@end-close/relay 0.12.0

package/dist/logger.js

@@ -0,0 +1,14 @@
+export const noopLogger = {
+    debug: () => { },
+    info: () => { },
+    warn: () => { },
+    error: () => { },
+};
+/** console-backed logger at warn level and above. */
+export const consoleLogger = {
+    debug: () => { },
+    info: () => { },
+    warn: (msg, meta) => console.warn(msg, meta ?? ''),
+    error: (msg, meta) => console.error(msg, meta ?? ''),
+};
+//# sourceMappingURL=logger.js.map

package/dist/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAYA,MAAM,CAAC,MAAM,UAAU,GAAW;IAChC,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;IACf,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;IACd,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;IACd,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;CAChB,CAAA;AAED,qDAAqD;AACrD,MAAM,CAAC,MAAM,aAAa,GAAW;IACnC,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;IACf,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;IACd,IAAI,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;IAClD,KAAK,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;CACrD,CAAA"}

package/dist/mask/defaults.d.ts

@@ -0,0 +1,7 @@
+export declare const REDACTED = "[REDACTED]";
+export declare function keyNameIsSensitive(key: string): boolean;
+/** Redact SSN patterns and Luhn-passing PANs inside string values. Returns the input unchanged when clean. */
+export declare function hardDenyValue(value: string): string;
+/** Recursively apply hardDenyValue to every string inside a mapped JSON value. */
+export declare function hardDenyDeep<T>(value: T): T;
+//# sourceMappingURL=defaults.d.ts.map

package/dist/mask/defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../src/mask/defaults.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,QAAQ,eAAe,CAAA;AAKpC,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAIvD;AAqBD,8GAA8G;AAC9G,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAQnD;AAED,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAS3C"}

package/dist/mask/defaults.js

@@ -0,0 +1,51 @@
+// Hard denylist: applied to every mapped value in every route, not configurable. If one
+// of these patterns fires on data a customer legitimately needs, the answer is a
+// deliberate code change here — never a config override.
+export const REDACTED = '[REDACTED]';
+const SENSITIVE_KEY_RE = /(^|_|\b)(cvv2?|cvc|cid|pin|password|passwd|secret|api[-_]?key|private[-_]?key|access[-_]?token|refresh[-_]?token|ssn|social[-_]?security|routing[-_]?number|account[-_]?number)($|_|\b)/i;
+export function keyNameIsSensitive(key) {
+    // Split camelCase so e.g. RoutingNumber / accountNumber match the snake/word patterns.
+    const normalized = key.replace(/([a-z0-9])([A-Z])/g, '$1_$2');
+    return SENSITIVE_KEY_RE.test(normalized);
+}
+const SSN_RE = /\b\d{3}-\d{2}-\d{4}\b/g;
+// Digit runs (allowing space/dash separators) long enough to be a PAN.
+const PAN_CANDIDATE_RE = /\b\d(?:[ -]?\d){12,18}\b/g;
+function luhnValid(digits) {
+    let sum = 0;
+    let double = false;
+    for (let i = digits.length - 1; i >= 0; i--) {
+        let d = digits.charCodeAt(i) - 48;
+        if (double) {
+            d *= 2;
+            if (d > 9)
+                d -= 9;
+        }
+        sum += d;
+        double = !double;
+    }
+    return sum % 10 === 0;
+}
+/** Redact SSN patterns and Luhn-passing PANs inside string values. Returns the input unchanged when clean. */
+export function hardDenyValue(value) {
+    let out = value.replace(SSN_RE, REDACTED);
+    out = out.replace(PAN_CANDIDATE_RE, (candidate) => {
+        const digits = candidate.replace(/[ -]/g, '');
+        if (digits.length >= 13 && digits.length <= 19 && luhnValid(digits))
+            return REDACTED;
+        return candidate;
+    });
+    return out;
+}
+/** Recursively apply hardDenyValue to every string inside a mapped JSON value. */
+export function hardDenyDeep(value) {
+    if (typeof value === 'string')
+        return hardDenyValue(value);
+    if (Array.isArray(value))
+        return value.map(hardDenyDeep);
+    if (value !== null && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, hardDenyDeep(v)]));
+    }
+    return value;
+}
+//# sourceMappingURL=defaults.js.map

package/dist/mask/defaults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../../src/mask/defaults.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,iFAAiF;AACjF,yDAAyD;AAEzD,MAAM,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAA;AAEpC,MAAM,gBAAgB,GACpB,0LAA0L,CAAA;AAE5L,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,uFAAuF;IACvF,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAA;IAC7D,OAAO,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;AAC1C,CAAC;AAED,MAAM,MAAM,GAAG,wBAAwB,CAAA;AACvC,uEAAuE;AACvE,MAAM,gBAAgB,GAAG,2BAA2B,CAAA;AAEpD,SAAS,SAAS,CAAC,MAAc;IAC/B,IAAI,GAAG,GAAG,CAAC,CAAA;IACX,IAAI,MAAM,GAAG,KAAK,CAAA;IAClB,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,IAAI,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAA;QACjC,IAAI,MAAM,EAAE,CAAC;YACX,CAAC,IAAI,CAAC,CAAA;YACN,IAAI,CAAC,GAAG,CAAC;gBAAE,CAAC,IAAI,CAAC,CAAA;QACnB,CAAC;QACD,GAAG,IAAI,CAAC,CAAA;QACR,MAAM,GAAG,CAAC,MAAM,CAAA;IAClB,CAAC;IACD,OAAO,GAAG,GAAG,EAAE,KAAK,CAAC,CAAA;AACvB,CAAC;AAED,8GAA8G;AAC9G,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACzC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,SAAS,EAAE,EAAE;QAChD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;QAC7C,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,IAAI,SAAS,CAAC,MAAM,CAAC;YAAE,OAAO,QAAQ,CAAA;QACpF,OAAO,SAAS,CAAA;IAClB,CAAC,CAAC,CAAA;IACF,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,YAAY,CAAI,KAAQ;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,aAAa,CAAC,KAAK,CAAM,CAAA;IAC/D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,YAAY,CAAM,CAAA;IAC7D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CACvD,CAAA;IACR,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/mask/paths.d.ts

@@ -0,0 +1,7 @@
+export type Json = null | boolean | number | string | Json[] | {
+    [k: string]: Json;
+};
+export declare function getAtPath(doc: Json, path: string): Json | undefined;
+/** All leaf paths of a document, dot-notation — used for the "not forwarded" report. */
+export declare function leafPaths(doc: Json, prefix?: string): string[];
+//# sourceMappingURL=paths.d.ts.map

package/dist/mask/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/mask/paths.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,IAAI,GAAG,IAAI,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,GAAG;IAAE,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAA;AAEpF,wBAAgB,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAEnE;AAmBD,wFAAwF;AACxF,wBAAgB,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,SAAK,GAAG,MAAM,EAAE,CAO1D"}

package/dist/mask/paths.js

@@ -0,0 +1,36 @@
+// Dot-notation paths into JSON documents: "batchId", "batch.id", "transactions.*.id".
+// A `*` segment fans out over every array element (or object value) and the result is
+// the array of matches.
+export function getAtPath(doc, path) {
+    return getSegments(doc, path.split('.'));
+}
+function getSegments(node, segments) {
+    if (segments.length === 0)
+        return node;
+    const [head, ...rest] = segments;
+    if (node === null || typeof node !== 'object')
+        return undefined;
+    if (head === '*') {
+        const children = Array.isArray(node) ? node : Object.values(node);
+        const out = children
+            .map((c) => getSegments(c, rest))
+            .filter((v) => v !== undefined);
+        return out;
+    }
+    const child = Array.isArray(node)
+        ? node[Number(head)]
+        : node[head];
+    return child === undefined ? undefined : getSegments(child, rest);
+}
+/** All leaf paths of a document, dot-notation — used for the "not forwarded" report. */
+export function leafPaths(doc, prefix = '') {
+    if (doc === null || typeof doc !== 'object')
+        return prefix ? [prefix] : [];
+    const entries = Array.isArray(doc)
+        ? doc.map((v, i) => [String(i), v])
+        : Object.entries(doc);
+    if (entries.length === 0)
+        return prefix ? [prefix] : [];
+    return entries.flatMap(([k, v]) => leafPaths(v, prefix ? `${prefix}.${k}` : k));
+}
+//# sourceMappingURL=paths.js.map

package/dist/mask/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/mask/paths.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,sFAAsF;AACtF,wBAAwB;AAIxB,MAAM,UAAU,SAAS,CAAC,GAAS,EAAE,IAAY;IAC/C,OAAO,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;AAC1C,CAAC;AAED,SAAS,WAAW,CAAC,IAAU,EAAE,QAAkB;IACjD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACtC,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,QAAQ,CAAA;IAChC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IAC/D,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACjE,MAAM,GAAG,GAAG,QAAQ;aACjB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;aAChC,MAAM,CAAC,CAAC,CAAC,EAAa,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAA;QAC5C,OAAO,GAAG,CAAA;IACZ,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAC/B,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC,CAAE,IAA8B,CAAC,IAAK,CAAC,CAAA;IAC1C,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;AACnE,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,SAAS,CAAC,GAAS,EAAE,MAAM,GAAG,EAAE;IAC9C,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC1E,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAChC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAU,CAAC;QAC5C,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACvB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACvD,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AACjF,CAAC"}

package/dist/util/payload-shape.d.ts

@@ -0,0 +1,6 @@
+import type { Json } from '../mask/paths.js';
+/** Comma-sorted top-level keys of a JSON object — safe for logs (no values). */
+export declare function jsonTopLevelKeys(value: Json | unknown): string;
+/** Comma-sorted request header names, excluding auth/secret headers. */
+export declare function requestHeaderNames(headers: Record<string, unknown>): string;
+//# sourceMappingURL=payload-shape.d.ts.map

package/dist/util/payload-shape.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-shape.d.ts","sourceRoot":"","sources":["../../src/util/payload-shape.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAE5C,gFAAgF;AAChF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,IAAI,GAAG,OAAO,GAAG,MAAM,CAI9D;AAED,wEAAwE;AACxE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAQ3E"}

package/dist/util/payload-shape.js

@@ -0,0 +1,19 @@
+/** Comma-sorted top-level keys of a JSON object — safe for logs (no values). */
+export function jsonTopLevelKeys(value) {
+    if (value === null || typeof value !== 'object')
+        return typeof value;
+    if (Array.isArray(value))
+        return '(array)';
+    return Object.keys(value).sort().join(',');
+}
+/** Comma-sorted request header names, excluding auth/secret headers. */
+export function requestHeaderNames(headers) {
+    return Object.keys(headers)
+        .filter((h) => {
+        const n = h.toLowerCase();
+        return n !== 'authorization' && !n.includes('secret') && !n.includes('api-key');
+    })
+        .sort()
+        .join(',');
+}
+//# sourceMappingURL=payload-shape.js.map

package/dist/util/payload-shape.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-shape.js","sourceRoot":"","sources":["../../src/util/payload-shape.ts"],"names":[],"mappings":"AAEA,gFAAgF;AAChF,MAAM,UAAU,gBAAgB,CAAC,KAAqB;IACpD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,OAAO,KAAK,CAAA;IACpE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAC1C,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAC5C,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,kBAAkB,CAAC,OAAgC;IACjE,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;SACxB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACZ,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAA;QACzB,OAAO,CAAC,KAAK,eAAe,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IACjF,CAAC,CAAC;SACD,IAAI,EAAE;SACN,IAAI,CAAC,GAAG,CAAC,CAAA;AACd,CAAC"}

package/dist/util/strings.d.ts

@@ -0,0 +1,3 @@
+export declare function escapeRe(s: string): string;
+export declare function sleep(ms: number): Promise<void>;
+//# sourceMappingURL=strings.d.ts.map

package/dist/util/strings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"strings.d.ts","sourceRoot":"","sources":["../../src/util/strings.ts"],"names":[],"mappings":"AAAA,wBAAgB,QAAQ,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAE1C;AAED,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/C"}

package/dist/util/strings.js

@@ -0,0 +1,7 @@
+export function escapeRe(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+export function sleep(ms) {
+    return new Promise((r) => setTimeout(r, ms));
+}
+//# sourceMappingURL=strings.js.map

package/dist/util/strings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"strings.js","sourceRoot":"","sources":["../../src/util/strings.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,QAAQ,CAAC,CAAS;IAChC,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAA;AACjD,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,EAAU;IAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;AAC9C,CAAC"}

package/package.json

@@ -0,0 +1,57 @@
+{
+  "name": "@end-close/relay",
+  "version": "0.12.0",
+  "description": "Embeddable store-and-forward engine for delivering payment-processor webhooks to End Close: verify, buffer durably, map through an explicit allowlist, forward with retries and idempotency.",
+  "keywords": [
+    "endclose",
+    "webhook",
+    "relay",
+    "store-and-forward",
+    "payabli",
+    "payments"
+  ],
+  "license": "MIT",
+  "homepage": "https://github.com/End-Close/endclose-relay/tree/main/packages/core#readme",
+  "bugs": {
+    "url": "https://github.com/End-Close/endclose-relay/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/End-Close/endclose-relay.git",
+    "directory": "packages/core"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "!dist/tsconfig.tsbuildinfo",
+    "src",
+    "COMPATIBILITY.md"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "engines": {
+    "node": ">=22.12"
+  },
+  "dependencies": {
+    "zod": "^3.24.2"
+  },
+  "devDependencies": {
+    "yaml": "^2.7.0"
+  },
+  "scripts": {
+    "build": "tsc -b tsconfig.json",
+    "typecheck": "tsc --noEmit -p tsconfig.json"
+  }
+}

package/src/config/schema.ts

@@ -0,0 +1,177 @@
+import { z } from 'zod'
+import { keyNameIsSensitive } from '../mask/defaults.js'
+
+// Dot-notation path into the webhook payload, e.g. "batchId", "batch.id",
+// "transactions.*.id" (a `*` segment fans out over an array).
+const dotPath = z
+  .string()
+  .regex(/^[^\s.]+(\.[^\s.]+)*$/, 'must be a dot-notation path like batchId or batch.id')
+
+export const transformNameSchema = z.enum(['trim', 'lowercase', 'hash'])
+export type TransformName = z.infer<typeof transformNameSchema>
+
+// A mapped field: either a bare source path, or an object with optional transforms
+// (single or array, applied in order).
+//   external_id: transferId
+//   customer_email: { source: CustomerEmail, transform: hash }
+//   customer_email: { source: CustomerEmail, transform: [trim, lowercase, hash] }
+// Strict, so a stray key (a typo, or `enrich` where it is not allowed) is an error
+// rather than silently ignored.
+export const fieldRefSchema = z.union([
+  dotPath,
+  z
+    .object({
+      source: dotPath,
+      transform: z.union([transformNameSchema, z.array(transformNameSchema).min(1)]).optional(),
+    })
+    .strict(),
+])
+export type FieldRef = z.infer<typeof fieldRefSchema>
+
+// Name of an enrichment registered by the host via createRelay({ enrichments }). Only
+// `description` and `metadata` entries may name one: the value at `source` (after any
+// transforms) is handed to the host function and its return value is what is forwarded.
+export const enrichNameSchema = z
+  .string()
+  .regex(/^[a-z][a-z0-9_]*$/, 'enrichment name must be a lowercase snake_case identifier')
+
+//   resident_name: { source: PayorId, enrich: resident_name }
+//   resident_unit: { source: PayorId, transform: trim, enrich: resident_unit }
+export const enrichableFieldRefSchema = z.union([
+  dotPath,
+  z
+    .object({
+      source: dotPath,
+      transform: z.union([transformNameSchema, z.array(transformNameSchema).min(1)]).optional(),
+      enrich: enrichNameSchema.optional(),
+    })
+    .strict(),
+])
+export type EnrichableFieldRef = z.infer<typeof enrichableFieldRefSchema>
+
+export function refSource(ref: EnrichableFieldRef): string {
+  return typeof ref === 'string' ? ref : ref.source
+}
+export function refTransforms(ref: EnrichableFieldRef): TransformName[] {
+  if (typeof ref === 'string' || ref.transform === undefined) return []
+  return Array.isArray(ref.transform) ? ref.transform : [ref.transform]
+}
+/** The enrichment a field names, if any. */
+export function refEnrichment(ref: EnrichableFieldRef): string | undefined {
+  return typeof ref === 'string' ? undefined : ref.enrich
+}
+
+const dateRefSchema = z.union([
+  dotPath,
+  z.object({
+    source: dotPath,
+    format: z.enum(['iso8601', 'mdy_hms']).default('iso8601'),
+  }),
+])
+export type DateRef = z.infer<typeof dateRefSchema>
+
+// A secret reference: the NAME the host's SecretResolver resolves (an env var in the
+// application). The value itself never appears in config or the database. The field is
+// deliberately named as a reference so a value is never mistaken for it.
+const secretRef = z.string().min(1)
+
+export const payabliAuthSchema = z.object({
+  mode: z.literal('static_header'),
+  header: z.string().default('authorization'),
+  secret_env: secretRef,
+  allowed_ips: z.array(z.string()).default([]),
+})
+
+export const genericHmacAuthSchema = z.object({
+  mode: z.literal('hmac'),
+  header: z.string(),
+  algorithm: z.enum(['sha256', 'sha512']).default('sha256'),
+  secret_env: secretRef,
+  // What gets signed: '{body}' or '{timestamp}.{body}'
+  signed_content: z.enum(['body', 'timestamp.body']).default('body'),
+  timestamp_header: z.string().optional(),
+  tolerance_seconds: z.number().int().positive().default(300),
+  // Where this processor keeps its stable event ID / event type in the payload.
+  event_id: dotPath.optional(),
+  event_type: dotPath.optional(),
+})
+
+// How a webhook event becomes an End Close record. This block is the complete answer to
+// "what leaves our network": only fields named here are forwarded, ever.
+export const recordMapSchema = z
+  .object({
+    data_stream_key: z.string().min(1),
+    external_id: fieldRefSchema,
+    // Source of a string amount like "3,762.87"; converted to integer cents.
+    amount: fieldRefSchema,
+    direction: z.enum(['credit', 'debit']),
+    // Optional payload timestamp. Absent -> the record is dated by receive time.
+    date: dateRefSchema.optional(),
+    description: enrichableFieldRefSchema.optional(),
+    currency: z
+      .string()
+      .regex(/^[A-Za-z]{3}$/)
+      .optional(),
+    // Extra fields to forward, as output_name: source. Output names are what End Close
+    // property definitions see, so choose clean snake_case names.
+    metadata: z.record(z.string().regex(/^[a-z][a-z0-9_]*$/), enrichableFieldRefSchema).default({}),
+  })
+  .superRefine((map, ctx) => {
+    for (const [outputKey, ref] of Object.entries(map.metadata)) {
+      const sourceLeaf = refSource(ref).split('.').at(-1)!
+      const hashed = refTransforms(ref).includes('hash')
+      const enriched = refEnrichment(ref) !== undefined
+      for (const name of [outputKey, sourceLeaf]) {
+        if (!keyNameIsSensitive(name)) continue
+        // `hash` protects the source value. An enriched field forwards whatever the host
+        // returns, so hashing the input does not make a sensitive output name safe.
+        if (hashed && !(enriched && name === outputKey)) continue
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          path: ['metadata', outputKey],
+          message: enriched && name === outputKey
+            ? `"${name}" matches the hard denylist (cvv/ssn/account number/...); an enriched field cannot use it as an output name`
+            : `"${name}" matches the hard denylist (cvv/ssn/account number/...); it cannot be forwarded in clear — use transform: hash or remove it`,
+        })
+      }
+    }
+  })
+
+/** Built-in processor adapters. Hosts may register more via createRelay({ adapters }). */
+export const BUILTIN_SOURCES = ['payabli', 'generic_hmac'] as const
+
+export const routeSchema = z.object({
+  id: z
+    .string()
+    .regex(/^[a-z0-9][a-z0-9-_]*$/, 'route id must be a lowercase slug'),
+  // The processor adapter name: a built-in, or one registered by the host.
+  source: z.string().regex(/^[a-z0-9][a-z0-9_-]*$/, 'source must be a lowercase slug'),
+  auth: z.discriminatedUnion('mode', [payabliAuthSchema, genericHmacAuthSchema]),
+  // Payload event types accepted by this route (adapter-extracted; glob '*' allowed).
+  // Non-matching events persist locally as dropped_by_filter and are never forwarded.
+  events: z.array(z.string()).min(1).optional(),
+  map: recordMapSchema,
+  max_body_bytes: z
+    .number()
+    .int()
+    .positive()
+    .max(10 * 1024 * 1024)
+    .default(1024 * 1024),
+})
+
+
+// The config document is ROUTES ONLY (strict: unknown top-level keys are rejected).
+// Everything else (End Close endpoint, ports, dispatch/retention tuning) is a boot-time
+// runtime setting from the environment — see src/config/runtime.ts. Consequence: every
+// applied config change takes effect live; there is no "restart pending" state.
+export const relayConfigSchema = z
+  .object({
+    routes: z.array(routeSchema).min(1),
+  })
+  .strict()
+
+export type RelayConfig = z.infer<typeof relayConfigSchema>
+export type RouteConfig = z.infer<typeof routeSchema>
+export type RecordMap = z.infer<typeof recordMapSchema>
+export type PayabliAuth = z.infer<typeof payabliAuthSchema>
+export type GenericHmacAuth = z.infer<typeof genericHmacAuthSchema>

package/src/crypto/at-rest.ts

@@ -0,0 +1,21 @@
+import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto'
+
+// AES-256-GCM with a per-row random IV. Ciphertext layout: <ciphertext><16-byte auth tag>.
+const ALGO = 'aes-256-gcm'
+const IV_BYTES = 12
+const TAG_BYTES = 16
+
+export function encrypt(key: Buffer, plaintext: Buffer): { ciphertext: Buffer; iv: Buffer } {
+  const iv = randomBytes(IV_BYTES)
+  const cipher = createCipheriv(ALGO, key, iv)
+  const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final(), cipher.getAuthTag()])
+  return { ciphertext, iv }
+}
+
+export function decrypt(key: Buffer, ciphertext: Buffer, iv: Buffer): Buffer {
+  const tag = ciphertext.subarray(ciphertext.length - TAG_BYTES)
+  const body = ciphertext.subarray(0, ciphertext.length - TAG_BYTES)
+  const decipher = createDecipheriv(ALGO, key, iv)
+  decipher.setAuthTag(tag)
+  return Buffer.concat([decipher.update(body), decipher.final()])
+}

package/src/crypto/keys.ts

@@ -0,0 +1,13 @@
+import { createHash } from 'node:crypto'
+
+// RELAY_DATA_KEY and MASKING_HMAC_KEY are operator-supplied strings (32+ chars of entropy
+// recommended). We derive fixed-length keys by hashing so any string works, but refuse
+// obviously weak values.
+const MIN_KEY_CHARS = 16
+
+export function deriveKey(envName: string, raw: string | undefined): Buffer {
+  if (!raw || raw.length < MIN_KEY_CHARS) {
+    throw new Error(`${envName} must be set to at least ${MIN_KEY_CHARS} characters`)
+  }
+  return createHash('sha256').update(raw, 'utf8').digest()
+}

package/src/engine/codec.ts

@@ -0,0 +1,30 @@
+import { encrypt, decrypt } from '../crypto/at-rest.js'
+
+// How buffered payloads are stored. Rows always hold whatever the codec produced; only the
+// dispatcher and an audited operator read path decode. Encryption is chosen explicitly by
+// the host — there is no silent plaintext default.
+
+export interface PayloadCodec {
+  encode(plain: Buffer): { payload: Buffer; iv: Buffer | null }
+  decode(payload: Buffer, iv: Buffer | null): Buffer
+}
+
+/** AES-256-GCM under a 32-byte key (see crypto/keys.ts deriveKey). */
+export function aesGcmCodec(key: Buffer): PayloadCodec {
+  return {
+    encode(plain) {
+      const { ciphertext, iv } = encrypt(key, plain)
+      return { payload: ciphertext, iv }
+    },
+    decode(payload, iv) {
+      if (!iv) throw new Error('encrypted payload has no iv')
+      return decrypt(key, payload, iv)
+    },
+  }
+}
+
+/** Stores payloads as-is. Only appropriate when the store itself is encrypted or trusted. */
+export const plainCodec: PayloadCodec = {
+  encode: (plain) => ({ payload: plain, iv: null }),
+  decode: (payload) => payload,
+}

package/src/engine/hooks.ts

@@ -0,0 +1,76 @@
+// Typed, metadata-only events the engine emits. Hosts subscribe to drive metrics,
+// telemetry, or their own observability; the engine itself depends on none of them.
+// Payloads carry route ids, counts, timestamps, field names and error kinds — never
+// webhook data or enriched values.
+
+export type IngestOutcome =
+  | 'accepted'
+  | 'duplicate'
+  | 'filtered'
+  | 'rejected_auth'
+  | 'rejected_size'
+  | 'rejected_json'
+  | 'panic'
+export type ForwardResult = 'delivered' | 'retried' | 'parked'
+/**
+ * applied: the field was filled. omitted: the enrichment returned undefined. failed: it
+ * threw or timed out (the event retries). rejected: its result or the reference was
+ * invalid (the event parks).
+ */
+export type EnrichOutcome = 'applied' | 'omitted' | 'failed' | 'rejected'
+
+export type EngineErrorKind = 'dispatch_cycle' | 'ingest_persist' | 'prune' | 'recover_delivering'
+
+export interface RelayEvents {
+  /** Every ingest request that reached a known route, by outcome. */
+  ingest: { routeId: string; outcome: IngestOutcome; eventType: string | null; bodyBytes: number }
+  /** A new event row was persisted (not emitted for duplicates). */
+  stored: { routeId: string; id: string; filtered: boolean }
+  /** Per-event forwarding results. */
+  forward: { routeId: string; result: ForwardResult; count: number }
+  /** Per-event outcome of a dispatch attempt, keyed by the store id `ingest` returned. */
+  settled: { id: string; routeId: string; result: ForwardResult; error?: string }
+  /** One event confirmed delivered; carries the timestamps for lag measurement. */
+  delivered: { routeId: string; receivedAt: string; deliveredAt: string }
+  /** One host enrichment call for one field of one event. Names only, never values. */
+  enrich: { routeId: string; id: string; field: string; enrichment: string; result: EnrichOutcome; error?: string }
+  'batch.forwarded': { routeId: string; events: number; bulkRequestId: string }
+  /** A whole batch was permanently rejected by End Close. */
+  'batch.parked': { routeId: string; status: number; events: number }
+  prune: { wiped: number; deleted: number }
+  /** An operational failure inside the engine (already logged). */
+  error: { kind: EngineErrorKind; error: unknown; op?: string; routeId?: string }
+}
+
+export type RelayEventName = keyof RelayEvents
+export type RelayHandler<E extends RelayEventName> = (payload: RelayEvents[E]) => void
+
+export class RelayHooks {
+  // Internally untyped; the public on/emit signatures enforce payload types.
+  private handlers = new Map<RelayEventName, Set<(payload: unknown) => void>>()
+
+  /** Subscribe; returns an unsubscribe function. */
+  on<E extends RelayEventName>(name: E, handler: RelayHandler<E>): () => void {
+    let set = this.handlers.get(name)
+    if (!set) {
+      set = new Set()
+      this.handlers.set(name, set)
+    }
+    const h = handler as (payload: unknown) => void
+    set.add(h)
+    return () => set.delete(h)
+  }
+
+  /** Handlers must not throw; a throwing handler is isolated so it cannot break the engine. */
+  emit<E extends RelayEventName>(name: E, payload: RelayEvents[E]): void {
+    const set = this.handlers.get(name)
+    if (!set) return
+    for (const h of set) {
+      try {
+        h(payload)
+      } catch {
+        // observers never affect ingest or dispatch
+      }
+    }
+  }
+}