope' | 'scopeId' | 'config' | 'featureId' | 'serviceKey' | 'updatedAt'>;
+    resourceSecrets: IntegrationStoreTable<'id' | 'resourceType' | 'resourceId' | 'secretId'>;
+};
+export declare const IntegrationServiceRowSchema: z.ZodObject<{
+    id: z.ZodString;
+    config: z.ZodRecord<z.ZodString, z.ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>;
+}, z.core.$strip>;
+export declare const IntegrationSecretIdSchema: z.ZodObject<{
+    secretId: z.ZodString;
+}, z.core.$strip>;
+export declare const IntegrationSecretJoinSchema: z.ZodObject<{
+    secretId: z.ZodString;
+    joinId: z.ZodString;
+}, z.core.$strip>;
+/** Scope selectors for persisted data are always complete and tenant-specific. */
+export declare const IntegrationStoreScopeSchema: z.ZodObject<{
+    scope: z.ZodEnum<{
+        user: "user";
+        platform: "platform";
+        project: "project";
+        org: "org";
+    }>;
+    scopeId: z.ZodString;
+}, z.core.$strict>;
+export type IntegrationStoreScope = z.infer<typeof IntegrationStoreScopeSchema>;
+export declare const IntegrationStoreIdSchema: z.ZodString;
+export declare const IntegrationStoreAdapterSchema: z.ZodObject<{
+    loadConfig: z.ZodCustom<(descriptorId: string, scope: IntegrationStoreScope) => Promise<import("./integration-descriptor.ts").IntegrationConfig | undefined>, (descriptorId: string, scope: IntegrationStoreScope) => Promise<import("./integration-descriptor.ts").IntegrationConfig | undefined>>;
+    loadCredential: z.ZodCustom<(descriptorId: string, source: import("./integration-descriptor.ts").IntegrationCredentialSource) => Promise<CredentialReference | undefined>, (descriptorId: string, source: import("./integration-descriptor.ts").IntegrationCredentialSource) => Promise<CredentialReference | undefined>>;
+    writeConfig: z.ZodCustom<(descriptorId: string, scope: IntegrationStoreScope, patch: import("./integration-descriptor.ts").IntegrationConfig) => Promise<void>, (descriptorId: string, scope: IntegrationStoreScope, patch: import("./integration-descriptor.ts").IntegrationConfig) => Promise<void>>;
+    writeCredential: z.ZodCustom<(descriptorId: string, source: import("./integration-descriptor.ts").IntegrationCredentialSource, value: string, metadata?: import("./integration-descriptor.ts").IntegrationCredentialWriteMetadata) => Promise<void>, (descriptorId: string, source: import("./integration-descriptor.ts").IntegrationCredentialSource, value: string, metadata?: import("./integration-descriptor.ts").IntegrationCredentialWriteMetadata) => Promise<void>>;
+    deleteCredential: z.ZodCustom<(descriptorId: string, source: import("./integration-descriptor.ts").IntegrationCredentialSource) => Promise<boolean>, (descriptorId: string, source: import("./integration-descriptor.ts").IntegrationCredentialSource) => Promise<boolean>>;
+    loadConnection: z.ZodOptional<z.ZodCustom<(descriptor: import("./integration-descriptor.ts").IntegrationProviderDescriptor, selector: Readonly<import("./integration-descriptor.ts").IntegrationConnectionSelector>, actor: Readonly<import("./integration-descriptor.ts").IntegrationConnectionActor>) => Promise<import("./integration-descriptor.ts").IntegrationResolvedConfigurationInput>, (descriptor: import("./integration-descriptor.ts").IntegrationProviderDescriptor, selector: Readonly<import("./integration-descriptor.ts").IntegrationConnectionSelector>, actor: Readonly<import("./integration-descriptor.ts").IntegrationConnectionActor>) => Promise<import("./integration-descriptor.ts").IntegrationResolvedConfigurationInput>>>;
+    loadConnectionReferences: z.ZodOptional<z.ZodCustom<(descriptor: import("./integration-descriptor.ts").IntegrationProviderDescriptor, selector: Readonly<import("./integration-descriptor.ts").IntegrationConnectionSelector>, actor: Readonly<import("./integration-descriptor.ts").IntegrationConnectionActor>) => Promise<import("./integration-descriptor.ts").IntegrationResolvedConfigurationInput>, (descriptor: import("./integration-descriptor.ts").IntegrationProviderDescriptor, selector: Readonly<import("./integration-descriptor.ts").IntegrationConnectionSelector>, actor: Readonly<import("./integration-descriptor.ts").IntegrationConnectionActor>) => Promise<import("./integration-descriptor.ts").IntegrationResolvedConfigurationInput>>>;
+}, z.core.$strip>;
+export type IntegrationStoreAdapter = z.infer<typeof IntegrationStoreAdapterSchema>;
+export declare const IntegrationConfigRowSchema: z.ZodObject<{
+    config: z.ZodRecord<z.ZodString, z.ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>;
+}, z.core.$strip>;
+export {};
+//# sourceMappingURL=store.d.ts.map

package/dist/schemas/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/schemas/store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAE3E,OAAO,EAAgC,KAAK,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAExG,wEAAwE;AACxE,KAAK,aAAa,GAAG,UAAU,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC;AAChE,KAAK,cAAc,GAAG,WAAW,CAAC,UAAU,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjF,KAAK,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAC/E,KAAK,KAAK,GAAG,UAAU,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3D,KAAK,KAAK,GAAG,UAAU,CAAC,UAAU,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEvE,MAAM,MAAM,yBAAyB,GAAG,OAAO,CAAC,KAAK,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,SAAS,CAAC;AACvF,MAAM,MAAM,qBAAqB,GAAG;IACnC,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,sBAAsB,GAAG,IAAI,GAAG,MAAM,KAAK,yBAAyB,CAAC;IACjG,GAAG,EAAE,CAAC,GAAG,UAAU,EAAE,yBAAyB,EAAE,KAAK,yBAAyB,CAAC;IAC/E,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,WAAW,CAAC,yBAAyB,CAAC,CAAC;CACjE,CAAC;AACF,MAAM,MAAM,qBAAqB,CAAC,IAAI,SAAS,MAAM,GAAG,MAAM,IAAI,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAE/F;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACpC,mBAAmB,EAAE,qBAAqB,CACzC,IAAI,GAAG,eAAe,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,GAAG,WAAW,GAAG,YAAY,GAAG,WAAW,CAC9G,CAAC;IACF,eAAe,EAAE,qBAAqB,CAAC,IAAI,GAAG,cAAc,GAAG,YAAY,GAAG,UAAU,CAAC,CAAC;CAC1F,CAAC;AAEF,eAAO,MAAM,2BAA2B;;;iBAGtC,CAAC;AAEH,eAAO,MAAM,yBAAyB;;iBAA4C,CAAC;AACnF,eAAO,MAAM,2BAA2B;;;iBAEtC,CAAC;AAEH,kFAAkF;AAClF,eAAO,MAAM,2BAA2B;;;;;;;;kBAG7B,CAAC;AACZ,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,eAAO,MAAM,wBAAwB,aAAoB,CAAC;AAE1D,eAAO,MAAM,6BAA6B;2CAEzB,MAAM,SAAS,qBAAqB,KAClD,OAAO,CAAC,OAAO,6BAA6B,EAAE,iBAAiB,GAAG,SAAS,CAAC,iBAD9D,MAAM,SAAS,qBAAqB,KAClD,OAAO,CAAC,OAAO,6BAA6B,EAAE,iBAAiB,GAAG,SAAS,CAAC;+CAG9D,MAAM,UAAU,OAAO,6BAA6B,EAAE,2BAA2B,KAC/F,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,iBAD1B,MAAM,UAAU,OAAO,6BAA6B,EAAE,2BAA2B,KAC/F,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;4CAG1B,MAAM,SAAS,qBAAqB,SAAS,OAAO,6BAA6B,EAAE,iBAAiB,KAClH,OAAO,CAAC,IAAI,CAAC,iBADC,MAAM,SAAS,qBAAqB,SAAS,OAAO,6BAA6B,EAAE,iBAAiB,KAClH,OAAO,CAAC,IAAI,CAAC;gDAIC,MAAM,UACZ,OAAO,6BAA6B,EAAE,2BAA2B,SAClE,MAAM,aACF,OAAO,6BAA6B,EAAE,kCAAkC,KAC/E,OAAO,CAAC,IAAI,CAAC,iBAJH,MAAM,UACZ,OAAO,6BAA6B,EAAE,2BAA2B,SAClE,MAAM,aACF,OAAO,6BAA6B,EAAE,kCAAkC,KAC/E,OAAO,CAAC,IAAI,CAAC;iDAGH,MAAM,UAAU,OAAO,6BAA6B,EAAE,2BAA2B,KAC/F,OAAO,CAAC,OAAO,CAAC,iBADF,MAAM,UAAU,OAAO,6BAA6B,EAAE,2BAA2B,KAC/F,OAAO,CAAC,OAAO,CAAC;2DAIJ,OAAO,6BAA6B,EAAE,6BAA6B,YACrE,QAAQ,CAAC,OAAO,6BAA6B,EAAE,6BAA6B,CAAC,SAChF,QAAQ,CAAC,OAAO,6BAA6B,EAAE,0BAA0B,CAAC,KAC7E,OAAO,CAAC,OAAO,6BAA6B,EAAE,qCAAqC,CAAC,eAH5E,OAAO,6BAA6B,EAAE,6BAA6B,YACrE,QAAQ,CAAC,OAAO,6BAA6B,EAAE,6BAA6B,CAAC,SAChF,QAAQ,CAAC,OAAO,6BAA6B,EAAE,0BAA0B,CAAC,KAC7E,OAAO,CAAC,OAAO,6BAA6B,EAAE,qCAAqC,CAAC;qEAK5E,OAAO,6BAA6B,EAAE,6BAA6B,YACrE,QAAQ,CAAC,OAAO,6BAA6B,EAAE,6BAA6B,CAAC,SAChF,QAAQ,CAAC,OAAO,6BAA6B,EAAE,0BAA0B,CAAC,KAC7E,OAAO,CAAC,OAAO,6BAA6B,EAAE,qCAAqC,CAAC,eAH5E,OAAO,6BAA6B,EAAE,6BAA6B,YACrE,QAAQ,CAAC,OAAO,6BAA6B,EAAE,6BAA6B,CAAC,SAChF,QAAQ,CAAC,OAAO,6BAA6B,EAAE,0BAA0B,CAAC,KAC7E,OAAO,CAAC,OAAO,6BAA6B,EAAE,qCAAqC,CAAC;iBAEzF,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,0BAA0B;;iBAErC,CAAC"}

package/dist/schemas/store.js

@@ -0,0 +1,31 @@
+import * as z from 'zod/v4';
+import { managedSecretScopeSchema } from '@vibesdotdev/secrets/schemas';
+import { IntegrationConfigValueSchema } from "./integration-descriptor.js";
+export const IntegrationServiceRowSchema = z.object({
+    id: z.string().min(1),
+    config: z.record(z.string(), IntegrationConfigValueSchema)
+});
+export const IntegrationSecretIdSchema = z.object({ secretId: z.string().min(1) });
+export const IntegrationSecretJoinSchema = IntegrationSecretIdSchema.extend({
+    joinId: z.string().min(1)
+});
+/** Scope selectors for persisted data are always complete and tenant-specific. */
+export const IntegrationStoreScopeSchema = z.object({
+    scope: managedSecretScopeSchema,
+    scopeId: z.string().trim().min(1)
+}).strict();
+export const IntegrationStoreIdSchema = z.string().min(1);
+export const IntegrationStoreAdapterSchema = z.object({
+    loadConfig: z.custom((value) => value instanceof Function),
+    loadCredential: z.custom((value) => value instanceof Function),
+    writeConfig: z.custom((value) => value instanceof Function),
+    writeCredential: z.custom((value) => value instanceof Function),
+    deleteCredential: z.custom((value) => value instanceof Function),
+    loadConnection: z.custom((value) => value instanceof Function).optional(),
+    /** Explicit reference delivery never calls a legacy value-returning loader. */
+    loadConnectionReferences: z.custom((value) => value instanceof Function).optional()
+});
+export const IntegrationConfigRowSchema = z.object({
+    config: z.record(z.string(), IntegrationConfigValueSchema)
+});
+//# sourceMappingURL=store.js.map

package/dist/schemas/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/schemas/store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EAAE,4BAA4B,EAA+B,MAAM,6BAA6B,CAAC;AA4BxG,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,4BAA4B,CAAC;CAC1D,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACnF,MAAM,CAAC,MAAM,2BAA2B,GAAG,yBAAyB,CAAC,MAAM,CAAC;IAC3E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACzB,CAAC,CAAC;AAEH,kFAAkF;AAClF,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,KAAK,EAAE,wBAAwB;IAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACjC,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAE1D,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,UAAU,EAAE,CAAC,CAAC,MAAM,CAGlB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,YAAY,QAAQ,CAAC;IACvC,cAAc,EAAE,CAAC,CAAC,MAAM,CAGtB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,YAAY,QAAQ,CAAC;IACvC,WAAW,EAAE,CAAC,CAAC,MAAM,CAGnB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,YAAY,QAAQ,CAAC;IACvC,eAAe,EAAE,CAAC,CAAC,MAAM,CAOvB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,YAAY,QAAQ,CAAC;IACvC,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAGxB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,YAAY,QAAQ,CAAC;IACvC,cAAc,EAAE,CAAC,CAAC,MAAM,CAMtB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,YAAY,QAAQ,CAAC,CAAC,QAAQ,EAAE;IAClD,+EAA+E;IAC/E,wBAAwB,EAAE,CAAC,CAAC,MAAM,CAMhC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,YAAY,QAAQ,CAAC,CAAC,QAAQ,EAAE;CAClD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,4BAA4B,CAAC;CAC1D,CAAC,CAAC"}

package/dist/server/defaults/system-defaults.kind.d.ts

@@ -0,0 +1,8 @@
+export { INTEGRATION_PROVIDER_DEFAULTS_ID, INTEGRATION_PROVIDER_DEFAULTS_KIND, IntegrationProviderDefaultsDescriptorSchema, type IntegrationProviderDefaultsDescriptor } from '../schemas/system-defaults.ts';
+/**
+ * Kind for host-composed provider service defaults. Descriptors of this kind
+ * declare which provider services a deployment seeds and cleans; the generic
+ * core registers the kind and ships no vendor selection itself.
+ */
+export declare const integrationProviderDefaultsKind: import("@vibesdotdev/kernel").RuntimeKindDescriptorRecord<unknown>;
+//# sourceMappingURL=system-defaults.kind.d.ts.map

package/dist/server/defaults/system-defaults.kind.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-defaults.kind.d.ts","sourceRoot":"","sources":["../../../src/server/defaults/system-defaults.kind.ts"],"names":[],"mappings":"AAMA,OAAO,EACN,gCAAgC,EAChC,kCAAkC,EAClC,2CAA2C,EAC3C,KAAK,qCAAqC,EAC1C,MAAM,+BAA+B,CAAC;AAEvC;;;;GAIG;AACH,eAAO,MAAM,+BAA+B,oEAG1C,CAAC"}

package/dist/server/defaults/system-defaults.kind.js

@@ -0,0 +1,13 @@
+import { createRuntimeKind } from '@vibesdotdev/kernel/factory';
+import { INTEGRATION_PROVIDER_DEFAULTS_KIND, IntegrationProviderDefaultsDescriptorSchema } from "../schemas/system-defaults.js";
+export { INTEGRATION_PROVIDER_DEFAULTS_ID, INTEGRATION_PROVIDER_DEFAULTS_KIND, IntegrationProviderDefaultsDescriptorSchema } from "../schemas/system-defaults.js";
+/**
+ * Kind for host-composed provider service defaults. Descriptors of this kind
+ * declare which provider services a deployment seeds and cleans; the generic
+ * core registers the kind and ships no vendor selection itself.
+ */
+export const integrationProviderDefaultsKind = createRuntimeKind({
+    id: INTEGRATION_PROVIDER_DEFAULTS_KIND,
+    descriptorSchema: IntegrationProviderDefaultsDescriptorSchema
+});
+//# sourceMappingURL=system-defaults.kind.js.map

package/dist/server/defaults/system-defaults.kind.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-defaults.kind.js","sourceRoot":"","sources":["../../../src/server/defaults/system-defaults.kind.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EACN,kCAAkC,EAClC,2CAA2C,EAC3C,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACN,gCAAgC,EAChC,kCAAkC,EAClC,2CAA2C,EAE3C,MAAM,+BAA+B,CAAC;AAEvC;;;;GAIG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,iBAAiB,CAAC;IAChE,EAAE,EAAE,kCAAkC;IACtC,gBAAgB,EAAE,2CAA2C;CAC7D,CAAC,CAAC"}

package/dist/server/integration-oauth.d.ts

@@ -0,0 +1,44 @@
+/**
+ * OAuth credential use, owned by the credential owners.
+ *
+ * A connect flow needs credential operations a provider must not do itself:
+ * resolve the host-managed client credentials, and exchange a code or a stored
+ * refresh token for tokens. Both belong to Secrets, which resolves references and
+ * composes the authenticated request. What core adds is the integration-shaped
+ * composition — the credential candidates a descriptor declares, and the
+ * authorization URL whose client id Secrets fills in.
+ *
+ * Client credentials remain inside Secrets. A connect flow receives newly issued
+ * tokens for its credential store through {@link exchangeIntegrationAuthorizationCode}.
+ */
+import type { RuntimeRef } from '@vibesdotdev/kernel';
+import type { CredentialPresence, CredentialPresenceInputInput, OAuthAuthorizationCodeExchangeInputInput, OAuthRefreshTokenExchangeInputInput } from '@vibesdotdev/secrets/schemas';
+import { type IntegrationOAuthTokens } from '../schemas/integration-descriptor.ts';
+import { type IntegrationClientIdResolution } from './schemas/integration-oauth.ts';
+/** The placeholder a browser-visible authorization URL carries for the client id. */
+export declare const INTEGRATION_OAUTH_CLIENT_ID_PLACEHOLDER = "{clientId}";
+/**
+ * Whether a credential a reference names is set, answered by the Secrets owner.
+ * The answer is presence only; a confirmed absence is `NOT_FOUND`
+ * `credential-not-set` and every other store refusal propagates unchanged.
+ */
+export declare function checkIntegrationCredentialPresence(runtime: RuntimeRef, input: CredentialPresenceInputInput): Promise<CredentialPresence>;
+/**
+ * Exchange an authorization code for tokens through the Secrets owner. The client
+ * credentials travel as ordered reference candidates, so neither value enters the
+ * calling provider, and the answer is the provider's token payload.
+ */
+export declare function exchangeIntegrationAuthorizationCode(runtime: RuntimeRef, input: OAuthAuthorizationCodeExchangeInputInput): Promise<IntegrationOAuthTokens>;
+/**
+ * Exchange a stored refresh token for a fresh access token through the Secrets
+ * owner. The refresh token travels as a reference candidate list.
+ */
+export declare function exchangeIntegrationRefreshToken(runtime: RuntimeRef, input: OAuthRefreshTokenExchangeInputInput): Promise<IntegrationOAuthTokens>;
+/**
+ * Turn a descriptor's authorization URL template into the URL a browser follows,
+ * with the public client identifier resolved inside Secrets. The value never
+ * enters provider code; the client secret is not part of this URL. A template
+ * without the named placeholder is returned unchanged.
+ */
+export declare function applyIntegrationClientId(runtime: RuntimeRef, input: IntegrationClientIdResolution): Promise<string>;
+//# sourceMappingURL=integration-oauth.d.ts.map

package/dist/server/integration-oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration-oauth.d.ts","sourceRoot":"","sources":["../../src/server/integration-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAqB,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEzE,OAAO,KAAK,EACX,kBAAkB,EAClB,4BAA4B,EAC5B,wCAAwC,EACxC,mCAAmC,EACnC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAgC,KAAK,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AACjH,OAAO,EAEN,KAAK,6BAA6B,EAClC,MAAM,gCAAgC,CAAC;AAGxC,qFAAqF;AACrF,eAAO,MAAM,uCAAuC,eAAe,CAAC;AASpE;;;;GAIG;AACH,wBAAsB,kCAAkC,CACvD,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,4BAA4B,GACjC,OAAO,CAAC,kBAAkB,CAAC,CAE7B;AAED;;;;GAIG;AACH,wBAAsB,oCAAoC,CACzD,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,wCAAwC,GAC7C,OAAO,CAAC,sBAAsB,CAAC,CAGjC;AAED;;;GAGG;AACH,wBAAsB,+BAA+B,CACpD,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,mCAAmC,GACxC,OAAO,CAAC,sBAAsB,CAAC,CAGjC;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC7C,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,6BAA6B,GAClC,OAAO,CAAC,MAAM,CAAC,CAYjB"}

package/dist/server/integration-oauth.js

@@ -0,0 +1,56 @@
+import { IntegrationOAuthTokensSchema } from "../schemas/integration-descriptor.js";
+import { IntegrationClientIdResolutionSchema } from "./schemas/integration-oauth.js";
+import { parseIntegrationBoundary } from "../schemas/boundary.js";
+/** The placeholder a browser-visible authorization URL carries for the client id. */
+export const INTEGRATION_OAUTH_CLIENT_ID_PLACEHOLDER = '{clientId}';
+async function secretsClient(runtime) {
+    return runtime
+        .query('runtime/client')
+        .withId('secrets')
+        .resolve();
+}
+/**
+ * Whether a credential a reference names is set, answered by the Secrets owner.
+ * The answer is presence only; a confirmed absence is `NOT_FOUND`
+ * `credential-not-set` and every other store refusal propagates unchanged.
+ */
+export async function checkIntegrationCredentialPresence(runtime, input) {
+    return (await secretsClient(runtime)).checkCredentialPresence(input);
+}
+/**
+ * Exchange an authorization code for tokens through the Secrets owner. The client
+ * credentials travel as ordered reference candidates, so neither value enters the
+ * calling provider, and the answer is the provider's token payload.
+ */
+export async function exchangeIntegrationAuthorizationCode(runtime, input) {
+    const tokens = await (await secretsClient(runtime)).exchangeOAuthAuthorizationCode(input);
+    return parseIntegrationBoundary(IntegrationOAuthTokensSchema, tokens);
+}
+/**
+ * Exchange a stored refresh token for a fresh access token through the Secrets
+ * owner. The refresh token travels as a reference candidate list.
+ */
+export async function exchangeIntegrationRefreshToken(runtime, input) {
+    const tokens = await (await secretsClient(runtime)).exchangeOAuthRefreshToken(input);
+    return parseIntegrationBoundary(IntegrationOAuthTokensSchema, tokens);
+}
+/**
+ * Turn a descriptor's authorization URL template into the URL a browser follows,
+ * with the public client identifier resolved inside Secrets. The value never
+ * enters provider code; the client secret is not part of this URL. A template
+ * without the named placeholder is returned unchanged.
+ */
+export async function applyIntegrationClientId(runtime, input) {
+    const parsed = parseIntegrationBoundary(IntegrationClientIdResolutionSchema, input);
+    const url = new URL(parsed.authorizationUrl);
+    if (url.searchParams.get('client_id') !== INTEGRATION_OAUTH_CLIENT_ID_PLACEHOLDER) {
+        return parsed.authorizationUrl;
+    }
+    return (await secretsClient(runtime)).resolveOAuthAuthorizationUrl({
+        authorizationUrl: parsed.authorizationUrl,
+        placeholder: INTEGRATION_OAUTH_CLIENT_ID_PLACEHOLDER,
+        parameter: 'client_id',
+        clientId: parsed.clientId
+    });
+}
+//# sourceMappingURL=integration-oauth.js.map

package/dist/server/integration-oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration-oauth.js","sourceRoot":"","sources":["../../src/server/integration-oauth.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,4BAA4B,EAA+B,MAAM,sCAAsC,CAAC;AACjH,OAAO,EACN,mCAAmC,EAEnC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAElE,qFAAqF;AACrF,MAAM,CAAC,MAAM,uCAAuC,GAAG,YAAY,CAAC;AAEpE,KAAK,UAAU,aAAa,CAAC,OAAmB;IAC/C,OAAO,OAAO;SACZ,KAAK,CAAmC,gBAAgB,CAAC;SACzD,MAAM,CAAC,SAAS,CAAC;SACjB,OAAO,EAAE,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACvD,OAAmB,EACnB,KAAmC;IAEnC,OAAO,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;AACtE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACzD,OAAmB,EACnB,KAA+C;IAE/C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAC1F,OAAO,wBAAwB,CAAC,4BAA4B,EAAE,MAAM,CAAC,CAAC;AACvE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACpD,OAAmB,EACnB,KAA0C;IAE1C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC;IACrF,OAAO,wBAAwB,CAAC,4BAA4B,EAAE,MAAM,CAAC,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,OAAmB,EACnB,KAAoC;IAEpC,MAAM,MAAM,GAAG,wBAAwB,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;IACpF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC7C,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,uCAAuC,EAAE,CAAC;QACnF,OAAO,MAAM,CAAC,gBAAgB,CAAC;IAChC,CAAC;IACD,OAAO,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B,CAAC;QAClE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,WAAW,EAAE,uCAAuC;QACpD,SAAS,EAAE,WAAW;QACtB,QAAQ,EAAE,MAAM,CAAC,QAAQ;KACzB,CAAC,CAAC;AACJ,CAAC"}

package/dist/server/integration-secrets.d.ts

@@ -0,0 +1,11 @@
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+import { type AuthenticatedRequestInputInput, type CredentialPayloadSignatureInput } from '@vibesdotdev/secrets/schemas';
+import { type AttachIntegrationSecretOptions, type IntegrationSecretReference, type ListIntegrationServiceSecretsOptions, type ResolveIntegrationSecretOptions } from './schemas/integration-secrets.ts';
+export type { AttachIntegrationSecretOptions, IntegrationSecretClient, IntegrationSecretReference, ListIntegrationServiceSecretsOptions, ResolveIntegrationSecretOptions } from './schemas/integration-secrets.ts';
+export declare function attachSecretToIntegrationService(options: AttachIntegrationSecretOptions): Promise<void>;
+export declare function listIntegrationServiceSecrets(options: ListIntegrationServiceSecretsOptions): Promise<IntegrationSecretReference[]>;
+export declare function resolveIntegrationServiceSecret(options: ResolveIntegrationSecretOptions): Promise<string | undefined>;
+export declare function sendIntegrationAuthenticatedRequest(runtime: RuntimeRef, input: AuthenticatedRequestInputInput): Promise<Response>;
+/** Forward credential use to Secrets without reading or returning signing key material. */
+export declare function signIntegrationPayload(runtime: RuntimeRef, input: CredentialPayloadSignatureInput): Promise<string | undefined>;
+//# sourceMappingURL=integration-secrets.d.ts.map

package/dist/server/integration-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration-secrets.d.ts","sourceRoot":"","sources":["../../src/server/integration-secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAA2C,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAE/F,OAAO,EAAsB,KAAK,8BAA8B,EAAE,KAAK,+BAA+B,EAAE,MAAM,8BAA8B,CAAC;AAE7I,OAAO,EAKN,KAAK,8BAA8B,EACnC,KAAK,0BAA0B,EAC/B,KAAK,oCAAoC,EACzC,KAAK,+BAA+B,EACpC,MAAM,kCAAkC,CAAC;AAE1C,YAAY,EACX,8BAA8B,EAC9B,uBAAuB,EACvB,0BAA0B,EAC1B,oCAAoC,EACpC,+BAA+B,EAC/B,MAAM,kCAAkC,CAAC;AAgB1C,wBAAsB,gCAAgC,CAAC,OAAO,EAAE,8BAA8B,GAAG,OAAO,CAAC,IAAI,CAAC,CAkB7G;AAED,wBAAsB,6BAA6B,CAClD,OAAO,EAAE,oCAAoC,GAC3C,OAAO,CAAC,0BAA0B,EAAE,CAAC,CAuBvC;AAED,wBAAsB,+BAA+B,CACpD,OAAO,EAAE,+BAA+B,GACtC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAoC7B;AAED,wBAAsB,mCAAmC,CACxD,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,8BAA8B,GACnC,OAAO,CAAC,QAAQ,CAAC,CAEnB;AAED,2FAA2F;AAC3F,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,+BAA+B,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAErI"}