@webpieces/http-client-node 0.4.698 → 0.4.700

package/README.md

@@ -5,10 +5,18 @@ the Cloud Tasks twin — calling a method makes the HTTP request that contract d
 
 ```ts
 // inject the factory (a framework singleton), then one client per contract
-const server2 = factory.createRpcClient(Server2Api, new ClientConfig('server2'));
+const server2 = factory.createRpcClient(
+    Server2Api,
+    new ClientConfig('server2', new DeployedServiceHost()),
+    [],                                             // this client's outbound filters
+);
 const res = await server2.fetchValue(req);          // inside a RequestContext
 ```
 
+Every `ClientConfig` states WHERE its requests go, because there are two kinds of destination and
+they carry very different risk. `DeployedServiceHost` is the one above and is what almost every
+client wants. See "A destination supplied at RUNTIME" below for the other.
+
 - `svcName` becomes a URL through `ClientRegistry.resolve` — ONE chain, the same one the browser
   client and Cloud Tasks run:
   1. a registered mapping wins: `ClientRegistry.addMapping(svcName, port)` (localhost) or
@@ -32,3 +40,69 @@ request-id chain loses the trace, and finding that out in production is worse th
 top-level server filter normally establishes the scope for you.
 
 The browser twin is [@webpieces/http-client-browser](../http-client-browser).
+
+## A destination supplied at RUNTIME
+
+Some destinations are DATA, not deployment: a URL a partner registered (`OrganizationWebhook.url`),
+an OAuth callback, a per-tenant or self-hosted host. There is no `svcName` to resolve and nothing to
+register, but there IS a contract — the payload is fully specified and published to customers. Name
+a runtime host policy and the base URL arrives per call:
+
+```ts
+const partner = factory.createRpcClient(
+    PartnerWebhookApi,
+    new ClientConfig('partner-webhooks', new RuntimeHostFromContext(new DnsAddressResolver())),
+    [new ClientFilterDefinition(500, new HmacSigningFilter(secret))],
+);
+
+for (const webhook of webhooks) {
+    await RequestContext.run(() => {
+        RequestContext.putUntrusted(WebpiecesCoreHeaders.OVERRIDE_BASE_URL, webhook.url);
+        return partner.deliver(envelope);
+    });
+}
+```
+
+- **It cannot leak.** The override lives on the per-call request, never on the client, so one client
+  fans out across N partner URLs and each call goes exactly where its own scope said.
+- **A `DeployedServiceHost` client IGNORES the key.** That is the point of making the policy a named
+  class: an ambient URL set for a partner delivery cannot re-point every other client in the same
+  request. `grep -rn RuntimeHostFromContext` lists every client that can be re-pointed at all.
+- **SSRF policy is ON.** https only; loopback / RFC1918 / link-local / cloud-metadata refused, by
+  name AND by every address the name resolves to; redirects are not followed by the transport but
+  re-judged hop by hop, so a partner URL that 302s at `169.254.169.254` is refused rather than
+  obeyed. The ONLY way to relax it is to say so out loud:
+  `new RuntimeHostFromContextAllowingInternalAddresses('local emulator on 127.0.0.1', resolver)`.
+- **`@AuthOidc` / `@AuthSharedSecret` endpoints are refused at bind time.** Both mint a credential
+  for a peer we chose; a destination that arrives per call has no honest audience, and minting one
+  would hand our credential to whoever registered the URL.
+- **The hop is VISIBLE.** `svcName` is still required under a runtime policy: it is the identity the
+  destination gets on the runtime architecture graph, drawn as an external node of kind `runtime`.
+
+## Outbound filters
+
+`createRpcClient`'s third argument is this client's OUTBOUND filter chain — the same `Filter` /
+`Service` abstraction (from `@webpieces/core-util`) the server's inbound chain uses, pointed the
+other way. A filter receives a mutable `ClientRequest` and returns the `Response`:
+
+```ts
+class HmacSigningFilter extends Filter<ClientRequest, Response> {
+    constructor(private readonly secret: string) { super(); }
+
+    async filter(request: ClientRequest, next: Service<ClientRequest, Response>): Promise<Response> {
+        // request.body is the EXACT serialized bytes the transport will send — sign those.
+        const mac = createHmac('sha256', this.secret).update(request.body ?? '').digest('hex');
+        request.headers.set('x-signature', `sha256=${mac}`);
+        return next.invoke(request);
+    }
+}
+```
+
+Highest priority runs OUTERMOST, matching the server's `FilterMatcher`. The framework's own
+built-ins occupy 1000 (the runtime base-URL override) and 900 (the SSRF guard), so an app filter
+below them sees the destination already settled.
+
+Signing over `request.body` is the whole reason this seam exists: the bytes a filter signs are the
+bytes transmitted, byte for byte. Without it a sender has to hand-serialize and post the payload
+itself, because a raw HTTP library that re-serializes internally signs one sequence and sends
+another.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webpieces/http-client-node",
-  "version": "0.4.698",
+  "version": "0.4.700",
   "description": "Server-side HTTP client for webpieces: inversify-wired, reads RequestContext directly, mints OIDC/shared-secret delivery auth, resolves Cloud Run URLs from a service name",
   "type": "commonjs",
   "main": "./src/index.js",
@@ -22,10 +22,10 @@
     "access": "public"
   },
   "dependencies": {
-    "@webpieces/core-context": "0.4.698",
-    "@webpieces/core-util": "0.4.698",
-    "@webpieces/gcp-identity": "0.4.698",
-    "@webpieces/http-client-core": "0.4.698",
+    "@webpieces/core-context": "0.4.700",
+    "@webpieces/core-util": "0.4.700",
+    "@webpieces/gcp-identity": "0.4.700",
+    "@webpieces/http-client-core": "0.4.700",
     "inversify": "7.10.4",
     "reflect-metadata": "0.2.2"
   }

package/src/AddressResolver.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Turns a hostname into the IP addresses it actually resolves to — the half of the SSRF check that
+ * has to touch the network, kept behind its own class so the policy itself is unit-testable without
+ * DNS and a test can hand the guard a resolver that answers whatever the case needs.
+ *
+ * ABSTRACT rather than an interface because it is a collaborator with behavior, and because
+ * @webpieces/core-mock and app tests substitute it by TYPE.
+ */
+export declare abstract class AddressResolver {
+    /**
+     * Every address `hostname` resolves to, as strings. ALL of them matter: a hostname that answers
+     * with one public address and one 127.0.0.1 is the classic DNS-rebinding shape, and a guard that
+     * checks only the first answer waves it through.
+     *
+     * @throws Error when the name does not resolve. The guard treats that as a refusal, not as a
+     *         pass — a destination we cannot even name is not one we should POST a payload to.
+     */
+    abstract resolve(hostname: string): Promise<string[]>;
+}
+/** The real one: node's DNS resolver, asking for every address family. */
+export declare class DnsAddressResolver extends AddressResolver {
+    resolve(hostname: string): Promise<string[]>;
+}

package/src/AddressResolver.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DnsAddressResolver = exports.AddressResolver = void 0;
+const tslib_1 = require("tslib");
+const promises_1 = require("node:dns/promises");
+const core_context_1 = require("@webpieces/core-context");
+/**
+ * Turns a hostname into the IP addresses it actually resolves to — the half of the SSRF check that
+ * has to touch the network, kept behind its own class so the policy itself is unit-testable without
+ * DNS and a test can hand the guard a resolver that answers whatever the case needs.
+ *
+ * ABSTRACT rather than an interface because it is a collaborator with behavior, and because
+ * @webpieces/core-mock and app tests substitute it by TYPE.
+ */
+class AddressResolver {
+}
+exports.AddressResolver = AddressResolver;
+/** The real one: node's DNS resolver, asking for every address family. */
+let DnsAddressResolver = class DnsAddressResolver extends AddressResolver {
+    async resolve(hostname) {
+        const answers = await (0, promises_1.lookup)(hostname, { all: true, verbatim: true });
+        return answers.map((answer) => answer.address);
+    }
+};
+exports.DnsAddressResolver = DnsAddressResolver;
+exports.DnsAddressResolver = DnsAddressResolver = tslib_1.__decorate([
+    (0, core_context_1.provideFrameworkSingleton)()
+], DnsAddressResolver);
+//# sourceMappingURL=AddressResolver.js.map

package/src/AddressResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AddressResolver.js","sourceRoot":"","sources":["../../../../../packages/http/http-client-node/src/AddressResolver.ts"],"names":[],"mappings":";;;;AACA,gDAA2C;AAC3C,0DAAoE;AAEpE;;;;;;;GAOG;AACH,MAAsB,eAAe;CAUpC;AAVD,0CAUC;AAED,0EAA0E;AAEnE,IAAM,kBAAkB,GAAxB,MAAM,kBAAmB,SAAQ,eAAe;IAC1C,KAAK,CAAC,OAAO,CAAC,QAAgB;QACnC,MAAM,OAAO,GAAoB,MAAM,IAAA,iBAAM,EAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACvF,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAqB,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClE,CAAC;CACJ,CAAA;AALY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,wCAAyB,GAAE;GACf,kBAAkB,CAK9B","sourcesContent":["import type { LookupAddress } from 'node:dns';\nimport { lookup } from 'node:dns/promises';\nimport { provideFrameworkSingleton } from '@webpieces/core-context';\n\n/**\n * Turns a hostname into the IP addresses it actually resolves to — the half of the SSRF check that\n * has to touch the network, kept behind its own class so the policy itself is unit-testable without\n * DNS and a test can hand the guard a resolver that answers whatever the case needs.\n *\n * ABSTRACT rather than an interface because it is a collaborator with behavior, and because\n * @webpieces/core-mock and app tests substitute it by TYPE.\n */\nexport abstract class AddressResolver {\n    /**\n     * Every address `hostname` resolves to, as strings. ALL of them matter: a hostname that answers\n     * with one public address and one 127.0.0.1 is the classic DNS-rebinding shape, and a guard that\n     * checks only the first answer waves it through.\n     *\n     * @throws Error when the name does not resolve. The guard treats that as a refusal, not as a\n     *         pass — a destination we cannot even name is not one we should POST a payload to.\n     */\n    abstract resolve(hostname: string): Promise<string[]>;\n}\n\n/** The real one: node's DNS resolver, asking for every address family. */\n@provideFrameworkSingleton()\nexport class DnsAddressResolver extends AddressResolver {\n    override async resolve(hostname: string): Promise<string[]> {\n        const answers: LookupAddress[] = await lookup(hostname, { all: true, verbatim: true });\n        return answers.map((answer: LookupAddress) => answer.address);\n    }\n}\n"]}

package/src/ClientConfig.d.ts

@@ -1,26 +1,56 @@
+import { HostPolicy } from './HostPolicy';
 /**
  * Per-client STATE for a server-side HTTP client — nothing else. A plain class; it extends nothing
  * and is unrelated to the browser package's ClientConfig, because the two answer "what URL?"
  * differently and share nothing worth a base class.
  *
  * Collaborators (RequestContextHeaders, Secrets) are NOT config: they are dependencies of
- * {@link NodeProxyClient} and are shared by every client the factory builds. This is the RPC twin
- * of cloudtasks-client's TaskClientConfig, and takes the same single field.
+ * {@link NodeProxyClient} and are shared by every client the factory builds. Outbound FILTERS are
+ * not config either — they are per-client collaborators an app constructs, so they are the third
+ * argument to `createRpcClient` rather than a field here.
  */
 export declare class ClientConfig {
     /**
-     * The service name. On GCP the URL is DERIVED from it (same project, same region — the Cloud
-     * Run service name, so you maintain no URL table), which works across demo/qa/prod. Anything
-     * the derivation cannot describe — a localhost port, another region/project, a non-Cloud-Run
-     * host — is a `ClientRegistry` mapping registered at startup, NOT a per-client URL.
+     * The service name.
+     *
+     * Under {@link DeployedServiceHost} the URL is DERIVED from it (on GCP: same project, same
+     * region — the Cloud Run service name, so you maintain no URL table), which works across
+     * demo/qa/prod. Anything the derivation cannot describe — a localhost port, another
+     * region/project, a non-Cloud-Run host — is a `ClientRegistry` mapping registered at
+     * startup, NOT a per-client URL.
+     *
+     * Under a runtime host policy nothing is derived from it, but it is still required and still
+     * load-bearing: it is the IDENTITY this outbound hop gets on the runtime architecture graph
+     * ('partner-webhooks'), which is what stops a partner delivery being an invisible edge.
      */
     readonly svcName: string;
+    /**
+     * WHERE this client's requests go: a service we deploy, or a host supplied per call at
+     * runtime. REQUIRED — see {@link HostPolicy} for why there is no default. The old
+     * one-argument `new ClientConfig('svc')` no longer compiles; write
+     * `new ClientConfig('svc', new DeployedServiceHost())` for the behaviour it used to have.
+     */
+    readonly hostPolicy: HostPolicy;
     constructor(
     /**
-     * The service name. On GCP the URL is DERIVED from it (same project, same region — the Cloud
-     * Run service name, so you maintain no URL table), which works across demo/qa/prod. Anything
-     * the derivation cannot describe — a localhost port, another region/project, a non-Cloud-Run
-     * host — is a `ClientRegistry` mapping registered at startup, NOT a per-client URL.
+     * The service name.
+     *
+     * Under {@link DeployedServiceHost} the URL is DERIVED from it (on GCP: same project, same
+     * region — the Cloud Run service name, so you maintain no URL table), which works across
+     * demo/qa/prod. Anything the derivation cannot describe — a localhost port, another
+     * region/project, a non-Cloud-Run host — is a `ClientRegistry` mapping registered at
+     * startup, NOT a per-client URL.
+     *
+     * Under a runtime host policy nothing is derived from it, but it is still required and still
+     * load-bearing: it is the IDENTITY this outbound hop gets on the runtime architecture graph
+     * ('partner-webhooks'), which is what stops a partner delivery being an invisible edge.
+     */
+    svcName: string, 
+    /**
+     * WHERE this client's requests go: a service we deploy, or a host supplied per call at
+     * runtime. REQUIRED — see {@link HostPolicy} for why there is no default. The old
+     * one-argument `new ClientConfig('svc')` no longer compiles; write
+     * `new ClientConfig('svc', new DeployedServiceHost())` for the behaviour it used to have.
      */
-    svcName: string);
+    hostPolicy: HostPolicy);
 }

package/src/ClientConfig.js

@@ -7,20 +7,37 @@ exports.ClientConfig = void 0;
  * differently and share nothing worth a base class.
  *
  * Collaborators (RequestContextHeaders, Secrets) are NOT config: they are dependencies of
- * {@link NodeProxyClient} and are shared by every client the factory builds. This is the RPC twin
- * of cloudtasks-client's TaskClientConfig, and takes the same single field.
+ * {@link NodeProxyClient} and are shared by every client the factory builds. Outbound FILTERS are
+ * not config either — they are per-client collaborators an app constructs, so they are the third
+ * argument to `createRpcClient` rather than a field here.
  */
 class ClientConfig {
     svcName;
+    hostPolicy;
     constructor(
     /**
-     * The service name. On GCP the URL is DERIVED from it (same project, same region — the Cloud
-     * Run service name, so you maintain no URL table), which works across demo/qa/prod. Anything
-     * the derivation cannot describe — a localhost port, another region/project, a non-Cloud-Run
-     * host — is a `ClientRegistry` mapping registered at startup, NOT a per-client URL.
+     * The service name.
+     *
+     * Under {@link DeployedServiceHost} the URL is DERIVED from it (on GCP: same project, same
+     * region — the Cloud Run service name, so you maintain no URL table), which works across
+     * demo/qa/prod. Anything the derivation cannot describe — a localhost port, another
+     * region/project, a non-Cloud-Run host — is a `ClientRegistry` mapping registered at
+     * startup, NOT a per-client URL.
+     *
+     * Under a runtime host policy nothing is derived from it, but it is still required and still
+     * load-bearing: it is the IDENTITY this outbound hop gets on the runtime architecture graph
+     * ('partner-webhooks'), which is what stops a partner delivery being an invisible edge.
      */
-    svcName) {
+    svcName, 
+    /**
+     * WHERE this client's requests go: a service we deploy, or a host supplied per call at
+     * runtime. REQUIRED — see {@link HostPolicy} for why there is no default. The old
+     * one-argument `new ClientConfig('svc')` no longer compiles; write
+     * `new ClientConfig('svc', new DeployedServiceHost())` for the behaviour it used to have.
+     */
+    hostPolicy) {
         this.svcName = svcName;
+        this.hostPolicy = hostPolicy;
     }
 }
 exports.ClientConfig = ClientConfig;

package/src/ClientConfig.js.map

@@ -1 +1 @@
-{"version":3,"file":"ClientConfig.js","sourceRoot":"","sources":["../../../../../packages/http/http-client-node/src/ClientConfig.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;GAQG;AACH,MAAa,YAAY;IAQD;IAPpB;IACI;;;;;OAKG;IACa,OAAe;QAAf,YAAO,GAAP,OAAO,CAAQ;IAChC,CAAC;CACP;AAVD,oCAUC","sourcesContent":["/**\n * Per-client STATE for a server-side HTTP client — nothing else. A plain class; it extends nothing\n * and is unrelated to the browser package's ClientConfig, because the two answer \"what URL?\"\n * differently and share nothing worth a base class.\n *\n * Collaborators (RequestContextHeaders, Secrets) are NOT config: they are dependencies of\n * {@link NodeProxyClient} and are shared by every client the factory builds. This is the RPC twin\n * of cloudtasks-client's TaskClientConfig, and takes the same single field.\n */\nexport class ClientConfig {\n    constructor(\n        /**\n         * The service name. On GCP the URL is DERIVED from it (same project, same region — the Cloud\n         * Run service name, so you maintain no URL table), which works across demo/qa/prod. Anything\n         * the derivation cannot describe — a localhost port, another region/project, a non-Cloud-Run\n         * host — is a `ClientRegistry` mapping registered at startup, NOT a per-client URL.\n         */\n        public readonly svcName: string,\n    ) {}\n}\n"]}
+{"version":3,"file":"ClientConfig.js","sourceRoot":"","sources":["../../../../../packages/http/http-client-node/src/ClientConfig.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;GASG;AACH,MAAa,YAAY;IAeD;IAOA;IArBpB;IACI;;;;;;;;;;;;OAYG;IACa,OAAe;IAC/B;;;;;OAKG;IACa,UAAsB;QAPtB,YAAO,GAAP,OAAO,CAAQ;QAOf,eAAU,GAAV,UAAU,CAAY;IACvC,CAAC;CACP;AAxBD,oCAwBC","sourcesContent":["import { HostPolicy } from './HostPolicy';\n\n/**\n * Per-client STATE for a server-side HTTP client — nothing else. A plain class; it extends nothing\n * and is unrelated to the browser package's ClientConfig, because the two answer \"what URL?\"\n * differently and share nothing worth a base class.\n *\n * Collaborators (RequestContextHeaders, Secrets) are NOT config: they are dependencies of\n * {@link NodeProxyClient} and are shared by every client the factory builds. Outbound FILTERS are\n * not config either — they are per-client collaborators an app constructs, so they are the third\n * argument to `createRpcClient` rather than a field here.\n */\nexport class ClientConfig {\n    constructor(\n        /**\n         * The service name.\n         *\n         * Under {@link DeployedServiceHost} the URL is DERIVED from it (on GCP: same project, same\n         * region — the Cloud Run service name, so you maintain no URL table), which works across\n         * demo/qa/prod. Anything the derivation cannot describe — a localhost port, another\n         * region/project, a non-Cloud-Run host — is a `ClientRegistry` mapping registered at\n         * startup, NOT a per-client URL.\n         *\n         * Under a runtime host policy nothing is derived from it, but it is still required and still\n         * load-bearing: it is the IDENTITY this outbound hop gets on the runtime architecture graph\n         * ('partner-webhooks'), which is what stops a partner delivery being an invisible edge.\n         */\n        public readonly svcName: string,\n        /**\n         * WHERE this client's requests go: a service we deploy, or a host supplied per call at\n         * runtime. REQUIRED — see {@link HostPolicy} for why there is no default. The old\n         * one-argument `new ClientConfig('svc')` no longer compiles; write\n         * `new ClientConfig('svc', new DeployedServiceHost())` for the behaviour it used to have.\n         */\n        public readonly hostPolicy: HostPolicy,\n    ) {}\n}\n"]}

package/src/ClientHttpFactory.d.ts

@@ -1,5 +1,6 @@
 import { Provider } from '@webpieces/core-context';
 import type { ApiPrototype } from '@webpieces/http-client-core';
+import { ClientFilterDefinition } from '@webpieces/http-client-core';
 import { ClientConfig } from './ClientConfig';
 import { NodeProxyClient } from './NodeProxyClient';
 /**
@@ -13,16 +14,26 @@ import { NodeProxyClient } from './NodeProxyClient';
  * Inject it and ask for a typed client per contract:
  * ```typescript
  * // same project + region as this container; the URL is derived, you maintain nothing
- * const server2 = factory.createRpcClient(Server2Api, new ClientConfig('server2'));
+ * const server2 = factory.createRpcClient(Server2Api, new ClientConfig('server2', new DeployedServiceHost()), []);
  *
  * // to reach somewhere derivation cannot describe (other region/project, non-Cloud-Run, localhost),
  * // register it once at startup — the client still carries only the svcName:
  * //   ClientRegistry.addUrlMapping('legacy', 'https://legacy.corp');
- * const legacy = factory.createRpcClient(LegacyApi, new ClientConfig('legacy'));
+ * const legacy = factory.createRpcClient(LegacyApi, new ClientConfig('legacy', new DeployedServiceHost()), []);
  *
  * const response = await server2.fetchValue(req);   // inside a RequestContext
  * ```
  *
+ * A destination that is DATA rather than deployment — a URL a partner registered — names a runtime
+ * host policy instead, and typically installs a signing filter over the exact bytes:
+ * ```typescript
+ * const partner = factory.createRpcClient(
+ *     PartnerWebhookApi,
+ *     new ClientConfig('partner-webhooks', new RuntimeHostFromContext(new DnsAddressResolver())),
+ *     [new ClientFilterDefinition(500, new HmacSigningFilter(secret))],
+ * );
+ * ```
+ *
  * Every client it builds shares one {@link NodeProxyClient} *shape* but never one instance: the
  * injected `Provider<NodeProxyClient>` hands out a fresh one per contract, which `createRpcClient`
  * then `init`s. Their collaborators (RequestContextHeaders, Secrets) come from the container, so
@@ -39,7 +50,13 @@ export declare class ClientHttpFactory {
      * Create a type-safe RPC (HTTP) client for one API contract.
      *
      * @param apiPrototype - The API prototype class with @ApiPath/@Endpoint decorators
-     * @param config - This client's state (its svcName)
+     * @param config - This client's state (its svcName and its host policy)
+     * @param filters - This client's OUTBOUND filters, each with the priority it runs at (highest
+     *        OUTERMOST). They wrap the send, so a filter sees the final URL, may add headers, and
+     *        may replace `ClientRequest.body` — the exact bytes transmitted, which is what makes
+     *        signing possible without hand-serializing. Pass `[]` for a client that needs none;
+     *        the argument is REQUIRED so "this client signs nothing" is written down rather than
+     *        inferred from an omitted argument.
      */
-    createRpcClient<T extends object>(apiPrototype: ApiPrototype<T>, config: ClientConfig): T;
+    createRpcClient<T extends object>(apiPrototype: ApiPrototype<T>, config: ClientConfig, filters: ClientFilterDefinition[]): T;
 }

package/src/ClientHttpFactory.js

@@ -21,16 +21,26 @@ const NodeProxyClient_1 = require("./NodeProxyClient");
  * Inject it and ask for a typed client per contract:
  * ```typescript
  * // same project + region as this container; the URL is derived, you maintain nothing
- * const server2 = factory.createRpcClient(Server2Api, new ClientConfig('server2'));
+ * const server2 = factory.createRpcClient(Server2Api, new ClientConfig('server2', new DeployedServiceHost()), []);
  *
  * // to reach somewhere derivation cannot describe (other region/project, non-Cloud-Run, localhost),
  * // register it once at startup — the client still carries only the svcName:
  * //   ClientRegistry.addUrlMapping('legacy', 'https://legacy.corp');
- * const legacy = factory.createRpcClient(LegacyApi, new ClientConfig('legacy'));
+ * const legacy = factory.createRpcClient(LegacyApi, new ClientConfig('legacy', new DeployedServiceHost()), []);
  *
  * const response = await server2.fetchValue(req);   // inside a RequestContext
  * ```
  *
+ * A destination that is DATA rather than deployment — a URL a partner registered — names a runtime
+ * host policy instead, and typically installs a signing filter over the exact bytes:
+ * ```typescript
+ * const partner = factory.createRpcClient(
+ *     PartnerWebhookApi,
+ *     new ClientConfig('partner-webhooks', new RuntimeHostFromContext(new DnsAddressResolver())),
+ *     [new ClientFilterDefinition(500, new HmacSigningFilter(secret))],
+ * );
+ * ```
+ *
  * Every client it builds shares one {@link NodeProxyClient} *shape* but never one instance: the
  * injected `Provider<NodeProxyClient>` hands out a fresh one per contract, which `createRpcClient`
  * then `init`s. Their collaborators (RequestContextHeaders, Secrets) come from the container, so
@@ -49,13 +59,19 @@ let ClientHttpFactory = class ClientHttpFactory {
      * Create a type-safe RPC (HTTP) client for one API contract.
      *
      * @param apiPrototype - The API prototype class with @ApiPath/@Endpoint decorators
-     * @param config - This client's state (its svcName)
+     * @param config - This client's state (its svcName and its host policy)
+     * @param filters - This client's OUTBOUND filters, each with the priority it runs at (highest
+     *        OUTERMOST). They wrap the send, so a filter sees the final URL, may add headers, and
+     *        may replace `ClientRequest.body` — the exact bytes transmitted, which is what makes
+     *        signing possible without hand-serializing. Pass `[]` for a client that needs none;
+     *        the argument is REQUIRED so "this client signs nothing" is written down rather than
+     *        inferred from an omitted argument.
      */
-    createRpcClient(apiPrototype, config) {
+    createRpcClient(apiPrototype, config, filters) {
         // Fresh instance per contract — NodeProxyClient is transient. init() binds it to this
         // contract + target; the collaborators already came from the container.
         const proxyClient = this.proxyClientProvider.get();
-        proxyClient.init(apiPrototype, config);
+        proxyClient.init(apiPrototype, config, filters);
         return (0, http_client_core_1.buildClientProxy)(apiPrototype, proxyClient);
     }
 };

package/src/ClientHttpFactory.js.map

@@ -1 +1 @@
-{"version":3,"file":"ClientHttpFactory.js","sourceRoot":"","sources":["../../../../../packages/http/http-client-node/src/ClientHttpFactory.ts"],"names":[],"mappings":";;;;AAAA,yCAAmC;AACnC,oDAAsD;AACtD,0DAAqG;AAErG,kEAA+D;AAE/D,uDAAgF;AAEhF,iGAAiG;AACjG,6EAA6E;AAC7E,IAAA,oCAAqB,EAAC,4CAA0B,EAAE,iCAAe,CAAC,CAAC;AAEnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAGI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAE+B;IADzD,YACyD,mBAA8C;QAA9C,wBAAmB,GAAnB,mBAAmB,CAA2B;IACpG,CAAC;IAEJ;;;;;OAKG;IACH,eAAe,CAAmB,YAA6B,EAAE,MAAoB;QACjF,sFAAsF;QACtF,wEAAwE;QACxE,MAAM,WAAW,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,CAAC;QACnD,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACvC,OAAO,IAAA,mCAAgB,EAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACvD,CAAC;CACJ,CAAA;AAlBY,8CAAiB;4BAAjB,iBAAiB;IAF7B,IAAA,0BAAc,GAAE;IAChB,IAAA,wCAAyB,GAAE;IAGnB,mBAAA,IAAA,kBAAM,EAAC,4CAA0B,CAAC,CAAA;6CAAuC,uBAAQ;GAF7E,iBAAiB,CAkB7B","sourcesContent":["import { inject } from 'inversify';\nimport { DocumentDesign } from '@webpieces/core-util';\nimport { Provider, bindFrameworkProvider, provideFrameworkSingleton } from '@webpieces/core-context';\nimport type { ApiPrototype } from '@webpieces/http-client-core';\nimport { buildClientProxy } from '@webpieces/http-client-core';\nimport { ClientConfig } from './ClientConfig';\nimport { NODE_PROXY_CLIENT_PROVIDER, NodeProxyClient } from './NodeProxyClient';\n\n// Teach the container how to hand out fresh NodeProxyClients. NodeProxyClient is bound TRANSIENT\n// (@provideFrameworkTransient), so each provider.get() constructs a new one.\nbindFrameworkProvider(NODE_PROXY_CLIENT_PROVIDER, NodeProxyClient);\n\n/**\n * ClientHttpFactory - builds type-safe HTTP clients from API prototypes carrying\n * @ApiPath/@Endpoint decorators. The SERVER-side factory.\n *\n * This is the client-side equivalent of ApiRoutingFactory:\n * - Server routing: ApiRoutingFactory reads decorators -> routes HTTP requests to controllers\n * - Server client:  ClientHttpFactory reads decorators -> generates HTTP requests from method calls\n *\n * Inject it and ask for a typed client per contract:\n * ```typescript\n * // same project + region as this container; the URL is derived, you maintain nothing\n * const server2 = factory.createRpcClient(Server2Api, new ClientConfig('server2'));\n *\n * // to reach somewhere derivation cannot describe (other region/project, non-Cloud-Run, localhost),\n * // register it once at startup — the client still carries only the svcName:\n * //   ClientRegistry.addUrlMapping('legacy', 'https://legacy.corp');\n * const legacy = factory.createRpcClient(LegacyApi, new ClientConfig('legacy'));\n *\n * const response = await server2.fetchValue(req);   // inside a RequestContext\n * ```\n *\n * Every client it builds shares one {@link NodeProxyClient} *shape* but never one instance: the\n * injected `Provider<NodeProxyClient>` hands out a fresh one per contract, which `createRpcClient`\n * then `init`s. Their collaborators (RequestContextHeaders, Secrets) come from the container, so\n * the whole dependency graph is visible in this package's design.html.\n *\n * Unlike @webpieces/http-client-browser this package is Node-only, so the factory IS the inversify\n * entry point and the magic context is read straight from the RequestContext. A call made outside\n * `RequestContext.run(...)` throws rather than silently dropping the trace.\n */\n@DocumentDesign()\n@provideFrameworkSingleton()\nexport class ClientHttpFactory {\n    constructor(\n        @inject(NODE_PROXY_CLIENT_PROVIDER) private readonly proxyClientProvider: Provider<NodeProxyClient>,\n    ) {}\n\n    /**\n     * Create a type-safe RPC (HTTP) client for one API contract.\n     *\n     * @param apiPrototype - The API prototype class with @ApiPath/@Endpoint decorators\n     * @param config - This client's state (its svcName)\n     */\n    createRpcClient<T extends object>(apiPrototype: ApiPrototype<T>, config: ClientConfig): T {\n        // Fresh instance per contract — NodeProxyClient is transient. init() binds it to this\n        // contract + target; the collaborators already came from the container.\n        const proxyClient = this.proxyClientProvider.get();\n        proxyClient.init(apiPrototype, config);\n        return buildClientProxy(apiPrototype, proxyClient);\n    }\n}\n"]}
+{"version":3,"file":"ClientHttpFactory.js","sourceRoot":"","sources":["../../../../../packages/http/http-client-node/src/ClientHttpFactory.ts"],"names":[],"mappings":";;;;AAAA,yCAAmC;AACnC,oDAAsD;AACtD,0DAAqG;AAErG,kEAAuF;AAEvF,uDAAgF;AAEhF,iGAAiG;AACjG,6EAA6E;AAC7E,IAAA,oCAAqB,EAAC,4CAA0B,EAAE,iCAAe,CAAC,CAAC;AAEnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAGI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAE+B;IADzD,YACyD,mBAA8C;QAA9C,wBAAmB,GAAnB,mBAAmB,CAA2B;IACpG,CAAC;IAEJ;;;;;;;;;;;OAWG;IACH,eAAe,CACX,YAA6B,EAC7B,MAAoB,EACpB,OAAiC;QAEjC,sFAAsF;QACtF,wEAAwE;QACxE,MAAM,WAAW,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,CAAC;QACnD,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAChD,OAAO,IAAA,mCAAgB,EAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACvD,CAAC;CACJ,CAAA;AA5BY,8CAAiB;4BAAjB,iBAAiB;IAF7B,IAAA,0BAAc,GAAE;IAChB,IAAA,wCAAyB,GAAE;IAGnB,mBAAA,IAAA,kBAAM,EAAC,4CAA0B,CAAC,CAAA;6CAAuC,uBAAQ;GAF7E,iBAAiB,CA4B7B","sourcesContent":["import { inject } from 'inversify';\nimport { DocumentDesign } from '@webpieces/core-util';\nimport { Provider, bindFrameworkProvider, provideFrameworkSingleton } from '@webpieces/core-context';\nimport type { ApiPrototype } from '@webpieces/http-client-core';\nimport { buildClientProxy, ClientFilterDefinition } from '@webpieces/http-client-core';\nimport { ClientConfig } from './ClientConfig';\nimport { NODE_PROXY_CLIENT_PROVIDER, NodeProxyClient } from './NodeProxyClient';\n\n// Teach the container how to hand out fresh NodeProxyClients. NodeProxyClient is bound TRANSIENT\n// (@provideFrameworkTransient), so each provider.get() constructs a new one.\nbindFrameworkProvider(NODE_PROXY_CLIENT_PROVIDER, NodeProxyClient);\n\n/**\n * ClientHttpFactory - builds type-safe HTTP clients from API prototypes carrying\n * @ApiPath/@Endpoint decorators. The SERVER-side factory.\n *\n * This is the client-side equivalent of ApiRoutingFactory:\n * - Server routing: ApiRoutingFactory reads decorators -> routes HTTP requests to controllers\n * - Server client:  ClientHttpFactory reads decorators -> generates HTTP requests from method calls\n *\n * Inject it and ask for a typed client per contract:\n * ```typescript\n * // same project + region as this container; the URL is derived, you maintain nothing\n * const server2 = factory.createRpcClient(Server2Api, new ClientConfig('server2', new DeployedServiceHost()), []);\n *\n * // to reach somewhere derivation cannot describe (other region/project, non-Cloud-Run, localhost),\n * // register it once at startup — the client still carries only the svcName:\n * //   ClientRegistry.addUrlMapping('legacy', 'https://legacy.corp');\n * const legacy = factory.createRpcClient(LegacyApi, new ClientConfig('legacy', new DeployedServiceHost()), []);\n *\n * const response = await server2.fetchValue(req);   // inside a RequestContext\n * ```\n *\n * A destination that is DATA rather than deployment — a URL a partner registered — names a runtime\n * host policy instead, and typically installs a signing filter over the exact bytes:\n * ```typescript\n * const partner = factory.createRpcClient(\n *     PartnerWebhookApi,\n *     new ClientConfig('partner-webhooks', new RuntimeHostFromContext(new DnsAddressResolver())),\n *     [new ClientFilterDefinition(500, new HmacSigningFilter(secret))],\n * );\n * ```\n *\n * Every client it builds shares one {@link NodeProxyClient} *shape* but never one instance: the\n * injected `Provider<NodeProxyClient>` hands out a fresh one per contract, which `createRpcClient`\n * then `init`s. Their collaborators (RequestContextHeaders, Secrets) come from the container, so\n * the whole dependency graph is visible in this package's design.html.\n *\n * Unlike @webpieces/http-client-browser this package is Node-only, so the factory IS the inversify\n * entry point and the magic context is read straight from the RequestContext. A call made outside\n * `RequestContext.run(...)` throws rather than silently dropping the trace.\n */\n@DocumentDesign()\n@provideFrameworkSingleton()\nexport class ClientHttpFactory {\n    constructor(\n        @inject(NODE_PROXY_CLIENT_PROVIDER) private readonly proxyClientProvider: Provider<NodeProxyClient>,\n    ) {}\n\n    /**\n     * Create a type-safe RPC (HTTP) client for one API contract.\n     *\n     * @param apiPrototype - The API prototype class with @ApiPath/@Endpoint decorators\n     * @param config - This client's state (its svcName and its host policy)\n     * @param filters - This client's OUTBOUND filters, each with the priority it runs at (highest\n     *        OUTERMOST). They wrap the send, so a filter sees the final URL, may add headers, and\n     *        may replace `ClientRequest.body` — the exact bytes transmitted, which is what makes\n     *        signing possible without hand-serializing. Pass `[]` for a client that needs none;\n     *        the argument is REQUIRED so \"this client signs nothing\" is written down rather than\n     *        inferred from an omitted argument.\n     */\n    createRpcClient<T extends object>(\n        apiPrototype: ApiPrototype<T>,\n        config: ClientConfig,\n        filters: ClientFilterDefinition[],\n    ): T {\n        // Fresh instance per contract — NodeProxyClient is transient. init() binds it to this\n        // contract + target; the collaborators already came from the container.\n        const proxyClient = this.proxyClientProvider.get();\n        proxyClient.init(apiPrototype, config, filters);\n        return buildClientProxy(apiPrototype, proxyClient);\n    }\n}\n"]}

package/src/ContextBaseUrlOverrideFilter.d.ts

@@ -0,0 +1,38 @@
+import { Filter, Service } from '@webpieces/core-util';
+import { ClientRequest } from '@webpieces/http-client-core';
+/**
+ * Reads {@link WebpiecesCoreHeaders.OVERRIDE_BASE_URL} out of the ambient RequestContext and points
+ * THIS ONE CALL at it.
+ *
+ * This is the filter the whole runtime-base-URL feature is built out of, and expressing it as a
+ * filter rather than as a special case inside the transport is the point: information from OUTSIDE
+ * the call (a URL a partner registered, sitting in a database column) crosses into the send path
+ * through the same seam an app's own signing filter uses, and everything below it in the chain —
+ * the SSRF guard, the app's signature — sees the destination this filter chose rather than the one
+ * `ClientConfig` bound at construction.
+ *
+ * ## Scope, and why it cannot leak
+ *
+ * It mutates the per-call {@link ClientRequest} and nothing else. The client is untouched, so the
+ * next call through the same client starts from its configured host again; and the context entry is
+ * scoped to whatever `RequestContext.run(...)` the caller established, so a fan-out loop that sets a
+ * different URL per partner gets exactly the URL it set, per iteration.
+ *
+ * It is installed ONLY by the runtime host policies, so a client bound to a deployed service never
+ * reads the key at all. That is what stops an ambient value set for a partner delivery from silently
+ * re-pointing every other client in the same request at the partner's server.
+ *
+ * Priority {@link BASE_URL_OVERRIDE_PRIORITY} — the OUTERMOST framework filter, so the destination
+ * is settled before anything else looks at it.
+ */
+export declare class ContextBaseUrlOverrideFilter extends Filter<ClientRequest, Response> {
+    filter(request: ClientRequest, nextFilter: Service<ClientRequest, Response>): Promise<Response>;
+}
+/**
+ * The priority the override filter runs at — OUTERMOST of everything, because every other filter's
+ * job depends on knowing where the call is going. Exported so an app can see what it is ordering
+ * against rather than guessing at a magic number.
+ */
+export declare const BASE_URL_OVERRIDE_PRIORITY = 1000;
+/** The SSRF guard's priority: immediately inside the override, so it judges the URL that won. */
+export declare const SSRF_GUARD_PRIORITY = 900;

package/src/ContextBaseUrlOverrideFilter.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SSRF_GUARD_PRIORITY = exports.BASE_URL_OVERRIDE_PRIORITY = exports.ContextBaseUrlOverrideFilter = void 0;
+const core_util_1 = require("@webpieces/core-util");
+const core_context_1 = require("@webpieces/core-context");
+const RuntimeHostErrors_1 = require("./RuntimeHostErrors");
+/**
+ * Reads {@link WebpiecesCoreHeaders.OVERRIDE_BASE_URL} out of the ambient RequestContext and points
+ * THIS ONE CALL at it.
+ *
+ * This is the filter the whole runtime-base-URL feature is built out of, and expressing it as a
+ * filter rather than as a special case inside the transport is the point: information from OUTSIDE
+ * the call (a URL a partner registered, sitting in a database column) crosses into the send path
+ * through the same seam an app's own signing filter uses, and everything below it in the chain —
+ * the SSRF guard, the app's signature — sees the destination this filter chose rather than the one
+ * `ClientConfig` bound at construction.
+ *
+ * ## Scope, and why it cannot leak
+ *
+ * It mutates the per-call {@link ClientRequest} and nothing else. The client is untouched, so the
+ * next call through the same client starts from its configured host again; and the context entry is
+ * scoped to whatever `RequestContext.run(...)` the caller established, so a fan-out loop that sets a
+ * different URL per partner gets exactly the URL it set, per iteration.
+ *
+ * It is installed ONLY by the runtime host policies, so a client bound to a deployed service never
+ * reads the key at all. That is what stops an ambient value set for a partner delivery from silently
+ * re-pointing every other client in the same request at the partner's server.
+ *
+ * Priority {@link BASE_URL_OVERRIDE_PRIORITY} — the OUTERMOST framework filter, so the destination
+ * is settled before anything else looks at it.
+ */
+class ContextBaseUrlOverrideFilter extends core_util_1.Filter {
+    async filter(request, nextFilter) {
+        const override = core_context_1.RequestContext.getUntrusted(core_util_1.WebpiecesCoreHeaders.OVERRIDE_BASE_URL);
+        if (override === undefined || override === '') {
+            throw new RuntimeHostErrors_1.MissingRuntimeBaseUrlError(`${request.contractName}.${request.route.methodName} is a RUNTIME-HOST client, so its ` +
+                `destination must be supplied per call, but no ` +
+                `WebpiecesCoreHeaders.OVERRIDE_BASE_URL was found in the RequestContext. Set it around ` +
+                `the call:\n` +
+                `    RequestContext.putUntrusted(WebpiecesCoreHeaders.OVERRIDE_BASE_URL, webhook.url);\n` +
+                `Refusing rather than falling back to a derived service URL is deliberate: a silent ` +
+                `fallback would send a partner's payload to one of our own services.`, `${request.contractName}.${request.route.methodName}`);
+        }
+        request.pointAtBaseUrl(override);
+        return nextFilter.invoke(request);
+    }
+}
+exports.ContextBaseUrlOverrideFilter = ContextBaseUrlOverrideFilter;
+/**
+ * The priority the override filter runs at — OUTERMOST of everything, because every other filter's
+ * job depends on knowing where the call is going. Exported so an app can see what it is ordering
+ * against rather than guessing at a magic number.
+ */
+exports.BASE_URL_OVERRIDE_PRIORITY = 1000;
+/** The SSRF guard's priority: immediately inside the override, so it judges the URL that won. */
+exports.SSRF_GUARD_PRIORITY = 900;
+//# sourceMappingURL=ContextBaseUrlOverrideFilter.js.map

package/src/ContextBaseUrlOverrideFilter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ContextBaseUrlOverrideFilter.js","sourceRoot":"","sources":["../../../../../packages/http/http-client-node/src/ContextBaseUrlOverrideFilter.ts"],"names":[],"mappings":";;;AAAA,oDAA6E;AAC7E,0DAAyD;AAEzD,2DAAiE;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAa,4BAA6B,SAAQ,kBAA+B;IACpE,KAAK,CAAC,MAAM,CAAC,OAAsB,EAAE,UAA4C;QACtF,MAAM,QAAQ,GAAG,6BAAc,CAAC,YAAY,CAAC,gCAAoB,CAAC,iBAAiB,CAAC,CAAC;QACrF,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YAC5C,MAAM,IAAI,8CAA0B,CAChC,GAAG,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,KAAK,CAAC,UAAU,oCAAoC;gBACnF,gDAAgD;gBAChD,wFAAwF;gBACxF,aAAa;gBACb,yFAAyF;gBACzF,qFAAqF;gBACrF,qEAAqE,EACzE,GAAG,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,CACxD,CAAC;QACN,CAAC;QACD,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACjC,OAAO,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;CACJ;AAlBD,oEAkBC;AAED;;;;GAIG;AACU,QAAA,0BAA0B,GAAG,IAAI,CAAC;AAE/C,iGAAiG;AACpF,QAAA,mBAAmB,GAAG,GAAG,CAAC","sourcesContent":["import { Filter, Service, WebpiecesCoreHeaders } from '@webpieces/core-util';\nimport { RequestContext } from '@webpieces/core-context';\nimport { ClientRequest } from '@webpieces/http-client-core';\nimport { MissingRuntimeBaseUrlError } from './RuntimeHostErrors';\n\n/**\n * Reads {@link WebpiecesCoreHeaders.OVERRIDE_BASE_URL} out of the ambient RequestContext and points\n * THIS ONE CALL at it.\n *\n * This is the filter the whole runtime-base-URL feature is built out of, and expressing it as a\n * filter rather than as a special case inside the transport is the point: information from OUTSIDE\n * the call (a URL a partner registered, sitting in a database column) crosses into the send path\n * through the same seam an app's own signing filter uses, and everything below it in the chain —\n * the SSRF guard, the app's signature — sees the destination this filter chose rather than the one\n * `ClientConfig` bound at construction.\n *\n * ## Scope, and why it cannot leak\n *\n * It mutates the per-call {@link ClientRequest} and nothing else. The client is untouched, so the\n * next call through the same client starts from its configured host again; and the context entry is\n * scoped to whatever `RequestContext.run(...)` the caller established, so a fan-out loop that sets a\n * different URL per partner gets exactly the URL it set, per iteration.\n *\n * It is installed ONLY by the runtime host policies, so a client bound to a deployed service never\n * reads the key at all. That is what stops an ambient value set for a partner delivery from silently\n * re-pointing every other client in the same request at the partner's server.\n *\n * Priority {@link BASE_URL_OVERRIDE_PRIORITY} — the OUTERMOST framework filter, so the destination\n * is settled before anything else looks at it.\n */\nexport class ContextBaseUrlOverrideFilter extends Filter<ClientRequest, Response> {\n    override async filter(request: ClientRequest, nextFilter: Service<ClientRequest, Response>): Promise<Response> {\n        const override = RequestContext.getUntrusted(WebpiecesCoreHeaders.OVERRIDE_BASE_URL);\n        if (override === undefined || override === '') {\n            throw new MissingRuntimeBaseUrlError(\n                `${request.contractName}.${request.route.methodName} is a RUNTIME-HOST client, so its ` +\n                    `destination must be supplied per call, but no ` +\n                    `WebpiecesCoreHeaders.OVERRIDE_BASE_URL was found in the RequestContext. Set it around ` +\n                    `the call:\\n` +\n                    `    RequestContext.putUntrusted(WebpiecesCoreHeaders.OVERRIDE_BASE_URL, webhook.url);\\n` +\n                    `Refusing rather than falling back to a derived service URL is deliberate: a silent ` +\n                    `fallback would send a partner's payload to one of our own services.`,\n                `${request.contractName}.${request.route.methodName}`,\n            );\n        }\n        request.pointAtBaseUrl(override);\n        return nextFilter.invoke(request);\n    }\n}\n\n/**\n * The priority the override filter runs at — OUTERMOST of everything, because every other filter's\n * job depends on knowing where the call is going. Exported so an app can see what it is ordering\n * against rather than guessing at a magic number.\n */\nexport const BASE_URL_OVERRIDE_PRIORITY = 1000;\n\n/** The SSRF guard's priority: immediately inside the override, so it judges the URL that won. */\nexport const SSRF_GUARD_PRIORITY = 900;\n"]}