pipework 0.67.0 → 0.69.0

package/dist/infra/storage/s3.d.ts

@@ -0,0 +1,34 @@
+import { type AwsCredentials } from '../aws/sigv4.js';
+import type { StorageBackend } from './backend.js';
+export type S3Encryption = {
+    readonly type: 'AES256';
+} | {
+    readonly type: 'aws:kms';
+    readonly keyId?: string;
+};
+export interface S3Config {
+    readonly bucket: string;
+    readonly region: string;
+    /** Base URL of an S3-compatible server, e.g. `http://127.0.0.1:9000`. Default `https://s3.<region>.amazonaws.com`. */
+    readonly endpoint?: string;
+    /** Address the bucket in the path (`<endpoint>/<bucket>/<key>`) rather than the host. Default: true when `endpoint` is given, false otherwise. */
+    readonly forcePathStyle?: boolean;
+    /** Called for every request, so short-lived credentials can be refreshed by the app. */
+    readonly credentials: () => Promise<AwsCredentials>;
+    /** Prepended to every key, e.g. `verity/`. */
+    readonly prefix?: string;
+    /** Server-side encryption, sent with every write (PutObject, CreateMultipartUpload, CopyObject). */
+    readonly encryption?: S3Encryption;
+}
+/** Size of each multipart upload part; a body that fits in one is sent with a single PutObject. */
+export declare const PART_SIZE: number;
+/** The headers that ask S3 to encrypt a written object. */
+export declare function encryptionHeaders(encryption: S3Encryption | undefined): Record<string, string>;
+/**
+ * S3-compatible storage (AWS S3, MinIO, R2, ...) over `fetch` with SigV4; no AWS SDK.
+ * Bodies are uploaded in 8 MiB parts (multipart) unless the whole body fits in one,
+ * and the signature does not cover the payload (`UNSIGNED-PAYLOAD`), so use `https`
+ * endpoints in production. A failed upload aborts its multipart upload.
+ */
+export declare function s3(config: S3Config): StorageBackend;
+//# sourceMappingURL=s3.d.ts.map

package/dist/infra/storage/s3.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3.d.ts","sourceRoot":"","sources":["../../../src/infra/storage/s3.ts"],"names":[],"mappings":"AAEA,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAExE,OAAO,KAAK,EAA0C,cAAc,EAAE,MAAM,cAAc,CAAA;AAE1F,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AAEzD,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,sHAAsH;IACtH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,kJAAkJ;IAClJ,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,wFAAwF;IACxF,QAAQ,CAAC,WAAW,EAAE,MAAM,OAAO,CAAC,cAAc,CAAC,CAAA;IACnD,8CAA8C;IAC9C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,oGAAoG;IACpG,QAAQ,CAAC,UAAU,CAAC,EAAE,YAAY,CAAA;CACnC;AAED,mGAAmG;AACnG,eAAO,MAAM,SAAS,QAAkB,CAAA;AAGxC,2DAA2D;AAC3D,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,YAAY,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAO9F;AAuBD;;;;;GAKG;AACH,wBAAgB,EAAE,CAAC,MAAM,EAAE,QAAQ,GAAG,cAAc,CAwLnD"}

package/dist/infra/storage/s3.js

@@ -0,0 +1,220 @@
+import { Readable } from 'node:stream';
+import { createHash } from 'node:crypto';
+import { signV4, presignV4 } from '../aws/sigv4.js';
+import { contentDisposition } from '../../request/http/file.js';
+/** Size of each multipart upload part; a body that fits in one is sent with a single PutObject. */
+export const PART_SIZE = 8 * 1024 * 1024;
+const EMPTY_SHA256 = createHash('sha256').update('').digest('hex');
+/** The headers that ask S3 to encrypt a written object. */
+export function encryptionHeaders(encryption) {
+    if (encryption === undefined)
+        return {};
+    if (encryption.type === 'AES256')
+        return { 'x-amz-server-side-encryption': 'AES256' };
+    return {
+        'x-amz-server-side-encryption': 'aws:kms',
+        ...(encryption.keyId !== undefined ? { 'x-amz-server-side-encryption-aws-kms-key-id': encryption.keyId } : {}),
+    };
+}
+function encodePath(key) {
+    return key.split('/').map(seg => encodeURIComponent(seg).replace(/[!'()*]/g, c => `%${c.charCodeAt(0).toString(16).toUpperCase()}`)).join('/');
+}
+function unescapeXml(s) {
+    return s.replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&quot;/g, '"').replace(/&apos;/g, "'").replace(/&amp;/g, '&');
+}
+function xmlTag(xml, tag) {
+    const m = new RegExp(`<${tag}>([\\s\\S]*?)</${tag}>`).exec(xml);
+    return m === null ? null : unescapeXml(m[1]);
+}
+/**
+ * S3-compatible storage (AWS S3, MinIO, R2, ...) over `fetch` with SigV4; no AWS SDK.
+ * Bodies are uploaded in 8 MiB parts (multipart) unless the whole body fits in one,
+ * and the signature does not cover the payload (`UNSIGNED-PAYLOAD`), so use `https`
+ * endpoints in production. A failed upload aborts its multipart upload.
+ */
+export function s3(config) {
+    const endpoint = (config.endpoint ?? `https://s3.${config.region}.amazonaws.com`).replace(/\/+$/, '');
+    const pathStyle = config.forcePathStyle ?? config.endpoint !== undefined;
+    const prefix = config.prefix ?? '';
+    const write = encryptionHeaders(config.encryption);
+    function urlFor(key, query = {}) {
+        const base = new URL(endpoint);
+        const objectPath = key === undefined ? '' : `/${encodePath(prefix + key)}`;
+        let origin = base.origin;
+        let path;
+        if (pathStyle)
+            path = `${base.pathname.replace(/\/+$/, '')}/${encodeURIComponent(config.bucket)}${objectPath}`;
+        else {
+            origin = `${base.protocol}//${config.bucket}.${base.host}`;
+            path = `${base.pathname.replace(/\/+$/, '')}${objectPath === '' ? '/' : objectPath}`;
+        }
+        const qs = Object.entries(query).map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`).join('&');
+        return `${origin}${path}${qs === '' ? '' : `?${qs}`}`;
+    }
+    async function call(c) {
+        const credentials = await config.credentials();
+        const body = c.body ?? Buffer.alloc(0);
+        const payloadHash = c.body === undefined ? EMPTY_SHA256 : 'UNSIGNED-PAYLOAD';
+        const url = urlFor(c.key, c.query);
+        const headers = signV4({
+            method: c.method, url, region: config.region, service: 's3', credentials, body, payloadHash,
+            headers: { ...c.headers, 'x-amz-content-sha256': payloadHash },
+        });
+        return fetch(url, {
+            method: c.method, headers,
+            ...(c.body !== undefined ? { body: new Uint8Array(c.body.buffer, c.body.byteOffset, c.body.byteLength) } : {}),
+        });
+    }
+    async function ok(op, res, allowed = []) {
+        const text = await res.text();
+        if ((res.status >= 200 && res.status < 300 && !(text.startsWith('<?xml') && /<Error>/.test(text))) || allowed.includes(res.status))
+            return text;
+        const code = xmlTag(text, 'Code');
+        const message = xmlTag(text, 'Message');
+        throw new Error(`[pipework] storage s3 ${op} failed: HTTP ${res.status}${code !== null ? ` ${code}` : ''}${message !== null ? `: ${message}` : ''}.\n`);
+    }
+    async function putWhole(key, body) {
+        await ok('PutObject', await call({ method: 'PUT', key, body, headers: { 'content-type': 'application/octet-stream', ...write } }));
+    }
+    async function putMultipart(key, first, rest, pending) {
+        const created = await ok('CreateMultipartUpload', await call({
+            method: 'POST', key, query: { uploads: '' }, headers: { 'content-type': 'application/octet-stream', ...write },
+        }));
+        const uploadId = xmlTag(created, 'UploadId');
+        if (uploadId === null)
+            throw new Error('[pipework] storage s3 CreateMultipartUpload returned no UploadId.\n');
+        const etags = [];
+        try {
+            const sendPart = async (part) => {
+                const number = etags.length + 1;
+                const res = await call({ method: 'PUT', key, query: { partNumber: String(number), uploadId }, body: part });
+                await ok('UploadPart', res);
+                const etag = res.headers.get('etag');
+                if (etag === null)
+                    throw new Error('[pipework] storage s3 UploadPart returned no ETag.\n');
+                etags.push(etag);
+            };
+            await sendPart(first);
+            // `pending` holds what the first read left over beyond one part.
+            let buffered = pending;
+            let size = buffered.reduce((n, b) => n + b.length, 0);
+            for (;;) {
+                while (size >= PART_SIZE) {
+                    const all = Buffer.concat(buffered);
+                    await sendPart(all.subarray(0, PART_SIZE));
+                    const remainder = all.subarray(PART_SIZE);
+                    buffered = remainder.length > 0 ? [remainder] : [];
+                    size = remainder.length;
+                }
+                const next = await rest.next();
+                if (next.done === true)
+                    break;
+                buffered.push(next.value);
+                size += next.value.length;
+            }
+            if (size > 0)
+                await sendPart(Buffer.concat(buffered));
+            const xml = '<CompleteMultipartUpload>' +
+                etags.map((e, i) => `<Part><PartNumber>${i + 1}</PartNumber><ETag>${e}</ETag></Part>`).join('') +
+                '</CompleteMultipartUpload>';
+            const payload = Buffer.from(xml, 'utf8');
+            await ok('CompleteMultipartUpload', await call({ method: 'POST', key, query: { uploadId }, body: payload, headers: { 'content-type': 'application/xml' } }));
+        }
+        catch (err) {
+            try {
+                await ok('AbortMultipartUpload', await call({ method: 'DELETE', key, query: { uploadId } }), [404]);
+            }
+            catch {
+                // the original failure is the one to report
+            }
+            throw err;
+        }
+    }
+    return {
+        name: 's3',
+        async put(key, body) {
+            const iterator = (async function* () {
+                for await (const chunk of body)
+                    yield Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+            })();
+            const chunks = [];
+            let size = 0;
+            try {
+                while (size < PART_SIZE) {
+                    const next = await iterator.next();
+                    if (next.done === true) {
+                        await putWhole(key, Buffer.concat(chunks));
+                        return;
+                    }
+                    chunks.push(next.value);
+                    size += next.value.length;
+                }
+            }
+            catch (err) {
+                await iterator.return(undefined).catch(() => undefined);
+                throw err;
+            }
+            const all = Buffer.concat(chunks);
+            const rest = all.length > PART_SIZE ? [all.subarray(PART_SIZE)] : [];
+            try {
+                await putMultipart(key, all.subarray(0, PART_SIZE), iterator, rest);
+            }
+            finally {
+                await iterator.return(undefined).catch(() => undefined);
+            }
+        },
+        async exists(key) {
+            const res = await call({ method: 'HEAD', key });
+            await res.arrayBuffer();
+            if (res.status === 404)
+                return false;
+            if (res.status >= 200 && res.status < 300)
+                return true;
+            throw new Error(`[pipework] storage s3 HeadObject failed: HTTP ${res.status}.\n`);
+        },
+        async copy(from, to) {
+            const source = `/${encodePath(config.bucket)}/${encodePath(prefix + from)}`;
+            await ok('CopyObject', await call({ method: 'PUT', key: to, headers: { 'x-amz-copy-source': source, ...write } }));
+        },
+        async remove(key) {
+            await ok('DeleteObject', await call({ method: 'DELETE', key }), [404]);
+        },
+        async read(key) {
+            const res = await call({ method: 'GET', key });
+            if (res.status < 200 || res.status >= 300 || res.body === null) {
+                await ok('GetObject', res);
+                throw new Error('[pipework] storage s3 GetObject returned no body.\n');
+            }
+            return Readable.fromWeb(res.body);
+        },
+        async *list(listPrefix) {
+            let token;
+            do {
+                const query = { 'list-type': '2', prefix: prefix + listPrefix };
+                if (token !== undefined)
+                    query['continuation-token'] = token;
+                const xml = await ok('ListObjectsV2', await call({ method: 'GET', query }));
+                for (const m of xml.matchAll(/<Contents>([\s\S]*?)<\/Contents>/g)) {
+                    const key = xmlTag(m[1], 'Key');
+                    const modified = xmlTag(m[1], 'LastModified');
+                    if (key === null || modified === null || !key.startsWith(prefix))
+                        continue;
+                    yield { key: key.slice(prefix.length), lastModified: new Date(modified) };
+                }
+                token = xmlTag(xml, 'IsTruncated') === 'true' ? (xmlTag(xml, 'NextContinuationToken') ?? undefined) : undefined;
+            } while (token !== undefined);
+        },
+        async signedUrl(key, options) {
+            const credentials = await config.credentials();
+            return presignV4({
+                method: 'GET',
+                url: urlFor(key, {
+                    'response-content-disposition': contentDisposition(options.disposition, options.filename),
+                    'response-content-type': options.mediaType,
+                }),
+                region: config.region, service: 's3', credentials, expiresInSeconds: options.expiresInSeconds,
+            });
+        },
+    };
+}
+//# sourceMappingURL=s3.js.map

package/dist/infra/storage/s3.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3.js","sourceRoot":"","sources":["../../../src/infra/storage/s3.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAuB,MAAM,iBAAiB,CAAA;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAA;AAsB/D,mGAAmG;AACnG,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AACxC,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAElE,2DAA2D;AAC3D,MAAM,UAAU,iBAAiB,CAAC,UAAoC;IACpE,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,EAAE,CAAA;IACvC,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,8BAA8B,EAAE,QAAQ,EAAE,CAAA;IACrF,OAAO;QACL,8BAA8B,EAAE,SAAS;QACzC,GAAG,CAAC,UAAU,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,6CAA6C,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/G,CAAA;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAChJ,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;AAC7H,CAAC;AAED,SAAS,MAAM,CAAC,GAAW,EAAE,GAAW;IACtC,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,GAAG,kBAAkB,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC/D,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAA;AAC/C,CAAC;AAUD;;;;;GAKG;AACH,MAAM,UAAU,EAAE,CAAC,MAAgB;IACjC,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,cAAc,MAAM,CAAC,MAAM,gBAAgB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACrG,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAA;IACxE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAA;IAClC,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IAElD,SAAS,MAAM,CAAC,GAAuB,EAAE,QAAgC,EAAE;QACzE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC9B,MAAM,UAAU,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAA;QAC1E,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;QACxB,IAAI,IAAY,CAAA;QAChB,IAAI,SAAS;YAAE,IAAI,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,UAAU,EAAE,CAAA;aACzG,CAAC;YACJ,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,CAAA;YAC1D,IAAI,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,CAAA;QACtF,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAC/G,OAAO,GAAG,MAAM,GAAG,IAAI,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAA;IACvD,CAAC;IAED,KAAK,UAAU,IAAI,CAAC,CAAO;QACzB,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAA;QAC9C,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACtC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,kBAAkB,CAAA;QAC5E,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAA;QAClC,MAAM,OAAO,GAAG,MAAM,CAAC;YACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW;YAC3F,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE;SAC/D,CAAC,CAAA;QACF,OAAO,KAAK,CAAC,GAAG,EAAE;YAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO;YACzB,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/G,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,UAAU,EAAE,CAAC,EAAU,EAAE,GAAa,EAAE,UAA6B,EAAE;QAC1E,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAC7B,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAA;QAC/I,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACjC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;QACvC,MAAM,IAAI,KAAK,CACb,yBAAyB,EAAE,iBAAiB,GAAG,CAAC,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CACvI,CAAA;IACH,CAAC;IAED,KAAK,UAAU,QAAQ,CAAC,GAAW,EAAE,IAAY;QAC/C,MAAM,EAAE,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC,CAAA;IACpI,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,GAAW,EAAE,KAAa,EAAE,IAA2B,EAAE,OAAiB;QACpG,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,uBAAuB,EAAE,MAAM,IAAI,CAAC;YAC3D,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,GAAG,KAAK,EAAE;SAC/G,CAAC,CAAC,CAAA;QACH,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;QAC5C,IAAI,QAAQ,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAA;QAC7G,MAAM,KAAK,GAAa,EAAE,CAAA;QAC1B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,KAAK,EAAE,IAAY,EAAiB,EAAE;gBACrD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAA;gBAC/B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;gBAC3G,MAAM,EAAE,CAAC,YAAY,EAAE,GAAG,CAAC,CAAA;gBAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;gBACpC,IAAI,IAAI,KAAK,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;gBAC1F,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAClB,CAAC,CAAA;YACD,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAA;YACrB,iEAAiE;YACjE,IAAI,QAAQ,GAAG,OAAO,CAAA;YACtB,IAAI,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;YACrD,SAAS,CAAC;gBACR,OAAO,IAAI,IAAI,SAAS,EAAE,CAAC;oBACzB,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;oBACnC,MAAM,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAA;oBAC1C,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;oBACzC,QAAQ,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;oBAClD,IAAI,GAAG,SAAS,CAAC,MAAM,CAAA;gBACzB,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;gBAC9B,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;oBAAE,MAAK;gBAC7B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBACzB,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAA;YAC3B,CAAC;YACD,IAAI,IAAI,GAAG,CAAC;gBAAE,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;YACrD,MAAM,GAAG,GAAG,2BAA2B;gBACrC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/F,4BAA4B,CAAA;YAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;YACxC,MAAM,EAAE,CAAC,yBAAyB,EAAE,MAAM,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC,CAAA;QAC9J,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,sBAAsB,EAAE,MAAM,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;YACrG,CAAC;YAAC,MAAM,CAAC;gBACP,4CAA4C;YAC9C,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI,EAAE,IAAI;QAEV,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI;YACjB,MAAM,QAAQ,GAAG,CAAC,KAAK,SAAS,CAAC;gBAC/B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,IAAI;oBAAE,MAAM,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAC3F,CAAC,CAAC,EAAE,CAAA;YACJ,MAAM,MAAM,GAAa,EAAE,CAAA;YAC3B,IAAI,IAAI,GAAG,CAAC,CAAA;YACZ,IAAI,CAAC;gBACH,OAAO,IAAI,GAAG,SAAS,EAAE,CAAC;oBACxB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;oBAClC,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;wBACvB,MAAM,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;wBAC1C,OAAM;oBACR,CAAC;oBACD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;oBACvB,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAA;gBAC3B,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;gBACvD,MAAM,GAAG,CAAA;YACX,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;YACjC,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YACpE,IAAI,CAAC;gBACH,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAA;YACrE,CAAC;oBAAS,CAAC;gBACT,MAAM,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;YACzD,CAAC;QACH,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC/C,MAAM,GAAG,CAAC,WAAW,EAAE,CAAA;YACvB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,KAAK,CAAA;YACpC,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;gBAAE,OAAO,IAAI,CAAA;YACtD,MAAM,IAAI,KAAK,CAAC,iDAAiD,GAAG,CAAC,MAAM,KAAK,CAAC,CAAA;QACnF,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE;YACjB,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAA;YAC3E,MAAM,EAAE,CAAC,YAAY,EAAE,MAAM,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,mBAAmB,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC,CAAA;QACpH,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,MAAM,EAAE,CAAC,cAAc,EAAE,MAAM,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;QACxE,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,GAAG;YACZ,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;YAC9C,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC/D,MAAM,EAAE,CAAC,WAAW,EAAE,GAAG,CAAC,CAAA;gBAC1B,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;YACxE,CAAC;YACD,OAAO,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAa,CAAC,CAAA;QAC5C,CAAC;QAED,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU;YACpB,IAAI,KAAyB,CAAA;YAC7B,GAAG,CAAC;gBACF,MAAM,KAAK,GAA2B,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,EAAE,CAAA;gBACvF,IAAI,KAAK,KAAK,SAAS;oBAAE,KAAK,CAAC,oBAAoB,CAAC,GAAG,KAAK,CAAA;gBAC5D,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,eAAe,EAAE,MAAM,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;gBAC3E,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,mCAAmC,CAAC,EAAE,CAAC;oBAClE,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,KAAK,CAAC,CAAA;oBAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,cAAc,CAAC,CAAA;oBAC9C,IAAI,GAAG,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;wBAAE,SAAQ;oBAC1E,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAA;gBAC3E,CAAC;gBACD,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,aAAa,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,uBAAuB,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YACjH,CAAC,QAAQ,KAAK,KAAK,SAAS,EAAC;QAC/B,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,GAAW,EAAE,OAAgC;YAC3D,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAA;YAC9C,OAAO,SAAS,CAAC;gBACf,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE;oBACf,8BAA8B,EAAE,kBAAkB,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC;oBACzF,uBAAuB,EAAE,OAAO,CAAC,SAAS;iBAC3C,CAAC;gBACF,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;aAC9F,CAAC,CAAA;QACJ,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/infra/storage/schema.d.ts

@@ -0,0 +1,43 @@
+export declare const storageFile: import("../../data/domain/types.js").DefinedTable<{
+    id: import("../../data/domain/types.js").FieldDescriptor<string, {
+        defaultRandom: true;
+        hasDefault: true;
+    } & {
+        primaryKey: true;
+    }> & import("../../data/domain/field.js").FieldModifiers<string, {
+        defaultRandom: true;
+        hasDefault: true;
+    } & {
+        primaryKey: true;
+    }>;
+    tenantId: import("../../data/domain/types.js").FieldDescriptor<string, {}> & import("../../data/domain/field.js").FieldModifiers<string, {}>;
+    sha256: import("../../data/domain/types.js").FieldDescriptor<string, {}> & import("../../data/domain/field.js").FieldModifiers<string, {}>;
+    size: import("../../data/domain/types.js").FieldDescriptor<bigint, {}> & import("../../data/domain/field.js").FieldModifiers<bigint, {}>;
+    mediaType: import("../../data/domain/types.js").FieldDescriptor<string, {}> & import("../../data/domain/field.js").FieldModifiers<string, {}>;
+    filename: import("../../data/domain/types.js").FieldDescriptor<string | null, {
+        nullable: true;
+    }> & import("../../data/domain/field.js").FieldModifiers<string | null, {
+        nullable: true;
+    }>;
+    createdAt: import("../../data/domain/types.js").FieldDescriptor<Date, {
+        hasDefault: true;
+    }> & import("../../data/domain/field.js").FieldModifiers<Date, {
+        hasDefault: true;
+    }>;
+    createdBy: import("../../data/domain/types.js").FieldDescriptor<string | null, {
+        nullable: true;
+    }> & import("../../data/domain/field.js").FieldModifiers<string | null, {
+        nullable: true;
+    }>;
+    expiresAt: import("../../data/domain/types.js").FieldDescriptor<Date | null, {
+        nullable: true;
+    }> & import("../../data/domain/field.js").FieldModifiers<Date | null, {
+        nullable: true;
+    }>;
+    metadata: import("../../data/domain/types.js").FieldDescriptor<import("zod/v4").JSONType, {
+        nullable: true;
+    }> & import("../../data/domain/field.js").FieldModifiers<import("zod/v4").JSONType, {
+        nullable: true;
+    }>;
+}, "storage_file">;
+//# sourceMappingURL=schema.d.ts.map

package/dist/infra/storage/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/infra/storage/schema.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAetB,CAAA"}

package/dist/infra/storage/schema.js

@@ -0,0 +1,23 @@
+// The table behind file storage: one metadata row per stored file, tenant-scoped
+// (forced row-level security in generated migrations). The bytes live in the backend.
+import { define } from '../../data/domain/index.js';
+import { field } from '../../data/domain/field.js';
+import { schema } from '../../data/schema/namespace.js';
+import { index } from '../../data/db/idx/index.js';
+export const storageFile = define('storage_file', {
+    id: field.uuid().defaultRandom().primaryKey(),
+    tenantId: field.uuid().tenant(),
+    sha256: field.text(),
+    size: field.bigint(),
+    mediaType: field.text(),
+    filename: field.text().nullable(),
+    createdAt: field.timestamp().default('now'),
+    createdBy: field.text().nullable(),
+    expiresAt: field.timestamp().nullable(),
+    metadata: field.jsonb(schema.check.json()).nullable(),
+}, {
+    indexes: (t) => ({
+        bySha: index('idx_storage_file_sha').on(t['tenantId'], t['sha256']),
+    }),
+});
+//# sourceMappingURL=schema.js.map

package/dist/infra/storage/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/infra/storage/schema.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,sFAAsF;AAEtF,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAA;AACnD,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAA;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAA;AACvD,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAA;AAElD,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC,cAAc,EAAE;IAChD,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC7C,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE;IAC/B,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE;IACpB,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE;IACpB,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE;IACvB,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC3C,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE;IACvC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;CACtD,EAAE;IACD,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACf,KAAK,EAAE,KAAK,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;KACpE,CAAC;CACH,CAAC,CAAA"}

package/dist/infra/webhook/sign.d.ts

@@ -1,6 +1,8 @@
 export interface WebhookSignatureOptions {
     algorithm?: string;
     encoding?: 'hex' | 'base64';
+    /** Message id to sign and return; default a fresh UUID. Pass a stable id so a retry is recognisable as the same message. */
+    messageId?: string;
 }
 export interface SignedPayload {
     body: string;

package/dist/infra/webhook/sign.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../../../src/infra/webhook/sign.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,uBAAuB;IACtC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAA;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,wBAAgB,WAAW,CACzB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,uBAA4B,GACpC,aAAa,CAWf"}
+{"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../../../src/infra/webhook/sign.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,uBAAuB;IACtC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAA;IAC3B,4HAA4H;IAC5H,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,wBAAgB,WAAW,CACzB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,uBAA4B,GACpC,aAAa,CAWf"}

package/dist/infra/webhook/sign.js

@@ -2,7 +2,7 @@ import { createHmac, randomUUID } from 'node:crypto';
 export function signPayload(payload, secret, options = {}) {
     const algorithm = options.algorithm ?? 'sha256';
     const encoding = options.encoding ?? 'hex';
-    const messageId = randomUUID();
+    const messageId = options.messageId ?? randomUUID();
     const timestamp = Math.floor(Date.now() / 1000);
     const body = typeof payload === 'string' ? payload : JSON.stringify(payload);
     const toSign = `${messageId}.${timestamp}.${body}`;

package/dist/infra/webhook/sign.js.map

@@ -1 +1 @@
-{"version":3,"file":"sign.js","sourceRoot":"","sources":["../../../src/infra/webhook/sign.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAcpD,MAAM,UAAU,WAAW,CACzB,OAAgB,EAChB,MAAc,EACd,UAAmC,EAAE;IAErC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAA;IAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAA;IAE1C,MAAM,SAAS,GAAG,UAAU,EAAE,CAAA;IAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IAC/C,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;IAC5E,MAAM,MAAM,GAAG,GAAG,SAAS,IAAI,SAAS,IAAI,IAAI,EAAE,CAAA;IAClD,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IAE/E,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAA;AAClD,CAAC"}
+{"version":3,"file":"sign.js","sourceRoot":"","sources":["../../../src/infra/webhook/sign.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAgBpD,MAAM,UAAU,WAAW,CACzB,OAAgB,EAChB,MAAc,EACd,UAAmC,EAAE;IAErC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAA;IAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAA;IAE1C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,EAAE,CAAA;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;IAC/C,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;IAC5E,MAAM,MAAM,GAAG,GAAG,SAAS,IAAI,SAAS,IAAI,IAAI,EAAE,CAAA;IAClD,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IAE/E,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAA;AAClD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pipework",
-  "version": "0.67.0",
+  "version": "0.69.0",
   "description": "TypeScript framework for multi-tenant SaaS applications. PostgreSQL-only.",
   "type": "module",
   "license": "MIT",