daemora 1.0.0-alpha.0

package/dist/integrations/IntegrationManager.js

@@ -0,0 +1,580 @@
+/**
+ * IntegrationManager — orchestrates OAuth flows for all integrations.
+ *
+ * Surfaces:
+ *   startAuth(integration, redirectUri)  → { url, state }
+ *   completeAuth(state, code)             → { integration, accountLabel }
+ *   getAccessToken(integration, accountId?) → string    (auto-refreshes)
+ *   disconnect(integration, accountId)
+ *   listAccounts(integration?)
+ *   availability()                        → which integrations have working creds
+ *
+ * Pending auth state (the code-verifier + integration id we expect back
+ * at callback) lives in an in-memory map keyed by `state`. Entries
+ * expire after 10 minutes.
+ */
+import { EventEmitter } from "node:events";
+import { createLogger } from "../util/logger.js";
+import { ProviderError, ValidationError } from "../util/errors.js";
+import { readExtraScopes, resolveIntegrationKeys } from "./keys.js";
+import { generatePKCE, generateState } from "./pkce.js";
+import { githubProvider } from "./providers/github.js";
+import { googleProvider } from "./providers/google.js";
+import { linkedinProvider } from "./providers/linkedin.js";
+import { metaProvider } from "./providers/meta.js";
+import { notionProvider } from "./providers/notion.js";
+import { redditProvider } from "./providers/reddit.js";
+import { tiktokProvider } from "./providers/tiktok.js";
+import { twitterProvider } from "./providers/twitter.js";
+const log = createLogger("integrations.manager");
+/**
+ * When `getAccessToken` is called and the stored token has less than
+ * this long remaining, we transparently refresh before returning.
+ * Short enough that UI requests don't wait on a refresh they could
+ * have avoided; long enough that API calls hitting on-expiry get a
+ * fresh token the first time.
+ */
+const EXPIRY_BUFFER_SECONDS = 5 * 60;
+/**
+ * Background refresher poll cadence + pre-expiry window. Every
+ * BG_TICK_MS we scan connected accounts and refresh any with less
+ * than BG_PRE_EXPIRY_SECONDS remaining. This keeps access tokens
+ * warm so interactive requests never pay the refresh cost.
+ *
+ * Buffer must exceed the cadence — otherwise a token can expire
+ * mid-cycle and the next sweep finds it already dead. With 30 min
+ * cadence + 35 min buffer, even Google's 1 h access token gets
+ * refreshed at minute ~25-30 of its life, well before expiry.
+ */
+const BG_TICK_MS = 30 * 60_000;
+const BG_PRE_EXPIRY_SECONDS = 35 * 60;
+/** Pending auth states live 10 min. */
+const PENDING_TTL_MS = 10 * 60_000;
+/**
+ * Integration → OAuth provider + default scope list. The integration id
+ * is the user-facing name; multiple integrations can share one
+ * provider (facebook + instagram both ride Meta).
+ */
+const INTEGRATION_CONFIG = {
+    twitter: {
+        provider: "twitter",
+        scopes: [
+            "tweet.read", "tweet.write", "users.read",
+            "follows.read", "follows.write",
+            "like.read", "like.write",
+            "offline.access",
+        ],
+    },
+    youtube: {
+        provider: "google",
+        scopes: [
+            "https://www.googleapis.com/auth/youtube",
+            "https://www.googleapis.com/auth/youtube.upload",
+            "https://www.googleapis.com/auth/youtube.readonly",
+            "https://www.googleapis.com/auth/youtube.force-ssl",
+            "https://www.googleapis.com/auth/userinfo.email",
+        ],
+    },
+    gmail: {
+        provider: "google",
+        scopes: [
+            "https://www.googleapis.com/auth/gmail.send",
+            "https://www.googleapis.com/auth/gmail.modify",
+            "https://www.googleapis.com/auth/gmail.readonly",
+            "https://www.googleapis.com/auth/gmail.compose",
+            "https://www.googleapis.com/auth/userinfo.email",
+        ],
+    },
+    google_calendar: {
+        provider: "google",
+        scopes: [
+            "https://www.googleapis.com/auth/calendar",
+            "https://www.googleapis.com/auth/calendar.events",
+            "https://www.googleapis.com/auth/userinfo.email",
+        ],
+    },
+    github: {
+        provider: "github",
+        scopes: ["repo", "workflow", "read:org", "gist", "user", "read:packages"],
+    },
+    notion: {
+        // Notion's OAuth doesn't take scopes — access is gated by the pages
+        // the user explicitly shares with the integration at consent time.
+        provider: "notion",
+        scopes: [],
+    },
+    reddit: {
+        provider: "reddit",
+        scopes: [
+            "identity",
+            "read",
+            "submit",
+            "edit",
+            "history",
+            "mysubreddits",
+            "vote",
+            "save",
+            "subscribe",
+            "report",
+        ],
+    },
+    linkedin: {
+        provider: "linkedin",
+        // OpenID scopes + UGC share (post to own feed). Company-page /
+        // marketing-platform scopes (w_organization_social, r_ads_reporting)
+        // require Marketing Partner status and aren't requested by default.
+        scopes: ["openid", "profile", "email", "w_member_social"],
+    },
+    tiktok: {
+        provider: "tiktok",
+        // Full TikTok scope set covering the products daemora actually uses.
+        // Each scope requires its corresponding "Product" to be enabled on
+        // the app in the developer portal — a request with even ONE scope
+        // whose product isn't enabled is rejected wholesale (`invalid_scope`).
+        //
+        // Mapping (enable each Product in TikTok portal → /apps/<id> → "Add products"):
+        //
+        //   user.info.basic                       ← Login Kit
+        //   user.info.profile, user.info.stats    ← User Information API
+        //   video.list                            ← Video Management API
+        //   video.upload, video.publish           ← Content Posting API
+        //   comment.list, comment.list.manage     ← Comment Management API
+        //
+        // video.publish requires TikTok app audit; before audit, uploaded
+        // videos are forced to SELF_ONLY visibility. video.upload covers
+        // the draft-only flow that works pre-audit.
+        // Default = the scope set most TikTok sandbox apps have available
+        // out of the box once they add Login Kit + Content Posting API +
+        // User Information API (the three sandbox-eligible products).
+        // Anything beyond requires extra products in the portal AND will
+        // be rejected with `invalid_scope` if missing — paste extras into
+        // the Extra Scopes field once the matching product is added:
+        //
+        //   video.list                            ← Video Management API
+        //   comment.list, comment.list.manage     ← Comment Management API
+        //   research.adlib.basic, research.data.basic ← Research API
+        scopes: [
+            "user.info.basic",
+            "user.info.profile",
+            "user.info.stats",
+            "video.upload",
+            "video.publish",
+        ],
+    },
+    facebook: {
+        provider: "meta",
+        scopes: [
+            "pages_show_list",
+            "pages_read_engagement",
+            "pages_manage_posts",
+            "pages_manage_engagement",
+            "pages_messaging",
+            "public_profile",
+            "email",
+        ],
+    },
+    instagram: {
+        provider: "meta",
+        scopes: [
+            "instagram_basic",
+            "instagram_content_publish",
+            "instagram_manage_comments",
+            "instagram_manage_insights",
+            "pages_show_list",
+            "pages_read_engagement",
+        ],
+    },
+};
+const PROVIDERS = {
+    twitter: twitterProvider,
+    google: googleProvider,
+    meta: metaProvider,
+    github: githubProvider,
+    notion: notionProvider,
+    reddit: redditProvider,
+    linkedin: linkedinProvider,
+    tiktok: tiktokProvider,
+};
+/**
+ * Events:
+ *   "connected"    { integration, account } — fires when a new auth completes.
+ *   "disconnected" { integration, accountId } — fires on disconnect.
+ * Listeners register / unregister the corresponding crew + watcher types.
+ */
+export class IntegrationManager extends EventEmitter {
+    cfg;
+    store;
+    pending = new Map();
+    /**
+     * In-flight refresh deduplication. Keyed by "integration:accountId".
+     * When two concurrent getAccessToken calls both need a refresh, the
+     * second awaits the first's promise instead of firing a duplicate
+     * exchange against the provider (Google issues at most one fresh
+     * refresh_token per consent — racing breaks that).
+     */
+    refreshInflight = new Map();
+    /**
+     * Track integrations we've logged a "refresh failed — reconnect
+     * needed" for, so we don't spam logs every call while the user
+     * hasn't reconnected yet. Cleared when a refresh succeeds.
+     */
+    refreshFailures = new Map();
+    /** Last time we logged the "vault locked, skipping" warning, in ms epoch. */
+    lastLockedWarnAt = 0;
+    /**
+     * One-shot per-account timers for tokens whose lifetime is shorter
+     * than the 30-min sweep cadence. Without these, a fresh token with
+     * a 10-min TTL would expire 20 min before the next sweep notices.
+     * Keyed by "integration:accountId"; replaced on every refresh.
+     */
+    earlyRefreshTimers = new Map();
+    constructor(cfg, store) {
+        super();
+        this.cfg = cfg;
+        this.store = store;
+        // Best-effort GC for stale pending flows.
+        const gc = setInterval(() => this.sweepPending(), 60_000);
+        gc.unref?.();
+        // Background refresher — keeps tokens warm well before they
+        // expire so interactive requests never pay the refresh latency.
+        const bg = setInterval(() => void this.backgroundRefresh(), BG_TICK_MS);
+        bg.unref?.();
+        // Vault-locked at boot is the silent failure mode: bg-refresh
+        // skips every tick while locked, then the user unlocks via the UI
+        // an hour later and finds every token expired. Re-firing on the
+        // unlock event closes that gap. Mirrors the channel-startup hook
+        // in src/cli/commands/start.ts.
+        this.cfg.vault.on("unlocked", () => {
+            void this.backgroundRefresh();
+        });
+    }
+    /** Resolve the OAuth provider an integration rides (e.g. youtube/gmail → google). */
+    providerFor(integration) {
+        const cfg = INTEGRATION_CONFIG[integration];
+        if (!cfg)
+            throw new ValidationError(`Unknown integration: ${integration}`);
+        return cfg.provider;
+    }
+    /** Default OAuth scopes Daemora requests for this integration. Used by the UI credentials modal. */
+    defaultScopesFor(integration) {
+        return INTEGRATION_CONFIG[integration]?.scopes ?? [];
+    }
+    /** Tell the UI which integrations actually have working client creds. */
+    availability() {
+        const keys = resolveIntegrationKeys(this.cfg);
+        const out = {};
+        out.twitter = keys.twitter ? { available: true } : { available: false, reason: "TWITTER_CLIENT_ID not configured" };
+        out.youtube = keys.google ? { available: true } : { available: false, reason: "GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET not configured" };
+        out.gmail = keys.google ? { available: true } : { available: false, reason: "GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET not configured" };
+        out.google_calendar = keys.google ? { available: true } : { available: false, reason: "GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET not configured" };
+        out.facebook = keys.meta ? { available: true } : { available: false, reason: "META_APP_ID / META_APP_SECRET not configured" };
+        out.instagram = keys.meta ? { available: true } : { available: false, reason: "META_APP_ID / META_APP_SECRET not configured" };
+        out.github = keys.github ? { available: true } : { available: false, reason: "GITHUB_CLIENT_ID / GITHUB_CLIENT_SECRET not configured" };
+        out.notion = keys.notion ? { available: true } : { available: false, reason: "NOTION_CLIENT_ID / NOTION_CLIENT_SECRET not configured" };
+        out.reddit = keys.reddit ? { available: true } : { available: false, reason: "REDDIT_CLIENT_ID / REDDIT_CLIENT_SECRET not configured" };
+        out.linkedin = keys.linkedin ? { available: true } : { available: false, reason: "LINKEDIN_CLIENT_ID / LINKEDIN_CLIENT_SECRET not configured" };
+        out.tiktok = keys.tiktok ? { available: true } : { available: false, reason: "TIKTOK_CLIENT_KEY / TIKTOK_CLIENT_SECRET not configured" };
+        return out;
+    }
+    /** Begin an OAuth flow; returns a URL to redirect the user to. */
+    startAuth(integration, redirectUri) {
+        const cfg = INTEGRATION_CONFIG[integration];
+        if (!cfg)
+            throw new ValidationError(`Unknown integration: ${integration}`);
+        const keys = resolveIntegrationKeys(this.cfg);
+        const { clientId } = requireClient(integration, cfg.provider, keys);
+        const provider = PROVIDERS[cfg.provider];
+        const state = generateState();
+        const pkce = provider.usesPKCE ? generatePKCE() : null;
+        // Dedup scopes: defaults + any user-added extras from the vault.
+        const extras = readExtraScopes(this.cfg, integration);
+        const mergedScopes = Array.from(new Set([...cfg.scopes, ...extras]));
+        const url = provider.authorizeUrl({
+            clientId,
+            redirectUri,
+            state,
+            scopes: mergedScopes,
+            ...(pkce ? { pkceVerifier: pkce.verifier } : {}),
+        });
+        this.pending.set(state, {
+            integration,
+            provider: cfg.provider,
+            redirectUri,
+            ...(pkce ? { pkceVerifier: pkce.verifier } : {}),
+            createdAt: Date.now(),
+        });
+        return { url, state };
+    }
+    /** Complete an OAuth flow. Called from the callback route. */
+    async completeAuth(state, code) {
+        const entry = this.pending.get(state);
+        if (!entry)
+            throw new ValidationError("Invalid or expired auth state. Try connecting again.");
+        this.pending.delete(state);
+        const provider = PROVIDERS[entry.provider];
+        const keys = resolveIntegrationKeys(this.cfg);
+        const { clientId, clientSecret } = requireClient(entry.integration, entry.provider, keys);
+        const tokens = await provider.exchangeCode({
+            code,
+            redirectUri: entry.redirectUri,
+            ...(entry.pkceVerifier ? { pkceVerifier: entry.pkceVerifier } : {}),
+            clientId,
+            ...(clientSecret ? { clientSecret } : {}),
+        });
+        if (!tokens.accountId) {
+            throw new ProviderError("Provider returned no account id — cannot persist connection.", entry.provider);
+        }
+        this.store.upsert({ integration: entry.integration, provider: entry.provider, tokens });
+        log.info({ integration: entry.integration, account: tokens.accountLabel }, "integration connected");
+        const account = {
+            integration: entry.integration,
+            provider: entry.provider,
+            accountId: tokens.accountId,
+            accountLabel: tokens.accountLabel,
+            scopes: tokens.scopes,
+            connectedAt: Date.now(),
+            expiresAt: tokens.expiresAt,
+        };
+        this.emit("connected", { integration: entry.integration, account });
+        // A token issued just now with TTL < 30 min would slip past the
+        // background sweep — schedule a per-account timer to catch it.
+        this.scheduleEarlyRefresh(entry.integration, tokens.accountId, tokens.expiresAt);
+        return { integration: entry.integration, accountLabel: tokens.accountLabel };
+    }
+    /**
+     * Return a valid access token for an integration, refreshing on-
+     * demand if the stored one is near expiry. Returns null when the
+     * user has never connected that integration.
+     *
+     * `force=true` ignores the expiry check and forces a refresh — used
+     * by the retry-on-401 path in integration clients when the provider
+     * rejects a token we thought was still valid (revoked, scopes
+     * changed, etc).
+     */
+    async getAccessToken(integration, accountId, force = false) {
+        const tokens = this.store.getTokens(integration, accountId);
+        if (!tokens)
+            return null;
+        const now = Math.floor(Date.now() / 1000);
+        const nearExpiry = tokens.expiresAt > 0 && tokens.expiresAt - now < EXPIRY_BUFFER_SECONDS;
+        const needsRefresh = force || nearExpiry;
+        if (!needsRefresh)
+            return tokens.accessToken;
+        if (!tokens.refreshToken)
+            return tokens.accessToken;
+        // Deduplicate concurrent refreshes — if two callers race, they
+        // share the same promise so we don't burn a refresh_token twice.
+        const key = `${integration}:${tokens.accountId}`;
+        const existing = this.refreshInflight.get(key);
+        if (existing)
+            return existing;
+        const job = this.doRefresh(integration, tokens).finally(() => {
+            this.refreshInflight.delete(key);
+        });
+        this.refreshInflight.set(key, job);
+        return job;
+    }
+    /**
+     * Force a refresh for a specific account, bypassing the expiry
+     * check. Used by integration clients on a 401 — the stored token
+     * may have been revoked or invalidated independent of its expiry.
+     * Returns the fresh access token or null if refresh failed.
+     */
+    async forceRefresh(integration, accountId) {
+        return this.getAccessToken(integration, accountId, true);
+    }
+    async doRefresh(integration, tokens) {
+        const cfg = INTEGRATION_CONFIG[integration];
+        const provider = PROVIDERS[cfg.provider];
+        const keys = resolveIntegrationKeys(this.cfg);
+        const { clientId, clientSecret } = requireClient(integration, cfg.provider, keys);
+        const key = `${integration}:${tokens.accountId}`;
+        try {
+            const refreshed = await provider.refresh({
+                refreshToken: tokens.refreshToken,
+                clientId,
+                ...(clientSecret ? { clientSecret } : {}),
+            });
+            // Providers vary on whether they return a fresh refresh_token
+            // (Google often doesn't; Meta doesn't have one). Fall back to
+            // the existing refresh credential when the response omits it.
+            const carriedRefresh = refreshed.refreshToken ?? tokens.refreshToken;
+            const merged = {
+                ...refreshed,
+                ...(carriedRefresh ? { refreshToken: carriedRefresh } : {}),
+                accountId: tokens.accountId,
+                accountLabel: tokens.accountLabel,
+            };
+            this.store.upsert({ integration, provider: cfg.provider, tokens: merged });
+            this.refreshFailures.delete(key);
+            this.emit("refreshed", { integration, accountId: tokens.accountId });
+            // Reschedule the early-refresh timer against the new expiry so
+            // back-to-back short-TTL tokens keep getting caught.
+            this.scheduleEarlyRefresh(integration, tokens.accountId, merged.expiresAt);
+            return merged.accessToken;
+        }
+        catch (e) {
+            // Log once per failure window — spamming on every request hurts
+            // log readability and doesn't give the user any new info.
+            const lastLoggedAt = this.refreshFailures.get(key) ?? 0;
+            if (Date.now() - lastLoggedAt > 60_000) {
+                log.error({ integration, err: e.message }, "token refresh failed — user may need to reconnect");
+                this.refreshFailures.set(key, Date.now());
+            }
+            this.emit("refresh-failed", { integration, accountId: tokens.accountId, error: e.message });
+            // Return the stale token so the caller's 401-retry path can
+            // surface a meaningful error to the user.
+            return tokens.accessToken;
+        }
+    }
+    /**
+     * Background pass over every connected account, refreshing any
+     * whose token expires in less than BG_PRE_EXPIRY_SECONDS. Called
+     * every BG_TICK_MS from the constructor. Errors are swallowed —
+     * the interactive path will retry.
+     */
+    async backgroundRefresh() {
+        if (!this.cfg.vault.isUnlocked()) {
+            // Throttled to one warning per cadence — without this the user
+            // sees "refresh not working" with zero log evidence and has no
+            // way to know the vault is the gate.
+            const now = Date.now();
+            if (now - this.lastLockedWarnAt > BG_TICK_MS - 1000) {
+                log.warn("token refresh skipped — vault locked");
+                this.lastLockedWarnAt = now;
+            }
+            return;
+        }
+        const now = Math.floor(Date.now() / 1000);
+        const accounts = this.store.list();
+        for (const a of accounts) {
+            // Always (re)schedule the per-account early-refresh timer so a
+            // fresh token whose TTL is shorter than the 30-min sweep window
+            // gets refreshed before it expires. Cheap — at most one timer
+            // per connected account.
+            this.scheduleEarlyRefresh(a.integration, a.accountId, a.expiresAt);
+            if (a.expiresAt === 0 || a.expiresAt - now > BG_PRE_EXPIRY_SECONDS)
+                continue;
+            try {
+                await this.getAccessToken(a.integration, a.accountId);
+            }
+            catch { /* surfaced in doRefresh already */ }
+        }
+    }
+    /**
+     * Schedule a one-shot refresh that fires shortly before a specific
+     * account's token expires. Cancels any prior timer for the same
+     * account first. Skips when expiry is far enough out that the
+     * BG_TICK_MS sweep will catch it; or when there's no expiry data.
+     */
+    scheduleEarlyRefresh(integration, accountId, expiresAt) {
+        const key = `${integration}:${accountId}`;
+        const existing = this.earlyRefreshTimers.get(key);
+        if (existing) {
+            clearTimeout(existing);
+            this.earlyRefreshTimers.delete(key);
+        }
+        if (!expiresAt)
+            return; // provider reports no expiry → nothing to schedule
+        const nowSec = Math.floor(Date.now() / 1000);
+        const secondsLeft = expiresAt - nowSec;
+        // Refresh 60 s before actual expiry — enough headroom for the
+        // exchange round-trip without burning the token's last seconds.
+        const fireInSec = secondsLeft - 60;
+        if (fireInSec <= 0) {
+            // Already inside the safety margin (or past it) — refresh now.
+            void this.getAccessToken(integration, accountId).catch(() => { });
+            return;
+        }
+        // If the next regular sweep will catch it before our timer would
+        // fire, don't bother — saves a setTimeout for the common case.
+        if (fireInSec * 1000 >= BG_TICK_MS)
+            return;
+        const t = setTimeout(() => {
+            this.earlyRefreshTimers.delete(key);
+            void this.getAccessToken(integration, accountId).catch(() => { });
+        }, fireInSec * 1000);
+        t.unref?.();
+        this.earlyRefreshTimers.set(key, t);
+    }
+    disconnect(integration, accountId) {
+        this.store.remove(integration, accountId);
+        const key = `${integration}:${accountId}`;
+        const t = this.earlyRefreshTimers.get(key);
+        if (t) {
+            clearTimeout(t);
+            this.earlyRefreshTimers.delete(key);
+        }
+        this.emit("disconnected", { integration, accountId });
+    }
+    /**
+     * Set of integration ids that currently have at least one connected
+     * account. Used by ToolRegistry.available() to gate integration-
+     * sourced tools out of the model's view until the user connects.
+     */
+    getEnabled() {
+        const out = new Set();
+        for (const a of this.store.list())
+            out.add(a.integration);
+        return out;
+    }
+    listAccounts(integration) {
+        return this.store.list(integration);
+    }
+    sweepPending() {
+        const cutoff = Date.now() - PENDING_TTL_MS;
+        for (const [state, entry] of this.pending) {
+            if (entry.createdAt < cutoff)
+                this.pending.delete(state);
+        }
+    }
+}
+function requireClient(integration, provider, keys) {
+    if (provider === "twitter") {
+        if (!keys.twitter)
+            throw new ValidationError(`${integration}: TWITTER_CLIENT_ID not configured.`);
+        // clientSecret only present for Confidential client apps; spread
+        // conditionally so the returned shape matches `clientSecret?: string`.
+        return {
+            clientId: keys.twitter.clientId,
+            ...(keys.twitter.clientSecret ? { clientSecret: keys.twitter.clientSecret } : {}),
+        };
+    }
+    if (provider === "google") {
+        if (!keys.google)
+            throw new ValidationError(`${integration}: GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET not configured.`);
+        return { clientId: keys.google.clientId, clientSecret: keys.google.clientSecret };
+    }
+    if (provider === "meta") {
+        if (!keys.meta)
+            throw new ValidationError(`${integration}: META_APP_ID / META_APP_SECRET not configured.`);
+        return { clientId: keys.meta.appId, clientSecret: keys.meta.appSecret };
+    }
+    if (provider === "github") {
+        if (!keys.github)
+            throw new ValidationError(`${integration}: GITHUB_CLIENT_ID / GITHUB_CLIENT_SECRET not configured.`);
+        return { clientId: keys.github.clientId, clientSecret: keys.github.clientSecret };
+    }
+    if (provider === "notion") {
+        if (!keys.notion)
+            throw new ValidationError(`${integration}: NOTION_CLIENT_ID / NOTION_CLIENT_SECRET not configured.`);
+        return { clientId: keys.notion.clientId, clientSecret: keys.notion.clientSecret };
+    }
+    if (provider === "reddit") {
+        if (!keys.reddit)
+            throw new ValidationError(`${integration}: REDDIT_CLIENT_ID / REDDIT_CLIENT_SECRET not configured.`);
+        return { clientId: keys.reddit.clientId, clientSecret: keys.reddit.clientSecret };
+    }
+    if (provider === "linkedin") {
+        if (!keys.linkedin)
+            throw new ValidationError(`${integration}: LINKEDIN_CLIENT_ID / LINKEDIN_CLIENT_SECRET not configured.`);
+        return { clientId: keys.linkedin.clientId, clientSecret: keys.linkedin.clientSecret };
+    }
+    if (provider === "tiktok") {
+        if (!keys.tiktok)
+            throw new ValidationError(`${integration}: TIKTOK_CLIENT_KEY / TIKTOK_CLIENT_SECRET not configured.`);
+        return { clientId: keys.tiktok.clientKey, clientSecret: keys.tiktok.clientSecret };
+    }
+    throw new ValidationError(`Unknown provider ${provider} for integration ${integration}`);
+}
+//# sourceMappingURL=IntegrationManager.js.map

package/dist/integrations/IntegrationManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"IntegrationManager.js","sourceRoot":"","sources":["../../src/integrations/IntegrationManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAIzD,MAAM,GAAG,GAAG,YAAY,CAAC,sBAAsB,CAAC,CAAC;AAEjD;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,CAAC;AAErC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,GAAG,EAAE,GAAG,MAAM,CAAC;AAC/B,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,CAAC;AAEtC,uCAAuC;AACvC,MAAM,cAAc,GAAG,EAAE,GAAG,MAAM,CAAC;AAUnC;;;;GAIG;AACH,MAAM,kBAAkB,GAGnB;IACH,OAAO,EAAE;QACP,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE;YACN,YAAY,EAAE,aAAa,EAAE,YAAY;YACzC,cAAc,EAAE,eAAe;YAC/B,WAAW,EAAE,YAAY;YACzB,gBAAgB;SACjB;KACF;IACD,OAAO,EAAE;QACP,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE;YACN,yCAAyC;YACzC,gDAAgD;YAChD,kDAAkD;YAClD,mDAAmD;YACnD,gDAAgD;SACjD;KACF;IACD,KAAK,EAAE;QACL,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE;YACN,4CAA4C;YAC5C,8CAA8C;YAC9C,gDAAgD;YAChD,+CAA+C;YAC/C,gDAAgD;SACjD;KACF;IACD,eAAe,EAAE;QACf,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE;YACN,0CAA0C;YAC1C,iDAAiD;YACjD,gDAAgD;SACjD;KACF;IACD,MAAM,EAAE;QACN,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC;KAC1E;IACD,MAAM,EAAE;QACN,oEAAoE;QACpE,mEAAmE;QACnE,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,EAAE;KACX;IACD,MAAM,EAAE;QACN,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE;YACN,UAAU;YACV,MAAM;YACN,QAAQ;YACR,MAAM;YACN,SAAS;YACT,cAAc;YACd,MAAM;YACN,MAAM;YACN,WAAW;YACX,QAAQ;SACT;KACF;IACD,QAAQ,EAAE;QACR,QAAQ,EAAE,UAAU;QACpB,+DAA+D;QAC/D,qEAAqE;QACrE,oEAAoE;QACpE,MAAM,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,iBAAiB,CAAC;KAC1D;IACD,MAAM,EAAE;QACN,QAAQ,EAAE,QAAQ;QAClB,qEAAqE;QACrE,mEAAmE;QACnE,kEAAkE;QAClE,uEAAuE;QACvE,EAAE;QACF,gFAAgF;QAChF,EAAE;QACF,sDAAsD;QACtD,iEAAiE;QACjE,iEAAiE;QACjE,gEAAgE;QAChE,mEAAmE;QACnE,EAAE;QACF,kEAAkE;QAClE,iEAAiE;QACjE,4CAA4C;QAC5C,kEAAkE;QAClE,iEAAiE;QACjE,8DAA8D;QAC9D,iEAAiE;QACjE,kEAAkE;QAClE,6DAA6D;QAC7D,EAAE;QACF,iEAAiE;QACjE,mEAAmE;QACnE,6DAA6D;QAC7D,MAAM,EAAE;YACN,iBAAiB;YACjB,mBAAmB;YACnB,iBAAiB;YACjB,cAAc;YACd,eAAe;SAChB;KACF;IACD,QAAQ,EAAE;QACR,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE;YACN,iBAAiB;YACjB,uBAAuB;YACvB,oBAAoB;YACpB,yBAAyB;YACzB,iBAAiB;YACjB,gBAAgB;YAChB,OAAO;SACR;KACF;IACD,SAAS,EAAE;QACT,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE;YACN,iBAAiB;YACjB,2BAA2B;YAC3B,2BAA2B;YAC3B,2BAA2B;YAC3B,iBAAiB;YACjB,uBAAuB;SACxB;KACF;CACF,CAAC;AAEF,MAAM,SAAS,GAAsC;IACnD,OAAO,EAAE,eAAe;IACxB,MAAM,EAAE,cAAc;IACtB,IAAI,EAAE,YAAY;IAClB,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,cAAc;IACtB,QAAQ,EAAE,gBAAgB;IAC1B,MAAM,EAAE,cAAc;CACvB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,OAAO,kBAAmB,SAAQ,YAAY;IA2B/B;IACA;IA3BF,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC1D;;;;;;OAMG;IACc,eAAe,GAAG,IAAI,GAAG,EAAkC,CAAC;IAC7E;;;;OAIG;IACc,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7D,6EAA6E;IACrE,gBAAgB,GAAG,CAAC,CAAC;IAC7B;;;;;OAKG;IACc,kBAAkB,GAAG,IAAI,GAAG,EAA0B,CAAC;IAExE,YACmB,GAAkB,EAClB,KAAuB;QAExC,KAAK,EAAE,CAAC;QAHS,QAAG,GAAH,GAAG,CAAe;QAClB,UAAK,GAAL,KAAK,CAAkB;QAGxC,0CAA0C;QAC1C,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,MAAM,CAAC,CAAC;QAC1D,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;QACb,4DAA4D;QAC5D,gEAAgE;QAChE,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,iBAAiB,EAAE,EAAE,UAAU,CAAC,CAAC;QACxE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;QACb,8DAA8D;QAC9D,kEAAkE;QAClE,gEAAgE;QAChE,iEAAiE;QACjE,gCAAgC;QAChC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,EAAE,GAAG,EAAE;YACjC,KAAK,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAChC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,qFAAqF;IACrF,WAAW,CAAC,WAA0B;QACpC,MAAM,GAAG,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,eAAe,CAAC,wBAAwB,WAAW,EAAE,CAAC,CAAC;QAC3E,OAAO,GAAG,CAAC,QAAQ,CAAC;IACtB,CAAC;IAED,oGAAoG;IACpG,gBAAgB,CAAC,WAA0B;QACzC,OAAO,kBAAkB,CAAC,WAAW,CAAC,EAAE,MAAM,IAAI,EAAE,CAAC;IACvD,CAAC;IAED,yEAAyE;IACzE,YAAY;QACV,MAAM,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,EAAoE,CAAC;QACjF,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;QACpH,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,wDAAwD,EAAE,CAAC;QACzI,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,wDAAwD,EAAE,CAAC;QACvI,GAAG,CAAC,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,wDAAwD,EAAE,CAAC;QACjJ,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,8CAA8C,EAAE,CAAC;QAC9H,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,8CAA8C,EAAE,CAAC;QAC/H,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,wDAAwD,EAAE,CAAC;QACxI,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,wDAAwD,EAAE,CAAC;QACxI,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,wDAAwD,EAAE,CAAC;QACxI,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,4DAA4D,EAAE,CAAC;QAChJ,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,yDAAyD,EAAE,CAAC;QACzI,OAAO,GAAG,CAAC;IACb,CAAC;IAED,kEAAkE;IAClE,SAAS,CAAC,WAA0B,EAAE,WAAmB;QACvD,MAAM,GAAG,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,eAAe,CAAC,wBAAwB,WAAW,EAAE,CAAC,CAAC;QAE3E,MAAM,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,WAAW,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEzC,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACvD,iEAAiE;QACjE,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACtD,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAS,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAC7E,MAAM,GAAG,GAAG,QAAQ,CAAC,YAAY,CAAC;YAChC,QAAQ;YACR,WAAW;YACX,KAAK;YACL,MAAM,EAAE,YAAY;YACpB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjD,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE;YACtB,WAAW;YACX,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,WAAW;YACX,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IACxB,CAAC;IAED,8DAA8D;IAC9D,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,IAAY;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,eAAe,CAAC,sDAAsD,CAAC,CAAC;QAC9F,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE3B,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAE1F,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC;YACzC,IAAI;YACJ,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,QAAQ;YACR,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,aAAa,CACrB,8DAA8D,EAC9D,KAAK,CAAC,QAAQ,CACf,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACxF,GAAG,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,uBAAuB,CAAC,CAAC;QAEpG,MAAM,OAAO,GAAuB;YAClC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;YACvB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;QACpE,gEAAgE;QAChE,+DAA+D;QAC/D,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACjF,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;IAC/E,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,cAAc,CAClB,WAA0B,EAC1B,SAAkB,EAClB,KAAK,GAAG,KAAK;QAEb,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEzB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,GAAG,CAAC,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG,GAAG,qBAAqB,CAAC;QAC1F,MAAM,YAAY,GAAG,KAAK,IAAI,UAAU,CAAC;QACzC,IAAI,CAAC,YAAY;YAAE,OAAO,MAAM,CAAC,WAAW,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,YAAY;YAAE,OAAO,MAAM,CAAC,WAAW,CAAC;QAEpD,+DAA+D;QAC/D,iEAAiE;QACjE,MAAM,GAAG,GAAG,GAAG,WAAW,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YAC3D,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACnC,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAAC,WAA0B,EAAE,SAAkB;QAC/D,OAAO,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC3D,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,WAA0B,EAAE,MAAgB;QAClE,MAAM,GAAG,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,aAAa,CAAC,WAAW,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAClF,MAAM,GAAG,GAAG,GAAG,WAAW,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC;gBACvC,YAAY,EAAE,MAAM,CAAC,YAAa;gBAClC,QAAQ;gBACR,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1C,CAAC,CAAC;YACH,8DAA8D;YAC9D,8DAA8D;YAC9D,8DAA8D;YAC9D,MAAM,cAAc,GAAG,SAAS,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC;YACrE,MAAM,MAAM,GAAa;gBACvB,GAAG,SAAS;gBACZ,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,YAAY,EAAE,MAAM,CAAC,YAAY;aAClC,CAAC;YACF,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3E,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;YACrE,+DAA+D;YAC/D,qDAAqD;YACrD,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YAC3E,OAAO,MAAM,CAAC,WAAW,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,gEAAgE;YAChE,0DAA0D;YAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACxD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,GAAG,MAAM,EAAE,CAAC;gBACvC,GAAG,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,GAAG,EAAG,CAAW,CAAC,OAAO,EAAE,EAAE,mDAAmD,CAAC,CAAC;gBAC3G,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAC5C,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;YACvG,4DAA4D;YAC5D,0CAA0C;YAC1C,OAAO,MAAM,CAAC,WAAW,CAAC;QAC5B,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,iBAAiB;QAC7B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC;YACjC,+DAA+D;YAC/D,+DAA+D;YAC/D,qCAAqC;YACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,IAAI,GAAG,GAAG,IAAI,CAAC,gBAAgB,GAAG,UAAU,GAAG,IAAI,EAAE,CAAC;gBACpD,GAAG,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;gBACjD,IAAI,CAAC,gBAAgB,GAAG,GAAG,CAAC;YAC9B,CAAC;YACD,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,+DAA+D;YAC/D,gEAAgE;YAChE,8DAA8D;YAC9D,yBAAyB;YACzB,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;YACnE,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,GAAG,GAAG,GAAG,qBAAqB;gBAAE,SAAS;YAC7E,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;YACxD,CAAC;YAAC,MAAM,CAAC,CAAC,mCAAmC,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,oBAAoB,CAC1B,WAA0B,EAC1B,SAAiB,EACjB,SAAiB;QAEjB,MAAM,GAAG,GAAG,GAAG,WAAW,IAAI,SAAS,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,QAAQ,EAAE,CAAC;YACb,YAAY,CAAC,QAAQ,CAAC,CAAC;YACvB,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,CAAC,SAAS;YAAE,OAAO,CAAC,mDAAmD;QAE3E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;QACvC,8DAA8D;QAC9D,gEAAgE;QAChE,MAAM,SAAS,GAAG,WAAW,GAAG,EAAE,CAAC;QACnC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACnB,+DAA+D;YAC/D,KAAK,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACjE,OAAO;QACT,CAAC;QACD,iEAAiE;QACjE,+DAA+D;QAC/D,IAAI,SAAS,GAAG,IAAI,IAAI,UAAU;YAAE,OAAO;QAE3C,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE;YACxB,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpC,KAAK,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnE,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QACZ,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACtC,CAAC;IAED,UAAU,CAAC,WAA0B,EAAE,SAAiB;QACtD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,GAAG,WAAW,IAAI,SAAS,EAAE,CAAC;QAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,EAAE,CAAC;YACN,YAAY,CAAC,CAAC,CAAC,CAAC;YAChB,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;IACxD,CAAC;IAED;;;;OAIG;IACH,UAAU;QACR,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QAC1D,OAAO,GAAG,CAAC;IACb,CAAC;IAED,YAAY,CAAC,WAA2B;QACtC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACtC,CAAC;IAEO,YAAY;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC;QAC3C,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1C,IAAI,KAAK,CAAC,SAAS,GAAG,MAAM;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;CACF;AAED,SAAS,aAAa,CACpB,WAA0B,EAC1B,QAAoB,EACpB,IAA+C;IAE/C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,GAAG,WAAW,qCAAqC,CAAC,CAAC;QAClG,iEAAiE;QACjE,uEAAuE;QACvE,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;YAC/B,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClF,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,eAAe,CAAC,GAAG,WAAW,2DAA2D,CAAC,CAAC;QACvH,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;IACpF,CAAC;IACD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,eAAe,CAAC,GAAG,WAAW,iDAAiD,CAAC,CAAC;QAC3G,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IAC1E,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,eAAe,CAAC,GAAG,WAAW,2DAA2D,CAAC,CAAC;QACvH,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;IACpF,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,eAAe,CAAC,GAAG,WAAW,2DAA2D,CAAC,CAAC;QACvH,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;IACpF,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,eAAe,CAAC,GAAG,WAAW,2DAA2D,CAAC,CAAC;QACvH,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;IACpF,CAAC;IACD,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,eAAe,CAAC,GAAG,WAAW,+DAA+D,CAAC,CAAC;QAC7H,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;IACxF,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,eAAe,CAAC,GAAG,WAAW,4DAA4D,CAAC,CAAC;QACxH,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;IACrF,CAAC;IACD,MAAM,IAAI,eAAe,CAAC,oBAAoB,QAAQ,oBAAoB,WAAW,EAAE,CAAC,CAAC;AAC3F,CAAC"}

package/dist/integrations/IntegrationStore.d.ts

@@ -0,0 +1,42 @@
+/**
+ * IntegrationStore — persists connected accounts for OAuth-backed
+ * integrations. Metadata (account id, label, scopes, expiry) lives in
+ * a SQLite table so the UI can list connections without unlocking the
+ * vault. Tokens live in the vault under keys shaped like
+ * `integration:<integration>:<accountId>`, encrypted by the existing
+ * AES-GCM + scrypt pipeline.
+ *
+ * Methods:
+ *   upsert({integration, provider, accountId, accountLabel, tokens})
+ *   getTokens(integration, accountId?)   → TokenSet | null
+ *   list(integration?)                   → IntegrationAccount[]
+ *   remove(integration, accountId)       → void  (wipes vault + row)
+ *
+ * No refresh logic here — IntegrationManager handles that.
+ */
+import type Database from "better-sqlite3";
+import type { ConfigManager } from "../config/ConfigManager.js";
+import type { IntegrationAccount, IntegrationId, ProviderId, TokenSet } from "./types.js";
+export declare class IntegrationStore {
+    private readonly db;
+    private readonly cfg;
+    private readonly insertStmt;
+    private readonly selectOne;
+    private readonly selectByInt;
+    private readonly selectAll;
+    private readonly deleteOne;
+    constructor(db: Database.Database, cfg: ConfigManager);
+    upsert(args: {
+        integration: IntegrationId;
+        provider: ProviderId;
+        tokens: TokenSet;
+    }): void;
+    /**
+     * Read-back the full token set for a given integration. When no
+     * accountId is given the most-recently-connected account wins.
+     */
+    getTokens(integration: IntegrationId, accountId?: string): TokenSet | null;
+    list(integration?: IntegrationId): readonly IntegrationAccount[];
+    remove(integration: IntegrationId, accountId: string): void;
+}
+//# sourceMappingURL=IntegrationStore.d.ts.map

package/dist/integrations/IntegrationStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"IntegrationStore.d.ts","sourceRoot":"","sources":["../../src/integrations/IntegrationStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAE3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAEhE,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAuB1F,qBAAa,gBAAgB;IAQzB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,GAAG;IARtB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;IAChD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAC/C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAC/C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;gBAG5B,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,GAAG,EAAE,aAAa;IAiCrC,MAAM,CAAC,IAAI,EAAE;QACX,WAAW,EAAE,aAAa,CAAC;QAC3B,QAAQ,EAAE,UAAU,CAAC;QACrB,MAAM,EAAE,QAAQ,CAAC;KAClB,GAAG,IAAI;IAwBR;;;OAGG;IACH,SAAS,CAAC,WAAW,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI;IA6B1E,IAAI,CAAC,WAAW,CAAC,EAAE,aAAa,GAAG,SAAS,kBAAkB,EAAE;IAehE,MAAM,CAAC,WAAW,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;CAM5D"}