@pattern-stack/codegen 0.15.2 → 0.15.3

package/CHANGELOG.md

@@ -4,6 +4,38 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+## [0.15.3] — 2026-06-03
+
+Package-mode **inbound webhook drain** — the first real exercise of
+`WebhookChangeSource` by a `runtime: package` consumer (swe-brain's Slack
+inbound pipeline-parity drain, ADR-0009 §6). One latent transposition this path
+exercises; the fix is framework-only.
+
+### Fixed
+
+- **`WebhookChangeSource` (and the identically-shaped `PollChangeSource`) now
+  derive `Change<T>.externalId` from the mapping `source`, not `target`.** Both
+  primitives located the `DetectionConfig` mapping entry with `target ===
+  'external_id'` correctly, then read the emitted record off
+  `mapping.target` — a transposition. Mapping semantics are `{ source: <field on
+  the emitted record>, target: <canonical column> }`, and `fetch()` reads
+  `record[externalIdSourceField]` off the emitted record, so it must use
+  `.source`. The two diverge only when the canonical record is vendor-neutral
+  camelCase (`source: 'externalId'` → `target: 'external_id'`): such a consumer
+  hit `record missing string 'external_id'` and the primitive was unusable. The
+  original unit fixtures masked it by keying records `external_id` (== the
+  target). Regression tests now cover the camelCase consumer shape directly.
+
+### Added
+
+- **Webhook/poll/detection symbols re-exported from
+  `@pattern-stack/codegen/subsystems`.** `WebhookChangeSource`,
+  `WebhookChangeSourceOptions`, `WebhookFetchCallback`, `WebhookFetchContext`,
+  `WebhookCursor`, `buildChangeSource`, `DetectionConfigSchema`,
+  `DetectionConfig` (+ poll equivalents) were previously reachable only via the
+  deep `.../integration/index` path; they now ride the public barrel alongside
+  the curated `IncrementalReadBase` / `ExecuteIntegrationUseCase` forwards.
+
 ## [0.15.2] — 2026-06-03
 
 Package-mode **bridge *delivery*** — the first time a `runtime: package` consumer

package/dist/{chunk-COGHTKXY.js → chunk-27ETSJ2X.js}

@@ -1,6 +1,6 @@
 import {
   DrizzleCacheService
-} from "./chunk-T6C4LFLC.js";
+} from "./chunk-7YGORYZD.js";
 import {
   MemoryCacheService
 } from "./chunk-IF5I3DAA.js";
@@ -81,4 +81,4 @@ CacheModule = __decorateClass([
 export {
   CacheModule
 };
-//# sourceMappingURL=chunk-COGHTKXY.js.map
+//# sourceMappingURL=chunk-27ETSJ2X.js.map

package/dist/{chunk-WPXNN6QS.js → chunk-4H3PETLM.js}

@@ -3,11 +3,7 @@ import {
 } from "./chunk-RC23QROE.js";
 import {
   JobsDomainModule
-} from "./chunk-KMZCQASO.js";
-import {
-  BootValidationError,
-  ReservedPoolViolationError
-} from "./chunk-T4BIIU5E.js";
+} from "./chunk-O37C3YE6.js";
 import {
   BULLMQ_CONNECTION,
   BULLMQ_RESOLVED_CONFIG,
@@ -18,6 +14,10 @@ import {
   allPoolNames,
   loadPoolConfig
 } from "./chunk-RHVN6NA7.js";
+import {
+  BootValidationError,
+  ReservedPoolViolationError
+} from "./chunk-T4BIIU5E.js";
 import {
   HandlerRegistry
 } from "./chunk-CO6LUM72.js";
@@ -287,4 +287,4 @@ export {
   JobWorkerOrchestrator,
   JobWorkerModule
 };
-//# sourceMappingURL=chunk-WPXNN6QS.js.map
+//# sourceMappingURL=chunk-4H3PETLM.js.map

package/dist/{chunk-24CWKBK5.js → chunk-4MF3HKJA.js}

@@ -29,7 +29,7 @@ var PollChangeSource = class {
         "PollChangeSource: DetectionConfig.mapping must include an entry with target 'external_id' so emitted Change<T>.externalId can be populated"
       );
     }
-    this.externalIdSourceField = externalIdMapping.target;
+    this.externalIdSourceField = externalIdMapping.source;
     this.adapter = opts.adapter;
     this.filters = config.filters;
     const isCdc = config.poll.provenance === "cdc";
@@ -56,7 +56,7 @@ var PollChangeSource = class {
       const externalIdRaw = record[this.externalIdSourceField];
       if (typeof externalIdRaw !== "string" || externalIdRaw.length === 0) {
         throw new Error(
-          `PollChangeSource: record missing string '${this.externalIdSourceField}' \u2014 emitted records MUST carry the canonical external id keyed by the mapping target`
+          `PollChangeSource: record missing string '${this.externalIdSourceField}' \u2014 emitted records MUST carry the canonical external id keyed by the mapping source`
         );
       }
       let dedupKey;
@@ -91,4 +91,4 @@ var PollChangeSource = class {
 export {
   PollChangeSource
 };
-//# sourceMappingURL=chunk-24CWKBK5.js.map
+//# sourceMappingURL=chunk-4MF3HKJA.js.map

package/dist/chunk-4MF3HKJA.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../runtime/subsystems/integration/poll-change-source.ts"],"sourcesContent":["/**\n * Integration subsystem — `PollChangeSource<T>` primitive (#226-3, ADR-033).\n *\n * Generic poll-mode `IChangeSource<T>` implementation parameterized by a\n * parsed `DetectionConfig` (poll mode) and a consumer-supplied\n * `PollFetchCallback<T>`. The primitive owns:\n *\n *   - filter resolution (flat-AND vocabulary per epic decision Q3 — richer\n *     boolean expressions deferred);\n *   - field mapping → `Change.externalId` derivation;\n *   - cursor strategy passthrough (the orchestrator passes the prior cursor\n *     by-value per ADR-033 / #226-2; the callback yields the next cursor\n *     per record; the primitive simply stamps it onto `Change<T>`);\n *   - `Change<T>.source` provenance (`'poll'` by default);\n *   - middleware-chain composition (the `ChangeMiddleware<T>` shape\n *     locked in #226-1).\n *\n * Shape locks (decision memo Q5):\n *   - `PollFetchContext = { subscription, cursor, filters }` — explicitly\n *     NO `userId` / `tenantId`. Run-scope identity is closed over by the\n *     consumer at adapter construction (or resolved inside the callback\n *     via consumer services). Threading it through the seam would force\n *     port expansion every time run-context grows.\n *\n * The adapter callback returns `{ record: T; cursor: PollCursor }` — the\n * primitive does not reach into the record to extract a cursor itself.\n * `cursor.field` from `DetectionConfig.poll.cursor` is metadata for codegen\n * + adapters; the primitive trusts what the callback yielded.\n */\n\nimport type {\n  DetectionConfig,\n  ResolvedFilter,\n} from './detection-config.schema';\nimport type {\n  Change,\n  ChangeSource,\n  IChangeSource,\n  IntegrationSubscriptionView,\n} from './integration-change-source.protocol';\nimport type {\n  ChangeIterator,\n  ChangeMiddleware,\n} from './integration-middleware.protocol';\n\n// ============================================================================\n// Cursor + adapter callback shapes\n// ============================================================================\n\n/**\n * Opaque poll-cursor shape. Each provider/entity pair binds it concretely\n * via the cursor strategy (`{ systemModstamp }`, `{ replayId }`, etc.); the\n * primitive treats it as an opaque value to pass through.\n */\nexport type PollCursor = unknown;\n\n/**\n * The context the primitive forwards to the adapter callback. Locked to\n * exactly three fields per decision memo Q5 — `userId` / `tenantId` are\n * NOT here on purpose.\n */\nexport interface PollFetchContext {\n  readonly subscription: IntegrationSubscriptionView;\n  readonly cursor: PollCursor | null;\n  readonly filters: readonly ResolvedFilter[];\n}\n\n/**\n * Consumer-supplied fetch callback. Returns an async iterable of\n * `{ record, cursor }` pairs — `record` is already the canonical `T`\n * (the adapter does provider-side translation), `cursor` is the post-record\n * cursor the orchestrator should persist if the run completes successfully.\n */\nexport type PollFetchCallback<T> = (\n  ctx: PollFetchContext,\n) => AsyncIterable<{ record: T; cursor: PollCursor }>;\n\n// ============================================================================\n// Constructor options\n// ============================================================================\n\nexport interface PollChangeSourceOptions<T> {\n  /** Consumer-supplied fetch callback. */\n  readonly adapter: PollFetchCallback<T>;\n  /**\n   * Parsed detection config. MUST be `mode: 'poll'`; the constructor\n   * throws if a webhook config is supplied. Codegen-emitted factories\n   * call `DetectionConfigSchema.parse(...)` upstream so this is a safety\n   * net, not the primary validation point.\n   */\n  readonly config: DetectionConfig;\n  /**\n   * Optional middleware chain. First element is the outermost layer:\n   * sees `(subscription, cursor)` first and yielded `Change<T>` last.\n   * Locked shape (#226-1) — the primitive composes them with its own\n   * `listChanges` implementation as the innermost iterator.\n   */\n  readonly middlewares?: ReadonlyArray<ChangeMiddleware<T>>;\n  /**\n   * Optional human label for run logs (e.g. `'salesforce-poll-opportunity'`).\n   * Defaults to a derived label based on the subscription domain at\n   * construction time fallback — adapters are encouraged to provide one.\n   */\n  readonly label?: string;\n}\n\n// ============================================================================\n// PollChangeSource<T>\n// ============================================================================\n\nexport class PollChangeSource<T> implements IChangeSource<T> {\n  public readonly label: string;\n\n  private readonly adapter: PollFetchCallback<T>;\n  private readonly filters: readonly ResolvedFilter[];\n  private readonly externalIdSourceField: string;\n  private readonly source: ChangeSource;\n  /**\n   * When `poll.provenance === 'cdc'`, the field on the emitted record from\n   * which `Change<T>.dedupKey` is read — sourced from `poll.cursor.field`\n   * (Stripe-style event endpoints carry the event id on the record itself\n   * and the cursor advances over the same id). `null` for default poll\n   * provenance, which does NOT populate `dedupKey`.\n   */\n  private readonly dedupKeySourceField: string | null;\n  private readonly composed: ChangeIterator<T>;\n\n  constructor(opts: PollChangeSourceOptions<T>) {\n    if (opts.config.mode !== 'poll') {\n      throw new Error(\n        `PollChangeSource requires DetectionConfig.mode === 'poll'; got '${(opts.config as { mode: string }).mode}'`,\n      );\n    }\n    const config = opts.config;\n\n    // Field mapping: locate the entry whose canonical `target` is `external_id`.\n    // Adapters emit T already-mapped, but the primitive needs to know which key\n    // on T carries the external id so it can stamp `Change.externalId`. That key\n    // is the mapping's `source` (the field on the emitted record), NOT its\n    // `target` (the canonical column) — they differ whenever the canonical\n    // record is vendor-neutral camelCase (e.g. `source: 'externalId'` →\n    // `target: 'external_id'`). Source of truth is the mapping table — codegen\n    // emits it from YAML, the primitive reads it here.\n    const externalIdMapping = config.mapping.find(\n      (m) => m.target === 'external_id',\n    );\n    if (!externalIdMapping) {\n      throw new Error(\n        \"PollChangeSource: DetectionConfig.mapping must include an entry with target 'external_id' so emitted Change<T>.externalId can be populated\",\n      );\n    }\n    this.externalIdSourceField = externalIdMapping.source;\n\n    this.adapter = opts.adapter;\n    this.filters = config.filters;\n    // Provenance: `mode: 'poll'` defaults to `'poll'`; opt into `'cdc'` via\n    // `poll.provenance` (Stripe-style event endpoints — wired in #226-4).\n    // CDC provenance also stamps `dedupKey` from the cursor's `field`, since\n    // those endpoints surface a per-event id on each record (the same id the\n    // cursor advances over).\n    const isCdc = config.poll.provenance === 'cdc';\n    this.source = isCdc ? 'cdc' : 'poll';\n    this.dedupKeySourceField = isCdc ? config.poll.cursor.field : null;\n\n    this.label =\n      opts.label ?? `poll-change-source:${externalIdMapping.source}`;\n\n    // Compose middleware chain. The terminal iterator is `this.fetch`\n    // bound to `this`. First middleware in the array is the outermost\n    // layer (sees subscription/cursor first, yielded changes last).\n    const inner: ChangeIterator<T> = (sub, cur) => this.fetch(sub, cur);\n    const middlewares = opts.middlewares ?? [];\n    this.composed = middlewares.reduceRight<ChangeIterator<T>>(\n      (next, mw) => mw(next),\n      inner,\n    );\n  }\n\n  listChanges(\n    subscription: IntegrationSubscriptionView,\n    cursor: unknown | null,\n  ): AsyncIterable<Change<T>> {\n    return this.composed(subscription, cursor);\n  }\n\n  private async *fetch(\n    subscription: IntegrationSubscriptionView,\n    cursor: unknown | null,\n  ): AsyncIterable<Change<T>> {\n    const ctx: PollFetchContext = {\n      subscription,\n      cursor: cursor as PollCursor | null,\n      filters: this.filters,\n    };\n\n    for await (const { record, cursor: nextCursor } of this.adapter(ctx)) {\n      const externalIdRaw = (record as Record<string, unknown>)[\n        this.externalIdSourceField\n      ];\n      if (typeof externalIdRaw !== 'string' || externalIdRaw.length === 0) {\n        throw new Error(\n          `PollChangeSource: record missing string '${this.externalIdSourceField}' — emitted records MUST carry the canonical external id keyed by the mapping source`,\n        );\n      }\n      let dedupKey: string | undefined;\n      if (this.dedupKeySourceField !== null) {\n        const dedupRaw = (record as Record<string, unknown>)[\n          this.dedupKeySourceField\n        ];\n        if (typeof dedupRaw !== 'string' || dedupRaw.length === 0) {\n          throw new Error(\n            `PollChangeSource: cdc-provenance record missing string '${this.dedupKeySourceField}' — when poll.provenance === 'cdc' the cursor.field must be present on each record so dedupKey can be populated`,\n          );\n        }\n        dedupKey = dedupRaw;\n      }\n\n      const change: Change<T> = {\n        externalId: externalIdRaw,\n        // Polling cannot distinguish create vs. update vs. delete on its\n        // own — all yielded records are surfaced as 'updated'. The\n        // orchestrator's diff stage classifies create-vs-update against\n        // local state; soft-delete detection is out of scope for the\n        // primitive (consumer drives via tombstone records or a separate\n        // sweep — see ADR-033).\n        operation: 'updated',\n        record,\n        cursor: nextCursor,\n        source: this.source,\n        ...(dedupKey !== undefined ? { dedupKey } : {}),\n      };\n      yield change;\n    }\n  }\n}\n"],"mappings":";AA8GO,IAAM,mBAAN,MAAsD;AAAA,EAC3C;AAAA,EAEC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA;AAAA,EACA;AAAA,EAEjB,YAAY,MAAkC;AAC5C,QAAI,KAAK,OAAO,SAAS,QAAQ;AAC/B,YAAM,IAAI;AAAA,QACR,mEAAoE,KAAK,OAA4B,IAAI;AAAA,MAC3G;AAAA,IACF;AACA,UAAM,SAAS,KAAK;AAUpB,UAAM,oBAAoB,OAAO,QAAQ;AAAA,MACvC,CAAC,MAAM,EAAE,WAAW;AAAA,IACtB;AACA,QAAI,CAAC,mBAAmB;AACtB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,SAAK,wBAAwB,kBAAkB;AAE/C,SAAK,UAAU,KAAK;AACpB,SAAK,UAAU,OAAO;AAMtB,UAAM,QAAQ,OAAO,KAAK,eAAe;AACzC,SAAK,SAAS,QAAQ,QAAQ;AAC9B,SAAK,sBAAsB,QAAQ,OAAO,KAAK,OAAO,QAAQ;AAE9D,SAAK,QACH,KAAK,SAAS,sBAAsB,kBAAkB,MAAM;AAK9D,UAAM,QAA2B,CAAC,KAAK,QAAQ,KAAK,MAAM,KAAK,GAAG;AAClE,UAAM,cAAc,KAAK,eAAe,CAAC;AACzC,SAAK,WAAW,YAAY;AAAA,MAC1B,CAAC,MAAM,OAAO,GAAG,IAAI;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AAAA,EAEA,YACE,cACA,QAC0B;AAC1B,WAAO,KAAK,SAAS,cAAc,MAAM;AAAA,EAC3C;AAAA,EAEA,OAAe,MACb,cACA,QAC0B;AAC1B,UAAM,MAAwB;AAAA,MAC5B;AAAA,MACA;AAAA,MACA,SAAS,KAAK;AAAA,IAChB;AAEA,qBAAiB,EAAE,QAAQ,QAAQ,WAAW,KAAK,KAAK,QAAQ,GAAG,GAAG;AACpE,YAAM,gBAAiB,OACrB,KAAK,qBACP;AACA,UAAI,OAAO,kBAAkB,YAAY,cAAc,WAAW,GAAG;AACnE,cAAM,IAAI;AAAA,UACR,4CAA4C,KAAK,qBAAqB;AAAA,QACxE;AAAA,MACF;AACA,UAAI;AACJ,UAAI,KAAK,wBAAwB,MAAM;AACrC,cAAM,WAAY,OAChB,KAAK,mBACP;AACA,YAAI,OAAO,aAAa,YAAY,SAAS,WAAW,GAAG;AACzD,gBAAM,IAAI;AAAA,YACR,2DAA2D,KAAK,mBAAmB;AAAA,UACrF;AAAA,QACF;AACA,mBAAW;AAAA,MACb;AAEA,YAAM,SAAoB;AAAA,QACxB,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAOZ,WAAW;AAAA,QACX;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ,KAAK;AAAA,QACb,GAAI,aAAa,SAAY,EAAE,SAAS,IAAI,CAAC;AAAA,MAC/C;AACA,YAAM;AAAA,IACR;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-T6C4LFLC.js → chunk-7YGORYZD.js}

@@ -1,9 +1,9 @@
-import {
-  cacheEntries
-} from "./chunk-FASRXRX5.js";
 import {
   CACHE_DEFAULT_TTL
 } from "./chunk-L6FTY45T.js";
+import {
+  cacheEntries
+} from "./chunk-FASRXRX5.js";
 import {
   DRIZZLE
 } from "./chunk-U64T4YZE.js";
@@ -109,4 +109,4 @@ DrizzleCacheService = __decorateClass([
 export {
   DrizzleCacheService
 };
-//# sourceMappingURL=chunk-T6C4LFLC.js.map
+//# sourceMappingURL=chunk-7YGORYZD.js.map

package/dist/{chunk-I6MG4M3F.js → chunk-FBGHYQIZ.js}

@@ -1,12 +1,12 @@
-import {
-  MissingTenantIdError
-} from "./chunk-T4BIIU5E.js";
 import {
   clampLimit,
   decodeKeysetCursor,
   encodeKeysetCursor,
   toJobRunSummary
 } from "./chunk-L3LZWWSX.js";
+import {
+  MissingTenantIdError
+} from "./chunk-T4BIIU5E.js";
 import {
   JOBS_MULTI_TENANT,
   JOB_ORCHESTRATOR
@@ -198,4 +198,4 @@ DrizzleJobRunService = __decorateClass([
 export {
   DrizzleJobRunService
 };
-//# sourceMappingURL=chunk-I6MG4M3F.js.map
+//# sourceMappingURL=chunk-FBGHYQIZ.js.map

package/dist/{chunk-WEVWJKOW.js → chunk-GCYKMF22.js}

@@ -1,15 +1,15 @@
-import {
-  MemoryCursorStore
-} from "./chunk-AHV4GDYM.js";
-import {
-  DrizzleIntegrationRunRecorder
-} from "./chunk-SR7F3TJY.js";
 import {
   MemoryRunRecorder
 } from "./chunk-EO2QPOKH.js";
 import {
   PostgresCursorStore
 } from "./chunk-DCCZB4UC.js";
+import {
+  MemoryCursorStore
+} from "./chunk-AHV4GDYM.js";
+import {
+  DrizzleIntegrationRunRecorder
+} from "./chunk-SR7F3TJY.js";
 import {
   DeepEqualDiffer
 } from "./chunk-36U5UGIO.js";
@@ -78,4 +78,4 @@ IntegrationModule = __decorateClass([
 export {
   IntegrationModule
 };
-//# sourceMappingURL=chunk-WEVWJKOW.js.map
+//# sourceMappingURL=chunk-GCYKMF22.js.map

package/dist/{chunk-OZZJDRGW.js → chunk-IYNSRIGR.js}

@@ -1,30 +1,30 @@
 import {
   bridgeRegistry
 } from "./chunk-5A432NZJ.js";
-import {
-  BridgeOutboxDrainHook
-} from "./chunk-L7BNNRGI.js";
 import {
   EventFlowService
 } from "./chunk-32BMMV4H.js";
 import {
   BRIDGE_RESERVED_POOLS
 } from "./chunk-EDKJU5BO.js";
-import {
-  BridgeDeliveryHandler
-} from "./chunk-YTN6BKWA.js";
 import {
   DrizzleBridgeDeliveryRepo
 } from "./chunk-K2I6XIK5.js";
 import {
   MemoryBridgeDeliveryRepo
 } from "./chunk-4DOJBQTP.js";
+import {
+  BridgeOutboxDrainHook
+} from "./chunk-L7BNNRGI.js";
+import {
+  BridgeDeliveryHandler
+} from "./chunk-YTN6BKWA.js";
 import {
   BridgeReservedPoolsNotPolledError
 } from "./chunk-NXXDZ6ZF.js";
 import {
   JOB_WORKER_MODULE_OPTIONS
-} from "./chunk-WPXNN6QS.js";
+} from "./chunk-4H3PETLM.js";
 import {
   BRIDGE_DELIVERY_REPO,
   BRIDGE_MODULE_OPTIONS,
@@ -119,4 +119,4 @@ BridgeModule = __decorateClass([
 export {
   BridgeModule
 };
-//# sourceMappingURL=chunk-OZZJDRGW.js.map
+//# sourceMappingURL=chunk-IYNSRIGR.js.map

package/dist/{chunk-DKKFTHHI.js → chunk-J7JMVS2B.js}

@@ -1,9 +1,9 @@
-import {
-  NoopAnalyticsBackend
-} from "./chunk-J37YWU7Y.js";
 import {
   CubeAnalyticsBackend
 } from "./chunk-7B3RYX45.js";
+import {
+  NoopAnalyticsBackend
+} from "./chunk-J37YWU7Y.js";
 import {
   ANALYTICS_QUERY,
   CUBE_API_SECRET,
@@ -50,4 +50,4 @@ AnalyticsModule = __decorateClass([
 export {
   AnalyticsModule
 };
-//# sourceMappingURL=chunk-DKKFTHHI.js.map
+//# sourceMappingURL=chunk-J7JMVS2B.js.map

package/dist/{chunk-KMZCQASO.js → chunk-O37C3YE6.js}

@@ -1,12 +1,17 @@
 import {
   DrizzleJobRunService
-} from "./chunk-I6MG4M3F.js";
+} from "./chunk-FBGHYQIZ.js";
 import {
   MemoryJobRunService
-} from "./chunk-JRVNVKN6.js";
+} from "./chunk-RDVTWIYY.js";
 import {
   DrizzleJobStepService
 } from "./chunk-DV4RV2DC.js";
+import {
+  BULLMQ_CONNECTION,
+  BULLMQ_RESOLVED_CONFIG,
+  resolveBullMqConfig
+} from "./chunk-I6MVCB5A.js";
 import {
   DrizzleJobOrchestrator
 } from "./chunk-5Y7W3XR6.js";
@@ -19,11 +24,6 @@ import {
 import {
   MemoryJobStore
 } from "./chunk-SNQ3TOWP.js";
-import {
-  BULLMQ_CONNECTION,
-  BULLMQ_RESOLVED_CONFIG,
-  resolveBullMqConfig
-} from "./chunk-I6MVCB5A.js";
 import {
   JOBS_MULTI_TENANT,
   JOB_ORCHESTRATOR,
@@ -108,4 +108,4 @@ JobsDomainModule = __decorateClass([
 export {
   JobsDomainModule
 };
-//# sourceMappingURL=chunk-KMZCQASO.js.map
+//# sourceMappingURL=chunk-O37C3YE6.js.map

package/dist/{chunk-JRVNVKN6.js → chunk-RDVTWIYY.js}

@@ -1,15 +1,15 @@
-import {
-  MemoryJobStore
-} from "./chunk-SNQ3TOWP.js";
-import {
-  MissingTenantIdError
-} from "./chunk-T4BIIU5E.js";
 import {
   clampLimit,
   decodeKeysetCursor,
   encodeKeysetCursor,
   toJobRunSummary
 } from "./chunk-L3LZWWSX.js";
+import {
+  MemoryJobStore
+} from "./chunk-SNQ3TOWP.js";
+import {
+  MissingTenantIdError
+} from "./chunk-T4BIIU5E.js";
 import {
   JOBS_MULTI_TENANT,
   JOB_ORCHESTRATOR
@@ -209,4 +209,4 @@ function compareBy(a, b, order) {
 export {
   MemoryJobRunService
 };
-//# sourceMappingURL=chunk-JRVNVKN6.js.map
+//# sourceMappingURL=chunk-RDVTWIYY.js.map

package/dist/{chunk-7LKAMLV4.js → chunk-T6SCOJF4.js}

@@ -1,15 +1,15 @@
 import {
   EnvEncryptionKey
 } from "./chunk-IP4OO26U.js";
+import {
+  AuthController
+} from "./chunk-SZVPIHWE.js";
 import {
   DrizzleOAuthStateStore
 } from "./chunk-N5OTOWTP.js";
 import {
   MemoryOAuthStateStore
 } from "./chunk-QLTJSCE6.js";
-import {
-  AuthController
-} from "./chunk-SZVPIHWE.js";
 import {
   AUTH_OPTIONS,
   ENCRYPTION_KEY,
@@ -89,4 +89,4 @@ AuthModule = __decorateClass([
 export {
   AuthModule
 };
-//# sourceMappingURL=chunk-7LKAMLV4.js.map
+//# sourceMappingURL=chunk-T6SCOJF4.js.map

package/dist/{chunk-WRUUSZDJ.js → chunk-WWGYCIJX.js}

@@ -1,9 +1,9 @@
 import {
   PollChangeSource
-} from "./chunk-24CWKBK5.js";
+} from "./chunk-4MF3HKJA.js";
 import {
   WebhookChangeSource
-} from "./chunk-4OMHBMZJ.js";
+} from "./chunk-YLPAPPLW.js";
 
 // runtime/subsystems/integration/build-change-source.ts
 function buildChangeSource(cfg, fetch, middlewares = []) {
@@ -26,4 +26,4 @@ function buildChangeSource(cfg, fetch, middlewares = []) {
 export {
   buildChangeSource
 };
-//# sourceMappingURL=chunk-WRUUSZDJ.js.map
+//# sourceMappingURL=chunk-WWGYCIJX.js.map

package/dist/{chunk-4OMHBMZJ.js → chunk-YLPAPPLW.js}

@@ -20,7 +20,7 @@ var WebhookChangeSource = class {
         "WebhookChangeSource: DetectionConfig.mapping must include an entry with target 'external_id' so emitted Change<T>.externalId can be populated"
       );
     }
-    this.externalIdSourceField = externalIdMapping.target;
+    this.externalIdSourceField = externalIdMapping.source;
     this.eventIdSourceField = config.webhook.eventIdField;
     this.queue = opts.queue;
     this.label = opts.label ?? `webhook-change-source:${externalIdMapping.source}`;
@@ -43,7 +43,7 @@ var WebhookChangeSource = class {
       const externalIdRaw = record[this.externalIdSourceField];
       if (typeof externalIdRaw !== "string" || externalIdRaw.length === 0) {
         throw new Error(
-          `WebhookChangeSource: record missing string '${this.externalIdSourceField}' \u2014 emitted records MUST carry the canonical external id keyed by the mapping target`
+          `WebhookChangeSource: record missing string '${this.externalIdSourceField}' \u2014 emitted records MUST carry the canonical external id keyed by the mapping source`
         );
       }
       const eventIdRaw = record[this.eventIdSourceField];
@@ -72,4 +72,4 @@ var WebhookChangeSource = class {
 export {
   WebhookChangeSource
 };
-//# sourceMappingURL=chunk-4OMHBMZJ.js.map
+//# sourceMappingURL=chunk-YLPAPPLW.js.map

package/dist/chunk-YLPAPPLW.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../runtime/subsystems/integration/webhook-change-source.ts"],"sourcesContent":["/**\n * Integration subsystem — `WebhookChangeSource<T>` primitive (#226-4, ADR-033).\n *\n * Generic webhook-mode `IChangeSource<T>` implementation parameterized by a\n * parsed `DetectionConfig` (webhook mode) and a consumer-supplied\n * `WebhookFetchCallback<T>` that iterates a consumer-owned inbound staging\n * queue. The primitive owns:\n *\n *   - canonical `Change<T>.source = 'webhook'` stamping;\n *   - `dedupKey` derivation from the configured `webhook.eventIdField` on\n *     the emitted record;\n *   - `externalId` derivation: the mapping entry whose `target === 'external_id'`\n *     names — via its `source` — the field on the emitted record that carries\n *     the canonical external id (mirrors `PollChangeSource`);\n *   - middleware-chain composition via the locked `ChangeMiddleware<T>` shape\n *     (#226-1) — same composition seam as the poll primitive.\n *\n * The primitive is **passive**: it iterates whatever the consumer-owned\n * queue yields. It does NOT synchronously drive the orchestrator, does NOT\n * own a transport, and does NOT manage acks. The inbound staging table\n * schema is consumer-owned and deferred per ADR-0002 §Phase 4 — the\n * `WebhookFetchCallback<T>` is the queue contract the consumer injects.\n *\n * Shape locks (decision memo Q5, mirrored from poll primitive):\n *   - `WebhookFetchContext = { subscription, cursor }` — explicitly NO\n *     `userId` / `tenantId`. Run-scope identity is closed over by the\n *     consumer at queue construction or resolved inside the callback via\n *     consumer services. There are no `filters` on the webhook context —\n *     filtering is done at registration / on the staging row, not at the\n *     port seam (the queue is already filtered by the time the primitive\n *     iterates).\n *\n * Long-lived streaming CDC primitives (SFDC Pub-Sub gRPC, Debezium/Kafka,\n * Postgres logical replication) are deferred to `#226-8` — they need a\n * fundamentally different lifecycle (`subscribe(onChange, onError)`,\n * server-paced backpressure, ack-on-yield) and shouldn't be retrofitted\n * into either this primitive or the poll primitive.\n */\n\nimport type { DetectionConfig } from './detection-config.schema';\nimport type {\n  Change,\n  IChangeSource,\n  IntegrationSubscriptionView,\n} from './integration-change-source.protocol';\nimport type {\n  ChangeIterator,\n  ChangeMiddleware,\n} from './integration-middleware.protocol';\n\n// ============================================================================\n// Cursor + queue callback shapes\n// ============================================================================\n\n/**\n * Opaque webhook cursor shape. Webhook mode typically has a cursor of\n * `{ ts: ISO-string }` (last drained staging-row timestamp) but the\n * primitive treats it as opaque. Consumer-owned queue iterators interpret\n * it however the staging schema needs.\n */\nexport type WebhookCursor = unknown;\n\n/**\n * Context the primitive forwards to the queue iterator. Locked to exactly\n * two fields per the same Q5 reasoning that locks `PollFetchContext` — no\n * `userId` / `tenantId`.\n */\nexport interface WebhookFetchContext {\n  readonly subscription: IntegrationSubscriptionView;\n  readonly cursor: WebhookCursor | null;\n}\n\n/**\n * Consumer-supplied queue iterator. Returns an async iterable of\n * `{ record }` pairs — the consumer drains the inbound staging queue and\n * emits already-mapped canonical records `T`. The primitive stamps\n * `source: 'webhook'` and `dedupKey` from the record's configured\n * `webhook.eventIdField`; the consumer is the one who decided when a\n * staging row is \"ready\" to drain.\n *\n * Webhook mode has no per-record cursor advance — the staging-row drain\n * order is consumer policy (FIFO by ingestion timestamp, by event id, etc.)\n * and is opaque to the primitive. The orchestrator's last-yielded cursor\n * is whatever the consumer chooses to surface, if anything.\n */\nexport type WebhookFetchCallback<T> = (\n  ctx: WebhookFetchContext,\n) => AsyncIterable<{ record: T; cursor?: WebhookCursor }>;\n\n// ============================================================================\n// Constructor options\n// ============================================================================\n\nexport interface WebhookChangeSourceOptions<T> {\n  /** Consumer-supplied inbound queue iterator. */\n  readonly queue: WebhookFetchCallback<T>;\n  /**\n   * Parsed detection config. MUST be `mode: 'webhook'`; the constructor\n   * throws if a poll config is supplied. Codegen-emitted factories call\n   * `DetectionConfigSchema.parse(...)` upstream so this is a safety net,\n   * not the primary validation point.\n   */\n  readonly config: DetectionConfig;\n  /**\n   * Optional middleware chain. Same shape and composition rules as\n   * `PollChangeSource` — first element is the outermost layer.\n   */\n  readonly middlewares?: ReadonlyArray<ChangeMiddleware<T>>;\n  /**\n   * Optional human label for run logs (e.g. `'stripe-webhook-charge'`).\n   * Defaults to a derived label based on the mapping at construction.\n   */\n  readonly label?: string;\n}\n\n// ============================================================================\n// WebhookChangeSource<T>\n// ============================================================================\n\nexport class WebhookChangeSource<T> implements IChangeSource<T> {\n  public readonly label: string;\n\n  private readonly queue: WebhookFetchCallback<T>;\n  private readonly externalIdSourceField: string;\n  private readonly eventIdSourceField: string;\n  private readonly composed: ChangeIterator<T>;\n\n  constructor(opts: WebhookChangeSourceOptions<T>) {\n    if (opts.config.mode !== 'webhook') {\n      throw new Error(\n        `WebhookChangeSource requires DetectionConfig.mode === 'webhook'; got '${(opts.config as { mode: string }).mode}'`,\n      );\n    }\n    const config = opts.config;\n\n    // Field mapping: locate the entry whose canonical `target` is `external_id`\n    // — mirrors the poll primitive's contract. Adapters emit records\n    // already-mapped; the primitive needs to know which key on T carries the\n    // external id so it can stamp `Change.externalId`. That key is the\n    // mapping's `source` (the field on the emitted record), NOT its `target`\n    // (the canonical column) — they differ whenever the canonical record is\n    // vendor-neutral camelCase (e.g. `source: 'externalId'` → `target: 'external_id'`).\n    const externalIdMapping = config.mapping.find(\n      (m) => m.target === 'external_id',\n    );\n    if (!externalIdMapping) {\n      throw new Error(\n        \"WebhookChangeSource: DetectionConfig.mapping must include an entry with target 'external_id' so emitted Change<T>.externalId can be populated\",\n      );\n    }\n    this.externalIdSourceField = externalIdMapping.source;\n    this.eventIdSourceField = config.webhook.eventIdField;\n\n    this.queue = opts.queue;\n\n    this.label =\n      opts.label ?? `webhook-change-source:${externalIdMapping.source}`;\n\n    // Compose middleware chain — same shape as PollChangeSource.\n    const inner: ChangeIterator<T> = (sub, cur) => this.fetch(sub, cur);\n    const middlewares = opts.middlewares ?? [];\n    this.composed = middlewares.reduceRight<ChangeIterator<T>>(\n      (next, mw) => mw(next),\n      inner,\n    );\n  }\n\n  listChanges(\n    subscription: IntegrationSubscriptionView,\n    cursor: unknown | null,\n  ): AsyncIterable<Change<T>> {\n    return this.composed(subscription, cursor);\n  }\n\n  private async *fetch(\n    subscription: IntegrationSubscriptionView,\n    cursor: unknown | null,\n  ): AsyncIterable<Change<T>> {\n    const ctx: WebhookFetchContext = {\n      subscription,\n      cursor: cursor as WebhookCursor | null,\n    };\n\n    for await (const { record, cursor: nextCursor } of this.queue(ctx)) {\n      const externalIdRaw = (record as Record<string, unknown>)[\n        this.externalIdSourceField\n      ];\n      if (typeof externalIdRaw !== 'string' || externalIdRaw.length === 0) {\n        throw new Error(\n          `WebhookChangeSource: record missing string '${this.externalIdSourceField}' — emitted records MUST carry the canonical external id keyed by the mapping source`,\n        );\n      }\n      const eventIdRaw = (record as Record<string, unknown>)[\n        this.eventIdSourceField\n      ];\n      if (typeof eventIdRaw !== 'string' || eventIdRaw.length === 0) {\n        throw new Error(\n          `WebhookChangeSource: record missing string '${this.eventIdSourceField}' — webhook records MUST carry the event id (DetectionConfig.webhook.eventIdField) so Change<T>.dedupKey can be populated`,\n        );\n      }\n\n      const change: Change<T> = {\n        externalId: externalIdRaw,\n        // Webhook mode cannot distinguish create vs. update vs. delete on\n        // its own — the orchestrator's diff stage handles classification.\n        // Tombstone / soft-delete detection is consumer-driven (same as\n        // poll mode — see ADR-033).\n        operation: 'updated',\n        record,\n        cursor: nextCursor ?? null,\n        source: 'webhook',\n        dedupKey: eventIdRaw,\n      };\n      yield change;\n    }\n  }\n}\n"],"mappings":";AAuHO,IAAM,sBAAN,MAAyD;AAAA,EAC9C;AAAA,EAEC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,MAAqC;AAC/C,QAAI,KAAK,OAAO,SAAS,WAAW;AAClC,YAAM,IAAI;AAAA,QACR,yEAA0E,KAAK,OAA4B,IAAI;AAAA,MACjH;AAAA,IACF;AACA,UAAM,SAAS,KAAK;AASpB,UAAM,oBAAoB,OAAO,QAAQ;AAAA,MACvC,CAAC,MAAM,EAAE,WAAW;AAAA,IACtB;AACA,QAAI,CAAC,mBAAmB;AACtB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,SAAK,wBAAwB,kBAAkB;AAC/C,SAAK,qBAAqB,OAAO,QAAQ;AAEzC,SAAK,QAAQ,KAAK;AAElB,SAAK,QACH,KAAK,SAAS,yBAAyB,kBAAkB,MAAM;AAGjE,UAAM,QAA2B,CAAC,KAAK,QAAQ,KAAK,MAAM,KAAK,GAAG;AAClE,UAAM,cAAc,KAAK,eAAe,CAAC;AACzC,SAAK,WAAW,YAAY;AAAA,MAC1B,CAAC,MAAM,OAAO,GAAG,IAAI;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AAAA,EAEA,YACE,cACA,QAC0B;AAC1B,WAAO,KAAK,SAAS,cAAc,MAAM;AAAA,EAC3C;AAAA,EAEA,OAAe,MACb,cACA,QAC0B;AAC1B,UAAM,MAA2B;AAAA,MAC/B;AAAA,MACA;AAAA,IACF;AAEA,qBAAiB,EAAE,QAAQ,QAAQ,WAAW,KAAK,KAAK,MAAM,GAAG,GAAG;AAClE,YAAM,gBAAiB,OACrB,KAAK,qBACP;AACA,UAAI,OAAO,kBAAkB,YAAY,cAAc,WAAW,GAAG;AACnE,cAAM,IAAI;AAAA,UACR,+CAA+C,KAAK,qBAAqB;AAAA,QAC3E;AAAA,MACF;AACA,YAAM,aAAc,OAClB,KAAK,kBACP;AACA,UAAI,OAAO,eAAe,YAAY,WAAW,WAAW,GAAG;AAC7D,cAAM,IAAI;AAAA,UACR,+CAA+C,KAAK,kBAAkB;AAAA,QACxE;AAAA,MACF;AAEA,YAAM,SAAoB;AAAA,QACxB,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA,QAKZ,WAAW;AAAA,QACX;AAAA,QACA,QAAQ,cAAc;AAAA,QACtB,QAAQ;AAAA,QACR,UAAU;AAAA,MACZ;AACA,YAAM;AAAA,IACR;AAAA,EACF;AACF;","names":[]}

package/dist/runtime/base-classes/index.js

@@ -1,6 +1,18 @@
+import {
+  MetadataEntityRepository
+} from "../../chunk-7KOW6PU6.js";
+import {
+  MetadataEntityService
+} from "../../chunk-RFH7N6EP.js";
 import {
   WithAnalytics
 } from "../../chunk-IBGER4YK.js";
+import {
+  IntegratedEntityRepository
+} from "../../chunk-OTDN3OUQ.js";
+import {
+  IntegratedEntityService
+} from "../../chunk-2VHZ7EKC.js";
 import {
   JunctionIntegrationRepository,
   buildCompositeExternalId,
@@ -12,12 +24,6 @@ import {
 import {
   KnowledgeEntityService
 } from "../../chunk-AS3NAZB6.js";
-import {
-  MetadataEntityRepository
-} from "../../chunk-7KOW6PU6.js";
-import {
-  MetadataEntityService
-} from "../../chunk-RFH7N6EP.js";
 import {
   ActivityEntityRepository
 } from "../../chunk-XCEI7NUH.js";
@@ -28,24 +34,9 @@ import {
   BaseFindByIdUseCase,
   BaseListUseCase
 } from "../../chunk-EXVDJMIY.js";
-import {
-  IntegratedEntityRepository
-} from "../../chunk-OTDN3OUQ.js";
 import {
   BaseRepository
 } from "../../chunk-J6KZS54B.js";
-import {
-  requireRequester,
-  requireRequesterScope,
-  tryGetRequester,
-  withOrgScope,
-  withRequester,
-  withSuperuserScope,
-  withUserScope
-} from "../../chunk-ZUKFQL6E.js";
-import {
-  IntegratedEntityService
-} from "../../chunk-2VHZ7EKC.js";
 import {
   BaseService
 } from "../../chunk-W72PRNJY.js";
@@ -56,6 +47,15 @@ import {
   emitSafely,
   entitySnapshot
 } from "../../chunk-KYR3B3OW.js";
+import {
+  requireRequester,
+  requireRequesterScope,
+  tryGetRequester,
+  withOrgScope,
+  withRequester,
+  withSuperuserScope,
+  withUserScope
+} from "../../chunk-ZUKFQL6E.js";
 import "../../chunk-2E224ZSN.js";
 export {
   ActivityEntityRepository,

package/dist/runtime/subsystems/analytics/analytics.module.js

@@ -1,8 +1,8 @@
 import {
   AnalyticsModule
-} from "../../../chunk-DKKFTHHI.js";
-import "../../../chunk-J37YWU7Y.js";
+} from "../../../chunk-J7JMVS2B.js";
 import "../../../chunk-7B3RYX45.js";
+import "../../../chunk-J37YWU7Y.js";
 import "../../../chunk-6I7ULIN6.js";
 import "../../../chunk-GYGNEQSC.js";
 import "../../../chunk-2E224ZSN.js";

package/dist/runtime/subsystems/analytics/index.js

@@ -1,12 +1,12 @@
 import {
   AnalyticsModule
-} from "../../../chunk-DKKFTHHI.js";
-import {
-  NoopAnalyticsBackend
-} from "../../../chunk-J37YWU7Y.js";
+} from "../../../chunk-J7JMVS2B.js";
 import {
   CubeAnalyticsBackend
 } from "../../../chunk-7B3RYX45.js";
+import {
+  NoopAnalyticsBackend
+} from "../../../chunk-J37YWU7Y.js";
 import {
   ANALYTICS_QUERY,
   CUBE_API_SECRET,

package/dist/runtime/subsystems/auth/auth.module.js

@@ -1,13 +1,13 @@
 import {
   AuthModule
-} from "../../../chunk-7LKAMLV4.js";
+} from "../../../chunk-T6SCOJF4.js";
 import "../../../chunk-IP4OO26U.js";
+import "../../../chunk-SZVPIHWE.js";
 import "../../../chunk-N5OTOWTP.js";
 import "../../../chunk-QLTJSCE6.js";
 import "../../../chunk-BPARRK6F.js";
-import "../../../chunk-SZVPIHWE.js";
-import "../../../chunk-6XY6ZMMD.js";
 import "../../../chunk-NPFPZ2HO.js";
+import "../../../chunk-6XY6ZMMD.js";
 import "../../../chunk-GYGNEQSC.js";
 import "../../../chunk-U64T4YZE.js";
 import "../../../chunk-2E224ZSN.js";

package/dist/runtime/subsystems/auth/index.js

@@ -19,10 +19,13 @@ import {
 } from "../../../chunk-OSQRXVG2.js";
 import {
   AuthModule
-} from "../../../chunk-7LKAMLV4.js";
+} from "../../../chunk-T6SCOJF4.js";
 import {
   EnvEncryptionKey
 } from "../../../chunk-IP4OO26U.js";
+import {
+  AuthController
+} from "../../../chunk-SZVPIHWE.js";
 import {
   DrizzleOAuthStateStore
 } from "../../../chunk-N5OTOWTP.js";
@@ -33,8 +36,8 @@ import {
   OAuthStateError
 } from "../../../chunk-BPARRK6F.js";
 import {
-  AuthController
-} from "../../../chunk-SZVPIHWE.js";
+  authOAuthState
+} from "../../../chunk-NPFPZ2HO.js";
 import {
   AUTH_CONNECTION_GRANT_SINK,
   AUTH_CONNECTION_READER,
@@ -45,9 +48,6 @@ import {
   OAUTH_STATE_STORE,
   STRATEGY_REGISTRY
 } from "../../../chunk-6XY6ZMMD.js";
-import {
-  authOAuthState
-} from "../../../chunk-NPFPZ2HO.js";
 import "../../../chunk-GYGNEQSC.js";
 import "../../../chunk-ZUKFQL6E.js";
 import "../../../chunk-U64T4YZE.js";

package/dist/runtime/subsystems/bridge/bridge.module.js

@@ -1,30 +1,30 @@
 import {
   BridgeModule
-} from "../../../chunk-OZZJDRGW.js";
+} from "../../../chunk-IYNSRIGR.js";
 import "../../../chunk-5A432NZJ.js";
-import "../../../chunk-L7BNNRGI.js";
 import "../../../chunk-32BMMV4H.js";
 import "../../../chunk-EDKJU5BO.js";
-import "../../../chunk-YTN6BKWA.js";
 import "../../../chunk-K2I6XIK5.js";
-import "../../../chunk-6DWFJNIK.js";
 import "../../../chunk-4DOJBQTP.js";
+import "../../../chunk-L7BNNRGI.js";
+import "../../../chunk-YTN6BKWA.js";
+import "../../../chunk-6DWFJNIK.js";
 import "../../../chunk-2TVVBC53.js";
 import "../../../chunk-NXXDZ6ZF.js";
-import "../../../chunk-WPXNN6QS.js";
+import "../../../chunk-4H3PETLM.js";
 import "../../../chunk-RC23QROE.js";
-import "../../../chunk-KMZCQASO.js";
-import "../../../chunk-I6MG4M3F.js";
-import "../../../chunk-JRVNVKN6.js";
+import "../../../chunk-O37C3YE6.js";
+import "../../../chunk-FBGHYQIZ.js";
+import "../../../chunk-RDVTWIYY.js";
+import "../../../chunk-L3LZWWSX.js";
 import "../../../chunk-DV4RV2DC.js";
+import "../../../chunk-I6MVCB5A.js";
+import "../../../chunk-RHVN6NA7.js";
 import "../../../chunk-5Y7W3XR6.js";
 import "../../../chunk-4RFHUZXU.js";
 import "../../../chunk-PNZSGAB2.js";
 import "../../../chunk-SNQ3TOWP.js";
 import "../../../chunk-T4BIIU5E.js";
-import "../../../chunk-L3LZWWSX.js";
-import "../../../chunk-I6MVCB5A.js";
-import "../../../chunk-RHVN6NA7.js";
 import "../../../chunk-CO6LUM72.js";
 import "../../../chunk-BIO6F7YI.js";
 import "../../../chunk-H5NH7KPE.js";