@portaidentity/server 1.7.0

package/dist/lib/etag.js

@@ -0,0 +1,155 @@
+/**
+ * ETag generation and optimistic concurrency control utility.
+ *
+ * Provides ETag generation from entity metadata and If-Match header
+ * validation for optimistic concurrency on PUT/PATCH endpoints.
+ *
+ * ETags use MD5 hashing of entity type + ID + updatedAt timestamp.
+ * MD5 is used for speed, not security — ETags are not secrets, they
+ * are cache/concurrency markers. Weak ETags (W/"...") are used since
+ * the comparison is semantic equivalence, not byte-identical content.
+ *
+ * Integration pattern:
+ *   GET /:id  → setETagHeader(ctx, 'entity', id, updatedAt)
+ *   PUT /:id  → checkIfMatch(ctx, 'entity', id, current.updatedAt, current)
+ *
+ * @module lib/etag
+ */
+import { createHash } from 'node:crypto';
+// ============================================================================
+// ETag Generation
+// ============================================================================
+/**
+ * Generate a weak ETag from entity type, ID, and updatedAt timestamp.
+ *
+ * The ETag is a deterministic MD5 hash of the concatenation:
+ *   `${entityType}:${id}:${updatedAt.toISOString()}`
+ *
+ * Format: `W/"<first 16 hex chars of MD5>"` (weak ETag, 64-bit precision)
+ *
+ * @param entityType - Entity type string (e.g., 'organization', 'user')
+ * @param id - Entity UUID
+ * @param updatedAt - Entity's last modification timestamp
+ * @returns Weak ETag string (e.g., `W/"a1b2c3d4e5f67890"`)
+ */
+export function generateETag(entityType, id, updatedAt) {
+    const input = `${entityType}:${id}:${updatedAt.toISOString()}`;
+    const hash = createHash('md5').update(input).digest('hex').substring(0, 16);
+    return `W/"${hash}"`;
+}
+// ============================================================================
+// ETag Comparison
+// ============================================================================
+/**
+ * Compare an If-Match header value against the current ETag.
+ *
+ * Returns true if the ETags match (safe to proceed with the update).
+ * Handles:
+ * - Quoted strings: `"abc"` matches `W/"abc"` and vice versa
+ * - Weak prefix: `W/"abc"` is treated equivalently to `"abc"` for weak comparison
+ * - Wildcard: `*` always matches
+ * - Multiple ETags: `"abc", "def"` matches if any one matches
+ *
+ * @param ifMatchHeader - The value of the If-Match HTTP header
+ * @param currentETag - The current entity's ETag
+ * @returns true if they match
+ */
+export function matchesETag(ifMatchHeader, currentETag) {
+    const trimmed = ifMatchHeader.trim();
+    // Wildcard matches everything
+    if (trimmed === '*') {
+        return true;
+    }
+    // Extract the hash portion from the current ETag for comparison
+    const currentHash = extractHash(currentETag);
+    if (!currentHash) {
+        return false;
+    }
+    // Split on comma for multiple ETags: If-Match: "a", "b", "c"
+    const candidates = trimmed.split(',').map((s) => s.trim());
+    return candidates.some((candidate) => {
+        const candidateHash = extractHash(candidate);
+        return candidateHash !== null && candidateHash === currentHash;
+    });
+}
+/**
+ * Extract the raw hash string from an ETag value.
+ *
+ * Strips the W/ prefix and surrounding quotes:
+ *   `W/"abc123"` → `abc123`
+ *   `"abc123"`   → `abc123`
+ *   `abc123`     → `abc123`
+ *
+ * @param etag - ETag value (possibly with W/ prefix and quotes)
+ * @returns The raw hash string, or null if empty/invalid
+ */
+function extractHash(etag) {
+    let value = etag.trim();
+    // Remove weak prefix
+    if (value.startsWith('W/')) {
+        value = value.substring(2);
+    }
+    // Remove surrounding quotes
+    if (value.startsWith('"') && value.endsWith('"')) {
+        value = value.substring(1, value.length - 1);
+    }
+    return value.length > 0 ? value : null;
+}
+/**
+ * Set the ETag header on a GET response.
+ *
+ * Call this in GET-single-entity handlers after retrieving the entity:
+ * ```typescript
+ * const org = await getOrganization(id);
+ * setETagHeader(ctx, 'organization', id, org.updatedAt);
+ * ctx.body = { data: org };
+ * ```
+ *
+ * @param ctx - Koa context (or compatible object with set/get methods)
+ * @param entityType - Entity type string (e.g., 'organization')
+ * @param id - Entity UUID
+ * @param updatedAt - Entity's last modification timestamp
+ */
+export function setETagHeader(ctx, entityType, id, updatedAt) {
+    const etag = generateETag(entityType, id, updatedAt);
+    ctx.set('ETag', etag);
+}
+/**
+ * Check the If-Match header on a PUT/PATCH request.
+ *
+ * If the If-Match header is present and does NOT match the current entity's
+ * ETag, sets a 409 Conflict response with the current entity state and
+ * returns false (caller should `return` without proceeding).
+ *
+ * If the header is absent or matches, returns true (safe to proceed).
+ * This makes If-Match opt-in — backward compatible with clients that
+ * don't send it.
+ *
+ * @param ctx - Koa context
+ * @param entityType - Entity type string
+ * @param id - Entity UUID
+ * @param updatedAt - Entity's current updatedAt timestamp
+ * @param currentEntity - The current entity (included in 409 response body)
+ * @returns true if the update may proceed, false if 409 was sent
+ */
+export function checkIfMatch(ctx, entityType, id, updatedAt, currentEntity) {
+    const ifMatchHeader = ctx.get('If-Match');
+    if (!ifMatchHeader) {
+        // No If-Match header — backward compatible, proceed without check
+        return true;
+    }
+    const currentETag = generateETag(entityType, id, updatedAt);
+    if (matchesETag(ifMatchHeader, currentETag)) {
+        return true;
+    }
+    // Conflict — entity was modified since the client's last read
+    ctx.status = 409;
+    ctx.body = {
+        error: 'Conflict',
+        message: 'Entity has been modified since your last read. Please refresh and try again.',
+        currentEntity,
+        currentETag,
+    };
+    return false;
+}
+//# sourceMappingURL=etag.js.map

package/dist/lib/etag.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"etag.js","sourceRoot":"","sources":["../../src/lib/etag.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAAC,UAAkB,EAAE,EAAU,EAAE,SAAe;IAC1E,MAAM,KAAK,GAAG,GAAG,UAAU,IAAI,EAAE,IAAI,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;IAC/D,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5E,OAAO,MAAM,IAAI,GAAG,CAAC;AACvB,CAAC;AAED,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,WAAW,CAAC,aAAqB,EAAE,WAAmB;IACpE,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;IAErC,8BAA8B;IAC9B,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gEAAgE;IAChE,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,6DAA6D;IAC7D,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAE3D,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;QACnC,MAAM,aAAa,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;QAC7C,OAAO,aAAa,KAAK,IAAI,IAAI,aAAa,KAAK,WAAW,CAAC;IACjE,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAExB,qBAAqB;IACrB,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IAED,4BAA4B;IAC5B,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAgBD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,aAAa,CAAC,GAAgB,EAAE,UAAkB,EAAE,EAAU,EAAE,SAAe;IAC7F,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;IACrD,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AACxB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,YAAY,CAC1B,GAAgB,EAChB,UAAkB,EAClB,EAAU,EACV,SAAe,EACf,aAAsB;IAEtB,MAAM,aAAa,GAAG,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC1C,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,kEAAkE;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,WAAW,GAAG,YAAY,CAAC,UAAU,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;IAE5D,IAAI,WAAW,CAAC,aAAa,EAAE,WAAW,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8DAA8D;IAC9D,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;IACjB,GAAG,CAAC,IAAI,GAAG;QACT,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE,8EAA8E;QACvF,aAAa;QACb,WAAW;KACZ,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/lib/image-validator.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Image validation for branding asset uploads.
+ *
+ * Validates uploaded images using magic byte signature detection, size limits,
+ * and SVG sanitization. This prevents:
+ * - Disguised file uploads (wrong content-type vs actual content)
+ * - Oversized files
+ * - SVG-based XSS via embedded scripts or event handlers
+ *
+ * @module image-validator
+ * @see 06-bulk-operations-branding.md
+ */
+export type AssetType = 'logo' | 'favicon';
+/** Result of image validation — either valid or contains an error message */
+export interface ImageValidationResult {
+    valid: boolean;
+    error?: string;
+    /** The detected content type from magic bytes (may differ from declared) */
+    detectedType?: string;
+    /** True if SVG was sanitized (scripts removed) */
+    sanitized?: boolean;
+    /** Sanitized buffer (only for SVG; otherwise same as input) */
+    data?: Buffer;
+}
+/**
+ * Validate an uploaded image buffer against content type, size, and content rules.
+ *
+ * For binary formats (PNG, JPEG, WebP, ICO), validates magic byte signatures.
+ * For SVG, validates XML structure and sanitizes dangerous content (scripts,
+ * event handlers, javascript: URIs).
+ *
+ * @param buffer - Raw file data
+ * @param contentType - Declared content type from the upload
+ * @param assetType - Whether this is a logo or favicon (determines size limit)
+ * @returns Validation result with optional sanitized data for SVGs
+ */
+export declare function validateImage(buffer: Buffer, contentType: string, assetType: AssetType): ImageValidationResult;
+/**
+ * Get the size limit for an asset type.
+ * @param assetType - The asset type
+ * @returns Size limit in bytes
+ */
+export declare function getSizeLimit(assetType: AssetType): number;
+//# sourceMappingURL=image-validator.d.ts.map

package/dist/lib/image-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-validator.d.ts","sourceRoot":"","sources":["../../src/lib/image-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;AAE3C,6EAA6E;AAC7E,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAgDD;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,SAAS,GACnB,qBAAqB,CA8BvB;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,SAAS,GAAG,MAAM,CAEzD"}

package/dist/lib/image-validator.js

@@ -0,0 +1,204 @@
+/**
+ * Image validation for branding asset uploads.
+ *
+ * Validates uploaded images using magic byte signature detection, size limits,
+ * and SVG sanitization. This prevents:
+ * - Disguised file uploads (wrong content-type vs actual content)
+ * - Oversized files
+ * - SVG-based XSS via embedded scripts or event handlers
+ *
+ * @module image-validator
+ * @see 06-bulk-operations-branding.md
+ */
+// ============================================================================
+// Constants
+// ============================================================================
+/** Size limits per asset type (in bytes) */
+const SIZE_LIMITS = {
+    logo: 2 * 1024 * 1024, // 2 MB — logos can be larger for hi-DPI
+    favicon: 512 * 1024, // 512 KB — favicons should be small
+};
+/**
+ * Magic byte signatures for supported image formats.
+ * Each entry maps a content type to its expected leading bytes.
+ * SVG is XML-based and has no magic bytes — validated separately.
+ */
+const MAGIC_SIGNATURES = [
+    { type: 'image/png', bytes: [0x89, 0x50, 0x4E, 0x47] },
+    { type: 'image/jpeg', bytes: [0xFF, 0xD8, 0xFF] },
+    { type: 'image/webp', bytes: [0x52, 0x49, 0x46, 0x46] },
+    { type: 'image/x-icon', bytes: [0x00, 0x00, 0x01, 0x00] },
+    { type: 'image/vnd.microsoft.icon', bytes: [0x00, 0x00, 0x01, 0x00] },
+];
+/** Content types that are allowed for upload */
+const ALLOWED_TYPES = new Set([
+    'image/png',
+    'image/jpeg',
+    'image/svg+xml',
+    'image/webp',
+    'image/x-icon',
+    'image/vnd.microsoft.icon',
+]);
+/**
+ * Dangerous SVG elements and attributes that could enable XSS.
+ * These are stripped during sanitization to prevent stored XSS attacks.
+ */
+const SVG_DANGEROUS_ELEMENTS = /(<script[\s>][\s\S]*?<\/script>|<script[\s>][\s\S]*?\/>)/gi;
+const SVG_EVENT_HANDLERS = /\s+on\w+\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>]*)/gi;
+const SVG_JAVASCRIPT_HREFS = /\s+(href|xlink:href)\s*=\s*["']javascript:[^"']*["']/gi;
+const SVG_DATA_URIS_SCRIPT = /\s+(href|xlink:href)\s*=\s*["']data:text\/html[^"']*["']/gi;
+// ============================================================================
+// Public API
+// ============================================================================
+/**
+ * Validate an uploaded image buffer against content type, size, and content rules.
+ *
+ * For binary formats (PNG, JPEG, WebP, ICO), validates magic byte signatures.
+ * For SVG, validates XML structure and sanitizes dangerous content (scripts,
+ * event handlers, javascript: URIs).
+ *
+ * @param buffer - Raw file data
+ * @param contentType - Declared content type from the upload
+ * @param assetType - Whether this is a logo or favicon (determines size limit)
+ * @returns Validation result with optional sanitized data for SVGs
+ */
+export function validateImage(buffer, contentType, assetType) {
+    // Check content type is allowed
+    if (!ALLOWED_TYPES.has(contentType)) {
+        return {
+            valid: false,
+            error: `Unsupported content type: ${contentType}. Allowed: ${[...ALLOWED_TYPES].join(', ')}`,
+        };
+    }
+    // Check buffer is not empty
+    if (!buffer || buffer.length === 0) {
+        return { valid: false, error: 'Image data cannot be empty' };
+    }
+    // Check size limit for the asset type
+    const sizeLimit = SIZE_LIMITS[assetType];
+    if (buffer.length > sizeLimit) {
+        return {
+            valid: false,
+            error: `File too large: ${buffer.length} bytes. Maximum for ${assetType}: ${sizeLimit} bytes (${formatBytes(sizeLimit)})`,
+        };
+    }
+    // SVG validation is content-based (no magic bytes)
+    if (contentType === 'image/svg+xml') {
+        return validateAndSanitizeSvg(buffer);
+    }
+    // Binary image format — validate magic bytes
+    return validateMagicBytes(buffer, contentType);
+}
+/**
+ * Get the size limit for an asset type.
+ * @param assetType - The asset type
+ * @returns Size limit in bytes
+ */
+export function getSizeLimit(assetType) {
+    return SIZE_LIMITS[assetType];
+}
+// ============================================================================
+// Internal helpers
+// ============================================================================
+/**
+ * Validate a binary image by checking its magic byte signature matches
+ * the declared content type. Prevents uploading a PNG disguised as a JPEG, etc.
+ */
+function validateMagicBytes(buffer, contentType) {
+    const signature = MAGIC_SIGNATURES.find((sig) => sig.type === contentType);
+    if (!signature) {
+        // No signature defined for this type — allow it (shouldn't happen due to ALLOWED_TYPES check)
+        return { valid: true, detectedType: contentType, data: buffer };
+    }
+    // Check that buffer is at least long enough for the signature
+    if (buffer.length < signature.bytes.length) {
+        return {
+            valid: false,
+            error: `File too small to be a valid ${contentType} image`,
+        };
+    }
+    // Compare magic bytes
+    const matches = signature.bytes.every((byte, i) => buffer[i] === byte);
+    if (!matches) {
+        // Try to detect what the file actually is
+        const detected = detectContentType(buffer);
+        return {
+            valid: false,
+            error: `File content does not match declared type ${contentType}${detected ? `. Detected: ${detected}` : ''}`,
+            detectedType: detected ?? undefined,
+        };
+    }
+    return { valid: true, detectedType: contentType, data: buffer };
+}
+/**
+ * Validate SVG content and sanitize dangerous elements.
+ * SVGs are XML-based, so we check for script tags, event handlers,
+ * and javascript: URIs that could enable stored XSS.
+ */
+function validateAndSanitizeSvg(buffer) {
+    let content;
+    try {
+        content = buffer.toString('utf-8');
+    }
+    catch {
+        return { valid: false, error: 'SVG file contains invalid UTF-8 encoding' };
+    }
+    // Basic SVG structure check — must contain an <svg element
+    if (!/<svg[\s>]/i.test(content)) {
+        return { valid: false, error: 'File does not appear to be a valid SVG (no <svg> element found)' };
+    }
+    // Sanitize: strip dangerous elements and attributes
+    let sanitized = content;
+    let wasSanitized = false;
+    // Remove <script> tags and their content
+    if (SVG_DANGEROUS_ELEMENTS.test(sanitized)) {
+        sanitized = sanitized.replace(SVG_DANGEROUS_ELEMENTS, '');
+        wasSanitized = true;
+    }
+    // Remove on* event handler attributes (onclick, onload, onerror, etc.)
+    if (SVG_EVENT_HANDLERS.test(sanitized)) {
+        sanitized = sanitized.replace(SVG_EVENT_HANDLERS, '');
+        wasSanitized = true;
+    }
+    // Remove javascript: URIs in href/xlink:href attributes
+    if (SVG_JAVASCRIPT_HREFS.test(sanitized)) {
+        sanitized = sanitized.replace(SVG_JAVASCRIPT_HREFS, '');
+        wasSanitized = true;
+    }
+    // Remove data:text/html URIs (can embed scripts)
+    if (SVG_DATA_URIS_SCRIPT.test(sanitized)) {
+        sanitized = sanitized.replace(SVG_DATA_URIS_SCRIPT, '');
+        wasSanitized = true;
+    }
+    return {
+        valid: true,
+        detectedType: 'image/svg+xml',
+        sanitized: wasSanitized,
+        data: Buffer.from(sanitized, 'utf-8'),
+    };
+}
+/**
+ * Attempt to detect the actual content type of a buffer by its magic bytes.
+ * Returns null if no known format is detected.
+ */
+function detectContentType(buffer) {
+    for (const sig of MAGIC_SIGNATURES) {
+        if (buffer.length >= sig.bytes.length) {
+            const matches = sig.bytes.every((byte, i) => buffer[i] === byte);
+            if (matches)
+                return sig.type;
+        }
+    }
+    return null;
+}
+/**
+ * Format bytes into a human-readable string (e.g., "512 KB", "2 MB").
+ */
+function formatBytes(bytes) {
+    if (bytes >= 1024 * 1024)
+        return `${(bytes / (1024 * 1024)).toFixed(0)} MB`;
+    if (bytes >= 1024)
+        return `${(bytes / 1024).toFixed(0)} KB`;
+    return `${bytes} bytes`;
+}
+//# sourceMappingURL=image-validator.js.map

package/dist/lib/image-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-validator.js","sourceRoot":"","sources":["../../src/lib/image-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAoBH,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,4CAA4C;AAC5C,MAAM,WAAW,GAA8B;IAC7C,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAK,wCAAwC;IAClE,OAAO,EAAE,GAAG,GAAG,IAAI,EAAQ,oCAAoC;CAChE,CAAC;AAEF;;;;GAIG;AACH,MAAM,gBAAgB,GAA6C;IACjE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;IACtD,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;IACjD,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;IACvD,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;IACzD,EAAE,IAAI,EAAE,0BAA0B,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;CACtE,CAAC;AAEF,gDAAgD;AAChD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,WAAW;IACX,YAAY;IACZ,eAAe;IACf,YAAY;IACZ,cAAc;IACd,0BAA0B;CAC3B,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,sBAAsB,GAAG,4DAA4D,CAAC;AAC5F,MAAM,kBAAkB,GAAG,8CAA8C,CAAC;AAC1E,MAAM,oBAAoB,GAAG,wDAAwD,CAAC;AACtF,MAAM,oBAAoB,GAAG,4DAA4D,CAAC;AAE1F,+EAA+E;AAC/E,aAAa;AACb,+EAA+E;AAE/E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAc,EACd,WAAmB,EACnB,SAAoB;IAEpB,gCAAgC;IAChC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QACpC,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,6BAA6B,WAAW,cAAc,CAAC,GAAG,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAC7F,CAAC;IACJ,CAAC;IAED,4BAA4B;IAC5B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;IAC/D,CAAC;IAED,sCAAsC;IACtC,MAAM,SAAS,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,MAAM,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC9B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,mBAAmB,MAAM,CAAC,MAAM,uBAAuB,SAAS,KAAK,SAAS,WAAW,WAAW,CAAC,SAAS,CAAC,GAAG;SAC1H,CAAC;IACJ,CAAC;IAED,mDAAmD;IACnD,IAAI,WAAW,KAAK,eAAe,EAAE,CAAC;QACpC,OAAO,sBAAsB,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IAED,6CAA6C;IAC7C,OAAO,kBAAkB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,SAAoB;IAC/C,OAAO,WAAW,CAAC,SAAS,CAAC,CAAC;AAChC,CAAC;AAED,+EAA+E;AAC/E,mBAAmB;AACnB,+EAA+E;AAE/E;;;GAGG;AACH,SAAS,kBAAkB,CAAC,MAAc,EAAE,WAAmB;IAC7D,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;IAE3E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,8FAA8F;QAC9F,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAClE,CAAC;IAED,8DAA8D;IAC9D,IAAI,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAC3C,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,gCAAgC,WAAW,QAAQ;SAC3D,CAAC;IACJ,CAAC;IAED,sBAAsB;IACtB,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IACvE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,0CAA0C;QAC1C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC3C,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,6CAA6C,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,eAAe,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YAC7G,YAAY,EAAE,QAAQ,IAAI,SAAS;SACpC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,MAAc;IAC5C,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC;IAC7E,CAAC;IAED,2DAA2D;IAC3D,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,iEAAiE,EAAE,CAAC;IACpG,CAAC;IAED,oDAAoD;IACpD,IAAI,SAAS,GAAG,OAAO,CAAC;IACxB,IAAI,YAAY,GAAG,KAAK,CAAC;IAEzB,yCAAyC;IACzC,IAAI,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3C,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC;QAC1D,YAAY,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,uEAAuE;IACvE,IAAI,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;QACtD,YAAY,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,wDAAwD;IACxD,IAAI,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACzC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;QACxD,YAAY,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,iDAAiD;IACjD,IAAI,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACzC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;QACxD,YAAY,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,OAAO;QACL,KAAK,EAAE,IAAI;QACX,YAAY,EAAE,eAAe;QAC7B,SAAS,EAAE,YAAY;QACvB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC;KACtC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,MAAc;IACvC,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACtC,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;YACjE,IAAI,OAAO;gBAAE,OAAO,GAAG,CAAC,IAAI,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,KAAK,IAAI,IAAI,GAAG,IAAI;QAAE,OAAO,GAAG,CAAC,KAAK,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5E,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5D,OAAO,GAAG,KAAK,QAAQ,CAAC;AAC1B,CAAC"}

package/dist/lib/logger.d.ts

@@ -0,0 +1,15 @@
+/** Observer for ephemeral, in-process validation of actual structured logger calls. */
+export type OperationalLogObserver = (serializedArguments: string) => void;
+/**
+ * Observe arguments delivered to the production logger boundary.
+ *
+ * This is intended for owner-controlled diagnostics and executable privacy validation. Observers
+ * are process-local, receive no replay buffer, and must detach immediately after their bounded
+ * operation. They cannot alter, suppress, or replace the actual log write.
+ *
+ * @param observer - Callback receiving one JSON representation per logger call.
+ * @returns A function which removes exactly this observer.
+ */
+export declare function observeOperationalLogOutput(observer: OperationalLogObserver): () => void;
+export declare const logger: import("pino").Logger<never, boolean>;
+//# sourceMappingURL=logger.d.ts.map

package/dist/lib/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/lib/logger.ts"],"names":[],"mappings":"AAEA,uFAAuF;AACvF,MAAM,MAAM,sBAAsB,GAAG,CAAC,mBAAmB,EAAE,MAAM,KAAK,IAAI,CAAC;AAI3E;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,sBAAsB,GAAG,MAAM,IAAI,CAGxF;AAKD,eAAO,MAAM,MAAM,uCAiDjB,CAAC"}

package/dist/lib/logger.js

@@ -0,0 +1,84 @@
+import { pino, stdSerializers } from 'pino';
+const operationalLogObservers = new Set();
+/**
+ * Observe arguments delivered to the production logger boundary.
+ *
+ * This is intended for owner-controlled diagnostics and executable privacy validation. Observers
+ * are process-local, receive no replay buffer, and must detach immediately after their bounded
+ * operation. They cannot alter, suppress, or replace the actual log write.
+ *
+ * @param observer - Callback receiving one JSON representation per logger call.
+ * @returns A function which removes exactly this observer.
+ */
+export function observeOperationalLogOutput(observer) {
+    operationalLogObservers.add(observer);
+    return () => operationalLogObservers.delete(observer);
+}
+const isProduction = process.env.NODE_ENV === 'production';
+const isTest = process.env.NODE_ENV === 'test';
+export const logger = pino({
+    level: process.env.LOG_LEVEL || (isTest ? 'silent' : 'info'),
+    transport: !isProduction ? { target: 'pino-pretty', options: { colorize: true } } : undefined,
+    serializers: {
+        err: stdSerializers.err,
+        req: stdSerializers.req,
+        res: stdSerializers.res,
+    },
+    hooks: {
+        logMethod(arguments_, method) {
+            if (operationalLogObservers.size > 0) {
+                const serialized = serializeOperationalLogArguments(arguments_);
+                for (const observer of operationalLogObservers)
+                    observer(serialized);
+            }
+            return method.apply(this, arguments_);
+        },
+    },
+    // Redact PII and sensitive fields from log output to prevent accidental
+    // exposure of credentials, tokens, and personal data. Pino replaces the
+    // value at each path with "[Redacted]" before the log line is serialized.
+    // Paths use dot-notation with wildcards so nested objects are also covered.
+    redact: {
+        paths: [
+            'password',
+            'token',
+            'authorization',
+            'cookie',
+            'refresh_token',
+            'client_secret',
+            'req.headers.authorization',
+            'req.headers.cookie',
+            '*.password',
+            '*.token',
+            '*.refresh_token',
+            '*.client_secret',
+            '*.authorization',
+            'email',
+            'userId',
+            'organizationId',
+            'uid',
+            'interactionUid',
+            '*.email',
+            '*.userId',
+            '*.organizationId',
+            '*.uid',
+            '*.interactionUid',
+        ],
+        censor: '[Redacted]',
+    },
+});
+/** Serialize one bounded logger invocation without letting observation break the owning request. */
+function serializeOperationalLogArguments(arguments_) {
+    try {
+        return JSON.stringify(arguments_, (_key, value) => {
+            if (value instanceof Error) {
+                return { name: value.name, message: value.message, stack: value.stack };
+            }
+            return value;
+        });
+    }
+    catch {
+        return '[unserializable-operational-log]';
+    }
+}
+//# sourceMappingURL=logger.js.map

package/dist/lib/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/lib/logger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,MAAM,CAAC;AAK5C,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAA0B,CAAC;AAElE;;;;;;;;;GASG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAAgC;IAC1E,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO,GAAG,EAAE,CAAC,uBAAuB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC;AAE/C,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5D,SAAS,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS;IAC7F,WAAW,EAAE;QACX,GAAG,EAAE,cAAc,CAAC,GAAG;QACvB,GAAG,EAAE,cAAc,CAAC,GAAG;QACvB,GAAG,EAAE,cAAc,CAAC,GAAG;KACxB;IACD,KAAK,EAAE;QACL,SAAS,CAAC,UAAU,EAAE,MAAM;YAC1B,IAAI,uBAAuB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBACrC,MAAM,UAAU,GAAG,gCAAgC,CAAC,UAAU,CAAC,CAAC;gBAChE,KAAK,MAAM,QAAQ,IAAI,uBAAuB;oBAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;YACvE,CAAC;YACD,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACxC,CAAC;KACF;IACD,wEAAwE;IACxE,wEAAwE;IACxE,0EAA0E;IAC1E,4EAA4E;IAC5E,MAAM,EAAE;QACN,KAAK,EAAE;YACL,UAAU;YACV,OAAO;YACP,eAAe;YACf,QAAQ;YACR,eAAe;YACf,eAAe;YACf,2BAA2B;YAC3B,oBAAoB;YACpB,YAAY;YACZ,SAAS;YACT,iBAAiB;YACjB,iBAAiB;YACjB,iBAAiB;YACjB,OAAO;YACP,QAAQ;YACR,gBAAgB;YAChB,KAAK;YACL,gBAAgB;YAChB,SAAS;YACT,UAAU;YACV,kBAAkB;YAClB,OAAO;YACP,kBAAkB;SACnB;QACD,MAAM,EAAE,YAAY;KACrB;CACF,CAAC,CAAC;AAEH,oGAAoG;AACpG,SAAS,gCAAgC,CAAC,UAAqB;IAC7D,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,KAAc,EAAE,EAAE;YACzD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;gBAC3B,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YAC1E,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,kCAAkC,CAAC;IAC5C,CAAC;AACH,CAAC"}

package/dist/lib/migrator.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Run database migrations using node-pg-migrate's programmatic API.
+ *
+ * Executes SQL migrations from the `migrations/` directory against the
+ * database specified by `DATABASE_URL`. This is useful for:
+ * - Integration test setup (run migrations before tests)
+ * - Application startup (auto-migrate in development)
+ * - Programmatic rollback in tests
+ *
+ * @param direction - 'up' to apply pending migrations, 'down' to rollback
+ * @param count - Number of migrations to run (undefined = all pending for 'up', 1 for 'down')
+ */
+export declare function runMigrations(direction?: 'up' | 'down', count?: number): Promise<void>;
+//# sourceMappingURL=migrator.d.ts.map

package/dist/lib/migrator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrator.d.ts","sourceRoot":"","sources":["../../src/lib/migrator.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CACjC,SAAS,GAAE,IAAI,GAAG,MAAa,EAC/B,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,IAAI,CAAC,CAkBf"}

package/dist/lib/migrator.js

@@ -0,0 +1,34 @@
+import { runner } from 'node-pg-migrate';
+import { config } from '../config/index.js';
+import { logger } from './logger.js';
+import { getMigrationsDirectory } from './runtime-paths.js';
+/**
+ * Run database migrations using node-pg-migrate's programmatic API.
+ *
+ * Executes SQL migrations from the `migrations/` directory against the
+ * database specified by `DATABASE_URL`. This is useful for:
+ * - Integration test setup (run migrations before tests)
+ * - Application startup (auto-migrate in development)
+ * - Programmatic rollback in tests
+ *
+ * @param direction - 'up' to apply pending migrations, 'down' to rollback
+ * @param count - Number of migrations to run (undefined = all pending for 'up', 1 for 'down')
+ */
+export async function runMigrations(direction = 'up', count) {
+    const migrationsDir = getMigrationsDirectory();
+    const options = {
+        databaseUrl: config.databaseUrl,
+        migrationsTable: 'pgmigrations',
+        dir: migrationsDir,
+        direction,
+        // For 'up', run all pending migrations; for 'down', default to rolling back 1
+        count: count ?? (direction === 'up' ? Infinity : 1),
+        // Redirect migration log output to pino logger
+        log: (msg) => logger.debug({ migration: true }, msg),
+        // Don't decamelize SQL file names — we use snake_case already
+        decamelize: false,
+    };
+    await runner(options);
+    logger.info({ direction, count }, 'Migrations complete');
+}
+//# sourceMappingURL=migrator.js.map

package/dist/lib/migrator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrator.js","sourceRoot":"","sources":["../../src/lib/migrator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAEzC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAE5D;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,SAAS,GAAkB,IAAI,EAC/B,KAAc;IAEd,MAAM,aAAa,GAAG,sBAAsB,EAAE,CAAC;IAE/C,MAAM,OAAO,GAAiB;QAC5B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,eAAe,EAAE,cAAc;QAC/B,GAAG,EAAE,aAAa;QAClB,SAAS;QACT,8EAA8E;QAC9E,KAAK,EAAE,KAAK,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,+CAA+C;QAC/C,GAAG,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC;QAC5D,8DAA8D;QAC9D,UAAU,EAAE,KAAK;KAClB,CAAC;IAEF,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;IACtB,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,qBAAqB,CAAC,CAAC;AAC3D,CAAC"}

package/dist/lib/redis.d.ts

@@ -0,0 +1,5 @@
+import { Redis } from 'ioredis';
+export declare function connectRedis(): Promise<Redis>;
+export declare function getRedis(): Redis;
+export declare function disconnectRedis(): Promise<void>;
+//# sourceMappingURL=redis.d.ts.map

package/dist/lib/redis.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis.d.ts","sourceRoot":"","sources":["../../src/lib/redis.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAMhC,wBAAsB,YAAY,IAAI,OAAO,CAAC,KAAK,CAAC,CAcnD;AAED,wBAAgB,QAAQ,IAAI,KAAK,CAGhC;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAMrD"}

package/dist/lib/redis.js

@@ -0,0 +1,29 @@
+import { Redis } from 'ioredis';
+import { config } from '../config/index.js';
+import { logger } from './logger.js';
+let redis = null;
+export async function connectRedis() {
+    redis = new Redis(config.redisUrl, {
+        maxRetriesPerRequest: 3,
+        lazyConnect: true,
+    });
+    await redis.connect();
+    logger.info('Redis connected');
+    redis.on('error', (err) => {
+        logger.error({ err }, 'Redis error');
+    });
+    return redis;
+}
+export function getRedis() {
+    if (!redis)
+        throw new Error('Redis not connected. Call connectRedis() first.');
+    return redis;
+}
+export async function disconnectRedis() {
+    if (redis) {
+        await redis.quit();
+        redis = null;
+        logger.info('Redis disconnected');
+    }
+}
+//# sourceMappingURL=redis.js.map

package/dist/lib/redis.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis.js","sourceRoot":"","sources":["../../src/lib/redis.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,IAAI,KAAK,GAAiB,IAAI,CAAC;AAE/B,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE;QACjC,oBAAoB,EAAE,CAAC;QACvB,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IAEH,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;IACtB,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAE/B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;QAC/B,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,aAAa,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,QAAQ;IACtB,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAC/E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,GAAG,IAAI,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACpC,CAAC;AACH,CAAC"}