@spine-event-engine/auth 2.0.0-snapshot.10

package/dist/index.d.ts

@@ -0,0 +1,433 @@
+import type { Message } from "@bufbuild/protobuf";
+import type { TypeRegistryLookup } from "@spine-event-engine/core";
+import type { ActorContext, Command, Language, TenantId, UserId, ZoneId } from "@spine-event-engine/proto";
+import { type Query, type Subscription, type Target, type Topic } from "@spine-event-engine/proto/client";
+import type { Timestamp } from "@bufbuild/protobuf/wkt";
+/**
+ * Allowlisted RPC facts exposed to authorization policy and diagnostics.
+ */
+export interface TransportRequestContext {
+    /**
+     * Identifies the receiving RPC service.
+     */
+    readonly service: string;
+    /**
+     * Identifies the invoked RPC method.
+     */
+    readonly method: string;
+    /**
+     * Identifies the browser origin when the transport provides it.
+     */
+    readonly origin?: string;
+    /**
+     * Correlates this request with transport diagnostics.
+     */
+    readonly requestId?: string;
+    /**
+     * Correlates this request with its initiating operation.
+     */
+    readonly correlationId?: string;
+    /**
+     * Identifies the peer address when the transport provides it.
+     */
+    readonly peerAddress?: string;
+    /**
+     * Identifies the calling user agent when the transport provides it.
+     */
+    readonly userAgent?: string;
+}
+/**
+ * Raw transport facts from which the safe transport view is constructed.
+ */
+export interface TransportFactsInput extends Omit<TransportRequestContext, "requestId" | "correlationId"> {
+    /**
+     * Supplies raw request headers from which allowlisted values are selected.
+     */
+    readonly headers?: Readonly<Record<string, string | undefined>>;
+}
+/**
+ * Command facts available to authorization policy.
+ */
+export interface IncomingCommand {
+    /**
+     * Identifies this request as a command.
+     */
+    readonly kind: "command";
+    /**
+     * Carries the received command envelope.
+     */
+    readonly command: Command;
+    /**
+     * Carries the unpacked command message when its type is known.
+     */
+    readonly message: Message | undefined;
+    /**
+     * Identifies the packed command message type.
+     */
+    readonly messageType: string;
+    /**
+     * Carries the context requested by the caller.
+     */
+    readonly requestedContext: ActorContext;
+    /**
+     * Carries allowlisted transport facts.
+     */
+    readonly transport: TransportRequestContext;
+}
+/**
+ * Query facts available to authorization policy.
+ */
+export interface IncomingQuery {
+    /**
+     * Identifies this request as a query.
+     */
+    readonly kind: "query";
+    /**
+     * Carries the received query.
+     */
+    readonly query: Query;
+    /**
+     * Carries the query target.
+     */
+    readonly target: Target;
+    /**
+     * Carries the context requested by the caller.
+     */
+    readonly requestedContext: ActorContext;
+    /**
+     * Carries allowlisted transport facts.
+     */
+    readonly transport: TransportRequestContext;
+}
+/**
+ * Subscription-creation facts available to authorization policy.
+ */
+export interface IncomingSubscription {
+    /**
+     * Identifies this request as subscription creation.
+     */
+    readonly kind: "subscribe";
+    /**
+     * Carries the requested topic.
+     */
+    readonly topic: Topic;
+    /**
+     * Carries the topic target.
+     */
+    readonly target: Target;
+    /**
+     * Carries the context requested by the caller.
+     */
+    readonly requestedContext: ActorContext;
+    /**
+     * Carries allowlisted transport facts.
+     */
+    readonly transport: TransportRequestContext;
+}
+/**
+ * Subscription-activation facts available to authorization policy.
+ */
+export interface IncomingSubscriptionActivation {
+    /**
+     * Identifies this request as subscription activation.
+     */
+    readonly kind: "activate";
+    /**
+     * Carries the public subscription handle.
+     */
+    readonly subscription: Subscription;
+    /**
+     * Carries the context requested by the caller.
+     */
+    readonly requestedContext: ActorContext;
+    /**
+     * Carries allowlisted transport facts.
+     */
+    readonly transport: TransportRequestContext;
+}
+/**
+ * Subscription-cancellation facts available to authorization policy.
+ */
+export interface IncomingSubscriptionCancellation {
+    /**
+     * Identifies this request as subscription cancellation.
+     */
+    readonly kind: "cancel";
+    /**
+     * Carries the public subscription handle.
+     */
+    readonly subscription: Subscription;
+    /**
+     * Carries the context requested by the caller.
+     */
+    readonly requestedContext: ActorContext;
+    /**
+     * Carries allowlisted transport facts.
+     */
+    readonly transport: TransportRequestContext;
+}
+/**
+ * Exhaustive request model used at the authorization boundary.
+ */
+export type IncomingRequest = IncomingCommand | IncomingQuery | IncomingSubscription | IncomingSubscriptionActivation | IncomingSubscriptionCancellation;
+/**
+ * Identity established by an application-specific authenticator.
+ */
+export interface AuthenticatedPrincipal {
+    /**
+     * Identifies the authenticated application principal.
+     */
+    readonly id: string;
+    /**
+     * Carries application-defined identity attributes.
+     */
+    readonly attributes?: Readonly<Record<string, string>>;
+}
+/**
+ * Credential material supplied directly to an authenticator or session resolver.
+ */
+export interface RequestCredential {
+    /**
+     * Identifies how the credential was presented.
+     */
+    readonly kind: "bearer" | "cookie";
+    /**
+     * Carries the opaque credential material.
+     */
+    readonly value: string;
+}
+/**
+ * Cookie credential issued by an application-session strategy.
+ */
+export interface CookieCredential extends RequestCredential {
+    /**
+     * Identifies this credential as a cookie.
+     */
+    readonly kind: "cookie";
+}
+/**
+ * Bearer credential issued by a signed application-session strategy.
+ */
+export interface BearerCredential extends RequestCredential {
+    /**
+     * Identifies this credential as a bearer token.
+     */
+    readonly kind: "bearer";
+}
+/**
+ * Session validated by an application-selected session strategy.
+ */
+export interface ResolvedSession {
+    /**
+     * Identifies the authenticated session principal.
+     */
+    readonly principal: AuthenticatedPrincipal;
+    /**
+     * Specifies when the resolved session expires.
+     */
+    readonly expiresAt: Timestamp;
+}
+/**
+ * Provider-neutral authentication boundary. Credentials do not reach policy request facts.
+ */
+export interface Authenticator {
+    /**
+     * Validates a presented credential.
+     * @param credential Supplies the credential to authenticate.
+     * @returns Returns the authenticated principal or `undefined` when rejected.
+     */
+    authenticate(credential: RequestCredential): Promise<AuthenticatedPrincipal | undefined>;
+}
+/**
+ * Application-session validation boundary.
+ */
+export interface SessionResolver {
+    /**
+     * Resolves a presented credential into a valid session.
+     * @param credential Supplies the credential to resolve.
+     * @returns Returns the resolved session or `undefined` when it is invalid.
+     */
+    resolve(credential: RequestCredential): Promise<ResolvedSession | undefined>;
+}
+/**
+ * Authorization policy boundary evaluated separately for every incoming request.
+ */
+export interface AuthorizationPolicy {
+    /**
+     * Checks whether a principal may make one incoming request.
+     * @param principal Supplies the authenticated principal.
+     * @param request Supplies the request being authorized.
+     * @returns Returns whether the request is allowed.
+     */
+    authorize(principal: AuthenticatedPrincipal, request: IncomingRequest): Promise<boolean>;
+}
+/**
+ * Gateway-owned trusted context supplied after authentication and authorization.
+ */
+export interface AuthorizedRequestContext {
+    /**
+     * Identifies the resolved application actor.
+     */
+    readonly actor: UserId;
+    /**
+     * Identifies the resolved tenant when the application is multi-tenant.
+     */
+    readonly tenant?: TenantId;
+    /**
+     * Records the trusted resolution time.
+     */
+    readonly timestamp: Timestamp;
+    /**
+     * Identifies the actor's time zone when resolved.
+     */
+    readonly zoneId?: ZoneId;
+    /**
+     * Identifies the actor's language when resolved.
+     */
+    readonly language?: Language;
+}
+/**
+ * Application-owned actor and tenant resolution boundary.
+ */
+export interface ContextResolver {
+    /**
+     * Resolves a trusted context for one authorized request.
+     * @param principal Supplies the authenticated principal.
+     * @param request Supplies the authorized request.
+     * @param clock Supplies the trusted timestamp source.
+     * @returns Returns the resolved actor context.
+     */
+    resolve(principal: AuthenticatedPrincipal, request: IncomingRequest, clock: Clock): Promise<AuthorizedRequestContext>;
+    /**
+     * Resolves a context when only the principal is available.
+     * @param principal Supplies the authenticated principal.
+     * @param clock Supplies the trusted timestamp source.
+     * @returns Returns the resolved actor context.
+     */
+    resolveContext(principal: AuthenticatedPrincipal, clock: Clock): Promise<AuthorizedRequestContext>;
+}
+/**
+ * Clock boundary for trusted timestamps and deterministic gateway tests.
+ */
+export interface Clock {
+    /**
+     * Returns the current trusted timestamp.
+     * @returns Returns the current timestamp.
+     */
+    now(): Timestamp;
+}
+/**
+ * Envelope-decoding boundary used by the later gateway pipeline.
+ */
+export interface RequestDecoder {
+    /**
+     * Decodes one transport request.
+     * @param input Supplies the wire request input.
+     * @returns Returns decoded request facts or `undefined` for invalid input.
+     */
+    decode(input: IncomingRequestInput): IncomingRequest | undefined;
+}
+/**
+ * Wire envelope shape decoded by the gateway's later forwarding pipeline.
+ */
+export type IncomingRequestInput = CommandRequestInput | {
+    /**
+     * Identifies this input as a query.
+     */
+    readonly kind: "query";
+    /**
+     * Carries the serialized query bytes.
+     */
+    readonly value: Uint8Array;
+    /**
+     * Carries allowlisted transport facts.
+     */
+    readonly transport: TransportRequestContext;
+} | {
+    /**
+     * Identifies this input as subscription creation.
+     */
+    readonly kind: "subscribe";
+    /**
+     * Carries the serialized topic bytes.
+     */
+    readonly value: Uint8Array;
+    /**
+     * Carries allowlisted transport facts.
+     */
+    readonly transport: TransportRequestContext;
+} | {
+    /**
+     * Identifies this input as subscription activation.
+     */
+    readonly kind: "activate";
+    /**
+     * Carries the serialized subscription bytes.
+     */
+    readonly value: Uint8Array;
+    /**
+     * Carries allowlisted transport facts.
+     */
+    readonly transport: TransportRequestContext;
+} | {
+    /**
+     * Identifies this input as subscription cancellation.
+     */
+    readonly kind: "cancel";
+    /**
+     * Carries the serialized subscription bytes.
+     */
+    readonly value: Uint8Array;
+    /**
+     * Carries allowlisted transport facts.
+     */
+    readonly transport: TransportRequestContext;
+};
+/**
+ * Wire command envelope with an optional registry for content-aware policy.
+ */
+export interface CommandRequestInput {
+    /**
+     * Identifies this input as a command.
+     */
+    readonly kind: "command";
+    /**
+     * Carries the serialized command bytes.
+     */
+    readonly value: Uint8Array;
+    /**
+     * Carries allowlisted transport facts.
+     */
+    readonly transport: TransportRequestContext;
+    /**
+     * Supplies message types used to unpack the command when available.
+     */
+    readonly registry?: TypeRegistryLookup;
+}
+interface TransportFactsApi {
+    from(input: TransportFactsInput): TransportRequestContext;
+}
+/**
+ * Builds the allowlisted transport facts used by authorization and diagnostics.
+ */
+export declare const TransportFacts: Readonly<TransportFactsApi>;
+export { IncomingRequests } from "./request/index.js";
+export { UnaryGateway } from "./gateway/index.js";
+export { OpaqueSessionCookies } from "./sessions/cookies.js";
+export { OpaqueSessions } from "./sessions/opaque.js";
+export { SignedSessions } from "./sessions/signed.js";
+export { OidcFlow } from "./oidc/index.js";
+export { createGitHubProvider, createGoogleProvider, createOidcProvider, discoverOidcProvider, } from "./providers/index.js";
+export { InMemorySubscriptionBindings, SubscriptionGateway } from "./subscriptions/index.js";
+export { createNativeGatewayServices, NativeSubscriptionCreator, SubscriptionUpdateRelay, } from "./native/index.js";
+export type { UnaryForwarder, GatewayAdmission, UnaryGatewayCollaborators, UnaryGatewayOptions, UnaryGatewayRejection, UnaryGatewayRequest, UnaryGatewayResult, } from "./gateway/index.js";
+export type { SubscriptionCreator, SubscriptionCoordinator, SubscriptionGatewayLimits, SubscriptionGatewayCollaborators, SubscriptionGatewayOptions, SubscriptionGatewayRequest, SubscriptionGatewayResult, SubscriptionBindings, SubscriptionAbortSignal, SubscriptionBindingTransition, SubscriptionTopicWire, PublicSubscriptionWire, BackendSubscriptionEnvelope, OnSubscriptionDefinition, SubscriptionUpdateSink, SubscriptionUpdateWire, } from "./subscriptions/index.js";
+export type { NativeGatewayRequestContext, NativeGatewayServices, NativeGatewayServicesOptions, SubscriptionRelayLimits, } from "./native/index.js";
+export type { OpaqueCredentialExtraction, OpaqueCredentialRejection, OpaqueSessionCookiesOptions, OpaqueSessionHeaders, } from "./sessions/cookies.js";
+export type { OpaqueSessionClock, OpaqueSessionCreateResult, OpaqueSessionLogoutResult, OpaqueSessionRandom, OpaqueSessionRotateResult, OpaqueSessionsOptions, } from "./sessions/opaque.js";
+export type { SignedSessionClock, SignedSessionIssueResult, SignedSessionLogoutResult, SignedSessionRandom, SignedSessionRotationResult, SignedSessionSigningKey, SignedSessionVerificationKey, SignedSessionsOptions, SignedTokenRevocation, } from "./sessions/signed.js";
+export type { ApplicationSessionIssue, ApplicationSessionIssuer, ExternalIdentity, IdentityMapping, OidcAuthorizationCodeExchange, OidcFlowCallbackInput, OidcFlowCallbackResult, OidcFlowClock, OidcFlowExchangeInput, OidcFlowExchangeResult, OidcFlowOptions, OidcFlowRandom, OidcFlowStartInput, OidcFlowStartResult, OidcVerifiedIdentityProvider, ResolvedApplicationIdentity, } from "./oidc/contracts.js";
+export type { ConfiguredOidcProvider, GitHubProviderOptions, OidcClientAuthentication, OidcProviderOptions, ProviderFetch, } from "./providers/index.js";
+export { DynamicUnaryForwarder, type DynamicUnaryClient, type DynamicUnaryOptions, } from "./gateway/dynamic-unary-forwarder.js";
+export { DynamicSubscriptionCreator } from "./gateway/dynamic-subscription-creator.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EACV,YAAY,EACZ,OAAO,EACP,QAAQ,EACR,QAAQ,EACR,MAAM,EACN,MAAM,EACP,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,KAAK,KAAK,EACV,KAAK,YAAY,EACjB,KAAK,MAAM,EACX,KAAK,KAAK,EACX,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAExD;;GAEG;AACH,MAAM,WAAW,uBAAuB;IAGtC;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAE5B;;OAEG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC;;OAEG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B;;OAEG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,mBAAoB,SAAQ,IAAI,CAC/C,uBAAuB,EACvB,WAAW,GAAG,eAAe,CAC9B;IAGC;;OAEG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;CACjE;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAG9B;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,SAAS,CAAC;IAEtC;;OAEG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B;;OAEG;IACH,QAAQ,CAAC,gBAAgB,EAAE,YAAY,CAAC;IAExC;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;CAC7C;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAG5B;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAEvB;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IAEtB;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB;;OAEG;IACH,QAAQ,CAAC,gBAAgB,EAAE,YAAY,CAAC;IAExC;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;CAC7C;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IAGnC;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAE3B;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IAEtB;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB;;OAEG;IACH,QAAQ,CAAC,gBAAgB,EAAE,YAAY,CAAC;IAExC;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;CAC7C;AAED;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAG7C;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IAEpC;;OAEG;IACH,QAAQ,CAAC,gBAAgB,EAAE,YAAY,CAAC;IAExC;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;CAC7C;AAED;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAG/C;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAExB;;OAEG;IACH,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IAEpC;;OAEG;IACH,QAAQ,CAAC,gBAAgB,EAAE,YAAY,CAAC;IAExC;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;CAC7C;AAED;;GAEG;AACH,MAAM,MAAM,eAAe,GACvB,eAAe,GACf,aAAa,GACb,oBAAoB,GACpB,8BAA8B,GAC9B,gCAAgC,CAAC;AAErC;;GAEG;AACH,MAAM,WAAW,sBAAsB;IAGrC;;OAEG;IACH,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACxD;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAGhC;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAEnC;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IAGzD;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IAGzD;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAG9B;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,sBAAsB,CAAC;IAE3C;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAG5B;;;;OAIG;IACH,YAAY,CAAC,UAAU,EAAE,iBAAiB,GAAG,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CAAC;CAC1F;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAG9B;;;;OAIG;IACH,OAAO,CAAC,UAAU,EAAE,iBAAiB,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC;CAC9E;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAGlC;;;;;OAKG;IACH,SAAS,CAAC,SAAS,EAAE,sBAAsB,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC1F;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IAGvC;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC;IAE3B;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAE9B;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAG9B;;;;;;OAMG;IACH,OAAO,CACL,SAAS,EAAE,sBAAsB,EACjC,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE,KAAK,GACX,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAErC;;;;;OAKG;IACH,cAAc,CACZ,SAAS,EAAE,sBAAsB,EACjC,KAAK,EAAE,KAAK,GACX,OAAO,CAAC,wBAAwB,CAAC,CAAC;CACtC;AAED;;GAEG;AACH,MAAM,WAAW,KAAK;IAGpB;;;OAGG;IACH,GAAG,IAAI,SAAS,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAG7B;;;;OAIG;IACH,MAAM,CAAC,KAAK,EAAE,oBAAoB,GAAG,eAAe,GAAG,SAAS,CAAC;CAClE;AAED;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAC5B,mBAAmB,GACnB;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAEvB;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAE3B;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;CAC7C,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAE3B;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAE3B;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;CAC7C,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAE3B;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;CAC7C,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAExB;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAE3B;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;CAC7C,CAAC;AAEN;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAGlC;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAE3B;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;IAE5C;;OAEG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CACxC;AAED,UAAU,iBAAiB;IACzB,IAAI,CAAC,KAAK,EAAE,mBAAmB,GAAG,uBAAuB,CAAC;CAC3D;AAED;;GAEG;AACH,eAAO,MAAM,cAAc,EAAE,QAAQ,CAAC,iBAAiB,CAwBrD,CAAC;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAYtD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,4BAA4B,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC7F,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,cAAc,EACd,gBAAgB,EAChB,yBAAyB,EACzB,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,mBAAmB,EACnB,uBAAuB,EACvB,yBAAyB,EACzB,gCAAgC,EAChC,0BAA0B,EAC1B,0BAA0B,EAC1B,yBAAyB,EACzB,oBAAoB,EACpB,uBAAuB,EACvB,6BAA6B,EAC7B,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,2BAA2B,EAC3B,qBAAqB,EACrB,4BAA4B,EAC5B,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,0BAA0B,EAC1B,yBAAyB,EACzB,2BAA2B,EAC3B,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,kBAAkB,EAClB,yBAAyB,EACzB,yBAAyB,EACzB,mBAAmB,EACnB,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,kBAAkB,EAClB,wBAAwB,EACxB,yBAAyB,EACzB,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACvB,4BAA4B,EAC5B,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,uBAAuB,EACvB,wBAAwB,EACxB,gBAAgB,EAChB,eAAe,EACf,6BAA6B,EAC7B,qBAAqB,EACrB,sBAAsB,EACtB,aAAa,EACb,qBAAqB,EACrB,sBAAsB,EACtB,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,mBAAmB,EACnB,aAAa,GACd,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,qBAAqB,EACrB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC"}

package/dist/index.js

@@ -0,0 +1,56 @@
+/*
+ * Copyright 2026, CodeMatters. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License. You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
+ * or implied. See the License for the specific language governing permissions and limitations under
+ * the License.
+ */
+import {} from "@spine-event-engine/proto/client";
+/**
+ * Builds the allowlisted transport facts used by authorization and diagnostics.
+ */
+export const TransportFacts = Object.freeze({
+    // prettier-ignore
+    /**
+     * Builds allowlisted facts while omitting credentials and unknown headers.
+     * @param input Supplies raw transport facts and optional headers.
+     * @returns Returns the safe transport context.
+     */
+    from(input) {
+        const headers = Object.fromEntries(Object.entries(input.headers ?? {})
+            .filter((entry) => entry[1] !== undefined)
+            .map(([name, value]) => [name.toLowerCase(), value]));
+        return TransportFactsValues.compact({
+            service: input.service,
+            method: input.method,
+            origin: input.origin,
+            requestId: headers["x-request-id"],
+            correlationId: headers["x-correlation-id"],
+            peerAddress: input.peerAddress,
+            userAgent: input.userAgent,
+        });
+    },
+});
+export { IncomingRequests } from "./request/index.js";
+const TransportFactsValues = Object.freeze({
+    compact(context) {
+        return Object.fromEntries(Object.entries(context).filter(([, value]) => value !== undefined));
+    },
+});
+export { UnaryGateway } from "./gateway/index.js";
+export { OpaqueSessionCookies } from "./sessions/cookies.js";
+export { OpaqueSessions } from "./sessions/opaque.js";
+export { SignedSessions } from "./sessions/signed.js";
+export { OidcFlow } from "./oidc/index.js";
+export { createGitHubProvider, createGoogleProvider, createOidcProvider, discoverOidcProvider, } from "./providers/index.js";
+export { InMemorySubscriptionBindings, SubscriptionGateway } from "./subscriptions/index.js";
+export { createNativeGatewayServices, NativeSubscriptionCreator, SubscriptionUpdateRelay, } from "./native/index.js";
+export { DynamicUnaryForwarder, } from "./gateway/dynamic-unary-forwarder.js";
+export { DynamicSubscriptionCreator } from "./gateway/dynamic-subscription-creator.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAYH,OAAO,EAKN,MAAM,kCAAkC,CAAC;AA8hB1C;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAgC,MAAM,CAAC,MAAM,CAAC;IACvE,kBAAkB;IAElB;;;;OAIG;IACH,IAAI,CAAC,KAA0B;QAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAChC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;aAChC,MAAM,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;aACpE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,CAAC,CACvD,CAAC;QACF,OAAO,oBAAoB,CAAC,OAAO,CAAC;YAClC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,OAAO,CAAC,cAAc,CAAC;YAClC,aAAa,EAAE,OAAO,CAAC,kBAAkB,CAAC;YAC1C,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;IACL,CAAC;CACF,CAAC,CAAC;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC;IACzC,OAAO,CACL,OACqD;QAErD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAC7B,CAAC;IAC1C,CAAC;CACF,CAAC,CAAC;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,4BAA4B,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC7F,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAoF3B,OAAO,EACL,qBAAqB,GAGtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC"}