From 076c8629b3c40efba610b6b9f134d20d57c9ea54 Mon Sep 17 00:00:00 2001
From: lorentz <lorentz@wulfconsulting.com>
Date: Fri, 10 Jul 2026 17:44:56 -0400
Subject: [PATCH] feat(10-03): add live PAX8 auth-proof script + document PAX8
 in CLAUDE.md

- scripts/verify-pax8-auth.ts loads .env.local, calls getPax8Client().listCompanies(0,1), logs only counts/status (never token/secret)
- CLAUDE.md External integrations table gains a PAX8 row (PAX8_* prefix)
- INTEGRATIONS.md does not exist at repo root; edit skipped per plan instructions (noted in SUMMARY)
---
 CLAUDE.md                   |  1 +
 scripts/verify-pax8-auth.ts | 39 +++++++++++++++++++++++++++++++++++++
 2 files changed, 40 insertions(+)
 create mode 100644 scripts/verify-pax8-auth.ts

diff --git a/CLAUDE.md b/CLAUDE.md
index 54d2bb3..f494629 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -79,6 +79,7 @@ Examples: `getAutotaskClient()`, `getMsgraphClient()`, `getDattoRmmClient()`,
 | Datto RMM | `DATTO_RMM_*` |
 | Veeam VSPC | `VEEAM_VSPC_*` |
 | Auvik / Addigy / IT Glue / Mimecast / S1 / Duo / Zoom / QBO / Zabbix / Salesbldr | `<NAME>_*` |
+| PAX8 | `PAX8_*` (OAuth2 client-credentials, read-only partner/reseller API) |
 | Anthropic | `ANTHROPIC_API_KEY` (analyzer pipeline + `ai-triage-service.ts`) |
 | OpenRouter | `OPENROUTER_API_KEY` (alternate analyzer provider, opt-in per request) |
 | Backblaze B2 | `B2_*` (LogLift evidence storage) |
diff --git a/scripts/verify-pax8-auth.ts b/scripts/verify-pax8-auth.ts
new file mode 100644
index 0000000..d161dbf
--- /dev/null
+++ b/scripts/verify-pax8-auth.ts
@@ -0,0 +1,39 @@
+/**
+ * verify-pax8-auth.ts
+ *
+ * Live auth-proof for the PAX8 integration (Phase 10 Success Criterion #2).
+ * Runs a real OAuth2 client-credentials token exchange against
+ * api.pax8.com/v1/token, then a read-only GET /companies call, through the
+ * Plan 01 client (lib/services/pax8-client.ts via lib/services/pax8-factory.ts).
+ *
+ * Requires PAX8_CLIENT_ID and PAX8_CLIENT_SECRET in .env.local (gitignored —
+ * `.env*` is covered by .gitignore; never commit real credentials).
+ *
+ * Run with: npx tsx scripts/verify-pax8-auth.ts
+ *
+ * Security: this script prints ONLY a success summary (company count /
+ * page.totalElements). It never logs the access token or the client secret.
+ */
+
+import { config } from 'dotenv';
+import { resolve } from 'path';
+
+config({ path: resolve(__dirname, '../.env.local') });
+
+import { getPax8Client } from '../lib/services/pax8-factory';
+
+async function main(): Promise<void> {
+  console.log('[verify-pax8-auth] Requesting live PAX8 token + /companies read...');
+
+  const client = getPax8Client();
+  const result = await client.listCompanies(0, 1);
+
+  console.log('[verify-pax8-auth] SUCCESS');
+  console.log(`[verify-pax8-auth] companies returned this page: ${result.content.length}`);
+  console.log(`[verify-pax8-auth] total companies (page.totalElements): ${result.page.totalElements}`);
+}
+
+main().catch((err) => {
+  console.error('[verify-pax8-auth] FAILED:', err instanceof Error ? err.message : err);
+  process.exit(1);
+});