daemora 1.0.0-alpha.0

package/dist/integrations/IntegrationStore.js

@@ -0,0 +1,146 @@
+/**
+ * IntegrationStore — persists connected accounts for OAuth-backed
+ * integrations. Metadata (account id, label, scopes, expiry) lives in
+ * a SQLite table so the UI can list connections without unlocking the
+ * vault. Tokens live in the vault under keys shaped like
+ * `integration:<integration>:<accountId>`, encrypted by the existing
+ * AES-GCM + scrypt pipeline.
+ *
+ * Methods:
+ *   upsert({integration, provider, accountId, accountLabel, tokens})
+ *   getTokens(integration, accountId?)   → TokenSet | null
+ *   list(integration?)                   → IntegrationAccount[]
+ *   remove(integration, accountId)       → void  (wipes vault + row)
+ *
+ * No refresh logic here — IntegrationManager handles that.
+ */
+import { createLogger } from "../util/logger.js";
+const log = createLogger("integrations.store");
+const SCHEMA = `
+CREATE TABLE IF NOT EXISTS integration_accounts (
+  integration    TEXT NOT NULL,
+  provider       TEXT NOT NULL,
+  account_id     TEXT NOT NULL,
+  account_label  TEXT NOT NULL,
+  scopes_json    TEXT NOT NULL,
+  connected_at   INTEGER NOT NULL,
+  expires_at     INTEGER NOT NULL,
+  PRIMARY KEY (integration, account_id)
+);
+CREATE INDEX IF NOT EXISTS integration_accounts_by_integration
+  ON integration_accounts (integration);
+`;
+function vaultKey(integration, accountId) {
+    return `integration:${integration}:${accountId}`;
+}
+export class IntegrationStore {
+    db;
+    cfg;
+    insertStmt;
+    selectOne;
+    selectByInt;
+    selectAll;
+    deleteOne;
+    constructor(db, cfg) {
+        this.db = db;
+        this.cfg = cfg;
+        db.exec(SCHEMA);
+        this.insertStmt = db.prepare(`INSERT INTO integration_accounts
+        (integration, provider, account_id, account_label, scopes_json, connected_at, expires_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?)
+       ON CONFLICT (integration, account_id) DO UPDATE SET
+         provider = excluded.provider,
+         account_label = excluded.account_label,
+         scopes_json = excluded.scopes_json,
+         expires_at = excluded.expires_at`);
+        this.selectOne = db.prepare(`SELECT integration, provider, account_id AS accountId, account_label AS accountLabel,
+              scopes_json AS scopesJson, connected_at AS connectedAt, expires_at AS expiresAt
+       FROM integration_accounts WHERE integration = ? AND account_id = ?`);
+        this.selectByInt = db.prepare(`SELECT integration, provider, account_id AS accountId, account_label AS accountLabel,
+              scopes_json AS scopesJson, connected_at AS connectedAt, expires_at AS expiresAt
+       FROM integration_accounts WHERE integration = ? ORDER BY connected_at DESC`);
+        this.selectAll = db.prepare(`SELECT integration, provider, account_id AS accountId, account_label AS accountLabel,
+              scopes_json AS scopesJson, connected_at AS connectedAt, expires_at AS expiresAt
+       FROM integration_accounts ORDER BY connected_at DESC`);
+        this.deleteOne = db.prepare(`DELETE FROM integration_accounts WHERE integration = ? AND account_id = ?`);
+    }
+    upsert(args) {
+        if (!this.cfg.vault.isUnlocked()) {
+            throw new Error("Vault is locked — cannot persist integration tokens.");
+        }
+        const { integration, provider, tokens } = args;
+        const key = vaultKey(integration, tokens.accountId);
+        this.cfg.vault.set(key, JSON.stringify({
+            accessToken: tokens.accessToken,
+            refreshToken: tokens.refreshToken ?? null,
+            expiresAt: tokens.expiresAt,
+            scopes: tokens.scopes,
+        }));
+        this.insertStmt.run(integration, provider, tokens.accountId, tokens.accountLabel, JSON.stringify(tokens.scopes), Date.now(), tokens.expiresAt);
+        log.info({ integration, accountId: tokens.accountId }, "integration account saved");
+    }
+    /**
+     * Read-back the full token set for a given integration. When no
+     * accountId is given the most-recently-connected account wins.
+     */
+    getTokens(integration, accountId) {
+        if (!this.cfg.vault.isUnlocked())
+            return null;
+        const row = accountId
+            ? this.selectOne.get(integration, accountId)
+            : this.selectByInt.all(integration)[0];
+        if (!row)
+            return null;
+        const raw = this.cfg.vault.get(vaultKey(integration, row.accountId))?.reveal();
+        if (!raw)
+            return null;
+        try {
+            const parsed = JSON.parse(raw);
+            return {
+                accessToken: parsed.accessToken,
+                ...(parsed.refreshToken ? { refreshToken: parsed.refreshToken } : {}),
+                expiresAt: parsed.expiresAt,
+                scopes: parsed.scopes,
+                accountId: row.accountId,
+                accountLabel: row.accountLabel,
+            };
+        }
+        catch (e) {
+            log.error({ err: e.message }, "failed to parse vault entry");
+            return null;
+        }
+    }
+    list(integration) {
+        const rows = integration
+            ? this.selectByInt.all(integration)
+            : this.selectAll.all();
+        return rows.map((r) => ({
+            integration: r.integration,
+            provider: r.provider,
+            accountId: r.accountId,
+            accountLabel: r.accountLabel,
+            scopes: safeJsonArray(r.scopesJson),
+            connectedAt: r.connectedAt,
+            expiresAt: r.expiresAt,
+        }));
+    }
+    remove(integration, accountId) {
+        const key = vaultKey(integration, accountId);
+        try {
+            this.cfg.vault.delete(key);
+        }
+        catch { /* non-fatal */ }
+        this.deleteOne.run(integration, accountId);
+        log.info({ integration, accountId }, "integration account removed");
+    }
+}
+function safeJsonArray(raw) {
+    try {
+        const parsed = JSON.parse(raw);
+        return Array.isArray(parsed) ? parsed.filter((s) => typeof s === "string") : [];
+    }
+    catch {
+        return [];
+    }
+}
+//# sourceMappingURL=IntegrationStore.js.map

package/dist/integrations/IntegrationStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"IntegrationStore.js","sourceRoot":"","sources":["../../src/integrations/IntegrationStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGjD,MAAM,GAAG,GAAG,YAAY,CAAC,oBAAoB,CAAC,CAAC;AAE/C,MAAM,MAAM,GAAG;;;;;;;;;;;;;CAad,CAAC;AAEF,SAAS,QAAQ,CAAC,WAA0B,EAAE,SAAiB;IAC7D,OAAO,eAAe,WAAW,IAAI,SAAS,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,OAAO,gBAAgB;IAQR;IACA;IARF,UAAU,CAAqB;IAC/B,SAAS,CAAqB;IAC9B,WAAW,CAAqB;IAChC,SAAS,CAAqB;IAC9B,SAAS,CAAqB;IAE/C,YACmB,EAAqB,EACrB,GAAkB;QADlB,OAAE,GAAF,EAAE,CAAmB;QACrB,QAAG,GAAH,GAAG,CAAe;QAEnC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChB,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC,OAAO,CAC1B;;;;;;;0CAOoC,CACrC,CAAC;QACF,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC,OAAO,CACzB;;0EAEoE,CACrE,CAAC;QACF,IAAI,CAAC,WAAW,GAAG,EAAE,CAAC,OAAO,CAC3B;;kFAE4E,CAC7E,CAAC;QACF,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC,OAAO,CACzB;;4DAEsD,CACvD,CAAC;QACF,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC,OAAO,CACzB,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,IAIN;QACC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC;YACrC,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI;YACzC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,UAAU,CAAC,GAAG,CACjB,WAAW,EACX,QAAQ,EACR,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,YAAY,EACnB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAC7B,IAAI,CAAC,GAAG,EAAE,EACV,MAAM,CAAC,SAAS,CACjB,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,2BAA2B,CAAC,CAAC;IACtF,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,WAA0B,EAAE,SAAkB;QACtD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE;YAAE,OAAO,IAAI,CAAC;QAC9C,MAAM,GAAG,GAAG,SAAS;YACnB,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAuB;YAClE,CAAC,CAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,CAAc,CAAC,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;QAC/E,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAK5B,CAAC;YACF,OAAO;gBACL,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrE,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,YAAY,EAAE,GAAG,CAAC,YAAY;aAC/B,CAAC;QACJ,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAG,CAAW,CAAC,OAAO,EAAE,EAAE,6BAA6B,CAAC,CAAC;YACxE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,CAAC,WAA2B;QAC9B,MAAM,IAAI,GAAG,WAAW;YACtB,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,CAAa;YAC/C,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAc,CAAC;QACrC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC;YACnC,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,SAAS,EAAE,CAAC,CAAC,SAAS;SACvB,CAAC,CAAC,CAAC;IACN,CAAC;IAED,MAAM,CAAC,WAA0B,EAAE,SAAiB;QAClD,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;QAC7D,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAC3C,GAAG,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,6BAA6B,CAAC,CAAC;IACtE,CAAC;CACF;AAYD,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/integrations/authFetch.d.ts

@@ -0,0 +1,21 @@
+/**
+ * authFetch — shared helper that wraps a provider API call with
+ * transparent token refresh on 401. Integration clients call this
+ * instead of fetch() directly so a revoked/rotated access token
+ * auto-recovers without bubbling a confusing 401 up to the agent.
+ *
+ * Flow:
+ *   1. Pull current access token from IntegrationManager.
+ *   2. Call the builder with that token.
+ *   3. If the response status is 401, force-refresh and retry once.
+ *   4. On the retry still-401, bubble the failure up.
+ *
+ * The `builder` callback receives the live token string and returns
+ * the Response — it controls headers / method / body. We stay out of
+ * that so callers can handle multipart, form-urlencoded, raw fetch
+ * against non-default hosts, etc.
+ */
+import type { IntegrationManager } from "./IntegrationManager.js";
+import type { IntegrationId } from "./types.js";
+export declare function authFetch(integrations: IntegrationManager, integration: IntegrationId, builder: (token: string) => Promise<Response>): Promise<Response>;
+//# sourceMappingURL=authFetch.d.ts.map

package/dist/integrations/authFetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authFetch.d.ts","sourceRoot":"","sources":["../../src/integrations/authFetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,wBAAsB,SAAS,CAC7B,YAAY,EAAE,kBAAkB,EAChC,WAAW,EAAE,aAAa,EAC1B,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,GAC5C,OAAO,CAAC,QAAQ,CAAC,CAenB"}

package/dist/integrations/authFetch.js

@@ -0,0 +1,36 @@
+/**
+ * authFetch — shared helper that wraps a provider API call with
+ * transparent token refresh on 401. Integration clients call this
+ * instead of fetch() directly so a revoked/rotated access token
+ * auto-recovers without bubbling a confusing 401 up to the agent.
+ *
+ * Flow:
+ *   1. Pull current access token from IntegrationManager.
+ *   2. Call the builder with that token.
+ *   3. If the response status is 401, force-refresh and retry once.
+ *   4. On the retry still-401, bubble the failure up.
+ *
+ * The `builder` callback receives the live token string and returns
+ * the Response — it controls headers / method / body. We stay out of
+ * that so callers can handle multipart, form-urlencoded, raw fetch
+ * against non-default hosts, etc.
+ */
+export async function authFetch(integrations, integration, builder) {
+    let token = await integrations.getAccessToken(integration);
+    if (!token)
+        throw new Error(`${integration} not connected`);
+    let resp = await builder(token);
+    if (resp.status !== 401)
+        return resp;
+    // Token is formally valid (or we haven't tried refreshing) but the
+    // provider rejected it — force-refresh and retry once. Don't retry
+    // again: the second 401 is either a genuine revocation or a
+    // scope issue the user has to fix by reconnecting.
+    const fresh = await integrations.forceRefresh(integration);
+    if (!fresh || fresh === token)
+        return resp;
+    token = fresh;
+    resp = await builder(token);
+    return resp;
+}
+//# sourceMappingURL=authFetch.js.map

package/dist/integrations/authFetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authFetch.js","sourceRoot":"","sources":["../../src/integrations/authFetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,YAAgC,EAChC,WAA0B,EAC1B,OAA6C;IAE7C,IAAI,KAAK,GAAG,MAAM,YAAY,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,WAAW,gBAAgB,CAAC,CAAC;IAC5D,IAAI,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAErC,mEAAmE;IACnE,mEAAmE;IACnE,4DAA4D;IAC5D,mDAAmD;IACnD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC3C,KAAK,GAAG,KAAK,CAAC;IACd,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/integrations/facebook/FacebookClient.d.ts

@@ -0,0 +1,33 @@
+/**
+ * FacebookClient — thin wrapper over the Meta Graph API v19, scoped to
+ * Facebook Pages operations (list, post, comment, insights). Auth goes
+ * through IntegrationManager; Meta doesn't issue refresh_tokens in the
+ * classic sense — we exchange the stored long-lived token when it
+ * approaches expiry (handled in IntegrationManager.refresh).
+ *
+ * Page tokens vs user tokens: Graph API requires a Page Access Token
+ * (not the user token) for posting/reading Page insights. We fetch
+ * pages via /me/accounts and cache their page_access_token per Page.
+ */
+import type { IntegrationManager } from "../IntegrationManager.js";
+export declare class FacebookClient {
+    private readonly integrations;
+    private readonly pageTokenCache;
+    constructor(integrations: IntegrationManager);
+    userToken(): Promise<string>;
+    /** Force a user-token refresh (used by the 401-retry path). Page
+     *  tokens don't expire the same way, so we only cycle the user
+     *  token and re-fetch page tokens on the next listPages() call. */
+    private refreshUserToken;
+    /** Fetch the user's managed Pages + their page tokens. */
+    listPages(): Promise<ReadonlyArray<{
+        id: string;
+        name: string;
+        access_token: string;
+        category?: string;
+    }>>;
+    /** Look up (or fetch) a page's access token, given a Page id. */
+    pageToken(pageId: string): Promise<string>;
+    request<T>(path: string, init?: RequestInit, bearer?: string): Promise<T>;
+}
+//# sourceMappingURL=FacebookClient.d.ts.map

package/dist/integrations/facebook/FacebookClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"FacebookClient.d.ts","sourceRoot":"","sources":["../../../src/integrations/facebook/FacebookClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAInE,qBAAa,cAAc;IAGb,OAAO,CAAC,QAAQ,CAAC,YAAY;IAFzC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA6B;gBAE/B,YAAY,EAAE,kBAAkB;IAEvD,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC;IAMlC;;uEAEmE;YACrD,gBAAgB;IAK9B,0DAA0D;IACpD,SAAS,IAAI,OAAO,CAAC,aAAa,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAYhH,iEAAiE;IAC3D,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAS1C,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;CA0BpF"}

package/dist/integrations/facebook/FacebookClient.js

@@ -0,0 +1,88 @@
+/**
+ * FacebookClient — thin wrapper over the Meta Graph API v19, scoped to
+ * Facebook Pages operations (list, post, comment, insights). Auth goes
+ * through IntegrationManager; Meta doesn't issue refresh_tokens in the
+ * classic sense — we exchange the stored long-lived token when it
+ * approaches expiry (handled in IntegrationManager.refresh).
+ *
+ * Page tokens vs user tokens: Graph API requires a Page Access Token
+ * (not the user token) for posting/reading Page insights. We fetch
+ * pages via /me/accounts and cache their page_access_token per Page.
+ */
+import { ProviderError } from "../../util/errors.js";
+const GRAPH = "https://graph.facebook.com/v19.0";
+export class FacebookClient {
+    integrations;
+    pageTokenCache = new Map();
+    constructor(integrations) {
+        this.integrations = integrations;
+    }
+    async userToken() {
+        const token = await this.integrations.getAccessToken("facebook");
+        if (!token)
+            throw new ProviderError("Facebook is not connected. Connect it in Settings → Integrations.", "meta");
+        return token;
+    }
+    /** Force a user-token refresh (used by the 401-retry path). Page
+     *  tokens don't expire the same way, so we only cycle the user
+     *  token and re-fetch page tokens on the next listPages() call. */
+    async refreshUserToken() {
+        this.pageTokenCache.clear();
+        return this.integrations.forceRefresh("facebook");
+    }
+    /** Fetch the user's managed Pages + their page tokens. */
+    async listPages() {
+        const token = await this.userToken();
+        const data = await this.request(`/me/accounts?fields=id,name,access_token,category`, {}, token);
+        const pages = data.data ?? [];
+        for (const p of pages)
+            this.pageTokenCache.set(p.id, p.access_token);
+        return pages;
+    }
+    /** Look up (or fetch) a page's access token, given a Page id. */
+    async pageToken(pageId) {
+        const cached = this.pageTokenCache.get(pageId);
+        if (cached)
+            return cached;
+        await this.listPages(); // primes the cache
+        const fresh = this.pageTokenCache.get(pageId);
+        if (!fresh)
+            throw new ProviderError(`Facebook Page ${pageId} not found on this account.`, "meta");
+        return fresh;
+    }
+    async request(path, init = {}, bearer) {
+        let token = bearer ?? (await this.userToken());
+        let resp = await fbFetch(GRAPH, path, token, init);
+        // On 401: if we were using the user token (not a page token),
+        // refresh once and retry. Page tokens don't come back from a
+        // refresh — the user must re-connect to fix Page-level 401s.
+        if (resp.status === 401 && !bearer) {
+            const fresh = await this.refreshUserToken();
+            if (fresh && fresh !== token) {
+                token = fresh;
+                resp = await fbFetch(GRAPH, path, token, init);
+            }
+        }
+        if (!resp.ok) {
+            const body = await resp.text().catch(() => "");
+            if (resp.status === 401) {
+                throw new ProviderError(`Facebook auth failed after refresh (${resp.status}). Reconnect in Settings → Integrations. ${body.slice(0, 200)}`, "meta");
+            }
+            throw new ProviderError(`Facebook ${resp.status} ${path}: ${body.slice(0, 300)}`, "meta");
+        }
+        if (resp.status === 204)
+            return {};
+        return (await resp.json());
+    }
+}
+async function fbFetch(base, path, token, init) {
+    const url = `${base}${path}${path.includes("?") ? "&" : "?"}access_token=${encodeURIComponent(token)}`;
+    return fetch(url, {
+        ...init,
+        headers: {
+            "Content-Type": "application/json",
+            ...(init.headers ?? {}),
+        },
+    });
+}
+//# sourceMappingURL=FacebookClient.js.map

package/dist/integrations/facebook/FacebookClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FacebookClient.js","sourceRoot":"","sources":["../../../src/integrations/facebook/FacebookClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAGrD,MAAM,KAAK,GAAG,kCAAkC,CAAC;AAEjD,MAAM,OAAO,cAAc;IAGI;IAFZ,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE5D,YAA6B,YAAgC;QAAhC,iBAAY,GAAZ,YAAY,CAAoB;IAAG,CAAC;IAEjE,KAAK,CAAC,SAAS;QACb,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,aAAa,CAAC,mEAAmE,EAAE,MAAM,CAAC,CAAC;QACjH,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;uEAEmE;IAC3D,KAAK,CAAC,gBAAgB;QAC5B,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;IACpD,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,SAAS;QACb,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,mDAAmD,EACnD,EAAE,EACF,KAAK,CACN,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC;QACrE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,iEAAiE;IACjE,KAAK,CAAC,SAAS,CAAC,MAAc;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,mBAAmB;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,aAAa,CAAC,iBAAiB,MAAM,6BAA6B,EAAE,MAAM,CAAC,CAAC;QAClG,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,OAAO,CAAI,IAAY,EAAE,OAAoB,EAAE,EAAE,MAAe;QACpE,IAAI,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAC/C,IAAI,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QACnD,8DAA8D;QAC9D,6DAA6D;QAC7D,6DAA6D;QAC7D,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC5C,IAAI,KAAK,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;gBAC7B,KAAK,GAAG,KAAK,CAAC;gBACd,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC/C,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACxB,MAAM,IAAI,aAAa,CACrB,uCAAuC,IAAI,CAAC,MAAM,4CAA4C,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAClH,MAAM,CACP,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,aAAa,CAAC,YAAY,IAAI,CAAC,MAAM,IAAI,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAO,CAAC;QACxC,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAM,CAAC;IAClC,CAAC;CACF;AAED,KAAK,UAAU,OAAO,CACpB,IAAY,EACZ,IAAY,EACZ,KAAa,EACb,IAAiB;IAEjB,MAAM,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,gBAAgB,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;IACvG,OAAO,KAAK,CAAC,GAAG,EAAE;QAChB,GAAG,IAAI;QACP,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;SACxB;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/integrations/facebook/tools.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Facebook Pages tool set — what the `facebook` crew exposes.
+ * Operation list mirrors n8n's FacebookGraphApi node: list pages, post
+ * to page, list posts, list insights, manage comments.
+ */
+import type { ToolDef } from "../../tools/types.js";
+import type { IntegrationManager } from "../IntegrationManager.js";
+export declare function makeFacebookTools(integrations: IntegrationManager): readonly ToolDef[];
+//# sourceMappingURL=tools.d.ts.map

package/dist/integrations/facebook/tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../../src/integrations/facebook/tools.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAGnE,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,kBAAkB,GAAG,SAAS,OAAO,EAAE,CAqYtF"}