@stigmer/server 3.14.0-dev.20260910084630

package/dist/pipeline/interceptors/auth.js

@@ -0,0 +1,371 @@
+/**
+ * Identity chassis — chain position 1, outermost (reserved by DD-004;
+ * filled by O2, 20260827.01, per DD-007 §1). Every request enters the
+ * server through exactly one of the two identity sources this module
+ * owns, and every request leaves position 1 with a CallerIdentity stashed
+ * under `callerIdentityKey`:
+ *
+ *   - createVerifierChainInterceptor — the serving chain's source: an
+ *     ordered claim-or-pass walk over the composed IdentityVerifiers (the
+ *     TS rendering of the Java ProviderManager chain), followed by the
+ *     composed CallerGuards over the stamped identity (entry 20260902.02
+ *     ruling Q1 — see extensions/caller-guards.ts for the contract and
+ *     its doctrine).
+ *   - createInProcessCallerInterceptor — the in-process router
+ *     transport's source: stamps the `internal` caller class (ruling Q4,
+ *     the TS rendering of the Java in-process authorization skip). It
+ *     takes NO guards — the in-process exemption is structural
+ *     (caller-guards.ts), not a runtime skip.
+ *
+ * The serving source's inner walk, authenticateBearerToken, is ALSO
+ * exported on its own (stigmer#991): a composition's extension-owned HTTP
+ * lanes are not Connect requests, so they cannot ride the interceptor, but
+ * they must authenticate with the same chain — one walk, two edges.
+ *
+ * The internal class is mintable ONLY here, only by the in-process
+ * interceptor: the serving chain always overwrites the position-1 value
+ * from the wire, contextValues never cross a transport, and no
+ * IdentityVerifier may produce the class (contract on CallerClass).
+ * Spoofing is structurally impossible, not policed.
+ *
+ * # Conditional strictness (ruling Q6 — pinned contract)
+ *
+ * Strictness is a function of whether any verifier is configured:
+ *
+ *   - ZERO verifiers (every shipped OSS composition today): a presented
+ *     token that nothing claims falls through SILENTLY to the
+ *     trusted-local identity. This preserves wire behavior byte-for-byte
+ *     — the runner presents a Bearer token on every control-plane RPC
+ *     when STIGMER_TOKEN is set, and domains that verify tokens (the
+ *     executioncontext decrypt lane) read the raw header themselves.
+ *   - ONE OR MORE verifiers: a presented-but-unclaimed token is
+ *     UNAUTHENTICATED. A configured issuer must never silently admit
+ *     garbage tokens as trusted-local.
+ *   - An ABSENT token falls to trusted-local UNLESS the composition asks
+ *     for the require-authentication posture (O3 rulings Q1+Q2,
+ *     20260827.06): with requireAuthentication on — compose.ts sets it
+ *     when STIGMER_OIDC_ISSUER is configured OR when a composed extension
+ *     unit declares `requireAuthentication` (entry 20260904.02, the
+ *     cloud's ask: its own lanes resolve its users, and the issuer knob
+ *     cannot stand in because it also registers the OSS OIDC verifier
+ *     ahead of them; the OSS API-key lane, by contrast, rides EITHER
+ *     posture source — stigmer#984) — a tokenless request is
+ *     UNAUTHENTICATED "authentication token missing" (the Java
+ *     interceptor's byte-pinned copy), EXCEPT where isAuthenticationExempt
+ *     says so: is_public-marked methods (the Java isPublic skip) and the
+ *     gRPC health service by name (the Java by-name skip — a third-party
+ *     proto cannot carry our option, and a Kubernetes `grpc:` probe is a
+ *     tokenless Health/Check; without this arm the posture crash-loops the
+ *     pod, stigmer#974). Extension-only verifier sets that declare
+ *     nothing keep the fall-to-trusted-local arm: strictness against
+ *     PRESENTED tokens is a function of verifier count (Q6); strictness
+ *     against ABSENT tokens is the composition's explicit ask.
+ *
+ * # Trusted-local identity (the explicit modeled state)
+ *
+ * No issuer + no claim = the single-operator trust domain's one
+ * principal, minted from the #400 operator seam (steps/defaults.ts):
+ * identityId is the operator email (email-first, matching the audit
+ * doctrine there), or "system" when unconfigured. The audit-actor seam
+ * derives from this identity the exact bytes currentAuditActor stamped
+ * before O2.
+ *
+ * # Verifier faults
+ *
+ * A verifier that throws a ConnectError chose its wire shape (signature/
+ * expiry/audience failures are UNAUTHENTICATED by the verifier's own
+ * mapping); any other throw is an infrastructure fault — INTERNAL, never
+ * softened into an auth denial (the DD-007 unavailable doctrine, applied
+ * to the verification side).
+ */
+import { Code, ConnectError, createContextKey } from "@connectrpc/connect";
+import { getOption } from "@bufbuild/protobuf";
+import { is_public } from "@stigmer/protos/ai/stigmer/commons/rpc/method_options_pb";
+import { internalError } from "../errors.js";
+import { operatorIdentitySnapshot } from "../steps/defaults.js";
+/**
+ * The tokenless-request refusal under the require-authentication posture —
+ * the Java interceptor's copy (GrpcSecurityConfigBase), byte-pinned.
+ */
+export const AUTHENTICATION_TOKEN_MISSING_MESSAGE = "authentication token missing";
+/**
+ * Services reachable WITHOUT a credential under the require-authentication
+ * posture, by fully-qualified service name — the Java interceptor's
+ * by-name skip list (GrpcSecurityConfigBase), for services whose protos
+ * are not ours and so cannot carry the `is_public` method option. The
+ * standard gRPC health service is the one entry OSS serves: Kubernetes
+ * `grpc:` probes call Health/Check tokenless, and a refused probe is a
+ * pod that never becomes Ready (stigmer#974). Java's second entry,
+ * `grpc.reflection.v1alpha.ServerReflection`, is deliberately absent —
+ * OSS registers no reflection service; a future registration joins this
+ * set in the same change, or the posture refuses it.
+ */
+export const AUTHENTICATION_EXEMPT_SERVICES = new Set([
+    "grpc.health.v1.Health",
+]);
+/**
+ * Whether a method stays reachable tokenless under the
+ * require-authentication posture: `is_public` on the method (our protos)
+ * or an exempt service by name (third-party protos). The ONE predicate
+ * the refusal arm consults, so both exemption doctrines read as a single
+ * decision and are pinned together.
+ */
+export function isAuthenticationExempt(method) {
+    return (getOption(method, is_public) ||
+        AUTHENTICATION_EXEMPT_SERVICES.has(method.parent.typeName));
+}
+/**
+ * Context key for the request's caller identity. The default is
+ * `undefined` so a read BEFORE position 1 has stamped (a wiring bug — both
+ * chains stamp unconditionally) is loud through callerIdentityOf, never a
+ * silent placeholder principal.
+ */
+export const callerIdentityKey = createContextKey(undefined, { description: "caller identity produced at chain position 1" });
+/**
+ * The request's caller identity — the ONE read idiom for controllers
+ * (threaded into RequestContext exactly once, ruling Q3). Throws the
+ * composition-root wiring fault when position 1 did not stamp: that state
+ * is unreachable through either chain, so reaching it means a transport
+ * was built without an identity source.
+ */
+export function callerIdentityOf(ctx) {
+    const identity = ctx.values.get(callerIdentityKey);
+    if (identity === undefined) {
+        throw internalError(new Error("no caller identity in context (chain wiring bug)"), "internal server error");
+    }
+    return identity;
+}
+/**
+ * The trusted-local single-user identity — the explicit modeled state for
+ * "no verifier claimed this request". Read per request (not cached at
+ * chain build) so composeServer stays re-entrant for tests while the
+ * operator seam remains process-global.
+ */
+export function trustedLocalIdentity() {
+    const operator = operatorIdentitySnapshot();
+    if (operator.email === "") {
+        return {
+            identityId: "system",
+            callerClass: "user",
+            issuer: "",
+            rawToken: "",
+        };
+    }
+    return {
+        identityId: operator.email,
+        callerClass: "user",
+        issuer: "",
+        rawToken: "",
+        email: operator.email,
+        displayName: operator.displayName,
+    };
+}
+/**
+ * The serving chain's position-1 identity source: walks the composed
+ * verifiers in order (OSS entries first, extension entries after, in
+ * extension-unit order — registry contract), stamps the claimed identity
+ * or the trusted-local fallback per the strictness contract above, then
+ * runs the composed caller guards over the stamped identity (entry
+ * 20260902.02 ruling Q1). Covers unary AND streams — identity is
+ * per-request state, not a unary-pipeline concern like the apiresource
+ * kind.
+ *
+ * `guards` is REQUIRED, like the identity source on buildInterceptorChain:
+ * a serving transport that forgets its guards must be a compile error,
+ * never a silently unenforced edge — the exact failure class this seam
+ * exists to close (the cloud's platform-client controls went unported
+ * through five green readouts because nothing forced them).
+ */
+export function createVerifierChainInterceptor(verifiers, guards, logger, requireAuthentication = false) {
+    return (next) => async (request) => {
+        // The in-process propagation header is meaningless — and forgeable —
+        // on the wire: stripped unconditionally before anything downstream
+        // could read it (ruling R5's unspoofability-by-construction arm).
+        request.header.delete(IN_PROCESS_CALLER_HEADER);
+        const token = parseBearerToken(request.header.get("authorization") ?? "");
+        let identity;
+        if (token !== "") {
+            identity = await authenticateBearerToken(verifiers, token, logger);
+            if (identity === undefined && verifiers.length > 0) {
+                // Position 1 is outside the logging interceptor, so the rejection
+                // is recorded here (the wire carries only the sanitized copy).
+                logger.warn("presented token not claimed by any identity verifier", {
+                    verifiers: verifiers.map((v) => v.name).join(", "),
+                });
+                throw new ConnectError("the presented token was not accepted by any configured identity verifier", Code.Unauthenticated);
+            }
+        }
+        else if (requireAuthentication &&
+            !isAuthenticationExempt(request.method)) {
+            // Rulings Q1+Q2: the auth-enabled posture requires a credential on
+            // every non-exempt method — the Java interceptor's exact behavior
+            // and copy. is_public methods and the health service stay reachable
+            // tokenless (the Java isPublic and by-name skips), so the console's
+            // anonymous reads and the pod's probes survive.
+            throw new ConnectError(AUTHENTICATION_TOKEN_MISSING_MESSAGE, Code.Unauthenticated);
+        }
+        const stamped = identity ?? trustedLocalIdentity();
+        request.contextValues.set(callerIdentityKey, stamped);
+        await runCallerGuards(guards, stamped, request, logger);
+        return next(request);
+    };
+}
+/**
+ * The composed-order guard walk (caller-guards.ts contract): every guard
+ * runs against the FINAL stamped identity; the first throw wins. A
+ * ConnectError is the guard's own wire mapping; any other throw is an
+ * infrastructure fault (INTERNAL — a store outage during a liveness read
+ * must never read as an admission refusal). Both arms are recorded here:
+ * position 1 sits outside the logging interceptor, so this is a guard
+ * outcome's only operator record (the verifier-rejection precedent
+ * above).
+ */
+async function runCallerGuards(guards, caller, request, logger) {
+    for (const guard of guards) {
+        try {
+            await guard.guard(caller, request.method, request.header);
+        }
+        catch (error) {
+            const procedure = `/${request.service.typeName}/${request.method.name}`;
+            if (error instanceof ConnectError) {
+                logger.warn("caller guard refused the request", {
+                    guard: guard.name,
+                    procedure,
+                    code: Code[error.code],
+                });
+                throw error;
+            }
+            logger.error("caller guard failed", {
+                guard: guard.name,
+                procedure,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            throw internalError(error, "internal server error");
+        }
+    }
+}
+/**
+ * The caller-propagation header of the in-process lane (C2 Stage 3,
+ * ruling R5). Client CallOptions carry no contextValues across the
+ * router transport, so the asCaller adapters (boot/inprocess.ts) ride
+ * the one channel that does cross it: a request header, base64url JSON.
+ * Unspoofable from the wire BY CONSTRUCTION: the serving chassis strips
+ * it before anything can read it, and only the in-process interceptor —
+ * reachable only by server code — honors it.
+ */
+export const IN_PROCESS_CALLER_HEADER = "x-stigmer-inprocess-caller";
+/** Encodes a CallerIdentity for the propagation header. */
+export function encodeInProcessCaller(caller) {
+    return Buffer.from(JSON.stringify(caller)).toString("base64url");
+}
+/**
+ * The in-process transport's position-1 identity source. Two arms since
+ * C2 Stage 3 (ruling R5 — the caller-propagation amendment restoring the
+ * Java posture, where in-process calls carried the ORIGINAL caller):
+ *
+ *   - PROPAGATED: a request-origin adapter passed the original caller's
+ *     identity through {@link IN_PROCESS_CALLER_HEADER} (the asCaller
+ *     edges) — it forwards with `origin: "in-process"` stamped, so
+ *     attribution (owner/creator tuples, audit) lands on the real user
+ *     while transport-trust arms (the reserved-label guard) still see
+ *     the server-composed origin.
+ *   - MINTED: no propagated identity — the daemon-origin default (the
+ *     schedule clock, the project reconciler): the internal caller class
+ *     carrying the operator's identity fields, so audit stamps on
+ *     daemon writes stay byte-identical to the pre-R5 posture. The
+ *     Authorize step treats the internal class as the in-process
+ *     authorization skip (ruling Q4).
+ *
+ * A malformed propagation header is a WIRING BUG (only server code can
+ * write it) — loud INTERNAL, never a silent fall-through to a wrong
+ * identity.
+ */
+export function createInProcessCallerInterceptor() {
+    return (next) => (request) => {
+        const encoded = request.header.get(IN_PROCESS_CALLER_HEADER);
+        let identity;
+        if (encoded !== null) {
+            request.header.delete(IN_PROCESS_CALLER_HEADER);
+            try {
+                identity = {
+                    ...JSON.parse(Buffer.from(encoded, "base64url").toString("utf8")),
+                    origin: "in-process",
+                };
+            }
+            catch (error) {
+                throw internalError(error instanceof Error ? error : new Error(String(error)), "internal server error");
+            }
+        }
+        else {
+            identity = {
+                ...trustedLocalIdentity(),
+                callerClass: "internal",
+                origin: "in-process",
+            };
+        }
+        request.contextValues.set(callerIdentityKey, identity);
+        return next(request);
+    };
+}
+/**
+ * The claim-or-pass walk (identity.ts contract): a claim wins, null moves
+ * to the next verifier, a ConnectError throw is the verifier's own wire
+ * mapping, any other throw is an infrastructure fault (INTERNAL — a JWKS
+ * outage must never read as a credential rejection). `undefined` means no
+ * verifier claimed the token — the CALLER decides what that means
+ * (the serving interceptor applies the Q6 strictness contract above).
+ *
+ * Exported (stigmer#991) so a composition's extension-owned HTTP lanes —
+ * edges that are not Connect requests and so never pass through
+ * createVerifierChainInterceptor — authenticate a presented bearer with
+ * the SAME composed chain, in the same order, under the same fault
+ * doctrine. The alternative, a composition re-instantiating its verifier
+ * list at the HTTP edge, is a second copy of chain order and fault
+ * mapping — exactly the drift DD-007's "one chain" rules out. This is the
+ * identity walk ONLY: caller guards (caller-guards.ts) are RPC-shaped by
+ * contract and stay the serving interceptor's; an HTTP edge that wants
+ * them is a contract widening, not a call site.
+ */
+export async function authenticateBearerToken(verifiers, token, logger) {
+    for (const verifier of verifiers) {
+        let claimed;
+        try {
+            claimed = await verifier.verify(token);
+        }
+        catch (error) {
+            if (error instanceof ConnectError) {
+                throw error;
+            }
+            logger.error("identity verifier failed", {
+                verifier: verifier.name,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            throw internalError(error, "internal server error");
+        }
+        if (claimed !== null) {
+            return claimed;
+        }
+    }
+    return undefined;
+}
+/**
+ * The Bearer credential from a (possibly comma-joined) authorization
+ * header value; empty when absent or differently shaped. One shared
+ * definition of the shape both consumers use (this chassis and the
+ * executioncontext decrypt lane): case-insensitive "bearer " prefix, the
+ * remainder non-empty before trimming. Node's http2 layer joins repeated
+ * headers with ", " — the first comma segment IS the first value, and a
+ * genuine token (base64url segments joined by dots) can never contain a
+ * comma, so the split is lossless for every legitimate shape (the Go
+ * server read metadata values[0], same result).
+ */
+export function parseBearerToken(joinedHeaderValue) {
+    const header = joinedHeaderValue.split(",")[0] ?? "";
+    const prefix = "bearer ";
+    if (header.length <= prefix.length ||
+        header.slice(0, prefix.length).toLowerCase() !== prefix) {
+        return "";
+    }
+    return header.slice(prefix.length).trim();
+}
+//# sourceMappingURL=auth.js.map

package/dist/pipeline/interceptors/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/pipeline/interceptors/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+EG;AACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAO3E,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAG/C,OAAO,EAAE,SAAS,EAAE,MAAM,0DAA0D,CAAC;AAQrF,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAEhE;;;GAGG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAC/C,8BAA8B,CAAC;AAEjC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAwB,IAAI,GAAG,CAAC;IACzE,uBAAuB;CACxB,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAkB;IACvD,OAAO,CACL,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC;QAC5B,8BAA8B,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAC3D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,gBAAgB,CAC/C,SAAS,EACT,EAAE,WAAW,EAAE,8CAA8C,EAAE,CAChE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAmB;IAClD,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACnD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,aAAa,CACjB,IAAI,KAAK,CAAC,kDAAkD,CAAC,EAC7D,uBAAuB,CACxB,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;IAC5C,IAAI,QAAQ,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;QAC1B,OAAO;YACL,UAAU,EAAE,QAAQ;YACpB,WAAW,EAAE,MAAM;YACnB,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IACD,OAAO;QACL,UAAU,EAAE,QAAQ,CAAC,KAAK;QAC1B,WAAW,EAAE,MAAM;QACnB,MAAM,EAAE,EAAE;QACV,QAAQ,EAAE,EAAE;QACZ,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,WAAW,EAAE,QAAQ,CAAC,WAAW;KAClC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,8BAA8B,CAC5C,SAA0C,EAC1C,MAAkC,EAClC,MAAc,EACd,qBAAqB,GAAG,KAAK;IAE7B,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACjC,qEAAqE;QACrE,mEAAmE;QACnE,kEAAkE;QAClE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,IAAI,QAAoC,CAAC;QACzC,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACjB,QAAQ,GAAG,MAAM,uBAAuB,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YACnE,IAAI,QAAQ,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnD,kEAAkE;gBAClE,+DAA+D;gBAC/D,MAAM,CAAC,IAAI,CAAC,sDAAsD,EAAE;oBAClE,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;iBACnD,CAAC,CAAC;gBACH,MAAM,IAAI,YAAY,CACpB,0EAA0E,EAC1E,IAAI,CAAC,eAAe,CACrB,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,IACL,qBAAqB;YACrB,CAAC,sBAAsB,CAAC,OAAO,CAAC,MAAM,CAAC,EACvC,CAAC;YACD,mEAAmE;YACnE,kEAAkE;YAClE,oEAAoE;YACpE,oEAAoE;YACpE,gDAAgD;YAChD,MAAM,IAAI,YAAY,CACpB,oCAAoC,EACpC,IAAI,CAAC,eAAe,CACrB,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,IAAI,oBAAoB,EAAE,CAAC;QACnD,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;QACtD,MAAM,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,eAAe,CAC5B,MAAkC,EAClC,MAAsB,EACtB,OAAqC,EACrC,MAAc;IAEd,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,SAAS,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACxE,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;gBAClC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;oBAC9C,KAAK,EAAE,KAAK,CAAC,IAAI;oBACjB,SAAS;oBACT,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;iBACvB,CAAC,CAAC;gBACH,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE;gBAClC,KAAK,EAAE,KAAK,CAAC,IAAI;gBACjB,SAAS;gBACT,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,MAAM,aAAa,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,4BAA4B,CAAC;AAErE,2DAA2D;AAC3D,MAAM,UAAU,qBAAqB,CAAC,MAAsB;IAC1D,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,gCAAgC;IAC9C,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE;QAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QAC7D,IAAI,QAAwB,CAAC;QAC7B,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;YAChD,IAAI,CAAC;gBACH,QAAQ,GAAG;oBACT,GAAI,IAAI,CAAC,KAAK,CACZ,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAChC;oBACpB,MAAM,EAAE,YAAY;iBACrB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,aAAa,CACjB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EACzD,uBAAuB,CACxB,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG;gBACT,GAAG,oBAAoB,EAAE;gBACzB,WAAW,EAAE,UAAU;gBACvB,MAAM,EAAE,YAAY;aACrB,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,SAA0C,EAC1C,KAAa,EACb,MAAc;IAEd,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,OAA8B,CAAC;QACnC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;gBAClC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE;gBACvC,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,MAAM,aAAa,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,iBAAyB;IACxD,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,MAAM,GAAG,SAAS,CAAC;IACzB,IACE,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM;QAC9B,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,EACvD,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;AAC5C,CAAC"}

package/dist/pipeline/interceptors/error-boundary.d.ts

@@ -0,0 +1,48 @@
+import type { Interceptor } from "@connectrpc/connect";
+import type { DescMethod } from "@bufbuild/protobuf";
+import type { Logger } from "../../boot/logger.js";
+import type { CallerIdentity } from "../../extensions/identity.js";
+/**
+ * The visitor-sanitization policy a composition registers through
+ * ExtensionDrivers.visitorErrorPolicy (single-instance point). The
+ * boundary owns the mechanism — the code set, code preservation, the
+ * ref format, details/metadata dropping, the boundary WARN; the policy
+ * owns the edition semantics — WHO is on the anonymous surface and WHAT
+ * copy replaces the description.
+ */
+export interface VisitorErrorPolicy {
+    /**
+     * Whether this caller+method pair is on the anonymous surface (the
+     * cloud rule: guest or channel caller class, or an is_public method).
+     * Synchronous and cheap — it runs on every boundary error. `identity`
+     * is undefined when the error rose from position 1 before stamping
+     * (the Java "no interceptor context" arm — an is_public rule must
+     * still answer there). A throw is treated as eligible: over-sanitizing
+     * an org member's diagnostics is recoverable, leaking internals to a
+     * visitor is not.
+     */
+    eligible(identity: CallerIdentity | undefined, method: DescMethod): boolean;
+    /**
+     * The replacement description (WITHOUT the support ref — the boundary
+     * appends it). Runs only on the error path, so per-call resolution
+     * work (the cloud's per-share owner copy) is admissible. A rejection
+     * falls back to the pipeline's sanitized-Internal copy — never the
+     * original description.
+     */
+    replacementCopy(identity: CallerIdentity | undefined, method: DescMethod): Promise<string>;
+}
+/**
+ * The Java supportRef format, byte-pinned (gate ruling Q3):
+ * `" (ref: <8 hex chars>)"`. Java derives the ref from the first 8 of
+ * the trace id; the TS serving path has no trace id, so the boundary
+ * mints one on the error path and the boundary WARN is the correlation
+ * point.
+ */
+export declare function supportRefSuffix(ref: string): string;
+/**
+ * Builds the boundary for the serving chain. `policy` is the composed
+ * VisitorErrorPolicy or undefined (the OSS default) — arm 1 runs either
+ * way, arm 2 only with a policy.
+ */
+export declare function createErrorBoundaryInterceptor(logger: Logger, policy?: VisitorErrorPolicy): Interceptor;
+//# sourceMappingURL=error-boundary.d.ts.map

package/dist/pipeline/interceptors/error-boundary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-boundary.d.ts","sourceRoot":"","sources":["../../../src/pipeline/interceptors/error-boundary.ts"],"names":[],"mappings":"AAkDA,OAAO,KAAK,EACV,WAAW,EAGZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAsBnE;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;;;;;;OASG;IACH,QAAQ,CAAC,QAAQ,EAAE,cAAc,GAAG,SAAS,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC;IAC5E;;;;;;OAMG;IACH,eAAe,CACb,QAAQ,EAAE,cAAc,GAAG,SAAS,EACpC,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,MAAM,CAAC,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEpD;AAMD;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,kBAAkB,GAC1B,WAAW,CAgBb"}

package/dist/pipeline/interceptors/error-boundary.js

@@ -0,0 +1,185 @@
+/**
+ * Error-boundary interceptor — the serving chain's position 0, the TS
+ * port of the cloud Java VisitorErrorSanitizerInterceptor posture (cloud
+ * DD-005 of 20260810.02, shipped for stigmer-cloud#242; ported by
+ * convergence entry 20260830.03.sp.visitor-error-sanitizer, all six gate
+ * rulings as recommended).
+ *
+ * Two arms, one structural guarantee each:
+ *
+ *   1. RAW-ERROR CONVERSION (always on, gate ruling Q2): a non-ConnectError
+ *      escaping any handler — the direct handlers whose internalError
+ *      wrapping is per-site discipline, not structure — becomes the
+ *      pipeline executor's exact sanitized Internal
+ *      ("internal server error") instead of connect-node's default
+ *      Unknown-with-raw-message conversion. This closes the
+ *      leak-by-default class for direct handlers the way
+ *      pipeline.ts closes it for chains (stigmer#478's sibling). The
+ *      guidelines' self-sanitize discipline still applies — a handler's
+ *      own "failed to <do thing>" copy beats this generic net.
+ *
+ *   2. VISITOR SANITIZATION (policy-driven, empty by default): when a
+ *      composition registers a VisitorErrorPolicy, descriptions of the
+ *      six leak-prone codes are rewritten for callers the policy deems
+ *      on the anonymous surface (the cloud: guest / channel / is_public),
+ *      the code ALWAYS preserved so SDK retry semantics stay honest, a
+ *      minted support ref appended in the Java byte-pinned format, and
+ *      the original description kept operator-visible via the boundary
+ *      WARN (log-based correlation — the TS serving path has no OTel
+ *      span to stamp, gate ruling Q3). The sanitized error is a FRESH
+ *      ConnectError: details and metadata never survive sanitization
+ *      (the Java trailers-drop, and rethrownStatusError's metadata
+ *      lesson).
+ *
+ * Placement contract: OUTERMOST on the SERVING chain only (chain.ts).
+ * Outermost keeps the Java pin "sanitizes even with no identity context"
+ * (identity is read from contextValues at error time — stamped by
+ * position 1 when the error rose from inside it, absent when position 1
+ * itself refused) and covers identity-chassis faults; the logging
+ * interceptor sits inside, so operators keep the ORIGINAL error at error
+ * level while the wire carries the rewrite. The in-process chain never
+ * composes this interceptor — in-process hops are exempt by
+ * construction (the outer handler needs the full inner diagnostic), the
+ * TS rendering of the Java InProcessCallContextHolder exemption.
+ *
+ * Streams: mid-iteration errors bypass a plain `await next(request)`
+ * wrapper, so stream responses are re-wrapped with a guarded iterable —
+ * without it, server-stream errors would escape both arms.
+ */
+import { randomBytes } from "node:crypto";
+import { Code, ConnectError } from "@connectrpc/connect";
+import { internalError } from "../errors.js";
+import { INTERNAL_FALLBACK_MESSAGE } from "../pipeline.js";
+import { callerIdentityKey } from "./auth.js";
+/**
+ * The codes whose descriptions may carry internals — the deny-leaky
+ * matrix ratified by cloud DD-005 (20260810.02) and byte-pinned across
+ * editions. Deliberate-refusal codes (PermissionDenied,
+ * FailedPrecondition, ResourceExhausted, …) pass through untouched:
+ * their descriptions are authored copy, including owner-customized
+ * refusal messages and machine tokens brokers branch on.
+ */
+const SANITIZED_CODES = new Set([
+    Code.Internal,
+    Code.Unknown,
+    Code.DataLoss,
+    Code.Unavailable,
+    Code.DeadlineExceeded,
+    Code.Unimplemented,
+]);
+/**
+ * The Java supportRef format, byte-pinned (gate ruling Q3):
+ * `" (ref: <8 hex chars>)"`. Java derives the ref from the first 8 of
+ * the trace id; the TS serving path has no trace id, so the boundary
+ * mints one on the error path and the boundary WARN is the correlation
+ * point.
+ */
+export function supportRefSuffix(ref) {
+    return ` (ref: ${ref})`;
+}
+function mintSupportRef() {
+    return randomBytes(4).toString("hex");
+}
+/**
+ * Builds the boundary for the serving chain. `policy` is the composed
+ * VisitorErrorPolicy or undefined (the OSS default) — arm 1 runs either
+ * way, arm 2 only with a policy.
+ */
+export function createErrorBoundaryInterceptor(logger, policy) {
+    return (next) => async (request) => {
+        let response;
+        try {
+            response = await next(request);
+        }
+        catch (error) {
+            throw await boundaryError(error, request, logger, policy);
+        }
+        if (response.stream) {
+            return {
+                ...response,
+                message: guardStreamMessages(response.message, request, logger, policy),
+            };
+        }
+        return response;
+    };
+}
+/** Re-raises mid-stream errors through the same two boundary arms. */
+async function* guardStreamMessages(messages, request, logger, policy) {
+    try {
+        yield* messages;
+    }
+    catch (error) {
+        throw await boundaryError(error, request, logger, policy);
+    }
+}
+async function boundaryError(error, request, logger, policy) {
+    const procedure = `/${request.service.typeName}/${request.method.name}`;
+    // Arm 1: the structural raw-error conversion (Q2). The logging
+    // interceptor inside already recorded unary failures; this line is the
+    // only record for mid-stream and identity-chassis raws, and it names
+    // the conversion the operator would otherwise not know happened.
+    let connectError;
+    if (error instanceof ConnectError) {
+        connectError = error;
+    }
+    else {
+        logger.error("unhandled non-ConnectError at the transport boundary", {
+            procedure,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        connectError = internalError(error, INTERNAL_FALLBACK_MESSAGE);
+    }
+    // Arm 2: the visitor rewrite — only with a composed policy, only on
+    // the leak-prone codes.
+    if (policy === undefined || !SANITIZED_CODES.has(connectError.code)) {
+        return connectError;
+    }
+    const identity = request.contextValues.get(callerIdentityKey);
+    let eligible;
+    try {
+        eligible = policy.eligible(identity, request.method);
+    }
+    catch (policyFault) {
+        // Fail toward sanitizing: the recoverable direction (see the
+        // contract's eligible() doc).
+        logger.error("visitor error policy eligibility check threw", {
+            procedure,
+            error: policyFault instanceof Error
+                ? policyFault.message
+                : String(policyFault),
+        });
+        eligible = true;
+    }
+    if (!eligible) {
+        return connectError;
+    }
+    let copy;
+    try {
+        copy = await policy.replacementCopy(identity, request.method);
+    }
+    catch (policyFault) {
+        logger.warn("visitor error copy resolution failed, using fallback", {
+            procedure,
+            error: policyFault instanceof Error
+                ? policyFault.message
+                : String(policyFault),
+        });
+        copy = INTERNAL_FALLBACK_MESSAGE;
+    }
+    const ref = mintSupportRef();
+    // The correlation point (Q3): the visitor holds the ref, this line
+    // holds the original description — the log-based rendering of the
+    // Java span attribute + boundary WARN pair.
+    logger.warn("sanitized a visitor-facing error", {
+        procedure,
+        code: Code[connectError.code],
+        callerClass: identity?.callerClass ?? "(unstamped)",
+        ref,
+        error: connectError.rawMessage,
+    });
+    // A FRESH error: same code (never changed — SDK retry semantics stay
+    // honest), rewritten description + ref, and NO inherited details or
+    // metadata (the Java trailers-drop; rethrownStatusError's lesson).
+    return new ConnectError(copy + supportRefSuffix(ref), connectError.code);
+}
+//# sourceMappingURL=error-boundary.js.map

package/dist/pipeline/interceptors/error-boundary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-boundary.js","sourceRoot":"","sources":["../../../src/pipeline/interceptors/error-boundary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAUzD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C;;;;;;;GAOG;AACH,MAAM,eAAe,GAAsB,IAAI,GAAG,CAAC;IACjD,IAAI,CAAC,QAAQ;IACb,IAAI,CAAC,OAAO;IACZ,IAAI,CAAC,QAAQ;IACb,IAAI,CAAC,WAAW;IAChB,IAAI,CAAC,gBAAgB;IACrB,IAAI,CAAC,aAAa;CACnB,CAAC,CAAC;AAmCH;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,OAAO,UAAU,GAAG,GAAG,CAAC;AAC1B,CAAC;AAED,SAAS,cAAc;IACrB,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAC5C,MAAc,EACd,MAA2B;IAE3B,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QACjC,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpB,OAAO;gBACL,GAAG,QAAQ;gBACX,OAAO,EAAE,mBAAmB,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC;aACxE,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,KAAK,SAAS,CAAC,CAAC,mBAAmB,CACjC,QAA0B,EAC1B,OAAqC,EACrC,MAAc,EACd,MAAsC;IAEtC,IAAI,CAAC;QACH,KAAK,CAAC,CAAC,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,KAAc,EACd,OAAqC,EACrC,MAAc,EACd,MAAsC;IAEtC,MAAM,SAAS,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAExE,+DAA+D;IAC/D,uEAAuE;IACvE,qEAAqE;IACrE,iEAAiE;IACjE,IAAI,YAA0B,CAAC;IAC/B,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;QAClC,YAAY,GAAG,KAAK,CAAC;IACvB,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,KAAK,CAAC,sDAAsD,EAAE;YACnE,SAAS;YACT,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC;QACH,YAAY,GAAG,aAAa,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC;IACjE,CAAC;IAED,oEAAoE;IACpE,wBAAwB;IACxB,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACpE,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC9D,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,WAAW,EAAE,CAAC;QACrB,6DAA6D;QAC7D,8BAA8B;QAC9B,MAAM,CAAC,KAAK,CAAC,8CAA8C,EAAE;YAC3D,SAAS;YACT,KAAK,EACH,WAAW,YAAY,KAAK;gBAC1B,CAAC,CAAC,WAAW,CAAC,OAAO;gBACrB,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;SAC1B,CAAC,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,WAAW,EAAE,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,sDAAsD,EAAE;YAClE,SAAS;YACT,KAAK,EACH,WAAW,YAAY,KAAK;gBAC1B,CAAC,CAAC,WAAW,CAAC,OAAO;gBACrB,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;SAC1B,CAAC,CAAC;QACH,IAAI,GAAG,yBAAyB,CAAC;IACnC,CAAC;IAED,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,mEAAmE;IACnE,kEAAkE;IAClE,4CAA4C;IAC5C,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;QAC9C,SAAS;QACT,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;QAC7B,WAAW,EAAE,QAAQ,EAAE,WAAW,IAAI,aAAa;QACnD,GAAG;QACH,KAAK,EAAE,YAAY,CAAC,UAAU;KAC/B,CAAC,CAAC;IACH,qEAAqE;IACrE,oEAAoE;IACpE,mEAAmE;IACnE,OAAO,IAAI,YAAY,CAAC,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC;AAC3E,CAAC"}

package/dist/pipeline/interceptors/logging.d.ts

@@ -0,0 +1,4 @@
+import type { Interceptor } from "@connectrpc/connect";
+import type { Logger } from "../../boot/logger.js";
+export declare function createLoggingInterceptor(logger: Logger): Interceptor;
+//# sourceMappingURL=logging.d.ts.map

package/dist/pipeline/interceptors/logging.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging.d.ts","sourceRoot":"","sources":["../../../src/pipeline/interceptors/logging.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAKnD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,CAqCpE"}