@heyatom/bastion-client 0.1.0

package/dist/esm/nest/bastion.module.js

@@ -0,0 +1,57 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var BastionModule_1;
+import { Global, Module } from '@nestjs/common';
+import { BASTION_OPTIONS } from './options.js';
+import { BastionJwksService } from './bastion-jwks.service.js';
+import { BastionService } from './bastion.service.js';
+import { BastionAuditService } from './bastion-audit.service.js';
+import { ServiceClientJwtGuard } from './guards/service-client-jwt.guard.js';
+import { BastionUserGuard } from './guards/bastion-user.guard.js';
+import { AuditInterceptor } from './interceptors/audit.interceptor.js';
+const PROVIDERS = [
+    BastionJwksService,
+    BastionService,
+    BastionAuditService,
+    ServiceClientJwtGuard,
+    BastionUserGuard,
+    AuditInterceptor,
+];
+/**
+ * ```ts
+ * BastionModule.forRootAsync({
+ *   inject: [ConfigService],
+ *   useFactory: (config: ConfigService) => ({
+ *     baseUrl: config.getOrThrow('BASTION_URL'),
+ *     serviceSlug: config.getOrThrow('BASTION_APP_SLUG'),
+ *     apiKey: config.get('BASTION_CLIENT_API_KEY'),
+ *   }),
+ * })
+ * ```
+ * Global: import once in `AppModule`, inject anywhere.
+ */
+let BastionModule = BastionModule_1 = class BastionModule {
+    static forRoot(options) {
+        return this.build({ provide: BASTION_OPTIONS, useValue: options });
+    }
+    static forRootAsync(options) {
+        return this.build({ provide: BASTION_OPTIONS, useFactory: options.useFactory, inject: options.inject }, options.imports);
+    }
+    static build(optionsProvider, imports = []) {
+        return {
+            module: BastionModule_1,
+            imports,
+            providers: [optionsProvider, ...PROVIDERS],
+            exports: [BASTION_OPTIONS, ...PROVIDERS],
+        };
+    }
+};
+BastionModule = BastionModule_1 = __decorate([
+    Global(),
+    Module({})
+], BastionModule);
+export { BastionModule };

package/dist/esm/nest/bastion.service.d.ts

@@ -0,0 +1,18 @@
+import { BastionHttp } from '../core/bastion-http.js';
+import type { AuditEventInput, TokenResponse } from '../core/types.js';
+import { type BastionModuleOptions } from './options.js';
+/** Outbound HTTP to Bastion. A non-2xx answer surfaces as `HttpException` with Bastion's status. */
+export declare class BastionService {
+    private readonly options;
+    readonly http: BastionHttp;
+    constructor(options: BastionModuleOptions);
+    call<T>(method: string, path: string, body?: unknown, init?: {
+        token?: string;
+        headers?: Record<string, string>;
+    }): Promise<T>;
+    clientAuth(): Promise<TokenResponse>;
+    writeAuditEvent(token: string, data: AuditEventInput): Promise<{
+        id: string;
+        createdAt: string;
+    }>;
+}

package/dist/esm/nest/bastion.service.js

@@ -0,0 +1,54 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { HttpException, Inject, Injectable } from '@nestjs/common';
+import { BastionHttp } from '../core/bastion-http.js';
+import { BastionHttpError } from '../core/errors.js';
+import { BASTION_OPTIONS } from './options.js';
+/** Outbound HTTP to Bastion. A non-2xx answer surfaces as `HttpException` with Bastion's status. */
+let BastionService = class BastionService {
+    options;
+    http;
+    constructor(options) {
+        this.options = options;
+        this.http = new BastionHttp({ baseUrl: options.baseUrl });
+    }
+    async call(method, path, body, init) {
+        try {
+            return await this.http.call(method, path, body, init);
+        }
+        catch (err) {
+            if (err instanceof BastionHttpError)
+                throw new HttpException(err.message, err.status);
+            throw err;
+        }
+    }
+    clientAuth() {
+        if (!this.options.apiKey) {
+            throw new Error('BastionModule: apiKey is required for clientAuth()');
+        }
+        return this.call('POST', '/auth/client', {
+            apiKey: this.options.apiKey,
+            serviceSlug: this.options.serviceSlug,
+            ...(this.options.tenantSlug ? { tenantSlug: this.options.tenantSlug } : {}),
+        });
+    }
+    writeAuditEvent(token, data) {
+        return this.call('POST', '/events', data, { token });
+    }
+};
+BastionService = __decorate([
+    Injectable(),
+    __param(0, Inject(BASTION_OPTIONS)),
+    __metadata("design:paramtypes", [Object])
+], BastionService);
+export { BastionService };

package/dist/esm/nest/decorators/audit.decorator.d.ts

@@ -0,0 +1,15 @@
+export declare const AUDIT_EVENT_KEY = "bastion:auditEvent";
+export interface AuditRequest {
+    params: Record<string, string>;
+    body: unknown;
+}
+export interface AuditOptions {
+    /** Builds the metadata from the handler's result and the request. Errors here are logged, never propagated. */
+    metadata?: (result: unknown, req: AuditRequest) => Record<string, unknown>;
+}
+export interface AuditDescriptor {
+    event: string;
+    options: AuditOptions;
+}
+/** Writes `event` (attributed to the admin user on the request) after the handler succeeds. Needs `AuditInterceptor`. */
+export declare const Audit: (event: string, options?: AuditOptions) => import("@nestjs/common").CustomDecorator<string>;

package/dist/esm/nest/decorators/audit.decorator.js

@@ -0,0 +1,4 @@
+import { SetMetadata } from '@nestjs/common';
+export const AUDIT_EVENT_KEY = 'bastion:auditEvent';
+/** Writes `event` (attributed to the admin user on the request) after the handler succeeds. Needs `AuditInterceptor`. */
+export const Audit = (event, options = {}) => SetMetadata(AUDIT_EVENT_KEY, { event, options });

package/dist/esm/nest/decorators/current-user.decorator.d.ts

@@ -0,0 +1,4 @@
+/** The machine token payload set by `ServiceClientJwtGuard`. */
+export declare const CurrentClient: (...dataOrPipes: unknown[]) => ParameterDecorator;
+/** The user payload set by `BastionUserGuard`. */
+export declare const CurrentAdminUser: (...dataOrPipes: unknown[]) => ParameterDecorator;

package/dist/esm/nest/decorators/current-user.decorator.js

@@ -0,0 +1,5 @@
+import { createParamDecorator } from '@nestjs/common';
+/** The machine token payload set by `ServiceClientJwtGuard`. */
+export const CurrentClient = createParamDecorator((_, ctx) => ctx.switchToHttp().getRequest().user);
+/** The user payload set by `BastionUserGuard`. */
+export const CurrentAdminUser = createParamDecorator((_, ctx) => ctx.switchToHttp().getRequest().adminUser);

package/dist/esm/nest/decorators/public.decorator.d.ts

@@ -0,0 +1,3 @@
+export declare const IS_PUBLIC_KEY = "isPublic";
+/** Exempts a route (or a whole controller) from `ServiceClientJwtGuard`. */
+export declare const Public: () => import("@nestjs/common").CustomDecorator<string>;

package/dist/esm/nest/decorators/public.decorator.js

@@ -0,0 +1,4 @@
+import { SetMetadata } from '@nestjs/common';
+export const IS_PUBLIC_KEY = 'isPublic';
+/** Exempts a route (or a whole controller) from `ServiceClientJwtGuard`. */
+export const Public = () => SetMetadata(IS_PUBLIC_KEY, true);

package/dist/esm/nest/decorators/require-scope.decorator.d.ts

@@ -0,0 +1,3 @@
+export declare const REQUIRED_SCOPES_KEY = "bastion:requiredScopes";
+/** Scopes the machine token must carry to reach this route (all of them). Checked by `ServiceClientJwtGuard`. */
+export declare const RequireScope: (...scopes: string[]) => import("@nestjs/common").CustomDecorator<string>;

package/dist/esm/nest/decorators/require-scope.decorator.js

@@ -0,0 +1,4 @@
+import { SetMetadata } from '@nestjs/common';
+export const REQUIRED_SCOPES_KEY = 'bastion:requiredScopes';
+/** Scopes the machine token must carry to reach this route (all of them). Checked by `ServiceClientJwtGuard`. */
+export const RequireScope = (...scopes) => SetMetadata(REQUIRED_SCOPES_KEY, scopes);

package/dist/esm/nest/guards/bastion-user.guard.d.ts

@@ -0,0 +1,20 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { BastionJwksService } from '../bastion-jwks.service.js';
+import { BastionAuditService } from '../bastion-audit.service.js';
+import { type BastionModuleOptions } from '../options.js';
+/**
+ * Admin-surface guard: accepts a *user* token from one of `acceptedAppSlugs`
+ * (the console, typically) with one of `acceptedRoles`. Sets `req.adminUser`.
+ * A denial is audited as `admin.access_denied`, rate-limited per (app, reason)
+ * so a misconfigured console cannot flood the log.
+ */
+export declare class BastionUserGuard implements CanActivate {
+    private readonly jwks;
+    private readonly audit;
+    private readonly acceptedAppSlugs;
+    private readonly acceptedRoles;
+    private readonly reportedAt;
+    constructor(jwks: BastionJwksService, audit: BastionAuditService, options: BastionModuleOptions);
+    canActivate(ctx: ExecutionContext): Promise<boolean>;
+    private reportAccessDenied;
+}

package/dist/esm/nest/guards/bastion-user.guard.js

@@ -0,0 +1,84 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { ForbiddenException, Inject, Injectable, UnauthorizedException, } from '@nestjs/common';
+import { isServiceClientToken } from '../../core/types.js';
+import { BastionJwksService } from '../bastion-jwks.service.js';
+import { BastionAuditService } from '../bastion-audit.service.js';
+import { BASTION_OPTIONS } from '../options.js';
+const ACCESS_DENIED_COOLDOWN_MS = 5 * 60 * 1000;
+const ACCESS_DENIED_MAX_KEYS = 50;
+const DEFAULT_ACCEPTED_APP_SLUGS = ['meridian'];
+const DEFAULT_ACCEPTED_ROLES = ['ADMIN', 'OWNER', 'SUPER_ADMIN'];
+/**
+ * Admin-surface guard: accepts a *user* token from one of `acceptedAppSlugs`
+ * (the console, typically) with one of `acceptedRoles`. Sets `req.adminUser`.
+ * A denial is audited as `admin.access_denied`, rate-limited per (app, reason)
+ * so a misconfigured console cannot flood the log.
+ */
+let BastionUserGuard = class BastionUserGuard {
+    jwks;
+    audit;
+    acceptedAppSlugs;
+    acceptedRoles;
+    reportedAt = new Map();
+    constructor(jwks, audit, options) {
+        this.jwks = jwks;
+        this.audit = audit;
+        this.acceptedAppSlugs = options.acceptedAppSlugs ?? DEFAULT_ACCEPTED_APP_SLUGS;
+        this.acceptedRoles = options.acceptedRoles ?? DEFAULT_ACCEPTED_ROLES;
+    }
+    async canActivate(ctx) {
+        const req = ctx.switchToHttp().getRequest();
+        const auth = req.headers['authorization'];
+        if (!auth?.startsWith('Bearer '))
+            throw new UnauthorizedException('Missing token');
+        const payload = await this.jwks.verify(auth.slice(7));
+        if (isServiceClientToken(payload))
+            throw new UnauthorizedException('Service client token not allowed');
+        if (!this.acceptedAppSlugs.includes(payload.appSlug)) {
+            this.reportAccessDenied('app_not_allowed', payload, req);
+            throw new ForbiddenException('App not allowed');
+        }
+        if (!this.acceptedRoles.includes(payload.role ?? '')) {
+            this.reportAccessDenied('role_insufficient', payload, req);
+            throw new ForbiddenException('Insufficient role');
+        }
+        req.adminUser = payload;
+        return true;
+    }
+    reportAccessDenied(reason, user, req) {
+        const key = `${user.appSlug}:${reason}`;
+        const now = Date.now();
+        const last = this.reportedAt.get(key);
+        if (last !== undefined && now - last < ACCESS_DENIED_COOLDOWN_MS)
+            return;
+        if (this.reportedAt.size >= ACCESS_DENIED_MAX_KEYS)
+            this.reportedAt.clear();
+        this.reportedAt.set(key, now);
+        void this.audit.write('admin.access_denied', {
+            metadata: {
+                reason,
+                appSlug: user.appSlug,
+                role: user.role ?? 'none',
+                path: req.originalUrl ?? req.url ?? 'unknown',
+            },
+        });
+    }
+};
+BastionUserGuard = __decorate([
+    Injectable(),
+    __param(2, Inject(BASTION_OPTIONS)),
+    __metadata("design:paramtypes", [BastionJwksService,
+        BastionAuditService, Object])
+], BastionUserGuard);
+export { BastionUserGuard };

package/dist/esm/nest/guards/service-client-jwt.guard.d.ts

@@ -0,0 +1,17 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { BastionJwksService } from '../bastion-jwks.service.js';
+import { type BastionModuleOptions } from '../options.js';
+/**
+ * Machine-to-machine guard, meant as the global `APP_GUARD`: every route needs
+ * a `service_client` token issued for this service (`serviceSlug` from the
+ * module options, never hard-coded) unless it carries `@Public()`.
+ * `@RequireScope()` adds a per-route scope check. The payload lands on `req.user`.
+ */
+export declare class ServiceClientJwtGuard implements CanActivate {
+    private readonly jwks;
+    private readonly reflector;
+    private readonly options;
+    constructor(jwks: BastionJwksService, reflector: Reflector, options: BastionModuleOptions);
+    canActivate(ctx: ExecutionContext): Promise<boolean>;
+}

package/dist/esm/nest/guards/service-client-jwt.guard.js

@@ -0,0 +1,63 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { ForbiddenException, Inject, Injectable, UnauthorizedException, } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { isServiceClientToken } from '../../core/types.js';
+import { BastionJwksService } from '../bastion-jwks.service.js';
+import { BASTION_OPTIONS } from '../options.js';
+import { IS_PUBLIC_KEY } from '../decorators/public.decorator.js';
+import { REQUIRED_SCOPES_KEY } from '../decorators/require-scope.decorator.js';
+/**
+ * Machine-to-machine guard, meant as the global `APP_GUARD`: every route needs
+ * a `service_client` token issued for this service (`serviceSlug` from the
+ * module options, never hard-coded) unless it carries `@Public()`.
+ * `@RequireScope()` adds a per-route scope check. The payload lands on `req.user`.
+ */
+let ServiceClientJwtGuard = class ServiceClientJwtGuard {
+    jwks;
+    reflector;
+    options;
+    constructor(jwks, reflector, options) {
+        this.jwks = jwks;
+        this.reflector = reflector;
+        this.options = options;
+    }
+    async canActivate(ctx) {
+        const targets = [ctx.getHandler(), ctx.getClass()];
+        if (this.reflector.getAllAndOverride(IS_PUBLIC_KEY, targets))
+            return true;
+        const req = ctx.switchToHttp().getRequest();
+        const auth = req.headers['authorization'];
+        if (!auth?.startsWith('Bearer '))
+            throw new UnauthorizedException('Missing token');
+        const payload = await this.jwks.verify(auth.slice(7));
+        if (!isServiceClientToken(payload))
+            throw new UnauthorizedException('Not a service client token');
+        if (payload.serviceSlug !== this.options.serviceSlug) {
+            throw new ForbiddenException('Token not issued for this service');
+        }
+        const required = this.reflector.getAllAndOverride(REQUIRED_SCOPES_KEY, targets) ?? [];
+        const missing = required.filter((s) => !payload.scopes?.includes(s));
+        if (missing.length)
+            throw new ForbiddenException(`Missing scope: ${missing.join(', ')}`);
+        req.user = payload;
+        return true;
+    }
+};
+ServiceClientJwtGuard = __decorate([
+    Injectable(),
+    __param(2, Inject(BASTION_OPTIONS)),
+    __metadata("design:paramtypes", [BastionJwksService,
+        Reflector, Object])
+], ServiceClientJwtGuard);
+export { ServiceClientJwtGuard };

package/dist/esm/nest/index.d.ts

@@ -0,0 +1,14 @@
+export * from '../core/index.js';
+export { BastionModule } from './bastion.module.js';
+export { BASTION_OPTIONS, type BastionModuleOptions, type BastionModuleAsyncOptions } from './options.js';
+export { BastionJwksService } from './bastion-jwks.service.js';
+export { BastionService } from './bastion.service.js';
+export { BastionAuditService } from './bastion-audit.service.js';
+export { ServiceClientJwtGuard } from './guards/service-client-jwt.guard.js';
+export { BastionUserGuard } from './guards/bastion-user.guard.js';
+export { AuditInterceptor } from './interceptors/audit.interceptor.js';
+export { Public, IS_PUBLIC_KEY } from './decorators/public.decorator.js';
+export { RequireScope, REQUIRED_SCOPES_KEY } from './decorators/require-scope.decorator.js';
+export { Audit, AUDIT_EVENT_KEY, type AuditOptions, type AuditRequest, type AuditDescriptor } from './decorators/audit.decorator.js';
+export { CurrentClient, CurrentAdminUser } from './decorators/current-user.decorator.js';
+export { resolveTenantScope, CROSS_TENANT_ROLE } from './tenant-scope.js';

package/dist/esm/nest/index.js

@@ -0,0 +1,14 @@
+export * from '../core/index.js';
+export { BastionModule } from './bastion.module.js';
+export { BASTION_OPTIONS } from './options.js';
+export { BastionJwksService } from './bastion-jwks.service.js';
+export { BastionService } from './bastion.service.js';
+export { BastionAuditService } from './bastion-audit.service.js';
+export { ServiceClientJwtGuard } from './guards/service-client-jwt.guard.js';
+export { BastionUserGuard } from './guards/bastion-user.guard.js';
+export { AuditInterceptor } from './interceptors/audit.interceptor.js';
+export { Public, IS_PUBLIC_KEY } from './decorators/public.decorator.js';
+export { RequireScope, REQUIRED_SCOPES_KEY } from './decorators/require-scope.decorator.js';
+export { Audit, AUDIT_EVENT_KEY } from './decorators/audit.decorator.js';
+export { CurrentClient, CurrentAdminUser } from './decorators/current-user.decorator.js';
+export { resolveTenantScope, CROSS_TENANT_ROLE } from './tenant-scope.js';

package/dist/esm/nest/interceptors/audit.interceptor.d.ts

@@ -0,0 +1,12 @@
+import { CallHandler, ExecutionContext, NestInterceptor } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { Observable } from 'rxjs';
+import { BastionAuditService } from '../bastion-audit.service.js';
+/** Pairs with `@Audit()`: after a handler succeeds, writes the event attributed to `req.adminUser`. */
+export declare class AuditInterceptor implements NestInterceptor {
+    private readonly reflector;
+    private readonly audit;
+    private readonly logger;
+    constructor(reflector: Reflector, audit: BastionAuditService);
+    intercept(ctx: ExecutionContext, next: CallHandler): Observable<unknown>;
+}

package/dist/esm/nest/interceptors/audit.interceptor.js

@@ -0,0 +1,48 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var AuditInterceptor_1;
+import { Injectable, Logger } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { tap } from 'rxjs';
+import { BastionAuditService } from '../bastion-audit.service.js';
+import { AUDIT_EVENT_KEY } from '../decorators/audit.decorator.js';
+/** Pairs with `@Audit()`: after a handler succeeds, writes the event attributed to `req.adminUser`. */
+let AuditInterceptor = AuditInterceptor_1 = class AuditInterceptor {
+    reflector;
+    audit;
+    logger = new Logger(AuditInterceptor_1.name);
+    constructor(reflector, audit) {
+        this.reflector = reflector;
+        this.audit = audit;
+    }
+    intercept(ctx, next) {
+        const descriptor = this.reflector.get(AUDIT_EVENT_KEY, ctx.getHandler());
+        if (!descriptor)
+            return next.handle();
+        const req = ctx.switchToHttp().getRequest();
+        return next.handle().pipe(tap((result) => {
+            let metadata;
+            try {
+                metadata = descriptor.options.metadata?.(result, req) ?? {};
+            }
+            catch (err) {
+                this.logger.warn(`audit metadata builder failed event=${descriptor.event}: ${err.message}`);
+                return;
+            }
+            void this.audit.writeAsAdmin(descriptor.event, req.adminUser, metadata);
+        }));
+    }
+};
+AuditInterceptor = AuditInterceptor_1 = __decorate([
+    Injectable(),
+    __metadata("design:paramtypes", [Reflector,
+        BastionAuditService])
+], AuditInterceptor);
+export { AuditInterceptor };

package/dist/esm/nest/nest-logger.d.ts

@@ -0,0 +1,2 @@
+import type { BastionLogger } from '../core/types.js';
+export declare function nestLogger(context: string): BastionLogger;

package/dist/esm/nest/nest-logger.js

@@ -0,0 +1,9 @@
+import { Logger } from '@nestjs/common';
+export function nestLogger(context) {
+    const logger = new Logger(context);
+    return {
+        warn: (m) => logger.warn(m),
+        error: (m) => logger.error(m),
+        log: (m) => logger.log(m),
+    };
+}

package/dist/esm/nest/options.d.ts

@@ -0,0 +1,24 @@
+import type { ModuleMetadata } from '@nestjs/common';
+export declare const BASTION_OPTIONS: unique symbol;
+export interface BastionModuleOptions {
+    /** `BASTION_URL` — base URL, e.g. `http://bastion:3001`. */
+    baseUrl: string;
+    /** `BASTION_APP_SLUG` — this service's App slug. Machine tokens must carry it as `serviceSlug`. */
+    serviceSlug: string;
+    /** `BASTION_CLIENT_API_KEY` — needed for outbound calls (audit writes). Optional for verify-only consumers. */
+    apiKey?: string;
+    /** Required by Bastion when the app is `isGlobal` or registered in more than one tenant. */
+    tenantSlug?: string;
+    /** `BASTION_JWKS_TTL_MS`, default 300 000. */
+    jwksTtlMs?: number;
+    /** Expected `iss`. Default `'bastion'`; `null` disables the check. */
+    issuer?: string | null;
+    /** `BastionUserGuard`: which apps' user tokens are accepted. Default `['meridian']`. */
+    acceptedAppSlugs?: string[];
+    /** `BastionUserGuard`: which roles are accepted. Default `['ADMIN', 'OWNER', 'SUPER_ADMIN']`. */
+    acceptedRoles?: string[];
+}
+export interface BastionModuleAsyncOptions extends Pick<ModuleMetadata, 'imports'> {
+    useFactory: (...args: unknown[]) => BastionModuleOptions | Promise<BastionModuleOptions>;
+    inject?: unknown[];
+}

package/dist/esm/nest/options.js

@@ -0,0 +1 @@
+export const BASTION_OPTIONS = Symbol('BASTION_OPTIONS');

package/dist/esm/nest/tenant-scope.d.ts

@@ -0,0 +1,4 @@
+import type { UserJwtPayload } from '../core/types.js';
+export declare const CROSS_TENANT_ROLE = "SUPER_ADMIN";
+/** The tenant a console user may read: their own, or the requested one if they are SUPER_ADMIN. */
+export declare function resolveTenantScope(user: UserJwtPayload, requested?: string): string | undefined;

package/dist/esm/nest/tenant-scope.js

@@ -0,0 +1,10 @@
+import { ForbiddenException } from '@nestjs/common';
+export const CROSS_TENANT_ROLE = 'SUPER_ADMIN';
+/** The tenant a console user may read: their own, or the requested one if they are SUPER_ADMIN. */
+export function resolveTenantScope(user, requested) {
+    if (user.role === CROSS_TENANT_ROLE)
+        return requested;
+    if (!user.tenantId)
+        throw new ForbiddenException('Token without tenant scope');
+    return user.tenantId;
+}

package/dist/esm/package.json

@@ -0,0 +1 @@
+{"type":"module"}

package/package.json

@@ -0,0 +1,80 @@
+{
+  "name": "@heyatom/bastion-client",
+  "version": "0.1.0",
+  "description": "Consumer SDK for the Bastion identity provider: JWKS verification, service-client auth, audit writes, NestJS guards",
+  "license": "MIT",
+  "author": "Andrea Tombolato <hey@heyatom.dev> (https://heyatom.dev)",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/heyatomdev/bastion-client.git"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "main": "./dist/cjs/core/index.js",
+  "module": "./dist/esm/core/index.js",
+  "types": "./dist/cjs/core/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/esm/core/index.d.ts",
+        "default": "./dist/esm/core/index.js"
+      },
+      "require": {
+        "types": "./dist/cjs/core/index.d.ts",
+        "default": "./dist/cjs/core/index.js"
+      }
+    },
+    "./nest": {
+      "import": {
+        "types": "./dist/esm/nest/index.d.ts",
+        "default": "./dist/esm/nest/index.js"
+      },
+      "require": {
+        "types": "./dist/cjs/nest/index.d.ts",
+        "default": "./dist/cjs/nest/index.js"
+      }
+    }
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "peerDependencies": {
+    "@nestjs/common": "^11.0.0",
+    "@nestjs/core": "^11.0.0",
+    "jose": "^6.0.0",
+    "reflect-metadata": "^0.2.0",
+    "rxjs": "^7.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@nestjs/common": {
+      "optional": true
+    },
+    "@nestjs/core": {
+      "optional": true
+    },
+    "reflect-metadata": {
+      "optional": true
+    },
+    "rxjs": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@nestjs/common": "^11.2.5",
+    "@nestjs/core": "^11.2.5",
+    "@types/node": "^25.9.8",
+    "jose": "^6.2.12",
+    "reflect-metadata": "^0.2.2",
+    "rxjs": "^7.8.2",
+    "typescript": "^5.9.3",
+    "vitest": "^3.2.4"
+  },
+  "scripts": {
+    "build": "rm -rf dist && tsc -p tsconfig.cjs.json && tsc -p tsconfig.esm.json && echo '{\"type\":\"module\"}' > dist/esm/package.json",
+    "test": "vitest run",
+    "lint": "tsc -p tsconfig.json --noEmit",
+    "test:di": "node scripts/di-smoke.cjs"
+  }
+}