@heavybit/shared-lib 0.0.0-stage → 1.1.0

package/dist/esm/http/safe-fetch.js

@@ -0,0 +1,193 @@
+import { lookup as dnsLookup } from 'node:dns';
+import { isIP } from 'node:net';
+import { Agent, request } from 'undici';
+/** A fetch rejected for an SSRF guard, a limit, or a transport failure. */
+export class SafeFetchError extends Error {
+    code;
+    constructor(code, message, options) {
+        super(message, options);
+        this.name = 'SafeFetchError';
+        this.code = code;
+    }
+}
+const DEFAULT_PROTOCOLS = ['https:', 'http:'];
+const defaultLookup = (hostname, options, callback) => {
+    dnsLookup(hostname, { all: true, family: options.family }, (err, addresses) => {
+        if (err)
+            return callback(err, []);
+        callback(null, addresses.map((a) => ({ address: a.address, family: a.family })));
+    });
+};
+/**
+ * Returns a human-readable reason if `ip` is a disallowed destination (private, loopback,
+ * link-local, CGNAT, multicast, unspecified, IPv4-mapped IPv6, cloud metadata), otherwise `null`.
+ */
+export function blockedAddressReason(ip) {
+    const family = isIP(ip);
+    if (family === 4)
+        return blockedIpv4Reason(ip);
+    if (family === 6)
+        return blockedIpv6Reason(ip.toLowerCase());
+    return 'not an IP address';
+}
+function blockedIpv4Reason(ip) {
+    const parts = ip.split('.').map((p) => Number(p));
+    if (parts.length !== 4 || parts.some((p) => Number.isNaN(p) || p < 0 || p > 255))
+        return 'malformed IPv4';
+    const [a, b] = parts;
+    if (a === 0)
+        return 'unspecified';
+    if (a === 10)
+        return 'private (10.0.0.0/8)';
+    if (a === 127)
+        return 'loopback';
+    if (a === 100 && b >= 64 && b <= 127)
+        return 'CGNAT (100.64.0.0/10)';
+    if (a === 169 && b === 254)
+        return 'link-local (incl. cloud metadata)';
+    if (a === 172 && b >= 16 && b <= 31)
+        return 'private (172.16.0.0/12)';
+    if (a === 192 && b === 168)
+        return 'private (192.168.0.0/16)';
+    if (a >= 224)
+        return 'multicast or reserved';
+    return null;
+}
+function blockedIpv6Reason(ip) {
+    if (ip === '::' || ip === '::0')
+        return 'unspecified';
+    if (ip === '::1')
+        return 'loopback';
+    if (ip.startsWith('fe80') || ip.startsWith('fe9') || ip.startsWith('fea') || ip.startsWith('feb'))
+        return 'link-local';
+    if (ip.startsWith('fc') || ip.startsWith('fd'))
+        return 'unique-local (incl. fd00:ec2::254 metadata)';
+    if (ip.startsWith('ff'))
+        return 'multicast';
+    // IPv4-mapped (::ffff:a.b.c.d) and IPv4-compatible (::a.b.c.d) — unwrap and re-check.
+    const mapped = ip.match(/::(?:ffff:)?(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
+    if (mapped)
+        return `IPv4-mapped IPv6 (${blockedIpv4Reason(mapped[1]) ?? 'maps to public IPv4'})`;
+    return null;
+}
+export function createSafeFetcher(options) {
+    const { userAgent, maxBytes, timeoutMs, maxRedirects = 5, allowedProtocols = DEFAULT_PROTOCOLS, lookup = defaultLookup, allowedAddresses = [], } = options;
+    const allowSet = new Set(allowedAddresses);
+    const isBlocked = (ip) => !allowSet.has(ip) && blockedAddressReason(ip) !== null;
+    function resolveAndCheck(hostname) {
+        // A literal IP resolves to itself; still subject to the blocklist.
+        return new Promise((resolve, reject) => {
+            lookup(hostname, { all: true }, (err, addresses) => {
+                if (err)
+                    return reject(new SafeFetchError('NETWORK', `DNS lookup failed for ${hostname}`, { cause: err }));
+                if (!addresses.length)
+                    return reject(new SafeFetchError('NETWORK', `No addresses for ${hostname}`));
+                for (const a of addresses) {
+                    if (isBlocked(a.address))
+                        return reject(new SafeFetchError('BLOCKED_ADDRESS', `Blocked address ${a.address} for ${hostname}`));
+                }
+                resolve();
+            });
+        });
+    }
+    // Re-validates at connect time so a DNS rebind between the pre-check and the socket is blocked.
+    // `net.connect` calls this with `{ all: true }` (and expects an array) on modern Node; support both.
+    const connectLookup = (hostname, opts, callback) => {
+        lookup(hostname, { all: true }, (err, addresses) => {
+            if (err)
+                return callback(err, undefined, 0);
+            const blocked = addresses.find((a) => isBlocked(a.address));
+            if (blocked) {
+                return callback(new SafeFetchError('BLOCKED_ADDRESS', `Blocked address ${blocked.address} for ${hostname}`), undefined, 0);
+            }
+            if (opts?.all)
+                return callback(null, addresses);
+            const first = addresses[0];
+            callback(null, first.address, first.family);
+        });
+    };
+    const agent = new Agent({ connect: { lookup: connectLookup } });
+    async function fetchOnce(url, headers, signal) {
+        if (!allowedProtocols.includes(url.protocol)) {
+            throw new SafeFetchError('PROTOCOL_NOT_ALLOWED', `Protocol ${url.protocol} not allowed`);
+        }
+        await resolveAndCheck(url.hostname);
+        let res;
+        try {
+            // `request` does not follow redirects; we handle each 3xx hop manually and re-validate it.
+            res = await request(url, {
+                method: 'GET',
+                dispatcher: agent,
+                headers,
+                signal,
+            });
+        }
+        catch (error) {
+            if (error instanceof SafeFetchError)
+                throw error;
+            // undici wraps a thrown connect-lookup error as the cause.
+            const cause = error.cause;
+            if (cause instanceof SafeFetchError)
+                throw cause;
+            if (signal.aborted)
+                throw new SafeFetchError('TIMEOUT', `Request to ${url.href} timed out`, { cause: error });
+            throw new SafeFetchError('NETWORK', `Request to ${url.href} failed`, { cause: error });
+        }
+        const chunks = [];
+        let total = 0;
+        try {
+            for await (const chunk of res.body) {
+                const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+                total += buf.length;
+                if (total > maxBytes) {
+                    res.body.destroy();
+                    throw new SafeFetchError('TOO_LARGE', `Response from ${url.href} exceeds ${maxBytes} bytes`);
+                }
+                chunks.push(buf);
+            }
+        }
+        catch (error) {
+            if (error instanceof SafeFetchError)
+                throw error;
+            if (signal.aborted)
+                throw new SafeFetchError('TIMEOUT', `Request to ${url.href} timed out`, { cause: error });
+            throw new SafeFetchError('NETWORK', `Reading response from ${url.href} failed`, { cause: error });
+        }
+        const location = typeof res.headers.location === 'string' ? res.headers.location : undefined;
+        return { status: res.statusCode, headers: res.headers, body: Buffer.concat(chunks), finalUrl: url.href, redirects: 0, location };
+    }
+    return {
+        async fetch(rawUrl, req = {}) {
+            const controller = new AbortController();
+            const timer = setTimeout(() => controller.abort(), timeoutMs);
+            try {
+                let current = new URL(rawUrl);
+                let redirects = 0;
+                for (;;) {
+                    const headers = {
+                        'user-agent': userAgent,
+                        accept: req.accept ?? '*/*',
+                        ...req.headers,
+                    };
+                    // Never forward cookies or credentials.
+                    delete headers.cookie;
+                    delete headers.authorization;
+                    const result = await fetchOnce(current, headers, controller.signal);
+                    const isRedirect = result.status >= 300 && result.status < 400 && result.location;
+                    if (!isRedirect) {
+                        return { status: result.status, headers: result.headers, body: result.body, finalUrl: current.href, redirects };
+                    }
+                    redirects += 1;
+                    if (redirects > maxRedirects) {
+                        throw new SafeFetchError('TOO_MANY_REDIRECTS', `More than ${maxRedirects} redirects from ${rawUrl}`);
+                    }
+                    current = new URL(result.location, current);
+                }
+            }
+            finally {
+                clearTimeout(timer);
+            }
+        },
+    };
+}
+//# sourceMappingURL=safe-fetch.js.map

package/dist/esm/http/safe-fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-fetch.js","sourceRoot":"","sources":["../../../src/http/safe-fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAWxC,2EAA2E;AAC3E,MAAM,OAAO,cAAe,SAAQ,KAAK;IAC9B,IAAI,CAAqB;IAElC,YAAY,IAAwB,EAAE,OAAe,EAAE,OAA6B;QAClF,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAkDD,MAAM,iBAAiB,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAE9C,MAAM,aAAa,GAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;IAChE,SAAS,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE;QAC5E,IAAI,GAAG;YAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAClC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,EAAU;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;IACxB,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAC/C,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,iBAAiB,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7D,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,SAAS,iBAAiB,CAAC,EAAU;IACnC,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;QAAE,OAAO,gBAAgB,CAAC;IAC1G,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;IACrB,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC;IAClC,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,sBAAsB,CAAC;IAC5C,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,UAAU,CAAC;IACjC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,uBAAuB,CAAC;IACrE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,mCAAmC,CAAC;IACvE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,yBAAyB,CAAC;IACtE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,0BAA0B,CAAC;IAC9D,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,uBAAuB,CAAC;IAC7C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,EAAU;IACnC,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,KAAK;QAAE,OAAO,aAAa,CAAC;IACtD,IAAI,EAAE,KAAK,KAAK;QAAE,OAAO,UAAU,CAAC;IACpC,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IACvH,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,6CAA6C,CAAC;IACrG,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,WAAW,CAAC;IAC5C,sFAAsF;IACtF,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAC7E,IAAI,MAAM;QAAE,OAAO,qBAAqB,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,qBAAqB,GAAG,CAAC;IACjG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAA2B;IAC3D,MAAM,EACJ,SAAS,EACT,QAAQ,EACR,SAAS,EACT,YAAY,GAAG,CAAC,EAChB,gBAAgB,GAAG,iBAAiB,EACpC,MAAM,GAAG,aAAa,EACtB,gBAAgB,GAAG,EAAE,GACtB,GAAG,OAAO,CAAC;IACZ,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAE3C,MAAM,SAAS,GAAG,CAAC,EAAU,EAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,oBAAoB,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC;IAElG,SAAS,eAAe,CAAC,QAAgB;QACvC,mEAAmE;QACnE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE;gBACjD,IAAI,GAAG;oBAAE,OAAO,MAAM,CAAC,IAAI,cAAc,CAAC,SAAS,EAAE,yBAAyB,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;gBAC3G,IAAI,CAAC,SAAS,CAAC,MAAM;oBAAE,OAAO,MAAM,CAAC,IAAI,cAAc,CAAC,SAAS,EAAE,oBAAoB,QAAQ,EAAE,CAAC,CAAC,CAAC;gBACpG,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;oBAC1B,IAAI,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;wBAAE,OAAO,MAAM,CAAC,IAAI,cAAc,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC,OAAO,QAAQ,QAAQ,EAAE,CAAC,CAAC,CAAC;gBACjI,CAAC;gBACD,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,gGAAgG;IAChG,qGAAqG;IACrG,MAAM,aAAa,GAAG,CAAC,QAAgB,EAAE,IAAuB,EAAE,QAAwF,EAAQ,EAAE;QAClK,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE;YACjD,IAAI,GAAG;gBAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;YAC5C,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YAC5D,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,QAAQ,CAAC,IAAI,cAAc,CAAC,iBAAiB,EAAE,mBAAmB,OAAO,CAAC,OAAO,QAAQ,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;YAC7H,CAAC;YACD,IAAI,IAAI,EAAE,GAAG;gBAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAChD,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YAC3B,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,EAA8B,EAAE,CAAC,CAAC;IAE5F,KAAK,UAAU,SAAS,CAAC,GAAQ,EAAE,OAA+B,EAAE,MAAmB;QACrF,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,cAAc,CAAC,sBAAsB,EAAE,YAAY,GAAG,CAAC,QAAQ,cAAc,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEpC,IAAI,GAAG,CAAC;QACR,IAAI,CAAC;YACH,2FAA2F;YAC3F,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;gBACvB,MAAM,EAAE,KAAK;gBACb,UAAU,EAAE,KAAK;gBACjB,OAAO;gBACP,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,cAAc;gBAAE,MAAM,KAAK,CAAC;YACjD,2DAA2D;YAC3D,MAAM,KAAK,GAAI,KAA6B,CAAC,KAAK,CAAC;YACnD,IAAI,KAAK,YAAY,cAAc;gBAAE,MAAM,KAAK,CAAC;YACjD,IAAI,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,cAAc,GAAG,CAAC,IAAI,YAAY,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9G,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,cAAc,GAAG,CAAC,IAAI,SAAS,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;gBACnC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAChE,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC;gBACpB,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;oBACrB,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;oBACnB,MAAM,IAAI,cAAc,CAAC,WAAW,EAAE,iBAAiB,GAAG,CAAC,IAAI,YAAY,QAAQ,QAAQ,CAAC,CAAC;gBAC/F,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,cAAc;gBAAE,MAAM,KAAK,CAAC;YACjD,IAAI,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,cAAc,GAAG,CAAC,IAAI,YAAY,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9G,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,yBAAyB,GAAG,CAAC,IAAI,SAAS,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACpG,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7F,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC;IACnI,CAAC;IAED,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,GAAG,EAAE;YAC1B,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;YAC9D,IAAI,CAAC;gBACH,IAAI,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC9B,IAAI,SAAS,GAAG,CAAC,CAAC;gBAClB,SAAS,CAAC;oBACR,MAAM,OAAO,GAA2B;wBACtC,YAAY,EAAE,SAAS;wBACvB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK;wBAC3B,GAAG,GAAG,CAAC,OAAO;qBACf,CAAC;oBACF,wCAAwC;oBACxC,OAAO,OAAO,CAAC,MAAM,CAAC;oBACtB,OAAO,OAAO,CAAC,aAAa,CAAC;oBAE7B,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;oBACpE,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC;oBAClF,IAAI,CAAC,UAAU,EAAE,CAAC;wBAChB,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;oBAClH,CAAC;oBACD,SAAS,IAAI,CAAC,CAAC;oBACf,IAAI,SAAS,GAAG,YAAY,EAAE,CAAC;wBAC7B,MAAM,IAAI,cAAc,CAAC,oBAAoB,EAAE,aAAa,YAAY,mBAAmB,MAAM,EAAE,CAAC,CAAC;oBACvG,CAAC;oBACD,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAkB,EAAE,OAAO,CAAC,CAAC;gBACxD,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/esm/identity/index.js

@@ -0,0 +1,111 @@
+import { hmacSha256, safeEqual } from '../common/crypto.js';
+/**
+ * Header contract between the gateway and downstream services.
+ *
+ * The gateway strips any client-supplied identity headers, then writes these and signs them with
+ * `x-gateway-auth` = HMAC-SHA256(secret, canonical string). Services verify the signature and
+ * timestamp before trusting anything, so a request that bypasses the gateway on the internal
+ * network cannot forge an identity.
+ */
+export const IDENTITY_HEADERS = {
+    USER_ID: 'x-user-id',
+    USER_EMAIL: 'x-user-email',
+    USER_ROLES: 'x-user-roles',
+    USER_PERMISSIONS: 'x-user-permissions',
+    USER_SCOPES: 'x-user-scopes',
+    USER_ATTRS: 'x-user-attrs',
+    SESSION_ID: 'x-session-id',
+    TIMESTAMP: 'x-gateway-ts',
+    SIGNATURE: 'x-gateway-auth',
+};
+export const CONTEXT_HEADERS = {
+    CORRELATION_ID: 'x-correlation-id',
+    ANON_ID: 'x-anon-id',
+    TIMEZONE: 'x-timezone',
+    CLIENT_IP: 'x-client-ip',
+    INTERNAL_SECRET: 'x-internal-service-secret',
+    CALLER_SERVICE: 'x-caller-service',
+};
+/** Every header a client must never be allowed to set. */
+export const PROTECTED_HEADERS = [...Object.values(IDENTITY_HEADERS), CONTEXT_HEADERS.INTERNAL_SECRET, CONTEXT_HEADERS.CLIENT_IP];
+const DEFAULT_MAX_SKEW_MS = 5 * 60_000;
+function header(headers, name) {
+    const value = headers[name];
+    return Array.isArray(value) ? value[0] : value;
+}
+function canonical(values) {
+    return [
+        values[IDENTITY_HEADERS.TIMESTAMP],
+        values[IDENTITY_HEADERS.USER_ID],
+        values[IDENTITY_HEADERS.USER_EMAIL],
+        values[IDENTITY_HEADERS.USER_ROLES],
+        values[IDENTITY_HEADERS.USER_PERMISSIONS],
+        values[IDENTITY_HEADERS.USER_SCOPES],
+        values[IDENTITY_HEADERS.USER_ATTRS],
+        values[IDENTITY_HEADERS.SESSION_ID],
+    ].join('\n');
+}
+const encodeList = (items) => items.join(',');
+const decodeList = (value) => (value ? value.split(',').map((s) => s.trim()).filter(Boolean) : []);
+const encodeJson = (value) => Buffer.from(JSON.stringify(value ?? {})).toString('base64url');
+function decodeJson(value, fallback) {
+    if (!value)
+        return fallback;
+    try {
+        return JSON.parse(Buffer.from(value, 'base64url').toString('utf8'));
+    }
+    catch {
+        return fallback;
+    }
+}
+/** Gateway side: headers (including signature) that represent `user`. */
+export function signIdentityHeaders(user, secret, now = Date.now()) {
+    const values = {
+        [IDENTITY_HEADERS.TIMESTAMP]: String(now),
+        [IDENTITY_HEADERS.USER_ID]: user.id,
+        [IDENTITY_HEADERS.USER_EMAIL]: user.email ?? '',
+        [IDENTITY_HEADERS.USER_ROLES]: encodeList(user.roles),
+        [IDENTITY_HEADERS.USER_PERMISSIONS]: encodeList(user.permissions),
+        [IDENTITY_HEADERS.USER_SCOPES]: encodeJson(user.scopes),
+        [IDENTITY_HEADERS.USER_ATTRS]: encodeJson(user.attrs),
+        [IDENTITY_HEADERS.SESSION_ID]: user.sessionId ?? '',
+    };
+    values[IDENTITY_HEADERS.SIGNATURE] = hmacSha256(secret, canonical(values));
+    return values;
+}
+/** Service side: verifies and decodes the gateway identity headers. */
+export function verifyIdentityHeaders(headers, secret, options = {}) {
+    const userId = header(headers, IDENTITY_HEADERS.USER_ID);
+    if (!userId)
+        return { status: 'anonymous' };
+    const values = {};
+    for (const name of Object.values(IDENTITY_HEADERS))
+        values[name] = header(headers, name) ?? '';
+    const signature = values[IDENTITY_HEADERS.SIGNATURE];
+    if (!signature || !safeEqual(signature, hmacSha256(secret, canonical(values)))) {
+        return { status: 'invalid', reason: 'bad-signature' };
+    }
+    const ts = Number(values[IDENTITY_HEADERS.TIMESTAMP]);
+    const now = options.now ?? Date.now();
+    if (!Number.isFinite(ts) || Math.abs(now - ts) > (options.maxSkewMs ?? DEFAULT_MAX_SKEW_MS)) {
+        return { status: 'invalid', reason: 'stale-signature' };
+    }
+    return {
+        status: 'authenticated',
+        user: {
+            id: userId,
+            email: values[IDENTITY_HEADERS.USER_EMAIL] ?? '',
+            roles: decodeList(values[IDENTITY_HEADERS.USER_ROLES]),
+            permissions: decodeList(values[IDENTITY_HEADERS.USER_PERMISSIONS]),
+            scopes: decodeJson(values[IDENTITY_HEADERS.USER_SCOPES], {}),
+            attrs: decodeJson(values[IDENTITY_HEADERS.USER_ATTRS], {}),
+            sessionId: values[IDENTITY_HEADERS.SESSION_ID] || undefined,
+        },
+    };
+}
+/** Removes every protected header in place (gateway ingress). */
+export function stripProtectedHeaders(headers) {
+    for (const name of PROTECTED_HEADERS)
+        delete headers[name];
+}
+//# sourceMappingURL=index.js.map

package/dist/esm/identity/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/identity/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAG5D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,OAAO,EAAE,WAAW;IACpB,UAAU,EAAE,cAAc;IAC1B,UAAU,EAAE,cAAc;IAC1B,gBAAgB,EAAE,oBAAoB;IACtC,WAAW,EAAE,eAAe;IAC5B,UAAU,EAAE,cAAc;IAC1B,UAAU,EAAE,cAAc;IAC1B,SAAS,EAAE,cAAc;IACzB,SAAS,EAAE,gBAAgB;CACnB,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,cAAc,EAAE,kBAAkB;IAClC,OAAO,EAAE,WAAW;IACpB,QAAQ,EAAE,YAAY;IACtB,SAAS,EAAE,aAAa;IACxB,eAAe,EAAE,2BAA2B;IAC5C,cAAc,EAAE,kBAAkB;CAC1B,CAAC;AAEX,0DAA0D;AAC1D,MAAM,CAAC,MAAM,iBAAiB,GAAsB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,eAAe,CAAC,eAAe,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC;AAErJ,MAAM,mBAAmB,GAAG,CAAC,GAAG,MAAM,CAAC;AAIvC,SAAS,MAAM,CAAC,OAAkB,EAAE,IAAY;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC;AAED,SAAS,SAAS,CAAC,MAA8B;IAC/C,OAAO;QACL,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC;QAClC,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC;QAChC,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC;QACnC,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC;QACnC,MAAM,CAAC,gBAAgB,CAAC,gBAAgB,CAAC;QACzC,MAAM,CAAC,gBAAgB,CAAC,WAAW,CAAC;QACpC,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC;QACnC,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC;KACpC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,KAAe,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACxD,MAAM,UAAU,GAAG,CAAC,KAAyB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACvH,MAAM,UAAU,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAEtG,SAAS,UAAU,CAAI,KAAyB,EAAE,QAAW;IAC3D,IAAI,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAM,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,mBAAmB,CAAC,IAAc,EAAE,MAAc,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IAC1F,MAAM,MAAM,GAA2B;QACrC,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC;QACzC,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE;QACnC,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;QAC/C,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QACrD,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;QACjE,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;QACvD,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QACrD,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,SAAS,IAAI,EAAE;KACpD,CAAC;IACF,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3E,OAAO,MAAM,CAAC;AAChB,CAAC;AAOD,uEAAuE;AACvE,MAAM,UAAU,qBAAqB,CAAC,OAAkB,EAAE,MAAc,EAAE,UAAgD,EAAE;IAC1H,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAE5C,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IAE/F,MAAM,SAAS,GAAG,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACxD,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,mBAAmB,CAAC,EAAE,CAAC;QAC5F,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC1D,CAAC;IAED,OAAO;QACL,MAAM,EAAE,eAAe;QACvB,IAAI,EAAE;YACJ,EAAE,EAAE,MAAM;YACV,KAAK,EAAE,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,IAAI,EAAE;YAChD,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;YACtD,WAAW,EAAE,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;YAClE,MAAM,EAAE,UAAU,CAA2B,MAAM,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;YACtF,KAAK,EAAE,UAAU,CAA0B,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACnF,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,IAAI,SAAS;SAC5D;KACF,CAAC;AACJ,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,qBAAqB,CAAC,OAAkB;IACtD,KAAK,MAAM,IAAI,IAAI,iBAAiB;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;AAC7D,CAAC"}

package/dist/esm/index.js

@@ -0,0 +1,13 @@
+// Root entry: dependency-light building blocks usable from any Node service.
+// Modules that need optional peers (express, ioredis, knex, socket.io, rate-limiter-flexible)
+// live behind subpaths: `@heavybit/shared-lib/express`, `/cache`, `/messaging`, …
+export * from './types/index.js';
+export * from './common/index.js';
+export * from './identity/index.js';
+export * from './access/index.js';
+export * from './validation/index.js';
+export * from './logging/index.js';
+export * from './config/index.js';
+export * from './contracts/index.js';
+export * from './alerting/index.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,8FAA8F;AAC9F,kFAAkF;AAClF,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC"}

package/dist/esm/knex/index.js

@@ -0,0 +1,66 @@
+/**
+ * Migration helpers (usable from CommonJS `.cjs` migrations via `require('@heavybit/shared-lib/knex')`).
+ * They keep ID, timestamp and audit column definitions identical across services.
+ */
+/** `id CHAR(26)` primary key for ULIDs. */
+export function ulidPrimary(table, name = 'id') {
+    table.specificType(name, 'char(26)').notNullable().primary();
+}
+/** `CHAR(26)` column referencing another ULID (FK constraints only within the same database). */
+export function ulidColumn(table, name) {
+    return table.specificType(name, 'char(26)');
+}
+/** `created_at` / `updated_at` as `DATETIME(3)` in UTC, maintained by MySQL. */
+export function timestamps(table, knex) {
+    table.specificType('created_at', 'datetime(3)').notNullable().defaultTo(knex.raw('CURRENT_TIMESTAMP(3)'));
+    table.specificType('updated_at', 'datetime(3)').notNullable().defaultTo(knex.raw('CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)'));
+}
+/** `created_by` / `updated_by` actor columns (null for system operations). */
+export function actorColumns(table) {
+    ulidColumn(table, 'created_by').nullable();
+    ulidColumn(table, 'updated_by').nullable();
+}
+/** Nullable `DATETIME(3)` column. */
+export function datetime(table, name) {
+    return table.specificType(name, 'datetime(3)');
+}
+/**
+ * Creates `<parent>_audits`: every parent column (defined again by `columns`) plus `parent_id`
+ * and `action`. Audit rows are append-only history, so no unique constraints are copied.
+ */
+export async function createAuditTable(knex, parentTable, columns) {
+    const name = `${parentTable}_audits`;
+    if (await knex.schema.hasTable(name))
+        return;
+    await knex.schema.createTable(name, (table) => {
+        ulidPrimary(table);
+        ulidColumn(table, 'parent_id').notNullable().index();
+        table.enu('action', ['create', 'update', 'delete']).notNullable();
+        columns(table);
+        actorColumns(table);
+        timestamps(table, knex);
+        table.index(['parent_id', 'created_at']);
+    });
+}
+/** Transactional outbox table used by `OutboxRelay`. */
+export async function createOutboxTable(knex, name = 'event_outbox') {
+    if (await knex.schema.hasTable(name))
+        return;
+    await knex.schema.createTable(name, (table) => {
+        ulidPrimary(table);
+        table.string('routing_key', 191).notNullable();
+        table.json('payload').notNullable();
+        table.integer('attempts').unsigned().notNullable().defaultTo(0);
+        table.string('last_error', 500).nullable();
+        table.specificType('created_at', 'datetime(3)').notNullable().defaultTo(knex.raw('CURRENT_TIMESTAMP(3)'));
+        datetime(table, 'published_at').nullable();
+        table.index(['published_at', 'id']);
+    });
+}
+/** Standard table options: InnoDB, utf8mb4. Call inside `createTable`. */
+export function utf8mb4(table) {
+    table.engine('InnoDB');
+    table.charset('utf8mb4');
+    table.collate('utf8mb4_unicode_ci');
+}
+//# sourceMappingURL=index.js.map

package/dist/esm/knex/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/knex/index.ts"],"names":[],"mappings":"AAEA;;;GAGG;AAEH,2CAA2C;AAC3C,MAAM,UAAU,WAAW,CAAC,KAA8B,EAAE,IAAI,GAAG,IAAI;IACrE,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,CAAC;AAC/D,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,UAAU,CAAC,KAAuD,EAAE,IAAY;IAC9F,OAAO,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AAC9C,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,UAAU,CAAC,KAA8B,EAAE,IAAU;IACnE,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAC1G,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC,CAAC;AAC3I,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,YAAY,CAAC,KAA8B;IACzD,UAAU,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3C,UAAU,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;AAC7C,CAAC;AAED,qCAAqC;AACrC,MAAM,UAAU,QAAQ,CAAC,KAAuD,EAAE,IAAY;IAC5F,OAAO,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAU,EAAE,WAAmB,EAAE,OAAiD;IACvH,MAAM,IAAI,GAAG,GAAG,WAAW,SAAS,CAAC;IACrC,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO;IAC7C,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE;QAC5C,WAAW,CAAC,KAAK,CAAC,CAAC;QACnB,UAAU,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,CAAC;QACrD,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAClE,OAAO,CAAC,KAAK,CAAC,CAAC;QACf,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACxB,KAAK,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,wDAAwD;AACxD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAU,EAAE,IAAI,GAAG,cAAc;IACvE,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO;IAC7C,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE;QAC5C,WAAW,CAAC,KAAK,CAAC,CAAC;QACnB,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QACpC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAChE,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3C,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC1G,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3C,KAAK,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,OAAO,CAAC,KAA8B;IACpD,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvB,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACzB,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;AACtC,CAAC"}

package/dist/esm/logging/index.js

@@ -0,0 +1,67 @@
+import winston from 'winston';
+const { combine, timestamp, json, errors, colorize, printf, splat } = winston.format;
+/** Keys whose values are replaced with `[REDACTED]` anywhere in log metadata. */
+export const DEFAULT_REDACT_KEYS = [
+    'password', 'newPassword', 'currentPassword', 'passwordHash', 'token', 'accessToken', 'refreshToken',
+    'secret', 'clientSecret', 'apiKey', 'authorization', 'cookie', 'otp', 'pass', 'smtpPassword',
+];
+function redactValue(value, keys, depth = 0) {
+    if (depth > 6 || value === null || typeof value !== 'object')
+        return value;
+    if (Array.isArray(value))
+        return value.map((v) => redactValue(v, keys, depth + 1));
+    if (value instanceof Error)
+        return value;
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+        out[k] = keys.has(k) || k.endsWith('Enc') || k.endsWith('_enc') ? '[REDACTED]' : redactValue(v, keys, depth + 1);
+    }
+    return out;
+}
+const redact = (keys) => winston.format((info) => {
+    for (const k of Object.keys(info)) {
+        if (keys.has(k))
+            info[k] = '[REDACTED]';
+        else if (k !== 'message' && k !== 'level')
+            info[k] = redactValue(info[k], keys);
+    }
+    return info;
+})();
+const devFormat = printf((info) => {
+    const { level, message, timestamp: ts, service, stack, ...rest } = info;
+    const meta = Object.fromEntries(Object.entries(rest).filter(([k]) => typeof k === 'string' && k !== 'splat'));
+    const metaStr = Object.keys(meta).length ? ` ${JSON.stringify(meta)}` : '';
+    return `${String(ts ?? '')} ${String(level)}: ${service ? `[${String(service)}] ` : ''}${String(message)}${metaStr}${stack ? `\n${String(stack)}` : ''}`;
+});
+/** Structured logger with secret redaction. JSON to stdout in production, pretty otherwise. */
+export function createLogger(service, options = {}) {
+    const isProduction = process.env.NODE_ENV === 'production';
+    const level = options.level ?? process.env.LOG_LEVEL ?? (isProduction ? 'info' : 'debug');
+    const format = options.format ?? process.env.LOG_FORMAT ?? (isProduction ? 'json' : 'pretty');
+    const keys = new Set([...DEFAULT_REDACT_KEYS, ...(options.redactKeys ?? [])]);
+    return winston.createLogger({
+        level,
+        defaultMeta: { service },
+        format: combine(errors({ stack: true }), splat(), redact(keys), timestamp()),
+        transports: [
+            new winston.transports.Console({
+                silent: process.env.NODE_ENV === 'test' && !process.env.LOG_IN_TESTS,
+                format: format === 'json' ? json() : combine(colorize({ level: true }), devFormat),
+            }),
+        ],
+    });
+}
+/** Logger that discards everything — handy default for libraries and tests. */
+export const silentLogger = { debug: () => { }, info: () => { }, warn: () => { }, error: () => { } };
+/**
+ * A logger that adds `context` (for example pipeline IDs) to every line it writes; a line's own
+ * meta wins on a key clash. `undefined` context values are dropped so lines never carry empty keys.
+ * Works over any {@link Logger} (winston, a test spy, or another child), so handlers can create one
+ * per message and pass it down.
+ */
+export function childLogger(logger, context) {
+    const base = Object.fromEntries(Object.entries(context).filter(([, v]) => v !== undefined));
+    const write = (level) => (message, meta) => logger[level](message, { ...base, ...meta });
+    return { debug: write('debug'), info: write('info'), warn: write('warn'), error: write('error') };
+}
+//# sourceMappingURL=index.js.map

package/dist/esm/logging/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/logging/index.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAG9B,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;AAErF,iFAAiF;AACjF,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,UAAU,EAAE,aAAa,EAAE,iBAAiB,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa,EAAE,cAAc;IACpG,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc;CAC7F,CAAC;AAEF,SAAS,WAAW,CAAC,KAAc,EAAE,IAAiB,EAAE,KAAK,GAAG,CAAC;IAC/D,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC3E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IACnF,IAAI,KAAK,YAAY,KAAK;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IACnH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,IAAiB,EAAE,EAAE,CACnC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;IACtB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAG,IAAgC,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC;aAChE,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,OAAO;YAAG,IAAgC,CAAC,CAAC,CAAC,GAAG,WAAW,CAAE,IAAgC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5I,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC,EAAE,CAAC;AAEP,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;IAChC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,IAA+B,CAAC;IACnG,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC;IAC9G,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,OAAO,GAAG,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAC3J,CAAC,CAAC,CAAC;AASH,+FAA+F;AAC/F,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,UAAyB,EAAE;IACvE,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;IAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAK,OAAO,CAAC,GAAG,CAAC,UAA4C,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACjI,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,mBAAmB,EAAE,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAE9E,OAAO,OAAO,CAAC,YAAY,CAAC;QAC1B,KAAK;QACL,WAAW,EAAE,EAAE,OAAO,EAAE;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC;QAC5E,UAAU,EAAE;YACV,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;gBAC7B,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY;gBACpE,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,CAAC;aACnF,CAAC;SACH;KACF,CAA4B,CAAC;AAChC,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,MAAM,YAAY,GAAW,EAAE,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,CAAC;AAEzG;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,OAAgC;IAC1E,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC;IAC5F,MAAM,KAAK,GAAG,CAAC,KAAmB,EAAE,EAAE,CAAC,CAAC,OAAe,EAAE,IAA8B,EAAE,EAAE,CACzF,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IAC/C,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;AACpG,CAAC"}

package/dist/esm/messaging/connection.js

@@ -0,0 +1,108 @@
+import amqp from 'amqplib';
+import { sleep } from '../common/async.js';
+import { silentLogger } from '../logging/index.js';
+/**
+ * One AMQP connection per process with automatic reconnect. Components register channels
+ * with a `setup` callback (assert topology, start consuming); setups re-run after every
+ * reconnect so consumers and publishers heal without restarts.
+ */
+export class AmqpConnection {
+    options;
+    model = null;
+    registrations = [];
+    closing = false;
+    connecting = null;
+    logger;
+    constructor(options) {
+        this.options = options;
+        this.logger = options.logger ?? silentLogger;
+    }
+    get isConnected() {
+        return this.model !== null;
+    }
+    /** Registers a channel. If already connected it is opened immediately. */
+    async registerChannel(name, setup, options = {}) {
+        const registration = { name, confirm: options.confirm ?? false, setup: setup, channel: null };
+        this.registrations.push(registration);
+        if (this.model)
+            await this.openChannel(registration);
+        return { name, current: () => registration.channel };
+    }
+    /**
+     * Connects, retrying with back-off until it succeeds or `close()` is called. Resolves once the
+     * first connection is up; later drops reconnect in the background.
+     */
+    connect() {
+        if (!this.connecting) {
+            this.connecting = this.connectWithRetry().finally(() => { this.connecting = null; });
+        }
+        return this.connecting;
+    }
+    /** Throws when the broker is not reachable — used by readiness checks. */
+    assertReady() {
+        if (!this.model)
+            throw new Error('RabbitMQ is not connected');
+    }
+    async close() {
+        this.closing = true;
+        for (const reg of this.registrations) {
+            await reg.channel?.close().catch(() => undefined);
+            reg.channel = null;
+        }
+        await this.model?.close().catch(() => undefined);
+        this.model = null;
+    }
+    async connectWithRetry() {
+        const delay = this.options.reconnectDelayMs ?? ((n) => Math.min(30_000, 1000 * 2 ** (n - 1)));
+        for (let attempt = 1; !this.closing; attempt += 1) {
+            try {
+                await this.establish();
+                return;
+            }
+            catch (error) {
+                this.logger.warn('RabbitMQ connect failed; retrying', { attempt, error: error.message });
+                await sleep(delay(attempt));
+            }
+        }
+    }
+    async establish() {
+        const model = await amqp.connect(this.options.url, {
+            clientProperties: { connection_name: this.options.connectionName },
+            heartbeat: this.options.heartbeatSec ?? 30,
+        });
+        model.on('error', (error) => this.logger.error('RabbitMQ connection error', { error: error.message }));
+        model.on('close', () => {
+            if (this.model !== model)
+                return;
+            this.model = null;
+            for (const reg of this.registrations)
+                reg.channel = null;
+            if (!this.closing) {
+                this.logger.warn('RabbitMQ connection closed; reconnecting');
+                void this.connect();
+            }
+        });
+        this.model = model;
+        for (const reg of this.registrations)
+            await this.openChannel(reg);
+        this.logger.info('Connected to RabbitMQ', { connection: this.options.connectionName, channels: this.registrations.length });
+    }
+    async openChannel(reg) {
+        if (!this.model)
+            return;
+        const channel = reg.confirm ? await this.model.createConfirmChannel() : await this.model.createChannel();
+        channel.on('error', (error) => this.logger.error('RabbitMQ channel error', { channel: reg.name, error: error.message }));
+        channel.on('close', () => {
+            if (reg.channel !== channel)
+                return;
+            reg.channel = null;
+            // A channel can close on its own (e.g. precondition failure) while the connection lives on.
+            if (this.model && !this.closing) {
+                setTimeout(() => { void this.openChannel(reg).catch((e) => this.logger.error('Channel reopen failed', { channel: reg.name, error: e.message })); }, 1000);
+            }
+        });
+        await reg.setup(channel);
+        reg.channel = channel;
+    }
+}
+//# sourceMappingURL=connection.js.map

package/dist/esm/messaging/connection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection.js","sourceRoot":"","sources":["../../../src/messaging/connection.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,SAAS,CAAC;AAE3B,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AA4BnD;;;;GAIG;AACH,MAAM,OAAO,cAAc;IAOI;IANrB,KAAK,GAAqB,IAAI,CAAC;IACtB,aAAa,GAA0B,EAAE,CAAC;IACnD,OAAO,GAAG,KAAK,CAAC;IAChB,UAAU,GAAyB,IAAI,CAAC;IAC/B,MAAM,CAAS;IAEhC,YAA6B,OAA8B;QAA9B,YAAO,GAAP,OAAO,CAAuB;QACzD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC;IAC/C,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC;IAC7B,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,eAAe,CAA8B,IAAY,EAAE,KAAoC,EAAE,UAAiC,EAAE;QACxI,MAAM,YAAY,GAAwB,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,KAAK,EAAE,KAAK,EAAE,KAAsC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACpJ,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACtC,IAAI,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;QACrD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,OAAmB,EAAE,CAAC;IACnE,CAAC;IAED;;;OAGG;IACH,OAAO;QACL,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,0EAA0E;IAC1E,WAAW;QACT,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACrC,MAAM,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAClD,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;QACrB,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,gBAAgB;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACtG,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;gBACvB,OAAO;YACT,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;gBACpG,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;YACjD,gBAAgB,EAAE,EAAE,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE;YAClE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,EAAE;SAC3C,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC9G,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACrB,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK;gBAAE,OAAO;YACjC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAClB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,aAAa;gBAAE,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;YACzD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;gBAC7D,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;YACtB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,aAAa;YAAE,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9H,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,GAAwB;QAChD,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO;QACxB,MAAM,OAAO,GAAY,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QAClH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAChI,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO;gBAAE,OAAO;YACpC,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;YACnB,4FAA4F;YAC5F,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBAChC,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YACvK,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACzB,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,CAAC;CACF"}