@olane/o-core 0.8.4 → 0.8.6

package/dist/src/auth/file-token-store.d.ts

@@ -0,0 +1,15 @@
+import type { oTokenStore, oTokenStoreEntry } from './o-token-store.js';
+export interface FileTokenStoreConfig {
+    directory: string;
+}
+export declare class FileTokenStore implements oTokenStore {
+    private directory;
+    private initialized;
+    constructor(config: FileTokenStoreConfig);
+    get(key: string): Promise<oTokenStoreEntry | null>;
+    set(key: string, entry: oTokenStoreEntry): Promise<void>;
+    delete(key: string): Promise<void>;
+    private keyToPath;
+    private ensureDirectory;
+}
+//# sourceMappingURL=file-token-store.d.ts.map

package/dist/src/auth/file-token-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-token-store.d.ts","sourceRoot":"","sources":["../../../src/auth/file-token-store.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAExE,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,cAAe,YAAW,WAAW;IAChD,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,WAAW,CAAS;gBAEhB,MAAM,EAAE,oBAAoB;IAIlC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAqBlD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAWxD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOxC,OAAO,CAAC,SAAS;YAKH,eAAe;CAK9B"}

package/dist/src/auth/file-token-store.js

@@ -0,0 +1,55 @@
+import { readFile, writeFile, rename, unlink, mkdir } from 'node:fs/promises';
+import { join } from 'node:path';
+export class FileTokenStore {
+    constructor(config) {
+        this.initialized = false;
+        this.directory = config.directory;
+    }
+    async get(key) {
+        await this.ensureDirectory();
+        const filePath = this.keyToPath(key);
+        let raw;
+        try {
+            raw = await readFile(filePath, 'utf-8');
+        }
+        catch (err) {
+            if (err.code === 'ENOENT')
+                return null;
+            throw err;
+        }
+        try {
+            return JSON.parse(raw);
+        }
+        catch {
+            // Corrupted file — remove it and return null
+            await unlink(filePath).catch(() => { });
+            return null;
+        }
+    }
+    async set(key, entry) {
+        await this.ensureDirectory();
+        const filePath = this.keyToPath(key);
+        const tmpPath = filePath + '.tmp';
+        const data = JSON.stringify(entry, null, 2);
+        // Atomic write: write to tmp, then rename
+        await writeFile(tmpPath, data, { encoding: 'utf-8', mode: 0o600 });
+        await rename(tmpPath, filePath);
+    }
+    async delete(key) {
+        const filePath = this.keyToPath(key);
+        await unlink(filePath).catch((err) => {
+            if (err.code !== 'ENOENT')
+                throw err;
+        });
+    }
+    keyToPath(key) {
+        const sanitized = key.replace(/[^a-zA-Z0-9_\-\.]/g, '_');
+        return join(this.directory, `${sanitized}.token.json`);
+    }
+    async ensureDirectory() {
+        if (this.initialized)
+            return;
+        await mkdir(this.directory, { recursive: true, mode: 0o700 });
+        this.initialized = true;
+    }
+}

package/dist/src/auth/index.d.ts

@@ -0,0 +1,6 @@
+export * from './o-token-provider.js';
+export * from './o-token-manager.js';
+export * from './o-token-store.js';
+export * from './o-refresh-token-provider.js';
+export * from './file-token-store.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,uBAAuB,CAAC"}

package/dist/src/auth/index.js

@@ -0,0 +1,5 @@
+export * from './o-token-provider.js';
+export * from './o-token-manager.js';
+export * from './o-token-store.js';
+export * from './o-refresh-token-provider.js';
+export * from './file-token-store.js';

package/dist/src/auth/o-refresh-token-provider.d.ts

@@ -0,0 +1,31 @@
+import type { oTokenProvider, oTokenResult } from './o-token-provider.js';
+export interface OAuth2TokenResponse {
+    access_token: string;
+    expires_in?: number;
+    refresh_token?: string;
+    token_type?: string;
+    [key: string]: any;
+}
+export interface RefreshTokenProviderConfig {
+    tokenEndpoint: string;
+    refreshToken: string;
+    clientId?: string;
+    clientSecret?: string;
+    headers?: Record<string, string>;
+    additionalParams?: Record<string, string>;
+    parseResponse?: (body: any) => oTokenResult;
+}
+export declare class RefreshTokenProvider implements oTokenProvider {
+    private tokenEndpoint;
+    private refreshToken;
+    private clientId?;
+    private clientSecret?;
+    private headers;
+    private additionalParams;
+    private parseResponse;
+    constructor(config: RefreshTokenProviderConfig);
+    acquireToken(): Promise<oTokenResult>;
+    updateRefreshToken(token: string): void;
+    static defaultParseResponse(body: OAuth2TokenResponse): oTokenResult;
+}
+//# sourceMappingURL=o-refresh-token-provider.d.ts.map

package/dist/src/auth/o-refresh-token-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"o-refresh-token-provider.d.ts","sourceRoot":"","sources":["../../../src/auth/o-refresh-token-provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAE1E,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB;AAED,MAAM,WAAW,0BAA0B;IACzC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK,YAAY,CAAC;CAC7C;AAED,qBAAa,oBAAqB,YAAW,cAAc;IACzD,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,CAAS;IAC1B,OAAO,CAAC,YAAY,CAAC,CAAS;IAC9B,OAAO,CAAC,OAAO,CAAyB;IACxC,OAAO,CAAC,gBAAgB,CAAyB;IACjD,OAAO,CAAC,aAAa,CAA8B;gBAEvC,MAAM,EAAE,0BAA0B;IAUxC,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;IAyC3C,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAIvC,MAAM,CAAC,oBAAoB,CAAC,IAAI,EAAE,mBAAmB,GAAG,YAAY;CAmBrE"}

package/dist/src/auth/o-refresh-token-provider.js

@@ -0,0 +1,61 @@
+export class RefreshTokenProvider {
+    constructor(config) {
+        this.tokenEndpoint = config.tokenEndpoint;
+        this.refreshToken = config.refreshToken;
+        this.clientId = config.clientId;
+        this.clientSecret = config.clientSecret;
+        this.headers = config.headers ?? {};
+        this.additionalParams = config.additionalParams ?? {};
+        this.parseResponse = config.parseResponse ?? RefreshTokenProvider.defaultParseResponse;
+    }
+    async acquireToken() {
+        const body = new URLSearchParams({
+            grant_type: 'refresh_token',
+            refresh_token: this.refreshToken,
+            ...this.additionalParams,
+        });
+        if (this.clientId) {
+            body.set('client_id', this.clientId);
+        }
+        if (this.clientSecret) {
+            body.set('client_secret', this.clientSecret);
+        }
+        const response = await fetch(this.tokenEndpoint, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+                ...this.headers,
+            },
+            body: body.toString(),
+        });
+        if (!response.ok) {
+            const text = await response.text().catch(() => '');
+            throw new Error(`Token refresh failed: ${response.status} ${response.statusText}${text ? ` - ${text}` : ''}`);
+        }
+        const json = await response.json();
+        const result = this.parseResponse(json);
+        // Rotate stored refresh token if the provider returned a new one
+        if (result.refreshToken) {
+            this.refreshToken = result.refreshToken;
+        }
+        return result;
+    }
+    updateRefreshToken(token) {
+        this.refreshToken = token;
+    }
+    static defaultParseResponse(body) {
+        if (!body.access_token) {
+            throw new Error('Token response missing access_token');
+        }
+        const result = {
+            token: body.access_token,
+        };
+        if (body.expires_in != null) {
+            result.expiresAt = Math.floor(Date.now() / 1000) + body.expires_in;
+        }
+        if (body.refresh_token) {
+            result.refreshToken = body.refresh_token;
+        }
+        return result;
+    }
+}

package/dist/src/auth/o-token-manager.d.ts

@@ -0,0 +1,46 @@
+import type { oTokenProvider, oTokenResult } from './o-token-provider.js';
+import type { oTokenStore } from './o-token-store.js';
+import type { ORequestAuthContext } from '../context/o-request-context.js';
+export interface oTokenManagerConfig {
+    provider: oTokenProvider;
+    autoRefresh?: boolean;
+    refreshBufferMs?: number;
+    defaultLifetimeMs?: number;
+    maxRefreshRetries?: number;
+    onRefreshFailure?: (error: Error) => void;
+    store?: oTokenStore;
+    storeKey?: string;
+}
+export declare class oTokenManager {
+    private provider;
+    private autoRefresh;
+    private refreshBufferMs;
+    private defaultLifetimeMs;
+    private maxRefreshRetries;
+    private onRefreshFailure?;
+    private store;
+    private storeKey;
+    private storeLoaded;
+    private currentResult;
+    private acquiredAt;
+    private refreshPromise;
+    private refreshTimer;
+    private destroyed;
+    constructor(config: oTokenManagerConfig);
+    getToken(forceRefresh?: boolean): Promise<string>;
+    getTokenResult(forceRefresh?: boolean): Promise<oTokenResult>;
+    refresh(): Promise<oTokenResult>;
+    isExpired(): boolean;
+    isCloseToExpiration(): boolean;
+    getTimeUntilExpiration(): number | null;
+    toAuthContext(): ORequestAuthContext | null;
+    destroy(): Promise<void>;
+    private loadFromStore;
+    private saveToStore;
+    private executeRefreshWithRetry;
+    private scheduleAutoRefresh;
+    private clearRefreshTimer;
+    private getExpiresAtMs;
+    private sleep;
+}
+//# sourceMappingURL=o-token-manager.d.ts.map

package/dist/src/auth/o-token-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"o-token-manager.d.ts","sourceRoot":"","sources":["../../../src/auth/o-token-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC1E,OAAO,KAAK,EAAE,WAAW,EAAoB,MAAM,oBAAoB,CAAC;AACxE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AAE3E,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,cAAc,CAAC;IACzB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gBAAgB,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IAC1C,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAiB;IACjC,OAAO,CAAC,WAAW,CAAU;IAC7B,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,gBAAgB,CAAC,CAAyB;IAElD,OAAO,CAAC,KAAK,CAAqB;IAClC,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,WAAW,CAAS;IAE5B,OAAO,CAAC,aAAa,CAA6B;IAClD,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,cAAc,CAAsC;IAC5D,OAAO,CAAC,YAAY,CAA8C;IAClE,OAAO,CAAC,SAAS,CAAS;gBAEd,MAAM,EAAE,mBAAmB;IAWjC,QAAQ,CAAC,YAAY,UAAQ,GAAG,OAAO,CAAC,MAAM,CAAC;IAK/C,cAAc,CAAC,YAAY,UAAQ,GAAG,OAAO,CAAC,YAAY,CAAC;IAoB3D,OAAO,IAAI,OAAO,CAAC,YAAY,CAAC;IAoBtC,SAAS,IAAI,OAAO;IAOpB,mBAAmB,IAAI,OAAO;IAO9B,sBAAsB,IAAI,MAAM,GAAG,IAAI;IAOvC,aAAa,IAAI,mBAAmB,GAAG,IAAI;IAarC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;YAgBhB,aAAa;YA4Bb,WAAW;YAiBX,uBAAuB;IA2BrC,OAAO,CAAC,mBAAmB;IAwB3B,OAAO,CAAC,iBAAiB;IAOzB,OAAO,CAAC,cAAc;IAetB,OAAO,CAAC,KAAK;CAGd"}

package/dist/src/auth/o-token-manager.js

@@ -0,0 +1,211 @@
+export class oTokenManager {
+    constructor(config) {
+        this.storeLoaded = false;
+        this.currentResult = null;
+        this.acquiredAt = null;
+        this.refreshPromise = null;
+        this.refreshTimer = null;
+        this.destroyed = false;
+        this.provider = config.provider;
+        this.autoRefresh = config.autoRefresh ?? true;
+        this.refreshBufferMs = config.refreshBufferMs ?? 60000;
+        this.defaultLifetimeMs = config.defaultLifetimeMs ?? 3600000;
+        this.maxRefreshRetries = config.maxRefreshRetries ?? 3;
+        this.onRefreshFailure = config.onRefreshFailure;
+        this.store = config.store ?? null;
+        this.storeKey = config.storeKey ?? 'default';
+    }
+    async getToken(forceRefresh = false) {
+        const result = await this.getTokenResult(forceRefresh);
+        return result.token;
+    }
+    async getTokenResult(forceRefresh = false) {
+        if (this.destroyed) {
+            throw new Error('oTokenManager has been destroyed');
+        }
+        if (!forceRefresh && this.currentResult && !this.isExpired()) {
+            return this.currentResult;
+        }
+        // On first call, try to restore from persistent store
+        if (!forceRefresh && !this.currentResult && this.store && !this.storeLoaded) {
+            const restored = await this.loadFromStore();
+            if (restored && !this.isExpired()) {
+                return this.currentResult;
+            }
+        }
+        return this.refresh();
+    }
+    async refresh() {
+        if (this.destroyed) {
+            throw new Error('oTokenManager has been destroyed');
+        }
+        // Concurrent deduplication: share a single in-flight refresh
+        if (this.refreshPromise) {
+            return this.refreshPromise;
+        }
+        this.refreshPromise = this.executeRefreshWithRetry();
+        try {
+            const result = await this.refreshPromise;
+            return result;
+        }
+        finally {
+            this.refreshPromise = null;
+        }
+    }
+    isExpired() {
+        if (!this.currentResult)
+            return true;
+        const expiresAt = this.getExpiresAtMs();
+        if (expiresAt === null)
+            return false;
+        return Date.now() >= expiresAt;
+    }
+    isCloseToExpiration() {
+        if (!this.currentResult)
+            return true;
+        const expiresAt = this.getExpiresAtMs();
+        if (expiresAt === null)
+            return false;
+        return Date.now() >= expiresAt - this.refreshBufferMs;
+    }
+    getTimeUntilExpiration() {
+        if (!this.currentResult)
+            return null;
+        const expiresAt = this.getExpiresAtMs();
+        if (expiresAt === null)
+            return null;
+        return Math.max(0, expiresAt - Date.now());
+    }
+    toAuthContext() {
+        if (!this.currentResult)
+            return null;
+        return {
+            token: this.currentResult.token,
+            claims: {
+                sub: this.currentResult.claims?.sub,
+                iss: this.currentResult.claims?.iss,
+                ...this.currentResult.claims,
+            },
+        };
+    }
+    async destroy() {
+        this.destroyed = true;
+        this.clearRefreshTimer();
+        // Persist latest state before clearing memory
+        await this.saveToStore();
+        this.currentResult = null;
+        this.acquiredAt = null;
+        this.refreshPromise = null;
+        if (this.provider.destroy) {
+            await this.provider.destroy();
+        }
+    }
+    async loadFromStore() {
+        this.storeLoaded = true;
+        try {
+            const entry = await this.store.get(this.storeKey);
+            if (!entry)
+                return false;
+            this.currentResult = {
+                token: entry.token,
+                expiresAt: entry.expiresAt,
+                claims: entry.claims,
+                refreshToken: entry.refreshToken,
+            };
+            this.acquiredAt = entry.acquiredAt;
+            // Feed persisted refresh token back to provider
+            if (entry.refreshToken && this.provider.updateRefreshToken) {
+                this.provider.updateRefreshToken(entry.refreshToken);
+            }
+            this.scheduleAutoRefresh();
+            return true;
+        }
+        catch {
+            // Store failures are non-fatal — degrade to in-memory
+            return false;
+        }
+    }
+    async saveToStore() {
+        if (!this.store || !this.currentResult || this.acquiredAt === null)
+            return;
+        try {
+            const entry = {
+                token: this.currentResult.token,
+                expiresAt: this.currentResult.expiresAt,
+                claims: this.currentResult.claims,
+                refreshToken: this.currentResult.refreshToken,
+                acquiredAt: this.acquiredAt,
+            };
+            await this.store.set(this.storeKey, entry);
+        }
+        catch {
+            // Store failures are non-fatal
+        }
+    }
+    async executeRefreshWithRetry() {
+        let lastError = null;
+        for (let attempt = 0; attempt <= this.maxRefreshRetries; attempt++) {
+            try {
+                const result = await this.provider.acquireToken();
+                this.currentResult = result;
+                this.acquiredAt = Date.now();
+                this.scheduleAutoRefresh();
+                await this.saveToStore();
+                return result;
+            }
+            catch (err) {
+                lastError = err instanceof Error ? err : new Error(String(err));
+                if (attempt < this.maxRefreshRetries) {
+                    // Exponential backoff: 1s, 2s, 4s, ...
+                    const delayMs = Math.min(1000 * Math.pow(2, attempt), 30000);
+                    await this.sleep(delayMs);
+                }
+            }
+        }
+        const error = lastError ?? new Error('Token refresh failed');
+        this.onRefreshFailure?.(error);
+        throw error;
+    }
+    scheduleAutoRefresh() {
+        this.clearRefreshTimer();
+        if (!this.autoRefresh || this.destroyed)
+            return;
+        const expiresAt = this.getExpiresAtMs();
+        if (expiresAt === null)
+            return;
+        const refreshAt = expiresAt - this.refreshBufferMs;
+        const delay = Math.max(0, refreshAt - Date.now());
+        this.refreshTimer = setTimeout(() => {
+            if (this.destroyed)
+                return;
+            this.refresh().catch((err) => {
+                // onRefreshFailure already called in executeRefreshWithRetry
+            });
+        }, delay);
+        // Don't block process exit
+        if (this.refreshTimer && typeof this.refreshTimer === 'object' && 'unref' in this.refreshTimer) {
+            this.refreshTimer.unref();
+        }
+    }
+    clearRefreshTimer() {
+        if (this.refreshTimer !== null) {
+            clearTimeout(this.refreshTimer);
+            this.refreshTimer = null;
+        }
+    }
+    getExpiresAtMs() {
+        if (!this.currentResult)
+            return null;
+        if (this.currentResult.expiresAt != null) {
+            return this.currentResult.expiresAt * 1000; // convert unix seconds to ms
+        }
+        // No expiry info — fall back to defaultLifetimeMs from acquisition time
+        if (this.acquiredAt != null) {
+            return this.acquiredAt + this.defaultLifetimeMs;
+        }
+        return null;
+    }
+    sleep(ms) {
+        return new Promise((resolve) => setTimeout(resolve, ms));
+    }
+}

package/dist/src/auth/o-token-provider.d.ts

@@ -0,0 +1,16 @@
+export interface oTokenResult {
+    token: string;
+    expiresAt?: number;
+    claims?: {
+        sub?: string;
+        iss?: string;
+        [key: string]: any;
+    };
+    refreshToken?: string;
+}
+export interface oTokenProvider {
+    acquireToken(): Promise<oTokenResult>;
+    destroy?(): Promise<void>;
+    updateRefreshToken?(token: string): void;
+}
+//# sourceMappingURL=o-token-provider.d.ts.map

package/dist/src/auth/o-token-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"o-token-provider.d.ts","sourceRoot":"","sources":["../../../src/auth/o-token-provider.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KAAE,CAAC;IAC5D,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC,CAAC;IACtC,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,kBAAkB,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1C"}

package/dist/src/auth/o-token-provider.js

@@ -0,0 +1 @@
+export {};

package/dist/src/auth/o-token-store.d.ts

@@ -0,0 +1,17 @@
+export interface oTokenStoreEntry {
+    token: string;
+    expiresAt?: number;
+    claims?: {
+        sub?: string;
+        iss?: string;
+        [key: string]: any;
+    };
+    refreshToken?: string;
+    acquiredAt: number;
+}
+export interface oTokenStore {
+    get(key: string): Promise<oTokenStoreEntry | null>;
+    set(key: string, entry: oTokenStoreEntry): Promise<void>;
+    delete(key: string): Promise<void>;
+}
+//# sourceMappingURL=o-token-store.d.ts.map

package/dist/src/auth/o-token-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"o-token-store.d.ts","sourceRoot":"","sources":["../../../src/auth/o-token-store.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KAAE,CAAC;IAC5D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACnD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC"}

package/dist/src/auth/o-token-store.js

@@ -0,0 +1 @@
+export {};

package/dist/src/context/index.d.ts

@@ -0,0 +1,2 @@
+export * from './o-request-context.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/context/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/context/index.ts"],"names":[],"mappings":"AAAA,cAAc,wBAAwB,CAAC"}

package/dist/src/context/index.js

@@ -0,0 +1 @@
+export * from './o-request-context.js';

package/dist/src/context/o-request-context.d.ts

@@ -0,0 +1,22 @@
+import type { oTokenManager } from '../auth/o-token-manager.js';
+export interface ORequestAuthContext {
+    token: string;
+    claims: {
+        sub?: string;
+        iss?: string;
+        aud?: string | string[];
+        exp?: number;
+        [key: string]: any;
+    };
+}
+export interface ORequestStore {
+    auth?: ORequestAuthContext;
+    tokenManager?: oTokenManager;
+}
+export declare const oRequestContext: {
+    run<T>(store: ORequestStore, fn: () => T): T;
+    getStore(): ORequestStore | undefined;
+    getAuth(): ORequestAuthContext | undefined;
+    getTokenManager(): oTokenManager | undefined;
+};
+//# sourceMappingURL=o-request-context.d.ts.map

package/dist/src/context/o-request-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"o-request-context.d.ts","sourceRoot":"","sources":["../../../src/context/o-request-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAEhE,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE;QACN,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;QACxB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;KACpB,CAAC;CACH;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,mBAAmB,CAAC;IAC3B,YAAY,CAAC,EAAE,aAAa,CAAC;CAC9B;AAgBD,eAAO,MAAM,eAAe;QACtB,CAAC,SAAS,aAAa,MAAM,MAAM,CAAC,GAAG,CAAC;gBAoBhC,aAAa,GAAG,SAAS;eAO1B,mBAAmB,GAAG,SAAS;uBAIvB,aAAa,GAAG,SAAS;CAG7C,CAAC"}

package/dist/src/context/o-request-context.js

@@ -0,0 +1,47 @@
+// Runtime detection: use native AsyncLocalStorage if available (Node, Deno, Bun, CF Workers).
+// Falls back to a simple variable for browsers/React Native where concurrent
+// multi-user requests don't happen.
+let nativeALS = null;
+try {
+    const mod = await import('node:async_hooks');
+    nativeALS = new mod.AsyncLocalStorage();
+}
+catch {
+    // Not available — browser or React Native runtime
+}
+// Browser fallback state
+let currentStore;
+export const oRequestContext = {
+    run(store, fn) {
+        if (nativeALS) {
+            return nativeALS.run(store, fn);
+        }
+        // Browser fallback: simple variable swap (safe for single-user environments)
+        const prev = currentStore;
+        currentStore = store;
+        try {
+            const result = fn();
+            if (result instanceof Promise) {
+                return result.finally(() => { currentStore = prev; });
+            }
+            currentStore = prev;
+            return result;
+        }
+        catch (e) {
+            currentStore = prev;
+            throw e;
+        }
+    },
+    getStore() {
+        if (nativeALS) {
+            return nativeALS.getStore();
+        }
+        return currentStore;
+    },
+    getAuth() {
+        return oRequestContext.getStore()?.auth;
+    },
+    getTokenManager() {
+        return oRequestContext.getStore()?.tokenManager;
+    },
+};

package/dist/src/core/interfaces/o-core.config.d.ts

@@ -2,6 +2,7 @@ import { Libp2pConfig } from '@olane/o-config';
 import { oAddress } from '../../router/o-address.js';
 import { NodeType } from './node-type.enum.js';
 import { oDependency, oMethod } from '@olane/o-protocol';
+import type { oTokenManager } from '../../auth/o-token-manager.js';
 export interface oCoreConfig {
     address: oAddress;
     leader: oAddress | null;
@@ -19,6 +20,7 @@ export interface oCoreConfig {
     cwd?: string;
     systemName?: string;
     joinToken?: string;
+    tokenManager?: oTokenManager;
     /**
      * Internal flag - bypasses nested address validation.
      * Should only be used by framework internals or tests.

package/dist/src/core/interfaces/o-core.config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"o-core.config.d.ts","sourceRoot":"","sources":["../../../../src/core/interfaces/o-core.config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEzD,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,QAAQ,CAAC;IAClB,MAAM,EAAE,QAAQ,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,QAAQ,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;IAC7B,OAAO,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B"}
+{"version":3,"file":"o-core.config.d.ts","sourceRoot":"","sources":["../../../../src/core/interfaces/o-core.config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAEnE,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,QAAQ,CAAC;IAClB,MAAM,EAAE,QAAQ,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,QAAQ,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,WAAW,EAAE,CAAC;IAC7B,OAAO,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,aAAa,CAAC;IAE7B;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B"}

package/dist/src/core/interfaces/use-data.config.d.ts

@@ -1,6 +1,13 @@
 export interface UseDataConfig {
     method: string;
     params?: {
+        _auth?: {
+            token: string;
+            claims: {
+                sub?: string;
+                [key: string]: any;
+            };
+        };
         [key: string]: any;
     };
     id?: string;

package/dist/src/core/interfaces/use-data.config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"use-data.config.d.ts","sourceRoot":"","sources":["../../../../src/core/interfaces/use-data.config.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KAAE,CAAC;IAChC,EAAE,CAAC,EAAE,MAAM,CAAC;CACb"}
+{"version":3,"file":"use-data.config.d.ts","sourceRoot":"","sources":["../../../../src/core/interfaces/use-data.config.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE;QACP,KAAK,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE;gBAAE,GAAG,CAAC,EAAE,MAAM,CAAC;gBAAC,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;aAAE,CAAA;SAAE,CAAC;QACxE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;KACpB,CAAC;IACF,EAAE,CAAC,EAAE,MAAM,CAAC;CACb"}

package/dist/src/core/o-core.d.ts

@@ -18,6 +18,7 @@ import { oNotificationEvent, EventFilter, NotificationHandler, Subscription } fr
 import { UseOptions } from './interfaces/use-options.interface.js';
 import { UseStreamOptions } from './interfaces/use-stream-options.interface.js';
 import { UseDataConfig } from './interfaces/use-data.config.js';
+import { oTokenManager } from '../auth/o-token-manager.js';
 export declare abstract class oCore extends oObject {
     readonly config: oCoreConfig;
     address: oAddress;
@@ -29,6 +30,7 @@ export declare abstract class oCore extends oObject {
     requestManager?: oRequestManager;
     router: oRouter;
     notificationManager: oNotificationManager;
+    tokenManager?: oTokenManager;
     private heartbeatInterval?;
     constructor(config: oCoreConfig);
     get isLeader(): boolean;
@@ -96,6 +98,18 @@ export declare abstract class oCore extends oObject {
      * @throws Error if node is not running
      */
     private validateRunning;
+    /**
+     * Injects _auth into request params if not already present.
+     *
+     * Resolution order:
+     * 1. AsyncLocalStorage context (propagated auth from an incoming request)
+     * 2. Node-level tokenManager (the node's own identity)
+     *
+     * This ensures every outbound request carries auth — whether it originates
+     * from within a request chain or from a node-initiated call (registration,
+     * heartbeat, etc.).
+     */
+    private injectAuthContext;
     useSelf(data?: {
         method?: string;
         params?: {

package/dist/src/core/o-core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"o-core.d.ts","sourceRoot":"","sources":["../../../src/core/o-core.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAC3E,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AAEtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EACL,kBAAkB,EAClB,WAAW,EACX,mBAAmB,EACnB,YAAY,EACb,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,MAAM,uCAAuC,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8CAA8C,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAEhE,8BAAsB,KAAM,SAAQ,OAAO;IAY7B,QAAQ,CAAC,MAAM,EAAE,WAAW;IAXjC,OAAO,EAAE,QAAQ,CAAC;IAClB,KAAK,EAAE,SAAS,CAAqB;IACrC,MAAM,EAAE,KAAK,EAAE,CAAM;IACrB,iBAAiB,EAAG,kBAAkB,CAAC;IACvC,gBAAgB,EAAG,iBAAiB,CAAC;IACrC,OAAO,EAAE,QAAQ,CAAkB;IACnC,cAAc,CAAC,EAAE,eAAe,CAAC;IACjC,MAAM,EAAG,OAAO,CAAC;IACjB,mBAAmB,EAAG,oBAAoB,CAAC;IAClD,OAAO,CAAC,iBAAiB,CAAC,CAAiB;gBAEtB,MAAM,EAAE,WAAW;IAcxC,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED,IAAI,MAAM,IAAI,QAAQ,GAAG,IAAI,CAE5B;IAGD,QAAQ,CAAC,mBAAmB,IAAI,GAAG,EAAE;IAE/B,SAAS,CACb,OAAO,EAAE,QAAQ,EACjB,IAAI,EAAE,aAAa,EACnB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,SAAS,CAAC;IAiBf,SAAS,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC;IAI5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoDG;IACG,GAAG,CACP,OAAO,EAAE,QAAQ,EACjB,IAAI,CAAC,EAAE,aAAa,EACpB,OAAO,CAAC,EAAE,UAAU,GACnB,OAAO,CAAC,SAAS,CAAC;IAcrB,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC;IAEjD;;;OAGG;IACH,OAAO,CAAC,eAAe;IAOjB,OAAO,CAAC,IAAI,CAAC,EAAE;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE;YAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;SAAE,CAAC;QAChC,EAAE,CAAC,EAAE,MAAM,CAAC;KACb,GAAG,OAAO,CAAC,SAAS,CAAC;IAyBhB,OAAO,CACX,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;QACL,MAAM,CAAC,EAAE;YAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;SAAE,CAAC;KACjC;IAWG,QAAQ,CACZ,YAAY,EAAE,QAAQ,EACtB,IAAI,CAAC,EAAE,aAAa,EACpB,OAAO,CAAC,EAAE,UAAU,GACnB,OAAO,CAAC,SAAS,CAAC;IAyBrB,YAAY,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI;IAI/B,eAAe,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI;IAKlC,QAAQ,CAAC,gBAAgB,IAAI,IAAI;IAGjC,QAAQ,CAAC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IACpC,QAAQ,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAGlC,SAAS,CAAC,QAAQ,CAAC,yBAAyB,IAAI,oBAAoB;IAEpE;;OAEG;IACH,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI;IAMjD;;OAEG;IACH,SAAS,CAAC,cAAc,CACtB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,mBAAmB,EAC5B,MAAM,CAAC,EAAE,WAAW,GACnB,YAAY;IAQT,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAIjC,IAAI,SAAS,IAAI,OAAO,CAMvB;cAEe,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACU,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAmCnC;;;;;;;OAOG;cAEa,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAEnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACU,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAyBrB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IActC,QAAQ,CAAC,kBAAkB,IAAI,IAAI;IAEnC;;;OAGG;IACH,SAAS,CAAC,UAAU,IAAI,IAAI;IAqB5B,IAAI,YAAY,IAAI,WAAW,EAAE,CAEhC;IAED;;;OAGG;IACH,OAAO,CAAC,cAAc;IA0CtB,IAAI,OAAO,IAAI;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAExC;IAED,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,aAAa,IAAI,QAAQ,CAE5B;IAED,IAAI,IAAI,IAAI,QAAQ,CAEnB;IAED,IAAI,UAAU,IAAI,UAAU,EAAE,CAE7B;IAED,IAAI,MAAM,IAAI,QAAQ,GAAG,IAAI,CAE5B;IAED,IAAI,gBAAgB,IAAI,UAAU,EAAE,CAEnC;IAEK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC;CAQ7B"}
+{"version":3,"file":"o-core.d.ts","sourceRoot":"","sources":["../../../src/core/o-core.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAC3E,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AAEtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EACL,kBAAkB,EAClB,WAAW,EACX,mBAAmB,EACnB,YAAY,EACb,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,MAAM,uCAAuC,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8CAA8C,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAEhE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAE3D,8BAAsB,KAAM,SAAQ,OAAO;IAa7B,QAAQ,CAAC,MAAM,EAAE,WAAW;IAZjC,OAAO,EAAE,QAAQ,CAAC;IAClB,KAAK,EAAE,SAAS,CAAqB;IACrC,MAAM,EAAE,KAAK,EAAE,CAAM;IACrB,iBAAiB,EAAG,kBAAkB,CAAC;IACvC,gBAAgB,EAAG,iBAAiB,CAAC;IACrC,OAAO,EAAE,QAAQ,CAAkB;IACnC,cAAc,CAAC,EAAE,eAAe,CAAC;IACjC,MAAM,EAAG,OAAO,CAAC;IACjB,mBAAmB,EAAG,oBAAoB,CAAC;IAC3C,YAAY,CAAC,EAAE,aAAa,CAAC;IACpC,OAAO,CAAC,iBAAiB,CAAC,CAAiB;gBAEtB,MAAM,EAAE,WAAW;IAkBxC,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED,IAAI,MAAM,IAAI,QAAQ,GAAG,IAAI,CAE5B;IAGD,QAAQ,CAAC,mBAAmB,IAAI,GAAG,EAAE;IAE/B,SAAS,CACb,OAAO,EAAE,QAAQ,EACjB,IAAI,EAAE,aAAa,EACnB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,SAAS,CAAC;IAiBf,SAAS,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC;IAI5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoDG;IACG,GAAG,CACP,OAAO,EAAE,QAAQ,EACjB,IAAI,CAAC,EAAE,aAAa,EACpB,OAAO,CAAC,EAAE,UAAU,GACnB,OAAO,CAAC,SAAS,CAAC;IAgBrB,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC;IAEjD;;;OAGG;IACH,OAAO,CAAC,eAAe;IAOvB;;;;;;;;;;OAUG;YACW,iBAAiB;IAgCzB,OAAO,CAAC,IAAI,CAAC,EAAE;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE;YAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;SAAE,CAAC;QAChC,EAAE,CAAC,EAAE,MAAM,CAAC;KACb,GAAG,OAAO,CAAC,SAAS,CAAC;IA2BhB,OAAO,CACX,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE;QACL,MAAM,CAAC,EAAE;YAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;SAAE,CAAC;KACjC;IAWG,QAAQ,CACZ,YAAY,EAAE,QAAQ,EACtB,IAAI,CAAC,EAAE,aAAa,EACpB,OAAO,CAAC,EAAE,UAAU,GACnB,OAAO,CAAC,SAAS,CAAC;IA2BrB,YAAY,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI;IAI/B,eAAe,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI;IAKlC,QAAQ,CAAC,gBAAgB,IAAI,IAAI;IAGjC,QAAQ,CAAC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IACpC,QAAQ,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAGlC,SAAS,CAAC,QAAQ,CAAC,yBAAyB,IAAI,oBAAoB;IAEpE;;OAEG;IACH,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI;IAMjD;;OAEG;IACH,SAAS,CAAC,cAAc,CACtB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,mBAAmB,EAC5B,MAAM,CAAC,EAAE,WAAW,GACnB,YAAY;IAQT,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAIjC,IAAI,SAAS,IAAI,OAAO,CAMvB;cAEe,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACU,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAmCnC;;;;;;;OAOG;cAEa,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;IAEnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACU,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAyBrB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IActC,QAAQ,CAAC,kBAAkB,IAAI,IAAI;IAEnC;;;OAGG;IACH,SAAS,CAAC,UAAU,IAAI,IAAI;IAqB5B,IAAI,YAAY,IAAI,WAAW,EAAE,CAEhC;IAED;;;OAGG;IACH,OAAO,CAAC,cAAc;IA0CtB,IAAI,OAAO,IAAI;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAExC;IAED,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,IAAI,aAAa,IAAI,QAAQ,CAE5B;IAED,IAAI,IAAI,IAAI,QAAQ,CAEnB;IAED,IAAI,UAAU,IAAI,UAAU,EAAE,CAE7B;IAED,IAAI,MAAM,IAAI,QAAQ,GAAG,IAAI,CAE5B;IAED,IAAI,gBAAgB,IAAI,UAAU,EAAE,CAEnC;IAEK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC;CAQ7B"}

package/dist/src/core/o-core.js

@@ -6,6 +6,7 @@ import { oObject } from './o-object.js';
 import { oMetrics } from './lib/o-metrics.js';
 import { oRequest } from '../connection/o-request.js';
 import { ResponseBuilder } from '../response/response-builder.js';
+import { oRequestContext } from '../context/o-request-context.js';
 export class oCore extends oObject {
     constructor(config) {
         super((config.name ? `:${config.name}` : '') + ':' + config.address.toString());
@@ -19,6 +20,9 @@ export class oCore extends oObject {
             config.address.validateNotNested();
         }
         this.address = config.address || new oAddress('o://node');
+        if (config.tokenManager) {
+            this.tokenManager = config.tokenManager;
+        }
     }
     get isLeader() {
         return this.config.type === NodeType.LEADER;
@@ -99,10 +103,11 @@ export class oCore extends oObject {
         if (!this.requestManager) {
             throw new Error('Request manager is not initialized');
         }
+        const enriched = await this.injectAuthContext(data);
         if (address?.toStaticAddress().equals(this.address.toStaticAddress())) {
-            return this.useSelf(data);
+            return this.useSelf(enriched);
         }
-        return this.requestManager.send(address, data, options, this);
+        return this.requestManager.send(address, enriched, options, this);
     }
     /**
      * Helper method to validate node is running
@@ -114,14 +119,54 @@ export class oCore extends oObject {
             throw new Error('Node is not running');
         }
     }
+    /**
+     * Injects _auth into request params if not already present.
+     *
+     * Resolution order:
+     * 1. AsyncLocalStorage context (propagated auth from an incoming request)
+     * 2. Node-level tokenManager (the node's own identity)
+     *
+     * This ensures every outbound request carries auth — whether it originates
+     * from within a request chain or from a node-initiated call (registration,
+     * heartbeat, etc.).
+     */
+    async injectAuthContext(data) {
+        if (!data)
+            return data;
+        // Already has explicit _auth — don't overwrite
+        if (data.params?._auth)
+            return data;
+        // 1. Propagated auth from incoming request context
+        let auth = oRequestContext.getAuth();
+        // 2. Fallback: node's own identity via tokenManager
+        if (!auth && this.tokenManager) {
+            try {
+                await this.tokenManager.getTokenResult();
+                auth = this.tokenManager.toAuthContext() ?? undefined;
+            }
+            catch (error) {
+                this.logger.debug('Failed to get token from tokenManager:', error);
+            }
+        }
+        if (!auth)
+            return data;
+        return {
+            ...data,
+            params: {
+                ...data.params,
+                _auth: auth,
+            },
+        };
+    }
     async useSelf(data) {
         this.validateRunning();
+        const enriched = await this.injectAuthContext(data);
         const request = new oRequest({
-            method: data?.method,
+            method: enriched?.method,
             params: {
                 _connectionId: 0,
-                _requestMethod: data?.method,
-                ...data?.params,
+                _requestMethod: enriched?.method,
+                ...enriched?.params,
             },
             id: 0,
         });
@@ -150,6 +195,7 @@ export class oCore extends oObject {
         if (!this.requestManager) {
             throw new Error('Request manager is not initialized');
         }
+        const enriched = await this.injectAuthContext(data);
         // extract child address with transports
         if (!childAddress.transports) {
             const child = this.hierarchyManager.getChild(childAddress);
@@ -161,7 +207,7 @@ export class oCore extends oObject {
                 childAddress.setTransports(child?.transports || []);
             }
         }
-        return this.requestManager.send(childAddress, data, options, this);
+        return this.requestManager.send(childAddress, enriched, options, this);
     }
     // hierarchy
     addChildNode(node) {

package/dist/src/index.d.ts

@@ -1,4 +1,6 @@
+export * from './auth/index.js';
 export * from './connection/index.js';
+export * from './context/index.js';
 export * from './core/index.js';
 export * from './error/index.js';
 export * from './response/index.js';

package/dist/src/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,kBAAkB,CAAC"}

package/dist/src/index.js

@@ -1,4 +1,6 @@
+export * from './auth/index.js';
 export * from './connection/index.js';
+export * from './context/index.js';
 export * from './core/index.js';
 export * from './error/index.js';
 export * from './response/index.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@olane/o-core",
-  "version": "0.8.4",
+  "version": "0.8.6",
   "type": "module",
   "main": "dist/src/index.js",
   "types": "dist/src/index.d.ts",
@@ -63,12 +63,12 @@
     "typescript": "^5.8.3"
   },
   "dependencies": {
-    "@olane/o-protocol": "0.8.4",
+    "@olane/o-protocol": "0.8.6",
     "chalk": "^5.4.1",
     "debug": "^4.4.1",
     "dotenv": "^16.5.0",
     "multiformats": "^13.3.7",
     "stream-json": "^1.9.1"
   },
-  "gitHead": "b53623b1ad4365133911722f80d5597a72b65bf2"
+  "gitHead": "530f7e3c8576d9427f4181b91bdfb6ae1843cffa"
 }