@heavybit/shared-lib 1.3.2 → 2.7.0

package/dist/esm/cache/keyspace.js

@@ -0,0 +1,95 @@
+import { createHash, createHmac } from 'node:crypto';
+import { ConfigError, isDeployedNodeEnv } from '../config/index.js';
+/** Environment segment used outside staging and production when none is given. */
+export const DEFAULT_KEY_ENV = 'dev';
+/** Parts longer than this are hashed. */
+export const MAX_PLAIN_KEY_PART_LENGTH = 64;
+/** Marker that starts every hashed part. */
+export const HASHED_PART_PREFIX = 'h.';
+const SEGMENT_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+const EMAIL_LIKE = /@/;
+const PHONE_LIKE = /^\+?\d{9,15}$/;
+function assertSegment(kind, value) {
+    if (!SEGMENT_PATTERN.test(value))
+        throw new ConfigError(`Redis keyspace: invalid ${kind} "${value}" (lower-case kebab-case [a-z0-9-] only)`);
+    return value;
+}
+/**
+ * Marks a key part as personal data or a secret so the keyspace always hashes it.
+ *
+ * @param value Raw value (e.g. an email address or a token).
+ * @returns A part the keyspace hashes.
+ * @example ks.key('otp', sensitivePart(email))
+ */
+export const sensitivePart = (value) => ({ sensitive: value });
+/**
+ * Percent-encodes a plain key part, including the glob characters SCAN interprets.
+ *
+ * @param value Part text (non-empty).
+ * @returns The encoded part.
+ * @throws ConfigError when the part is empty.
+ * @example encodeKeyPart('a:b*') // 'a%3Ab%2A'
+ */
+export function encodeKeyPart(value) {
+    if (!value)
+        throw new ConfigError('Redis keyspace: key parts must not be empty');
+    return encodeURIComponent(value).replace(/[*?[\]!'()]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+function hashValue(value, secret) {
+    const digest = secret ? createHmac('sha256', secret).update(value).digest('hex') : createHash('sha256').update(value).digest('hex');
+    return `${HASHED_PART_PREFIX}${digest}`;
+}
+function shouldHash(value) {
+    return value.length > MAX_PLAIN_KEY_PART_LENGTH || EMAIL_LIKE.test(value) || PHONE_LIKE.test(value) || value.startsWith(HASHED_PART_PREFIX);
+}
+function renderPart(part, secret) {
+    if (typeof part === 'object') {
+        if (!part.sensitive)
+            throw new ConfigError('Redis keyspace: key parts must not be empty');
+        return hashValue(part.sensitive, secret);
+    }
+    const value = String(part);
+    return shouldHash(value) ? hashValue(value, secret) : encodeKeyPart(value);
+}
+function resolveEnv(env, nodeEnv) {
+    const explicit = env?.trim();
+    if (explicit)
+        return assertSegment('env', explicit);
+    if (isDeployedNodeEnv(nodeEnv))
+        throw new ConfigError(`Redis keyspace: CACHE_KEY_PREFIX must be set when NODE_ENV=${(nodeEnv ?? '').trim()}`);
+    return DEFAULT_KEY_ENV;
+}
+/**
+ * Creates the keyspace for one service.
+ *
+ * @param options App slug, service, env segment (`CACHE_KEY_PREFIX`), optional hash secret.
+ * @returns A {@link RedisKeyspace}.
+ * @throws ConfigError on an invalid segment, or when `env` is missing in staging/production.
+ * @example
+ * const ks = createRedisKeyspace({ app: 'myapp', service: 'widget-service', env: config.CACHE_KEY_PREFIX });
+ * ks.key('widget', widgetId) // 'myapp:prod:widget-service:widget:01J…'
+ */
+export function createRedisKeyspace(options) {
+    const app = assertSegment('app', options.app);
+    const service = assertSegment('service', options.service);
+    const env = resolveEnv(options.env, options.nodeEnv ?? process.env.NODE_ENV);
+    const prefix = `${app}:${env}:${service}:`;
+    const secret = options.hashSecret;
+    return Object.freeze({
+        app,
+        env,
+        service,
+        prefix,
+        key(purpose, ...parts) {
+            const head = `${prefix}${assertSegment('purpose', purpose)}`;
+            return (parts.length ? `${head}:${parts.map((p) => renderPart(p, secret)).join(':')}` : head);
+        },
+        pattern(purpose, suffix = '*') {
+            return `${prefix}${assertSegment('purpose', purpose)}:${suffix}`;
+        },
+        owns(key) {
+            return key.startsWith(prefix) && key.length > prefix.length;
+        },
+    });
+}
+//# sourceMappingURL=keyspace.js.map

package/dist/esm/cache/keyspace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyspace.js","sourceRoot":"","sources":["../../../src/cache/keyspace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAuDpE,kFAAkF;AAClF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,CAAC;AACrC,yCAAyC;AACzC,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAC5C,4CAA4C;AAC5C,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEvC,MAAM,eAAe,GAAG,4BAA4B,CAAC;AACrD,MAAM,UAAU,GAAG,GAAG,CAAC;AACvB,MAAM,UAAU,GAAG,eAAe,CAAC;AAEnC,SAAS,aAAa,CAAC,IAAY,EAAE,KAAa;IAChD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,2BAA2B,IAAI,KAAK,KAAK,0CAA0C,CAAC,CAAC;IAC7I,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAa,EAAoB,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;AAEzF;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,WAAW,CAAC,6CAA6C,CAAC,CAAC;IACjF,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AACpH,CAAC;AAED,SAAS,SAAS,CAAC,KAAa,EAAE,MAAe;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpI,OAAO,GAAG,kBAAkB,GAAG,MAAM,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,MAAM,GAAG,yBAAyB,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;AAC9I,CAAC;AAED,SAAS,UAAU,CAAC,IAAkB,EAAE,MAAe;IACrD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,WAAW,CAAC,6CAA6C,CAAC,CAAC;QAC1F,OAAO,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,UAAU,CAAC,GAAuB,EAAE,OAA2B;IACtE,MAAM,QAAQ,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IAC7B,IAAI,QAAQ;QAAE,OAAO,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACpD,IAAI,iBAAiB,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,8DAA8D,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC9I,OAAO,eAAe,CAAC;AACzB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAA6B;IAC/D,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAElC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG;QACH,GAAG;QACH,OAAO;QACP,MAAM;QACN,GAAG,CAAC,OAAe,EAAE,GAAG,KAAqB;YAC3C,MAAM,IAAI,GAAG,GAAG,MAAM,GAAG,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;YAC7D,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAa,CAAC;QAC5G,CAAC;QACD,OAAO,CAAC,OAAe,EAAE,MAAM,GAAG,GAAG;YACnC,OAAO,GAAG,MAAM,GAAG,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,MAAM,EAAE,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,GAAW;YACd,OAAO,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9D,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/esm/common/circuit-breaker.js

@@ -0,0 +1,70 @@
+/**
+ * A minimal in-process circuit breaker for outbound calls.
+ *
+ * Layer: plumbing. States: `closed` (calls flow) → `open` after `failureThreshold` consecutive failures
+ * (calls are refused without touching the network) → `half-open` once `resetAfterMs` has passed, when exactly
+ * one trial call is let through: success closes the circuit, failure re-opens it for another `resetAfterMs`.
+ * State is per instance (per process), so each client owns its breaker; nothing is shared between targets.
+ */
+/**
+ * Counts consecutive failures and refuses calls while open.
+ *
+ * @example
+ * const breaker = new CircuitBreaker({ failureThreshold: 5, resetAfterMs: 30_000 });
+ * if (!breaker.tryAcquire()) throw new TargetUnavailableError();
+ * try { const r = await call(); breaker.onSuccess(); return r; } catch (e) { breaker.onFailure(); throw e; }
+ */
+export class CircuitBreaker {
+    failureThreshold;
+    resetAfterMs;
+    now;
+    failures = 0;
+    openedAt = 0;
+    current = 'closed';
+    trialInFlight = false;
+    /** @param options Threshold, reset time and clock. @throws Error when a setting is not a positive number. */
+    constructor(options = {}) {
+        this.failureThreshold = options.failureThreshold ?? 5;
+        this.resetAfterMs = options.resetAfterMs ?? 30_000;
+        this.now = options.now ?? Date.now;
+        if (!(this.failureThreshold >= 1) || !(this.resetAfterMs > 0))
+            throw new Error('CircuitBreaker: failureThreshold must be ≥ 1 and resetAfterMs > 0');
+    }
+    /** The current state (an open circuit whose reset time has passed reports `half-open`). */
+    get state() {
+        if (this.current === 'open' && this.now() - this.openedAt >= this.resetAfterMs)
+            return 'half-open';
+        return this.current;
+    }
+    /**
+     * Asks to make a call. While half-open only the first caller gets the trial; the rest are refused until it settles.
+     *
+     * @returns True when the call may go ahead; the caller must then report {@link onSuccess} or {@link onFailure}.
+     */
+    tryAcquire() {
+        const state = this.state;
+        if (state === 'closed')
+            return true;
+        if (state === 'open' || this.trialInFlight)
+            return false;
+        this.current = 'half-open';
+        this.trialInFlight = true;
+        return true;
+    }
+    /** Records a successful call: closes the circuit and clears the failure count. */
+    onSuccess() {
+        this.failures = 0;
+        this.trialInFlight = false;
+        this.current = 'closed';
+    }
+    /** Records a failed call: a failed trial re-opens at once; otherwise opens after `failureThreshold` in a row. */
+    onFailure() {
+        this.failures += 1;
+        if (this.current === 'half-open' || this.failures >= this.failureThreshold) {
+            this.current = 'open';
+            this.openedAt = this.now();
+        }
+        this.trialInFlight = false;
+    }
+}
+//# sourceMappingURL=circuit-breaker.js.map

package/dist/esm/common/circuit-breaker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"circuit-breaker.js","sourceRoot":"","sources":["../../../src/common/circuit-breaker.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAeH;;;;;;;GAOG;AACH,MAAM,OAAO,cAAc;IACR,gBAAgB,CAAS;IACzB,YAAY,CAAS;IACrB,GAAG,CAAe;IAC3B,QAAQ,GAAG,CAAC,CAAC;IACb,QAAQ,GAAG,CAAC,CAAC;IACb,OAAO,GAAiB,QAAQ,CAAC;IACjC,aAAa,GAAG,KAAK,CAAC;IAE9B,6GAA6G;IAC7G,YAAY,UAAiC,EAAE;QAC7C,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,MAAM,CAAC;QACnD,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACtJ,CAAC;IAED,2FAA2F;IAC3F,IAAI,KAAK;QACP,IAAI,IAAI,CAAC,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,YAAY;YAAE,OAAO,WAAW,CAAC;QACnG,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;;;OAIG;IACH,UAAU;QACR,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,IAAI,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,KAAK,KAAK,MAAM,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,KAAK,CAAC;QACzD,IAAI,CAAC,OAAO,GAAG,WAAW,CAAC;QAC3B,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kFAAkF;IAClF,SAAS;QACP,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;QAClB,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;QAC3B,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC;IAC1B,CAAC;IAED,iHAAiH;IACjH,SAAS;QACP,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;QACnB,IAAI,IAAI,CAAC,OAAO,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3E,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;YACtB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,CAAC;QACD,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;IAC7B,CAAC;CACF"}

package/dist/esm/common/errors.js

@@ -2,6 +2,12 @@
  * Base class for errors that map to an HTTP status. Throw these from services; the shared
  * error middleware turns them into the standard envelope. Anything that is not an AppError is
  * reported as a 500 with a generic message so internals never leak.
+ *
+ * @param statusCode HTTP status. 4xx messages reach the caller; 5xx messages never do.
+ * @param message Caller-facing message (4xx) or log message (5xx).
+ * @param options `code` (defaults from the status), field `errors`, `retryable` (consumers),
+ *   `retryAfterSeconds` (sent as `Retry-After`) and `cause`.
+ * @example throw new AppError(402, 'Payment is required first', { code: 'PAYMENT_REQUIRED' });
  */
 export class AppError extends Error {
     statusCode;
@@ -9,6 +15,8 @@ export class AppError extends Error {
     errors;
     /** Consumers dead-letter immediately instead of retrying when this is false. */
     retryable;
+    /** Seconds the caller should wait before retrying; the error middleware sends it as `Retry-After`. */
+    retryAfterSeconds;
     constructor(statusCode, message, options = {}) {
         super(message, options.cause ? { cause: options.cause } : undefined);
         this.name = new.target.name;
@@ -16,8 +24,22 @@ export class AppError extends Error {
         this.code = options.code ?? defaultCode(statusCode);
         this.errors = options.errors;
         this.retryable = options.retryable ?? statusCode >= 500;
+        this.retryAfterSeconds = options.retryAfterSeconds;
     }
 }
+/**
+ * Shorthand for an error with an explicit status and code.
+ *
+ * @param statusCode HTTP status (4xx messages reach the caller; 5xx are replaced with a generic message).
+ * @param code UPPER_SNAKE_CASE machine-readable code, e.g. `SLUG_TAKEN`.
+ * @param message Human-readable message for 4xx responses.
+ * @param errors Optional field errors (`{ 'items.0.qty': ['Must be positive'] }`).
+ * @returns An {@link AppError} to `throw`.
+ * @example throw httpError(409, 'SLUG_TAKEN', 'That address is already in use');
+ */
+export function httpError(statusCode, code, message, errors) {
+    return new AppError(statusCode, message, { code, errors });
+}
 function defaultCode(status) {
     switch (status) {
         case 400: return 'BAD_REQUEST';
@@ -31,27 +53,35 @@ function defaultCode(status) {
         default: return status >= 500 ? 'INTERNAL_ERROR' : 'ERROR';
     }
 }
+/** 400 BAD_REQUEST: the request is malformed or breaks a business rule. */
 export class BadRequestError extends AppError {
     constructor(message = 'Bad request', options = {}) { super(400, message, options); }
 }
+/** 401 UNAUTHENTICATED: no valid identity. */
 export class UnauthorizedError extends AppError {
     constructor(message = 'Authentication required', options = {}) { super(401, message, options); }
 }
+/** 403 FORBIDDEN: authenticated, but not allowed. */
 export class ForbiddenError extends AppError {
     constructor(message = 'You do not have permission to perform this action', options = {}) { super(403, message, options); }
 }
+/** 404 NOT_FOUND. Also use it for out-of-scope resources so their existence is not revealed. */
 export class NotFoundError extends AppError {
     constructor(message = 'Resource not found', options = {}) { super(404, message, options); }
 }
+/** 409 CONFLICT: duplicate or state conflict. */
 export class ConflictError extends AppError {
     constructor(message = 'Resource already exists', options = {}) { super(409, message, options); }
 }
+/** 422 VALIDATION_FAILED with field errors (`{ 'items.0.qty': ['…'] }`). */
 export class ValidationError extends AppError {
     constructor(errors, message = 'Validation failed') { super(422, message, { errors }); }
 }
+/** 429. Pass `retryAfterSeconds` so the error middleware sets the `Retry-After` header. */
 export class TooManyRequestsError extends AppError {
     constructor(message = 'Too many requests. Please try again later.', options = {}) { super(429, message, options); }
 }
+/** 503 SERVICE_UNAVAILABLE: a dependency is down. The message is logged, never sent (callers see the generic one). */
 export class ServiceUnavailableError extends AppError {
     constructor(message = 'Service temporarily unavailable', options = {}) { super(503, message, options); }
 }
@@ -61,15 +91,23 @@ export class NonRetryableError extends AppError {
         super(422, message, { ...options, retryable: false });
     }
 }
+/** Type guard for {@link AppError} (and its subclasses). */
 export function isAppError(error) {
     return error instanceof AppError;
 }
-/** Message safe to show a caller; hides internals for unexpected errors. */
+/** The message every 5xx response carries. */
+export const GENERIC_ERROR_MESSAGE = 'Internal server error';
+/**
+ * Message safe to show a caller. Only 4xx AppErrors keep their own message; every 5xx (including
+ * 503s, whose messages often name upstreams or RPC methods) and every non-AppError get the generic one.
+ *
+ * @param error Anything thrown.
+ * @returns The message to put in the response body.
+ * @example publicMessage(new NotFoundError('Order not found')) // 'Order not found'
+ */
 export function publicMessage(error) {
     if (isAppError(error) && error.statusCode < 500)
         return error.message;
-    if (isAppError(error) && error.statusCode === 503)
-        return error.message;
-    return 'Internal server error';
+    return GENERIC_ERROR_MESSAGE;
 }
 //# sourceMappingURL=errors.js.map

package/dist/esm/common/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/common/errors.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,OAAO,QAAS,SAAQ,KAAK;IACxB,UAAU,CAAS;IACnB,IAAI,CAAS;IACb,MAAM,CAAgB;IAC/B,gFAAgF;IACvE,SAAS,CAAU;IAE5B,YAAY,UAAkB,EAAE,OAAe,EAAE,UAA0F,EAAE;QAC3I,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,IAAI,GAAG,CAAC;IAC1D,CAAC;CACF;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,GAAG,CAAC,CAAC,OAAO,aAAa,CAAC;QAC/B,KAAK,GAAG,CAAC,CAAC,OAAO,iBAAiB,CAAC;QACnC,KAAK,GAAG,CAAC,CAAC,OAAO,WAAW,CAAC;QAC7B,KAAK,GAAG,CAAC,CAAC,OAAO,WAAW,CAAC;QAC7B,KAAK,GAAG,CAAC,CAAC,OAAO,UAAU,CAAC;QAC5B,KAAK,GAAG,CAAC,CAAC,OAAO,mBAAmB,CAAC;QACrC,KAAK,GAAG,CAAC,CAAC,OAAO,cAAc,CAAC;QAChC,KAAK,GAAG,CAAC,CAAC,OAAO,qBAAqB,CAAC;QACvC,OAAO,CAAC,CAAC,OAAO,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,MAAM,OAAO,eAAgB,SAAQ,QAAQ;IAC3C,YAAY,OAAO,GAAG,aAAa,EAAE,UAAoD,EAAE,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;CAC/H;AACD,MAAM,OAAO,iBAAkB,SAAQ,QAAQ;IAC7C,YAAY,OAAO,GAAG,yBAAyB,EAAE,UAA6B,EAAE,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;CACpH;AACD,MAAM,OAAO,cAAe,SAAQ,QAAQ;IAC1C,YAAY,OAAO,GAAG,mDAAmD,EAAE,UAA6B,EAAE,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;CAC9I;AACD,MAAM,OAAO,aAAc,SAAQ,QAAQ;IACzC,YAAY,OAAO,GAAG,oBAAoB,EAAE,UAA6B,EAAE,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;CAC/G;AACD,MAAM,OAAO,aAAc,SAAQ,QAAQ;IACzC,YAAY,OAAO,GAAG,yBAAyB,EAAE,UAAoD,EAAE,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;CAC3I;AACD,MAAM,OAAO,eAAgB,SAAQ,QAAQ;IAC3C,YAAY,MAAoB,EAAE,OAAO,GAAG,mBAAmB,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;CACtG;AACD,MAAM,OAAO,oBAAqB,SAAQ,QAAQ;IAChD,YAAY,OAAO,GAAG,4CAA4C,EAAE,UAA6B,EAAE,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;CACvI;AACD,MAAM,OAAO,uBAAwB,SAAQ,QAAQ;IACnD,YAAY,OAAO,GAAG,iCAAiC,EAAE,UAA8C,EAAE,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;CAC7I;AAED,qFAAqF;AACrF,MAAM,OAAO,iBAAkB,SAAQ,QAAQ;IAC7C,YAAY,OAAe,EAAE,UAA8C,EAAE;QAC3E,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACxD,CAAC;CACF;AAED,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,OAAO,KAAK,YAAY,QAAQ,CAAC;AACnC,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,GAAG,GAAG;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IACtE,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IACxE,OAAO,uBAAuB,CAAC;AACjC,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/common/errors.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AACH,MAAM,OAAO,QAAS,SAAQ,KAAK;IACxB,UAAU,CAAS;IACnB,IAAI,CAAS;IACb,MAAM,CAAgB;IAC/B,gFAAgF;IACvE,SAAS,CAAU;IAC5B,sGAAsG;IAC7F,iBAAiB,CAAU;IAEpC,YAAY,UAAkB,EAAE,OAAe,EAAE,UAA2B,EAAE;QAC5E,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,IAAI,GAAG,CAAC;QACxD,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IACrD,CAAC;CACF;AAWD;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CAAC,UAAkB,EAAE,IAAY,EAAE,OAAe,EAAE,MAAqB;IAChG,OAAO,IAAI,QAAQ,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,GAAG,CAAC,CAAC,OAAO,aAAa,CAAC;QAC/B,KAAK,GAAG,CAAC,CAAC,OAAO,iBAAiB,CAAC;QACnC,KAAK,GAAG,CAAC,CAAC,OAAO,WAAW,CAAC;QAC7B,KAAK,GAAG,CAAC,CAAC,OAAO,WAAW,CAAC;QAC7B,KAAK,GAAG,CAAC,CAAC,OAAO,UAAU,CAAC;QAC5B,KAAK,GAAG,CAAC,CAAC,OAAO,mBAAmB,CAAC;QACrC,KAAK,GAAG,CAAC,CAAC,OAAO,cAAc,CAAC;QAChC,KAAK,GAAG,CAAC,CAAC,OAAO,qBAAqB,CAAC;QACvC,OAAO,CAAC,CAAC,OAAO,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,MAAM,OAAO,eAAgB,SAAQ,QAAQ;IAC3C,YAAY,OAAO,GAAG,aAAa,EAAE,UAAoD,EAAE,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;CAC/H;AACD,8CAA8C;AAC9C,MAAM,OAAO,iBAAkB,SAAQ,QAAQ;IAC7C,YAAY,OAAO,GAAG,yBAAyB,EAAE,UAA6B,EAAE,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;CACpH;AACD,qDAAqD;AACrD,MAAM,OAAO,cAAe,SAAQ,QAAQ;IAC1C,YAAY,OAAO,GAAG,mDAAmD,EAAE,UAA6B,EAAE,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;CAC9I;AACD,gGAAgG;AAChG,MAAM,OAAO,aAAc,SAAQ,QAAQ;IACzC,YAAY,OAAO,GAAG,oBAAoB,EAAE,UAA6B,EAAE,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;CAC/G;AACD,iDAAiD;AACjD,MAAM,OAAO,aAAc,SAAQ,QAAQ;IACzC,YAAY,OAAO,GAAG,yBAAyB,EAAE,UAAoD,EAAE,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;CAC3I;AACD,4EAA4E;AAC5E,MAAM,OAAO,eAAgB,SAAQ,QAAQ;IAC3C,YAAY,MAAoB,EAAE,OAAO,GAAG,mBAAmB,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;CACtG;AACD,2FAA2F;AAC3F,MAAM,OAAO,oBAAqB,SAAQ,QAAQ;IAChD,YAAY,OAAO,GAAG,4CAA4C,EAAE,UAAyD,EAAE,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;CACnK;AACD,sHAAsH;AACtH,MAAM,OAAO,uBAAwB,SAAQ,QAAQ;IACnD,YAAY,OAAO,GAAG,iCAAiC,EAAE,UAA8C,EAAE,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;CAC7I;AAED,qFAAqF;AACrF,MAAM,OAAO,iBAAkB,SAAQ,QAAQ;IAC7C,YAAY,OAAe,EAAE,UAA8C,EAAE;QAC3E,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACxD,CAAC;CACF;AAED,4DAA4D;AAC5D,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,OAAO,KAAK,YAAY,QAAQ,CAAC;AACnC,CAAC;AAED,8CAA8C;AAC9C,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AAE7D;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,GAAG,GAAG;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IACtE,OAAO,qBAAqB,CAAC;AAC/B,CAAC"}

package/dist/esm/common/index.js

@@ -7,6 +7,10 @@ export * from './jwt.js';
 export * from './text.js';
 export * from './async.js';
 export * from './phone.js';
+export * from './money.js';
 export * from './time.js';
 export * from './audit.js';
+export * from './circuit-breaker.js';
+export * from './internal-service-auth.js';
+export * from './internal-client.js';
 //# sourceMappingURL=index.js.map

package/dist/esm/common/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/common/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/common/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,sBAAsB,CAAC;AACrC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC"}

package/dist/esm/common/internal-client.js

@@ -0,0 +1,173 @@
+import { sleep } from './async.js';
+import { CircuitBreaker } from './circuit-breaker.js';
+import { AppError, ServiceUnavailableError } from './errors.js';
+import { internalServiceAuthConfigFromEnv, internalServiceHeaders } from './internal-service-auth.js';
+import { ConfigError } from '../config/index.js';
+import { getRequestContext } from '../context/index.js';
+import { CONTEXT_HEADERS } from '../identity/index.js';
+const unavailableClasses = new Map();
+const pascalCase = (value) => value.split(/[^A-Za-z0-9]+/).filter(Boolean).map((part) => part[0].toUpperCase() + part.slice(1)).join('');
+/**
+ * Returns the `{Target}UnavailableError` class for a target service (the same class on every call, so
+ * `instanceof` works anywhere in the process).
+ *
+ * @param target The target service name, e.g. `records-service`.
+ * @returns A class named e.g. `RecordsServiceUnavailableError`, extending `ServiceUnavailableError` (503).
+ * @example
+ * const RecordsUnavailable = makeUnavailableError('records-service');
+ * try { await records.get('/records/1'); } catch (e) { if (e instanceof RecordsUnavailable) useCachedCopy(); }
+ */
+export function makeUnavailableError(target) {
+    const existing = unavailableClasses.get(target);
+    if (existing)
+        return existing;
+    const TargetUnavailableError = class extends ServiceUnavailableError {
+        target = target;
+        constructor(message = `${target} is unavailable`, options = {}) {
+            super(message, { cause: options.cause });
+        }
+    };
+    // AppError takes `name` from the constructor, so naming the class names every instance.
+    Object.defineProperty(TargetUnavailableError, 'name', { value: `${pascalCase(target)}UnavailableError` });
+    unavailableClasses.set(target, TargetUnavailableError);
+    return TargetUnavailableError;
+}
+const RETRYABLE_METHODS = new Set(['GET']);
+const RETRYABLE_STATUS = new Set([502, 503, 504]);
+/** Why an attempt counted as unavailable; logged, never sent to the end user. */
+class AttemptFailure extends Error {
+    reason;
+    retryable;
+    constructor(reason, retryable, options) {
+        super(reason, options);
+        this.reason = reason;
+        this.retryable = retryable;
+    }
+}
+/**
+ * Creates a client for one target service.
+ *
+ * @param options Target, base URL, caller credential, timeout, retry, breaker and logger settings.
+ * @returns An {@link InternalClient}.
+ * @throws ConfigError when the caller name or credential is missing.
+ * @example
+ * // src/clients/records.client.ts
+ * const http = createInternalClient({ target: 'records-service', baseUrl: config.RECORDS_INTERNAL_URL, logger });
+ * export const getRecord = (id: string) => http.get(`/records/${id}`, { schema: recordSchema });
+ */
+export function createInternalClient(options) {
+    const caller = options.caller ?? (() => {
+        const env = internalServiceAuthConfigFromEnv();
+        return { name: env.name, secret: env.credential };
+    })();
+    if (!caller.name || !caller.secret) {
+        throw new ConfigError(`createInternalClient(${options.target}): INTERNAL_SERVICE_NAME and INTERNAL_SERVICE_CREDENTIAL are required`);
+    }
+    const UnavailableError = makeUnavailableError(options.target);
+    const breaker = new CircuitBreaker(options.breaker);
+    const doFetch = options.fetch ?? fetch;
+    const base = options.baseUrl.replace(/\/+$/, '');
+    const backoff = options.backoffMs?.length ? options.backoffMs : [100, 400];
+    const buildUrl = (path, query) => {
+        const url = new URL(base + (path.startsWith('/') ? path : `/${path}`));
+        for (const [key, value] of Object.entries(query ?? {}))
+            if (value !== undefined)
+                url.searchParams.set(key, String(value));
+        return url;
+    };
+    const buildHeaders = (opts) => {
+        const correlationId = opts.correlationId ?? getRequestContext()?.correlationId;
+        return {
+            accept: 'application/json',
+            ...(opts.body !== undefined ? { 'content-type': 'application/json' } : {}),
+            ...opts.identityHeaders,
+            ...(correlationId ? { [CONTEXT_HEADERS.CORRELATION_ID]: correlationId } : {}),
+            ...(opts.idempotencyKey ? { [CONTEXT_HEADERS.IDEMPOTENCY_KEY]: opts.idempotencyKey } : {}),
+            // Last, so nothing passed in can replace the caller's own credential.
+            ...internalServiceHeaders(caller),
+        };
+    };
+    /** One HTTP attempt: resolves with status + body text for any answer below 500, throws AttemptFailure otherwise. */
+    const attempt = async (method, url, init, timeoutMs) => {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), timeoutMs);
+        try {
+            const response = await doFetch(url, { ...init, method, signal: controller.signal });
+            const text = await response.text();
+            if (response.status >= 500)
+                throw new AttemptFailure(`status ${response.status}`, RETRYABLE_STATUS.has(response.status));
+            return { status: response.status, text };
+        }
+        catch (error) {
+            if (error instanceof AttemptFailure)
+                throw error;
+            throw new AttemptFailure(controller.signal.aborted ? 'timeout' : 'network error', true, { cause: error });
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    };
+    /** Runs attempts with GET-only retries; throws AttemptFailure when the target never answered below 500. */
+    const send = async (method, url, init, timeoutMs) => {
+        const retries = RETRYABLE_METHODS.has(method) ? options.retries ?? 2 : 0;
+        for (let n = 0;; n += 1) {
+            try {
+                return await attempt(method, url, init, timeoutMs);
+            }
+            catch (error) {
+                const failure = error;
+                if (!failure.retryable || n >= retries)
+                    throw failure;
+                await sleep(backoff[Math.min(n, backoff.length - 1)] ?? 0);
+            }
+        }
+    };
+    const unavailable = (method, url, reason, cause) => {
+        options.logger?.warn('Internal call unavailable', { target: options.target, method, path: url.pathname, reason });
+        return new UnavailableError(`${options.target} unavailable: ${reason}`, { cause });
+    };
+    async function request(method, path, opts = {}) {
+        const url = buildUrl(path, opts.query);
+        if (!breaker.tryAcquire())
+            throw unavailable(method, url, 'circuit open');
+        const init = { headers: buildHeaders(opts), body: opts.body !== undefined ? JSON.stringify(opts.body) : undefined };
+        let answer;
+        try {
+            answer = await send(method, url, init, opts.timeoutMs ?? options.timeoutMs ?? 3000);
+        }
+        catch (error) {
+            breaker.onFailure();
+            throw unavailable(method, url, error.reason, error);
+        }
+        breaker.onSuccess();
+        let payload = {};
+        try {
+            payload = answer.text ? JSON.parse(answer.text) : {};
+        }
+        catch (error) {
+            // A 4xx without a JSON body still maps to a plain AppError below; a 2xx must be readable.
+            if (answer.status < 400)
+                throw unavailable(method, url, 'unreadable response body', error);
+        }
+        if (answer.status >= 400) {
+            throw new AppError(answer.status, payload.message || `${options.target} rejected the request`, { code: payload.code, errors: payload.errors });
+        }
+        if (!opts.schema)
+            return payload.data;
+        const parsed = opts.schema.safeParse(payload.data);
+        if (!parsed.success)
+            throw unavailable(method, url, 'response did not match the expected schema', parsed.error);
+        return parsed.data;
+    }
+    return {
+        target: options.target,
+        UnavailableError,
+        get circuitState() { return breaker.state; },
+        get: (path, opts) => request('GET', path, opts),
+        post: (path, opts) => request('POST', path, opts),
+        put: (path, opts) => request('PUT', path, opts),
+        patch: (path, opts) => request('PATCH', path, opts),
+        delete: (path, opts) => request('DELETE', path, opts),
+    };
+}
+//# sourceMappingURL=internal-client.js.map

package/dist/esm/common/internal-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-client.js","sourceRoot":"","sources":["../../../src/common/internal-client.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,cAAc,EAAiD,MAAM,sBAAsB,CAAC;AACrG,OAAO,EAAE,QAAQ,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,gCAAgC,EAAE,sBAAsB,EAAiC,MAAM,4BAA4B,CAAC;AACrI,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAMvD,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAiC,CAAC;AAEpE,MAAM,UAAU,GAAG,CAAC,KAAa,EAAU,EAAE,CAC3C,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAE9G;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,sBAAsB,GAAG,KAAM,SAAQ,uBAAuB;QACzD,MAAM,GAAG,MAAM,CAAC;QACzB,YAAY,OAAO,GAAG,GAAG,MAAM,iBAAiB,EAAE,UAA+B,EAAE;YACjF,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAC3C,CAAC;KACF,CAAC;IACF,wFAAwF;IACxF,MAAM,CAAC,cAAc,CAAC,sBAAsB,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAC1G,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IACvD,OAAO,sBAAsB,CAAC;AAChC,CAAC;AAuED,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAC3C,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAElD,iFAAiF;AACjF,MAAM,cAAe,SAAQ,KAAK;IACX;IAAyB;IAA9C,YAAqB,MAAc,EAAW,SAAkB,EAAE,OAA6B;QAAI,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAArG,WAAM,GAAN,MAAM,CAAQ;QAAW,cAAS,GAAT,SAAS,CAAS;IAA2D,CAAC;CAC7H;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAA8B;IACjE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE;QACrC,MAAM,GAAG,GAAG,gCAAgC,EAAE,CAAC;QAC/C,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;IACpD,CAAC,CAAC,EAAE,CAAC;IACL,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,IAAI,WAAW,CAAC,wBAAwB,OAAO,CAAC,MAAM,uEAAuE,CAAC,CAAC;IACvI,CAAC;IACD,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAE3E,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,KAAsC,EAAO,EAAE;QAC7E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;QACvE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;YAAE,IAAI,KAAK,KAAK,SAAS;gBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1H,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,CAAC,IAA4B,EAA0B,EAAE;QAC5E,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,iBAAiB,EAAE,EAAE,aAAa,CAAC;QAC/E,OAAO;YACL,MAAM,EAAE,kBAAkB;YAC1B,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,GAAG,IAAI,CAAC,eAAe;YACvB,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1F,sEAAsE;YACtE,GAAG,sBAAsB,CAAC,MAAM,CAAC;SAClC,CAAC;IACJ,CAAC,CAAC;IAEF,oHAAoH;IACpH,MAAM,OAAO,GAAG,KAAK,EAAE,MAAc,EAAE,GAAQ,EAAE,IAAiB,EAAE,SAAiB,EAA6C,EAAE;QAClI,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;QAC9D,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;YACpF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG;gBAAE,MAAM,IAAI,cAAc,CAAC,UAAU,QAAQ,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACzH,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,cAAc;gBAAE,MAAM,KAAK,CAAC;YACjD,MAAM,IAAI,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5G,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC,CAAC;IAEF,2GAA2G;IAC3G,MAAM,IAAI,GAAG,KAAK,EAAE,MAAc,EAAE,GAAQ,EAAE,IAAiB,EAAE,SAAiB,EAAE,EAAE;QACpF,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzE,KAAK,IAAI,CAAC,GAAG,CAAC,GAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,OAAO,MAAM,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,KAAuB,CAAC;gBACxC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,IAAI,OAAO;oBAAE,MAAM,OAAO,CAAC;gBACtD,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,GAAQ,EAAE,MAAc,EAAE,KAAe,EAAE,EAAE;QAChF,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,2BAA2B,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAClH,OAAO,IAAI,gBAAgB,CAAC,GAAG,OAAO,CAAC,MAAM,iBAAiB,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACrF,CAAC,CAAC;IAEF,KAAK,UAAU,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,OAAkC,EAAE;QAC1F,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE;YAAE,MAAM,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;QAC1E,MAAM,IAAI,GAAgB,EAAE,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QACjI,IAAI,MAAwC,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC;QACtF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,WAAW,CAAC,MAAM,EAAE,GAAG,EAAG,KAAwB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,CAAC,SAAS,EAAE,CAAC;QAEpB,IAAI,OAAO,GAAkC,EAAE,CAAC;QAChD,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAA0B,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,0FAA0F;YAC1F,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG;gBAAE,MAAM,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,0BAA0B,EAAE,KAAK,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YACzB,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,IAAI,GAAG,OAAO,CAAC,MAAM,uBAAuB,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACjJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC,IAAS,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,4CAA4C,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAChH,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,gBAAgB;QAChB,IAAI,YAAY,KAAK,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5C,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC;QAC/C,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC;QACjD,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC;QAC/C,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;QACnD,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC;KACtD,CAAC;AACJ,CAAC"}

package/dist/esm/common/internal-constants.js

@@ -0,0 +1,9 @@
+/**
+ * Leaf constants for internal-service auth, shared by `common/internal-service-auth` and the `config` env blocks
+ * (kept dependency-free so neither module imports the other).
+ */
+/** Shortest internal credential accepted in staging and production. */
+export const MIN_INTERNAL_CREDENTIAL_LENGTH = 32;
+/** Service names are compose-style: lower-case letters, digits and hyphens, starting with a letter. */
+export const SERVICE_NAME_PATTERN = /^[a-z][a-z0-9-]{0,62}$/;
+//# sourceMappingURL=internal-constants.js.map

package/dist/esm/common/internal-constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-constants.js","sourceRoot":"","sources":["../../../src/common/internal-constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,uEAAuE;AACvE,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,CAAC;AACjD,uGAAuG;AACvG,MAAM,CAAC,MAAM,oBAAoB,GAAG,wBAAwB,CAAC"}