@vibesdotdev/integrations 0.0.0-stage → 1.0.0-rc.3

package/dist/server/integration-secrets.js

@@ -0,0 +1,98 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { publicSecretSchema } from '@vibesdotdev/secrets/schemas';
+import { parseIntegrationBoundary } from "../schemas/boundary.js";
+import { AttachIntegrationSecretOptionsSchema, IntegrationSecretAssociationSchema, ListIntegrationServiceSecretsOptionsSchema, ResolveIntegrationSecretOptionsSchema } from "./schemas/integration-secrets.js";
+const INTEGRATION_RESOURCE_TYPE = 'integration';
+async function secretsClient(runtime) {
+    return runtime
+        .query('runtime/client')
+        .withId('secrets')
+        .resolve();
+}
+async function managedSecrets(runtime, scope, scopeId) {
+    const client = await secretsClient(runtime);
+    return client.managed(scope, scopeId);
+}
+export async function attachSecretToIntegrationService(options) {
+    options = parseIntegrationBoundary(AttachIntegrationSecretOptionsSchema, options);
+    const managed = await managedSecrets(options.runtime, options.scope, options.scopeId);
+    const secret = await managed.get(options.secretId);
+    if (!secret) {
+        throw new CapabilityError('The managed secret is not available in the selected scope.', 'NOT_FOUND', {
+            reason: 'integration-secret-not-found',
+            retryable: false
+        });
+    }
+    await options.client.attachSecretToResource({
+        secretId: secret.id,
+        resourceType: INTEGRATION_RESOURCE_TYPE,
+        resourceId: options.serviceId,
+        attachedBy: options.attachedBy,
+        purpose: options.purpose
+    });
+}
+export async function listIntegrationServiceSecrets(options) {
+    options = parseIntegrationBoundary(ListIntegrationServiceSecretsOptionsSchema, options);
+    const [associations, secrets] = await Promise.all([
+        options.client.listSecretsForResource({
+            resourceType: INTEGRATION_RESOURCE_TYPE,
+            resourceId: options.serviceId
+        }),
+        (await managedSecrets(options.runtime, options.scope, options.scopeId)).list()
+    ]);
+    const ids = new Set(associations
+        .map((association) => IntegrationSecretAssociationSchema.parse(association).secretId));
+    return secrets
+        .filter((secret) => ids.has(secret.id))
+        .map((secret) => {
+        const publicSecret = publicSecretSchema.parse(secret);
+        return {
+            secretId: publicSecret.id,
+            name: publicSecret.name,
+            providerType: publicSecret.providerType,
+            updatedAt: publicSecret.updatedAt
+        };
+    });
+}
+export async function resolveIntegrationServiceSecret(options) {
+    options = parseIntegrationBoundary(ResolveIntegrationSecretOptionsSchema, options);
+    const references = await listIntegrationServiceSecrets({
+        runtime: options.runtime,
+        client: options.client,
+        serviceId: options.serviceId,
+        scope: options.scope,
+        scopeId: options.scopeId
+    });
+    const selected = references.find((secret) => (options.reference === undefined || secret.name === options.reference.key)
+        && (options.secretName === undefined || secret.name === options.secretName)
+        && (options.providerType === undefined || secret.providerType === options.providerType));
+    if (!selected)
+        return undefined;
+    if (options.recordUsage && !options.client.recordSecretUsage) {
+        throw new CapabilityError('Secret usage recording is unavailable.', 'UNAVAILABLE', {
+            reason: 'integration-secret-usage-unavailable',
+            retryable: false
+        });
+    }
+    const client = await secretsClient(options.runtime);
+    const reference = client.managedCredentialReference(selected.secretId);
+    const result = await options.runtime.resolveCredential(reference);
+    if (!result.ok)
+        throw result.error;
+    if (options.recordUsage) {
+        await options.client.recordSecretUsage?.({
+            resourceType: INTEGRATION_RESOURCE_TYPE,
+            resourceId: options.serviceId,
+            secretId: selected.secretId
+        });
+    }
+    return result.value;
+}
+export async function sendIntegrationAuthenticatedRequest(runtime, input) {
+    return (await secretsClient(runtime)).sendAuthenticatedRequest(input);
+}
+/** Forward credential use to Secrets without reading or returning signing key material. */
+export async function signIntegrationPayload(runtime, input) {
+    return (await secretsClient(runtime)).signPayload(input);
+}
+//# sourceMappingURL=integration-secrets.js.map

package/dist/server/integration-secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration-secrets.js","sourceRoot":"","sources":["../../src/server/integration-secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAA2C,MAAM,qBAAqB,CAAC;AAE/F,OAAO,EAAE,kBAAkB,EAA6E,MAAM,8BAA8B,CAAC;AAC7I,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EACN,oCAAoC,EACpC,kCAAkC,EAClC,0CAA0C,EAC1C,qCAAqC,EAKrC,MAAM,kCAAkC,CAAC;AAU1C,MAAM,yBAAyB,GAAG,aAAsB,CAAC;AAEzD,KAAK,UAAU,aAAa,CAAC,OAAkD;IAC9E,OAAO,OAAO;SACZ,KAAK,CAAmC,gBAAgB,CAAC;SACzD,MAAM,CAAC,SAAS,CAAC;SACjB,OAAO,EAAE,CAAC;AACb,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,OAAkD,EAAE,KAA8C,EAAE,OAAe;IAChJ,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,OAAuC;IAC7F,OAAO,GAAG,wBAAwB,CAAC,oCAAoC,EAAE,OAAO,CAAC,CAAC;IAClF,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,MAAM,IAAI,eAAe,CAAC,4DAA4D,EAAE,WAAW,EAAE;YACpG,MAAM,EAAE,8BAA8B;YACtC,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,CAAC,MAAM,CAAC,sBAAsB,CAAC;QAC3C,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnB,YAAY,EAAE,yBAAyB;QACvC,UAAU,EAAE,OAAO,CAAC,SAAS;QAC7B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;KACxB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAClD,OAA6C;IAE7C,OAAO,GAAG,wBAAwB,CAAC,0CAA0C,EAAE,OAAO,CAAC,CAAC;IACxF,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACjD,OAAO,CAAC,MAAM,CAAC,sBAAsB,CAAC;YACrC,YAAY,EAAE,yBAAyB;YACvC,UAAU,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC;QACF,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE;KAC9E,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,YAAY;SAC9B,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,kCAAkC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAExF,OAAO,OAAO;SACZ,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;SACtC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACf,MAAM,YAAY,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACtD,OAAO;YACN,QAAQ,EAAE,YAAY,CAAC,EAAE;YACzB,IAAI,EAAE,YAAY,CAAC,IAAI;YACvB,YAAY,EAAE,YAAY,CAAC,YAAY;YACvC,SAAS,EAAE,YAAY,CAAC,SAAS;SACjC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACpD,OAAwC;IAExC,OAAO,GAAG,wBAAwB,CAAC,qCAAqC,EAAE,OAAO,CAAC,CAAC;IACnF,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC;QACtD,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,OAAO,EAAE,OAAO,CAAC,OAAO;KACxB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAC3C,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC;WACtE,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,UAAU,CAAC;WACxE,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,YAAY,KAAK,OAAO,CAAC,YAAY,CAAC,CACxF,CAAC;IACF,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAEhC,IAAI,OAAO,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC9D,MAAM,IAAI,eAAe,CAAC,wCAAwC,EAAE,aAAa,EAAE;YAClF,MAAM,EAAE,sCAAsC;YAC9C,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,MAAM,CAAC,0BAA0B,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAClE,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,MAAM,CAAC,KAAK,CAAC;IAEnC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;YACxC,YAAY,EAAE,yBAAyB;YACvC,UAAU,EAAE,OAAO,CAAC,SAAS;YAC7B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;SAC3B,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACxD,OAAmB,EACnB,KAAqC;IAErC,OAAO,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;AACvE,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAAmB,EAAE,KAAsC;IACvG,OAAO,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC"}

package/dist/server/oauth-state.d.ts

@@ -0,0 +1,74 @@
+import { type OauthStateOptions, type SignedOauthStatePayload, type IssueSignedOauthStateInput, type ReadSignedOauthStateInput } from '../schemas/oauth-state.ts';
+export type { OauthStateOptions, SignedOauthStatePayload } from '../schemas/oauth-state.ts';
+/**
+ * OAuth integration connect/callback state.
+ *
+ * Every host that exposes `/api/integrations/[id]/connect` +
+ * `/api/integrations/[id]/callback` (or provider-specific equivalents) needs
+ * to defend the OAuth roundtrip against CSRF. The proven pattern in this
+ * monorepo is the standard one: issue a random state token, persist it in
+ * an HTTP-only `SameSite=Lax` cookie scoped to the callback path, embed it
+ * in the authorization URL, and on return compare the URL `state` against
+ * the cookie value in constant time before deleting the cookie.
+ *
+ * Why a cookie, not server-side storage: the cookie is tied to the same
+ * browser that initiated the flow (which is what CSRF protection actually
+ * needs), has zero infrastructure dependencies, and survives across
+ * single-region Workers, multi-region Workers, and local dev without any
+ * deploy-time binding setup. A KV-backed implementation that fails open
+ * when the binding is absent is strictly worse — that's the bug this
+ * helper exists to prevent.
+ *
+ * This module is framework-agnostic on purpose: it talks to a structural
+ * `CookieJar` interface that SvelteKit's `event.cookies` satisfies
+ * directly (and that any other framework can satisfy with a small shim).
+ * Per `packages/integrations/SPEC.md` hard rules, this package must not
+ * import `@sveltejs/kit`.
+ */
+/**
+ * Structural shape that SvelteKit's `event.cookies` already satisfies.
+ * Other frameworks can satisfy this with a tiny adapter.
+ */
+export interface OauthStateCookieJar {
+    get(name: string): string | undefined;
+    set(name: string, value: string, options: {
+        path: string;
+        httpOnly?: boolean;
+        sameSite?: 'lax' | 'strict' | 'none';
+        secure?: boolean;
+        maxAge?: number;
+    }): void;
+    delete(name: string, options: {
+        path: string;
+    }): void;
+}
+export interface OauthStateHandle {
+    /** Generate a random state token, set the cookie, return the token for the auth URL. */
+    issue(): string;
+    /**
+     * Validate `returnedState` (from the callback URL) against the stored
+     * cookie value in constant time. Deletes the cookie on success.
+     * Throws `CapabilityError` on any failure (missing, wrong, replayed).
+     */
+    validate(returnedState: string | null | undefined): void;
+}
+/**
+ * Build a per-integration state handle.
+ *
+ * @param integrationId - Descriptor id, e.g. `'integration.quickbooks'`. Used
+ *   as the cookie-name discriminator so two parallel OAuth flows in the same
+ *   browser don't clobber each other.
+ * @param cookies - Cookie jar (SvelteKit `event.cookies` satisfies this).
+ * @param options - Optional overrides.
+ */
+export declare function createOauthState(integrationId: string, cookies: OauthStateCookieJar, options?: OauthStateOptions): OauthStateHandle;
+/**
+ * Issue a signed OAuth state token: `v1.<base64url payload>.<base64url hmac>`.
+ */
+export declare function issueSignedOauthState(input: IssueSignedOauthStateInput): Promise<string>;
+/**
+ * Validate and decode a signed OAuth state token. Throws
+ * `SignedOauthStateError` on missing/malformed/forged/expired states.
+ */
+export declare function readSignedOauthState(input: ReadSignedOauthStateInput): Promise<SignedOauthStatePayload>;
+//# sourceMappingURL=oauth-state.d.ts.map

package/dist/server/oauth-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-state.d.ts","sourceRoot":"","sources":["../../src/server/oauth-state.ts"],"names":[],"mappings":"AAEA,OAAO,EAAmH,KAAK,iBAAiB,EAAE,KAAK,uBAAuB,EAAE,KAAK,0BAA0B,EAAE,KAAK,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACnR,YAAY,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAE5F;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IACnC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACtC,GAAG,CACF,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE;QACR,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;QACrC,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;KAChB,GACC,IAAI,CAAC;IACR,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACtD;AAED,MAAM,WAAW,gBAAgB;IAChC,wFAAwF;IACxF,KAAK,IAAI,MAAM,CAAC;IAChB;;;;OAIG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,CAAC;CACzD;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC/B,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,mBAAmB,EAC5B,OAAO,GAAE,iBAAsB,GAC7B,gBAAgB,CAiDlB;AAoED;;GAEG;AACH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,MAAM,CAAC,CAY9F;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAoC7G"}

package/dist/server/oauth-state.js

@@ -0,0 +1,208 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { parseIntegrationBoundary } from "../schemas/boundary.js";
+import { OauthStateOptionsSchema, IssueSignedOauthStateSchema, ReadSignedOauthStateSchema, SignedOauthStatePayloadSchema } from "../schemas/oauth-state.js";
+/**
+ * Build a per-integration state handle.
+ *
+ * @param integrationId - Descriptor id, e.g. `'integration.quickbooks'`. Used
+ *   as the cookie-name discriminator so two parallel OAuth flows in the same
+ *   browser don't clobber each other.
+ * @param cookies - Cookie jar (SvelteKit `event.cookies` satisfies this).
+ * @param options - Optional overrides.
+ */
+export function createOauthState(integrationId, cookies, options = {}) {
+    const cookieName = cookieNameFor(integrationId);
+    const parsed = parseIntegrationBoundary(OauthStateOptionsSchema, options);
+    const path = parsed.callbackPath;
+    const ttlSeconds = parsed.ttlSeconds;
+    const secure = parsed.secure;
+    return {
+        issue() {
+            const token = generateStateToken();
+            // SameSite=Lax, NOT 'none': the OAuth callback is a top-level GET
+            // navigation, which Lax cookies ARE sent on, and same
+            // registrable-domain subdomains are same-site anyway. 'none'
+            // requires `Secure`, so on plain-http local dev the browser
+            // silently drops the cookie and every callback fails state
+            // validation. See SPEC.md §Owns → oauth-state.ts.
+            cookies.set(cookieName, token, {
+                path,
+                httpOnly: true,
+                sameSite: 'lax',
+                secure,
+                maxAge: ttlSeconds
+            });
+            return token;
+        },
+        validate(returnedState) {
+            const stored = cookies.get(cookieName);
+            if (!returnedState) {
+                throw new CapabilityError('OAuth state validation failed.', 'INVALID_INPUT', { reason: 'oauth-state-missing', retryable: false });
+            }
+            if (!stored) {
+                // Missing state typically means the flow expired (10-minute
+                // cookie TTL) or the callback was opened in a different
+                // browser than the one that initiated the connect.
+                throw new CapabilityError('OAuth state validation failed.', 'INVALID_INPUT', { reason: 'oauth-state-missing', retryable: false });
+            }
+            if (!constantTimeEqual(returnedState, stored)) {
+                // Don't clear on mismatch: a parallel/abandoned flow in
+                // the same browser shouldn't be allowed to nuke an
+                // otherwise-valid pending state. The 256-bit token isn't
+                // brute-forceable and is single-use against the upstream
+                // provider's `code`, so leaving the cookie is safe.
+                throw new CapabilityError('OAuth state validation failed.', 'INVALID_INPUT', { reason: 'oauth-state-mismatch', retryable: false });
+            }
+            // Successful match: consume the cookie so the same state
+            // can't be replayed.
+            cookies.delete(cookieName, { path });
+        }
+    };
+}
+/**
+ * Cookie name derived from the integration id. Stable, URL-safe, and
+ * collision-free across providers in the same browser.
+ */
+function cookieNameFor(integrationId) {
+    return `oauth_state.${integrationId.replace(/[^a-zA-Z0-9._-]/g, '_')}`;
+}
+/**
+ * Generate a 256-bit state token, hex-encoded. Uses Web Crypto, which is
+ * present in every runtime this monorepo targets (Workers, Node 18+, Bun).
+ */
+function generateStateToken() {
+    const bytes = new Uint8Array(32);
+    crypto.getRandomValues(bytes);
+    let hex = '';
+    for (const byte of bytes) {
+        hex += byte.toString(16).padStart(2, '0');
+    }
+    return hex;
+}
+/**
+ * Constant-time string comparison. Avoids the byte-by-byte short-circuit
+ * that would leak token prefixes via timing.
+ */
+function constantTimeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++) {
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    }
+    return diff === 0;
+}
+// ─────────────────────────────────────────────────────────────────────────────
+// Signed-payload state (sanctioned variant)
+//
+// The cookie-backed `createOauthState` above is the default and what every
+// host should reach for first. Some upstream providers, however, drop side
+// cookies across their consent roundtrip even when the redirect is a
+// top-level GET (observed with Intuit/QuickBooks). For those flows the host
+// also needs to transport server-trusted context (orgId, returnTo) through
+// the roundtrip without trusting query params. The signed-payload state
+// below is the ONE sanctioned alternative: an HMAC-SHA256-signed,
+// TTL-bounded `state` value carrying `{ nonce, iat, orgId, returnTo? }`.
+//
+// Trade-off (documented, deliberate): unlike the cookie variant, a signed
+// state is not bound to the initiating browser — it is a short-lived bearer
+// artifact. Hosts that use it MUST re-validate org membership AND the
+// manage-connection role on the callback before acting on the payload, and
+// MUST pass any returnTo through their safe-redirect allowlist.
+//
+// Key hygiene: callers supply a `secret` (hosts should prefer a dedicated
+// signing secret; QuickBooks currently passes the Intuit clientSecret). The
+// HMAC key material is domain-separated with a fixed prefix so even a reused
+// credential yields a signing key distinct from any other HMAC use of that
+// secret.
+// ─────────────────────────────────────────────────────────────────────────────
+const SIGNED_STATE_VERSION = 'v1';
+/** Domain-separation prefix mixed into the HMAC key material. */
+const SIGNED_STATE_KEY_DOMAIN = 'vibes.integrations.signed-oauth-state.v1';
+const textEncoder = new TextEncoder();
+const textDecoder = new TextDecoder();
+/**
+ * Issue a signed OAuth state token: `v1.<base64url payload>.<base64url hmac>`.
+ */
+export async function issueSignedOauthState(input) {
+    input = parseIntegrationBoundary(IssueSignedOauthStateSchema, input);
+    const payload = {
+        v: 1,
+        nonce: base64UrlEncode(randomBytes(16)),
+        iat: input.now ?? Date.now(),
+        orgId: input.orgId,
+        returnTo: input.returnTo ?? undefined
+    };
+    const encodedPayload = base64UrlEncode(textEncoder.encode(JSON.stringify(payload)));
+    const signature = await signStatePayload(encodedPayload, input.secret);
+    return `${SIGNED_STATE_VERSION}.${encodedPayload}.${signature}`;
+}
+/**
+ * Validate and decode a signed OAuth state token. Throws
+ * `SignedOauthStateError` on missing/malformed/forged/expired states.
+ */
+export async function readSignedOauthState(input) {
+    const options = parseIntegrationBoundary(ReadSignedOauthStateSchema, input);
+    if (!options.state) {
+        throw new CapabilityError('Signed OAuth state validation failed.', 'INVALID_INPUT', { reason: 'oauth-signed-state-missing', retryable: false });
+    }
+    const parts = options.state.split('.');
+    if (parts.length !== 3 || parts[0] !== SIGNED_STATE_VERSION || !parts[1] || !parts[2]) {
+        throw new CapabilityError('Signed OAuth state validation failed.', 'INVALID_INPUT', { reason: 'oauth-signed-state-malformed', retryable: false });
+    }
+    const expectedSignature = await signStatePayload(parts[1], options.secret);
+    if (!constantTimeEqual(parts[2], expectedSignature)) {
+        throw new CapabilityError('Signed OAuth state validation failed.', 'INVALID_INPUT', { reason: 'oauth-signed-state-signature', retryable: false });
+    }
+    let decoded;
+    try {
+        decoded = JSON.parse(textDecoder.decode(base64UrlDecode(parts[1])));
+    }
+    catch (cause) {
+        throw new CapabilityError('Signed OAuth state payload is malformed.', 'INVALID_INPUT', {
+            reason: 'oauth-signed-state-malformed', retryable: false, cause
+        });
+    }
+    const result = SignedOauthStatePayloadSchema.safeParse(decoded);
+    if (!result.success) {
+        throw new CapabilityError('Signed OAuth state payload is invalid.', 'INVALID_INPUT', {
+            reason: 'oauth-signed-state-malformed', retryable: false, cause: result.error
+        });
+    }
+    const payload = result.data;
+    const age = (options.now ?? Date.now()) - payload.iat;
+    if (age < 0 || age >= options.ttlMs) {
+        throw new CapabilityError('Signed OAuth state expired.', 'INVALID_INPUT', {
+            reason: 'oauth-signed-state-expired', retryable: false
+        });
+    }
+    return payload;
+}
+async function signStatePayload(payload, secret) {
+    const key = await crypto.subtle.importKey('raw', textEncoder.encode(`${SIGNED_STATE_KEY_DOMAIN}${secret}`), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    const signature = await crypto.subtle.sign('HMAC', key, textEncoder.encode(payload));
+    return base64UrlEncode(new Uint8Array(signature));
+}
+function randomBytes(length) {
+    const bytes = new Uint8Array(length);
+    crypto.getRandomValues(bytes);
+    return bytes;
+}
+function base64UrlEncode(bytes) {
+    let binary = '';
+    for (const byte of bytes) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/u, '');
+}
+function base64UrlDecode(value) {
+    const base64 = value.replace(/-/g, '+').replace(/_/g, '/');
+    const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, '=');
+    const binary = atob(padded);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i += 1) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes;
+}
+//# sourceMappingURL=oauth-state.js.map

package/dist/server/oauth-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-state.js","sourceRoot":"","sources":["../../src/server/oauth-state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,0BAA0B,EAAE,6BAA6B,EAAyH,MAAM,2BAA2B,CAAC;AA4DnR;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAC/B,aAAqB,EACrB,OAA4B,EAC5B,UAA6B,EAAE;IAE/B,MAAM,UAAU,GAAG,aAAa,CAAC,aAAa,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,wBAAwB,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC;IACjC,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAE7B,OAAO;QACN,KAAK;YACJ,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;YACnC,kEAAkE;YAClE,sDAAsD;YACtD,6DAA6D;YAC7D,4DAA4D;YAC5D,2DAA2D;YAC3D,kDAAkD;YAClD,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE;gBAC9B,IAAI;gBACJ,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,KAAK;gBACf,MAAM;gBACN,MAAM,EAAE,UAAU;aAClB,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACd,CAAC;QACD,QAAQ,CAAC,aAAwC;YAChD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACvC,IAAI,CAAC,aAAa,EAAE,CAAC;gBACpB,MAAM,IAAI,eAAe,CAAC,gCAAgC,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YACnI,CAAC;YACD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACb,4DAA4D;gBAC5D,wDAAwD;gBACxD,mDAAmD;gBACnD,MAAM,IAAI,eAAe,CAAC,gCAAgC,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YACnI,CAAC;YACD,IAAI,CAAC,iBAAiB,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,CAAC;gBAC/C,wDAAwD;gBACxD,mDAAmD;gBACnD,yDAAyD;gBACzD,yDAAyD;gBACzD,oDAAoD;gBACpD,MAAM,IAAI,eAAe,CAAC,gCAAgC,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YACpI,CAAC;YACD,yDAAyD;YACzD,qBAAqB;YACrB,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,CAAC;KACD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,aAAqB;IAC3C,OAAO,eAAe,aAAa,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,EAAE,CAAC;AACxE,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB;IAC1B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,gFAAgF;AAChF,4CAA4C;AAC5C,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,qEAAqE;AACrE,4EAA4E;AAC5E,2EAA2E;AAC3E,wEAAwE;AACxE,kEAAkE;AAClE,yEAAyE;AACzE,EAAE;AACF,0EAA0E;AAC1E,4EAA4E;AAC5E,sEAAsE;AACtE,2EAA2E;AAC3E,gEAAgE;AAChE,EAAE;AACF,0EAA0E;AAC1E,4EAA4E;AAC5E,6EAA6E;AAC7E,2EAA2E;AAC3E,UAAU;AACV,gFAAgF;AAEhF,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAClC,iEAAiE;AACjE,MAAM,uBAAuB,GAAG,0CAA0C,CAAC;AAC3E,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;AACtC,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;AAEtC;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAAiC;IAC5E,KAAK,GAAG,wBAAwB,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC;IACrE,MAAM,OAAO,GAA4B;QACxC,CAAC,EAAE,CAAC;QACJ,KAAK,EAAE,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACvC,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE;QAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,SAAS;KACrC,CAAC;IACF,MAAM,cAAc,GAAG,eAAe,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACpF,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACvE,OAAO,GAAG,oBAAoB,IAAI,cAAc,IAAI,SAAS,EAAE,CAAC;AACjE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAAgC;IAC1E,MAAM,OAAO,GAAG,wBAAwB,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;IAC5E,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACpB,MAAM,IAAI,eAAe,CAAC,uCAAuC,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,4BAA4B,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACjJ,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,oBAAoB,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,eAAe,CAAC,uCAAuC,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACnJ,CAAC;IACD,MAAM,iBAAiB,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3E,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,iBAAiB,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,eAAe,CAAC,uCAAuC,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACnJ,CAAC;IAED,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACJ,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,eAAe,CAAC,0CAA0C,EAAE,eAAe,EAAE;YACtF,MAAM,EAAE,8BAA8B,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK;SAC/D,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,6BAA6B,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,eAAe,CAAC,wCAAwC,EAAE,eAAe,EAAE;YACpF,MAAM,EAAE,8BAA8B,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK;SAC7E,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC;IAC5B,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC;IACtD,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACrC,MAAM,IAAI,eAAe,CAAC,6BAA6B,EAAE,eAAe,EAAE;YACzE,MAAM,EAAE,4BAA4B,EAAE,SAAS,EAAE,KAAK;SACtD,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,OAAe,EAAE,MAAc;IAC9D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACxC,KAAK,EACL,WAAW,CAAC,MAAM,CAAC,GAAG,uBAAuB,IAAI,MAAM,EAAE,CAAC,EAC1D,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACR,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACrF,OAAO,eAAe,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IAClC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,KAAiB;IACzC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACrC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC"}

package/dist/server/schemas/integration-oauth.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Integration OAuth boundary schemas.
+ *
+ * The authorization URL a browser follows is public routing data, but it carries
+ * the client identifier, which is a host-managed credential. The caller therefore
+ * hands Secrets a URL template plus the identifier's credential candidates, and the
+ * finished URL is the only thing that comes back.
+ */
+import * as z from 'zod/v4';
+/**
+ * An authorization URL awaiting its client identifier, with the ordered
+ * candidates for that identifier. Values stay with Secrets; the URL template is the
+ * only thing that is public.
+ */
+export declare const IntegrationClientIdResolutionSchema: z.ZodObject<{
+    authorizationUrl: z.ZodURL;
+    clientId: z.ZodArray<z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.ZodObject<{
+        source: z.ZodLiteral<"secret">;
+        key: z.ZodString;
+        store: z.ZodOptional<z.ZodString>;
+        operation: z.ZodOptional<z.ZodCustom<object, object>>;
+    }, z.core.$strict>], "source">, z.ZodObject<{
+        source: z.ZodLiteral<"oauth-account">;
+        providerId: z.ZodString;
+        token: z.ZodDefault<z.ZodEnum<{
+            accessToken: "accessToken";
+            refreshToken: "refreshToken";
+        }>>;
+    }, z.core.$strict>]>>;
+}, z.core.$strict>;
+export type IntegrationClientIdResolution = z.infer<typeof IntegrationClientIdResolutionSchema>;
+//# sourceMappingURL=integration-oauth.d.ts.map

package/dist/server/schemas/integration-oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration-oauth.d.ts","sourceRoot":"","sources":["../../../src/server/schemas/integration-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B;;;;GAIG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;kBAGrC,CAAC;AAEZ,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC"}

package/dist/server/schemas/integration-oauth.js

@@ -0,0 +1,20 @@
+/**
+ * Integration OAuth boundary schemas.
+ *
+ * The authorization URL a browser follows is public routing data, but it carries
+ * the client identifier, which is a host-managed credential. The caller therefore
+ * hands Secrets a URL template plus the identifier's credential candidates, and the
+ * finished URL is the only thing that comes back.
+ */
+import * as z from 'zod/v4';
+import { CredentialCandidatesSchema } from '@vibesdotdev/secrets/schemas';
+/**
+ * An authorization URL awaiting its client identifier, with the ordered
+ * candidates for that identifier. Values stay with Secrets; the URL template is the
+ * only thing that is public.
+ */
+export const IntegrationClientIdResolutionSchema = z.object({
+    authorizationUrl: z.url(),
+    clientId: CredentialCandidatesSchema
+}).strict();
+//# sourceMappingURL=integration-oauth.js.map

package/dist/server/schemas/integration-oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration-oauth.js","sourceRoot":"","sources":["../../../src/server/schemas/integration-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAE1E;;;;GAIG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE;IACzB,QAAQ,EAAE,0BAA0B;CACpC,CAAC,CAAC,MAAM,EAAE,CAAC"}

package/dist/server/schemas/integration-secrets.d.ts

@@ -0,0 +1,165 @@
+import * as z from 'zod/v4';
+import type { RuntimeRef } from '@vibesdotdev/kernel';
+import { type CredentialReference } from '@vibesdotdev/kernel/credentials';
+import { type ManagedSecretScope, type PublicSecret } from '@vibesdotdev/secrets/schemas';
+export declare const IntegrationSecretResourceTypeSchema: z.ZodLiteral<"integration">;
+export type IntegrationSecretResourceType = z.infer<typeof IntegrationSecretResourceTypeSchema>;
+export declare const AttachSecretToResourceInputSchema: z.ZodObject<{
+    secretId: z.ZodString;
+    resourceType: z.ZodLiteral<"integration">;
+    resourceId: z.ZodString;
+    attachedBy: z.ZodString;
+    purpose: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strict>;
+export type AttachSecretToResourceInput = z.infer<typeof AttachSecretToResourceInputSchema>;
+export declare const ListSecretsForResourceInputSchema: z.ZodObject<{
+    resourceType: z.ZodLiteral<"integration">;
+    resourceId: z.ZodString;
+}, z.core.$strict>;
+export type ListSecretsForResourceInput = z.infer<typeof ListSecretsForResourceInputSchema>;
+export declare const IntegrationSecretAssociationSchema: z.ZodObject<{
+    secretId: z.ZodString;
+}, z.core.$strict>;
+export type IntegrationSecretAssociation = z.infer<typeof IntegrationSecretAssociationSchema>;
+/** Integration-facing projection composed from the secrets owner's public metadata. */
+export type IntegrationSecretReference = Pick<PublicSecret, 'name' | 'providerType' | 'updatedAt'> & {
+    secretId: string;
+};
+export declare const RecordSecretUsageInputSchema: z.ZodObject<{
+    resourceType: z.ZodLiteral<"integration">;
+    resourceId: z.ZodString;
+    secretId: z.ZodString;
+}, z.core.$strict>;
+export type RecordSecretUsageInput = z.infer<typeof RecordSecretUsageInputSchema>;
+/** Association metadata only. Credential values remain owned by secrets/store. */
+export declare const IntegrationSecretClientSchema: z.ZodObject<{
+    attachSecretToResource: z.ZodFunction<z.ZodTuple<readonly [z.ZodObject<{
+        secretId: z.ZodString;
+        resourceType: z.ZodLiteral<"integration">;
+        resourceId: z.ZodString;
+        attachedBy: z.ZodString;
+        purpose: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strict>], null>, z.ZodPromise<z.ZodVoid>>;
+    listSecretsForResource: z.ZodFunction<z.ZodTuple<readonly [z.ZodObject<{
+        resourceType: z.ZodLiteral<"integration">;
+        resourceId: z.ZodString;
+    }, z.core.$strict>], null>, z.ZodPromise<z.ZodReadonly<z.ZodArray<z.ZodObject<{
+        secretId: z.ZodString;
+    }, z.core.$strict>>>>>;
+    recordSecretUsage: z.ZodOptional<z.ZodFunction<z.ZodTuple<readonly [z.ZodObject<{
+        resourceType: z.ZodLiteral<"integration">;
+        resourceId: z.ZodString;
+        secretId: z.ZodString;
+    }, z.core.$strict>], null>, z.ZodPromise<z.ZodVoid>>>;
+}, z.core.$strict>;
+export type IntegrationSecretClient = z.infer<typeof IntegrationSecretClientSchema>;
+export declare const AttachIntegrationSecretOptionsSchema: z.ZodObject<{
+    runtime: z.ZodCustom<RuntimeRef, RuntimeRef>;
+    client: z.ZodObject<{
+        attachSecretToResource: z.ZodFunction<z.ZodTuple<readonly [z.ZodObject<{
+            secretId: z.ZodString;
+            resourceType: z.ZodLiteral<"integration">;
+            resourceId: z.ZodString;
+            attachedBy: z.ZodString;
+            purpose: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        }, z.core.$strict>], null>, z.ZodPromise<z.ZodVoid>>;
+        listSecretsForResource: z.ZodFunction<z.ZodTuple<readonly [z.ZodObject<{
+            resourceType: z.ZodLiteral<"integration">;
+            resourceId: z.ZodString;
+        }, z.core.$strict>], null>, z.ZodPromise<z.ZodReadonly<z.ZodArray<z.ZodObject<{
+            secretId: z.ZodString;
+        }, z.core.$strict>>>>>;
+        recordSecretUsage: z.ZodOptional<z.ZodFunction<z.ZodTuple<readonly [z.ZodObject<{
+            resourceType: z.ZodLiteral<"integration">;
+            resourceId: z.ZodString;
+            secretId: z.ZodString;
+        }, z.core.$strict>], null>, z.ZodPromise<z.ZodVoid>>>;
+    }, z.core.$strict>;
+    serviceId: z.ZodString;
+    secretId: z.ZodString;
+    attachedBy: z.ZodString;
+    scope: z.ZodEnum<{
+        user: "user";
+        platform: "platform";
+        project: "project";
+        org: "org";
+    }>;
+    scopeId: z.ZodString;
+    purpose: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strict>;
+export type AttachIntegrationSecretOptions = z.infer<typeof AttachIntegrationSecretOptionsSchema>;
+export declare const ListIntegrationServiceSecretsOptionsSchema: z.ZodObject<{
+    runtime: z.ZodCustom<RuntimeRef, RuntimeRef>;
+    client: z.ZodObject<{
+        attachSecretToResource: z.ZodFunction<z.ZodTuple<readonly [z.ZodObject<{
+            secretId: z.ZodString;
+            resourceType: z.ZodLiteral<"integration">;
+            resourceId: z.ZodString;
+            attachedBy: z.ZodString;
+            purpose: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        }, z.core.$strict>], null>, z.ZodPromise<z.ZodVoid>>;
+        listSecretsForResource: z.ZodFunction<z.ZodTuple<readonly [z.ZodObject<{
+            resourceType: z.ZodLiteral<"integration">;
+            resourceId: z.ZodString;
+        }, z.core.$strict>], null>, z.ZodPromise<z.ZodReadonly<z.ZodArray<z.ZodObject<{
+            secretId: z.ZodString;
+        }, z.core.$strict>>>>>;
+        recordSecretUsage: z.ZodOptional<z.ZodFunction<z.ZodTuple<readonly [z.ZodObject<{
+            resourceType: z.ZodLiteral<"integration">;
+            resourceId: z.ZodString;
+            secretId: z.ZodString;
+        }, z.core.$strict>], null>, z.ZodPromise<z.ZodVoid>>>;
+    }, z.core.$strict>;
+    serviceId: z.ZodString;
+    scope: z.ZodEnum<{
+        user: "user";
+        platform: "platform";
+        project: "project";
+        org: "org";
+    }>;
+    scopeId: z.ZodString;
+}, z.core.$strict>;
+export type ListIntegrationServiceSecretsOptions = z.infer<typeof ListIntegrationServiceSecretsOptionsSchema>;
+export declare const ResolveIntegrationSecretOptionsSchema: z.ZodObject<{
+    runtime: z.ZodCustom<RuntimeRef, RuntimeRef>;
+    client: z.ZodObject<{
+        attachSecretToResource: z.ZodFunction<z.ZodTuple<readonly [z.ZodObject<{
+            secretId: z.ZodString;
+            resourceType: z.ZodLiteral<"integration">;
+            resourceId: z.ZodString;
+            attachedBy: z.ZodString;
+            purpose: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        }, z.core.$strict>], null>, z.ZodPromise<z.ZodVoid>>;
+        listSecretsForResource: z.ZodFunction<z.ZodTuple<readonly [z.ZodObject<{
+            resourceType: z.ZodLiteral<"integration">;
+            resourceId: z.ZodString;
+        }, z.core.$strict>], null>, z.ZodPromise<z.ZodReadonly<z.ZodArray<z.ZodObject<{
+            secretId: z.ZodString;
+        }, z.core.$strict>>>>>;
+        recordSecretUsage: z.ZodOptional<z.ZodFunction<z.ZodTuple<readonly [z.ZodObject<{
+            resourceType: z.ZodLiteral<"integration">;
+            resourceId: z.ZodString;
+            secretId: z.ZodString;
+        }, z.core.$strict>], null>, z.ZodPromise<z.ZodVoid>>>;
+    }, z.core.$strict>;
+    serviceId: z.ZodString;
+    secretName: z.ZodOptional<z.ZodString>;
+    providerType: z.ZodOptional<z.ZodString>;
+    reference: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        source: z.ZodLiteral<"secret">;
+        key: z.ZodString;
+        store: z.ZodOptional<z.ZodString>;
+        operation: z.ZodOptional<z.ZodCustom<object, object>>;
+    }, z.core.$strict>], "source">>;
+    scope: z.ZodEnum<{
+        user: "user";
+        platform: "platform";
+        project: "project";
+        org: "org";
+    }>;
+    scopeId: z.ZodString;
+    recordUsage: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strict>;
+export type ResolveIntegrationSecretOptions = z.infer<typeof ResolveIntegrationSecretOptionsSchema>;
+export type { CredentialReference, ManagedSecretScope };
+//# sourceMappingURL=integration-secrets.d.ts.map

package/dist/server/schemas/integration-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration-secrets.d.ts","sourceRoot":"","sources":["../../../src/server/schemas/integration-secrets.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAA6B,KAAK,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtG,OAAO,EAEN,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,MAAM,8BAA8B,CAAC;AAEtC,eAAO,MAAM,mCAAmC,6BAA2B,CAAC;AAC5E,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG,eAAO,MAAM,iCAAiC;;;;;;kBAMnC,CAAC;AACZ,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,eAAO,MAAM,iCAAiC;;;kBAGnC,CAAC;AACZ,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,eAAO,MAAM,kCAAkC;;kBAEpC,CAAC;AACZ,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,uFAAuF;AACvF,MAAM,MAAM,0BAA0B,GAAG,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,cAAc,GAAG,WAAW,CAAC,GAAG;IACpG,QAAQ,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,eAAO,MAAM,4BAA4B;;;;kBAI9B,CAAC;AACZ,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,kFAAkF;AAClF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;kBAa/B,CAAC;AACZ,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAUpF,eAAO,MAAM,oCAAoC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAStC,CAAC;AACZ,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG,eAAO,MAAM,0CAA0C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAM5C,CAAC;AACZ,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAE9G,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAUvC,CAAC;AACZ,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAEpG,YAAY,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,CAAC"}