@proofhound/core 0.1.6

package/dist/server/modules/token/token.service.js

@@ -0,0 +1,124 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LocalTokenService = exports.TokenService = void 0;
+const node_crypto_1 = require("node:crypto");
+const common_1 = require("@nestjs/common");
+const shared_1 = require("@proofhound/shared");
+const access_control_1 = require("../../common/access-control");
+const access_control_service_1 = require("../../common/contracts/access-control.service");
+const crypto_service_1 = require("../../../shared/crypto/crypto.service");
+const token_service_1 = require("../../common/contracts/token.service");
+Object.defineProperty(exports, "TokenService", { enumerable: true, get: function () { return token_service_1.TokenService; } });
+const token_repository_1 = require("./token.repository");
+// User token = the single local-admin-console user credential; the same token can be used for both the HTTP API and MCP.
+// OSS does not bind project_id; the SaaS form may attach project later, but this service does not write it.
+// Rows with scope='webhook' are not handled by this service. OSS binds this default in LocalContractsModule;
+// TokenModule itself only consumes the edition-supplied TokenService so SaaS can replace it via forRoot({ contracts }).
+// See docs/specs/06-database-schema.md §3.2.
+let LocalTokenService = class LocalTokenService extends token_service_1.TokenService {
+    constructor(repo, crypto, accessControl) {
+        super();
+        this.repo = repo;
+        this.crypto = crypto;
+        this.accessControl = accessControl;
+    }
+    async listUserTokens(actor) {
+        await this.accessControl.assertCan((0, access_control_1.toActorContext)(actor), actor.projectId ? { projectId: actor.projectId, source: 'local' } : shared_1.LOCAL_PROJECT_CONTEXT, 'user_token_manage');
+        const rows = await this.repo.listUserTokens();
+        return { data: rows.map((row) => this.toSummary(row)), total: rows.length };
+    }
+    async createUserToken(dto, actor, _source = 'api') {
+        await this.accessControl.assertCan((0, access_control_1.toActorContext)(actor), actor.projectId ? { projectId: actor.projectId, source: 'local' } : shared_1.LOCAL_PROJECT_CONTEXT, 'user_token_manage');
+        const existing = await this.repo.findUserTokenByName(dto.name);
+        if (existing)
+            throw new common_1.ConflictException(`user_token_name_in_use:${dto.name}`);
+        const plaintext = this.generatePlaintext();
+        const tokenHash = this.hashToken(plaintext);
+        const prefix = plaintext.slice(0, 12);
+        const row = await this.repo.insertUserToken({
+            scope: 'user',
+            projectId: null,
+            name: dto.name,
+            tokenHash,
+            tokenEncrypted: this.crypto.encryptApiKey(plaintext),
+            prefix,
+            ipWhitelist: dto.ipWhitelist ?? null,
+            expiresAt: dto.expiresAt ? new Date(dto.expiresAt) : null,
+            createdBy: actor.sub,
+        });
+        const rowWithCreator = await this.repo.findUserTokenById(row.id);
+        return { token: this.toSummary(rowWithCreator ?? row), plaintext };
+    }
+    async updateUserToken(tokenId, dto, actor, _source = 'api') {
+        await this.accessControl.assertCan((0, access_control_1.toActorContext)(actor), actor.projectId ? { projectId: actor.projectId, source: 'local' } : shared_1.LOCAL_PROJECT_CONTEXT, 'user_token_manage');
+        const row = await this.repo.findUserTokenById(tokenId);
+        if (!row)
+            throw new common_1.NotFoundException(`user token ${tokenId} not found`);
+        if (dto.name !== row.name) {
+            const existing = await this.repo.findUserTokenByName(dto.name);
+            if (existing && existing.id !== tokenId)
+                throw new common_1.ConflictException(`user_token_name_in_use:${dto.name}`);
+        }
+        const updated = await this.repo.updateUserToken(tokenId, {
+            name: dto.name,
+            expiresAt: dto.expiresAt === undefined ? row.expiresAt : dto.expiresAt ? new Date(dto.expiresAt) : null,
+        });
+        if (!updated)
+            throw new common_1.NotFoundException(`user token ${tokenId} not found`);
+        return { token: this.toSummary(updated) };
+    }
+    async revealUserToken(tokenId, actor, _source = 'api') {
+        await this.accessControl.assertCan((0, access_control_1.toActorContext)(actor), actor.projectId ? { projectId: actor.projectId, source: 'local' } : shared_1.LOCAL_PROJECT_CONTEXT, 'user_token_manage');
+        const row = await this.repo.findUserTokenById(tokenId);
+        if (!row)
+            throw new common_1.NotFoundException(`user token ${tokenId} not found`);
+        const plaintext = row.tokenEncrypted ? this.crypto.decryptApiKey(row.tokenEncrypted) : null;
+        return { tokenId, plaintext, available: Boolean(plaintext) };
+    }
+    async deleteUserToken(tokenId, actor, _source = 'api') {
+        await this.accessControl.assertCan((0, access_control_1.toActorContext)(actor), actor.projectId ? { projectId: actor.projectId, source: 'local' } : shared_1.LOCAL_PROJECT_CONTEXT, 'user_token_manage');
+        const row = await this.repo.findUserTokenById(tokenId);
+        if (!row)
+            throw new common_1.NotFoundException(`user token ${tokenId} not found`);
+        const revoked = await this.repo.revokeUserToken(tokenId, new Date());
+        if (!revoked)
+            throw new common_1.NotFoundException(`user token ${tokenId} not found`);
+        return { tokenId };
+    }
+    generatePlaintext() {
+        return `ph_tok_${(0, node_crypto_1.randomBytes)(24).toString('base64url')}`;
+    }
+    hashToken(plaintext) {
+        return (0, node_crypto_1.createHash)('sha256').update(plaintext).digest('hex');
+    }
+    toSummary(row) {
+        return {
+            id: row.id,
+            name: row.name,
+            prefix: row.prefix,
+            ipWhitelist: row.ipWhitelist ?? null,
+            lastUsedAt: row.lastUsedAt?.toISOString() ?? null,
+            expiresAt: row.expiresAt?.toISOString() ?? null,
+            createdBy: row.createdBy,
+            createdByDisplayName: 'createdByDisplayName' in row ? row.createdByDisplayName : null,
+            createdAt: row.createdAt.toISOString(),
+        };
+    }
+};
+exports.LocalTokenService = LocalTokenService;
+exports.LocalTokenService = LocalTokenService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [token_repository_1.TokenRepository,
+        crypto_service_1.CryptoService,
+        access_control_service_1.AccessControlService])
+], LocalTokenService);
+//# sourceMappingURL=token.service.js.map

package/dist/server/modules/token/token.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.service.js","sourceRoot":"","sources":["../../../../src/server/modules/token/token.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAAsD;AACtD,2CAAkF;AAWlF,+CAA2D;AAC3D,gEAA6D;AAC7D,0FAAqF;AAErF,0EAAsE;AACtE,wEAAuF;AAG9E,6FAHA,4BAAY,OAGA;AAFrB,yDAAsG;AAKtG,yHAAyH;AACzH,4GAA4G;AAC5G,6GAA6G;AAC7G,wHAAwH;AACxH,6CAA6C;AAEtC,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,4BAAY;IACjD,YACmB,IAAqB,EACrB,MAAqB,EACrB,aAAmC;QAEpD,KAAK,EAAE,CAAC;QAJS,SAAI,GAAJ,IAAI,CAAiB;QACrB,WAAM,GAAN,MAAM,CAAe;QACrB,kBAAa,GAAb,aAAa,CAAsB;IAGtD,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAyB;QAC5C,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAChC,IAAA,+BAAc,EAAC,KAAK,CAAC,EACrB,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,8BAAqB,EACzF,mBAAmB,CACpB,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QAC9C,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IAC9E,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,GAAuB,EACvB,KAAyB,EACzB,UAAwB,KAAK;QAE7B,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAChC,IAAA,+BAAc,EAAC,KAAK,CAAC,EACrB,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,8BAAqB,EACzF,mBAAmB,CACpB,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,QAAQ;YAAE,MAAM,IAAI,0BAAiB,CAAC,0BAA0B,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAEhF,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC;YAC1C,KAAK,EAAE,MAAM;YACb,SAAS,EAAE,IAAI;YACf,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,SAAS;YACT,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC;YACpD,MAAM;YACN,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;YACpC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;YACzD,SAAS,EAAE,KAAK,CAAC,GAAG;SACrB,CAAC,CAAC;QAEH,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,IAAI,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,OAAe,EACf,GAAuB,EACvB,KAAyB,EACzB,UAAwB,KAAK;QAE7B,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAChC,IAAA,+BAAc,EAAC,KAAK,CAAC,EACrB,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,8BAAqB,EACzF,mBAAmB,CACpB,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,0BAAiB,CAAC,cAAc,OAAO,YAAY,CAAC,CAAC;QAEzE,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC/D,IAAI,QAAQ,IAAI,QAAQ,CAAC,EAAE,KAAK,OAAO;gBAAE,MAAM,IAAI,0BAAiB,CAAC,0BAA0B,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7G,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE;YACvD,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,SAAS,EAAE,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;SACxG,CAAC,CAAC;QACH,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,0BAAiB,CAAC,cAAc,OAAO,YAAY,CAAC,CAAC;QAC7E,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,OAAe,EACf,KAAyB,EACzB,UAAwB,KAAK;QAE7B,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAChC,IAAA,+BAAc,EAAC,KAAK,CAAC,EACrB,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,8BAAqB,EACzF,mBAAmB,CACpB,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,0BAAiB,CAAC,cAAc,OAAO,YAAY,CAAC,CAAC;QAEzE,MAAM,SAAS,GAAG,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5F,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,OAAe,EACf,KAAyB,EACzB,UAAwB,KAAK;QAE7B,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAChC,IAAA,+BAAc,EAAC,KAAK,CAAC,EACrB,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,8BAAqB,EACzF,mBAAmB,CACpB,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,0BAAiB,CAAC,cAAc,OAAO,YAAY,CAAC,CAAC;QAEzE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,0BAAiB,CAAC,cAAc,OAAO,YAAY,CAAC,CAAC;QAC7E,OAAO,EAAE,OAAO,EAAE,CAAC;IACrB,CAAC;IAEO,iBAAiB;QACvB,OAAO,UAAU,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;IAC3D,CAAC;IAEO,SAAS,CAAC,SAAiB;QACjC,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC;IAEO,SAAS,CAAC,GAA2C;QAC3D,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,WAAW,EAAG,GAAG,CAAC,WAA+B,IAAI,IAAI;YACzD,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,IAAI;YACjD,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,IAAI;YAC/C,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,oBAAoB,EAAE,sBAAsB,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI;YACrF,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;SACvC,CAAC;IACJ,CAAC;CACF,CAAA;AAtIY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;qCAGc,kCAAe;QACb,8BAAa;QACN,6CAAoB;GAJ3C,iBAAiB,CAsI7B"}

package/dist/server/proofhound-server.module.d.ts

@@ -0,0 +1,7 @@
+import { type DynamicModule } from '@nestjs/common';
+import type { ProofHoundRuntimeModuleOptions } from '../shared/runtime-module-options';
+export type ProofHoundServerModuleOptions = ProofHoundRuntimeModuleOptions;
+export declare class ProofHoundServerModule {
+    static forRoot(options: ProofHoundServerModuleOptions): DynamicModule;
+}
+//# sourceMappingURL=proofhound-server.module.d.ts.map

package/dist/server/proofhound-server.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proofhound-server.module.d.ts","sourceRoot":"","sources":["../../src/server/proofhound-server.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAwB5D,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,kCAAkC,CAAC;AAMvF,MAAM,MAAM,6BAA6B,GAAG,8BAA8B,CAAC;AAE3E,qBACa,sBAAsB;IACjC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,6BAA6B,GAAG,aAAa;CA+BtE"}

package/dist/server/proofhound-server.module.js

@@ -0,0 +1,72 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var ProofHoundServerModule_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProofHoundServerModule = void 0;
+const common_1 = require("@nestjs/common");
+const config_module_1 = require("../shared/config/config.module");
+const project_context_module_1 = require("./common/project-context.module");
+const crypto_module_1 = require("../shared/crypto/crypto.module");
+const database_module_1 = require("../shared/database/database.module");
+const redis_module_1 = require("../shared/redis/redis.module");
+const health_controller_1 = require("../shared/health/health.controller");
+const health_service_1 = require("../shared/health/health.service");
+const orchestration_1 = require("./infrastructure/orchestration");
+const optimization_module_1 = require("./modules/optimization/optimization.module");
+const connector_module_1 = require("./modules/connector/connector.module");
+const dataset_module_1 = require("./modules/dataset/dataset.module");
+const experiment_module_1 = require("./modules/experiment/experiment.module");
+const model_module_1 = require("./modules/model/model.module");
+const monitoring_module_1 = require("./modules/monitoring/monitoring.module");
+const annotation_module_1 = require("./modules/annotation/annotation.module");
+const canary_release_module_1 = require("./modules/canary-release/canary-release.module");
+const production_release_module_1 = require("./modules/production-release/production-release.module");
+const prompt_module_1 = require("./modules/prompt/prompt.module");
+const quick_start_module_1 = require("./modules/quick-start/quick-start.module");
+const release_line_module_1 = require("./modules/release-line/release-line.module");
+const run_result_module_1 = require("./modules/run-result/run-result.module");
+const token_module_1 = require("./modules/token/token.module");
+const mcp_module_1 = require("./channels/mcp/mcp.module");
+let ProofHoundServerModule = ProofHoundServerModule_1 = class ProofHoundServerModule {
+    static forRoot(options) {
+        return {
+            module: ProofHoundServerModule_1,
+            imports: [
+                config_module_1.ConfigModule,
+                options.contracts,
+                project_context_module_1.ProjectContextModule,
+                crypto_module_1.CryptoModule,
+                database_module_1.DatabaseModule,
+                orchestration_1.OrchestrationModule,
+                redis_module_1.RedisModule,
+                model_module_1.ModelModule,
+                monitoring_module_1.MonitoringModule,
+                annotation_module_1.AnnotationModule,
+                dataset_module_1.DatasetModule,
+                prompt_module_1.PromptModule,
+                run_result_module_1.RunResultModule,
+                token_module_1.TokenModule,
+                experiment_module_1.ExperimentModule,
+                optimization_module_1.OptimizationModule,
+                quick_start_module_1.QuickStartModule,
+                release_line_module_1.ReleaseLineModule,
+                connector_module_1.ConnectorModule,
+                canary_release_module_1.CanaryReleaseModule,
+                production_release_module_1.ProductionReleaseModule,
+                mcp_module_1.McpModule,
+            ],
+            controllers: [health_controller_1.HealthController],
+            providers: [health_service_1.HealthService],
+        };
+    }
+};
+exports.ProofHoundServerModule = ProofHoundServerModule;
+exports.ProofHoundServerModule = ProofHoundServerModule = ProofHoundServerModule_1 = __decorate([
+    (0, common_1.Module)({})
+], ProofHoundServerModule);
+//# sourceMappingURL=proofhound-server.module.js.map

package/dist/server/proofhound-server.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proofhound-server.module.js","sourceRoot":"","sources":["../../src/server/proofhound-server.module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAA4D;AAC5D,kEAA8D;AAC9D,4EAAuE;AACvE,kEAA8D;AAC9D,wEAAoE;AACpE,+DAA2D;AAC3D,0EAAsE;AACtE,oEAAgE;AAChE,kEAAqE;AACrE,oFAAgF;AAChF,2EAAuE;AACvE,qEAAiE;AACjE,8EAA0E;AAC1E,+DAA2D;AAC3D,8EAA0E;AAC1E,8EAA0E;AAC1E,0FAAqF;AACrF,sGAAiG;AACjG,kEAA8D;AAC9D,iFAA4E;AAC5E,oFAA+E;AAC/E,8EAAyE;AACzE,+DAA2D;AAC3D,0DAAsD;AAU/C,IAAM,sBAAsB,8BAA5B,MAAM,sBAAsB;IACjC,MAAM,CAAC,OAAO,CAAC,OAAsC;QACnD,OAAO;YACL,MAAM,EAAE,wBAAsB;YAC9B,OAAO,EAAE;gBACP,4BAAY;gBACZ,OAAO,CAAC,SAAS;gBACjB,6CAAoB;gBACpB,4BAAY;gBACZ,gCAAc;gBACd,mCAAmB;gBACnB,0BAAW;gBACX,0BAAW;gBACX,oCAAgB;gBAChB,oCAAgB;gBAChB,8BAAa;gBACb,4BAAY;gBACZ,mCAAe;gBACf,0BAAW;gBACX,oCAAgB;gBAChB,wCAAkB;gBAClB,qCAAgB;gBAChB,uCAAiB;gBACjB,kCAAe;gBACf,2CAAmB;gBACnB,mDAAuB;gBACvB,sBAAS;aACV;YACD,WAAW,EAAE,CAAC,oCAAgB,CAAC;YAC/B,SAAS,EAAE,CAAC,8BAAa,CAAC;SAC3B,CAAC;IACJ,CAAC;CACF,CAAA;AAhCY,wDAAsB;iCAAtB,sBAAsB;IADlC,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,sBAAsB,CAgClC"}

package/dist/shared/config/config.module.d.ts

@@ -0,0 +1,3 @@
+export declare class ConfigModule {
+}
+//# sourceMappingURL=config.module.d.ts.map

package/dist/shared/config/config.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.module.d.ts","sourceRoot":"","sources":["../../../src/shared/config/config.module.ts"],"names":[],"mappings":"AAIA,qBAea,YAAY;CAAG"}

package/dist/shared/config/config.module.js

@@ -0,0 +1,33 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConfigModule = void 0;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+const node_path_1 = require("node:path");
+let ConfigModule = class ConfigModule {
+};
+exports.ConfigModule = ConfigModule;
+exports.ConfigModule = ConfigModule = __decorate([
+    (0, common_1.Global)(),
+    (0, common_1.Module)({
+        imports: [
+            config_1.ConfigModule.forRoot({
+                isGlobal: true,
+                envFilePath: [
+                    (0, node_path_1.resolve)(process.cwd(), '.env.local'),
+                    (0, node_path_1.resolve)(process.cwd(), '.env'),
+                    (0, node_path_1.resolve)(process.cwd(), '../../.env.local'),
+                    (0, node_path_1.resolve)(process.cwd(), '../../.env'),
+                ],
+            }),
+        ],
+        exports: [config_1.ConfigModule],
+    })
+], ConfigModule);
+//# sourceMappingURL=config.module.js.map

package/dist/shared/config/config.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.module.js","sourceRoot":"","sources":["../../../src/shared/config/config.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAgD;AAChD,2CAAkE;AAClE,yCAAoC;AAiB7B,IAAM,YAAY,GAAlB,MAAM,YAAY;CAAG,CAAA;AAAf,oCAAY;uBAAZ,YAAY;IAfxB,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC;QACN,OAAO,EAAE;YACP,qBAAgB,CAAC,OAAO,CAAC;gBACvB,QAAQ,EAAE,IAAI;gBACd,WAAW,EAAE;oBACX,IAAA,mBAAO,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,YAAY,CAAC;oBACpC,IAAA,mBAAO,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC;oBAC9B,IAAA,mBAAO,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,kBAAkB,CAAC;oBAC1C,IAAA,mBAAO,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,YAAY,CAAC;iBACrC;aACF,CAAC;SACH;QACD,OAAO,EAAE,CAAC,qBAAgB,CAAC;KAC5B,CAAC;GACW,YAAY,CAAG"}

package/dist/shared/crypto/crypto.module.d.ts

@@ -0,0 +1,3 @@
+export declare class CryptoModule {
+}
+//# sourceMappingURL=crypto.module.d.ts.map

package/dist/shared/crypto/crypto.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.module.d.ts","sourceRoot":"","sources":["../../../src/shared/crypto/crypto.module.ts"],"names":[],"mappings":"AAIA,qBAMa,YAAY;CAAG"}

package/dist/shared/crypto/crypto.module.js

@@ -0,0 +1,24 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CryptoModule = void 0;
+const common_1 = require("@nestjs/common");
+const config_module_1 = require("../config/config.module");
+const crypto_service_1 = require("./crypto.service");
+let CryptoModule = class CryptoModule {
+};
+exports.CryptoModule = CryptoModule;
+exports.CryptoModule = CryptoModule = __decorate([
+    (0, common_1.Global)(),
+    (0, common_1.Module)({
+        imports: [config_module_1.ConfigModule],
+        providers: [crypto_service_1.CryptoService],
+        exports: [crypto_service_1.CryptoService],
+    })
+], CryptoModule);
+//# sourceMappingURL=crypto.module.js.map

package/dist/shared/crypto/crypto.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.module.js","sourceRoot":"","sources":["../../../src/shared/crypto/crypto.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAgD;AAChD,2DAAuD;AACvD,qDAAiD;AAQ1C,IAAM,YAAY,GAAlB,MAAM,YAAY;CAAG,CAAA;AAAf,oCAAY;uBAAZ,YAAY;IANxB,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC;QACN,OAAO,EAAE,CAAC,4BAAY,CAAC;QACvB,SAAS,EAAE,CAAC,8BAAa,CAAC;QAC1B,OAAO,EAAE,CAAC,8BAAa,CAAC;KACzB,CAAC;GACW,YAAY,CAAG"}

package/dist/shared/crypto/crypto.service.d.ts

@@ -0,0 +1,9 @@
+import { ConfigService } from '@nestjs/config';
+export declare class CryptoService {
+    private readonly keyBase64;
+    constructor(configService: ConfigService);
+    encryptApiKey(plain: string): string;
+    decryptApiKey(payload: string): string;
+    getCredentialTail(plain: string): string;
+}
+//# sourceMappingURL=crypto.service.d.ts.map

package/dist/shared/crypto/crypto.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.service.d.ts","sourceRoot":"","sources":["../../../src/shared/crypto/crypto.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAM/C,qBACa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAEvB,aAAa,EAAE,aAAa;IAIxC,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAIpC,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IAItC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;CAGzC"}

package/dist/shared/crypto/crypto.service.js

@@ -0,0 +1,37 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CryptoService = void 0;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+const crypto_1 = require("@proofhound/crypto");
+// The API KEY encryption/decryption algorithm and format are defined in @proofhound/crypto — the single source of truth for server / worker / seed.
+// This service only injects MODEL_API_KEY_ENCRYPTION_KEY and exposes a NestJS-friendly wrapper.
+let CryptoService = class CryptoService {
+    constructor(configService) {
+        this.keyBase64 = configService.getOrThrow('MODEL_API_KEY_ENCRYPTION_KEY');
+    }
+    encryptApiKey(plain) {
+        return (0, crypto_1.encryptApiKey)(plain, this.keyBase64);
+    }
+    decryptApiKey(payload) {
+        return (0, crypto_1.decryptApiKey)(payload, this.keyBase64);
+    }
+    getCredentialTail(plain) {
+        return plain.length <= 4 ? plain : plain.slice(-4);
+    }
+};
+exports.CryptoService = CryptoService;
+exports.CryptoService = CryptoService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [config_1.ConfigService])
+], CryptoService);
+//# sourceMappingURL=crypto.service.js.map

package/dist/shared/crypto/crypto.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.service.js","sourceRoot":"","sources":["../../../src/shared/crypto/crypto.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAC5C,2CAA+C;AAC/C,+CAAkE;AAElE,oJAAoJ;AACpJ,gGAAgG;AAGzF,IAAM,aAAa,GAAnB,MAAM,aAAa;IAGxB,YAAY,aAA4B;QACtC,IAAI,CAAC,SAAS,GAAG,aAAa,CAAC,UAAU,CAAS,8BAA8B,CAAC,CAAC;IACpF,CAAC;IAED,aAAa,CAAC,KAAa;QACzB,OAAO,IAAA,sBAAa,EAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED,aAAa,CAAC,OAAe;QAC3B,OAAO,IAAA,sBAAa,EAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAChD,CAAC;IAED,iBAAiB,CAAC,KAAa;QAC7B,OAAO,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;CACF,CAAA;AAlBY,sCAAa;wBAAb,aAAa;IADzB,IAAA,mBAAU,GAAE;qCAIgB,sBAAa;GAH7B,aAAa,CAkBzB"}

package/dist/shared/database/database.constants.d.ts

@@ -0,0 +1,2 @@
+export declare const DATABASE_CLIENT: unique symbol;
+//# sourceMappingURL=database.constants.d.ts.map

package/dist/shared/database/database.constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"database.constants.d.ts","sourceRoot":"","sources":["../../../src/shared/database/database.constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,eAA4B,CAAC"}

package/dist/shared/database/database.constants.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DATABASE_CLIENT = void 0;
+exports.DATABASE_CLIENT = Symbol('DATABASE_CLIENT');
+//# sourceMappingURL=database.constants.js.map

package/dist/shared/database/database.constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database.constants.js","sourceRoot":"","sources":["../../../src/shared/database/database.constants.ts"],"names":[],"mappings":";;;AAAa,QAAA,eAAe,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC"}

package/dist/shared/database/database.module.d.ts

@@ -0,0 +1,3 @@
+export declare class DatabaseModule {
+}
+//# sourceMappingURL=database.module.d.ts.map

package/dist/shared/database/database.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"database.module.d.ts","sourceRoot":"","sources":["../../../src/shared/database/database.module.ts"],"names":[],"mappings":"AAIA,qBASa,cAAc;CAAG"}

package/dist/shared/database/database.module.js

@@ -0,0 +1,27 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DatabaseModule = void 0;
+const common_1 = require("@nestjs/common");
+const db_1 = require("@proofhound/db");
+const database_constants_1 = require("./database.constants");
+let DatabaseModule = class DatabaseModule {
+};
+exports.DatabaseModule = DatabaseModule;
+exports.DatabaseModule = DatabaseModule = __decorate([
+    (0, common_1.Module)({
+        providers: [
+            {
+                provide: database_constants_1.DATABASE_CLIENT,
+                useFactory: () => (0, db_1.createDbClient)(process.env['DATABASE_URL'] ?? ''),
+            },
+        ],
+        exports: [database_constants_1.DATABASE_CLIENT],
+    })
+], DatabaseModule);
+//# sourceMappingURL=database.module.js.map

package/dist/shared/database/database.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database.module.js","sourceRoot":"","sources":["../../../src/shared/database/database.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,uCAAgD;AAChD,6DAAuD;AAWhD,IAAM,cAAc,GAApB,MAAM,cAAc;CAAG,CAAA;AAAjB,wCAAc;yBAAd,cAAc;IAT1B,IAAA,eAAM,EAAC;QACN,SAAS,EAAE;YACT;gBACE,OAAO,EAAE,oCAAe;gBACxB,UAAU,EAAE,GAAG,EAAE,CAAC,IAAA,mBAAc,EAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;aACpE;SACF;QACD,OAAO,EAAE,CAAC,oCAAe,CAAC;KAC3B,CAAC;GACW,cAAc,CAAG"}

package/dist/shared/filters/pino-exception.filter.d.ts

@@ -0,0 +1,9 @@
+import type { ArgumentsHost, ExceptionFilter } from '@nestjs/common';
+export declare class PinoExceptionFilter implements ExceptionFilter {
+    private readonly logger;
+    private readonly logClientErrors;
+    constructor(serviceName?: string, logClientErrors?: boolean);
+    catch(exception: unknown, host: ArgumentsHost): void;
+    private toResponseBody;
+}
+//# sourceMappingURL=pino-exception.filter.d.ts.map

package/dist/shared/filters/pino-exception.filter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pino-exception.filter.d.ts","sourceRoot":"","sources":["../../../src/shared/filters/pino-exception.filter.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAGrE,qBACa,mBAAoB,YAAW,eAAe;IACzD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IACxB,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAU;gBAI9B,WAAW,SAAQ,EAAE,eAAe,UAAO;IAKvD,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,IAAI;IAsBpD,OAAO,CAAC,cAAc;CAUvB"}

package/dist/shared/filters/pino-exception.filter.js

@@ -0,0 +1,58 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PinoExceptionFilter = void 0;
+const common_1 = require("@nestjs/common");
+const logger_1 = require("@proofhound/logger");
+let PinoExceptionFilter = class PinoExceptionFilter {
+    // logClientErrors: when true (server default) 4xx are logged as `warn`; webhook passes false
+    // because as a public ingress its 400/401 are routine noise, not signal.
+    constructor(serviceName = 'api', logClientErrors = true) {
+        this.logger = (0, logger_1.createLogger)('exception.filter', { service: serviceName });
+        this.logClientErrors = logClientErrors;
+    }
+    catch(exception, host) {
+        const ctx = host.switchToHttp();
+        const request = ctx.getRequest();
+        const response = ctx.getResponse();
+        const status = exception instanceof common_1.HttpException ? exception.getStatus() : common_1.HttpStatus.INTERNAL_SERVER_ERROR;
+        const responseBody = this.toResponseBody(exception, status);
+        const payload = {
+            status,
+            requestId: request.id,
+            req: { method: request.method, url: request.originalUrl ?? request.url },
+            errorClass: exception instanceof Error ? exception.constructor.name : typeof exception,
+        };
+        if (status >= common_1.HttpStatus.INTERNAL_SERVER_ERROR) {
+            this.logger.error({ ...payload, err: exception }, 'http_exception_thrown');
+        }
+        else if (this.logClientErrors && status >= common_1.HttpStatus.BAD_REQUEST) {
+            this.logger.warn({ ...payload, response: responseBody }, 'http_client_error');
+        }
+        response.status(status).json(responseBody);
+    }
+    toResponseBody(exception, status) {
+        if (exception instanceof common_1.HttpException) {
+            const body = exception.getResponse();
+            if (typeof body === 'string') {
+                return { statusCode: status, message: body };
+            }
+            return body;
+        }
+        return { statusCode: status, message: 'Internal server error' };
+    }
+};
+exports.PinoExceptionFilter = PinoExceptionFilter;
+exports.PinoExceptionFilter = PinoExceptionFilter = __decorate([
+    (0, common_1.Catch)(),
+    __metadata("design:paramtypes", [Object, Object])
+], PinoExceptionFilter);
+//# sourceMappingURL=pino-exception.filter.js.map

package/dist/shared/filters/pino-exception.filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pino-exception.filter.js","sourceRoot":"","sources":["../../../src/shared/filters/pino-exception.filter.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAkE;AAClE,+CAAkD;AAK3C,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAI9B,6FAA6F;IAC7F,yEAAyE;IACzE,YAAY,WAAW,GAAG,KAAK,EAAE,eAAe,GAAG,IAAI;QACrD,IAAI,CAAC,MAAM,GAAG,IAAA,qBAAY,EAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,SAAkB,EAAE,IAAmB;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,EAA8B,CAAC;QAC7D,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAY,CAAC;QAC7C,MAAM,MAAM,GAAG,SAAS,YAAY,sBAAa,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,mBAAU,CAAC,qBAAqB,CAAC;QAC7G,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG;YACd,MAAM;YACN,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE;YACxE,UAAU,EAAE,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,SAAS;SACvF,CAAC;QAEF,IAAI,MAAM,IAAI,mBAAU,CAAC,qBAAqB,EAAE,CAAC;YAC/C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,uBAAuB,CAAC,CAAC;QAC7E,CAAC;aAAM,IAAI,IAAI,CAAC,eAAe,IAAI,MAAM,IAAI,mBAAU,CAAC,WAAW,EAAE,CAAC;YACpE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,mBAAmB,CAAC,CAAC;QAChF,CAAC;QAED,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC7C,CAAC;IAEO,cAAc,CAAC,SAAkB,EAAE,MAAc;QACvD,IAAI,SAAS,YAAY,sBAAa,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;YACrC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC/C,CAAC;YACD,OAAO,IAA+B,CAAC;QACzC,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC;IAClE,CAAC;CACF,CAAA;AA3CY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,cAAK,GAAE;;GACK,mBAAmB,CA2C/B"}

package/dist/shared/health/health.controller.d.ts

@@ -0,0 +1,11 @@
+import type { Response } from 'express';
+import { HealthService } from './health.service';
+export declare class HealthController {
+    private readonly health;
+    constructor(health: HealthService);
+    check(): {
+        status: string;
+    };
+    ready(response: Response): Promise<import("./health.service").ReadinessResult>;
+}
+//# sourceMappingURL=health.controller.d.ts.map

package/dist/shared/health/health.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.controller.d.ts","sourceRoot":"","sources":["../../../src/shared/health/health.controller.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,qBACa,gBAAgB;IACQ,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,aAAa;IAGzE,KAAK;;;IAKC,KAAK,CAA6B,QAAQ,EAAE,QAAQ;CAK3D"}

package/dist/shared/health/health.controller.js

@@ -0,0 +1,51 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HealthController = void 0;
+const common_1 = require("@nestjs/common");
+const health_service_1 = require("./health.service");
+let HealthController = class HealthController {
+    constructor(health) {
+        this.health = health;
+    }
+    check() {
+        return this.health.liveness();
+    }
+    async ready(response) {
+        const result = await this.health.readiness();
+        if (result.status !== 'ok')
+            response.status(503);
+        return result;
+    }
+};
+exports.HealthController = HealthController;
+__decorate([
+    (0, common_1.Get)('healthz'),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", void 0)
+], HealthController.prototype, "check", null);
+__decorate([
+    (0, common_1.Get)('readyz'),
+    __param(0, (0, common_1.Res)({ passthrough: true })),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], HealthController.prototype, "ready", null);
+exports.HealthController = HealthController = __decorate([
+    (0, common_1.Controller)(),
+    __param(0, (0, common_1.Inject)(health_service_1.HealthService)),
+    __metadata("design:paramtypes", [health_service_1.HealthService])
+], HealthController);
+//# sourceMappingURL=health.controller.js.map

package/dist/shared/health/health.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.controller.js","sourceRoot":"","sources":["../../../src/shared/health/health.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA8D;AAE9D,qDAAiD;AAG1C,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAC3B,YAAoD,MAAqB;QAArB,WAAM,GAAN,MAAM,CAAe;IAAG,CAAC;IAG7E,KAAK;QACH,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;IAChC,CAAC;IAGK,AAAN,KAAK,CAAC,KAAK,CAA6B,QAAkB;QACxD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QAC7C,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI;YAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF,CAAA;AAdY,4CAAgB;AAI3B;IADC,IAAA,YAAG,EAAC,SAAS,CAAC;;;;6CAGd;AAGK;IADL,IAAA,YAAG,EAAC,QAAQ,CAAC;IACD,WAAA,IAAA,YAAG,EAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;;;;6CAItC;2BAbU,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;IAEE,WAAA,IAAA,eAAM,EAAC,8BAAa,CAAC,CAAA;qCAA0B,8BAAa;GAD9D,gBAAgB,CAc5B"}

package/dist/shared/health/health.service.d.ts

@@ -0,0 +1,25 @@
+import type { DbClient } from '@proofhound/db';
+import type Redis from 'ioredis';
+type CheckName = 'database' | 'redis';
+type CheckStatus = 'ok' | 'error';
+export interface HealthCheckResult {
+    status: CheckStatus;
+    latencyMs: number;
+    errorClass?: string;
+}
+export interface ReadinessResult {
+    status: CheckStatus;
+    checks: Record<CheckName, HealthCheckResult>;
+}
+export declare class HealthService {
+    private readonly db;
+    private readonly redis;
+    constructor(db: DbClient, redis: Redis);
+    liveness(): {
+        status: string;
+    };
+    readiness(): Promise<ReadinessResult>;
+    private checkDependency;
+}
+export {};
+//# sourceMappingURL=health.service.d.ts.map

package/dist/shared/health/health.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.service.d.ts","sourceRoot":"","sources":["../../../src/shared/health/health.service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,KAAK,KAAK,MAAM,SAAS,CAAC;AAMjC,KAAK,SAAS,GAAG,UAAU,GAAG,OAAO,CAAC;AACtC,KAAK,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC;AAElC,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,WAAW,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;CAC9C;AAED,qBACa,aAAa;IAEG,OAAO,CAAC,QAAQ,CAAC,EAAE;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBADF,EAAE,EAAE,QAAQ,EACf,KAAK,EAAE,KAAK;IAGrD,QAAQ;;;IAIF,SAAS,IAAI,OAAO,CAAC,eAAe,CAAC;YAY7B,eAAe;CAc9B"}