@open-mercato/shared 0.6.7 → 0.6.8-develop.6874.1.982d6097d8

package/dist/lib/webhooks/verify.js

@@ -1,13 +1,16 @@
 import { timingSafeEqual, createHmac } from "node:crypto";
 import { parseWebhookSecret } from "./secrets.js";
-const TOLERANCE_SECONDS = 5 * 60;
-function verifyWebhookSignature(msgId, timestamp, body, signatureHeader, secrets, toleranceSeconds = TOLERANCE_SECONDS) {
-  const timestampNum = parseInt(timestamp, 10);
-  if (isNaN(timestampNum)) {
-    return { valid: false };
+const WEBHOOK_SIGNATURE_TOLERANCE_SECONDS = 5 * 60;
+function isWebhookTimestampWithinTolerance(timestamp, toleranceSeconds = WEBHOOK_SIGNATURE_TOLERANCE_SECONDS, nowSeconds = Math.floor(Date.now() / 1e3)) {
+  const normalizedTimestamp = timestamp.trim();
+  if (!/^\d+$/.test(normalizedTimestamp)) {
+    return false;
   }
-  const now = Math.floor(Date.now() / 1e3);
-  if (Math.abs(now - timestampNum) > toleranceSeconds) {
+  const timestampNum = Number.parseInt(normalizedTimestamp, 10);
+  return Math.abs(nowSeconds - timestampNum) <= toleranceSeconds;
+}
+function verifyWebhookSignature(msgId, timestamp, body, signatureHeader, secrets, toleranceSeconds = WEBHOOK_SIGNATURE_TOLERANCE_SECONDS) {
+  if (!isWebhookTimestampWithinTolerance(timestamp, toleranceSeconds)) {
     return { valid: false };
   }
   const signedContent = `${msgId}.${timestamp}.${body}`;
@@ -29,6 +32,8 @@ function verifyWebhookSignature(msgId, timestamp, body, signatureHeader, secrets
   return { valid: false };
 }
 export {
+  WEBHOOK_SIGNATURE_TOLERANCE_SECONDS,
+  isWebhookTimestampWithinTolerance,
   verifyWebhookSignature
 };
 //# sourceMappingURL=verify.js.map

package/dist/lib/webhooks/verify.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/webhooks/verify.ts"],
-  "sourcesContent": ["import { timingSafeEqual, createHmac } from 'node:crypto'\nimport { parseWebhookSecret } from './secrets'\nimport type { WebhookVerificationResult } from './types'\n\nconst TOLERANCE_SECONDS = 5 * 60 // 5 minutes\n\n/**\n * Verify a Standard Webhooks signature against one or more secrets.\n * Returns verification result with which key matched.\n */\nexport function verifyWebhookSignature(\n  msgId: string,\n  timestamp: string,\n  body: string,\n  signatureHeader: string,\n  secrets: string[],\n  toleranceSeconds: number = TOLERANCE_SECONDS,\n): WebhookVerificationResult {\n  const timestampNum = parseInt(timestamp, 10)\n  if (isNaN(timestampNum)) {\n    return { valid: false }\n  }\n\n  const now = Math.floor(Date.now() / 1000)\n  if (Math.abs(now - timestampNum) > toleranceSeconds) {\n    return { valid: false }\n  }\n\n  const signedContent = `${msgId}.${timestamp}.${body}`\n  const providedSignatures = signatureHeader.split(' ')\n\n  for (let keyIndex = 0; keyIndex < secrets.length; keyIndex++) {\n    const key = parseWebhookSecret(secrets[keyIndex])\n    const expectedSig = createHmac('sha256', key)\n      .update(signedContent)\n      .digest('base64')\n\n    for (const sig of providedSignatures) {\n      const parts = sig.split(',')\n      if (parts.length !== 2 || parts[0] !== 'v1') continue\n\n      const sigBytes = Buffer.from(parts[1], 'base64')\n      const expectedBytes = Buffer.from(expectedSig, 'base64')\n\n      if (sigBytes.length !== expectedBytes.length) continue\n\n      if (timingSafeEqual(sigBytes, expectedBytes)) {\n        return { valid: true, matchedKeyIndex: keyIndex }\n      }\n    }\n  }\n\n  return { valid: false }\n}\n"],
-  "mappings": "AAAA,SAAS,iBAAiB,kBAAkB;AAC5C,SAAS,0BAA0B;AAGnC,MAAM,oBAAoB,IAAI;AAMvB,SAAS,uBACd,OACA,WACA,MACA,iBACA,SACA,mBAA2B,mBACA;AAC3B,QAAM,eAAe,SAAS,WAAW,EAAE;AAC3C,MAAI,MAAM,YAAY,GAAG;AACvB,WAAO,EAAE,OAAO,MAAM;AAAA,EACxB;AAEA,QAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,MAAI,KAAK,IAAI,MAAM,YAAY,IAAI,kBAAkB;AACnD,WAAO,EAAE,OAAO,MAAM;AAAA,EACxB;AAEA,QAAM,gBAAgB,GAAG,KAAK,IAAI,SAAS,IAAI,IAAI;AACnD,QAAM,qBAAqB,gBAAgB,MAAM,GAAG;AAEpD,WAAS,WAAW,GAAG,WAAW,QAAQ,QAAQ,YAAY;AAC5D,UAAM,MAAM,mBAAmB,QAAQ,QAAQ,CAAC;AAChD,UAAM,cAAc,WAAW,UAAU,GAAG,EACzC,OAAO,aAAa,EACpB,OAAO,QAAQ;AAElB,eAAW,OAAO,oBAAoB;AACpC,YAAM,QAAQ,IAAI,MAAM,GAAG;AAC3B,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,KAAM;AAE7C,YAAM,WAAW,OAAO,KAAK,MAAM,CAAC,GAAG,QAAQ;AAC/C,YAAM,gBAAgB,OAAO,KAAK,aAAa,QAAQ;AAEvD,UAAI,SAAS,WAAW,cAAc,OAAQ;AAE9C,UAAI,gBAAgB,UAAU,aAAa,GAAG;AAC5C,eAAO,EAAE,OAAO,MAAM,iBAAiB,SAAS;AAAA,MAClD;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,OAAO,MAAM;AACxB;",
+  "sourcesContent": ["import { timingSafeEqual, createHmac } from 'node:crypto'\nimport { parseWebhookSecret } from './secrets'\nimport type { WebhookVerificationResult } from './types'\n\nexport const WEBHOOK_SIGNATURE_TOLERANCE_SECONDS = 5 * 60 // 5 minutes\n\nexport function isWebhookTimestampWithinTolerance(\n  timestamp: string,\n  toleranceSeconds: number = WEBHOOK_SIGNATURE_TOLERANCE_SECONDS,\n  nowSeconds: number = Math.floor(Date.now() / 1000),\n): boolean {\n  const normalizedTimestamp = timestamp.trim()\n  if (!/^\\d+$/.test(normalizedTimestamp)) {\n    return false\n  }\n\n  const timestampNum = Number.parseInt(normalizedTimestamp, 10)\n  return Math.abs(nowSeconds - timestampNum) <= toleranceSeconds\n}\n\n/**\n * Verify a Standard Webhooks signature against one or more secrets.\n * Returns verification result with which key matched.\n */\nexport function verifyWebhookSignature(\n  msgId: string,\n  timestamp: string,\n  body: string,\n  signatureHeader: string,\n  secrets: string[],\n  toleranceSeconds: number = WEBHOOK_SIGNATURE_TOLERANCE_SECONDS,\n): WebhookVerificationResult {\n  if (!isWebhookTimestampWithinTolerance(timestamp, toleranceSeconds)) {\n    return { valid: false }\n  }\n\n  const signedContent = `${msgId}.${timestamp}.${body}`\n  const providedSignatures = signatureHeader.split(' ')\n\n  for (let keyIndex = 0; keyIndex < secrets.length; keyIndex++) {\n    const key = parseWebhookSecret(secrets[keyIndex])\n    const expectedSig = createHmac('sha256', key)\n      .update(signedContent)\n      .digest('base64')\n\n    for (const sig of providedSignatures) {\n      const parts = sig.split(',')\n      if (parts.length !== 2 || parts[0] !== 'v1') continue\n\n      const sigBytes = Buffer.from(parts[1], 'base64')\n      const expectedBytes = Buffer.from(expectedSig, 'base64')\n\n      if (sigBytes.length !== expectedBytes.length) continue\n\n      if (timingSafeEqual(sigBytes, expectedBytes)) {\n        return { valid: true, matchedKeyIndex: keyIndex }\n      }\n    }\n  }\n\n  return { valid: false }\n}\n"],
+  "mappings": "AAAA,SAAS,iBAAiB,kBAAkB;AAC5C,SAAS,0BAA0B;AAG5B,MAAM,sCAAsC,IAAI;AAEhD,SAAS,kCACd,WACA,mBAA2B,qCAC3B,aAAqB,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GACxC;AACT,QAAM,sBAAsB,UAAU,KAAK;AAC3C,MAAI,CAAC,QAAQ,KAAK,mBAAmB,GAAG;AACtC,WAAO;AAAA,EACT;AAEA,QAAM,eAAe,OAAO,SAAS,qBAAqB,EAAE;AAC5D,SAAO,KAAK,IAAI,aAAa,YAAY,KAAK;AAChD;AAMO,SAAS,uBACd,OACA,WACA,MACA,iBACA,SACA,mBAA2B,qCACA;AAC3B,MAAI,CAAC,kCAAkC,WAAW,gBAAgB,GAAG;AACnE,WAAO,EAAE,OAAO,MAAM;AAAA,EACxB;AAEA,QAAM,gBAAgB,GAAG,KAAK,IAAI,SAAS,IAAI,IAAI;AACnD,QAAM,qBAAqB,gBAAgB,MAAM,GAAG;AAEpD,WAAS,WAAW,GAAG,WAAW,QAAQ,QAAQ,YAAY;AAC5D,UAAM,MAAM,mBAAmB,QAAQ,QAAQ,CAAC;AAChD,UAAM,cAAc,WAAW,UAAU,GAAG,EACzC,OAAO,aAAa,EACpB,OAAO,QAAQ;AAElB,eAAW,OAAO,oBAAoB;AACpC,YAAM,QAAQ,IAAI,MAAM,GAAG;AAC3B,UAAI,MAAM,WAAW,KAAK,MAAM,CAAC,MAAM,KAAM;AAE7C,YAAM,WAAW,OAAO,KAAK,MAAM,CAAC,GAAG,QAAQ;AAC/C,YAAM,gBAAgB,OAAO,KAAK,aAAa,QAAQ;AAEvD,UAAI,SAAS,WAAW,cAAc,OAAQ;AAE9C,UAAI,gBAAgB,UAAU,aAAa,GAAG;AAC5C,eAAO,EAAE,OAAO,MAAM,iBAAiB,SAAS;AAAA,MAClD;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,OAAO,MAAM;AACxB;",
   "names": []
 }

package/dist/modules/analytics.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/modules/analytics.ts"],
-  "sourcesContent": ["import { createLogger } from '../lib/logger'\n\nconst logger = createLogger('shared').child({ component: 'analytics-registry' })\n\nexport type AggregateFunction = 'count' | 'sum' | 'avg' | 'min' | 'max'\n\nexport type DateGranularity = 'day' | 'week' | 'month' | 'quarter' | 'year'\n\nexport type AnalyticsFieldType = 'numeric' | 'text' | 'uuid' | 'timestamp' | 'jsonb'\n\nexport type AnalyticsEntityTypeConfig = {\n  tableName: string\n  schema?: string\n  dateField: string\n  defaultScopeFields: string[]\n}\n\nexport type AnalyticsFieldMapping = {\n  dbColumn: string\n  type: AnalyticsFieldType\n}\n\nexport type AnalyticsLabelResolverConfig = {\n  table: string\n  idColumn: string\n  labelColumn: string\n}\n\nexport type AnalyticsEntityConfig = {\n  entityId: string\n  requiredFeatures: string[]\n  entityConfig: AnalyticsEntityTypeConfig\n  fieldMappings: Record<string, AnalyticsFieldMapping>\n  labelResolvers?: Record<string, AnalyticsLabelResolverConfig>\n}\n\nexport type AnalyticsModuleConfig = {\n  entities: AnalyticsEntityConfig[]\n}\n\nlet _analyticsModuleConfigs: AnalyticsModuleConfig[] | null = null\n\nexport function registerAnalyticsModuleConfigs(configs: AnalyticsModuleConfig[]): void {\n  if (_analyticsModuleConfigs !== null && process.env.NODE_ENV === 'development') {\n    logger.debug('Analytics module configs re-registered (this may occur during HMR)')\n  }\n  _analyticsModuleConfigs = configs\n}\n\nexport function getAnalyticsModuleConfigs(): AnalyticsModuleConfig[] {\n  return _analyticsModuleConfigs ?? []\n}\n\nexport function getAllAnalyticsEntityConfigs(): AnalyticsEntityConfig[] {\n  const configs = getAnalyticsModuleConfigs()\n  return configs.flatMap((moduleConfig) => moduleConfig.entities)\n}\n\nexport function getAnalyticsEntityConfig(entityId: string): AnalyticsEntityConfig | null {\n  const entities = getAllAnalyticsEntityConfigs()\n  return entities.find((e) => e.entityId === entityId) ?? null\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,QAAQ,EAAE,MAAM,EAAE,WAAW,qBAAqB,CAAC;AAsC/E,IAAI,0BAA0D;AAEvD,SAAS,+BAA+B,SAAwC;AACrF,MAAI,4BAA4B,QAAQ,QAAQ,IAAI,aAAa,eAAe;AAC9E,WAAO,MAAM,oEAAoE;AAAA,EACnF;AACA,4BAA0B;AAC5B;AAEO,SAAS,4BAAqD;AACnE,SAAO,2BAA2B,CAAC;AACrC;AAEO,SAAS,+BAAwD;AACtE,QAAM,UAAU,0BAA0B;AAC1C,SAAO,QAAQ,QAAQ,CAAC,iBAAiB,aAAa,QAAQ;AAChE;AAEO,SAAS,yBAAyB,UAAgD;AACvF,QAAM,WAAW,6BAA6B;AAC9C,SAAO,SAAS,KAAK,CAAC,MAAM,EAAE,aAAa,QAAQ,KAAK;AAC1D;",
+  "sourcesContent": ["import { createLogger } from '../lib/logger'\n\nconst logger = createLogger('shared').child({ component: 'analytics-registry' })\n\nexport type AggregateFunction = 'count' | 'sum' | 'avg' | 'min' | 'max'\n\nexport type DateGranularity = 'day' | 'week' | 'month' | 'quarter' | 'year'\n\nexport type AnalyticsFieldType = 'numeric' | 'text' | 'uuid' | 'timestamp' | 'jsonb'\n\nexport type AnalyticsEntityTypeConfig = {\n  tableName: string\n  schema?: string\n  dateField: string\n  defaultScopeFields: string[]\n  /**\n   * Field name (a key of `fieldMappings`) holding the per-row currency of monetary\n   * columns. Declaring it lets analytics consumers verify that the rows they aggregate\n   * all carry one currency before labelling the result with it (#4676). Omit it for\n   * entities whose amounts are not per-row denominated.\n   */\n  currencyField?: string\n}\n\nexport type AnalyticsFieldMapping = {\n  dbColumn: string\n  type: AnalyticsFieldType\n}\n\nexport type AnalyticsLabelResolverConfig = {\n  table: string\n  idColumn: string\n  labelColumn: string\n}\n\nexport type AnalyticsEntityConfig = {\n  entityId: string\n  requiredFeatures: string[]\n  entityConfig: AnalyticsEntityTypeConfig\n  fieldMappings: Record<string, AnalyticsFieldMapping>\n  labelResolvers?: Record<string, AnalyticsLabelResolverConfig>\n}\n\nexport type AnalyticsModuleConfig = {\n  entities: AnalyticsEntityConfig[]\n}\n\nlet _analyticsModuleConfigs: AnalyticsModuleConfig[] | null = null\n\nexport function registerAnalyticsModuleConfigs(configs: AnalyticsModuleConfig[]): void {\n  if (_analyticsModuleConfigs !== null && process.env.NODE_ENV === 'development') {\n    logger.debug('Analytics module configs re-registered (this may occur during HMR)')\n  }\n  _analyticsModuleConfigs = configs\n}\n\nexport function getAnalyticsModuleConfigs(): AnalyticsModuleConfig[] {\n  return _analyticsModuleConfigs ?? []\n}\n\nexport function getAllAnalyticsEntityConfigs(): AnalyticsEntityConfig[] {\n  const configs = getAnalyticsModuleConfigs()\n  return configs.flatMap((moduleConfig) => moduleConfig.entities)\n}\n\nexport function getAnalyticsEntityConfig(entityId: string): AnalyticsEntityConfig | null {\n  const entities = getAllAnalyticsEntityConfigs()\n  return entities.find((e) => e.entityId === entityId) ?? null\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,QAAQ,EAAE,MAAM,EAAE,WAAW,qBAAqB,CAAC;AA6C/E,IAAI,0BAA0D;AAEvD,SAAS,+BAA+B,SAAwC;AACrF,MAAI,4BAA4B,QAAQ,QAAQ,IAAI,aAAa,eAAe;AAC9E,WAAO,MAAM,oEAAoE;AAAA,EACnF;AACA,4BAA0B;AAC5B;AAEO,SAAS,4BAAqD;AACnE,SAAO,2BAA2B,CAAC;AACrC;AAEO,SAAS,+BAAwD;AACtE,QAAM,UAAU,0BAA0B;AAC1C,SAAO,QAAQ,QAAQ,CAAC,iBAAiB,aAAa,QAAQ;AAChE;AAEO,SAAS,yBAAyB,UAAgD;AACvF,QAAM,WAAW,6BAA6B;AAC9C,SAAO,SAAS,KAAK,CAAC,MAAM,EAAE,aAAa,QAAQ,KAAK;AAC1D;",
   "names": []
 }

package/dist/modules/overrides.js

@@ -23,7 +23,8 @@ const DOMAIN_KEYS = [
   "setup",
   "acl",
   "di",
-  "encryption"
+  "encryption",
+  "nav"
 ];
 const TRACKING_ISSUE_HINT = "See `.ai/specs/implemented/2026-05-04-modules-ts-unified-overrides.md` and tracking issue https://github.com/open-mercato/open-mercato/issues/1787.";
 function applyModuleOverridesFromEnabledModules(modules) {
@@ -74,6 +75,33 @@ const aclFeatureOverrideStore = { modules: {}, programmatic: {} };
 const encryptionMapOverrideStore = { modules: {}, programmatic: {} };
 const diOverrideStore = { modules: {}, programmatic: {} };
 const setupOverridesByModule = {};
+const GLOBAL_NAV_OVERRIDE_STATE_KEY = "__openMercatoNavOverrideState__";
+function getNavOverrideState() {
+  const existing = globalThis[GLOBAL_NAV_OVERRIDE_STATE_KEY];
+  if (existing && typeof existing === "object") {
+    const typed = existing;
+    if ("modules" in typed && "programmatic" in typed) return typed;
+  }
+  const initial = { modules: null, programmatic: null };
+  globalThis[GLOBAL_NAV_OVERRIDE_STATE_KEY] = initial;
+  return initial;
+}
+function normalizeNavGroupOrder(value) {
+  if (!Array.isArray(value)) return null;
+  const ids = Array.from(
+    new Set(
+      value.filter((id) => typeof id === "string" && id.trim().length > 0).map((id) => id.trim())
+    )
+  );
+  return ids.length > 0 ? ids : null;
+}
+function applyNavGroupOrderOverrides(groupOrder) {
+  getNavOverrideState().programmatic = groupOrder === null ? null : normalizeNavGroupOrder(groupOrder);
+}
+function getNavGroupOrderOverride() {
+  const state = getNavOverrideState();
+  return state.programmatic ?? state.modules?.groupOrder ?? null;
+}
 function normalizeIdOverrideKey(key, label) {
   if (typeof key !== "string") return null;
   const trimmed = key.trim();
@@ -261,6 +289,9 @@ function resetModuleContractOverridesForTests() {
   clearStore(encryptionMapOverrideStore);
   clearStore(diOverrideStore);
   for (const key of Object.keys(setupOverridesByModule)) delete setupOverridesByModule[key];
+  const navState = getNavOverrideState();
+  navState.modules = null;
+  navState.programmatic = null;
 }
 function composeApiRouteOverrides() {
   const modulesKeys = Object.keys(modulesConfigApiRouteOverrides);
@@ -827,7 +858,23 @@ function encryptionOverridesApplier(entries) {
     applyStoreOverrides(encryptionMapOverrideStore, "modules", entry.overrides?.maps, { label: "encryption.maps" });
   }
 }
+function navOverridesApplier(entries) {
+  const state = getNavOverrideState();
+  for (const entry of entries) {
+    const groupOrder = normalizeNavGroupOrder(entry.overrides?.groupOrder);
+    if (!groupOrder) continue;
+    if (state.modules && state.modules.moduleId !== entry.moduleId) {
+      logger.warn("nav.groupOrder declared by more than one module \u2014 the later one wins", {
+        previousModuleId: state.modules.moduleId,
+        moduleId: entry.moduleId,
+        hint: "Sidebar group ordering is a single app-wide decision; declare it on one module entry."
+      });
+    }
+    state.modules = { moduleId: entry.moduleId, groupOrder };
+  }
+}
 function registerBuiltInModuleOverrideAppliers() {
+  registerModuleOverrideApplier("nav", navOverridesApplier);
   registerModuleOverrideApplier("routes", routesOverridesApplier);
   registerModuleOverrideApplier("events", eventsOverridesApplier);
   registerModuleOverrideApplier("workers", workersOverridesApplier);
@@ -865,6 +912,7 @@ export {
   applyInjectionWidgetOverridesToTables,
   applyModuleOverridesFromEnabledModules,
   applyModuleOverridesToModules,
+  applyNavGroupOrderOverrides,
   applyNotificationHandlerOverrides,
   applyNotificationHandlerOverridesToEntries,
   applyNotificationTypeOverrides,
@@ -895,6 +943,7 @@ export {
   composeResponseEnricherOverrides,
   composeSubscriberOverrides,
   composeWorkerOverrides,
+  getNavGroupOrderOverride,
   registerModuleOverrideApplier,
   resetApiRouteOverridesForTests,
   resetModuleContractOverridesForTests,