@spfn/core 0.2.0-beta.4 → 0.2.0-beta.40

package/dist/event/sse/index.js

@@ -1,19 +1,29 @@
 import { streamSSE } from 'hono/streaming';
 import { logger } from '@spfn/core/logger';
+import { randomBytes } from 'crypto';
 
 // src/event/sse/handler.ts
 var sseLogger = logger.child("@spfn/core:sse");
-function createSSEHandler(router, config = {}) {
+function createSSEHandler(router, config = {}, tokenManager) {
   const {
-    pingInterval = 3e4
-    // headers: customHeaders = {},  // Reserved for future use
+    pingInterval = 3e4,
+    auth: authConfig
   } = config;
   return async (c) => {
-    const eventsParam = c.req.query("events");
-    if (!eventsParam) {
+    const subject = await authenticateToken(c, tokenManager);
+    if (subject === false) {
+      return c.json({ error: "Missing token parameter" }, 401);
+    }
+    if (subject === null) {
+      return c.json({ error: "Invalid or expired token" }, 401);
+    }
+    if (subject) {
+      c.set("sseSubject", subject);
+    }
+    const requestedEvents = parseRequestedEvents(c);
+    if (!requestedEvents) {
       return c.json({ error: "Missing events parameter" }, 400);
     }
-    const requestedEvents = eventsParam.split(",").map((e) => e.trim());
     const validEventNames = router.eventNames;
     const invalidEvents = requestedEvents.filter((e) => !validEventNames.includes(e));
     if (invalidEvents.length > 0) {
@@ -23,19 +33,29 @@ function createSSEHandler(router, config = {}) {
         validEvents: validEventNames
       }, 400);
     }
+    const allowedEvents = await authorizeEvents(subject, requestedEvents, authConfig);
+    if (allowedEvents === null) {
+      return c.json({ error: "Not authorized for any requested events" }, 403);
+    }
     sseLogger.debug("SSE connection requested", {
-      events: requestedEvents,
+      events: allowedEvents,
+      subject: subject || void 0,
       clientIp: c.req.header("x-forwarded-for") || c.req.header("x-real-ip")
     });
     return streamSSE(c, async (stream) => {
       const unsubscribes = [];
       let messageId = 0;
-      for (const eventName of requestedEvents) {
+      for (const eventName of allowedEvents) {
         const eventDef = router.events[eventName];
         if (!eventDef) {
           continue;
         }
         const unsubscribe = eventDef.subscribe((payload) => {
+          if (subject && authConfig?.filter?.[eventName]) {
+            if (!authConfig.filter[eventName](subject, payload)) {
+              return;
+            }
+          }
           messageId++;
           const message = {
             event: eventName,
@@ -54,13 +74,13 @@ function createSSEHandler(router, config = {}) {
         unsubscribes.push(unsubscribe);
       }
       sseLogger.info("SSE connection established", {
-        events: requestedEvents,
+        events: allowedEvents,
         subscriptionCount: unsubscribes.length
       });
       await stream.writeSSE({
         event: "connected",
         data: JSON.stringify({
-          subscribedEvents: requestedEvents,
+          subscribedEvents: allowedEvents,
           timestamp: Date.now()
         })
       });
@@ -77,7 +97,7 @@ function createSSEHandler(router, config = {}) {
       clearInterval(pingTimer);
       unsubscribes.forEach((fn) => fn());
       sseLogger.info("SSE connection closed", {
-        events: requestedEvents
+        events: allowedEvents
       });
     }, async (err) => {
       sseLogger.error("SSE stream error", {
@@ -86,7 +106,133 @@ function createSSEHandler(router, config = {}) {
     });
   };
 }
+async function authenticateToken(c, tokenManager) {
+  if (!tokenManager) {
+    return void 0;
+  }
+  const token = c.req.query("token");
+  if (!token) {
+    return false;
+  }
+  return await tokenManager.verify(token);
+}
+function parseRequestedEvents(c) {
+  const eventsParam = c.req.query("events");
+  if (!eventsParam) {
+    return null;
+  }
+  return eventsParam.split(",").map((e) => e.trim());
+}
+async function authorizeEvents(subject, requestedEvents, authConfig) {
+  if (!subject || !authConfig?.authorize) {
+    return requestedEvents;
+  }
+  const allowed = await authConfig.authorize(subject, requestedEvents);
+  if (allowed.length === 0) {
+    return null;
+  }
+  return allowed;
+}
+var InMemoryTokenStore = class {
+  tokens = /* @__PURE__ */ new Map();
+  async set(token, data) {
+    this.tokens.set(token, data);
+  }
+  async consume(token) {
+    const data = this.tokens.get(token);
+    if (!data) {
+      return null;
+    }
+    this.tokens.delete(token);
+    return data;
+  }
+  async cleanup() {
+    const now = Date.now();
+    for (const [token, data] of this.tokens) {
+      if (data.expiresAt <= now) {
+        this.tokens.delete(token);
+      }
+    }
+  }
+};
+var CacheTokenStore = class {
+  constructor(cache) {
+    this.cache = cache;
+  }
+  prefix = "sse:token:";
+  async set(token, data) {
+    const ttlSeconds = Math.max(1, Math.ceil((data.expiresAt - Date.now()) / 1e3));
+    await this.cache.set(
+      this.prefix + token,
+      JSON.stringify(data),
+      "EX",
+      ttlSeconds
+    );
+  }
+  async consume(token) {
+    const key = this.prefix + token;
+    let raw = null;
+    if (this.cache.getdel) {
+      raw = await this.cache.getdel(key);
+    } else {
+      raw = await this.cache.get(key);
+      if (raw) {
+        await this.cache.del(key);
+      }
+    }
+    if (!raw) {
+      return null;
+    }
+    return JSON.parse(raw);
+  }
+  async cleanup() {
+  }
+};
+var SSETokenManager = class {
+  store;
+  ttl;
+  cleanupTimer = null;
+  constructor(config) {
+    this.ttl = config?.ttl ?? 3e4;
+    this.store = config?.store ?? new InMemoryTokenStore();
+    const cleanupInterval = config?.cleanupInterval ?? 6e4;
+    this.cleanupTimer = setInterval(() => void this.store.cleanup(), cleanupInterval);
+    this.cleanupTimer.unref();
+  }
+  /**
+   * Issue a new one-time-use token for the given subject
+   */
+  async issue(subject) {
+    const token = randomBytes(32).toString("hex");
+    await this.store.set(token, {
+      token,
+      subject,
+      expiresAt: Date.now() + this.ttl
+    });
+    return token;
+  }
+  /**
+   * Verify and consume a token
+   * @returns subject string if valid, null if invalid/expired/already consumed
+   */
+  async verify(token) {
+    const data = await this.store.consume(token);
+    if (!data || data.expiresAt <= Date.now()) {
+      return null;
+    }
+    return data.subject;
+  }
+  /**
+   * Cleanup timer and resources
+   */
+  destroy() {
+    if (this.cleanupTimer) {
+      clearInterval(this.cleanupTimer);
+      this.cleanupTimer = null;
+    }
+  }
+};
 
-export { createSSEHandler };
+export { CacheTokenStore, SSETokenManager, createSSEHandler };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/event/sse/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/event/sse/handler.ts"],"names":[],"mappings":";;;;AAwBA,IAAM,SAAA,GAAY,MAAA,CAAO,KAAA,CAAM,gBAAgB,CAAA;AAexC,SAAS,gBAAA,CACZ,MAAA,EACA,MAAA,GAA2B,EAAC,EAEhC;AACI,EAAA,MAAM;AAAA,IACF,YAAA,GAAe;AAAA;AAAA,GAEnB,GAAI,MAAA;AAEJ,EAAA,OAAO,OAAO,CAAA,KACd;AAEI,IAAA,MAAM,WAAA,GAAc,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,QAAQ,CAAA;AAExC,IAAA,IAAI,CAAC,WAAA,EACL;AACI,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,0BAAA,IAA8B,GAAG,CAAA;AAAA,IAC5D;AAEA,IAAA,MAAM,eAAA,GAAkB,YAAY,KAAA,CAAM,GAAG,EAAE,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,CAAE,IAAA,EAAM,CAAA;AAGhE,IAAA,MAAM,kBAAkB,MAAA,CAAO,UAAA;AAC/B,IAAA,MAAM,aAAA,GAAgB,gBAAgB,MAAA,CAAO,CAAA,CAAA,KAAK,CAAC,eAAA,CAAgB,QAAA,CAAS,CAAC,CAAC,CAAA;AAE9E,IAAA,IAAI,aAAA,CAAc,SAAS,CAAA,EAC3B;AACI,MAAA,OAAO,EAAE,IAAA,CAAK;AAAA,QACV,KAAA,EAAO,qBAAA;AAAA,QACP,aAAA;AAAA,QACA,WAAA,EAAa;AAAA,SACd,GAAG,CAAA;AAAA,IACV;AAEA,IAAA,SAAA,CAAU,MAAM,0BAAA,EAA4B;AAAA,MACxC,MAAA,EAAQ,eAAA;AAAA,MACR,QAAA,EAAU,EAAE,GAAA,CAAI,MAAA,CAAO,iBAAiB,CAAA,IAAK,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,WAAW;AAAA,KACxE,CAAA;AAGD,IAAA,OAAO,SAAA,CAAU,CAAA,EAAG,OAAO,MAAA,KAC3B;AACI,MAAA,MAAM,eAA+B,EAAC;AACtC,MAAA,IAAI,SAAA,GAAY,CAAA;AAGhB,MAAA,KAAA,MAAW,aAAa,eAAA,EACxB;AACI,QAAA,MAAM,QAAA,GAAW,MAAA,CAAO,MAAA,CAAO,SAAS,CAAA;AAExC,QAAA,IAAI,CAAC,QAAA,EACL;AACI,UAAA;AAAA,QACJ;AAEA,QAAA,MAAM,WAAA,GAAc,QAAA,CAAS,SAAA,CAAU,CAAC,OAAA,KACxC;AACI,UAAA,SAAA,EAAA;AAEA,UAAA,MAAM,OAAA,GAAU;AAAA,YACZ,KAAA,EAAO,SAAA;AAAA,YACP,IAAA,EAAM;AAAA,WACV;AAEA,UAAA,SAAA,CAAU,MAAM,mBAAA,EAAqB;AAAA,YACjC,KAAA,EAAO,SAAA;AAAA,YACP;AAAA,WACH,CAAA;AAGD,UAAA,KAAK,OAAO,QAAA,CAAS;AAAA,YACjB,EAAA,EAAI,OAAO,SAAS,CAAA;AAAA,YACpB,KAAA,EAAO,SAAA;AAAA,YACP,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,OAAO;AAAA,WAC/B,CAAA;AAAA,QACL,CAAC,CAAA;AAED,QAAA,YAAA,CAAa,KAAK,WAAW,CAAA;AAAA,MACjC;AAEA,MAAA,SAAA,CAAU,KAAK,4BAAA,EAA8B;AAAA,QACzC,MAAA,EAAQ,eAAA;AAAA,QACR,mBAAmB,YAAA,CAAa;AAAA,OACnC,CAAA;AAGD,MAAA,MAAM,OAAO,QAAA,CAAS;AAAA,QAClB,KAAA,EAAO,WAAA;AAAA,QACP,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,UACjB,gBAAA,EAAkB,eAAA;AAAA,UAClB,SAAA,EAAW,KAAK,GAAA;AAAI,SACvB;AAAA,OACJ,CAAA;AAGD,MAAA,MAAM,SAAA,GAAY,YAAY,MAC9B;AAEI,QAAA,KAAK,OAAO,QAAA,CAAS;AAAA,UACjB,KAAA,EAAO,MAAA;AAAA,UACP,IAAA,EAAM,KAAK,SAAA,CAAU,EAAE,WAAW,IAAA,CAAK,GAAA,IAAO;AAAA,SACjD,CAAA;AAAA,MACL,GAAG,YAAY,CAAA;AAGf,MAAA,MAAM,WAAA,GAAc,CAAA,CAAE,GAAA,CAAI,GAAA,CAAI,MAAA;AAE9B,MAAA,OAAO,CAAC,YAAY,OAAA,EACpB;AACI,QAAA,MAAM,MAAA,CAAO,MAAM,YAAY,CAAA;AAAA,MACnC;AAGA,MAAA,aAAA,CAAc,SAAS,CAAA;AACvB,MAAA,YAAA,CAAa,OAAA,CAAQ,CAAA,EAAA,KAAM,EAAA,EAAI,CAAA;AAE/B,MAAA,SAAA,CAAU,KAAK,uBAAA,EAAyB;AAAA,QACpC,MAAA,EAAQ;AAAA,OACX,CAAA;AAAA,IACL,CAAA,EAAG,OAAO,GAAA,KACV;AACI,MAAA,SAAA,CAAU,MAAM,kBAAA,EAAoB;AAAA,QAChC,OAAO,GAAA,CAAI;AAAA,OACd,CAAA;AAAA,IACL,CAAC,CAAA;AAAA,EACL,CAAA;AACJ","file":"index.js","sourcesContent":["/**\n * SSE Handler for Hono\n *\n * Creates SSE stream endpoint for event subscription\n *\n * @example\n * ```typescript\n * import { Hono } from 'hono';\n * import { createSSEHandler } from '@spfn/core/event/sse';\n * import { eventRouter } from './events';\n *\n * const app = new Hono();\n *\n * // GET /events/stream?events=userCreated,orderPlaced\n * app.get('/events/stream', createSSEHandler(eventRouter));\n * ```\n */\n\nimport type { Context } from 'hono';\nimport { streamSSE } from 'hono/streaming';\nimport { logger } from '@spfn/core/logger';\nimport type { EventRouterDef, InferEventNames } from '../router';\nimport type { SSEHandlerConfig } from './types';\n\nconst sseLogger = logger.child('@spfn/core:sse');\n\n/**\n * Create SSE handler for Hono\n *\n * Query parameters:\n * - events: Comma-separated list of event names to subscribe\n *\n * @example\n * ```typescript\n * app.get('/events/stream', createSSEHandler(eventRouter, {\n *     pingInterval: 30000,\n * }));\n * ```\n */\nexport function createSSEHandler<TRouter extends EventRouterDef<any>>(\n    router: TRouter,\n    config: SSEHandlerConfig = {}\n)\n{\n    const {\n        pingInterval = 30000,\n        // headers: customHeaders = {},  // Reserved for future use\n    } = config;\n\n    return async (c: Context) =>\n    {\n        // Parse events from query parameter\n        const eventsParam = c.req.query('events');\n\n        if (!eventsParam)\n        {\n            return c.json({ error: 'Missing events parameter' }, 400);\n        }\n\n        const requestedEvents = eventsParam.split(',').map(e => e.trim());\n\n        // Validate event names\n        const validEventNames = router.eventNames as string[];\n        const invalidEvents = requestedEvents.filter(e => !validEventNames.includes(e));\n\n        if (invalidEvents.length > 0)\n        {\n            return c.json({\n                error: 'Invalid event names',\n                invalidEvents,\n                validEvents: validEventNames,\n            }, 400);\n        }\n\n        sseLogger.debug('SSE connection requested', {\n            events: requestedEvents,\n            clientIp: c.req.header('x-forwarded-for') || c.req.header('x-real-ip'),\n        });\n\n        // Start SSE stream\n        return streamSSE(c, async (stream) =>\n        {\n            const unsubscribes: (() => void)[] = [];\n            let messageId = 0;\n\n            // Subscribe to each requested event\n            for (const eventName of requestedEvents as InferEventNames<TRouter>[])\n            {\n                const eventDef = router.events[eventName];\n\n                if (!eventDef)\n                {\n                    continue;\n                }\n\n                const unsubscribe = eventDef.subscribe((payload: unknown) =>\n                {\n                    messageId++;\n\n                    const message = {\n                        event: eventName,\n                        data: payload,\n                    };\n\n                    sseLogger.debug('SSE sending event', {\n                        event: eventName,\n                        messageId,\n                    });\n\n                    // Fire-and-forget in sync callback\n                    void stream.writeSSE({\n                        id: String(messageId),\n                        event: eventName as string,\n                        data: JSON.stringify(message),\n                    });\n                });\n\n                unsubscribes.push(unsubscribe);\n            }\n\n            sseLogger.info('SSE connection established', {\n                events: requestedEvents,\n                subscriptionCount: unsubscribes.length,\n            });\n\n            // Send initial connection message\n            await stream.writeSSE({\n                event: 'connected',\n                data: JSON.stringify({\n                    subscribedEvents: requestedEvents,\n                    timestamp: Date.now(),\n                }),\n            });\n\n            // Keep-alive ping\n            const pingTimer = setInterval(() =>\n            {\n                // Fire-and-forget in sync callback\n                void stream.writeSSE({\n                    event: 'ping',\n                    data: JSON.stringify({ timestamp: Date.now() }),\n                });\n            }, pingInterval);\n\n            // Wait for client disconnect using abort signal\n            const abortSignal = c.req.raw.signal;\n\n            while (!abortSignal.aborted)\n            {\n                await stream.sleep(pingInterval);\n            }\n\n            // Cleanup\n            clearInterval(pingTimer);\n            unsubscribes.forEach(fn => fn());\n\n            sseLogger.info('SSE connection closed', {\n                events: requestedEvents,\n            });\n        }, async (err: Error) =>\n        {\n            sseLogger.error('SSE stream error', {\n                error: err.message,\n            });\n        });\n    };\n}\n\n"]}
+{"version":3,"sources":["../../../src/event/sse/handler.ts","../../../src/event/sse/token-manager.ts"],"names":[],"mappings":";;;;;AAyBA,IAAM,SAAA,GAAY,MAAA,CAAO,KAAA,CAAM,gBAAgB,CAAA;AAyBxC,SAAS,gBAAA,CACZ,MAAA,EACA,MAAA,GAA2B,IAC3B,YAAA,EAEJ;AACI,EAAA,MAAM;AAAA,IACF,YAAA,GAAe,GAAA;AAAA,IACf,IAAA,EAAM;AAAA,GACV,GAAI,MAAA;AAEJ,EAAA,OAAO,OAAO,CAAA,KACd;AAEI,IAAA,MAAM,OAAA,GAAU,MAAM,iBAAA,CAAkB,CAAA,EAAG,YAAY,CAAA;AACvD,IAAA,IAAI,YAAY,KAAA,EAChB;AACI,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,yBAAA,IAA6B,GAAG,CAAA;AAAA,IAC3D;AACA,IAAA,IAAI,YAAY,IAAA,EAChB;AACI,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,0BAAA,IAA8B,GAAG,CAAA;AAAA,IAC5D;AACA,IAAA,IAAI,OAAA,EACJ;AACI,MAAA,CAAA,CAAE,GAAA,CAAI,cAAc,OAAO,CAAA;AAAA,IAC/B;AAGA,IAAA,MAAM,eAAA,GAAkB,qBAAqB,CAAC,CAAA;AAC9C,IAAA,IAAI,CAAC,eAAA,EACL;AACI,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,0BAAA,IAA8B,GAAG,CAAA;AAAA,IAC5D;AAGA,IAAA,MAAM,kBAAkB,MAAA,CAAO,UAAA;AAC/B,IAAA,MAAM,aAAA,GAAgB,gBAAgB,MAAA,CAAO,CAAA,CAAA,KAAK,CAAC,eAAA,CAAgB,QAAA,CAAS,CAAC,CAAC,CAAA;AAE9E,IAAA,IAAI,aAAA,CAAc,SAAS,CAAA,EAC3B;AACI,MAAA,OAAO,EAAE,IAAA,CAAK;AAAA,QACV,KAAA,EAAO,qBAAA;AAAA,QACP,aAAA;AAAA,QACA,WAAA,EAAa;AAAA,SACd,GAAG,CAAA;AAAA,IACV;AAGA,IAAA,MAAM,aAAA,GAAgB,MAAM,eAAA,CAAgB,OAAA,EAAS,iBAAiB,UAAU,CAAA;AAChF,IAAA,IAAI,kBAAkB,IAAA,EACtB;AACI,MAAA,OAAO,EAAE,IAAA,CAAK,EAAE,KAAA,EAAO,yCAAA,IAA6C,GAAG,CAAA;AAAA,IAC3E;AAEA,IAAA,SAAA,CAAU,MAAM,0BAAA,EAA4B;AAAA,MACxC,MAAA,EAAQ,aAAA;AAAA,MACR,SAAS,OAAA,IAAW,MAAA;AAAA,MACpB,QAAA,EAAU,EAAE,GAAA,CAAI,MAAA,CAAO,iBAAiB,CAAA,IAAK,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,WAAW;AAAA,KACxE,CAAA;AAGD,IAAA,OAAO,SAAA,CAAU,CAAA,EAAG,OAAO,MAAA,KAC3B;AACI,MAAA,MAAM,eAA+B,EAAC;AACtC,MAAA,IAAI,SAAA,GAAY,CAAA;AAEhB,MAAA,KAAA,MAAW,aAAa,aAAA,EACxB;AACI,QAAA,MAAM,QAAA,GAAW,MAAA,CAAO,MAAA,CAAO,SAAS,CAAA;AAExC,QAAA,IAAI,CAAC,QAAA,EACL;AACI,UAAA;AAAA,QACJ;AAEA,QAAA,MAAM,WAAA,GAAc,QAAA,CAAS,SAAA,CAAU,CAAC,OAAA,KACxC;AAEI,UAAA,IAAI,OAAA,IAAW,UAAA,EAAY,MAAA,GAAS,SAAmB,CAAA,EACvD;AACI,YAAA,IAAI,CAAC,UAAA,CAAW,MAAA,CAAO,SAAmB,CAAA,CAAE,OAAA,EAAS,OAAO,CAAA,EAC5D;AACI,cAAA;AAAA,YACJ;AAAA,UACJ;AAEA,UAAA,SAAA,EAAA;AAEA,UAAA,MAAM,OAAA,GAAU;AAAA,YACZ,KAAA,EAAO,SAAA;AAAA,YACP,IAAA,EAAM;AAAA,WACV;AAEA,UAAA,SAAA,CAAU,MAAM,mBAAA,EAAqB;AAAA,YACjC,KAAA,EAAO,SAAA;AAAA,YACP;AAAA,WACH,CAAA;AAGD,UAAA,KAAK,OAAO,QAAA,CAAS;AAAA,YACjB,EAAA,EAAI,OAAO,SAAS,CAAA;AAAA,YACpB,KAAA,EAAO,SAAA;AAAA,YACP,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,OAAO;AAAA,WAC/B,CAAA;AAAA,QACL,CAAC,CAAA;AAED,QAAA,YAAA,CAAa,KAAK,WAAW,CAAA;AAAA,MACjC;AAEA,MAAA,SAAA,CAAU,KAAK,4BAAA,EAA8B;AAAA,QACzC,MAAA,EAAQ,aAAA;AAAA,QACR,mBAAmB,YAAA,CAAa;AAAA,OACnC,CAAA;AAGD,MAAA,MAAM,OAAO,QAAA,CAAS;AAAA,QAClB,KAAA,EAAO,WAAA;AAAA,QACP,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,UACjB,gBAAA,EAAkB,aAAA;AAAA,UAClB,SAAA,EAAW,KAAK,GAAA;AAAI,SACvB;AAAA,OACJ,CAAA;AAGD,MAAA,MAAM,SAAA,GAAY,YAAY,MAC9B;AAEI,QAAA,KAAK,OAAO,QAAA,CAAS;AAAA,UACjB,KAAA,EAAO,MAAA;AAAA,UACP,IAAA,EAAM,KAAK,SAAA,CAAU,EAAE,WAAW,IAAA,CAAK,GAAA,IAAO;AAAA,SACjD,CAAA;AAAA,MACL,GAAG,YAAY,CAAA;AAGf,MAAA,MAAM,WAAA,GAAc,CAAA,CAAE,GAAA,CAAI,GAAA,CAAI,MAAA;AAE9B,MAAA,OAAO,CAAC,YAAY,OAAA,EACpB;AACI,QAAA,MAAM,MAAA,CAAO,MAAM,YAAY,CAAA;AAAA,MACnC;AAGA,MAAA,aAAA,CAAc,SAAS,CAAA;AACvB,MAAA,YAAA,CAAa,OAAA,CAAQ,CAAA,EAAA,KAAM,EAAA,EAAI,CAAA;AAE/B,MAAA,SAAA,CAAU,KAAK,uBAAA,EAAyB;AAAA,QACpC,MAAA,EAAQ;AAAA,OACX,CAAA;AAAA,IACL,CAAA,EAAG,OAAO,GAAA,KACV;AACI,MAAA,SAAA,CAAU,MAAM,kBAAA,EAAoB;AAAA,QAChC,OAAO,GAAA,CAAI;AAAA,OACd,CAAA;AAAA,IACL,CAAC,CAAA;AAAA,EACL,CAAA;AACJ;AAWA,eAAe,iBAAA,CACX,GACA,YAAA,EAEJ;AACI,EAAA,IAAI,CAAC,YAAA,EACL;AACI,IAAA,OAAO,MAAA;AAAA,EACX;AAEA,EAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,OAAO,CAAA;AACjC,EAAA,IAAI,CAAC,KAAA,EACL;AACI,IAAA,OAAO,KAAA;AAAA,EACX;AAEA,EAAA,OAAO,MAAM,YAAA,CAAa,MAAA,CAAO,KAAK,CAAA;AAC1C;AAKA,SAAS,qBAAqB,CAAA,EAC9B;AACI,EAAA,MAAM,WAAA,GAAc,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,QAAQ,CAAA;AACxC,EAAA,IAAI,CAAC,WAAA,EACL;AACI,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,OAAO,WAAA,CAAY,MAAM,GAAG,CAAA,CAAE,IAAI,CAAA,CAAA,KAAK,CAAA,CAAE,MAAM,CAAA;AACnD;AAMA,eAAe,eAAA,CACX,OAAA,EACA,eAAA,EACA,UAAA,EAEJ;AACI,EAAA,IAAI,CAAC,OAAA,IAAW,CAAC,UAAA,EAAY,SAAA,EAC7B;AACI,IAAA,OAAO,eAAA;AAAA,EACX;AAEA,EAAA,MAAM,OAAA,GAAU,MAAM,UAAA,CAAW,SAAA,CAAU,SAAS,eAAe,CAAA;AAEnE,EAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EACvB;AACI,IAAA,OAAO,IAAA;AAAA,EACX;AAEA,EAAA,OAAO,OAAA;AACX;ACrLA,IAAM,qBAAN,MACA;AAAA,EACY,MAAA,uBAAa,GAAA,EAAsB;AAAA,EAE3C,MAAM,GAAA,CAAI,KAAA,EAAe,IAAA,EACzB;AACI,IAAA,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,KAAA,EAAO,IAAI,CAAA;AAAA,EAC/B;AAAA,EAEA,MAAM,QAAQ,KAAA,EACd;AACI,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,MAAA,CAAO,GAAA,CAAI,KAAK,CAAA;AAClC,IAAA,IAAI,CAAC,IAAA,EACL;AACI,MAAA,OAAO,IAAA;AAAA,IACX;AAEA,IAAA,IAAA,CAAK,MAAA,CAAO,OAAO,KAAK,CAAA;AACxB,IAAA,OAAO,IAAA;AAAA,EACX;AAAA,EAEA,MAAM,OAAA,GACN;AACI,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AAErB,IAAA,KAAA,MAAW,CAAC,KAAA,EAAO,IAAI,CAAA,IAAK,KAAK,MAAA,EACjC;AACI,MAAA,IAAI,IAAA,CAAK,aAAa,GAAA,EACtB;AACI,QAAA,IAAA,CAAK,MAAA,CAAO,OAAO,KAAK,CAAA;AAAA,MAC5B;AAAA,IACJ;AAAA,EACJ;AACJ,CAAA;AAuBO,IAAM,kBAAN,MACP;AAAA,EAGI,YAAoB,KAAA,EAAoB;AAApB,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AAAA,EAAqB;AAAA,EAFjC,MAAA,GAAS,YAAA;AAAA,EAIjB,MAAM,GAAA,CAAI,KAAA,EAAe,IAAA,EACzB;AACI,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,IAAA,CAAA,CAAM,IAAA,CAAK,SAAA,GAAY,IAAA,CAAK,GAAA,EAAI,IAAK,GAAI,CAAC,CAAA;AAC9E,IAAA,MAAM,KAAK,KAAA,CAAM,GAAA;AAAA,MACb,KAAK,MAAA,GAAS,KAAA;AAAA,MACd,IAAA,CAAK,UAAU,IAAI,CAAA;AAAA,MACnB,IAAA;AAAA,MACA;AAAA,KACJ;AAAA,EACJ;AAAA,EAEA,MAAM,QAAQ,KAAA,EACd;AACI,IAAA,MAAM,GAAA,GAAM,KAAK,MAAA,GAAS,KAAA;AAG1B,IAAA,IAAI,GAAA,GAAqB,IAAA;AAEzB,IAAA,IAAI,IAAA,CAAK,MAAM,MAAA,EACf;AACI,MAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,GAAG,CAAA;AAAA,IACrC,CAAA,MAEA;AACI,MAAA,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AAC9B,MAAA,IAAI,GAAA,EACJ;AACI,QAAA,MAAM,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AAAA,MAC5B;AAAA,IACJ;AAEA,IAAA,IAAI,CAAC,GAAA,EACL;AACI,MAAA,OAAO,IAAA;AAAA,IACX;AAEA,IAAA,OAAO,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,EACzB;AAAA,EAEA,MAAM,OAAA,GACN;AAAA,EAEA;AACJ;AAMO,IAAM,kBAAN,MACP;AAAA,EACY,KAAA;AAAA,EACA,GAAA;AAAA,EACA,YAAA,GAAsD,IAAA;AAAA,EAE9D,YAAY,MAAA,EACZ;AACI,IAAA,IAAA,CAAK,GAAA,GAAM,QAAQ,GAAA,IAAO,GAAA;AAC1B,IAAA,IAAA,CAAK,KAAA,GAAQ,MAAA,EAAQ,KAAA,IAAS,IAAI,kBAAA,EAAmB;AAErD,IAAA,MAAM,eAAA,GAAkB,QAAQ,eAAA,IAAmB,GAAA;AACnD,IAAA,IAAA,CAAK,YAAA,GAAe,YAAY,MAAM,KAAK,KAAK,KAAA,CAAM,OAAA,IAAW,eAAe,CAAA;AAChF,IAAA,IAAA,CAAK,aAAa,KAAA,EAAM;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,MAAM,OAAA,EACZ;AACI,IAAA,MAAM,KAAA,GAAQ,WAAA,CAAY,EAAE,CAAA,CAAE,SAAS,KAAK,CAAA;AAE5C,IAAA,MAAM,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,KAAA,EAAO;AAAA,MACxB,KAAA;AAAA,MACA,OAAA;AAAA,MACA,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK;AAAA,KAChC,CAAA;AAED,IAAA,OAAO,KAAA;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,OAAO,KAAA,EACb;AACI,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,KAAA,CAAM,QAAQ,KAAK,CAAA;AAE3C,IAAA,IAAI,CAAC,IAAA,IAAQ,IAAA,CAAK,SAAA,IAAa,IAAA,CAAK,KAAI,EACxC;AACI,MAAA,OAAO,IAAA;AAAA,IACX;AAEA,IAAA,OAAO,IAAA,CAAK,OAAA;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA,EAKA,OAAA,GACA;AACI,IAAA,IAAI,KAAK,YAAA,EACT;AACI,MAAA,aAAA,CAAc,KAAK,YAAY,CAAA;AAC/B,MAAA,IAAA,CAAK,YAAA,GAAe,IAAA;AAAA,IACxB;AAAA,EACJ;AACJ","file":"index.js","sourcesContent":["/**\n * SSE Handler for Hono\n *\n * Creates SSE stream endpoint for event subscription\n *\n * @example\n * ```typescript\n * import { Hono } from 'hono';\n * import { createSSEHandler } from '@spfn/core/event/sse';\n * import { eventRouter } from './events';\n *\n * const app = new Hono();\n *\n * // GET /events/stream?events=userCreated,orderPlaced\n * app.get('/events/stream', createSSEHandler(eventRouter));\n * ```\n */\n\nimport type { Context } from 'hono';\nimport { streamSSE } from 'hono/streaming';\nimport { logger } from '@spfn/core/logger';\nimport type { EventRouterDef, InferEventNames } from '../router';\nimport type { SSEHandlerConfig, SSEHandlerAuthConfig } from './types';\nimport type { SSETokenManager } from './token-manager';\n\nconst sseLogger = logger.child('@spfn/core:sse');\n\n// Extend Hono context with SSE subject\ndeclare module 'hono'\n{\n    interface ContextVariableMap\n    {\n        sseSubject?: string;\n    }\n}\n\n/**\n * Create SSE handler for Hono\n *\n * Query parameters:\n * - events: Comma-separated list of event names to subscribe\n * - token: One-time auth token (when auth is enabled)\n *\n * @example\n * ```typescript\n * app.get('/events/stream', createSSEHandler(eventRouter, {\n *     pingInterval: 30000,\n * }));\n * ```\n */\nexport function createSSEHandler<TRouter extends EventRouterDef<any>>(\n    router: TRouter,\n    config: SSEHandlerConfig = {},\n    tokenManager?: SSETokenManager\n)\n{\n    const {\n        pingInterval = 30000,\n        auth: authConfig,\n    } = config;\n\n    return async (c: Context) =>\n    {\n        // ── 1. Token Authentication ──\n        const subject = await authenticateToken(c, tokenManager);\n        if (subject === false)\n        {\n            return c.json({ error: 'Missing token parameter' }, 401);\n        }\n        if (subject === null)\n        {\n            return c.json({ error: 'Invalid or expired token' }, 401);\n        }\n        if (subject)\n        {\n            c.set('sseSubject', subject);\n        }\n\n        // ── 2. Parse events from query parameter ──\n        const requestedEvents = parseRequestedEvents(c);\n        if (!requestedEvents)\n        {\n            return c.json({ error: 'Missing events parameter' }, 400);\n        }\n\n        // ── 3. Validate event names ──\n        const validEventNames = router.eventNames as string[];\n        const invalidEvents = requestedEvents.filter(e => !validEventNames.includes(e));\n\n        if (invalidEvents.length > 0)\n        {\n            return c.json({\n                error: 'Invalid event names',\n                invalidEvents,\n                validEvents: validEventNames,\n            }, 400);\n        }\n\n        // ── 4. Subscription Authorization ──\n        const allowedEvents = await authorizeEvents(subject, requestedEvents, authConfig);\n        if (allowedEvents === null)\n        {\n            return c.json({ error: 'Not authorized for any requested events' }, 403);\n        }\n\n        sseLogger.debug('SSE connection requested', {\n            events: allowedEvents,\n            subject: subject || undefined,\n            clientIp: c.req.header('x-forwarded-for') || c.req.header('x-real-ip'),\n        });\n\n        // ── 5. SSE Stream ──\n        return streamSSE(c, async (stream) =>\n        {\n            const unsubscribes: (() => void)[] = [];\n            let messageId = 0;\n\n            for (const eventName of allowedEvents as InferEventNames<TRouter>[])\n            {\n                const eventDef = router.events[eventName];\n\n                if (!eventDef)\n                {\n                    continue;\n                }\n\n                const unsubscribe = eventDef.subscribe((payload: unknown) =>\n                {\n                    // ── Payload Filtering ──\n                    if (subject && authConfig?.filter?.[eventName as string])\n                    {\n                        if (!authConfig.filter[eventName as string](subject, payload))\n                        {\n                            return;\n                        }\n                    }\n\n                    messageId++;\n\n                    const message = {\n                        event: eventName,\n                        data: payload,\n                    };\n\n                    sseLogger.debug('SSE sending event', {\n                        event: eventName,\n                        messageId,\n                    });\n\n                    // Fire-and-forget in sync callback\n                    void stream.writeSSE({\n                        id: String(messageId),\n                        event: eventName as string,\n                        data: JSON.stringify(message),\n                    });\n                });\n\n                unsubscribes.push(unsubscribe);\n            }\n\n            sseLogger.info('SSE connection established', {\n                events: allowedEvents,\n                subscriptionCount: unsubscribes.length,\n            });\n\n            // Send initial connection message\n            await stream.writeSSE({\n                event: 'connected',\n                data: JSON.stringify({\n                    subscribedEvents: allowedEvents,\n                    timestamp: Date.now(),\n                }),\n            });\n\n            // Keep-alive ping\n            const pingTimer = setInterval(() =>\n            {\n                // Fire-and-forget in sync callback\n                void stream.writeSSE({\n                    event: 'ping',\n                    data: JSON.stringify({ timestamp: Date.now() }),\n                });\n            }, pingInterval);\n\n            // Wait for client disconnect using abort signal\n            const abortSignal = c.req.raw.signal;\n\n            while (!abortSignal.aborted)\n            {\n                await stream.sleep(pingInterval);\n            }\n\n            // Cleanup\n            clearInterval(pingTimer);\n            unsubscribes.forEach(fn => fn());\n\n            sseLogger.info('SSE connection closed', {\n                events: allowedEvents,\n            });\n        }, async (err: Error) =>\n        {\n            sseLogger.error('SSE stream error', {\n                error: err.message,\n            });\n        });\n    };\n}\n\n// ============================================================================\n// Helper Functions\n// ============================================================================\n\n/**\n * Authenticate via one-time token\n * @returns subject string if authenticated, undefined if no auth required,\n *          false if token missing, null if token invalid/expired\n */\nasync function authenticateToken(\n    c: Context,\n    tokenManager?: SSETokenManager\n): Promise<string | undefined | false | null>\n{\n    if (!tokenManager)\n    {\n        return undefined;\n    }\n\n    const token = c.req.query('token');\n    if (!token)\n    {\n        return false;\n    }\n\n    return await tokenManager.verify(token);\n}\n\n/**\n * Parse requested events from query parameter\n */\nfunction parseRequestedEvents(c: Context): string[] | null\n{\n    const eventsParam = c.req.query('events');\n    if (!eventsParam)\n    {\n        return null;\n    }\n\n    return eventsParam.split(',').map(e => e.trim());\n}\n\n/**\n * Authorize event subscription via auth hook\n * @returns allowed events array, or null if rejected\n */\nasync function authorizeEvents(\n    subject: string | undefined,\n    requestedEvents: string[],\n    authConfig?: SSEHandlerAuthConfig\n): Promise<string[] | null>\n{\n    if (!subject || !authConfig?.authorize)\n    {\n        return requestedEvents;\n    }\n\n    const allowed = await authConfig.authorize(subject, requestedEvents);\n\n    if (allowed.length === 0)\n    {\n        return null;\n    }\n\n    return allowed;\n}\n","/**\n * SSE Token Manager\n *\n * Auth-agnostic token issuance and verification for SSE connections.\n * Issues one-time-use tokens with TTL for Token Exchange pattern.\n *\n * @example\n * ```typescript\n * const manager = new SSETokenManager({ ttl: 30000 });\n *\n * // Issue token for authenticated user\n * const token = await manager.issue('user-123');\n *\n * // Verify and consume token (one-time use)\n * const subject = await manager.verify(token); // 'user-123'\n * const again = await manager.verify(token);   // null (already consumed)\n *\n * // Cleanup on shutdown\n * manager.destroy();\n * ```\n */\n\nimport { randomBytes } from 'crypto';\n\n/**\n * Minimal cache client interface (compatible with ioredis Redis | Cluster)\n */\ntype CacheClient = {\n    set(key: string, value: string, ...args: any[]): Promise<any>;\n    getdel?(key: string): Promise<string | null>;\n    get(key: string): Promise<string | null>;\n    del(key: string | string[]): Promise<number>;\n};\n\n// ============================================================================\n// Types\n// ============================================================================\n\n/**\n * Stored SSE token data\n */\nexport interface SSEToken\n{\n    token: string;\n    subject: string;\n    expiresAt: number;\n}\n\n/**\n * Token storage interface\n *\n * Implement this for custom storage backends (e.g., Redis for multi-instance).\n */\nexport interface SSETokenStore\n{\n    /** Store a token */\n    set(token: string, data: SSEToken): Promise<void>;\n\n    /** Get and delete a token (one-time use) */\n    consume(token: string): Promise<SSEToken | null>;\n\n    /** Remove expired tokens */\n    cleanup(): Promise<void>;\n}\n\n/**\n * SSETokenManager configuration\n */\nexport interface SSETokenManagerConfig\n{\n    /**\n     * Token time-to-live in milliseconds\n     * @default 30000\n     */\n    ttl?: number;\n\n    /**\n     * Custom token store (default: in-memory Map)\n     */\n    store?: SSETokenStore;\n\n    /**\n     * Cleanup interval in milliseconds\n     * @default 60000\n     */\n    cleanupInterval?: number;\n}\n\n// ============================================================================\n// InMemoryTokenStore\n// ============================================================================\n\nclass InMemoryTokenStore implements SSETokenStore\n{\n    private tokens = new Map<string, SSEToken>();\n\n    async set(token: string, data: SSEToken): Promise<void>\n    {\n        this.tokens.set(token, data);\n    }\n\n    async consume(token: string): Promise<SSEToken | null>\n    {\n        const data = this.tokens.get(token);\n        if (!data)\n        {\n            return null;\n        }\n\n        this.tokens.delete(token);\n        return data;\n    }\n\n    async cleanup(): Promise<void>\n    {\n        const now = Date.now();\n\n        for (const [token, data] of this.tokens)\n        {\n            if (data.expiresAt <= now)\n            {\n                this.tokens.delete(token);\n            }\n        }\n    }\n}\n\n// ============================================================================\n// CacheTokenStore (Redis/Valkey)\n// ============================================================================\n\n/**\n * Redis/Valkey-backed token store for multi-instance deployments.\n *\n * Uses SET EX for automatic TTL expiry and GETDEL for atomic one-time consumption.\n * No cleanup needed — Redis handles expiration automatically.\n *\n * @example\n * ```typescript\n * import { getCache } from '@spfn/core/cache';\n *\n * const cache = getCache();\n * if (cache) {\n *     const store = new CacheTokenStore(cache);\n *     const manager = new SSETokenManager({ store });\n * }\n * ```\n */\nexport class CacheTokenStore implements SSETokenStore\n{\n    private prefix = 'sse:token:';\n\n    constructor(private cache: CacheClient) {}\n\n    async set(token: string, data: SSEToken): Promise<void>\n    {\n        const ttlSeconds = Math.max(1, Math.ceil((data.expiresAt - Date.now()) / 1000));\n        await this.cache.set(\n            this.prefix + token,\n            JSON.stringify(data),\n            'EX',\n            ttlSeconds,\n        );\n    }\n\n    async consume(token: string): Promise<SSEToken | null>\n    {\n        const key = this.prefix + token;\n\n        // GETDEL (Redis 6.2+) for atomic consume, fallback to GET+DEL\n        let raw: string | null = null;\n\n        if (this.cache.getdel)\n        {\n            raw = await this.cache.getdel(key);\n        }\n        else\n        {\n            raw = await this.cache.get(key);\n            if (raw)\n            {\n                await this.cache.del(key);\n            }\n        }\n\n        if (!raw)\n        {\n            return null;\n        }\n\n        return JSON.parse(raw) as SSEToken;\n    }\n\n    async cleanup(): Promise<void>\n    {\n        // No-op: Redis TTL handles expiration automatically\n    }\n}\n\n// ============================================================================\n// SSETokenManager\n// ============================================================================\n\nexport class SSETokenManager\n{\n    private store: SSETokenStore;\n    private ttl: number;\n    private cleanupTimer: ReturnType<typeof setInterval> | null = null;\n\n    constructor(config?: SSETokenManagerConfig)\n    {\n        this.ttl = config?.ttl ?? 30000;\n        this.store = config?.store ?? new InMemoryTokenStore();\n\n        const cleanupInterval = config?.cleanupInterval ?? 60000;\n        this.cleanupTimer = setInterval(() => void this.store.cleanup(), cleanupInterval);\n        this.cleanupTimer.unref();\n    }\n\n    /**\n     * Issue a new one-time-use token for the given subject\n     */\n    async issue(subject: string): Promise<string>\n    {\n        const token = randomBytes(32).toString('hex');\n\n        await this.store.set(token, {\n            token,\n            subject,\n            expiresAt: Date.now() + this.ttl,\n        });\n\n        return token;\n    }\n\n    /**\n     * Verify and consume a token\n     * @returns subject string if valid, null if invalid/expired/already consumed\n     */\n    async verify(token: string): Promise<string | null>\n    {\n        const data = await this.store.consume(token);\n\n        if (!data || data.expiresAt <= Date.now())\n        {\n            return null;\n        }\n\n        return data.subject;\n    }\n\n    /**\n     * Cleanup timer and resources\n     */\n    destroy(): void\n    {\n        if (this.cleanupTimer)\n        {\n            clearInterval(this.cleanupTimer);\n            this.cleanupTimer = null;\n        }\n    }\n}\n"]}

package/dist/job/index.d.ts

@@ -1,5 +1,5 @@
-import { a as JobOptions, b as JobHandler, c as JobDef, d as JobRouterEntry, J as JobRouter } from '../boss-BO8ty33K.js';
-export { j as BossConfig, B as BossOptions, I as InferJobInput, e as JobSendOptions, g as getBoss, i as initBoss, f as isBossRunning, h as shouldClearOnStart, s as stopBoss } from '../boss-BO8ty33K.js';
+import { a as JobOptions, C as CompensateHandler, b as JobHandler, c as JobDef, d as JobRouterEntry, J as JobRouter } from '../boss-DI1r4kTS.js';
+export { k as BossConfig, B as BossOptions, I as InferJobInput, f as InferJobOutput, e as JobSendOptions, g as getBoss, i as initBoss, h as isBossRunning, j as shouldClearOnStart, s as stopBoss } from '../boss-DI1r4kTS.js';
 import * as _sinclair_typebox from '@sinclair/typebox';
 import { Static } from '@sinclair/typebox';
 import { EventDef, InferEventPayload } from '@spfn/core/event';
@@ -8,20 +8,26 @@ import 'pg-boss';
 /**
  * Job builder class with fluent API
  */
-declare class JobBuilder<TInput = void> {
-    private _name;
+declare class JobBuilder<TInput = void, TOutput = void> {
+    private readonly _name;
     private _inputSchema?;
+    private _outputSchema?;
     private _cronExpression?;
     private _runOnce?;
     private _subscribedEvent?;
     private _subscribedEventDef?;
     private _options?;
     private _handler?;
+    private _compensate?;
     constructor(name: string);
     /**
      * Define input schema with TypeBox
      */
-    input<TSchema extends _sinclair_typebox.TSchema>(schema: TSchema): JobBuilder<Static<TSchema>>;
+    input<TSchema extends _sinclair_typebox.TSchema>(schema: TSchema): JobBuilder<Static<TSchema>, TOutput>;
+    /**
+     * Define output schema with TypeBox (for workflow integration)
+     */
+    output<TSchema extends _sinclair_typebox.TSchema>(schema: TSchema): JobBuilder<TInput, Static<TSchema>>;
     /**
      * Subscribe to an event (decoupled triggering)
      *
@@ -38,7 +44,7 @@ declare class JobBuilder<TInput = void> {
      *     });
      * ```
      */
-    on<TEvent extends EventDef<any>>(event: TEvent): JobBuilder<InferEventPayload<TEvent>>;
+    on<TEvent extends EventDef<any>>(event: TEvent): JobBuilder<InferEventPayload<TEvent>, TOutput>;
     /**
      * Set cron expression for scheduled execution
      */
@@ -51,10 +57,19 @@ declare class JobBuilder<TInput = void> {
      * Set job options (retry, expiration, etc.)
      */
     options(options: JobOptions): this;
+    /**
+     * Set job timeout in milliseconds
+     * (Converts to expireInSeconds for pg-boss)
+     */
+    timeout(ms: number): this;
+    /**
+     * Define compensate handler for rollback (workflow integration)
+     */
+    compensate(fn: CompensateHandler<TInput, TOutput>): this;
     /**
      * Define the job handler and finalize the job definition
      */
-    handler(fn: JobHandler<TInput>): JobDef<TInput>;
+    handler(fn: JobHandler<TInput, TOutput>): JobDef<TInput, TOutput>;
 }
 /**
  * Create a new job definition
@@ -200,4 +215,4 @@ declare function collectJobs(router: JobRouter<any>, prefix?: string): JobDef<an
  */
 declare function registerJobs(router: JobRouter<any>): Promise<void>;
 
-export { JobDef, JobHandler, JobOptions, JobRouter, JobRouterEntry, collectJobs, defineJobRouter, isJobDef, isJobRouter, job, registerJobs };
+export { CompensateHandler, JobDef, JobHandler, JobOptions, JobRouter, JobRouterEntry, collectJobs, defineJobRouter, isJobDef, isJobRouter, job, registerJobs };

package/dist/job/index.js

@@ -3,55 +3,91 @@ import { logger } from '@spfn/core/logger';
 
 // src/job/boss.ts
 var jobLogger = logger.child("@spfn/core:job");
-var bossInstance = null;
-var bossConfig = null;
+function requiresSSLWithoutVerification(connectionString) {
+  try {
+    const url = new URL(connectionString);
+    const sslmode = url.searchParams.get("sslmode");
+    return sslmode === "require" || sslmode === "prefer";
+  } catch {
+    return false;
+  }
+}
+function stripSslModeFromUrl(connectionString) {
+  const url = new URL(connectionString);
+  url.searchParams.delete("sslmode");
+  return url.toString();
+}
+var BOSS_KEY = Symbol.for("spfn:boss-instance");
+var CONFIG_KEY = Symbol.for("spfn:boss-config");
+var g = globalThis;
+function getBossInstance() {
+  return g[BOSS_KEY] ?? null;
+}
+function setBossInstance(instance) {
+  g[BOSS_KEY] = instance;
+}
+function getBossConfig() {
+  return g[CONFIG_KEY] ?? null;
+}
+function setBossConfig(config) {
+  g[CONFIG_KEY] = config;
+}
 async function initBoss(options) {
-  if (bossInstance) {
+  const existing = getBossInstance();
+  if (existing) {
     jobLogger.warn("pg-boss already initialized, returning existing instance");
-    return bossInstance;
+    return existing;
   }
   jobLogger.info("Initializing pg-boss...");
-  bossConfig = options;
+  setBossConfig(options);
+  const needsSSL = requiresSSLWithoutVerification(options.connectionString);
   const pgBossOptions = {
-    connectionString: options.connectionString,
+    // pg 드라이버가 URL의 sslmode=require를 verify-full로 해석해서
+    // ssl 옵션을 무시하므로, URL에서 sslmode를 빼고 ssl 객체만 전달
+    connectionString: needsSSL ? stripSslModeFromUrl(options.connectionString) : options.connectionString,
     schema: options.schema ?? "spfn_queue",
     maintenanceIntervalSeconds: options.maintenanceIntervalSeconds ?? 120
   };
+  if (needsSSL) {
+    pgBossOptions.ssl = { rejectUnauthorized: false };
+  }
   if (options.monitorIntervalSeconds !== void 0 && options.monitorIntervalSeconds >= 1) {
     pgBossOptions.monitorIntervalSeconds = options.monitorIntervalSeconds;
   }
-  bossInstance = new PgBoss(pgBossOptions);
-  bossInstance.on("error", (error) => {
+  const boss = new PgBoss(pgBossOptions);
+  boss.on("error", (error) => {
     jobLogger.error("pg-boss error:", error);
   });
-  await bossInstance.start();
+  await boss.start();
+  setBossInstance(boss);
   jobLogger.info("pg-boss started successfully");
-  return bossInstance;
+  return boss;
 }
 function getBoss() {
-  return bossInstance;
+  return getBossInstance();
 }
 async function stopBoss() {
-  if (!bossInstance) {
+  const boss = getBossInstance();
+  if (!boss) {
     return;
   }
   jobLogger.info("Stopping pg-boss...");
   try {
-    await bossInstance.stop({ graceful: true, timeout: 3e4 });
+    await boss.stop({ graceful: true, timeout: 3e4 });
     jobLogger.info("pg-boss stopped gracefully");
   } catch (error) {
     jobLogger.error("Error stopping pg-boss:", error);
     throw error;
   } finally {
-    bossInstance = null;
-    bossConfig = null;
+    setBossInstance(null);
+    setBossConfig(null);
   }
 }
 function isBossRunning() {
-  return bossInstance !== null;
+  return getBossInstance() !== null;
 }
 function shouldClearOnStart() {
-  return bossConfig?.clearOnStart ?? false;
+  return getBossConfig()?.clearOnStart ?? false;
 }
 
 // src/job/job-builder.ts
@@ -89,12 +125,14 @@ function buildPgBossOptions(defaults, sendOptions) {
 var JobBuilder = class _JobBuilder {
   _name;
   _inputSchema;
+  _outputSchema;
   _cronExpression;
   _runOnce;
   _subscribedEvent;
   _subscribedEventDef;
   _options;
   _handler;
+  _compensate;
   constructor(name) {
     this._name = name;
   }
@@ -104,6 +142,20 @@ var JobBuilder = class _JobBuilder {
   input(schema) {
     const builder = new _JobBuilder(this._name);
     builder._inputSchema = schema;
+    builder._outputSchema = this._outputSchema;
+    builder._cronExpression = this._cronExpression;
+    builder._runOnce = this._runOnce;
+    builder._subscribedEvent = this._subscribedEvent;
+    builder._options = this._options;
+    return builder;
+  }
+  /**
+   * Define output schema with TypeBox (for workflow integration)
+   */
+  output(schema) {
+    const builder = new _JobBuilder(this._name);
+    builder._inputSchema = this._inputSchema;
+    builder._outputSchema = schema;
     builder._cronExpression = this._cronExpression;
     builder._runOnce = this._runOnce;
     builder._subscribedEvent = this._subscribedEvent;
@@ -129,6 +181,7 @@ var JobBuilder = class _JobBuilder {
   on(event) {
     const builder = new _JobBuilder(this._name);
     builder._inputSchema = event.schema;
+    builder._outputSchema = this._outputSchema;
     builder._subscribedEvent = event.name;
     builder._subscribedEventDef = event;
     builder._cronExpression = this._cronExpression;
@@ -157,6 +210,24 @@ var JobBuilder = class _JobBuilder {
     this._options = options;
     return this;
   }
+  /**
+   * Set job timeout in milliseconds
+   * (Converts to expireInSeconds for pg-boss)
+   */
+  timeout(ms) {
+    this._options = {
+      ...this._options,
+      expireInSeconds: Math.ceil(ms / 1e3)
+    };
+    return this;
+  }
+  /**
+   * Define compensate handler for rollback (workflow integration)
+   */
+  compensate(fn) {
+    this._compensate = fn;
+    return this;
+  }
   /**
    * Define the job handler and finalize the job definition
    */
@@ -164,12 +235,14 @@ var JobBuilder = class _JobBuilder {
     this._handler = fn;
     const name = this._name;
     const inputSchema = this._inputSchema;
+    const outputSchema = this._outputSchema;
     const cronExpression = this._cronExpression;
     const runOnce = this._runOnce;
     const subscribedEvent = this._subscribedEvent;
     const subscribedEventDef = this._subscribedEventDef;
     const options = this._options;
     const handler = this._handler;
+    const compensate = this._compensate;
     const send = async (inputOrOptions, maybeOptions) => {
       const boss = getBoss();
       if (!boss) {
@@ -186,23 +259,26 @@ var JobBuilder = class _JobBuilder {
     };
     const run = async (input) => {
       if (inputSchema) {
-        await handler(input);
+        return await handler(input);
       } else {
-        await handler();
+        return await handler();
       }
     };
     return {
       name,
       inputSchema,
+      outputSchema,
       cronExpression,
       runOnce,
       subscribedEvent,
       _subscribedEventDef: subscribedEventDef,
       options,
       handler,
+      compensate,
       send,
       run,
-      _input: void 0
+      _input: void 0,
+      _output: void 0
     };
   }
 };