@spine-event-engine/auth 2.0.0-snapshot.2

package/dist/gateway/dynamic-unary-forwarder.d.ts

@@ -0,0 +1,130 @@
+import { ApplicationNode } from "@spine-event-engine/deployment";
+import type { ILogLayer } from "loglayer";
+import type { UnaryForwarder } from "./index.js";
+import type { PublicSubscriptionWire, SubscriptionCreator, SubscriptionUpdateSink } from "../subscriptions/index.js";
+/**
+ * Represents a connected unary backend with deterministic disposal.
+ */
+export interface DynamicUnaryClient extends UnaryForwarder, SubscriptionCreator {
+    /**
+     * Returns after releasing this connection when its node leaves membership.
+     *
+     * @returns Completion of connection cleanup.
+     */
+    close(): Promise<void>;
+}
+/**
+ * Configures unary clients for discovered application nodes.
+ */
+export interface DynamicUnaryOptions {
+    /**
+     * Creates a client for one discovered application node.
+     *
+     * @param node Supplies the discovered application node.
+     * @param signal Cancels client creation.
+     * @returns The connected unary client.
+     */
+    readonly create: (node: ApplicationNode, signal: AbortSignal) => Promise<DynamicUnaryClient>;
+    /**
+     * Limits parallel client starts when supplied.
+     */
+    readonly maxConcurrentStarts?: number;
+    /**
+     * Limits one backend subscription envelope when supplied.
+     */
+    readonly maxBackendEnvelopeBytes?: number;
+    /**
+     * Receives adapter-local diagnostic records when supplied.
+     */
+    readonly logger?: ILogLayer;
+}
+/**
+ * Adapts Gateway unary operations to the deployment-owned membership kernel.
+ * Durable logical ownership remains in the Gateway's subscription bindings.
+ */
+export declare class DynamicUnaryForwarder implements UnaryForwarder {
+    #private;
+    /**
+     * Creates the Gateway adapter around the deployment membership kernel.
+     *
+     * @param options Configures discovery clients and resource bounds.
+     */
+    constructor(options: DynamicUnaryOptions);
+    /**
+     * Updates connected clients from a complete application-node snapshot.
+     *
+     * @param nodes Supplies the complete node snapshot.
+     * @returns Completion of client reconciliation.
+     */
+    reconcile(nodes: readonly ApplicationNode[]): Promise<void>;
+    /**
+     * Returns a unary response from the selected backend client.
+     *
+     * @param request Supplies the request to forward.
+     * @returns The backend response bytes.
+     */
+    forward(request: Parameters<UnaryForwarder["forward"]>[0]): Promise<Uint8Array>;
+    /**
+     * Closes all live backend clients.
+     *
+     * @returns Completion of backend cleanup.
+     */
+    close(): Promise<void>;
+    /**
+     * Creates backend children for one logical Gateway subscription.
+     *
+     * @param request Supplies the public subscription wire.
+     * @param signal Cancels child creation.
+     * @param maxBackendEnvelopeBytes Limits one backend envelope when supplied.
+     * @returns Completion of child creation.
+     */
+    subscribeDefinition(request: PublicSubscriptionWire, signal: AbortSignal, maxBackendEnvelopeBytes?: number): Promise<void>;
+    /**
+     * Updates backend children for a retained Gateway subscription.
+     *
+     * @param request Supplies the retained public subscription wire.
+     * @param maxBackendEnvelopeBytes Limits one backend envelope when supplied.
+     * @returns Completion of child recreation.
+     */
+    rehydrateDefinition(request: PublicSubscriptionWire, maxBackendEnvelopeBytes?: number): Promise<void>;
+    /**
+     * Activates backend update relay for one Gateway subscription.
+     *
+     * @param wire Supplies the public subscription wire.
+     * @param updates Receives relayed subscription updates.
+     * @param signal Cancels update relay.
+     * @returns Completion after cancellation.
+     */
+    activateDefinition(wire: PublicSubscriptionWire, updates: SubscriptionUpdateSink, signal: AbortSignal): Promise<void>;
+    /**
+     * Cancels backend children for one Gateway subscription.
+     *
+     * @param wire Supplies the public subscription wire.
+     * @param signal Cancels child cleanup when supported.
+     * @returns Completion of child cleanup.
+     */
+    cancelDefinition(wire: PublicSubscriptionWire, signal: AbortSignal): Promise<void>;
+    /**
+     * Resolves when the supplied signal aborts.
+     *
+     * @param signal Supplies the signal to observe.
+     * @returns Completion after the signal aborts.
+     */
+    static waitForAbort(signal: AbortSignal): Promise<void>;
+    /**
+     * Returns the logical identifier encoded in public subscription bytes.
+     *
+     * @param bytes Supplies the public subscription bytes.
+     * @returns The logical identifier, when present.
+     */
+    static definitionKey(bytes: Uint8Array): string | undefined;
+    /**
+     * Returns bytes with only the immediate child subscription identifier rewritten.
+     *
+     * @param bytes Supplies the parent subscription bytes.
+     * @param node Supplies the child application node.
+     * @returns The rewritten child subscription bytes.
+     */
+    static childDefinition(bytes: Uint8Array, node: ApplicationNode): Uint8Array;
+}
+//# sourceMappingURL=dynamic-unary-forwarder.d.ts.map

package/dist/gateway/dynamic-unary-forwarder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dynamic-unary-forwarder.d.ts","sourceRoot":"","sources":["../../src/gateway/dynamic-unary-forwarder.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAGjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAE1C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,KAAK,EAEV,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,EAEvB,MAAM,2BAA2B,CAAC;AAEnC;;GAEG;AACH,MAAM,WAAW,kBAAmB,SAAQ,cAAc,EAAE,mBAAmB;IAG7E;;;;OAIG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAGlC;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAE7F;;OAEG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAEtC;;OAEG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAE1C;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;CAC7B;AAED;;;GAGG;AACH,qBAAa,qBAAsB,YAAW,cAAc;;IAQ1D;;;;OAIG;gBACS,OAAO,EAAE,mBAAmB;IAsDxC;;;;;OAKG;IACH,SAAS,CAAC,KAAK,EAAE,SAAS,eAAe,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAI3D;;;;;OAKG;IACH,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;IAM/E;;;;OAIG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAItB;;;;;;;OAOG;IACH,mBAAmB,CACjB,OAAO,EAAE,sBAAsB,EAC/B,MAAM,EAAE,WAAW,EACnB,uBAAuB,CAAC,EAAE,MAAM,GAC/B,OAAO,CAAC,IAAI,CAAC;IAWhB;;;;;;OAMG;IACG,mBAAmB,CACvB,OAAO,EAAE,sBAAsB,EAC/B,uBAAuB,CAAC,EAAE,MAAM,GAC/B,OAAO,CAAC,IAAI,CAAC;IAWhB;;;;;;;OAOG;IACH,kBAAkB,CAChB,IAAI,EAAE,sBAAsB,EAC5B,OAAO,EAAE,sBAAsB,EAC/B,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,IAAI,CAAC;IAIhB;;;;;;OAMG;IACH,gBAAgB,CAAC,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlF;;;;;OAKG;IACH,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvD;;;;;OAKG;IACH,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,GAAG,SAAS;IAI3D;;;;;;OAMG;IACH,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,eAAe,GAAG,UAAU;CAiB7E"}

package/dist/gateway/dynamic-unary-forwarder.js

@@ -0,0 +1,185 @@
+/*
+ * Copyright 2026, CodeMatters. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
+ * in compliance with the License. You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
+ * or implied. See the License for the specific language governing permissions and limitations under
+ * the License.
+ */
+import { clone, fromBinary, toBinary } from "@bufbuild/protobuf";
+import { ApplicationNode } from "@spine-event-engine/deployment";
+import { BackendMembershipKernel } from "@spine-event-engine/deployment/internal/backend-membership-kernel";
+import { SubscriptionSchema } from "@spine-event-engine/proto/client";
+/**
+ * Adapts Gateway unary operations to the deployment-owned membership kernel.
+ * Durable logical ownership remains in the Gateway's subscription bindings.
+ */
+export class DynamicUnaryForwarder {
+    #kernel;
+    /**
+     * Creates the Gateway adapter around the deployment membership kernel.
+     *
+     * @param options Configures discovery clients and resource bounds.
+     */
+    constructor(options) {
+        if (options.maxBackendEnvelopeBytes !== undefined &&
+            (!Number.isSafeInteger(options.maxBackendEnvelopeBytes) ||
+                options.maxBackendEnvelopeBytes < 1))
+            throw new RangeError("maxBackendEnvelopeBytes must be a positive safe integer.");
+        this.#kernel = new BackendMembershipKernel({
+            create: async (node, signal) => {
+                const client = await options.create(node, signal);
+                return {
+                    forward: (request) => client.forward(request),
+                    subscribe: (definition, childSignal) => client.subscribe({ kind: "public-subscription", bytes: definition.slice() }, childSignal),
+                    activate: (child, updates, childSignal) => client.activate({
+                        wire: { kind: "backend-subscription-envelope", bytes: child.bytes.slice() },
+                        updates,
+                    }, childSignal),
+                    dispose: (child, childSignal) => client.dispose({ kind: "backend-subscription-envelope", bytes: child.bytes.slice() }, childSignal),
+                    close: () => client.close(),
+                };
+            },
+            memberKey: (node) => node.id,
+            sameMember: (left, right) => left.endpoint === right.endpoint && left.tlsServerName === right.tlsServerName,
+            definitionKey: (definition) => DynamicUnaryForwarder.definitionKey(definition),
+            childDefinition: (definition, node) => DynamicUnaryForwarder.childDefinition(definition, node),
+            childSize: (child) => child.bytes.byteLength,
+            ...(options.maxConcurrentStarts === undefined
+                ? {}
+                : { maxConcurrentStarts: options.maxConcurrentStarts }),
+            ...(options.maxBackendEnvelopeBytes === undefined
+                ? {}
+                : { maxChildBytes: options.maxBackendEnvelopeBytes }),
+        });
+    }
+    /**
+     * Updates connected clients from a complete application-node snapshot.
+     *
+     * @param nodes Supplies the complete node snapshot.
+     * @returns Completion of client reconciliation.
+     */
+    reconcile(nodes) {
+        return this.#kernel.reconcile(nodes);
+    }
+    /**
+     * Returns a unary response from the selected backend client.
+     *
+     * @param request Supplies the request to forward.
+     * @returns The backend response bytes.
+     */
+    forward(request) {
+        return this.#kernel
+            .forward(request)
+            .catch((error) => DynamicUnaryForwarder.#gatewayError(error));
+    }
+    /**
+     * Closes all live backend clients.
+     *
+     * @returns Completion of backend cleanup.
+     */
+    close() {
+        return this.#kernel.close();
+    }
+    /**
+     * Creates backend children for one logical Gateway subscription.
+     *
+     * @param request Supplies the public subscription wire.
+     * @param signal Cancels child creation.
+     * @param maxBackendEnvelopeBytes Limits one backend envelope when supplied.
+     * @returns Completion of child creation.
+     */
+    subscribeDefinition(request, signal, maxBackendEnvelopeBytes) {
+        if (maxBackendEnvelopeBytes !== undefined &&
+            (!Number.isSafeInteger(maxBackendEnvelopeBytes) || maxBackendEnvelopeBytes < 1))
+            throw new RangeError("maxBackendEnvelopeBytes must be a positive safe integer.");
+        return this.#kernel
+            .subscribe(request.bytes, signal, maxBackendEnvelopeBytes)
+            .catch((error) => DynamicUnaryForwarder.#gatewayError(error));
+    }
+    /**
+     * Updates backend children for a retained Gateway subscription.
+     *
+     * @param request Supplies the retained public subscription wire.
+     * @param maxBackendEnvelopeBytes Limits one backend envelope when supplied.
+     * @returns Completion of child recreation.
+     */
+    async rehydrateDefinition(request, maxBackendEnvelopeBytes) {
+        if (maxBackendEnvelopeBytes !== undefined &&
+            (!Number.isSafeInteger(maxBackendEnvelopeBytes) || maxBackendEnvelopeBytes < 1))
+            throw new RangeError("maxBackendEnvelopeBytes must be a positive safe integer.");
+        await this.#kernel
+            .rehydrate(request.bytes, maxBackendEnvelopeBytes)
+            .catch((error) => DynamicUnaryForwarder.#gatewayError(error));
+    }
+    /**
+     * Activates backend update relay for one Gateway subscription.
+     *
+     * @param wire Supplies the public subscription wire.
+     * @param updates Receives relayed subscription updates.
+     * @param signal Cancels update relay.
+     * @returns Completion after cancellation.
+     */
+    activateDefinition(wire, updates, signal) {
+        return this.#kernel.activate(wire.bytes, updates, signal);
+    }
+    /**
+     * Cancels backend children for one Gateway subscription.
+     *
+     * @param wire Supplies the public subscription wire.
+     * @param signal Cancels child cleanup when supported.
+     * @returns Completion of child cleanup.
+     */
+    cancelDefinition(wire, signal) {
+        return this.#kernel.cancel(wire.bytes, signal);
+    }
+    /**
+     * Resolves when the supplied signal aborts.
+     *
+     * @param signal Supplies the signal to observe.
+     * @returns Completion after the signal aborts.
+     */
+    static waitForAbort(signal) {
+        return BackendMembershipKernel.waitForAbort(signal);
+    }
+    /**
+     * Returns the logical identifier encoded in public subscription bytes.
+     *
+     * @param bytes Supplies the public subscription bytes.
+     * @returns The logical identifier, when present.
+     */
+    static definitionKey(bytes) {
+        return fromBinary(SubscriptionSchema, bytes).id?.value;
+    }
+    /**
+     * Returns bytes with only the immediate child subscription identifier rewritten.
+     *
+     * @param bytes Supplies the parent subscription bytes.
+     * @param node Supplies the child application node.
+     * @returns The rewritten child subscription bytes.
+     */
+    static childDefinition(bytes, node) {
+        const subscription = clone(SubscriptionSchema, fromBinary(SubscriptionSchema, bytes));
+        const id = subscription.id?.value;
+        if (id === undefined || id.length === 0)
+            return bytes.slice();
+        const subscriptionId = subscription.id;
+        if (subscriptionId === undefined)
+            return bytes.slice();
+        subscriptionId.value = `${id}/${node.id}`;
+        return toBinary(SubscriptionSchema, subscription);
+    }
+    static #gatewayError(error) {
+        if (error instanceof Error && error.message === "backend membership is unavailable.")
+            throw new Error("Gateway backend is absent.");
+        if (error instanceof Error && error.message === "backend membership kernel is closed.")
+            throw new Error("Gateway dynamic owner is closed.");
+        throw error;
+    }
+}
+//# sourceMappingURL=dynamic-unary-forwarder.js.map

package/dist/gateway/dynamic-unary-forwarder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dynamic-unary-forwarder.js","sourceRoot":"","sources":["../../src/gateway/dynamic-unary-forwarder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,mEAAmE,CAAC;AAC5G,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAyDtE;;;GAGG;AACH,MAAM,OAAO,qBAAqB;IACvB,OAAO,CAKd;IAEF;;;;OAIG;IACH,YAAY,OAA4B;QACtC,IACE,OAAO,CAAC,uBAAuB,KAAK,SAAS;YAC7C,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,uBAAuB,CAAC;gBACrD,OAAO,CAAC,uBAAuB,GAAG,CAAC,CAAC;YAEtC,MAAM,IAAI,UAAU,CAAC,0DAA0D,CAAC,CAAC;QACnF,IAAI,CAAC,OAAO,GAAG,IAAI,uBAAuB,CAKxC;YACA,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;gBAC7B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAClD,OAAO;oBACL,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;oBAC7C,SAAS,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,EAAE,CACrC,MAAM,CAAC,SAAS,CACd,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,EAAE,EAC1D,WAAW,CACZ;oBACH,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CACxC,MAAM,CAAC,QAAQ,CACb;wBACE,IAAI,EAAE,EAAE,IAAI,EAAE,+BAA+B,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE;wBAC3E,OAAO;qBACR,EACD,WAAW,CACZ;oBACH,OAAO,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,CAC9B,MAAM,CAAC,OAAO,CACZ,EAAE,IAAI,EAAE,+BAA+B,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EACrE,WAAW,CACZ;oBACH,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE;iBAC5B,CAAC;YACJ,CAAC;YACD,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE;YAC5B,UAAU,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC1B,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa;YAChF,aAAa,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,qBAAqB,CAAC,aAAa,CAAC,UAAU,CAAC;YAC9E,eAAe,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,CACpC,qBAAqB,CAAC,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC;YACzD,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU;YAC5C,GAAG,CAAC,OAAO,CAAC,mBAAmB,KAAK,SAAS;gBAC3C,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,EAAE,CAAC;YACzD,GAAG,CAAC,OAAO,CAAC,uBAAuB,KAAK,SAAS;gBAC/C,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,uBAAuB,EAAE,CAAC;SACxD,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,KAAiC;QACzC,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAED;;;;;OAKG;IACH,OAAO,CAAC,OAAiD;QACvD,OAAO,IAAI,CAAC,OAAO;aAChB,OAAO,CAAC,OAAO,CAAC;aAChB,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,qBAAqB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED;;;;OAIG;IACH,KAAK;QACH,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED;;;;;;;OAOG;IACH,mBAAmB,CACjB,OAA+B,EAC/B,MAAmB,EACnB,uBAAgC;QAEhC,IACE,uBAAuB,KAAK,SAAS;YACrC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,uBAAuB,CAAC,IAAI,uBAAuB,GAAG,CAAC,CAAC;YAE/E,MAAM,IAAI,UAAU,CAAC,0DAA0D,CAAC,CAAC;QACnF,OAAO,IAAI,CAAC,OAAO;aAChB,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,uBAAuB,CAAC;aACzD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,qBAAqB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,mBAAmB,CACvB,OAA+B,EAC/B,uBAAgC;QAEhC,IACE,uBAAuB,KAAK,SAAS;YACrC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,uBAAuB,CAAC,IAAI,uBAAuB,GAAG,CAAC,CAAC;YAE/E,MAAM,IAAI,UAAU,CAAC,0DAA0D,CAAC,CAAC;QACnF,MAAM,IAAI,CAAC,OAAO;aACf,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,uBAAuB,CAAC;aACjD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,qBAAqB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED;;;;;;;OAOG;IACH,kBAAkB,CAChB,IAA4B,EAC5B,OAA+B,EAC/B,MAAmB;QAEnB,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,IAA4B,EAAE,MAAmB;QAChE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,YAAY,CAAC,MAAmB;QACrC,OAAO,uBAAuB,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACtD,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,aAAa,CAAC,KAAiB;QACpC,OAAO,UAAU,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC;IACzD,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,eAAe,CAAC,KAAiB,EAAE,IAAqB;QAC7D,MAAM,YAAY,GAAG,KAAK,CAAC,kBAAkB,EAAE,UAAU,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC,CAAC;QACtF,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC;QAClC,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,KAAK,EAAE,CAAC;QAC9D,MAAM,cAAc,GAAG,YAAY,CAAC,EAAE,CAAC;QACvC,IAAI,cAAc,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,KAAK,EAAE,CAAC;QACvD,cAAc,CAAC,KAAK,GAAG,GAAG,EAAE,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;QAC1C,OAAO,QAAQ,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,KAAc;QACjC,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,oCAAoC;YAClF,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,sCAAsC;YACpF,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,MAAM,KAAK,CAAC;IACd,CAAC;CACF"}

package/dist/gateway/index.d.ts

@@ -0,0 +1,164 @@
+import type { TypeRegistryLookup } from "@spine-event-engine/core";
+import type { AuthorizationPolicy, Clock, ContextResolver, RequestCredential, SessionResolver, TransportRequestContext } from "../index.js";
+/**
+ * Owned request bytes and canonical operation identity accepted by the B2 gateway.
+ */
+export interface UnaryGatewayRequest {
+    /**
+     * Identifies the requested gRPC service.
+     */
+    readonly service: string;
+    /**
+     * Identifies the requested gRPC method.
+     */
+    readonly method: string;
+    /**
+     * Holds the owned request bytes.
+     */
+    readonly value: Uint8Array;
+    /**
+     * Holds the credential resolved by the gateway.
+     */
+    readonly credential?: RequestCredential | undefined;
+    /**
+     * Holds the allowlisted request transport facts.
+     */
+    readonly transport: TransportRequestContext;
+    /**
+     * Downstream cancellation capability forwarded only to the admitted native effect.
+     */
+    readonly signal?: AbortSignal;
+}
+/**
+ * B4-mappable forwarding boundary; credentials and transport extras are never supplied.
+ */
+export interface UnaryForwarder {
+    /**
+     * Routes an authorized request to its backend service.
+     * @param request Holds the canonical request forwarded to the backend.
+     * @returns Resolves to the backend response bytes.
+     */
+    forward(request: {
+        readonly service: string;
+        readonly method: string;
+        readonly value: Uint8Array;
+        readonly signal?: AbortSignal;
+    }): Promise<Uint8Array>;
+}
+/**
+ * Selects exactly one Gateway admission mode.
+ *
+ * Supply `sessions` for authenticated requests, or `publicAccess: true` for a
+ * deliberately public Gateway. Admission establishes a principal only:
+ * `authorize` decides whether that principal may perform a decoded request,
+ * and `contexts` independently resolves its trusted actor and tenant context.
+ * The modes are mutually exclusive.
+ */
+export type GatewayAdmission = {
+    /**
+     * Resolves authenticated application sessions from incoming credentials.
+     */
+    readonly sessions: SessionResolver;
+    /**
+     * Excludes non-session public admission from authenticated mode.
+     */
+    readonly publicAccess?: never;
+} | {
+    /**
+     * Excludes session resolution from public mode.
+     */
+    readonly sessions?: never;
+    /**
+     * Admits requests under the framework-owned non-session public principal.
+     */
+    readonly publicAccess: true;
+};
+/**
+ * Common collaborators for every unary Gateway admission mode.
+ *
+ * Pair these with exactly one {@link GatewayAdmission} to form
+ * {@link UnaryGatewayOptions}.
+ */
+export interface UnaryGatewayCollaborators {
+    /**
+     * Fixed application registry used only to decode command content for policy and context collaborators.
+     */
+    readonly registry?: TypeRegistryLookup;
+    /**
+     * Limits the number of request bytes accepted by the gateway.
+     */
+    readonly maxRequestBytes: number;
+    /**
+     * Allows or rejects an admitted principal for each decoded request.
+     */
+    readonly authorize: AuthorizationPolicy["authorize"];
+    /**
+     * Independently resolves trusted actor and tenant context after authorization.
+     */
+    readonly contexts: ContextResolver;
+    /**
+     * Provides trusted timestamps for context resolution.
+     */
+    readonly clock: Clock;
+    /**
+     * Forwards authorized bytes to the backend service.
+     */
+    readonly forward: UnaryForwarder["forward"];
+}
+/**
+ * Gateway collaborators, one admission mode, and a finite byte ownership limit.
+ */
+export type UnaryGatewayOptions = UnaryGatewayCollaborators & GatewayAdmission;
+/**
+ * Transport-neutral B4-mappable rejection reasons.
+ */
+export type UnaryGatewayRejection = "request-too-large" | "unknown-operation" | "malformed-request" | "unauthenticated" | "forbidden" | "context-stale";
+/**
+ * Forwarded/resolved bytes or a B4-mappable rejection.
+ */
+export type UnaryGatewayResult = {
+    /**
+     * Identifies a backend-forwarded result.
+     */
+    readonly kind: "forwarded";
+    /**
+     * Holds the backend response bytes.
+     */
+    readonly value: Uint8Array;
+} | {
+    /**
+     * Identifies a resolved trusted-context result.
+     */
+    readonly kind: "resolved";
+    /**
+     * Holds the encoded trusted context.
+     */
+    readonly value: Uint8Array;
+} | {
+    /**
+     * Identifies a rejected request.
+     */
+    readonly kind: "rejected";
+    /**
+     * Explains why the request was rejected.
+     */
+    readonly reason: UnaryGatewayRejection;
+};
+/**
+ * Transport-neutral B2 unary admission and context-replacement pipeline.
+ */
+export declare class UnaryGateway {
+    #private;
+    /**
+     * Creates a unary admission gateway.
+     * @param options Configures admission, authorization, context, and forwarding collaborators.
+     */
+    constructor(options: UnaryGatewayOptions);
+    /**
+     * Handles one admitted unary request.
+     * @param request Supplies owned request bytes, credential, and transport facts.
+     * @returns Resolves to forwarded bytes, a trusted context, or a rejection.
+     */
+    handle(request: UnaryGatewayRequest): Promise<UnaryGatewayResult>;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/gateway/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/gateway/index.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAEV,mBAAmB,EACnB,KAAK,EACL,eAAe,EAGf,iBAAiB,EACjB,eAAe,EACf,uBAAuB,EACxB,MAAM,aAAa,CAAC;AAGrB;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAGlC;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAE3B;;OAEG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;IAEpD;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;IAE5C;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAG7B;;;;OAIG;IACH,OAAO,CAAC,OAAO,EAAE;QACf,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;QAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;KAC/B,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CACzB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAGE;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IAEnC;;OAEG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC;CAC/B,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC;CAC7B,CAAC;AAEN;;;;;GAKG;AACH,MAAM,WAAW,yBAAyB;IAGxC;;OAEG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAEvC;;OAEG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IAEjC;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAErD;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IAEnC;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IAEtB;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC;CAC7C;AAED;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,yBAAyB,GAAG,gBAAgB,CAAC;AAE/E;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAC7B,mBAAmB,GACnB,mBAAmB,GACnB,mBAAmB,GACnB,iBAAiB,GACjB,WAAW,GACX,eAAe,CAAC;AAEpB;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAE3B;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;CACxC,CAAC;AAoBN;;GAEG;AACH,qBAAa,YAAY;;IAGvB;;;OAGG;gBACS,OAAO,EAAE,mBAAmB;IAQxC;;;;OAIG;IACG,MAAM,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC;CAwFxE"}