@heavybit/shared-lib 0.0.0-stage → 1.1.0

package/dist/esm/messaging/rpc.js

@@ -0,0 +1,120 @@
+import { AppError, isAppError, ServiceUnavailableError } from '../common/errors.js';
+import { newId } from '../common/id.js';
+import { silentLogger } from '../logging/index.js';
+const REPLY_TO = 'amq.rabbitmq.reply-to';
+/**
+ * Request/response over RabbitMQ for the few synchronous cross-service calls that must fail
+ * cleanly (e.g. "create the profile before committing the account"). Uses direct reply-to, so
+ * no reply queue is declared per call, and sets the request TTL to the caller's timeout so a
+ * request the caller has given up on is never executed late.
+ */
+export class RpcServer {
+    connection;
+    topology;
+    handles = [];
+    logger;
+    constructor(connection, topology, logger) {
+        this.connection = connection;
+        this.topology = topology;
+        this.logger = logger ?? silentLogger;
+    }
+    async handle(method, handler, options = {}) {
+        const queue = this.topology.queue(method);
+        this.handles.push(await this.connection.registerChannel(`rpc-server:${queue}`, async (channel) => {
+            await channel.assertQueue(queue, { durable: true });
+            await channel.prefetch(options.prefetch ?? 5);
+            await channel.consume(queue, (msg) => { if (msg)
+                void this.respond(channel, msg, handler); });
+        }));
+        this.logger.info('RPC method registered', { queue });
+    }
+    async respond(channel, msg, handler) {
+        let reply;
+        try {
+            const payload = JSON.parse(msg.content.toString('utf8'));
+            const data = await handler(payload, { correlationId: msg.properties.correlationId, callerService: msg.properties.appId });
+            reply = { ok: true, data };
+        }
+        catch (error) {
+            const status = isAppError(error) ? error.statusCode : 500;
+            const message = isAppError(error) && status < 500 ? error.message : 'RPC handler failed';
+            if (status >= 500)
+                this.logger.error('RPC handler error', { queue: msg.fields.routingKey, error: error.message });
+            reply = { ok: false, error: { status, code: isAppError(error) ? error.code : 'INTERNAL_ERROR', message } };
+        }
+        if (msg.properties.replyTo) {
+            channel.sendToQueue(msg.properties.replyTo, Buffer.from(JSON.stringify(reply)), { correlationId: msg.properties.correlationId, contentType: 'application/json' });
+        }
+        channel.ack(msg);
+    }
+}
+export class RpcClient {
+    connection;
+    topology;
+    callerService;
+    handle = null;
+    pending = new Map();
+    logger;
+    constructor(connection, topology, callerService, logger) {
+        this.connection = connection;
+        this.topology = topology;
+        this.callerService = callerService;
+        this.logger = logger ?? silentLogger;
+    }
+    async init() {
+        this.handle = await this.connection.registerChannel('rpc-client', async (channel) => {
+            // A reconnect invalidates every in-flight reply.
+            this.failAll(new ServiceUnavailableError('RPC channel reset'));
+            await channel.consume(REPLY_TO, (msg) => { if (msg)
+                this.onReply(msg); }, { noAck: true });
+        });
+    }
+    call(method, payload, options = {}) {
+        const channel = this.handle?.current();
+        if (!channel)
+            return Promise.reject(new ServiceUnavailableError('Message broker unavailable'));
+        const timeoutMs = options.timeoutMs ?? 5000;
+        const id = newId();
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                this.pending.delete(id);
+                this.logger.warn('RPC timed out', { method, timeoutMs });
+                reject(new ServiceUnavailableError(`Upstream did not respond in time (${method})`));
+            }, timeoutMs);
+            this.pending.set(id, { resolve: resolve, reject, timer });
+            channel.sendToQueue(this.topology.queue(method), Buffer.from(JSON.stringify(payload)), {
+                correlationId: id,
+                replyTo: REPLY_TO,
+                contentType: 'application/json',
+                expiration: String(timeoutMs),
+                appId: this.callerService,
+                headers: options.correlationId ? { 'x-correlation-id': options.correlationId } : undefined,
+            });
+        });
+    }
+    onReply(msg) {
+        const entry = this.pending.get(msg.properties.correlationId);
+        if (!entry)
+            return;
+        this.pending.delete(msg.properties.correlationId);
+        clearTimeout(entry.timer);
+        try {
+            const reply = JSON.parse(msg.content.toString('utf8'));
+            if (reply.ok)
+                entry.resolve(reply.data);
+            else
+                entry.reject(new AppError(reply.error.status, reply.error.message, { code: reply.error.code }));
+        }
+        catch (error) {
+            entry.reject(new ServiceUnavailableError('Malformed RPC reply', { cause: error }));
+        }
+    }
+    failAll(error) {
+        for (const [id, entry] of this.pending) {
+            clearTimeout(entry.timer);
+            entry.reject(error);
+            this.pending.delete(id);
+        }
+    }
+}
+//# sourceMappingURL=rpc.js.map

package/dist/esm/messaging/rpc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rpc.js","sourceRoot":"","sources":["../../../src/messaging/rpc.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACpF,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAKnD,MAAM,QAAQ,GAAG,uBAAuB,CAAC;AASzC;;;;;GAKG;AACH,MAAM,OAAO,SAAS;IAIS;IAA6C;IAHzD,OAAO,GAAoB,EAAE,CAAC;IAC9B,MAAM,CAAS;IAEhC,YAA6B,UAA0B,EAAmB,QAAkB,EAAE,MAAe;QAAhF,eAAU,GAAV,UAAU,CAAgB;QAAmB,aAAQ,GAAR,QAAQ,CAAU;QAC1F,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,YAAY,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,MAAM,CAAO,MAAc,EAAE,OAAwD,EAAE,UAAiC,EAAE;QAC9H,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,cAAc,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAC/F,MAAM,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACpD,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC;YAC9C,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,GAAG;gBAAE,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChG,CAAC,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,CAAC;IAEO,KAAK,CAAC,OAAO,CAAO,OAAgB,EAAE,GAAmB,EAAE,OAAoD;QACrH,IAAI,KAAkB,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAM,CAAC;YAC9D,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,GAAG,CAAC,UAAU,CAAC,aAAa,EAAE,aAAa,EAAE,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;YAC1H,KAAK,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC;YAC1D,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC;YACzF,IAAI,MAAM,IAAI,GAAG;gBAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7H,KAAK,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,EAAE,OAAO,EAAE,EAAE,CAAC;QAC7G,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,aAAa,EAAE,GAAG,CAAC,UAAU,CAAC,aAAa,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACpK,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;CACF;AAMD,MAAM,OAAO,SAAS;IAKS;IAA6C;IAAqC;IAJvG,MAAM,GAAyB,IAAI,CAAC;IAC3B,OAAO,GAAG,IAAI,GAAG,EAA+G,CAAC;IACjI,MAAM,CAAS;IAEhC,YAA6B,UAA0B,EAAmB,QAAkB,EAAmB,aAAqB,EAAE,MAAe;QAAxH,eAAU,GAAV,UAAU,CAAgB;QAAmB,aAAQ,GAAR,QAAQ,CAAU;QAAmB,kBAAa,GAAb,aAAa,CAAQ;QAClI,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,YAAY,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAClF,iDAAiD;YACjD,IAAI,CAAC,OAAO,CAAC,IAAI,uBAAuB,CAAC,mBAAmB,CAAC,CAAC,CAAC;YAC/D,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,GAAG;gBAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAO,MAAc,EAAE,OAAU,EAAE,UAA0D,EAAE;QACjG,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACvC,IAAI,CAAC,OAAO;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,uBAAuB,CAAC,4BAA4B,CAAC,CAAC,CAAC;QAC/F,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;QAC5C,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;QACnB,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACxB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;gBACzD,MAAM,CAAC,IAAI,uBAAuB,CAAC,qCAAqC,MAAM,GAAG,CAAC,CAAC,CAAC;YACtF,CAAC,EAAE,SAAS,CAAC,CAAC;YACd,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,OAA+B,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAClF,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE;gBACrF,aAAa,EAAE,EAAE;gBACjB,OAAO,EAAE,QAAQ;gBACjB,WAAW,EAAE,kBAAkB;gBAC/B,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC;gBAC7B,KAAK,EAAE,IAAI,CAAC,aAAa;gBACzB,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,SAAS;aAC3F,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,OAAO,CAAC,GAAmB;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QAC7D,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QAClD,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAsB,CAAC;YAC5E,IAAI,KAAK,CAAC,EAAE;gBAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;;gBACnC,KAAK,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACvG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,MAAM,CAAC,IAAI,uBAAuB,CAAC,qBAAqB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IAEO,OAAO,CAAC,KAAY;QAC1B,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACvC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1B,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;CACF"}

package/dist/esm/messaging/staff-notifier.js

@@ -0,0 +1,73 @@
+import { z } from 'zod';
+import { DISPATCH_LIMITS, NOTIFICATION_DISPATCH, } from '../contracts/notification-dispatch.js';
+import { silentLogger } from '../logging/index.js';
+/** Recipients from configuration (env), keyed by the permission an alert targets. */
+export class ConfiguredStaffRecipients {
+    byPermission;
+    constructor(byPermission) {
+        this.byPermission = byPermission;
+    }
+    async resolve(permission) {
+        return [...(this.byPermission[permission] ?? [])];
+    }
+}
+/**
+ * Stages one `notification:dispatch` per recipient through the outbox, in the caller's transaction, so an
+ * alert is sent if and only if the state change that raised it commits. Never sends email itself.
+ * An alert that resolves to nobody is logged as a warning (an unconfigured list must not fail silently).
+ */
+export class StaffNotifier {
+    outbox;
+    recipients;
+    logger;
+    constructor(outbox, recipients, logger = silentLogger) {
+        this.outbox = outbox;
+        this.recipients = recipients;
+        this.logger = logger;
+    }
+    /** Returns how many commands were staged. */
+    async alert(executor, alert, meta = {}) {
+        const targets = await this.recipients.resolve(alert.permission);
+        if (targets.length === 0) {
+            this.logger.warn('Staff alert not sent: no recipients are configured', { template: alert.template, permission: alert.permission });
+            return 0;
+        }
+        for (const recipient of targets) {
+            const dispatch = {
+                template: alert.template,
+                category: 'staff',
+                recipient,
+                channels: alert.channels ?? ['email'],
+                data: alert.data,
+                bypassPreferences: true,
+                targetPermission: alert.permission,
+            };
+            await this.outbox.command(executor, NOTIFICATION_DISPATCH, dispatch, { ...meta, actorId: null });
+        }
+        return targets.length;
+    }
+}
+const emailSchema = z.string().email().max(DISPATCH_LIMITS.email);
+/**
+ * A comma-separated staff address list from env (`"a@x.io, b@y.io"`): trimmed, blanks dropped,
+ * de-duplicated case-insensitively. An invalid address fails validation, so a typo is caught at boot
+ * instead of dead-lettering in notification-service when the alert finally fires.
+ */
+export const staffEmailListSchema = z
+    .string()
+    .optional()
+    .transform((csv) => {
+    const seen = new Set();
+    return (csv ?? '')
+        .split(',')
+        .map((entry) => entry.trim())
+        .filter((email) => email && !seen.has(email.toLowerCase()) && seen.add(email.toLowerCase()));
+})
+    .superRefine((emails, ctx) => {
+    for (const email of emails) {
+        if (!emailSchema.safeParse(email).success)
+            ctx.addIssue({ code: z.ZodIssueCode.custom, message: `Not a valid email address: ${email}` });
+    }
+})
+    .transform((emails) => emails.map((email) => ({ email })));
+//# sourceMappingURL=staff-notifier.js.map

package/dist/esm/messaging/staff-notifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"staff-notifier.js","sourceRoot":"","sources":["../../../src/messaging/staff-notifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,eAAe,EACf,qBAAqB,GAKtB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAcnD,qFAAqF;AACrF,MAAM,OAAO,yBAAyB;IACP;IAA7B,YAA6B,YAAoE;QAApE,iBAAY,GAAZ,YAAY,CAAwD;IAAG,CAAC;IAErG,KAAK,CAAC,OAAO,CAAC,UAAkB;QAC9B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACpD,CAAC;CACF;AAgBD;;;;GAIG;AACH,MAAM,OAAO,aAAa;IAEL;IACA;IACA;IAHnB,YACmB,MAAwB,EACxB,UAAkC,EAClC,SAAiB,YAAY;QAF7B,WAAM,GAAN,MAAM,CAAkB;QACxB,eAAU,GAAV,UAAU,CAAwB;QAClC,WAAM,GAAN,MAAM,CAAuB;IAC7C,CAAC;IAEJ,6CAA6C;IAC7C,KAAK,CAAC,KAAK,CAAC,QAAW,EAAE,KAAiB,EAAE,OAAuB,EAAE;QACnE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAChE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oDAAoD,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;YACnI,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,MAAM,SAAS,IAAI,OAAO,EAAE,CAAC;YAChC,MAAM,QAAQ,GAA8B;gBAC1C,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,QAAQ,EAAE,OAAO;gBACjB,SAAS;gBACT,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC;gBACrC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,iBAAiB,EAAE,IAAI;gBACvB,gBAAgB,EAAE,KAAK,CAAC,UAAU;aACnC,CAAC;YACF,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,qBAAqB,EAAE,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,OAAO,OAAO,CAAC,MAAM,CAAC;IACxB,CAAC;CACF;AAED,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;AAElE;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,EAAE;KACR,QAAQ,EAAE;KACV,SAAS,CAAC,CAAC,GAAG,EAAE,EAAE;IACjB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;SACf,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AACjG,CAAC,CAAC;KACD,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC3B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO;YAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,8BAA8B,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3I,CAAC;AACH,CAAC,CAAC;KACD,SAAS,CAAC,CAAC,MAAM,EAAuB,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC"}

package/dist/esm/messaging/topology.js

@@ -0,0 +1,16 @@
+export function createTopology(options) {
+    const app = options.app.trim();
+    const prefix = options.prefix.trim();
+    if (!app || !prefix)
+        throw new Error('Topology requires both app and prefix');
+    return {
+        app,
+        prefix,
+        eventsExchange: `${app}.${prefix}.events`,
+        commandsExchange: `${app}.${prefix}.commands`,
+        queue: (name) => (name.startsWith(`${prefix}.`) ? name : `${prefix}.${name}`),
+    };
+}
+export const retryQueueName = (queue, delayMs) => `${queue}.retry.${delayMs}`;
+export const deadLetterQueueName = (queue) => `${queue}.dlq`;
+//# sourceMappingURL=topology.js.map

package/dist/esm/messaging/topology.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"topology.js","sourceRoot":"","sources":["../../../src/messaging/topology.ts"],"names":[],"mappings":"AAiBA,MAAM,UAAU,cAAc,CAAC,OAAwC;IACrE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC9E,OAAO;QACL,GAAG;QACH,MAAM;QACN,cAAc,EAAE,GAAG,GAAG,IAAI,MAAM,SAAS;QACzC,gBAAgB,EAAE,GAAG,GAAG,IAAI,MAAM,WAAW;QAC7C,KAAK,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC;KACtF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAa,EAAE,OAAe,EAAE,EAAE,CAAC,GAAG,KAAK,UAAU,OAAO,EAAE,CAAC;AAC9F,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,GAAG,KAAK,MAAM,CAAC"}

package/dist/esm/package.json

@@ -0,0 +1 @@
+{"type":"module"}

package/dist/esm/rate-limit/index.js

@@ -0,0 +1,56 @@
+import { RateLimiterMemory, RateLimiterRedis } from 'rate-limiter-flexible';
+import { errorResponse } from '../common/response.js';
+import { TooManyRequestsError } from '../common/errors.js';
+import { silentLogger } from '../logging/index.js';
+/** Redis limiter with an in-memory insurance limiter so a Redis outage never blocks traffic. */
+export function createLimiter(options) {
+    const memory = new RateLimiterMemory({ keyPrefix: options.keyPrefix, points: options.points, duration: options.durationSec, blockDuration: options.blockDurationSec ?? 0 });
+    if (!options.redis)
+        return memory;
+    return new RateLimiterRedis({
+        storeClient: options.redis,
+        keyPrefix: options.keyPrefix,
+        points: options.points,
+        duration: options.durationSec,
+        blockDuration: options.blockDurationSec ?? 0,
+        insuranceLimiter: memory,
+    });
+}
+/**
+ * Consumes one point for `key`; throws TooManyRequestsError (429) when exhausted.
+ * For in-service checks such as per-identifier login throttling.
+ */
+export async function consumeOrThrow(limiter, key, message) {
+    try {
+        await limiter.consume(key);
+    }
+    catch (rejection) {
+        if (typeof rejection?.msBeforeNext === 'number')
+            throw new TooManyRequestsError(message);
+        throw rejection;
+    }
+}
+export function rateLimitMiddleware(options) {
+    const limiter = createLimiter(options);
+    const logger = options.logger ?? silentLogger;
+    const keyOf = options.keyOf ?? ((req) => req.user?.id ?? req.ip ?? 'unknown');
+    return async (req, res, next) => {
+        try {
+            const result = await limiter.consume(keyOf(req));
+            res.setHeader('X-RateLimit-Limit', options.points);
+            res.setHeader('X-RateLimit-Remaining', result.remainingPoints);
+            next();
+        }
+        catch (rejection) {
+            const ms = rejection?.msBeforeNext;
+            if (typeof ms !== 'number') {
+                logger.error('Rate limiter failure; allowing request', { keyPrefix: options.keyPrefix, error: String(rejection) });
+                next();
+                return;
+            }
+            res.setHeader('Retry-After', Math.ceil(ms / 1000));
+            res.status(429).json(errorResponse('Too many requests. Please try again later.', undefined, 'RATE_LIMITED'));
+        }
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/esm/rate-limit/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/rate-limit/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAA4B,MAAM,uBAAuB,CAAC;AACtG,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAcnD,gGAAgG;AAChG,MAAM,UAAU,aAAa,CAAC,OAAyB;IACrD,MAAM,MAAM,GAAG,IAAI,iBAAiB,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,WAAW,EAAE,aAAa,EAAE,OAAO,CAAC,gBAAgB,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5K,IAAI,CAAC,OAAO,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC;IAClC,OAAO,IAAI,gBAAgB,CAAC;QAC1B,WAAW,EAAE,OAAO,CAAC,KAAK;QAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,WAAW;QAC7B,aAAa,EAAE,OAAO,CAAC,gBAAgB,IAAI,CAAC;QAC5C,gBAAgB,EAAE,MAAM;KACzB,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAA4B,EAAE,GAAW,EAAE,OAAgB;IAC9F,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,SAAS,EAAE,CAAC;QACnB,IAAI,OAAQ,SAAuC,EAAE,YAAY,KAAK,QAAQ;YAAE,MAAM,IAAI,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACxH,MAAM,SAAS,CAAC;IAClB,CAAC;AACH,CAAC;AAOD,MAAM,UAAU,mBAAmB,CAAC,OAAmC;IACrE,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC,CAAC;IAEvF,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAiB,EAAE;QAC9E,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;YACjD,GAAG,CAAC,SAAS,CAAC,mBAAmB,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YACnD,GAAG,CAAC,SAAS,CAAC,uBAAuB,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;YAC/D,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,SAAS,EAAE,CAAC;YACnB,MAAM,EAAE,GAAI,SAAuC,EAAE,YAAY,CAAC;YAClE,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAC3B,MAAM,CAAC,KAAK,CAAC,wCAAwC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBACnH,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;YACnD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,4CAA4C,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;QAC/G,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/esm/scheduling/index.js

@@ -0,0 +1,83 @@
+import { randomUUID } from 'node:crypto';
+import { silentLogger } from '../logging/index.js';
+const RELEASE_SCRIPT = "if redis.call('get', KEYS[1]) == ARGV[1] then return redis.call('del', KEYS[1]) else return 0 end";
+/** Redis lock (SET NX PX + token-checked release). Without Redis, a per-process lock. */
+export function createLock(redis, prefix = 'lock:') {
+    const local = new Set();
+    return {
+        async runExclusive(key, ttlMs, fn) {
+            if (!redis) {
+                if (local.has(key))
+                    return false;
+                local.add(key);
+                try {
+                    await fn();
+                }
+                finally {
+                    local.delete(key);
+                }
+                return true;
+            }
+            const token = randomUUID();
+            const acquired = await redis.set(prefix + key, token, 'PX', ttlMs, 'NX').catch(() => null);
+            if (acquired !== 'OK')
+                return false;
+            try {
+                await fn();
+            }
+            finally {
+                await redis.eval(RELEASE_SCRIPT, 1, prefix + key, token).catch(() => undefined);
+            }
+            return true;
+        },
+    };
+}
+/**
+ * Interval job that never overlaps itself, can be triggered early by events (`trigger()`), and
+ * optionally runs on one replica at a time.
+ */
+export class ScheduledJob {
+    options;
+    timer = null;
+    running = false;
+    logger;
+    constructor(options) {
+        this.options = options;
+        this.logger = options.logger ?? silentLogger;
+    }
+    start() {
+        if (this.timer)
+            return;
+        this.timer = setInterval(() => { void this.trigger(); }, this.options.intervalMs);
+        this.timer.unref?.();
+        if (this.options.runOnStart)
+            void this.trigger();
+    }
+    stop() {
+        if (this.timer)
+            clearInterval(this.timer);
+        this.timer = null;
+    }
+    get isRunning() {
+        return this.running;
+    }
+    async trigger() {
+        if (this.running)
+            return;
+        this.running = true;
+        try {
+            const run = async () => { await this.options.work(); };
+            if (this.options.lock)
+                await this.options.lock.runExclusive(`job:${this.options.name}`, Math.max(this.options.intervalMs, 30_000), run);
+            else
+                await run();
+        }
+        catch (error) {
+            this.logger.error('Scheduled job failed', { job: this.options.name, error: error.message });
+        }
+        finally {
+            this.running = false;
+        }
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/esm/scheduling/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/scheduling/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAQnD,MAAM,cAAc,GAAG,mGAAmG,CAAC;AAE3H,yFAAyF;AACzF,MAAM,UAAU,UAAU,CAAC,KAAmB,EAAE,MAAM,GAAG,OAAO;IAC9D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACjC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACf,IAAI,CAAC;oBAAC,MAAM,EAAE,EAAE,CAAC;gBAAC,CAAC;wBAAS,CAAC;oBAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAAC,CAAC;gBAClD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAC3F,IAAI,QAAQ,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,EAAE,EAAE,CAAC;YACb,CAAC;oBAAS,CAAC;gBACT,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,EAAE,MAAM,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAClF,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AAYD;;;GAGG;AACH,MAAM,OAAO,YAAY;IAKM;IAJrB,KAAK,GAA0C,IAAI,CAAC;IACpD,OAAO,GAAG,KAAK,CAAC;IACP,MAAM,CAAS;IAEhC,YAA6B,OAA4B;QAA5B,YAAO,GAAP,OAAO,CAAqB;QACvD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC;IAC/C,CAAC;IAED,KAAK;QACH,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QACvB,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAClF,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QACrB,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU;YAAE,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;IACnD,CAAC;IAED,IAAI;QACF,IAAI,IAAI,CAAC,KAAK;YAAE,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACvD,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI;gBAAE,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;;gBACnI,MAAM,GAAG,EAAE,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACzG,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;CACF"}

package/dist/esm/security/index.js

@@ -0,0 +1,36 @@
+import { hmacSha256, safeEqual } from '../common/crypto.js';
+/** HMAC-SHA256 expiring URL signatures for private files (streams, downloads, originals). */
+export function createUrlSigner(secret) {
+    if (!secret || secret.length < 16)
+        throw new Error('URL signing secret must be at least 16 characters');
+    const expiry = (ttlSec) => Math.floor(Date.now() / 1000) + ttlSec;
+    const mac = (target, exp) => hmacSha256(secret, `${target}|${exp}`);
+    const signer = {
+        sign(path, ttlSec) {
+            const exp = expiry(ttlSec);
+            return { exp, sig: mac(path, exp) };
+        },
+        signPrefix(prefix, ttlSec) {
+            const exp = expiry(ttlSec);
+            return { exp, sig: mac(`prefix:${prefix}`, exp), sp: prefix };
+        },
+        signedPath(path, ttlSec, options = {}) {
+            const params = options.prefix ? signer.signPrefix(options.prefix, ttlSec) : signer.sign(path, ttlSec);
+            const qs = new URLSearchParams({ exp: String(params.exp), sig: params.sig, ...(params.sp ? { sp: params.sp } : {}) });
+            return `${path}${path.includes('?') ? '&' : '?'}${qs.toString()}`;
+        },
+        verify(path, params, now = Date.now()) {
+            const exp = Number(params.exp);
+            if (!params.sig || !Number.isFinite(exp) || exp * 1000 < now)
+                return false;
+            if (params.sp) {
+                if (!path.startsWith(params.sp))
+                    return false;
+                return safeEqual(params.sig, mac(`prefix:${params.sp}`, exp));
+            }
+            return safeEqual(params.sig, mac(path, exp));
+        },
+    };
+    return signer;
+}
+//# sourceMappingURL=index.js.map

package/dist/esm/security/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/security/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAmB5D,6FAA6F;AAC7F,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACxG,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC;IAC1E,MAAM,GAAG,GAAG,CAAC,MAAc,EAAE,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;IAEpF,MAAM,MAAM,GAAc;QACxB,IAAI,CAAC,IAAI,EAAE,MAAM;YACf,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3B,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;QACtC,CAAC;QACD,UAAU,CAAC,MAAM,EAAE,MAAM;YACvB,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3B,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,UAAU,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;QAChE,CAAC;QACD,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAG,EAAE;YACnC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACtG,MAAM,EAAE,GAAG,IAAI,eAAe,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACtH,OAAO,GAAG,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;QACpE,CAAC;QACD,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;YACnC,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,IAAI,GAAG,GAAG;gBAAE,OAAO,KAAK,CAAC;YAC3E,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;oBAAE,OAAO,KAAK,CAAC;gBAC9C,OAAO,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;YAChE,CAAC;YACD,OAAO,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QAC/C,CAAC;KACF,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/esm/socket/index.js

@@ -0,0 +1,47 @@
+import { Server } from 'socket.io';
+import { verifyIdentityHeaders } from '../identity/index.js';
+import { silentLogger } from '../logging/index.js';
+export const userRoom = (userId) => `user:${userId}`;
+export function createSocketServer(httpServer, options) {
+    const logger = options.logger ?? silentLogger;
+    const io = new Server(httpServer, {
+        path: options.path,
+        cors: { origin: options.corsOrigins?.length ? options.corsOrigins : false, credentials: true },
+        ...(options.adapter ? { adapter: options.adapter } : {}),
+        ...options.serverOptions,
+    });
+    io.use(async (socket, next) => {
+        try {
+            const user = await options.authenticate(socket);
+            if (!user)
+                return next(new Error('Authentication failed'));
+            socket.data.user = user;
+            next();
+        }
+        catch (error) {
+            logger.warn('Socket authentication rejected', { error: error.message });
+            next(new Error('Authentication failed'));
+        }
+    });
+    io.on('connection', (socket) => {
+        const user = socket.data.user;
+        const rooms = options.rooms ? options.rooms(user) : [userRoom(user.id)];
+        void socket.join(rooms);
+        logger.debug('Socket connected', { userId: user.id, rooms });
+        socket.on('disconnect', (reason) => logger.debug('Socket disconnected', { userId: user.id, reason }));
+    });
+    return {
+        io,
+        emitToUser: (userId, event, payload) => { io.to(userRoom(userId)).emit(event, payload); },
+        emitToRoom: (room, event, payload) => { io.to(room).emit(event, payload); },
+        close: () => new Promise((resolve) => { io.close(() => resolve()); }),
+    };
+}
+/** Trusts the gateway-signed identity headers forwarded on the WebSocket upgrade request. */
+export function gatewaySocketAuth(secret) {
+    return (socket) => {
+        const result = verifyIdentityHeaders(socket.handshake.headers, secret);
+        return result.status === 'authenticated' ? result.user : null;
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/esm/socket/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/socket/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAmC,MAAM,WAAW,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AA2BnD,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,QAAQ,MAAM,EAAE,CAAC;AAE7D,MAAM,UAAU,kBAAkB,CAAC,UAAsB,EAAE,OAA4B;IACrF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC;IAC9C,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,UAAU,EAAE;QAChC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE;QAC9F,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,OAAO,CAAC,aAAa;KACzB,CAAC,CAAC;IAEH,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QAC5B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;YAC3D,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;YACxB,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YACnF,IAAI,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAgB,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACxE,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,MAAM,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACxG,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,EAAE;QACF,UAAU,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QACzF,UAAU,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAC3E,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;KAC5E,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,CAAC,MAAc,EAAmB,EAAE;QACzC,MAAM,MAAM,GAAG,qBAAqB,CAAC,MAAM,CAAC,SAAS,CAAC,OAAiC,EAAE,MAAM,CAAC,CAAC;QACjG,OAAO,MAAM,CAAC,MAAM,KAAK,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,CAAC,CAAC;AACJ,CAAC"}

package/dist/esm/testing/index.js

@@ -0,0 +1,66 @@
+import { newId } from '../common/id.js';
+import { signIdentityHeaders } from '../identity/index.js';
+import { buildEnvelope } from '../messaging/envelope.js';
+/** A logger spy: records every line (level, message, meta) so tests can assert on log context. */
+export class RecordingLogger {
+    lines = [];
+    debug(message, meta = {}) { this.lines.push({ level: 'debug', message, meta }); }
+    info(message, meta = {}) { this.lines.push({ level: 'info', message, meta }); }
+    warn(message, meta = {}) { this.lines.push({ level: 'warn', message, meta }); }
+    error(message, meta = {}) { this.lines.push({ level: 'error', message, meta }); }
+}
+/** An AuthUser for tests. */
+export function makeAuthUser(overrides = {}) {
+    return { id: newId(), email: 'user@example.com', roles: [], permissions: [], scopes: {}, attrs: {}, ...overrides };
+}
+/** Gateway-signed identity headers for route tests (use with supertest `.set()`). */
+export function identityHeaders(user, secret) {
+    return signIdentityHeaders(user, secret);
+}
+/** Records everything published/sent so tests can assert on events, commands and direct queue sends. */
+export class RecordingBus {
+    source;
+    events = [];
+    commands = [];
+    queued = [];
+    failWith = null;
+    constructor(source = 'test') {
+        this.source = source;
+    }
+    async publish(type, data, meta) {
+        if (this.failWith)
+            throw this.failWith;
+        const envelope = buildEnvelope(type, data, this.source, meta);
+        this.events.push(envelope);
+        return envelope;
+    }
+    async publishEnvelope(envelope) {
+        if (this.failWith)
+            throw this.failWith;
+        this.events.push(envelope);
+    }
+    async send(command, data, meta) {
+        if (this.failWith)
+            throw this.failWith;
+        const envelope = buildEnvelope(command, data, this.source, meta);
+        this.commands.push(envelope);
+        return envelope;
+    }
+    async sendEnvelope(envelope) {
+        if (this.failWith)
+            throw this.failWith;
+        this.commands.push(envelope);
+    }
+    async sendToQueue(queue, payload, options = {}) {
+        if (this.failWith)
+            throw this.failWith;
+        this.queued.push({ queue, payload, options });
+    }
+    eventsOfType(type) {
+        return this.events.filter((e) => e.type === type);
+    }
+    commandsOfType(command) {
+        return this.commands.filter((e) => e.type === command);
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/esm/testing/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/testing/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACxC,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAqB,MAAM,0BAA0B,CAAC;AAU5E,kGAAkG;AAClG,MAAM,OAAO,eAAe;IACjB,KAAK,GAAc,EAAE,CAAC;IAC/B,KAAK,CAAC,OAAe,EAAE,OAAgC,EAAE,IAAU,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACxH,IAAI,CAAC,OAAe,EAAE,OAAgC,EAAE,IAAU,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACtH,IAAI,CAAC,OAAe,EAAE,OAAgC,EAAE,IAAU,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACtH,KAAK,CAAC,OAAe,EAAE,OAAgC,EAAE,IAAU,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;CACzH;AAED,6BAA6B;AAC7B,MAAM,UAAU,YAAY,CAAC,YAA+B,EAAE;IAC5D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,SAAS,EAAE,CAAC;AACrH,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,eAAe,CAAC,IAAc,EAAE,MAAc;IAC5D,OAAO,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC3C,CAAC;AAED,wGAAwG;AACxG,MAAM,OAAO,YAAY;IAMM;IALpB,MAAM,GAAoB,EAAE,CAAC;IAC7B,QAAQ,GAAoB,EAAE,CAAC;IAC/B,MAAM,GAA0E,EAAE,CAAC;IAC5F,QAAQ,GAAiB,IAAI,CAAC;IAE9B,YAA6B,SAAS,MAAM;QAAf,WAAM,GAAN,MAAM,CAAS;IAAG,CAAC;IAEhD,KAAK,CAAC,OAAO,CAAI,IAAY,EAAE,IAAO,EAAE,IAAmB;QACzD,IAAI,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,CAAC,QAAQ,CAAC;QACvC,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAyB,CAAC,CAAC;QAC5C,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,QAAuB;QAC3C,IAAI,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,CAAC,QAAQ,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,IAAI,CAAI,OAAe,EAAE,IAAO,EAAE,IAAmB;QACzD,IAAI,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,CAAC,QAAQ,CAAC;QACvC,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAyB,CAAC,CAAC;QAC9C,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAuB;QACxC,IAAI,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,CAAC,QAAQ,CAAC;QACvC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,OAAgB,EAAE,UAA4B,EAAE;QAC/E,IAAI,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,CAAC,QAAQ,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,YAAY,CAAC,IAAY;QACvB,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACpD,CAAC;IAED,cAAc,CAAC,OAAe;QAC5B,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;IACzD,CAAC;CACF"}

package/dist/esm/types/index.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.js.map

package/dist/esm/types/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/types/index.ts"],"names":[],"mappings":""}

package/dist/esm/validation/index.js

@@ -0,0 +1,36 @@
+import { z } from 'zod';
+import { ID_PATTERN } from '../common/id.js';
+import { ValidationError } from '../common/errors.js';
+export const idSchema = z.string().regex(ID_PATTERN, 'Invalid id');
+export const idParamSchema = z.object({ id: idSchema });
+export const paginationSchema = z.object({
+    page: z.coerce.number().int().min(1).default(1),
+    limit: z.coerce.number().int().min(1).max(100).default(20),
+});
+export const sortOrderSchema = z.enum(['asc', 'desc']).default('desc');
+export const emailSchema = z.string().trim().toLowerCase().email('Invalid email address').max(191);
+export const slugSchema = z.string().trim().min(1).max(120).regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, 'Invalid slug');
+/** Length-first password rule (NIST 800-63B): 8–128 chars, no composition rules. Tighten per app if needed. */
+export const passwordSchema = z.string().min(8, 'Password must be at least 8 characters').max(128, 'Password is too long');
+/** Accepts `true/false/1/0/yes/no` from query strings. */
+export const booleanish = z.union([z.boolean(), z.enum(['true', 'false', '1', '0', 'yes', 'no'])]).transform((v) => v === true || v === 'true' || v === '1' || v === 'yes');
+/** Comma list or repeated query param → string[]. */
+export const csvList = z.union([z.string(), z.array(z.string())]).transform((v) => (Array.isArray(v) ? v : v.split(',')).map((s) => s.trim()).filter(Boolean));
+/** Converts Zod issues into the `{ field: [messages] }` shape used by the error envelope. */
+export function zodIssuesToErrors(error) {
+    const errors = {};
+    for (const issue of error.issues) {
+        const key = issue.path.join('.') || '_';
+        (errors[key] ??= []).push(issue.message);
+    }
+    return errors;
+}
+/** Parses `input` or throws a ValidationError (422). */
+export function parseOrThrow(schema, input) {
+    const result = schema.safeParse(input);
+    if (!result.success)
+        throw new ValidationError(zodIssuesToErrors(result.error));
+    return result.data;
+}
+export { z };
+//# sourceMappingURL=index.js.map

package/dist/esm/validation/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/validation/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;AAEnE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;AAExD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/C,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC3D,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;AAEvE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAEnG,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,4BAA4B,EAAE,cAAc,CAAC,CAAC;AAEhH,+GAA+G;AAC/G,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,wCAAwC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;AAE3H,0DAA0D;AAC1D,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;AAE5K,qDAAqD;AACrD,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;AAE/J,6FAA6F;AAC7F,MAAM,UAAU,iBAAiB,CAAC,KAAiB;IACjD,MAAM,MAAM,GAA6B,EAAE,CAAC;IAC5C,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;QACxC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,YAAY,CAAyB,MAAS,EAAE,KAAc;IAC5E,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,eAAe,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAChF,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,OAAO,EAAE,CAAC,EAAE,CAAC"}