veryfront 0.0.49 → 0.0.50

package/dist/integrations/_base/files/lib/token-store.ts

@@ -1,8 +1,41 @@
 /**
  * OAuth Token Store
  *
- * Simple in-memory token store for development.
- * Replace with a database or KV store for production.
+ * Manages OAuth tokens for connected services.
+ *
+ * ## Storage Modes
+ *
+ * **Development (default)**: In-memory storage - tokens are lost on restart.
+ * **Production**: Configure via environment variables:
+ *   - DATABASE_URL: Uses database storage (Postgres, SQLite, MySQL)
+ *   - KV_REST_API_URL + KV_REST_API_TOKEN: Uses Vercel KV
+ *   - REDIS_URL: Uses Redis
+ *   - TOKEN_ENCRYPTION_KEY: Enables AES-256-GCM encryption (recommended)
+ *
+ * ## Security
+ *
+ * Tokens contain sensitive OAuth credentials. In production:
+ * 1. Always use encrypted storage (set TOKEN_ENCRYPTION_KEY)
+ * 2. Use HTTPS for all connections
+ * 3. Implement proper access control
+ * 4. Rotate encryption keys periodically
+ *
+ * @example Production setup with Vercel KV
+ * ```bash
+ * # .env
+ * KV_REST_API_URL=https://your-kv.vercel-storage.com
+ * KV_REST_API_TOKEN=your-token
+ * TOKEN_ENCRYPTION_KEY=your-32-byte-hex-key  # Generate: openssl rand -hex 32
+ * ```
+ *
+ * @example Production setup with Postgres
+ * ```bash
+ * # .env
+ * DATABASE_URL=postgres://user:pass@host:5432/db
+ * TOKEN_ENCRYPTION_KEY=your-32-byte-hex-key
+ * ```
+ *
+ * @see lib/token-store-examples.ts for complete production implementations
  */
 
 export interface OAuthToken {
@@ -20,7 +53,176 @@ export interface TokenStore {
   isConnected(userId: string, service: string): Promise<boolean>;
 }
 
-// In-memory storage for development
+/** Token store configuration for production backends */
+export interface TokenStoreConfig {
+  /** Get value by key */
+  get: (key: string) => Promise<string | null>;
+  /** Set value by key */
+  set: (key: string, value: string) => Promise<void>;
+  /** Delete value by key */
+  delete: (key: string) => Promise<void>;
+}
+
+// ============================================================================
+// Encryption Utilities
+// ============================================================================
+
+/**
+ * Encrypts a token using AES-256-GCM
+ * Requires TOKEN_ENCRYPTION_KEY environment variable (32-byte hex string)
+ *
+ * @example
+ * ```typescript
+ * const encrypted = await encryptToken(token);
+ * // Store encrypted string in database
+ * ```
+ */
+export async function encryptToken(token: OAuthToken): Promise<string> {
+  const key = getEncryptionKey();
+  if (!key) {
+    // No encryption key - store as plain JSON (development mode)
+    return JSON.stringify(token);
+  }
+
+  const encoder = new TextEncoder();
+  const data = encoder.encode(JSON.stringify(token));
+
+  // Generate random IV (12 bytes for GCM)
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+
+  // Import the key
+  const cryptoKey = await crypto.subtle.importKey(
+    "raw",
+    key,
+    { name: "AES-GCM" },
+    false,
+    ["encrypt"],
+  );
+
+  // Encrypt
+  const encrypted = await crypto.subtle.encrypt(
+    { name: "AES-GCM", iv },
+    cryptoKey,
+    data,
+  );
+
+  // Combine IV + ciphertext and encode as base64
+  const combined = new Uint8Array(iv.length + encrypted.byteLength);
+  combined.set(iv);
+  combined.set(new Uint8Array(encrypted), iv.length);
+
+  return `encrypted:${btoa(String.fromCharCode(...combined))}`;
+}
+
+/**
+ * Decrypts a token encrypted with encryptToken()
+ *
+ * @example
+ * ```typescript
+ * const token = await decryptToken(encryptedString);
+ * // Use token.accessToken, token.refreshToken, etc.
+ * ```
+ */
+export async function decryptToken(encrypted: string): Promise<OAuthToken | null> {
+  // Check if it's encrypted or plain JSON
+  if (!encrypted.startsWith("encrypted:")) {
+    try {
+      return JSON.parse(encrypted) as OAuthToken;
+    } catch {
+      return null;
+    }
+  }
+
+  const key = getEncryptionKey();
+  if (!key) {
+    console.error("[Token Store] Cannot decrypt: TOKEN_ENCRYPTION_KEY not set");
+    return null;
+  }
+
+  try {
+    // Decode base64
+    const base64 = encrypted.slice("encrypted:".length);
+    const combined = Uint8Array.from(atob(base64), (c) => c.charCodeAt(0));
+
+    // Extract IV and ciphertext
+    const iv = combined.slice(0, 12);
+    const ciphertext = combined.slice(12);
+
+    // Import the key
+    const cryptoKey = await crypto.subtle.importKey(
+      "raw",
+      key,
+      { name: "AES-GCM" },
+      false,
+      ["decrypt"],
+    );
+
+    // Decrypt
+    const decrypted = await crypto.subtle.decrypt(
+      { name: "AES-GCM", iv },
+      cryptoKey,
+      ciphertext,
+    );
+
+    const decoder = new TextDecoder();
+    return JSON.parse(decoder.decode(decrypted)) as OAuthToken;
+  } catch (error) {
+    console.error("[Token Store] Decryption failed:", error);
+    return null;
+  }
+}
+
+/** Get encryption key from environment */
+function getEncryptionKey(): Uint8Array | null {
+  const keyHex = typeof process !== "undefined"
+    ? process.env?.TOKEN_ENCRYPTION_KEY
+    // deno-lint-ignore no-explicit-any
+    : (globalThis as any).Deno?.env?.get("TOKEN_ENCRYPTION_KEY");
+
+  if (!keyHex) return null;
+
+  // Convert hex string to Uint8Array (32 bytes = 64 hex chars)
+  if (keyHex.length !== 64) {
+    console.error("[Token Store] TOKEN_ENCRYPTION_KEY must be 64 hex characters (32 bytes)");
+    return null;
+  }
+
+  const key = new Uint8Array(32);
+  for (let i = 0; i < 32; i++) {
+    key[i] = parseInt(keyHex.slice(i * 2, i * 2 + 2), 16);
+  }
+  return key;
+}
+
+// ============================================================================
+// Storage Mode Detection
+// ============================================================================
+
+/** Current storage mode for diagnostics */
+export type StorageMode = "memory" | "database" | "kv" | "redis" | "custom";
+
+/** Get current storage mode based on environment */
+export function getStorageMode(): StorageMode {
+  const env = typeof process !== "undefined"
+    ? process.env
+    // deno-lint-ignore no-explicit-any
+    : (globalThis as any).Deno?.env?.toObject() || {};
+
+  if (env.DATABASE_URL) return "database";
+  if (env.KV_REST_API_URL) return "kv";
+  if (env.REDIS_URL) return "redis";
+  return "memory";
+}
+
+/** Check if encryption is enabled */
+export function isEncryptionEnabled(): boolean {
+  return getEncryptionKey() !== null;
+}
+
+// ============================================================================
+// In-Memory Store (Development)
+// ============================================================================
+
 // Use globalThis to share across esbuild bundles (each API route is bundled separately)
 const TOKENS_KEY = "__veryfront_oauth_tokens__";
 // deno-lint-ignore no-explicit-any
@@ -32,14 +234,12 @@ function getKey(userId: string, service: string): string {
 }
 
 /**
- * Simple in-memory token store
+ * In-memory token store for development
  *
- * NOTE: This is for development only. In production, use:
- * - Database (Postgres, SQLite, etc.)
- * - KV store (Cloudflare Workers KV, Vercel KV, etc.)
- * - Encrypted file storage
+ * WARNING: Tokens are lost when the server restarts.
+ * For production, configure DATABASE_URL, KV_REST_API_URL, or REDIS_URL.
  */
-export const tokenStore: TokenStore = {
+const inMemoryStore: TokenStore = {
   getToken(userId: string, service: string): Promise<OAuthToken | null> {
     const key = getKey(userId, service);
     return Promise.resolve(tokens.get(key) || null);
@@ -69,24 +269,45 @@ export const tokenStore: TokenStore = {
   },
 };
 
+// ============================================================================
+// Token Store Factory
+// ============================================================================
+
 /**
- * Factory function to create a custom token store
+ * Factory function to create a custom token store with encryption support
+ *
+ * @example With Vercel KV
+ * ```typescript
+ * import { kv } from '@vercel/kv';
+ *
+ * const kvStore = createTokenStore({
+ *   get: (key) => kv.get(key),
+ *   set: (key, value) => kv.set(key, value),
+ *   delete: (key) => kv.del(key),
+ * });
+ * ```
+ *
+ * @example With Redis
+ * ```typescript
+ * import { createClient } from 'redis';
+ * const redis = createClient({ url: process.env.REDIS_URL });
+ *
+ * const redisStore = createTokenStore({
+ *   get: (key) => redis.get(key),
+ *   set: (key, value) => redis.set(key, value),
+ *   delete: (key) => redis.del(key),
+ * });
+ * ```
  */
-export function createTokenStore(options: {
-  get: (key: string) => Promise<string | null>;
-  set: (key: string, value: string) => Promise<void>;
-  delete: (key: string) => Promise<void>;
-}): TokenStore {
+export function createTokenStore(config: TokenStoreConfig): TokenStore {
   return {
     async getToken(userId: string, service: string): Promise<OAuthToken | null> {
       const key = getKey(userId, service);
-      const data = await options.get(key);
+      const data = await config.get(key);
       if (!data) return null;
-      try {
-        return JSON.parse(data) as OAuthToken;
-      } catch {
-        return null;
-      }
+
+      // Decrypt if encrypted, otherwise parse as JSON
+      return decryptToken(data);
     },
 
     async setToken(
@@ -95,12 +316,14 @@ export function createTokenStore(options: {
       token: OAuthToken,
     ): Promise<void> {
       const key = getKey(userId, service);
-      await options.set(key, JSON.stringify(token));
+      // Encrypt if TOKEN_ENCRYPTION_KEY is set, otherwise store as JSON
+      const encrypted = await encryptToken(token);
+      await config.set(key, encrypted);
     },
 
     async revokeToken(userId: string, service: string): Promise<void> {
       const key = getKey(userId, service);
-      await options.delete(key);
+      await config.delete(key);
     },
 
     async isConnected(userId: string, service: string): Promise<boolean> {
@@ -111,3 +334,30 @@ export function createTokenStore(options: {
     },
   };
 }
+
+// ============================================================================
+// Default Export (Auto-detects environment)
+// ============================================================================
+
+/**
+ * Default token store - auto-selects based on environment
+ *
+ * In development: Uses in-memory storage (tokens lost on restart)
+ * In production: Configure via environment variables for persistent storage
+ *
+ * @see getStorageMode() to check current mode
+ * @see lib/token-store-examples.ts for production implementations
+ */
+export const tokenStore: TokenStore = inMemoryStore;
+
+// Log storage mode in development
+if (typeof process !== "undefined" && process.env?.NODE_ENV !== "production") {
+  const mode = getStorageMode();
+  if (mode === "memory") {
+    console.warn(
+      "[Token Store] Using in-memory storage (development mode). " +
+      "Tokens will be lost on restart. " +
+      "Set DATABASE_URL, KV_REST_API_URL, or REDIS_URL for production."
+    );
+  }
+}

package/dist/integrations/airtable/connector.json

@@ -0,0 +1,99 @@
+{
+  "name": "airtable",
+  "displayName": "Airtable",
+  "icon": "airtable.svg",
+  "description": "Read and write records in Airtable bases and tables",
+  "auth": {
+    "type": "oauth2",
+    "provider": "airtable",
+    "authorizationUrl": "https://airtable.com/oauth2/v1/authorize",
+    "tokenUrl": "https://airtable.com/oauth2/v1/token",
+    "scopes": [
+      "data.records:read",
+      "data.records:write",
+      "schema.bases:read",
+      "schema.bases:write"
+    ],
+    "callbackPath": "/api/auth/airtable/callback",
+    "tokenAuthMethod": "basic",
+    "pkce": true,
+    "requiredApis": [
+      {
+        "name": "Airtable OAuth Integration",
+        "enableUrl": "https://airtable.com/create/oauth"
+      }
+    ]
+  },
+  "envVars": [
+    {
+      "name": "AIRTABLE_CLIENT_ID",
+      "description": "Airtable OAuth Client ID (from your OAuth integration)",
+      "required": true,
+      "sensitive": false,
+      "docsUrl": "https://airtable.com/create/oauth"
+    },
+    {
+      "name": "AIRTABLE_CLIENT_SECRET",
+      "description": "Airtable OAuth Client Secret",
+      "required": true,
+      "sensitive": true,
+      "docsUrl": "https://airtable.com/create/oauth"
+    }
+  ],
+  "tools": [
+    {
+      "id": "list-bases",
+      "name": "List Bases",
+      "description": "List all accessible Airtable bases",
+      "requiresWrite": false
+    },
+    {
+      "id": "get-base",
+      "name": "Get Base",
+      "description": "Get schema information for a specific base",
+      "requiresWrite": false
+    },
+    {
+      "id": "list-records",
+      "name": "List Records",
+      "description": "List records from a table with optional filtering",
+      "requiresWrite": false
+    },
+    {
+      "id": "get-record",
+      "name": "Get Record",
+      "description": "Get a specific record by ID",
+      "requiresWrite": false
+    },
+    {
+      "id": "create-record",
+      "name": "Create Record",
+      "description": "Create a new record in a table",
+      "requiresWrite": true
+    }
+  ],
+  "prompts": [
+    {
+      "id": "query-data",
+      "title": "Query my data",
+      "prompt": "Search and query records from my Airtable bases. Find specific information across tables.",
+      "category": "productivity",
+      "icon": "search"
+    },
+    {
+      "id": "add-record",
+      "title": "Add a record",
+      "prompt": "Create a new record in an Airtable table with the specified field values.",
+      "category": "productivity",
+      "icon": "plus"
+    },
+    {
+      "id": "analyze-base",
+      "title": "Analyze base structure",
+      "prompt": "Analyze the structure and schema of an Airtable base, including all tables and their fields.",
+      "category": "productivity",
+      "icon": "document"
+    }
+  ],
+  "suggestedWith": ["gmail", "slack", "notion"]
+}

package/dist/integrations/airtable/files/ai/tools/create-record.ts

@@ -0,0 +1,25 @@
+import { tool } from "veryfront/ai";
+import { z } from "zod";
+import { createRecord } from "../../lib/airtable-client.ts";
+
+export default tool({
+  id: "create-record",
+  description:
+    "Create a new record in an Airtable table. Provide field names and values as an object. Returns the created record with its ID.",
+  inputSchema: z.object({
+    baseId: z.string().describe('The ID of the Airtable base (starts with "app")'),
+    tableIdOrName: z.string().describe("The ID or name of the table"),
+    fields: z.record(z.unknown()).describe(
+      'Object with field names as keys and their values. Field names must match exactly. Example: { "Name": "John Doe", "Email": "john@example.com", "Status": "Active" }',
+    ),
+  }),
+  async execute({ baseId, tableIdOrName, fields }) {
+    const record = await createRecord(baseId, tableIdOrName, fields);
+
+    return {
+      id: record.id,
+      createdTime: record.createdTime,
+      fields: record.fields,
+    };
+  },
+});

package/dist/integrations/airtable/files/ai/tools/get-base.ts

@@ -0,0 +1,34 @@
+import { tool } from "veryfront/ai";
+import { z } from "zod";
+import { getBase } from "../../lib/airtable-client.ts";
+
+export default tool({
+  id: "get-base",
+  description:
+    "Get the schema and structure of an Airtable base, including all tables, fields, and views. Useful for understanding the data model before querying or creating records.",
+  inputSchema: z.object({
+    baseId: z.string().describe('The ID of the Airtable base (starts with "app")'),
+  }),
+  async execute({ baseId }) {
+    const schema = await getBase(baseId);
+
+    return {
+      tables: schema.tables.map((table) => ({
+        id: table.id,
+        name: table.name,
+        primaryFieldId: table.primaryFieldId,
+        fields: table.fields.map((field) => ({
+          id: field.id,
+          name: field.name,
+          type: field.type,
+          options: field.options,
+        })),
+        views: table.views.map((view) => ({
+          id: view.id,
+          name: view.name,
+          type: view.type,
+        })),
+      })),
+    };
+  },
+});

package/dist/integrations/airtable/files/ai/tools/get-record.ts

@@ -0,0 +1,23 @@
+import { tool } from "veryfront/ai";
+import { z } from "zod";
+import { getRecord } from "../../lib/airtable-client.ts";
+
+export default tool({
+  id: "get-record",
+  description:
+    "Get a specific record from an Airtable table by its ID. Returns the full record with all field values.",
+  inputSchema: z.object({
+    baseId: z.string().describe('The ID of the Airtable base (starts with "app")'),
+    tableIdOrName: z.string().describe("The ID or name of the table"),
+    recordId: z.string().describe('The ID of the record to retrieve (starts with "rec")'),
+  }),
+  async execute({ baseId, tableIdOrName, recordId }) {
+    const record = await getRecord(baseId, tableIdOrName, recordId);
+
+    return {
+      id: record.id,
+      createdTime: record.createdTime,
+      fields: record.fields,
+    };
+  },
+});

package/dist/integrations/airtable/files/ai/tools/list-bases.ts

@@ -0,0 +1,19 @@
+import { tool } from "veryfront/ai";
+import { z } from "zod";
+import { listBases } from "../../lib/airtable-client.ts";
+
+export default tool({
+  id: "list-bases",
+  description:
+    "List all accessible Airtable bases in the connected account. Returns base IDs, names, and permission levels.",
+  inputSchema: z.object({}),
+  async execute() {
+    const bases = await listBases();
+
+    return bases.map((base) => ({
+      id: base.id,
+      name: base.name,
+      permissionLevel: base.permissionLevel,
+    }));
+  },
+});

package/dist/integrations/airtable/files/ai/tools/list-records.ts

@@ -0,0 +1,47 @@
+import { tool } from "veryfront/ai";
+import { z } from "zod";
+import { listRecords } from "../../lib/airtable-client.ts";
+
+export default tool({
+  id: "list-records",
+  description:
+    "List records from an Airtable table. Supports filtering with formulas, sorting, and limiting results. Returns record IDs, creation times, and all field values.",
+  inputSchema: z.object({
+    baseId: z.string().describe('The ID of the Airtable base (starts with "app")'),
+    tableIdOrName: z.string().describe("The ID or name of the table"),
+    fields: z.array(z.string()).optional().describe(
+      "Specific field names to return (returns all fields if not specified)",
+    ),
+    filterByFormula: z.string().optional().describe(
+      "Airtable formula to filter records (e.g., \"{Status} = 'Done'\")",
+    ),
+    maxRecords: z.number().min(1).max(100).optional().describe(
+      "Maximum number of records to return",
+    ),
+    sort: z.array(z.object({
+      field: z.string().describe("Field name to sort by"),
+      direction: z.enum(["asc", "desc"]).describe("Sort direction"),
+    })).optional().describe("Array of sort specifications"),
+    view: z.string().optional().describe("Name of a view to use for filtering and sorting"),
+  }),
+  async execute({ baseId, tableIdOrName, fields, filterByFormula, maxRecords, sort, view }) {
+    const result = await listRecords(baseId, tableIdOrName, {
+      fields,
+      filterByFormula,
+      maxRecords,
+      pageSize: maxRecords,
+      sort,
+      view,
+    });
+
+    return {
+      records: result.records.map((record) => ({
+        id: record.id,
+        createdTime: record.createdTime,
+        fields: record.fields,
+      })),
+      count: result.records.length,
+      hasMore: !!result.offset,
+    };
+  },
+});

package/dist/integrations/airtable/files/app/api/auth/airtable/callback/route.ts

@@ -0,0 +1,11 @@
+/**
+ * Airtable OAuth Callback
+ */
+
+import { airtableConfig, createOAuthCallbackHandler, memoryTokenStore } from "veryfront/oauth";
+
+export const GET = createOAuthCallbackHandler(airtableConfig, {
+  tokenStore: memoryTokenStore,
+  onSuccess: () => "/",
+  onError: () => "/",
+});

package/dist/integrations/airtable/files/app/api/auth/airtable/route.ts

@@ -0,0 +1,9 @@
+/**
+ * Airtable OAuth Initiation
+ */
+
+import { airtableConfig, createOAuthInitHandler, memoryTokenStore } from "veryfront/oauth";
+
+export const GET = createOAuthInitHandler(airtableConfig, {
+  tokenStore: memoryTokenStore,
+});