@origins-digital/nestjs-shared-key-http 0.0.0-stage → 1.0.1

package/README.md

@@ -1,3 +1,107 @@
-# Temporary Holding Version
+# @origins-digital/nestjs-shared-key-http
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+`HttpService` for calls between Origins services: it adds the internal service
+token (`x-internal-auth-token`) and `x-service-name`, so services no longer
+build those headers by hand.
+
+## Rule (`applyInternalAuth`)
+
+The internal headers are added only when the request has **neither** an
+`authorization` **nor** an `x-internal-auth-token` header key (case-insensitive,
+whatever the value, `undefined` and `''` included). Key presence means "the
+caller decided": a forwarded session token that is missing is not replaced by
+the internal token, so the service still answers 401.
+
+- A caller-provided `x-internal-auth-token` or `x-service-name` is never overwritten.
+- The JWT is fetched only when it will be sent.
+- If the token cannot be resolved, the request rejects before it is sent.
+
+## Installation
+
+```bash
+yarn add @origins-digital/nestjs-shared-key-http
+```
+
+Peer dependencies: `@nestjs/common`, `@nestjs/axios`, `axios`, `rxjs`,
+`@origins-digital/nestjs-shared-key`.
+
+## Usage
+
+`SharedKeyHttpService` needs `SharedKeyService`. The module never registers
+`SharedKeyModule` itself, so the app keeps its key backend (SSM or Secrets
+Manager) and its options. Either register it globally once:
+
+```ts
+@Module({
+  imports: [
+    SharedKeyModule.forRoot({ isGlobal: true }),
+    SharedKeyHttpModule, // default options
+  ],
+})
+export class AppModule {}
+```
+
+or pass the module that provides it:
+
+```ts
+SharedKeyHttpModule.register({
+  serviceName: 'origins-backoffice-orchestrator', // x-service-name
+  imports: [SharedKeyModule],
+  axiosConfig: { timeout: 10_000 }, // defaults of the module's own axios instance
+  isGlobal: false,
+});
+```
+
+Then inject it (it extends `HttpService`):
+
+```ts
+@Injectable()
+export class VideoClient {
+  constructor(private readonly http: SharedKeyHttpService) {}
+
+  async getVideo(id: string) {
+    const { data } = await this.http.getAsPromise<Video>(`${host}/videos/${id}`, {
+      requestedService: 'origins-video-service',
+    });
+    return data;
+  }
+}
+```
+
+- `getAsPromise`, `postAsPromise`, `putAsPromise`, `patchAsPromise`,
+  `deleteAsPromise`, `headAsPromise` turn HTTP errors into the Nest exception
+  built by `raiseError` (`@origins-digital/error-utils`), labelled with
+  `requestedService`. Other errors pass through unchanged.
+- The Observable methods of `HttpService` (`get`, `post`, ...) apply the same rule.
+- The service uses its own axios instance: a plain `HttpModule` (calls to
+  external hosts) never gets the internal token.
+
+`x-service-name` defaults to `${APP_ENV}-${npm_package_name}` (the package name
+alone without `APP_ENV`, `unknown-service` without a package name). Note that
+`npm_package_name` is only set when the app is started through npm/yarn; pass
+`serviceName` to make it explicit.
+
+## Other clients (hey-api)
+
+The rule is a plain axios request interceptor, reusable on any axios instance:
+
+```ts
+client.instance.interceptors.request.use((config) =>
+  applyInternalAuth(config, () => sharedKeyHttp.internalHeaders()),
+);
+keepCallerAuthKeys(client);
+```
+
+hey-api drops header keys whose value is `undefined` before axios runs, so the
+rule would not see `authorization: undefined`. `keepCallerAuthKeys(client)`
+wraps the client's request methods and sends `''` instead
+(`withCallerAuthKeys(options)` is the pure version). Nest's `HttpService` keeps
+undefined keys, so `SharedKeyHttpService` does not need it.
+
+## Build
+
+```bash
+yarn build
+yarn test
+yarn lint
+```

package/dist/caller-auth-keys.d.ts

@@ -0,0 +1,40 @@
+export type CallerAuthCallOptions = {
+    headers?: unknown;
+};
+export declare const HTTP_CLIENT_METHODS: readonly ["request", "get", "post", "put", "patch", "delete", "head", "options", "connect", "trace"];
+/**
+ * The part of a generated client (e.g. a hey-api axios client) that
+ * `keepCallerAuthKeys` wraps. Methods are declared as methods (bivariant
+ * parameters), so each generated client's narrower option types fit.
+ */
+export interface CallerAuthClient {
+    request(options?: CallerAuthCallOptions): unknown;
+    get(options?: CallerAuthCallOptions): unknown;
+    post(options?: CallerAuthCallOptions): unknown;
+    put(options?: CallerAuthCallOptions): unknown;
+    patch(options?: CallerAuthCallOptions): unknown;
+    delete(options?: CallerAuthCallOptions): unknown;
+    head(options?: CallerAuthCallOptions): unknown;
+    options(options?: CallerAuthCallOptions): unknown;
+    connect(options?: CallerAuthCallOptions): unknown;
+    trace(options?: CallerAuthCallOptions): unknown;
+}
+/**
+ * Returns `options` with undefined `authorization` / `x-internal-auth-token`
+ * header values replaced by ''. Only plain-object headers are normalised;
+ * anything else (none, `Headers`, `AxiosHeaders`) is returned as is.
+ */
+export declare const withCallerAuthKeys: (options?: CallerAuthCallOptions) => CallerAuthCallOptions | undefined;
+/**
+ * Some clients (hey-api) drop header keys whose value is undefined before axios
+ * runs, so `applyInternalAuth` would not see `authorization: undefined` and
+ * would add the internal token. Wrapping the client's request methods with
+ * `withCallerAuthKeys` sends '' instead, which keeps the caller's choice
+ * visible: the rule leaves the request alone and the service answers 401, as
+ * it does for a missing header. Mutates and returns `client`.
+ *
+ * Not needed on Nest's `HttpService`: it hands the config to axios as is, and
+ * axios keeps undefined header keys.
+ */
+export declare const keepCallerAuthKeys: <C extends CallerAuthClient>(client: C) => C;
+//# sourceMappingURL=caller-auth-keys.d.ts.map

package/dist/caller-auth-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller-auth-keys.d.ts","sourceRoot":"","sources":["../src/caller-auth-keys.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,qBAAqB,GAAG;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAE1D,eAAO,MAAM,mBAAmB,sGAWtB,CAAC;AAEX;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC;IAClD,GAAG,CAAC,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC;IAC9C,IAAI,CAAC,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC;IAC/C,GAAG,CAAC,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC;IAC9C,KAAK,CAAC,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC;IAChD,MAAM,CAAC,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC;IACjD,IAAI,CAAC,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC;IAC/C,OAAO,CAAC,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC;IAClD,OAAO,CAAC,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC;IAClD,KAAK,CAAC,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC;CACjD;AAWD;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAC7B,UAAU,qBAAqB,KAC9B,qBAAqB,GAAG,SAY1B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,GAAI,CAAC,SAAS,gBAAgB,EAC3D,QAAQ,CAAC,KACR,CAQF,CAAC"}

package/dist/caller-auth-keys.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.keepCallerAuthKeys = exports.withCallerAuthKeys = exports.HTTP_CLIENT_METHODS = void 0;
+const internal_auth_rule_1 = require("./internal-auth.rule");
+exports.HTTP_CLIENT_METHODS = [
+    'request',
+    'get',
+    'post',
+    'put',
+    'patch',
+    'delete',
+    'head',
+    'options',
+    'connect',
+    'trace',
+];
+const isPlainObject = (value) => {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+};
+const isUndefinedCallerAuth = ([key, value]) => value === undefined && internal_auth_rule_1.CALLER_AUTH_HEADERS.has(key.toLowerCase());
+/**
+ * Returns `options` with undefined `authorization` / `x-internal-auth-token`
+ * header values replaced by ''. Only plain-object headers are normalised;
+ * anything else (none, `Headers`, `AxiosHeaders`) is returned as is.
+ */
+const withCallerAuthKeys = (options) => {
+    const headers = options === null || options === void 0 ? void 0 : options.headers;
+    if (!isPlainObject(headers))
+        return options;
+    const entries = Object.entries(headers);
+    if (!entries.some(isUndefinedCallerAuth))
+        return options;
+    const kept = entries.map(([key, value]) => [
+        key,
+        isUndefinedCallerAuth([key, value]) ? '' : value,
+    ]);
+    return Object.assign(Object.assign({}, options), { headers: Object.fromEntries(kept) });
+};
+exports.withCallerAuthKeys = withCallerAuthKeys;
+/**
+ * Some clients (hey-api) drop header keys whose value is undefined before axios
+ * runs, so `applyInternalAuth` would not see `authorization: undefined` and
+ * would add the internal token. Wrapping the client's request methods with
+ * `withCallerAuthKeys` sends '' instead, which keeps the caller's choice
+ * visible: the rule leaves the request alone and the service answers 401, as
+ * it does for a missing header. Mutates and returns `client`.
+ *
+ * Not needed on Nest's `HttpService`: it hands the config to axios as is, and
+ * axios keeps undefined header keys.
+ */
+const keepCallerAuthKeys = (client) => {
+    const target = client;
+    for (const method of exports.HTTP_CLIENT_METHODS) {
+        const send = target[method].bind(target);
+        target[method] = (options) => send((0, exports.withCallerAuthKeys)(options));
+    }
+    return client;
+};
+exports.keepCallerAuthKeys = keepCallerAuthKeys;
+//# sourceMappingURL=caller-auth-keys.js.map

package/dist/caller-auth-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"caller-auth-keys.js","sourceRoot":"","sources":["../src/caller-auth-keys.ts"],"names":[],"mappings":";;;AAAA,6DAA2D;AAI9C,QAAA,mBAAmB,GAAG;IACjC,SAAS;IACT,KAAK;IACL,MAAM;IACN,KAAK;IACL,OAAO;IACP,QAAQ;IACR,MAAM;IACN,SAAS;IACT,SAAS;IACT,OAAO;CACC,CAAC;AAoBX,MAAM,aAAa,GAAG,CAAC,KAAc,EAAoC,EAAE;IACzE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,KAAK,GAAY,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACpD,OAAO,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC;AACtD,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,CAAoB,EAAW,EAAE,CACzE,KAAK,KAAK,SAAS,IAAI,wCAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;AAEpE;;;;GAIG;AACI,MAAM,kBAAkB,GAAG,CAChC,OAA+B,EACI,EAAE;IACrC,MAAM,OAAO,GAAG,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,CAAC;IACjC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAE5C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC;QAAE,OAAO,OAAO,CAAC;IAEzD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAqB,EAAE,CAAC;QAC5D,GAAG;QACH,qBAAqB,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK;KACjD,CAAC,CAAC;IACH,uCAAY,OAAO,KAAE,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAG;AAC3D,CAAC,CAAC;AAdW,QAAA,kBAAkB,sBAc7B;AAEF;;;;;;;;;;GAUG;AACI,MAAM,kBAAkB,GAAG,CAChC,MAAS,EACN,EAAE;IACL,MAAM,MAAM,GAAqB,MAAM,CAAC;IACxC,KAAK,MAAM,MAAM,IAAI,2BAAmB,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,OAA+B,EAAE,EAAE,CACnD,IAAI,CAAC,IAAA,0BAAkB,EAAC,OAAO,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAVW,QAAA,kBAAkB,sBAU7B"}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export * from './internal-auth.rule';
+export * from './caller-auth-keys';
+export * from './shared-key-http.options';
+export * from './shared-key-http.service';
+export * from './shared-key-http.module';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC"}

package/dist/index.js

@@ -0,0 +1,22 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./internal-auth.rule"), exports);
+__exportStar(require("./caller-auth-keys"), exports);
+__exportStar(require("./shared-key-http.options"), exports);
+__exportStar(require("./shared-key-http.service"), exports);
+__exportStar(require("./shared-key-http.module"), exports);
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uDAAqC;AACrC,qDAAmC;AACnC,4DAA0C;AAC1C,4DAA0C;AAC1C,2DAAyC"}

package/dist/internal-auth.rule.d.ts

@@ -0,0 +1,27 @@
+import { InternalAxiosRequestConfig } from 'axios';
+export declare const INTERNAL_AUTH_TOKEN_HEADER = "x-internal-auth-token";
+export declare const SERVICE_NAME_HEADER = "x-service-name";
+/** Header keys that mean "the caller already chose the credential to send". */
+export declare const CALLER_AUTH_HEADERS: ReadonlySet<string>;
+/** Internal headers to add, e.g. `x-internal-auth-token` and `x-service-name`. */
+export type InternalAuthHeaders = Readonly<Record<string, string>>;
+/** Resolves the internal headers; only called when they will be sent. */
+export type InternalHeadersProvider = () => Promise<InternalAuthHeaders>;
+/**
+ * Axios request-interceptor rule for calls to internal services: adds the
+ * headers of `headersProvider` unless the request already carries an
+ * `authorization` or `x-internal-auth-token` header KEY, compared
+ * case-insensitively and whatever its value.
+ *
+ * Key presence, not value: a caller that forwards `authorization: sessionToken`
+ * with an undefined or empty token keeps sending no valid credential (the
+ * service answers 401) instead of silently getting the internal token.
+ * AxiosHeaders keeps keys whose value is undefined, so `Object.keys` sees them
+ * (`has()` would not). Headers the caller already set (e.g. `x-service-name`)
+ * are never overwritten. A rejection of `headersProvider` rejects the request
+ * before it is sent.
+ *
+ * Usage: `instance.interceptors.request.use((config) => applyInternalAuth(config, provider))`.
+ */
+export declare const applyInternalAuth: (config: InternalAxiosRequestConfig, headersProvider: InternalHeadersProvider) => Promise<InternalAxiosRequestConfig>;
+//# sourceMappingURL=internal-auth.rule.d.ts.map

package/dist/internal-auth.rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-auth.rule.d.ts","sourceRoot":"","sources":["../src/internal-auth.rule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,0BAA0B,EAAE,MAAM,OAAO,CAAC;AAEjE,eAAO,MAAM,0BAA0B,0BAA0B,CAAC;AAClE,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AAEpD,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAGlD,CAAC;AAEH,kFAAkF;AAClF,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEnE,yEAAyE;AACzE,MAAM,MAAM,uBAAuB,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,CAAC;AASzE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,iBAAiB,GAC5B,QAAQ,0BAA0B,EAClC,iBAAiB,uBAAuB,KACvC,OAAO,CAAC,0BAA0B,CAWpC,CAAC"}

package/dist/internal-auth.rule.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.applyInternalAuth = exports.CALLER_AUTH_HEADERS = exports.SERVICE_NAME_HEADER = exports.INTERNAL_AUTH_TOKEN_HEADER = void 0;
+const axios_1 = require("axios");
+exports.INTERNAL_AUTH_TOKEN_HEADER = 'x-internal-auth-token';
+exports.SERVICE_NAME_HEADER = 'x-service-name';
+/** Header keys that mean "the caller already chose the credential to send". */
+exports.CALLER_AUTH_HEADERS = new Set([
+    'authorization',
+    exports.INTERNAL_AUTH_TOKEN_HEADER,
+]);
+/** Whether `headers` has one of `names` as a key, compared case-insensitively. */
+const hasHeaderKey = (headers, names) => Object.keys(headers !== null && headers !== void 0 ? headers : {}).some((key) => names.has(key.toLowerCase()));
+/**
+ * Axios request-interceptor rule for calls to internal services: adds the
+ * headers of `headersProvider` unless the request already carries an
+ * `authorization` or `x-internal-auth-token` header KEY, compared
+ * case-insensitively and whatever its value.
+ *
+ * Key presence, not value: a caller that forwards `authorization: sessionToken`
+ * with an undefined or empty token keeps sending no valid credential (the
+ * service answers 401) instead of silently getting the internal token.
+ * AxiosHeaders keeps keys whose value is undefined, so `Object.keys` sees them
+ * (`has()` would not). Headers the caller already set (e.g. `x-service-name`)
+ * are never overwritten. A rejection of `headersProvider` rejects the request
+ * before it is sent.
+ *
+ * Usage: `instance.interceptors.request.use((config) => applyInternalAuth(config, provider))`.
+ */
+const applyInternalAuth = async (config, headersProvider) => {
+    if (hasHeaderKey(config.headers, exports.CALLER_AUTH_HEADERS))
+        return config;
+    const headers = axios_1.AxiosHeaders.from(config.headers);
+    for (const [name, value] of Object.entries(await headersProvider())) {
+        if (!hasHeaderKey(headers, new Set([name.toLowerCase()]))) {
+            headers.set(name, value);
+        }
+    }
+    config.headers = headers;
+    return config;
+};
+exports.applyInternalAuth = applyInternalAuth;
+//# sourceMappingURL=internal-auth.rule.js.map

package/dist/internal-auth.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal-auth.rule.js","sourceRoot":"","sources":["../src/internal-auth.rule.ts"],"names":[],"mappings":";;;AAAA,iCAAiE;AAEpD,QAAA,0BAA0B,GAAG,uBAAuB,CAAC;AACrD,QAAA,mBAAmB,GAAG,gBAAgB,CAAC;AAEpD,+EAA+E;AAClE,QAAA,mBAAmB,GAAwB,IAAI,GAAG,CAAC;IAC9D,eAAe;IACf,kCAA0B;CAC3B,CAAC,CAAC;AAQH,kFAAkF;AAClF,MAAM,YAAY,GAAG,CACnB,OAA2B,EAC3B,KAA0B,EACjB,EAAE,CACX,MAAM,CAAC,IAAI,CAAC,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAEzE;;;;;;;;;;;;;;;GAeG;AACI,MAAM,iBAAiB,GAAG,KAAK,EACpC,MAAkC,EAClC,eAAwC,EACH,EAAE;IACvC,IAAI,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,2BAAmB,CAAC;QAAE,OAAO,MAAM,CAAC;IAErE,MAAM,OAAO,GAAG,oBAAY,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,eAAe,EAAE,CAAC,EAAE,CAAC;QACpE,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAdW,QAAA,iBAAiB,qBAc5B"}

package/dist/shared-key-http.module.d.ts

@@ -0,0 +1,16 @@
+import { DynamicModule } from '@nestjs/common';
+import { SharedKeyHttpModuleOptions } from './shared-key-http.options';
+/**
+ * Provides `SharedKeyHttpService`. It needs `SharedKeyService`: either the app
+ * registers `SharedKeyModule.forRoot({ isGlobal: true })` once, or the module
+ * gets it through `register({ imports: [...] })`. It never registers
+ * `SharedKeyModule` itself, so the app keeps its choice of key backend
+ * (SSM / Secrets Manager) and options.
+ *
+ * - `imports: [SharedKeyHttpModule]`: default options, global `SharedKeyService`.
+ * - `imports: [SharedKeyHttpModule.register({ serviceName, imports, isGlobal })]`.
+ */
+export declare class SharedKeyHttpModule {
+    static register(options?: SharedKeyHttpModuleOptions): DynamicModule;
+}
+//# sourceMappingURL=shared-key-http.module.d.ts.map

package/dist/shared-key-http.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-key-http.module.d.ts","sourceRoot":"","sources":["../src/shared-key-http.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAoB,MAAM,gBAAgB,CAAC;AAEjE,OAAO,EAGL,0BAA0B,EAC3B,MAAM,2BAA2B,CAAC;AAanC;;;;;;;;;GASG;AACH,qBAIa,mBAAmB;IAC9B,MAAM,CAAC,QAAQ,CAAC,OAAO,GAAE,0BAA+B,GAAG,aAAa;CASzE"}

package/dist/shared-key-http.module.js

@@ -0,0 +1,56 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+var SharedKeyHttpModule_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SharedKeyHttpModule = void 0;
+const common_1 = require("@nestjs/common");
+const axios_1 = __importDefault(require("axios"));
+const shared_key_http_options_1 = require("./shared-key-http.options");
+const shared_key_http_service_1 = require("./shared-key-http.service");
+const createProviders = (options) => [
+    { provide: shared_key_http_options_1.SHARED_KEY_HTTP_OPTIONS, useValue: options },
+    {
+        // Own instance: the auth interceptor never reaches the global axios.
+        provide: shared_key_http_options_1.SHARED_KEY_HTTP_AXIOS_INSTANCE,
+        useFactory: () => axios_1.default.create(options.axiosConfig),
+    },
+    shared_key_http_service_1.SharedKeyHttpService,
+];
+/**
+ * Provides `SharedKeyHttpService`. It needs `SharedKeyService`: either the app
+ * registers `SharedKeyModule.forRoot({ isGlobal: true })` once, or the module
+ * gets it through `register({ imports: [...] })`. It never registers
+ * `SharedKeyModule` itself, so the app keeps its choice of key backend
+ * (SSM / Secrets Manager) and options.
+ *
+ * - `imports: [SharedKeyHttpModule]`: default options, global `SharedKeyService`.
+ * - `imports: [SharedKeyHttpModule.register({ serviceName, imports, isGlobal })]`.
+ */
+let SharedKeyHttpModule = SharedKeyHttpModule_1 = class SharedKeyHttpModule {
+    static register(options = {}) {
+        var _a, _b;
+        return {
+            module: SharedKeyHttpModule_1,
+            global: (_a = options.isGlobal) !== null && _a !== void 0 ? _a : false,
+            imports: (_b = options.imports) !== null && _b !== void 0 ? _b : [],
+            providers: createProviders(options),
+            exports: [shared_key_http_service_1.SharedKeyHttpService],
+        };
+    }
+};
+exports.SharedKeyHttpModule = SharedKeyHttpModule;
+exports.SharedKeyHttpModule = SharedKeyHttpModule = SharedKeyHttpModule_1 = __decorate([
+    (0, common_1.Module)({
+        providers: createProviders({}),
+        exports: [shared_key_http_service_1.SharedKeyHttpService],
+    })
+], SharedKeyHttpModule);
+//# sourceMappingURL=shared-key-http.module.js.map

package/dist/shared-key-http.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-key-http.module.js","sourceRoot":"","sources":["../src/shared-key-http.module.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAAiE;AACjE,kDAA0B;AAC1B,uEAImC;AACnC,uEAAiE;AAEjE,MAAM,eAAe,GAAG,CAAC,OAAmC,EAAc,EAAE,CAAC;IAC3E,EAAE,OAAO,EAAE,iDAAuB,EAAE,QAAQ,EAAE,OAAO,EAAE;IACvD;QACE,qEAAqE;QACrE,OAAO,EAAE,wDAA8B;QACvC,UAAU,EAAE,GAAG,EAAE,CAAC,eAAK,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;KACpD;IACD,8CAAoB;CACrB,CAAC;AAEF;;;;;;;;;GASG;AAKI,IAAM,mBAAmB,2BAAzB,MAAM,mBAAmB;IAC9B,MAAM,CAAC,QAAQ,CAAC,UAAsC,EAAE;;QACtD,OAAO;YACL,MAAM,EAAE,qBAAmB;YAC3B,MAAM,EAAE,MAAA,OAAO,CAAC,QAAQ,mCAAI,KAAK;YACjC,OAAO,EAAE,MAAA,OAAO,CAAC,OAAO,mCAAI,EAAE;YAC9B,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC;YACnC,OAAO,EAAE,CAAC,8CAAoB,CAAC;SAChC,CAAC;IACJ,CAAC;CACF,CAAA;AAVY,kDAAmB;8BAAnB,mBAAmB;IAJ/B,IAAA,eAAM,EAAC;QACN,SAAS,EAAE,eAAe,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC,8CAAoB,CAAC;KAChC,CAAC;GACW,mBAAmB,CAU/B"}

package/dist/shared-key-http.options.d.ts

@@ -0,0 +1,22 @@
+import { ModuleMetadata } from '@nestjs/common';
+import { CreateAxiosDefaults } from 'axios';
+export declare const SHARED_KEY_HTTP_OPTIONS: unique symbol;
+export declare const SHARED_KEY_HTTP_AXIOS_INSTANCE: unique symbol;
+export declare const DEFAULT_SERVICE_NAME = "unknown-service";
+export type SharedKeyHttpModuleOptions = {
+    /** `x-service-name` sent with the internal token. Default: `defaultServiceName()`. */
+    serviceName?: string;
+    /** Defaults of the module's own axios instance (e.g. `timeout`). */
+    axiosConfig?: CreateAxiosDefaults;
+    /**
+     * Modules that provide `SharedKeyService`, e.g. `[SharedKeyModule]`. Leave it
+     * empty when the app registers `SharedKeyModule.forRoot({ isGlobal: true })`
+     * (or `SharedSecretModule`) once at the root.
+     */
+    imports?: ModuleMetadata['imports'];
+    /** Registers the module globally. Default: false. */
+    isGlobal?: boolean;
+};
+/** `${APP_ENV}-${npm_package_name}`, the package name alone without APP_ENV, else `unknown-service`. */
+export declare const defaultServiceName: (env?: NodeJS.ProcessEnv) => string;
+//# sourceMappingURL=shared-key-http.options.d.ts.map

package/dist/shared-key-http.options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-key-http.options.d.ts","sourceRoot":"","sources":["../src/shared-key-http.options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,OAAO,CAAC;AAE5C,eAAO,MAAM,uBAAuB,eAAoC,CAAC;AACzE,eAAO,MAAM,8BAA8B,eAE1C,CAAC;AACF,eAAO,MAAM,oBAAoB,oBAAoB,CAAC;AAEtD,MAAM,MAAM,0BAA0B,GAAG;IACvC,sFAAsF;IACtF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC;;;;OAIG;IACH,OAAO,CAAC,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC;IACpC,qDAAqD;IACrD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,wGAAwG;AACxG,eAAO,MAAM,kBAAkB,GAC7B,MAAK,MAAM,CAAC,UAAwB,KACnC,MAIF,CAAC"}

package/dist/shared-key-http.options.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultServiceName = exports.DEFAULT_SERVICE_NAME = exports.SHARED_KEY_HTTP_AXIOS_INSTANCE = exports.SHARED_KEY_HTTP_OPTIONS = void 0;
+exports.SHARED_KEY_HTTP_OPTIONS = Symbol('SHARED_KEY_HTTP_OPTIONS');
+exports.SHARED_KEY_HTTP_AXIOS_INSTANCE = Symbol('SHARED_KEY_HTTP_AXIOS_INSTANCE');
+exports.DEFAULT_SERVICE_NAME = 'unknown-service';
+/** `${APP_ENV}-${npm_package_name}`, the package name alone without APP_ENV, else `unknown-service`. */
+const defaultServiceName = (env = process.env) => {
+    const packageName = env.npm_package_name;
+    if (!packageName)
+        return exports.DEFAULT_SERVICE_NAME;
+    return env.APP_ENV ? `${env.APP_ENV}-${packageName}` : packageName;
+};
+exports.defaultServiceName = defaultServiceName;
+//# sourceMappingURL=shared-key-http.options.js.map

package/dist/shared-key-http.options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-key-http.options.js","sourceRoot":"","sources":["../src/shared-key-http.options.ts"],"names":[],"mappings":";;;AAGa,QAAA,uBAAuB,GAAG,MAAM,CAAC,yBAAyB,CAAC,CAAC;AAC5D,QAAA,8BAA8B,GAAG,MAAM,CAClD,gCAAgC,CACjC,CAAC;AACW,QAAA,oBAAoB,GAAG,iBAAiB,CAAC;AAiBtD,wGAAwG;AACjG,MAAM,kBAAkB,GAAG,CAChC,MAAyB,OAAO,CAAC,GAAG,EAC5B,EAAE;IACV,MAAM,WAAW,GAAG,GAAG,CAAC,gBAAgB,CAAC;IACzC,IAAI,CAAC,WAAW;QAAE,OAAO,4BAAoB,CAAC;IAC9C,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;AACrE,CAAC,CAAC;AANW,QAAA,kBAAkB,sBAM7B"}

package/dist/shared-key-http.service.d.ts

@@ -0,0 +1,41 @@
+import { HttpService } from '@nestjs/axios';
+import { SharedKeyService } from '@origins-digital/nestjs-shared-key';
+import { AxiosInstance, AxiosRequestConfig, AxiosResponse } from 'axios';
+import { InternalAuthHeaders } from './internal-auth.rule';
+import { SharedKeyHttpModuleOptions } from './shared-key-http.options';
+export declare const DEFAULT_REQUESTED_SERVICE = "shared-key-http-service";
+/** Axios config plus the service label used in the errors of `*AsPromise`. */
+export type SharedKeyHttpRequestConfig<D = unknown> = AxiosRequestConfig<D> & {
+    requestedService?: string;
+};
+/**
+ * `HttpService` for calls to internal Origins services: `applyInternalAuth`
+ * adds `x-internal-auth-token` and `x-service-name` unless the caller set an
+ * `authorization` or `x-internal-auth-token` header key.
+ *
+ * It runs on the module's own axios instance, never the global axios, so a
+ * plain `HttpModule` (calls to external hosts) is left untouched.
+ */
+export declare class SharedKeyHttpService extends HttpService {
+    private readonly sharedKeyService;
+    private readonly serviceName;
+    constructor(axiosInstance: AxiosInstance, sharedKeyService: SharedKeyService, options: SharedKeyHttpModuleOptions);
+    /**
+     * Internal auth headers, also usable as the headers provider of other clients
+     * (`() => sharedKeyHttp.internalHeaders()`). Rejects when no token resolves.
+     */
+    internalHeaders(): Promise<InternalAuthHeaders>;
+    getAsPromise<T = unknown, D = unknown>(url: string, config?: SharedKeyHttpRequestConfig<D>): Promise<AxiosResponse<T, D>>;
+    deleteAsPromise<T = unknown, D = unknown>(url: string, config?: SharedKeyHttpRequestConfig<D>): Promise<AxiosResponse<T, D>>;
+    headAsPromise<T = unknown, D = unknown>(url: string, config?: SharedKeyHttpRequestConfig<D>): Promise<AxiosResponse<T, D>>;
+    postAsPromise<T = unknown, D = unknown>(url: string, data?: D, config?: SharedKeyHttpRequestConfig<D>): Promise<AxiosResponse<T, D>>;
+    putAsPromise<T = unknown, D = unknown>(url: string, data?: D, config?: SharedKeyHttpRequestConfig<D>): Promise<AxiosResponse<T, D>>;
+    patchAsPromise<T = unknown, D = unknown>(url: string, data?: D, config?: SharedKeyHttpRequestConfig<D>): Promise<AxiosResponse<T, D>>;
+    private resolveConfig;
+    /**
+     * HTTP errors become the Nest exception `raiseError` builds, labelled with
+     * `requestedService`; other errors (e.g. from the auth rule) pass through.
+     */
+    private toPromise;
+}
+//# sourceMappingURL=shared-key-http.service.d.ts.map

package/dist/shared-key-http.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-key-http.service.d.ts","sourceRoot":"","sources":["../src/shared-key-http.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAQ5C,OAAO,EAEL,gBAAgB,EACjB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,aAAa,EAEd,MAAM,OAAO,CAAC;AAEf,OAAO,EAGL,mBAAmB,EAEpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAIL,0BAA0B,EAC3B,MAAM,2BAA2B,CAAC;AAEnC,eAAO,MAAM,yBAAyB,4BAA4B,CAAC;AAEnE,8EAA8E;AAC9E,MAAM,MAAM,0BAA0B,CAAC,CAAC,GAAG,OAAO,IAAI,kBAAkB,CAAC,CAAC,CAAC,GAAG;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF;;;;;;;GAOG;AACH,qBACa,oBAAqB,SAAQ,WAAW;IAKjD,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAJnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;gBAGK,aAAa,EAAE,aAAa,EACnD,gBAAgB,EAAE,gBAAgB,EAClB,OAAO,EAAE,0BAA0B;IAStE;;;OAGG;IACG,eAAe,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAerD,YAAY,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,EACnC,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,0BAA0B,CAAC,CAAC,CAAC,GACrC,OAAO,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAK/B,eAAe,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,EACtC,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,0BAA0B,CAAC,CAAC,CAAC,GACrC,OAAO,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAK/B,aAAa,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,EACpC,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,0BAA0B,CAAC,CAAC,CAAC,GACrC,OAAO,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAK/B,aAAa,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,EACpC,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,CAAC,EACR,MAAM,CAAC,EAAE,0BAA0B,CAAC,CAAC,CAAC,GACrC,OAAO,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAQ/B,YAAY,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,EACnC,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,CAAC,EACR,MAAM,CAAC,EAAE,0BAA0B,CAAC,CAAC,CAAC,GACrC,OAAO,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAQ/B,cAAc,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,EACrC,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,CAAC,EACR,MAAM,CAAC,EAAE,0BAA0B,CAAC,CAAC,CAAC,GACrC,OAAO,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAQ/B,OAAO,CAAC,aAAa;IAerB;;;OAGG;IACH,OAAO,CAAC,SAAS;CAalB"}

package/dist/shared-key-http.service.js

@@ -0,0 +1,120 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __rest = (this && this.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SharedKeyHttpService = exports.DEFAULT_REQUESTED_SERVICE = void 0;
+const axios_1 = require("@nestjs/axios");
+const common_1 = require("@nestjs/common");
+const cacheable_1 = require("@origins-digital/cacheable");
+const error_utils_1 = require("@origins-digital/error-utils");
+const nestjs_shared_key_1 = require("@origins-digital/nestjs-shared-key");
+const axios_2 = require("axios");
+const rxjs_1 = require("rxjs");
+const internal_auth_rule_1 = require("./internal-auth.rule");
+const shared_key_http_options_1 = require("./shared-key-http.options");
+exports.DEFAULT_REQUESTED_SERVICE = 'shared-key-http-service';
+/**
+ * `HttpService` for calls to internal Origins services: `applyInternalAuth`
+ * adds `x-internal-auth-token` and `x-service-name` unless the caller set an
+ * `authorization` or `x-internal-auth-token` header key.
+ *
+ * It runs on the module's own axios instance, never the global axios, so a
+ * plain `HttpModule` (calls to external hosts) is left untouched.
+ */
+let SharedKeyHttpService = class SharedKeyHttpService extends axios_1.HttpService {
+    constructor(axiosInstance, sharedKeyService, options) {
+        var _a;
+        super(axiosInstance);
+        this.sharedKeyService = sharedKeyService;
+        this.serviceName = (_a = options.serviceName) !== null && _a !== void 0 ? _a : (0, shared_key_http_options_1.defaultServiceName)();
+        axiosInstance.interceptors.request.use((config) => (0, internal_auth_rule_1.applyInternalAuth)(config, () => this.internalHeaders()));
+    }
+    /**
+     * Internal auth headers, also usable as the headers provider of other clients
+     * (`() => sharedKeyHttp.internalHeaders()`). Rejects when no token resolves.
+     */
+    async internalHeaders() {
+        const jwtAccessToken = cacheable_1.GenericOutput.data(await this.sharedKeyService.getInternalAuthJWT());
+        if (!(jwtAccessToken === null || jwtAccessToken === void 0 ? void 0 : jwtAccessToken.key)) {
+            throw new common_1.InternalServerErrorException('Could not resolve the internal shared key token');
+        }
+        return {
+            [internal_auth_rule_1.INTERNAL_AUTH_TOKEN_HEADER]: jwtAccessToken.key,
+            [internal_auth_rule_1.SERVICE_NAME_HEADER]: this.serviceName,
+        };
+    }
+    getAsPromise(url, config) {
+        const { requestedService, axiosConfig } = this.resolveConfig(config);
+        return this.toPromise(this.get(url, axiosConfig), requestedService);
+    }
+    deleteAsPromise(url, config) {
+        const { requestedService, axiosConfig } = this.resolveConfig(config);
+        return this.toPromise(this.delete(url, axiosConfig), requestedService);
+    }
+    headAsPromise(url, config) {
+        const { requestedService, axiosConfig } = this.resolveConfig(config);
+        return this.toPromise(this.head(url, axiosConfig), requestedService);
+    }
+    postAsPromise(url, data, config) {
+        const { requestedService, axiosConfig } = this.resolveConfig(config);
+        return this.toPromise(this.post(url, data, axiosConfig), requestedService);
+    }
+    putAsPromise(url, data, config) {
+        const { requestedService, axiosConfig } = this.resolveConfig(config);
+        return this.toPromise(this.put(url, data, axiosConfig), requestedService);
+    }
+    patchAsPromise(url, data, config) {
+        const { requestedService, axiosConfig } = this.resolveConfig(config);
+        return this.toPromise(this.patch(url, data, axiosConfig), requestedService);
+    }
+    resolveConfig(config) {
+        if (!config) {
+            return {
+                requestedService: exports.DEFAULT_REQUESTED_SERVICE,
+                axiosConfig: undefined,
+            };
+        }
+        const { requestedService = exports.DEFAULT_REQUESTED_SERVICE } = config, axiosConfig = __rest(config, ["requestedService"]);
+        return { requestedService, axiosConfig };
+    }
+    /**
+     * HTTP errors become the Nest exception `raiseError` builds, labelled with
+     * `requestedService`; other errors (e.g. from the auth rule) pass through.
+     */
+    toPromise(request$, requestedService) {
+        return (0, rxjs_1.firstValueFrom)(request$.pipe((0, rxjs_1.catchError)((error) => {
+            if ((0, axios_2.isAxiosError)(error))
+                (0, error_utils_1.raiseError)(error, { requestedService });
+            throw error;
+        })));
+    }
+};
+exports.SharedKeyHttpService = SharedKeyHttpService;
+exports.SharedKeyHttpService = SharedKeyHttpService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(shared_key_http_options_1.SHARED_KEY_HTTP_AXIOS_INSTANCE)),
+    __param(2, (0, common_1.Inject)(shared_key_http_options_1.SHARED_KEY_HTTP_OPTIONS)),
+    __metadata("design:paramtypes", [Function, nestjs_shared_key_1.SharedKeyService, Object])
+], SharedKeyHttpService);
+//# sourceMappingURL=shared-key-http.service.js.map

package/dist/shared-key-http.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-key-http.service.js","sourceRoot":"","sources":["../src/shared-key-http.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,yCAA4C;AAC5C,2CAIwB;AACxB,0DAA2D;AAC3D,8DAA0D;AAC1D,0EAG4C;AAC5C,iCAKe;AACf,+BAA8D;AAC9D,6DAK8B;AAC9B,uEAKmC;AAEtB,QAAA,yBAAyB,GAAG,yBAAyB,CAAC;AAOnE;;;;;;;GAOG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAqB,SAAQ,mBAAW;IAGnD,YAC0C,aAA4B,EACnD,gBAAkC,EAClB,OAAmC;;QAEpE,KAAK,CAAC,aAAa,CAAC,CAAC;QAHJ,qBAAgB,GAAhB,gBAAgB,CAAkB;QAInD,IAAI,CAAC,WAAW,GAAG,MAAA,OAAO,CAAC,WAAW,mCAAI,IAAA,4CAAkB,GAAE,CAAC;QAC/D,aAAa,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAChD,IAAA,sCAAiB,EAAC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CACxD,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe;QACnB,MAAM,cAAc,GAAG,yBAAa,CAAC,IAAI,CACvC,MAAM,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,CACjD,CAAC;QACF,IAAI,CAAC,CAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,GAAG,CAAA,EAAE,CAAC;YACzB,MAAM,IAAI,qCAA4B,CACpC,iDAAiD,CAClD,CAAC;QACJ,CAAC;QACD,OAAO;YACL,CAAC,+CAA0B,CAAC,EAAE,cAAc,CAAC,GAAG;YAChD,CAAC,wCAAmB,CAAC,EAAE,IAAI,CAAC,WAAW;SACxC,CAAC;IACJ,CAAC;IAED,YAAY,CACV,GAAW,EACX,MAAsC;QAEtC,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAI,GAAG,EAAE,WAAW,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACzE,CAAC;IAED,eAAe,CACb,GAAW,EACX,MAAsC;QAEtC,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAI,GAAG,EAAE,WAAW,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAC5E,CAAC;IAED,aAAa,CACX,GAAW,EACX,MAAsC;QAEtC,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAI,GAAG,EAAE,WAAW,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAC1E,CAAC;IAED,aAAa,CACX,GAAW,EACX,IAAQ,EACR,MAAsC;QAEtC,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC,SAAS,CACnB,IAAI,CAAC,IAAI,CAAI,GAAG,EAAE,IAAI,EAAE,WAAW,CAAC,EACpC,gBAAgB,CACjB,CAAC;IACJ,CAAC;IAED,YAAY,CACV,GAAW,EACX,IAAQ,EACR,MAAsC;QAEtC,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC,SAAS,CACnB,IAAI,CAAC,GAAG,CAAI,GAAG,EAAE,IAAI,EAAE,WAAW,CAAC,EACnC,gBAAgB,CACjB,CAAC;IACJ,CAAC;IAED,cAAc,CACZ,GAAW,EACX,IAAQ,EACR,MAAsC;QAEtC,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC,SAAS,CACnB,IAAI,CAAC,KAAK,CAAI,GAAG,EAAE,IAAI,EAAE,WAAW,CAAC,EACrC,gBAAgB,CACjB,CAAC;IACJ,CAAC;IAEO,aAAa,CAAI,MAAsC;QAI7D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,gBAAgB,EAAE,iCAAyB;gBAC3C,WAAW,EAAE,SAAS;aACvB,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,gBAAgB,GAAG,iCAAyB,KAClD,MAAM,EADiD,WAAW,UAClE,MAAM,EADF,oBAAgE,CAC9D,CAAC;QACT,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,CAAC;IAC3C,CAAC;IAED;;;OAGG;IACK,SAAS,CACf,QAAsC,EACtC,gBAAwB;QAExB,OAAO,IAAA,qBAAc,EACnB,QAAQ,CAAC,IAAI,CACX,IAAA,iBAAU,EAAC,CAAC,KAAc,EAAE,EAAE;YAC5B,IAAI,IAAA,oBAAY,EAAC,KAAK,CAAC;gBAAE,IAAA,wBAAU,EAAC,KAAK,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC;YACjE,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CACH,CACF,CAAC;IACJ,CAAC;CACF,CAAA;AA9HY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,wDAA8B,CAAC,CAAA;IAEtC,WAAA,IAAA,eAAM,EAAC,iDAAuB,CAAC,CAAA;+CADG,oCAAgB;GAL1C,oBAAoB,CA8HhC"}

package/package.json

@@ -1,6 +1,102 @@
 {
   "name": "@origins-digital/nestjs-shared-key-http",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.1",
+  "description": "NestJS HttpService that adds the internal shared-key auth headers to calls between Origins services",
+  "main": "./dist/index.js",
+  "module": "./dist/index.d.ts",
+  "types": "./dist/index.d.ts",
+  "author": "Origins Digital (https://www.origins-digital.com/)",
+  "license": "MIT",
+  "exports": {
+    ".": "./dist/index.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "format": "prettier --write \"src/**/*.ts\" \"test/**/*.ts\"",
+    "lint": "eslint \"src/**/*.ts\"",
+    "lint:fix": "eslint \"src/**/*.ts\" --fix",
+    "test": "jest --passWithNoTests",
+    "test:watch": "jest --watch",
+    "test:cov": "jest --coverage",
+    "test:debug": "node --inspect-brk -r tsconfig-paths/register -r ts-node/register node_modules/.bin/jest --runInBand",
+    "build": "rimraf dist && tsc -p tsconfig.build.json",
+    "release:patch": "release-it patch --ci",
+    "release:minor": "release-it minor --ci",
+    "release:major": "release-it major --ci",
+    "commit": "git-cz",
+    "prepublish": "yarn build"
+  },
+  "dependencies": {
+    "@origins-digital/cacheable": "3.4.0",
+    "@origins-digital/error-utils": "2.1.4"
+  },
+  "peerDependencies": {
+    "@nestjs/axios": ">=4.0.1",
+    "@nestjs/common": ">=11.0.0",
+    "@origins-digital/nestjs-shared-key": ">=3.2.1",
+    "axios": ">=1.4.0",
+    "rxjs": ">=7.1.0"
+  },
+  "devDependencies": {
+    "@commitlint/cli": "^17.6.6",
+    "@commitlint/config-conventional": "^17.6.6",
+    "@nestjs/testing": "^11.1.11",
+    "@types/node": "^20.3.1",
+    "commitizen": "^4.3.0",
+    "conventional-recommended-bump": "^11.2.0",
+    "cz-conventional-changelog": "^3.3.0",
+    "eslint": "^9.0.0",
+    "eslint-config-prettier": "^9.0.0",
+    "eslint-plugin-prettier": "^5.0.0",
+    "jest": "^29.5.0",
+    "prettier": "^3.0.0",
+    "rimraf": "^5.0.5",
+    "ts-jest": "^29.1.0",
+    "ts-node": "^10.9.1",
+    "tsconfig-paths": "^4.2.0",
+    "typescript": "^5.3.2"
+  },
+  "jest": {
+    "moduleFileExtensions": [
+      "js",
+      "json",
+      "ts"
+    ],
+    "rootDir": "src",
+    "testRegex": ".*\\.spec\\.ts$",
+    "transform": {
+      "^.+\\.ts$": "ts-jest"
+    },
+    "collectCoverageFrom": [
+      "**/*.(t|j)s"
+    ],
+    "coverageDirectory": "../coverage",
+    "testEnvironment": "node"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org",
+    "access": "public"
+  },
+  "release-it": {
+    "git": {
+      "requireCleanWorkingDir": false,
+      "commitMessage": "chore(release): bump nestjs-shared-key-http ${version}",
+      "tagName": "${npm.name}-v${version}",
+      "tagAnnotation": "nestjs-shared-key-http-${version}",
+      "push": false,
+      "commit": true,
+      "addUntrackedFiles": false
+    },
+    "npm": {
+      "publish": true
+    },
+    "hooks": {
+      "before:init": [
+        "yarn test",
+        "yarn build"
+      ]
+    }
+  }
+}