@lssm/lib.contracts-integrations 9.0.1

package/dist/integrations/byok.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Bring-Your-Own-Key (BYOK) management types and helpers.
+ *
+ * Extends the basic managed/byok ownership mode with validation,
+ * key rotation, and quota tracking capabilities.
+ */
+export interface ByokKeyValidationResult {
+    /** Whether the provided key is valid and usable. */
+    valid: boolean;
+    /** Scopes or permissions the key has access to. */
+    scopes?: string[];
+    /** Remaining quota by resource name (e.g. { "requests": 950 }). */
+    quotaRemaining?: Record<string, number>;
+    /** ISO-8601 expiration date for the key itself. */
+    expiresAt?: string;
+    /** Validation error details when valid is false. */
+    error?: string;
+    /** Provider-returned metadata (plan, tier, etc.). */
+    providerMeta?: Record<string, unknown>;
+}
+export interface ByokKeyRotationRequest {
+    /** Connection whose key should be rotated. */
+    connectionId: string;
+    /** Reason for the rotation. */
+    reason: 'scheduled' | 'compromised' | 'manual';
+    /** New secret reference (post-rotation). */
+    newSecretRef?: string;
+}
+export interface ByokKeyRotationResult {
+    success: boolean;
+    /** New secret reference after rotation. */
+    newSecretRef?: string;
+    /** ISO-8601 timestamp of the rotation. */
+    rotatedAt?: string;
+    error?: string;
+}
+export interface ByokKeyMetadata {
+    /** When the key was first stored. */
+    createdAt: string;
+    /** When the key was last rotated. */
+    lastRotatedAt?: string;
+    /** When the key was last validated against the provider. */
+    lastValidatedAt?: string;
+    /** Outcome of the last validation. */
+    validationStatus: 'valid' | 'invalid' | 'unknown';
+    /** Provider-reported quota snapshot from the last validation. */
+    quotaSnapshot?: Record<string, number>;
+}
+/**
+ * Interface that provider implementations can adopt to support
+ * BYOK key lifecycle operations.
+ */
+export interface ByokKeyLifecycle {
+    /**
+     * Validate a BYOK key against the provider and return capabilities.
+     *
+     * @param secrets Resolved secret key-value pairs from the store.
+     */
+    validateKey(secrets: Record<string, string>): Promise<ByokKeyValidationResult>;
+    /**
+     * Rotate the BYOK key (optional — not every provider supports this).
+     *
+     * When the provider issues a new key programmatically, this method
+     * should return the updated secret data; otherwise, the consumer
+     * must supply a new key manually.
+     */
+    rotateKey?(secrets: Record<string, string>, request: ByokKeyRotationRequest): Promise<ByokKeyRotationResult>;
+}
+/**
+ * Check whether a ByokKeyMetadata indicates a stale validation.
+ *
+ * @param meta      The key metadata
+ * @param maxAgeMs  Maximum allowed age since last validation (default: 24 h)
+ */
+export declare function isByokValidationStale(meta: ByokKeyMetadata, maxAgeMs?: number): boolean;

package/dist/integrations/byok.js

@@ -0,0 +1,2 @@
+// @bun
+function r(e,t=86400000){if(!e.lastValidatedAt)return!0;return Date.now()-new Date(e.lastValidatedAt).getTime()>t}export{r as isByokValidationStale};

package/dist/integrations/byok.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/integrations/catalog.d.ts

@@ -0,0 +1,84 @@
+import type { IntegrationCategory, IntegrationOwnershipMode, IntegrationSpec } from './spec.js';
+export type IntegrationCatalogRecordKind = 'integration-spec' | 'integration-package' | 'provider-implementation' | 'exception';
+export type IntegrationCatalogAvailability = 'available' | 'hidden' | 'disabled' | 'exception';
+export type IntegrationConnectionActivation = 'not-connected' | 'active' | 'inactive' | 'pending' | 'disabled' | 'error' | 'unknown';
+export interface IntegrationCatalogDefinition {
+    readonly id: string;
+    readonly key: string;
+    readonly version: string;
+    readonly label: string;
+    readonly description?: string;
+    readonly recordKind: IntegrationCatalogRecordKind;
+    readonly category: IntegrationCategory | string;
+    readonly sourcePackage: string;
+    readonly sourcePath: string;
+    readonly supportedModes: readonly IntegrationOwnershipMode[];
+    readonly managedSupport: boolean;
+    readonly byokSupport: boolean;
+    readonly tags: readonly string[];
+    readonly searchText: string;
+    readonly transports: readonly string[];
+    readonly authMethods: readonly string[];
+    readonly providerKey: string;
+    readonly implementationKeys: readonly string[];
+    readonly exceptionRationale?: string;
+}
+export interface IntegrationCatalogAvailabilityOverlay {
+    readonly definitionId: string;
+    readonly availability: IntegrationCatalogAvailability;
+    readonly reason?: string;
+}
+export interface IntegrationConnectionActivationSummary {
+    readonly definitionId: string;
+    readonly activation: IntegrationConnectionActivation;
+    readonly connectionCount?: number;
+    readonly activeConnectionModes?: readonly IntegrationOwnershipMode[];
+}
+export interface IntegrationCatalogViewRecord extends IntegrationCatalogDefinition {
+    readonly catalogAvailability: IntegrationCatalogAvailability;
+    readonly availabilityReason?: string;
+    readonly connectionActivation: IntegrationConnectionActivation;
+    readonly connectionCount: number;
+    readonly activeConnectionModes: readonly IntegrationOwnershipMode[];
+}
+export interface IntegrationCatalogFilters {
+    readonly category?: string | readonly string[];
+    readonly recordKind?: IntegrationCatalogRecordKind | readonly IntegrationCatalogRecordKind[];
+    readonly search?: string;
+    readonly ownershipMode?: IntegrationOwnershipMode | readonly IntegrationOwnershipMode[];
+    readonly catalogAvailability?: IntegrationCatalogAvailability | readonly IntegrationCatalogAvailability[];
+    readonly connectionActivation?: IntegrationConnectionActivation | readonly IntegrationConnectionActivation[];
+    readonly transport?: string | readonly string[];
+    readonly authMethod?: string | readonly string[];
+    readonly includeExceptions?: boolean;
+}
+export interface IntegrationCatalog {
+    readonly definitions: readonly IntegrationCatalogDefinition[];
+}
+type IntegrationCatalogDefinitionInput = Omit<IntegrationCatalogDefinition, 'managedSupport' | 'byokSupport' | 'searchText'> & {
+    readonly managedSupport: boolean | {
+        readonly supported: boolean;
+        readonly exceptionRationale?: string;
+    };
+    readonly byokSupport: boolean | {
+        readonly supported: boolean;
+        readonly exceptionRationale?: string;
+    };
+    readonly searchText?: string;
+};
+export declare function defineIntegrationCatalogDefinition(input: IntegrationCatalogDefinitionInput): IntegrationCatalogDefinition;
+export declare function createIntegrationCatalog(definitions: readonly IntegrationCatalogDefinition[]): IntegrationCatalog;
+export declare function projectIntegrationSpecToCatalogDefinition(spec: IntegrationSpec, options?: {
+    readonly sourcePackage?: string;
+    readonly sourcePath?: string;
+}): IntegrationCatalogDefinition;
+export declare function joinIntegrationCatalogView(definitions: readonly IntegrationCatalogDefinition[], availabilityOverlays?: readonly IntegrationCatalogAvailabilityOverlay[], activationSummaries?: readonly IntegrationConnectionActivationSummary[]): readonly IntegrationCatalogViewRecord[];
+export declare function queryIntegrationCatalog(catalog: IntegrationCatalog | readonly IntegrationCatalogDefinition[], filters?: IntegrationCatalogFilters): readonly IntegrationCatalogDefinition[];
+export declare function filterIntegrationCatalog<T extends IntegrationCatalogViewRecord>(records: readonly T[], filters?: IntegrationCatalogFilters): readonly T[];
+export declare function catalogDefinitionId(input: {
+    readonly recordKind: IntegrationCatalogRecordKind;
+    readonly key: string;
+    readonly version: string;
+    readonly sourcePackage: string;
+}): string;
+export {};

package/dist/integrations/catalog.js

@@ -0,0 +1,2 @@
+// @bun
+function s(e){return e.credentialManifest??h(e)}function K(e,n){if(!e.supportedModes.includes(n))return;return s(e).modes?.[n]}function D(e){let n=s(e);if(n.exempt)return!0;return e.supportedModes.every((t)=>Boolean(n.modes?.[t]))}function f(e){if(!e.supportedModes.includes("managed"))return!0;let n=s(e);if(n.exempt)return!0;return Boolean(n.modes?.managed?.evidence?.length)}function h(e){let n=u(e.configSchema.schema),t=u(e.secretSchema.schema),o={};for(let r of e.supportedModes)o[r]={mode:r,configFields:n,secretFields:t,validationStrategy:r==="byok"&&e.byokSetup?"byok-lifecycle":"static-schema",rotation:{supported:r==="byok"?e.byokSetup?.keyRotationSupported===!0:!1},setupSteps:r==="byok"?e.byokSetup?.provisioningSteps??(e.byokSetup?.setupInstructions?[e.byokSetup.setupInstructions]:void 0):void 0,docsUrl:e.docsUrl,evidence:r==="managed"?x(e,t):void 0};return{modes:o}}function x(e,n){let t=[];if(e.docsUrl)t.push({kind:"provider-docs",ref:e.docsUrl,description:"Provider documentation anchors managed integration setup."});for(let o of e.supportedAuthMethods??[])t.push({kind:"auth-method",ref:o.type,description:"Supported auth method can be brokered without exposing raw secrets."});for(let o of n)t.push({kind:"secret-schema",ref:o.key,description:o.description??"Required secret is represented by schema and must be stored by reference."});return t.length?t:void 0}function u(e){if(!g(e))return[];let n=Array.isArray(e.required)?new Set(e.required.filter((o)=>typeof o==="string")):new Set,t=g(e.properties)?e.properties:{};return Object.entries(t).map(([o,r])=>({key:o,required:n.has(o),description:g(r)&&typeof r.description==="string"?r.description:void 0}))}function g(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function F(e){let n=I(e.managedSupport),t=I(e.byokSupport);return{...e,managedSupport:n,byokSupport:t,supportedModes:[...e.supportedModes].sort(),tags:[...e.tags].sort(),transports:[...e.transports].sort(),authMethods:[...e.authMethods].sort(),implementationKeys:[...e.implementationKeys].sort(),searchText:e.searchText??C([e.key,e.label,e.description,e.category,...e.tags,...e.transports,...e.authMethods,...e.implementationKeys])}}function I(e){return typeof e==="boolean"?e:e.supported}function O(e){return{definitions:[...e].sort(y)}}function E(e,n){let t=s(e),o=[...e.supportedModes].sort(),r=o.includes("managed"),i=o.includes("byok"),d=[...e.meta.tags??[]].sort(),a=R(e.transports),p=w(e.supportedAuthMethods),b=k({recordKind:"integration-spec",key:e.meta.key,version:e.meta.version,sourcePackage:n?.sourcePackage??"@lssm/lib.contracts-integrations"}),v=t.exempt&&t.exemptionReason?t.exemptionReason:r&&!f(e)?"Managed mode is declared without evidence; add credentialManifest evidence before production exposure.":void 0;return{id:b,key:e.meta.key,version:e.meta.version,label:e.meta.title??e.meta.key,description:e.meta.description,recordKind:"integration-spec",category:e.meta.category,sourcePackage:n?.sourcePackage??"@lssm/lib.contracts-integrations",sourcePath:n?.sourcePath??`packages/libs/contracts-integrations/src/integrations/providers/${e.meta.key}.ts`,supportedModes:o,managedSupport:r,byokSupport:i,tags:d,searchText:C([e.meta.key,e.meta.title,e.meta.description,e.meta.category,...d,...a,...p]),transports:a,authMethods:p,providerKey:e.meta.key,implementationKeys:[],exceptionRationale:v}}function q(e,n=[],t=[]){let o=new Map(n.map((i)=>[i.definitionId,i])),r=new Map(t.map((i)=>[i.definitionId,i]));return e.map((i)=>{let d=o.get(i.id),a=r.get(i.id);return{...i,catalogAvailability:d?.availability??(i.recordKind==="exception"?"exception":"available"),availabilityReason:d?.reason,connectionActivation:a?.activation??"not-connected",connectionCount:a?.connectionCount??0,activeConnectionModes:a?.activeConnectionModes??[]}})}function V(e,n={}){let t=M(e)?e.definitions:e;return[...S(t,n)].sort(y)}function M(e){return!Array.isArray(e)}function j(e,n={}){return e.filter((t)=>m(t,n)).filter((t)=>l(t.catalogAvailability,n.catalogAvailability)).filter((t)=>l(t.connectionActivation,n.connectionActivation)).sort(y)}function k(e){return[e.recordKind,e.sourcePackage,e.key,e.version].map((n)=>n.replace(/[^a-z0-9]+/gi,"-").toLowerCase()).join(":")}function S(e,n){return e.filter((t)=>n.includeExceptions||t.recordKind!=="exception").filter((t)=>m(t,n))}function m(e,n){return l(e.category,n.category)&&l(e.recordKind,n.recordKind)&&c(e.supportedModes,n.ownershipMode)&&c(e.transports,n.transport)&&c(e.authMethods,n.authMethod)&&A(e.searchText,n.search)}function l(e,n){if(!n)return!0;return(Array.isArray(n)?n:[n]).includes(e)}function c(e,n){if(!n)return!0;return(Array.isArray(n)?n:[n]).some((o)=>e.includes(o))}function A(e,n){if(!n?.trim())return!0;return e.includes(n.trim().toLowerCase())}function C(e){return e.filter((n)=>typeof n==="string"&&n.length>0).join(" ").toLowerCase()}function R(e){return[...new Set((e??[]).map((n)=>n.type))].sort()}function w(e){return[...new Set((e??[]).map((n)=>n.type))].sort()}function y(e,n){return e.recordKind.localeCompare(n.recordKind)||e.key.localeCompare(n.key)||e.version.localeCompare(n.version)||e.id.localeCompare(n.id)}export{k as catalogDefinitionId,O as createIntegrationCatalog,F as defineIntegrationCatalogDefinition,j as filterIntegrationCatalog,q as joinIntegrationCatalogView,E as projectIntegrationSpecToCatalogDefinition,V as queryIntegrationCatalog};

package/dist/integrations/catalog.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/integrations/clay/events.d.ts

@@ -0,0 +1,93 @@
+import { EventRegistry } from '@lssm/lib.contracts-spec/events';
+import { SchemaModel } from '@lssm/lib.schema';
+export declare const ClayHttpActionCallbackPayload: SchemaModel<{
+    connectionId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    deliveryId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    callbackId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    runId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    routineId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: true;
+    };
+    receivedAt: {
+        type: import("@lssm/lib.schema").FieldType<Date, string>;
+        isOptional: false;
+    };
+    payload: {
+        type: import("@lssm/lib.schema").FieldType<Record<string, unknown>, Record<string, unknown>>;
+        isOptional: false;
+    };
+}>;
+export declare const ClayHttpActionReceivedEvent: import("@lssm/lib.contracts-spec").EventSpec<SchemaModel<{
+    connectionId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    deliveryId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    callbackId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    runId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    routineId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: true;
+    };
+    receivedAt: {
+        type: import("@lssm/lib.schema").FieldType<Date, string>;
+        isOptional: false;
+    };
+    payload: {
+        type: import("@lssm/lib.schema").FieldType<Record<string, unknown>, Record<string, unknown>>;
+        isOptional: false;
+    };
+}>>;
+export declare const clayWebhookEvents: readonly [import("@lssm/lib.contracts-spec").EventSpec<SchemaModel<{
+    connectionId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    deliveryId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    callbackId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    runId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    routineId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: true;
+    };
+    receivedAt: {
+        type: import("@lssm/lib.schema").FieldType<Date, string>;
+        isOptional: false;
+    };
+    payload: {
+        type: import("@lssm/lib.schema").FieldType<Record<string, unknown>, Record<string, unknown>>;
+        isOptional: false;
+    };
+}>>];
+export declare function registerClayWebhookEvents(registry: EventRegistry): EventRegistry;

package/dist/integrations/clay/events.js

@@ -0,0 +1,2 @@
+// @bun
+import{defineEvent as l}from"@lssm/lib.contracts-spec/events";import{ScalarTypeEnum as t,SchemaModel as n}from"@lssm/lib.schema";var e=t.NonEmptyString(),o=new n({name:"ClayHttpActionCallbackPayload",fields:{connectionId:{type:e,isOptional:!1},deliveryId:{type:e,isOptional:!1},callbackId:{type:e,isOptional:!1},runId:{type:e,isOptional:!1},routineId:{type:e,isOptional:!0},receivedAt:{type:t.DateTime(),isOptional:!1},payload:{type:t.JSONObject(),isOptional:!1}}}),a=l({meta:{key:"sales-intelligence.clay.callback.received",version:"1.0.0",description:"Normalized Clay HTTP action callback received.",stability:"beta",owners:["@platform.integrations"],tags:["sales-intelligence","clay","webhook"]},pii:["payload"],payload:o}),r=[a];function y(i){return i.register(a)}export{o as ClayHttpActionCallbackPayload,a as ClayHttpActionReceivedEvent,r as clayWebhookEvents,y as registerClayWebhookEvents};

package/dist/integrations/clay/events.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/integrations/clay/index.d.ts

@@ -0,0 +1,2 @@
+export * from './events.js';
+export * from './operations.js';

package/dist/integrations/clay/index.js

@@ -0,0 +1,2 @@
+// @bun
+import{defineEvent as x}from"@lssm/lib.contracts-spec/events";import{ScalarTypeEnum as p,SchemaModel as k}from"@lssm/lib.schema";var a=p.NonEmptyString(),g=new k({name:"ClayHttpActionCallbackPayload",fields:{connectionId:{type:a,isOptional:!1},deliveryId:{type:a,isOptional:!1},callbackId:{type:a,isOptional:!1},runId:{type:a,isOptional:!1},routineId:{type:a,isOptional:!0},receivedAt:{type:p.DateTime(),isOptional:!1},payload:{type:p.JSONObject(),isOptional:!1}}}),u=x({meta:{key:"sales-intelligence.clay.callback.received",version:"1.0.0",description:"Normalized Clay HTTP action callback received.",stability:"beta",owners:["@platform.integrations"],tags:["sales-intelligence","clay","webhook"]},pii:["payload"],payload:g}),N=[u];function M(t){return t.register(u)}import{defineCommand as C,defineQuery as h}from"@lssm/lib.contracts-spec/operations";import{ScalarTypeEnum as r,SchemaModel as i}from"@lssm/lib.schema";var o=r.JSONObject(),e=r.NonEmptyString(),y=new i({name:"GtmConnectionInput",fields:{connectionId:{type:e,isOptional:!1},correlationId:{type:e,isOptional:!0}}}),W=new i({name:"GtmResourceInput",fields:{connectionId:{type:e,isOptional:!1},resourceId:{type:e,isOptional:!0},parentId:{type:e,isOptional:!0},cursor:{type:e,isOptional:!0},payload:{type:o,isOptional:!0},filters:{type:o,isOptional:!0},correlationId:{type:e,isOptional:!0},idempotencyKey:{type:e,isOptional:!0}}}),d=new i({name:"GtmCollectionInput",fields:{connectionId:{type:e,isOptional:!1},cursor:{type:e,isOptional:!0},filters:{type:o,isOptional:!0},correlationId:{type:e,isOptional:!0}}}),m=new i({name:"GtmResourceIdInput",fields:{connectionId:{type:e,isOptional:!1},resourceId:{type:e,isOptional:!1},correlationId:{type:e,isOptional:!0}}}),H=new i({name:"GtmNestedResourceIdInput",fields:{connectionId:{type:e,isOptional:!1},parentId:{type:e,isOptional:!1},resourceId:{type:e,isOptional:!1},correlationId:{type:e,isOptional:!0}}}),f=new i({name:"GtmCreateInput",fields:{connectionId:{type:e,isOptional:!1},payload:{type:o,isOptional:!1},correlationId:{type:e,isOptional:!0},idempotencyKey:{type:e,isOptional:!0}}}),P=new i({name:"GtmNestedCreateInput",fields:{connectionId:{type:e,isOptional:!1},parentId:{type:e,isOptional:!1},payload:{type:o,isOptional:!1},correlationId:{type:e,isOptional:!0},idempotencyKey:{type:e,isOptional:!0}}}),O=new i({name:"GtmUpdateInput",fields:{connectionId:{type:e,isOptional:!1},resourceId:{type:e,isOptional:!1},payload:{type:o,isOptional:!1},correlationId:{type:e,isOptional:!0},idempotencyKey:{type:e,isOptional:!0}}}),K=new i({name:"GtmNestedUpdateInput",fields:{connectionId:{type:e,isOptional:!1},parentId:{type:e,isOptional:!1},resourceId:{type:e,isOptional:!1},payload:{type:o,isOptional:!1},correlationId:{type:e,isOptional:!0},idempotencyKey:{type:e,isOptional:!0}}}),L=new i({name:"GtmAttributeChildInput",fields:{connectionId:{type:e,isOptional:!1},parentId:{type:e,isOptional:!1},resourceId:{type:e,isOptional:!1},childId:{type:e,isOptional:!0},payload:{type:o,isOptional:!0},correlationId:{type:e,isOptional:!0}}}),U=new i({name:"GtmNestedQueryInput",fields:{connectionId:{type:e,isOptional:!1},parentId:{type:e,isOptional:!1},cursor:{type:e,isOptional:!0},filters:{type:o,isOptional:!0},correlationId:{type:e,isOptional:!0}}}),I=new i({name:"GtmResourceOutput",fields:{data:{type:o,isOptional:!1},nextCursor:{type:e,isOptional:!0},requestId:{type:e,isOptional:!0}}}),_=new i({name:"GtmWebhookInput",fields:{connectionId:{type:e,isOptional:!1},deliveryId:{type:e,isOptional:!0},headers:{type:o,isOptional:!1},payload:{type:o,isOptional:!1},correlationId:{type:e,isOptional:!0}}}),j=new i({name:"GtmWebhookReceiptOutput",fields:{accepted:{type:r.Boolean(),isOptional:!1},duplicate:{type:r.Boolean(),isOptional:!1},receiptId:{type:e,isOptional:!1},verificationStatus:{type:e,isOptional:!1}}}),b=new i({name:"HostedMcpDescriptorOutput",fields:{descriptor:{type:o,isOptional:!1}}});var G="1.0.0",w=[{suffix:"identity.get",title:"Get Clay identity",kind:"query",stability:"beta"},{suffix:"searches.create",title:"Create Clay search",kind:"command",stability:"beta"},{suffix:"searches.get",title:"Get Clay search",kind:"query",stability:"beta"},{suffix:"searches.results.list",title:"List Clay search results",kind:"query",stability:"beta"},{suffix:"routines.list",title:"List Clay routines",kind:"query",stability:"beta"},{suffix:"routines.get",title:"Get Clay routine",kind:"query",stability:"beta"},{suffix:"routines.execute",title:"Execute Clay routine",kind:"command",stability:"beta"},{suffix:"runs.get",title:"Get Clay run",kind:"query",stability:"beta"},{suffix:"tables.list",title:"List Clay tables",kind:"query",stability:"beta"},{suffix:"tables.get",title:"Get Clay table",kind:"query",stability:"beta"},{suffix:"tables.records.list",title:"List Clay table records",kind:"query",stability:"beta"},{suffix:"workflows.list",title:"List Clay workflows",kind:"query"},{suffix:"workflows.get",title:"Get Clay workflow",kind:"query"},{suffix:"workflows.execute",title:"Execute Clay workflow",kind:"command"},{suffix:"webhook-table.trigger",title:"Trigger Clay webhook table",kind:"command"},{suffix:"mcp.remote.describe",title:"Describe Clay hosted MCP",kind:"query",input:y,output:b}];function v(t){let n=`sales-intelligence.clay.${t.suffix}`,s=["searches.create","routines.execute","workflows.execute"].includes(t.suffix),l=t.kind==="query"?["read"]:s?["write","cost-bearing","external-side-effect"]:["write","external-side-effect"],c={meta:{key:n,version:G,title:t.title,description:`${t.title} through Clay's documented developer platform.`,goal:t.title,context:"Public API capabilities are beta; Workflows are alpha and require an explicit capability opt-in. Tables are Enterprise and read-only.",owners:["@platform.integrations"],tags:["sales-intelligence","clay","gtm"],stability:t.stability??"experimental"},io:{input:t.input??R(t.suffix),output:t.output??I},policy:{auth:"user",policies:[],idempotent:t.kind==="query",escalate:t.kind==="command"?"human_review":null},execution:t.kind==="command"?{effects:l,approval:{required:!0,effects:l}}:{effects:l},economicEvidence:s?{required:!0,modelVersion:"provider-reported-v1",refs:[{id:`usage:clay:${t.suffix}`,kind:"usage",source:"@lssm/integration.provider-clay"},{id:`cost:clay:${t.suffix}`,kind:"cost",source:"@lssm/integration.provider-clay"}]}:void 0,transport:{rest:{method:t.kind==="command"?"POST":"GET",path:`/api/contracts/${n}/v1.0.0`},mcp:{toolName:`${n.replaceAll(".","_")}-v1_0_0`}}};return t.kind==="command"?C(c):h(c)}function R(t){if(t.endsWith(".list")||t==="identity.get"||t==="mcp.remote.describe")return d;if(t==="searches.create"||t==="webhook-table.trigger")return f;if(t.endsWith(".execute"))return O;return m}var q=w.map(v);function z(t){return q.reduce((n,s)=>n.register(s),t)}export{g as ClayHttpActionCallbackPayload,u as ClayHttpActionReceivedEvent,q as clayOperations,N as clayWebhookEvents,z as registerClayOperations,M as registerClayWebhookEvents};

package/dist/integrations/clay/operations.d.ts

@@ -0,0 +1,4 @@
+import { type AnyOperationSpec } from '@lssm/lib.contracts-spec/operations';
+import type { OperationSpecRegistry } from '@lssm/lib.contracts-spec/operations/registry';
+export declare const clayOperations: readonly AnyOperationSpec[];
+export declare function registerClayOperations(registry: OperationSpecRegistry): OperationSpecRegistry;

package/dist/integrations/clay/operations.js

@@ -0,0 +1,2 @@
+// @bun
+import{defineCommand as O,defineQuery as I}from"@lssm/lib.contracts-spec/operations";import{ScalarTypeEnum as a,SchemaModel as i}from"@lssm/lib.schema";var n=a.JSONObject(),e=a.NonEmptyString(),l=new i({name:"GtmConnectionInput",fields:{connectionId:{type:e,isOptional:!1},correlationId:{type:e,isOptional:!0}}}),w=new i({name:"GtmResourceInput",fields:{connectionId:{type:e,isOptional:!1},resourceId:{type:e,isOptional:!0},parentId:{type:e,isOptional:!0},cursor:{type:e,isOptional:!0},payload:{type:n,isOptional:!0},filters:{type:n,isOptional:!0},correlationId:{type:e,isOptional:!0},idempotencyKey:{type:e,isOptional:!0}}}),c=new i({name:"GtmCollectionInput",fields:{connectionId:{type:e,isOptional:!1},cursor:{type:e,isOptional:!0},filters:{type:n,isOptional:!0},correlationId:{type:e,isOptional:!0}}}),u=new i({name:"GtmResourceIdInput",fields:{connectionId:{type:e,isOptional:!1},resourceId:{type:e,isOptional:!1},correlationId:{type:e,isOptional:!0}}}),g=new i({name:"GtmNestedResourceIdInput",fields:{connectionId:{type:e,isOptional:!1},parentId:{type:e,isOptional:!1},resourceId:{type:e,isOptional:!1},correlationId:{type:e,isOptional:!0}}}),y=new i({name:"GtmCreateInput",fields:{connectionId:{type:e,isOptional:!1},payload:{type:n,isOptional:!1},correlationId:{type:e,isOptional:!0},idempotencyKey:{type:e,isOptional:!0}}}),q=new i({name:"GtmNestedCreateInput",fields:{connectionId:{type:e,isOptional:!1},parentId:{type:e,isOptional:!1},payload:{type:n,isOptional:!1},correlationId:{type:e,isOptional:!0},idempotencyKey:{type:e,isOptional:!0}}}),d=new i({name:"GtmUpdateInput",fields:{connectionId:{type:e,isOptional:!1},resourceId:{type:e,isOptional:!1},payload:{type:n,isOptional:!1},correlationId:{type:e,isOptional:!0},idempotencyKey:{type:e,isOptional:!0}}}),R=new i({name:"GtmNestedUpdateInput",fields:{connectionId:{type:e,isOptional:!1},parentId:{type:e,isOptional:!1},resourceId:{type:e,isOptional:!1},payload:{type:n,isOptional:!1},correlationId:{type:e,isOptional:!0},idempotencyKey:{type:e,isOptional:!0}}}),S=new i({name:"GtmAttributeChildInput",fields:{connectionId:{type:e,isOptional:!1},parentId:{type:e,isOptional:!1},resourceId:{type:e,isOptional:!1},childId:{type:e,isOptional:!0},payload:{type:n,isOptional:!0},correlationId:{type:e,isOptional:!0}}}),v=new i({name:"GtmNestedQueryInput",fields:{connectionId:{type:e,isOptional:!1},parentId:{type:e,isOptional:!1},cursor:{type:e,isOptional:!0},filters:{type:n,isOptional:!0},correlationId:{type:e,isOptional:!0}}}),m=new i({name:"GtmResourceOutput",fields:{data:{type:n,isOptional:!1},nextCursor:{type:e,isOptional:!0},requestId:{type:e,isOptional:!0}}}),N=new i({name:"GtmWebhookInput",fields:{connectionId:{type:e,isOptional:!1},deliveryId:{type:e,isOptional:!0},headers:{type:n,isOptional:!1},payload:{type:n,isOptional:!1},correlationId:{type:e,isOptional:!0}}}),A=new i({name:"GtmWebhookReceiptOutput",fields:{accepted:{type:a.Boolean(),isOptional:!1},duplicate:{type:a.Boolean(),isOptional:!1},receiptId:{type:e,isOptional:!1},verificationStatus:{type:e,isOptional:!1}}}),f=new i({name:"HostedMcpDescriptorOutput",fields:{descriptor:{type:n,isOptional:!1}}});var b="1.0.0",x=[{suffix:"identity.get",title:"Get Clay identity",kind:"query",stability:"beta"},{suffix:"searches.create",title:"Create Clay search",kind:"command",stability:"beta"},{suffix:"searches.get",title:"Get Clay search",kind:"query",stability:"beta"},{suffix:"searches.results.list",title:"List Clay search results",kind:"query",stability:"beta"},{suffix:"routines.list",title:"List Clay routines",kind:"query",stability:"beta"},{suffix:"routines.get",title:"Get Clay routine",kind:"query",stability:"beta"},{suffix:"routines.execute",title:"Execute Clay routine",kind:"command",stability:"beta"},{suffix:"runs.get",title:"Get Clay run",kind:"query",stability:"beta"},{suffix:"tables.list",title:"List Clay tables",kind:"query",stability:"beta"},{suffix:"tables.get",title:"Get Clay table",kind:"query",stability:"beta"},{suffix:"tables.records.list",title:"List Clay table records",kind:"query",stability:"beta"},{suffix:"workflows.list",title:"List Clay workflows",kind:"query"},{suffix:"workflows.get",title:"Get Clay workflow",kind:"query"},{suffix:"workflows.execute",title:"Execute Clay workflow",kind:"command"},{suffix:"webhook-table.trigger",title:"Trigger Clay webhook table",kind:"command"},{suffix:"mcp.remote.describe",title:"Describe Clay hosted MCP",kind:"query",input:l,output:f}];function G(t){let o=`sales-intelligence.clay.${t.suffix}`,s=["searches.create","routines.execute","workflows.execute"].includes(t.suffix),r=t.kind==="query"?["read"]:s?["write","cost-bearing","external-side-effect"]:["write","external-side-effect"],p={meta:{key:o,version:b,title:t.title,description:`${t.title} through Clay's documented developer platform.`,goal:t.title,context:"Public API capabilities are beta; Workflows are alpha and require an explicit capability opt-in. Tables are Enterprise and read-only.",owners:["@platform.integrations"],tags:["sales-intelligence","clay","gtm"],stability:t.stability??"experimental"},io:{input:t.input??k(t.suffix),output:t.output??m},policy:{auth:"user",policies:[],idempotent:t.kind==="query",escalate:t.kind==="command"?"human_review":null},execution:t.kind==="command"?{effects:r,approval:{required:!0,effects:r}}:{effects:r},economicEvidence:s?{required:!0,modelVersion:"provider-reported-v1",refs:[{id:`usage:clay:${t.suffix}`,kind:"usage",source:"@lssm/integration.provider-clay"},{id:`cost:clay:${t.suffix}`,kind:"cost",source:"@lssm/integration.provider-clay"}]}:void 0,transport:{rest:{method:t.kind==="command"?"POST":"GET",path:`/api/contracts/${o}/v1.0.0`},mcp:{toolName:`${o.replaceAll(".","_")}-v1_0_0`}}};return t.kind==="command"?O(p):I(p)}function k(t){if(t.endsWith(".list")||t==="identity.get"||t==="mcp.remote.describe")return c;if(t==="searches.create"||t==="webhook-table.trigger")return y;if(t.endsWith(".execute"))return d;return u}var C=x.map(G);function W(t){return C.reduce((o,s)=>o.register(s),t)}export{C as clayOperations,W as registerClayOperations};

package/dist/integrations/clay/operations.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/integrations/connection.d.ts

@@ -0,0 +1,68 @@
+import type { IntegrationAuthType, OAuth2TokenState } from './auth.js';
+import type { ByokKeyMetadata } from './byok.js';
+import type { IntegrationCredentialReference } from './credentials.js';
+import type { IntegrationOwnershipMode } from './spec.js';
+import type { IntegrationTransportType } from './transport.js';
+export type ConnectionStatus = 'connected' | 'disconnected' | 'error' | 'unknown';
+export interface IntegrationConnectionHealth {
+    status: ConnectionStatus;
+    checkedAt?: Date;
+    latencyMs?: number;
+    errorCode?: string;
+    errorMessage?: string;
+}
+export interface IntegrationUsageMetrics {
+    requestCount?: number;
+    successCount?: number;
+    errorCount?: number;
+    lastUsed?: Date;
+    lastSuccessAt?: Date;
+    lastErrorAt?: Date;
+    lastErrorCode?: string;
+}
+export interface IntegrationConnectionMeta {
+    id: string;
+    tenantId: string;
+    /** Reference to IntegrationSpec. */
+    integrationKey: string;
+    integrationVersion: string;
+    /** Human-readable label (e.g., "Production Stripe"). */
+    label: string;
+    environment?: string;
+    createdAt: string | Date;
+    updatedAt: string | Date;
+}
+export interface IntegrationConnection {
+    meta: IntegrationConnectionMeta;
+    /** Ownership mode indicating who controls credentials. */
+    ownershipMode: IntegrationOwnershipMode;
+    /** External provider account/project identifier (BYOK scenarios). */
+    externalAccountId?: string;
+    /** Encrypted configuration matching IntegrationSpec.configSchema. */
+    config: Record<string, unknown>;
+    /** Reference to external secret store entry containing credentials. */
+    secretProvider: string;
+    secretRef: string;
+    status: ConnectionStatus;
+    /** Last health check result. */
+    health?: IntegrationConnectionHealth;
+    /** Usage tracking. */
+    usage?: IntegrationUsageMetrics;
+    /** Which transport this connection is currently using. */
+    activeTransport?: IntegrationTransportType;
+    /** Transport-specific runtime config overrides. */
+    transportConfig?: Record<string, unknown>;
+    /** Which auth method this connection is using. */
+    authMethod?: IntegrationAuthType;
+    /** OAuth2 token state when authMethod is "oauth2". */
+    oauth2State?: OAuth2TokenState;
+    /**
+     * Redacted reference to externally stored credential material. New
+     * integrations should prefer this over embedding OAuth token state.
+     */
+    credentialReference?: IntegrationCredentialReference;
+    /** Provider API version this connection targets. */
+    apiVersion?: string;
+    /** BYOK key lifecycle metadata (only when ownershipMode is "byok"). */
+    byokKeyMetadata?: ByokKeyMetadata;
+}

package/dist/integrations/connection.js

@@ -0,0 +1 @@
+// @bun

package/dist/integrations/credentials.d.ts

@@ -0,0 +1,56 @@
+import type { IntegrationOwnershipMode, IntegrationSpec } from './spec.js';
+export interface IntegrationCredentialReference {
+    kind: string;
+    providerKey: string;
+    secretProvider: string;
+    secretRef: string;
+    version: number;
+    updatedAt: string;
+}
+export type CredentialValidationStrategy = 'static-schema' | 'provider-health' | 'byok-lifecycle' | 'custom';
+export interface IntegrationCredentialFieldRef {
+    key: string;
+    required?: boolean;
+    description?: string;
+    envVar?: string;
+}
+export interface IntegrationCredentialAlias {
+    logicalKey: string;
+    envVar: string;
+    targetId?: string;
+    public?: boolean;
+}
+export interface IntegrationCredentialRotationPolicy {
+    supported?: boolean;
+    recommendedIntervalDays?: number;
+}
+export type IntegrationCredentialEvidenceKind = 'provider-docs' | 'auth-method' | 'secret-schema' | 'managed-broker' | 'operator-runbook' | 'custom';
+export interface IntegrationCredentialEvidenceRef {
+    kind: IntegrationCredentialEvidenceKind;
+    /** Stable pointer to public docs, internal runbook, auth contract, schema field, or audit artifact. */
+    ref: string;
+    description?: string;
+}
+export interface IntegrationCredentialModeManifest {
+    mode: IntegrationOwnershipMode;
+    configFields?: IntegrationCredentialFieldRef[];
+    secretFields?: IntegrationCredentialFieldRef[];
+    envAliases?: IntegrationCredentialAlias[];
+    allowedSecretProviders?: string[];
+    validationStrategy?: CredentialValidationStrategy;
+    rotation?: IntegrationCredentialRotationPolicy;
+    setupSteps?: string[];
+    docsUrl?: string;
+    /** Evidence supporting this mode without embedding raw credentials or tenant secrets. */
+    evidence?: IntegrationCredentialEvidenceRef[];
+}
+export interface IntegrationCredentialManifest {
+    modes?: Partial<Record<IntegrationOwnershipMode, IntegrationCredentialModeManifest>>;
+    exempt?: boolean;
+    exemptionReason?: string;
+}
+export declare function getIntegrationCredentialManifest(spec: IntegrationSpec): IntegrationCredentialManifest;
+export declare function getIntegrationCredentialRequirements(spec: IntegrationSpec, mode: IntegrationOwnershipMode): IntegrationCredentialModeManifest | undefined;
+export declare function integrationHasCredentialCoverage(spec: IntegrationSpec): boolean;
+export declare function integrationHasManagedSupportEvidence(spec: IntegrationSpec): boolean;
+export declare function buildLegacyCredentialManifest(spec: IntegrationSpec): IntegrationCredentialManifest;

package/dist/integrations/credentials.js

@@ -0,0 +1,2 @@
+// @bun
+function a(e){return e.credentialManifest??s(e)}function p(e,t){if(!e.supportedModes.includes(t))return;return a(e).modes?.[t]}function u(e){let t=a(e);if(t.exempt)return!0;return e.supportedModes.every((n)=>Boolean(t.modes?.[n]))}function g(e){if(!e.supportedModes.includes("managed"))return!0;let t=a(e);if(t.exempt)return!0;return Boolean(t.modes?.managed?.evidence?.length)}function s(e){let t=d(e.configSchema.schema),n=d(e.secretSchema.schema),r={};for(let i of e.supportedModes)r[i]={mode:i,configFields:t,secretFields:n,validationStrategy:i==="byok"&&e.byokSetup?"byok-lifecycle":"static-schema",rotation:{supported:i==="byok"?e.byokSetup?.keyRotationSupported===!0:!1},setupSteps:i==="byok"?e.byokSetup?.provisioningSteps??(e.byokSetup?.setupInstructions?[e.byokSetup.setupInstructions]:void 0):void 0,docsUrl:e.docsUrl,evidence:i==="managed"?c(e,n):void 0};return{modes:r}}function c(e,t){let n=[];if(e.docsUrl)n.push({kind:"provider-docs",ref:e.docsUrl,description:"Provider documentation anchors managed integration setup."});for(let r of e.supportedAuthMethods??[])n.push({kind:"auth-method",ref:r.type,description:"Supported auth method can be brokered without exposing raw secrets."});for(let r of t)n.push({kind:"secret-schema",ref:r.key,description:r.description??"Required secret is represented by schema and must be stored by reference."});return n.length?n:void 0}function d(e){if(!o(e))return[];let t=Array.isArray(e.required)?new Set(e.required.filter((r)=>typeof r==="string")):new Set,n=o(e.properties)?e.properties:{};return Object.entries(n).map(([r,i])=>({key:r,required:t.has(r),description:o(i)&&typeof i.description==="string"?i.description:void 0}))}function o(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}export{s as buildLegacyCredentialManifest,a as getIntegrationCredentialManifest,p as getIntegrationCredentialRequirements,u as integrationHasCredentialCoverage,g as integrationHasManagedSupportEvidence};

package/dist/integrations/credentials.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/integrations/deployment-topology-model.d.ts

@@ -0,0 +1,75 @@
+/** Independent infrastructure axes for managed, vertical, and customer-hosted integrations. */
+export type IntegrationOperator = 'lssm' | 'vertical' | 'customer';
+export type IntegrationRuntimePlacement = 'managed_cloud' | 'customer_cloud' | 'customer_local' | 'hybrid';
+export type IntegrationDataPlacement = 'lssm_managed' | 'vertical_managed' | 'customer_managed' | 'customer_local' | 'mixed';
+export type IntegrationCredentialCustody = 'lssm_vault' | 'vertical_vault' | 'customer_vault' | 'local_only' | 'mixed';
+export type IntegrationIdentityTrust = 'lssm_oidc' | 'vertical_oidc' | 'customer_oidc' | 'local_identity' | 'federated';
+export type IntegrationApiCommercialMode = 'lssm_managed' | 'vertical_managed' | 'customer_keys' | 'none';
+export type IntegrationNetworkMode = 'public_egress' | 'allowlisted_egress' | 'private_link' | 'air_gapped';
+export interface IntegrationDeploymentTopology {
+    readonly serviceOperator: IntegrationOperator;
+    readonly runtimePlacement: IntegrationRuntimePlacement;
+    readonly dataPlacement: IntegrationDataPlacement;
+    readonly credentialCustody: IntegrationCredentialCustody;
+    readonly identityTrust: IntegrationIdentityTrust;
+    readonly apiCommercialMode: IntegrationApiCommercialMode;
+    readonly networkMode: IntegrationNetworkMode;
+    readonly residencyRegions: readonly string[];
+    readonly evidencePlacement: 'lssm_managed' | 'vertical_managed' | 'customer_managed' | 'local_only';
+}
+export interface IntegrationTopologyViolation {
+    readonly code: string;
+    readonly message: string;
+    readonly path: keyof IntegrationDeploymentTopology;
+}
+export interface IntegrationTopologyValidationResult {
+    readonly success: boolean;
+    readonly violations: readonly IntegrationTopologyViolation[];
+}
+export type IntegrationTopologyBindingScope = {
+    readonly kind: 'workspace';
+    readonly tenantId: string;
+    readonly workspaceId: string;
+    readonly environmentId: string;
+} | {
+    readonly kind: 'connection';
+    readonly tenantId: string;
+    readonly workspaceId: string;
+    readonly environmentId: string;
+    readonly integrationId: string;
+    readonly connectionId: string;
+};
+export declare const INTEGRATION_TOPOLOGY_PROVIDER_RECEIPT_V1: '1.0.0';
+/** Secret-free projection emitted only after provider-native receipt verification. */
+export interface IntegrationTopologyProviderReceiptV1 {
+    readonly schemaVersion: typeof INTEGRATION_TOPOLOGY_PROVIDER_RECEIPT_V1;
+    readonly receiptRef: string;
+    readonly providerKey: string;
+    readonly providerAccountRef: string;
+    readonly scope: IntegrationTopologyBindingScope;
+    readonly topologyDigest: `sha256:${string}`;
+    readonly planDigest: `sha256:${string}`;
+    readonly effectDigest: `sha256:${string}`;
+    readonly providerObservationRef: string;
+    readonly evidenceRefs: readonly string[];
+    readonly observedAt: string;
+    readonly expiresAt: string;
+    readonly outcome: 'succeeded' | 'failed';
+    readonly verificationState: 'verified' | 'rejected';
+    readonly attestationDigest: `sha256:${string}`;
+}
+export interface IntegrationTopologyReceiptViolation {
+    readonly code: string;
+    readonly message: string;
+    readonly path: string;
+}
+export interface IntegrationTopologyReceiptAssessment {
+    readonly state: 'verified' | 'stale' | 'failed';
+    readonly violations: readonly IntegrationTopologyReceiptViolation[];
+}
+export interface IntegrationTopologyEvidencePort {
+    getLatest(input: {
+        readonly scope: IntegrationTopologyBindingScope;
+        readonly topologyDigest: `sha256:${string}`;
+    }): Promise<IntegrationTopologyProviderReceiptV1 | undefined>;
+}

package/dist/integrations/deployment-topology-model.js

@@ -0,0 +1,2 @@
+// @bun
+var e="1.0.0";export{e as INTEGRATION_TOPOLOGY_PROVIDER_RECEIPT_V1};

package/dist/integrations/deployment-topology-receipt.d.ts

@@ -0,0 +1,8 @@
+import { type IntegrationTopologyBindingScope, type IntegrationTopologyProviderReceiptV1, type IntegrationTopologyReceiptAssessment } from './deployment-topology-model.js';
+/** Structural and exact-binding assessment after a trusted adapter verifies provider evidence. */
+export declare function assessIntegrationTopologyProviderReceipt(input: {
+    readonly receipt: IntegrationTopologyProviderReceiptV1;
+    readonly expectedScope: IntegrationTopologyBindingScope;
+    readonly expectedTopologyDigest: `sha256:${string}`;
+    readonly now: string;
+}): IntegrationTopologyReceiptAssessment;

package/dist/integrations/deployment-topology-receipt.js

@@ -0,0 +1,2 @@
+// @bun
+var p="1.0.0";function I(e){let{receipt:o}=e,t=[];if(o.schemaVersion!==p)t.push(n("receipt_schema_mismatch","schemaVersion"));for(let[s,d]of c(o))if(!y(d))t.push(n("unsafe_or_missing_reference",s));for(let[s,d]of g(o))if(!/^sha256:[a-f0-9]{64}$/.test(d))t.push(n("invalid_digest",s));if(o.evidenceRefs.length===0)t.push(n("evidence_required","evidenceRefs"));if(!f(o.scope,e.expectedScope))t.push(n("scope_mismatch","scope"));if(o.topologyDigest!==e.expectedTopologyDigest)t.push(n("topology_digest_mismatch","topologyDigest"));if(o.verificationState!=="verified")t.push(n("provider_verification_rejected","verificationState"));if(o.outcome!=="succeeded")t.push(n("provider_operation_failed","outcome"));let i=l(e.now),r=l(o.observedAt),a=l(o.expiresAt);if(i===void 0)t.push(n("invalid_time","now"));if(r===void 0)t.push(n("invalid_time","observedAt"));if(a===void 0)t.push(n("invalid_time","expiresAt"));if(i!==void 0&&r!==void 0&&r>i)t.push(n("observation_in_future","observedAt"));if(r!==void 0&&a!==void 0&&a<=r)t.push(n("invalid_freshness_window","expiresAt"));if(t.length>0)return{state:"failed",violations:t};if(i!==void 0&&a!==void 0&&i>=a)return{state:"stale",violations:[n("receipt_expired","expiresAt")]};return{state:"verified",violations:[]}}function c(e){let o=Object.entries(e.scope).filter(([t])=>t!=="kind");return[["receiptRef",e.receiptRef],["providerKey",e.providerKey],["providerAccountRef",e.providerAccountRef],["providerObservationRef",e.providerObservationRef],...e.evidenceRefs.map((t)=>["evidenceRefs",t]),...o.map(([t,i])=>[`scope.${t}`,i])]}function g(e){return[["topologyDigest",e.topologyDigest],["planDigest",e.planDigest],["effectDigest",e.effectDigest],["attestationDigest",e.attestationDigest]]}function y(e){return e.length>0&&e.length<=240&&!/[\s<>"']/u.test(e)&&!/(?:password|secret|token|credential)=/iu.test(e)}function f(e,o){if(e.kind!==o.kind||e.tenantId!==o.tenantId||e.workspaceId!==o.workspaceId||e.environmentId!==o.environmentId)return!1;if(e.kind==="workspace"||o.kind==="workspace")return!0;return e.integrationId===o.integrationId&&e.connectionId===o.connectionId}function l(e){let o=Date.parse(e);return Number.isFinite(o)&&new Date(o).toISOString()===e?o:void 0}function n(e,o){return{code:e,path:o,message:e}}export{I as assessIntegrationTopologyProviderReceipt};

package/dist/integrations/deployment-topology-validation.d.ts

@@ -0,0 +1,5 @@
+import type { IntegrationDeploymentTopology, IntegrationTopologyValidationResult } from './deployment-topology-model.js';
+/** Canonical digest for exact provider-receipt binding; residency order is normalized. */
+export declare function digestIntegrationDeploymentTopology(topology: IntegrationDeploymentTopology): `sha256:${string}`;
+/** Fail-closed semantic validation; it performs no discovery or provider calls. */
+export declare function validateIntegrationDeploymentTopology(topology: IntegrationDeploymentTopology): IntegrationTopologyValidationResult;

package/dist/integrations/deployment-topology-validation.js

@@ -0,0 +1,2 @@
+// @bun
+import{sha256Hex as i}from"@lssm/lib.crypto-utils";function n(e){let t=[e.serviceOperator,e.runtimePlacement,e.dataPlacement,e.credentialCustody,e.identityTrust,e.apiCommercialMode,e.networkMode,[...e.residencyRegions].sort(),e.evidencePlacement];return`sha256:${i(JSON.stringify(t))}`}function r(e){let t=[];if(e.residencyRegions.length===0)t.push({code:"residency_required",message:"At least one allowed residency region must be explicit.",path:"residencyRegions"});if(e.apiCommercialMode==="customer_keys"&&!["customer_vault","local_only","mixed"].includes(e.credentialCustody))t.push({code:"customer_keys_custody_mismatch",message:"Customer API keys must remain in customer or mixed custody.",path:"credentialCustody"});if(e.networkMode==="air_gapped"&&!["local_identity","customer_oidc"].includes(e.identityTrust))t.push({code:"air_gap_identity_mismatch",message:"Air-gapped runtimes require a local or customer-controlled identity authority.",path:"identityTrust"});if(e.runtimePlacement==="customer_local"&&e.dataPlacement==="lssm_managed"&&e.networkMode==="air_gapped")t.push({code:"air_gap_remote_data_mismatch",message:"An air-gapped local runtime cannot depend on LSSM-managed data.",path:"dataPlacement"});if(e.serviceOperator==="customer"&&e.runtimePlacement==="managed_cloud")t.push({code:"operator_runtime_mismatch",message:"Customer-operated services must identify customer cloud, local, or hybrid placement.",path:"runtimePlacement"});return{success:t.length===0,violations:t}}export{n as digestIntegrationDeploymentTopology,r as validateIntegrationDeploymentTopology};

package/dist/integrations/deployment-topology.d.ts

@@ -0,0 +1,3 @@
+export * from './deployment-topology-model.js';
+export * from './deployment-topology-receipt.js';
+export * from './deployment-topology-validation.js';

package/dist/integrations/deployment-topology.js

@@ -0,0 +1,2 @@
+// @bun
+var l="1.0.0";function _(e){let{receipt:t}=e,o=[];if(t.schemaVersion!==l)o.push(n("receipt_schema_mismatch","schemaVersion"));for(let[s,d]of p(t))if(!y(d))o.push(n("unsafe_or_missing_reference",s));for(let[s,d]of g(t))if(!/^sha256:[a-f0-9]{64}$/.test(d))o.push(n("invalid_digest",s));if(t.evidenceRefs.length===0)o.push(n("evidence_required","evidenceRefs"));if(!m(t.scope,e.expectedScope))o.push(n("scope_mismatch","scope"));if(t.topologyDigest!==e.expectedTopologyDigest)o.push(n("topology_digest_mismatch","topologyDigest"));if(t.verificationState!=="verified")o.push(n("provider_verification_rejected","verificationState"));if(t.outcome!=="succeeded")o.push(n("provider_operation_failed","outcome"));let i=c(e.now),r=c(t.observedAt),a=c(t.expiresAt);if(i===void 0)o.push(n("invalid_time","now"));if(r===void 0)o.push(n("invalid_time","observedAt"));if(a===void 0)o.push(n("invalid_time","expiresAt"));if(i!==void 0&&r!==void 0&&r>i)o.push(n("observation_in_future","observedAt"));if(r!==void 0&&a!==void 0&&a<=r)o.push(n("invalid_freshness_window","expiresAt"));if(o.length>0)return{state:"failed",violations:o};if(i!==void 0&&a!==void 0&&i>=a)return{state:"stale",violations:[n("receipt_expired","expiresAt")]};return{state:"verified",violations:[]}}function p(e){let t=Object.entries(e.scope).filter(([o])=>o!=="kind");return[["receiptRef",e.receiptRef],["providerKey",e.providerKey],["providerAccountRef",e.providerAccountRef],["providerObservationRef",e.providerObservationRef],...e.evidenceRefs.map((o)=>["evidenceRefs",o]),...t.map(([o,i])=>[`scope.${o}`,i])]}function g(e){return[["topologyDigest",e.topologyDigest],["planDigest",e.planDigest],["effectDigest",e.effectDigest],["attestationDigest",e.attestationDigest]]}function y(e){return e.length>0&&e.length<=240&&!/[\s<>"']/u.test(e)&&!/(?:password|secret|token|credential)=/iu.test(e)}function m(e,t){if(e.kind!==t.kind||e.tenantId!==t.tenantId||e.workspaceId!==t.workspaceId||e.environmentId!==t.environmentId)return!1;if(e.kind==="workspace"||t.kind==="workspace")return!0;return e.integrationId===t.integrationId&&e.connectionId===t.connectionId}function c(e){let t=Date.parse(e);return Number.isFinite(t)&&new Date(t).toISOString()===e?t:void 0}function n(e,t){return{code:e,path:t,message:e}}import{sha256Hex as u}from"@lssm/lib.crypto-utils";function R(e){let t=[e.serviceOperator,e.runtimePlacement,e.dataPlacement,e.credentialCustody,e.identityTrust,e.apiCommercialMode,e.networkMode,[...e.residencyRegions].sort(),e.evidencePlacement];return`sha256:${u(JSON.stringify(t))}`}function h(e){let t=[];if(e.residencyRegions.length===0)t.push({code:"residency_required",message:"At least one allowed residency region must be explicit.",path:"residencyRegions"});if(e.apiCommercialMode==="customer_keys"&&!["customer_vault","local_only","mixed"].includes(e.credentialCustody))t.push({code:"customer_keys_custody_mismatch",message:"Customer API keys must remain in customer or mixed custody.",path:"credentialCustody"});if(e.networkMode==="air_gapped"&&!["local_identity","customer_oidc"].includes(e.identityTrust))t.push({code:"air_gap_identity_mismatch",message:"Air-gapped runtimes require a local or customer-controlled identity authority.",path:"identityTrust"});if(e.runtimePlacement==="customer_local"&&e.dataPlacement==="lssm_managed"&&e.networkMode==="air_gapped")t.push({code:"air_gap_remote_data_mismatch",message:"An air-gapped local runtime cannot depend on LSSM-managed data.",path:"dataPlacement"});if(e.serviceOperator==="customer"&&e.runtimePlacement==="managed_cloud")t.push({code:"operator_runtime_mismatch",message:"Customer-operated services must identify customer cloud, local, or hybrid placement.",path:"runtimePlacement"});return{success:t.length===0,violations:t}}export{l as INTEGRATION_TOPOLOGY_PROVIDER_RECEIPT_V1,_ as assessIntegrationTopologyProviderReceipt,R as digestIntegrationDeploymentTopology,h as validateIntegrationDeploymentTopology};

package/dist/integrations/deployment-topology.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/integrations/docs/integrations.docblock.d.ts

@@ -0,0 +1,2 @@
+import type { DocBlock } from '@lssm/lib.contracts-spec/docs';
+export declare const tech_contracts_integrations_DocBlocks: DocBlock[];