@heavybit/shared-lib 1.3.2 → 2.7.0

package/dist/cjs/identity/index.js

@@ -1,117 +1,319 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PROTECTED_HEADERS = exports.CONTEXT_HEADERS = exports.IDENTITY_HEADERS = void 0;
-exports.signIdentityHeaders = signIdentityHeaders;
-exports.verifyIdentityHeaders = verifyIdentityHeaders;
+exports.MIN_GATEWAY_SECRET_LENGTH = exports.DEFAULT_IDENTITY_MAX_FUTURE_MS = exports.DEFAULT_IDENTITY_MAX_AGE_MS = exports.GATEWAY_SIGNATURE_VERSION = exports.CONTEXT_HEADERS = exports.IDENTITY_HEADERS = void 0;
+exports.defineIdentityProtocol = defineIdentityProtocol;
+exports.protectedHeaders = protectedHeaders;
 exports.stripProtectedHeaders = stripProtectedHeaders;
+exports.canonicalPath = canonicalPath;
+exports.buildIdentityHeaders = buildIdentityHeaders;
+exports.signGatewayIdentity = signGatewayIdentity;
+exports.signedIdentityHeaders = signedIdentityHeaders;
+exports.verifyGatewayIdentity = verifyGatewayIdentity;
+exports.assertGatewaySecret = assertGatewaySecret;
 const crypto_js_1 = require("../common/crypto.js");
 /**
- * Header contract between the gateway and downstream services.
+ * Gateway identity protocol, version 2.
  *
- * The gateway strips any client-supplied identity headers, then writes these and signs them with
- * `x-gateway-auth` = HMAC-SHA256(secret, canonical string). Services verify the signature and
- * timestamp before trusting anything, so a request that bypasses the gateway on the internal
- * network cannot forge an identity.
+ * The gateway strips every client-supplied identity header, writes the headers below for the
+ * authenticated caller and signs them with `x-gateway-signature: v2=<hex>`. The signature is an
+ * HMAC-SHA256 over an app-chosen domain separator, the HTTP method, the canonical path (no query),
+ * the gateway timestamp and every identity header in a fixed order. A request that bypasses the
+ * gateway, is replayed later, or is replayed against another route cannot carry a forged identity.
+ *
+ * App-specific identity fields (for example a tenant id) travel in their own headers through an
+ * {@link IdentityProtocol} mapping, so this module never names an app concept.
  */
 exports.IDENTITY_HEADERS = {
     USER_ID: 'x-user-id',
     USER_EMAIL: 'x-user-email',
     USER_ROLES: 'x-user-roles',
     USER_PERMISSIONS: 'x-user-permissions',
+    SUPER_ADMIN: 'x-is-superadmin',
+    OTP_VERIFIED: 'x-otp-verified',
+    STEP_UP_AT: 'x-step-up-at',
+    SESSION_ID: 'x-session-id',
     USER_SCOPES: 'x-user-scopes',
     USER_ATTRS: 'x-user-attrs',
-    SESSION_ID: 'x-session-id',
     TIMESTAMP: 'x-gateway-ts',
-    SIGNATURE: 'x-gateway-auth',
+    SIGNATURE: 'x-gateway-signature',
 };
+/** Non-identity request headers shared by the gateway and services (correlation, client hints, internal auth). */
 exports.CONTEXT_HEADERS = {
     CORRELATION_ID: 'x-correlation-id',
     ANON_ID: 'x-anon-id',
     TIMEZONE: 'x-timezone',
     CLIENT_IP: 'x-client-ip',
     INTERNAL_SECRET: 'x-internal-service-secret',
-    CALLER_SERVICE: 'x-caller-service',
+    INTERNAL_SERVICE_NAME: 'x-internal-service-name',
+    IDEMPOTENCY_KEY: 'idempotency-key',
 };
-/** Every header a client must never be allowed to set. */
-exports.PROTECTED_HEADERS = [...Object.values(exports.IDENTITY_HEADERS), exports.CONTEXT_HEADERS.INTERNAL_SECRET, exports.CONTEXT_HEADERS.CLIENT_IP];
-const DEFAULT_MAX_SKEW_MS = 5 * 60_000;
+/** Signature version prefix: `x-gateway-signature: v2=<hex>`. */
+exports.GATEWAY_SIGNATURE_VERSION = 'v2';
+/** Default maximum age of a gateway timestamp (replay window). */
+exports.DEFAULT_IDENTITY_MAX_AGE_MS = 30_000;
+/** Default allowance for a gateway clock that runs ahead of the service clock. */
+exports.DEFAULT_IDENTITY_MAX_FUTURE_MS = 5_000;
+/** Minimum length of the shared gateway signing secret. */
+exports.MIN_GATEWAY_SECRET_LENGTH = 32;
+const BASE_HEAD = [exports.IDENTITY_HEADERS.USER_ID, exports.IDENTITY_HEADERS.USER_EMAIL];
+const BASE_TAIL = [
+    exports.IDENTITY_HEADERS.USER_ROLES,
+    exports.IDENTITY_HEADERS.USER_PERMISSIONS,
+    exports.IDENTITY_HEADERS.SUPER_ADMIN,
+    exports.IDENTITY_HEADERS.OTP_VERIFIED,
+    exports.IDENTITY_HEADERS.STEP_UP_AT,
+    exports.IDENTITY_HEADERS.SESSION_ID,
+    exports.IDENTITY_HEADERS.USER_SCOPES,
+    exports.IDENTITY_HEADERS.USER_ATTRS,
+];
+const HEADER_NAME = /^x-[a-z0-9-]+$/;
+const RESERVED_HEADERS = new Set([...Object.values(exports.IDENTITY_HEADERS), ...Object.values(exports.CONTEXT_HEADERS)]);
+/**
+ * Validates and freezes an app's identity protocol. Throws at startup on a bad binding so a
+ * misconfiguration can never weaken verification at runtime.
+ *
+ * @param input Domain separator and optional scope/attr header mappings.
+ * @returns The frozen protocol, including the signing order.
+ * @example const protocol = defineIdentityProtocol({ domain: 'shop-gateway-identity:v2', scopeHeaders: { tenant: 'x-tenant-id' } });
+ */
+function defineIdentityProtocol(input) {
+    if (!input.domain?.trim())
+        throw new Error('defineIdentityProtocol: domain separator is required');
+    const scopeHeaders = { ...(input.scopeHeaders ?? {}) };
+    const attrHeaders = { ...(input.attrHeaders ?? {}) };
+    const mapped = [...Object.values(scopeHeaders), ...Object.values(attrHeaders)];
+    const seen = new Set();
+    for (const name of mapped) {
+        if (!HEADER_NAME.test(name))
+            throw new Error(`defineIdentityProtocol: "${name}" must be a lower-case x- header`);
+        if (RESERVED_HEADERS.has(name) || seen.has(name))
+            throw new Error(`defineIdentityProtocol: header "${name}" is reserved or duplicated`);
+        seen.add(name);
+    }
+    return Object.freeze({
+        domain: input.domain,
+        scopeHeaders: Object.freeze(scopeHeaders),
+        attrHeaders: Object.freeze(attrHeaders),
+        headerOrder: Object.freeze([...BASE_HEAD, ...mapped, ...BASE_TAIL]),
+    });
+}
+/**
+ * Every header a client must never be allowed to set, for a given protocol: identity headers, the gateway
+ * timestamp and signature, both internal-service headers and the client IP.
+ *
+ * @param protocol The app's identity protocol.
+ * @returns Lower-case header names.
+ * @example const blocked = new Set(protectedHeaders(protocol));
+ */
+function protectedHeaders(protocol) {
+    return [...protocol.headerOrder, exports.IDENTITY_HEADERS.TIMESTAMP, exports.IDENTITY_HEADERS.SIGNATURE, exports.CONTEXT_HEADERS.INTERNAL_SECRET, exports.CONTEXT_HEADERS.INTERNAL_SERVICE_NAME, exports.CONTEXT_HEADERS.CLIENT_IP];
+}
+/**
+ * Removes every protected header in place (gateway ingress), so clients can't forge identity or internal auth.
+ *
+ * @param headers Incoming request headers (mutated).
+ * @param protocol The app's identity protocol.
+ * @example stripProtectedHeaders(req.headers, protocol);
+ */
+function stripProtectedHeaders(headers, protocol) {
+    for (const name of protectedHeaders(protocol))
+        delete headers[name];
+}
 function header(headers, name) {
     const value = headers[name];
     return Array.isArray(value) ? value[0] : value;
 }
-function canonical(values) {
-    return [
-        values[exports.IDENTITY_HEADERS.TIMESTAMP],
-        values[exports.IDENTITY_HEADERS.USER_ID],
-        values[exports.IDENTITY_HEADERS.USER_EMAIL],
-        values[exports.IDENTITY_HEADERS.USER_ROLES],
-        values[exports.IDENTITY_HEADERS.USER_PERMISSIONS],
-        values[exports.IDENTITY_HEADERS.USER_SCOPES],
-        values[exports.IDENTITY_HEADERS.USER_ATTRS],
-        values[exports.IDENTITY_HEADERS.SESSION_ID],
-    ].join('\n');
+/**
+ * Canonical request path for signing: the path only (query and fragment dropped), always starting with `/`.
+ *
+ * @param path A path or path-plus-query such as `req.originalUrl`.
+ * @returns The path to sign or verify.
+ * @example canonicalPath('/v1/items?page=2') // '/v1/items'
+ */
+function canonicalPath(path) {
+    const bare = path.split(/[?#]/, 1)[0] ?? '';
+    return bare.startsWith('/') ? bare : `/${bare}`;
 }
-const encodeList = (items) => items.join(',');
+const encodeList = (items = []) => items.join(',');
 const decodeList = (value) => (value ? value.split(',').map((s) => s.trim()).filter(Boolean) : []);
-const encodeJson = (value) => Buffer.from(JSON.stringify(value ?? {})).toString('base64url');
-function decodeJson(value, fallback) {
+const encodeJson = (value) => (Object.keys(value).length ? Buffer.from(JSON.stringify(value)).toString('base64url') : '');
+const omitKeys = (record, keys) => Object.fromEntries(Object.entries(record).filter(([k]) => !keys.includes(k)));
+function decodeJson(value) {
     if (!value)
-        return fallback;
+        return {};
     try {
-        return JSON.parse(Buffer.from(value, 'base64url').toString('utf8'));
+        const parsed = JSON.parse(Buffer.from(value, 'base64url').toString('utf8'));
+        return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : undefined;
     }
     catch {
-        return fallback;
+        return undefined;
     }
 }
-/** Gateway side: headers (including signature) that represent `user`. */
-function signIdentityHeaders(user, secret, now = Date.now()) {
+/**
+ * Gateway side: the identity header values (unsigned) that represent `user` under `protocol`.
+ * Mapped scopes and string attrs travel in their own headers; the rest go in the JSON headers.
+ *
+ * @param user The authenticated caller.
+ * @param protocol The app's identity protocol.
+ * @returns Header name → value for every header in `protocol.headerOrder`.
+ * @example const identity = buildIdentityHeaders(user, protocol);
+ */
+function buildIdentityHeaders(user, protocol) {
+    const scopeKeys = Object.keys(protocol.scopeHeaders);
+    const attrKeys = Object.keys(protocol.attrHeaders);
     const values = {
-        [exports.IDENTITY_HEADERS.TIMESTAMP]: String(now),
         [exports.IDENTITY_HEADERS.USER_ID]: user.id,
         [exports.IDENTITY_HEADERS.USER_EMAIL]: user.email ?? '',
         [exports.IDENTITY_HEADERS.USER_ROLES]: encodeList(user.roles),
         [exports.IDENTITY_HEADERS.USER_PERMISSIONS]: encodeList(user.permissions),
-        [exports.IDENTITY_HEADERS.USER_SCOPES]: encodeJson(user.scopes),
-        [exports.IDENTITY_HEADERS.USER_ATTRS]: encodeJson(user.attrs),
+        [exports.IDENTITY_HEADERS.SUPER_ADMIN]: user.isSuperAdmin ? 'true' : 'false',
+        [exports.IDENTITY_HEADERS.OTP_VERIFIED]: user.otpVerified ? 'true' : 'false',
+        [exports.IDENTITY_HEADERS.STEP_UP_AT]: user.stepUpAt !== undefined ? String(Math.trunc(user.stepUpAt)) : '',
         [exports.IDENTITY_HEADERS.SESSION_ID]: user.sessionId ?? '',
+        [exports.IDENTITY_HEADERS.USER_SCOPES]: encodeJson(omitKeys(user.scopes ?? {}, scopeKeys)),
+        [exports.IDENTITY_HEADERS.USER_ATTRS]: encodeJson(omitKeys(user.attrs ?? {}, attrKeys)),
     };
-    values[exports.IDENTITY_HEADERS.SIGNATURE] = (0, crypto_js_1.hmacSha256)(secret, canonical(values));
+    for (const [key, name] of Object.entries(protocol.scopeHeaders))
+        values[name] = encodeList(user.scopes?.[key]);
+    for (const [key, name] of Object.entries(protocol.attrHeaders)) {
+        const attr = user.attrs?.[key];
+        values[name] = typeof attr === 'string' ? attr : '';
+    }
     return values;
 }
-/** Service side: verifies and decodes the gateway identity headers. */
-function verifyIdentityHeaders(headers, secret, options = {}) {
-    const userId = header(headers, exports.IDENTITY_HEADERS.USER_ID);
-    if (!userId)
-        return { status: 'anonymous' };
-    const values = {};
-    for (const name of Object.values(exports.IDENTITY_HEADERS))
-        values[name] = header(headers, name) ?? '';
-    const signature = values[exports.IDENTITY_HEADERS.SIGNATURE];
-    if (!signature || !(0, crypto_js_1.safeEqual)(signature, (0, crypto_js_1.hmacSha256)(secret, canonical(values)))) {
-        return { status: 'invalid', reason: 'bad-signature' };
+function canonicalString(input) {
+    const fields = [
+        input.protocol.domain,
+        input.method.toUpperCase(),
+        canonicalPath(input.path),
+        String(input.ts),
+        ...input.protocol.headerOrder.map((name) => input.identity[name] ?? ''),
+    ];
+    // JSON array encoding keeps field boundaries unambiguous whatever the values contain.
+    return JSON.stringify(fields);
+}
+/**
+ * Signs an identity for one request.
+ *
+ * @param input Method, path, identity headers, timestamp, secret and protocol.
+ * @returns The `x-gateway-signature` value, `v2=<hex>`.
+ * @example headers['x-gateway-signature'] = signGatewayIdentity({ method, path, identity, ts, secret, protocol });
+ */
+function signGatewayIdentity(input) {
+    return `${exports.GATEWAY_SIGNATURE_VERSION}=${(0, crypto_js_1.hmacSha256)(input.secret, canonicalString(input))}`;
+}
+/**
+ * Gateway side convenience: every identity header plus `x-gateway-ts` and `x-gateway-signature`. Also used by a
+ * service acting for a user to re-sign the identity for one internal call (signatures bind method and path).
+ *
+ * @param input User, method, path, secret, protocol and optional time.
+ * @returns Headers to add to the outgoing request.
+ *
+ * @example Object.assign(proxyHeaders, signedIdentityHeaders({ user, method: req.method, path: upstreamPath, secret, protocol }));
+ */
+function signedIdentityHeaders(input) {
+    const ts = input.now ?? Date.now();
+    const identity = buildIdentityHeaders(input.user, input.protocol);
+    const signature = signGatewayIdentity({ method: input.method, path: input.path, identity, ts, secret: input.secret, protocol: input.protocol });
+    return { ...identity, [exports.IDENTITY_HEADERS.TIMESTAMP]: String(ts), [exports.IDENTITY_HEADERS.SIGNATURE]: signature };
+}
+function checkTimestamp(raw, now, maxAgeMs, maxFutureMs) {
+    if (!raw || !/^\d+$/.test(raw))
+        return 'bad-timestamp';
+    const ts = Number(raw);
+    if (now - ts > maxAgeMs)
+        return 'stale';
+    if (ts - now > maxFutureMs)
+        return 'future';
+    return null;
+}
+function decodeUser(values, protocol) {
+    const scopes = decodeJson(values[exports.IDENTITY_HEADERS.USER_SCOPES]);
+    const attrs = decodeJson(values[exports.IDENTITY_HEADERS.USER_ATTRS]);
+    const stepUpRaw = values[exports.IDENTITY_HEADERS.STEP_UP_AT];
+    if (!scopes || !attrs || (stepUpRaw && !/^\d+$/.test(stepUpRaw)))
+        return null;
+    for (const [key, name] of Object.entries(protocol.scopeHeaders)) {
+        const ids = decodeList(values[name]);
+        if (ids.length)
+            scopes[key] = ids;
     }
-    const ts = Number(values[exports.IDENTITY_HEADERS.TIMESTAMP]);
-    const now = options.now ?? Date.now();
-    if (!Number.isFinite(ts) || Math.abs(now - ts) > (options.maxSkewMs ?? DEFAULT_MAX_SKEW_MS)) {
-        return { status: 'invalid', reason: 'stale-signature' };
+    for (const [key, name] of Object.entries(protocol.attrHeaders)) {
+        if (values[name])
+            attrs[key] = values[name];
     }
-    return {
-        status: 'authenticated',
-        user: {
-            id: userId,
-            email: values[exports.IDENTITY_HEADERS.USER_EMAIL] ?? '',
-            roles: decodeList(values[exports.IDENTITY_HEADERS.USER_ROLES]),
-            permissions: decodeList(values[exports.IDENTITY_HEADERS.USER_PERMISSIONS]),
-            scopes: decodeJson(values[exports.IDENTITY_HEADERS.USER_SCOPES], {}),
-            attrs: decodeJson(values[exports.IDENTITY_HEADERS.USER_ATTRS], {}),
-            sessionId: values[exports.IDENTITY_HEADERS.SESSION_ID] || undefined,
-        },
+    const user = {
+        id: values[exports.IDENTITY_HEADERS.USER_ID] ?? '',
+        email: values[exports.IDENTITY_HEADERS.USER_EMAIL] ?? '',
+        roles: decodeList(values[exports.IDENTITY_HEADERS.USER_ROLES]),
+        permissions: decodeList(values[exports.IDENTITY_HEADERS.USER_PERMISSIONS]),
+        scopes,
+        attrs,
+        isSuperAdmin: values[exports.IDENTITY_HEADERS.SUPER_ADMIN] === 'true',
+        otpVerified: values[exports.IDENTITY_HEADERS.OTP_VERIFIED] === 'true',
     };
+    if (values[exports.IDENTITY_HEADERS.SESSION_ID])
+        user.sessionId = values[exports.IDENTITY_HEADERS.SESSION_ID];
+    if (stepUpRaw)
+        user.stepUpAt = Number(stepUpRaw);
+    return user;
 }
-/** Removes every protected header in place (gateway ingress). */
-function stripProtectedHeaders(headers) {
-    for (const name of exports.PROTECTED_HEADERS)
-        delete headers[name];
+/**
+ * Service side: verifies and decodes the gateway identity. No `x-user-id` → anonymous. Otherwise the
+ * request is rejected unless the signature is present, version `v2`, made for this method, path and
+ * protocol, and the timestamp is at most `maxAgeMs` old (default 30 s) and at most `maxFutureMs` ahead
+ * (default 5 s). The comparison is constant-time.
+ *
+ * @example const result = verifyGatewayIdentity({ headers: req.headers, method: req.method, path: req.originalUrl, secret, protocol });
+ */
+function verifyGatewayIdentity(input) {
+    const { headers, protocol } = input;
+    if (!header(headers, exports.IDENTITY_HEADERS.USER_ID))
+        return { status: 'anonymous' };
+    const signature = header(headers, exports.IDENTITY_HEADERS.SIGNATURE);
+    if (!signature)
+        return { status: 'invalid', reason: 'missing-signature' };
+    if (!signature.startsWith(`${exports.GATEWAY_SIGNATURE_VERSION}=`))
+        return { status: 'invalid', reason: 'bad-version' };
+    const rawTs = header(headers, exports.IDENTITY_HEADERS.TIMESTAMP);
+    const now = input.now ?? Date.now();
+    const tsProblem = checkTimestamp(rawTs, now, input.maxAgeMs ?? exports.DEFAULT_IDENTITY_MAX_AGE_MS, input.maxFutureMs ?? exports.DEFAULT_IDENTITY_MAX_FUTURE_MS);
+    if (tsProblem)
+        return { status: 'invalid', reason: tsProblem };
+    const identity = {};
+    for (const name of protocol.headerOrder)
+        identity[name] = header(headers, name) ?? '';
+    const expected = signGatewayIdentity({ method: input.method, path: input.path, identity, ts: Number(rawTs), secret: input.secret, protocol });
+    if (!(0, crypto_js_1.safeEqual)(signature, expected))
+        return { status: 'invalid', reason: 'bad-signature' };
+    const user = decodeUser(identity, protocol);
+    return user ? { status: 'authenticated', user } : { status: 'invalid', reason: 'bad-payload' };
+}
+/**
+ * Throws unless `secret` is long enough to sign identities. Call at startup.
+ *
+ * @param secret The shared gateway signing secret (env `GATEWAY_SIGNING_SECRET`).
+ * @returns The secret, unchanged.
+ */
+function assertGatewaySecret(secret) {
+    if (!secret || secret.length < exports.MIN_GATEWAY_SECRET_LENGTH) {
+        throw new Error(`Gateway signing secret must be at least ${exports.MIN_GATEWAY_SECRET_LENGTH} characters`);
+    }
+    return secret;
 }
+__exportStar(require("./step-up.js"), exports);
 //# sourceMappingURL=index.js.map

package/dist/cjs/identity/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/identity/index.ts"],"names":[],"mappings":";;;AAuEA,kDAaC;AAQD,sDA6BC;AAGD,sDAEC;AA9HD,mDAA4D;AAG5D;;;;;;;GAOG;AACU,QAAA,gBAAgB,GAAG;IAC9B,OAAO,EAAE,WAAW;IACpB,UAAU,EAAE,cAAc;IAC1B,UAAU,EAAE,cAAc;IAC1B,gBAAgB,EAAE,oBAAoB;IACtC,WAAW,EAAE,eAAe;IAC5B,UAAU,EAAE,cAAc;IAC1B,UAAU,EAAE,cAAc;IAC1B,SAAS,EAAE,cAAc;IACzB,SAAS,EAAE,gBAAgB;CACnB,CAAC;AAEE,QAAA,eAAe,GAAG;IAC7B,cAAc,EAAE,kBAAkB;IAClC,OAAO,EAAE,WAAW;IACpB,QAAQ,EAAE,YAAY;IACtB,SAAS,EAAE,aAAa;IACxB,eAAe,EAAE,2BAA2B;IAC5C,cAAc,EAAE,kBAAkB;CAC1B,CAAC;AAEX,0DAA0D;AAC7C,QAAA,iBAAiB,GAAsB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,wBAAgB,CAAC,EAAE,uBAAe,CAAC,eAAe,EAAE,uBAAe,CAAC,SAAS,CAAC,CAAC;AAErJ,MAAM,mBAAmB,GAAG,CAAC,GAAG,MAAM,CAAC;AAIvC,SAAS,MAAM,CAAC,OAAkB,EAAE,IAAY;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC;AAED,SAAS,SAAS,CAAC,MAA8B;IAC/C,OAAO;QACL,MAAM,CAAC,wBAAgB,CAAC,SAAS,CAAC;QAClC,MAAM,CAAC,wBAAgB,CAAC,OAAO,CAAC;QAChC,MAAM,CAAC,wBAAgB,CAAC,UAAU,CAAC;QACnC,MAAM,CAAC,wBAAgB,CAAC,UAAU,CAAC;QACnC,MAAM,CAAC,wBAAgB,CAAC,gBAAgB,CAAC;QACzC,MAAM,CAAC,wBAAgB,CAAC,WAAW,CAAC;QACpC,MAAM,CAAC,wBAAgB,CAAC,UAAU,CAAC;QACnC,MAAM,CAAC,wBAAgB,CAAC,UAAU,CAAC;KACpC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,KAAe,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACxD,MAAM,UAAU,GAAG,CAAC,KAAyB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACvH,MAAM,UAAU,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAEtG,SAAS,UAAU,CAAI,KAAyB,EAAE,QAAW;IAC3D,IAAI,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAM,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,SAAgB,mBAAmB,CAAC,IAAc,EAAE,MAAc,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IAC1F,MAAM,MAAM,GAA2B;QACrC,CAAC,wBAAgB,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC;QACzC,CAAC,wBAAgB,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE;QACnC,CAAC,wBAAgB,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;QAC/C,CAAC,wBAAgB,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QACrD,CAAC,wBAAgB,CAAC,gBAAgB,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;QACjE,CAAC,wBAAgB,CAAC,WAAW,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;QACvD,CAAC,wBAAgB,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QACrD,CAAC,wBAAgB,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,SAAS,IAAI,EAAE;KACpD,CAAC;IACF,MAAM,CAAC,wBAAgB,CAAC,SAAS,CAAC,GAAG,IAAA,sBAAU,EAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3E,OAAO,MAAM,CAAC;AAChB,CAAC;AAOD,uEAAuE;AACvE,SAAgB,qBAAqB,CAAC,OAAkB,EAAE,MAAc,EAAE,UAAgD,EAAE;IAC1H,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,EAAE,wBAAgB,CAAC,OAAO,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAE5C,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,wBAAgB,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IAE/F,MAAM,SAAS,GAAG,MAAM,CAAC,wBAAgB,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,CAAC,SAAS,IAAI,CAAC,IAAA,qBAAS,EAAC,SAAS,EAAE,IAAA,sBAAU,EAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACxD,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,wBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,mBAAmB,CAAC,EAAE,CAAC;QAC5F,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC1D,CAAC;IAED,OAAO;QACL,MAAM,EAAE,eAAe;QACvB,IAAI,EAAE;YACJ,EAAE,EAAE,MAAM;YACV,KAAK,EAAE,MAAM,CAAC,wBAAgB,CAAC,UAAU,CAAC,IAAI,EAAE;YAChD,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,wBAAgB,CAAC,UAAU,CAAC,CAAC;YACtD,WAAW,EAAE,UAAU,CAAC,MAAM,CAAC,wBAAgB,CAAC,gBAAgB,CAAC,CAAC;YAClE,MAAM,EAAE,UAAU,CAA2B,MAAM,CAAC,wBAAgB,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;YACtF,KAAK,EAAE,UAAU,CAA0B,MAAM,CAAC,wBAAgB,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACnF,SAAS,EAAE,MAAM,CAAC,wBAAgB,CAAC,UAAU,CAAC,IAAI,SAAS;SAC5D;KACF,CAAC;AACJ,CAAC;AAED,iEAAiE;AACjE,SAAgB,qBAAqB,CAAC,OAAkB;IACtD,KAAK,MAAM,IAAI,IAAI,yBAAiB;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;AAC7D,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/identity/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AA2FA,wDAiBC;AAUD,4CAEC;AASD,sDAEC;AAiBD,sCAGC;AA0BD,oDAqBC;AAkCD,kDAEC;AAsBD,sDAKC;AAkED,sDAoBC;AAQD,kDAKC;AAxWD,mDAA4D;AAG5D;;;;;;;;;;;GAWG;AACU,QAAA,gBAAgB,GAAG;IAC9B,OAAO,EAAE,WAAW;IACpB,UAAU,EAAE,cAAc;IAC1B,UAAU,EAAE,cAAc;IAC1B,gBAAgB,EAAE,oBAAoB;IACtC,WAAW,EAAE,iBAAiB;IAC9B,YAAY,EAAE,gBAAgB;IAC9B,UAAU,EAAE,cAAc;IAC1B,UAAU,EAAE,cAAc;IAC1B,WAAW,EAAE,eAAe;IAC5B,UAAU,EAAE,cAAc;IAC1B,SAAS,EAAE,cAAc;IACzB,SAAS,EAAE,qBAAqB;CACxB,CAAC;AAEX,kHAAkH;AACrG,QAAA,eAAe,GAAG;IAC7B,cAAc,EAAE,kBAAkB;IAClC,OAAO,EAAE,WAAW;IACpB,QAAQ,EAAE,YAAY;IACtB,SAAS,EAAE,aAAa;IACxB,eAAe,EAAE,2BAA2B;IAC5C,qBAAqB,EAAE,yBAAyB;IAChD,eAAe,EAAE,iBAAiB;CAC1B,CAAC;AAEX,iEAAiE;AACpD,QAAA,yBAAyB,GAAG,IAAI,CAAC;AAC9C,kEAAkE;AACrD,QAAA,2BAA2B,GAAG,MAAM,CAAC;AAClD,kFAAkF;AACrE,QAAA,8BAA8B,GAAG,KAAK,CAAC;AACpD,2DAA2D;AAC9C,QAAA,yBAAyB,GAAG,EAAE,CAAC;AAqB5C,MAAM,SAAS,GAAG,CAAC,wBAAgB,CAAC,OAAO,EAAE,wBAAgB,CAAC,UAAU,CAAU,CAAC;AACnF,MAAM,SAAS,GAAG;IAChB,wBAAgB,CAAC,UAAU;IAC3B,wBAAgB,CAAC,gBAAgB;IACjC,wBAAgB,CAAC,WAAW;IAC5B,wBAAgB,CAAC,YAAY;IAC7B,wBAAgB,CAAC,UAAU;IAC3B,wBAAgB,CAAC,UAAU;IAC3B,wBAAgB,CAAC,WAAW;IAC5B,wBAAgB,CAAC,UAAU;CACnB,CAAC;AACX,MAAM,WAAW,GAAG,gBAAgB,CAAC;AACrC,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,wBAAgB,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,uBAAe,CAAC,CAAC,CAAC,CAAC;AAE/H;;;;;;;GAOG;AACH,SAAgB,sBAAsB,CAAC,KAA4B;IACjE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IACnG,MAAM,YAAY,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;IACvD,MAAM,WAAW,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;IACrD,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IAC/E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,kCAAkC,CAAC,CAAC;QACjH,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,6BAA6B,CAAC,CAAC;QACxI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;QACzC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;QACvC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;KACpE,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,gBAAgB,CAAC,QAA0B;IACzD,OAAO,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,wBAAgB,CAAC,SAAS,EAAE,wBAAgB,CAAC,SAAS,EAAE,uBAAe,CAAC,eAAe,EAAE,uBAAe,CAAC,qBAAqB,EAAE,uBAAe,CAAC,SAAS,CAAC,CAAC;AAC9L,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,qBAAqB,CAAC,OAAkB,EAAE,QAA0B;IAClF,KAAK,MAAM,IAAI,IAAI,gBAAgB,CAAC,QAAQ,CAAC;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;AACtE,CAAC;AAKD,SAAS,MAAM,CAAC,OAAkB,EAAE,IAAY;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,aAAa,CAAC,IAAY;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,QAA2B,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACtE,MAAM,UAAU,GAAG,CAAC,KAAyB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACvH,MAAM,UAAU,GAAG,CAAC,KAA8B,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACnJ,MAAM,QAAQ,GAAG,CAAI,MAAyB,EAAE,IAAuB,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE1J,SAAS,UAAU,CAAmB,KAAyB;IAC7D,IAAI,CAAC,KAAK;QAAE,OAAO,EAAO,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACrF,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IACpG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,oBAAoB,CAAC,IAAc,EAAE,QAA0B;IAC7E,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,MAAM,GAA2B;QACrC,CAAC,wBAAgB,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE;QACnC,CAAC,wBAAgB,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;QAC/C,CAAC,wBAAgB,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QACrD,CAAC,wBAAgB,CAAC,gBAAgB,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;QACjE,CAAC,wBAAgB,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;QACpE,CAAC,wBAAgB,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;QACpE,CAAC,wBAAgB,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;QACnG,CAAC,wBAAgB,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,SAAS,IAAI,EAAE;QACnD,CAAC,wBAAgB,CAAC,WAAW,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,SAAS,CAAC,CAAC;QAClF,CAAC,wBAAgB,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;KAChF,CAAC;IACF,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/G,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAeD,SAAS,eAAe,CAAC,KAA+C;IACtE,MAAM,MAAM,GAAG;QACb,KAAK,CAAC,QAAQ,CAAC,MAAM;QACrB,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE;QAC1B,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC;QACzB,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAChB,GAAG,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;KACxE,CAAC;IACF,sFAAsF;IACtF,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,mBAAmB,CAAC,KAA+B;IACjE,OAAO,GAAG,iCAAyB,IAAI,IAAA,sBAAU,EAAC,KAAK,CAAC,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;AAC5F,CAAC;AAaD;;;;;;;;GAQG;AACH,SAAgB,qBAAqB,CAAC,KAAiC;IACrE,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,mBAAmB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IAChJ,OAAO,EAAE,GAAG,QAAQ,EAAE,CAAC,wBAAgB,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,wBAAgB,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;AAC5G,CAAC;AAuBD,SAAS,cAAc,CAAC,GAAuB,EAAE,GAAW,EAAE,QAAgB,EAAE,WAAmB;IACjG,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,eAAe,CAAC;IACvD,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACvB,IAAI,GAAG,GAAG,EAAE,GAAG,QAAQ;QAAE,OAAO,OAAO,CAAC;IACxC,IAAI,EAAE,GAAG,GAAG,GAAG,WAAW;QAAE,OAAO,QAAQ,CAAC;IAC5C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CAAC,MAA8B,EAAE,QAA0B;IAC5E,MAAM,MAAM,GAAG,UAAU,CAA2B,MAAM,CAAC,wBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1F,MAAM,KAAK,GAAG,UAAU,CAA0B,MAAM,CAAC,wBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC;IACvF,MAAM,SAAS,GAAG,MAAM,CAAC,wBAAgB,CAAC,UAAU,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAChE,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACrC,IAAI,GAAG,CAAC,MAAM;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACpC,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/D,IAAI,MAAM,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,IAAI,GAAa;QACrB,EAAE,EAAE,MAAM,CAAC,wBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE;QAC1C,KAAK,EAAE,MAAM,CAAC,wBAAgB,CAAC,UAAU,CAAC,IAAI,EAAE;QAChD,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,wBAAgB,CAAC,UAAU,CAAC,CAAC;QACtD,WAAW,EAAE,UAAU,CAAC,MAAM,CAAC,wBAAgB,CAAC,gBAAgB,CAAC,CAAC;QAClE,MAAM;QACN,KAAK;QACL,YAAY,EAAE,MAAM,CAAC,wBAAgB,CAAC,WAAW,CAAC,KAAK,MAAM;QAC7D,WAAW,EAAE,MAAM,CAAC,wBAAgB,CAAC,YAAY,CAAC,KAAK,MAAM;KAC9D,CAAC;IACF,IAAI,MAAM,CAAC,wBAAgB,CAAC,UAAU,CAAC;QAAE,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,wBAAgB,CAAC,UAAU,CAAC,CAAC;IAC9F,IAAI,SAAS;QAAE,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,qBAAqB,CAAC,KAAiC;IACrE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IACpC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,wBAAgB,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAE/E,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,EAAE,wBAAgB,CAAC,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC1E,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,iCAAyB,GAAG,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAEhH,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,EAAE,wBAAgB,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,IAAI,mCAA2B,EAAE,KAAK,CAAC,WAAW,IAAI,sCAA8B,CAAC,CAAC;IACjJ,IAAI,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAE/D,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,WAAW;QAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IACtF,MAAM,QAAQ,GAAG,mBAAmB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9I,IAAI,CAAC,IAAA,qBAAS,EAAC,SAAS,EAAE,QAAQ,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAE3F,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC5C,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;AACjG,CAAC;AAED;;;;;GAKG;AACH,SAAgB,mBAAmB,CAAC,MAA0B;IAC5D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,iCAAyB,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,2CAA2C,iCAAyB,aAAa,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+CAA6B"}

package/dist/cjs/identity/step-up.js

@@ -0,0 +1,52 @@
+"use strict";
+/**
+ * Step-up (re-authentication) scopes. The gateway checks the client's step-up proof for the route's
+ * scope and forwards the verified time as the signed `x-step-up-at` header; services only check that
+ * the time is fresh. Scope names and their rules are app values, declared once with
+ * {@link defineStepUpScopes}.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.STEP_UP_REQUIRED_CODE = exports.STEP_UP_MAX_FUTURE_MS = exports.DEFAULT_STEP_UP_WINDOW_MS = void 0;
+exports.defineStepUpScopes = defineStepUpScopes;
+exports.stepUpStatus = stepUpStatus;
+/** Default freshness window for a step-up verification. */
+exports.DEFAULT_STEP_UP_WINDOW_MS = 5 * 60_000;
+/** A step-up time this far ahead of the service clock is still accepted (clock skew). */
+exports.STEP_UP_MAX_FUTURE_MS = 5_000;
+/** Error code of the 403 a service returns when a fresh step-up is required. */
+exports.STEP_UP_REQUIRED_CODE = 'STEP_UP_REQUIRED';
+const SCOPE_NAME = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
+/**
+ * Validates and freezes an app's step-up scope catalogue (kebab-case names). Throws at startup on a bad name.
+ *
+ * @param catalogue Scope name → rules.
+ * @returns The frozen catalogue; its keys type `requireStepUp`'s scope argument.
+ * @example export const stepUpScopes = defineStepUpScopes({ 'refund-large': {}, 'payout-destination': { singleUse: true } });
+ */
+function defineStepUpScopes(catalogue) {
+    const entries = Object.entries(catalogue);
+    if (!entries.length)
+        throw new Error('defineStepUpScopes: catalogue is empty');
+    for (const [name] of entries) {
+        if (!SCOPE_NAME.test(name))
+            throw new Error(`defineStepUpScopes: "${name}" must be kebab-case`);
+    }
+    return Object.freeze(Object.fromEntries(entries.map(([name, rules]) => [name, Object.freeze({ ...rules })])));
+}
+/**
+ * Whether a gateway-verified step-up time is usable now.
+ *
+ * @param stepUpAt Epoch milliseconds of the step-up, or undefined when none was made.
+ * @param windowMs How old the step-up may be.
+ * @param now Current epoch milliseconds.
+ * @returns `fresh` when usable; otherwise why not.
+ * @example stepUpStatus(req.user?.stepUpAt, DEFAULT_STEP_UP_WINDOW_MS) === 'fresh'
+ */
+function stepUpStatus(stepUpAt, windowMs, now = Date.now()) {
+    if (stepUpAt === undefined || !Number.isFinite(stepUpAt))
+        return 'missing';
+    if (stepUpAt - now > exports.STEP_UP_MAX_FUTURE_MS)
+        return 'future';
+    return now - stepUpAt > windowMs ? 'stale' : 'fresh';
+}
+//# sourceMappingURL=step-up.js.map

package/dist/cjs/identity/step-up.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-up.js","sourceRoot":"","sources":["../../../src/identity/step-up.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AA6BH,gDAOC;AAaD,oCAIC;AAxCD,2DAA2D;AAC9C,QAAA,yBAAyB,GAAG,CAAC,GAAG,MAAM,CAAC;AACpD,yFAAyF;AAC5E,QAAA,qBAAqB,GAAG,KAAK,CAAC;AAC3C,gFAAgF;AACnE,QAAA,qBAAqB,GAAG,kBAAkB,CAAC;AAExD,MAAM,UAAU,GAAG,iCAAiC,CAAC;AAErD;;;;;;GAMG;AACH,SAAgB,kBAAkB,CAAmB,SAA2C;IAC9F,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAsC,CAAC;IAC/E,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC/E,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,sBAAsB,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAuB,CAAC;AACtI,CAAC;AAID;;;;;;;;GAQG;AACH,SAAgB,YAAY,CAAC,QAA4B,EAAE,QAAgB,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IACnG,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3E,IAAI,QAAQ,GAAG,GAAG,GAAG,6BAAqB;QAAE,OAAO,QAAQ,CAAC;IAC5D,OAAO,GAAG,GAAG,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;AACvD,CAAC"}

package/dist/cjs/index.js

@@ -19,11 +19,18 @@ Object.defineProperty(exports, "__esModule", { value: true });
 // live behind subpaths: `@heavybit/shared-lib/express`, `/cache`, `/messaging`, …
 __exportStar(require("./types/index.js"), exports);
 __exportStar(require("./common/index.js"), exports);
+__exportStar(require("./context/index.js"), exports);
 __exportStar(require("./identity/index.js"), exports);
 __exportStar(require("./access/index.js"), exports);
 __exportStar(require("./validation/index.js"), exports);
 __exportStar(require("./logging/index.js"), exports);
 __exportStar(require("./config/index.js"), exports);
+__exportStar(require("./cache/keyspace.js"), exports);
+__exportStar(require("./rate-limit/keys.js"), exports);
 __exportStar(require("./contracts/index.js"), exports);
 __exportStar(require("./alerting/index.js"), exports);
+__exportStar(require("./database/pagination.js"), exports);
+__exportStar(require("./audit/index.js"), exports);
+__exportStar(require("./approvals/index.js"), exports);
+__exportStar(require("./socket/ticket.js"), exports);
 //# sourceMappingURL=index.js.map

package/dist/cjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,6EAA6E;AAC7E,8FAA8F;AAC9F,kFAAkF;AAClF,mDAAiC;AACjC,oDAAkC;AAClC,sDAAoC;AACpC,oDAAkC;AAClC,wDAAsC;AACtC,qDAAmC;AACnC,oDAAkC;AAClC,uDAAqC;AACrC,sDAAoC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,6EAA6E;AAC7E,8FAA8F;AAC9F,kFAAkF;AAClF,mDAAiC;AACjC,oDAAkC;AAClC,qDAAmC;AACnC,sDAAoC;AACpC,oDAAkC;AAClC,wDAAsC;AACtC,qDAAmC;AACnC,oDAAkC;AAClC,sDAAoC;AACpC,uDAAqC;AACrC,uDAAqC;AACrC,sDAAoC;AACpC,2DAAyC;AACzC,mDAAiC;AACjC,uDAAqC;AACrC,qDAAmC"}

package/dist/cjs/knex/columns.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ulidPrimary = ulidPrimary;
+exports.ulidColumn = ulidColumn;
+exports.timestamps = timestamps;
+exports.actorColumns = actorColumns;
+exports.datetime = datetime;
+exports.createdAtColumn = createdAtColumn;
+/** Column primitives shared by every migration helper (one definition of ULID and DATETIME(3) columns). */
+/** `id CHAR(26)` primary key for ULIDs. */
+function ulidPrimary(table, name = 'id') {
+    table.specificType(name, 'char(26)').notNullable().primary();
+}
+/** `CHAR(26)` column referencing another ULID (FK constraints only within the same database). */
+function ulidColumn(table, name) {
+    return table.specificType(name, 'char(26)');
+}
+/** `created_at` / `updated_at` as `DATETIME(3)` in UTC, maintained by MySQL. */
+function timestamps(table, knex) {
+    createdAtColumn(table, knex);
+    datetime(table, 'updated_at').notNullable().defaultTo(knex.raw('CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)'));
+}
+/** `created_by` / `updated_by` actor columns (null for system operations). */
+function actorColumns(table) {
+    ulidColumn(table, 'created_by').nullable();
+    ulidColumn(table, 'updated_by').nullable();
+}
+/** Nullable `DATETIME(3)` column. */
+function datetime(table, name) {
+    return table.specificType(name, 'datetime(3)');
+}
+/** `DATETIME(3)` column defaulting to `CURRENT_TIMESTAMP(3)` (insert time, UTC). */
+function createdAtColumn(table, knex, name = 'created_at') {
+    return datetime(table, name).notNullable().defaultTo(knex.raw('CURRENT_TIMESTAMP(3)'));
+}
+//# sourceMappingURL=columns.js.map

package/dist/cjs/knex/columns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"columns.js","sourceRoot":"","sources":["../../../src/knex/columns.ts"],"names":[],"mappings":";;AAKA,kCAEC;AAGD,gCAEC;AAGD,gCAGC;AAGD,oCAGC;AAGD,4BAEC;AAGD,0CAEC;AAhCD,2GAA2G;AAE3G,2CAA2C;AAC3C,SAAgB,WAAW,CAAC,KAA8B,EAAE,IAAI,GAAG,IAAI;IACrE,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,CAAC;AAC/D,CAAC;AAED,iGAAiG;AACjG,SAAgB,UAAU,CAAC,KAAuD,EAAE,IAAY;IAC9F,OAAO,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AAC9C,CAAC;AAED,gFAAgF;AAChF,SAAgB,UAAU,CAAC,KAA8B,EAAE,IAAU;IACnE,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC,CAAC;AACzH,CAAC;AAED,8EAA8E;AAC9E,SAAgB,YAAY,CAAC,KAA8B;IACzD,UAAU,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3C,UAAU,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;AAC7C,CAAC;AAED,qCAAqC;AACrC,SAAgB,QAAQ,CAAC,KAAuD,EAAE,IAAY;IAC5F,OAAO,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;AACjD,CAAC;AAED,oFAAoF;AACpF,SAAgB,eAAe,CAAC,KAA8B,EAAE,IAAU,EAAE,IAAI,GAAG,YAAY;IAC7F,OAAO,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC;AACzF,CAAC"}

package/dist/cjs/knex/index.js

@@ -1,39 +1,31 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ulidPrimary = ulidPrimary;
-exports.ulidColumn = ulidColumn;
-exports.timestamps = timestamps;
-exports.actorColumns = actorColumns;
-exports.datetime = datetime;
 exports.createAuditTable = createAuditTable;
 exports.createOutboxTable = createOutboxTable;
 exports.utf8mb4 = utf8mb4;
+const table_names_js_1 = require("../database/table-names.js");
+const columns_js_1 = require("./columns.js");
+const migration_helpers_js_1 = require("./migration-helpers.js");
+__exportStar(require("./columns.js"), exports);
+__exportStar(require("./migration-helpers.js"), exports);
 /**
  * Migration helpers (usable from CommonJS `.cjs` migrations via `require('@heavybit/shared-lib/knex')`).
  * They keep ID, timestamp and audit column definitions identical across services.
  */
-/** `id CHAR(26)` primary key for ULIDs. */
-function ulidPrimary(table, name = 'id') {
-    table.specificType(name, 'char(26)').notNullable().primary();
-}
-/** `CHAR(26)` column referencing another ULID (FK constraints only within the same database). */
-function ulidColumn(table, name) {
-    return table.specificType(name, 'char(26)');
-}
-/** `created_at` / `updated_at` as `DATETIME(3)` in UTC, maintained by MySQL. */
-function timestamps(table, knex) {
-    table.specificType('created_at', 'datetime(3)').notNullable().defaultTo(knex.raw('CURRENT_TIMESTAMP(3)'));
-    table.specificType('updated_at', 'datetime(3)').notNullable().defaultTo(knex.raw('CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)'));
-}
-/** `created_by` / `updated_by` actor columns (null for system operations). */
-function actorColumns(table) {
-    ulidColumn(table, 'created_by').nullable();
-    ulidColumn(table, 'updated_by').nullable();
-}
-/** Nullable `DATETIME(3)` column. */
-function datetime(table, name) {
-    return table.specificType(name, 'datetime(3)');
-}
 /**
  * Creates `<parent>_audits`: every parent column (defined again by `columns`) plus `parent_id`
  * and `action`. Audit rows are append-only history, so no unique constraints are copied.
@@ -43,29 +35,20 @@ async function createAuditTable(knex, parentTable, columns) {
     if (await knex.schema.hasTable(name))
         return;
     await knex.schema.createTable(name, (table) => {
-        ulidPrimary(table);
-        ulidColumn(table, 'parent_id').notNullable().index();
+        (0, columns_js_1.ulidPrimary)(table);
+        (0, columns_js_1.ulidColumn)(table, 'parent_id').notNullable().index();
         table.enu('action', ['create', 'update', 'delete']).notNullable();
         columns(table);
-        actorColumns(table);
-        timestamps(table, knex);
+        (0, columns_js_1.actorColumns)(table);
+        (0, columns_js_1.timestamps)(table, knex);
         table.index(['parent_id', 'created_at']);
     });
 }
-/** Transactional outbox table used by `OutboxRelay`. */
-async function createOutboxTable(knex, name = 'event_outbox') {
+/** Transactional outbox table used by `OutboxRelay` (columns from {@link outboxColumns}). */
+async function createOutboxTable(knex, name = table_names_js_1.DEFAULT_OUTBOX_TABLE) {
     if (await knex.schema.hasTable(name))
         return;
-    await knex.schema.createTable(name, (table) => {
-        ulidPrimary(table);
-        table.string('routing_key', 191).notNullable();
-        table.json('payload').notNullable();
-        table.integer('attempts').unsigned().notNullable().defaultTo(0);
-        table.string('last_error', 500).nullable();
-        table.specificType('created_at', 'datetime(3)').notNullable().defaultTo(knex.raw('CURRENT_TIMESTAMP(3)'));
-        datetime(table, 'published_at').nullable();
-        table.index(['published_at', 'id']);
-    });
+    await knex.schema.createTable(name, (table) => (0, migration_helpers_js_1.outboxColumns)(table, knex));
 }
 /** Standard table options: InnoDB, utf8mb4. Call inside `createTable`. */
 function utf8mb4(table) {