@xemahq/biome-activity-sdk 0.1.1

package/LICENSE

@@ -0,0 +1 @@
+Copyright (c) 2026 Xema. All rights reserved.

package/README.md

@@ -0,0 +1,74 @@
+<!-- Banner: inline SVG (from assets/banner-template.svg). Renders on GitHub; npm strips inline SVG. -->
+<p align="center">
+<svg width="680" height="120" viewBox="0 0 680 120" fill="none" xmlns="http://www.w3.org/2000/svg" role="img" aria-label="@xemahq/biome-activity-sdk">
+  <rect width="680" height="120" rx="14" fill="#0B1020"/>
+  <g transform="translate(28,34)">
+    <path d="M26 0 L52 15 L52 45 L26 60 L0 45 L0 15 Z" fill="#8B5CF6" opacity="0.18"/>
+    <path d="M26 12 L41 21 L41 39 L26 48 L11 39 L11 21 Z" fill="#8B5CF6"/>
+  </g>
+  <text x="92" y="52" font-family="ui-monospace,SFMono-Regular,Menlo,monospace" font-size="22" fill="#F8FAFC" font-weight="700">@xemahq/biome-activity-sdk</text>
+  <text x="92" y="80" font-family="ui-sans-serif,system-ui,sans-serif" font-size="15" fill="#94A3B8">Helpers for outbound integration calls inside workflow activities.</text>
+  <text x="652" y="105" text-anchor="end" font-family="ui-sans-serif,system-ui,sans-serif" font-size="12" fill="#475569">xema.dev</text>
+</svg>
+</p>
+
+<p align="center">
+  <a href="https://xema.dev">Website</a> &middot;
+  <a href="https://www.npmjs.com/package/@xemahq/biome-activity-sdk">npm</a>
+</p>
+
+<p align="center">
+  <img alt="npm" src="https://img.shields.io/npm/v/%40xemahq%2Fbiome-activity-sdk?color=2563eb&label=npm">
+  <img alt="license" src="https://img.shields.io/npm/l/%40xemahq%2Fbiome-activity-sdk?color=10b981">
+  <img alt="types" src="https://img.shields.io/npm/types/%40xemahq%2Fbiome-activity-sdk?color=3178c6">
+</p>
+
+# @xemahq/biome-activity-sdk
+
+> Helpers for outbound integration calls inside workflow activities
+
+## Overview
+
+This package gives workflow activity authors a small set of helpers for talking
+to external providers. Its central helper, `withIntegrationToken`, mints a
+credential on behalf of a user, runs the caller's outbound request with that
+token, and re-mints once on a single auth failure before giving up.
+
+It is provider-neutral and credential-kind-neutral by construction: the helper
+does not know which provider it is speaking to. The caller supplies the request
+function and signals an auth failure by throwing `IntegrationAuthError`, which is
+the only error the helper retries on — everything else propagates immediately.
+
+## When to use it
+
+- Use it from biome workflow activities that make authenticated outbound calls
+  to an external provider.
+- Reach for `withIntegrationToken` when you want automatic re-mint-and-retry on
+  a single expired-token failure.
+
+## Installation
+
+```bash
+pnpm add @xemahq/biome-activity-sdk
+```
+
+## Usage
+
+```ts
+import { withIntegrationToken, IntegrationAuthError } from '@xemahq/biome-activity-sdk';
+import { CredentialKind } from '@xemahq/connector-contracts';
+
+const result = await withIntegrationToken(
+  { adapterKind: 'scm', provider: 'GITHUB', credentialKind: CredentialKind.AppInstall, userId: ctx.actorId },
+  async (token) => {
+    const res = await fetch(url, { headers: { Authorization: `Bearer ${token.accessToken}` } });
+    if (res.status === 401) throw new IntegrationAuthError(401);
+    if (!res.ok) throw new Error(`HTTP ${res.status}`);
+    return res.json();
+  },
+);
+```
+
+## License
+
+Proprietary — &copy; Xema. All rights reserved. — [xema.dev](https://xema.dev)

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export * from './lib/with-integration-token';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,8BAA8B,CAAC"}

package/dist/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./lib/with-integration-token"), exports);
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,+DAA6C"}

package/dist/lib/with-integration-token.d.ts

@@ -0,0 +1,14 @@
+import type { CredentialKind, MintedToken, ResourceRef } from '@xemahq/kernel-contracts/connector';
+export interface WithIntegrationTokenInput {
+    readonly adapterKind: string;
+    readonly provider: string;
+    readonly credentialKind: CredentialKind;
+    readonly userId: string;
+    readonly resourceRef?: ResourceRef;
+}
+export declare class IntegrationAuthError extends Error {
+    readonly status: number;
+    constructor(status: number, message?: string);
+}
+export declare function withIntegrationToken<T>(input: WithIntegrationTokenInput, fn: (token: MintedToken) => Promise<T>): Promise<T>;
+//# sourceMappingURL=with-integration-token.d.ts.map

package/dist/lib/with-integration-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"with-integration-token.d.ts","sourceRoot":"","sources":["../../src/lib/with-integration-token.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,cAAc,EACd,WAAW,EACX,WAAW,EACZ,MAAM,oCAAoC,CAAC;AAY5C,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;CACpC;AAcD,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM;CAK7C;AAyBD,wBAAsB,oBAAoB,CAAC,CAAC,EAC1C,KAAK,EAAE,yBAAyB,EAChC,EAAE,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,GACrC,OAAO,CAAC,CAAC,CAAC,CAgBZ"}

package/dist/lib/with-integration-token.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IntegrationAuthError = void 0;
+exports.withIntegrationToken = withIntegrationToken;
+const connector_gateway_api_client_1 = require("@xemahq/connector-gateway-api-client");
+class IntegrationAuthError extends Error {
+    status;
+    constructor(status, message) {
+        super(message ?? `Integration auth failed with status ${status}`);
+        this.name = 'IntegrationAuthError';
+        this.status = status;
+    }
+}
+exports.IntegrationAuthError = IntegrationAuthError;
+async function withIntegrationToken(input, fn) {
+    const first = await mint(input);
+    try {
+        return await fn(first);
+    }
+    catch (cause) {
+        if (cause instanceof IntegrationAuthError) {
+            const second = await mint(input);
+            return fn(second);
+        }
+        throw cause;
+    }
+}
+async function mint(input) {
+    const envelope = await (0, connector_gateway_api_client_1.credentialsControllerResolve)({
+        adapterKind: input.adapterKind,
+        provider: input.provider,
+        credentialKind: input.credentialKind,
+        userId: input.userId,
+        ...(input.resourceRef
+            ? {
+                resourceRef: {
+                    type: input.resourceRef.type,
+                    id: input.resourceRef.id,
+                },
+            }
+            : {}),
+    });
+    return envelope.data;
+}
+//# sourceMappingURL=with-integration-token.js.map

package/dist/lib/with-integration-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"with-integration-token.js","sourceRoot":"","sources":["../../src/lib/with-integration-token.ts"],"names":[],"mappings":";;;AAqEA,oDAmBC;AAxFD,uFAAoF;AAqCpF,MAAa,oBAAqB,SAAQ,KAAK;IACpC,MAAM,CAAS;IACxB,YAAY,MAAc,EAAE,OAAgB;QAC1C,KAAK,CAAC,OAAO,IAAI,uCAAuC,MAAM,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAPD,oDAOC;AAyBM,KAAK,UAAU,oBAAoB,CACxC,KAAgC,EAChC,EAAsC;IAEtC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,oBAAoB,EAAE,CAAC;YAM1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;YACjC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;QACpB,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,KAAgC;IAClD,MAAM,QAAQ,GAAG,MAAM,IAAA,2DAA4B,EAAC;QAClD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK,CAAC,cAAmC;QACzD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,CAAC,KAAK,CAAC,WAAW;YACnB,CAAC,CAAC;gBACE,WAAW,EAAE;oBACX,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC,IAAI;oBAC5B,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE;iBACzB;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KAC8C,CAAC,CAAC;IAKzD,OAAO,QAAQ,CAAC,IAA8B,CAAC;AACjD,CAAC"}

package/package.json

@@ -0,0 +1,35 @@
+{
+  "name": "@xemahq/biome-activity-sdk",
+  "version": "0.1.1",
+  "description": "Activity-side helpers plugins use from inside workflow activities. Today: `withIntegrationToken` — mints a credential via integration-adapters-api, runs the caller's outbound request, and re-mints on a single 401 before giving up. Provider-neutral and credential-kind-neutral by design.",
+  "publishConfig": {
+    "registry": "https://npm.pkg.github.com"
+  },
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "devDependencies": {
+    "@types/node": "25.2.3",
+    "prettier": "3.6.2",
+    "typescript": "5.9.3"
+  },
+  "dependencies": {
+    "@xemahq/kernel-contracts": "^0.2.0",
+    "@xemahq/connector-gateway-api-client": "0.1.2"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "xema-source": "./src/index.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "clean": "rm -rf dist",
+    "build": "tsc -p tsconfig.json",
+    "format": "prettier --write \"src/**/*.ts\"",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  }
+}