@mojaloop/central-services-shared 18.35.2 → 18.35.5

package/.circleci/config.yml

@@ -20,7 +20,7 @@ version: 2.1
 setup: true
 
 orbs:
-  build: mojaloop/build@1.1.9
+  build: mojaloop/build@1.1.15
 
 workflows:
   setup:

package/.grype.yaml

@@ -1,40 +1,21 @@
-# Grype vulnerability scanning configuration for central-services-shared
-# This is a library project without Docker images, so we use source scanning
 scan-type: source
-
-# Enable vulnerability scanning
 disabled: false
-
-# Vulnerability ignore rules
-# Add specific CVEs here if they are false positives or acceptable risks
 ignore:
-  # Example format for ignoring specific vulnerabilities:
-  # - vulnerability: "CVE-2023-xxxxx"
-  #   reason: "False positive in dev dependency that doesn't affect production"
-  # - vulnerability: "GHSA-xxxx-xxxx-xxxx"
-  #   package:
-  #     name: "package-name"
-  #     version: "1.0.0"
-  #   reason: "Not exploitable in our usage context"
-
-# Output formats for scan results
+  - vulnerability: GHSA-2g4f-4pwh-qvx6
+    include-aliases: true
+    reason: "Unfixable npm transitive vulnerability: ajv ReDoS (moderate) as of 2026-02-19"
+  - vulnerability: GHSA-3ppc-4f35-3m26
+    include-aliases: true
+    reason: "Unfixable npm transitive vulnerability: minimatch ReDoS - fix requires v10 major version break as of 2026-02-19"
 output:
-  - "table"  # Human-readable table format
-  - "json"   # Machine-readable JSON for further processing
-
-# Grype configuration options
-quiet: false                    # Show progress and status messages
-check-for-app-update: false     # Don't check for Grype updates during CI
-only-fixed: false               # Show all vulnerabilities, not just those with fixes
-add-cpes-if-none: false         # Don't add CPEs if none are found
-by-cve: false                   # Group by vulnerability rather than CVE
-
-# Database settings
+  - table
+  - json
+quiet: false
+check-for-app-update: false
+only-fixed: false
+add-cpes-if-none: false
+by-cve: false
 db:
-  auto-update: true             # Auto-update the vulnerability database
-  validate-age: true            # Validate the age of the vulnerability database
-  max-allowed-built-age: 120h   # Maximum age of the vulnerability database (5 days)
-
-# Severity thresholds (handled by the orb, but documented here for clarity)
-# The build will fail on Critical, High, or Medium severity vulnerabilities
-# Low and Negligible severities are reported but won't fail the build
+  auto-update: true
+  validate-age: true
+  max-allowed-built-age: 120h

package/.nvmrc

@@ -1 +1 @@
-22.15.1
+22.22.0

package/CHANGELOG.md

@@ -2,6 +2,27 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+### [18.35.5](https://github.com/mojaloop/central-services-shared/compare/v18.35.4...v18.35.5) (2026-02-20)
+
+
+### Chore
+
+* update orb and dep ver ([#509](https://github.com/mojaloop/central-services-shared/issues/509)) ([7293cff](https://github.com/mojaloop/central-services-shared/commit/7293cffea15145d115b25625eb4352ceb651bb35))
+
+### [18.35.4](https://github.com/mojaloop/central-services-shared/compare/v18.35.3...v18.35.4) (2026-02-19)
+
+
+### Chore
+
+* update dependencies, node.js 22.22.0, and security patches ([#508](https://github.com/mojaloop/central-services-shared/issues/508)) ([51281d8](https://github.com/mojaloop/central-services-shared/commit/51281d8eaaa8b9da53214f2b6543d1aef165a682))
+
+### [18.35.3](https://github.com/mojaloop/central-services-shared/compare/v18.35.2...v18.35.3) (2026-02-06)
+
+
+### Chore
+
+* extend type definitions ([#503](https://github.com/mojaloop/central-services-shared/issues/503)) ([82b9820](https://github.com/mojaloop/central-services-shared/commit/82b9820f8df7221397e8cd3cff53ea0df9cf0042))
+
 ### [18.35.2](https://github.com/mojaloop/central-services-shared/compare/v18.35.1...v18.35.2) (2026-01-28)
 
 

package/audit-ci.jsonc

@@ -4,6 +4,7 @@
   // Only use one of ["low": true, "moderate": true, "high": true, "critical": true]
   "moderate": true,
   "allowlist": [ // NOTE: Please add as much information as possible to any items added to the allowList
-    // e.g. Currently no fixes available for the following
+    "GHSA-2g4f-4pwh-qvx6",
+    "GHSA-3ppc-4f35-3m26" // minimatch ReDoS - fix requires v10 (major version break), unfixable via override
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mojaloop/central-services-shared",
-  "version": "18.35.2",
+  "version": "18.35.5",
   "description": "Shared code for mojaloop central services",
   "license": "Apache-2.0",
   "author": "ModusBox",
@@ -67,16 +67,16 @@
   "dependencies": {
     "@hapi/catbox": "12.1.1",
     "@hapi/catbox-memory": "5.0.1",
-    "@hapi/hapi": "21.4.4",
+    "@hapi/hapi": "21.4.6",
     "@hapi/joi-date": "2.0.1",
     "@mojaloop/inter-scheme-proxy-cache-lib": "2.9.0",
     "@opentelemetry/api": "1.9.0",
     "async-exit-hook": "2.0.1",
     "async-retry": "1.3.3",
-    "axios": "1.13.4",
+    "axios": "1.13.5",
     "clone": "2.1.2",
     "convict": "^6.2.4",
-    "dotenv": "17.2.3",
+    "dotenv": "17.3.1",
     "env-var": "7.5.0",
     "event-stream": "4.0.1",
     "fast-safe-stringify": "2.1.1",
@@ -96,20 +96,20 @@
     "yaml": "2.8.2"
   },
   "devDependencies": {
-    "@mojaloop/central-services-error-handling": "13.1.5",
-    "@mojaloop/central-services-logger": "11.10.3",
-    "@mojaloop/central-services-metrics": "12.8.3",
-    "@mojaloop/event-sdk": "14.8.2",
-    "@mojaloop/sdk-standard-components": "19.18.4",
-    "@opentelemetry/auto-instrumentations-node": "^0.69.0",
+    "@mojaloop/central-services-error-handling": "13.1.6",
+    "@mojaloop/central-services-logger": "11.10.4",
+    "@mojaloop/central-services-metrics": "12.8.5",
+    "@mojaloop/event-sdk": "14.8.3",
+    "@mojaloop/sdk-standard-components": "19.18.7",
+    "@opentelemetry/auto-instrumentations-node": "^0.70.0",
     "@types/hapi__joi": "17.1.15",
-    "ajv": "^8.17.1",
+    "ajv": "8.18.0",
     "ajv-formats": "^3.0.1",
     "ajv-keywords": "^5.1.0",
     "audit-ci": "7.1.0",
     "base64url": "3.0.1",
     "chance": "1.1.13",
-    "npm-check-updates": "19.3.2",
+    "npm-check-updates": "19.4.1",
     "nyc": "17.1.0",
     "portfinder": "1.0.38",
     "pre-commit": "1.2.2",
@@ -125,10 +125,10 @@
     "tapes": "4.1.0"
   },
   "overrides": {
-    "axios": "1.13.4",
-    "qs": "6.14.1",
+    "axios": "1.13.5",
+    "qs": "6.14.2",
     "brace-expansion": "2.0.2",
-    "form-data": "4.0.4",
+    "form-data": "4.0.5",
     "nanoid": "5.1.5",
     "postcss": {
       "nanoid": "5.1.5"
@@ -145,6 +145,7 @@
       "swagger2openapi": "7.0.8"
     },
     "markdown-it": "12.3.2",
+    "fast-xml-parser": "5.3.6",
     "trim": "0.0.3",
     "cross-spawn": "7.0.6",
     "yargs-parser": "21.1.1",

package/src/index.d.ts

@@ -366,7 +366,7 @@ declare namespace CentralServicesShared {
 
   enum TransferInternalStateEnum {
     ABORTED_ERROR = 'ABORTED_ERROR',
-    ABORTED_REJECTED= 'ABORTED_REJECTED',
+    ABORTED_REJECTED = 'ABORTED_REJECTED',
     COMMITTED = 'COMMITTED',
     EXPIRED_PREPARED = 'EXPIRED_PREPARED',
     EXPIRED_RESERVED = 'EXPIRED_RESERVED',
@@ -443,6 +443,56 @@ declare namespace CentralServicesShared {
     LIMIT_ADJUSTMENT = 'limit-adjustment'
   }
 
+  enum LedgerAccountTypeEnum {
+    POSITION = 1,
+    SETTLEMENT = 2,
+    HUB_RECONCILIATION = 3,
+    HUB_MULTILATERAL_SETTLEMENT = 4,
+    HUB_FEE = 5,
+    POSITION_REMITTANCE = 7,
+    SETTLEMENT_REMITTANCE = 8
+  }
+
+  enum LedgerEntryTypeEnum {
+    PRINCIPLE_VALUE = 1,
+    INTERCHANGE_FEE = 2,
+    HUB_FEE = 3,
+    POSITION_DEPOSIT = 4,
+    POSITION_WITHDRAWAL = 5,
+    SETTLEMENT_NET_RECIPIENT = 6,
+    SETTLEMENT_NET_SENDER = 7,
+    SETTLEMENT_NET_ZERO = 8,
+    SETTLEMENT_ACCOUNT_DEPOSIT = 9,
+    SETTLEMENT_ACCOUNT_WITHDRAWAL = 10
+  }
+
+  enum ParticipantLimitTypeEnum {
+    NET_DEBIT_CAP = 1
+  }
+
+  enum TransferParticipantRoleTypeEnum {
+    PAYER_DFSP = 1,
+    PAYEE_DFSP = 2,
+    HUB = 3,
+    DFSP_SETTLEMENT = 4,
+    DFSP_POSITION = 5,
+    INITIATING_FSP = 6,
+    COUNTER_PARTY_FSP = 7
+  }
+
+  enum PartyTypeEnum {
+    MSISDN = 'MSISDN',
+    EMAIL = 'EMAIL',
+    PERSONAL_ID = 'PERSONAL_ID',
+    BUSINESS = 'BUSINESS',
+    DEVICE = 'DEVICE',
+    ACCOUNT_ID = 'ACCOUNT_ID',
+    IBAN = 'IBAN',
+    ALIAS = 'ALIAS',
+    CONSENT = 'CONSENT',
+    THIRD_PARTY_LINK = 'THIRD_PARTY_LINK'
+  }
+
   interface Enum {
     Http: HttpEnum;
     EndPoints: EndPointsEnum;
@@ -451,8 +501,18 @@ declare namespace CentralServicesShared {
         CONSUMER: string,
         PRODUCER: string,
       }
+      Topics: {
+        NOTIFICATION: string;
+        POSITION: string;
+        TRANSFER: string;
+        [key: string]: string;
+      }
     }
     Events: {
+      EventStatus: {
+        FAILURE: { status: string };
+        SUCCESS: { status: string };
+      };
       Event: {
         Action: {
           ABORT: EventActionEnum.ABORT;
@@ -628,6 +688,53 @@ declare namespace CentralServicesShared {
         LIMIT_ADJUSTMENT: AdminNotificationActionsEnum.LIMIT_ADJUSTMENT;
       };
     };
+    Accounts: {
+      LedgerAccountType: {
+        POSITION: LedgerAccountTypeEnum.POSITION;
+        SETTLEMENT: LedgerAccountTypeEnum.SETTLEMENT;
+        HUB_RECONCILIATION: LedgerAccountTypeEnum.HUB_RECONCILIATION;
+        HUB_MULTILATERAL_SETTLEMENT: LedgerAccountTypeEnum.HUB_MULTILATERAL_SETTLEMENT;
+        HUB_FEE: LedgerAccountTypeEnum.HUB_FEE;
+        POSITION_REMITTANCE: LedgerAccountTypeEnum.POSITION_REMITTANCE;
+        SETTLEMENT_REMITTANCE: LedgerAccountTypeEnum.SETTLEMENT_REMITTANCE;
+      };
+      LedgerEntryType: {
+        PRINCIPLE_VALUE: LedgerEntryTypeEnum.PRINCIPLE_VALUE;
+        INTERCHANGE_FEE: LedgerEntryTypeEnum.INTERCHANGE_FEE;
+        HUB_FEE: LedgerEntryTypeEnum.HUB_FEE;
+        POSITION_DEPOSIT: LedgerEntryTypeEnum.POSITION_DEPOSIT;
+        POSITION_WITHDRAWAL: LedgerEntryTypeEnum.POSITION_WITHDRAWAL;
+        SETTLEMENT_NET_RECIPIENT: LedgerEntryTypeEnum.SETTLEMENT_NET_RECIPIENT;
+        SETTLEMENT_NET_SENDER: LedgerEntryTypeEnum.SETTLEMENT_NET_SENDER;
+        SETTLEMENT_NET_ZERO: LedgerEntryTypeEnum.SETTLEMENT_NET_ZERO;
+        SETTLEMENT_ACCOUNT_DEPOSIT: LedgerEntryTypeEnum.SETTLEMENT_ACCOUNT_DEPOSIT;
+        SETTLEMENT_ACCOUNT_WITHDRAWAL: LedgerEntryTypeEnum.SETTLEMENT_ACCOUNT_WITHDRAWAL;
+      };
+      ParticipantLimitType: {
+        NET_DEBIT_CAP: ParticipantLimitTypeEnum.NET_DEBIT_CAP;
+      };
+      TransferParticipantRoleType: {
+        PAYER_DFSP: TransferParticipantRoleTypeEnum.PAYER_DFSP;
+        PAYEE_DFSP: TransferParticipantRoleTypeEnum.PAYEE_DFSP;
+        HUB: TransferParticipantRoleTypeEnum.HUB;
+        DFSP_SETTLEMENT: TransferParticipantRoleTypeEnum.DFSP_SETTLEMENT;
+        DFSP_POSITION: TransferParticipantRoleTypeEnum.DFSP_POSITION;
+        INITIATING_FSP: TransferParticipantRoleTypeEnum.INITIATING_FSP;
+        COUNTER_PARTY_FSP: TransferParticipantRoleTypeEnum.COUNTER_PARTY_FSP;
+      };
+      PartyTypes: {
+        MSISDN: PartyTypeEnum.MSISDN;
+        EMAIL: PartyTypeEnum.EMAIL;
+        PERSONAL_ID: PartyTypeEnum.PERSONAL_ID;
+        BUSINESS: PartyTypeEnum.BUSINESS;
+        DEVICE: PartyTypeEnum.DEVICE;
+        ACCOUNT_ID: PartyTypeEnum.ACCOUNT_ID;
+        IBAN: PartyTypeEnum.IBAN;
+        ALIAS: PartyTypeEnum.ALIAS;
+        CONSENT: PartyTypeEnum.CONSENT;
+        THIRD_PARTY_LINK: PartyTypeEnum.THIRD_PARTY_LINK;
+      };
+    };
   }
 
   interface Cacheable {
@@ -662,13 +769,18 @@ declare namespace CentralServicesShared {
   }
 
   interface Kafka {
-    createGeneralTopicConf(template: string, functionality: string, action: string, key?: string, partition?: number, opaqueKey?: any, topicNameOverride?: string): {topicName: string, key: string | null, partition: number | null, opaqueKey: any }
+    createGeneralTopicConf(template: string, functionality: string, action: string, key?: string, partition?: number, opaqueKey?: any, topicNameOverride?: string): { topicName: string, key: string | null, partition: number | null, opaqueKey: any }
+    transformGeneralTopicName(template: string, functionality: string, action: string): string
+    getKafkaConfig(kafkaConfig: object, flow: string, functionality: string, action: string): object
   }
 
   type MimeTypes = 'text/plain' | 'application/json' | 'application/vnd.interoperability.'
   interface StreamingProtocol {
     decodePayload(input: string, options: Object): Object
     encodePayload(input: string | Buffer, mimeType: MimeTypes): string
+    createEventState(status: string, errorCode: string, errorDescription: string): any
+    createMetadataWithCorrelatedEvent(transferId: string, topic: string, action: string, state: any): any
+    createMessage(id: string, destination: string, source: string, metadata: any, headers: any, payload: any, uriParams: any, contentType: string): any
   }
 
   interface HeaderValidation {
@@ -686,8 +798,8 @@ declare namespace CentralServicesShared {
   type ProtocolVersions = (string | symbol)[]
   type ApiTypeValues = 'fspiop' | 'iso20022'
   type APIDocumentationPluginOptions =
-  | { documentPath: string; document?: never }
-  | { document?: string; documentPath?: never }
+    | { documentPath: string; document?: never }
+    | { document?: string; documentPath?: never }
 
   type LoggingPluginOptions = {
     log?: ILogger,
@@ -759,7 +871,7 @@ declare namespace CentralServicesShared {
 
   interface PubSub {
     (config: object, publisherClient?: IORedis, subscriberClient?: IORedis): PubSub;
-    new (config: object, publisherClient?: IORedis, subscriberClient?: IORedis): PubSub;
+    new(config: object, publisherClient?: IORedis, subscriberClient?: IORedis): PubSub;
     connect(): Promise<void>;
     disconnect(): Promise<boolean>;
     healthCheck(): Promise<boolean>;
@@ -772,7 +884,7 @@ declare namespace CentralServicesShared {
 
   interface RedisCache {
     (config: object, client?: IORedis): RedisCache;
-    new (config: object, client?: IORedis): RedisCache;
+    new(config: object, client?: IORedis): RedisCache;
     connect(): Promise<boolean>;
     disconnect(): Promise<boolean>;
     healthCheck(): Promise<boolean>;
@@ -788,16 +900,16 @@ declare namespace CentralServicesShared {
     RedisCache: RedisCache;
   }
 
-  type RedisInstanceConfig = 
+  type RedisInstanceConfig =
     | {
-        type: 'redis';
-        host: string;
-        port: number;
-      }
+      type: 'redis';
+      host: string;
+      port: number;
+    }
     | {
-        type: 'redis-cluster';
-        cluster: Array<{ host: string; port: number }>;
-      };
+      type: 'redis-cluster';
+      cluster: Array<{ host: string; port: number }>;
+    };
 
   interface DistributedLockConfig {
     redisConfigs: RedisInstanceConfig[];
@@ -824,6 +936,59 @@ declare namespace CentralServicesShared {
     createLock(config: DistributedLockConfig, logger?: ILogger): DistributedLock;
   }
 
+  interface RethrowOptions {
+    operation?: string;
+    step?: string;
+    loggerOverride?: ILogger;
+  }
+
+  interface RethrowModule {
+    rethrowAndCountFspiopError(error: Error, options?: RethrowOptions, context?: string): never;
+    rethrowDatabaseError(error: Error, options?: RethrowOptions): never;
+    rethrowCachedDatabaseError(error: Error, options?: RethrowOptions): never;
+    rethrowRedisError(error: Error, options?: RethrowOptions): never;
+    rethrowKafkaError(error: Error, options?: RethrowOptions): never;
+    rethrowCacheError(error: Error, options?: RethrowOptions): never;
+    constructSystemExtensionError(error: Error, system: string): Error;
+    countFspiopError(error: Error, options?: RethrowOptions, context?: string): Error;
+    with(context: string): RethrowModule;
+  }
+
+  interface SpanTags {
+    transactionType: string;
+    transactionAction: string;
+    transactionId: string | undefined;
+    source: string | undefined;
+    destination: string | undefined;
+    payerFsp?: string;
+    payeeFsp?: string;
+  }
+
+  interface QueryTags {
+    serviceName: string;
+    auditType: string;
+    contentType: string;
+    operation: string;
+    [key: string]: any;
+  }
+
+  interface TransferSpanInput {
+    payload?: any;
+    headers?: Record<string, string>;
+    params?: { id?: string };
+  }
+
+  interface EventFramework {
+    getTransferSpanTags(input: TransferSpanInput, transactionType: string, transactionAction: string): SpanTags;
+    getSpanTags(transactionType: string, transactionAction: string, transactionId: string, source: string, destination: string): SpanTags;
+    getQueryTags(serviceName: string, auditType: string, contentType: string, operation: string, additionalTags?: Record<string, any>): QueryTags;
+    Tags: {
+      getTransferSpanTags: (input: TransferSpanInput, transactionType: string, transactionAction: string) => SpanTags;
+      getSpanTags: (transactionType: string, transactionAction: string, transactionId: string, source: string, destination: string) => SpanTags;
+      getQueryTags: (serviceName: string, auditType: string, contentType: string, operation: string, additionalTags?: Record<string, any>) => QueryTags;
+    };
+  }
+
   interface Util {
     Endpoints: Endpoints;
     Participants: Participants;
@@ -836,6 +1001,12 @@ declare namespace CentralServicesShared {
     HeaderValidation: HeaderValidation;
     Redis: Redis;
     distLock: DistLock;
+    rethrow: RethrowModule;
+    EventFramework: EventFramework;
+    resourceVersions: Record<string, { contentVersion: string }>;
+    Http: {
+      SwitchDefaultHeaders: (destination: string, resource: string, hubName: string, contentVersion: string) => Record<string, any>;
+    };
   }
 
   const Enum: Enum

package/src/util/endpoints.js

@@ -197,6 +197,9 @@ exports.getEndpoint = async (switchUrl, fsp, endpointType, options = {}, renderO
       hit = endpoints.cached !== null
       endpoints = endpoints.value
     }
+    if (!hit) {
+      log.warn(`getEndpoint cache miss for fsp=${fsp}, endpointType=${endpointType}`)
+    }
 
     const result = renderEndpoint(endpoints)
     histTimer({ success: true, hit })