Crate soma_integrations 

Product adapters connecting soma-application’s transport-neutral ports to Soma’s shared engines (plan section 3.20).

This is intentionally an outer-layer crate: it is the one place allowed to see both soma-application ports and concrete shared engines (soma-gateway, soma-codemode, and — once wired — soma-openapi) in the same dependency graph. apps/soma constructs these adapters; it must not contain their implementation logic.

Modules: gateway — GatewayPort implementation over soma-gateway’s GatewayManager. gateway_auth — bridges soma-auth’s upstream OAuth runtime into soma-gateway’s generic OAuth traits (oauth feature). auth — Soma’s product auth default mapping (env prefix, scopes, cookie name) (auth feature). codemode — CodeModePort implementation over soma-codemode.

protected_routes/protected_routes_proxy (bearer-token auth, scope authorization, and gateway-subset dispatch for protected MCP routes) lived here briefly behind a protected-http feature but were moved to soma-runtime as a PR 19 review fix: they need both AppState (soma-runtime) and soma-mcp’s McpState, and depending on either from this crate inverted plan section 3.20’s target dependency shape (below) and contradicted this crate’s own gateway.rs, which documents taking the gateway manager directly rather than depending on soma-runtime for that reason.

Not yet implemented here (see soma-architecture-refactor-plan-v3.md PR 11 notes on the bead for this slice): OpenApiPort has no product adapter — soma_application::OpenApiExecuteRequest has no spec/label field and no soma_openapi::registry::OpenApiRegistry is constructed anywhere in the runtime yet, so a real adapter would require inventing an unspecified wire shape rather than moving or wiring existing, tested behavior.

Re-exports

pub use codemode::CodeModeApplicationPort;

pub use gateway::GatewayApplicationPort;

Modules

auth

Soma’s product auth default mapping: the env prefix, session cookie name, supported/default scopes, and resource path that turn soma-auth’s generic, product-agnostic AuthConfigBuilder into Soma’s own OAuth configuration (plan section 3.20).

codemode

Implements soma-application’s [CodeModePort] over soma-codemode’s sandboxed JS snippet runner (plan section 3.20, “CodeModeExecutor” in section 5’s illustrative flow).

gateway

Implements soma-application’s [GatewayPort] over soma-gateway’s GatewayManager, translating Soma product principal/scope types into the generic gateway’s access and route-scope types (plan section 3.20, “GatewayControl” in section 5’s illustrative flow).

gateway_auth

Gateway-to-auth bridge: translates soma-auth’s upstream OAuth runtime (Soma’s product OAuth storage, refresh, and credential cache) into soma-gateway’s generic UpstreamOAuthProvider/UpstreamOAuthManager traits, so the standalone gateway engine can authenticate to upstream MCP servers without knowing about Soma’s auth types (plan section 3.20).