@heyatom/bastion-client 0.1.0 → 0.1.2

package/README.md

@@ -6,7 +6,7 @@ Replaces the `src/modules/bastion/` boilerplate every service used to copy by ha
 - `@heyatom/bastion-client` — framework-free core: `JwksVerifier` (kid-indexed cache, unknown-kid refetch with cooldown, stale-on-error), `BastionHttp` (`POST /auth/client`, `POST /events`, any other route), `ServiceTokenProvider` (single-flight refresh ahead of `exp`), payload types.
 - `@heyatom/bastion-client/nest` — NestJS: `BastionModule`, `ServiceClientJwtGuard`, `BastionUserGuard`, `BastionAuditService`, `AuditInterceptor`, `@Public()`, `@RequireScope()`, `@Audit()`, `@CurrentClient()`, `@CurrentAdminUser()`.
 
-Ships CJS and ESM. Peer deps: `jose` (always), `@nestjs/common`, `@nestjs/core`, `rxjs`, `reflect-metadata` (for `/nest`).
+Ships CJS and ESM. `jose` v6 is ESM-only, so the CJS build relies on Node's `require(esm)` — Node ≥ 20.19 / 22.12. Peer deps: `jose` (always), `@nestjs/common`, `@nestjs/core`, `rxjs`, `reflect-metadata` (for `/nest`).
 
 ## NestJS
 
@@ -77,4 +77,4 @@ await http.writeAuditEvent(await tokens.getToken(), { event: 'thing.done' });
 
 ## Release
 
-Bump `version`, tag `vX.Y.Z`, push the tag. The workflow runs lint/test/build/DI smoke and publishes with provenance (`NPM_TOKEN` secret).
+Bump `version`, tag `vX.Y.Z`, push the tag. The workflow runs lint/test/build/DI smoke and publishes via npm trusted publishing (OIDC, no token; provenance implied).

package/dist/cjs/nest/guards/service-client-jwt.guard.js

@@ -49,8 +49,8 @@ let ServiceClientJwtGuard = class ServiceClientJwtGuard {
         if (payload.serviceSlug !== this.options.serviceSlug) {
             throw new common_1.ForbiddenException('Token not issued for this service');
         }
-        const required = this.reflector.getAllAndOverride(require_scope_decorator_js_1.REQUIRED_SCOPES_KEY, targets) ?? [];
-        const missing = required.filter((s) => !payload.scopes?.includes(s));
+        const required = this.reflector.getAllAndOverride(require_scope_decorator_js_1.REQUIRED_SCOPES_KEY, targets);
+        const missing = (Array.isArray(required) ? required : []).filter((s) => !payload.scopes?.includes(s));
         if (missing.length)
             throw new common_1.ForbiddenException(`Missing scope: ${missing.join(', ')}`);
         req.user = payload;

package/dist/cjs/nest/options.d.ts

@@ -19,6 +19,6 @@ export interface BastionModuleOptions {
     acceptedRoles?: string[];
 }
 export interface BastionModuleAsyncOptions extends Pick<ModuleMetadata, 'imports'> {
-    useFactory: (...args: unknown[]) => BastionModuleOptions | Promise<BastionModuleOptions>;
+    useFactory: (...args: any[]) => BastionModuleOptions | Promise<BastionModuleOptions>;
     inject?: unknown[];
 }

package/dist/esm/nest/guards/service-client-jwt.guard.js

@@ -46,8 +46,8 @@ let ServiceClientJwtGuard = class ServiceClientJwtGuard {
         if (payload.serviceSlug !== this.options.serviceSlug) {
             throw new ForbiddenException('Token not issued for this service');
         }
-        const required = this.reflector.getAllAndOverride(REQUIRED_SCOPES_KEY, targets) ?? [];
-        const missing = required.filter((s) => !payload.scopes?.includes(s));
+        const required = this.reflector.getAllAndOverride(REQUIRED_SCOPES_KEY, targets);
+        const missing = (Array.isArray(required) ? required : []).filter((s) => !payload.scopes?.includes(s));
         if (missing.length)
             throw new ForbiddenException(`Missing scope: ${missing.join(', ')}`);
         req.user = payload;

package/dist/esm/nest/options.d.ts

@@ -19,6 +19,6 @@ export interface BastionModuleOptions {
     acceptedRoles?: string[];
 }
 export interface BastionModuleAsyncOptions extends Pick<ModuleMetadata, 'imports'> {
-    useFactory: (...args: unknown[]) => BastionModuleOptions | Promise<BastionModuleOptions>;
+    useFactory: (...args: any[]) => BastionModuleOptions | Promise<BastionModuleOptions>;
     inject?: unknown[];
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heyatom/bastion-client",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Consumer SDK for the Bastion identity provider: JWKS verification, service-client auth, audit writes, NestJS guards",
   "license": "MIT",
   "author": "Andrea Tombolato <hey@heyatom.dev> (https://heyatom.dev)",
@@ -37,8 +37,15 @@
       }
     }
   },
+  "scripts": {
+    "build": "rm -rf dist && tsc -p tsconfig.cjs.json && tsc -p tsconfig.esm.json && echo '{\"type\":\"module\"}' > dist/esm/package.json",
+    "test": "vitest run",
+    "lint": "tsc -p tsconfig.json --noEmit",
+    "prepublishOnly": "pnpm lint && pnpm test && pnpm build && pnpm test:di",
+    "test:di": "node scripts/di-smoke.cjs"
+  },
   "engines": {
-    "node": ">=20"
+    "node": ">=20.19"
   },
   "peerDependencies": {
     "@nestjs/common": "^11.0.0",
@@ -71,10 +78,14 @@
     "typescript": "^5.9.3",
     "vitest": "^3.2.4"
   },
-  "scripts": {
-    "build": "rm -rf dist && tsc -p tsconfig.cjs.json && tsc -p tsconfig.esm.json && echo '{\"type\":\"module\"}' > dist/esm/package.json",
-    "test": "vitest run",
-    "lint": "tsc -p tsconfig.json --noEmit",
-    "test:di": "node scripts/di-smoke.cjs"
+  "typesVersions": {
+    "*": {
+      "nest": [
+        "./dist/cjs/nest/index.d.ts"
+      ],
+      "*": [
+        "./dist/cjs/core/index.d.ts"
+      ]
+    }
   }
-}
+}