Browse capabilities by evidence.

HMAC Webhook Signature Verifier

Verifies raw-body HMAC webhook signatures with constant-time comparison, timestamp tolerance, and rotation-safe key selection.

TypeScript · node-service · aws-lambda · vercel · 99% coverage

Composes with 2 declared catalog connections · fixture declared

Evidence-led browse order uses maintenance, critical findings, verification records, security posture, and test coverage. No request-fit score is inferred.

Exponential Backoff Policy Kit

Calculates bounded exponential retry schedules with deterministic jitter, retry budgets, and explicit terminal decisions.

TypeScript · node-service · aws-lambda · container · 100% coverage

Composes with 2 declared catalog connections · fixture declared

Evidence-led browse order uses maintenance, critical findings, verification records, security posture, and test coverage. No request-fit score is inferred.

JSON PII Field Redactor

Redacts declared sensitive JSON paths without changing payload shape and emits an inspectable field-level action report.

TypeScript · node-service · aws-lambda · vercel · 100% coverage

Composes with 3 declared catalog connections · fixture declared

Evidence-led browse order uses maintenance, critical findings, verification records, security posture, and test coverage. No request-fit score is inferred.

Tenant Context Propagation Guard

Carries validated tenant context across HTTP, queues, and background jobs while rejecting missing or conflicting identities.

TypeScript · node-service · aws-lambda · container · 98% coverage

Composes with 2 declared catalog connections · fixture declared

Evidence-led browse order uses maintenance, critical findings, verification records, security posture, and test coverage. No request-fit score is inferred.

Idempotency Key Guard

Rejects conflicting request replays and safely returns prior outcomes using canonical fingerprints and bounded retention policies.

TypeScript · node-service · aws-lambda · 99% coverage

Composes with 3 declared catalog connections · fixture declared

Evidence-led browse order uses maintenance, critical findings, verification records, security posture, and test coverage. No request-fit score is inferred.

Audit Hash-Chain Ledger

Appends canonical audit records to tenant-scoped hash chains and verifies continuity without prescribing storage retention.

TypeScript · node-service · container · 98% coverage

Composes with 3 declared catalog connections · fixture declared

Evidence-led browse order uses maintenance, critical findings, verification records, security posture, and test coverage. No request-fit score is inferred.

PII Detection and Redaction Pipeline

Detects and redacts sensitive identifiers across text, JSON, PDF, and document images with explainable findings.

TypeScript · aws-lambda · container · kubernetes · 98% coverage

Composes with 3 declared catalog connections · fixture declared

Evidence-led browse order uses maintenance, critical findings, verification records, security posture, and test coverage. No request-fit score is inferred.

Upload MIME and Magic-Byte Validator

Rejects upload type confusion by comparing declared MIME types, extensions, and bounded magic-byte signatures.

TypeScript · node-service · aws-lambda · vercel · 97% coverage

Composes with 2 declared catalog connections · fixture declared

Evidence-led browse order uses maintenance, critical findings, verification records, security posture, and test coverage. No request-fit score is inferred.

Bank Statement Transaction Normalizer

Extracts normalized transactions from bank-statement PDFs with optional PII redaction and reconciliation metadata.

TypeScript · aws-lambda · container · node-service · 96% coverage

Composes with 3 declared catalog connections · fixture declared

Evidence-led browse order uses maintenance, critical findings, verification records, security posture, and test coverage. No request-fit score is inferred.

PDF Table Boundary Detector

Locates candidate table regions and row boundaries in native and scanned PDFs without assigning domain-specific fields.

Python · container · aws-lambda · 94% coverage

Composes with 2 declared catalog connections · fixture declared

Evidence-led browse order uses maintenance, critical findings, verification records, security posture, and test coverage. No request-fit score is inferred.

Multi-Tenant Authorization Middleware

Enforces tenant-scoped RBAC and ABAC policies for API and background-job boundaries with denial-by-default behavior.

TypeScript · node-service · aws-lambda · container · 99% coverage

Composes with 2 declared catalog connections · fixture declared

Evidence-led browse order uses maintenance, critical findings, verification records, security posture, and test coverage. No request-fit score is inferred.

Subscription Billing State Machine

Implements auditable subscription, trial, grace-period, cancellation, and entitlement transitions independent of a processor.

TypeScript · node-service · container · 97% coverage

Composes with 3 declared catalog connections · fixture declared

Evidence-led browse order uses maintenance, critical findings, verification records, security posture, and test coverage. No request-fit score is inferred.

Audit Log Event Pipeline

Captures immutable-style security events with integrity chains, tenant isolation, retention rules, and export formats.

TypeScript · container · kubernetes · 94% coverage

Composes with 3 declared catalog connections · fixture declared

Evidence-led browse order uses maintenance, critical findings, verification records, security posture, and test coverage. No request-fit score is inferred.

PDF Invoice Extraction Service

Converts vendor invoices and scanned PDFs into validated invoice, line-item, tax, and payment-term records.

Python · container · aws-lambda · 93% coverage

Composes with 3 declared catalog connections · fixture declared

Evidence-led browse order uses maintenance, critical findings, verification records, security posture, and test coverage. No request-fit score is inferred.

Webhook Retry and Dead-Letter Worker

Delivers signed webhooks with idempotency, configurable backoff, observability, replay, and dead-letter handling.

TypeScript · container · aws-lambda · 95% coverage

Composes with 3 declared catalog connections · fixture declared

Evidence-led browse order uses maintenance, critical findings, verification records, security posture, and test coverage. No request-fit score is inferred.

File Malware-Scanning Gateway

Quarantines uploads, verifies content types, scans files, and releases clean objects through a digest-bound workflow.

TypeScript · container · kubernetes · 91% coverage

Composes with 2 declared catalog connections · fixture declared

Evidence-led browse order uses maintenance, critical findings, verification records, security posture, and test coverage. No request-fit score is inferred.

Address Standardization and Validation Module

Normalizes postal addresses, validates deliverability signals, and returns structured components without retaining inputs.

TypeScript · aws-lambda · node-service · 92% coverage

Evidence-led browse order uses maintenance, critical findings, verification records, security posture, and test coverage. No request-fit score is inferred.

Document Deduplication Engine

Finds exact and near-duplicate documents using content fingerprints and privacy-preserving similarity signatures.

Python · container · kubernetes · 88% coverage

Evidence-led browse order uses maintenance, critical findings, verification records, security posture, and test coverage. No request-fit score is inferred.

Email Attachment Classification Service

Classifies inbound email attachments by document purpose, sensitivity, sender context, and required processing route.

Python · aws-lambda · container · 86% coverage

Composes with 2 declared catalog connections · fixture declared

Evidence-led browse order uses maintenance, critical findings, verification records, security posture, and test coverage. No request-fit score is inferred.

OAuth Provider Integration Pack

Adds tested OAuth and OIDC provider adapters with state validation, PKCE, token rotation, and account linking.

TypeScript · node-service · aws-lambda · vercel · 82% coverage

Evidence-led browse order uses maintenance, critical findings, verification records, security posture, and test coverage. No request-fit score is inferred.