@heavybit/shared-lib 2.1.0 → 2.7.0

package/dist/esm/identity/index.js

@@ -1,111 +1,293 @@
 import { hmacSha256, safeEqual } from '../common/crypto.js';
 /**
- * Header contract between the gateway and downstream services.
+ * Gateway identity protocol, version 2.
  *
- * The gateway strips any client-supplied identity headers, then writes these and signs them with
- * `x-gateway-auth` = HMAC-SHA256(secret, canonical string). Services verify the signature and
- * timestamp before trusting anything, so a request that bypasses the gateway on the internal
- * network cannot forge an identity.
+ * The gateway strips every client-supplied identity header, writes the headers below for the
+ * authenticated caller and signs them with `x-gateway-signature: v2=<hex>`. The signature is an
+ * HMAC-SHA256 over an app-chosen domain separator, the HTTP method, the canonical path (no query),
+ * the gateway timestamp and every identity header in a fixed order. A request that bypasses the
+ * gateway, is replayed later, or is replayed against another route cannot carry a forged identity.
+ *
+ * App-specific identity fields (for example a tenant id) travel in their own headers through an
+ * {@link IdentityProtocol} mapping, so this module never names an app concept.
  */
 export const IDENTITY_HEADERS = {
     USER_ID: 'x-user-id',
     USER_EMAIL: 'x-user-email',
     USER_ROLES: 'x-user-roles',
     USER_PERMISSIONS: 'x-user-permissions',
+    SUPER_ADMIN: 'x-is-superadmin',
+    OTP_VERIFIED: 'x-otp-verified',
+    STEP_UP_AT: 'x-step-up-at',
+    SESSION_ID: 'x-session-id',
     USER_SCOPES: 'x-user-scopes',
     USER_ATTRS: 'x-user-attrs',
-    SESSION_ID: 'x-session-id',
     TIMESTAMP: 'x-gateway-ts',
-    SIGNATURE: 'x-gateway-auth',
+    SIGNATURE: 'x-gateway-signature',
 };
+/** Non-identity request headers shared by the gateway and services (correlation, client hints, internal auth). */
 export const CONTEXT_HEADERS = {
     CORRELATION_ID: 'x-correlation-id',
     ANON_ID: 'x-anon-id',
     TIMEZONE: 'x-timezone',
     CLIENT_IP: 'x-client-ip',
     INTERNAL_SECRET: 'x-internal-service-secret',
-    CALLER_SERVICE: 'x-caller-service',
+    INTERNAL_SERVICE_NAME: 'x-internal-service-name',
+    IDEMPOTENCY_KEY: 'idempotency-key',
 };
-/** Every header a client must never be allowed to set. */
-export const PROTECTED_HEADERS = [...Object.values(IDENTITY_HEADERS), CONTEXT_HEADERS.INTERNAL_SECRET, CONTEXT_HEADERS.CLIENT_IP];
-const DEFAULT_MAX_SKEW_MS = 5 * 60_000;
+/** Signature version prefix: `x-gateway-signature: v2=<hex>`. */
+export const GATEWAY_SIGNATURE_VERSION = 'v2';
+/** Default maximum age of a gateway timestamp (replay window). */
+export const DEFAULT_IDENTITY_MAX_AGE_MS = 30_000;
+/** Default allowance for a gateway clock that runs ahead of the service clock. */
+export const DEFAULT_IDENTITY_MAX_FUTURE_MS = 5_000;
+/** Minimum length of the shared gateway signing secret. */
+export const MIN_GATEWAY_SECRET_LENGTH = 32;
+const BASE_HEAD = [IDENTITY_HEADERS.USER_ID, IDENTITY_HEADERS.USER_EMAIL];
+const BASE_TAIL = [
+    IDENTITY_HEADERS.USER_ROLES,
+    IDENTITY_HEADERS.USER_PERMISSIONS,
+    IDENTITY_HEADERS.SUPER_ADMIN,
+    IDENTITY_HEADERS.OTP_VERIFIED,
+    IDENTITY_HEADERS.STEP_UP_AT,
+    IDENTITY_HEADERS.SESSION_ID,
+    IDENTITY_HEADERS.USER_SCOPES,
+    IDENTITY_HEADERS.USER_ATTRS,
+];
+const HEADER_NAME = /^x-[a-z0-9-]+$/;
+const RESERVED_HEADERS = new Set([...Object.values(IDENTITY_HEADERS), ...Object.values(CONTEXT_HEADERS)]);
+/**
+ * Validates and freezes an app's identity protocol. Throws at startup on a bad binding so a
+ * misconfiguration can never weaken verification at runtime.
+ *
+ * @param input Domain separator and optional scope/attr header mappings.
+ * @returns The frozen protocol, including the signing order.
+ * @example const protocol = defineIdentityProtocol({ domain: 'shop-gateway-identity:v2', scopeHeaders: { tenant: 'x-tenant-id' } });
+ */
+export function defineIdentityProtocol(input) {
+    if (!input.domain?.trim())
+        throw new Error('defineIdentityProtocol: domain separator is required');
+    const scopeHeaders = { ...(input.scopeHeaders ?? {}) };
+    const attrHeaders = { ...(input.attrHeaders ?? {}) };
+    const mapped = [...Object.values(scopeHeaders), ...Object.values(attrHeaders)];
+    const seen = new Set();
+    for (const name of mapped) {
+        if (!HEADER_NAME.test(name))
+            throw new Error(`defineIdentityProtocol: "${name}" must be a lower-case x- header`);
+        if (RESERVED_HEADERS.has(name) || seen.has(name))
+            throw new Error(`defineIdentityProtocol: header "${name}" is reserved or duplicated`);
+        seen.add(name);
+    }
+    return Object.freeze({
+        domain: input.domain,
+        scopeHeaders: Object.freeze(scopeHeaders),
+        attrHeaders: Object.freeze(attrHeaders),
+        headerOrder: Object.freeze([...BASE_HEAD, ...mapped, ...BASE_TAIL]),
+    });
+}
+/**
+ * Every header a client must never be allowed to set, for a given protocol: identity headers, the gateway
+ * timestamp and signature, both internal-service headers and the client IP.
+ *
+ * @param protocol The app's identity protocol.
+ * @returns Lower-case header names.
+ * @example const blocked = new Set(protectedHeaders(protocol));
+ */
+export function protectedHeaders(protocol) {
+    return [...protocol.headerOrder, IDENTITY_HEADERS.TIMESTAMP, IDENTITY_HEADERS.SIGNATURE, CONTEXT_HEADERS.INTERNAL_SECRET, CONTEXT_HEADERS.INTERNAL_SERVICE_NAME, CONTEXT_HEADERS.CLIENT_IP];
+}
+/**
+ * Removes every protected header in place (gateway ingress), so clients can't forge identity or internal auth.
+ *
+ * @param headers Incoming request headers (mutated).
+ * @param protocol The app's identity protocol.
+ * @example stripProtectedHeaders(req.headers, protocol);
+ */
+export function stripProtectedHeaders(headers, protocol) {
+    for (const name of protectedHeaders(protocol))
+        delete headers[name];
+}
 function header(headers, name) {
     const value = headers[name];
     return Array.isArray(value) ? value[0] : value;
 }
-function canonical(values) {
-    return [
-        values[IDENTITY_HEADERS.TIMESTAMP],
-        values[IDENTITY_HEADERS.USER_ID],
-        values[IDENTITY_HEADERS.USER_EMAIL],
-        values[IDENTITY_HEADERS.USER_ROLES],
-        values[IDENTITY_HEADERS.USER_PERMISSIONS],
-        values[IDENTITY_HEADERS.USER_SCOPES],
-        values[IDENTITY_HEADERS.USER_ATTRS],
-        values[IDENTITY_HEADERS.SESSION_ID],
-    ].join('\n');
+/**
+ * Canonical request path for signing: the path only (query and fragment dropped), always starting with `/`.
+ *
+ * @param path A path or path-plus-query such as `req.originalUrl`.
+ * @returns The path to sign or verify.
+ * @example canonicalPath('/v1/items?page=2') // '/v1/items'
+ */
+export function canonicalPath(path) {
+    const bare = path.split(/[?#]/, 1)[0] ?? '';
+    return bare.startsWith('/') ? bare : `/${bare}`;
 }
-const encodeList = (items) => items.join(',');
+const encodeList = (items = []) => items.join(',');
 const decodeList = (value) => (value ? value.split(',').map((s) => s.trim()).filter(Boolean) : []);
-const encodeJson = (value) => Buffer.from(JSON.stringify(value ?? {})).toString('base64url');
-function decodeJson(value, fallback) {
+const encodeJson = (value) => (Object.keys(value).length ? Buffer.from(JSON.stringify(value)).toString('base64url') : '');
+const omitKeys = (record, keys) => Object.fromEntries(Object.entries(record).filter(([k]) => !keys.includes(k)));
+function decodeJson(value) {
     if (!value)
-        return fallback;
+        return {};
     try {
-        return JSON.parse(Buffer.from(value, 'base64url').toString('utf8'));
+        const parsed = JSON.parse(Buffer.from(value, 'base64url').toString('utf8'));
+        return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : undefined;
     }
     catch {
-        return fallback;
+        return undefined;
     }
 }
-/** Gateway side: headers (including signature) that represent `user`. */
-export function signIdentityHeaders(user, secret, now = Date.now()) {
+/**
+ * Gateway side: the identity header values (unsigned) that represent `user` under `protocol`.
+ * Mapped scopes and string attrs travel in their own headers; the rest go in the JSON headers.
+ *
+ * @param user The authenticated caller.
+ * @param protocol The app's identity protocol.
+ * @returns Header name → value for every header in `protocol.headerOrder`.
+ * @example const identity = buildIdentityHeaders(user, protocol);
+ */
+export function buildIdentityHeaders(user, protocol) {
+    const scopeKeys = Object.keys(protocol.scopeHeaders);
+    const attrKeys = Object.keys(protocol.attrHeaders);
     const values = {
-        [IDENTITY_HEADERS.TIMESTAMP]: String(now),
         [IDENTITY_HEADERS.USER_ID]: user.id,
         [IDENTITY_HEADERS.USER_EMAIL]: user.email ?? '',
         [IDENTITY_HEADERS.USER_ROLES]: encodeList(user.roles),
         [IDENTITY_HEADERS.USER_PERMISSIONS]: encodeList(user.permissions),
-        [IDENTITY_HEADERS.USER_SCOPES]: encodeJson(user.scopes),
-        [IDENTITY_HEADERS.USER_ATTRS]: encodeJson(user.attrs),
+        [IDENTITY_HEADERS.SUPER_ADMIN]: user.isSuperAdmin ? 'true' : 'false',
+        [IDENTITY_HEADERS.OTP_VERIFIED]: user.otpVerified ? 'true' : 'false',
+        [IDENTITY_HEADERS.STEP_UP_AT]: user.stepUpAt !== undefined ? String(Math.trunc(user.stepUpAt)) : '',
         [IDENTITY_HEADERS.SESSION_ID]: user.sessionId ?? '',
+        [IDENTITY_HEADERS.USER_SCOPES]: encodeJson(omitKeys(user.scopes ?? {}, scopeKeys)),
+        [IDENTITY_HEADERS.USER_ATTRS]: encodeJson(omitKeys(user.attrs ?? {}, attrKeys)),
     };
-    values[IDENTITY_HEADERS.SIGNATURE] = hmacSha256(secret, canonical(values));
+    for (const [key, name] of Object.entries(protocol.scopeHeaders))
+        values[name] = encodeList(user.scopes?.[key]);
+    for (const [key, name] of Object.entries(protocol.attrHeaders)) {
+        const attr = user.attrs?.[key];
+        values[name] = typeof attr === 'string' ? attr : '';
+    }
     return values;
 }
-/** Service side: verifies and decodes the gateway identity headers. */
-export function verifyIdentityHeaders(headers, secret, options = {}) {
-    const userId = header(headers, IDENTITY_HEADERS.USER_ID);
-    if (!userId)
-        return { status: 'anonymous' };
-    const values = {};
-    for (const name of Object.values(IDENTITY_HEADERS))
-        values[name] = header(headers, name) ?? '';
-    const signature = values[IDENTITY_HEADERS.SIGNATURE];
-    if (!signature || !safeEqual(signature, hmacSha256(secret, canonical(values)))) {
-        return { status: 'invalid', reason: 'bad-signature' };
+function canonicalString(input) {
+    const fields = [
+        input.protocol.domain,
+        input.method.toUpperCase(),
+        canonicalPath(input.path),
+        String(input.ts),
+        ...input.protocol.headerOrder.map((name) => input.identity[name] ?? ''),
+    ];
+    // JSON array encoding keeps field boundaries unambiguous whatever the values contain.
+    return JSON.stringify(fields);
+}
+/**
+ * Signs an identity for one request.
+ *
+ * @param input Method, path, identity headers, timestamp, secret and protocol.
+ * @returns The `x-gateway-signature` value, `v2=<hex>`.
+ * @example headers['x-gateway-signature'] = signGatewayIdentity({ method, path, identity, ts, secret, protocol });
+ */
+export function signGatewayIdentity(input) {
+    return `${GATEWAY_SIGNATURE_VERSION}=${hmacSha256(input.secret, canonicalString(input))}`;
+}
+/**
+ * Gateway side convenience: every identity header plus `x-gateway-ts` and `x-gateway-signature`. Also used by a
+ * service acting for a user to re-sign the identity for one internal call (signatures bind method and path).
+ *
+ * @param input User, method, path, secret, protocol and optional time.
+ * @returns Headers to add to the outgoing request.
+ *
+ * @example Object.assign(proxyHeaders, signedIdentityHeaders({ user, method: req.method, path: upstreamPath, secret, protocol }));
+ */
+export function signedIdentityHeaders(input) {
+    const ts = input.now ?? Date.now();
+    const identity = buildIdentityHeaders(input.user, input.protocol);
+    const signature = signGatewayIdentity({ method: input.method, path: input.path, identity, ts, secret: input.secret, protocol: input.protocol });
+    return { ...identity, [IDENTITY_HEADERS.TIMESTAMP]: String(ts), [IDENTITY_HEADERS.SIGNATURE]: signature };
+}
+function checkTimestamp(raw, now, maxAgeMs, maxFutureMs) {
+    if (!raw || !/^\d+$/.test(raw))
+        return 'bad-timestamp';
+    const ts = Number(raw);
+    if (now - ts > maxAgeMs)
+        return 'stale';
+    if (ts - now > maxFutureMs)
+        return 'future';
+    return null;
+}
+function decodeUser(values, protocol) {
+    const scopes = decodeJson(values[IDENTITY_HEADERS.USER_SCOPES]);
+    const attrs = decodeJson(values[IDENTITY_HEADERS.USER_ATTRS]);
+    const stepUpRaw = values[IDENTITY_HEADERS.STEP_UP_AT];
+    if (!scopes || !attrs || (stepUpRaw && !/^\d+$/.test(stepUpRaw)))
+        return null;
+    for (const [key, name] of Object.entries(protocol.scopeHeaders)) {
+        const ids = decodeList(values[name]);
+        if (ids.length)
+            scopes[key] = ids;
     }
-    const ts = Number(values[IDENTITY_HEADERS.TIMESTAMP]);
-    const now = options.now ?? Date.now();
-    if (!Number.isFinite(ts) || Math.abs(now - ts) > (options.maxSkewMs ?? DEFAULT_MAX_SKEW_MS)) {
-        return { status: 'invalid', reason: 'stale-signature' };
+    for (const [key, name] of Object.entries(protocol.attrHeaders)) {
+        if (values[name])
+            attrs[key] = values[name];
     }
-    return {
-        status: 'authenticated',
-        user: {
-            id: userId,
-            email: values[IDENTITY_HEADERS.USER_EMAIL] ?? '',
-            roles: decodeList(values[IDENTITY_HEADERS.USER_ROLES]),
-            permissions: decodeList(values[IDENTITY_HEADERS.USER_PERMISSIONS]),
-            scopes: decodeJson(values[IDENTITY_HEADERS.USER_SCOPES], {}),
-            attrs: decodeJson(values[IDENTITY_HEADERS.USER_ATTRS], {}),
-            sessionId: values[IDENTITY_HEADERS.SESSION_ID] || undefined,
-        },
+    const user = {
+        id: values[IDENTITY_HEADERS.USER_ID] ?? '',
+        email: values[IDENTITY_HEADERS.USER_EMAIL] ?? '',
+        roles: decodeList(values[IDENTITY_HEADERS.USER_ROLES]),
+        permissions: decodeList(values[IDENTITY_HEADERS.USER_PERMISSIONS]),
+        scopes,
+        attrs,
+        isSuperAdmin: values[IDENTITY_HEADERS.SUPER_ADMIN] === 'true',
+        otpVerified: values[IDENTITY_HEADERS.OTP_VERIFIED] === 'true',
     };
+    if (values[IDENTITY_HEADERS.SESSION_ID])
+        user.sessionId = values[IDENTITY_HEADERS.SESSION_ID];
+    if (stepUpRaw)
+        user.stepUpAt = Number(stepUpRaw);
+    return user;
 }
-/** Removes every protected header in place (gateway ingress). */
-export function stripProtectedHeaders(headers) {
-    for (const name of PROTECTED_HEADERS)
-        delete headers[name];
+/**
+ * Service side: verifies and decodes the gateway identity. No `x-user-id` → anonymous. Otherwise the
+ * request is rejected unless the signature is present, version `v2`, made for this method, path and
+ * protocol, and the timestamp is at most `maxAgeMs` old (default 30 s) and at most `maxFutureMs` ahead
+ * (default 5 s). The comparison is constant-time.
+ *
+ * @example const result = verifyGatewayIdentity({ headers: req.headers, method: req.method, path: req.originalUrl, secret, protocol });
+ */
+export function verifyGatewayIdentity(input) {
+    const { headers, protocol } = input;
+    if (!header(headers, IDENTITY_HEADERS.USER_ID))
+        return { status: 'anonymous' };
+    const signature = header(headers, IDENTITY_HEADERS.SIGNATURE);
+    if (!signature)
+        return { status: 'invalid', reason: 'missing-signature' };
+    if (!signature.startsWith(`${GATEWAY_SIGNATURE_VERSION}=`))
+        return { status: 'invalid', reason: 'bad-version' };
+    const rawTs = header(headers, IDENTITY_HEADERS.TIMESTAMP);
+    const now = input.now ?? Date.now();
+    const tsProblem = checkTimestamp(rawTs, now, input.maxAgeMs ?? DEFAULT_IDENTITY_MAX_AGE_MS, input.maxFutureMs ?? DEFAULT_IDENTITY_MAX_FUTURE_MS);
+    if (tsProblem)
+        return { status: 'invalid', reason: tsProblem };
+    const identity = {};
+    for (const name of protocol.headerOrder)
+        identity[name] = header(headers, name) ?? '';
+    const expected = signGatewayIdentity({ method: input.method, path: input.path, identity, ts: Number(rawTs), secret: input.secret, protocol });
+    if (!safeEqual(signature, expected))
+        return { status: 'invalid', reason: 'bad-signature' };
+    const user = decodeUser(identity, protocol);
+    return user ? { status: 'authenticated', user } : { status: 'invalid', reason: 'bad-payload' };
+}
+/**
+ * Throws unless `secret` is long enough to sign identities. Call at startup.
+ *
+ * @param secret The shared gateway signing secret (env `GATEWAY_SIGNING_SECRET`).
+ * @returns The secret, unchanged.
+ */
+export function assertGatewaySecret(secret) {
+    if (!secret || secret.length < MIN_GATEWAY_SECRET_LENGTH) {
+        throw new Error(`Gateway signing secret must be at least ${MIN_GATEWAY_SECRET_LENGTH} characters`);
+    }
+    return secret;
 }
+export * from './step-up.js';
 //# sourceMappingURL=index.js.map

package/dist/esm/identity/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/identity/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAG5D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,OAAO,EAAE,WAAW;IACpB,UAAU,EAAE,cAAc;IAC1B,UAAU,EAAE,cAAc;IAC1B,gBAAgB,EAAE,oBAAoB;IACtC,WAAW,EAAE,eAAe;IAC5B,UAAU,EAAE,cAAc;IAC1B,UAAU,EAAE,cAAc;IAC1B,SAAS,EAAE,cAAc;IACzB,SAAS,EAAE,gBAAgB;CACnB,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,cAAc,EAAE,kBAAkB;IAClC,OAAO,EAAE,WAAW;IACpB,QAAQ,EAAE,YAAY;IACtB,SAAS,EAAE,aAAa;IACxB,eAAe,EAAE,2BAA2B;IAC5C,cAAc,EAAE,kBAAkB;CAC1B,CAAC;AAEX,0DAA0D;AAC1D,MAAM,CAAC,MAAM,iBAAiB,GAAsB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,eAAe,CAAC,eAAe,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC;AAErJ,MAAM,mBAAmB,GAAG,CAAC,GAAG,MAAM,CAAC;AAIvC,SAAS,MAAM,CAAC,OAAkB,EAAE,IAAY;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC;AAED,SAAS,SAAS,CAAC,MAA8B;IAC/C,OAAO;QACL,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC;QAClC,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC;QAChC,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC;QACnC,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC;QACnC,MAAM,CAAC,gBAAgB,CAAC,gBAAgB,CAAC;QACzC,MAAM,CAAC,gBAAgB,CAAC,WAAW,CAAC;QACpC,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC;QACnC,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC;KACpC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,KAAe,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACxD,MAAM,UAAU,GAAG,CAAC,KAAyB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACvH,MAAM,UAAU,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAEtG,SAAS,UAAU,CAAI,KAAyB,EAAE,QAAW;IAC3D,IAAI,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAM,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,mBAAmB,CAAC,IAAc,EAAE,MAAc,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IAC1F,MAAM,MAAM,GAA2B;QACrC,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC;QACzC,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE;QACnC,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;QAC/C,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QACrD,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;QACjE,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;QACvD,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QACrD,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,SAAS,IAAI,EAAE;KACpD,CAAC;IACF,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3E,OAAO,MAAM,CAAC;AAChB,CAAC;AAOD,uEAAuE;AACvE,MAAM,UAAU,qBAAqB,CAAC,OAAkB,EAAE,MAAc,EAAE,UAAgD,EAAE;IAC1H,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAE5C,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IAE/F,MAAM,SAAS,GAAG,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACxD,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,mBAAmB,CAAC,EAAE,CAAC;QAC5F,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC1D,CAAC;IAED,OAAO;QACL,MAAM,EAAE,eAAe;QACvB,IAAI,EAAE;YACJ,EAAE,EAAE,MAAM;YACV,KAAK,EAAE,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,IAAI,EAAE;YAChD,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;YACtD,WAAW,EAAE,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;YAClE,MAAM,EAAE,UAAU,CAA2B,MAAM,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;YACtF,KAAK,EAAE,UAAU,CAA0B,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACnF,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,IAAI,SAAS;SAC5D;KACF,CAAC;AACJ,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,qBAAqB,CAAC,OAAkB;IACtD,KAAK,MAAM,IAAI,IAAI,iBAAiB;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;AAC7D,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/identity/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAG5D;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,OAAO,EAAE,WAAW;IACpB,UAAU,EAAE,cAAc;IAC1B,UAAU,EAAE,cAAc;IAC1B,gBAAgB,EAAE,oBAAoB;IACtC,WAAW,EAAE,iBAAiB;IAC9B,YAAY,EAAE,gBAAgB;IAC9B,UAAU,EAAE,cAAc;IAC1B,UAAU,EAAE,cAAc;IAC1B,WAAW,EAAE,eAAe;IAC5B,UAAU,EAAE,cAAc;IAC1B,SAAS,EAAE,cAAc;IACzB,SAAS,EAAE,qBAAqB;CACxB,CAAC;AAEX,kHAAkH;AAClH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,cAAc,EAAE,kBAAkB;IAClC,OAAO,EAAE,WAAW;IACpB,QAAQ,EAAE,YAAY;IACtB,SAAS,EAAE,aAAa;IACxB,eAAe,EAAE,2BAA2B;IAC5C,qBAAqB,EAAE,yBAAyB;IAChD,eAAe,EAAE,iBAAiB;CAC1B,CAAC;AAEX,iEAAiE;AACjE,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAC9C,kEAAkE;AAClE,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAClD,kFAAkF;AAClF,MAAM,CAAC,MAAM,8BAA8B,GAAG,KAAK,CAAC;AACpD,2DAA2D;AAC3D,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAqB5C,MAAM,SAAS,GAAG,CAAC,gBAAgB,CAAC,OAAO,EAAE,gBAAgB,CAAC,UAAU,CAAU,CAAC;AACnF,MAAM,SAAS,GAAG;IAChB,gBAAgB,CAAC,UAAU;IAC3B,gBAAgB,CAAC,gBAAgB;IACjC,gBAAgB,CAAC,WAAW;IAC5B,gBAAgB,CAAC,YAAY;IAC7B,gBAAgB,CAAC,UAAU;IAC3B,gBAAgB,CAAC,UAAU;IAC3B,gBAAgB,CAAC,WAAW;IAC5B,gBAAgB,CAAC,UAAU;CACnB,CAAC;AACX,MAAM,WAAW,GAAG,gBAAgB,CAAC;AACrC,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;AAE/H;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAA4B;IACjE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IACnG,MAAM,YAAY,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;IACvD,MAAM,WAAW,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;IACrD,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IAC/E,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,kCAAkC,CAAC,CAAC;QACjH,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,6BAA6B,CAAC,CAAC;QACxI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;QACzC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;QACvC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;KACpE,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAA0B;IACzD,OAAO,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC,SAAS,EAAE,gBAAgB,CAAC,SAAS,EAAE,eAAe,CAAC,eAAe,EAAE,eAAe,CAAC,qBAAqB,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC;AAC9L,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAkB,EAAE,QAA0B;IAClF,KAAK,MAAM,IAAI,IAAI,gBAAgB,CAAC,QAAQ,CAAC;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;AACtE,CAAC;AAKD,SAAS,MAAM,CAAC,OAAkB,EAAE,IAAY;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,QAA2B,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACtE,MAAM,UAAU,GAAG,CAAC,KAAyB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACvH,MAAM,UAAU,GAAG,CAAC,KAA8B,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACnJ,MAAM,QAAQ,GAAG,CAAI,MAAyB,EAAE,IAAuB,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE1J,SAAS,UAAU,CAAmB,KAAyB;IAC7D,IAAI,CAAC,KAAK;QAAE,OAAO,EAAO,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACrF,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IACpG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAc,EAAE,QAA0B;IAC7E,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,MAAM,GAA2B;QACrC,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE;QACnC,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;QAC/C,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QACrD,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;QACjE,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;QACpE,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;QACpE,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;QACnG,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,SAAS,IAAI,EAAE;QACnD,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,SAAS,CAAC,CAAC;QAClF,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;KAChF,CAAC;IACF,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/G,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAeD,SAAS,eAAe,CAAC,KAA+C;IACtE,MAAM,MAAM,GAAG;QACb,KAAK,CAAC,QAAQ,CAAC,MAAM;QACrB,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE;QAC1B,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC;QACzB,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAChB,GAAG,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;KACxE,CAAC;IACF,sFAAsF;IACtF,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAA+B;IACjE,OAAO,GAAG,yBAAyB,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;AAC5F,CAAC;AAaD;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAiC;IACrE,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,mBAAmB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IAChJ,OAAO,EAAE,GAAG,QAAQ,EAAE,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;AAC5G,CAAC;AAuBD,SAAS,cAAc,CAAC,GAAuB,EAAE,GAAW,EAAE,QAAgB,EAAE,WAAmB;IACjG,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,eAAe,CAAC;IACvD,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACvB,IAAI,GAAG,GAAG,EAAE,GAAG,QAAQ;QAAE,OAAO,OAAO,CAAC;IACxC,IAAI,EAAE,GAAG,GAAG,GAAG,WAAW;QAAE,OAAO,QAAQ,CAAC;IAC5C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CAAC,MAA8B,EAAE,QAA0B;IAC5E,MAAM,MAAM,GAAG,UAAU,CAA2B,MAAM,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1F,MAAM,KAAK,GAAG,UAAU,CAA0B,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC;IACvF,MAAM,SAAS,GAAG,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAChE,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACrC,IAAI,GAAG,CAAC,MAAM;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACpC,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/D,IAAI,MAAM,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,IAAI,GAAa;QACrB,EAAE,EAAE,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE;QAC1C,KAAK,EAAE,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,IAAI,EAAE;QAChD,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QACtD,WAAW,EAAE,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;QAClE,MAAM;QACN,KAAK;QACL,YAAY,EAAE,MAAM,CAAC,gBAAgB,CAAC,WAAW,CAAC,KAAK,MAAM;QAC7D,WAAW,EAAE,MAAM,CAAC,gBAAgB,CAAC,YAAY,CAAC,KAAK,MAAM;KAC9D,CAAC;IACF,IAAI,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC;QAAE,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC9F,IAAI,SAAS;QAAE,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAiC;IACrE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IACpC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAE/E,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC1E,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,yBAAyB,GAAG,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAEhH,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,IAAI,2BAA2B,EAAE,KAAK,CAAC,WAAW,IAAI,8BAA8B,CAAC,CAAC;IACjJ,IAAI,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAE/D,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,WAAW;QAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IACtF,MAAM,QAAQ,GAAG,mBAAmB,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9I,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAE3F,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC5C,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;AACjG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA0B;IAC5D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,2CAA2C,yBAAyB,aAAa,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,cAAc,cAAc,CAAC"}

package/dist/esm/identity/step-up.js

@@ -0,0 +1,47 @@
+/**
+ * Step-up (re-authentication) scopes. The gateway checks the client's step-up proof for the route's
+ * scope and forwards the verified time as the signed `x-step-up-at` header; services only check that
+ * the time is fresh. Scope names and their rules are app values, declared once with
+ * {@link defineStepUpScopes}.
+ */
+/** Default freshness window for a step-up verification. */
+export const DEFAULT_STEP_UP_WINDOW_MS = 5 * 60_000;
+/** A step-up time this far ahead of the service clock is still accepted (clock skew). */
+export const STEP_UP_MAX_FUTURE_MS = 5_000;
+/** Error code of the 403 a service returns when a fresh step-up is required. */
+export const STEP_UP_REQUIRED_CODE = 'STEP_UP_REQUIRED';
+const SCOPE_NAME = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
+/**
+ * Validates and freezes an app's step-up scope catalogue (kebab-case names). Throws at startup on a bad name.
+ *
+ * @param catalogue Scope name → rules.
+ * @returns The frozen catalogue; its keys type `requireStepUp`'s scope argument.
+ * @example export const stepUpScopes = defineStepUpScopes({ 'refund-large': {}, 'payout-destination': { singleUse: true } });
+ */
+export function defineStepUpScopes(catalogue) {
+    const entries = Object.entries(catalogue);
+    if (!entries.length)
+        throw new Error('defineStepUpScopes: catalogue is empty');
+    for (const [name] of entries) {
+        if (!SCOPE_NAME.test(name))
+            throw new Error(`defineStepUpScopes: "${name}" must be kebab-case`);
+    }
+    return Object.freeze(Object.fromEntries(entries.map(([name, rules]) => [name, Object.freeze({ ...rules })])));
+}
+/**
+ * Whether a gateway-verified step-up time is usable now.
+ *
+ * @param stepUpAt Epoch milliseconds of the step-up, or undefined when none was made.
+ * @param windowMs How old the step-up may be.
+ * @param now Current epoch milliseconds.
+ * @returns `fresh` when usable; otherwise why not.
+ * @example stepUpStatus(req.user?.stepUpAt, DEFAULT_STEP_UP_WINDOW_MS) === 'fresh'
+ */
+export function stepUpStatus(stepUpAt, windowMs, now = Date.now()) {
+    if (stepUpAt === undefined || !Number.isFinite(stepUpAt))
+        return 'missing';
+    if (stepUpAt - now > STEP_UP_MAX_FUTURE_MS)
+        return 'future';
+    return now - stepUpAt > windowMs ? 'stale' : 'fresh';
+}
+//# sourceMappingURL=step-up.js.map

package/dist/esm/identity/step-up.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-up.js","sourceRoot":"","sources":["../../../src/identity/step-up.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAaH,2DAA2D;AAC3D,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,GAAG,MAAM,CAAC;AACpD,yFAAyF;AACzF,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAC3C,gFAAgF;AAChF,MAAM,CAAC,MAAM,qBAAqB,GAAG,kBAAkB,CAAC;AAExD,MAAM,UAAU,GAAG,iCAAiC,CAAC;AAErD;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAmB,SAA2C;IAC9F,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAsC,CAAC;IAC/E,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC/E,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,sBAAsB,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAuB,CAAC;AACtI,CAAC;AAID;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,QAA4B,EAAE,QAAgB,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IACnG,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3E,IAAI,QAAQ,GAAG,GAAG,GAAG,qBAAqB;QAAE,OAAO,QAAQ,CAAC;IAC5D,OAAO,GAAG,GAAG,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;AACvD,CAAC"}

package/dist/esm/index.js

@@ -9,6 +9,12 @@ export * from './access/index.js';
 export * from './validation/index.js';
 export * from './logging/index.js';
 export * from './config/index.js';
+export * from './cache/keyspace.js';
+export * from './rate-limit/keys.js';
 export * from './contracts/index.js';
 export * from './alerting/index.js';
+export * from './database/pagination.js';
+export * from './audit/index.js';
+export * from './approvals/index.js';
+export * from './socket/ticket.js';
 //# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,8FAA8F;AAC9F,kFAAkF;AAClF,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,8FAA8F;AAC9F,kFAAkF;AAClF,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC;AACjC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC"}

package/dist/esm/knex/columns.js

@@ -0,0 +1,28 @@
+/** Column primitives shared by every migration helper (one definition of ULID and DATETIME(3) columns). */
+/** `id CHAR(26)` primary key for ULIDs. */
+export function ulidPrimary(table, name = 'id') {
+    table.specificType(name, 'char(26)').notNullable().primary();
+}
+/** `CHAR(26)` column referencing another ULID (FK constraints only within the same database). */
+export function ulidColumn(table, name) {
+    return table.specificType(name, 'char(26)');
+}
+/** `created_at` / `updated_at` as `DATETIME(3)` in UTC, maintained by MySQL. */
+export function timestamps(table, knex) {
+    createdAtColumn(table, knex);
+    datetime(table, 'updated_at').notNullable().defaultTo(knex.raw('CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)'));
+}
+/** `created_by` / `updated_by` actor columns (null for system operations). */
+export function actorColumns(table) {
+    ulidColumn(table, 'created_by').nullable();
+    ulidColumn(table, 'updated_by').nullable();
+}
+/** Nullable `DATETIME(3)` column. */
+export function datetime(table, name) {
+    return table.specificType(name, 'datetime(3)');
+}
+/** `DATETIME(3)` column defaulting to `CURRENT_TIMESTAMP(3)` (insert time, UTC). */
+export function createdAtColumn(table, knex, name = 'created_at') {
+    return datetime(table, name).notNullable().defaultTo(knex.raw('CURRENT_TIMESTAMP(3)'));
+}
+//# sourceMappingURL=columns.js.map

package/dist/esm/knex/columns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"columns.js","sourceRoot":"","sources":["../../../src/knex/columns.ts"],"names":[],"mappings":"AAEA,2GAA2G;AAE3G,2CAA2C;AAC3C,MAAM,UAAU,WAAW,CAAC,KAA8B,EAAE,IAAI,GAAG,IAAI;IACrE,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,CAAC;AAC/D,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,UAAU,CAAC,KAAuD,EAAE,IAAY;IAC9F,OAAO,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AAC9C,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,UAAU,CAAC,KAA8B,EAAE,IAAU;IACnE,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC,CAAC;AACzH,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,YAAY,CAAC,KAA8B;IACzD,UAAU,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3C,UAAU,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;AAC7C,CAAC;AAED,qCAAqC;AACrC,MAAM,UAAU,QAAQ,CAAC,KAAuD,EAAE,IAAY;IAC5F,OAAO,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;AACjD,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,eAAe,CAAC,KAA8B,EAAE,IAAU,EAAE,IAAI,GAAG,YAAY;IAC7F,OAAO,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC;AACzF,CAAC"}

package/dist/esm/knex/index.js

@@ -1,29 +1,12 @@
+import { DEFAULT_OUTBOX_TABLE } from '../database/table-names.js';
+import { actorColumns, timestamps, ulidColumn, ulidPrimary } from './columns.js';
+import { outboxColumns } from './migration-helpers.js';
+export * from './columns.js';
+export * from './migration-helpers.js';
 /**
  * Migration helpers (usable from CommonJS `.cjs` migrations via `require('@heavybit/shared-lib/knex')`).
  * They keep ID, timestamp and audit column definitions identical across services.
  */
-/** `id CHAR(26)` primary key for ULIDs. */
-export function ulidPrimary(table, name = 'id') {
-    table.specificType(name, 'char(26)').notNullable().primary();
-}
-/** `CHAR(26)` column referencing another ULID (FK constraints only within the same database). */
-export function ulidColumn(table, name) {
-    return table.specificType(name, 'char(26)');
-}
-/** `created_at` / `updated_at` as `DATETIME(3)` in UTC, maintained by MySQL. */
-export function timestamps(table, knex) {
-    table.specificType('created_at', 'datetime(3)').notNullable().defaultTo(knex.raw('CURRENT_TIMESTAMP(3)'));
-    table.specificType('updated_at', 'datetime(3)').notNullable().defaultTo(knex.raw('CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3)'));
-}
-/** `created_by` / `updated_by` actor columns (null for system operations). */
-export function actorColumns(table) {
-    ulidColumn(table, 'created_by').nullable();
-    ulidColumn(table, 'updated_by').nullable();
-}
-/** Nullable `DATETIME(3)` column. */
-export function datetime(table, name) {
-    return table.specificType(name, 'datetime(3)');
-}
 /**
  * Creates `<parent>_audits`: every parent column (defined again by `columns`) plus `parent_id`
  * and `action`. Audit rows are append-only history, so no unique constraints are copied.
@@ -42,20 +25,11 @@ export async function createAuditTable(knex, parentTable, columns) {
         table.index(['parent_id', 'created_at']);
     });
 }
-/** Transactional outbox table used by `OutboxRelay`. */
-export async function createOutboxTable(knex, name = 'event_outbox') {
+/** Transactional outbox table used by `OutboxRelay` (columns from {@link outboxColumns}). */
+export async function createOutboxTable(knex, name = DEFAULT_OUTBOX_TABLE) {
     if (await knex.schema.hasTable(name))
         return;
-    await knex.schema.createTable(name, (table) => {
-        ulidPrimary(table);
-        table.string('routing_key', 191).notNullable();
-        table.json('payload').notNullable();
-        table.integer('attempts').unsigned().notNullable().defaultTo(0);
-        table.string('last_error', 500).nullable();
-        table.specificType('created_at', 'datetime(3)').notNullable().defaultTo(knex.raw('CURRENT_TIMESTAMP(3)'));
-        datetime(table, 'published_at').nullable();
-        table.index(['published_at', 'id']);
-    });
+    await knex.schema.createTable(name, (table) => outboxColumns(table, knex));
 }
 /** Standard table options: InnoDB, utf8mb4. Call inside `createTable`. */
 export function utf8mb4(table) {

package/dist/esm/knex/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/knex/index.ts"],"names":[],"mappings":"AAEA;;;GAGG;AAEH,2CAA2C;AAC3C,MAAM,UAAU,WAAW,CAAC,KAA8B,EAAE,IAAI,GAAG,IAAI;IACrE,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,CAAC;AAC/D,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,UAAU,CAAC,KAAuD,EAAE,IAAY;IAC9F,OAAO,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AAC9C,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,UAAU,CAAC,KAA8B,EAAE,IAAU;IACnE,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAC1G,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC,CAAC;AAC3I,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,YAAY,CAAC,KAA8B;IACzD,UAAU,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3C,UAAU,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;AAC7C,CAAC;AAED,qCAAqC;AACrC,MAAM,UAAU,QAAQ,CAAC,KAAuD,EAAE,IAAY;IAC5F,OAAO,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAU,EAAE,WAAmB,EAAE,OAAiD;IACvH,MAAM,IAAI,GAAG,GAAG,WAAW,SAAS,CAAC;IACrC,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO;IAC7C,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE;QAC5C,WAAW,CAAC,KAAK,CAAC,CAAC;QACnB,UAAU,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,CAAC;QACrD,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAClE,OAAO,CAAC,KAAK,CAAC,CAAC;QACf,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACxB,KAAK,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,wDAAwD;AACxD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAU,EAAE,IAAI,GAAG,cAAc;IACvE,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO;IAC7C,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE;QAC5C,WAAW,CAAC,KAAK,CAAC,CAAC;QACnB,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QACpC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAChE,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3C,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC1G,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3C,KAAK,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,OAAO,CAAC,KAA8B;IACpD,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvB,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACzB,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;AACtC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/knex/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,YAAY,EAAY,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,cAAc,cAAc,CAAC;AAC7B,cAAc,wBAAwB,CAAC;AAEvC;;;GAGG;AAEH;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAU,EAAE,WAAmB,EAAE,OAAiD;IACvH,MAAM,IAAI,GAAG,GAAG,WAAW,SAAS,CAAC;IACrC,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO;IAC7C,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE;QAC5C,WAAW,CAAC,KAAK,CAAC,CAAC;QACnB,UAAU,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,CAAC;QACrD,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAClE,OAAO,CAAC,KAAK,CAAC,CAAC;QACf,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACxB,KAAK,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAU,EAAE,IAAI,GAAG,oBAAoB;IAC7E,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO;IAC7C,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,OAAO,CAAC,KAA8B;IACpD,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvB,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACzB,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;AACtC,CAAC"}

package/dist/esm/knex/migration-helpers.js

@@ -0,0 +1,51 @@
+import { OUTBOX_EXCHANGES, SCHEDULER_RUN_STATUSES } from '../database/table-names.js';
+import { createdAtColumn, datetime, ulidPrimary } from './columns.js';
+/**
+ * Outbox columns: id, routing_key, exchange, payload, correlation_id, attempts, last_error, created_at,
+ * published_at (+ relay index).
+ */
+export function outboxColumns(t, knex) {
+    ulidPrimary(t);
+    t.string('routing_key', 191).notNullable();
+    t.enu('exchange', [...OUTBOX_EXCHANGES]).notNullable().defaultTo('events');
+    t.json('payload').notNullable();
+    t.string('correlation_id', 64).nullable();
+    t.integer('attempts').unsigned().notNullable().defaultTo(0);
+    t.string('last_error', 500).nullable();
+    createdAtColumn(t, knex, 'created_at');
+    datetime(t, 'published_at').nullable();
+    t.index(['published_at', 'id']);
+}
+/** Consumer idempotency columns: id, consumer, event_id (unique together), processed_at. */
+export function processedEventsColumns(t, knex) {
+    ulidPrimary(t);
+    t.string('consumer', 191).notNullable();
+    t.string('event_id', 64).notNullable();
+    createdAtColumn(t, knex, 'processed_at');
+    t.unique(['consumer', 'event_id']);
+    t.index(['processed_at']);
+}
+/** Scheduler run columns: id, job, run_key (unique together), status, error, started_at, finished_at. */
+export function schedulerRunsColumns(t, knex) {
+    ulidPrimary(t);
+    t.string('job', 191).notNullable();
+    t.string('run_key', 191).notNullable();
+    t.enu('status', [...SCHEDULER_RUN_STATUSES]).notNullable().defaultTo('running');
+    t.string('error', 500).nullable();
+    createdAtColumn(t, knex, 'started_at');
+    datetime(t, 'finished_at').nullable();
+    t.unique(['job', 'run_key']);
+    t.index(['job', 'started_at']);
+}
+/**
+ * Index that always leads with the scope column (TEN-4); `columns` follow in order, duplicates of
+ * the scope column are dropped.
+ *
+ * @example scopedIndex(t, 'workspace_id', ['status', 'created_at'])
+ */
+export function scopedIndex(t, scopeColumn, columns = [], indexName) {
+    if (!scopeColumn)
+        throw new Error('scopedIndex needs a scope column');
+    t.index([scopeColumn, ...columns.filter((c) => c !== scopeColumn)], indexName);
+}
+//# sourceMappingURL=migration-helpers.js.map

package/dist/esm/knex/migration-helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-helpers.js","sourceRoot":"","sources":["../../../src/knex/migration-helpers.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACtF,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AActE;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,CAAU,EAAE,IAAU;IAClD,WAAW,CAAC,CAAC,CAAC,CAAC;IACf,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3C,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC3E,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;IAChC,CAAC,CAAC,MAAM,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC1C,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;IACvC,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;IACvC,QAAQ,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC;IACvC,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,sBAAsB,CAAC,CAAU,EAAE,IAAU;IAC3D,WAAW,CAAC,CAAC,CAAC,CAAC;IACf,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IACxC,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACvC,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IACzC,CAAC,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;IACnC,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,oBAAoB,CAAC,CAAU,EAAE,IAAU;IACzD,WAAW,CAAC,CAAC,CAAC,CAAC;IACf,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IACnC,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IACvC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,sBAAsB,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAChF,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;IAClC,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;IACvC,QAAQ,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;IAC7B,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,CAAmC,EAAE,WAAmB,EAAE,UAAoB,EAAE,EAAE,SAAkB;IAC9H,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtE,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AACjF,CAAC"}