@vibesdotdev/platform 0.0.0-stage → 1.0.0-rc.2

package/dist/server/integration-accounts/operation-receiver.js

@@ -0,0 +1,210 @@
+import { IntegrationOperationInputSchema } from '@vibesdotdev/integrations/schemas/integration-descriptor';
+import { operationHttpError as error, IntegrationOperationHttpError } from './operation-http-error';
+const json = Response.json;
+import { getLogger } from '@vibesdotdev/logging';
+import { settle, valueFreeFailure } from '@vibesdotdev/kernel';
+import { resolveInternalServiceToken } from '@vibesdotdev/account/server/internal-service-token';
+import { runWithRequestContext } from '@vibesdotdev/account/org/request-context';
+import { verifyDelegatedActorClaims } from '@vibesdotdev/auth';
+import { originOf, serviceEnvironment } from '@vibesdotdev/infra-core/service';
+import { requireInternalServiceUser } from './internal-service';
+import { assertIntegrationOperationAuthority, IntegrationOperationAuthorityError } from './operation-authority';
+import { DeploymentAuthoritySchema, DeploymentVerificationSchema } from './schemas/connection';
+import { IntegrationConnectionUnavailableError } from './connection-store';
+import { integrationErrorMessage, isIntegrationNotConnectedError } from './integration-availability';
+export function createIntegrationOperationReceiver(runtime, refreshLegacy) {
+    const logger = getLogger('platform.integration-operation', runtime);
+    const dispatch = async (params, request) => {
+        const integrationId = params.id;
+        const operationId = params.op;
+        if (!integrationId || !operationId) {
+            throw error(400, 'Missing integration id or operation');
+        }
+        const internalIdentity = await requireInternalServiceUser(runtime, request);
+        const { userId } = internalIdentity;
+        let organizationId = internalIdentity.organizationId;
+        let admittedPrincipal;
+        const actorJwt = request.headers.get('x-vibes-actor-jwt')?.trim() || undefined;
+        const deploymentAuthority = readDeploymentAuthority(request.headers);
+        const selectedHeader = request.headers.get('x-vibes-integration-connection-id');
+        const connectionId = selectedHeader?.trim();
+        if (selectedHeader !== null && (!connectionId || connectionId.length > 512)) {
+            throw error(400, 'Invalid integration connection id');
+        }
+        const admission = await settle(async () => {
+            const authority = await assertIntegrationOperationAuthority({
+                integrationId,
+                operationId,
+                connectionId,
+                userId,
+                organizationId,
+                actorJwt,
+                deploymentAuthority
+            }, {
+                verifyActorJwt: async (jwt) => {
+                    const authOrigin = originOf(await runtime.query('infra/service').withId('auth').resolve(), await serviceEnvironment(runtime), 'primary');
+                    return verifyDelegatedActorClaims({ token: jwt, authOrigin, runtime: runtime });
+                },
+                verifyDeploymentAuthority: async (claimed) => {
+                    const [hqService, environment, token] = await Promise.all([
+                        runtime.query('infra/service').withId('hq').resolve(),
+                        serviceEnvironment(runtime),
+                        resolveInternalServiceToken(runtime)
+                    ]);
+                    const hqOrigin = originOf(hqService, environment, 'internal');
+                    if (!token)
+                        return null;
+                    const response = await fetch(`${hqOrigin.replace(/\/$/, '')}/api/internal/agent-deployments/outbound-authority`, {
+                        method: 'POST',
+                        headers: {
+                            authorization: `Bearer ${token}`,
+                            'content-type': 'application/json'
+                        },
+                        body: JSON.stringify(claimed),
+                        signal: AbortSignal.timeout(5_000)
+                    });
+                    if (!response.ok)
+                        return null;
+                    const result = DeploymentVerificationSchema.parse(await response.json());
+                    return result.allowed === true && result.authority ? result.authority : null;
+                }
+            });
+            organizationId = authority.organizationId;
+            if (authority.verified) {
+                admittedPrincipal = {
+                    kind: 'service', caller: 'platform.integration-operation', onBehalfOf: userId,
+                    delegation: {
+                        verifiedBy: authority.verified.kind === 'actor' ? 'auth.delegated-actor-jwt' : 'hq.deployment-authority',
+                        account: { ownerId: userId, orgId: organizationId, integrationId, connectionId }
+                    }
+                };
+            }
+        });
+        if (!admission.ok) {
+            const authorityError = admission.cause;
+            if (authorityError instanceof IntegrationOperationAuthorityError) {
+                throw error(403, authorityError.message, authorityError);
+            }
+            throw authorityError;
+        }
+        let args;
+        const body = await request.text();
+        if (body.trim()) {
+            const input = await settle(() => IntegrationOperationInputSchema.parse(JSON.parse(body)));
+            if (!input.ok)
+                throw error(400, 'Invalid JSON body', input.cause);
+            args = input.value;
+        }
+        const operation = await settle(async () => {
+            // Wrap dispatch in a request context so the integration kind reads
+            // the calling app's orgId / userId for credential scopeId
+            // composition. Without this, the integration provider would resolve
+            // credentials at platform-scope only.
+            return await runtime.runInvocation(() => runWithRequestContext(runtime, { orgId: organizationId, userId }, async () => {
+                const provider = await runtime
+                    .query('integration/provider')
+                    .withId(integrationId)
+                    .resolve();
+                if (connectionId && !provider.invokeOperationForConnection) {
+                    return json({ ok: false, errors: ['This provider does not support selected accounts.'],
+                        error: { code: 'CONNECTION_SELECTION_UNSUPPORTED', message: 'This provider does not support selected accounts.' }
+                    }, { status: 412 });
+                }
+                // Just-in-time refresh of org-scoped OAuth tokens before dispatch.
+                // No-op for delegated/non-OAuth providers. Provider rejection of
+                // the stored refresh token is not-connected (412), not a retry.
+                // Selected account implementations resolve only their exact saved bundle.
+                // The legacy org-wide refresher must never run for a selected account.
+                const refresh = connectionId ? { status: 'ok' } : await refreshLegacy({ integrationId, organizationId, userId });
+                if (refresh.status === 'reconnect_required') {
+                    return json({
+                        ok: false,
+                        errors: [refresh.message],
+                        error: {
+                            code: 'INTEGRATION_NOT_CONNECTED',
+                            message: refresh.message
+                        }
+                    }, { status: 412 });
+                }
+                const result = connectionId
+                    ? await provider.invokeOperationForConnection({ connectionId }, operationId, args)
+                    : await provider.invokeOperation(operationId, args);
+                if (!result.ok) {
+                    // Surface the provider's own error message through the platform
+                    // error-code envelope so the internal client extracts a human
+                    // message (`error.{code,message}`) rather than falling back to
+                    // the raw JSON body. The not-connected path below uses the same
+                    // shape with INTEGRATION_NOT_CONNECTED; real provider rejections
+                    // (invalid customer, amount rejected, expired token, …) get
+                    // INTEGRATION_OPERATION_FAILED.
+                    const errors = result.errors ?? [];
+                    const message = errors.length > 0
+                        ? errors.join('; ')
+                        : `The ${integrationId} ${operationId} operation failed.`;
+                    return json({
+                        ok: false,
+                        errors,
+                        error: {
+                            code: 'INTEGRATION_OPERATION_FAILED',
+                            message
+                        }
+                    }, { status: 400 });
+                }
+                return json({ ok: true, data: result.data ?? null });
+            }), admittedPrincipal ? { principal: admittedPrincipal } : undefined);
+        });
+        if (!operation.ok) {
+            const err = operation.cause;
+            if (err instanceof IntegrationConnectionUnavailableError || isIntegrationNotConnectedError(err)) {
+                const message = integrationErrorMessage(err, 'Integration is not connected');
+                return json({
+                    ok: false,
+                    errors: [message],
+                    error: {
+                        code: 'INTEGRATION_NOT_CONNECTED',
+                        message
+                    }
+                }, { status: 412 });
+            }
+            logger.error('Platform integration operation dispatch failed', {
+                integrationId,
+                operationId,
+                userId,
+                organizationId,
+                error: valueFreeFailure(err)
+            });
+            throw error(500, 'Operation failed', err);
+        }
+        return operation.value;
+    };
+    return async (params, request) => {
+        const result = await settle(() => dispatch(params, request));
+        if (!result.ok) {
+            const cause = result.cause;
+            if (cause instanceof IntegrationOperationHttpError) {
+                return json({ ok: false, error: { code: `HTTP_${cause.status}`, message: cause.body.message } }, { status: cause.status });
+            }
+            throw cause;
+        }
+        return result.value;
+    };
+}
+function readDeploymentAuthority(headers) {
+    const required = {
+        deploymentId: headers.get('x-vibes-deployment-id')?.trim(),
+        agentId: headers.get('x-vibes-deployment-agent-id')?.trim(),
+        ownerUserId: headers.get('x-vibes-deployment-owner-user-id')?.trim(),
+        integrationId: headers.get('x-vibes-deployment-integration-id')?.trim(),
+        sourceId: headers.get('x-vibes-deployment-source-id')?.trim(),
+        channelId: headers.get('x-vibes-deployment-channel-id')?.trim()
+    };
+    if (Object.values(required).some((value) => !value))
+        return undefined;
+    const optional = {
+        organizationId: headers.get('x-vibes-deployment-organization-id')?.trim() || undefined,
+        guildId: headers.get('x-vibes-deployment-guild-id')?.trim() || undefined,
+        connectionId: headers.get('x-vibes-deployment-connection-id')?.trim() || undefined
+    };
+    return DeploymentAuthoritySchema.parse({ ...required, ...optional });
+}
+//# sourceMappingURL=operation-receiver.js.map

package/dist/server/integration-accounts/operation-receiver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation-receiver.js","sourceRoot":"","sources":["../../../src/server/integration-accounts/operation-receiver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,0DAA0D,CAAC;AAC3G,OAAO,EAAE,kBAAkB,IAAI,KAAK,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAC;AACpG,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;AAC3B,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAA4C,MAAM,qBAAqB,CAAC;AACzG,OAAO,EAAE,2BAA2B,EAAE,MAAM,oDAAoD,CAAC;AAKjG,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AACjF,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAsD,MAAM,iCAAiC,CAAC;AACnI,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EACN,mCAAmC,EACnC,kCAAkC,EAClC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,yBAAyB,EAAE,4BAA4B,EAAoC,MAAM,sBAAsB,CAAC;AACjI,OAAO,EAAE,qCAAqC,EAAE,MAAM,oBAAoB,CAAC;AAE3E,OAAO,EACN,uBAAuB,EACvB,8BAA8B,EAC9B,MAAM,4BAA4B,CAAC;AAEpC,MAAM,UAAU,kCAAkC,CAAC,OAAqB,EAAE,aAA2I;IACrN,MAAM,MAAM,GAAG,SAAS,CAAC,gCAAgC,EAAE,OAAO,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAoC,EAAE,OAAgB,EAAqB,EAAE;QACpG,MAAM,aAAa,GAAG,MAAM,CAAC,EAAE,CAAC;QAChC,MAAM,WAAW,GAAG,MAAM,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC,aAAa,IAAI,CAAC,WAAW,EAAE,CAAC;YACpC,MAAM,KAAK,CAAC,GAAG,EAAE,qCAAqC,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,0BAA0B,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC5E,MAAM,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC;QACpC,IAAI,cAAc,GAAG,gBAAgB,CAAC,cAAc,CAAC;QACrD,IAAI,iBAA+C,CAAC;QACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;QAC/E,MAAM,mBAAmB,GAAG,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrE,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;QAChF,MAAM,YAAY,GAAG,cAAc,EAAE,IAAI,EAAE,CAAC;QAC5C,IAAI,cAAc,KAAK,IAAI,IAAI,CAAC,CAAC,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;YAC7E,MAAM,KAAK,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,IAAI,EAAE;YACzC,MAAM,SAAS,GAAG,MAAM,mCAAmC,CAC1D;gBACC,aAAa;gBACb,WAAW;gBACX,YAAY;gBACZ,MAAM;gBACN,cAAc;gBACd,QAAQ;gBACR,mBAAmB;aACnB,EACD;gBACC,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;oBAC7B,MAAM,UAAU,GAAG,QAAQ,CAC1B,MAAM,OAAO,CAAC,KAAK,CAA2C,eAAe,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EACvG,MAAM,kBAAkB,CAAC,OAAO,CAAC,EAAE,SAAS,CAC5C,CAAC;oBACF,OAAO,0BAA0B,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;gBACjF,CAAC;gBACD,yBAAyB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;oBAC5C,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;wBACzD,OAAO,CAAC,KAAK,CAA2C,eAAe,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE;wBAC/F,kBAAkB,CAAC,OAAO,CAAC;wBAC3B,2BAA2B,CAAC,OAAO,CAAC;qBACpC,CAAC,CAAC;oBACH,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;oBAC9D,IAAI,CAAC,KAAK;wBAAE,OAAO,IAAI,CAAC;oBACxB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC3B,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,oDAAoD,EAClF;wBACC,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE;4BACR,aAAa,EAAE,UAAU,KAAK,EAAE;4BAChC,cAAc,EAAE,kBAAkB;yBAClC;wBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;wBAC7B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;qBAClC,CACD,CAAC;oBACF,IAAI,CAAC,QAAQ,CAAC,EAAE;wBAAE,OAAO,IAAI,CAAC;oBAC9B,MAAM,MAAM,GAAG,4BAA4B,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;oBACzE,OAAO,MAAM,CAAC,OAAO,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC9E,CAAC;aACD,CACD,CAAC;YACF,cAAc,GAAG,SAAS,CAAC,cAAc,CAAC;YAC1C,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;gBACxB,iBAAiB,GAAG;oBACnB,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,gCAAgC,EAAE,UAAU,EAAE,MAAM;oBAC7E,UAAU,EAAE;wBACX,UAAU,EAAE,SAAS,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,yBAAyB;wBACxG,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE;qBAChF;iBACD,CAAC;YACH,CAAC;QACF,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YACnB,MAAM,cAAc,GAAG,SAAS,CAAC,KAAK,CAAC;YACvC,IAAI,cAAc,YAAY,kCAAkC,EAAE,CAAC;gBAClE,MAAM,KAAK,CAAC,GAAG,EAAE,cAAc,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM,cAAc,CAAC;QACtB,CAAC;QAED,IAAI,IAA8D,CAAC;QACnE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,+BAA+B,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1F,IAAI,CAAC,KAAK,CAAC,EAAE;gBAAE,MAAM,KAAK,CAAC,GAAG,EAAE,mBAAmB,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAClE,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;QACpB,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,IAAI,EAAE;YACzC,mEAAmE;YACnE,0DAA0D;YAC1D,oEAAoE;YACpE,sCAAsC;YACtC,OAAO,MAAM,OAAO,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,KAAK,IAAI,EAAE;gBACrH,MAAM,QAAQ,GAAG,MAAM,OAAO;qBAC5B,KAAK,CAAmE,sBAAsB,CAAC;qBAC/F,MAAM,CAAC,aAAa,CAAC;qBACrB,OAAO,EAAE,CAAC;gBACZ,IAAI,YAAY,IAAI,CAAC,QAAQ,CAAC,4BAA4B,EAAE,CAAC;oBAC5D,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,mDAAmD,CAAC;wBACrF,KAAK,EAAE,EAAE,IAAI,EAAE,kCAAkC,EAAE,OAAO,EAAE,mDAAmD,EAAE;qBACjH,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBACrB,CAAC;gBACD,mEAAmE;gBACnE,iEAAiE;gBACjE,gEAAgE;gBAChE,0EAA0E;gBAC1E,uEAAuE;gBACvE,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC;gBAE1H,IAAI,OAAO,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;oBAC7C,OAAO,IAAI,CACV;wBACC,EAAE,EAAE,KAAK;wBACT,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;wBACzB,KAAK,EAAE;4BACN,IAAI,EAAE,2BAA2B;4BACjC,OAAO,EAAE,OAAO,CAAC,OAAO;yBACxB;qBACD,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;gBACH,CAAC;gBAED,MAAM,MAAM,GAAG,YAAY;oBAC1B,CAAC,CAAC,MAAM,QAAQ,CAAC,4BAA6B,CAAC,EAAE,YAAY,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC;oBACnF,CAAC,CAAC,MAAM,QAAQ,CAAC,eAAe,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;gBACrD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;oBAChB,gEAAgE;oBAChE,8DAA8D;oBAC9D,+DAA+D;oBAC/D,gEAAgE;oBAChE,iEAAiE;oBACjE,4DAA4D;oBAC5D,gCAAgC;oBAChC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;oBACnC,MAAM,OAAO,GACZ,MAAM,CAAC,MAAM,GAAG,CAAC;wBAChB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;wBACnB,CAAC,CAAC,OAAO,aAAa,IAAI,WAAW,oBAAoB,CAAC;oBAC5D,OAAO,IAAI,CACV;wBACC,EAAE,EAAE,KAAK;wBACT,MAAM;wBACN,KAAK,EAAE;4BACN,IAAI,EAAE,8BAA8B;4BACpC,OAAO;yBACP;qBACD,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;gBACH,CAAC;gBACD,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;YACtD,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YACnB,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC;YAC5B,IAAI,GAAG,YAAY,qCAAqC,IAAI,8BAA8B,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjG,MAAM,OAAO,GAAG,uBAAuB,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAC;gBAC7E,OAAO,IAAI,CACV;oBACC,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,CAAC,OAAO,CAAC;oBACjB,KAAK,EAAE;wBACN,IAAI,EAAE,2BAA2B;wBACjC,OAAO;qBACP;iBACD,EACD,EAAE,MAAM,EAAE,GAAG,EAAE,CACf,CAAC;YACH,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,gDAAgD,EAAE;gBAC9D,aAAa;gBACb,WAAW;gBACX,MAAM;gBACN,cAAc;gBACd,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC;aAC5B,CAAC,CAAC;YACH,MAAM,KAAK,CAAC,GAAG,EAAE,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,SAAS,CAAC,KAAK,CAAC;IACxB,CAAC,CAAC;IACD,OAAO,KAAK,EAAE,MAAoC,EAAE,OAAgB,EAAqB,EAAE;QAC1F,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAC3B,IAAI,KAAK,YAAY,6BAA6B,EAAE,CAAC;gBACrD,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,KAAK,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YAC3H,CAAC;YACD,MAAM,KAAK,CAAC;QACb,CAAC;QACD,OAAO,MAAM,CAAC,KAAK,CAAC;IACrB,CAAC,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAgB;IAChD,MAAM,QAAQ,GAAG;QAChB,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE;QAC1D,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,EAAE,IAAI,EAAE;QAC3D,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,EAAE,IAAI,EAAE;QACpE,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,EAAE,IAAI,EAAE;QACvE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,EAAE,IAAI,EAAE;QAC7D,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,EAAE,IAAI,EAAE;KAC/D,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACtE,MAAM,QAAQ,GAAG;QAChB,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS;QACtF,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS;QACxE,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS;KAClF,CAAC;IACF,OAAO,yBAAyB,CAAC,KAAK,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;AACtE,CAAC"}

package/dist/server/integration-accounts/plugin.d.ts

@@ -0,0 +1,8 @@
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+import type { DrizzleDb } from '@vibesdotdev/storage/adapters/drizzle';
+import { type CiJobSecretAuthorityVerifier } from './ci-job-secrets';
+import { IntegrationAccountsClient } from './account-client';
+import { SecretService } from './secret-service';
+export declare function createPlatformIntegrationStorePlugin(database: (runtime: VibesRuntime) => DrizzleDb, secretService?: (runtime: VibesRuntime, db: DrizzleDb) => SecretService, authorizeCiSecretRead?: CiJobSecretAuthorityVerifier): import("@vibesdotdev/kernel").RuntimePlugin;
+export declare function getIntegrationAccountsClient(runtime: VibesRuntime): Promise<IntegrationAccountsClient>;
+//# sourceMappingURL=plugin.d.ts.map

package/dist/server/integration-accounts/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../../src/server/integration-accounts/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAE7E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAC;AAIvE,OAAO,EAA2B,KAAK,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAE9F,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAMjD,wBAAgB,oCAAoC,CACnD,QAAQ,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,SAAS,EAC9C,aAAa,GAAE,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,SAAS,KAAK,aAA+D,EACxH,qBAAqB,CAAC,EAAE,4BAA4B,+CAgCpD;AACD,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,YAAY,sCAEjE"}

package/dist/server/integration-accounts/plugin.js

@@ -0,0 +1,43 @@
+import { createRuntimePlugin } from '@vibesdotdev/kernel';
+import { getVibesClient, RuntimeClientDescriptorSchema } from '@vibesdotdev/kernel/client';
+import { accountSecretsDescriptor } from './account-secrets.descriptor';
+import { createAccountSecretsStore } from './account-secrets';
+import { ciJobSecretsDescriptor } from './ci-job-secrets.descriptor';
+import { createCiJobSecretsStore } from './ci-job-secrets';
+import { createPlatformIntegrationStoreAdapter } from './store-adapter';
+import { IntegrationAccountsClient } from './account-client';
+import { SecretService } from './secret-service';
+const accountsDescriptor = RuntimeClientDescriptorSchema.parse({
+    kind: 'runtime/client', id: 'platform.integration-accounts', name: 'Platform integration accounts', enabled: true
+});
+export function createPlatformIntegrationStorePlugin(database, secretService = (runtime, db) => new SecretService(db, runtime), authorizeCiSecretRead) {
+    return createRuntimePlugin({
+        id: 'platform-integration-store',
+        dependencies: ['integrations', 'secrets'],
+        descriptors: [accountSecretsDescriptor, ciJobSecretsDescriptor, accountsDescriptor],
+        onRegister(runtime) {
+            runtime.registerLoader('secrets/store', accountSecretsDescriptor.id, async () => ({
+                // SAFETY: this plugin is composed into a VibesRuntime; onRegister exposes its RuntimeRef base.
+                impl: createAccountSecretsStore(runtime, database(runtime), secretService(runtime, database(runtime)))
+            }));
+            runtime.registerLoader('secrets/store', ciJobSecretsDescriptor.id, async () => ({
+                // SAFETY: this plugin is composed into a VibesRuntime; onRegister exposes its RuntimeRef base.
+                impl: createCiJobSecretsStore(runtime, database(runtime), secretService(runtime, database(runtime)), authorizeCiSecretRead)
+            }));
+            runtime.registerLoader('context', 'integration/store', async () => ({
+                impl: { provide: (scope) => createPlatformIntegrationStoreAdapter(scope, database(scope)) }
+            }));
+            runtime.registerLoader('runtime/client', accountsDescriptor.id, async () => ({
+                impl: class extends IntegrationAccountsClient {
+                    constructor(descriptor, context) {
+                        super(descriptor, context, database, secretService);
+                    }
+                }
+            }));
+        }
+    });
+}
+export function getIntegrationAccountsClient(runtime) {
+    return getVibesClient(accountsDescriptor.id, runtime);
+}
+//# sourceMappingURL=plugin.js.map

package/dist/server/integration-accounts/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/server/integration-accounts/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAqB,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAE3F,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AACxE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAqC,MAAM,kBAAkB,CAAC;AAC9F,OAAO,EAAE,qCAAqC,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,MAAM,kBAAkB,GAAG,6BAA6B,CAAC,KAAK,CAAC;IAC9D,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,+BAA+B,EAAE,IAAI,EAAE,+BAA+B,EAAE,OAAO,EAAE,IAAI;CACjH,CAAC,CAAC;AAEH,MAAM,UAAU,oCAAoC,CACnD,QAA8C,EAC9C,gBAAyE,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,aAAa,CAAC,EAAE,EAAE,OAAO,CAAC,EACxH,qBAAoD;IAEpD,OAAO,mBAAmB,CAAC;QAC1B,EAAE,EAAE,4BAA4B;QAChC,YAAY,EAAE,CAAC,cAAc,EAAE,SAAS,CAAC;QACzC,WAAW,EAAE,CAAC,wBAAwB,EAAE,sBAAsB,EAAE,kBAAkB,CAAC;QACnF,UAAU,CAAC,OAAO;YACjB,OAAO,CAAC,cAAc,CAAC,eAAe,EAAE,wBAAwB,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;gBACjF,+FAA+F;gBAC/F,IAAI,EAAE,yBAAyB,CAAC,OAAuB,EAAE,QAAQ,CAAC,OAAuB,CAAC,EAAE,aAAa,CAAC,OAAuB,EAAE,QAAQ,CAAC,OAAuB,CAAC,CAAC,CAAC;aACtK,CAAC,CAAC,CAAC;YACJ,OAAO,CAAC,cAAc,CAAC,eAAe,EAAE,sBAAsB,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;gBAC/E,+FAA+F;gBAC/F,IAAI,EAAE,uBAAuB,CAC5B,OAAuB,EACvB,QAAQ,CAAC,OAAuB,CAAC,EACjC,aAAa,CAAC,OAAuB,EAAE,QAAQ,CAAC,OAAuB,CAAC,CAAC,EACzE,qBAAqB,CACrB;aACD,CAAC,CAAC,CAAC;YACJ,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,mBAAmB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;gBACnE,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,KAAmB,EAAE,EAAE,CAAC,qCAAqC,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE;aACzG,CAAC,CAAC,CAAC;YACJ,OAAO,CAAC,cAAc,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;gBAC5E,IAAI,EAAE,KAAM,SAAQ,yBAAyB;oBAC5C,YAAY,UAAsE,EAAE,OAAmE;wBACtJ,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;oBACrD,CAAC;iBACD;aACD,CAAC,CAAC,CAAC;QACL,CAAC;KACD,CAAC,CAAC;AACJ,CAAC;AACD,MAAM,UAAU,4BAA4B,CAAC,OAAqB;IACjE,OAAO,cAAc,CAA4B,kBAAkB,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;AAClF,CAAC"}

package/dist/server/integration-accounts/resource-secrets.d.ts

@@ -0,0 +1,125 @@
+/**
+ * Junction table for associating secrets with platform resources.
+ */
+export declare const resourceSecrets: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+    name: "resource_secrets";
+    schema: undefined;
+    columns: {
+        secretId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "secret_id";
+            tableName: "resource_secrets";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        resourceType: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "resource_type";
+            tableName: "resource_secrets";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        resourceId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "resource_id";
+            tableName: "resource_secrets";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        attachedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "attached_at";
+            tableName: "resource_secrets";
+            dataType: "date";
+            columnType: "SQLiteTimestamp";
+            data: Date;
+            driverParam: number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        attachedBy: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "attached_by";
+            tableName: "resource_secrets";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        purpose: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "purpose";
+            tableName: "resource_secrets";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+    };
+    dialect: "sqlite";
+}>;
+export type ResourceSecretRow = typeof resourceSecrets.$inferSelect;
+export type NewResourceSecretRow = typeof resourceSecrets.$inferInsert;
+//# sourceMappingURL=resource-secrets.d.ts.map

package/dist/server/integration-accounts/resource-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-secrets.d.ts","sourceRoot":"","sources":["../../../src/server/integration-accounts/resource-secrets.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkB3B,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,OAAO,eAAe,CAAC,YAAY,CAAC;AACpE,MAAM,MAAM,oBAAoB,GAAG,OAAO,eAAe,CAAC,YAAY,CAAC"}

package/dist/server/integration-accounts/resource-secrets.js

@@ -0,0 +1,21 @@
+import { sqliteTable, text, integer, primaryKey, index } from 'drizzle-orm/sqlite-core';
+import { secrets } from './secrets';
+/**
+ * Junction table for associating secrets with platform resources.
+ */
+export const resourceSecrets = sqliteTable('resource_secrets', {
+    secretId: text('secret_id')
+        .notNull()
+        .references(() => secrets.id, { onDelete: 'cascade' }),
+    resourceType: text('resource_type').notNull(),
+    resourceId: text('resource_id').notNull(),
+    attachedAt: integer('attached_at', { mode: 'timestamp_ms' }).notNull(),
+    attachedBy: text('attached_by').notNull(),
+    purpose: text('purpose')
+}, (table) => ({
+    pk: primaryKey({ columns: [table.secretId, table.resourceType, table.resourceId] }),
+    secretIdx: index('idx_resource_secrets_secret').on(table.secretId),
+    resourceIdx: index('idx_resource_secrets_resource').on(table.resourceType, table.resourceId),
+    attachedByIdx: index('idx_resource_secrets_attached_by').on(table.attachedBy)
+}));
+//# sourceMappingURL=resource-secrets.js.map

package/dist/server/integration-accounts/resource-secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-secrets.js","sourceRoot":"","sources":["../../../src/server/integration-accounts/resource-secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AACxF,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CACzC,kBAAkB,EAClB;IACC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;SACzB,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IACvD,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE;IAC7C,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,UAAU,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;IACtE,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;CACxB,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACX,EAAE,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;IACnF,SAAS,EAAE,KAAK,CAAC,6BAA6B,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC;IAClE,WAAW,EAAE,KAAK,CAAC,+BAA+B,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC;IAC5F,aAAa,EAAE,KAAK,CAAC,kCAAkC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;CAC7E,CAAC,CACF,CAAC"}

package/dist/server/integration-accounts/schema.d.ts

@@ -0,0 +1,6 @@
+export { secrets } from './secrets';
+export { resourceSecrets } from './resource-secrets';
+export { integrations } from './integrations';
+/** Initial table migrations from Platform's account persistence owner. */
+export declare const accountSchemaStatements: string[];
+//# sourceMappingURL=schema.d.ts.map

package/dist/server/integration-accounts/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/server/integration-accounts/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB,UAInC,CAAC"}

package/dist/server/integration-accounts/schema.js

@@ -0,0 +1,10 @@
+export { secrets } from './secrets';
+export { resourceSecrets } from './resource-secrets';
+export { integrations } from './integrations';
+/** Initial table migrations from Platform's account persistence owner. */
+export const accountSchemaStatements = [
+    "CREATE TABLE `secrets` (\n\t`id` text PRIMARY KEY NOT NULL,\n\t`name` text NOT NULL,\n\t`scope` text NOT NULL,\n\t`scope_id` text NOT NULL,\n\t`provider_type` text NOT NULL,\n\t`encrypted_value` text NOT NULL,\n\t`created_by` text NOT NULL,\n\t`rotation_policy` text DEFAULT 'manual' NOT NULL,\n\t`metadata` text,\n\t`last_used_at` integer,\n\t`last_rotated_at` integer,\n\t`created_at` integer NOT NULL,\n\t`updated_at` integer NOT NULL\n);",
+    "CREATE TABLE `resource_secrets` (\n\t`secret_id` text NOT NULL,\n\t`resource_type` text NOT NULL,\n\t`resource_id` text NOT NULL,\n\t`attached_at` integer NOT NULL,\n\t`attached_by` text NOT NULL,\n\t`purpose` text,\n\tPRIMARY KEY(`secret_id`, `resource_type`, `resource_id`),\n\tFOREIGN KEY (`secret_id`) REFERENCES `secrets`(`id`) ON UPDATE no action ON DELETE cascade\n);",
+    "CREATE TABLE `integrations` (\n\t`id` text PRIMARY KEY NOT NULL,\n\t`user_id` text NOT NULL,\n\t`project_id` text,\n\t`organization_id` text,\n\t`name` text NOT NULL,\n\t`description` text,\n\t`type` text NOT NULL,\n\t`category` text NOT NULL,\n\t`secret_id` text NOT NULL,\n\t`config` text DEFAULT '{}',\n\t`last_used_at` integer,\n\t`usage_count` integer DEFAULT 0,\n\t`status` text DEFAULT 'pending',\n\t`last_error` text,\n\t`last_error_at` integer,\n\t`is_default` integer DEFAULT 0,\n\t`tags` text DEFAULT '[]',\n\t`created_at` integer NOT NULL,\n\t`updated_at` integer NOT NULL\n);"
+];
+//# sourceMappingURL=schema.js.map

package/dist/server/integration-accounts/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/server/integration-accounts/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,0EAA0E;AAC1E,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,2bAA2b;IAC3b,wXAAwX;IACxX,8kBAA8kB;CAC/kB,CAAC"}

package/dist/server/integration-accounts/schemas/account.d.ts

@@ -0,0 +1,12 @@
+import * as z from 'zod/v4';
+export declare const CreateAccountSchema: z.ZodObject<{
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    type: z.ZodTemplateLiteral<`integration.${string}`>;
+    credentials: z.ZodRecord<z.ZodString, z.ZodString>;
+    config: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>>;
+    isDefault: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+export type CreateAccount = z.infer<typeof CreateAccountSchema>;
+export declare const AccountIdSchema: z.ZodString;
+//# sourceMappingURL=account.d.ts.map

package/dist/server/integration-accounts/schemas/account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../../../../src/server/integration-accounts/schemas/account.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,eAAO,MAAM,mBAAmB;;;;;;;iBAO9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,eAAO,MAAM,eAAe,aAA6B,CAAC"}

package/dist/server/integration-accounts/schemas/account.js

@@ -0,0 +1,12 @@
+import * as z from 'zod/v4';
+import { IntegrationConfigValueSchema } from '@vibesdotdev/integrations/schemas/integration-descriptor';
+export const CreateAccountSchema = z.object({
+    name: z.string().trim().min(1),
+    description: z.string().optional(),
+    type: z.templateLiteral(['integration.', z.string().min(1)]),
+    credentials: z.record(z.string(), z.string()),
+    config: z.record(z.string(), IntegrationConfigValueSchema).default({}),
+    isDefault: z.boolean().default(false)
+});
+export const AccountIdSchema = z.string().min(1).max(512);
+//# sourceMappingURL=account.js.map

package/dist/server/integration-accounts/schemas/account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.js","sourceRoot":"","sources":["../../../../src/server/integration-accounts/schemas/account.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,4BAA4B,EAAE,MAAM,0DAA0D,CAAC;AAExG,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,IAAI,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,4BAA4B,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACrC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC"}

package/dist/server/integration-accounts/schemas/connection.d.ts

@@ -0,0 +1,91 @@
+import * as z from 'zod/v4';
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+import type { DrizzleDb } from '@vibesdotdev/storage/adapters/drizzle';
+export declare const CiJobSecretDelegationInputSchema: z.ZodObject<{
+    actionRunId: z.ZodUUID;
+    step: z.ZodString;
+    ownerType: z.ZodEnum<{
+        user: "user";
+        organization: "organization";
+    }>;
+    ownerId: z.ZodString;
+    targetTier: z.ZodOptional<z.ZodEnum<{
+        local: "local";
+        dev: "dev";
+        staging: "staging";
+        production: "production";
+    }>>;
+}, z.core.$strict>;
+export type CiJobSecretDelegationInput = z.infer<typeof CiJobSecretDelegationInputSchema>;
+export declare const CiJobSecretReadRequestSchema: z.ZodObject<{
+    actionRunId: z.ZodUUID;
+    step: z.ZodString;
+    ownerType: z.ZodEnum<{
+        user: "user";
+        organization: "organization";
+    }>;
+    ownerId: z.ZodString;
+    targetTier: z.ZodOptional<z.ZodEnum<{
+        local: "local";
+        dev: "dev";
+        staging: "staging";
+        production: "production";
+    }>>;
+    secretName: z.ZodString;
+}, z.core.$strict>;
+export type CiJobSecretReadRequest = z.infer<typeof CiJobSecretReadRequestSchema>;
+export declare const VerifiedCiJobSecretAuthoritySchema: z.ZodObject<{
+    actionRunId: z.ZodUUID;
+    step: z.ZodString;
+    ownerType: z.ZodEnum<{
+        user: "user";
+        organization: "organization";
+    }>;
+    ownerId: z.ZodString;
+    attemptId: z.ZodUUID;
+    targetTier: z.ZodEnum<{
+        local: "local";
+        dev: "dev";
+        staging: "staging";
+        production: "production";
+    }>;
+    allowedSecrets: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+export type VerifiedCiJobSecretAuthority = z.input<typeof VerifiedCiJobSecretAuthoritySchema>;
+export type CiJobSecretAuthorityVerifier = (runtime: VibesRuntime, db: DrizzleDb, request: CiJobSecretReadRequest) => Promise<VerifiedCiJobSecretAuthority | null | undefined>;
+export declare const ConnectionConfigSchema: z.ZodRecord<z.ZodString, z.ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>;
+export declare const MailIdentitySchema: z.ZodObject<{
+    fromEmail: z.ZodOptional<z.ZodString>;
+    fromName: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const CredentialStateSchema: z.ZodObject<{
+    expiresAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    status: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const DeploymentAuthoritySchema: z.ZodObject<{
+    deploymentId: z.ZodString;
+    agentId: z.ZodString;
+    ownerUserId: z.ZodString;
+    organizationId: z.ZodOptional<z.ZodString>;
+    integrationId: z.ZodString;
+    sourceId: z.ZodString;
+    channelId: z.ZodString;
+    guildId: z.ZodOptional<z.ZodString>;
+    connectionId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type VerifiedDeploymentAuthority = z.infer<typeof DeploymentAuthoritySchema>;
+export declare const DeploymentVerificationSchema: z.ZodObject<{
+    allowed: z.ZodOptional<z.ZodBoolean>;
+    authority: z.ZodOptional<z.ZodObject<{
+        deploymentId: z.ZodString;
+        agentId: z.ZodString;
+        ownerUserId: z.ZodString;
+        organizationId: z.ZodOptional<z.ZodString>;
+        integrationId: z.ZodString;
+        sourceId: z.ZodString;
+        channelId: z.ZodString;
+        guildId: z.ZodOptional<z.ZodString>;
+        connectionId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+//# sourceMappingURL=connection.d.ts.map

package/dist/server/integration-accounts/schemas/connection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../../../src/server/integration-accounts/schemas/connection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAyB,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAE/E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAC;AAIvE,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;kBAMlC,CAAC;AACZ,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;kBAE9B,CAAC;AACZ,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;kBAIpC,CAAC;AACZ,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,MAAM,MAAM,4BAA4B,GAAG,CAC1C,OAAO,EAAE,YAAY,EACrB,EAAE,EAAE,SAAS,EACb,OAAO,EAAE,sBAAsB,KAC3B,OAAO,CAAC,4BAA4B,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;AAE9D,eAAO,MAAM,sBAAsB,2QAAqD,CAAC;AACzF,eAAO,MAAM,kBAAkB;;;iBAG7B,CAAC;AACH,eAAO,MAAM,qBAAqB;;;iBAGhC,CAAC;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;iBAUpC,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AACpF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;iBAGvC,CAAC"}