@lssm/lib.contracts 1.11.0 → 1.41.0

package/dist/integrations/runtime.js

@@ -1,2 +1 @@
-import{performance as e}from"node:perf_hooks";var t=class{telemetry;maxAttempts;backoffMs;shouldRetry;sleep;now;constructor(e,t={}){this.secretProvider=e,this.telemetry=t.telemetry,this.maxAttempts=Math.max(1,t.maxAttempts??3),this.backoffMs=t.backoffMs??250,this.shouldRetry=t.shouldRetry??(e=>typeof e==`object`&&!!e&&`retryable`in e&&!!e.retryable),this.sleep=t.sleep??(e=>e<=0?Promise.resolve():new Promise(t=>setTimeout(t,e))),this.now=t.now??(()=>new Date)}async executeWithGuards(t,n,r,i,a){let o=this.findIntegration(t,i);if(!o)return this.failure({tenantId:i.tenantId,appId:i.appId,environment:i.environment,blueprintName:i.blueprintName,blueprintVersion:i.blueprintVersion,configVersion:i.configVersion,slotId:t,operation:n},void 0,{code:`SLOT_NOT_BOUND`,message:`Integration slot "${t}" is not bound for tenant "${i.tenantId}".`,retryable:!1},0);let s=o.connection.status;if(s===`disconnected`||s===`error`)return this.failure(this.makeContext(t,n,i),o,{code:`CONNECTION_NOT_READY`,message:`Integration connection "${o.connection.meta.label}" is in status "${s}".`,retryable:!1},0);let c=await this.fetchSecrets(o.connection),l=0,u=e.now();for(;l<this.maxAttempts;){l+=1;try{let r=await a(o.connection,c),s=e.now()-u;return this.emitTelemetry(this.makeContext(t,n,i),o,`success`,s),{success:!0,data:r,metadata:{latencyMs:s,connectionId:o.connection.meta.id,ownershipMode:o.connection.ownershipMode,attempts:l}}}catch(r){let a=e.now()-u;this.emitTelemetry(this.makeContext(t,n,i),o,`error`,a,this.errorCodeFor(r),r instanceof Error?r.message:String(r));let s=this.shouldRetry(r,l);if(!s||l>=this.maxAttempts)return{success:!1,error:{code:this.errorCodeFor(r),message:r instanceof Error?r.message:String(r),retryable:s,cause:r},metadata:{latencyMs:a,connectionId:o.connection.meta.id,ownershipMode:o.connection.ownershipMode,attempts:l}};await this.sleep(this.backoffMs)}}return{success:!1,error:{code:`UNKNOWN_ERROR`,message:`Integration call failed after retries.`,retryable:!1},metadata:{latencyMs:e.now()-u,connectionId:o.connection.meta.id,ownershipMode:o.connection.ownershipMode,attempts:this.maxAttempts}}}findIntegration(e,t){return t.integrations.find(t=>t.slot.slotId===e)}async fetchSecrets(e){if(!this.secretProvider.canHandle(e.secretRef))throw Error(`Secret provider "${this.secretProvider.id}" cannot handle reference "${e.secretRef}".`);let t=await this.secretProvider.getSecret(e.secretRef);return this.parseSecret(t)}parseSecret(e){let t=new TextDecoder().decode(e.data);try{let e=JSON.parse(t);if(e&&typeof e==`object`&&!Array.isArray(e)){let t=Object.entries(e).filter(([,e])=>typeof e==`string`||typeof e==`number`||typeof e==`boolean`);return Object.fromEntries(t.map(([e,t])=>[e,String(t)]))}}catch{}return{secret:t}}emitTelemetry(e,t,n,r,i,a){!this.telemetry||!t||this.telemetry.record({tenantId:e.tenantId,appId:e.appId,environment:e.environment,slotId:e.slotId,integrationKey:t.connection.meta.integrationKey,integrationVersion:t.connection.meta.integrationVersion,connectionId:t.connection.meta.id,status:n,durationMs:r,errorCode:i,errorMessage:a,occurredAt:this.now(),metadata:{blueprint:`${e.blueprintName}.v${e.blueprintVersion}`,configVersion:e.configVersion,operation:e.operation}})}failure(e,t,n,r){return t&&this.emitTelemetry(e,t,`error`,0,n.code,n.message),{success:!1,error:n,metadata:{latencyMs:0,connectionId:t?.connection.meta.id??`unknown`,ownershipMode:t?.connection.ownershipMode??`managed`,attempts:r}}}makeContext(e,t,n){return{tenantId:n.tenantId,appId:n.appId,environment:n.environment,blueprintName:n.blueprintName,blueprintVersion:n.blueprintVersion,configVersion:n.configVersion,slotId:e,operation:t}}errorCodeFor(e){return typeof e==`object`&&e&&`code`in e&&typeof e.code==`string`?e.code:`PROVIDER_ERROR`}};function n(e){let t=e.connection.status;if(t===`disconnected`||t===`error`)throw Error(`Integration connection "${e.connection.meta.label}" is in status "${t}".`)}function r(e){switch(e){case`connected`:return`connected`;case`disconnected`:return`disconnected`;case`error`:return`error`;case`unknown`:default:return`unknown`}}export{t as IntegrationCallGuard,r as connectionStatusLabel,n as ensureConnectionReady};
-//# sourceMappingURL=runtime.js.map
+import{performance as e}from"node:perf_hooks";var t=class{telemetry;maxAttempts;backoffMs;shouldRetry;sleep;now;constructor(e,t={}){this.secretProvider=e,this.telemetry=t.telemetry,this.maxAttempts=Math.max(1,t.maxAttempts??3),this.backoffMs=t.backoffMs??250,this.shouldRetry=t.shouldRetry??(e=>typeof e==`object`&&!!e&&`retryable`in e&&!!e.retryable),this.sleep=t.sleep??(e=>e<=0?Promise.resolve():new Promise(t=>setTimeout(t,e))),this.now=t.now??(()=>new Date)}async executeWithGuards(t,n,r,i,a){let o=this.findIntegration(t,i);if(!o)return this.failure({tenantId:i.tenantId,appId:i.appId,environment:i.environment,blueprintName:i.blueprintName,blueprintVersion:i.blueprintVersion,configVersion:i.configVersion,slotId:t,operation:n},void 0,{code:`SLOT_NOT_BOUND`,message:`Integration slot "${t}" is not bound for tenant "${i.tenantId}".`,retryable:!1},0);let s=o.connection.status;if(s===`disconnected`||s===`error`)return this.failure(this.makeContext(t,n,i),o,{code:`CONNECTION_NOT_READY`,message:`Integration connection "${o.connection.meta.label}" is in status "${s}".`,retryable:!1},0);let c=await this.fetchSecrets(o.connection),l=0,u=e.now();for(;l<this.maxAttempts;){l+=1;try{let r=await a(o.connection,c),s=e.now()-u;return this.emitTelemetry(this.makeContext(t,n,i),o,`success`,s),{success:!0,data:r,metadata:{latencyMs:s,connectionId:o.connection.meta.id,ownershipMode:o.connection.ownershipMode,attempts:l}}}catch(r){let a=e.now()-u;this.emitTelemetry(this.makeContext(t,n,i),o,`error`,a,this.errorCodeFor(r),r instanceof Error?r.message:String(r));let s=this.shouldRetry(r,l);if(!s||l>=this.maxAttempts)return{success:!1,error:{code:this.errorCodeFor(r),message:r instanceof Error?r.message:String(r),retryable:s,cause:r},metadata:{latencyMs:a,connectionId:o.connection.meta.id,ownershipMode:o.connection.ownershipMode,attempts:l}};await this.sleep(this.backoffMs)}}return{success:!1,error:{code:`UNKNOWN_ERROR`,message:`Integration call failed after retries.`,retryable:!1},metadata:{latencyMs:e.now()-u,connectionId:o.connection.meta.id,ownershipMode:o.connection.ownershipMode,attempts:this.maxAttempts}}}findIntegration(e,t){return t.integrations.find(t=>t.slot.slotId===e)}async fetchSecrets(e){if(!this.secretProvider.canHandle(e.secretRef))throw Error(`Secret provider "${this.secretProvider.id}" cannot handle reference "${e.secretRef}".`);let t=await this.secretProvider.getSecret(e.secretRef);return this.parseSecret(t)}parseSecret(e){let t=new TextDecoder().decode(e.data);try{let e=JSON.parse(t);if(e&&typeof e==`object`&&!Array.isArray(e)){let t=Object.entries(e).filter(([,e])=>typeof e==`string`||typeof e==`number`||typeof e==`boolean`);return Object.fromEntries(t.map(([e,t])=>[e,String(t)]))}}catch{}return{secret:t}}emitTelemetry(e,t,n,r,i,a){!this.telemetry||!t||this.telemetry.record({tenantId:e.tenantId,appId:e.appId,environment:e.environment,slotId:e.slotId,integrationKey:t.connection.meta.integrationKey,integrationVersion:t.connection.meta.integrationVersion,connectionId:t.connection.meta.id,status:n,durationMs:r,errorCode:i,errorMessage:a,occurredAt:this.now(),metadata:{blueprint:`${e.blueprintName}.v${e.blueprintVersion}`,configVersion:e.configVersion,operation:e.operation}})}failure(e,t,n,r){return t&&this.emitTelemetry(e,t,`error`,0,n.code,n.message),{success:!1,error:n,metadata:{latencyMs:0,connectionId:t?.connection.meta.id??`unknown`,ownershipMode:t?.connection.ownershipMode??`managed`,attempts:r}}}makeContext(e,t,n){return{tenantId:n.tenantId,appId:n.appId,environment:n.environment,blueprintName:n.blueprintName,blueprintVersion:n.blueprintVersion,configVersion:n.configVersion,slotId:e,operation:t}}errorCodeFor(e){return typeof e==`object`&&e&&`code`in e&&typeof e.code==`string`?e.code:`PROVIDER_ERROR`}};function n(e){let t=e.connection.status;if(t===`disconnected`||t===`error`)throw Error(`Integration connection "${e.connection.meta.label}" is in status "${t}".`)}function r(e){switch(e){case`connected`:return`connected`;case`disconnected`:return`disconnected`;case`error`:return`error`;case`unknown`:default:return`unknown`}}export{t as IntegrationCallGuard,r as connectionStatusLabel,n as ensureConnectionReady};

package/dist/integrations/secrets/aws-secret-manager.js

@@ -0,0 +1 @@
+import{SecretProviderError as e,normalizeSecretPayload as t,parseSecretUri as n}from"./provider.js";import{Buffer as r}from"node:buffer";import{CreateSecretCommand as i,DeleteSecretCommand as a,GetSecretValueCommand as o,PutSecretValueCommand as s,SecretsManagerClient as c}from"@aws-sdk/client-secrets-manager";var l=class{id=`aws-secrets-manager`;explicitRegion;injectedClient;clientConfig;clientsByRegion=new Map;constructor(e={}){this.explicitRegion=e.region,this.injectedClient=e.client,this.clientConfig=e.clientConfig}canHandle(e){try{let t=n(e);return t.provider===`aws`&&(t.path===`secretsmanager`||t.path.startsWith(`secretsmanager/`))}catch{return!1}}async getSecret(e,t){let n=this.parseReference(e),r=this.getClient(n.region),i=t?.version??n.stage??n.version,a={SecretId:n.secretId,...this.buildVersionSelector(i)};try{let t=await r.send(new o(a));return{data:u(t,e,this.id),version:typeof t.VersionId==`string`&&t.VersionId?t.VersionId:i,metadata:{region:n.region,secretId:n.secretId,...i?{requestedVersion:i}:{}},retrievedAt:new Date}}catch(t){throw p({error:t,provider:this.id,reference:e,operation:`getSecret`})}}async setSecret(n,r){let a=this.parseReference(n),o=this.getClient(a.region),c=t(r);try{let e=await o.send(new s({SecretId:a.secretId,SecretBinary:c})),t=typeof e.VersionId==`string`&&e.VersionId?e.VersionId:`latest`;return{reference:this.buildReference(a.region,a.secretId,{version:t}),version:t}}catch(t){if(!f(t))throw p({error:t,provider:this.id,reference:n,operation:`putSecretValue`});if(d(a.secretId))throw new e({message:`Secret not found: ${a.secretId}`,provider:this.id,reference:n,code:`NOT_FOUND`,cause:t});try{let e=await o.send(new i({Name:a.secretId,SecretBinary:c})),t=typeof e.VersionId==`string`&&e.VersionId?e.VersionId:`latest`;return{reference:this.buildReference(a.region,a.secretId,{version:t}),version:t}}catch(e){throw p({error:e,provider:this.id,reference:n,operation:`createSecret`})}}}async rotateSecret(e,t){return this.setSecret(e,t)}async deleteSecret(e){let t=this.parseReference(e),n=this.getClient(t.region);try{await n.send(new a({SecretId:t.secretId,RecoveryWindowInDays:7}))}catch(t){throw p({error:t,provider:this.id,reference:e,operation:`deleteSecret`})}}getClient(e){if(this.injectedClient)return this.injectedClient;let t=this.clientsByRegion.get(e);if(t)return t;let n=new c({...this.clientConfig??{},region:e});return this.clientsByRegion.set(e,n),n}parseReference(t){let r=n(t);if(r.provider!==`aws`)throw new e({message:`Unsupported secret provider: ${r.provider}`,provider:this.id,reference:t,code:`INVALID`});let i=r.path.split(`/`).filter(Boolean);if(i.length<3||i[0]!==`secretsmanager`)throw new e({message:`Expected secret reference format aws://secretsmanager/{region}/{secretIdOrArn}[?version=...]`,provider:this.id,reference:t,code:`INVALID`});let a=i[1],o=this.resolveRegion(a),s=i.slice(2).join(`/`);if(!s)throw new e({message:`Unable to resolve secret id from reference "${r.path}"`,provider:this.id,reference:t,code:`INVALID`});return{region:o,secretId:s,version:r.extras?.version,stage:r.extras?.stage}}resolveRegion(t){let n=t??this.explicitRegion??process.env.AWS_REGION??process.env.AWS_DEFAULT_REGION;if(!n)throw new e({message:`AWS region must be provided either in reference (aws://secretsmanager/{region}/...) or via AWS_REGION/AWS_DEFAULT_REGION.`,provider:this.id,reference:`aws://secretsmanager//`,code:`INVALID`});return n}buildVersionSelector(e){return e?e===`latest`||e===`current`?{VersionStage:`AWSCURRENT`}:e.startsWith(`AWS`)?{VersionStage:e}:{VersionId:e}:{}}buildReference(e,t,n){let r=`aws://secretsmanager/${e}/${t}`,i=n?Object.entries(n).filter(([,e])=>!!e).map(([e,t])=>`${encodeURIComponent(e)}=${encodeURIComponent(t)}`).join(`&`):``;return i?`${r}?${i}`:r}};function u(t,n,i){if(!t||typeof t!=`object`)throw new e({message:`Invalid AWS Secrets Manager response`,provider:i,reference:n,code:`UNKNOWN`,cause:t});let a=t;if(a.SecretBinary instanceof Uint8Array)return a.SecretBinary;if(typeof a.SecretBinary==`string`)return r.from(a.SecretBinary,`base64`);if(typeof a.SecretString==`string`)return r.from(a.SecretString,`utf-8`);throw new e({message:`AWS secret value is empty`,provider:i,reference:n,code:`NOT_FOUND`,cause:t})}function d(e){return e.startsWith(`arn:aws:secretsmanager:`)}function f(e){if(!e||typeof e!=`object`)return!1;let t=e;return typeof t.$metadata?.httpStatusCode==`number`?t.$metadata.httpStatusCode===404:t.name===`ResourceNotFoundException`}function p(t){let{error:n,provider:r,reference:i,operation:a}=t;if(n instanceof e)return n;let o=typeof n==`object`&&!!n&&`$metadata`in n&&typeof n.$metadata==`object`&&n.$metadata?.httpStatusCode,s=o===404?`NOT_FOUND`:o===401||o===403?`FORBIDDEN`:o===400?`INVALID`:`UNKNOWN`;return new e({message:n instanceof Error?n.message:`Unknown error during ${a}`,provider:r,reference:i,code:s,cause:n})}export{l as AwsSecretsManagerProvider};

package/dist/integrations/secrets/env-secret-provider.js

@@ -1,2 +1 @@
-import{SecretProviderError as e,parseSecretUri as t}from"./provider.js";var n=class{id=`env`;aliases;constructor(e={}){this.aliases=e.aliases??{}}canHandle(e){let t=this.resolveEnvKey(e);return t!==void 0&&process.env[t]!==void 0}async getSecret(t){let n=this.resolveEnvKey(t);if(!n)throw new e({message:`Unable to resolve environment variable for reference "${t}".`,provider:this.id,reference:t,code:`INVALID`});let r=process.env[n];if(r===void 0)throw new e({message:`Environment variable "${n}" not found for reference "${t}".`,provider:this.id,reference:t,code:`NOT_FOUND`});return{data:Buffer.from(r,`utf-8`),version:`current`,metadata:{source:`env`,envKey:n},retrievedAt:new Date}}async setSecret(e,t){throw this.forbiddenError(`setSecret`,e)}async rotateSecret(e,t){throw this.forbiddenError(`rotateSecret`,e)}async deleteSecret(e){throw this.forbiddenError(`deleteSecret`,e)}resolveEnvKey(e){if(e){if(this.aliases[e])return this.aliases[e];if(!e.includes(`://`))return e;try{let n=t(e);return n.provider===`env`?n.path:n.extras?.env?n.extras.env:this.deriveEnvKey(n.path)}catch{return e}}}deriveEnvKey(e){if(e)return e.split(/[\/:\-\.]/).filter(Boolean).map(e=>e.replace(/[^a-zA-Z0-9]/g,`_`).replace(/_{2,}/g,`_`).toUpperCase()).join(`_`)}forbiddenError(t,n){return new e({message:`EnvSecretProvider is read-only. "${t}" is not allowed for ${n}.`,provider:this.id,reference:n,code:`FORBIDDEN`})}};export{n as EnvSecretProvider};
-//# sourceMappingURL=env-secret-provider.js.map
+import{SecretProviderError as e,parseSecretUri as t}from"./provider.js";var n=class{id=`env`;aliases;constructor(e={}){this.aliases=e.aliases??{}}canHandle(e){let t=this.resolveEnvKey(e);return t!==void 0&&process.env[t]!==void 0}async getSecret(t){let n=this.resolveEnvKey(t);if(!n)throw new e({message:`Unable to resolve environment variable for reference "${t}".`,provider:this.id,reference:t,code:`INVALID`});let r=process.env[n];if(r===void 0)throw new e({message:`Environment variable "${n}" not found for reference "${t}".`,provider:this.id,reference:t,code:`NOT_FOUND`});return{data:Buffer.from(r,`utf-8`),version:`current`,metadata:{source:`env`,envKey:n},retrievedAt:new Date}}async setSecret(e,t){throw this.forbiddenError(`setSecret`,e)}async rotateSecret(e,t){throw this.forbiddenError(`rotateSecret`,e)}async deleteSecret(e){throw this.forbiddenError(`deleteSecret`,e)}resolveEnvKey(e){if(e){if(this.aliases[e])return this.aliases[e];if(!e.includes(`://`))return e;try{let n=t(e);return n.provider===`env`?n.path:n.extras?.env?n.extras.env:this.deriveEnvKey(n.path)}catch{return e}}}deriveEnvKey(e){if(e)return e.split(/[\/:\-\.]/).filter(Boolean).map(e=>e.replace(/[^a-zA-Z0-9]/g,`_`).replace(/_{2,}/g,`_`).toUpperCase()).join(`_`)}forbiddenError(t,n){return new e({message:`EnvSecretProvider is read-only. "${t}" is not allowed for ${n}.`,provider:this.id,reference:n,code:`FORBIDDEN`})}};export{n as EnvSecretProvider};

package/dist/integrations/secrets/gcp-secret-manager.js

@@ -1,2 +1 @@
-import{SecretProviderError as e,normalizeSecretPayload as t,parseSecretUri as n}from"./provider.js";import{SecretManagerServiceClient as r,protos as i}from"@google-cloud/secret-manager";const a={automatic:{}};var o=class{id=`gcp-secret-manager`;client;explicitProjectId;replication;constructor(e={}){this.client=e.client??new r(e.clientOptions??{}),this.explicitProjectId=e.projectId,this.replication=e.defaultReplication??a}canHandle(e){try{return n(e).provider===`gcp`}catch{return!1}}async getSecret(t,n,r){let i=this.parseReference(t),a=this.buildVersionName(i,n?.version);try{let[n]=await this.client.accessSecretVersion({name:a},r??{}),i=n.payload;if(!i?.data)throw new e({message:`Secret payload empty for ${a}`,provider:this.id,reference:t,code:`UNKNOWN`});let o=s(n.name??a);return{data:i.data,version:o,metadata:i.dataCrc32c?{crc32c:i.dataCrc32c.toString()}:void 0,retrievedAt:new Date}}catch(e){throw c({error:e,provider:this.id,reference:t,operation:`access`})}}async setSecret(n,r){let i=this.parseReference(n),{secretName:a}=this.buildNames(i),o=t(r);await this.ensureSecretExists(i,r);try{let t=await this.client.addSecretVersion({parent:a,payload:{data:o}});if(!t)throw new e({message:`No version returned when adding secret version for ${a}`,provider:this.id,reference:n,code:`UNKNOWN`});let[r]=t,i=r?.name??`${a}/versions/latest`;return{reference:`gcp://${i}`,version:s(i)??`latest`}}catch(e){throw c({error:e,provider:this.id,reference:n,operation:`addSecretVersion`})}}async rotateSecret(e,t){return this.setSecret(e,t)}async deleteSecret(e){let t=this.parseReference(e),{secretName:n}=this.buildNames(t);try{await this.client.deleteSecret({name:n})}catch(t){throw c({error:t,provider:this.id,reference:e,operation:`delete`})}}parseReference(t){let r=n(t);if(r.provider!==`gcp`)throw new e({message:`Unsupported secret provider: ${r.provider}`,provider:this.id,reference:t,code:`INVALID`});let i=r.path.split(`/`).filter(Boolean);if(i.length<4||i[0]!==`projects`)throw new e({message:`Expected secret reference format gcp://projects/{project}/secrets/{secret}[(/versions/{version})] but received "${r.path}"`,provider:this.id,reference:t,code:`INVALID`});let a=i[1]??this.explicitProjectId;if(!a)throw new e({message:`Unable to resolve project or secret from reference "${r.path}"`,provider:this.id,reference:t,code:`INVALID`});let o=i.indexOf(`secrets`);if(o===-1||o+1>=i.length)throw new e({message:`Unable to resolve project or secret from reference "${r.path}"`,provider:this.id,reference:t,code:`INVALID`});let s=a,c=i[o+1];if(!c)throw new e({message:`Unable to resolve secret ID from reference "${r.path}"`,provider:this.id,reference:t,code:`INVALID`});let l=c,u=i.indexOf(`versions`);return{projectId:s,secretId:l,version:r.extras?.version??(u!==-1&&u+1<i.length?i[u+1]:void 0)}}buildNames(t){let n=t.projectId??this.explicitProjectId;if(!n)throw new e({message:`Project ID must be provided either in reference or provider configuration`,provider:this.id,reference:`gcp://projects//secrets/${t.secretId}`,code:`INVALID`});let r=`projects/${n}`;return{projectParent:r,secretName:`${r}/secrets/${t.secretId}`}}buildVersionName(e,t){let{secretName:n}=this.buildNames(e);return`${n}/versions/${t??e.version??`latest`}`}async ensureSecretExists(e,t){let{secretName:n,projectParent:r}=this.buildNames(e);try{await this.client.getSecret({name:n})}catch(i){let a=c({error:i,provider:this.id,reference:`gcp://${n}`,operation:`getSecret`,suppressThrow:!0});if(!a||a.code!==`NOT_FOUND`)throw a||i;try{await this.client.createSecret({parent:r,secretId:e.secretId,secret:{replication:this.replication,labels:t.labels}})}catch(e){throw c({error:e,provider:this.id,reference:`gcp://${n}`,operation:`createSecret`})}}}};function s(e){let t=e.split(`/`).filter(Boolean),n=t.indexOf(`versions`);if(!(n===-1||n+1>=t.length))return t[n+1]}function c(t){let{error:n,provider:r,reference:i,operation:a,suppressThrow:o}=t;if(n instanceof e)return n;let s=l(n),c=new e({message:n instanceof Error?n.message:`Unknown error during ${a}`,provider:r,reference:i,code:s,cause:n});if(o)return c;throw c}function l(e){if(typeof e!=`object`||!e)return`UNKNOWN`;let t=e.code;return t===5||t===`NOT_FOUND`?`NOT_FOUND`:t===6||t===`ALREADY_EXISTS`?`INVALID`:t===7||t===`PERMISSION_DENIED`||t===403?`FORBIDDEN`:t===3||t===`INVALID_ARGUMENT`?`INVALID`:`UNKNOWN`}export{o as GcpSecretManagerProvider};
-//# sourceMappingURL=gcp-secret-manager.js.map
+import{SecretProviderError as e,normalizeSecretPayload as t,parseSecretUri as n}from"./provider.js";import{SecretManagerServiceClient as r}from"@google-cloud/secret-manager";const i={automatic:{}};var a=class{id=`gcp-secret-manager`;client;explicitProjectId;replication;constructor(e={}){this.client=e.client??new r(e.clientOptions??{}),this.explicitProjectId=e.projectId,this.replication=e.defaultReplication??i}canHandle(e){try{return n(e).provider===`gcp`}catch{return!1}}async getSecret(t,n,r){let i=this.parseReference(t),a=this.buildVersionName(i,n?.version);try{let[n]=await this.client.accessSecretVersion({name:a},r??{}),i=n.payload;if(!i?.data)throw new e({message:`Secret payload empty for ${a}`,provider:this.id,reference:t,code:`UNKNOWN`});let s=o(n.name??a);return{data:i.data,version:s,metadata:i.dataCrc32c?{crc32c:i.dataCrc32c.toString()}:void 0,retrievedAt:new Date}}catch(e){throw s({error:e,provider:this.id,reference:t,operation:`access`})}}async setSecret(n,r){let i=this.parseReference(n),{secretName:a}=this.buildNames(i),c=t(r);await this.ensureSecretExists(i,r);try{let t=await this.client.addSecretVersion({parent:a,payload:{data:c}});if(!t)throw new e({message:`No version returned when adding secret version for ${a}`,provider:this.id,reference:n,code:`UNKNOWN`});let[r]=t,i=r?.name??`${a}/versions/latest`;return{reference:`gcp://${i}`,version:o(i)??`latest`}}catch(e){throw s({error:e,provider:this.id,reference:n,operation:`addSecretVersion`})}}async rotateSecret(e,t){return this.setSecret(e,t)}async deleteSecret(e){let t=this.parseReference(e),{secretName:n}=this.buildNames(t);try{await this.client.deleteSecret({name:n})}catch(t){throw s({error:t,provider:this.id,reference:e,operation:`delete`})}}parseReference(t){let r=n(t);if(r.provider!==`gcp`)throw new e({message:`Unsupported secret provider: ${r.provider}`,provider:this.id,reference:t,code:`INVALID`});let i=r.path.split(`/`).filter(Boolean);if(i.length<4||i[0]!==`projects`)throw new e({message:`Expected secret reference format gcp://projects/{project}/secrets/{secret}[(/versions/{version})] but received "${r.path}"`,provider:this.id,reference:t,code:`INVALID`});let a=i[1]??this.explicitProjectId;if(!a)throw new e({message:`Unable to resolve project or secret from reference "${r.path}"`,provider:this.id,reference:t,code:`INVALID`});let o=i.indexOf(`secrets`);if(o===-1||o+1>=i.length)throw new e({message:`Unable to resolve project or secret from reference "${r.path}"`,provider:this.id,reference:t,code:`INVALID`});let s=a,c=i[o+1];if(!c)throw new e({message:`Unable to resolve secret ID from reference "${r.path}"`,provider:this.id,reference:t,code:`INVALID`});let l=c,u=i.indexOf(`versions`);return{projectId:s,secretId:l,version:r.extras?.version??(u!==-1&&u+1<i.length?i[u+1]:void 0)}}buildNames(t){let n=t.projectId??this.explicitProjectId;if(!n)throw new e({message:`Project ID must be provided either in reference or provider configuration`,provider:this.id,reference:`gcp://projects//secrets/${t.secretId}`,code:`INVALID`});let r=`projects/${n}`;return{projectParent:r,secretName:`${r}/secrets/${t.secretId}`}}buildVersionName(e,t){let{secretName:n}=this.buildNames(e);return`${n}/versions/${t??e.version??`latest`}`}async ensureSecretExists(e,t){let{secretName:n,projectParent:r}=this.buildNames(e);try{await this.client.getSecret({name:n})}catch(i){let a=s({error:i,provider:this.id,reference:`gcp://${n}`,operation:`getSecret`,suppressThrow:!0});if(!a||a.code!==`NOT_FOUND`)throw a||i;try{await this.client.createSecret({parent:r,secretId:e.secretId,secret:{replication:this.replication,labels:t.labels}})}catch(e){throw s({error:e,provider:this.id,reference:`gcp://${n}`,operation:`createSecret`})}}}};function o(e){let t=e.split(`/`).filter(Boolean),n=t.indexOf(`versions`);if(!(n===-1||n+1>=t.length))return t[n+1]}function s(t){let{error:n,provider:r,reference:i,operation:a,suppressThrow:o}=t;if(n instanceof e)return n;let s=c(n),l=new e({message:n instanceof Error?n.message:`Unknown error during ${a}`,provider:r,reference:i,code:s,cause:n});if(o)return l;throw l}function c(e){if(typeof e!=`object`||!e)return`UNKNOWN`;let t=e.code;return t===5||t===`NOT_FOUND`?`NOT_FOUND`:t===6||t===`ALREADY_EXISTS`?`INVALID`:t===7||t===`PERMISSION_DENIED`||t===403?`FORBIDDEN`:t===3||t===`INVALID_ARGUMENT`?`INVALID`:`UNKNOWN`}export{a as GcpSecretManagerProvider};

package/dist/integrations/secrets/index.js

@@ -1 +1 @@
-import{SecretProviderError as e,normalizeSecretPayload as t,parseSecretUri as n}from"./provider.js";import{GcpSecretManagerProvider as r}from"./gcp-secret-manager.js";import{EnvSecretProvider as i}from"./env-secret-provider.js";import{SecretProviderManager as a}from"./manager.js";export{i as EnvSecretProvider,r as GcpSecretManagerProvider,e as SecretProviderError,a as SecretProviderManager,t as normalizeSecretPayload,n as parseSecretUri};
+import{SecretProviderError as e,normalizeSecretPayload as t,parseSecretUri as n}from"./provider.js";import{AwsSecretsManagerProvider as r}from"./aws-secret-manager.js";import{EnvSecretProvider as i}from"./env-secret-provider.js";import{GcpSecretManagerProvider as a}from"./gcp-secret-manager.js";import{ScalewaySecretManagerProvider as o}from"./scaleway-secret-manager.js";import{SecretProviderManager as s}from"./manager.js";export{r as AwsSecretsManagerProvider,i as EnvSecretProvider,a as GcpSecretManagerProvider,o as ScalewaySecretManagerProvider,e as SecretProviderError,s as SecretProviderManager,t as normalizeSecretPayload,n as parseSecretUri};

package/dist/integrations/secrets/manager.js

@@ -1,2 +1 @@
-import{SecretProviderError as e}from"./provider.js";var t=class{id;providers=[];registrationCounter=0;constructor(e={}){this.id=e.id??`secret-provider-manager`;let t=e.providers??[];for(let e of t)this.register(e.provider,{priority:e.priority})}register(e,t={}){return this.providers.push({provider:e,priority:t.priority??0,order:this.registrationCounter++}),this.providers.sort((e,t)=>e.priority===t.priority?e.order-t.order:t.priority-e.priority),this}canHandle(e){return this.providers.some(({provider:t})=>n(t,e))}async getSecret(t,r){let i=[];for(let{provider:a}of this.providers)if(n(a,t))try{return await a.getSecret(t,r)}catch(t){if(t instanceof e){if(i.push(t),t.code!==`NOT_FOUND`)break;continue}throw t}throw this.composeError(`getSecret`,t,i,r?.version)}async setSecret(e,t){return this.delegateToFirst(`setSecret`,e,n=>n.setSecret(e,t))}async rotateSecret(e,t){return this.delegateToFirst(`rotateSecret`,e,n=>n.rotateSecret(e,t))}async deleteSecret(e){await this.delegateToFirst(`deleteSecret`,e,t=>t.deleteSecret(e))}async delegateToFirst(t,r,i){let a=[];for(let{provider:t}of this.providers)if(n(t,r))try{return await i(t)}catch(t){if(t instanceof e){a.push(t);continue}throw t}throw this.composeError(t,r,a)}composeError(t,n,r,i){if(r.length===1){let[e]=r;if(e)return e}let a=[`No registered secret provider could ${t}`,`reference "${n}"`];return i&&a.push(`(version: ${i})`),r.length>1&&a.push(`Attempts: ${r.map(e=>`${e.provider}:${e.code}`).join(`, `)}`),new e({message:a.join(` `),provider:this.id,reference:n,code:r.length>0?r[r.length-1].code:`UNKNOWN`,cause:r})}};function n(e,t){try{return e.canHandle(t)}catch{return!1}}export{t as SecretProviderManager};
-//# sourceMappingURL=manager.js.map
+import{SecretProviderError as e}from"./provider.js";var t=class{id;providers=[];registrationCounter=0;constructor(e={}){this.id=e.id??`secret-provider-manager`;let t=e.providers??[];for(let e of t)this.register(e.provider,{priority:e.priority})}register(e,t={}){return this.providers.push({provider:e,priority:t.priority??0,order:this.registrationCounter++}),this.providers.sort((e,t)=>e.priority===t.priority?e.order-t.order:t.priority-e.priority),this}canHandle(e){return this.providers.some(({provider:t})=>n(t,e))}async getSecret(t,r){let i=[];for(let{provider:a}of this.providers)if(n(a,t))try{return await a.getSecret(t,r)}catch(t){if(t instanceof e){if(i.push(t),t.code!==`NOT_FOUND`)break;continue}throw t}throw this.composeError(`getSecret`,t,i,r?.version)}async setSecret(e,t){return this.delegateToFirst(`setSecret`,e,n=>n.setSecret(e,t))}async rotateSecret(e,t){return this.delegateToFirst(`rotateSecret`,e,n=>n.rotateSecret(e,t))}async deleteSecret(e){await this.delegateToFirst(`deleteSecret`,e,t=>t.deleteSecret(e))}async delegateToFirst(t,r,i){let a=[];for(let{provider:t}of this.providers)if(n(t,r))try{return await i(t)}catch(t){if(t instanceof e){a.push(t);continue}throw t}throw this.composeError(t,r,a)}composeError(t,n,r,i){if(r.length===1){let[e]=r;if(e)return e}let a=[`No registered secret provider could ${t}`,`reference "${n}"`];return i&&a.push(`(version: ${i})`),r.length>1&&a.push(`Attempts: ${r.map(e=>`${e.provider}:${e.code}`).join(`, `)}`),new e({message:a.join(` `),provider:this.id,reference:n,code:r.length>0?r[r.length-1].code:`UNKNOWN`,cause:r})}};function n(e,t){try{return e.canHandle(t)}catch{return!1}}export{t as SecretProviderManager};

package/dist/integrations/secrets/provider.js

@@ -1,2 +1 @@
-import{Buffer as e}from"node:buffer";var t=class extends Error{provider;reference;code;cause;constructor(e){super(e.message),this.name=`SecretProviderError`,this.provider=e.provider,this.reference=e.reference,this.code=e.code??`UNKNOWN`,this.cause=e.cause}};function n(e){if(!e)throw new t({message:`Secret reference cannot be empty`,provider:`unknown`,reference:e,code:`INVALID`});let[n,r]=e.split(`://`);if(!n||!r)throw new t({message:`Invalid secret reference: ${e}`,provider:`unknown`,reference:e,code:`INVALID`});let i=r.indexOf(`?`);if(i===-1)return{provider:n,path:r};let a=r.slice(0,i),o=r.slice(i+1);return{provider:n,path:a,extras:Object.fromEntries(o.split(`&`).filter(Boolean).map(e=>{let[t,n]=e.split(`=`),r=t??``,i=n??``;return[decodeURIComponent(r),decodeURIComponent(i)]}))}}function r(t){return t.data instanceof Uint8Array?t.data:t.encoding===`base64`?e.from(t.data,`base64`):t.encoding===`binary`?e.from(t.data,`binary`):e.from(t.data,`utf-8`)}export{t as SecretProviderError,r as normalizeSecretPayload,n as parseSecretUri};
-//# sourceMappingURL=provider.js.map
+import{Buffer as e}from"node:buffer";var t=class extends Error{provider;reference;code;cause;constructor(e){super(e.message),this.name=`SecretProviderError`,this.provider=e.provider,this.reference=e.reference,this.code=e.code??`UNKNOWN`,this.cause=e.cause}};function n(e){if(!e)throw new t({message:`Secret reference cannot be empty`,provider:`unknown`,reference:e,code:`INVALID`});let[n,r]=e.split(`://`);if(!n||!r)throw new t({message:`Invalid secret reference: ${e}`,provider:`unknown`,reference:e,code:`INVALID`});let i=r.indexOf(`?`);if(i===-1)return{provider:n,path:r};let a=r.slice(0,i),o=r.slice(i+1);return{provider:n,path:a,extras:Object.fromEntries(o.split(`&`).filter(Boolean).map(e=>{let[t,n]=e.split(`=`),r=t??``,i=n??``;return[decodeURIComponent(r),decodeURIComponent(i)]}))}}function r(t){return t.data instanceof Uint8Array?t.data:t.encoding===`base64`?e.from(t.data,`base64`):t.encoding===`binary`?e.from(t.data,`binary`):e.from(t.data,`utf-8`)}export{t as SecretProviderError,r as normalizeSecretPayload,n as parseSecretUri};

package/dist/integrations/secrets/scaleway-secret-manager.js

@@ -0,0 +1 @@
+import{SecretProviderError as e,normalizeSecretPayload as t,parseSecretUri as n}from"./provider.js";import{Buffer as r}from"node:buffer";const i=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;var a=class{id=`scaleway-secret-manager`;token;defaultRegion;defaultProjectId;baseUrl;fetchFn;constructor(e={}){this.token=e.token??process.env.SCW_SECRET_KEY??process.env.SCALEWAY_SECRET_KEY??``,this.defaultRegion=e.defaultRegion??process.env.SCW_DEFAULT_REGION??process.env.SCW_REGION,this.defaultProjectId=e.defaultProjectId??process.env.SCW_DEFAULT_PROJECT_ID??process.env.SCW_PROJECT_ID,this.baseUrl=e.baseUrl??`https://api.scaleway.com`,this.fetchFn=e.fetch??fetch}canHandle(e){try{let t=n(e);return t.provider===`scw`&&(t.path===`secret-manager`||t.path.startsWith(`secret-manager/`))}catch{return!1}}async getSecret(t,n){let a=this.parseReference(t);if(!this.token)throw new e({message:`Scaleway secret manager token is missing (set SCW_SECRET_KEY / SCALEWAY_SECRET_KEY).`,provider:this.id,reference:t,code:`FORBIDDEN`});if(!i.test(a.secretIdOrName))throw new e({message:`Scaleway getSecret requires a secretId (uuid) reference, not a secret name.`,provider:this.id,reference:t,code:`INVALID`});let s=n?.version??a.revision??`latest`,c=`${this.baseUrl}/secret-manager/v1beta1/regions/${encodeURIComponent(a.region)}/secrets/${encodeURIComponent(a.secretIdOrName)}/versions/${encodeURIComponent(s)}/access`,u=await this.fetchFn(c,{method:`GET`,headers:{"X-Auth-Token":this.token}});if(!u.ok)throw await l({response:u,provider:this.id,reference:t,operation:`getSecret`});let d=o(await u.json());return{data:r.from(d,`base64`),version:s,metadata:{region:a.region,secretId:a.secretIdOrName},retrievedAt:new Date}}async setSecret(n,a){let o=this.parseReference(n);if(!this.token)throw new e({message:`Scaleway secret manager token is missing (set SCW_SECRET_KEY / SCALEWAY_SECRET_KEY).`,provider:this.id,reference:n,code:`FORBIDDEN`});let s=t(a),c=r.from(s).toString(`base64`),l=i.test(o.secretIdOrName)?o.secretIdOrName:await this.createSecret({region:o.region,name:o.secretIdOrName,reference:n}),u=await this.createSecretVersion({region:o.region,secretId:l,dataB64:c,reference:n});return{reference:this.buildReference(o.region,l,{version:u}),version:u}}async rotateSecret(e,t){return this.setSecret(e,t)}async deleteSecret(t){let n=this.parseReference(t);if(!this.token)throw new e({message:`Scaleway secret manager token is missing (set SCW_SECRET_KEY / SCALEWAY_SECRET_KEY).`,provider:this.id,reference:t,code:`FORBIDDEN`});if(!i.test(n.secretIdOrName))throw new e({message:`Scaleway deleteSecret requires a secretId (uuid) reference, not a secret name.`,provider:this.id,reference:t,code:`INVALID`});let r=`${this.baseUrl}/secret-manager/v1beta1/regions/${encodeURIComponent(n.region)}/secrets/${encodeURIComponent(n.secretIdOrName)}`,a=await this.fetchFn(r,{method:`DELETE`,headers:{"X-Auth-Token":this.token}});if(!a.ok)throw await l({response:a,provider:this.id,reference:t,operation:`deleteSecret`})}parseReference(t){let r=n(t);if(r.provider!==`scw`)throw new e({message:`Unsupported secret provider: ${r.provider}`,provider:this.id,reference:t,code:`INVALID`});let i=r.path.split(`/`).filter(Boolean);if(i.length<2||i[0]!==`secret-manager`)throw new e({message:`Expected secret reference format scw://secret-manager/{region}/{secretIdOrName}[?version=...]`,provider:this.id,reference:t,code:`INVALID`});let a=i[1]??this.defaultRegion;if(!a)throw new e({message:`Scaleway region must be provided either in reference (scw://secret-manager/{region}/...) or via SCW_DEFAULT_REGION/SCW_REGION.`,provider:this.id,reference:t,code:`INVALID`});let o=i.slice(2).join(`/`);if(!o)throw new e({message:`Unable to resolve secret id/name from reference "${r.path}"`,provider:this.id,reference:t,code:`INVALID`});return{region:a,secretIdOrName:o,revision:r.extras?.version}}async createSecret(t){let n=this.defaultProjectId;if(!n)throw new e({message:`Scaleway project id is required to create secrets by name (set SCW_DEFAULT_PROJECT_ID/SCW_PROJECT_ID).`,provider:this.id,reference:t.reference,code:`INVALID`});let r=`${this.baseUrl}/secret-manager/v1beta1/regions/${encodeURIComponent(t.region)}/secrets`,i=await this.fetchFn(r,{method:`POST`,headers:{"Content-Type":`application/json`,"X-Auth-Token":this.token},body:JSON.stringify({name:t.name,project_id:n})});if(!i.ok)throw await l({response:i,provider:this.id,reference:t.reference,operation:`createSecret`});return s(await i.json())}async createSecretVersion(e){let t=`${this.baseUrl}/secret-manager/v1beta1/regions/${encodeURIComponent(e.region)}/secrets/${encodeURIComponent(e.secretId)}/versions`,n=await this.fetchFn(t,{method:`POST`,headers:{"Content-Type":`application/json`,"X-Auth-Token":this.token},body:JSON.stringify({data:e.dataB64})});if(!n.ok)throw await l({response:n,provider:this.id,reference:e.reference,operation:`createSecretVersion`});return c(await n.json())??`latest`}buildReference(e,t,n){let r=`scw://secret-manager/${e}/${t}`,i=n?Object.entries(n).filter(([,e])=>!!e).map(([e,t])=>`${encodeURIComponent(e)}=${encodeURIComponent(t)}`).join(`&`):``;return i?`${r}?${i}`:r}};function o(e){if(!e||typeof e!=`object`)throw Error(`Invalid scaleway secret payload`);let t=e;if(typeof t.data==`string`&&t.data)return t.data;throw Error(`Scaleway secret payload is missing data`)}function s(e){if(!e||typeof e!=`object`)throw Error(`Invalid scaleway createSecret payload`);let t=e;if(typeof t.id==`string`&&t.id)return t.id;throw Error(`Scaleway createSecret response is missing id`)}function c(e){if(!e||typeof e!=`object`)return;let t=e;if(typeof t.revision==`number`)return String(t.revision);if(typeof t.revision==`string`&&t.revision)return t.revision;if(typeof t.id==`string`&&t.id)return t.id}async function l(t){let{response:n,provider:r,reference:i,operation:a}=t,o=n.status===404?`NOT_FOUND`:n.status===401||n.status===403?`FORBIDDEN`:n.status>=400&&n.status<500?`INVALID`:`UNKNOWN`,s=await u(n);return new e({message:s?`Scaleway Secret Manager ${a} failed (${n.status}): ${s}`:`Scaleway Secret Manager ${a} failed (${n.status})`,provider:r,reference:i,code:o})}async function u(e){try{let t=(await e.text()).trim();return t.length?t:void 0}catch{return}}export{a as ScalewaySecretManagerProvider};

package/dist/integrations/spec.js

@@ -1,2 +1 @@
-const e=e=>`${e.key}.v${e.version}`;var t=class{items=new Map;register(t){let n=e(t.meta);if(this.items.has(n))throw Error(`Duplicate IntegrationSpec ${n}`);return this.items.set(n,t),this}list(){return[...this.items.values()]}get(t,n){if(n!=null)return this.items.get(e({key:t,version:n}));let r,i=-1/0;for(let e of this.items.values())e.meta.key===t&&e.meta.version>i&&(i=e.meta.version,r=e);return r}getByCategory(e){return this.list().filter(t=>t.meta.category===e)}};function n(t){return e(t)}export{t as IntegrationSpecRegistry,n as makeIntegrationSpecKey};
-//# sourceMappingURL=spec.js.map
+const e=e=>`${e.key}.v${e.version}`;var t=class{items=new Map;register(t){let n=e(t.meta);if(this.items.has(n))throw Error(`Duplicate IntegrationSpec ${n}`);return this.items.set(n,t),this}list(){return[...this.items.values()]}get(t,n){if(n!=null)return this.items.get(e({key:t,version:n}));let r,i=-1/0;for(let e of this.items.values())e.meta.key===t&&e.meta.version>i&&(i=e.meta.version,r=e);return r}getByCategory(e){return this.list().filter(t=>t.meta.category===e)}};function n(t){return e(t)}export{t as IntegrationSpecRegistry,n as makeIntegrationSpecKey};

package/dist/jobs/define-job.js

@@ -0,0 +1 @@
+function e(e,t){e.register(t.type,async e=>{let n=t.schema.parse(e.payload);await t.handler(n,e)})}export{e as registerDefinedJob};

package/dist/jobs/gcp-cloud-tasks.js

@@ -1,2 +1 @@
-import{randomUUID as e}from"node:crypto";var t=class{handlers=new Map;constructor(e){this.options=e}async enqueue(t,n,r={}){let i=r.delaySeconds==null?void 0:{seconds:Math.floor(Date.now()/1e3)+r.delaySeconds},a=Buffer.from(JSON.stringify({id:e(),type:t,payload:n}),`utf-8`);return await this.options.client.createTask({parent:`projects/${this.options.projectId}/locations/${this.options.location}/queues/${this.options.queue}`,task:{httpRequest:{httpMethod:`POST`,url:this.options.resolveUrl(t),body:a,headers:{"Content-Type":`application/json`},oidcToken:this.options.serviceAccountEmail?{serviceAccountEmail:this.options.serviceAccountEmail}:void 0},scheduleTime:i}}),{id:e(),type:t,payload:n,status:`pending`,attempts:0,createdAt:new Date,updatedAt:new Date}}register(e,t){this.handlers.set(e,t)}start(){}async stop(){this.handlers.clear()}};export{t as GcpCloudTasksQueue};
-//# sourceMappingURL=gcp-cloud-tasks.js.map
+import{DEFAULT_RETRY_POLICY as e}from"./queue.js";import{randomUUID as t}from"node:crypto";var n=class{handlers=new Map;constructor(e){this.options=e}async enqueue(n,r,i={}){let a=i.delaySeconds==null?void 0:{seconds:Math.floor(Date.now()/1e3)+i.delaySeconds},o=Buffer.from(JSON.stringify({id:t(),type:n,payload:r}),`utf-8`);return await this.options.client.createTask({parent:`projects/${this.options.projectId}/locations/${this.options.location}/queues/${this.options.queue}`,task:{httpRequest:{httpMethod:`POST`,url:this.options.resolveUrl(n),body:o,headers:{"Content-Type":`application/json`},oidcToken:this.options.serviceAccountEmail?{serviceAccountEmail:this.options.serviceAccountEmail}:void 0},scheduleTime:a}}),{id:t(),type:n,version:1,payload:r,status:`pending`,priority:i.priority??0,attempts:0,maxRetries:i.maxRetries??e.maxRetries,createdAt:new Date,updatedAt:new Date}}register(e,t){this.handlers.set(e,t)}start(){}async stop(){this.handlers.clear()}};export{n as GcpCloudTasksQueue};

package/dist/jobs/gcp-pubsub.js

@@ -1,2 +1 @@
-import{randomUUID as e}from"node:crypto";var t=class{handlers=new Map;constructor(e){this.options=e}async enqueue(t,n,r={}){return await this.options.client.topic(this.options.topicName).publishMessage({data:Buffer.from(JSON.stringify({id:e(),type:t,payload:n}),`utf-8`)}),{id:e(),type:t,payload:n,status:`pending`,attempts:0,createdAt:new Date,updatedAt:new Date}}register(e,t){this.handlers.set(e,t)}start(){}async stop(){this.handlers.clear()}};export{t as GcpPubSubQueue};
-//# sourceMappingURL=gcp-pubsub.js.map
+import{DEFAULT_RETRY_POLICY as e}from"./queue.js";import{randomUUID as t}from"node:crypto";var n=class{handlers=new Map;constructor(e){this.options=e}async enqueue(n,r,i={}){return await this.options.client.topic(this.options.topicName).publishMessage({data:Buffer.from(JSON.stringify({id:t(),type:n,payload:r}),`utf-8`)}),{id:t(),type:n,version:1,payload:r,status:`pending`,priority:i.priority??0,attempts:0,maxRetries:i.maxRetries??e.maxRetries,createdAt:new Date,updatedAt:new Date}}register(e,t){this.handlers.set(e,t)}start(){}async stop(){this.handlers.clear()}};export{n as GcpPubSubQueue};

package/dist/jobs/handlers/gmail-sync-handler.js

@@ -1,2 +1 @@
-function e(e){return async t=>{await e.syncThreads(t.payload)}}export{e as createGmailSyncHandler};
-//# sourceMappingURL=gmail-sync-handler.js.map
+function e(e){return async t=>{await e.syncThreads(t.payload)}}export{e as createGmailSyncHandler};

package/dist/jobs/handlers/index.js

@@ -1 +1 @@
-import{createGmailSyncHandler as e}from"./gmail-sync-handler.js";import{createStorageDocumentHandler as t}from"./storage-document-handler.js";export{e as createGmailSyncHandler,t as createStorageDocumentHandler};
+import{registerDefinedJob as e}from"../define-job.js";import{createGmailSyncHandler as t}from"./gmail-sync-handler.js";import{PING_JOB_TYPE as n,PingPayloadSchema as r,pingJob as i}from"./ping-handler.js";import{createStorageDocumentHandler as a}from"./storage-document-handler.js";function o(t){e(t,i)}export{n as PING_JOB_TYPE,r as PingPayloadSchema,t as createGmailSyncHandler,a as createStorageDocumentHandler,i as pingJob,o as registerAllJobs};

package/dist/jobs/handlers/ping-handler.js

@@ -0,0 +1 @@
+import*as e from"zod";const t=`core.ping`,n=e.object({}),r={type:t,schema:n,handler:async(e,t)=>{console.log(`[ping] job id=%s attempts=%d`,t.id,t.attempts)}};export{t as PING_JOB_TYPE,n as PingPayloadSchema,r as pingJob};

package/dist/jobs/handlers/storage-document-handler.js

@@ -1,2 +1 @@
-function e(e,t){return async n=>{let r=await e.getObject({bucket:n.payload.bucket,key:n.payload.key});if(!r)throw Error(`Object ${n.payload.bucket}/${n.payload.key} not found`);await t.ingestObject(r)}}export{e as createStorageDocumentHandler};
-//# sourceMappingURL=storage-document-handler.js.map
+function e(e,t){return async n=>{let r=await e.getObject({bucket:n.payload.bucket,key:n.payload.key});if(!r)throw Error(`Object ${n.payload.bucket}/${n.payload.key} not found`);await t.ingestObject(r)}}export{e as createStorageDocumentHandler};

package/dist/jobs/index.js

@@ -1 +1 @@
-import{GcpCloudTasksQueue as e}from"./gcp-cloud-tasks.js";import{GcpPubSubQueue as t}from"./gcp-pubsub.js";import{MemoryJobQueue as n}from"./memory-queue.js";import{createGmailSyncHandler as r}from"./handlers/gmail-sync-handler.js";import{createStorageDocumentHandler as i}from"./handlers/storage-document-handler.js";export{e as GcpCloudTasksQueue,t as GcpPubSubQueue,n as MemoryJobQueue,r as createGmailSyncHandler,i as createStorageDocumentHandler};
+import{registerDefinedJob as e}from"./define-job.js";import{DEFAULT_RETRY_POLICY as t,calculateBackoff as n,defineJobType as r}from"./queue.js";export{t as DEFAULT_RETRY_POLICY,n as calculateBackoff,r as defineJobType,e as registerDefinedJob};

package/dist/jobs/memory-queue.js

@@ -1,2 +1 @@
-import{randomUUID as e}from"node:crypto";var t=class{jobs=[];handlers=new Map;timer;processing=!1;constructor(e=200){this.pollIntervalMs=e}async enqueue(t,n,r={}){let i={id:e(),type:t,payload:n,status:`pending`,attempts:0,createdAt:new Date,updatedAt:new Date};return r.delaySeconds&&(i.updatedAt=new Date(Date.now()+r.delaySeconds*1e3)),this.jobs.push(i),i}register(e,t){this.handlers.set(e,t)}start(){this.timer||=setInterval(()=>{this.processNext()},this.pollIntervalMs)}async stop(){for(this.timer&&=(clearInterval(this.timer),void 0);this.processing;)await new Promise(e=>setTimeout(e,10))}async processNext(){if(this.processing)return;let e=this.jobs.find(e=>e.status===`pending`&&e.updatedAt<=new Date);if(!e)return;let t=this.handlers.get(e.type);if(t){this.processing=!0,e.status=`running`,e.updatedAt=new Date,e.attempts+=1;try{await t(e),e.status=`completed`,e.updatedAt=new Date}catch(t){e.status=`failed`,e.lastError=t instanceof Error?t.message:`Unknown job error`,e.updatedAt=new Date}finally{this.processing=!1}}}};export{t as MemoryJobQueue};
-//# sourceMappingURL=memory-queue.js.map
+import{DEFAULT_RETRY_POLICY as e}from"./queue.js";import{randomUUID as t}from"node:crypto";var n=class{jobs=[];handlers=new Map;timer;processing=!1;constructor(e=200){this.pollIntervalMs=e}async enqueue(n,r,i={}){let a={id:t(),type:n,version:1,payload:r,status:`pending`,priority:i.priority??0,attempts:0,maxRetries:i.maxRetries??e.maxRetries,createdAt:new Date,updatedAt:new Date};return i.delaySeconds&&(a.updatedAt=new Date(Date.now()+i.delaySeconds*1e3)),this.jobs.push(a),a}register(e,t){this.handlers.set(e,t)}start(){this.timer||=setInterval(()=>{this.processNext()},this.pollIntervalMs)}async stop(){for(this.timer&&=(clearInterval(this.timer),void 0);this.processing;)await new Promise(e=>setTimeout(e,10))}async processNext(){if(this.processing)return;let e=this.jobs.find(e=>e.status===`pending`&&e.updatedAt<=new Date);if(!e)return;let t=this.handlers.get(e.type);if(t){this.processing=!0,e.status=`running`,e.updatedAt=new Date,e.attempts+=1;try{await t(e),e.status=`completed`,e.updatedAt=new Date}catch(t){e.status=`failed`,e.lastError=t instanceof Error?t.message:`Unknown job error`,e.updatedAt=new Date}finally{this.processing=!1}}}};export{n as MemoryJobQueue};

package/dist/jobs/queue.js

@@ -0,0 +1 @@
+import"zod";const e={maxRetries:3,initialBackoffMs:1e3,maxBackoffMs:6e4,multiplier:2,jitter:!0};function t(t,n=e){let r=Math.min(n.initialBackoffMs*n.multiplier**(t-1),n.maxBackoffMs);if(n.jitter){let e=.8+Math.random()*.4;return Math.floor(r*e)}return r}function n(e){return e}export{e as DEFAULT_RETRY_POLICY,t as calculateBackoff,n as defineJobType};

package/dist/jobs/scaleway-sqs-queue.js

@@ -0,0 +1 @@
+import{DEFAULT_RETRY_POLICY as e}from"./queue.js";import{randomUUID as t}from"crypto";import{DeleteMessageCommand as n,ReceiveMessageCommand as r,SQSClient as i,SendMessageCommand as a}from"@aws-sdk/client-sqs";var o=class{sqs;queueUrl;waitTimeSeconds;maxNumberOfMessages;visibilityTimeoutSeconds;handlers=new Map;running=!1;constructor(e){let t=process.env.SCALEWAY_ACCESS_KEY_QUEUE,n=process.env.SCALEWAY_SECRET_KEY_QUEUE;if(!t||!n)throw Error(`Missing SCALEWAY_ACCESS_KEY_QUEUE / SCALEWAY_SECRET_KEY_QUEUE in env`);this.sqs=new i({region:e.region??process.env.SCALEWAY_REGION??`par`,endpoint:`https://sqs.mnq.fr-par.scaleway.com`,credentials:{accessKeyId:t,secretAccessKey:n}}),this.queueUrl=e.queueUrl,this.waitTimeSeconds=e.waitTimeSeconds??20,this.maxNumberOfMessages=e.maxNumberOfMessages??5,this.visibilityTimeoutSeconds=e.visibilityTimeoutSeconds??60}async enqueue(n,r,i={}){let o=t(),s=new Date,c={id:o,type:n,payload:r};return await this.sqs.send(new a({QueueUrl:this.queueUrl,MessageBody:JSON.stringify(c),DelaySeconds:i.delaySeconds??0})),{id:o,type:n,version:1,payload:r,status:`pending`,priority:i.priority??0,attempts:0,maxRetries:i.maxRetries??e.maxRetries,createdAt:s,updatedAt:s}}register(e,t){if(this.handlers.has(e))throw Error(`Handler already registered for job type "${e}"`);this.handlers.set(e,t)}start(){this.running||(this.running=!0,this.pollLoop().catch(e=>{console.error(`[queue] Fatal error in poll loop`,e),process.exit(1)}))}async stop(){this.running=!1}async pollLoop(){for(console.log(`[queue] SQS worker started for queue:`,this.queueUrl);this.running;)try{let t=(await this.sqs.send(new r({QueueUrl:this.queueUrl,MaxNumberOfMessages:this.maxNumberOfMessages,WaitTimeSeconds:this.waitTimeSeconds,VisibilityTimeout:this.visibilityTimeoutSeconds,MessageSystemAttributeNames:[`ApproximateReceiveCount`]}))).Messages??[];if(t.length===0)continue;for(let n of t){if(!n.Body||!n.ReceiptHandle){console.warn(`[queue] Message missing Body or ReceiptHandle`,n.MessageId);continue}let t;try{t=JSON.parse(n.Body)}catch(e){console.error(`[queue] Failed to parse message body (id=${n.MessageId}), deleting`,e),await this.deleteMessage(n.ReceiptHandle);continue}let r=this.handlers.get(t.type);if(!r){console.error(`[queue] No handler registered for type "${t.type}", deleting message`),await this.deleteMessage(n.ReceiptHandle);continue}let i=new Date,a=parseInt(n.Attributes?.ApproximateReceiveCount??`1`,10),o={id:t.id,type:t.type,version:1,payload:t.payload,status:`pending`,priority:0,attempts:a,maxRetries:e.maxRetries,createdAt:i,updatedAt:i};o.status=`running`,o.updatedAt=new Date;try{await r(o),o.status=`completed`,o.updatedAt=new Date,await this.deleteMessage(n.ReceiptHandle)}catch(e){o.status=`failed`,o.lastError=e instanceof Error?e.message:`Unknown job error`,o.updatedAt=new Date,console.error(`[queue] Error while handling job type=${o.type} id=${o.id}`,e)}}}catch(e){e&&typeof e==`object`&&`$response`in e?console.error(`[queue] Error while polling SQS`,e,e.$response):console.error(`[queue] Error while polling SQS`,e),await this.sleep(5e3)}console.log(`[queue] SQS worker stopped`)}async deleteMessage(e){try{await this.sqs.send(new n({QueueUrl:this.queueUrl,ReceiptHandle:e}))}catch(e){console.error(`[queue] Failed to delete message`,e)}}async sleep(e){await new Promise(t=>setTimeout(t,e))}};export{o as ScalewaySqsJobQueue};

package/dist/jsonschema.js

@@ -1,2 +1 @@
-import e from"zod";function t(t){return{input:t.io.input?e.toJSONSchema(t.io.input.getZod()):null,output:t.io.output?e.toJSONSchema(t.io.output.getZod()):null,meta:{name:t.meta.name,version:t.meta.version,kind:t.meta.kind,description:t.meta.description,tags:t.meta.tags??[],stability:t.meta.stability??`stable`}}}function n(e,t){return`/${e.replace(/\./g,`/`)}/v${t}`}function r(e,t){return`${e}.v${t}`}function i(e,t){return`${e.replace(/\./g,`_`)}_v${t}`}export{i as defaultGqlField,r as defaultMcpTool,n as defaultRestPath,t as jsonSchemaForSpec};
-//# sourceMappingURL=jsonschema.js.map
+import e from"zod";function t(t){return{input:t.io.input?e.toJSONSchema(t.io.input.getZod()):null,output:t.io.output?e.toJSONSchema(t.io.output.getZod()):null,meta:{name:t.meta.name,version:t.meta.version,kind:t.meta.kind,description:t.meta.description,tags:t.meta.tags??[],stability:t.meta.stability??`stable`}}}function n(e,t){return`/${e.replace(/\./g,`/`)}/v${t}`}function r(e,t){return`${e}.v${t}`}function i(e,t){return`${e.replace(/\./g,`_`)}_v${t}`}export{i as defaultGqlField,r as defaultMcpTool,n as defaultRestPath,t as jsonSchemaForSpec};

package/dist/knowledge/contracts.js

@@ -1,2 +1 @@
-import{l as e}from"../schema/dist/ScalarTypeEnum.js";import{t}from"../schema/dist/SchemaModel.js";import"../schema/dist/index.js";import{defineCommand as n,defineQuery as r}from"../spec.js";const i=new t({name:`KnowledgeSyncSchedule`,fields:{enabled:{type:e.Boolean(),isOptional:!1},cron:{type:e.String_unsecure(),isOptional:!0},intervalMs:{type:e.Int_unsecure(),isOptional:!0}}}),a=new t({name:`KnowledgeSourceRecord`,fields:{id:{type:e.ID(),isOptional:!1},tenantId:{type:e.ID(),isOptional:!1},spaceKey:{type:e.NonEmptyString(),isOptional:!1},spaceVersion:{type:e.Int_unsecure(),isOptional:!1},label:{type:e.String_unsecure(),isOptional:!1},sourceType:{type:e.String_unsecure(),isOptional:!1},syncSchedule:{type:i,isOptional:!0},lastSyncStatus:{type:e.String_unsecure(),isOptional:!0},lastSyncAt:{type:e.DateTime(),isOptional:!0},itemsProcessed:{type:e.Int_unsecure(),isOptional:!0},createdAt:{type:e.DateTime(),isOptional:!0},updatedAt:{type:e.DateTime(),isOptional:!0}}}),o=new t({name:`CreateKnowledgeSourceInput`,fields:{tenantId:{type:e.ID(),isOptional:!1},spaceKey:{type:e.NonEmptyString(),isOptional:!1},spaceVersion:{type:e.Int_unsecure(),isOptional:!1},label:{type:e.String_unsecure(),isOptional:!1},sourceType:{type:e.NonEmptyString(),isOptional:!1},config:{type:e.JSONObject(),isOptional:!1},syncSchedule:{type:i,isOptional:!0}}}),s=new t({name:`UpdateKnowledgeSourceInput`,fields:{sourceId:{type:e.ID(),isOptional:!1},label:{type:e.String_unsecure(),isOptional:!0},config:{type:e.JSONObject(),isOptional:!0},syncSchedule:{type:i,isOptional:!0}}}),c=new t({name:`DeleteKnowledgeSourceInput`,fields:{sourceId:{type:e.ID(),isOptional:!1}}}),l=new t({name:`DeleteKnowledgeSourceOutput`,fields:{success:{type:e.Boolean(),isOptional:!1}}}),u=new t({name:`ListKnowledgeSourcesInput`,fields:{tenantId:{type:e.ID(),isOptional:!1},spaceKey:{type:e.NonEmptyString(),isOptional:!0}}}),d=new t({name:`ListKnowledgeSourcesOutput`,fields:{sources:{type:a,isOptional:!1,isArray:!0}}}),f=new t({name:`TriggerKnowledgeSyncInput`,fields:{sourceId:{type:e.ID(),isOptional:!1}}}),p=new t({name:`TriggerKnowledgeSyncOutput`,fields:{success:{type:e.Boolean(),isOptional:!1},itemsProcessed:{type:e.Int_unsecure(),isOptional:!0},error:{type:e.String_unsecure(),isOptional:!0}}}),m=n({meta:{name:`knowledge.source.create`,version:1,description:`Create a knowledge source binding for a tenant.`,goal:`Onboard a new knowledge ingestion source such as Notion or uploads.`,context:`Used by Ops and App Studio to configure knowledge ingestion per tenant and space.`,owners:[`platform.knowledge`],tags:[`knowledge`,`sources`],stability:`experimental`},io:{input:o,output:a},policy:{auth:`admin`,policies:[{name:`platform.knowledge.manage`,version:1}]}}),h=n({meta:{name:`knowledge.source.update`,version:1,description:`Update metadata or configuration for a knowledge source.`,goal:`Allow rotation of credentials, sync schedules, and labels.`,context:`Supports editing how a tenant ingests knowledge (e.g., toggling sync cadence).`,owners:[`platform.knowledge`],tags:[`knowledge`,`sources`],stability:`experimental`},io:{input:s,output:a},policy:{auth:`admin`,policies:[{name:`platform.knowledge.manage`,version:1}]}}),g=n({meta:{name:`knowledge.source.delete`,version:1,description:`Delete a knowledge source binding for a tenant.`,goal:`Remove obsolete or compromised knowledge ingestion paths.`,context:`Ensures ephemeral or external sources can be removed cleanly without leaving residual bindings.`,owners:[`platform.knowledge`],tags:[`knowledge`,`sources`],stability:`experimental`},io:{input:c,output:l},policy:{auth:`admin`,policies:[{name:`platform.knowledge.manage`,version:1}]}}),_=r({meta:{name:`knowledge.source.list`,version:1,description:`List knowledge sources configured for a tenant.`,goal:`Provide visibility into knowledge ingest configuration and schedules.`,context:`Used by App Studio and Ops flows to surface knowledge sources and their health.`,owners:[`platform.knowledge`],tags:[`knowledge`,`sources`],stability:`experimental`},io:{input:u,output:d},policy:{auth:`admin`,policies:[{name:`platform.knowledge.read`,version:1}]}}),v=n({meta:{name:`knowledge.source.triggerSync`,version:1,description:`Trigger an immediate sync for a knowledge source.`,goal:`Support manual or automated sync retries for knowledge ingestion.`,context:`Invoked by Ops tooling or monitors when knowledge content must be refreshed or reprocessed.`,owners:[`platform.knowledge`],tags:[`knowledge`,`sources`],stability:`experimental`},io:{input:f,output:p},policy:{auth:`admin`,policies:[{name:`platform.knowledge.manage`,version:1}]}}),y={CreateKnowledgeSource:m,UpdateKnowledgeSource:h,DeleteKnowledgeSource:g,ListKnowledgeSources:_,TriggerKnowledgeSourceSync:v};function b(e){return e.register(m).register(h).register(g).register(_).register(v)}export{m as CreateKnowledgeSource,g as DeleteKnowledgeSource,_ as ListKnowledgeSources,v as TriggerKnowledgeSourceSync,h as UpdateKnowledgeSource,y as knowledgeContracts,b as registerKnowledgeContracts};
-//# sourceMappingURL=contracts.js.map
+import{defineCommand as e,defineQuery as t}from"../spec.js";import{ScalarTypeEnum as n,SchemaModel as r}from"@lssm/lib.schema";const i=new r({name:`KnowledgeSyncSchedule`,fields:{enabled:{type:n.Boolean(),isOptional:!1},cron:{type:n.String_unsecure(),isOptional:!0},intervalMs:{type:n.Int_unsecure(),isOptional:!0}}}),a=new r({name:`KnowledgeSourceRecord`,fields:{id:{type:n.ID(),isOptional:!1},tenantId:{type:n.ID(),isOptional:!1},spaceKey:{type:n.NonEmptyString(),isOptional:!1},spaceVersion:{type:n.Int_unsecure(),isOptional:!1},label:{type:n.String_unsecure(),isOptional:!1},sourceType:{type:n.String_unsecure(),isOptional:!1},syncSchedule:{type:i,isOptional:!0},lastSyncStatus:{type:n.String_unsecure(),isOptional:!0},lastSyncAt:{type:n.DateTime(),isOptional:!0},itemsProcessed:{type:n.Int_unsecure(),isOptional:!0},createdAt:{type:n.DateTime(),isOptional:!0},updatedAt:{type:n.DateTime(),isOptional:!0}}}),o=new r({name:`CreateKnowledgeSourceInput`,fields:{tenantId:{type:n.ID(),isOptional:!1},spaceKey:{type:n.NonEmptyString(),isOptional:!1},spaceVersion:{type:n.Int_unsecure(),isOptional:!1},label:{type:n.String_unsecure(),isOptional:!1},sourceType:{type:n.NonEmptyString(),isOptional:!1},config:{type:n.JSONObject(),isOptional:!1},syncSchedule:{type:i,isOptional:!0}}}),s=new r({name:`UpdateKnowledgeSourceInput`,fields:{sourceId:{type:n.ID(),isOptional:!1},label:{type:n.String_unsecure(),isOptional:!0},config:{type:n.JSONObject(),isOptional:!0},syncSchedule:{type:i,isOptional:!0}}}),c=new r({name:`DeleteKnowledgeSourceInput`,fields:{sourceId:{type:n.ID(),isOptional:!1}}}),l=new r({name:`DeleteKnowledgeSourceOutput`,fields:{success:{type:n.Boolean(),isOptional:!1}}}),u=new r({name:`ListKnowledgeSourcesInput`,fields:{tenantId:{type:n.ID(),isOptional:!1},spaceKey:{type:n.NonEmptyString(),isOptional:!0}}}),d=new r({name:`ListKnowledgeSourcesOutput`,fields:{sources:{type:a,isOptional:!1,isArray:!0}}}),f=new r({name:`TriggerKnowledgeSyncInput`,fields:{sourceId:{type:n.ID(),isOptional:!1}}}),p=new r({name:`TriggerKnowledgeSyncOutput`,fields:{success:{type:n.Boolean(),isOptional:!1},itemsProcessed:{type:n.Int_unsecure(),isOptional:!0},error:{type:n.String_unsecure(),isOptional:!0}}}),m=e({meta:{name:`knowledge.source.create`,version:1,description:`Create a knowledge source binding for a tenant.`,goal:`Onboard a new knowledge ingestion source such as Notion or uploads.`,context:`Used by Ops and App Studio to configure knowledge ingestion per tenant and space.`,owners:[`platform.knowledge`],tags:[`knowledge`,`sources`],stability:`experimental`},io:{input:o,output:a},policy:{auth:`admin`,policies:[{name:`platform.knowledge.manage`,version:1}]}}),h=e({meta:{name:`knowledge.source.update`,version:1,description:`Update metadata or configuration for a knowledge source.`,goal:`Allow rotation of credentials, sync schedules, and labels.`,context:`Supports editing how a tenant ingests knowledge (e.g., toggling sync cadence).`,owners:[`platform.knowledge`],tags:[`knowledge`,`sources`],stability:`experimental`},io:{input:s,output:a},policy:{auth:`admin`,policies:[{name:`platform.knowledge.manage`,version:1}]}}),g=e({meta:{name:`knowledge.source.delete`,version:1,description:`Delete a knowledge source binding for a tenant.`,goal:`Remove obsolete or compromised knowledge ingestion paths.`,context:`Ensures ephemeral or external sources can be removed cleanly without leaving residual bindings.`,owners:[`platform.knowledge`],tags:[`knowledge`,`sources`],stability:`experimental`},io:{input:c,output:l},policy:{auth:`admin`,policies:[{name:`platform.knowledge.manage`,version:1}]}}),_=t({meta:{name:`knowledge.source.list`,version:1,description:`List knowledge sources configured for a tenant.`,goal:`Provide visibility into knowledge ingest configuration and schedules.`,context:`Used by App Studio and Ops flows to surface knowledge sources and their health.`,owners:[`platform.knowledge`],tags:[`knowledge`,`sources`],stability:`experimental`},io:{input:u,output:d},policy:{auth:`admin`,policies:[{name:`platform.knowledge.read`,version:1}]}}),v=e({meta:{name:`knowledge.source.triggerSync`,version:1,description:`Trigger an immediate sync for a knowledge source.`,goal:`Support manual or automated sync retries for knowledge ingestion.`,context:`Invoked by Ops tooling or monitors when knowledge content must be refreshed or reprocessed.`,owners:[`platform.knowledge`],tags:[`knowledge`,`sources`],stability:`experimental`},io:{input:f,output:p},policy:{auth:`admin`,policies:[{name:`platform.knowledge.manage`,version:1}]}}),y={CreateKnowledgeSource:m,UpdateKnowledgeSource:h,DeleteKnowledgeSource:g,ListKnowledgeSources:_,TriggerKnowledgeSourceSync:v};function b(e){return e.register(m).register(h).register(g).register(_).register(v)}export{m as CreateKnowledgeSource,g as DeleteKnowledgeSource,_ as ListKnowledgeSources,v as TriggerKnowledgeSourceSync,h as UpdateKnowledgeSource,y as knowledgeContracts,b as registerKnowledgeContracts};

package/dist/knowledge/docs/knowledge.docblock.js

@@ -0,0 +1,138 @@
+import{registerDocBlocks as e}from"../../docs/registry.js";import"../../registry.js";const t=[{id:`docs.tech.contracts.knowledge`,title:`Knowledge Layer`,summary:`The knowledge layer turns unstructured inputs (uploads, email threads,`,kind:`reference`,visibility:`public`,route:`/docs/tech/contracts/knowledge`,tags:[`tech`,`contracts`,`knowledge`],body:`# Knowledge Layer
+
+The knowledge layer turns unstructured inputs (uploads, email threads,
+notes) into searchable context for agents and workflows. The Pocket
+Family Office vertical ships a minimal but production-ready stack that
+covers ingestion, indexing, querying, and guardrails.
+
+## Knowledge Spaces
+
+Knowledge is organised via \`KnowledgeSpaceSpec\` definitions under
+\`packages/libs/contracts/src/knowledge/spaces\`:
+
+- \`knowledge.financial-docs\` – canonical invoices, bills, and contracts.
+- \`knowledge.email-threads\` – operational Gmail threads.
+- \`knowledge.support-faq\` / \`knowledge.product-canon\` – reusable shared
+  spaces available to any vertical.
+
+Each space defines:
+
+- Ownership metadata (domain, owners, stability tags).
+- Retention policy (TTL/archival).
+- Access policy (trust level, automation write permissions).
+- Indexing configuration (embedding model, chunk size, vector DB slot).
+
+## Sources & Bindings
+
+- \`KnowledgeSourceConfig\` records tenant-specific connections (bucket,
+  Gmail labels, sync cadence). Pocket Family Office provides sample
+  configs in \`knowledge/sources.sample.ts\`.
+- \`AppKnowledgeBinding\` associates spaces with workflows/agents and adds
+  per-tenant constraints (rate limits, scopes).
+
+Validation ensures that:
+
+- All referenced spaces exist in the registry.
+- At least one source is configured per binding.
+- External/ephemeral spaces trigger warnings for policy-sensitive flows.
+
+## Ingestion Pipeline
+
+Implemented in \`packages/libs/contracts/src/knowledge/ingestion\`:
+
+1. **DocumentProcessor** – pluggable MIME extractors producing
+   \`DocumentFragment\`s.
+2. **EmbeddingService** – batches fragments through an \`EmbeddingProvider\`
+   (Mistral in the reference implementation).
+3. **VectorIndexer** – upserts fragments into a \`VectorStoreProvider\`
+   (Qdrant in production, with in-memory implementations for tests).
+4. **Adapters**
+   - \`GmailIngestionAdapter\`: list threads → convert to raw documents →
+     index.
+   - \`StorageIngestionAdapter\`: fetch object from storage provider →
+     index.
+
+Background jobs (see \`jobs/\`) orchestrate ingestion via Cloud Tasks /
+Pub/Sub or in-memory workers. Handlers:
+
+- \`storage-document-handler\` – resolves storage object + indexes.
+- \`gmail-sync-handler\` – syncs threads based on label/date filters.
+
+## Query Service
+
+\`KnowledgeQueryService\` performs retrieval-augmented generation:
+
+1. Embed the user query using the configured provider.
+2. Search the vector store for top-k matches.
+3. Compose prompts combining system instructions + contextual snippets.
+4. Invoke the LLM provider (Mistral) and return the answer plus
+   references and token usage.
+
+The service is designed for tooling: workflows can execute it directly
+or through custom operations (see \`pfo.summary.generate\` contract).
+
+## Guardrails
+
+- Automation can only write to spaces where \`automationWritable\` is true.
+- Canonical spaces default to high trust; external/ephemeral spaces are
+  flagged during validation.
+- Telemetry captures query volumes per tenant + space.
+
+## Extending
+
+1. Define a new \`KnowledgeSpaceSpec\` with indexing/retention policies.
+2. Add sources pointing to storage providers or APIs.
+3. Register adapters if ingestion requires bespoke logic.
+4. Reference the space in blueprints (\`AppKnowledgeBinding\`) and update
+   workflows/agents accordingly.
+
+The Pocket Family Office tests (\`tests/pocket-family-office.test.ts\`)
+show how to wire the ingestion pipeline, index a document, and run an
+end-to-end knowledge query using in-memory providers.
+## Knowledge Spaces & Guardrails
+
+Knowledge surfaces (\`KnowledgeSpaceSpec\`) describe curated corpora that agents and workflows can consult. Tenant bindings (\`AppKnowledgeBinding\`) declare which spaces are active, who can use them, and optional usage constraints.
+
+### Binding recap
+
+- \`spaceKey\` / \`spaceVersion\`: pointer to the \`KnowledgeSpaceSpec\`
+- \`scope.workflows\` / \`scope.agents\`: explicit allow-lists for consumers
+- \`constraints.maxTokensPerQuery\` & \`constraints.maxQueriesPerMinute\`: throttling knobs for LLM-backed search
+- \`required\`: mark the binding as blocking (defaults to \`true\`)
+
+At runtime, \`ResolvedAppConfig.knowledge\` contains \`ResolvedKnowledge\` entries with the bound space, active sources, and the binding metadata above.
+
+### KnowledgeAccessGuard
+
+\`KnowledgeAccessGuard\` (\`@lssm/lib.contracts/knowledge/runtime\`) centralises the access checks that must run before any workflow/agent reads or mutates a knowledge space.
+
+\`\`\`ts
+import { KnowledgeAccessGuard } from '@lssm/lib.contracts/knowledge/runtime';
+
+const guard = new KnowledgeAccessGuard({
+  disallowWriteCategories: ['external', 'ephemeral'], // default
+  requireWorkflowBinding: true,
+  requireAgentBinding: false,
+});
+
+const result = guard.checkAccess(resolvedKnowledge, {
+  tenantId,
+  appId,
+  workflowName: 'order-processing',
+  operation: 'read', // or 'write' / 'search'
+}, resolvedAppConfig);
+
+if (!result.allowed) {
+  throw new Error(result.reason);
+}
+\`\`\`
+
+Key behaviours:
+
+- **Binding**: rejects access when the space is not present in the resolved tenant config.
+- **Category guardrails**: blocks writes to \`external\` and \`ephemeral\` spaces by default; allows reads but emits warnings for \`ephemeral\`.
+- **Workflow/agent scoping**: when \`requireWorkflowBinding\` or \`requireAgentBinding\` is enabled, only explicitly authorised consumers may access the space.
+
+Use the guard inside workflow operations or agent resolvers to guarantee multi-tenant isolation and honour data governance rules.
+
+`}];e(t);export{t as tech_contracts_knowledge_DocBlocks};

package/dist/knowledge/ingestion/document-processor.js

@@ -1,2 +1 @@
-import{Buffer as e}from"node:buffer";var t=class{extractors=new Map;constructor(){this.registerExtractor(`text/plain`,this.extractText),this.registerExtractor(`application/json`,this.extractJson)}registerExtractor(e,t){this.extractors.set(e.toLowerCase(),t)}async process(e){let t=this.extractors.get(e.mimeType.toLowerCase())??this.extractors.get(`*/*`);if(!t)throw Error(`No extractor registered for mime type ${e.mimeType}`);let n=await t(e);return n.length===0?[{id:`${e.id}:0`,documentId:e.id,text:``,metadata:e.metadata}]:n}async extractText(t){let n=e.from(t.data).toString(`utf-8`);return[{id:`${t.id}:0`,documentId:t.id,text:n,metadata:t.metadata}]}async extractJson(t){let n=e.from(t.data).toString(`utf-8`);try{let e=JSON.parse(n);return[{id:`${t.id}:0`,documentId:t.id,text:JSON.stringify(e,null,2),metadata:{...t.metadata,contentType:`application/json`}}]}catch{return this.extractText(t)}}};export{t as DocumentProcessor};
-//# sourceMappingURL=document-processor.js.map
+import{Buffer as e}from"node:buffer";var t=class{extractors=new Map;constructor(){this.registerExtractor(`text/plain`,this.extractText),this.registerExtractor(`application/json`,this.extractJson)}registerExtractor(e,t){this.extractors.set(e.toLowerCase(),t)}async process(e){let t=this.extractors.get(e.mimeType.toLowerCase())??this.extractors.get(`*/*`);if(!t)throw Error(`No extractor registered for mime type ${e.mimeType}`);let n=await t(e);return n.length===0?[{id:`${e.id}:0`,documentId:e.id,text:``,metadata:e.metadata}]:n}async extractText(t){let n=e.from(t.data).toString(`utf-8`);return[{id:`${t.id}:0`,documentId:t.id,text:n,metadata:t.metadata}]}async extractJson(t){let n=e.from(t.data).toString(`utf-8`);try{let e=JSON.parse(n);return[{id:`${t.id}:0`,documentId:t.id,text:JSON.stringify(e,null,2),metadata:{...t.metadata,contentType:`application/json`}}]}catch{return this.extractText(t)}}};export{t as DocumentProcessor};

package/dist/knowledge/ingestion/embedding-service.js

@@ -1,2 +1 @@
-var e=class{provider;batchSize;constructor(e,t=16){this.provider=e,this.batchSize=t}async embedFragments(e){let t=[];for(let n=0;n<e.length;n+=this.batchSize){let r=e.slice(n,n+this.batchSize).map(e=>({id:e.id,text:e.text,metadata:e.metadata})),i=await this.provider.embedDocuments(r);t.push(...i)}return t}};export{e as EmbeddingService};
-//# sourceMappingURL=embedding-service.js.map
+var e=class{provider;batchSize;constructor(e,t=16){this.provider=e,this.batchSize=t}async embedFragments(e){let t=[];for(let n=0;n<e.length;n+=this.batchSize){let r=e.slice(n,n+this.batchSize).map(e=>({id:e.id,text:e.text,metadata:e.metadata})),i=await this.provider.embedDocuments(r);t.push(...i)}return t}};export{e as EmbeddingService};

package/dist/knowledge/ingestion/gmail-adapter.js

@@ -3,5 +3,4 @@ var e=class{constructor(e,t,n,r){this.gmail=e,this.processor=t,this.embeddings=n
 
 ---
 
-`)}function n(e){return e.name?`${e.name} <${e.email}>`:e.email}function r(e){return e.replace(/<[^>]+>/g,` `)}export{e as GmailIngestionAdapter};
-//# sourceMappingURL=gmail-adapter.js.map
+`)}function n(e){return e.name?`${e.name} <${e.email}>`:e.email}function r(e){return e.replace(/<[^>]+>/g,` `)}export{e as GmailIngestionAdapter};

package/dist/knowledge/ingestion/storage-adapter.js

@@ -1,2 +1 @@
-var e=class{constructor(e,t,n){this.processor=e,this.embeddings=t,this.indexer=n}async ingestObject(e){if(!(`data`in e)||!e.data)throw Error(`Storage ingestion requires object data`);let t={id:e.key,mimeType:e.contentType??`application/octet-stream`,data:e.data,metadata:{bucket:e.bucket,checksum:e.checksum??``}},n=await this.processor.process(t),r=await this.embeddings.embedFragments(n);await this.indexer.upsert(n,r)}};export{e as StorageIngestionAdapter};
-//# sourceMappingURL=storage-adapter.js.map
+var e=class{constructor(e,t,n){this.processor=e,this.embeddings=t,this.indexer=n}async ingestObject(e){if(!(`data`in e)||!e.data)throw Error(`Storage ingestion requires object data`);let t={id:e.key,mimeType:e.contentType??`application/octet-stream`,data:e.data,metadata:{bucket:e.bucket,checksum:e.checksum??``}},n=await this.processor.process(t),r=await this.embeddings.embedFragments(n);await this.indexer.upsert(n,r)}};export{e as StorageIngestionAdapter};

package/dist/knowledge/ingestion/vector-indexer.js

@@ -1,2 +1 @@
-var e=class{provider;config;constructor(e,t){this.provider=e,this.config=t}async upsert(e,t){let n=t.map(t=>{let n=e.find(e=>e.id===t.id);return{id:t.id,vector:t.vector,payload:{...this.config.metadata,...n?.metadata??{},documentId:n?.documentId},namespace:this.config.namespace}}),r={collection:this.config.collection,documents:n};await this.provider.upsert(r)}};export{e as VectorIndexer};
-//# sourceMappingURL=vector-indexer.js.map
+var e=class{provider;config;constructor(e,t){this.provider=e,this.config=t}async upsert(e,t){let n=t.map(t=>{let n=e.find(e=>e.id===t.id);return{id:t.id,vector:t.vector,payload:{...this.config.metadata,...n?.metadata??{},documentId:n?.documentId},namespace:this.config.namespace}}),r={collection:this.config.collection,documents:n};await this.provider.upsert(r)}};export{e as VectorIndexer};

package/dist/knowledge/query/service.js

@@ -1,4 +1,3 @@
 var e=class{embeddings;vectorStore;llm;config;constructor(e,t,n,r){this.embeddings=e,this.vectorStore=t,this.llm=n,this.config=r}async query(e){let r=await this.embeddings.embedQuery(e),i=await this.vectorStore.search({collection:this.config.collection,vector:r.vector,topK:this.config.topK??5,namespace:this.config.namespace,filter:void 0}),a=t(i),o=this.buildMessages(e,a),s=await this.llm.chat(o);return{answer:s.message.content.map(e=>`text`in e?e.text:``).join(``),references:i.map(e=>({...e,text:n(e)})),usage:s.usage}}buildMessages(e,t){return[{role:`system`,content:[{type:`text`,text:this.config.systemPrompt??`You are a knowledge assistant that answers questions using the provided context. Cite relevant sources if possible.`}]},{role:`user`,content:[{type:`text`,text:`Question:\n${e}\n\nContext:\n${t}`}]}]}};function t(e){return e.length===0?`No relevant documents found.`:e.map((e,t)=>{let r=n(e);return`Source ${t+1} (score: ${e.score.toFixed(3)}):\n${r}`}).join(`
 
-`)}function n(e){let t=e.payload??{};return typeof t.text==`string`?t.text:typeof t.content==`string`?t.content:JSON.stringify(t)}export{e as KnowledgeQueryService};
-//# sourceMappingURL=service.js.map
+`)}function n(e){let t=e.payload??{};return typeof t.text==`string`?t.text:typeof t.content==`string`?t.content:JSON.stringify(t)}export{e as KnowledgeQueryService};

package/dist/knowledge/runtime.js

@@ -1,2 +1 @@
-const e=[`external`,`ephemeral`];var t=class{disallowedWrite;requireWorkflowBinding;requireAgentBinding;constructor(t={}){this.disallowedWrite=new Set(t.disallowWriteCategories??e),this.requireWorkflowBinding=t.requireWorkflowBinding??!0,this.requireAgentBinding=t.requireAgentBinding??!1}checkAccess(e,t,n){let{binding:r,space:i}=e;if(r.required!==!1&&!this.isSpaceBound(e,n))return{allowed:!1,reason:`Knowledge space "${i.meta.key}" is not bound in the resolved app config.`};if(t.operation===`write`&&this.disallowedWrite.has(i.meta.category))return{allowed:!1,reason:`Knowledge space "${i.meta.key}" is category "${i.meta.category}" and is read-only.`};if(this.requireWorkflowBinding&&t.workflowName){let e=r.scope?.workflows;if(e&&!e.includes(t.workflowName))return{allowed:!1,reason:`Workflow "${t.workflowName}" is not authorized to access knowledge space "${i.meta.key}".`}}if(this.requireAgentBinding&&t.agentName){let e=r.scope?.agents;if(e&&!e.includes(t.agentName))return{allowed:!1,reason:`Agent "${t.agentName}" is not authorized to access knowledge space "${i.meta.key}".`}}return i.meta.category===`ephemeral`?{allowed:!0,severity:`warning`,reason:`Knowledge space "${i.meta.key}" is ephemeral; results may be transient.`}:{allowed:!0}}isSpaceBound(e,t){return t.knowledge.some(t=>t.space.meta.key===e.space.meta.key&&(e.space.meta.version==null||t.space.meta.version===e.space.meta.version))}};export{t as KnowledgeAccessGuard};
-//# sourceMappingURL=runtime.js.map
+const e=[`external`,`ephemeral`];var t=class{disallowedWrite;requireWorkflowBinding;requireAgentBinding;constructor(t={}){this.disallowedWrite=new Set(t.disallowWriteCategories??e),this.requireWorkflowBinding=t.requireWorkflowBinding??!0,this.requireAgentBinding=t.requireAgentBinding??!1}checkAccess(e,t,n){let{binding:r,space:i}=e;if(r.required!==!1&&!this.isSpaceBound(e,n))return{allowed:!1,reason:`Knowledge space "${i.meta.key}" is not bound in the resolved app config.`};if(t.operation===`write`&&this.disallowedWrite.has(i.meta.category))return{allowed:!1,reason:`Knowledge space "${i.meta.key}" is category "${i.meta.category}" and is read-only.`};if(this.requireWorkflowBinding&&t.workflowName){let e=r.scope?.workflows;if(e&&!e.includes(t.workflowName))return{allowed:!1,reason:`Workflow "${t.workflowName}" is not authorized to access knowledge space "${i.meta.key}".`}}if(this.requireAgentBinding&&t.agentName){let e=r.scope?.agents;if(e&&!e.includes(t.agentName))return{allowed:!1,reason:`Agent "${t.agentName}" is not authorized to access knowledge space "${i.meta.key}".`}}return i.meta.category===`ephemeral`?{allowed:!0,severity:`warning`,reason:`Knowledge space "${i.meta.key}" is ephemeral; results may be transient.`}:{allowed:!0}}isSpaceBound(e,t){return t.knowledge.some(t=>t.space.meta.key===e.space.meta.key&&(e.space.meta.version==null||t.space.meta.version===e.space.meta.version))}};export{t as KnowledgeAccessGuard};

package/dist/knowledge/spaces/email-threads.js

@@ -1,2 +1 @@
-import{StabilityEnum as e}from"../../ownership.js";const t={meta:{key:`knowledge.email-threads`,version:1,category:`operational`,displayName:`Email Threads`,title:`Operational Email Threads`,description:`Indexed copies of operational email threads used for support, onboarding, and workflows.`,domain:`operations`,owners:[`platform.operations`],tags:[`email`,`operations`],stability:e.Beta},retention:{ttlDays:365},access:{policy:{name:`knowledge.access.email-threads`,version:1},trustLevel:`medium`,automationWritable:!0},indexing:{embeddingModel:`mistral-embed`,chunkSize:600,vectorDbIntegration:`vectordb.qdrant`},description:`Operational email threads synchronized from Gmail to support automations and contextual assistance.`};function n(e){return e.register(t)}export{t as emailThreadsKnowledgeSpace,n as registerEmailThreadsKnowledgeSpace};
-//# sourceMappingURL=email-threads.js.map
+import{StabilityEnum as e}from"../../ownership.js";const t={meta:{key:`knowledge.email-threads`,version:1,category:`operational`,displayName:`Email Threads`,title:`Operational Email Threads`,description:`Indexed copies of operational email threads used for support, onboarding, and workflows.`,domain:`operations`,owners:[`platform.operations`],tags:[`email`,`operations`],stability:e.Beta},retention:{ttlDays:365},access:{policy:{name:`knowledge.access.email-threads`,version:1},trustLevel:`medium`,automationWritable:!0},indexing:{embeddingModel:`mistral-embed`,chunkSize:600,vectorDbIntegration:`vectordb.qdrant`},description:`Operational email threads synchronized from Gmail to support automations and contextual assistance.`};function n(e){return e.register(t)}export{t as emailThreadsKnowledgeSpace,n as registerEmailThreadsKnowledgeSpace};

package/dist/knowledge/spaces/financial-docs.js

@@ -1,2 +1 @@
-import{StabilityEnum as e}from"../../ownership.js";const t={meta:{key:`knowledge.financial-docs`,version:1,category:`canonical`,displayName:`Financial Documents`,title:`Household Financial Documents`,description:`Invoices, bills, and contracts powering Pocket Family Office financial automation.`,domain:`finance`,owners:[`platform.finance`],tags:[`finance`,`documents`],stability:e.Beta},retention:{ttlDays:null},access:{policy:{name:`knowledge.access.financial-docs`,version:1},trustLevel:`high`,automationWritable:!0},indexing:{embeddingModel:`mistral-embed`,chunkSize:700,vectorDbIntegration:`vectordb.qdrant`},description:`Normalized financial documents enabling bill pay automation, reminders, and summaries.`};function n(e){return e.register(t)}export{t as financialDocsKnowledgeSpace,n as registerFinancialDocsKnowledgeSpace};
-//# sourceMappingURL=financial-docs.js.map
+import{StabilityEnum as e}from"../../ownership.js";const t={meta:{key:`knowledge.financial-docs`,version:1,category:`canonical`,displayName:`Financial Documents`,title:`Household Financial Documents`,description:`Invoices, bills, and contracts powering Pocket Family Office financial automation.`,domain:`finance`,owners:[`platform.finance`],tags:[`finance`,`documents`],stability:e.Beta},retention:{ttlDays:null},access:{policy:{name:`knowledge.access.financial-docs`,version:1},trustLevel:`high`,automationWritable:!0},indexing:{embeddingModel:`mistral-embed`,chunkSize:700,vectorDbIntegration:`vectordb.qdrant`},description:`Normalized financial documents enabling bill pay automation, reminders, and summaries.`};function n(e){return e.register(t)}export{t as financialDocsKnowledgeSpace,n as registerFinancialDocsKnowledgeSpace};

package/dist/knowledge/spaces/financial-overview.js

@@ -1,2 +1 @@
-import{StabilityEnum as e}from"../../ownership.js";const t={meta:{key:`knowledge.financial-overview`,version:1,category:`operational`,displayName:`Financial Overview Summaries`,title:`Derived Financial Summaries`,description:`Aggregated cashflow summaries, category breakdowns, and balance trends derived from open banking data.`,domain:`finance`,owners:[`platform.finance`],tags:[`open-banking`,`summaries`,`cashflow`],stability:e.Experimental},retention:{ttlDays:180},access:{policy:{name:`knowledge.access.financial-overview`,version:1},trustLevel:`medium`,automationWritable:!0},indexing:{embeddingModel:`mistral-embed`,chunkSize:600,vectorDbIntegration:`vectordb.qdrant`},description:`Derived knowledge space containing weekly/monthly cashflow rollups and account health summaries. Raw transactions are excluded to respect privacy guardrails.`};function n(e){return e.register(t)}export{t as financialOverviewKnowledgeSpace,n as registerFinancialOverviewKnowledgeSpace};
-//# sourceMappingURL=financial-overview.js.map
+import{StabilityEnum as e}from"../../ownership.js";const t={meta:{key:`knowledge.financial-overview`,version:1,category:`operational`,displayName:`Financial Overview Summaries`,title:`Derived Financial Summaries`,description:`Aggregated cashflow summaries, category breakdowns, and balance trends derived from open banking data.`,domain:`finance`,owners:[`platform.finance`],tags:[`open-banking`,`summaries`,`cashflow`],stability:e.Experimental},retention:{ttlDays:180},access:{policy:{name:`knowledge.access.financial-overview`,version:1},trustLevel:`medium`,automationWritable:!0},indexing:{embeddingModel:`mistral-embed`,chunkSize:600,vectorDbIntegration:`vectordb.qdrant`},description:`Derived knowledge space containing weekly/monthly cashflow rollups and account health summaries. Raw transactions are excluded to respect privacy guardrails.`};function n(e){return e.register(t)}export{t as financialOverviewKnowledgeSpace,n as registerFinancialOverviewKnowledgeSpace};

package/dist/knowledge/spaces/product-canon.js

@@ -1,2 +1 @@
-import{StabilityEnum as e}from"../../ownership.js";const t={meta:{key:`knowledge.product-canon`,version:1,category:`canonical`,displayName:`Product Canon`,title:`Product Canon Knowledge Space`,description:`Authoritative product knowledge covering strategy, roadmap, and delivery canon.`,domain:`product`,owners:[`platform.product`],tags:[`knowledge`,`product`],stability:e.Stable},retention:{ttlDays:null},access:{policy:{name:`knowledge.access.product-canon`,version:1},trustLevel:`high`,automationWritable:!1},indexing:{embeddingModel:`text-embedding-3-large`,chunkSize:800,vectorDbIntegration:`vectordb.qdrant`},description:`Single source of truth for product canon, principles, and strategic narratives.`};function n(e){return e.register(t)}export{t as productCanonKnowledgeSpace,n as registerProductCanonKnowledgeSpace};
-//# sourceMappingURL=product-canon.js.map
+import{StabilityEnum as e}from"../../ownership.js";const t={meta:{key:`knowledge.product-canon`,version:1,category:`canonical`,displayName:`Product Canon`,title:`Product Canon Knowledge Space`,description:`Authoritative product knowledge covering strategy, roadmap, and delivery canon.`,domain:`product`,owners:[`platform.product`],tags:[`knowledge`,`product`],stability:e.Stable},retention:{ttlDays:null},access:{policy:{name:`knowledge.access.product-canon`,version:1},trustLevel:`high`,automationWritable:!1},indexing:{embeddingModel:`text-embedding-3-large`,chunkSize:800,vectorDbIntegration:`vectordb.qdrant`},description:`Single source of truth for product canon, principles, and strategic narratives.`};function n(e){return e.register(t)}export{t as productCanonKnowledgeSpace,n as registerProductCanonKnowledgeSpace};

package/dist/knowledge/spaces/support-faq.js

@@ -1,2 +1 @@
-import{StabilityEnum as e}from"../../ownership.js";const t={meta:{key:`knowledge.support-faq`,version:1,category:`operational`,displayName:`Support FAQ`,title:`Support & Success FAQ`,description:`Operational knowledge base for customer support and success.`,domain:`support`,owners:[`platform.support`],tags:[`knowledge`,`support`],stability:e.Beta},retention:{ttlDays:365,archiveAfterDays:180},access:{policy:{name:`knowledge.access.support`,version:1},trustLevel:`medium`,automationWritable:!0},indexing:{embeddingModel:`text-embedding-3-small`,chunkSize:700,vectorDbIntegration:`vectordb.qdrant`},description:`Operational FAQs, runbooks, and customer success playbooks augmented with automation updates.`};function n(e){return e.register(t)}export{n as registerSupportFaqKnowledgeSpace,t as supportFaqKnowledgeSpace};
-//# sourceMappingURL=support-faq.js.map
+import{StabilityEnum as e}from"../../ownership.js";const t={meta:{key:`knowledge.support-faq`,version:1,category:`operational`,displayName:`Support FAQ`,title:`Support & Success FAQ`,description:`Operational knowledge base for customer support and success.`,domain:`support`,owners:[`platform.support`],tags:[`knowledge`,`support`],stability:e.Beta},retention:{ttlDays:365,archiveAfterDays:180},access:{policy:{name:`knowledge.access.support`,version:1},trustLevel:`medium`,automationWritable:!0},indexing:{embeddingModel:`text-embedding-3-small`,chunkSize:700,vectorDbIntegration:`vectordb.qdrant`},description:`Operational FAQs, runbooks, and customer success playbooks augmented with automation updates.`};function n(e){return e.register(t)}export{n as registerSupportFaqKnowledgeSpace,t as supportFaqKnowledgeSpace};

package/dist/knowledge/spaces/uploaded-docs.js

@@ -1,2 +1 @@
-import{StabilityEnum as e}from"../../ownership.js";const t={meta:{key:`knowledge.uploaded-docs`,version:1,category:`external`,displayName:`Uploaded Documents`,title:`Uploaded Knowledge Assets`,description:`Documents uploaded by households, including invoices, contracts, and reference files.`,domain:`operations`,owners:[`platform.operations`],tags:[`documents`,`storage`],stability:e.Beta},retention:{ttlDays:null},access:{policy:{name:`knowledge.access.uploaded-docs`,version:1},trustLevel:`medium`,automationWritable:!0},indexing:{embeddingModel:`mistral-embed`,chunkSize:900,vectorDbIntegration:`vectordb.qdrant`},description:`User-provided documents normalized and embedded for retrieval augmented workflows.`};function n(e){return e.register(t)}export{n as registerUploadedDocsKnowledgeSpace,t as uploadedDocsKnowledgeSpace};
-//# sourceMappingURL=uploaded-docs.js.map
+import{StabilityEnum as e}from"../../ownership.js";const t={meta:{key:`knowledge.uploaded-docs`,version:1,category:`external`,displayName:`Uploaded Documents`,title:`Uploaded Knowledge Assets`,description:`Documents uploaded by households, including invoices, contracts, and reference files.`,domain:`operations`,owners:[`platform.operations`],tags:[`documents`,`storage`],stability:e.Beta},retention:{ttlDays:null},access:{policy:{name:`knowledge.access.uploaded-docs`,version:1},trustLevel:`medium`,automationWritable:!0},indexing:{embeddingModel:`mistral-embed`,chunkSize:900,vectorDbIntegration:`vectordb.qdrant`},description:`User-provided documents normalized and embedded for retrieval augmented workflows.`};function n(e){return e.register(t)}export{n as registerUploadedDocsKnowledgeSpace,t as uploadedDocsKnowledgeSpace};

package/dist/knowledge/spec.js

@@ -1,2 +1 @@
-const e=e=>`${e.key}.v${e.version}`;var t=class{items=new Map;register(t){let n=e(t.meta);if(this.items.has(n))throw Error(`Duplicate KnowledgeSpaceSpec ${n}`);return this.items.set(n,t),this}list(){return[...this.items.values()]}get(t,n){if(n!=null)return this.items.get(e({key:t,version:n}));let r,i=-1/0;for(let e of this.items.values())e.meta.key===t&&e.meta.version>i&&(i=e.meta.version,r=e);return r}getByCategory(e){return this.list().filter(t=>t.meta.category===e)}};function n(t){return e(t)}export{t as KnowledgeSpaceRegistry,n as makeKnowledgeSpaceKey};
-//# sourceMappingURL=spec.js.map
+const e=e=>`${e.key}.v${e.version}`;var t=class{items=new Map;register(t){let n=e(t.meta);if(this.items.has(n))throw Error(`Duplicate KnowledgeSpaceSpec ${n}`);return this.items.set(n,t),this}list(){return[...this.items.values()]}get(t,n){if(n!=null)return this.items.get(e({key:t,version:n}));let r,i=-1/0;for(let e of this.items.values())e.meta.key===t&&e.meta.version>i&&(i=e.meta.version,r=e);return r}getByCategory(e){return this.list().filter(t=>t.meta.category===e)}};function n(t){return e(t)}export{t as KnowledgeSpaceRegistry,n as makeKnowledgeSpaceKey};

package/dist/llm/exporters.js

@@ -0,0 +1,8 @@
+import{jsonSchemaForSpec as e}from"../jsonschema.js";import{isEmitDeclRef as t}from"../spec.js";const n={format:`full`,includeSchemas:!0,includeScenarios:!0,includeExamples:!0,includePolicy:!0,includeSideEffects:!0},r={...n,includeRelatedSpecs:!0,includeRelatedEvents:!0,includeRelatedPresentations:!0};function i(e){let t=e.meta,n=[];if(n.push(`# ${t.name} (v${t.version})`),n.push(``),n.push(`> ${t.description}`),n.push(``),n.push(`**Type:** ${t.kind} | **Stability:** ${t.stability}`),n.push(``),n.push(`## Goal`),n.push(``),n.push(t.goal),n.push(``),n.push(`## Context`),n.push(``),n.push(t.context),n.push(``),e.acceptance?.scenarios?.length){n.push(`## Acceptance Criteria`),n.push(``);for(let t of e.acceptance.scenarios){n.push(`### ${t.name}`),n.push(``),n.push(`**Given:**`);for(let e of t.given)n.push(`- ${e}`);n.push(``),n.push(`**When:**`);for(let e of t.when)n.push(`- ${e}`);n.push(``),n.push(`**Then:**`);for(let e of t.then)n.push(`- ${e}`);n.push(``)}}return n.join(`
+`)}function a(r,i={}){let a={...n,...i},o=r.meta,s=[];if(s.push(`# ${o.name}.v${o.version}`),s.push(``),s.push(`> ${o.description}`),s.push(``),s.push(`## Metadata`),s.push(``),s.push(`| Field | Value |`),s.push(`|-------|-------|`),s.push(`| Kind | ${o.kind} |`),s.push(`| Stability | ${o.stability} |`),s.push(`| Owners | ${o.owners.join(`, `)} |`),s.push(`| Tags | ${o.tags.join(`, `)} |`),s.push(``),s.push(`## Goal`),s.push(``),s.push(o.goal),s.push(``),s.push(`## Context`),s.push(``),s.push(o.context),s.push(``),a.includeSchemas){if(s.push(`## Input/Output`),s.push(``),r.io.input){s.push(`### Input Schema`),s.push(``),s.push("```json");try{let t=e(r);s.push(JSON.stringify(t.input??{},null,2))}catch{s.push(`// Schema generation not available`)}s.push("```"),s.push(``)}s.push(`### Output Schema`),s.push(``),s.push("```json");try{let t=e(r);s.push(JSON.stringify(t.output??{},null,2))}catch{s.push(`// Schema generation not available`)}if(s.push("```"),s.push(``),r.io.errors&&Object.keys(r.io.errors).length){s.push(`### Error Codes`),s.push(``),s.push(`| Code | HTTP | Description | When |`),s.push(`|------|------|-------------|------|`);for(let[e,t]of Object.entries(r.io.errors))s.push(`| \`${e}\` | ${t.http??400} | ${t.description} | ${t.when} |`);s.push(``)}}if(a.includePolicy&&(s.push(`## Policy`),s.push(``),s.push(`- **Auth Required:** ${r.policy.auth}`),s.push(`- **Idempotent:** ${r.policy.idempotent??o.kind===`query`}`),r.policy.rateLimit&&s.push(`- **Rate Limit:** ${r.policy.rateLimit.rpm} rpm per ${r.policy.rateLimit.key}`),r.policy.flags?.length&&s.push(`- **Feature Flags:** ${r.policy.flags.join(`, `)}`),r.policy.pii?.length&&s.push(`- **PII Fields:** ${r.policy.pii.join(`, `)}`),r.policy.escalate&&s.push(`- **Escalation:** ${r.policy.escalate}`),s.push(``)),a.includeSideEffects&&r.sideEffects){if(r.sideEffects.emits?.length){s.push(`## Events Emitted`),s.push(``);for(let e of r.sideEffects.emits)t(e)?s.push(`- \`${e.ref.name}.v${e.ref.version}\` — ${e.when}`):s.push(`- \`${e.name}.v${e.version}\` — ${e.when}`);s.push(``)}if(r.sideEffects.analytics?.length){s.push(`## Analytics Events`),s.push(``);for(let e of r.sideEffects.analytics)s.push(`- ${e}`);s.push(``)}}if(a.includeScenarios&&r.acceptance?.scenarios?.length){s.push(`## Acceptance Scenarios`),s.push(``);for(let e of r.acceptance.scenarios){s.push(`### ${e.name}`),s.push(``),s.push(`**Given:**`);for(let t of e.given)s.push(`- ${t}`);s.push(``),s.push(`**When:**`);for(let t of e.when)s.push(`- ${t}`);s.push(``),s.push(`**Then:**`);for(let t of e.then)s.push(`- ${t}`);s.push(``)}}if(a.includeExamples&&r.acceptance?.examples?.length){s.push(`## Examples`),s.push(``);for(let e of r.acceptance.examples)s.push(`### ${e.name}`),s.push(``),s.push(`**Input:**`),s.push("```json"),s.push(JSON.stringify(e.input,null,2)),s.push("```"),s.push(``),s.push(`**Output:**`),s.push("```json"),s.push(JSON.stringify(e.output,null,2)),s.push("```"),s.push(``)}return r.transport&&(s.push(`## Transport Configuration`),s.push(``),r.transport.rest&&s.push(`- **REST:** ${r.transport.rest.method??`POST`} ${r.transport.rest.path??`auto`}`),r.transport.gql&&s.push(`- **GraphQL:** ${r.transport.gql.field??`auto`}`),r.transport.mcp&&s.push(`- **MCP Tool:** ${r.transport.mcp.toolName??`auto`}`),s.push(``)),s.join(`
+`)}function o(e,t){let n=t?.taskType??`implement`,r=e.meta,i=[],o={implement:`Implement`,test:`Write tests for`,refactor:`Refactor`,review:`Review`}[n];if(i.push(`# Task: ${o} ${r.name}.v${r.version}`),i.push(``),i.push(`## Context`),i.push(``),i.push(`You are working on a ContractSpec-driven codebase. This spec defines a ${r.kind} operation.`),i.push(``),i.push(`**Goal:** ${r.goal}`),i.push(``),i.push(`**Background:** ${r.context}`),i.push(``),i.push(`## Specification`),i.push(``),i.push(a(e)),i.push(``),i.push(`## Instructions`),i.push(``),n===`implement`){if(i.push(`Implement this specification following these requirements:`),i.push(``),i.push("1. **Type Safety**: Use TypeScript with strict typing. No `any` types."),i.push(`2. **Input Validation**: Validate input against the schema before processing.`),i.push(`3. **Error Handling**: Implement all error cases defined in the spec.`),i.push(`4. **Events**: Emit events as specified in sideEffects.emits.`),i.push(`5. **Policy**: Respect auth, rate limits, and feature flags.`),i.push(`6. **Idempotency**: `+(e.policy.idempotent?`This operation MUST be idempotent.`:`This operation may have side effects.`)),i.push(``),e.policy.pii?.length){i.push(`**PII Handling**: The following fields contain PII and must be handled carefully:`);for(let t of e.policy.pii)i.push(`- ${t}`);i.push(``)}}else n===`test`?(i.push(`Write comprehensive tests for this specification:`),i.push(``),i.push(`1. Test all acceptance scenarios defined in the spec.`),i.push(`2. Test all error cases with appropriate assertions.`),i.push(`3. Test edge cases and boundary conditions.`),i.push(`4. Verify events are emitted correctly.`),i.push(`5. Use descriptive test names following the pattern: "should [behavior] when [condition]"`),i.push(``)):n===`refactor`?(i.push(`Refactor this implementation while preserving all behavior:`),i.push(``),i.push(`1. Maintain compliance with the specification.`),i.push(`2. Improve code clarity and maintainability.`),i.push(`3. Reduce complexity where possible.`),i.push(`4. Ensure all existing tests still pass.`),i.push(``)):n===`review`&&(i.push(`Review this implementation against the specification:`),i.push(``),i.push(`1. Verify input/output types match the schema.`),i.push(`2. Check all error cases are handled.`),i.push(`3. Verify events are emitted as specified.`),i.push(`4. Check policy compliance (auth, rate limits).`),i.push(`5. Report any deviations from the spec.`),i.push(``));return t?.existingCode&&(i.push(`## Existing Code`),i.push(``),i.push("```typescript"),i.push(t.existingCode),i.push("```"),i.push(``)),i.push(`## Expected Output`),i.push(``),n===`implement`||n===`refactor`?(i.push(`Provide a complete TypeScript implementation. Include:`),i.push(`- Type definitions for input/output`),i.push(`- Handler function with proper error handling`),i.push(`- JSDoc comments explaining the implementation`)):n===`test`?i.push(`Provide a complete test file using the testing framework available (prefer Vitest).`):n===`review`&&(i.push(`Provide a structured review with:`),i.push(`- Compliance status (pass/fail for each requirement)`),i.push(`- Issues found with severity (error/warning/info)`),i.push(`- Suggestions for improvement`)),i.push(``),i.join(`
+`)}function s(e,t,n={}){let i={...r,...n},o=e.meta,s=[];if(s.push(`# Feature: ${o.title??o.key}`),s.push(``),o.description&&(s.push(`> ${o.description}`),s.push(``)),s.push(`## Overview`),s.push(``),s.push(`- **Key:** \`${o.key}\``),s.push(`- **Stability:** ${o.stability}`),s.push(`- **Owners:** ${o.owners.join(`, `)}`),o.tags?.length&&s.push(`- **Tags:** ${o.tags.join(`, `)}`),s.push(``),e.operations?.length){s.push(`## Operations`),s.push(``),s.push(`| Name | Version | Type |`),s.push(`|------|---------|------|`);for(let n of e.operations){let e=(t?.specs?.getSpec(n.name,n.version))?.meta.kind??`unknown`;s.push(`| ${n.name} | v${n.version} | ${e} |`)}if(s.push(``),i.includeRelatedSpecs&&t?.specs){s.push(`### Operation Details`),s.push(``);for(let n of e.operations){let e=t.specs.getSpec(n.name,n.version);e&&(s.push(`---`),s.push(``),s.push(a(e,i)))}}}if(e.events?.length){s.push(`## Events`),s.push(``),s.push(`| Name | Version |`),s.push(`|------|---------|`);for(let t of e.events)s.push(`| ${t.name} | v${t.version} |`);s.push(``)}if(e.presentations?.length){s.push(`## Presentations`),s.push(``),s.push(`| Name | Version |`),s.push(`|------|---------|`);for(let t of e.presentations)s.push(`| ${t.name} | v${t.version} |`);if(s.push(``),i.includeRelatedPresentations&&t?.presentations){s.push(`### Presentation Details`),s.push(``);for(let n of e.presentations){let e=t.presentations.get(n.name,n.version);e&&(s.push(`#### ${n.name}.v${n.version}`),s.push(``),s.push(`- **Kind:** ${e.content.kind??`unknown`}`),`componentKey`in e.content&&s.push(`- **Component:** ${e.content.componentKey}`),s.push(``))}}}if(e.capabilities){if(e.capabilities.provides?.length){s.push(`## Capabilities Provided`),s.push(``);for(let t of e.capabilities.provides)s.push(`- \`${t.key}.v${t.version}\``);s.push(``)}if(e.capabilities.requires?.length){s.push(`## Capabilities Required`),s.push(``);for(let t of e.capabilities.requires)s.push(`- \`${t.key}\`${t.version?`.v${t.version}`:``} (${t.optional?`optional`:`required`})`);s.push(``)}}return s.join(`
+`)}function c(e){let t=e.meta,n=[];n.push(`# Presentation: ${t.name}.v${t.version}`),n.push(``),t.description&&(n.push(`> ${t.description}`),n.push(``)),n.push(`## Metadata`),n.push(``),n.push(`- **Name:** ${t.name}`),n.push(`- **Version:** ${t.version}`),t.stability&&n.push(`- **Stability:** ${t.stability}`),t.owners?.length&&n.push(`- **Owners:** ${t.owners.join(`, `)}`),t.tags?.length&&n.push(`- **Tags:** ${t.tags.join(`, `)}`),n.push(``),n.push(`## Source`),n.push(``),n.push(`- **Type:** ${e.source.type}`),e.source.type===`component`&&(n.push(`- **Framework:** ${e.source.framework}`),n.push(`- **Component Key:** ${e.source.componentKey}`)),n.push(``),n.push(`## Supported Targets`),n.push(``);for(let t of e.targets)n.push(`- ${t}`);return n.push(``),e.policy&&(n.push(`## Policy`),n.push(``),e.policy.flags?.length&&n.push(`- **Feature Flags:** ${e.policy.flags.join(`, `)}`),e.policy.pii?.length&&n.push(`- **PII Fields:** ${e.policy.pii.join(`, `)}`),n.push(``)),n.join(`
+`)}function l(e){let t=[];t.push(`# Event: ${e.name}.v${e.version}`),t.push(``),t.push(`## Metadata`),t.push(``),t.push(`- **Name:** ${e.name}`),t.push(`- **Version:** ${e.version}`),e.description&&t.push(`- **Description:** ${e.description}`),t.push(``),t.push(`## Payload Schema`),t.push(``),t.push("```json");try{let n=e.payload.getZod();if(`shape`in n&&n.shape){let e=n.shape,r=Object.keys(e);t.push(JSON.stringify({fields:r},null,2))}else t.push(`// Payload schema available at runtime`)}catch{t.push(`// Schema details available at runtime`)}return t.push("```"),t.push(``),t.join(`
+`)}function u(e){let t=[];if(t.push(`# ${e.title}`),t.push(``),e.summary&&(t.push(`> ${e.summary}`),t.push(``)),t.push(`## Metadata`),t.push(``),t.push(`- **ID:** ${e.id}`),t.push(`- **Kind:** ${e.kind??`reference`}`),t.push(`- **Visibility:** ${e.visibility??`public`}`),e.tags?.length&&t.push(`- **Tags:** ${e.tags.join(`, `)}`),e.owners?.length&&t.push(`- **Owners:** ${e.owners.join(`, `)}`),e.domain&&t.push(`- **Domain:** ${e.domain}`),t.push(``),t.push(`## Content`),t.push(``),t.push(e.body),t.push(``),e.links?.length){t.push(`## Related Links`),t.push(``);for(let n of e.links)t.push(`- [${n.label}](${n.href})`);t.push(``)}return t.join(`
+`)}function d(e,t={}){let n=t.format??`full`,r;switch(n){case`context`:r=i(e);break;case`prompt`:r=o(e);break;case`full`:default:r=a(e,t);break}return{spec:e,markdown:r,format:n,meta:{specName:e.meta.name,specVersion:e.meta.version,exportedAt:new Date().toISOString(),wordCount:r.split(/\s+/).length}}}function f(e,t,n={}){let r=n.format??`full`;return{feature:e,markdown:s(e,t,n),format:r,includedSpecs:e.operations?.map(e=>`${e.name}.v${e.version}`)??[],includedEvents:e.events?.map(e=>`${e.name}.v${e.version}`)??[],includedPresentations:e.presentations?.map(e=>`${e.name}.v${e.version}`)??[]}}export{u as docBlockToMarkdown,l as eventToMarkdown,f as exportFeature,d as exportSpec,s as featureToMarkdown,c as presentationToMarkdown,o as specToAgentPrompt,i as specToContextMarkdown,a as specToFullMarkdown};

package/dist/llm/index.js

@@ -0,0 +1 @@
+import{docBlockToMarkdown as e,eventToMarkdown as t,exportFeature as n,exportSpec as r,featureToMarkdown as i,presentationToMarkdown as a,specToAgentPrompt as o,specToContextMarkdown as s,specToFullMarkdown as c}from"./exporters.js";import{AGENT_SYSTEM_PROMPTS as l,formatPlanForAgent as u,generateFixViolationsPrompt as d,generateImplementationPlan as f,generateImplementationPrompt as p,generateReviewPrompt as m,generateTestPrompt as h,generateVerificationPrompt as g}from"./prompts.js";export{l as AGENT_SYSTEM_PROMPTS,e as docBlockToMarkdown,t as eventToMarkdown,n as exportFeature,r as exportSpec,i as featureToMarkdown,u as formatPlanForAgent,d as generateFixViolationsPrompt,f as generateImplementationPlan,p as generateImplementationPrompt,m as generateReviewPrompt,h as generateTestPrompt,g as generateVerificationPrompt,a as presentationToMarkdown,o as specToAgentPrompt,s as specToContextMarkdown,c as specToFullMarkdown};