@adaptic/backend-legacy 0.0.986 → 0.0.987

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adaptic/backend-legacy",
-  "version": "0.0.986",
+  "version": "0.0.987",
   "description": "Backend executable CRUD functions with dynamic variables construction, and type definitions for the Adaptic AI platform.",
   "type": "module",
   "types": "index.d.ts",
@@ -49,9 +49,9 @@
     "cross-fetch": "^4.0.0"
   },
   "devDependencies": {
-    "prisma": "^5.17.0",
-    "typegraphql-prisma": "^0.27.2",
-    "typescript": "^5.6.2"
+    "prisma": "^6.19.2",
+    "typegraphql-prisma": "^0.28.0",
+    "typescript": "^5.9.2"
   },
   "engines": {
     "node": ">=20.0.0"

package/server.cjs

@@ -39,6 +39,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 require("reflect-metadata");
 const dotenv_1 = __importDefault(require("dotenv"));
 dotenv_1.default.config();
+// IMPORTANT: tracing initialization must happen before any other instrumented
+// import is loaded. `initTracing()` is a no-op unless `OTEL_TRACING_ENABLED=true`
+// (or NODE_ENV ∈ {production, staging}), so this remains safe in development.
+// See: src/config/tracing.ts and docs/ENVIRONMENT_SETUP.md.
+const tracing_1 = require("./config/tracing.cjs");
+(0, tracing_1.initTracing)();
 const express_1 = __importDefault(require("express"));
 const server_1 = require("@apollo/server");
 const express4_1 = require("@as-integrations/express4");
@@ -55,10 +61,13 @@ const ws_2 = require("graphql-ws/lib/use/ws");
 const auth_1 = require("./middleware/auth.cjs");
 const audit_logger_1 = require("./middleware/audit-logger.cjs");
 const http_status_mapper_1 = require("./plugins/http-status-mapper.cjs");
+const graphql_validation_plugin_1 = require("./middleware/graphql-validation-plugin.cjs");
+const query_complexity_1 = require("./middleware/query-complexity.cjs");
+const metrics_1 = require("./config/metrics.cjs");
+const persisted_queries_1 = require("./config/persisted-queries.cjs");
 const prismaClient_1 = __importStar(require("./prismaClient.cjs"));
 const health_1 = require("./health.cjs");
 const logger_1 = require("./utils/logger.cjs");
-const tracing_1 = require("./config/tracing.cjs");
 const token_verifier_1 = require("./auth/token-verifier.cjs");
 /**
  * Adapt a verified `BackendPrincipal` to the legacy `user` context shape used
@@ -96,13 +105,25 @@ const startServer = async () => {
     // would surface a per-request `misconfigured` error indefinitely. Refuse to
     // boot with broken identity configuration.
     (0, token_verifier_1.assertGoogleAudienceConfiguredForProd)();
+    // Prometheus metrics initialization. No-op unless `PROMETHEUS_METRICS_ENABLED`
+    // is on (defaults on in production/staging). Registers default Node.js metrics
+    // and starts the uptime gauge ticker. See: src/config/metrics.ts.
+    (0, metrics_1.initMetrics)();
     const schema = await (0, type_graphql_1.buildSchema)({
         resolvers: [...typegraphql_prisma_1.resolvers, custom_1.OptionsGreeksHistoryCustomResolver],
         validate: false,
     });
     const app = (0, express_1.default)();
     const httpServer = (0, http_1.createServer)(app);
+    // HTTP request metrics — must be mounted early to capture every request.
+    // The middleware is a no-op when metrics are disabled.
+    app.use(metrics_1.metricsMiddleware);
     app.use('/api', (req, res, next) => (0, auth_1.authMiddleware)(req, res, next));
+    // APQ cache: in-memory LRU, gated by `APQ_ENABLED` (default on). The
+    // Apollo Server option only accepts a value when a cache is provided;
+    // omit the option when APQ is disabled rather than passing `false` so
+    // Apollo's default in-memory cache can take over if needed.
+    const apqCache = (0, persisted_queries_1.createAPQCache)();
     const server = new server_1.ApolloServer({
         schema,
         introspection: process.env.NODE_ENV !== 'production',
@@ -110,7 +131,20 @@ const startServer = async () => {
             (0, drainHttpServer_1.ApolloServerPluginDrainHttpServer)({ httpServer }),
             (0, audit_logger_1.createAuditLogPlugin)(),
             (0, http_status_mapper_1.createHttpStatusMapperPlugin)(),
+            // Validation plugin — runs on `didResolveOperation` and rejects
+            // mutations whose input variables fail pattern-based validation
+            // (percentages, positive numbers, non-empty strings).
+            (0, graphql_validation_plugin_1.createValidationPlugin)(),
+            // Query complexity + depth guard. No-op unless
+            // `GRAPHQL_COMPLEXITY_ENABLED` is on (defaults on in production /
+            // staging). Tunable via `GRAPHQL_MAX_DEPTH`,
+            // `GRAPHQL_MAX_COMPLEXITY_AUTH`, `GRAPHQL_MAX_COMPLEXITY_UNAUTH`.
+            (0, query_complexity_1.createQueryComplexityPlugin)(schema),
+            // GraphQL operation metrics (count, duration, error counts).
+            // No-op when metrics are disabled.
+            (0, metrics_1.createMetricsPlugin)(),
         ],
+        ...(apqCache && (0, persisted_queries_1.isAPQEnabled)() ? { persistedQueries: { cache: apqCache } } : {}),
         formatError: (err) => {
             var _a, _b;
             const message = err.message || '';
@@ -165,6 +199,13 @@ const startServer = async () => {
     await server.start();
     // Health check endpoint - mounted before Apollo middleware so it's not behind GraphQL or auth
     app.use((0, health_1.createHealthRouter)());
+    // Prometheus metrics endpoint — GET /metrics returns metrics in the
+    // Prometheus text exposition format. Mounted outside of Apollo and auth
+    // so a scraper can pull metrics without a Bearer token. In production
+    // this endpoint should be protected via firewall / Cloud Run ingress
+    // rules rather than at the application layer. No-op response if
+    // `PROMETHEUS_METRICS_ENABLED` is off (the registry is simply empty).
+    app.use((0, metrics_1.createMetricsRouter)());
     // Configure CORS with allowed origins
     const defaultOrigins = [
         'http://localhost:3000',

package/esm/utils/index.d.ts

@@ -1,24 +0,0 @@
-/**
- * Utils module index
- * Re-exports utility functions for CRUD operations
- *
- * This file provides a utils/index.mjs export path for ESM imports
- * from generated CRUD files that import from './utils/index.mjs'
- */
-/**
- * Recursively removes undefined and null properties from an object or array.
- *
- * This utility is called by generated CRUD functions to clean GraphQL variables
- * before passing them to Apollo Client. The input objects contain Prisma-typed
- * fields (Date, Decimal, bigint, JsonValue, nested relations, etc.) which cannot
- * be enumerated exhaustively. The return value is used as Apollo OperationVariables.
- *
- * Class instances (Date, Decimal, etc.) are preserved as leaf values — only plain
- * objects and arrays are recursed into. This prevents Decimal objects (which have
- * no own enumerable keys) from being incorrectly stripped as "empty objects".
- *
- * We use Record<string, unknown> for the parameter to accept all generated Prisma
- * input shapes without needing to enumerate every possible field type.
- */
-export declare function removeUndefinedProps(obj: Record<string, unknown> | Record<string, unknown>[] | unknown): Record<string, unknown> | undefined;
-//# sourceMappingURL=index.d.ts.map

package/esm/utils/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/utils/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAYH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,OAAO,GACjE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAuDrC"}

package/esm/utils/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/utils/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;GAGG;AACH,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC3C,OAAO,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC;AACtD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAkE;IAElE,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,GAAG;aACP,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;aACzC,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,KAAK,SAAS;YAClB,IAAI,KAAK,IAAI;YACb,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CACnB,CAAC;IAC5C,CAAC;SAAM,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,GAAG,CAAC;QACnB,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,GAA4B,EAAE,GAAG,EAAE,EAAE;YACtE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YAE1B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBAC1C,IAAI,YAAqB,CAAC;gBAE1B,IAAI,GAAG,KAAK,OAAO,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC;oBACvB,IACE,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC;wBACpD,QAAQ,CAAC,EAAE,KAAK,SAAS,EACzB,CAAC;wBACD,4CAA4C;wBAC5C,YAAY,GAAG;4BACb,EAAE,EAAE,oBAAoB,CAAC,QAAQ,CAAC,EAA6B,CAAC;yBACjE,CAAC;oBACJ,CAAC;yBAAM,CAAC;wBACN,wEAAwE;wBACxE,YAAY,GAAG,oBAAoB,CACjC,KAAgC,CACjC,CAAC;oBACJ,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,8BAA8B;oBAC9B,YAAY,GAAG,oBAAoB,CAAC,KAAgC,CAAC,CAAC;gBACxE,CAAC;gBAED,IACE,YAAY,KAAK,SAAS;oBAC1B,YAAY,KAAK,IAAI;oBACrB,CAAC,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EACtE,CAAC;oBACD,GAAG,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;gBAC1B,CAAC;YACH,CAAC;YAED,OAAO,GAAG,CAAC;QACb,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,CAAC;IAED,OAAO,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QACtC,CAAC,CAAE,GAA+B;QAClC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC"}

package/esm/utils/index.mjs

@@ -1,78 +0,0 @@
-/**
- * Utils module index
- * Re-exports utility functions for CRUD operations
- *
- * This file provides a utils/index.mjs export path for ESM imports
- * from generated CRUD files that import from './utils/index.mjs'
- */
-/**
- * Check if a value is a plain object (created via {} or new Object()), as opposed
- * to a class instance (Date, Decimal, Buffer, etc.) that should be treated as a leaf.
- */
-function isPlainObject(value) {
-    if (typeof value !== 'object' || value === null)
-        return false;
-    const proto = Object.getPrototypeOf(value);
-    return proto === Object.prototype || proto === null;
-}
-/**
- * Recursively removes undefined and null properties from an object or array.
- *
- * This utility is called by generated CRUD functions to clean GraphQL variables
- * before passing them to Apollo Client. The input objects contain Prisma-typed
- * fields (Date, Decimal, bigint, JsonValue, nested relations, etc.) which cannot
- * be enumerated exhaustively. The return value is used as Apollo OperationVariables.
- *
- * Class instances (Date, Decimal, etc.) are preserved as leaf values — only plain
- * objects and arrays are recursed into. This prevents Decimal objects (which have
- * no own enumerable keys) from being incorrectly stripped as "empty objects".
- *
- * We use Record<string, unknown> for the parameter to accept all generated Prisma
- * input shapes without needing to enumerate every possible field type.
- */
-export function removeUndefinedProps(obj) {
-    if (Array.isArray(obj)) {
-        return obj
-            .map((item) => removeUndefinedProps(item))
-            .filter((item) => item !== undefined &&
-            item !== null &&
-            (!isPlainObject(item) || Object.keys(item).length > 0));
-    }
-    else if (isPlainObject(obj)) {
-        const record = obj;
-        return Object.keys(record).reduce((acc, key) => {
-            const value = record[key];
-            if (value !== undefined && value !== null) {
-                let cleanedValue;
-                if (key === 'where' && isPlainObject(value)) {
-                    const whereObj = value;
-                    if (Object.prototype.hasOwnProperty.call(whereObj, 'id') &&
-                        whereObj.id !== undefined) {
-                        // Retain only the 'id' field within 'where'
-                        cleanedValue = {
-                            id: removeUndefinedProps(whereObj.id),
-                        };
-                    }
-                    else {
-                        // Process 'where' object normally if 'id' is undefined or doesn't exist
-                        cleanedValue = removeUndefinedProps(value);
-                    }
-                }
-                else {
-                    // Process other keys normally
-                    cleanedValue = removeUndefinedProps(value);
-                }
-                if (cleanedValue !== undefined &&
-                    cleanedValue !== null &&
-                    (!isPlainObject(cleanedValue) || Object.keys(cleanedValue).length > 0)) {
-                    acc[key] = cleanedValue;
-                }
-            }
-            return acc;
-        }, {});
-    }
-    return obj !== undefined && obj !== null
-        ? obj
-        : undefined;
-}
-//# sourceMappingURL=index.js.map