@steve31415/baselib 1.0.0

package/README.md

@@ -0,0 +1,14 @@
+# baselib
+
+The Plasticine new-world shared platform library (`@steve31415/baselib`).
+What it provides and why: `docs/SPEC.md`. How it's put together:
+`docs/IMPL.md`. Full design rationale with alternatives:
+`~/migration/research/base-services-design.md` (step 5).
+
+Modules (subpath exports): `config`, `log`, `log-browser`, `rum`, `auth`,
+`s2s`, `db`, `http`.
+
+Bins: `check-test-owners` — the fleet's structural test-coverage gate; every
+app runs it from `npm run verify`.
+
+Reflects Plasticine Way commit: see `docs/IMPL.md` footer.

package/dist/auth.d.ts

@@ -0,0 +1,37 @@
+import type { Context } from 'hono';
+import type { Logger } from './log-core.js';
+import { ServiceCaller, S2sOptions } from './s2s.js';
+export declare const DEFAULT_AUTH_URL = "https://auth.apps.snewman.net";
+export declare const SESSION_COOKIE = "pw_session";
+export interface AuthedUser {
+    type: 'user';
+    email: string;
+    name?: string;
+    userId?: string;
+}
+export type Identity = AuthedUser | ServiceCaller;
+declare module 'hono' {
+    interface ContextVariableMap {
+        identity: Identity;
+        user: AuthedUser;
+    }
+}
+export interface RequireIdentityOptions extends S2sOptions {
+    /** Base URL of the auth service. */
+    authUrl?: string;
+    /** Injectable for tests (defaults to global fetch). */
+    whoamiFetch?: typeof fetch;
+    logger?: Logger;
+    /** Distinguishes API requests (401) from page requests (redirect).
+     *  Default: path starts with /api/ or client prefers JSON. */
+    isApiRequest?: (c: Context) => boolean;
+    cacheTtl?: {
+        hitMs?: number;
+        missMs?: number;
+    };
+}
+export declare function requireIdentity(opts: RequireIdentityOptions): import("hono").MiddlewareHandler<any, string, {}, (Response & import("hono").TypedResponse<undefined, 302, "redirect">) | (Response & import("hono").TypedResponse<{
+    error: string;
+}, 401 | 403 | 429, "json">) | (Response & import("hono").TypedResponse<{
+    error: string;
+}, 503, "json">)>;

package/dist/auth.js

@@ -0,0 +1,102 @@
+// Identity middleware for consuming apps (design §3.4).
+//
+// Resolves who is calling, in order:
+//   1. Test bypass (AUTH_MODE=test): X-Test-S2S-Caller → service caller;
+//      X-Test-User header or TEST_USER env → user. Credential verification is
+//      bypassed; authorization (grants, app-level user checks) still runs.
+//   2. Authorization: Bearer → service-to-service OIDC (s2s.ts).
+//   3. pw_session cookie → whoami call to the auth service, cached
+//      in-instance (10 min hits / 30 s misses — the old-world numbers).
+//
+// Unauthenticated: APIs get 401 JSON, pages redirect to the auth service's
+// login with a return URL. Auth-service *failures* (network, 5xx) return 503
+// and never redirect — a redirect on failure loops forever (old-world lesson).
+import { createHash } from 'node:crypto';
+import { createMiddleware } from 'hono/factory';
+import { authMode } from './config.js';
+import { RateLimiter, resolveS2sCaller } from './s2s.js';
+export const DEFAULT_AUTH_URL = 'https://auth.apps.snewman.net';
+export const SESSION_COOKIE = 'pw_session';
+export function requireIdentity(opts) {
+    const authUrl = (opts.authUrl ?? DEFAULT_AUTH_URL).replace(/\/$/, '');
+    const whoamiFetch = opts.whoamiFetch ?? fetch;
+    const hitMs = opts.cacheTtl?.hitMs ?? 600_000;
+    const missMs = opts.cacheTtl?.missMs ?? 30_000;
+    const limiter = new RateLimiter(opts.rateLimitPerMin ?? 600);
+    const cache = new Map();
+    const isApi = opts.isApiRequest ??
+        ((c) => c.req.path.startsWith('/api/') || (c.req.header('accept') ?? '').includes('application/json'));
+    const unauthenticated = (c) => {
+        if (isApi(c))
+            return c.json({ error: 'not signed in' }, 401);
+        // Behind the LB the Node server sees plain HTTP; honor the proxy's
+        // protocol so the post-login redirect lands on https directly.
+        let returnUrl = c.req.url;
+        if (c.req.header('x-forwarded-proto') === 'https' && returnUrl.startsWith('http://')) {
+            returnUrl = `https://${returnUrl.slice('http://'.length)}`;
+        }
+        return c.redirect(`${authUrl}/login?redirect=${encodeURIComponent(returnUrl)}`);
+    };
+    return createMiddleware(async (c, next) => {
+        // Test-mode user bypass (service-caller test bypass is handled by
+        // resolveS2sCaller below, so both paths stay testable).
+        if (authMode() === 'test' && !c.req.header('x-test-s2s-caller')) {
+            const email = c.req.header('x-test-user') ?? process.env.TEST_USER;
+            if (!email)
+                return unauthenticated(c);
+            const user = { type: 'user', email };
+            c.set('identity', user);
+            c.set('user', user);
+            return next();
+        }
+        // Service-to-service path.
+        if (c.req.header('authorization') || c.req.header('x-test-s2s-caller')) {
+            const resolved = await resolveS2sCaller({ ...opts, limiter }, {
+                authorization: c.req.header('authorization'),
+                testCaller: c.req.header('x-test-s2s-caller'),
+            }, c.req.method, c.req.path);
+            if (!resolved.caller) {
+                const f = resolved.failure;
+                return c.json({ error: f.error }, f.status);
+            }
+            c.set('caller', resolved.caller);
+            c.set('identity', resolved.caller);
+            return next();
+        }
+        // Browser session path.
+        const cookieHeader = c.req.header('cookie') ?? '';
+        if (!/(?:^|;\s*)pw_session=/.test(cookieHeader))
+            return unauthenticated(c);
+        const key = createHash('sha256').update(cookieHeader).digest('hex');
+        const cached = cache.get(key);
+        if (cached && cached.expires > Date.now()) {
+            if (!cached.user)
+                return unauthenticated(c);
+            c.set('identity', cached.user);
+            c.set('user', cached.user);
+            return next();
+        }
+        let res;
+        try {
+            res = await whoamiFetch(`${authUrl}/api/whoami`, { headers: { cookie: cookieHeader } });
+        }
+        catch (err) {
+            opts.logger?.error('auth service unreachable', { error: err });
+            return c.json({ error: 'auth service unavailable' }, 503);
+        }
+        if (res.ok) {
+            const data = (await res.json());
+            const user = { type: 'user', email: data.email, name: data.name, userId: data.user_id };
+            cache.set(key, { expires: Date.now() + hitMs, user });
+            c.set('identity', user);
+            c.set('user', user);
+            return next();
+        }
+        if (res.status === 401) {
+            cache.set(key, { expires: Date.now() + missMs });
+            return unauthenticated(c);
+        }
+        opts.logger?.error('auth service error', { meta_status: res.status });
+        return c.json({ error: 'auth service unavailable' }, 503);
+    });
+}

package/dist/bin/check-test-owners.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/bin/check-test-owners.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+// `check-test-owners` — the npm bin every app runs from its verify script.
+// All logic lives in ../test-owners.ts.
+import { runTestOwnersCli } from '../test-owners.js';
+process.exitCode = await runTestOwnersCli(process.argv.slice(2));

package/dist/config.d.ts

@@ -0,0 +1,4 @@
+export declare function isCloudRun(): boolean;
+export declare function requireEnv(name: string): string;
+export declare function authMode(): 'test' | 'production';
+export declare function assertBootSafety(): void;

package/dist/config.js

@@ -0,0 +1,27 @@
+// Environment/configuration accessors shared by all new-world services.
+//
+// Local dev and tests configure via plain env vars; Cloud Run injects env
+// vars and Secret Manager values at deploy time. This module owns the
+// local-vs-Cloud-Run distinction so nothing else has to look at K_SERVICE.
+export function isCloudRun() {
+    return Boolean(process.env.K_SERVICE);
+}
+export function requireEnv(name) {
+    const v = process.env[name];
+    if (!v)
+        throw new Error(`required environment variable ${name} is not set`);
+    return v;
+}
+// 'test' enables the synthetic-identity bypass (X-Test-User /
+// X-Test-S2S-Caller headers). Production images never set AUTH_MODE.
+export function authMode() {
+    return process.env.AUTH_MODE === 'test' ? 'test' : 'production';
+}
+// Belt-and-suspenders: a container with the test bypass enabled must never
+// boot in Cloud Run. Called by startServer(); call directly from any
+// non-server entry point.
+export function assertBootSafety() {
+    if (authMode() === 'test' && isCloudRun()) {
+        throw new Error('refusing to start: AUTH_MODE=test inside Cloud Run (K_SERVICE is set)');
+    }
+}

package/dist/db.d.ts

@@ -0,0 +1,11 @@
+import pg from 'pg';
+import type { Logger } from './log-core.js';
+export interface PoolOptions {
+    /** Override the database name (default: env DB_NAME / DATABASE_URL path). */
+    database?: string;
+    max?: number;
+}
+export declare function createPool(opts?: PoolOptions): Promise<pg.Pool>;
+export declare function migrate(pool: pg.Pool, migrationsDir: string, logger?: Logger): Promise<{
+    applied: string[];
+}>;

package/dist/db.js

@@ -0,0 +1,76 @@
+// Database access. Local/dev/test: DATABASE_URL to a plain Postgres
+// (per-checkout instance — see TESTING.md). Cloud Run: the Cloud SQL Node
+// connector with IAM authentication (CLOUD_SQL_INSTANCE + DB_IAM_USER +
+// DB_NAME env vars) — no database passwords anywhere in the serving path.
+import { readdir, readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import pg from 'pg';
+import { requireEnv } from './config.js';
+// DATE columns come back as 'YYYY-MM-DD' strings, not JS Dates: calendar
+// dates are timezone-free by meaning, and a Date object smears them across
+// zones (and JSON-serializes to a full ISO timestamp). Set here — on the
+// pg instance createPool actually uses — because apps that set it on their
+// own pg copy miss this one (file:-dependency installs resolve separate pg
+// instances).
+pg.types.setTypeParser(pg.types.builtins.DATE, (v) => v);
+export async function createPool(opts = {}) {
+    const instance = process.env.CLOUD_SQL_INSTANCE;
+    if (instance) {
+        const { Connector, AuthTypes, IpAddressTypes } = await import('@google-cloud/cloud-sql-connector');
+        const connector = new Connector();
+        const clientOpts = await connector.getOptions({
+            instanceConnectionName: instance,
+            ipType: IpAddressTypes.PUBLIC,
+            authType: AuthTypes.IAM,
+        });
+        return new pg.Pool({
+            ...clientOpts,
+            user: requireEnv('DB_IAM_USER'),
+            database: opts.database ?? requireEnv('DB_NAME'),
+            max: opts.max ?? 3, // shared instance: default max_connections is low
+        });
+    }
+    const url = new URL(requireEnv('DATABASE_URL'));
+    if (opts.database)
+        url.pathname = `/${opts.database}`;
+    return new pg.Pool({ connectionString: url.toString(), max: opts.max ?? 5 });
+}
+// Plain-SQL migrations: numbered files (001-*.sql, 002-*.sql, …) applied in
+// order, recorded in schema_migrations, each inside a transaction, guarded by
+// an advisory lock so concurrent boots can't race. Applied at service boot.
+export async function migrate(pool, migrationsDir, logger) {
+    const files = (await readdir(migrationsDir)).filter((f) => f.endsWith('.sql')).sort();
+    const client = await pool.connect();
+    const applied = [];
+    try {
+        await client.query('select pg_advisory_lock(hashtext($1))', ['baselib_migrate']);
+        await client.query(`create table if not exists schema_migrations (
+         name text primary key,
+         applied_at timestamptz not null default now()
+       )`);
+        const { rows } = await client.query('select name from schema_migrations');
+        const done = new Set(rows.map((r) => r.name));
+        for (const file of files) {
+            if (done.has(file))
+                continue;
+            const sql = await readFile(join(migrationsDir, file), 'utf8');
+            try {
+                await client.query('begin');
+                await client.query(sql);
+                await client.query('insert into schema_migrations (name) values ($1)', [file]);
+                await client.query('commit');
+            }
+            catch (err) {
+                await client.query('rollback');
+                throw new Error(`migration ${file} failed`, { cause: err });
+            }
+            applied.push(file);
+            logger?.info('migration applied', { migration: file });
+        }
+    }
+    finally {
+        await client.query('select pg_advisory_unlock(hashtext($1))', ['baselib_migrate']).catch(() => { });
+        client.release();
+    }
+    return { applied };
+}

package/dist/http.d.ts

@@ -0,0 +1,23 @@
+import type { Hono, Context } from 'hono';
+import { serve } from '@hono/node-server';
+import type { Logger } from './log-core.js';
+/** One INFO line per request on exit (method, path, status, elapsed,
+ *  identity); /health excluded. Entry-point detail beyond this (key
+ *  parameters, outcomes) is the handler's job per OPERATIONS.md. */
+export declare function requestLogging(logger: Logger): import("hono").MiddlewareHandler<any, string, {}, Response>;
+export declare function addHealth(app: Hono): void;
+/** app.onError handler: log with full context, return a plain 500. */
+export declare function errorHandler(logger: Logger): (err: Error, c: Context) => (Response & import("hono").TypedResponse<{
+    error: string;
+    detail: string;
+}, 500, "json">) | (Response & import("hono").TypedResponse<`Internal error: ${string}`, 500, "text">);
+export interface StartServerOptions {
+    app: Hono;
+    logger: Logger;
+    port?: number;
+}
+/** Standard entry point: safety check, serve, graceful SIGTERM shutdown
+ *  (stop accepting, then flush all loggers, then exit). Returns the Node
+ *  server so callers can attach protocol upgrades (e.g. @hono/node-ws's
+ *  injectWebSocket). */
+export declare function startServer(opts: StartServerOptions): ReturnType<typeof serve>;

package/dist/http.js

@@ -0,0 +1,69 @@
+// HTTP service plumbing: request logging, health endpoint, error handler,
+// and the standard server entry point with graceful shutdown.
+import { createMiddleware } from 'hono/factory';
+import { serve } from '@hono/node-server';
+import { assertBootSafety } from './config.js';
+import { flushAllLoggers } from './log.js';
+import { truncate } from './log-core.js';
+/** One INFO line per request on exit (method, path, status, elapsed,
+ *  identity); /health excluded. Entry-point detail beyond this (key
+ *  parameters, outcomes) is the handler's job per OPERATIONS.md. */
+export function requestLogging(logger) {
+    return createMiddleware(async (c, next) => {
+        if (c.req.path === '/health')
+            return next();
+        const started = Date.now();
+        await next();
+        const identity = c.var.identity;
+        logger.info(`${c.req.method} ${c.req.path} ${c.res.status}`, {
+            method: c.req.method,
+            path: truncate(c.req.path, 200),
+            status: c.res.status,
+            elapsed_ms: Date.now() - started,
+            ...(identity ? { identity: identity.email } : {}),
+        });
+    });
+}
+export function addHealth(app) {
+    app.get('/health', (c) => c.json({
+        ok: true,
+        service: process.env.K_SERVICE ?? 'local',
+        revision: process.env.K_REVISION ?? 'local',
+    }));
+}
+/** app.onError handler: log with full context, return a plain 500. */
+export function errorHandler(logger) {
+    return (err, c) => {
+        logger.error(`unhandled error in ${c.req.method} ${c.req.path}`, {
+            error: err,
+            method: c.req.method,
+            path: c.req.path,
+        });
+        const wantsJson = c.req.path.startsWith('/api/') || (c.req.header('accept') ?? '').includes('application/json');
+        return wantsJson
+            ? c.json({ error: 'internal error', detail: String(err.message ?? err) }, 500)
+            : c.text(`Internal error: ${String(err.message ?? err)}`, 500);
+    };
+}
+/** Standard entry point: safety check, serve, graceful SIGTERM shutdown
+ *  (stop accepting, then flush all loggers, then exit). Returns the Node
+ *  server so callers can attach protocol upgrades (e.g. @hono/node-ws's
+ *  injectWebSocket). */
+export function startServer(opts) {
+    assertBootSafety();
+    const port = opts.port ?? Number(process.env.PORT ?? 8080);
+    const server = serve({ fetch: opts.app.fetch, port }, (info) => {
+        opts.logger.info('server started', { port: info.port });
+    });
+    process.once('SIGTERM', () => {
+        opts.logger.info('SIGTERM received, shutting down');
+        server.close(() => {
+            void flushAllLoggers().finally(() => process.exit(0));
+        });
+        // Cloud Run's grace period is 10s; don't rely on every socket closing.
+        setTimeout(() => {
+            void flushAllLoggers().finally(() => process.exit(0));
+        }, 5000).unref();
+    });
+    return server;
+}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export * from './config.js';
+export * from './log.js';
+export * from './s2s.js';
+export * from './auth.js';
+export * from './db.js';
+export * from './http.js';

package/dist/index.js

@@ -0,0 +1,6 @@
+export * from './config.js';
+export * from './log.js';
+export * from './s2s.js';
+export * from './auth.js';
+export * from './db.js';
+export * from './http.js';

package/dist/log-browser.d.ts

@@ -0,0 +1,15 @@
+import { Logger } from './log-core.js';
+export { serializeError } from './log-core.js';
+export type { Logger } from './log-core.js';
+export interface BrowserLoggerOptions {
+    app?: string;
+    dataset?: string;
+    token?: string;
+    baseUrl?: string;
+    context?: Record<string, unknown>;
+    /** Also mirror events to the devtools console (default false). */
+    console?: boolean;
+}
+export declare function createBrowserLogger(opts?: BrowserLoggerOptions): Logger;
+/** Route uncaught errors and unhandled rejections into the logger. */
+export declare function installGlobalErrorHandlers(logger: Logger): void;

package/dist/log-browser.js

@@ -0,0 +1,69 @@
+// Browser logger: same event shape and API as the server logger, shipping
+// directly to Axiom (CORS is wildcard-open on the ingest endpoint —
+// verified). Configuration comes from meta tags so server templates can
+// inject it:
+//
+//   <meta name="pw-log-app" content="auth">
+//   <meta name="pw-log-dataset" content="apps">
+//   <meta name="pw-log-token" content="...ingest-only, dataset-scoped...">
+//
+// The token is ingest-only and dataset-scoped by design — visible to any
+// signed-in user, able to do nothing but add log events.
+import { LogShipper, makeEvent } from './log-core.js';
+export { serializeError } from './log-core.js';
+function metaContent(name) {
+    return document.querySelector(`meta[name="${name}"]`)?.content || undefined;
+}
+export function createBrowserLogger(opts = {}) {
+    const app = opts.app ?? metaContent('pw-log-app') ?? 'unknown';
+    const dataset = opts.dataset ?? metaContent('pw-log-dataset') ?? 'apps';
+    const token = opts.token ?? metaContent('pw-log-token');
+    const baseUrl = opts.baseUrl ?? 'https://api.axiom.co';
+    const shipper = token
+        ? new LogShipper({
+            url: `${baseUrl}/v1/datasets/${dataset}/ingest`,
+            token,
+            batchSize: 20,
+            // keepalive lets a flush started during page unload complete.
+            fetchInit: { keepalive: true },
+        })
+        : undefined;
+    function build(context) {
+        const factory = { app, source: 'browser', context };
+        const emit = (level, message, meta) => {
+            const event = makeEvent(factory, level, message, {
+                ...meta,
+                page: location.pathname,
+            });
+            if (opts.console)
+                console[level === 'debug' ? 'debug' : level === 'error' ? 'error' : 'log'](message, meta ?? '');
+            shipper?.enqueue(event);
+        };
+        return {
+            debug: (m, meta) => emit('debug', m, meta),
+            info: (m, meta) => emit('info', m, meta),
+            warn: (m, meta) => emit('warn', m, meta),
+            error: (m, meta) => emit('error', m, meta),
+            with: (extra) => build({ ...context, ...extra }),
+            flush: () => shipper?.flush() ?? Promise.resolve(),
+        };
+    }
+    const logger = build(opts.context);
+    // Ship what's pending whenever the page may be going away.
+    const flushNow = () => void logger.flush();
+    addEventListener('pagehide', flushNow);
+    document.addEventListener('visibilitychange', () => {
+        if (document.visibilityState === 'hidden')
+            flushNow();
+    });
+    return logger;
+}
+/** Route uncaught errors and unhandled rejections into the logger. */
+export function installGlobalErrorHandlers(logger) {
+    addEventListener('error', (e) => {
+        logger.error('uncaught error', { error: e.error ?? e.message });
+    });
+    addEventListener('unhandledrejection', (e) => {
+        logger.error('unhandled rejection', { error: e.reason });
+    });
+}

package/dist/log-core.d.ts

@@ -0,0 +1,60 @@
+export type LogLevel = 'debug' | 'info' | 'warn' | 'error';
+export interface LogEvent {
+    _time: string;
+    app: string;
+    level: LogLevel;
+    severity: string;
+    source: 'server' | 'browser';
+    message: string;
+    [key: string]: unknown;
+}
+export interface Logger {
+    debug(message: string, meta?: Record<string, unknown>): void;
+    info(message: string, meta?: Record<string, unknown>): void;
+    warn(message: string, meta?: Record<string, unknown>): void;
+    error(message: string, meta?: Record<string, unknown>): void;
+    /** New logger sharing transport, with extra top-level fields on every event. */
+    with(context: Record<string, unknown>): Logger;
+    flush(): Promise<void>;
+}
+export interface SerializedError {
+    name: string;
+    message: string;
+    stack?: string;
+    cause?: {
+        name: string;
+        message: string;
+    };
+}
+export declare function serializeError(err: unknown): SerializedError;
+export declare function truncate(s: string, max: number): string;
+export interface ShipperOptions {
+    /** Full ingest URL, e.g. https://api.axiom.co/v1/datasets/apps/ingest */
+    url: string;
+    token: string;
+    batchSize?: number;
+    intervalMs?: number;
+    fetchFn?: typeof fetch;
+    /** Extra fetch options (browser sets keepalive). */
+    fetchInit?: RequestInit;
+    /** Called with the events that could not be delivered. */
+    onShipFailure?: (events: LogEvent[], error: unknown) => void;
+}
+export declare class LogShipper {
+    private readonly opts;
+    private queue;
+    private timer;
+    private inflight;
+    private readonly batchSize;
+    private readonly intervalMs;
+    constructor(opts: ShipperOptions);
+    enqueue(event: LogEvent): void;
+    flush(): Promise<void>;
+    private ship;
+}
+export interface EventFactoryOptions {
+    app: string;
+    source: 'server' | 'browser';
+    context?: Record<string, unknown>;
+}
+export declare function makeEvent(opts: EventFactoryOptions, level: LogLevel, message: string, meta?: Record<string, unknown>): LogEvent;

package/dist/log-core.js

@@ -0,0 +1,99 @@
+// Platform-neutral logging core: event shape, batching shipper, error
+// serialization. Used by both the server logger (log.ts) and the browser
+// logger (log-browser.ts). Ships to Axiom's native JSON ingest — chosen over
+// OTLP for its synchronous commit and clean top-level field names (design:
+// ~/migration/research/base-services-design.md §4).
+export function serializeError(err) {
+    if (err instanceof Error) {
+        const out = { name: err.name, message: err.message, stack: err.stack };
+        if (err.cause instanceof Error) {
+            out.cause = { name: err.cause.name, message: err.cause.message };
+        }
+        else if (err.cause !== undefined) {
+            out.cause = { name: 'cause', message: truncate(String(err.cause), 500) };
+        }
+        return out;
+    }
+    return { name: 'NonError', message: truncate(String(err), 2000) };
+}
+export function truncate(s, max) {
+    return s.length <= max ? s : s.slice(0, max) + `…[+${s.length - max}]`;
+}
+// Batches events and ships them with plain fetch. Never throws from
+// enqueue(); delivery failures go to onShipFailure (the server logger falls
+// back to stdout, which Cloud Logging captures).
+export class LogShipper {
+    opts;
+    queue = [];
+    timer;
+    inflight = Promise.resolve();
+    batchSize;
+    intervalMs;
+    constructor(opts) {
+        this.opts = opts;
+        this.batchSize = opts.batchSize ?? 50;
+        this.intervalMs = opts.intervalMs ?? 2000;
+    }
+    enqueue(event) {
+        this.queue.push(event);
+        if (this.queue.length >= this.batchSize) {
+            void this.flush();
+        }
+        else if (!this.timer) {
+            this.timer = setTimeout(() => void this.flush(), this.intervalMs);
+            this.timer.unref?.();
+        }
+    }
+    flush() {
+        if (this.timer) {
+            clearTimeout(this.timer);
+            this.timer = undefined;
+        }
+        if (this.queue.length === 0)
+            return this.inflight;
+        const batch = this.queue;
+        this.queue = [];
+        // Chain so batches can't reorder or race; errors never propagate.
+        this.inflight = this.inflight.then(() => this.ship(batch));
+        return this.inflight;
+    }
+    async ship(batch) {
+        const fetchFn = this.opts.fetchFn ?? fetch;
+        try {
+            const res = await fetchFn(this.opts.url, {
+                ...this.opts.fetchInit,
+                method: 'POST',
+                headers: {
+                    authorization: `Bearer ${this.opts.token}`,
+                    'content-type': 'application/json',
+                },
+                body: JSON.stringify(batch),
+            });
+            if (!res.ok) {
+                this.opts.onShipFailure?.(batch, new Error(`ingest returned ${res.status}`));
+            }
+        }
+        catch (err) {
+            this.opts.onShipFailure?.(batch, err);
+        }
+    }
+}
+export function makeEvent(opts, level, message, meta) {
+    let m = meta;
+    if (m && m.error !== undefined && !isPlainSerialized(m.error)) {
+        m = { ...m, error: serializeError(m.error) };
+    }
+    return {
+        _time: new Date().toISOString(),
+        app: opts.app,
+        level,
+        severity: level.toUpperCase(),
+        source: opts.source,
+        message: truncate(message, 10_000),
+        ...opts.context,
+        ...(m ? { meta: m } : {}),
+    };
+}
+function isPlainSerialized(v) {
+    return typeof v === 'object' && v !== null && !(v instanceof Error) && 'message' in v && 'name' in v;
+}

package/dist/log.d.ts

@@ -0,0 +1,20 @@
+import { Logger } from './log-core.js';
+export { LogShipper, serializeError, truncate } from './log-core.js';
+export type { Logger, LogEvent, LogLevel, ShipperOptions } from './log-core.js';
+export interface LoggerOptions {
+    /** App name, e.g. 'auth'. Becomes the `app` field queried in Axiom. */
+    app: string;
+    /** Axiom dataset. Default: env AXIOM_DATASET, else 'apps'. */
+    dataset?: string;
+    /** Ingest token. Default: env AXIOM_INGEST_TOKEN. Absent → stdout only. */
+    token?: string;
+    /** Default: env AXIOM_URL, else https://api.axiom.co */
+    baseUrl?: string;
+    /** Mirror every event to stdout (default true). */
+    stdout?: boolean;
+    context?: Record<string, unknown>;
+    fetchFn?: typeof fetch;
+}
+/** Flush every logger created by createLogger (used at graceful shutdown). */
+export declare function flushAllLoggers(): Promise<void>;
+export declare function createLogger(opts: LoggerOptions): Logger;

package/dist/log.js

@@ -0,0 +1,61 @@
+// Server-side logger. Every event goes to stdout as one JSON line (free
+// Cloud Logging backstop) and — when an ingest token is configured — to
+// Axiom in batches. Without a token (local dev, tests) it is stdout-only.
+//
+// Conventions (new PW OPERATIONS.md): ERROR for anything that could reflect
+// a real problem; log entry points, outbound calls, and DB writes with ids;
+// rich meta is encouraged, but keep meta keys disciplined — every distinct
+// flattened key becomes an Axiom field (dataset cap 1024).
+import { LogShipper, makeEvent, } from './log-core.js';
+export { LogShipper, serializeError, truncate } from './log-core.js';
+const allLoggers = new Set();
+/** Flush every logger created by createLogger (used at graceful shutdown). */
+export async function flushAllLoggers() {
+    await Promise.all([...allLoggers].map((l) => l.flush()));
+}
+export function createLogger(opts) {
+    const token = opts.token ?? process.env.AXIOM_INGEST_TOKEN;
+    const dataset = opts.dataset ?? process.env.AXIOM_DATASET ?? 'apps';
+    const baseUrl = opts.baseUrl ?? process.env.AXIOM_URL ?? 'https://api.axiom.co';
+    const stdout = opts.stdout ?? true;
+    const shipper = token
+        ? new LogShipper({
+            url: `${baseUrl}/v1/datasets/${dataset}/ingest`,
+            token,
+            fetchFn: opts.fetchFn,
+            onShipFailure: (events, error) => {
+                // The stdout mirror already carried these events; record the
+                // delivery failure itself so Axiom gaps are explainable.
+                process.stdout.write(JSON.stringify({
+                    severity: 'WARNING',
+                    message: `axiom ship failed: ${String(error)} (${events.length} events; stdout mirror has them)`,
+                    app: opts.app,
+                    kind: 'log-ship-failure',
+                }) + '\n');
+            },
+        })
+        : undefined;
+    function build(context) {
+        const factory = { app: opts.app, source: 'server', context };
+        const emit = (level, message, meta) => {
+            const event = makeEvent(factory, level, message, meta);
+            if (stdout)
+                process.stdout.write(JSON.stringify(event) + '\n');
+            shipper?.enqueue(event);
+        };
+        const logger = {
+            debug: (m, meta) => emit('debug', m, meta),
+            info: (m, meta) => emit('info', m, meta),
+            warn: (m, meta) => emit('warn', m, meta),
+            error: (m, meta) => emit('error', m, meta),
+            with: (extra) => build({ ...context, ...extra }),
+            flush: () => shipper?.flush() ?? Promise.resolve(),
+        };
+        allLoggers.add(logger);
+        return logger;
+    }
+    const root = build(opts.context);
+    // Best-effort flush when the event loop drains (covers scripts/jobs).
+    process.once('beforeExit', () => void root.flush());
+    return root;
+}

package/dist/rum.d.ts

@@ -0,0 +1,7 @@
+export interface RumOptions {
+    app?: string;
+    dataset?: string;
+    token?: string;
+    baseUrl?: string;
+}
+export declare function initRum(opts?: RumOptions): void;

package/dist/rum.js

@@ -0,0 +1,56 @@
+// Real-user monitoring: Core Web Vitals shipped to the Axiom `rum` dataset
+// (targets: ~/migration/research/performance-targets.md). Configured by the
+// same pw-log-* meta tags as log-browser; token-less pages (local dev)
+// no-op. Metrics finalize on tab-hide, so the shipper flushes there with
+// keepalive fetch.
+//
+// Browser-only module — do not import server-side.
+import { onCLS, onFCP, onINP, onLCP, onTTFB } from 'web-vitals';
+import { LogShipper } from './log-core.js';
+function metaContent(name) {
+    return document.querySelector(`meta[name="${name}"]`)?.content || undefined;
+}
+export function initRum(opts = {}) {
+    const app = opts.app ?? metaContent('pw-log-app') ?? 'unknown';
+    const token = opts.token ?? metaContent('pw-log-token');
+    if (!token)
+        return;
+    const dataset = opts.dataset ?? 'rum';
+    const baseUrl = (opts.baseUrl ?? 'https://api.axiom.co').replace(/\/$/, '');
+    const shipper = new LogShipper({
+        url: `${baseUrl}/v1/datasets/${dataset}/ingest`,
+        token,
+        fetchInit: { keepalive: true },
+        intervalMs: 5000,
+    });
+    const report = (m) => {
+        shipper.enqueue({
+            _time: new Date().toISOString(),
+            app,
+            // LogEvent-shaped enough for the shipper; rum rows are their own schema.
+            level: 'info',
+            severity: 'INFO',
+            source: 'browser',
+            message: m.name,
+            meta: {},
+            metric: m.name,
+            value: m.value,
+            rating: m.rating,
+            delta: m.delta,
+            metric_id: m.id,
+            navigation_type: m.navigationType,
+            path: location.pathname,
+        });
+    };
+    onLCP(report);
+    onINP(report);
+    onCLS(report);
+    onTTFB(report);
+    onFCP(report);
+    const flush = () => void shipper.flush();
+    window.addEventListener('pagehide', flush);
+    document.addEventListener('visibilitychange', () => {
+        if (document.visibilityState === 'hidden')
+            flush();
+    });
+}

package/dist/s2s.d.ts

@@ -0,0 +1,66 @@
+import { OAuth2Client } from 'google-auth-library';
+import type { Logger } from './log-core.js';
+/** The fleet coding agent's service-account email, read from AGENT_SA — set at
+ * deploy time by each service (SECURITY.md: agents have full access, so
+ * grantAllows always admits this identity). Env-driven rather than a baked-in
+ * constant so the published package carries no deployment identifiers. Unset
+ * disables the always-allow rule (fail closed). */
+export declare function codingAgentSa(): string | undefined;
+/** caller service-account email → allowed "METHOD /path" patterns.
+ *  Patterns: exact ("GET /api/whoami"), trailing wildcard ("POST /api/admin/*"),
+ *  or "*" for everything. */
+export type Grants = Record<string, string[]>;
+export interface ServiceCaller {
+    type: 's2s';
+    email: string;
+}
+declare module 'hono' {
+    interface ContextVariableMap {
+        caller: ServiceCaller;
+    }
+}
+export declare function grantAllows(grants: Grants, email: string, method: string, path: string): boolean;
+export declare class RateLimiter {
+    private readonly perMinute;
+    private windows;
+    constructor(perMinute: number);
+    allow(key: string): boolean;
+}
+export interface S2sOptions {
+    /** This service's canonical URL, e.g. https://auth.apps.snewman.net — the
+     *  audience callers must mint tokens for. */
+    audience: string;
+    grants: Grants;
+    logger?: Logger;
+    /** Per-caller request ceiling (default 600/min). */
+    rateLimitPerMin?: number;
+    /** Injectable for tests. */
+    verifyClient?: OAuth2Client;
+}
+export interface ResolvedCaller {
+    caller?: ServiceCaller;
+    /** Response status to return when caller is undefined. */
+    failure?: {
+        status: 401 | 403 | 429;
+        error: string;
+    };
+}
+/** Resolve and authorize an s2s caller from a request's Authorization header.
+ *  Shared by s2sAuth() and auth.ts's requireIdentity(). */
+export declare function resolveS2sCaller(opts: S2sOptions & {
+    limiter: RateLimiter;
+}, headers: {
+    authorization?: string;
+    testCaller?: string;
+}, method: string, path: string): Promise<ResolvedCaller>;
+/** Middleware for endpoints that accept only service callers (no browser
+ *  sessions) — e.g. scheduler pokes, Pub/Sub push, admin APIs. */
+export declare function s2sAuth(opts: S2sOptions): import("hono").MiddlewareHandler<any, string, {}, Response | (Response & import("hono").TypedResponse<{
+    error: string;
+}, 401 | 403 | 429, "json">)>;
+/** fetch() with an OIDC identity token for the target's canonical audience.
+ *  In test mode, sends the synthetic X-Test-S2S-Caller header instead
+ *  (identity from TEST_S2S_IDENTITY, default 'test-service@test'). */
+export declare function serviceFetch(url: string, opts: {
+    audience: string;
+} & RequestInit): Promise<Response>;

package/dist/s2s.js

@@ -0,0 +1,150 @@
+// Service-to-service authentication (design:
+// ~/migration/research/base-services-design.md §5).
+//
+// Mechanism: Google-signed OIDC identity tokens. Callers (Cloud Run services
+// via the metadata server, the coding agent via its service-account
+// credential, Cloud Scheduler / Pub-Sub natively) mint a short-lived ID token
+// with audience = the callee's canonical URL; the callee verifies it against
+// Google's certificates and authorizes the caller's service-account identity
+// against a checked-in per-method grants table. No long-lived credential
+// exists anywhere on this path.
+//
+// The grants table lives in each app's repo (src/grants.ts) and is identical
+// in test and production by construction. The coding agent's SA is always
+// allowed (SECURITY.md: agents have full access).
+import { createMiddleware } from 'hono/factory';
+import { OAuth2Client } from 'google-auth-library';
+import { authMode } from './config.js';
+/** The fleet coding agent's service-account email, read from AGENT_SA — set at
+ * deploy time by each service (SECURITY.md: agents have full access, so
+ * grantAllows always admits this identity). Env-driven rather than a baked-in
+ * constant so the published package carries no deployment identifiers. Unset
+ * disables the always-allow rule (fail closed). */
+export function codingAgentSa() {
+    return process.env.AGENT_SA || undefined;
+}
+export function grantAllows(grants, email, method, path) {
+    const agent = codingAgentSa();
+    if (agent && email === agent)
+        return true;
+    const patterns = grants[email];
+    if (!patterns)
+        return false;
+    const want = `${method.toUpperCase()} ${path}`;
+    return patterns.some((p) => {
+        if (p === '*')
+            return true;
+        if (p.endsWith('/*')) {
+            const prefix = p.slice(0, -1); // keep the trailing slash
+            return want.startsWith(prefix) || want === p.slice(0, -2);
+        }
+        return want === p;
+    });
+}
+// Fixed-window per-identity rate limiter — a sanity check against runaway
+// loops and mischief, not a precision tool (per-instance state only).
+export class RateLimiter {
+    perMinute;
+    windows = new Map();
+    constructor(perMinute) {
+        this.perMinute = perMinute;
+    }
+    allow(key) {
+        const now = Date.now();
+        const w = this.windows.get(key);
+        if (!w || now - w.start >= 60_000) {
+            this.windows.set(key, { start: now, count: 1 });
+            return true;
+        }
+        w.count++;
+        return w.count <= this.perMinute;
+    }
+}
+/** Resolve and authorize an s2s caller from a request's Authorization header.
+ *  Shared by s2sAuth() and auth.ts's requireIdentity(). */
+export async function resolveS2sCaller(opts, headers, method, path) {
+    let email;
+    if (authMode() === 'test') {
+        email = headers.testCaller;
+        if (!email)
+            return { failure: { status: 401, error: 'no s2s credential (test mode: set X-Test-S2S-Caller)' } };
+    }
+    else {
+        const m = headers.authorization?.match(/^Bearer (.+)$/i);
+        if (!m)
+            return { failure: { status: 401, error: 'missing bearer token' } };
+        try {
+            const client = opts.verifyClient ?? defaultVerifyClient();
+            const ticket = await client.verifyIdToken({ idToken: m[1], audience: opts.audience });
+            const payload = ticket.getPayload();
+            if (!payload?.email || payload.email_verified === false) {
+                return { failure: { status: 401, error: 'token has no verified identity' } };
+            }
+            email = payload.email;
+        }
+        catch (err) {
+            opts.logger?.warn('s2s token verification failed', { error: err, path });
+            return { failure: { status: 401, error: 'invalid token' } };
+        }
+    }
+    if (!opts.limiter.allow(email)) {
+        opts.logger?.warn('s2s rate limit exceeded', { caller: email, path });
+        return { failure: { status: 429, error: 'rate limit exceeded' } };
+    }
+    if (!grantAllows(opts.grants, email, method, path)) {
+        // ERROR by policy: a denied identity is either an attack or a missing
+        // grant during development — both deserve attention.
+        opts.logger?.error('s2s call denied by grants', { caller: email, method, path });
+        return { failure: { status: 403, error: `${email} is not granted ${method} ${path}` } };
+    }
+    return { caller: { type: 's2s', email } };
+}
+let sharedVerifyClient;
+function defaultVerifyClient() {
+    sharedVerifyClient ??= new OAuth2Client();
+    return sharedVerifyClient;
+}
+/** Middleware for endpoints that accept only service callers (no browser
+ *  sessions) — e.g. scheduler pokes, Pub/Sub push, admin APIs. */
+export function s2sAuth(opts) {
+    const limiter = new RateLimiter(opts.rateLimitPerMin ?? 600);
+    return createMiddleware(async (c, next) => {
+        const resolved = await resolveS2sCaller({ ...opts, limiter }, {
+            authorization: c.req.header('authorization'),
+            testCaller: c.req.header('x-test-s2s-caller'),
+        }, c.req.method, c.req.path);
+        if (!resolved.caller) {
+            const f = resolved.failure;
+            return c.json({ error: f.error }, f.status);
+        }
+        c.set('caller', resolved.caller);
+        await next();
+    });
+}
+// ---------------------------------------------------------------------------
+// Caller side
+const idTokenClients = new Map();
+/** fetch() with an OIDC identity token for the target's canonical audience.
+ *  In test mode, sends the synthetic X-Test-S2S-Caller header instead
+ *  (identity from TEST_S2S_IDENTITY, default 'test-service@test'). */
+export async function serviceFetch(url, opts) {
+    const { audience, ...init } = opts;
+    const headers = new Headers(init.headers);
+    if (authMode() === 'test') {
+        headers.set('x-test-s2s-caller', process.env.TEST_S2S_IDENTITY ?? 'test-service@test');
+    }
+    else {
+        let clientPromise = idTokenClients.get(audience);
+        if (!clientPromise) {
+            clientPromise = (async () => {
+                const { GoogleAuth } = await import('google-auth-library');
+                return new GoogleAuth().getIdTokenClient(audience);
+            })();
+            idTokenClients.set(audience, clientPromise);
+        }
+        const client = await clientPromise;
+        const token = await client.idTokenProvider.fetchIdToken(audience);
+        headers.set('authorization', `Bearer ${token}`);
+    }
+    return fetch(url, { ...init, headers });
+}

package/dist/test-owners.d.ts

@@ -0,0 +1,25 @@
+export interface TestOwnersOptions {
+    /** Repo root; srcDir and testDir are resolved against it. */
+    root: string;
+    srcDir?: string;
+    testDir?: string;
+}
+export interface TestOwnersReport {
+    /** Modules with no test file at the mirrored path. */
+    missing: {
+        module: string;
+        expectedTest: string;
+    }[];
+    /** Test files with no module at the mirrored path (usually a stale name). */
+    orphans: {
+        test: string;
+        expectedModule: string;
+    }[];
+    /** Modules checked. Zero means the src directory was empty or misspelled. */
+    checked: number;
+}
+export declare function checkTestOwners(opts: TestOwnersOptions): Promise<TestOwnersReport>;
+/** Format a report for the terminal. Empty string when everything passes. */
+export declare function formatTestOwnersReport(report: TestOwnersReport): string;
+/** CLI entry point. Flags: --root, --src, --test. Returns a process exit code. */
+export declare function runTestOwnersCli(argv: string[], write?: (line: string) => void): Promise<number>;

package/dist/test-owners.js

@@ -0,0 +1,106 @@
+// Structural test-coverage gate (PW docs/TESTING.md, "Before calling a build
+// done"): every module under src/ must have a test file at the mirrored path
+// under test/, and every test file must mirror a module.
+//
+// Deliberately no exemption list. A module that genuinely needs no test still
+// gets its test file, containing nothing but a comment saying why. That keeps
+// the check trivially mechanical — does the file exist? — puts the excuse next
+// to the code it excuses, and avoids a separate registry that drifts.
+//
+// Scope is `.ts` only; `.tsx` is out of scope by decision (docs/TESTING.md,
+// "The src -> test mapping"). `.d.ts` files are declarations, not modules.
+import { readdir } from 'node:fs/promises';
+import { join } from 'node:path';
+const MODULE_EXT = '.ts';
+const TEST_EXT = '.test.ts';
+/** Files under `dir` (recursively) ending in `ext`, as paths relative to
+ *  `dir` with forward slashes. A missing directory yields no files. */
+async function listFiles(dir, ext) {
+    let entries;
+    try {
+        entries = await readdir(dir, { recursive: true });
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return [];
+        throw err;
+    }
+    return entries
+        .map((e) => e.split('\\').join('/'))
+        .filter((e) => e.endsWith(ext) && !e.endsWith('.d.ts'))
+        .sort();
+}
+export async function checkTestOwners(opts) {
+    const srcDir = opts.srcDir ?? 'src';
+    const testDir = opts.testDir ?? 'test';
+    const modules = (await listFiles(join(opts.root, srcDir), MODULE_EXT)).filter((m) => !m.endsWith(TEST_EXT));
+    const tests = new Set(await listFiles(join(opts.root, testDir), TEST_EXT));
+    const missing = [];
+    for (const mod of modules) {
+        const expected = `${mod.slice(0, -MODULE_EXT.length)}${TEST_EXT}`;
+        if (!tests.has(expected)) {
+            missing.push({ module: `${srcDir}/${mod}`, expectedTest: `${testDir}/${expected}` });
+        }
+    }
+    const moduleSet = new Set(modules);
+    const orphans = [];
+    for (const test of tests) {
+        const expected = `${test.slice(0, -TEST_EXT.length)}${MODULE_EXT}`;
+        if (!moduleSet.has(expected)) {
+            orphans.push({ test: `${testDir}/${test}`, expectedModule: `${srcDir}/${expected}` });
+        }
+    }
+    return { missing, orphans, checked: modules.length };
+}
+function pad(items) {
+    const width = Math.max(...items.map((i) => i.a.length));
+    return items.map((i) => `  ${i.a.padEnd(width)}  ${i.b}`);
+}
+function count(n, noun) {
+    return `${n} ${noun}${n === 1 ? '' : 's'}`;
+}
+/** Format a report for the terminal. Empty string when everything passes. */
+export function formatTestOwnersReport(report) {
+    const out = [];
+    if (report.missing.length > 0) {
+        out.push(`${count(report.missing.length, 'module')} with no test file:`, ...pad(report.missing.map((m) => ({ a: m.module, b: `-> ${m.expectedTest}` }))), '', 'Every module needs a test file at the mirrored path. A module that', 'genuinely needs no test still gets the file, containing only a comment', 'saying why (PW docs/TESTING.md, "Before calling a build done").');
+    }
+    if (report.orphans.length > 0) {
+        if (out.length > 0)
+            out.push('');
+        out.push(`${count(report.orphans.length, 'test file')} mirroring no module:`, ...pad(report.orphans.map((o) => ({ a: o.test, b: `expected ${o.expectedModule}` }))), '', 'Rename the test to mirror the module it covers, or delete it if the', 'module is gone.');
+    }
+    return out.join('\n');
+}
+/** CLI entry point. Flags: --root, --src, --test. Returns a process exit code. */
+export async function runTestOwnersCli(argv, write = (line) => console.log(line)) {
+    const opts = { root: process.cwd() };
+    for (let i = 0; i < argv.length; i += 2) {
+        const value = argv[i + 1];
+        if (value === undefined) {
+            write(`test-owners: missing value for ${argv[i]}`);
+            return 2;
+        }
+        if (argv[i] === '--root')
+            opts.root = value;
+        else if (argv[i] === '--src')
+            opts.srcDir = value;
+        else if (argv[i] === '--test')
+            opts.testDir = value;
+        else {
+            write(`test-owners: unknown option ${argv[i]} (expected --root, --src, --test)`);
+            return 2;
+        }
+    }
+    const report = await checkTestOwners(opts);
+    if (report.checked === 0) {
+        write(`test-owners: no modules found under ${opts.srcDir ?? 'src'}/ — wrong --src?`);
+        return 2;
+    }
+    if (report.missing.length === 0 && report.orphans.length === 0) {
+        write(`test-owners: ${count(report.checked, 'module')}, all owned`);
+        return 0;
+    }
+    write(`test-owners: FAILED\n\n${formatTestOwnersReport(report)}`);
+    return 1;
+}

package/package.json

@@ -0,0 +1,79 @@
+{
+  "name": "@steve31415/baselib",
+  "version": "1.0.0",
+  "description": "Plasticine new-world shared platform library: logging, auth, service-to-service auth, db, http",
+  "type": "module",
+  "license": "MIT",
+  "repository": "github:plasticine-apps/baselib",
+  "files": [
+    "dist"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./config": {
+      "types": "./dist/config.d.ts",
+      "default": "./dist/config.js"
+    },
+    "./log": {
+      "types": "./dist/log.d.ts",
+      "default": "./dist/log.js"
+    },
+    "./log-browser": {
+      "types": "./dist/log-browser.d.ts",
+      "default": "./dist/log-browser.js"
+    },
+    "./s2s": {
+      "types": "./dist/s2s.d.ts",
+      "default": "./dist/s2s.js"
+    },
+    "./auth": {
+      "types": "./dist/auth.d.ts",
+      "default": "./dist/auth.js"
+    },
+    "./db": {
+      "types": "./dist/db.d.ts",
+      "default": "./dist/db.js"
+    },
+    "./http": {
+      "types": "./dist/http.d.ts",
+      "default": "./dist/http.js"
+    },
+    "./rum": {
+      "types": "./dist/rum.d.ts",
+      "default": "./dist/rum.js"
+    }
+  },
+  "bin": {
+    "check-test-owners": "./dist/bin/check-test-owners.js"
+  },
+  "engines": {
+    "node": "22.x"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "prepack": "npm run build",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "check:test-owners": "tsx src/bin/check-test-owners.ts",
+    "verify": "npm run typecheck && npm run check:test-owners && npm run test && npm run build"
+  },
+  "dependencies": {
+    "@google-cloud/cloud-sql-connector": "^1.8.2",
+    "@hono/node-server": "^1.14.0",
+    "google-auth-library": "^10.5.0",
+    "hono": "^4.7.0",
+    "pg": "^8.14.0",
+    "web-vitals": "^6.1.1"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "@types/pg": "^8.11.0",
+    "happy-dom": "^18.0.0",
+    "tsx": "^4.19.0",
+    "typescript": "^5.7.0",
+    "vitest": "^3.0.0"
+  }
+}