@starci/hfs 4.3.0 → 4.4.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (538) hide show
  1. package/CHANGELOG.md +14 -0
  2. package/README.md +1 -1
  3. package/db/migrate.mjs +361 -0
  4. package/db/post-cutover.mjs +136 -0
  5. package/emit/contracts.mjs +2 -2
  6. package/emit/db-types.mjs +12 -3
  7. package/lint/run.mjs +3 -3
  8. package/package.json +4 -1
  9. package/release/gate.mjs +298 -0
  10. package/release/index.mjs +103 -0
  11. package/release/push.mjs +110 -0
  12. package/report/sonar.mjs +1 -1
  13. package/runtime/config.example.yaml +7 -6
  14. package/runtime/engine/config.mjs +10 -18
  15. package/runtime/engine/removed-vocabulary.mjs +0 -2
  16. package/runtime/knowledge/hfs/canon-pins.yaml +11 -11
  17. package/runtime/knowledge/hfs/fe-stack.yaml +22 -1
  18. package/runtime/knowledge/hfs/rules.yaml +2855 -163
  19. package/runtime/knowledge/hfs/slots.yaml +333 -62
  20. package/runtime/knowledge/patterns/be/api.yaml +32 -5
  21. package/runtime/knowledge/patterns/be/cli.yaml +14 -4
  22. package/runtime/knowledge/patterns/be/event-bus.yaml +3 -3
  23. package/runtime/knowledge/patterns/be/jobs.yaml +20 -2
  24. package/runtime/knowledge/patterns/be/projections.yaml +4 -2
  25. package/runtime/knowledge/patterns/be/queues.yaml +11 -3
  26. package/runtime/knowledge/patterns/be/reactors.yaml +20 -1
  27. package/runtime/knowledge/patterns/be/realtime.yaml +25 -3
  28. package/runtime/knowledge/patterns/be/saga.yaml +20 -3
  29. package/runtime/knowledge/patterns/be/webhooks.yaml +23 -4
  30. package/runtime/knowledge/patterns/fe/folder.yaml +1 -0
  31. package/runtime/knowledge/sonar-gate.yaml +1 -1
  32. package/runtime/modules/kernel/failure-codes.yaml +3091 -43
  33. package/runtime/modules/kernel/removed-vocabulary.yaml +30 -0
  34. package/runtime/modules/models/runtimes.yaml +5 -7
  35. package/runtime/modules/schemas/application-stacks.schema.yaml +663 -0
  36. package/runtime/packages/cli/src/catalog.generated.mjs +13769 -0
  37. package/runtime/packages/cli/src/validate-args.mjs +213 -0
  38. package/runtime/scripts/api/git/add.mjs +5 -0
  39. package/runtime/scripts/api/git/init.mjs +7 -0
  40. package/runtime/scripts/api/git/lib.mjs +4 -1
  41. package/runtime/scripts/api/git/tag.mjs +5 -0
  42. package/runtime/scripts/api/node/lib.mjs +20 -0
  43. package/runtime/scripts/api/node/run-node.mjs +6 -0
  44. package/runtime/scripts/api/sops/lib.mjs +42 -1
  45. package/runtime/scripts/api/sops/selected-age-recipient.mjs +7 -0
  46. package/runtime/scripts/api/supabase/database-dump.mjs +5 -0
  47. package/runtime/scripts/api/supabase/database-query.mjs +5 -0
  48. package/runtime/scripts/api/supabase/lib.mjs +44 -0
  49. package/runtime/scripts/api/supabase/migration-repair.mjs +5 -0
  50. package/runtime/scripts/hfs/app-wiring.mjs +201 -0
  51. package/runtime/scripts/hfs/architecture/backend-app-files.mjs +1 -8
  52. package/runtime/scripts/hfs/architecture/backend.mjs +2 -7
  53. package/runtime/scripts/hfs/architecture/client-reaches-server.mjs +6 -3
  54. package/runtime/scripts/hfs/architecture/config.mjs +1 -1
  55. package/runtime/scripts/hfs/architecture/dead-exports-bindings.mjs +149 -0
  56. package/runtime/scripts/hfs/architecture/dead-exports.mjs +9 -41
  57. package/runtime/scripts/hfs/architecture/default-deny.mjs +8 -6
  58. package/runtime/scripts/hfs/architecture/frontend-world.mjs +1 -1
  59. package/runtime/scripts/hfs/architecture/function-spec-providers.mjs +153 -0
  60. package/runtime/scripts/hfs/architecture/hfs.mjs +3 -3
  61. package/runtime/scripts/hfs/architecture/index.mjs +1 -1
  62. package/runtime/scripts/hfs/architecture/module-per-transport.mjs +28 -13
  63. package/runtime/scripts/hfs/architecture/next-data-inference.mjs +176 -0
  64. package/runtime/scripts/hfs/architecture/next-data-symbols.mjs +26 -0
  65. package/runtime/scripts/hfs/architecture/next-data.mjs +31 -23
  66. package/runtime/scripts/hfs/architecture/reachability.mjs +14 -0
  67. package/runtime/scripts/hfs/architecture/register-once.mjs +2 -2
  68. package/runtime/scripts/hfs/architecture/source-names.mjs +48 -3
  69. package/runtime/scripts/hfs/architecture/supabase-ast.mjs +211 -11
  70. package/runtime/scripts/hfs/architecture/supabase-be.mjs +1 -1
  71. package/runtime/scripts/hfs/architecture/supabase.mjs +59 -21
  72. package/runtime/scripts/hfs/architecture/surface.mjs +2 -1
  73. package/runtime/scripts/hfs/architecture/tiers.mjs +4 -4
  74. package/runtime/scripts/hfs/architecture/unit-spec-providers.mjs +8 -2
  75. package/runtime/scripts/hfs/architecture.mjs +1 -1
  76. package/runtime/scripts/hfs/check-results.mjs +28 -0
  77. package/runtime/scripts/hfs/check.mjs +46 -47
  78. package/runtime/scripts/hfs/coverage-from.mjs +70 -0
  79. package/runtime/scripts/hfs/coverage-scope.mjs +1 -1
  80. package/runtime/scripts/hfs/db-baseline-verb.mjs +276 -0
  81. package/runtime/scripts/hfs/db-plan-verb.mjs +254 -0
  82. package/runtime/scripts/hfs/db-restamp-verb.mjs +60 -0
  83. package/runtime/scripts/hfs/declaration-shape.mjs +39 -3
  84. package/runtime/scripts/hfs/doc-commands.mjs +367 -0
  85. package/runtime/scripts/hfs/edition-slots.mjs +2 -2
  86. package/runtime/scripts/hfs/example-secrets.mjs +158 -0
  87. package/runtime/scripts/hfs/manifest-shape.mjs +69 -9
  88. package/runtime/scripts/hfs/param-names.mjs +1 -1
  89. package/runtime/scripts/hfs/refusal-codes.mjs +6 -0
  90. package/runtime/scripts/hfs/rule-catalog.mjs +158 -11
  91. package/runtime/scripts/hfs/rule-params-shape.mjs +22 -10
  92. package/runtime/scripts/hfs/rules/a15-findings.mjs +88 -0
  93. package/runtime/scripts/hfs/rules/app-env-required.mjs +20 -0
  94. package/runtime/scripts/hfs/rules/app-root.mjs +2 -2
  95. package/runtime/scripts/hfs/rules/assets.mjs +79 -0
  96. package/runtime/scripts/hfs/rules/boot-proof.mjs +16 -0
  97. package/runtime/scripts/hfs/rules/canon-copy-drift.mjs +59 -0
  98. package/runtime/scripts/hfs/rules/cli.mjs +1 -1
  99. package/runtime/scripts/hfs/rules/contract-compat.mjs +1 -1
  100. package/runtime/scripts/hfs/rules/contract.mjs +67 -6
  101. package/runtime/scripts/hfs/rules/coverage-below.mjs +230 -0
  102. package/runtime/scripts/hfs/rules/database-access.mjs +343 -0
  103. package/runtime/scripts/hfs/rules/database-baseline.mjs +142 -0
  104. package/runtime/scripts/hfs/rules/database-config.mjs +250 -2
  105. package/runtime/scripts/hfs/rules/database-constants.mjs +9 -0
  106. package/runtime/scripts/hfs/rules/database-migrations.mjs +286 -7
  107. package/runtime/scripts/hfs/rules/database-plpgsql.mjs +119 -9
  108. package/runtime/scripts/hfs/rules/database-queue-sources.mjs +176 -0
  109. package/runtime/scripts/hfs/rules/database-queues.mjs +361 -0
  110. package/runtime/scripts/hfs/rules/database-sql.mjs +91 -9
  111. package/runtime/scripts/hfs/rules/database.mjs +9 -0
  112. package/runtime/scripts/hfs/rules/deploy-scan.mjs +192 -0
  113. package/runtime/scripts/hfs/rules/deploy-workflow.mjs +219 -0
  114. package/runtime/scripts/hfs/rules/doc-fresh.mjs +286 -0
  115. package/runtime/scripts/hfs/rules/docker-health.mjs +249 -0
  116. package/runtime/scripts/hfs/rules/docker.mjs +24 -7
  117. package/runtime/scripts/hfs/rules/edition.mjs +9 -8
  118. package/runtime/scripts/hfs/rules/env-parity.mjs +373 -0
  119. package/runtime/scripts/hfs/rules/env-value-shape.mjs +113 -0
  120. package/runtime/scripts/hfs/rules/event-bus.mjs +3 -2
  121. package/runtime/scripts/hfs/rules/event-tables.mjs +100 -0
  122. package/runtime/scripts/hfs/rules/fe-contract-documents.mjs +115 -15
  123. package/runtime/scripts/hfs/rules/fe-stack.mjs +57 -0
  124. package/runtime/scripts/hfs/rules/feature-files.mjs +28 -0
  125. package/runtime/scripts/hfs/rules/frontend-tree.mjs +54 -35
  126. package/runtime/scripts/hfs/rules/integration-specs.mjs +3 -2
  127. package/runtime/scripts/hfs/rules/lexicon.mjs +62 -0
  128. package/runtime/scripts/hfs/rules/lite-proof-lane.mjs +89 -0
  129. package/runtime/scripts/hfs/rules/monorepo.mjs +14 -1
  130. package/runtime/scripts/hfs/rules/pipeline.mjs +8 -1
  131. package/runtime/scripts/hfs/rules/release-provenance.mjs +211 -0
  132. package/runtime/scripts/hfs/rules/saga-delivery.mjs +66 -0
  133. package/runtime/scripts/hfs/rules/saga.mjs +8 -16
  134. package/runtime/scripts/hfs/rules/script-hygiene.mjs +151 -0
  135. package/runtime/scripts/hfs/rules/secret-custody-only.mjs +65 -0
  136. package/runtime/scripts/hfs/rules/secrets.mjs +13 -0
  137. package/runtime/scripts/hfs/rules/services.mjs +4 -4
  138. package/runtime/scripts/hfs/rules/stack-tooling.mjs +93 -0
  139. package/runtime/scripts/hfs/rules/stacks-deploy.mjs +76 -0
  140. package/runtime/scripts/hfs/rules/stacks-ingress.mjs +87 -0
  141. package/runtime/scripts/hfs/rules/stacks-lite-backing.mjs +111 -0
  142. package/runtime/scripts/hfs/rules/stacks-release.mjs +366 -0
  143. package/runtime/scripts/hfs/rules/stacks-runtime.mjs +41 -1
  144. package/runtime/scripts/hfs/rules/stacks-swarm.mjs +417 -0
  145. package/runtime/scripts/hfs/rules/supabase-secrets.mjs +2 -2
  146. package/runtime/scripts/hfs/rules/supply-chain.mjs +167 -0
  147. package/runtime/scripts/hfs/rules/unused-symbol-flow.mjs +101 -0
  148. package/runtime/scripts/hfs/rules/unused-symbol-ledger.mjs +77 -0
  149. package/runtime/scripts/hfs/rules/unused-symbol-translators.mjs +165 -0
  150. package/runtime/scripts/hfs/rules/unused-symbol-values.mjs +103 -0
  151. package/runtime/scripts/hfs/rules/unused-symbol.mjs +320 -0
  152. package/runtime/scripts/hfs/runtime-rules/source-ast.mjs +185 -0
  153. package/runtime/scripts/hfs/runtime-rules/workflow-source.mjs +19 -0
  154. package/runtime/scripts/hfs/sealed-members.mjs +101 -0
  155. package/runtime/scripts/hfs/secret-bootstrap-crypto.mjs +200 -0
  156. package/runtime/scripts/hfs/secret-edit.mjs +170 -0
  157. package/runtime/scripts/hfs/secret-init.mjs +127 -19
  158. package/runtime/scripts/hfs/secret-sops.mjs +38 -6
  159. package/runtime/scripts/hfs/secret-store.mjs +56 -54
  160. package/runtime/scripts/hfs/secret.mjs +34 -5
  161. package/runtime/scripts/hfs/slot-imports.mjs +18 -5
  162. package/runtime/scripts/hfs/slots.mjs +3 -2
  163. package/runtime/scripts/hfs/stack-config-kit.mjs +34 -0
  164. package/runtime/scripts/hfs/stack-deploy-config.mjs +313 -0
  165. package/runtime/scripts/hfs/stack-ingress-config.mjs +237 -0
  166. package/runtime/scripts/hfs/stacks-gate.mjs +414 -0
  167. package/runtime/scripts/hfs/starcistacks-runtime.mjs +61 -0
  168. package/runtime/scripts/hfs/typescript-programs.mjs +0 -8
  169. package/runtime/scripts/lib/command-tokens.mjs +126 -0
  170. package/runtime/scripts/lib/compose-values.mjs +11 -0
  171. package/runtime/scripts/lib/deployment-findings.mjs +7 -0
  172. package/runtime/scripts/lib/env.mjs +2 -2
  173. package/runtime/scripts/lib/git.mjs +1 -1
  174. package/runtime/scripts/lib/i18n.mjs +0 -2
  175. package/runtime/scripts/lib/json-clone.mjs +61 -0
  176. package/runtime/scripts/lib/language.mjs +1 -1
  177. package/runtime/scripts/lib/list.mjs +4 -0
  178. package/runtime/scripts/lib/roots.mjs +2 -4
  179. package/runtime/scripts/lib/runtime-example.mjs +13 -0
  180. package/runtime/scripts/lib/secret-patterns.mjs +60 -5
  181. package/runtime/scripts/lib/sql-ast.mjs +32 -0
  182. package/runtime/scripts/lib/stack-services.mjs +1 -1
  183. package/runtime/scripts/lib/swarm-stack.mjs +5 -18
  184. package/runtime/scripts/lib/trim-end.mjs +8 -0
  185. package/runtime/scripts/lib/ts-analysis.mjs +5 -2
  186. package/runtime/scripts/lib/ts-ast.mjs +27 -2
  187. package/runtime/scripts/lib/workflow-events.mjs +8 -0
  188. package/scaffold/add-app.mjs +77 -59
  189. package/scaffold/add-cli-lite.mjs +14 -6
  190. package/scaffold/add-compose.mjs +79 -0
  191. package/scaffold/add-database-lite.mjs +14 -0
  192. package/scaffold/add-fe-overlay.mjs +1 -0
  193. package/scaffold/add-fe-page.mjs +1 -0
  194. package/scaffold/add-inbox-lite.mjs +74 -42
  195. package/scaffold/add-table.mjs +110 -87
  196. package/scaffold/add.mjs +159 -44
  197. package/scaffold/app.mjs +124 -39
  198. package/scaffold/edition-gate.mjs +3 -3
  199. package/scaffold/lite-exports.mjs +2 -1
  200. package/scaffold/service.mjs +2 -2
  201. package/scaffold/supabase-ports.mjs +1 -1
  202. package/src/main.mjs +229 -116
  203. package/stack/age-install.mjs +37 -0
  204. package/stack/backup.mjs +100 -0
  205. package/stack/build-args.mjs +42 -0
  206. package/stack/build.mjs +173 -0
  207. package/stack/cli.mjs +130 -0
  208. package/stack/config.mjs +57 -0
  209. package/stack/context.mjs +57 -0
  210. package/stack/converge.mjs +107 -0
  211. package/stack/deploy.mjs +301 -0
  212. package/stack/digest.mjs +16 -0
  213. package/stack/docker-transport.mjs +53 -0
  214. package/stack/edge-alias.mjs +118 -0
  215. package/stack/errors.mjs +21 -0
  216. package/stack/image-scan.mjs +152 -0
  217. package/stack/ingress-create.mjs +114 -0
  218. package/stack/ingress-publish.mjs +273 -0
  219. package/stack/ingress.mjs +706 -0
  220. package/stack/jobs.mjs +51 -0
  221. package/stack/live-restore.mjs +177 -0
  222. package/stack/prepare.mjs +266 -0
  223. package/stack/private-file.mjs +22 -0
  224. package/stack/provision.mjs +90 -0
  225. package/stack/prune.mjs +46 -0
  226. package/stack/release-store.mjs +87 -0
  227. package/stack/remote.mjs +205 -0
  228. package/stack/render.mjs +149 -0
  229. package/stack/retire.mjs +47 -0
  230. package/stack/sealed.mjs +149 -0
  231. package/stack/task.mjs +42 -0
  232. package/stack/verify.mjs +99 -0
  233. package/sync/ci-commands.mjs +13 -0
  234. package/sync/format.mjs +1 -1
  235. package/sync/hygiene.mjs +1 -1
  236. package/sync/index.mjs +110 -54
  237. package/sync/stack-images.mjs +127 -0
  238. package/templates/app/ci-workflows/github/workflows/ci.yml +5 -1
  239. package/templates/app/ci-workflows/github/workflows/images.yml +15 -3
  240. package/templates/app/ci-workflows/github/workflows/stack-deploy.yml +148 -0
  241. package/templates/app/ci-workflows-lite/github/workflows/ci.yml +7 -3
  242. package/templates/app/ci-workflows-lite/github/workflows/db-deploy.yml +38 -6
  243. package/templates/app/ci-workflows-lite/github/workflows/images.yml +14 -2
  244. package/templates/app/ci-workflows-lite/github/workflows/stack-deploy.yml +148 -0
  245. package/templates/app/codegen-graphql.mjs.partial +13 -2
  246. package/templates/app/codegen-lite/scripts/codegen.mjs +6 -1
  247. package/templates/app/codegen-prelude.mjs.partial +8 -0
  248. package/templates/app/gitignore +3 -0
  249. package/templates/app/gitignore-lite +3 -0
  250. package/templates/app/package-scripts/package.json +1 -0
  251. package/templates/app/package-scripts/supabase.json +7 -0
  252. package/templates/app/package-scripts-lite/package.json +1 -7
  253. package/templates/app/skeleton/.editorconfig +1 -0
  254. package/templates/app/skeleton/.gitattributes +7 -1
  255. package/templates/app/skeleton/.github/dependabot.yml +17 -0
  256. package/templates/app/skeleton/.nvmrc +1 -1
  257. package/templates/app/skeleton/.starcistacks/application-stacks.yaml +134 -1
  258. package/templates/app/skeleton/.starcistacks/dev/README.md +16 -0
  259. package/templates/app/skeleton/.starcistacks/dev/environment.json +5 -0
  260. package/templates/app/skeleton/.starcistacks/dev/infra/compose/stack.yaml +71 -0
  261. package/templates/app/skeleton/.starcistacks/dev/runtime/env/KEYS.md +14 -0
  262. package/templates/app/skeleton/.starcistacks/production/README.md +37 -0
  263. package/templates/app/skeleton/.starcistacks/production/environment.json +5 -0
  264. package/templates/app/skeleton/.starcistacks/production/infra/swarm/Caddyfile +15 -0
  265. package/templates/app/skeleton/.starcistacks/production/infra/swarm/owner-actions.md +11 -0
  266. package/templates/app/skeleton/.starcistacks/production/infra/swarm/recovery/restore-proof.md +7 -0
  267. package/templates/app/skeleton/.starcistacks/production/infra/swarm/releases/current.yaml +6 -0
  268. package/templates/app/skeleton/.starcistacks/production/infra/swarm/releases/images.lock.yaml +9 -0
  269. package/templates/app/skeleton/.starcistacks/production/infra/swarm/releases/previous.yaml +6 -0
  270. package/templates/app/skeleton/.starcistacks/production/infra/swarm/stack.yaml +142 -0
  271. package/templates/app/skeleton/.starcistacks/production/runtime/env/KEYS.md +14 -0
  272. package/templates/app/skeleton/README.md +6 -6
  273. package/templates/app/skeleton/scripts/codegen.mjs +1 -2
  274. package/templates/app/skeleton-lite/.editorconfig +16 -0
  275. package/templates/app/skeleton-lite/.gitattributes +8 -0
  276. package/templates/app/skeleton-lite/.github/dependabot.yml +17 -0
  277. package/templates/app/skeleton-lite/.nvmrc +1 -0
  278. package/templates/app/skeleton-lite/.sops.yaml +3 -2
  279. package/templates/app/skeleton-lite/.starcistacks/application-stacks.yaml +178 -1
  280. package/templates/app/skeleton-lite/.starcistacks/dev/README.md +20 -0
  281. package/templates/app/skeleton-lite/.starcistacks/dev/environment.json +2 -1
  282. package/templates/app/skeleton-lite/.starcistacks/dev/infra/swarm/Caddyfile +16 -0
  283. package/templates/app/skeleton-lite/.starcistacks/dev/infra/swarm/owner-actions.md +11 -0
  284. package/templates/app/skeleton-lite/.starcistacks/dev/infra/swarm/recovery/restore-proof.md +7 -0
  285. package/templates/app/skeleton-lite/.starcistacks/dev/infra/swarm/releases/current.yaml +6 -0
  286. package/templates/app/skeleton-lite/.starcistacks/dev/infra/swarm/releases/images.lock.yaml +8 -0
  287. package/templates/app/skeleton-lite/.starcistacks/dev/infra/swarm/releases/previous.yaml +6 -0
  288. package/templates/app/skeleton-lite/.starcistacks/dev/infra/swarm/stack.yaml +120 -0
  289. package/templates/app/skeleton-lite/.starcistacks/dev/runtime/env/KEYS.md +18 -0
  290. package/templates/app/skeleton-lite/.starcistacks/production/README.md +38 -0
  291. package/templates/app/skeleton-lite/.starcistacks/production/environment.json +6 -0
  292. package/templates/app/skeleton-lite/.starcistacks/production/infra/swarm/Caddyfile +11 -0
  293. package/templates/app/skeleton-lite/.starcistacks/production/infra/swarm/owner-actions.md +11 -0
  294. package/templates/app/skeleton-lite/.starcistacks/production/infra/swarm/recovery/restore-proof.md +7 -0
  295. package/templates/app/skeleton-lite/.starcistacks/production/infra/swarm/releases/current.yaml +6 -0
  296. package/templates/app/skeleton-lite/.starcistacks/production/infra/swarm/releases/images.lock.yaml +8 -0
  297. package/templates/app/skeleton-lite/.starcistacks/production/infra/swarm/releases/previous.yaml +6 -0
  298. package/templates/app/skeleton-lite/.starcistacks/production/infra/swarm/stack.yaml +121 -0
  299. package/templates/app/skeleton-lite/.starcistacks/production/runtime/env/KEYS.md +21 -0
  300. package/templates/app/skeleton-lite/.starciwork/brand/index.yaml +12 -0
  301. package/templates/app/skeleton-lite/README.md +5 -3
  302. package/templates/app/skeleton-lite/supabase/config.toml +8 -1
  303. package/templates/app/skeleton-lite/supabase/migrations/__timestamp___baseline.sql +15 -6
  304. package/templates/app/upgrade-full/.starcistacks/dev/README.md +13 -7
  305. package/templates/be/image/worker/Dockerfile +1 -1
  306. package/templates/be/inbox/database-client.spec.ts.tpl +17 -18
  307. package/templates/be/inbox/database-client.ts.tpl +12 -11
  308. package/templates/be/inbox/delivery-recorded.event.ts.tpl +36 -0
  309. package/templates/be/inbox/event-index.ts.tpl +1 -0
  310. package/templates/be/inbox/events.json.tpl +10 -0
  311. package/templates/be/inbox/migration.sql.tpl +1 -0
  312. package/templates/be/inbox/platform/event-bus/event-bus.contracts.ts.tpl +42 -0
  313. package/templates/be/inbox/platform/event-bus/event-bus.decorators.ts.tpl +9 -0
  314. package/templates/be/inbox/platform/event-bus/event-bus.module-definition.ts.tpl +6 -0
  315. package/templates/be/inbox/platform/event-bus/event-bus.module.ts.tpl +19 -0
  316. package/templates/be/inbox/platform/event-bus/event-bus.options.ts.tpl +2 -0
  317. package/templates/be/inbox/platform/event-bus/event-bus.port.ts.tpl +16 -0
  318. package/templates/be/inbox/platform/event-bus/event-bus.service.spec.ts.tpl +45 -0
  319. package/templates/be/inbox/platform/event-bus/event-bus.service.ts.tpl +15 -0
  320. package/templates/be/inbox/platform/event-bus/index.ts.tpl +5 -0
  321. package/templates/be/inbox/platform/event-bus/persistence/event-bus.sql.ts.tpl +5 -0
  322. package/templates/be/inbox/platform/inbox/inbox.decorators.ts.tpl +9 -0
  323. package/templates/be/inbox/platform/inbox/inbox.module-definition.ts.tpl +6 -0
  324. package/templates/be/inbox/platform/inbox/inbox.module.ts.tpl +19 -0
  325. package/templates/be/inbox/platform/inbox/inbox.options.ts.tpl +2 -0
  326. package/templates/be/inbox/platform/inbox/inbox.port.ts.tpl +10 -0
  327. package/templates/be/inbox/platform/inbox/inbox.service.spec.ts.tpl +41 -0
  328. package/templates/be/inbox/platform/inbox/inbox.service.ts.tpl +19 -0
  329. package/templates/be/inbox/platform/inbox/index.ts.tpl +3 -0
  330. package/templates/be/inbox/platform/inbox/persistence/inbox.sql.ts.tpl +7 -0
  331. package/templates/be/inbox/platform/migration.sql.tpl +48 -0
  332. package/templates/be/inbox/service.spec.ts.tpl +42 -9
  333. package/templates/be/inbox/service.ts.tpl +23 -8
  334. package/templates/be/inbox/webhook-door.spec.ts.tpl +1 -1
  335. package/templates/be/inbox/webhook-door.ts.tpl +2 -2
  336. package/templates/be/patterns/api/feature.module-definition.ts.tpl +6 -0
  337. package/templates/be/patterns/api/feature.module.ts.tpl +2 -1
  338. package/templates/be/patterns/api/feature.options.ts.tpl +2 -0
  339. package/templates/be/patterns/api/graphql.module-definition.ts.tpl +6 -0
  340. package/templates/be/patterns/api/graphql.module.ts.tpl +3 -2
  341. package/templates/be/patterns/api/graphql.options.ts.tpl +2 -0
  342. package/templates/be/patterns/cli/group.module-definition.ts.tpl +6 -0
  343. package/templates/be/patterns/cli/group.module.ts.tpl +2 -1
  344. package/templates/be/patterns/cli/group.options.ts.tpl +2 -0
  345. package/templates/be/patterns/event-bus/platform/errors/event-bus.error.ts.tpl +0 -3
  346. package/templates/be/patterns/event-bus/platform/messages/event-bus.messages.ts.tpl +0 -2
  347. package/templates/be/patterns/jobs/job.module-definition.ts.tpl +6 -0
  348. package/templates/be/patterns/jobs/job.module.ts.tpl +2 -1
  349. package/templates/be/patterns/jobs/job.options.ts.tpl +2 -0
  350. package/templates/be/patterns/jobs/job.queue.module-definition.ts.tpl +6 -0
  351. package/templates/be/patterns/jobs/job.queue.module.ts.tpl +6 -3
  352. package/templates/be/patterns/jobs/job.queue.options.ts.tpl +2 -0
  353. package/templates/be/patterns/jobs/platform/fenced.processor.spec.ts.tpl +3 -1
  354. package/templates/be/patterns/outbox/platform/outbox-relay.policy.spec.ts.tpl +25 -9
  355. package/templates/be/patterns/queues/platform/queue.config.ts.tpl +1 -1
  356. package/templates/be/patterns/queues/platform/queue.index.ts.tpl +1 -1
  357. package/templates/be/patterns/queues/platform/queue.module-definition.ts.tpl +2 -2
  358. package/templates/be/patterns/queues/platform/queue.module.ts.tpl +11 -0
  359. package/templates/be/patterns/queues/platform/queue.options.ts.tpl +10 -0
  360. package/templates/be/patterns/queues/queue.module-definition.ts.tpl +6 -0
  361. package/templates/be/patterns/queues/queue.module.ts.tpl +2 -1
  362. package/templates/be/patterns/queues/queue.options.ts.tpl +2 -0
  363. package/templates/be/patterns/reactors/message.module-definition.ts.tpl +6 -0
  364. package/templates/be/patterns/reactors/message.module.ts.tpl +6 -3
  365. package/templates/be/patterns/reactors/message.options.ts.tpl +2 -0
  366. package/templates/be/patterns/reactors/reactor.module-definition.ts.tpl +6 -0
  367. package/templates/be/patterns/reactors/reactor.module.ts.tpl +2 -1
  368. package/templates/be/patterns/reactors/reactor.options.ts.tpl +2 -0
  369. package/templates/be/patterns/realtime/channel.gateway.spec.ts.tpl +188 -0
  370. package/templates/be/patterns/realtime/channel.gateway.ts.tpl +22 -0
  371. package/templates/be/patterns/realtime/channel.graphql.module-definition.ts.tpl +6 -0
  372. package/templates/be/patterns/realtime/channel.graphql.module.ts.tpl +2 -1
  373. package/templates/be/patterns/realtime/channel.graphql.options.ts.tpl +2 -0
  374. package/templates/be/patterns/realtime/channel.websocket.module-definition.ts.tpl +6 -0
  375. package/templates/be/patterns/realtime/channel.websocket.module.ts.tpl +110 -0
  376. package/templates/be/patterns/realtime/channel.websocket.options.ts.tpl +7 -0
  377. package/templates/be/patterns/saga/saga.message.module-definition.ts.tpl +6 -0
  378. package/templates/be/patterns/saga/saga.message.module.ts.tpl +6 -3
  379. package/templates/be/patterns/saga/saga.message.options.ts.tpl +2 -0
  380. package/templates/be/patterns/saga/saga.module-definition.ts.tpl +6 -0
  381. package/templates/be/patterns/saga/saga.module.ts.tpl +2 -1
  382. package/templates/be/patterns/saga/saga.options.ts.tpl +2 -0
  383. package/templates/be/patterns/webhooks/webhook.http.module-definition.ts.tpl +6 -0
  384. package/templates/be/patterns/webhooks/webhook.http.module.ts.tpl +2 -1
  385. package/templates/be/patterns/webhooks/webhook.http.options.ts.tpl +2 -0
  386. package/templates/be/platform/graphql/localize-errors.mapper.spec.ts +80 -26
  387. package/templates/be/platform/graphql/localize-errors.mapper.ts +2 -5
  388. package/templates/be/skeleton/apps/__app__/src/app.module.ts +11 -9
  389. package/templates/be/skeleton/apps/__app__/src/compose/api.ts +4 -0
  390. package/templates/be/skeleton/apps/__app__/src/compose/domain.ts +11 -0
  391. package/templates/be/skeleton/apps/__app__/src/compose/platform.ts +2 -0
  392. package/templates/be/skeleton/apps/__app__/src/compose/system.ts +5 -0
  393. package/templates/be/skeleton/apps/__app__/src/compose/webhooks.ts +4 -0
  394. package/templates/be/skeleton/apps/__app__/src/main.ts +15 -1
  395. package/templates/be/skeleton/apps/cli/src/app.module.ts +3 -13
  396. package/templates/be/skeleton/apps/cli/src/cli.options.ts +6 -14
  397. package/templates/be/skeleton/apps/cli/src/compose/cli.ts +5 -0
  398. package/templates/be/skeleton/apps/cli/src/compose/platform.ts +24 -0
  399. package/templates/be/skeleton/src/features/api/system-health/application/check-readiness.contracts.ts +2 -0
  400. package/templates/be/skeleton/src/features/api/system-health/application/check-readiness.handler.ts +22 -0
  401. package/templates/be/skeleton/src/features/api/system-health/application/check-readiness.query.ts +11 -0
  402. package/templates/be/skeleton/src/features/api/system-health/system-health.module-definition.ts +6 -0
  403. package/templates/be/skeleton/src/features/api/system-health/system-health.module.ts +5 -3
  404. package/templates/be/skeleton/src/features/api/system-health/system-health.options.ts +2 -0
  405. package/templates/be/skeleton/src/features/api/system-health/transport/http/ready.controller.ts +19 -0
  406. package/templates/be/skeleton/src/features/api/system-health/transport/http/system-health-http.module-definition.ts +6 -0
  407. package/templates/be/skeleton/src/features/api/system-health/transport/http/system-health-http.module.ts +8 -3
  408. package/templates/be/skeleton/src/features/api/system-health/transport/http/system-health-http.options.ts +2 -0
  409. package/templates/be/skeleton/src/features/cli/cli.module-definition.ts +6 -0
  410. package/templates/be/skeleton/src/features/cli/cli.module.ts +3 -2
  411. package/templates/be/skeleton/src/features/cli/cli.options.ts +2 -0
  412. package/templates/be/skeleton/src/features/cli/migrate/migrate.module-definition.ts +6 -0
  413. package/templates/be/skeleton/src/features/cli/migrate/migrate.module.ts +2 -1
  414. package/templates/be/skeleton/src/features/cli/migrate/migrate.options.ts +2 -0
  415. package/templates/be/skeleton/src/features/cli/seed/seed.module-definition.ts +6 -0
  416. package/templates/be/skeleton/src/features/cli/seed/seed.module.ts +2 -1
  417. package/templates/be/skeleton/src/features/cli/seed/seed.options.ts +2 -0
  418. package/templates/be/skeleton/src/features/cli/seed/subs/run.cli.spec.ts +5 -6
  419. package/templates/be/skeleton/src/modules/domain/identity/admission.policy.spec.ts +56 -4
  420. package/templates/be/skeleton/src/modules/domain/identity/admission.policy.ts +36 -5
  421. package/templates/be/skeleton/src/modules/domain/identity/auth.guard.spec.ts +39 -8
  422. package/templates/be/skeleton/src/modules/domain/identity/auth.guard.ts +14 -8
  423. package/templates/be/skeleton/src/modules/domain/identity/credential.contracts.ts +26 -0
  424. package/templates/be/skeleton/src/modules/domain/identity/credential.guard.spec.ts +119 -0
  425. package/templates/be/skeleton/src/modules/domain/identity/credential.guard.ts +43 -0
  426. package/templates/be/skeleton/src/modules/domain/identity/identity.contracts.ts +16 -0
  427. package/templates/be/skeleton/src/modules/domain/identity/identity.decorators.ts +18 -1
  428. package/templates/be/skeleton/src/modules/domain/identity/identity.module.ts +22 -4
  429. package/templates/be/skeleton/src/modules/domain/identity/identity.options.ts +8 -2
  430. package/templates/be/skeleton/src/modules/domain/identity/index.ts +1 -0
  431. package/templates/be/skeleton/src/modules/platform/database/connection-source.client.spec.ts +11 -4
  432. package/templates/be/skeleton/src/modules/platform/database/database-probe.service.spec.ts +32 -0
  433. package/templates/be/skeleton/src/modules/platform/database/database-probe.service.ts +14 -0
  434. package/templates/be/skeleton/src/modules/platform/database/database.module.ts +7 -1
  435. package/templates/be/skeleton/src/modules/platform/database/index.ts +2 -0
  436. package/templates/be/skeleton/src/modules/platform/database/primary.decorators.ts +8 -0
  437. package/templates/be/skeleton/src/modules/platform/database/seed-connections.client.spec.ts +25 -6
  438. package/templates/be/skeleton/src/modules/platform/errors/errors.filter.spec.ts +16 -6
  439. package/templates/be/skeleton/src/modules/platform/http-security/edge-security.service.spec.ts +130 -0
  440. package/templates/be/skeleton/src/modules/platform/http-security/edge-security.service.ts +58 -0
  441. package/templates/be/skeleton/src/modules/platform/http-security/errors/http-security.error.ts +3 -0
  442. package/templates/be/skeleton/src/modules/platform/http-security/execution-request.mapper.spec.ts +16 -4
  443. package/templates/be/skeleton/src/modules/platform/http-security/http-security.config.ts +16 -10
  444. package/templates/be/skeleton/src/modules/platform/http-security/http-security.module.ts +3 -1
  445. package/templates/be/skeleton/src/modules/platform/http-security/http-security.options.ts +2 -0
  446. package/templates/be/skeleton/src/modules/platform/http-security/index.ts +5 -0
  447. package/templates/be/skeleton/src/modules/platform/http-security/messages/http-security.messages.ts +12 -5
  448. package/templates/be/skeleton/src/modules/platform/http-security/rate-limit.guard.spec.ts +13 -8
  449. package/templates/be/skeleton/src/modules/platform/http-security/readiness.contracts.ts +5 -0
  450. package/templates/be/skeleton/src/modules/platform/http-security/readiness.decorators.ts +7 -0
  451. package/templates/be/skeleton/src/modules/platform/http-security/readiness.service.spec.ts +86 -0
  452. package/templates/be/skeleton/src/modules/platform/http-security/readiness.service.ts +39 -0
  453. package/templates/be/skeleton/src/modules/platform/http-security/webhook-signature.service.spec.ts +139 -131
  454. package/templates/be/skeleton/src/modules/platform/i18n/index.ts +1 -1
  455. package/templates/be/skeleton/src/modules/platform/logging/json-logger.service.spec.ts +91 -67
  456. package/templates/be/skeleton/src/modules/platform/logging/json-logger.service.ts +5 -4
  457. package/templates/be/skeleton/src/modules/platform/logging/logging.log-events.ts +0 -2
  458. package/templates/be/skeleton/src/modules/platform/primitives/outcome.mapper.spec.ts +20 -6
  459. package/templates/be/skeleton/src/modules/platform/primitives/sequence.policy.spec.ts +16 -4
  460. package/templates/be/skeleton/src/modules/platform/retry/index.ts +3 -0
  461. package/templates/be/skeleton/src/modules/platform/retry/retry.decorators.ts +9 -0
  462. package/templates/be/skeleton/src/modules/platform/retry/retry.module-definition.ts +7 -0
  463. package/templates/be/skeleton/src/modules/platform/retry/retry.module.ts +19 -0
  464. package/templates/be/skeleton/src/modules/platform/retry/retry.options.ts +2 -0
  465. package/templates/be/skeleton/src/modules/platform/retry/retry.port.ts +11 -0
  466. package/templates/be/skeleton/src/modules/platform/retry/system-timer.service.spec.ts +36 -0
  467. package/templates/be/skeleton/src/modules/platform/retry/system-timer.service.ts +10 -0
  468. package/templates/be/skeleton/src/tests/contract/http-security/http-security.contract-spec.ts +54 -0
  469. package/templates/be/skeleton-lite/apps/api/src/app.module.ts +14 -18
  470. package/templates/be/skeleton-lite/apps/api/src/compose/api.ts +4 -0
  471. package/templates/be/skeleton-lite/apps/api/src/compose/domain.ts +10 -0
  472. package/templates/be/skeleton-lite/apps/api/src/compose/integrations.ts +16 -0
  473. package/templates/be/skeleton-lite/apps/api/src/compose/platform.ts +2 -0
  474. package/templates/be/skeleton-lite/apps/api/src/compose/system.ts +5 -0
  475. package/templates/be/skeleton-lite/apps/api/src/compose/webhooks.ts +4 -0
  476. package/templates/be/skeleton-lite/apps/api/src/main.ts +2 -3
  477. package/templates/be/skeleton-lite/apps/cli/src/compose/platform.ts +12 -0
  478. package/templates/be/skeleton-lite/src/modules/domain/identity/admission.policy.spec.ts +71 -5
  479. package/templates/be/skeleton-lite/src/modules/domain/identity/admission.policy.ts +29 -2
  480. package/templates/be/skeleton-lite/src/modules/domain/identity/auth.guard.spec.ts +68 -15
  481. package/templates/be/skeleton-lite/src/modules/domain/identity/auth.guard.ts +14 -9
  482. package/templates/be/skeleton-lite/src/modules/domain/identity/identity.contracts.ts +9 -2
  483. package/templates/be/skeleton-lite/src/modules/domain/identity/identity.decorators.ts +16 -1
  484. package/templates/be/skeleton-lite/src/modules/domain/identity/identity.module.ts +19 -4
  485. package/templates/be/skeleton-lite/src/modules/domain/identity/identity.options.ts +5 -1
  486. package/templates/be/skeleton-lite/src/modules/domain/identity/index.ts +2 -1
  487. package/templates/be/skeleton-lite/src/modules/integrations/supabase/errors/supabase.error.ts +0 -3
  488. package/templates/be/skeleton-lite/src/modules/integrations/supabase/supabase.client.spec.ts +17 -5
  489. package/templates/be/skeleton-lite/src/modules/platform/database/database.module.ts +24 -13
  490. package/templates/be/skeleton-lite/src/modules/platform/database/database.port.ts +5 -0
  491. package/templates/be/skeleton-lite/src/modules/platform/database/errors/database.error.ts +16 -0
  492. package/templates/be/skeleton-lite/src/modules/platform/database/index.ts +3 -0
  493. package/templates/be/skeleton-lite/src/modules/platform/http-security/http-security.module.ts +5 -2
  494. package/templates/be/skeleton-lite/src/modules/platform/http-security/index.ts +4 -1
  495. package/templates/be/skeleton-lite/src/modules/platform/i18n/index.ts +1 -1
  496. package/templates/be/skeleton-lite/src/modules/platform/logging/logging.log-events.ts +7 -0
  497. package/templates/be/skeleton-lite/src/tests/fixtures/builders/api.builder.ts +29 -0
  498. package/templates/be/skeleton-lite/src/tests/fixtures/builders/cli.builder.ts +16 -0
  499. package/templates/be/table/api/feature.module-definition.ts.tpl +6 -0
  500. package/templates/be/table/api/feature.module.ts.tpl +2 -1
  501. package/templates/be/table/api/feature.options.ts.tpl +2 -0
  502. package/templates/be/table/api/graphql.module-definition.ts.tpl +6 -0
  503. package/templates/be/table/api/graphql.module.ts.tpl +3 -2
  504. package/templates/be/table/api/graphql.options.ts.tpl +2 -0
  505. package/templates/be/table/migration.sql.tpl +1 -0
  506. package/templates/be/upgrade-full/apps/cli/src/app.module.ts +4 -6
  507. package/templates/be/upgrade-full/apps/cli/src/cli.env.ts +7 -0
  508. package/templates/be/upgrade-full/apps/cli/src/compose/cli.ts +5 -0
  509. package/templates/be/upgrade-full/apps/cli/src/compose/platform.ts +9 -0
  510. package/templates/be/upgrade-full/apps/cli/src/main.ts +3 -0
  511. package/templates/be/upgrade-full/src/features/cli/cli.module.ts +3 -2
  512. package/templates/fe/auth/supabase-client.ts.tpl +34 -0
  513. package/templates/fe/skeleton/apps/__app__/src/app/auth/callback/route.ts +11 -0
  514. package/templates/fe/skeleton/apps/__app__/src/components/blocks/SignInForm/index.tsx +6 -1
  515. package/templates/fe/skeleton/apps/__app__/src/components/leaves/Icon/index.tsx +4 -0
  516. package/templates/fe/skeleton/apps/__app__/src/features/overlays/AppGuideOverlay/component.tsx +31 -0
  517. package/templates/fe/skeleton/apps/__app__/src/features/overlays/AppGuideOverlay/index.tsx +24 -0
  518. package/templates/fe/skeleton/apps/__app__/src/hooks/auth/useSession.ts +6 -1
  519. package/templates/fe/skeleton/apps/__app__/src/hooks/auth/useSignOut.ts +3 -4
  520. package/templates/fe/skeleton/apps/__app__/src/hooks/zustand/appGuide/index.ts +1 -0
  521. package/templates/fe/skeleton/apps/__app__/src/hooks/zustand/appGuide/store.ts +15 -0
  522. package/templates/fe/skeleton/apps/__app__/src/modules/auth/pkce-client.ts +18 -0
  523. package/templates/fe/skeleton/apps/__app__/src/modules/auth/server.ts +19 -0
  524. package/templates/fe/skeleton/apps/app/src/features/pages/AppHomePage/index.tsx +7 -1
  525. package/templates/fe/skeleton/apps/app/src/modules/i18n/messages/en.json +57 -0
  526. package/templates/fe/skeleton/apps/app/src/modules/i18n/messages/vi.json +6 -0
  527. package/templates/fe/skeleton/apps/landing/src/modules/i18n/messages/en.json +31 -0
  528. package/templates/fe/skeleton/packages/__project__-i18n/src/routing.ts +1 -1
  529. package/templates/fe/skeleton/packages/__project__-ui/src/index.ts +1 -0
  530. package/templates/fe/skeleton-lite/apps/__app__/src/modules/auth/client.ts +1 -34
  531. package/templates/fe/skeleton-lite/apps/web/src/features/pages/AppHomePage/index.tsx +7 -1
  532. package/templates/fe/skeleton-lite/apps/web/src/modules/i18n/messages/en.json +57 -0
  533. package/templates/fe/skeleton-lite/apps/web/src/modules/i18n/messages/vi.json +30 -24
  534. package/templates/fe/skeleton-lite/apps/web/src/modules/i18n/routing.ts +1 -1
  535. package/templates/fe/transport/graphql/clients/clients/auth.ts +1 -1
  536. package/templates/fe/transport/graphql/clients/links/locale.ts +2 -2
  537. package/upgrade/check.mjs +3 -1
  538. package/upgrade/index.mjs +54 -41
@@ -0,0 +1,7 @@
1
+ import { injector } from "@modules/platform/composition"
2
+ import type { TypedParameterDecorator } from "@modules/platform/composition"
3
+ import { ReadinessService } from "./readiness.service"
4
+
5
+ /** Injects the bounded required-dependency probe. Parameter type: ReadinessService. */
6
+ export const InjectReadiness = (): TypedParameterDecorator<ReadinessService> =>
7
+ injector<ReadinessService>(ReadinessService)
@@ -0,0 +1,86 @@
1
+ import { Test } from "@nestjs/testing"
2
+ import { mock } from "@starci/jest-preset"
3
+ import { DATABASE_PROBE } from "@modules/platform/database"
4
+ import type { DatabaseProbeService } from "@modules/platform/database"
5
+ import { TIMER } from "@modules/platform/retry"
6
+ import type { Timer } from "@modules/platform/retry"
7
+ import { HTTP_SECURITY_ERROR_KINDS, HttpSecurityError, HttpSecurityErrorCode } from "./errors/http-security.error"
8
+ import { ReadinessService } from "./readiness.service"
9
+
10
+ const build = async () => {
11
+ const database = mock<DatabaseProbeService>()
12
+ const timer = mock<Timer>()
13
+ const cancel = jest.fn()
14
+ timer.schedule.mockReturnValue(cancel)
15
+ const moduleRef = await Test.createTestingModule({
16
+ providers: [
17
+ ReadinessService,
18
+ { provide: DATABASE_PROBE, useValue: database },
19
+ { provide: TIMER, useValue: timer },
20
+ ],
21
+ }).compile()
22
+ return { service: moduleRef.get(ReadinessService), database, timer, cancel }
23
+ }
24
+
25
+ describe("ReadinessService", () => {
26
+ it("probes the required database before reporting ready", async () => {
27
+ const { service, database, timer } = await build()
28
+ database.probe.mockResolvedValue(undefined)
29
+
30
+ await expect(service.probeRequired()).resolves.toEqual({ ok: true })
31
+
32
+ expect(database.probe).toHaveBeenCalledTimes(1)
33
+ expect(timer.schedule).toHaveBeenCalledWith(expect.any(Function), 1000)
34
+ })
35
+
36
+ it("preserves the database failure under the unavailable error kind that answers 503", async () => {
37
+ const { service, database, cancel } = await build()
38
+ const cause = new Error("connection unavailable")
39
+ database.probe.mockRejectedValue(cause)
40
+ const probe = service.probeRequired()
41
+
42
+ await expect(probe).rejects.toBeInstanceOf(HttpSecurityError)
43
+ await expect(probe).rejects.toMatchObject({ code: HttpSecurityErrorCode.RequiredDependencyUnavailable, cause })
44
+ expect(HTTP_SECURITY_ERROR_KINDS[HttpSecurityErrorCode.RequiredDependencyUnavailable]).toBe("unavailable")
45
+ expect(cancel).toHaveBeenCalledTimes(1)
46
+ })
47
+
48
+ it("fails within the bounded timeout when the required database never answers", async () => {
49
+ const { service, database, timer, cancel } = await build()
50
+ database.probe.mockReturnValue(new Promise(() => undefined))
51
+ const probe = service.probeRequired()
52
+ const expected = expect(probe).rejects.toMatchObject({
53
+ code: HttpSecurityErrorCode.RequiredDependencyUnavailable,
54
+ cause: new Error("Required database readiness timed out"),
55
+ })
56
+
57
+ expect(timer.schedule).toHaveBeenCalledWith(expect.any(Function), 1000)
58
+ timer.schedule.mock.calls.at(0)?.[0]()
59
+ await expected
60
+ expect(cancel).toHaveBeenCalledTimes(1)
61
+ })
62
+
63
+ it("cancels the deadline when the database answers early", async () => {
64
+ const { service, database, cancel } = await build()
65
+ database.probe.mockResolvedValue(undefined)
66
+
67
+ await expect(service.probeRequired()).resolves.toEqual({ ok: true })
68
+
69
+ expect(cancel).toHaveBeenCalledTimes(1)
70
+ })
71
+
72
+ it("preserves a synchronous database failure before a deadline can be scheduled", async () => {
73
+ const { service, database, timer, cancel } = await build()
74
+ const cause = new HttpSecurityError({ code: HttpSecurityErrorCode.RequiredDependencyUnavailable })
75
+ database.probe.mockImplementation(() => {
76
+ throw cause
77
+ })
78
+
79
+ await expect(service.probeRequired()).rejects.toMatchObject({
80
+ code: HttpSecurityErrorCode.RequiredDependencyUnavailable,
81
+ cause,
82
+ })
83
+ expect(timer.schedule).not.toHaveBeenCalled()
84
+ expect(cancel).not.toHaveBeenCalled()
85
+ })
86
+ })
@@ -0,0 +1,39 @@
1
+ import { Injectable } from "@nestjs/common"
2
+ import { InjectDatabaseProbe } from "@modules/platform/database"
3
+ import type { DatabaseProbeService } from "@modules/platform/database"
4
+ import { InjectTimer } from "@modules/platform/retry"
5
+ import type { Timer } from "@modules/platform/retry"
6
+ import { HttpSecurityError, HttpSecurityErrorCode } from "./errors/http-security.error"
7
+ import type { ReadinessReport } from "./readiness.contracts"
8
+
9
+ const READINESS_TIMEOUT_MS = 1000
10
+
11
+ @Injectable()
12
+ /** Required-dependency readiness; liveness never calls this database probe. */
13
+ export class ReadinessService {
14
+ constructor(
15
+ @InjectDatabaseProbe() private readonly database: DatabaseProbeService,
16
+ @InjectTimer() private readonly timer: Timer,
17
+ ) {}
18
+
19
+ /** Returns ready only when the required primary database answers within one second. */
20
+ async probeRequired(): Promise<ReadinessReport> {
21
+ let cancel: () => void = () => undefined
22
+ try {
23
+ await Promise.race([
24
+ this.database.probe(),
25
+ new Promise<never>((_resolve, reject) => {
26
+ cancel = this.timer.schedule(
27
+ () => reject(new Error("Required database readiness timed out")),
28
+ READINESS_TIMEOUT_MS,
29
+ )
30
+ }),
31
+ ])
32
+ } catch (cause) {
33
+ throw new HttpSecurityError({ code: HttpSecurityErrorCode.RequiredDependencyUnavailable, cause })
34
+ } finally {
35
+ cancel()
36
+ }
37
+ return { ok: true }
38
+ }
39
+ }
@@ -36,137 +36,145 @@ const build = async () => {
36
36
 
37
37
  const refusal = (code: HttpSecurityErrorCode) => expect.objectContaining({ code })
38
38
 
39
- describe("WebhookSignatureService", () => {
40
- describe("verify", () => {
41
- it("accepts a current delivery signed with the configured secret", async () => {
42
- const { service } = await build()
43
- const timestamp = String(SIGNED_AT)
44
-
45
- expect(() =>
46
- service.verify({
47
- provider: "payments",
48
- rawBody: BODY,
49
- signature: `sha256=${sign(timestamp)}`,
50
- timestamp,
51
- }),
52
- ).not.toThrow()
53
- })
54
-
55
- it("refuses a provider that is not configured", async () => {
56
- const { service } = await build()
57
-
58
- expect(() =>
59
- service.verify({
60
- provider: "unknown",
61
- rawBody: BODY,
62
- signature: "sha256=x",
63
- timestamp: "1",
64
- }),
65
- ).toThrow(refusal(HttpSecurityErrorCode.WebhookProviderUnknown))
66
- })
67
-
68
- it.each([
69
- {
70
- rawBody: undefined,
39
+ const signedPartCases = () => {
40
+ it("accepts a current delivery signed with the configured secret", async () => {
41
+ const { service } = await build()
42
+ const timestamp = String(SIGNED_AT)
43
+
44
+ expect(() =>
45
+ service.verify({
46
+ provider: "payments",
47
+ rawBody: BODY,
48
+ signature: `sha256=${sign(timestamp)}`,
49
+ timestamp,
50
+ }),
51
+ ).not.toThrow()
52
+ })
53
+
54
+ it("refuses a provider that is not configured", async () => {
55
+ const { service } = await build()
56
+
57
+ expect(() =>
58
+ service.verify({
59
+ provider: "unknown",
60
+ rawBody: BODY,
71
61
  signature: "sha256=x",
72
- timestamp: String(SIGNED_AT),
73
- },
74
- { rawBody: BODY, signature: undefined, timestamp: String(SIGNED_AT) },
75
- { rawBody: BODY, signature: "sha256=x", timestamp: undefined },
76
- { rawBody: BODY, signature: "sha256=x", timestamp: "yesterday" },
77
- ])("refuses a delivery missing a signed part (%#)", async (part) => {
78
- const { service } = await build()
79
-
80
- expect(() => service.verify({ provider: "payments", ...part })).toThrow(
81
- refusal(HttpSecurityErrorCode.WebhookSignatureInvalid),
82
- )
83
- })
84
-
85
- it("refuses a signature without the sha256 scheme", async () => {
86
- const { service } = await build()
87
- const timestamp = String(SIGNED_AT)
88
-
89
- expect(() =>
90
- service.verify({
91
- provider: "payments",
92
- rawBody: BODY,
93
- signature: sign(timestamp),
94
- timestamp,
95
- }),
96
- ).toThrow(refusal(HttpSecurityErrorCode.WebhookSignatureInvalid))
97
- })
98
-
99
- it("refuses a signature of another length and one made with another secret", async () => {
100
- const { service } = await build()
101
- const timestamp = String(SIGNED_AT)
102
-
103
- expect(() =>
104
- service.verify({
105
- provider: "payments",
106
- rawBody: BODY,
107
- signature: "sha256=abc",
108
- timestamp,
109
- }),
110
- ).toThrow(refusal(HttpSecurityErrorCode.WebhookSignatureInvalid))
111
- expect(() =>
112
- service.verify({
113
- provider: "payments",
114
- rawBody: BODY,
115
- signature: `sha256=${sign(timestamp, BODY, "other")}`,
116
- timestamp,
117
- }),
118
- ).toThrow(refusal(HttpSecurityErrorCode.WebhookSignatureInvalid))
119
- })
120
-
121
- it("refuses a delivery whose body was changed after signing", async () => {
122
- const { service } = await build()
123
- const timestamp = String(SIGNED_AT)
124
-
125
- expect(() =>
126
- service.verify({
127
- provider: "payments",
128
- rawBody: Buffer.from("{}"),
129
- signature: `sha256=${sign(timestamp)}`,
130
- timestamp,
131
- }),
132
- ).toThrow(refusal(HttpSecurityErrorCode.WebhookSignatureInvalid))
133
- })
134
-
135
- it("refuses a correctly signed delivery outside the replay window, in either direction", async () => {
136
- const { service } = await build()
137
- const stale = String(SIGNED_AT - 300_001)
138
- const future = String(SIGNED_AT + 300_001)
139
-
140
- expect(() =>
141
- service.verify({
142
- provider: "payments",
143
- rawBody: BODY,
144
- signature: `sha256=${sign(stale)}`,
145
- timestamp: stale,
146
- }),
147
- ).toThrow(refusal(HttpSecurityErrorCode.WebhookReplayed))
148
- expect(() =>
149
- service.verify({
150
- provider: "payments",
151
- rawBody: BODY,
152
- signature: `sha256=${sign(future)}`,
153
- timestamp: future,
154
- }),
155
- ).toThrow(refusal(HttpSecurityErrorCode.WebhookReplayed))
156
- })
157
-
158
- it("accepts a delivery exactly at the edge of the replay window", async () => {
159
- const { service } = await build()
160
- const edge = String(SIGNED_AT - 300_000)
161
-
162
- expect(() =>
163
- service.verify({
164
- provider: "payments",
165
- rawBody: BODY,
166
- signature: `sha256=${sign(edge)}`,
167
- timestamp: edge,
168
- }),
169
- ).not.toThrow()
170
- })
62
+ timestamp: "1",
63
+ }),
64
+ ).toThrow(refusal(HttpSecurityErrorCode.WebhookProviderUnknown))
65
+ })
66
+
67
+ it.each([
68
+ {
69
+ rawBody: undefined,
70
+ signature: "sha256=x",
71
+ timestamp: String(SIGNED_AT),
72
+ },
73
+ { rawBody: BODY, signature: undefined, timestamp: String(SIGNED_AT) },
74
+ { rawBody: BODY, signature: "sha256=x", timestamp: undefined },
75
+ { rawBody: BODY, signature: "sha256=x", timestamp: "yesterday" },
76
+ ])("refuses a delivery missing a signed part (%#)", async (part) => {
77
+ const { service } = await build()
78
+
79
+ expect(() => service.verify({ provider: "payments", ...part })).toThrow(
80
+ refusal(HttpSecurityErrorCode.WebhookSignatureInvalid),
81
+ )
82
+ })
83
+ }
84
+
85
+ const digestCases = () => {
86
+ it("refuses a signature without the sha256 scheme", async () => {
87
+ const { service } = await build()
88
+ const timestamp = String(SIGNED_AT)
89
+
90
+ expect(() =>
91
+ service.verify({
92
+ provider: "payments",
93
+ rawBody: BODY,
94
+ signature: sign(timestamp),
95
+ timestamp,
96
+ }),
97
+ ).toThrow(refusal(HttpSecurityErrorCode.WebhookSignatureInvalid))
98
+ })
99
+
100
+ it("refuses a signature of another length and one made with another secret", async () => {
101
+ const { service } = await build()
102
+ const timestamp = String(SIGNED_AT)
103
+
104
+ expect(() =>
105
+ service.verify({
106
+ provider: "payments",
107
+ rawBody: BODY,
108
+ signature: "sha256=abc",
109
+ timestamp,
110
+ }),
111
+ ).toThrow(refusal(HttpSecurityErrorCode.WebhookSignatureInvalid))
112
+ expect(() =>
113
+ service.verify({
114
+ provider: "payments",
115
+ rawBody: BODY,
116
+ signature: `sha256=${sign(timestamp, BODY, "other")}`,
117
+ timestamp,
118
+ }),
119
+ ).toThrow(refusal(HttpSecurityErrorCode.WebhookSignatureInvalid))
171
120
  })
121
+
122
+ it("refuses a delivery whose body was changed after signing", async () => {
123
+ const { service } = await build()
124
+ const timestamp = String(SIGNED_AT)
125
+
126
+ expect(() =>
127
+ service.verify({
128
+ provider: "payments",
129
+ rawBody: Buffer.from("{}"),
130
+ signature: `sha256=${sign(timestamp)}`,
131
+ timestamp,
132
+ }),
133
+ ).toThrow(refusal(HttpSecurityErrorCode.WebhookSignatureInvalid))
134
+ })
135
+ }
136
+
137
+ const replayWindowCases = () => {
138
+ it("refuses a correctly signed delivery outside the replay window, in either direction", async () => {
139
+ const { service } = await build()
140
+ const stale = String(SIGNED_AT - 300_001)
141
+ const future = String(SIGNED_AT + 300_001)
142
+
143
+ expect(() =>
144
+ service.verify({
145
+ provider: "payments",
146
+ rawBody: BODY,
147
+ signature: `sha256=${sign(stale)}`,
148
+ timestamp: stale,
149
+ }),
150
+ ).toThrow(refusal(HttpSecurityErrorCode.WebhookReplayed))
151
+ expect(() =>
152
+ service.verify({
153
+ provider: "payments",
154
+ rawBody: BODY,
155
+ signature: `sha256=${sign(future)}`,
156
+ timestamp: future,
157
+ }),
158
+ ).toThrow(refusal(HttpSecurityErrorCode.WebhookReplayed))
159
+ })
160
+
161
+ it("accepts a delivery exactly at the edge of the replay window", async () => {
162
+ const { service } = await build()
163
+ const edge = String(SIGNED_AT - 300_000)
164
+
165
+ expect(() =>
166
+ service.verify({
167
+ provider: "payments",
168
+ rawBody: BODY,
169
+ signature: `sha256=${sign(edge)}`,
170
+ timestamp: edge,
171
+ }),
172
+ ).not.toThrow()
173
+ })
174
+ }
175
+
176
+ describe("WebhookSignatureService", () => {
177
+ describe("verify signed parts", signedPartCases)
178
+ describe("verify digest", digestCases)
179
+ describe("verify replay window", replayWindowCases)
172
180
  })
@@ -1,4 +1,4 @@
1
1
  export type { Locale, MessageBundle } from "./i18n.contracts"
2
- export { InjectMessageCatalog, InjectRequestLocale, MESSAGE_CATALOG } from "./i18n.decorators"
2
+ export { InjectMessageCatalog, InjectRequestLocale, MESSAGE_CATALOG, REQUEST_LOCALE } from "./i18n.decorators"
3
3
  export { I18nModule } from "./i18n.module"
4
4
  export type { MessageCatalog, RequestLocale } from "./i18n.port"
@@ -6,21 +6,22 @@ import { createJsonLogger, JsonLoggerService } from "./json-logger.service"
6
6
  import { LOG_ERR, LOG_OUT } from "./logging.decorators"
7
7
  import { LoggingLogEvent } from "./logging.log-events"
8
8
 
9
+ type WrittenLine = { stream: "out" | "err"; line: string }
10
+
11
+ const readJsonLine = (line: string | undefined): Record<string, unknown> => {
12
+ try {
13
+ const entry: Record<string, unknown> = JSON.parse(line ?? "")
14
+ return entry
15
+ } catch (error) {
16
+ throw error
17
+ }
18
+ }
19
+
9
20
  const build = async () => {
10
21
  const clock = new FakeClock("2026-05-06T07:08:09.000Z")
11
- const written: Array<{ stream: "out" | "err"; line: string }> = []
12
- const out = mock<Writable>({
13
- write: (chunk: string) => {
14
- written.push({ stream: "out", line: chunk })
15
- return true
16
- },
17
- })
18
- const err = mock<Writable>({
19
- write: (chunk: string) => {
20
- written.push({ stream: "err", line: chunk })
21
- return true
22
- },
23
- })
22
+ const written: Array<WrittenLine> = []
23
+ const out = mock<Writable>({ write: (chunk: string) => written.push({ stream: "out", line: chunk }) > 0 })
24
+ const err = mock<Writable>({ write: (chunk: string) => written.push({ stream: "err", line: chunk }) > 0 })
24
25
  const moduleRef = await Test.createTestingModule({
25
26
  providers: [
26
27
  JsonLoggerService,
@@ -33,84 +34,107 @@ const build = async () => {
33
34
  }
34
35
 
35
36
  describe("JsonLoggerService", () => {
36
- it("writes an info line to the out stream stamped by the clock", async () => {
37
+ it("writes one info JSON line to stdout stamped by the clock", async () => {
37
38
  const { logger, written } = await build()
38
-
39
39
  logger.info("cart.opened", { personId: "p-1" })
40
-
41
40
  expect(written).toEqual([
42
41
  {
43
42
  stream: "out",
44
- line: `${JSON.stringify({ level: "info", event: "cart.opened", time: "2026-05-06T07:08:09.000Z", personId: "p-1" })}\n`,
43
+ line: `${JSON.stringify({ personId: "p-1", level: "info", event: "cart.opened", time: "2026-05-06T07:08:09.000Z" })}\n`,
45
44
  },
46
45
  ])
47
46
  })
48
47
 
49
- it("writes a warn line without fields to the err stream", async () => {
48
+ it("writes a warning without caller fields to stderr", async () => {
50
49
  const { logger, clock, written } = await build()
51
50
  clock.advance(1000)
52
-
53
51
  logger.warn(LoggingLogEvent.StartupFailed)
54
-
55
- expect(written).toEqual([
56
- {
57
- stream: "err",
58
- line: `${JSON.stringify({ level: "warn", event: LoggingLogEvent.StartupFailed, time: "2026-05-06T07:08:10.000Z" })}\n`,
59
- },
60
- ])
52
+ expect(readJsonLine(written[0]?.line)).toEqual({
53
+ level: "warn",
54
+ event: LoggingLogEvent.StartupFailed,
55
+ time: "2026-05-06T07:08:10.000Z",
56
+ })
57
+ expect(written[0]?.stream).toBe("err")
61
58
  })
59
+ })
62
60
 
63
- it("writes an error line with the name and message of an Error cause", async () => {
61
+ describe("JsonLoggerService error details", () => {
62
+ it("retains the error name, message and stack without dumping the Error object", async () => {
64
63
  const { logger, written } = await build()
65
-
66
- logger.error("db.failed", new TypeError("boom"), { operation: "PlaceOrderHandler" })
67
-
68
- expect(written).toEqual([
69
- {
70
- stream: "err",
71
- line: `${JSON.stringify({
72
- level: "error",
73
- event: "db.failed",
74
- time: "2026-05-06T07:08:09.000Z",
75
- errorName: "TypeError",
76
- errorMessage: "boom",
77
- operation: "PlaceOrderHandler",
78
- })}\n`,
79
- },
80
- ])
64
+ const cause = new TypeError("boom")
65
+ logger.error("db.failed", cause, { operation: "PlaceOrderHandler" })
66
+ expect(readJsonLine(written[0]?.line)).toEqual({
67
+ operation: "PlaceOrderHandler",
68
+ errorName: "TypeError",
69
+ errorMessage: "boom",
70
+ stack: cause.stack,
71
+ level: "error",
72
+ event: "db.failed",
73
+ time: "2026-05-06T07:08:09.000Z",
74
+ })
75
+ expect(written[0]?.stream).toBe("err")
81
76
  })
82
77
 
83
- it("writes an error line with the text of a cause that is not an Error", async () => {
78
+ it("retains an error's code, including zero, and protects cause details from caller fields", async () => {
84
79
  const { logger, written } = await build()
80
+ const cause = Object.assign(new Error("connection lost"), { code: 0 })
81
+ logger.error("db.failed", cause, { errorName: "fake", errorMessage: "fake", errorCode: "fake", stack: "fake" })
82
+ expect(readJsonLine(written[0]?.line)).toEqual({
83
+ errorName: "Error",
84
+ errorMessage: "connection lost",
85
+ errorCode: 0,
86
+ stack: cause.stack,
87
+ level: "error",
88
+ event: "db.failed",
89
+ time: "2026-05-06T07:08:09.000Z",
90
+ })
91
+ })
85
92
 
93
+ it("serializes a non-Error cause and preserves a code carried by an object cause", async () => {
94
+ const { logger, written } = await build()
86
95
  logger.error("db.failed", "plain failure")
87
-
88
- expect(written).toEqual([
89
- {
90
- stream: "err",
91
- line: `${JSON.stringify({ level: "error", event: "db.failed", time: "2026-05-06T07:08:09.000Z", errorMessage: "plain failure" })}\n`,
92
- },
96
+ logger.error("db.failed", { code: "CONNECTION_CLOSED" })
97
+ logger.error("db.failed", null)
98
+ expect(written.map(({ line }) => readJsonLine(line).errorMessage)).toEqual([
99
+ "plain failure",
100
+ "[object Object]",
101
+ "null",
93
102
  ])
103
+ expect(readJsonLine(written[1]?.line).errorCode).toBe("CONNECTION_CLOSED")
104
+ expect(readJsonLine(written[0]?.line)).not.toHaveProperty("errorCode")
94
105
  })
106
+ })
95
107
 
96
- describe("createJsonLogger", () => {
97
- afterEach(() => {
98
- jest.restoreAllMocks()
99
- })
100
-
101
- it("builds a logger that writes info to stdout and errors to stderr, stamped by the clock", () => {
102
- const lines: Array<string> = []
103
- jest.spyOn(process.stdout, "write").mockImplementation((chunk) => lines.push(`out:${String(chunk)}`) > 0)
104
- jest.spyOn(process.stderr, "write").mockImplementation((chunk) => lines.push(`err:${String(chunk)}`) > 0)
105
- const logger = createJsonLogger(new FakeClock("2026-05-06T07:08:09.000Z"))
108
+ describe("JsonLoggerService reserved fields", () => {
109
+ it("writes reserved level, event and time last so caller fields cannot forge them", async () => {
110
+ const { logger, written } = await build()
111
+ const fields = { level: "error", event: "forged", time: "1900-01-01T00:00:00Z", personId: "p-1" }
112
+ logger.info("cart.opened", fields)
113
+ logger.warn("cart.warning", fields)
114
+ logger.error("cart.failed", "failure", fields)
115
+ expect(written.map(({ line }) => readJsonLine(line).level)).toEqual(["info", "warn", "error"])
116
+ expect(written.map(({ line }) => readJsonLine(line).event)).toEqual([
117
+ "cart.opened",
118
+ "cart.warning",
119
+ "cart.failed",
120
+ ])
121
+ expect(written.every(({ line }) => readJsonLine(line).time === "2026-05-06T07:08:09.000Z")).toBe(true)
122
+ })
123
+ })
106
124
 
107
- logger.info(LoggingLogEvent.ServerStarted)
108
- logger.warn(LoggingLogEvent.StartupFailed)
125
+ describe("createJsonLogger", () => {
126
+ afterEach(() => jest.restoreAllMocks())
109
127
 
110
- expect(lines).toEqual([
111
- `out:${JSON.stringify({ level: "info", event: LoggingLogEvent.ServerStarted, time: "2026-05-06T07:08:09.000Z" })}\n`,
112
- `err:${JSON.stringify({ level: "warn", event: LoggingLogEvent.StartupFailed, time: "2026-05-06T07:08:09.000Z" })}\n`,
113
- ])
114
- })
128
+ it("uses process stdout and stderr before the DI container exists", () => {
129
+ const lines: Array<string> = []
130
+ jest.spyOn(process.stdout, "write").mockImplementation((chunk) => lines.push(`out:${String(chunk)}`) > 0)
131
+ jest.spyOn(process.stderr, "write").mockImplementation((chunk) => lines.push(`err:${String(chunk)}`) > 0)
132
+ const logger = createJsonLogger(new FakeClock("2026-05-06T07:08:09.000Z"))
133
+ logger.info(LoggingLogEvent.ServerStarted)
134
+ logger.warn(LoggingLogEvent.StartupFailed)
135
+ expect(lines).toEqual([
136
+ `out:${JSON.stringify({ level: "info", event: LoggingLogEvent.ServerStarted, time: "2026-05-06T07:08:09.000Z" })}\n`,
137
+ `err:${JSON.stringify({ level: "warn", event: LoggingLogEvent.StartupFailed, time: "2026-05-06T07:08:09.000Z" })}\n`,
138
+ ])
115
139
  })
116
140
  })
@@ -24,17 +24,18 @@ export class JsonLoggerService implements Logger {
24
24
  this.write("warn", this.err, event, fields)
25
25
  }
26
26
 
27
- /** Writes an error line with the cause serialized by name and message. */
27
+ /** Writes the cause's name, message, optional error code and stack without allowing caller fields to replace them. */
28
28
  error(event: string, cause: unknown, fields?: LogFields): void {
29
+ const code = typeof cause === "object" && cause !== null && "code" in cause ? { errorCode: cause.code } : {}
29
30
  const detail =
30
31
  cause instanceof Error
31
- ? { errorName: cause.name, errorMessage: cause.message }
32
+ ? { errorName: cause.name, errorMessage: cause.message, stack: cause.stack }
32
33
  : { errorMessage: String(cause) }
33
- this.write("error", this.err, event, { ...detail, ...fields })
34
+ this.write("error", this.err, event, { ...fields, ...detail, ...code })
34
35
  }
35
36
 
36
37
  private write(level: Level, sink: Writable, event: string, fields?: LogFields): void {
37
- sink.write(`${JSON.stringify({ level, event, time: this.clock.now().toISOString(), ...fields })}\n`)
38
+ sink.write(`${JSON.stringify({ ...fields, level, event, time: this.clock.now().toISOString() })}\n`)
38
39
  }
39
40
  }
40
41
 
@@ -4,8 +4,6 @@ export enum LoggingLogEvent {
4
4
  ServerStarted = "server.started",
5
5
  /** The service failed before it could serve; the process exits non-zero. */
6
6
  StartupFailed = "server.startup_failed",
7
- /** The worker started: its jobs are ticking and its consumers are polling. */
8
- WorkerStarted = "worker.started",
9
7
  /** The cli app's migrate run finished; the names of the applied migrations ride in the fields. */
10
8
  MigrationsApplied = "migrations.applied",
11
9
  /** The seed command finished; the seed files it ran ride in the fields, by connection. */