@heavybit/shared-lib 0.0.0-stage → 1.2.0

package/dist/cjs/scheduling/index.js

@@ -0,0 +1,88 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ScheduledJob = void 0;
+exports.createLock = createLock;
+const node_crypto_1 = require("node:crypto");
+const index_js_1 = require("../logging/index.js");
+const RELEASE_SCRIPT = "if redis.call('get', KEYS[1]) == ARGV[1] then return redis.call('del', KEYS[1]) else return 0 end";
+/** Redis lock (SET NX PX + token-checked release). Without Redis, a per-process lock. */
+function createLock(redis, prefix = 'lock:') {
+    const local = new Set();
+    return {
+        async runExclusive(key, ttlMs, fn) {
+            if (!redis) {
+                if (local.has(key))
+                    return false;
+                local.add(key);
+                try {
+                    await fn();
+                }
+                finally {
+                    local.delete(key);
+                }
+                return true;
+            }
+            const token = (0, node_crypto_1.randomUUID)();
+            const acquired = await redis.set(prefix + key, token, 'PX', ttlMs, 'NX').catch(() => null);
+            if (acquired !== 'OK')
+                return false;
+            try {
+                await fn();
+            }
+            finally {
+                await redis.eval(RELEASE_SCRIPT, 1, prefix + key, token).catch(() => undefined);
+            }
+            return true;
+        },
+    };
+}
+/**
+ * Interval job that never overlaps itself, can be triggered early by events (`trigger()`), and
+ * optionally runs on one replica at a time.
+ */
+class ScheduledJob {
+    options;
+    timer = null;
+    running = false;
+    logger;
+    constructor(options) {
+        this.options = options;
+        this.logger = options.logger ?? index_js_1.silentLogger;
+    }
+    start() {
+        if (this.timer)
+            return;
+        this.timer = setInterval(() => { void this.trigger(); }, this.options.intervalMs);
+        this.timer.unref?.();
+        if (this.options.runOnStart)
+            void this.trigger();
+    }
+    stop() {
+        if (this.timer)
+            clearInterval(this.timer);
+        this.timer = null;
+    }
+    get isRunning() {
+        return this.running;
+    }
+    async trigger() {
+        if (this.running)
+            return;
+        this.running = true;
+        try {
+            const run = async () => { await this.options.work(); };
+            if (this.options.lock)
+                await this.options.lock.runExclusive(`job:${this.options.name}`, Math.max(this.options.intervalMs, 30_000), run);
+            else
+                await run();
+        }
+        catch (error) {
+            this.logger.error('Scheduled job failed', { job: this.options.name, error: error.message });
+        }
+        finally {
+            this.running = false;
+        }
+    }
+}
+exports.ScheduledJob = ScheduledJob;
+//# sourceMappingURL=index.js.map

package/dist/cjs/scheduling/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/scheduling/index.ts"],"names":[],"mappings":";;;AAaA,gCAqBC;AAlCD,6CAAyC;AAEzC,kDAAmD;AAQnD,MAAM,cAAc,GAAG,mGAAmG,CAAC;AAE3H,yFAAyF;AACzF,SAAgB,UAAU,CAAC,KAAmB,EAAE,MAAM,GAAG,OAAO;IAC9D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACjC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACf,IAAI,CAAC;oBAAC,MAAM,EAAE,EAAE,CAAC;gBAAC,CAAC;wBAAS,CAAC;oBAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAAC,CAAC;gBAClD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,KAAK,GAAG,IAAA,wBAAU,GAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAC3F,IAAI,QAAQ,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;YACpC,IAAI,CAAC;gBACH,MAAM,EAAE,EAAE,CAAC;YACb,CAAC;oBAAS,CAAC;gBACT,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,EAAE,MAAM,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAClF,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AAYD;;;GAGG;AACH,MAAa,YAAY;IAKM;IAJrB,KAAK,GAA0C,IAAI,CAAC;IACpD,OAAO,GAAG,KAAK,CAAC;IACP,MAAM,CAAS;IAEhC,YAA6B,OAA4B;QAA5B,YAAO,GAAP,OAAO,CAAqB;QACvD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,uBAAY,CAAC;IAC/C,CAAC;IAED,KAAK;QACH,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QACvB,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAClF,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QACrB,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU;YAAE,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;IACnD,CAAC;IAED,IAAI;QACF,IAAI,IAAI,CAAC,KAAK;YAAE,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACvD,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI;gBAAE,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;;gBACnI,MAAM,GAAG,EAAE,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACzG,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;CACF;AAtCD,oCAsCC"}

package/dist/cjs/security/index.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createUrlSigner = createUrlSigner;
+const crypto_js_1 = require("../common/crypto.js");
+/** HMAC-SHA256 expiring URL signatures for private files (streams, downloads, originals). */
+function createUrlSigner(secret) {
+    if (!secret || secret.length < 16)
+        throw new Error('URL signing secret must be at least 16 characters');
+    const expiry = (ttlSec) => Math.floor(Date.now() / 1000) + ttlSec;
+    const mac = (target, exp) => (0, crypto_js_1.hmacSha256)(secret, `${target}|${exp}`);
+    const signer = {
+        sign(path, ttlSec) {
+            const exp = expiry(ttlSec);
+            return { exp, sig: mac(path, exp) };
+        },
+        signPrefix(prefix, ttlSec) {
+            const exp = expiry(ttlSec);
+            return { exp, sig: mac(`prefix:${prefix}`, exp), sp: prefix };
+        },
+        signedPath(path, ttlSec, options = {}) {
+            const params = options.prefix ? signer.signPrefix(options.prefix, ttlSec) : signer.sign(path, ttlSec);
+            const qs = new URLSearchParams({ exp: String(params.exp), sig: params.sig, ...(params.sp ? { sp: params.sp } : {}) });
+            return `${path}${path.includes('?') ? '&' : '?'}${qs.toString()}`;
+        },
+        verify(path, params, now = Date.now()) {
+            const exp = Number(params.exp);
+            if (!params.sig || !Number.isFinite(exp) || exp * 1000 < now)
+                return false;
+            if (params.sp) {
+                if (!path.startsWith(params.sp))
+                    return false;
+                return (0, crypto_js_1.safeEqual)(params.sig, mac(`prefix:${params.sp}`, exp));
+            }
+            return (0, crypto_js_1.safeEqual)(params.sig, mac(path, exp));
+        },
+    };
+    return signer;
+}
+//# sourceMappingURL=index.js.map

package/dist/cjs/security/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/security/index.ts"],"names":[],"mappings":";;AAoBA,0CA8BC;AAlDD,mDAA4D;AAmB5D,6FAA6F;AAC7F,SAAgB,eAAe,CAAC,MAAc;IAC5C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACxG,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC;IAC1E,MAAM,GAAG,GAAG,CAAC,MAAc,EAAE,GAAW,EAAE,EAAE,CAAC,IAAA,sBAAU,EAAC,MAAM,EAAE,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;IAEpF,MAAM,MAAM,GAAc;QACxB,IAAI,CAAC,IAAI,EAAE,MAAM;YACf,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3B,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;QACtC,CAAC;QACD,UAAU,CAAC,MAAM,EAAE,MAAM;YACvB,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3B,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,UAAU,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;QAChE,CAAC;QACD,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAG,EAAE;YACnC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACtG,MAAM,EAAE,GAAG,IAAI,eAAe,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACtH,OAAO,GAAG,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;QACpE,CAAC;QACD,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;YACnC,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,IAAI,GAAG,GAAG;gBAAE,OAAO,KAAK,CAAC;YAC3E,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;oBAAE,OAAO,KAAK,CAAC;gBAC9C,OAAO,IAAA,qBAAS,EAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,UAAU,MAAM,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;YAChE,CAAC;YACD,OAAO,IAAA,qBAAS,EAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QAC/C,CAAC;KACF,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/cjs/socket/index.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.userRoom = void 0;
+exports.createSocketServer = createSocketServer;
+exports.gatewaySocketAuth = gatewaySocketAuth;
+const socket_io_1 = require("socket.io");
+const index_js_1 = require("../identity/index.js");
+const index_js_2 = require("../logging/index.js");
+const userRoom = (userId) => `user:${userId}`;
+exports.userRoom = userRoom;
+function createSocketServer(httpServer, options) {
+    const logger = options.logger ?? index_js_2.silentLogger;
+    const io = new socket_io_1.Server(httpServer, {
+        path: options.path,
+        cors: { origin: options.corsOrigins?.length ? options.corsOrigins : false, credentials: true },
+        ...(options.adapter ? { adapter: options.adapter } : {}),
+        ...options.serverOptions,
+    });
+    io.use(async (socket, next) => {
+        try {
+            const user = await options.authenticate(socket);
+            if (!user)
+                return next(new Error('Authentication failed'));
+            socket.data.user = user;
+            next();
+        }
+        catch (error) {
+            logger.warn('Socket authentication rejected', { error: error.message });
+            next(new Error('Authentication failed'));
+        }
+    });
+    io.on('connection', (socket) => {
+        const user = socket.data.user;
+        const rooms = options.rooms ? options.rooms(user) : [(0, exports.userRoom)(user.id)];
+        void socket.join(rooms);
+        logger.debug('Socket connected', { userId: user.id, rooms });
+        socket.on('disconnect', (reason) => logger.debug('Socket disconnected', { userId: user.id, reason }));
+    });
+    return {
+        io,
+        emitToUser: (userId, event, payload) => { io.to((0, exports.userRoom)(userId)).emit(event, payload); },
+        emitToRoom: (room, event, payload) => { io.to(room).emit(event, payload); },
+        close: () => new Promise((resolve) => { io.close(() => resolve()); }),
+    };
+}
+/** Trusts the gateway-signed identity headers forwarded on the WebSocket upgrade request. */
+function gatewaySocketAuth(secret) {
+    return (socket) => {
+        const result = (0, index_js_1.verifyIdentityHeaders)(socket.handshake.headers, secret);
+        return result.status === 'authenticated' ? result.user : null;
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/cjs/socket/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/socket/index.ts"],"names":[],"mappings":";;;AAgCA,gDAmCC;AAGD,8CAKC;AA1ED,yCAAoE;AACpE,mDAA6D;AAC7D,kDAAmD;AA2B5C,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,QAAQ,MAAM,EAAE,CAAC;AAAhD,QAAA,QAAQ,YAAwC;AAE7D,SAAgB,kBAAkB,CAAC,UAAsB,EAAE,OAA4B;IACrF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,uBAAY,CAAC;IAC9C,MAAM,EAAE,GAAG,IAAI,kBAAM,CAAC,UAAU,EAAE;QAChC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE;QAC9F,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,OAAO,CAAC,aAAa;KACzB,CAAC,CAAC;IAEH,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QAC5B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;YAC3D,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;YACxB,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YACnF,IAAI,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAgB,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAQ,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACxE,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,MAAM,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACxG,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,EAAE;QACF,UAAU,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,IAAA,gBAAQ,EAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QACzF,UAAU,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAC3E,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;KAC5E,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,SAAgB,iBAAiB,CAAC,MAAc;IAC9C,OAAO,CAAC,MAAc,EAAmB,EAAE;QACzC,MAAM,MAAM,GAAG,IAAA,gCAAqB,EAAC,MAAM,CAAC,SAAS,CAAC,OAAiC,EAAE,MAAM,CAAC,CAAC;QACjG,OAAO,MAAM,CAAC,MAAM,KAAK,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,CAAC,CAAC;AACJ,CAAC"}

package/dist/cjs/testing/index.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RecordingBus = exports.RecordingLogger = void 0;
+exports.makeAuthUser = makeAuthUser;
+exports.identityHeaders = identityHeaders;
+const id_js_1 = require("../common/id.js");
+const index_js_1 = require("../identity/index.js");
+const envelope_js_1 = require("../messaging/envelope.js");
+/** A logger spy: records every line (level, message, meta) so tests can assert on log context. */
+class RecordingLogger {
+    lines = [];
+    debug(message, meta = {}) { this.lines.push({ level: 'debug', message, meta }); }
+    info(message, meta = {}) { this.lines.push({ level: 'info', message, meta }); }
+    warn(message, meta = {}) { this.lines.push({ level: 'warn', message, meta }); }
+    error(message, meta = {}) { this.lines.push({ level: 'error', message, meta }); }
+}
+exports.RecordingLogger = RecordingLogger;
+/** An AuthUser for tests. */
+function makeAuthUser(overrides = {}) {
+    return { id: (0, id_js_1.newId)(), email: 'user@example.com', roles: [], permissions: [], scopes: {}, attrs: {}, ...overrides };
+}
+/** Gateway-signed identity headers for route tests (use with supertest `.set()`). */
+function identityHeaders(user, secret) {
+    return (0, index_js_1.signIdentityHeaders)(user, secret);
+}
+/** Records everything published/sent so tests can assert on events, commands and direct queue sends. */
+class RecordingBus {
+    source;
+    events = [];
+    commands = [];
+    queued = [];
+    failWith = null;
+    constructor(source = 'test') {
+        this.source = source;
+    }
+    async publish(type, data, meta) {
+        if (this.failWith)
+            throw this.failWith;
+        const envelope = (0, envelope_js_1.buildEnvelope)(type, data, this.source, meta);
+        this.events.push(envelope);
+        return envelope;
+    }
+    async publishEnvelope(envelope) {
+        if (this.failWith)
+            throw this.failWith;
+        this.events.push(envelope);
+    }
+    async send(command, data, meta) {
+        if (this.failWith)
+            throw this.failWith;
+        const envelope = (0, envelope_js_1.buildEnvelope)(command, data, this.source, meta);
+        this.commands.push(envelope);
+        return envelope;
+    }
+    async sendEnvelope(envelope) {
+        if (this.failWith)
+            throw this.failWith;
+        this.commands.push(envelope);
+    }
+    async sendToQueue(queue, payload, options = {}) {
+        if (this.failWith)
+            throw this.failWith;
+        this.queued.push({ queue, payload, options });
+    }
+    eventsOfType(type) {
+        return this.events.filter((e) => e.type === type);
+    }
+    commandsOfType(command) {
+        return this.commands.filter((e) => e.type === command);
+    }
+}
+exports.RecordingBus = RecordingBus;
+//# sourceMappingURL=index.js.map

package/dist/cjs/testing/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/testing/index.ts"],"names":[],"mappings":";;;AAsBA,oCAEC;AAGD,0CAEC;AA7BD,2CAAwC;AACxC,mDAA2D;AAC3D,0DAA4E;AAU5E,kGAAkG;AAClG,MAAa,eAAe;IACjB,KAAK,GAAc,EAAE,CAAC;IAC/B,KAAK,CAAC,OAAe,EAAE,OAAgC,EAAE,IAAU,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACxH,IAAI,CAAC,OAAe,EAAE,OAAgC,EAAE,IAAU,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACtH,IAAI,CAAC,OAAe,EAAE,OAAgC,EAAE,IAAU,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACtH,KAAK,CAAC,OAAe,EAAE,OAAgC,EAAE,IAAU,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;CACzH;AAND,0CAMC;AAED,6BAA6B;AAC7B,SAAgB,YAAY,CAAC,YAA+B,EAAE;IAC5D,OAAO,EAAE,EAAE,EAAE,IAAA,aAAK,GAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,SAAS,EAAE,CAAC;AACrH,CAAC;AAED,qFAAqF;AACrF,SAAgB,eAAe,CAAC,IAAc,EAAE,MAAc;IAC5D,OAAO,IAAA,8BAAmB,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC3C,CAAC;AAED,wGAAwG;AACxG,MAAa,YAAY;IAMM;IALpB,MAAM,GAAoB,EAAE,CAAC;IAC7B,QAAQ,GAAoB,EAAE,CAAC;IAC/B,MAAM,GAA0E,EAAE,CAAC;IAC5F,QAAQ,GAAiB,IAAI,CAAC;IAE9B,YAA6B,SAAS,MAAM;QAAf,WAAM,GAAN,MAAM,CAAS;IAAG,CAAC;IAEhD,KAAK,CAAC,OAAO,CAAI,IAAY,EAAE,IAAO,EAAE,IAAmB;QACzD,IAAI,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,CAAC,QAAQ,CAAC;QACvC,MAAM,QAAQ,GAAG,IAAA,2BAAa,EAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAyB,CAAC,CAAC;QAC5C,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,QAAuB;QAC3C,IAAI,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,CAAC,QAAQ,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,IAAI,CAAI,OAAe,EAAE,IAAO,EAAE,IAAmB;QACzD,IAAI,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,CAAC,QAAQ,CAAC;QACvC,MAAM,QAAQ,GAAG,IAAA,2BAAa,EAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAyB,CAAC,CAAC;QAC9C,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAuB;QACxC,IAAI,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,CAAC,QAAQ,CAAC;QACvC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,OAAgB,EAAE,UAA4B,EAAE;QAC/E,IAAI,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,CAAC,QAAQ,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,YAAY,CAAC,IAAY;QACvB,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACpD,CAAC;IAED,cAAc,CAAC,OAAe;QAC5B,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;IACzD,CAAC;CACF;AA5CD,oCA4CC"}

package/dist/cjs/types/index.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=index.js.map

package/dist/cjs/types/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/types/index.ts"],"names":[],"mappings":""}

package/dist/cjs/validation/index.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.z = exports.csvList = exports.booleanish = exports.passwordSchema = exports.slugSchema = exports.emailSchema = exports.sortOrderSchema = exports.paginationSchema = exports.idParamSchema = exports.idSchema = void 0;
+exports.zodIssuesToErrors = zodIssuesToErrors;
+exports.parseOrThrow = parseOrThrow;
+const zod_1 = require("zod");
+Object.defineProperty(exports, "z", { enumerable: true, get: function () { return zod_1.z; } });
+const id_js_1 = require("../common/id.js");
+const errors_js_1 = require("../common/errors.js");
+exports.idSchema = zod_1.z.string().regex(id_js_1.ID_PATTERN, 'Invalid id');
+exports.idParamSchema = zod_1.z.object({ id: exports.idSchema });
+exports.paginationSchema = zod_1.z.object({
+    page: zod_1.z.coerce.number().int().min(1).default(1),
+    limit: zod_1.z.coerce.number().int().min(1).max(100).default(20),
+});
+exports.sortOrderSchema = zod_1.z.enum(['asc', 'desc']).default('desc');
+exports.emailSchema = zod_1.z.string().trim().toLowerCase().email('Invalid email address').max(191);
+exports.slugSchema = zod_1.z.string().trim().min(1).max(120).regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, 'Invalid slug');
+/** Length-first password rule (NIST 800-63B): 8–128 chars, no composition rules. Tighten per app if needed. */
+exports.passwordSchema = zod_1.z.string().min(8, 'Password must be at least 8 characters').max(128, 'Password is too long');
+/** Accepts `true/false/1/0/yes/no` from query strings. */
+exports.booleanish = zod_1.z.union([zod_1.z.boolean(), zod_1.z.enum(['true', 'false', '1', '0', 'yes', 'no'])]).transform((v) => v === true || v === 'true' || v === '1' || v === 'yes');
+/** Comma list or repeated query param → string[]. */
+exports.csvList = zod_1.z.union([zod_1.z.string(), zod_1.z.array(zod_1.z.string())]).transform((v) => (Array.isArray(v) ? v : v.split(',')).map((s) => s.trim()).filter(Boolean));
+/** Converts Zod issues into the `{ field: [messages] }` shape used by the error envelope. */
+function zodIssuesToErrors(error) {
+    const errors = {};
+    for (const issue of error.issues) {
+        const key = issue.path.join('.') || '_';
+        (errors[key] ??= []).push(issue.message);
+    }
+    return errors;
+}
+/** Parses `input` or throws a ValidationError (422). */
+function parseOrThrow(schema, input) {
+    const result = schema.safeParse(input);
+    if (!result.success)
+        throw new errors_js_1.ValidationError(zodIssuesToErrors(result.error));
+    return result.data;
+}
+//# sourceMappingURL=index.js.map

package/dist/cjs/validation/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/validation/index.ts"],"names":[],"mappings":";;;AA6BA,8CAOC;AAGD,oCAIC;AA3CD,6BAAwB;AA6Cf,kFA7CA,OAAC,OA6CA;AA5CV,2CAA6C;AAC7C,mDAAsD;AAEzC,QAAA,QAAQ,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,kBAAU,EAAE,YAAY,CAAC,CAAC;AAEtD,QAAA,aAAa,GAAG,OAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,gBAAQ,EAAE,CAAC,CAAC;AAE3C,QAAA,gBAAgB,GAAG,OAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,OAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/C,KAAK,EAAE,OAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC3D,CAAC,CAAC;AAEU,QAAA,eAAe,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;AAE1D,QAAA,WAAW,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAEtF,QAAA,UAAU,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,4BAA4B,EAAE,cAAc,CAAC,CAAC;AAEhH,+GAA+G;AAClG,QAAA,cAAc,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,wCAAwC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;AAE3H,0DAA0D;AAC7C,QAAA,UAAU,GAAG,OAAC,CAAC,KAAK,CAAC,CAAC,OAAC,CAAC,OAAO,EAAE,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;AAE5K,qDAAqD;AACxC,QAAA,OAAO,GAAG,OAAC,CAAC,KAAK,CAAC,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;AAE/J,6FAA6F;AAC7F,SAAgB,iBAAiB,CAAC,KAAiB;IACjD,MAAM,MAAM,GAA6B,EAAE,CAAC;IAC5C,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;QACxC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,wDAAwD;AACxD,SAAgB,YAAY,CAAyB,MAAS,EAAE,KAAc;IAC5E,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,2BAAe,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAChF,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC"}

package/dist/esm/access/index.js

@@ -0,0 +1,104 @@
+import { ForbiddenError, UnauthorizedError } from '../common/errors.js';
+/**
+ * Permission and ownership checks. Keep every authorization decision in these helpers (not
+ * inline in controllers) so the rules are identical across endpoints and services.
+ *
+ * Permission strings are dotted (`users.manage`, `media.manage.any`). Grants may use
+ * wildcards: `*` grants everything; `media.*` grants any permission starting with `media.`.
+ */
+export const WILDCARD_PERMISSION = '*';
+function grants(granted, required) {
+    if (granted === WILDCARD_PERMISSION || granted === required)
+        return true;
+    return granted.endsWith('.*') && required.startsWith(granted.slice(0, -1));
+}
+/** True when the user holds at least one of `required`. */
+export function hasPermission(user, ...required) {
+    if (!user)
+        return false;
+    return required.some((perm) => user.permissions.some((g) => grants(g, perm)));
+}
+export function hasAllPermissions(user, ...required) {
+    if (!user)
+        return false;
+    return required.every((perm) => user.permissions.some((g) => grants(g, perm)));
+}
+export function hasRole(user, ...roles) {
+    return !!user && roles.some((role) => user.roles.includes(role));
+}
+export function requireUser(user) {
+    if (!user)
+        throw new UnauthorizedError();
+    return user;
+}
+export function assertPermission(user, ...required) {
+    const u = requireUser(user);
+    if (!hasPermission(u, ...required))
+        throw new ForbiddenError();
+    return u;
+}
+/** IDs the user may act on within a scope (e.g. profiles they are a member of). */
+export function scopeIds(user, scope) {
+    return user?.scopes?.[scope] ?? [];
+}
+/**
+ * Self-owned data: allow when the caller *is* `ownerUserId`, or holds `bypassPermission`.
+ * Throws ForbiddenError otherwise.
+ */
+export function assertSelfOrPermission(user, ownerUserId, bypassPermission) {
+    const u = requireUser(user);
+    if (u.id === ownerUserId)
+        return u;
+    if (bypassPermission && hasPermission(u, bypassPermission))
+        return u;
+    throw new ForbiddenError();
+}
+/**
+ * Scoped data: allow when `resourceScopeId` is one of the caller's scope IDs, or the caller holds
+ * `bypassPermission`.
+ */
+export function assertInScope(user, scope, resourceScopeId, bypassPermission) {
+    const u = requireUser(user);
+    if (scopeIds(u, scope).includes(resourceScopeId))
+        return u;
+    if (bypassPermission && hasPermission(u, bypassPermission))
+        return u;
+    throw new ForbiddenError();
+}
+/**
+ * Resolves the single scope ID a request acts on. With one membership it is implicit; with
+ * several the client names one (e.g. `x-active-profile-id`), which must be a member ID.
+ * IDs from request bodies are never trusted — only the gateway-signed scopes.
+ */
+export function resolveActiveScopeId(user, scope, requested) {
+    const ids = scopeIds(requireUser(user), scope);
+    if (requested) {
+        if (!ids.includes(requested))
+            throw new ForbiddenError(`Not a member of this ${scope}`);
+        return requested;
+    }
+    if (ids.length === 1)
+        return ids[0];
+    if (ids.length === 0)
+        throw new ForbiddenError(`No ${scope} is linked to this account`);
+    throw new ForbiddenError(`Select a ${scope} to act on`, { code: 'SCOPE_SELECTION_REQUIRED' });
+}
+/**
+ * Like `resolveActiveScopeId`, for screens that work without a selector: with several memberships
+ * and none named, the first (primary) one is used. A named ID must still be a member ID.
+ */
+export function resolvePrimaryScopeId(user, scope, requested) {
+    const ids = scopeIds(requireUser(user), scope);
+    return resolveActiveScopeId(user, scope, requested || ids[0]);
+}
+/**
+ * Repository filter for list queries: `{ all: true }` for callers holding `bypassPermission`,
+ * otherwise the caller's own scope IDs (possibly empty → return nothing).
+ */
+export function ownerFilter(user, scope, bypassPermission) {
+    const u = requireUser(user);
+    if (bypassPermission && hasPermission(u, bypassPermission))
+        return { all: true };
+    return { all: false, ids: scopeIds(u, scope) };
+}
+//# sourceMappingURL=index.js.map

package/dist/esm/access/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/access/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAGxE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEvC,SAAS,MAAM,CAAC,OAAe,EAAE,QAAgB;IAC/C,IAAI,OAAO,KAAK,mBAAmB,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzE,OAAO,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,aAAa,CAAC,IAAsD,EAAE,GAAG,QAAkB;IACzG,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAsD,EAAE,GAAG,QAAkB;IAC7G,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAgD,EAAE,GAAG,KAAe;IAC1F,OAAO,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAiC;IAC3D,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,iBAAiB,EAAE,CAAC;IACzC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAiC,EAAE,GAAG,QAAkB;IACvF,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC;QAAE,MAAM,IAAI,cAAc,EAAE,CAAC;IAC/D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,QAAQ,CAAC,IAAiD,EAAE,KAAa;IACvF,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAiC,EAAE,WAAmB,EAAE,gBAAyB;IACtH,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC,EAAE,KAAK,WAAW;QAAE,OAAO,CAAC,CAAC;IACnC,IAAI,gBAAgB,IAAI,aAAa,CAAC,CAAC,EAAE,gBAAgB,CAAC;QAAE,OAAO,CAAC,CAAC;IACrE,MAAM,IAAI,cAAc,EAAE,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAAiC,EAAE,KAAa,EAAE,eAAuB,EAAE,gBAAyB;IAChI,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC;QAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,gBAAgB,IAAI,aAAa,CAAC,CAAC,EAAE,gBAAgB,CAAC;QAAE,OAAO,CAAC,CAAC;IACrE,MAAM,IAAI,cAAc,EAAE,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAiC,EAAE,KAAa,EAAE,SAAyB;IAC9G,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/C,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,cAAc,CAAC,wBAAwB,KAAK,EAAE,CAAC,CAAC;QACxF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC,CAAC,CAAE,CAAC;IACrC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,MAAM,KAAK,4BAA4B,CAAC,CAAC;IACxF,MAAM,IAAI,cAAc,CAAC,YAAY,KAAK,YAAY,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC,CAAC;AAChG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAiC,EAAE,KAAa,EAAE,SAAyB;IAC/G,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/C,OAAO,oBAAoB,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAID;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAiC,EAAE,KAAa,EAAE,gBAAyB;IACrG,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,gBAAgB,IAAI,aAAa,CAAC,CAAC,EAAE,gBAAgB,CAAC;QAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACjF,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;AACjD,CAAC"}

package/dist/esm/alerting/index.js

@@ -0,0 +1,52 @@
+import { silentLogger } from '../logging/index.js';
+/**
+ * Posts alerts to a Slack notification webhook as `{ messages, alert_type, app_name, environment, consolidate }`.
+ * An unset URL is a valid "alerts off" configuration: the first skipped alert is warned about once, then silently.
+ */
+export class SlackAlerter {
+    options;
+    warnedUnconfigured = false;
+    logger;
+    constructor(options) {
+        this.options = options;
+        this.logger = options.logger ?? silentLogger;
+    }
+    get configured() {
+        return Boolean(this.options.url);
+    }
+    async send(messages, options = {}) {
+        if (!this.options.url) {
+            if (!this.warnedUnconfigured)
+                this.logger.warn('Slack alert URL is not configured; alerts are logged only');
+            this.warnedUnconfigured = true;
+            return false;
+        }
+        const payload = {
+            messages,
+            alert_type: options.alertType ?? 'app-alert',
+            app_name: this.options.app,
+            environment: this.options.environment,
+            consolidate: true,
+        };
+        const post = this.options.fetch ?? fetch;
+        try {
+            const res = await post(this.options.url, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify(payload),
+                signal: AbortSignal.timeout(this.options.timeoutMs ?? 10_000),
+            });
+            if (!res.ok) {
+                const body = await res.text().catch(() => '');
+                this.logger.error('Slack alert rejected', { status: res.status, body: body.slice(0, 200) });
+                return false;
+            }
+            return true;
+        }
+        catch (error) {
+            this.logger.error('Slack alert failed', { error: error.message });
+            return false;
+        }
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/esm/alerting/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/alerting/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AA+BnD;;;GAGG;AACH,MAAM,OAAO,YAAY;IAIM;IAHrB,kBAAkB,GAAG,KAAK,CAAC;IAClB,MAAM,CAAS;IAEhC,YAA6B,OAA4B;QAA5B,YAAO,GAAP,OAAO,CAAqB;QACvD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC;IAC/C,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAkB,EAAE,UAAkC,EAAE;QACjE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,kBAAkB;gBAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;YAC5G,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,OAAO,GAAsB;YACjC,QAAQ;YACR,UAAU,EAAE,OAAO,CAAC,SAAS,IAAI,WAAW;YAC5C,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG;YAC1B,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;YACrC,WAAW,EAAE,IAAI;SAClB,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;gBACvC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;gBAC7B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;aAC9D,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC9C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC5F,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7E,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF"}