@vibesdotdev/platform 0.0.0-stage → 1.0.0-rc.2

package/dist/server/integration-accounts/connection-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-store.d.ts","sourceRoot":"","sources":["../../../src/server/integration-accounts/connection-store.ts"],"names":[],"mappings":"AACA,OAAO,EAEN,KAAK,0BAA0B,EAC/B,KAAK,6BAA6B,EAElC,KAAK,6BAA6B,EAClC,KAAK,wCAAwC,EAC7C,MAAM,0DAA0D,CAAC;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAC;AAEvE,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,eAAe,EAAU,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAM/E,KAAK,UAAU,GAAG,SAAS,CAAC;AAE5B,qBAAa,qCAAsC,SAAQ,eAAe;;CAKzE;AAMD,sFAAsF;AACtF,wBAAsB,4BAA4B,CACjD,EAAE,EAAE,UAAU,EACd,UAAU,EAAE,6BAA6B,EACzC,QAAQ,EAAE,QAAQ,CAAC,6BAA6B,CAAC,EACjD,KAAK,EAAE,QAAQ,CAAC,0BAA0B,CAAC,GACzC,OAAO,CAAC;IAAE,MAAM,EAAE,wCAAwC,CAAC,QAAQ,CAAC,CAAC;IAAC,IAAI,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC,CA+FvH;AAED,iGAAiG;AACjG,wBAAsB,4BAA4B,CACjD,EAAE,EAAE,UAAU,EACd,UAAU,EAAE,6BAA6B,EACzC,QAAQ,EAAE,QAAQ,CAAC,6BAA6B,CAAC,EACjD,KAAK,EAAE,QAAQ,CAAC,0BAA0B,CAAC,GACzC,OAAO,CAAC,OAAO,CAAC,CAKlB;AAoBD,qFAAqF;AACrF,wBAAsB,mCAAmC,CACxD,EAAE,EAAE,UAAU,EACd,OAAO,EAAE,UAAU,EACnB,UAAU,EAAE,6BAA6B,EACzC,QAAQ,EAAE,QAAQ,CAAC,6BAA6B,CAAC,EACjD,KAAK,EAAE,QAAQ,CAAC,0BAA0B,CAAC,GACzC,OAAO,CAAC,wCAAwC,CAAC,CASnD;AAED,+EAA+E;AAC/E,wBAAsB,yBAAyB,CAC9C,EAAE,EAAE,UAAU,EACd,OAAO,EAAE,UAAU,EACnB,UAAU,EAAE,6BAA6B,EACzC,QAAQ,EAAE,QAAQ,CAAC,6BAA6B,CAAC,EACjD,KAAK,EAAE,QAAQ,CAAC,0BAA0B,CAAC,GACzC,OAAO,CAAC,wCAAwC,CAAC,CAUnD"}

package/dist/server/integration-accounts/connection-store.js

@@ -0,0 +1,161 @@
+import { and, eq } from 'drizzle-orm';
+import { IntegrationProviderResolvedConfigurationSchema } from '@vibesdotdev/integrations/schemas/integration-descriptor';
+import { integrations } from './integrations';
+import { secrets } from './secrets';
+import { CapabilityError, settle } from '@vibesdotdev/kernel';
+import { accountSecretContext } from './account-secrets';
+import { accountSecretsDescriptor } from './account-secrets.descriptor';
+import { resourceSecrets } from './resource-secrets';
+import { ConnectionConfigSchema, MailIdentitySchema, CredentialStateSchema } from './schemas/connection';
+export class IntegrationConnectionUnavailableError extends CapabilityError {
+    constructor() {
+        super('Selected integration account is unavailable. Reconnect or select another account.', 'UNAVAILABLE', { reason: 'integration-connection-unavailable' });
+        this.name = 'IntegrationConnectionUnavailableError';
+    }
+}
+function unavailable() {
+    throw new IntegrationConnectionUnavailableError();
+}
+/** Shared admission for status and execution; this phase never decrypts or writes. */
+export async function resolveIntegrationConnection(db, descriptor, selector, actor) {
+    if (!actor.userId || !selector.connectionId.trim() || descriptor.enabled === false)
+        unavailable();
+    const scope = actor.organizationId ? 'org' : 'user';
+    const actorId = actor.organizationId ?? actor.userId;
+    const connectionId = selector.connectionId;
+    const declaredCredentials = descriptor.credentials ?? [];
+    const [saved] = await db.select().from(integrations).where(eq(integrations.id, connectionId)).limit(1);
+    // Scope-group IDs and saved integration UUIDs are two existing owner-backed
+    // representations, not interchangeable identifiers. A collision is ambiguous.
+    const groupAllowed = connectionId === actorId || connectionId.startsWith(`${actorId}:`);
+    const group = groupAllowed
+        ? await db.select().from(secrets).where(and(eq(secrets.scope, scope), eq(secrets.scopeId, connectionId), eq(secrets.providerType, descriptor.provider)))
+        : [];
+    if (saved && group.length)
+        unavailable();
+    let rows = [];
+    let config = {};
+    if (saved) {
+        const owned = actor.organizationId
+            ? saved.organizationId === actor.organizationId
+            : !saved.organizationId && saved.userId === actor.userId;
+        // A saved account belongs to exactly the descriptor whose id its `type`
+        // names; descriptors declare no legacy account-type list. Credential keys
+        // come from exact `resource_secrets` associations, including multi-key
+        // providers.
+        if (!owned || saved.status !== 'active' || saved.type !== descriptor.id)
+            unavailable();
+        const linked = await db.select({ secret: secrets, key: resourceSecrets.purpose }).from(resourceSecrets)
+            .leftJoin(secrets, eq(secrets.id, resourceSecrets.secretId))
+            .where(and(eq(resourceSecrets.resourceType, 'integration'), eq(resourceSecrets.resourceId, saved.id)));
+        if (linked.length === 0) {
+            throw new CapabilityError(`Saved integration account "${saved.id}" has no credential associations.`, 'UNAVAILABLE', { reason: 'integration-credential-association-missing', details: { integrationId: descriptor.id } });
+        }
+        const keys = new Set();
+        for (const { secret, key } of linked) {
+            if (key === null) {
+                throw new CapabilityError(`Saved integration account "${saved.id}" has an association without a credential key.`, 'INVALID_INPUT', { reason: 'integration-credential-association-incomplete', details: { integrationId: descriptor.id } });
+            }
+            if (!secret || secret.scope !== scope || secret.scopeId !== actorId || secret.providerType !== descriptor.provider ||
+                !declaredCredentials.some((source) => source.source === 'secret' && source.key === key) || keys.has(key))
+                unavailable();
+            keys.add(key);
+            rows.push({ key, secret });
+        }
+        // A saved account may use only the exact secret records named by its
+        // associations. The legacy `secret_id` is an integrity check, never a
+        // fallback that can borrow an unrelated association's key.
+        if (!rows.some(({ secret }) => secret.id === saved.secretId))
+            unavailable();
+        const parsed = ConnectionConfigSchema.safeParse(saved.config ?? {});
+        if (!parsed.success)
+            unavailable();
+        config = { ...parsed.data };
+        const mailIdentity = MailIdentitySchema.safeParse(config);
+        if (mailIdentity.success && mailIdentity.data.fromEmail) {
+            const { fromEmail, fromName } = mailIdentity.data;
+            config.defaultFrom = fromName ? `${fromName} <${fromEmail}>` : fromEmail;
+        }
+    }
+    else {
+        if (!groupAllowed || group.length === 0)
+            unavailable();
+        const credentialKeys = new Set(declaredCredentials
+            .filter((source) => source.source === 'secret')
+            .map((source) => source.key));
+        const seen = new Set();
+        for (const secret of group) {
+            if (!credentialKeys.has(secret.name))
+                continue;
+            if (seen.has(secret.name))
+                unavailable();
+            seen.add(secret.name);
+            rows.push({ key: secret.name, secret });
+        }
+        if (rows.length === 0)
+            unavailable();
+    }
+    // Validate the whole selected bundle before decrypting any row. A partial
+    // duplicate/expired bundle is not permission to pick a different credential.
+    for (const { secret } of rows) {
+        const parsedState = CredentialStateSchema.safeParse(secret.metadata ?? {});
+        if (!parsedState.success)
+            unavailable();
+        const metadata = parsedState.data;
+        if (metadata.status === 'disconnected' || metadata.status === 'revoked')
+            unavailable();
+        if (metadata.expiresAt != null) {
+            const expiry = Date.parse(metadata.expiresAt);
+            if (!Number.isFinite(expiry) || expiry <= Date.now())
+                unavailable();
+        }
+    }
+    const keys = new Set(rows.map((row) => row.key));
+    if (declaredCredentials.some((source) => source.required && !keys.has(source.key)))
+        unavailable();
+    return { config, rows };
+}
+/** Saved-account readiness, not a live provider health check. No secret values leave storage. */
+export async function isIntegrationConnectionReady(db, descriptor, selector, actor) {
+    const result = await settle(() => resolveIntegrationConnection(db, descriptor, selector, actor));
+    if (result.ok)
+        return true;
+    if (result.cause instanceof IntegrationConnectionUnavailableError)
+        return false;
+    throw result.cause;
+}
+/** Both delivery modes use the same saved-account and invocation authority. */
+async function admittedConnection(db, runtime, descriptor, selector, actor) {
+    const current = accountSecretContext(runtime);
+    if (current.userId !== actor.userId || current.orgId !== actor.organizationId)
+        unavailable();
+    const principal = runtime.requestPrincipal();
+    if (principal.kind === 'service' && (principal.delegation?.account.integrationId !== descriptor.id ||
+        principal.delegation?.account.connectionId !== selector.connectionId))
+        unavailable();
+    return resolveIntegrationConnection(db, descriptor, selector, actor);
+}
+/** Return the exact admitted row identities without resolving a credential value. */
+export async function loadIntegrationConnectionReferences(db, runtime, descriptor, selector, actor) {
+    const { config, rows } = await admittedConnection(db, runtime, descriptor, selector, actor);
+    return IntegrationProviderResolvedConfigurationSchema.parse({
+        config,
+        credentials: {},
+        credentialReferences: Object.fromEntries(rows.map(({ key, secret }) => [key, [{ source: 'secret', store: accountSecretsDescriptor.id, key: secret.id }]]))
+    });
+}
+/** Compatibility value delivery resolves only the saved account's own rows. */
+export async function loadIntegrationConnection(db, runtime, descriptor, selector, actor) {
+    const { config, rows } = await admittedConnection(db, runtime, descriptor, selector, actor);
+    const credentials = {};
+    for (const { key, secret } of rows) {
+        const result = await runtime.resolveCredential({ source: 'secret', store: accountSecretsDescriptor.id, key: secret.id });
+        if (!result.ok)
+            throw result.error;
+        credentials[key] = result.value;
+        if (!credentials[key])
+            unavailable();
+    }
+    return IntegrationProviderResolvedConfigurationSchema.parse({ config, credentials });
+}
+//# sourceMappingURL=connection-store.js.map

package/dist/server/integration-accounts/connection-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-store.js","sourceRoot":"","sources":["../../../src/server/integration-accounts/connection-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EACN,8CAA8C,EAM9C,MAAM,0DAA0D,CAAC;AAElE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAe,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,EAAmB,MAAM,qBAAqB,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAIzG,MAAM,OAAO,qCAAsC,SAAQ,eAAe;IACzE;QACC,KAAK,CAAC,mFAAmF,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC,CAAC;QAC5J,IAAI,CAAC,IAAI,GAAG,uCAAuC,CAAC;IACrD,CAAC;CACD;AAED,SAAS,WAAW;IACnB,MAAM,IAAI,qCAAqC,EAAE,CAAC;AACnD,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,4BAA4B,CACjD,EAAc,EACd,UAAyC,EACzC,QAAiD,EACjD,KAA2C;IAE3C,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,UAAU,CAAC,OAAO,KAAK,KAAK;QAAE,WAAW,EAAE,CAAC;IAClG,MAAM,KAAK,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IACpD,MAAM,OAAO,GAAG,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,MAAM,CAAC;IACrD,MAAM,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC;IAC3C,MAAM,mBAAmB,GAAkC,UAAU,CAAC,WAAW,IAAI,EAAE,CAAC;IACxF,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACvG,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAM,YAAY,GAAG,YAAY,KAAK,OAAO,IAAI,YAAY,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC;IACxF,MAAM,KAAK,GAAa,YAAY;QACnC,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAC1C,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,EACxB,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,EACjC,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,UAAU,CAAC,QAAQ,CAAC,CAC7C,CAAC;QACF,CAAC,CAAC,EAAE,CAAC;IACN,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM;QAAE,WAAW,EAAE,CAAC;IAEzC,IAAI,IAAI,GAA2C,EAAE,CAAC;IACtD,IAAI,MAAM,GAAuD,EAAE,CAAC;IACpE,IAAI,KAAK,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,KAAK,CAAC,cAAc;YACjC,CAAC,CAAC,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;YAC/C,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC;QAC1D,wEAAwE;QACxE,0EAA0E;QAC1E,uEAAuE;QACvE,aAAa;QACb,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,EAAE;YAAE,WAAW,EAAE,CAAC;QACvF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;aACrG,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC;aAC3D,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,YAAY,EAAE,aAAa,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACxG,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,eAAe,CACxB,8BAA8B,KAAK,CAAC,EAAE,mCAAmC,EACzE,aAAa,EACb,EAAE,MAAM,EAAE,4CAA4C,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,CAAC,EAAE,EAAE,EAAE,CACnG,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,MAAM,EAAE,CAAC;YACtC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBAClB,MAAM,IAAI,eAAe,CACxB,8BAA8B,KAAK,CAAC,EAAE,gDAAgD,EACtF,eAAe,EACf,EAAE,MAAM,EAAE,+CAA+C,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,CAAC,EAAE,EAAE,EAAE,CACtG,CAAC;YACH,CAAC;YACD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,IAAI,MAAM,CAAC,YAAY,KAAK,UAAU,CAAC,QAAQ;gBACjH,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,WAAW,EAAE,CAAC;YACzH,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5B,CAAC;QACD,qEAAqE;QACrE,sEAAsE;QACtE,2DAA2D;QAC3D,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,KAAK,CAAC,QAAQ,CAAC;YAAE,WAAW,EAAE,CAAC;QAC5E,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,WAAW,EAAE,CAAC;QACnC,MAAM,GAAG,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG,kBAAkB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,YAAY,CAAC,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACzD,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC;YAClD,MAAM,CAAC,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,KAAK,SAAS,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,CAAC;IACF,CAAC;SAAM,CAAC;QACP,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,WAAW,EAAE,CAAC;QACvD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS,mBAAmB;aACxD,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC;aAC9C,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;YAC5B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC/C,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,WAAW,EAAE,CAAC;YACzC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,WAAW,EAAE,CAAC;IACtC,CAAC;IACD,0EAA0E;IAC1E,6EAA6E;IAC7E,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,qBAAqB,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC,WAAW,CAAC,OAAO;YAAE,WAAW,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC;QAClC,IAAI,QAAQ,CAAC,MAAM,KAAK,cAAc,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;YAAE,WAAW,EAAE,CAAC;QACvF,IAAI,QAAQ,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAC9C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE;gBAAE,WAAW,EAAE,CAAC;QACrE,CAAC;IACF,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACjD,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAAE,WAAW,EAAE,CAAC;IAClG,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,4BAA4B,CACjD,EAAc,EACd,UAAyC,EACzC,QAAiD,EACjD,KAA2C;IAE3C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,4BAA4B,CAAC,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IACjG,IAAI,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,MAAM,CAAC,KAAK,YAAY,qCAAqC;QAAE,OAAO,KAAK,CAAC;IAChF,MAAM,MAAM,CAAC,KAAK,CAAC;AACpB,CAAC;AAED,+EAA+E;AAC/E,KAAK,UAAU,kBAAkB,CAChC,EAAc,EACd,OAAmB,EACnB,UAAyC,EACzC,QAAiD,EACjD,KAA2C;IAE3C,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,cAAc;QAAE,WAAW,EAAE,CAAC;IAC7F,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAC7C,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,IAAI,CACnC,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,aAAa,KAAK,UAAU,CAAC,EAAE;QAC7D,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY,CACpE;QAAE,WAAW,EAAE,CAAC;IACjB,OAAO,4BAA4B,CAAC,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AACtE,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACxD,EAAc,EACd,OAAmB,EACnB,UAAyC,EACzC,QAAiD,EACjD,KAA2C;IAE3C,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,kBAAkB,CAAC,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC5F,OAAO,8CAA8C,CAAC,KAAK,CAAC;QAC3D,MAAM;QACN,WAAW,EAAE,EAAE;QACf,oBAAoB,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,CACrE,CAAC,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,wBAAwB,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CACjF,CAAC;KACF,CAAC,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,EAAc,EACd,OAAmB,EACnB,UAAyC,EACzC,QAAiD,EACjD,KAA2C;IAE3C,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,kBAAkB,CAAC,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC5F,MAAM,WAAW,GAA2B,EAAE,CAAC;IAC/C,KAAK,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,wBAAwB,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QACzH,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,MAAM,CAAC,KAAK,CAAC;QACnC,WAAW,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;QAChC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;YAAE,WAAW,EAAE,CAAC;IACtC,CAAC;IACD,OAAO,8CAA8C,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;AACtF,CAAC"}

package/dist/server/integration-accounts/index.d.ts

@@ -0,0 +1,8 @@
+export { createPlatformIntegrationStorePlugin, getIntegrationAccountsClient } from './plugin';
+export { createIntegrationOperationReceiver } from './operation-receiver';
+export { CI_JOB_SECRETS_STORE_ID, ciJobSecretsDescriptor } from './ci-job-secrets.descriptor';
+export { CI_JOB_SECRET_DELEGATION_VERIFIED_BY, CiJobSecretDelegationInputSchema, CiJobSecretReadRequestSchema, VerifiedCiJobSecretAuthoritySchema, createCiJobSecretsStore, resolveCiJobSecretBindings, resolveCiJobSecretCredential, resolveCiJobSecretValue, runWithCiJobSecretDelegation, type CiJobSecretAuthorityVerifier, type CiJobSecretDelegationInput, type CiJobSecretReadRequest, type VerifiedCiJobSecretAuthority } from './ci-job-secrets';
+export type { IntegrationAccountsClient } from './account-client';
+export { CreateAccountSchema } from './schemas/account';
+export type { CreateAccount } from './schemas/account';
+//# sourceMappingURL=index.d.ts.map

package/dist/server/integration-accounts/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/integration-accounts/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oCAAoC,EAAE,4BAA4B,EAAE,MAAM,UAAU,CAAC;AAC9F,OAAO,EAAE,kCAAkC,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAC9F,OAAO,EACN,oCAAoC,EACpC,gCAAgC,EAChC,4BAA4B,EAC5B,kCAAkC,EAClC,uBAAuB,EACvB,0BAA0B,EAC1B,4BAA4B,EAC5B,uBAAuB,EACvB,4BAA4B,EAC5B,KAAK,4BAA4B,EACjC,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,EAC3B,KAAK,4BAA4B,EACjC,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,YAAY,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/server/integration-accounts/index.js

@@ -0,0 +1,6 @@
+export { createPlatformIntegrationStorePlugin, getIntegrationAccountsClient } from './plugin';
+export { createIntegrationOperationReceiver } from './operation-receiver';
+export { CI_JOB_SECRETS_STORE_ID, ciJobSecretsDescriptor } from './ci-job-secrets.descriptor';
+export { CI_JOB_SECRET_DELEGATION_VERIFIED_BY, CiJobSecretDelegationInputSchema, CiJobSecretReadRequestSchema, VerifiedCiJobSecretAuthoritySchema, createCiJobSecretsStore, resolveCiJobSecretBindings, resolveCiJobSecretCredential, resolveCiJobSecretValue, runWithCiJobSecretDelegation } from './ci-job-secrets';
+export { CreateAccountSchema } from './schemas/account';
+//# sourceMappingURL=index.js.map

package/dist/server/integration-accounts/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/integration-accounts/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oCAAoC,EAAE,4BAA4B,EAAE,MAAM,UAAU,CAAC;AAC9F,OAAO,EAAE,kCAAkC,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAC9F,OAAO,EACN,oCAAoC,EACpC,gCAAgC,EAChC,4BAA4B,EAC5B,kCAAkC,EAClC,uBAAuB,EACvB,0BAA0B,EAC1B,4BAA4B,EAC5B,uBAAuB,EACvB,4BAA4B,EAK5B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/server/integration-accounts/integration-availability.d.ts

@@ -0,0 +1,4 @@
+import type { CaughtFailure } from '@vibesdotdev/kernel';
+export declare function isIntegrationNotConnectedError(err: CaughtFailure): boolean;
+export declare function integrationErrorMessage(err: CaughtFailure, fallback: string): string;
+//# sourceMappingURL=integration-availability.d.ts.map

package/dist/server/integration-accounts/integration-availability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration-availability.d.ts","sourceRoot":"","sources":["../../../src/server/integration-accounts/integration-availability.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAezD,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAG1E;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEpF"}

package/dist/server/integration-accounts/integration-availability.js

@@ -0,0 +1,19 @@
+/**
+ * Provider-auth failures that mean "the caller needs to connect or consent this
+ * integration", not "the platform route is broken".
+ *
+ * Keep this deliberately narrow. Runtime wiring failures such as
+ * `authInternalClient in KindContext`, missing `userId`, or generic Graph
+ * 401/403 operation failures are operational bugs/errors and must not be
+ * converted to HTTP 412. Converting them to "not connected" hid the real
+ * Microsoft/SharePoint failure behind a reconnect prompt.
+ */
+const NOT_CONNECTED_RE = /not connected|no microsoft|no .*access token|access token available|sign[\s-]?in with|connect .*microsoft|invalidauthenticationtoken|aadsts\d|admin[\s-]?consent|required .*consent|consent required|microsoft credential|credential.*microsoft|missing .*credential|requires .*credential|requires clientid|clientsecret.*tenantid|tenantid.*clientsecret|msal client credentials|acquire token|token request|invalid_grant|incorrect or invalid refresh token|qbo token refresh failed|quickbooks token refresh failed|re-authorization required/i;
+export function isIntegrationNotConnectedError(err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return NOT_CONNECTED_RE.test(message);
+}
+export function integrationErrorMessage(err, fallback) {
+    return err instanceof Error ? err.message : fallback;
+}
+//# sourceMappingURL=integration-availability.js.map

package/dist/server/integration-accounts/integration-availability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration-availability.js","sourceRoot":"","sources":["../../../src/server/integration-accounts/integration-availability.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,MAAM,gBAAgB,GACrB,qhBAAqhB,CAAC;AAEvhB,MAAM,UAAU,8BAA8B,CAAC,GAAkB;IAChE,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,OAAO,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,GAAkB,EAAE,QAAgB;IAC3E,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;AACtD,CAAC"}