@heavybit/shared-lib 2.1.0 → 2.7.0

package/dist/esm/database/tables.js

@@ -0,0 +1,61 @@
+import { sql } from 'drizzle-orm';
+import { DEFAULT_OUTBOX_TABLE, DEFAULT_PROCESSED_EVENTS_TABLE, DEFAULT_SCHEDULER_RUNS_TABLE, OUTBOX_EXCHANGES, SCHEDULER_RUN_STATUSES } from './table-names.js';
+import { char, datetime, index, int, json, mysqlEnum, mysqlTable, uniqueIndex, varchar } from 'drizzle-orm/mysql-core';
+/**
+ * Drizzle definitions of the infrastructure tables every service may own. Each matches the Knex
+ * helper of the same name in `@heavybit/shared-lib/knex` (`outboxColumns`, `processedEventsColumns`,
+ * `schedulerRunsColumns`); a test keeps the two in step. Pass a custom name when a service needs one.
+ */
+const ms = (name) => datetime(name, { mode: 'date', fsp: 3 });
+const createdNow = (name) => ms(name).notNull().default(sql `CURRENT_TIMESTAMP(3)`);
+export { DEFAULT_OUTBOX_TABLE, DEFAULT_PROCESSED_EVENTS_TABLE, DEFAULT_SCHEDULER_RUNS_TABLE, OUTBOX_EXCHANGES, SCHEDULER_RUN_STATUSES };
+/** Transactional outbox (`event_outbox` by default): domain change and message in one transaction. */
+export function outboxTable(name = DEFAULT_OUTBOX_TABLE) {
+    return mysqlTable(name, {
+        id: char('id', { length: 26 }).primaryKey(),
+        routingKey: varchar('routing_key', { length: 191 }).notNull(),
+        /** Logical exchange: `events` (topic fan-out) or `commands` (direct, one owner). */
+        exchange: mysqlEnum('exchange', OUTBOX_EXCHANGES).notNull().default('events'),
+        payload: json('payload').notNull(),
+        /** Correlation id of the request that staged the row; the relay sends it as `x-correlation-id`. */
+        correlationId: varchar('correlation_id', { length: 64 }),
+        attempts: int('attempts', { unsigned: true }).notNull().default(0),
+        lastError: varchar('last_error', { length: 500 }),
+        createdAt: createdNow('created_at'),
+        publishedAt: ms('published_at'),
+    }, (t) => [index(`${name}_published_at_id_index`).on(t.publishedAt, t.id)]);
+}
+/** Consumer idempotency ledger: one row per (consumer, event id). */
+export function processedEventsTable(name = DEFAULT_PROCESSED_EVENTS_TABLE) {
+    return mysqlTable(name, {
+        id: char('id', { length: 26 }).primaryKey(),
+        consumer: varchar('consumer', { length: 191 }).notNull(),
+        eventId: varchar('event_id', { length: 64 }).notNull(),
+        processedAt: createdNow('processed_at'),
+    }, (t) => [
+        uniqueIndex(`${name}_consumer_event_id_unique`).on(t.consumer, t.eventId),
+        index(`${name}_processed_at_index`).on(t.processedAt),
+    ]);
+}
+/** Scheduled-job runs: one row per (job, run key), so a run is never executed twice. */
+export function schedulerRunsTable(name = DEFAULT_SCHEDULER_RUNS_TABLE) {
+    return mysqlTable(name, {
+        id: char('id', { length: 26 }).primaryKey(),
+        job: varchar('job', { length: 191 }).notNull(),
+        runKey: varchar('run_key', { length: 191 }).notNull(),
+        status: mysqlEnum('status', SCHEDULER_RUN_STATUSES).notNull().default('running'),
+        error: varchar('error', { length: 500 }),
+        startedAt: createdNow('started_at'),
+        finishedAt: ms('finished_at'),
+    }, (t) => [
+        uniqueIndex(`${name}_job_run_key_unique`).on(t.job, t.runKey),
+        index(`${name}_job_started_at_index`).on(t.job, t.startedAt),
+    ]);
+}
+/** `event_outbox` with the default name. */
+export const outbox = outboxTable();
+/** `processed_events` with the default name. */
+export const processedEvents = processedEventsTable();
+/** `scheduler_runs` with the default name. */
+export const schedulerRuns = schedulerRunsTable();
+//# sourceMappingURL=tables.js.map

package/dist/esm/database/tables.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tables.js","sourceRoot":"","sources":["../../../src/database/tables.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,oBAAoB,EAAE,8BAA8B,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAChK,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAEvH;;;;GAIG;AAEH,MAAM,EAAE,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;AACtE,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,sBAAsB,CAAC,CAAC;AAE3F,OAAO,EAAE,oBAAoB,EAAE,8BAA8B,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,CAAC;AASxI,sGAAsG;AACtG,MAAM,UAAU,WAAW,CAAC,IAAI,GAAG,oBAAoB;IACrD,OAAO,UAAU,CAAC,IAAI,EAAE;QACtB,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE;QAC3C,UAAU,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE;QAC7D,oFAAoF;QACpF,QAAQ,EAAE,SAAS,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC7E,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;QAClC,mGAAmG;QACnG,aAAa,EAAE,OAAO,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACxD,QAAQ,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QAClE,SAAS,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QACjD,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC;QACnC,WAAW,EAAE,EAAE,CAAC,cAAc,CAAC;KAChC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,IAAI,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,oBAAoB,CAAC,IAAI,GAAG,8BAA8B;IACxE,OAAO,UAAU,CAAC,IAAI,EAAE;QACtB,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE;QAC3C,QAAQ,EAAE,OAAO,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE;QACxD,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE;QACtD,WAAW,EAAE,UAAU,CAAC,cAAc,CAAC;KACxC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;QACR,WAAW,CAAC,GAAG,IAAI,2BAA2B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC;QACzE,KAAK,CAAC,GAAG,IAAI,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;KACtD,CAAC,CAAC;AACL,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,kBAAkB,CAAC,IAAI,GAAG,4BAA4B;IACpE,OAAO,UAAU,CAAC,IAAI,EAAE;QACtB,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE;QAC3C,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE;QAC9C,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE;QACrD,MAAM,EAAE,SAAS,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;QAChF,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QACxC,SAAS,EAAE,UAAU,CAAC,YAAY,CAAC;QACnC,UAAU,EAAE,EAAE,CAAC,aAAa,CAAC;KAC9B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;QACR,WAAW,CAAC,GAAG,IAAI,qBAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC;QAC7D,KAAK,CAAC,GAAG,IAAI,uBAAuB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC;KAC7D,CAAC,CAAC;AACL,CAAC;AAED,4CAA4C;AAC5C,MAAM,CAAC,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;AACpC,gDAAgD;AAChD,MAAM,CAAC,MAAM,eAAe,GAAG,oBAAoB,EAAE,CAAC;AACtD,8CAA8C;AAC9C,MAAM,CAAC,MAAM,aAAa,GAAG,kBAAkB,EAAE,CAAC"}

package/dist/esm/express/auth.js

@@ -1,57 +1,77 @@
 import { hasAllPermissions, hasPermission, hasRole } from '../access/index.js';
-import { safeEqual } from '../common/crypto.js';
 import { errorBody } from '../common/response.js';
 import { correlationId } from './middleware.js';
-import { CONTEXT_HEADERS, verifyIdentityHeaders } from '../identity/index.js';
-function resolveIdentity(req, options) {
-    const result = verifyIdentityHeaders(req.headers, options.secret, { maxSkewMs: options.maxSkewMs });
-    if (result.status === 'authenticated') {
-        req.user = result.user;
-        return 'ok';
-    }
-    if (result.status === 'invalid') {
-        options.logger?.warn('Rejected forged or stale gateway identity', { reason: result.reason, path: req.path });
-        return 'invalid';
-    }
-    return 'anonymous';
+import { updateRequestContext } from '../context/index.js';
+import { assertGatewaySecret, canonicalPath, verifyGatewayIdentity, } from '../identity/index.js';
+/** Collapses the user's scope id lists into the request context's `key → id` map (lists are comma-joined). */
+function contextScopes(user) {
+    return Object.fromEntries(Object.entries(user.scopes).filter(([, ids]) => ids.length).map(([key, ids]) => [key, ids.join(',')]));
 }
+function createResolver(options) {
+    const secret = assertGatewaySecret(options.secret ?? process.env.GATEWAY_SIGNING_SECRET);
+    const reject = (req, reason) => {
+        const event = { reason, method: req.method, path: canonicalPath(req.originalUrl), requestId: correlationId(req) };
+        options.logger?.warn('Rejected gateway identity', { reason, method: event.method, path: event.path });
+        if (!options.onRejected)
+            return;
+        Promise.resolve()
+            .then(() => options.onRejected?.(event, req))
+            .catch((error) => options.logger?.error('Identity onRejected hook failed', { error: error.message }));
+    };
+    return (req) => {
+        const result = verifyGatewayIdentity({
+            headers: req.headers, method: req.method, path: req.originalUrl, secret, protocol: options.protocol,
+            maxAgeMs: options.maxAgeMs, maxFutureMs: options.maxFutureMs,
+        });
+        if (result.status === 'authenticated') {
+            req.user = result.user;
+            updateRequestContext({ userId: result.user.id, scopes: contextScopes(result.user) });
+            return 'ok';
+        }
+        if (result.status === 'invalid')
+            reject(req, result.reason);
+        return result.status === 'invalid' ? 'invalid' : 'anonymous';
+    };
+}
+const unauthenticated = (req, res, message = 'Authentication required') => res.status(401).json(errorBody('UNAUTHENTICATED', message, { requestId: correlationId(req) }));
 /**
- * Requires a valid gateway-signed identity and sets `req.user`; 401 UNAUTHENTICATED (with `requestId`) otherwise.
+ * Requires a valid gateway-signed (v2) identity and sets `req.user`; 401 UNAUTHENTICATED (with `requestId`)
+ * otherwise. Also fills the request context's `userId` and `scopes` so log lines carry them.
+ * Throws at startup when the secret is missing or shorter than 32 characters.
  *
- * @param options Secret, skew window and logger.
+ * @param options Protocol, secret, replay window, logger and rejection hook.
  * @returns Express middleware.
- * @example router.use(authenticateFromGateway({ secret: config.gatewaySecret, logger }));
+ * @example router.use(authenticateFromGateway({ protocol, logger, onRejected: publishSecurityEvent }));
  */
 export function authenticateFromGateway(options) {
+    const resolve = createResolver(options);
     return (req, res, next) => {
-        if (resolveIdentity(req, options) === 'ok')
+        if (resolve(req) === 'ok')
             return next();
-        res.status(401).json(errorBody('UNAUTHENTICATED', 'Authentication required', { requestId: correlationId(req) }));
+        unauthenticated(req, res);
     };
 }
 /**
- * Attaches `req.user` when a valid identity is present and continues anonymously when none is sent.
- * A forged or stale identity is still rejected with 401, never downgraded to anonymous.
+ * Attaches `req.user` when a valid identity is present and continues anonymously when none is sent,
+ * for public routes that personalise. A forged or stale identity is still rejected with 401, never
+ * downgraded to anonymous.
  *
- * @param options Secret, skew window and logger.
+ * @param options Same as {@link authenticateFromGateway}.
  * @returns Express middleware.
- * @example router.get('/products', optionalAuthFromGateway({ secret }), controller.list);
+ * @example router.get('/items', optionalAuthFromGateway({ protocol }), controller.list);
  */
 export function optionalAuthFromGateway(options) {
+    const resolve = createResolver(options);
     return (req, res, next) => {
-        if (resolveIdentity(req, options) === 'invalid') {
-            res.status(401).json(errorBody('UNAUTHENTICATED', 'Invalid identity', { requestId: correlationId(req) }));
-            return;
-        }
+        if (resolve(req) === 'invalid')
+            return unauthenticated(req, res, 'Invalid identity');
         next();
     };
 }
 function guard(check, message = 'You do not have permission to perform this action') {
     return (req, res, next) => {
-        if (!req.user) {
-            res.status(401).json(errorBody('UNAUTHENTICATED', 'Authentication required', { requestId: correlationId(req) }));
-            return;
-        }
+        if (!req.user)
+            return unauthenticated(req, res);
         if (!check(req.user)) {
             res.status(403).json(errorBody('FORBIDDEN', message, { requestId: correlationId(req) }));
             return;
@@ -61,36 +81,30 @@ function guard(check, message = 'You do not have permission to perform this acti
 }
 /**
  * Allows callers holding any of `permissions` (401 without identity, 403 FORBIDDEN otherwise).
+ * A super admin passes every permission guard.
  *
  * @example router.post('/refunds', requirePermission('refunds.create'), controller.create);
  */
 export const requirePermission = (...permissions) => guard((u) => hasPermission(u, ...permissions));
 /**
- * Allows callers holding every one of `permissions`.
+ * Allows callers holding every one of `permissions`. Accepts a list or rest arguments.
  *
  * @example router.delete('/x/:id', requireAllPermissions('x.read', 'x.delete'), controller.remove);
  */
-export const requireAllPermissions = (...permissions) => guard((u) => hasAllPermissions(u, ...permissions));
+export const requireAllPermissions = (...permissions) => {
+    const required = permissions.flat();
+    return guard((u) => hasAllPermissions(u, ...required));
+};
 /**
- * Allows callers with any of `roles`. Prefer permissions; roles are for coarse gates only.
+ * Allows callers whose session passed the one-time-code (second factor) check; 403 FORBIDDEN otherwise.
  *
- * @example router.use('/ops', requireRole('platform_admin'));
+ * @example router.post('/security/settings', requireOtpVerified(), controller.update);
  */
-export const requireRole = (...roles) => guard((u) => hasRole(u, ...roles), 'Insufficient role');
+export const requireOtpVerified = () => guard((u) => u.otpVerified === true, 'One-time code verification is required');
 /**
- * Guards `/internal/*` routes: requires the service secret header (constant-time compare);
- * 401 UNAUTHENTICATED with `requestId` otherwise.
+ * Allows callers with any of `roles`. Prefer permissions; roles are for coarse gates only.
  *
- * @param secret The expected `x-internal-service-secret`; an empty secret rejects every call (fail closed).
- * @returns Express middleware.
- * @example router.use('/internal', requireInternalServiceSecret(config.internalSecret));
+ * @example router.use('/ops', requireRole('platform_admin'));
  */
-export function requireInternalServiceSecret(secret) {
-    return (req, res, next) => {
-        const provided = req.headers[CONTEXT_HEADERS.INTERNAL_SECRET];
-        if (typeof provided === 'string' && secret && safeEqual(provided, secret))
-            return next();
-        res.status(401).json(errorBody('UNAUTHENTICATED', 'Invalid internal service credentials', { requestId: correlationId(req) }));
-    };
-}
+export const requireRole = (...roles) => guard((u) => hasRole(u, ...roles), 'Insufficient role');
 //# sourceMappingURL=auth.js.map

package/dist/esm/express/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/express/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAsB9E,SAAS,eAAe,CAAC,GAAY,EAAE,OAA2B;IAChE,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACpG,IAAI,MAAM,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QACtC,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,2CAA2C,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7G,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAA2B;IACjE,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,IAAI,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,EAAE,CAAC;QAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,yBAAyB,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACnH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAA2B;IACjE,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,IAAI,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,kBAAkB,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YAC1G,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,KAAkC,EAAE,OAAO,GAAG,mDAAmD;IAC9G,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,yBAAyB,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YACjH,OAAO;QACT,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAG,WAAqB,EAAkB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC;AAE9H;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,WAAqB,EAAkB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC;AAEtI;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,GAAG,KAAe,EAAkB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,EAAE,mBAAmB,CAAC,CAAC;AAE3H;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAAc;IACzD,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;QAC9D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,IAAI,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QACzF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,sCAAsC,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAChI,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/express/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,mBAAmB,EAAE,aAAa,EAAE,qBAAqB,GAC1D,MAAM,sBAAsB,CAAC;AAuC9B,8GAA8G;AAC9G,SAAS,aAAa,CAAC,IAAc;IACnC,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACnI,CAAC;AAED,SAAS,cAAc,CAAC,OAA2B;IACjD,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACzF,MAAM,MAAM,GAAG,CAAC,GAAY,EAAE,MAAyB,EAAE,EAAE;QACzD,MAAM,KAAK,GAA0B,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;QACzI,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,2BAA2B,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACtG,IAAI,CAAC,OAAO,CAAC,UAAU;YAAE,OAAO;QAChC,OAAO,CAAC,OAAO,EAAE;aACd,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;aAC5C,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,iCAAiC,EAAE,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC9H,CAAC,CAAC;IACF,OAAO,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,MAAM,GAAG,qBAAqB,CAAC;YACnC,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ;YACnG,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;SAC7D,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YACtC,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;YACvB,oBAAoB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACrF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5D,OAAO,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;IAC/D,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAG,CAAC,GAAY,EAAE,GAAa,EAAE,OAAO,GAAG,yBAAyB,EAAE,EAAE,CAC3F,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AAEjG;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAA2B;IACjE,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACxC,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,EAAE,CAAC;QACzC,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5B,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAA2B;IACjE,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACxC,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,OAAO,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACrF,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,KAAkC,EAAE,OAAO,GAAG,mDAAmD;IAC9G,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,IAAI,CAAC,GAAG,CAAC,IAAI;YAAE,OAAO,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAG,WAAqB,EAAkB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC;AAE9H;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,WAAqC,EAAkB,EAAE;IAChG,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;IACpC,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC;AACzD,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAmB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,EAAE,wCAAwC,CAAC,CAAC;AAEvI;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,GAAG,KAAe,EAAkB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,EAAE,mBAAmB,CAAC,CAAC"}

package/dist/esm/express/index.js

@@ -3,4 +3,6 @@ export * from './middleware.js';
 export * from './health.js';
 export * from './security.js';
 export * from './respond.js';
+export * from './step-up.js';
+export * from './internal-caller.js';
 //# sourceMappingURL=index.js.map

package/dist/esm/express/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/express/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/express/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,sBAAsB,CAAC"}

package/dist/esm/express/internal-caller.js

@@ -0,0 +1,49 @@
+import { errorBody } from '../common/response.js';
+import { internalServiceAuthConfigFromEnv, verifyInternalCaller } from '../common/internal-service-auth.js';
+import { canonicalPath } from '../identity/index.js';
+import { correlationId } from './middleware.js';
+const isUnderPrefix = (path, prefix) => path === prefix || path.startsWith(`${prefix}/`);
+/**
+ * Builds the internal-caller guard for a service, bound to its internal path prefix and accepted credentials.
+ *
+ * @param options Path prefix, credentials and logger.
+ * @returns `{ requireInternalCaller }`.
+ * @throws Error when the prefix is not an absolute path; ConfigError when env credentials are malformed.
+ * @example
+ * const { requireInternalCaller } = createInternalCallerGuards({ pathPrefix: '/internal', logger });
+ * router.get('/internal/records/:id', requireInternalCaller(['alpha-service']), controller.get);
+ */
+export function createInternalCallerGuards(options) {
+    const prefix = options.pathPrefix.replace(/\/+$/, '');
+    if (!prefix.startsWith('/'))
+        throw new Error('createInternalCallerGuards: pathPrefix must be an absolute path such as /internal');
+    const credentials = options.credentials ?? internalServiceAuthConfigFromEnv().credentials;
+    return {
+        requireInternalCaller(allowed) {
+            if (!allowed.length)
+                throw new Error('requireInternalCaller: list at least one caller');
+            const callers = [...allowed];
+            return (req, res, next) => {
+                const path = canonicalPath(req.originalUrl);
+                const requestId = correlationId(req);
+                if (!isUnderPrefix(path, prefix)) {
+                    options.logger?.warn('Internal guard outside the internal prefix', { path });
+                    res.status(403).json(errorBody('FORBIDDEN', 'Not an internal route', { requestId }));
+                    return;
+                }
+                const verdict = verifyInternalCaller({ headers: req.headers, credentials, allowed: callers });
+                if (verdict.ok) {
+                    req.internalCaller = verdict.caller;
+                    return next();
+                }
+                options.logger?.warn('Rejected internal caller', { reason: verdict.reason, caller: verdict.caller, path });
+                if (verdict.status === 401) {
+                    res.status(401).json(errorBody('UNAUTHENTICATED', 'Invalid internal service credentials', { requestId }));
+                    return;
+                }
+                res.status(403).json(errorBody('FORBIDDEN', 'This service may not call this route', { requestId }));
+            };
+        },
+    };
+}
+//# sourceMappingURL=internal-caller.js.map

package/dist/esm/express/internal-caller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-caller.js","sourceRoot":"","sources":["../../../src/express/internal-caller.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,gCAAgC,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC5G,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAkChD,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,MAAc,EAAW,EAAE,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;AAElH;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAmC;IAC5E,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;IAClI,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,gCAAgC,EAAE,CAAC,WAAW,CAAC;IAE1F,OAAO;QACL,qBAAqB,CAAC,OAAO;YAC3B,IAAI,CAAC,OAAO,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACxF,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;YAC7B,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;gBACzD,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBAC5C,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;gBACrC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;oBACjC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,4CAA4C,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC7E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,uBAAuB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;oBACrF,OAAO;gBACT,CAAC;gBACD,MAAM,OAAO,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC9F,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;oBACf,GAAG,CAAC,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC;oBACpC,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;gBACD,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC3G,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC3B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,sCAAsC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;oBAC1G,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,sCAAsC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;YACtG,CAAC,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/esm/express/step-up.js

@@ -0,0 +1,38 @@
+import { errorBody } from '../common/response.js';
+import { DEFAULT_STEP_UP_WINDOW_MS, STEP_UP_REQUIRED_CODE, stepUpStatus, } from '../identity/step-up.js';
+import { correlationId } from './middleware.js';
+/**
+ * Builds the step-up guard for an app's catalogue. Must run after `authenticateFromGateway`, which sets
+ * `req.user.stepUpAt` only from the signed `x-step-up-at` header. Single-use proofs are consumed by the
+ * gateway; the service sees only the verified time. Throws at startup for an unknown scope or a bad window.
+ *
+ * @param options Catalogue, freshness window and clock.
+ * @returns `requireStepUp(scope, route?)` and `declaredStepUpRoutes()`.
+ * @example
+ * const { requireStepUp } = createStepUpGuards({ catalogue: stepUpScopes });
+ * router.post('/refunds/:id', requirePermission('refunds.create'), requireStepUp('refund-large', 'POST /refunds/:id'), controller.refund);
+ */
+export function createStepUpGuards(options) {
+    const windowMs = options.windowMs ?? DEFAULT_STEP_UP_WINDOW_MS;
+    if (!Number.isFinite(windowMs) || windowMs <= 0)
+        throw new Error(`createStepUpGuards: windowMs must be positive (got ${windowMs})`);
+    const now = options.now ?? Date.now;
+    const declared = [];
+    const requireStepUp = (scope, route) => {
+        const rules = options.catalogue[scope];
+        if (!rules)
+            throw new Error(`requireStepUp: unknown step-up scope "${scope}"`);
+        declared.push({ scope, singleUse: rules.singleUse === true, ...(route ? { route } : {}) });
+        return (req, res, next) => {
+            if (!req.user) {
+                res.status(401).json(errorBody('UNAUTHENTICATED', 'Authentication required', { requestId: correlationId(req) }));
+                return;
+            }
+            if (stepUpStatus(req.user.stepUpAt, windowMs, now()) === 'fresh')
+                return next();
+            res.status(403).json({ ...errorBody(STEP_UP_REQUIRED_CODE, 'Please confirm it is you to continue', { requestId: correlationId(req) }), scope });
+        };
+    };
+    return { requireStepUp, declaredStepUpRoutes: () => declared.map((entry) => ({ ...entry })) };
+}
+//# sourceMappingURL=step-up.js.map

package/dist/esm/express/step-up.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-up.js","sourceRoot":"","sources":["../../../src/express/step-up.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EACL,yBAAyB,EAAE,qBAAqB,EAAE,YAAY,GAC/D,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AA4BhD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAmB,OAA8B;IACjF,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,yBAAyB,CAAC;IAC/D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,QAAQ,GAAG,CAAC,CAAC;IACpI,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,QAAQ,GAAkC,EAAE,CAAC;IAEnD,MAAM,aAAa,GAAG,CAAC,KAAQ,EAAE,KAAc,EAAkB,EAAE;QACjE,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,KAAK,GAAG,CAAC,CAAC;QAC/E,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC3F,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;YACzD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,yBAAyB,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;gBACjH,OAAO;YACT,CAAC;YACD,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,OAAO;gBAAE,OAAO,IAAI,EAAE,CAAC;YAChF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,SAAS,CAAC,qBAAqB,EAAE,sCAAsC,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAClJ,CAAC,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;AAChG,CAAC"}

package/dist/esm/http/index.js

@@ -1,73 +1,6 @@
-import { AppError, ServiceUnavailableError } from '../common/errors.js';
-import { sleep } from '../common/async.js';
-import { CONTEXT_HEADERS } from '../identity/index.js';
-import { silentLogger } from '../logging/index.js';
-export * from './safe-fetch.js';
-const RETRYABLE_STATUS = new Set([502, 503, 504]);
-const IDEMPOTENT = new Set(['GET', 'PUT', 'DELETE']);
 /**
- * Typed client for `/internal/*` calls between services. Unwraps the `{ success, data }`
- * envelope, maps upstream errors to AppErrors with the same status, and turns network failures
- * and timeouts into 503s.
+ * Outbound HTTP helpers. Service-to-service calls use `createInternalClient` (root export); calls to
+ * tenant-supplied URLs go through the SSRF-guarded {@link createSafeFetcher}.
  */
-export function createServiceClient(options) {
-    const logger = options.logger ?? silentLogger;
-    const base = options.baseUrl.replace(/\/+$/, '');
-    async function request(method, path, opts = {}) {
-        const url = new URL(base + path);
-        for (const [key, value] of Object.entries(opts.query ?? {}))
-            if (value !== undefined)
-                url.searchParams.set(key, String(value));
-        const retries = IDEMPOTENT.has(method) ? options.retries ?? 2 : 0;
-        for (let attempt = 0;; attempt += 1) {
-            const controller = new AbortController();
-            const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? options.timeoutMs ?? 5000);
-            try {
-                const response = await fetch(url, {
-                    method,
-                    signal: controller.signal,
-                    headers: {
-                        accept: 'application/json',
-                        ...(opts.body !== undefined ? { 'content-type': 'application/json' } : {}),
-                        [CONTEXT_HEADERS.INTERNAL_SECRET]: options.internalSecret,
-                        [CONTEXT_HEADERS.CALLER_SERVICE]: options.callerService,
-                        ...(opts.correlationId ? { [CONTEXT_HEADERS.CORRELATION_ID]: opts.correlationId } : {}),
-                        ...opts.headers,
-                    },
-                    body: opts.body !== undefined ? JSON.stringify(opts.body) : undefined,
-                });
-                if (RETRYABLE_STATUS.has(response.status) && attempt < retries) {
-                    await sleep(200 * 2 ** attempt);
-                    continue;
-                }
-                const text = await response.text();
-                const payload = text ? JSON.parse(text) : { success: response.ok, message: '' };
-                if (!response.ok) {
-                    throw new AppError(response.status, payload.message || `Upstream error ${response.status}`, { code: payload.code, errors: payload.errors });
-                }
-                return (payload.data ?? payload);
-            }
-            catch (error) {
-                if (error instanceof AppError)
-                    throw error;
-                if (attempt < retries) {
-                    await sleep(200 * 2 ** attempt);
-                    continue;
-                }
-                logger.warn('Internal call failed', { method, url: url.pathname, error: error.message });
-                throw new ServiceUnavailableError('Upstream service unavailable', { cause: error });
-            }
-            finally {
-                clearTimeout(timer);
-            }
-        }
-    }
-    return {
-        get: (path, opts) => request('GET', path, opts),
-        post: (path, opts) => request('POST', path, opts),
-        put: (path, opts) => request('PUT', path, opts),
-        patch: (path, opts) => request('PATCH', path, opts),
-        delete: (path, opts) => request('DELETE', path, opts),
-    };
-}
+export * from './safe-fetch.js';
 //# sourceMappingURL=index.js.map

package/dist/esm/http/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/http/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGnD,cAAc,iBAAiB,CAAC;AA8BhC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAClD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;AAErD;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAA6B;IAC/D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC;IAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAEjD,KAAK,UAAU,OAAO,CAAI,MAAc,EAAE,IAAY,EAAE,OAAuB,EAAE;QAC/E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QACjC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAAE,IAAI,KAAK,KAAK,SAAS;gBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/H,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAElE,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,IAAI,CAAC,EAAE,CAAC;YACrC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC;YAChG,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;oBAChC,MAAM;oBACN,MAAM,EAAE,UAAU,CAAC,MAAM;oBACzB,OAAO,EAAE;wBACP,MAAM,EAAE,kBAAkB;wBAC1B,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC1E,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC,cAAc;wBACzD,CAAC,eAAe,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC,aAAa;wBACvD,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACvF,GAAG,IAAI,CAAC,OAAO;qBAChB;oBACD,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;iBACtE,CAAC,CAAC;gBACH,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,GAAG,OAAO,EAAE,CAAC;oBAC/D,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC;oBAChC,SAAS;gBACX,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACnC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAoB,CAAC,CAAC,CAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,EAAqB,CAAC;gBACxH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,IAAI,kBAAkB,QAAQ,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC9I,CAAC;gBACD,OAAO,CAAC,OAAO,CAAC,IAAI,IAAK,OAAmB,CAAM,CAAC;YACrD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,QAAQ;oBAAE,MAAM,KAAK,CAAC;gBAC3C,IAAI,OAAO,GAAG,OAAO,EAAE,CAAC;oBACtB,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC;oBAChC,SAAS;gBACX,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;gBACpG,MAAM,IAAI,uBAAuB,CAAC,8BAA8B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACtF,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC;QAC/C,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC;QACjD,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC;QAC/C,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;QACnD,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC;KACtD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/http/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,cAAc,iBAAiB,CAAC"}