@heavybit/shared-lib 0.0.0-stage → 1.2.0

package/dist/types/contracts/notification-dispatch.d.ts

@@ -0,0 +1,175 @@
+import { z } from 'zod';
+/**
+ * `notification:dispatch` — the one command every Showbiz service stages (through its outbox) to have
+ * notification-service render a seeded template and deliver it by email and/or the in-app feed. No
+ * other service sends email itself. One contract for both sides: producers type their payload with it
+ * and notification-service validates against it, so the two cannot drift.
+ */
+export declare const NOTIFICATION_DISPATCH = "notification:dispatch";
+/** Channels a dispatch may ask for. `in_app` needs a recipient `userId` (the bell feed is per user). */
+export declare const DISPATCH_CHANNELS: readonly ["email", "in_app"];
+export type DispatchChannel = (typeof DISPATCH_CHANNELS)[number];
+/**
+ * What a dispatch is about. Account mail (`security`, `account`, `team`, `marketing`) goes to a user;
+ * `staff` is an operational alert to a configured staff address.
+ */
+export declare const NOTIFICATION_CATEGORIES: readonly ["security", "account", "team", "marketing", "staff"];
+export type NotificationCategory = (typeof NOTIFICATION_CATEGORIES)[number];
+export declare const DISPATCH_LIMITS: {
+    readonly template: 100;
+    readonly email: 254;
+    readonly name: 200;
+    readonly dataKeys: 40;
+    readonly dataKey: 64;
+    readonly dataValue: 2000;
+    readonly secretKeys: 10;
+    readonly permission: 100;
+};
+/** Template variables are flat scalars: they are printed into the copy, never serialised objects. */
+export declare const dispatchValueSchema: z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>;
+export type DispatchValue = z.infer<typeof dispatchValueSchema>;
+export declare const dispatchRecipientSchema: z.ZodObject<{
+    email: z.ZodString;
+    name: z.ZodOptional<z.ZodString>;
+    userId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    locale: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    /** IANA zone; time variables are rendered in it. */
+    timezone: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, "strip", z.ZodTypeAny, {
+    email: string;
+    name?: string | undefined;
+    userId?: string | null | undefined;
+    locale?: string | null | undefined;
+    timezone?: string | null | undefined;
+}, {
+    email: string;
+    name?: string | undefined;
+    userId?: string | null | undefined;
+    locale?: string | null | undefined;
+    timezone?: string | null | undefined;
+}>;
+export type DispatchRecipient = z.infer<typeof dispatchRecipientSchema>;
+export declare const notificationDispatchSchema: z.ZodEffects<z.ZodObject<{
+    /** Seeded `notification_templates.slug`. */
+    template: z.ZodString;
+    category: z.ZodEnum<["security", "account", "team", "marketing", "staff"]>;
+    recipient: z.ZodObject<{
+        email: z.ZodString;
+        name: z.ZodOptional<z.ZodString>;
+        userId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        locale: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        /** IANA zone; time variables are rendered in it. */
+        timezone: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, "strip", z.ZodTypeAny, {
+        email: string;
+        name?: string | undefined;
+        userId?: string | null | undefined;
+        locale?: string | null | undefined;
+        timezone?: string | null | undefined;
+    }, {
+        email: string;
+        name?: string | undefined;
+        userId?: string | null | undefined;
+        locale?: string | null | undefined;
+        timezone?: string | null | undefined;
+    }>;
+    channels: z.ZodArray<z.ZodEnum<["email", "in_app"]>, "many">;
+    data: z.ZodEffects<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>>>, Record<string, string | number | boolean | null>, Record<string, string | number | boolean | null> | undefined>;
+    /**
+     * Keys of `data` holding a one-time secret (a sign-in code, a reset or confirm link). They are used to
+     * render the email and nothing else: notification-service never stores them and never puts them in the
+     * in-app feed, and email-service masks them in what it keeps.
+     */
+    secretKeys: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /** Security and staff alerts are always delivered, whatever the recipient's preferences. */
+    bypassPreferences: z.ZodOptional<z.ZodBoolean>;
+    /** The permission staff recipients hold; informational until recipients are resolved by permission. */
+    targetPermission: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    data: Record<string, string | number | boolean | null>;
+    category: "security" | "account" | "team" | "marketing" | "staff";
+    template: string;
+    recipient: {
+        email: string;
+        name?: string | undefined;
+        userId?: string | null | undefined;
+        locale?: string | null | undefined;
+        timezone?: string | null | undefined;
+    };
+    channels: ("email" | "in_app")[];
+    secretKeys: string[];
+    bypassPreferences?: boolean | undefined;
+    targetPermission?: string | undefined;
+}, {
+    category: "security" | "account" | "team" | "marketing" | "staff";
+    template: string;
+    recipient: {
+        email: string;
+        name?: string | undefined;
+        userId?: string | null | undefined;
+        locale?: string | null | undefined;
+        timezone?: string | null | undefined;
+    };
+    channels: ("email" | "in_app")[];
+    data?: Record<string, string | number | boolean | null> | undefined;
+    secretKeys?: string[] | undefined;
+    bypassPreferences?: boolean | undefined;
+    targetPermission?: string | undefined;
+}>, {
+    data: Record<string, string | number | boolean | null>;
+    category: "security" | "account" | "team" | "marketing" | "staff";
+    template: string;
+    recipient: {
+        email: string;
+        name?: string | undefined;
+        userId?: string | null | undefined;
+        locale?: string | null | undefined;
+        timezone?: string | null | undefined;
+    };
+    channels: ("email" | "in_app")[];
+    secretKeys: string[];
+    bypassPreferences?: boolean | undefined;
+    targetPermission?: string | undefined;
+}, {
+    category: "security" | "account" | "team" | "marketing" | "staff";
+    template: string;
+    recipient: {
+        email: string;
+        name?: string | undefined;
+        userId?: string | null | undefined;
+        locale?: string | null | undefined;
+        timezone?: string | null | undefined;
+    };
+    channels: ("email" | "in_app")[];
+    data?: Record<string, string | number | boolean | null> | undefined;
+    secretKeys?: string[] | undefined;
+    bypassPreferences?: boolean | undefined;
+    targetPermission?: string | undefined;
+}>;
+/**
+ * The seeded templates Showbiz services dispatch, with the variables (`data` keys) each dispatch carries.
+ * Producers send exactly these keys; a seeded template may use any subset (notification-service dead-letters
+ * a dispatch missing a variable its template uses). Both sides test against this table.
+ */
+export declare const DISPATCH_TEMPLATE_VARIABLES: {
+    readonly 'account-activation': readonly ["name", "code", "expiresInHours"];
+    readonly 'login-otp': readonly ["name", "code", "expiresInMinutes", "device"];
+    readonly 'password-reset': readonly ["name", "resetUrl", "expiresInMinutes"];
+    readonly 'staff-invitation': readonly ["name", "resetUrl", "expiresInMinutes"];
+    readonly 'password-changed': readonly ["name", "changedAt"];
+    readonly 'new-device-login': readonly ["name", "device", "ip", "country", "occurredAt", "confirmUrl", "disputeUrl"];
+    readonly 'team-member-added': readonly ["name", "profileName", "role", "invitedBy"];
+    readonly 'account-suspended': readonly ["name", "reason"];
+    readonly 'welcome-listener': readonly ["name"];
+    readonly 'welcome-creator': readonly ["name"];
+    readonly ai_budget_threshold: readonly ["requester", "period", "threshold_pct", "spent_usd", "limit_usd"];
+    readonly newswire_source_unhealthy: readonly ["source_name", "source_slug", "consecutive_failures", "last_error", "last_success_at"];
+    readonly newswire_block_rate_high: readonly ["blocked", "total", "block_rate_pct", "window_hours"];
+    readonly autopublish_audit_alert: readonly ["problem_rate_pct", "problem_count", "sample_count", "window_days", "action_taken"];
+};
+export type DispatchTemplate = keyof typeof DISPATCH_TEMPLATE_VARIABLES;
+/** The validated command (defaults applied). */
+export type NotificationDispatch = z.infer<typeof notificationDispatchSchema>;
+/** What a producer stages: `data` and `secretKeys` may be omitted. */
+export type NotificationDispatchInput = z.input<typeof notificationDispatchSchema>;
+//# sourceMappingURL=notification-dispatch.d.ts.map

package/dist/types/contracts/notification-dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notification-dispatch.d.ts","sourceRoot":"","sources":["../../../src/contracts/notification-dispatch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,0BAA0B,CAAC;AAE7D,wGAAwG;AACxG,eAAO,MAAM,iBAAiB,8BAA+B,CAAC;AAC9D,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjE;;;GAGG;AACH,eAAO,MAAM,uBAAuB,gEAAiE,CAAC;AACtG,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5E,eAAO,MAAM,eAAe;;;;;;;;;CASlB,CAAC;AAEX,qGAAqG;AACrG,eAAO,MAAM,mBAAmB,iEAAmG,CAAC;AACpI,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,uBAAuB;;;;;IAKlC,oDAAoD;;;;;;;;;;;;;;EAEpD,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAIxE,eAAO,MAAM,0BAA0B;IAEnC,4CAA4C;;;;;;;;QAT9C,oDAAoD;;;;;;;;;;;;;;;;;IAkBlD;;;;OAIG;;IAEH,4FAA4F;;IAE5F,uGAAuG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EASvG,CAAC;AAEL;;;;GAIG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;CAiBc,CAAC;AACvD,MAAM,MAAM,gBAAgB,GAAG,MAAM,OAAO,2BAA2B,CAAC;AAExE,gDAAgD;AAChD,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,sEAAsE;AACtE,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC"}

package/dist/types/contracts/upload-import.d.ts

@@ -0,0 +1,96 @@
+import { z } from 'zod';
+/**
+ * Licensed image import by URL (Newswire R5, decision R39). newswire-service (and later
+ * editorial-service) sends `upload:import`; upload-service fetches the file and answers with an
+ * `upload.import.completed` or `upload.import.failed` event. One contract for both sides.
+ */
+export declare const UPLOAD_IMPORT = "upload:import";
+export declare const UPLOAD_IMPORT_EVENTS: {
+    readonly COMPLETED: "upload.import.completed";
+    readonly FAILED: "upload.import.failed";
+};
+/** Upload policies an import may use. */
+export declare const UPLOAD_IMPORT_POLICIES: readonly ["news_image"];
+export type UploadImportPolicy = (typeof UPLOAD_IMPORT_POLICIES)[number];
+/** Field limits of the contract (upload-service's `uploads` columns). */
+export declare const UPLOAD_IMPORT_LIMITS: {
+    readonly url: 2048;
+    readonly ownerType: 50;
+    readonly licenceHolder: 160;
+    readonly licenceBasis: 255;
+    readonly reason: 255;
+};
+/**
+ * `upload:import` data. The URL is only length-checked here: upload-service rejects a non-https or
+ * unsafe URL itself, so the sender hears about it through a `failed` event instead of a dead letter.
+ */
+export declare const uploadImportCommandSchema: z.ZodObject<{
+    /** ULID the outcome event echoes back; upload-service is idempotent on it. */
+    importId: z.ZodString;
+    url: z.ZodString;
+    policy: z.ZodEnum<["news_image"]>;
+    /** Echoed in the outcome only; the imported upload is a system row with no owner. */
+    ownerType: z.ZodString;
+    ownerId: z.ZodString;
+    licence: z.ZodObject<{
+        holder: z.ZodString;
+        basis: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        holder: string;
+        basis: string;
+    }, {
+        holder: string;
+        basis: string;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    url: string;
+    importId: string;
+    policy: "news_image";
+    ownerType: string;
+    ownerId: string;
+    licence: {
+        holder: string;
+        basis: string;
+    };
+}, {
+    url: string;
+    importId: string;
+    policy: "news_image";
+    ownerType: string;
+    ownerId: string;
+    licence: {
+        holder: string;
+        basis: string;
+    };
+}>;
+export declare const uploadImportCompletedSchema: z.ZodObject<{
+    importId: z.ZodString;
+    uploadId: z.ZodString;
+    ownerType: z.ZodString;
+    ownerId: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    uploadId: string;
+    importId: string;
+    ownerType: string;
+    ownerId: string;
+}, {
+    uploadId: string;
+    importId: string;
+    ownerType: string;
+    ownerId: string;
+}>;
+/** `reason` is a machine code (`too_large`, `http_404`, …; see upload-service `ImportFailureReason`). */
+export declare const uploadImportFailedSchema: z.ZodObject<{
+    importId: z.ZodString;
+    reason: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    reason: string;
+    importId: string;
+}, {
+    reason: string;
+    importId: string;
+}>;
+export type UploadImportCommand = z.infer<typeof uploadImportCommandSchema>;
+export type UploadImportCompleted = z.infer<typeof uploadImportCompletedSchema>;
+export type UploadImportFailed = z.infer<typeof uploadImportFailedSchema>;
+//# sourceMappingURL=upload-import.d.ts.map

package/dist/types/contracts/upload-import.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upload-import.d.ts","sourceRoot":"","sources":["../../../src/contracts/upload-import.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;GAIG;AACH,eAAO,MAAM,aAAa,kBAAkB,CAAC;AAE7C,eAAO,MAAM,oBAAoB;;;CAGvB,CAAC;AAEX,yCAAyC;AACzC,eAAO,MAAM,sBAAsB,yBAA0B,CAAC;AAC9D,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,yEAAyE;AACzE,eAAO,MAAM,oBAAoB;;;;;;CAMvB,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,yBAAyB;IACpC,8EAA8E;;;;IAI9E,qFAAqF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAOrF,CAAC;AAEH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;EAKtC,CAAC;AAEH,yGAAyG;AACzG,eAAO,MAAM,wBAAwB;;;;;;;;;EAGnC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}

package/dist/types/database/index.d.ts

@@ -0,0 +1,25 @@
+import type { Knex } from 'knex';
+import mysql from 'mysql2/promise';
+export interface MysqlConnectionOptions {
+    host: string;
+    port: number;
+    user: string;
+    password: string;
+    database: string;
+    poolMax?: number;
+}
+/**
+ * mysql2 pool for Drizzle. Sessions run in UTC and utf8mb4 so timestamps and emoji round-trip
+ * unchanged regardless of server defaults.
+ */
+export declare function createMysqlPool(options: MysqlConnectionOptions): mysql.Pool;
+/** Knex config for migrations/seeds and query-builder use (same session settings as the pool). */
+export declare function createKnexConfig(options: MysqlConnectionOptions & {
+    migrationsDir?: string;
+    seedsDir?: string;
+}): Knex.Config;
+/** Readiness probe helper. */
+export declare function pingMysql(pool: mysql.Pool): Promise<void>;
+/** Escapes `%`, `_` and `\` for use inside a LIKE pattern. */
+export declare function escapeLike(value: string): string;
+//# sourceMappingURL=index.d.ts.map

package/dist/types/database/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/database/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,MAAM,gBAAgB,CAAC;AAEnC,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,KAAK,CAAC,IAAI,CAe3E;AAED,kGAAkG;AAClG,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,sBAAsB,GAAG;IAAE,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,MAAM,CAgB7H;AAED,8BAA8B;AAC9B,wBAAsB,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/D;AAED,8DAA8D;AAC9D,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhD"}

package/dist/types/express/auth.d.ts

@@ -0,0 +1,27 @@
+import type { RequestHandler } from 'express';
+import type { AuthUser, Logger } from '../types/index.js';
+declare global {
+    namespace Express {
+        interface Request {
+            user?: AuthUser;
+        }
+    }
+}
+export interface GatewayAuthOptions {
+    secret: string;
+    maxSkewMs?: number;
+    logger?: Logger;
+}
+/** Requires a valid gateway-signed identity; 401 otherwise. */
+export declare function authenticateFromGateway(options: GatewayAuthOptions): RequestHandler;
+/** Attaches `req.user` when a valid identity is present; continues anonymously otherwise. */
+export declare function optionalAuthFromGateway(options: GatewayAuthOptions): RequestHandler;
+/** Allows callers holding any of `permissions`. */
+export declare const requirePermission: (...permissions: string[]) => RequestHandler;
+/** Allows callers holding every one of `permissions`. */
+export declare const requireAllPermissions: (...permissions: string[]) => RequestHandler;
+/** Allows callers with any of `roles`. Prefer permissions; roles are for coarse gates only. */
+export declare const requireRole: (...roles: string[]) => RequestHandler;
+/** Guards `/internal/*` routes: requires the shared service secret header. */
+export declare function requireInternalServiceSecret(secret: string): RequestHandler;
+//# sourceMappingURL=auth.d.ts.map

package/dist/types/express/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/express/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAyB,cAAc,EAAY,MAAM,SAAS,CAAC;AAK/E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE1D,OAAO,CAAC,MAAM,CAAC;IAEb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,IAAI,CAAC,EAAE,QAAQ,CAAC;SACjB;KACF;CACF;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAeD,+DAA+D;AAC/D,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,kBAAkB,GAAG,cAAc,CAKnF;AAED,6FAA6F;AAC7F,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,kBAAkB,GAAG,cAAc,CAQnF;AAgBD,mDAAmD;AACnD,eAAO,MAAM,iBAAiB,GAAI,GAAG,aAAa,MAAM,EAAE,KAAG,cAAgE,CAAC;AAE9H,yDAAyD;AACzD,eAAO,MAAM,qBAAqB,GAAI,GAAG,aAAa,MAAM,EAAE,KAAG,cAAoE,CAAC;AAEtI,+FAA+F;AAC/F,eAAO,MAAM,WAAW,GAAI,GAAG,OAAO,MAAM,EAAE,KAAG,cAAyE,CAAC;AAE3H,8EAA8E;AAC9E,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,CAM3E"}

package/dist/types/express/health.d.ts

@@ -0,0 +1,14 @@
+import type { RequestHandler } from 'express';
+export type HealthCheck = () => Promise<unknown> | unknown;
+export interface HealthOptions {
+    service: string;
+    version?: string;
+    /** Readiness dependencies, e.g. `{ mysql: () => pool.query('select 1'), rabbitmq: () => conn.assertReady() }`. */
+    checks?: Record<string, HealthCheck>;
+    timeoutMs?: number;
+}
+/** `GET /health` — liveness: the process is up. Never touches dependencies. */
+export declare function livenessHandler(options: HealthOptions): RequestHandler;
+/** `GET /health/ready` — readiness: every dependency responds. 503 when any fails. */
+export declare function readinessHandler(options: HealthOptions): RequestHandler;
+//# sourceMappingURL=health.d.ts.map

package/dist/types/express/health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../../../src/express/health.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,cAAc,EAAY,MAAM,SAAS,CAAC;AAGjE,MAAM,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;AAE3D,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kHAAkH;IAClH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,+EAA+E;AAC/E,wBAAgB,eAAe,CAAC,OAAO,EAAE,aAAa,GAAG,cAAc,CAKtE;AAED,sFAAsF;AACtF,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,aAAa,GAAG,cAAc,CAevE"}

package/dist/types/express/index.d.ts

@@ -0,0 +1,5 @@
+export * from './auth.js';
+export * from './middleware.js';
+export * from './health.js';
+export * from './security.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/types/express/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/express/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC"}

package/dist/types/express/middleware.d.ts

@@ -0,0 +1,20 @@
+import type { ErrorRequestHandler, NextFunction, Request, RequestHandler, Response } from 'express';
+import type { ZodTypeAny } from 'zod';
+import type { Logger } from '../types/index.js';
+/** Ensures every request carries `x-correlation-id` (reused from the gateway when present). */
+export declare function correlationMiddleware(): RequestHandler;
+export declare function correlationId(req: Request): string | undefined;
+/** Real client IP: gateway-forwarded header first, then Express's `req.ip`. */
+export declare function clientIp(req: Request): string | null;
+export declare function clientTimezone(req: Request): string | null;
+export declare function anonId(req: Request): string | null;
+type RequestPart = 'body' | 'query' | 'params';
+/** Validates and replaces `req[part]` with the parsed value; 422 with field errors on failure. */
+export declare function validate(schema: ZodTypeAny, part?: RequestPart): RequestHandler;
+/** Wraps an async handler so rejections reach the error middleware (needed on Express 4). */
+export declare function asyncHandler<Req extends Request = Request>(fn: (req: Req, res: Response, next: NextFunction) => Promise<unknown>): RequestHandler;
+/** Maps AppErrors to their status; everything else becomes a logged 500 with a generic message. */
+export declare function errorHandler(logger?: Logger): ErrorRequestHandler;
+export declare function notFoundHandler(): RequestHandler;
+export {};
+//# sourceMappingURL=middleware.d.ts.map

package/dist/types/express/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../../src/express/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACpG,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAKtC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAGhD,+FAA+F;AAC/F,wBAAgB,qBAAqB,IAAI,cAAc,CAQtD;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAG9D;AAED,+EAA+E;AAC/E,wBAAgB,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAIpD;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAG1D;AAED,wBAAgB,MAAM,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAGlD;AAED,KAAK,WAAW,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE/C,kGAAkG;AAClG,wBAAgB,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,GAAE,WAAoB,GAAG,cAAc,CAWvF;AAED,6FAA6F;AAC7F,wBAAgB,YAAY,CAAC,GAAG,SAAS,OAAO,GAAG,OAAO,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,cAAc,CAIjJ;AAED,mGAAmG;AACnG,wBAAgB,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,mBAAmB,CAqBjE;AAED,wBAAgB,eAAe,IAAI,cAAc,CAIhD"}

package/dist/types/express/security.d.ts

@@ -0,0 +1,9 @@
+import { type CorsOptions } from 'cors';
+import { type HelmetOptions } from 'helmet';
+import type { RequestHandler } from 'express';
+export type { CorsOptions, HelmetOptions };
+/** Standard security headers (helmet). Pass options only to relax a header a service genuinely needs. */
+export declare function securityHeaders(options?: HelmetOptions): RequestHandler;
+/** CORS for browser-facing services. An empty origin list disables CORS (no `Access-Control-*` headers). */
+export declare function corsMiddleware(origins: string[], options?: Omit<CorsOptions, 'origin'>): RequestHandler;
+//# sourceMappingURL=security.d.ts.map

package/dist/types/express/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/express/security.ts"],"names":[],"mappings":"AAAA,OAAa,EAAE,KAAK,WAAW,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAe,EAAE,KAAK,aAAa,EAAE,MAAM,QAAQ,CAAC;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC;AAE3C,yGAAyG;AACzG,wBAAgB,eAAe,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,cAAc,CAEvE;AAED,4GAA4G;AAC5G,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,OAAO,GAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAM,GAAG,cAAc,CAE3G"}

package/dist/types/http/index.d.ts

@@ -0,0 +1,34 @@
+import type { Logger } from '../types/index.js';
+export * from './safe-fetch.js';
+export interface ServiceClientOptions {
+    /** e.g. `http://auth-admin-service:4001` */
+    baseUrl: string;
+    /** Sent as `x-internal-service-secret`. */
+    internalSecret: string;
+    callerService: string;
+    timeoutMs?: number;
+    /** Retries for network errors and 502/503/504 on idempotent methods. */
+    retries?: number;
+    logger?: Logger;
+}
+export interface RequestOptions {
+    query?: Record<string, string | number | boolean | undefined>;
+    body?: unknown;
+    headers?: Record<string, string>;
+    correlationId?: string;
+    timeoutMs?: number;
+}
+export interface ServiceClient {
+    get<T>(path: string, options?: RequestOptions): Promise<T>;
+    post<T>(path: string, options?: RequestOptions): Promise<T>;
+    put<T>(path: string, options?: RequestOptions): Promise<T>;
+    patch<T>(path: string, options?: RequestOptions): Promise<T>;
+    delete<T>(path: string, options?: RequestOptions): Promise<T>;
+}
+/**
+ * Typed client for `/internal/*` calls between services. Unwraps the `{ success, data }`
+ * envelope, maps upstream errors to AppErrors with the same status, and turns network failures
+ * and timeouts into 503s.
+ */
+export declare function createServiceClient(options: ServiceClientOptions): ServiceClient;
+//# sourceMappingURL=index.d.ts.map

package/dist/types/http/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/http/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAe,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE7D,cAAc,iBAAiB,CAAC;AAEhC,MAAM,WAAW,oBAAoB;IACnC,4CAA4C;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,2CAA2C;IAC3C,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3D,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5D,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3D,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7D,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC/D;AAKD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,GAAG,aAAa,CAyDhF"}

package/dist/types/http/safe-fetch.d.ts

@@ -0,0 +1,58 @@
+/** Error codes raised by the safe fetcher. */
+export type SafeFetchErrorCode = 'BLOCKED_ADDRESS' | 'PROTOCOL_NOT_ALLOWED' | 'TOO_MANY_REDIRECTS' | 'TOO_LARGE' | 'TIMEOUT' | 'NETWORK';
+/** A fetch rejected for an SSRF guard, a limit, or a transport failure. */
+export declare class SafeFetchError extends Error {
+    readonly code: SafeFetchErrorCode;
+    constructor(code: SafeFetchErrorCode, message: string, options?: {
+        cause?: unknown;
+    });
+}
+interface ResolvedAddress {
+    address: string;
+    family: number;
+}
+/**
+ * Node `dns.lookup`-shaped callback. The safe fetcher always calls it with `{ all: true }`, so the
+ * result is an array. Tests inject a fake to force a chosen address (including the rebinding case).
+ */
+export type SafeLookup = (hostname: string, options: {
+    all: true;
+    family?: number;
+}, callback: (err: NodeJS.ErrnoException | null, addresses: ResolvedAddress[]) => void) => void;
+export interface SafeFetcherOptions {
+    userAgent: string;
+    maxBytes: number;
+    timeoutMs: number;
+    maxRedirects?: number;
+    allowedProtocols?: string[];
+    /** Override DNS resolution (tests). Defaults to `node:dns` lookup. */
+    lookup?: SafeLookup;
+    /**
+     * IP literals that bypass the private/loopback blocklist. Empty by default; a service may allow a
+     * specific internal host. Also the seam the tests use to reach a loopback test server.
+     */
+    allowedAddresses?: string[];
+}
+export interface SafeFetchRequest {
+    headers?: Record<string, string>;
+    /** Value for the `accept` header. */
+    accept?: string;
+}
+export interface SafeFetchResponse {
+    status: number;
+    headers: Record<string, string | string[] | undefined>;
+    body: Buffer;
+    finalUrl: string;
+    redirects: number;
+}
+export interface SafeFetcher {
+    fetch(url: string, req?: SafeFetchRequest): Promise<SafeFetchResponse>;
+}
+/**
+ * Returns a human-readable reason if `ip` is a disallowed destination (private, loopback,
+ * link-local, CGNAT, multicast, unspecified, IPv4-mapped IPv6, cloud metadata), otherwise `null`.
+ */
+export declare function blockedAddressReason(ip: string): string | null;
+export declare function createSafeFetcher(options: SafeFetcherOptions): SafeFetcher;
+export {};
+//# sourceMappingURL=safe-fetch.d.ts.map

package/dist/types/http/safe-fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-fetch.d.ts","sourceRoot":"","sources":["../../../src/http/safe-fetch.ts"],"names":[],"mappings":"AAIA,8CAA8C;AAC9C,MAAM,MAAM,kBAAkB,GAC1B,iBAAiB,GACjB,sBAAsB,GACtB,oBAAoB,GACpB,WAAW,GACX,SAAS,GACT,SAAS,CAAC;AAEd,2EAA2E;AAC3E,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;gBAEtB,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAKrF;AAED,UAAU,eAAe;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,CACvB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE;IAAE,GAAG,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EACvC,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,cAAc,GAAG,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,KAAK,IAAI,KAChF,IAAI,CAAC;AAEV,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,sEAAsE;IACtE,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,qCAAqC;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACxE;AAWD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK9D;AA6BD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,GAAG,WAAW,CA2H1E"}

package/dist/types/identity/index.d.ts

@@ -0,0 +1,51 @@
+import type { AuthUser } from '../types/index.js';
+/**
+ * Header contract between the gateway and downstream services.
+ *
+ * The gateway strips any client-supplied identity headers, then writes these and signs them with
+ * `x-gateway-auth` = HMAC-SHA256(secret, canonical string). Services verify the signature and
+ * timestamp before trusting anything, so a request that bypasses the gateway on the internal
+ * network cannot forge an identity.
+ */
+export declare const IDENTITY_HEADERS: {
+    readonly USER_ID: "x-user-id";
+    readonly USER_EMAIL: "x-user-email";
+    readonly USER_ROLES: "x-user-roles";
+    readonly USER_PERMISSIONS: "x-user-permissions";
+    readonly USER_SCOPES: "x-user-scopes";
+    readonly USER_ATTRS: "x-user-attrs";
+    readonly SESSION_ID: "x-session-id";
+    readonly TIMESTAMP: "x-gateway-ts";
+    readonly SIGNATURE: "x-gateway-auth";
+};
+export declare const CONTEXT_HEADERS: {
+    readonly CORRELATION_ID: "x-correlation-id";
+    readonly ANON_ID: "x-anon-id";
+    readonly TIMEZONE: "x-timezone";
+    readonly CLIENT_IP: "x-client-ip";
+    readonly INTERNAL_SECRET: "x-internal-service-secret";
+    readonly CALLER_SERVICE: "x-caller-service";
+};
+/** Every header a client must never be allowed to set. */
+export declare const PROTECTED_HEADERS: readonly string[];
+type HeaderBag = Record<string, string | string[] | undefined>;
+/** Gateway side: headers (including signature) that represent `user`. */
+export declare function signIdentityHeaders(user: AuthUser, secret: string, now?: number): Record<string, string>;
+export type IdentityResult = {
+    status: 'anonymous';
+} | {
+    status: 'invalid';
+    reason: string;
+} | {
+    status: 'authenticated';
+    user: AuthUser;
+};
+/** Service side: verifies and decodes the gateway identity headers. */
+export declare function verifyIdentityHeaders(headers: HeaderBag, secret: string, options?: {
+    maxSkewMs?: number;
+    now?: number;
+}): IdentityResult;
+/** Removes every protected header in place (gateway ingress). */
+export declare function stripProtectedHeaders(headers: HeaderBag): void;
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/types/identity/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/identity/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAElD;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;CAUnB,CAAC;AAEX,eAAO,MAAM,eAAe;;;;;;;CAOlB,CAAC;AAEX,0DAA0D;AAC1D,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAAqG,CAAC;AAIrJ,KAAK,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;AAiC/D,yEAAyE;AACzE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,GAAE,MAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAapH;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEhD,uEAAuE;AACvE,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,cAAc,CA6B5I;AAED,iEAAiE;AACjE,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,SAAS,GAAG,IAAI,CAE9D"}

package/dist/types/index.d.ts

@@ -0,0 +1,10 @@
+export * from './types/index.js';
+export * from './common/index.js';
+export * from './identity/index.js';
+export * from './access/index.js';
+export * from './validation/index.js';
+export * from './logging/index.js';
+export * from './config/index.js';
+export * from './contracts/index.js';
+export * from './alerting/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/types/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAGA,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC"}

package/dist/types/knex/index.d.ts

@@ -0,0 +1,25 @@
+import type { Knex } from 'knex';
+/**
+ * Migration helpers (usable from CommonJS `.cjs` migrations via `require('@heavybit/shared-lib/knex')`).
+ * They keep ID, timestamp and audit column definitions identical across services.
+ */
+/** `id CHAR(26)` primary key for ULIDs. */
+export declare function ulidPrimary(table: Knex.CreateTableBuilder, name?: string): void;
+/** `CHAR(26)` column referencing another ULID (FK constraints only within the same database). */
+export declare function ulidColumn(table: Knex.CreateTableBuilder | Knex.AlterTableBuilder, name: string): Knex.ColumnBuilder;
+/** `created_at` / `updated_at` as `DATETIME(3)` in UTC, maintained by MySQL. */
+export declare function timestamps(table: Knex.CreateTableBuilder, knex: Knex): void;
+/** `created_by` / `updated_by` actor columns (null for system operations). */
+export declare function actorColumns(table: Knex.CreateTableBuilder): void;
+/** Nullable `DATETIME(3)` column. */
+export declare function datetime(table: Knex.CreateTableBuilder | Knex.AlterTableBuilder, name: string): Knex.ColumnBuilder;
+/**
+ * Creates `<parent>_audits`: every parent column (defined again by `columns`) plus `parent_id`
+ * and `action`. Audit rows are append-only history, so no unique constraints are copied.
+ */
+export declare function createAuditTable(knex: Knex, parentTable: string, columns: (table: Knex.CreateTableBuilder) => void): Promise<void>;
+/** Transactional outbox table used by `OutboxRelay`. */
+export declare function createOutboxTable(knex: Knex, name?: string): Promise<void>;
+/** Standard table options: InnoDB, utf8mb4. Call inside `createTable`. */
+export declare function utf8mb4(table: Knex.CreateTableBuilder): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/types/knex/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/knex/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAEjC;;;GAGG;AAEH,2CAA2C;AAC3C,wBAAgB,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,kBAAkB,EAAE,IAAI,SAAO,GAAG,IAAI,CAE7E;AAED,iGAAiG;AACjG,wBAAgB,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,aAAa,CAEpH;AAED,gFAAgF;AAChF,wBAAgB,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAG3E;AAED,8EAA8E;AAC9E,wBAAgB,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAGjE;AAED,qCAAqC;AACrC,wBAAgB,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,aAAa,CAElH;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,kBAAkB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAYxI;AAED,wDAAwD;AACxD,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,SAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAYxF;AAED,0EAA0E;AAC1E,wBAAgB,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAI5D"}