@zintrust/core 0.1.40 → 0.1.42

package/src/orm/adapters/MongoDBProxyAdapter.js

@@ -0,0 +1,128 @@
+/* eslint-disable @typescript-eslint/require-await */
+import { Env } from '../../config/env.js';
+import { Logger } from '../../config/logger.js';
+import { ErrorFactory } from '../../exceptions/ZintrustError.js';
+import { ProxyCache } from '../adapters/ProxyCache.js';
+import { ensureSignedSettings, isRecord, requestSignedProxy, } from '../adapters/SqlProxyAdapterUtils.js';
+const normalizeRows = (value) => {
+    if (value === null)
+        return [];
+    if (Array.isArray(value))
+        return value;
+    return [value];
+};
+const extractResultPayload = (response) => {
+    if (!isRecord(response))
+        return response;
+    if ('result' in response)
+        return response['result'];
+    if ('rows' in response)
+        return response['rows'];
+    return response;
+};
+const getCacheKey = (collection, operation, args) => {
+    return `${collection}:${operation}:${JSON.stringify(args)}`;
+};
+const resolveProxyUrl = () => {
+    const url = Env.get('MONGODB_PROXY_URL', '');
+    if (typeof url === 'string' && url.trim() !== '')
+        return url;
+    const host = Env.get('MONGODB_PROXY_HOST', '127.0.0.1');
+    const port = Env.getInt('MONGODB_PROXY_PORT', 8792);
+    return `http://${host}:${port}`;
+};
+const buildProxySettings = () => {
+    const baseUrl = resolveProxyUrl();
+    const keyId = Env.get('MONGODB_PROXY_KEY_ID', '');
+    const secret = Env.get('MONGODB_PROXY_SECRET', '');
+    const timeoutMs = Env.getInt('MONGODB_PROXY_TIMEOUT_MS', 30000);
+    return { baseUrl, keyId, secret, timeoutMs };
+};
+const buildSignedProxyConfig = (settings) => ({
+    settings,
+    missingUrlMessage: 'MongoDB proxy URL is missing',
+    missingCredentialsMessage: 'MongoDB proxy signing credentials are missing',
+    messages: {
+        unauthorized: 'MongoDB proxy unauthorized',
+        forbidden: 'MongoDB proxy forbidden',
+        rateLimited: 'MongoDB proxy rate limited',
+        rejected: 'MongoDB proxy rejected',
+        error: 'MongoDB proxy error',
+        timedOut: 'MongoDB proxy timed out',
+    },
+});
+const MONGODB_OPERATION_PATH = '/zin/mongodb/operation';
+export function createMongoDBProxyAdapter() {
+    let connected = false;
+    const cache = ProxyCache.create();
+    const settings = buildProxySettings();
+    return {
+        async connect() {
+            ensureSignedSettings(buildSignedProxyConfig(settings));
+            Logger.info(`Connecting to MongoDB via proxy: ${settings.baseUrl}`);
+            connected = true;
+        },
+        async disconnect() {
+            connected = false;
+            cache.clear();
+            Logger.info('Disconnected from MongoDB proxy');
+        },
+        async query(_sql, _parameters) {
+            if (!connected) {
+                throw ErrorFactory.createConnectionError('Not connected to MongoDB proxy');
+            }
+            // Parse MongoDB-like query (simple implementation)
+            // Expected format: collection.operation({...})
+            const pattern = /^(\w+)\.(\w+)\((.+)\$/;
+            const match = pattern.exec(_sql);
+            if (!match) {
+                throw ErrorFactory.createGeneralError('Invalid MongoDB query format');
+            }
+            const [, collection, operation, argsStr] = match;
+            const args = JSON.parse(argsStr);
+            const cacheKey = getCacheKey(collection, operation, args);
+            const cached = cache.get(cacheKey);
+            if (cached)
+                return cached;
+            const response = await requestSignedProxy(buildSignedProxyConfig({
+                ...settings,
+                signaturePathPrefixToStrip: MONGODB_OPERATION_PATH,
+            }), MONGODB_OPERATION_PATH, { collection, operation, args });
+            const result = extractResultPayload(response);
+            const rows = normalizeRows(result);
+            const queryResult = {
+                rows,
+                rowCount: rows.length,
+            };
+            cache.set(cacheKey, queryResult);
+            return queryResult;
+        },
+        async queryOne(sql, parameters) {
+            const result = await this.query(sql, parameters);
+            return result.rows[0] ?? null;
+        },
+        async ping() {
+            if (!connected) {
+                throw ErrorFactory.createConnectionError('Not connected to MongoDB proxy');
+            }
+        },
+        async transaction(callback) {
+            // MongoDB proxy doesn't support traditional transactions via HTTP
+            Logger.warn('MongoDB proxy adapter does not support transactions');
+            return callback(this);
+        },
+        async rawQuery(sql, parameters) {
+            const result = await this.query(sql, parameters ?? []);
+            return result.rows;
+        },
+        getType() {
+            return 'mongodb-proxy';
+        },
+        isConnected() {
+            return connected;
+        },
+        getPlaceholder(index) {
+            return `$${index}`;
+        },
+    };
+}

package/src/orm/adapters/MySQLProxyAdapter.d.ts

@@ -0,0 +1,11 @@
+/**
+ * MySQL Proxy Adapter (HTTP)
+ *
+ * Used in Cloudflare Workers when MYSQL_PROXY_URL is configured.
+ */
+import type { DatabaseConfig, IDatabaseAdapter } from '../DatabaseAdapter';
+export declare const MySQLProxyAdapter: Readonly<{
+    create(_config: DatabaseConfig): IDatabaseAdapter;
+}>;
+export default MySQLProxyAdapter;
+//# sourceMappingURL=MySQLProxyAdapter.d.ts.map

package/src/orm/adapters/MySQLProxyAdapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MySQLProxyAdapter.d.ts","sourceRoot":"","sources":["../../../../src/orm/adapters/MySQLProxyAdapter.ts"],"names":[],"mappings":"AACA;;;;GAIG;AAkBH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAe,MAAM,sBAAsB,CAAC;AAiN1F,eAAO,MAAM,iBAAiB;oBACZ,cAAc,GAAG,gBAAgB;EAajD,CAAC;AAEH,eAAe,iBAAiB,CAAC"}

package/src/orm/adapters/MySQLProxyAdapter.js

@@ -0,0 +1,162 @@
+/* eslint-disable @typescript-eslint/require-await */
+/**
+ * MySQL Proxy Adapter (HTTP)
+ *
+ * Used in Cloudflare Workers when MYSQL_PROXY_URL is configured.
+ */
+import { Env } from '../../config/env.js';
+import { Logger } from '../../config/logger.js';
+import { ErrorFactory } from '../../exceptions/ZintrustError.js';
+import { AdaptersEnum } from '../../migrations/enum/index.js';
+import { ensureSignedSettings, isRecord, requestSignedProxy, } from '../adapters/SqlProxyAdapterUtils.js';
+import { createStatementPayload, getExecMetaWithLastRowId, resolveSqlProxyMode, } from '../adapters/SqlProxyRegistryMode.js';
+import { QueryBuilder } from '../QueryBuilder.js';
+const buildProxySettings = () => {
+    const baseUrl = Env.MYSQL_PROXY_URL;
+    const keyId = Env.MYSQL_PROXY_KEY_ID ?? '';
+    const secret = Env.MYSQL_PROXY_SECRET ?? '';
+    const timeoutMs = Env.MYSQL_PROXY_TIMEOUT_MS;
+    return { baseUrl, keyId, secret, timeoutMs };
+};
+const buildSignedProxyConfig = (settings) => ({
+    settings,
+    missingUrlMessage: 'MySQL proxy URL is missing (MYSQL_PROXY_URL)',
+    missingCredentialsMessage: 'MySQL proxy signing credentials are missing (MYSQL_PROXY_KEY_ID / MYSQL_PROXY_SECRET)',
+    messages: {
+        unauthorized: 'MySQL proxy unauthorized',
+        forbidden: 'MySQL proxy forbidden',
+        rateLimited: 'MySQL proxy rate limited',
+        rejected: 'MySQL proxy rejected request',
+        error: 'MySQL proxy error',
+        timedOut: 'MySQL proxy request timed out',
+    },
+});
+const isQueryResponse = (value) => isRecord(value) && Array.isArray(value['rows']) && typeof value['rowCount'] === 'number';
+const isQueryOneResponse = (value) => isRecord(value) && 'row' in value;
+const requestProxy = async (settings, path, payload) => {
+    const signedProxyConfig = buildSignedProxyConfig(settings);
+    try {
+        return await requestSignedProxy(signedProxyConfig, path, payload);
+    }
+    catch (error) {
+        Logger.error('[MySQLProxyAdapter] Proxy request failed', {
+            path,
+            baseUrl: settings.baseUrl,
+            timeoutMs: settings.timeoutMs,
+            hasKeyId: (settings.keyId ?? '').trim() !== '',
+            hasSecret: (settings.secret ?? '').trim() !== '',
+            error: error instanceof Error ? error.message : String(error),
+        });
+        throw error;
+    }
+};
+const resolveProxyMode = () => {
+    return resolveSqlProxyMode('MYSQL_PROXY_MODE');
+};
+const requireConnected = (state) => {
+    if (!state.connected)
+        throw ErrorFactory.createConnectionError('Database not connected');
+};
+const toQueryResult = (out) => {
+    if (isQueryResponse(out)) {
+        return {
+            rows: out.rows,
+            rowCount: out.rowCount,
+            lastInsertId: out.lastInsertId,
+        };
+    }
+    if (isQueryOneResponse(out)) {
+        const row = out.row;
+        return { rows: row ? [row] : [], rowCount: row ? 1 : 0 };
+    }
+    const meta = getExecMetaWithLastRowId(out);
+    return { rows: [], rowCount: meta.changes, lastInsertId: meta.lastRowId };
+};
+const createQuery = (state) => async (sql, parameters) => {
+    requireConnected(state);
+    const mode = resolveProxyMode();
+    const out = mode === 'registry'
+        ? await requestProxy(state.settings, '/zin/mysql/statement', await createStatementPayload(sql, parameters))
+        : await requestProxy(state.settings, '/zin/mysql/query', {
+            sql,
+            params: parameters,
+        });
+    return toQueryResult(out);
+};
+const createQueryOne = (state) => async (sql, parameters) => {
+    requireConnected(state);
+    const mode = resolveProxyMode();
+    if (mode !== 'registry') {
+        const out = await requestProxy(state.settings, '/zin/mysql/queryOne', {
+            sql,
+            params: parameters,
+        });
+        return out.row ?? null;
+    }
+    const out = await requestProxy(state.settings, '/zin/mysql/statement', await createStatementPayload(sql, parameters));
+    if (isQueryOneResponse(out))
+        return out.row ?? null;
+    if (isQueryResponse(out))
+        return out.rows[0] ?? null;
+    return null;
+};
+const createPing = (queryOne) => async () => {
+    await queryOne(QueryBuilder.create('').select('1').toSQL(), []);
+};
+const createTransaction = (state, getAdapter) => async (callback) => {
+    requireConnected(state);
+    try {
+        return await callback(getAdapter());
+    }
+    catch (error) {
+        throw ErrorFactory.createTryCatchError('MySQL proxy transaction failed', error);
+    }
+};
+const createRawQuery = (state, query) => async (sql, parameters = []) => {
+    requireConnected(state);
+    const out = await query(sql, parameters);
+    return out.rows;
+};
+const createAdapter = (state) => {
+    const query = createQuery(state);
+    const queryOne = createQueryOne(state);
+    const ping = createPing(queryOne);
+    const adapter = {
+        async connect() {
+            ensureSignedSettings(buildSignedProxyConfig(state.settings));
+            state.connected = true;
+        },
+        async disconnect() {
+            state.connected = false;
+        },
+        query,
+        queryOne,
+        ping,
+        transaction: createTransaction(state, () => adapter),
+        rawQuery: createRawQuery(state, query),
+        getType() {
+            return AdaptersEnum.mysql;
+        },
+        isConnected() {
+            return state.connected;
+        },
+        getPlaceholder(_index) {
+            return '?';
+        },
+    };
+    return adapter;
+};
+export const MySQLProxyAdapter = Object.freeze({
+    create(_config) {
+        const settings = buildProxySettings();
+        const state = { connected: false, settings };
+        Logger.info('[MySQLProxyAdapter] Created with runtime settings', {
+            baseUrl: settings.baseUrl,
+            timeoutMs: settings.timeoutMs,
+            hasKeyId: (settings.keyId ?? '').trim() !== '',
+            hasSecret: (settings.secret ?? '').trim() !== '',
+        });
+        return createAdapter(state);
+    },
+});
+export default MySQLProxyAdapter;

package/src/orm/adapters/PostgreSQLProxyAdapter.d.ts

@@ -0,0 +1,11 @@
+/**
+ * PostgreSQL Proxy Adapter (HTTP)
+ *
+ * Used in Cloudflare Workers when POSTGRES_PROXY_URL is configured.
+ */
+import type { DatabaseConfig, IDatabaseAdapter } from '../DatabaseAdapter';
+export declare const PostgreSQLProxyAdapter: Readonly<{
+    create(_config: DatabaseConfig): IDatabaseAdapter;
+}>;
+export default PostgreSQLProxyAdapter;
+//# sourceMappingURL=PostgreSQLProxyAdapter.d.ts.map

package/src/orm/adapters/PostgreSQLProxyAdapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PostgreSQLProxyAdapter.d.ts","sourceRoot":"","sources":["../../../../src/orm/adapters/PostgreSQLProxyAdapter.ts"],"names":[],"mappings":"AACA;;;;GAIG;AAaH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAe,MAAM,sBAAsB,CAAC;AAiH1F,eAAO,MAAM,sBAAsB;oBACjB,cAAc,GAAG,gBAAgB;EAwFjD,CAAC;AAEH,eAAe,sBAAsB,CAAC"}

package/src/orm/adapters/PostgreSQLProxyAdapter.js

@@ -0,0 +1,163 @@
+/* eslint-disable @typescript-eslint/require-await */
+/**
+ * PostgreSQL Proxy Adapter (HTTP)
+ *
+ * Used in Cloudflare Workers when POSTGRES_PROXY_URL is configured.
+ */
+import { Env } from '../../config/env.js';
+import { ErrorFactory } from '../../exceptions/ZintrustError.js';
+import { AdaptersEnum } from '../../migrations/enum/index.js';
+import { ensureSignedSettings, isRecord, requestSignedProxy, } from '../adapters/SqlProxyAdapterUtils.js';
+import { createStatementPayload, resolveSqlProxyMode } from '../adapters/SqlProxyRegistryMode.js';
+import { QueryBuilder } from '../QueryBuilder.js';
+const resolveBaseUrl = () => {
+    const explicit = Env.POSTGRES_PROXY_URL.trim();
+    if (explicit !== '')
+        return explicit;
+    const host = Env.POSTGRES_PROXY_HOST || '127.0.0.1';
+    const port = Env.POSTGRES_PROXY_PORT;
+    return `http://${host}:${port}`;
+};
+const buildProxySettings = () => {
+    const baseUrl = resolveBaseUrl();
+    const keyId = Env.POSTGRES_PROXY_KEY_ID ?? '';
+    const secret = Env.POSTGRES_PROXY_SECRET ?? '';
+    const timeoutMs = Env.POSTGRES_PROXY_TIMEOUT_MS;
+    return { baseUrl, keyId, secret, timeoutMs };
+};
+const buildSignedProxyConfig = (settings) => ({
+    settings,
+    missingUrlMessage: 'PostgreSQL proxy URL is missing (POSTGRES_PROXY_URL)',
+    missingCredentialsMessage: 'PostgreSQL proxy signing credentials are missing (POSTGRES_PROXY_KEY_ID / POSTGRES_PROXY_SECRET)',
+    messages: {
+        unauthorized: 'PostgreSQL proxy unauthorized',
+        forbidden: 'PostgreSQL proxy forbidden',
+        rateLimited: 'PostgreSQL proxy rate limited',
+        rejected: 'PostgreSQL proxy rejected request',
+        error: 'PostgreSQL proxy error',
+        timedOut: 'PostgreSQL proxy request timed out',
+    },
+});
+const isQueryResponse = (value) => isRecord(value) && Array.isArray(value['rows']) && typeof value['rowCount'] === 'number';
+const isQueryOneResponse = (value) => isRecord(value) && 'row' in value;
+const normalizeLastInsertId = (value) => {
+    if (typeof value === 'number' || typeof value === 'string' || typeof value === 'bigint') {
+        return value;
+    }
+    return undefined;
+};
+const extractRowId = (row) => {
+    if (!isRecord(row))
+        return undefined;
+    return normalizeLastInsertId(row['id']);
+};
+const getExecMeta = (value) => {
+    if (!isRecord(value) || typeof value['ok'] !== 'boolean')
+        return { changes: 0 };
+    const meta = value['meta'];
+    if (!isRecord(meta))
+        return { changes: 0 };
+    const changes = typeof meta['changes'] === 'number' ? meta['changes'] : 0;
+    return { changes };
+};
+const toQueryResult = (out) => {
+    if (isQueryResponse(out)) {
+        return {
+            rows: out.rows,
+            rowCount: out.rowCount,
+            lastInsertId: extractRowId(out.rows[0]),
+        };
+    }
+    if (isQueryOneResponse(out)) {
+        const row = out.row ?? null;
+        return {
+            rows: row ? [row] : [],
+            rowCount: row ? 1 : 0,
+            lastInsertId: extractRowId(row),
+        };
+    }
+    const meta = getExecMeta(out);
+    return { rows: [], rowCount: meta.changes };
+};
+const requestProxy = async (settings, path, payload) => {
+    return requestSignedProxy(buildSignedProxyConfig(settings), path, payload);
+};
+const resolveProxyMode = () => {
+    return resolveSqlProxyMode('POSTGRES_PROXY_MODE');
+};
+export const PostgreSQLProxyAdapter = Object.freeze({
+    create(_config) {
+        let connected = true;
+        const settings = buildProxySettings();
+        return {
+            async connect() {
+                ensureSignedSettings(buildSignedProxyConfig(settings));
+                connected = true;
+            },
+            async disconnect() {
+                connected = true;
+            },
+            async query(sql, parameters) {
+                if (!connected)
+                    throw ErrorFactory.createConnectionError('Database not connected');
+                const mode = resolveProxyMode();
+                const out = mode === 'registry'
+                    ? await requestProxy(settings, '/zin/postgres/statement', await createStatementPayload(sql, parameters))
+                    : await requestProxy(settings, '/zin/postgres/query', {
+                        sql,
+                        params: parameters,
+                    });
+                return toQueryResult(out);
+            },
+            async queryOne(sql, parameters) {
+                if (!connected)
+                    throw ErrorFactory.createConnectionError('Database not connected');
+                const mode = resolveProxyMode();
+                if (mode !== 'registry') {
+                    const out = await requestProxy(settings, '/zin/postgres/queryOne', {
+                        sql,
+                        params: parameters,
+                    });
+                    return out.row ?? null;
+                }
+                const out = await requestProxy(settings, '/zin/postgres/statement', await createStatementPayload(sql, parameters));
+                if (isQueryOneResponse(out))
+                    return out.row ?? null;
+                if (isQueryResponse(out))
+                    return out.rows[0] ?? null;
+                return null;
+            },
+            async ping() {
+                if (!connected)
+                    throw ErrorFactory.createConnectionError('Database not connected');
+                await this.queryOne(QueryBuilder.create('').select('1').toSQL(), []);
+            },
+            async transaction(callback) {
+                if (!connected)
+                    throw ErrorFactory.createConnectionError('Database not connected');
+                try {
+                    return await callback(this);
+                }
+                catch (error) {
+                    throw ErrorFactory.createTryCatchError('PostgreSQL proxy transaction failed', error);
+                }
+            },
+            async rawQuery(sql, parameters = []) {
+                if (!connected)
+                    throw ErrorFactory.createConnectionError('Database not connected');
+                const out = await this.query(sql, parameters);
+                return out.rows;
+            },
+            getType() {
+                return AdaptersEnum.postgresql;
+            },
+            isConnected() {
+                return connected;
+            },
+            getPlaceholder(index) {
+                return `$${index}`;
+            },
+        };
+    },
+});
+export default PostgreSQLProxyAdapter;

package/src/orm/adapters/ProxyCache.d.ts

@@ -0,0 +1,9 @@
+import type { QueryResult } from '../DatabaseAdapter';
+export declare const ProxyCache: Readonly<{
+    create(): Readonly<{
+        get(key: string): QueryResult | null;
+        set(key: string, data: QueryResult): void;
+        clear(): void;
+    }>;
+}>;
+//# sourceMappingURL=ProxyCache.d.ts.map

package/src/orm/adapters/ProxyCache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProxyCache.d.ts","sourceRoot":"","sources":["../../../../src/orm/adapters/ProxyCache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AASxD,eAAO,MAAM,UAAU;;iBAKR,MAAM,GAAG,WAAW,GAAG,IAAI;iBAU3B,MAAM,QAAQ,WAAW,GAAG,IAAI;iBAIhC,IAAI;;EAKjB,CAAC"}

package/src/orm/adapters/ProxyCache.js

@@ -0,0 +1,24 @@
+const CACHE_TTL_MS = 5000;
+export const ProxyCache = Object.freeze({
+    create() {
+        const cache = new Map();
+        return Object.freeze({
+            get(key) {
+                const entry = cache.get(key);
+                if (!entry)
+                    return null;
+                if (Date.now() - entry.timestamp > CACHE_TTL_MS) {
+                    cache.delete(key);
+                    return null;
+                }
+                return entry.data;
+            },
+            set(key, data) {
+                cache.set(key, { data, timestamp: Date.now() });
+            },
+            clear() {
+                cache.clear();
+            },
+        });
+    },
+});

package/src/orm/adapters/ProxySignedRequest.d.ts

@@ -0,0 +1,11 @@
+export declare const createSignedProxyRequest: (input: {
+    url: string;
+    body: string;
+    keyId: string;
+    secret: string;
+    missingCredentialsMessage: string;
+}) => Promise<{
+    headers: Record<string, string>;
+    body: string;
+}>;
+//# sourceMappingURL=ProxySignedRequest.d.ts.map

package/src/orm/adapters/ProxySignedRequest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProxySignedRequest.d.ts","sourceRoot":"","sources":["../../../../src/orm/adapters/ProxySignedRequest.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,wBAAwB,GAAU,OAAO;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,yBAAyB,EAAE,MAAM,CAAC;CACnC,KAAG,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CA4B5D,CAAC"}

package/src/orm/adapters/ProxySignedRequest.js

@@ -0,0 +1,30 @@
+import { ErrorFactory } from '../../exceptions/ZintrustError.js';
+import { normalizeSigningCredentials } from '../../proxy/SigningService.js';
+import { SignedRequest } from '../../security/SignedRequest.js';
+import { buildSigningUrl } from '../adapters/ProxySigningPath.js';
+export const createSignedProxyRequest = async (input) => {
+    const creds = normalizeSigningCredentials({ keyId: input.keyId, secret: input.secret });
+    if (creds.keyId.trim() === '' || creds.secret.trim() === '') {
+        throw ErrorFactory.createConfigError(input.missingCredentialsMessage);
+    }
+    const urlObj = new URL(input.url);
+    const signingUrl = buildSigningUrl(urlObj, input.url);
+    const signResult = await SignedRequest.createHeaders({
+        method: 'POST',
+        url: signingUrl,
+        body: input.body,
+        keyId: creds.keyId,
+        secret: creds.secret,
+    });
+    return {
+        headers: {
+            'content-type': 'application/json',
+            'x-zt-key-id': signResult['x-zt-key-id'],
+            'x-zt-timestamp': signResult['x-zt-timestamp'],
+            'x-zt-nonce': signResult['x-zt-nonce'],
+            'x-zt-body-sha256': signResult['x-zt-body-sha256'],
+            'x-zt-signature': signResult['x-zt-signature'],
+        },
+        body: input.body,
+    };
+};

package/src/orm/adapters/ProxySigningPath.d.ts

@@ -0,0 +1,3 @@
+export declare const resolveSigningPrefix: (baseUrl: string) => string | undefined;
+export declare const buildSigningUrl: (requestUrl: URL, baseUrl: string) => URL;
+//# sourceMappingURL=ProxySigningPath.d.ts.map

package/src/orm/adapters/ProxySigningPath.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProxySigningPath.d.ts","sourceRoot":"","sources":["../../../../src/orm/adapters/ProxySigningPath.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,oBAAoB,GAAI,SAAS,MAAM,KAAG,MAAM,GAAG,SAU/D,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,YAAY,GAAG,EAAE,SAAS,MAAM,KAAG,GAYlE,CAAC"}

package/src/orm/adapters/ProxySigningPath.js

@@ -0,0 +1,25 @@
+export const resolveSigningPrefix = (baseUrl) => {
+    try {
+        const parsed = new URL(baseUrl);
+        const pathname = parsed.pathname;
+        const path = pathname.endsWith('/') ? pathname.slice(0, -1) : pathname;
+        if (path === '' || path === '/')
+            return undefined;
+        return path;
+    }
+    catch {
+        return undefined;
+    }
+};
+export const buildSigningUrl = (requestUrl, baseUrl) => {
+    const prefix = resolveSigningPrefix(baseUrl);
+    if (typeof prefix !== 'string' || prefix.trim() === '')
+        return requestUrl;
+    if (requestUrl.pathname === prefix || requestUrl.pathname.startsWith(`${prefix}/`)) {
+        const signingUrl = new URL(requestUrl.toString());
+        const stripped = requestUrl.pathname.slice(prefix.length);
+        signingUrl.pathname = stripped.startsWith('/') ? stripped : `/${stripped}`;
+        return signingUrl;
+    }
+    return requestUrl;
+};

package/src/orm/adapters/SqlProxyAdapterUtils.d.ts

@@ -0,0 +1,19 @@
+import { type RemoteSignedJsonSettings } from '../../common/RemoteSignedJson';
+export type ProxySettings = {
+    baseUrl: string;
+    keyId?: string;
+    secret?: string;
+    timeoutMs: number;
+    signaturePathPrefixToStrip?: string;
+};
+export type SignedProxyConfig = {
+    settings: ProxySettings;
+    missingUrlMessage: string;
+    missingCredentialsMessage: string;
+    messages: RemoteSignedJsonSettings['messages'];
+};
+export declare const buildSignedSettings: (config: SignedProxyConfig) => RemoteSignedJsonSettings;
+export declare const ensureSignedSettings: (config: SignedProxyConfig) => RemoteSignedJsonSettings;
+export declare const requestSignedProxy: <T>(config: SignedProxyConfig, path: string, payload: Record<string, unknown>) => Promise<T>;
+export declare const isRecord: (value: unknown) => value is Record<string, unknown>;
+//# sourceMappingURL=SqlProxyAdapterUtils.d.ts.map

package/src/orm/adapters/SqlProxyAdapterUtils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SqlProxyAdapterUtils.d.ts","sourceRoot":"","sources":["../../../../src/orm/adapters/SqlProxyAdapterUtils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,KAAK,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAM3F,MAAM,MAAM,aAAa,GAAG;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,0BAA0B,CAAC,EAAE,MAAM,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,EAAE,aAAa,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,yBAAyB,EAAE,MAAM,CAAC;IAClC,QAAQ,EAAE,wBAAwB,CAAC,UAAU,CAAC,CAAC;CAChD,CAAC;AAEF,eAAO,MAAM,mBAAmB,GAAI,QAAQ,iBAAiB,KAAG,wBAiB/D,CAAC;AAEF,eAAO,MAAM,oBAAoB,GAAI,QAAQ,iBAAiB,KAAG,wBAYhE,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAAU,CAAC,EACxC,QAAQ,iBAAiB,EACzB,MAAM,MAAM,EACZ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC/B,OAAO,CAAC,CAAC,CAGX,CAAC;AAEF,eAAO,MAAM,QAAQ,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAoB,CAAC"}

package/src/orm/adapters/SqlProxyAdapterUtils.js

@@ -0,0 +1,36 @@
+import { RemoteSignedJson } from '../../common/RemoteSignedJson.js';
+import { ErrorFactory } from '../../exceptions/ZintrustError.js';
+import { isObject } from '../../helper/index.js';
+import { resolveSigningPrefix } from '../adapters/ProxySigningPath.js';
+import { normalizeSigningCredentials } from '../../proxy/SigningService.js';
+export const buildSignedSettings = (config) => {
+    const creds = normalizeSigningCredentials({
+        keyId: config.settings.keyId ?? '',
+        secret: config.settings.secret ?? '',
+    });
+    return {
+        baseUrl: config.settings.baseUrl,
+        keyId: creds.keyId,
+        secret: creds.secret,
+        timeoutMs: config.settings.timeoutMs,
+        signaturePathPrefixToStrip: config.settings.signaturePathPrefixToStrip ?? resolveSigningPrefix(config.settings.baseUrl),
+        missingUrlMessage: config.missingUrlMessage,
+        missingCredentialsMessage: config.missingCredentialsMessage,
+        messages: config.messages,
+    };
+};
+export const ensureSignedSettings = (config) => {
+    const signedSettings = buildSignedSettings(config);
+    if (signedSettings.baseUrl.trim() === '') {
+        throw ErrorFactory.createConfigError(config.missingUrlMessage);
+    }
+    if (signedSettings.keyId.trim() === '' || signedSettings.secret.trim() === '') {
+        throw ErrorFactory.createConfigError(config.missingCredentialsMessage);
+    }
+    return signedSettings;
+};
+export const requestSignedProxy = async (config, path, payload) => {
+    const signedSettings = ensureSignedSettings(config);
+    return RemoteSignedJson.request(signedSettings, path, payload);
+};
+export const isRecord = (value) => isObject(value);