@ya-accelerators/web-backend-framework 0.0.100 → 0.0.102

package/@types/express.d.ts

@@ -1,7 +1,3 @@
-// Captures the raw request body for handlers that need to verify a signature
-// against the original bytes (e.g. Stripe webhooks) — the parsed `req.body`
-// would not survive signature verification because JSON.stringify is not
-// guaranteed to reproduce the exact byte sequence the sender signed.
 declare global {
   namespace Express {
     interface Request {

package/dist/connector/google-auth/index.js

@@ -1,24 +1,11 @@
 import { runWithRequestHeaders } from '../../context/request/index.js';
 import { awsSecurityCredentialsSupplier, impersonatedClient, parseWifConfig } from '../../internal/federation/index.js';
 import { logger } from '../../logger/index.js';
-// AWS → Google Workload Identity Federation auth primitives. All three federate the running AWS identity
-// into a Google Workload Identity Pool and impersonate the configured service account; they differ only in
-// the token they mint. The framework owns all `google-auth-library` usage — consumers pass their own base64
-// WIF cred config (holds no credential — points at the pool / provider / SA, read from the consumer's own
-// env proxy) and never import `google-auth-library` themselves. `google-auth-library` is dynamically
-// imported so a service that never calls Google does not load it. AWS credentials resolve through the AWS
-// SDK chain via the shared Fargate-safe supplier (`internal/federation`), so federation works on ECS
-// Fargate (task-role creds at the container credential endpoint), which the library's built-in AWS source
-// (env → IMDS only) does not reach; `AWS_REGION` supplies the signature region.
 const ID_TOKEN_TTL_SEC = 3600;
 const REFRESH_SKEW_MS = 5 * 60 * 1000;
-// Access-token auth for calling any Google Cloud API (Vertex AI / Gemini, Storage, …). The consumer hands
-// authClient() to whichever Google SDK it uses (e.g. @google/genai `googleAuthOptions`), or reads bearer()
-// directly. SA impersonation is performed by the AwsClient itself via service_account_impersonation_url.
 export const googleCloudAuth = (wifConfigBase64) => {
     let client;
     let inflight;
-    // Built once per instance and reused — the client owns access-token acquisition, caching, and refresh.
     const authClient = async () => {
         if (client !== undefined) {
             return client;
@@ -26,10 +13,6 @@ export const googleCloudAuth = (wifConfigBase64) => {
         if (inflight === undefined) {
             inflight = (async () => {
                 const { AwsClient } = await import('google-auth-library');
-                // Construct AwsClient directly (not ExternalAccountClient.fromJSON, whose client-type selection
-                // reads only credential_source and ignores aws_security_credentials_supplier, yielding a throwing
-                // IdentityPoolClient). credential_source is cleared because AwsClient rejects both a credential
-                // source and a supplier at once; the built-in IMDS source is dropped in favour of the supplier.
                 return new AwsClient({
                     ...parseWifConfig(wifConfigBase64, 'googleCloudAuth'),
                     credential_source: undefined,
@@ -57,9 +40,6 @@ export const googleCloudAuth = (wifConfigBase64) => {
         },
     };
 };
-// Audience-bound OIDC id_token auth for service-to-service calls (e.g. a fork's service calling the
-// central corporate-service). Mints a Google-signed id_token whose `aud` is the passed audience, which the
-// callee verifies against Google's JWKS. The token is cached and refreshed REFRESH_SKEW_MS before expiry.
 // `forHost` (host[:port]) host-binds the Bearer that `withAuth` forwards: it is attached only to a fetch
 // whose target host matches, so an unrelated outbound fetch inside the closure never receives the credential.
 export const googleIdTokenAuth = (wifConfigBase64, audience, forHost) => {
@@ -77,8 +57,6 @@ export const googleIdTokenAuth = (wifConfigBase64, audience, forHost) => {
                 logger.error('google-auth', { op: 'id-token', error: e });
                 throw e;
             }),
-            // Google id_tokens are valid for ID_TOKEN_TTL_SEC; bearer() refreshes REFRESH_SKEW_MS earlier. The
-            // sub-second offset between the mint await and this stamp is immaterial against the 5-min skew.
             expiresAt: (Math.floor(Date.now() / 1000) + ID_TOKEN_TTL_SEC) * 1000,
         };
     };
@@ -96,17 +74,9 @@ export const googleIdTokenAuth = (wifConfigBase64, audience, forHost) => {
     };
     return {
         bearer,
-        // Run fn with the minted Bearer forwarded on outbound fetch (the in-mesh credential-propagation
-        // allow path, e.g. a consumer's per-env corporate-service dist client reaching corporate-service).
-        // When `forHost` is set the Bearer is bound to that host, so it never rides an unrelated outbound fetch.
         withAuth: async (fn) => runWithRequestHeaders({ authorization: await bearer() }, fn, forHost === undefined ? undefined : { forHost }),
     };
 };
-// Impersonated access-token auth for arbitrary target scopes — what googleCloudAuth's fixed cloud-platform
-// scope does not cover (Cloud Identity / Directory admin / IAM provisioning, e.g. corporate-service's own
-// server-side Google operations). Mints per call (no cache — callers cache the downstream result where it
-// matters) and returns the impersonated SA's email alongside the token for follow-up IAM Credentials calls
-// (e.g. a domain-wide-delegation signJwt). `label` prefixes error messages with the calling module's name.
 export const googleImpersonatedAuth = (wifConfigBase64, { label, lifetime, targetScopes }) => ({
     accessToken: async () => {
         const { impersonated, serviceAccountEmail } = await impersonatedClient({

package/dist/connector/google-auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/connector/google-auth/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AACtE,OAAO,EAAE,8BAA8B,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAA;AACvH,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAE9C,yGAAyG;AACzG,2GAA2G;AAC3G,4GAA4G;AAC5G,0GAA0G;AAC1G,qGAAqG;AACrG,0GAA0G;AAC1G,qGAAqG;AACrG,0GAA0G;AAC1G,gFAAgF;AAEhF,MAAM,gBAAgB,GAAG,IAAI,CAAA;AAC7B,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AAErC,0GAA0G;AAC1G,2GAA2G;AAC3G,yGAAyG;AACzG,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,eAAuB,EAAE,EAAE;IACzD,IAAI,MAA8B,CAAA;IAClC,IAAI,QAAyC,CAAA;IAE7C,uGAAuG;IACvG,MAAM,UAAU,GAAG,KAAK,IAAI,EAAE;QAC5B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,MAAM,CAAA;QACf,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,QAAQ,GAAG,CAAC,KAAK,IAAI,EAAE;gBACrB,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAA;gBACzD,gGAAgG;gBAChG,kGAAkG;gBAClG,gGAAgG;gBAChG,gGAAgG;gBAChG,OAAO,IAAI,SAAS,CAAC;oBACnB,GAAG,cAAc,CAAC,eAAe,EAAE,iBAAiB,CAAC;oBACrD,iBAAiB,EAAE,SAAS;oBAC5B,iCAAiC,EAAE,8BAA8B;oBACjE,MAAM,EAAE,CAAC,gDAAgD,CAAC;iBAC3D,CAAC,CAAA;YACJ,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBAChB,QAAQ,GAAG,SAAS,CAAA;YACtB,CAAC,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,GAAG,MAAM,QAAQ,CAAA;QACvB,OAAO,MAAM,CAAA;IACf,CAAC,CAAA;IAED,OAAO;QACL,UAAU;QACV,MAAM,EAAE,KAAK,IAAI,EAAE;YACjB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,MAAM,UAAU,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;gBACjF,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;gBAC7D,MAAM,CAAC,CAAA;YACT,CAAC,CAAC,CAAA;YACF,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;YAC9D,CAAC;YACD,OAAO,UAAU,KAAK,EAAE,CAAA;QAC1B,CAAC;KACF,CAAA;AACH,CAAC,CAAA;AAED,oGAAoG;AACpG,2GAA2G;AAC3G,0GAA0G;AAC1G,yGAAyG;AACzG,8GAA8G;AAC9G,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,eAAuB,EAAE,QAAgB,EAAE,OAAgB,EAAE,EAAE;IAC/F,IAAI,MAAwD,CAAA;IAC5D,IAAI,QAAmE,CAAA;IACvE,MAAM,YAAY,GAAG,KAAK,IAAI,EAAE;QAC9B,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,kBAAkB,CAAC;YAChD,eAAe;YACf,KAAK,EAAE,mBAAmB;YAC1B,QAAQ,EAAE,gBAAgB;YAC1B,YAAY,EAAE,CAAC,gDAAgD,CAAC;SACjE,CAAC,CAAA;QACF,OAAO;YACL,KAAK,EAAE,MAAM,YAAY,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;gBAC5F,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;gBACzD,MAAM,CAAC,CAAA;YACT,CAAC,CAAC;YACF,mGAAmG;YACnG,gGAAgG;YAChG,SAAS,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,gBAAgB,CAAC,GAAG,IAAI;SACrE,CAAA;IACH,CAAC,CAAA;IACD,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE;QACxB,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,SAAS,GAAG,eAAe,EAAE,CAAC;YAC7E,OAAO,UAAU,MAAM,CAAC,KAAK,EAAE,CAAA;QACjC,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,QAAQ,GAAG,YAAY,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBACrC,QAAQ,GAAG,SAAS,CAAA;YACtB,CAAC,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,GAAG,MAAM,QAAQ,CAAA;QACvB,OAAO,UAAU,MAAM,CAAC,KAAK,EAAE,CAAA;IACjC,CAAC,CAAA;IAED,OAAO;QACL,MAAM;QACN,gGAAgG;QAChG,mGAAmG;QACnG,yGAAyG;QACzG,QAAQ,EAAE,KAAK,EAAK,EAAoB,EAAE,EAAE,CAC1C,qBAAqB,CAAC,EAAE,aAAa,EAAE,MAAM,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;KAChH,CAAA;AACH,CAAC,CAAA;AAED,2GAA2G;AAC3G,0GAA0G;AAC1G,0GAA0G;AAC1G,2GAA2G;AAC3G,2GAA2G;AAC3G,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,eAAuB,EACvB,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAA+D,EAC9F,EAAE,CAAC,CAAC;IACJ,WAAW,EAAE,KAAK,IAAI,EAAE;QACtB,MAAM,EAAE,YAAY,EAAE,mBAAmB,EAAE,GAAG,MAAM,kBAAkB,CAAC;YACrE,eAAe;YACf,KAAK;YACL,QAAQ;YACR,YAAY;SACb,CAAC,CAAA;QACF,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,YAAY,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;YACzE,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;YACpE,MAAM,CAAC,CAAA;QACT,CAAC,CAAC,CAAA;QACF,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,yCAAyC,CAAC,CAAA;QACpE,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAA;IACvC,CAAC;CACF,CAAC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/connector/google-auth/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AACtE,OAAO,EAAE,8BAA8B,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAA;AACvH,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAE9C,MAAM,gBAAgB,GAAG,IAAI,CAAA;AAC7B,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AAErC,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,eAAuB,EAAE,EAAE;IACzD,IAAI,MAA8B,CAAA;IAClC,IAAI,QAAyC,CAAA;IAE7C,MAAM,UAAU,GAAG,KAAK,IAAI,EAAE;QAC5B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,MAAM,CAAA;QACf,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,QAAQ,GAAG,CAAC,KAAK,IAAI,EAAE;gBACrB,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAA;gBACzD,OAAO,IAAI,SAAS,CAAC;oBACnB,GAAG,cAAc,CAAC,eAAe,EAAE,iBAAiB,CAAC;oBACrD,iBAAiB,EAAE,SAAS;oBAC5B,iCAAiC,EAAE,8BAA8B;oBACjE,MAAM,EAAE,CAAC,gDAAgD,CAAC;iBAC3D,CAAC,CAAA;YACJ,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBAChB,QAAQ,GAAG,SAAS,CAAA;YACtB,CAAC,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,GAAG,MAAM,QAAQ,CAAA;QACvB,OAAO,MAAM,CAAA;IACf,CAAC,CAAA;IAED,OAAO;QACL,UAAU;QACV,MAAM,EAAE,KAAK,IAAI,EAAE;YACjB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,MAAM,UAAU,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;gBACjF,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;gBAC7D,MAAM,CAAC,CAAA;YACT,CAAC,CAAC,CAAA;YACF,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;YAC9D,CAAC;YACD,OAAO,UAAU,KAAK,EAAE,CAAA;QAC1B,CAAC;KACF,CAAA;AACH,CAAC,CAAA;AAED,yGAAyG;AACzG,8GAA8G;AAC9G,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,eAAuB,EAAE,QAAgB,EAAE,OAAgB,EAAE,EAAE;IAC/F,IAAI,MAAwD,CAAA;IAC5D,IAAI,QAAmE,CAAA;IACvE,MAAM,YAAY,GAAG,KAAK,IAAI,EAAE;QAC9B,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,kBAAkB,CAAC;YAChD,eAAe;YACf,KAAK,EAAE,mBAAmB;YAC1B,QAAQ,EAAE,gBAAgB;YAC1B,YAAY,EAAE,CAAC,gDAAgD,CAAC;SACjE,CAAC,CAAA;QACF,OAAO;YACL,KAAK,EAAE,MAAM,YAAY,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;gBAC5F,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;gBACzD,MAAM,CAAC,CAAA;YACT,CAAC,CAAC;YACF,SAAS,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,gBAAgB,CAAC,GAAG,IAAI;SACrE,CAAA;IACH,CAAC,CAAA;IACD,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE;QACxB,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,SAAS,GAAG,eAAe,EAAE,CAAC;YAC7E,OAAO,UAAU,MAAM,CAAC,KAAK,EAAE,CAAA;QACjC,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,QAAQ,GAAG,YAAY,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBACrC,QAAQ,GAAG,SAAS,CAAA;YACtB,CAAC,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,GAAG,MAAM,QAAQ,CAAA;QACvB,OAAO,UAAU,MAAM,CAAC,KAAK,EAAE,CAAA;IACjC,CAAC,CAAA;IAED,OAAO;QACL,MAAM;QACN,QAAQ,EAAE,KAAK,EAAK,EAAoB,EAAE,EAAE,CAC1C,qBAAqB,CAAC,EAAE,aAAa,EAAE,MAAM,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;KAChH,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,eAAuB,EACvB,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAA+D,EAC9F,EAAE,CAAC,CAAC;IACJ,WAAW,EAAE,KAAK,IAAI,EAAE;QACtB,MAAM,EAAE,YAAY,EAAE,mBAAmB,EAAE,GAAG,MAAM,kBAAkB,CAAC;YACrE,eAAe;YACf,KAAK;YACL,QAAQ;YACR,YAAY;SACb,CAAC,CAAA;QACF,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,YAAY,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;YACzE,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;YACpE,MAAM,CAAC,CAAA;QACT,CAAC,CAAC,CAAA;QACF,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,yCAAyC,CAAC,CAAA;QACpE,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAA;IACvC,CAAC;CACF,CAAC,CAAA"}

package/dist/constants.d.ts

@@ -1,3 +1,12 @@
 export declare const constants: {
     OAUTH_DEV_REDIRECTOR_URL: string;
+    UPLOADS_PREFIX: string;
+    UPLOADS_EXPIRE_DAYS: number;
+    UPLOAD_FILENAME_MAX_LENGTH: number;
+    UPLOAD_CONTENT_TYPE_MAX_LENGTH: number;
+    UPLOAD_STORED_CONTENT_TYPE: string;
+    PII_ALLOWED_AWS_REGIONS: readonly ['eu-north-1', 'eu-west-1', 'eu-west-3', 'eu-central-1', 'eu-south-1', 'eu-south-2'];
+    SANITIZE_KEYWORDS: readonly ['authorization', 'proxy-authorization', 'cookie', 'set-cookie', 'x-api-key', 'apikey', 'api_key', 'api-key', 'token', 'secret', 'password', 'passwd', 'signature', 'private', 'session', 'jwt', 'bearer', 'email', 'fullname', 'isikukood', 'dateofbirth', 'phone', 'wage', 'screenedname', 'familyname', 'givenname', 'middlename', 'holdername', 'namekana', 'nickname', 'fax', 'workplaceaddress', 'complainantcontact', 'affiliatedorganization', 'nationalid', 'zipcode', 'taxnumber', 'corporateid', 'useragent', 'hostcountry', 'residencycountry', 'jobtitle', 'department', 'authenticationkey'];
+    SANITIZE_EXACT_KEYS: readonly ['ip'];
+    SANITIZE_EXACT_KEYS_EXCEPT_ERRORS: readonly ['name'];
 };

package/dist/constants.js

@@ -1,8 +1,77 @@
 export const constants = {
-    // Shared OAuth dev redirector (see `docker.md § Shared OAuth dev redirector`). In dev, provider OAuth
-    // `redirect_uri` points here because providers reject `http://*.orb.local`; the redirector 302s the browser
-    // back to the app's local return URL carried in `state`. One shared AWS-hosted instance for every product ×
-    // engineer, entity-invariant — a code constant, not env. Only used when DEPLOY_ENV === 'dev'.
     OAUTH_DEV_REDIRECTOR_URL: 'https://jbilvarnjxcewv7spngtoaowia0krqmu.lambda-url.eu-north-1.on.aws/',
+    UPLOADS_PREFIX: '_uploads/',
+    UPLOADS_EXPIRE_DAYS: 1,
+    UPLOAD_FILENAME_MAX_LENGTH: 255,
+    UPLOAD_CONTENT_TYPE_MAX_LENGTH: 255,
+    UPLOAD_STORED_CONTENT_TYPE: 'application/octet-stream',
+    // The AWS regions inside the EU / EEA, which is where every resource processing or storing personal data is
+    // provisioned (infra.md § 9, GDPR Art. 44-49). Removing an entry closes a region every consumer's S3 / SES /
+    // STS clients may bind; an entry outside the EEA takes a documented Art. 46 transfer mechanism, recorded in
+    // the Sub-processors page, before it is added.
+    PII_ALLOWED_AWS_REGIONS: [
+        'eu-north-1',
+        'eu-west-1',
+        'eu-west-3',
+        'eu-central-1',
+        'eu-south-1',
+        'eu-south-2',
+    ],
+    // The keys `Util.sanitize` redacts by substring match. Every entry must stay low-false-positive: a
+    // substring here masks any key containing it, so a generic word would gut incident investigation. Bare
+    // 'name' (a direct identifier, db-schema.md) belongs in SANITIZE_EXACT_KEYS_EXCEPT_ERRORS instead — a
+    // substring entry would mask serviceName / fileName / ….
+    SANITIZE_KEYWORDS: [
+        'authorization',
+        'proxy-authorization',
+        'cookie',
+        'set-cookie',
+        'x-api-key',
+        'apikey',
+        'api_key',
+        'api-key',
+        'token',
+        'secret',
+        'password',
+        'passwd',
+        'signature',
+        'private',
+        'session',
+        'jwt',
+        'bearer',
+        'email',
+        'fullname',
+        'isikukood',
+        'dateofbirth',
+        'phone',
+        'wage',
+        'screenedname',
+        'familyname',
+        'givenname',
+        'middlename',
+        'holdername',
+        'namekana',
+        'nickname',
+        'fax',
+        'workplaceaddress',
+        'complainantcontact',
+        'affiliatedorganization',
+        'nationalid',
+        'zipcode',
+        'taxnumber',
+        'corporateid',
+        'useragent',
+        'hostcountry',
+        'residencycountry',
+        'jobtitle',
+        'department',
+        'authenticationkey',
+    ],
+    // Exact-match-only PII keys. A substring entry would be catastrophic here — 'ip' matches recipient /
+    // description / zip / script — so these are compared whole.
+    SANITIZE_EXACT_KEYS: ['ip'],
+    // Exact-match PII keys that an object produced from an Error is exempt from: its `name` is the error
+    // class, not a person's.
+    SANITIZE_EXACT_KEYS_EXCEPT_ERRORS: ['name'],
 };
 //# sourceMappingURL=constants.js.map

package/dist/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,sGAAsG;IACtG,4GAA4G;IAC5G,4GAA4G;IAC5G,8FAA8F;IAC9F,wBAAwB,EAAE,wEAAwE;CACnG,CAAA"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,wBAAwB,EAAE,wEAAwE;IAClG,cAAc,EAAE,WAAW;IAC3B,mBAAmB,EAAE,CAAC;IACtB,0BAA0B,EAAE,GAAG;IAC/B,8BAA8B,EAAE,GAAG;IACnC,0BAA0B,EAAE,0BAA0B;IAEtD,4GAA4G;IAC5G,6GAA6G;IAC7G,4GAA4G;IAC5G,+CAA+C;IAC/C,uBAAuB,EAAE;QACvB,YAAY;QACZ,WAAW;QACX,WAAW;QACX,cAAc;QACd,YAAY;QACZ,YAAY;KACJ;IAEV,mGAAmG;IACnG,uGAAuG;IACvG,sGAAsG;IACtG,yDAAyD;IACzD,iBAAiB,EAAE;QACjB,eAAe;QACf,qBAAqB;QACrB,QAAQ;QACR,YAAY;QACZ,WAAW;QACX,QAAQ;QACR,SAAS;QACT,SAAS;QACT,OAAO;QACP,QAAQ;QACR,UAAU;QACV,QAAQ;QACR,WAAW;QACX,SAAS;QACT,SAAS;QACT,KAAK;QACL,QAAQ;QACR,OAAO;QACP,UAAU;QACV,WAAW;QACX,aAAa;QACb,OAAO;QACP,MAAM;QACN,cAAc;QACd,YAAY;QACZ,WAAW;QACX,YAAY;QACZ,YAAY;QACZ,UAAU;QACV,UAAU;QACV,KAAK;QACL,kBAAkB;QAClB,oBAAoB;QACpB,wBAAwB;QACxB,YAAY;QACZ,SAAS;QACT,WAAW;QACX,aAAa;QACb,WAAW;QACX,aAAa;QACb,kBAAkB;QAClB,UAAU;QACV,YAAY;QACZ,mBAAmB;KACX;IAEV,qGAAqG;IACrG,4DAA4D;IAC5D,mBAAmB,EAAE,CAAC,IAAI,CAAU;IAEpC,qGAAqG;IACrG,yBAAyB;IACzB,iCAAiC,EAAE,CAAC,MAAM,CAAU;CACrD,CAAA"}

package/dist/context/audit/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/context/audit/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAsB/C,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,iBAAiB,EAAgB,CAAA;AAExE,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,EAAE,CAAC,mBAAmB,CAAC,QAAQ,EAAE,CAAA;AAE1E,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAI,IAA+C,EAAE,EAAoB,EAAE,EAAE;IAC5G,MAAM,MAAM,GAAG,mBAAmB,CAAC,QAAQ,EAAE,CAAA;IAC7C,OAAO,mBAAmB,CAAC,GAAG,CAC5B;QACE,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,MAAM,EAAE,QAAQ,IAAI,KAAK;KACpC,EACD,EAAE,CACH,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAI,IAAyB,EAAE,EAAoB,EAAE,EAAE,CACtF,mBAAmB,CAAC,GAAG,CACrB;IACE,MAAM,EAAE,IAAI,CAAC,MAAM;IACnB,QAAQ,EAAE,IAAI;CACf,EACD,EAAE,CACH,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/context/audit/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAY/C,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,iBAAiB,EAAgB,CAAA;AAExE,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,EAAE,CAAC,mBAAmB,CAAC,QAAQ,EAAE,CAAA;AAE1E,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAI,IAA+C,EAAE,EAAoB,EAAE,EAAE;IAC5G,MAAM,MAAM,GAAG,mBAAmB,CAAC,QAAQ,EAAE,CAAA;IAC7C,OAAO,mBAAmB,CAAC,GAAG,CAC5B;QACE,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,MAAM,EAAE,QAAQ,IAAI,KAAK;KACpC,EACD,EAAE,CACH,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAI,IAAyB,EAAE,EAAoB,EAAE,EAAE,CACtF,mBAAmB,CAAC,GAAG,CACrB;IACE,MAAM,EAAE,IAAI,CAAC,MAAM;IACnB,QAAQ,EAAE,IAAI;CACf,EACD,EAAE,CACH,CAAA"}

package/dist/context/request/index.js

@@ -1,19 +1,4 @@
 import { AsyncLocalStorage } from 'async_hooks';
-// Request-scoped context shared across middleware boundaries (request id, header
-// forwarding, current request path for log records). Lives in its own module so the
-// logger can read it without depending on `server/express` (which already depends on the
-// logger). The path is overridden by the tRPC procedure middleware so log records
-// emitted inside a procedure carry the procedure path rather than the bare `/trpc`
-// from Express.
-//
-// `headers` are the auto-captured inbound request headers; only tracing headers are
-// auto-forwarded to outbound `fetch` (see `server/express` § AUTO_FORWARD_ALLOW_LIST) —
-// everything else (credentials, client-context quasi-identifiers, content negotiation) is
-// withheld by default. `forwardHeaderScopes` are headers set explicitly via
-// `runWithRequestHeaders` — an intentional, audited in-mesh propagation path. Each scope may
-// be host-bound (`forHost`) so a forwarded credential is only ever attached to a request whose
-// target host matches, and `nonForwardableHeaders` is the per-app additional deny-set carried
-// from `createApp` so the module-global patched `fetch` reads the right app's config.
 export const requestContextStorage = new AsyncLocalStorage();
 export const getCurrentRequestPath = () => requestContextStorage.getStore()?.path;
 // Attach `headers` to every outbound `fetch` within `fn`. Pass `forHost` to bind them to a single

package/dist/context/request/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/context/request/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAE/C,iFAAiF;AACjF,oFAAoF;AACpF,yFAAyF;AACzF,kFAAkF;AAClF,mFAAmF;AACnF,gBAAgB;AAChB,EAAE;AACF,oFAAoF;AACpF,wFAAwF;AACxF,0FAA0F;AAC1F,4EAA4E;AAC5E,6FAA6F;AAC7F,+FAA+F;AAC/F,8FAA8F;AAC9F,sFAAsF;AACtF,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,iBAAiB,EAKtD,CAAA;AAEJ,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,EAAE,CAAC,qBAAqB,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAA;AAEjF,kGAAkG;AAClG,uGAAuG;AACvG,oGAAoG;AACpG,wCAAwC;AACxC,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,OAA+B,EAC/B,EAAoB,EACpB,OAA8B,EAC9B,EAAE;IACF,MAAM,OAAO,GAAG,qBAAqB,CAAC,QAAQ,EAAE,CAAA;IAChD,MAAM,KAAK,GAAG,OAAO,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAA;IAChH,OAAO,qBAAqB,CAAC,GAAG,CAC9B;QACE,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE;QAC/B,mBAAmB,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,mBAAmB,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC;QACrE,GAAG,CAAC,OAAO,EAAE,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,EAAE,CAAC;QACjH,GAAG,CAAC,OAAO,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;KAC/D,EACD,EAAE,CACH,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAI,IAAY,EAAE,EAAwB,EAAE,EAAE;IAC9E,MAAM,OAAO,GAAG,qBAAqB,CAAC,QAAQ,EAAE,CAAA;IAChD,OAAO,qBAAqB,CAAC,GAAG,CAC9B;QACE,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE;QAC/B,GAAG,CAAC,OAAO,EAAE,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,EAAE,CAAC;QAC3G,GAAG,CAAC,OAAO,EAAE,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,EAAE,CAAC;QACjH,IAAI;KACL,EACD,EAAE,CACH,CAAA;AACH,CAAC,CAAA;AAED,uGAAuG;AACvG,yGAAyG;AACzG,2GAA2G;AAC3G,wGAAwG;AACxG,qCAAqC;AACrC,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAA;AAE3E,2FAA2F;AAC3F,kGAAkG;AAClG,+FAA+F;AAC/F,uGAAuG;AACvG,sGAAsG;AACtG,yGAAyG;AACzG,0GAA0G;AAC1G,uFAAuF;AACvF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,KAIC,EACD,OAA4G,EAC5G,EAAE;IACF,qGAAqG;IACrG,oGAAoG;IACpG,6BAA6B;IAC7B,MAAM,aAAa,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,YAAY,IAAI,SAAS,CAAC,CAAA;IACpE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QACpE,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC/B,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,aAAa,CAAC,CAAA;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAA;QAC/B,IAAI,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,qBAAqB,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClG,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACzB,CAAC;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,mBAAmB,IAAI,EAAE,EAAE,CAAC;QACpD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,gBAAgB,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;YAClH,SAAQ;QACV,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACzD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/context/request/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAE/C,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,iBAAiB,EAKtD,CAAA;AAEJ,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,EAAE,CAAC,qBAAqB,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAA;AAEjF,kGAAkG;AAClG,uGAAuG;AACvG,oGAAoG;AACpG,wCAAwC;AACxC,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,OAA+B,EAC/B,EAAoB,EACpB,OAA8B,EAC9B,EAAE;IACF,MAAM,OAAO,GAAG,qBAAqB,CAAC,QAAQ,EAAE,CAAA;IAChD,MAAM,KAAK,GAAG,OAAO,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAA;IAChH,OAAO,qBAAqB,CAAC,GAAG,CAC9B;QACE,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE;QAC/B,mBAAmB,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,mBAAmB,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC;QACrE,GAAG,CAAC,OAAO,EAAE,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,EAAE,CAAC;QACjH,GAAG,CAAC,OAAO,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;KAC/D,EACD,EAAE,CACH,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAI,IAAY,EAAE,EAAwB,EAAE,EAAE;IAC9E,MAAM,OAAO,GAAG,qBAAqB,CAAC,QAAQ,EAAE,CAAA;IAChD,OAAO,qBAAqB,CAAC,GAAG,CAC9B;QACE,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE;QAC/B,GAAG,CAAC,OAAO,EAAE,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,EAAE,CAAC;QAC3G,GAAG,CAAC,OAAO,EAAE,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,EAAE,CAAC;QACjH,IAAI;KACL,EACD,EAAE,CACH,CAAA;AACH,CAAC,CAAA;AAED,uGAAuG;AACvG,yGAAyG;AACzG,2GAA2G;AAC3G,wGAAwG;AACxG,qCAAqC;AACrC,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAA;AAE3E,2FAA2F;AAC3F,kGAAkG;AAClG,+FAA+F;AAC/F,uGAAuG;AACvG,sGAAsG;AACtG,yGAAyG;AACzG,0GAA0G;AAC1G,uFAAuF;AACvF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,KAIC,EACD,OAA4G,EAC5G,EAAE;IACF,qGAAqG;IACrG,oGAAoG;IACpG,6BAA6B;IAC7B,MAAM,aAAa,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,YAAY,IAAI,SAAS,CAAC,CAAA;IACpE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QACpE,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC/B,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,aAAa,CAAC,CAAA;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAA;QAC/B,IAAI,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,qBAAqB,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClG,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACzB,CAAC;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,mBAAmB,IAAI,EAAE,EAAE,CAAC;QACpD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,gBAAgB,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;YAClH,SAAQ;QACV,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACzD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}

package/dist/coordination/lock/index.d.ts

@@ -7,14 +7,6 @@ export declare const lock: {
         key: string;
         token: string;
     }) => Promise<void>;
-    /**
-     * Run `fn` while holding the lock. Returns `{ acquired: false }` without
-     * invoking `fn` if the lock could not be acquired. Always releases the lock,
-     * even when `fn` throws.
-     *
-     * The discriminated return lets callers tell "lock not acquired" from "fn
-     * ran and returned undefined" — a plain `T | undefined` would collide.
-     */
     withLock: <T>({ key, ttlSec }: {
         key: string;
         ttlSec: number;

package/dist/coordination/lock/index.js

@@ -1,24 +1,6 @@
 import { Script } from '@valkey/valkey-glide';
 import { redis } from '../../repository/redis/index.js';
 import { Util } from '../../util/index.js';
-/**
- * Distributed mutex built on Redis SET NX + check-and-delete.
- *
- * Use to serialize work that must not run concurrently across processes —
- * payout execution, batch jobs, anything where two concurrent runs would
- * double-spend or corrupt state.
- *
- * `acquire` returns a unique token on success (null when the lock is held).
- * `release` only deletes the key when the stored token still matches, so a
- * TTL-expired-then-reacquired lock is never deleted by the original holder.
- *
- * Redis errors propagate as throws — callers decide whether to fail-closed
- * via `.catch(() => null)` (acquire) or surface the failure.
- *
- * Note: even with the token check, a critical section that overruns `ttlSec`
- * no longer holds the lock; another worker can enter while `fn` is still
- * running. Pick `ttlSec` larger than the worst-case body duration.
- */
 const RELEASE_SCRIPT = new Script(`
 if redis.call("GET", KEYS[1]) == ARGV[1] then
   return redis.call("DEL", KEYS[1])
@@ -35,14 +17,6 @@ export const lock = {
     release: async ({ key, token }) => {
         await redis.invokeScript(RELEASE_SCRIPT, { keys: [key], args: [token] });
     },
-    /**
-     * Run `fn` while holding the lock. Returns `{ acquired: false }` without
-     * invoking `fn` if the lock could not be acquired. Always releases the lock,
-     * even when `fn` throws.
-     *
-     * The discriminated return lets callers tell "lock not acquired" from "fn
-     * ran and returned undefined" — a plain `T | undefined` would collide.
-     */
     withLock: async ({ key, ttlSec }, fn) => {
         const token = await lock.acquire({ key, ttlSec });
         if (token === null) {
@@ -52,9 +26,6 @@ export const lock = {
             return { acquired: true, value: await fn() };
         }
         finally {
-            // Swallow release failures so a Redis blip in cleanup doesn't mask
-            // `fn`'s original exception. The framework-level redis.invokeScript
-            // already logs the failure, and the lock TTL guarantees recovery.
             await lock.release({ key, token }).catch(() => undefined);
         }
     },

package/dist/coordination/lock/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/coordination/lock/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAE7C,OAAO,EAAE,KAAK,EAAE,MAAM,iCAAiC,CAAA;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAA;AAE1C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,cAAc,GAAG,IAAI,MAAM,CAAC;;;;;;CAMjC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,EAAmC,EAAE,EAAE;QAClE,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,CAAA;QAC/B,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;QAChD,OAAO,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IAClC,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,KAAK,EAAkC,EAAE,EAAE;QAChE,MAAM,KAAK,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAC1E,CAAC;IACD;;;;;;;OAOG;IACH,QAAQ,EAAE,KAAK,EAAK,EAAE,GAAG,EAAE,MAAM,EAAmC,EAAE,EAAoB,EAAE,EAAE;QAC5F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAA;QACjD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;QAC5B,CAAC;QACD,IAAI,CAAC;YACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;QAC9C,CAAC;gBAAS,CAAC;YACT,mEAAmE;YACnE,oEAAoE;YACpE,kEAAkE;YAClE,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QAC3D,CAAC;IACH,CAAC;CACF,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/coordination/lock/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAE7C,OAAO,EAAE,KAAK,EAAE,MAAM,iCAAiC,CAAA;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAA;AAE1C,MAAM,cAAc,GAAG,IAAI,MAAM,CAAC;;;;;;CAMjC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,EAAmC,EAAE,EAAE;QAClE,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,CAAA;QAC/B,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;QAChD,OAAO,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IAClC,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,KAAK,EAAkC,EAAE,EAAE;QAChE,MAAM,KAAK,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAC1E,CAAC;IACD,QAAQ,EAAE,KAAK,EAAK,EAAE,GAAG,EAAE,MAAM,EAAmC,EAAE,EAAoB,EAAE,EAAE;QAC5F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAA;QACjD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;QAC5B,CAAC;QACD,IAAI,CAAC;YACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;QAC9C,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QAC3D,CAAC;IACH,CAAC;CACF,CAAA"}

package/dist/coordination/rate-limit/index.d.ts

@@ -1,9 +1,4 @@
 export declare const rateLimit: {
-    /**
-     * Increment the counter for `key` and decide whether the current attempt is
-     * allowed. Returns the post-increment count and how many attempts remain in
-     * the current window.
-     */
     attempt: ({ key, max, windowSec }: {
         key: string;
         max: number;

package/dist/coordination/rate-limit/index.js

@@ -1,35 +1,12 @@
 import { Script } from '@valkey/valkey-glide';
 import { redis } from '../../repository/redis/index.js';
-/**
- * Fixed-window rate limiter built on a single atomic Lua script
- * (INCR + EXPIRE on the first hit of a window).
- *
- * Use to cap the number of attempts against a key inside a rolling window —
- * unauthenticated endpoints (password reset, signup, OTP request, etc.) that
- * would otherwise be abusable by brute-force or spam.
- *
- * The INCR and EXPIRE run inside a Lua script, so the key is guaranteed to
- * have a TTL whenever its value > 0 — an interrupt between the two ops is
- * impossible.
- *
- * Redis errors propagate as throws — callers decide whether to fail-closed
- * via `.catch(...)` or surface the failure.
- */
 const ATTEMPT_SCRIPT = new Script(`
 local n = redis.call("INCR", KEYS[1])
 if n == 1 then redis.call("EXPIRE", KEYS[1], ARGV[1]) end
 return n
 `);
 export const rateLimit = {
-    /**
-     * Increment the counter for `key` and decide whether the current attempt is
-     * allowed. Returns the post-increment count and how many attempts remain in
-     * the current window.
-     */
     attempt: async ({ key, max, windowSec }) => {
-        // A non-integer windowSec makes the Lua EXPIRE fail after the INCR (no rollback) — the key persists
-        // with no TTL, permanently denying the caller; windowSec: 0 makes EXPIRE delete the key, permanently
-        // allowing it. Reject both before running the script.
         if (!Number.isInteger(windowSec) || windowSec <= 0) {
             throw new Error(`rateLimit: windowSec must be a positive integer (got ${windowSec})`);
         }

package/dist/coordination/rate-limit/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/coordination/rate-limit/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAE7C,OAAO,EAAE,KAAK,EAAE,MAAM,iCAAiC,CAAA;AAEvD;;;;;;;;;;;;;;GAcG;AACH,MAAM,cAAc,GAAG,IAAI,MAAM,CAAC;;;;CAIjC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB;;;;OAIG;IACH,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAmD,EAAE,EAAE;QAC1F,oGAAoG;QACpG,qGAAqG;QACrG,sDAAsD;QACtD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,wDAAwD,SAAS,GAAG,CAAC,CAAA;QACvF,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QAC1G,OAAO;YACL,OAAO,EAAE,KAAK,IAAI,GAAG;YACrB,KAAK;YACL,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,KAAK,CAAC;SACpC,CAAA;IACH,CAAC;CACF,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/coordination/rate-limit/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAE7C,OAAO,EAAE,KAAK,EAAE,MAAM,iCAAiC,CAAA;AAEvD,MAAM,cAAc,GAAG,IAAI,MAAM,CAAC;;;;CAIjC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAmD,EAAE,EAAE;QAC1F,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,wDAAwD,SAAS,GAAG,CAAC,CAAA;QACvF,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QAC1G,OAAO;YACL,OAAO,EAAE,KAAK,IAAI,GAAG;YACrB,KAAK;YACL,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,KAAK,CAAC;SACpC,CAAA;IACH,CAAC;CACF,CAAA"}

package/dist/coordination/throttle/index.d.ts

@@ -1,16 +1,3 @@
-/**
- * At-most-once-per-window throttle built on Redis SET NX.
- *
- * Use when an action should run at most once per `windowSec` — sanctions
- * evaluation that should not re-fire on every call-log ingest, single-use
- * token claims that must succeed exactly once across concurrent attempts.
- *
- * Unlike `lock`, there is no explicit release: the slot opens again only
- * when the TTL expires.
- *
- * Redis errors propagate as throws — callers decide whether to fail-closed
- * via `.catch(() => false)` or surface the failure.
- */
 export declare const throttle: {
     tryAcquire: ({ key, windowSec }: {
         key: string;

package/dist/coordination/throttle/index.js

@@ -1,17 +1,4 @@
 import { redis } from '../../repository/redis/index.js';
-/**
- * At-most-once-per-window throttle built on Redis SET NX.
- *
- * Use when an action should run at most once per `windowSec` — sanctions
- * evaluation that should not re-fire on every call-log ingest, single-use
- * token claims that must succeed exactly once across concurrent attempts.
- *
- * Unlike `lock`, there is no explicit release: the slot opens again only
- * when the TTL expires.
- *
- * Redis errors propagate as throws — callers decide whether to fail-closed
- * via `.catch(() => false)` or surface the failure.
- */
 export const throttle = {
     tryAcquire: async ({ key, windowSec }) => {
         const ok = await redis.setNx(key, '1', windowSec);

package/dist/coordination/throttle/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/coordination/throttle/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iCAAiC,CAAA;AAEvD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,UAAU,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,SAAS,EAAsC,EAAE,EAAE;QAC3E,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,CAAA;QACjD,OAAO,EAAE,IAAI,IAAI,CAAA;IACnB,CAAC;CACF,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/coordination/throttle/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,iCAAiC,CAAA;AAEvD,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,UAAU,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,SAAS,EAAsC,EAAE,EAAE;QAC3E,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,CAAA;QACjD,OAAO,EAAE,IAAI,IAAI,CAAA;IACnB,CAAC;CACF,CAAA"}

package/dist/env.d.ts

@@ -1,5 +1,5 @@
 export declare const defaultEnv: {
-    AWS_REGION: string;
+    AWS_REGION: "eu-central-1" | "eu-north-1" | "eu-south-1" | "eu-south-2" | "eu-west-1" | "eu-west-3";
     NODE_ENV: "development" | "production";
     DEPLOY_ENV: "dev" | "prd" | "stg";
     LOG_LEVEL?: "debug" | "error" | "info" | "warn" | undefined;

package/dist/env.js

@@ -1,31 +1,25 @@
 import { z } from 'zod';
+import { constants } from './constants.js';
 import { Util } from './util/index.js';
 export const defaultEnv = Util.createEnvProxy(z.object({
-    // ---- AWS
-    AWS_REGION: z.string().min(1),
-    // ---- Common
+    AWS_REGION: z.enum(constants.PII_ALLOWED_AWS_REGIONS),
     NODE_ENV: z.enum(['development', 'production']),
     DEPLOY_ENV: z.enum(['dev', 'stg', 'prd']),
-    LOG_LEVEL: z.enum(['debug', 'info', 'warn', 'error']).optional(), // When unset, the threshold defaults to debug on local dev and info on stg/prd (see logger).
-    // ---- Infra
+    LOG_LEVEL: z.enum(['debug', 'info', 'warn', 'error']).optional(),
     DATABASE_HOST: z.string().min(1),
     DATABASE_PORT: z.string().min(1).transform(Number),
     DATABASE_RO_HOST: z.string().min(1),
     DATABASE_RO_PORT: z.string().min(1).transform(Number),
     DATABASE_USER: z.string().min(1),
     DATABASE_PASSWORD: z.string().min(1),
-    DATABASE_NAME: z.string().min(1).optional(), // When unset, the database name is derived from the SERVICE env var (see repository/prisma/index.ts).
+    DATABASE_NAME: z.string().min(1).optional(),
     REDIS_CLUSTER: z.string().transform((val) => val === 'true'),
     REDIS_HOST: z.string().min(1),
     REDIS_PORT: z.string().min(1).transform(Number),
-    LOCAL_S3_ENDPOINT: z.url().optional(), // s3 (object storage) — LOCAL_S3_ENDPOINT points the client at MinIO on dev; both fall back to the AWS resolution chain.
+    LOCAL_S3_ENDPOINT: z.url().optional(),
     STORAGE_BUCKET: z.string().min(1),
-    // ---- Package
     SERVICE: z.string().min(1),
     PORT: z.string().min(1).transform(Number),
-    // Comma-separated list of allowed origins (a single origin stays a one-element list). Each entry is
-    // trimmed and URL-validated, so a malformed / empty entry fails at startup instead of silently
-    // widening or narrowing the allow-list.
     CORS_ORIGIN: z
         .string()
         .min(1)
@@ -33,13 +27,10 @@ export const defaultEnv = Util.createEnvProxy(z.object({
         .pipe(z.array(z.url()).min(1)),
     BASE_URL: z.url(),
 }), () => ({
-    // ---- AWS
     AWS_REGION: process.env.AWS_REGION,
-    // ---- Common
     NODE_ENV: process.env.NODE_ENV,
     DEPLOY_ENV: process.env.DEPLOY_ENV,
     LOG_LEVEL: process.env.LOG_LEVEL,
-    // ---- Infra
     DATABASE_HOST: process.env.DATABASE_HOST,
     DATABASE_PORT: process.env.DATABASE_PORT,
     DATABASE_RO_HOST: process.env.DATABASE_RO_HOST,
@@ -52,7 +43,6 @@ export const defaultEnv = Util.createEnvProxy(z.object({
     REDIS_PORT: process.env.REDIS_PORT,
     LOCAL_S3_ENDPOINT: process.env.LOCAL_S3_ENDPOINT,
     STORAGE_BUCKET: process.env.STORAGE_BUCKET,
-    // ---- Package
     SERVICE: process.env.SERVICE,
     PORT: process.env.PORT,
     CORS_ORIGIN: process.env.CORS_ORIGIN,

package/dist/env.js.map

@@ -1 +1 @@
-{"version":3,"file":"env.js","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AAEtC,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAC3C,CAAC,CAAC,MAAM,CAAC;IACP,WAAW;IACX,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,cAAc;IACd,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAC/C,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACzC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,6FAA6F;IAC/J,aAAa;IACb,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC;IAClD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC;IACrD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,sGAAsG;IACnJ,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,MAAM,CAAC;IAC5D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC;IAC/C,iBAAiB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,yHAAyH;IAChK,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,eAAe;IACf,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC;IACzC,oGAAoG;IACpG,+FAA+F;IAC/F,wCAAwC;IACxC,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;SACrE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChC,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;CAClB,CAAC,EACF,GAAG,EAAE,CAAC,CAAC;IACL,WAAW;IACX,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;IAClC,cAAc;IACd,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ;IAC9B,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;IAClC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS;IAChC,aAAa;IACb,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa;IACxC,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa;IACxC,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;IAC9C,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;IAC9C,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa;IACxC,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;IAChD,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa;IACxC,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa;IACxC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;IAClC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;IAClC,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;IAChD,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc;IAC1C,eAAe;IACf,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;IAC5B,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI;IACtB,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW;IACpC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ;CAC/B,CAAC,CACH,CAAA"}
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AAEtC,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAC3C,CAAC,CAAC,MAAM,CAAC;IACP,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC;IACrD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAC/C,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACzC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC;IAClD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC;IACrD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,MAAM,CAAC;IAC5D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC;IAC/C,iBAAiB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACrC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC;IACzC,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;SACrE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChC,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;CAClB,CAAC,EACF,GAAG,EAAE,CAAC,CAAC;IACL,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;IAClC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ;IAC9B,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;IAClC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS;IAChC,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa;IACxC,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa;IACxC,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;IAC9C,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;IAC9C,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa;IACxC,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;IAChD,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa;IACxC,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa;IACxC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;IAClC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;IAClC,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;IAChD,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc;IAC1C,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;IAC5B,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI;IACtB,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW;IACpC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ;CAC/B,CAAC,CACH,CAAA"}

package/dist/internal/federation/index.d.ts

@@ -1,6 +1,6 @@
 import type { AwsClientOptions } from 'google-auth-library';
 export declare const awsSecurityCredentialsSupplier: {
-    getAwsRegion: () => Promise<string>;
+    getAwsRegion: () => Promise<"eu-central-1" | "eu-north-1" | "eu-south-1" | "eu-south-2" | "eu-west-1" | "eu-west-3">;
     getAwsSecurityCredentials: () => Promise<{
         accessKeyId: string;
         secretAccessKey: string;

package/dist/internal/federation/index.js

@@ -1,15 +1,4 @@
 import { defaultEnv } from '../../env.js';
-// Shared AWS → Google Workload Identity Federation plumbing. All consumers federate the running AWS
-// identity into a Google Workload Identity Pool and impersonate a service account: googleIdTokenAuth
-// mints an audience-bound OIDC id_token, googleCloudAuth a cloud-platform access token, and
-// googleImpersonatedAuth an access token for arbitrary target scopes. What they share lives here — the
-// AWS credential supplier, the cred-config parse, and the Impersonated-client builder.
-//
-// The AWS identity is resolved through the AWS SDK credential chain (env / ECS container credential
-// endpoint / EC2 IMDS, rotation-aware) rather than google-auth-library's built-in AWS source, which
-// reads only env vars → EC2 IMDS and therefore fails on ECS Fargate, where task-role credentials
-// live at the container credential endpoint instead of IMDS. The chain is exposed to
-// google-auth-library via the custom aws_security_credentials_supplier below.
 let awsCredentialProvider;
 // An AwsSecurityCredentialsSupplier backed by the AWS SDK defaultProvider (the credential provider is
 // dynamically imported and memoized so a service that never federates does not load it).
@@ -21,9 +10,6 @@ export const awsSecurityCredentialsSupplier = {
         return { accessKeyId: c.accessKeyId, secretAccessKey: c.secretAccessKey, token: c.sessionToken };
     },
 };
-// Parse the base64 WIF cred config (points at the pool / provider / SA; holds no credential). Both
-// consumers require service account impersonation, so the presence check lives here and the return
-// type narrows the field to non-optional for the caller.
 export const parseWifConfig = (base64, label) => {
     const config = JSON.parse(Buffer.from(base64, 'base64').toString('utf8'));
     const { service_account_impersonation_url } = config;
@@ -32,12 +18,6 @@ export const parseWifConfig = (base64, label) => {
     }
     return { ...config, service_account_impersonation_url };
 };
-// Build the Impersonated client the token mints run through: parse the WIF config, derive the target SA
-// email from its impersonation URL, and wrap the federation-only AwsClient (impersonation URL + built-in
-// IMDS source stripped in favour of the supplier — AwsClient rejects a credential source and a supplier at
-// once) in an Impersonated for the requested lifetime / target scopes. Impersonation itself runs via
-// generateAccessToken / generateIdToken, for which the federated principal holds
-// roles/iam.serviceAccountTokenCreator on the SA.
 export const impersonatedClient = async ({ wifConfigBase64, label, lifetime, targetScopes, }) => {
     const { AwsClient, Impersonated } = await import('google-auth-library');
     const config = parseWifConfig(wifConfigBase64, label);

package/dist/internal/federation/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/internal/federation/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAEzC,oGAAoG;AACpG,qGAAqG;AACrG,4FAA4F;AAC5F,uGAAuG;AACvG,uFAAuF;AACvF,EAAE;AACF,oGAAoG;AACpG,oGAAoG;AACpG,iGAAiG;AACjG,qFAAqF;AACrF,8EAA8E;AAE9E,IAAI,qBAES,CAAA;AAEb,sGAAsG;AACtG,yFAAyF;AACzF,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU;IAC/C,yBAAyB,EAAE,KAAK,IAAI,EAAE;QACpC,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,mCAAmC,CAAC,CAAA;QAC7E,MAAM,CAAC,GAAG,MAAM,CAAC,qBAAqB,KAAK,eAAe,EAAE,CAAC,EAAE,CAAA;QAC/D,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC,YAAY,EAAE,CAAA;IAClG,CAAC;CACF,CAAA;AAED,mGAAmG;AACnG,mGAAmG;AACnG,yDAAyD;AACzD,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,MAAc,EACd,KAAa,EACqD,EAAE;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAqB,CAAA;IAC7F,MAAM,EAAE,iCAAiC,EAAE,GAAG,MAAM,CAAA;IACpD,IAAI,iCAAiC,KAAK,SAAS,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,wDAAwD,CAAC,CAAA;IACnF,CAAC;IACD,OAAO,EAAE,GAAG,MAAM,EAAE,iCAAiC,EAAE,CAAA;AACzD,CAAC,CAAA;AAED,wGAAwG;AACxG,yGAAyG;AACzG,2GAA2G;AAC3G,qGAAqG;AACrG,iFAAiF;AACjF,kDAAkD;AAClD,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EAAE,EACvC,eAAe,EACf,KAAK,EACL,QAAQ,EACR,YAAY,GAMb,EAAE,EAAE;IACH,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAA;IACvE,MAAM,MAAM,GAAG,cAAc,CAAC,eAAe,EAAE,KAAK,CAAC,CAAA;IACrD,MAAM,mBAAmB,GAAG,MAAM,CAAC,iCAAiC,CAAC,KAAK,CAAC,4BAA4B,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC7G,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,uDAAuD,CAAC,CAAA;IAClF,CAAC;IACD,OAAO;QACL,YAAY,EAAE,IAAI,YAAY,CAAC;YAC7B,YAAY,EAAE,IAAI,SAAS,CAAC;gBAC1B,GAAG,MAAM;gBACT,iCAAiC,EAAE,SAAS;gBAC5C,iBAAiB,EAAE,SAAS;gBAC5B,iCAAiC,EAAE,8BAA8B;aAClE,CAAC;YACF,eAAe,EAAE,mBAAmB;YACpC,QAAQ;YACR,YAAY;SACb,CAAC;QACF,mBAAmB;KACpB,CAAA;AACH,CAAC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/internal/federation/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAEzC,IAAI,qBAES,CAAA;AAEb,sGAAsG;AACtG,yFAAyF;AACzF,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU;IAC/C,yBAAyB,EAAE,KAAK,IAAI,EAAE;QACpC,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,mCAAmC,CAAC,CAAA;QAC7E,MAAM,CAAC,GAAG,MAAM,CAAC,qBAAqB,KAAK,eAAe,EAAE,CAAC,EAAE,CAAA;QAC/D,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC,YAAY,EAAE,CAAA;IAClG,CAAC;CACF,CAAA;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,MAAc,EACd,KAAa,EACqD,EAAE;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAqB,CAAA;IAC7F,MAAM,EAAE,iCAAiC,EAAE,GAAG,MAAM,CAAA;IACpD,IAAI,iCAAiC,KAAK,SAAS,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,wDAAwD,CAAC,CAAA;IACnF,CAAC;IACD,OAAO,EAAE,GAAG,MAAM,EAAE,iCAAiC,EAAE,CAAA;AACzD,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EAAE,EACvC,eAAe,EACf,KAAK,EACL,QAAQ,EACR,YAAY,GAMb,EAAE,EAAE;IACH,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAA;IACvE,MAAM,MAAM,GAAG,cAAc,CAAC,eAAe,EAAE,KAAK,CAAC,CAAA;IACrD,MAAM,mBAAmB,GAAG,MAAM,CAAC,iCAAiC,CAAC,KAAK,CAAC,4BAA4B,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC7G,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,uDAAuD,CAAC,CAAA;IAClF,CAAC;IACD,OAAO;QACL,YAAY,EAAE,IAAI,YAAY,CAAC;YAC7B,YAAY,EAAE,IAAI,SAAS,CAAC;gBAC1B,GAAG,MAAM;gBACT,iCAAiC,EAAE,SAAS;gBAC5C,iBAAiB,EAAE,SAAS;gBAC5B,iCAAiC,EAAE,8BAA8B;aAClE,CAAC;YACF,eAAe,EAAE,mBAAmB;YACpC,QAAQ;YACR,YAAY;SACb,CAAC;QACF,mBAAmB;KACpB,CAAA;AACH,CAAC,CAAA"}

package/dist/logger/index.js

@@ -3,31 +3,13 @@ import { getCurrentRequestPath } from '../context/request/index.js';
 import { defaultEnv } from '../env.js';
 import { Util } from '../util/index.js';
 const LEVEL_ORDER = { debug: 10, info: 20, warn: 30, error: 40 };
-// LOG_LEVEL overrides per package's .env.<env>; otherwise the threshold defaults by
-// DEPLOY_ENV: dev=debug (full local trace), stg=info (drop high-volume debug), prd=warn
-// (only warnings and errors). LOG_LEVEL is the escape hatch when you need to temporarily
-// raise visibility — e.g. enable debug in prd for an incident, or info in stg for a
-// repro session.
 const DEFAULT_BY_DEPLOY_ENV = { dev: 'debug', stg: 'info', prd: 'warn' };
-// Cap each sanitized string so one oversized value (a base64 blob, a giant payload) cannot blow past
-// the CloudWatch 256 KB per-event limit. Applied per string / line, well under the whole-record ceiling.
 const MAX_LOG_STRING_LENGTH = 8192;
 const emit = (level, tag, payload) => {
     if (LEVEL_ORDER[level] < LEVEL_ORDER[defaultEnv.LOG_LEVEL ?? DEFAULT_BY_DEPLOY_ENV[defaultEnv.DEPLOY_ENV]]) {
         return;
     }
-    // Guard the whole sanitize+format+write: a payload with a throwing getter or non-serializable value
-    // must not make `logger.error` throw — it runs inside the uncaughtException handler and tRPC onError,
-    // where a throw is fatal. On failure, degrade to a minimal single-line record (sanctioned console use,
-    // last-resort logger).
     try {
-        // dev (local, human-read) prints via util.inspect so string values render literally — no
-        // JSON quote/newline escaping (`\"`, `\n`) and no depth truncation (`[Object]`). stg/prd
-        // (ECS → CloudWatch, machine-parsed) print single-line JSON so each entry maps to one
-        // CloudWatch record and the escaping is the correct, parseable wire form.
-        // `path` is auto-injected from the AsyncLocalStorage request context (Express request
-        // path, overridden to the tRPC procedure path inside `baseProcedure`). The caller can
-        // still pass `path` in `payload` to override — payload spreads last.
         const autoPath = getCurrentRequestPath();
         const record = Util.sanitize({
             level,

package/dist/logger/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/logger/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAEnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAEvC,MAAM,WAAW,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAW,CAAA;AAGzE,oFAAoF;AACpF,wFAAwF;AACxF,yFAAyF;AACzF,oFAAoF;AACpF,iBAAiB;AACjB,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAW,CAAA;AAEjF,qGAAqG;AACrG,yGAAyG;AACzG,MAAM,qBAAqB,GAAG,IAAI,CAAA;AAElC,MAAM,IAAI,GAAG,CAAC,KAAe,EAAE,GAAW,EAAE,OAAgC,EAAE,EAAE;IAC9E,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,UAAU,CAAC,SAAS,IAAI,qBAAqB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAC3G,OAAM;IACR,CAAC;IACD,oGAAoG;IACpG,sGAAsG;IACtG,uGAAuG;IACvG,uBAAuB;IACvB,IAAI,CAAC;QACH,yFAAyF;QACzF,yFAAyF;QACzF,sFAAsF;QACtF,0EAA0E;QAC1E,sFAAsF;QACtF,sFAAsF;QACtF,qEAAqE;QACrE,MAAM,QAAQ,GAAG,qBAAqB,EAAE,CAAA;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAC1B;YACE,KAAK;YACL,OAAO,EAAE,UAAU,CAAC,OAAO,IAAI,SAAS;YACxC,GAAG;YACH,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;YACrD,GAAG,OAAO;SACX,EACD,EAAE,eAAe,EAAE,qBAAqB,EAAE,CAC3C,CAAA;QACD,MAAM,OAAO,GACX,UAAU,CAAC,QAAQ,KAAK,aAAa;YACnC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YAChH,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QAC5B,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YACtB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACxB,CAAC;aAAM,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACvB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACtB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,CAAA;IAC1F,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,KAAK,EAAE,CAAC,GAAW,EAAE,OAAgC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC;IACrF,IAAI,EAAE,CAAC,GAAW,EAAE,OAAgC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;IACnF,IAAI,EAAE,CAAC,GAAW,EAAE,OAAgC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;IACnF,KAAK,EAAE,CAAC,GAAW,EAAE,OAAgC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC;IACrF,MAAM,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,OAAO,OAAO,CAAC;CACjE,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/logger/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAEnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAEvC,MAAM,WAAW,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAW,CAAA;AAGzE,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAW,CAAA;AAEjF,MAAM,qBAAqB,GAAG,IAAI,CAAA;AAElC,MAAM,IAAI,GAAG,CAAC,KAAe,EAAE,GAAW,EAAE,OAAgC,EAAE,EAAE;IAC9E,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,UAAU,CAAC,SAAS,IAAI,qBAAqB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAC3G,OAAM;IACR,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,qBAAqB,EAAE,CAAA;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAC1B;YACE,KAAK;YACL,OAAO,EAAE,UAAU,CAAC,OAAO,IAAI,SAAS;YACxC,GAAG;YACH,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;YACrD,GAAG,OAAO;SACX,EACD,EAAE,eAAe,EAAE,qBAAqB,EAAE,CAC3C,CAAA;QACD,MAAM,OAAO,GACX,UAAU,CAAC,QAAQ,KAAK,aAAa;YACnC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YAChH,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QAC5B,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YACtB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACxB,CAAC;aAAM,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACvB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACtB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,CAAA;IAC1F,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,KAAK,EAAE,CAAC,GAAW,EAAE,OAAgC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC;IACrF,IAAI,EAAE,CAAC,GAAW,EAAE,OAAgC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;IACnF,IAAI,EAAE,CAAC,GAAW,EAAE,OAAgC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC;IACnF,KAAK,EAAE,CAAC,GAAW,EAAE,OAAgC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC;IACrF,MAAM,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,OAAO,OAAO,CAAC;CACjE,CAAA"}