@webpieces/core-context 0.4.838 → 0.4.840

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webpieces/core-context",
-  "version": "0.4.838",
+  "version": "0.4.840",
   "description": "AsyncLocalStorage-based context management for request-scoped data",
   "type": "commonjs",
   "main": "./src/index.js",
@@ -22,7 +22,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@webpieces/core-util": "0.4.838",
+    "@webpieces/core-util": "0.4.840",
     "@inversifyjs/binding-decorators": "1.1.5",
     "inversify": "7.10.4",
     "reflect-metadata": "0.2.2"

package/src/StreamEventContext.d.ts

@@ -0,0 +1,10 @@
+/** Captures the authenticated opening scope and restores an isolated scope for every event. */
+export declare class StreamEventContext {
+    private readonly captured;
+    private readonly request?;
+    constructor();
+    run<T>(handler: () => T): T;
+    private copyRequest;
+    /** Triggered output inherits its inbound event; unsolicited output receives its own child scope. */
+    runOutbound<T>(handler: () => T): T;
+}

package/src/StreamEventContext.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StreamEventContext = void 0;
+const node_crypto_1 = require("node:crypto");
+const core_util_1 = require("@webpieces/core-util");
+const RequestContext_1 = require("./RequestContext");
+const HttpRequest_1 = require("./HttpRequest");
+/** Captures the authenticated opening scope and restores an isolated scope for every event. */
+class StreamEventContext {
+    captured;
+    request;
+    constructor() {
+        this.captured = RequestContext_1.RequestContext.copyContext();
+        const current = RequestContext_1.RequestContext.getRequest();
+        if (current)
+            this.request = this.copyRequest(current);
+    }
+    run(handler) {
+        return RequestContext_1.RequestContext.runWithContext(this.captured.withTrusted(), () => {
+            if (this.request)
+                RequestContext_1.RequestContext.setRequest(this.copyRequest(this.request));
+            RequestContext_1.RequestContext.putUntrusted(core_util_1.WebpiecesCoreHeaders.STREAM_EVENT_ID, (0, node_crypto_1.randomUUID)());
+            return handler();
+        });
+    }
+    copyRequest(request) {
+        const headers = new Map();
+        for (const entry of request.headers)
+            headers.set(entry[0], [...entry[1]]);
+        return new HttpRequest_1.HttpRequest(request.method, request.path, headers, request.raw);
+    }
+    /** Triggered output inherits its inbound event; unsolicited output receives its own child scope. */
+    runOutbound(handler) {
+        if (RequestContext_1.RequestContext.getUntrusted(core_util_1.WebpiecesCoreHeaders.STREAM_EVENT_ID))
+            return handler();
+        return this.run(handler);
+    }
+}
+exports.StreamEventContext = StreamEventContext;
+//# sourceMappingURL=StreamEventContext.js.map

package/src/StreamEventContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"StreamEventContext.js","sourceRoot":"","sources":["../../../../../packages/core/core-context/src/StreamEventContext.ts"],"names":[],"mappings":";;;AAAA,6CAAyC;AACzC,oDAA4D;AAC5D,qDAAkD;AAElD,+CAA4C;AAE5C,+FAA+F;AAC/F,MAAa,kBAAkB;IACV,QAAQ,CAAkB;IAC1B,OAAO,CAAe;IAEvC;QACI,IAAI,CAAC,QAAQ,GAAG,+BAAc,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,+BAAc,CAAC,UAAU,EAAE,CAAC;QAC5C,IAAI,OAAO;YAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED,GAAG,CAAI,OAAgB;QACnB,OAAO,+BAAc,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE;YACnE,IAAI,IAAI,CAAC,OAAO;gBAAE,+BAAc,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAC5E,+BAAc,CAAC,YAAY,CAAC,gCAAoB,CAAC,eAAe,EAAE,IAAA,wBAAU,GAAE,CAAC,CAAC;YAChF,OAAO,OAAO,EAAE,CAAC;QACrB,CAAC,CAAC,CAAC;IACP,CAAC;IAEO,WAAW,CAAC,OAAoB;QACpC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC5C,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1E,OAAO,IAAI,yBAAW,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/E,CAAC;IAED,oGAAoG;IACpG,WAAW,CAAI,OAAgB;QAC3B,IAAI,+BAAc,CAAC,YAAY,CAAC,gCAAoB,CAAC,eAAe,CAAC;YAAE,OAAO,OAAO,EAAE,CAAC;QACxF,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;CACJ;AA7BD,gDA6BC","sourcesContent":["import { randomUUID } from 'node:crypto';\nimport { WebpiecesCoreHeaders } from '@webpieces/core-util';\nimport { RequestContext } from './RequestContext';\nimport { CapturedContext } from './CapturedContext';\nimport { HttpRequest } from './HttpRequest';\n\n/** Captures the authenticated opening scope and restores an isolated scope for every event. */\nexport class StreamEventContext {\n    private readonly captured: CapturedContext;\n    private readonly request?: HttpRequest;\n\n    constructor() {\n        this.captured = RequestContext.copyContext();\n        const current = RequestContext.getRequest();\n        if (current) this.request = this.copyRequest(current);\n    }\n\n    run<T>(handler: () => T): T {\n        return RequestContext.runWithContext(this.captured.withTrusted(), () => {\n            if (this.request) RequestContext.setRequest(this.copyRequest(this.request));\n            RequestContext.putUntrusted(WebpiecesCoreHeaders.STREAM_EVENT_ID, randomUUID());\n            return handler();\n        });\n    }\n\n    private copyRequest(request: HttpRequest): HttpRequest {\n        const headers = new Map<string, string[]>();\n        for (const entry of request.headers) headers.set(entry[0], [...entry[1]]);\n        return new HttpRequest(request.method, request.path, headers, request.raw);\n    }\n\n    /** Triggered output inherits its inbound event; unsolicited output receives its own child scope. */\n    runOutbound<T>(handler: () => T): T {\n        if (RequestContext.getUntrusted(WebpiecesCoreHeaders.STREAM_EVENT_ID)) return handler();\n        return this.run(handler);\n    }\n}\n"]}

package/src/index.d.ts

@@ -11,3 +11,4 @@ export type { FrameworkScope } from './frameworkProvide';
 export { RequestContextHeaders } from './RequestContextHeaders';
 export { RequestContextReader } from './RequestContextReader';
 export { PendingWireTrust, PendingTrustedValue } from './PendingWireTrust';
+export { StreamEventContext } from './StreamEventContext';

package/src/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PendingTrustedValue = exports.PendingWireTrust = exports.RequestContextReader = exports.RequestContextHeaders = exports.buildFrameworkModule = exports.bindFrameworkProvider = exports.provideFrameworkTransient = exports.provideFrameworkSingletonDefaultForApi = exports.provideFrameworkSingleton = exports.Provider = exports.provideSingletonDefaultForApi = exports.RawRequest = exports.HttpRequest = exports.RequestContextApiCallContext = exports.RequestContext = void 0;
+exports.StreamEventContext = exports.PendingTrustedValue = exports.PendingWireTrust = exports.RequestContextReader = exports.RequestContextHeaders = exports.buildFrameworkModule = exports.bindFrameworkProvider = exports.provideFrameworkTransient = exports.provideFrameworkSingletonDefaultForApi = exports.provideFrameworkSingleton = exports.Provider = exports.provideSingletonDefaultForApi = exports.RawRequest = exports.HttpRequest = exports.RequestContextApiCallContext = exports.RequestContext = void 0;
 // Context management with AsyncLocalStorage
 var RequestContext_1 = require("./RequestContext");
 Object.defineProperty(exports, "RequestContext", { enumerable: true, get: function () { return RequestContext_1.RequestContext; } });
@@ -44,4 +44,6 @@ Object.defineProperty(exports, "RequestContextReader", { enumerable: true, get:
 var PendingWireTrust_1 = require("./PendingWireTrust");
 Object.defineProperty(exports, "PendingWireTrust", { enumerable: true, get: function () { return PendingWireTrust_1.PendingWireTrust; } });
 Object.defineProperty(exports, "PendingTrustedValue", { enumerable: true, get: function () { return PendingWireTrust_1.PendingTrustedValue; } });
+var StreamEventContext_1 = require("./StreamEventContext");
+Object.defineProperty(exports, "StreamEventContext", { enumerable: true, get: function () { return StreamEventContext_1.StreamEventContext; } });
 //# sourceMappingURL=index.js.map

package/src/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/core/core-context/src/index.ts"],"names":[],"mappings":";;;AAAA,4CAA4C;AAC5C,mDAAkD;AAAzC,gHAAA,cAAc,OAAA;AAiBvB,qGAAqG;AACrG,wFAAwF;AACxF,0EAA0E;AAC1E,+EAA8E;AAArE,4IAAA,4BAA4B,OAAA;AACrC,mGAAmG;AACnG,6CAA4D;AAAnD,0GAAA,WAAW,OAAA;AACpB,qGAAqG;AACrG,2CAA0C;AAAjC,wGAAA,UAAU,OAAA;AAEnB,mFAAmF;AACnF,qCAA0D;AAAjD,wHAAA,6BAA6B,OAAA;AACtC,2FAA2F;AAC3F,qCAAqC;AAA5B,mGAAA,QAAQ,OAAA;AACjB,sFAAsF;AACtF,wEAAwE;AACxE,uDAM4B;AALxB,6HAAA,yBAAyB,OAAA;AACzB,0IAAA,sCAAsC,OAAA;AACtC,6HAAA,yBAAyB,OAAA;AACzB,yHAAA,qBAAqB,OAAA;AACrB,wHAAA,oBAAoB,OAAA;AAIxB,mFAAmF;AACnF,yFAAyF;AACzF,yBAAyB;AACzB,EAAE;AACF,8FAA8F;AAC9F,2FAA2F;AAC3F,uDAAuD;AACvD,iEAAgE;AAAvD,8HAAA,qBAAqB,OAAA;AAC9B,oGAAoG;AACpG,+DAA8D;AAArD,4HAAA,oBAAoB,OAAA;AAC7B,uDAA2E;AAAlE,oHAAA,gBAAgB,OAAA;AAAE,uHAAA,mBAAmB,OAAA","sourcesContent":["// Context management with AsyncLocalStorage\nexport { RequestContext } from './RequestContext';\n// The OPAQUE snapshot type that copyContext() produces and restoreContext()/runWithContext() accept.\n//\n// `export type`, NOT `export` — deliberately. Consumers need to NAME it (a field, a queue entry, a\n// parameter) and nothing more. A VALUE export would hand them the class object, and with it the static\n// `capture(...)`, whose capability token a cast can supply even though this barrel never exports the\n// token's type: `CapturedContext.capture(null as never, new Map([['userId','victim']]))` would compile\n// and forge a proven identity — the exact hole this whole change closes. A type-only export removes the\n// class object from the package surface, so there is no factory to reach and copyContext() really is\n// the only producer. (ContextCaptureAuthority is not exported here in any form.)\nexport type { CapturedContext } from './CapturedContext';\n// The narrowed snapshot — what withTrusted() / withoutTrusted() produce and what\n// runWithContext()/restoreContext() accept. A bare CapturedContext is NOT accepted by either, so every\n// call site states whether the proven identity travels with the work (`grep -rn withTrusted`) or is\n// deliberately dropped (`grep -rn withoutTrusted`). Type-only for the same reason as above: with no\n// class object on the surface there is no `of(...)` factory to reach, cast or not.\nexport type { RestorableContext } from './CapturedContext';\n// SERVER impl of the core-util ApiCallContext seam, bound to RequestContext. There is no install and\n// no side effect: each node package that logs api calls (LogApiFilter, NodeProxyClient,\n// TaskProxyClient) CONSTRUCTS one and hands it to its own LogApiCallImpl.\nexport { RequestContextApiCallContext } from './RequestContextApiCallContext';\n// Transport-neutral request stored in the context (http-routing's request type; re-exported there)\nexport { HttpRequest, RawHttpRequest } from './HttpRequest';\n// The verbatim bytes + absolute url a webhook SIGNATURE is computed over ({ rawBody: true } routes).\nexport { RawRequest } from './RawRequest';\n\n// DI provider decorators (shared DI seam; http-routing re-exports for back-compat)\nexport { provideSingletonDefaultForApi } from './provide';\n// Guice-style Provider<T> — lazy singleton OR fresh-per-get, decided by T's binding scope.\nexport { Provider } from './provide';\n// Framework-only DI registry (packages/** use these; keeps framework classes out of a\n// client's buildProviderModule() global scan). See frameworkProvide.ts.\nexport {\n    provideFrameworkSingleton,\n    provideFrameworkSingletonDefaultForApi,\n    provideFrameworkTransient,\n    bindFrameworkProvider,\n    buildFrameworkModule,\n} from './frameworkProvide';\nexport type { FrameworkScope } from './frameworkProvide';\n\n// Outbound headers for a SERVER: reads RequestContext directly, fails fast outside\n// RequestContext.run(...). Server-side clients (http-client-node, cloudtasks-client) and\n// http-routing use THIS.\n//\n// ContextMgr is deliberately NOT re-exported. It is the browser's answer (an app-held store),\n// and only @webpieces/http-client-browser may name it — importing it here would let a node\n// package reach for a ContextReader it has no use for.\nexport { RequestContextHeaders } from './RequestContextHeaders';\n// The browser store's server counterpart, still used by the logging packages + http-server filters.\nexport { RequestContextReader } from './RequestContextReader';\nexport { PendingWireTrust, PendingTrustedValue } from './PendingWireTrust';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/core/core-context/src/index.ts"],"names":[],"mappings":";;;AAAA,4CAA4C;AAC5C,mDAAkD;AAAzC,gHAAA,cAAc,OAAA;AAiBvB,qGAAqG;AACrG,wFAAwF;AACxF,0EAA0E;AAC1E,+EAA8E;AAArE,4IAAA,4BAA4B,OAAA;AACrC,mGAAmG;AACnG,6CAA4D;AAAnD,0GAAA,WAAW,OAAA;AACpB,qGAAqG;AACrG,2CAA0C;AAAjC,wGAAA,UAAU,OAAA;AAEnB,mFAAmF;AACnF,qCAA0D;AAAjD,wHAAA,6BAA6B,OAAA;AACtC,2FAA2F;AAC3F,qCAAqC;AAA5B,mGAAA,QAAQ,OAAA;AACjB,sFAAsF;AACtF,wEAAwE;AACxE,uDAM4B;AALxB,6HAAA,yBAAyB,OAAA;AACzB,0IAAA,sCAAsC,OAAA;AACtC,6HAAA,yBAAyB,OAAA;AACzB,yHAAA,qBAAqB,OAAA;AACrB,wHAAA,oBAAoB,OAAA;AAIxB,mFAAmF;AACnF,yFAAyF;AACzF,yBAAyB;AACzB,EAAE;AACF,8FAA8F;AAC9F,2FAA2F;AAC3F,uDAAuD;AACvD,iEAAgE;AAAvD,8HAAA,qBAAqB,OAAA;AAC9B,oGAAoG;AACpG,+DAA8D;AAArD,4HAAA,oBAAoB,OAAA;AAC7B,uDAA2E;AAAlE,oHAAA,gBAAgB,OAAA;AAAE,uHAAA,mBAAmB,OAAA;AAC9C,2DAA0D;AAAjD,wHAAA,kBAAkB,OAAA","sourcesContent":["// Context management with AsyncLocalStorage\nexport { RequestContext } from './RequestContext';\n// The OPAQUE snapshot type that copyContext() produces and restoreContext()/runWithContext() accept.\n//\n// `export type`, NOT `export` — deliberately. Consumers need to NAME it (a field, a queue entry, a\n// parameter) and nothing more. A VALUE export would hand them the class object, and with it the static\n// `capture(...)`, whose capability token a cast can supply even though this barrel never exports the\n// token's type: `CapturedContext.capture(null as never, new Map([['userId','victim']]))` would compile\n// and forge a proven identity — the exact hole this whole change closes. A type-only export removes the\n// class object from the package surface, so there is no factory to reach and copyContext() really is\n// the only producer. (ContextCaptureAuthority is not exported here in any form.)\nexport type { CapturedContext } from './CapturedContext';\n// The narrowed snapshot — what withTrusted() / withoutTrusted() produce and what\n// runWithContext()/restoreContext() accept. A bare CapturedContext is NOT accepted by either, so every\n// call site states whether the proven identity travels with the work (`grep -rn withTrusted`) or is\n// deliberately dropped (`grep -rn withoutTrusted`). Type-only for the same reason as above: with no\n// class object on the surface there is no `of(...)` factory to reach, cast or not.\nexport type { RestorableContext } from './CapturedContext';\n// SERVER impl of the core-util ApiCallContext seam, bound to RequestContext. There is no install and\n// no side effect: each node package that logs api calls (LogApiFilter, NodeProxyClient,\n// TaskProxyClient) CONSTRUCTS one and hands it to its own LogApiCallImpl.\nexport { RequestContextApiCallContext } from './RequestContextApiCallContext';\n// Transport-neutral request stored in the context (http-routing's request type; re-exported there)\nexport { HttpRequest, RawHttpRequest } from './HttpRequest';\n// The verbatim bytes + absolute url a webhook SIGNATURE is computed over ({ rawBody: true } routes).\nexport { RawRequest } from './RawRequest';\n\n// DI provider decorators (shared DI seam; http-routing re-exports for back-compat)\nexport { provideSingletonDefaultForApi } from './provide';\n// Guice-style Provider<T> — lazy singleton OR fresh-per-get, decided by T's binding scope.\nexport { Provider } from './provide';\n// Framework-only DI registry (packages/** use these; keeps framework classes out of a\n// client's buildProviderModule() global scan). See frameworkProvide.ts.\nexport {\n    provideFrameworkSingleton,\n    provideFrameworkSingletonDefaultForApi,\n    provideFrameworkTransient,\n    bindFrameworkProvider,\n    buildFrameworkModule,\n} from './frameworkProvide';\nexport type { FrameworkScope } from './frameworkProvide';\n\n// Outbound headers for a SERVER: reads RequestContext directly, fails fast outside\n// RequestContext.run(...). Server-side clients (http-client-node, cloudtasks-client) and\n// http-routing use THIS.\n//\n// ContextMgr is deliberately NOT re-exported. It is the browser's answer (an app-held store),\n// and only @webpieces/http-client-browser may name it — importing it here would let a node\n// package reach for a ContextReader it has no use for.\nexport { RequestContextHeaders } from './RequestContextHeaders';\n// The browser store's server counterpart, still used by the logging packages + http-server filters.\nexport { RequestContextReader } from './RequestContextReader';\nexport { PendingWireTrust, PendingTrustedValue } from './PendingWireTrust';\nexport { StreamEventContext } from './StreamEventContext';\n"]}