@heavybit/shared-lib 0.0.0-stage → 1.2.0

package/dist/esm/express/auth.js

@@ -0,0 +1,63 @@
+import { hasAllPermissions, hasPermission, hasRole } from '../access/index.js';
+import { safeEqual } from '../common/crypto.js';
+import { errorResponse } from '../common/response.js';
+import { CONTEXT_HEADERS, verifyIdentityHeaders } from '../identity/index.js';
+function resolveIdentity(req, options) {
+    const result = verifyIdentityHeaders(req.headers, options.secret, { maxSkewMs: options.maxSkewMs });
+    if (result.status === 'authenticated') {
+        req.user = result.user;
+        return 'ok';
+    }
+    if (result.status === 'invalid') {
+        options.logger?.warn('Rejected forged or stale gateway identity', { reason: result.reason, path: req.path });
+        return 'invalid';
+    }
+    return 'anonymous';
+}
+/** Requires a valid gateway-signed identity; 401 otherwise. */
+export function authenticateFromGateway(options) {
+    return (req, res, next) => {
+        if (resolveIdentity(req, options) === 'ok')
+            return next();
+        res.status(401).json(errorResponse('Authentication required', undefined, 'UNAUTHENTICATED'));
+    };
+}
+/** Attaches `req.user` when a valid identity is present; continues anonymously otherwise. */
+export function optionalAuthFromGateway(options) {
+    return (req, res, next) => {
+        if (resolveIdentity(req, options) === 'invalid') {
+            res.status(401).json(errorResponse('Invalid identity', undefined, 'UNAUTHENTICATED'));
+            return;
+        }
+        next();
+    };
+}
+function guard(check, message = 'You do not have permission to perform this action') {
+    return (req, res, next) => {
+        if (!req.user) {
+            res.status(401).json(errorResponse('Authentication required', undefined, 'UNAUTHENTICATED'));
+            return;
+        }
+        if (!check(req.user)) {
+            res.status(403).json(errorResponse(message, undefined, 'FORBIDDEN'));
+            return;
+        }
+        next();
+    };
+}
+/** Allows callers holding any of `permissions`. */
+export const requirePermission = (...permissions) => guard((u) => hasPermission(u, ...permissions));
+/** Allows callers holding every one of `permissions`. */
+export const requireAllPermissions = (...permissions) => guard((u) => hasAllPermissions(u, ...permissions));
+/** Allows callers with any of `roles`. Prefer permissions; roles are for coarse gates only. */
+export const requireRole = (...roles) => guard((u) => hasRole(u, ...roles), 'Insufficient role');
+/** Guards `/internal/*` routes: requires the shared service secret header. */
+export function requireInternalServiceSecret(secret) {
+    return (req, res, next) => {
+        const provided = req.headers[CONTEXT_HEADERS.INTERNAL_SECRET];
+        if (typeof provided === 'string' && secret && safeEqual(provided, secret))
+            return next();
+        res.status(401).json(errorResponse('Invalid internal service credentials', undefined, 'UNAUTHENTICATED'));
+    };
+}
+//# sourceMappingURL=auth.js.map

package/dist/esm/express/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/express/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAkB9E,SAAS,eAAe,CAAC,GAAY,EAAE,OAA2B;IAChE,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACpG,IAAI,MAAM,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QACtC,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,2CAA2C,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7G,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,uBAAuB,CAAC,OAA2B;IACjE,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,IAAI,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,EAAE,CAAC;QAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,yBAAyB,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC/F,CAAC,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,uBAAuB,CAAC,OAA2B;IACjE,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,IAAI,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,kBAAkB,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC;YACtF,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,KAAkC,EAAE,OAAO,GAAG,mDAAmD;IAC9G,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,yBAAyB,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC;YAC7F,OAAO;QACT,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,mDAAmD;AACnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAG,WAAqB,EAAkB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC;AAE9H,yDAAyD;AACzD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,WAAqB,EAAkB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC;AAEtI,+FAA+F;AAC/F,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,GAAG,KAAe,EAAkB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,EAAE,mBAAmB,CAAC,CAAC;AAE3H,8EAA8E;AAC9E,MAAM,UAAU,4BAA4B,CAAC,MAAc;IACzD,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;QAC9D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,IAAI,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QACzF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,sCAAsC,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC5G,CAAC,CAAC;AACJ,CAAC"}

package/dist/esm/express/health.js

@@ -0,0 +1,27 @@
+import { withTimeout } from '../common/async.js';
+/** `GET /health` — liveness: the process is up. Never touches dependencies. */
+export function livenessHandler(options) {
+    const startedAt = Date.now();
+    return (_req, res) => {
+        res.json({ status: 'ok', service: options.service, version: options.version, uptimeSec: Math.round((Date.now() - startedAt) / 1000) });
+    };
+}
+/** `GET /health/ready` — readiness: every dependency responds. 503 when any fails. */
+export function readinessHandler(options) {
+    return async (_req, res) => {
+        const entries = Object.entries(options.checks ?? {});
+        const results = await Promise.all(entries.map(async ([name, check]) => {
+            const started = Date.now();
+            try {
+                const detail = await withTimeout(Promise.resolve(check()), options.timeoutMs ?? 3000, () => new Error('timeout'));
+                return [name, { status: 'up', latencyMs: Date.now() - started, ...(detail && typeof detail === 'object' ? { detail } : {}) }];
+            }
+            catch (error) {
+                return [name, { status: 'down', latencyMs: Date.now() - started, error: error.message }];
+            }
+        }));
+        const healthy = results.every(([, r]) => r.status === 'up');
+        res.status(healthy ? 200 : 503).json({ status: healthy ? 'ok' : 'degraded', service: options.service, checks: Object.fromEntries(results) });
+    };
+}
+//# sourceMappingURL=health.js.map

package/dist/esm/express/health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.js","sourceRoot":"","sources":["../../../src/express/health.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAYjD,+EAA+E;AAC/E,MAAM,UAAU,eAAe,CAAC,OAAsB;IACpD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,OAAO,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QACtC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;IACzI,CAAC,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,gBAAgB,CAAC,OAAsB;IACrD,OAAO,KAAK,EAAE,IAAa,EAAE,GAAa,EAAE,EAAE;QAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE;YACpE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;gBAClH,OAAO,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,GAAG,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAU,CAAC;YACzI,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAU,CAAC;YAC/G,CAAC;QACH,CAAC,CAAC,CAAC,CAAC;QACJ,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;QAC5D,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC/I,CAAC,CAAC;AACJ,CAAC"}

package/dist/esm/express/index.js

@@ -0,0 +1,5 @@
+export * from './auth.js';
+export * from './middleware.js';
+export * from './health.js';
+export * from './security.js';
+//# sourceMappingURL=index.js.map

package/dist/esm/express/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/express/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC"}

package/dist/esm/express/middleware.js

@@ -0,0 +1,84 @@
+import { isAppError, publicMessage } from '../common/errors.js';
+import { newId } from '../common/id.js';
+import { errorResponse } from '../common/response.js';
+import { CONTEXT_HEADERS } from '../identity/index.js';
+import { zodIssuesToErrors } from '../validation/index.js';
+/** Ensures every request carries `x-correlation-id` (reused from the gateway when present). */
+export function correlationMiddleware() {
+    return (req, res, next) => {
+        const incoming = req.headers[CONTEXT_HEADERS.CORRELATION_ID];
+        const id = typeof incoming === 'string' && incoming.length <= 128 ? incoming : newId();
+        req.headers[CONTEXT_HEADERS.CORRELATION_ID] = id;
+        res.setHeader(CONTEXT_HEADERS.CORRELATION_ID, id);
+        next();
+    };
+}
+export function correlationId(req) {
+    const value = req.headers[CONTEXT_HEADERS.CORRELATION_ID];
+    return typeof value === 'string' ? value : undefined;
+}
+/** Real client IP: gateway-forwarded header first, then Express's `req.ip`. */
+export function clientIp(req) {
+    const forwarded = req.headers[CONTEXT_HEADERS.CLIENT_IP];
+    if (typeof forwarded === 'string' && forwarded)
+        return forwarded;
+    return req.ip ?? null;
+}
+export function clientTimezone(req) {
+    const tz = req.headers[CONTEXT_HEADERS.TIMEZONE];
+    return typeof tz === 'string' && tz ? tz : null;
+}
+export function anonId(req) {
+    const id = req.headers[CONTEXT_HEADERS.ANON_ID];
+    return typeof id === 'string' && id ? id : null;
+}
+/** Validates and replaces `req[part]` with the parsed value; 422 with field errors on failure. */
+export function validate(schema, part = 'body') {
+    return (req, res, next) => {
+        const result = schema.safeParse(req[part]);
+        if (!result.success) {
+            res.status(422).json(errorResponse('Validation failed', zodIssuesToErrors(result.error), 'VALIDATION_FAILED'));
+            return;
+        }
+        // Express 5 exposes req.query as a getter; redefine to store the parsed value.
+        Object.defineProperty(req, part, { value: result.data, writable: true, configurable: true, enumerable: true });
+        next();
+    };
+}
+/** Wraps an async handler so rejections reach the error middleware (needed on Express 4). */
+export function asyncHandler(fn) {
+    return (req, res, next) => {
+        fn(req, res, next).catch(next);
+    };
+}
+/** Maps AppErrors to their status; everything else becomes a logged 500 with a generic message. */
+export function errorHandler(logger) {
+    return (err, req, res, _next) => {
+        if (res.headersSent)
+            return;
+        const bodyError = err;
+        if (bodyError?.type === 'entity.parse.failed') {
+            res.status(400).json(errorResponse('Malformed JSON body', undefined, 'BAD_REQUEST'));
+            return;
+        }
+        if (bodyError?.type === 'entity.too.large') {
+            res.status(413).json(errorResponse('Request body too large', undefined, 'PAYLOAD_TOO_LARGE'));
+            return;
+        }
+        if (isAppError(err)) {
+            if (err.statusCode >= 500)
+                logger?.error(err.message, { path: req.path, code: err.code, correlationId: correlationId(req) });
+            res.status(err.statusCode).json(errorResponse(publicMessage(err), err.errors, err.code));
+            return;
+        }
+        const error = err instanceof Error ? err : new Error(String(err));
+        logger?.error('Unhandled error', { error: error.message, stack: error.stack, path: req.path, correlationId: correlationId(req) });
+        res.status(500).json(errorResponse('Internal server error', undefined, 'INTERNAL_ERROR'));
+    };
+}
+export function notFoundHandler() {
+    return (_req, res) => {
+        res.status(404).json(errorResponse('Resource not found', undefined, 'NOT_FOUND'));
+    };
+}
+//# sourceMappingURL=middleware.js.map

package/dist/esm/express/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../../src/express/middleware.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,+FAA+F;AAC/F,MAAM,UAAU,qBAAqB;IACnC,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC;QAC7D,MAAM,EAAE,GAAG,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QACvF,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC;QACjD,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC;IAC1D,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,QAAQ,CAAC,GAAY;IACnC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IACjE,OAAO,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IACjD,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,GAAY;IACjC,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IAChD,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAID,kGAAkG;AAClG,MAAM,UAAU,QAAQ,CAAC,MAAkB,EAAE,OAAoB,MAAM;IACrE,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;YAC/G,OAAO;QACT,CAAC;QACD,+EAA+E;QAC/E,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/G,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,YAAY,CAAgC,EAAqE;IAC/H,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,EAAE,CAAC,GAAU,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC,CAAC;AACJ,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,YAAY,CAAC,MAAe;IAC1C,OAAO,CAAC,GAAY,EAAE,GAAY,EAAE,GAAa,EAAE,KAAmB,EAAE,EAAE;QACxE,IAAI,GAAG,CAAC,WAAW;YAAE,OAAO;QAC5B,MAAM,SAAS,GAAG,GAAyC,CAAC;QAC5D,IAAI,SAAS,EAAE,IAAI,KAAK,qBAAqB,EAAE,CAAC;YAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,qBAAqB,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;YACrF,OAAO;QACT,CAAC;QACD,IAAI,SAAS,EAAE,IAAI,KAAK,kBAAkB,EAAE,CAAC;YAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,wBAAwB,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC,CAAC;YAC9F,OAAO;QACT,CAAC;QACD,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG;gBAAE,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,aAAa,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC7H,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAClE,MAAM,EAAE,KAAK,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,aAAa,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,uBAAuB,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC5F,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QACtC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,oBAAoB,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IACpF,CAAC,CAAC;AACJ,CAAC"}

package/dist/esm/express/security.js

@@ -0,0 +1,11 @@
+import cors from 'cors';
+import helmet from 'helmet';
+/** Standard security headers (helmet). Pass options only to relax a header a service genuinely needs. */
+export function securityHeaders(options) {
+    return helmet(options);
+}
+/** CORS for browser-facing services. An empty origin list disables CORS (no `Access-Control-*` headers). */
+export function corsMiddleware(origins, options = {}) {
+    return cors({ ...options, origin: origins.length ? origins : false });
+}
+//# sourceMappingURL=security.js.map

package/dist/esm/express/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../../src/express/security.ts"],"names":[],"mappings":"AAAA,OAAO,IAA0B,MAAM,MAAM,CAAC;AAC9C,OAAO,MAA8B,MAAM,QAAQ,CAAC;AAKpD,yGAAyG;AACzG,MAAM,UAAU,eAAe,CAAC,OAAuB;IACrD,OAAO,MAAM,CAAC,OAAO,CAA8B,CAAC;AACtD,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,cAAc,CAAC,OAAiB,EAAE,UAAuC,EAAE;IACzF,OAAO,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,CAA8B,CAAC;AACrG,CAAC"}

package/dist/esm/http/index.js

@@ -0,0 +1,73 @@
+import { AppError, ServiceUnavailableError } from '../common/errors.js';
+import { sleep } from '../common/async.js';
+import { CONTEXT_HEADERS } from '../identity/index.js';
+import { silentLogger } from '../logging/index.js';
+export * from './safe-fetch.js';
+const RETRYABLE_STATUS = new Set([502, 503, 504]);
+const IDEMPOTENT = new Set(['GET', 'PUT', 'DELETE']);
+/**
+ * Typed client for `/internal/*` calls between services. Unwraps the `{ success, data }`
+ * envelope, maps upstream errors to AppErrors with the same status, and turns network failures
+ * and timeouts into 503s.
+ */
+export function createServiceClient(options) {
+    const logger = options.logger ?? silentLogger;
+    const base = options.baseUrl.replace(/\/+$/, '');
+    async function request(method, path, opts = {}) {
+        const url = new URL(base + path);
+        for (const [key, value] of Object.entries(opts.query ?? {}))
+            if (value !== undefined)
+                url.searchParams.set(key, String(value));
+        const retries = IDEMPOTENT.has(method) ? options.retries ?? 2 : 0;
+        for (let attempt = 0;; attempt += 1) {
+            const controller = new AbortController();
+            const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? options.timeoutMs ?? 5000);
+            try {
+                const response = await fetch(url, {
+                    method,
+                    signal: controller.signal,
+                    headers: {
+                        accept: 'application/json',
+                        ...(opts.body !== undefined ? { 'content-type': 'application/json' } : {}),
+                        [CONTEXT_HEADERS.INTERNAL_SECRET]: options.internalSecret,
+                        [CONTEXT_HEADERS.CALLER_SERVICE]: options.callerService,
+                        ...(opts.correlationId ? { [CONTEXT_HEADERS.CORRELATION_ID]: opts.correlationId } : {}),
+                        ...opts.headers,
+                    },
+                    body: opts.body !== undefined ? JSON.stringify(opts.body) : undefined,
+                });
+                if (RETRYABLE_STATUS.has(response.status) && attempt < retries) {
+                    await sleep(200 * 2 ** attempt);
+                    continue;
+                }
+                const text = await response.text();
+                const payload = text ? JSON.parse(text) : { success: response.ok, message: '' };
+                if (!response.ok) {
+                    throw new AppError(response.status, payload.message || `Upstream error ${response.status}`, { code: payload.code, errors: payload.errors });
+                }
+                return (payload.data ?? payload);
+            }
+            catch (error) {
+                if (error instanceof AppError)
+                    throw error;
+                if (attempt < retries) {
+                    await sleep(200 * 2 ** attempt);
+                    continue;
+                }
+                logger.warn('Internal call failed', { method, url: url.pathname, error: error.message });
+                throw new ServiceUnavailableError('Upstream service unavailable', { cause: error });
+            }
+            finally {
+                clearTimeout(timer);
+            }
+        }
+    }
+    return {
+        get: (path, opts) => request('GET', path, opts),
+        post: (path, opts) => request('POST', path, opts),
+        put: (path, opts) => request('PUT', path, opts),
+        patch: (path, opts) => request('PATCH', path, opts),
+        delete: (path, opts) => request('DELETE', path, opts),
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/esm/http/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/http/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGnD,cAAc,iBAAiB,CAAC;AA8BhC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAClD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;AAErD;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAA6B;IAC/D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC;IAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAEjD,KAAK,UAAU,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,OAAuB,EAAE;QAC/E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QACjC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAAE,IAAI,KAAK,KAAK,SAAS;gBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/H,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAElE,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,IAAI,CAAC,EAAE,CAAC;YACrC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC;YAChG,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;oBAChC,MAAM;oBACN,MAAM,EAAE,UAAU,CAAC,MAAM;oBACzB,OAAO,EAAE;wBACP,MAAM,EAAE,kBAAkB;wBAC1B,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC1E,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC,cAAc;wBACzD,CAAC,eAAe,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC,aAAa;wBACvD,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACvF,GAAG,IAAI,CAAC,OAAO;qBAChB;oBACD,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;iBACtE,CAAC,CAAC;gBACH,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,GAAG,OAAO,EAAE,CAAC;oBAC/D,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC;oBAChC,SAAS;gBACX,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACnC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAoB,CAAC,CAAC,CAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,EAAqB,CAAC;gBACxH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,IAAI,kBAAkB,QAAQ,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC9I,CAAC;gBACD,OAAO,CAAC,OAAO,CAAC,IAAI,IAAK,OAAmB,CAAM,CAAC;YACrD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,QAAQ;oBAAE,MAAM,KAAK,CAAC;gBAC3C,IAAI,OAAO,GAAG,OAAO,EAAE,CAAC;oBACtB,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC;oBAChC,SAAS;gBACX,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;gBACpG,MAAM,IAAI,uBAAuB,CAAC,8BAA8B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACtF,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC;QAC/C,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC;QACjD,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC;QAC/C,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;QACnD,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC;KACtD,CAAC;AACJ,CAAC"}

package/dist/esm/http/safe-fetch.js

@@ -0,0 +1,193 @@
+import { lookup as dnsLookup } from 'node:dns';
+import { isIP } from 'node:net';
+import { Agent, request } from 'undici';
+/** A fetch rejected for an SSRF guard, a limit, or a transport failure. */
+export class SafeFetchError extends Error {
+    code;
+    constructor(code, message, options) {
+        super(message, options);
+        this.name = 'SafeFetchError';
+        this.code = code;
+    }
+}
+const DEFAULT_PROTOCOLS = ['https:', 'http:'];
+const defaultLookup = (hostname, options, callback) => {
+    dnsLookup(hostname, { all: true, family: options.family }, (err, addresses) => {
+        if (err)
+            return callback(err, []);
+        callback(null, addresses.map((a) => ({ address: a.address, family: a.family })));
+    });
+};
+/**
+ * Returns a human-readable reason if `ip` is a disallowed destination (private, loopback,
+ * link-local, CGNAT, multicast, unspecified, IPv4-mapped IPv6, cloud metadata), otherwise `null`.
+ */
+export function blockedAddressReason(ip) {
+    const family = isIP(ip);
+    if (family === 4)
+        return blockedIpv4Reason(ip);
+    if (family === 6)
+        return blockedIpv6Reason(ip.toLowerCase());
+    return 'not an IP address';
+}
+function blockedIpv4Reason(ip) {
+    const parts = ip.split('.').map((p) => Number(p));
+    if (parts.length !== 4 || parts.some((p) => Number.isNaN(p) || p < 0 || p > 255))
+        return 'malformed IPv4';
+    const [a, b] = parts;
+    if (a === 0)
+        return 'unspecified';
+    if (a === 10)
+        return 'private (10.0.0.0/8)';
+    if (a === 127)
+        return 'loopback';
+    if (a === 100 && b >= 64 && b <= 127)
+        return 'CGNAT (100.64.0.0/10)';
+    if (a === 169 && b === 254)
+        return 'link-local (incl. cloud metadata)';
+    if (a === 172 && b >= 16 && b <= 31)
+        return 'private (172.16.0.0/12)';
+    if (a === 192 && b === 168)
+        return 'private (192.168.0.0/16)';
+    if (a >= 224)
+        return 'multicast or reserved';
+    return null;
+}
+function blockedIpv6Reason(ip) {
+    if (ip === '::' || ip === '::0')
+        return 'unspecified';
+    if (ip === '::1')
+        return 'loopback';
+    if (ip.startsWith('fe80') || ip.startsWith('fe9') || ip.startsWith('fea') || ip.startsWith('feb'))
+        return 'link-local';
+    if (ip.startsWith('fc') || ip.startsWith('fd'))
+        return 'unique-local (incl. fd00:ec2::254 metadata)';
+    if (ip.startsWith('ff'))
+        return 'multicast';
+    // IPv4-mapped (::ffff:a.b.c.d) and IPv4-compatible (::a.b.c.d) — unwrap and re-check.
+    const mapped = ip.match(/::(?:ffff:)?(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
+    if (mapped)
+        return `IPv4-mapped IPv6 (${blockedIpv4Reason(mapped[1]) ?? 'maps to public IPv4'})`;
+    return null;
+}
+export function createSafeFetcher(options) {
+    const { userAgent, maxBytes, timeoutMs, maxRedirects = 5, allowedProtocols = DEFAULT_PROTOCOLS, lookup = defaultLookup, allowedAddresses = [], } = options;
+    const allowSet = new Set(allowedAddresses);
+    const isBlocked = (ip) => !allowSet.has(ip) && blockedAddressReason(ip) !== null;
+    function resolveAndCheck(hostname) {
+        // A literal IP resolves to itself; still subject to the blocklist.
+        return new Promise((resolve, reject) => {
+            lookup(hostname, { all: true }, (err, addresses) => {
+                if (err)
+                    return reject(new SafeFetchError('NETWORK', `DNS lookup failed for ${hostname}`, { cause: err }));
+                if (!addresses.length)
+                    return reject(new SafeFetchError('NETWORK', `No addresses for ${hostname}`));
+                for (const a of addresses) {
+                    if (isBlocked(a.address))
+                        return reject(new SafeFetchError('BLOCKED_ADDRESS', `Blocked address ${a.address} for ${hostname}`));
+                }
+                resolve();
+            });
+        });
+    }
+    // Re-validates at connect time so a DNS rebind between the pre-check and the socket is blocked.
+    // `net.connect` calls this with `{ all: true }` (and expects an array) on modern Node; support both.
+    const connectLookup = (hostname, opts, callback) => {
+        lookup(hostname, { all: true }, (err, addresses) => {
+            if (err)
+                return callback(err, undefined, 0);
+            const blocked = addresses.find((a) => isBlocked(a.address));
+            if (blocked) {
+                return callback(new SafeFetchError('BLOCKED_ADDRESS', `Blocked address ${blocked.address} for ${hostname}`), undefined, 0);
+            }
+            if (opts?.all)
+                return callback(null, addresses);
+            const first = addresses[0];
+            callback(null, first.address, first.family);
+        });
+    };
+    const agent = new Agent({ connect: { lookup: connectLookup } });
+    async function fetchOnce(url, headers, signal) {
+        if (!allowedProtocols.includes(url.protocol)) {
+            throw new SafeFetchError('PROTOCOL_NOT_ALLOWED', `Protocol ${url.protocol} not allowed`);
+        }
+        await resolveAndCheck(url.hostname);
+        let res;
+        try {
+            // `request` does not follow redirects; we handle each 3xx hop manually and re-validate it.
+            res = await request(url, {
+                method: 'GET',
+                dispatcher: agent,
+                headers,
+                signal,
+            });
+        }
+        catch (error) {
+            if (error instanceof SafeFetchError)
+                throw error;
+            // undici wraps a thrown connect-lookup error as the cause.
+            const cause = error.cause;
+            if (cause instanceof SafeFetchError)
+                throw cause;
+            if (signal.aborted)
+                throw new SafeFetchError('TIMEOUT', `Request to ${url.href} timed out`, { cause: error });
+            throw new SafeFetchError('NETWORK', `Request to ${url.href} failed`, { cause: error });
+        }
+        const chunks = [];
+        let total = 0;
+        try {
+            for await (const chunk of res.body) {
+                const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+                total += buf.length;
+                if (total > maxBytes) {
+                    res.body.destroy();
+                    throw new SafeFetchError('TOO_LARGE', `Response from ${url.href} exceeds ${maxBytes} bytes`);
+                }
+                chunks.push(buf);
+            }
+        }
+        catch (error) {
+            if (error instanceof SafeFetchError)
+                throw error;
+            if (signal.aborted)
+                throw new SafeFetchError('TIMEOUT', `Request to ${url.href} timed out`, { cause: error });
+            throw new SafeFetchError('NETWORK', `Reading response from ${url.href} failed`, { cause: error });
+        }
+        const location = typeof res.headers.location === 'string' ? res.headers.location : undefined;
+        return { status: res.statusCode, headers: res.headers, body: Buffer.concat(chunks), finalUrl: url.href, redirects: 0, location };
+    }
+    return {
+        async fetch(rawUrl, req = {}) {
+            const controller = new AbortController();
+            const timer = setTimeout(() => controller.abort(), timeoutMs);
+            try {
+                let current = new URL(rawUrl);
+                let redirects = 0;
+                for (;;) {
+                    const headers = {
+                        'user-agent': userAgent,
+                        accept: req.accept ?? '*/*',
+                        ...req.headers,
+                    };
+                    // Never forward cookies or credentials.
+                    delete headers.cookie;
+                    delete headers.authorization;
+                    const result = await fetchOnce(current, headers, controller.signal);
+                    const isRedirect = result.status >= 300 && result.status < 400 && result.location;
+                    if (!isRedirect) {
+                        return { status: result.status, headers: result.headers, body: result.body, finalUrl: current.href, redirects };
+                    }
+                    redirects += 1;
+                    if (redirects > maxRedirects) {
+                        throw new SafeFetchError('TOO_MANY_REDIRECTS', `More than ${maxRedirects} redirects from ${rawUrl}`);
+                    }
+                    current = new URL(result.location, current);
+                }
+            }
+            finally {
+                clearTimeout(timer);
+            }
+        },
+    };
+}
+//# sourceMappingURL=safe-fetch.js.map

package/dist/esm/http/safe-fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-fetch.js","sourceRoot":"","sources":["../../../src/http/safe-fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAWxC,2EAA2E;AAC3E,MAAM,OAAO,cAAe,SAAQ,KAAK;IAC9B,IAAI,CAAqB;IAElC,YAAY,IAAwB,EAAE,OAAe,EAAE,OAA6B;QAClF,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAkDD,MAAM,iBAAiB,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAE9C,MAAM,aAAa,GAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;IAChE,SAAS,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE;QAC5E,IAAI,GAAG;YAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAClC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,EAAU;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;IACxB,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAC/C,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,iBAAiB,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7D,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,SAAS,iBAAiB,CAAC,EAAU;IACnC,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;QAAE,OAAO,gBAAgB,CAAC;IAC1G,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;IACrB,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC;IAClC,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,sBAAsB,CAAC;IAC5C,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,UAAU,CAAC;IACjC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,uBAAuB,CAAC;IACrE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,mCAAmC,CAAC;IACvE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,yBAAyB,CAAC;IACtE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,0BAA0B,CAAC;IAC9D,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,uBAAuB,CAAC;IAC7C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,EAAU;IACnC,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,KAAK;QAAE,OAAO,aAAa,CAAC;IACtD,IAAI,EAAE,KAAK,KAAK;QAAE,OAAO,UAAU,CAAC;IACpC,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IACvH,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,6CAA6C,CAAC;IACrG,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,WAAW,CAAC;IAC5C,sFAAsF;IACtF,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAC7E,IAAI,MAAM;QAAE,OAAO,qBAAqB,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,qBAAqB,GAAG,CAAC;IACjG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAA2B;IAC3D,MAAM,EACJ,SAAS,EACT,QAAQ,EACR,SAAS,EACT,YAAY,GAAG,CAAC,EAChB,gBAAgB,GAAG,iBAAiB,EACpC,MAAM,GAAG,aAAa,EACtB,gBAAgB,GAAG,EAAE,GACtB,GAAG,OAAO,CAAC;IACZ,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAE3C,MAAM,SAAS,GAAG,CAAC,EAAU,EAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,oBAAoB,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC;IAElG,SAAS,eAAe,CAAC,QAAgB;QACvC,mEAAmE;QACnE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE;gBACjD,IAAI,GAAG;oBAAE,OAAO,MAAM,CAAC,IAAI,cAAc,CAAC,SAAS,EAAE,yBAAyB,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;gBAC3G,IAAI,CAAC,SAAS,CAAC,MAAM;oBAAE,OAAO,MAAM,CAAC,IAAI,cAAc,CAAC,SAAS,EAAE,oBAAoB,QAAQ,EAAE,CAAC,CAAC,CAAC;gBACpG,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;oBAC1B,IAAI,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;wBAAE,OAAO,MAAM,CAAC,IAAI,cAAc,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC,OAAO,QAAQ,QAAQ,EAAE,CAAC,CAAC,CAAC;gBACjI,CAAC;gBACD,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,gGAAgG;IAChG,qGAAqG;IACrG,MAAM,aAAa,GAAG,CAAC,QAAgB,EAAE,IAAuB,EAAE,QAAwF,EAAQ,EAAE;QAClK,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE;YACjD,IAAI,GAAG;gBAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;YAC5C,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YAC5D,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,QAAQ,CAAC,IAAI,cAAc,CAAC,iBAAiB,EAAE,mBAAmB,OAAO,CAAC,OAAO,QAAQ,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;YAC7H,CAAC;YACD,IAAI,IAAI,EAAE,GAAG;gBAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAChD,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YAC3B,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,EAA8B,EAAE,CAAC,CAAC;IAE5F,KAAK,UAAU,SAAS,CAAC,GAAQ,EAAE,OAA+B,EAAE,MAAmB;QACrF,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,cAAc,CAAC,sBAAsB,EAAE,YAAY,GAAG,CAAC,QAAQ,cAAc,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEpC,IAAI,GAAG,CAAC;QACR,IAAI,CAAC;YACH,2FAA2F;YAC3F,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;gBACvB,MAAM,EAAE,KAAK;gBACb,UAAU,EAAE,KAAK;gBACjB,OAAO;gBACP,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,cAAc;gBAAE,MAAM,KAAK,CAAC;YACjD,2DAA2D;YAC3D,MAAM,KAAK,GAAI,KAA6B,CAAC,KAAK,CAAC;YACnD,IAAI,KAAK,YAAY,cAAc;gBAAE,MAAM,KAAK,CAAC;YACjD,IAAI,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,cAAc,GAAG,CAAC,IAAI,YAAY,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9G,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,cAAc,GAAG,CAAC,IAAI,SAAS,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;gBACnC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAChE,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC;gBACpB,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;oBACrB,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;oBACnB,MAAM,IAAI,cAAc,CAAC,WAAW,EAAE,iBAAiB,GAAG,CAAC,IAAI,YAAY,QAAQ,QAAQ,CAAC,CAAC;gBAC/F,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,cAAc;gBAAE,MAAM,KAAK,CAAC;YACjD,IAAI,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,cAAc,GAAG,CAAC,IAAI,YAAY,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9G,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,yBAAyB,GAAG,CAAC,IAAI,SAAS,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACpG,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7F,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC;IACnI,CAAC;IAED,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,GAAG,EAAE;YAC1B,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;YAC9D,IAAI,CAAC;gBACH,IAAI,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC9B,IAAI,SAAS,GAAG,CAAC,CAAC;gBAClB,SAAS,CAAC;oBACR,MAAM,OAAO,GAA2B;wBACtC,YAAY,EAAE,SAAS;wBACvB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK;wBAC3B,GAAG,GAAG,CAAC,OAAO;qBACf,CAAC;oBACF,wCAAwC;oBACxC,OAAO,OAAO,CAAC,MAAM,CAAC;oBACtB,OAAO,OAAO,CAAC,aAAa,CAAC;oBAE7B,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;oBACpE,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC;oBAClF,IAAI,CAAC,UAAU,EAAE,CAAC;wBAChB,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;oBAClH,CAAC;oBACD,SAAS,IAAI,CAAC,CAAC;oBACf,IAAI,SAAS,GAAG,YAAY,EAAE,CAAC;wBAC7B,MAAM,IAAI,cAAc,CAAC,oBAAoB,EAAE,aAAa,YAAY,mBAAmB,MAAM,EAAE,CAAC,CAAC;oBACvG,CAAC;oBACD,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAkB,EAAE,OAAO,CAAC,CAAC;gBACxD,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/esm/identity/index.js

@@ -0,0 +1,111 @@
+import { hmacSha256, safeEqual } from '../common/crypto.js';
+/**
+ * Header contract between the gateway and downstream services.
+ *
+ * The gateway strips any client-supplied identity headers, then writes these and signs them with
+ * `x-gateway-auth` = HMAC-SHA256(secret, canonical string). Services verify the signature and
+ * timestamp before trusting anything, so a request that bypasses the gateway on the internal
+ * network cannot forge an identity.
+ */
+export const IDENTITY_HEADERS = {
+    USER_ID: 'x-user-id',
+    USER_EMAIL: 'x-user-email',
+    USER_ROLES: 'x-user-roles',
+    USER_PERMISSIONS: 'x-user-permissions',
+    USER_SCOPES: 'x-user-scopes',
+    USER_ATTRS: 'x-user-attrs',
+    SESSION_ID: 'x-session-id',
+    TIMESTAMP: 'x-gateway-ts',
+    SIGNATURE: 'x-gateway-auth',
+};
+export const CONTEXT_HEADERS = {
+    CORRELATION_ID: 'x-correlation-id',
+    ANON_ID: 'x-anon-id',
+    TIMEZONE: 'x-timezone',
+    CLIENT_IP: 'x-client-ip',
+    INTERNAL_SECRET: 'x-internal-service-secret',
+    CALLER_SERVICE: 'x-caller-service',
+};
+/** Every header a client must never be allowed to set. */
+export const PROTECTED_HEADERS = [...Object.values(IDENTITY_HEADERS), CONTEXT_HEADERS.INTERNAL_SECRET, CONTEXT_HEADERS.CLIENT_IP];
+const DEFAULT_MAX_SKEW_MS = 5 * 60_000;
+function header(headers, name) {
+    const value = headers[name];
+    return Array.isArray(value) ? value[0] : value;
+}
+function canonical(values) {
+    return [
+        values[IDENTITY_HEADERS.TIMESTAMP],
+        values[IDENTITY_HEADERS.USER_ID],
+        values[IDENTITY_HEADERS.USER_EMAIL],
+        values[IDENTITY_HEADERS.USER_ROLES],
+        values[IDENTITY_HEADERS.USER_PERMISSIONS],
+        values[IDENTITY_HEADERS.USER_SCOPES],
+        values[IDENTITY_HEADERS.USER_ATTRS],
+        values[IDENTITY_HEADERS.SESSION_ID],
+    ].join('\n');
+}
+const encodeList = (items) => items.join(',');
+const decodeList = (value) => (value ? value.split(',').map((s) => s.trim()).filter(Boolean) : []);
+const encodeJson = (value) => Buffer.from(JSON.stringify(value ?? {})).toString('base64url');
+function decodeJson(value, fallback) {
+    if (!value)
+        return fallback;
+    try {
+        return JSON.parse(Buffer.from(value, 'base64url').toString('utf8'));
+    }
+    catch {
+        return fallback;
+    }
+}
+/** Gateway side: headers (including signature) that represent `user`. */
+export function signIdentityHeaders(user, secret, now = Date.now()) {
+    const values = {
+        [IDENTITY_HEADERS.TIMESTAMP]: String(now),
+        [IDENTITY_HEADERS.USER_ID]: user.id,
+        [IDENTITY_HEADERS.USER_EMAIL]: user.email ?? '',
+        [IDENTITY_HEADERS.USER_ROLES]: encodeList(user.roles),
+        [IDENTITY_HEADERS.USER_PERMISSIONS]: encodeList(user.permissions),
+        [IDENTITY_HEADERS.USER_SCOPES]: encodeJson(user.scopes),
+        [IDENTITY_HEADERS.USER_ATTRS]: encodeJson(user.attrs),
+        [IDENTITY_HEADERS.SESSION_ID]: user.sessionId ?? '',
+    };
+    values[IDENTITY_HEADERS.SIGNATURE] = hmacSha256(secret, canonical(values));
+    return values;
+}
+/** Service side: verifies and decodes the gateway identity headers. */
+export function verifyIdentityHeaders(headers, secret, options = {}) {
+    const userId = header(headers, IDENTITY_HEADERS.USER_ID);
+    if (!userId)
+        return { status: 'anonymous' };
+    const values = {};
+    for (const name of Object.values(IDENTITY_HEADERS))
+        values[name] = header(headers, name) ?? '';
+    const signature = values[IDENTITY_HEADERS.SIGNATURE];
+    if (!signature || !safeEqual(signature, hmacSha256(secret, canonical(values)))) {
+        return { status: 'invalid', reason: 'bad-signature' };
+    }
+    const ts = Number(values[IDENTITY_HEADERS.TIMESTAMP]);
+    const now = options.now ?? Date.now();
+    if (!Number.isFinite(ts) || Math.abs(now - ts) > (options.maxSkewMs ?? DEFAULT_MAX_SKEW_MS)) {
+        return { status: 'invalid', reason: 'stale-signature' };
+    }
+    return {
+        status: 'authenticated',
+        user: {
+            id: userId,
+            email: values[IDENTITY_HEADERS.USER_EMAIL] ?? '',
+            roles: decodeList(values[IDENTITY_HEADERS.USER_ROLES]),
+            permissions: decodeList(values[IDENTITY_HEADERS.USER_PERMISSIONS]),
+            scopes: decodeJson(values[IDENTITY_HEADERS.USER_SCOPES], {}),
+            attrs: decodeJson(values[IDENTITY_HEADERS.USER_ATTRS], {}),
+            sessionId: values[IDENTITY_HEADERS.SESSION_ID] || undefined,
+        },
+    };
+}
+/** Removes every protected header in place (gateway ingress). */
+export function stripProtectedHeaders(headers) {
+    for (const name of PROTECTED_HEADERS)
+        delete headers[name];
+}
+//# sourceMappingURL=index.js.map

package/dist/esm/identity/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/identity/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAG5D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,OAAO,EAAE,WAAW;IACpB,UAAU,EAAE,cAAc;IAC1B,UAAU,EAAE,cAAc;IAC1B,gBAAgB,EAAE,oBAAoB;IACtC,WAAW,EAAE,eAAe;IAC5B,UAAU,EAAE,cAAc;IAC1B,UAAU,EAAE,cAAc;IAC1B,SAAS,EAAE,cAAc;IACzB,SAAS,EAAE,gBAAgB;CACnB,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,cAAc,EAAE,kBAAkB;IAClC,OAAO,EAAE,WAAW;IACpB,QAAQ,EAAE,YAAY;IACtB,SAAS,EAAE,aAAa;IACxB,eAAe,EAAE,2BAA2B;IAC5C,cAAc,EAAE,kBAAkB;CAC1B,CAAC;AAEX,0DAA0D;AAC1D,MAAM,CAAC,MAAM,iBAAiB,GAAsB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,eAAe,CAAC,eAAe,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC;AAErJ,MAAM,mBAAmB,GAAG,CAAC,GAAG,MAAM,CAAC;AAIvC,SAAS,MAAM,CAAC,OAAkB,EAAE,IAAY;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC;AAED,SAAS,SAAS,CAAC,MAA8B;IAC/C,OAAO;QACL,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC;QAClC,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC;QAChC,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC;QACnC,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC;QACnC,MAAM,CAAC,gBAAgB,CAAC,gBAAgB,CAAC;QACzC,MAAM,CAAC,gBAAgB,CAAC,WAAW,CAAC;QACpC,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC;QACnC,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC;KACpC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,KAAe,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACxD,MAAM,UAAU,GAAG,CAAC,KAAyB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACvH,MAAM,UAAU,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAEtG,SAAS,UAAU,CAAI,KAAyB,EAAE,QAAW;IAC3D,IAAI,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAM,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,mBAAmB,CAAC,IAAc,EAAE,MAAc,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IAC1F,MAAM,MAAM,GAA2B;QACrC,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC;QACzC,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE;QACnC,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;QAC/C,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QACrD,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;QACjE,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;QACvD,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QACrD,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,SAAS,IAAI,EAAE;KACpD,CAAC;IACF,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3E,OAAO,MAAM,CAAC;AAChB,CAAC;AAOD,uEAAuE;AACvE,MAAM,UAAU,qBAAqB,CAAC,OAAkB,EAAE,MAAc,EAAE,UAAgD,EAAE;IAC1H,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAE5C,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IAE/F,MAAM,SAAS,GAAG,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACxD,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,mBAAmB,CAAC,EAAE,CAAC;QAC5F,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC1D,CAAC;IAED,OAAO;QACL,MAAM,EAAE,eAAe;QACvB,IAAI,EAAE;YACJ,EAAE,EAAE,MAAM;YACV,KAAK,EAAE,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,IAAI,EAAE;YAChD,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;YACtD,WAAW,EAAE,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;YAClE,MAAM,EAAE,UAAU,CAA2B,MAAM,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;YACtF,KAAK,EAAE,UAAU,CAA0B,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACnF,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,IAAI,SAAS;SAC5D;KACF,CAAC;AACJ,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,qBAAqB,CAAC,OAAkB;IACtD,KAAK,MAAM,IAAI,IAAI,iBAAiB;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;AAC7D,CAAC"}