@plumbus/core 0.1.0

package/dist/events/outbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbox.d.ts","sourceRoot":"","sources":["../../src/events/outbox.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqBvB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAS5B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAU1B,CAAC"}

package/dist/events/outbox.js

@@ -0,0 +1,48 @@
+import { index, jsonb, pgTable, text, timestamp, uuid } from 'drizzle-orm/pg-core';
+/**
+ * Outbox table — stores events written atomically alongside business data.
+ * A background dispatcher polls pending rows and publishes them to the queue.
+ */
+export const outboxTable = pgTable('event_outbox', {
+    id: uuid('id').defaultRandom().primaryKey(),
+    eventType: text('event_type').notNull(),
+    version: text('version').notNull().default('1'),
+    payload: jsonb('payload').notNull(),
+    actor: text('actor').notNull(),
+    tenantId: text('tenant_id'),
+    correlationId: text('correlation_id').notNull(),
+    causationId: text('causation_id'),
+    occurredAt: timestamp('occurred_at', { withTimezone: true }).defaultNow().notNull(),
+    status: text('status').notNull().default('pending'), // pending | processing | retry | dispatched | dead_lettered
+    dispatchedAt: timestamp('dispatched_at', { withTimezone: true }),
+    retryCount: text('retry_count').notNull().default('0'),
+    lastError: text('last_error'),
+}, (table) => [
+    index('event_outbox_status_idx').on(table.status),
+    index('event_outbox_occurred_at_idx').on(table.occurredAt),
+]);
+/**
+ * Idempotency table — tracks which event+consumer pairs have been processed
+ * to support at-least-once delivery with consumer deduplication.
+ */
+export const idempotencyTable = pgTable('event_idempotency', {
+    id: uuid('id').defaultRandom().primaryKey(),
+    eventId: text('event_id').notNull(),
+    consumerId: text('consumer_id').notNull(),
+    processedAt: timestamp('processed_at', { withTimezone: true }).defaultNow().notNull(),
+}, (table) => [index('event_idempotency_event_consumer_idx').on(table.eventId, table.consumerId)]);
+/**
+ * Dead-letter table — events that exhausted retries.
+ */
+export const deadLetterTable = pgTable('event_dead_letter', {
+    id: uuid('id').defaultRandom().primaryKey(),
+    eventId: text('event_id').notNull(),
+    eventType: text('event_type').notNull(),
+    payload: jsonb('payload').notNull(),
+    consumerId: text('consumer_id'),
+    lastError: text('last_error'),
+    retryCount: text('retry_count').notNull(),
+    failedAt: timestamp('failed_at', { withTimezone: true }).defaultNow().notNull(),
+    metadata: jsonb('metadata'),
+});
+//# sourceMappingURL=outbox.js.map

package/dist/events/outbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbox.js","sourceRoot":"","sources":["../../src/events/outbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAEnF;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAChC,cAAc,EACd;IACE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IAC/C,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACnC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IAC9B,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;IAC3B,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;IAC/C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC;IACjC,UAAU,EAAE,SAAS,CAAC,aAAa,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACnF,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,4DAA4D;IACjH,YAAY,EAAE,SAAS,CAAC,eAAe,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAChE,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IACtD,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;CAC9B,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,KAAK,CAAC,yBAAyB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;IACjD,KAAK,CAAC,8BAA8B,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;CAC3D,CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CACrC,mBAAmB,EACnB;IACE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACnC,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,WAAW,EAAE,SAAS,CAAC,cAAc,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CACtF,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,CAC/F,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC,mBAAmB,EAAE;IAC1D,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACnC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;IACnC,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;IAC/B,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;IAC7B,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,QAAQ,EAAE,SAAS,CAAC,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IAC/E,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC;CAC5B,CAAC,CAAC"}

package/dist/events/queue.d.ts

@@ -0,0 +1,58 @@
+import type { EventEnvelope } from '../types/event.js';
+/**
+ * Abstract queue interface for publishing and consuming event envelopes.
+ * Implementations can back this with in-memory arrays (dev/test),
+ * Redis/BullMQ, SQS, etc.
+ */
+export interface EventQueue {
+    /** Enqueue an event for delivery to consumers */
+    publish(envelope: EventEnvelope): Promise<void>;
+    /** Subscribe to incoming events. Returns an unsubscribe function. */
+    subscribe(handler: (envelope: EventEnvelope) => Promise<void>): () => void;
+    /** Drain / shutdown the queue gracefully */
+    close(): Promise<void>;
+}
+/**
+ * Simple in-memory queue for development and testing.
+ * Events are delivered asynchronously to all subscribers.
+ */
+export declare function createInMemoryQueue(): EventQueue;
+export interface RedisQueueConfig {
+    /** Redis connection URL (e.g., redis://localhost:6379) */
+    url?: string;
+    /** Redis host (default: "localhost") */
+    host?: string;
+    /** Redis port (default: 6379) */
+    port?: number;
+    /** Redis password */
+    password?: string;
+    /** Queue key prefix (default: "plumbus:events") */
+    prefix?: string;
+    /** Poll interval in ms for subscriber polling (default: 1000) */
+    pollIntervalMs?: number;
+    /** Visibility timeout in seconds — how long a message is hidden after dequeue (default: 30) */
+    visibilityTimeoutSec?: number;
+}
+/** Minimal Redis client interface — compatible with ioredis and node-redis */
+export interface RedisClient {
+    lpush(key: string, ...values: string[]): Promise<number>;
+    brpoplpush?(source: string, destination: string, timeout: number): Promise<string | null>;
+    rpoplpush?(source: string, destination: string): Promise<string | null>;
+    lrem(key: string, count: number, value: string): Promise<number>;
+    lrange(key: string, start: number, stop: number): Promise<string[]>;
+    quit(): Promise<unknown>;
+}
+/**
+ * Create a Redis-backed event queue.
+ *
+ * Uses a simple list-based pattern:
+ * - Publish: LPUSH events to the queue list
+ * - Subscribe: Poll with RPOPLPUSH to a processing list
+ * - Ack: LREM from processing list after successful handling
+ *
+ * This provides at-least-once delivery with crash recovery:
+ * if the consumer crashes, unacknowledged events remain in the
+ * processing list and can be recovered.
+ */
+export declare function createRedisQueue(client: RedisClient, config?: Partial<RedisQueueConfig>): EventQueue;
+//# sourceMappingURL=queue.d.ts.map

package/dist/events/queue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"queue.d.ts","sourceRoot":"","sources":["../../src/events/queue.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,iDAAiD;IACjD,OAAO,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,qEAAqE;IACrE,SAAS,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC;IAC3E,4CAA4C;IAC5C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,UAAU,CA+BhD;AAOD,MAAM,WAAW,gBAAgB;IAC/B,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iCAAiC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qBAAqB;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+FAA+F;IAC/F,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,8EAA8E;AAC9E,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACzD,UAAU,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1F,SAAS,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACxE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACjE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACpE,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,WAAW,EACnB,MAAM,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,GACjC,UAAU,CAwFZ"}

package/dist/events/queue.js

@@ -0,0 +1,135 @@
+/**
+ * Simple in-memory queue for development and testing.
+ * Events are delivered asynchronously to all subscribers.
+ */
+export function createInMemoryQueue() {
+    const subscribers = [];
+    let closed = false;
+    const pending = [];
+    return {
+        async publish(envelope) {
+            if (closed)
+                throw new Error('Queue is closed');
+            for (const handler of subscribers) {
+                const p = handler(envelope).catch(() => {
+                    /* delivery errors handled by worker */
+                });
+                pending.push(p);
+            }
+        },
+        subscribe(handler) {
+            if (closed)
+                throw new Error('Queue is closed');
+            subscribers.push(handler);
+            return () => {
+                const idx = subscribers.indexOf(handler);
+                if (idx !== -1)
+                    subscribers.splice(idx, 1);
+            };
+        },
+        async close() {
+            closed = true;
+            await Promise.allSettled(pending);
+            subscribers.length = 0;
+        },
+    };
+}
+/**
+ * Create a Redis-backed event queue.
+ *
+ * Uses a simple list-based pattern:
+ * - Publish: LPUSH events to the queue list
+ * - Subscribe: Poll with RPOPLPUSH to a processing list
+ * - Ack: LREM from processing list after successful handling
+ *
+ * This provides at-least-once delivery with crash recovery:
+ * if the consumer crashes, unacknowledged events remain in the
+ * processing list and can be recovered.
+ */
+export function createRedisQueue(client, config) {
+    const prefix = config?.prefix ?? 'plumbus:events';
+    const pollIntervalMs = config?.pollIntervalMs ?? 1000;
+    const queueKey = `${prefix}:pending`;
+    const processingKey = `${prefix}:processing`;
+    const subscribers = [];
+    let closed = false;
+    let pollTimer = null;
+    let polling = false;
+    async function pollOnce() {
+        if (closed || polling || subscribers.length === 0)
+            return;
+        polling = true;
+        try {
+            // Move one item from pending to processing atomically
+            let raw = null;
+            if (client.rpoplpush) {
+                raw = await client.rpoplpush(queueKey, processingKey);
+            }
+            else if (client.brpoplpush) {
+                raw = await client.brpoplpush(queueKey, processingKey, 0);
+            }
+            if (!raw) {
+                polling = false;
+                return;
+            }
+            const envelope = JSON.parse(raw);
+            // Restore Date object
+            if (typeof envelope.occurredAt === 'string') {
+                envelope.occurredAt = new Date(envelope.occurredAt);
+            }
+            // Deliver to all subscribers
+            const results = await Promise.allSettled(subscribers.map((handler) => handler(envelope)));
+            // If at least one subscriber succeeded, acknowledge the message
+            const anySuccess = results.some((r) => r.status === 'fulfilled');
+            if (anySuccess) {
+                await client.lrem(processingKey, 1, raw);
+            }
+        }
+        catch {
+            // Poll errors are transient — will retry next cycle
+        }
+        finally {
+            polling = false;
+        }
+    }
+    function startPolling() {
+        if (pollTimer)
+            return;
+        pollTimer = setInterval(() => {
+            void pollOnce();
+        }, pollIntervalMs);
+    }
+    return {
+        async publish(envelope) {
+            if (closed)
+                throw new Error('Queue is closed');
+            const serialized = JSON.stringify(envelope);
+            await client.lpush(queueKey, serialized);
+        },
+        subscribe(handler) {
+            if (closed)
+                throw new Error('Queue is closed');
+            subscribers.push(handler);
+            startPolling();
+            return () => {
+                const idx = subscribers.indexOf(handler);
+                if (idx !== -1)
+                    subscribers.splice(idx, 1);
+                if (subscribers.length === 0 && pollTimer) {
+                    clearInterval(pollTimer);
+                    pollTimer = null;
+                }
+            };
+        },
+        async close() {
+            closed = true;
+            if (pollTimer) {
+                clearInterval(pollTimer);
+                pollTimer = null;
+            }
+            subscribers.length = 0;
+            await client.quit();
+        },
+    };
+}
+//# sourceMappingURL=queue.js.map

package/dist/events/queue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"queue.js","sourceRoot":"","sources":["../../src/events/queue.ts"],"names":[],"mappings":"AAgBA;;;GAGG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,WAAW,GAAsD,EAAE,CAAC;IAC1E,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,MAAM,OAAO,GAAoB,EAAE,CAAC;IAEpC,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,QAAuB;YACnC,IAAI,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;YAC/C,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE,CAAC;gBAClC,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;oBACrC,uCAAuC;gBACzC,CAAC,CAAC,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,SAAS,CAAC,OAAmD;YAC3D,IAAI,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;YAC/C,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1B,OAAO,GAAG,EAAE;gBACV,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBACzC,IAAI,GAAG,KAAK,CAAC,CAAC;oBAAE,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC7C,CAAC,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,KAAK;YACT,MAAM,GAAG,IAAI,CAAC;YACd,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAClC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;QACzB,CAAC;KACF,CAAC;AACJ,CAAC;AAkCD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAmB,EACnB,MAAkC;IAElC,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,IAAI,gBAAgB,CAAC;IAClD,MAAM,cAAc,GAAG,MAAM,EAAE,cAAc,IAAI,IAAI,CAAC;IACtD,MAAM,QAAQ,GAAG,GAAG,MAAM,UAAU,CAAC;IACrC,MAAM,aAAa,GAAG,GAAG,MAAM,aAAa,CAAC;IAE7C,MAAM,WAAW,GAAsD,EAAE,CAAC;IAC1E,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,SAAS,GAA0C,IAAI,CAAC;IAC5D,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,KAAK,UAAU,QAAQ;QACrB,IAAI,MAAM,IAAI,OAAO,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC1D,OAAO,GAAG,IAAI,CAAC;QAEf,IAAI,CAAC;YACH,sDAAsD;YACtD,IAAI,GAAG,GAAkB,IAAI,CAAC;YAC9B,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBACrB,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;YACxD,CAAC;iBAAM,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC7B,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;YAC5D,CAAC;YAED,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO,GAAG,KAAK,CAAC;gBAChB,OAAO;YACT,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAC;YAClD,sBAAsB;YACtB,IAAI,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;gBAC5C,QAAQ,CAAC,UAAU,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YACtD,CAAC;YAED,6BAA6B;YAC7B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAE1F,gEAAgE;YAChE,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC;YACjE,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,oDAAoD;QACtD,CAAC;gBAAS,CAAC;YACT,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;IACH,CAAC;IAED,SAAS,YAAY;QACnB,IAAI,SAAS;YAAE,OAAO;QACtB,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;YAC3B,KAAK,QAAQ,EAAE,CAAC;QAClB,CAAC,EAAE,cAAc,CAAC,CAAC;IACrB,CAAC;IAED,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,QAAuB;YACnC,IAAI,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;YAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YAC5C,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC3C,CAAC;QAED,SAAS,CAAC,OAAmD;YAC3D,IAAI,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;YAC/C,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1B,YAAY,EAAE,CAAC;YACf,OAAO,GAAG,EAAE;gBACV,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBACzC,IAAI,GAAG,KAAK,CAAC,CAAC;oBAAE,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBAC3C,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,EAAE,CAAC;oBAC1C,aAAa,CAAC,SAAS,CAAC,CAAC;oBACzB,SAAS,GAAG,IAAI,CAAC;gBACnB,CAAC;YACH,CAAC,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,KAAK;YACT,MAAM,GAAG,IAAI,CAAC;YACd,IAAI,SAAS,EAAE,CAAC;gBACd,aAAa,CAAC,SAAS,CAAC,CAAC;gBACzB,SAAS,GAAG,IAAI,CAAC;YACnB,CAAC;YACD,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;YACvB,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/events/registry.d.ts

@@ -0,0 +1,36 @@
+import type { EventDefinition } from '../types/event.js';
+/**
+ * Registry that holds all discovered/registered event definitions,
+ * indexed by name (and optionally version) for schema validation
+ * during emission and consumer routing.
+ */
+export declare class EventRegistry {
+    private events;
+    /**
+     * Register an event definition. Throws on duplicate names.
+     * Stores under both the plain name and the versioned key (name@version).
+     */
+    register(event: EventDefinition): void;
+    /**
+     * Register multiple event definitions at once.
+     */
+    registerAll(events: EventDefinition[]): void;
+    /**
+     * Get an event definition by name (and optional version).
+     */
+    get(name: string, version?: string): EventDefinition | undefined;
+    /**
+     * Check if an event is registered.
+     */
+    has(name: string, version?: string): boolean;
+    /**
+     * Return all registered event definitions.
+     */
+    getAll(): EventDefinition[];
+    /**
+     * Return all events for a specific domain.
+     */
+    getByDomain(domain: string): EventDefinition[];
+    private key;
+}
+//# sourceMappingURL=registry.d.ts.map

package/dist/events/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/events/registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEzD;;;;GAIG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,MAAM,CAAsC;IAEpD;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI;IAYtC;;OAEG;IACH,WAAW,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,IAAI;IAM5C;;OAEG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS;IAIhE;;OAEG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO;IAI5C;;OAEG;IACH,MAAM,IAAI,eAAe,EAAE;IAI3B;;OAEG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,EAAE;IAI9C,OAAO,CAAC,GAAG;CAGZ"}

package/dist/events/registry.js

@@ -0,0 +1,59 @@
+/**
+ * Registry that holds all discovered/registered event definitions,
+ * indexed by name (and optionally version) for schema validation
+ * during emission and consumer routing.
+ */
+export class EventRegistry {
+    events = new Map();
+    /**
+     * Register an event definition. Throws on duplicate names.
+     * Stores under both the plain name and the versioned key (name@version).
+     */
+    register(event) {
+        const key = this.key(event.name, event.version);
+        if (this.events.has(key)) {
+            throw new Error(`Event "${key}" is already registered`);
+        }
+        this.events.set(key, event);
+        // Also store under the plain name for version-agnostic lookups
+        if (event.version && !this.events.has(event.name)) {
+            this.events.set(event.name, event);
+        }
+    }
+    /**
+     * Register multiple event definitions at once.
+     */
+    registerAll(events) {
+        for (const event of events) {
+            this.register(event);
+        }
+    }
+    /**
+     * Get an event definition by name (and optional version).
+     */
+    get(name, version) {
+        return this.events.get(this.key(name, version));
+    }
+    /**
+     * Check if an event is registered.
+     */
+    has(name, version) {
+        return this.events.has(this.key(name, version));
+    }
+    /**
+     * Return all registered event definitions.
+     */
+    getAll() {
+        return Array.from(this.events.values());
+    }
+    /**
+     * Return all events for a specific domain.
+     */
+    getByDomain(domain) {
+        return this.getAll().filter((e) => e.domain === domain);
+    }
+    key(name, version) {
+        return version ? `${name}@${version}` : name;
+    }
+}
+//# sourceMappingURL=registry.js.map

package/dist/events/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/events/registry.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,OAAO,aAAa;IAChB,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;IAEpD;;;OAGG;IACH,QAAQ,CAAC,KAAsB;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,UAAU,GAAG,yBAAyB,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5B,+DAA+D;QAC/D,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,MAAyB;QACnC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,IAAY,EAAE,OAAgB;QAChC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,IAAY,EAAE,OAAgB;QAChC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,MAAc;QACxB,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAC1D,CAAC;IAEO,GAAG,CAAC,IAAY,EAAE,OAAgB;QACxC,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,CAAC;CACF"}

package/dist/events/worker.d.ts

@@ -0,0 +1,34 @@
+import type { PostgresJsDatabase } from 'drizzle-orm/postgres-js';
+import type { EventEnvelope } from '../types/event.js';
+import type { ConsumerRegistry } from './consumer-registry.js';
+import type { IdempotencyService } from './idempotency.js';
+import type { EventQueue } from './queue.js';
+export interface WorkerConfig {
+    db: PostgresJsDatabase;
+    queue: EventQueue;
+    consumers: ConsumerRegistry;
+    idempotency: IdempotencyService;
+    /** Default max retries per consumer (default: 3) */
+    defaultMaxRetries?: number;
+    /** Base delay in ms for exponential backoff between retries (default: 100) */
+    retryBackoffBaseMs?: number;
+    /** Max backoff delay in ms (default: 5000) */
+    retryBackoffMaxMs?: number;
+}
+/**
+ * Creates an event delivery worker that subscribes to the queue,
+ * routes events to registered consumers with idempotency checks,
+ * and dead-letters events that exhaust retries.
+ *
+ * Returns start/stop controls.
+ */
+export declare function createEventWorker(config: WorkerConfig): {
+    /** Process a single envelope (useful for testing) */
+    deliver: (envelope: EventEnvelope) => Promise<void>;
+    /** Start subscribing to the queue */
+    start(): void;
+    /** Stop the worker */
+    stop(): void;
+    readonly isRunning: boolean;
+};
+//# sourceMappingURL=worker.d.ts.map

package/dist/events/worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../../src/events/worker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,kBAAkB,CAAC;IACvB,KAAK,EAAE,UAAU,CAAC;IAClB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,WAAW,EAAE,kBAAkB,CAAC;IAChC,oDAAoD;IACpD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,8EAA8E;IAC9E,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,8CAA8C;IAC9C,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,YAAY;IA0ElD,qDAAqD;wBAlDtB,aAAa,KAAG,OAAO,CAAC,IAAI,CAAC;IAqD5D,qCAAqC;aAC5B,IAAI;IAKb,sBAAsB;YACd,IAAI;wBAOK,OAAO;EAI3B"}

package/dist/events/worker.js

@@ -0,0 +1,88 @@
+import { deadLetterTable } from './outbox.js';
+/**
+ * Creates an event delivery worker that subscribes to the queue,
+ * routes events to registered consumers with idempotency checks,
+ * and dead-letters events that exhaust retries.
+ *
+ * Returns start/stop controls.
+ */
+export function createEventWorker(config) {
+    const { db, queue, consumers, idempotency, defaultMaxRetries = 3, retryBackoffBaseMs = 100, retryBackoffMaxMs = 5000, } = config;
+    let unsubscribe = null;
+    /** Compute exponential backoff with jitter */
+    function computeRetryDelay(attempt) {
+        const base = Math.min(retryBackoffBaseMs * 2 ** attempt, retryBackoffMaxMs);
+        // Add jitter: random value between 0 and base
+        return base + Math.floor(Math.random() * base * 0.5);
+    }
+    function sleep(ms) {
+        return new Promise((resolve) => setTimeout(resolve, ms));
+    }
+    async function deliver(envelope) {
+        const matched = consumers.getConsumers(envelope.eventType, envelope.version);
+        for (const consumer of matched) {
+            const maxRetries = consumer.maxRetries ?? defaultMaxRetries;
+            // Idempotency guard
+            const alreadyProcessed = await idempotency.isProcessed(envelope.id, consumer.id);
+            if (alreadyProcessed)
+                continue;
+            let lastError;
+            let attempt = 0;
+            let succeeded = false;
+            while (attempt < maxRetries && !succeeded) {
+                attempt++;
+                try {
+                    await consumer.handler(envelope);
+                    succeeded = true;
+                }
+                catch (err) {
+                    lastError = err instanceof Error ? err.message : String(err);
+                    if (attempt < maxRetries) {
+                        await sleep(computeRetryDelay(attempt - 1));
+                    }
+                }
+            }
+            if (succeeded) {
+                await idempotency.markProcessed(envelope.id, consumer.id);
+            }
+            else {
+                // Dead-letter
+                await db.insert(deadLetterTable).values({
+                    eventId: envelope.id,
+                    eventType: envelope.eventType,
+                    payload: envelope.payload,
+                    consumerId: consumer.id,
+                    lastError: lastError ?? 'Unknown error',
+                    retryCount: String(attempt),
+                    metadata: {
+                        correlationId: envelope.correlationId,
+                        causationId: envelope.causationId,
+                        actor: envelope.actor,
+                        tenantId: envelope.tenantId,
+                    },
+                });
+            }
+        }
+    }
+    return {
+        /** Process a single envelope (useful for testing) */
+        deliver,
+        /** Start subscribing to the queue */
+        start() {
+            if (unsubscribe)
+                return;
+            unsubscribe = queue.subscribe(deliver);
+        },
+        /** Stop the worker */
+        stop() {
+            if (unsubscribe) {
+                unsubscribe();
+                unsubscribe = null;
+            }
+        },
+        get isRunning() {
+            return unsubscribe !== null;
+        },
+    };
+}
+//# sourceMappingURL=worker.js.map

package/dist/events/worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.js","sourceRoot":"","sources":["../../src/events/worker.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAgB9C;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAoB;IACpD,MAAM,EACJ,EAAE,EACF,KAAK,EACL,SAAS,EACT,WAAW,EACX,iBAAiB,GAAG,CAAC,EACrB,kBAAkB,GAAG,GAAG,EACxB,iBAAiB,GAAG,IAAI,GACzB,GAAG,MAAM,CAAC;IAEX,IAAI,WAAW,GAAwB,IAAI,CAAC;IAE5C,8CAA8C;IAC9C,SAAS,iBAAiB,CAAC,OAAe;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,GAAG,CAAC,IAAI,OAAO,EAAE,iBAAiB,CAAC,CAAC;QAC5E,8CAA8C;QAC9C,OAAO,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,GAAG,GAAG,CAAC,CAAC;IACvD,CAAC;IAED,SAAS,KAAK,CAAC,EAAU;QACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,QAAuB;QAC5C,MAAM,OAAO,GAAG,SAAS,CAAC,YAAY,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAE7E,KAAK,MAAM,QAAQ,IAAI,OAAO,EAAE,CAAC;YAC/B,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,IAAI,iBAAiB,CAAC;YAE5D,oBAAoB;YACpB,MAAM,gBAAgB,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;YACjF,IAAI,gBAAgB;gBAAE,SAAS;YAE/B,IAAI,SAA6B,CAAC;YAClC,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,IAAI,SAAS,GAAG,KAAK,CAAC;YAEtB,OAAO,OAAO,GAAG,UAAU,IAAI,CAAC,SAAS,EAAE,CAAC;gBAC1C,OAAO,EAAE,CAAC;gBACV,IAAI,CAAC;oBACH,MAAM,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;oBACjC,SAAS,GAAG,IAAI,CAAC;gBACnB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,SAAS,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC7D,IAAI,OAAO,GAAG,UAAU,EAAE,CAAC;wBACzB,MAAM,KAAK,CAAC,iBAAiB,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;oBAC9C,CAAC;gBACH,CAAC;YACH,CAAC;YAED,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,WAAW,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC5D,CAAC;iBAAM,CAAC;gBACN,cAAc;gBACd,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC;oBACtC,OAAO,EAAE,QAAQ,CAAC,EAAE;oBACpB,SAAS,EAAE,QAAQ,CAAC,SAAS;oBAC7B,OAAO,EAAE,QAAQ,CAAC,OAAc;oBAChC,UAAU,EAAE,QAAQ,CAAC,EAAE;oBACvB,SAAS,EAAE,SAAS,IAAI,eAAe;oBACvC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC;oBAC3B,QAAQ,EAAE;wBACR,aAAa,EAAE,QAAQ,CAAC,aAAa;wBACrC,WAAW,EAAE,QAAQ,CAAC,WAAW;wBACjC,KAAK,EAAE,QAAQ,CAAC,KAAK;wBACrB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;qBAC5B;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,qDAAqD;QACrD,OAAO;QAEP,qCAAqC;QACrC,KAAK;YACH,IAAI,WAAW;gBAAE,OAAO;YACxB,WAAW,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC;QAED,sBAAsB;QACtB,IAAI;YACF,IAAI,WAAW,EAAE,CAAC;gBAChB,WAAW,EAAE,CAAC;gBACd,WAAW,GAAG,IAAI,CAAC;YACrB,CAAC;QACH,CAAC;QAED,IAAI,SAAS;YACX,OAAO,WAAW,KAAK,IAAI,CAAC;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/execution/__tests__/authorization.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=authorization.test.d.ts.map

package/dist/execution/__tests__/authorization.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.test.d.ts","sourceRoot":"","sources":["../../../src/execution/__tests__/authorization.test.ts"],"names":[],"mappings":""}

package/dist/execution/__tests__/authorization.test.js

@@ -0,0 +1,88 @@
+import { describe, expect, it } from 'vitest';
+import { evaluateAccess } from '../authorization.js';
+function makeAuth(overrides = {}) {
+    return {
+        userId: 'user-1',
+        roles: ['editor'],
+        scopes: ['read', 'write'],
+        provider: 'test',
+        tenantId: 'tenant-1',
+        ...overrides,
+    };
+}
+describe('evaluateAccess', () => {
+    it('denies when no policy is provided', () => {
+        const result = evaluateAccess(undefined, makeAuth());
+        expect(result.allowed).toBe(false);
+        expect(result.reason).toContain('No access policy');
+    });
+    it('allows public capabilities without authentication', () => {
+        const policy = { public: true };
+        const result = evaluateAccess(policy, makeAuth({ userId: undefined }));
+        expect(result.allowed).toBe(true);
+    });
+    it('denies unauthenticated non-public access', () => {
+        const policy = { roles: ['admin'] };
+        const result = evaluateAccess(policy, makeAuth({ userId: undefined }));
+        expect(result.allowed).toBe(false);
+        expect(result.reason).toContain('Authentication required');
+    });
+    it('allows when caller has a required role', () => {
+        const policy = { roles: ['editor', 'admin'] };
+        const result = evaluateAccess(policy, makeAuth({ roles: ['editor'] }));
+        expect(result.allowed).toBe(true);
+    });
+    it('denies when caller lacks required roles', () => {
+        const policy = { roles: ['admin'] };
+        const result = evaluateAccess(policy, makeAuth({ roles: ['viewer'] }));
+        expect(result.allowed).toBe(false);
+        expect(result.reason).toContain('Required roles');
+    });
+    it('allows when caller has all required scopes', () => {
+        const policy = { scopes: ['read', 'write'] };
+        const result = evaluateAccess(policy, makeAuth({ scopes: ['read', 'write', 'delete'] }));
+        expect(result.allowed).toBe(true);
+    });
+    it('denies when caller is missing a required scope', () => {
+        const policy = { scopes: ['read', 'admin'] };
+        const result = evaluateAccess(policy, makeAuth({ scopes: ['read'] }));
+        expect(result.allowed).toBe(false);
+        expect(result.reason).toContain('Missing scopes: admin');
+    });
+    it('denies tenant-scoped access without tenantId', () => {
+        const policy = { tenantScoped: true };
+        const result = evaluateAccess(policy, makeAuth({ tenantId: undefined }));
+        expect(result.allowed).toBe(false);
+        expect(result.reason).toContain('Tenant context required');
+    });
+    it('allows tenant-scoped access with tenantId', () => {
+        const policy = { tenantScoped: true };
+        const result = evaluateAccess(policy, makeAuth({ tenantId: 't-1' }));
+        expect(result.allowed).toBe(true);
+    });
+    it('allows recognized service accounts', () => {
+        const policy = {
+            serviceAccounts: ['svc-worker'],
+            roles: ['admin'],
+        };
+        const result = evaluateAccess(policy, makeAuth({ userId: 'svc-worker', roles: [] }));
+        expect(result.allowed).toBe(true);
+    });
+    it('falls through to role check for non-service accounts', () => {
+        const policy = {
+            serviceAccounts: ['svc-worker'],
+            roles: ['admin'],
+        };
+        const result = evaluateAccess(policy, makeAuth({ userId: 'regular-user', roles: ['viewer'] }));
+        expect(result.allowed).toBe(false);
+    });
+    it('allows when both roles and scopes match', () => {
+        const policy = {
+            roles: ['editor'],
+            scopes: ['write'],
+        };
+        const result = evaluateAccess(policy, makeAuth({ roles: ['editor'], scopes: ['read', 'write'] }));
+        expect(result.allowed).toBe(true);
+    });
+});
+//# sourceMappingURL=authorization.test.js.map

package/dist/execution/__tests__/authorization.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.test.js","sourceRoot":"","sources":["../../../src/execution/__tests__/authorization.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,SAAS,QAAQ,CAAC,YAAkC,EAAE;IACpD,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE,CAAC,QAAQ,CAAC;QACjB,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;QACzB,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,UAAU;QACpB,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,MAAM,GAAiB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QACvE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,MAAM,GAAiB,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QACvE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,MAAM,GAAiB,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QACvE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,MAAM,GAAiB,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QACvE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,MAAM,GAAiB,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QACzF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,MAAM,GAAiB,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QACtE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,MAAM,GAAiB,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QACzE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,MAAM,GAAiB,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,MAAM,GAAiB;YAC3B,eAAe,EAAE,CAAC,YAAY,CAAC;YAC/B,KAAK,EAAE,CAAC,OAAO,CAAC;SACjB,CAAC;QACF,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QACrF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,MAAM,GAAiB;YAC3B,eAAe,EAAE,CAAC,YAAY,CAAC;YAC/B,KAAK,EAAE,CAAC,OAAO,CAAC;SACjB,CAAC;QACF,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/F,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,MAAM,GAAiB;YAC3B,KAAK,EAAE,CAAC,QAAQ,CAAC;YACjB,MAAM,EAAE,CAAC,OAAO,CAAC;SAClB,CAAC;QACF,MAAM,MAAM,GAAG,cAAc,CAC3B,MAAM,EACN,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAC3D,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/execution/__tests__/capability-executor.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=capability-executor.test.d.ts.map

package/dist/execution/__tests__/capability-executor.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-executor.test.d.ts","sourceRoot":"","sources":["../../../src/execution/__tests__/capability-executor.test.ts"],"names":[],"mappings":""}