@discover-cloud/shared 1.2.9 → 1.3.0

package/dist/http/service-client.js

@@ -1,4 +1,10 @@
 "use strict";
+/**
+ * @file service-client.ts
+ * @description HTTP client wrapper for service-to-service communication.
+ * Handles automatic JWT forwarding, request correlation tracking via header propagation,
+ * and automatic retry behaviors on transient failures.
+ */
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
@@ -7,35 +13,15 @@ exports.ServiceClient = void 0;
 const axios_1 = __importDefault(require("axios"));
 const axios_retry_1 = __importDefault(require("axios-retry"));
 /**
- * SERVICE CLIENT  (@discover-cloud/shared)
- * ─────────────────────────────────────────
- * HTTP client for service-to-service communication.
- *
- * Two call patterns:
- *
- * Pattern 1 — JWT-forwarding (user-initiated requests)
- *   Pass the current Express Request — Authorization + x-request-id are
- *   forwarded automatically. Used when the downstream service needs to
- *   act on behalf of the authenticated user.
- *   Methods: getWithAuth, postWithAuth, patchWithAuth, deleteWithAuth
- *
- * Pattern 2 — Internal calls (service-initiated, no incoming request)
- *   Pass explicit headers — used when calls originate from service logic
- *   rather than from an HTTP handler (e.g. auth service → user service
- *   during account creation). Caller is responsible for providing the
- *   X-Internal-Secret header.
- *   Methods: get, post, patch, delete
- *
- * Retry strategy:
- *   - Retries on network errors and 5xx responses only (up to 3 attempts,
- *     exponential backoff). 4xx responses are never retried — they are
- *     deterministic caller errors that won't resolve on retry.
- *
- * Timeout:
- *   - 8 seconds per request (covers retry delays separately via axiosRetry).
- *     Adjust per-call via config.timeout if a specific route needs more.
+ * ServiceClient encapsulates an AxiosInstance configured for service-to-service HTTP requests.
+ * Supports token forwarding (Pattern 1) and secure internal calls (Pattern 2).
  */
 class ServiceClient {
+    /**
+     * Initializes the Axios instance with a base URL, timeout, and retry rules.
+     *
+     * @param {string} baseURL - Downstream service base URL.
+     */
     constructor(baseURL) {
         this.http = axios_1.default.create({
             baseURL,
@@ -45,62 +31,123 @@ class ServiceClient {
             retries: 3,
             retryDelay: axios_retry_1.default.exponentialDelay,
             retryCondition: (err) => {
-                // Retry network-level errors (no response received)
                 if (axios_retry_1.default.isNetworkError(err))
                     return true;
-                // Retry transient server errors; never retry client errors
                 const status = err.response?.status ?? 0;
                 return status >= 500;
             },
         });
     }
-    /* ----------------------------------------------------------------
-       Pattern 1 — JWT-forwarding (pass Express req)
-       Forwards Authorization header + x-request-id automatically.
-       Use for endpoints that require a user identity downstream.
-    ---------------------------------------------------------------- */
+    /* ---------------------------------------------------------------------------
+       Pattern 1 — JWT-forwarding (pass Express Request)
+       Forwards authorization tokens and request correlation IDs automatically.
+    --------------------------------------------------------------------------- */
+    /**
+     * Performs an HTTP GET request while forwarding authorization and request headers.
+     *
+     * @param {string}             url    - Request target endpoint relative path.
+     * @param {Request}            req    - The current Express request object.
+     * @param {AxiosRequestConfig} [config] - Optional request configuration parameters.
+     * @returns {Promise<AxiosResponse<T>>} Axios response promise.
+     */
     async getWithAuth(url, req, config) {
         return this.http.get(url, this.mergeAuth(req, config));
     }
+    /**
+     * Performs an HTTP POST request while forwarding authorization and request headers.
+     *
+     * @param {string}             url    - Request target endpoint relative path.
+     * @param {unknown}            data   - JSON request body data payload.
+     * @param {Request}            req    - The current Express request object.
+     * @param {AxiosRequestConfig} [config] - Optional request configuration parameters.
+     * @returns {Promise<AxiosResponse<T>>} Axios response promise.
+     */
     async postWithAuth(url, data, req, config) {
         return this.http.post(url, data, this.mergeAuth(req, config));
     }
+    /**
+     * Performs an HTTP PATCH request while forwarding authorization and request headers.
+     *
+     * @param {string}             url    - Request target endpoint relative path.
+     * @param {unknown}            data   - JSON request body data payload.
+     * @param {Request}            req    - The current Express request object.
+     * @param {AxiosRequestConfig} [config] - Optional request configuration parameters.
+     * @returns {Promise<AxiosResponse<T>>} Axios response promise.
+     */
     async patchWithAuth(url, data, req, config) {
         return this.http.patch(url, data, this.mergeAuth(req, config));
     }
+    /**
+     * Performs an HTTP DELETE request while forwarding authorization and request headers.
+     *
+     * @param {string}             url    - Request target endpoint relative path.
+     * @param {Request}            req    - The current Express request object.
+     * @param {AxiosRequestConfig} [config] - Optional request configuration parameters.
+     * @returns {Promise<AxiosResponse<T>>} Axios response promise.
+     */
     async deleteWithAuth(url, req, config) {
         return this.http.delete(url, this.mergeAuth(req, config));
     }
-    /* ----------------------------------------------------------------
-       Pattern 2 — Internal calls (explicit headers, no Express req)
-       Used for service-initiated calls where there is no incoming HTTP
-       request to forward from. Caller must supply X-Internal-Secret.
-    ---------------------------------------------------------------- */
+    /* ---------------------------------------------------------------------------
+       Pattern 2 — Internal calls (explicit headers, no Express Request)
+       Used for background tasks or service-initiated operations without a request context.
+    --------------------------------------------------------------------------- */
+    /**
+     * Performs an HTTP GET request with explicit header configurations.
+     *
+     * @param {string}             url     - Request target endpoint relative path.
+     * @param {Record<string, string>} headers - Header keys and values to attach.
+     * @param {AxiosRequestConfig} [config]  - Optional request configuration parameters.
+     * @returns {Promise<AxiosResponse<T>>} Axios response promise.
+     */
     async get(url, headers, config) {
         return this.http.get(url, this.mergeHeaders(headers, config));
     }
+    /**
+     * Performs an HTTP POST request with explicit header configurations.
+     *
+     * @param {string}             url     - Request target endpoint relative path.
+     * @param {unknown}            data    - JSON request body data payload.
+     * @param {Record<string, string>} headers - Header keys and values to attach.
+     * @param {AxiosRequestConfig} [config]  - Optional request configuration parameters.
+     * @returns {Promise<AxiosResponse<T>>} Axios response promise.
+     */
     async post(url, data, headers, config) {
         return this.http.post(url, data, this.mergeHeaders(headers, config));
     }
+    /**
+     * Performs an HTTP PATCH request with explicit header configurations.
+     *
+     * @param {string}             url     - Request target endpoint relative path.
+     * @param {unknown}            data    - JSON request body data payload.
+     * @param {Record<string, string>} headers - Header keys and values to attach.
+     * @param {AxiosRequestConfig} [config]  - Optional request configuration parameters.
+     * @returns {Promise<AxiosResponse<T>>} Axios response promise.
+     */
     async patch(url, data, headers, config) {
         return this.http.patch(url, data, this.mergeHeaders(headers, config));
     }
+    /**
+     * Performs an HTTP DELETE request with explicit header configurations.
+     *
+     * @param {string}             url     - Request target endpoint relative path.
+     * @param {Record<string, string>} headers - Header keys and values to attach.
+     * @param {AxiosRequestConfig} [config]  - Optional request configuration parameters.
+     * @returns {Promise<AxiosResponse<T>>} Axios response promise.
+     */
     async delete(url, headers, config) {
         return this.http.delete(url, this.mergeHeaders(headers, config));
     }
-    /* ----------------------------------------------------------------
-       Private helpers
-    ---------------------------------------------------------------- */
+    /* ---------------------------------------------------------------------------
+       Private Helpers
+    --------------------------------------------------------------------------- */
     /**
-     * mergeAuth
-     * Extracts Authorization and x-request-id from the Express request
-     * and merges them into the Axios config headers.
+     * Extracts authorization credentials and tracing identifiers from Express requests
+     * and merges them into Axios config header values.
      *
-     * x-request-id precedence:
-     *   1. req.id — set by express-request-id or equivalent middleware
-     *   2. x-request-id header forwarded from the upstream caller
-     *   3. Synthetic fallback (timestamp) — should not appear in production
-     *      if request-id middleware is wired correctly in the gateway
+     * @param {Request}            req    - The current Express request.
+     * @param {AxiosRequestConfig} [config] - The existing Axios request configuration.
+     * @returns {AxiosRequestConfig} The merged Axios request configuration.
      */
     mergeAuth(req, config) {
         const authHeader = req.headers.authorization;
@@ -116,9 +163,11 @@ class ServiceClient {
         };
     }
     /**
-     * mergeHeaders
-     * Merges caller-supplied headers into the Axios config.
-     * Caller-supplied headers take precedence over config.headers.
+     * Integrates user-supplied headers into the request configuration object.
+     *
+     * @param {Record<string, string>} headers - The headers to merge.
+     * @param {AxiosRequestConfig} [config]  - The existing Axios request configuration.
+     * @returns {AxiosRequestConfig} The merged Axios request configuration.
      */
     mergeHeaders(headers, config) {
         return {

package/dist/index.d.ts

@@ -7,3 +7,4 @@ export * from "./middleware";
 export * from "./types";
 export * from "./jwt";
 export * from "./http";
+export * from "./messaging";

package/dist/index.js

@@ -23,3 +23,4 @@ __exportStar(require("./middleware"), exports);
 __exportStar(require("./types"), exports);
 __exportStar(require("./jwt"), exports);
 __exportStar(require("./http"), exports);
+__exportStar(require("./messaging"), exports);

package/dist/jwt/index.d.ts

@@ -1,2 +1,3 @@
-export * from "./internal-jwt-verifier";
+export * from "./user-jwt-verifier";
+export * from "./machine-jwt-verifier";
 export * from "./machine-token-client";

package/dist/jwt/index.js

@@ -14,5 +14,6 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./internal-jwt-verifier"), exports);
+__exportStar(require("./user-jwt-verifier"), exports);
+__exportStar(require("./machine-jwt-verifier"), exports);
 __exportStar(require("./machine-token-client"), exports);

package/dist/jwt/machine-jwt-verifier.d.ts

@@ -0,0 +1,21 @@
+/**
+ * @file machine-jwt-verifier.ts
+ * @description Verifies service-to-service RS256 machine JWTs issued by auth-service.
+ */
+import { MachineTokenPayload } from "../types";
+/**
+ * Verifies auth-service issued machine tokens used for service-to-service calls.
+ */
+export declare class MachineJwtVerifier {
+    private readonly jwks;
+    private readonly issuer;
+    private readonly audience;
+    constructor(authServiceJwksUri?: string);
+    /**
+     * Verify machine JWT signature and claims.
+     *
+     * @param {string} token - Raw bearer machine token.
+     * @returns {Promise<MachineTokenPayload>} Verified machine payload.
+     */
+    verify(token: string): Promise<MachineTokenPayload>;
+}

package/dist/jwt/machine-jwt-verifier.js

@@ -0,0 +1,84 @@
+"use strict";
+/**
+ * @file machine-jwt-verifier.ts
+ * @description Verifies service-to-service RS256 machine JWTs issued by auth-service.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MachineJwtVerifier = void 0;
+const jose = __importStar(require("jose"));
+const CLOCK_TOLERANCE_SECONDS = 30;
+const JWKS_CACHE_MAX_AGE_MS = 10 * 60 * 1000;
+const JWKS_FETCH_TIMEOUT_MS = 5000;
+/**
+ * Verifies auth-service issued machine tokens used for service-to-service calls.
+ */
+class MachineJwtVerifier {
+    constructor(authServiceJwksUri) {
+        const jwksUri = authServiceJwksUri ??
+            process.env.AUTH_JWKS_URI ??
+            "http://auth-service:3001/.well-known/jwks.json";
+        this.issuer = process.env.MACHINE_JWT_ISSUER ?? "discover-cloud:auth-service";
+        this.audience = process.env.MACHINE_JWT_AUDIENCE ?? "discover-cloud:services";
+        this.jwks = jose.createRemoteJWKSet(new URL(jwksUri), {
+            cacheMaxAge: JWKS_CACHE_MAX_AGE_MS,
+            timeoutDuration: JWKS_FETCH_TIMEOUT_MS,
+        });
+    }
+    /**
+     * Verify machine JWT signature and claims.
+     *
+     * @param {string} token - Raw bearer machine token.
+     * @returns {Promise<MachineTokenPayload>} Verified machine payload.
+     */
+    async verify(token) {
+        const { payload } = await jose.jwtVerify(token, this.jwks, {
+            issuer: this.issuer,
+            audience: this.audience,
+            algorithms: ["RS256"],
+            clockTolerance: CLOCK_TOLERANCE_SECONDS,
+        });
+        if (payload.typ !== "machine") {
+            throw new jose.errors.JWTClaimValidationFailed(`Token type mismatch: expected "machine", got "${String(payload.typ)}"`, payload, "typ", "check_failed");
+        }
+        if (typeof payload.serviceId !== "string" ||
+            typeof payload.jti !== "string" ||
+            !Array.isArray(payload.scopes)) {
+            throw new jose.errors.JWTClaimValidationFailed("Missing required machine token claims", payload, "payload", "missing");
+        }
+        return payload;
+    }
+}
+exports.MachineJwtVerifier = MachineJwtVerifier;

package/dist/jwt/machine-token-client.d.ts

@@ -1,13 +1,44 @@
+/**
+ * @file machine-token-client.ts
+ * @description HTTP client for fetching and caching short-lived machine JWTs
+ * from the Auth Service for service-to-service communication.
+ */
 import { ILogger } from "../utils";
+/**
+ * Handles retrieving and caching auth-service issued machine JWTs.
+ */
 export declare class MachineTokenClient {
-    private readonly gatewayUrl;
+    private readonly authServiceUrl;
     private readonly serviceId;
-    private readonly internalSecret?;
+    private readonly serviceSecret;
     private readonly logger;
     private cache;
     private fetchPromise;
-    constructor(gatewayUrl: string, serviceId: string, internalSecret?: string | undefined, logger?: ILogger);
+    /**
+     * @param {string}  authServiceUrl - Base URL of the Auth Service.
+     * @param {string}  serviceId      - The service ID identifying the calling microservice.
+     * @param {string}  serviceSecret  - Service-specific secret for authentication.
+     * @param {ILogger} [logger]       - Optional logger instance.
+     */
+    constructor(authServiceUrl: string, serviceId: string, serviceSecret: string, logger?: ILogger);
+    /**
+     * Returns a valid machine JWT.
+     *
+     * @param {string} [requestId] - Request ID for distributed tracing.
+     * @returns {Promise<string>} The machine JWT token string.
+     */
     getToken(requestId?: string): Promise<string>;
-    private getValidCachedToken;
+    /**
+     * Gets the cached token if it exists and is not within the refresh buffer window.
+     *
+     * @returns {CachedToken | null} The cached token, or null if invalid/expired.
+     */
+    private getCachedToken;
+    /**
+     * Performs the HTTP request to the Auth Service to retrieve a machine token.
+     *
+     * @param {string} [requestId] - Request ID for tracing.
+     * @returns {Promise<string>} The freshly issued machine token.
+     */
     private fetchToken;
 }

package/dist/jwt/machine-token-client.js

@@ -1,21 +1,41 @@
 "use strict";
+/**
+ * @file machine-token-client.ts
+ * @description HTTP client for fetching and caching short-lived machine JWTs
+ * from the Auth Service for service-to-service communication.
+ */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MachineTokenClient = void 0;
 const utils_1 = require("../utils");
-const REFRESH_BUFFER_S = 10;
+const REFRESH_BUFFER_SECONDS = 60;
+/**
+ * Handles retrieving and caching auth-service issued machine JWTs.
+ */
 class MachineTokenClient {
-    constructor(gatewayUrl, serviceId, internalSecret, logger = utils_1.noopLogger) {
-        this.gatewayUrl = gatewayUrl;
+    /**
+     * @param {string}  authServiceUrl - Base URL of the Auth Service.
+     * @param {string}  serviceId      - The service ID identifying the calling microservice.
+     * @param {string}  serviceSecret  - Service-specific secret for authentication.
+     * @param {ILogger} [logger]       - Optional logger instance.
+     */
+    constructor(authServiceUrl, serviceId, serviceSecret, logger = utils_1.noopLogger) {
+        this.authServiceUrl = authServiceUrl;
         this.serviceId = serviceId;
-        this.internalSecret = internalSecret;
+        this.serviceSecret = serviceSecret;
         this.logger = logger;
         this.cache = null;
         this.fetchPromise = null;
     }
+    /**
+     * Returns a valid machine JWT.
+     *
+     * @param {string} [requestId] - Request ID for distributed tracing.
+     * @returns {Promise<string>} The machine JWT token string.
+     */
     async getToken(requestId) {
-        const cachedToken = this.getValidCachedToken();
-        if (cachedToken) {
-            return cachedToken.token;
+        const cached = this.getCachedToken();
+        if (cached) {
+            return cached.token;
         }
         if (!this.fetchPromise) {
             this.fetchPromise = this.fetchToken(requestId).finally(() => {
@@ -24,44 +44,58 @@ class MachineTokenClient {
         }
         return this.fetchPromise;
     }
-    getValidCachedToken() {
+    /**
+     * Gets the cached token if it exists and is not within the refresh buffer window.
+     *
+     * @returns {CachedToken | null} The cached token, or null if invalid/expired.
+     */
+    getCachedToken() {
         if (!this.cache) {
             return null;
         }
-        const nowS = Math.floor(Date.now() / 1000);
-        if (this.cache.expiresAt - REFRESH_BUFFER_S <= nowS) {
+        const now = Math.floor(Date.now() / 1000);
+        if (this.cache.expiresAt - REFRESH_BUFFER_SECONDS <= now) {
             return null;
         }
         return this.cache;
     }
+    /**
+     * Performs the HTTP request to the Auth Service to retrieve a machine token.
+     *
+     * @param {string} [requestId] - Request ID for tracing.
+     * @returns {Promise<string>} The freshly issued machine token.
+     */
     async fetchToken(requestId) {
-        const url = `${this.gatewayUrl}/internal/machine-token`;
+        const url = `${this.authServiceUrl.replace(/\/$/, "")}/internal/machine-token`;
         this.logger.debug({ serviceId: this.serviceId, requestId }, "Fetching machine token");
-        const headers = {
-            "content-type": "application/json",
-        };
-        if (this.internalSecret) {
-            headers["x-internal-secret"] = this.internalSecret;
-        }
         const response = await fetch(url, {
             method: "POST",
-            headers,
+            headers: {
+                "content-type": "application/json",
+            },
             body: JSON.stringify({
                 serviceId: this.serviceId,
+                secret: this.serviceSecret,
                 requestId,
             }),
         });
         if (!response.ok) {
             const text = await response.text().catch(() => "(unreadable)");
-            throw new Error(`MachineTokenClient: gateway returned ${response.status} fetching machine token: ${text}`);
+            throw new Error(`Machine token request failed (${response.status}): ${text}`);
         }
         const body = (await response.json());
-        const nowS = Math.floor(Date.now() / 1000);
+        if (!body.success ||
+            !body.data?.accessToken ||
+            typeof body.data.expiresIn !== "number" ||
+            body.data.expiresIn <= 0) {
+            throw new Error("Invalid machine token response");
+        }
+        const now = Math.floor(Date.now() / 1000);
         this.cache = {
-            token: body.data.token,
-            expiresAt: nowS + body.data.expiresIn,
+            token: body.data.accessToken,
+            expiresAt: now + body.data.expiresIn,
         };
-        this.logger.info({
+        this.logger.debug({
             serviceId: this.serviceId,
             expiresAt: this.cache.expiresAt,
         }, "Machine token cached");

package/dist/jwt/user-jwt-verifier.d.ts

@@ -0,0 +1,31 @@
+/**
+ * @file user-jwt-verifier.ts
+ * @description Verifies user RS256 access tokens issued by auth-service.
+ */
+import { AccessTokenPayload, UserContext } from "../types";
+/**
+ * Verifies auth-service issued user access tokens.
+ */
+export declare class UserJwtVerifier {
+    private readonly jwks;
+    private readonly issuer;
+    private readonly audience;
+    constructor();
+    /**
+     * Verify JWT signature and required user claims.
+     *
+     * @param {string} token - Raw bearer access token.
+     * @returns {Promise<AccessTokenPayload>} Verified access payload.
+     */
+    verify(token: string): Promise<AccessTokenPayload>;
+    /**
+     * Builds request authorization context.
+     *
+     * @param {string} token - Raw bearer access token.
+     * @returns {Promise<{ payload: AccessTokenPayload; context: UserContext }>} The auth context block.
+     */
+    buildAccessContext(token: string): Promise<{
+        payload: AccessTokenPayload;
+        context: UserContext;
+    }>;
+}

package/dist/jwt/user-jwt-verifier.js

@@ -0,0 +1,101 @@
+"use strict";
+/**
+ * @file user-jwt-verifier.ts
+ * @description Verifies user RS256 access tokens issued by auth-service.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserJwtVerifier = void 0;
+const jose = __importStar(require("jose"));
+const CLOCK_TOLERANCE_SECONDS = 30;
+const JWKS_CACHE_MAX_AGE_MS = 10 * 60 * 1000;
+const JWKS_FETCH_TIMEOUT_MS = 5000;
+/**
+ * Verifies auth-service issued user access tokens.
+ */
+class UserJwtVerifier {
+    constructor() {
+        const authJwksUri = process.env.AUTH_JWKS_URI ?? "http://auth-service:3001/.well-known/jwks.json";
+        this.issuer = process.env.EXTERNAL_JWT_ISSUER ?? "discover-cloud:auth-service";
+        this.audience = process.env.EXTERNAL_JWT_AUDIENCE ?? "discover-cloud:api";
+        this.jwks = jose.createRemoteJWKSet(new URL(authJwksUri), {
+            cacheMaxAge: JWKS_CACHE_MAX_AGE_MS,
+            timeoutDuration: JWKS_FETCH_TIMEOUT_MS,
+        });
+    }
+    /**
+     * Verify JWT signature and required user claims.
+     *
+     * @param {string} token - Raw bearer access token.
+     * @returns {Promise<AccessTokenPayload>} Verified access payload.
+     */
+    async verify(token) {
+        const { payload } = await jose.jwtVerify(token, this.jwks, {
+            issuer: this.issuer,
+            audience: this.audience,
+            algorithms: ["RS256"],
+            clockTolerance: CLOCK_TOLERANCE_SECONDS,
+        });
+        if (payload.typ !== "access") {
+            throw new jose.errors.JWTClaimValidationFailed(`Token type mismatch: expected "access", got "${String(payload.typ)}"`, payload, "typ", "check_failed");
+        }
+        if (typeof payload.accountId !== "string" ||
+            typeof payload.sessionId !== "string" ||
+            typeof payload.jti !== "string" ||
+            typeof payload.iat !== "number" ||
+            typeof payload.exp !== "number") {
+            throw new jose.errors.JWTClaimValidationFailed("Missing required access token claims", payload, "payload", "missing");
+        }
+        return payload;
+    }
+    /**
+     * Builds request authorization context.
+     *
+     * @param {string} token - Raw bearer access token.
+     * @returns {Promise<{ payload: AccessTokenPayload; context: UserContext }>} The auth context block.
+     */
+    async buildAccessContext(token) {
+        const payload = await this.verify(token);
+        return {
+            payload,
+            context: {
+                type: "user",
+                accountId: payload.accountId,
+                sessionId: payload.sessionId,
+            },
+        };
+    }
+}
+exports.UserJwtVerifier = UserJwtVerifier;

package/dist/messaging/index.d.ts

@@ -0,0 +1 @@
+export * from './rabbitmq.client';

package/dist/{security → messaging}/index.js

@@ -14,4 +14,4 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./guard"), exports);
+__exportStar(require("./rabbitmq.client"), exports);