@pattern-stack/codegen 0.15.1 → 0.15.3

package/dist/chunk-SR7F3TJY.js

@@ -0,0 +1,130 @@
+import {
+  FieldDiffSchema
+} from "./chunk-SQDOBLBP.js";
+import {
+  assertTenantId
+} from "./chunk-MZ6GV4YF.js";
+import {
+  integrationRunItems,
+  integrationRuns,
+  integrationSubscriptions
+} from "./chunk-HNWZFNKP.js";
+import {
+  INTEGRATION_MULTI_TENANT
+} from "./chunk-S7C6TIIF.js";
+import {
+  DRIZZLE
+} from "./chunk-U64T4YZE.js";
+import {
+  __decorateClass,
+  __decorateParam
+} from "./chunk-2E224ZSN.js";
+
+// runtime/subsystems/integration/integration-run-recorder.drizzle-backend.ts
+import { Inject, Injectable, Optional } from "@nestjs/common";
+import { and, desc, eq } from "drizzle-orm";
+var DrizzleIntegrationRunRecorder = class {
+  constructor(db, multiTenant) {
+    this.db = db;
+    this.multiTenant = multiTenant ?? false;
+  }
+  db;
+  multiTenant;
+  async startRun(input) {
+    assertTenantId(input.tenantId, {
+      multiTenant: this.multiTenant,
+      operation: "startRun"
+    });
+    const rows = await this.db.insert(integrationRuns).values({
+      subscriptionId: input.subscriptionId,
+      direction: input.direction,
+      action: input.action,
+      status: "running",
+      cursorBefore: input.cursorBefore ?? null,
+      tenantId: input.tenantId ?? null
+    }).returning({ id: integrationRuns.id });
+    const id = rows[0]?.id;
+    if (!id) {
+      throw new Error("DrizzleIntegrationRunRecorder: INSERT RETURNING produced no id");
+    }
+    return { id };
+  }
+  async recordItem(input) {
+    assertTenantId(input.tenantId, {
+      multiTenant: this.multiTenant,
+      operation: "recordItem"
+    });
+    FieldDiffSchema.parse(input.changedFields);
+    await this.db.insert(integrationRunItems).values({
+      integrationRunId: input.integrationRunId,
+      entityType: input.entityType,
+      externalId: input.externalId,
+      localId: input.localId ?? null,
+      operation: input.operation,
+      status: input.status,
+      changedFields: input.changedFields,
+      title: input.title ?? null,
+      error: input.error ?? null,
+      tenantId: input.tenantId ?? null
+    });
+  }
+  async listRecent(limit, subscriptionId, tenantId) {
+    assertTenantId(tenantId, {
+      multiTenant: this.multiTenant,
+      operation: "listRecent"
+    });
+    const conditions = [];
+    if (subscriptionId !== void 0) {
+      conditions.push(eq(integrationRuns.subscriptionId, subscriptionId));
+    }
+    if (this.multiTenant) {
+      conditions.push(eq(integrationRuns.tenantId, tenantId));
+    }
+    const where = conditions.length === 0 ? void 0 : conditions.length === 1 ? conditions[0] : and(...conditions);
+    const rows = await this.db.select({
+      id: integrationRuns.id,
+      subscriptionId: integrationRuns.subscriptionId,
+      connectionId: integrationSubscriptions.connectionId,
+      status: integrationRuns.status,
+      startedAt: integrationRuns.startedAt,
+      completedAt: integrationRuns.completedAt,
+      recordsProcessed: integrationRuns.recordsProcessed,
+      tenantId: integrationRuns.tenantId
+    }).from(integrationRuns).innerJoin(
+      integrationSubscriptions,
+      eq(integrationRuns.subscriptionId, integrationSubscriptions.id)
+    ).where(where).orderBy(desc(integrationRuns.startedAt)).limit(limit);
+    return rows.map((row) => ({
+      id: row.id,
+      subscriptionId: row.subscriptionId,
+      connectionId: row.connectionId,
+      status: row.status,
+      startedAt: row.startedAt,
+      completedAt: row.completedAt,
+      recordsProcessed: row.recordsProcessed,
+      tenantId: row.tenantId
+    }));
+  }
+  async completeRun(runId, input) {
+    await this.db.update(integrationRuns).set({
+      status: input.status,
+      recordsFound: input.recordsFound,
+      recordsProcessed: input.recordsProcessed,
+      cursorAfter: input.cursorAfter ?? null,
+      durationMs: input.durationMs,
+      error: input.error ?? null,
+      completedAt: /* @__PURE__ */ new Date()
+    }).where(eq(integrationRuns.id, runId));
+  }
+};
+DrizzleIntegrationRunRecorder = __decorateClass([
+  Injectable(),
+  __decorateParam(0, Inject(DRIZZLE)),
+  __decorateParam(1, Optional()),
+  __decorateParam(1, Inject(INTEGRATION_MULTI_TENANT))
+], DrizzleIntegrationRunRecorder);
+
+export {
+  DrizzleIntegrationRunRecorder
+};
+//# sourceMappingURL=chunk-SR7F3TJY.js.map

package/dist/chunk-SR7F3TJY.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../runtime/subsystems/integration/integration-run-recorder.drizzle-backend.ts"],"sourcesContent":["/**\n * DrizzleIntegrationRunRecorder — Drizzle-backed `IIntegrationRunRecorder` (SYNC-4).\n *\n * Generic write path only — extracted from the source app's\n * `IntegrationRunRecorderService`, minus CRM-specific convenience methods. Those\n * stay consumer-owned; the subsystem ships the substrate.\n *\n * ## Responsibilities\n *\n *   - `startRun`     — INSERT integration_runs row in status='running', returns id.\n *   - `recordItem`   — validates `changedFields` via `FieldDiffSchema.parse`\n *                      BEFORE the INSERT; a malformed shape throws before\n *                      any DB call fires. Enforces the ADR-0003 contract at\n *                      the write boundary.\n *   - `completeRun`  — UPDATE integration_runs with terminal status, counts,\n *                      cursor_after, duration_ms, completed_at.\n *\n * ## Multi-tenancy\n *\n * When `INTEGRATION_MULTI_TENANT` is true (SYNC-6):\n *   - `startRun` and `recordItem` require non-null `tenantId` on input.\n *     Enforcement goes through the shared `assertTenantId` helper so the\n *     error message shape matches the orchestrator entry point + the\n *     cursor-store backends.\n *   - `completeRun` does NOT re-check tenancy — the run id was returned\n *     by `startRun` which already enforced it, and run ids are uuids that\n *     aren't guessable cross-tenant. Matches JOB-3's pattern of trusting\n *     the run-id for downstream mutations.\n */\nimport { Inject, Injectable, Optional } from '@nestjs/common';\nimport { and, desc, eq, type SQL } from 'drizzle-orm';\nimport type { DrizzleClient } from '../../types/drizzle';\nimport { DRIZZLE } from '../../constants/tokens';\nimport type {\n  CompleteRunInput,\n  IIntegrationRunRecorder,\n  RecordItemInput,\n  StartRunInput,\n  IntegrationRunSummary,\n} from './integration-run-recorder.protocol';\nimport { integrationRuns, integrationRunItems, integrationSubscriptions } from './integration-audit.schema';\nimport { FieldDiffSchema } from './integration-field-diff.protocol';\nimport { INTEGRATION_MULTI_TENANT } from './integration.tokens';\nimport { assertTenantId } from './integration-errors';\n\n@Injectable()\nexport class DrizzleIntegrationRunRecorder implements IIntegrationRunRecorder {\n  private readonly multiTenant: boolean;\n\n  constructor(\n    @Inject(DRIZZLE) private readonly db: DrizzleClient,\n    @Optional() @Inject(INTEGRATION_MULTI_TENANT) multiTenant?: boolean,\n  ) {\n    this.multiTenant = multiTenant ?? false;\n  }\n\n  async startRun(input: StartRunInput): Promise<{ id: string }> {\n    assertTenantId(input.tenantId, {\n      multiTenant: this.multiTenant,\n      operation: 'startRun',\n    });\n\n    const rows = await this.db\n      .insert(integrationRuns)\n      .values({\n        subscriptionId: input.subscriptionId,\n        direction: input.direction,\n        action: input.action,\n        status: 'running',\n        cursorBefore: input.cursorBefore ?? null,\n        tenantId: input.tenantId ?? null,\n      })\n      .returning({ id: integrationRuns.id });\n\n    const id = rows[0]?.id;\n    if (!id) {\n      // Drizzle's insert().returning() contract: at least one row is\n      // returned for every successful INSERT. A missing id would indicate\n      // a driver misbehavior; throw loudly rather than return bogus data.\n      throw new Error('DrizzleIntegrationRunRecorder: INSERT RETURNING produced no id');\n    }\n    return { id };\n  }\n\n  async recordItem(input: RecordItemInput): Promise<void> {\n    assertTenantId(input.tenantId, {\n      multiTenant: this.multiTenant,\n      operation: 'recordItem',\n    });\n\n    // ADR-0003 contract enforcement — reject malformed changedFields\n    // before the DB call fires. `parse` throws a ZodError; callers see\n    // the validation failure, not a DB constraint error.\n    FieldDiffSchema.parse(input.changedFields);\n\n    await this.db.insert(integrationRunItems).values({\n      integrationRunId: input.integrationRunId,\n      entityType: input.entityType,\n      externalId: input.externalId,\n      localId: input.localId ?? null,\n      operation: input.operation,\n      status: input.status,\n      changedFields: input.changedFields,\n      title: input.title ?? null,\n      error: input.error ?? null,\n      tenantId: input.tenantId ?? null,\n    });\n  }\n\n  async listRecent(\n    limit: number,\n    subscriptionId?: string,\n    tenantId?: string | null,\n  ): Promise<IntegrationRunSummary[]> {\n    assertTenantId(tenantId, {\n      multiTenant: this.multiTenant,\n      operation: 'listRecent',\n    });\n\n    // JOIN against integration_subscriptions to resolve `connection_id` per run.\n    // `integration_runs.subscription_id` is a non-null FK so INNER JOIN is correct;\n    // there should be no orphaned runs.\n    const conditions: SQL[] = [];\n    if (subscriptionId !== undefined) {\n      conditions.push(eq(integrationRuns.subscriptionId, subscriptionId));\n    }\n    if (this.multiTenant) {\n      conditions.push(eq(integrationRuns.tenantId, tenantId as string));\n    }\n    const where =\n      conditions.length === 0\n        ? undefined\n        : conditions.length === 1\n          ? conditions[0]\n          : and(...conditions);\n\n    const rows = await this.db\n      .select({\n        id: integrationRuns.id,\n        subscriptionId: integrationRuns.subscriptionId,\n        connectionId: integrationSubscriptions.connectionId,\n        status: integrationRuns.status,\n        startedAt: integrationRuns.startedAt,\n        completedAt: integrationRuns.completedAt,\n        recordsProcessed: integrationRuns.recordsProcessed,\n        tenantId: integrationRuns.tenantId,\n      })\n      .from(integrationRuns)\n      .innerJoin(\n        integrationSubscriptions,\n        eq(integrationRuns.subscriptionId, integrationSubscriptions.id),\n      )\n      .where(where)\n      .orderBy(desc(integrationRuns.startedAt))\n      .limit(limit);\n\n    return rows.map((row) => ({\n      id: row.id,\n      subscriptionId: row.subscriptionId,\n      connectionId: row.connectionId,\n      status: row.status,\n      startedAt: row.startedAt,\n      completedAt: row.completedAt,\n      recordsProcessed: row.recordsProcessed,\n      tenantId: row.tenantId,\n    }));\n  }\n\n  async completeRun(runId: string, input: CompleteRunInput): Promise<void> {\n    await this.db\n      .update(integrationRuns)\n      .set({\n        status: input.status,\n        recordsFound: input.recordsFound,\n        recordsProcessed: input.recordsProcessed,\n        cursorAfter: input.cursorAfter ?? null,\n        durationMs: input.durationMs,\n        error: input.error ?? null,\n        completedAt: new Date(),\n      })\n      .where(eq(integrationRuns.id, runId));\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AA6BA,SAAS,QAAQ,YAAY,gBAAgB;AAC7C,SAAS,KAAK,MAAM,UAAoB;AAgBjC,IAAM,gCAAN,MAAuE;AAAA,EAG5E,YACoC,IACY,aAC9C;AAFkC;AAGlC,SAAK,cAAc,eAAe;AAAA,EACpC;AAAA,EAJoC;AAAA,EAHnB;AAAA,EASjB,MAAM,SAAS,OAA+C;AAC5D,mBAAe,MAAM,UAAU;AAAA,MAC7B,aAAa,KAAK;AAAA,MAClB,WAAW;AAAA,IACb,CAAC;AAED,UAAM,OAAO,MAAM,KAAK,GACrB,OAAO,eAAe,EACtB,OAAO;AAAA,MACN,gBAAgB,MAAM;AAAA,MACtB,WAAW,MAAM;AAAA,MACjB,QAAQ,MAAM;AAAA,MACd,QAAQ;AAAA,MACR,cAAc,MAAM,gBAAgB;AAAA,MACpC,UAAU,MAAM,YAAY;AAAA,IAC9B,CAAC,EACA,UAAU,EAAE,IAAI,gBAAgB,GAAG,CAAC;AAEvC,UAAM,KAAK,KAAK,CAAC,GAAG;AACpB,QAAI,CAAC,IAAI;AAIP,YAAM,IAAI,MAAM,gEAAgE;AAAA,IAClF;AACA,WAAO,EAAE,GAAG;AAAA,EACd;AAAA,EAEA,MAAM,WAAW,OAAuC;AACtD,mBAAe,MAAM,UAAU;AAAA,MAC7B,aAAa,KAAK;AAAA,MAClB,WAAW;AAAA,IACb,CAAC;AAKD,oBAAgB,MAAM,MAAM,aAAa;AAEzC,UAAM,KAAK,GAAG,OAAO,mBAAmB,EAAE,OAAO;AAAA,MAC/C,kBAAkB,MAAM;AAAA,MACxB,YAAY,MAAM;AAAA,MAClB,YAAY,MAAM;AAAA,MAClB,SAAS,MAAM,WAAW;AAAA,MAC1B,WAAW,MAAM;AAAA,MACjB,QAAQ,MAAM;AAAA,MACd,eAAe,MAAM;AAAA,MACrB,OAAO,MAAM,SAAS;AAAA,MACtB,OAAO,MAAM,SAAS;AAAA,MACtB,UAAU,MAAM,YAAY;AAAA,IAC9B,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,WACJ,OACA,gBACA,UACkC;AAClC,mBAAe,UAAU;AAAA,MACvB,aAAa,KAAK;AAAA,MAClB,WAAW;AAAA,IACb,CAAC;AAKD,UAAM,aAAoB,CAAC;AAC3B,QAAI,mBAAmB,QAAW;AAChC,iBAAW,KAAK,GAAG,gBAAgB,gBAAgB,cAAc,CAAC;AAAA,IACpE;AACA,QAAI,KAAK,aAAa;AACpB,iBAAW,KAAK,GAAG,gBAAgB,UAAU,QAAkB,CAAC;AAAA,IAClE;AACA,UAAM,QACJ,WAAW,WAAW,IAClB,SACA,WAAW,WAAW,IACpB,WAAW,CAAC,IACZ,IAAI,GAAG,UAAU;AAEzB,UAAM,OAAO,MAAM,KAAK,GACrB,OAAO;AAAA,MACN,IAAI,gBAAgB;AAAA,MACpB,gBAAgB,gBAAgB;AAAA,MAChC,cAAc,yBAAyB;AAAA,MACvC,QAAQ,gBAAgB;AAAA,MACxB,WAAW,gBAAgB;AAAA,MAC3B,aAAa,gBAAgB;AAAA,MAC7B,kBAAkB,gBAAgB;AAAA,MAClC,UAAU,gBAAgB;AAAA,IAC5B,CAAC,EACA,KAAK,eAAe,EACpB;AAAA,MACC;AAAA,MACA,GAAG,gBAAgB,gBAAgB,yBAAyB,EAAE;AAAA,IAChE,EACC,MAAM,KAAK,EACX,QAAQ,KAAK,gBAAgB,SAAS,CAAC,EACvC,MAAM,KAAK;AAEd,WAAO,KAAK,IAAI,CAAC,SAAS;AAAA,MACxB,IAAI,IAAI;AAAA,MACR,gBAAgB,IAAI;AAAA,MACpB,cAAc,IAAI;AAAA,MAClB,QAAQ,IAAI;AAAA,MACZ,WAAW,IAAI;AAAA,MACf,aAAa,IAAI;AAAA,MACjB,kBAAkB,IAAI;AAAA,MACtB,UAAU,IAAI;AAAA,IAChB,EAAE;AAAA,EACJ;AAAA,EAEA,MAAM,YAAY,OAAe,OAAwC;AACvE,UAAM,KAAK,GACR,OAAO,eAAe,EACtB,IAAI;AAAA,MACH,QAAQ,MAAM;AAAA,MACd,cAAc,MAAM;AAAA,MACpB,kBAAkB,MAAM;AAAA,MACxB,aAAa,MAAM,eAAe;AAAA,MAClC,YAAY,MAAM;AAAA,MAClB,OAAO,MAAM,SAAS;AAAA,MACtB,aAAa,oBAAI,KAAK;AAAA,IACxB,CAAC,EACA,MAAM,GAAG,gBAAgB,IAAI,KAAK,CAAC;AAAA,EACxC;AACF;AAxIa,gCAAN;AAAA,EADN,WAAW;AAAA,EAKP,0BAAO,OAAO;AAAA,EACd,4BAAS;AAAA,EAAG,0BAAO,wBAAwB;AAAA,GALnC;","names":[]}

package/dist/chunk-SZVPIHWE.js

@@ -0,0 +1,129 @@
+import {
+  AUTH_CONNECTION_GRANT_SINK,
+  AUTH_OPTIONS,
+  AUTH_USER_CONTEXT,
+  OAUTH_STATE_STORE,
+  STRATEGY_REGISTRY
+} from "./chunk-6XY6ZMMD.js";
+import {
+  __decorateClass,
+  __decorateParam
+} from "./chunk-2E224ZSN.js";
+
+// runtime/subsystems/auth/controllers/auth.controller.ts
+import {
+  Controller,
+  Get,
+  Inject,
+  Param,
+  Query,
+  Req,
+  Res,
+  HttpException,
+  HttpStatus
+} from "@nestjs/common";
+var AuthController = class {
+  constructor(registry, userContext, stateStore, grantSink, options) {
+    this.registry = registry;
+    this.userContext = userContext;
+    this.stateStore = stateStore;
+    this.grantSink = grantSink;
+    this.options = options;
+  }
+  registry;
+  userContext;
+  stateStore;
+  grantSink;
+  options;
+  async connect(slug, redirect, req, res) {
+    const strategy = this.requireStrategy(slug);
+    const userId = await this.userContext.getCurrentUserId(req);
+    const state = await this.stateStore.generate({ userId, redirect });
+    const url = strategy.buildAuthorizeUrl({
+      state,
+      redirectUri: this.redirectUriFor(slug)
+    });
+    return res.redirect(HttpStatus.FOUND, url);
+  }
+  async callback(slug, code, state, res) {
+    const strategy = this.requireStrategy(slug);
+    if (!code) {
+      throw new HttpException(
+        `Missing 'code' query param`,
+        HttpStatus.BAD_REQUEST
+      );
+    }
+    if (!state) {
+      throw new HttpException(
+        `Missing 'state' query param`,
+        HttpStatus.BAD_REQUEST
+      );
+    }
+    const { userId, redirect } = await this.stateStore.consume(state);
+    const tokens = await strategy.exchangeCodeForTokens({
+      code,
+      redirectUri: this.redirectUriFor(slug)
+    });
+    await this.grantSink.createOrUpdateFromOAuthGrant({
+      userId,
+      provider: slug,
+      accessToken: tokens.accessToken,
+      refreshToken: tokens.refreshToken,
+      expiresAt: tokens.expiresAt,
+      scope: tokens.scope,
+      externalAccountId: tokens.externalAccountId,
+      providerMetadata: tokens.providerMetadata
+    });
+    return res.redirect(
+      HttpStatus.FOUND,
+      redirect ?? `/settings/connections?connected=${encodeURIComponent(slug)}`
+    );
+  }
+  requireStrategy(slug) {
+    const strategy = this.registry.get(slug);
+    if (!strategy) {
+      throw new HttpException(
+        `Unknown provider '${slug}'`,
+        HttpStatus.NOT_FOUND
+      );
+    }
+    return strategy;
+  }
+  redirectUriFor(slug) {
+    const base = this.options.redirectUriBase;
+    if (!base) {
+      throw new Error(
+        `AuthModule.forRoot: redirectUriBase is required when AuthController is enabled`
+      );
+    }
+    const trimmed = base.replace(/\/+$/, "");
+    return `${trimmed}/auth/${encodeURIComponent(slug)}/callback`;
+  }
+};
+__decorateClass([
+  Get(":provider/connect"),
+  __decorateParam(0, Param("provider")),
+  __decorateParam(1, Query("redirect")),
+  __decorateParam(2, Req()),
+  __decorateParam(3, Res())
+], AuthController.prototype, "connect", 1);
+__decorateClass([
+  Get(":provider/callback"),
+  __decorateParam(0, Param("provider")),
+  __decorateParam(1, Query("code")),
+  __decorateParam(2, Query("state")),
+  __decorateParam(3, Res())
+], AuthController.prototype, "callback", 1);
+AuthController = __decorateClass([
+  Controller("auth"),
+  __decorateParam(0, Inject(STRATEGY_REGISTRY)),
+  __decorateParam(1, Inject(AUTH_USER_CONTEXT)),
+  __decorateParam(2, Inject(OAUTH_STATE_STORE)),
+  __decorateParam(3, Inject(AUTH_CONNECTION_GRANT_SINK)),
+  __decorateParam(4, Inject(AUTH_OPTIONS))
+], AuthController);
+
+export {
+  AuthController
+};
+//# sourceMappingURL=chunk-SZVPIHWE.js.map

package/dist/chunk-SZVPIHWE.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../runtime/subsystems/auth/controllers/auth.controller.ts"],"sourcesContent":["/**\n * AuthController — provider-agnostic OAuth2 connect/callback dance.\n *\n * Mounts two routes:\n *   - `GET /auth/:provider/connect?redirect=...` — generates state, builds\n *     the provider's authorize-url, 302-redirects the browser there.\n *   - `GET /auth/:provider/callback?code=...&state=...` — consumes state,\n *     exchanges the code for tokens, hands them to the grant sink, then\n *     302-redirects to the post-connect path.\n *\n * Hexagonal seams:\n *   - `STRATEGY_REGISTRY` (ReadonlyMap<slug, IProviderStrategy>) — dispatch.\n *     Concrete per-provider strategies live consumer-side and contribute\n *     entries via a `useFactory` in the consumer's app module.\n *   - `AUTH_USER_CONTEXT` (IUserContext) — resolves \"who is this request\"\n *     from the consumer's session/JWT/etc.\n *   - `OAUTH_STATE_STORE` (IOAuthStateStore) — CSRF state minting/consume.\n *   - `AUTH_CONNECTION_GRANT_SINK` (IConnectionGrantSink) — persists the\n *     freshly-minted grant. Adapter lives consumer-side (e.g. the\n *     auth-integrations starter from #285).\n *\n * The controller never imports `ConnectionsService` or any other concrete\n * consumer type — it goes through ports only.\n */\nimport {\n  Controller,\n  Get,\n  Inject,\n  Param,\n  Query,\n  Req,\n  Res,\n  HttpException,\n  HttpStatus,\n} from '@nestjs/common';\nimport {\n  AUTH_CONNECTION_GRANT_SINK,\n  AUTH_OPTIONS,\n  AUTH_USER_CONTEXT,\n  OAUTH_STATE_STORE,\n  STRATEGY_REGISTRY,\n} from '../auth.tokens';\nimport type { AuthModuleOptions } from '../auth.module';\nimport type { IOAuthStateStore } from '../protocols/oauth-state-store';\nimport type { IUserContext } from '../protocols/user-context';\nimport type {\n  IProviderStrategy,\n  ProviderStrategyRegistry,\n} from '../protocols/provider-strategy';\nimport type { IConnectionGrantSink } from '../protocols/connection-store';\n\n/**\n * Minimal response surface used by the controller — typed loosely so we\n * don't pull a hard dep on `express` or `fastify`. Both popular HTTP\n * adapters expose `redirect(status, url)`.\n */\ninterface RedirectingResponse {\n  redirect(statusCode: number, url: string): unknown;\n}\n\n@Controller('auth')\nexport class AuthController {\n  constructor(\n    @Inject(STRATEGY_REGISTRY)\n    private readonly registry: ProviderStrategyRegistry,\n    @Inject(AUTH_USER_CONTEXT)\n    private readonly userContext: IUserContext,\n    @Inject(OAUTH_STATE_STORE)\n    private readonly stateStore: IOAuthStateStore,\n    @Inject(AUTH_CONNECTION_GRANT_SINK)\n    private readonly grantSink: IConnectionGrantSink,\n    @Inject(AUTH_OPTIONS)\n    private readonly options: AuthModuleOptions,\n  ) {}\n\n  @Get(':provider/connect')\n  async connect(\n    @Param('provider') slug: string,\n    @Query('redirect') redirect: string | undefined,\n    @Req() req: unknown,\n    @Res() res: RedirectingResponse,\n  ): Promise<unknown> {\n    const strategy = this.requireStrategy(slug);\n    const userId = await this.userContext.getCurrentUserId(req);\n    const state = await this.stateStore.generate({ userId, redirect });\n    const url = strategy.buildAuthorizeUrl({\n      state,\n      redirectUri: this.redirectUriFor(slug),\n    });\n    return res.redirect(HttpStatus.FOUND, url);\n  }\n\n  @Get(':provider/callback')\n  async callback(\n    @Param('provider') slug: string,\n    @Query('code') code: string | undefined,\n    @Query('state') state: string | undefined,\n    @Res() res: RedirectingResponse,\n  ): Promise<unknown> {\n    const strategy = this.requireStrategy(slug);\n    if (!code) {\n      throw new HttpException(\n        `Missing 'code' query param`,\n        HttpStatus.BAD_REQUEST,\n      );\n    }\n    if (!state) {\n      throw new HttpException(\n        `Missing 'state' query param`,\n        HttpStatus.BAD_REQUEST,\n      );\n    }\n    const { userId, redirect } = await this.stateStore.consume(state);\n    const tokens = await strategy.exchangeCodeForTokens({\n      code,\n      redirectUri: this.redirectUriFor(slug),\n    });\n    await this.grantSink.createOrUpdateFromOAuthGrant({\n      userId,\n      provider: slug,\n      accessToken: tokens.accessToken,\n      refreshToken: tokens.refreshToken,\n      expiresAt: tokens.expiresAt,\n      scope: tokens.scope,\n      externalAccountId: tokens.externalAccountId,\n      providerMetadata: tokens.providerMetadata,\n    });\n    return res.redirect(\n      HttpStatus.FOUND,\n      redirect ?? `/settings/connections?connected=${encodeURIComponent(slug)}`,\n    );\n  }\n\n  private requireStrategy(slug: string): IProviderStrategy {\n    const strategy = this.registry.get(slug);\n    if (!strategy) {\n      throw new HttpException(\n        `Unknown provider '${slug}'`,\n        HttpStatus.NOT_FOUND,\n      );\n    }\n    return strategy;\n  }\n\n  private redirectUriFor(slug: string): string {\n    const base = this.options.redirectUriBase;\n    if (!base) {\n      throw new Error(\n        `AuthModule.forRoot: redirectUriBase is required when AuthController is enabled`,\n      );\n    }\n    const trimmed = base.replace(/\\/+$/, '');\n    return `${trimmed}/auth/${encodeURIComponent(slug)}/callback`;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AAwBA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AA2BA,IAAM,iBAAN,MAAqB;AAAA,EAC1B,YAEmB,UAEA,aAEA,YAEA,WAEA,SACjB;AATiB;AAEA;AAEA;AAEA;AAEA;AAAA,EAChB;AAAA,EATgB;AAAA,EAEA;AAAA,EAEA;AAAA,EAEA;AAAA,EAEA;AAAA,EAInB,MAAM,QACe,MACA,UACZ,KACA,KACW;AAClB,UAAM,WAAW,KAAK,gBAAgB,IAAI;AAC1C,UAAM,SAAS,MAAM,KAAK,YAAY,iBAAiB,GAAG;AAC1D,UAAM,QAAQ,MAAM,KAAK,WAAW,SAAS,EAAE,QAAQ,SAAS,CAAC;AACjE,UAAM,MAAM,SAAS,kBAAkB;AAAA,MACrC;AAAA,MACA,aAAa,KAAK,eAAe,IAAI;AAAA,IACvC,CAAC;AACD,WAAO,IAAI,SAAS,WAAW,OAAO,GAAG;AAAA,EAC3C;AAAA,EAGA,MAAM,SACe,MACJ,MACC,OACT,KACW;AAClB,UAAM,WAAW,KAAK,gBAAgB,IAAI;AAC1C,QAAI,CAAC,MAAM;AACT,YAAM,IAAI;AAAA,QACR;AAAA,QACA,WAAW;AAAA,MACb;AAAA,IACF;AACA,QAAI,CAAC,OAAO;AACV,YAAM,IAAI;AAAA,QACR;AAAA,QACA,WAAW;AAAA,MACb;AAAA,IACF;AACA,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,KAAK,WAAW,QAAQ,KAAK;AAChE,UAAM,SAAS,MAAM,SAAS,sBAAsB;AAAA,MAClD;AAAA,MACA,aAAa,KAAK,eAAe,IAAI;AAAA,IACvC,CAAC;AACD,UAAM,KAAK,UAAU,6BAA6B;AAAA,MAChD;AAAA,MACA,UAAU;AAAA,MACV,aAAa,OAAO;AAAA,MACpB,cAAc,OAAO;AAAA,MACrB,WAAW,OAAO;AAAA,MAClB,OAAO,OAAO;AAAA,MACd,mBAAmB,OAAO;AAAA,MAC1B,kBAAkB,OAAO;AAAA,IAC3B,CAAC;AACD,WAAO,IAAI;AAAA,MACT,WAAW;AAAA,MACX,YAAY,mCAAmC,mBAAmB,IAAI,CAAC;AAAA,IACzE;AAAA,EACF;AAAA,EAEQ,gBAAgB,MAAiC;AACvD,UAAM,WAAW,KAAK,SAAS,IAAI,IAAI;AACvC,QAAI,CAAC,UAAU;AACb,YAAM,IAAI;AAAA,QACR,qBAAqB,IAAI;AAAA,QACzB,WAAW;AAAA,MACb;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,eAAe,MAAsB;AAC3C,UAAM,OAAO,KAAK,QAAQ;AAC1B,QAAI,CAAC,MAAM;AACT,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,UAAU,KAAK,QAAQ,QAAQ,EAAE;AACvC,WAAO,GAAG,OAAO,SAAS,mBAAmB,IAAI,CAAC;AAAA,EACpD;AACF;AA9EQ;AAAA,EADL,IAAI,mBAAmB;AAAA,EAErB,yBAAM,UAAU;AAAA,EAChB,yBAAM,UAAU;AAAA,EAChB,uBAAI;AAAA,EACJ,uBAAI;AAAA,GAnBI,eAeL;AAiBA;AAAA,EADL,IAAI,oBAAoB;AAAA,EAEtB,yBAAM,UAAU;AAAA,EAChB,yBAAM,MAAM;AAAA,EACZ,yBAAM,OAAO;AAAA,EACb,uBAAI;AAAA,GApCI,eAgCL;AAhCK,iBAAN;AAAA,EADN,WAAW,MAAM;AAAA,EAGb,0BAAO,iBAAiB;AAAA,EAExB,0BAAO,iBAAiB;AAAA,EAExB,0BAAO,iBAAiB;AAAA,EAExB,0BAAO,0BAA0B;AAAA,EAEjC,0BAAO,YAAY;AAAA,GAVX;","names":[]}

package/dist/chunk-T4BIIU5E.js

@@ -0,0 +1,89 @@
+// runtime/subsystems/jobs/jobs-errors.ts
+var JobTypeNotFoundError = class extends Error {
+  constructor(jobType) {
+    super(`No job definition registered for type '${jobType}'.`);
+    this.jobType = jobType;
+  }
+  jobType;
+  name = "JobTypeNotFoundError";
+};
+var JobCollisionError = class extends Error {
+  constructor(jobType, concurrencyKey, incumbent) {
+    super(
+      `Job type '${jobType}' has an in-flight run with concurrency_key '${concurrencyKey}' (incumbent ${incumbent.id}); collision_mode=reject.`
+    );
+    this.jobType = jobType;
+    this.concurrencyKey = concurrencyKey;
+    this.incumbent = incumbent;
+  }
+  jobType;
+  concurrencyKey;
+  incumbent;
+  name = "JobCollisionError";
+};
+var JobNotReplayableError = class extends Error {
+  constructor(runId, currentStatus) {
+    super(
+      `Run ${runId} is not replayable from status '${currentStatus}'. Only 'completed', 'failed', 'timed_out', and 'canceled' are eligible.`
+    );
+    this.runId = runId;
+    this.currentStatus = currentStatus;
+  }
+  runId;
+  currentStatus;
+  name = "JobNotReplayableError";
+};
+var JobTemplateFieldMissingError = class extends Error {
+  constructor(template, field) {
+    super(
+      `Template '${template}' references input field '${field}' which is missing or undefined on the payload.`
+    );
+    this.template = template;
+    this.field = field;
+  }
+  template;
+  field;
+  name = "JobTemplateFieldMissingError";
+};
+var MissingTenantIdError = class extends Error {
+  constructor(method) {
+    super(
+      `MissingTenantIdError: JobsDomainModule was configured with multiTenant=true but ${method} was called without tenantId (undefined). Pass an explicit tenantId, or pass null for cross-tenant work.`
+    );
+    this.method = method;
+  }
+  method;
+  name = "MissingTenantIdError";
+};
+var BootValidationError = class extends Error {
+  constructor(missingHandlers) {
+    super(
+      `BootValidationError: ${missingHandlers.length} orphaned job type(s) in 'job' table with no matching @JobHandler in the running process: [${missingHandlers.join(", ")}]. Either register the handler(s) or remove the rows.`
+    );
+    this.missingHandlers = missingHandlers;
+  }
+  missingHandlers;
+  name = "BootValidationError";
+};
+var ReservedPoolViolationError = class extends Error {
+  constructor(offenders) {
+    super(
+      `ReservedPoolViolationError: ${offenders.length} @JobHandler(s) target reserved pools \u2014 reserved pools are framework-only:
+` + offenders.map((o) => `  - ${o.handlerClass} \u2192 pool='${o.pool}'`).join("\n")
+    );
+    this.offenders = offenders;
+  }
+  offenders;
+  name = "ReservedPoolViolationError";
+};
+
+export {
+  JobTypeNotFoundError,
+  JobCollisionError,
+  JobNotReplayableError,
+  JobTemplateFieldMissingError,
+  MissingTenantIdError,
+  BootValidationError,
+  ReservedPoolViolationError
+};
+//# sourceMappingURL=chunk-T4BIIU5E.js.map

package/dist/chunk-T4BIIU5E.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../runtime/subsystems/jobs/jobs-errors.ts"],"sourcesContent":["/**\n * Typed errors for the job orchestration domain (ADR-022, JOB-3).\n *\n * All thrown by the Drizzle orchestrator (and mirrored by the Memory\n * backend in JOB-4). They exist as classes so consumers can `instanceof`\n * them in catch blocks and exception filters can map them to HTTP codes.\n */\nimport type { JobRun } from './job-orchestrator.protocol';\n\n/**\n * `start(type, …)` was called for a job type that has no row in the `job`\n * table. At runtime this usually means the handler was not decorated or the\n * boot validator (JOB-5) has not registered it yet.\n */\nexport class JobTypeNotFoundError extends Error {\n  override readonly name = 'JobTypeNotFoundError';\n  constructor(public readonly jobType: string) {\n    super(`No job definition registered for type '${jobType}'.`);\n  }\n}\n\n/**\n * Thrown by `start` when `collision_mode === 'reject'` and a non-terminal\n * run with the same `concurrency_key` already exists. Carries the incumbent\n * so callers can surface its id or subscribe to its completion event.\n */\nexport class JobCollisionError extends Error {\n  override readonly name = 'JobCollisionError';\n  constructor(\n    public readonly jobType: string,\n    public readonly concurrencyKey: string,\n    public readonly incumbent: JobRun,\n  ) {\n    super(\n      `Job type '${jobType}' has an in-flight run with concurrency_key ` +\n        `'${concurrencyKey}' (incumbent ${incumbent.id}); collision_mode=reject.`,\n    );\n  }\n}\n\n/**\n * `replay` was called on a run that is not in a replayable terminal state\n * (i.e. still `pending` / `running` / `waiting`). Replay always spawns\n * fresh execution and therefore requires the source run to be settled.\n */\nexport class JobNotReplayableError extends Error {\n  override readonly name = 'JobNotReplayableError';\n  constructor(\n    public readonly runId: string,\n    public readonly currentStatus: string,\n  ) {\n    super(\n      `Run ${runId} is not replayable from status '${currentStatus}'. ` +\n        `Only 'completed', 'failed', 'timed_out', and 'canceled' are eligible.`,\n    );\n  }\n}\n\n/**\n * A `concurrency_key_template` or `dedupe_key_template` referenced a field\n * that is not present on the input payload. Caught at `start` time so the\n * caller sees the misconfiguration synchronously rather than at claim time.\n */\nexport class JobTemplateFieldMissingError extends Error {\n  override readonly name = 'JobTemplateFieldMissingError';\n  constructor(\n    public readonly template: string,\n    public readonly field: string,\n  ) {\n    super(\n      `Template '${template}' references input field '${field}' which is ` +\n        `missing or undefined on the payload.`,\n    );\n  }\n}\n\n/**\n * Thrown by the four multi-tenant-aware service-layer backends (JOB-8)\n * when `JobsDomainModule` was configured with `multiTenant: true` but the\n * caller did not pass a `tenantId` in the relevant options object.\n *\n * **Strict enforcement rationale (resolved 2026-04-18).** Cross-tenant data\n * leakage is the worst class of bug a multi-tenant system can ship; surfacing\n * the misuse loudly at the call site (rather than silently defaulting to\n * `null` or to the \"last tenant seen\") prevents both accidental global\n * writes and sneaky reads that return a union of tenants.\n *\n * - `undefined` `tenantId` → throw this error.\n * - Explicit `null` `tenantId` → passes; opts the call into cross-tenant\n *   background work (e.g. a nightly housekeeping job that must scan all\n *   tenants). The row is persisted with `tenant_id = NULL`.\n */\nexport class MissingTenantIdError extends Error {\n  override readonly name = 'MissingTenantIdError';\n  constructor(public readonly method: string) {\n    super(\n      `MissingTenantIdError: JobsDomainModule was configured with ` +\n        `multiTenant=true but ${method} was called without tenantId ` +\n        `(undefined). Pass an explicit tenantId, or pass null for ` +\n        `cross-tenant work.`,\n    );\n  }\n}\n\n/**\n * Thrown by `JobWorkerModule.onModuleInit` (Drizzle backend only) when the\n * `job` table contains type rows for which no `@JobHandler` is registered\n * in the running process. Surfaces every orphaned type at once so a single\n * boot tells the operator everything to clean up.\n *\n * Skipped entirely in memory mode (Q4 resolution 2026-04-19) — the memory\n * backend has no DB rows to validate; `MemoryJobOrchestrator.start()`\n * throws `JobTypeNotFoundError` synchronously for unknown types instead.\n */\nexport class BootValidationError extends Error {\n  override readonly name = 'BootValidationError';\n  constructor(public readonly missingHandlers: string[]) {\n    super(\n      `BootValidationError: ${missingHandlers.length} orphaned job type(s) ` +\n        `in 'job' table with no matching @JobHandler in the running process: ` +\n        `[${missingHandlers.join(', ')}]. Either register the handler(s) or ` +\n        `remove the rows.`,\n    );\n  }\n}\n\n/**\n * Thrown by `JobWorkerModule.onModuleInit` when one or more `@JobHandler`\n * classes target a `reserved: true` pool from the resolved pool config\n * (the three `events_*` pools are reserved for the events subsystem\n * outbox drain). Listing every offender on a single boot avoids the\n * fix-one-restart-fix-next loop.\n */\nexport class ReservedPoolViolationError extends Error {\n  override readonly name = 'ReservedPoolViolationError';\n  constructor(\n    public readonly offenders: ReadonlyArray<{\n      handlerClass: string;\n      pool: string;\n    }>,\n  ) {\n    super(\n      `ReservedPoolViolationError: ${offenders.length} @JobHandler(s) target ` +\n        `reserved pools — reserved pools are framework-only:\\n` +\n        offenders\n          .map((o) => `  - ${o.handlerClass} → pool='${o.pool}'`)\n          .join('\\n'),\n    );\n  }\n}\n"],"mappings":";AAcO,IAAM,uBAAN,cAAmC,MAAM;AAAA,EAE9C,YAA4B,SAAiB;AAC3C,UAAM,0CAA0C,OAAO,IAAI;AADjC;AAAA,EAE5B;AAAA,EAF4B;AAAA,EADV,OAAO;AAI3B;AAOO,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAE3C,YACkB,SACA,gBACA,WAChB;AACA;AAAA,MACE,aAAa,OAAO,gDACd,cAAc,gBAAgB,UAAU,EAAE;AAAA,IAClD;AAPgB;AACA;AACA;AAAA,EAMlB;AAAA,EARkB;AAAA,EACA;AAAA,EACA;AAAA,EAJA,OAAO;AAW3B;AAOO,IAAM,wBAAN,cAAoC,MAAM;AAAA,EAE/C,YACkB,OACA,eAChB;AACA;AAAA,MACE,OAAO,KAAK,mCAAmC,aAAa;AAAA,IAE9D;AANgB;AACA;AAAA,EAMlB;AAAA,EAPkB;AAAA,EACA;AAAA,EAHA,OAAO;AAU3B;AAOO,IAAM,+BAAN,cAA2C,MAAM;AAAA,EAEtD,YACkB,UACA,OAChB;AACA;AAAA,MACE,aAAa,QAAQ,6BAA6B,KAAK;AAAA,IAEzD;AANgB;AACA;AAAA,EAMlB;AAAA,EAPkB;AAAA,EACA;AAAA,EAHA,OAAO;AAU3B;AAkBO,IAAM,uBAAN,cAAmC,MAAM;AAAA,EAE9C,YAA4B,QAAgB;AAC1C;AAAA,MACE,mFAC0B,MAAM;AAAA,IAGlC;AAN0B;AAAA,EAO5B;AAAA,EAP4B;AAAA,EADV,OAAO;AAS3B;AAYO,IAAM,sBAAN,cAAkC,MAAM;AAAA,EAE7C,YAA4B,iBAA2B;AACrD;AAAA,MACE,wBAAwB,gBAAgB,MAAM,8FAExC,gBAAgB,KAAK,IAAI,CAAC;AAAA,IAElC;AAN0B;AAAA,EAO5B;AAAA,EAP4B;AAAA,EADV,OAAO;AAS3B;AASO,IAAM,6BAAN,cAAyC,MAAM;AAAA,EAEpD,YACkB,WAIhB;AACA;AAAA,MACE,+BAA+B,UAAU,MAAM;AAAA,IAE7C,UACG,IAAI,CAAC,MAAM,OAAO,EAAE,YAAY,iBAAY,EAAE,IAAI,GAAG,EACrD,KAAK,IAAI;AAAA,IAChB;AAXgB;AAAA,EAYlB;AAAA,EAZkB;AAAA,EAFA,OAAO;AAe3B;","names":[]}

package/dist/chunk-T6SCOJF4.js

@@ -0,0 +1,92 @@
+import {
+  EnvEncryptionKey
+} from "./chunk-IP4OO26U.js";
+import {
+  AuthController
+} from "./chunk-SZVPIHWE.js";
+import {
+  DrizzleOAuthStateStore
+} from "./chunk-N5OTOWTP.js";
+import {
+  MemoryOAuthStateStore
+} from "./chunk-QLTJSCE6.js";
+import {
+  AUTH_OPTIONS,
+  ENCRYPTION_KEY,
+  OAUTH_STATE_STORE
+} from "./chunk-6XY6ZMMD.js";
+import {
+  DRIZZLE
+} from "./chunk-U64T4YZE.js";
+import {
+  __decorateClass
+} from "./chunk-2E224ZSN.js";
+
+// runtime/subsystems/auth/auth.module.ts
+import { Module } from "@nestjs/common";
+function resolveEncryptionKeyProvider(choice) {
+  if (choice === "env") {
+    return { provide: ENCRYPTION_KEY, useClass: EnvEncryptionKey };
+  }
+  return { provide: ENCRYPTION_KEY, ...choice };
+}
+function resolveOAuthStateStoreProvider(choice) {
+  if (choice === "memory") {
+    return { provide: OAUTH_STATE_STORE, useClass: MemoryOAuthStateStore };
+  }
+  if (choice === "drizzle") {
+    return {
+      provide: OAUTH_STATE_STORE,
+      useFactory: (db) => {
+        if (!db) {
+          throw new Error(
+            "AuthModule.forRoot: oauthStateStore: 'drizzle' selected but DRIZZLE provider is not available. Ensure DatabaseModule (or another provider exposing DRIZZLE) is imported before AuthModule.forRoot."
+          );
+        }
+        return new DrizzleOAuthStateStore(db);
+      },
+      inject: [{ token: DRIZZLE, optional: true }]
+    };
+  }
+  return { provide: OAUTH_STATE_STORE, ...choice };
+}
+var AuthModule = class {
+  static forRoot(options = {}) {
+    const resolved = {
+      encryptionKey: options.encryptionKey ?? "env",
+      oauthStateStore: options.oauthStateStore ?? "memory",
+      enableController: options.enableController ?? false,
+      redirectUriBase: options.redirectUriBase
+    };
+    if (resolved.enableController && !resolved.redirectUriBase) {
+      throw new Error(
+        "AuthModule.forRoot: redirectUriBase is required when enableController: true"
+      );
+    }
+    const encryptionKeyProvider = resolveEncryptionKeyProvider(
+      resolved.encryptionKey
+    );
+    const oauthStateStoreProvider = resolveOAuthStateStoreProvider(
+      resolved.oauthStateStore
+    );
+    const optionsProvider = {
+      provide: AUTH_OPTIONS,
+      useValue: resolved
+    };
+    return {
+      module: AuthModule,
+      global: true,
+      providers: [encryptionKeyProvider, oauthStateStoreProvider, optionsProvider],
+      controllers: resolved.enableController ? [AuthController] : [],
+      exports: [ENCRYPTION_KEY, OAUTH_STATE_STORE, AUTH_OPTIONS]
+    };
+  }
+};
+AuthModule = __decorateClass([
+  Module({})
+], AuthModule);
+
+export {
+  AuthModule
+};
+//# sourceMappingURL=chunk-T6SCOJF4.js.map

package/dist/chunk-T6SCOJF4.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../runtime/subsystems/auth/auth.module.ts"],"sourcesContent":["/**\n * AuthModule — DynamicModule factory for the auth subsystem.\n *\n * Wires the pluggable backends the subsystem ships with:\n *   - `ENCRYPTION_KEY`      → `EnvEncryptionKey` (AES-256-GCM from env)\n *   - `OAUTH_STATE_STORE`   → `MemoryOAuthStateStore` (dev/tests) or\n *                             `DrizzleOAuthStateStore` (prod, requires\n *                             DRIZZLE provider).\n *   - `AUTH_OPTIONS`        → resolved options bag (used by AuthController\n *                             for `redirectUriBase`).\n *\n * The connection-store ports (`AUTH_CONNECTION_READER`,\n * `AUTH_CONNECTION_TOKEN_WRITER`, `AUTH_CONNECTION_GRANT_SINK`),\n * `AUTH_USER_CONTEXT`, and `STRATEGY_REGISTRY` are deliberately **not**\n * wired here — they are always consumer-specific:\n *   - connection-store ports adapt the consumer's `connections` storage;\n *   - `IUserContext` adapts the app's session/JWT scheme;\n *   - `STRATEGY_REGISTRY` is populated from the per-provider strategy\n *     classes the consumer maintains.\n *\n * Consumers provide them in their app module (or by importing the\n * `auth-integrations` starter, which binds the three connection-store\n * ports off a single canonical entity).\n *\n * Usage in AppModule:\n * ```typescript\n * AuthModule.forRoot({\n *   encryptionKey: 'env',\n *   oauthStateStore: 'memory',          // or 'drizzle'\n *   enableController: true,\n *   redirectUriBase: 'http://localhost:3000',\n * });\n * ```\n *\n * `global: true` means other modules don't need to re-import AuthModule to\n * inject the auth tokens.\n */\nimport { Module, type DynamicModule, type Provider } from '@nestjs/common';\nimport {\n  AUTH_OPTIONS,\n  ENCRYPTION_KEY,\n  OAUTH_STATE_STORE,\n} from './auth.tokens';\nimport { EnvEncryptionKey } from './backends/encryption-key/env';\nimport { MemoryOAuthStateStore } from './backends/state-store.memory-backend';\nimport { DrizzleOAuthStateStore } from './backends/state-store.drizzle-backend';\nimport { AuthController } from './controllers/auth.controller';\nimport { DRIZZLE } from '../../constants/tokens';\nimport type { DrizzleClient } from '../../types/drizzle';\n\ntype EncryptionKeyChoice =\n  | 'env'\n  | Omit<Provider, 'provide'>;\n\ntype OAuthStateStoreChoice =\n  | 'memory'\n  | 'drizzle'\n  | Omit<Provider, 'provide'>;\n\nexport interface AuthModuleOptions {\n  /** `'env'` (default) or a full provider definition (e.g. `{ useClass: MyKmsEncryptionKey }`). */\n  encryptionKey?: EncryptionKeyChoice;\n  /**\n   * `'memory'` (default — tests/dev) or `'drizzle'` (prod, requires DRIZZLE\n   * provider) or a full provider definition for a custom impl.\n   */\n  oauthStateStore?: OAuthStateStoreChoice;\n  /**\n   * Mount `AuthController` (`/auth/:provider/connect` + `/callback`).\n   * Default `false` — apps that hand-roll connect/callback (rare) or that\n   * use the subsystem only for the refresh path can opt out.\n   */\n  enableController?: boolean;\n  /**\n   * Public base URL of the API server. Used to construct per-provider\n   * callback URIs as `${redirectUriBase}/auth/:provider/callback`.\n   * Required when `enableController: true`.\n   */\n  redirectUriBase?: string;\n}\n\nfunction resolveEncryptionKeyProvider(choice: EncryptionKeyChoice): Provider {\n  if (choice === 'env') {\n    return { provide: ENCRYPTION_KEY, useClass: EnvEncryptionKey };\n  }\n  return { provide: ENCRYPTION_KEY, ...choice } as Provider;\n}\n\nfunction resolveOAuthStateStoreProvider(\n  choice: OAuthStateStoreChoice,\n): Provider {\n  if (choice === 'memory') {\n    return { provide: OAUTH_STATE_STORE, useClass: MemoryOAuthStateStore };\n  }\n  if (choice === 'drizzle') {\n    return {\n      provide: OAUTH_STATE_STORE,\n      useFactory: (db: DrizzleClient | null) => {\n        if (!db) {\n          throw new Error(\n            \"AuthModule.forRoot: oauthStateStore: 'drizzle' selected but DRIZZLE provider is not available. \" +\n              'Ensure DatabaseModule (or another provider exposing DRIZZLE) is imported before AuthModule.forRoot.',\n          );\n        }\n        return new DrizzleOAuthStateStore(db);\n      },\n      inject: [{ token: DRIZZLE, optional: true }],\n    };\n  }\n  return { provide: OAUTH_STATE_STORE, ...choice } as Provider;\n}\n\n@Module({})\nexport class AuthModule {\n  static forRoot(options: AuthModuleOptions = {}): DynamicModule {\n    const resolved: AuthModuleOptions = {\n      encryptionKey: options.encryptionKey ?? 'env',\n      oauthStateStore: options.oauthStateStore ?? 'memory',\n      enableController: options.enableController ?? false,\n      redirectUriBase: options.redirectUriBase,\n    };\n\n    if (resolved.enableController && !resolved.redirectUriBase) {\n      throw new Error(\n        'AuthModule.forRoot: redirectUriBase is required when enableController: true',\n      );\n    }\n\n    const encryptionKeyProvider = resolveEncryptionKeyProvider(\n      resolved.encryptionKey!,\n    );\n    const oauthStateStoreProvider = resolveOAuthStateStoreProvider(\n      resolved.oauthStateStore!,\n    );\n    const optionsProvider: Provider = {\n      provide: AUTH_OPTIONS,\n      useValue: resolved,\n    };\n\n    return {\n      module: AuthModule,\n      global: true,\n      providers: [encryptionKeyProvider, oauthStateStoreProvider, optionsProvider],\n      controllers: resolved.enableController ? [AuthController] : [],\n      exports: [ENCRYPTION_KEY, OAUTH_STATE_STORE, AUTH_OPTIONS],\n    };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,SAAS,cAAiD;AA4C1D,SAAS,6BAA6B,QAAuC;AAC3E,MAAI,WAAW,OAAO;AACpB,WAAO,EAAE,SAAS,gBAAgB,UAAU,iBAAiB;AAAA,EAC/D;AACA,SAAO,EAAE,SAAS,gBAAgB,GAAG,OAAO;AAC9C;AAEA,SAAS,+BACP,QACU;AACV,MAAI,WAAW,UAAU;AACvB,WAAO,EAAE,SAAS,mBAAmB,UAAU,sBAAsB;AAAA,EACvE;AACA,MAAI,WAAW,WAAW;AACxB,WAAO;AAAA,MACL,SAAS;AAAA,MACT,YAAY,CAAC,OAA6B;AACxC,YAAI,CAAC,IAAI;AACP,gBAAM,IAAI;AAAA,YACR;AAAA,UAEF;AAAA,QACF;AACA,eAAO,IAAI,uBAAuB,EAAE;AAAA,MACtC;AAAA,MACA,QAAQ,CAAC,EAAE,OAAO,SAAS,UAAU,KAAK,CAAC;AAAA,IAC7C;AAAA,EACF;AACA,SAAO,EAAE,SAAS,mBAAmB,GAAG,OAAO;AACjD;AAGO,IAAM,aAAN,MAAiB;AAAA,EACtB,OAAO,QAAQ,UAA6B,CAAC,GAAkB;AAC7D,UAAM,WAA8B;AAAA,MAClC,eAAe,QAAQ,iBAAiB;AAAA,MACxC,iBAAiB,QAAQ,mBAAmB;AAAA,MAC5C,kBAAkB,QAAQ,oBAAoB;AAAA,MAC9C,iBAAiB,QAAQ;AAAA,IAC3B;AAEA,QAAI,SAAS,oBAAoB,CAAC,SAAS,iBAAiB;AAC1D,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,wBAAwB;AAAA,MAC5B,SAAS;AAAA,IACX;AACA,UAAM,0BAA0B;AAAA,MAC9B,SAAS;AAAA,IACX;AACA,UAAM,kBAA4B;AAAA,MAChC,SAAS;AAAA,MACT,UAAU;AAAA,IACZ;AAEA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,WAAW,CAAC,uBAAuB,yBAAyB,eAAe;AAAA,MAC3E,aAAa,SAAS,mBAAmB,CAAC,cAAc,IAAI,CAAC;AAAA,MAC7D,SAAS,CAAC,gBAAgB,mBAAmB,YAAY;AAAA,IAC3D;AAAA,EACF;AACF;AAlCa,aAAN;AAAA,EADN,OAAO,CAAC,CAAC;AAAA,GACG;","names":[]}

package/dist/chunk-TNXH7BJS.js

@@ -0,0 +1,48 @@
+import {
+  BridgeMetricsReporter
+} from "./chunk-AQFQ4BYM.js";
+import {
+  ObservabilityService
+} from "./chunk-YPWODKD5.js";
+import {
+  OBSERVABILITY,
+  OBSERVABILITY_MODULE_OPTIONS
+} from "./chunk-Y7RRSEOC.js";
+import {
+  __decorateClass
+} from "./chunk-2E224ZSN.js";
+
+// runtime/subsystems/observability/observability.module.ts
+import { Module } from "@nestjs/common";
+var ObservabilityModule = class {
+  static forRoot(options = {}) {
+    const providers = [
+      // Expose the resolved options so internal reporters can read their
+      // own config via `OBSERVABILITY_MODULE_OPTIONS`.
+      { provide: OBSERVABILITY_MODULE_OPTIONS, useValue: options },
+      // Register the concrete class as the canonical instance.
+      ObservabilityService,
+      // OBSERVABILITY token points at the same instance — consumers inject
+      // the token, not the class, per ADR-025 §Shape (index.ts does NOT
+      // export `ObservabilityService`).
+      { provide: OBSERVABILITY, useExisting: ObservabilityService }
+    ];
+    if (options.reporters?.bridgeMetrics?.enabled === true) {
+      providers.push(BridgeMetricsReporter);
+    }
+    return {
+      module: ObservabilityModule,
+      global: true,
+      providers,
+      exports: [OBSERVABILITY, OBSERVABILITY_MODULE_OPTIONS]
+    };
+  }
+};
+ObservabilityModule = __decorateClass([
+  Module({})
+], ObservabilityModule);
+
+export {
+  ObservabilityModule
+};
+//# sourceMappingURL=chunk-TNXH7BJS.js.map

package/dist/chunk-TNXH7BJS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../runtime/subsystems/observability/observability.module.ts"],"sourcesContent":["/**\n * ObservabilityModule — combiner subsystem (ADR-025, OBS-5, OBS-6).\n *\n * Composes the jobs, bridge, and integration read ports into a single\n * `IObservability` facade. Owned by no sibling subsystem; it consumes\n * their tokens via DI, which the consumer app wires by registering the\n * sibling modules in the right order (like BridgeModule — the named\n * precedent in ADR-025).\n *\n * Consumer wiring (register AFTER the composed sibling modules):\n * ```ts\n * @Module({\n *   imports: [\n *     EventsModule.forRoot({ backend: 'drizzle' }),\n *     JobsDomainModule.forRoot({ backend: 'drizzle' }),\n *     BridgeModule.forRoot({ backend: 'drizzle' }),\n *     IntegrationModule.forRoot({ backend: 'drizzle' }),\n *     ObservabilityModule.forRoot({\n *       reporters: {\n *         bridgeMetrics: {\n *           enabled: true,\n *           intervalMs: 60_000,\n *           windowHours: 1,\n *         },\n *       },\n *     }),\n *   ],\n * })\n * class AppModule {}\n * ```\n *\n * # No `backend` option — intentional\n *\n * Unlike ADR-008 infrastructure subsystems (events / jobs / cache /\n * storage), observability is a combiner per ADR-025 and owns no durable\n * state. The \"backend\" is whichever backends the composed subsystems are\n * running — portability is inherited, not declared. See ADR-025 §4 (when\n * to pick combiner vs. infrastructure) and\n * `.claude/skills/observability/SKILL.md` §1.\n *\n * # Graceful sibling absence\n *\n * The consumed sibling tokens are `@Optional()` inside\n * `ObservabilityService`. An app that only installed a subset of the\n * composed subsystems can still register `ObservabilityModule`; the\n * methods whose sibling is missing return empty shapes.\n *\n * # Reporters (OBS-6)\n *\n * Internal consumers of the `OBSERVABILITY` facade — auto-registered\n * when the matching `reporters.*` key is present and enabled. Reporters\n * are NOT added to `exports`; they are a module-internal concern.\n * Consumers configure them via options; they never import the reporter\n * classes directly.\n */\nimport { Module, type DynamicModule, type Provider } from '@nestjs/common';\n\nimport {\n  OBSERVABILITY,\n  OBSERVABILITY_MODULE_OPTIONS,\n} from './observability.tokens';\nimport { ObservabilityService } from './observability.service';\nimport { BridgeMetricsReporter } from './reporters/bridge-metrics.reporter';\n\n/**\n * Config for the bridge-delivery sampler (OBS-6). All fields are required\n * when `enabled: true` — the config is declarative and explicit; there\n * are no hidden defaults. Lives on the module (not the reporter file) so\n * the module's options type stays the single authoritative schema for\n * everything `forRoot` accepts.\n */\nexport interface BridgeMetricsReporterConfig {\n  /** Master switch. Reporter is only registered as a provider when this\n   *  is `true` (see `forRoot`). */\n  enabled: boolean;\n  /** Sampling period in ms. Must be `> 0` when `enabled: true`. */\n  intervalMs: number;\n  /** Trailing window (hours) passed to `getBridgeDeliveryHistogram`.\n   *  Must be `> 0` when `enabled: true`. */\n  windowHours: number;\n  /** Forwarded verbatim to `IObservability.getBridgeDeliveryHistogram`.\n   *   - `undefined` — sibling default semantics\n   *   - `null`      — explicit cross-tenant match\n   *   - `string`    — filter to that single tenant */\n  tenantId?: string | null;\n}\n\n/**\n * Named-map of reporter configs. Named, not array, so consumers can toggle\n * individual reporters by key without juggling order and so future reporters\n * can be added without breaking existing configs.\n */\nexport interface ObservabilityReportersOptions {\n  bridgeMetrics?: BridgeMetricsReporterConfig;\n}\n\n/**\n * Options for `ObservabilityModule.forRoot()`. Currently only `reporters`;\n * room to grow (sampling, exporters) without changing the module signature.\n */\nexport interface ObservabilityModuleOptions {\n  reporters?: ObservabilityReportersOptions;\n}\n\n@Module({})\nexport class ObservabilityModule {\n  static forRoot(options: ObservabilityModuleOptions = {}): DynamicModule {\n    const providers: Provider[] = [\n      // Expose the resolved options so internal reporters can read their\n      // own config via `OBSERVABILITY_MODULE_OPTIONS`.\n      { provide: OBSERVABILITY_MODULE_OPTIONS, useValue: options },\n      // Register the concrete class as the canonical instance.\n      ObservabilityService,\n      // OBSERVABILITY token points at the same instance — consumers inject\n      // the token, not the class, per ADR-025 §Shape (index.ts does NOT\n      // export `ObservabilityService`).\n      { provide: OBSERVABILITY, useExisting: ObservabilityService },\n    ];\n\n    // Reporters: auto-registered when enabled, not added to `exports`.\n    // They are internal consumers of OBSERVABILITY; consumers configure\n    // them via options rather than importing the classes.\n    if (options.reporters?.bridgeMetrics?.enabled === true) {\n      providers.push(BridgeMetricsReporter);\n    }\n\n    return {\n      module: ObservabilityModule,\n      global: true,\n      providers,\n      exports: [OBSERVABILITY, OBSERVABILITY_MODULE_OPTIONS],\n    };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAuDA,SAAS,cAAiD;AAkDnD,IAAM,sBAAN,MAA0B;AAAA,EAC/B,OAAO,QAAQ,UAAsC,CAAC,GAAkB;AACtE,UAAM,YAAwB;AAAA;AAAA;AAAA,MAG5B,EAAE,SAAS,8BAA8B,UAAU,QAAQ;AAAA;AAAA,MAE3D;AAAA;AAAA;AAAA;AAAA,MAIA,EAAE,SAAS,eAAe,aAAa,qBAAqB;AAAA,IAC9D;AAKA,QAAI,QAAQ,WAAW,eAAe,YAAY,MAAM;AACtD,gBAAU,KAAK,qBAAqB;AAAA,IACtC;AAEA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,MACA,SAAS,CAAC,eAAe,4BAA4B;AAAA,IACvD;AAAA,EACF;AACF;AA5Ba,sBAAN;AAAA,EADN,OAAO,CAAC,CAAC;AAAA,GACG;","names":[]}

package/dist/chunk-U64T4YZE.js

@@ -0,0 +1,9 @@
+// runtime/constants/tokens.ts
+var DRIZZLE = "DRIZZLE";
+var EVENT_BUS = "EVENT_BUS";
+
+export {
+  DRIZZLE,
+  EVENT_BUS
+};
+//# sourceMappingURL=chunk-U64T4YZE.js.map

package/dist/chunk-U64T4YZE.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../runtime/constants/tokens.ts"],"sourcesContent":["/**\n * NestJS injection tokens\n *\n * Used with @Inject() decorator in concrete repository constructors.\n */\n\n/**\n * Injection token for the Drizzle ORM database client.\n *\n * Usage in concrete repositories:\n * ```typescript\n * constructor(@Inject(DRIZZLE) db: DrizzleClient) { super(db); }\n * ```\n */\nexport const DRIZZLE = 'DRIZZLE' as const;\n\n/**\n * Injection token for the event bus (IEventBus).\n *\n * Optional — only resolved when EventsModule.forRoot() is registered.\n * BaseService uses this with @Optional() to emit lifecycle events\n * without requiring the events subsystem to be installed.\n *\n * Usage in services/use cases:\n * ```typescript\n * @Optional() @Inject(EVENT_BUS) eventBus?: IEventBus\n * ```\n */\nexport const EVENT_BUS = 'EVENT_BUS' as const;\n"],"mappings":";AAcO,IAAM,UAAU;AAchB,IAAM,YAAY;","names":[]}

package/dist/chunk-UQ5EHOH2.js

@@ -0,0 +1,39 @@
+// runtime/subsystems/events/event-keyset-cursor.ts
+var DEFAULT_EVENT_LIST_LIMIT = 50;
+var MAX_EVENT_LIST_LIMIT = 200;
+function clampEventLimit(limit) {
+  if (typeof limit !== "number" || !Number.isFinite(limit)) {
+    return DEFAULT_EVENT_LIST_LIMIT;
+  }
+  const floored = Math.floor(limit);
+  if (floored < 1) return 1;
+  if (floored > MAX_EVENT_LIST_LIMIT) return MAX_EVENT_LIST_LIMIT;
+  return floored;
+}
+function encodeEventCursor(keyset) {
+  const tuple = [keyset.occurredAt.toISOString(), keyset.id];
+  return Buffer.from(JSON.stringify(tuple), "utf8").toString("base64url");
+}
+function decodeEventCursor(cursor) {
+  try {
+    const json = Buffer.from(cursor, "base64url").toString("utf8");
+    const parsed = JSON.parse(json);
+    if (!Array.isArray(parsed) || parsed.length !== 2) return null;
+    const [iso, id] = parsed;
+    if (typeof iso !== "string" || typeof id !== "string") return null;
+    const occurredAt = new Date(iso);
+    if (Number.isNaN(occurredAt.getTime())) return null;
+    return { occurredAt, id };
+  } catch {
+    return null;
+  }
+}
+
+export {
+  DEFAULT_EVENT_LIST_LIMIT,
+  MAX_EVENT_LIST_LIMIT,
+  clampEventLimit,
+  encodeEventCursor,
+  decodeEventCursor
+};
+//# sourceMappingURL=chunk-UQ5EHOH2.js.map

package/dist/chunk-UQ5EHOH2.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../runtime/subsystems/events/event-keyset-cursor.ts"],"sourcesContent":["/**\n * Keyset (seek) cursor codec for `IEventReadPort.listEvents` (OBS-LIST-1).\n *\n * The list is ordered `occurred_at DESC, id DESC`. The cursor encodes the\n * `(occurredAt, id)` of the last row on the previous page so the next page\n * seeks with `WHERE (occurred_at, id) < (cursorOccurredAt, cursorId)`.\n *\n * The cursor is opaque to consumers: a base64url-encoded JSON tuple. Shape\n * is an implementation detail — never parse it outside this module.\n *\n * Mirrors the jobs keyset codec; kept separate because the events subsystem\n * must not depend on `runtime/subsystems/jobs/`.\n */\n\nexport interface EventKeyset {\n  occurredAt: Date;\n  id: string;\n}\n\n/** Default page size when `limit` is omitted. */\nexport const DEFAULT_EVENT_LIST_LIMIT = 50;\n/** Hard upper bound on page size. */\nexport const MAX_EVENT_LIST_LIMIT = 200;\n\n/** Clamp a caller-supplied `limit` into `[1, MAX_EVENT_LIST_LIMIT]`. */\nexport function clampEventLimit(limit: number | undefined): number {\n  if (typeof limit !== 'number' || !Number.isFinite(limit)) {\n    return DEFAULT_EVENT_LIST_LIMIT;\n  }\n  const floored = Math.floor(limit);\n  if (floored < 1) return 1;\n  if (floored > MAX_EVENT_LIST_LIMIT) return MAX_EVENT_LIST_LIMIT;\n  return floored;\n}\n\nexport function encodeEventCursor(keyset: EventKeyset): string {\n  const tuple = [keyset.occurredAt.toISOString(), keyset.id];\n  return Buffer.from(JSON.stringify(tuple), 'utf8').toString('base64url');\n}\n\n/**\n * Decode an opaque cursor back into its `(occurredAt, id)` keyset. Returns\n * `null` for malformed input so user-supplied garbage is treated as \"start\n * from the beginning\" rather than throwing.\n */\nexport function decodeEventCursor(cursor: string): EventKeyset | null {\n  try {\n    const json = Buffer.from(cursor, 'base64url').toString('utf8');\n    const parsed = JSON.parse(json) as unknown;\n    if (!Array.isArray(parsed) || parsed.length !== 2) return null;\n    const [iso, id] = parsed;\n    if (typeof iso !== 'string' || typeof id !== 'string') return null;\n    const occurredAt = new Date(iso);\n    if (Number.isNaN(occurredAt.getTime())) return null;\n    return { occurredAt, id };\n  } catch {\n    return null;\n  }\n}\n"],"mappings":";AAoBO,IAAM,2BAA2B;AAEjC,IAAM,uBAAuB;AAG7B,SAAS,gBAAgB,OAAmC;AACjE,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,SAAS,KAAK,GAAG;AACxD,WAAO;AAAA,EACT;AACA,QAAM,UAAU,KAAK,MAAM,KAAK;AAChC,MAAI,UAAU,EAAG,QAAO;AACxB,MAAI,UAAU,qBAAsB,QAAO;AAC3C,SAAO;AACT;AAEO,SAAS,kBAAkB,QAA6B;AAC7D,QAAM,QAAQ,CAAC,OAAO,WAAW,YAAY,GAAG,OAAO,EAAE;AACzD,SAAO,OAAO,KAAK,KAAK,UAAU,KAAK,GAAG,MAAM,EAAE,SAAS,WAAW;AACxE;AAOO,SAAS,kBAAkB,QAAoC;AACpE,MAAI;AACF,UAAM,OAAO,OAAO,KAAK,QAAQ,WAAW,EAAE,SAAS,MAAM;AAC7D,UAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,QAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,EAAG,QAAO;AAC1D,UAAM,CAAC,KAAK,EAAE,IAAI;AAClB,QAAI,OAAO,QAAQ,YAAY,OAAO,OAAO,SAAU,QAAO;AAC9D,UAAM,aAAa,IAAI,KAAK,GAAG;AAC/B,QAAI,OAAO,MAAM,WAAW,QAAQ,CAAC,EAAG,QAAO;AAC/C,WAAO,EAAE,YAAY,GAAG;AAAA,EAC1B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/chunk-UTN4GBPQ.js

@@ -0,0 +1 @@
+//# sourceMappingURL=chunk-UTN4GBPQ.js.map

package/dist/chunk-UTN4GBPQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}