@heavybit/shared-lib 0.0.0-stage → 1.2.0

package/dist/cjs/express/security.js

@@ -0,0 +1,18 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.securityHeaders = securityHeaders;
+exports.corsMiddleware = corsMiddleware;
+const cors_1 = __importDefault(require("cors"));
+const helmet_1 = __importDefault(require("helmet"));
+/** Standard security headers (helmet). Pass options only to relax a header a service genuinely needs. */
+function securityHeaders(options) {
+    return (0, helmet_1.default)(options);
+}
+/** CORS for browser-facing services. An empty origin list disables CORS (no `Access-Control-*` headers). */
+function corsMiddleware(origins, options = {}) {
+    return (0, cors_1.default)({ ...options, origin: origins.length ? origins : false });
+}
+//# sourceMappingURL=security.js.map

package/dist/cjs/express/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../../src/express/security.ts"],"names":[],"mappings":";;;;;AAOA,0CAEC;AAGD,wCAEC;AAdD,gDAA8C;AAC9C,oDAAoD;AAKpD,yGAAyG;AACzG,SAAgB,eAAe,CAAC,OAAuB;IACrD,OAAO,IAAA,gBAAM,EAAC,OAAO,CAA8B,CAAC;AACtD,CAAC;AAED,4GAA4G;AAC5G,SAAgB,cAAc,CAAC,OAAiB,EAAE,UAAuC,EAAE;IACzF,OAAO,IAAA,cAAI,EAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,CAA8B,CAAC;AACrG,CAAC"}

package/dist/cjs/http/index.js

@@ -0,0 +1,90 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createServiceClient = createServiceClient;
+const errors_js_1 = require("../common/errors.js");
+const async_js_1 = require("../common/async.js");
+const index_js_1 = require("../identity/index.js");
+const index_js_2 = require("../logging/index.js");
+__exportStar(require("./safe-fetch.js"), exports);
+const RETRYABLE_STATUS = new Set([502, 503, 504]);
+const IDEMPOTENT = new Set(['GET', 'PUT', 'DELETE']);
+/**
+ * Typed client for `/internal/*` calls between services. Unwraps the `{ success, data }`
+ * envelope, maps upstream errors to AppErrors with the same status, and turns network failures
+ * and timeouts into 503s.
+ */
+function createServiceClient(options) {
+    const logger = options.logger ?? index_js_2.silentLogger;
+    const base = options.baseUrl.replace(/\/+$/, '');
+    async function request(method, path, opts = {}) {
+        const url = new URL(base + path);
+        for (const [key, value] of Object.entries(opts.query ?? {}))
+            if (value !== undefined)
+                url.searchParams.set(key, String(value));
+        const retries = IDEMPOTENT.has(method) ? options.retries ?? 2 : 0;
+        for (let attempt = 0;; attempt += 1) {
+            const controller = new AbortController();
+            const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? options.timeoutMs ?? 5000);
+            try {
+                const response = await fetch(url, {
+                    method,
+                    signal: controller.signal,
+                    headers: {
+                        accept: 'application/json',
+                        ...(opts.body !== undefined ? { 'content-type': 'application/json' } : {}),
+                        [index_js_1.CONTEXT_HEADERS.INTERNAL_SECRET]: options.internalSecret,
+                        [index_js_1.CONTEXT_HEADERS.CALLER_SERVICE]: options.callerService,
+                        ...(opts.correlationId ? { [index_js_1.CONTEXT_HEADERS.CORRELATION_ID]: opts.correlationId } : {}),
+                        ...opts.headers,
+                    },
+                    body: opts.body !== undefined ? JSON.stringify(opts.body) : undefined,
+                });
+                if (RETRYABLE_STATUS.has(response.status) && attempt < retries) {
+                    await (0, async_js_1.sleep)(200 * 2 ** attempt);
+                    continue;
+                }
+                const text = await response.text();
+                const payload = text ? JSON.parse(text) : { success: response.ok, message: '' };
+                if (!response.ok) {
+                    throw new errors_js_1.AppError(response.status, payload.message || `Upstream error ${response.status}`, { code: payload.code, errors: payload.errors });
+                }
+                return (payload.data ?? payload);
+            }
+            catch (error) {
+                if (error instanceof errors_js_1.AppError)
+                    throw error;
+                if (attempt < retries) {
+                    await (0, async_js_1.sleep)(200 * 2 ** attempt);
+                    continue;
+                }
+                logger.warn('Internal call failed', { method, url: url.pathname, error: error.message });
+                throw new errors_js_1.ServiceUnavailableError('Upstream service unavailable', { cause: error });
+            }
+            finally {
+                clearTimeout(timer);
+            }
+        }
+    }
+    return {
+        get: (path, opts) => request('GET', path, opts),
+        post: (path, opts) => request('POST', path, opts),
+        put: (path, opts) => request('PUT', path, opts),
+        patch: (path, opts) => request('PATCH', path, opts),
+        delete: (path, opts) => request('DELETE', path, opts),
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/cjs/http/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/http/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AA4CA,kDAyDC;AArGD,mDAAwE;AACxE,iDAA2C;AAC3C,mDAAuD;AACvD,kDAAmD;AAGnD,kDAAgC;AA8BhC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAClD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;AAErD;;;;GAIG;AACH,SAAgB,mBAAmB,CAAC,OAA6B;IAC/D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,uBAAY,CAAC;IAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAEjD,KAAK,UAAU,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,OAAuB,EAAE;QAC/E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QACjC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAAE,IAAI,KAAK,KAAK,SAAS;gBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/H,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAElE,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,IAAI,CAAC,EAAE,CAAC;YACrC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC;YAChG,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;oBAChC,MAAM;oBACN,MAAM,EAAE,UAAU,CAAC,MAAM;oBACzB,OAAO,EAAE;wBACP,MAAM,EAAE,kBAAkB;wBAC1B,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC1E,CAAC,0BAAe,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC,cAAc;wBACzD,CAAC,0BAAe,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC,aAAa;wBACvD,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,0BAAe,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACvF,GAAG,IAAI,CAAC,OAAO;qBAChB;oBACD,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;iBACtE,CAAC,CAAC;gBACH,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,GAAG,OAAO,EAAE,CAAC;oBAC/D,MAAM,IAAA,gBAAK,EAAC,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC;oBAChC,SAAS;gBACX,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACnC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAoB,CAAC,CAAC,CAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,EAAqB,CAAC;gBACxH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,MAAM,IAAI,oBAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,IAAI,kBAAkB,QAAQ,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC9I,CAAC;gBACD,OAAO,CAAC,OAAO,CAAC,IAAI,IAAK,OAAmB,CAAM,CAAC;YACrD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,oBAAQ;oBAAE,MAAM,KAAK,CAAC;gBAC3C,IAAI,OAAO,GAAG,OAAO,EAAE,CAAC;oBACtB,MAAM,IAAA,gBAAK,EAAC,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC;oBAChC,SAAS;gBACX,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;gBACpG,MAAM,IAAI,mCAAuB,CAAC,8BAA8B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACtF,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC;QAC/C,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC;QACjD,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC;QAC/C,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;QACnD,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC;KACtD,CAAC;AACJ,CAAC"}

package/dist/cjs/http/safe-fetch.js

@@ -0,0 +1,199 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SafeFetchError = void 0;
+exports.blockedAddressReason = blockedAddressReason;
+exports.createSafeFetcher = createSafeFetcher;
+const node_dns_1 = require("node:dns");
+const node_net_1 = require("node:net");
+const undici_1 = require("undici");
+/** A fetch rejected for an SSRF guard, a limit, or a transport failure. */
+class SafeFetchError extends Error {
+    code;
+    constructor(code, message, options) {
+        super(message, options);
+        this.name = 'SafeFetchError';
+        this.code = code;
+    }
+}
+exports.SafeFetchError = SafeFetchError;
+const DEFAULT_PROTOCOLS = ['https:', 'http:'];
+const defaultLookup = (hostname, options, callback) => {
+    (0, node_dns_1.lookup)(hostname, { all: true, family: options.family }, (err, addresses) => {
+        if (err)
+            return callback(err, []);
+        callback(null, addresses.map((a) => ({ address: a.address, family: a.family })));
+    });
+};
+/**
+ * Returns a human-readable reason if `ip` is a disallowed destination (private, loopback,
+ * link-local, CGNAT, multicast, unspecified, IPv4-mapped IPv6, cloud metadata), otherwise `null`.
+ */
+function blockedAddressReason(ip) {
+    const family = (0, node_net_1.isIP)(ip);
+    if (family === 4)
+        return blockedIpv4Reason(ip);
+    if (family === 6)
+        return blockedIpv6Reason(ip.toLowerCase());
+    return 'not an IP address';
+}
+function blockedIpv4Reason(ip) {
+    const parts = ip.split('.').map((p) => Number(p));
+    if (parts.length !== 4 || parts.some((p) => Number.isNaN(p) || p < 0 || p > 255))
+        return 'malformed IPv4';
+    const [a, b] = parts;
+    if (a === 0)
+        return 'unspecified';
+    if (a === 10)
+        return 'private (10.0.0.0/8)';
+    if (a === 127)
+        return 'loopback';
+    if (a === 100 && b >= 64 && b <= 127)
+        return 'CGNAT (100.64.0.0/10)';
+    if (a === 169 && b === 254)
+        return 'link-local (incl. cloud metadata)';
+    if (a === 172 && b >= 16 && b <= 31)
+        return 'private (172.16.0.0/12)';
+    if (a === 192 && b === 168)
+        return 'private (192.168.0.0/16)';
+    if (a >= 224)
+        return 'multicast or reserved';
+    return null;
+}
+function blockedIpv6Reason(ip) {
+    if (ip === '::' || ip === '::0')
+        return 'unspecified';
+    if (ip === '::1')
+        return 'loopback';
+    if (ip.startsWith('fe80') || ip.startsWith('fe9') || ip.startsWith('fea') || ip.startsWith('feb'))
+        return 'link-local';
+    if (ip.startsWith('fc') || ip.startsWith('fd'))
+        return 'unique-local (incl. fd00:ec2::254 metadata)';
+    if (ip.startsWith('ff'))
+        return 'multicast';
+    // IPv4-mapped (::ffff:a.b.c.d) and IPv4-compatible (::a.b.c.d) — unwrap and re-check.
+    const mapped = ip.match(/::(?:ffff:)?(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
+    if (mapped)
+        return `IPv4-mapped IPv6 (${blockedIpv4Reason(mapped[1]) ?? 'maps to public IPv4'})`;
+    return null;
+}
+function createSafeFetcher(options) {
+    const { userAgent, maxBytes, timeoutMs, maxRedirects = 5, allowedProtocols = DEFAULT_PROTOCOLS, lookup = defaultLookup, allowedAddresses = [], } = options;
+    const allowSet = new Set(allowedAddresses);
+    const isBlocked = (ip) => !allowSet.has(ip) && blockedAddressReason(ip) !== null;
+    function resolveAndCheck(hostname) {
+        // A literal IP resolves to itself; still subject to the blocklist.
+        return new Promise((resolve, reject) => {
+            lookup(hostname, { all: true }, (err, addresses) => {
+                if (err)
+                    return reject(new SafeFetchError('NETWORK', `DNS lookup failed for ${hostname}`, { cause: err }));
+                if (!addresses.length)
+                    return reject(new SafeFetchError('NETWORK', `No addresses for ${hostname}`));
+                for (const a of addresses) {
+                    if (isBlocked(a.address))
+                        return reject(new SafeFetchError('BLOCKED_ADDRESS', `Blocked address ${a.address} for ${hostname}`));
+                }
+                resolve();
+            });
+        });
+    }
+    // Re-validates at connect time so a DNS rebind between the pre-check and the socket is blocked.
+    // `net.connect` calls this with `{ all: true }` (and expects an array) on modern Node; support both.
+    const connectLookup = (hostname, opts, callback) => {
+        lookup(hostname, { all: true }, (err, addresses) => {
+            if (err)
+                return callback(err, undefined, 0);
+            const blocked = addresses.find((a) => isBlocked(a.address));
+            if (blocked) {
+                return callback(new SafeFetchError('BLOCKED_ADDRESS', `Blocked address ${blocked.address} for ${hostname}`), undefined, 0);
+            }
+            if (opts?.all)
+                return callback(null, addresses);
+            const first = addresses[0];
+            callback(null, first.address, first.family);
+        });
+    };
+    const agent = new undici_1.Agent({ connect: { lookup: connectLookup } });
+    async function fetchOnce(url, headers, signal) {
+        if (!allowedProtocols.includes(url.protocol)) {
+            throw new SafeFetchError('PROTOCOL_NOT_ALLOWED', `Protocol ${url.protocol} not allowed`);
+        }
+        await resolveAndCheck(url.hostname);
+        let res;
+        try {
+            // `request` does not follow redirects; we handle each 3xx hop manually and re-validate it.
+            res = await (0, undici_1.request)(url, {
+                method: 'GET',
+                dispatcher: agent,
+                headers,
+                signal,
+            });
+        }
+        catch (error) {
+            if (error instanceof SafeFetchError)
+                throw error;
+            // undici wraps a thrown connect-lookup error as the cause.
+            const cause = error.cause;
+            if (cause instanceof SafeFetchError)
+                throw cause;
+            if (signal.aborted)
+                throw new SafeFetchError('TIMEOUT', `Request to ${url.href} timed out`, { cause: error });
+            throw new SafeFetchError('NETWORK', `Request to ${url.href} failed`, { cause: error });
+        }
+        const chunks = [];
+        let total = 0;
+        try {
+            for await (const chunk of res.body) {
+                const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+                total += buf.length;
+                if (total > maxBytes) {
+                    res.body.destroy();
+                    throw new SafeFetchError('TOO_LARGE', `Response from ${url.href} exceeds ${maxBytes} bytes`);
+                }
+                chunks.push(buf);
+            }
+        }
+        catch (error) {
+            if (error instanceof SafeFetchError)
+                throw error;
+            if (signal.aborted)
+                throw new SafeFetchError('TIMEOUT', `Request to ${url.href} timed out`, { cause: error });
+            throw new SafeFetchError('NETWORK', `Reading response from ${url.href} failed`, { cause: error });
+        }
+        const location = typeof res.headers.location === 'string' ? res.headers.location : undefined;
+        return { status: res.statusCode, headers: res.headers, body: Buffer.concat(chunks), finalUrl: url.href, redirects: 0, location };
+    }
+    return {
+        async fetch(rawUrl, req = {}) {
+            const controller = new AbortController();
+            const timer = setTimeout(() => controller.abort(), timeoutMs);
+            try {
+                let current = new URL(rawUrl);
+                let redirects = 0;
+                for (;;) {
+                    const headers = {
+                        'user-agent': userAgent,
+                        accept: req.accept ?? '*/*',
+                        ...req.headers,
+                    };
+                    // Never forward cookies or credentials.
+                    delete headers.cookie;
+                    delete headers.authorization;
+                    const result = await fetchOnce(current, headers, controller.signal);
+                    const isRedirect = result.status >= 300 && result.status < 400 && result.location;
+                    if (!isRedirect) {
+                        return { status: result.status, headers: result.headers, body: result.body, finalUrl: current.href, redirects };
+                    }
+                    redirects += 1;
+                    if (redirects > maxRedirects) {
+                        throw new SafeFetchError('TOO_MANY_REDIRECTS', `More than ${maxRedirects} redirects from ${rawUrl}`);
+                    }
+                    current = new URL(result.location, current);
+                }
+            }
+            finally {
+                clearTimeout(timer);
+            }
+        },
+    };
+}
+//# sourceMappingURL=safe-fetch.js.map

package/dist/cjs/http/safe-fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-fetch.js","sourceRoot":"","sources":["../../../src/http/safe-fetch.ts"],"names":[],"mappings":";;;AAqFA,oDAKC;AA6BD,8CA2HC;AAlPD,uCAA+C;AAC/C,uCAAgC;AAChC,mCAAwC;AAWxC,2EAA2E;AAC3E,MAAa,cAAe,SAAQ,KAAK;IAC9B,IAAI,CAAqB;IAElC,YAAY,IAAwB,EAAE,OAAe,EAAE,OAA6B;QAClF,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AARD,wCAQC;AAkDD,MAAM,iBAAiB,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAE9C,MAAM,aAAa,GAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;IAChE,IAAA,iBAAS,EAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE;QAC5E,IAAI,GAAG;YAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAClC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,EAAU;IAC7C,MAAM,MAAM,GAAG,IAAA,eAAI,EAAC,EAAE,CAAC,CAAC;IACxB,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAC/C,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,iBAAiB,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7D,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,SAAS,iBAAiB,CAAC,EAAU;IACnC,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;QAAE,OAAO,gBAAgB,CAAC;IAC1G,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;IACrB,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC;IAClC,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,sBAAsB,CAAC;IAC5C,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,UAAU,CAAC;IACjC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,uBAAuB,CAAC;IACrE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,mCAAmC,CAAC;IACvE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,yBAAyB,CAAC;IACtE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,0BAA0B,CAAC;IAC9D,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,uBAAuB,CAAC;IAC7C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,EAAU;IACnC,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,KAAK;QAAE,OAAO,aAAa,CAAC;IACtD,IAAI,EAAE,KAAK,KAAK;QAAE,OAAO,UAAU,CAAC;IACpC,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IACvH,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,6CAA6C,CAAC;IACrG,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,WAAW,CAAC;IAC5C,sFAAsF;IACtF,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAC7E,IAAI,MAAM;QAAE,OAAO,qBAAqB,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,qBAAqB,GAAG,CAAC;IACjG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,iBAAiB,CAAC,OAA2B;IAC3D,MAAM,EACJ,SAAS,EACT,QAAQ,EACR,SAAS,EACT,YAAY,GAAG,CAAC,EAChB,gBAAgB,GAAG,iBAAiB,EACpC,MAAM,GAAG,aAAa,EACtB,gBAAgB,GAAG,EAAE,GACtB,GAAG,OAAO,CAAC;IACZ,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAE3C,MAAM,SAAS,GAAG,CAAC,EAAU,EAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,oBAAoB,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC;IAElG,SAAS,eAAe,CAAC,QAAgB;QACvC,mEAAmE;QACnE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE;gBACjD,IAAI,GAAG;oBAAE,OAAO,MAAM,CAAC,IAAI,cAAc,CAAC,SAAS,EAAE,yBAAyB,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;gBAC3G,IAAI,CAAC,SAAS,CAAC,MAAM;oBAAE,OAAO,MAAM,CAAC,IAAI,cAAc,CAAC,SAAS,EAAE,oBAAoB,QAAQ,EAAE,CAAC,CAAC,CAAC;gBACpG,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;oBAC1B,IAAI,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;wBAAE,OAAO,MAAM,CAAC,IAAI,cAAc,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC,OAAO,QAAQ,QAAQ,EAAE,CAAC,CAAC,CAAC;gBACjI,CAAC;gBACD,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,gGAAgG;IAChG,qGAAqG;IACrG,MAAM,aAAa,GAAG,CAAC,QAAgB,EAAE,IAAuB,EAAE,QAAwF,EAAQ,EAAE;QAClK,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE;YACjD,IAAI,GAAG;gBAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;YAC5C,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YAC5D,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,QAAQ,CAAC,IAAI,cAAc,CAAC,iBAAiB,EAAE,mBAAmB,OAAO,CAAC,OAAO,QAAQ,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;YAC7H,CAAC;YACD,IAAI,IAAI,EAAE,GAAG;gBAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAChD,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YAC3B,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,cAAK,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,EAA8B,EAAE,CAAC,CAAC;IAE5F,KAAK,UAAU,SAAS,CAAC,GAAQ,EAAE,OAA+B,EAAE,MAAmB;QACrF,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,cAAc,CAAC,sBAAsB,EAAE,YAAY,GAAG,CAAC,QAAQ,cAAc,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEpC,IAAI,GAAG,CAAC;QACR,IAAI,CAAC;YACH,2FAA2F;YAC3F,GAAG,GAAG,MAAM,IAAA,gBAAO,EAAC,GAAG,EAAE;gBACvB,MAAM,EAAE,KAAK;gBACb,UAAU,EAAE,KAAK;gBACjB,OAAO;gBACP,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,cAAc;gBAAE,MAAM,KAAK,CAAC;YACjD,2DAA2D;YAC3D,MAAM,KAAK,GAAI,KAA6B,CAAC,KAAK,CAAC;YACnD,IAAI,KAAK,YAAY,cAAc;gBAAE,MAAM,KAAK,CAAC;YACjD,IAAI,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,cAAc,GAAG,CAAC,IAAI,YAAY,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9G,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,cAAc,GAAG,CAAC,IAAI,SAAS,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;gBACnC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAChE,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC;gBACpB,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;oBACrB,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;oBACnB,MAAM,IAAI,cAAc,CAAC,WAAW,EAAE,iBAAiB,GAAG,CAAC,IAAI,YAAY,QAAQ,QAAQ,CAAC,CAAC;gBAC/F,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,cAAc;gBAAE,MAAM,KAAK,CAAC;YACjD,IAAI,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,cAAc,GAAG,CAAC,IAAI,YAAY,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9G,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,yBAAyB,GAAG,CAAC,IAAI,SAAS,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACpG,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7F,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC;IACnI,CAAC;IAED,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,GAAG,EAAE;YAC1B,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;YAC9D,IAAI,CAAC;gBACH,IAAI,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC9B,IAAI,SAAS,GAAG,CAAC,CAAC;gBAClB,SAAS,CAAC;oBACR,MAAM,OAAO,GAA2B;wBACtC,YAAY,EAAE,SAAS;wBACvB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK;wBAC3B,GAAG,GAAG,CAAC,OAAO;qBACf,CAAC;oBACF,wCAAwC;oBACxC,OAAO,OAAO,CAAC,MAAM,CAAC;oBACtB,OAAO,OAAO,CAAC,aAAa,CAAC;oBAE7B,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;oBACpE,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC;oBAClF,IAAI,CAAC,UAAU,EAAE,CAAC;wBAChB,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;oBAClH,CAAC;oBACD,SAAS,IAAI,CAAC,CAAC;oBACf,IAAI,SAAS,GAAG,YAAY,EAAE,CAAC;wBAC7B,MAAM,IAAI,cAAc,CAAC,oBAAoB,EAAE,aAAa,YAAY,mBAAmB,MAAM,EAAE,CAAC,CAAC;oBACvG,CAAC;oBACD,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAkB,EAAE,OAAO,CAAC,CAAC;gBACxD,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/cjs/identity/index.js

@@ -0,0 +1,117 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PROTECTED_HEADERS = exports.CONTEXT_HEADERS = exports.IDENTITY_HEADERS = void 0;
+exports.signIdentityHeaders = signIdentityHeaders;
+exports.verifyIdentityHeaders = verifyIdentityHeaders;
+exports.stripProtectedHeaders = stripProtectedHeaders;
+const crypto_js_1 = require("../common/crypto.js");
+/**
+ * Header contract between the gateway and downstream services.
+ *
+ * The gateway strips any client-supplied identity headers, then writes these and signs them with
+ * `x-gateway-auth` = HMAC-SHA256(secret, canonical string). Services verify the signature and
+ * timestamp before trusting anything, so a request that bypasses the gateway on the internal
+ * network cannot forge an identity.
+ */
+exports.IDENTITY_HEADERS = {
+    USER_ID: 'x-user-id',
+    USER_EMAIL: 'x-user-email',
+    USER_ROLES: 'x-user-roles',
+    USER_PERMISSIONS: 'x-user-permissions',
+    USER_SCOPES: 'x-user-scopes',
+    USER_ATTRS: 'x-user-attrs',
+    SESSION_ID: 'x-session-id',
+    TIMESTAMP: 'x-gateway-ts',
+    SIGNATURE: 'x-gateway-auth',
+};
+exports.CONTEXT_HEADERS = {
+    CORRELATION_ID: 'x-correlation-id',
+    ANON_ID: 'x-anon-id',
+    TIMEZONE: 'x-timezone',
+    CLIENT_IP: 'x-client-ip',
+    INTERNAL_SECRET: 'x-internal-service-secret',
+    CALLER_SERVICE: 'x-caller-service',
+};
+/** Every header a client must never be allowed to set. */
+exports.PROTECTED_HEADERS = [...Object.values(exports.IDENTITY_HEADERS), exports.CONTEXT_HEADERS.INTERNAL_SECRET, exports.CONTEXT_HEADERS.CLIENT_IP];
+const DEFAULT_MAX_SKEW_MS = 5 * 60_000;
+function header(headers, name) {
+    const value = headers[name];
+    return Array.isArray(value) ? value[0] : value;
+}
+function canonical(values) {
+    return [
+        values[exports.IDENTITY_HEADERS.TIMESTAMP],
+        values[exports.IDENTITY_HEADERS.USER_ID],
+        values[exports.IDENTITY_HEADERS.USER_EMAIL],
+        values[exports.IDENTITY_HEADERS.USER_ROLES],
+        values[exports.IDENTITY_HEADERS.USER_PERMISSIONS],
+        values[exports.IDENTITY_HEADERS.USER_SCOPES],
+        values[exports.IDENTITY_HEADERS.USER_ATTRS],
+        values[exports.IDENTITY_HEADERS.SESSION_ID],
+    ].join('\n');
+}
+const encodeList = (items) => items.join(',');
+const decodeList = (value) => (value ? value.split(',').map((s) => s.trim()).filter(Boolean) : []);
+const encodeJson = (value) => Buffer.from(JSON.stringify(value ?? {})).toString('base64url');
+function decodeJson(value, fallback) {
+    if (!value)
+        return fallback;
+    try {
+        return JSON.parse(Buffer.from(value, 'base64url').toString('utf8'));
+    }
+    catch {
+        return fallback;
+    }
+}
+/** Gateway side: headers (including signature) that represent `user`. */
+function signIdentityHeaders(user, secret, now = Date.now()) {
+    const values = {
+        [exports.IDENTITY_HEADERS.TIMESTAMP]: String(now),
+        [exports.IDENTITY_HEADERS.USER_ID]: user.id,
+        [exports.IDENTITY_HEADERS.USER_EMAIL]: user.email ?? '',
+        [exports.IDENTITY_HEADERS.USER_ROLES]: encodeList(user.roles),
+        [exports.IDENTITY_HEADERS.USER_PERMISSIONS]: encodeList(user.permissions),
+        [exports.IDENTITY_HEADERS.USER_SCOPES]: encodeJson(user.scopes),
+        [exports.IDENTITY_HEADERS.USER_ATTRS]: encodeJson(user.attrs),
+        [exports.IDENTITY_HEADERS.SESSION_ID]: user.sessionId ?? '',
+    };
+    values[exports.IDENTITY_HEADERS.SIGNATURE] = (0, crypto_js_1.hmacSha256)(secret, canonical(values));
+    return values;
+}
+/** Service side: verifies and decodes the gateway identity headers. */
+function verifyIdentityHeaders(headers, secret, options = {}) {
+    const userId = header(headers, exports.IDENTITY_HEADERS.USER_ID);
+    if (!userId)
+        return { status: 'anonymous' };
+    const values = {};
+    for (const name of Object.values(exports.IDENTITY_HEADERS))
+        values[name] = header(headers, name) ?? '';
+    const signature = values[exports.IDENTITY_HEADERS.SIGNATURE];
+    if (!signature || !(0, crypto_js_1.safeEqual)(signature, (0, crypto_js_1.hmacSha256)(secret, canonical(values)))) {
+        return { status: 'invalid', reason: 'bad-signature' };
+    }
+    const ts = Number(values[exports.IDENTITY_HEADERS.TIMESTAMP]);
+    const now = options.now ?? Date.now();
+    if (!Number.isFinite(ts) || Math.abs(now - ts) > (options.maxSkewMs ?? DEFAULT_MAX_SKEW_MS)) {
+        return { status: 'invalid', reason: 'stale-signature' };
+    }
+    return {
+        status: 'authenticated',
+        user: {
+            id: userId,
+            email: values[exports.IDENTITY_HEADERS.USER_EMAIL] ?? '',
+            roles: decodeList(values[exports.IDENTITY_HEADERS.USER_ROLES]),
+            permissions: decodeList(values[exports.IDENTITY_HEADERS.USER_PERMISSIONS]),
+            scopes: decodeJson(values[exports.IDENTITY_HEADERS.USER_SCOPES], {}),
+            attrs: decodeJson(values[exports.IDENTITY_HEADERS.USER_ATTRS], {}),
+            sessionId: values[exports.IDENTITY_HEADERS.SESSION_ID] || undefined,
+        },
+    };
+}
+/** Removes every protected header in place (gateway ingress). */
+function stripProtectedHeaders(headers) {
+    for (const name of exports.PROTECTED_HEADERS)
+        delete headers[name];
+}
+//# sourceMappingURL=index.js.map

package/dist/cjs/identity/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/identity/index.ts"],"names":[],"mappings":";;;AAuEA,kDAaC;AAQD,sDA6BC;AAGD,sDAEC;AA9HD,mDAA4D;AAG5D;;;;;;;GAOG;AACU,QAAA,gBAAgB,GAAG;IAC9B,OAAO,EAAE,WAAW;IACpB,UAAU,EAAE,cAAc;IAC1B,UAAU,EAAE,cAAc;IAC1B,gBAAgB,EAAE,oBAAoB;IACtC,WAAW,EAAE,eAAe;IAC5B,UAAU,EAAE,cAAc;IAC1B,UAAU,EAAE,cAAc;IAC1B,SAAS,EAAE,cAAc;IACzB,SAAS,EAAE,gBAAgB;CACnB,CAAC;AAEE,QAAA,eAAe,GAAG;IAC7B,cAAc,EAAE,kBAAkB;IAClC,OAAO,EAAE,WAAW;IACpB,QAAQ,EAAE,YAAY;IACtB,SAAS,EAAE,aAAa;IACxB,eAAe,EAAE,2BAA2B;IAC5C,cAAc,EAAE,kBAAkB;CAC1B,CAAC;AAEX,0DAA0D;AAC7C,QAAA,iBAAiB,GAAsB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,wBAAgB,CAAC,EAAE,uBAAe,CAAC,eAAe,EAAE,uBAAe,CAAC,SAAS,CAAC,CAAC;AAErJ,MAAM,mBAAmB,GAAG,CAAC,GAAG,MAAM,CAAC;AAIvC,SAAS,MAAM,CAAC,OAAkB,EAAE,IAAY;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC;AAED,SAAS,SAAS,CAAC,MAA8B;IAC/C,OAAO;QACL,MAAM,CAAC,wBAAgB,CAAC,SAAS,CAAC;QAClC,MAAM,CAAC,wBAAgB,CAAC,OAAO,CAAC;QAChC,MAAM,CAAC,wBAAgB,CAAC,UAAU,CAAC;QACnC,MAAM,CAAC,wBAAgB,CAAC,UAAU,CAAC;QACnC,MAAM,CAAC,wBAAgB,CAAC,gBAAgB,CAAC;QACzC,MAAM,CAAC,wBAAgB,CAAC,WAAW,CAAC;QACpC,MAAM,CAAC,wBAAgB,CAAC,UAAU,CAAC;QACnC,MAAM,CAAC,wBAAgB,CAAC,UAAU,CAAC;KACpC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,KAAe,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACxD,MAAM,UAAU,GAAG,CAAC,KAAyB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACvH,MAAM,UAAU,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAEtG,SAAS,UAAU,CAAI,KAAyB,EAAE,QAAW;IAC3D,IAAI,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAM,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,SAAgB,mBAAmB,CAAC,IAAc,EAAE,MAAc,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IAC1F,MAAM,MAAM,GAA2B;QACrC,CAAC,wBAAgB,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC;QACzC,CAAC,wBAAgB,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE;QACnC,CAAC,wBAAgB,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;QAC/C,CAAC,wBAAgB,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QACrD,CAAC,wBAAgB,CAAC,gBAAgB,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;QACjE,CAAC,wBAAgB,CAAC,WAAW,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;QACvD,CAAC,wBAAgB,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QACrD,CAAC,wBAAgB,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,SAAS,IAAI,EAAE;KACpD,CAAC;IACF,MAAM,CAAC,wBAAgB,CAAC,SAAS,CAAC,GAAG,IAAA,sBAAU,EAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3E,OAAO,MAAM,CAAC;AAChB,CAAC;AAOD,uEAAuE;AACvE,SAAgB,qBAAqB,CAAC,OAAkB,EAAE,MAAc,EAAE,UAAgD,EAAE;IAC1H,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,EAAE,wBAAgB,CAAC,OAAO,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAE5C,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,wBAAgB,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IAE/F,MAAM,SAAS,GAAG,MAAM,CAAC,wBAAgB,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,CAAC,SAAS,IAAI,CAAC,IAAA,qBAAS,EAAC,SAAS,EAAE,IAAA,sBAAU,EAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACxD,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,wBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,mBAAmB,CAAC,EAAE,CAAC;QAC5F,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC1D,CAAC;IAED,OAAO;QACL,MAAM,EAAE,eAAe;QACvB,IAAI,EAAE;YACJ,EAAE,EAAE,MAAM;YACV,KAAK,EAAE,MAAM,CAAC,wBAAgB,CAAC,UAAU,CAAC,IAAI,EAAE;YAChD,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,wBAAgB,CAAC,UAAU,CAAC,CAAC;YACtD,WAAW,EAAE,UAAU,CAAC,MAAM,CAAC,wBAAgB,CAAC,gBAAgB,CAAC,CAAC;YAClE,MAAM,EAAE,UAAU,CAA2B,MAAM,CAAC,wBAAgB,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;YACtF,KAAK,EAAE,UAAU,CAA0B,MAAM,CAAC,wBAAgB,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACnF,SAAS,EAAE,MAAM,CAAC,wBAAgB,CAAC,UAAU,CAAC,IAAI,SAAS;SAC5D;KACF,CAAC;AACJ,CAAC;AAED,iEAAiE;AACjE,SAAgB,qBAAqB,CAAC,OAAkB;IACtD,KAAK,MAAM,IAAI,IAAI,yBAAiB;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;AAC7D,CAAC"}

package/dist/cjs/index.js

@@ -0,0 +1,29 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// Root entry: dependency-light building blocks usable from any Node service.
+// Modules that need optional peers (express, ioredis, knex, socket.io, rate-limiter-flexible)
+// live behind subpaths: `@heavybit/shared-lib/express`, `/cache`, `/messaging`, …
+__exportStar(require("./types/index.js"), exports);
+__exportStar(require("./common/index.js"), exports);
+__exportStar(require("./identity/index.js"), exports);
+__exportStar(require("./access/index.js"), exports);
+__exportStar(require("./validation/index.js"), exports);
+__exportStar(require("./logging/index.js"), exports);
+__exportStar(require("./config/index.js"), exports);
+__exportStar(require("./contracts/index.js"), exports);
+__exportStar(require("./alerting/index.js"), exports);
+//# sourceMappingURL=index.js.map

package/dist/cjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,6EAA6E;AAC7E,8FAA8F;AAC9F,kFAAkF;AAClF,mDAAiC;AACjC,oDAAkC;AAClC,sDAAoC;AACpC,oDAAkC;AAClC,wDAAsC;AACtC,qDAAmC;AACnC,oDAAkC;AAClC,uDAAqC;AACrC,sDAAoC"}

package/dist/cjs/knex/index.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ulidPrimary = ulidPrimary;
+exports.ulidColumn = ulidColumn;
+exports.timestamps = timestamps;
+exports.actorColumns = actorColumns;
+exports.datetime = datetime;
+exports.createAuditTable = createAuditTable;
+exports.createOutboxTable = createOutboxTable;
+exports.utf8mb4 = utf8mb4;
+/**
+ * Migration helpers (usable from CommonJS `.cjs` migrations via `require('@heavybit/shared-lib/knex')`).
+ * They keep ID, timestamp and audit column definitions identical across services.
+ */
+/** `id CHAR(26)` primary key for ULIDs. */
+function ulidPrimary(table, name = 'id') {
+    table.specificType(name, 'char(26)').notNullable().primary();
+}
+/** `CHAR(26)` column referencing another ULID (FK constraints only within the same database). */
+function ulidColumn(table, name) {
+    return table.specificType(name, 'char(26)');
+}
+/** `created_at` / `updated_at` as `DATETIME(3)` in UTC, maintained by MySQL. */
+function timestamps(table, knex) {
+    table.specificType('created_at', 'datetime(3)').notNullable().defaultTo(knex.raw('CURRENT_TIMESTAMP(3)'));
+    table.specificType('updated_at', 'datetime(3)').notNullable().defaultTo(knex.raw('CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)'));
+}
+/** `created_by` / `updated_by` actor columns (null for system operations). */
+function actorColumns(table) {
+    ulidColumn(table, 'created_by').nullable();
+    ulidColumn(table, 'updated_by').nullable();
+}
+/** Nullable `DATETIME(3)` column. */
+function datetime(table, name) {
+    return table.specificType(name, 'datetime(3)');
+}
+/**
+ * Creates `<parent>_audits`: every parent column (defined again by `columns`) plus `parent_id`
+ * and `action`. Audit rows are append-only history, so no unique constraints are copied.
+ */
+async function createAuditTable(knex, parentTable, columns) {
+    const name = `${parentTable}_audits`;
+    if (await knex.schema.hasTable(name))
+        return;
+    await knex.schema.createTable(name, (table) => {
+        ulidPrimary(table);
+        ulidColumn(table, 'parent_id').notNullable().index();
+        table.enu('action', ['create', 'update', 'delete']).notNullable();
+        columns(table);
+        actorColumns(table);
+        timestamps(table, knex);
+        table.index(['parent_id', 'created_at']);
+    });
+}
+/** Transactional outbox table used by `OutboxRelay`. */
+async function createOutboxTable(knex, name = 'event_outbox') {
+    if (await knex.schema.hasTable(name))
+        return;
+    await knex.schema.createTable(name, (table) => {
+        ulidPrimary(table);
+        table.string('routing_key', 191).notNullable();
+        table.json('payload').notNullable();
+        table.integer('attempts').unsigned().notNullable().defaultTo(0);
+        table.string('last_error', 500).nullable();
+        table.specificType('created_at', 'datetime(3)').notNullable().defaultTo(knex.raw('CURRENT_TIMESTAMP(3)'));
+        datetime(table, 'published_at').nullable();
+        table.index(['published_at', 'id']);
+    });
+}
+/** Standard table options: InnoDB, utf8mb4. Call inside `createTable`. */
+function utf8mb4(table) {
+    table.engine('InnoDB');
+    table.charset('utf8mb4');
+    table.collate('utf8mb4_unicode_ci');
+}
+//# sourceMappingURL=index.js.map

package/dist/cjs/knex/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/knex/index.ts"],"names":[],"mappings":";;AAQA,kCAEC;AAGD,gCAEC;AAGD,gCAGC;AAGD,oCAGC;AAGD,4BAEC;AAMD,4CAYC;AAGD,8CAYC;AAGD,0BAIC;AAtED;;;GAGG;AAEH,2CAA2C;AAC3C,SAAgB,WAAW,CAAC,KAA8B,EAAE,IAAI,GAAG,IAAI;IACrE,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,CAAC;AAC/D,CAAC;AAED,iGAAiG;AACjG,SAAgB,UAAU,CAAC,KAAuD,EAAE,IAAY;IAC9F,OAAO,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AAC9C,CAAC;AAED,gFAAgF;AAChF,SAAgB,UAAU,CAAC,KAA8B,EAAE,IAAU;IACnE,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAC1G,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC,CAAC;AAC3I,CAAC;AAED,8EAA8E;AAC9E,SAAgB,YAAY,CAAC,KAA8B;IACzD,UAAU,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3C,UAAU,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;AAC7C,CAAC;AAED,qCAAqC;AACrC,SAAgB,QAAQ,CAAC,KAAuD,EAAE,IAAY;IAC5F,OAAO,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;AACjD,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,gBAAgB,CAAC,IAAU,EAAE,WAAmB,EAAE,OAAiD;IACvH,MAAM,IAAI,GAAG,GAAG,WAAW,SAAS,CAAC;IACrC,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO;IAC7C,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE;QAC5C,WAAW,CAAC,KAAK,CAAC,CAAC;QACnB,UAAU,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,CAAC;QACrD,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAClE,OAAO,CAAC,KAAK,CAAC,CAAC;QACf,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACxB,KAAK,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,wDAAwD;AACjD,KAAK,UAAU,iBAAiB,CAAC,IAAU,EAAE,IAAI,GAAG,cAAc;IACvE,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO;IAC7C,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE;QAC5C,WAAW,CAAC,KAAK,CAAC,CAAC;QACnB,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QACpC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAChE,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3C,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC1G,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3C,KAAK,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,0EAA0E;AAC1E,SAAgB,OAAO,CAAC,KAA8B;IACpD,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvB,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACzB,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;AACtC,CAAC"}