@webpieces/cloudtasks-client 0.4.712 → 0.4.714

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webpieces/cloudtasks-client",
-  "version": "0.4.712",
+  "version": "0.4.714",
   "description": "Cloud Tasks enqueue client generated from a shared @PubSub API contract (twin of http-client)",
   "type": "commonjs",
   "main": "./src/index.js",
@@ -23,9 +23,9 @@
     "access": "public"
   },
   "dependencies": {
-    "@webpieces/core-context": "0.4.712",
-    "@webpieces/core-util": "0.4.712",
-    "@webpieces/gcp-identity": "0.4.712",
+    "@webpieces/core-context": "0.4.714",
+    "@webpieces/core-util": "0.4.714",
+    "@webpieces/gcp-identity": "0.4.714",
     "@google-cloud/tasks": "5.5.2",
     "inversify": "7.10.4",
     "reflect-metadata": "0.2.2"

package/src/TaskProxyClient.d.ts

@@ -15,7 +15,8 @@ import { ApiPrototype, TaskClientConfig } from './TaskClientConfig';
  *
  * It owns:
  * - @ApiPath / @PubSub convention validation + the endpoint plans from the contract's decorators
- * - Resolving the callee's base URL from svcName (ClientRegistry override, else GCP derivation)
+ * - Resolving the callee's base URL from svcName through `ClientRegistry.resolve` — the SAME chain the
+ *   RPC client runs: a registered mapping, else the installed deriver, else throw
  * - Context propagation onto the task headers (a credential is never a context key, so none can ride along)
  * - Handing a fully-built TaskRequest to the bound {@link TaskInvoker}
  */

package/src/TaskProxyClient.js

@@ -37,7 +37,8 @@ class EndpointPlan {
  *
  * It owns:
  * - @ApiPath / @PubSub convention validation + the endpoint plans from the contract's decorators
- * - Resolving the callee's base URL from svcName (ClientRegistry override, else GCP derivation)
+ * - Resolving the callee's base URL from svcName through `ClientRegistry.resolve` — the SAME chain the
+ *   RPC client runs: a registered mapping, else the installed deriver, else throw
  * - Context propagation onto the task headers (a credential is never a context key, so none can ride along)
  * - Handing a fully-built TaskRequest to the bound {@link TaskInvoker}
  */

package/src/TaskProxyClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"TaskProxyClient.js","sourceRoot":"","sources":["../../../../../packages/cloud/cloudtasks-client/src/TaskProxyClient.ts"],"names":[],"mappings":";;;;AAAA,yCAAmC;AACnC,oDAe8B;AAC9B,0DAIiC;AACjC,2CAAqE;AACrE,uDAAyD;AAGzD,MAAM,GAAG,GAAG,sBAAU,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;AAEpD,8EAA8E;AAC9E,MAAM,YAAY;IACd,IAAI,CAAS;IACb,SAAS,CAAS;IAClB,QAAQ,CAAW;IACnB;uGACmG;IACnG,IAAI,CAAY;IAEhB,YAAY,IAAY,EAAE,SAAiB,EAAE,QAAkB,EAAE,IAAe;QAC5E,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACrB,CAAC;CACJ;AAED;;;;;;;;;;;;;;;;;GAiBG;AAEI,IAAM,eAAe,GAArB,MAAM,eAAe;IAgBkB;IACU;IAhBpD,8EAA8E;IACtE,KAAK,CAA6B;IAClC,OAAO,CAAU;IACjB,MAAM,CAAoB;IAElC;;;;;;OAMG;IACc,UAAU,GAAG,IAAI,0BAAc,CAAC,IAAI,2CAA4B,EAAE,CAAC,CAAC;IAErF,YAC0C,OAAoB,EACV,OAA8B;QADxC,YAAO,GAAP,OAAO,CAAa;QACV,YAAO,GAAP,OAAO,CAAuB;IAC/E,CAAC;IAEJ,yDAAyD;IACzD,IAAI,CAAC,QAA8B,EAAE,MAAwB;QACzD,IAAI,CAAC,IAAA,qBAAS,EAAC,QAAQ,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,SAAS,QAAQ,CAAC,IAAI,IAAI,SAAS,oCAAoC,CAAC,CAAC;QAC7F,CAAC;QACD,IAAA,mCAAuB,EAAC,QAAQ,CAAC,CAAC;QAClC,IAAA,0CAA8B,EAAC,QAAQ,CAAC,CAAC;QAEzC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC,IAAI,IAAI,YAAY,CAAC;QAC7C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAED,oFAAoF;IACpF,WAAW,CAAC,UAAkB;QAC1B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACtC,CAAC;IAED;;;;OAIG;IACH,6FAA6F;IAC7F,KAAK,CAAC,OAAO,CAAC,UAAkB,EAAE,UAAmB;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,MAAM,IAAI,KAAK,CAAC,wBAAwB,UAAU,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,KAAK,GAAG,IAAA,sCAAoB,GAAE,CAAC;QACrC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACX,uEAAuE;gBACvE,oEAAoE,CACvE,CAAC;QACN,CAAC;QAED,8FAA8F;QAC9F,gGAAgG;QAChG,wFAAwF;QACxF,0FAA0F;QAC1F,mDAAmD;QACnD,MAAM,IAAI,GAAG,IAAI,yBAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACzF,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,IAAI,EAAE;YACvD,uFAAuF;YACvF,qFAAqF;YACrF,wCAAwC;YACxC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAEjD,MAAM,OAAO,GAAG,IAAI,uBAAW,CAC3B,SAAS,EACT,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,SAAS,EACd,UAAU,EACV,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,EACvC,IAAI,CAAC,QAAQ,EACb,KAAK,CAAC,IAAI,IAAI,IAAI,wBAAY,EAAE,CACnC,CAAC;YAEF,gEAAgE;YAChE,GAAG,CAAC,KAAK,CAAC,gBAAgB,IAAI,CAAC,SAAS,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAClF,KAAK,CAAC,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAEnD,4FAA4F;YAC5F,wFAAwF;YACxF,6BAA6B;YAC7B,OAAO,KAAK,CAAC,MAAM,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC9C,CAAC,CAAC,CAAC;IACP,CAAC;IAED,6FAA6F;IACrF,UAAU,CAAC,QAA8B;QAC7C,MAAM,QAAQ,GAAG,IAAA,sBAAU,EAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,SAAS,GAAG,IAAA,wBAAY,EAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAwB,CAAC;QAE9C,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9C,MAAM,QAAQ,GAAG,IAAA,uBAAW,EAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,aAAa,UAAU,QAAQ,IAAI,CAAC,OAAO,mBAAmB,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,YAAY,CACzB,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,EAChC,IAAA,wBAAY,EAAC,QAAQ,EAAE,UAAU,CAAC,EAClC,QAAQ,EACR,IAAA,uBAAW,EAAC,QAAQ,EAAE,UAAU,CAAC,CACpC,CAAC;YACF,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,mBAAmB,CAAC,QAAkB;QAC1C,OAAO,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,4BAAgB,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrF,CAAC;CACJ,CAAA;AApIY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,wCAAyB,GAAE;IAiBnB,mBAAA,IAAA,kBAAM,EAAC,uBAAW,CAAC,CAAA;IACnB,mBAAA,IAAA,kBAAM,EAAC,oCAAqB,CAAC,CAAA;6CADiB,uBAAW;QACD,oCAAqB;GAjBzE,eAAe,CAoI3B;AAED;;;;;;;GAOG;AACH,gGAAgG;AACnF,QAAA,0BAA0B,GAAG,MAAM,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC","sourcesContent":["import { inject } from 'inversify';\nimport {\n    isApiPath,\n    getApiPath,\n    getEndpoints,\n    getAuthMode,\n    getQueueName,\n    getMaskSpec,\n    assertPubSubConventions,\n    assertEveryEndpointHasAuthMode,\n    AuthMode,\n    DestinationTrust,\n    MaskSpec,\n    LogManager,\n    LogApiCallImpl,\n    ApiMethodInfo,\n} from '@webpieces/core-util';\nimport {\n    RequestContextApiCallContext,\n    RequestContextHeaders,\n    provideFrameworkTransient,\n} from '@webpieces/core-context';\nimport { TaskInvoker, TaskRequest, ScheduleInfo } from './TaskTypes';\nimport { currentScheduleFrame } from './ScheduleContext';\nimport { ApiPrototype, TaskClientConfig } from './TaskClientConfig';\n\nconst log = LogManager.getLogger('TaskProxyClient');\n\n/** Per-endpoint routing plan resolved once from the contract's decorators. */\nclass EndpointPlan {\n    path: string;\n    queueName: string;\n    authMode: AuthMode;\n    /** @MaskLog spec for this endpoint's request DTO, read once here so the enqueue log path masks\n     *  a secret on the task payload without a per-enqueue reflection hit. Undefined = log verbatim. */\n    mask?: MaskSpec;\n\n    constructor(path: string, queueName: string, authMode: AuthMode, mask?: MaskSpec) {\n        this.path = path;\n        this.queueName = queueName;\n        this.authMode = authMode;\n        this.mask = mask;\n    }\n}\n\n/**\n * TaskProxyClient - the enqueue engine behind one @PubSub API contract's client proxy.\n *\n * The fire-and-forget twin of http-client-core's ProxyClient, and TWO-PHASE for the same reason:\n * its COLLABORATORS (invoker, headers) come from the container, while the PER-CLIENT state (which\n * contract, which target) arrives on {@link init}. That is what lets {@link ClientCloudTasksFactory}\n * hold a `Provider<TaskProxyClient>` and hand out a fresh, independently-configured client per\n * contract.\n *\n * Calling an endpoint ENQUEUES a task (it does not call remotely); the task is later delivered to\n * the same endpoint's controller through the full server filter chain.\n *\n * It owns:\n * - @ApiPath / @PubSub convention validation + the endpoint plans from the contract's decorators\n * - Resolving the callee's base URL from svcName (ClientRegistry override, else GCP derivation)\n * - Context propagation onto the task headers (a credential is never a context key, so none can ride along)\n * - Handing a fully-built TaskRequest to the bound {@link TaskInvoker}\n */\n@provideFrameworkTransient()\nexport class TaskProxyClient {\n    // Assigned by init(), which the factory calls immediately after construction.\n    private plans!: Map<string, EndpointPlan>;\n    private apiName!: string;\n    private config!: TaskClientConfig;\n\n    /**\n     * The api-call log seam, built around this node-only package's OWN RequestContext-backed\n     * ApiCallContext. Constructed here rather than installed at startup, so a plain NestJS/Express\n     * host needs no webpieces STARTUP INSTALL to enqueue — it only has to run the call inside a\n     * `RequestContext.run(...)` scope, which such a host already opens per request. That is the defect\n     * that made every enqueue throw `ApiCallContext is not installed`.\n     */\n    private readonly logApiCall = new LogApiCallImpl(new RequestContextApiCallContext());\n\n    constructor(\n        @inject(TaskInvoker) private readonly invoker: TaskInvoker,\n        @inject(RequestContextHeaders) private readonly headers: RequestContextHeaders,\n    ) {}\n\n    /** Bind this client to one @PubSub contract + target. */\n    init(apiClass: ApiPrototype<object>, config: TaskClientConfig): void {\n        if (!isApiPath(apiClass)) {\n            throw new Error(`Class ${apiClass.name || 'Unknown'} must be decorated with @ApiPath()`);\n        }\n        assertPubSubConventions(apiClass);\n        assertEveryEndpointHasAuthMode(apiClass);\n\n        this.config = config;\n        this.apiName = apiClass.name || 'UnknownApi';\n        this.plans = this.buildPlans(apiClass);\n    }\n\n    /** Check whether the contract declares a @PubSub endpoint with this method name. */\n    hasEndpoint(methodName: string): boolean {\n        return this.plans.has(methodName);\n    }\n\n    /**\n     * Enqueue one task for the named endpoint. Must run inside a CloudTaskScheduler lambda\n     * (which supplies the ScheduleInfo) within an active RequestContext, e.g.:\n     *   scheduler.addToQueue(() => taskClient.foo(req), { dedupName });\n     */\n    // webpieces-disable no-any-unknown -- the request DTO's type is erased at the proxy boundary\n    async enqueue(methodName: string, requestDto: unknown): Promise<void> {\n        const plan = this.plans.get(methodName);\n        if (!plan) {\n            throw new Error(`No @PubSub endpoint '${methodName}' on ${this.apiName}`);\n        }\n\n        const frame = currentScheduleFrame();\n        if (!frame) {\n            throw new Error(\n                'Cloud task enqueue must run inside a CloudTaskScheduler lambda, e.g. ' +\n                'scheduler.addToQueue(() => taskClient.method(req), { dedupName }).',\n            );\n        }\n\n        // Route through LogApiCall exactly like ProxyClient does for http. TaskProxyClient.enqueue is\n        // the ONE seam above BOTH GcpTaskInvoker (prod) and InMemoryTaskInvoker (localhost) — whichever\n        // TaskInvoker is bound, this method sits above it — so the enqueue edge gets structured\n        // `jsonPayload.api.*` logging (and, once recording is unified at LogApiCall, is recorded)\n        // uniformly, without touching either invoker impl.\n        const info = new ApiMethodInfo('client', this.apiName, methodName, undefined, plan.mask);\n        await this.logApiCall.execute(info, requestDto, async () => {\n            // Resolved lazily (not at client construction) so building a client stays synchronous.\n            // Every metadata read beneath resolveUrl is memoized process-wide, so only the first\n            // enqueue in the process pays a lookup.\n            const targetUrl = await this.config.resolveUrl();\n\n            const request = new TaskRequest(\n                targetUrl,\n                plan.path,\n                plan.queueName,\n                requestDto,\n                this.buildContextHeaders(plan.authMode),\n                plan.authMode,\n                frame.info ?? new ScheduleInfo(),\n            );\n\n            // svcName, not the URL, is the stable name across demo/qa/prod.\n            log.debug(`enqueue task ${plan.queueName} -> ${this.config.svcName}${plan.path}`);\n            frame.jobRef = await this.invoker.enqueue(request);\n\n            // Fire-and-forget: the enqueue ack is not a meaningful response. Return a non-null value so\n            // LogApiCall's null-response guard passes; a recorded test asserts the enqueued REQUEST\n            // (payload), never this ack.\n            return frame.jobRef ?? { enqueued: true };\n        });\n    }\n\n    /** Endpoint name -> its resolved path / queue / auth mode, read once from the decorators. */\n    private buildPlans(apiClass: ApiPrototype<object>): Map<string, EndpointPlan> {\n        const basePath = getApiPath(apiClass) ?? '';\n        const endpoints = getEndpoints(apiClass) ?? {};\n        const plans = new Map<string, EndpointPlan>();\n\n        for (const methodName of Object.keys(endpoints)) {\n            const authMode = getAuthMode(apiClass, methodName);\n            if (!authMode) {\n                throw new Error(`Endpoint '${methodName}' on ${this.apiName} has no auth mode`);\n            }\n            const plan = new EndpointPlan(\n                basePath + endpoints[methodName],\n                getQueueName(apiClass, methodName),\n                authMode,\n                getMaskSpec(apiClass, methodName),\n            );\n            plans.set(methodName, plan);\n        }\n        return plans;\n    }\n\n    /**\n     * Every transferred context key (txId/requestId/tenant…) the DELIVERY endpoint may receive,\n     * request-id chained. Throws if there is no active RequestContext — an enqueue with no trace is\n     * a bug.\n     *\n     * No credential can appear here: `authorization` is read off the inbound HttpRequest and is not\n     * a ContextKey, so it never enters the RequestContext to be transferred. The invoker mints the\n     * task's own delivery auth per the endpoint's @AuthOidc / @AuthSharedSecret mode.\n     *\n     * TRUSTED keys DO flow on this path, and that is the point of deriving {@link DestinationTrust}\n     * from `plan.authMode` rather than hardcoding it: a task is delivered under the OIDC token the\n     * invoker mints, so the delivery endpoint authenticates its caller and its AuthFilter admits the\n     * userId/orgId we vouched for. A @PubSub endpoint declared @Public or @AuthJwt would not, and it\n     * correctly stops receiving them — the enqueue keeps working, minus context the callee would\n     * have 401'd on.\n     */\n    private buildContextHeaders(authMode: AuthMode): Map<string, string> {\n        return this.headers.buildOutboundHeaders(DestinationTrust.forAuthMode(authMode));\n    }\n}\n\n/**\n * DI token for the `Provider<TaskProxyClient>` that hands out enqueue clients — one per @PubSub\n * contract. `Provider<T>` is erased at runtime, so it cannot be its own token; this Symbol names T.\n *\n * Because TaskProxyClient is bound TRANSIENT, every `get()` constructs a new one. (Were it bound\n * `@provideFrameworkSingleton`, the very same Provider would hand back one lazily-created instance\n * instead — the provider caches nothing, so the target's scope decides.)\n */\n// webpieces-disable no-symbol-di-tokens -- Provider<T> is erased at runtime; the Symbol names T\nexport const TASK_PROXY_CLIENT_PROVIDER = Symbol.for('Provider<TaskProxyClient>');\n"]}
+{"version":3,"file":"TaskProxyClient.js","sourceRoot":"","sources":["../../../../../packages/cloud/cloudtasks-client/src/TaskProxyClient.ts"],"names":[],"mappings":";;;;AAAA,yCAAmC;AACnC,oDAe8B;AAC9B,0DAIiC;AACjC,2CAAqE;AACrE,uDAAyD;AAGzD,MAAM,GAAG,GAAG,sBAAU,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;AAEpD,8EAA8E;AAC9E,MAAM,YAAY;IACd,IAAI,CAAS;IACb,SAAS,CAAS;IAClB,QAAQ,CAAW;IACnB;uGACmG;IACnG,IAAI,CAAY;IAEhB,YAAY,IAAY,EAAE,SAAiB,EAAE,QAAkB,EAAE,IAAe;QAC5E,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACrB,CAAC;CACJ;AAED;;;;;;;;;;;;;;;;;;GAkBG;AAEI,IAAM,eAAe,GAArB,MAAM,eAAe;IAgBkB;IACU;IAhBpD,8EAA8E;IACtE,KAAK,CAA6B;IAClC,OAAO,CAAU;IACjB,MAAM,CAAoB;IAElC;;;;;;OAMG;IACc,UAAU,GAAG,IAAI,0BAAc,CAAC,IAAI,2CAA4B,EAAE,CAAC,CAAC;IAErF,YAC0C,OAAoB,EACV,OAA8B;QADxC,YAAO,GAAP,OAAO,CAAa;QACV,YAAO,GAAP,OAAO,CAAuB;IAC/E,CAAC;IAEJ,yDAAyD;IACzD,IAAI,CAAC,QAA8B,EAAE,MAAwB;QACzD,IAAI,CAAC,IAAA,qBAAS,EAAC,QAAQ,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,SAAS,QAAQ,CAAC,IAAI,IAAI,SAAS,oCAAoC,CAAC,CAAC;QAC7F,CAAC;QACD,IAAA,mCAAuB,EAAC,QAAQ,CAAC,CAAC;QAClC,IAAA,0CAA8B,EAAC,QAAQ,CAAC,CAAC;QAEzC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC,IAAI,IAAI,YAAY,CAAC;QAC7C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAED,oFAAoF;IACpF,WAAW,CAAC,UAAkB;QAC1B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACtC,CAAC;IAED;;;;OAIG;IACH,6FAA6F;IAC7F,KAAK,CAAC,OAAO,CAAC,UAAkB,EAAE,UAAmB;QACjD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,MAAM,IAAI,KAAK,CAAC,wBAAwB,UAAU,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,KAAK,GAAG,IAAA,sCAAoB,GAAE,CAAC;QACrC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACX,uEAAuE;gBACvE,oEAAoE,CACvE,CAAC;QACN,CAAC;QAED,8FAA8F;QAC9F,gGAAgG;QAChG,wFAAwF;QACxF,0FAA0F;QAC1F,mDAAmD;QACnD,MAAM,IAAI,GAAG,IAAI,yBAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACzF,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,IAAI,EAAE;YACvD,uFAAuF;YACvF,qFAAqF;YACrF,wCAAwC;YACxC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAEjD,MAAM,OAAO,GAAG,IAAI,uBAAW,CAC3B,SAAS,EACT,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,SAAS,EACd,UAAU,EACV,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,EACvC,IAAI,CAAC,QAAQ,EACb,KAAK,CAAC,IAAI,IAAI,IAAI,wBAAY,EAAE,CACnC,CAAC;YAEF,gEAAgE;YAChE,GAAG,CAAC,KAAK,CAAC,gBAAgB,IAAI,CAAC,SAAS,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAClF,KAAK,CAAC,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAEnD,4FAA4F;YAC5F,wFAAwF;YACxF,6BAA6B;YAC7B,OAAO,KAAK,CAAC,MAAM,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC9C,CAAC,CAAC,CAAC;IACP,CAAC;IAED,6FAA6F;IACrF,UAAU,CAAC,QAA8B;QAC7C,MAAM,QAAQ,GAAG,IAAA,sBAAU,EAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,SAAS,GAAG,IAAA,wBAAY,EAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAwB,CAAC;QAE9C,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9C,MAAM,QAAQ,GAAG,IAAA,uBAAW,EAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,aAAa,UAAU,QAAQ,IAAI,CAAC,OAAO,mBAAmB,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,YAAY,CACzB,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,EAChC,IAAA,wBAAY,EAAC,QAAQ,EAAE,UAAU,CAAC,EAClC,QAAQ,EACR,IAAA,uBAAW,EAAC,QAAQ,EAAE,UAAU,CAAC,CACpC,CAAC;YACF,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,mBAAmB,CAAC,QAAkB;QAC1C,OAAO,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,4BAAgB,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrF,CAAC;CACJ,CAAA;AApIY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,wCAAyB,GAAE;IAiBnB,mBAAA,IAAA,kBAAM,EAAC,uBAAW,CAAC,CAAA;IACnB,mBAAA,IAAA,kBAAM,EAAC,oCAAqB,CAAC,CAAA;6CADiB,uBAAW;QACD,oCAAqB;GAjBzE,eAAe,CAoI3B;AAED;;;;;;;GAOG;AACH,gGAAgG;AACnF,QAAA,0BAA0B,GAAG,MAAM,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC","sourcesContent":["import { inject } from 'inversify';\nimport {\n    isApiPath,\n    getApiPath,\n    getEndpoints,\n    getAuthMode,\n    getQueueName,\n    getMaskSpec,\n    assertPubSubConventions,\n    assertEveryEndpointHasAuthMode,\n    AuthMode,\n    DestinationTrust,\n    MaskSpec,\n    LogManager,\n    LogApiCallImpl,\n    ApiMethodInfo,\n} from '@webpieces/core-util';\nimport {\n    RequestContextApiCallContext,\n    RequestContextHeaders,\n    provideFrameworkTransient,\n} from '@webpieces/core-context';\nimport { TaskInvoker, TaskRequest, ScheduleInfo } from './TaskTypes';\nimport { currentScheduleFrame } from './ScheduleContext';\nimport { ApiPrototype, TaskClientConfig } from './TaskClientConfig';\n\nconst log = LogManager.getLogger('TaskProxyClient');\n\n/** Per-endpoint routing plan resolved once from the contract's decorators. */\nclass EndpointPlan {\n    path: string;\n    queueName: string;\n    authMode: AuthMode;\n    /** @MaskLog spec for this endpoint's request DTO, read once here so the enqueue log path masks\n     *  a secret on the task payload without a per-enqueue reflection hit. Undefined = log verbatim. */\n    mask?: MaskSpec;\n\n    constructor(path: string, queueName: string, authMode: AuthMode, mask?: MaskSpec) {\n        this.path = path;\n        this.queueName = queueName;\n        this.authMode = authMode;\n        this.mask = mask;\n    }\n}\n\n/**\n * TaskProxyClient - the enqueue engine behind one @PubSub API contract's client proxy.\n *\n * The fire-and-forget twin of http-client-core's ProxyClient, and TWO-PHASE for the same reason:\n * its COLLABORATORS (invoker, headers) come from the container, while the PER-CLIENT state (which\n * contract, which target) arrives on {@link init}. That is what lets {@link ClientCloudTasksFactory}\n * hold a `Provider<TaskProxyClient>` and hand out a fresh, independently-configured client per\n * contract.\n *\n * Calling an endpoint ENQUEUES a task (it does not call remotely); the task is later delivered to\n * the same endpoint's controller through the full server filter chain.\n *\n * It owns:\n * - @ApiPath / @PubSub convention validation + the endpoint plans from the contract's decorators\n * - Resolving the callee's base URL from svcName through `ClientRegistry.resolve` — the SAME chain the\n *   RPC client runs: a registered mapping, else the installed deriver, else throw\n * - Context propagation onto the task headers (a credential is never a context key, so none can ride along)\n * - Handing a fully-built TaskRequest to the bound {@link TaskInvoker}\n */\n@provideFrameworkTransient()\nexport class TaskProxyClient {\n    // Assigned by init(), which the factory calls immediately after construction.\n    private plans!: Map<string, EndpointPlan>;\n    private apiName!: string;\n    private config!: TaskClientConfig;\n\n    /**\n     * The api-call log seam, built around this node-only package's OWN RequestContext-backed\n     * ApiCallContext. Constructed here rather than installed at startup, so a plain NestJS/Express\n     * host needs no webpieces STARTUP INSTALL to enqueue — it only has to run the call inside a\n     * `RequestContext.run(...)` scope, which such a host already opens per request. That is the defect\n     * that made every enqueue throw `ApiCallContext is not installed`.\n     */\n    private readonly logApiCall = new LogApiCallImpl(new RequestContextApiCallContext());\n\n    constructor(\n        @inject(TaskInvoker) private readonly invoker: TaskInvoker,\n        @inject(RequestContextHeaders) private readonly headers: RequestContextHeaders,\n    ) {}\n\n    /** Bind this client to one @PubSub contract + target. */\n    init(apiClass: ApiPrototype<object>, config: TaskClientConfig): void {\n        if (!isApiPath(apiClass)) {\n            throw new Error(`Class ${apiClass.name || 'Unknown'} must be decorated with @ApiPath()`);\n        }\n        assertPubSubConventions(apiClass);\n        assertEveryEndpointHasAuthMode(apiClass);\n\n        this.config = config;\n        this.apiName = apiClass.name || 'UnknownApi';\n        this.plans = this.buildPlans(apiClass);\n    }\n\n    /** Check whether the contract declares a @PubSub endpoint with this method name. */\n    hasEndpoint(methodName: string): boolean {\n        return this.plans.has(methodName);\n    }\n\n    /**\n     * Enqueue one task for the named endpoint. Must run inside a CloudTaskScheduler lambda\n     * (which supplies the ScheduleInfo) within an active RequestContext, e.g.:\n     *   scheduler.addToQueue(() => taskClient.foo(req), { dedupName });\n     */\n    // webpieces-disable no-any-unknown -- the request DTO's type is erased at the proxy boundary\n    async enqueue(methodName: string, requestDto: unknown): Promise<void> {\n        const plan = this.plans.get(methodName);\n        if (!plan) {\n            throw new Error(`No @PubSub endpoint '${methodName}' on ${this.apiName}`);\n        }\n\n        const frame = currentScheduleFrame();\n        if (!frame) {\n            throw new Error(\n                'Cloud task enqueue must run inside a CloudTaskScheduler lambda, e.g. ' +\n                'scheduler.addToQueue(() => taskClient.method(req), { dedupName }).',\n            );\n        }\n\n        // Route through LogApiCall exactly like ProxyClient does for http. TaskProxyClient.enqueue is\n        // the ONE seam above BOTH GcpTaskInvoker (prod) and InMemoryTaskInvoker (localhost) — whichever\n        // TaskInvoker is bound, this method sits above it — so the enqueue edge gets structured\n        // `jsonPayload.api.*` logging (and, once recording is unified at LogApiCall, is recorded)\n        // uniformly, without touching either invoker impl.\n        const info = new ApiMethodInfo('client', this.apiName, methodName, undefined, plan.mask);\n        await this.logApiCall.execute(info, requestDto, async () => {\n            // Resolved lazily (not at client construction) so building a client stays synchronous.\n            // Every metadata read beneath resolveUrl is memoized process-wide, so only the first\n            // enqueue in the process pays a lookup.\n            const targetUrl = await this.config.resolveUrl();\n\n            const request = new TaskRequest(\n                targetUrl,\n                plan.path,\n                plan.queueName,\n                requestDto,\n                this.buildContextHeaders(plan.authMode),\n                plan.authMode,\n                frame.info ?? new ScheduleInfo(),\n            );\n\n            // svcName, not the URL, is the stable name across demo/qa/prod.\n            log.debug(`enqueue task ${plan.queueName} -> ${this.config.svcName}${plan.path}`);\n            frame.jobRef = await this.invoker.enqueue(request);\n\n            // Fire-and-forget: the enqueue ack is not a meaningful response. Return a non-null value so\n            // LogApiCall's null-response guard passes; a recorded test asserts the enqueued REQUEST\n            // (payload), never this ack.\n            return frame.jobRef ?? { enqueued: true };\n        });\n    }\n\n    /** Endpoint name -> its resolved path / queue / auth mode, read once from the decorators. */\n    private buildPlans(apiClass: ApiPrototype<object>): Map<string, EndpointPlan> {\n        const basePath = getApiPath(apiClass) ?? '';\n        const endpoints = getEndpoints(apiClass) ?? {};\n        const plans = new Map<string, EndpointPlan>();\n\n        for (const methodName of Object.keys(endpoints)) {\n            const authMode = getAuthMode(apiClass, methodName);\n            if (!authMode) {\n                throw new Error(`Endpoint '${methodName}' on ${this.apiName} has no auth mode`);\n            }\n            const plan = new EndpointPlan(\n                basePath + endpoints[methodName],\n                getQueueName(apiClass, methodName),\n                authMode,\n                getMaskSpec(apiClass, methodName),\n            );\n            plans.set(methodName, plan);\n        }\n        return plans;\n    }\n\n    /**\n     * Every transferred context key (txId/requestId/tenant…) the DELIVERY endpoint may receive,\n     * request-id chained. Throws if there is no active RequestContext — an enqueue with no trace is\n     * a bug.\n     *\n     * No credential can appear here: `authorization` is read off the inbound HttpRequest and is not\n     * a ContextKey, so it never enters the RequestContext to be transferred. The invoker mints the\n     * task's own delivery auth per the endpoint's @AuthOidc / @AuthSharedSecret mode.\n     *\n     * TRUSTED keys DO flow on this path, and that is the point of deriving {@link DestinationTrust}\n     * from `plan.authMode` rather than hardcoding it: a task is delivered under the OIDC token the\n     * invoker mints, so the delivery endpoint authenticates its caller and its AuthFilter admits the\n     * userId/orgId we vouched for. A @PubSub endpoint declared @Public or @AuthJwt would not, and it\n     * correctly stops receiving them — the enqueue keeps working, minus context the callee would\n     * have 401'd on.\n     */\n    private buildContextHeaders(authMode: AuthMode): Map<string, string> {\n        return this.headers.buildOutboundHeaders(DestinationTrust.forAuthMode(authMode));\n    }\n}\n\n/**\n * DI token for the `Provider<TaskProxyClient>` that hands out enqueue clients — one per @PubSub\n * contract. `Provider<T>` is erased at runtime, so it cannot be its own token; this Symbol names T.\n *\n * Because TaskProxyClient is bound TRANSIENT, every `get()` constructs a new one. (Were it bound\n * `@provideFrameworkSingleton`, the very same Provider would hand back one lazily-created instance\n * instead — the provider caches nothing, so the target's scope decides.)\n */\n// webpieces-disable no-symbol-di-tokens -- Provider<T> is erased at runtime; the Symbol names T\nexport const TASK_PROXY_CLIENT_PROVIDER = Symbol.for('Provider<TaskProxyClient>');\n"]}