@tangle-network/starter-foundry 0.5.4 → 0.7.0

package/registry/families/hipaa-compliance-pack/files/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "{{packageName}}",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "build": "tsc --noEmit",
+    "validate": "node validate-hipaa-pack.mjs"
+  },
+  "dependencies": {},
+  "devDependencies": {
+    "typescript": "^5.9.0",
+    "@types/node": "^22.0.0"
+  }
+}

package/registry/families/hipaa-compliance-pack/files/src/audit-log.ts

@@ -0,0 +1,54 @@
+// Append-only audit log with PHI-redacted field enumeration. Every PHI
+// read/write emits one row. The row references PHI by (subject_table,
+// subject_id) — the audit entry itself contains NO PHI content.
+
+export type AuditAction = 'read' | 'create' | 'update' | 'delete' | 'export' | 'login' | 'logout'
+
+export interface AuditEntry {
+  id?: string
+  actorUserId: string
+  actorRole: string
+  action: AuditAction
+  subjectTable: string
+  subjectId: string
+  /** List of PHI field names accessed — NEVER the values. */
+  subjectFieldsAccessed: string[]
+  requestId?: string
+  clientIp?: string
+  at: string
+}
+
+export interface AuditStore {
+  append(entry: AuditEntry): Promise<void>
+  /** Required by §164.316(b)(2)(i) — retention ≥6 years. Stores must be append-only at the DB level. */
+  list(filter?: {
+    actorUserId?: string
+    subjectId?: string
+    action?: AuditAction
+    since?: string
+    until?: string
+  }): Promise<AuditEntry[]>
+}
+
+/** In-memory audit store for testing. Production stores must be append-only + retained ≥6 years. */
+export class InMemoryAuditStore implements AuditStore {
+  private entries: AuditEntry[] = []
+
+  async append(entry: AuditEntry): Promise<void> {
+    this.entries.push({ ...entry, id: entry.id ?? crypto.randomUUID() })
+  }
+
+  async list(filter?: Parameters<AuditStore['list']>[0]): Promise<AuditEntry[]> {
+    let out = [...this.entries]
+    if (filter?.actorUserId) out = out.filter((e) => e.actorUserId === filter.actorUserId)
+    if (filter?.subjectId) out = out.filter((e) => e.subjectId === filter.subjectId)
+    if (filter?.action) out = out.filter((e) => e.action === filter.action)
+    if (filter?.since) out = out.filter((e) => e.at >= filter.since!)
+    if (filter?.until) out = out.filter((e) => e.at <= filter.until!)
+    return out
+  }
+
+  size(): number {
+    return this.entries.length
+  }
+}

package/registry/families/hipaa-compliance-pack/files/src/encryption.ts

@@ -0,0 +1,74 @@
+// AES-256-GCM field-level encryption helpers — for PHI at rest in columns
+// like SSN, DOB, MRN, free-text clinical notes. Per-field IV (96-bit)
+// concatenated with the ciphertext so one encrypted value is self-contained.
+// Key management: the application supplies a 256-bit key via KMS / Vault —
+// NEVER from env vars on the filesystem for production workloads.
+
+import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto'
+
+const ALGORITHM = 'aes-256-gcm'
+const IV_LENGTH = 12 // 96-bit IV is the AES-GCM standard.
+const TAG_LENGTH = 16 // 128-bit auth tag.
+const KEY_LENGTH = 32 // 256-bit key.
+
+export class PhiEncryptionError extends Error {
+  constructor(message: string) {
+    super(message)
+    this.name = 'PhiEncryptionError'
+  }
+}
+
+function assertKey(key: Buffer): void {
+  if (key.length !== KEY_LENGTH) {
+    throw new PhiEncryptionError(`PHI encryption key must be ${KEY_LENGTH} bytes; got ${key.length}`)
+  }
+}
+
+/**
+ * Encrypt a plaintext string with AES-256-GCM.
+ * Returns base64url( iv || ciphertext || tag ) — self-contained, safe to
+ * store in a single column.
+ */
+export function encryptPhi(plaintext: string, key: Buffer): string {
+  assertKey(key)
+  const iv = randomBytes(IV_LENGTH)
+  const cipher = createCipheriv(ALGORITHM, key, iv)
+  const ciphertext = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()])
+  const tag = cipher.getAuthTag()
+  return Buffer.concat([iv, ciphertext, tag]).toString('base64url')
+}
+
+/**
+ * Decrypt a ciphertext produced by `encryptPhi`. Throws PhiEncryptionError
+ * on tag mismatch (tampering) or malformed input.
+ */
+export function decryptPhi(encoded: string, key: Buffer): string {
+  assertKey(key)
+  const buf = Buffer.from(encoded, 'base64url')
+  if (buf.length < IV_LENGTH + TAG_LENGTH + 1) {
+    throw new PhiEncryptionError('ciphertext shorter than IV + tag; corrupt or wrong encoding')
+  }
+  const iv = buf.subarray(0, IV_LENGTH)
+  const tag = buf.subarray(buf.length - TAG_LENGTH)
+  const ciphertext = buf.subarray(IV_LENGTH, buf.length - TAG_LENGTH)
+  const decipher = createDecipheriv(ALGORITHM, key, iv)
+  decipher.setAuthTag(tag)
+  try {
+    const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()])
+    return plaintext.toString('utf8')
+  } catch (err) {
+    // GCM auth-tag verify fails → throw a class-level PhiEncryptionError so
+    // callers can distinguish from plaintext-level errors.
+    throw new PhiEncryptionError(
+      `PHI decryption failed (auth-tag mismatch — likely tampered or wrong key): ${(err as Error).message}`,
+    )
+  }
+}
+
+/**
+ * Generate a fresh 256-bit key (for key-generation tooling, NOT for per-request use).
+ * Production code must source the key from KMS / Vault and cache it in-memory.
+ */
+export function generatePhiKey(): Buffer {
+  return randomBytes(KEY_LENGTH)
+}

package/registry/families/hipaa-compliance-pack/files/src/phi-access.ts

@@ -0,0 +1,83 @@
+// withPhiAccess — wraps a PHI-returning handler so an audit row is emitted
+// BEFORE the response goes out. Covers §164.312(b) "record and examine
+// activity in information systems that contain or use electronic protected
+// health information."
+//
+// Shape is framework-agnostic. Adapters live in the consuming service
+// (Express, Fastify, Hono, Next.js route handler, etc.).
+
+import { randomUUID } from 'node:crypto'
+import type { AuditAction, AuditStore } from './audit-log.js'
+
+export interface PhiAccessContext {
+  actorUserId: string
+  actorRole: string
+  action: AuditAction
+  subjectTable: string
+  subjectId: string
+  subjectFieldsAccessed: string[]
+  requestId?: string
+  clientIp?: string
+}
+
+/**
+ * Wrap a handler so the audit row is written BEFORE the PHI payload leaves
+ * the process. If the audit-store write fails, the handler MUST reject the
+ * request — a silently-dropped audit row is a §164.312(b) violation.
+ */
+export function withPhiAccess<T>(
+  store: AuditStore,
+  context: PhiAccessContext,
+  handler: () => Promise<T>,
+): Promise<T> {
+  return (async () => {
+    await store.append({
+      actorUserId: context.actorUserId,
+      actorRole: context.actorRole,
+      action: context.action,
+      subjectTable: context.subjectTable,
+      subjectId: context.subjectId,
+      subjectFieldsAccessed: context.subjectFieldsAccessed,
+      requestId: context.requestId ?? randomUUID(),
+      clientIp: context.clientIp,
+      at: new Date().toISOString(),
+    })
+    return handler()
+  })()
+}
+
+/**
+ * Minimum-necessary role filter. Given a table of records, returns only the
+ * fields the actor's role is permitted to see. Required by §164.502(b).
+ */
+export type MinimumNecessaryPolicy = Record<string, Record<string, string[]>>
+
+export function filterByMinimumNecessary<T extends Record<string, unknown>>(
+  row: T,
+  actorRole: string,
+  subjectTable: string,
+  policy: MinimumNecessaryPolicy,
+): Partial<T> {
+  const allowed = policy[subjectTable]?.[actorRole] ?? []
+  const out: Partial<T> = {}
+  for (const field of allowed) {
+    if (field in row) (out as Record<string, unknown>)[field] = row[field as keyof T]
+  }
+  return out
+}
+
+/** Example baseline policy — extend per-product. */
+export const DEFAULT_PHI_POLICY: MinimumNecessaryPolicy = {
+  patients: {
+    attending_physician: ['id', 'name', 'dob', 'mrn', 'insurance_plan', 'allergies', 'current_medications'],
+    nurse: ['id', 'name', 'dob', 'mrn', 'allergies', 'current_medications'],
+    billing: ['id', 'name', 'dob', 'mrn', 'insurance_plan'],
+    scheduler: ['id', 'name', 'dob', 'mrn'],
+  },
+  encounters: {
+    attending_physician: ['id', 'patient_id', 'date', 'chief_complaint', 'diagnosis_codes', 'notes'],
+    nurse: ['id', 'patient_id', 'date', 'chief_complaint', 'vitals'],
+    billing: ['id', 'patient_id', 'date', 'cpt_codes', 'icd10_codes'],
+    scheduler: ['id', 'patient_id', 'date'],
+  },
+}

package/registry/families/hipaa-compliance-pack/files/tsconfig.json

@@ -0,0 +1,14 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "noEmit": true,
+    "declaration": true,
+    "lib": ["ES2022"]
+  },
+  "include": ["src"]
+}

package/registry/families/hipaa-compliance-pack/files/validate-hipaa-pack.mjs

@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+import { readFileSync, existsSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const here = dirname(fileURLToPath(import.meta.url))
+
+for (const rel of [
+  'src/encryption.ts',
+  'src/phi-access.ts',
+  'src/audit-log.ts',
+  'docs/HIPAA-controls.md',
+  'docs/BAA-template.md',
+  'tsconfig.json',
+]) {
+  if (!existsSync(join(here, rel))) throw new Error(`missing ${rel}`)
+}
+
+const enc = readFileSync(join(here, 'src/encryption.ts'), 'utf8')
+if (!enc.includes('aes-256-gcm')) throw new Error('encryption.ts does not use aes-256-gcm')
+if (!/IV_LENGTH\s*=\s*12/.test(enc)) throw new Error('encryption.ts IV_LENGTH must be 96-bit (12 bytes)')
+
+const phi = readFileSync(join(here, 'src/phi-access.ts'), 'utf8')
+if (!phi.includes('withPhiAccess')) throw new Error('phi-access.ts missing withPhiAccess export')
+if (!phi.includes('filterByMinimumNecessary')) throw new Error('phi-access.ts missing minimum-necessary filter')
+
+const audit = readFileSync(join(here, 'src/audit-log.ts'), 'utf8')
+if (!audit.includes('append-only')) throw new Error('audit-log.ts should document append-only semantics')
+
+const controls = readFileSync(join(here, 'docs/HIPAA-controls.md'), 'utf8')
+if (!/§164\.312/.test(controls)) throw new Error('HIPAA-controls.md missing §164.312 references')
+
+console.log('hipaa-pack ok')

package/registry/families/hipaa-compliance-pack/manifest.json

@@ -0,0 +1,63 @@
+{
+  "id": "hipaa-compliance-pack",
+  "description": "HIPAA compliance overlay — PHI audit trail, field-level AES-256-GCM helpers, role-based minimum-necessary middleware, BAA acknowledgment surface. Composes onto fullstack-ts / api-service / healthcare-hipaa-backend.",
+  "tags": ["compliance", "hipaa", "healthcare", "overlay"],
+  "taxonomy": { "language": "typescript", "runtime": "node", "surface": "api" },
+  "defaults": {
+    "projectType": "compliance-pack",
+    "serviceName": "starter-foundry-hipaa-pack"
+  },
+  "files": [
+    { "source": "files/package.json", "target": "package.json" },
+    { "source": "files/tsconfig.json", "target": "tsconfig.json" },
+    { "source": "files/src/encryption.ts", "target": "src/encryption.ts" },
+    { "source": "files/src/phi-access.ts", "target": "src/phi-access.ts" },
+    { "source": "files/src/audit-log.ts", "target": "src/audit-log.ts" },
+    { "source": "files/docs/HIPAA-controls.md", "target": "docs/HIPAA-controls.md" },
+    { "source": "files/docs/BAA-template.md", "target": "docs/BAA-template.md" },
+    { "source": "files/validate-hipaa-pack.mjs", "target": "validate-hipaa-pack.mjs" }
+  ],
+  "validationChecks": [
+    { "type": "file-exists", "path": "src/encryption.ts" },
+    { "type": "file-exists", "path": "src/phi-access.ts" },
+    { "type": "file-exists", "path": "docs/HIPAA-controls.md" },
+    { "type": "command-success", "command": ["node", "validate-hipaa-pack.mjs"], "expect": "hipaa-pack ok" }
+  ],
+  "contextHints": {
+    "commands": ["pnpm install", "pnpm build"],
+    "entrypoints": ["src/encryption.ts", "src/phi-access.ts", "src/audit-log.ts"],
+    "preview": null,
+    "extensionPoints": ["src/phi-access.ts", "docs/HIPAA-controls.md"]
+  },
+  "keywords": ["hipaa", "hipaa compliance", "phi audit", "baa", "protected health information", "healthcare compliance"],
+  "scoring": { "boost": { "hipaa compliance": 5, "phi audit trail": 4 } },
+  "tieredKeywords": {
+    "tier1": ["hipaa compliance", "hipaa compliant", "phi audit trail", "baa template"],
+    "tier2": ["protected health information", "healthcare compliance backend"]
+  },
+  "buildHints": {
+    "whenToUse": "Bolt HIPAA primitives (audit trail, field encryption, minimum-necessary middleware) onto an existing healthcare backend. Not a standalone application.",
+    "firstSteps": [
+      "Read `docs/HIPAA-controls.md` — each §164.312 control maps to one file in this pack.",
+      "Wire `withPhiAccess` from `src/phi-access.ts` onto every route that reads or writes PHI. The middleware MUST log BEFORE returning.",
+      "Wire `src/encryption.ts` helpers on every column storing SSN, DOB, MRN, or free-text clinical notes. AES-256-GCM with per-field IV.",
+      "Emit the BAA template (`docs/BAA-template.md`) as a signed doc before production data lands. Gate the production API behind a signed-BAA state flag.",
+      "Confirm `audit_logs` table is append-only at the DB level (TRIGGER or permission) — application-only enforcement is insufficient per §164.312(c)(2)."
+    ],
+    "gotchas": [
+      "Do NOT log PHI to stdout, structured JSON logs, or error traces. Every logger must run through a PHI-redaction filter — one slip violates §164.312(b).",
+      "Audit retention is ≥6 years per §164.316(b)(2)(i). Design the storage tier for it — don't plan to TTL old audit rows.",
+      "De-identification per §164.514 is NOT anonymization. Safe Harbor requires 18 specific identifier classes removed; Expert Determination needs a signed statistician's attestation.",
+      "Encryption at rest is 'addressable' not 'required' in §164.312 — but skipping it is almost always an audit failure. Always encrypt.",
+      "Minimum-necessary rule (§164.502(b)) means APIs must filter, not just the UI. A /patients endpoint that returns the full row and lets the caller discard fields is a violation."
+    ],
+    "architectureNotes": [
+      "Pair with `healthcare-hipaa-backend` family for a full starter, or compose onto `fullstack-ts` / `api-service` / `python-api` for incremental adoption.",
+      "Audit table schema: id, actor_user_id, actor_role, action (enum), subject_table, subject_id, subject_fields_accessed[], at (timestamp), request_id, client_ip. Never include the PHI itself in the audit row — reference it by ID only."
+    ],
+    "placeholders": [
+      { "path": "src/phi-access.ts", "description": "Reference middleware. Replace the stubbed route matchers with the product's real routes; keep the audit-before-return order." },
+      { "path": "docs/BAA-template.md", "description": "BAA template. Legal MUST review + customize before use — it is not legal advice." }
+    ]
+  }
+}

package/registry/families/hls-origin/files/docker-compose.yml

@@ -0,0 +1,32 @@
+services:
+  nginx:
+    image: nginx:1.27-alpine
+    restart: unless-stopped
+    ports:
+      - "{{nginxPort}}:80"
+    volumes:
+      - ./nginx.conf:/etc/nginx/nginx.conf:ro
+      - hls-data:/var/www/hls:ro
+    depends_on:
+      - ffmpeg
+
+  ffmpeg:
+    # jrottenberg/ffmpeg ships ffmpeg + ffprobe with libx264/libvpx/AAC. Mount
+    # the shared hls volume so segments written by ffmpeg are immediately
+    # visible to nginx.
+    image: jrottenberg/ffmpeg:7.1-alpine
+    restart: unless-stopped
+    # Keep the container up with a no-op; each stream is launched with
+    # `./start-stream.sh` which docker-exec's into this container.
+    entrypoint: ["tail", "-f", "/dev/null"]
+    volumes:
+      - hls-data:/var/www/hls
+      - ./start-stream.sh:/usr/local/bin/start-stream.sh:ro
+    # If you want an RTMP ingest endpoint, uncomment and pair with an
+    # nginx-rtmp or srtrelay image — ffmpeg itself can't accept RTMP in
+    # listen mode reliably.
+    # ports:
+    #   - "{{rtmpPort}}:{{rtmpPort}}"
+
+volumes:
+  hls-data:

package/registry/families/hls-origin/files/nginx.conf

@@ -0,0 +1,68 @@
+worker_processes auto;
+
+events {
+  worker_connections 1024;
+}
+
+http {
+  include       mime.types;
+  default_type  application/octet-stream;
+  sendfile      on;
+  tcp_nopush    on;
+  tcp_nodelay   on;
+  keepalive_timeout 65;
+
+  # HLS-specific MIME overrides. nginx's default mime.types has these but some
+  # distros ship an old copy; declaring them explicitly is cheap insurance.
+  types {
+    application/vnd.apple.mpegurl  m3u8;
+    video/mp2t                     ts;
+    video/iso.segment              m4s;
+    application/dash+xml           mpd;
+  }
+
+  # Gzip helps for .m3u8 playlists (text). Do NOT gzip .ts segments — ffmpeg
+  # already emits them at the target bitrate, and re-compression just burns CPU.
+  gzip on;
+  gzip_types application/vnd.apple.mpegurl;
+
+  server {
+    listen 80;
+    server_name _;
+
+    # Match any origin so browser HLS.js / Safari native player can pull the
+    # playlist cross-origin. Tighten in production to your known host list.
+    add_header Access-Control-Allow-Origin "*" always;
+    add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always;
+    add_header Access-Control-Allow-Headers "Range" always;
+    add_header Access-Control-Expose-Headers "Content-Length, Content-Range" always;
+
+    # The playlist rewrites every segment; clients poll it ~every
+    # target-duration seconds. Cache-bust it aggressively so players never
+    # see a stale window.
+    location ~ \.m3u8$ {
+      root /var/www;
+      add_header Cache-Control "no-cache, no-store, must-revalidate" always;
+      add_header Access-Control-Allow-Origin "*" always;
+      expires -1;
+    }
+
+    # Segments are immutable once written — safe to cache for the playlist
+    # lifetime. 10s matches the default rolling window size.
+    location ~ \.(ts|m4s)$ {
+      root /var/www;
+      add_header Cache-Control "public, max-age=10" always;
+      add_header Access-Control-Allow-Origin "*" always;
+    }
+
+    location /hls/ {
+      root /var/www;
+      autoindex off;
+    }
+
+    location = /healthz {
+      return 200 "ok\n";
+      add_header Content-Type text/plain;
+    }
+  }
+}

package/registry/families/hls-origin/files/package.json

@@ -0,0 +1,30 @@
+{
+  "name": "{{packageName}}",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "dev": "tsx watch src/server.ts",
+    "start": "node --import tsx src/server.ts",
+    "hls:up": "docker compose up -d",
+    "hls:down": "docker compose down",
+    "hls:logs": "docker compose logs -f",
+    "stream:demo": "./start-stream.sh testsrc demo",
+    "validate": "node validate-hls.mjs"
+  },
+  "dependencies": {
+    "fast-glob": "^3.3.2"
+  },
+  "devDependencies": {
+    "@types/node": "^20.17.0",
+    "tsx": "^4.19.2",
+    "typescript": "^5.9.0"
+  },
+  "overrides": {
+    "vite": "^6.4.2"
+  },
+  "pnpm": {
+    "overrides": {
+      "vite": "^6.4.2"
+    }
+  }
+}

package/registry/families/hls-origin/files/start-stream.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+# Usage:
+#   ./start-stream.sh <input>     <stream-name>
+#   ./start-stream.sh my-file.mp4 lobby
+#   ./start-stream.sh rtmp://ingest.example.com/live/key concert
+#   ./start-stream.sh testsrc     demo           # ffmpeg synthetic test pattern
+#
+# Writes a rolling HLS window to /var/www/hls/<stream-name>/stream.m3u8 inside
+# the ffmpeg container. nginx mounts the same volume and serves it at
+# http://localhost:{{nginxPort}}/hls/<stream-name>/stream.m3u8
+
+set -euo pipefail
+
+if [[ $# -lt 2 ]]; then
+  echo "usage: $0 <input> <stream-name>" >&2
+  exit 2
+fi
+
+INPUT="$1"
+STREAM="$2"
+SEGMENT_SEC="${SEGMENT_SEC:-{{segmentDurationSec}}}"
+PLAYLIST_SIZE="${PLAYLIST_SIZE:-{{playlistSize}}}"
+OUTDIR="/var/www/hls/${STREAM}"
+
+# Build the input side of the command. `testsrc` is a built-in ffmpeg filter
+# — convenient for smoke-testing the pipeline end-to-end without a real feed.
+if [[ "$INPUT" == "testsrc" ]]; then
+  INPUT_ARGS=(-re -f lavfi -i "testsrc=size=1280x720:rate=30" -f lavfi -i "sine=frequency=1000")
+  MAPS=(-map 0:v -map 1:a)
+else
+  INPUT_ARGS=(-re -i "$INPUT")
+  MAPS=()
+fi
+
+# -hls_flags delete_segments+append_list+omit_endlist:
+#   delete_segments   drop old .ts from disk as they roll off the playlist
+#   append_list       keep a stable playlist across reconnects
+#   omit_endlist      never write #EXT-X-ENDLIST — the stream is live, not VOD
+#
+# -hls_time controls segment duration. Shorter = lower glass-to-glass latency,
+# more playlist churn. 2s is a sensible default; drop to 1s for sub-5s
+# interactive latency, raise to 6s for stability over lossy links.
+exec docker compose exec ffmpeg sh -c "
+  mkdir -p '${OUTDIR}' &&
+  ffmpeg -hide_banner -loglevel warning \
+    ${INPUT_ARGS[*]} \
+    ${MAPS[*]} \
+    -c:v libx264 -preset veryfast -tune zerolatency -pix_fmt yuv420p \
+    -g \$((${SEGMENT_SEC}*30)) -keyint_min \$((${SEGMENT_SEC}*30)) -sc_threshold 0 \
+    -b:v 2500k -maxrate 2500k -bufsize 5000k \
+    -c:a aac -b:a 128k -ar 48000 \
+    -f hls \
+    -hls_time ${SEGMENT_SEC} \
+    -hls_list_size ${PLAYLIST_SIZE} \
+    -hls_flags delete_segments+append_list+omit_endlist \
+    -hls_segment_filename '${OUTDIR}/seg_%05d.ts' \
+    '${OUTDIR}/stream.m3u8'
+"

package/registry/families/hls-origin/files/tsconfig.json

@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "noEmit": true,
+    "resolveJsonModule": true,
+    "lib": ["ES2022"],
+    "types": ["node"]
+  },
+  "include": ["src/**/*.ts"]
+}

package/registry/families/hls-origin/files/validate-hls.mjs

@@ -0,0 +1,50 @@
+// Structural validator for hls-origin. Does NOT launch ffmpeg/nginx — just
+// cross-checks that the pipeline wiring is coherent.
+
+import fs from "node:fs/promises";
+
+const [pkgSource, serverSource, composeSource, nginxConf, streamScript] = await Promise.all([
+  fs.readFile("package.json", "utf8"),
+  fs.readFile("src/server.ts", "utf8"),
+  fs.readFile("docker-compose.yml", "utf8"),
+  fs.readFile("nginx.conf", "utf8"),
+  fs.readFile("start-stream.sh", "utf8"),
+]);
+
+const pkg = JSON.parse(pkgSource);
+if (pkg.name !== "{{packageName}}") {
+  throw new Error(`package.json name should be "{{packageName}}", got "${pkg.name}"`);
+}
+
+if (!serverSource.includes('"/health"') && !serverSource.includes("'/health'")) {
+  throw new Error("src/server.ts missing /health route contract");
+}
+if (!serverSource.includes('/streams')) {
+  throw new Error("src/server.ts must expose a /streams listing endpoint");
+}
+
+if (!composeSource.includes("nginx")) {
+  throw new Error("docker-compose.yml must include an nginx service for HLS segment delivery");
+}
+if (!composeSource.includes("ffmpeg")) {
+  throw new Error("docker-compose.yml must include an ffmpeg service for transcoding");
+}
+if (!composeSource.includes("hls-data")) {
+  throw new Error("docker-compose.yml must share an hls-data volume between nginx and ffmpeg");
+}
+
+if (!nginxConf.includes("Access-Control-Allow-Origin")) {
+  throw new Error("nginx.conf must set CORS headers — HLS.js will refuse cross-origin playlists without them");
+}
+if (!nginxConf.includes(".m3u8")) {
+  throw new Error("nginx.conf must have an explicit .m3u8 location block");
+}
+
+if (!streamScript.includes("hls_flags")) {
+  throw new Error("start-stream.sh must pass -hls_flags to ffmpeg");
+}
+if (!streamScript.includes("delete_segments")) {
+  throw new Error("start-stream.sh must use delete_segments or the origin will fill disk");
+}
+
+console.log("hls-origin starter ok");