@spfn/core 0.3.0-beta.3 → 0.3.0-beta.5

package/README.md

@@ -359,6 +359,39 @@ probe depends on, and a probe reaches it unauthenticated. An app with `src/serve
 
 ---
 
+## How does a client synchronize with the server clock?
+
+Call `GET /_core/time` before minting a timestamped proof. It is a built-in,
+unauthenticated and session-free operation registered before application middleware and
+routes:
+
+```json
+{ "serverTimeMillis": 1750000000123 }
+```
+
+The response is a closed contract: `serverTimeMillis` is an integer Unix epoch in
+milliseconds and no additional fields are declared. It always carries
+`Cache-Control: no-store`; a cached clock reading is not a synchronization point.
+
+The value is trustworthy only when the transport is trustworthy. Production clients must
+call the endpoint over HTTPS and validate the server certificate. The endpoint does not
+sign its response, compensate for network latency, choose an authentication skew margin,
+or define client retry and persistence policy — those belong to the consuming protocol.
+
+Tests can inject an exact clock without replacing global time:
+
+```typescript
+const app = await createServer(defineServerConfig()
+    .serverTime({ clock: { now: () => 1750000000123 } })
+    .build());
+```
+
+`CORE_TIME_ROUTE`, `CORE_TIME_PATH`, `ServerTimeResponseSchema` and the
+`ServerTimeResponse` type are exported from `@spfn/core/server` for separately deployed
+client-contract exporters to consume from the same wire definition.
+
+---
+
 ## Can I deploy this to Vercel?
 
 Yes, and it is a first-class target rather than a workaround. From your app:
@@ -483,6 +516,57 @@ spfn ops call listSignups --query limit=50            # invoke one
 spfn ops call listSignups --describe                  # print its usage (--json for raw schemas)
 ```
 
+### Can a package ship ops commands?
+
+It can describe them. Whether they are reachable is your application's decision, made in
+the `createOpsRouter` call — installing a package never adds anything to your ops surface.
+Available from **0.3.0-beta.5**.
+
+```typescript
+// in the package
+export const ledgerOpsModule = defineOpsModule({
+    id: 'ledger',
+    source: '@acme/ledger',
+    contractVersion: '1.0.0',
+    summary: 'Ledger diagnostics',
+    commands: {
+        verify: {
+            summary: 'Verify ledger invariants',
+            effect: 'read',                                  // read | write | destructive
+            scopes: ['ledger:read'],
+            route: opsRoute.get('/ledger/verify').handler(verifyLedger),
+        },
+    },
+});
+
+// in the application — nothing is mounted until this line names it
+export const opsRouter = createOpsRouter({ listSignups }, {
+    auth: opsTokenAuth,
+    authorize: requireOpsScope,
+    modules: [ledgerOpsModule],
+});
+```
+
+A module command is named `<module>.<command>` (`ledger.verify`) and its route must live
+under `/_ops/<module>/`. The scopes it declares become a server-side guard, run after
+authentication — `authorize` is required as soon as any module is mounted, and it is passed
+in rather than imported so core stays independent of `@spfn/auth`.
+
+What is refused at definition time: a path that could decode its way out of the module's
+namespace, two commands in one module that could answer the same URL, and an app route that
+overlaps a mounted module's command. That last one matters because the alternative is a
+surface where which command answers depends on route registration order.
+
+The manifest gains a `modules` array and per-command `module`, `summary`, `effect` and
+`scopes`. All of it is additive — an app that mounts no modules serves exactly the v1
+manifest it served before.
+
+```bash
+spfn ops modules                                      # what is mounted, and from where
+spfn ops list --module ledger                         # just that module's commands
+spfn ops call ledger.compact --yes                    # effect=destructive needs this
+```
+
 Authentication is an ops token from [`@spfn/auth`](../auth/README.md#ops-tokens-spfn-ops):
 scoped, revocable, hash-stored, issued with `spfn ops token issue` against the running app
 — the CLI signs in as an administrator, so issuance needs no database access. On macOS the

package/dist/authz/index.js

@@ -1,4 +1,4 @@
-import { format } from 'util';
+import { logger } from '@spfn/core/logger';
 
 // src/errors/error-registry.ts
 var ErrorRegistry = class _ErrorRegistry {
@@ -90,386 +90,6 @@ var ErrorRegistry = class _ErrorRegistry {
     return Array.from(this.errors.keys());
   }
 };
-
-// src/logger/types.ts
-var LOG_LEVEL_PRIORITY = {
-  debug: 0,
-  info: 1,
-  warn: 2,
-  error: 3,
-  fatal: 4
-};
-
-// src/logger/formatters.ts
-var SENSITIVE_KEYS = [
-  "password",
-  "passwd",
-  "pwd",
-  "secret",
-  "token",
-  "apikey",
-  "api_key",
-  "accesstoken",
-  "access_token",
-  "refreshtoken",
-  "refresh_token",
-  "authorization",
-  "auth",
-  "cookie",
-  "session",
-  "sessionid",
-  "session_id",
-  "privatekey",
-  "private_key",
-  "creditcard",
-  "credit_card",
-  "cardnumber",
-  "card_number",
-  "cvv",
-  "ssn",
-  "pin"
-];
-var MASKED_VALUE = "***MASKED***";
-function isSensitiveKey(key) {
-  const lowerKey = key.toLowerCase();
-  return SENSITIVE_KEYS.some((sensitive) => lowerKey.includes(sensitive));
-}
-function maskSensitiveData(data, seen = /* @__PURE__ */ new WeakSet()) {
-  if (data === null || data === void 0) {
-    return data;
-  }
-  if (typeof data !== "object") {
-    return data;
-  }
-  if (seen.has(data)) {
-    return "[Circular]";
-  }
-  seen.add(data);
-  if (Array.isArray(data)) {
-    return data.map((item) => maskSensitiveData(item, seen));
-  }
-  const masked = {};
-  for (const [key, value] of Object.entries(data)) {
-    if (isSensitiveKey(key)) {
-      masked[key] = MASKED_VALUE;
-    } else if (typeof value === "object" && value !== null) {
-      masked[key] = maskSensitiveData(value, seen);
-    } else {
-      masked[key] = value;
-    }
-  }
-  return masked;
-}
-var COLORS = {
-  reset: "\x1B[0m",
-  bright: "\x1B[1m",
-  dim: "\x1B[2m",
-  // 로그 레벨 컬러
-  debug: "\x1B[36m",
-  // cyan
-  info: "\x1B[32m",
-  // green
-  warn: "\x1B[33m",
-  // yellow
-  error: "\x1B[31m",
-  // red
-  fatal: "\x1B[35m",
-  // magenta
-  // 추가 컬러
-  gray: "\x1B[90m"
-};
-function formatTimestampHuman(date) {
-  const year = date.getFullYear();
-  const month = String(date.getMonth() + 1).padStart(2, "0");
-  const day = String(date.getDate()).padStart(2, "0");
-  const hours = String(date.getHours()).padStart(2, "0");
-  const minutes = String(date.getMinutes()).padStart(2, "0");
-  const seconds = String(date.getSeconds()).padStart(2, "0");
-  const ms = String(date.getMilliseconds()).padStart(3, "0");
-  return `${year}-${month}-${day} ${hours}:${minutes}:${seconds}.${ms}`;
-}
-function formatError(error) {
-  const lines = [];
-  lines.push(`${error.name}: ${error.message}`);
-  if (error.stack) {
-    const stackLines = error.stack.split("\n").slice(1);
-    lines.push(...stackLines);
-  }
-  if (error.cause instanceof Error) {
-    lines.push(`Caused by: ${formatError(error.cause)}`);
-  } else if (error.cause !== void 0) {
-    lines.push(`Caused by: ${String(error.cause)}`);
-  }
-  return lines.join("\n");
-}
-function formatConsole(metadata, colorize = true) {
-  const parts = [];
-  const timestamp = formatTimestampHuman(metadata.timestamp);
-  if (colorize) {
-    parts.push(`${COLORS.gray}[${timestamp}]${COLORS.reset}`);
-  } else {
-    parts.push(`[${timestamp}]`);
-  }
-  const pid = process.pid;
-  if (colorize) {
-    parts.push(`${COLORS.dim}[pid=${pid}]${COLORS.reset}`);
-  } else {
-    parts.push(`[pid=${pid}]`);
-  }
-  if (metadata.module) {
-    if (colorize) {
-      parts.push(`${COLORS.dim}[module=${metadata.module}]${COLORS.reset}`);
-    } else {
-      parts.push(`[module=${metadata.module}]`);
-    }
-  }
-  if (metadata.context && Object.keys(metadata.context).length > 0) {
-    Object.entries(metadata.context).forEach(([key, value]) => {
-      let valueStr;
-      if (typeof value === "string") {
-        valueStr = value;
-      } else if (typeof value === "object" && value !== null) {
-        try {
-          valueStr = JSON.stringify(value);
-        } catch (error) {
-          valueStr = "[circular]";
-        }
-      } else {
-        valueStr = String(value);
-      }
-      if (colorize) {
-        parts.push(`${COLORS.dim}[${key}=${valueStr}]${COLORS.reset}`);
-      } else {
-        parts.push(`[${key}=${valueStr}]`);
-      }
-    });
-  }
-  const levelStr = metadata.level.toUpperCase();
-  if (colorize) {
-    const color = COLORS[metadata.level];
-    parts.push(`${color}(${levelStr})${COLORS.reset}:`);
-  } else {
-    parts.push(`(${levelStr}):`);
-  }
-  if (colorize) {
-    parts.push(`${COLORS.bright}${metadata.message}${COLORS.reset}`);
-  } else {
-    parts.push(metadata.message);
-  }
-  let output = parts.join(" ");
-  if (metadata.error) {
-    output += "\n" + formatError(metadata.error);
-  }
-  return output;
-}
-
-// src/logger/logger.ts
-var FORMAT_PATTERN = /%[sdifjoOc%]/;
-var Logger = class _Logger {
-  config;
-  module;
-  constructor(config) {
-    this.config = config;
-    this.module = config.module;
-  }
-  /**
-   * Convert unknown error to Error object
-   */
-  toError(error) {
-    if (error instanceof Error) return error;
-    if (typeof error === "string") return new Error(error);
-    if (typeof error === "object" && error !== null) {
-      return new Error(JSON.stringify(error));
-    }
-    return new Error(String(error));
-  }
-  /**
-   * Check if value is a context object (not an error)
-   */
-  isContext(value) {
-    if (typeof value !== "object" || value === null) return false;
-    if (value instanceof Error) return false;
-    const hasStack = "stack" in value && typeof value.stack === "string";
-    if (hasStack) {
-      return false;
-    }
-    return true;
-  }
-  /**
-   * Get current log level
-   */
-  get level() {
-    return this.config.level;
-  }
-  /**
-   * Create child logger (per module)
-   */
-  child(module) {
-    return new _Logger({
-      ...this.config,
-      module
-    });
-  }
-  /**
-   * Common log method with error/context detection
-   */
-  logWithLevel(level, message, errorOrContext, context) {
-    if (errorOrContext !== void 0 && FORMAT_PATTERN.test(message)) {
-      this.log(level, format(message, errorOrContext), void 0, context);
-      return;
-    }
-    if (errorOrContext instanceof Error) {
-      this.log(level, message, errorOrContext, context);
-    } else if (errorOrContext !== void 0 && typeof errorOrContext === "object" && !this.isContext(errorOrContext)) {
-      this.log(level, message, this.toError(errorOrContext), context);
-    } else if (typeof errorOrContext === "string" || typeof errorOrContext === "number" || typeof errorOrContext === "boolean") {
-      this.log(level, message, this.toError(errorOrContext), context);
-    } else {
-      this.log(level, message, void 0, errorOrContext);
-    }
-  }
-  debug(message, errorOrContext, context) {
-    this.logWithLevel("debug", message, errorOrContext, context);
-  }
-  info(message, errorOrContext, context) {
-    this.logWithLevel("info", message, errorOrContext, context);
-  }
-  warn(message, errorOrContext, context) {
-    this.logWithLevel("warn", message, errorOrContext, context);
-  }
-  error(message, errorOrContext, context) {
-    this.logWithLevel("error", message, errorOrContext, context);
-  }
-  fatal(message, errorOrContext, context) {
-    this.logWithLevel("fatal", message, errorOrContext, context);
-  }
-  /**
-   * Log processing (internal)
-   */
-  log(level, message, error, context) {
-    if (LOG_LEVEL_PRIORITY[level] < LOG_LEVEL_PRIORITY[this.config.level]) {
-      return;
-    }
-    const metadata = {
-      timestamp: /* @__PURE__ */ new Date(),
-      level,
-      message,
-      module: this.module,
-      error,
-      // Mask sensitive information in context to prevent credential leaks
-      context: context ? maskSensitiveData(context) : void 0
-    };
-    this.processTransports(metadata);
-  }
-  /**
-   * Process Transports
-   */
-  processTransports(metadata) {
-    const promises = this.config.transports.filter((transport) => transport.enabled).map((transport) => this.safeTransportLog(transport, metadata));
-    Promise.all(promises).catch((error) => {
-      const errorMessage = error instanceof Error ? error.message : String(error);
-      process.stderr.write(`[Logger] Transport error: ${errorMessage}
-`);
-    });
-  }
-  /**
-   * Transport log (error-safe)
-   */
-  async safeTransportLog(transport, metadata) {
-    try {
-      await transport.log(metadata);
-    } catch (error) {
-      const errorMessage = error instanceof Error ? error.message : String(error);
-      process.stderr.write(`[Logger] Transport "${transport.name}" failed: ${errorMessage}
-`);
-    }
-  }
-  /**
-   * Close all Transports
-   */
-  async close() {
-    const closePromises = this.config.transports.filter((transport) => transport.close).map((transport) => transport.close());
-    await Promise.all(closePromises);
-  }
-};
-
-// src/logger/transports/console.ts
-var ConsoleTransport = class {
-  name = "console";
-  level;
-  enabled;
-  colorize;
-  constructor(config) {
-    this.level = config.level;
-    this.enabled = config.enabled;
-    this.colorize = config.colorize ?? true;
-  }
-  async log(metadata) {
-    if (!this.enabled) {
-      return;
-    }
-    if (LOG_LEVEL_PRIORITY[metadata.level] < LOG_LEVEL_PRIORITY[this.level]) {
-      return;
-    }
-    const message = formatConsole(metadata, this.colorize);
-    if (metadata.level === "warn" || metadata.level === "error" || metadata.level === "fatal") {
-      console.error(message);
-    } else {
-      console.log(message);
-    }
-  }
-};
-
-// src/logger/config.ts
-function getConsoleConfig() {
-  const isProduction = process.env.NODE_ENV === "production";
-  return {
-    level: "debug",
-    enabled: true,
-    colorize: !isProduction
-    // Dev: colored output, Production: plain text
-  };
-}
-function validateEnvironment() {
-  const nodeEnv = process.env.NODE_ENV;
-  if (!nodeEnv) {
-    process.stderr.write(
-      "[Logger] Warning: NODE_ENV is not set. Defaulting to test environment.\n"
-    );
-  }
-}
-function validateConfig() {
-  validateEnvironment();
-}
-
-// src/logger/factory.ts
-function initializeTransports() {
-  const transports = [];
-  const consoleConfig = getConsoleConfig();
-  transports.push(new ConsoleTransport(consoleConfig));
-  return transports;
-}
-function getLogLevel() {
-  const envLevel = process.env.SPFN_LOG_LEVEL || process.env.NEXT_PUBLIC_SPFN_LOG_LEVEL || "info";
-  if (envLevel in LOG_LEVEL_PRIORITY) {
-    return envLevel;
-  }
-  process.stderr.write(
-    `[Logger] Invalid log level "${envLevel}", defaulting to "info"
-`
-  );
-  return "info";
-}
-function initializeLogger() {
-  validateConfig();
-  return new Logger({
-    level: getLogLevel(),
-    transports: initializeTransports()
-  });
-}
-var logger = initializeLogger();
-
-// src/errors/serializable-error.ts
 var RESERVED_RESPONSE_KEYS = /* @__PURE__ */ new Set(["__type", "message", "error"]);
 var AUTHORING_ENVIRONMENTS = /* @__PURE__ */ new Set(["local", "development", "test"]);
 function refuseReservedKey(className, key) {