Vendor Fabric

vendor-fabric is the optional vendor integration layer for the Extended Data Python stack. It depends on extended-data>=8.4.0 for the polymorphic ExtendedData root, concrete containers, local file sync, inputs, logging, and workflow utilities, then adds adapter-registered API clients and vendor-backed sync capabilities.

Documentation: jonbogaty.com/vendor-fabric

pip install vendor-fabric
pip install "vendor-fabric[github,slack]"
pip install "vendor-fabric[aws,google,vault,secrets-sync]"
pip install secrets-sync-python-binding
pip install pytest-vendor-fabric

The base install keeps vendor SDKs out of the environment. Connector metadata is available even when an optional SDK is absent:

from vendor_fabric import get_connector_info, list_connector_info

print(get_connector_info("github")["available"])
print(list_connector_info(include_unavailable=True))

Construct connectors through the registry or ConnectorFabric:

from vendor_fabric import ConnectorFabric

fabric = ConnectorFabric(inputs={"GITHUB_TOKEN": "..."})
github = fabric.get_connector("github")

Unavailable features report install guidance instead of requiring callers to wrap their own imports.

Command-line interface

The vendor-fabric command exposes the same Extended Data-returning connector surface as the Python registry. Connector credentials come from environment variables, the AWS default credential chain, or SecretSync configuration; the CLI has no credential flags.

# Discover connectors and their callable data surface.
vendor-fabric list
vendor-fabric list --category cloud --available-only
vendor-fabric info github
vendor-fabric methods github
vendor-fabric methods github --json
vendor-fabric credentials
vendor-fabric credentials github --json

# Provider commands use the connector method name and --name value arguments.
vendor-fabric github list_repositories --type-filter public
vendor-fabric meshy text3d_generate --prompt "a low-poly observatory" --wait false

# The generic spelling remains available for scripts that select a provider.
vendor-fabric call github list_repositories --type-filter public --json

# SecretSync is also routed through the unified command.
vendor-fabric secrets-sync validate --config pipeline.yaml
vendor-fabric secrets-sync info --config pipeline.yaml
vendor-fabric secrets-sync pipeline --config pipeline.yaml --dry-run --diff

methods prints each callable signature, including required and optional arguments. Argument names accept either underscores or hyphens. Values are decoded as JSON first, then as booleans, integers, floats, or strings. Use JSON for structured arguments:

vendor-fabric anthropic create_message \
  --model claude-sonnet-4-20250514 \
  --max-tokens 1024 \
  --messages '[{"role":"user","content":"Summarize this change"}]'

Sensitive method inputs are never accepted as literal command-line values. Use the generated --<name>-env, --<name>-file, or --<name>-stdin form so the value does not land in shell history. These source forms also work for non-sensitive structured or multiline inputs. File and environment contents receive the same JSON-first decoding as ordinary arguments.

# APP_SECRET contains the value; only its variable name appears in history.
vendor-fabric aws create_secret --name app/api --secret-value-env APP_SECRET

# Read a Google Workspace initial password from standard input.
security find-generic-password -w -s workspace-bootstrap \
  | vendor-fabric google create_user \
      --primary-email new.user@example.com \
      --given-name New \
      --family-name User \
      --password-stdin

# Keep a large request payload in a permission-controlled file.
vendor-fabric anthropic create_message \
  --model claude-sonnet-4-20250514 \
  --max-tokens 1024 \
  --messages-file request-messages.json

Credential sources

vendor-fabric credentials [connector] reports these names without reading or printing their values. Optional SDK extras remain discoverable even when they are not installed.

Connector commands

Every command below is available through both vendor-fabric <connector> <method> and vendor-fabric call <connector> <method>. Run vendor-fabric methods <connector> for its argument signature.

The CLI deliberately does not expose raw HTTP/SDK clients, sessions, resources, authentication helpers, connector lifecycle methods, duplicate agent-tool wrappers, Meshy persistence/webhook internals, SecretSync's transitional Python helpers, or connector methods whose public return contract is a raw bool, str, None, or SDK object. Those APIs either bypass the Extended Data serialization/redaction boundary, duplicate a command above, or need an application lifecycle rather than a one-shot shell command.

SecretSync access is exposed through a binding-backed facade:

from vendor_fabric.secrets_sync import ProviderSession, SyncOptions, get_targets, run_pipeline

result = run_pipeline("pipeline.yaml", SyncOptions(dry_run=True))
targets = get_targets("pipeline.yaml")

print(result["success"])
print(targets["targets"])

session = ProviderSession(
    vault_address="https://vault.example.com",
    vault_token=vault_token,
    aws_region="us-east-1",
    aws_access_key_id=aws_credentials.access_key,
    aws_secret_access_key=aws_credentials.secret_key,
    aws_session_token=aws_credentials.token,
)
run_pipeline("pipeline.yaml", SyncOptions(dry_run=True), provider_session=session)

vendor-fabric consumes the secrets_sync import from secrets-sync-python-binding and shapes those payloads into Extended Data values. The canonical SecretSync runtime, CLI, pipeline semantics, and gopy binding source live in jbcom/secrets-sync.

Connector and sync payloads are ExtendedData values at the boundary. Dict, list, string, tuple, and set payloads are concrete extended subclasses, so code can use normal container operations and extended-data methods without import juggling.

Testing support lives in the separately published pytest-vendor-fabric package. It provides connector fixtures, E2E controls, and credential guards without forcing test-only dependencies into the runtime package.