meyi-marketplace-onboarding-dev 1.0.0

package/README.md

@@ -0,0 +1,62 @@
+# Marketplace Onboarding
+
+Reusable AWS Marketplace customer-onboarding npm module. The API, migrations,
+application adapters, static UI, and CloudFormation templates ship as one package.
+
+```text
+marketplace-onboarding/
+|-- onboarding-service/  Express API, application adapters, AWS orchestration, and migrations
+|-- onboarding-ui/       Static onboarding pages, assets, and CloudFormation templates
+|-- package.json         meyi-marketplace-onboarding package definition
+`-- README.md
+```
+
+The package is import-safe: importing it does not start a server, run migrations,
+or schedule jobs. A host application opts into those operations through the
+exported API. The same source remains deployable as the standalone
+`meyiconnect/customer-onboarding` Docker image.
+
+## Build And Verify
+
+```bash
+cd marketplace-onboarding
+npm run typecheck
+npm run check:applications
+```
+
+The UI has no build step. Validate its JavaScript modules from the repository root:
+
+```bash
+node --check marketplace-onboarding/onboarding-ui/assets/js/main.js
+```
+
+Build the combined image from this directory:
+
+```bash
+cd marketplace-onboarding
+docker build -t meyiconnect/customer-onboarding:dev .
+```
+
+Inside the image, the UI is served under `/marketplace/ui` and
+`/customer-onboarding/ui`.
+
+## Use In Meyi Connect
+
+Build the package and install its direct sibling dependency in Meyi Connect:
+
+```bash
+cd marketplace-onboarding
+npm run build
+cd ../../meyi-connect/backend
+npm install
+```
+
+Meyi Connect mounts `marketplaceNotificationParser()` before its global body
+parser, runs `runMarketplaceMigrations()`, mounts `createMarketplaceRouter()`,
+and starts `startMarketplaceJobs()` after the HTTP server starts. The bundled UI
+is served by the router, so the Meyi Connect frontend does not need a second npm
+dependency.
+
+Marketplace onboarding enables automatically when the product code and both SNS
+topic ARNs are present. `DATABASE_URL`, `JWT_SECRET`, `AWS_REGION`,
+`FRONTEND_URL`, and `MARKETPLACE_ADMIN_SECRET` are also required once enabled.

package/onboarding-service/README.md

@@ -0,0 +1,115 @@
+# Marketplace Onboarding
+
+Reusable AWS Marketplace registration and customer-onboarding service. The repository currently registers the **Meyi Connect** application, while the service and UI select application-specific behavior through a `MarketplaceApplication` adapter.
+
+## Reuse Decision
+
+`onboarding-ui` is the customer-onboarding UI and `onboarding-service` is its API. Meyi Connect should use this existing flow.
+
+- Do not create separate `setup-ui` or `setup-api` projects.
+- Keep shared Marketplace registration, verification, password, plugin selection, and AWS orchestration in this repository.
+- Put application-specific product identity, plugin rules, AWS template settings, tenant provisioning, and destination URLs in an application adapter.
+- Existing records are assigned to `meyi-connect` by migration `0016_marketplace_applications.sql`, preserving the current flow.
+
+## Architecture
+
+```text
+AWS Marketplace registration / SNS notifications
+                    |
+                    v
+          onboarding-service routes
+                    |
+                    v
+       MarketplaceApplication registry
+                    |
+          +---------+---------+
+          |                   |
+  Meyi Connect adapter    future app adapter
+          |
+          +-- product and plugin catalog
+          +-- AWS role, StackSet, and template settings
+          +-- tenant provisioning and plugin persistence
+          +-- sign-in and dashboard URLs
+
+onboarding-ui -- GET /marketplace/application-config --> selected adapter
+```
+
+The shared database rows carry `application_id` on marketplace customers, events, onboarding sessions, and AWS connections. Customer identity is unique per `(application_id, aws_customer_identifier)` so another product cannot collide with Meyi Connect.
+
+## Current Application
+
+| Setting | Value |
+|---|---|
+| Application ID | `meyi-connect` |
+| Product ID | `prod-2wjamdfmjqg66` |
+| Adapter | `src/applications/meyi-connect/config.ts` |
+| Plugin catalog | `src/applications/meyi-connect/plugin-config.ts` |
+| AWS settings | `src/applications/meyi-connect/aws-config.ts` |
+| Provisioning | `src/applications/meyi-connect/provisioner.ts` |
+
+Meyi Connect retains its current plugin behavior: Pulse is required and visible, Insight is selected by default, Cost is opt-in, and Access is a required backend capability hidden from the selection screen.
+
+## Add Another Application
+
+1. Create `src/applications/<application-id>/` with configuration, plugin normalization, and a provisioner implementing `MarketplaceApplication` from `src/applications/types.ts`.
+2. Register the adapter in `src/applications/registry.ts`.
+3. Add product-specific environment variables and SNS topic validation when the new AWS Marketplace product is configured.
+4. Add any product-specific CloudFormation template under `iam/` and point the adapter's `templatePath` to it.
+5. Test registration, onboarding resume, plugin persistence, AWS connection creation, provisioning, and dashboard redirect for both applications.
+
+Adding an adapter does not require cloning the UI or API. Open the UI with `?application=<application-id>` when no Marketplace session determines the application.
+
+## API
+
+| Method | Path | Description |
+|---|---|---|
+| GET | `/marketplace/health` | Runtime health and AWS deployment settings |
+| GET | `/marketplace/application-config` | Public configuration for the default application |
+| GET | `/marketplace/application-config?applicationId=<id>` | Public configuration for a registered application |
+| GET/POST | `/marketplace/register` | AWS Marketplace redirect handler |
+| POST | `/marketplace/notifications` | SNS webhook with signature validation |
+| GET | `/marketplace/subscription` | Authenticated subscription details |
+| POST | `/marketplace/onboarding` | Create an application-scoped onboarding session |
+| POST | `/marketplace/api/aws/connect` | Create an application-scoped AWS connection |
+| POST | `/marketplace/sync` | Admin subscription synchronization |
+
+## Configuration
+
+```env
+MARKETPLACE_DEFAULT_APPLICATION_ID=meyi-connect
+MARKETPLACE_APP_NAME=Meyi Connect
+AWS_MARKETPLACE_PRODUCT_CODE=<seller-product-code>
+AWS_MARKETPLACE_PRODUCT_ID=prod-2wjamdfmjqg66
+AWS_MARKETPLACE_SUBSCRIPTION_TOPIC_ARN=<subscription-topic-arn>
+AWS_MARKETPLACE_ENTITLEMENT_TOPIC_ARN=<entitlement-topic-arn>
+APP_URL=http://localhost:5173
+DATABASE_URL=<postgres-connection-string>
+JWT_SECRET=<shared-jwt-secret>
+```
+
+See the repository `.env.example` for the full list. Never commit real credentials or admin secrets.
+
+## Build And Run
+
+```bash
+cd marketplace-onboarding/onboarding-service
+npm install
+npm run typecheck
+npm run check:applications
+npm run db:migrate
+npm start
+```
+
+The service listens on `PORT` or `MARKETPLACE_SERVICE_PORT` (default `3020`). The Docker image copies `onboarding-ui` into the service and exposes the onboarding page through the configured `/marketplace` or `/customer-onboarding` base path.
+
+## Migration
+
+Run `npm run db:migrate` before deploying this version. Migration `0016_marketplace_applications.sql` backfills all existing rows to `meyi-connect`, makes `application_id` required, and replaces the old globally unique customer identifier index with an application-scoped unique index.
+
+## Security
+
+- Marketplace product identity is resolved server-side from AWS product codes.
+- Client-supplied application IDs are checked against the registry and against persisted onboarding sessions.
+- SNS signatures are validated before notification processing.
+- Plans are sourced from AWS entitlements, never from client input.
+- JWT verification allows only `HS256` and uses the shared application secret.

package/onboarding-service/dist/applications/meyi-connect/aws-config.d.ts

@@ -0,0 +1,3 @@
+import type { ApplicationAwsConfig } from '../types';
+export declare const meyiConnectAwsConfig: ApplicationAwsConfig;
+//# sourceMappingURL=aws-config.d.ts.map

package/onboarding-service/dist/applications/meyi-connect/aws-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-config.d.ts","sourceRoot":"","sources":["../../../src/applications/meyi-connect/aws-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAIrD,eAAO,MAAM,oBAAoB,EAAE,oBAOlC,CAAC"}

package/onboarding-service/dist/applications/meyi-connect/aws-config.js

@@ -0,0 +1,17 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.meyiConnectAwsConfig = void 0;
+const path_1 = __importDefault(require("path"));
+const paths_1 = require("../../paths");
+exports.meyiConnectAwsConfig = {
+    defaultRoleName: 'MeyiConnectOnboardingRole',
+    stackSetPrefix: 'MeyiConnect',
+    downloadFilePrefix: 'meyi-connect-stackset',
+    managedByTag: 'MeyiConnect',
+    templatePath: path_1.default.join((0, paths_1.getMarketplaceUiDirectory)(), 'templates', 'aws-onboarding-stackset.yaml'),
+    sessionNamePrefix: 'MeyiConnect',
+};
+//# sourceMappingURL=aws-config.js.map

package/onboarding-service/dist/applications/meyi-connect/aws-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-config.js","sourceRoot":"","sources":["../../../src/applications/meyi-connect/aws-config.ts"],"names":[],"mappings":";;;;;;AACA,gDAAwB;AACxB,uCAAwD;AAE3C,QAAA,oBAAoB,GAAyB;IACxD,eAAe,EAAE,2BAA2B;IAC5C,cAAc,EAAE,aAAa;IAC7B,kBAAkB,EAAE,uBAAuB;IAC3C,YAAY,EAAE,aAAa;IAC3B,YAAY,EAAE,cAAI,CAAC,IAAI,CAAC,IAAA,iCAAyB,GAAE,EAAE,WAAW,EAAE,8BAA8B,CAAC;IACjG,iBAAiB,EAAE,aAAa;CACjC,CAAC"}

package/onboarding-service/dist/applications/meyi-connect/config.d.ts

@@ -0,0 +1,3 @@
+import type { MarketplaceApplication } from '../types';
+export declare function createMeyiConnectApplication(): MarketplaceApplication;
+//# sourceMappingURL=config.d.ts.map

package/onboarding-service/dist/applications/meyi-connect/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/applications/meyi-connect/config.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AASvD,wBAAgB,4BAA4B,IAAI,sBAAsB,CA8BrE"}

package/onboarding-service/dist/applications/meyi-connect/config.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMeyiConnectApplication = createMeyiConnectApplication;
+const utils_1 = require("../../modules/marketplace/utils");
+const aws_config_1 = require("./aws-config");
+const plugin_config_1 = require("./plugin-config");
+const provisioner_1 = require("./provisioner");
+function createMeyiConnectApplication() {
+    const application = {
+        id: 'meyi-connect',
+        name: process.env.MARKETPLACE_APP_NAME || 'Meyi Connect',
+        productCode: process.env.AWS_MARKETPLACE_PRODUCT_CODE || '',
+        productId: process.env.AWS_MARKETPLACE_PRODUCT_ID || '',
+        databaseSchema: 'meyiconnect',
+        aws: aws_config_1.meyiConnectAwsConfig,
+        plugins: plugin_config_1.meyiConnectPlugins,
+        normalizeOnboardingPlugins: plugin_config_1.normalizeMeyiConnectOnboardingPlugins,
+        normalizePlugins: plugin_config_1.normalizeMeyiConnectPlugins,
+        provisionTenant: provisioner_1.provisionMeyiConnectTenant,
+        syncTenantPlugins: provisioner_1.syncMeyiConnectTenantPlugins,
+        signInUrl: utils_1.appSignInUrl,
+        onboardingCompleteUrl: (workspaceName) => `${process.env.FRONTEND_URL || ''}/ui/login.html?provisioned=1&workspace=${encodeURIComponent(workspaceName)}`,
+        dashboardUrl: utils_1.appBaseUrl,
+        toPublicConfig: () => ({
+            id: application.id,
+            name: application.name,
+            productId: application.productId,
+            loginUrl: application.signInUrl(),
+            dashboardUrl: application.dashboardUrl(),
+            awsRoleName: application.aws.defaultRoleName,
+            downloadFilePrefix: application.aws.downloadFilePrefix,
+            features: { awsOrganization: true },
+            plugins: application.plugins,
+        }),
+    };
+    return application;
+}
+//# sourceMappingURL=config.js.map

package/onboarding-service/dist/applications/meyi-connect/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/applications/meyi-connect/config.ts"],"names":[],"mappings":";;AAUA,oEA8BC;AAxCD,2DAA2E;AAE3E,6CAAoD;AACpD,mDAIyB;AACzB,+CAAyF;AAEzF,SAAgB,4BAA4B;IAC1C,MAAM,WAAW,GAA2B;QAC1C,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,cAAc;QACxD,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,EAAE;QAC3D,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,EAAE;QACvD,cAAc,EAAE,aAAa;QAC7B,GAAG,EAAE,iCAAoB;QACzB,OAAO,EAAE,kCAAkB;QAC3B,0BAA0B,EAAE,qDAAqC;QACjE,gBAAgB,EAAE,2CAA2B;QAC7C,eAAe,EAAE,wCAA0B;QAC3C,iBAAiB,EAAE,0CAA4B;QAC/C,SAAS,EAAE,oBAAY;QACvB,qBAAqB,EAAE,CAAC,aAAa,EAAE,EAAE,CACvC,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,0CAA0C,kBAAkB,CAAC,aAAa,CAAC,EAAE;QAChH,YAAY,EAAE,kBAAU;QACxB,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;YACrB,EAAE,EAAE,WAAW,CAAC,EAAE;YAClB,IAAI,EAAE,WAAW,CAAC,IAAI;YACtB,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,QAAQ,EAAE,WAAW,CAAC,SAAS,EAAE;YACjC,YAAY,EAAE,WAAW,CAAC,YAAY,EAAE;YACxC,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,eAAe;YAC5C,kBAAkB,EAAE,WAAW,CAAC,GAAG,CAAC,kBAAkB;YACtD,QAAQ,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE;YACnC,OAAO,EAAE,WAAW,CAAC,OAAO;SAC7B,CAAC;KACH,CAAC;IACF,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/onboarding-service/dist/applications/meyi-connect/plugin-config.d.ts

@@ -0,0 +1,6 @@
+import type { ApplicationPlugin } from '../types';
+export declare const meyiConnectPlugins: ApplicationPlugin[];
+export declare function normalizeMeyiConnectOnboardingPlugins(plugins: unknown): string[];
+export declare function normalizeMeyiConnectPersistedPlugins(plugins: unknown): string[];
+export declare function normalizeMeyiConnectPlugins(plugins: unknown): string[];
+//# sourceMappingURL=plugin-config.d.ts.map

package/onboarding-service/dist/applications/meyi-connect/plugin-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-config.d.ts","sourceRoot":"","sources":["../../../src/applications/meyi-connect/plugin-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAElD,eAAO,MAAM,kBAAkB,EAAE,iBAAiB,EAiCjD,CAAC;AAEF,wBAAgB,qCAAqC,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,CAMhF;AAED,wBAAgB,oCAAoC,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,CAY/E;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,CAUtE"}

package/onboarding-service/dist/applications/meyi-connect/plugin-config.js

@@ -0,0 +1,70 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.meyiConnectPlugins = void 0;
+exports.normalizeMeyiConnectOnboardingPlugins = normalizeMeyiConnectOnboardingPlugins;
+exports.normalizeMeyiConnectPersistedPlugins = normalizeMeyiConnectPersistedPlugins;
+exports.normalizeMeyiConnectPlugins = normalizeMeyiConnectPlugins;
+exports.meyiConnectPlugins = [
+    {
+        id: 'Pulse',
+        label: 'Pulse',
+        description: 'Infrastructure health, operational signals & uptime monitoring. Always on.',
+        required: true,
+        defaultEnabled: true,
+        persistedName: 'pulse',
+    },
+    {
+        id: 'Insight',
+        label: 'Insight',
+        description: 'Cloud asset inventory, misconfiguration detection, CIS checks & topology.',
+        required: false,
+        defaultEnabled: true,
+        persistedName: 'insight',
+    },
+    {
+        id: 'Cost',
+        label: 'Cost',
+        description: 'Spend anomalies, budgets, and AWS Cost & Usage reporting.',
+        required: false,
+        defaultEnabled: false,
+        persistedName: 'cost',
+    },
+    {
+        id: 'Access',
+        label: 'Access',
+        description: 'Core access-management capability.',
+        required: true,
+        defaultEnabled: true,
+        visible: false,
+    },
+];
+function normalizeMeyiConnectOnboardingPlugins(plugins) {
+    const requested = Array.isArray(plugins)
+        ? plugins.filter((plugin) => typeof plugin === 'string')
+        : [];
+    const allowed = new Set([...exports.meyiConnectPlugins.map((plugin) => plugin.id), 'Security']);
+    return [...new Set([...requested, 'Pulse'])].filter((plugin) => allowed.has(plugin));
+}
+function normalizeMeyiConnectPersistedPlugins(plugins) {
+    const requested = Array.isArray(plugins)
+        ? plugins.filter((plugin) => typeof plugin === 'string')
+        : [];
+    const normalized = new Set(requested.map((plugin) => {
+        const lower = plugin.toLowerCase();
+        return lower === 'security' ? 'insight' : lower;
+    }));
+    normalized.add('pulse');
+    return exports.meyiConnectPlugins
+        .flatMap((plugin) => plugin.persistedName ? [plugin.persistedName] : [])
+        .filter((plugin) => normalized.has(plugin));
+}
+function normalizeMeyiConnectPlugins(plugins) {
+    const requested = Array.isArray(plugins)
+        ? plugins.filter((plugin) => typeof plugin === 'string')
+        : [];
+    const expanded = requested.flatMap((plugin) => plugin.toLowerCase() === 'insight' ? ['Insight', 'Security'] : [plugin]);
+    const required = exports.meyiConnectPlugins.filter((plugin) => plugin.required).map((plugin) => plugin.id);
+    const allowed = new Set([...exports.meyiConnectPlugins.map((plugin) => plugin.id), 'Security']);
+    return [...new Set([...expanded, ...required])].filter((plugin) => allowed.has(plugin));
+}
+//# sourceMappingURL=plugin-config.js.map

package/onboarding-service/dist/applications/meyi-connect/plugin-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-config.js","sourceRoot":"","sources":["../../../src/applications/meyi-connect/plugin-config.ts"],"names":[],"mappings":";;;AAqCA,sFAMC;AAED,oFAYC;AAED,kEAUC;AAnEY,QAAA,kBAAkB,GAAwB;IACrD;QACE,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,OAAO;QACd,WAAW,EAAE,4EAA4E;QACzF,QAAQ,EAAE,IAAI;QACd,cAAc,EAAE,IAAI;QACpB,aAAa,EAAE,OAAO;KACvB;IACD;QACE,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,SAAS;QAChB,WAAW,EAAE,2EAA2E;QACxF,QAAQ,EAAE,KAAK;QACf,cAAc,EAAE,IAAI;QACpB,aAAa,EAAE,SAAS;KACzB;IACD;QACE,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,MAAM;QACb,WAAW,EAAE,2DAA2D;QACxE,QAAQ,EAAE,KAAK;QACf,cAAc,EAAE,KAAK;QACrB,aAAa,EAAE,MAAM;KACtB;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,QAAQ;QACf,WAAW,EAAE,oCAAoC;QACjD,QAAQ,EAAE,IAAI;QACd,cAAc,EAAE,IAAI;QACpB,OAAO,EAAE,KAAK;KACf;CACF,CAAC;AAEF,SAAgB,qCAAqC,CAAC,OAAgB;IACpE,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QACtC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC;QAC1E,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,0BAAkB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;IACxF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,SAAgB,oCAAoC,CAAC,OAAgB;IACnE,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QACtC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC;QAC1E,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QAClD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QACnC,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;IAClD,CAAC,CAAC,CAAC,CAAC;IACJ,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACxB,OAAO,0BAAkB;SACtB,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACvE,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,SAAgB,2BAA2B,CAAC,OAAgB;IAC1D,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QACtC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC;QAC1E,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAC5C,MAAM,CAAC,WAAW,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CACxE,CAAC;IACF,MAAM,QAAQ,GAAG,0BAAkB,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACnG,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,0BAAkB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;IACxF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC1F,CAAC"}

package/onboarding-service/dist/applications/meyi-connect/provisioner.d.ts

@@ -0,0 +1,4 @@
+import type { ProvisionTenantResult } from '../types';
+export declare function syncMeyiConnectTenantPlugins(tenantId: string, plugins: string[]): Promise<void>;
+export declare function provisionMeyiConnectTenant(onboardingId: string): Promise<ProvisionTenantResult>;
+//# sourceMappingURL=provisioner.d.ts.map

package/onboarding-service/dist/applications/meyi-connect/provisioner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisioner.d.ts","sourceRoot":"","sources":["../../../src/applications/meyi-connect/provisioner.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAGtD,wBAAsB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBrG;AAED,wBAAsB,0BAA0B,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAqGrG"}

package/onboarding-service/dist/applications/meyi-connect/provisioner.js

@@ -0,0 +1,120 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.syncMeyiConnectTenantPlugins = syncMeyiConnectTenantPlugins;
+exports.provisionMeyiConnectTenant = provisionMeyiConnectTenant;
+const drizzle_orm_1 = require("drizzle-orm");
+const db_1 = require("../../db");
+const schema_1 = require("../../db/schema");
+const utils_1 = require("../../modules/marketplace/utils");
+const plugin_config_1 = require("./plugin-config");
+async function syncMeyiConnectTenantPlugins(tenantId, plugins) {
+    const selected = new Set((0, plugin_config_1.normalizeMeyiConnectPersistedPlugins)(plugins));
+    const db = (0, db_1.getDb)();
+    for (const plugin of plugin_config_1.meyiConnectPlugins.filter((candidate) => candidate.persistedName)) {
+        const pluginName = plugin.persistedName;
+        const isEnabled = selected.has(pluginName);
+        await db.execute((0, drizzle_orm_1.sql) `
+      INSERT INTO meyiconnect.plugins
+        (tenant_id, name, is_installed, is_enabled, is_entitled, provisioned_by, created_at, updated_at)
+      VALUES
+        (${tenantId}::uuid, ${pluginName}, ${isEnabled}, ${isEnabled}, true, 'marketplace', now(), now())
+      ON CONFLICT (tenant_id, name) DO UPDATE SET
+        is_installed = EXCLUDED.is_installed,
+        is_enabled = EXCLUDED.is_enabled,
+        is_entitled = EXCLUDED.is_entitled,
+        provisioned_by = EXCLUDED.provisioned_by,
+        updated_at = now()
+    `);
+    }
+}
+async function provisionMeyiConnectTenant(onboardingId) {
+    const db = (0, db_1.getDb)();
+    const sessions = await db
+        .select()
+        .from(schema_1.onboardingDetails)
+        .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.onboardingDetails.id, onboardingId), (0, drizzle_orm_1.eq)(schema_1.onboardingDetails.applicationId, 'meyi-connect')))
+        .limit(1);
+    const session = sessions[0];
+    if (!session)
+        throw new Error('Meyi Connect onboarding session not found');
+    const workspaceName = session.workspaceName || 'acme';
+    const companyName = session.companyName || 'Acme Inc';
+    const email = session.email || `admin@${workspaceName.toLowerCase().replace(/[^a-z0-9]/g, '')}.com`;
+    const alias = workspaceName.toLowerCase().replace(/[^a-z0-9]/g, '-');
+    const passwordHash = session.permanentPasswordHash || '';
+    if (!passwordHash)
+        throw new Error('Password not found for this onboarding session.');
+    const userLookup = await db.execute((0, drizzle_orm_1.sql) `
+    SELECT id, password_hash FROM meyiconnect.users WHERE lower(email) = lower(${email}) LIMIT 1
+  `);
+    let userId = userLookup.rows[0]?.id || '';
+    const hadPassword = Boolean(userLookup.rows[0]?.password_hash);
+    if (!userId) {
+        const createdUser = await db.execute((0, drizzle_orm_1.sql) `
+      INSERT INTO meyiconnect.users (email, password_hash, full_name, role, is_active, created_at, updated_at, is_confirmed)
+      VALUES (${email}, ${passwordHash}, 'Admin', 'admin', true, now(), now(), true)
+      RETURNING id
+    `);
+        userId = createdUser.rows[0].id;
+    }
+    const customers = session.awsCustomerIdentifier
+        ? await db
+            .select({ awsAccountId: schema_1.marketplaceCustomers.awsAccountId })
+            .from(schema_1.marketplaceCustomers)
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.marketplaceCustomers.applicationId, session.applicationId), (0, drizzle_orm_1.eq)(schema_1.marketplaceCustomers.awsCustomerIdentifier, session.awsCustomerIdentifier)))
+            .limit(1)
+        : [];
+    let tenantId = session.tenantId || '';
+    const subscriberAccountId = customers[0]?.awsAccountId || null;
+    if (!tenantId) {
+        const owned = await db.execute((0, drizzle_orm_1.sql) `
+      SELECT id FROM meyiconnect.tenants
+       WHERE owner_user_id = ${userId}
+         AND lower(name) = lower(${companyName})
+         AND lower(coalesce(alias, '')) = lower(${alias})
+         AND coalesce(aws_account_id, '') = coalesce(${subscriberAccountId}::text, '')
+       LIMIT 1
+    `);
+        tenantId = owned.rows[0]?.id || '';
+    }
+    if (!tenantId) {
+        const created = await db.execute((0, drizzle_orm_1.sql) `
+      INSERT INTO meyiconnect.tenants (alias, name, owner_user_id, aws_account_id, is_msp_managed, is_default, is_active, created_at, updated_at)
+      VALUES (${alias}, ${companyName}, ${userId}, ${subscriberAccountId}, true, false, true, now(), now())
+      RETURNING id
+    `);
+        tenantId = created.rows[0].id;
+    }
+    await db.update(schema_1.onboardingDetails).set({ tenantId, updatedAt: new Date() }).where((0, drizzle_orm_1.eq)(schema_1.onboardingDetails.id, onboardingId));
+    await db.execute((0, drizzle_orm_1.sql) `
+    UPDATE meyiconnect.users
+       SET tenant_id = ${tenantId},
+           password_hash = CASE WHEN ${hadPassword} THEN password_hash ELSE ${passwordHash} END,
+           is_confirmed = true,
+           updated_at = now()
+     WHERE id = ${userId}
+  `);
+    await db.execute((0, drizzle_orm_1.sql) `
+    INSERT INTO meyiconnect.user_tenants (user_id, tenant_id, role, is_default)
+    VALUES (${userId}, ${tenantId}, 'admin',
+            NOT EXISTS (SELECT 1 FROM meyiconnect.user_tenants WHERE user_id = ${userId}))
+    ON CONFLICT (user_id, tenant_id) DO NOTHING
+  `);
+    try {
+        await syncMeyiConnectTenantPlugins(tenantId, Array.isArray(session.plugins) && session.plugins.length > 0 ? session.plugins : ['Pulse', 'Insight']);
+    }
+    catch (error) {
+        console.error(`[marketplace:meyi-connect] Failed to provision plugins for tenant ${tenantId}:`, error);
+    }
+    console.info(`[marketplace:meyi-connect] Provisioned tenant tenantId=${tenantId}, email=${email}.`);
+    return {
+        tenantId,
+        workspaceName,
+        companyName,
+        email,
+        tempPassword: '',
+        isNewTenant: true,
+        loginUrl: (0, utils_1.appSignInUrl)({ provisioned: '1', email }),
+    };
+}
+//# sourceMappingURL=provisioner.js.map

package/onboarding-service/dist/applications/meyi-connect/provisioner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisioner.js","sourceRoot":"","sources":["../../../src/applications/meyi-connect/provisioner.ts"],"names":[],"mappings":";;AAOA,oEAoBC;AAED,gEAqGC;AAlID,6CAA2C;AAC3C,iCAAiC;AACjC,4CAA0E;AAC1E,2DAA+D;AAE/D,mDAA2F;AAEpF,KAAK,UAAU,4BAA4B,CAAC,QAAgB,EAAE,OAAiB;IACpF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAA,oDAAoC,EAAC,OAAO,CAAC,CAAC,CAAC;IACxE,MAAM,EAAE,GAAG,IAAA,UAAK,GAAE,CAAC;IAEnB,KAAK,MAAM,MAAM,IAAI,kCAAkB,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC;QACvF,MAAM,UAAU,GAAG,MAAM,CAAC,aAAc,CAAC;QACzC,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC3C,MAAM,EAAE,CAAC,OAAO,CAAC,IAAA,iBAAG,EAAA;;;;WAIb,QAAQ,WAAW,UAAU,KAAK,SAAS,KAAK,SAAS;;;;;;;KAO/D,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,0BAA0B,CAAC,YAAoB;IACnE,MAAM,EAAE,GAAG,IAAA,UAAK,GAAE,CAAC;IACnB,MAAM,QAAQ,GAAG,MAAM,EAAE;SACtB,MAAM,EAAE;SACR,IAAI,CAAC,0BAAiB,CAAC;SACvB,KAAK,CAAC,IAAA,iBAAG,EAAC,IAAA,gBAAE,EAAC,0BAAiB,CAAC,EAAE,EAAE,YAAY,CAAC,EAAE,IAAA,gBAAE,EAAC,0BAAiB,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC;SACvG,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAE3E,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC;IACtD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,UAAU,CAAC;IACtD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,SAAS,aAAa,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,MAAM,CAAC;IACpG,MAAM,KAAK,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IACrE,MAAM,YAAY,GAAG,OAAO,CAAC,qBAAqB,IAAI,EAAE,CAAC;IACzD,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAEtF,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,OAAO,CAA+C,IAAA,iBAAG,EAAA;iFACN,KAAK;GACnF,CAAC,CAAC;IACH,IAAI,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;IAC1C,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IAE/D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,OAAO,CAAiB,IAAA,iBAAG,EAAA;;gBAE5C,KAAK,KAAK,YAAY;;KAEjC,CAAC,CAAC;QACH,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClC,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,qBAAqB;QAC7C,CAAC,CAAC,MAAM,EAAE;aACL,MAAM,CAAC,EAAE,YAAY,EAAE,6BAAoB,CAAC,YAAY,EAAE,CAAC;aAC3D,IAAI,CAAC,6BAAoB,CAAC;aAC1B,KAAK,CAAC,IAAA,iBAAG,EACR,IAAA,gBAAE,EAAC,6BAAoB,CAAC,aAAa,EAAE,OAAO,CAAC,aAAa,CAAC,EAC7D,IAAA,gBAAE,EAAC,6BAAoB,CAAC,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAC9E,CAAC;aACD,KAAK,CAAC,CAAC,CAAC;QACb,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;IACtC,MAAM,mBAAmB,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,IAAI,IAAI,CAAC;IAE/D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAiB,IAAA,iBAAG,EAAA;;+BAEvB,MAAM;mCACF,WAAW;kDACI,KAAK;uDACA,mBAAmB;;KAErE,CAAC,CAAC;QACH,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;IACrC,CAAC;IAED,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAiB,IAAA,iBAAG,EAAA;;gBAExC,KAAK,KAAK,WAAW,KAAK,MAAM,KAAK,mBAAmB;;KAEnE,CAAC,CAAC;QACH,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,EAAE,CAAC,MAAM,CAAC,0BAAiB,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAA,gBAAE,EAAC,0BAAiB,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC;IAC1H,MAAM,EAAE,CAAC,OAAO,CAAC,IAAA,iBAAG,EAAA;;yBAEG,QAAQ;uCACM,WAAW,4BAA4B,YAAY;;;kBAGxE,MAAM;GACrB,CAAC,CAAC;IACH,MAAM,EAAE,CAAC,OAAO,CAAC,IAAA,iBAAG,EAAA;;cAER,MAAM,KAAK,QAAQ;iFACgD,MAAM;;GAEpF,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,4BAA4B,CAChC,QAAQ,EACR,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CACtG,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,qEAAqE,QAAQ,GAAG,EAAE,KAAK,CAAC,CAAC;IACzG,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,0DAA0D,QAAQ,WAAW,KAAK,GAAG,CAAC,CAAC;IACpG,OAAO;QACL,QAAQ;QACR,aAAa;QACb,WAAW;QACX,KAAK;QACL,YAAY,EAAE,EAAE;QAChB,WAAW,EAAE,IAAI;QACjB,QAAQ,EAAE,IAAA,oBAAY,EAAC,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;KACpD,CAAC;AACJ,CAAC"}

package/onboarding-service/dist/applications/registry.d.ts

@@ -0,0 +1,9 @@
+import type { MarketplaceApplication } from './types';
+export declare const DEFAULT_APPLICATION_ID = "meyi-connect";
+export declare function listApplications(): MarketplaceApplication[];
+export declare function getApplicationById(id: string | null | undefined): MarketplaceApplication | undefined;
+export declare function requireApplicationById(id: string | null | undefined): MarketplaceApplication;
+export declare function getApplicationByProductCode(productCode: string): MarketplaceApplication | undefined;
+export declare function requireApplicationByProductCode(productCode: string): MarketplaceApplication;
+export declare function getDefaultApplication(): MarketplaceApplication;
+//# sourceMappingURL=registry.d.ts.map

package/onboarding-service/dist/applications/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/applications/registry.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC;AAEtD,eAAO,MAAM,sBAAsB,iBAAiB,CAAC;AAErD,wBAAgB,gBAAgB,IAAI,sBAAsB,EAAE,CAE3D;AAED,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,sBAAsB,GAAG,SAAS,CAGpG;AAED,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,sBAAsB,CAI5F;AAED,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,sBAAsB,GAAG,SAAS,CAInG;AAED,wBAAgB,+BAA+B,CAAC,WAAW,EAAE,MAAM,GAAG,sBAAsB,CAI3F;AAED,wBAAgB,qBAAqB,IAAI,sBAAsB,CAG9D"}

package/onboarding-service/dist/applications/registry.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_APPLICATION_ID = void 0;
+exports.listApplications = listApplications;
+exports.getApplicationById = getApplicationById;
+exports.requireApplicationById = requireApplicationById;
+exports.getApplicationByProductCode = getApplicationByProductCode;
+exports.requireApplicationByProductCode = requireApplicationByProductCode;
+exports.getDefaultApplication = getDefaultApplication;
+const config_1 = require("./meyi-connect/config");
+exports.DEFAULT_APPLICATION_ID = 'meyi-connect';
+function listApplications() {
+    return [(0, config_1.createMeyiConnectApplication)()];
+}
+function getApplicationById(id) {
+    const applicationId = id?.trim() || exports.DEFAULT_APPLICATION_ID;
+    return listApplications().find((application) => application.id === applicationId);
+}
+function requireApplicationById(id) {
+    const application = getApplicationById(id);
+    if (!application)
+        throw new Error(`Unsupported marketplace application: ${id}`);
+    return application;
+}
+function getApplicationByProductCode(productCode) {
+    return listApplications().find((application) => application.productCode !== '' && application.productCode === productCode);
+}
+function requireApplicationByProductCode(productCode) {
+    const application = getApplicationByProductCode(productCode);
+    if (!application)
+        throw new Error('Registration token does not belong to a supported Marketplace product');
+    return application;
+}
+function getDefaultApplication() {
+    const configuredId = process.env.MARKETPLACE_DEFAULT_APPLICATION_ID || exports.DEFAULT_APPLICATION_ID;
+    return requireApplicationById(configuredId);
+}
+//# sourceMappingURL=registry.js.map

package/onboarding-service/dist/applications/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/applications/registry.ts"],"names":[],"mappings":";;;AAKA,4CAEC;AAED,gDAGC;AAED,wDAIC;AAED,kEAIC;AAED,0EAIC;AAED,sDAGC;AAnCD,kDAAqE;AAGxD,QAAA,sBAAsB,GAAG,cAAc,CAAC;AAErD,SAAgB,gBAAgB;IAC9B,OAAO,CAAC,IAAA,qCAA4B,GAAE,CAAC,CAAC;AAC1C,CAAC;AAED,SAAgB,kBAAkB,CAAC,EAA6B;IAC9D,MAAM,aAAa,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,8BAAsB,CAAC;IAC3D,OAAO,gBAAgB,EAAE,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,KAAK,aAAa,CAAC,CAAC;AACpF,CAAC;AAED,SAAgB,sBAAsB,CAAC,EAA6B;IAClE,MAAM,WAAW,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,EAAE,EAAE,CAAC,CAAC;IAChF,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAgB,2BAA2B,CAAC,WAAmB;IAC7D,OAAO,gBAAgB,EAAE,CAAC,IAAI,CAC5B,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,WAAW,KAAK,EAAE,IAAI,WAAW,CAAC,WAAW,KAAK,WAAW,CAC3F,CAAC;AACJ,CAAC;AAED,SAAgB,+BAA+B,CAAC,WAAmB;IACjE,MAAM,WAAW,GAAG,2BAA2B,CAAC,WAAW,CAAC,CAAC;IAC7D,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC3G,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAgB,qBAAqB;IACnC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,kCAAkC,IAAI,8BAAsB,CAAC;IAC9F,OAAO,sBAAsB,CAAC,YAAY,CAAC,CAAC;AAC9C,CAAC"}

package/onboarding-service/dist/applications/types.d.ts

@@ -0,0 +1,57 @@
+export interface ApplicationPlugin {
+    id: string;
+    label: string;
+    description: string;
+    required: boolean;
+    defaultEnabled: boolean;
+    visible?: boolean;
+    persistedName?: string;
+}
+export interface ApplicationAwsConfig {
+    defaultRoleName: string;
+    stackSetPrefix: string;
+    downloadFilePrefix: string;
+    managedByTag: string;
+    templatePath: string;
+    sessionNamePrefix: string;
+}
+export interface ProvisionTenantResult {
+    tenantId: string;
+    workspaceName: string;
+    companyName: string;
+    email: string;
+    tempPassword?: string;
+    isNewTenant: boolean;
+    loginUrl: string;
+}
+export interface PublicApplicationConfig {
+    id: string;
+    name: string;
+    productId: string;
+    loginUrl: string;
+    dashboardUrl: string;
+    awsRoleName: string;
+    downloadFilePrefix: string;
+    features: {
+        awsOrganization: boolean;
+    };
+    plugins: ApplicationPlugin[];
+}
+export interface MarketplaceApplication {
+    id: string;
+    name: string;
+    productCode: string;
+    productId: string;
+    databaseSchema: string;
+    aws: ApplicationAwsConfig;
+    plugins: ApplicationPlugin[];
+    normalizeOnboardingPlugins(plugins: unknown): string[];
+    normalizePlugins(plugins: unknown): string[];
+    provisionTenant(onboardingId: string): Promise<ProvisionTenantResult>;
+    syncTenantPlugins(tenantId: string, plugins: string[]): Promise<void>;
+    signInUrl(params?: Record<string, string>): string;
+    onboardingCompleteUrl(workspaceName: string): string;
+    dashboardUrl(): string;
+    toPublicConfig(): PublicApplicationConfig;
+}
+//# sourceMappingURL=types.d.ts.map

package/onboarding-service/dist/applications/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/applications/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;IAClB,cAAc,EAAE,OAAO,CAAC;IACxB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,OAAO,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,QAAQ,EAAE;QACR,eAAe,EAAE,OAAO,CAAC;KAC1B,CAAC;IACF,OAAO,EAAE,iBAAiB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,GAAG,EAAE,oBAAoB,CAAC;IAC1B,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,0BAA0B,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,CAAC;IACvD,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,CAAC;IAC7C,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACtE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC;IACnD,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC;IACrD,YAAY,IAAI,MAAM,CAAC;IACvB,cAAc,IAAI,uBAAuB,CAAC;CAC3C"}

package/onboarding-service/dist/applications/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/onboarding-service/dist/applications/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/applications/types.ts"],"names":[],"mappings":""}

package/onboarding-service/dist/db/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * db/index.ts — Singleton Drizzle database client.
+ *
+ * Security:
+ * - DATABASE_URL loaded exclusively from environment (no fallback literal).
+ * - Pool sized conservatively to avoid overwhelming the shared PostgreSQL instance.
+ * - mTLS respected if present in the connection string.
+ */
+import { NodePgDatabase } from 'drizzle-orm/node-postgres';
+import * as schema from './schema';
+export declare function getDb(): NodePgDatabase<typeof schema>;
+export declare function closeDb(): Promise<void>;
+//# sourceMappingURL=index.d.ts.map

package/onboarding-service/dist/db/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/db/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAW,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEpE,OAAO,KAAK,MAAM,MAAM,UAAU,CAAC;AAKnC,wBAAgB,KAAK,IAAI,cAAc,CAAC,OAAO,MAAM,CAAC,CAmBrD;AAED,wBAAsB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAM7C"}