@gorgo/medusa-integration 0.0.1

package/.medusa/server/src/modules/integration/services/crypto.js

@@ -0,0 +1,41 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deriveKey = deriveKey;
+exports.encryptValue = encryptValue;
+exports.decryptValue = decryptValue;
+const crypto_1 = __importDefault(require("crypto"));
+const ALGO = "aes-256-gcm";
+const TAG_LEN = 16;
+const IV_LEN = 12;
+/** Derive a 32-byte AES key from any non-empty passphrase (SHA-256). */
+function deriveKey(passphrase) {
+    return crypto_1.default.createHash("sha256").update(passphrase, "utf8").digest();
+}
+/**
+ * Encrypt one JSON-serializable value. Returns a single base64 string containing
+ * `iv ‖ authTag ‖ ciphertext` — the IV is random per call (required for GCM) and folded
+ * into the blob, so no separate IV field is stored.
+ */
+function encryptValue(value, key) {
+    const iv = crypto_1.default.randomBytes(IV_LEN);
+    const cipher = crypto_1.default.createCipheriv(ALGO, key, iv);
+    const plaintext = Buffer.from(JSON.stringify(value), "utf8");
+    const enc = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return Buffer.concat([iv, tag, enc]).toString("base64");
+}
+/** Inverse of {@link encryptValue}. Throws if the key is wrong or the blob was tampered. */
+function decryptValue(blob, key) {
+    const raw = Buffer.from(blob, "base64");
+    const iv = raw.subarray(0, IV_LEN);
+    const tag = raw.subarray(IV_LEN, IV_LEN + TAG_LEN);
+    const enc = raw.subarray(IV_LEN + TAG_LEN);
+    const decipher = crypto_1.default.createDecipheriv(ALGO, key, iv);
+    decipher.setAuthTag(tag);
+    const dec = Buffer.concat([decipher.update(enc), decipher.final()]);
+    return JSON.parse(dec.toString("utf8"));
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY3J5cHRvLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vLi4vLi4vc3JjL21vZHVsZXMvaW50ZWdyYXRpb24vc2VydmljZXMvY3J5cHRvLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7O0FBT0EsOEJBRUM7QUFPRCxvQ0FPQztBQUdELG9DQVNDO0FBbkNELG9EQUEyQjtBQUUzQixNQUFNLElBQUksR0FBRyxhQUFhLENBQUE7QUFDMUIsTUFBTSxPQUFPLEdBQUcsRUFBRSxDQUFBO0FBQ2xCLE1BQU0sTUFBTSxHQUFHLEVBQUUsQ0FBQTtBQUVqQix3RUFBd0U7QUFDeEUsU0FBZ0IsU0FBUyxDQUFDLFVBQWtCO0lBQzFDLE9BQU8sZ0JBQU0sQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxNQUFNLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQTtBQUN4RSxDQUFDO0FBRUQ7Ozs7R0FJRztBQUNILFNBQWdCLFlBQVksQ0FBQyxLQUFjLEVBQUUsR0FBVztJQUN0RCxNQUFNLEVBQUUsR0FBRyxnQkFBTSxDQUFDLFdBQVcsQ0FBQyxNQUFNLENBQUMsQ0FBQTtJQUNyQyxNQUFNLE1BQU0sR0FBRyxnQkFBTSxDQUFDLGNBQWMsQ0FBQyxJQUFJLEVBQUUsR0FBRyxFQUFFLEVBQUUsQ0FBQyxDQUFBO0lBQ25ELE1BQU0sU0FBUyxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsRUFBRSxNQUFNLENBQUMsQ0FBQTtJQUM1RCxNQUFNLEdBQUcsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsRUFBRSxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFBO0lBQ3JFLE1BQU0sR0FBRyxHQUFHLE1BQU0sQ0FBQyxVQUFVLEVBQUUsQ0FBQTtJQUMvQixPQUFPLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxFQUFFLEVBQUUsR0FBRyxFQUFFLEdBQUcsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxDQUFBO0FBQ3pELENBQUM7QUFFRCw0RkFBNEY7QUFDNUYsU0FBZ0IsWUFBWSxDQUFDLElBQVksRUFBRSxHQUFXO0lBQ3BELE1BQU0sR0FBRyxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLFFBQVEsQ0FBQyxDQUFBO0lBQ3ZDLE1BQU0sRUFBRSxHQUFHLEdBQUcsQ0FBQyxRQUFRLENBQUMsQ0FBQyxFQUFFLE1BQU0sQ0FBQyxDQUFBO0lBQ2xDLE1BQU0sR0FBRyxHQUFHLEdBQUcsQ0FBQyxRQUFRLENBQUMsTUFBTSxFQUFFLE1BQU0sR0FBRyxPQUFPLENBQUMsQ0FBQTtJQUNsRCxNQUFNLEdBQUcsR0FBRyxHQUFHLENBQUMsUUFBUSxDQUFDLE1BQU0sR0FBRyxPQUFPLENBQUMsQ0FBQTtJQUMxQyxNQUFNLFFBQVEsR0FBRyxnQkFBTSxDQUFDLGdCQUFnQixDQUFDLElBQUksRUFBRSxHQUFHLEVBQUUsRUFBRSxDQUFDLENBQUE7SUFDdkQsUUFBUSxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsQ0FBQTtJQUN4QixNQUFNLEdBQUcsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsRUFBRSxRQUFRLENBQUMsS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFBO0lBQ25FLE9BQU8sSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUE7QUFDekMsQ0FBQyJ9

package/.medusa/server/src/modules/integration/services/index.d.ts

@@ -0,0 +1,3 @@
+export { default as IntegrationModuleService } from "./integration-module";
+export { default as IntegrationProviderService } from "./integration-provider";
+export type { ResolvedOptions } from "./integration-module";

package/.medusa/server/src/modules/integration/services/index.js

@@ -0,0 +1,11 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IntegrationProviderService = exports.IntegrationModuleService = void 0;
+var integration_module_1 = require("./integration-module");
+Object.defineProperty(exports, "IntegrationModuleService", { enumerable: true, get: function () { return __importDefault(integration_module_1).default; } });
+var integration_provider_1 = require("./integration-provider");
+Object.defineProperty(exports, "IntegrationProviderService", { enumerable: true, get: function () { return __importDefault(integration_provider_1).default; } });
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi9zcmMvbW9kdWxlcy9pbnRlZ3JhdGlvbi9zZXJ2aWNlcy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7QUFBQSwyREFBMEU7QUFBakUsK0lBQUEsT0FBTyxPQUE0QjtBQUM1QywrREFBOEU7QUFBckUsbUpBQUEsT0FBTyxPQUE4QiJ9

package/.medusa/server/src/modules/integration/services/integration-module.d.ts

@@ -0,0 +1,113 @@
+import { Logger } from "@medusajs/framework/types";
+import IntegrationProviderService from "./integration-provider";
+import type { IntegrationDescriptor, TestConnectionResult } from "../descriptor/define";
+import { type UiDescriptor } from "../descriptor/introspect";
+import { INTEGRATION_OPTIONS_KEY, type IntegrationModuleOptions } from "../types";
+import type { IntegrationOverviewItem } from "../../../types";
+type InjectedDependencies = {
+    logger?: Logger;
+    integrationProviderService: IntegrationProviderService;
+    [INTEGRATION_OPTIONS_KEY]?: IntegrationModuleOptions;
+};
+export type ResolvedOptions = {
+    options: Record<string, unknown>;
+    meta: {
+        provider_id: string;
+        module: string | null;
+        is_enabled: boolean;
+    };
+};
+declare const IntegrationModuleService_base: import("@medusajs/framework/utils").MedusaServiceReturnType<import("@medusajs/framework/utils").ModelConfigurationsToConfigTemplate<{
+    readonly Integration: import("@medusajs/framework/utils").DmlEntity<import("@medusajs/framework/utils").DMLEntitySchemaBuilder<{
+        id: import("@medusajs/framework/utils").PrimaryKeyModifier<string, import("@medusajs/framework/utils").IdProperty>;
+        module: import("@medusajs/framework/utils").EnumProperty<["payment", "fulfillment", "marketplace", "crm", "erp", "pim", "notification", "feed", "tax", "other"]>;
+        provider_id: import("@medusajs/framework/utils").TextProperty;
+        title: import("@medusajs/framework/utils").NullableModifier<string, import("@medusajs/framework/utils").TextProperty>;
+        options: import("@medusajs/framework/utils").JSONProperty;
+        options_version: import("@medusajs/framework/utils").NumberProperty;
+        is_enabled: import("@medusajs/framework/utils").BooleanProperty;
+        last_test_at: import("@medusajs/framework/utils").NullableModifier<Date, import("@medusajs/framework/utils").DateTimeProperty>;
+        last_test_status: import("@medusajs/framework/utils").NullableModifier<"ok" | "fail" | "skipped", import("@medusajs/framework/utils").EnumProperty<["ok", "fail", "skipped"]>>;
+        last_test_message: import("@medusajs/framework/utils").NullableModifier<string, import("@medusajs/framework/utils").TextProperty>;
+    }>, "integration">;
+}>>;
+export default class IntegrationModuleService extends IntegrationModuleService_base {
+    protected providerService_: IntegrationProviderService;
+    protected options_: IntegrationModuleOptions;
+    protected cache_: Map<string, {
+        value: ResolvedOptions | null;
+        expiresAt: number;
+    }>;
+    protected key_?: Buffer;
+    constructor(deps: InjectedDependencies);
+    /** UI descriptors for every registration (one per instance). */
+    listUiDescriptors(): UiDescriptor[];
+    /** Stamped descriptor (schema + pluginId/instanceId) for one `provider_id`. */
+    getProviderDescriptor(providerId: string): IntegrationDescriptor | undefined;
+    /** UI descriptor for one `provider_id` (container key). */
+    getProviderUiDescriptor(providerId: string): UiDescriptor | undefined;
+    /** Whether a provider is registered under this `provider_id` (container key). */
+    hasProviderId(providerId: string): boolean;
+    /**
+     * The single stored row for a `provider_id` (it's unique), or `undefined`. One place for
+     * the "load the row for this provider" lookup shared by the service, steps and routes.
+     */
+    findByProviderId(providerId: string): Promise<{
+        id: string;
+        module: "payment" | "fulfillment" | "marketplace" | "crm" | "erp" | "pim" | "notification" | "feed" | "tax" | "other";
+        provider_id: string;
+        title: string | null;
+        options: Record<string, unknown>;
+        options_version: number;
+        is_enabled: boolean;
+        last_test_at: Date | null;
+        last_test_status: "ok" | "fail" | "skipped" | null;
+        last_test_message: string | null;
+        created_at: Date;
+        updated_at: Date;
+        deleted_at: Date | null;
+    }>;
+    /**
+     * Full decrypted config (non-secret options + decrypted secrets) for one `provider_id`,
+     * or `{}` if no row exists. Used at write time to merge submitted option values over the
+     * rest of the stored config without losing secrets the form never sends back.
+     */
+    getStoredValues(providerId: string): Promise<Record<string, unknown>>;
+    /**
+     * Whether a loaded row passes full validation against its provider's descriptor (all
+     * required options present + every option's `validate` and the cross-section `validate`).
+     * Derived on demand — never persisted — so it can't drift when the descriptor changes.
+     */
+    isComplete(record: any): boolean;
+    /** Decrypt inline secret keys within a loaded record's `options` → plaintext values. */
+    protected assembleValues(record: any): Record<string, unknown>;
+    /**
+     * Admin overview: every declared instance (registration) merged with its current row
+     * state. Lets the UI list configurable integrations before any row exists. No secrets.
+     */
+    listIntegrationsOverview(): Promise<IntegrationOverviewItem[]>;
+    /**
+     * Run the provider's connection test against the currently-resolved settings.
+     * Delegates to the integration-provider's `testConnection` (if it has one).
+     */
+    runTestConnection(providerId: string): Promise<TestConnectionResult>;
+    /** The configured passphrase (any non-empty string). Throws if missing. */
+    protected resolveKey(): string;
+    /** The derived 32-byte AES key, computed once from the passphrase. */
+    protected getKey(): Buffer;
+    /** Secret option ids declared by the provider for a `provider_id` (empty if none/unknown). */
+    getSecretKeys(providerId: string): string[];
+    /**
+     * Build the `options` object to persist: secret keys encrypted inline (base64 iv‖tag‖ct),
+     * non-secret keys as-is. Requires a configured key only when the descriptor has secrets.
+     */
+    encryptForStorage(descriptor: IntegrationDescriptor, values: Record<string, unknown>): Record<string, unknown>;
+    /** Clear the resolved-options cache for one `provider_id`, or all when omitted. */
+    clearOptionsCache(providerId?: string): void;
+    /**
+     * Resolve decrypted options for a `(pluginId, instanceId)` pair (the consumer-facing
+     * shape) — mapped internally to the `provider_id` key `int_<pluginId>[_<instanceId>]`.
+     */
+    getResolvedOptions(pluginId: string, instanceId?: string | null): Promise<ResolvedOptions | null>;
+}
+export {};

package/.medusa/server/src/modules/integration/services/integration-module.js

@@ -0,0 +1,219 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const utils_1 = require("@medusajs/framework/utils");
+const integration_1 = __importDefault(require("../models/integration"));
+const crypto_1 = require("./crypto");
+const secrets_1 = require("./secrets");
+const integration_provider_1 = __importDefault(require("./integration-provider"));
+const introspect_1 = require("../descriptor/introspect");
+const validate_1 = require("../descriptor/validate");
+const types_1 = require("../types");
+const CACHE_TTL_MS = 60_000;
+class IntegrationModuleService extends (0, utils_1.MedusaService)({
+    Integration: integration_1.default,
+}) {
+    constructor(deps) {
+        super(...arguments);
+        this.cache_ = new Map();
+        this.providerService_ = deps.integrationProviderService;
+        this.options_ = deps[types_1.INTEGRATION_OPTIONS_KEY] ?? {};
+    }
+    // ── descriptors (sourced from registered integration-providers) ──────────────
+    /** UI descriptors for every registration (one per instance). */
+    listUiDescriptors() {
+        return this.providerService_.listRegistrations().map((r) => (0, introspect_1.introspectDescriptor)({ ...r.provider.getDescriptor(), pluginId: r.pluginId, instanceId: r.instanceId }, typeof r.provider.testConnection === "function"));
+    }
+    /** Stamped descriptor (schema + pluginId/instanceId) for one `provider_id`. */
+    getProviderDescriptor(providerId) {
+        const r = this.providerService_.getRegistration(providerId);
+        if (!r)
+            return undefined;
+        return { ...r.provider.getDescriptor(), pluginId: r.pluginId, instanceId: r.instanceId };
+    }
+    /** UI descriptor for one `provider_id` (container key). */
+    getProviderUiDescriptor(providerId) {
+        const r = this.providerService_.getRegistration(providerId);
+        if (!r)
+            return undefined;
+        return (0, introspect_1.introspectDescriptor)({ ...r.provider.getDescriptor(), pluginId: r.pluginId, instanceId: r.instanceId }, typeof r.provider.testConnection === "function");
+    }
+    /** Whether a provider is registered under this `provider_id` (container key). */
+    hasProviderId(providerId) {
+        return !!this.providerService_.getRegistration(providerId);
+    }
+    /**
+     * The single stored row for a `provider_id` (it's unique), or `undefined`. One place for
+     * the "load the row for this provider" lookup shared by the service, steps and routes.
+     */
+    async findByProviderId(providerId) {
+        const [record] = await this.listIntegrations({ provider_id: providerId }, { take: 1 });
+        return record;
+    }
+    /**
+     * Full decrypted config (non-secret options + decrypted secrets) for one `provider_id`,
+     * or `{}` if no row exists. Used at write time to merge submitted option values over the
+     * rest of the stored config without losing secrets the form never sends back.
+     */
+    async getStoredValues(providerId) {
+        const record = await this.findByProviderId(providerId);
+        return record ? this.assembleValues(record) : {};
+    }
+    /**
+     * Whether a loaded row passes full validation against its provider's descriptor (all
+     * required options present + every option's `validate` and the cross-section `validate`).
+     * Derived on demand — never persisted — so it can't drift when the descriptor changes.
+     */
+    isComplete(record) {
+        const descriptor = this.getProviderDescriptor(record.provider_id);
+        if (!descriptor)
+            return false;
+        return (0, validate_1.isDescriptorComplete)(descriptor, this.assembleValues(record));
+    }
+    /** Decrypt inline secret keys within a loaded record's `options` → plaintext values. */
+    assembleValues(record) {
+        const options = (record.options ?? {});
+        const descriptor = this.getProviderDescriptor(record.provider_id);
+        const secretKeys = descriptor ? (0, introspect_1.secretFieldNames)(descriptor) : [];
+        if (secretKeys.length === 0)
+            return { ...options };
+        return (0, secrets_1.decryptSecretsInline)(options, secretKeys, this.getKey());
+    }
+    /**
+     * Admin overview: every declared instance (registration) merged with its current row
+     * state. Lets the UI list configurable integrations before any row exists. No secrets.
+     */
+    async listIntegrationsOverview() {
+        const regs = this.providerService_.listRegistrations();
+        const rows = await this.listIntegrations({}, { take: 1000 });
+        const byId = new Map(rows.map((r) => [r.provider_id, r]));
+        return regs.map((r) => {
+            const d = r.provider.getDescriptor();
+            const row = byId.get(r.key);
+            return {
+                provider_id: r.key,
+                plugin_id: r.pluginId,
+                instance_id: r.instanceId,
+                module: d.module,
+                display_name: d.displayName,
+                icon: d.icon,
+                supports_multiple_instances: d.supportsMultipleInstances ?? false,
+                has_test_connection: typeof r.provider.testConnection === "function",
+                is_configured: !!row,
+                is_enabled: row?.is_enabled ?? false,
+                is_complete: row ? this.isComplete(row) : false,
+                last_test_status: row?.last_test_status ?? null,
+                last_test_at: row?.last_test_at ?? null,
+            };
+        });
+    }
+    /**
+     * Run the provider's connection test against the currently-resolved settings.
+     * Delegates to the integration-provider's `testConnection` (if it has one).
+     */
+    async runTestConnection(providerId) {
+        let provider;
+        try {
+            provider = this.providerService_.retrieveByKey(providerId);
+        }
+        catch {
+            return { status: "fail", message: `Unknown integration provider "${providerId}"` };
+        }
+        if (!provider.testConnection) {
+            return { status: "skipped", message: "No test configured" };
+        }
+        const resolved = await this.getResolvedOptions(provider.getIdentifier(), provider.getInstanceId());
+        if (!resolved) {
+            return { status: "fail", message: "Not configured" };
+        }
+        try {
+            return await provider.testConnection({
+                options: resolved.options,
+            });
+        }
+        catch (e) {
+            return { status: "fail", message: e?.message ?? "Test failed" };
+        }
+    }
+    // ── encryption ───────────────────────────────────────────────────────────────
+    /** The configured passphrase (any non-empty string). Throws if missing. */
+    resolveKey() {
+        const key = this.options_.encryptionKey;
+        if (key && key.length > 0)
+            return key;
+        throw new Error("[integration] encryptionKey is required. Set GORGO_INTEGRATION_ENCRYPTION_KEY to any " +
+            "non-empty secret (high-entropy recommended, e.g. `openssl rand -hex 32`).");
+    }
+    /** The derived 32-byte AES key, computed once from the passphrase. */
+    getKey() {
+        return (this.key_ ??= (0, crypto_1.deriveKey)(this.resolveKey()));
+    }
+    /** Secret option ids declared by the provider for a `provider_id` (empty if none/unknown). */
+    getSecretKeys(providerId) {
+        const descriptor = this.getProviderDescriptor(providerId);
+        return descriptor ? (0, introspect_1.secretFieldNames)(descriptor) : [];
+    }
+    /**
+     * Build the `options` object to persist: secret keys encrypted inline (base64 iv‖tag‖ct),
+     * non-secret keys as-is. Requires a configured key only when the descriptor has secrets.
+     */
+    encryptForStorage(descriptor, values) {
+        const secretKeys = (0, introspect_1.secretFieldNames)(descriptor);
+        if (secretKeys.length === 0)
+            return { ...values };
+        return (0, secrets_1.encryptSecretsInline)(values, secretKeys, this.getKey());
+    }
+    // ── resolver (runtime read, cached) ──────────────────────────────────────────
+    /** Clear the resolved-options cache for one `provider_id`, or all when omitted. */
+    clearOptionsCache(providerId) {
+        if (!providerId) {
+            this.cache_.clear();
+            return;
+        }
+        this.cache_.delete(providerId);
+    }
+    /**
+     * Resolve decrypted options for a `(pluginId, instanceId)` pair (the consumer-facing
+     * shape) — mapped internally to the `provider_id` key `int_<pluginId>[_<instanceId>]`.
+     */
+    async getResolvedOptions(pluginId, instanceId) {
+        const providerId = integration_provider_1.default.key(pluginId, instanceId);
+        const hit = this.cache_.get(providerId);
+        if (hit && hit.expiresAt > Date.now())
+            return hit.value;
+        // The provider_id must correspond to a declared registration. A miss here is a
+        // misconfiguration (forgot to register / wrong id), distinct from "registered but
+        // not configured yet" (handled below by returning null).
+        if (!this.hasProviderId(providerId)) {
+            throw new Error(`No integration provider registered for "${providerId}". ` +
+                `Declare it in medusa-config under the integration plugin's options.providers.`);
+        }
+        const record = await this.findByProviderId(providerId);
+        let value = null;
+        // An incomplete config is invisible to consumers (treated like "not configured"), so a
+        // partially-filled draft can never leak into a provider mid-setup. Completeness is the
+        // full validation: every option + the descriptor's cross-section `validate`.
+        if (record && record.is_enabled) {
+            const descriptor = this.getProviderDescriptor(providerId);
+            const assembled = this.assembleValues(record);
+            if ((0, validate_1.isDescriptorComplete)(descriptor, assembled)) {
+                // Apply option defaults for fields the user never set explicitly.
+                const parsed = descriptor.optionsSchema.safeParse(assembled);
+                value = {
+                    options: parsed.success ? parsed.data : assembled,
+                    meta: {
+                        provider_id: record.provider_id,
+                        module: record.module ?? null,
+                        is_enabled: record.is_enabled,
+                    },
+                };
+            }
+        }
+        this.cache_.set(providerId, { value, expiresAt: Date.now() + CACHE_TTL_MS });
+        return value;
+    }
+}
+exports.default = IntegrationModuleService;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW50ZWdyYXRpb24tbW9kdWxlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vLi4vLi4vc3JjL21vZHVsZXMvaW50ZWdyYXRpb24vc2VydmljZXMvaW50ZWdyYXRpb24tbW9kdWxlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7O0FBQUEscURBQXlEO0FBRXpELHdFQUErQztBQUMvQyxxQ0FBb0M7QUFDcEMsdUNBQXNFO0FBQ3RFLGtGQUErRDtBQUUvRCx5REFBb0c7QUFDcEcscURBQTZEO0FBQzdELG9DQUFpRjtBQWNqRixNQUFNLFlBQVksR0FBRyxNQUFNLENBQUE7QUFFM0IsTUFBcUIsd0JBQXlCLFNBQVEsSUFBQSxxQkFBYSxFQUFDO0lBQ2xFLFdBQVcsRUFBWCxxQkFBVztDQUNaLENBQUM7SUFNQSxZQUFZLElBQTBCO1FBQ3BDLEtBQUssQ0FBQyxHQUFHLFNBQVMsQ0FBQyxDQUFBO1FBSlgsV0FBTSxHQUFHLElBQUksR0FBRyxFQUFnRSxDQUFBO1FBS3hGLElBQUksQ0FBQyxnQkFBZ0IsR0FBRyxJQUFJLENBQUMsMEJBQTBCLENBQUE7UUFDdkQsSUFBSSxDQUFDLFFBQVEsR0FBRyxJQUFJLENBQUMsK0JBQXVCLENBQUMsSUFBSSxFQUFFLENBQUE7SUFDckQsQ0FBQztJQUVELGdGQUFnRjtJQUNoRixnRUFBZ0U7SUFDaEUsaUJBQWlCO1FBQ2YsT0FBTyxJQUFJLENBQUMsZ0JBQWdCLENBQUMsaUJBQWlCLEVBQUUsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUN6RCxJQUFBLGlDQUFvQixFQUNsQixFQUFFLEdBQUcsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxhQUFhLEVBQUUsRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDLFFBQVEsRUFBRSxVQUFVLEVBQUUsQ0FBQyxDQUFDLFVBQVUsRUFBRSxFQUNqRixPQUFPLENBQUMsQ0FBQyxRQUFRLENBQUMsY0FBYyxLQUFLLFVBQVUsQ0FDaEQsQ0FDRixDQUFBO0lBQ0gsQ0FBQztJQUVELCtFQUErRTtJQUMvRSxxQkFBcUIsQ0FBQyxVQUFrQjtRQUN0QyxNQUFNLENBQUMsR0FBRyxJQUFJLENBQUMsZ0JBQWdCLENBQUMsZUFBZSxDQUFDLFVBQVUsQ0FBQyxDQUFBO1FBQzNELElBQUksQ0FBQyxDQUFDO1lBQUUsT0FBTyxTQUFTLENBQUE7UUFDeEIsT0FBTyxFQUFFLEdBQUcsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxhQUFhLEVBQUUsRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDLFFBQVEsRUFBRSxVQUFVLEVBQUUsQ0FBQyxDQUFDLFVBQVUsRUFBRSxDQUFBO0lBQzFGLENBQUM7SUFFRCwyREFBMkQ7SUFDM0QsdUJBQXVCLENBQUMsVUFBa0I7UUFDeEMsTUFBTSxDQUFDLEdBQUcsSUFBSSxDQUFDLGdCQUFnQixDQUFDLGVBQWUsQ0FBQyxVQUFVLENBQUMsQ0FBQTtRQUMzRCxJQUFJLENBQUMsQ0FBQztZQUFFLE9BQU8sU0FBUyxDQUFBO1FBQ3hCLE9BQU8sSUFBQSxpQ0FBb0IsRUFDekIsRUFBRSxHQUFHLENBQUMsQ0FBQyxRQUFRLENBQUMsYUFBYSxFQUFFLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQyxRQUFRLEVBQUUsVUFBVSxFQUFFLENBQUMsQ0FBQyxVQUFVLEVBQUUsRUFDakYsT0FBTyxDQUFDLENBQUMsUUFBUSxDQUFDLGNBQWMsS0FBSyxVQUFVLENBQ2hELENBQUE7SUFDSCxDQUFDO0lBRUQsaUZBQWlGO0lBQ2pGLGFBQWEsQ0FBQyxVQUFrQjtRQUM5QixPQUFPLENBQUMsQ0FBQyxJQUFJLENBQUMsZ0JBQWdCLENBQUMsZUFBZSxDQUFDLFVBQVUsQ0FBQyxDQUFBO0lBQzVELENBQUM7SUFFRDs7O09BR0c7SUFDSCxLQUFLLENBQUMsZ0JBQWdCLENBQUMsVUFBa0I7UUFDdkMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxHQUFHLE1BQU0sSUFBSSxDQUFDLGdCQUFnQixDQUFDLEVBQUUsV0FBVyxFQUFFLFVBQVUsRUFBRSxFQUFFLEVBQUUsSUFBSSxFQUFFLENBQUMsRUFBRSxDQUFDLENBQUE7UUFDdEYsT0FBTyxNQUFNLENBQUE7SUFDZixDQUFDO0lBRUQ7Ozs7T0FJRztJQUNILEtBQUssQ0FBQyxlQUFlLENBQUMsVUFBa0I7UUFDdEMsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsZ0JBQWdCLENBQUMsVUFBVSxDQUFDLENBQUE7UUFDdEQsT0FBTyxNQUFNLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxjQUFjLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQTtJQUNsRCxDQUFDO0lBRUQ7Ozs7T0FJRztJQUNILFVBQVUsQ0FBQyxNQUFXO1FBQ3BCLE1BQU0sVUFBVSxHQUFHLElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLENBQUE7UUFDakUsSUFBSSxDQUFDLFVBQVU7WUFBRSxPQUFPLEtBQUssQ0FBQTtRQUM3QixPQUFPLElBQUEsK0JBQW9CLEVBQUMsVUFBVSxFQUFFLElBQUksQ0FBQyxjQUFjLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQTtJQUN0RSxDQUFDO0lBRUQsd0ZBQXdGO0lBQzlFLGNBQWMsQ0FBQyxNQUFXO1FBQ2xDLE1BQU0sT0FBTyxHQUFHLENBQUUsTUFBTSxDQUFDLE9BQW1DLElBQUksRUFBRSxDQUFDLENBQUE7UUFDbkUsTUFBTSxVQUFVLEdBQUcsSUFBSSxDQUFDLHFCQUFxQixDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsQ0FBQTtRQUNqRSxNQUFNLFVBQVUsR0FBRyxVQUFVLENBQUMsQ0FBQyxDQUFDLElBQUEsNkJBQWdCLEVBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQTtRQUNqRSxJQUFJLFVBQVUsQ0FBQyxNQUFNLEtBQUssQ0FBQztZQUFFLE9BQU8sRUFBRSxHQUFHLE9BQU8sRUFBRSxDQUFBO1FBQ2xELE9BQU8sSUFBQSw4QkFBb0IsRUFBQyxPQUFPLEVBQUUsVUFBVSxFQUFFLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFBO0lBQ2pFLENBQUM7SUFFRDs7O09BR0c7SUFDSCxLQUFLLENBQUMsd0JBQXdCO1FBQzVCLE1BQU0sSUFBSSxHQUFHLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxpQkFBaUIsRUFBRSxDQUFBO1FBQ3RELE1BQU0sSUFBSSxHQUFHLE1BQU0sSUFBSSxDQUFDLGdCQUFnQixDQUFDLEVBQUUsRUFBRSxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFBO1FBQzVELE1BQU0sSUFBSSxHQUFHLElBQUksR0FBRyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFNLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLFdBQVcsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUE7UUFDOUQsT0FBTyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUU7WUFDcEIsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxhQUFhLEVBQUUsQ0FBQTtZQUNwQyxNQUFNLEdBQUcsR0FBUSxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQTtZQUNoQyxPQUFPO2dCQUNMLFdBQVcsRUFBRSxDQUFDLENBQUMsR0FBRztnQkFDbEIsU0FBUyxFQUFFLENBQUMsQ0FBQyxRQUFRO2dCQUNyQixXQUFXLEVBQUUsQ0FBQyxDQUFDLFVBQVU7Z0JBQ3pCLE1BQU0sRUFBRSxDQUFDLENBQUMsTUFBTTtnQkFDaEIsWUFBWSxFQUFFLENBQUMsQ0FBQyxXQUFXO2dCQUMzQixJQUFJLEVBQUUsQ0FBQyxDQUFDLElBQUk7Z0JBQ1osMkJBQTJCLEVBQUUsQ0FBQyxDQUFDLHlCQUF5QixJQUFJLEtBQUs7Z0JBQ2pFLG1CQUFtQixFQUFFLE9BQU8sQ0FBQyxDQUFDLFFBQVEsQ0FBQyxjQUFjLEtBQUssVUFBVTtnQkFDcEUsYUFBYSxFQUFFLENBQUMsQ0FBQyxHQUFHO2dCQUNwQixVQUFVLEVBQUUsR0FBRyxFQUFFLFVBQVUsSUFBSSxLQUFLO2dCQUNwQyxXQUFXLEVBQUUsR0FBRyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxLQUFLO2dCQUMvQyxnQkFBZ0IsRUFBRSxHQUFHLEVBQUUsZ0JBQWdCLElBQUksSUFBSTtnQkFDL0MsWUFBWSxFQUFFLEdBQUcsRUFBRSxZQUFZLElBQUksSUFBSTthQUN4QyxDQUFBO1FBQ0gsQ0FBQyxDQUFDLENBQUE7SUFDSixDQUFDO0lBRUQ7OztPQUdHO0lBQ0gsS0FBSyxDQUFDLGlCQUFpQixDQUFDLFVBQWtCO1FBQ3hDLElBQUksUUFBUSxDQUFBO1FBQ1osSUFBSSxDQUFDO1lBQ0gsUUFBUSxHQUFHLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxhQUFhLENBQUMsVUFBVSxDQUFDLENBQUE7UUFDNUQsQ0FBQztRQUFDLE1BQU0sQ0FBQztZQUNQLE9BQU8sRUFBRSxNQUFNLEVBQUUsTUFBTSxFQUFFLE9BQU8sRUFBRSxpQ0FBaUMsVUFBVSxHQUFHLEVBQUUsQ0FBQTtRQUNwRixDQUFDO1FBQ0QsSUFBSSxDQUFDLFFBQVEsQ0FBQyxjQUFjLEVBQUUsQ0FBQztZQUM3QixPQUFPLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxPQUFPLEVBQUUsb0JBQW9CLEVBQUUsQ0FBQTtRQUM3RCxDQUFDO1FBQ0QsTUFBTSxRQUFRLEdBQUcsTUFBTSxJQUFJLENBQUMsa0JBQWtCLENBQUMsUUFBUSxDQUFDLGFBQWEsRUFBRSxFQUFFLFFBQVEsQ0FBQyxhQUFhLEVBQUUsQ0FBQyxDQUFBO1FBQ2xHLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUNkLE9BQU8sRUFBRSxNQUFNLEVBQUUsTUFBTSxFQUFFLE9BQU8sRUFBRSxnQkFBZ0IsRUFBRSxDQUFBO1FBQ3RELENBQUM7UUFDRCxJQUFJLENBQUM7WUFDSCxPQUFPLE1BQU0sUUFBUSxDQUFDLGNBQWMsQ0FBQztnQkFDbkMsT0FBTyxFQUFFLFFBQVEsQ0FBQyxPQUFPO2FBQzFCLENBQUMsQ0FBQTtRQUNKLENBQUM7UUFBQyxPQUFPLENBQU0sRUFBRSxDQUFDO1lBQ2hCLE9BQU8sRUFBRSxNQUFNLEVBQUUsTUFBTSxFQUFFLE9BQU8sRUFBRSxDQUFDLEVBQUUsT0FBTyxJQUFJLGFBQWEsRUFBRSxDQUFBO1FBQ2pFLENBQUM7SUFDSCxDQUFDO0lBRUQsZ0ZBQWdGO0lBQ2hGLDJFQUEyRTtJQUNqRSxVQUFVO1FBQ2xCLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxRQUFRLENBQUMsYUFBYSxDQUFBO1FBQ3ZDLElBQUksR0FBRyxJQUFJLEdBQUcsQ0FBQyxNQUFNLEdBQUcsQ0FBQztZQUFFLE9BQU8sR0FBRyxDQUFBO1FBQ3JDLE1BQU0sSUFBSSxLQUFLLENBQ2IsdUZBQXVGO1lBQ3JGLDJFQUEyRSxDQUM5RSxDQUFBO0lBQ0gsQ0FBQztJQUVELHNFQUFzRTtJQUM1RCxNQUFNO1FBQ2QsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLEtBQUssSUFBQSxrQkFBUyxFQUFDLElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQyxDQUFDLENBQUE7SUFDckQsQ0FBQztJQUVELDhGQUE4RjtJQUM5RixhQUFhLENBQUMsVUFBa0I7UUFDOUIsTUFBTSxVQUFVLEdBQUcsSUFBSSxDQUFDLHFCQUFxQixDQUFDLFVBQVUsQ0FBQyxDQUFBO1FBQ3pELE9BQU8sVUFBVSxDQUFDLENBQUMsQ0FBQyxJQUFBLDZCQUFnQixFQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUE7SUFDdkQsQ0FBQztJQUVEOzs7T0FHRztJQUNILGlCQUFpQixDQUNmLFVBQWlDLEVBQ2pDLE1BQStCO1FBRS9CLE1BQU0sVUFBVSxHQUFHLElBQUEsNkJBQWdCLEVBQUMsVUFBVSxDQUFDLENBQUE7UUFDL0MsSUFBSSxVQUFVLENBQUMsTUFBTSxLQUFLLENBQUM7WUFBRSxPQUFPLEVBQUUsR0FBRyxNQUFNLEVBQUUsQ0FBQTtRQUNqRCxPQUFPLElBQUEsOEJBQW9CLEVBQUMsTUFBTSxFQUFFLFVBQVUsRUFBRSxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQTtJQUNoRSxDQUFDO0lBRUQsZ0ZBQWdGO0lBQ2hGLG1GQUFtRjtJQUNuRixpQkFBaUIsQ0FBQyxVQUFtQjtRQUNuQyxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUM7WUFDaEIsSUFBSSxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsQ0FBQTtZQUNuQixPQUFNO1FBQ1IsQ0FBQztRQUNELElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxDQUFBO0lBQ2hDLENBQUM7SUFFRDs7O09BR0c7SUFDSCxLQUFLLENBQUMsa0JBQWtCLENBQ3RCLFFBQWdCLEVBQ2hCLFVBQTBCO1FBRTFCLE1BQU0sVUFBVSxHQUFHLDhCQUEwQixDQUFDLEdBQUcsQ0FBQyxRQUFRLEVBQUUsVUFBVSxDQUFDLENBQUE7UUFDdkUsTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLENBQUE7UUFDdkMsSUFBSSxHQUFHLElBQUksR0FBRyxDQUFDLFNBQVMsR0FBRyxJQUFJLENBQUMsR0FBRyxFQUFFO1lBQUUsT0FBTyxHQUFHLENBQUMsS0FBSyxDQUFBO1FBRXZELCtFQUErRTtRQUMvRSxrRkFBa0Y7UUFDbEYseURBQXlEO1FBQ3pELElBQUksQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7WUFDcEMsTUFBTSxJQUFJLEtBQUssQ0FDYiwyQ0FBMkMsVUFBVSxLQUFLO2dCQUN4RCwrRUFBK0UsQ0FDbEYsQ0FBQTtRQUNILENBQUM7UUFFRCxNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxVQUFVLENBQUMsQ0FBQTtRQUV0RCxJQUFJLEtBQUssR0FBMkIsSUFBSSxDQUFBO1FBQ3hDLHVGQUF1RjtRQUN2Rix1RkFBdUY7UUFDdkYsNkVBQTZFO1FBQzdFLElBQUksTUFBTSxJQUFJLE1BQU0sQ0FBQyxVQUFVLEVBQUUsQ0FBQztZQUNoQyxNQUFNLFVBQVUsR0FBRyxJQUFJLENBQUMscUJBQXFCLENBQUMsVUFBVSxDQUFFLENBQUE7WUFDMUQsTUFBTSxTQUFTLEdBQUcsSUFBSSxDQUFDLGNBQWMsQ0FBQyxNQUFNLENBQUMsQ0FBQTtZQUM3QyxJQUFJLElBQUEsK0JBQW9CLEVBQUMsVUFBVSxFQUFFLFNBQVMsQ0FBQyxFQUFFLENBQUM7Z0JBQ2hELGtFQUFrRTtnQkFDbEUsTUFBTSxNQUFNLEdBQUcsVUFBVSxDQUFDLGFBQWEsQ0FBQyxTQUFTLENBQUMsU0FBUyxDQUFDLENBQUE7Z0JBQzVELEtBQUssR0FBRztvQkFDTixPQUFPLEVBQUUsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUUsTUFBTSxDQUFDLElBQWdDLENBQUMsQ0FBQyxDQUFDLFNBQVM7b0JBQzlFLElBQUksRUFBRTt3QkFDSixXQUFXLEVBQUUsTUFBTSxDQUFDLFdBQVc7d0JBQy9CLE1BQU0sRUFBRSxNQUFNLENBQUMsTUFBTSxJQUFJLElBQUk7d0JBQzdCLFVBQVUsRUFBRSxNQUFNLENBQUMsVUFBVTtxQkFDOUI7aUJBQ0YsQ0FBQTtZQUNILENBQUM7UUFDSCxDQUFDO1FBQ0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsVUFBVSxFQUFFLEVBQUUsS0FBSyxFQUFFLFNBQVMsRUFBRSxJQUFJLENBQUMsR0FBRyxFQUFFLEdBQUcsWUFBWSxFQUFFLENBQUMsQ0FBQTtRQUM1RSxPQUFPLEtBQUssQ0FBQTtJQUNkLENBQUM7Q0FDRjtBQTFPRCwyQ0EwT0MifQ==

package/.medusa/server/src/modules/integration/services/integration-provider.d.ts

@@ -0,0 +1,49 @@
+import { IntegrationProviderRegistrationPrefix } from "../types";
+import type { AbstractIntegrationProvider } from "../utils/abstract-integration-provider";
+import type { IntegrationDescriptor } from "../descriptor/define";
+type InjectedDependencies = {
+    [key: `${typeof IntegrationProviderRegistrationPrefix}${string}`]: AbstractIntegrationProvider;
+};
+/** A single registered provider = one integration *instance*. */
+export type ProviderRegistration = {
+    /** Container key `int_<identifier>[_<id>]` — the instance's stable identity. */
+    key: string;
+    pluginId: string;
+    instanceId: string | null;
+    provider: AbstractIntegrationProvider;
+};
+/**
+ * Thin registry over the integration-providers registered into the module container by
+ * `loadProviders`. Each registration in `options.providers` is one instance, identified
+ * by its container key `int_<identifier>[_<id>]` — which is also the DB `provider_id`.
+ * Instances are declared in medusa-config, not created at runtime. `pluginId`/`instanceId`
+ * (= `getIdentifier()`/`getInstanceId()`) are derived for descriptors/UI.
+ *
+ * Intentionally minimal: it locates providers; callers invoke provider methods directly,
+ * so new provider methods never require changes here.
+ */
+export default class IntegrationProviderService {
+    protected dependencies_: InjectedDependencies;
+    constructor(container: InjectedDependencies);
+    /** Build the container key for a `(pluginId, instanceId)` pair. */
+    static key(pluginId: string, instanceId?: string | null): string;
+    /** All registered provider instances. */
+    listProviders(): AbstractIntegrationProvider[];
+    /** Every registration with its derived `(pluginId, instanceId)` identity. */
+    listRegistrations(): ProviderRegistration[];
+    /** Resolve a provider by its exact container key. */
+    retrieveByKey(key: string): AbstractIntegrationProvider;
+    /** Resolve the provider for a `(pluginId, instanceId)` pair. */
+    retrieveProvider(pluginId: string, instanceId?: string | null): AbstractIntegrationProvider;
+    /** Whether a provider is registered for this `(pluginId, instanceId)` pair. */
+    hasProvider(pluginId: string, instanceId?: string | null): boolean;
+    /** Resolve `(pluginId, instanceId)` from a container key, or undefined if unregistered. */
+    getRegistration(key: string): ProviderRegistration | undefined;
+    /**
+     * Descriptors of every registered provider — feeds the introspection/UI pipeline.
+     * `pluginId`/`instanceId` are stamped from each registration, so authors never repeat
+     * them in the descriptor. One descriptor per registration (one per instance).
+     */
+    listDescriptors(): IntegrationDescriptor[];
+}
+export {};

package/.medusa/server/src/modules/integration/services/integration-provider.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const types_1 = require("../types");
+/**
+ * Thin registry over the integration-providers registered into the module container by
+ * `loadProviders`. Each registration in `options.providers` is one instance, identified
+ * by its container key `int_<identifier>[_<id>]` — which is also the DB `provider_id`.
+ * Instances are declared in medusa-config, not created at runtime. `pluginId`/`instanceId`
+ * (= `getIdentifier()`/`getInstanceId()`) are derived for descriptors/UI.
+ *
+ * Intentionally minimal: it locates providers; callers invoke provider methods directly,
+ * so new provider methods never require changes here.
+ */
+class IntegrationProviderService {
+    constructor(container) {
+        this.dependencies_ = container;
+    }
+    /** Build the container key for a `(pluginId, instanceId)` pair. */
+    static key(pluginId, instanceId) {
+        return `${types_1.IntegrationProviderRegistrationPrefix}${pluginId}${instanceId ? `_${instanceId}` : ""}`;
+    }
+    /** All registered provider instances. */
+    listProviders() {
+        return Object.keys(this.dependencies_)
+            .filter((k) => k.startsWith(types_1.IntegrationProviderRegistrationPrefix))
+            .map((k) => this.dependencies_[k]);
+    }
+    /** Every registration with its derived `(pluginId, instanceId)` identity. */
+    listRegistrations() {
+        return Object.keys(this.dependencies_)
+            .filter((k) => k.startsWith(types_1.IntegrationProviderRegistrationPrefix))
+            .map((k) => {
+            const provider = this.dependencies_[k];
+            return {
+                key: k,
+                pluginId: provider.getIdentifier(),
+                instanceId: provider.getInstanceId(),
+                provider,
+            };
+        });
+    }
+    /** Resolve a provider by its exact container key. */
+    retrieveByKey(key) {
+        const provider = this.dependencies_[key];
+        if (!provider) {
+            throw new Error(`Unable to retrieve integration provider "${key}". Make sure it is registered in medusa-config under the integration plugin's \`options.providers\`.`);
+        }
+        return provider;
+    }
+    /** Resolve the provider for a `(pluginId, instanceId)` pair. */
+    retrieveProvider(pluginId, instanceId) {
+        return this.retrieveByKey(IntegrationProviderService.key(pluginId, instanceId));
+    }
+    /** Whether a provider is registered for this `(pluginId, instanceId)` pair. */
+    hasProvider(pluginId, instanceId) {
+        return !!this.dependencies_[IntegrationProviderService.key(pluginId, instanceId)];
+    }
+    /** Resolve `(pluginId, instanceId)` from a container key, or undefined if unregistered. */
+    getRegistration(key) {
+        return this.listRegistrations().find((r) => r.key === key);
+    }
+    /**
+     * Descriptors of every registered provider — feeds the introspection/UI pipeline.
+     * `pluginId`/`instanceId` are stamped from each registration, so authors never repeat
+     * them in the descriptor. One descriptor per registration (one per instance).
+     */
+    listDescriptors() {
+        return this.listRegistrations().map((r) => ({
+            ...r.provider.getDescriptor(),
+            pluginId: r.pluginId,
+            instanceId: r.instanceId,
+        }));
+    }
+}
+exports.default = IntegrationProviderService;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW50ZWdyYXRpb24tcHJvdmlkZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi9zcmMvbW9kdWxlcy9pbnRlZ3JhdGlvbi9zZXJ2aWNlcy9pbnRlZ3JhdGlvbi1wcm92aWRlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztBQUFBLG9DQUFnRTtBQWlCaEU7Ozs7Ozs7OztHQVNHO0FBQ0gsTUFBcUIsMEJBQTBCO0lBRzdDLFlBQVksU0FBK0I7UUFDekMsSUFBSSxDQUFDLGFBQWEsR0FBRyxTQUFTLENBQUE7SUFDaEMsQ0FBQztJQUVELG1FQUFtRTtJQUNuRSxNQUFNLENBQUMsR0FBRyxDQUFDLFFBQWdCLEVBQUUsVUFBMEI7UUFDckQsT0FBTyxHQUFHLDZDQUFxQyxHQUFHLFFBQVEsR0FBRyxVQUFVLENBQUMsQ0FBQyxDQUFDLElBQUksVUFBVSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFBO0lBQ25HLENBQUM7SUFFRCx5Q0FBeUM7SUFDekMsYUFBYTtRQUNYLE9BQU8sTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDO2FBQ25DLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLFVBQVUsQ0FBQyw2Q0FBcUMsQ0FBQyxDQUFDO2FBQ2xFLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxDQUErQixDQUFDLENBQUMsQ0FBQTtJQUNwRSxDQUFDO0lBRUQsNkVBQTZFO0lBQzdFLGlCQUFpQjtRQUNmLE9BQU8sTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDO2FBQ25DLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLFVBQVUsQ0FBQyw2Q0FBcUMsQ0FBQyxDQUFDO2FBQ2xFLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFO1lBQ1QsTUFBTSxRQUFRLEdBQUcsSUFBSSxDQUFDLGFBQWEsQ0FBQyxDQUErQixDQUFDLENBQUE7WUFDcEUsT0FBTztnQkFDTCxHQUFHLEVBQUUsQ0FBQztnQkFDTixRQUFRLEVBQUUsUUFBUSxDQUFDLGFBQWEsRUFBRTtnQkFDbEMsVUFBVSxFQUFFLFFBQVEsQ0FBQyxhQUFhLEVBQUU7Z0JBQ3BDLFFBQVE7YUFDVCxDQUFBO1FBQ0gsQ0FBQyxDQUFDLENBQUE7SUFDTixDQUFDO0lBRUQscURBQXFEO0lBQ3JELGFBQWEsQ0FBQyxHQUFXO1FBQ3ZCLE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxhQUFhLENBQUMsR0FBaUMsQ0FBQyxDQUFBO1FBQ3RFLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUNkLE1BQU0sSUFBSSxLQUFLLENBQ2IsNENBQTRDLEdBQUcsc0dBQXNHLENBQ3RKLENBQUE7UUFDSCxDQUFDO1FBQ0QsT0FBTyxRQUFRLENBQUE7SUFDakIsQ0FBQztJQUVELGdFQUFnRTtJQUNoRSxnQkFBZ0IsQ0FBQyxRQUFnQixFQUFFLFVBQTBCO1FBQzNELE9BQU8sSUFBSSxDQUFDLGFBQWEsQ0FBQywwQkFBMEIsQ0FBQyxHQUFHLENBQUMsUUFBUSxFQUFFLFVBQVUsQ0FBQyxDQUFDLENBQUE7SUFDakYsQ0FBQztJQUVELCtFQUErRTtJQUMvRSxXQUFXLENBQUMsUUFBZ0IsRUFBRSxVQUEwQjtRQUN0RCxPQUFPLENBQUMsQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUN6QiwwQkFBMEIsQ0FBQyxHQUFHLENBQUMsUUFBUSxFQUFFLFVBQVUsQ0FBK0IsQ0FDbkYsQ0FBQTtJQUNILENBQUM7SUFFRCwyRkFBMkY7SUFDM0YsZUFBZSxDQUFDLEdBQVc7UUFDekIsT0FBTyxJQUFJLENBQUMsaUJBQWlCLEVBQUUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxHQUFHLEtBQUssR0FBRyxDQUFDLENBQUE7SUFDNUQsQ0FBQztJQUVEOzs7O09BSUc7SUFDSCxlQUFlO1FBQ2IsT0FBTyxJQUFJLENBQUMsaUJBQWlCLEVBQUUsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUM7WUFDMUMsR0FBRyxDQUFDLENBQUMsUUFBUSxDQUFDLGFBQWEsRUFBRTtZQUM3QixRQUFRLEVBQUUsQ0FBQyxDQUFDLFFBQVE7WUFDcEIsVUFBVSxFQUFFLENBQUMsQ0FBQyxVQUFVO1NBQ3pCLENBQUMsQ0FBQyxDQUFBO0lBQ0wsQ0FBQztDQUNGO0FBMUVELDZDQTBFQyJ9

package/.medusa/server/src/modules/integration/services/secrets.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Return a copy of `values` where each secret key (per the descriptor's `secret` flags)
+ * holds a `base64(iv‖tag‖ct)` string; non-secret keys pass through unchanged. Empty/absent
+ * secret values are left as-is (nothing to encrypt).
+ */
+export declare function encryptSecretsInline(values: Record<string, unknown>, secretKeys: Iterable<string>, key: Buffer): Record<string, unknown>;
+/**
+ * Inverse of {@link encryptSecretsInline}: decrypt each secret key holding a non-empty
+ * string blob back to its plaintext value; everything else passes through unchanged.
+ */
+export declare function decryptSecretsInline(options: Record<string, unknown>, secretKeys: Iterable<string>, key: Buffer): Record<string, unknown>;

package/.medusa/server/src/modules/integration/services/secrets.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.encryptSecretsInline = encryptSecretsInline;
+exports.decryptSecretsInline = decryptSecretsInline;
+const crypto_1 = require("./crypto");
+/**
+ * Return a copy of `values` where each secret key (per the descriptor's `secret` flags)
+ * holds a `base64(iv‖tag‖ct)` string; non-secret keys pass through unchanged. Empty/absent
+ * secret values are left as-is (nothing to encrypt).
+ */
+function encryptSecretsInline(values, secretKeys, key) {
+    const secret = new Set(secretKeys);
+    const out = {};
+    for (const [k, v] of Object.entries(values)) {
+        out[k] = secret.has(k) && v != null && v !== "" ? (0, crypto_1.encryptValue)(v, key) : v;
+    }
+    return out;
+}
+/**
+ * Inverse of {@link encryptSecretsInline}: decrypt each secret key holding a non-empty
+ * string blob back to its plaintext value; everything else passes through unchanged.
+ */
+function decryptSecretsInline(options, secretKeys, key) {
+    const secret = new Set(secretKeys);
+    const out = {};
+    for (const [k, v] of Object.entries(options)) {
+        out[k] = secret.has(k) && typeof v === "string" && v !== "" ? (0, crypto_1.decryptValue)(v, key) : v;
+    }
+    return out;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VjcmV0cy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uLy4uLy4uL3NyYy9tb2R1bGVzL2ludGVncmF0aW9uL3NlcnZpY2VzL3NlY3JldHMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFPQSxvREFXQztBQU1ELG9EQVdDO0FBbkNELHFDQUFxRDtBQUVyRDs7OztHQUlHO0FBQ0gsU0FBZ0Isb0JBQW9CLENBQ2xDLE1BQStCLEVBQy9CLFVBQTRCLEVBQzVCLEdBQVc7SUFFWCxNQUFNLE1BQU0sR0FBRyxJQUFJLEdBQUcsQ0FBQyxVQUFVLENBQUMsQ0FBQTtJQUNsQyxNQUFNLEdBQUcsR0FBNEIsRUFBRSxDQUFBO0lBQ3ZDLEtBQUssTUFBTSxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsSUFBSSxNQUFNLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDNUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxHQUFHLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxJQUFJLElBQUksSUFBSSxDQUFDLEtBQUssRUFBRSxDQUFDLENBQUMsQ0FBQyxJQUFBLHFCQUFZLEVBQUMsQ0FBQyxFQUFFLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUE7SUFDNUUsQ0FBQztJQUNELE9BQU8sR0FBRyxDQUFBO0FBQ1osQ0FBQztBQUVEOzs7R0FHRztBQUNILFNBQWdCLG9CQUFvQixDQUNsQyxPQUFnQyxFQUNoQyxVQUE0QixFQUM1QixHQUFXO0lBRVgsTUFBTSxNQUFNLEdBQUcsSUFBSSxHQUFHLENBQUMsVUFBVSxDQUFDLENBQUE7SUFDbEMsTUFBTSxHQUFHLEdBQTRCLEVBQUUsQ0FBQTtJQUN2QyxLQUFLLE1BQU0sQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLElBQUksTUFBTSxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1FBQzdDLEdBQUcsQ0FBQyxDQUFDLENBQUMsR0FBRyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxJQUFJLE9BQU8sQ0FBQyxLQUFLLFFBQVEsSUFBSSxDQUFDLEtBQUssRUFBRSxDQUFDLENBQUMsQ0FBQyxJQUFBLHFCQUFZLEVBQUMsQ0FBQyxFQUFFLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUE7SUFDeEYsQ0FBQztJQUNELE9BQU8sR0FBRyxDQUFBO0FBQ1osQ0FBQyJ9

package/.medusa/server/src/modules/integration/types/index.d.ts

@@ -0,0 +1,13 @@
+import type { ModuleProvider } from "@medusajs/framework/types";
+/** Awilix list-key under which every registered integration-provider key is collected. */
+export declare const IntegrationProviderRegistrationKey = "integration_providers";
+/** Prefix for each provider's container registration key: `int_<identifier>[_<id>]`. */
+export declare const IntegrationProviderRegistrationPrefix = "int_";
+/** Container key under which the resolved module options are registered. */
+export declare const INTEGRATION_OPTIONS_KEY = "integrationModuleOptions";
+export type IntegrationModuleOptions = {
+    /** Any non-empty secret; SHA-256-derived to a 32-byte AES-256-GCM key. High-entropy recommended (openssl rand -hex 32). */
+    encryptionKey?: string;
+    /** Integration-providers, each `{ resolve, id?, options? }` — like payment/fulfillment. */
+    providers?: ModuleProvider[];
+};

package/.medusa/server/src/modules/integration/types/index.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.INTEGRATION_OPTIONS_KEY = exports.IntegrationProviderRegistrationPrefix = exports.IntegrationProviderRegistrationKey = void 0;
+/** Awilix list-key under which every registered integration-provider key is collected. */
+exports.IntegrationProviderRegistrationKey = "integration_providers";
+/** Prefix for each provider's container registration key: `int_<identifier>[_<id>]`. */
+exports.IntegrationProviderRegistrationPrefix = "int_";
+/** Container key under which the resolved module options are registered. */
+exports.INTEGRATION_OPTIONS_KEY = "integrationModuleOptions";
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi8uLi8uLi9zcmMvbW9kdWxlcy9pbnRlZ3JhdGlvbi90eXBlcy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFFQSwwRkFBMEY7QUFDN0UsUUFBQSxrQ0FBa0MsR0FBRyx1QkFBdUIsQ0FBQTtBQUV6RSx3RkFBd0Y7QUFDM0UsUUFBQSxxQ0FBcUMsR0FBRyxNQUFNLENBQUE7QUFFM0QsNEVBQTRFO0FBQy9ELFFBQUEsdUJBQXVCLEdBQUcsMEJBQTBCLENBQUEifQ==