@nolag/core 0.4.0

package/dist/modules/signingKeyModule/signingKey.service.js

@@ -0,0 +1,259 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var SigningKeyService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SigningKeyService = void 0;
+const common_1 = require("@nestjs/common");
+const jwt = __importStar(require("jsonwebtoken"));
+const secretCipher_1 = require("../../common/utils/secretCipher");
+const secretHash_1 = require("../../common/utils/secretHash");
+const ttlCache_1 = require("../../common/utils/ttlCache");
+const core_config_1 = require("../../core.config");
+const ESigningKeyPrefix_enum_1 = require("./enum/ESigningKeyPrefix.enum");
+const ESigningKeyStatus_enum_1 = require("./enum/ESigningKeyStatus.enum");
+const typeorm_1 = require("typeorm");
+const exceptions_1 = require("../../utils/exceptions");
+const signingKey_entity_1 = require("./signingKey.entity");
+const signingKey_repository_1 = require("./signingKey.repository");
+const KID_PATTERN = /^sk_(live|sandbox)_[0-9a-f]{12}$/;
+const SUB_PATTERN = /^at_(live|sandbox)_[0-9a-f]{12}$/;
+const MAX_TTL_SECONDS = 3600;
+const CLOCK_SKEW_SECONDS = 60;
+let SigningKeyService = SigningKeyService_1 = class SigningKeyService {
+    _signingKeyRepository;
+    _config;
+    _logger = new common_1.Logger(SigningKeyService_1.name);
+    _kidCache = new ttlCache_1.TtlCache(60_000);
+    constructor(_signingKeyRepository, _config) {
+        this._signingKeyRepository = _signingKeyRepository;
+        this._config = _config;
+    }
+    encryptionKey() {
+        const key = this._config.signingKeyEncryptionKey;
+        if (!key) {
+            throw new Error("SIGNING_KEY_ENCRYPTION_KEY is not configured; signing keys are unavailable");
+        }
+        return key;
+    }
+    generateSigningKey(environmentPrefix = ESigningKeyPrefix_enum_1.ESigningKeyPrefix.Live) {
+        const { keyId, secret, credential } = (0, secretHash_1.generateCredential)(environmentPrefix);
+        return { keyId, secret, signingKey: credential };
+    }
+    encryptForStorage(secret) {
+        return (0, secretCipher_1.encryptSecret)(secret, this.encryptionKey());
+    }
+    async verifyClientToken(token) {
+        const segments = token.split(".");
+        if (segments.length !== 3 || !token.startsWith("eyJ")) {
+            return null;
+        }
+        const decoded = jwt.decode(token, { complete: true });
+        if (!decoded) {
+            return null;
+        }
+        const { alg, kid } = decoded.header;
+        if (alg !== "HS256") {
+            this._logger.warn("Client token rejected: disallowed algorithm", { alg });
+            return null;
+        }
+        if (!kid || !KID_PATTERN.test(kid)) {
+            this._logger.warn("Client token rejected: missing or malformed kid");
+            return null;
+        }
+        const resolved = await this._resolveSigningKey(kid);
+        if (!resolved) {
+            return null;
+        }
+        let payload;
+        try {
+            payload = jwt.verify(token, resolved.secret, {
+                algorithms: ["HS256"],
+                clockTolerance: CLOCK_SKEW_SECONDS,
+            });
+        }
+        catch (error) {
+            this._logger.warn("Client token rejected: verification failed", {
+                kid,
+                reason: error instanceof Error ? error.message : "unknown",
+            });
+            return null;
+        }
+        if (typeof payload.exp !== "number") {
+            this._logger.warn("Client token rejected: missing exp claim", { kid });
+            return null;
+        }
+        const nowSeconds = Math.floor(Date.now() / 1000);
+        if (payload.exp > nowSeconds + MAX_TTL_SECONDS + CLOCK_SKEW_SECONDS) {
+            this._logger.warn("Client token rejected: exp exceeds TTL cap", {
+                kid,
+                exp: payload.exp,
+            });
+            return null;
+        }
+        if (typeof payload.sub !== "string" || !SUB_PATTERN.test(payload.sub)) {
+            this._logger.warn("Client token rejected: missing or malformed sub", {
+                kid,
+            });
+            return null;
+        }
+        void this._signingKeyRepository
+            .updateLastUsed(resolved.entity.signingKeyId)
+            .catch((err) => this._logger.error("Failed to update lastUsedAt", err));
+        return {
+            signingKey: resolved.entity,
+            payload: {
+                sub: payload.sub,
+                exp: payload.exp,
+                iat: payload.iat,
+            },
+        };
+    }
+    async _resolveSigningKey(kid) {
+        const cached = this._kidCache.get(kid);
+        if (cached) {
+            return cached;
+        }
+        const entity = await this._signingKeyRepository.findByKeyId(kid);
+        if (!entity) {
+            this._logger.warn("Client token rejected: unknown signing key", { kid });
+            return null;
+        }
+        if (entity.status !== ESigningKeyStatus_enum_1.ESigningKeyStatus.Active) {
+            this._logger.warn("Client token rejected: signing key not active", {
+                kid,
+                projectId: entity.projectId,
+                status: entity.status,
+            });
+            return null;
+        }
+        let secret;
+        try {
+            secret = (0, secretCipher_1.decryptSecret)(entity.secretEncrypted, this.encryptionKey());
+        }
+        catch (error) {
+            this._logger.error("Failed to decrypt signing key secret", {
+                kid,
+                projectId: entity.projectId,
+                error: error instanceof Error ? error.message : "unknown",
+            });
+            return null;
+        }
+        const resolved = { entity, secret };
+        this._kidCache.set(kid, resolved);
+        return resolved;
+    }
+    invalidateCache(keyId) {
+        this._kidCache.delete(keyId);
+    }
+    _repo(manager) {
+        return manager
+            ? manager.getRepository(signingKey_entity_1.SigningKeyEntity)
+            : this._signingKeyRepository;
+    }
+    findByIdAndProject(signingKeyId, projectId, manager) {
+        return this._repo(manager).findOne({
+            where: { signingKeyId, projectId, deletedAt: (0, typeorm_1.IsNull)() },
+        });
+    }
+    async createSigningKey(projectId, data, manager) {
+        const prefix = data.environment === "sandbox"
+            ? ESigningKeyPrefix_enum_1.ESigningKeyPrefix.Sandbox
+            : ESigningKeyPrefix_enum_1.ESigningKeyPrefix.Live;
+        const generated = this.generateSigningKey(prefix);
+        const entity = new signingKey_entity_1.SigningKeyEntity();
+        entity.projectId = projectId;
+        entity.keyId = generated.keyId;
+        entity.secretEncrypted = this.encryptForStorage(generated.secret);
+        entity.name = data.name;
+        entity.status = ESigningKeyStatus_enum_1.ESigningKeyStatus.Active;
+        const saved = await this._repo(manager).save(entity);
+        return { entity: saved, signingKey: generated.signingKey };
+    }
+    updateLock(signingKeyId, projectId, manager) {
+        const alias = signingKey_entity_1.SigningKeyEntity.entityName();
+        return manager
+            .createQueryBuilder(signingKey_entity_1.SigningKeyEntity, alias)
+            .where(`${alias}.signingKeyId = :signingKeyId AND ${alias}.projectId = :projectId`, { signingKeyId, projectId })
+            .andWhere(`${alias}.deletedAt IS NULL`)
+            .setLock("pessimistic_read")
+            .getOne();
+    }
+    async patchSigningKey(signingKeyId, projectId, data, manager) {
+        const repo = this._repo(manager);
+        const entity = await repo.findOne({
+            where: { signingKeyId, projectId, deletedAt: (0, typeorm_1.IsNull)() },
+        });
+        if (!entity) {
+            throw (0, exceptions_1.badRequestException)(this._logger, {
+                errorMsgUser: "Could not update signing key",
+                errorMsgSystem: "SigningKeyService:patchSigningKey:not_found",
+            });
+        }
+        if (data.name !== undefined)
+            entity.name = data.name;
+        if (data.status !== undefined)
+            entity.status = data.status;
+        const saved = await repo.save(entity);
+        this.invalidateCache(entity.keyId);
+        return saved;
+    }
+    async removeSigningKey(signingKeyId, projectId, manager) {
+        const existing = await this.findByIdAndProject(signingKeyId, projectId, manager);
+        const result = await this._repo(manager).softDelete({
+            signingKeyId,
+            projectId,
+            deletedAt: (0, typeorm_1.IsNull)(),
+        });
+        if (existing) {
+            this.invalidateCache(existing.keyId);
+        }
+        return result;
+    }
+};
+exports.SigningKeyService = SigningKeyService;
+exports.SigningKeyService = SigningKeyService = SigningKeyService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [signingKey_repository_1.SigningKeyRepository,
+        core_config_1.CoreConfig])
+], SigningKeyService);

package/dist/schema.d.ts

@@ -0,0 +1,19 @@
+import type { MigrationInterface } from "typeorm";
+type MigrationClass = new (...args: never[]) => MigrationInterface;
+import { AccessScopeEntity } from "./modules/accessScopeModule/accessScope.entity";
+import { ActorAppAccessEntity } from "./modules/actorTokenModule/actorAppAccess.entity";
+import { ActorTokenEntity } from "./modules/actorTokenModule/actorToken.entity";
+import { ActorTokenStateEntity } from "./modules/actorTokenModule/actorTokenState.entity";
+import { LobbyEntity } from "./modules/lobbyModule/lobby.entity";
+import { LobbyRoomEntity } from "./modules/lobbyModule/lobbyRoom.entity";
+import { PlatformAppEntity } from "./modules/platformAppModule/platformApp.entity";
+import { ProjectEntity } from "./modules/projectModule/project.entity";
+import { RoomActorAccessEntity } from "./modules/roomModule/roomActorAccess.entity";
+import { RoomEntity } from "./modules/roomModule/room.entity";
+import { SigningKeyEntity } from "./modules/signingKeyModule/signingKey.entity";
+export declare const coreEntities: (typeof ProjectEntity | typeof AccessScopeEntity | typeof ActorTokenEntity | typeof PlatformAppEntity | typeof ActorAppAccessEntity | typeof ActorTokenStateEntity | typeof RoomEntity | typeof LobbyRoomEntity | typeof LobbyEntity | typeof RoomActorAccessEntity | typeof SigningKeyEntity)[];
+export declare const coreInitialMigrations: MigrationClass[];
+export declare const coreMigrations: MigrationClass[];
+export declare const allCoreMigrations: MigrationClass[];
+export {};
+//# sourceMappingURL=schema.d.ts.map

package/dist/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAIlD,KAAK,cAAc,GAAG,KAAK,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,kBAAkB,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gDAAgD,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kDAAkD,CAAC;AACxF,OAAO,EAAE,gBAAgB,EAAE,MAAM,8CAA8C,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gDAAgD,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACpF,OAAO,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,8CAA8C,CAAC;AAUhF,eAAO,MAAM,YAAY,kSAYxB,CAAC;AAUF,eAAO,MAAM,qBAAqB,EAAE,cAAc,EAEjD,CAAC;AAKF,eAAO,MAAM,cAAc,EAAE,cAAc,EAAO,CAAC;AAGnD,eAAO,MAAM,iBAAiB,kBAAgD,CAAC"}

package/dist/schema.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.allCoreMigrations = exports.coreMigrations = exports.coreInitialMigrations = exports.coreEntities = void 0;
+const _1786323955167_InitialSchema_1 = require("./migrations/1786323955167-InitialSchema");
+const accessScope_entity_1 = require("./modules/accessScopeModule/accessScope.entity");
+const actorAppAccess_entity_1 = require("./modules/actorTokenModule/actorAppAccess.entity");
+const actorToken_entity_1 = require("./modules/actorTokenModule/actorToken.entity");
+const actorTokenState_entity_1 = require("./modules/actorTokenModule/actorTokenState.entity");
+const lobby_entity_1 = require("./modules/lobbyModule/lobby.entity");
+const lobbyRoom_entity_1 = require("./modules/lobbyModule/lobbyRoom.entity");
+const platformApp_entity_1 = require("./modules/platformAppModule/platformApp.entity");
+const project_entity_1 = require("./modules/projectModule/project.entity");
+const roomActorAccess_entity_1 = require("./modules/roomModule/roomActorAccess.entity");
+const room_entity_1 = require("./modules/roomModule/room.entity");
+const signingKey_entity_1 = require("./modules/signingKeyModule/signingKey.entity");
+exports.coreEntities = [
+    project_entity_1.ProjectEntity,
+    platformApp_entity_1.PlatformAppEntity,
+    room_entity_1.RoomEntity,
+    roomActorAccess_entity_1.RoomActorAccessEntity,
+    lobby_entity_1.LobbyEntity,
+    lobbyRoom_entity_1.LobbyRoomEntity,
+    accessScope_entity_1.AccessScopeEntity,
+    actorToken_entity_1.ActorTokenEntity,
+    actorTokenState_entity_1.ActorTokenStateEntity,
+    actorAppAccess_entity_1.ActorAppAccessEntity,
+    signingKey_entity_1.SigningKeyEntity,
+];
+exports.coreInitialMigrations = [
+    _1786323955167_InitialSchema_1.InitialSchema1786323955167,
+];
+exports.coreMigrations = [];
+exports.allCoreMigrations = [...exports.coreInitialMigrations, ...exports.coreMigrations];

package/dist/utils/clientToken.d.ts

@@ -0,0 +1,2 @@
+export declare function isClientTokenJwt(token: string): boolean;
+//# sourceMappingURL=clientToken.d.ts.map

package/dist/utils/clientToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientToken.d.ts","sourceRoot":"","sources":["../../src/utils/clientToken.ts"],"names":[],"mappings":"AAWA,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEvD"}

package/dist/utils/clientToken.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isClientTokenJwt = isClientTokenJwt;
+function isClientTokenJwt(token) {
+    return token.startsWith("eyJ") && token.split(".").length === 3;
+}

package/dist/utils/exceptions.d.ts

@@ -0,0 +1,16 @@
+import { type HttpException, Logger } from "@nestjs/common";
+export interface IErrorMessagesOptions {
+    errorMsgUser?: string;
+    errorMsgSystem?: string;
+}
+export interface IException {
+    id: string;
+    message: string;
+    timestamp: string;
+}
+export declare const badRequestException: (loggerInstance: Logger, errorMessagesOptions?: IErrorMessagesOptions) => HttpException;
+export declare const unauthorizedException: (loggerInstance: Logger, errorMessagesOptions?: IErrorMessagesOptions) => HttpException;
+export declare const forbiddenException: (loggerInstance: Logger, errorMessagesOptions?: IErrorMessagesOptions) => HttpException;
+export declare const notFoundException: (loggerInstance: Logger, errorMessagesOptions?: IErrorMessagesOptions) => HttpException;
+export declare const conflictException: (loggerInstance: Logger, errorMessagesOptions?: IErrorMessagesOptions) => HttpException;
+//# sourceMappingURL=exceptions.d.ts.map

package/dist/utils/exceptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exceptions.d.ts","sourceRoot":"","sources":["../../src/utils/exceptions.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,aAAa,EAClB,MAAM,EAGP,MAAM,gBAAgB,CAAC;AAGxB,MAAM,WAAW,qBAAqB;IAEpC,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAqCD,eAAO,MAAM,mBAAmB,mBAlBZ,MAAM,yBACC,qBAAqB,KAC3C,aAoBJ,CAAC;AAEF,eAAO,MAAM,qBAAqB,mBAxBd,MAAM,yBACC,qBAAqB,KAC3C,aA0BJ,CAAC;AAEF,eAAO,MAAM,kBAAkB,mBA9BX,MAAM,yBACC,qBAAqB,KAC3C,aAgCJ,CAAC;AAEF,eAAO,MAAM,iBAAiB,mBApCV,MAAM,yBACC,qBAAqB,KAC3C,aAkCyE,CAAC;AAE/E,eAAO,MAAM,iBAAiB,mBAtCV,MAAM,yBACC,qBAAqB,KAC3C,aAoCwE,CAAC"}

package/dist/utils/exceptions.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.conflictException = exports.notFoundException = exports.forbiddenException = exports.unauthorizedException = exports.badRequestException = void 0;
+const common_1 = require("@nestjs/common");
+const guid_1 = require("./guid");
+const build = (Exception, defaultMessage, level) => {
+    return (loggerInstance, errorMessagesOptions) => {
+        const exception = {
+            id: (0, guid_1.generateRandomUuid)(),
+            message: errorMessagesOptions?.errorMsgUser || defaultMessage,
+            timestamp: new Date().toISOString(),
+        };
+        loggerInstance[level]({
+            ...exception,
+            errorMsgSystem: errorMessagesOptions?.errorMsgSystem,
+        });
+        return new Exception(exception);
+    };
+};
+exports.badRequestException = build(common_1.BadRequestException, "Bad request", "warn");
+exports.unauthorizedException = build(common_1.UnauthorizedException, "Unauthorized", "warn");
+exports.forbiddenException = build(common_1.ForbiddenException, "Forbidden", "warn");
+exports.notFoundException = build(common_1.NotFoundException, "Not found", "warn");
+exports.conflictException = build(common_1.ConflictException, "Conflict", "warn");

package/dist/utils/guid.d.ts

@@ -0,0 +1,4 @@
+export declare const generateDBUuid: () => string;
+export declare const generateRandomUuid: () => string;
+export declare const validateUUID: (uuid: string) => boolean;
+//# sourceMappingURL=guid.d.ts.map

package/dist/utils/guid.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guid.d.ts","sourceRoot":"","sources":["../../src/utils/guid.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,cAAc,QAAO,MAEjC,CAAC;AAEF,eAAO,MAAM,kBAAkB,QAAO,MAErC,CAAC;AAEF,eAAO,MAAM,YAAY,GAAI,MAAM,MAAM,KAAG,OAE3C,CAAC"}

package/dist/utils/guid.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateUUID = exports.generateRandomUuid = exports.generateDBUuid = void 0;
+const uuid_1 = require("uuid");
+const generateDBUuid = () => {
+    return (0, uuid_1.v7)();
+};
+exports.generateDBUuid = generateDBUuid;
+const generateRandomUuid = () => {
+    return (0, uuid_1.v4)();
+};
+exports.generateRandomUuid = generateRandomUuid;
+const validateUUID = (uuid) => {
+    return (0, uuid_1.validate)(uuid);
+};
+exports.validateUUID = validateUUID;

package/package.json

@@ -0,0 +1,127 @@
+{
+  "name": "@nolag/core",
+  "version": "0.4.0",
+  "description": "The authorization domain of NoLag, as a library",
+  "license": "Apache-2.0",
+  "private": false,
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/NoLagApp/nolag-core.git"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "clean": "rm -rf dist *.tsbuildinfo",
+    "format": "prettier --write \"src/**/*.ts\" \"test/**/*.ts\"",
+    "lint": "eslint \"{src,test}/**/*.ts\" --fix",
+    "test": "jest",
+    "test:watch": "jest --watch",
+    "test:cov": "jest --coverage",
+    "test:e2e": "jest --config ./test/jest-e2e.json",
+    "test:stack": "jest --config ./test/jest-stack.json",
+    "test:package": "bash scripts/test-package.sh",
+    "migration:create": "typeorm-ts-node-commonjs migration:create",
+    "migration:generate": "typeorm-ts-node-commonjs migration:generate -d tools/data-source.ts",
+    "migration:run": "typeorm-ts-node-commonjs migration:run -d tools/data-source.ts",
+    "migration:revert": "typeorm-ts-node-commonjs migration:revert -d tools/data-source.ts",
+    "migration:show": "typeorm-ts-node-commonjs migration:show -d tools/data-source.ts",
+    "prepublishOnly": "npm run clean && npm run build"
+  },
+  "overridesNote": "js-yaml: @nestjs/swagger pins exactly 5.2.1, which carries GHSA-pm4m-ph32-ghv5 (DoS via flow collections). It only parses the OpenAPI document we author ourselves, so the practical risk is nil, but a patch bump keeps `npm audit` clean for anyone cloning this. Drop the override once @nestjs/swagger ships a fixed pin.",
+  "overrides": {
+    "js-yaml": "^5.2.3"
+  },
+  "dependencies": {
+    "jsonwebtoken": "^9.0.2",
+    "uuid": "^13.0.0"
+  },
+  "devDependencies": {
+    "@eslint/eslintrc": "^3.2.0",
+    "@eslint/js": "^9.18.0",
+    "@nestjs/cli": "^11.0.0",
+    "@nestjs/common": "^11.0.0",
+    "@nestjs/config": "^4.0.4",
+    "@nestjs/core": "^11.0.0",
+    "@nestjs/platform-express": "^11.0.1",
+    "@nestjs/schematics": "^11.0.0",
+    "@nestjs/swagger": "^11.0.0",
+    "@nestjs/testing": "^11.0.1",
+    "@nestjs/typeorm": "^11.0.0",
+    "@nolag/js-sdk": "^1.11.0",
+    "@types/express": "^5.0.0",
+    "@types/jest": "^30.0.0",
+    "@types/jsonwebtoken": "^9.0.10",
+    "@types/node": "^22.10.7",
+    "@types/pg": "^8.11.10",
+    "@types/supertest": "^6.0.2",
+    "@types/uuid": "^11.0.0",
+    "class-transformer": "^0.5.1",
+    "class-validator": "^0.14.1",
+    "dotenv": "^16.4.7",
+    "eslint": "^9.18.0",
+    "eslint-config-prettier": "^10.0.1",
+    "eslint-plugin-prettier": "^5.2.2",
+    "globals": "^16.0.0",
+    "jest": "^30.0.0",
+    "pg": "^8.13.1",
+    "prettier": "^3.4.2",
+    "reflect-metadata": "^0.2.0",
+    "rxjs": "^7.8.0",
+    "supertest": "^7.0.0",
+    "ts-jest": "^29.2.5",
+    "ts-loader": "^9.5.2",
+    "ts-node": "^10.9.2",
+    "tsconfig-paths": "^4.2.0",
+    "typeorm": "^0.3.21",
+    "typescript": "^5.7.3",
+    "typescript-eslint": "^8.20.0"
+  },
+  "jest": {
+    "moduleFileExtensions": [
+      "js",
+      "json",
+      "ts"
+    ],
+    "rootDir": "src",
+    "testRegex": ".*\\.spec\\.ts$",
+    "transform": {
+      "^.+\\.(t|j)s$": "ts-jest"
+    },
+    "transformIgnorePatterns": [
+      "/node_modules/(?!(uuid)/)"
+    ],
+    "collectCoverageFrom": [
+      "**/*.(t|j)s"
+    ],
+    "coverageDirectory": "../coverage",
+    "testEnvironment": "node"
+  },
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "NOTICE"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "peerDependencies": {
+    "@nestjs/common": "^11.0.0",
+    "@nestjs/core": "^11.0.0",
+    "@nestjs/swagger": "^11.0.0",
+    "@nestjs/typeorm": "^11.0.0",
+    "class-transformer": "^0.5.1",
+    "class-validator": "^0.14.1",
+    "reflect-metadata": "^0.2.0",
+    "rxjs": "^7.8.0",
+    "typeorm": "^0.3.21"
+  }
+}