ysk-omni 1.0.0

package/dist/utils/engine-session.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isUuid = isUuid;
+exports.uuidV5 = uuidV5;
+exports.namespacedEngineSessionId = namespacedEngineSessionId;
+exports.resolveEngineSessionBinding = resolveEngineSessionBinding;
+exports.isSessionAlreadyExistsError = isSessionAlreadyExistsError;
+const node_crypto_1 = require("node:crypto");
+/** DNS namespace UUID (RFC 4122) — stable seed for per-key session ids. */
+const UUID_V5_NAMESPACE = '6ba7b810-9dad-11d1-80b4-00c04fd430c8';
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function isUuid(value) {
+    return UUID_RE.test(value.trim());
+}
+function parseUuidBytes(uuid) {
+    return Buffer.from(uuid.replace(/-/g, ''), 'hex');
+}
+function formatUuid(bytes) {
+    const h = bytes.toString('hex');
+    return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20, 32)}`;
+}
+/** RFC 4122 UUID v5 (SHA-1 name-based). */
+function uuidV5(name, namespace = UUID_V5_NAMESPACE) {
+    const hash = (0, node_crypto_1.createHash)('sha1')
+        .update(parseUuidBytes(namespace))
+        .update(name, 'utf8')
+        .digest();
+    const bytes = Buffer.from(hash.subarray(0, 16));
+    bytes[6] = (bytes[6] & 0x0f) | 0x50;
+    bytes[8] = (bytes[8] & 0x3f) | 0x80;
+    return formatUuid(bytes);
+}
+/**
+ * Deterministic local engine session UUID for a tenant + client session id.
+ * 1.0+ requires `-s` to be a UUID and only accepts it on first create.
+ */
+function namespacedEngineSessionId(apiKeyId, clientSessionId) {
+    const raw = clientSessionId.trim().slice(0, 128);
+    return uuidV5(`ysk-omni:${apiKeyId}:${raw}`);
+}
+/**
+ * Decide create (`-s`) vs resume (`--resume`) for a client `session_id`.
+ * `knownEngineSessionId` comes from a persisted alias row.
+ */
+function resolveEngineSessionBinding(input) {
+    if (input.knownEngineSessionId && isUuid(input.knownEngineSessionId)) {
+        return { mode: 'resume', engineSessionId: input.knownEngineSessionId };
+    }
+    if (input.knownByEngineId && isUuid(input.knownByEngineId)) {
+        return { mode: 'resume', engineSessionId: input.knownByEngineId };
+    }
+    return {
+        mode: 'create',
+        engineSessionId: namespacedEngineSessionId(input.apiKeyId, input.clientSessionId),
+    };
+}
+function isSessionAlreadyExistsError(err) {
+    const parts = [];
+    if (typeof err === 'string')
+        parts.push(err);
+    if (err instanceof Error)
+        parts.push(err.message);
+    if (err && typeof err === 'object' && 'details' in err) {
+        const d = err.details;
+        if (typeof d === 'string')
+            parts.push(d);
+        else if (d && typeof d === 'object') {
+            const rec = d;
+            if (typeof rec.stderr === 'string')
+                parts.push(rec.stderr);
+            if (typeof rec.message === 'string')
+                parts.push(rec.message);
+        }
+    }
+    const m = parts.join('\n').toLowerCase();
+    return (m.includes('already in use') ||
+        m.includes('already exist') ||
+        m.includes('must not already exist'));
+}
+//# sourceMappingURL=engine-session.js.map

package/dist/utils/engine-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine-session.js","sourceRoot":"","sources":["../../src/utils/engine-session.ts"],"names":[],"mappings":";;AAQA,wBAEC;AAYD,wBASC;AAMD,8DAMC;AAaD,kEAmBC;AAED,kEAmBC;AAhGD,6CAAyC;AAEzC,2EAA2E;AAC3E,MAAM,iBAAiB,GAAG,sCAAsC,CAAC;AAEjE,MAAM,OAAO,GACX,iEAAiE,CAAC;AAEpE,SAAgB,MAAM,CAAC,KAAa;IAClC,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChC,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;AACvG,CAAC;AAED,2CAA2C;AAC3C,SAAgB,MAAM,CAAC,IAAY,EAAE,SAAS,GAAG,iBAAiB;IAChE,MAAM,IAAI,GAAG,IAAA,wBAAU,EAAC,MAAM,CAAC;SAC5B,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;SACjC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC;SACpB,MAAM,EAAE,CAAC;IACZ,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAChD,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IACrC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IACrC,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,SAAgB,yBAAyB,CACvC,QAAgB,EAChB,eAAuB;IAEvB,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC,YAAY,QAAQ,IAAI,GAAG,EAAE,CAAC,CAAC;AAC/C,CAAC;AASD;;;GAGG;AACH,SAAgB,2BAA2B,CAAC,KAK3C;IACC,IAAI,KAAK,CAAC,oBAAoB,IAAI,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACrE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE,KAAK,CAAC,oBAAoB,EAAE,CAAC;IACzE,CAAC;IACD,IAAI,KAAK,CAAC,eAAe,IAAI,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC;IACpE,CAAC;IACD,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,eAAe,EAAE,yBAAyB,CACxC,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,eAAe,CACtB;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,2BAA2B,CAAC,GAAY;IACtD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,GAAG,YAAY,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;QACvD,MAAM,CAAC,GAAI,GAA6B,CAAC,OAAO,CAAC;QACjD,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;aACpC,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,GAAG,GAAG,CAA4B,CAAC;YACzC,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC3D,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACzC,OAAO,CACL,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAC5B,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC;QAC3B,CAAC,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CACrC,CAAC;AACJ,CAAC"}

package/dist/utils/file-sniff.d.ts

@@ -0,0 +1,16 @@
+/** Block obvious binaries (ELF/PE/Mach-O). Shebang only rejected for non-.sh. */
+export declare function isDangerousExecutable(buf: Buffer, ext?: string): boolean;
+/**
+ * Strict upload gate: filename, ext+mime allowlist, ext↔mime map,
+ * magic bytes, executable signatures.
+ */
+export declare function assertSafeUpload(opts: {
+    originalName: string;
+    mimeType: string;
+    buffer: Buffer;
+}): {
+    originalName: string;
+    mimeType: string;
+    ext: string;
+};
+//# sourceMappingURL=file-sniff.d.ts.map

package/dist/utils/file-sniff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-sniff.d.ts","sourceRoot":"","sources":["../../src/utils/file-sniff.ts"],"names":[],"mappings":"AAsDA,iFAAiF;AACjF,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAqBxE;AAqCD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CA+C1D"}

package/dist/utils/file-sniff.js

@@ -0,0 +1,151 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isDangerousExecutable = isDangerousExecutable;
+exports.assertSafeUpload = assertSafeUpload;
+const node_path_1 = __importDefault(require("node:path"));
+const constants_1 = require("../config/constants");
+const exception_factory_1 = require("../exceptions/exception.factory");
+const path_safe_1 = require("./path-safe");
+const TEXT_EXTS = new Set([
+    '.txt',
+    '.md',
+    '.markdown',
+    '.csv',
+    '.json',
+    '.xml',
+    '.html',
+    '.htm',
+    '.js',
+    '.ts',
+    '.tsx',
+    '.jsx',
+    '.py',
+    '.java',
+    '.go',
+    '.rs',
+    '.c',
+    '.cpp',
+    '.h',
+    '.hpp',
+    '.css',
+    '.yml',
+    '.yaml',
+    '.toml',
+    '.ini',
+    '.env',
+    '.sh',
+    '.sql',
+    '.log',
+]);
+function startsWith(buf, sig) {
+    if (typeof sig === 'string') {
+        const s = Buffer.from(sig, 'utf8');
+        if (buf.length < s.length)
+            return false;
+        return buf.subarray(0, s.length).equals(s);
+    }
+    if (buf.length < sig.length)
+        return false;
+    for (let i = 0; i < sig.length; i++) {
+        if (buf[i] !== sig[i])
+            return false;
+    }
+    return true;
+}
+/** Block obvious binaries (ELF/PE/Mach-O). Shebang only rejected for non-.sh. */
+function isDangerousExecutable(buf, ext) {
+    if (buf.length < 4)
+        return false;
+    // ELF
+    if (startsWith(buf, [0x7f, 0x45, 0x4c, 0x46]))
+        return true;
+    // PE / DOS MZ
+    if (startsWith(buf, [0x4d, 0x5a]))
+        return true;
+    // Mach-O (32/64 fat)
+    if (startsWith(buf, [0xfe, 0xed, 0xfa, 0xce]) ||
+        startsWith(buf, [0xfe, 0xed, 0xfa, 0xcf]) ||
+        startsWith(buf, [0xce, 0xfa, 0xed, 0xfe]) ||
+        startsWith(buf, [0xcf, 0xfa, 0xed, 0xfe]) ||
+        startsWith(buf, [0xca, 0xfe, 0xba, 0xbe])) {
+        return true;
+    }
+    // Shebang: allow only for .sh text scripts
+    if (startsWith(buf, '#!/') && ext !== '.sh') {
+        return true;
+    }
+    return false;
+}
+function looksLikeText(buf) {
+    const sample = buf.subarray(0, Math.min(8192, buf.length));
+    if (sample.includes(0))
+        return false;
+    // Allow high UTF-8; reject too many control chars (except tab/lf/cr)
+    let ctrl = 0;
+    for (const b of sample) {
+        if (b < 9 || (b > 13 && b < 32))
+            ctrl += 1;
+    }
+    return ctrl / Math.max(1, sample.length) < 0.02;
+}
+function magicMatchesExt(ext, buf) {
+    switch (ext) {
+        case '.pdf':
+            return startsWith(buf, '%PDF');
+        case '.png':
+            return startsWith(buf, [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
+        case '.jpg':
+        case '.jpeg':
+            return startsWith(buf, [0xff, 0xd8, 0xff]);
+        case '.gif':
+            return startsWith(buf, 'GIF87a') || startsWith(buf, 'GIF89a');
+        case '.webp':
+            return (buf.length >= 12 &&
+                startsWith(buf, 'RIFF') &&
+                buf.subarray(8, 12).toString('ascii') === 'WEBP');
+        default:
+            if (TEXT_EXTS.has(ext))
+                return looksLikeText(buf);
+            // Unknown binary types we allow only with exact map — default require non-empty
+            return buf.length > 0;
+    }
+}
+/**
+ * Strict upload gate: filename, ext+mime allowlist, ext↔mime map,
+ * magic bytes, executable signatures.
+ */
+function assertSafeUpload(opts) {
+    if (!opts.buffer || opts.buffer.length === 0) {
+        throw exception_factory_1.ExceptionFactory.validation('Empty file is not allowed');
+    }
+    const originalName = (0, path_safe_1.sanitizeFilename)(opts.originalName);
+    if (!originalName || originalName.length > 255) {
+        throw exception_factory_1.ExceptionFactory.validation('Invalid filename');
+    }
+    if (originalName.includes('..') || /[/\0]/.test(originalName)) {
+        throw exception_factory_1.ExceptionFactory.validation('Invalid filename');
+    }
+    const ext = node_path_1.default.extname(originalName).toLowerCase();
+    if (!ext || !constants_1.ALLOWED_UPLOAD_EXTENSIONS.has(ext)) {
+        throw exception_factory_1.ExceptionFactory.documentTypeNotAllowed(`Extension "${ext || '(none)'}" is not allowed`);
+    }
+    const mime = (opts.mimeType || '').toLowerCase().split(';')[0].trim();
+    if (!mime || !constants_1.ALLOWED_UPLOAD_MIME_TYPES.has(mime)) {
+        throw exception_factory_1.ExceptionFactory.documentTypeNotAllowed(`MIME type "${mime || '(none)'}" is not allowed`);
+    }
+    const allowedMimes = constants_1.EXT_MIME_MAP[ext];
+    if (!allowedMimes || !allowedMimes.has(mime)) {
+        throw exception_factory_1.ExceptionFactory.documentTypeNotAllowed(`MIME "${mime}" does not match extension "${ext}"`);
+    }
+    if (isDangerousExecutable(opts.buffer, ext)) {
+        throw exception_factory_1.ExceptionFactory.documentTypeNotAllowed('Executable or binary program content is not allowed');
+    }
+    if (!magicMatchesExt(ext, opts.buffer)) {
+        throw exception_factory_1.ExceptionFactory.documentTypeNotAllowed(`File content does not match declared type "${ext}" / "${mime}"`);
+    }
+    return { originalName, mimeType: mime, ext };
+}
+//# sourceMappingURL=file-sniff.js.map

package/dist/utils/file-sniff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-sniff.js","sourceRoot":"","sources":["../../src/utils/file-sniff.ts"],"names":[],"mappings":";;;;;AAuDA,sDAqBC;AAyCD,4CAmDC;AAxKD,0DAA6B;AAC7B,mDAI6B;AAC7B,uEAAmE;AACnE,2CAA+C;AAE/C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,MAAM;IACN,KAAK;IACL,WAAW;IACX,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,KAAK;IACL,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,OAAO;IACP,KAAK;IACL,KAAK;IACL,IAAI;IACJ,MAAM;IACN,IAAI;IACJ,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;CACP,CAAC,CAAC;AAEH,SAAS,UAAU,CAAC,GAAW,EAAE,GAAsB;IACrD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACnC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACxC,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iFAAiF;AACjF,SAAgB,qBAAqB,CAAC,GAAW,EAAE,GAAY;IAC7D,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACjC,MAAM;IACN,IAAI,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,cAAc;IACd,IAAI,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,qBAAqB;IACrB,IACE,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACzC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,EACzC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,2CAA2C;IAC3C,IAAI,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3D,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,qEAAqE;IACrE,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;YAAE,IAAI,IAAI,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;AAClD,CAAC;AAED,SAAS,eAAe,CAAC,GAAW,EAAE,GAAW;IAC/C,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,MAAM;YACT,OAAO,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACjC,KAAK,MAAM;YACT,OAAO,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAC3E,KAAK,MAAM,CAAC;QACZ,KAAK,OAAO;YACV,OAAO,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAC7C,KAAK,MAAM;YACT,OAAO,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAChE,KAAK,OAAO;YACV,OAAO,CACL,GAAG,CAAC,MAAM,IAAI,EAAE;gBAChB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;gBACvB,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,MAAM,CACjD,CAAC;QACJ;YACE,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;YAClD,gFAAgF;YAChF,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,IAIhC;IACC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,oCAAgB,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,YAAY,GAAG,IAAA,4BAAgB,EAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACzD,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC/C,MAAM,oCAAgB,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9D,MAAM,oCAAgB,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,GAAG,GAAG,mBAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;IACrD,IAAI,CAAC,GAAG,IAAI,CAAC,qCAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,oCAAgB,CAAC,sBAAsB,CAC3C,cAAc,GAAG,IAAI,QAAQ,kBAAkB,CAChD,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;IACvE,IAAI,CAAC,IAAI,IAAI,CAAC,qCAAyB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAClD,MAAM,oCAAgB,CAAC,sBAAsB,CAC3C,cAAc,IAAI,IAAI,QAAQ,kBAAkB,CACjD,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,wBAAY,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,MAAM,oCAAgB,CAAC,sBAAsB,CAC3C,SAAS,IAAI,+BAA+B,GAAG,GAAG,CACnD,CAAC;IACJ,CAAC;IAED,IAAI,qBAAqB,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,oCAAgB,CAAC,sBAAsB,CAC3C,qDAAqD,CACtD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,oCAAgB,CAAC,sBAAsB,CAC3C,8CAA8C,GAAG,QAAQ,IAAI,GAAG,CACjE,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAC/C,CAAC"}

package/dist/utils/fs-safe.d.ts

@@ -0,0 +1,5 @@
+/** Best-effort recursive remove (ignore missing / permission errors). */
+export declare function rmSafe(target: string): Promise<void>;
+/** Ensure parent dir exists and return absolute path. */
+export declare function ensureDir(dir: string): Promise<string>;
+//# sourceMappingURL=fs-safe.d.ts.map

package/dist/utils/fs-safe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs-safe.d.ts","sourceRoot":"","sources":["../../src/utils/fs-safe.ts"],"names":[],"mappings":"AAGA,yEAAyE;AACzE,wBAAsB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO1D;AAED,yDAAyD;AACzD,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAG5D"}

package/dist/utils/fs-safe.js

@@ -0,0 +1,26 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rmSafe = rmSafe;
+exports.ensureDir = ensureDir;
+const node_fs_1 = require("node:fs");
+const node_path_1 = __importDefault(require("node:path"));
+/** Best-effort recursive remove (ignore missing / permission errors). */
+async function rmSafe(target) {
+    if (!target)
+        return;
+    try {
+        await node_fs_1.promises.rm(target, { recursive: true, force: true });
+    }
+    catch {
+        /* ignore */
+    }
+}
+/** Ensure parent dir exists and return absolute path. */
+async function ensureDir(dir) {
+    await node_fs_1.promises.mkdir(dir, { recursive: true });
+    return node_path_1.default.resolve(dir);
+}
+//# sourceMappingURL=fs-safe.js.map

package/dist/utils/fs-safe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs-safe.js","sourceRoot":"","sources":["../../src/utils/fs-safe.ts"],"names":[],"mappings":";;;;;AAIA,wBAOC;AAGD,8BAGC;AAjBD,qCAAyC;AACzC,0DAA6B;AAE7B,yEAAyE;AAClE,KAAK,UAAU,MAAM,CAAC,MAAc;IACzC,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,IAAI,CAAC;QACH,MAAM,kBAAE,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;AACH,CAAC;AAED,yDAAyD;AAClD,KAAK,UAAU,SAAS,CAAC,GAAW;IACzC,MAAM,kBAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,OAAO,mBAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC"}

package/dist/utils/id.d.ts

@@ -0,0 +1,7 @@
+export { createApiKeySecret, apiKeyPrefix } from './api-key-crypto';
+export declare function createId(): string;
+export declare function createRequestId(): string;
+export declare function createChatCompletionId(): string;
+export declare function createMessageId(): string;
+export declare function createResponseId(): string;
+//# sourceMappingURL=id.d.ts.map

package/dist/utils/id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"id.d.ts","sourceRoot":"","sources":["../../src/utils/id.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEpE,wBAAgB,QAAQ,IAAI,MAAM,CAEjC;AAED,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AAED,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC"}

package/dist/utils/id.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.apiKeyPrefix = exports.createApiKeySecret = void 0;
+exports.createId = createId;
+exports.createRequestId = createRequestId;
+exports.createChatCompletionId = createChatCompletionId;
+exports.createMessageId = createMessageId;
+exports.createResponseId = createResponseId;
+const node_crypto_1 = require("node:crypto");
+var api_key_crypto_1 = require("./api-key-crypto");
+Object.defineProperty(exports, "createApiKeySecret", { enumerable: true, get: function () { return api_key_crypto_1.createApiKeySecret; } });
+Object.defineProperty(exports, "apiKeyPrefix", { enumerable: true, get: function () { return api_key_crypto_1.apiKeyPrefix; } });
+function createId() {
+    return (0, node_crypto_1.randomUUID)();
+}
+function createRequestId() {
+    return `req_${(0, node_crypto_1.randomBytes)(12).toString('hex')}`;
+}
+function createChatCompletionId() {
+    return `chatcmpl_${(0, node_crypto_1.randomBytes)(12).toString('hex')}`;
+}
+function createMessageId() {
+    return `msg_${(0, node_crypto_1.randomBytes)(12).toString('hex')}`;
+}
+function createResponseId() {
+    return `resp_${(0, node_crypto_1.randomBytes)(12).toString('hex')}`;
+}
+//# sourceMappingURL=id.js.map

package/dist/utils/id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"id.js","sourceRoot":"","sources":["../../src/utils/id.ts"],"names":[],"mappings":";;;AAIA,4BAEC;AAED,0CAEC;AAED,wDAEC;AAED,0CAEC;AAED,4CAEC;AAtBD,6CAAsD;AAEtD,mDAAoE;AAA3D,oHAAA,kBAAkB,OAAA;AAAE,8GAAA,YAAY,OAAA;AAEzC,SAAgB,QAAQ;IACtB,OAAO,IAAA,wBAAU,GAAE,CAAC;AACtB,CAAC;AAED,SAAgB,eAAe;IAC7B,OAAO,OAAO,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,SAAgB,sBAAsB;IACpC,OAAO,YAAY,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,SAAgB,eAAe;IAC7B,OAAO,OAAO,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,SAAgB,gBAAgB;IAC9B,OAAO,QAAQ,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACnD,CAAC"}

package/dist/utils/index.d.ts

@@ -0,0 +1,14 @@
+/** Shared utilities barrel. Prefer direct imports when a single helper is needed. */
+export { asyncHandler } from './async-handler';
+export { createId, createRequestId, createChatCompletionId, createMessageId, createResponseId, createApiKeySecret, apiKeyPrefix, } from './id';
+export { hashApiKey, hashApiKeySha256, scryptHash, verifyApiKey, } from './api-key-crypto';
+export { normalizeApiKeyRole, normalizeApiKeyMode } from './role-normalize';
+export { isSyntheticApiKeyId, toAuditApiKeyId, toPersistentApiKeyId, } from './api-key-id';
+export { flattenMessageContent, messageHasImageParts, messagesToPrompt, } from './message-content';
+export { readIdempotencyKey, scopedIdempotencyKey, readIdempotencyKeyScoped, } from './request-meta';
+export { logger } from './logger';
+export { mapEngineToChatCompletion, mapTextDeltaChunk, mapReasoningDeltaChunk, mapRoleChunk, mapFinishChunk, mapModelsList, } from './openai-mapper';
+export { initSse, writeSseData, writeSseDone, writeSseEvent, } from './stream';
+export { anthropicToChatDto, chatCompletionToAnthropicMessage, mapAnthropicStopReason, } from './anthropic-mapper';
+export { responsesDtoToChatDto, chatCompletionToResponse, } from './responses-mapper';
+//# sourceMappingURL=index.d.ts.map

package/dist/utils/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,qFAAqF;AAErF,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EACL,QAAQ,EACR,eAAe,EACf,sBAAsB,EACtB,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,GACb,MAAM,MAAM,CAAC;AACd,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,UAAU,EACV,YAAY,GACb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,sBAAsB,EACtB,YAAY,EACZ,cAAc,EACd,aAAa,GACd,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,OAAO,EACP,YAAY,EACZ,YAAY,EACZ,aAAa,GACd,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,kBAAkB,EAClB,gCAAgC,EAChC,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC"}

package/dist/utils/index.js

@@ -0,0 +1,56 @@
+"use strict";
+/** Shared utilities barrel. Prefer direct imports when a single helper is needed. */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.chatCompletionToResponse = exports.responsesDtoToChatDto = exports.mapAnthropicStopReason = exports.chatCompletionToAnthropicMessage = exports.anthropicToChatDto = exports.writeSseEvent = exports.writeSseDone = exports.writeSseData = exports.initSse = exports.mapModelsList = exports.mapFinishChunk = exports.mapRoleChunk = exports.mapReasoningDeltaChunk = exports.mapTextDeltaChunk = exports.mapEngineToChatCompletion = exports.logger = exports.readIdempotencyKeyScoped = exports.scopedIdempotencyKey = exports.readIdempotencyKey = exports.messagesToPrompt = exports.messageHasImageParts = exports.flattenMessageContent = exports.toPersistentApiKeyId = exports.toAuditApiKeyId = exports.isSyntheticApiKeyId = exports.normalizeApiKeyMode = exports.normalizeApiKeyRole = exports.verifyApiKey = exports.scryptHash = exports.hashApiKeySha256 = exports.hashApiKey = exports.apiKeyPrefix = exports.createApiKeySecret = exports.createResponseId = exports.createMessageId = exports.createChatCompletionId = exports.createRequestId = exports.createId = exports.asyncHandler = void 0;
+var async_handler_1 = require("./async-handler");
+Object.defineProperty(exports, "asyncHandler", { enumerable: true, get: function () { return async_handler_1.asyncHandler; } });
+var id_1 = require("./id");
+Object.defineProperty(exports, "createId", { enumerable: true, get: function () { return id_1.createId; } });
+Object.defineProperty(exports, "createRequestId", { enumerable: true, get: function () { return id_1.createRequestId; } });
+Object.defineProperty(exports, "createChatCompletionId", { enumerable: true, get: function () { return id_1.createChatCompletionId; } });
+Object.defineProperty(exports, "createMessageId", { enumerable: true, get: function () { return id_1.createMessageId; } });
+Object.defineProperty(exports, "createResponseId", { enumerable: true, get: function () { return id_1.createResponseId; } });
+Object.defineProperty(exports, "createApiKeySecret", { enumerable: true, get: function () { return id_1.createApiKeySecret; } });
+Object.defineProperty(exports, "apiKeyPrefix", { enumerable: true, get: function () { return id_1.apiKeyPrefix; } });
+var api_key_crypto_1 = require("./api-key-crypto");
+Object.defineProperty(exports, "hashApiKey", { enumerable: true, get: function () { return api_key_crypto_1.hashApiKey; } });
+Object.defineProperty(exports, "hashApiKeySha256", { enumerable: true, get: function () { return api_key_crypto_1.hashApiKeySha256; } });
+Object.defineProperty(exports, "scryptHash", { enumerable: true, get: function () { return api_key_crypto_1.scryptHash; } });
+Object.defineProperty(exports, "verifyApiKey", { enumerable: true, get: function () { return api_key_crypto_1.verifyApiKey; } });
+var role_normalize_1 = require("./role-normalize");
+Object.defineProperty(exports, "normalizeApiKeyRole", { enumerable: true, get: function () { return role_normalize_1.normalizeApiKeyRole; } });
+Object.defineProperty(exports, "normalizeApiKeyMode", { enumerable: true, get: function () { return role_normalize_1.normalizeApiKeyMode; } });
+var api_key_id_1 = require("./api-key-id");
+Object.defineProperty(exports, "isSyntheticApiKeyId", { enumerable: true, get: function () { return api_key_id_1.isSyntheticApiKeyId; } });
+Object.defineProperty(exports, "toAuditApiKeyId", { enumerable: true, get: function () { return api_key_id_1.toAuditApiKeyId; } });
+Object.defineProperty(exports, "toPersistentApiKeyId", { enumerable: true, get: function () { return api_key_id_1.toPersistentApiKeyId; } });
+var message_content_1 = require("./message-content");
+Object.defineProperty(exports, "flattenMessageContent", { enumerable: true, get: function () { return message_content_1.flattenMessageContent; } });
+Object.defineProperty(exports, "messageHasImageParts", { enumerable: true, get: function () { return message_content_1.messageHasImageParts; } });
+Object.defineProperty(exports, "messagesToPrompt", { enumerable: true, get: function () { return message_content_1.messagesToPrompt; } });
+var request_meta_1 = require("./request-meta");
+Object.defineProperty(exports, "readIdempotencyKey", { enumerable: true, get: function () { return request_meta_1.readIdempotencyKey; } });
+Object.defineProperty(exports, "scopedIdempotencyKey", { enumerable: true, get: function () { return request_meta_1.scopedIdempotencyKey; } });
+Object.defineProperty(exports, "readIdempotencyKeyScoped", { enumerable: true, get: function () { return request_meta_1.readIdempotencyKeyScoped; } });
+var logger_1 = require("./logger");
+Object.defineProperty(exports, "logger", { enumerable: true, get: function () { return logger_1.logger; } });
+var openai_mapper_1 = require("./openai-mapper");
+Object.defineProperty(exports, "mapEngineToChatCompletion", { enumerable: true, get: function () { return openai_mapper_1.mapEngineToChatCompletion; } });
+Object.defineProperty(exports, "mapTextDeltaChunk", { enumerable: true, get: function () { return openai_mapper_1.mapTextDeltaChunk; } });
+Object.defineProperty(exports, "mapReasoningDeltaChunk", { enumerable: true, get: function () { return openai_mapper_1.mapReasoningDeltaChunk; } });
+Object.defineProperty(exports, "mapRoleChunk", { enumerable: true, get: function () { return openai_mapper_1.mapRoleChunk; } });
+Object.defineProperty(exports, "mapFinishChunk", { enumerable: true, get: function () { return openai_mapper_1.mapFinishChunk; } });
+Object.defineProperty(exports, "mapModelsList", { enumerable: true, get: function () { return openai_mapper_1.mapModelsList; } });
+var stream_1 = require("./stream");
+Object.defineProperty(exports, "initSse", { enumerable: true, get: function () { return stream_1.initSse; } });
+Object.defineProperty(exports, "writeSseData", { enumerable: true, get: function () { return stream_1.writeSseData; } });
+Object.defineProperty(exports, "writeSseDone", { enumerable: true, get: function () { return stream_1.writeSseDone; } });
+Object.defineProperty(exports, "writeSseEvent", { enumerable: true, get: function () { return stream_1.writeSseEvent; } });
+var anthropic_mapper_1 = require("./anthropic-mapper");
+Object.defineProperty(exports, "anthropicToChatDto", { enumerable: true, get: function () { return anthropic_mapper_1.anthropicToChatDto; } });
+Object.defineProperty(exports, "chatCompletionToAnthropicMessage", { enumerable: true, get: function () { return anthropic_mapper_1.chatCompletionToAnthropicMessage; } });
+Object.defineProperty(exports, "mapAnthropicStopReason", { enumerable: true, get: function () { return anthropic_mapper_1.mapAnthropicStopReason; } });
+var responses_mapper_1 = require("./responses-mapper");
+Object.defineProperty(exports, "responsesDtoToChatDto", { enumerable: true, get: function () { return responses_mapper_1.responsesDtoToChatDto; } });
+Object.defineProperty(exports, "chatCompletionToResponse", { enumerable: true, get: function () { return responses_mapper_1.chatCompletionToResponse; } });
+//# sourceMappingURL=index.js.map

package/dist/utils/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":";AAAA,qFAAqF;;;AAErF,iDAA+C;AAAtC,6GAAA,YAAY,OAAA;AACrB,2BAQc;AAPZ,8FAAA,QAAQ,OAAA;AACR,qGAAA,eAAe,OAAA;AACf,4GAAA,sBAAsB,OAAA;AACtB,qGAAA,eAAe,OAAA;AACf,sGAAA,gBAAgB,OAAA;AAChB,wGAAA,kBAAkB,OAAA;AAClB,kGAAA,YAAY,OAAA;AAEd,mDAK0B;AAJxB,4GAAA,UAAU,OAAA;AACV,kHAAA,gBAAgB,OAAA;AAChB,4GAAA,UAAU,OAAA;AACV,8GAAA,YAAY,OAAA;AAEd,mDAA4E;AAAnE,qHAAA,mBAAmB,OAAA;AAAE,qHAAA,mBAAmB,OAAA;AACjD,2CAIsB;AAHpB,iHAAA,mBAAmB,OAAA;AACnB,6GAAA,eAAe,OAAA;AACf,kHAAA,oBAAoB,OAAA;AAEtB,qDAI2B;AAHzB,wHAAA,qBAAqB,OAAA;AACrB,uHAAA,oBAAoB,OAAA;AACpB,mHAAA,gBAAgB,OAAA;AAElB,+CAIwB;AAHtB,kHAAA,kBAAkB,OAAA;AAClB,oHAAA,oBAAoB,OAAA;AACpB,wHAAA,wBAAwB,OAAA;AAE1B,mCAAkC;AAAzB,gGAAA,MAAM,OAAA;AACf,iDAOyB;AANvB,0HAAA,yBAAyB,OAAA;AACzB,kHAAA,iBAAiB,OAAA;AACjB,uHAAA,sBAAsB,OAAA;AACtB,6GAAA,YAAY,OAAA;AACZ,+GAAA,cAAc,OAAA;AACd,8GAAA,aAAa,OAAA;AAEf,mCAKkB;AAJhB,iGAAA,OAAO,OAAA;AACP,sGAAA,YAAY,OAAA;AACZ,sGAAA,YAAY,OAAA;AACZ,uGAAA,aAAa,OAAA;AAEf,uDAI4B;AAH1B,sHAAA,kBAAkB,OAAA;AAClB,oIAAA,gCAAgC,OAAA;AAChC,0HAAA,sBAAsB,OAAA;AAExB,uDAG4B;AAF1B,yHAAA,qBAAqB,OAAA;AACrB,4HAAA,wBAAwB,OAAA"}

package/dist/utils/ip-match.d.ts

@@ -0,0 +1,15 @@
+/**
+ * IPv4 exact / CIDR match helpers for API key whitelist and blacklist.
+ * IPv6: exact match only (no CIDR).
+ */
+export declare function normalizeIp(ip: string): string;
+/** Aliases that should match the same client (loopback). */
+export declare function ipEquivalents(ip: string): string[];
+export declare function isValidIpOrCidr(entry: string): boolean;
+/** True if clientIp matches any whitelist entry (exact or CIDR). Empty list = allow all. */
+export declare function ipAllowed(clientIp: string, whitelist: string[] | null | undefined): boolean;
+/** True if client IP is exactly (or loopback-equivalent) in a ban set. */
+export declare function ipMatchesExact(clientIp: string, bannedIp: string): boolean;
+export declare function parseIpList(input: unknown): string[];
+export declare function serializeIpList(list: string[] | null | undefined): string | null;
+//# sourceMappingURL=ip-match.d.ts.map

package/dist/utils/ip-match.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ip-match.d.ts","sourceRoot":"","sources":["../../src/utils/ip-match.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAe9C;AAED,4DAA4D;AAC5D,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,CAMlD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAOtD;AAsBD,4FAA4F;AAC5F,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAe3F;AAED,0EAA0E;AAC1E,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAI1E;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CA0BpD;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAGhF"}

package/dist/utils/ip-match.js

@@ -0,0 +1,133 @@
+"use strict";
+/**
+ * IPv4 exact / CIDR match helpers for API key whitelist and blacklist.
+ * IPv6: exact match only (no CIDR).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeIp = normalizeIp;
+exports.ipEquivalents = ipEquivalents;
+exports.isValidIpOrCidr = isValidIpOrCidr;
+exports.ipAllowed = ipAllowed;
+exports.ipMatchesExact = ipMatchesExact;
+exports.parseIpList = parseIpList;
+exports.serializeIpList = serializeIpList;
+const IPV4_RE = /^(?:(?:25[0-5]|2[0-4]\d|1?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|1?\d?\d)$/;
+const CIDR_RE = /^(?:(?:25[0-5]|2[0-4]\d|1?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|1?\d?\d)\/(?:3[0-2]|[12]?\d)$/;
+function normalizeIp(ip) {
+    let s = ip.trim();
+    // strip IPv4-mapped IPv6 ::ffff:x.x.x.x
+    if (s.toLowerCase().startsWith('::ffff:')) {
+        s = s.slice(7);
+    }
+    // strip brackets
+    if (s.startsWith('[') && s.endsWith(']')) {
+        s = s.slice(1, -1);
+    }
+    // Treat common loopback forms as 127.0.0.1 for matching
+    if (s === '::1' || s === '0:0:0:0:0:0:0:1') {
+        return '127.0.0.1';
+    }
+    return s;
+}
+/** Aliases that should match the same client (loopback). */
+function ipEquivalents(ip) {
+    const n = normalizeIp(ip);
+    if (n === '127.0.0.1' || n === 'localhost') {
+        return ['127.0.0.1', '::1', '::ffff:127.0.0.1', 'localhost'];
+    }
+    return [n];
+}
+function isValidIpOrCidr(entry) {
+    const s = normalizeIp(entry);
+    if (!s)
+        return false;
+    if (IPV4_RE.test(s) || CIDR_RE.test(s))
+        return true;
+    // loose IPv6 exact
+    if (s.includes(':') && /^[0-9a-fA-F:.]+$/.test(s))
+        return true;
+    return false;
+}
+function ipv4ToInt(ip) {
+    const parts = ip.split('.').map((x) => Number(x));
+    return (((parts[0] << 24) >>> 0) +
+        ((parts[1] << 16) >>> 0) +
+        ((parts[2] << 8) >>> 0) +
+        (parts[3] >>> 0));
+}
+function matchCidr(ip, cidr) {
+    const [base, bitsStr] = cidr.split('/');
+    if (!base || !bitsStr || !IPV4_RE.test(ip) || !IPV4_RE.test(base))
+        return false;
+    const bits = Number(bitsStr);
+    if (!Number.isFinite(bits) || bits < 0 || bits > 32)
+        return false;
+    if (bits === 0)
+        return true;
+    const mask = bits === 32 ? 0xffffffff : (~0 << (32 - bits)) >>> 0;
+    return (ipv4ToInt(ip) & mask) === (ipv4ToInt(base) & mask);
+}
+/** True if clientIp matches any whitelist entry (exact or CIDR). Empty list = allow all. */
+function ipAllowed(clientIp, whitelist) {
+    if (!whitelist || whitelist.length === 0)
+        return true;
+    const candidates = ipEquivalents(clientIp);
+    for (const ip of candidates) {
+        for (const raw of whitelist) {
+            const entry = normalizeIp(raw);
+            if (!entry)
+                continue;
+            if (entry.includes('/')) {
+                if (IPV4_RE.test(ip) && matchCidr(ip, entry))
+                    return true;
+            }
+            else if (entry === ip || ipEquivalents(entry).includes(ip)) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+/** True if client IP is exactly (or loopback-equivalent) in a ban set. */
+function ipMatchesExact(clientIp, bannedIp) {
+    const a = ipEquivalents(clientIp);
+    const b = ipEquivalents(bannedIp);
+    return a.some((x) => b.includes(x));
+}
+function parseIpList(input) {
+    if (input == null)
+        return [];
+    if (Array.isArray(input)) {
+        return input
+            .map((x) => String(x).trim())
+            .filter(Boolean)
+            .filter(isValidIpOrCidr)
+            .map(normalizeIp);
+    }
+    if (typeof input === 'string') {
+        const trimmed = input.trim();
+        if (!trimmed)
+            return [];
+        try {
+            const parsed = JSON.parse(trimmed);
+            if (Array.isArray(parsed))
+                return parseIpList(parsed);
+        }
+        catch {
+            /* lines / commas */
+        }
+        return trimmed
+            .split(/[\n,]+/)
+            .map((s) => s.trim())
+            .filter(Boolean)
+            .filter(isValidIpOrCidr)
+            .map(normalizeIp);
+    }
+    return [];
+}
+function serializeIpList(list) {
+    if (!list || list.length === 0)
+        return null;
+    return JSON.stringify(list);
+}
+//# sourceMappingURL=ip-match.js.map

package/dist/utils/ip-match.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ip-match.js","sourceRoot":"","sources":["../../src/utils/ip-match.ts"],"names":[],"mappings":";AAAA;;;GAGG;;AAOH,kCAeC;AAGD,sCAMC;AAED,0CAOC;AAuBD,8BAeC;AAGD,wCAIC;AAED,kCA0BC;AAED,0CAGC;AApHD,MAAM,OAAO,GACX,qEAAqE,CAAC;AACxE,MAAM,OAAO,GACX,yFAAyF,CAAC;AAE5F,SAAgB,WAAW,CAAC,EAAU;IACpC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;IAClB,wCAAwC;IACxC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1C,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IACD,iBAAiB;IACjB,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,wDAAwD;IACxD,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,iBAAiB,EAAE,CAAC;QAC3C,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,4DAA4D;AAC5D,SAAgB,aAAa,CAAC,EAAU;IACtC,MAAM,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC1B,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;QAC3C,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,kBAAkB,EAAE,WAAW,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,CAAC,CAAC,CAAC,CAAC;AACb,CAAC;AAED,SAAgB,eAAe,CAAC,KAAa;IAC3C,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,mBAAmB;IACnB,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,EAAU;IAC3B,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,OAAO,CACL,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC,KAAK,CAAC,CAAC,CAAE,KAAK,CAAC,CAAC,CAClB,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,EAAU,EAAE,IAAY;IACzC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAChF,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IAClE,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;IAClE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;AAC7D,CAAC;AAED,4FAA4F;AAC5F,SAAgB,SAAS,CAAC,QAAgB,EAAE,SAAsC;IAChF,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,MAAM,UAAU,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC3C,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC;oBAAE,OAAO,IAAI,CAAC;YAC5D,CAAC;iBAAM,IAAI,KAAK,KAAK,EAAE,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC7D,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0EAA0E;AAC1E,SAAgB,cAAc,CAAC,QAAgB,EAAE,QAAgB;IAC/D,MAAM,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAClC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,SAAgB,WAAW,CAAC,KAAc;IACxC,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,EAAE,CAAC;IAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK;aACT,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aAC5B,MAAM,CAAC,OAAO,CAAC;aACf,MAAM,CAAC,eAAe,CAAC;aACvB,GAAG,CAAC,WAAW,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAY,CAAC;YAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,oBAAoB;QACtB,CAAC;QACD,OAAO,OAAO;aACX,KAAK,CAAC,QAAQ,CAAC;aACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC;aACf,MAAM,CAAC,eAAe,CAAC;aACvB,GAAG,CAAC,WAAW,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAgB,eAAe,CAAC,IAAiC;IAC/D,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC"}

package/dist/utils/list-sort.d.ts

@@ -0,0 +1,14 @@
+/** Shared list sorting helpers for Admin APIs (server-side only). */
+export type SortDir = 'asc' | 'desc';
+export declare function parseSortDir(raw: unknown): SortDir;
+/**
+ * Pick a whitelist field for Prisma `orderBy: { field: dir }`.
+ * Invalid sortBy falls back to defaultField; sortDir defaults to desc.
+ */
+export declare function resolveScalarOrderBy<T extends string>(sortBy: string | undefined, sortDir: SortDir | string | undefined, allowed: readonly T[], defaultField: T): Record<string, SortDir>;
+/**
+ * In-memory sort for aggregates / connection snapshots.
+ * Default direction is **desc** (newest / largest first).
+ */
+export declare function sortInMemory<T>(rows: T[], sortBy: string | undefined, sortDir: SortDir | string | undefined, getters: Record<string, (row: T) => string | number | Date | null | undefined>, defaultKey: string): T[];
+//# sourceMappingURL=list-sort.d.ts.map

package/dist/utils/list-sort.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-sort.d.ts","sourceRoot":"","sources":["../../src/utils/list-sort.ts"],"names":[],"mappings":"AAAA,qEAAqE;AAErE,MAAM,MAAM,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;AAErC,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAElD;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,SAAS,MAAM,EACnD,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,EACrC,OAAO,EAAE,SAAS,CAAC,EAAE,EACrB,YAAY,EAAE,CAAC,GACd,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQzB;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAC5B,IAAI,EAAE,CAAC,EAAE,EACT,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,EACrC,OAAO,EAAE,MAAM,CACb,MAAM,EACN,CAAC,GAAG,EAAE,CAAC,KAAK,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,IAAI,GAAG,SAAS,CACtD,EACD,UAAU,EAAE,MAAM,GACjB,CAAC,EAAE,CA8BL"}