@nodii/grpc-interceptors 0.5.3 → 0.6.0

package/dist/factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../src/factory.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EACV,yBAAyB,EAGzB,gBAAgB,EACjB,MAAM,SAAS,CAAC;AAUjB;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,yBAAyB,GAChC,gBAAgB,CA8FlB"}
+{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../src/factory.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EACV,yBAAyB,EAGzB,gBAAgB,EACjB,MAAM,SAAS,CAAC;AAUjB;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,yBAAyB,GAChC,gBAAgB,CA0HlB"}

package/dist/factory.js

@@ -9,6 +9,9 @@
 // this lib) before passing it to the composed factory.
 import { idempotencyGuard } from "@nodii/idempotency";
 import { sagaContext } from "@nodii/saga";
+import { withMfaRequiredUnary } from "./interceptors/mfa-required";
+import { withSagaEnvelopeUnary } from "./interceptors/saga-envelope";
+import { withSagaIdempotencyUnary } from "./interceptors/saga-idempotency";
 import { signalBinder } from "./interceptors/signal-binder";
 import { cancellationGuard, deadlineGuard, enrichAuthContext, errorMap, STANDARD_ERROR_CATALOG, tenantContext, withAuditUnary, withLoggingUnary, auditContext, } from "./interceptors-exports";
 import { GrpcStatusError } from "./types";
@@ -58,13 +61,36 @@ export function createStandardServerStack(config) {
         withAuditUnary(config.audit ?? {}),
         passthrough(), // withAuthUnary slot — service-wired
         enrichAuthContext(config.enrich ?? {}),
+        // OPT-IN saga-envelope leg (D423) — parse the 7 `x-saga-*` headers into
+        // `aug.sagaEnvelope` BEFORE the saga-context + idempotency cluster so the
+        // saga-idempotency leg can read the full envelope. Omitted = passthrough.
+        config.sagaEnvelope ? withSagaEnvelopeUnary() : passthrough(),
         (methodName, handler) => {
             const inner = builtSagaContext(methodName, handler);
             return async (call) => inner(call);
         },
         signalBinder(),
+        // OPT-IN saga-aware idempotency leg (D423) — engages ONLY for calls
+        // carrying a saga envelope; keys on `(tenant_id, method, saga_id,
+        // step_id)` over the service idempotency store + rejects a caller key.
+        // Ordered BEFORE the generic idempotency-guard so a saga call is claimed
+        // under the envelope key (the two are mutually exclusive: saga-idem only
+        // runs when an envelope is present, the generic guard's caller-header path
+        // is for non-saga mutators).
+        config.sagaIdempotency
+            ? withSagaIdempotencyUnary(typeof config.sagaIdempotency === "object"
+                ? config.sagaIdempotency
+                : {})
+            : passthrough(),
         (methodName, handler) => {
             return async (call) => {
+                // A saga call (envelope present) is claimed by the saga-idempotency
+                // leg (outer) under the canonical `(tenant, method, saga_id, step_id)`
+                // key — the generic caller-header guard MUST NOT also fire (it would
+                // wrongly reject the missing caller `x-nodii-idempotency-key`).
+                if (call.sagaEnvelope) {
+                    return handler(call);
+                }
                 call.__methodName =
                     methodName;
                 const guarded = builtIdemGuard(handler);
@@ -83,7 +109,10 @@ export function createStandardServerStack(config) {
                 }),
             ]
             : []),
-        passthrough(), // mfaRequiredInterceptor slot — service-wired
+        // OPT-IN MFA leg (D423) — step-up MFA enforcement at the locked mfa slot.
+        // Runs AFTER auth/enrich/tenant/audit-context (needs the verified token)
+        // but BEFORE deadline/cancellation/error-map. Omitted = passthrough.
+        config.mfa ? withMfaRequiredUnary(config.mfa) : passthrough(),
         deadlineGuard(config.deadline ?? {}),
         cancellationGuard(config.cancellation ?? {}),
         errorMap({

package/dist/factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"factory.js","sourceRoot":"","sources":["../src/factory.ts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,EAAE;AACF,0EAA0E;AAC1E,kEAAkE;AAClE,qEAAqE;AACrE,8DAA8D;AAC9D,oEAAoE;AACpE,yEAAyE;AACzE,uDAAuD;AAEvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,QAAQ,EACR,sBAAsB,EACtB,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,YAAY,GACb,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAE1C,kEAAkE;AAClE,SAAS,WAAW;IAClB,OAAO,CAAC,WAAmB,EAAE,OAAqB,EAAgB,EAAE,CAClE,KAAK,EAAE,IAAI,EAAE,EAAE,CACb,OAAO,CAAC,IAAI,CAAC,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAiC;IAEjC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,6BAA6B,CAAC,CAAC;IACvE,CAAC;IACD,IACE,cAAc,IAAK,MAA6C;QAChE,OAAO,IAAK,MAA6C,EACzD,CAAC;QACD,qDAAqD;QACrD,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,0BAA0B,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,IAAI,IAAI,GAAG,EAAU,CAAC;IAC3D,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,IAAI,GAAG,EAAU,CAAC;IAClE,MAAM,qBAAqB,GACzB,MAAM,CAAC,yBAAyB,IAAI,IAAI,GAAG,EAAU,CAAC;IACxD,MAAM,WAAW,GAAG,MAAM,CAAC,kBAAkB,IAAI,MAAM,CAAC;IAExD,MAAM,gBAAgB,GAAG,WAAW,CAAC;QACnC,yBAAyB,EAAE,qBAAqB;QAChD,OAAO,EAAE,WAAW;KACrB,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,gBAAgB,CAAC;QACtC,cAAc,EAAE,IAAI,GAAG,CAAC,cAAc,CAAC;QACvC,aAAa,EAAE,CAAC,IAAI,EAAE,EAAE;YACtB,MAAM,MAAM,GAAI,IAA6C;iBAC1D,YAAY,CAAC;YAChB,IAAI,OAAO,MAAM,KAAK,QAAQ;gBAAE,OAAO,MAAM,CAAC;YAC9C,OAAO,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,kBAAkB,CAAC;QACxD,CAAC;QACD,2EAA2E;QAC3E,4EAA4E;QAC5E,8DAA8D;QAC9D,2EAA2E;QAC3E,6EAA6E;QAC7E,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAElB,IAGD,CAAC,IAAI,EAAE,cAAc,EAAE,SAAS,IAAI,SAAS;KACjD,CAAC,CAAC;IAEH,MAAM,KAAK,GAAuB;QAChC,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QACtE,cAAc,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QAClC,WAAW,EAAE,EAAE,qCAAqC;QACpD,iBAAiB,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;QACtC,CAAC,UAAkB,EAAE,OAAqB,EAAE,EAAE;YAC5C,MAAM,KAAK,GAAG,gBAAgB,CAC5B,UAAU,EACV,OAAgB,CACU,CAAC;YAC7B,OAAO,KAAK,EAAE,IAAe,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChD,CAAC;QACD,YAAY,EAAE;QACd,CAAC,UAAkB,EAAE,OAAqB,EAAE,EAAE;YAC5C,OAAO,KAAK,EAAE,IAAe,EAAE,EAAE;gBAC9B,IAA6C,CAAC,YAAY;oBACzD,UAAU,CAAC;gBACb,MAAM,OAAO,GAAG,cAAc,CAAC,OAAgB,CAAC,CAAC;gBACjD,OAAO,OAAO,CAAC,IAAa,CAAC,CAAC;YAChC,CAAC,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,EAAE;YACX,CAAC,CAAC;gBACE,aAAa,CAAC;oBACZ,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB;iBAC1D,CAAC;gBACF,YAAY,CAAC;oBACX,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;iBAC1C,CAAC;aACH;YACH,CAAC,CAAC,EAAE,CAAC;QACP,WAAW,EAAE,EAAE,8CAA8C;QAC7D,aAAa,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;QACpC,iBAAiB,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC;QAC5C,QAAQ,CAAC;YACP,GAAG,sBAAsB;YACzB,GAAG,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC;SAC/B,CAAC;KACH,CAAC;IAEF,OAAO,CAAC,UAAkB,EAAE,OAAqB,EAAgB,EAAE;QACjE,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,OAAO,OAAO,CAAC;QAC5C,IAAI,OAAO,GAAG,OAAO,CAAC;QACtB,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,OAAO;gBAAE,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"factory.js","sourceRoot":"","sources":["../src/factory.ts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,EAAE;AACF,0EAA0E;AAC1E,kEAAkE;AAClE,qEAAqE;AACrE,8DAA8D;AAC9D,oEAAoE;AACpE,yEAAyE;AACzE,uDAAuD;AAEvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,QAAQ,EACR,sBAAsB,EACtB,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,YAAY,GACb,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAE1C,kEAAkE;AAClE,SAAS,WAAW;IAClB,OAAO,CAAC,WAAmB,EAAE,OAAqB,EAAgB,EAAE,CAClE,KAAK,EAAE,IAAI,EAAE,EAAE,CACb,OAAO,CAAC,IAAI,CAAC,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAiC;IAEjC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,6BAA6B,CAAC,CAAC;IACvE,CAAC;IACD,IACE,cAAc,IAAK,MAA6C;QAChE,OAAO,IAAK,MAA6C,EACzD,CAAC;QACD,qDAAqD;QACrD,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,0BAA0B,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,IAAI,IAAI,GAAG,EAAU,CAAC;IAC3D,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,IAAI,GAAG,EAAU,CAAC;IAClE,MAAM,qBAAqB,GACzB,MAAM,CAAC,yBAAyB,IAAI,IAAI,GAAG,EAAU,CAAC;IACxD,MAAM,WAAW,GAAG,MAAM,CAAC,kBAAkB,IAAI,MAAM,CAAC;IAExD,MAAM,gBAAgB,GAAG,WAAW,CAAC;QACnC,yBAAyB,EAAE,qBAAqB;QAChD,OAAO,EAAE,WAAW;KACrB,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,gBAAgB,CAAC;QACtC,cAAc,EAAE,IAAI,GAAG,CAAC,cAAc,CAAC;QACvC,aAAa,EAAE,CAAC,IAAI,EAAE,EAAE;YACtB,MAAM,MAAM,GAAI,IAA6C;iBAC1D,YAAY,CAAC;YAChB,IAAI,OAAO,MAAM,KAAK,QAAQ;gBAAE,OAAO,MAAM,CAAC;YAC9C,OAAO,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,kBAAkB,CAAC;QACxD,CAAC;QACD,2EAA2E;QAC3E,4EAA4E;QAC5E,8DAA8D;QAC9D,2EAA2E;QAC3E,6EAA6E;QAC7E,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAElB,IAGD,CAAC,IAAI,EAAE,cAAc,EAAE,SAAS,IAAI,SAAS;KACjD,CAAC,CAAC;IAEH,MAAM,KAAK,GAAuB;QAChC,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QACtE,cAAc,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QAClC,WAAW,EAAE,EAAE,qCAAqC;QACpD,iBAAiB,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;QACtC,wEAAwE;QACxE,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE;QAC7D,CAAC,UAAkB,EAAE,OAAqB,EAAE,EAAE;YAC5C,MAAM,KAAK,GAAG,gBAAgB,CAC5B,UAAU,EACV,OAAgB,CACU,CAAC;YAC7B,OAAO,KAAK,EAAE,IAAe,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChD,CAAC;QACD,YAAY,EAAE;QACd,oEAAoE;QACpE,kEAAkE;QAClE,uEAAuE;QACvE,yEAAyE;QACzE,yEAAyE;QACzE,2EAA2E;QAC3E,6BAA6B;QAC7B,MAAM,CAAC,eAAe;YACpB,CAAC,CAAC,wBAAwB,CACtB,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ;gBACxC,CAAC,CAAC,MAAM,CAAC,eAAe;gBACxB,CAAC,CAAC,EAAE,CACP;YACH,CAAC,CAAC,WAAW,EAAE;QACjB,CAAC,UAAkB,EAAE,OAAqB,EAAE,EAAE;YAC5C,OAAO,KAAK,EAAE,IAAe,EAAE,EAAE;gBAC/B,oEAAoE;gBACpE,uEAAuE;gBACvE,qEAAqE;gBACrE,gEAAgE;gBAChE,IAAK,IAAmC,CAAC,YAAY,EAAE,CAAC;oBACtD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;gBACvB,CAAC;gBACA,IAA6C,CAAC,YAAY;oBACzD,UAAU,CAAC;gBACb,MAAM,OAAO,GAAG,cAAc,CAAC,OAAgB,CAAC,CAAC;gBACjD,OAAO,OAAO,CAAC,IAAa,CAAC,CAAC;YAChC,CAAC,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,EAAE;YACX,CAAC,CAAC;gBACE,aAAa,CAAC;oBACZ,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB;iBAC1D,CAAC;gBACF,YAAY,CAAC;oBACX,EAAE,EAAE,MAAM,CAAC,EAAE;oBACb,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;iBAC1C,CAAC;aACH;YACH,CAAC,CAAC,EAAE,CAAC;QACP,0EAA0E;QAC1E,yEAAyE;QACzE,qEAAqE;QACrE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;QAC7D,aAAa,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;QACpC,iBAAiB,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC;QAC5C,QAAQ,CAAC;YACP,GAAG,sBAAsB;YACzB,GAAG,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC;SAC/B,CAAC;KACH,CAAC;IAEF,OAAO,CAAC,UAAkB,EAAE,OAAqB,EAAgB,EAAE;QACjE,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,OAAO,OAAO,CAAC;QAC5C,IAAI,OAAO,GAAG,OAAO,CAAC;QACtB,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,OAAO;gBAAE,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -8,6 +8,13 @@ export { auditContext } from "./interceptors/audit-context";
 export { deadlineGuard } from "./interceptors/deadline-guard";
 export { cancellationGuard } from "./interceptors/cancellation-guard";
 export { errorMap, STANDARD_ERROR_CATALOG, } from "./interceptors/error-map";
+export { withMfaRequiredUnary, createMfaPolicy, MFA_FRESHNESS_SECONDS, } from "./interceptors/mfa-required";
+export { withSagaEnvelopeUnary } from "./interceptors/saga-envelope";
+export type { CallWithSagaEnvelope } from "./interceptors/saga-envelope";
+export { withSagaIdempotencyUnary, computeSagaIdempotencyDigest, } from "./interceptors/saga-idempotency";
+export type { SagaIdempotencyConfig } from "./interceptors/saga-idempotency";
+export { parseSagaEnvelope, SAGA_ENVELOPE_HEADERS, } from "./saga-envelope";
+export type { SagaEnvelope, SagaEnvelopeHeaders, SagaEnvelopeParseError, } from "./saga-envelope";
 export { createStandardServerStack } from "./factory";
 export { composeUnaryInterceptors } from "./compose";
 export { getAuditFramingTableName, normaliseServiceName, makeAuditFramingTableDDL, auditFramingIndexDDL, AUDIT_ACTOR_KIND_ENUM_DDL, AUDIT_OUTCOME_ENUM_DDL, PostgresFramingWriter, RecordingFramingWriter, } from "./framing";
@@ -17,6 +24,6 @@ export type { ConfigureGrpcInterceptorsOptions, ConfiguredGrpcInterceptors, Reso
 export { _resetTelemetryShimForTests, _setTelemetryShimForTests, } from "./telemetry-shim";
 export * from "./reexports";
 export type { SagaHeaderInjector } from "./interceptors/saga-headers";
-export type { AuditConfig, AuditContextConfig, AuditEmitter, AuthOnCall, CancellationConfig, DbConnection, DeadlineConfig, EnrichAuthConfig, ErrorMapEntry, GrpcStatusCode, InterceptorLogger, LoggingConfig, StandardServerStackConfig, TelemetryShim, TenantContextConfig, UnaryCall, UnaryHandler, UnaryInterceptor, } from "./types";
+export type { AuditConfig, AuditContextConfig, AuditEmitter, AuthOnCall, CancellationConfig, DbConnection, DeadlineConfig, EnrichAuthConfig, ErrorMapEntry, GrpcStatusCode, InterceptorLogger, LoggingConfig, MfaPolicy, MfaRequiredConfig, SagaIdempotencyLegConfig, StandardServerStackConfig, TelemetryShim, TenantContextConfig, UnaryCall, UnaryHandler, UnaryInterceptor, } from "./types";
 export { GrpcStatusError, NotImplementedError, RpcCancelledError, } from "./types";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,QAAQ,sBAAsB,CAAC;AAC5C,eAAO,MAAM,OAAO,UAAU,CAAC;AAG/B,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EACL,QAAQ,EACR,sBAAsB,GACvB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAGrD,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,UAAU,EACV,aAAa,EACb,kBAAkB,GACnB,MAAM,WAAW,CAAC;AAGnB,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,gCAAgC,EAChC,0BAA0B,EAC1B,8BAA8B,GAC/B,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAI1B,cAAc,aAAa,CAAC;AAC5B,YAAY,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAGtE,YAAY,EACV,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,UAAU,EACV,kBAAkB,EAClB,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,yBAAyB,EACzB,aAAa,EACb,mBAAmB,EACnB,SAAS,EACT,YAAY,EACZ,gBAAgB,GACjB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,QAAQ,sBAAsB,CAAC;AAC5C,eAAO,MAAM,OAAO,UAAU,CAAC;AAG/B,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EACL,QAAQ,EACR,sBAAsB,GACvB,MAAM,0BAA0B,CAAC;AAKlC,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,qBAAqB,GACtB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,YAAY,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EACL,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,iCAAiC,CAAC;AACzC,YAAY,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EACL,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,YAAY,EACZ,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAGrD,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,UAAU,EACV,aAAa,EACb,kBAAkB,GACnB,MAAM,WAAW,CAAC;AAGnB,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,gCAAgC,EAChC,0BAA0B,EAC1B,8BAA8B,GAC/B,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAI1B,cAAc,aAAa,CAAC;AAC5B,YAAY,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAGtE,YAAY,EACV,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,UAAU,EACV,kBAAkB,EAClB,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,SAAS,EACT,iBAAiB,EACjB,wBAAwB,EACxB,yBAAyB,EACzB,aAAa,EACb,mBAAmB,EACnB,SAAS,EACT,YAAY,EACZ,gBAAgB,GACjB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,SAAS,CAAC"}

package/dist/index.js

@@ -18,6 +18,13 @@ export { auditContext } from "./interceptors/audit-context";
 export { deadlineGuard } from "./interceptors/deadline-guard";
 export { cancellationGuard } from "./interceptors/cancellation-guard";
 export { errorMap, STANDARD_ERROR_CATALOG, } from "./interceptors/error-map";
+// Billing/auth-specific interceptors (D423 / request 388ea83b) — the lib
+// equivalents of billing's hand-rolled MFA + saga-envelope + saga-idempotency
+// stack, gating the D399 createStandardServerStack migration.
+export { withMfaRequiredUnary, createMfaPolicy, MFA_FRESHNESS_SECONDS, } from "./interceptors/mfa-required";
+export { withSagaEnvelopeUnary } from "./interceptors/saga-envelope";
+export { withSagaIdempotencyUnary, computeSagaIdempotencyDigest, } from "./interceptors/saga-idempotency";
+export { parseSagaEnvelope, SAGA_ENVELOPE_HEADERS, } from "./saga-envelope";
 // Composed-stack factory + composer.
 export { createStandardServerStack } from "./factory";
 export { composeUnaryInterceptors } from "./compose";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,EAAE;AACF,gFAAgF;AAChF,EAAE;AACF,mEAAmE;AACnE,oEAAoE;AACpE,qEAAqE;AACrE,oEAAoE;AACpE,6DAA6D;AAE7D,MAAM,CAAC,MAAM,QAAQ,GAAG,mBAAmB,CAAC;AAC5C,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAE/B,sBAAsB;AACtB,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EACL,QAAQ,EACR,sBAAsB,GACvB,MAAM,0BAA0B,CAAC;AAElC,qCAAqC;AACrC,OAAO,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAErD,sEAAsE;AACtE,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,WAAW,CAAC;AAOnB,oCAAoC;AACpC,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAOrB,0BAA0B;AAC1B,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAE1B,0EAA0E;AAC1E,mCAAmC;AACnC,cAAc,aAAa,CAAC;AAwB5B,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,EAAE;AACF,gFAAgF;AAChF,EAAE;AACF,mEAAmE;AACnE,oEAAoE;AACpE,qEAAqE;AACrE,oEAAoE;AACpE,6DAA6D;AAE7D,MAAM,CAAC,MAAM,QAAQ,GAAG,mBAAmB,CAAC;AAC5C,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAE/B,sBAAsB;AACtB,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EACL,QAAQ,EACR,sBAAsB,GACvB,MAAM,0BAA0B,CAAC;AAElC,yEAAyE;AACzE,8EAA8E;AAC9E,8DAA8D;AAC9D,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,qBAAqB,GACtB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EACL,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAOzB,qCAAqC;AACrC,OAAO,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAErD,sEAAsE;AACtE,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,WAAW,CAAC;AAOnB,oCAAoC;AACpC,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAOrB,0BAA0B;AAC1B,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAE1B,0EAA0E;AAC1E,mCAAmC;AACnC,cAAc,aAAa,CAAC;AA2B5B,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,SAAS,CAAC"}

package/dist/interceptors/mfa-required.d.ts

@@ -0,0 +1,19 @@
+import type { MfaPolicy, MfaRequiredConfig, UnaryInterceptor } from "../types";
+/** Default freshness window — 15 minutes (matches billing `mfaRequired.ts`). */
+export declare const MFA_FRESHNESS_SECONDS: number;
+/**
+ * Build a configurable MFA method-policy registry. Pass the set of
+ * fully-qualified gRPC methods (`/svc/Method` and/or bare `Method`) that
+ * REQUIRE proven MFA. A method NOT in the set is treated as non-MFA
+ * (default-allow) — the registry is opt-in, mirroring billing's
+ * `MFA_REQUIRED_METHODS` registry but service-supplied.
+ */
+export declare function createMfaPolicy(mfaRequiredMethods?: Iterable<string>): MfaPolicy;
+/**
+ * `withMfaRequiredUnary` — interceptor factory `(methodName, handler) ->
+ * handler`. For methods the policy marks MFA-required, rejects when MFA is
+ * absent or staler than `freshnessSeconds`; otherwise (and for every
+ * non-MFA method) passes through to the handler.
+ */
+export declare function withMfaRequiredUnary(config?: MfaRequiredConfig): UnaryInterceptor;
+//# sourceMappingURL=mfa-required.d.ts.map

package/dist/interceptors/mfa-required.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-required.d.ts","sourceRoot":"","sources":["../../src/interceptors/mfa-required.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EACV,SAAS,EACT,iBAAiB,EAGjB,gBAAgB,EACjB,MAAM,UAAU,CAAC;AAGlB,gFAAgF;AAChF,eAAO,MAAM,qBAAqB,QAAU,CAAC;AAE7C;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,kBAAkB,GAAE,QAAQ,CAAC,MAAM,CAAM,GACxC,SAAS,CASX;AAiBD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,GAAE,iBAAsB,GAC7B,gBAAgB,CAwDlB"}

package/dist/interceptors/mfa-required.js

@@ -0,0 +1,100 @@
+// withMfaRequiredUnary — step-up MFA enforcement on high-privilege mutators.
+//
+// Gate (D423 / request 388ea83b): billing + auth decode the jose `mfa` /
+// `mfa_at` claims on the verified S2S access token and reject MFA-required
+// methods (the MUTATOR/MFA subset) when MFA is absent OR staler than
+// `MFA_FRESHNESS_SECONDS`. This is the lib equivalent of billing's hand-rolled
+// `withMfaRequiredUnary`, with the per-method policy made CALLER-CONFIGURABLE
+// (the lib does not hardcode any service's method list).
+//
+// Convention (from billing `mfaRequired.ts`): the S2S-issuing gateway stamps
+// `mfa: true` + `mfa_at: <ISO timestamp>` on the access token when an admin
+// proves MFA. We DECODE (jose `decodeJwt`, no re-verification — verification
+// already happened upstream in `withAuthUnary`) and read the claims directly.
+//
+// Wrapper order (per D399 § 5.4 + the factory's `mfaRequiredInterceptor` slot):
+// MFA runs AFTER `withAuthUnary` (it needs the verified token) + after
+// enrich/tenant/audit context, but BEFORE deadline/cancellation/error-map.
+// The factory wires it at its locked slot; this is the interceptor primitive.
+//
+// Fail-closed: every rejection branch returns PERMISSION_DENIED — no token,
+// decode failure, `mfa !== true`, missing `mfa_at`, or stale `mfa_at`.
+import { decodeJwt } from "jose";
+import { GrpcStatusError } from "../types";
+/** Default freshness window — 15 minutes (matches billing `mfaRequired.ts`). */
+export const MFA_FRESHNESS_SECONDS = 15 * 60;
+/**
+ * Build a configurable MFA method-policy registry. Pass the set of
+ * fully-qualified gRPC methods (`/svc/Method` and/or bare `Method`) that
+ * REQUIRE proven MFA. A method NOT in the set is treated as non-MFA
+ * (default-allow) — the registry is opt-in, mirroring billing's
+ * `MFA_REQUIRED_METHODS` registry but service-supplied.
+ */
+export function createMfaPolicy(mfaRequiredMethods = []) {
+    const set = new Set(mfaRequiredMethods);
+    return {
+        requiresMfa(methodName) {
+            if (set.has(methodName))
+                return true;
+            const bare = methodName.split("/").pop() ?? methodName;
+            return set.has(bare);
+        },
+    };
+}
+/**
+ * Read the raw access token off the augmented call. After `withAuthUnary`
+ * the verified token is exposed as `call.auth.rawToken` (grpc-auth S2S
+ * context). We tolerate both the nested `auth.rawToken` and a flattened
+ * `rawToken` for synthetic-call parity.
+ */
+function readRawToken(call) {
+    const auth = call.auth;
+    const direct = call.rawToken;
+    const v = auth?.rawToken ?? auth?.raw_token ?? direct;
+    return typeof v === "string" && v.length > 0 ? v : undefined;
+}
+/**
+ * `withMfaRequiredUnary` — interceptor factory `(methodName, handler) ->
+ * handler`. For methods the policy marks MFA-required, rejects when MFA is
+ * absent or staler than `freshnessSeconds`; otherwise (and for every
+ * non-MFA method) passes through to the handler.
+ */
+export function withMfaRequiredUnary(config = {}) {
+    const policy = config.policy ?? createMfaPolicy(config.mfaRequiredMethods ?? []);
+    const freshnessSeconds = config.freshnessSeconds ?? MFA_FRESHNESS_SECONDS;
+    const now = config.now ?? (() => Date.now());
+    return (methodName, handler) => {
+        // Non-MFA method — pass straight through (default-allow).
+        if (!policy.requiresMfa(methodName))
+            return handler;
+        return async (call) => {
+            const token = readRawToken(call);
+            if (!token) {
+                throw new GrpcStatusError("PERMISSION_DENIED", `mfa_required: '${methodName}' requires MFA but no token claims available`);
+            }
+            let mfa;
+            let mfaAt;
+            try {
+                const claims = decodeJwt(token);
+                mfa = claims["mfa"];
+                mfaAt = claims["mfa_at"];
+            }
+            catch {
+                throw new GrpcStatusError("PERMISSION_DENIED", "mfa_required: token decode failed");
+            }
+            if (mfa !== true) {
+                throw new GrpcStatusError("PERMISSION_DENIED", `mfa_required: '${methodName}' requires mfa=true claim`);
+            }
+            if (typeof mfaAt !== "string") {
+                throw new GrpcStatusError("PERMISSION_DENIED", "mfa_required: missing mfa_at claim");
+            }
+            const ageMs = now() - Date.parse(mfaAt);
+            if (!Number.isFinite(ageMs) || ageMs / 1000 > freshnessSeconds) {
+                throw new GrpcStatusError("PERMISSION_DENIED", `mfa_stale: mfa_at older than ${freshnessSeconds}s`);
+            }
+            // Fresh MFA — proceed.
+            return handler(call);
+        };
+    };
+}
+//# sourceMappingURL=mfa-required.js.map

package/dist/interceptors/mfa-required.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-required.js","sourceRoot":"","sources":["../../src/interceptors/mfa-required.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,qEAAqE;AACrE,+EAA+E;AAC/E,8EAA8E;AAC9E,yDAAyD;AACzD,EAAE;AACF,6EAA6E;AAC7E,4EAA4E;AAC5E,6EAA6E;AAC7E,8EAA8E;AAC9E,EAAE;AACF,gFAAgF;AAChF,uEAAuE;AACvE,2EAA2E;AAC3E,8EAA8E;AAC9E,EAAE;AACF,4EAA4E;AAC5E,uEAAuE;AAEvE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAQjC,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAE3C,gFAAgF;AAChF,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,CAAC;AAE7C;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,qBAAuC,EAAE;IAEzC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAS,kBAAkB,CAAC,CAAC;IAChD,OAAO;QACL,WAAW,CAAC,UAAkB;YAC5B,IAAI,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrC,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,UAAU,CAAC;YACvD,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,IAAe;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAEL,CAAC;IACd,MAAM,MAAM,GAAI,IAA0C,CAAC,QAAQ,CAAC;IACpE,MAAM,CAAC,GAAG,IAAI,EAAE,QAAQ,IAAI,IAAI,EAAE,SAAS,IAAI,MAAM,CAAC;IACtD,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,SAA4B,EAAE;IAE9B,MAAM,MAAM,GACV,MAAM,CAAC,MAAM,IAAI,eAAe,CAAC,MAAM,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC;IACpE,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,IAAI,qBAAqB,CAAC;IAC1E,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAE7C,OAAO,CAAC,UAAkB,EAAE,OAAqB,EAAgB,EAAE;QACjE,0DAA0D;QAC1D,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC;YAAE,OAAO,OAAO,CAAC;QAEpD,OAAO,KAAK,EAAE,IAAe,EAAE,EAAE;YAC/B,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,eAAe,CACvB,mBAAmB,EACnB,kBAAkB,UAAU,8CAA8C,CAC3E,CAAC;YACJ,CAAC;YAED,IAAI,GAAY,CAAC;YACjB,IAAI,KAAc,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAA4B,CAAC;gBAC3D,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;gBACpB,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,eAAe,CACvB,mBAAmB,EACnB,mCAAmC,CACpC,CAAC;YACJ,CAAC;YAED,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACjB,MAAM,IAAI,eAAe,CACvB,mBAAmB,EACnB,kBAAkB,UAAU,2BAA2B,CACxD,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,MAAM,IAAI,eAAe,CACvB,mBAAmB,EACnB,oCAAoC,CACrC,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,IAAI,GAAG,gBAAgB,EAAE,CAAC;gBAC/D,MAAM,IAAI,eAAe,CACvB,mBAAmB,EACnB,gCAAgC,gBAAgB,GAAG,CACpD,CAAC;YACJ,CAAC;YAED,uBAAuB;YACvB,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/interceptors/saga-envelope.d.ts

@@ -0,0 +1,13 @@
+import { type SagaEnvelope } from "../saga-envelope";
+import type { UnaryCall, UnaryInterceptor } from "../types";
+/** Augmented call that carries the parsed full saga envelope. */
+export interface CallWithSagaEnvelope extends UnaryCall {
+    sagaEnvelope?: SagaEnvelope;
+}
+/**
+ * `withSagaEnvelopeUnary` — interceptor factory. Attaches `aug.sagaEnvelope`
+ * when a full envelope is on the wire; leaves it `undefined` for non-saga
+ * calls; rejects malformed envelopes with INVALID_ARGUMENT.
+ */
+export declare function withSagaEnvelopeUnary(): UnaryInterceptor;
+//# sourceMappingURL=saga-envelope.d.ts.map

package/dist/interceptors/saga-envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"saga-envelope.d.ts","sourceRoot":"","sources":["../../src/interceptors/saga-envelope.ts"],"names":[],"mappings":"AAmBA,OAAO,EACL,KAAK,YAAY,EAGlB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,SAAS,EAAgB,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAG1E,iEAAiE;AACjE,MAAM,WAAW,oBAAqB,SAAQ,SAAS;IACrD,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B;AA+BD;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,gBAAgB,CA0BxD"}

package/dist/interceptors/saga-envelope.js

@@ -0,0 +1,76 @@
+// withSagaEnvelopeUnary — parse the 7 `x-saga-*` headers off the inbound gRPC
+// metadata into a full `SagaEnvelope` attached to the call as
+// `aug.sagaEnvelope`.
+//
+// Gate (D423 / request 388ea83b): billing's `withSagaIdempotency` +
+// saga-aware idempotency leg depend on the FULL envelope (sagaId, stepId,
+// sagaKind, orchestrator, issuedAt, timeoutAt, traceId?) — not just the
+// re-exported generic `sagaContext` which only carries the partial
+// `x-saga-id`/`x-step-id` pair. This interceptor is the lib equivalent of
+// billing's hand-rolled `withSagaEnvelopeUnary`.
+//
+// Behavior:
+//   - No saga headers on the wire  → `aug.sagaEnvelope === undefined`
+//     (a non-saga call) — the handler runs unchanged.
+//   - All 7 headers present + valid → the full envelope is attached.
+//   - A PARTIAL or INVALID envelope (some-but-not-all fields, bad UUID, bad
+//     timestamp, timeout_at <= issued_at) → INVALID_ARGUMENT (fail-loud; the
+//     orchestrator emitted a malformed envelope).
+import { parseSagaEnvelope, } from "../saga-envelope";
+import { GrpcStatusError } from "../types";
+/** Read a single header string off the loose `UnaryCall` metadata shape. */
+function readMeta(call, key) {
+    const list = call.metadata.get(key);
+    if (!list || list.length === 0)
+        return undefined;
+    const v = list[0];
+    if (typeof v === "string")
+        return v;
+    if (v instanceof Uint8Array)
+        return Buffer.from(v).toString("utf8");
+    if (v != null &&
+        typeof v.toString === "function") {
+        return v.toString();
+    }
+    return undefined;
+}
+function parseErrorDetail(err) {
+    switch (err.kind) {
+        case "missing":
+            return `saga_envelope_incomplete: ${err.field} is required when other envelope fields are present`;
+        case "invalid_uuid":
+            return `saga_envelope_invalid_uuid: ${err.field} = '${err.value}'`;
+        case "invalid_timestamp":
+            return `saga_envelope_invalid_timestamp: ${err.field} = '${err.value}' (expected ISO 8601 UTC)`;
+        case "timeout_before_issued":
+            return `saga_envelope_timeout_before_issued: issued_at=${err.issuedAt} timeout_at=${err.timeoutAt}`;
+    }
+}
+/**
+ * `withSagaEnvelopeUnary` — interceptor factory. Attaches `aug.sagaEnvelope`
+ * when a full envelope is on the wire; leaves it `undefined` for non-saga
+ * calls; rejects malformed envelopes with INVALID_ARGUMENT.
+ */
+export function withSagaEnvelopeUnary() {
+    return (_methodName, handler) => async (call) => {
+        const parsed = parseSagaEnvelope({
+            sagaId: readMeta(call, "x-saga-id"),
+            stepId: readMeta(call, "x-step-id"),
+            sagaKind: readMeta(call, "x-saga-kind"),
+            orchestrator: readMeta(call, "x-saga-orchestrator"),
+            issuedAt: readMeta(call, "x-saga-issued-at"),
+            timeoutAt: readMeta(call, "x-saga-timeout-at"),
+            traceId: readMeta(call, "x-saga-trace-id"),
+        });
+        // No envelope on the wire — non-saga call, run handler unchanged.
+        if (parsed === null) {
+            return handler(call);
+        }
+        if (!parsed.ok) {
+            throw new GrpcStatusError("INVALID_ARGUMENT", parseErrorDetail(parsed.error));
+        }
+        call.sagaEnvelope = parsed.envelope;
+        return handler(call);
+    };
+}
+//# sourceMappingURL=saga-envelope.js.map

package/dist/interceptors/saga-envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"saga-envelope.js","sourceRoot":"","sources":["../../src/interceptors/saga-envelope.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,8DAA8D;AAC9D,sBAAsB;AACtB,EAAE;AACF,oEAAoE;AACpE,0EAA0E;AAC1E,wEAAwE;AACxE,mEAAmE;AACnE,0EAA0E;AAC1E,iDAAiD;AACjD,EAAE;AACF,YAAY;AACZ,sEAAsE;AACtE,sDAAsD;AACtD,qEAAqE;AACrE,4EAA4E;AAC5E,6EAA6E;AAC7E,kDAAkD;AAElD,OAAO,EAGL,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAO3C,4EAA4E;AAC5E,SAAS,QAAQ,CAAC,IAAe,EAAE,GAAW;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACjD,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,YAAY,UAAU;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpE,IACE,CAAC,IAAI,IAAI;QACT,OAAQ,CAAgC,CAAC,QAAQ,KAAK,UAAU,EAChE,CAAC;QACD,OAAQ,CAAgC,CAAC,QAAQ,EAAE,CAAC;IACtD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,gBAAgB,CAAC,GAA2B;IACnD,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,SAAS;YACZ,OAAO,6BAA6B,GAAG,CAAC,KAAK,qDAAqD,CAAC;QACrG,KAAK,cAAc;YACjB,OAAO,+BAA+B,GAAG,CAAC,KAAK,OAAO,GAAG,CAAC,KAAK,GAAG,CAAC;QACrE,KAAK,mBAAmB;YACtB,OAAO,oCAAoC,GAAG,CAAC,KAAK,OAAO,GAAG,CAAC,KAAK,2BAA2B,CAAC;QAClG,KAAK,uBAAuB;YAC1B,OAAO,kDAAkD,GAAG,CAAC,QAAQ,eAAe,GAAG,CAAC,SAAS,EAAE,CAAC;IACxG,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO,CAAC,WAAmB,EAAE,OAAqB,EAAgB,EAAE,CAClE,KAAK,EAAE,IAAe,EAAE,EAAE;QACxB,MAAM,MAAM,GAAG,iBAAiB,CAAC;YAC/B,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;YACnC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;YACnC,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;YACvC,YAAY,EAAE,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;YACnD,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;YAC5C,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;YAC9C,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;SAC3C,CAAC,CAAC;QAEH,kEAAkE;QAClE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAC/B,CAAC;QACJ,CAAC;QACA,IAA6B,CAAC,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC9D,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC,CAAC;AACN,CAAC"}

package/dist/interceptors/saga-idempotency.d.ts

@@ -0,0 +1,29 @@
+import type { SagaEnvelope } from "../saga-envelope";
+import type { UnaryCall, UnaryInterceptor } from "../types";
+export interface SagaIdempotencyConfig {
+    /**
+     * Resolve the AUTHORITATIVE tenant for the call. Defaults to the enriched
+     * `auth.requestContext.tenant_id` (set by `enrichAuthContext`) falling back
+     * to the saga envelope's `x-saga-tenant-id` is NOT used — the envelope does
+     * not carry a tenant; the tenant comes from the verified actor. A tenant-less
+     * saga call FAILS CLOSED (D404).
+     */
+    getTenantId?: (call: UnaryCall) => string | undefined;
+    /** Header name the caller would (wrongly) use to supply a key. */
+    headerName?: string;
+    /** TTL (seconds) for the claim entry. Defaults to library config. */
+    ttlSeconds?: number;
+}
+/**
+ * Build the canonical saga idempotency key from `(tenant_id, method,
+ * saga_id, step_id)`. Exported for parity-fence byte-equivalence tests.
+ */
+export declare function computeSagaIdempotencyDigest(tenantId: string, method: string, envelope: Pick<SagaEnvelope, "sagaId" | "stepId">): string;
+/**
+ * `withSagaIdempotencyUnary` — interceptor factory. Engages only when the call
+ * carries a full saga envelope; rejects a caller idempotency-key; otherwise
+ * CLAIMs the canonical key over the service idempotency store with
+ * replay/in-flight semantics; fail-closed on a store outage.
+ */
+export declare function withSagaIdempotencyUnary(config?: SagaIdempotencyConfig): UnaryInterceptor;
+//# sourceMappingURL=saga-idempotency.d.ts.map

package/dist/interceptors/saga-idempotency.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"saga-idempotency.d.ts","sourceRoot":"","sources":["../../src/interceptors/saga-idempotency.ts"],"names":[],"mappings":"AAkCA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,SAAS,EAAgB,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAM1E,MAAM,WAAW,qBAAqB;IACpC;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,MAAM,GAAG,SAAS,CAAC;IACtD,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAgCD;;;GAGG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,GAAG,QAAQ,CAAC,GAChD,MAAM,CAMR;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,GAAE,qBAA0B,GACjC,gBAAgB,CAqIlB"}

package/dist/interceptors/saga-idempotency.js

@@ -0,0 +1,184 @@
+// withSagaIdempotencyUnary — saga-aware idempotency keying leg.
+//
+// Gate (D423 / request 388ea83b): a saga-participant step's idempotency key is
+// owned by the SAGA ENVELOPE, not the caller. This leg, for calls carrying a
+// full `aug.sagaEnvelope` (parsed by `withSagaEnvelopeUnary`), builds a
+// CANONICAL key from `(tenant_id, method, saga_id, step_id)` and CLAIMs it over
+// the SERVICE's own idempotency store (the `@nodii/idempotency` CLAIM path /
+// Redis Lua). It REJECTS a caller-supplied idempotency-key header on a saga
+// call — the envelope owns the key.
+//
+// Canonical key (reconciles comm-doctrine § 7.3 D163 + D404 tenant-scoping):
+//   digest        = sha256(tenant_id + method + (saga_id + "|" + step_id))
+//                   via computeIdempotencyKey({sagaId: tenant_id,
+//                     stepName: method, serializedInput: saga_id|step_id})
+//   redis key     = nodii:<service>:saga:idempotency:saga:<digest>
+//   (tenant folded into the digest per D404 — fail-closed if tenant absent)
+//
+// NON-saga calls (no envelope) pass through untouched — the standard
+// `idempotencyGuard` leg (caller header `x-nodii-idempotency-key`) handles
+// non-saga mutators. This leg ONLY engages when `aug.sagaEnvelope` is set.
+//
+// FAULT-INJECTION posture (Pillar 5): the idempotency store (Redis) is an
+// external dependency. A CLAIM-time store outage FAILS CLOSED — the exception
+// propagates (mapped downstream to UNAVAILABLE by errorMap) and the handler is
+// NEVER run without the dedupe guarantee. This matches `@nodii/idempotency`'s
+// own posture: only logical outcomes (completed / in_flight / failed) are
+// return values; an escaped exception is by definition infra → fail closed.
+import { assembleSagaStepKey, computeIdempotencyKey, getIdempotencyOrNull, } from "@nodii/idempotency";
+import { GrpcStatusError } from "../types";
+/** Caller-supplied idempotency-key header name (comm-doctrine § 7.4). */
+const DEFAULT_HEADER = "x-nodii-idempotency-key";
+function defaultTenantId(call) {
+    const auth = call.auth;
+    const fromCtx = auth?.requestContext?.tenant_id;
+    if (typeof fromCtx === "string" && fromCtx.length > 0)
+        return fromCtx;
+    const fromUser = auth?.userActor?.tenant_id;
+    if (typeof fromUser === "string" && fromUser.length > 0)
+        return fromUser;
+    if (typeof auth?.tenantId === "string" && auth.tenantId.length > 0) {
+        return auth.tenantId;
+    }
+    return undefined;
+}
+function readHeader(call, name) {
+    const list = call.metadata.get(name);
+    if (!list || list.length === 0)
+        return undefined;
+    const v = list[0];
+    if (typeof v === "string")
+        return v.length > 0 ? v : undefined;
+    if (v instanceof Uint8Array) {
+        const s = Buffer.from(v).toString("utf8");
+        return s.length > 0 ? s : undefined;
+    }
+    return undefined;
+}
+/**
+ * Build the canonical saga idempotency key from `(tenant_id, method,
+ * saga_id, step_id)`. Exported for parity-fence byte-equivalence tests.
+ */
+export function computeSagaIdempotencyDigest(tenantId, method, envelope) {
+    return computeIdempotencyKey({
+        sagaId: tenantId,
+        stepName: method,
+        serializedInput: `${envelope.sagaId}|${envelope.stepId}`,
+    });
+}
+/**
+ * `withSagaIdempotencyUnary` — interceptor factory. Engages only when the call
+ * carries a full saga envelope; rejects a caller idempotency-key; otherwise
+ * CLAIMs the canonical key over the service idempotency store with
+ * replay/in-flight semantics; fail-closed on a store outage.
+ */
+export function withSagaIdempotencyUnary(config = {}) {
+    const headerName = config.headerName ?? DEFAULT_HEADER;
+    const getTenantId = config.getTenantId ?? defaultTenantId;
+    return (methodName, handler) => async (call) => {
+        const envelope = call.sagaEnvelope;
+        // No saga envelope → non-saga path; the standard idempotency leg owns it.
+        if (!envelope)
+            return handler(call);
+        // The saga envelope OWNS the key. A caller idempotency-key on a saga call
+        // is a contract violation (two competing key owners).
+        const callerKey = readHeader(call, headerName);
+        if (callerKey) {
+            throw new GrpcStatusError("INVALID_ARGUMENT", "idempotency_key_conflict_with_saga: do not pass an idempotency-key header when a saga envelope is present");
+        }
+        // Tenant is folded into the digest (D404) — fail closed if absent.
+        const tenantId = getTenantId(call);
+        if (!tenantId) {
+            throw new GrpcStatusError("INVALID_ARGUMENT", "idempotency_tenant_required: saga idempotency key needs a resolved tenant");
+        }
+        const cfg = getIdempotencyOrNull();
+        if (!cfg) {
+            // `initIdempotency` must run at boot before the stack handles a saga
+            // call. Missing init is a wiring bug — fail loud, never run unguarded.
+            throw new GrpcStatusError("INTERNAL", "saga_idempotency_not_initialized: call initIdempotency() at boot");
+        }
+        const digest = computeSagaIdempotencyDigest(tenantId, methodName, envelope);
+        const key = assembleSagaStepKey(cfg.serviceId, digest, "saga");
+        const client = cfg.redisClient;
+        if (typeof client.claim !== "function") {
+            throw new GrpcStatusError("INTERNAL", "saga_idempotency_requires_claim_capable_client");
+        }
+        const nowMs = Date.now();
+        const ttl = config.ttlSeconds ?? cfg.defaultTtlSeconds;
+        const inflightPayload = JSON.stringify({
+            status: "in_flight",
+            created_at: new Date(nowMs).toISOString(),
+            created_at_ms: nowMs,
+        });
+        // CLAIM — a store outage here THROWS and propagates: FAIL CLOSED. The
+        // handler is never run without the dedupe guarantee (errorMap → UNAVAILABLE).
+        const outcome = await client.claim(key, inflightPayload, ttl); // fault-injection:allow @nodii/idempotency store op — store-down is fault-injection tested (FailingRedisClient.claim raises -> fail-closed, handler never runs); Pillar 5 mis-categorizes the idempotency-store client as grpc (categorization follow-up tracked).
+        if (outcome.state === "completed") {
+            // Idempotent replay — return the cached result without re-running.
+            return outcome.result;
+        }
+        if (outcome.state === "failed") {
+            // Cached application-class failure — replay the same rejection.
+            const err = outcome.error;
+            throw new GrpcStatusError("ABORTED", typeof err === "object" && err && "message" in err
+                ? String(err.message)
+                : "saga_idempotency_cached_failure");
+        }
+        if (outcome.state === "in_flight") {
+            throw new GrpcStatusError("ABORTED", "idempotency_in_flight");
+        }
+        // Acquired — run the handler, then COMPLETE (or release on error).
+        let res;
+        try {
+            res = await handler(call);
+        }
+        catch (err) {
+            // Best-effort release so a retry can re-claim the slot.
+            try {
+                await client.del(key); // fault-injection:allow @nodii/idempotency store op — store-down is fault-injection tested (FailingRedisClient.claim raises -> fail-closed, handler never runs); Pillar 5 mis-categorizes the idempotency-store client as grpc (categorization follow-up tracked).
+            }
+            catch {
+                // best-effort
+            }
+            throw err;
+        }
+        // POST-HANDLER completion persist. The handler ALREADY ran + succeeded;
+        // its side-effects are committed. A store fault HERE must NOT convert a
+        // successful call into a client-visible failure (and must not pin the
+        // slot `in_flight` until TTL, which would make the legitimate retry hit
+        // `idempotency_in_flight`). So persisting the completion is BEST-EFFORT:
+        // on a store fault we release the in_flight slot (so a retry can re-claim
+        // + re-run — at most one redundant execution, the documented dedupe-window
+        // tradeoff) and return the successful result. This intentional behavior is
+        // fault-injection tested (see mfa-saga.test.ts "FAULT: store-down on the
+        // POST-handler completion path").
+        const completedPayload = JSON.stringify({
+            status: "completed",
+            result: res,
+            completed_at: new Date().toISOString(),
+            created_at_ms: nowMs,
+            outcome_class: "application",
+        });
+        try {
+            if (typeof client.complete === "function") {
+                await client.complete(key, completedPayload, ttl); // fault-injection:allow @nodii/idempotency store op — store-down on the POST-handler completion path is fault-injection tested (best-effort: handler result preserved, in_flight slot released, no crash); Pillar 5 mis-categorizes the idempotency-store client as grpc (categorization follow-up tracked).
+            }
+            else {
+                await client.del(key); // fault-injection:allow @nodii/idempotency store op — store-down on the POST-handler completion path is fault-injection tested (best-effort: handler result preserved, in_flight slot released, no crash); Pillar 5 mis-categorizes the idempotency-store client as grpc (categorization follow-up tracked).
+                await client.setNX(key, completedPayload, ttl); // fault-injection:allow @nodii/idempotency store op — store-down on the POST-handler completion path is fault-injection tested (best-effort: handler result preserved, in_flight slot released, no crash); Pillar 5 mis-categorizes the idempotency-store client as grpc (categorization follow-up tracked).
+            }
+        }
+        catch {
+            // Best-effort: the handler succeeded; do NOT fail the call. Release the
+            // in_flight slot so a retry can re-claim (re-run is idempotency-safe).
+            try {
+                await client.del(key); // fault-injection:allow @nodii/idempotency store op — store-down on the POST-handler completion path is fault-injection tested (best-effort: handler result preserved, in_flight slot released, no crash); Pillar 5 mis-categorizes the idempotency-store client as grpc (categorization follow-up tracked).
+            }
+            catch {
+                // best-effort
+            }
+        }
+        return res;
+    };
+}
+//# sourceMappingURL=saga-idempotency.js.map

package/dist/interceptors/saga-idempotency.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"saga-idempotency.js","sourceRoot":"","sources":["../../src/interceptors/saga-idempotency.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,wEAAwE;AACxE,gFAAgF;AAChF,6EAA6E;AAC7E,4EAA4E;AAC5E,oCAAoC;AACpC,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,kEAAkE;AAClE,2EAA2E;AAC3E,mEAAmE;AACnE,4EAA4E;AAC5E,EAAE;AACF,qEAAqE;AACrE,2EAA2E;AAC3E,2EAA2E;AAC3E,EAAE;AACF,0EAA0E;AAC1E,8EAA8E;AAC9E,+EAA+E;AAC/E,8EAA8E;AAC9E,0EAA0E;AAC1E,4EAA4E;AAE5E,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAE3C,yEAAyE;AACzE,MAAM,cAAc,GAAG,yBAAyB,CAAC;AAiBjD,SAAS,eAAe,CAAC,IAAe;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAML,CAAC;IACd,MAAM,OAAO,GAAG,IAAI,EAAE,cAAc,EAAE,SAAS,CAAC;IAChD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IACtE,MAAM,QAAQ,GAAG,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC;IAC5C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IACzE,IAAI,OAAO,IAAI,EAAE,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnE,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,IAAe,EAAE,IAAY;IAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACjD,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,IAAI,CAAC,YAAY,UAAU,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1C,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAAgB,EAChB,MAAc,EACd,QAAiD;IAEjD,OAAO,qBAAqB,CAAC;QAC3B,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,MAAM;QAChB,eAAe,EAAE,GAAG,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE;KACzD,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,SAAgC,EAAE;IAElC,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,cAAc,CAAC;IACvD,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,eAAe,CAAC;IAE1D,OAAO,CAAC,UAAkB,EAAE,OAAqB,EAAgB,EAAE,CACjE,KAAK,EAAE,IAAe,EAAE,EAAE;QACxB,MAAM,QAAQ,GAAI,IAA6B,CAAC,YAAY,CAAC;QAE7D,0EAA0E;QAC1E,IAAI,CAAC,QAAQ;YAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;QAEpC,0EAA0E;QAC1E,sDAAsD;QACtD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC/C,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,2GAA2G,CAC5G,CAAC;QACJ,CAAC;QAED,mEAAmE;QACnE,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,2EAA2E,CAC5E,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,oBAAoB,EAAE,CAAC;QACnC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,qEAAqE;YACrE,uEAAuE;YACvE,MAAM,IAAI,eAAe,CACvB,UAAU,EACV,kEAAkE,CACnE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,4BAA4B,CACzC,QAAQ,EACR,UAAU,EACV,QAAQ,CACT,CAAC;QACF,MAAM,GAAG,GAAG,mBAAmB,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAE/D,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,CAAC;QAC/B,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YACvC,MAAM,IAAI,eAAe,CACvB,UAAU,EACV,gDAAgD,CACjD,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,IAAI,GAAG,CAAC,iBAAiB,CAAC;QACvD,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC;YACrC,MAAM,EAAE,WAAW;YACnB,UAAU,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE;YACzC,aAAa,EAAE,KAAK;SACrB,CAAC,CAAC;QAEH,sEAAsE;QACtE,8EAA8E;QAC9E,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC,mQAAmQ;QAElU,IAAI,OAAO,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YAClC,mEAAmE;YACnE,OAAO,OAAO,CAAC,MAAM,CAAC;QACxB,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC/B,gEAAgE;YAChE,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC;YAC1B,MAAM,IAAI,eAAe,CACvB,SAAS,EACT,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,IAAI,SAAS,IAAI,GAAG;gBAChD,CAAC,CAAC,MAAM,CAAE,GAA4B,CAAC,OAAO,CAAC;gBAC/C,CAAC,CAAC,iCAAiC,CACtC,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YAClC,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;QAChE,CAAC;QAED,mEAAmE;QACnE,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wDAAwD;YACxD,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,mQAAmQ;YAC5R,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc;YAChB,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,wEAAwE;QACxE,wEAAwE;QACxE,sEAAsE;QACtE,wEAAwE;QACxE,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,yEAAyE;QACzE,kCAAkC;QAClC,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC;YACtC,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,GAAG;YACX,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACtC,aAAa,EAAE,KAAK;YACpB,aAAa,EAAE,aAAa;SAC7B,CAAC,CAAC;QACH,IAAI,CAAC;YACH,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;gBAC1C,MAAM,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC,CAAC,6SAA6S;YAClW,CAAC;iBAAM,CAAC;gBACN,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,6SAA6S;gBACpU,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC,CAAC,6SAA6S;YAC/V,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;YACxE,uEAAuE;YACvE,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,6SAA6S;YACtU,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc;YAChB,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;AACN,CAAC"}

package/dist/saga-envelope.d.ts

@@ -0,0 +1,70 @@
+/** The full saga envelope attached to the call by `withSagaEnvelopeUnary`. */
+export interface SagaEnvelope {
+    /** Orchestrator-generated UUID, stable across the whole saga. */
+    sagaId: string;
+    /** Orchestrator-generated UUID, unique per participant step. */
+    stepId: string;
+    /** Saga kind from the sagas.json registry. */
+    sagaKind: string;
+    /** Service id of the orchestrator (`tenant`, `billing`, …). */
+    orchestrator: string;
+    /** When the orchestrator issued this RPC. */
+    issuedAt: Date;
+    /**
+     * When the orchestrator considers this step timed out. Participants SHOULD
+     * short-circuit if past it.
+     */
+    timeoutAt: Date;
+    /** Optional W3C traceparent — pinned to the per-step OTel span. */
+    traceId?: string;
+}
+export type SagaEnvelopeParseError = {
+    kind: "missing";
+    field: string;
+} | {
+    kind: "invalid_uuid";
+    field: string;
+    value: string;
+} | {
+    kind: "invalid_timestamp";
+    field: string;
+    value: string;
+} | {
+    kind: "timeout_before_issued";
+    issuedAt: string;
+    timeoutAt: string;
+};
+/** The 7 `x-saga-*` headers, in canonical order. */
+export declare const SAGA_ENVELOPE_HEADERS: {
+    readonly sagaId: "x-saga-id";
+    readonly stepId: "x-step-id";
+    readonly sagaKind: "x-saga-kind";
+    readonly orchestrator: "x-saga-orchestrator";
+    readonly issuedAt: "x-saga-issued-at";
+    readonly timeoutAt: "x-saga-timeout-at";
+    readonly traceId: "x-saga-trace-id";
+};
+export interface SagaEnvelopeHeaders {
+    sagaId?: string;
+    stepId?: string;
+    sagaKind?: string;
+    orchestrator?: string;
+    issuedAt?: string;
+    timeoutAt?: string;
+    traceId?: string;
+}
+/**
+ * Build a SagaEnvelope from the raw header strings. Returns the envelope on
+ * success, or a typed error describing the first validation failure.
+ *
+ * Returns `null` when NONE of the required envelope fields are present —
+ * caller treats that as "no envelope sent" (a non-saga call).
+ */
+export declare function parseSagaEnvelope(headers: SagaEnvelopeHeaders): {
+    ok: true;
+    envelope: SagaEnvelope;
+} | {
+    ok: false;
+    error: SagaEnvelopeParseError;
+} | null;
+//# sourceMappingURL=saga-envelope.d.ts.map

package/dist/saga-envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"saga-envelope.d.ts","sourceRoot":"","sources":["../src/saga-envelope.ts"],"names":[],"mappings":"AAyBA,8EAA8E;AAC9E,MAAM,WAAW,YAAY;IAC3B,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,YAAY,EAAE,MAAM,CAAC;IACrB,6CAA6C;IAC7C,QAAQ,EAAE,IAAI,CAAC;IACf;;;OAGG;IACH,SAAS,EAAE,IAAI,CAAC;IAChB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,sBAAsB,GAC9B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,uBAAuB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAM3E,oDAAoD;AACpD,eAAO,MAAM,qBAAqB;;;;;;;;CAQxB,CAAC;AAEX,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,mBAAmB,GAE1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,YAAY,CAAA;CAAE,GACpC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,sBAAsB,CAAA;CAAE,GAC5C,IAAI,CA2FP"}

package/dist/saga-envelope.js

@@ -0,0 +1,131 @@
+// SagaEnvelope — the doctrine-locked metadata carried on every saga-participant
+// gRPC RPC. Wire format on gRPC metadata is discrete per-field headers (NOT a
+// single JSON blob), to match the existing partial-envelope `x-saga-id` /
+// `x-step-id` headers handled by the saga context interceptor. The full
+// envelope is 7 `x-saga-*` headers:
+//
+//   x-saga-id            — UUID (orchestrator-stable saga id)
+//   x-step-id            — UUID (unique per participant step)
+//   x-saga-kind          — string from the sagas.json registry
+//   x-saga-orchestrator  — service id of the orchestrator
+//   x-saga-issued-at     — ISO 8601 UTC
+//   x-saga-timeout-at    — ISO 8601 UTC
+//   x-saga-trace-id      — W3C traceparent (OPTIONAL)
+//
+// Per comm-doctrine § 5.1 (`x-nodii-saga-id`, `x-nodii-saga-trace-id`) the
+// auto-injected client headers exist; the FULL per-step envelope (this file)
+// is the participant-side IPC contract billing's `withSagaIdempotency` depends
+// on. Backwards compat: when ONLY `x-saga-id` + `x-step-id` are present, the
+// legacy saga-context interceptor handles them (no envelope built); when all
+// required envelope fields are present, `withSagaEnvelopeUnary` builds the full
+// envelope and attaches it to the call as `aug.sagaEnvelope`.
+//
+// Ported from billing's `src/lib/saga/SagaEnvelope.ts` into the lib so every
+// adopter gets the identical parse from `@nodii/grpc-interceptors`.
+// UUID v1-v8. Matches the other interceptors' regex shape.
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+/** The 7 `x-saga-*` headers, in canonical order. */
+export const SAGA_ENVELOPE_HEADERS = {
+    sagaId: "x-saga-id",
+    stepId: "x-step-id",
+    sagaKind: "x-saga-kind",
+    orchestrator: "x-saga-orchestrator",
+    issuedAt: "x-saga-issued-at",
+    timeoutAt: "x-saga-timeout-at",
+    traceId: "x-saga-trace-id",
+};
+/**
+ * Build a SagaEnvelope from the raw header strings. Returns the envelope on
+ * success, or a typed error describing the first validation failure.
+ *
+ * Returns `null` when NONE of the required envelope fields are present —
+ * caller treats that as "no envelope sent" (a non-saga call).
+ */
+export function parseSagaEnvelope(headers) {
+    // None of the required fields present → no envelope on the wire.
+    const anyPresent = headers.sagaId !== undefined ||
+        headers.stepId !== undefined ||
+        headers.sagaKind !== undefined ||
+        headers.orchestrator !== undefined ||
+        headers.issuedAt !== undefined ||
+        headers.timeoutAt !== undefined;
+    if (!anyPresent)
+        return null;
+    // When ANY required field is present, ALL of them must be present — a
+    // partial envelope is a wire-contract violation.
+    for (const [field, value] of [
+        ["saga_id", headers.sagaId],
+        ["step_id", headers.stepId],
+        ["saga_kind", headers.sagaKind],
+        ["orchestrator", headers.orchestrator],
+        ["issued_at", headers.issuedAt],
+        ["timeout_at", headers.timeoutAt],
+    ]) {
+        if (value === undefined || value.length === 0) {
+            return { ok: false, error: { kind: "missing", field } };
+        }
+    }
+    const sagaId = headers.sagaId;
+    const stepId = headers.stepId;
+    const sagaKind = headers.sagaKind;
+    const orchestrator = headers.orchestrator;
+    const issuedAtRaw = headers.issuedAt;
+    const timeoutAtRaw = headers.timeoutAt;
+    if (!UUID_RE.test(sagaId)) {
+        return {
+            ok: false,
+            error: { kind: "invalid_uuid", field: "saga_id", value: sagaId },
+        };
+    }
+    if (!UUID_RE.test(stepId)) {
+        return {
+            ok: false,
+            error: { kind: "invalid_uuid", field: "step_id", value: stepId },
+        };
+    }
+    const issuedAt = new Date(issuedAtRaw);
+    if (Number.isNaN(issuedAt.getTime())) {
+        return {
+            ok: false,
+            error: {
+                kind: "invalid_timestamp",
+                field: "issued_at",
+                value: issuedAtRaw,
+            },
+        };
+    }
+    const timeoutAt = new Date(timeoutAtRaw);
+    if (Number.isNaN(timeoutAt.getTime())) {
+        return {
+            ok: false,
+            error: {
+                kind: "invalid_timestamp",
+                field: "timeout_at",
+                value: timeoutAtRaw,
+            },
+        };
+    }
+    if (timeoutAt.getTime() <= issuedAt.getTime()) {
+        return {
+            ok: false,
+            error: {
+                kind: "timeout_before_issued",
+                issuedAt: issuedAtRaw,
+                timeoutAt: timeoutAtRaw,
+            },
+        };
+    }
+    return {
+        ok: true,
+        envelope: {
+            sagaId,
+            stepId,
+            sagaKind,
+            orchestrator,
+            issuedAt,
+            timeoutAt,
+            traceId: headers.traceId,
+        },
+    };
+}
+//# sourceMappingURL=saga-envelope.js.map

package/dist/saga-envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"saga-envelope.js","sourceRoot":"","sources":["../src/saga-envelope.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,8EAA8E;AAC9E,0EAA0E;AAC1E,wEAAwE;AACxE,oCAAoC;AACpC,EAAE;AACF,8DAA8D;AAC9D,8DAA8D;AAC9D,+DAA+D;AAC/D,0DAA0D;AAC1D,wCAAwC;AACxC,wCAAwC;AACxC,sDAAsD;AACtD,EAAE;AACF,2EAA2E;AAC3E,6EAA6E;AAC7E,+EAA+E;AAC/E,6EAA6E;AAC7E,6EAA6E;AAC7E,gFAAgF;AAChF,8DAA8D;AAC9D,EAAE;AACF,6EAA6E;AAC7E,oEAAoE;AA6BpE,2DAA2D;AAC3D,MAAM,OAAO,GACX,4EAA4E,CAAC;AAE/E,oDAAoD;AACpD,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,WAAW;IACnB,QAAQ,EAAE,aAAa;IACvB,YAAY,EAAE,qBAAqB;IACnC,QAAQ,EAAE,kBAAkB;IAC5B,SAAS,EAAE,mBAAmB;IAC9B,OAAO,EAAE,iBAAiB;CAClB,CAAC;AAYX;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAA4B;IAK5B,iEAAiE;IACjE,MAAM,UAAU,GACd,OAAO,CAAC,MAAM,KAAK,SAAS;QAC5B,OAAO,CAAC,MAAM,KAAK,SAAS;QAC5B,OAAO,CAAC,QAAQ,KAAK,SAAS;QAC9B,OAAO,CAAC,YAAY,KAAK,SAAS;QAClC,OAAO,CAAC,QAAQ,KAAK,SAAS;QAC9B,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC;IAClC,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAE7B,sEAAsE;IACtE,iDAAiD;IACjD,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI;QAC3B,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC;QAC3B,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC;QAC3B,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC;QAC/B,CAAC,cAAc,EAAE,OAAO,CAAC,YAAY,CAAC;QACtC,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC;QAC/B,CAAC,YAAY,EAAE,OAAO,CAAC,SAAS,CAAC;KACzB,EAAE,CAAC;QACX,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAgB,CAAC;IACxC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAgB,CAAC;IACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAkB,CAAC;IAC5C,MAAM,YAAY,GAAG,OAAO,CAAC,YAAsB,CAAC;IACpD,MAAM,WAAW,GAAG,OAAO,CAAC,QAAkB,CAAC;IAC/C,MAAM,YAAY,GAAG,OAAO,CAAC,SAAmB,CAAC;IAEjD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE;SACjE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE;SACjE,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QACrC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,mBAAmB;gBACzB,KAAK,EAAE,WAAW;gBAClB,KAAK,EAAE,WAAW;aACnB;SACF,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QACtC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,mBAAmB;gBACzB,KAAK,EAAE,YAAY;gBACnB,KAAK,EAAE,YAAY;aACpB;SACF,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,CAAC,OAAO,EAAE,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,IAAI,EAAE,uBAAuB;gBAC7B,QAAQ,EAAE,WAAW;gBACrB,SAAS,EAAE,YAAY;aACxB;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,QAAQ,EAAE;YACR,MAAM;YACN,MAAM;YACN,QAAQ;YACR,YAAY;YACZ,QAAQ;YACR,SAAS;YACT,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB;KACF,CAAC;AACJ,CAAC"}

package/dist/types.d.ts

@@ -38,6 +38,12 @@ export interface UnaryCall {
  * mutates onto the call.
  */
 export interface AuthOnCall {
+    /**
+     * The verified raw access token (set by `withAuthUnary`). The MFA leg
+     * decodes it (jose, no re-verification — verification already happened in
+     * `withAuthUnary`) to read the `mfa` / `mfa_at` step-up claims.
+     */
+    rawToken?: string;
     /** Service-to-service actor stamp. */
     serviceActor?: {
         service_id?: string;
@@ -186,6 +192,35 @@ export interface AuditConfig {
     /** Methods skipped entirely (e.g. health checks). */
     skipMethods?: ReadonlySet<string>;
 }
+/**
+ * MFA method-policy — decides which methods require proven step-up MFA.
+ * Caller-configurable: the lib hardcodes no service's method list.
+ */
+export interface MfaPolicy {
+    requiresMfa(methodName: string): boolean;
+}
+/** Config for `withMfaRequiredUnary` — spec D423 / request 388ea83b. */
+export interface MfaRequiredConfig {
+    /**
+     * Fully-qualified (`/svc/Method`) and/or bare (`Method`) gRPC methods that
+     * REQUIRE proven MFA. Used to build the default `MfaPolicy` when `policy`
+     * is not supplied. A method absent from the set is non-MFA (default-allow).
+     */
+    mfaRequiredMethods?: Iterable<string>;
+    /** A pre-built policy — takes precedence over `mfaRequiredMethods`. */
+    policy?: MfaPolicy;
+    /** Freshness window in seconds. Default 900 (15 min). */
+    freshnessSeconds?: number;
+    /** Clock override for deterministic tests. Default `Date.now`. */
+    now?: () => number;
+}
+/** Config for `withSagaIdempotencyUnary` — spec D423 / request 388ea83b. */
+export interface SagaIdempotencyLegConfig {
+    /** Header name a caller would (wrongly) use. Default `x-nodii-idempotency-key`. */
+    headerName?: string;
+    /** TTL (seconds) for the saga claim entry. Defaults to library config. */
+    ttlSeconds?: number;
+}
 /** Deadline guard config — spec § 5.10. */
 export interface DeadlineConfig {
     /** Budget reserved at the inbound boundary in ms. Default 50ms per § 5.10. */
@@ -259,6 +294,27 @@ export interface StandardServerStackConfig {
     requireSagaContextMethods?: ReadonlySet<string>;
     /** sagaContext enforcement mode: 'warn' (default) | 'reject'. */
     sagaContextEnforce?: "warn" | "reject";
+    /**
+     * OPT-IN MFA leg (D423 / request 388ea83b). When set, wires
+     * `withMfaRequiredUnary` at the locked MFA slot — methods the policy marks
+     * MFA-required are rejected without fresh proven MFA. Omitted = MFA slot is
+     * a pure passthrough (back-compat).
+     */
+    mfa?: MfaRequiredConfig;
+    /**
+     * OPT-IN saga-envelope leg (D423 / request 388ea83b). When `true`, wires
+     * `withSagaEnvelopeUnary` so the full 7-header `x-saga-*` envelope is parsed
+     * onto `aug.sagaEnvelope`. Required for the saga-idempotency leg. Omitted =
+     * no envelope parsing (back-compat: only the generic `sagaContext` runs).
+     */
+    sagaEnvelope?: boolean;
+    /**
+     * OPT-IN saga-aware idempotency leg (D423 / request 388ea83b). When set,
+     * wires `withSagaIdempotencyUnary` — a canonical `(tenant_id, method,
+     * saga_id, step_id)` key over the service idempotency store for saga calls,
+     * rejecting a caller idempotency-key. Requires `sagaEnvelope: true`.
+     */
+    sagaIdempotency?: SagaIdempotencyLegConfig | boolean;
 }
 /** Subset of `@nodii/telemetry` we depend on at runtime. */
 export interface TelemetryShim {

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AASA;;;;;;;GAOG;AACH,MAAM,WAAW,SAAS;IACxB,0EAA0E;IAC1E,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,QAAQ,EAAE;QACR,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,OAAO,EAAE,CAAC;KACtC,CAAC;IACF,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC;IACvD,2DAA2D;IAC3D,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,sCAAsC;IACtC,YAAY,CAAC,EAAE;QACb,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KAC5B,CAAC;IACF,yDAAyD;IACzD,SAAS,CAAC,EAAE;QACV,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IACF;;;;;;OAMG;IACH,cAAc,CAAC,EAAE;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;QACzC,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AAED,6CAA6C;AAC7C,MAAM,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEjE;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,YAAY,KAClB,YAAY,CAAC;AAElB,8EAA8E;AAC9E,MAAM,MAAM,cAAc,GACtB,IAAI,GACJ,WAAW,GACX,SAAS,GACT,kBAAkB,GAClB,mBAAmB,GACnB,WAAW,GACX,gBAAgB,GAChB,mBAAmB,GACnB,oBAAoB,GACpB,qBAAqB,GACrB,SAAS,GACT,cAAc,GACd,eAAe,GACf,UAAU,GACV,aAAa,GACb,WAAW,GACX,iBAAiB,CAAC;AAEtB,oDAAoD;AACpD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,cAAc,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,gFAAgF;AAChF,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAOlE;AAED,8EAA8E;AAC9E,qBAAa,iBAAkB,SAAQ,eAAe;gBACxC,MAAM,SAAsB;CAIzC;AAED,4DAA4D;AAC5D,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAED,8EAA8E;AAC9E,MAAM,WAAW,YAAY;IAC3B;;;;;OAKG;IACH,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/D;AAED,0EAA0E;AAC1E,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,IAAI,EAAE;QACT,MAAM,EAAE,MAAM,CAAC;QACf,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACnC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAED,gFAAgF;AAChF,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC3D,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1D,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1D,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC5D;AAED,+CAA+C;AAC/C,MAAM,WAAW,aAAa;IAC5B,iEAAiE;IACjE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IACvC,uEAAuE;IACvE,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,gFAAgF;IAChF,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;CACvB;AAED,8EAA8E;AAC9E,MAAM,WAAW,WAAW;IAC1B;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,OAAO,WAAW,EAAE,aAAa,CAAC;IAClD;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACzC,qDAAqD;IACrD,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACnC;AAED,2CAA2C;AAC3C,MAAM,WAAW,cAAc;IAC7B,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC5C;AAED,+CAA+C;AAC/C,MAAM,WAAW,kBAAkB;IACjC,oEAAoE;IACpE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iFAAiF;IACjF,QAAQ,CAAC,EAAE,SAAS,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;CACpD;AAED,sDAAsD;AACtD,MAAM,WAAW,mBAAmB;IAClC,gDAAgD;IAChD,EAAE,EAAE,YAAY,CAAC;IACjB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC5C;AAED,qDAAqD;AACrD,MAAM,WAAW,kBAAkB;IACjC,4EAA4E;IAC5E,EAAE,EAAE,YAAY,CAAC;IACjB,iEAAiE;IACjE,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,+CAA+C;AAC/C,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjD,iFAAiF;IACjF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,iBAAiB,CAAC,EAAE,MAAM,MAAM,CAAC;CAClC;AAED,8EAA8E;AAC9E,MAAM,WAAW,yBAAyB;IACxC,gBAAgB,EAAE,MAAM,CAAC;IACzB,EAAE,CAAC,EAAE,YAAY,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC7C,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,MAAM,CAAC,EAAE;QAAE,oBAAoB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;KAAE,CAAC;IACxD,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,uEAAuE;IACvE,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC,0DAA0D;IAC1D,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B;;;;OAIG;IACH,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC;;;OAGG;IACH,yBAAyB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAChD,iEAAiE;IACjE,kBAAkB,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;CACxC;AAED,4DAA4D;AAC5D,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,iBAAiB,CAAC;IAC1B,KAAK,EAAE,YAAY,CAAC;CACrB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AASA;;;;;;;GAOG;AACH,MAAM,WAAW,SAAS;IACxB,0EAA0E;IAC1E,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,QAAQ,EAAE;QACR,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,OAAO,EAAE,CAAC;KACtC,CAAC;IACF,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC;IACvD,2DAA2D;IAC3D,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sCAAsC;IACtC,YAAY,CAAC,EAAE;QACb,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;KAC5B,CAAC;IACF,yDAAyD;IACzD,SAAS,CAAC,EAAE;QACV,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IACF;;;;;;OAMG;IACH,cAAc,CAAC,EAAE;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;QACzC,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AAED,6CAA6C;AAC7C,MAAM,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEjE;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,YAAY,KAClB,YAAY,CAAC;AAElB,8EAA8E;AAC9E,MAAM,MAAM,cAAc,GACtB,IAAI,GACJ,WAAW,GACX,SAAS,GACT,kBAAkB,GAClB,mBAAmB,GACnB,WAAW,GACX,gBAAgB,GAChB,mBAAmB,GACnB,oBAAoB,GACpB,qBAAqB,GACrB,SAAS,GACT,cAAc,GACd,eAAe,GACf,UAAU,GACV,aAAa,GACb,WAAW,GACX,iBAAiB,CAAC;AAEtB,oDAAoD;AACpD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,cAAc,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,gFAAgF;AAChF,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAOlE;AAED,8EAA8E;AAC9E,qBAAa,iBAAkB,SAAQ,eAAe;gBACxC,MAAM,SAAsB;CAIzC;AAED,4DAA4D;AAC5D,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAED,8EAA8E;AAC9E,MAAM,WAAW,YAAY;IAC3B;;;;;OAKG;IACH,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/D;AAED,0EAA0E;AAC1E,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,IAAI,EAAE;QACT,MAAM,EAAE,MAAM,CAAC;QACf,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACnC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB;AAED,gFAAgF;AAChF,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC3D,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1D,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1D,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC5D;AAED,+CAA+C;AAC/C,MAAM,WAAW,aAAa;IAC5B,iEAAiE;IACjE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IACvC,uEAAuE;IACvE,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,gFAAgF;IAChF,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;CACvB;AAED,8EAA8E;AAC9E,MAAM,WAAW,WAAW;IAC1B;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,OAAO,WAAW,EAAE,aAAa,CAAC;IAClD;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACzC,qDAAqD;IACrD,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACnC;AAED;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1C;AAED,wEAAwE;AACxE,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtC,uEAAuE;IACvE,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,yDAAyD;IACzD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kEAAkE;IAClE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,4EAA4E;AAC5E,MAAM,WAAW,wBAAwB;IACvC,mFAAmF;IACnF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,2CAA2C;AAC3C,MAAM,WAAW,cAAc;IAC7B,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC5C;AAED,+CAA+C;AAC/C,MAAM,WAAW,kBAAkB;IACjC,oEAAoE;IACpE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iFAAiF;IACjF,QAAQ,CAAC,EAAE,SAAS,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;CACpD;AAED,sDAAsD;AACtD,MAAM,WAAW,mBAAmB;IAClC,gDAAgD;IAChD,EAAE,EAAE,YAAY,CAAC;IACjB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC5C;AAED,qDAAqD;AACrD,MAAM,WAAW,kBAAkB;IACjC,4EAA4E;IAC5E,EAAE,EAAE,YAAY,CAAC;IACjB,iEAAiE;IACjE,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,+CAA+C;AAC/C,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjD,iFAAiF;IACjF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,iBAAiB,CAAC,EAAE,MAAM,MAAM,CAAC;CAClC;AAED,8EAA8E;AAC9E,MAAM,WAAW,yBAAyB;IACxC,gBAAgB,EAAE,MAAM,CAAC;IACzB,EAAE,CAAC,EAAE,YAAY,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC7C,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,MAAM,CAAC,EAAE;QAAE,oBAAoB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;KAAE,CAAC;IACxD,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,uEAAuE;IACvE,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC,0DAA0D;IAC1D,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B;;;;OAIG;IACH,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC;;;OAGG;IACH,yBAAyB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAChD,iEAAiE;IACjE,kBAAkB,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IACvC;;;;;OAKG;IACH,GAAG,CAAC,EAAE,iBAAiB,CAAC;IACxB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,wBAAwB,GAAG,OAAO,CAAC;CACtD;AAED,4DAA4D;AAC5D,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,iBAAiB,CAAC;IAC1B,KAAK,EAAE,YAAY,CAAC;CACrB"}

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,oDAAoD;AACpD,EAAE;AACF,gFAAgF;AAChF,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,2EAA2E;AAC3E,wEAAwE;AAgHxE,gFAAgF;AAChF,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAC/B,IAAI,CAAiB;IACrB,MAAM,CAAS;IACxB,YAAY,IAAoB,EAAE,MAAc,EAAE,KAAe;QAC/D,KAAK,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,KAAK,KAAK,SAAS;YAAG,IAA4B,CAAC,KAAK,GAAG,KAAK,CAAC;IACvE,CAAC;CACF;AAED,8EAA8E;AAC9E,MAAM,OAAO,iBAAkB,SAAQ,eAAe;IACpD,YAAY,MAAM,GAAG,mBAAmB;QACtC,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,4DAA4D;AAC5D,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,oDAAoD;AACpD,EAAE;AACF,gFAAgF;AAChF,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,2EAA2E;AAC3E,wEAAwE;AAsHxE,gFAAgF;AAChF,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAC/B,IAAI,CAAiB;IACrB,MAAM,CAAS;IACxB,YAAY,IAAoB,EAAE,MAAc,EAAE,KAAe;QAC/D,KAAK,CAAC,GAAG,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,KAAK,KAAK,SAAS;YAAG,IAA4B,CAAC,KAAK,GAAG,KAAK,CAAC;IACvE,CAAC;CACF;AAED,8EAA8E;AAC9E,MAAM,OAAO,iBAAkB,SAAQ,eAAe;IACpD,YAAY,MAAM,GAAG,mBAAmB;QACtC,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,4DAA4D;AAC5D,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nodii/grpc-interceptors",
-  "version": "0.5.3",
+  "version": "0.6.0",
   "description": "Substrate gRPC interceptor library for the Nodii microservice stack — 8 cross-cutting interceptors (logging, audit, enrichAuthContext, tenantContext, auditContext, deadlineGuard, cancellationGuard, errorMap) + re-export façade over @nodii/grpc-auth/saga/idempotency + locked-order createStandardServerStack factory. Spec: planning hub docKey=grpc-interceptors.",
   "license": "MIT",
   "type": "module",
@@ -23,15 +23,18 @@
     "typecheck": "tsc --noEmit",
     "test": "bun test"
   },
+  "dependencies": {
+    "jose": "^5.9.6"
+  },
   "devDependencies": {
-    "@nodii/audit-chain": "0.9.1",
+    "@nodii/audit-chain": "0.10.0",
     "ioredis": "^5.4.0",
     "postgres": "^3.4.0",
     "typescript": "^5.9.3",
     "@nodii/grpc-auth": "0.9.1",
     "@nodii/idempotency": "0.6.1",
     "@nodii/saga": "0.8.0",
-    "@nodii/telemetry": "0.9.1"
+    "@nodii/telemetry": "0.13.0"
   },
   "repository": {
     "type": "git",