@headless-lms/core 0.1.0

package/dist/integrations/ports.d.ts

@@ -0,0 +1,62 @@
+import { ConfigureInput, ConnectInput, Connection, Validation } from "../types/schemas/integrations.js";
+import { Action, ActionContext, Integration } from "../types/integrations.js";
+import "../types/index.js";
+import { CredentialStore, OutboxAppender, UnitOfWork } from "../shared/ports.js";
+import "./model.js";
+//#region src/integrations/ports.d.ts
+/** The integrations declared at startup. Unknown ids are rejected by the service. */
+interface IntegrationsRegistry {
+  get(id: string): Integration | null;
+  list(): Integration[];
+}
+/** A declared integration as surfaced to clients: id, config schema, actions. */
+interface AvailableIntegration {
+  id: string;
+  configSchema: Record<string, unknown>;
+  secretsSchema: Record<string, unknown>;
+  actions: {
+    id: string;
+    description: string;
+    inputSchema: Record<string, unknown>;
+    outputSchema: Record<string, unknown>;
+  }[];
+}
+interface IntegrationsService {
+  /** The integrations declared in this deployment, with their config schemas. */
+  available(): AvailableIntegration[];
+  /** Establish a connection for an org; stores its credential and configuration. */
+  connect(orgId: string, input: ConnectInput): Promise<Connection>;
+  /** Replace a connection's stored secrets (re-auth / token refresh). */
+  reconnect(orgId: string, id: string, secrets: Record<string, unknown>): Promise<Connection | null>;
+  /** Set or change a connection's configuration and/or active flag. */
+  configure(orgId: string, id: string, input: ConfigureInput): Promise<Connection | null>;
+  /** Remove a connection and destroy its credential. */
+  disconnect(orgId: string, id: string): Promise<boolean>;
+  list(orgId: string): Promise<Connection[]>;
+  get(orgId: string, id: string): Promise<Connection | null>;
+  /** The connection consumers (billing, automations) resolve an integration by id. */
+  getByIntegration(orgId: string, integrationId: string): Promise<Connection | null>;
+  /** Invoke one of a connection's actions with its credential revealed at point
+   *  of use (e.g. a listing action that feeds a client-side picker). */
+  invoke(orgId: string, connectionId: string, actionId: string, input: Record<string, unknown>): Promise<unknown>;
+}
+interface ConnectionsRepository {
+  insert(orgId: string, connection: Connection): Promise<Connection>;
+  findById(orgId: string, id: string): Promise<Connection | null>;
+  findByIntegration(orgId: string, integrationId: string): Promise<Connection | null>;
+  list(orgId: string): Promise<Connection[]>;
+  update(orgId: string, id: string, patch: Partial<Pick<Connection, 'config' | 'active' | 'updatedAt'>>): Promise<Connection | null>;
+  delete(orgId: string, id: string): Promise<boolean>;
+}
+/** Tx-scoped port bundle for this context's mutating use cases. Folding the
+ *  credential store in makes credential + connection writes + outbox append
+ *  one transaction (closes the historical orphan-credential window). */
+interface IntegrationsTxScope {
+  connections: ConnectionsRepository;
+  credentials: CredentialStore;
+  outbox: OutboxAppender;
+}
+type IntegrationsUnitOfWork = UnitOfWork<IntegrationsTxScope>;
+//#endregion
+export { type Action, type ActionContext, AvailableIntegration, ConnectionsRepository, type Integration, IntegrationsRegistry, IntegrationsService, IntegrationsTxScope, IntegrationsUnitOfWork, type Validation };
+//# sourceMappingURL=ports.d.ts.map

package/dist/integrations/ports.js

@@ -0,0 +1 @@
+export {};

package/dist/integrations/registry.d.ts

@@ -0,0 +1,7 @@
+import { Integration } from "../types/integrations.js";
+import { IntegrationsRegistry } from "./ports.js";
+//#region src/integrations/registry.d.ts
+declare function createIntegrationsRegistry(integrations: Integration[]): IntegrationsRegistry;
+//#endregion
+export { createIntegrationsRegistry };
+//# sourceMappingURL=registry.d.ts.map

package/dist/integrations/registry.js

@@ -0,0 +1,16 @@
+//#region src/integrations/registry.ts
+function createIntegrationsRegistry(integrations) {
+	const byId = /* @__PURE__ */ new Map();
+	for (const integration of integrations) {
+		if (byId.has(integration.id)) throw new Error(`duplicate integration id "${integration.id}"`);
+		byId.set(integration.id, integration);
+	}
+	return {
+		get: (id) => byId.get(id) ?? null,
+		list: () => [...byId.values()]
+	};
+}
+//#endregion
+export { createIntegrationsRegistry };
+
+//# sourceMappingURL=registry.js.map

package/dist/integrations/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","names":[],"sources":["../../src/integrations/registry.ts"],"sourcesContent":["// integrations context — registry. The set of available integrations is\n// declared once at startup (composition passes the modules in); the service\n// consults it to reject unknown integration ids and to validate config.\nimport type { Integration, IntegrationsRegistry } from './ports.js';\n\nexport function createIntegrationsRegistry(integrations: Integration[]): IntegrationsRegistry {\n  const byId = new Map<string, Integration>();\n  for (const integration of integrations) {\n    if (byId.has(integration.id)) {\n      throw new Error(`duplicate integration id \"${integration.id}\"`);\n    }\n    byId.set(integration.id, integration);\n  }\n  return {\n    get: (id) => byId.get(id) ?? null,\n    list: () => [...byId.values()],\n  };\n}\n"],"mappings":";AAKA,SAAgB,2BAA2B,cAAmD;CAC5F,MAAM,uBAAO,IAAI,IAAyB;CAC1C,KAAK,MAAM,eAAe,cAAc;EACtC,IAAI,KAAK,IAAI,YAAY,EAAE,GACzB,MAAM,IAAI,MAAM,6BAA6B,YAAY,GAAG,EAAE;EAEhE,KAAK,IAAI,YAAY,IAAI,WAAW;CACtC;CACA,OAAO;EACL,MAAM,OAAO,KAAK,IAAI,EAAE,KAAK;EAC7B,YAAY,CAAC,GAAG,KAAK,OAAO,CAAC;CAC/B;AACF"}

package/dist/integrations/service.d.ts

@@ -0,0 +1,47 @@
+import { Logger } from "../types/ports.js";
+import { ConfigureInput, ConnectInput, Connection } from "../types/schemas/integrations.js";
+import { CredentialStore } from "../shared/ports.js";
+import "./model.js";
+import { ConnectionsRepository, IntegrationsRegistry, IntegrationsService, IntegrationsUnitOfWork } from "./ports.js";
+//#region src/integrations/service.d.ts
+type IntegrationsServiceParams = {
+  registry: IntegrationsRegistry;
+  /** Read-only access (find/list) — runs outside any transaction. */
+  repo: ConnectionsRepository;
+  /** Atomic write scope: tx-bound connections repo + credential store + outbox. */
+  uow: IntegrationsUnitOfWork;
+  /** Point-of-use credential reveal for action invocation — reads only. */
+  credentials: CredentialStore;
+  logger?: Logger;
+};
+declare class IntegrationsServiceImpl implements IntegrationsService {
+  private readonly registry;
+  private readonly repo;
+  private readonly uow;
+  private readonly credentials;
+  private readonly logger;
+  constructor(params: IntegrationsServiceParams);
+  available(): {
+    id: string;
+    configSchema: Record<string, unknown>;
+    secretsSchema: Record<string, unknown>;
+    actions: {
+      id: string;
+      description: string;
+      inputSchema: Record<string, unknown>;
+      outputSchema: Record<string, unknown>;
+    }[];
+  }[];
+  private validate;
+  connect(orgId: string, input: ConnectInput): Promise<Connection>;
+  reconnect(orgId: string, id: string, secrets: Record<string, unknown>): Promise<Connection | null>;
+  configure(orgId: string, id: string, input: ConfigureInput): Promise<Connection | null>;
+  disconnect(orgId: string, id: string): Promise<boolean>;
+  list(orgId: string): Promise<Connection[]>;
+  get(orgId: string, id: string): Promise<Connection | null>;
+  getByIntegration(orgId: string, integrationId: string): Promise<Connection | null>;
+  invoke(orgId: string, connectionId: string, actionId: string, input: Record<string, unknown>): Promise<unknown>;
+}
+//#endregion
+export { IntegrationsServiceImpl, IntegrationsServiceParams };
+//# sourceMappingURL=service.d.ts.map

package/dist/integrations/service.js

@@ -0,0 +1,184 @@
+import { genId } from "../shared/id.js";
+import { noopLogger } from "../shared/logger.js";
+import { ConflictError, NotFoundError } from "../shared/errors.js";
+import { ActionInvocationError, AlreadyConnectedError, InvalidConfigError, UnknownIntegrationError } from "./model.js";
+import { integrationEvents } from "./events.js";
+//#region src/integrations/service.ts
+var IntegrationsServiceImpl = class {
+	registry;
+	repo;
+	uow;
+	credentials;
+	logger;
+	constructor(params) {
+		this.registry = params.registry;
+		this.repo = params.repo;
+		this.uow = params.uow;
+		this.credentials = params.credentials;
+		this.logger = params.logger ?? noopLogger;
+	}
+	available() {
+		return this.registry.list().map((integration) => ({
+			id: integration.id,
+			configSchema: integration.configSchema(),
+			secretsSchema: integration.secretsSchema(),
+			actions: integration.actions.map((action) => ({
+				id: action.id,
+				description: action.description,
+				inputSchema: action.inputSchema(),
+				outputSchema: action.outputSchema()
+			}))
+		}));
+	}
+	validate(integrationId, config) {
+		const integration = this.registry.get(integrationId);
+		if (!integration) {
+			this.logger.warn("unknown integration rejected", { integrationId });
+			throw new UnknownIntegrationError(integrationId);
+		}
+		const result = integration.validateConfig(config);
+		if (!result.ok) {
+			this.logger.warn("invalid integration config rejected", {
+				integrationId,
+				errors: result.errors
+			});
+			throw new InvalidConfigError(integrationId, result.errors);
+		}
+	}
+	async connect(orgId, input) {
+		const config = input.config ?? {};
+		this.validate(input.integrationId, config);
+		if (await this.repo.findByIntegration(orgId, input.integrationId)) {
+			this.logger.warn("duplicate connection rejected", {
+				orgId,
+				integrationId: input.integrationId
+			});
+			throw new AlreadyConnectedError(input.integrationId);
+		}
+		const connection = await this.uow.run(async ({ connections, credentials, outbox }) => {
+			const credentialRef = await credentials.store(orgId, input.secrets);
+			const at = /* @__PURE__ */ new Date();
+			const created = await connections.insert(orgId, {
+				orgId,
+				id: genId("connection"),
+				integrationId: input.integrationId,
+				config,
+				active: true,
+				credentialRef,
+				createdAt: at,
+				updatedAt: at
+			});
+			await outbox.append([integrationEvents.connectionCreated.make({
+				orgId,
+				data: created
+			})]);
+			return created;
+		});
+		this.logger.info("integration connected", {
+			orgId,
+			integrationId: connection.integrationId,
+			connectionId: connection.id
+		});
+		return connection;
+	}
+	async reconnect(orgId, id, secrets) {
+		const connection = await this.repo.findById(orgId, id);
+		if (!connection) return null;
+		const updated = await this.uow.run(async ({ connections, credentials, outbox }) => {
+			await credentials.update(orgId, connection.credentialRef, secrets);
+			const result = await connections.update(orgId, id, { updatedAt: /* @__PURE__ */ new Date() });
+			if (result) await outbox.append([integrationEvents.connectionUpdated.make({
+				orgId,
+				data: result
+			})]);
+			return result;
+		});
+		this.logger.info("integration credentials rotated", {
+			orgId,
+			connectionId: id,
+			integrationId: connection.integrationId
+		});
+		return updated;
+	}
+	async configure(orgId, id, input) {
+		const connection = await this.repo.findById(orgId, id);
+		if (!connection) return null;
+		if (input.config !== void 0) this.validate(connection.integrationId, input.config);
+		const updated = await this.uow.run(async ({ connections, outbox }) => {
+			const result = await connections.update(orgId, id, {
+				...input.config !== void 0 ? { config: input.config } : {},
+				...input.active !== void 0 ? { active: input.active } : {},
+				updatedAt: /* @__PURE__ */ new Date()
+			});
+			if (result) await outbox.append([integrationEvents.connectionUpdated.make({
+				orgId,
+				data: result
+			})]);
+			return result;
+		});
+		this.logger.info("integration configured", {
+			orgId,
+			connectionId: id,
+			integrationId: connection.integrationId
+		});
+		return updated;
+	}
+	async disconnect(orgId, id) {
+		const connection = await this.repo.findById(orgId, id);
+		if (!connection) return false;
+		const deleted = await this.uow.run(async ({ connections, credentials, outbox }) => {
+			const ok = await connections.delete(orgId, id);
+			await credentials.destroy(orgId, connection.credentialRef);
+			await outbox.append([integrationEvents.connectionRemoved.make({
+				orgId,
+				data: connection
+			})]);
+			return ok;
+		});
+		this.logger.info("integration disconnected", {
+			orgId,
+			connectionId: id,
+			integrationId: connection.integrationId
+		});
+		return deleted;
+	}
+	list(orgId) {
+		return this.repo.list(orgId);
+	}
+	get(orgId, id) {
+		return this.repo.findById(orgId, id);
+	}
+	getByIntegration(orgId, integrationId) {
+		return this.repo.findByIntegration(orgId, integrationId);
+	}
+	async invoke(orgId, connectionId, actionId, input) {
+		const connection = await this.repo.findById(orgId, connectionId);
+		if (!connection) throw new NotFoundError("Connection", connectionId);
+		if (!connection.active) throw new ConflictError(`connection "${connectionId}" is inactive`);
+		const integration = this.registry.get(connection.integrationId);
+		if (!integration) throw new UnknownIntegrationError(connection.integrationId);
+		const action = integration.actions.find((a) => a.id === actionId);
+		if (!action) throw new NotFoundError("Action", actionId);
+		const secrets = await this.credentials.reveal(orgId, connection.credentialRef);
+		if (!secrets) throw new NotFoundError("Credential", connectionId);
+		try {
+			return await action.invoke({
+				secrets,
+				config: connection.config
+			}, input);
+		} catch (err) {
+			this.logger.warn("integration action failed", {
+				orgId,
+				connectionId,
+				integrationId: connection.integrationId,
+				actionId,
+				error: err instanceof Error ? err.message : String(err)
+			});
+			throw new ActionInvocationError(connection.integrationId, actionId, err);
+		}
+	}
+};
+//#endregion
+export { IntegrationsServiceImpl };
+
+//# sourceMappingURL=service.js.map

package/dist/integrations/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","names":[],"sources":["../../src/integrations/service.ts"],"sourcesContent":["// integrations context — service implementation (inbound port). Owns the\n// connection lifecycle; credentials live in the shared secure credential store\n// (this service holds only the ref). The integrations the system supports are\n// declared at startup via the IntegrationsRegistry: connect/configure reject\n// unknown integration ids and validate config with the integration's own\n// validator. The domain never calls the external service — consumers take the\n// connection, reveal the credential at point of use, and build their own adapter.\n//\n// Mutations run inside the context's UnitOfWork: credential writes, connection\n// writes, and the outbox append commit in ONE transaction (transactional\n// outbox; this also closed the historical orphan-credential window). The\n// outbox relay — not this service — publishes to the EventBus.\nimport { genId } from '../shared/id.js';\nimport {\n  ActionInvocationError,\n  AlreadyConnectedError,\n  InvalidConfigError,\n  UnknownIntegrationError,\n  type ConfigureInput,\n  type ConnectInput,\n  type Connection,\n} from './model.js';\nimport type {\n  ConnectionsRepository,\n  IntegrationsRegistry,\n  IntegrationsService,\n  IntegrationsUnitOfWork,\n} from './ports.js';\nimport type { CredentialStore, Logger } from '../shared/ports.js';\nimport { ConflictError, NotFoundError } from '../shared/errors.js';\nimport { noopLogger } from '../shared/logger.js';\nimport { integrationEvents } from './events.js';\n\nexport type IntegrationsServiceParams = {\n  registry: IntegrationsRegistry;\n  /** Read-only access (find/list) — runs outside any transaction. */\n  repo: ConnectionsRepository;\n  /** Atomic write scope: tx-bound connections repo + credential store + outbox. */\n  uow: IntegrationsUnitOfWork;\n  /** Point-of-use credential reveal for action invocation — reads only. */\n  credentials: CredentialStore;\n  logger?: Logger;\n};\n\nexport class IntegrationsServiceImpl implements IntegrationsService {\n  private readonly registry: IntegrationsRegistry;\n  private readonly repo: ConnectionsRepository;\n  private readonly uow: IntegrationsUnitOfWork;\n  private readonly credentials: CredentialStore;\n  private readonly logger: Logger;\n\n  constructor(params: IntegrationsServiceParams) {\n    this.registry = params.registry;\n    this.repo = params.repo;\n    this.uow = params.uow;\n    this.credentials = params.credentials;\n    this.logger = params.logger ?? noopLogger;\n  }\n\n  available() {\n    return this.registry.list().map((integration) => ({\n      id: integration.id,\n      configSchema: integration.configSchema(),\n      secretsSchema: integration.secretsSchema(),\n      actions: integration.actions.map((action) => ({\n        id: action.id,\n        description: action.description,\n        inputSchema: action.inputSchema(),\n        outputSchema: action.outputSchema(),\n      })),\n    }));\n  }\n\n  private validate(integrationId: string, config: Record<string, unknown>): void {\n    const integration = this.registry.get(integrationId);\n    if (!integration) {\n      this.logger.warn('unknown integration rejected', { integrationId });\n      throw new UnknownIntegrationError(integrationId);\n    }\n    const result = integration.validateConfig(config);\n    if (!result.ok) {\n      this.logger.warn('invalid integration config rejected', {\n        integrationId,\n        errors: result.errors,\n      });\n      throw new InvalidConfigError(integrationId, result.errors);\n    }\n  }\n\n  async connect(orgId: string, input: ConnectInput): Promise<Connection> {\n    const config = input.config ?? {};\n    this.validate(input.integrationId, config);\n    const existing = await this.repo.findByIntegration(orgId, input.integrationId);\n    if (existing) {\n      this.logger.warn('duplicate connection rejected', {\n        orgId,\n        integrationId: input.integrationId,\n      });\n      throw new AlreadyConnectedError(input.integrationId);\n    }\n    const connection = await this.uow.run(async ({ connections, credentials, outbox }) => {\n      const credentialRef = await credentials.store(orgId, input.secrets);\n      const at = new Date();\n      const created = await connections.insert(orgId, {\n        orgId,\n        id: genId('connection'),\n        integrationId: input.integrationId,\n        config,\n        active: true,\n        credentialRef,\n        createdAt: at,\n        updatedAt: at,\n      });\n      await outbox.append([\n        integrationEvents.connectionCreated.make({\n          orgId,\n          data: created,\n        }),\n      ]);\n      return created;\n    });\n    this.logger.info('integration connected', {\n      orgId,\n      integrationId: connection.integrationId,\n      connectionId: connection.id,\n    });\n    return connection;\n  }\n\n  async reconnect(\n    orgId: string,\n    id: string,\n    secrets: Record<string, unknown>,\n  ): Promise<Connection | null> {\n    const connection = await this.repo.findById(orgId, id);\n    if (!connection) {\n      return null;\n    }\n    const updated = await this.uow.run(async ({ connections, credentials, outbox }) => {\n      await credentials.update(orgId, connection.credentialRef, secrets);\n      const result = await connections.update(orgId, id, { updatedAt: new Date() });\n      if (result) {\n        await outbox.append([\n          integrationEvents.connectionUpdated.make({ orgId, data: result }),\n        ]);\n      }\n      return result;\n    });\n    this.logger.info('integration credentials rotated', {\n      orgId,\n      connectionId: id,\n      integrationId: connection.integrationId,\n    });\n    return updated;\n  }\n\n  async configure(orgId: string, id: string, input: ConfigureInput): Promise<Connection | null> {\n    const connection = await this.repo.findById(orgId, id);\n    if (!connection) {\n      return null;\n    }\n    if (input.config !== undefined) {\n      this.validate(connection.integrationId, input.config);\n    }\n    const updated = await this.uow.run(async ({ connections, outbox }) => {\n      const result = await connections.update(orgId, id, {\n        ...(input.config !== undefined ? { config: input.config } : {}),\n        ...(input.active !== undefined ? { active: input.active } : {}),\n        updatedAt: new Date(),\n      });\n      if (result) {\n        await outbox.append([\n          integrationEvents.connectionUpdated.make({ orgId, data: result }),\n        ]);\n      }\n      return result;\n    });\n    this.logger.info('integration configured', {\n      orgId,\n      connectionId: id,\n      integrationId: connection.integrationId,\n    });\n    return updated;\n  }\n\n  async disconnect(orgId: string, id: string): Promise<boolean> {\n    const connection = await this.repo.findById(orgId, id);\n    if (!connection) {\n      return false;\n    }\n    const deleted = await this.uow.run(async ({ connections, credentials, outbox }) => {\n      // Connection first: it holds the FK onto the credential row.\n      const ok = await connections.delete(orgId, id);\n      await credentials.destroy(orgId, connection.credentialRef);\n      await outbox.append([\n        integrationEvents.connectionRemoved.make({ orgId, data: connection }),\n      ]);\n      return ok;\n    });\n    this.logger.info('integration disconnected', {\n      orgId,\n      connectionId: id,\n      integrationId: connection.integrationId,\n    });\n    return deleted;\n  }\n\n  list(orgId: string): Promise<Connection[]> {\n    return this.repo.list(orgId);\n  }\n\n  get(orgId: string, id: string): Promise<Connection | null> {\n    return this.repo.findById(orgId, id);\n  }\n\n  getByIntegration(orgId: string, integrationId: string): Promise<Connection | null> {\n    return this.repo.findByIntegration(orgId, integrationId);\n  }\n\n  async invoke(\n    orgId: string,\n    connectionId: string,\n    actionId: string,\n    input: Record<string, unknown>,\n  ): Promise<unknown> {\n    const connection = await this.repo.findById(orgId, connectionId);\n    if (!connection) {\n      throw new NotFoundError('Connection', connectionId);\n    }\n    if (!connection.active) {\n      throw new ConflictError(`connection \"${connectionId}\" is inactive`);\n    }\n    const integration = this.registry.get(connection.integrationId);\n    if (!integration) {\n      throw new UnknownIntegrationError(connection.integrationId);\n    }\n    const action = integration.actions.find((a) => a.id === actionId);\n    if (!action) {\n      throw new NotFoundError('Action', actionId);\n    }\n    const secrets = await this.credentials.reveal(orgId, connection.credentialRef);\n    if (!secrets) {\n      throw new NotFoundError('Credential', connectionId);\n    }\n    try {\n      return await action.invoke({ secrets, config: connection.config }, input);\n    } catch (err) {\n      this.logger.warn('integration action failed', {\n        orgId,\n        connectionId,\n        integrationId: connection.integrationId,\n        actionId,\n        error: err instanceof Error ? err.message : String(err),\n      });\n      throw new ActionInvocationError(connection.integrationId, actionId, err);\n    }\n  }\n}\n"],"mappings":";;;;;;AA4CA,IAAa,0BAAb,MAAoE;CAClE;CACA;CACA;CACA;CACA;CAEA,YAAY,QAAmC;EAC7C,KAAK,WAAW,OAAO;EACvB,KAAK,OAAO,OAAO;EACnB,KAAK,MAAM,OAAO;EAClB,KAAK,cAAc,OAAO;EAC1B,KAAK,SAAS,OAAO,UAAU;CACjC;CAEA,YAAY;EACV,OAAO,KAAK,SAAS,KAAK,CAAC,CAAC,KAAK,iBAAiB;GAChD,IAAI,YAAY;GAChB,cAAc,YAAY,aAAa;GACvC,eAAe,YAAY,cAAc;GACzC,SAAS,YAAY,QAAQ,KAAK,YAAY;IAC5C,IAAI,OAAO;IACX,aAAa,OAAO;IACpB,aAAa,OAAO,YAAY;IAChC,cAAc,OAAO,aAAa;GACpC,EAAE;EACJ,EAAE;CACJ;CAEA,SAAiB,eAAuB,QAAuC;EAC7E,MAAM,cAAc,KAAK,SAAS,IAAI,aAAa;EACnD,IAAI,CAAC,aAAa;GAChB,KAAK,OAAO,KAAK,gCAAgC,EAAE,cAAc,CAAC;GAClE,MAAM,IAAI,wBAAwB,aAAa;EACjD;EACA,MAAM,SAAS,YAAY,eAAe,MAAM;EAChD,IAAI,CAAC,OAAO,IAAI;GACd,KAAK,OAAO,KAAK,uCAAuC;IACtD;IACA,QAAQ,OAAO;GACjB,CAAC;GACD,MAAM,IAAI,mBAAmB,eAAe,OAAO,MAAM;EAC3D;CACF;CAEA,MAAM,QAAQ,OAAe,OAA0C;EACrE,MAAM,SAAS,MAAM,UAAU,CAAC;EAChC,KAAK,SAAS,MAAM,eAAe,MAAM;EAEzC,IAAI,MADmB,KAAK,KAAK,kBAAkB,OAAO,MAAM,aAAa,GAC/D;GACZ,KAAK,OAAO,KAAK,iCAAiC;IAChD;IACA,eAAe,MAAM;GACvB,CAAC;GACD,MAAM,IAAI,sBAAsB,MAAM,aAAa;EACrD;EACA,MAAM,aAAa,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,aAAa,aAAa,aAAa;GACpF,MAAM,gBAAgB,MAAM,YAAY,MAAM,OAAO,MAAM,OAAO;GAClE,MAAM,qBAAK,IAAI,KAAK;GACpB,MAAM,UAAU,MAAM,YAAY,OAAO,OAAO;IAC9C;IACA,IAAI,MAAM,YAAY;IACtB,eAAe,MAAM;IACrB;IACA,QAAQ;IACR;IACA,WAAW;IACX,WAAW;GACb,CAAC;GACD,MAAM,OAAO,OAAO,CAClB,kBAAkB,kBAAkB,KAAK;IACvC;IACA,MAAM;GACR,CAAC,CACH,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,yBAAyB;GACxC;GACA,eAAe,WAAW;GAC1B,cAAc,WAAW;EAC3B,CAAC;EACD,OAAO;CACT;CAEA,MAAM,UACJ,OACA,IACA,SAC4B;EAC5B,MAAM,aAAa,MAAM,KAAK,KAAK,SAAS,OAAO,EAAE;EACrD,IAAI,CAAC,YACH,OAAO;EAET,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,aAAa,aAAa,aAAa;GACjF,MAAM,YAAY,OAAO,OAAO,WAAW,eAAe,OAAO;GACjE,MAAM,SAAS,MAAM,YAAY,OAAO,OAAO,IAAI,EAAE,2BAAW,IAAI,KAAK,EAAE,CAAC;GAC5E,IAAI,QACF,MAAM,OAAO,OAAO,CAClB,kBAAkB,kBAAkB,KAAK;IAAE;IAAO,MAAM;GAAO,CAAC,CAClE,CAAC;GAEH,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,mCAAmC;GAClD;GACA,cAAc;GACd,eAAe,WAAW;EAC5B,CAAC;EACD,OAAO;CACT;CAEA,MAAM,UAAU,OAAe,IAAY,OAAmD;EAC5F,MAAM,aAAa,MAAM,KAAK,KAAK,SAAS,OAAO,EAAE;EACrD,IAAI,CAAC,YACH,OAAO;EAET,IAAI,MAAM,WAAW,KAAA,GACnB,KAAK,SAAS,WAAW,eAAe,MAAM,MAAM;EAEtD,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,aAAa,aAAa;GACpE,MAAM,SAAS,MAAM,YAAY,OAAO,OAAO,IAAI;IACjD,GAAI,MAAM,WAAW,KAAA,IAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;IAC7D,GAAI,MAAM,WAAW,KAAA,IAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;IAC7D,2BAAW,IAAI,KAAK;GACtB,CAAC;GACD,IAAI,QACF,MAAM,OAAO,OAAO,CAClB,kBAAkB,kBAAkB,KAAK;IAAE;IAAO,MAAM;GAAO,CAAC,CAClE,CAAC;GAEH,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,0BAA0B;GACzC;GACA,cAAc;GACd,eAAe,WAAW;EAC5B,CAAC;EACD,OAAO;CACT;CAEA,MAAM,WAAW,OAAe,IAA8B;EAC5D,MAAM,aAAa,MAAM,KAAK,KAAK,SAAS,OAAO,EAAE;EACrD,IAAI,CAAC,YACH,OAAO;EAET,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,aAAa,aAAa,aAAa;GAEjF,MAAM,KAAK,MAAM,YAAY,OAAO,OAAO,EAAE;GAC7C,MAAM,YAAY,QAAQ,OAAO,WAAW,aAAa;GACzD,MAAM,OAAO,OAAO,CAClB,kBAAkB,kBAAkB,KAAK;IAAE;IAAO,MAAM;GAAW,CAAC,CACtE,CAAC;GACD,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,4BAA4B;GAC3C;GACA,cAAc;GACd,eAAe,WAAW;EAC5B,CAAC;EACD,OAAO;CACT;CAEA,KAAK,OAAsC;EACzC,OAAO,KAAK,KAAK,KAAK,KAAK;CAC7B;CAEA,IAAI,OAAe,IAAwC;EACzD,OAAO,KAAK,KAAK,SAAS,OAAO,EAAE;CACrC;CAEA,iBAAiB,OAAe,eAAmD;EACjF,OAAO,KAAK,KAAK,kBAAkB,OAAO,aAAa;CACzD;CAEA,MAAM,OACJ,OACA,cACA,UACA,OACkB;EAClB,MAAM,aAAa,MAAM,KAAK,KAAK,SAAS,OAAO,YAAY;EAC/D,IAAI,CAAC,YACH,MAAM,IAAI,cAAc,cAAc,YAAY;EAEpD,IAAI,CAAC,WAAW,QACd,MAAM,IAAI,cAAc,eAAe,aAAa,cAAc;EAEpE,MAAM,cAAc,KAAK,SAAS,IAAI,WAAW,aAAa;EAC9D,IAAI,CAAC,aACH,MAAM,IAAI,wBAAwB,WAAW,aAAa;EAE5D,MAAM,SAAS,YAAY,QAAQ,MAAM,MAAM,EAAE,OAAO,QAAQ;EAChE,IAAI,CAAC,QACH,MAAM,IAAI,cAAc,UAAU,QAAQ;EAE5C,MAAM,UAAU,MAAM,KAAK,YAAY,OAAO,OAAO,WAAW,aAAa;EAC7E,IAAI,CAAC,SACH,MAAM,IAAI,cAAc,cAAc,YAAY;EAEpD,IAAI;GACF,OAAO,MAAM,OAAO,OAAO;IAAE;IAAS,QAAQ,WAAW;GAAO,GAAG,KAAK;EAC1E,SAAS,KAAK;GACZ,KAAK,OAAO,KAAK,6BAA6B;IAC5C;IACA;IACA,eAAe,WAAW;IAC1B;IACA,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GACxD,CAAC;GACD,MAAM,IAAI,sBAAsB,WAAW,eAAe,UAAU,GAAG;EACzE;CACF;AACF"}

package/dist/integrations/zod.d.ts

@@ -0,0 +1,29 @@
+import { Validation } from "../types/schemas/integrations.js";
+import { Action, ActionContext } from "../types/integrations.js";
+import "../types/index.js";
+import { z } from "zod";
+//#region src/integrations/zod.d.ts
+declare function zodConfig(schema: z.ZodType): {
+  configSchema: () => Record<string, unknown>;
+  validateConfig: (config: unknown) => Validation;
+};
+/** Derive the Integration contract's secretsSchema getter from a zod schema. */
+declare function zodSecrets(schema: z.ZodType): {
+  secretsSchema: () => Record<string, unknown>;
+};
+/**
+ * Build an Action from zod schemas + a run function. `invoke` parses the input
+ * first (defaults applied, throws on mismatch), so `run` always sees typed,
+ * valid input. The output schema documents the resolved shape for consumers;
+ * it is not re-validated at runtime.
+ */
+declare function zodAction<I extends z.ZodType, O extends z.ZodType>(def: {
+  id: string;
+  description: string;
+  input: I;
+  output: O;
+  run(ctx: ActionContext, input: z.infer<I>): Promise<z.infer<O>>;
+}): Action;
+//#endregion
+export { zodAction, zodConfig, zodSecrets };
+//# sourceMappingURL=zod.d.ts.map

package/dist/integrations/zod.js

@@ -0,0 +1,40 @@
+import { z } from "zod";
+//#region src/integrations/zod.ts
+function toErrors(error) {
+	return error.issues.map((issue) => issue.path.length ? `${issue.path.join(".")}: ${issue.message}` : issue.message);
+}
+function zodConfig(schema) {
+	return {
+		configSchema: () => z.toJSONSchema(schema),
+		validateConfig: (config) => {
+			const result = schema.safeParse(config ?? {});
+			return result.success ? { ok: true } : {
+				ok: false,
+				errors: toErrors(result.error)
+			};
+		}
+	};
+}
+/** Derive the Integration contract's secretsSchema getter from a zod schema. */
+function zodSecrets(schema) {
+	return { secretsSchema: () => z.toJSONSchema(schema) };
+}
+/**
+* Build an Action from zod schemas + a run function. `invoke` parses the input
+* first (defaults applied, throws on mismatch), so `run` always sees typed,
+* valid input. The output schema documents the resolved shape for consumers;
+* it is not re-validated at runtime.
+*/
+function zodAction(def) {
+	return {
+		id: def.id,
+		description: def.description,
+		inputSchema: () => z.toJSONSchema(def.input),
+		outputSchema: () => z.toJSONSchema(def.output),
+		invoke: async (ctx, input) => def.run(ctx, def.input.parse(input ?? {}))
+	};
+}
+//#endregion
+export { zodAction, zodConfig, zodSecrets };
+
+//# sourceMappingURL=zod.js.map

package/dist/integrations/zod.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zod.js","names":[],"sources":["../../src/integrations/zod.ts"],"sourcesContent":["// Zod helpers for integration modules. An integration declares its config and\n// each action's input/output as zod schemas once; these adapt them to the\n// contract's JSON-Schema getters and validators.\nimport { z } from 'zod';\nimport type { Action, ActionContext, Validation } from '../types/index.js';\n\nfunction toErrors(error: z.ZodError): string[] {\n  return error.issues.map((issue) =>\n    issue.path.length ? `${issue.path.join('.')}: ${issue.message}` : issue.message,\n  );\n}\n\nexport function zodConfig(schema: z.ZodType): {\n  configSchema: () => Record<string, unknown>;\n  validateConfig: (config: unknown) => Validation;\n} {\n  return {\n    configSchema: () => z.toJSONSchema(schema) as Record<string, unknown>,\n    validateConfig: (config) => {\n      const result = schema.safeParse(config ?? {});\n      return result.success ? { ok: true } : { ok: false, errors: toErrors(result.error) };\n    },\n  };\n}\n\n/** Derive the Integration contract's secretsSchema getter from a zod schema. */\nexport function zodSecrets(schema: z.ZodType): {\n  secretsSchema: () => Record<string, unknown>;\n} {\n  return { secretsSchema: () => z.toJSONSchema(schema) as Record<string, unknown> };\n}\n\n/**\n * Build an Action from zod schemas + a run function. `invoke` parses the input\n * first (defaults applied, throws on mismatch), so `run` always sees typed,\n * valid input. The output schema documents the resolved shape for consumers;\n * it is not re-validated at runtime.\n */\nexport function zodAction<I extends z.ZodType, O extends z.ZodType>(def: {\n  id: string;\n  description: string;\n  input: I;\n  output: O;\n  run(ctx: ActionContext, input: z.infer<I>): Promise<z.infer<O>>;\n}): Action {\n  return {\n    id: def.id,\n    description: def.description,\n    inputSchema: () => z.toJSONSchema(def.input) as Record<string, unknown>,\n    outputSchema: () => z.toJSONSchema(def.output) as Record<string, unknown>,\n    invoke: async (ctx, input) => def.run(ctx, def.input.parse(input ?? {}) as z.infer<I>),\n  };\n}\n"],"mappings":";;AAMA,SAAS,SAAS,OAA6B;CAC7C,OAAO,MAAM,OAAO,KAAK,UACvB,MAAM,KAAK,SAAS,GAAG,MAAM,KAAK,KAAK,GAAG,EAAE,IAAI,MAAM,YAAY,MAAM,OAC1E;AACF;AAEA,SAAgB,UAAU,QAGxB;CACA,OAAO;EACL,oBAAoB,EAAE,aAAa,MAAM;EACzC,iBAAiB,WAAW;GAC1B,MAAM,SAAS,OAAO,UAAU,UAAU,CAAC,CAAC;GAC5C,OAAO,OAAO,UAAU,EAAE,IAAI,KAAK,IAAI;IAAE,IAAI;IAAO,QAAQ,SAAS,OAAO,KAAK;GAAE;EACrF;CACF;AACF;;AAGA,SAAgB,WAAW,QAEzB;CACA,OAAO,EAAE,qBAAqB,EAAE,aAAa,MAAM,EAA6B;AAClF;;;;;;;AAQA,SAAgB,UAAoD,KAMzD;CACT,OAAO;EACL,IAAI,IAAI;EACR,aAAa,IAAI;EACjB,mBAAmB,EAAE,aAAa,IAAI,KAAK;EAC3C,oBAAoB,EAAE,aAAa,IAAI,MAAM;EAC7C,QAAQ,OAAO,KAAK,UAAU,IAAI,IAAI,KAAK,IAAI,MAAM,MAAM,SAAS,CAAC,CAAC,CAAe;CACvF;AACF"}

package/dist/organizations/events.d.ts

@@ -0,0 +1,197 @@
+import { EventOf, EventOfValues, RuntimeEventDefinition, VersionedDomainEvent } from "../shared/events.js";
+import "../shared/ports.js";
+//#region src/organizations/events.d.ts
+declare const organizationEvents: {
+  organizationCreated: RuntimeEventDefinition<VersionedDomainEvent<{
+    id: string;
+    externalId: string | null;
+    name: string;
+    slug: string;
+    ownerId: string;
+    createdAt: Date;
+    updatedAt: Date;
+  }, "organization.created", 1>, {
+    id: string;
+    externalId: string | null;
+    name: string;
+    slug: string;
+    ownerId: string;
+    createdAt: unknown;
+    updatedAt: unknown;
+  }>;
+  organizationUpdated: RuntimeEventDefinition<VersionedDomainEvent<{
+    id: string;
+    externalId: string | null;
+    name: string;
+    slug: string;
+    ownerId: string;
+    createdAt: Date;
+    updatedAt: Date;
+  }, "organization.updated", 1>, {
+    id: string;
+    externalId: string | null;
+    name: string;
+    slug: string;
+    ownerId: string;
+    createdAt: unknown;
+    updatedAt: unknown;
+  }>;
+  organizationDeleted: RuntimeEventDefinition<VersionedDomainEvent<{
+    id: string;
+    externalId: string | null;
+    name: string;
+    slug: string;
+    ownerId: string;
+    createdAt: Date;
+    updatedAt: Date;
+  }, "organization.deleted", 1>, {
+    id: string;
+    externalId: string | null;
+    name: string;
+    slug: string;
+    ownerId: string;
+    createdAt: unknown;
+    updatedAt: unknown;
+  }>;
+  orgUserLinked: RuntimeEventDefinition<VersionedDomainEvent<{
+    id: string;
+    orgId: string;
+    userId: string;
+    role: "owner" | "admin" | "instructor" | "student";
+    status: "active" | "invited";
+    createdAt: Date;
+    updatedAt: Date;
+  }, "organization.user.linked", 1>, {
+    id: string;
+    orgId: string;
+    userId: string;
+    role: "owner" | "admin" | "instructor" | "student";
+    status: "active" | "invited";
+    createdAt: unknown;
+    updatedAt: unknown;
+  }>;
+  orgUserDeleted: RuntimeEventDefinition<VersionedDomainEvent<{
+    id: string;
+    orgId: string;
+    userId: string;
+    role: "owner" | "admin" | "instructor" | "student";
+    status: "active" | "invited";
+    createdAt: Date;
+    updatedAt: Date;
+  }, "organization.user.deleted", 1>, {
+    id: string;
+    orgId: string;
+    userId: string;
+    role: "owner" | "admin" | "instructor" | "student";
+    status: "active" | "invited";
+    createdAt: unknown;
+    updatedAt: unknown;
+  }>;
+  inviteCreated: RuntimeEventDefinition<VersionedDomainEvent<{
+    id: string;
+    orgId: string;
+    email: string;
+    role: "admin" | "instructor" | "student";
+    status: "pending" | "accepted" | "rejected" | "canceled";
+    invitedBy: string;
+    tokenHash: string | null;
+    expiresAt: Date | null;
+    createdAt: Date;
+  }, "organization.invite.created", 1>, {
+    id: string;
+    orgId: string;
+    email: string;
+    role: "admin" | "instructor" | "student";
+    status: "pending" | "accepted" | "rejected" | "canceled";
+    invitedBy: string;
+    tokenHash: string | null;
+    expiresAt: unknown;
+    createdAt: unknown;
+  }>;
+  inviteAccepted: RuntimeEventDefinition<VersionedDomainEvent<{
+    id: string;
+    orgId: string;
+    email: string;
+    role: "admin" | "instructor" | "student";
+    status: "pending" | "accepted" | "rejected" | "canceled";
+    invitedBy: string;
+    tokenHash: string | null;
+    expiresAt: Date | null;
+    createdAt: Date;
+  }, "organization.invite.accepted", 1>, {
+    id: string;
+    orgId: string;
+    email: string;
+    role: "admin" | "instructor" | "student";
+    status: "pending" | "accepted" | "rejected" | "canceled";
+    invitedBy: string;
+    tokenHash: string | null;
+    expiresAt: unknown;
+    createdAt: unknown;
+  }>;
+  studentCreated: RuntimeEventDefinition<VersionedDomainEvent<{
+    id: string;
+    orgId: string;
+    userId: string;
+    role: "owner" | "admin" | "instructor" | "student";
+    status: "active" | "invited";
+    createdAt: Date;
+    updatedAt: Date;
+  }, "organization.student.created", 1>, {
+    id: string;
+    orgId: string;
+    userId: string;
+    role: "owner" | "admin" | "instructor" | "student";
+    status: "active" | "invited";
+    createdAt: unknown;
+    updatedAt: unknown;
+  }>;
+  studentDeleted: RuntimeEventDefinition<VersionedDomainEvent<{
+    id: string;
+    orgId: string;
+    userId: string;
+    role: "owner" | "admin" | "instructor" | "student";
+    status: "active" | "invited";
+    createdAt: Date;
+    updatedAt: Date;
+  }, "organization.student.deleted", 1>, {
+    id: string;
+    orgId: string;
+    userId: string;
+    role: "owner" | "admin" | "instructor" | "student";
+    status: "active" | "invited";
+    createdAt: unknown;
+    updatedAt: unknown;
+  }>;
+  studentLinked: RuntimeEventDefinition<VersionedDomainEvent<{
+    id: string;
+    orgId: string;
+    userId: string;
+    role: "owner" | "admin" | "instructor" | "student";
+    status: "active" | "invited";
+    createdAt: Date;
+    updatedAt: Date;
+  }, "organization.student.linked", 1>, {
+    id: string;
+    orgId: string;
+    userId: string;
+    role: "owner" | "admin" | "instructor" | "student";
+    status: "active" | "invited";
+    createdAt: unknown;
+    updatedAt: unknown;
+  }>;
+};
+type OrganizationCreated = EventOf<typeof organizationEvents.organizationCreated>;
+type OrganizationUpdated = EventOf<typeof organizationEvents.organizationUpdated>;
+type OrganizationDeleted = EventOf<typeof organizationEvents.organizationDeleted>;
+type OrgUserLinked = EventOf<typeof organizationEvents.orgUserLinked>;
+type OrgUserDeleted = EventOf<typeof organizationEvents.orgUserDeleted>;
+type InviteCreated = EventOf<typeof organizationEvents.inviteCreated>;
+type InviteAccepted = EventOf<typeof organizationEvents.inviteAccepted>;
+type StudentCreated = EventOf<typeof organizationEvents.studentCreated>;
+type StudentDeleted = EventOf<typeof organizationEvents.studentDeleted>;
+type StudentLinked = EventOf<typeof organizationEvents.studentLinked>;
+type OrganizationEvent = EventOfValues<typeof organizationEvents>;
+//#endregion
+export { InviteAccepted, InviteCreated, OrgUserDeleted, OrgUserLinked, OrganizationCreated, OrganizationDeleted, OrganizationEvent, OrganizationUpdated, StudentCreated, StudentDeleted, StudentLinked, organizationEvents };
+//# sourceMappingURL=events.d.ts.map