fastify-wrap 0.1.0

package/dist/src/common/auth/JwtStrategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"JwtStrategy.js","sourceRoot":"","sources":["../../../../src/common/auth/JwtStrategy.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAEvC,MAAM,OAAO,WAAW;IACd,OAAO,CAAkB;IAEjC,YAAY,OAAwB;QAClC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAuB,EAAE,MAAoB,EAAE,WAAoB;QACpF,MAAM,OAAO,CAAC,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAY,CAAC;QAElC,4EAA4E;QAC5E,yDAAyD;QACzD,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;YACzB,MAAM,YAAY,GAAW,GAAG,IAAI,CAAC,IAAI,cAAc,IAAI,CAAC,EAAE,EAAE,CAAC;YACjE,IAAI,CAAC;gBACH,MAAM,WAAW,GAAY,MAAM,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBAC9D,IAAI,WAAW,EAAE,CAAC;oBAChB,MAAM,GAAG,GAAoC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;oBAClE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;oBACrB,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,MAAM,KAAK,GAAa,GAA+B,CAAC,UAAU,KAAK,GAAG,CAAC;gBAC3E,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,GAAG,CAAC;gBACZ,CAAC;gBACD,8CAA8C;gBAC9C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,EAAE,4CAA4C,CAAC,CAAC;YAC7F,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/src/common/auth/NonceStore.d.ts

@@ -0,0 +1,22 @@
+export interface NonceStore {
+    /**
+     * Atomically check if nonce is new and mark it used.
+     * @returns true if nonce is allowed (first use), false if replay.
+     */
+    checkAndSet(nonce: string, ttlSeconds: number): Promise<boolean>;
+}
+/**
+ * In-memory nonce store. Default, single-instance only.
+ */
+export declare class MemoryNonceStore implements NonceStore {
+    private cache;
+    checkAndSet(nonce: string, ttlSeconds: number): Promise<boolean>;
+}
+/**
+ * Redis-backed nonce store. Uses SET NX EX for atomic check-and-set.
+ * Requires redis module to be initialized (config.redis).
+ */
+export declare class RedisNonceStore implements NonceStore {
+    checkAndSet(nonce: string, ttlSeconds: number): Promise<boolean>;
+}
+//# sourceMappingURL=NonceStore.d.ts.map

package/dist/src/common/auth/NonceStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"NonceStore.d.ts","sourceRoot":"","sources":["../../../../src/common/auth/NonceStore.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAClE;AAED;;GAEG;AACH,qBAAa,gBAAiB,YAAW,UAAU;IACjD,OAAO,CAAC,KAAK,CAAkC;IAEzC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CASvE;AAED;;;GAGG;AACH,qBAAa,eAAgB,YAAW,UAAU;IAC1C,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAKvE"}

package/dist/src/common/auth/NonceStore.js

@@ -0,0 +1,27 @@
+/**
+ * In-memory nonce store. Default, single-instance only.
+ */
+export class MemoryNonceStore {
+    cache = new Map();
+    async checkAndSet(nonce, ttlSeconds) {
+        const now = Date.now();
+        const expiry = this.cache.get(nonce);
+        if (expiry !== undefined && expiry > now) {
+            return false;
+        }
+        this.cache.set(nonce, now + ttlSeconds * 1000);
+        return true;
+    }
+}
+/**
+ * Redis-backed nonce store. Uses SET NX EX for atomic check-and-set.
+ * Requires redis module to be initialized (config.redis).
+ */
+export class RedisNonceStore {
+    async checkAndSet(nonce, ttlSeconds) {
+        // Dynamic import to avoid circular dependency at module load time
+        const { redis } = await import('../redis/index');
+        return redis.setnx(`nonce:${nonce}`, '1', ttlSeconds);
+    }
+}
+//# sourceMappingURL=NonceStore.js.map

package/dist/src/common/auth/NonceStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"NonceStore.js","sourceRoot":"","sources":["../../../../src/common/auth/NonceStore.ts"],"names":[],"mappings":"AAQA;;GAEG;AACH,MAAM,OAAO,gBAAgB;IACnB,KAAK,GAAwB,IAAI,GAAG,EAAE,CAAC;IAE/C,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,UAAkB;QACjD,MAAM,GAAG,GAAW,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAuB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;YACzC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,eAAe;IAC1B,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,UAAkB;QACjD,kEAAkE;QAClE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACjD,OAAO,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IACxD,CAAC;CACF"}

package/dist/src/common/auth/SecretResolvers.d.ts

@@ -0,0 +1,18 @@
+import type { SecretResolver } from './SignatureStrategy';
+export interface DbSecretResolverOptions {
+    /** Table name. Default: 'api_keys'. */
+    tableName?: string;
+    /** Column for clientId lookup. Default: 'client_id'. */
+    clientIdColumn?: string;
+    /** Column for secret key. Default: 'secret_key'. */
+    secretColumn?: string;
+    /** Column for module name. Default: 'module_name'. */
+    moduleNameColumn?: string;
+}
+export declare function createDbSecretResolver(options?: DbSecretResolverOptions): SecretResolver;
+export interface RedisSecretResolverOptions {
+    /** Key prefix. Default: 'client:secret:'. Full key = prefix + clientId. */
+    keyPrefix?: string;
+}
+export declare function createRedisSecretResolver(options?: RedisSecretResolverOptions): SecretResolver;
+//# sourceMappingURL=SecretResolvers.d.ts.map

package/dist/src/common/auth/SecretResolvers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretResolvers.d.ts","sourceRoot":"","sources":["../../../../src/common/auth/SecretResolvers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAgB,MAAM,qBAAqB,CAAC;AAIxE,MAAM,WAAW,uBAAuB;IACtC,uCAAuC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wDAAwD;IACxD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oDAAoD;IACpD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sDAAsD;IACtD,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAgB,sBAAsB,CAAC,OAAO,GAAE,uBAA4B,GAAG,cAAc,CAoB5F;AAED,MAAM,WAAW,0BAA0B;IACzC,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,yBAAyB,CAAC,OAAO,GAAE,0BAA+B,GAAG,cAAc,CAWlG"}

package/dist/src/common/auth/SecretResolvers.js

@@ -0,0 +1,30 @@
+import { db } from '../db/index';
+import { redis } from '../redis/index';
+export function createDbSecretResolver(options = {}) {
+    const tableName = options.tableName ?? 'api_keys';
+    const keyCol = options.clientIdColumn ?? 'client_id';
+    const secretCol = options.secretColumn ?? 'secret_key';
+    const moduleNameCol = options.moduleNameColumn ?? 'module_name';
+    return async (clientId, moduleName) => {
+        const row = await db.queryOne(`SELECT ${secretCol}, ${moduleNameCol} FROM ${tableName} WHERE ${keyCol} = ?`, [clientId]);
+        if (!row) {
+            return null;
+        }
+        return {
+            appSecret: row[secretCol],
+            moduleName: row[moduleNameCol],
+        };
+    };
+}
+export function createRedisSecretResolver(options = {}) {
+    const keyPrefix = options.keyPrefix ?? 'client:secret:';
+    return async (clientId, moduleName) => {
+        const json = await redis.get(`${keyPrefix}${clientId}`);
+        if (!json) {
+            return null;
+        }
+        const parsed = JSON.parse(json);
+        return parsed;
+    };
+}
+//# sourceMappingURL=SecretResolvers.js.map

package/dist/src/common/auth/SecretResolvers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretResolvers.js","sourceRoot":"","sources":["../../../../src/common/auth/SecretResolvers.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAavC,MAAM,UAAU,sBAAsB,CAAC,UAAmC,EAAE;IAC1E,MAAM,SAAS,GAAW,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC;IAC1D,MAAM,MAAM,GAAW,OAAO,CAAC,cAAc,IAAI,WAAW,CAAC;IAC7D,MAAM,SAAS,GAAW,OAAO,CAAC,YAAY,IAAI,YAAY,CAAC;IAC/D,MAAM,aAAa,GAAW,OAAO,CAAC,gBAAgB,IAAI,aAAa,CAAC;IAExE,OAAO,KAAK,EAAE,QAAgB,EAAE,UAAkB,EAAgC,EAAE;QAElF,MAAM,GAAG,GAAe,MAAM,EAAE,CAAC,QAAQ,CACvC,UAAU,SAAS,KAAK,aAAa,SAAS,SAAS,UAAU,MAAM,MAAM,EAC7E,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,SAAS,EAAE,GAAG,CAAC,SAAS,CAAW;YACnC,UAAU,EAAE,GAAG,CAAC,aAAa,CAAW;SACzC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAOD,MAAM,UAAU,yBAAyB,CAAC,UAAsC,EAAE;IAChF,MAAM,SAAS,GAAW,OAAO,CAAC,SAAS,IAAI,gBAAgB,CAAC;IAEhE,OAAO,KAAK,EAAE,QAAgB,EAAE,UAAkB,EAAgC,EAAE;QAClF,MAAM,IAAI,GAAkB,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,SAAS,GAAG,QAAQ,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAiB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAiB,CAAC;QAC9D,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/src/common/auth/SignatureStrategy.d.ts

@@ -0,0 +1,23 @@
+import type { FastifyRequest, FastifyReply } from 'fastify';
+import type { AuthStrategy } from './AuthStrategy';
+import type { User } from '../../types';
+import { type NonceStore } from './NonceStore';
+export interface SecretResult {
+    appSecret: string;
+    moduleName?: string;
+}
+export type SecretResolver = (appKey: string, moduleName: string) => Promise<SecretResult | null>;
+export interface SignatureOptions {
+    resolveSecret: SecretResolver;
+    timestampWindowMs?: number;
+    /** Nonce store for replay protection. Default: MemoryNonceStore. */
+    nonceStore?: NonceStore;
+}
+export declare class SignatureStrategy implements AuthStrategy {
+    private resolveSecret;
+    private windowMs;
+    private nonceStore;
+    constructor(options: SignatureOptions);
+    authenticate(request: FastifyRequest, reply: FastifyReply, moduleName?: string): Promise<User>;
+}
+//# sourceMappingURL=SignatureStrategy.d.ts.map

package/dist/src/common/auth/SignatureStrategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SignatureStrategy.d.ts","sourceRoot":"","sources":["../../../../src/common/auth/SignatureStrategy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AASjE,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;AAElG,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,cAAc,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oEAAoE;IACpE,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AA0CD,qBAAa,iBAAkB,YAAW,YAAY;IACpD,OAAO,CAAC,aAAa,CAAiB;IACtC,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,UAAU,CAAa;gBAEnB,OAAO,EAAE,gBAAgB;IAM/B,YAAY,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAmErG"}

package/dist/src/common/auth/SignatureStrategy.js

@@ -0,0 +1,115 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { MemoryNonceStore } from './NonceStore';
+const HEADER_KEY = 'x-app-key';
+const HEADER_TIMESTAMP = 'x-timestamp';
+const HEADER_NONCE = 'x-nonce';
+const HEADER_SIGNATURE = 'x-signature';
+const DEFAULT_WINDOW_MS = 5 * 60 * 1000;
+function canonicalBody(body) {
+    if (body === null || body === undefined) {
+        return '';
+    }
+    if (typeof body !== 'object') {
+        return String(body);
+    }
+    const keys = Object.keys(body).sort();
+    return JSON.stringify(body, keys);
+}
+function computeSignature(secret, stringToSign) {
+    return createHmac('sha256', secret).update(stringToSign).digest('base64');
+}
+function constantTimeEqual(a, b) {
+    // Treat absent signature the same as empty string
+    if (a === undefined && b === undefined)
+        return true;
+    if (a === undefined || b === undefined)
+        return false;
+    const bufA = Buffer.from(a);
+    const bufB = Buffer.from(b);
+    return bufA.length === bufB.length && timingSafeEqual(bufA, bufB);
+}
+function extractBodyForSign(request) {
+    const contentType = request.headers['content-type'];
+    if (contentType === undefined || !contentType.includes('multipart/form-data')) {
+        return request.body;
+    }
+    if (request.body === undefined || request.body === null) {
+        return {};
+    }
+    const body = request.body;
+    const signField = body._sign_body;
+    if (signField === undefined || signField.value === undefined) {
+        return {};
+    }
+    return JSON.parse(signField.value);
+}
+export class SignatureStrategy {
+    resolveSecret;
+    windowMs;
+    nonceStore;
+    constructor(options) {
+        this.resolveSecret = options.resolveSecret;
+        this.windowMs = options.timestampWindowMs ?? DEFAULT_WINDOW_MS;
+        this.nonceStore = options.nonceStore ?? new MemoryNonceStore();
+    }
+    async authenticate(request, reply, moduleName) {
+        const appKey = request.headers[HEADER_KEY];
+        const timestamp = request.headers[HEADER_TIMESTAMP];
+        const nonce = request.headers[HEADER_NONCE];
+        const clientSignature = request.headers[HEADER_SIGNATURE];
+        const clientInfo = { appKey, timestamp, nonce, clientSignature };
+        if (!appKey || !timestamp || !nonce || !clientSignature) {
+            request.log.warn({ clientInfo }, 'Signature auth: missing headers');
+            return reply.status(401).send({ code: 'error', error: '签名验证失败' });
+        }
+        // Timestamp freshness
+        const ts = Number(timestamp);
+        if (isNaN(ts)) {
+            request.log.warn({ clientInfo }, 'Signature auth: invalid timestamp format');
+            return reply.status(401).send({ code: 'error', error: '签名验证失败' });
+        }
+        const now = Date.now();
+        if (Math.abs(now - ts) > this.windowMs) {
+            request.log.warn({ clientInfo, now, windowMs: this.windowMs }, 'Signature auth: timestamp expired');
+            return reply.status(401).send({ code: 'error', error: '签名验证失败' });
+        }
+        // Nonce replay check
+        const ttlSeconds = Math.ceil(this.windowMs / 1000);
+        const isNew = await this.nonceStore.checkAndSet(nonce, ttlSeconds);
+        if (!isNew) {
+            request.log.warn({ clientInfo }, 'Signature auth: nonce replay detected');
+            return reply.status(401).send({ code: 'error', error: '签名验证失败' });
+        }
+        // Look up secret
+        const result = await this.resolveSecret(appKey, moduleName ?? '');
+        if (!result) {
+            request.log.warn({ appKey }, 'Signature auth: appKey not found or expired');
+            return reply.status(401).send({ code: 'retry', error: '凭证无效或已过期' });
+        }
+        // Compute expected signature
+        const method = request.method;
+        const path = request.url;
+        const bodyStr = canonicalBody(extractBodyForSign(request));
+        const stringToSign = `${method}\n${path}\n${timestamp}\n${nonce}\n${bodyStr}`;
+        const expectedSignature = computeSignature(result.appSecret, stringToSign);
+        if (!constantTimeEqual(expectedSignature, clientSignature)) {
+            request.log.warn({
+                appKey,
+                method,
+                path,
+                timestamp,
+                nonce,
+                bodyStr,
+                stringToSign,
+                expectedSignature,
+                clientSignature,
+            }, 'Signature auth: signature mismatch');
+            return reply.status(401).send({ code: 'error', error: '签名验证失败' });
+        }
+        const user = {
+            id: appKey,
+        };
+        return user;
+    }
+}
+//# sourceMappingURL=SignatureStrategy.js.map

package/dist/src/common/auth/SignatureStrategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SignatureStrategy.js","sourceRoot":"","sources":["../../../../src/common/auth/SignatureStrategy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAI1D,OAAO,EAAE,gBAAgB,EAAmB,MAAM,cAAc,CAAC;AAEjE,MAAM,UAAU,GAAG,WAAW,CAAC;AAC/B,MAAM,gBAAgB,GAAG,aAAa,CAAC;AACvC,MAAM,YAAY,GAAG,SAAS,CAAC;AAC/B,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAEvC,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAgBxC,SAAS,aAAa,CAAC,IAAa;IAClC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IACD,MAAM,IAAI,GAAa,MAAM,CAAC,IAAI,CAAC,IAA+B,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3E,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc,EAAE,YAAoB;IAC5D,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,kDAAkD;IAClD,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACrD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAuB;IACjD,MAAM,WAAW,GAAuB,OAAO,CAAC,OAAO,CAAC,cAAc,CAAuB,CAAC;IAC9F,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;QAC9E,OAAO,OAAO,CAAC,IAAI,CAAC;IACtB,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACxD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAA+B,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,UAA4C,CAAC;IACpE,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7D,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,OAAO,iBAAiB;IACpB,aAAa,CAAiB;IAC9B,QAAQ,CAAS;IACjB,UAAU,CAAa;IAE/B,YAAY,OAAyB;QACnC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,iBAAiB,IAAI,iBAAiB,CAAC;QAC/D,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,gBAAgB,EAAE,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAuB,EAAE,KAAmB,EAAE,UAAmB;QAClF,MAAM,MAAM,GAAuB,OAAO,CAAC,OAAO,CAAC,UAAU,CAAuB,CAAC;QACrF,MAAM,SAAS,GAAuB,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAuB,CAAC;QAC9F,MAAM,KAAK,GAAuB,OAAO,CAAC,OAAO,CAAC,YAAY,CAAuB,CAAC;QACtF,MAAM,eAAe,GAAuB,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAuB,CAAC;QAEpG,MAAM,UAAU,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;QAEjE,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,IAAI,CAAC,eAAe,EAAE,CAAC;YACxD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,EAAE,iCAAiC,CAAC,CAAC;YACpE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAU,CAAC;QAC7E,CAAC;QAED,sBAAsB;QACtB,MAAM,EAAE,GAAW,MAAM,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,EAAE,0CAA0C,CAAC,CAAC;YAC7E,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAU,CAAC;QAC7E,CAAC;QACD,MAAM,GAAG,GAAW,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,mCAAmC,CAAC,CAAC;YACpG,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAU,CAAC;QAC7E,CAAC;QAED,qBAAqB;QACrB,MAAM,UAAU,GAAW,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAY,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC5E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,EAAE,uCAAuC,CAAC,CAAC;YAC1E,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAU,CAAC;QAC7E,CAAC;QAED,iBAAiB;QACjB,MAAM,MAAM,GAAwB,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC;QACvF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,6CAA6C,CAAC,CAAC;YAC5E,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAU,CAAC;QAC/E,CAAC;QAED,6BAA6B;QAC7B,MAAM,MAAM,GAAW,OAAO,CAAC,MAAM,CAAC;QACtC,MAAM,IAAI,GAAW,OAAO,CAAC,GAAG,CAAC;QACjC,MAAM,OAAO,GAAW,aAAa,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;QACnE,MAAM,YAAY,GAAW,GAAG,MAAM,KAAK,IAAI,KAAK,SAAS,KAAK,KAAK,KAAK,OAAO,EAAE,CAAC;QACtF,MAAM,iBAAiB,GAAW,gBAAgB,CAAC,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAEnF,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,eAAe,CAAC,EAAE,CAAC;YAC3D,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;gBACf,MAAM;gBACN,MAAM;gBACN,IAAI;gBACJ,SAAS;gBACT,KAAK;gBACL,OAAO;gBACP,YAAY;gBACZ,iBAAiB;gBACjB,eAAe;aAChB,EAAE,oCAAoC,CAAC,CAAC;YACzC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAU,CAAC;QAC7E,CAAC;QAED,MAAM,IAAI,GAAS;YACjB,EAAE,EAAE,MAAM;SACX,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/src/common/auth/index.d.ts

@@ -0,0 +1,4 @@
+export type { AuthStrategy } from './AuthStrategy';
+export { JwtStrategy } from './JwtStrategy';
+export { signToken, initSignToken } from './signToken';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/common/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/common/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC"}

package/dist/src/common/auth/index.js

@@ -0,0 +1,3 @@
+export { JwtStrategy } from './JwtStrategy';
+export { signToken, initSignToken } from './signToken';
+//# sourceMappingURL=index.js.map

package/dist/src/common/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/common/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC"}

package/dist/src/common/auth/signToken.d.ts

@@ -0,0 +1,4 @@
+import type { FastifyInstance } from 'fastify';
+export declare function initSignToken(fastify: FastifyInstance): void;
+export declare function signToken(payload: Record<string, unknown>): Promise<string>;
+//# sourceMappingURL=signToken.d.ts.map

package/dist/src/common/auth/signToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signToken.d.ts","sourceRoot":"","sources":["../../../../src/common/auth/signToken.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAI/C,wBAAgB,aAAa,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,CAG5D;AAED,wBAAsB,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAKjF"}

package/dist/src/common/auth/signToken.js

@@ -0,0 +1,11 @@
+let _sign;
+export function initSignToken(fastify) {
+    _sign = (payload) => Promise.resolve(fastify.jwt.sign(payload));
+}
+export async function signToken(payload) {
+    if (!_sign) {
+        throw new Error('signToken not initialized. Ensure JWT plugin is registered.');
+    }
+    return _sign(payload);
+}
+//# sourceMappingURL=signToken.js.map

package/dist/src/common/auth/signToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signToken.js","sourceRoot":"","sources":["../../../../src/common/auth/signToken.ts"],"names":[],"mappings":"AAEA,IAAI,KAA0E,CAAC;AAE/E,MAAM,UAAU,aAAa,CAAC,OAAwB;IACpD,KAAK,GAAG,CAAC,OAAgC,EAAE,EAAE,CAC3C,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAgC;IAC9D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC;AACxB,CAAC"}

package/dist/src/common/config/loader.d.ts

@@ -0,0 +1,10 @@
+import type { AppConfig } from '../../types';
+/**
+ * Load config based on APP_ENV environment variable.
+ *
+ * APP_ENV=test   → config/test.ts
+ * APP_ENV=prod   → config/production.ts
+ * (unset)        → config/development.ts
+ */
+export declare function loadConfig(): Promise<AppConfig>;
+//# sourceMappingURL=loader.d.ts.map

package/dist/src/common/config/loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../../../src/common/config/loader.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C;;;;;;GAMG;AACH,wBAAsB,UAAU,IAAI,OAAO,CAAC,SAAS,CAAC,CAUrD"}

package/dist/src/common/config/loader.js

@@ -0,0 +1,20 @@
+import { existsSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { pathToFileURL } from 'node:url';
+/**
+ * Load config based on APP_ENV environment variable.
+ *
+ * APP_ENV=test   → config/test.ts
+ * APP_ENV=prod   → config/production.ts
+ * (unset)        → config/development.ts
+ */
+export async function loadConfig() {
+    const env = process.env.APP_ENV || 'development';
+    const configPath = resolve(process.cwd(), 'config', `${env}.ts`);
+    if (!existsSync(configPath)) {
+        throw new Error(`Config file not found: ${configPath} (APP_ENV=${env})`);
+    }
+    const mod = await import(pathToFileURL(configPath).href);
+    return mod.default;
+}
+//# sourceMappingURL=loader.js.map

package/dist/src/common/config/loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../../../src/common/config/loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,GAAG,GAAW,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,aAAa,CAAC;IACzD,MAAM,UAAU,GAAW,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,GAAG,GAAG,KAAK,CAAC,CAAC;IAEzE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,0BAA0B,UAAU,aAAa,GAAG,GAAG,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC;IACzD,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC"}

package/dist/src/common/container/index.d.ts

@@ -0,0 +1,7 @@
+export declare class Container {
+    private instances;
+    register<T>(token: Function, instance: T): void;
+    resolve<T>(token: Function): T;
+}
+export declare const container: Container;
+//# sourceMappingURL=index.d.ts.map

package/dist/src/common/container/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/common/container/index.ts"],"names":[],"mappings":"AAAA,qBAAa,SAAS;IACpB,OAAO,CAAC,SAAS,CAAgC;IAEjD,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI;IAI/C,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,GAAG,CAAC;CAO/B;AAED,eAAO,MAAM,SAAS,WAAkB,CAAC"}

package/dist/src/common/container/index.js

@@ -0,0 +1,15 @@
+export class Container {
+    instances = new Map();
+    register(token, instance) {
+        this.instances.set(token, instance);
+    }
+    resolve(token) {
+        const instance = this.instances.get(token);
+        if (instance === undefined) {
+            throw new Error(`No instance registered for ${token.name}`);
+        }
+        return instance;
+    }
+}
+export const container = new Container();
+//# sourceMappingURL=index.js.map

package/dist/src/common/container/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/common/container/index.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,SAAS;IACZ,SAAS,GAAG,IAAI,GAAG,EAAqB,CAAC;IAEjD,QAAQ,CAAI,KAAe,EAAE,QAAW;QACtC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACtC,CAAC;IAED,OAAO,CAAI,KAAe;QACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,8BAA8B,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,QAAa,CAAC;IACvB,CAAC;CACF;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC"}

package/dist/src/common/db/index.d.ts

@@ -0,0 +1,19 @@
+import type { Knex } from 'knex';
+import type { ResultSetHeader } from 'mysql2';
+export declare function initDb(knex: Knex): void;
+export interface Transaction {
+    query<T>(sql: string, params?: unknown[]): Promise<T[]>;
+    queryOne<T>(sql: string, params?: unknown[]): Promise<T | null>;
+    insert(sql: string, params?: unknown[]): Promise<ResultSetHeader>;
+    execute(sql: string, params?: unknown[]): Promise<number>;
+}
+export declare function knex(tableName: string): Knex.QueryBuilder;
+export declare const db: {
+    query<T>(sql: string, params?: unknown[]): Promise<T[]>;
+    queryOne<T>(sql: string, params?: unknown[]): Promise<T | null>;
+    insert(sql: string, params?: unknown[]): Promise<ResultSetHeader>;
+    execute(sql: string, params?: unknown[]): Promise<number>;
+    /** Runs fn within a single MySQL transaction. Rolls back on error. */
+    transaction<T>(fn: (tx: Transaction) => Promise<T>): Promise<T>;
+};
+//# sourceMappingURL=index.d.ts.map

package/dist/src/common/db/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/common/db/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAI9C,wBAAgB,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAEvC;AASD,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IACxD,QAAQ,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAChE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3D;AAED,wBAAgB,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC,YAAY,CAEzD;AASD,eAAO,MAAM,EAAE;UACD,CAAC,OAAO,MAAM,WAAW,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;aAK9C,CAAC,OAAO,MAAM,WAAW,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;gBAKnD,MAAM,WAAW,OAAO,EAAE,GAAG,OAAO,CAAC,eAAe,CAAC;iBAKpD,MAAM,WAAW,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAK/D,sEAAsE;gBACpD,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CAwBtE,CAAC"}

package/dist/src/common/db/index.js

@@ -0,0 +1,64 @@
+let _knex = null;
+export function initDb(knex) {
+    _knex = knex;
+}
+function getKnex() {
+    if (_knex === null) {
+        throw new Error('db not initialized — call initDb(knex) during app startup');
+    }
+    return _knex;
+}
+export function knex(tableName) {
+    return getKnex()(tableName);
+}
+function bindings(params) {
+    if (!params)
+        return [];
+    // Replace undefined with null to prevent Knex raw query binding errors.
+    // Callers should default optional fields, this is a safety net.
+    return params.map((v) => (v === undefined ? null : v));
+}
+export const db = {
+    async query(sql, params) {
+        const result = await getKnex().raw(sql, bindings(params));
+        return result[0];
+    },
+    async queryOne(sql, params) {
+        const rows = await db.query(sql, params);
+        return rows.length > 0 ? rows[0] : null;
+    },
+    async insert(sql, params) {
+        const result = await getKnex().raw(sql, bindings(params));
+        return result[0];
+    },
+    async execute(sql, params) {
+        const result = await getKnex().raw(sql, bindings(params));
+        return result[0].affectedRows;
+    },
+    /** Runs fn within a single MySQL transaction. Rolls back on error. */
+    async transaction(fn) {
+        return getKnex().transaction(async (trx) => {
+            const tx = {
+                async query(sql, params) {
+                    const r = await trx.raw(sql, bindings(params));
+                    return r[0];
+                },
+                async queryOne(sql, params) {
+                    const r = await trx.raw(sql, bindings(params));
+                    const arr = r[0];
+                    return arr.length > 0 ? arr[0] : null;
+                },
+                async insert(sql, params) {
+                    const r = await trx.raw(sql, bindings(params));
+                    return r[0];
+                },
+                async execute(sql, params) {
+                    const r = await trx.raw(sql, bindings(params));
+                    return r[0].affectedRows;
+                },
+            };
+            return fn(tx);
+        });
+    },
+};
+//# sourceMappingURL=index.js.map

package/dist/src/common/db/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/common/db/index.ts"],"names":[],"mappings":"AAGA,IAAI,KAAK,GAAgB,IAAI,CAAC;AAE9B,MAAM,UAAU,MAAM,CAAC,IAAU;IAC/B,KAAK,GAAG,IAAI,CAAC;AACf,CAAC;AAED,SAAS,OAAO;IACd,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AASD,MAAM,UAAU,IAAI,CAAC,SAAiB;IACpC,OAAO,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,QAAQ,CAAC,MAA6B;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,EAAgC,CAAC;IACrD,wEAAwE;IACxE,gEAAgE;IAChE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAA+B,CAAC;AAChG,CAAC;AAED,MAAM,CAAC,MAAM,EAAE,GAAG;IAChB,KAAK,CAAC,KAAK,CAAI,GAAW,EAAE,MAAkB;QAC5C,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1D,OAAO,MAAM,CAAC,CAAC,CAAQ,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,QAAQ,CAAI,GAAW,EAAE,MAAkB;QAC/C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAI,GAAG,EAAE,MAAM,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,MAAkB;QAC1C,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1D,OAAO,MAAM,CAAC,CAAC,CAAoB,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAW,EAAE,MAAkB;QAC3C,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1D,OAAQ,MAAM,CAAC,CAAC,CAAqB,CAAC,YAAY,CAAC;IACrD,CAAC;IAED,sEAAsE;IACtE,KAAK,CAAC,WAAW,CAAI,EAAmC;QACtD,OAAO,OAAO,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACzC,MAAM,EAAE,GAAgB;gBACtB,KAAK,CAAC,KAAK,CAAI,GAAW,EAAE,MAAkB;oBAC5C,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;oBAC/C,OAAO,CAAC,CAAC,CAAC,CAAQ,CAAC;gBACrB,CAAC;gBACD,KAAK,CAAC,QAAQ,CAAI,GAAW,EAAE,MAAkB;oBAC/C,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;oBAC/C,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAQ,CAAC;oBACxB,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBACxC,CAAC;gBACD,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,MAAkB;oBAC1C,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;oBAC/C,OAAO,CAAC,CAAC,CAAC,CAAoB,CAAC;gBACjC,CAAC;gBACD,KAAK,CAAC,OAAO,CAAC,GAAW,EAAE,MAAkB;oBAC3C,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;oBAC/C,OAAQ,CAAC,CAAC,CAAC,CAAqB,CAAC,YAAY,CAAC;gBAChD,CAAC;aACF,CAAC;YACF,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAC"}

package/dist/src/common/dto/PageResult.d.ts

@@ -0,0 +1,12 @@
+export interface PageResult<T> {
+    items: T[];
+    total: number;
+    page: number;
+    pageSize: number;
+}
+/** DAO-layer paginated query result — raw rows without page/pageSize context */
+export interface PagedRows<T> {
+    rows: T[];
+    total: number;
+}
+//# sourceMappingURL=PageResult.d.ts.map

package/dist/src/common/dto/PageResult.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PageResult.d.ts","sourceRoot":"","sources":["../../../../src/common/dto/PageResult.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,UAAU,CAAC,CAAC;IAC3B,KAAK,EAAE,CAAC,EAAE,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,gFAAgF;AAChF,MAAM,WAAW,SAAS,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,EAAE,CAAC;IACV,KAAK,EAAE,MAAM,CAAC;CACf"}

package/dist/src/common/dto/PageResult.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=PageResult.js.map

package/dist/src/common/dto/PageResult.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PageResult.js","sourceRoot":"","sources":["../../../../src/common/dto/PageResult.ts"],"names":[],"mappings":""}

package/dist/src/common/errorHandler.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyError, FastifyReply, FastifyRequest } from 'fastify';
+export declare function errorHandler(error: FastifyError | Error, request: FastifyRequest, reply: FastifyReply): void;
+//# sourceMappingURL=errorHandler.d.ts.map

package/dist/src/common/errorHandler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errorHandler.d.ts","sourceRoot":"","sources":["../../../src/common/errorHandler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAO1E,wBAAgB,YAAY,CAC1B,KAAK,EAAE,YAAY,GAAG,KAAK,EAC3B,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,YAAY,GAClB,IAAI,CA8CN"}

package/dist/src/common/errorHandler.js

@@ -0,0 +1,47 @@
+import { BaseException } from './exceptions/BaseException';
+import { AuthException } from './exceptions/AuthException';
+import { BusinessException } from './exceptions/BusinessException';
+import { NotFoundException } from './exceptions/NotFoundException';
+import { ServiceException } from './exceptions/ServiceException';
+export function errorHandler(error, request, reply) {
+    // AuthException → 401 with code:login (key not found, token expired, etc.)
+    if (error instanceof AuthException) {
+        reply.status(401).send({ code: 'login', error: error.message });
+        return;
+    }
+    // Known business exceptions — 404 is reserved for route-not-found only
+    if (error instanceof NotFoundException || error instanceof BusinessException) {
+        reply.status(422).send({ error: error.message });
+        return;
+    }
+    if (error instanceof ServiceException) {
+        reply.status(500).send({ error: '服务器内部错误' });
+        return;
+    }
+    if (error instanceof BaseException) {
+        reply.status(500).send({ error: '服务器内部错误' });
+        return;
+    }
+    // Fastify schema validation error — message already formatted by schemaErrorFormatter
+    if ('validation' in error && error.validation) {
+        reply.status(422).send({ error: error.message });
+        return;
+    }
+    // Fastify schema validation error
+    if (error.name === 'FastifyError' && 'statusCode' in error) {
+        const statusCode = error.statusCode;
+        if (statusCode !== undefined && statusCode < 500) {
+            // JWT auth errors → unified code:login
+            if (statusCode === 401) {
+                reply.status(401).send({ code: 'login', error: error.message });
+                return;
+            }
+            reply.status(statusCode).send({ error: error.message });
+            return;
+        }
+    }
+    // Unknown error → 500, generic message
+    request.log.error(error, 'Unhandled error');
+    reply.status(500).send({ error: '服务器内部错误' });
+}
+//# sourceMappingURL=errorHandler.js.map

package/dist/src/common/errorHandler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errorHandler.js","sourceRoot":"","sources":["../../../src/common/errorHandler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEjE,MAAM,UAAU,YAAY,CAC1B,KAA2B,EAC3B,OAAuB,EACvB,KAAmB;IAEnB,2EAA2E;IAC3E,IAAI,KAAK,YAAY,aAAa,EAAE,CAAC;QACnC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAChE,OAAO;IACT,CAAC;IAED,uEAAuE;IACvE,IAAI,KAAK,YAAY,iBAAiB,IAAI,KAAK,YAAY,iBAAiB,EAAE,CAAC;QAC7E,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACjD,OAAO;IACT,CAAC;IAED,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;QACtC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC7C,OAAO;IACT,CAAC;IAED,IAAI,KAAK,YAAY,aAAa,EAAE,CAAC;QACnC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC7C,OAAO;IACT,CAAC;IAED,sFAAsF;IACtF,IAAI,YAAY,IAAI,KAAK,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QAC9C,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACjD,OAAO;IACT,CAAC;IAED,kCAAkC;IAClC,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,YAAY,IAAI,KAAK,EAAE,CAAC;QAC3D,MAAM,UAAU,GAAI,KAAsB,CAAC,UAAU,CAAC;QACtD,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,GAAG,GAAG,EAAE,CAAC;YACjD,uCAAuC;YACvC,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;gBACvB,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAChE,OAAO;YACT,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IAC5C,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;AAC/C,CAAC"}

package/dist/src/common/exceptions/AuthException.d.ts

@@ -0,0 +1,5 @@
+import { BaseException } from './BaseException';
+export declare class AuthException extends BaseException {
+    constructor(message: string);
+}
+//# sourceMappingURL=AuthException.d.ts.map

package/dist/src/common/exceptions/AuthException.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthException.d.ts","sourceRoot":"","sources":["../../../../src/common/exceptions/AuthException.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,qBAAa,aAAc,SAAQ,aAAa;gBAClC,OAAO,EAAE,MAAM;CAI5B"}

package/dist/src/common/exceptions/AuthException.js

@@ -0,0 +1,8 @@
+import { BaseException } from './BaseException';
+export class AuthException extends BaseException {
+    constructor(message) {
+        super(message);
+        this.name = 'AuthException';
+    }
+}
+//# sourceMappingURL=AuthException.js.map

package/dist/src/common/exceptions/AuthException.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthException.js","sourceRoot":"","sources":["../../../../src/common/exceptions/AuthException.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,MAAM,OAAO,aAAc,SAAQ,aAAa;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF"}

package/dist/src/common/exceptions/BaseException.d.ts

@@ -0,0 +1,4 @@
+export declare class BaseException extends Error {
+    constructor(message: string);
+}
+//# sourceMappingURL=BaseException.d.ts.map

package/dist/src/common/exceptions/BaseException.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BaseException.d.ts","sourceRoot":"","sources":["../../../../src/common/exceptions/BaseException.ts"],"names":[],"mappings":"AAAA,qBAAa,aAAc,SAAQ,KAAK;gBAC1B,OAAO,EAAE,MAAM;CAI5B"}