@almadar/integrations 2.39.0 → 2.40.0

package/dist/runtime/index.d.ts

@@ -50,7 +50,15 @@ declare class RuntimeIntegrationManager {
     private credentialStore;
     private storeEnvBase;
     private storeFirst;
-    constructor();
+    private readonly tenant;
+    /**
+     * `tenant`: one tenant of a multi-tenant host. Its services are configured from its credential
+     * store alone (never the host's env), and it installs nothing process-wide; resolve its
+     * references inside `runWithCredentialScope`.
+     */
+    constructor(options?: {
+        tenant?: boolean;
+    });
     /**
      * W4: configure with the tenant credential store layered over the env —
      * store → env → unconfigured. Installs the store as the process-wide

package/dist/runtime/index.js

@@ -1,6 +1,7 @@
 import { createLogger } from '@almadar/logger';
 import { integratorsRegistry } from '@almadar/core/patterns';
 import { createHmac, createHash } from 'crypto';
+import { AsyncLocalStorage } from 'async_hooks';
 import { mkdtempSync, writeFileSync, rmSync, promises } from 'fs';
 import { join } from 'path';
 import Stripe2 from 'stripe';
@@ -400,8 +401,7 @@ function getIntegration(name) {
 function getRegisteredIntegrations() {
   return Object.keys(INTEGRATION_REGISTRY);
 }
-
-// src/factory.ts
+var callLog = createLogger("almadar:integrations:calls");
 function instanceKey(name, principal) {
   return principal ? `${name}\0${principal}` : name;
 }
@@ -446,8 +446,16 @@ var IntegrationFactory = class {
    * Execute an action on an integration
    */
   async execute(integration, action, params, context) {
-    const instance = this.get(integration, context?.principal);
-    return await instance.execute(action, params, context);
+    const start = performance.now();
+    const record = (ok, error) => callLog.call({ kind: "external", service: integration, op: action, durationMs: performance.now() - start, ok, ...error !== void 0 ? { error } : {} });
+    try {
+      const result = await this.get(integration, context?.principal).execute(action, params, context);
+      record(result.success, result.success ? void 0 : result.error?.message);
+      return result;
+    } catch (err) {
+      record(false, err instanceof Error ? err.message : String(err));
+      throw err;
+    }
   }
   /**
    * Check if integration is configured
@@ -491,9 +499,8 @@ var IntegrationFactory = class {
     this.configs.clear();
   }
 };
-
-// src/credentials/resolver.ts
 var installedStore = null;
+var tenantScope = new AsyncLocalStorage();
 var activeFactory = null;
 function installActiveFactory(factory) {
   activeFactory = factory;
@@ -508,6 +515,8 @@ function getInstalledCredentialStore() {
   return installedStore;
 }
 function resolveCredentialRef(ref, env = process.env) {
+  const tenant = tenantScope.getStore();
+  if (tenant) return tenant.resolve(ref);
   return installedStore?.resolve(ref) ?? env[ref];
 }
 join(".almadar", "dev-credentials.json");
@@ -5437,12 +5446,18 @@ function generateMockFromShape(shape) {
   return data;
 }
 var RuntimeIntegrationManager = class {
-  constructor() {
+  /**
+   * `tenant`: one tenant of a multi-tenant host. Its services are configured from its credential
+   * store alone (never the host's env), and it installs nothing process-wide; resolve its
+   * references inside `runWithCredentialScope`.
+   */
+  constructor(options = {}) {
     this.credentialStore = null;
     this.storeEnvBase = null;
     this.storeFirst = false;
     this.factory = new IntegrationFactory();
-    installActiveFactory(this.factory);
+    this.tenant = options.tenant === true;
+    if (!this.tenant) installActiveFactory(this.factory);
   }
   /**
    * W4: configure with the tenant credential store layered over the env —
@@ -5454,7 +5469,13 @@ var RuntimeIntegrationManager = class {
    */
   async configureFromStore(store, envOverride) {
     this.credentialStore = store;
-    this.storeEnvBase = envOverride ?? process.env;
+    this.storeEnvBase = this.tenant ? {} : envOverride ?? process.env;
+    if (this.tenant) {
+      await store.warm();
+      store.subscribe(() => this.refreshFromStore());
+      this.refreshFromStore();
+      return;
+    }
     this.storeFirst = this.storeEnvBase.ALMADAR_CREDENTIALS_SOURCE === "store";
     installCredentialStore(store);
     await store.warm();