@discover-cloud/shared 1.2.9 → 1.4.0

package/dist/middleware/require-human.middleware.d.ts

@@ -1,2 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-export declare const requireHuman: (req: Request, res: Response, next: NextFunction) => void;

package/dist/middleware/require-human.middleware.js

@@ -1,18 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.requireHuman = void 0;
-const utils_1 = require("../utils");
-const types_1 = require("../types");
-const requireHuman = (req, res, next) => {
-    const ctx = req.accessContext;
-    if (!ctx) {
-        (0, utils_1.failure)(res, req, "Unauthorized: No access context", "UNAUTHORIZED", 401);
-        return;
-    }
-    if (!(0, types_1.isHumanContext)(ctx)) {
-        (0, utils_1.failure)(res, req, "Human token required", "FORBIDDEN", 403);
-        return;
-    }
-    next();
-};
-exports.requireHuman = requireHuman;

package/dist/middleware/require-internal.middleware.d.ts

@@ -1,18 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import { ILogger } from "../utils/logger.utils";
-export interface RequireInternalOptions {
-    /**
-     * Gateway JWKS URI.
-     * Defaults to GATEWAY_JWKS_URI env var, then the docker-compose default.
-     * Must point to the gateway, not any individual service.
-     */
-    gatewayJwksUri?: string;
-    /**
-     * Permitted serviceIds. Reject any machine token whose serviceId is
-     * not in this list, even if the signature is valid.
-     * Omit to accept any valid machine token (not recommended in production).
-     */
-    allowedServices?: string[];
-    logger?: ILogger;
-}
-export declare function requireInternal(options?: RequireInternalOptions): (req: Request, res: Response, next: NextFunction) => Promise<void>;

package/dist/middleware/require-internal.middleware.js

@@ -1,183 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.requireInternal = requireInternal;
-const jose = __importStar(require("jose"));
-const types_1 = require("../types");
-const logger_utils_1 = require("../utils/logger.utils");
-/**
- * REQUIRE INTERNAL MIDDLEWARE  (@discover-cloud/shared)
- * ─────────────────────────────────────────────────────────────────────────
- * Protects /internal/* routes by verifying a gateway-signed machine JWT.
- * Replaces X-Internal-Secret on all service-to-service endpoints.
- *
- * Trust model:
- *   All machine tokens are signed by the gateway's private key and verified
- *   against the gateway's JWKS endpoint — the same trust root used for
- *   human tokens. There is exactly one signing authority in the system.
- *
- * Verification:
- *   1. Extract Bearer token from Authorization header
- *   2. Verify RS256 signature against gateway JWKS
- *   3. Assert typ === "internal" (token confusion defence)
- *   4. Assert isMachine === true (rejects human tokens on internal routes)
- *   5. Assert serviceId is in the allowlist (optional but recommended)
- *   6. Attach MachineAccessContext to req.accessContext
- *
- * JWKS caching:
- *   One RemoteJWKSet instance is created per middleware instance (i.e. per
- *   service process), cached internally by jose for JWKS_CACHE_MAX_AGE_MS.
- *   No per-request network call under normal operation.
- *
- * Allowlist:
- *   Pass allowedServices to restrict which services can call this endpoint.
- *   Example: requireInternal({ allowedServices: ["cloud-service"] })
- *   Defaults to accepting any valid machine token if omitted.
- *   Always set this in production — it limits blast radius if a service
- *   is compromised.
- *
- * Usage:
- *   // insights-service internal routes
- *   router.use("/internal", requireInternal({
- *     gatewayJwksUri: process.env.GATEWAY_JWKS_URI,
- *     allowedServices: ["cloud-service"],
- *     logger,
- *   }));
- */
-const CLOCK_TOLERANCE_S = 30;
-const JWKS_CACHE_MAX_AGE_MS = 10 * 60 * 1000;
-const JWKS_FETCH_TIMEOUT_MS = 5000;
-function requireInternal(options = {}) {
-    const logger = options.logger ?? logger_utils_1.noopLogger;
-    const jwksUri = options.gatewayJwksUri ??
-        process.env["GATEWAY_JWKS_URI"] ??
-        "http://api-gateway:3000/.well-known/jwks.json";
-    const issuer = process.env["INTERNAL_JWT_ISSUER"] ?? "discover-cloud:api-gateway";
-    const audience = process.env["INTERNAL_JWT_AUDIENCE"] ?? "discover-cloud:internal";
-    // One JWKS instance per middleware — jose caches the key set internally
-    const jwks = jose.createRemoteJWKSet(new URL(jwksUri), {
-        cacheMaxAge: JWKS_CACHE_MAX_AGE_MS,
-        timeoutDuration: JWKS_FETCH_TIMEOUT_MS,
-    });
-    const { allowedServices } = options;
-    return async (req, res, next) => {
-        const header = req.headers.authorization;
-        if (!header?.startsWith("Bearer ")) {
-            res.status(401).json({
-                success: false,
-                error: { code: "UNAUTHORIZED", message: "Missing Authorization header" },
-            });
-            return;
-        }
-        const token = header.slice(7);
-        try {
-            const { payload } = await jose.jwtVerify(token, jwks, {
-                issuer,
-                audience,
-                algorithms: ["RS256"],
-                clockTolerance: CLOCK_TOLERANCE_S,
-            });
-            // Token confusion defence — reject human tokens that somehow
-            // reach an internal route (wrong header forwarded by caller)
-            if (payload["typ"] !== "internal") {
-                res.status(401).json({
-                    success: false,
-                    error: { code: "INVALID_TOKEN", message: "Token type must be 'internal'" },
-                });
-                return;
-            }
-            // Machine guard — reject human internal tokens on machine-only routes
-            if (payload["isMachine"] !== true) {
-                res.status(403).json({
-                    success: false,
-                    error: { code: "FORBIDDEN", message: "Machine token required for internal routes" },
-                });
-                return;
-            }
-            try {
-                (0, types_1.assertMachinePayload)(payload);
-            }
-            catch {
-                res.status(401).json({
-                    success: false,
-                    error: {
-                        code: "INVALID_TOKEN",
-                        message: "Invalid machine token payload",
-                    },
-                });
-                return;
-            }
-            const serviceId = payload.serviceId;
-            // Allowlist — tightest possible scope per endpoint
-            if (allowedServices && !allowedServices.includes(serviceId)) {
-                logger.warn({ requestId: req.id, serviceId }, "[requireInternal] serviceId not in allowlist");
-                res.status(403).json({
-                    success: false,
-                    error: { code: "FORBIDDEN", message: "Service not permitted to call this endpoint" },
-                });
-                return;
-            }
-            const context = { kind: "machine", serviceId };
-            req.internalAuth = payload;
-            req.accessContext = context;
-            logger.debug({ requestId: req.id, serviceId, jti: payload.jti }, "[requireInternal] Machine token verified");
-            next();
-        }
-        catch (err) {
-            if (err instanceof jose.errors.JWTExpired) {
-                res.status(401).json({
-                    success: false,
-                    error: { code: "TOKEN_EXPIRED", message: "Machine token has expired" },
-                });
-                return;
-            }
-            if (err instanceof jose.errors.JWSSignatureVerificationFailed ||
-                err instanceof jose.errors.JWTClaimValidationFailed ||
-                err instanceof jose.errors.JWSInvalid ||
-                err instanceof jose.errors.JWTInvalid) {
-                res.status(401).json({
-                    success: false,
-                    error: { code: "INVALID_TOKEN", message: "Machine token is invalid" },
-                });
-                return;
-            }
-            logger.error({ err, requestId: req.id }, "[requireInternal] Unexpected error verifying machine token");
-            res.status(503).json({
-                success: false,
-                error: { code: "SERVICE_UNAVAILABLE", message: "Authentication temporarily unavailable" },
-            });
-        }
-    };
-}

package/dist/middleware/validate.d.ts

@@ -1,5 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import { ZodType } from "zod";
-export declare class Validator {
-    static validate<T>(schema: ZodType<T>, source?: "body" | "params" | "query"): (req: Request, _res: Response, next: NextFunction) => void;
-}

package/dist/middleware/validate.js

@@ -1,18 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.Validator = void 0;
-class Validator {
-    static validate(schema, source = "body") {
-        return (req, _res, next) => {
-            const result = schema.safeParse(req[source]);
-            if (!result.success) {
-                // Pass to GlobalErrorHandler
-                return next(result.error);
-            }
-            // Populate req.validated (defined in your shared .d.ts)
-            req.validated = result.data;
-            next();
-        };
-    }
-}
-exports.Validator = Validator;

package/dist/middleware/validated-merge.middleware.d.ts

@@ -1,20 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-/**
- * VALIDATED MERGE HELPERS
- * ─────────────────────────
- * Used in routes that run two Validator.validate calls (e.g. params + body,
- * or params + query). Each call overwrites req.validated, so values from
- * the first validator must be captured before the second runs.
- *
- * Pattern:
- *   Validator.validate(paramsSchema, "params"),   // req.validated = { id }
- *   captureValidated("id", "_capturedId"),        // stashes id
- *   Validator.validate(bodySchema, "body"),        // req.validated = { role }
- *   mergeValidated("id", "_capturedId"),           // req.validated = { id, role }
- *
- * The cast through unknown is required — TypeScript won't allow a direct
- * cast from Request to Record<string, unknown> because they don't overlap
- * enough. Casting to unknown first tells TypeScript we know what we're doing.
- */
-export declare const captureValidated: (key: string, tempKey: string) => (req: Request, _res: Response, next: NextFunction) => void;
-export declare const mergeValidated: (key: string, tempKey: string) => (req: Request, _res: Response, next: NextFunction) => void;

package/dist/middleware/validated-merge.middleware.js

@@ -1,33 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.mergeValidated = exports.captureValidated = void 0;
-/**
- * VALIDATED MERGE HELPERS
- * ─────────────────────────
- * Used in routes that run two Validator.validate calls (e.g. params + body,
- * or params + query). Each call overwrites req.validated, so values from
- * the first validator must be captured before the second runs.
- *
- * Pattern:
- *   Validator.validate(paramsSchema, "params"),   // req.validated = { id }
- *   captureValidated("id", "_capturedId"),        // stashes id
- *   Validator.validate(bodySchema, "body"),        // req.validated = { role }
- *   mergeValidated("id", "_capturedId"),           // req.validated = { id, role }
- *
- * The cast through unknown is required — TypeScript won't allow a direct
- * cast from Request to Record<string, unknown> because they don't overlap
- * enough. Casting to unknown first tells TypeScript we know what we're doing.
- */
-const captureValidated = (key, tempKey) => (req, _res, next) => {
-    req[tempKey] = req.validated[key];
-    next();
-};
-exports.captureValidated = captureValidated;
-const mergeValidated = (key, tempKey) => (req, _res, next) => {
-    req.validated = {
-        ...req.validated,
-        [key]: req[tempKey],
-    };
-    next();
-};
-exports.mergeValidated = mergeValidated;

package/dist/middleware/verify-internal-jwt.d.ts

@@ -1,7 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import { InternalJwtService } from "../internal";
-export declare class VerifyInternalJwtMiddleware {
-    private readonly internalJwt;
-    constructor(internalJwt: InternalJwtService);
-    handle: (req: Request, _res: Response, next: NextFunction) => Promise<void>;
-}

package/dist/middleware/verify-internal-jwt.js

@@ -1,25 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.VerifyInternalJwtMiddleware = void 0;
-const errors_1 = require("../errors"); // Shared errors
-class VerifyInternalJwtMiddleware {
-    constructor(internalJwt) {
-        this.internalJwt = internalJwt;
-        this.handle = async (req, _res, next) => {
-            const raw = req.headers["x-internal-token"]; // Standardize header name
-            if (!raw || typeof raw !== "string") {
-                return next(new errors_1.UnauthorizedError("Missing internal token"));
-            }
-            try {
-                const payload = await this.internalJwt.verify(raw);
-                // Populate standardized internalAuth (from your shared .d.ts)
-                req.internalAuth = payload;
-                next();
-            }
-            catch (err) {
-                next(new errors_1.UnauthorizedError("Invalid internal token"));
-            }
-        };
-    }
-}
-exports.VerifyInternalJwtMiddleware = VerifyInternalJwtMiddleware;

package/dist/security/guard.d.ts

@@ -1,10 +0,0 @@
-import { AccountRole, GlobalPermission, OrganizationRole, OrgPermission } from "../enums";
-import { AccessContext } from "../types";
-export declare const globalRolePermissions: Record<AccountRole, readonly GlobalPermission[]>;
-export declare const orgRolePermissions: Record<OrganizationRole, readonly OrgPermission[]>;
-/**
- * Updated isAllowed
- * Since memberships are no longer in the JWT, this function
- * primarily validates Global permissions.
- */
-export declare const isAllowed: (ctx: AccessContext, permission: GlobalPermission | OrgPermission) => boolean;

package/dist/security/guard.js

@@ -1,40 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.isAllowed = exports.orgRolePermissions = exports.globalRolePermissions = void 0;
-const enums_1 = require("../enums");
-exports.globalRolePermissions = {
-    [enums_1.AccountRole.SUPERADMIN]: Object.values(enums_1.GlobalPermission), // Superadmin gets everything
-    [enums_1.AccountRole.ADMIN]: [
-        enums_1.GlobalPermission.MANAGE_USERS,
-        enums_1.GlobalPermission.SUPPORT_ACTIONS,
-        enums_1.GlobalPermission.VIEW_SYSTEM_LOGS
-    ],
-    [enums_1.AccountRole.SUPPORT]: [enums_1.GlobalPermission.SUPPORT_ACTIONS],
-    [enums_1.AccountRole.MODERATOR]: [enums_1.GlobalPermission.MODERATE_CONTENT],
-    [enums_1.AccountRole.USER]: []
-};
-// We keep this here as a reference for local service lookups
-exports.orgRolePermissions = {
-    [enums_1.OrganizationRole.OWNER]: [enums_1.OrgPermission.MANAGE_ORG, enums_1.OrgPermission.MANAGE_MEMBERS],
-    [enums_1.OrganizationRole.ADMIN]: [enums_1.OrgPermission.MANAGE_MEMBERS],
-    [enums_1.OrganizationRole.EDITOR]: [],
-    [enums_1.OrganizationRole.VIEWER]: [],
-};
-const canPerformGlobalPermission = (role, permission) => {
-    return exports.globalRolePermissions[role]?.includes(permission) ?? false;
-};
-/**
- * Updated isAllowed
- * Since memberships are no longer in the JWT, this function
- * primarily validates Global permissions.
- */
-const isAllowed = (ctx, permission) => {
-    // 1. Check if it's a Global Permission (Handled via JWT role)
-    if (Object.values(enums_1.GlobalPermission).includes(permission)) {
-        return canPerformGlobalPermission(ctx.accountRole, permission);
-    }
-    // 2. Org Permissions are now handled by specific "Tenant Middleware"
-    // within the microservices because they require a DB check.
-    return false;
-};
-exports.isAllowed = isAllowed;

package/dist/security/index.d.ts

@@ -1 +0,0 @@
-export * from "./guard";

package/dist/types/express.d.ts

@@ -1,22 +0,0 @@
-import "express-serve-static-core";
-import { JWTPayload } from "jose";
-import { AccountRole } from "../enums";
-export interface AccessContext {
-    accountId: string;
-    accountRole: AccountRole;
-}
-export interface InternalJwtPayload extends JWTPayload {
-    jti: string;
-    accountId?: string;
-    accountRole?: string;
-    isMachine?: boolean;
-}
-declare module "express-serve-static-core" {
-    interface Request {
-        id: string;
-        validated?: any;
-        accessContext?: AccessContext;
-        internalAuth?: InternalJwtPayload;
-    }
-}
-export {};

package/dist/types/express.js

@@ -1,3 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-require("express-serve-static-core");

package/dist/utils/date.utils.d.ts

@@ -1,25 +0,0 @@
-/**
- * DATE SERIALIZATION UTILS  (@discover-cloud/shared)
- * ─────────────────────────────────────────────────────
- * Converts Date objects to ISO 8601 strings for HTTP responses.
- * Use these in toDto() mappers — never call .toISOString() inline.
- *
- * Why centralise this?
- *   DTOs cross HTTP boundaries where JSON has no Date type. Domain models
- *   keep Date objects internally; these helpers handle the conversion at
- *   the boundary in a single consistent place. If the serialisation format
- *   ever needs to change (e.g. add milliseconds truncation, force UTC
- *   suffix), there is one place to update.
- */
-/**
- * toIso
- * Converts a Date to an ISO 8601 string.
- * Use for non-nullable timestamp fields in DTOs.
- */
-export declare const toIso: (date: Date) => string;
-/**
- * toIsoOrNull
- * Converts a Date to an ISO 8601 string, or returns null if the value
- * is absent. Use for nullable timestamp fields (e.g. revokedAt, deletedAt).
- */
-export declare const toIsoOrNull: (date: Date | null | undefined) => string | null;

package/dist/utils/date.utils.js

@@ -1,30 +0,0 @@
-"use strict";
-/**
- * DATE SERIALIZATION UTILS  (@discover-cloud/shared)
- * ─────────────────────────────────────────────────────
- * Converts Date objects to ISO 8601 strings for HTTP responses.
- * Use these in toDto() mappers — never call .toISOString() inline.
- *
- * Why centralise this?
- *   DTOs cross HTTP boundaries where JSON has no Date type. Domain models
- *   keep Date objects internally; these helpers handle the conversion at
- *   the boundary in a single consistent place. If the serialisation format
- *   ever needs to change (e.g. add milliseconds truncation, force UTC
- *   suffix), there is one place to update.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.toIsoOrNull = exports.toIso = void 0;
-/**
- * toIso
- * Converts a Date to an ISO 8601 string.
- * Use for non-nullable timestamp fields in DTOs.
- */
-const toIso = (date) => date.toISOString();
-exports.toIso = toIso;
-/**
- * toIsoOrNull
- * Converts a Date to an ISO 8601 string, or returns null if the value
- * is absent. Use for nullable timestamp fields (e.g. revokedAt, deletedAt).
- */
-const toIsoOrNull = (date) => date ? date.toISOString() : null;
-exports.toIsoOrNull = toIsoOrNull;

package/dist/utils/env.d.ts

@@ -1,46 +0,0 @@
-/**
- * ENVIRONMENT HELPERS  (@discover-cloud/shared)
- * ───────────────────────────────────────────────
- * Typed accessors for process.env values.
- *
- * Why not read process.env directly?
- *   - process.env values are always string | undefined. Reading them inline
- *     forces every callsite to handle undefined or cast — this pushes that
- *     contract to one place.
- *   - getEnv() fails fast at startup (before serving any traffic) if a
- *     required variable is absent, surfacing misconfiguration immediately
- *     rather than at runtime inside a request handler.
- *   - Centralised access makes it straightforward to add validation, type
- *     coercion, or secret-redaction logic later without touching callsites.
- *
- * Usage:
- *   // Required — throws at startup if missing
- *   const dbUrl     = getEnv("DATABASE_URL");
- *   const jwtSecret = getEnv("JWT_SECRET");
- *
- *   // Optional — returns undefined (or a typed default) when absent
- *   const logLevel  = getEnvOptional("LOG_LEVEL") ?? "info";
- *   const port      = Number(getEnvOptional("PORT") ?? "3000");
- */
-/**
- * getEnv
- * Returns the value of a required environment variable.
- * Throws at call time (typically during service startup) if the variable
- * is absent or empty — this is intentional: missing required config should
- * crash the process before it begins serving traffic.
- *
- * Empty string ("") is treated as missing because it is almost always an
- * accidental misconfiguration (e.g. `SECRET=` with no value in a .env file).
- */
-export declare function getEnv(name: string): string;
-/**
- * getEnvOptional
- * Returns the value of an optional environment variable, or undefined
- * if it is absent or empty. Use with a nullish coalescing default:
- *
- *   const logLevel = getEnvOptional("LOG_LEVEL") ?? "info";
- *
- * Returns undefined (not empty string) so callers can safely use `??`
- * and `||` without needing to guard against empty strings separately.
- */
-export declare function getEnvOptional(name: string): string | undefined;

package/dist/utils/env.js

@@ -1,61 +0,0 @@
-"use strict";
-/**
- * ENVIRONMENT HELPERS  (@discover-cloud/shared)
- * ───────────────────────────────────────────────
- * Typed accessors for process.env values.
- *
- * Why not read process.env directly?
- *   - process.env values are always string | undefined. Reading them inline
- *     forces every callsite to handle undefined or cast — this pushes that
- *     contract to one place.
- *   - getEnv() fails fast at startup (before serving any traffic) if a
- *     required variable is absent, surfacing misconfiguration immediately
- *     rather than at runtime inside a request handler.
- *   - Centralised access makes it straightforward to add validation, type
- *     coercion, or secret-redaction logic later without touching callsites.
- *
- * Usage:
- *   // Required — throws at startup if missing
- *   const dbUrl     = getEnv("DATABASE_URL");
- *   const jwtSecret = getEnv("JWT_SECRET");
- *
- *   // Optional — returns undefined (or a typed default) when absent
- *   const logLevel  = getEnvOptional("LOG_LEVEL") ?? "info";
- *   const port      = Number(getEnvOptional("PORT") ?? "3000");
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.getEnv = getEnv;
-exports.getEnvOptional = getEnvOptional;
-/**
- * getEnv
- * Returns the value of a required environment variable.
- * Throws at call time (typically during service startup) if the variable
- * is absent or empty — this is intentional: missing required config should
- * crash the process before it begins serving traffic.
- *
- * Empty string ("") is treated as missing because it is almost always an
- * accidental misconfiguration (e.g. `SECRET=` with no value in a .env file).
- */
-function getEnv(name) {
-    const value = process.env[name];
-    if (!value) {
-        throw new Error(`Missing required environment variable: ${name}. ` +
-            `Ensure it is set in your .env file or deployment environment.`);
-    }
-    return value;
-}
-/**
- * getEnvOptional
- * Returns the value of an optional environment variable, or undefined
- * if it is absent or empty. Use with a nullish coalescing default:
- *
- *   const logLevel = getEnvOptional("LOG_LEVEL") ?? "info";
- *
- * Returns undefined (not empty string) so callers can safely use `??`
- * and `||` without needing to guard against empty strings separately.
- */
-function getEnvOptional(name) {
-    const value = process.env[name];
-    // Normalise empty string to undefined — same convention as getEnv.
-    return value === "" ? undefined : value;
-}

package/dist/utils/env.utils.d.ts

@@ -1,46 +0,0 @@
-/**
- * ENVIRONMENT HELPERS  (@discover-cloud/shared)
- * ───────────────────────────────────────────────
- * Typed accessors for process.env values.
- *
- * Why not read process.env directly?
- *   - process.env values are always string | undefined. Reading them inline
- *     forces every callsite to handle undefined or cast — this pushes that
- *     contract to one place.
- *   - getEnv() fails fast at startup (before serving any traffic) if a
- *     required variable is absent, surfacing misconfiguration immediately
- *     rather than at runtime inside a request handler.
- *   - Centralised access makes it straightforward to add validation, type
- *     coercion, or secret-redaction logic later without touching callsites.
- *
- * Usage:
- *   // Required — throws at startup if missing
- *   const dbUrl     = getEnv("DATABASE_URL");
- *   const jwtSecret = getEnv("JWT_SECRET");
- *
- *   // Optional — returns undefined (or a typed default) when absent
- *   const logLevel  = getEnvOptional("LOG_LEVEL") ?? "info";
- *   const port      = Number(getEnvOptional("PORT") ?? "3000");
- */
-/**
- * getEnv
- * Returns the value of a required environment variable.
- * Throws at call time (typically during service startup) if the variable
- * is absent or empty — this is intentional: missing required config should
- * crash the process before it begins serving traffic.
- *
- * Empty string ("") is treated as missing because it is almost always an
- * accidental misconfiguration (e.g. `SECRET=` with no value in a .env file).
- */
-export declare function getEnv(name: string): string;
-/**
- * getEnvOptional
- * Returns the value of an optional environment variable, or undefined
- * if it is absent or empty. Use with a nullish coalescing default:
- *
- *   const logLevel = getEnvOptional("LOG_LEVEL") ?? "info";
- *
- * Returns undefined (not empty string) so callers can safely use `??`
- * and `||` without needing to guard against empty strings separately.
- */
-export declare function getEnvOptional(name: string): string | undefined;