From 4b0b3c7f7e6cc539a9bd132a5e4225ec34437813 Mon Sep 17 00:00:00 2001 From: jmgasper Date: Mon, 26 Oct 2026 12:17:58 +1100 Subject: [PATCH 01/13] refactor: adopt shared v6 JWT and bus clients --- README.md | 24 ++++ app-routes.ts | 2 +- config/default.js | 4 +- mock/mock-challenge-api.js | 17 +-- package.json | 3 +- pnpm-lock.yaml | 225 ++----------------------------------- pnpm-workspace.yaml | 1 - src/common/helper.ts | 4 +- test/postman/newman.js | 2 +- 9 files changed, 49 insertions(+), 233 deletions(-) create mode 100644 README.md diff --git a/README.md b/README.md new file mode 100644 index 0000000..57d0b8b --- /dev/null +++ b/README.md @@ -0,0 +1,24 @@ +# resource-api-v6 + +## Shared authentication and bus client (v6 refresh) + +This branch uses `tc-core-library-js` **4.0.0-rc.1**. Use its named +`createJwtVerifier` / `createJwtAuthenticator`, `createM2MClient`, and +`createBusApiClient` exports for shared authentication and bus API publishing. +Service-specific roles, scopes, sessions and ownership checks remain in this service. +The former bus wrapper dependency and local JWT cryptography must not be reintroduced. + +RSA verification requires an exact configured issuer and audience (`JWT_AUDIENCE` +for client tokens, `AUTH0_AUDIENCE` for machine/API tokens, or this service's explicit +issuer-policy settings). HMAC secrets must be at least 32 bytes; no default secret +is supplied. Expiry is enforced. Machine identity comes from the shared verifier, +not the presence of scopes. Supply real development credentials through the service's +existing environment configuration before deployment. + +Bus publishers use `createBusApiClient(config).postEvent(event)` with the existing +event envelope and optional key. Configure `BUSAPI_URL` for v6 and the existing +OAuth credentials/token provider. The client uses bounded HTTPS requests and does +not retry POSTs automatically. Application retry/outbox behavior remains local. + +See the [core migration guide](https://github.com/topcoder-platform/tc-core-library-js/blob/v4.0.0-rc.1/MIGRATION.md) +for the API mapping, compatibility requirements, and rollout scope. diff --git a/app-routes.ts b/app-routes.ts index 4d219d5..4edbfcc 100644 --- a/app-routes.ts +++ b/app-routes.ts @@ -12,7 +12,7 @@ const HttpStatus = require('http-status-codes') const helper = require('./src/common/helper') const errors = require('./src/common/errors') const routes = require('./src/routes') -const authenticator = require('tc-core-library-js').middleware.jwtAuthenticator +const authenticator = require('tc-core-library-js').createJwtAuthenticator /** * Configures every public API route on the supplied Express application. diff --git a/config/default.js b/config/default.js index b55ca73..877ea92 100644 --- a/config/default.js +++ b/config/default.js @@ -10,7 +10,7 @@ module.exports = { // used to properly set the header response to api calls for services behind a load balancer API_BASE_URL: process.env.API_BASE_URL || `http://localhost:3000`, - AUTH_SECRET: process.env.AUTH_SECRET || 'mysecret', + AUTH_SECRET: process.env.AUTH_SECRET, VALID_ISSUERS: process.env.VALID_ISSUERS || '["https://api.topcoder-dev.com", "https://api.topcoder.com", "https://topcoder-dev.auth0.com/"]', SUBMITTER_RESOURCE_ROLE_ID: process.env.SUBMITTER_RESOURCE_ROLE_ID || '732339e7-8e30-49d7-9198-cccf9451e221', @@ -40,7 +40,7 @@ module.exports = { ALL: process.env.SCOPE_ALL || 'all:resources' }, - BUSAPI_URL: process.env.BUSAPI_URL || 'https://api.topcoder-dev.com/v5', + BUSAPI_URL: process.env.BUSAPI_URL || 'https://api.topcoder-dev.com/v6', KAFKA_ERROR_TOPIC: process.env.KAFKA_ERROR_TOPIC || 'common.error.reporting', KAFKA_MESSAGE_ORIGINATOR: process.env.KAFKA_MESSAGE_ORIGINATOR || 'resources-api', RESOURCE_CREATE_TOPIC: process.env.RESOURCE_CREATE_TOPIC || 'challenge.action.resource.create', diff --git a/mock/mock-challenge-api.js b/mock/mock-challenge-api.js index 7a9393d..78f8a71 100644 --- a/mock/mock-challenge-api.js +++ b/mock/mock-challenge-api.js @@ -6,10 +6,13 @@ const config = require('config') const http = require('http') const send = require('http-json-response') const logger = require('../src/common/logger') -const m2mVerify = require('tc-core-library-js').auth.verifier -const verify = m2mVerify(config.VALID_ISSUERS, '24h') +const { createJwtVerifier } = require('tc-core-library-js') +const verifier = createJwtVerifier({ + VALID_ISSUERS: config.VALID_ISSUERS, AUTH_SECRET: config.AUTH_SECRET, + AUTH0_AUDIENCE: config.AUTH0_AUDIENCE, JWT_AUDIENCE: process.env.JWT_AUDIENCE +}) -const mockChallengeApi = http.createServer((req, res) => { +const mockChallengeApi = http.createServer(async (req, res) => { logger.debug(`${req.method} ${req.url}`) // Parse the token from request header let token @@ -20,12 +23,13 @@ const mockChallengeApi = http.createServer((req, res) => { } } - verify.validateToken(token, config.AUTH_SECRET, (error, decoded) => { - if (error) { + try { + await verifier.verify(token) + } catch { res.statusCode = 401 res.end('Not Authorized') return - } + } if (req.method === 'GET' && req.url.match(/^\/v5\/challenges\/[a-zA-Z0-9-]+(\?[a-zA-Z=]+)?$/)) { const list = req.url.split('/') @@ -124,7 +128,6 @@ const mockChallengeApi = http.createServer((req, res) => { res.statusCode = 404 res.end('Not Found') } - }) }) if (!module.parent) { diff --git a/package.json b/package.json index 95ac4a4..7194dae 100644 --- a/package.json +++ b/package.json @@ -76,8 +76,7 @@ "rxjs": "^7.8.1", "superagent": "^10.3.0", "swagger-ui-express": "^4.1.3", - "tc-bus-api-wrapper": "github:topcoder-platform/tc-bus-api-wrapper.git", - "tc-core-library-js": "https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/1075136355e1e1c4779f2138a30f3ffbd718bfa4", + "tc-core-library-js": "github:topcoder-platform/tc-core-library-js#v4.0.0-rc.1", "uuid": "^14.0.1", "winston": "^3.2.1", "xss": "^1.0.7", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 679be10..7e1681f 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -5,7 +5,6 @@ settings: excludeLinksFromLockfile: false overrides: - '@topcoder-platform/topcoder-bus-api-wrapper>tc-core-library-js': https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/1075136355e1e1c4779f2138a30f3ffbd718bfa4 '@hono/node-server@<2.0.11': 2.0.11 ajv@>=6.0.0 <6.14.0: 6.15.0 axios@<1.18.1: 1.18.1 @@ -110,12 +109,9 @@ importers: swagger-ui-express: specifier: ^4.1.3 version: 4.6.3(express@4.22.1(supports-color@5.5.0)) - tc-bus-api-wrapper: - specifier: github:topcoder-platform/tc-bus-api-wrapper.git - version: '@topcoder-platform/topcoder-bus-api-wrapper@https://codeload.github.com/topcoder-platform/tc-bus-api-wrapper/tar.gz/297a9c0adcdb97661257e7825bee9c3f5578b833(debug@4.4.3(supports-color@5.5.0))(supports-color@5.5.0)' tc-core-library-js: - specifier: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/1075136355e1e1c4779f2138a30f3ffbd718bfa4 - version: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/1075136355e1e1c4779f2138a30f3ffbd718bfa4(debug@4.4.3(supports-color@5.5.0))(supports-color@5.5.0) + specifier: github:topcoder-platform/tc-core-library-js#v4.0.0-rc.1 + version: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/6c326fea0abfccb5ae29dff2ac5bce01aabc1fa4(supports-color@5.5.0) uuid: specifier: ^14.0.1 version: 14.0.1 @@ -862,10 +858,6 @@ packages: '@tokenizer/token@0.3.0': resolution: {integrity: sha512-OvjF+z51L3ov0OyAU0duzsYuvO01PH7x4t6DJx+guahgTnBHkhJdG7soQeTSFLWN3efnHyibZ4Z8l2EuWwJN3A==} - '@topcoder-platform/topcoder-bus-api-wrapper@https://codeload.github.com/topcoder-platform/tc-bus-api-wrapper/tar.gz/297a9c0adcdb97661257e7825bee9c3f5578b833': - resolution: {gitHosted: true, tarball: https://codeload.github.com/topcoder-platform/tc-bus-api-wrapper/tar.gz/297a9c0adcdb97661257e7825bee9c3f5578b833} - version: 1.2.0 - '@tsconfig/node10@1.0.12': resolution: {integrity: sha512-UCYBaeFvM11aU2y3YPZ//O5Rhj+xKyzy7mvcIoAjASbigy8mHMryP5cK7dgjlz2hWxh1g5pLw084E0a/wlUSFQ==} @@ -1079,10 +1071,6 @@ packages: engines: {node: '>=0.4.0'} hasBin: true - agent-base@6.0.2: - resolution: {integrity: sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==} - engines: {node: '>= 6.0.0'} - agent-base@7.1.4: resolution: {integrity: sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==} engines: {node: '>= 14'} @@ -1211,13 +1199,6 @@ packages: aws4@1.13.2: resolution: {integrity: sha512-lHe62zvbTB5eEABUVi/AwVh0ZKY9rMMDhmm+eeyuuUQbQ3+J+fONVQOZyj+DdrvD4BY33uYniyRJ4UJIaSKAfw==} - axios@1.18.1: - resolution: {integrity: sha512-3nTvFlvpn9Zu/RkHUqtc7/+al4UpRW5az71ap5zccp6e8RAYEzhMTecX8Dz1wWDYrPpUoB1HAQEGEAEvUr7S9g==} - - backoff@2.5.0: - resolution: {integrity: sha512-wC5ihrnUXmR2douXmXLCe5O3zg3GKIyvRi/hi58a/XyRxVI+3/yM0PYueQOZXPXQ9pxBislYkw+sF9b7C/RuMA==} - engines: {node: '>= 0.6'} - balanced-match@1.0.2: resolution: {integrity: sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==} @@ -1291,11 +1272,6 @@ packages: buffer@5.7.1: resolution: {integrity: sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==} - bunyan@1.8.15: - resolution: {integrity: sha512-0tECWShh6wUysgucJcBAoYegf3JJoZWibxdqhTm7OHPeT42qdjkZ29QCMcKwbgU1kiH+auSIasNRXMLWXafXig==} - engines: {'0': node >=0.10.0} - hasBin: true - busboy@1.6.0: resolution: {integrity: sha512-8SFQbg/0hQ9xy3UNTB0YEnsNBbWfhf7RtnzpL7TkBiTBRfrQ9Fxcnz7VJsleJpyp6rVLvXiuORqjlHi5q+PYuA==} engines: {node: '>=10.16.0'} @@ -1411,9 +1387,6 @@ packages: resolution: {integrity: sha512-JQHZ2QMW6l3aH/j6xCqQThY/9OH4D/9ls34cgkUBiEeocRTU04tHfKPBsUK1PqZCUQM7GiA0IIXJSuXHI64Kbg==} engines: {node: '>=0.8'} - codependency@2.1.0: - resolution: {integrity: sha512-JIdmYkE8Z6jwH1OUf4a5H5jk9YShPQkaYPUAiN+ktyChmPP77LGbeKrxWGPqdCnpTmt0hRIn8TXBVu01U3HDhg==} - color-convert@2.0.1: resolution: {integrity: sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==} engines: {node: '>=7.0.0'} @@ -1646,10 +1619,6 @@ packages: resolution: {integrity: sha512-nI4U3TottKAcAD9LLud4Cb7b2QztQMUEfHbvhTH09bqXTxnSie8WnjPALV/WMCrJZ6UV/qHJ6L03OqO3LcdYZw==} engines: {node: '>=12'} - dtrace-provider@0.8.8: - resolution: {integrity: sha512-b7Z7cNtHPhH9EJhNNbbeqTcXB8LGFFZhq1PGgEvpeHlzd36bhbdTWoE/Ba/YguqpBSlAPKnARWhVlhunCMwfxg==} - engines: {node: '>=0.10'} - dunder-proto@1.0.1: resolution: {integrity: sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==} engines: {node: '>= 0.4'} @@ -1913,15 +1882,6 @@ packages: fn.name@1.1.0: resolution: {integrity: sha512-GRnmB5gPyJpAhTQdSZTSp9uaPSvl09KoYcMQtsB9rQoOmzs9dH6ffeccH+Z+cv6P68Hu5bC6JjRh4Ah/mHSNRw==} - follow-redirects@1.16.0: - resolution: {integrity: sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==} - engines: {node: '>=4.0'} - peerDependencies: - debug: '*' - peerDependenciesMeta: - debug: - optional: true - foreground-child@2.0.0: resolution: {integrity: sha512-dCIq9FpEcyQyXKCkyzmlPTFNgrCzPudOe+mhvJU5zAtlBnGVy2yKxtfsxK2tQBThwq225jcvBjpw1Gr40uzZCA==} engines: {node: '>=8.0.0'} @@ -2038,10 +1998,6 @@ packages: resolution: {integrity: sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==} engines: {node: 18 || 20 || >=22} - glob@6.0.4: - resolution: {integrity: sha512-MKZeRNyYZAVVVG1oZeLaWie1uweH40m9AZwIwxyPbTSX4hHrVYSzLg0Ro5Z5R7XKkIX+Cc6oD1rqeDJnwsB8/A==} - deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me - glob@7.2.3: resolution: {integrity: sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==} deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me @@ -2152,10 +2108,6 @@ packages: resolution: {integrity: sha512-uhSZLPPD2VXXOSN8Cni3kIsoFHaU2pT/nySEU/fHr/ePbqHYr0jeiQRmUKLEirC09SFPsdMoA7LU7UXMd/w0Kw==} engines: {node: '>= 6.15.1'} - https-proxy-agent@5.0.1: - resolution: {integrity: sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==} - engines: {node: '>= 6'} - iconv-lite@0.4.24: resolution: {integrity: sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA==} engines: {node: '>=0.10.0'} @@ -2547,9 +2499,6 @@ packages: resolution: {integrity: sha512-iclAHeNqNm68zFtnZ0e+1L2yUIdvzNoauKU4WBA3VvH/vPFieF7qfRlwUZU+DA9P9bPXIS90ulxoUoCH23sV2w==} engines: {node: '>= 0.6'} - millisecond@0.1.2: - resolution: {integrity: sha512-BJ8XtxY+woL+5TkP6uS6XvOArm0JVrX2otkgtWZseHpIax0oOOPW3cnwhOjRqbEJg7YRO/BDF7fO/PTWNT3T9Q==} - mime-db@1.52.0: resolution: {integrity: sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==} engines: {node: '>= 0.6'} @@ -2607,10 +2556,6 @@ packages: resolution: {integrity: sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==} engines: {node: '>=16 || 14 >=14.17'} - mkdirp@0.5.6: - resolution: {integrity: sha512-FP+p8RB8OWpF3YZBCrP5gtADmtXApB5AMLn+vdyA+PyxCjrCs00mjyUozssO33cwDeT3wNGdLxJ5M//YqtHAJw==} - hasBin: true - mkdirp@3.0.1: resolution: {integrity: sha512-+NsyUUAZDmo6YVHzL/stxSu3t9YS1iljliy3BSDrXJ/dkn1KYdmtZODGGjLcc9XLgVVpH4KshHB8XmZgMhaBXg==} engines: {node: '>=10'} @@ -2638,10 +2583,6 @@ packages: resolution: {integrity: sha512-WWdIxpyjEn+FhQJQQv9aQAYlHoNVdzIzUySNV1gHUPDSdZJ3yZn7pAAbQcV7B56Mvu881q9FZV+0Vx2xC44VWA==} engines: {node: ^18.17.0 || >=20.5.0} - mv@2.1.1: - resolution: {integrity: sha512-at/ZndSy3xEGJ8i0ygALh8ru9qy7gWW1cmkaqBN29JmMlIvM//MEO9y1sk/avxuwnPcfhkejkLsuPxH81BrkSg==} - engines: {node: '>=0.8.0'} - mysql2@3.15.3: resolution: {integrity: sha512-FBrGau0IXmuqg4haEZRBfHNWB5mUARw6hNwPDXXGg0XzVJ50mr/9hb267lvpVMnhZ1FON3qNd4Xfcez1rbFwSg==} engines: {node: '>= 8.0'} @@ -2650,16 +2591,9 @@ packages: resolution: {integrity: sha512-Tz09sEL2EEuv5fFowm419c1+a/jSMiBjI9gHxVLrVdbUkkNUUfjsVYs9pVZu5oCon/kmRh9TfLEObFtkVxmY0w==} engines: {node: '>=8.0.0'} - nan@2.24.0: - resolution: {integrity: sha512-Vpf9qnVW1RaDkoNKFUvfxqAbtI8ncb8OJlqZ9wwpXzWPEsvsB1nvdUi6oYrHIkQ1Y/tMDnr1h4nczS0VB9Xykg==} - natural-compare@1.4.0: resolution: {integrity: sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==} - ncp@2.0.0: - resolution: {integrity: sha512-zIdGUrPRFTUELUvr3Gmc7KZ2Sw/h1PiVM0Af/oHB6zgnV1ikqSfRk+TOufi79aHYCW3NiOXmr1BP5nWbzojLaA==} - hasBin: true - negotiator@0.6.3: resolution: {integrity: sha512-+EUsqGPLsM+j/zdChZjsnX51g4XrHFOIXwfnCVPGlQk/k5giakcKsuxCObBRu6DSm9opw/O6slWbJdghQM4bBg==} engines: {node: '>= 0.6'} @@ -2957,10 +2891,6 @@ packages: resolution: {integrity: sha512-jOrdVvzUXBC7C+9gkIkpDJ3HIxOHTIqjpQ4C1EMt1ZGeMvSEpbFCKq23DEfgsj46vMnDgyQf+1ZLp2Wm+bKSsA==} engines: {node: '>=10'} - precond@0.2.3: - resolution: {integrity: sha512-QCYG84SgGyGzqJ/vlMsxeXd/pgL/I94ixdNFyh1PusWmTCyVfPJjZ1K1jvHtsbfnXQs2TSkEP2fR7QiMZAnKFQ==} - engines: {node: '>= 0.6'} - prelude-ls@1.2.1: resolution: {integrity: sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==} engines: {node: '>= 0.8.0'} @@ -3002,10 +2932,6 @@ packages: resolution: {integrity: sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==} engines: {node: '>= 0.10'} - proxy-from-env@2.1.0: - resolution: {integrity: sha512-cJ+oHTW1VAEa8cJslgmUZrc+sjRKgAKl3Zyse6+PV38hZe/V6Z14TbCuXcan9F9ghlz4QrFr2c92TNF82UkYHA==} - engines: {node: '>=10'} - psl@1.15.0: resolution: {integrity: sha512-JZd3gMVBAVQkSs6HdNZo9Sdo0LNcQeMNP3CozBJb3JYC/QUYZTnKxP+f8oWRX4rHP5EurWxqAHTSwUCjlNKa1w==} @@ -3030,10 +2956,6 @@ packages: querystringify@2.2.0: resolution: {integrity: sha512-FIqgj2EUvTa7R50u0rGsyTftzjYmv/a3hO345bZNrqabNqjtgiDMgmo4mkUjd+nzU5oF3dClKqFIPUKybUyqoQ==} - r7insight_node@2.1.1: - resolution: {integrity: sha512-xx0kgFxSHWY9aG1109uv4w2b+JLwHseSowOWo1bzCTDBpUk3er2rZdtQ90mAjUYbkh6Hus9DAwWvmHsX5pHaIQ==} - engines: {node: ^8.10.0 || ^10.13.0 || >=11.10.1} - range-parser@1.2.1: resolution: {integrity: sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg==} engines: {node: '>= 0.6'} @@ -3074,9 +2996,6 @@ packages: resolution: {integrity: sha512-9u/XQ1pvrQtYyMpZe7DXKv2p5CNvyVwzUB6uhLAnQwHMSgKMBR62lc7AHljaeteeHXn11XTAaLLUVZYVZyuRBQ==} engines: {node: '>= 20.19.0'} - reconnect-core@1.3.0: - resolution: {integrity: sha512-+gLKwmyRf2tjl6bLR03DoeWELzyN6LW9Xgr3vh7NXHHwPi0JC0N2TwPyf90oUEBkCRcD+bgQ+s3HORoG3nwHDg==} - reflect-metadata@0.2.2: resolution: {integrity: sha512-urBwgfrvVP/eAyXx4hluJivBKzuEbSQs9rKWCrCkbSxNv8mxPcUZKeuoF3Uy4mJl3Lwprp6yy5/39VWigZ4K6Q==} @@ -3117,11 +3036,6 @@ packages: resolution: {integrity: sha512-9LkiTwjUh6rT555DtE9rTX+BKByPfrMzEAtnlEtdEwr3Nkffwiihqe2bWADg+OQRjt9gl6ICdmB/ZFDCGAtSow==} engines: {node: '>= 4'} - rimraf@2.4.5: - resolution: {integrity: sha512-J5xnxTyqaiw06JjMftq7L9ouA448dw/E7dKghkP9WpKNuwmARNNg+Gk8/u5ryb9N/Yo2+z3MCwuqFK/+qPOPfQ==} - deprecated: Rimraf versions prior to v4 are no longer supported - hasBin: true - rimraf@3.0.2: resolution: {integrity: sha512-JZkJMZkAGFFPP2YqXZXPbMlMBgsxzE8ILs4lMIX/2o0L9UBw9O/Y3o6wFw/i9YLapcUJWwqbi3kdxIPdC62TIA==} deprecated: Rimraf versions prior to v4 are no longer supported @@ -3140,9 +3054,6 @@ packages: safe-buffer@5.2.1: resolution: {integrity: sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==} - safe-json-stringify@1.2.0: - resolution: {integrity: sha512-gH8eh2nZudPQO6TytOvbxnuhYBOvDBBLW52tz5q6X58lJcd/tkmqFR+5Z9adS8aJtURSXWThWy/xJtJwixErvg==} - safe-stable-stringify@2.5.0: resolution: {integrity: sha512-b3rppTKm9T+PsVCBEOUR46GWI7fdOs00VKZ1+9c1EWDaDMvjQc6tUwuFyIprgGgTcWoVHSKrU8H31ZHA2e0RHA==} engines: {node: '>=10'} @@ -3161,10 +3072,6 @@ packages: resolution: {integrity: sha512-eflK8wEtyOE6+hsaRVPxvUKYCpRgzLqDTb8krvAsRIwOGlHoSgYLgBXoubGgLd2fT41/OUYdb48v4k4WWHQurA==} engines: {node: '>= 10.13.0'} - semver@5.7.2: - resolution: {integrity: sha512-cBznnQ9KjJqU67B52RMC65CMarK2600WFnbkcaiwWq3xy/5haFJlshgnpjovMVJ+Hff49d8GEn0b87C5pDQ10g==} - hasBin: true - semver@6.3.1: resolution: {integrity: sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==} hasBin: true @@ -3407,10 +3314,10 @@ packages: resolution: {integrity: sha512-uxc/zpqFg6x7C8vOE7lh6Lbda8eEL9zmVm/PLeTPBRhh1xCgdWaQ+J1CUieGpIfm2HdtsUpRv+HshiasBMcc6A==} engines: {node: '>=6'} - tc-core-library-js@https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/1075136355e1e1c4779f2138a30f3ffbd718bfa4: - resolution: {tarball: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/1075136355e1e1c4779f2138a30f3ffbd718bfa4} - version: 3.0.1 - engines: {node: '>= 14'} + tc-core-library-js@https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/6c326fea0abfccb5ae29dff2ac5bce01aabc1fa4: + resolution: {gitHosted: true, tarball: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/6c326fea0abfccb5ae29dff2ac5bce01aabc1fa4} + version: 4.0.0-rc.1 + engines: {node: '>=22.13'} teleport-javascript@1.0.0: resolution: {integrity: sha512-j1llvWVFyEn/6XIFDfX5LAU43DXe0GCt3NfXDwJ8XpRRMkS+i50SAkonAONBy+vxwPFBd50MFU8a2uj8R/ccLg==} @@ -4570,16 +4477,6 @@ snapshots: '@tokenizer/token@0.3.0': {} - '@topcoder-platform/topcoder-bus-api-wrapper@https://codeload.github.com/topcoder-platform/tc-bus-api-wrapper/tar.gz/297a9c0adcdb97661257e7825bee9c3f5578b833(debug@4.4.3(supports-color@5.5.0))(supports-color@5.5.0)': - dependencies: - joi: 18.2.3 - lodash: 4.18.1 - superagent: 10.3.0(supports-color@5.5.0) - tc-core-library-js: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/1075136355e1e1c4779f2138a30f3ffbd718bfa4(debug@4.4.3(supports-color@5.5.0))(supports-color@5.5.0) - transitivePeerDependencies: - - debug - - supports-color - '@tsconfig/node10@1.0.12': {} '@tsconfig/node12@1.0.11': {} @@ -4866,12 +4763,6 @@ snapshots: acorn@8.17.0: {} - agent-base@6.0.2(supports-color@5.5.0): - dependencies: - debug: 4.4.3(supports-color@5.5.0) - transitivePeerDependencies: - - supports-color - agent-base@7.1.4: {} aggregate-error@3.1.0: @@ -4978,20 +4869,6 @@ snapshots: aws4@1.13.2: {} - axios@1.18.1(debug@4.4.3(supports-color@5.5.0))(supports-color@5.5.0): - dependencies: - follow-redirects: 1.16.0(debug@4.4.3(supports-color@5.5.0)) - form-data: 4.0.6 - https-proxy-agent: 5.0.1(supports-color@5.5.0) - proxy-from-env: 2.1.0 - transitivePeerDependencies: - - debug - - supports-color - - backoff@2.5.0: - dependencies: - precond: 0.2.3 - balanced-match@1.0.2: {} balanced-match@4.0.4: {} @@ -5087,13 +4964,6 @@ snapshots: base64-js: 1.5.1 ieee754: 1.1.13 - bunyan@1.8.15: - optionalDependencies: - dtrace-provider: 0.8.8 - moment: 2.30.1 - mv: 2.1.1 - safe-json-stringify: 1.2.0 - busboy@1.6.0: dependencies: streamsearch: 1.1.0 @@ -5213,10 +5083,6 @@ snapshots: clone@1.0.4: {} - codependency@2.1.0: - dependencies: - semver: 5.7.2 - color-convert@2.0.1: dependencies: color-name: 1.1.4 @@ -5403,11 +5269,6 @@ snapshots: dotenv@17.4.2: {} - dtrace-provider@0.8.8: - dependencies: - nan: 2.24.0 - optional: true - dunder-proto@1.0.1: dependencies: call-bind-apply-helpers: 1.0.2 @@ -5739,10 +5600,6 @@ snapshots: fn.name@1.1.0: {} - follow-redirects@1.16.0(debug@4.4.3(supports-color@5.5.0)): - optionalDependencies: - debug: 4.4.3(supports-color@5.5.0) - foreground-child@2.0.0: dependencies: cross-spawn: 7.0.6 @@ -5872,15 +5729,6 @@ snapshots: minipass: 7.1.3 path-scurry: 2.0.2 - glob@6.0.4: - dependencies: - inflight: 1.0.6 - inherits: 2.0.4 - minimatch: 3.1.4 - once: 1.4.0 - path-is-absolute: 1.0.1 - optional: true - glob@7.2.3: dependencies: fs.realpath: 1.0.0 @@ -5984,13 +5832,6 @@ snapshots: httpreq@1.1.1: {} - https-proxy-agent@5.0.1(supports-color@5.5.0): - dependencies: - agent-base: 6.0.2(supports-color@5.5.0) - debug: 4.4.3(supports-color@5.5.0) - transitivePeerDependencies: - - supports-color - iconv-lite@0.4.24: dependencies: safer-buffer: 2.1.2 @@ -6348,8 +6189,6 @@ snapshots: methods@1.1.2: {} - millisecond@0.1.2: {} - mime-db@1.52.0: {} mime-db@1.54.0: {} @@ -6394,11 +6233,6 @@ snapshots: minipass@7.1.3: {} - mkdirp@0.5.6: - dependencies: - minimist: 1.2.8 - optional: true - mkdirp@3.0.1: {} mocha@11.7.6: @@ -6440,13 +6274,6 @@ snapshots: mute-stream@2.0.0: {} - mv@2.1.1: - dependencies: - mkdirp: 0.5.6 - ncp: 2.0.0 - rimraf: 2.4.5 - optional: true - mysql2@3.15.3: dependencies: aws-ssl-profiles: 1.1.2 @@ -6463,14 +6290,8 @@ snapshots: dependencies: lru.min: 1.1.4 - nan@2.24.0: - optional: true - natural-compare@1.4.0: {} - ncp@2.0.0: - optional: true - negotiator@0.6.3: {} negotiator@1.0.0: {} @@ -6869,8 +6690,6 @@ snapshots: dependencies: punycode: 2.3.1 - precond@0.2.3: {} - prelude-ls@1.2.1: {} prettier@3.9.5: {} @@ -6913,8 +6732,6 @@ snapshots: forwarded: 0.2.0 ipaddr.js: 1.9.1 - proxy-from-env@2.1.0: {} - psl@1.15.0: dependencies: punycode: 2.3.1 @@ -6936,13 +6753,6 @@ snapshots: querystringify@2.2.0: {} - r7insight_node@2.1.1: - dependencies: - codependency: 2.1.0 - json-stringify-safe: 5.0.1 - lodash: 4.18.1 - reconnect-core: 1.3.0 - range-parser@1.2.1: {} raw-body@2.5.3: @@ -6985,10 +6795,6 @@ snapshots: readdirp@5.0.0: {} - reconnect-core@1.3.0: - dependencies: - backoff: 2.5.0 - reflect-metadata@0.2.2: {} release-zalgo@1.0.0: @@ -7016,11 +6822,6 @@ snapshots: retry@0.12.0: {} - rimraf@2.4.5: - dependencies: - glob: 6.0.4 - optional: true - rimraf@3.0.2: dependencies: glob: 7.2.3 @@ -7045,9 +6846,6 @@ snapshots: safe-buffer@5.2.1: {} - safe-json-stringify@1.2.0: - optional: true - safe-stable-stringify@2.5.0: {} safer-buffer@2.1.2: {} @@ -7067,8 +6865,6 @@ snapshots: ajv-formats: 2.1.1(ajv@8.20.0) ajv-keywords: 5.1.0(ajv@8.20.0) - semver@5.7.2: {} - semver@6.3.1: {} semver@7.5.4: @@ -7355,17 +7151,12 @@ snapshots: tapable@2.3.3: {} - tc-core-library-js@https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/1075136355e1e1c4779f2138a30f3ffbd718bfa4(debug@4.4.3(supports-color@5.5.0))(supports-color@5.5.0): + tc-core-library-js@https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/6c326fea0abfccb5ae29dff2ac5bce01aabc1fa4(supports-color@5.5.0): dependencies: - axios: 1.18.1(debug@4.4.3(supports-color@5.5.0))(supports-color@5.5.0) - bunyan: 1.8.15 + '@types/jsonwebtoken': 9.0.10 jsonwebtoken: 9.0.3 jwks-rsa: 3.2.0(supports-color@5.5.0) - lodash: 4.18.1 - millisecond: 0.1.2 - r7insight_node: 2.1.1 transitivePeerDependencies: - - debug - supports-color teleport-javascript@1.0.0: {} diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 69f24f7..816901d 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -1,5 +1,4 @@ overrides: - '@topcoder-platform/topcoder-bus-api-wrapper>tc-core-library-js': https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/1075136355e1e1c4779f2138a30f3ffbd718bfa4 '@hono/node-server@<2.0.11': 2.0.11 'ajv@>=6.0.0 <6.14.0': 6.15.0 'axios@<1.18.1': 1.18.1 diff --git a/src/common/helper.ts b/src/common/helper.ts index 4687292..a5116f0 100644 --- a/src/common/helper.ts +++ b/src/common/helper.ts @@ -14,9 +14,9 @@ const moment = require('moment') const constants = require('../../app-constants') const errors = require('./errors') const logger = require('./logger') -const m2mAuth = require('tc-core-library-js').auth.m2m +const m2mAuth = require('tc-core-library-js').createM2MClient const m2m = m2mAuth(_.pick(config, ['AUTH0_URL', 'AUTH0_AUDIENCE', 'TOKEN_CACHE_TIME', 'AUTH0_PROXY_SERVER_URL'])) -const busApi = require('tc-bus-api-wrapper') +const busApi = require('tc-core-library-js').createBusApiClient const busApiClient = busApi(_.pick(config, ['AUTH0_URL', 'AUTH0_AUDIENCE', 'TOKEN_CACHE_TIME', 'AUTH0_CLIENT_ID', 'AUTH0_CLIENT_SECRET', 'BUSAPI_URL', 'KAFKA_ERROR_TOPIC', 'AUTH0_PROXY_SERVER_URL'])) diff --git a/test/postman/newman.js b/test/postman/newman.js index 5db8835..aacbff2 100644 --- a/test/postman/newman.js +++ b/test/postman/newman.js @@ -5,7 +5,7 @@ const newman = require('newman') const helper = require('../../src/common/helper') const logger = require('../../src/common/logger') -const m2m = require('tc-core-library-js').auth.m2m({ +const m2m = require('tc-core-library-js').createM2MClient({ AUTH0_URL: config.AUTH0_URL, AUTH0_AUDIENCE: config.AUTH0_AUDIENCE, TOKEN_CACHE_TIME: config.TOKEN_CACHE_TIME, From bd0f6cffda9e50acbb6cb578b6f613b9c06fda60 Mon Sep 17 00:00:00 2001 From: jmgasper Date: Tue, 27 Oct 2026 14:16:08 +1100 Subject: [PATCH 02/13] fix: allow maintained Alpine Node patch releases --- README.md | 11 +++++++++++ docker/Dockerfile | 5 ++++- 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 57d0b8b..77a668e 100644 --- a/README.md +++ b/README.md @@ -22,3 +22,14 @@ not retry POSTs automatically. Application retry/outbox behavior remains local. See the [core migration guide](https://github.com/topcoder-platform/tc-core-library-js/blob/v4.0.0-rc.1/MIGRATION.md) for the API mapping, compatibility requirements, and rollout scope. + +## Alpine Node runtime packages + +Container stages that install Node through APK constrain `nodejs-current` to the +major version in `NODE_VERSION`, rather than an exact Alpine package revision. +Alpine replaces older patch packages in its repositories; the compatible pin +allows current security patches while a build-time check rejects a different +Node major. The runtime keeps Alpine's dynamically linked Node and system +libraries. Existing non-root users and application entrypoints are preserved. +Build stages using a versioned official Node image retain their configured +version, and pnpm build arguments are explicitly declared in the consuming stage. diff --git a/docker/Dockerfile b/docker/Dockerfile index 132244e..1250292 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -36,8 +36,11 @@ ARG NODE_VERSION ENV NODE_ENV=production WORKDIR /resources-api +# Alpine replaces old APK patch versions. Keep the configured Node major while +# accepting maintained patch releases and verify the selected runtime below. RUN apk upgrade --no-cache \ - && apk add --no-cache bash "nodejs-current=${NODE_VERSION}-r0" \ + && apk add --no-cache bash "nodejs-current~${NODE_VERSION%%.*}" \ + && test "$(node -p 'process.versions.node.split(".")[0]')" = "${NODE_VERSION%%.*}" \ && addgroup -S -g 10001 app \ && adduser -S -D -H -u 10001 -G app app From 81e1ef5e198340075e5c0f162a6c9ab200c69553 Mon Sep 17 00:00:00 2001 From: jmgasper Date: Wed, 28 Oct 2026 14:43:29 +1100 Subject: [PATCH 03/13] fix: align shared JWT configuration and deployment inputs --- README.md | 22 ++++++ app-routes.ts | 4 +- config/default.js | 1 + package.json | 2 +- test/unit/jwt-configuration.test.ts | 101 ++++++++++++++++++++++++++++ 5 files changed, 128 insertions(+), 2 deletions(-) create mode 100644 test/unit/jwt-configuration.test.ts diff --git a/README.md b/README.md index 77a668e..aeb0b62 100644 --- a/README.md +++ b/README.md @@ -33,3 +33,25 @@ Node major. The runtime keeps Alpine's dynamically linked Node and system libraries. Existing non-root users and application entrypoints are preserved. Build stages using a versioned official Node image retain their configured version, and pnpm build arguments are explicitly declared in the consuming stage. + +## Shared JWT deployment configuration + +Development deployments load `/config/common/global-appvar` alongside the service's +application parameters. JWT verification uses the same four settings as the other +v6 services: `VALID_ISSUERS` (JSON array or comma-separated exact issuers), +`AUTH_SECRET` (the existing shared HS256 signing key, at least 32 UTF-8 bytes), +`JWT_AUDIENCE` (the browser application's audience), and `AUTH0_AUDIENCE` (the +machine/API audience). RSA keys are fetched over HTTPS from the trusted issuer's +`/.well-known/jwks.json`. Audience settings must reach the shared verifier; OAuth +client IDs/secrets used for outbound requests are independent of JWT audiences. + +The development browser audience is `BXWXUWnilVUPdN01t2Se29Tw2ZYNGZvH`, and the +machine audience is `https://m2m.topcoder-dev.com/`. Use the existing Parameter Store +secret rather than creating a per-service key. Reconcile any service-specific +overrides of these four keys with the global values before deployment. Parameters +are consumed on deployment/task startup; changing Parameter Store alone does not +replace running tasks. Existing role, scope, ownership and active-session checks +continue after JWT verification. + +Protected and optional-authentication routes share one authenticator instance, +including its bounded JWKS cache. diff --git a/app-routes.ts b/app-routes.ts index 4edbfcc..849ccad 100644 --- a/app-routes.ts +++ b/app-routes.ts @@ -28,6 +28,8 @@ const authenticator = require('tc-core-library-js').createJwtAuthenticator * authorization middleware raises an application error. */ function configureRoutes (app: any): void { + // Share issuer/audience configuration and the JWKS cache across all routes. + const authenticate = authenticator(_.pick(config, ['AUTH_SECRET', 'VALID_ISSUERS', 'JWT_AUDIENCE', 'AUTH0_AUDIENCE'])) _.each(routes, (verbs, path) => { _.each(verbs, (def, verb) => { const controllerPath = `./src/controllers/${def.controller}` @@ -52,7 +54,7 @@ function configureRoutes (app: any): void { if (def.allowAnonymous && !token) { next() } else { - authenticator(_.pick(config, ['AUTH_SECRET', 'VALID_ISSUERS']))(req, res, next) + authenticate(req, res, next) } }) diff --git a/config/default.js b/config/default.js index 877ea92..a8ed3a0 100644 --- a/config/default.js +++ b/config/default.js @@ -11,6 +11,7 @@ module.exports = { API_BASE_URL: process.env.API_BASE_URL || `http://localhost:3000`, AUTH_SECRET: process.env.AUTH_SECRET, + JWT_AUDIENCE: process.env.JWT_AUDIENCE, VALID_ISSUERS: process.env.VALID_ISSUERS || '["https://api.topcoder-dev.com", "https://api.topcoder.com", "https://topcoder-dev.auth0.com/"]', SUBMITTER_RESOURCE_ROLE_ID: process.env.SUBMITTER_RESOURCE_ROLE_ID || '732339e7-8e30-49d7-9198-cccf9451e221', diff --git a/package.json b/package.json index 7194dae..72078d2 100644 --- a/package.json +++ b/package.json @@ -22,7 +22,7 @@ "view-data": "node dist/src/scripts/view-data.js", "mock-api": "NODE_ENV=test node --require ts-node/register/transpile-only mock/mock-api.js", "mock-challenge-api": "NODE_ENV=test node --require ts-node/register/transpile-only mock/mock-challenge-api.js", - "test": "nyc --reporter=html --reporter=text mocha --require ts-node/register/transpile-only test/unit/logger.test.ts test/unit/outbound-url.test.ts test/unit/prisma-adapter.test.ts test/unit/test.js --require test/common/prepare.js --timeout 60000 --exit", + "test": "nyc --reporter=html --reporter=text mocha --require ts-node/register/transpile-only test/unit/logger.test.ts test/unit/outbound-url.test.ts test/unit/prisma-adapter.test.ts test/unit/jwt-configuration.test.ts test/unit/test.js --require test/common/prepare.js --timeout 60000 --exit", "test:logger": "mocha --require ts-node/register/transpile-only test/unit/logger.test.ts --timeout 10000", "test:adapter": "mocha --require ts-node/register/transpile-only test/unit/prisma-adapter.test.ts", "test:newman": "NODE_ENV=test node --require ts-node/register/transpile-only test/postman/newman.js", diff --git a/test/unit/jwt-configuration.test.ts b/test/unit/jwt-configuration.test.ts new file mode 100644 index 0000000..a4cb8fc --- /dev/null +++ b/test/unit/jwt-configuration.test.ts @@ -0,0 +1,101 @@ +const assert = require('node:assert/strict'); +const Module = require('node:module'); +const { generateKeyPairSync } = require('node:crypto'); +const { createRequire } = require('node:module'); +const jwt = require('jsonwebtoken'); + +const secret = 'routes-test-signing-secret-at-least-32-bytes'; +const issuer = 'https://auth.topcoder-dev.com/'; +const sharedRequire = createRequire(require.resolve('tc-core-library-js')); +const { JwksClient } = sharedRequire('jwks-rsa'); +const { privateKey, publicKey } = generateKeyPairSync('rsa', { modulusLength: 2048 }); + +describe('route JWT configuration', () => { + const originalEnv = process.env; + const originalSigningKey = JwksClient.prototype.getSigningKey; + let authenticate: any; + + before(() => { + process.env = { ...originalEnv, AUTH_SECRET: secret, VALID_ISSUERS: JSON.stringify([issuer]), JWT_AUDIENCE: 'browser-client', AUTH0_AUDIENCE: 'machine-api' }; + // Stub only JWKS I/O. The actual route middleware and released verifier run. + JwksClient.prototype.getSigningKey = async () => ({ getPublicKey: () => publicKey.export({ type: 'spki', format: 'pem' }).toString() }); + const configPath = require.resolve('../../config/default.js'); + delete require.cache[configPath]; + const config = require(configPath); + const routePath = require.resolve('../../app-routes'); + delete require.cache[routePath]; + const originalLoad = Module._load; + const routes: Record = {}; + Module._load = function (name: string, parent: any, ...rest: any[]) { + if (parent?.filename === routePath) { + if (name === 'config') return config; + if (name === './src/routes') return { '/jwt-test': { get: { auth: true, controller: 'JwtTest', method: 'run', scopes: ['read:test'], access: ['User'] } } }; + if (name === './src/controllers/JwtTest') return { run: () => undefined }; + if (name === './src/common/helper') return { autoWrapExpress: (actions: any[]) => actions }; + if (name === './src/common/logger') return { info: () => undefined, warn: () => undefined, error: () => undefined, debug: () => undefined }; + } + return originalLoad.call(this, name, parent, ...rest); + }; + try { + require(routePath)({ get: (path: string, actions: any[]) => { routes[path] = actions; }, use: () => undefined }); + authenticate = routes[`/${config.API_VERSION}/jwt-test`][1]; + } finally { + Module._load = originalLoad; + delete require.cache[routePath]; + delete require.cache[configPath]; + } + }); + + after(() => { + process.env = originalEnv; + JwksClient.prototype.getSigningKey = originalSigningKey; + }); + + /** Executes the registered protected-route authenticator with a signed token. + * @param token Compact JWT. @returns Status and verified identity; rejects on unexpected middleware errors. + */ + function verify(token: string): Promise { + const request: any = { headers: { authorization: `Bearer ${token}` } }; + return new Promise((resolve, reject) => { + const response: any = { statusCode: 200 }; + response.status = (status: number) => { response.statusCode = status; return response; }; + response.json = () => resolve({ status: response.statusCode, user: request.authUser }); + response.send = response.json; + authenticate(request, response, (error?: Error) => error ? reject(error) : resolve({ status: response.statusCode, user: request.authUser })); + }); + } + + it('accepts browser RSA tokens using JWT_AUDIENCE', async () => { + const token = jwt.sign({ userId: '42', roles: ['User'] }, privateKey, { algorithm: 'RS256', keyid: 'test-key', issuer, audience: 'browser-client', expiresIn: 300 }); + const result = await verify(token); + assert.equal(result.status, 200); + assert.equal(result.user.isMachine, false); + }); + + it('accepts machine RSA tokens using AUTH0_AUDIENCE', async () => { + const token = jwt.sign({ sub: 'client@clients', gty: 'client-credentials', scope: 'read:test' }, privateKey, { algorithm: 'RS256', keyid: 'test-key', issuer, audience: 'machine-api', expiresIn: 300 }); + const result = await verify(token); + assert.equal(result.status, 200); + assert.equal(result.user.isMachine, true); + }); + + it('retains legacy HS256 human tokens without an audience', async () => { + const token = jwt.sign({ userId: '42', roles: ['User'] }, secret, { issuer, expiresIn: 300 }); + assert.equal((await verify(token)).status, 200); + }); + + it('rejects an untrusted audience', async () => { + const token = jwt.sign({ userId: '42' }, privateKey, { algorithm: 'RS256', keyid: 'test-key', issuer, audience: 'another-api', expiresIn: 300 }); + assert.equal((await verify(token)).status, 401); + }); + + it('rejects a machine token addressed to the browser client', async () => { + const token = jwt.sign({ sub: 'client@clients', gty: 'client-credentials' }, privateKey, { algorithm: 'RS256', keyid: 'test-key', issuer, audience: 'browser-client', expiresIn: 300 }); + assert.equal((await verify(token)).status, 401); + }); + + it('rejects an invalid signature', async () => { + const token = jwt.sign({ userId: '42' }, 'incorrect-secret-at-least-32-bytes', { issuer, expiresIn: 300 }); + assert.equal((await verify(token)).status, 401); + }); +}); From a4a4537803ca181dea93bb6dc0887d08b8a301fa Mon Sep 17 00:00:00 2001 From: Justin Gasper Date: Mon, 2 Nov 2026 11:53:03 +1100 Subject: [PATCH 04/13] fix: patch service and migration dependencies with compatibility coverage --- docker/Dockerfile | 5 +- migrator/.npmrc | 1 + migrator/package-lock.json | 1186 +++++++++++------------- migrator/package.json | 15 +- migrator/src/clients/dynamoLoader.js | 2 +- migrator/src/utils/batchMigrator.js | 2 +- migrator/src/utils/progressLogger.js | 7 +- migrator/test/streaming.test.cjs | 47 + package.json | 9 +- patches/newman@6.2.2.patch | 13 + patches/postman-collection@4.4.0.patch | 319 +++++++ pnpm-lock.yaml | 576 +++++------- pnpm-workspace.yaml | 49 +- tools/minimatch-compat/index.cjs | 38 + tools/minimatch-compat/index.test.cjs | 85 ++ tools/minimatch-compat/package.json | 10 + 16 files changed, 1306 insertions(+), 1058 deletions(-) create mode 100644 migrator/.npmrc create mode 100644 migrator/test/streaming.test.cjs create mode 100644 patches/newman@6.2.2.patch create mode 100644 patches/postman-collection@4.4.0.patch create mode 100644 tools/minimatch-compat/index.cjs create mode 100644 tools/minimatch-compat/index.test.cjs create mode 100644 tools/minimatch-compat/package.json diff --git a/docker/Dockerfile b/docker/Dockerfile index 1250292..fe14de8 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1 -ARG NODE_VERSION=26.5.1 +ARG NODE_VERSION=26.12.1 FROM node:${NODE_VERSION}-alpine AS build @@ -19,11 +19,14 @@ RUN apk upgrade --no-cache \ # without connecting to a database. The committed external client is copied # later with the rest of the source tree and is not regenerated. COPY package.json pnpm-lock.yaml pnpm-workspace.yaml prisma.config.ts tsconfig.json tsconfig.build.json ./ +COPY tools ./tools +COPY patches ./patches COPY prisma ./prisma RUN pnpm install --frozen-lockfile COPY . . RUN mkdir -p src/scripts/seed \ + && pnpm run test:dependency-compat \ && pnpm lint \ && pnpm test:logger \ && pnpm build \ diff --git a/migrator/.npmrc b/migrator/.npmrc new file mode 100644 index 0000000..c7d3517 --- /dev/null +++ b/migrator/.npmrc @@ -0,0 +1 @@ +install-links=true diff --git a/migrator/package-lock.json b/migrator/package-lock.json index 643c07b..6e5da06 100644 --- a/migrator/package-lock.json +++ b/migrator/package-lock.json @@ -13,7 +13,8 @@ "cli-progress": "^3.12.0", "dotenv": "^16.5.0", "prisma": "^6.6.0", - "stream-json": "^1.9.1" + "stream-chain": "^4.4.1", + "stream-json": "^3.8.0" }, "devDependencies": { "jest": "^29.7.0" @@ -76,14 +77,14 @@ } }, "node_modules/@babel/generator": { - "version": "7.29.7", - "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.7.tgz", - "integrity": "sha512-DkXD5OJQaAQIdZ1bt3UZdEnHAn9Imd3IVBdX03UFe+ony9Ojw5pzr9YVKGDY1jt+Gcn/FnGkNf8r+Vj5NOJWtQ==", + "version": "7.29.12", + "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.12.tgz", + "integrity": "sha512-2W76mhjrpQFO1lK5e8IvGYB2D0YZ7S2R1Z2BjO2ZUYuW+amcpK/z60U6ZZmzskwoa7sJ6XohP/Wg8H5KxXI/IA==", "dev": true, "license": "MIT", "dependencies": { - "@babel/parser": "^7.29.7", - "@babel/types": "^7.29.7", + "@babel/parser": "^7.29.12", + "@babel/types": "^7.29.11", "@jridgewell/gen-mapping": "^0.3.12", "@jridgewell/trace-mapping": "^0.3.28", "jsesc": "^3.0.2" @@ -152,9 +153,9 @@ } }, "node_modules/@babel/helper-plugin-utils": { - "version": "7.26.5", - "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.26.5.tgz", - "integrity": "sha512-RS+jZcRdZdRFzMyr+wcsaqOmld1/EqTghfaBGQQd/WnRdzdlvSZ//kF7U8VQTxf1ynZ4cjUcYgjVGx13ewNPMg==", + "version": "7.29.7", + "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.29.7.tgz", + "integrity": "sha512-G7sHYigPY17oO5SYWnfD/0MTBwVR781S/JI643e/JhUYgVgWE/61SoW3NH9KWUKyKq5LVh3npif99Wkt6j86Jw==", "dev": true, "license": "MIT", "engines": { @@ -162,9 +163,9 @@ } }, "node_modules/@babel/helper-string-parser": { - "version": "7.29.7", - "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.29.7.tgz", - "integrity": "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==", + "version": "7.29.11", + "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.29.11.tgz", + "integrity": "sha512-snZbO7MEDOof+hvNa97EjEY7qD7h2kwvQr5AJC3ZhQudKW5dnej6k3kP9NQV88hJwaS8vDqRLFo9rivLEhle2g==", "dev": true, "license": "MIT", "engines": { @@ -192,27 +193,27 @@ } }, "node_modules/@babel/helpers": { - "version": "7.29.7", - "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.29.7.tgz", - "integrity": "sha512-1k2lAGRMfHTcwuNYcCNUmaUffmQv8KWMfh2iJUUeRlwlwH4FdNG7mfPI10NPfLHJFThE4Tyr4mv7kTNZOiPuBg==", + "version": "7.29.10", + "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.29.10.tgz", + "integrity": "sha512-EMCx3AGZ3WfAl6ht7AyQoPm2Lh+BGYEMdc4Q6Hf7uSCDOZFuLq44qNwL+iaim8VlyYhRAo4X43+weadK8ZB4Yg==", "dev": true, "license": "MIT", "dependencies": { "@babel/template": "^7.29.7", - "@babel/types": "^7.29.7" + "@babel/types": "^7.29.8" }, "engines": { "node": ">=6.9.0" } }, "node_modules/@babel/parser": { - "version": "7.29.7", - "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.7.tgz", - "integrity": "sha512-hnORnjP/1P/zFEndoeX+n+t1RwWRJiJpM/jO7FW32Kn9r5+sJB2JWOdYo4L6k78j15eCwY3Gm/7364B1EMwtNg==", + "version": "7.29.12", + "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.12.tgz", + "integrity": "sha512-WJ7JBp/Q4+z/ImydtI7jS6NVco5++632ExBemSX+Ysb+G1lCwQ5BVo3SY+jGGOcZXI4ZccbZSUSJLNBW6eEpJg==", "dev": true, "license": "MIT", "dependencies": { - "@babel/types": "^7.29.7" + "@babel/types": "^7.29.11" }, "bin": { "parser": "bin/babel-parser.js" @@ -277,13 +278,13 @@ } }, "node_modules/@babel/plugin-syntax-import-attributes": { - "version": "7.26.0", - "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-import-attributes/-/plugin-syntax-import-attributes-7.26.0.tgz", - "integrity": "sha512-e2dttdsJ1ZTpi3B9UYGLw41hifAubg19AtCu/2I/F1QNVclOBr1dYpTdmdyZ84Xiz43BS/tCUkMAZNLv12Pi+A==", + "version": "7.29.7", + "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-import-attributes/-/plugin-syntax-import-attributes-7.29.7.tgz", + "integrity": "sha512-zGYcYfq/WmZ4V+kBIXQon9dSSc8ircGZqw9ZaNhhGj9nZkeBu1jHLBDQqYYi5WA9uawvA2sIMbry2nCFhf5Djg==", "dev": true, "license": "MIT", "dependencies": { - "@babel/helper-plugin-utils": "^7.25.9" + "@babel/helper-plugin-utils": "^7.29.7" }, "engines": { "node": ">=6.9.0" @@ -319,13 +320,13 @@ } }, "node_modules/@babel/plugin-syntax-jsx": { - "version": "7.25.9", - "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-jsx/-/plugin-syntax-jsx-7.25.9.tgz", - "integrity": "sha512-ld6oezHQMZsZfp6pWtbjaNDF2tiiCYYDqQszHt5VV437lewP9aSi2Of99CK0D0XB21k7FLgnLcmQKyKzynfeAA==", + "version": "7.29.7", + "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-jsx/-/plugin-syntax-jsx-7.29.7.tgz", + "integrity": "sha512-TSu8+mHCoEaaCDEZ0I3+6mvTBYR4PCxQwf2z9/r5Tbztv6NaLR3B9thGTTxX2WGuGHJqRiAbKPeGTJ5XWXVg6A==", "dev": true, "license": "MIT", "dependencies": { - "@babel/helper-plugin-utils": "^7.25.9" + "@babel/helper-plugin-utils": "^7.29.7" }, "engines": { "node": ">=6.9.0" @@ -445,13 +446,13 @@ } }, "node_modules/@babel/plugin-syntax-typescript": { - "version": "7.25.9", - "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-typescript/-/plugin-syntax-typescript-7.25.9.tgz", - "integrity": "sha512-hjMgRy5hb8uJJjUcdWunWVcoi9bGpJp8p5Ol1229PoN6aytsLwNMgmdftO23wnCLMfVmTwZDWMPNq/D1SY60JQ==", + "version": "7.29.7", + "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-typescript/-/plugin-syntax-typescript-7.29.7.tgz", + "integrity": "sha512-ngr+82Sh0xMz25TPCZi+nC2iTzjfCdWS2ONXTp/PtSCHCgaCNBpdMqgvJ2ccdLlClVZ7sisIgB914j/JFe+RZA==", "dev": true, "license": "MIT", "dependencies": { - "@babel/helper-plugin-utils": "^7.25.9" + "@babel/helper-plugin-utils": "^7.29.7" }, "engines": { "node": ">=6.9.0" @@ -476,18 +477,18 @@ } }, "node_modules/@babel/traverse": { - "version": "7.29.7", - "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.7.tgz", - "integrity": "sha512-EhlfNQtZ+NK22w5BM61ciuiq1m58ed33Wr1Xan//ZRTy6hgjnwyCffRYwzsGXdASJSUJ1guZILsErh1eQcl+zw==", + "version": "7.29.12", + "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.12.tgz", + "integrity": "sha512-MscXe/NAZcOkYEsRajHZFt3ynsb22PUi6CTrp5U7+RYycR9By84mn9mFN54YgfITiqK4hFx3Ju3tZSyzfpS5ew==", "dev": true, "license": "MIT", "dependencies": { "@babel/code-frame": "^7.29.7", - "@babel/generator": "^7.29.7", + "@babel/generator": "^7.29.12", "@babel/helper-globals": "^7.29.7", - "@babel/parser": "^7.29.7", + "@babel/parser": "^7.29.12", "@babel/template": "^7.29.7", - "@babel/types": "^7.29.7", + "@babel/types": "^7.29.11", "debug": "^4.3.1" }, "engines": { @@ -495,13 +496,13 @@ } }, "node_modules/@babel/types": { - "version": "7.29.7", - "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.7.tgz", - "integrity": "sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA==", + "version": "7.29.11", + "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.11.tgz", + "integrity": "sha512-WCsemW40Cpc6gouC1SrY6PBaZ+oLRlEVY9XBvZBI7il/HyUrb2nJ505wE1MHEFyDZNnrWDEuy4jL50WVHfTTSQ==", "dev": true, "license": "MIT", "dependencies": { - "@babel/helper-string-parser": "^7.29.7", + "@babel/helper-string-parser": "^7.29.11", "@babel/helper-validator-identifier": "^7.29.7" }, "engines": { @@ -515,405 +516,12 @@ "dev": true, "license": "MIT" }, - "node_modules/@esbuild/aix-ppc64": { - "version": "0.25.2", - "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.25.2.tgz", - "integrity": "sha512-wCIboOL2yXZym2cgm6mlA742s9QeJ8DjGVaL39dLN4rRwrOgOyYSnOaFPhKZGLb2ngj4EyfAFjsNJwPXZvseag==", - "cpu": [ - "ppc64" - ], - "license": "MIT", - "optional": true, - "os": [ - "aix" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/android-arm": { - "version": "0.25.2", - "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.25.2.tgz", - "integrity": "sha512-NQhH7jFstVY5x8CKbcfa166GoV0EFkaPkCKBQkdPJFvo5u+nGXLEH/ooniLb3QI8Fk58YAx7nsPLozUWfCBOJA==", - "cpu": [ - "arm" - ], - "license": "MIT", - "optional": true, - "os": [ - "android" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/android-arm64": { - "version": "0.25.2", - "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.25.2.tgz", - "integrity": "sha512-5ZAX5xOmTligeBaeNEPnPaeEuah53Id2tX4c2CVP3JaROTH+j4fnfHCkr1PjXMd78hMst+TlkfKcW/DlTq0i4w==", - "cpu": [ - "arm64" - ], - "license": "MIT", - "optional": true, - "os": [ - "android" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/android-x64": { - "version": "0.25.2", - "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.25.2.tgz", - "integrity": "sha512-Ffcx+nnma8Sge4jzddPHCZVRvIfQ0kMsUsCMcJRHkGJ1cDmhe4SsrYIjLUKn1xpHZybmOqCWwB0zQvsjdEHtkg==", - "cpu": [ - "x64" - ], - "license": "MIT", - "optional": true, - "os": [ - "android" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/darwin-arm64": { - "version": "0.25.2", - "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.25.2.tgz", - "integrity": "sha512-MpM6LUVTXAzOvN4KbjzU/q5smzryuoNjlriAIx+06RpecwCkL9JpenNzpKd2YMzLJFOdPqBpuub6eVRP5IgiSA==", - "cpu": [ - "arm64" - ], - "license": "MIT", - "optional": true, - "os": [ - "darwin" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/darwin-x64": { - "version": "0.25.2", - "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.25.2.tgz", - "integrity": "sha512-5eRPrTX7wFyuWe8FqEFPG2cU0+butQQVNcT4sVipqjLYQjjh8a8+vUTfgBKM88ObB85ahsnTwF7PSIt6PG+QkA==", - "cpu": [ - "x64" - ], - "license": "MIT", - "optional": true, - "os": [ - "darwin" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/freebsd-arm64": { - "version": "0.25.2", - "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.25.2.tgz", - "integrity": "sha512-mLwm4vXKiQ2UTSX4+ImyiPdiHjiZhIaE9QvC7sw0tZ6HoNMjYAqQpGyui5VRIi5sGd+uWq940gdCbY3VLvsO1w==", - "cpu": [ - "arm64" - ], - "license": "MIT", - "optional": true, - "os": [ - "freebsd" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/freebsd-x64": { - "version": "0.25.2", - "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.25.2.tgz", - "integrity": "sha512-6qyyn6TjayJSwGpm8J9QYYGQcRgc90nmfdUb0O7pp1s4lTY+9D0H9O02v5JqGApUyiHOtkz6+1hZNvNtEhbwRQ==", - "cpu": [ - "x64" - ], - "license": "MIT", - "optional": true, - "os": [ - "freebsd" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/linux-arm": { - "version": "0.25.2", - "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.25.2.tgz", - "integrity": "sha512-UHBRgJcmjJv5oeQF8EpTRZs/1knq6loLxTsjc3nxO9eXAPDLcWW55flrMVc97qFPbmZP31ta1AZVUKQzKTzb0g==", - "cpu": [ - "arm" - ], - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/linux-arm64": { - "version": "0.25.2", - "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.25.2.tgz", - "integrity": "sha512-gq/sjLsOyMT19I8obBISvhoYiZIAaGF8JpeXu1u8yPv8BE5HlWYobmlsfijFIZ9hIVGYkbdFhEqC0NvM4kNO0g==", - "cpu": [ - "arm64" - ], - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/linux-ia32": { - "version": "0.25.2", - "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.25.2.tgz", - "integrity": "sha512-bBYCv9obgW2cBP+2ZWfjYTU+f5cxRoGGQ5SeDbYdFCAZpYWrfjjfYwvUpP8MlKbP0nwZ5gyOU/0aUzZ5HWPuvQ==", - "cpu": [ - "ia32" - ], - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/linux-loong64": { - "version": "0.25.2", - "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.25.2.tgz", - "integrity": "sha512-SHNGiKtvnU2dBlM5D8CXRFdd+6etgZ9dXfaPCeJtz+37PIUlixvlIhI23L5khKXs3DIzAn9V8v+qb1TRKrgT5w==", - "cpu": [ - "loong64" - ], - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/linux-mips64el": { - "version": "0.25.2", - "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.25.2.tgz", - "integrity": "sha512-hDDRlzE6rPeoj+5fsADqdUZl1OzqDYow4TB4Y/3PlKBD0ph1e6uPHzIQcv2Z65u2K0kpeByIyAjCmjn1hJgG0Q==", - "cpu": [ - "mips64el" - ], - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/linux-ppc64": { - "version": "0.25.2", - "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.25.2.tgz", - "integrity": "sha512-tsHu2RRSWzipmUi9UBDEzc0nLc4HtpZEI5Ba+Omms5456x5WaNuiG3u7xh5AO6sipnJ9r4cRWQB2tUjPyIkc6g==", - "cpu": [ - "ppc64" - ], - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/linux-riscv64": { - "version": "0.25.2", - "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.25.2.tgz", - "integrity": "sha512-k4LtpgV7NJQOml/10uPU0s4SAXGnowi5qBSjaLWMojNCUICNu7TshqHLAEbkBdAszL5TabfvQ48kK84hyFzjnw==", - "cpu": [ - "riscv64" - ], - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/linux-s390x": { - "version": "0.25.2", - "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.25.2.tgz", - "integrity": "sha512-GRa4IshOdvKY7M/rDpRR3gkiTNp34M0eLTaC1a08gNrh4u488aPhuZOCpkF6+2wl3zAN7L7XIpOFBhnaE3/Q8Q==", - "cpu": [ - "s390x" - ], - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/linux-x64": { - "version": "0.25.2", - "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.25.2.tgz", - "integrity": "sha512-QInHERlqpTTZ4FRB0fROQWXcYRD64lAoiegezDunLpalZMjcUcld3YzZmVJ2H/Cp0wJRZ8Xtjtj0cEHhYc/uUg==", - "cpu": [ - "x64" - ], - "license": "MIT", - "optional": true, - "os": [ - "linux" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/netbsd-arm64": { - "version": "0.25.2", - "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.25.2.tgz", - "integrity": "sha512-talAIBoY5M8vHc6EeI2WW9d/CkiO9MQJ0IOWX8hrLhxGbro/vBXJvaQXefW2cP0z0nQVTdQ/eNyGFV1GSKrxfw==", - "cpu": [ - "arm64" - ], - "license": "MIT", - "optional": true, - "os": [ - "netbsd" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/netbsd-x64": { - "version": "0.25.2", - "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.25.2.tgz", - "integrity": "sha512-voZT9Z+tpOxrvfKFyfDYPc4DO4rk06qamv1a/fkuzHpiVBMOhpjK+vBmWM8J1eiB3OLSMFYNaOaBNLXGChf5tg==", - "cpu": [ - "x64" - ], - "license": "MIT", - "optional": true, - "os": [ - "netbsd" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/openbsd-arm64": { - "version": "0.25.2", - "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.25.2.tgz", - "integrity": "sha512-dcXYOC6NXOqcykeDlwId9kB6OkPUxOEqU+rkrYVqJbK2hagWOMrsTGsMr8+rW02M+d5Op5NNlgMmjzecaRf7Tg==", - "cpu": [ - "arm64" - ], - "license": "MIT", - "optional": true, - "os": [ - "openbsd" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/openbsd-x64": { - "version": "0.25.2", - "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.25.2.tgz", - "integrity": "sha512-t/TkWwahkH0Tsgoq1Ju7QfgGhArkGLkF1uYz8nQS/PPFlXbP5YgRpqQR3ARRiC2iXoLTWFxc6DJMSK10dVXluw==", - "cpu": [ - "x64" - ], - "license": "MIT", - "optional": true, - "os": [ - "openbsd" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/sunos-x64": { - "version": "0.25.2", - "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.25.2.tgz", - "integrity": "sha512-cfZH1co2+imVdWCjd+D1gf9NjkchVhhdpgb1q5y6Hcv9TP6Zi9ZG/beI3ig8TvwT9lH9dlxLq5MQBBgwuj4xvA==", - "cpu": [ - "x64" - ], - "license": "MIT", - "optional": true, - "os": [ - "sunos" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/win32-arm64": { - "version": "0.25.2", - "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.25.2.tgz", - "integrity": "sha512-7Loyjh+D/Nx/sOTzV8vfbB3GJuHdOQyrOryFdZvPHLf42Tk9ivBU5Aedi7iyX+x6rbn2Mh68T4qq1SDqJBQO5Q==", - "cpu": [ - "arm64" - ], - "license": "MIT", - "optional": true, - "os": [ - "win32" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/win32-ia32": { - "version": "0.25.2", - "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.25.2.tgz", - "integrity": "sha512-WRJgsz9un0nqZJ4MfhabxaD9Ft8KioqU3JMinOTvobbX6MOSUigSBlogP8QB3uxpJDsFS6yN+3FDBdqE5lg9kg==", - "cpu": [ - "ia32" - ], - "license": "MIT", - "optional": true, - "os": [ - "win32" - ], - "engines": { - "node": ">=18" - } - }, - "node_modules/@esbuild/win32-x64": { - "version": "0.25.2", - "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.25.2.tgz", - "integrity": "sha512-kM3HKb16VIXZyIeVrM1ygYmZBKybX8N4p754bw390wGO3Tf2j4L2/WYL+4suWujpgf6GBYs3jv7TyUivdd05JA==", - "cpu": [ - "x64" - ], - "license": "MIT", - "optional": true, - "os": [ - "win32" - ], - "engines": { - "node": ">=18" - } + "node_modules/@isaacs/nonrecursive-glob-match": { + "version": "1.0.3", + "resolved": "https://registry.npmjs.org/@isaacs/nonrecursive-glob-match/-/nonrecursive-glob-match-1.0.3.tgz", + "integrity": "sha512-SI7kyKHq4XXDRozw+r9GlRZkia1ZkFrpLW98r2IC2Bpr8YkFGE3fvjzmxCG0x78A++69HmDNrDvSMYBZmHGpKA==", + "dev": true, + "license": "BlueOak-1.0.0" }, "node_modules/@istanbuljs/load-nyc-config": { "version": "1.1.0", @@ -933,9 +541,9 @@ } }, "node_modules/@istanbuljs/schema": { - "version": "0.1.3", - "resolved": "https://registry.npmjs.org/@istanbuljs/schema/-/schema-0.1.3.tgz", - "integrity": "sha512-ZXRY4jNvVgSVQ8DL3LTcakaAtXwTVUxE81hslsyD2AtoXW/wVob10HkOJ1X/pAlcI7D+2YoZKg5do8G/w6RYgA==", + "version": "0.1.6", + "resolved": "https://registry.npmjs.org/@istanbuljs/schema/-/schema-0.1.6.tgz", + "integrity": "sha512-+Sg6GCR/wy1oSmQDFq4LQDAhm3ETKnorxN+y5nbLULOR3P0c14f2Wurzj3/xqPXtasLFfHd5iRFQ7AJt4KH2cw==", "dev": true, "license": "MIT", "engines": { @@ -1267,9 +875,9 @@ } }, "node_modules/@jridgewell/sourcemap-codec": { - "version": "1.5.0", - "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.0.tgz", - "integrity": "sha512-gv3ZRaISU3fjPAgNsriBRqGWQL6quFx04YMPW/zD8XMLsU32mhCCbfbO6KZFLjvYpCZ8zyDEgqsgf+PwPaM7GQ==", + "version": "1.6.0", + "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.6.0.tgz", + "integrity": "sha512-T7jf+5zgsZHwNJ4lvQ7/aezbyk0nNX+zJVWpmHA7VYsEx7a7qr5Rg5IbtJFqkgze5Y2sruq1RUY8Q837Od7iFw==", "dev": true, "license": "MIT" }, @@ -1285,9 +893,9 @@ } }, "node_modules/@prisma/client": { - "version": "6.6.0", - "resolved": "https://registry.npmjs.org/@prisma/client/-/client-6.6.0.tgz", - "integrity": "sha512-vfp73YT/BHsWWOAuthKQ/1lBgESSqYqAWZEYyTdGXyFAHpmewwWL2Iz6ErIzkj4aHbuc6/cGSsE6ZY+pBO04Cg==", + "version": "6.19.3", + "resolved": "https://registry.npmjs.org/@prisma/client/-/client-6.19.3.tgz", + "integrity": "sha512-mKq3jQFhjvko5LTJFHGilsuQs+W+T3Gm451NzuTDGQxwCzwXHYnIu2zGkRoW+Exq3Rob7yp2MfzSrdIiZVhrBg==", "hasInstallScript": true, "license": "Apache-2.0", "engines": { @@ -1307,64 +915,66 @@ } }, "node_modules/@prisma/config": { - "version": "6.6.0", - "resolved": "https://registry.npmjs.org/@prisma/config/-/config-6.6.0.tgz", - "integrity": "sha512-d8FlXRHsx72RbN8nA2QCRORNv5AcUnPXgtPvwhXmYkQSMF/j9cKaJg+9VcUzBRXGy9QBckNzEQDEJZdEOZ+ubA==", + "version": "6.19.3", + "resolved": "https://registry.npmjs.org/@prisma/config/-/config-6.19.3.tgz", + "integrity": "sha512-CBPT44BjlQxEt8kiMEauji2WHTDoVBOKl7UlewXmUgBPnr/oPRZC3psci5chJnYmH0ivEIog2OU9PGWoki3DLQ==", "license": "Apache-2.0", "dependencies": { - "esbuild": ">=0.12 <1", - "esbuild-register": "3.6.0" + "c12": "3.1.0", + "deepmerge-ts": "7.1.5", + "effect": "3.21.0", + "empathic": "2.0.0" } }, "node_modules/@prisma/debug": { - "version": "6.6.0", - "resolved": "https://registry.npmjs.org/@prisma/debug/-/debug-6.6.0.tgz", - "integrity": "sha512-DL6n4IKlW5k2LEXzpN60SQ1kP/F6fqaCgU/McgaYsxSf43GZ8lwtmXLke9efS+L1uGmrhtBUP4npV/QKF8s2ZQ==", + "version": "6.19.3", + "resolved": "https://registry.npmjs.org/@prisma/debug/-/debug-6.19.3.tgz", + "integrity": "sha512-ljkJ+SgpXNktLG0Q/n4JGYCkKf0f8oYLyjImS2I8e2q2WCfdRRtWER062ZV/ixaNP2M2VKlWXVJiGzZaUgbKZw==", "license": "Apache-2.0" }, "node_modules/@prisma/engines": { - "version": "6.6.0", - "resolved": "https://registry.npmjs.org/@prisma/engines/-/engines-6.6.0.tgz", - "integrity": "sha512-nC0IV4NHh7500cozD1fBoTwTD1ydJERndreIjpZr/S3mno3P6tm8qnXmIND5SwUkibNeSJMpgl4gAnlqJ/gVlg==", + "version": "6.19.3", + "resolved": "https://registry.npmjs.org/@prisma/engines/-/engines-6.19.3.tgz", + "integrity": "sha512-RSYxtlYFl5pJ8ZePgMv0lZ9IzVCOdTPOegrs2qcbAEFrBI1G33h6wyC9kjQvo0DnYEhEVY0X4LsuFHXLKQk88g==", "hasInstallScript": true, "license": "Apache-2.0", "dependencies": { - "@prisma/debug": "6.6.0", - "@prisma/engines-version": "6.6.0-53.f676762280b54cd07c770017ed3711ddde35f37a", - "@prisma/fetch-engine": "6.6.0", - "@prisma/get-platform": "6.6.0" + "@prisma/debug": "6.19.3", + "@prisma/engines-version": "7.1.1-3.c2990dca591cba766e3b7ef5d9e8a84796e47ab7", + "@prisma/fetch-engine": "6.19.3", + "@prisma/get-platform": "6.19.3" } }, "node_modules/@prisma/engines-version": { - "version": "6.6.0-53.f676762280b54cd07c770017ed3711ddde35f37a", - "resolved": "https://registry.npmjs.org/@prisma/engines-version/-/engines-version-6.6.0-53.f676762280b54cd07c770017ed3711ddde35f37a.tgz", - "integrity": "sha512-JzRaQ5Em1fuEcbR3nUsMNYaIYrOT1iMheenjCvzZblJcjv/3JIuxXN7RCNT5i6lRkLodW5ojCGhR7n5yvnNKrw==", + "version": "7.1.1-3.c2990dca591cba766e3b7ef5d9e8a84796e47ab7", + "resolved": "https://registry.npmjs.org/@prisma/engines-version/-/engines-version-7.1.1-3.c2990dca591cba766e3b7ef5d9e8a84796e47ab7.tgz", + "integrity": "sha512-03bgb1VD5gvuumNf+7fVGBzfpJPjmqV423l/WxsWk2cNQ42JD0/SsFBPhN6z8iAvdHs07/7ei77SKu7aZfq8bA==", "license": "Apache-2.0" }, "node_modules/@prisma/fetch-engine": { - "version": "6.6.0", - "resolved": "https://registry.npmjs.org/@prisma/fetch-engine/-/fetch-engine-6.6.0.tgz", - "integrity": "sha512-Ohfo8gKp05LFLZaBlPUApM0M7k43a0jmo86YY35u1/4t+vuQH9mRGU7jGwVzGFY3v+9edeb/cowb1oG4buM1yw==", + "version": "6.19.3", + "resolved": "https://registry.npmjs.org/@prisma/fetch-engine/-/fetch-engine-6.19.3.tgz", + "integrity": "sha512-tKtl/qco9Nt7LU5iKhpultD8O4vMCZcU2CHjNTnRrL1QvSUr5W/GcyFPjNL87GtRrwBc7ubXXD9xy4EvLvt8JA==", "license": "Apache-2.0", "dependencies": { - "@prisma/debug": "6.6.0", - "@prisma/engines-version": "6.6.0-53.f676762280b54cd07c770017ed3711ddde35f37a", - "@prisma/get-platform": "6.6.0" + "@prisma/debug": "6.19.3", + "@prisma/engines-version": "7.1.1-3.c2990dca591cba766e3b7ef5d9e8a84796e47ab7", + "@prisma/get-platform": "6.19.3" } }, "node_modules/@prisma/get-platform": { - "version": "6.6.0", - "resolved": "https://registry.npmjs.org/@prisma/get-platform/-/get-platform-6.6.0.tgz", - "integrity": "sha512-3qCwmnT4Jh5WCGUrkWcc6VZaw0JY7eWN175/pcb5Z6FiLZZ3ygY93UX0WuV41bG51a6JN/oBH0uywJ90Y+V5eA==", + "version": "6.19.3", + "resolved": "https://registry.npmjs.org/@prisma/get-platform/-/get-platform-6.19.3.tgz", + "integrity": "sha512-xFj1VcJ1N3MKooOQAGO0W5tsd0W2QzIvW7DD7c/8H14Zmp4jseeWAITm+w2LLoLrlhoHdPPh0NMZ8mfL6puoHA==", "license": "Apache-2.0", "dependencies": { - "@prisma/debug": "6.6.0" + "@prisma/debug": "6.19.3" } }, "node_modules/@sinclair/typebox": { - "version": "0.27.8", - "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.27.8.tgz", - "integrity": "sha512-+Fj43pSMwJs4KRrH/938Uf+uAELIgVBmQzg/q1YG10djyfA3TnrU8N8XzqCh/okZdszqBQTZf96idMfE5lnwTA==", + "version": "0.27.12", + "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.27.12.tgz", + "integrity": "sha512-hhyNJ+nbR6ZR7pToHvllEFun9TL0sbL+tk/ON75lo+Xas054uez98qRbsuNt7MBCyZKK4+8Yli/OAGZhmfBZ/g==", "dev": true, "license": "MIT" }, @@ -1388,6 +998,12 @@ "@sinonjs/commons": "^3.0.0" } }, + "node_modules/@standard-schema/spec": { + "version": "1.1.0", + "resolved": "https://registry.npmjs.org/@standard-schema/spec/-/spec-1.1.0.tgz", + "integrity": "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==", + "license": "MIT" + }, "node_modules/@types/babel__core": { "version": "7.20.5", "resolved": "https://registry.npmjs.org/@types/babel__core/-/babel__core-7.20.5.tgz", @@ -1424,13 +1040,13 @@ } }, "node_modules/@types/babel__traverse": { - "version": "7.20.7", - "resolved": "https://registry.npmjs.org/@types/babel__traverse/-/babel__traverse-7.20.7.tgz", - "integrity": "sha512-dkO5fhS7+/oos4ciWxyEyjWe48zmG6wbCheo/G2ZnHx4fs3EU6YC6UM8rk56gAjNJ9P3MTH2jo5jb92/K6wbng==", + "version": "7.28.0", + "resolved": "https://registry.npmjs.org/@types/babel__traverse/-/babel__traverse-7.28.0.tgz", + "integrity": "sha512-8PvcXf70gTDZBgt9ptxJ8elBeBjcLOAcOtoO/mPJjtji1+CdGbHgm77om1GrsPxsiE+uXIpNSK64UYaIwQXd4Q==", "dev": true, "license": "MIT", "dependencies": { - "@babel/types": "^7.20.7" + "@babel/types": "^7.28.2" } }, "node_modules/@types/graceful-fs": { @@ -1471,13 +1087,13 @@ } }, "node_modules/@types/node": { - "version": "22.14.1", - "resolved": "https://registry.npmjs.org/@types/node/-/node-22.14.1.tgz", - "integrity": "sha512-u0HuPQwe/dHrItgHHpmw3N2fYCR6x4ivMNbPHRkBVP4CvN+kiRrKHWk3i8tXiO/joPwXLMYvF9TTF0eqgHIuOw==", + "version": "26.6.6", + "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.6.tgz", + "integrity": "sha512-MzQj+8Kx3XI40OmUAE6Qoh58ZMNstNNMwn2nfd3qWsfe7nDNSqJNzes4njhz6AHwrSHOffSLwXU6yb474Q4aog==", "dev": true, "license": "MIT", "dependencies": { - "undici-types": "~6.21.0" + "undici-types": "~8.9.0" } }, "node_modules/@types/stack-utils": { @@ -1488,9 +1104,9 @@ "license": "MIT" }, "node_modules/@types/yargs": { - "version": "17.0.33", - "resolved": "https://registry.npmjs.org/@types/yargs/-/yargs-17.0.33.tgz", - "integrity": "sha512-WpxBCKWPLr4xSsHgz511rFJAM+wS28w2zEO1QDNY5zM/S8ok70NNfztH0xwhqKyaK0OHCbN98LDAZuy1ctxDkA==", + "version": "17.0.35", + "resolved": "https://registry.npmjs.org/@types/yargs/-/yargs-17.0.35.tgz", + "integrity": "sha512-qUHkeCyQFxMXg79wQfTtfndEC+N9ZZg76HJftDJp+qH2tV7Gj4OJi7l+PiWwJ+pWtW8GwSmqsDj/oymhrTWXjg==", "dev": true, "license": "MIT", "dependencies": { @@ -1642,9 +1258,9 @@ } }, "node_modules/babel-preset-current-node-syntax": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/babel-preset-current-node-syntax/-/babel-preset-current-node-syntax-1.1.0.tgz", - "integrity": "sha512-ldYss8SbBlWva1bs28q78Ju5Zq1F+8BrqBZZ0VFhLBvhh6lCpC2o3gDJi/5DRLs9FgYZCnmPYIVFU4lRXCkyUw==", + "version": "1.2.0", + "resolved": "https://registry.npmjs.org/babel-preset-current-node-syntax/-/babel-preset-current-node-syntax-1.2.0.tgz", + "integrity": "sha512-E/VlAEzRrsLEb2+dv8yp3bo4scof3l9nR4lrld+Iy5NyVqgVYUJnDAmunkhPMisRI32Qc4iRiz425d8vM++2fg==", "dev": true, "license": "MIT", "dependencies": { @@ -1665,7 +1281,7 @@ "@babel/plugin-syntax-top-level-await": "^7.14.5" }, "peerDependencies": { - "@babel/core": "^7.0.0" + "@babel/core": "^7.0.0 || ^8.0.0-0" } }, "node_modules/babel-preset-jest": { @@ -1686,16 +1302,19 @@ } }, "node_modules/balanced-match": { - "version": "1.0.2", - "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz", - "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==", + "version": "4.0.4", + "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz", + "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==", "dev": true, - "license": "MIT" + "license": "MIT", + "engines": { + "node": "18 || 20 || >=22" + } }, "node_modules/baseline-browser-mapping": { - "version": "2.11.0", - "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.0.tgz", - "integrity": "sha512-oCu2wfipvX3AePSgmOuKkIywOu+8n9psz7hXYmk56ghpu3+7KzNIBopaOs4c9BrtdnTtW30unG9GTfHo7EwERQ==", + "version": "2.11.34", + "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.34.tgz", + "integrity": "sha512-Aqr8mA1kIvyJ3UY5YAY7ib8LSo1DmDMbMnVqGPtsKW1LxaFQFwn9Eb3yvq2fUKJsRvaXjnAV7R5osqETapzNiA==", "dev": true, "license": "Apache-2.0", "bin": { @@ -1706,14 +1325,16 @@ } }, "node_modules/brace-expansion": { - "version": "1.1.18", - "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz", - "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==", + "version": "5.0.12", + "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz", + "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==", "dev": true, "license": "MIT", "dependencies": { - "balanced-match": "^1.0.0", - "concat-map": "0.0.1" + "balanced-match": "^4.0.2" + }, + "engines": { + "node": "20 || >=22" } }, "node_modules/braces": { @@ -1730,9 +1351,9 @@ } }, "node_modules/browserslist": { - "version": "4.28.7", - "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.7.tgz", - "integrity": "sha512-JxV13hNrFxqjOc8alRbq9dK1MM79NEXYpma2B2J4wAtpWS5zIEIKqWPGCl7N4o7Uc7B7itylh7SuDujATRyyTw==", + "version": "4.29.5", + "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.29.5.tgz", + "integrity": "sha512-khTmKu5NGYTotqcYo8Bew2k4RAE9PuXRSFRXG2lQBrCEQHyeQ/vX6gKMxfokwywBsLiXZMnHsmWMG1pnO8J7uQ==", "dev": true, "funding": [ { @@ -1750,11 +1371,11 @@ ], "license": "MIT", "dependencies": { - "baseline-browser-mapping": "^2.10.44", - "caniuse-lite": "^1.0.30001806", - "electron-to-chromium": "^1.5.393", - "node-releases": "^2.0.51", - "update-browserslist-db": "^1.2.3" + "baseline-browser-mapping": "^2.11.33", + "caniuse-lite": "^1.0.30001819", + "electron-to-chromium": "^1.5.464", + "node-releases": "^2.0.60", + "update-browserslist-db": "^1.3.4" }, "bin": { "browserslist": "cli.js" @@ -1764,11 +1385,11 @@ } }, "node_modules/bser": { - "version": "2.1.1", - "resolved": "https://registry.npmjs.org/bser/-/bser-2.1.1.tgz", - "integrity": "sha512-gQxTNE/GAfIIrmHLUE3oJyp5FO6HRBfhjnw4/wMmA63ZGDJnWBmgY/lyQBpnDUkGmAhbSe39tx2d/iTOAfglwQ==", + "version": "2.1.2", + "resolved": "https://registry.npmjs.org/bser/-/bser-2.1.2.tgz", + "integrity": "sha512-V2o8YS2EhrKMO9AumnkK0ynynfFlsajpYupwq7S46H5mhcanwxDkNTw3K67wPIcKTH1ffkA4vhMOtAc7gRmPZw==", "dev": true, - "license": "Apache-2.0", + "license": "MIT", "dependencies": { "node-int64": "^0.4.0" } @@ -1780,6 +1401,34 @@ "dev": true, "license": "MIT" }, + "node_modules/c12": { + "version": "3.1.0", + "resolved": "https://registry.npmjs.org/c12/-/c12-3.1.0.tgz", + "integrity": "sha512-uWoS8OU1MEIsOv8p/5a82c3H31LsWVR5qiyXVfBNOzfffjUWtPnhAb4BYI2uG2HfGmZmFjCtui5XNWaps+iFuw==", + "license": "MIT", + "dependencies": { + "chokidar": "^4.0.3", + "confbox": "^0.2.2", + "defu": "^6.1.4", + "dotenv": "^16.6.1", + "exsolve": "^1.0.7", + "giget": "^2.0.0", + "jiti": "^2.4.2", + "ohash": "^2.0.11", + "pathe": "^2.0.3", + "perfect-debounce": "^1.0.0", + "pkg-types": "^2.2.0", + "rc9": "^2.1.2" + }, + "peerDependencies": { + "magicast": "^0.3.5" + }, + "peerDependenciesMeta": { + "magicast": { + "optional": true + } + } + }, "node_modules/callsites": { "version": "3.1.0", "resolved": "https://registry.npmjs.org/callsites/-/callsites-3.1.0.tgz", @@ -1801,9 +1450,9 @@ } }, "node_modules/caniuse-lite": { - "version": "1.0.30001806", - "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001806.tgz", - "integrity": "sha512-72Cuvd95zbSYPKq6Fhg8eDJRlzgWDf7/mtoZv6Qe/DYNCEBdNxoA3+rZAU2ZhGCpZlns3EssFavaZomckT5Uuw==", + "version": "1.0.30001820", + "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001820.tgz", + "integrity": "sha512-gfWD6MxqVCqAOwmODfZf7DchWvlrA+SRdNX7ceLfg3xRqe5ssjjpF7EgslC/0tiLiNTajdaNN/q8c/5u/7Gz8w==", "dev": true, "funding": [ { @@ -1848,6 +1497,21 @@ "node": ">=10" } }, + "node_modules/chokidar": { + "version": "4.0.3", + "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-4.0.3.tgz", + "integrity": "sha512-Qgzu8kfBvo+cA4962jnP1KkS6Dop5NS6g7R5LFYJr4b8Ub94PPQXUksCw9PvXoeXPRRddRNC5C1JQUR2SMGtnA==", + "license": "MIT", + "dependencies": { + "readdirp": "^4.0.1" + }, + "engines": { + "node": ">= 14.16.0" + }, + "funding": { + "url": "https://paulmillr.com/funding/" + } + }, "node_modules/ci-info": { "version": "3.9.0", "resolved": "https://registry.npmjs.org/ci-info/-/ci-info-3.9.0.tgz", @@ -1864,6 +1528,15 @@ "node": ">=8" } }, + "node_modules/citty": { + "version": "0.1.6", + "resolved": "https://registry.npmjs.org/citty/-/citty-0.1.6.tgz", + "integrity": "sha512-tskPPKEs8D2KPafUypv2gxwJP8h/OaJmC82QQGGDQcHvXX43xF2VDACcJVmZ0EuSxkpO9Kc4MlrA3q0+FG58AQ==", + "license": "MIT", + "dependencies": { + "consola": "^3.2.3" + } + }, "node_modules/cjs-module-lexer": { "version": "1.4.3", "resolved": "https://registry.npmjs.org/cjs-module-lexer/-/cjs-module-lexer-1.4.3.tgz", @@ -1910,9 +1583,9 @@ } }, "node_modules/collect-v8-coverage": { - "version": "1.0.2", - "resolved": "https://registry.npmjs.org/collect-v8-coverage/-/collect-v8-coverage-1.0.2.tgz", - "integrity": "sha512-lHl4d5/ONEbLlJvaJNtsF/Lz+WvB07u2ycqTYbdrq7UypDXailES4valYb2eWiJFxZlVmpGekfqoxQhzyFdT4Q==", + "version": "1.0.3", + "resolved": "https://registry.npmjs.org/collect-v8-coverage/-/collect-v8-coverage-1.0.3.tgz", + "integrity": "sha512-1L5aqIkwPfiodaMgQunkF1zRhNqifHBmtbbbxcr6yVxxBnliw4TDOW6NxpO8DJLgJ16OT+Y4ztZqP6p/FtXnAw==", "dev": true, "license": "MIT" }, @@ -1936,13 +1609,21 @@ "dev": true, "license": "MIT" }, - "node_modules/concat-map": { - "version": "0.0.1", - "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz", - "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==", - "dev": true, + "node_modules/confbox": { + "version": "0.2.4", + "resolved": "https://registry.npmjs.org/confbox/-/confbox-0.2.4.tgz", + "integrity": "sha512-ysOGlgTFbN2/Y6Cg3Iye8YKulHw+R2fNXHrgSmXISQdMnomY6eNDprVdW9R5xBguEqI954+S6709UyiO7B+6OQ==", "license": "MIT" }, + "node_modules/consola": { + "version": "3.4.2", + "resolved": "https://registry.npmjs.org/consola/-/consola-3.4.2.tgz", + "integrity": "sha512-5IKcdX0nnYavi6G7TtOhwkYzyjfJlatbjMjuLSfE2kYT5pMDOilZ4OvMhi637CcDICTmz3wARPoyhqyX1Y+XvA==", + "license": "MIT", + "engines": { + "node": "^14.18.0 || >=16.10.0" + } + }, "node_modules/convert-source-map": { "version": "2.0.0", "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz", @@ -1988,9 +1669,10 @@ } }, "node_modules/debug": { - "version": "4.4.0", - "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.0.tgz", - "integrity": "sha512-6WTZ/IxCY/T6BALoZHaE4ctp9xm+Z5kY/pzYaCHRFeyVhojxlrm+46y68HA6hr0TcwEssoxNiDEUJQjfPZ/RYA==", + "version": "4.4.3", + "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz", + "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==", + "dev": true, "license": "MIT", "dependencies": { "ms": "^2.1.3" @@ -2005,9 +1687,9 @@ } }, "node_modules/dedent": { - "version": "1.5.3", - "resolved": "https://registry.npmjs.org/dedent/-/dedent-1.5.3.tgz", - "integrity": "sha512-NHQtfOOW68WD8lgypbLA5oT+Bt0xXJhiYvoR6SmmNXZfpzOGXwdKWmcwG8N7PwVVWV3eF/68nmD9BaJSsTBhyQ==", + "version": "1.7.2", + "resolved": "https://registry.npmjs.org/dedent/-/dedent-1.7.2.tgz", + "integrity": "sha512-WzMx3mW98SN+zn3hgemf4OzdmyNhhhKz5Ay0pUfQiMQ3e1g+xmTJWp/pKdwKVXhdSkAEGIIzqeuWrL3mV/AXbA==", "dev": true, "license": "MIT", "peerDependencies": { @@ -2029,6 +1711,37 @@ "node": ">=0.10.0" } }, + "node_modules/deepmerge-ts": { + "version": "8.0.0", + "resolved": "https://registry.npmjs.org/deepmerge-ts/-/deepmerge-ts-8.0.0.tgz", + "integrity": "sha512-ICNjaP0ML+eSdEpJYQC46XiAn/UjAdwbEl0dE8p85ZTeNDinN4Kd4+9jS4OSAuH7st6eC7rQhsqTF5zIDaUm2g==", + "funding": [ + { + "type": "ko-fi", + "url": "https://ko-fi.com/rebeccastevens" + }, + { + "type": "tidelift", + "url": "https://tidelift.com/funding/github/npm/deepmerge-ts" + } + ], + "license": "BSD-3-Clause", + "engines": { + "node": ">=16.0.0" + } + }, + "node_modules/defu": { + "version": "6.1.7", + "resolved": "https://registry.npmjs.org/defu/-/defu-6.1.7.tgz", + "integrity": "sha512-7z22QmUWiQ/2d0KkdYmANbRUVABpZ9SNYyH5vx6PZ+nE5bcC0l7uFvEfHlyld/HcGBFTL536ClDt3DEcSlEJAQ==", + "license": "MIT" + }, + "node_modules/destr": { + "version": "2.0.5", + "resolved": "https://registry.npmjs.org/destr/-/destr-2.0.5.tgz", + "integrity": "sha512-ugFTXCtDZunbzasqBxrK93Ik/DRYsO6S/fedkWEMKqt04xZ4csmnmwGDBAb07QWNaGMAmnTIemsYZCksjATwsA==", + "license": "MIT" + }, "node_modules/detect-newline": { "version": "3.1.0", "resolved": "https://registry.npmjs.org/detect-newline/-/detect-newline-3.1.0.tgz", @@ -2050,9 +1763,9 @@ } }, "node_modules/dotenv": { - "version": "16.5.0", - "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-16.5.0.tgz", - "integrity": "sha512-m/C+AwOAr9/W1UOIZUo232ejMNnJAJtYQjUbHoNTBNTJSvqzzDh7vnrei3o3r3m9blf6ZoDkvcw0VmozNRFJxg==", + "version": "16.6.1", + "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-16.6.1.tgz", + "integrity": "sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow==", "license": "BSD-2-Clause", "engines": { "node": ">=12" @@ -2061,10 +1774,20 @@ "url": "https://dotenvx.com" } }, + "node_modules/effect": { + "version": "3.21.0", + "resolved": "https://registry.npmjs.org/effect/-/effect-3.21.0.tgz", + "integrity": "sha512-PPN80qRokCd1f015IANNhrwOnLO7GrrMQfk4/lnZRE/8j7UPWrNNjPV0uBrZutI/nHzernbW+J0hdqQysHiSnQ==", + "license": "MIT", + "dependencies": { + "@standard-schema/spec": "^1.0.0", + "fast-check": "^3.23.1" + } + }, "node_modules/electron-to-chromium": { - "version": "1.5.395", - "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.395.tgz", - "integrity": "sha512-7zt9Aw+SrmxLWLN0zhaTWZQiCdryLVrYTq5R7iZakLvi2UQPYMMsROYV/2qVCzMeCiSXHwKOU+sZ4zOVVlrtKA==", + "version": "1.5.472", + "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.472.tgz", + "integrity": "sha512-s4+nfT29b0FKpVKoaIxl2pWsoNcn7A/nMPSrxayw4T3BsmPeV2lF9Y06BsAQeMGhCTQ4nYJ5XST7jkqe4ZEqFw==", "dev": true, "license": "ISC" }, @@ -2087,66 +1810,33 @@ "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==", "license": "MIT" }, + "node_modules/empathic": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/empathic/-/empathic-2.0.0.tgz", + "integrity": "sha512-i6UzDscO/XfAcNYD75CfICkmfLedpyPDdozrLMmQc5ORaQcdMoc21OnlEylMIqI7U8eniKrPMxxtj8k0vhmJhA==", + "license": "MIT", + "engines": { + "node": ">=14" + } + }, "node_modules/error-ex": { - "version": "1.3.2", - "resolved": "https://registry.npmjs.org/error-ex/-/error-ex-1.3.2.tgz", - "integrity": "sha512-7dFHNmqeFSEt2ZBsCriorKnn3Z2pj+fd9kmI6QoWw4//DL+icEBfc0U7qJCisqrTsKTjw4fNFy2pW9OqStD84g==", + "version": "1.3.4", + "resolved": "https://registry.npmjs.org/error-ex/-/error-ex-1.3.4.tgz", + "integrity": "sha512-sqQamAnR14VgCr1A618A3sGrygcpK+HEbenA/HiEAkkUwcZIIB/tgWqHFxWgOyDh4nB4JCRimh79dR5Ywc9MDQ==", "dev": true, "license": "MIT", "dependencies": { "is-arrayish": "^0.2.1" } }, - "node_modules/esbuild": { - "version": "0.25.2", - "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.25.2.tgz", - "integrity": "sha512-16854zccKPnC+toMywC+uKNeYSv+/eXkevRAfwRD/G9Cleq66m8XFIrigkbvauLLlCfDL45Q2cWegSg53gGBnQ==", - "hasInstallScript": true, + "node_modules/es-errors": { + "version": "1.3.0", + "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz", + "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==", + "dev": true, "license": "MIT", - "bin": { - "esbuild": "bin/esbuild" - }, "engines": { - "node": ">=18" - }, - "optionalDependencies": { - "@esbuild/aix-ppc64": "0.25.2", - "@esbuild/android-arm": "0.25.2", - "@esbuild/android-arm64": "0.25.2", - "@esbuild/android-x64": "0.25.2", - "@esbuild/darwin-arm64": "0.25.2", - "@esbuild/darwin-x64": "0.25.2", - "@esbuild/freebsd-arm64": "0.25.2", - "@esbuild/freebsd-x64": "0.25.2", - "@esbuild/linux-arm": "0.25.2", - "@esbuild/linux-arm64": "0.25.2", - "@esbuild/linux-ia32": "0.25.2", - "@esbuild/linux-loong64": "0.25.2", - "@esbuild/linux-mips64el": "0.25.2", - "@esbuild/linux-ppc64": "0.25.2", - "@esbuild/linux-riscv64": "0.25.2", - "@esbuild/linux-s390x": "0.25.2", - "@esbuild/linux-x64": "0.25.2", - "@esbuild/netbsd-arm64": "0.25.2", - "@esbuild/netbsd-x64": "0.25.2", - "@esbuild/openbsd-arm64": "0.25.2", - "@esbuild/openbsd-x64": "0.25.2", - "@esbuild/sunos-x64": "0.25.2", - "@esbuild/win32-arm64": "0.25.2", - "@esbuild/win32-ia32": "0.25.2", - "@esbuild/win32-x64": "0.25.2" - } - }, - "node_modules/esbuild-register": { - "version": "3.6.0", - "resolved": "https://registry.npmjs.org/esbuild-register/-/esbuild-register-3.6.0.tgz", - "integrity": "sha512-H2/S7Pm8a9CL1uhp9OvjwrBh5Pvx0H8qVOxNu8Wed9Y7qv56MPtq+GGM8RJpq6glYJn9Wspr8uw7l55uyinNeg==", - "license": "MIT", - "dependencies": { - "debug": "^4.3.4" - }, - "peerDependencies": { - "esbuild": ">=0.12 <1" + "node": ">= 0.4" } }, "node_modules/escalade": { @@ -2233,6 +1923,34 @@ "node": "^14.15.0 || ^16.10.0 || >=18.0.0" } }, + "node_modules/exsolve": { + "version": "1.2.0", + "resolved": "https://registry.npmjs.org/exsolve/-/exsolve-1.2.0.tgz", + "integrity": "sha512-h1pQPR9XoeSMdntRNCjyTznaume4UpfXrULBnlkZ2CUM/G5eSa+pBByGldO5uR8dxbPC+OuJXsPPNf+JZ81ADg==", + "license": "MIT" + }, + "node_modules/fast-check": { + "version": "3.23.2", + "resolved": "https://registry.npmjs.org/fast-check/-/fast-check-3.23.2.tgz", + "integrity": "sha512-h5+1OzzfCC3Ef7VbtKdcv7zsstUQwUDlYpUTvjeUsJAssPgLn7QzbboPtL5ro04Mq0rPOsMzl7q5hIbRs2wD1A==", + "funding": [ + { + "type": "individual", + "url": "https://github.com/sponsors/dubzzz" + }, + { + "type": "opencollective", + "url": "https://opencollective.com/fast-check" + } + ], + "license": "MIT", + "dependencies": { + "pure-rand": "^6.1.0" + }, + "engines": { + "node": ">=8.0.0" + } + }, "node_modules/fast-json-stable-stringify": { "version": "2.1.0", "resolved": "https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz", @@ -2241,13 +1959,13 @@ "license": "MIT" }, "node_modules/fb-watchman": { - "version": "2.0.2", - "resolved": "https://registry.npmjs.org/fb-watchman/-/fb-watchman-2.0.2.tgz", - "integrity": "sha512-p5161BqbuCaSnB8jIbzQHOlpgsPmK5rJVDfDKO91Axs5NC1uu3HRQm6wt9cd9/+GtQQIO53JdGXXoyDpTAsgYA==", + "version": "2.0.4", + "resolved": "https://registry.npmjs.org/fb-watchman/-/fb-watchman-2.0.4.tgz", + "integrity": "sha512-tGQtaoYisPDriJBN0mT5yZSyNETnJGA1gTYxaVRAE5KUO3LI9kPUc9WIu8JXcxaIci+faIKlzXqXyPgrmubtBQ==", "dev": true, - "license": "Apache-2.0", + "license": "MIT", "dependencies": { - "bser": "2.1.1" + "bser": "2.1.2" } }, "node_modules/fill-range": { @@ -2288,6 +2006,7 @@ "version": "2.3.3", "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz", "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==", + "dev": true, "hasInstallScript": true, "license": "MIT", "optional": true, @@ -2351,11 +2070,28 @@ "url": "https://github.com/sponsors/sindresorhus" } }, + "node_modules/giget": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/giget/-/giget-2.0.0.tgz", + "integrity": "sha512-L5bGsVkxJbJgdnwyuheIunkGatUF/zssUoxxjACCseZYAVbaqdh9Tsmmlkl8vYan09H7sbvKt4pS8GqKLBrEzA==", + "license": "MIT", + "dependencies": { + "citty": "^0.1.6", + "consola": "^3.4.0", + "defu": "^6.1.4", + "node-fetch-native": "^1.6.6", + "nypm": "^0.6.0", + "pathe": "^2.0.3" + }, + "bin": { + "giget": "dist/cli.mjs" + } + }, "node_modules/glob": { "version": "7.2.3", "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz", "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==", - "deprecated": "Glob versions prior to v9 are no longer supported", + "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me", "dev": true, "license": "ISC", "dependencies": { @@ -2391,9 +2127,9 @@ } }, "node_modules/hasown": { - "version": "2.0.2", - "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz", - "integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==", + "version": "2.0.4", + "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz", + "integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==", "dev": true, "license": "MIT", "dependencies": { @@ -2477,13 +2213,13 @@ "license": "MIT" }, "node_modules/is-core-module": { - "version": "2.16.1", - "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.16.1.tgz", - "integrity": "sha512-UfoeMA6fIJ8wTYFEUjelnaGI67v6+N7qXJEvQuIGa99l4xsCruSYOVSQ0uPANn4dAzm8lkYPaKLrrijLq7x23w==", + "version": "2.17.0", + "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.17.0.tgz", + "integrity": "sha512-J/vG0zBCbIKOQFfufSwyXdMrsohyJIUNkrnmo6WZGzoM7tr/lsbfW5b2BvisL6zsyMzK9UxV9L6c7AoFbyXHOA==", "dev": true, "license": "MIT", "dependencies": { - "hasown": "^2.0.2" + "hasown": "^2.0.4" }, "engines": { "node": ">= 0.4" @@ -2569,9 +2305,9 @@ } }, "node_modules/istanbul-lib-instrument/node_modules/semver": { - "version": "7.7.1", - "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.1.tgz", - "integrity": "sha512-hlq8tAfn0m/61p4BVRcPzIGr6LKiMwo4VM6dGi6pt4qcRkmNzTcWq6eCEjEh+qXjkMDvPlOFFSGwQjoEa6gyMA==", + "version": "7.8.5", + "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz", + "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==", "dev": true, "license": "ISC", "bin": { @@ -2612,9 +2348,9 @@ } }, "node_modules/istanbul-reports": { - "version": "3.1.7", - "resolved": "https://registry.npmjs.org/istanbul-reports/-/istanbul-reports-3.1.7.tgz", - "integrity": "sha512-BewmUXImeuRk2YY0PVbxgKAysvhRPUQE0h5QRM++nVWyubKGV0l8qQ5op8+B2DOmwSe63Jivj0BjkPQVf8fP5g==", + "version": "3.2.0", + "resolved": "https://registry.npmjs.org/istanbul-reports/-/istanbul-reports-3.2.0.tgz", + "integrity": "sha512-HGYWWS/ehqTV3xN10i23tkPkpH46MLCIMFNCaaKNavAXTF1RkqxawEPtnjnGZ6XKSInBKkiOA5BKS+aZiY3AvA==", "dev": true, "license": "BSD-3-Clause", "dependencies": { @@ -3108,9 +2844,9 @@ } }, "node_modules/jest-snapshot/node_modules/semver": { - "version": "7.7.1", - "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.1.tgz", - "integrity": "sha512-hlq8tAfn0m/61p4BVRcPzIGr6LKiMwo4VM6dGi6pt4qcRkmNzTcWq6eCEjEh+qXjkMDvPlOFFSGwQjoEa6gyMA==", + "version": "7.8.5", + "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz", + "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==", "dev": true, "license": "ISC", "bin": { @@ -3221,6 +2957,15 @@ "url": "https://github.com/chalk/supports-color?sponsor=1" } }, + "node_modules/jiti": { + "version": "2.7.0", + "resolved": "https://registry.npmjs.org/jiti/-/jiti-2.7.0.tgz", + "integrity": "sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==", + "license": "MIT", + "bin": { + "jiti": "lib/jiti-cli.mjs" + } + }, "node_modules/js-tokens": { "version": "4.0.0", "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz", @@ -3229,9 +2974,9 @@ "license": "MIT" }, "node_modules/js-yaml": { - "version": "3.15.1", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.1.tgz", - "integrity": "sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag==", + "version": "3.15.2", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.2.tgz", + "integrity": "sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==", "dev": true, "license": "MIT", "dependencies": { @@ -3342,9 +3087,9 @@ } }, "node_modules/make-dir/node_modules/semver": { - "version": "7.7.1", - "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.1.tgz", - "integrity": "sha512-hlq8tAfn0m/61p4BVRcPzIGr6LKiMwo4VM6dGi6pt4qcRkmNzTcWq6eCEjEh+qXjkMDvPlOFFSGwQjoEa6gyMA==", + "version": "7.8.5", + "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz", + "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==", "dev": true, "license": "ISC", "bin": { @@ -3396,22 +3141,36 @@ } }, "node_modules/minimatch": { - "version": "3.1.5", - "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz", - "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==", + "name": "@topcoder/minimatch-compat", + "version": "1.0.0", + "resolved": "file:../tools/minimatch-compat", "dev": true, - "license": "ISC", "dependencies": { - "brace-expansion": "^1.1.7" + "minimatch": "11.0.1" + } + }, + "node_modules/minimatch/node_modules/minimatch": { + "version": "11.0.1", + "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-11.0.1.tgz", + "integrity": "sha512-t+Vn6DX4wPCxS23y03C0uhF7S1jpi1GfqPrnlEipCJaA2ykiNbMkVlDutZtmvLfRcUN6R8AYVlzTsQrT4RZoLQ==", + "dev": true, + "license": "BlueOak-1.0.0", + "dependencies": { + "@isaacs/nonrecursive-glob-match": "^1.0.1", + "brace-expansion": "^5.0.12" }, "engines": { - "node": "*" + "node": "18 || 20 || >=22" + }, + "funding": { + "url": "https://github.com/sponsors/isaacs" } }, "node_modules/ms": { "version": "2.1.3", "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz", "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==", + "dev": true, "license": "MIT" }, "node_modules/natural-compare": { @@ -3421,6 +3180,12 @@ "dev": true, "license": "MIT" }, + "node_modules/node-fetch-native": { + "version": "1.6.7", + "resolved": "https://registry.npmjs.org/node-fetch-native/-/node-fetch-native-1.6.7.tgz", + "integrity": "sha512-g9yhqoedzIUm0nTnTqAQvueMPVOuIY16bqgAJJC8XOOubYFNwz6IER9qs0Gq2Xd0+CecCKFjtdDTMA4u4xG06Q==", + "license": "MIT" + }, "node_modules/node-int64": { "version": "0.4.0", "resolved": "https://registry.npmjs.org/node-int64/-/node-int64-0.4.0.tgz", @@ -3429,9 +3194,9 @@ "license": "MIT" }, "node_modules/node-releases": { - "version": "2.0.51", - "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.51.tgz", - "integrity": "sha512-wRNIrw4DmVLKQlbgOMdkMx27Wrpzes2hh5Jtbi2bjPd+4wJstWIqP5A+lscnqbm0xxmT5Bpg8Lec5ItEBwx6BQ==", + "version": "2.0.63", + "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.63.tgz", + "integrity": "sha512-6li2QanLsAXpIH2R6j77MzRyvOyrvdTqlKtO4CgBdHGNvN99ZZfyxszHc5o5+IZBWD5u6Hzwg83JoGXmqZNG9Q==", "dev": true, "license": "MIT", "engines": { @@ -3461,6 +3226,35 @@ "node": ">=8" } }, + "node_modules/nypm": { + "version": "0.6.12", + "resolved": "https://registry.npmjs.org/nypm/-/nypm-0.6.12.tgz", + "integrity": "sha512-4AhWntz+ds/P5kz1rN25yGegTPYsO5ffOy+8S0TeuXKZrgjlmgcEBLA1xubzcP/dWX4zYfNybv4TQERlL9Z0LQ==", + "license": "MIT", + "dependencies": { + "citty": "^0.2.2", + "pathe": "^2.0.3", + "tinyexec": "^1.3.1" + }, + "bin": { + "nypm": "dist/cli.mjs" + }, + "engines": { + "node": ">=18" + } + }, + "node_modules/nypm/node_modules/citty": { + "version": "0.2.2", + "resolved": "https://registry.npmjs.org/citty/-/citty-0.2.2.tgz", + "integrity": "sha512-+6vJA3L98yv+IdfKGZHBNiGW5KHn22e/JwID0Strsz8h4S/csAu/OuICwxrg44k5MRiZHWIo8XXuJgQTriRP4w==", + "license": "MIT" + }, + "node_modules/ohash": { + "version": "2.0.12", + "resolved": "https://registry.npmjs.org/ohash/-/ohash-2.0.12.tgz", + "integrity": "sha512-65S/5gk9YSsaRjcyf7Nfa6h/d3E8/1gslpXfI4W7Dxn/oap8IKRuNT5VXkLQ1YFKIEg4apRY4Pj6aiwFzrDdmw==", + "license": "MIT" + }, "node_modules/once": { "version": "1.4.0", "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz", @@ -3598,6 +3392,18 @@ "dev": true, "license": "MIT" }, + "node_modules/pathe": { + "version": "2.0.3", + "resolved": "https://registry.npmjs.org/pathe/-/pathe-2.0.3.tgz", + "integrity": "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==", + "license": "MIT" + }, + "node_modules/perfect-debounce": { + "version": "1.0.0", + "resolved": "https://registry.npmjs.org/perfect-debounce/-/perfect-debounce-1.0.0.tgz", + "integrity": "sha512-xCy9V055GLEqoFaHoC1SoLIaLmWctgCUaBaWxDZ7/Zx4CTyX7cJQLJOok/orfjZAh9kEYpjJa4d0KcJmCbctZA==", + "license": "MIT" + }, "node_modules/picocolors": { "version": "1.1.1", "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz", @@ -3641,6 +3447,23 @@ "node": ">=8" } }, + "node_modules/pkg-types": { + "version": "2.4.0", + "resolved": "https://registry.npmjs.org/pkg-types/-/pkg-types-2.4.0.tgz", + "integrity": "sha512-07Fys7iVx0X6TcviMOgogM1Lk33ZyqOezMnU79S+kffWqwolG/5W9V8EgQSeYCIfFTYVgssRbnH630Oa2+soBA==", + "license": "MIT", + "dependencies": { + "confbox": "^0.3.1", + "exsolve": "^1.1.3", + "pathe": "^2.0.3" + } + }, + "node_modules/pkg-types/node_modules/confbox": { + "version": "0.3.2", + "resolved": "https://registry.npmjs.org/confbox/-/confbox-0.3.2.tgz", + "integrity": "sha512-ZUAKhKlkCOrIGKc8cj7zek9s9z1mveHif/25nUshI2BzCRzF7KH7KHa+Lnh2ubq+e1tIlaFuP763mzW4qVoehg==", + "license": "MIT" + }, "node_modules/pretty-format": { "version": "29.7.0", "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-29.7.0.tgz", @@ -3670,14 +3493,14 @@ } }, "node_modules/prisma": { - "version": "6.6.0", - "resolved": "https://registry.npmjs.org/prisma/-/prisma-6.6.0.tgz", - "integrity": "sha512-SYCUykz+1cnl6Ugd8VUvtTQq5+j1Q7C0CtzKPjQ8JyA2ALh0EEJkMCS+KgdnvKW1lrxjtjCyJSHOOT236mENYg==", + "version": "6.19.3", + "resolved": "https://registry.npmjs.org/prisma/-/prisma-6.19.3.tgz", + "integrity": "sha512-++ZJ0ijLrDJF6hNB4t4uxg2br3fC4H9Yc9tcbjr2fcNFP3rh/SBNrAgjhsqBU4Ght8JPrVofG/ZkXfnSfnYsFg==", "hasInstallScript": true, "license": "Apache-2.0", "dependencies": { - "@prisma/config": "6.6.0", - "@prisma/engines": "6.6.0" + "@prisma/config": "6.19.3", + "@prisma/engines": "6.19.3" }, "bin": { "prisma": "build/index.js" @@ -3685,9 +3508,6 @@ "engines": { "node": ">=18.18" }, - "optionalDependencies": { - "fsevents": "2.3.3" - }, "peerDependencies": { "typescript": ">=5.1.0" }, @@ -3715,7 +3535,6 @@ "version": "6.1.0", "resolved": "https://registry.npmjs.org/pure-rand/-/pure-rand-6.1.0.tgz", "integrity": "sha512-bVWawvoZoBYpp6yIoQtQXHZjmz35RSVHnUOTefl8Vcjr8snTPY1wnpSPMWekcFwbxI6gtmT7rSYPFvz71ldiOA==", - "dev": true, "funding": [ { "type": "individual", @@ -3728,6 +3547,16 @@ ], "license": "MIT" }, + "node_modules/rc9": { + "version": "2.1.2", + "resolved": "https://registry.npmjs.org/rc9/-/rc9-2.1.2.tgz", + "integrity": "sha512-btXCnMmRIBINM2LDZoEmOogIZU7Qe7zn4BpomSKZ/ykbLObuBdvG+mFq11DL6fjH1DRwHhrlgtYWG96bJiC7Cg==", + "license": "MIT", + "dependencies": { + "defu": "^6.1.4", + "destr": "^2.0.3" + } + }, "node_modules/react-is": { "version": "18.3.1", "resolved": "https://registry.npmjs.org/react-is/-/react-is-18.3.1.tgz", @@ -3735,6 +3564,19 @@ "dev": true, "license": "MIT" }, + "node_modules/readdirp": { + "version": "4.1.2", + "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-4.1.2.tgz", + "integrity": "sha512-GDhwkLfywWL2s6vEjyhri+eXmfH6j1L7JE27WhqLeYzoh/A3DBaYGEj2H/HFZCn/kMfim73FXxEJTw06WtxQwg==", + "license": "MIT", + "engines": { + "node": ">= 14.18.0" + }, + "funding": { + "type": "individual", + "url": "https://paulmillr.com/funding/" + } + }, "node_modules/require-directory": { "version": "2.1.1", "resolved": "https://registry.npmjs.org/require-directory/-/require-directory-2.1.1.tgz", @@ -3746,13 +3588,14 @@ } }, "node_modules/resolve": { - "version": "1.22.10", - "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.10.tgz", - "integrity": "sha512-NPRy+/ncIMeDlTAsuqwKIiferiawhefFJtkNSW0qZJEqMEb+qBt/77B/jGeeek+F0uOeN05CDa6HXbbIgtVX4w==", + "version": "1.22.13", + "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.13.tgz", + "integrity": "sha512-Dj/cW9zBV2aRj6XzCxuGIs3ESZKv02jixne3q6jFZYZ3/Tg09gHHviSMDL4kObh9pqSahdRHEnDoaP2gn8YLhA==", "dev": true, "license": "MIT", "dependencies": { - "is-core-module": "^2.16.0", + "es-errors": "^1.3.0", + "is-core-module": "^2.17.0", "path-parse": "^1.0.7", "supports-preserve-symlinks-flag": "^1.0.0" }, @@ -3790,9 +3633,9 @@ } }, "node_modules/resolve.exports": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/resolve.exports/-/resolve.exports-2.0.3.tgz", - "integrity": "sha512-OcXjMsGdhL4XnbShKpAcSqPMzQoYkYyhbEaeSko47MjRP9NfEQMhZkXL1DoFlt9LWQn4YttrdnV6X2OiyzBi+A==", + "version": "2.0.4", + "resolved": "https://registry.npmjs.org/resolve.exports/-/resolve.exports-2.0.4.tgz", + "integrity": "sha512-zepuGL0ulf+nt+XaFrlKeaiTJeyPFPLLY62+ncq1/VTHBdt3HsfXOH60priZ6tnXQozdGcDeIF5JVTanvIcYWQ==", "dev": true, "license": "MIT", "engines": { @@ -3898,18 +3741,24 @@ } }, "node_modules/stream-chain": { - "version": "2.2.5", - "resolved": "https://registry.npmjs.org/stream-chain/-/stream-chain-2.2.5.tgz", - "integrity": "sha512-1TJmBx6aSWqZ4tx7aTpBDXK0/e2hhcNSTV8+CbFJtDjbb+I1mZ8lHit0Grw9GRT+6JbIrrDd8esncgBi8aBXGA==", - "license": "BSD-3-Clause" + "version": "4.4.1", + "resolved": "https://registry.npmjs.org/stream-chain/-/stream-chain-4.4.1.tgz", + "integrity": "sha512-4MWXw+Si0RW3HAYQN3MdxpgTJA6Te9StiLtdkZO248DLPsRipqBbuiQSkyYLpCDEuvqGfqb2B5dEGxiEfHYkNQ==", + "license": "BSD-3-Clause", + "funding": { + "url": "https://github.com/sponsors/uhop" + } }, "node_modules/stream-json": { - "version": "1.9.1", - "resolved": "https://registry.npmjs.org/stream-json/-/stream-json-1.9.1.tgz", - "integrity": "sha512-uWkjJ+2Nt/LO9Z/JyKZbMusL8Dkh97uUBTv3AJQ74y07lVahLY4eEFsPsE97pxYBwr8nnjMAIch5eqI0gPShyw==", + "version": "3.8.0", + "resolved": "https://registry.npmjs.org/stream-json/-/stream-json-3.8.0.tgz", + "integrity": "sha512-xD0bPEoPgaaEpEu2HSq1spYAs5LSJrLAlo44SHycE+aI8W0IrU2cklY7fiQKhRTVbuvxNUij06vIiz1NBT+AZA==", "license": "BSD-3-Clause", "dependencies": { - "stream-chain": "^2.2.5" + "stream-chain": "^4.4.1" + }, + "funding": { + "url": "https://github.com/sponsors/uhop" } }, "node_modules/string-length": { @@ -4026,6 +3875,15 @@ "node": ">=8" } }, + "node_modules/tinyexec": { + "version": "1.3.1", + "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.3.1.tgz", + "integrity": "sha512-GCvB3aoys96IuDFBMcTB46JOR6mdMtAToqwiW8JlWhsoh1mhHi/xn9ss/Dg7N555GiJyEt2qzoG/NHCwM6h1EA==", + "license": "MIT", + "engines": { + "node": ">=18" + } + }, "node_modules/tmpl": { "version": "1.0.5", "resolved": "https://registry.npmjs.org/tmpl/-/tmpl-1.0.5.tgz", @@ -4070,16 +3928,16 @@ } }, "node_modules/undici-types": { - "version": "6.21.0", - "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz", - "integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==", + "version": "8.9.0", + "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.9.0.tgz", + "integrity": "sha512-KTDyRTYX8sWmKXAikPHHSyc63CRPETMctyjKFupcC6OBLXT3xsN0e9aF7m+mIXutFWpUXuedtowG7iLOzp0kQg==", "dev": true, "license": "MIT" }, "node_modules/update-browserslist-db": { - "version": "1.2.3", - "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.2.3.tgz", - "integrity": "sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==", + "version": "1.3.4", + "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.3.4.tgz", + "integrity": "sha512-t8wonIOdQyOjtPd2VktlBu6QjTVTks6v8bSi7kd0r2Vll8TK1JYDZtRRdbmCHOAMphkZgrzK+L+vXK4pyZ8t4A==", "dev": true, "funding": [ { @@ -4205,9 +4063,9 @@ "license": "ISC" }, "node_modules/yargs": { - "version": "17.7.2", - "resolved": "https://registry.npmjs.org/yargs/-/yargs-17.7.2.tgz", - "integrity": "sha512-7dSzzRQ++CKnNI/krKnYRV7JKKPUXMEh61soaHKg9mrWEhzFWhFnxPxGl+69cD1Ou63C13NUPCnmIcrvqCuM6w==", + "version": "17.7.3", + "resolved": "https://registry.npmjs.org/yargs/-/yargs-17.7.3.tgz", + "integrity": "sha512-GZtjxm/J/4TSxuL3FNYjCmLktBTnIw/rVmKSIyKeYAZpmJB2ig9VauCC5xsa82GNKVKDAqpOn3KVzNt0zmrU0g==", "dev": true, "license": "MIT", "dependencies": { diff --git a/migrator/package.json b/migrator/package.json index d856af1..63c2a0f 100644 --- a/migrator/package.json +++ b/migrator/package.json @@ -3,7 +3,8 @@ "version": "1.0.0", "main": "index.js", "scripts": { - "test": "jest" + "test": "jest", + "test:streaming": "node --test test/streaming.test.cjs" }, "keywords": [], "author": "", @@ -14,13 +15,19 @@ "cli-progress": "^3.12.0", "dotenv": "^16.5.0", "prisma": "^6.6.0", - "stream-json": "^1.9.1" + "stream-json": "^3.8.0", + "stream-chain": "^4.4.1" }, "devDependencies": { "jest": "^29.7.0" }, "overrides": { - "brace-expansion": "1.1.18", - "js-yaml": "3.15.1" + "brace-expansion": "5.0.12", + "js-yaml@^3": "3.15.2", + "js-yaml@^4": "4.3.2", + "minimatch@<9": "file:../tools/minimatch-compat", + "minimatch@>=9": "11.0.1", + "glob@>=9": "14.0.2", + "deepmerge-ts": "8.0.0" } } diff --git a/migrator/src/clients/dynamoLoader.js b/migrator/src/clients/dynamoLoader.js index 3318c3c..e80c5ca 100644 --- a/migrator/src/clients/dynamoLoader.js +++ b/migrator/src/clients/dynamoLoader.js @@ -2,7 +2,7 @@ const fs = require('fs'); const path = require('path'); const { chain } = require('stream-chain'); const { parser } = require('stream-json'); -const { streamArray } = require('stream-json/streamers/StreamArray'); +const { streamArray } = require('stream-json/streamers/stream-array.js'); async function loadJSON(filePath) { return new Promise((resolve, reject) => { diff --git a/migrator/src/utils/batchMigrator.js b/migrator/src/utils/batchMigrator.js index d8ae740..c54f091 100644 --- a/migrator/src/utils/batchMigrator.js +++ b/migrator/src/utils/batchMigrator.js @@ -2,7 +2,7 @@ const fs = require('fs'); const { chain } = require('stream-chain'); const { parser } = require('stream-json'); -const { streamArray } = require('stream-json/streamers/StreamArray'); +const { streamArray } = require('stream-json/streamers/stream-array.js'); const { createSimpleProgressBar } = require('./progressLogger'); const { countJsonRecordsByBrace } = require('./countJsonRecordsByBrace'); diff --git a/migrator/src/utils/progressLogger.js b/migrator/src/utils/progressLogger.js index 6c9065c..2257d24 100644 --- a/migrator/src/utils/progressLogger.js +++ b/migrator/src/utils/progressLogger.js @@ -16,8 +16,11 @@ function createSimpleProgressBar(totalSteps) { const empty = barWidth - filled; const bar = 'â–ˆ'.repeat(filled) + 'â–‘'.repeat(empty); - process.stdout.clearLine(0); - process.stdout.cursorTo(0); + // Redirected migration logs do not expose the TTY cursor methods. + if (process.stdout.isTTY) { + process.stdout.clearLine(0); + process.stdout.cursorTo(0); + } process.stdout.write(`Progress: [${bar}] ${percentage}%`); } }, diff --git a/migrator/test/streaming.test.cjs b/migrator/test/streaming.test.cjs new file mode 100644 index 0000000..fb8cb4c --- /dev/null +++ b/migrator/test/streaming.test.cjs @@ -0,0 +1,47 @@ +const assert = require('node:assert/strict'); +const fs = require('node:fs'); +const os = require('node:os'); +const path = require('node:path'); +const { test } = require('node:test'); +const { loadJSON } = require('../src/clients/dynamoLoader'); +const { batchMigrator } = require('../src/utils/batchMigrator'); + +test('the patched streaming parser preserves array records and rejects malformed input', async () => { + const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'resource-json-')); + try { + const file = path.join(directory, 'records.json'); + const records = Array.from({ length: 1005 }, (_, id) => ({ id, name: 'escaped " braces {} and Unicode \u2603' })); + fs.writeFileSync(file, JSON.stringify(records)); + assert.deepEqual(await loadJSON(file), records); + fs.writeFileSync(file, '[{"__proto__":{"polluted":true}}]'); + await loadJSON(file); + assert.equal({}.polluted, undefined); + fs.writeFileSync(file, '[{"id":'); + await assert.rejects(loadJSON(file)); + } finally { + fs.rmSync(directory, { recursive: true, force: true }); + } +}); + +test('batch migration retains filtering, batch boundaries, and failed-record logging', async () => { + const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'resource-batch-')); + try { + const filePath = path.join(directory, 'records.json'); + const errorLogFile = path.join(directory, 'errors.log'); + fs.writeFileSync(filePath, JSON.stringify(Array.from({ length: 9 }, (_, id) => ({ id })))); + const processed = []; + await batchMigrator({ + filePath, errorLogFile, batchSize: 2, totalRecords: 9, label: 'compatibility', + filterRecord: record => record.id % 2 === 0, + handleRecord: async record => { + await Promise.resolve(); + processed.push(record.id); + if (record.id === 4) throw new Error('fixture failure'); + }, + }); + assert.deepEqual(processed, [0, 2, 4, 6, 8]); + assert.equal(fs.readFileSync(errorLogFile, 'utf8'), 'id=4 - fixture failure\n'); + } finally { + fs.rmSync(directory, { recursive: true, force: true }); + } +}); diff --git a/package.json b/package.json index 72078d2..42b6c1c 100644 --- a/package.json +++ b/package.json @@ -26,7 +26,8 @@ "test:logger": "mocha --require ts-node/register/transpile-only test/unit/logger.test.ts --timeout 10000", "test:adapter": "mocha --require ts-node/register/transpile-only test/unit/prisma-adapter.test.ts", "test:newman": "NODE_ENV=test node --require ts-node/register/transpile-only test/postman/newman.js", - "test:newman:clear": "node --require ts-node/register/transpile-only test/postman/clearTestData.js" + "test:newman:clear": "node --require ts-node/register/transpile-only test/postman/clearTestData.js", + "test:dependency-compat": "node --test tools/minimatch-compat/index.test.cjs" }, "author": "TCSCODER", "license": "none", @@ -58,7 +59,7 @@ "@nestjs/platform-express": "^11.1.8", "@prisma/adapter-pg": "7.8.0", "@prisma/client": "7.8.0", - "body-parser": "1.20.6", + "body-parser": "1.20.9", "config": "^3.0.1", "cors": "^2.7.1", "dotenv": "^17.2.3", @@ -67,9 +68,9 @@ "get-parameter-names": "^0.3.0", "http-json-response": "^1.0.1", "http-status-codes": "^1.3.0", - "joi": "^18.2.3", + "joi": "^18.3.1", "lodash": "^4.18.1", - "moment": "^2.30.1", + "moment": "^2.31.0", "pg": "^8.16.3", "prisma": "7.8.0", "reflect-metadata": "^0.2.2", diff --git a/patches/newman@6.2.2.patch b/patches/newman@6.2.2.patch new file mode 100644 index 0000000..51c0627 --- /dev/null +++ b/patches/newman@6.2.2.patch @@ -0,0 +1,13 @@ +diff --git a/lib/run/options.js b/lib/run/options.js +index 19c876ce2ae4c0bfb388f53e9839eae6b8cbd9b0..074f2e1b728970692942f4aa971d203197b00b1f 100644 +--- a/lib/run/options.js ++++ b/lib/run/options.js +@@ -6,7 +6,7 @@ var _ = require('lodash'), + CookieJar = require('@postman/tough-cookie').CookieJar, + transformer = require('postman-collection-transformer'), + liquidJSON = require('liquid-json'), +- parseCsv = require('csv-parse'), ++ parseCsv = require('csv-parse').parse, + util = require('../util'), + config = require('../config'), + diff --git a/patches/postman-collection@4.4.0.patch b/patches/postman-collection@4.4.0.patch new file mode 100644 index 0000000..84f99ee --- /dev/null +++ b/patches/postman-collection@4.4.0.patch @@ -0,0 +1,319 @@ +diff --git a/lib/superstring/dynamic-variables.js b/lib/superstring/dynamic-variables.js +index aeff852b4c5b52e0732923dd0fc3116743e78e78..42e51cbee00be55f65d07a50eeaa88baa5a7eed1 100644 +--- a/lib/superstring/dynamic-variables.js ++++ b/lib/superstring/dynamic-variables.js +@@ -1,4 +1,4 @@ +-var faker = require('@faker-js/faker/locale/en'), ++var faker = require('@faker-js/faker/locale/en').faker, + uuid = require('uuid'), + + // locale list generated from: https://github.com/chromium/chromium/blob/master/ui/base/l10n/l10n_util.cc +@@ -110,7 +110,7 @@ var faker = require('@faker-js/faker/locale/en'), + $randomPhoneNumber: { + description: 'A random 10-digit phone number', + generator: function () { +- return faker.phone.phoneNumberFormat(0); ++ return faker.helpers.replaceSymbols('###-###-####'); + } + }, + +@@ -119,7 +119,7 @@ var faker = require('@faker-js/faker/locale/en'), + $randomPhoneNumberExt: { + description: 'A random phone number with extension (12 digits)', + generator: function () { +- return faker.datatype.number({ min: 1, max: 99 }) + '-' + faker.phone.phoneNumberFormat(0); ++ return faker.number.int({ min: 1, max: 99 }) + '-' + faker.helpers.replaceSymbols('###-###-####'); + } + }, + +@@ -128,7 +128,7 @@ var faker = require('@faker-js/faker/locale/en'), + $randomLocale: { + description: 'A random two-letter language code (ISO 639-1)', + generator: function () { +- return faker.random.arrayElement(LOCALES); ++ return faker.helpers.arrayElement(LOCALES); + } + }, + +@@ -138,11 +138,11 @@ var faker = require('@faker-js/faker/locale/en'), + description: 'Some random words', + generator: function () { + var words = [], +- count = faker.datatype.number({ min: 2, max: 5 }), ++ count = faker.number.int({ min: 2, max: 5 }), + i; + + for (i = 0; i < count; i++) { +- words.push(faker.random.word()); ++ words.push(faker.word.sample()); + } + + return words.join(' '); +@@ -162,42 +162,42 @@ var faker = require('@faker-js/faker/locale/en'), + $randomDirectoryPath: { + description: 'A random directory path', + generator: function () { +- return faker.random.arrayElement(DIRECTORY_PATHS); ++ return faker.helpers.arrayElement(DIRECTORY_PATHS); + } + }, + + $randomCity: { + description: 'A random city name', +- generator: faker.address.city ++ generator: faker.location.city + }, + $randomStreetName: { + description: 'A random street name', +- generator: faker.address.streetName ++ generator: faker.location.street + }, + $randomStreetAddress: { + description: 'A random street address (e.g. 1234 Main Street)', +- generator: faker.address.streetAddress ++ generator: faker.location.streetAddress + }, + $randomCountry: { + description: 'A random country', +- generator: faker.address.country ++ generator: faker.location.country + }, + $randomCountryCode: { + description: 'A random 2-letter country code (ISO 3166-1 alpha-2)', +- generator: faker.address.countryCode ++ generator: faker.location.countryCode + }, + $randomLatitude: { + description: 'A random latitude coordinate', +- generator: faker.address.latitude ++ generator: faker.location.latitude + }, + $randomLongitude: { + description: 'A random longitude coordinate', +- generator: faker.address.longitude ++ generator: faker.location.longitude + }, + + $randomColor: { + description: 'A random color', +- generator: faker.commerce.color ++ generator: faker.color.human + }, + $randomDepartment: { + description: 'A random commerce category (e.g. electronics, clothing)', +@@ -222,11 +222,11 @@ var faker = require('@faker-js/faker/locale/en'), + + $randomCompanyName: { + description: 'A random company name', +- generator: faker.company.companyName ++ generator: faker.company.name + }, + $randomCompanySuffix: { + description: 'A random company suffix (e.g. Inc, LLC, Group)', +- generator: faker.company.companySuffix ++ generator: faker.helpers.arrayElement.bind(null, ['Inc', 'LLC', 'Group']) + }, + $randomCatchPhrase: { + description: 'A random catchphrase', +@@ -234,7 +234,7 @@ var faker = require('@faker-js/faker/locale/en'), + }, + $randomBs: { + description: 'A random phrase of business speak', +- generator: faker.company.bs ++ generator: faker.company.buzzPhrase + }, + $randomCatchPhraseAdjective: { + description: 'A random catchphrase adjective', +@@ -250,15 +250,15 @@ var faker = require('@faker-js/faker/locale/en'), + }, + $randomBsAdjective: { + description: 'A random business speak adjective', +- generator: faker.company.bsAdjective ++ generator: faker.company.buzzAdjective + }, + $randomBsBuzz: { + description: 'A random business speak buzzword', +- generator: faker.company.bsBuzz ++ generator: faker.company.buzzVerb + }, + $randomBsNoun: { + description: 'A random business speak noun', +- generator: faker.company.bsNoun ++ generator: faker.company.buzzNoun + }, + + $randomDatabaseColumn: { +@@ -301,7 +301,7 @@ var faker = require('@faker-js/faker/locale/en'), + + $randomBankAccount: { + description: 'A random 8-digit bank account number', +- generator: faker.finance.account ++ generator: faker.finance.accountNumber + }, + $randomBankAccountName: { + description: 'A random bank account name (e.g. savings account, checking account)', +@@ -309,7 +309,7 @@ var faker = require('@faker-js/faker/locale/en'), + }, + $randomCreditCardMask: { + description: 'A random masked credit card number', +- generator: faker.finance.mask ++ generator: faker.helpers.replaceSymbols.bind(null, '(...)####') + }, + $randomPrice: { + description: 'A random price between 0.00 and 1000.00', +@@ -375,55 +375,55 @@ var faker = require('@faker-js/faker/locale/en'), + }, + $randomImageUrl: { + description: 'A URL for a random image', +- generator: faker.image.imageUrl ++ generator: faker.image.url + }, + $randomAbstractImage: { + description: 'A URL for a random abstract image', +- generator: faker.image.abstract ++ generator: faker.image.urlLoremFlickr.bind(null, { category: 'abstract' }) + }, + $randomAnimalsImage: { + description: 'A URL for a random animal image', +- generator: faker.image.animals ++ generator: faker.image.urlLoremFlickr.bind(null, { category: 'animals' }) + }, + $randomBusinessImage: { + description: 'A URL for a random stock business image', +- generator: faker.image.business ++ generator: faker.image.urlLoremFlickr.bind(null, { category: 'business' }) + }, + $randomCatsImage: { + description: 'A URL for a random cat image', +- generator: faker.image.cats ++ generator: faker.image.urlLoremFlickr.bind(null, { category: 'cats' }) + }, + $randomCityImage: { + description: 'A URL for a random city image', +- generator: faker.image.city ++ generator: faker.image.urlLoremFlickr.bind(null, { category: 'city' }) + }, + $randomFoodImage: { + description: 'A URL for a random food image', +- generator: faker.image.food ++ generator: faker.image.urlLoremFlickr.bind(null, { category: 'food' }) + }, + $randomNightlifeImage: { + description: 'A URL for a random nightlife image', +- generator: faker.image.nightlife ++ generator: faker.image.urlLoremFlickr.bind(null, { category: 'nightlife' }) + }, + $randomFashionImage: { + description: 'A URL for a random fashion image', +- generator: faker.image.fashion ++ generator: faker.image.urlLoremFlickr.bind(null, { category: 'fashion' }) + }, + $randomPeopleImage: { + description: 'A URL for a random image of a person', +- generator: faker.image.people ++ generator: faker.image.urlLoremFlickr.bind(null, { category: 'people' }) + }, + $randomNatureImage: { + description: 'A URL for a random nature image', +- generator: faker.image.nature ++ generator: faker.image.urlLoremFlickr.bind(null, { category: 'nature' }) + }, + $randomSportsImage: { + description: 'A URL for a random sports image', +- generator: faker.image.sports ++ generator: faker.image.urlLoremFlickr.bind(null, { category: 'sports' }) + }, + $randomTransportImage: { + description: 'A URL for a random transportation image', +- generator: faker.image.transport ++ generator: faker.image.urlLoremFlickr.bind(null, { category: 'transport' }) + }, + $randomImageDataUri: { + description: 'A random image data URI', +@@ -440,7 +440,7 @@ var faker = require('@faker-js/faker/locale/en'), + }, + $randomUserName: { + description: 'A random username', +- generator: faker.internet.userName ++ generator: faker.internet.username + }, + $randomProtocol: { + description: 'A random internet protocol', +@@ -476,7 +476,7 @@ var faker = require('@faker-js/faker/locale/en'), + }, + $randomHexColor: { + description: 'A random hex value', +- generator: faker.internet.color ++ generator: faker.color.rgb + }, + $randomMACAddress: { + description: 'A random MAC address', +@@ -526,44 +526,44 @@ var faker = require('@faker-js/faker/locale/en'), + + $randomFirstName: { + description: 'A random first name', +- generator: faker.name.firstName ++ generator: faker.person.firstName + }, + $randomLastName: { + description: 'A random last name', +- generator: faker.name.lastName ++ generator: faker.person.lastName + }, + $randomFullName: { + description: 'A random first and last name', +- generator: faker.name.findName ++ generator: faker.person.fullName + }, + $randomJobTitle: { + description: 'A random job title (e.g. senior software developer)', +- generator: faker.name.jobTitle ++ generator: faker.person.jobTitle + }, + $randomNamePrefix: { + description: 'A random name prefix (e.g. Mr., Mrs., Dr.)', +- generator: faker.name.prefix ++ generator: faker.person.prefix + }, + $randomNameSuffix: { + description: 'A random name suffix (e.g. Jr., MD, PhD)', +- generator: faker.name.suffix ++ generator: faker.person.suffix + }, + $randomJobDescriptor: { + description: 'A random job descriptor (e.g., senior, chief, corporate, etc.)', +- generator: faker.name.jobDescriptor ++ generator: faker.person.jobDescriptor + }, + $randomJobArea: { + description: 'A random job area (e.g. branding, functionality, usability)', +- generator: faker.name.jobArea ++ generator: faker.person.jobArea + }, + $randomJobType: { + description: 'A random job type (e.g. supervisor, manager, coordinator, etc.)', +- generator: faker.name.jobType ++ generator: faker.person.jobType + }, + + $randomUUID: { + description: 'A random 36-character UUID', +- generator: faker.datatype.uuid ++ generator: faker.string.uuid + }, + $randomBoolean: { + description: 'A random boolean value (true/false)', +@@ -571,11 +571,11 @@ var faker = require('@faker-js/faker/locale/en'), + }, + $randomWord: { + description: 'A random word', +- generator: faker.random.word ++ generator: faker.word.sample + }, + $randomAlphaNumeric: { + description: 'A random alpha-numeric character', +- generator: faker.random.alphaNumeric ++ generator: faker.string.alphanumeric + }, + + $randomFileName: { diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 7e1681f..aef6f30 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -5,37 +5,52 @@ settings: excludeLinksFromLockfile: false overrides: - '@hono/node-server@<2.0.11': 2.0.11 + ip-address: 10.7.5 + baseline-browser-mapping: 2.11.0 + browserslist: 4.28.8 + proxy-addr: 2.0.8 + axios: 1.20.0 + follow-redirects: 1.16.2 + multer: 2.5.0 + qs: 6.16.1 + handlebars: 4.7.10 + csv-parse: 7.0.2 + '@faker-js/faker': 10.6.0 + node-forge: 1.4.1 + joi: 18.3.1 + moment: 2.31.0 + mysql2: 3.23.1 + hono: 4.13.11 + '@hono/node-server': 2.1.3 + js-yaml@^3: 3.15.2 + js-yaml@^4: 4.3.2 + brace-expansion@^1: 1.1.21 + brace-expansion@^2: 2.1.7 + brace-expansion@^5: 5.0.12 + fast-uri: 4.2.3 + body-parser@^1: 1.20.9 + body-parser@^2: 2.4.0 + glob@>=9: 14.0.2 + minimatch@<9: file:tools/minimatch-compat + minimatch@>=9: 11.0.1 ajv@>=6.0.0 <6.14.0: 6.15.0 - axios@<1.18.1: 1.18.1 - body-parser@<1.20.6: 1.20.6 - brace-expansion@<1.1.18: 1.1.18 - brace-expansion@>=2.0.0 <2.1.4: 2.1.4 - brace-expansion@>=3.0.0 <3.0.6: 3.0.6 - brace-expansion@>=4.0.0 <5.0.9: 5.0.9 deepmerge-ts@<8.0.0: 8.0.2 diff@>=6.0.0 <8.0.3: 8.0.3 - fast-uri@>=3.0.0 <3.1.6: 3.1.6 flatted@<3.4.2: 3.4.2 - handlebars@<4.7.9: 4.7.9 jose@>=3.0.0 <4.15.5: 4.15.5 - hono@<4.12.34: 4.12.34 - ip-address@<=10.3.0: 10.3.1 - js-yaml@>=3.0.0 <3.15.1: 3.15.1 - js-yaml@>=4.0.0 <4.3.1: 4.3.1 lodash@<4.18.1: 4.18.1 - node-forge@<1.4.0: 1.4.0 picomatch@<2.3.2: 2.3.2 serialize-javascript@>=5.0.0 <7.0.7: 7.0.7 underscore@<1.13.8: 1.13.8 uuid@<11.1.1: 11.1.1 - follow-redirects@<1.16.0: 1.16.0 form-data@<4.0.6: 4.0.6 - minimatch@3.1.2: 3.1.4 path-to-regexp@0.1.12: 0.1.13 - qs@<6.15.2: 6.15.2 valibot@<=1.4.1: 1.4.2 +patchedDependencies: + newman@6.2.2: b230221a371fa780544fbd2f311bb845fd113d9e68fe8c3da0d1efca00aa3b8b + postman-collection@4.4.0: 17b540b14b6535c79f5c2f5416e3d4461863b60277b152d57bbca198010988dd + importers: .: @@ -54,10 +69,10 @@ importers: version: 7.8.0 '@prisma/client': specifier: 7.8.0 - version: 7.8.0(prisma@7.8.0(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(typescript@5.9.3))(typescript@5.9.3) + version: 7.8.0(prisma@7.8.0(@types/node@26.1.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(typescript@5.9.3))(typescript@5.9.3) body-parser: - specifier: 1.20.6 - version: 1.20.6(supports-color@5.5.0) + specifier: 1.20.9 + version: 1.20.9(supports-color@5.5.0) config: specifier: ^3.0.1 version: 3.3.12 @@ -83,20 +98,20 @@ importers: specifier: ^1.3.0 version: 1.4.0 joi: - specifier: ^18.2.3 - version: 18.2.3 + specifier: 18.3.1 + version: 18.3.1 lodash: specifier: ^4.18.1 version: 4.18.1 moment: - specifier: ^2.30.1 - version: 2.30.1 + specifier: 2.31.0 + version: 2.31.0 pg: specifier: ^8.16.3 version: 8.22.0 prisma: specifier: 7.8.0 - version: 7.8.0(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(typescript@5.9.3) + version: 7.8.0(@types/node@26.1.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(typescript@5.9.3) reflect-metadata: specifier: ^0.2.2 version: 0.2.2 @@ -157,7 +172,7 @@ importers: version: 11.7.6 newman: specifier: 6.2.2 - version: 6.2.2(supports-color@5.5.0) + version: 6.2.2(patch_hash=b230221a371fa780544fbd2f311bb845fd113d9e68fe8c3da0d1efca00aa3b8b)(supports-color@5.5.0) nock: specifier: ^14.0.16 version: 14.0.16 @@ -377,9 +392,9 @@ packages: resolution: {integrity: sha512-43/qtrDUokr7LJqoF2c3+RInu/t4zfrpYdoSDfYyhg52rwLV6TnOvdG4fXm7IkSB3wErkcmJS9iEhjVtOSEjjA==} engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0} - '@faker-js/faker@5.5.3': - resolution: {integrity: sha512-R11tGE6yIFwqpaIqcfkcg7AICXzFg14+5h5v0TfF/9+RMDL6jhzCy/pxHVOfbALGdtVYdt6JdR21tuxEgl34dw==} - deprecated: Please update to a newer version. + '@faker-js/faker@10.6.0': + resolution: {integrity: sha512-3RQHgEtvL1Frl/d1cSreo7qhJ3Gk1OdNUai/CtZ8G+wYeRQnJih3s9xJ9/kgYekPQRdwgh0HXRPqMlzWGwivIQ==} + engines: {node: ^20.19.0 || ^22.13.0 || ^23.5.0 || >=24.0.0, npm: '>=10'} '@hapi/address@5.1.1': resolution: {integrity: sha512-A+po2d/dVoY7cYajycYI43ZbYMXukuopIsqCjh5QzsBCipDtdofHntljDlpccMjIfTy6UOkg+5KPriwYch2bXA==} @@ -401,11 +416,11 @@ packages: '@hapi/topo@6.0.2': resolution: {integrity: sha512-KR3rD5inZbGMrHmgPxsJ9dbi6zEK+C3ZwUwTa+eMwWLz7oijWUTWD2pMSNNYJAU6Qq+65NkxXjqHr/7LM2Xkqg==} - '@hono/node-server@2.0.11': - resolution: {integrity: sha512-bjD221KPLoJTWUwso1J6fGKiTXEUFedG/s0visavY4zakFPkeGURMRNly+FhBHs7T8Dz4qHaZIMX9ZoJHSJtKA==} + '@hono/node-server@2.1.3': + resolution: {integrity: sha512-TA//nWMqPhbfdfneACk6t5a9eqbS9lABEPyKn0/xZTah3H3U2XaVg85rJFl0/Fyit0I552YDHgXGVSf3GwqbUw==} engines: {node: '>=20'} peerDependencies: - hono: 4.12.34 + hono: 4.13.11 '@humanfs/core@0.19.2': resolution: {integrity: sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==} @@ -570,9 +585,8 @@ packages: '@types/node': optional: true - '@isaacs/cliui@8.0.2': - resolution: {integrity: sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA==} - engines: {node: '>=12'} + '@isaacs/nonrecursive-glob-match@1.0.3': + resolution: {integrity: sha512-SI7kyKHq4XXDRozw+r9GlRZkia1ZkFrpLW98r2IC2Bpr8YkFGE3fvjzmxCG0x78A++69HmDNrDvSMYBZmHGpKA==} '@istanbuljs/load-nyc-config@1.1.0': resolution: {integrity: sha512-VjeHSlIzpv/NyD3N0YuHfXOPDIixcA1q2ZV98wsMqcYlPmv2n3Yb2lYP9XMElnaFVXg5A7YLTeLu6V84uQDjmQ==} @@ -690,10 +704,6 @@ packages: '@paralleldrive/cuid2@2.3.1': resolution: {integrity: sha512-XO7cAxhnTZl0Yggq6jOgjiOHhbgcO4NqFqwSmQpjK3b6TEE6Uj/jfSk6wzYyemh3+I0sHirKSetjQwn5cZktFw==} - '@pkgjs/parseargs@0.11.0': - resolution: {integrity: sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg==} - engines: {node: '>=14'} - '@postman/form-data@3.1.1': resolution: {integrity: sha512-vjh8Q2a8S6UCm/KKs31XFJqEEgmbjBmpPNVV2eVav6905wyFAwaUOBGA1NPBI4ERH9MMZc6w0umFgM6WbEPMdg==} engines: {node: '>= 6'} @@ -858,6 +868,9 @@ packages: '@tokenizer/token@0.3.0': resolution: {integrity: sha512-OvjF+z51L3ov0OyAU0duzsYuvO01PH7x4t6DJx+guahgTnBHkhJdG7soQeTSFLWN3efnHyibZ4Z8l2EuWwJN3A==} + '@topcoder/minimatch-compat@file:tools/minimatch-compat': + resolution: {directory: tools/minimatch-compat, type: directory} + '@tsconfig/node10@1.0.12': resolution: {integrity: sha512-UCYBaeFvM11aU2y3YPZ//O5Rhj+xKyzy7mvcIoAjASbigy8mHMryP5cK7dgjlz2hWxh1g5pLw084E0a/wlUSFQ==} @@ -1122,18 +1135,10 @@ packages: resolution: {integrity: sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==} engines: {node: '>=8'} - ansi-regex@6.2.2: - resolution: {integrity: sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg==} - engines: {node: '>=12'} - ansi-styles@4.3.0: resolution: {integrity: sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==} engines: {node: '>=8'} - ansi-styles@6.2.3: - resolution: {integrity: sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==} - engines: {node: '>=12'} - ansis@4.2.0: resolution: {integrity: sha512-HqZ5rWlFjGiV0tDm3UxxgNRqsOTniqoKZu0pIAfh7TZQMGuZK+hH0drySty0si0QXj1ieop4+SkSfPZBPPkHig==} engines: {node: '>=14'} @@ -1199,9 +1204,6 @@ packages: aws4@1.13.2: resolution: {integrity: sha512-lHe62zvbTB5eEABUVi/AwVh0ZKY9rMMDhmm+eeyuuUQbQ3+J+fONVQOZyj+DdrvD4BY33uYniyRJ4UJIaSKAfw==} - balanced-match@1.0.2: - resolution: {integrity: sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==} - balanced-match@4.0.4: resolution: {integrity: sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==} engines: {node: 18 || 20 || >=22} @@ -1209,8 +1211,8 @@ packages: base64-js@1.5.1: resolution: {integrity: sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==} - baseline-browser-mapping@2.10.43: - resolution: {integrity: sha512-AjYpR78kDWAY3Efj+cDTFH9t9SCoL7OoTp1BOb0mQV7S+6CiLwnWM3FyxhJtdPufDFKzmCSFoUncKjWgJEZTCQ==} + baseline-browser-mapping@2.11.0: + resolution: {integrity: sha512-oCu2wfipvX3AePSgmOuKkIywOu+8n9psz7hXYmk56ghpu3+7KzNIBopaOs4c9BrtdnTtW30unG9GTfHo7EwERQ==} engines: {node: '>=6.0.0'} hasBin: true @@ -1230,22 +1232,16 @@ packages: bluebird@2.11.0: resolution: {integrity: sha512-UfFSr22dmHPQqPP9XWHRhq+gWnHCYguQGkXQlbyPtW5qTnhFWA8/iXg765tH0cAjy7l/zPJ1aBTO0g5XgA7kvQ==} - body-parser@1.20.6: - resolution: {integrity: sha512-p5tAzS57i5MV9fZFDj9LeIiTZEufbSe2eDozP+ElheSUq1m74CRq1jI4mYNDdVs9vQztXFLuk/Gd6BWTdwRJ5g==} + body-parser@1.20.9: + resolution: {integrity: sha512-FISIQxV5u91Y9gvuFq3q/tA/qTqLJn3AhRcEvyozyhJTh5OBFFtv827AdHU7Rbyct4r+Ba1/99oFa1Y3yuFsdw==} engines: {node: '>= 0.8', npm: 1.2.8000 || >= 1.4.16} - body-parser@2.3.0: - resolution: {integrity: sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==} + body-parser@2.4.0: + resolution: {integrity: sha512-Ifk1KcLrxaGt1occQagQNFNNOqRt1LFuehEnHHzB8Z6cRgIxRU1TBaiIsUiCdA+gy5PL7Y1IX31DNKkRmxtXjQ==} engines: {node: '>=18'} - brace-expansion@1.1.18: - resolution: {integrity: sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==} - - brace-expansion@2.1.4: - resolution: {integrity: sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==} - - brace-expansion@5.0.9: - resolution: {integrity: sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==} + brace-expansion@5.0.12: + resolution: {integrity: sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==} engines: {node: 20 || >=22} braces@3.0.3: @@ -1258,8 +1254,8 @@ packages: browser-stdout@1.3.1: resolution: {integrity: sha512-qhAVI1+Av2X7qelOfAIYwXONood6XlZE/fXaBSmW/T5SzLAmCgzi+eiWE7fUvbHaeNBQH13UftjpXxsfLkMpgw==} - browserslist@4.28.6: - resolution: {integrity: sha512-FQBYNK15VMslhLHpA7+n+n1GOlF1kId2xcCg7/j95f24AOF6VDYMNH4mFxF7KuaTdv627faazpOAjFzMrfJOUw==} + browserslist@4.28.8: + resolution: {integrity: sha512-V2NpofLblG64mfOtSgDhOJESZEGogzDMBv/q+W6oc4LXWP/q75eOXoOaaOu1EOadB9U4Bwx/e0yzbvwKH8zalA==} engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7} hasBin: true @@ -1312,8 +1308,8 @@ packages: resolution: {integrity: sha512-Gmy6FhYlCY7uOElZUSbxo2UCDH8owEk996gkbrpsgGtrJLM3J7jGxl9Ic7Qwwj4ivOE5AWZWRMecDdF7hqGjFA==} engines: {node: '>=10'} - caniuse-lite@1.0.30001806: - resolution: {integrity: sha512-72Cuvd95zbSYPKq6Fhg8eDJRlzgWDf7/mtoZv6Qe/DYNCEBdNxoA3+rZAU2ZhGCpZlns3EssFavaZomckT5Uuw==} + caniuse-lite@1.0.30001820: + resolution: {integrity: sha512-gfWD6MxqVCqAOwmODfZf7DchWvlrA+SRdNX7ceLfg3xRqe5ssjjpF7EgslC/0tiLiNTajdaNN/q8c/5u/7Gz8w==} caseless@0.12.0: resolution: {integrity: sha512-4tYFyifaFfGacoiObjJegolkwSU4xQNGbVgUiNYVUxbQ2x2lUsFvY4hVgVzGiIe6WLOPqycWXA40l+PWsxthUw==} @@ -1443,13 +1439,6 @@ packages: component-emitter@1.3.1: resolution: {integrity: sha512-T0+barUSQRTUQASh8bx02dl+DhF54GtIDY13Y3m9oWTklKbb3Wv974meRpeZ3lp1JpLVECWWNHC4vaG2XHXouQ==} - concat-map@0.0.1: - resolution: {integrity: sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==} - - concat-stream@2.0.0: - resolution: {integrity: sha512-MWufYdFw53ccGjCA+Ol7XJYpAlW6/prSMzuPOTRnJGcGzuhLn4Scrz7qf6o8bROZ514ltazcIFJZevcfbo0x7A==} - engines: {'0': node >= 6.0} - confbox@0.2.2: resolution: {integrity: sha512-1NB+BKqhtNipMsov4xI/NnhCKp9XG9NamYp5PVm9klAT0fsrNPjaFICsCFhNhwZJKNh7zB/3q8qXz0E9oaMNtQ==} @@ -1476,6 +1465,10 @@ packages: resolution: {integrity: sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==} engines: {node: '>=18'} + content-type@2.1.0: + resolution: {integrity: sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==} + engines: {node: '>=18'} + convert-source-map@1.9.0: resolution: {integrity: sha512-ASFBup0Mz1uyiIjANan1jzLQami9z1PoYSZCiiYW2FczPbenXc45FZdBZLzOT+r6+iciuEModtmCti+hjaAk0A==} @@ -1529,8 +1522,8 @@ packages: csstype@3.2.3: resolution: {integrity: sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ==} - csv-parse@4.16.3: - resolution: {integrity: sha512-cO1I/zmz4w2dcKHVvpCr7JVRu8/FymG5OEpmvsZYlccYolPBLoVGKUHgNoc4ZGkFeFlWGEDmMyBM+TTqRdW/wg==} + csv-parse@7.0.2: + resolution: {integrity: sha512-uKZghv9UmPkMVLYy//KZ9HFAIJsl7wkhoEdIL0+rhuSY9pZQlhaeGEDPIe+/w7eh81MOql8Q/9+inAGWG6ZHYA==} dashdash@1.14.1: resolution: {integrity: sha512-jRFi8UDGo6j+odZiEpjazZaWqEal3w/basFjQHQEwVtZJGDpxbH1MeYluwCS8Xq5wmLJooDlMgvVarmWfGM44g==} @@ -1623,9 +1616,6 @@ packages: resolution: {integrity: sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==} engines: {node: '>= 0.4'} - eastasianwidth@0.2.0: - resolution: {integrity: sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA==} - ecc-jsbn@0.1.2: resolution: {integrity: sha512-eh9O+hwRHNbG4BLTjEl3nw044CkGm5X6LoaCf7LPp7UU8Qrt47JYNi6nPX8xjW97TKGKm1ouctg0QSpZe9qrnw==} @@ -1638,15 +1628,12 @@ packages: effect@3.20.0: resolution: {integrity: sha512-qMLfDJscrNG8p/aw+IkT9W7fgj50Z4wG5bLBy0Txsxz8iUHjDIkOgO3SV0WZfnQbNG2VJYb0b+rDLMrhM4+Krw==} - electron-to-chromium@1.5.392: - resolution: {integrity: sha512-1yQq3VQCZRwsnYc67Oc+1fge6Lwtn0hzi6zmEVkB61Zx21kTbwJAW4dFLadl5Rc1tKhG/kSpYXnfiAhu0f0a1g==} + electron-to-chromium@1.5.472: + resolution: {integrity: sha512-s4+nfT29b0FKpVKoaIxl2pWsoNcn7A/nMPSrxayw4T3BsmPeV2lF9Y06BsAQeMGhCTQ4nYJ5XST7jkqe4ZEqFw==} emoji-regex@8.0.0: resolution: {integrity: sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==} - emoji-regex@9.2.2: - resolution: {integrity: sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg==} - empathic@2.0.0: resolution: {integrity: sha512-i6UzDscO/XfAcNYD75CfICkmfLedpyPDdozrLMmQc5ORaQcdMoc21OnlEylMIqI7U8eniKrPMxxtj8k0vhmJhA==} engines: {node: '>=14'} @@ -1813,8 +1800,8 @@ packages: fast-safe-stringify@2.1.1: resolution: {integrity: sha512-W+KJc2dmILlPplD/H4K9l9LcAHAfPtP6BY84uVLXQ6Evcz9Lcg33Y2z1IVblT6xdY54PXYVHEv+0Wpq8Io6zkA==} - fast-uri@3.1.6: - resolution: {integrity: sha512-7Ical1vFEMr0onbVzEDIreM22I4khW+fzyQPwvAFWBp1iwdshSZRsL4jjRvPG9JP1uiqMHRto+YU6R2/CzDz5Q==} + fast-uri@4.2.3: + resolution: {integrity: sha512-I1PXwP5eAhlNlcdpjt9CgB59op2ZvZfxw+BkqGFVIUOgNpCVTcTqp3HhTX7brxj5vsip+nSY4nTvff+eIA76hg==} fdir@6.5.0: resolution: {integrity: sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==} @@ -1989,13 +1976,8 @@ packages: glob-to-regexp@0.4.1: resolution: {integrity: sha512-lkX1HJXwyMcprw/5YUZc2s7DrpAiHB21/V+E1rHUrVNokkvB6bqMzT0VfV6/86ZNabt1k14YOIaT7nDvOX3Iiw==} - glob@10.5.0: - resolution: {integrity: sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==} - deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me - hasBin: true - - glob@13.0.6: - resolution: {integrity: sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==} + glob@14.0.2: + resolution: {integrity: sha512-vfMgTR2djMHPUchsJMLpZlYQvtjVL+mHpEr5wPpoCbQs2vr/FBNK+3Gnl9Ara1DSs4Aeg4eG9HiADb5/rkY/ZA==} engines: {node: 18 || 20 || >=22} glob@7.2.3: @@ -2023,8 +2005,8 @@ packages: graphmatch@1.1.1: resolution: {integrity: sha512-5ykVn/EXM1hF0XCaWh05VbYvEiOL2lY1kBxZtaYsyvjp7cmWOU1XsAdfQBwClraEofXDT197lFbXOEVMHpvQOg==} - handlebars@4.7.9: - resolution: {integrity: sha512-4E71E0rpOaQuJR2A3xDZ+GM1HyWYv1clR58tC8emQNeQe3RH7MAzSbat+V0wG78LQBo6m6bzSG/L4pBuCsgnUQ==} + handlebars@4.7.10: + resolution: {integrity: sha512-P5VJMVM7qgBn6vjXMw8WG9uVI+ncf2pi72j4de4yz5ZULLj2RGqLYaKOYGsgyrViQ0tePOVlN1tDCCXXtFqXKg==} engines: {node: '>=0.4.7'} hasBin: true @@ -2069,8 +2051,8 @@ packages: resolution: {integrity: sha512-F/1DnUGPopORZi0ni+CvrCgHQ5FyEAHRLSApuYWMmrbSwoN2Mn/7k+Gl38gJnR7yyDZk6WLXwiGod1JOWNDKGw==} hasBin: true - hono@4.12.34: - resolution: {integrity: sha512-GqXJqY/xJkJmuloTrnV1ZEXG3fqte+VjkUqoRNZXcrUidiUOP4fMSIHHY4tsqZBK++kVyWmt/AAfSUuy57/eSA==} + hono@4.13.11: + resolution: {integrity: sha512-/SMX/RQNJn7oNmFwH6DtwDqcrzZU2otm1FD6OJe2cWF6cfy/F8hq0XVBv7xW3FTJshRQwuBnXHDq2kNsdZnshg==} engines: {node: '>=16.9.0'} html-escaper@2.0.2: @@ -2156,8 +2138,8 @@ packages: inherits@2.0.4: resolution: {integrity: sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==} - ip-address@10.3.1: - resolution: {integrity: sha512-1e9d3kb97NHJTIJDZW9rKqW2h6+dFa50Dy0fpPSMQp2ADje5gvKsXmdiK6dwY5t76TaTt5+P5N1Y/LoToIxP6g==} + ip-address@10.7.5: + resolution: {integrity: sha512-t2v0rkILYv9WXmSL7TpAaU3HXgaFYOPUcH3QHgwQ++gpJuH3bqyMy4Fvt/DJCTKwzH3Cf+bAp5W/mFL39KPLzA==} engines: {node: '>= 12'} ipaddr.js@1.9.1: @@ -2261,9 +2243,6 @@ packages: resolution: {integrity: sha512-RKYVTCjAnRthyJes037NX/IiqeidgN1xc3j1RjFfECFp28A1GVwK9nA+i0rJPaHqSZwygLzRnFlzUuHFoWWy+Q==} engines: {node: '>=6'} - jackspeak@3.4.3: - resolution: {integrity: sha512-OGlZQpz2yfahA/Rd1Y8Cd9SIEsqvXkLVoSw/cgwhnhFMDbsQFeZYoJJ7bIZBS9BcamUW96asq/npPWugM+RQBw==} - jest-worker@27.5.1: resolution: {integrity: sha512-7vuh85V5cdDofPyxn58nrPjBktZo0u9x1g8WtjQol+jZDaE+fhN+cIvTj11GndBnMnyfrUOG1sZQxCdjKh+DKg==} engines: {node: '>= 10.13.0'} @@ -2272,8 +2251,8 @@ packages: resolution: {integrity: sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ==} hasBin: true - joi@18.2.3: - resolution: {integrity: sha512-N5A3KTWQpPWT4ExxxPlUx7WmykGXRzhNidWhV41d6Abu9YfI2NyWCJuxdPnslJCPWtbRpSVOWSnSS6GakLM/Rg==} + joi@18.3.1: + resolution: {integrity: sha512-mV9M4Llh4va3NT90p7KBtQhoZqjs8xLX7EWYE4y/GG3yLF6REbIBEHSUb0UX1JXRht2w5tiLSsvmpYc5akiqIw==} engines: {node: '>= 20'} jose@4.15.5: @@ -2288,12 +2267,12 @@ packages: js-tokens@4.0.0: resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==} - js-yaml@3.15.1: - resolution: {integrity: sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag==} + js-yaml@3.15.2: + resolution: {integrity: sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==} hasBin: true - js-yaml@4.3.1: - resolution: {integrity: sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==} + js-yaml@4.3.2: + resolution: {integrity: sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==} hasBin: true jsbn@0.1.1: @@ -2434,9 +2413,6 @@ packages: long@5.3.2: resolution: {integrity: sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA==} - lru-cache@10.4.3: - resolution: {integrity: sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==} - lru-cache@11.5.2: resolution: {integrity: sha512-4pfM1Ff0x50o0tQwb5ucw/RzNyD0/YJME6IVcStalZuMWxdt3sR3huStTtxz4PUmvZfRguvDejasvQ2kifR11g==} engines: {node: 20 || >=22} @@ -2535,20 +2511,10 @@ packages: minimalistic-assert@1.0.1: resolution: {integrity: sha512-UtJcAD4yEaGtjPezWuO9wC4nwUnVH/8/Im3yEHQP4b67cXlD/Qr9hdITCU1xDbSEXg2XKNaP8jsReV7vQd00/A==} - minimatch@10.2.5: - resolution: {integrity: sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==} + minimatch@11.0.1: + resolution: {integrity: sha512-t+Vn6DX4wPCxS23y03C0uhF7S1jpi1GfqPrnlEipCJaA2ykiNbMkVlDutZtmvLfRcUN6R8AYVlzTsQrT4RZoLQ==} engines: {node: 18 || 20 || >=22} - minimatch@3.1.4: - resolution: {integrity: sha512-twmL+S8+7yIsE9wsqgzU3E8/LumN3M3QELrBZ20OdmQ9jB2JvW5oZtBEmft84k/Gs5CG9mqtWc6Y9vW+JEzGxw==} - - minimatch@3.1.5: - resolution: {integrity: sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==} - - minimatch@9.0.9: - resolution: {integrity: sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==} - engines: {node: '>=16 || 14 >=14.17'} - minimist@1.2.8: resolution: {integrity: sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==} @@ -2566,8 +2532,8 @@ packages: engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0} hasBin: true - moment@2.30.1: - resolution: {integrity: sha512-uEmtNhbDOrWPFS+hdjFCBfy9f2YoyzRpwcl+DqpC6taX21FzsTLQVbMV/W7PzNSX6x/bhC1zA3c2UQ5NzH6how==} + moment@2.31.0: + resolution: {integrity: sha512-0acOTfMiWOheYS4eoWb80yYMb/JLvVv9SHbs2PehaDzfUG0Bw855SKyk0IKTnPGa5+U2bmi3W68l1+sGLX/pvw==} ms@2.0.0: resolution: {integrity: sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==} @@ -2575,17 +2541,19 @@ packages: ms@2.1.3: resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==} - multer@2.2.0: - resolution: {integrity: sha512-6rdyFg2kLrMh9Jee7/BMPuV9lEAd7lLW2YUpF9/YxR7njyoUwwQ0ZPh3TaIY50Sw6vlyD2HW3wGOkTS4P79xrQ==} + multer@2.5.0: + resolution: {integrity: sha512-BsqOzYGVq49JcW2IzoSAxeKYRevb+dGGPPWleOR8Lrlk4igwxu1/9pwSXlByhCb7MVZDrNJFC0IBP5/O5nLYRw==} engines: {node: '>= 10.16.0'} mute-stream@2.0.0: resolution: {integrity: sha512-WWdIxpyjEn+FhQJQQv9aQAYlHoNVdzIzUySNV1gHUPDSdZJ3yZn7pAAbQcV7B56Mvu881q9FZV+0Vx2xC44VWA==} engines: {node: ^18.17.0 || >=20.5.0} - mysql2@3.15.3: - resolution: {integrity: sha512-FBrGau0IXmuqg4haEZRBfHNWB5mUARw6hNwPDXXGg0XzVJ50mr/9hb267lvpVMnhZ1FON3qNd4Xfcez1rbFwSg==} + mysql2@3.23.1: + resolution: {integrity: sha512-tTuRnC7qCet2IOfSNMYZ5SwXuBnfvBPAcIA28P0gtruXyZlU1LMxA6uha32kYypoFgyYklMqhLWwt4laYwXR/Q==} engines: {node: '>= 8.0'} + peerDependencies: + '@types/node': '>= 8' named-placeholders@1.1.6: resolution: {integrity: sha512-Tz09sEL2EEuv5fFowm419c1+a/jSMiBjI9gHxVLrVdbUkkNUUfjsVYs9pVZu5oCon/kmRh9TfLEObFtkVxmY0w==} @@ -2620,8 +2588,8 @@ packages: node-emoji@1.11.0: resolution: {integrity: sha512-wo2DpQkQp7Sjm2A0cq+sN7EHKO6Sl0ctXeBdFZrL9T9+UywORbufTcTZxom8YqpLQt/FqNMUkOpkZrJVYSKD3A==} - node-forge@1.4.0: - resolution: {integrity: sha512-LarFH0+6VfriEhqMMcLX2F7SwSXeWwnEAJEsYm5QKWchiVYVvJyV9v7UDvUv+w5HO23ZpQTXDv/GxdDdMyOuoQ==} + node-forge@1.4.1: + resolution: {integrity: sha512-w5/MfWaeMrpR/5ba6fZyAUTLSuE6aYz7H/3cYrqwZEmf5eQS3IaaLgJt4MBv7HglGFWmV22K8h4U18RJQmw/ow==} engines: {node: '>= 6.13.0'} node-oauth1@1.3.0: @@ -2631,8 +2599,8 @@ packages: resolution: {integrity: sha512-RM5oyBy45cLEoHqCeh+MNuFAxO0vTFBLskvQbOKnEE7YTTSN4tbN8QWDIPQ6L+WvKsB/qLEGpYe2ZZ9d4W9OIQ==} engines: {node: '>=8'} - node-releases@2.0.51: - resolution: {integrity: sha512-wRNIrw4DmVLKQlbgOMdkMx27Wrpzes2hh5Jtbi2bjPd+4wJstWIqP5A+lscnqbm0xxmT5Bpg8Lec5ItEBwx6BQ==} + node-releases@2.0.63: + resolution: {integrity: sha512-6li2QanLsAXpIH2R6j77MzRyvOyrvdTqlKtO4CgBdHGNvN99ZZfyxszHc5o5+IZBWD5u6Hzwg83JoGXmqZNG9Q==} engines: {node: '>=18'} nodemon@3.1.11: @@ -2720,9 +2688,6 @@ packages: resolution: {integrity: sha512-whdkPIooSu/bASggZ96BWVvZTRMOFxnyUG5PnTSGKoJE2gd5mbVNmR2Nj20QFzxYYgAXpoqC+AiXzl+UMRh7zQ==} engines: {node: '>=8'} - package-json-from-dist@1.0.1: - resolution: {integrity: sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw==} - parent-module@1.0.1: resolution: {integrity: sha512-GQ2EWRpQV8/o+Aw8YqtfZZPfNRWZYkbidE9k5rpl/hC3vtHHBfGm2Ifi6qWV+coDGkrUKZAxE3Lot5kcsRlh+g==} engines: {node: '>=6'} @@ -2751,12 +2716,8 @@ packages: resolution: {integrity: sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==} engines: {node: '>=8'} - path-scurry@1.11.1: - resolution: {integrity: sha512-Xa4Nw17FS9ApQFJ9umLiJS4orGjm7ZzwUrwamcGQuHSzDyth9boKDaycYdDcZDuqYATXw4HFXgaqWTctW/v1HA==} - engines: {node: '>=16 || 14 >=14.18'} - - path-scurry@2.0.2: - resolution: {integrity: sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==} + path-scurry@3.0.0: + resolution: {integrity: sha512-1pTbQqH1wIwMi/eleQ5leFTTCkzFsPcgXNjwOA8YGGW/W4/kHT3dssE7Z6NH+zuqNLOzOB0uaD61yl7cAcVhgg==} engines: {node: 18 || 20 || >=22} path-to-regexp@0.1.13: @@ -2928,8 +2889,8 @@ packages: proper-lockfile@4.1.2: resolution: {integrity: sha512-TjNPblN4BwAWMXU8s9AEz4JmQxnD1NNL7bNOY/AKUzyamc379FWASUhc/K1pL2noVb+XmZKLL68cjzLsiOAMaA==} - proxy-addr@2.0.7: - resolution: {integrity: sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==} + proxy-addr@2.0.8: + resolution: {integrity: sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==} engines: {node: '>= 0.10'} psl@1.15.0: @@ -2945,12 +2906,8 @@ packages: pure-rand@6.1.0: resolution: {integrity: sha512-bVWawvoZoBYpp6yIoQtQXHZjmz35RSVHnUOTefl8Vcjr8snTPY1wnpSPMWekcFwbxI6gtmT7rSYPFvz71ldiOA==} - qs@6.15.2: - resolution: {integrity: sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==} - engines: {node: '>=0.6'} - - qs@6.15.3: - resolution: {integrity: sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==} + qs@6.16.1: + resolution: {integrity: sha512-5Px6J7rfHBAGUhNQ3es4YzcOdBBw0SDcVtThJml4RdnKw4tKs2epA0kPZ+K8X+WiHktT93RHVcQ/3ym5aTCgtg==} engines: {node: '>=0.6'} querystringify@2.2.0: @@ -3099,9 +3056,6 @@ packages: resolution: {integrity: sha512-1gnZf7DFcoIcajTjTwjwuDjzuz4PPcY2StKPlsGAQ1+YH20IRVrBaXSWmdjowTJ6u8Rc01PoYOGHXfP1mYcZNQ==} engines: {node: '>= 18'} - seq-queue@0.0.5: - resolution: {integrity: sha512-hr3Wtp/GZIc/6DAGPDcV4/9WoZhjrkXsi5B/07QgX8tsdc6ilr7BFM6PM6rbdAX1kFSDYeZGLipIZZKyQP0O5Q==} - serialised-error@1.1.3: resolution: {integrity: sha512-vybp3GItaR1ZtO2nxZZo8eOo7fnVaNtP3XE2vJKgzkKR2bagCkdJ1EpYYhEMd3qu/80DwQk9KjsNSxE3fXWq0g==} @@ -3214,9 +3168,9 @@ packages: sprintf-js@1.0.3: resolution: {integrity: sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==} - sqlstring@2.3.3: - resolution: {integrity: sha512-qC9iz2FlN7DQl3+wjwn3802RTyjCx7sDvfQEXchwa6CWOx07/WVfh91gBmQ9fahw8snwGEWU3xGzOt4tFyHLxg==} - engines: {node: '>= 0.6'} + sql-escaper@1.5.2: + resolution: {integrity: sha512-6CKD38c31SENivxOADeMNLdukOnUxUcflKtzVWzace7Riv1v7cAEym5Cx9Q7gYZ3ezIJI7ZpqecQq8cqNeSSFg==} + engines: {bun: '>=1.0.0', deno: '>=2.0.0', node: '>=12.0.0'} sshpk@1.18.0: resolution: {integrity: sha512-2p2KJZTSqQ/I3+HX42EpYOa2l3f8Erv8MWKsy2I9uf4wA7yFIkXRffYdsx86y6z4vHtV8u7g+pPlr8/4ouAxsQ==} @@ -3250,10 +3204,6 @@ packages: resolution: {integrity: sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==} engines: {node: '>=8'} - string-width@5.1.2: - resolution: {integrity: sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA==} - engines: {node: '>=12'} - string_decoder@1.3.0: resolution: {integrity: sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==} @@ -3261,10 +3211,6 @@ packages: resolution: {integrity: sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==} engines: {node: '>=8'} - strip-ansi@7.2.0: - resolution: {integrity: sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w==} - engines: {node: '>=12'} - strip-bom@3.0.0: resolution: {integrity: sha512-vavAMRXOgBVNF6nyEEmL3DBK19iRpDcoIwW+swQ+CbGiu7lju6t+JklA1MHweoWtadgt4ISVUsXLyDq34ddcwA==} engines: {node: '>=4'} @@ -3465,9 +3411,6 @@ packages: typedarray-to-buffer@3.1.5: resolution: {integrity: sha512-zdu8XMNEDepKKR+XYOXAVPtWui0ly0NtohUscw+UmaHiAWT8hrV1rr//H6V+0DvJ3OQ19S979M0laLfX8rm82Q==} - typedarray@0.0.6: - resolution: {integrity: sha512-/aCDEGatGvZ2BIk+HmLf4ifCJFwvKFNb9/JeZPMulfgFracn9QFcAf5GO8B/mweUjSoblS5In0cWhqpfs/5PQA==} - typescript-eslint@8.64.0: resolution: {integrity: sha512-0qg+pDNMnqYzqH9AnNK+39tejHvsShUOUUoRUgtnTGE7QuMZhiFDnozq8nHJVq+Wae6NMLKNWLg5WmkcC/ndyQ==} engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0} @@ -3514,11 +3457,11 @@ packages: resolution: {integrity: sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==} engines: {node: '>= 0.8'} - update-browserslist-db@1.2.3: - resolution: {integrity: sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==} + update-browserslist-db@1.3.4: + resolution: {integrity: sha512-t8wonIOdQyOjtPd2VktlBu6QjTVTks6v8bSi7kd0r2Vll8TK1JYDZtRRdbmCHOAMphkZgrzK+L+vXK4pyZ8t4A==} hasBin: true peerDependencies: - browserslist: '>= 4.21.0' + browserslist: 4.28.8 uri-js@4.4.1: resolution: {integrity: sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==} @@ -3623,10 +3566,6 @@ packages: resolution: {integrity: sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==} engines: {node: '>=10'} - wrap-ansi@8.1.0: - resolution: {integrity: sha512-si7QWI6zUMq56bESFvagtmzMdGOtoxfR+Sez11Mobfc7tm+VkUckk9bW2UeffTGVUbOksxmSw0AA2gs8g71NCQ==} - engines: {node: '>=12'} - wrappy@1.0.2: resolution: {integrity: sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==} @@ -3800,7 +3739,7 @@ snapshots: dependencies: '@babel/compat-data': 7.29.7 '@babel/helper-validator-option': 7.29.7 - browserslist: 4.28.6 + browserslist: 4.28.8 lru-cache: 5.1.1 semver: 6.3.1 @@ -3911,7 +3850,7 @@ snapshots: dependencies: '@eslint/object-schema': 2.1.7 debug: 4.4.3(supports-color@5.5.0) - minimatch: 3.1.5 + minimatch: '@topcoder/minimatch-compat@file:tools/minimatch-compat' transitivePeerDependencies: - supports-color @@ -3931,8 +3870,8 @@ snapshots: globals: 14.0.0 ignore: 5.3.2 import-fresh: 3.3.1 - js-yaml: 4.3.1 - minimatch: 3.1.5 + js-yaml: 4.3.2 + minimatch: '@topcoder/minimatch-compat@file:tools/minimatch-compat' strip-json-comments: 3.1.1 transitivePeerDependencies: - supports-color @@ -3946,7 +3885,7 @@ snapshots: '@eslint/core': 0.17.0 levn: 0.4.1 - '@faker-js/faker@5.5.3': {} + '@faker-js/faker@10.6.0': {} '@hapi/address@5.1.1': dependencies: @@ -3964,9 +3903,9 @@ snapshots: dependencies: '@hapi/hoek': 11.0.7 - '@hono/node-server@2.0.11(hono@4.12.34)': + '@hono/node-server@2.1.3(hono@4.13.11)': dependencies: - hono: 4.12.34 + hono: 4.13.11 '@humanfs/core@0.19.2': dependencies: @@ -4124,21 +4063,14 @@ snapshots: optionalDependencies: '@types/node': 26.1.1 - '@isaacs/cliui@8.0.2': - dependencies: - string-width: 5.1.2 - string-width-cjs: string-width@4.2.3 - strip-ansi: 7.2.0 - strip-ansi-cjs: strip-ansi@6.0.1 - wrap-ansi: 8.1.0 - wrap-ansi-cjs: wrap-ansi@7.0.0 + '@isaacs/nonrecursive-glob-match@1.0.3': {} '@istanbuljs/load-nyc-config@1.1.0': dependencies: camelcase: 5.3.1 find-up: 4.1.0 get-package-type: 0.1.0 - js-yaml: 3.15.1 + js-yaml: 3.15.2 resolve-from: 5.0.0 '@istanbuljs/schema@0.1.6': {} @@ -4197,7 +4129,7 @@ snapshots: cli-table3: 0.6.5 commander: 4.1.1 fork-ts-checker-webpack-plugin: 9.1.0(typescript@5.9.3)(webpack@5.106.2(uglify-js@3.19.3)) - glob: 13.0.6 + glob: 14.0.2 node-emoji: 1.11.0 ora: 5.4.1 tsconfig-paths: 4.2.0 @@ -4252,7 +4184,7 @@ snapshots: '@nestjs/core': 11.1.28(@nestjs/common@11.1.28(reflect-metadata@0.2.2)(rxjs@7.8.2)(supports-color@5.5.0))(@nestjs/platform-express@11.1.28)(reflect-metadata@0.2.2)(rxjs@7.8.2) cors: 2.8.6 express: 5.2.1(supports-color@5.5.0) - multer: 2.2.0 + multer: 2.5.0 path-to-regexp: 8.4.2 tslib: 2.8.1 transitivePeerDependencies: @@ -4286,9 +4218,6 @@ snapshots: dependencies: '@noble/hashes': 1.8.0 - '@pkgjs/parseargs@0.11.0': - optional: true - '@postman/form-data@3.1.1': dependencies: asynckit: 0.4.0 @@ -4317,11 +4246,11 @@ snapshots: '@prisma/client-runtime-utils@7.8.0': {} - '@prisma/client@7.8.0(prisma@7.8.0(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(typescript@5.9.3))(typescript@5.9.3)': + '@prisma/client@7.8.0(prisma@7.8.0(@types/node@26.1.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(typescript@5.9.3))(typescript@5.9.3)': dependencies: '@prisma/client-runtime-utils': 7.8.0 optionalDependencies: - prisma: 7.8.0(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(typescript@5.9.3) + prisma: 7.8.0(@types/node@26.1.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(typescript@5.9.3) typescript: 5.9.3 '@prisma/config@7.8.0': @@ -4342,13 +4271,13 @@ snapshots: '@electric-sql/pglite': 0.4.1 '@electric-sql/pglite-socket': 0.1.1(@electric-sql/pglite@0.4.1) '@electric-sql/pglite-tools': 0.3.1(@electric-sql/pglite@0.4.1) - '@hono/node-server': 2.0.11(hono@4.12.34) + '@hono/node-server': 2.1.3(hono@4.13.11) '@prisma/get-platform': 7.2.0 '@prisma/query-plan-executor': 7.2.0 '@prisma/streams-local': 0.1.2 foreground-child: 3.3.1 get-port-please: 3.2.0 - hono: 4.12.34 + hono: 4.13.11 http-status-codes: 2.3.0 pathe: 2.0.3 proper-lockfile: 4.1.2 @@ -4477,6 +4406,10 @@ snapshots: '@tokenizer/token@0.3.0': {} + '@topcoder/minimatch-compat@file:tools/minimatch-compat': + dependencies: + minimatch: 11.0.1 + '@tsconfig/node10@1.0.12': {} '@tsconfig/node12@1.0.11': {} @@ -4635,7 +4568,7 @@ snapshots: '@typescript-eslint/types': 8.64.0 '@typescript-eslint/visitor-keys': 8.64.0 debug: 4.4.3(supports-color@5.5.0) - minimatch: 10.2.5 + minimatch: 11.0.1 semver: 7.7.3 tinyglobby: 0.2.17 ts-api-utils: 2.5.0(typescript@5.9.3) @@ -4797,14 +4730,14 @@ snapshots: ajv@8.18.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.6 + fast-uri: 4.2.3 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.6 + fast-uri: 4.2.3 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -4812,14 +4745,10 @@ snapshots: ansi-regex@5.0.1: {} - ansi-regex@6.2.2: {} - ansi-styles@4.3.0: dependencies: color-convert: 2.0.1 - ansi-styles@6.2.3: {} - ansis@4.2.0: {} anymatch@3.1.3: @@ -4869,13 +4798,11 @@ snapshots: aws4@1.13.2: {} - balanced-match@1.0.2: {} - balanced-match@4.0.4: {} base64-js@1.5.1: {} - baseline-browser-mapping@2.10.43: {} + baseline-browser-mapping@2.11.0: {} bcrypt-pbkdf@1.0.2: dependencies: @@ -4893,7 +4820,7 @@ snapshots: bluebird@2.11.0: {} - body-parser@1.20.6(supports-color@5.5.0): + body-parser@1.20.9(supports-color@5.5.0): dependencies: bytes: 3.1.2 content-type: 1.0.5 @@ -4903,37 +4830,28 @@ snapshots: http-errors: 2.0.1 iconv-lite: 0.4.24 on-finished: 2.4.1 - qs: 6.15.2 + qs: 6.16.1 raw-body: 2.5.3 type-is: 1.6.18 unpipe: 1.0.0 transitivePeerDependencies: - supports-color - body-parser@2.3.0(supports-color@5.5.0): + body-parser@2.4.0(supports-color@5.5.0): dependencies: bytes: 3.1.2 - content-type: 2.0.0 + content-type: 2.1.0 debug: 4.4.3(supports-color@5.5.0) http-errors: 2.0.1 iconv-lite: 0.7.3 on-finished: 2.4.1 - qs: 6.15.3 + qs: 6.16.1 raw-body: 3.0.2 type-is: 2.1.0 transitivePeerDependencies: - supports-color - brace-expansion@1.1.18: - dependencies: - balanced-match: 1.0.2 - concat-map: 0.0.1 - - brace-expansion@2.1.4: - dependencies: - balanced-match: 1.0.2 - - brace-expansion@5.0.9: + brace-expansion@5.0.12: dependencies: balanced-match: 4.0.4 @@ -4947,13 +4865,13 @@ snapshots: browser-stdout@1.3.1: {} - browserslist@4.28.6: + browserslist@4.28.8: dependencies: - baseline-browser-mapping: 2.10.43 - caniuse-lite: 1.0.30001806 - electron-to-chromium: 1.5.392 - node-releases: 2.0.51 - update-browserslist-db: 1.2.3(browserslist@4.28.6) + baseline-browser-mapping: 2.11.0 + caniuse-lite: 1.0.30001820 + electron-to-chromium: 1.5.472 + node-releases: 2.0.63 + update-browserslist-db: 1.3.4(browserslist@4.28.8) buffer-equal-constant-time@1.0.1: {} @@ -5008,7 +4926,7 @@ snapshots: camelcase@6.3.0: {} - caniuse-lite@1.0.30001806: {} + caniuse-lite@1.0.30001820: {} caseless@0.12.0: {} @@ -5127,15 +5045,6 @@ snapshots: component-emitter@1.3.1: {} - concat-map@0.0.1: {} - - concat-stream@2.0.0: - dependencies: - buffer-from: 1.1.2 - inherits: 2.0.4 - readable-stream: 3.6.2 - typedarray: 0.0.6 - confbox@0.2.2: {} confbox@0.2.4: {} @@ -5154,6 +5063,8 @@ snapshots: content-type@2.0.0: {} + content-type@2.1.0: {} + convert-source-map@1.9.0: {} convert-source-map@2.0.0: {} @@ -5181,7 +5092,7 @@ snapshots: cosmiconfig@8.3.6(typescript@5.9.3): dependencies: import-fresh: 3.3.1 - js-yaml: 4.3.1 + js-yaml: 4.3.2 parse-json: 5.2.0 path-type: 4.0.0 optionalDependencies: @@ -5199,7 +5110,7 @@ snapshots: csstype@3.2.3: {} - csv-parse@4.16.3: {} + csv-parse@7.0.2: {} dashdash@1.14.1: dependencies: @@ -5275,8 +5186,6 @@ snapshots: es-errors: 1.3.0 gopd: 1.2.0 - eastasianwidth@0.2.0: {} - ecc-jsbn@0.1.2: dependencies: jsbn: 0.1.1 @@ -5293,12 +5202,10 @@ snapshots: '@standard-schema/spec': 1.1.0 fast-check: 3.23.2 - electron-to-chromium@1.5.392: {} + electron-to-chromium@1.5.472: {} emoji-regex@8.0.0: {} - emoji-regex@9.2.2: {} - empathic@2.0.0: {} enabled@2.0.0: {} @@ -5394,7 +5301,7 @@ snapshots: is-glob: 4.0.3 json-stable-stringify-without-jsonify: 1.0.1 lodash.merge: 4.6.2 - minimatch: 3.1.5 + minimatch: '@topcoder/minimatch-compat@file:tools/minimatch-compat' natural-compare: 1.4.0 optionator: 0.9.4 optionalDependencies: @@ -5438,7 +5345,7 @@ snapshots: dependencies: accepts: 1.3.8 array-flatten: 1.1.1 - body-parser: 1.20.6(supports-color@5.5.0) + body-parser: 1.20.9(supports-color@5.5.0) content-disposition: 0.5.4 content-type: 1.0.5 cookie: 0.7.2 @@ -5456,8 +5363,8 @@ snapshots: on-finished: 2.4.1 parseurl: 1.3.3 path-to-regexp: 0.1.13 - proxy-addr: 2.0.7 - qs: 6.15.2 + proxy-addr: 2.0.8 + qs: 6.16.1 range-parser: 1.2.1 safe-buffer: 5.2.1 send: 0.19.2(supports-color@5.5.0) @@ -5473,7 +5380,7 @@ snapshots: express@5.2.1(supports-color@5.5.0): dependencies: accepts: 2.0.0 - body-parser: 2.3.0(supports-color@5.5.0) + body-parser: 2.4.0(supports-color@5.5.0) content-disposition: 1.1.0 content-type: 1.0.5 cookie: 0.7.2 @@ -5491,8 +5398,8 @@ snapshots: on-finished: 2.4.1 once: 1.4.0 parseurl: 1.3.3 - proxy-addr: 2.0.7 - qs: 6.15.2 + proxy-addr: 2.0.8 + qs: 6.16.1 range-parser: 1.2.1 router: 2.2.0(supports-color@5.5.0) send: 1.2.1(supports-color@5.5.0) @@ -5521,7 +5428,7 @@ snapshots: fast-safe-stringify@2.1.1: {} - fast-uri@3.1.6: {} + fast-uri@4.2.3: {} fdir@6.5.0(picomatch@4.0.5): optionalDependencies: @@ -5621,7 +5528,7 @@ snapshots: deepmerge: 4.3.1 fs-extra: 10.1.0 memfs: 3.5.3 - minimatch: 3.1.4 + minimatch: '@topcoder/minimatch-compat@file:tools/minimatch-compat' node-abort-controller: 3.1.1 schema-utils: 3.3.0 semver: 7.7.3 @@ -5714,27 +5621,18 @@ snapshots: glob-to-regexp@0.4.1: {} - glob@10.5.0: - dependencies: - foreground-child: 3.3.1 - jackspeak: 3.4.3 - minimatch: 9.0.9 - minipass: 7.1.3 - package-json-from-dist: 1.0.1 - path-scurry: 1.11.1 - - glob@13.0.6: + glob@14.0.2: dependencies: - minimatch: 10.2.5 + minimatch: 11.0.1 minipass: 7.1.3 - path-scurry: 2.0.2 + path-scurry: 3.0.0 glob@7.2.3: dependencies: fs.realpath: 1.0.0 inflight: 1.0.6 inherits: 2.0.4 - minimatch: 3.1.4 + minimatch: '@topcoder/minimatch-compat@file:tools/minimatch-compat' once: 1.4.0 path-is-absolute: 1.0.1 @@ -5750,7 +5648,7 @@ snapshots: graphmatch@1.1.1: {} - handlebars@4.7.9: + handlebars@4.7.10: dependencies: minimist: 1.2.8 neo-async: 2.6.2 @@ -5791,7 +5689,7 @@ snapshots: he@1.2.0: {} - hono@4.12.34: {} + hono@4.13.11: {} html-escaper@2.0.2: {} @@ -5870,7 +5768,7 @@ snapshots: inherits@2.0.4: {} - ip-address@10.3.1: {} + ip-address@10.7.5: {} ipaddr.js@1.9.1: {} @@ -5960,12 +5858,6 @@ snapshots: iterare@1.2.1: {} - jackspeak@3.4.3: - dependencies: - '@isaacs/cliui': 8.0.2 - optionalDependencies: - '@pkgjs/parseargs': 0.11.0 - jest-worker@27.5.1: dependencies: '@types/node': 26.1.1 @@ -5974,7 +5866,7 @@ snapshots: jiti@2.6.1: {} - joi@18.2.3: + joi@18.3.1: dependencies: '@hapi/address': 5.1.1 '@hapi/formula': 3.0.2 @@ -5992,12 +5884,12 @@ snapshots: js-tokens@4.0.0: {} - js-yaml@3.15.1: + js-yaml@3.15.2: dependencies: argparse: 1.0.10 esprima: 4.0.1 - js-yaml@4.3.1: + js-yaml@4.3.2: dependencies: argparse: 2.0.1 @@ -6138,8 +6030,6 @@ snapshots: long@5.3.2: {} - lru-cache@10.4.3: {} - lru-cache@11.5.2: {} lru-cache@5.1.1: @@ -6213,21 +6103,10 @@ snapshots: minimalistic-assert@1.0.1: {} - minimatch@10.2.5: + minimatch@11.0.1: dependencies: - brace-expansion: 5.0.9 - - minimatch@3.1.4: - dependencies: - brace-expansion: 1.1.18 - - minimatch@3.1.5: - dependencies: - brace-expansion: 1.1.18 - - minimatch@9.0.9: - dependencies: - brace-expansion: 2.1.4 + '@isaacs/nonrecursive-glob-match': 1.0.3 + brace-expansion: 5.0.12 minimist@1.2.8: {} @@ -6243,12 +6122,12 @@ snapshots: diff: 8.0.3 escape-string-regexp: 4.0.0 find-up: 5.0.0 - glob: 10.5.0 + glob: 14.0.2 he: 1.2.0 is-path-inside: 3.0.3 - js-yaml: 4.3.1 + js-yaml: 4.3.2 log-symbols: 4.1.0 - minimatch: 9.0.9 + minimatch: 11.0.1 ms: 2.1.3 picocolors: 1.1.1 serialize-javascript: 7.0.7 @@ -6259,23 +6138,23 @@ snapshots: yargs-parser: 21.1.1 yargs-unparser: 2.0.0 - moment@2.30.1: {} + moment@2.31.0: {} ms@2.0.0: {} ms@2.1.3: {} - multer@2.2.0: + multer@2.5.0: dependencies: append-field: 1.0.0 busboy: 1.6.0 - concat-stream: 2.0.0 type-is: 1.6.18 mute-stream@2.0.0: {} - mysql2@3.15.3: + mysql2@3.23.1(@types/node@26.1.1): dependencies: + '@types/node': 26.1.1 aws-ssl-profiles: 1.1.2 denque: 2.1.0 generate-function: 2.3.1 @@ -6283,8 +6162,7 @@ snapshots: long: 5.3.2 lru.min: 1.1.4 named-placeholders: 1.1.6 - seq-queue: 0.0.5 - sqlstring: 2.3.3 + sql-escaper: 1.5.2 named-placeholders@1.1.6: dependencies: @@ -6298,7 +6176,7 @@ snapshots: neo-async@2.6.2: {} - newman@6.2.2(supports-color@5.5.0): + newman@6.2.2(patch_hash=b230221a371fa780544fbd2f311bb845fd113d9e68fe8c3da0d1efca00aa3b8b)(supports-color@5.5.0): dependencies: '@postman/tough-cookie': 4.1.3-postman.1 async: 3.2.5 @@ -6307,12 +6185,12 @@ snapshots: cli-table3: 0.6.5 colors: 1.4.0 commander: 11.1.0 - csv-parse: 4.16.3 + csv-parse: 7.0.2 filesize: 10.1.4 liquid-json: 0.3.1 lodash: 4.18.1 mkdirp: 3.0.1 - postman-collection: 4.4.0 + postman-collection: 4.4.0(patch_hash=17b540b14b6535c79f5c2f5416e3d4461863b60277b152d57bbca198010988dd) postman-collection-transformer: 4.1.8 postman-request: 2.88.1-postman.48(supports-color@5.5.0) postman-runtime: 7.39.1 @@ -6336,7 +6214,7 @@ snapshots: dependencies: lodash: 4.18.1 - node-forge@1.4.0: {} + node-forge@1.4.1: {} node-oauth1@1.3.0: {} @@ -6344,14 +6222,14 @@ snapshots: dependencies: process-on-spawn: 1.1.0 - node-releases@2.0.51: {} + node-releases@2.0.63: {} nodemon@3.1.11: dependencies: chokidar: 3.6.0 debug: 4.4.3(supports-color@5.5.0) ignore-by-default: 1.0.1 - minimatch: 3.1.4 + minimatch: '@topcoder/minimatch-compat@file:tools/minimatch-compat' pstree.remy: 1.1.8 semver: 7.7.3 simple-update-notifier: 2.0.0 @@ -6471,8 +6349,6 @@ snapshots: lodash.flattendeep: 4.4.0 release-zalgo: 1.0.0 - package-json-from-dist@1.0.1: {} - parent-module@1.0.1: dependencies: callsites: 3.1.0 @@ -6494,12 +6370,7 @@ snapshots: path-key@3.1.1: {} - path-scurry@1.11.1: - dependencies: - lru-cache: 10.4.3 - minipass: 7.1.3 - - path-scurry@2.0.2: + path-scurry@3.0.0: dependencies: lru-cache: 11.5.2 minipass: 7.1.3 @@ -6593,9 +6464,9 @@ snapshots: semver: 7.5.4 strip-json-comments: 3.1.1 - postman-collection@4.4.0: + postman-collection@4.4.0(patch_hash=17b540b14b6535c79f5c2f5416e3d4461863b60277b152d57bbca198010988dd): dependencies: - '@faker-js/faker': 5.5.3 + '@faker-js/faker': 10.6.0 file-type: 3.9.0 http-reasons: 0.1.0 iconv-lite: 0.6.3 @@ -6627,7 +6498,7 @@ snapshots: mime-types: 2.1.35 oauth-sign: 0.9.0 performance-now: 2.1.0 - qs: 6.15.2 + qs: 6.16.1 safe-buffer: 5.2.1 stream-length: 1.0.2 uuid: 11.1.1 @@ -6649,7 +6520,7 @@ snapshots: json-stringify-safe: 5.0.1 mime-types: 2.1.35 oauth-sign: 0.9.0 - qs: 6.15.2 + qs: 6.16.1 safe-buffer: 5.2.1 socks-proxy-agent: 8.0.5(supports-color@5.5.0) stream-length: 1.0.2 @@ -6662,16 +6533,16 @@ snapshots: '@postman/tough-cookie': 4.1.3-postman.1 async: 3.2.5 aws4: 1.12.0 - handlebars: 4.7.9 + handlebars: 4.7.10 httpntlm: 1.8.13 jose: 4.15.5 js-sha512: 0.9.0 lodash: 4.18.1 mime-types: 2.1.35 - node-forge: 1.4.0 + node-forge: 1.4.1 node-oauth1: 1.3.0 performance-now: 2.1.0 - postman-collection: 4.4.0 + postman-collection: 4.4.0(patch_hash=17b540b14b6535c79f5c2f5416e3d4461863b60277b152d57bbca198010988dd) postman-request: 2.88.1-postman.34 postman-sandbox: 4.7.1 postman-url-encoder: 3.0.5 @@ -6682,7 +6553,7 @@ snapshots: postman-sandbox@4.7.1: dependencies: lodash: 4.18.1 - postman-collection: 4.4.0 + postman-collection: 4.4.0(patch_hash=17b540b14b6535c79f5c2f5416e3d4461863b60277b152d57bbca198010988dd) teleport-javascript: 1.0.0 uvm: 2.1.1 @@ -6698,17 +6569,18 @@ snapshots: dependencies: parse-ms: 2.1.0 - prisma@7.8.0(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(typescript@5.9.3): + prisma@7.8.0(@types/node@26.1.1)(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(typescript@5.9.3): dependencies: '@prisma/config': 7.8.0 '@prisma/dev': 0.24.3(typescript@5.9.3) '@prisma/engines': 7.8.0 '@prisma/studio-core': 0.27.3(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7) - mysql2: 3.15.3 + mysql2: 3.23.1(@types/node@26.1.1) postgres: 3.4.7 optionalDependencies: typescript: 5.9.3 transitivePeerDependencies: + - '@types/node' - '@types/react' - '@types/react-dom' - magicast @@ -6727,7 +6599,7 @@ snapshots: retry: 0.12.0 signal-exit: 3.0.7 - proxy-addr@2.0.7: + proxy-addr@2.0.8: dependencies: forwarded: 0.2.0 ipaddr.js: 1.9.1 @@ -6742,11 +6614,7 @@ snapshots: pure-rand@6.1.0: {} - qs@6.15.2: - dependencies: - side-channel: 1.1.1 - - qs@6.15.3: + qs@6.16.1: dependencies: es-define-property: 1.0.1 side-channel: 1.1.1 @@ -6909,8 +6777,6 @@ snapshots: transitivePeerDependencies: - supports-color - seq-queue@0.0.5: {} - serialised-error@1.1.3: dependencies: object-hash: 1.3.1 @@ -7021,7 +6887,7 @@ snapshots: socks@2.8.9: dependencies: - ip-address: 10.3.1 + ip-address: 10.7.5 smart-buffer: 4.2.0 source-map-support@0.5.21: @@ -7048,7 +6914,7 @@ snapshots: sprintf-js@1.0.3: {} - sqlstring@2.3.3: {} + sql-escaper@1.5.2: {} sshpk@1.18.0: dependencies: @@ -7084,12 +6950,6 @@ snapshots: is-fullwidth-code-point: 3.0.0 strip-ansi: 6.0.1 - string-width@5.1.2: - dependencies: - eastasianwidth: 0.2.0 - emoji-regex: 9.2.2 - strip-ansi: 7.2.0 - string_decoder@1.3.0: dependencies: safe-buffer: 5.2.1 @@ -7098,10 +6958,6 @@ snapshots: dependencies: ansi-regex: 5.0.1 - strip-ansi@7.2.0: - dependencies: - ansi-regex: 6.2.2 - strip-bom@3.0.0: {} strip-bom@4.0.0: {} @@ -7122,7 +6978,7 @@ snapshots: formidable: 3.5.4 methods: 1.1.2 mime: 2.6.0 - qs: 6.15.2 + qs: 6.16.1 transitivePeerDependencies: - supports-color @@ -7182,7 +7038,7 @@ snapshots: dependencies: '@istanbuljs/schema': 0.1.6 glob: 7.2.3 - minimatch: 3.1.4 + minimatch: '@topcoder/minimatch-compat@file:tools/minimatch-compat' text-hex@1.0.0: {} @@ -7275,8 +7131,6 @@ snapshots: dependencies: is-typedarray: 1.0.0 - typedarray@0.0.6: {} - typescript-eslint@8.64.0(eslint@9.39.5(jiti@2.6.1)(supports-color@5.5.0))(supports-color@5.5.0)(typescript@5.9.3): dependencies: '@typescript-eslint/eslint-plugin': 8.64.0(@typescript-eslint/parser@8.64.0(eslint@9.39.5(jiti@2.6.1)(supports-color@5.5.0))(supports-color@5.5.0)(typescript@5.9.3))(eslint@9.39.5(jiti@2.6.1)(supports-color@5.5.0))(supports-color@5.5.0)(typescript@5.9.3) @@ -7311,9 +7165,9 @@ snapshots: unpipe@1.0.0: {} - update-browserslist-db@1.2.3(browserslist@4.28.6): + update-browserslist-db@1.3.4(browserslist@4.28.8): dependencies: - browserslist: 4.28.6 + browserslist: 4.28.8 escalade: 3.2.0 picocolors: 1.1.1 @@ -7374,7 +7228,7 @@ snapshots: '@webassemblyjs/wasm-parser': 1.14.1 acorn: 8.17.0 acorn-import-phases: 1.0.4(acorn@8.17.0) - browserslist: 4.28.6 + browserslist: 4.28.8 chrome-trace-event: 1.0.4 enhanced-resolve: 5.24.2 es-module-lexer: 2.3.1 @@ -7448,12 +7302,6 @@ snapshots: string-width: 4.2.3 strip-ansi: 6.0.1 - wrap-ansi@8.1.0: - dependencies: - ansi-styles: 6.2.3 - string-width: 5.1.2 - strip-ansi: 7.2.0 - wrappy@1.0.2: {} write-file-atomic@3.0.3: diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 816901d..0fd153f 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -1,33 +1,44 @@ overrides: - '@hono/node-server@<2.0.11': 2.0.11 + 'ip-address': 10.7.5 + 'baseline-browser-mapping': 2.11.0 + 'browserslist': 4.28.8 + 'proxy-addr': 2.0.8 + 'axios': 1.20.0 + 'follow-redirects': 1.16.2 + 'multer': 2.5.0 + 'qs': 6.16.1 + 'handlebars': 4.7.10 + 'csv-parse': 7.0.2 + '@faker-js/faker': 10.6.0 + 'node-forge': 1.4.1 + 'joi': 18.3.1 + 'moment': 2.31.0 + 'mysql2': 3.23.1 + 'hono': 4.13.11 + '@hono/node-server': 2.1.3 + 'js-yaml@^3': 3.15.2 + 'js-yaml@^4': 4.3.2 + 'brace-expansion@^1': 1.1.21 + 'brace-expansion@^2': 2.1.7 + 'brace-expansion@^5': 5.0.12 + 'fast-uri': 4.2.3 + 'body-parser@^1': 1.20.9 + 'body-parser@^2': 2.4.0 + 'glob@>=9': 14.0.2 + 'minimatch@<9': file:tools/minimatch-compat + 'minimatch@>=9': 11.0.1 'ajv@>=6.0.0 <6.14.0': 6.15.0 - 'axios@<1.18.1': 1.18.1 - 'body-parser@<1.20.6': 1.20.6 - 'brace-expansion@<1.1.18': 1.1.18 - 'brace-expansion@>=2.0.0 <2.1.4': 2.1.4 - 'brace-expansion@>=3.0.0 <3.0.6': 3.0.6 - 'brace-expansion@>=4.0.0 <5.0.9': 5.0.9 'deepmerge-ts@<8.0.0': 8.0.2 'diff@>=6.0.0 <8.0.3': 8.0.3 - 'fast-uri@>=3.0.0 <3.1.6': 3.1.6 'flatted@<3.4.2': 3.4.2 - 'handlebars@<4.7.9': 4.7.9 'jose@>=3.0.0 <4.15.5': 4.15.5 - 'hono@<4.12.34': 4.12.34 - 'ip-address@<=10.3.0': 10.3.1 - 'js-yaml@>=3.0.0 <3.15.1': 3.15.1 - 'js-yaml@>=4.0.0 <4.3.1': 4.3.1 'lodash@<4.18.1': 4.18.1 - 'node-forge@<1.4.0': 1.4.0 'picomatch@<2.3.2': 2.3.2 'serialize-javascript@>=5.0.0 <7.0.7': 7.0.7 'underscore@<1.13.8': 1.13.8 'uuid@<11.1.1': 11.1.1 - 'follow-redirects@<1.16.0': 1.16.0 'form-data@<4.0.6': 4.0.6 - 'minimatch@3.1.2': 3.1.4 'path-to-regexp@0.1.12': 0.1.13 - 'qs@<6.15.2': 6.15.2 'valibot@<=1.4.1': 1.4.2 # The published Bus API wrapper intentionally resolves Topcoder's core library @@ -41,3 +52,7 @@ allowBuilds: '@scarf/scarf': false core-js: false dtrace-provider: false + +patchedDependencies: + newman@6.2.2: patches/newman@6.2.2.patch + postman-collection@4.4.0: patches/postman-collection@4.4.0.patch diff --git a/tools/minimatch-compat/index.cjs b/tools/minimatch-compat/index.cjs new file mode 100644 index 0000000..21c167f --- /dev/null +++ b/tools/minimatch-compat/index.cjs @@ -0,0 +1,38 @@ +const modern = require('minimatch'); + +// Older build tools expect a callable CommonJS export. glob 7 additionally +// reads _glob and uses String.match on compiled segments. Delegate matching +// to minimatch 11's bounded matcher, without restoring the old regex engine. +function compatible(defaultOptions = {}) { + const options = (value) => ({ ...defaultOptions, ...value }); + const match = (path, pattern, value) => + modern.minimatch(path, pattern, options(value)); + Object.assign(match, modern.minimatch); + match.Minimatch = class extends modern.Minimatch { + constructor(pattern, value) { + super(pattern, options(value)); + for (const row of this.set) { + for (const segment of row) { + if (typeof segment === 'object' && segment !== null) { + segment._glob = segment.pattern; + segment[Symbol.match] = (input) => + segment.test(input) ? [input] : null; + } + } + } + } + + static defaults(value) { + return compatible(options(value)).Minimatch; + } + }; + match.defaults = (value) => compatible(options(value)); + match.filter = (pattern, value) => modern.filter(pattern, options(value)); + match.match = (paths, pattern, value) => + modern.match(paths, pattern, options(value)); + match.braceExpand = (pattern, value) => + modern.braceExpand(pattern, options(value)); + return match; +} + +module.exports = compatible(); diff --git a/tools/minimatch-compat/index.test.cjs b/tools/minimatch-compat/index.test.cjs new file mode 100644 index 0000000..7db975b --- /dev/null +++ b/tools/minimatch-compat/index.test.cjs @@ -0,0 +1,85 @@ +const assert = require('node:assert/strict'); +const { createRequire } = require('node:module'); +const { spawnSync } = require('node:child_process'); +const { test } = require('node:test'); + +const legacyRequire = createRequire(require.resolve('eslint')); +const match = legacyRequire('minimatch'); + +test('CSV consumers parse quoted fields through the patched parser', async () => { + const rows = await new Promise((resolve, reject) => { + createRequire(require.resolve('newman'))('csv-parse').parse('name,email\n"Example, User",user@example.test\n', { columns: true }, + (error, records) => error ? reject(error) : resolve(records)); + }); + assert.deepEqual(rows, [{ name: 'Example, User', email: 'user@example.test' }]); +}); + +test('Newman resolves dynamic variables with the patched Faker dependency', async () => { + const fs = require('node:fs'); + const path = require('node:path'); + const directory = fs.mkdtempSync(path.join(require('node:os').tmpdir(), 'newman-compat-')); + const iterationData = path.join(directory, 'data.csv'); + fs.writeFileSync(iterationData, 'account\nexample-account\n'); + const newmanRequire = createRequire(require.resolve('newman')); + const generators = newmanRequire('postman-collection/lib/superstring/dynamic-variables'); + for (const [name, { generator }] of Object.entries(generators)) { + assert.equal(typeof generator, 'function', name); + assert.notEqual(generator(), undefined, name); + } + const http = require('node:http'); + const server = http.createServer((request, response) => { + assert.ok(new URL(request.url, 'http://localhost').searchParams.get('name')); + assert.equal(new URL(request.url, 'http://localhost').searchParams.get('row'), 'example-account'); + response.end('ok'); + }); + await new Promise(resolve => server.listen(0, '127.0.0.1', resolve)); + try { + const summary = await new Promise((resolve, reject) => { + require('newman').run({ collection: { + info: { name: 'dependency smoke', schema: 'https://schema.getpostman.com/json/collection/v2.1.0/collection.json' }, + item: [{ name: 'dynamic name', request: { + method: 'GET', url: `http://127.0.0.1:${server.address().port}/?name={{$randomFirstName}}&row={{account}}`, + } }], + }, iterationData, timeoutRequest: 3000 }, (error, result) => error ? reject(error) : resolve(result)); + }); + assert.deepEqual(summary.run.failures, []); + const requestUrl = summary.run.executions[0].request.url.toString(); + assert.equal(requestUrl.includes('$randomFirstName'), false); + } finally { + await new Promise(resolve => server.close(resolve)); + fs.rmSync(directory, { recursive: true, force: true }); + } +}); + +test('legacy consumers retain the callable minimatch API', () => { + assert.equal(typeof match, 'function'); + assert.equal(match('src/main.ts', '**/*.ts'), true); + assert.equal(match('src/main.js', '**/*.ts'), false); + assert.equal(match('.env', '*'), false); + assert.equal(match.defaults({ dot: true })('.env', '*'), true); + assert.deepEqual(match.match(['a.ts', 'b.js'], '*.ts'), ['a.ts']); + assert.deepEqual(['a.ts', 'b.js'].filter(match.filter('*.ts')), ['a.ts']); + assert.deepEqual(match.braceExpand('*.{js,ts}'), ['*.js', '*.ts']); + assert.equal(new match.Minimatch('**/*.ts').match('src/main.ts'), true); + assert.equal(match.Minimatch.defaults({ dot: true }) !== undefined, true); + assert.equal(typeof match.GLOBSTAR, 'symbol'); +}); + +test('installed glob discovers source files with patched matching', () => { + const fs = require('node:fs'); + const path = require('node:path'); + const entries = fs.readdirSync('node_modules/.pnpm'); + const entry = entries.find(p => p.startsWith('glob@7.')) || entries.find(p => p.startsWith('glob@14.')); + assert.ok(entry, 'Expected an installed glob consumer'); + const glob = require(path.resolve('node_modules/.pnpm', entry, 'node_modules/glob')); + assert.ok(glob.sync('*.ts').includes('main.ts')); +}); + +test('amplifying glob patterns terminate within a bounded time', () => { + const result = spawnSync(process.execPath, ['-e', ` + const match = require(${JSON.stringify(legacyRequire.resolve('minimatch'))}); + new match.Minimatch('**/../'.repeat(30) + '*.ts', { optimizationLevel: 2 }); + `], { timeout: 5000, encoding: 'utf8' }); + assert.equal(result.error, undefined); + assert.equal(result.status, 0, result.stderr); +}); diff --git a/tools/minimatch-compat/package.json b/tools/minimatch-compat/package.json new file mode 100644 index 0000000..52aea68 --- /dev/null +++ b/tools/minimatch-compat/package.json @@ -0,0 +1,10 @@ +{ + "name": "@topcoder/minimatch-compat", + "version": "1.0.0", + "private": true, + "description": "Legacy CommonJS entry point backed by patched minimatch", + "main": "index.cjs", + "dependencies": { + "minimatch": "11.0.1" + } +} From 775a4fa356fed9d4a6b8a150bdaab0723ce2c012 Mon Sep 17 00:00:00 2001 From: Justin Gasper Date: Tue, 3 Nov 2026 10:09:21 +1100 Subject: [PATCH 05/13] chore: adopt core v4.0.0-rc.2 identity denylists --- package.json | 2 +- pnpm-lock.yaml | 12 ++++++------ 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/package.json b/package.json index 42b6c1c..74ff783 100644 --- a/package.json +++ b/package.json @@ -77,7 +77,7 @@ "rxjs": "^7.8.1", "superagent": "^10.3.0", "swagger-ui-express": "^4.1.3", - "tc-core-library-js": "github:topcoder-platform/tc-core-library-js#v4.0.0-rc.1", + "tc-core-library-js": "github:topcoder-platform/tc-core-library-js#v4.0.0-rc.2", "uuid": "^14.0.1", "winston": "^3.2.1", "xss": "^1.0.7", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index aef6f30..0df76f6 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -125,8 +125,8 @@ importers: specifier: ^4.1.3 version: 4.6.3(express@4.22.1(supports-color@5.5.0)) tc-core-library-js: - specifier: github:topcoder-platform/tc-core-library-js#v4.0.0-rc.1 - version: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/6c326fea0abfccb5ae29dff2ac5bce01aabc1fa4(supports-color@5.5.0) + specifier: github:topcoder-platform/tc-core-library-js#v4.0.0-rc.2 + version: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/58de37670180e183e8378c3d203df0112a0414f6(supports-color@5.5.0) uuid: specifier: ^14.0.1 version: 14.0.1 @@ -3260,9 +3260,9 @@ packages: resolution: {integrity: sha512-uxc/zpqFg6x7C8vOE7lh6Lbda8eEL9zmVm/PLeTPBRhh1xCgdWaQ+J1CUieGpIfm2HdtsUpRv+HshiasBMcc6A==} engines: {node: '>=6'} - tc-core-library-js@https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/6c326fea0abfccb5ae29dff2ac5bce01aabc1fa4: - resolution: {gitHosted: true, tarball: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/6c326fea0abfccb5ae29dff2ac5bce01aabc1fa4} - version: 4.0.0-rc.1 + tc-core-library-js@https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/58de37670180e183e8378c3d203df0112a0414f6: + resolution: {gitHosted: true, tarball: https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/58de37670180e183e8378c3d203df0112a0414f6} + version: 4.0.0-rc.2 engines: {node: '>=22.13'} teleport-javascript@1.0.0: @@ -7007,7 +7007,7 @@ snapshots: tapable@2.3.3: {} - tc-core-library-js@https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/6c326fea0abfccb5ae29dff2ac5bce01aabc1fa4(supports-color@5.5.0): + tc-core-library-js@https://codeload.github.com/topcoder-platform/tc-core-library-js/tar.gz/58de37670180e183e8378c3d203df0112a0414f6(supports-color@5.5.0): dependencies: '@types/jsonwebtoken': 9.0.10 jsonwebtoken: 9.0.3 From 3ab85e51b4bf2df7649bce89dbc0b2aba27f7ba9 Mon Sep 17 00:00:00 2001 From: Justin Gasper Date: Tue, 3 Nov 2026 22:23:25 +1100 Subject: [PATCH 06/13] Migrate ECS deployment to scoped OIDC without parameter access --- .circleci/config.yml | 340 ++++++++++++++++------------------- deploy/MIGRATION.md | 27 +++ deploy/prod-healthcheck.json | 14 ++ deploy/prod.json | 19 ++ deploy/release.py | 13 ++ 5 files changed, 232 insertions(+), 181 deletions(-) create mode 100644 deploy/MIGRATION.md create mode 100644 deploy/prod-healthcheck.json create mode 100644 deploy/prod.json create mode 100644 deploy/release.py diff --git a/.circleci/config.yml b/.circleci/config.yml index 9f4097f..7b03aa4 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -1,190 +1,168 @@ version: 2.1 - -parameters: - run_automatedtesting: - default: false - type: boolean - run_basedeployment: - default: true - type: boolean - -defaults: &defaults - docker: - - image: cimg/python:3.12.2-browsers - -install_dependency: &install_dependency - name: Installation of build and deployment dependencies. - command: | - # The image already contains Chrome and the Docker client. Their optional - # repositories can retain obsolete signing-key configuration and block or - # warn during otherwise unrelated package installation. - sudo rm -f /etc/apt/sources.list.d/google-chrome.list - sudo rm -f /etc/apt/sources.list.d/archive_uri-https_download_docker_com_linux_ubuntu-jammy.list - sudo apt-get update - sudo apt-get install --yes jq python3-pip - sudo pip3 install awscli --upgrade - -install_deploysuite: &install_deploysuite - name: Installation of install_deploysuite. - command: | - git clone --branch v1.4.17 https://github.com/topcoder-platform/tc-deploy-scripts ../buildscript - cp ./../buildscript/master_deploy.sh . - cp ./../buildscript/buildenv.sh . - cp ./../buildscript/awsconfiguration.sh . - cp ./../buildscript/psvar-processor.sh . - -finger_print_add: &finger_print_add - fingerprints: - - SHA256:KJYSvQh9CxkY9yRXxp+Geo6cllnfSiiKAH3LFQ/X9f4 - -builddeploy_steps: &builddeploy_steps - - add_ssh_keys: *finger_print_add - - checkout - - setup_remote_docker - - run: *install_dependency - - run: *install_deploysuite - - run: - name: Build docker image - command: | - ./awsconfiguration.sh "${DEPLOY_ENV}" - source awsenvconf - ./psvar-processor.sh -t appenv -p "/config/${APPNAME}/buildvar" - source buildvar_env - rm -f awsenvconf - ./build.sh "${APPNAME}" - - deploy: - name: Running MasterScript. - command: | - ./awsconfiguration.sh "$DEPLOY_ENV" - source awsenvconf - ./psvar-processor.sh -t appenv -p "/config/${APPNAME}/deployvar" - source deployvar_env - ./master_deploy.sh \ - -d ECS \ - -e "$DEPLOY_ENV" \ - -t latest \ - -j "/config/common/global-appvar,/config/${APPNAME}/appvar" \ - -i "$APPNAME" \ - -p FARGATE - - ./psvar-processor.sh -t appenv -p /config/common/qa-appvar - source qa-appvar_env - curl --request POST \ - --url "https://circleci.com/api/v2/project/github/$CIRCLE_PROJECT_USERNAME/$CIRCLE_PROJECT_REPONAME/pipeline" \ - --header "Circle-Token: ${QA_USER_TOKEN}" \ - --header 'content-type: application/json' \ - --data '{"branch":"'"$CIRCLE_BRANCH"'","parameters":{"run_automatedtesting":true,"run_basedeployment":false}}' - +executors: + reviewed: + docker: + - image: cimg/aws@sha256:4cf3768db00ddf9bc439b8c84e8a60c11a14edf81c8baf76f74132144f8340d5 +commands: + checkout-suite: + steps: + - run: + name: Verify the reviewed deployment suite + command: | + set -euo pipefail + git init --quiet /tmp/tc-deploy-scripts + git -C /tmp/tc-deploy-scripts remote add origin https://github.com/topcoder-platform/tc-deploy-scripts.git + git -C /tmp/tc-deploy-scripts fetch --quiet --depth 1 origin 2a76ef3153bf966f29b66a007397e21affc5e169 + git -C /tmp/tc-deploy-scripts checkout --quiet --detach FETCH_HEAD + test "$(git -C /tmp/tc-deploy-scripts rev-parse HEAD)" = 2a76ef3153bf966f29b66a007397e21affc5e169 jobs: - build-dev: - <<: *defaults - environment: - DEPLOY_ENV: DEV - LOGICAL_ENV: dev - APPNAME: resources-api-v6 - steps: *builddeploy_steps - - build-prod: - <<: *defaults + build: + executor: reviewed + steps: + - checkout + - setup_remote_docker + - checkout-suite + - run: + name: Build committed source without AWS or broker credentials + command: | + set -euo pipefail + python3 -I /tmp/tc-deploy-scripts/build_image.py --dockerfile docker/Dockerfile --image resource-api-v6:candidate + mkdir -p /tmp/release + docker save --output /tmp/release/image.tar resource-api-v6:candidate + no_output_timeout: 30m + - persist_to_workspace: + root: /tmp/release + paths: + - image.tar + deploy: + executor: reviewed + parameters: + environment: + type: enum + enum: + - dev + - prod environment: - DEPLOY_ENV: PROD - LOGICAL_ENV: prod - APPNAME: resources-api-v6 - steps: *builddeploy_steps - - Run-Newman-Test: + DEPLOY_ENV: << parameters.environment >> + steps: + - checkout + - setup_remote_docker + - checkout-suite + - attach_workspace: + at: /tmp/release + - run: + name: Promote a scanned digest with repository-bound OIDC + command: | + set +x + set -euo pipefail + test -f "deploy/${DEPLOY_ENV}.json" + docker load --input /tmp/release/image.tar + python3 -I deploy/release.py "deploy/${DEPLOY_ENV}.json" + no_output_timeout: 45m + qa: docker: - - image: cimg/node:26.5.0 - environment: - DEPLOY_ENV: DEV - LOGICAL_ENV: dev - APPNAME: resources-api-v6 + - image: cimg/node@sha256:2c1320ee6a256628f698938038700911276310d40cc9887cfc8f66ec0daa4343 + environment: + DEPLOY_ENV: DEV + LOGICAL_ENV: dev + APPNAME: resources-api-v6 steps: - - checkout - - run: *install_dependency - - run: *install_deploysuite - - restore_cache: - keys: - - pnpm-store-v1-{{ checksum "pnpm-lock.yaml" }} - - pnpm-store-v1- - - run: - name: Install pnpm dependencies - command: | - sudo npm install --global pnpm@11.15.1 - pnpm install --frozen-lockfile - pnpm build - - save_cache: - key: pnpm-store-v1-{{ checksum "pnpm-lock.yaml" }} - paths: - - ~/.local/share/pnpm/store - - run: - name: Newman test - command: | - ./awsconfiguration.sh "$DEPLOY_ENV" - source awsenvconf - ./psvar-processor.sh -t appenv -p /config/resources-api-v6/qaappvar - source qaappvar_env - ./psvar-processor.sh -t appenv -p /config/common/global-appvar - source global-appvar_env + - checkout + - restore_cache: + keys: + - pnpm-store-v1-{{ checksum "pnpm-lock.yaml" }} + - pnpm-store-v1- + - run: + name: Install pnpm dependencies + command: | + sudo npm install --global pnpm@11.15.1 + pnpm install --frozen-lockfile + pnpm build + - save_cache: + key: pnpm-store-v1-{{ checksum "pnpm-lock.yaml" }} + paths: + - ~/.local/share/pnpm/store + - run: + name: Newman test + command: | + set +x + set -euo pipefail + : "${DATABASE_URL:?Set isolated QA database settings in the restricted QA context}" + : "${AUTH0_CLIENT_SECRET:?Set test-only Auth0 settings in the restricted QA context}" + pnpm run mock-challenge-api > /tmp/mock-challenge-api.log 2>&1 & + mock_pid=$! + NODE_ENV=test pnpm start > /tmp/resource-api.log 2>&1 & + app_pid=$! + trap 'kill "$mock_pid" "$app_pid" 2>/dev/null || true' EXIT - pnpm run mock-challenge-api > /tmp/mock-challenge-api.log 2>&1 & - mock_pid=$! - NODE_ENV=test pnpm start > /tmp/resource-api.log 2>&1 & - app_pid=$! - trap 'kill "$mock_pid" "$app_pid" 2>/dev/null || true' EXIT - - health_url="http://localhost:${PORT:-3000}/${API_VERSION:-v6}/resources/health" - for attempt in $(seq 1 30); do - if curl --fail --silent "$health_url" > /dev/null; then - break - fi - if [[ "$attempt" == 30 ]]; then - cat /tmp/mock-challenge-api.log - cat /tmp/resource-api.log - exit 1 - fi - sleep 1 - done - - pnpm run test:newman:clear - pnpm run test:newman - pnpm run test:newman:clear - - store_artifacts: - path: ./newman + health_url="http://localhost:${PORT:-3000}/${API_VERSION:-v6}/resources/health" + for attempt in $(seq 1 30); do + if curl --fail --silent "$health_url" > /dev/null; then + break + fi + if [[ "$attempt" == 30 ]]; then + exit 1 + fi + sleep 1 + done + pnpm run test:newman:clear + pnpm run test:newman + pnpm run test:newman:clear + - store_artifacts: + path: ./newman workflows: - version: 2 - build: - when: << pipeline.parameters.run_basedeployment >> - jobs: - - build-dev: - context: org-global - filters: - branches: - only: - - develop - - security_july_2026 - - hotfix/deploy - - PM-3458 - - PM-5919 - - build-prod: - context: org-global - filters: - branches: - only: - - master - - testingflow: - when: << pipeline.parameters.run_automatedtesting >> + release: jobs: - - Hold [Performance-Testing]: - type: approval - - Run-Newman-Test: - context: org-global - requires: - - Hold [Performance-Testing] - filters: - branches: - only: - - develop - - dev-circleci + - build + - deploy: + name: deploy-dev + environment: dev + requires: + - build + context: resource-api-v6-dev-deploy + serial-group: << pipeline.project.slug >>/deploy-dev + filters: + branches: + only: develop + tags: + ignore: /.*/ + - approve-prod: + type: approval + requires: + - build + filters: + branches: + only: master + tags: + ignore: /.*/ + - deploy: + name: deploy-prod + environment: prod + requires: + - approve-prod + context: resource-api-v6-prod-deploy + serial-group: << pipeline.project.slug >>/deploy-prod + filters: + branches: + only: master + tags: + ignore: /.*/ + - approve-qa: + type: approval + requires: + - deploy-dev + filters: + branches: + only: develop + tags: + ignore: /.*/ + - qa: + requires: + - approve-qa + context: resource-api-v6-qa + filters: + branches: + only: develop + tags: + ignore: /.*/ diff --git a/deploy/MIGRATION.md b/deploy/MIGRATION.md new file mode 100644 index 0000000..f9f48b6 --- /dev/null +++ b/deploy/MIGRATION.md @@ -0,0 +1,27 @@ +# OIDC deployment migration + +This change replaces the Auth0 credential broker and SSM-to-shell deployment path with the reviewed [shared suite PR #40](https://github.com/topcoder-platform/tc-deploy-scripts/pull/40), pinned to `2a76ef3153bf966f29b66a007397e21affc5e169`. Build and deployment run in separate jobs. The deployer cannot read Parameter Store, Secrets Manager or decrypt KMS data, including through another assumed role. ECS continues resolving the existing runtime secret references using the execution role. + +## Production target + +The read-only inventory on 2026-11-03 verified account `409275337247`, cluster `tc-challenge-serverless`, service `resources-api-v6`, family `resources-api-v6`, and container `resources-api-v6`. `prod.json` preserves the observed task/execution roles and names the proposed service-specific deployment role. `prod-baseline.json` records references only; it contains no parameter values. Do not recreate the service or replace its complete task definition from this baseline. + +## Infrastructure prerequisites, applied separately by an administrator + +1. In each account, register the CircleCI OIDC issuer `https://oidc.circleci.com/org/947bef5e-1669-415d-b83c-4fc85155b7df` with client ID `947bef5e-1669-415d-b83c-4fc85155b7df`. The current production account has only the legacy Auth0 provider. Do not remove that provider until all its consumers have migrated. +2. Review and install `iam/prod-role.cloudformation.json` with an administrator/IaC identity. It creates the proposed deployment role and applies the same least-privilege policy as a permissions boundary. The trust binds this CircleCI project, repository, checkout branch and configuration branch. It does not grant infrastructure creation to CircleCI. +3. Configure ECR repository `resources-api-v6` with unconditional `IMMUTABLE` tags and supported scan-on-push. Existing tags are not retagged. The release fails for MEDIUM/HIGH/CRITICAL/UNDEFINED findings, failed scans, or a mismatched digest. +4. In the infrastructure that owns the task definition, add the reviewed container check from `prod-healthcheck.json`, keeping all roles, runtime secret references, resources, mounts and sidecars. Verify the health endpoint against the running container in dev first. Preserve circuit-breaker rollback and positive desired capacity. Remove any `RESET_DB` secret binding and plaintext secret environment entries before adoption. Keep the execution role's runtime read permissions scoped to the references that service needs. +5. Create restricted `resource-api-v6-dev-deploy` and `resource-api-v6-prod-deploy` CircleCI contexts without Auth0/static AWS credentials. Restrict production to the reviewed `master` checkout and configuration ref, authorized operators, and approval job. Remove legacy credentials from project settings too: removing `org-global` alone does not remove project-level variables. Confirm `CIRCLE_OIDC_TOKEN_V3` is issued. Disable secret access for forks and SSH debugging in deployment jobs. + +## Development acceptance before merge/release + +The saved dev AWS session had expired during preparation. No dev cluster, role or family has been guessed. **This PR is a draft until an administrator verifies and commits `deploy/dev.json` for account `811668436784` and branch `develop`, with corresponding narrow IAM policy/trust.** Use the same schema as `prod.json`, but inspect the actual dev resources and roles; do not replace just the account number. The dev job fails closed while its manifest is absent. Branches other than `develop` and `master` build only and receive no deployment context. + +Run the shared offline suite, validate the CircleCI config and IAM policies, and test a dev release plus an unhealthy-image rollback. Verify CloudTrail contains no SSM/Secrets Manager calls from the deployment principal. Remove its old broker grants only after migration. Check the runtime secret references and roles stayed unchanged. Production requires the manual approval job and a passing digest/scan/health verification. + +The pinned executor is `cimg/aws@sha256:4cf3768db00ddf9bc439b8c84e8a60c11a14edf81c8baf76f74132144f8340d5`. Python/AWS CLI/Buildx/Git compatibility was tested with the shared offline suite. No package installation or service build runs in the deployment job. The Dockerfile retains the existing in-image quality gates. This PR does not deploy, change IAM, rotate credentials, or claim a successful live rollout. + +## Newman integration tests + +The Newman workflow remains available after the dev release and a QA approval. It uses a separate restricted `resource-api-v6-qa` context containing only isolated test database and non-production test-user/Auth0 settings. An administrator must migrate those test settings before enabling the QA job. It does not receive the deployment role, `org-global`, CI broker credentials, or any Parameter Store permissions. The old recursive CircleCI API trigger and its QA_USER_TOKEN are removed; workflow dependencies now order the jobs. diff --git a/deploy/prod-healthcheck.json b/deploy/prod-healthcheck.json new file mode 100644 index 0000000..acca5d2 --- /dev/null +++ b/deploy/prod-healthcheck.json @@ -0,0 +1,14 @@ +{ + "resources-api-v6": { + "command": [ + "CMD", + "node", + "-e", + "const r=require('node:http').get('http://127.0.0.1:3000/v6/resources/health',r=>{r.resume();process.exit(r.statusCode>=200&&r.statusCode<300?0:1)});r.setTimeout(4000,()=>{r.destroy();process.exit(1)});r.on('error',()=>process.exit(1))" + ], + "interval": 30, + "timeout": 5, + "retries": 3, + "startPeriod": 120 + } +} diff --git a/deploy/prod.json b/deploy/prod.json new file mode 100644 index 0000000..5d6e323 --- /dev/null +++ b/deploy/prod.json @@ -0,0 +1,19 @@ +{ + "schemaVersion": 2, + "environment": "prod", + "accountId": "409275337247", + "region": "us-east-1", + "deployRoleArn": "arn:aws:iam::409275337247:role/resource-api-v6-prod-deploy", + "taskRoleArn": "arn:aws:iam::409275337247:role/challenge-v5-container-role", + "executionRoleArn": "arn:aws:iam::409275337247:role/ecsTaskExecutionRole", + "cluster": "tc-challenge-serverless", + "service": "resources-api-v6", + "taskFamily": "resources-api-v6", + "circleciOrgId": "947bef5e-1669-415d-b83c-4fc85155b7df", + "circleciProjectId": "bd210f8f-832b-4cca-b7b5-2f55569f5292", + "repository": "github.com/topcoder-platform/resource-api-v6", + "branch": "master", + "images": { + "resources-api-v6": "resources-api-v6" + } +} diff --git a/deploy/release.py b/deploy/release.py new file mode 100644 index 0000000..05b99da --- /dev/null +++ b/deploy/release.py @@ -0,0 +1,13 @@ +#!/usr/bin/env python3 +"""Pass the reviewed manifest and this job's prebuilt images to the pinned suite.""" +import json +from pathlib import Path +import subprocess +import sys + +manifest = Path(sys.argv[1]) +data = json.loads(manifest.read_text()) +command = [sys.executable, '-I', '/tmp/tc-deploy-scripts/tcdeploy.py', 'deploy', '--manifest', str(manifest)] +for container in data['images']: + command.extend(['--image', container + '=resource-api-v6:candidate']) +subprocess.run(command, check=True) From 340c9aa1df26a4b25a54f3ef9567b7bb9208c734 Mon Sep 17 00:00:00 2001 From: Justin Gasper Date: Tue, 3 Nov 2026 22:33:28 +1100 Subject: [PATCH 07/13] Migrate ECS deployment to scoped OIDC without parameter access --- .circleci/config.yml | 4 ++-- deploy/MIGRATION.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 7b03aa4..8f4f8f6 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -12,9 +12,9 @@ commands: set -euo pipefail git init --quiet /tmp/tc-deploy-scripts git -C /tmp/tc-deploy-scripts remote add origin https://github.com/topcoder-platform/tc-deploy-scripts.git - git -C /tmp/tc-deploy-scripts fetch --quiet --depth 1 origin 2a76ef3153bf966f29b66a007397e21affc5e169 + git -C /tmp/tc-deploy-scripts fetch --quiet --depth 1 origin b900d58e38787e3397743412597c6563fe6e08dd git -C /tmp/tc-deploy-scripts checkout --quiet --detach FETCH_HEAD - test "$(git -C /tmp/tc-deploy-scripts rev-parse HEAD)" = 2a76ef3153bf966f29b66a007397e21affc5e169 + test "$(git -C /tmp/tc-deploy-scripts rev-parse HEAD)" = b900d58e38787e3397743412597c6563fe6e08dd jobs: build: executor: reviewed diff --git a/deploy/MIGRATION.md b/deploy/MIGRATION.md index f9f48b6..17d282d 100644 --- a/deploy/MIGRATION.md +++ b/deploy/MIGRATION.md @@ -1,6 +1,6 @@ # OIDC deployment migration -This change replaces the Auth0 credential broker and SSM-to-shell deployment path with the reviewed [shared suite PR #40](https://github.com/topcoder-platform/tc-deploy-scripts/pull/40), pinned to `2a76ef3153bf966f29b66a007397e21affc5e169`. Build and deployment run in separate jobs. The deployer cannot read Parameter Store, Secrets Manager or decrypt KMS data, including through another assumed role. ECS continues resolving the existing runtime secret references using the execution role. +This change replaces the Auth0 credential broker and SSM-to-shell deployment path with the reviewed [shared suite PR #40](https://github.com/topcoder-platform/tc-deploy-scripts/pull/40), pinned to `b900d58e38787e3397743412597c6563fe6e08dd`. Build and deployment run in separate jobs. The deployer cannot read Parameter Store, Secrets Manager or decrypt KMS data, including through another assumed role. ECS continues resolving the existing runtime secret references using the execution role. ## Production target From 4cb4170907ad9426b0a9f50cd30097cc4b964b12 Mon Sep 17 00:00:00 2001 From: Justin Gasper Date: Tue, 3 Nov 2026 22:55:04 +1100 Subject: [PATCH 08/13] Migrate ECS deployment to scoped OIDC without parameter access --- .circleci/config.yml | 4 ++-- deploy/MIGRATION.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 8f4f8f6..d1bcee9 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -12,9 +12,9 @@ commands: set -euo pipefail git init --quiet /tmp/tc-deploy-scripts git -C /tmp/tc-deploy-scripts remote add origin https://github.com/topcoder-platform/tc-deploy-scripts.git - git -C /tmp/tc-deploy-scripts fetch --quiet --depth 1 origin b900d58e38787e3397743412597c6563fe6e08dd + git -C /tmp/tc-deploy-scripts fetch --quiet --depth 1 origin bbc9b3d0c702947d26b6d9686d7b29104ebe461a git -C /tmp/tc-deploy-scripts checkout --quiet --detach FETCH_HEAD - test "$(git -C /tmp/tc-deploy-scripts rev-parse HEAD)" = b900d58e38787e3397743412597c6563fe6e08dd + test "$(git -C /tmp/tc-deploy-scripts rev-parse HEAD)" = bbc9b3d0c702947d26b6d9686d7b29104ebe461a jobs: build: executor: reviewed diff --git a/deploy/MIGRATION.md b/deploy/MIGRATION.md index 17d282d..b8a2739 100644 --- a/deploy/MIGRATION.md +++ b/deploy/MIGRATION.md @@ -1,6 +1,6 @@ # OIDC deployment migration -This change replaces the Auth0 credential broker and SSM-to-shell deployment path with the reviewed [shared suite PR #40](https://github.com/topcoder-platform/tc-deploy-scripts/pull/40), pinned to `b900d58e38787e3397743412597c6563fe6e08dd`. Build and deployment run in separate jobs. The deployer cannot read Parameter Store, Secrets Manager or decrypt KMS data, including through another assumed role. ECS continues resolving the existing runtime secret references using the execution role. +This change replaces the Auth0 credential broker and SSM-to-shell deployment path with the reviewed [shared suite PR #40](https://github.com/topcoder-platform/tc-deploy-scripts/pull/40), pinned to `bbc9b3d0c702947d26b6d9686d7b29104ebe461a`. Build and deployment run in separate jobs. The deployer cannot read Parameter Store, Secrets Manager or decrypt KMS data, including through another assumed role. ECS continues resolving the existing runtime secret references using the execution role. ## Production target From d1af06e3d1e4308ece18ba09b4b2b74edfe9ed9e Mon Sep 17 00:00:00 2001 From: Justin Gasper Date: Wed, 4 Nov 2026 08:23:10 +1100 Subject: [PATCH 09/13] Maintain IAM templates and AWS baselines in private infrastructure repository --- .gitignore | 4 ++++ deploy/MIGRATION.md | 8 ++++++-- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 9748e37..9056621 100644 --- a/.gitignore +++ b/.gitignore @@ -72,3 +72,7 @@ src/generated/ # NestJS build output. dist/ + +# Infrastructure definitions and detailed AWS inventories are maintained privately. +/deploy/iam/ +/deploy/*-baseline.json diff --git a/deploy/MIGRATION.md b/deploy/MIGRATION.md index b8a2739..e6a7fe3 100644 --- a/deploy/MIGRATION.md +++ b/deploy/MIGRATION.md @@ -4,12 +4,12 @@ This change replaces the Auth0 credential broker and SSM-to-shell deployment pat ## Production target -The read-only inventory on 2026-11-03 verified account `409275337247`, cluster `tc-challenge-serverless`, service `resources-api-v6`, family `resources-api-v6`, and container `resources-api-v6`. `prod.json` preserves the observed task/execution roles and names the proposed service-specific deployment role. `prod-baseline.json` records references only; it contains no parameter values. Do not recreate the service or replace its complete task definition from this baseline. +The read-only inventory on 2026-11-03 verified account `409275337247`, cluster `tc-challenge-serverless`, service `resources-api-v6`, family `resources-api-v6`, and container `resources-api-v6`. `prod.json` preserves the observed task/execution roles and names the proposed service-specific deployment role. [prod-baseline.json](https://github.com/topcoder-platform/v6-services-iac/blob/main/services/resource-api-v6/deploy/prod-baseline.json) records references only; it contains no parameter values. Do not recreate the service or replace its complete task definition from this baseline. ## Infrastructure prerequisites, applied separately by an administrator 1. In each account, register the CircleCI OIDC issuer `https://oidc.circleci.com/org/947bef5e-1669-415d-b83c-4fc85155b7df` with client ID `947bef5e-1669-415d-b83c-4fc85155b7df`. The current production account has only the legacy Auth0 provider. Do not remove that provider until all its consumers have migrated. -2. Review and install `iam/prod-role.cloudformation.json` with an administrator/IaC identity. It creates the proposed deployment role and applies the same least-privilege policy as a permissions boundary. The trust binds this CircleCI project, repository, checkout branch and configuration branch. It does not grant infrastructure creation to CircleCI. +2. Review and install [iam/prod-role.cloudformation.json](https://github.com/topcoder-platform/v6-services-iac/blob/main/services/resource-api-v6/deploy/iam/prod-role.cloudformation.json) with an administrator/IaC identity. It creates the proposed deployment role and applies the same least-privilege policy as a permissions boundary. The trust binds this CircleCI project, repository, checkout branch and configuration branch. It does not grant infrastructure creation to CircleCI. 3. Configure ECR repository `resources-api-v6` with unconditional `IMMUTABLE` tags and supported scan-on-push. Existing tags are not retagged. The release fails for MEDIUM/HIGH/CRITICAL/UNDEFINED findings, failed scans, or a mismatched digest. 4. In the infrastructure that owns the task definition, add the reviewed container check from `prod-healthcheck.json`, keeping all roles, runtime secret references, resources, mounts and sidecars. Verify the health endpoint against the running container in dev first. Preserve circuit-breaker rollback and positive desired capacity. Remove any `RESET_DB` secret binding and plaintext secret environment entries before adoption. Keep the execution role's runtime read permissions scoped to the references that service needs. 5. Create restricted `resource-api-v6-dev-deploy` and `resource-api-v6-prod-deploy` CircleCI contexts without Auth0/static AWS credentials. Restrict production to the reviewed `master` checkout and configuration ref, authorized operators, and approval job. Remove legacy credentials from project settings too: removing `org-global` alone does not remove project-level variables. Confirm `CIRCLE_OIDC_TOKEN_V3` is issued. Disable secret access for forks and SSH debugging in deployment jobs. @@ -25,3 +25,7 @@ The pinned executor is `cimg/aws@sha256:4cf3768db00ddf9bc439b8c84e8a60c11a14edf8 ## Newman integration tests The Newman workflow remains available after the dev release and a QA approval. It uses a separate restricted `resource-api-v6-qa` context containing only isolated test database and non-production test-user/Auth0 settings. An administrator must migrate those test settings before enabling the QA job. It does not receive the deployment role, `org-global`, CI broker credentials, or any Parameter Store permissions. The old recursive CircleCI API trigger and its QA_USER_TOKEN are removed; workflow dependencies now order the jobs. + +## Infrastructure source + +IAM templates and detailed AWS baselines are maintained in the private [v6-services-iac service directory](https://github.com/topcoder-platform/v6-services-iac/tree/main/services/resource-api-v6). Provision infrastructure separately with an administrator identity; application CI does not fetch that repository or install IAM. Required application manifests and health-check proposals remain here. From c8ef883df67846c0c3ef5dd8a7b6c2d20704e835 Mon Sep 17 00:00:00 2001 From: Justin Gasper Date: Wed, 4 Nov 2026 21:21:25 +1100 Subject: [PATCH 10/13] Refresh deployment suite v2.0.5 and dev review prerequisites --- .circleci/config.yml | 25 +++++++++++++++++++------ deploy/MIGRATION.md | 19 +++++++++++++++---- deploy/dev-healthcheck.json | 14 ++++++++++++++ deploy/dev.json | 19 +++++++++++++++++++ 4 files changed, 67 insertions(+), 10 deletions(-) create mode 100644 deploy/dev-healthcheck.json create mode 100644 deploy/dev.json diff --git a/.circleci/config.yml b/.circleci/config.yml index d1bcee9..f3d4ea0 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -4,22 +4,35 @@ executors: docker: - image: cimg/aws@sha256:4cf3768db00ddf9bc439b8c84e8a60c11a14edf81c8baf76f74132144f8340d5 commands: + checkout-source: + steps: + - run: + name: Check out the exact public source commit over HTTPS + command: | + set -euo pipefail + [[ "$CIRCLE_SHA1" =~ ^[0-9a-f]{40}$ ]] + export GIT_CONFIG_NOSYSTEM=1 GIT_CONFIG_GLOBAL=/dev/null GIT_TERMINAL_PROMPT=0 + git init --quiet . + git remote add origin https://github.com/topcoder-platform/resource-api-v6.git + git -c credential.helper= fetch --quiet --depth 1 origin "$CIRCLE_SHA1" + git checkout --quiet --detach FETCH_HEAD + test "$(git rev-parse HEAD)" = "$CIRCLE_SHA1" checkout-suite: steps: - run: - name: Verify the reviewed deployment suite + name: Verify deployment suite v2.0.5 command: | set -euo pipefail git init --quiet /tmp/tc-deploy-scripts git -C /tmp/tc-deploy-scripts remote add origin https://github.com/topcoder-platform/tc-deploy-scripts.git - git -C /tmp/tc-deploy-scripts fetch --quiet --depth 1 origin bbc9b3d0c702947d26b6d9686d7b29104ebe461a + git -C /tmp/tc-deploy-scripts fetch --quiet --depth 1 origin refs/tags/v2.0.5 git -C /tmp/tc-deploy-scripts checkout --quiet --detach FETCH_HEAD - test "$(git -C /tmp/tc-deploy-scripts rev-parse HEAD)" = bbc9b3d0c702947d26b6d9686d7b29104ebe461a + test "$(git -C /tmp/tc-deploy-scripts rev-parse HEAD)" = bff574ab5c0b46773e25d2af1eff76675fba2ba5 jobs: build: executor: reviewed steps: - - checkout + - checkout-source - setup_remote_docker - checkout-suite - run: @@ -45,7 +58,7 @@ jobs: environment: DEPLOY_ENV: << parameters.environment >> steps: - - checkout + - checkout-source - setup_remote_docker - checkout-suite - attach_workspace: @@ -67,7 +80,7 @@ jobs: LOGICAL_ENV: dev APPNAME: resources-api-v6 steps: - - checkout + - checkout-source - restore_cache: keys: - pnpm-store-v1-{{ checksum "pnpm-lock.yaml" }} diff --git a/deploy/MIGRATION.md b/deploy/MIGRATION.md index e6a7fe3..fada9be 100644 --- a/deploy/MIGRATION.md +++ b/deploy/MIGRATION.md @@ -1,6 +1,6 @@ # OIDC deployment migration -This change replaces the Auth0 credential broker and SSM-to-shell deployment path with the reviewed [shared suite PR #40](https://github.com/topcoder-platform/tc-deploy-scripts/pull/40), pinned to `bbc9b3d0c702947d26b6d9686d7b29104ebe461a`. Build and deployment run in separate jobs. The deployer cannot read Parameter Store, Secrets Manager or decrypt KMS data, including through another assumed role. ECS continues resolving the existing runtime secret references using the execution role. +This change replaces the Auth0 credential broker and SSM-to-shell deployment path with [tc-deploy-scripts v2.0.5](https://github.com/topcoder-platform/tc-deploy-scripts/releases/tag/v2.0.5), fetched by tag and verified against commit `bff574ab5c0b46773e25d2af1eff76675fba2ba5`. Build and deployment run in separate jobs. The deployer cannot read Parameter Store, Secrets Manager or decrypt KMS data, including through another assumed role. ECS continues resolving the existing runtime secret references using the execution role. ## Production target @@ -9,14 +9,19 @@ The read-only inventory on 2026-11-03 verified account `409275337247`, cluster ` ## Infrastructure prerequisites, applied separately by an administrator 1. In each account, register the CircleCI OIDC issuer `https://oidc.circleci.com/org/947bef5e-1669-415d-b83c-4fc85155b7df` with client ID `947bef5e-1669-415d-b83c-4fc85155b7df`. The current production account has only the legacy Auth0 provider. Do not remove that provider until all its consumers have migrated. -2. Review and install [iam/prod-role.cloudformation.json](https://github.com/topcoder-platform/v6-services-iac/blob/main/services/resource-api-v6/deploy/iam/prod-role.cloudformation.json) with an administrator/IaC identity. It creates the proposed deployment role and applies the same least-privilege policy as a permissions boundary. The trust binds this CircleCI project, repository, checkout branch and configuration branch. It does not grant infrastructure creation to CircleCI. -3. Configure ECR repository `resources-api-v6` with unconditional `IMMUTABLE` tags and supported scan-on-push. Existing tags are not retagged. The release fails for MEDIUM/HIGH/CRITICAL/UNDEFINED findings, failed scans, or a mismatched digest. +2. Review and install [iam/prod-role.cloudformation.json](https://github.com/topcoder-platform/v6-services-iac/blob/main/services/resource-api-v6/deploy/iam/prod-role.cloudformation.json) with an administrator/IaC identity. It creates the proposed deployment role and applies the same least-privilege policy as a permissions boundary. The trust binds this CircleCI project, repository, checkout branch and configuration branch. It does not grant infrastructure creation to CircleCI. The role and matching boundary include `inspector2:ListFindings` and `inspector2:ListCoverage` restricted to the deployment region; these scan-metadata APIs require `Resource: "*"`. Secret-access denies remain explicit. +3. Configure ECR repository `resources-api-v6` with unconditional `IMMUTABLE` tags and supported scanning. Preserve existing enhanced scanning where enabled. Existing tags are not retagged. The release fails for MEDIUM/HIGH/CRITICAL/UNDEFINED findings, failed scans, or a mismatched digest. 4. In the infrastructure that owns the task definition, add the reviewed container check from `prod-healthcheck.json`, keeping all roles, runtime secret references, resources, mounts and sidecars. Verify the health endpoint against the running container in dev first. Preserve circuit-breaker rollback and positive desired capacity. Remove any `RESET_DB` secret binding and plaintext secret environment entries before adoption. Keep the execution role's runtime read permissions scoped to the references that service needs. 5. Create restricted `resource-api-v6-dev-deploy` and `resource-api-v6-prod-deploy` CircleCI contexts without Auth0/static AWS credentials. Restrict production to the reviewed `master` checkout and configuration ref, authorized operators, and approval job. Remove legacy credentials from project settings too: removing `org-global` alone does not remove project-level variables. Confirm `CIRCLE_OIDC_TOKEN_V3` is issued. Disable secret access for forks and SSH debugging in deployment jobs. ## Development acceptance before merge/release -The saved dev AWS session had expired during preparation. No dev cluster, role or family has been guessed. **This PR is a draft until an administrator verifies and commits `deploy/dev.json` for account `811668436784` and branch `develop`, with corresponding narrow IAM policy/trust.** Use the same schema as `prod.json`, but inspect the actual dev resources and roles; do not replace just the account number. The dev job fails closed while its manifest is absent. Branches other than `develop` and `master` build only and receive no deployment context. +Read-only inventory on 2026-11-04 verified `dev.json` against the actual development service, task/execution roles and image repositories. This PR targets `develop`. Matching IAM templates and detailed baselines remain private. **Keep this PR in draft until the service-specific prerequisites below are complete.** No AWS or CircleCI resources were provisioned by this refresh. + +- Install the service deployment role and matching permissions boundary. +- Create the restricted empty CircleCI deployment context. +- Set unconditional immutable ECR tags, preserving existing enhanced scanning. +- Review and install the dev container health-check proposal; preserve all other task configuration. Run the shared offline suite, validate the CircleCI config and IAM policies, and test a dev release plus an unhealthy-image rollback. Verify CloudTrail contains no SSM/Secrets Manager calls from the deployment principal. Remove its old broker grants only after migration. Check the runtime secret references and roles stayed unchanged. Production requires the manual approval job and a passing digest/scan/health verification. @@ -29,3 +34,9 @@ The Newman workflow remains available after the dev release and a QA approval. I ## Infrastructure source IAM templates and detailed AWS baselines are maintained in the private [v6-services-iac service directory](https://github.com/topcoder-platform/v6-services-iac/tree/main/services/resource-api-v6). Provision infrastructure separately with an administrator identity; application CI does not fetch that repository or install IAM. Required application manifests and health-check proposals remain here. + +## Dev branch refresh + +This PR targets `develop` and preserves its current application/dependency fixes. The shared suite is v2.0.5 (82 offline tests); service-specific adapters and their tests remain part of review. Keep this PR in draft until its documented infrastructure and integration prerequisites are met. Updating these files does not provision AWS or CircleCI resources. + +Source checkout uses the public HTTPS repository and verifies the exact CircleCI commit, avoiding dependency on failing SSH checkout keys. No GitHub token is added to build or deployment contexts. diff --git a/deploy/dev-healthcheck.json b/deploy/dev-healthcheck.json new file mode 100644 index 0000000..7e0face --- /dev/null +++ b/deploy/dev-healthcheck.json @@ -0,0 +1,14 @@ +{ + "resources-api-v6": { + "command": [ + "CMD", + "node", + "-e", + "const r=require('node:http').get(\"http://127.0.0.1:3000/v6/resources/health\",r=>{r.resume();process.exit(r.statusCode>=200&&r.statusCode<300?0:1)});r.setTimeout(4000,()=>{r.destroy();process.exit(1)});r.on('error',()=>process.exit(1))" + ], + "interval": 30, + "timeout": 5, + "retries": 3, + "startPeriod": 120 + } +} diff --git a/deploy/dev.json b/deploy/dev.json new file mode 100644 index 0000000..7eeadcd --- /dev/null +++ b/deploy/dev.json @@ -0,0 +1,19 @@ +{ + "schemaVersion": 2, + "environment": "dev", + "accountId": "811668436784", + "region": "us-east-1", + "deployRoleArn": "arn:aws:iam::811668436784:role/resource-api-v6-dev-deploy", + "taskRoleArn": "arn:aws:iam::811668436784:role/challenge-v5-container-role", + "executionRoleArn": "arn:aws:iam::811668436784:role/ecsTaskExecutionRole", + "cluster": "tc-challenge-serverless", + "service": "resources-api-v6", + "taskFamily": "resources-api-v6", + "circleciOrgId": "947bef5e-1669-415d-b83c-4fc85155b7df", + "circleciProjectId": "bd210f8f-832b-4cca-b7b5-2f55569f5292", + "repository": "github.com/topcoder-platform/resource-api-v6", + "branch": "develop", + "images": { + "resources-api-v6": "resources-api-v6" + } +} From f9d0ef8596d68f027f57d1784b01b52eb9240fa0 Mon Sep 17 00:00:00 2001 From: Justin Gasper Date: Wed, 4 Nov 2026 21:22:54 +1100 Subject: [PATCH 11/13] Preserve npm link settings without credential-capable build inputs --- deploy/MIGRATION.md | 2 ++ migrator/.npmrc | 1 - migrator/README.md | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) delete mode 100644 migrator/.npmrc diff --git a/deploy/MIGRATION.md b/deploy/MIGRATION.md index fada9be..df013ee 100644 --- a/deploy/MIGRATION.md +++ b/deploy/MIGRATION.md @@ -40,3 +40,5 @@ IAM templates and detailed AWS baselines are maintained in the private [v6-servi This PR targets `develop` and preserves its current application/dependency fixes. The shared suite is v2.0.5 (82 offline tests); service-specific adapters and their tests remain part of review. Keep this PR in draft until its documented infrastructure and integration prerequisites are met. Updating these files does not provision AWS or CircleCI resources. Source checkout uses the public HTTPS repository and verifies the exact CircleCI commit, avoiding dependency on failing SSH checkout keys. No GitHub token is added to build or deployment contexts. + +The credential-free builder rejects committed `.npmrc` files. Preserve the existing local compatibility dependencies with explicit `--install-links=true` npm options instead; do not reintroduce credential-capable npm configuration files. diff --git a/migrator/.npmrc b/migrator/.npmrc deleted file mode 100644 index c7d3517..0000000 --- a/migrator/.npmrc +++ /dev/null @@ -1 +0,0 @@ -install-links=true diff --git a/migrator/README.md b/migrator/README.md index 0aa401f..1d2e527 100644 --- a/migrator/README.md +++ b/migrator/README.md @@ -34,7 +34,7 @@ 1. Clone the repo and install dependencies: ```bash - npm install + npm install --install-links=true ``` 2. Start PostgreSQL with Docker Compose: From 7f4087746ece8a362fe3596a65d67507b78b45e6 Mon Sep 17 00:00:00 2001 From: Justin Gasper Date: Thu, 5 Nov 2026 07:50:59 +1100 Subject: [PATCH 12/13] Record installed dev prerequisites and production cutover readiness --- deploy/MIGRATION.md | 21 ++++++++------------- 1 file changed, 8 insertions(+), 13 deletions(-) diff --git a/deploy/MIGRATION.md b/deploy/MIGRATION.md index df013ee..d7f9860 100644 --- a/deploy/MIGRATION.md +++ b/deploy/MIGRATION.md @@ -6,22 +6,17 @@ This change replaces the Auth0 credential broker and SSM-to-shell deployment pat The read-only inventory on 2026-11-03 verified account `409275337247`, cluster `tc-challenge-serverless`, service `resources-api-v6`, family `resources-api-v6`, and container `resources-api-v6`. `prod.json` preserves the observed task/execution roles and names the proposed service-specific deployment role. [prod-baseline.json](https://github.com/topcoder-platform/v6-services-iac/blob/main/services/resource-api-v6/deploy/prod-baseline.json) records references only; it contains no parameter values. Do not recreate the service or replace its complete task definition from this baseline. -## Infrastructure prerequisites, applied separately by an administrator +## Installed infrastructure and production cutover -1. In each account, register the CircleCI OIDC issuer `https://oidc.circleci.com/org/947bef5e-1669-415d-b83c-4fc85155b7df` with client ID `947bef5e-1669-415d-b83c-4fc85155b7df`. The current production account has only the legacy Auth0 provider. Do not remove that provider until all its consumers have migrated. -2. Review and install [iam/prod-role.cloudformation.json](https://github.com/topcoder-platform/v6-services-iac/blob/main/services/resource-api-v6/deploy/iam/prod-role.cloudformation.json) with an administrator/IaC identity. It creates the proposed deployment role and applies the same least-privilege policy as a permissions boundary. The trust binds this CircleCI project, repository, checkout branch and configuration branch. It does not grant infrastructure creation to CircleCI. The role and matching boundary include `inspector2:ListFindings` and `inspector2:ListCoverage` restricted to the deployment region; these scan-metadata APIs require `Resource: "*"`. Secret-access denies remain explicit. -3. Configure ECR repository `resources-api-v6` with unconditional `IMMUTABLE` tags and supported scanning. Preserve existing enhanced scanning where enabled. Existing tags are not retagged. The release fails for MEDIUM/HIGH/CRITICAL/UNDEFINED findings, failed scans, or a mismatched digest. -4. In the infrastructure that owns the task definition, add the reviewed container check from `prod-healthcheck.json`, keeping all roles, runtime secret references, resources, mounts and sidecars. Verify the health endpoint against the running container in dev first. Preserve circuit-breaker rollback and positive desired capacity. Remove any `RESET_DB` secret binding and plaintext secret environment entries before adoption. Keep the execution role's runtime read permissions scoped to the references that service needs. -5. Create restricted `resource-api-v6-dev-deploy` and `resource-api-v6-prod-deploy` CircleCI contexts without Auth0/static AWS credentials. Restrict production to the reviewed `master` checkout and configuration ref, authorized operators, and approval job. Remove legacy credentials from project settings too: removing `org-global` alone does not remove project-level variables. Confirm `CIRCLE_OIDC_TOKEN_V3` is issued. Disable secret access for forks and SSH debugging in deployment jobs. +The dev deployment role/boundary, restricted empty CircleCI context, and immutable ECR tags are installed. Existing enhanced scanning is preserved. The production OIDC provider, deployment role/boundary and restricted context are also installed; production runtime and ECR changes remain gated on dev validation. Installation evidence and remaining service-specific steps are private in [PROVISIONING.txt](https://github.com/topcoder-platform/v6-services-iac/blob/main/services/resource-api-v6/deploy/PROVISIONING.txt). Deploy roles have explicit secret-store and KMS-decryption denies. Runtime values are retrieved only by ECS using the execution role. -## Development acceptance before merge/release +At production cutover, stop legacy publishers, enable unconditional tag immutability, adopt missing task health checks with the reviewed image, and use the approval-gated `master` workflow. Preserve capacity, roles, secret references and rollback. Do not run production before dev validation. -Read-only inventory on 2026-11-04 verified `dev.json` against the actual development service, task/execution roles and image repositories. This PR targets `develop`. Matching IAM templates and detailed baselines remain private. **Keep this PR in draft until the service-specific prerequisites below are complete.** No AWS or CircleCI resources were provisioned by this refresh. +## Development acceptance -- Install the service deployment role and matching permissions boundary. -- Create the restricted empty CircleCI deployment context. -- Set unconditional immutable ECR tags, preserving existing enhanced scanning. -- Review and install the dev container health-check proposal; preserve all other task configuration. +This PR targets `develop`. Administrator-installed dev prerequisites are recorded in the private IaC repository. The reviewed task health check was submitted only after confirming the existing image serves the identical healthy load-balancer endpoint. + +- Dev infrastructure prerequisites are installed; merge to run the application deployment, then validate functionality. Run the shared offline suite, validate the CircleCI config and IAM policies, and test a dev release plus an unhealthy-image rollback. Verify CloudTrail contains no SSM/Secrets Manager calls from the deployment principal. Remove its old broker grants only after migration. Check the runtime secret references and roles stayed unchanged. Production requires the manual approval job and a passing digest/scan/health verification. @@ -37,7 +32,7 @@ IAM templates and detailed AWS baselines are maintained in the private [v6-servi ## Dev branch refresh -This PR targets `develop` and preserves its current application/dependency fixes. The shared suite is v2.0.5 (82 offline tests); service-specific adapters and their tests remain part of review. Keep this PR in draft until its documented infrastructure and integration prerequisites are met. Updating these files does not provision AWS or CircleCI resources. +This PR targets `develop` and preserves its current application/dependency fixes. The shared suite is v2.0.5 (82 offline tests); service-specific adapters and their tests remain part of review. Use the current readiness record above for the remaining merge/deployment gates. Updating these files does not provision AWS or CircleCI resources. Source checkout uses the public HTTPS repository and verifies the exact CircleCI commit, avoiding dependency on failing SSH checkout keys. No GitHub token is added to build or deployment contexts. From 0311cc3f6d90228cff78c90735fb2fe467e3980a Mon Sep 17 00:00:00 2001 From: Justin Gasper Date: Thu, 5 Nov 2026 08:46:07 +1100 Subject: [PATCH 13/13] Pin deployment suite v2.0.6 and enable reviewed health-check bootstrap --- .circleci/config.yml | 6 +++--- deploy/MIGRATION.md | 8 ++++++-- deploy/release.py | 3 ++- 3 files changed, 11 insertions(+), 6 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index f3d4ea0..e7ef20d 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -20,14 +20,14 @@ commands: checkout-suite: steps: - run: - name: Verify deployment suite v2.0.5 + name: Verify deployment suite v2.0.6 command: | set -euo pipefail git init --quiet /tmp/tc-deploy-scripts git -C /tmp/tc-deploy-scripts remote add origin https://github.com/topcoder-platform/tc-deploy-scripts.git - git -C /tmp/tc-deploy-scripts fetch --quiet --depth 1 origin refs/tags/v2.0.5 + git -C /tmp/tc-deploy-scripts fetch --quiet --depth 1 origin refs/tags/v2.0.6 git -C /tmp/tc-deploy-scripts checkout --quiet --detach FETCH_HEAD - test "$(git -C /tmp/tc-deploy-scripts rev-parse HEAD)" = bff574ab5c0b46773e25d2af1eff76675fba2ba5 + test "$(git -C /tmp/tc-deploy-scripts rev-parse HEAD)" = 26aaf607463d4a271c0099854c1731214215a9c5 jobs: build: executor: reviewed diff --git a/deploy/MIGRATION.md b/deploy/MIGRATION.md index d7f9860..d242d8b 100644 --- a/deploy/MIGRATION.md +++ b/deploy/MIGRATION.md @@ -1,6 +1,6 @@ # OIDC deployment migration -This change replaces the Auth0 credential broker and SSM-to-shell deployment path with [tc-deploy-scripts v2.0.5](https://github.com/topcoder-platform/tc-deploy-scripts/releases/tag/v2.0.5), fetched by tag and verified against commit `bff574ab5c0b46773e25d2af1eff76675fba2ba5`. Build and deployment run in separate jobs. The deployer cannot read Parameter Store, Secrets Manager or decrypt KMS data, including through another assumed role. ECS continues resolving the existing runtime secret references using the execution role. +This change replaces the Auth0 credential broker and SSM-to-shell deployment path with [tc-deploy-scripts v2.0.6](https://github.com/topcoder-platform/tc-deploy-scripts/releases/tag/v2.0.6), fetched by tag and verified against commit `26aaf607463d4a271c0099854c1731214215a9c5`. Build and deployment run in separate jobs. The deployer cannot read Parameter Store, Secrets Manager or decrypt KMS data, including through another assumed role. ECS continues resolving the existing runtime secret references using the execution role. ## Production target @@ -32,8 +32,12 @@ IAM templates and detailed AWS baselines are maintained in the private [v6-servi ## Dev branch refresh -This PR targets `develop` and preserves its current application/dependency fixes. The shared suite is v2.0.5 (82 offline tests); service-specific adapters and their tests remain part of review. Use the current readiness record above for the remaining merge/deployment gates. Updating these files does not provision AWS or CircleCI resources. +This PR targets `develop` and preserves its current application/dependency fixes. The shared suite is v2.0.6 (92 offline tests); service-specific adapters and their tests remain part of review. Use the current readiness record above for the remaining merge/deployment gates. Updating these files does not provision AWS or CircleCI resources. Source checkout uses the public HTTPS repository and verifies the exact CircleCI commit, avoiding dependency on failing SSH checkout keys. No GitHub token is added to build or deployment contexts. The credential-free builder rejects committed `.npmrc` files. Preserve the existing local compatibility dependencies with explicit `--install-links=true` npm options instead; do not reintroduce credential-capable npm configuration files. + +## Reviewed health-check bootstrap + +The release wrapper passes the environment-specific health-check JSON to v2.0.6. A missing check is added with the new scanned image; the old image is not restarted with a new probe. An identical existing check is preserved, and a different existing check stops the release. Role, runtime-secret reference, scan, concurrency and healthy-digest checks remain enforced. diff --git a/deploy/release.py b/deploy/release.py index 05b99da..4aefefa 100644 --- a/deploy/release.py +++ b/deploy/release.py @@ -7,7 +7,8 @@ manifest = Path(sys.argv[1]) data = json.loads(manifest.read_text()) -command = [sys.executable, '-I', '/tmp/tc-deploy-scripts/tcdeploy.py', 'deploy', '--manifest', str(manifest)] +command = [sys.executable, '-I', '/tmp/tc-deploy-scripts/tcdeploy.py', 'deploy', '--manifest', str(manifest), + '--bootstrap-health-checks', str(manifest.with_name(data['environment'] + '-healthcheck.json'))] for container in data['images']: command.extend(['--image', container + '=resource-api-v6:candidate']) subprocess.run(command, check=True)