@lssm/lib.contracts 0.0.0-canary-20251120170226

package/dist/integrations/secrets/manager.d.ts

@@ -0,0 +1,48 @@
+import { SecretProvider, SecretReference, SecretRotationResult, SecretValue, SecretWritePayload } from "./provider.js";
+
+//#region src/integrations/secrets/manager.d.ts
+interface RegisterOptions {
+  /**
+   * Larger priority values are attempted first. Defaults to 0.
+   */
+  priority?: number;
+}
+interface SecretProviderManagerOptions {
+  /**
+   * Override manager identifier. Defaults to "secret-provider-manager".
+   */
+  id?: string;
+  /**
+   * Providers to pre-register. They are registered in array order with
+   * descending priority (first entry wins ties).
+   */
+  providers?: Array<{
+    provider: SecretProvider;
+    priority?: number;
+  }>;
+}
+/**
+ * Composite secret provider that delegates to registered providers.
+ * Providers are attempted in order of descending priority, respecting the
+ * registration order for ties. This enables privileged overrides (e.g.
+ * environment variables) while still supporting durable backends like GCP
+ * Secret Manager.
+ */
+declare class SecretProviderManager implements SecretProvider {
+  readonly id: string;
+  private readonly providers;
+  private registrationCounter;
+  constructor(options?: SecretProviderManagerOptions);
+  register(provider: SecretProvider, options?: RegisterOptions): this;
+  canHandle(reference: SecretReference): boolean;
+  getSecret(reference: SecretReference, options?: SecretFetchOptions): Promise<SecretValue>;
+  setSecret(reference: SecretReference, payload: SecretWritePayload): Promise<SecretRotationResult>;
+  rotateSecret(reference: SecretReference, payload: SecretWritePayload): Promise<SecretRotationResult>;
+  deleteSecret(reference: SecretReference): Promise<void>;
+  private delegateToFirst;
+  private composeError;
+}
+type SecretFetchOptions = Parameters<SecretProvider['getSecret']>[1];
+//#endregion
+export { SecretProviderManager, SecretProviderManagerOptions };
+//# sourceMappingURL=manager.d.ts.map

package/dist/integrations/secrets/manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.d.ts","names":[],"sources":["../../../src/integrations/secrets/manager.ts"],"sourcesContent":[],"mappings":";;;UAeU,eAAA;;AARU;AAepB;EAmBa,QAAA,CAAA,EAAA,MAAA;;AAaQ,UAhCJ,4BAAA,CAgCI;EAAyB;;;EAuBhC,EAAA,CAAA,EAAA,MAAA;EACD;;;;EAgCA,SAAA,CAAA,EA/EC,KA+ED,CAAA;IAAR,QAAA,EA/E2B,cA+E3B;IAOU,QAAA,CAAA,EAAA,MAAA;EACF,CAAA,CAAA;;;;;;;AA0EZ;;cAvJY,qBAAA,YAAiC;;;;wBAKvB;qBAQF,0BAAyB;uBAevB;uBAOR,2BACD,qBACT,QAAQ;uBA8BE,0BACF,qBACR,QAAQ;0BAOE,0BACF,qBACR,QAAQ;0BAMmB,kBAAkB;;;;KAgF7C,kBAAA,GAAqB,WAAW"}

package/dist/integrations/secrets/manager.js

@@ -0,0 +1,2 @@
+import{SecretProviderError as e}from"./provider.js";var t=class{id;providers=[];registrationCounter=0;constructor(e={}){this.id=e.id??`secret-provider-manager`;let t=e.providers??[];for(let e of t)this.register(e.provider,{priority:e.priority})}register(e,t={}){return this.providers.push({provider:e,priority:t.priority??0,order:this.registrationCounter++}),this.providers.sort((e,t)=>e.priority===t.priority?e.order-t.order:t.priority-e.priority),this}canHandle(e){return this.providers.some(({provider:t})=>n(t,e))}async getSecret(t,r){let i=[];for(let{provider:a}of this.providers)if(n(a,t))try{return await a.getSecret(t,r)}catch(t){if(t instanceof e){if(i.push(t),t.code!==`NOT_FOUND`)break;continue}throw t}throw this.composeError(`getSecret`,t,i,r?.version)}async setSecret(e,t){return this.delegateToFirst(`setSecret`,e,n=>n.setSecret(e,t))}async rotateSecret(e,t){return this.delegateToFirst(`rotateSecret`,e,n=>n.rotateSecret(e,t))}async deleteSecret(e){await this.delegateToFirst(`deleteSecret`,e,t=>t.deleteSecret(e))}async delegateToFirst(t,r,i){let a=[];for(let{provider:t}of this.providers)if(n(t,r))try{return await i(t)}catch(t){if(t instanceof e){a.push(t);continue}throw t}throw this.composeError(t,r,a)}composeError(t,n,r,i){if(r.length===1){let[e]=r;if(e)return e}let a=[`No registered secret provider could ${t}`,`reference "${n}"`];return i&&a.push(`(version: ${i})`),r.length>1&&a.push(`Attempts: ${r.map(e=>`${e.provider}:${e.code}`).join(`, `)}`),new e({message:a.join(` `),provider:this.id,reference:n,code:r.length>0?r[r.length-1].code:`UNKNOWN`,cause:r})}};function n(e,t){try{return e.canHandle(t)}catch{return!1}}export{t as SecretProviderManager};
+//# sourceMappingURL=manager.js.map

package/dist/integrations/secrets/manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.js","names":["errors: SecretProviderError[]"],"sources":["../../../src/integrations/secrets/manager.ts"],"sourcesContent":["import { SecretProviderError } from './provider';\nimport type {\n  SecretProvider,\n  SecretReference,\n  SecretRotationResult,\n  SecretValue,\n  SecretWritePayload,\n} from './provider';\n\ninterface ProviderRegistration {\n  readonly provider: SecretProvider;\n  readonly priority: number;\n  readonly order: number;\n}\n\ninterface RegisterOptions {\n  /**\n   * Larger priority values are attempted first. Defaults to 0.\n   */\n  priority?: number;\n}\n\nexport interface SecretProviderManagerOptions {\n  /**\n   * Override manager identifier. Defaults to \"secret-provider-manager\".\n   */\n  id?: string;\n  /**\n   * Providers to pre-register. They are registered in array order with\n   * descending priority (first entry wins ties).\n   */\n  providers?: Array<{ provider: SecretProvider; priority?: number }>;\n}\n\n/**\n * Composite secret provider that delegates to registered providers.\n * Providers are attempted in order of descending priority, respecting the\n * registration order for ties. This enables privileged overrides (e.g.\n * environment variables) while still supporting durable backends like GCP\n * Secret Manager.\n */\nexport class SecretProviderManager implements SecretProvider {\n  readonly id: string;\n  private readonly providers: ProviderRegistration[] = [];\n  private registrationCounter = 0;\n\n  constructor(options: SecretProviderManagerOptions = {}) {\n    this.id = options.id ?? 'secret-provider-manager';\n    const initialProviders = options.providers ?? [];\n    for (const entry of initialProviders) {\n      this.register(entry.provider, { priority: entry.priority });\n    }\n  }\n\n  register(provider: SecretProvider, options: RegisterOptions = {}): this {\n    this.providers.push({\n      provider,\n      priority: options.priority ?? 0,\n      order: this.registrationCounter++,\n    });\n    this.providers.sort((a, b) => {\n      if (a.priority !== b.priority) {\n        return b.priority - a.priority;\n      }\n      return a.order - b.order;\n    });\n    return this;\n  }\n\n  canHandle(reference: SecretReference): boolean {\n    return this.providers.some(({ provider }) =>\n      safeCanHandle(provider, reference)\n    );\n  }\n\n  async getSecret(\n    reference: SecretReference,\n    options?: SecretFetchOptions\n  ): Promise<SecretValue> {\n    const errors: SecretProviderError[] = [];\n\n    for (const { provider } of this.providers) {\n      if (!safeCanHandle(provider, reference)) {\n        continue;\n      }\n      try {\n        return await provider.getSecret(reference, options);\n      } catch (error) {\n        if (error instanceof SecretProviderError) {\n          errors.push(error);\n          if (error.code !== 'NOT_FOUND') {\n            break;\n          }\n          continue;\n        }\n        throw error;\n      }\n    }\n\n    throw this.composeError(\n      'getSecret',\n      reference,\n      errors,\n      options?.version\n    );\n  }\n\n  async setSecret(\n    reference: SecretReference,\n    payload: SecretWritePayload\n  ): Promise<SecretRotationResult> {\n    return this.delegateToFirst('setSecret', reference, (provider) =>\n      provider.setSecret(reference, payload)\n    );\n  }\n\n  async rotateSecret(\n    reference: SecretReference,\n    payload: SecretWritePayload\n  ): Promise<SecretRotationResult> {\n    return this.delegateToFirst('rotateSecret', reference, (provider) =>\n      provider.rotateSecret(reference, payload)\n    );\n  }\n\n  async deleteSecret(reference: SecretReference): Promise<void> {\n    await this.delegateToFirst('deleteSecret', reference, (provider) =>\n      provider.deleteSecret(reference)\n    );\n  }\n\n  private async delegateToFirst<T>(\n    operation: 'setSecret' | 'rotateSecret' | 'deleteSecret',\n    reference: SecretReference,\n    invoker: (provider: SecretProvider) => Promise<T>\n  ): Promise<T> {\n    const errors: SecretProviderError[] = [];\n\n    for (const { provider } of this.providers) {\n      if (!safeCanHandle(provider, reference)) {\n        continue;\n      }\n      try {\n        return await invoker(provider);\n      } catch (error) {\n        if (error instanceof SecretProviderError) {\n          errors.push(error);\n          continue;\n        }\n        throw error;\n      }\n    }\n\n    throw this.composeError(operation, reference, errors);\n  }\n\n  private composeError(\n    operation: string,\n    reference: SecretReference,\n    errors: SecretProviderError[],\n    version?: string\n  ): SecretProviderError {\n    if (errors.length === 1) {\n      const [singleError] = errors;\n      if (singleError) {\n        return singleError;\n      }\n    }\n\n    const messageParts = [\n      `No registered secret provider could ${operation}`,\n      `reference \"${reference}\"`,\n    ];\n    if (version) {\n      messageParts.push(`(version: ${version})`);\n    }\n    if (errors.length > 1) {\n      messageParts.push(\n        `Attempts: ${errors\n          .map((error) => `${error.provider}:${error.code}`)\n          .join(', ')}`\n      );\n    }\n\n    return new SecretProviderError({\n      message: messageParts.join(' '),\n      provider: this.id,\n      reference,\n      code: errors.length > 0 ? errors[errors.length - 1]!.code : 'UNKNOWN',\n      cause: errors,\n    });\n  }\n}\n\nfunction safeCanHandle(\n  provider: SecretProvider,\n  reference: SecretReference\n): boolean {\n  try {\n    return provider.canHandle(reference);\n  } catch {\n    return false;\n  }\n}\n\ntype SecretFetchOptions = Parameters<SecretProvider['getSecret']>[1];\n\n\n"],"mappings":"oDAyCA,IAAa,EAAb,KAA6D,CAC3D,GACA,UAAqD,EAAE,CACvD,oBAA8B,EAE9B,YAAY,EAAwC,EAAE,CAAE,CACtD,KAAK,GAAK,EAAQ,IAAM,0BACxB,IAAM,EAAmB,EAAQ,WAAa,EAAE,CAChD,IAAK,IAAM,KAAS,EAClB,KAAK,SAAS,EAAM,SAAU,CAAE,SAAU,EAAM,SAAU,CAAC,CAI/D,SAAS,EAA0B,EAA2B,EAAE,CAAQ,CAYtE,OAXA,KAAK,UAAU,KAAK,CAClB,WACA,SAAU,EAAQ,UAAY,EAC9B,MAAO,KAAK,sBACb,CAAC,CACF,KAAK,UAAU,MAAM,EAAG,IAClB,EAAE,WAAa,EAAE,SAGd,EAAE,MAAQ,EAAE,MAFV,EAAE,SAAW,EAAE,SAGxB,CACK,KAGT,UAAU,EAAqC,CAC7C,OAAO,KAAK,UAAU,MAAM,CAAE,cAC5B,EAAc,EAAU,EAAU,CACnC,CAGH,MAAM,UACJ,EACA,EACsB,CACtB,IAAMA,EAAgC,EAAE,CAExC,IAAK,GAAM,CAAE,cAAc,KAAK,UACzB,KAAc,EAAU,EAAU,CAGvC,GAAI,CACF,OAAO,MAAM,EAAS,UAAU,EAAW,EAAQ,OAC5C,EAAO,CACd,GAAI,aAAiB,EAAqB,CAExC,GADA,EAAO,KAAK,EAAM,CACd,EAAM,OAAS,YACjB,MAEF,SAEF,MAAM,EAIV,MAAM,KAAK,aACT,YACA,EACA,EACA,GAAS,QACV,CAGH,MAAM,UACJ,EACA,EAC+B,CAC/B,OAAO,KAAK,gBAAgB,YAAa,EAAY,GACnD,EAAS,UAAU,EAAW,EAAQ,CACvC,CAGH,MAAM,aACJ,EACA,EAC+B,CAC/B,OAAO,KAAK,gBAAgB,eAAgB,EAAY,GACtD,EAAS,aAAa,EAAW,EAAQ,CAC1C,CAGH,MAAM,aAAa,EAA2C,CAC5D,MAAM,KAAK,gBAAgB,eAAgB,EAAY,GACrD,EAAS,aAAa,EAAU,CACjC,CAGH,MAAc,gBACZ,EACA,EACA,EACY,CACZ,IAAMA,EAAgC,EAAE,CAExC,IAAK,GAAM,CAAE,cAAc,KAAK,UACzB,KAAc,EAAU,EAAU,CAGvC,GAAI,CACF,OAAO,MAAM,EAAQ,EAAS,OACvB,EAAO,CACd,GAAI,aAAiB,EAAqB,CACxC,EAAO,KAAK,EAAM,CAClB,SAEF,MAAM,EAIV,MAAM,KAAK,aAAa,EAAW,EAAW,EAAO,CAGvD,aACE,EACA,EACA,EACA,EACqB,CACrB,GAAI,EAAO,SAAW,EAAG,CACvB,GAAM,CAAC,GAAe,EACtB,GAAI,EACF,OAAO,EAIX,IAAM,EAAe,CACnB,uCAAuC,IACvC,cAAc,EAAU,GACzB,CAYD,OAXI,GACF,EAAa,KAAK,aAAa,EAAQ,GAAG,CAExC,EAAO,OAAS,GAClB,EAAa,KACX,aAAa,EACV,IAAK,GAAU,GAAG,EAAM,SAAS,GAAG,EAAM,OAAO,CACjD,KAAK,KAAK,GACd,CAGI,IAAI,EAAoB,CAC7B,QAAS,EAAa,KAAK,IAAI,CAC/B,SAAU,KAAK,GACf,YACA,KAAM,EAAO,OAAS,EAAI,EAAO,EAAO,OAAS,GAAI,KAAO,UAC5D,MAAO,EACR,CAAC,GAIN,SAAS,EACP,EACA,EACS,CACT,GAAI,CACF,OAAO,EAAS,UAAU,EAAU,MAC9B,CACN,MAAO"}

package/dist/integrations/secrets/provider.d.ts

@@ -0,0 +1,53 @@
+//#region src/integrations/secrets/provider.d.ts
+type SecretReference = string;
+interface SecretValue {
+  data: Uint8Array;
+  version?: string;
+  metadata?: Record<string, string>;
+  retrievedAt: Date;
+}
+interface SecretFetchOptions {
+  version?: string;
+}
+type SecretPayloadEncoding = 'utf-8' | 'base64' | 'binary';
+interface SecretWritePayload {
+  data: string | Uint8Array;
+  encoding?: SecretPayloadEncoding;
+  contentType?: string;
+  labels?: Record<string, string>;
+}
+interface SecretRotationResult {
+  reference: SecretReference;
+  version: string;
+}
+interface SecretProvider {
+  readonly id: string;
+  canHandle(reference: SecretReference): boolean;
+  getSecret(reference: SecretReference, options?: SecretFetchOptions): Promise<SecretValue>;
+  setSecret(reference: SecretReference, payload: SecretWritePayload): Promise<SecretRotationResult>;
+  rotateSecret(reference: SecretReference, payload: SecretWritePayload): Promise<SecretRotationResult>;
+  deleteSecret(reference: SecretReference): Promise<void>;
+}
+interface ParsedSecretUri {
+  provider: string;
+  path: string;
+  extras?: Record<string, string>;
+}
+declare class SecretProviderError extends Error {
+  readonly provider: string;
+  readonly reference: SecretReference;
+  readonly code: 'NOT_FOUND' | 'FORBIDDEN' | 'INVALID' | 'UNKNOWN';
+  readonly cause?: unknown;
+  constructor(params: {
+    message: string;
+    provider: string;
+    reference: SecretReference;
+    code?: SecretProviderError['code'];
+    cause?: unknown;
+  });
+}
+declare function parseSecretUri(reference: SecretReference): ParsedSecretUri;
+declare function normalizeSecretPayload(payload: SecretWritePayload): Uint8Array;
+//#endregion
+export { ParsedSecretUri, SecretFetchOptions, SecretPayloadEncoding, SecretProvider, SecretProviderError, SecretReference, SecretRotationResult, SecretValue, SecretWritePayload, normalizeSecretPayload, parseSecretUri };
+//# sourceMappingURL=provider.d.ts.map

package/dist/integrations/secrets/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","names":[],"sources":["../../../src/integrations/secrets/provider.ts"],"sourcesContent":[],"mappings":";KAEY,eAAA;AAAA,UAEK,WAAA,CAFU;EAEV,IAAA,EACT,UADoB;EACpB,OAAA,CAAA,EAAA,MAAA;EAEK,QAAA,CAAA,EAAA,MAAA,CAAA,MAAA,EAAA,MAAA,CAAA;EACE,WAAA,EAAA,IAAA;;AAGE,UAAA,kBAAA,CAAkB;EAIvB,OAAA,CAAA,EAAA,MAAA;AAEZ;AACiB,KAHL,qBAAA,GAGK,OAAA,GAAA,QAAA,GAAA,QAAA;AACJ,UAFI,kBAAA,CAEJ;EAEF,IAAA,EAAA,MAAA,GAHM,UAGN;EAAM,QAAA,CAAA,EAFJ,qBAEI;EAGA,WAAA,CAAA,EAAA,MAAA;EAKA,MAAA,CAAA,EARN,MAQM,CAAA,MAAc,EAAA,MAAA,CAAA;;AAIhB,UATE,oBAAA,CASF;EACD,SAAA,EATD,eASC;EACD,OAAA,EAAA,MAAA;;AAEE,UARE,cAAA,CAQF;EACF,SAAA,EAAA,EAAA,MAAA;EACA,SAAA,CAAA,SAAA,EARU,eAQV,CAAA,EAAA,OAAA;EAAR,SAAA,CAAA,SAAA,EANU,eAMV,EAAA,OAAA,CAAA,EALS,kBAKT,CAAA,EAJA,OAIA,CAJQ,WAIR,CAAA;EAEU,SAAA,CAAA,SAAA,EAJA,eAIA,EAAA,OAAA,EAHF,kBAGE,CAAA,EAFV,OAEU,CAFF,oBAEE,CAAA;EACF,YAAA,CAAA,SAAA,EADE,eACF,EAAA,OAAA,EAAA,kBAAA,CAAA,EACR,OADQ,CACA,oBADA,CAAA;EACA,YAAA,CAAA,SAAA,EACa,eADb,CAAA,EAC+B,OAD/B,CAAA,IAAA,CAAA;;AACa,UAGT,eAAA,CAHS;EAAkB,QAAA,EAAA,MAAA;EAAO,IAAA,EAAA,MAAA;EAGlC,MAAA,CAAA,EAGN,MAHM,CAAA,MAAe,EAAA,MAAA,CAGrB;AAGX;AAEsB,cAFT,mBAAA,SAA4B,KAAA,CAEnB;EAOP,SAAA,QAAA,EAAA,MAAA;EACJ,SAAA,SAAA,EARW,eAQX;EAV8B,SAAA,IAAA,EAAA,WAAA,GAAA,WAAA,GAAA,SAAA,GAAA,SAAA;EAAK,SAAA,KAAA,CAAA,EAAA,OAAA;EAsB9B,WAAA,CAAA,MAAc,EAAA;IAiDd,OAAA,EAAA,MAAA;;eA9DD;WACJ;;;;iBAYK,cAAA,YAA0B,kBAAkB;iBAiD5C,sBAAA,UACL,qBACR"}

package/dist/integrations/secrets/provider.js

@@ -0,0 +1,2 @@
+import{Buffer as e}from"node:buffer";var t=class extends Error{provider;reference;code;cause;constructor(e){super(e.message),this.name=`SecretProviderError`,this.provider=e.provider,this.reference=e.reference,this.code=e.code??`UNKNOWN`,this.cause=e.cause}};function n(e){if(!e)throw new t({message:`Secret reference cannot be empty`,provider:`unknown`,reference:e,code:`INVALID`});let[n,r]=e.split(`://`);if(!n||!r)throw new t({message:`Invalid secret reference: ${e}`,provider:`unknown`,reference:e,code:`INVALID`});let i=r.indexOf(`?`);if(i===-1)return{provider:n,path:r};let a=r.slice(0,i),o=r.slice(i+1);return{provider:n,path:a,extras:Object.fromEntries(o.split(`&`).filter(Boolean).map(e=>{let[t,n]=e.split(`=`),r=t??``,i=n??``;return[decodeURIComponent(r),decodeURIComponent(i)]}))}}function r(t){return t.data instanceof Uint8Array?t.data:t.encoding===`base64`?e.from(t.data,`base64`):t.encoding===`binary`?e.from(t.data,`binary`):e.from(t.data,`utf-8`)}export{t as SecretProviderError,r as normalizeSecretPayload,n as parseSecretUri};
+//# sourceMappingURL=provider.js.map

package/dist/integrations/secrets/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","names":[],"sources":["../../../src/integrations/secrets/provider.ts"],"sourcesContent":["import { Buffer } from 'node:buffer';\n\nexport type SecretReference = string;\n\nexport interface SecretValue {\n  data: Uint8Array;\n  version?: string;\n  metadata?: Record<string, string>;\n  retrievedAt: Date;\n}\n\nexport interface SecretFetchOptions {\n  version?: string;\n}\n\nexport type SecretPayloadEncoding = 'utf-8' | 'base64' | 'binary';\n\nexport interface SecretWritePayload {\n  data: string | Uint8Array;\n  encoding?: SecretPayloadEncoding;\n  contentType?: string;\n  labels?: Record<string, string>;\n}\n\nexport interface SecretRotationResult {\n  reference: SecretReference;\n  version: string;\n}\n\nexport interface SecretProvider {\n  readonly id: string;\n  canHandle(reference: SecretReference): boolean;\n  getSecret(\n    reference: SecretReference,\n    options?: SecretFetchOptions\n  ): Promise<SecretValue>;\n  setSecret(\n    reference: SecretReference,\n    payload: SecretWritePayload\n  ): Promise<SecretRotationResult>;\n  rotateSecret(\n    reference: SecretReference,\n    payload: SecretWritePayload\n  ): Promise<SecretRotationResult>;\n  deleteSecret(reference: SecretReference): Promise<void>;\n}\n\nexport interface ParsedSecretUri {\n  provider: string;\n  path: string;\n  extras?: Record<string, string>;\n}\n\nexport class SecretProviderError extends Error {\n  readonly provider: string;\n  readonly reference: SecretReference;\n  readonly code: 'NOT_FOUND' | 'FORBIDDEN' | 'INVALID' | 'UNKNOWN';\n  readonly cause?: unknown;\n\n  constructor(params: {\n    message: string;\n    provider: string;\n    reference: SecretReference;\n    code?: SecretProviderError['code'];\n    cause?: unknown;\n  }) {\n    super(params.message);\n    this.name = 'SecretProviderError';\n    this.provider = params.provider;\n    this.reference = params.reference;\n    this.code = params.code ?? 'UNKNOWN';\n    this.cause = params.cause;\n  }\n}\n\nexport function parseSecretUri(reference: SecretReference): ParsedSecretUri {\n  if (!reference) {\n    throw new SecretProviderError({\n      message: 'Secret reference cannot be empty',\n      provider: 'unknown',\n      reference,\n      code: 'INVALID',\n    });\n  }\n\n  const [scheme, rest] = reference.split('://');\n  if (!scheme || !rest) {\n    throw new SecretProviderError({\n      message: `Invalid secret reference: ${reference}`,\n      provider: 'unknown',\n      reference,\n      code: 'INVALID',\n    });\n  }\n\n  const queryIndex = rest.indexOf('?');\n  if (queryIndex === -1) {\n    return {\n      provider: scheme,\n      path: rest,\n    };\n  }\n\n  const path = rest.slice(0, queryIndex);\n  const query = rest.slice(queryIndex + 1);\n  const extras = Object.fromEntries(\n    query\n      .split('&')\n      .filter(Boolean)\n      .map((pair) => {\n        const [keyRaw, valueRaw] = pair.split('=');\n        const key = keyRaw ?? '';\n        const value = valueRaw ?? '';\n        return [decodeURIComponent(key), decodeURIComponent(value)];\n      })\n  );\n\n  return {\n    provider: scheme,\n    path,\n    extras,\n  };\n}\n\nexport function normalizeSecretPayload(\n  payload: SecretWritePayload\n): Uint8Array {\n  if (payload.data instanceof Uint8Array) {\n    return payload.data;\n  }\n\n  if (payload.encoding === 'base64') {\n    return Buffer.from(payload.data, 'base64');\n  }\n\n  if (payload.encoding === 'binary') {\n    return Buffer.from(payload.data, 'binary');\n  }\n\n  return Buffer.from(payload.data, 'utf-8');\n}\n\n\n"],"mappings":"qCAqDA,IAAa,EAAb,cAAyC,KAAM,CAC7C,SACA,UACA,KACA,MAEA,YAAY,EAMT,CACD,MAAM,EAAO,QAAQ,CACrB,KAAK,KAAO,sBACZ,KAAK,SAAW,EAAO,SACvB,KAAK,UAAY,EAAO,UACxB,KAAK,KAAO,EAAO,MAAQ,UAC3B,KAAK,MAAQ,EAAO,QAIxB,SAAgB,EAAe,EAA6C,CAC1E,GAAI,CAAC,EACH,MAAM,IAAI,EAAoB,CAC5B,QAAS,mCACT,SAAU,UACV,YACA,KAAM,UACP,CAAC,CAGJ,GAAM,CAAC,EAAQ,GAAQ,EAAU,MAAM,MAAM,CAC7C,GAAI,CAAC,GAAU,CAAC,EACd,MAAM,IAAI,EAAoB,CAC5B,QAAS,6BAA6B,IACtC,SAAU,UACV,YACA,KAAM,UACP,CAAC,CAGJ,IAAM,EAAa,EAAK,QAAQ,IAAI,CACpC,GAAI,IAAe,GACjB,MAAO,CACL,SAAU,EACV,KAAM,EACP,CAGH,IAAM,EAAO,EAAK,MAAM,EAAG,EAAW,CAChC,EAAQ,EAAK,MAAM,EAAa,EAAE,CAaxC,MAAO,CACL,SAAU,EACV,OACA,OAfa,OAAO,YACpB,EACG,MAAM,IAAI,CACV,OAAO,QAAQ,CACf,IAAK,GAAS,CACb,GAAM,CAAC,EAAQ,GAAY,EAAK,MAAM,IAAI,CACpC,EAAM,GAAU,GAChB,EAAQ,GAAY,GAC1B,MAAO,CAAC,mBAAmB,EAAI,CAAE,mBAAmB,EAAM,CAAC,EAC3D,CACL,CAMA,CAGH,SAAgB,EACd,EACY,CAaZ,OAZI,EAAQ,gBAAgB,WACnB,EAAQ,KAGb,EAAQ,WAAa,SAChB,EAAO,KAAK,EAAQ,KAAM,SAAS,CAGxC,EAAQ,WAAa,SAChB,EAAO,KAAK,EAAQ,KAAM,SAAS,CAGrC,EAAO,KAAK,EAAQ,KAAM,QAAQ"}

package/dist/integrations/spec.d.ts

@@ -0,0 +1,80 @@
+import { OwnerShipMeta } from "../ownership.js";
+import { CapabilityRef, CapabilityRequirement } from "../capabilities.js";
+
+//#region src/integrations/spec.d.ts
+type IntegrationCategory = 'payments' | 'email' | 'calendar' | 'sms' | 'ai-llm' | 'ai-voice' | 'speech-to-text' | 'vector-db' | 'storage' | 'accounting' | 'crm' | 'helpdesk' | 'open-banking' | 'custom';
+type IntegrationOwnershipMode = 'managed' | 'byok';
+interface IntegrationMeta extends OwnerShipMeta {
+  /** Stable provider slug (e.g., "stripe", "openai"). */
+  key: string;
+  /** Provider version (increment on breaking API changes). */
+  version: number;
+  category: IntegrationCategory;
+  displayName: string;
+}
+interface IntegrationCapabilityMapping {
+  /** Which CapabilitySpec this integration provides. */
+  provides: CapabilityRef[];
+  /** Optional: which capabilities it requires (e.g., storage for caching). */
+  requires?: CapabilityRequirement[];
+}
+interface IntegrationConfigSchema {
+  /** JSON Schema or SchemaModel defining required config fields. */
+  schema: unknown;
+  /** Example configuration (for docs/UI). */
+  example?: Record<string, unknown>;
+}
+interface IntegrationSecretSchema {
+  /** JSON Schema or SchemaModel describing secret fields. */
+  schema: unknown;
+  /** Redacted example for documentation/UI. */
+  example?: Record<string, string>;
+}
+interface IntegrationByokSetup {
+  /** Human-readable instructions for tenants configuring BYOK accounts. */
+  setupInstructions?: string;
+  /** Required scopes/permissions for BYOK accounts. */
+  requiredScopes?: string[];
+}
+interface IntegrationHealthCheck {
+  /** Endpoint or method to validate connection health. */
+  method?: 'ping' | 'list' | 'custom';
+  /** Timeout in ms for health check. */
+  timeoutMs?: number;
+}
+interface IntegrationSpec {
+  meta: IntegrationMeta;
+  /** Supported ownership modes for this provider. */
+  supportedModes: IntegrationOwnershipMode[];
+  /** Which capabilities this integration provides/requires. */
+  capabilities: IntegrationCapabilityMapping;
+  /** Configuration schema (API keys, endpoints, etc.). */
+  configSchema: IntegrationConfigSchema;
+  /** Secret schema (API/key material stored via secretRef). */
+  secretSchema: IntegrationSecretSchema;
+  /** Optional health check configuration. */
+  healthCheck?: IntegrationHealthCheck;
+  /** Documentation URL. */
+  docsUrl?: string;
+  /** Rate limits or usage constraints. */
+  constraints?: {
+    rateLimit?: {
+      rpm?: number;
+      rph?: number;
+    };
+    quotas?: Record<string, number>;
+  };
+  /** Provider-specific metadata for BYOK setup flows. */
+  byokSetup?: IntegrationByokSetup;
+}
+declare class IntegrationSpecRegistry {
+  private readonly items;
+  register(spec: IntegrationSpec): this;
+  list(): IntegrationSpec[];
+  get(key: string, version?: number): IntegrationSpec | undefined;
+  getByCategory(category: IntegrationCategory): IntegrationSpec[];
+}
+declare function makeIntegrationSpecKey(meta: IntegrationMeta): string;
+//#endregion
+export { IntegrationByokSetup, IntegrationCapabilityMapping, IntegrationCategory, IntegrationConfigSchema, IntegrationHealthCheck, IntegrationMeta, IntegrationOwnershipMode, IntegrationSecretSchema, IntegrationSpec, IntegrationSpecRegistry, makeIntegrationSpecKey };
+//# sourceMappingURL=spec.d.ts.map

package/dist/integrations/spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec.d.ts","names":[],"sources":["../../src/integrations/spec.ts"],"sourcesContent":[],"mappings":";;;;KAMY,mBAAA;KAgBA,wBAAA;AAhBA,UAkBK,eAAA,SAAwB,aAlBV,CAAA;EAgBnB;EAEK,GAAA,EAAA,MAAA;EASA;EAOA,OAAA,EAAA,MAAA;EAOA,QAAA,EAlBL,mBAkB4B;EAOvB,WAAA,EAAA,MAAA;AAOjB;AAOiB,UAnCA,4BAAA,CAmCe;EACxB;EAEU,QAAA,EApCN,aAoCM,EAAA;EAEF;EAEA,QAAA,CAAA,EAtCH,qBAsCG,EAAA;;AAIA,UAvCC,uBAAA,CAuCD;EAMH;EAGC,MAAA,EAAA,OAAA;EAAoB;EAMrB,OAAA,CAAA,EAlDD,MAkDC,CAAA,MAAA,EAAA,OAAuB,CAAA;;AAY1B,UA3DO,uBAAA,CA2DP;EAI4B;EAgBZ,MAAA,EAAA,OAAA;EAAsB;EAAe,OAAA,CAAA,EA3EnD,MA2EmD,CAAA,MAAA,EAAA,MAAA,CAAA;AAK/D;UA7EiB,oBAAA;;;;;;UAOA,sBAAA;;;;;;UAOA,eAAA;QACT;;kBAEU;;gBAEF;;gBAEA;;gBAEA;;gBAEA;;;;;;;;;aAMH;;;cAGC;;cAMD,uBAAA;;iBAGI;UASP;sCAI4B;0BAgBZ,sBAAsB;;iBAKhC,sBAAA,OAA6B"}

package/dist/integrations/spec.js

@@ -0,0 +1,2 @@
+const e=e=>`${e.key}.v${e.version}`;var t=class{items=new Map;register(t){let n=e(t.meta);if(this.items.has(n))throw Error(`Duplicate IntegrationSpec ${n}`);return this.items.set(n,t),this}list(){return[...this.items.values()]}get(t,n){if(n!=null)return this.items.get(e({key:t,version:n}));let r,i=-1/0;for(let e of this.items.values())e.meta.key===t&&e.meta.version>i&&(i=e.meta.version,r=e);return r}getByCategory(e){return this.list().filter(t=>t.meta.category===e)}};function n(t){return e(t)}export{t as IntegrationSpecRegistry,n as makeIntegrationSpecKey};
+//# sourceMappingURL=spec.js.map

package/dist/integrations/spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec.js","names":["latest: IntegrationSpec | undefined"],"sources":["../../src/integrations/spec.ts"],"sourcesContent":["import type { OwnerShipMeta } from '../ownership';\nimport type {\n  CapabilityRef,\n  CapabilityRequirement,\n} from '../capabilities';\n\nexport type IntegrationCategory =\n  | 'payments'\n  | 'email'\n  | 'calendar'\n  | 'sms'\n  | 'ai-llm'\n  | 'ai-voice'\n  | 'speech-to-text'\n  | 'vector-db'\n  | 'storage'\n  | 'accounting'\n  | 'crm'\n  | 'helpdesk'\n  | 'open-banking'\n  | 'custom';\n\nexport type IntegrationOwnershipMode = 'managed' | 'byok';\n\nexport interface IntegrationMeta extends OwnerShipMeta {\n  /** Stable provider slug (e.g., \"stripe\", \"openai\"). */\n  key: string;\n  /** Provider version (increment on breaking API changes). */\n  version: number;\n  category: IntegrationCategory;\n  displayName: string;\n}\n\nexport interface IntegrationCapabilityMapping {\n  /** Which CapabilitySpec this integration provides. */\n  provides: CapabilityRef[];\n  /** Optional: which capabilities it requires (e.g., storage for caching). */\n  requires?: CapabilityRequirement[];\n}\n\nexport interface IntegrationConfigSchema {\n  /** JSON Schema or SchemaModel defining required config fields. */\n  schema: unknown;\n  /** Example configuration (for docs/UI). */\n  example?: Record<string, unknown>;\n}\n\nexport interface IntegrationSecretSchema {\n  /** JSON Schema or SchemaModel describing secret fields. */\n  schema: unknown;\n  /** Redacted example for documentation/UI. */\n  example?: Record<string, string>;\n}\n\nexport interface IntegrationByokSetup {\n  /** Human-readable instructions for tenants configuring BYOK accounts. */\n  setupInstructions?: string;\n  /** Required scopes/permissions for BYOK accounts. */\n  requiredScopes?: string[];\n}\n\nexport interface IntegrationHealthCheck {\n  /** Endpoint or method to validate connection health. */\n  method?: 'ping' | 'list' | 'custom';\n  /** Timeout in ms for health check. */\n  timeoutMs?: number;\n}\n\nexport interface IntegrationSpec {\n  meta: IntegrationMeta;\n  /** Supported ownership modes for this provider. */\n  supportedModes: IntegrationOwnershipMode[];\n  /** Which capabilities this integration provides/requires. */\n  capabilities: IntegrationCapabilityMapping;\n  /** Configuration schema (API keys, endpoints, etc.). */\n  configSchema: IntegrationConfigSchema;\n  /** Secret schema (API/key material stored via secretRef). */\n  secretSchema: IntegrationSecretSchema;\n  /** Optional health check configuration. */\n  healthCheck?: IntegrationHealthCheck;\n  /** Documentation URL. */\n  docsUrl?: string;\n  /** Rate limits or usage constraints. */\n  constraints?: {\n    rateLimit?: { rpm?: number; rph?: number };\n    quotas?: Record<string, number>;\n  };\n  /** Provider-specific metadata for BYOK setup flows. */\n  byokSetup?: IntegrationByokSetup;\n}\n\nconst integrationKey = (meta: Pick<IntegrationMeta, 'key' | 'version'>) =>\n  `${meta.key}.v${meta.version}`;\n\nexport class IntegrationSpecRegistry {\n  private readonly items = new Map<string, IntegrationSpec>();\n\n  register(spec: IntegrationSpec): this {\n    const key = integrationKey(spec.meta);\n    if (this.items.has(key)) {\n      throw new Error(`Duplicate IntegrationSpec ${key}`);\n    }\n    this.items.set(key, spec);\n    return this;\n  }\n\n  list(): IntegrationSpec[] {\n    return [...this.items.values()];\n  }\n\n  get(key: string, version?: number): IntegrationSpec | undefined {\n    if (version != null) {\n      return this.items.get(integrationKey({ key, version }));\n    }\n    let latest: IntegrationSpec | undefined;\n    let maxVersion = -Infinity;\n    for (const spec of this.items.values()) {\n      if (spec.meta.key !== key) continue;\n      if (spec.meta.version > maxVersion) {\n        maxVersion = spec.meta.version;\n        latest = spec;\n      }\n    }\n    return latest;\n  }\n\n  getByCategory(category: IntegrationCategory): IntegrationSpec[] {\n    return this.list().filter((spec) => spec.meta.category === category);\n  }\n}\n\nexport function makeIntegrationSpecKey(meta: IntegrationMeta) {\n  return integrationKey(meta);\n}\n\n"],"mappings":"AA2FA,MAAM,EAAkB,GACtB,GAAG,EAAK,IAAI,IAAI,EAAK,UAEvB,IAAa,EAAb,KAAqC,CACnC,MAAyB,IAAI,IAE7B,SAAS,EAA6B,CACpC,IAAM,EAAM,EAAe,EAAK,KAAK,CACrC,GAAI,KAAK,MAAM,IAAI,EAAI,CACrB,MAAU,MAAM,6BAA6B,IAAM,CAGrD,OADA,KAAK,MAAM,IAAI,EAAK,EAAK,CAClB,KAGT,MAA0B,CACxB,MAAO,CAAC,GAAG,KAAK,MAAM,QAAQ,CAAC,CAGjC,IAAI,EAAa,EAA+C,CAC9D,GAAI,GAAW,KACb,OAAO,KAAK,MAAM,IAAI,EAAe,CAAE,MAAK,UAAS,CAAC,CAAC,CAEzD,IAAIA,EACA,EAAa,KACjB,IAAK,IAAM,KAAQ,KAAK,MAAM,QAAQ,CAChC,EAAK,KAAK,MAAQ,GAClB,EAAK,KAAK,QAAU,IACtB,EAAa,EAAK,KAAK,QACvB,EAAS,GAGb,OAAO,EAGT,cAAc,EAAkD,CAC9D,OAAO,KAAK,MAAM,CAAC,OAAQ,GAAS,EAAK,KAAK,WAAa,EAAS,GAIxE,SAAgB,EAAuB,EAAuB,CAC5D,OAAO,EAAe,EAAK"}

package/dist/jobs/gcp-cloud-tasks.d.ts

@@ -0,0 +1,42 @@
+import { EnqueueOptions, Job, JobHandler, JobQueue } from "./queue.js";
+
+//#region src/jobs/gcp-cloud-tasks.d.ts
+interface CloudTasksClientLike {
+  createTask(request: {
+    parent: string;
+    task: {
+      httpRequest: {
+        httpMethod: number | string;
+        url: string;
+        body: Buffer;
+        headers?: Record<string, string>;
+        oidcToken?: {
+          serviceAccountEmail: string;
+        };
+      };
+      scheduleTime?: {
+        seconds: number;
+      };
+    };
+  }): Promise<unknown>;
+}
+interface GcpCloudTasksQueueOptions {
+  client: CloudTasksClientLike;
+  projectId: string;
+  location: string;
+  queue: string;
+  resolveUrl(jobType: string): string;
+  serviceAccountEmail?: string;
+}
+declare class GcpCloudTasksQueue implements JobQueue {
+  private readonly options;
+  private readonly handlers;
+  constructor(options: GcpCloudTasksQueueOptions);
+  enqueue<TPayload>(jobType: string, payload: TPayload, options?: EnqueueOptions): Promise<Job<TPayload>>;
+  register<TPayload>(jobType: string, handler: JobHandler<TPayload>): void;
+  start(): void;
+  stop(): Promise<void>;
+}
+//#endregion
+export { GcpCloudTasksQueue, GcpCloudTasksQueueOptions };
+//# sourceMappingURL=gcp-cloud-tasks.d.ts.map

package/dist/jobs/gcp-cloud-tasks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gcp-cloud-tasks.d.ts","names":[],"sources":["../../src/jobs/gcp-cloud-tasks.ts"],"sourcesContent":[],"mappings":";;;UAIU,oBAAA;;IAAA,MAAA,EAAA,MAAA;IAOI,IAAA,EAAA;MACI,WAAA,EAAA;QAKZ,UAAA,EAAA,MAAA,GAAA,MAAA;QAAO,GAAA,EAAA,MAAA;QAGI,IAAA,EATH,MASG;QASJ,OAAA,CAAA,EAjBK,MAiBc,CAAA,MAAA,EAAA,MAAA,CAAA;QAGQ,SAAA,CAAA,EAAA;UAI3B,mBAAA,EAAA,MAAA;QACA,CAAA;MACI,CAAA;MAAJ,YAAA,CAAA,EAAA;QAAR,OAAA,EAAA,MAAA;MAwCqD,CAAA;IAAX,CAAA;EAQ/B,CAAA,CAAA,EArEV,OAqEU,CAAA,OAAA,CAAA;;AAzDmC,UATlC,yBAAA,CASkC;UARzC;;;;;;;cAQG,kBAAA,YAA8B;;;uBAGH;8CAI3B,oBACA,iBACR,QAAQ,IAAI;+CAwC8B,WAAW;;UAQ1C"}

package/dist/jobs/gcp-cloud-tasks.js

@@ -0,0 +1,2 @@
+import{randomUUID as e}from"node:crypto";var t=class{handlers=new Map;constructor(e){this.options=e}async enqueue(t,n,r={}){let i=r.delaySeconds==null?void 0:{seconds:Math.floor(Date.now()/1e3)+r.delaySeconds},a=Buffer.from(JSON.stringify({id:e(),type:t,payload:n}),`utf-8`);return await this.options.client.createTask({parent:`projects/${this.options.projectId}/locations/${this.options.location}/queues/${this.options.queue}`,task:{httpRequest:{httpMethod:`POST`,url:this.options.resolveUrl(t),body:a,headers:{"Content-Type":`application/json`},oidcToken:this.options.serviceAccountEmail?{serviceAccountEmail:this.options.serviceAccountEmail}:void 0},scheduleTime:i}}),{id:e(),type:t,payload:n,status:`pending`,attempts:0,createdAt:new Date,updatedAt:new Date}}register(e,t){this.handlers.set(e,t)}start(){}async stop(){this.handlers.clear()}};export{t as GcpCloudTasksQueue};
+//# sourceMappingURL=gcp-cloud-tasks.js.map

package/dist/jobs/gcp-cloud-tasks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gcp-cloud-tasks.js","names":["options: GcpCloudTasksQueueOptions"],"sources":["../../src/jobs/gcp-cloud-tasks.ts"],"sourcesContent":["import { randomUUID } from 'node:crypto';\n\nimport type { EnqueueOptions, Job, JobHandler, JobQueue } from './queue';\n\ninterface CloudTasksClientLike {\n  createTask(request: {\n    parent: string;\n    task: {\n      httpRequest: {\n        httpMethod: number | string;\n        url: string;\n        body: Buffer;\n        headers?: Record<string, string>;\n        oidcToken?: { serviceAccountEmail: string };\n      };\n      scheduleTime?: { seconds: number };\n    };\n  }): Promise<unknown>;\n}\n\nexport interface GcpCloudTasksQueueOptions {\n  client: CloudTasksClientLike;\n  projectId: string;\n  location: string;\n  queue: string;\n  resolveUrl(jobType: string): string;\n  serviceAccountEmail?: string;\n}\n\nexport class GcpCloudTasksQueue implements JobQueue {\n  private readonly handlers = new Map<string, JobHandler>();\n\n  constructor(private readonly options: GcpCloudTasksQueueOptions) {}\n\n  async enqueue<TPayload>(\n    jobType: string,\n    payload: TPayload,\n    options: EnqueueOptions = {}\n  ): Promise<Job<TPayload>> {\n    const enqueueTime =\n      options.delaySeconds != null\n        ? { seconds: Math.floor(Date.now() / 1000) + options.delaySeconds }\n        : undefined;\n    const body = Buffer.from(\n      JSON.stringify({\n        id: randomUUID(),\n        type: jobType,\n        payload,\n      }),\n      'utf-8'\n    );\n    await this.options.client.createTask({\n      parent: `projects/${this.options.projectId}/locations/${this.options.location}/queues/${this.options.queue}`,\n      task: {\n        httpRequest: {\n          httpMethod: 'POST',\n          url: this.options.resolveUrl(jobType),\n          body,\n          headers: { 'Content-Type': 'application/json' },\n          oidcToken: this.options.serviceAccountEmail\n            ? { serviceAccountEmail: this.options.serviceAccountEmail }\n            : undefined,\n        },\n        scheduleTime: enqueueTime,\n      },\n    });\n\n    return {\n      id: randomUUID(),\n      type: jobType,\n      payload,\n      status: 'pending',\n      attempts: 0,\n      createdAt: new Date(),\n      updatedAt: new Date(),\n    };\n  }\n\n  register<TPayload>(jobType: string, handler: JobHandler<TPayload>): void {\n    this.handlers.set(jobType, handler as JobHandler);\n  }\n\n  start(): void {\n    // Execution is handled by Cloud Tasks via HTTP callbacks.\n  }\n\n  async stop(): Promise<void> {\n    this.handlers.clear();\n  }\n}\n\n\n"],"mappings":"yCA6BA,IAAa,EAAb,KAAoD,CAClD,SAA4B,IAAI,IAEhC,YAAY,EAAqD,CAApC,KAAA,QAAA,EAE7B,MAAM,QACJ,EACA,EACA,EAA0B,EAAE,CACJ,CACxB,IAAM,EACJ,EAAQ,cAAgB,KAEpB,IAAA,GADA,CAAE,QAAS,KAAK,MAAM,KAAK,KAAK,CAAG,IAAK,CAAG,EAAQ,aAAc,CAEjE,EAAO,OAAO,KAClB,KAAK,UAAU,CACb,GAAI,GAAY,CAChB,KAAM,EACN,UACD,CAAC,CACF,QACD,CAiBD,OAhBA,MAAM,KAAK,QAAQ,OAAO,WAAW,CACnC,OAAQ,YAAY,KAAK,QAAQ,UAAU,aAAa,KAAK,QAAQ,SAAS,UAAU,KAAK,QAAQ,QACrG,KAAM,CACJ,YAAa,CACX,WAAY,OACZ,IAAK,KAAK,QAAQ,WAAW,EAAQ,CACrC,OACA,QAAS,CAAE,eAAgB,mBAAoB,CAC/C,UAAW,KAAK,QAAQ,oBACpB,CAAE,oBAAqB,KAAK,QAAQ,oBAAqB,CACzD,IAAA,GACL,CACD,aAAc,EACf,CACF,CAAC,CAEK,CACL,GAAI,GAAY,CAChB,KAAM,EACN,UACA,OAAQ,UACR,SAAU,EACV,UAAW,IAAI,KACf,UAAW,IAAI,KAChB,CAGH,SAAmB,EAAiB,EAAqC,CACvE,KAAK,SAAS,IAAI,EAAS,EAAsB,CAGnD,OAAc,EAId,MAAM,MAAsB,CAC1B,KAAK,SAAS,OAAO"}

package/dist/jobs/gcp-pubsub.d.ts

@@ -0,0 +1,26 @@
+import { EnqueueOptions, Job, JobHandler, JobQueue } from "./queue.js";
+
+//#region src/jobs/gcp-pubsub.d.ts
+interface PubSubClientLike {
+  topic(name: string): {
+    publishMessage(message: {
+      data: Buffer;
+    }): Promise<string>;
+  };
+}
+interface GcpPubSubQueueOptions {
+  client: PubSubClientLike;
+  topicName: string;
+}
+declare class GcpPubSubQueue implements JobQueue {
+  private readonly options;
+  private readonly handlers;
+  constructor(options: GcpPubSubQueueOptions);
+  enqueue<TPayload>(jobType: string, payload: TPayload, _options?: EnqueueOptions): Promise<Job<TPayload>>;
+  register<TPayload>(jobType: string, handler: JobHandler<TPayload>): void;
+  start(): void;
+  stop(): Promise<void>;
+}
+//#endregion
+export { GcpPubSubQueue, GcpPubSubQueueOptions };
+//# sourceMappingURL=gcp-pubsub.d.ts.map

package/dist/jobs/gcp-pubsub.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gcp-pubsub.d.ts","names":[],"sources":["../../src/jobs/gcp-pubsub.ts"],"sourcesContent":[],"mappings":";;;UAIU,gBAAA;;IAAA,cAAA,CAAgB,OAAA,EAAA;MAMT,IAAA,EAJmB,MAInB;IAKJ,CAAA,CAAA,EATkC,OASlC,CAAA,MAAe,CAAA;EAGY,CAAA;;AAK1B,UAbG,qBAAA,CAaH;EACG,MAAA,EAbP,gBAaO;EAAJ,SAAA,EAAA,MAAA;;AAyB6C,cAlC7C,cAAA,YAA0B,QAkCmB,CAAA;EAAX,iBAAA,OAAA;EAQ/B,iBAAA,QAAA;EA1CuB,WAAA,CAAA,OAAA,EAGC,qBAHD;EAAQ,OAAA,CAAA,QAAA,CAAA,CAAA,OAAA,EAAA,MAAA,EAAA,OAAA,EAOlC,QAPkC,EAAA,QAAA,CAAA,EAQjC,cARiC,CAAA,EAS1C,OAT0C,CASlC,GATkC,CAS9B,QAT8B,CAAA,CAAA;+CAkCA,WAAW;;UAQ1C"}

package/dist/jobs/gcp-pubsub.js

@@ -0,0 +1,2 @@
+import{randomUUID as e}from"node:crypto";var t=class{handlers=new Map;constructor(e){this.options=e}async enqueue(t,n,r={}){return await this.options.client.topic(this.options.topicName).publishMessage({data:Buffer.from(JSON.stringify({id:e(),type:t,payload:n}),`utf-8`)}),{id:e(),type:t,payload:n,status:`pending`,attempts:0,createdAt:new Date,updatedAt:new Date}}register(e,t){this.handlers.set(e,t)}start(){}async stop(){this.handlers.clear()}};export{t as GcpPubSubQueue};
+//# sourceMappingURL=gcp-pubsub.js.map

package/dist/jobs/gcp-pubsub.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gcp-pubsub.js","names":["options: GcpPubSubQueueOptions"],"sources":["../../src/jobs/gcp-pubsub.ts"],"sourcesContent":["import { randomUUID } from 'node:crypto';\n\nimport type { EnqueueOptions, Job, JobHandler, JobQueue } from './queue';\n\ninterface PubSubClientLike {\n  topic(name: string): {\n    publishMessage(message: { data: Buffer }): Promise<string>;\n  };\n}\n\nexport interface GcpPubSubQueueOptions {\n  client: PubSubClientLike;\n  topicName: string;\n}\n\nexport class GcpPubSubQueue implements JobQueue {\n  private readonly handlers = new Map<string, JobHandler>();\n\n  constructor(private readonly options: GcpPubSubQueueOptions) {}\n\n  async enqueue<TPayload>(\n    jobType: string,\n    payload: TPayload,\n    _options: EnqueueOptions = {}\n  ): Promise<Job<TPayload>> {\n    await this.options.client\n      .topic(this.options.topicName)\n      .publishMessage({\n        data: Buffer.from(\n          JSON.stringify({\n            id: randomUUID(),\n            type: jobType,\n            payload,\n          }),\n          'utf-8'\n        ),\n      });\n\n    return {\n      id: randomUUID(),\n      type: jobType,\n      payload,\n      status: 'pending',\n      attempts: 0,\n      createdAt: new Date(),\n      updatedAt: new Date(),\n    };\n  }\n\n  register<TPayload>(jobType: string, handler: JobHandler<TPayload>): void {\n    this.handlers.set(jobType, handler as JobHandler);\n  }\n\n  start(): void {\n    // Message consumption handled externally via Pub/Sub subscription.\n  }\n\n  async stop(): Promise<void> {\n    this.handlers.clear();\n  }\n}\n\n\n"],"mappings":"yCAeA,IAAa,EAAb,KAAgD,CAC9C,SAA4B,IAAI,IAEhC,YAAY,EAAiD,CAAhC,KAAA,QAAA,EAE7B,MAAM,QACJ,EACA,EACA,EAA2B,EAAE,CACL,CAcxB,OAbA,MAAM,KAAK,QAAQ,OAChB,MAAM,KAAK,QAAQ,UAAU,CAC7B,eAAe,CACd,KAAM,OAAO,KACX,KAAK,UAAU,CACb,GAAI,GAAY,CAChB,KAAM,EACN,UACD,CAAC,CACF,QACD,CACF,CAAC,CAEG,CACL,GAAI,GAAY,CAChB,KAAM,EACN,UACA,OAAQ,UACR,SAAU,EACV,UAAW,IAAI,KACf,UAAW,IAAI,KAChB,CAGH,SAAmB,EAAiB,EAAqC,CACvE,KAAK,SAAS,IAAI,EAAS,EAAsB,CAGnD,OAAc,EAId,MAAM,MAAsB,CAC1B,KAAK,SAAS,OAAO"}

package/dist/jobs/handlers/gmail-sync-handler.d.ts

@@ -0,0 +1,10 @@
+import { EmailThreadListQuery } from "../../integrations/providers/email.js";
+import { JobHandler } from "../queue.js";
+import { GmailIngestionAdapter } from "../../knowledge/ingestion/gmail-adapter.js";
+
+//#region src/jobs/handlers/gmail-sync-handler.d.ts
+interface GmailSyncJobPayload extends EmailThreadListQuery {}
+declare function createGmailSyncHandler(adapter: GmailIngestionAdapter): JobHandler<GmailSyncJobPayload>;
+//#endregion
+export { GmailSyncJobPayload, createGmailSyncHandler };
+//# sourceMappingURL=gmail-sync-handler.d.ts.map

package/dist/jobs/handlers/gmail-sync-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gmail-sync-handler.d.ts","names":[],"sources":["../../../src/jobs/handlers/gmail-sync-handler.ts"],"sourcesContent":[],"mappings":";;;;;UAIiB,mBAAA,SAA4B;AAA5B,iBAED,sBAAA,CAF6B,OAAA,EAGlC,qBAHsD,CAAA,EAI9D,UAJ8D,CAInD,mBAJmD,CAAA"}

package/dist/jobs/handlers/gmail-sync-handler.js

@@ -0,0 +1,2 @@
+function e(e){return async t=>{await e.syncThreads(t.payload)}}export{e as createGmailSyncHandler};
+//# sourceMappingURL=gmail-sync-handler.js.map

package/dist/jobs/handlers/gmail-sync-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gmail-sync-handler.js","names":[],"sources":["../../../src/jobs/handlers/gmail-sync-handler.ts"],"sourcesContent":["import type { JobHandler } from '../queue';\nimport type { GmailIngestionAdapter } from '../../knowledge/ingestion/gmail-adapter';\nimport type { EmailThreadListQuery } from '../../integrations/providers/email';\n\nexport interface GmailSyncJobPayload extends EmailThreadListQuery {}\n\nexport function createGmailSyncHandler(\n  adapter: GmailIngestionAdapter\n): JobHandler<GmailSyncJobPayload> {\n  return async (job) => {\n    await adapter.syncThreads(job.payload);\n  };\n}\n\n\n"],"mappings":"AAMA,SAAgB,EACd,EACiC,CACjC,OAAO,KAAO,IAAQ,CACpB,MAAM,EAAQ,YAAY,EAAI,QAAQ"}

package/dist/jobs/handlers/index.d.ts

@@ -0,0 +1,3 @@
+import { GmailSyncJobPayload, createGmailSyncHandler } from "./gmail-sync-handler.js";
+import { StorageDocumentJobPayload, createStorageDocumentHandler } from "./storage-document-handler.js";
+export { GmailSyncJobPayload, StorageDocumentJobPayload, createGmailSyncHandler, createStorageDocumentHandler };

package/dist/jobs/handlers/index.js

@@ -0,0 +1 @@
+import{createGmailSyncHandler as e}from"./gmail-sync-handler.js";import{createStorageDocumentHandler as t}from"./storage-document-handler.js";export{e as createGmailSyncHandler,t as createStorageDocumentHandler};

package/dist/jobs/handlers/storage-document-handler.d.ts

@@ -0,0 +1,13 @@
+import { ObjectStorageProvider } from "../../integrations/providers/storage.js";
+import { JobHandler } from "../queue.js";
+import { StorageIngestionAdapter } from "../../knowledge/ingestion/storage-adapter.js";
+
+//#region src/jobs/handlers/storage-document-handler.d.ts
+interface StorageDocumentJobPayload {
+  bucket: string;
+  key: string;
+}
+declare function createStorageDocumentHandler(storage: ObjectStorageProvider, adapter: StorageIngestionAdapter): JobHandler<StorageDocumentJobPayload>;
+//#endregion
+export { StorageDocumentJobPayload, createStorageDocumentHandler };
+//# sourceMappingURL=storage-document-handler.d.ts.map

package/dist/jobs/handlers/storage-document-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-document-handler.d.ts","names":[],"sources":["../../../src/jobs/handlers/storage-document-handler.ts"],"sourcesContent":[],"mappings":";;;;;UAIiB,yBAAA;;EAAA,GAAA,EAAA,MAAA;AAKjB;AACW,iBADK,4BAAA,CACL,OAAA,EAAA,qBAAA,EAAA,OAAA,EACA,uBADA,CAAA,EAER,UAFQ,CAEG,yBAFH,CAAA"}

package/dist/jobs/handlers/storage-document-handler.js

@@ -0,0 +1,2 @@
+function e(e,t){return async n=>{let r=await e.getObject({bucket:n.payload.bucket,key:n.payload.key});if(!r)throw Error(`Object ${n.payload.bucket}/${n.payload.key} not found`);await t.ingestObject(r)}}export{e as createStorageDocumentHandler};
+//# sourceMappingURL=storage-document-handler.js.map

package/dist/jobs/handlers/storage-document-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-document-handler.js","names":[],"sources":["../../../src/jobs/handlers/storage-document-handler.ts"],"sourcesContent":["import type { ObjectStorageProvider } from '../../integrations/providers/storage';\nimport type { StorageIngestionAdapter } from '../../knowledge/ingestion/storage-adapter';\nimport type { JobHandler } from '../queue';\n\nexport interface StorageDocumentJobPayload {\n  bucket: string;\n  key: string;\n}\n\nexport function createStorageDocumentHandler(\n  storage: ObjectStorageProvider,\n  adapter: StorageIngestionAdapter\n): JobHandler<StorageDocumentJobPayload> {\n  return async (job) => {\n    const object = await storage.getObject({\n      bucket: job.payload.bucket,\n      key: job.payload.key,\n    });\n    if (!object) {\n      throw new Error(\n        `Object ${job.payload.bucket}/${job.payload.key} not found`\n      );\n    }\n    await adapter.ingestObject(object);\n  };\n}\n\n\n"],"mappings":"AASA,SAAgB,EACd,EACA,EACuC,CACvC,OAAO,KAAO,IAAQ,CACpB,IAAM,EAAS,MAAM,EAAQ,UAAU,CACrC,OAAQ,EAAI,QAAQ,OACpB,IAAK,EAAI,QAAQ,IAClB,CAAC,CACF,GAAI,CAAC,EACH,MAAU,MACR,UAAU,EAAI,QAAQ,OAAO,GAAG,EAAI,QAAQ,IAAI,YACjD,CAEH,MAAM,EAAQ,aAAa,EAAO"}

package/dist/jobs/index.d.ts

@@ -0,0 +1,7 @@
+import { EnqueueOptions, Job, JobHandler, JobQueue, JobStatus } from "./queue.js";
+import { GcpCloudTasksQueue, GcpCloudTasksQueueOptions } from "./gcp-cloud-tasks.js";
+import { GcpPubSubQueue, GcpPubSubQueueOptions } from "./gcp-pubsub.js";
+import { GmailSyncJobPayload, createGmailSyncHandler } from "./handlers/gmail-sync-handler.js";
+import { StorageDocumentJobPayload, createStorageDocumentHandler } from "./handlers/storage-document-handler.js";
+import { MemoryJobQueue } from "./memory-queue.js";
+export { EnqueueOptions, GcpCloudTasksQueue, GcpCloudTasksQueueOptions, GcpPubSubQueue, GcpPubSubQueueOptions, GmailSyncJobPayload, Job, JobHandler, JobQueue, JobStatus, MemoryJobQueue, StorageDocumentJobPayload, createGmailSyncHandler, createStorageDocumentHandler };

package/dist/jobs/index.js

@@ -0,0 +1 @@
+import{GcpCloudTasksQueue as e}from"./gcp-cloud-tasks.js";import{GcpPubSubQueue as t}from"./gcp-pubsub.js";import{MemoryJobQueue as n}from"./memory-queue.js";import{createGmailSyncHandler as r}from"./handlers/gmail-sync-handler.js";import{createStorageDocumentHandler as i}from"./handlers/storage-document-handler.js";export{e as GcpCloudTasksQueue,t as GcpPubSubQueue,n as MemoryJobQueue,r as createGmailSyncHandler,i as createStorageDocumentHandler};

package/dist/jobs/memory-queue.d.ts

@@ -0,0 +1,19 @@
+import { EnqueueOptions, Job, JobHandler, JobQueue } from "./queue.js";
+
+//#region src/jobs/memory-queue.d.ts
+declare class MemoryJobQueue implements JobQueue {
+  private readonly pollIntervalMs;
+  private readonly jobs;
+  private readonly handlers;
+  private timer?;
+  private processing;
+  constructor(pollIntervalMs?: number);
+  enqueue<TPayload>(jobType: string, payload: TPayload, options?: EnqueueOptions): Promise<Job<TPayload>>;
+  register<TPayload>(jobType: string, handler: JobHandler<TPayload>): void;
+  start(): void;
+  stop(): Promise<void>;
+  private processNext;
+}
+//#endregion
+export { MemoryJobQueue };
+//# sourceMappingURL=memory-queue.d.ts.map

package/dist/jobs/memory-queue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-queue.d.ts","names":[],"sources":["../../src/jobs/memory-queue.ts"],"sourcesContent":[],"mappings":";;;cASa,cAAA,YAA0B;;EAA1B,iBAAe,IAAA;EAUf,iBAAA,QAAA;EACA,QAAA,KAAA;EACI,QAAA,UAAA;EAAJ,WAAA,CAAA,cAAA,CAAA,EAAA,MAAA;EAAR,OAAA,CAAA,QAAA,CAAA,CAAA,OAAA,EAAA,MAAA,EAAA,OAAA,EAFQ,QAER,EAAA,OAAA,CAAA,EADQ,cACR,CAAA,EAAA,OAAA,CAAQ,GAAR,CAAY,QAAZ,CAAA,CAAA;EAiBqD,QAAA,CAAA,QAAA,CAAA,CAAA,OAAA,EAAA,MAAA,EAAA,OAAA,EAAX,UAAW,CAAA,QAAA,CAAA,CAAA,EAAA,IAAA;EAAX,KAAA,CAAA,CAAA,EAAA,IAAA;EAW/B,IAAA,CAAA,CAAA,EAAA,OAAA,CAAA,IAAA,CAAA;EAxCuB,QAAA,WAAA"}

package/dist/jobs/memory-queue.js

@@ -0,0 +1,2 @@
+import{randomUUID as e}from"node:crypto";var t=class{jobs=[];handlers=new Map;timer;processing=!1;constructor(e=200){this.pollIntervalMs=e}async enqueue(t,n,r={}){let i={id:e(),type:t,payload:n,status:`pending`,attempts:0,createdAt:new Date,updatedAt:new Date};return r.delaySeconds&&(i.updatedAt=new Date(Date.now()+r.delaySeconds*1e3)),this.jobs.push(i),i}register(e,t){this.handlers.set(e,t)}start(){this.timer||=setInterval(()=>{this.processNext()},this.pollIntervalMs)}async stop(){for(this.timer&&=(clearInterval(this.timer),void 0);this.processing;)await new Promise(e=>setTimeout(e,10))}async processNext(){if(this.processing)return;let e=this.jobs.find(e=>e.status===`pending`&&e.updatedAt<=new Date);if(!e)return;let t=this.handlers.get(e.type);if(t){this.processing=!0,e.status=`running`,e.updatedAt=new Date,e.attempts+=1;try{await t(e),e.status=`completed`,e.updatedAt=new Date}catch(t){e.status=`failed`,e.lastError=t instanceof Error?t.message:`Unknown job error`,e.updatedAt=new Date}finally{this.processing=!1}}}};export{t as MemoryJobQueue};
+//# sourceMappingURL=memory-queue.js.map

package/dist/jobs/memory-queue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-queue.js","names":["job: Job<TPayload>"],"sources":["../../src/jobs/memory-queue.ts"],"sourcesContent":["import { randomUUID } from 'node:crypto';\n\nimport type {\n  EnqueueOptions,\n  Job,\n  JobHandler,\n  JobQueue,\n} from './queue';\n\nexport class MemoryJobQueue implements JobQueue {\n  private readonly jobs: Job[] = [];\n  private readonly handlers = new Map<string, JobHandler>();\n  private timer?: NodeJS.Timeout;\n  private processing = false;\n\n  constructor(private readonly pollIntervalMs = 200) {}\n\n  async enqueue<TPayload>(\n    jobType: string,\n    payload: TPayload,\n    options: EnqueueOptions = {}\n  ): Promise<Job<TPayload>> {\n    const job: Job<TPayload> = {\n      id: randomUUID(),\n      type: jobType,\n      payload,\n      status: 'pending',\n      attempts: 0,\n      createdAt: new Date(),\n      updatedAt: new Date(),\n    };\n    if (options.delaySeconds) {\n      job.updatedAt = new Date(Date.now() + options.delaySeconds * 1000);\n    }\n    this.jobs.push(job);\n    return job;\n  }\n\n  register<TPayload>(jobType: string, handler: JobHandler<TPayload>): void {\n    this.handlers.set(jobType, handler as JobHandler);\n  }\n\n  start(): void {\n    if (this.timer) return;\n    this.timer = setInterval(() => {\n      void this.processNext();\n    }, this.pollIntervalMs);\n  }\n\n  async stop(): Promise<void> {\n    if (this.timer) {\n      clearInterval(this.timer);\n      this.timer = undefined;\n    }\n    while (this.processing) {\n      await new Promise((resolve) => setTimeout(resolve, 10));\n    }\n  }\n\n  private async processNext() {\n    if (this.processing) return;\n    const job = this.jobs.find((j) => j.status === 'pending' && j.updatedAt <= new Date());\n    if (!job) return;\n    const handler = this.handlers.get(job.type);\n    if (!handler) return;\n\n    this.processing = true;\n    job.status = 'running';\n    job.updatedAt = new Date();\n    job.attempts += 1;\n\n    try {\n      await handler(job);\n      job.status = 'completed';\n      job.updatedAt = new Date();\n    } catch (error) {\n      job.status = 'failed';\n      job.lastError =\n        error instanceof Error ? error.message : 'Unknown job error';\n      job.updatedAt = new Date();\n    } finally {\n      this.processing = false;\n    }\n  }\n}\n\n\n"],"mappings":"yCASA,IAAa,EAAb,KAAgD,CAC9C,KAA+B,EAAE,CACjC,SAA4B,IAAI,IAChC,MACA,WAAqB,GAErB,YAAY,EAAkC,IAAK,CAAtB,KAAA,eAAA,EAE7B,MAAM,QACJ,EACA,EACA,EAA0B,EAAE,CACJ,CACxB,IAAMA,EAAqB,CACzB,GAAI,GAAY,CAChB,KAAM,EACN,UACA,OAAQ,UACR,SAAU,EACV,UAAW,IAAI,KACf,UAAW,IAAI,KAChB,CAKD,OAJI,EAAQ,eACV,EAAI,UAAY,IAAI,KAAK,KAAK,KAAK,CAAG,EAAQ,aAAe,IAAK,EAEpE,KAAK,KAAK,KAAK,EAAI,CACZ,EAGT,SAAmB,EAAiB,EAAqC,CACvE,KAAK,SAAS,IAAI,EAAS,EAAsB,CAGnD,OAAc,CACR,AACJ,KAAK,QAAQ,gBAAkB,CACxB,KAAK,aAAa,EACtB,KAAK,eAAe,CAGzB,MAAM,MAAsB,CAK1B,IAJA,AAEE,KAAK,SADL,cAAc,KAAK,MAAM,CACZ,IAAA,IAER,KAAK,YACV,MAAM,IAAI,QAAS,GAAY,WAAW,EAAS,GAAG,CAAC,CAI3D,MAAc,aAAc,CAC1B,GAAI,KAAK,WAAY,OACrB,IAAM,EAAM,KAAK,KAAK,KAAM,GAAM,EAAE,SAAW,WAAa,EAAE,WAAa,IAAI,KAAO,CACtF,GAAI,CAAC,EAAK,OACV,IAAM,EAAU,KAAK,SAAS,IAAI,EAAI,KAAK,CACtC,KAKL,CAHA,KAAK,WAAa,GAClB,EAAI,OAAS,UACb,EAAI,UAAY,IAAI,KACpB,EAAI,UAAY,EAEhB,GAAI,CACF,MAAM,EAAQ,EAAI,CAClB,EAAI,OAAS,YACb,EAAI,UAAY,IAAI,WACb,EAAO,CACd,EAAI,OAAS,SACb,EAAI,UACF,aAAiB,MAAQ,EAAM,QAAU,oBAC3C,EAAI,UAAY,IAAI,YACZ,CACR,KAAK,WAAa"}

package/dist/jobs/queue.d.ts

@@ -0,0 +1,27 @@
+//#region src/jobs/queue.d.ts
+type JobStatus = 'pending' | 'running' | 'completed' | 'failed';
+interface Job<TPayload = unknown> {
+  id: string;
+  type: string;
+  payload: TPayload;
+  status: JobStatus;
+  attempts: number;
+  createdAt: Date;
+  updatedAt: Date;
+  lastError?: string;
+}
+interface EnqueueOptions {
+  delaySeconds?: number;
+  dedupeKey?: string;
+  maxAttempts?: number;
+}
+type JobHandler<TPayload = unknown> = (job: Job<TPayload>) => Promise<void>;
+interface JobQueue {
+  enqueue<TPayload>(jobType: string, payload: TPayload, options?: EnqueueOptions): Promise<Job<TPayload>>;
+  register<TPayload>(jobType: string, handler: JobHandler<TPayload>): void;
+  start(): void;
+  stop(): Promise<void>;
+}
+//#endregion
+export { EnqueueOptions, Job, JobHandler, JobQueue, JobStatus };
+//# sourceMappingURL=queue.d.ts.map

package/dist/jobs/queue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"queue.d.ts","names":[],"sources":["../../src/jobs/queue.ts"],"sourcesContent":[],"mappings":";KAAY,SAAA;AAAA,UAMK,GANI,CAAA,WAAA,OAAA,CAAA,CAAA;EAMJ,EAAA,EAAA,MAAG;EAGT,IAAA,EAAA,MAAA;EACD,OAAA,EADC,QACD;EAEG,MAAA,EAFH,SAEG;EACA,QAAA,EAAA,MAAA;EAAI,SAAA,EADJ,IACI;EAIA,SAAA,EAJJ,IAII;EAML,SAAA,CAAA,EAAA,MAAU;;AACf,UAPU,cAAA,CAOV;EACF,YAAA,CAAA,EAAA,MAAA;EAAO,SAAA,CAAA,EAAA,MAAA;EAEK,WAAQ,CAAA,EAAA,MAAA;;AAIX,KARF,UAQE,CAAA,WAAA,OAAA,CAAA,GAAA,CAAA,GAAA,EAPP,GAOO,CAPH,QAOG,CAAA,EAAA,GANT,OAMS,CAAA,IAAA,CAAA;AACG,UALA,QAAA,CAKA;EAAJ,OAAA,CAAA,QAAA,CAAA,CAAA,OAAA,EAAA,MAAA,EAAA,OAAA,EAFA,QAEA,EAAA,OAAA,CAAA,EADC,cACD,CAAA,EAAR,OAAQ,CAAA,GAAA,CAAI,QAAJ,CAAA,CAAA;EAAR,QAAA,CAAA,QAAA,CAAA,CAAA,OAAA,EAAA,MAAA,EAAA,OAAA,EAC0C,UAD1C,CACqD,QADrD,CAAA,CAAA,EAAA,IAAA;EACqD,KAAA,EAAA,EAAA,IAAA;EAAX,IAAA,EAAA,EAErC,OAFqC,CAAA,IAAA,CAAA"}

package/dist/jsonschema.d.ts

@@ -0,0 +1,27 @@
+import { Stability, Tag } from "./ownership.js";
+import { ContractSpec, OpKind } from "./spec.js";
+import z$1 from "zod";
+import { AnySchemaModel } from "@lssm/lib.schema";
+
+//#region src/jsonschema.d.ts
+declare function jsonSchemaForSpec(spec: ContractSpec<AnySchemaModel, AnySchemaModel>): {
+  input: z$1.core.JSONSchema.JSONSchema | null;
+  output: z$1.core.JSONSchema.JSONSchema | null;
+  meta: {
+    name: string;
+    version: number;
+    kind: OpKind;
+    description: string;
+    tags: Tag[];
+    stability: Stability;
+  };
+};
+/** Helper to derive default REST path */
+declare function defaultRestPath(name: string, version: number): string;
+/** Helper to derive default MCP tool name */
+declare function defaultMcpTool(name: string, version: number): string;
+/** Helper to derive default GraphQL field name */
+declare function defaultGqlField(name: string, version: number): string;
+//#endregion
+export { defaultGqlField, defaultMcpTool, defaultRestPath, jsonSchemaForSpec };
+//# sourceMappingURL=jsonschema.d.ts.map

package/dist/jsonschema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsonschema.d.ts","names":[],"sources":["../src/jsonschema.ts"],"sourcesContent":[],"mappings":";;;;;;AAOgB,iBAAA,iBAAA,CAAiB,IAAA,EACzB,YADyB,CACZ,cADY,EACI,cADJ,CAAA,CAAA,EAAA;EACZ,KAAA,gCAAA,GAAA,IAAA;EAAgB,MAAA,gCAAA,GAAA,IAAA;EAA7B,IAAA,EAAA;;;;;;;EAiBQ,CAAA;AAKhB,CAAA;AAKA;iBAVgB,eAAA;;iBAKA,cAAA;;iBAKA,eAAA"}

package/dist/jsonschema.js

@@ -0,0 +1,2 @@
+import e from"zod";function t(t){return{input:t.io.input?e.toJSONSchema(t.io.input.getZod()):null,output:t.io.output?e.toJSONSchema(t.io.output.getZod()):null,meta:{name:t.meta.name,version:t.meta.version,kind:t.meta.kind,description:t.meta.description,tags:t.meta.tags??[],stability:t.meta.stability??`stable`}}}function n(e,t){return`/${e.replace(/\./g,`/`)}/v${t}`}function r(e,t){return`${e}.v${t}`}function i(e,t){return`${e.replace(/\./g,`_`)}_v${t}`}export{i as defaultGqlField,r as defaultMcpTool,n as defaultRestPath,t as jsonSchemaForSpec};
+//# sourceMappingURL=jsonschema.js.map

package/dist/jsonschema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsonschema.js","names":["z"],"sources":["../src/jsonschema.ts"],"sourcesContent":["/**\n * Convert zod I/O to JSON Schema so adapters can generate OpenAPI/MCP.\n */\nimport type { ContractSpec } from './spec';\nimport type { AnySchemaModel } from '@lssm/lib.schema';\nimport z from 'zod';\n\nexport function jsonSchemaForSpec(\n  spec: ContractSpec<AnySchemaModel, AnySchemaModel>\n) {\n  return {\n    input: spec.io.input ? z.toJSONSchema(spec.io.input.getZod()) : null,\n    output: spec.io.output ? z.toJSONSchema(spec.io.output.getZod()) : null,\n    meta: {\n      name: spec.meta.name,\n      version: spec.meta.version,\n      kind: spec.meta.kind,\n      description: spec.meta.description,\n      tags: spec.meta.tags ?? [],\n      stability: spec.meta.stability ?? 'stable',\n    },\n  };\n}\n\n/** Helper to derive default REST path */\nexport function defaultRestPath(name: string, version: number) {\n  return `/${name.replace(/\\./g, '/')}/v${version}`;\n}\n\n/** Helper to derive default MCP tool name */\nexport function defaultMcpTool(name: string, version: number) {\n  return `${name}.v${version}`;\n}\n\n/** Helper to derive default GraphQL field name */\nexport function defaultGqlField(name: string, version: number) {\n  return `${name.replace(/\\./g, '_')}_v${version}`;\n}\n"],"mappings":"mBAOA,SAAgB,EACd,EACA,CACA,MAAO,CACL,MAAO,EAAK,GAAG,MAAQA,EAAE,aAAa,EAAK,GAAG,MAAM,QAAQ,CAAC,CAAG,KAChE,OAAQ,EAAK,GAAG,OAASA,EAAE,aAAa,EAAK,GAAG,OAAO,QAAQ,CAAC,CAAG,KACnE,KAAM,CACJ,KAAM,EAAK,KAAK,KAChB,QAAS,EAAK,KAAK,QACnB,KAAM,EAAK,KAAK,KAChB,YAAa,EAAK,KAAK,YACvB,KAAM,EAAK,KAAK,MAAQ,EAAE,CAC1B,UAAW,EAAK,KAAK,WAAa,SACnC,CACF,CAIH,SAAgB,EAAgB,EAAc,EAAiB,CAC7D,MAAO,IAAI,EAAK,QAAQ,MAAO,IAAI,CAAC,IAAI,IAI1C,SAAgB,EAAe,EAAc,EAAiB,CAC5D,MAAO,GAAG,EAAK,IAAI,IAIrB,SAAgB,EAAgB,EAAc,EAAiB,CAC7D,MAAO,GAAG,EAAK,QAAQ,MAAO,IAAI,CAAC,IAAI"}

package/dist/knowledge/binding.d.ts

@@ -0,0 +1,26 @@
+//#region src/knowledge/binding.d.ts
+interface AppKnowledgeBinding {
+  /** Which KnowledgeSpace to use. */
+  spaceKey: string;
+  spaceVersion?: number;
+  /** Optional: scope to specific workflows/agents. */
+  scope?: {
+    workflows?: string[];
+    agents?: string[];
+    operations?: string[];
+  };
+  /** Usage constraints. */
+  constraints?: {
+    /** Max tokens per query. */
+    maxTokensPerQuery?: number;
+    /** Max queries per minute. */
+    maxQueriesPerMinute?: number;
+  };
+  /** Priority when multiple spaces overlap. */
+  priority?: number;
+  /** Whether access to the space is required (blocking) or optional. */
+  required?: boolean;
+}
+//#endregion
+export { AppKnowledgeBinding };
+//# sourceMappingURL=binding.d.ts.map

package/dist/knowledge/binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"binding.d.ts","names":[],"sources":["../../src/knowledge/binding.ts"],"sourcesContent":[],"mappings":";UAAiB,mBAAA;EAAA"}