@vibesdotdev/platform 0.0.0-stage → 1.0.0-rc.1

package/dist/schemas/tool-presentation.js

@@ -0,0 +1,25 @@
+/** Admission for partial tool payloads displayed while a tool is streaming.
+ * Unknown extension values stay intact; only fields used for presentation are narrowed.
+ */
+import * as z from 'zod/v4';
+export const ToolPresentationValueSchema = z.unknown();
+export const ToolRecordSchema = z.record(z.string(), z.unknown());
+export const ToolTextSchema = z.string().trim();
+export const ToolPrimitiveSchema = z.union([z.string(), z.number(), z.boolean(), z.bigint(), z.symbol(), z.function()]);
+export const ToolNumberSchema = z.number();
+export const ComponentCardRowSchema = z.object({
+    id: z.string(), slug: z.string(), name: z.string(), description: z.string(),
+    visibility: z.string(), publishedVersion: z.string(), editorUrl: z.string()
+});
+export const VersionCardRowSchema = z.object({
+    version: z.string(), publishedAt: z.string(), bundleHash: z.string(), warningCount: z.number()
+});
+export const ManifestCardRowSchema = z.object({
+    id: z.string(), name: z.string(), description: z.string(), dataType: z.string(),
+    scope: z.string(), namespace: z.string()
+});
+export const InspectedQueryDataSchema = z.discriminatedUnion('kind', [
+    z.object({ kind: z.literal('rows'), rows: ToolRecordSchema.array(), total: z.number() }),
+    z.object({ kind: z.literal('value'), value: z.unknown().optional() })
+]);
+//# sourceMappingURL=tool-presentation.js.map

package/dist/schemas/tool-presentation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-presentation.js","sourceRoot":"","sources":["../../src/schemas/tool-presentation.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,MAAM,CAAC,MAAM,2BAA2B,GAAC,CAAC,CAAC,OAAO,EAAE,CAAC;AAGrD,MAAM,CAAC,MAAM,gBAAgB,GAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,cAAc,GAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;AAC9C,MAAM,CAAC,MAAM,mBAAmB,GAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAC,CAAC,CAAC,MAAM,EAAE,EAAC,CAAC,CAAC,OAAO,EAAE,EAAC,CAAC,CAAC,MAAM,EAAE,EAAC,CAAC,CAAC,MAAM,EAAE,EAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;AACjH,MAAM,CAAC,MAAM,gBAAgB,GAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AAEzC,MAAM,CAAC,MAAM,sBAAsB,GAAC,CAAC,CAAC,MAAM,CAAC;IAC5C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACxE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,EAAC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACzE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAC,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,EAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,EAAC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;CAC3F,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAC,CAAC,CAAC,MAAM,CAAC;IAC3C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,EAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5E,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACvC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAC;IACjE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAC,IAAI,EAAE,gBAAgB,CAAC,KAAK,EAAE,EAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACtF,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAC,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;CACpE,CAAC,CAAC"}

package/dist/server/integration-accounts/account-client.d.ts

@@ -0,0 +1,14 @@
+import { type KindContext, type VibesRuntime } from '@vibesdotdev/kernel';
+import { BaseRuntimeClient, type RuntimeClientDescriptor } from '@vibesdotdev/kernel/client';
+import type { DrizzleDb } from '@vibesdotdev/storage/adapters/drizzle';
+import { SecretService } from './secret-service';
+import { type CreateAccount } from './schemas/account';
+export declare class IntegrationAccountsClient extends BaseRuntimeClient<VibesRuntime> {
+    private readonly database;
+    private readonly secretService;
+    constructor(descriptor: RuntimeClientDescriptor, context: KindContext<VibesRuntime>, database: (runtime: VibesRuntime) => DrizzleDb, secretService: (runtime: VibesRuntime, db: DrizzleDb) => SecretService);
+    private owner;
+    create(input: CreateAccount): Promise<string>;
+    disconnect(accountId: string): Promise<void>;
+}
+//# sourceMappingURL=account-client.d.ts.map

package/dist/server/integration-accounts/account-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-client.d.ts","sourceRoot":"","sources":["../../../src/server/integration-accounts/account-client.ts"],"names":[],"mappings":"AACA,OAAO,EAA2B,KAAK,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnG,OAAO,EAAE,iBAAiB,EAAE,KAAK,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAC7F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAC;AAKvE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAAwC,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAE7F,qBAAa,yBAA0B,SAAQ,iBAAiB,CAAC,YAAY,CAAC;IAE5E,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAFnB,UAAU,EAAE,uBAAuB,EAAE,OAAO,EAAE,WAAW,CAAC,YAAY,CAAC,EACjE,QAAQ,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,SAAS,EAC9C,aAAa,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,SAAS,KAAK,aAAa;IAGxF,OAAO,CAAC,KAAK;IAMP,MAAM,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC;IAgD7C,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAuBlD"}

package/dist/server/integration-accounts/account-client.js

@@ -0,0 +1,102 @@
+import { and, eq, isNull } from 'drizzle-orm';
+import { CapabilityError, settle } from '@vibesdotdev/kernel';
+import { BaseRuntimeClient } from '@vibesdotdev/kernel/client';
+import { integrations } from './integrations';
+import { secrets } from './secrets';
+import { resourceSecrets } from './resource-secrets';
+import { SecretService } from './secret-service';
+import { accountSecretContext } from './account-secrets';
+import { CreateAccountSchema, AccountIdSchema } from './schemas/account';
+export class IntegrationAccountsClient extends BaseRuntimeClient {
+    database;
+    secretService;
+    constructor(descriptor, context, database, secretService) {
+        super(descriptor, context);
+        this.database = database;
+        this.secretService = secretService;
+    }
+    owner() {
+        const context = accountSecretContext(this.runtime);
+        if (this.runtime.requestPrincipal().kind !== 'user')
+            throw new CapabilityError('Account management requires a user.', 'PERMISSION_DENIED', { reason: 'integration-account-principal-required' });
+        return context;
+    }
+    async create(input) {
+        const body = CreateAccountSchema.parse(input);
+        const owner = this.owner();
+        const db = this.database(this.runtime);
+        const service = this.secretService(this.runtime, db);
+        const descriptor = this.runtime.query('integration/provider').withId(body.type).firstDescriptor();
+        if (!descriptor || descriptor.enabled === false || !['messaging', 'email'].includes(descriptor.category))
+            throw new CapabilityError('Unsupported saved account.', 'INVALID_INPUT', { reason: 'integration-account-invalid' });
+        const declared = descriptor.credentials ?? [];
+        const values = Object.entries(body.credentials).filter(([, value]) => value.trim());
+        if (!values.length || Object.keys(body.credentials).some(key => !declared.some(field => field.source === 'secret' && field.key === key)) ||
+            declared.some(field => field.required && !body.credentials[field.key]?.trim()))
+            throw new CapabilityError('Invalid account credentials.', 'INVALID_INPUT', { reason: 'integration-account-invalid' });
+        const id = crypto.randomUUID();
+        const created = [];
+        const now = new Date();
+        const result = await settle(async () => {
+            for (const [key, value] of values) {
+                const secret = await service.create({ name: `${id}:${key}`, scope: owner.orgId ? 'org' : 'user',
+                    scopeId: owner.orgId ?? owner.userId, providerType: descriptor.provider, value,
+                    metadata: { integrationId: id, integrationName: body.name }
+                }, owner);
+                created.push(secret.id);
+            }
+            await db.insert(integrations).values({ id, userId: owner.userId, organizationId: owner.orgId,
+                name: body.name, description: body.description, type: body.type,
+                category: descriptor.category === 'email' ? 'email' : 'messaging',
+                secretId: created[0], config: body.config, status: 'pending', createdAt: now, updatedAt: now });
+            await db.insert(resourceSecrets).values(created.map((secretId, index) => ({
+                secretId, resourceType: 'integration', resourceId: id, purpose: values[index][0], attachedAt: now, attachedBy: owner.userId
+            })));
+            if (body.isDefault) {
+                const scope = owner.orgId ? eq(integrations.organizationId, owner.orgId) : and(eq(integrations.userId, owner.userId), isNull(integrations.organizationId));
+                await db.update(integrations).set({ isDefault: false, updatedAt: now }).where(and(scope, eq(integrations.category, descriptor.category === 'email' ? 'email' : 'messaging')));
+            }
+            await db.update(integrations).set({ status: 'active', isDefault: body.isDefault }).where(eq(integrations.id, id));
+            return id;
+        });
+        if (!result.ok) {
+            const cleanup = await settle(async () => {
+                await db.delete(resourceSecrets).where(and(eq(resourceSecrets.resourceType, 'integration'), eq(resourceSecrets.resourceId, id)));
+                await db.delete(integrations).where(eq(integrations.id, id));
+                for (const secretId of created)
+                    await service.delete(secretId, owner);
+            });
+            if (!cleanup.ok)
+                throw new AggregateError([result.cause, cleanup.cause], 'Account creation and cleanup failed.');
+            throw result.cause;
+        }
+        return result.value;
+    }
+    async disconnect(accountId) {
+        const id = AccountIdSchema.parse(accountId);
+        const owner = this.owner();
+        const db = this.database(this.runtime);
+        const filter = owner.orgId
+            ? and(eq(integrations.id, id), eq(integrations.organizationId, owner.orgId))
+            : and(eq(integrations.id, id), eq(integrations.userId, owner.userId), isNull(integrations.organizationId));
+        const [existing] = await db.select().from(integrations).where(filter).limit(1);
+        if (!existing || !existing.type.startsWith('integration.'))
+            throw new CapabilityError('Account not found.', 'NOT_FOUND', { reason: 'integration-account-not-found' });
+        const linked = await db.select({ secret: secrets, key: resourceSecrets.purpose }).from(resourceSecrets)
+            .innerJoin(secrets, eq(secrets.id, resourceSecrets.secretId))
+            .where(and(eq(resourceSecrets.resourceType, 'integration'), eq(resourceSecrets.resourceId, id)));
+        // Refuse execution before detaching credentials, including if cleanup fails.
+        await db.update(integrations).set({ status: 'inactive', updatedAt: new Date() }).where(filter);
+        await db.delete(resourceSecrets).where(and(eq(resourceSecrets.resourceType, 'integration'), eq(resourceSecrets.resourceId, id)));
+        const service = this.secretService(this.runtime, db);
+        for (const { secret, key } of linked) {
+            if (secret.name !== `${id}:${key}` || secret.scope !== (owner.orgId ? 'org' : 'user') || secret.scopeId !== (owner.orgId ?? owner.userId))
+                continue;
+            const stillUsed = await db.select({ id: resourceSecrets.resourceId }).from(resourceSecrets).where(eq(resourceSecrets.secretId, secret.id)).limit(1);
+            if (!stillUsed.length)
+                await service.delete(secret.id, owner);
+        }
+        await db.delete(integrations).where(filter);
+    }
+}
+//# sourceMappingURL=account-client.js.map

package/dist/server/integration-accounts/account-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-client.js","sourceRoot":"","sources":["../../../src/server/integration-accounts/account-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,EAAuC,MAAM,qBAAqB,CAAC;AACnG,OAAO,EAAE,iBAAiB,EAAgC,MAAM,4BAA4B,CAAC;AAG7F,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAsB,MAAM,mBAAmB,CAAC;AAE7F,MAAM,OAAO,yBAA0B,SAAQ,iBAA+B;IAE3D;IACA;IAFlB,YAAY,UAAmC,EAAE,OAAkC,EACjE,QAA8C,EAC9C,aAAsE;QACpF,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAFb,aAAQ,GAAR,QAAQ,CAAsC;QAC9C,kBAAa,GAAb,aAAa,CAAyD;IACxD,CAAC;IAEzB,KAAK;QACZ,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,IAAI,KAAK,MAAM;YAAE,MAAM,IAAI,eAAe,CAAC,qCAAqC,EAAE,mBAAmB,EAAE,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC,CAAC;QACjM,OAAO,OAAO,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAoB;QAChC,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACrD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAgC,sBAAsB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,CAAC;QACjI,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,4BAA4B,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC9N,MAAM,QAAQ,GAAG,UAAU,CAAC,WAAW,IAAI,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACpF,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;YACvI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,8BAA8B,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC,CAAC;QACvM,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,IAAI,EAAE;YACtC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;gBACnC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;oBAC9F,OAAO,EAAE,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,QAAQ,EAAE,KAAK;oBAC9E,QAAQ,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,CAAC,IAAI,EAAE;iBAC3D,EAAE,KAAK,CAAC,CAAC;gBACV,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACzB,CAAC;YACD,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,KAAK,CAAC,KAAK;gBAC3F,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI;gBAC/D,QAAQ,EAAE,UAAU,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW;gBACjE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;YAClG,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;gBACzE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM;aAC5H,CAAC,CAAC,CAAC,CAAC;YACL,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACpB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC;gBAC3J,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;YAC/K,CAAC;YACD,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;YAClH,OAAO,EAAE,CAAC;QACX,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,IAAI,EAAE;gBACxC,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,YAAY,EAAE,aAAa,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;gBACjI,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC7D,KAAK,MAAM,QAAQ,IAAI,OAAO;oBAAE,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YACtE,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,EAAE;gBAAE,MAAM,IAAI,cAAc,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,sCAAsC,CAAC,CAAC;YACjH,MAAM,MAAM,CAAC,KAAK,CAAC;QACpB,CAAC;QACD,OAAO,MAAM,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,SAAiB;QACjC,MAAM,EAAE,GAAG,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK;YACzB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAC5E,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC;QAC5G,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/E,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,oBAAoB,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC,CAAC;QACtK,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;aACrG,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC;aAC5D,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,YAAY,EAAE,aAAa,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAClG,6EAA6E;QAC7E,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/F,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,YAAY,EAAE,aAAa,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACjI,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACrD,KAAK,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,MAAM,EAAE,CAAC;YACtC,IAAI,MAAM,CAAC,IAAI,KAAK,GAAG,EAAE,IAAI,GAAG,EAAE,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;gBAAE,SAAS;YACpJ,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACpJ,IAAI,CAAC,SAAS,CAAC,MAAM;gBAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;CACD"}

package/dist/server/integration-accounts/account-secrets.d.ts

@@ -0,0 +1,10 @@
+import { type RuntimeRef, type VibesRuntime } from '@vibesdotdev/kernel';
+import type { SecretsStoreImplementation } from '@vibesdotdev/secrets/kinds/store.interface';
+import { SecretService } from './secret-service';
+import type { SecretServiceContext } from './secret-types';
+import type { DrizzleDb } from '@vibesdotdev/storage/adapters/drizzle';
+/** Re-read the invocation on every operation; a cached adapter never captures its first user. */
+export declare function accountSecretContext(runtime: RuntimeRef): SecretServiceContext;
+/** The existing SecretService owns record scope checks, encryption and usage auditing. */
+export declare function createAccountSecretsStore(runtime: VibesRuntime, db: DrizzleDb, service?: SecretService): SecretsStoreImplementation;
+//# sourceMappingURL=account-secrets.d.ts.map

package/dist/server/integration-accounts/account-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-secrets.d.ts","sourceRoot":"","sources":["../../../src/server/integration-accounts/account-secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,UAAU,EAAE,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAC1F,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAC;AAKvE,iGAAiG;AACjG,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,UAAU,GAAG,oBAAoB,CAkB9E;AAED,0FAA0F;AAC1F,wBAAgB,yBAAyB,CACxC,OAAO,EAAE,YAAY,EACrB,EAAE,EAAE,SAAS,EACb,OAAO,gBAAiC,GACtC,0BAA0B,CAwC5B"}

package/dist/server/integration-accounts/account-secrets.descriptor.d.ts

@@ -0,0 +1,4 @@
+import type { SecretsStoreDescriptor } from '@vibesdotdev/secrets/kinds/store.schema';
+/** Stable platform secret record IDs; never a generic host credential source. */
+export declare const accountSecretsDescriptor: SecretsStoreDescriptor;
+//# sourceMappingURL=account-secrets.descriptor.d.ts.map

package/dist/server/integration-accounts/account-secrets.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-secrets.descriptor.d.ts","sourceRoot":"","sources":["../../../src/server/integration-accounts/account-secrets.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AAEtF,iFAAiF;AACjF,eAAO,MAAM,wBAAwB,EAAE,sBAUtC,CAAC"}

package/dist/server/integration-accounts/account-secrets.descriptor.js

@@ -0,0 +1,13 @@
+/** Stable platform secret record IDs; never a generic host credential source. */
+export const accountSecretsDescriptor = {
+    id: 'platform-integration-accounts',
+    kind: 'secrets/store',
+    name: 'Platform integration account credentials',
+    description: 'Authorized, request-scoped access to saved account secret records by stable ID.',
+    backend: 'platform-integration-accounts',
+    selection: 'by-id',
+    tiers: ['local', 'dev', 'staging', 'production'],
+    priority: 0,
+    enabled: true
+};
+//# sourceMappingURL=account-secrets.descriptor.js.map

package/dist/server/integration-accounts/account-secrets.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-secrets.descriptor.js","sourceRoot":"","sources":["../../../src/server/integration-accounts/account-secrets.descriptor.ts"],"names":[],"mappings":"AAEA,iFAAiF;AACjF,MAAM,CAAC,MAAM,wBAAwB,GAA2B;IAC/D,EAAE,EAAE,+BAA+B;IACnC,IAAI,EAAE,eAAe;IACrB,IAAI,EAAE,0CAA0C;IAChD,WAAW,EAAE,iFAAiF;IAC9F,OAAO,EAAE,+BAA+B;IACxC,SAAS,EAAE,OAAO;IAClB,KAAK,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,CAAC;IAChD,QAAQ,EAAE,CAAC;IACX,OAAO,EAAE,IAAI;CACb,CAAC"}

package/dist/server/integration-accounts/account-secrets.js

@@ -0,0 +1,70 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { SecretService } from './secret-service';
+import { accountSecretsDescriptor } from './account-secrets.descriptor';
+import { resolveIntegrationConnection } from './connection-store';
+/** Re-read the invocation on every operation; a cached adapter never captures its first user. */
+export function accountSecretContext(runtime) {
+    const principal = runtime.requestPrincipal();
+    if (principal.kind === 'service' && principal.delegation && principal.onBehalfOf === principal.delegation.account.ownerId) {
+        const account = principal.delegation.account;
+        return { userId: account.ownerId, orgId: account.orgId, projectId: account.projectId };
+    }
+    if (principal.kind !== 'user') {
+        throw new CapabilityError('Saved account credentials require an authenticated user.', 'PERMISSION_DENIED', {
+            reason: 'integration-account-principal-required', retryable: false
+        });
+    }
+    return {
+        userId: principal.userId,
+        orgId: principal.orgId,
+        projectId: principal.projectId,
+        isSuperuser: principal.isSuperuser,
+        userRoles: [...(principal.roles ?? [])]
+    };
+}
+/** The existing SecretService owns record scope checks, encryption and usage auditing. */
+export function createAccountSecretsStore(runtime, db, service = new SecretService(db, runtime)) {
+    const unsupported = async () => {
+        throw new CapabilityError('Use the platform secret service to manage account records.', 'PERMISSION_DENIED', {
+            reason: 'integration-account-store-read-only', retryable: false
+        });
+    };
+    return {
+        id: accountSecretsDescriptor.id,
+        descriptor: accountSecretsDescriptor,
+        async get(tier, id) {
+            if (tier !== runtime.declaredScope.qualifiers?.environmentTier) {
+                throw new CapabilityError('Account credential tier does not match this host.', 'PERMISSION_DENIED', {
+                    reason: 'integration-account-tier-mismatch', retryable: false
+                });
+            }
+            const context = accountSecretContext(runtime);
+            const principal = runtime.requestPrincipal();
+            if (principal.kind === 'service') {
+                const account = principal.delegation?.account;
+                if (!account?.integrationId || !account.connectionId) {
+                    throw new CapabilityError('Delegated account credentials require an exact integration and connection.', 'PERMISSION_DENIED', {
+                        reason: 'integration-account-delegation-unbound', retryable: false
+                    });
+                }
+                const descriptor = runtime.query('integration/provider').withId(account.integrationId).firstDescriptor();
+                if (!descriptor)
+                    return undefined;
+                const admitted = await resolveIntegrationConnection(db, descriptor, { connectionId: account.connectionId }, {
+                    userId: context.userId, organizationId: context.orgId
+                });
+                if (!admitted.rows.some(row => row.secret.id === id))
+                    return undefined;
+            }
+            if (!await service.get(id, context))
+                return undefined;
+            return service.decrypt(id, context);
+        },
+        list: unsupported,
+        getAll: unsupported,
+        set: unsupported,
+        setAll: unsupported,
+        unset: unsupported
+    };
+}
+//# sourceMappingURL=account-secrets.js.map

package/dist/server/integration-accounts/account-secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-secrets.js","sourceRoot":"","sources":["../../../src/server/integration-accounts/account-secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAsC,MAAM,qBAAqB,CAAC;AAE1F,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGjD,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAGlE,iGAAiG;AACjG,MAAM,UAAU,oBAAoB,CAAC,OAAmB;IACvD,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAC7C,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,IAAI,SAAS,CAAC,UAAU,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3H,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC;QAC7C,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;IACxF,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC/B,MAAM,IAAI,eAAe,CAAC,0DAA0D,EAAE,mBAAmB,EAAE;YAC1G,MAAM,EAAE,wCAAwC,EAAE,SAAS,EAAE,KAAK;SAClE,CAAC,CAAC;IACJ,CAAC;IACD,OAAO;QACN,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,SAAS,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;KACvC,CAAC;AACH,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,yBAAyB,CACxC,OAAqB,EACrB,EAAa,EACb,OAAO,GAAG,IAAI,aAAa,CAAC,EAAE,EAAE,OAAO,CAAC;IAExC,MAAM,WAAW,GAAG,KAAK,IAAoB,EAAE;QAC9C,MAAM,IAAI,eAAe,CAAC,4DAA4D,EAAE,mBAAmB,EAAE;YAC5G,MAAM,EAAE,qCAAqC,EAAE,SAAS,EAAE,KAAK;SAC/D,CAAC,CAAC;IACJ,CAAC,CAAC;IACF,OAAO;QACN,EAAE,EAAE,wBAAwB,CAAC,EAAE;QAC/B,UAAU,EAAE,wBAAwB;QACpC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE;YACjB,IAAI,IAAI,KAAK,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE,eAAe,EAAE,CAAC;gBAChE,MAAM,IAAI,eAAe,CAAC,mDAAmD,EAAE,mBAAmB,EAAE;oBACnG,MAAM,EAAE,mCAAmC,EAAE,SAAS,EAAE,KAAK;iBAC7D,CAAC,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;YAC9C,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAC7C,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAClC,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC;gBAC9C,IAAI,CAAC,OAAO,EAAE,aAAa,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;oBACtD,MAAM,IAAI,eAAe,CAAC,4EAA4E,EAAE,mBAAmB,EAAE;wBAC5H,MAAM,EAAE,wCAAwC,EAAE,SAAS,EAAE,KAAK;qBAClE,CAAC,CAAC;gBACJ,CAAC;gBACD,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAgC,sBAAsB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,eAAe,EAAE,CAAC;gBACxI,IAAI,CAAC,UAAU;oBAAE,OAAO,SAAS,CAAC;gBAClC,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE;oBAC3G,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,CAAC,KAAK;iBACrD,CAAC,CAAC;gBACH,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;oBAAE,OAAO,SAAS,CAAC;YACxE,CAAC;YACD,IAAI,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC;gBAAE,OAAO,SAAS,CAAC;YACtD,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,EAAE,WAAW;QACjB,MAAM,EAAE,WAAW;QACnB,GAAG,EAAE,WAAW;QAChB,MAAM,EAAE,WAAW;QACnB,KAAK,EAAE,WAAW;KAClB,CAAC;AACH,CAAC"}

package/dist/server/integration-accounts/ci-job-secrets.d.ts

@@ -0,0 +1,23 @@
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+import type { CredentialResolution } from '@vibesdotdev/kernel/credentials';
+import type { SecretsStoreImplementation } from '@vibesdotdev/secrets/kinds/store.interface';
+import type { DrizzleDb } from '@vibesdotdev/storage/adapters/drizzle';
+import { CiJobSecretDelegationInputSchema, CiJobSecretReadRequestSchema, VerifiedCiJobSecretAuthoritySchema, type CiJobSecretAuthorityVerifier, type CiJobSecretDelegationInput, type CiJobSecretReadRequest, type VerifiedCiJobSecretAuthority } from './schemas/connection';
+import { SecretService } from './secret-service';
+export { CiJobSecretDelegationInputSchema, CiJobSecretReadRequestSchema, VerifiedCiJobSecretAuthoritySchema, type CiJobSecretAuthorityVerifier, type CiJobSecretDelegationInput, type CiJobSecretReadRequest, type VerifiedCiJobSecretAuthority };
+export declare const CI_JOB_SECRET_DELEGATION_VERIFIED_BY: "forge-ci.host-action-step";
+export declare function runWithCiJobSecretDelegation<T>(runtime: VibesRuntime, input: CiJobSecretDelegationInput, fn: () => Promise<T>): Promise<T>;
+export declare function resolveCiJobSecretCredential(runtime: VibesRuntime, input: CiJobSecretDelegationInput & {
+    secretName: string;
+}): Promise<CredentialResolution>;
+export declare function resolveCiJobSecretValue(runtime: VibesRuntime, input: CiJobSecretDelegationInput & {
+    secretName: string;
+}): Promise<string>;
+export declare function resolveCiJobSecretBindings(runtime: VibesRuntime, input: CiJobSecretDelegationInput & {
+    secretNames: readonly string[];
+}): Promise<Array<{
+    name: string;
+    value: string;
+}>>;
+export declare function createCiJobSecretsStore(runtime: VibesRuntime, db: DrizzleDb, service?: SecretService, authorizeCiSecretRead?: CiJobSecretAuthorityVerifier): SecretsStoreImplementation;
+//# sourceMappingURL=ci-job-secrets.d.ts.map

package/dist/server/integration-accounts/ci-job-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-job-secrets.d.ts","sourceRoot":"","sources":["../../../src/server/integration-accounts/ci-job-secrets.ts"],"names":[],"mappings":"AACA,OAAO,EAEW,KAAK,YAAY,EAClC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAC7F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAC;AAEvE,OAAO,EACN,gCAAgC,EAAE,4BAA4B,EAAyB,kCAAkC,EACzH,KAAK,4BAA4B,EAAE,KAAK,0BAA0B,EAClE,KAAK,sBAAsB,EAAE,KAAK,4BAA4B,EAC9D,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAIjD,OAAO,EACN,gCAAgC,EAAE,4BAA4B,EAAE,kCAAkC,EAClG,KAAK,4BAA4B,EAAE,KAAK,0BAA0B,EAClE,KAAK,sBAAsB,EAAE,KAAK,4BAA4B,EAC9D,CAAC;AAEF,eAAO,MAAM,oCAAoC,EAAG,2BAAoC,CAAC;AAgCzF,wBAAsB,4BAA4B,CAAC,CAAC,EACnD,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAC5E,OAAO,CAAC,CAAC,CAAC,CAuBZ;AAED,wBAAsB,4BAA4B,CACjD,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,0BAA0B,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GAC/E,OAAO,CAAC,oBAAoB,CAAC,CAK/B;AAED,wBAAsB,uBAAuB,CAC5C,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,0BAA0B,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GAC/E,OAAO,CAAC,MAAM,CAAC,CAIjB;AAED,wBAAsB,0BAA0B,CAC/C,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,0BAA0B,GAAG;IAAE,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC3F,OAAO,CAAC,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAWjD;AAuDD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,gBAAiC,EAAE,qBAAqB,CAAC,EAAE,4BAA4B,GAAG,0BAA0B,CA0BxM"}

package/dist/server/integration-accounts/ci-job-secrets.descriptor.d.ts

@@ -0,0 +1,4 @@
+import type { SecretsStoreDescriptor } from '@vibesdotdev/secrets/kinds/store.schema';
+export declare const CI_JOB_SECRETS_STORE_ID: "platform-ci-job-secrets";
+export declare const ciJobSecretsDescriptor: SecretsStoreDescriptor;
+//# sourceMappingURL=ci-job-secrets.descriptor.d.ts.map

package/dist/server/integration-accounts/ci-job-secrets.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-job-secrets.descriptor.d.ts","sourceRoot":"","sources":["../../../src/server/integration-accounts/ci-job-secrets.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AAEtF,eAAO,MAAM,uBAAuB,EAAG,yBAAkC,CAAC;AAE1E,eAAO,MAAM,sBAAsB,EAAE,sBAUpC,CAAC"}

package/dist/server/integration-accounts/ci-job-secrets.descriptor.js

@@ -0,0 +1,13 @@
+export const CI_JOB_SECRETS_STORE_ID = 'platform-ci-job-secrets';
+export const ciJobSecretsDescriptor = {
+    id: CI_JOB_SECRETS_STORE_ID,
+    kind: 'secrets/store',
+    name: 'Platform Forge CI job secrets',
+    description: 'Resolves owner-scoped encrypted platform secrets for verified Forge CI job steps.',
+    backend: CI_JOB_SECRETS_STORE_ID,
+    selection: 'by-id',
+    tiers: ['local', 'dev', 'staging', 'production'],
+    priority: 0,
+    enabled: true
+};
+//# sourceMappingURL=ci-job-secrets.descriptor.js.map

package/dist/server/integration-accounts/ci-job-secrets.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-job-secrets.descriptor.js","sourceRoot":"","sources":["../../../src/server/integration-accounts/ci-job-secrets.descriptor.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,uBAAuB,GAAG,yBAAkC,CAAC;AAE1E,MAAM,CAAC,MAAM,sBAAsB,GAA2B;IAC7D,EAAE,EAAE,uBAAuB;IAC3B,IAAI,EAAE,eAAe;IACrB,IAAI,EAAE,+BAA+B;IACrC,WAAW,EAAE,mFAAmF;IAChG,OAAO,EAAE,uBAAuB;IAChC,SAAS,EAAE,OAAO;IAClB,KAAK,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,CAAC;IAChD,QAAQ,EAAE,CAAC;IACX,OAAO,EAAE,IAAI;CACb,CAAC"}

package/dist/server/integration-accounts/ci-job-secrets.js

@@ -0,0 +1,168 @@
+import { and, eq } from 'drizzle-orm';
+import { CapabilityError, EnvironmentTierSchema } from '@vibesdotdev/kernel';
+import { CI_JOB_SECRETS_STORE_ID, ciJobSecretsDescriptor } from './ci-job-secrets.descriptor';
+import { CiJobSecretDelegationInputSchema, CiJobSecretReadRequestSchema, CredentialStateSchema, VerifiedCiJobSecretAuthoritySchema } from './schemas/connection';
+import { SecretService } from './secret-service';
+import { secrets } from './secrets';
+export { CiJobSecretDelegationInputSchema, CiJobSecretReadRequestSchema, VerifiedCiJobSecretAuthoritySchema };
+export const CI_JOB_SECRET_DELEGATION_VERIFIED_BY = 'forge-ci.host-action-step';
+const CI_JOB_SECRET_GRANT_TTL_MS = 60_000;
+const runtimeDelegationGrants = new WeakMap();
+function runtimeGrantTable(runtime) {
+    const key = runtime.rootIdentity ?? runtime;
+    let table = runtimeDelegationGrants.get(key);
+    if (!table) {
+        table = new WeakMap();
+        runtimeDelegationGrants.set(key, table);
+    }
+    return table;
+}
+function deny(message, reason, code = 'PERMISSION_DENIED') {
+    throw new CapabilityError(message, code, { reason, retryable: false });
+}
+function buildDelegatedPrincipal(parsed) {
+    if (parsed.ownerType === 'organization') {
+        return { kind: 'service', caller: 'platform.forge-ci-step-credential', delegation: { verifiedBy: CI_JOB_SECRET_DELEGATION_VERIFIED_BY, account: { ownerId: parsed.ownerId, orgId: parsed.ownerId } } };
+    }
+    return { kind: 'service', caller: 'platform.forge-ci-step-credential', onBehalfOf: parsed.ownerId, delegation: { verifiedBy: CI_JOB_SECRET_DELEGATION_VERIFIED_BY, account: { ownerId: parsed.ownerId } } };
+}
+export async function runWithCiJobSecretDelegation(runtime, input, fn) {
+    const parsed = Object.freeze(CiJobSecretDelegationInputSchema.parse(input));
+    const actor = parsed.ownerType === 'organization' ? { orgId: parsed.ownerId } : { userId: parsed.ownerId };
+    return runtime.runInvocation(async () => {
+        const activePrincipal = runtime.requestPrincipal();
+        const table = runtimeGrantTable(runtime);
+        if (table.has(activePrincipal))
+            deny('Forge CI job secret delegation principal cannot be reused.', 'ci-secret-delegation-invalid');
+        const grant = {
+            claims: parsed, active: true, expiresAt: Date.now() + CI_JOB_SECRET_GRANT_TTL_MS
+        };
+        table.set(activePrincipal, grant);
+        try {
+            return await fn();
+        }
+        finally {
+            grant.active = false;
+            table.delete(activePrincipal);
+        }
+    }, {
+        principal: buildDelegatedPrincipal(parsed),
+        actor,
+        actorReplaces: true,
+        tenancy: { ownerType: parsed.ownerType, ownerId: parsed.ownerId }
+    });
+}
+export async function resolveCiJobSecretCredential(runtime, input) {
+    const { secretName, ...delegation } = input;
+    return runWithCiJobSecretDelegation(runtime, delegation, () => runtime.resolveCredential({ source: 'secret', key: secretName, store: CI_JOB_SECRETS_STORE_ID }));
+}
+export async function resolveCiJobSecretValue(runtime, input) {
+    const resolution = await resolveCiJobSecretCredential(runtime, input);
+    if (!resolution.ok)
+        throw resolution.error;
+    return resolution.value;
+}
+export async function resolveCiJobSecretBindings(runtime, input) {
+    const { secretNames, ...delegation } = input;
+    return runWithCiJobSecretDelegation(runtime, delegation, async () => {
+        const bindings = [];
+        for (const name of new Set(secretNames)) {
+            const resolution = await runtime.resolveCredential({ source: 'secret', key: name, store: CI_JOB_SECRETS_STORE_ID });
+            if (!resolution.ok)
+                throw resolution.error;
+            bindings.push({ name, value: resolution.value });
+        }
+        return bindings;
+    });
+}
+function verifyDelegatedGrant(runtime) {
+    const principal = runtime.requestPrincipal();
+    if (principal.kind !== 'service' || !principal.delegation?.account)
+        deny('Forge CI job secrets require a delegated service principal.', 'ci-secret-principal-required');
+    const { account, verifiedBy } = principal.delegation;
+    const expectedOnBehalfOf = account.orgId ? undefined : account.ownerId;
+    if (verifiedBy !== CI_JOB_SECRET_DELEGATION_VERIFIED_BY || principal.onBehalfOf !== expectedOnBehalfOf || account.connectionId !== undefined || account.integrationId !== undefined || account.projectId !== undefined) {
+        deny('Forge CI job secret delegation is not bound to a verified host action step.', 'ci-secret-delegation-invalid');
+    }
+    if (account.orgId !== undefined && account.orgId !== account.ownerId)
+        deny('Forge CI job secret organization delegation does not match the owner identity.', 'ci-secret-owner-mismatch');
+    const grant = runtimeGrantTable(runtime).get(principal);
+    if (!grant || !grant.active || grant.expiresAt <= Date.now())
+        deny('Forge CI job secret read requires an active step delegation grant.', 'ci-secret-delegation-unbound');
+    const { claims } = grant;
+    const expectedOrgId = claims.ownerType === 'organization' ? claims.ownerId : undefined;
+    const expectedUserId = claims.ownerType === 'user' ? claims.ownerId : undefined;
+    const { actor, tenancy } = runtime.scope;
+    if (claims.ownerType !== (account.orgId ? 'organization' : 'user') || claims.ownerId !== account.ownerId || actor?.userId !== expectedUserId || actor?.orgId !== expectedOrgId || (tenancy !== undefined && (tenancy.ownerType !== claims.ownerType || tenancy.ownerId !== claims.ownerId))) {
+        deny('Forge CI job secret delegation grant does not match the delegated owner.', 'ci-secret-owner-mismatch');
+    }
+    return grant;
+}
+async function resolvePersistedAuthority(runtime, db, storeVerifier, grant, secretName) {
+    const { claims } = grant;
+    const parsedRequest = CiJobSecretReadRequestSchema.safeParse({ ...claims, secretName });
+    if (!parsedRequest.success)
+        deny('Forge CI job secret name is invalid.', 'ci-secret-name-invalid');
+    if (!storeVerifier)
+        deny('Forge CI job secret authority verifier is not configured on this host store.', 'ci-secret-authority-not-configured', 'UNAVAILABLE');
+    const rawAuthority = await storeVerifier(runtime, db, parsedRequest.data);
+    if (!rawAuthority)
+        deny('Forge CI host action step has no live persisted authority.', 'ci-secret-action-unauthorized');
+    if (!EnvironmentTierSchema.safeParse(rawAuthority.targetTier).success)
+        deny('Forge CI job or step did not attest a valid target environment tier.', 'ci-secret-tier-undeclared');
+    const parsed = VerifiedCiJobSecretAuthoritySchema.safeParse(rawAuthority);
+    if (!parsed.success || parsed.data.actionRunId !== claims.actionRunId || parsed.data.step !== claims.step || parsed.data.ownerType !== claims.ownerType || parsed.data.ownerId !== claims.ownerId) {
+        deny('Forge CI persisted authority does not match the delegated action, step, or owner.', 'ci-secret-action-unauthorized');
+    }
+    if (!parsed.data.allowedSecrets.includes(secretName))
+        deny('Requested secret is not declared on the persisted Forge CI job or step.', 'ci-secret-not-declared');
+    const context = claims.ownerType === 'organization' ? { orgId: claims.ownerId } : { userId: claims.ownerId };
+    return { context, targetTier: parsed.data.targetTier };
+}
+function selectActiveSecret(rows) {
+    if (rows.length === 0)
+        return undefined;
+    for (const row of rows) {
+        const state = CredentialStateSchema.safeParse(row.metadata ?? {});
+        const expiry = state.success && state.data.expiresAt != null ? Date.parse(state.data.expiresAt) : undefined;
+        if (!state.success || state.data.status === 'disconnected' || state.data.status === 'revoked' || (expiry !== undefined && (Number.isNaN(expiry) || expiry <= Date.now()))) {
+            deny('Forge CI job secret record is revoked, disconnected, or expired.', 'ci-secret-record-inactive');
+        }
+    }
+    if (rows.length > 1)
+        deny('Multiple secret records matched the same owner and secret name on this host tier.', 'ci-secret-duplicate-record', 'CONFLICT');
+    return rows[0];
+}
+export function createCiJobSecretsStore(runtime, db, service = new SecretService(db, runtime), authorizeCiSecretRead) {
+    const unsupported = async () => deny('Forge CI job secrets store is read-only.', 'ci-secret-store-read-only');
+    return {
+        id: ciJobSecretsDescriptor.id, descriptor: ciJobSecretsDescriptor,
+        async get(kernelTier, key) {
+            const parsedKernelTier = EnvironmentTierSchema.safeParse(kernelTier);
+            const hostTier = EnvironmentTierSchema.safeParse(runtime.declaredScope.qualifiers?.environmentTier);
+            const scopeTier = EnvironmentTierSchema.safeParse(runtime.scope.qualifiers?.environmentTier);
+            if (!parsedKernelTier.success || !hostTier.success || !scopeTier.success)
+                deny('Kernel or host did not supply a valid environment tier.', 'ci-secret-tier-undeclared');
+            if (parsedKernelTier.data !== hostTier.data || scopeTier.data !== hostTier.data)
+                deny('Forge CI job secret tier does not match this host environment tier.', 'ci-secret-tier-mismatch');
+            const grant = verifyDelegatedGrant(runtime);
+            if (grant.claims.targetTier !== undefined && grant.claims.targetTier !== parsedKernelTier.data)
+                deny('Delegated Forge CI step target tier does not match the active host environment tier.', 'ci-secret-tier-mismatch');
+            const { context, targetTier } = await resolvePersistedAuthority(runtime, db, authorizeCiSecretRead, grant, key);
+            if (targetTier !== parsedKernelTier.data || targetTier !== hostTier.data)
+                deny('Persisted Forge CI step target tier does not match the kernel and host environment tier.', 'ci-secret-tier-mismatch');
+            const scope = grant.claims.ownerType === 'organization' ? 'org' : 'user';
+            const candidates = await db.select().from(secrets).where(and(eq(secrets.scope, scope), eq(secrets.scopeId, grant.claims.ownerId), eq(secrets.name, key)));
+            const readable = [];
+            for (const candidate of candidates) {
+                const verified = await service.get(candidate.id, context);
+                if (verified)
+                    readable.push(verified);
+            }
+            const selected = selectActiveSecret(readable);
+            return selected ? service.decrypt(selected.id, context) : undefined;
+        },
+        list: unsupported, getAll: unsupported, set: unsupported, setAll: unsupported, unset: unsupported
+    };
+}
+//# sourceMappingURL=ci-job-secrets.js.map

package/dist/server/integration-accounts/ci-job-secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-job-secrets.js","sourceRoot":"","sources":["../../../src/server/integration-accounts/ci-job-secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EACN,eAAe,EAAE,qBAAqB,EAEtC,MAAM,qBAAqB,CAAC;AAI7B,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAC9F,OAAO,EACN,gCAAgC,EAAE,4BAA4B,EAAE,qBAAqB,EAAE,kCAAkC,EAGzH,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAAE,OAAO,EAAe,MAAM,WAAW,CAAC;AAEjD,OAAO,EACN,gCAAgC,EAAE,4BAA4B,EAAE,kCAAkC,EAGlG,CAAC;AAEF,MAAM,CAAC,MAAM,oCAAoC,GAAG,2BAAoC,CAAC;AACzF,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAQ1C,MAAM,uBAAuB,GAAG,IAAI,OAAO,EAA6D,CAAC;AAEzG,SAAS,iBAAiB,CAAC,OAAmB;IAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC;IAC5C,IAAI,KAAK,GAAG,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,KAAK,GAAG,IAAI,OAAO,EAA4C,CAAC;QAChE,uBAAuB,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,IAAI,CAAC,OAAe,EAAE,MAAc,EAAE,OAAyD,mBAAmB;IAC1H,MAAM,IAAI,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,uBAAuB,CAAC,MAA4C;IAC5E,IAAI,MAAM,CAAC,SAAS,KAAK,cAAc,EAAE,CAAC;QACzC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,mCAAmC,EAAE,UAAU,EAAE,EAAE,UAAU,EAAE,oCAAoC,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC;IACxM,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,mCAAmC,EAAE,UAAU,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,UAAU,EAAE,oCAAoC,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC;AAC7M,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CACjD,OAAqB,EAAE,KAAiC,EAAE,EAAoB;IAE9E,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,gCAAgC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAC3G,OAAO,OAAO,CAAC,aAAa,CAAC,KAAK,IAAI,EAAE;QACvC,MAAM,eAAe,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC;YAAE,IAAI,CAAC,4DAA4D,EAAE,8BAA8B,CAAC,CAAC;QACnI,MAAM,KAAK,GAA2B;YACrC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,0BAA0B;SAChF,CAAC;QACF,KAAK,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC;YACJ,OAAO,MAAM,EAAE,EAAE,CAAC;QACnB,CAAC;gBAAS,CAAC;YACV,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC;YACrB,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC/B,CAAC;IACF,CAAC,EAAE;QACF,SAAS,EAAE,uBAAuB,CAAC,MAAM,CAAC;QAC1C,KAAK;QACL,aAAa,EAAE,IAAI;QACnB,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;KACjE,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CACjD,OAAqB,EAAE,KAA0D;IAEjF,MAAM,EAAE,UAAU,EAAE,GAAG,UAAU,EAAE,GAAG,KAAK,CAAC;IAC5C,OAAO,4BAA4B,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAC7D,OAAO,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAChG,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC5C,OAAqB,EAAE,KAA0D;IAEjF,MAAM,UAAU,GAAG,MAAM,4BAA4B,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACtE,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,MAAM,UAAU,CAAC,KAAK,CAAC;IAC3C,OAAO,UAAU,CAAC,KAAK,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC/C,OAAqB,EAAE,KAAsE;IAE7F,MAAM,EAAE,WAAW,EAAE,GAAG,UAAU,EAAE,GAAG,KAAK,CAAC;IAC7C,OAAO,4BAA4B,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,QAAQ,GAA2C,EAAE,CAAC;QAC5D,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YACzC,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;YACpH,IAAI,CAAC,UAAU,CAAC,EAAE;gBAAE,MAAM,UAAU,CAAC,KAAK,CAAC;YAC3C,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,QAAQ,CAAC;IACjB,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAmB;IAChD,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAC7C,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,OAAO;QAAE,IAAI,CAAC,6DAA6D,EAAE,8BAA8B,CAAC,CAAC;IACxK,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,SAAS,CAAC,UAAU,CAAC;IACrD,MAAM,kBAAkB,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACvE,IAAI,UAAU,KAAK,oCAAoC,IAAI,SAAS,CAAC,UAAU,KAAK,kBAAkB,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACxN,IAAI,CAAC,6EAA6E,EAAE,8BAA8B,CAAC,CAAC;IACrH,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,OAAO;QAAE,IAAI,CAAC,gFAAgF,EAAE,0BAA0B,CAAC,CAAC;IACzL,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACxD,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;QAAE,IAAI,CAAC,oEAAoE,EAAE,8BAA8B,CAAC,CAAC;IACzK,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACzB,MAAM,aAAa,GAAG,MAAM,CAAC,SAAS,KAAK,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACvF,MAAM,cAAc,GAAG,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;IACzC,IAAI,MAAM,CAAC,SAAS,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,IAAI,KAAK,EAAE,MAAM,KAAK,cAAc,IAAI,KAAK,EAAE,KAAK,KAAK,aAAa,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC7R,IAAI,CAAC,0EAA0E,EAAE,0BAA0B,CAAC,CAAC;IAC9G,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,KAAK,UAAU,yBAAyB,CACvC,OAAqB,EAAE,EAAa,EAAE,aAAuD,EAAE,KAA6B,EAAE,UAAkB;IAEhJ,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACzB,MAAM,aAAa,GAAG,4BAA4B,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACxF,IAAI,CAAC,aAAa,CAAC,OAAO;QAAE,IAAI,CAAC,sCAAsC,EAAE,wBAAwB,CAAC,CAAC;IACnG,IAAI,CAAC,aAAa;QAAE,IAAI,CAAC,8EAA8E,EAAE,oCAAoC,EAAE,aAAa,CAAC,CAAC;IAC9J,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,EAAE,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC;IAC1E,IAAI,CAAC,YAAY;QAAE,IAAI,CAAC,4DAA4D,EAAE,+BAA+B,CAAC,CAAC;IACvH,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,OAAO;QAAE,IAAI,CAAC,sEAAsE,EAAE,2BAA2B,CAAC,CAAC;IACjL,MAAM,MAAM,GAAG,kCAAkC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAC1E,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;QACnM,IAAI,CAAC,mFAAmF,EAAE,+BAA+B,CAAC,CAAC;IAC5H,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,IAAI,CAAC,yEAAyE,EAAE,wBAAwB,CAAC,CAAC;IAChK,MAAM,OAAO,GAAsB,MAAM,CAAC,SAAS,KAAK,cAAc,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAChI,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAc;IACzC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,qBAAqB,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5G,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,cAAc,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;YAC3K,IAAI,CAAC,kEAAkE,EAAE,2BAA2B,CAAC,CAAC;QACvG,CAAC;IACF,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,mFAAmF,EAAE,4BAA4B,EAAE,UAAU,CAAC,CAAC;IACzJ,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAAqB,EAAE,EAAa,EAAE,OAAO,GAAG,IAAI,aAAa,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,qBAAoD;IAC3K,MAAM,WAAW,GAAG,KAAK,IAAoB,EAAE,CAAC,IAAI,CAAC,0CAA0C,EAAE,2BAA2B,CAAC,CAAC;IAC9H,OAAO;QACN,EAAE,EAAE,sBAAsB,CAAC,EAAE,EAAE,UAAU,EAAE,sBAAsB;QACjE,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG;YACxB,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;YACrE,MAAM,QAAQ,GAAG,qBAAqB,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;YACpG,MAAM,SAAS,GAAG,qBAAqB,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;YAC7F,IAAI,CAAC,gBAAgB,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO;gBAAE,IAAI,CAAC,yDAAyD,EAAE,2BAA2B,CAAC,CAAC;YACvK,IAAI,gBAAgB,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;gBAAE,IAAI,CAAC,qEAAqE,EAAE,yBAAyB,CAAC,CAAC;YACxL,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;YAC5C,IAAI,KAAK,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC,UAAU,KAAK,gBAAgB,CAAC,IAAI;gBAAE,IAAI,CAAC,sFAAsF,EAAE,yBAAyB,CAAC,CAAC;YACxN,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,yBAAyB,CAAC,OAAO,EAAE,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YAChH,IAAI,UAAU,KAAK,gBAAgB,CAAC,IAAI,IAAI,UAAU,KAAK,QAAQ,CAAC,IAAI;gBAAE,IAAI,CAAC,0FAA0F,EAAE,yBAAyB,CAAC,CAAC;YACtM,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,SAAS,KAAK,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;YACzE,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;YAC1J,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;gBACpC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;gBAC1D,IAAI,QAAQ;oBAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvC,CAAC;YACD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAC9C,OAAO,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,CAAC;QACD,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW;KACjG,CAAC;AACH,CAAC"}

package/dist/server/integration-accounts/connect-routes.d.ts

@@ -0,0 +1,10 @@
+import { IntegrationConnectRouteSchema, resolvePlatformIntegrationConnectRoute, isPlatformIntegrationConnectable, PLATFORM_INTEGRATION_CONNECT_ROUTE_KIND } from '../../integration-connect.ts';
+import type { IntegrationConnectRoute, PlatformIntegrationConnectRouteDescriptor } from '../../integration-connect.ts';
+export declare const INTEGRATION_PROVIDER_KIND = "integration/provider";
+export { IntegrationConnectRouteSchema };
+export type { IntegrationConnectRoute };
+export type IntegrationConnectDeclaration = PlatformIntegrationConnectRouteDescriptor;
+export declare function resolveIntegrationConnectRoute(runtime: Parameters<typeof resolvePlatformIntegrationConnectRoute>[0], integrationId: string): IntegrationConnectRoute;
+export declare function isIntegrationConnectable(runtime: Parameters<typeof isPlatformIntegrationConnectable>[0], integrationId: string): boolean;
+export { PLATFORM_INTEGRATION_CONNECT_ROUTE_KIND };
+//# sourceMappingURL=connect-routes.d.ts.map

package/dist/server/integration-accounts/connect-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-routes.d.ts","sourceRoot":"","sources":["../../../src/server/integration-accounts/connect-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,6BAA6B,EAC7B,sCAAsC,EACtC,gCAAgC,EAChC,uCAAuC,EACvC,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EACX,uBAAuB,EACvB,yCAAyC,EACzC,MAAM,8BAA8B,CAAC;AAEtC,eAAO,MAAM,yBAAyB,yBAAyB,CAAC;AAChE,OAAO,EAAE,6BAA6B,EAAE,CAAC;AACzC,YAAY,EAAE,uBAAuB,EAAE,CAAC;AACxC,MAAM,MAAM,6BAA6B,GAAG,yCAAyC,CAAC;AAEtF,wBAAgB,8BAA8B,CAC7C,OAAO,EAAE,UAAU,CAAC,OAAO,sCAAsC,CAAC,CAAC,CAAC,CAAC,EACrE,aAAa,EAAE,MAAM,GACnB,uBAAuB,CAGzB;AAED,wBAAgB,wBAAwB,CACvC,OAAO,EAAE,UAAU,CAAC,OAAO,gCAAgC,CAAC,CAAC,CAAC,CAAC,EAC/D,aAAa,EAAE,MAAM,GACnB,OAAO,CAET;AAED,OAAO,EAAE,uCAAuC,EAAE,CAAC"}

package/dist/server/integration-accounts/connect-routes.js

@@ -0,0 +1,12 @@
+import { IntegrationConnectRouteSchema, resolvePlatformIntegrationConnectRoute, isPlatformIntegrationConnectable, PLATFORM_INTEGRATION_CONNECT_ROUTE_KIND } from "../../integration-connect.js";
+export const INTEGRATION_PROVIDER_KIND = 'integration/provider';
+export { IntegrationConnectRouteSchema };
+export function resolveIntegrationConnectRoute(runtime, integrationId) {
+    const descriptor = resolvePlatformIntegrationConnectRoute(runtime, integrationId);
+    return { integrationId: descriptor.integrationId, route: descriptor.route };
+}
+export function isIntegrationConnectable(runtime, integrationId) {
+    return isPlatformIntegrationConnectable(runtime, integrationId);
+}
+export { PLATFORM_INTEGRATION_CONNECT_ROUTE_KIND };
+//# sourceMappingURL=connect-routes.js.map

package/dist/server/integration-accounts/connect-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-routes.js","sourceRoot":"","sources":["../../../src/server/integration-accounts/connect-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,6BAA6B,EAC7B,sCAAsC,EACtC,gCAAgC,EAChC,uCAAuC,EACvC,MAAM,8BAA8B,CAAC;AAMtC,MAAM,CAAC,MAAM,yBAAyB,GAAG,sBAAsB,CAAC;AAChE,OAAO,EAAE,6BAA6B,EAAE,CAAC;AAIzC,MAAM,UAAU,8BAA8B,CAC7C,OAAqE,EACrE,aAAqB;IAErB,MAAM,UAAU,GAAG,sCAAsC,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAClF,OAAO,EAAE,aAAa,EAAE,UAAU,CAAC,aAAa,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,wBAAwB,CACvC,OAA+D,EAC/D,aAAqB;IAErB,OAAO,gCAAgC,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AACjE,CAAC;AAED,OAAO,EAAE,uCAAuC,EAAE,CAAC"}

package/dist/server/integration-accounts/connection-store.d.ts

@@ -0,0 +1,24 @@
+import { type IntegrationConnectionActor, type IntegrationConnectionSelector, type IntegrationProviderDescriptor, type IntegrationProviderResolvedConfiguration } from '@vibesdotdev/integrations/schemas/integration-descriptor';
+import type { DrizzleDb } from '@vibesdotdev/storage/adapters/drizzle';
+import { type Secret } from './secrets';
+import { CapabilityError, type RuntimeRef } from '@vibesdotdev/kernel';
+type PlatformDb = DrizzleDb;
+export declare class IntegrationConnectionUnavailableError extends CapabilityError {
+    constructor();
+}
+/** Shared admission for status and execution; this phase never decrypts or writes. */
+export declare function resolveIntegrationConnection(db: PlatformDb, descriptor: IntegrationProviderDescriptor, selector: Readonly<IntegrationConnectionSelector>, actor: Readonly<IntegrationConnectionActor>): Promise<{
+    config: IntegrationProviderResolvedConfiguration['config'];
+    rows: Array<{
+        key: string;
+        secret: Secret;
+    }>;
+}>;
+/** Saved-account readiness, not a live provider health check. No secret values leave storage. */
+export declare function isIntegrationConnectionReady(db: PlatformDb, descriptor: IntegrationProviderDescriptor, selector: Readonly<IntegrationConnectionSelector>, actor: Readonly<IntegrationConnectionActor>): Promise<boolean>;
+/** Return the exact admitted row identities without resolving a credential value. */
+export declare function loadIntegrationConnectionReferences(db: PlatformDb, runtime: RuntimeRef, descriptor: IntegrationProviderDescriptor, selector: Readonly<IntegrationConnectionSelector>, actor: Readonly<IntegrationConnectionActor>): Promise<IntegrationProviderResolvedConfiguration>;
+/** Compatibility value delivery resolves only the saved account's own rows. */
+export declare function loadIntegrationConnection(db: PlatformDb, runtime: RuntimeRef, descriptor: IntegrationProviderDescriptor, selector: Readonly<IntegrationConnectionSelector>, actor: Readonly<IntegrationConnectionActor>): Promise<IntegrationProviderResolvedConfiguration>;
+export {};
+//# sourceMappingURL=connection-store.d.ts.map