@flowdular/sdk 0.2.4 → 0.3.1

package/modules/connectors/src/settings.ts

@@ -0,0 +1,69 @@
+import {
+	defineModuleSettings,
+	PLATFORM_SETTINGS_TENANT,
+	type ModuleSettingsRuntime,
+} from '@flowdular/sdk/kernel';
+import type { ConnectorCallLimits } from './services/call-service.ts';
+
+export const CONNECTORS_MODULE_ID = 'connectors.core';
+
+export const CONNECTORS_MODULE_SETTINGS = defineModuleSettings({
+	moduleId: CONNECTORS_MODULE_ID,
+	settings: {
+		callTimeoutMs: {
+			type: 'number',
+			defaultValue: 10_000,
+			min: 1_000,
+			max: 60_000,
+			visibility: 'shared',
+			client: false,
+			scope: 'platform',
+			labelKey: 'connectors.settings.callTimeoutMs.label',
+			label: 'Call timeout (milliseconds)',
+			descriptionKey: 'connectors.settings.callTimeoutMs.description',
+			description:
+				'How long one connector call may take before it is aborted and recorded as a timeout.',
+		},
+		maxResponseBytes: {
+			type: 'number',
+			defaultValue: 1_048_576,
+			min: 1_024,
+			max: 16_777_216,
+			visibility: 'shared',
+			client: false,
+			scope: 'platform',
+			labelKey: 'connectors.settings.maxResponseBytes.label',
+			label: 'Response size cap (bytes)',
+			descriptionKey: 'connectors.settings.maxResponseBytes.description',
+			description:
+				'Bytes of a response that are read before the call is recorded as too large.',
+		},
+	},
+});
+
+/* A setting read must never take a call down, so each accessor falls back to
+   the declared default when the runtime has not registered it yet. */
+function value(
+	settings: ModuleSettingsRuntime,
+	key: 'callTimeoutMs' | 'maxResponseBytes',
+	fallback: number,
+): number {
+	try {
+		return settings.get<number>(
+			PLATFORM_SETTINGS_TENANT,
+			CONNECTORS_MODULE_ID,
+			key,
+		);
+	} catch {
+		return fallback;
+	}
+}
+
+export function connectorCallLimits(
+	settings: ModuleSettingsRuntime,
+): ConnectorCallLimits {
+	return {
+		timeoutMs: value(settings, 'callTimeoutMs', 10_000),
+		maxResponseBytes: value(settings, 'maxResponseBytes', 1_048_576),
+	};
+}

package/modules/connectors/translations/en.json

@@ -0,0 +1,191 @@
+{
+	"action.consent": "Change consent",
+	"action.create": "Create",
+	"action.delete": "Delete",
+	"action.disable": "Disable",
+	"action.enable": "Enable",
+	"action.new": "New connector",
+	"action.open": "Open",
+	"action.save": "Save",
+	"action.testCall": "Run test call",
+	"authKind.api-key": "API key header",
+	"authKind.bearer": "Bearer token",
+	"authKind.none": "No authentication",
+	"authKind.oauth2-client-credentials": "OAuth2 client credentials",
+	"caller.agent": "Agent",
+	"caller.test": "Test",
+	"caller.workflow": "Workflow",
+	"calls.allInstances": "Every connector",
+	"calls.allOutcomes": "Every outcome",
+	"calls.caption": "Connector calls of this workspace",
+	"calls.column.caller": "Caller",
+	"calls.column.duration": "Duration",
+	"calls.column.errorClass": "Class",
+	"calls.column.instance": "Connector",
+	"calls.column.occurredAt": "When",
+	"calls.column.operation": "Operation",
+	"calls.column.outcome": "Outcome",
+	"calls.column.status": "Status",
+	"calls.count": "{count} calls",
+	"calls.deletedInstance": "Deleted connector",
+	"calls.denied": "You need the connectors read permission to see this screen.",
+	"calls.description": "Every outbound call of this workspace, without any request or response body.",
+	"calls.duration": "{value} ms",
+	"calls.emptyFilteredHint": "Change the search or the filters.",
+	"calls.emptyFilteredTitle": "No call matches",
+	"calls.emptyHint": "A test call, a workflow or an agent produces the first row.",
+	"calls.emptyTitle": "No calls yet",
+	"calls.errorLoad": "Could not load the call log.",
+	"calls.filterInstance": "Connector",
+	"calls.filterOutcome": "Outcome",
+	"calls.loading": "Loading calls…",
+	"calls.note": "The log keeps outcomes, status codes and sizes. It never keeps a body or a credential.",
+	"calls.searchLabel": "Search calls",
+	"calls.searchPlaceholder": "Operation",
+	"calls.tableTitle": "Calls",
+	"calls.title": "Connector calls",
+	"column.allowAgents": "Agents",
+	"column.allowWorkflows": "Workflows",
+	"column.authKind": "Authentication",
+	"column.baseUrl": "Base URL",
+	"column.definition": "Definition",
+	"column.lastCall": "Last call",
+	"column.name": "Name",
+	"column.status": "Status",
+	"common.accessDenied": "Access denied",
+	"common.actions": "Actions",
+	"common.administration": "Administration",
+	"common.close": "Close",
+	"common.filters": "Filters",
+	"common.messages": "Messages",
+	"common.never": "Never",
+	"common.none": "None",
+	"common.refresh": "Refresh",
+	"common.refreshing": "Refreshing…",
+	"common.saving": "Saving…",
+	"consent.agents": "Agent calls",
+	"consent.agentsHelp": "While this is on, an agent run may call this connector through its tool.",
+	"consent.agentsSwitch": "Agent calls: {value}",
+	"consent.agentsTitle": "Change agent consent",
+	"consent.description": "This sets {caller} for {name} to {value}. Nothing else changes, and the change is recorded in the audit trail.",
+	"consent.off": "Off",
+	"consent.on": "On",
+	"consent.title": "Change connector consent",
+	"consent.workflows": "Workflow calls",
+	"consent.workflowsHelp": "While this is on, a published workflow may call this connector as an action.",
+	"consent.workflowsSwitch": "Workflow calls: {value}",
+	"consent.workflowsTitle": "Change workflow consent",
+	"credential.clientId": "Client id",
+	"credential.clientIdHelp": "The OAuth2 client identifier.",
+	"credential.clientSecret": "Client secret",
+	"credential.clientSecretHelp": "Stored sealed; it is never shown again.",
+	"credential.header": "Header name",
+	"credential.headerHelp": "The header the API key is sent in, for example x-api-key.",
+	"credential.scope": "Scope",
+	"credential.scopeHelp": "Optional scope requested with the token.",
+	"credential.token": "Bearer token",
+	"credential.tokenHelp": "Stored sealed; it is never shown again.",
+	"credential.tokenUrl": "Token URL",
+	"credential.tokenUrlHelp": "The https token endpoint, on the instance host allowlist.",
+	"credential.value": "API key",
+	"credential.valueHelp": "Stored sealed; it is never shown again.",
+	"delete.description": "Deleting {name} removes its sealed credential. The call log stays.",
+	"delete.title": "Delete connector",
+	"disable.description": "Disabling {name} stops every call at once, including calls already queued by workflows.",
+	"disable.title": "Disable connector",
+	"drawer.newSubtitle": "The credential is accepted once and sealed.",
+	"drawer.newTitle": "New connector",
+	"drawer.subtitle": "Connector instance",
+	"error.action": "The connector action failed.",
+	"error.code.AUTH_KIND_UNSUPPORTED": "This definition does not support the chosen authentication kind.",
+	"error.code.CONSENT_NOT_CONFIRMED": "A consent change needs an explicit confirmation.",
+	"error.code.CREDENTIAL_INVALID": "The credential is incomplete for the chosen authentication kind.",
+	"error.code.CSRF_REJECTED": "The session could not be verified. Reload the screen and try again.",
+	"error.code.DEFINITION_UNKNOWN": "No connector definition is registered under this key.",
+	"error.code.EGRESS_REFUSED": "The URL must be an https address of a public host.",
+	"error.code.FORBIDDEN": "You do not have permission for this action.",
+	"error.code.HOST_NOT_ALLOWLISTED": "The host is not on the instance allowlist.",
+	"error.code.INSTANCE_ACTIVE": "Disable the connector before deleting it.",
+	"error.code.INSTANCE_NAME_TAKEN": "A connector with this name already exists in the workspace.",
+	"error.code.INSTANCE_NOT_FOUND": "This connector no longer exists.",
+	"error.code.PORT_NOT_ALLOWED": "This definition does not accept that port.",
+	"error.load": "Could not load the connectors.",
+	"error.request": "The connectors operation failed.",
+	"error.save": "Could not save the connector.",
+	"filter.allDefinitions": "Every definition",
+	"filter.allStatuses": "Every status",
+	"filter.definition": "Definition",
+	"filter.status": "Status",
+	"form.allowedHosts": "Allowed hosts",
+	"form.allowedHostsHelp": "Hosts this instance may reach, separated by commas. Empty means the base URL host only.",
+	"form.allowedHostsPlaceholder": "api.example.com",
+	"form.authKind": "Authentication",
+	"form.authKindHelp": "How the request proves who it is. It cannot be changed later.",
+	"form.baseUrl": "Base URL",
+	"form.baseUrlHelp": "An https URL to a public host. Private and loopback addresses are refused.",
+	"form.baseUrlPlaceholder": "https://api.example.com/v1",
+	"form.constraint": "Credentials are sealed with the module key and never returned.",
+	"form.credentialFingerprint": "Credential fingerprint",
+	"form.credentialHelp": "The stored credential is never shown again; the fingerprint changes when it is replaced.",
+	"form.definition": "Definition",
+	"form.definitionHelp": "The connector kind this instance configures. It cannot be changed later.",
+	"form.lastCall": "Last call",
+	"form.lastCallHelp": "When a call of this instance was last recorded, including a refused one.",
+	"form.loadingHint": "The workspace connectors are still being read.",
+	"form.loadingTitle": "Loading the connector…",
+	"form.missingHint": "It was deleted or it belongs to another workspace. Close this panel and refresh.",
+	"form.missingTitle": "Connector not found",
+	"form.name": "Name",
+	"form.nameHelp": "Unique inside this workspace.",
+	"form.namePlaceholder": "Billing API",
+	"form.noCredential": "No credential",
+	"form.replaceCredentials": "Replace the credential",
+	"form.testBody": "Response preview",
+	"form.testBodyHelp": "Truncated for diagnosis. Nothing of it is stored.",
+	"form.testOperation": "Test operation",
+	"form.testOperationHelp": "The operation the test call runs.",
+	"form.testPath": "Test path",
+	"form.testPathHelp": "The path appended to the base URL, starting with a slash.",
+	"form.testResult": "Outcome {outcome}, status {status}, {duration} ms, class {errorClass}.",
+	"instances.caption": "Connector instances of this workspace",
+	"instances.count": "{count} instances",
+	"instances.denied": "You need the connectors read permission to see this screen.",
+	"instances.description": "Configured connections to external systems. Credentials are sealed and never shown again.",
+	"instances.emptyFilteredHint": "Change the search or the filters.",
+	"instances.emptyFilteredTitle": "No connector matches",
+	"instances.emptyHint": "Create one to let this workspace call an external system.",
+	"instances.emptyTitle": "No connectors yet",
+	"instances.errorHint": "Refresh to try again.",
+	"instances.errorTitle": "Could not load the connectors",
+	"instances.loading": "Loading connectors…",
+	"instances.note": "Calls leave only to allowlisted public hosts, and no request or response body is stored.",
+	"instances.tableTitle": "Instances",
+	"instances.title": "Connectors",
+	"module.name": "Connectors",
+	"navigation.calls": "Connector calls",
+	"navigation.callsDescription": "Every outbound call, with its outcome and duration.",
+	"navigation.instances": "Connectors",
+	"navigation.instancesDescription": "External systems this workspace may call, with their credentials and consent.",
+	"notice.consent": "Consent changed.",
+	"notice.created": "Connector created.",
+	"notice.deleted": "Connector deleted.",
+	"notice.disabled": "Connector disabled.",
+	"notice.enabled": "Connector enabled.",
+	"notice.saved": "Connector saved.",
+	"outcome.failed": "Failed",
+	"outcome.refused": "Refused",
+	"outcome.succeeded": "Succeeded",
+	"pagination.label": "Pagination",
+	"pagination.next": "Next",
+	"pagination.previous": "Previous",
+	"pagination.size": "Rows per page",
+	"pagination.page": "Page {page}, from row {from}",
+	"search.label": "Search connectors",
+	"search.placeholder": "Name or base URL",
+	"settings.callTimeoutMs.description": "How long one connector call may take before it is aborted and recorded as a timeout.",
+	"settings.callTimeoutMs.label": "Call timeout (milliseconds)",
+	"settings.maxResponseBytes.description": "Bytes of a response that are read before the call is recorded as too large.",
+	"settings.maxResponseBytes.label": "Response size cap (bytes)",
+	"status.active": "Active",
+	"status.disabled": "Disabled"
+}

package/modules/connectors/translations/pl.json

@@ -0,0 +1,191 @@
+{
+	"action.consent": "Zmień zgodę",
+	"action.create": "Utwórz",
+	"action.delete": "Usuń",
+	"action.disable": "Wyłącz",
+	"action.enable": "Włącz",
+	"action.new": "Nowy konektor",
+	"action.open": "Otwórz",
+	"action.save": "Zapisz",
+	"action.testCall": "Uruchom wywołanie testowe",
+	"authKind.api-key": "Nagłówek z kluczem API",
+	"authKind.bearer": "Token bearer",
+	"authKind.none": "Bez uwierzytelniania",
+	"authKind.oauth2-client-credentials": "OAuth2 client credentials",
+	"caller.agent": "Agent",
+	"caller.test": "Test",
+	"caller.workflow": "Przepływ",
+	"calls.allInstances": "Każdy konektor",
+	"calls.allOutcomes": "Każdy wynik",
+	"calls.caption": "Wywołania konektorów tego obszaru roboczego",
+	"calls.column.caller": "Wywołujący",
+	"calls.column.duration": "Czas",
+	"calls.column.errorClass": "Klasa",
+	"calls.column.instance": "Konektor",
+	"calls.column.occurredAt": "Kiedy",
+	"calls.column.operation": "Operacja",
+	"calls.column.outcome": "Wynik",
+	"calls.column.status": "Status",
+	"calls.count": "Wywołania: {count}",
+	"calls.deletedInstance": "Usunięty konektor",
+	"calls.denied": "Do tego ekranu potrzebne jest uprawnienie odczytu konektorów.",
+	"calls.description": "Każde wywołanie wychodzące tego obszaru roboczego, bez treści żądania i odpowiedzi.",
+	"calls.duration": "{value} ms",
+	"calls.emptyFilteredHint": "Zmień wyszukiwanie lub filtry.",
+	"calls.emptyFilteredTitle": "Brak pasujących wywołań",
+	"calls.emptyHint": "Pierwszy wiersz tworzy wywołanie testowe, przepływ albo agent.",
+	"calls.emptyTitle": "Brak wywołań",
+	"calls.errorLoad": "Nie udało się wczytać dziennika wywołań.",
+	"calls.filterInstance": "Konektor",
+	"calls.filterOutcome": "Wynik",
+	"calls.loading": "Wczytywanie wywołań…",
+	"calls.note": "Dziennik przechowuje wyniki, kody statusu i rozmiary. Nigdy nie przechowuje treści ani poświadczeń.",
+	"calls.searchLabel": "Szukaj wywołań",
+	"calls.searchPlaceholder": "Operacja",
+	"calls.tableTitle": "Wywołania",
+	"calls.title": "Wywołania konektorów",
+	"column.allowAgents": "Agenci",
+	"column.allowWorkflows": "Przepływy",
+	"column.authKind": "Uwierzytelnianie",
+	"column.baseUrl": "Adres bazowy",
+	"column.definition": "Definicja",
+	"column.lastCall": "Ostatnie wywołanie",
+	"column.name": "Nazwa",
+	"column.status": "Status",
+	"common.accessDenied": "Brak dostępu",
+	"common.actions": "Akcje",
+	"common.administration": "Administracja",
+	"common.close": "Zamknij",
+	"common.filters": "Filtry",
+	"common.messages": "Komunikaty",
+	"common.never": "Nigdy",
+	"common.none": "Brak",
+	"common.refresh": "Odśwież",
+	"common.refreshing": "Odświeżanie…",
+	"common.saving": "Zapisywanie…",
+	"consent.agents": "Wywołania agentów",
+	"consent.agentsHelp": "Gdy jest włączone, przebieg agenta może wywołać ten konektor swoim narzędziem.",
+	"consent.agentsSwitch": "Wywołania agentów: {value}",
+	"consent.agentsTitle": "Zmień zgodę dla agentów",
+	"consent.description": "To ustawia {caller} dla {name} na {value}. Nic innego się nie zmienia, a zmiana trafia do dziennika audytu.",
+	"consent.off": "Wyłączona",
+	"consent.on": "Włączona",
+	"consent.title": "Zmień zgodę konektora",
+	"consent.workflows": "Wywołania przepływów",
+	"consent.workflowsHelp": "Gdy jest włączone, opublikowany przepływ może wywołać ten konektor jako akcję.",
+	"consent.workflowsSwitch": "Wywołania przepływów: {value}",
+	"consent.workflowsTitle": "Zmień zgodę dla przepływów",
+	"credential.clientId": "Identyfikator klienta",
+	"credential.clientIdHelp": "Identyfikator klienta OAuth2.",
+	"credential.clientSecret": "Sekret klienta",
+	"credential.clientSecretHelp": "Zapisywany w postaci zapieczętowanej; nie jest pokazywany ponownie.",
+	"credential.header": "Nazwa nagłówka",
+	"credential.headerHelp": "Nagłówek, w którym wysyłany jest klucz API, na przykład x-api-key.",
+	"credential.scope": "Zakres",
+	"credential.scopeHelp": "Opcjonalny zakres żądany razem z tokenem.",
+	"credential.token": "Token bearer",
+	"credential.tokenHelp": "Zapisywany w postaci zapieczętowanej; nie jest pokazywany ponownie.",
+	"credential.tokenUrl": "Adres tokenu",
+	"credential.tokenUrlHelp": "Adres https punktu tokenu, z listy dozwolonych hostów instancji.",
+	"credential.value": "Klucz API",
+	"credential.valueHelp": "Zapisywany w postaci zapieczętowanej; nie jest pokazywany ponownie.",
+	"delete.description": "Usunięcie {name} kasuje jego zapieczętowane poświadczenie. Dziennik wywołań pozostaje.",
+	"delete.title": "Usuń konektor",
+	"disable.description": "Wyłączenie {name} natychmiast zatrzymuje każde wywołanie, także te już zakolejkowane przez przepływy.",
+	"disable.title": "Wyłącz konektor",
+	"drawer.newSubtitle": "Poświadczenie jest przyjmowane raz i pieczętowane.",
+	"drawer.newTitle": "Nowy konektor",
+	"drawer.subtitle": "Instancja konektora",
+	"error.action": "Akcja konektora nie powiodła się.",
+	"error.code.AUTH_KIND_UNSUPPORTED": "Ta definicja nie obsługuje wybranego rodzaju uwierzytelniania.",
+	"error.code.CONSENT_NOT_CONFIRMED": "Zmiana zgody wymaga wyraźnego potwierdzenia.",
+	"error.code.CREDENTIAL_INVALID": "Poświadczenie jest niekompletne dla wybranego rodzaju uwierzytelniania.",
+	"error.code.CSRF_REJECTED": "Nie udało się zweryfikować sesji. Odśwież ekran i spróbuj ponownie.",
+	"error.code.DEFINITION_UNKNOWN": "Pod tym kluczem nie zarejestrowano definicji konektora.",
+	"error.code.EGRESS_REFUSED": "Adres musi być adresem https publicznego hosta.",
+	"error.code.FORBIDDEN": "Nie masz uprawnienia do tej akcji.",
+	"error.code.HOST_NOT_ALLOWLISTED": "Host nie znajduje się na liście dozwolonych hostów instancji.",
+	"error.code.INSTANCE_ACTIVE": "Wyłącz konektor przed usunięciem.",
+	"error.code.INSTANCE_NAME_TAKEN": "Konektor o tej nazwie już istnieje w obszarze roboczym.",
+	"error.code.INSTANCE_NOT_FOUND": "Ten konektor już nie istnieje.",
+	"error.code.PORT_NOT_ALLOWED": "Ta definicja nie akceptuje tego portu.",
+	"error.load": "Nie udało się wczytać konektorów.",
+	"error.request": "Operacja konektorów nie powiodła się.",
+	"error.save": "Nie udało się zapisać konektora.",
+	"filter.allDefinitions": "Każda definicja",
+	"filter.allStatuses": "Każdy status",
+	"filter.definition": "Definicja",
+	"filter.status": "Status",
+	"form.allowedHosts": "Dozwolone hosty",
+	"form.allowedHostsHelp": "Hosty, do których ta instancja może dzwonić, oddzielone przecinkami. Puste oznacza tylko host adresu bazowego.",
+	"form.allowedHostsPlaceholder": "api.example.com",
+	"form.authKind": "Uwierzytelnianie",
+	"form.authKindHelp": "Sposób, w jaki żądanie potwierdza tożsamość. Nie można go później zmienić.",
+	"form.baseUrl": "Adres bazowy",
+	"form.baseUrlHelp": "Adres https publicznego hosta. Adresy prywatne i pętli zwrotnej są odrzucane.",
+	"form.baseUrlPlaceholder": "https://api.example.com/v1",
+	"form.constraint": "Poświadczenia są pieczętowane kluczem modułu i nigdy nie są zwracane.",
+	"form.credentialFingerprint": "Odcisk poświadczenia",
+	"form.credentialHelp": "Zapisane poświadczenie nie jest pokazywane ponownie; odcisk zmienia się po jego wymianie.",
+	"form.definition": "Definicja",
+	"form.definitionHelp": "Rodzaj konektora konfigurowany przez tę instancję. Nie można go później zmienić.",
+	"form.lastCall": "Ostatnie wywołanie",
+	"form.lastCallHelp": "Kiedy zapisano ostatnie wywołanie tej instancji, łącznie z odrzuconym.",
+	"form.loadingHint": "Konektory tej przestrzeni są jeszcze odczytywane.",
+	"form.loadingTitle": "Wczytywanie konektora…",
+	"form.missingHint": "Został usunięty albo należy do innej przestrzeni. Zamknij panel i odśwież.",
+	"form.missingTitle": "Nie znaleziono konektora",
+	"form.name": "Nazwa",
+	"form.nameHelp": "Unikalna w tym obszarze roboczym.",
+	"form.namePlaceholder": "API rozliczeń",
+	"form.noCredential": "Brak poświadczenia",
+	"form.replaceCredentials": "Wymień poświadczenie",
+	"form.testBody": "Podgląd odpowiedzi",
+	"form.testBodyHelp": "Skrócony na potrzeby diagnozy. Nic z niego nie jest zapisywane.",
+	"form.testOperation": "Operacja testowa",
+	"form.testOperationHelp": "Operacja uruchamiana przez wywołanie testowe.",
+	"form.testPath": "Ścieżka testowa",
+	"form.testPathHelp": "Ścieżka dołączana do adresu bazowego, zaczynająca się od ukośnika.",
+	"form.testResult": "Wynik {outcome}, status {status}, {duration} ms, klasa {errorClass}.",
+	"instances.caption": "Instancje konektorów tego obszaru roboczego",
+	"instances.count": "Instancje: {count}",
+	"instances.denied": "Do tego ekranu potrzebne jest uprawnienie odczytu konektorów.",
+	"instances.description": "Skonfigurowane połączenia z systemami zewnętrznymi. Poświadczenia są zapieczętowane i nie są pokazywane ponownie.",
+	"instances.emptyFilteredHint": "Zmień wyszukiwanie lub filtry.",
+	"instances.emptyFilteredTitle": "Brak pasujących konektorów",
+	"instances.emptyHint": "Utwórz konektor, aby ten obszar roboczy mógł wywołać system zewnętrzny.",
+	"instances.emptyTitle": "Brak konektorów",
+	"instances.errorHint": "Odśwież, aby spróbować ponownie.",
+	"instances.errorTitle": "Nie udało się wczytać konektorów",
+	"instances.loading": "Wczytywanie konektorów…",
+	"instances.note": "Wywołania trafiają wyłącznie do publicznych hostów z listy dozwolonych, a treści żądań i odpowiedzi nie są zapisywane.",
+	"instances.tableTitle": "Instancje",
+	"instances.title": "Konektory",
+	"module.name": "Konektory",
+	"navigation.calls": "Wywołania konektorów",
+	"navigation.callsDescription": "Każde wywołanie wychodzące z jego wynikiem i czasem trwania.",
+	"navigation.instances": "Konektory",
+	"navigation.instancesDescription": "Systemy zewnętrzne, do których ten obszar roboczy może dzwonić, wraz z poświadczeniami i zgodą.",
+	"notice.consent": "Zgoda zmieniona.",
+	"notice.created": "Konektor utworzony.",
+	"notice.deleted": "Konektor usunięty.",
+	"notice.disabled": "Konektor wyłączony.",
+	"notice.enabled": "Konektor włączony.",
+	"notice.saved": "Konektor zapisany.",
+	"outcome.failed": "Niepowodzenie",
+	"outcome.refused": "Odrzucone",
+	"outcome.succeeded": "Powodzenie",
+	"pagination.label": "Stronicowanie",
+	"pagination.next": "Następna",
+	"pagination.previous": "Poprzednia",
+	"pagination.size": "Wierszy na stronie",
+	"pagination.page": "Strona {page}, od wiersza {from}",
+	"search.label": "Szukaj konektorów",
+	"search.placeholder": "Nazwa lub adres bazowy",
+	"settings.callTimeoutMs.description": "Jak długo może trwać jedno wywołanie konektora, zanim zostanie przerwane i zapisane jako przekroczenie czasu.",
+	"settings.callTimeoutMs.label": "Limit czasu wywołania (milisekundy)",
+	"settings.maxResponseBytes.description": "Liczba bajtów odpowiedzi odczytywanych, zanim wywołanie zostanie zapisane jako zbyt duże.",
+	"settings.maxResponseBytes.label": "Limit rozmiaru odpowiedzi (bajty)",
+	"status.active": "Aktywny",
+	"status.disabled": "Wyłączony"
+}

package/modules/directory/migrations/0001_directory_core.down.sql

@@ -0,0 +1,5 @@
+DROP TABLE IF EXISTS directory_provisioning_events;
+DROP TABLE IF EXISTS directory_scim_group_members;
+DROP TABLE IF EXISTS directory_scim_groups;
+DROP TABLE IF EXISTS directory_scim_users;
+DROP TABLE IF EXISTS directory_scim_tokens;

package/modules/directory/migrations/0001_directory_core.up.sql

@@ -0,0 +1,111 @@
+CREATE TABLE IF NOT EXISTS directory_scim_tokens (
+  id TEXT PRIMARY KEY,
+  tenant_id TEXT NOT NULL,
+  label TEXT NOT NULL,
+  token_fingerprint TEXT NOT NULL,
+  token_hash TEXT NOT NULL,
+  status TEXT NOT NULL CHECK (status IN ('active', 'revoked')),
+  created_by TEXT NOT NULL,
+  created_at BIGINT NOT NULL,
+  last_used_at BIGINT,
+  expires_at BIGINT,
+  revoked_at BIGINT
+);
+-- Case folded like the group name below: two labels an owner cannot tell apart
+-- in the list must not be two credentials.
+CREATE UNIQUE INDEX IF NOT EXISTS directory_scim_tokens_label_idx
+  ON directory_scim_tokens (tenant_id, lower(label));
+-- Authentication reads one row by this derived prefix and then compares the
+-- full hash in constant time, so an unknown credential costs the same lookup.
+CREATE UNIQUE INDEX IF NOT EXISTS directory_scim_tokens_fingerprint_idx
+  ON directory_scim_tokens (tenant_id, token_fingerprint);
+ALTER TABLE directory_scim_tokens ENABLE ROW LEVEL SECURITY;
+ALTER TABLE directory_scim_tokens FORCE ROW LEVEL SECURITY;
+CREATE POLICY directory_scim_tokens_tenant_policy ON directory_scim_tokens
+  USING (tenant_id = current_setting('coreloom.tenant_id', true))
+  WITH CHECK (tenant_id = current_setting('coreloom.tenant_id', true));
+
+CREATE TABLE IF NOT EXISTS directory_scim_users (
+  id TEXT PRIMARY KEY,
+  tenant_id TEXT NOT NULL,
+  external_id TEXT,
+  user_name TEXT NOT NULL,
+  account_id TEXT NOT NULL,
+  active SMALLINT NOT NULL CHECK (active IN (0, 1)),
+  created_at BIGINT NOT NULL,
+  last_synced_at BIGINT NOT NULL
+);
+-- One provider identity per workspace, and one mapping per account: both are
+-- what makes a repeated create idempotent instead of a second membership.
+CREATE UNIQUE INDEX IF NOT EXISTS directory_scim_users_user_name_idx
+  ON directory_scim_users (tenant_id, user_name);
+CREATE UNIQUE INDEX IF NOT EXISTS directory_scim_users_account_idx
+  ON directory_scim_users (tenant_id, account_id);
+CREATE INDEX IF NOT EXISTS directory_scim_users_external_idx
+  ON directory_scim_users (tenant_id, external_id);
+ALTER TABLE directory_scim_users ENABLE ROW LEVEL SECURITY;
+ALTER TABLE directory_scim_users FORCE ROW LEVEL SECURITY;
+CREATE POLICY directory_scim_users_tenant_policy ON directory_scim_users
+  USING (tenant_id = current_setting('coreloom.tenant_id', true))
+  WITH CHECK (tenant_id = current_setting('coreloom.tenant_id', true));
+
+CREATE TABLE IF NOT EXISTS directory_scim_groups (
+  id TEXT PRIMARY KEY,
+  tenant_id TEXT NOT NULL,
+  external_id TEXT,
+  display_name TEXT NOT NULL,
+  role_key TEXT,
+  precedence INTEGER NOT NULL,
+  created_at BIGINT NOT NULL,
+  updated_at BIGINT NOT NULL
+);
+-- displayName is a caseExact=false attribute, so the uniqueness the provider
+-- sees and the index that enforces it have to fold case the same way.
+CREATE UNIQUE INDEX IF NOT EXISTS directory_scim_groups_display_name_idx
+  ON directory_scim_groups (tenant_id, lower(display_name));
+-- Role resolution walks the mapped groups of one user in precedence order.
+CREATE INDEX IF NOT EXISTS directory_scim_groups_precedence_idx
+  ON directory_scim_groups (tenant_id, precedence, id);
+ALTER TABLE directory_scim_groups ENABLE ROW LEVEL SECURITY;
+ALTER TABLE directory_scim_groups FORCE ROW LEVEL SECURITY;
+CREATE POLICY directory_scim_groups_tenant_policy ON directory_scim_groups
+  USING (tenant_id = current_setting('coreloom.tenant_id', true))
+  WITH CHECK (tenant_id = current_setting('coreloom.tenant_id', true));
+
+CREATE TABLE IF NOT EXISTS directory_scim_group_members (
+  tenant_id TEXT NOT NULL,
+  group_id TEXT NOT NULL REFERENCES directory_scim_groups(id) ON DELETE CASCADE,
+  user_id TEXT NOT NULL REFERENCES directory_scim_users(id) ON DELETE CASCADE,
+  added_at BIGINT NOT NULL,
+  PRIMARY KEY (tenant_id, group_id, user_id)
+);
+CREATE INDEX IF NOT EXISTS directory_scim_group_members_user_idx
+  ON directory_scim_group_members (tenant_id, user_id);
+ALTER TABLE directory_scim_group_members ENABLE ROW LEVEL SECURITY;
+ALTER TABLE directory_scim_group_members FORCE ROW LEVEL SECURITY;
+CREATE POLICY directory_scim_group_members_tenant_policy ON directory_scim_group_members
+  USING (tenant_id = current_setting('coreloom.tenant_id', true))
+  WITH CHECK (tenant_id = current_setting('coreloom.tenant_id', true));
+
+-- Evidence outlives the credential, so the token id is recorded without a
+-- foreign key: revoking or pruning a token never removes its trail.
+CREATE TABLE IF NOT EXISTS directory_provisioning_events (
+  id TEXT PRIMARY KEY,
+  -- Two operations of one request land in the same millisecond, so the order
+  -- the log is read in comes from storage rather than from the clock.
+  sequence BIGINT GENERATED BY DEFAULT AS IDENTITY,
+  tenant_id TEXT NOT NULL,
+  token_id TEXT NOT NULL,
+  operation TEXT NOT NULL CHECK (operation IN ('user-create', 'user-update', 'user-deactivate', 'user-reactivate', 'group-create', 'group-update', 'group-delete', 'membership-change')),
+  subject TEXT NOT NULL,
+  outcome TEXT NOT NULL CHECK (outcome IN ('applied', 'unchanged', 'refused')),
+  reason TEXT,
+  occurred_at BIGINT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS directory_provisioning_events_time_idx
+  ON directory_provisioning_events (tenant_id, occurred_at DESC, sequence DESC);
+ALTER TABLE directory_provisioning_events ENABLE ROW LEVEL SECURITY;
+ALTER TABLE directory_provisioning_events FORCE ROW LEVEL SECURITY;
+CREATE POLICY directory_provisioning_events_tenant_policy ON directory_provisioning_events
+  USING (tenant_id = current_setting('coreloom.tenant_id', true))
+  WITH CHECK (tenant_id = current_setting('coreloom.tenant_id', true));

package/modules/directory/migrations/README.md

@@ -0,0 +1,3 @@
+# Migrations
+
+Migrations in this directory are append-only after release.

package/modules/directory/module.json

@@ -0,0 +1,27 @@
+{
+	"$schema": "../../packages/contracts/schemas/module.schema.json",
+	"schemaVersion": 1,
+	"id": "directory.core",
+	"package": "@flowdular/module-directory",
+	"version": "0.1.9",
+	"platformApi": "^0.1.0",
+	"profile": "full",
+	"capabilities": ["api", "database", "client", "translations"],
+	"platform": {
+		"server": true,
+		"client": true
+	},
+	"dependencies": [
+		{
+			"id": "system.core",
+			"range": "^0.7.0"
+		},
+		{
+			"id": "auth.core",
+			"range": "^0.13.0"
+		}
+	],
+	"tenancy": "required",
+	"locales": ["en", "pl"],
+	"stability": "experimental"
+}

package/modules/directory/package.json

@@ -0,0 +1,46 @@
+{
+	"name": "@flowdular/module-directory",
+	"version": "0.1.9",
+	"private": true,
+	"type": "module",
+	"exports": {
+		".": "./src/index.ts",
+		"./client": "./src/client/index.ts",
+		"./server": "./src/server/index.ts",
+		"./platform": "./src/platform.ts",
+		"./module.json": "./module.json"
+	},
+	"files": [
+		"src",
+		"dist",
+		"module.json",
+		"migrations",
+		"translations",
+		"spec",
+		"README.md",
+		"LICENSE"
+	],
+	"scripts": {
+		"typecheck": "tsrx-tsc --noEmit -p tsconfig.json",
+		"test": "vitest run"
+	},
+	"dependencies": {
+		"@flowdular/client": "workspace:*",
+		"@flowdular/contracts": "workspace:*",
+		"@flowdular/database": "workspace:*",
+		"@flowdular/kernel": "workspace:*",
+		"@flowdular/module-auth": "workspace:*",
+		"@flowdular/server": "workspace:*",
+		"@flowdular/ui": "workspace:*",
+		"octane": "0.1.51",
+		"segment-state": "0.2.1"
+	},
+	"devDependencies": {
+		"@flowdular/database-testing": "workspace:*",
+		"@octanejs/app-core": "0.0.47",
+		"@tsrx/typescript-plugin": "0.3.120",
+		"@types/node": "24.13.3",
+		"typescript": "5.9.3",
+		"vitest": "4.1.11"
+	}
+}