@hasna/events 0.1.0 → 0.1.2

package/dist/cli/index.js

@@ -53,7 +53,7 @@ function channelMatchesEvent(channel, event) {
 }
 
 // src/storage.ts
-import { mkdir, readFile, rename, writeFile } from "fs/promises";
+import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises";
 import { existsSync } from "fs";
 import { homedir } from "os";
 import { join } from "path";
@@ -75,7 +75,10 @@ class JsonEventsStore {
     this.deliveriesPath = join(dataDir, "deliveries.json");
   }
   async init() {
-    await mkdir(this.dataDir, { recursive: true });
+    await mkdir(this.dataDir, { recursive: true, mode: 448 });
+    await chmod(this.dataDir, 448).catch(() => {
+      return;
+    });
     await this.ensureArrayFile(this.channelsPath);
     await this.ensureArrayFile(this.eventsPath);
     await this.ensureArrayFile(this.deliveriesPath);
@@ -143,8 +146,11 @@ class JsonEventsStore {
   async ensureArrayFile(path) {
     if (!existsSync(path)) {
       await writeFile(path, `[]
-`, "utf-8");
+`, { encoding: "utf-8", mode: 384 });
     }
+    await chmod(path, 384).catch(() => {
+      return;
+    });
   }
   async readJson(path, fallback) {
     try {
@@ -161,8 +167,11 @@ class JsonEventsStore {
   async writeJson(path, value) {
     const tempPath = `${path}.${process.pid}.${Date.now()}.tmp`;
     await writeFile(tempPath, `${JSON.stringify(value, null, 2)}
-`, "utf-8");
+`, { encoding: "utf-8", mode: 384 });
     await rename(tempPath, path);
+    await chmod(path, 384).catch(() => {
+      return;
+    });
   }
 }
 
@@ -172,6 +181,7 @@ import { spawn } from "child_process";
 
 // src/signing.ts
 import { createHmac, timingSafeEqual } from "crypto";
+var DEFAULT_SIGNATURE_TOLERANCE_MS = 5 * 60 * 1000;
 function buildSignatureBase(timestamp, body) {
   return `${timestamp}.${body}`;
 }
@@ -371,7 +381,7 @@ class EventsClient {
     return this.store.removeChannel(id);
   }
   async emit(input, options = {}) {
-    const event = createEvent(input);
+    const event = options.redactSensitiveData === false ? createEvent(input) : redactSensitiveKeys(createEvent(input));
     if (options.dedupe !== false) {
       const existing = await this.store.findEventByIdentity({ id: input.id, dedupeKey: event.dedupeKey });
       if (existing) {
@@ -486,9 +496,22 @@ function sanitizeChannelForOutput(channel) {
 function sanitizeChannelsForOutput(channels) {
   return channels.map(sanitizeChannelForOutput);
 }
+function redactSensitiveKeys(event, replacement = "[REDACTED]") {
+  return redactValue(event, replacement);
+}
 function shouldRedactKey(key) {
   return /secret|token|password|api[_-]?key|authorization/i.test(key);
 }
+function redactValue(value, replacement) {
+  if (Array.isArray(value))
+    return value.map((item) => redactValue(item, replacement));
+  if (!value || typeof value !== "object")
+    return value;
+  return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+    key,
+    shouldRedactKey(key) ? replacement : redactValue(item, replacement)
+  ]));
+}
 function setPath(input, path, replacement) {
   const parts = path.split(".");
   let cursor = input;

package/dist/commander.js

@@ -43,7 +43,7 @@ function channelMatchesEvent(channel, event) {
 }
 
 // src/storage.ts
-import { mkdir, readFile, rename, writeFile } from "fs/promises";
+import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises";
 import { existsSync } from "fs";
 import { homedir } from "os";
 import { join } from "path";
@@ -65,7 +65,10 @@ class JsonEventsStore {
     this.deliveriesPath = join(dataDir, "deliveries.json");
   }
   async init() {
-    await mkdir(this.dataDir, { recursive: true });
+    await mkdir(this.dataDir, { recursive: true, mode: 448 });
+    await chmod(this.dataDir, 448).catch(() => {
+      return;
+    });
     await this.ensureArrayFile(this.channelsPath);
     await this.ensureArrayFile(this.eventsPath);
     await this.ensureArrayFile(this.deliveriesPath);
@@ -133,8 +136,11 @@ class JsonEventsStore {
   async ensureArrayFile(path) {
     if (!existsSync(path)) {
       await writeFile(path, `[]
-`, "utf-8");
+`, { encoding: "utf-8", mode: 384 });
     }
+    await chmod(path, 384).catch(() => {
+      return;
+    });
   }
   async readJson(path, fallback) {
     try {
@@ -151,13 +157,17 @@ class JsonEventsStore {
   async writeJson(path, value) {
     const tempPath = `${path}.${process.pid}.${Date.now()}.tmp`;
     await writeFile(tempPath, `${JSON.stringify(value, null, 2)}
-`, "utf-8");
+`, { encoding: "utf-8", mode: 384 });
     await rename(tempPath, path);
+    await chmod(path, 384).catch(() => {
+      return;
+    });
   }
 }
 
 // src/signing.ts
 import { createHmac, timingSafeEqual } from "crypto";
+var DEFAULT_SIGNATURE_TOLERANCE_MS = 5 * 60 * 1000;
 function buildSignatureBase(timestamp, body) {
   return `${timestamp}.${body}`;
 }
@@ -182,7 +192,8 @@ function isTimestampWithinTolerance(timestamp, toleranceMs, now = Date.now()) {
   return Math.abs(reference - parsed) <= toleranceMs;
 }
 function verifyWebhookSignature(secret, timestamp, body, signature, options = {}) {
-  if (options.toleranceMs !== undefined && !isTimestampWithinTolerance(timestamp, options.toleranceMs, options.now)) {
+  const toleranceMs = options.toleranceMs ?? DEFAULT_SIGNATURE_TOLERANCE_MS;
+  if (!isTimestampWithinTolerance(timestamp, toleranceMs, options.now)) {
     return false;
   }
   return verifyPayloadSignature(secret, timestamp, body, signature);
@@ -381,7 +392,7 @@ class EventsClient {
     return this.store.removeChannel(id);
   }
   async emit(input, options = {}) {
-    const event = createEvent(input);
+    const event = options.redactSensitiveData === false ? createEvent(input) : redactSensitiveKeys(createEvent(input));
     if (options.dedupe !== false) {
       const existing = await this.store.findEventByIdentity({ id: input.id, dedupeKey: event.dedupeKey });
       if (existing) {
@@ -496,9 +507,22 @@ function sanitizeChannelForOutput(channel) {
 function sanitizeChannelsForOutput(channels) {
   return channels.map(sanitizeChannelForOutput);
 }
+function redactSensitiveKeys(event, replacement = "[REDACTED]") {
+  return redactValue(event, replacement);
+}
 function shouldRedactKey(key) {
   return /secret|token|password|api[_-]?key|authorization/i.test(key);
 }
+function redactValue(value, replacement) {
+  if (Array.isArray(value))
+    return value.map((item) => redactValue(item, replacement));
+  if (!value || typeof value !== "object")
+    return value;
+  return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+    key,
+    shouldRedactKey(key) ? replacement : redactValue(item, replacement)
+  ]));
+}
 function setPath(input, path, replacement) {
   const parts = path.split(".");
   let cursor = input;

package/dist/index.d.ts

@@ -35,3 +35,4 @@ export declare class EventsClient {
 export declare function redactPaths<T extends EventEnvelope>(event: T, paths: string[], replacement?: string): T;
 export declare function sanitizeChannelForOutput(channel: ChannelConfig): ChannelConfig;
 export declare function sanitizeChannelsForOutput(channels: ChannelConfig[]): ChannelConfig[];
+export declare function redactSensitiveKeys<T extends EventEnvelope>(event: T, replacement?: string): T;

package/dist/index.js

@@ -43,7 +43,7 @@ function channelMatchesEvent(channel, event) {
 }
 
 // src/storage.ts
-import { mkdir, readFile, rename, writeFile } from "fs/promises";
+import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises";
 import { existsSync } from "fs";
 import { homedir } from "os";
 import { join } from "path";
@@ -65,7 +65,10 @@ class JsonEventsStore {
     this.deliveriesPath = join(dataDir, "deliveries.json");
   }
   async init() {
-    await mkdir(this.dataDir, { recursive: true });
+    await mkdir(this.dataDir, { recursive: true, mode: 448 });
+    await chmod(this.dataDir, 448).catch(() => {
+      return;
+    });
     await this.ensureArrayFile(this.channelsPath);
     await this.ensureArrayFile(this.eventsPath);
     await this.ensureArrayFile(this.deliveriesPath);
@@ -133,8 +136,11 @@ class JsonEventsStore {
   async ensureArrayFile(path) {
     if (!existsSync(path)) {
       await writeFile(path, `[]
-`, "utf-8");
+`, { encoding: "utf-8", mode: 384 });
     }
+    await chmod(path, 384).catch(() => {
+      return;
+    });
   }
   async readJson(path, fallback) {
     try {
@@ -151,13 +157,17 @@ class JsonEventsStore {
   async writeJson(path, value) {
     const tempPath = `${path}.${process.pid}.${Date.now()}.tmp`;
     await writeFile(tempPath, `${JSON.stringify(value, null, 2)}
-`, "utf-8");
+`, { encoding: "utf-8", mode: 384 });
     await rename(tempPath, path);
+    await chmod(path, 384).catch(() => {
+      return;
+    });
   }
 }
 
 // src/signing.ts
 import { createHmac, timingSafeEqual } from "crypto";
+var DEFAULT_SIGNATURE_TOLERANCE_MS = 5 * 60 * 1000;
 function buildSignatureBase(timestamp, body) {
   return `${timestamp}.${body}`;
 }
@@ -182,7 +192,8 @@ function isTimestampWithinTolerance(timestamp, toleranceMs, now = Date.now()) {
   return Math.abs(reference - parsed) <= toleranceMs;
 }
 function verifyWebhookSignature(secret, timestamp, body, signature, options = {}) {
-  if (options.toleranceMs !== undefined && !isTimestampWithinTolerance(timestamp, options.toleranceMs, options.now)) {
+  const toleranceMs = options.toleranceMs ?? DEFAULT_SIGNATURE_TOLERANCE_MS;
+  if (!isTimestampWithinTolerance(timestamp, toleranceMs, options.now)) {
     return false;
   }
   return verifyPayloadSignature(secret, timestamp, body, signature);
@@ -381,7 +392,7 @@ class EventsClient {
     return this.store.removeChannel(id);
   }
   async emit(input, options = {}) {
-    const event = createEvent(input);
+    const event = options.redactSensitiveData === false ? createEvent(input) : redactSensitiveKeys(createEvent(input));
     if (options.dedupe !== false) {
       const existing = await this.store.findEventByIdentity({ id: input.id, dedupeKey: event.dedupeKey });
       if (existing) {
@@ -496,9 +507,22 @@ function sanitizeChannelForOutput(channel) {
 function sanitizeChannelsForOutput(channels) {
   return channels.map(sanitizeChannelForOutput);
 }
+function redactSensitiveKeys(event, replacement = "[REDACTED]") {
+  return redactValue(event, replacement);
+}
 function shouldRedactKey(key) {
   return /secret|token|password|api[_-]?key|authorization/i.test(key);
 }
+function redactValue(value, replacement) {
+  if (Array.isArray(value))
+    return value.map((item) => redactValue(item, replacement));
+  if (!value || typeof value !== "object")
+    return value;
+  return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+    key,
+    shouldRedactKey(key) ? replacement : redactValue(item, replacement)
+  ]));
+}
 function setPath(input, path, replacement) {
   const parts = path.split(".");
   let cursor = input;
@@ -530,6 +554,7 @@ export {
   signPayload,
   sanitizeChannelsForOutput,
   sanitizeChannelForOutput,
+  redactSensitiveKeys,
   redactPaths,
   matchString,
   isTimestampWithinTolerance,
@@ -546,5 +571,6 @@ export {
   JsonEventsStore,
   HASNA_EVENTS_HOME_ENV,
   HASNA_EVENTS_DIR_ENV,
-  EventsClient
+  EventsClient,
+  DEFAULT_SIGNATURE_TOLERANCE_MS
 };

package/dist/signing.d.ts

@@ -2,6 +2,7 @@ export interface SignatureVerificationOptions {
     toleranceMs?: number;
     now?: number | Date;
 }
+export declare const DEFAULT_SIGNATURE_TOLERANCE_MS: number;
 export declare function buildSignatureBase(timestamp: string, body: string): string;
 export declare function signPayload(secret: string, timestamp: string, body: string): string;
 export declare function verifyPayloadSignature(secret: string, timestamp: string, body: string, signature: string): boolean;

package/dist/signing.js

@@ -1,6 +1,7 @@
 // @bun
 // src/signing.ts
 import { createHmac, timingSafeEqual } from "crypto";
+var DEFAULT_SIGNATURE_TOLERANCE_MS = 5 * 60 * 1000;
 function buildSignatureBase(timestamp, body) {
   return `${timestamp}.${body}`;
 }
@@ -25,7 +26,8 @@ function isTimestampWithinTolerance(timestamp, toleranceMs, now = Date.now()) {
   return Math.abs(reference - parsed) <= toleranceMs;
 }
 function verifyWebhookSignature(secret, timestamp, body, signature, options = {}) {
-  if (options.toleranceMs !== undefined && !isTimestampWithinTolerance(timestamp, options.toleranceMs, options.now)) {
+  const toleranceMs = options.toleranceMs ?? DEFAULT_SIGNATURE_TOLERANCE_MS;
+  if (!isTimestampWithinTolerance(timestamp, toleranceMs, options.now)) {
     return false;
   }
   return verifyPayloadSignature(secret, timestamp, body, signature);
@@ -35,5 +37,6 @@ export {
   verifyPayloadSignature,
   signPayload,
   isTimestampWithinTolerance,
-  buildSignatureBase
+  buildSignatureBase,
+  DEFAULT_SIGNATURE_TOLERANCE_MS
 };

package/dist/storage.js

@@ -1,6 +1,6 @@
 // @bun
 // src/storage.ts
-import { mkdir, readFile, rename, writeFile } from "fs/promises";
+import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises";
 import { existsSync } from "fs";
 import { homedir } from "os";
 import { join } from "path";
@@ -22,7 +22,10 @@ class JsonEventsStore {
     this.deliveriesPath = join(dataDir, "deliveries.json");
   }
   async init() {
-    await mkdir(this.dataDir, { recursive: true });
+    await mkdir(this.dataDir, { recursive: true, mode: 448 });
+    await chmod(this.dataDir, 448).catch(() => {
+      return;
+    });
     await this.ensureArrayFile(this.channelsPath);
     await this.ensureArrayFile(this.eventsPath);
     await this.ensureArrayFile(this.deliveriesPath);
@@ -90,8 +93,11 @@ class JsonEventsStore {
   async ensureArrayFile(path) {
     if (!existsSync(path)) {
       await writeFile(path, `[]
-`, "utf-8");
+`, { encoding: "utf-8", mode: 384 });
     }
+    await chmod(path, 384).catch(() => {
+      return;
+    });
   }
   async readJson(path, fallback) {
     try {
@@ -108,8 +114,11 @@ class JsonEventsStore {
   async writeJson(path, value) {
     const tempPath = `${path}.${process.pid}.${Date.now()}.tmp`;
     await writeFile(tempPath, `${JSON.stringify(value, null, 2)}
-`, "utf-8");
+`, { encoding: "utf-8", mode: 384 });
     await rename(tempPath, path);
+    await chmod(path, 384).catch(() => {
+      return;
+    });
   }
 }
 export {

package/dist/transports.js

@@ -1,6 +1,7 @@
 // @bun
 // src/signing.ts
 import { createHmac, timingSafeEqual } from "crypto";
+var DEFAULT_SIGNATURE_TOLERANCE_MS = 5 * 60 * 1000;
 function buildSignatureBase(timestamp, body) {
   return `${timestamp}.${body}`;
 }
@@ -25,7 +26,8 @@ function isTimestampWithinTolerance(timestamp, toleranceMs, now = Date.now()) {
   return Math.abs(reference - parsed) <= toleranceMs;
 }
 function verifyWebhookSignature(secret, timestamp, body, signature, options = {}) {
-  if (options.toleranceMs !== undefined && !isTimestampWithinTolerance(timestamp, options.toleranceMs, options.now)) {
+  const toleranceMs = options.toleranceMs ?? DEFAULT_SIGNATURE_TOLERANCE_MS;
+  if (!isTimestampWithinTolerance(timestamp, toleranceMs, options.now)) {
     return false;
   }
   return verifyPayloadSignature(secret, timestamp, body, signature);

package/dist/types.d.ts

@@ -99,6 +99,7 @@ export type EventRedactor = (event: EventEnvelope, channel: ChannelConfig) => Ev
 export interface EmitOptions {
     deliver?: boolean;
     dedupe?: boolean;
+    redactSensitiveData?: boolean;
 }
 export interface ReplayOptions {
     eventId?: string;

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@hasna/events",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Shared event envelopes, local subscriptions, and webhook delivery for Hasna open-source apps",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "bin": {
-    "events": "./dist/cli/index.js",
-    "hasna-events": "./dist/cli/index.js"
+    "events": "dist/cli/index.js",
+    "hasna-events": "dist/cli/index.js"
   },
   "exports": {
     ".": {