@openora/core 0.4.0

package/dist/server/kernel/redis-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-cache.d.ts","sourceRoot":"","sources":["../../../src/server/kernel/redis-cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AASrD,qBAAa,UAAW,YAAW,YAAY;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,WAAW;IAE1C,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAO3C,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAOrE,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAMpD"}

package/dist/server/kernel/redis-cache.js

@@ -0,0 +1,36 @@
+const PREFIX = 'cache:';
+// Distributed reference cache, bound when REDIS_URL is set. Values are JSON so any
+// serializable shape round-trips. The `isReady` guards fast-path a miss/no-op when
+// the socket is reconnecting so a request never blocks on Redis; command errors are
+// NOT swallowed here - the cached()/invalidate() helpers already try/catch so a
+// cache fault degrades to a load, never a failed request.
+export class RedisCache {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    async get(key) {
+        if (!this.client.isReady)
+            return undefined;
+        const raw = await this.client.get(PREFIX + key);
+        if (raw === null)
+            return undefined;
+        return JSON.parse(raw);
+    }
+    async set(key, value, opts) {
+        if (!this.client.isReady)
+            return;
+        await this.client.set(PREFIX + key, JSON.stringify(value), {
+            expiration: { type: 'PX', value: opts.ttlMs },
+        });
+    }
+    async delete(key) {
+        if (!this.client.isReady)
+            return;
+        const keys = (Array.isArray(key) ? key : [key]).map((k) => PREFIX + k);
+        if (keys.length === 0)
+            return;
+        await this.client.del(keys);
+    }
+}
+//# sourceMappingURL=redis-cache.js.map

package/dist/server/kernel/redis-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-cache.js","sourceRoot":"","sources":["../../../src/server/kernel/redis-cache.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,GAAG,QAAQ,CAAC;AAExB,mFAAmF;AACnF,mFAAmF;AACnF,oFAAoF;AACpF,gFAAgF;AAChF,0DAA0D;AAC1D,MAAM,OAAO,UAAU;IACQ;IAA7B,YAA6B,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAEpD,KAAK,CAAC,GAAG,CAAI,GAAW;QACtB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAC3C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;QAChD,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACnC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,GAAW,EAAE,KAAQ,EAAE,IAAuB;QACzD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO;QACjC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;YACzD,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAsB;QACjC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO;QACjC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACvE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC9B,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;CACF"}

package/dist/server/kernel/redis-client.d.ts

@@ -0,0 +1,4 @@
+import { createClient } from 'redis';
+export type RedisClient = ReturnType<typeof createClient>;
+export declare function createRedisClient(url: string): RedisClient;
+//# sourceMappingURL=redis-client.d.ts.map

package/dist/server/kernel/redis-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-client.d.ts","sourceRoot":"","sources":["../../../src/server/kernel/redis-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AAGrC,MAAM,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;AAQ1D,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,CAS1D"}

package/dist/server/kernel/redis-client.js

@@ -0,0 +1,19 @@
+import { createClient } from 'redis';
+import { createLogger } from './logger.js';
+// One shared client for both the RedisCache and RedisRateLimiter adapters, bound
+// by createApp when REDIS_URL is set. node-redis throws at the process level if no
+// 'error' listener is attached, so we attach one and log instead of crashing;
+// connect() is fire-and-forget - commands issued before the socket is ready are
+// queued by node-redis, and each adapter fast-paths on `isReady` so a request
+// never hangs on a reconnecting socket.
+export function createRedisClient(url) {
+    const logger = createLogger('redis');
+    const client = createClient({
+        url,
+        socket: { reconnectStrategy: (retries) => Math.min(retries * 100, 2000) },
+    });
+    client.on('error', (err) => logger.error({ err }, 'redis client error'));
+    client.connect().catch((err) => logger.error({ err }, 'redis connect failed'));
+    return client;
+}
+//# sourceMappingURL=redis-client.js.map

package/dist/server/kernel/redis-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-client.js","sourceRoot":"","sources":["../../../src/server/kernel/redis-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAI3C,iFAAiF;AACjF,mFAAmF;AACnF,8EAA8E;AAC9E,gFAAgF;AAChF,8EAA8E;AAC9E,wCAAwC;AACxC,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,YAAY,CAAC;QAC1B,GAAG;QACH,MAAM,EAAE,EAAE,iBAAiB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE;KAC1E,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAY,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAClF,MAAM,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACxF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/server/kernel/redis-rate-limiter.d.ts

@@ -0,0 +1,10 @@
+import type { RateLimiterAdapter, RateLimitOptions, RateLimitResult } from '@openora/core/contracts';
+import type { RedisClient } from './redis-client.js';
+export declare class RedisRateLimiter implements RateLimiterAdapter {
+    private readonly client;
+    private readonly logger;
+    constructor(client: RedisClient);
+    consume(key: string, opts: RateLimitOptions): Promise<RateLimitResult>;
+    private unavailable;
+}
+//# sourceMappingURL=redis-rate-limiter.d.ts.map

package/dist/server/kernel/redis-rate-limiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-rate-limiter.d.ts","sourceRoot":"","sources":["../../../src/server/kernel/redis-rate-limiter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAqBrD,qBAAa,gBAAiB,YAAW,kBAAkB;IAG7C,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsC;gBAEhC,MAAM,EAAE,WAAW;IAE1C,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IAsB5E,OAAO,CAAC,WAAW;CAUpB"}

package/dist/server/kernel/redis-rate-limiter.js

@@ -0,0 +1,55 @@
+import { createLogger } from './logger.js';
+const PREFIX = 'rl:';
+// Fixed-window counter in one atomic round-trip: INCR the window, set the expiry
+// only on the first hit (so the window runs from the first request, not each one),
+// return the count and remaining TTL together. Atomic under concurrency - two
+// replicas can't both read a stale count and slip past the limit.
+//
+// ponytail: fixed-window (not sliding), same ceiling as the in-process default - a
+// burst straddling a boundary can briefly allow up to 2x limit. Fine for
+// brute-force throttling; swap the script for a sliding window if exactness matters.
+const CONSUME_SCRIPT = `
+local count = redis.call('INCR', KEYS[1])
+if count == 1 then
+  redis.call('PEXPIRE', KEYS[1], ARGV[1])
+end
+return { count, redis.call('PTTL', KEYS[1]) }
+`;
+export class RedisRateLimiter {
+    client;
+    logger = createLogger('redis-rate-limiter');
+    constructor(client) {
+        this.client = client;
+    }
+    async consume(key, opts) {
+        if (!this.client.isReady)
+            return this.unavailable(opts, { keyPrefix: key.split(':')[0] });
+        try {
+            const reply = await this.client.eval(CONSUME_SCRIPT, {
+                keys: [PREFIX + key],
+                arguments: [String(opts.windowMs)],
+            });
+            const [countRaw, pttlRaw] = Array.isArray(reply) ? reply : [];
+            const count = Number(countRaw);
+            const pttl = Number(pttlRaw);
+            const allowed = count <= opts.limit;
+            return { allowed, retryAfterMs: allowed ? 0 : Math.max(0, pttl) };
+        }
+        catch (err) {
+            return this.unavailable(opts, { keyPrefix: key.split(':')[0], err });
+        }
+    }
+    // Backend unreachable: fail-open by default to keep availability (throttling pauses
+    // during an outage); fail-closed for keys that opt into 'deny' where an unthrottled
+    // window is worse than a 429 (credential guessing).
+    // Never log the raw key - it embeds tokens/emails (pwreset:<token>, login:<email>);
+    // only the prefix before the first ':' is safe to record.
+    unavailable(opts, ctx) {
+        this.logger.warn({ ...ctx, onUnavailable: opts.onUnavailable ?? 'allow' }, 'rate limiter backend unavailable');
+        if (opts.onUnavailable === 'deny') {
+            return { allowed: false, retryAfterMs: opts.windowMs };
+        }
+        return { allowed: true, retryAfterMs: 0 };
+    }
+}
+//# sourceMappingURL=redis-rate-limiter.js.map

package/dist/server/kernel/redis-rate-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-rate-limiter.js","sourceRoot":"","sources":["../../../src/server/kernel/redis-rate-limiter.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,MAAM,GAAG,KAAK,CAAC;AAErB,iFAAiF;AACjF,mFAAmF;AACnF,8EAA8E;AAC9E,kEAAkE;AAClE,EAAE;AACF,mFAAmF;AACnF,yEAAyE;AACzE,qFAAqF;AACrF,MAAM,cAAc,GAAG;;;;;;CAMtB,CAAC;AAEF,MAAM,OAAO,gBAAgB;IAGE;IAFZ,MAAM,GAAG,YAAY,CAAC,oBAAoB,CAAC,CAAC;IAE7D,YAA6B,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAEpD,KAAK,CAAC,OAAO,CAAC,GAAW,EAAE,IAAsB;QAC/C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1F,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE;gBACnD,IAAI,EAAE,CAAC,MAAM,GAAG,GAAG,CAAC;gBACpB,SAAS,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;aACnC,CAAC,CAAC;YACH,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;YAC7B,MAAM,OAAO,GAAG,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC;YACpC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;QACpE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED,oFAAoF;IACpF,oFAAoF;IACpF,oDAAoD;IACpD,oFAAoF;IACpF,0DAA0D;IAClD,WAAW,CAAC,IAAsB,EAAE,GAA4B;QACtE,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,EAAE,GAAG,GAAG,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,OAAO,EAAE,EACxD,kCAAkC,CACnC,CAAC;QACF,IAAI,IAAI,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;YAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzD,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IAC5C,CAAC;CACF"}

package/dist/server/kernel/request-context.d.ts

@@ -0,0 +1,12 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+export type RequestContext = {
+    userId?: string;
+    traceId: string;
+};
+export type RequestStorage = AsyncLocalStorage<RequestContext>;
+export declare const requestStorage: RequestStorage;
+export declare function getCurrentRequestContext(): RequestContext | undefined;
+/** The active request's trace id for event correlation, or undefined on system/background paths. */
+export declare function getCurrentTraceId(): string | undefined;
+export declare function withRequestContext<T>(ctx: RequestContext, fn: () => T): T;
+//# sourceMappingURL=request-context.d.ts.map

package/dist/server/kernel/request-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-context.d.ts","sourceRoot":"","sources":["../../../src/server/kernel/request-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,iBAAiB,CAAC,cAAc,CAAC,CAAC;AAE/D,eAAO,MAAM,cAAc,EAAE,cAAwD,CAAC;AAEtF,wBAAgB,wBAAwB,IAAI,cAAc,GAAG,SAAS,CAErE;AAED,oGAAoG;AACpG,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAEtD;AAED,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAEzE"}

package/dist/server/kernel/request-context.js

@@ -0,0 +1,13 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+export const requestStorage = new AsyncLocalStorage();
+export function getCurrentRequestContext() {
+    return requestStorage.getStore();
+}
+/** The active request's trace id for event correlation, or undefined on system/background paths. */
+export function getCurrentTraceId() {
+    return requestStorage.getStore()?.traceId;
+}
+export function withRequestContext(ctx, fn) {
+    return requestStorage.run(ctx, fn);
+}
+//# sourceMappingURL=request-context.js.map

package/dist/server/kernel/request-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-context.js","sourceRoot":"","sources":["../../../src/server/kernel/request-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AASrD,MAAM,CAAC,MAAM,cAAc,GAAmB,IAAI,iBAAiB,EAAkB,CAAC;AAEtF,MAAM,UAAU,wBAAwB;IACtC,OAAO,cAAc,CAAC,QAAQ,EAAE,CAAC;AACnC,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,iBAAiB;IAC/B,OAAO,cAAc,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAI,GAAmB,EAAE,EAAW;IACpE,OAAO,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AACrC,CAAC"}

package/dist/server/kernel/router-utils.d.ts

@@ -0,0 +1,16 @@
+export type NodeHeaders = Record<string, string | string[] | undefined>;
+type RequestLike = {
+    headers: NodeHeaders;
+};
+export type AuthContext = {
+    userId: string;
+};
+export type OssContext = {
+    request: RequestLike;
+    auth?: AuthContext;
+    resHeaders?: Headers;
+    rawBody?: string;
+};
+export declare function getUserId(context: unknown): string;
+export {};
+//# sourceMappingURL=router-utils.d.ts.map

package/dist/server/kernel/router-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"router-utils.d.ts","sourceRoot":"","sources":["../../../src/server/kernel/router-utils.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;AAExE,KAAK,WAAW,GAAG;IAAE,OAAO,EAAE,WAAW,CAAA;CAAE,CAAC;AAG5C,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,OAAO,EAAE,WAAW,CAAC;IACrB,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IAGrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAoBF,wBAAgB,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAElD"}

package/dist/server/kernel/router-utils.js

@@ -0,0 +1,18 @@
+import { ORPCError } from '@orpc/server';
+function resolveAuth(context) {
+    if (typeof context !== 'object' ||
+        context === null ||
+        !('request' in context) ||
+        typeof context.request !== 'object') {
+        throw new ORPCError('UNAUTHORIZED', { message: 'Missing request context' });
+    }
+    const auth = context.auth;
+    if (!auth?.userId) {
+        throw new ORPCError('UNAUTHORIZED', { message: 'Authentication required' });
+    }
+    return auth;
+}
+export function getUserId(context) {
+    return resolveAuth(context).userId;
+}
+//# sourceMappingURL=router-utils.js.map

package/dist/server/kernel/router-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"router-utils.js","sourceRoot":"","sources":["../../../src/server/kernel/router-utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAqBzC,SAAS,WAAW,CAAC,OAAgB;IACnC,IACE,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,KAAK,IAAI;QAChB,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC;QACvB,OAAQ,OAAmC,CAAC,OAAO,KAAK,QAAQ,EAChE,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,IAAI,GAAI,OAAkC,CAAC,IAAI,CAAC;IACtD,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAClB,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAAgB;IACxC,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;AACrC,CAAC"}

package/dist/server/kernel/serialize-row.d.ts

@@ -0,0 +1,9 @@
+export type SerializedRow<T extends Record<string, unknown>, StringifiedK extends keyof T = never> = Omit<T, StringifiedK> & {
+    [P in StringifiedK]: string;
+};
+export type SerializeRowOptions<T extends Record<string, unknown>, DK extends keyof T, CK extends keyof T> = {
+    dateFields?: readonly DK[];
+    decimalFields?: readonly CK[];
+};
+export declare function serializeRow<T extends Record<string, unknown>, DK extends keyof T = never, CK extends keyof T = never>(row: T, opts?: SerializeRowOptions<T, DK, CK>): SerializedRow<T, DK | CK>;
+//# sourceMappingURL=serialize-row.d.ts.map

package/dist/server/kernel/serialize-row.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serialize-row.d.ts","sourceRoot":"","sources":["../../../src/server/kernel/serialize-row.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,CACvB,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,YAAY,SAAS,MAAM,CAAC,GAAG,KAAK,IAClC,IAAI,CAAC,CAAC,EAAE,YAAY,CAAC,GAAG;KAAG,CAAC,IAAI,YAAY,GAAG,MAAM;CAAE,CAAC;AAE5D,MAAM,MAAM,mBAAmB,CAC7B,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,EAAE,SAAS,MAAM,CAAC,EAClB,EAAE,SAAS,MAAM,CAAC,IAChB;IACF,UAAU,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC;IAC3B,aAAa,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC;CAC/B,CAAC;AAEF,wBAAgB,YAAY,CAC1B,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,EAAE,SAAS,MAAM,CAAC,GAAG,KAAK,EAC1B,EAAE,SAAS,MAAM,CAAC,GAAG,KAAK,EAC1B,GAAG,EAAE,CAAC,EAAE,IAAI,GAAE,mBAAmB,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAM,GAAG,aAAa,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAe9E"}

package/dist/server/kernel/serialize-row.js

@@ -0,0 +1,16 @@
+export function serializeRow(row, opts = {}) {
+    const { dateFields = [], decimalFields = [] } = opts;
+    const result = { ...row };
+    for (const key of dateFields) {
+        const val = result[key];
+        if (val instanceof Date)
+            result[key] = val.toISOString();
+    }
+    for (const key of decimalFields) {
+        const val = result[key];
+        if (val !== null && val !== undefined)
+            result[key] = String(val);
+    }
+    return result;
+}
+//# sourceMappingURL=serialize-row.js.map

package/dist/server/kernel/serialize-row.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serialize-row.js","sourceRoot":"","sources":["../../../src/server/kernel/serialize-row.ts"],"names":[],"mappings":"AAcA,MAAM,UAAU,YAAY,CAI1B,GAAM,EAAE,OAAuC,EAAE;IACjD,MAAM,EAAE,UAAU,GAAG,EAAE,EAAE,aAAa,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC;IACrD,MAAM,MAAM,GAA4B,EAAE,GAAG,GAAG,EAAE,CAAC;IAEnD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,GAAa,CAAC,CAAC;QAClC,IAAI,GAAG,YAAY,IAAI;YAAE,MAAM,CAAC,GAAa,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACrE,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAa,CAAC,CAAC;QAClC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;YAAE,MAAM,CAAC,GAAa,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO,MAAmC,CAAC;AAC7C,CAAC"}

package/dist/server/plugin-host/__tests__/module-registry.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=module-registry.test.d.ts.map

package/dist/server/plugin-host/__tests__/module-registry.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-registry.test.d.ts","sourceRoot":"","sources":["../../../../src/server/plugin-host/__tests__/module-registry.test.ts"],"names":[],"mappings":""}

package/dist/server/plugin-host/__tests__/module-registry.test.js

@@ -0,0 +1,48 @@
+import { describe, it, expect } from 'vitest';
+import { Container } from '../../kernel/index.js';
+import { createToken, createSealedToken } from '@openora/core/contracts';
+import { ModuleRegistryImpl } from '../module-registry.js';
+function newRegistry() {
+    const container = new Container();
+    return { container, reg: new ModuleRegistryImpl(container) };
+}
+describe('ModuleRegistryImpl', () => {
+    it('provide() binds to the container (last-wins)', () => {
+        const { container, reg } = newRegistry();
+        const TOKEN = createToken('svc');
+        reg.provide(TOKEN, () => 'a');
+        reg.provide(TOKEN, () => 'b');
+        expect(container.get(TOKEN)).toBe('b');
+    });
+    it('provide() refuses to bind a sealed token', () => {
+        const { reg } = newRegistry();
+        const SEALED = createSealedToken('rg-enforcement');
+        expect(() => reg.provide(SEALED, () => 'x')).toThrow(/sealed token/i);
+    });
+    it('provideSealed() binds a sealed token exactly once', () => {
+        const { container, reg } = newRegistry();
+        const SEALED = createSealedToken('audit-log-writer');
+        reg.provideSealed(SEALED, () => 'canonical');
+        expect(container.get(SEALED)).toBe('canonical');
+    });
+    it('provideSealed() rejects a second bind of the same sealed token', () => {
+        const { reg } = newRegistry();
+        const SEALED = createSealedToken('audit-log-writer');
+        reg.provideSealed(SEALED, () => 'canonical');
+        expect(() => reg.provideSealed(SEALED, () => 'overlay-attempt')).toThrow(/already bound/i);
+    });
+    it('routers.add() rejects a duplicate namespace', () => {
+        const { reg } = newRegistry();
+        reg.routers.add('wallet', () => ({}));
+        expect(() => reg.routers.add('wallet', () => ({}))).toThrow(/already registered/);
+    });
+    it('events.on() accumulates handlers per event', () => {
+        const { reg } = newRegistry();
+        const h1 = () => { };
+        const h2 = () => { };
+        reg.events.on('wallet.deposit.completed', h1);
+        reg.events.on('wallet.deposit.completed', h2);
+        expect(reg.events.getAll().get('wallet.deposit.completed')).toEqual([h1, h2]);
+    });
+});
+//# sourceMappingURL=module-registry.test.js.map

package/dist/server/plugin-host/__tests__/module-registry.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-registry.test.js","sourceRoot":"","sources":["../../../../src/server/plugin-host/__tests__/module-registry.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D,SAAS,WAAW;IAClB,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC;IAClC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,WAAW,CAAS,KAAK,CAAC,CAAC;QACzC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QAC9B,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,EAAE,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,iBAAiB,CAAS,gBAAgB,CAAC,CAAC;QAC3D,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,MAAe,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,iBAAiB,CAAS,kBAAkB,CAAC,CAAC;QAC7D,GAAG,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC;QAC7C,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,EAAE,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,iBAAiB,CAAS,kBAAkB,CAAC,CAAC;QAC7D,GAAG,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC7F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,EAAE,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC;QAC9B,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAU,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAU,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC7F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,EAAE,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC;QAC9B,MAAM,EAAE,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;QACpB,MAAM,EAAE,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;QACpB,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,0BAA0B,EAAE,EAAE,CAAC,CAAC;QAC9C,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,0BAA0B,EAAE,EAAE,CAAC,CAAC;QAC9C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/server/plugin-host/__tests__/required-ports.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=required-ports.test.d.ts.map

package/dist/server/plugin-host/__tests__/required-ports.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"required-ports.test.d.ts","sourceRoot":"","sources":["../../../../src/server/plugin-host/__tests__/required-ports.test.ts"],"names":[],"mappings":""}

package/dist/server/plugin-host/__tests__/required-ports.test.js

@@ -0,0 +1,27 @@
+import { describe, it, expect } from 'vitest';
+import { Container } from '../../kernel/index.js';
+import { createToken } from '@openora/core/contracts';
+import { assertRequiredPorts } from '../load-plugins.js';
+const WALLET_COMMANDS = createToken('WALLET_COMMANDS');
+const consumer = {
+    id: 'gaming',
+    requiresPorts: [WALLET_COMMANDS],
+    register: () => { },
+};
+describe('assertRequiredPorts (ADR-0024 boot fail-fast)', () => {
+    it('passes when every required port is bound', () => {
+        const container = new Container();
+        container.register(WALLET_COMMANDS, () => ({ debit: () => { } }));
+        expect(() => assertRequiredPorts([consumer], container)).not.toThrow();
+    });
+    it('throws an actionable error naming the plugin and the unbound port', () => {
+        const container = new Container();
+        expect(() => assertRequiredPorts([consumer], container)).toThrow(/gaming.*WALLET_COMMANDS/s);
+    });
+    it('is a no-op for plugins that declare no required ports', () => {
+        const container = new Container();
+        const plain = { id: 'audit', register: () => { } };
+        expect(() => assertRequiredPorts([plain], container)).not.toThrow();
+    });
+});
+//# sourceMappingURL=required-ports.test.js.map

package/dist/server/plugin-host/__tests__/required-ports.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"required-ports.test.js","sourceRoot":"","sources":["../../../../src/server/plugin-host/__tests__/required-ports.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAGzD,MAAM,eAAe,GAAG,WAAW,CAAwB,iBAAiB,CAAC,CAAC;AAE9E,MAAM,QAAQ,GAAW;IACvB,EAAE,EAAE,QAAQ;IACZ,aAAa,EAAE,CAAC,eAAe,CAAC;IAChC,QAAQ,EAAE,GAAG,EAAE,GAAE,CAAC;CACnB,CAAC;AAEF,QAAQ,CAAC,+CAA+C,EAAE,GAAG,EAAE;IAC7D,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC;QAClC,SAAS,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACjE,MAAM,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAC/F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC;QAClC,MAAM,KAAK,GAAW,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,CAAC;QAC1D,MAAM,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/server/plugin-host/__tests__/service-manifest.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=service-manifest.test.d.ts.map

package/dist/server/plugin-host/__tests__/service-manifest.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-manifest.test.d.ts","sourceRoot":"","sources":["../../../../src/server/plugin-host/__tests__/service-manifest.test.ts"],"names":[],"mappings":""}

package/dist/server/plugin-host/__tests__/service-manifest.test.js

@@ -0,0 +1,34 @@
+import { describe, it, expect } from 'vitest';
+import { applyServiceManifest, parseServiceManifest } from '../service-manifest.js';
+const entries = [
+    { id: 'identity', path: 'a' },
+    { id: 'wallet', path: 'b' },
+    { id: 'gaming', path: 'c' },
+    { id: 'rabbitmq', path: 'd', kind: 'infra' },
+    { id: 'bullmq', path: 'e', kind: 'infra' },
+];
+describe('parseServiceManifest', () => {
+    it('returns null (monolith) when unset or empty', () => {
+        expect(parseServiceManifest(undefined)).toBeNull();
+        expect(parseServiceManifest('')).toBeNull();
+        expect(parseServiceManifest('   ')).toBeNull();
+    });
+    it('splits on commas and whitespace, trimming blanks', () => {
+        expect(parseServiceManifest('identity, wallet')).toEqual(['identity', 'wallet']);
+        expect(parseServiceManifest('identity  wallet')).toEqual(['identity', 'wallet']);
+        expect(parseServiceManifest('wallet,')).toEqual(['wallet']);
+    });
+});
+describe('applyServiceManifest', () => {
+    it('returns every entry for the monolith (null manifest)', () => {
+        expect(applyServiceManifest(entries, null)).toHaveLength(entries.length);
+    });
+    it('keeps the named modules plus all infra overlays', () => {
+        const selected = applyServiceManifest(entries, ['wallet']);
+        expect(selected.map((e) => e.id).sort()).toEqual(['bullmq', 'rabbitmq', 'wallet']);
+    });
+    it('throws on an unknown id', () => {
+        expect(() => applyServiceManifest(entries, ['nope'])).toThrow(/unknown module id/);
+    });
+});
+//# sourceMappingURL=service-manifest.test.js.map

package/dist/server/plugin-host/__tests__/service-manifest.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-manifest.test.js","sourceRoot":"","sources":["../../../../src/server/plugin-host/__tests__/service-manifest.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAGpF,MAAM,OAAO,GAAkB;IAC7B,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE;IAC7B,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE;IAC3B,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE;IAC3B,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE;IAC5C,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE;CAC3C,CAAC;AAEF,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACnD,MAAM,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC5C,MAAM,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;QACjF,MAAM,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;QACjF,MAAM,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,CAAC,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC3D,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/server/plugin-host/define-plugin.d.ts

@@ -0,0 +1,48 @@
+import type { Container, Factory } from '../kernel/index.js';
+import type { SealedToken, Token, WorkerRegistration } from '@openora/core/contracts';
+export type McpToolDefinition = {
+    name: string;
+    description: string;
+    inputSchema: Record<string, unknown>;
+    handler: (input: unknown) => unknown | Promise<unknown>;
+};
+export type RouterFactory = (c: Container) => unknown;
+export type EventHandler = (payload: unknown) => void | Promise<void>;
+export type ModuleRegistry = {
+    provide<T>(token: Token<T>, factory: Factory<T>): void;
+    provideSealed<T>(token: SealedToken<T>, factory: Factory<T>): void;
+    routers: {
+        add(namespace: string, factory: RouterFactory): void;
+        getAll(): Map<string, RouterFactory>;
+    };
+    slots: {
+        fill(slotName: string, component: unknown): void;
+        getAll(): Map<string, unknown>;
+    };
+    events: {
+        on(event: string, handler: EventHandler): void;
+        getAll(): Map<string, EventHandler[]>;
+    };
+    jobs: {
+        worker<T>(registration: WorkerRegistration<T>): void;
+        getAll(): WorkerRegistration<unknown>[];
+    };
+    mcp: {
+        tool(definition: McpToolDefinition): void;
+        getAll(): McpToolDefinition[];
+    };
+};
+export type Plugin = {
+    id: string;
+    dependsOn?: string[];
+    requiresPorts?: Token<unknown>[];
+    register: (ctx: ModuleRegistry) => void | Promise<void>;
+};
+export type PluginDefinition = {
+    id: string;
+    dependsOn?: string[];
+    requiresPorts?: Token<unknown>[];
+    register: (ctx: ModuleRegistry) => void | Promise<void>;
+};
+export declare function definePlugin(definition: PluginDefinition): Plugin;
+//# sourceMappingURL=define-plugin.d.ts.map

package/dist/server/plugin-host/define-plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"define-plugin.d.ts","sourceRoot":"","sources":["../../../src/server/plugin-host/define-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAEtF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACzD,CAAC;AAGF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,EAAE,SAAS,KAAK,OAAO,CAAC;AAEtD,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAEtE,MAAM,MAAM,cAAc,GAAG;IAE3B,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAIvD,aAAa,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IACnE,OAAO,EAAE;QACP,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,IAAI,CAAC;QACrD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;KACtC,CAAC;IACF,KAAK,EAAE;QACL,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,IAAI,CAAC;QACjD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAChC,CAAC;IACF,MAAM,EAAE;QACN,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,IAAI,CAAC;QAC/C,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;KACvC,CAAC;IAEF,IAAI,EAAE;QACJ,MAAM,CAAC,CAAC,EAAE,YAAY,EAAE,kBAAkB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;QACrD,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;KACzC,CAAC;IACF,GAAG,EAAE;QACH,IAAI,CAAC,UAAU,EAAE,iBAAiB,GAAG,IAAI,CAAC;QAC1C,MAAM,IAAI,iBAAiB,EAAE,CAAC;KAC/B,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,MAAM,GAAG;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IAErB,aAAa,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;IACjC,QAAQ,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzD,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,aAAa,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;IACjC,QAAQ,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzD,CAAC;AAEF,wBAAgB,YAAY,CAAC,UAAU,EAAE,gBAAgB,GAAG,MAAM,CAEjE"}

package/dist/server/plugin-host/define-plugin.js

@@ -0,0 +1,4 @@
+export function definePlugin(definition) {
+    return definition;
+}
+//# sourceMappingURL=define-plugin.js.map

package/dist/server/plugin-host/define-plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"define-plugin.js","sourceRoot":"","sources":["../../../src/server/plugin-host/define-plugin.ts"],"names":[],"mappings":"AA4DA,MAAM,UAAU,YAAY,CAAC,UAA4B;IACvD,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/server/plugin-host/index.d.ts

@@ -0,0 +1,8 @@
+export { definePlugin } from './define-plugin.js';
+export type { Plugin, PluginDefinition, ModuleRegistry, McpToolDefinition, RouterFactory, EventHandler, } from './define-plugin.js';
+export { ModuleRegistryImpl } from './module-registry.js';
+export { loadPlugins } from './load-plugins.js';
+export type { PluginEntry } from './load-plugins.js';
+export { applyServiceManifest, parseServiceManifest } from './service-manifest.js';
+export { loadExtensions } from './load-extensions.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/server/plugin-host/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/plugin-host/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EACV,MAAM,EACN,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,YAAY,GACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/server/plugin-host/index.js

@@ -0,0 +1,6 @@
+export { definePlugin } from './define-plugin.js';
+export { ModuleRegistryImpl } from './module-registry.js';
+export { loadPlugins } from './load-plugins.js';
+export { applyServiceManifest, parseServiceManifest } from './service-manifest.js';
+export { loadExtensions } from './load-extensions.js';
+//# sourceMappingURL=index.js.map

package/dist/server/plugin-host/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/plugin-host/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AASlD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/server/plugin-host/load-extensions.d.ts

@@ -0,0 +1,9 @@
+import type { PluginEntry } from './load-plugins.js';
+/**
+ * Load the extensions.config.ts registry from disk and resolve plugin paths.
+ * Resolves via EXTENSIONS_CONFIG env var or walks up from process.cwd().
+ * Optional `filter` lets callers apply edition gating (eg OSS_ADDONS) before
+ * the service manifest is applied.
+ */
+export declare function loadExtensions(filter?: (entries: PluginEntry[]) => PluginEntry[]): Promise<PluginEntry[]>;
+//# sourceMappingURL=load-extensions.d.ts.map

package/dist/server/plugin-host/load-extensions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-extensions.d.ts","sourceRoot":"","sources":["../../../src/server/plugin-host/load-extensions.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,WAAW,EAAE,GACjD,OAAO,CAAC,WAAW,EAAE,CAAC,CA0BxB"}

package/dist/server/plugin-host/load-extensions.js

@@ -0,0 +1,52 @@
+import { resolve, dirname, isAbsolute } from 'node:path';
+import { accessSync } from 'node:fs';
+import { applyServiceManifest, parseServiceManifest } from './service-manifest.js';
+/**
+ * Load the extensions.config.ts registry from disk and resolve plugin paths.
+ * Resolves via EXTENSIONS_CONFIG env var or walks up from process.cwd().
+ * Optional `filter` lets callers apply edition gating (eg OSS_ADDONS) before
+ * the service manifest is applied.
+ */
+export async function loadExtensions(filter) {
+    const fromEnv = process.env['EXTENSIONS_CONFIG'];
+    const configPath = fromEnv
+        ? isAbsolute(fromEnv)
+            ? fromEnv
+            : resolve(process.cwd(), fromEnv)
+        : findConfigUpwards(process.cwd());
+    const mod = (await import(configPath));
+    const configDir = dirname(configPath);
+    const resolved = mod.extensions.map((entry) => ({
+        ...entry,
+        path: isAbsolute(entry.path) ? entry.path : resolve(configDir, entry.path),
+    }));
+    const filtered = filter ? filter(resolved) : resolved;
+    const manifest = parseServiceManifest(process.env['SERVICE_MANIFEST']);
+    const selected = applyServiceManifest(filtered, manifest);
+    if (manifest !== null) {
+        process.stdout.write(`SERVICE_MANIFEST active: booting ${selected.map((e) => e.id).join(', ')}\n`);
+    }
+    return selected;
+}
+function findConfigUpwards(start) {
+    let dir = start;
+    for (let i = 0; i < 8; i++) {
+        for (const ext of ['.js', '.ts']) {
+            const candidate = resolve(dir, `extensions.config${ext}`);
+            try {
+                accessSync(candidate);
+                return candidate;
+            }
+            catch {
+                // not here - try parent
+            }
+        }
+        const parent = dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    throw new Error(`extensions.config.js not found above ${start}. ` +
+        `Set EXTENSIONS_CONFIG to point at it explicitly.`);
+}
+//# sourceMappingURL=load-extensions.js.map

package/dist/server/plugin-host/load-extensions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-extensions.js","sourceRoot":"","sources":["../../../src/server/plugin-host/load-extensions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAGnF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAkD;IAElD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,OAAO;QACxB,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC;YACnB,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC;QACnC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAErC,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAkC,CAAC;IACxE,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAEtC,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9C,GAAG,KAAK;QACR,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC;KAC3E,CAAC,CAAC,CAAC;IAEJ,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAEtD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC1D,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oCAAoC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAC7E,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,KAAK,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,oBAAoB,GAAG,EAAE,CAAC,CAAC;YAC1D,IAAI,CAAC;gBACH,UAAU,CAAC,SAAS,CAAC,CAAC;gBACtB,OAAO,SAAS,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,wBAAwB;YAC1B,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,MAAM,IAAI,KAAK,CACb,wCAAwC,KAAK,IAAI;QAC/C,kDAAkD,CACrD,CAAC;AACJ,CAAC"}