@heavybit/shared-lib 0.0.0-stage → 1.2.0

package/dist/cjs/access/index.js

@@ -0,0 +1,118 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WILDCARD_PERMISSION = void 0;
+exports.hasPermission = hasPermission;
+exports.hasAllPermissions = hasAllPermissions;
+exports.hasRole = hasRole;
+exports.requireUser = requireUser;
+exports.assertPermission = assertPermission;
+exports.scopeIds = scopeIds;
+exports.assertSelfOrPermission = assertSelfOrPermission;
+exports.assertInScope = assertInScope;
+exports.resolveActiveScopeId = resolveActiveScopeId;
+exports.resolvePrimaryScopeId = resolvePrimaryScopeId;
+exports.ownerFilter = ownerFilter;
+const errors_js_1 = require("../common/errors.js");
+/**
+ * Permission and ownership checks. Keep every authorization decision in these helpers (not
+ * inline in controllers) so the rules are identical across endpoints and services.
+ *
+ * Permission strings are dotted (`users.manage`, `media.manage.any`). Grants may use
+ * wildcards: `*` grants everything; `media.*` grants any permission starting with `media.`.
+ */
+exports.WILDCARD_PERMISSION = '*';
+function grants(granted, required) {
+    if (granted === exports.WILDCARD_PERMISSION || granted === required)
+        return true;
+    return granted.endsWith('.*') && required.startsWith(granted.slice(0, -1));
+}
+/** True when the user holds at least one of `required`. */
+function hasPermission(user, ...required) {
+    if (!user)
+        return false;
+    return required.some((perm) => user.permissions.some((g) => grants(g, perm)));
+}
+function hasAllPermissions(user, ...required) {
+    if (!user)
+        return false;
+    return required.every((perm) => user.permissions.some((g) => grants(g, perm)));
+}
+function hasRole(user, ...roles) {
+    return !!user && roles.some((role) => user.roles.includes(role));
+}
+function requireUser(user) {
+    if (!user)
+        throw new errors_js_1.UnauthorizedError();
+    return user;
+}
+function assertPermission(user, ...required) {
+    const u = requireUser(user);
+    if (!hasPermission(u, ...required))
+        throw new errors_js_1.ForbiddenError();
+    return u;
+}
+/** IDs the user may act on within a scope (e.g. profiles they are a member of). */
+function scopeIds(user, scope) {
+    return user?.scopes?.[scope] ?? [];
+}
+/**
+ * Self-owned data: allow when the caller *is* `ownerUserId`, or holds `bypassPermission`.
+ * Throws ForbiddenError otherwise.
+ */
+function assertSelfOrPermission(user, ownerUserId, bypassPermission) {
+    const u = requireUser(user);
+    if (u.id === ownerUserId)
+        return u;
+    if (bypassPermission && hasPermission(u, bypassPermission))
+        return u;
+    throw new errors_js_1.ForbiddenError();
+}
+/**
+ * Scoped data: allow when `resourceScopeId` is one of the caller's scope IDs, or the caller holds
+ * `bypassPermission`.
+ */
+function assertInScope(user, scope, resourceScopeId, bypassPermission) {
+    const u = requireUser(user);
+    if (scopeIds(u, scope).includes(resourceScopeId))
+        return u;
+    if (bypassPermission && hasPermission(u, bypassPermission))
+        return u;
+    throw new errors_js_1.ForbiddenError();
+}
+/**
+ * Resolves the single scope ID a request acts on. With one membership it is implicit; with
+ * several the client names one (e.g. `x-active-profile-id`), which must be a member ID.
+ * IDs from request bodies are never trusted — only the gateway-signed scopes.
+ */
+function resolveActiveScopeId(user, scope, requested) {
+    const ids = scopeIds(requireUser(user), scope);
+    if (requested) {
+        if (!ids.includes(requested))
+            throw new errors_js_1.ForbiddenError(`Not a member of this ${scope}`);
+        return requested;
+    }
+    if (ids.length === 1)
+        return ids[0];
+    if (ids.length === 0)
+        throw new errors_js_1.ForbiddenError(`No ${scope} is linked to this account`);
+    throw new errors_js_1.ForbiddenError(`Select a ${scope} to act on`, { code: 'SCOPE_SELECTION_REQUIRED' });
+}
+/**
+ * Like `resolveActiveScopeId`, for screens that work without a selector: with several memberships
+ * and none named, the first (primary) one is used. A named ID must still be a member ID.
+ */
+function resolvePrimaryScopeId(user, scope, requested) {
+    const ids = scopeIds(requireUser(user), scope);
+    return resolveActiveScopeId(user, scope, requested || ids[0]);
+}
+/**
+ * Repository filter for list queries: `{ all: true }` for callers holding `bypassPermission`,
+ * otherwise the caller's own scope IDs (possibly empty → return nothing).
+ */
+function ownerFilter(user, scope, bypassPermission) {
+    const u = requireUser(user);
+    if (bypassPermission && hasPermission(u, bypassPermission))
+        return { all: true };
+    return { all: false, ids: scopeIds(u, scope) };
+}
+//# sourceMappingURL=index.js.map

package/dist/cjs/access/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/access/index.ts"],"names":[],"mappings":";;;AAkBA,sCAGC;AAED,8CAGC;AAED,0BAEC;AAED,kCAGC;AAED,4CAIC;AAGD,4BAEC;AAMD,wDAKC;AAMD,sCAKC;AAOD,oDASC;AAMD,sDAGC;AAQD,kCAIC;AAzGD,mDAAwE;AAGxE;;;;;;GAMG;AACU,QAAA,mBAAmB,GAAG,GAAG,CAAC;AAEvC,SAAS,MAAM,CAAC,OAAe,EAAE,QAAgB;IAC/C,IAAI,OAAO,KAAK,2BAAmB,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzE,OAAO,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,2DAA2D;AAC3D,SAAgB,aAAa,CAAC,IAAsD,EAAE,GAAG,QAAkB;IACzG,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,SAAgB,iBAAiB,CAAC,IAAsD,EAAE,GAAG,QAAkB;IAC7G,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,SAAgB,OAAO,CAAC,IAAgD,EAAE,GAAG,KAAe;IAC1F,OAAO,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,SAAgB,WAAW,CAAC,IAAiC;IAC3D,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,6BAAiB,EAAE,CAAC;IACzC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,gBAAgB,CAAC,IAAiC,EAAE,GAAG,QAAkB;IACvF,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC;QAAE,MAAM,IAAI,0BAAc,EAAE,CAAC;IAC/D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,mFAAmF;AACnF,SAAgB,QAAQ,CAAC,IAAiD,EAAE,KAAa;IACvF,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,SAAgB,sBAAsB,CAAC,IAAiC,EAAE,WAAmB,EAAE,gBAAyB;IACtH,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC,EAAE,KAAK,WAAW;QAAE,OAAO,CAAC,CAAC;IACnC,IAAI,gBAAgB,IAAI,aAAa,CAAC,CAAC,EAAE,gBAAgB,CAAC;QAAE,OAAO,CAAC,CAAC;IACrE,MAAM,IAAI,0BAAc,EAAE,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,SAAgB,aAAa,CAAC,IAAiC,EAAE,KAAa,EAAE,eAAuB,EAAE,gBAAyB;IAChI,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC;QAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,gBAAgB,IAAI,aAAa,CAAC,CAAC,EAAE,gBAAgB,CAAC;QAAE,OAAO,CAAC,CAAC;IACrE,MAAM,IAAI,0BAAc,EAAE,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,SAAgB,oBAAoB,CAAC,IAAiC,EAAE,KAAa,EAAE,SAAyB;IAC9G,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/C,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,0BAAc,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAC;QACxF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC,CAAC,CAAE,CAAC;IACrC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,0BAAc,CAAC,MAAM,KAAK,4BAA4B,CAAC,CAAC;IACxF,MAAM,IAAI,0BAAc,CAAC,YAAY,KAAK,YAAY,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC,CAAC;AAChG,CAAC;AAED;;;GAGG;AACH,SAAgB,qBAAqB,CAAC,IAAiC,EAAE,KAAa,EAAE,SAAyB;IAC/G,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/C,OAAO,oBAAoB,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAID;;;GAGG;AACH,SAAgB,WAAW,CAAC,IAAiC,EAAE,KAAa,EAAE,gBAAyB;IACrG,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,gBAAgB,IAAI,aAAa,CAAC,CAAC,EAAE,gBAAgB,CAAC;QAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACjF,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;AACjD,CAAC"}

package/dist/cjs/alerting/index.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SlackAlerter = void 0;
+const index_js_1 = require("../logging/index.js");
+/**
+ * Posts alerts to a Slack notification webhook as `{ messages, alert_type, app_name, environment, consolidate }`.
+ * An unset URL is a valid "alerts off" configuration: the first skipped alert is warned about once, then silently.
+ */
+class SlackAlerter {
+    options;
+    warnedUnconfigured = false;
+    logger;
+    constructor(options) {
+        this.options = options;
+        this.logger = options.logger ?? index_js_1.silentLogger;
+    }
+    get configured() {
+        return Boolean(this.options.url);
+    }
+    async send(messages, options = {}) {
+        if (!this.options.url) {
+            if (!this.warnedUnconfigured)
+                this.logger.warn('Slack alert URL is not configured; alerts are logged only');
+            this.warnedUnconfigured = true;
+            return false;
+        }
+        const payload = {
+            messages,
+            alert_type: options.alertType ?? 'app-alert',
+            app_name: this.options.app,
+            environment: this.options.environment,
+            consolidate: true,
+        };
+        const post = this.options.fetch ?? fetch;
+        try {
+            const res = await post(this.options.url, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify(payload),
+                signal: AbortSignal.timeout(this.options.timeoutMs ?? 10_000),
+            });
+            if (!res.ok) {
+                const body = await res.text().catch(() => '');
+                this.logger.error('Slack alert rejected', { status: res.status, body: body.slice(0, 200) });
+                return false;
+            }
+            return true;
+        }
+        catch (error) {
+            this.logger.error('Slack alert failed', { error: error.message });
+            return false;
+        }
+    }
+}
+exports.SlackAlerter = SlackAlerter;
+//# sourceMappingURL=index.js.map

package/dist/cjs/alerting/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/alerting/index.ts"],"names":[],"mappings":";;;AAAA,kDAAmD;AA+BnD;;;GAGG;AACH,MAAa,YAAY;IAIM;IAHrB,kBAAkB,GAAG,KAAK,CAAC;IAClB,MAAM,CAAS;IAEhC,YAA6B,OAA4B;QAA5B,YAAO,GAAP,OAAO,CAAqB;QACvD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,uBAAY,CAAC;IAC/C,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAkB,EAAE,UAAkC,EAAE;QACjE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,kBAAkB;gBAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;YAC5G,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,OAAO,GAAsB;YACjC,QAAQ;YACR,UAAU,EAAE,OAAO,CAAC,SAAS,IAAI,WAAW;YAC5C,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG;YAC1B,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;YACrC,WAAW,EAAE,IAAI;SAClB,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;gBACvC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;gBAC7B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;aAC9D,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC9C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC5F,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7E,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;AA5CD,oCA4CC"}

package/dist/cjs/cache/index.js

@@ -0,0 +1,167 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createCache = createCache;
+exports.createRedisClient = createRedisClient;
+const ioredis_1 = require("ioredis");
+const index_js_1 = require("../logging/index.js");
+const NULL_SENTINEL = '__null__';
+class MemoryStore {
+    max;
+    map = new Map();
+    constructor(max) {
+        this.max = max;
+    }
+    get(key) {
+        const entry = this.map.get(key);
+        if (!entry)
+            return undefined;
+        if (entry.expiresAt < Date.now()) {
+            this.map.delete(key);
+            return undefined;
+        }
+        // Refresh recency for LRU eviction.
+        this.map.delete(key);
+        this.map.set(key, entry);
+        return entry.value;
+    }
+    set(key, value, ttlSec) {
+        if (this.map.size >= this.max)
+            this.map.delete(this.map.keys().next().value);
+        this.map.set(key, { value, expiresAt: Date.now() + ttlSec * 1000 });
+    }
+    del(key) {
+        this.map.delete(key);
+    }
+}
+/**
+ * Redis-backed cache with tag invalidation. If Redis errors, reads fall through to the loader
+ * and writes go to a bounded in-memory store, so a cache outage degrades latency rather than
+ * availability.
+ */
+function createCache(options) {
+    const logger = options.logger ?? index_js_1.silentLogger;
+    const defaultTtl = options.defaultTtlSec ?? 60;
+    const memory = new MemoryStore(options.memoryMaxEntries ?? 5000);
+    const inflight = new Map();
+    const k = (key) => `${options.namespace}:${key}`;
+    const tagKey = (tag) => `${options.namespace}:tag:${tag}`;
+    let warned = false;
+    const redisFailed = (error) => {
+        if (!warned)
+            logger.warn('Cache backend unavailable; using in-memory fallback', { error: error.message });
+        warned = true;
+    };
+    const readRaw = async (key) => {
+        if (options.redis) {
+            try {
+                const value = await options.redis.get(k(key));
+                warned = false;
+                return value ?? undefined;
+            }
+            catch (error) {
+                redisFailed(error);
+            }
+        }
+        return memory.get(k(key));
+    };
+    const writeRaw = async (key, raw, opts = {}) => {
+        const ttl = opts.ttlSec ?? defaultTtl;
+        if (options.redis) {
+            try {
+                const pipeline = options.redis.multi().set(k(key), raw, 'EX', ttl);
+                for (const tag of opts.tags ?? [])
+                    pipeline.sadd(tagKey(tag), k(key)).expire(tagKey(tag), Math.max(ttl, 86_400));
+                await pipeline.exec();
+                return;
+            }
+            catch (error) {
+                redisFailed(error);
+            }
+        }
+        memory.set(k(key), raw, ttl);
+    };
+    const cache = {
+        async get(key) {
+            const raw = await readRaw(key);
+            if (raw === undefined || raw === NULL_SENTINEL)
+                return undefined;
+            return JSON.parse(raw);
+        },
+        async set(key, value, opts) {
+            await writeRaw(key, value === null ? NULL_SENTINEL : JSON.stringify(value), opts);
+        },
+        async del(...keys) {
+            for (const key of keys)
+                memory.del(k(key));
+            if (options.redis && keys.length)
+                await options.redis.del(...keys.map(k)).catch(redisFailed);
+        },
+        async wrap(key, loader, opts = {}) {
+            const raw = await readRaw(key);
+            if (raw !== undefined) {
+                if (raw === NULL_SENTINEL)
+                    return null;
+                return JSON.parse(raw);
+            }
+            const existing = inflight.get(key);
+            if (existing)
+                return existing;
+            const load = (async () => {
+                try {
+                    const value = await loader();
+                    if (value !== null && value !== undefined)
+                        await writeRaw(key, JSON.stringify(value), opts);
+                    else if (opts.cacheNull)
+                        await writeRaw(key, NULL_SENTINEL, { ...opts, ttlSec: Math.min(opts.ttlSec ?? defaultTtl, 30) });
+                    return value;
+                }
+                finally {
+                    inflight.delete(key);
+                }
+            })();
+            inflight.set(key, load);
+            return load;
+        },
+        async invalidateTags(...tags) {
+            if (!options.redis)
+                return;
+            try {
+                for (const tag of tags) {
+                    const members = await options.redis.smembers(tagKey(tag));
+                    for (const member of members)
+                        memory.del(member);
+                    if (members.length)
+                        await options.redis.del(...members);
+                    await options.redis.del(tagKey(tag));
+                }
+            }
+            catch (error) {
+                redisFailed(error);
+            }
+        },
+    };
+    return cache;
+}
+/** ioredis client that never crashes the process on connection errors and retries forever. */
+function createRedisClient(opts) {
+    const logger = opts.logger ?? index_js_1.silentLogger;
+    const base = {
+        db: opts.db ?? 0,
+        keyPrefix: opts.keyPrefix || undefined,
+        lazyConnect: false,
+        enableOfflineQueue: false,
+        maxRetriesPerRequest: 1,
+        retryStrategy: (times) => Math.min(times * 500, 10_000),
+        ...opts.options,
+    };
+    const client = opts.url ? new ioredis_1.Redis(opts.url, base) : new ioredis_1.Redis(base);
+    let lastError = '';
+    client.on('error', (error) => {
+        if (error.message !== lastError)
+            logger.warn('Redis error', { error: error.message });
+        lastError = error.message;
+    });
+    client.on('ready', () => { lastError = ''; logger.info('Redis connected', { db: base.db }); });
+    return client;
+}
+//# sourceMappingURL=index.js.map

package/dist/cjs/cache/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/cache/index.ts"],"names":[],"mappings":";;AAgEA,kCA+FC;AAYD,8CAmBC;AA9LD,qCAAmD;AACnD,kDAAmD;AA6BnD,MAAM,aAAa,GAAG,UAAU,CAAC;AAEjC,MAAM,WAAW;IAEc;IADZ,GAAG,GAAG,IAAI,GAAG,EAAgD,CAAC;IAC/E,YAA6B,GAAW;QAAX,QAAG,GAAH,GAAG,CAAQ;IAAG,CAAC;IAE5C,GAAG,CAAC,GAAW;QACb,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACjC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACrB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,oCAAoC;QACpC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACzB,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,KAAa,EAAE,MAAc;QAC5C,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG;YAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,CAAC,CAAC;QACvF,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,GAAG,CAAC,GAAW;QACb,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;CACF;AAED;;;;GAIG;AACH,SAAgB,WAAW,CAAC,OAAqB;IAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,uBAAY,CAAC;IAC9C,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IAC/C,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,gBAAgB,IAAI,IAAI,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA4B,CAAC;IACrD,MAAM,CAAC,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;IACzD,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,SAAS,QAAQ,GAAG,EAAE,CAAC;IAClE,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,MAAM,WAAW,GAAG,CAAC,KAAc,EAAE,EAAE;QACrC,IAAI,CAAC,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,qDAAqD,EAAE,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACrH,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,EAAE,GAAW,EAA+B,EAAE;QACjE,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC9C,MAAM,GAAG,KAAK,CAAC;gBACf,OAAO,KAAK,IAAI,SAAS,CAAC;YAC5B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,WAAW,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK,EAAE,GAAW,EAAE,GAAW,EAAE,OAAwB,EAAE,EAAE,EAAE;QAC9E,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC;QACtC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;gBACnE,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE;oBAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;gBACjH,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACtB,OAAO;YACT,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,WAAW,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC,CAAC;IAEF,MAAM,KAAK,GAAU;QACnB,KAAK,CAAC,GAAG,CAAI,GAAW;YACtB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,aAAa;gBAAE,OAAO,SAAS,CAAC;YACjE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAM,CAAC;QAC9B,CAAC;QAED,KAAK,CAAC,GAAG,CAAI,GAAW,EAAE,KAAQ,EAAE,IAAsB;YACxD,MAAM,QAAQ,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;QACpF,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,GAAG,IAAc;YACzB,KAAK,MAAM,GAAG,IAAI,IAAI;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3C,IAAI,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM;gBAAE,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC/F,CAAC;QAED,KAAK,CAAC,IAAI,CAAI,GAAW,EAAE,MAAwB,EAAE,OAAkD,EAAE;YACvG,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,IAAI,GAAG,KAAK,aAAa;oBAAE,OAAO,IAAS,CAAC;gBAC5C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAM,CAAC;YAC9B,CAAC;YACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,QAAQ;gBAAE,OAAO,QAAsB,CAAC;YAC5C,MAAM,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE;gBACvB,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,MAAM,MAAM,EAAE,CAAC;oBAC7B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;wBAAE,MAAM,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;yBACvF,IAAI,IAAI,CAAC,SAAS;wBAAE,MAAM,QAAQ,CAAC,GAAG,EAAE,aAAa,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;oBAC1H,OAAO,KAAK,CAAC;gBACf,CAAC;wBAAS,CAAC;oBACT,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACvB,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;YACL,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,GAAG,IAAc;YACpC,IAAI,CAAC,OAAO,CAAC,KAAK;gBAAE,OAAO;YAC3B,IAAI,CAAC;gBACH,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACvB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;oBAC1D,KAAK,MAAM,MAAM,IAAI,OAAO;wBAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;oBACjD,IAAI,OAAO,CAAC,MAAM;wBAAE,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;oBACxD,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBACvC,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,WAAW,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;KACF,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAWD,8FAA8F;AAC9F,SAAgB,iBAAiB,CAAC,IAAwB;IACxD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,uBAAY,CAAC;IAC3C,MAAM,IAAI,GAAiB;QACzB,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC;QAChB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,SAAS;QACtC,WAAW,EAAE,KAAK;QAClB,kBAAkB,EAAE,KAAK;QACzB,oBAAoB,EAAE,CAAC;QACvB,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,GAAG,EAAE,MAAM,CAAC;QACvD,GAAG,IAAI,CAAC,OAAO;KAChB,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,eAAK,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,eAAK,CAAC,IAAI,CAAC,CAAC;IACtE,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE;QAClC,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACtF,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC;IAC5B,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,SAAS,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/F,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/cjs/common/async.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sleep = void 0;
+exports.retry = retry;
+exports.withTimeout = withTimeout;
+exports.chunk = chunk;
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+exports.sleep = sleep;
+/** Runs `fn`, retrying failures with exponential back-off. */
+async function retry(fn, options) {
+    const delay = options.delayMs ?? ((n) => Math.min(5000, 200 * 2 ** (n - 1)));
+    let attempt = 0;
+    for (;;) {
+        try {
+            return await fn(attempt);
+        }
+        catch (error) {
+            attempt += 1;
+            if (attempt > options.retries || (options.shouldRetry && !options.shouldRetry(error)))
+                throw error;
+            await (0, exports.sleep)(delay(attempt));
+        }
+    }
+}
+/** Rejects with `onTimeout()` if `promise` does not settle within `ms`. */
+function withTimeout(promise, ms, onTimeout) {
+    let timer;
+    return Promise.race([
+        promise.finally(() => clearTimeout(timer)),
+        new Promise((_, reject) => { timer = setTimeout(() => reject(onTimeout()), ms); }),
+    ]);
+}
+/** Splits `items` into arrays of at most `size`. */
+function chunk(items, size) {
+    const out = [];
+    for (let i = 0; i < items.length; i += size)
+        out.push(items.slice(i, i + size));
+    return out;
+}
+//# sourceMappingURL=async.js.map

package/dist/cjs/common/async.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"async.js","sourceRoot":"","sources":["../../../src/common/async.ts"],"names":[],"mappings":";;;AAUA,sBAYC;AAGD,kCAMC;AAGD,sBAIC;AAtCM,MAAM,KAAK,GAAG,CAAC,EAAU,EAAiB,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAAzF,QAAA,KAAK,SAAoF;AAStG,8DAA8D;AACvD,KAAK,UAAU,KAAK,CAAI,EAAmC,EAAE,OAAqB;IACvF,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACrF,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,SAAS,CAAC;QACR,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,CAAC;YACb,IAAI,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;gBAAE,MAAM,KAAK,CAAC;YACnG,MAAM,IAAA,aAAK,EAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,SAAgB,WAAW,CAAI,OAAmB,EAAE,EAAU,EAAE,SAAsB;IACpF,IAAI,KAAoC,CAAC;IACzC,OAAO,OAAO,CAAC,IAAI,CAAC;QAClB,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;KAC1F,CAAC,CAAC;AACL,CAAC;AAED,oDAAoD;AACpD,SAAgB,KAAK,CAAI,KAAmB,EAAE,IAAY;IACxD,MAAM,GAAG,GAAU,EAAE,CAAC;IACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IAChF,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/cjs/common/audit.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildAuditRow = buildAuditRow;
+const id_js_1 = require("./id.js");
+/**
+ * Builds the row for a `*_audits` sibling table: a copy of the parent row plus `action`,
+ * `parentId`, and a fresh `id`. The parent's timestamps are dropped so the audit row records
+ * when the change happened. The actor lands in `createdBy`/`updatedBy` exactly as on the parent
+ * (null for system operations). Strip secrets (e.g. password hashes) before calling.
+ */
+function buildAuditRow(row, action, actorId = null) {
+    const { id: parentId, createdAt: _createdAt, updatedAt: _updatedAt, ...rest } = row;
+    return {
+        ...rest,
+        id: (0, id_js_1.newId)(),
+        parentId,
+        action,
+        ...(action === 'create' ? { createdBy: actorId, updatedBy: actorId } : { updatedBy: actorId }),
+    };
+}
+//# sourceMappingURL=audit.js.map

package/dist/cjs/common/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../src/common/audit.ts"],"names":[],"mappings":";;AAYA,sCASC;AArBD,mCAAgC;AAMhC;;;;;GAKG;AACH,SAAgB,aAAa,CAA2B,GAAM,EAAE,MAAmB,EAAE,UAAyB,IAAI;IAChH,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,GAAuD,CAAC;IACxI,OAAO;QACL,GAAI,IAAkD;QACtD,EAAE,EAAE,IAAA,aAAK,GAAE;QACX,QAAQ;QACR,MAAM;QACN,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;KAC/F,CAAC;AACJ,CAAC"}

package/dist/cjs/common/crypto.js

@@ -0,0 +1,75 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sha256 = sha256;
+exports.hmacSha256 = hmacSha256;
+exports.safeEqual = safeEqual;
+exports.randomToken = randomToken;
+exports.randomNumericCode = randomNumericCode;
+exports.hashToken = hashToken;
+exports.encryptSecret = encryptSecret;
+exports.decryptSecret = decryptSecret;
+exports.isEncryptedSecret = isEncryptedSecret;
+const node_crypto_1 = require("node:crypto");
+function sha256(value) {
+    return (0, node_crypto_1.createHash)('sha256').update(value).digest('hex');
+}
+function hmacSha256(secret, value) {
+    return (0, node_crypto_1.createHmac)('sha256', secret).update(value).digest('hex');
+}
+/** Constant-time string comparison (false when lengths differ). */
+function safeEqual(a, b) {
+    const left = Buffer.from(a);
+    const right = Buffer.from(b);
+    return left.length === right.length && (0, node_crypto_1.timingSafeEqual)(left, right);
+}
+/** URL-safe random token (default 32 bytes of entropy). */
+function randomToken(bytes = 32) {
+    return (0, node_crypto_1.randomBytes)(bytes).toString('base64url');
+}
+/** Numeric one-time code, e.g. `'042917'`. Uses a CSPRNG. */
+function randomNumericCode(length = 6) {
+    let code = '';
+    for (let i = 0; i < length; i += 1)
+        code += String((0, node_crypto_1.randomInt)(0, 10));
+    return code;
+}
+/**
+ * Hash a value that must be looked up later (refresh tokens, reset tokens, OTPs) with a
+ * server-side pepper so a database leak alone cannot be replayed.
+ */
+function hashToken(token, pepper) {
+    return hmacSha256(pepper, token);
+}
+const CIPHER = 'aes-256-gcm';
+const IV_BYTES = 12;
+const FORMAT_VERSION = 'v1';
+/** Accepts a 32-byte key as hex/base64, or any passphrase (derived with SHA-256). */
+function resolveKey(key) {
+    if (/^[0-9a-f]{64}$/i.test(key))
+        return Buffer.from(key, 'hex');
+    const b64 = Buffer.from(key, 'base64');
+    if (b64.length === 32 && /^[A-Za-z0-9+/=_-]+$/.test(key))
+        return b64;
+    return (0, node_crypto_1.createHash)('sha256').update(key).digest();
+}
+/** AES-256-GCM encrypt. Output: `v1:<iv>:<tag>:<ciphertext>` (base64url parts). */
+function encryptSecret(plaintext, key) {
+    const iv = (0, node_crypto_1.randomBytes)(IV_BYTES);
+    const cipher = (0, node_crypto_1.createCipheriv)(CIPHER, resolveKey(key), iv);
+    const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return [FORMAT_VERSION, iv.toString('base64url'), tag.toString('base64url'), encrypted.toString('base64url')].join(':');
+}
+function decryptSecret(payload, key) {
+    const [version, iv, tag, data] = payload.split(':');
+    if (version !== FORMAT_VERSION || !iv || !tag || data === undefined) {
+        throw new Error('Unsupported encrypted payload format');
+    }
+    const decipher = (0, node_crypto_1.createDecipheriv)(CIPHER, resolveKey(key), Buffer.from(iv, 'base64url'));
+    decipher.setAuthTag(Buffer.from(tag, 'base64url'));
+    return Buffer.concat([decipher.update(Buffer.from(data, 'base64url')), decipher.final()]).toString('utf8');
+}
+function isEncryptedSecret(value) {
+    return typeof value === 'string' && value.startsWith(`${FORMAT_VERSION}:`) && value.split(':').length === 4;
+}
+//# sourceMappingURL=crypto.js.map

package/dist/cjs/common/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../../src/common/crypto.ts"],"names":[],"mappings":";;AAEA,wBAEC;AAED,gCAEC;AAGD,8BAIC;AAGD,kCAEC;AAGD,8CAIC;AAMD,8BAEC;AAeD,sCAMC;AAED,sCAQC;AAED,8CAEC;AAtED,6CAAgI;AAEhI,SAAgB,MAAM,CAAC,KAAsB;IAC3C,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAgB,UAAU,CAAC,MAAuB,EAAE,KAAa;IAC/D,OAAO,IAAA,wBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,mEAAmE;AACnE,SAAgB,SAAS,CAAC,CAAS,EAAE,CAAS;IAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,IAAA,6BAAe,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACtE,CAAC;AAED,2DAA2D;AAC3D,SAAgB,WAAW,CAAC,KAAK,GAAG,EAAE;IACpC,OAAO,IAAA,yBAAW,EAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAClD,CAAC;AAED,6DAA6D;AAC7D,SAAgB,iBAAiB,CAAC,MAAM,GAAG,CAAC;IAC1C,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,IAAI,IAAI,MAAM,CAAC,IAAA,uBAAS,EAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACrE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,SAAgB,SAAS,CAAC,KAAa,EAAE,MAAc;IACrD,OAAO,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,MAAM,GAAG,aAAa,CAAC;AAC7B,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,cAAc,GAAG,IAAI,CAAC;AAE5B,qFAAqF;AACrF,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACvC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACrE,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;AACnD,CAAC;AAED,mFAAmF;AACnF,SAAgB,aAAa,CAAC,SAAiB,EAAE,GAAW;IAC1D,MAAM,EAAE,GAAG,IAAA,yBAAW,EAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,IAAA,4BAAc,EAAC,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACpF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1H,CAAC;AAED,SAAgB,aAAa,CAAC,OAAe,EAAE,GAAW;IACxD,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,OAAO,KAAK,cAAc,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,QAAQ,GAAG,IAAA,8BAAgB,EAAC,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;IACzF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC7G,CAAC;AAED,SAAgB,iBAAiB,CAAC,KAAc;IAC9C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,cAAc,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AAC9G,CAAC"}

package/dist/cjs/common/errors.js

@@ -0,0 +1,90 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NonRetryableError = exports.ServiceUnavailableError = exports.TooManyRequestsError = exports.ValidationError = exports.ConflictError = exports.NotFoundError = exports.ForbiddenError = exports.UnauthorizedError = exports.BadRequestError = exports.AppError = void 0;
+exports.isAppError = isAppError;
+exports.publicMessage = publicMessage;
+/**
+ * Base class for errors that map to an HTTP status. Throw these from services; the shared
+ * error middleware turns them into the standard envelope. Anything that is not an AppError is
+ * reported as a 500 with a generic message so internals never leak.
+ */
+class AppError extends Error {
+    statusCode;
+    code;
+    errors;
+    /** Consumers dead-letter immediately instead of retrying when this is false. */
+    retryable;
+    constructor(statusCode, message, options = {}) {
+        super(message, options.cause ? { cause: options.cause } : undefined);
+        this.name = new.target.name;
+        this.statusCode = statusCode;
+        this.code = options.code ?? defaultCode(statusCode);
+        this.errors = options.errors;
+        this.retryable = options.retryable ?? statusCode >= 500;
+    }
+}
+exports.AppError = AppError;
+function defaultCode(status) {
+    switch (status) {
+        case 400: return 'BAD_REQUEST';
+        case 401: return 'UNAUTHENTICATED';
+        case 403: return 'FORBIDDEN';
+        case 404: return 'NOT_FOUND';
+        case 409: return 'CONFLICT';
+        case 422: return 'VALIDATION_FAILED';
+        case 429: return 'RATE_LIMITED';
+        case 503: return 'SERVICE_UNAVAILABLE';
+        default: return status >= 500 ? 'INTERNAL_ERROR' : 'ERROR';
+    }
+}
+class BadRequestError extends AppError {
+    constructor(message = 'Bad request', options = {}) { super(400, message, options); }
+}
+exports.BadRequestError = BadRequestError;
+class UnauthorizedError extends AppError {
+    constructor(message = 'Authentication required', options = {}) { super(401, message, options); }
+}
+exports.UnauthorizedError = UnauthorizedError;
+class ForbiddenError extends AppError {
+    constructor(message = 'You do not have permission to perform this action', options = {}) { super(403, message, options); }
+}
+exports.ForbiddenError = ForbiddenError;
+class NotFoundError extends AppError {
+    constructor(message = 'Resource not found', options = {}) { super(404, message, options); }
+}
+exports.NotFoundError = NotFoundError;
+class ConflictError extends AppError {
+    constructor(message = 'Resource already exists', options = {}) { super(409, message, options); }
+}
+exports.ConflictError = ConflictError;
+class ValidationError extends AppError {
+    constructor(errors, message = 'Validation failed') { super(422, message, { errors }); }
+}
+exports.ValidationError = ValidationError;
+class TooManyRequestsError extends AppError {
+    constructor(message = 'Too many requests. Please try again later.', options = {}) { super(429, message, options); }
+}
+exports.TooManyRequestsError = TooManyRequestsError;
+class ServiceUnavailableError extends AppError {
+    constructor(message = 'Service temporarily unavailable', options = {}) { super(503, message, options); }
+}
+exports.ServiceUnavailableError = ServiceUnavailableError;
+/** A failure that will never succeed on retry (bad payload, unknown template, …). */
+class NonRetryableError extends AppError {
+    constructor(message, options = {}) {
+        super(422, message, { ...options, retryable: false });
+    }
+}
+exports.NonRetryableError = NonRetryableError;
+function isAppError(error) {
+    return error instanceof AppError;
+}
+/** Message safe to show a caller; hides internals for unexpected errors. */
+function publicMessage(error) {
+    if (isAppError(error) && error.statusCode < 500)
+        return error.message;
+    if (isAppError(error) && error.statusCode === 503)
+        return error.message;
+    return 'Internal server error';
+}
+//# sourceMappingURL=errors.js.map

package/dist/cjs/common/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/common/errors.ts"],"names":[],"mappings":";;;AAsEA,gCAEC;AAGD,sCAIC;AA7ED;;;;GAIG;AACH,MAAa,QAAS,SAAQ,KAAK;IACxB,UAAU,CAAS;IACnB,IAAI,CAAS;IACb,MAAM,CAAgB;IAC/B,gFAAgF;IACvE,SAAS,CAAU;IAE5B,YAAY,UAAkB,EAAE,OAAe,EAAE,UAA0F,EAAE;QAC3I,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,IAAI,GAAG,CAAC;IAC1D,CAAC;CACF;AAfD,4BAeC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,GAAG,CAAC,CAAC,OAAO,aAAa,CAAC;QAC/B,KAAK,GAAG,CAAC,CAAC,OAAO,iBAAiB,CAAC;QACnC,KAAK,GAAG,CAAC,CAAC,OAAO,WAAW,CAAC;QAC7B,KAAK,GAAG,CAAC,CAAC,OAAO,WAAW,CAAC;QAC7B,KAAK,GAAG,CAAC,CAAC,OAAO,UAAU,CAAC;QAC5B,KAAK,GAAG,CAAC,CAAC,OAAO,mBAAmB,CAAC;QACrC,KAAK,GAAG,CAAC,CAAC,OAAO,cAAc,CAAC;QAChC,KAAK,GAAG,CAAC,CAAC,OAAO,qBAAqB,CAAC;QACvC,OAAO,CAAC,CAAC,OAAO,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,MAAa,eAAgB,SAAQ,QAAQ;IAC3C,YAAY,OAAO,GAAG,aAAa,EAAE,UAAoD,EAAE,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;CAC/H;AAFD,0CAEC;AACD,MAAa,iBAAkB,SAAQ,QAAQ;IAC7C,YAAY,OAAO,GAAG,yBAAyB,EAAE,UAA6B,EAAE,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;CACpH;AAFD,8CAEC;AACD,MAAa,cAAe,SAAQ,QAAQ;IAC1C,YAAY,OAAO,GAAG,mDAAmD,EAAE,UAA6B,EAAE,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;CAC9I;AAFD,wCAEC;AACD,MAAa,aAAc,SAAQ,QAAQ;IACzC,YAAY,OAAO,GAAG,oBAAoB,EAAE,UAA6B,EAAE,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;CAC/G;AAFD,sCAEC;AACD,MAAa,aAAc,SAAQ,QAAQ;IACzC,YAAY,OAAO,GAAG,yBAAyB,EAAE,UAAoD,EAAE,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;CAC3I;AAFD,sCAEC;AACD,MAAa,eAAgB,SAAQ,QAAQ;IAC3C,YAAY,MAAoB,EAAE,OAAO,GAAG,mBAAmB,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;CACtG;AAFD,0CAEC;AACD,MAAa,oBAAqB,SAAQ,QAAQ;IAChD,YAAY,OAAO,GAAG,4CAA4C,EAAE,UAA6B,EAAE,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;CACvI;AAFD,oDAEC;AACD,MAAa,uBAAwB,SAAQ,QAAQ;IACnD,YAAY,OAAO,GAAG,iCAAiC,EAAE,UAA8C,EAAE,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;CAC7I;AAFD,0DAEC;AAED,qFAAqF;AACrF,MAAa,iBAAkB,SAAQ,QAAQ;IAC7C,YAAY,OAAe,EAAE,UAA8C,EAAE;QAC3E,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACxD,CAAC;CACF;AAJD,8CAIC;AAED,SAAgB,UAAU,CAAC,KAAc;IACvC,OAAO,KAAK,YAAY,QAAQ,CAAC;AACnC,CAAC;AAED,4EAA4E;AAC5E,SAAgB,aAAa,CAAC,KAAc;IAC1C,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,GAAG,GAAG;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IACtE,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IACxE,OAAO,uBAAuB,CAAC;AACjC,CAAC"}