patchwork-os 0.2.0-beta.1 → 0.2.0-beta.10.canary.95

package/dist/connectors/secrets.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Secret reader — file-first, env-fallback.
+ *
+ * Long-form `_CLIENT_SECRET` / API-token credentials sit in
+ * `~/.patchwork/.secrets.json` (a JSON object of `{ NAME: value }` pairs).
+ * The helper reads from that file when present and falls back to
+ * `process.env[name]` otherwise — so single-bridge users with an env-only
+ * setup keep working unchanged, while multi-tenant deployments can mount a
+ * read-only secrets file into the tenant volume to keep secrets out of the
+ * container's env (visible via `/proc/<pid>/environ`, `printenv`,
+ * `docker inspect`, etc.).
+ *
+ * Format: a single JSON object at `${HOME}/.patchwork/.secrets.json`.
+ *   {
+ *     "PATCHWORK_GITHUB_CLIENT_SECRET": "…",
+ *     "GMAIL_CLIENT_SECRET": "…",
+ *     "ANTHROPIC_API_KEY": "…"
+ *   }
+ *
+ * The file is read once (lazily) and cached in-memory. A successful parse
+ * locks the cache for the lifetime of the process — `readFileSync` on every
+ * OAuth call would be a perf footgun. Tests that need to swap the file MUST
+ * call `_resetSecretsCacheForTests()`.
+ *
+ * Fail-soft: a missing file, EACCES, malformed JSON, or any read error all
+ * route silently to the env-fallback path. We deliberately do NOT log on
+ * these — single-bridge installs simply will not have a secrets file, and a
+ * noisy warning every connector call would be operator-hostile.
+ *
+ * Precedence on collision (file present AND env set): the FILE wins. Reasoning:
+ * the file path exists exactly to override env. Once a deployment opts into
+ * the file by writing it, env values would be stale leftovers (or, worse, the
+ * exact leak we are hiding from `/proc/.../environ`). The contract is "file
+ * takes over when present", documented here so operators can reason about it.
+ */
+/** Absolute path the helper reads from. */
+export declare function secretsFilePath(): string;
+/**
+ * Read a named secret. Tries the secrets file first; falls back to
+ * `process.env[name]`; returns `""` when neither is set.
+ *
+ * Returning empty string (not `undefined`) matches the existing `?? ""`
+ * pattern at every connector call site — keeps the contract identical so the
+ * substitution is a drop-in.
+ */
+export declare function readSecret(name: string): string;
+/**
+ * Test hook — clears the cached file read so a test can rewrite the secrets
+ * file mid-run and observe the new value. Never called in production code.
+ */
+export declare function _resetSecretsCacheForTests(): void;

package/dist/connectors/secrets.js

@@ -0,0 +1,102 @@
+/**
+ * Secret reader — file-first, env-fallback.
+ *
+ * Long-form `_CLIENT_SECRET` / API-token credentials sit in
+ * `~/.patchwork/.secrets.json` (a JSON object of `{ NAME: value }` pairs).
+ * The helper reads from that file when present and falls back to
+ * `process.env[name]` otherwise — so single-bridge users with an env-only
+ * setup keep working unchanged, while multi-tenant deployments can mount a
+ * read-only secrets file into the tenant volume to keep secrets out of the
+ * container's env (visible via `/proc/<pid>/environ`, `printenv`,
+ * `docker inspect`, etc.).
+ *
+ * Format: a single JSON object at `${HOME}/.patchwork/.secrets.json`.
+ *   {
+ *     "PATCHWORK_GITHUB_CLIENT_SECRET": "…",
+ *     "GMAIL_CLIENT_SECRET": "…",
+ *     "ANTHROPIC_API_KEY": "…"
+ *   }
+ *
+ * The file is read once (lazily) and cached in-memory. A successful parse
+ * locks the cache for the lifetime of the process — `readFileSync` on every
+ * OAuth call would be a perf footgun. Tests that need to swap the file MUST
+ * call `_resetSecretsCacheForTests()`.
+ *
+ * Fail-soft: a missing file, EACCES, malformed JSON, or any read error all
+ * route silently to the env-fallback path. We deliberately do NOT log on
+ * these — single-bridge installs simply will not have a secrets file, and a
+ * noisy warning every connector call would be operator-hostile.
+ *
+ * Precedence on collision (file present AND env set): the FILE wins. Reasoning:
+ * the file path exists exactly to override env. Once a deployment opts into
+ * the file by writing it, env values would be stale leftovers (or, worse, the
+ * exact leak we are hiding from `/proc/.../environ`). The contract is "file
+ * takes over when present", documented here so operators can reason about it.
+ */
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import path from "node:path";
+/** Absolute path the helper reads from. */
+export function secretsFilePath() {
+    const patchworkHome = process.env.PATCHWORK_HOME ?? path.join(homedir(), ".patchwork");
+    return path.join(patchworkHome, ".secrets.json");
+}
+// ── Cache ─────────────────────────────────────────────────────────────────────
+/**
+ * Loaded JSON object, or `null` when the file is absent / unreadable /
+ * malformed. `undefined` means "not loaded yet". The two distinct states let
+ * us only attempt the read once per process — even if the file is missing.
+ */
+let cached;
+function load() {
+    if (cached !== undefined)
+        return cached;
+    try {
+        const raw = readFileSync(secretsFilePath(), "utf-8");
+        const parsed = JSON.parse(raw);
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+            // Coerce to Record<string, string>; drop non-string values defensively.
+            const out = {};
+            for (const [k, v] of Object.entries(parsed)) {
+                if (typeof v === "string")
+                    out[k] = v;
+            }
+            cached = out;
+            return cached;
+        }
+        cached = null;
+        return null;
+    }
+    catch {
+        // ENOENT / EACCES / SyntaxError — silent fallback to env.
+        cached = null;
+        return null;
+    }
+}
+// ── Public API ────────────────────────────────────────────────────────────────
+/**
+ * Read a named secret. Tries the secrets file first; falls back to
+ * `process.env[name]`; returns `""` when neither is set.
+ *
+ * Returning empty string (not `undefined`) matches the existing `?? ""`
+ * pattern at every connector call site — keeps the contract identical so the
+ * substitution is a drop-in.
+ */
+export function readSecret(name) {
+    const fromFile = load();
+    if (fromFile && Object.hasOwn(fromFile, name)) {
+        const v = fromFile[name];
+        if (typeof v === "string" && v !== "")
+            return v;
+        // Empty string in the file → still try env (treat the file value as unset).
+    }
+    return process.env[name] ?? "";
+}
+/**
+ * Test hook — clears the cached file read so a test can rewrite the secrets
+ * file mid-run and observe the new value. Never called in production code.
+ */
+export function _resetSecretsCacheForTests() {
+    cached = undefined;
+}
+//# sourceMappingURL=secrets.js.map

package/dist/connectors/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/connectors/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,2CAA2C;AAC3C,MAAM,UAAU,eAAe;IAC7B,MAAM,aAAa,GACjB,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,CAAC,CAAC;IACnE,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;AACnD,CAAC;AAED,iFAAiF;AAEjF;;;;GAIG;AACH,IAAI,MAAiD,CAAC;AAEtD,SAAS,IAAI;IACX,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,eAAe,EAAE,EAAE,OAAO,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QAC1C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,wEAAwE;YACxE,MAAM,GAAG,GAA2B,EAAE,CAAC;YACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,EAAE,CAAC;gBACvE,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACxC,CAAC;YACD,MAAM,GAAG,GAAG,CAAC;YACb,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,GAAG,IAAI,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;QAC1D,MAAM,GAAG,IAAI,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,QAAQ,GAAG,IAAI,EAAE,CAAC;IACxB,IAAI,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;QAC9C,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO,CAAC,CAAC;QAChD,4EAA4E;IAC9E,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B;IACxC,MAAM,GAAG,SAAS,CAAC;AACrB,CAAC"}

package/dist/connectors/sendgrid.d.ts

@@ -0,0 +1,102 @@
+/**
+ * SendGrid connector — outbound transactional email via SendGrid v3 REST API.
+ *
+ * Auth: Bearer API key (`SG.*`).
+ *   - Env var: SENDGRID_API_KEY (+ optional SENDGRID_FROM_EMAIL)
+ *   - Stored: getSecretJsonSync("sendgrid") → SendGridTokens
+ *
+ * Tools: send, listTemplates, getTemplate, listSenders, getStats
+ *
+ * Extends BaseConnector for unified auth, retry, rate-limit, error handling.
+ */
+import { type AuthContext, BaseConnector, type ConnectorError, type ConnectorStatus } from "./baseConnector.js";
+export interface SendGridTokens {
+    apiKey: string;
+    fromEmail?: string;
+    accountName?: string;
+    connected_at: string;
+}
+export interface SendGridTemplate {
+    id: string;
+    name: string;
+    generation: "legacy" | "dynamic";
+    updated_at?: string;
+}
+export interface SendGridTemplateListResult {
+    result: SendGridTemplate[];
+}
+export interface SendGridVerifiedSender {
+    id: number;
+    from_email: string;
+    from_name?: string;
+    verified: boolean;
+}
+export interface SendGridSenderListResult {
+    results: SendGridVerifiedSender[];
+}
+export interface SendGridStatsBucket {
+    date: string;
+    stats: Array<{
+        metrics: Record<string, number>;
+        name?: string;
+        type?: string;
+    }>;
+}
+export interface SendGridSendResult {
+    messageId: string;
+}
+export declare class SendGridConnector extends BaseConnector {
+    readonly providerName = "sendgrid";
+    private tokens;
+    protected getOAuthConfig(): null;
+    authenticate(): Promise<AuthContext>;
+    healthCheck(): Promise<{
+        ok: boolean;
+        error?: ConnectorError;
+    }>;
+    normalizeError(error: unknown): ConnectorError;
+    getStatus(): ConnectorStatus;
+    send(params: {
+        to: string;
+        subject: string;
+        text?: string;
+        html?: string;
+        from?: string;
+    }): Promise<SendGridSendResult>;
+    listTemplates(params?: {
+        limit?: number;
+        generations?: "legacy" | "dynamic";
+    }): Promise<SendGridTemplateListResult>;
+    getTemplate(templateId: string): Promise<SendGridTemplate>;
+    listSenders(params?: {
+        limit?: number;
+    }): Promise<SendGridSenderListResult>;
+    getStats(params: {
+        startDate: string;
+        endDate?: string;
+        aggregatedBy?: "day" | "week" | "month";
+    }): Promise<SendGridStatsBucket[]>;
+    private buildHeaders;
+}
+export declare function loadTokens(): SendGridTokens | null;
+export declare function saveTokens(tokens: SendGridTokens): void;
+export declare function clearTokens(): void;
+export declare function getSendGridConnector(): SendGridConnector;
+export { getSendGridConnector as sendgrid };
+export interface ConnectorHandlerResult {
+    status: number;
+    body: string;
+    contentType?: string;
+}
+/**
+ * POST /connections/sendgrid/connect  { apiKey, fromEmail? }
+ */
+export declare function handleSendGridConnect(body: string): Promise<ConnectorHandlerResult>;
+/**
+ * POST /connections/sendgrid/test
+ */
+export declare function handleSendGridTest(): Promise<ConnectorHandlerResult>;
+/**
+ * DELETE /connections/sendgrid
+ */
+export declare function handleSendGridDisconnect(): ConnectorHandlerResult;

package/dist/connectors/sendgrid.js

@@ -0,0 +1,423 @@
+/**
+ * SendGrid connector — outbound transactional email via SendGrid v3 REST API.
+ *
+ * Auth: Bearer API key (`SG.*`).
+ *   - Env var: SENDGRID_API_KEY (+ optional SENDGRID_FROM_EMAIL)
+ *   - Stored: getSecretJsonSync("sendgrid") → SendGridTokens
+ *
+ * Tools: send, listTemplates, getTemplate, listSenders, getStats
+ *
+ * Extends BaseConnector for unified auth, retry, rate-limit, error handling.
+ */
+import { BaseConnector, } from "./baseConnector.js";
+import { deleteSecretJsonSync, getSecretJsonSync, storeSecretJsonSync, } from "./tokenStorage.js";
+const BASE_URL = "https://api.sendgrid.com";
+// Loose RFC 5322-ish email check — good enough to reject obvious garbage.
+const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+function isValidEmail(s) {
+    return typeof s === "string" && EMAIL_RE.test(s);
+}
+export class SendGridConnector extends BaseConnector {
+    providerName = "sendgrid";
+    tokens = null;
+    getOAuthConfig() {
+        return null;
+    }
+    async authenticate() {
+        const tokens = loadTokens();
+        if (!tokens) {
+            throw new Error("SendGrid not connected. Run: patchwork-os connect sendgrid or set SENDGRID_API_KEY");
+        }
+        this.tokens = tokens;
+        return {
+            token: tokens.apiKey,
+            scopes: ["mail.send"],
+        };
+    }
+    async healthCheck() {
+        try {
+            const result = await this.apiCall(async () => {
+                const res = await fetch(`${BASE_URL}/v3/scopes`, {
+                    headers: this.buildHeaders(),
+                });
+                if (!res.ok)
+                    throw res;
+                return res.json();
+            });
+            if ("error" in result)
+                return { ok: false, error: result.error };
+            return { ok: true };
+        }
+        catch (err) {
+            return { ok: false, error: this.normalizeError(err) };
+        }
+    }
+    normalizeError(error) {
+        if (error instanceof Response) {
+            const s = error.status;
+            if (s === 401)
+                return {
+                    code: "auth_expired",
+                    message: "SendGrid authentication expired — reconnect",
+                    retryable: false,
+                    suggestedAction: "patchwork-os connect sendgrid",
+                };
+            if (s === 403)
+                return {
+                    code: "permission_denied",
+                    message: "Insufficient SendGrid permissions",
+                    retryable: false,
+                };
+            if (s === 404)
+                return {
+                    code: "not_found",
+                    message: "SendGrid resource not found",
+                    retryable: false,
+                };
+            if (s === 413)
+                return {
+                    code: "provider_error",
+                    message: "SendGrid payload too large",
+                    retryable: false,
+                };
+            if (s === 429)
+                return {
+                    code: "rate_limited",
+                    message: "SendGrid API rate limit exceeded",
+                    retryable: true,
+                    suggestedAction: "Wait and retry",
+                };
+            if (s >= 500)
+                return {
+                    code: "provider_error",
+                    message: `SendGrid API error: HTTP ${s}`,
+                    retryable: true,
+                };
+            return {
+                code: "provider_error",
+                message: `SendGrid API error: HTTP ${s}`,
+                retryable: false,
+            };
+        }
+        if (error instanceof Error) {
+            if (error.message.includes("ENOTFOUND") ||
+                error.message.includes("ECONNREFUSED")) {
+                return {
+                    code: "network_error",
+                    message: `Cannot connect to SendGrid: ${error.message}`,
+                    retryable: true,
+                };
+            }
+        }
+        return {
+            code: "provider_error",
+            message: error instanceof Error ? error.message : String(error),
+            retryable: false,
+        };
+    }
+    getStatus() {
+        const tokens = loadTokens();
+        return {
+            id: "sendgrid",
+            status: tokens ? "connected" : "disconnected",
+            lastSync: tokens?.connected_at,
+            workspace: tokens?.accountName
+                ? `SendGrid (${tokens.accountName})`
+                : tokens?.fromEmail
+                    ? `SendGrid <${tokens.fromEmail}>`
+                    : undefined,
+        };
+    }
+    // ── API Methods ────────────────────────────────────────────────────────────
+    async send(params) {
+        if (!isValidEmail(params.to)) {
+            throw new Error("send: `to` must be a valid email address");
+        }
+        if (typeof params.subject !== "string" || !params.subject.trim()) {
+            throw new Error("send: `subject` is required");
+        }
+        if (!params.text && !params.html) {
+            throw new Error("send: one of `text` or `html` is required");
+        }
+        const tokens = this.tokens ?? loadTokens();
+        const from = params.from ?? tokens?.fromEmail;
+        if (!from) {
+            throw new Error("send: no `from` provided and no fromEmail stored — pass `from` or reconnect with a verified sender");
+        }
+        if (!isValidEmail(from)) {
+            throw new Error("send: `from` must be a valid email address");
+        }
+        const content = [];
+        if (params.text)
+            content.push({ type: "text/plain", value: params.text });
+        if (params.html)
+            content.push({ type: "text/html", value: params.html });
+        const body = {
+            personalizations: [{ to: [{ email: params.to }] }],
+            from: { email: from },
+            subject: params.subject,
+            content,
+        };
+        const result = await this.apiCall(async () => {
+            const res = await fetch(`${BASE_URL}/v3/mail/send`, {
+                method: "POST",
+                headers: {
+                    ...this.buildHeaders(),
+                    "Content-Type": "application/json",
+                },
+                body: JSON.stringify(body),
+            });
+            if (!res.ok)
+                throw res;
+            // SendGrid returns 202 + X-Message-Id header on success, empty body.
+            const messageId = res.headers.get("x-message-id") ?? "";
+            return { messageId };
+        });
+        if ("error" in result)
+            throw new Error(result.error.message);
+        return result.data;
+    }
+    async listTemplates(params = {}) {
+        const result = await this.apiCall(async () => {
+            const qs = new URLSearchParams();
+            if (params.limit)
+                qs.set("page_size", String(params.limit));
+            if (params.generations)
+                qs.set("generations", params.generations);
+            const url = `${BASE_URL}/v3/templates${qs.toString() ? `?${qs}` : ""}`;
+            const res = await fetch(url, { headers: this.buildHeaders() });
+            if (!res.ok)
+                throw res;
+            return res.json();
+        });
+        if ("error" in result)
+            throw new Error(result.error.message);
+        return result.data;
+    }
+    async getTemplate(templateId) {
+        if (!templateId || typeof templateId !== "string") {
+            throw new Error("getTemplate: templateId is required");
+        }
+        const result = await this.apiCall(async () => {
+            const res = await fetch(`${BASE_URL}/v3/templates/${encodeURIComponent(templateId)}`, { headers: this.buildHeaders() });
+            if (!res.ok)
+                throw res;
+            return res.json();
+        });
+        if ("error" in result)
+            throw new Error(result.error.message);
+        return result.data;
+    }
+    async listSenders(params = {}) {
+        const result = await this.apiCall(async () => {
+            const qs = new URLSearchParams();
+            if (params.limit)
+                qs.set("limit", String(params.limit));
+            const url = `${BASE_URL}/v3/verified_senders${qs.toString() ? `?${qs}` : ""}`;
+            const res = await fetch(url, { headers: this.buildHeaders() });
+            if (!res.ok)
+                throw res;
+            return res.json();
+        });
+        if ("error" in result)
+            throw new Error(result.error.message);
+        return result.data;
+    }
+    async getStats(params) {
+        if (!params.startDate) {
+            throw new Error("getStats: startDate is required (YYYY-MM-DD)");
+        }
+        const result = await this.apiCall(async () => {
+            const qs = new URLSearchParams();
+            qs.set("start_date", params.startDate);
+            if (params.endDate)
+                qs.set("end_date", params.endDate);
+            if (params.aggregatedBy)
+                qs.set("aggregated_by", params.aggregatedBy);
+            const res = await fetch(`${BASE_URL}/v3/stats?${qs}`, {
+                headers: this.buildHeaders(),
+            });
+            if (!res.ok)
+                throw res;
+            return res.json();
+        });
+        if ("error" in result)
+            throw new Error(result.error.message);
+        return result.data;
+    }
+    // ── Helpers ────────────────────────────────────────────────────────────────
+    buildHeaders() {
+        const key = this.tokens?.apiKey ?? loadTokens()?.apiKey ?? "";
+        return {
+            Authorization: `Bearer ${key}`,
+            Accept: "application/json",
+        };
+    }
+}
+// ── Token persistence ────────────────────────────────────────────────────────
+export function loadTokens() {
+    const envKey = process.env.SENDGRID_API_KEY;
+    if (envKey) {
+        return {
+            apiKey: envKey,
+            fromEmail: process.env.SENDGRID_FROM_EMAIL,
+            connected_at: new Date().toISOString(),
+        };
+    }
+    return getSecretJsonSync("sendgrid");
+}
+export function saveTokens(tokens) {
+    storeSecretJsonSync("sendgrid", tokens);
+}
+export function clearTokens() {
+    try {
+        deleteSecretJsonSync("sendgrid");
+    }
+    catch {
+        // ignore
+    }
+}
+// ── Singleton instance ───────────────────────────────────────────────────────
+let _instance = null;
+function resetSendGridConnector() {
+    _instance = null;
+}
+export function getSendGridConnector() {
+    if (!_instance) {
+        _instance = new SendGridConnector();
+    }
+    return _instance;
+}
+export { getSendGridConnector as sendgrid };
+/**
+ * POST /connections/sendgrid/connect  { apiKey, fromEmail? }
+ */
+export async function handleSendGridConnect(body) {
+    let apiKey;
+    let fromEmail;
+    try {
+        const parsed = JSON.parse(body);
+        if (typeof parsed.apiKey !== "string" || !parsed.apiKey) {
+            return {
+                status: 400,
+                contentType: "application/json",
+                body: JSON.stringify({ ok: false, error: "apiKey is required" }),
+            };
+        }
+        apiKey = parsed.apiKey;
+        if (parsed.fromEmail !== undefined) {
+            if (typeof parsed.fromEmail !== "string" ||
+                !isValidEmail(parsed.fromEmail)) {
+                return {
+                    status: 400,
+                    contentType: "application/json",
+                    body: JSON.stringify({
+                        ok: false,
+                        error: "fromEmail must be a valid email address",
+                    }),
+                };
+            }
+            fromEmail = parsed.fromEmail;
+        }
+    }
+    catch {
+        return {
+            status: 400,
+            contentType: "application/json",
+            body: JSON.stringify({ ok: false, error: "Invalid JSON body" }),
+        };
+    }
+    try {
+        const res = await fetch(`${BASE_URL}/v3/user/profile`, {
+            headers: {
+                Authorization: `Bearer ${apiKey}`,
+                Accept: "application/json",
+            },
+        });
+        if (!res.ok) {
+            return {
+                status: 401,
+                contentType: "application/json",
+                body: JSON.stringify({
+                    ok: false,
+                    error: `Credentials rejected by SendGrid (HTTP ${res.status}) — check apiKey`,
+                }),
+            };
+        }
+        const profile = (await res.json());
+        const accountName = profile.username ?? undefined;
+        const tokens = {
+            apiKey,
+            fromEmail,
+            accountName,
+            connected_at: new Date().toISOString(),
+        };
+        saveTokens(tokens);
+        resetSendGridConnector();
+        return {
+            status: 200,
+            contentType: "application/json",
+            body: JSON.stringify({
+                ok: true,
+                accountName,
+                fromEmail,
+                connectedAt: tokens.connected_at,
+            }),
+        };
+    }
+    catch (err) {
+        return {
+            status: 500,
+            contentType: "application/json",
+            body: JSON.stringify({
+                ok: false,
+                error: err instanceof Error ? err.message : String(err),
+            }),
+        };
+    }
+}
+/**
+ * POST /connections/sendgrid/test
+ */
+export async function handleSendGridTest() {
+    const tokens = loadTokens();
+    if (!tokens) {
+        return {
+            status: 400,
+            contentType: "application/json",
+            body: JSON.stringify({ ok: false, error: "SendGrid not connected" }),
+        };
+    }
+    try {
+        const connector = getSendGridConnector();
+        const check = await connector.healthCheck();
+        return {
+            status: check.ok ? 200 : 401,
+            contentType: "application/json",
+            body: JSON.stringify(check.ok ? { ok: true } : { ok: false, error: check.error?.message }),
+        };
+    }
+    catch (err) {
+        return {
+            status: 500,
+            contentType: "application/json",
+            body: JSON.stringify({
+                ok: false,
+                error: err instanceof Error ? err.message : String(err),
+            }),
+        };
+    }
+}
+/**
+ * DELETE /connections/sendgrid
+ */
+export function handleSendGridDisconnect() {
+    clearTokens();
+    resetSendGridConnector();
+    return {
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify({ ok: true }),
+    };
+}
+//# sourceMappingURL=sendgrid.js.map