dialog-survey 1.1.0

package/dist/services/stream-message.service.js

@@ -0,0 +1,184 @@
+import { runInterviewGraph } from '../core/graph.js';
+import { InterviewStateRepository } from '../repositories/interview-state.repository.js';
+import { TemplateRepository } from '../repositories/template.repository.js';
+import { error, info } from '../utils/logger.js';
+import { isAllowedWebhookUrl, parseStreamMessage, sendReply as sendReplyUnsafe, } from './stream-message-utils.js';
+const MAX_RETRIES = 3;
+export class StreamMessageService {
+    repo;
+    constructor(repo) {
+        this.repo = repo || new InterviewStateRepository();
+    }
+    parseStreamMessage = parseStreamMessage;
+    async sendReply(sessionWebhook, content) {
+        if (!isAllowedWebhookUrl(sessionWebhook)) {
+            error('Webhook URL hostname not in allowlist', { url: sessionWebhook });
+            return false;
+        }
+        return sendReplyUnsafe(sessionWebhook, content);
+    }
+    async processStreamMessage(message, retryCount = 0, prisma) {
+        const parsed = parseStreamMessage(message);
+        if (!parsed) {
+            error('Message parse failed - invalid format', {
+                data: message.data?.substring(0, 200),
+            });
+            return { success: false, error: 'Invalid message format' };
+        }
+        if (!parsed.userId || !parsed.content) {
+            error('Message missing required fields', {
+                userId: parsed.userId,
+                content: parsed.content?.substring(0, 100),
+            });
+            return { success: false, error: 'Missing userId or content' };
+        }
+        info('Processing stream message', {
+            userId: parsed.userId,
+            content: parsed.content,
+            messageId: parsed.messageId,
+        });
+        let state = await this.repo.findActiveInterview(parsed.userId);
+        if (!state) {
+            const templateId = await this.resolveDefaultTemplateId();
+            const interviewId = await this.repo.createInterview(parsed.userId, templateId);
+            state = {
+                userId: parsed.userId,
+                interviewId,
+                templateId,
+                status: 'PENDING',
+                messages: [],
+                currentQuestion: 0,
+                followupCount: 0,
+                maxFollowups: 2,
+                responses: [],
+                reportGenerated: false,
+                version: 1,
+                originalVersion: 1,
+                pendingMessages: [],
+                pendingResponses: [],
+            };
+        }
+        state.pendingMessages.push({
+            role: 'user',
+            content: parsed.content,
+            isVoice: false,
+        });
+        if (!state.userName && prisma) {
+            try {
+                const interview = await prisma.interview.findFirst({
+                    where: { userId: parsed.userId },
+                    select: { planId: true },
+                });
+                if (interview?.planId) {
+                    const plan = await prisma.interviewPlan.findUnique({
+                        where: { id: interview.planId },
+                        select: { inviteeData: true },
+                    });
+                    if (plan?.inviteeData) {
+                        const invitees = plan.inviteeData;
+                        const matched = invitees.find((inv) => inv.userId === parsed.userId);
+                        if (matched?.name)
+                            state.userName = matched.name;
+                    }
+                }
+            }
+            catch {
+                // Silently fail userName resolution
+            }
+        }
+        const graphResult = await runInterviewGraph(state, {
+            userId: parsed.userId,
+            content: parsed.content,
+            isVoice: false,
+        });
+        const nextState = graphResult.nextState;
+        const existingCount = state.responses.length;
+        const newResponses = nextState.responses.slice(existingCount);
+        if (newResponses.length > 0) {
+            nextState.pendingResponses = newResponses;
+        }
+        nextState.pendingMessages.push({
+            role: 'assistant',
+            content: graphResult.response,
+            isVoice: false,
+        });
+        try {
+            await this.repo.saveFullState(state.interviewId, nextState);
+        }
+        catch (err) {
+            const errorMsg = err instanceof Error ? err.message : 'Unknown error';
+            if (errorMsg.includes('Version conflict') && retryCount < MAX_RETRIES) {
+                info('Retrying due to version conflict', {
+                    userId: parsed.userId,
+                    retryCount: retryCount + 1,
+                });
+                const freshState = await this.repo.loadFullState(state.interviewId, parsed.userId);
+                if (freshState) {
+                    freshState.pendingMessages = [{ role: 'user', content: parsed.content, isVoice: false }];
+                    const retryGraphResult = await runInterviewGraph(freshState, {
+                        userId: parsed.userId,
+                        content: parsed.content,
+                        isVoice: false,
+                    });
+                    const retryExistingCount = freshState.responses.length;
+                    const retryNewResponses = retryGraphResult.nextState.responses.slice(retryExistingCount);
+                    if (retryNewResponses.length > 0) {
+                        retryGraphResult.nextState.pendingResponses = retryNewResponses;
+                    }
+                    retryGraphResult.nextState.pendingMessages.push({
+                        role: 'assistant',
+                        content: retryGraphResult.response,
+                        isVoice: false,
+                    });
+                    return this.processStreamMessageWithState(message, retryGraphResult, freshState, retryCount + 1);
+                }
+            }
+            return { success: false, error: errorMsg };
+        }
+        if (parsed.sessionWebhook) {
+            await this.sendReply(parsed.sessionWebhook, graphResult.response);
+        }
+        return { success: true, response: graphResult.response };
+    }
+    async processStreamMessageWithState(message, graphResult, state, retryCount) {
+        const parsed = parseStreamMessage(message);
+        if (!parsed) {
+            return { success: false, error: 'Invalid message format' };
+        }
+        try {
+            const existingCount = state.responses.length;
+            const newResponses = graphResult.nextState.responses.slice(existingCount);
+            if (newResponses.length > 0) {
+                graphResult.nextState.pendingResponses = newResponses;
+            }
+            await this.repo.saveFullState(state.interviewId, graphResult.nextState);
+        }
+        catch (err) {
+            const errorMsg = err instanceof Error ? err.message : 'Unknown error';
+            if (errorMsg.includes('Version conflict') && retryCount < MAX_RETRIES) {
+                return this.processStreamMessage(message, retryCount + 1);
+            }
+            return { success: false, error: errorMsg };
+        }
+        if (parsed.sessionWebhook) {
+            await this.sendReply(parsed.sessionWebhook, graphResult.response);
+        }
+        return { success: true, response: graphResult.response };
+    }
+    async resolveDefaultTemplateId() {
+        const repo = new TemplateRepository();
+        const templates = await repo.findAll();
+        const published = templates.find((t) => t.status === 'PUBLISHED');
+        if (published)
+            return published.id;
+        return templates.length > 0 ? templates[0].id : 'test-template';
+    }
+}
+// Backwards-compatible exports
+export { parseStreamMessage, sendReply, isAllowedWebhookUrl } from './stream-message-utils.js';
+export async function processStreamMessage(message, prisma) {
+    const repo = new InterviewStateRepository(prisma);
+    const service = new StreamMessageService(repo);
+    return service.processStreamMessage(message, 0, prisma);
+}
+//# sourceMappingURL=stream-message.service.js.map

package/dist/services/stream-message.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream-message.service.js","sourceRoot":"","sources":["../../src/services/stream-message.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAGrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AACzF,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,SAAS,IAAI,eAAe,GAC7B,MAAM,2BAA2B,CAAC;AAGnC,MAAM,WAAW,GAAG,CAAC,CAAC;AAEtB,MAAM,OAAO,oBAAoB;IACvB,IAAI,CAA2B;IAEvC,YAAY,IAA+B;QACzC,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,IAAI,wBAAwB,EAAE,CAAC;IACrD,CAAC;IAED,kBAAkB,GAAG,kBAAkB,CAAC;IAExC,KAAK,CAAC,SAAS,CAAC,cAAsB,EAAE,OAAe;QACrD,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,EAAE,CAAC;YACzC,KAAK,CAAC,uCAAuC,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,CAAC;YACxE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,eAAe,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,OAAyD,EACzD,UAAU,GAAG,CAAC,EACd,MAAqB;QAErB,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAA4D,CAAC,CAAC;QAEhG,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,KAAK,CAAC,uCAAuC,EAAE;gBAC7C,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;aACtC,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;QAC7D,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACtC,KAAK,CAAC,iCAAiC,EAAE;gBACvC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;aAC3C,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;QAChE,CAAC;QAED,IAAI,CAAC,2BAA2B,EAAE;YAChC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;QAEH,IAAI,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAE/D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;YACzD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YAC/E,KAAK,GAAG;gBACN,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,WAAW;gBACX,UAAU;gBACV,MAAM,EAAE,SAAS;gBACjB,QAAQ,EAAE,EAAE;gBACZ,eAAe,EAAE,CAAC;gBAClB,aAAa,EAAE,CAAC;gBAChB,YAAY,EAAE,CAAC;gBACf,SAAS,EAAE,EAAE;gBACb,eAAe,EAAE,KAAK;gBACtB,OAAO,EAAE,CAAC;gBACV,eAAe,EAAE,CAAC;gBAClB,eAAe,EAAE,EAAE;gBACnB,gBAAgB,EAAE,EAAE;aACrB,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC;YACzB,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,MAAM,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC;oBACjD,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;oBAChC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;iBACzB,CAAC,CAAC;gBACH,IAAI,SAAS,EAAE,MAAM,EAAE,CAAC;oBACtB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC;wBACjD,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,CAAC,MAAM,EAAE;wBAC/B,MAAM,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE;qBAC9B,CAAC,CAAC;oBACH,IAAI,IAAI,EAAE,WAAW,EAAE,CAAC;wBACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAkD,CAAC;wBACzE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC;wBACrE,IAAI,OAAO,EAAE,IAAI;4BAAE,KAAK,CAAC,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;oBACnD,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,oCAAoC;YACtC,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAgB,MAAM,iBAAiB,CAAC,KAAK,EAAE;YAC9D,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,WAAW,CAAC,SAAS,CAAC;QACxC,MAAM,aAAa,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC;QAC7C,MAAM,YAAY,GAAG,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC9D,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,SAAS,CAAC,gBAAgB,GAAG,YAAY,CAAC;QAC5C,CAAC;QACD,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC;YAC7B,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,WAAW,CAAC,QAAQ;YAC7B,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,WAAqB,EAAE,SAAS,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACtE,IAAI,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,UAAU,GAAG,WAAW,EAAE,CAAC;gBACtE,IAAI,CAAC,kCAAkC,EAAE;oBACvC,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,UAAU,EAAE,UAAU,GAAG,CAAC;iBAC3B,CAAC,CAAC;gBACH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAC9C,KAAK,CAAC,WAAqB,EAC3B,MAAM,CAAC,MAAM,CACd,CAAC;gBACF,IAAI,UAAU,EAAE,CAAC;oBACf,UAAU,CAAC,eAAe,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;oBACzF,MAAM,gBAAgB,GAAG,MAAM,iBAAiB,CAAC,UAAU,EAAE;wBAC3D,MAAM,EAAE,MAAM,CAAC,MAAM;wBACrB,OAAO,EAAE,MAAM,CAAC,OAAO;wBACvB,OAAO,EAAE,KAAK;qBACf,CAAC,CAAC;oBACH,MAAM,kBAAkB,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC;oBACvD,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;oBACzF,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACjC,gBAAgB,CAAC,SAAS,CAAC,gBAAgB,GAAG,iBAAiB,CAAC;oBAClE,CAAC;oBACD,gBAAgB,CAAC,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC;wBAC9C,IAAI,EAAE,WAAW;wBACjB,OAAO,EAAE,gBAAgB,CAAC,QAAQ;wBAClC,OAAO,EAAE,KAAK;qBACf,CAAC,CAAC;oBACH,OAAO,IAAI,CAAC,6BAA6B,CACvC,OAAO,EACP,gBAAgB,EAChB,UAAU,EACV,UAAU,GAAG,CAAC,CACf,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QAC7C,CAAC;QAED,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC;IAC3D,CAAC;IAEO,KAAK,CAAC,6BAA6B,CACzC,OAAyD,EACzD,WAAwB,EACxB,KAAqB,EACrB,UAAkB;QAElB,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAA4D,CAAC,CAAC;QAChG,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;QAC7D,CAAC;QAED,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC;YAC7C,MAAM,YAAY,GAAG,WAAW,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YAC1E,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,WAAW,CAAC,SAAS,CAAC,gBAAgB,GAAG,YAAY,CAAC;YACxD,CAAC;YACD,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,WAAqB,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;QACpF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACtE,IAAI,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,UAAU,GAAG,WAAW,EAAE,CAAC;gBACtE,OAAO,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC;YAC5D,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QAC7C,CAAC;QAED,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC;IAC3D,CAAC;IAEO,KAAK,CAAC,wBAAwB;QACpC,MAAM,IAAI,GAAG,IAAI,kBAAkB,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACvC,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC;QAClE,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC,EAAE,CAAC;QACnC,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;IAClE,CAAC;CACF;AAED,+BAA+B;AAC/B,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAE/F,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAA0D,EAC1D,MAAqB;IAErB,MAAM,IAAI,GAAG,IAAI,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC/C,OAAO,OAAO,CAAC,oBAAoB,CAAC,OAAO,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;AAC1D,CAAC"}

package/dist/services/template-dimension.service.d.ts

@@ -0,0 +1,21 @@
+import { PrismaClient } from '@prisma/client';
+export declare function updateTemplateDimensions(prisma: PrismaClient, templateId: string, dimensions: {
+    id: string;
+    label: string;
+    description?: string;
+    keywords?: string[];
+}[]): Promise<{
+    id: string;
+    status: import(".prisma/client").$Enums.TemplateStatus;
+    version: number;
+    createdAt: Date;
+    updatedAt: Date;
+    name: string;
+    description: string | null;
+    content: string;
+    dimensions: import("@prisma/client/runtime/library").JsonValue | null;
+    analysisConfig: import("@prisma/client/runtime/library").JsonValue | null;
+    createdBy: string;
+    updatedBy: string;
+}>;
+//# sourceMappingURL=template-dimension.service.d.ts.map

package/dist/services/template-dimension.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"template-dimension.service.d.ts","sourceRoot":"","sources":["../../src/services/template-dimension.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAG9C,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,YAAY,EACpB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE;IACV,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB,EAAE;;;;;;;;;;;;;GAQJ"}

package/dist/services/template-dimension.service.js

@@ -0,0 +1,9 @@
+import { dimensionsArraySchema } from '../schemas/dimensions.js';
+export async function updateTemplateDimensions(prisma, templateId, dimensions) {
+    dimensionsArraySchema.parse(dimensions);
+    return prisma.template.update({
+        where: { id: templateId },
+        data: { dimensions, updatedAt: new Date() },
+    });
+}
+//# sourceMappingURL=template-dimension.service.js.map

package/dist/services/template-dimension.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"template-dimension.service.js","sourceRoot":"","sources":["../../src/services/template-dimension.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAoB,EACpB,UAAkB,EAClB,UAKG;IAEH,qBAAqB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAExC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC5B,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE;QACzB,IAAI,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;KAC5C,CAAC,CAAC;AACL,CAAC"}

package/dist/utils/db.d.ts

@@ -0,0 +1,10 @@
+import { PrismaClient } from '@prisma/client';
+/**
+ * Get or create the singleton PrismaClient instance.
+ * Use sparingly — prefer DI (constructor injection) for most cases.
+ * This exists for fire-and-forget background tasks (e.g., analyzingNode)
+ * where threading DI through the graph would be excessive.
+ */
+export declare function getDb(): PrismaClient;
+export declare function shutdownDb(): Promise<void>;
+//# sourceMappingURL=db.d.ts.map

package/dist/utils/db.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/utils/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAI9C;;;;;GAKG;AACH,wBAAgB,KAAK,IAAI,YAAY,CAKpC;AAED,wBAAsB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAKhD"}

package/dist/utils/db.js

@@ -0,0 +1,21 @@
+import { PrismaClient } from '@prisma/client';
+let _prisma = null;
+/**
+ * Get or create the singleton PrismaClient instance.
+ * Use sparingly — prefer DI (constructor injection) for most cases.
+ * This exists for fire-and-forget background tasks (e.g., analyzingNode)
+ * where threading DI through the graph would be excessive.
+ */
+export function getDb() {
+    if (!_prisma) {
+        _prisma = new PrismaClient();
+    }
+    return _prisma;
+}
+export async function shutdownDb() {
+    if (_prisma) {
+        await _prisma.$disconnect();
+        _prisma = null;
+    }
+}
+//# sourceMappingURL=db.js.map

package/dist/utils/db.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.js","sourceRoot":"","sources":["../../src/utils/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,IAAI,OAAO,GAAwB,IAAI,CAAC;AAExC;;;;;GAKG;AACH,MAAM,UAAU,KAAK;IACnB,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,IAAI,YAAY,EAAE,CAAC;IAC/B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC;QAC5B,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;AACH,CAAC"}

package/dist/utils/logger.d.ts

@@ -0,0 +1,8 @@
+import pino from 'pino';
+declare const logger: pino.Logger<never, boolean>;
+export declare function info(message: string, meta?: Record<string, unknown>): void;
+export declare function warn(message: string, meta?: Record<string, unknown>): void;
+export declare function error(message: string, meta?: Record<string, unknown>): void;
+export declare function debug(message: string, meta?: Record<string, unknown>): void;
+export { logger };
+//# sourceMappingURL=logger.d.ts.map

package/dist/utils/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/utils/logger.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,QAAA,MAAM,MAAM,6BAMV,CAAC;AAEH,wBAAgB,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,QAEnE;AAED,wBAAgB,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,QAEnE;AAED,wBAAgB,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,QAEpE;AAED,wBAAgB,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,QAEpE;AAED,OAAO,EAAE,MAAM,EAAE,CAAC"}

package/dist/utils/logger.js

@@ -0,0 +1,21 @@
+import pino from 'pino';
+const logger = pino({
+    level: process.env.LOG_LEVEL || 'info',
+    transport: process.env.NODE_ENV === 'development'
+        ? { target: 'pino-pretty', options: { colorize: true } }
+        : undefined,
+});
+export function info(message, meta) {
+    logger.info(meta, message);
+}
+export function warn(message, meta) {
+    logger.warn(meta, message);
+}
+export function error(message, meta) {
+    logger.error(meta, message);
+}
+export function debug(message, meta) {
+    logger.debug(meta, message);
+}
+export { logger };
+//# sourceMappingURL=logger.js.map

package/dist/utils/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/utils/logger.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,MAAM,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,MAAM;IACtC,SAAS,EACP,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa;QACpC,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;QACxD,CAAC,CAAC,SAAS;CAChB,CAAC,CAAC;AAEH,MAAM,UAAU,IAAI,CAAC,OAAe,EAAE,IAA8B;IAClE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,OAAe,EAAE,IAA8B;IAClE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,OAAe,EAAE,IAA8B;IACnE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,OAAe,EAAE,IAA8B;IACnE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED,OAAO,EAAE,MAAM,EAAE,CAAC"}

package/dist/utils/markdown.d.ts

@@ -0,0 +1,2 @@
+export declare function renderMarkdown(input: string | null | undefined): string;
+//# sourceMappingURL=markdown.d.ts.map

package/dist/utils/markdown.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"markdown.d.ts","sourceRoot":"","sources":["../../src/utils/markdown.ts"],"names":[],"mappings":"AA6BA,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAWvE"}

package/dist/utils/markdown.js

@@ -0,0 +1,39 @@
+import { Marked } from 'marked';
+import { error } from './logger.js';
+const marked = new Marked({
+    gfm: true,
+    breaks: false,
+});
+// Strip raw HTML tokens to prevent XSS from attacker-influenced LLM output.
+// marked@14 has no built-in sanitizer; we convert `html` block/inline tokens
+// to escaped text so they render visibly but never execute.
+marked.use({
+    walkTokens(token) {
+        if (token.type === 'html') {
+            token.type = 'text';
+            token.text = escapeHtml(token.text ?? '');
+        }
+    },
+});
+function escapeHtml(input) {
+    return input
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+export function renderMarkdown(input) {
+    if (input === null || input === undefined || input === '') {
+        return '';
+    }
+    try {
+        return marked.parse(input, { async: false });
+    }
+    catch (e) {
+        const errMsg = e instanceof Error ? e.message : 'Markdown parse failed';
+        error('renderMarkdown failed', { error: errMsg });
+        return escapeHtml(input);
+    }
+}
+//# sourceMappingURL=markdown.js.map

package/dist/utils/markdown.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"markdown.js","sourceRoot":"","sources":["../../src/utils/markdown.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAc,MAAM,QAAQ,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEpC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC;IACxB,GAAG,EAAE,IAAI;IACT,MAAM,EAAE,KAAK;CACd,CAAC,CAAC;AAEH,4EAA4E;AAC5E,6EAA6E;AAC7E,4DAA4D;AAC5D,MAAM,CAAC,GAAG,CAAC;IACT,UAAU,CAAC,KAAY;QACrB,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1B,KAAK,CAAC,IAAI,GAAG,MAAgB,CAAC;YAC9B,KAAK,CAAC,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;CACF,CAAC,CAAC;AAEH,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAgC;IAC7D,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC1D,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAW,CAAC;IACzD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC;QACxE,KAAK,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAClD,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC"}

package/dist/utils/pii-anonymizer.d.ts

@@ -0,0 +1,2 @@
+export declare function anonymizePII(text: string): string;
+//# sourceMappingURL=pii-anonymizer.d.ts.map

package/dist/utils/pii-anonymizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pii-anonymizer.d.ts","sourceRoot":"","sources":["../../src/utils/pii-anonymizer.ts"],"names":[],"mappings":"AAIA,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAOjD"}

package/dist/utils/pii-anonymizer.js

@@ -0,0 +1,13 @@
+const PHONE_RE = /\b1[3-9]\d{9}\b/g;
+const EMAIL_RE = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g;
+const CHINESE_NAME_RE = /[\u4e00-\u9fa5]{2,4}(?:说|的|表示|反映|提到|认为|反馈|也同意)/g;
+export function anonymizePII(text) {
+    if (!text)
+        return '';
+    let result = text;
+    result = result.replace(PHONE_RE, (m) => `${m.slice(0, 3)}****${m.slice(7)}`);
+    result = result.replace(EMAIL_RE, '[邮箱]');
+    result = result.replace(CHINESE_NAME_RE, '[匿名用户]');
+    return result;
+}
+//# sourceMappingURL=pii-anonymizer.js.map

package/dist/utils/pii-anonymizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pii-anonymizer.js","sourceRoot":"","sources":["../../src/utils/pii-anonymizer.ts"],"names":[],"mappings":"AAAA,MAAM,QAAQ,GAAG,kBAAkB,CAAC;AACpC,MAAM,QAAQ,GAAG,iDAAiD,CAAC;AACnE,MAAM,eAAe,GAAG,iDAAiD,CAAC;AAE1E,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9E,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/utils/retry.d.ts

@@ -0,0 +1,8 @@
+export interface RetryOptions {
+    maxRetries: number;
+    initialDelayMs: number;
+    maxDelayMs: number;
+    backoffMultiplier: number;
+}
+export declare function withRetry<T>(fn: () => Promise<T>, options?: Partial<RetryOptions>): Promise<T>;
+//# sourceMappingURL=retry.d.ts.map

package/dist/utils/retry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retry.d.ts","sourceRoot":"","sources":["../../src/utils/retry.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AASD,wBAAsB,SAAS,CAAC,CAAC,EAC/B,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,OAAO,GAAE,OAAO,CAAC,YAAY,CAAM,GAClC,OAAO,CAAC,CAAC,CAAC,CAmBZ"}

package/dist/utils/retry.js

@@ -0,0 +1,28 @@
+const DEFAULT_OPTIONS = {
+    maxRetries: 3,
+    initialDelayMs: 1000,
+    maxDelayMs: 10000,
+    backoffMultiplier: 2,
+};
+export async function withRetry(fn, options = {}) {
+    const opts = { ...DEFAULT_OPTIONS, ...options };
+    let lastError;
+    let delay = opts.initialDelayMs;
+    for (let attempt = 0; attempt <= opts.maxRetries; attempt++) {
+        try {
+            return await fn();
+        }
+        catch (e) {
+            lastError = e instanceof Error ? e : new Error(String(e));
+            if (attempt < opts.maxRetries) {
+                await sleep(delay);
+                delay = Math.min(delay * opts.backoffMultiplier, opts.maxDelayMs);
+            }
+        }
+    }
+    throw lastError || new Error('Retry failed');
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+//# sourceMappingURL=retry.js.map

package/dist/utils/retry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"retry.js","sourceRoot":"","sources":["../../src/utils/retry.ts"],"names":[],"mappings":"AAOA,MAAM,eAAe,GAAiB;IACpC,UAAU,EAAE,CAAC;IACb,cAAc,EAAE,IAAI;IACpB,UAAU,EAAE,KAAK;IACjB,iBAAiB,EAAE,CAAC;CACrB,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,EAAoB,EACpB,UAAiC,EAAE;IAEnC,MAAM,IAAI,GAAG,EAAE,GAAG,eAAe,EAAE,GAAG,OAAO,EAAE,CAAC;IAChD,IAAI,SAA4B,CAAC;IACjC,IAAI,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC;IAEhC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;QAC5D,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,SAAS,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAE1D,IAAI,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC9B,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;gBACnB,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,SAAS,IAAI,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/utils/security.d.ts

@@ -0,0 +1,26 @@
+import type { PrismaClient } from '@prisma/client';
+import type { FastifyInstance, FastifyReply, FastifyRequest } from 'fastify';
+export interface AuthUser {
+    userId: string;
+    role: 'admin' | 'user';
+    apiKeyId?: string;
+}
+declare module 'fastify' {
+    interface FastifyRequest {
+        user?: AuthUser;
+    }
+}
+export declare function hashApiKey(apiKey: string): string;
+export declare function createVerifyApiKey(prisma: PrismaClient): (request: FastifyRequest, reply: FastifyReply) => Promise<undefined>;
+export declare function logSecurityEvent(prisma: PrismaClient, params: {
+    action: string;
+    entityType: string;
+    entityId?: string;
+    userId?: string;
+    details?: Record<string, unknown>;
+    ipAddress?: string;
+}): Promise<void>;
+export declare function anonymizeData(data: string): string;
+export declare function generateApiKey(): string;
+export declare function securityMiddleware(fastify: FastifyInstance, prisma: PrismaClient): Promise<void>;
+//# sourceMappingURL=security.d.ts.map

package/dist/utils/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../src/utils/security.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE7E,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,cAAc;QACtB,IAAI,CAAC,EAAE,QAAQ,CAAC;KACjB;CACF;AAMD,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEjD;AAaD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,YAAY,IAClB,SAAS,cAAc,EAAE,OAAO,YAAY,wBAgChF;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE;IACN,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,iBAYF;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAelD;AAED,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,YAAY,iBA2BtF"}

package/dist/utils/security.js

@@ -0,0 +1,99 @@
+import crypto from 'node:crypto';
+const RATE_LIMIT_WINDOW_MS = 60_000;
+const MAX_FAILED_ATTEMPTS = 5;
+const failedAttempts = new Map();
+export function hashApiKey(apiKey) {
+    return crypto.createHash('sha256').update(apiKey).digest('hex');
+}
+function checkRateLimit(ipAddress) {
+    const now = Date.now();
+    const entry = failedAttempts.get(ipAddress);
+    if (!entry || now - entry.windowStart > RATE_LIMIT_WINDOW_MS) {
+        failedAttempts.set(ipAddress, { count: 1, windowStart: now });
+        return true;
+    }
+    entry.count += 1;
+    return entry.count <= MAX_FAILED_ATTEMPTS;
+}
+export function createVerifyApiKey(prisma) {
+    return async function verifyApiKey(request, reply) {
+        // Allow GET requests without authentication (public read-only access)
+        if (request.method === 'GET' || request.method === 'HEAD' || request.method === 'OPTIONS') {
+            return;
+        }
+        const apiKey = request.headers['x-api-key'];
+        if (!apiKey) {
+            return reply.status(401).send({ error: 'API key required' });
+        }
+        const ip = request.ip || 'unknown';
+        if (!checkRateLimit(ip)) {
+            return reply.status(429).send({ error: 'Too many failed attempts' });
+        }
+        const keyHash = hashApiKey(apiKey);
+        const keyRecord = await prisma.apiKey.findFirst({
+            where: { keyHash, revoked: false },
+        });
+        if (!keyRecord) {
+            return reply.status(401).send({ error: 'Invalid API key' });
+        }
+        request.user = {
+            userId: keyRecord.userId || 'unknown',
+            role: keyRecord.role,
+            apiKeyId: keyRecord.id,
+        };
+    };
+}
+export async function logSecurityEvent(prisma, params) {
+    await prisma.auditLog.create({
+        data: {
+            action: params.action,
+            entityType: params.entityType,
+            entityId: params.entityId,
+            userId: params.userId,
+            details: params.details ? JSON.stringify(params.details) : undefined,
+            ipAddress: params.ipAddress,
+        },
+    });
+}
+export function anonymizeData(data) {
+    const patterns = [
+        { regex: /1[3-9]\d{9}/g, replacement: '1XXXXXXXXXX' },
+        {
+            regex: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/g,
+            replacement: 'xxx@xxx.xxx',
+        },
+        { regex: /\b\d{17}[\dXx]\b/g, replacement: 'XXXXXXXXXXXXXXXXX' },
+    ];
+    let result = data;
+    for (const { regex, replacement } of patterns) {
+        result = result.replace(regex, replacement);
+    }
+    return result;
+}
+export function generateApiKey() {
+    return `ib_${crypto.randomBytes(32).toString('hex')}`;
+}
+export async function securityMiddleware(fastify, prisma) {
+    fastify.addHook('onRequest', async (request, _reply) => {
+        const path = request.url;
+        // Skip logging for health checks and static assets
+        if (path.startsWith('/health') || path.startsWith('/public/')) {
+            return;
+        }
+        // Only log mutations (POST/PUT/DELETE) and admin paths
+        // GET/HEAD/OPTIONS requests are not logged to reduce audit log volume
+        const isMutation = request.method === 'POST' || request.method === 'PUT' || request.method === 'DELETE';
+        const isAdmin = path.startsWith('/admin/');
+        if (!isMutation && !isAdmin) {
+            return;
+        }
+        const ipAddress = request.ip;
+        await logSecurityEvent(prisma, {
+            action: 'REQUEST',
+            entityType: 'api',
+            details: { method: request.method, path },
+            ipAddress,
+        });
+    });
+}
+//# sourceMappingURL=security.js.map

package/dist/utils/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../src/utils/security.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAgBjC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AACpC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkD,CAAC;AAEjF,MAAM,UAAU,UAAU,CAAC,MAAc;IACvC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,WAAW,GAAG,oBAAoB,EAAE,CAAC;QAC7D,cAAc,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;IACjB,OAAO,KAAK,CAAC,KAAK,IAAI,mBAAmB,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAoB;IACrD,OAAO,KAAK,UAAU,YAAY,CAAC,OAAuB,EAAE,KAAmB;QAC7E,sEAAsE;QACtE,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1F,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAuB,CAAC;QAElE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,SAAS,CAAC;QACnC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,EAAE,CAAC;YACxB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;YAC9C,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE;SACnC,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,OAAO,CAAC,IAAI,GAAG;YACb,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,SAAS;YACrC,IAAI,EAAE,SAAS,CAAC,IAAwB;YACxC,QAAQ,EAAE,SAAS,CAAC,EAAE;SACvB,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAoB,EACpB,MAOC;IAED,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC3B,IAAI,EAAE;YACJ,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;YACpE,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,QAAQ,GAAG;QACf,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,aAAa,EAAE;QACrD;YACE,KAAK,EAAE,sDAAsD;YAC7D,WAAW,EAAE,aAAa;SAC3B;QACD,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,mBAAmB,EAAE;KACjE,CAAC;IAEF,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC9C,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAwB,EAAE,MAAoB;IACrF,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC;QAEzB,mDAAmD;QACnD,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9D,OAAO;QACT,CAAC;QAED,uDAAuD;QACvD,sEAAsE;QACtE,MAAM,UAAU,GACd,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC;QACvF,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC;QAE7B,MAAM,gBAAgB,CAAC,MAAM,EAAE;YAC7B,MAAM,EAAE,SAAS;YACjB,UAAU,EAAE,KAAK;YACjB,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE;YACzC,SAAS;SACV,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}