@entifix/service-shell 0.4.2 → 0.6.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@entifix/service-shell",
-  "version": "0.4.2",
+  "version": "0.6.0",
   "description": "Effect HTTP service skeleton: server layer, health and metadata routes, permission guards, remote configuration and OpenTelemetry.",
   "license": "MIT",
   "repository": {
@@ -26,6 +26,21 @@
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js",
       "default": "./dist/index.js"
+    },
+    "./runtime": {
+      "types": "./dist/runtime.d.ts",
+      "import": "./dist/runtime.js",
+      "default": "./dist/runtime.js"
+    },
+    "./observability": {
+      "types": "./dist/observability.d.ts",
+      "import": "./dist/observability.js",
+      "default": "./dist/observability.js"
+    },
+    "./testing": {
+      "types": "./dist/testing.d.ts",
+      "import": "./dist/testing.js",
+      "default": "./dist/testing.js"
     }
   },
   "nx": {
@@ -50,26 +65,59 @@
     }
   },
   "dependencies": {
+    "@swc/helpers": "0.5.23",
+    "@entifix/business": "0.6.0",
+    "@entifix/core": "0.6.0",
+    "@entifix/tooling": "0.6.0",
+    "@entifix/authz": "0.6.0"
+  },
+  "devDependencies": {
     "@effect/opentelemetry": "4.0.5",
     "@effect/platform-node": "4.0.5",
+    "@opentelemetry/api": "1.9.1",
     "@opentelemetry/context-async-hooks": "2.12.0",
     "@opentelemetry/exporter-metrics-otlp-http": "0.223.0",
     "@opentelemetry/exporter-trace-otlp-http": "0.223.0",
     "@opentelemetry/sdk-metrics": "2.12.0",
     "@opentelemetry/sdk-trace-base": "2.12.0",
-    "@swc/helpers": "0.5.23",
-    "@entifix/authz": "0.4.2",
-    "@entifix/business": "0.4.2",
-    "@entifix/core": "0.4.2",
-    "@entifix/tooling": "0.4.2"
-  },
-  "devDependencies": {
-    "@opentelemetry/api": "1.9.1",
     "effect": "4.0.5",
-    "@entifix/testing-unit": "0.4.2"
+    "@entifix/testing-unit": "0.6.0"
   },
   "peerDependencies": {
+    "@effect/opentelemetry": "^4.0.5",
+    "@effect/platform-node": "^4.0.5",
     "@opentelemetry/api": ">=1.9 <2",
+    "@opentelemetry/context-async-hooks": ">=2.12 <3",
+    "@opentelemetry/exporter-metrics-otlp-http": ">=0.223 <0.224",
+    "@opentelemetry/exporter-trace-otlp-http": ">=0.223 <0.224",
+    "@opentelemetry/sdk-metrics": ">=2.12 <3",
+    "@opentelemetry/sdk-trace-base": ">=2.12 <3",
     "effect": "^4.0.5"
+  },
+  "peerDependenciesMeta": {
+    "@effect/opentelemetry": {
+      "optional": true
+    },
+    "@effect/platform-node": {
+      "optional": true
+    },
+    "@opentelemetry/api": {
+      "optional": true
+    },
+    "@opentelemetry/context-async-hooks": {
+      "optional": true
+    },
+    "@opentelemetry/exporter-metrics-otlp-http": {
+      "optional": true
+    },
+    "@opentelemetry/exporter-trace-otlp-http": {
+      "optional": true
+    },
+    "@opentelemetry/sdk-metrics": {
+      "optional": true
+    },
+    "@opentelemetry/sdk-trace-base": {
+      "optional": true
+    }
   }
 }

package/dist/auth/service-token.d.ts

@@ -1,37 +0,0 @@
-import { Effect } from 'effect';
-import { HttpServerRequest, HttpServerResponse } from 'effect/http';
-/** The header a caller of config-service's fleet lookup presents. */
-export declare const SERVICE_TOKEN_HEADER = "x-service-token";
-/**
- * Local-dev default, so `pnpm run back-office:dev` stays zero-config. Same
- * convention as the seeded `jwt.secret`: obviously a placeholder, replaced per
- * environment through `CONFIG_SERVICE_TOKEN`.
- */
-export declare const DEV_SERVICE_TOKEN = "dev-config-service-token-change-me";
-/**
- * The expected token, read from the environment on each call rather than captured
- * at module load — so a test can set it without re-importing the module.
- */
-export declare const serviceToken: () => string;
-/**
- * Guards config-service's fleet configuration lookup.
- *
- * `GET /api/config/:service` hands out `jwt.secret`, `mongo.uri`, `redis.uri` and
- * `rabbitmq.uri` in plaintext, because that is exactly what a booting service
- * needs — the values cannot be redacted here without breaking the boot the route
- * exists to serve. So the route is gated on a shared token instead, which closes
- * the drive-by read that being merely "cluster-internal" did not.
- *
- * This is deliberately **not** service identity: every caller presents the same
- * token, so it proves fleet membership and nothing more. Per-service credentials,
- * with the response scoped to the service that asked, are separate work; this is
- * the cheap step that stops the port from being self-serve.
- *
- * It lives here beside {@link loadRemoteConfiguration}, the client half of the
- * same protocol, so the header and the token cannot drift apart.
- *
- * Health endpoints are **not** guarded — a probe must answer without credentials,
- * or a readiness check becomes an authentication problem.
- */
-export declare const requireServiceToken: <A, E, R>(route: Effect.Effect<A, E, R>) => Effect.Effect<HttpServerResponse.HttpServerResponse | A, import("effect/http/HttpBody").HttpBodyError | E, HttpServerRequest.HttpServerRequest | R>;
-//# sourceMappingURL=service-token.d.ts.map

package/dist/auth/service-token.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"service-token.d.ts","sourceRoot":"","sources":["../../src/auth/service-token.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEpE,qEAAqE;AACrE,eAAO,MAAM,oBAAoB,oBAAoB,CAAC;AAEtD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,uCAAuC,CAAC;AAEtE;;;GAGG;AACH,eAAO,MAAM,YAAY,QAAO,MACuB,CAAC;AAYxD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,mBAAmB,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,wJAiBtE,CAAC"}

package/dist/auth/service-token.js

@@ -1,62 +0,0 @@
-import { timingSafeEqual } from 'node:crypto';
-import { Effect } from 'effect';
-import { HttpServerRequest, HttpServerResponse } from 'effect/http';
-/** The header a caller of config-service's fleet lookup presents. */ export const SERVICE_TOKEN_HEADER = 'x-service-token';
-/**
- * Local-dev default, so `pnpm run back-office:dev` stays zero-config. Same
- * convention as the seeded `jwt.secret`: obviously a placeholder, replaced per
- * environment through `CONFIG_SERVICE_TOKEN`.
- */ export const DEV_SERVICE_TOKEN = 'dev-config-service-token-change-me';
-/**
- * The expected token, read from the environment on each call rather than captured
- * at module load — so a test can set it without re-importing the module.
- */ export const serviceToken = ()=>{
-    var _process_env_CONFIG_SERVICE_TOKEN;
-    return (_process_env_CONFIG_SERVICE_TOKEN = process.env.CONFIG_SERVICE_TOKEN) != null ? _process_env_CONFIG_SERVICE_TOKEN : DEV_SERVICE_TOKEN;
-};
-/** Constant-time comparison, so the token cannot be recovered byte by byte. */ const matches = (provided)=>{
-    if (provided === undefined) return false;
-    const left = Buffer.from(provided);
-    const right = Buffer.from(serviceToken());
-    // `timingSafeEqual` throws on a length mismatch, so the lengths are compared
-    // first — the length of a shared secret is not what protects it.
-    return left.length === right.length && timingSafeEqual(left, right);
-};
-/**
- * Guards config-service's fleet configuration lookup.
- *
- * `GET /api/config/:service` hands out `jwt.secret`, `mongo.uri`, `redis.uri` and
- * `rabbitmq.uri` in plaintext, because that is exactly what a booting service
- * needs — the values cannot be redacted here without breaking the boot the route
- * exists to serve. So the route is gated on a shared token instead, which closes
- * the drive-by read that being merely "cluster-internal" did not.
- *
- * This is deliberately **not** service identity: every caller presents the same
- * token, so it proves fleet membership and nothing more. Per-service credentials,
- * with the response scoped to the service that asked, are separate work; this is
- * the cheap step that stops the port from being self-serve.
- *
- * It lives here beside {@link loadRemoteConfiguration}, the client half of the
- * same protocol, so the header and the token cannot drift apart.
- *
- * Health endpoints are **not** guarded — a probe must answer without credentials,
- * or a readiness check becomes an authentication problem.
- */ export const requireServiceToken = (route)=>// The return type is inferred rather than written out: `HttpServerResponse.json`
-    // contributes an `HttpBodyError` to the failure channel, and spelling the type
-    // out while omitting it is what makes `tsc` refuse the declaration emit — which
-    // `@nx/js:swc` hides, leaving a green build with no `.d.ts` and a TS6305
-    // cascade in every consumer. `requirePrincipal` infers for the same reason.
-    Effect.gen(function*() {
-        const request = yield* HttpServerRequest.HttpServerRequest;
-        if (!matches(request.headers[SERVICE_TOKEN_HEADER])) {
-            return yield* HttpServerResponse.json({
-                error: 'unauthenticated',
-                code: 'unauthenticated'
-            }, {
-                status: 401
-            });
-        }
-        return yield* route;
-    });
-
-//# sourceMappingURL=service-token.js.map

package/dist/auth/service-token.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/auth/service-token.ts"],"sourcesContent":["import { timingSafeEqual } from 'node:crypto';\n\nimport { Effect } from 'effect';\nimport { HttpServerRequest, HttpServerResponse } from 'effect/http';\n\n/** The header a caller of config-service's fleet lookup presents. */\nexport const SERVICE_TOKEN_HEADER = 'x-service-token';\n\n/**\n * Local-dev default, so `pnpm run back-office:dev` stays zero-config. Same\n * convention as the seeded `jwt.secret`: obviously a placeholder, replaced per\n * environment through `CONFIG_SERVICE_TOKEN`.\n */\nexport const DEV_SERVICE_TOKEN = 'dev-config-service-token-change-me';\n\n/**\n * The expected token, read from the environment on each call rather than captured\n * at module load — so a test can set it without re-importing the module.\n */\nexport const serviceToken = (): string =>\n  process.env.CONFIG_SERVICE_TOKEN ?? DEV_SERVICE_TOKEN;\n\n/** Constant-time comparison, so the token cannot be recovered byte by byte. */\nconst matches = (provided: string | undefined): boolean => {\n  if (provided === undefined) return false;\n  const left = Buffer.from(provided);\n  const right = Buffer.from(serviceToken());\n  // `timingSafeEqual` throws on a length mismatch, so the lengths are compared\n  // first — the length of a shared secret is not what protects it.\n  return left.length === right.length && timingSafeEqual(left, right);\n};\n\n/**\n * Guards config-service's fleet configuration lookup.\n *\n * `GET /api/config/:service` hands out `jwt.secret`, `mongo.uri`, `redis.uri` and\n * `rabbitmq.uri` in plaintext, because that is exactly what a booting service\n * needs — the values cannot be redacted here without breaking the boot the route\n * exists to serve. So the route is gated on a shared token instead, which closes\n * the drive-by read that being merely \"cluster-internal\" did not.\n *\n * This is deliberately **not** service identity: every caller presents the same\n * token, so it proves fleet membership and nothing more. Per-service credentials,\n * with the response scoped to the service that asked, are separate work; this is\n * the cheap step that stops the port from being self-serve.\n *\n * It lives here beside {@link loadRemoteConfiguration}, the client half of the\n * same protocol, so the header and the token cannot drift apart.\n *\n * Health endpoints are **not** guarded — a probe must answer without credentials,\n * or a readiness check becomes an authentication problem.\n */\nexport const requireServiceToken = <A, E, R>(route: Effect.Effect<A, E, R>) =>\n  // The return type is inferred rather than written out: `HttpServerResponse.json`\n  // contributes an `HttpBodyError` to the failure channel, and spelling the type\n  // out while omitting it is what makes `tsc` refuse the declaration emit — which\n  // `@nx/js:swc` hides, leaving a green build with no `.d.ts` and a TS6305\n  // cascade in every consumer. `requirePrincipal` infers for the same reason.\n  Effect.gen(function* () {\n    const request = yield* HttpServerRequest.HttpServerRequest;\n\n    if (!matches(request.headers[SERVICE_TOKEN_HEADER])) {\n      return yield* HttpServerResponse.json(\n        { error: 'unauthenticated', code: 'unauthenticated' },\n        { status: 401 },\n      );\n    }\n\n    return yield* route;\n  });\n"],"names":["timingSafeEqual","Effect","HttpServerRequest","HttpServerResponse","SERVICE_TOKEN_HEADER","DEV_SERVICE_TOKEN","serviceToken","process","env","CONFIG_SERVICE_TOKEN","matches","provided","undefined","left","Buffer","from","right","length","requireServiceToken","route","gen","request","headers","json","error","code","status"],"mappings":"AAAA,SAASA,eAAe,QAAQ,cAAc;AAE9C,SAASC,MAAM,QAAQ,SAAS;AAChC,SAASC,iBAAiB,EAAEC,kBAAkB,QAAQ,cAAc;AAEpE,mEAAmE,GACnE,OAAO,MAAMC,uBAAuB,kBAAkB;AAEtD;;;;CAIC,GACD,OAAO,MAAMC,oBAAoB,qCAAqC;AAEtE;;;CAGC,GACD,OAAO,MAAMC,eAAe;QAC1BC;YAAAA,oCAAAA,QAAQC,GAAG,CAACC,oBAAoB,YAAhCF,oCAAoCF;EAAkB;AAExD,6EAA6E,GAC7E,MAAMK,UAAU,CAACC;IACf,IAAIA,aAAaC,WAAW,OAAO;IACnC,MAAMC,OAAOC,OAAOC,IAAI,CAACJ;IACzB,MAAMK,QAAQF,OAAOC,IAAI,CAACT;IAC1B,6EAA6E;IAC7E,iEAAiE;IACjE,OAAOO,KAAKI,MAAM,KAAKD,MAAMC,MAAM,IAAIjB,gBAAgBa,MAAMG;AAC/D;AAEA;;;;;;;;;;;;;;;;;;;CAmBC,GACD,OAAO,MAAME,sBAAsB,CAAUC,QAC3C,iFAAiF;IACjF,+EAA+E;IAC/E,gFAAgF;IAChF,yEAAyE;IACzE,4EAA4E;IAC5ElB,OAAOmB,GAAG,CAAC;QACT,MAAMC,UAAU,OAAOnB,kBAAkBA,iBAAiB;QAE1D,IAAI,CAACQ,QAAQW,QAAQC,OAAO,CAAClB,qBAAqB,GAAG;YACnD,OAAO,OAAOD,mBAAmBoB,IAAI,CACnC;gBAAEC,OAAO;gBAAmBC,MAAM;YAAkB,GACpD;gBAAEC,QAAQ;YAAI;QAElB;QAEA,OAAO,OAAOP;IAChB,GAAG"}