@webpieces/http-client-node 0.4.700 → 0.4.701

package/src/ClientHttpFactory.js.map

@@ -1 +1 @@
-{"version":3,"file":"ClientHttpFactory.js","sourceRoot":"","sources":["../../../../../packages/http/http-client-node/src/ClientHttpFactory.ts"],"names":[],"mappings":";;;;AAAA,yCAAmC;AACnC,oDAAsD;AACtD,0DAAqG;AAErG,kEAAuF;AAEvF,uDAAgF;AAEhF,iGAAiG;AACjG,6EAA6E;AAC7E,IAAA,oCAAqB,EAAC,4CAA0B,EAAE,iCAAe,CAAC,CAAC;AAEnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAGI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAE+B;IADzD,YACyD,mBAA8C;QAA9C,wBAAmB,GAAnB,mBAAmB,CAA2B;IACpG,CAAC;IAEJ;;;;;;;;;;;OAWG;IACH,eAAe,CACX,YAA6B,EAC7B,MAAoB,EACpB,OAAiC;QAEjC,sFAAsF;QACtF,wEAAwE;QACxE,MAAM,WAAW,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,CAAC;QACnD,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAChD,OAAO,IAAA,mCAAgB,EAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACvD,CAAC;CACJ,CAAA;AA5BY,8CAAiB;4BAAjB,iBAAiB;IAF7B,IAAA,0BAAc,GAAE;IAChB,IAAA,wCAAyB,GAAE;IAGnB,mBAAA,IAAA,kBAAM,EAAC,4CAA0B,CAAC,CAAA;6CAAuC,uBAAQ;GAF7E,iBAAiB,CA4B7B","sourcesContent":["import { inject } from 'inversify';\nimport { DocumentDesign } from '@webpieces/core-util';\nimport { Provider, bindFrameworkProvider, provideFrameworkSingleton } from '@webpieces/core-context';\nimport type { ApiPrototype } from '@webpieces/http-client-core';\nimport { buildClientProxy, ClientFilterDefinition } from '@webpieces/http-client-core';\nimport { ClientConfig } from './ClientConfig';\nimport { NODE_PROXY_CLIENT_PROVIDER, NodeProxyClient } from './NodeProxyClient';\n\n// Teach the container how to hand out fresh NodeProxyClients. NodeProxyClient is bound TRANSIENT\n// (@provideFrameworkTransient), so each provider.get() constructs a new one.\nbindFrameworkProvider(NODE_PROXY_CLIENT_PROVIDER, NodeProxyClient);\n\n/**\n * ClientHttpFactory - builds type-safe HTTP clients from API prototypes carrying\n * @ApiPath/@Endpoint decorators. The SERVER-side factory.\n *\n * This is the client-side equivalent of ApiRoutingFactory:\n * - Server routing: ApiRoutingFactory reads decorators -> routes HTTP requests to controllers\n * - Server client:  ClientHttpFactory reads decorators -> generates HTTP requests from method calls\n *\n * Inject it and ask for a typed client per contract:\n * ```typescript\n * // same project + region as this container; the URL is derived, you maintain nothing\n * const server2 = factory.createRpcClient(Server2Api, new ClientConfig('server2', new DeployedServiceHost()), []);\n *\n * // to reach somewhere derivation cannot describe (other region/project, non-Cloud-Run, localhost),\n * // register it once at startup — the client still carries only the svcName:\n * //   ClientRegistry.addUrlMapping('legacy', 'https://legacy.corp');\n * const legacy = factory.createRpcClient(LegacyApi, new ClientConfig('legacy', new DeployedServiceHost()), []);\n *\n * const response = await server2.fetchValue(req);   // inside a RequestContext\n * ```\n *\n * A destination that is DATA rather than deployment — a URL a partner registered — names a runtime\n * host policy instead, and typically installs a signing filter over the exact bytes:\n * ```typescript\n * const partner = factory.createRpcClient(\n *     PartnerWebhookApi,\n *     new ClientConfig('partner-webhooks', new RuntimeHostFromContext(new DnsAddressResolver())),\n *     [new ClientFilterDefinition(500, new HmacSigningFilter(secret))],\n * );\n * ```\n *\n * Every client it builds shares one {@link NodeProxyClient} *shape* but never one instance: the\n * injected `Provider<NodeProxyClient>` hands out a fresh one per contract, which `createRpcClient`\n * then `init`s. Their collaborators (RequestContextHeaders, Secrets) come from the container, so\n * the whole dependency graph is visible in this package's design.html.\n *\n * Unlike @webpieces/http-client-browser this package is Node-only, so the factory IS the inversify\n * entry point and the magic context is read straight from the RequestContext. A call made outside\n * `RequestContext.run(...)` throws rather than silently dropping the trace.\n */\n@DocumentDesign()\n@provideFrameworkSingleton()\nexport class ClientHttpFactory {\n    constructor(\n        @inject(NODE_PROXY_CLIENT_PROVIDER) private readonly proxyClientProvider: Provider<NodeProxyClient>,\n    ) {}\n\n    /**\n     * Create a type-safe RPC (HTTP) client for one API contract.\n     *\n     * @param apiPrototype - The API prototype class with @ApiPath/@Endpoint decorators\n     * @param config - This client's state (its svcName and its host policy)\n     * @param filters - This client's OUTBOUND filters, each with the priority it runs at (highest\n     *        OUTERMOST). They wrap the send, so a filter sees the final URL, may add headers, and\n     *        may replace `ClientRequest.body` — the exact bytes transmitted, which is what makes\n     *        signing possible without hand-serializing. Pass `[]` for a client that needs none;\n     *        the argument is REQUIRED so \"this client signs nothing\" is written down rather than\n     *        inferred from an omitted argument.\n     */\n    createRpcClient<T extends object>(\n        apiPrototype: ApiPrototype<T>,\n        config: ClientConfig,\n        filters: ClientFilterDefinition[],\n    ): T {\n        // Fresh instance per contract — NodeProxyClient is transient. init() binds it to this\n        // contract + target; the collaborators already came from the container.\n        const proxyClient = this.proxyClientProvider.get();\n        proxyClient.init(apiPrototype, config, filters);\n        return buildClientProxy(apiPrototype, proxyClient);\n    }\n}\n"]}
+{"version":3,"file":"ClientHttpFactory.js","sourceRoot":"","sources":["../../../../../packages/http/http-client-node/src/ClientHttpFactory.ts"],"names":[],"mappings":";;;;AAAA,yCAAmC;AACnC,oDAAsD;AACtD,0DAAqG;AAErG,kEAA+D;AAG/D,uDAAgF;AAEhF,iGAAiG;AACjG,6EAA6E;AAC7E,IAAA,oCAAqB,EAAC,4CAA0B,EAAE,iCAAe,CAAC,CAAC;AAEnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAGI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAE+B;IADzD,YACyD,mBAA8C;QAA9C,wBAAmB,GAAnB,mBAAmB,CAA2B;IACpG,CAAC;IAEJ;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,eAAe,CACX,YAA6B,EAC7B,MAAoB,EACpB,OAAuB;QAEvB,sFAAsF;QACtF,wEAAwE;QACxE,MAAM,WAAW,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,CAAC;QACnD,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;QAClF,OAAO,IAAA,mCAAgB,EAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACvD,CAAC;CACJ,CAAA;AAtCY,8CAAiB;4BAAjB,iBAAiB;IAF7B,IAAA,0BAAc,GAAE;IAChB,IAAA,wCAAyB,GAAE;IAGnB,mBAAA,IAAA,kBAAM,EAAC,4CAA0B,CAAC,CAAA;6CAAuC,uBAAQ;GAF7E,iBAAiB,CAsC7B","sourcesContent":["import { inject } from 'inversify';\nimport { DocumentDesign } from '@webpieces/core-util';\nimport { Provider, bindFrameworkProvider, provideFrameworkSingleton } from '@webpieces/core-context';\nimport type { ApiPrototype } from '@webpieces/http-client-core';\nimport { buildClientProxy } from '@webpieces/http-client-core';\nimport type { ClientFilters } from '@webpieces/http-client-core';\nimport { ClientConfig } from './ClientConfig';\nimport { NODE_PROXY_CLIENT_PROVIDER, NodeProxyClient } from './NodeProxyClient';\n\n// Teach the container how to hand out fresh NodeProxyClients. NodeProxyClient is bound TRANSIENT\n// (@provideFrameworkTransient), so each provider.get() constructs a new one.\nbindFrameworkProvider(NODE_PROXY_CLIENT_PROVIDER, NodeProxyClient);\n\n/**\n * ClientHttpFactory - builds type-safe HTTP clients from API prototypes carrying\n * @ApiPath/@Endpoint decorators. The SERVER-side factory.\n *\n * This is the client-side equivalent of ApiRoutingFactory:\n * - Server routing: ApiRoutingFactory reads decorators -> routes HTTP requests to controllers\n * - Server client:  ClientHttpFactory reads decorators -> generates HTTP requests from method calls\n *\n * Inject it and ask for a typed client per contract:\n * ```typescript\n * // same project + region as this container; the URL is derived, you maintain nothing\n * const server2 = factory.createRpcClient(Server2Api, new ClientConfig('server2'));\n *\n * // to reach somewhere derivation cannot describe (other region/project, non-Cloud-Run, localhost),\n * // register it once at startup — the client still carries only the svcName:\n * //   ClientRegistry.addUrlMapping('legacy', 'https://legacy.corp');\n * const legacy = factory.createRpcClient(LegacyApi, new ClientConfig('legacy'));\n *\n * const response = await server2.fetchValue(req);   // inside a RequestContext\n * ```\n *\n * A destination that is DATA rather than deployment — a URL a partner registered — is a FILTER, not\n * a different kind of client. Install `ContextBaseUrlFilter` on the one client that may be\n * re-pointed, and set the URL per call:\n * ```typescript\n * const partner = factory.createRpcClient(PartnerWebhookApi, new ClientConfig('partner-webhooks'), [\n *     new ClientFilterDefinition(1000, new ContextBaseUrlFilter()),\n * ]);\n * ```\n * The SSRF guard arms itself the moment that filter re-points a request, and the contract's\n * `@AuthWebhook(name)` selects the app's bound `WebhookSignerCallback` to sign the exact bytes —\n * neither is something the app registers, orders, or can displace.\n *\n * Every client it builds shares one {@link NodeProxyClient} *shape* but never one instance: the\n * injected `Provider<NodeProxyClient>` hands out a fresh one per contract, which `createRpcClient`\n * then `init`s. Their collaborators (RequestContextHeaders, Secrets) come from the container, so\n * the whole dependency graph is visible in this package's design.html.\n *\n * Unlike @webpieces/http-client-browser this package is Node-only, so the factory IS the inversify\n * entry point and the magic context is read straight from the RequestContext. A call made outside\n * `RequestContext.run(...)` throws rather than silently dropping the trace.\n */\n@DocumentDesign()\n@provideFrameworkSingleton()\nexport class ClientHttpFactory {\n    constructor(\n        @inject(NODE_PROXY_CLIENT_PROVIDER) private readonly proxyClientProvider: Provider<NodeProxyClient>,\n    ) {}\n\n    /**\n     * Create a type-safe RPC (HTTP) client for one API contract.\n     *\n     * @param apiPrototype - The API prototype class with @ApiPath/@Endpoint decorators\n     * @param config - This client's state: its svcName, which is what `ClientRegistry` resolves\n     * @param filters - This client's own OUTBOUND filters, each with the priority it runs at\n     *        (highest OUTERMOST). They wrap the send, so a filter may rewrite the URL, add or remove\n     *        headers, log, or replace `ClientRequest.body` — the exact bytes transmitted. What goes\n     *        here is APP behaviour: url rewriting, headers, logging, and `ContextBaseUrlFilter` when\n     *        this client's destination arrives per call.\n     *\n     *        OPTIONAL, and omitting it is not a statement about security: the framework's own SSRF\n     *        guard and credential minter are installed on every client regardless, BENEATH anything\n     *        passed here, so there is nothing an app can decline by writing nothing.\n     *\n     *        ONE SPELLING PER DECISION. It is a NON-EMPTY tuple, so `createRpcClient(Api, cfg, [])`\n     *        does not compile: \"this client has no app filters\" is said by omitting the argument, and\n     *        `[]` would be a second way to say the identical thing. That is the same device\n     *        {@link JwtRoles}'s `roles` uses, for the same reason — the bad case is deleted by the\n     *        TYPE rather than left available and discouraged in a docstring. Pinned in\n     *        {@link CreateRpcClientCompileAssertions}.\n     */\n    createRpcClient<T extends object>(\n        apiPrototype: ApiPrototype<T>,\n        config: ClientConfig,\n        filters?: ClientFilters,\n    ): T {\n        // Fresh instance per contract — NodeProxyClient is transient. init() binds it to this\n        // contract + target; the collaborators already came from the container.\n        const proxyClient = this.proxyClientProvider.get();\n        proxyClient.init(apiPrototype, config, filters === undefined ? [] : [...filters]);\n        return buildClientProxy(apiPrototype, proxyClient);\n    }\n}\n"]}

package/src/ContextBaseUrlFilter.d.ts

@@ -0,0 +1,80 @@
+import { Filter, Service } from '@webpieces/core-util';
+import { ClientRequest } from '@webpieces/http-client-core';
+import { SsrfPolicy } from './SsrfPolicy';
+/**
+ * Reads {@link WebpiecesCoreHeaders.OVERRIDE_BASE_URL} out of the ambient RequestContext and points
+ * THIS ONE CALL at it. Ships in the box, and is the whole of the runtime-base-URL feature:
+ *
+ * ```ts
+ * const partner = factory.createRpcClient(PartnerWebhookApi, new ClientConfig('partner-webhooks'), [
+ *     new ClientFilterDefinition(1000, new ContextBaseUrlFilter()),
+ * ]);
+ *
+ * for (const webhook of webhooks) {
+ *     await RequestContext.run(() => {
+ *         RequestContext.putUntrusted(WebpiecesCoreHeaders.OVERRIDE_BASE_URL, webhook.url);
+ *         return partner.deliver(envelope);
+ *     });
+ * }
+ * ```
+ *
+ * ## INSTALLING IT IS THE OPT-IN
+ *
+ * There is no client-level setting saying "this one may be re-pointed", because installing this
+ * filter IS that statement, written at the one place a reader looks. A client with no
+ * `ContextBaseUrlFilter` ignores an ambient `OVERRIDE_BASE_URL` entirely — which is what stops a
+ * value set for a partner delivery from silently re-pointing every other client in the same
+ * request at the partner's server. `grep -rn ContextBaseUrlFilter` enumerates every client in a
+ * codebase that can be re-pointed at all, which is the question a security review actually asks.
+ *
+ * ## PER-ENDPOINT, if a contract mixes them
+ *
+ * `request.route` carries `methodName`, `path`, `httpMethod` and `authMeta`, so a subclass can
+ * re-point some endpoints of a contract and leave the rest on the configured host, with no API
+ * change:
+ *
+ * ```ts
+ * class DeliverOnlyBaseUrlFilter extends ContextBaseUrlFilter {
+ *     override async filter(request: ClientRequest, next: Service<ClientRequest, Response>) {
+ *         if (request.route.methodName !== 'deliver') return next.invoke(request);
+ *         return super.filter(request, next);
+ *     }
+ * }
+ * ```
+ *
+ * ## Scope, and why it cannot leak
+ *
+ * It mutates the per-call {@link ClientRequest} and nothing else. The client is untouched, so the
+ * next call through the same client starts from its configured host again; and the context entry is
+ * scoped to whatever `RequestContext.run(...)` the caller established, so a fan-out loop that sets
+ * a different URL per partner gets exactly the URL it set, per iteration.
+ *
+ * ## The SSRF guard is NOT registered here
+ *
+ * Re-pointing arms it by itself — `ClientRequest.pointAtBaseUrl` flips
+ * `destinationCameFromData`, and the framework's own guard sits beneath every app filter and reads
+ * that. So this filter cannot forget to bring the guard along, and an app cannot install this one
+ * without it. The only thing this class carries is WHICH policy the guard applies, and only
+ * because the single legitimate relaxation ({@link SsrfTestingPolicy}) belongs at the same
+ * construction site as the decision to be re-pointable at all.
+ */
+export declare class ContextBaseUrlFilter extends Filter<ClientRequest, Response> {
+    /**
+     * What the framework's SSRF guard holds this client's re-pointed URLs to.
+     *
+     * Defaulted to {@link SsrfPolicy} (the strict one), and that default is the SAFE branch, so the
+     * omitted argument can never be the permissive one — the widening has to be typed out, with
+     * a reason, as `new ContextBaseUrlFilter(new SsrfTestingPolicy('<why>'))`.
+     */
+    readonly ssrfPolicy: SsrfPolicy;
+    constructor(
+    /**
+     * What the framework's SSRF guard holds this client's re-pointed URLs to.
+     *
+     * Defaulted to {@link SsrfPolicy} (the strict one), and that default is the SAFE branch, so the
+     * omitted argument can never be the permissive one — the widening has to be typed out, with
+     * a reason, as `new ContextBaseUrlFilter(new SsrfTestingPolicy('<why>'))`.
+     */
+    ssrfPolicy?: SsrfPolicy);
+    filter(request: ClientRequest, nextFilter: Service<ClientRequest, Response>): Promise<Response>;
+}

package/src/ContextBaseUrlFilter.js

@@ -0,0 +1,95 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ContextBaseUrlFilter = void 0;
+const core_util_1 = require("@webpieces/core-util");
+const core_context_1 = require("@webpieces/core-context");
+const MissingRuntimeBaseUrlError_1 = require("./MissingRuntimeBaseUrlError");
+const SsrfPolicy_1 = require("./SsrfPolicy");
+/**
+ * Reads {@link WebpiecesCoreHeaders.OVERRIDE_BASE_URL} out of the ambient RequestContext and points
+ * THIS ONE CALL at it. Ships in the box, and is the whole of the runtime-base-URL feature:
+ *
+ * ```ts
+ * const partner = factory.createRpcClient(PartnerWebhookApi, new ClientConfig('partner-webhooks'), [
+ *     new ClientFilterDefinition(1000, new ContextBaseUrlFilter()),
+ * ]);
+ *
+ * for (const webhook of webhooks) {
+ *     await RequestContext.run(() => {
+ *         RequestContext.putUntrusted(WebpiecesCoreHeaders.OVERRIDE_BASE_URL, webhook.url);
+ *         return partner.deliver(envelope);
+ *     });
+ * }
+ * ```
+ *
+ * ## INSTALLING IT IS THE OPT-IN
+ *
+ * There is no client-level setting saying "this one may be re-pointed", because installing this
+ * filter IS that statement, written at the one place a reader looks. A client with no
+ * `ContextBaseUrlFilter` ignores an ambient `OVERRIDE_BASE_URL` entirely — which is what stops a
+ * value set for a partner delivery from silently re-pointing every other client in the same
+ * request at the partner's server. `grep -rn ContextBaseUrlFilter` enumerates every client in a
+ * codebase that can be re-pointed at all, which is the question a security review actually asks.
+ *
+ * ## PER-ENDPOINT, if a contract mixes them
+ *
+ * `request.route` carries `methodName`, `path`, `httpMethod` and `authMeta`, so a subclass can
+ * re-point some endpoints of a contract and leave the rest on the configured host, with no API
+ * change:
+ *
+ * ```ts
+ * class DeliverOnlyBaseUrlFilter extends ContextBaseUrlFilter {
+ *     override async filter(request: ClientRequest, next: Service<ClientRequest, Response>) {
+ *         if (request.route.methodName !== 'deliver') return next.invoke(request);
+ *         return super.filter(request, next);
+ *     }
+ * }
+ * ```
+ *
+ * ## Scope, and why it cannot leak
+ *
+ * It mutates the per-call {@link ClientRequest} and nothing else. The client is untouched, so the
+ * next call through the same client starts from its configured host again; and the context entry is
+ * scoped to whatever `RequestContext.run(...)` the caller established, so a fan-out loop that sets
+ * a different URL per partner gets exactly the URL it set, per iteration.
+ *
+ * ## The SSRF guard is NOT registered here
+ *
+ * Re-pointing arms it by itself — `ClientRequest.pointAtBaseUrl` flips
+ * `destinationCameFromData`, and the framework's own guard sits beneath every app filter and reads
+ * that. So this filter cannot forget to bring the guard along, and an app cannot install this one
+ * without it. The only thing this class carries is WHICH policy the guard applies, and only
+ * because the single legitimate relaxation ({@link SsrfTestingPolicy}) belongs at the same
+ * construction site as the decision to be re-pointable at all.
+ */
+class ContextBaseUrlFilter extends core_util_1.Filter {
+    ssrfPolicy;
+    constructor(
+    /**
+     * What the framework's SSRF guard holds this client's re-pointed URLs to.
+     *
+     * Defaulted to {@link SsrfPolicy} (the strict one), and that default is the SAFE branch, so the
+     * omitted argument can never be the permissive one — the widening has to be typed out, with
+     * a reason, as `new ContextBaseUrlFilter(new SsrfTestingPolicy('<why>'))`.
+     */
+    ssrfPolicy = new SsrfPolicy_1.SsrfPolicy()) {
+        super();
+        this.ssrfPolicy = ssrfPolicy;
+    }
+    async filter(request, nextFilter) {
+        const override = core_context_1.RequestContext.getUntrusted(core_util_1.WebpiecesCoreHeaders.OVERRIDE_BASE_URL);
+        if (override === undefined || override === '') {
+            throw new MissingRuntimeBaseUrlError_1.MissingRuntimeBaseUrlError(`${request.contractName}.${request.route.methodName} runs behind a ContextBaseUrlFilter, so ` +
+                `its destination must be supplied per call, but no ` +
+                `WebpiecesCoreHeaders.OVERRIDE_BASE_URL was found in the RequestContext. Set it around ` +
+                `the call:\n` +
+                `    RequestContext.putUntrusted(WebpiecesCoreHeaders.OVERRIDE_BASE_URL, webhook.url);\n` +
+                `Refusing rather than falling back to this client's configured service URL is ` +
+                `deliberate: a silent fallback would send a partner's payload to one of our own services.`, `${request.contractName}.${request.route.methodName}`);
+        }
+        request.pointAtBaseUrl(override);
+        return nextFilter.invoke(request);
+    }
+}
+exports.ContextBaseUrlFilter = ContextBaseUrlFilter;
+//# sourceMappingURL=ContextBaseUrlFilter.js.map

package/src/ContextBaseUrlFilter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ContextBaseUrlFilter.js","sourceRoot":"","sources":["../../../../../packages/http/http-client-node/src/ContextBaseUrlFilter.ts"],"names":[],"mappings":";;;AAAA,oDAA6E;AAC7E,0DAAyD;AAEzD,6EAA0E;AAC1E,6CAA0C;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,MAAa,oBAAqB,SAAQ,kBAA+B;IASxD;IARb;IACI;;;;;;OAMG;IACM,aAAyB,IAAI,uBAAU,EAAE;QAElD,KAAK,EAAE,CAAC;QAFC,eAAU,GAAV,UAAU,CAA+B;IAGtD,CAAC;IAEQ,KAAK,CAAC,MAAM,CAAC,OAAsB,EAAE,UAA4C;QACtF,MAAM,QAAQ,GAAG,6BAAc,CAAC,YAAY,CAAC,gCAAoB,CAAC,iBAAiB,CAAC,CAAC;QACrF,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YAC5C,MAAM,IAAI,uDAA0B,CAChC,GAAG,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,KAAK,CAAC,UAAU,0CAA0C;gBACzF,oDAAoD;gBACpD,wFAAwF;gBACxF,aAAa;gBACb,yFAAyF;gBACzF,+EAA+E;gBAC/E,0FAA0F,EAC9F,GAAG,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,CACxD,CAAC;QACN,CAAC;QACD,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACjC,OAAO,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;CACJ;AA/BD,oDA+BC","sourcesContent":["import { Filter, Service, WebpiecesCoreHeaders } from '@webpieces/core-util';\nimport { RequestContext } from '@webpieces/core-context';\nimport { ClientRequest } from '@webpieces/http-client-core';\nimport { MissingRuntimeBaseUrlError } from './MissingRuntimeBaseUrlError';\nimport { SsrfPolicy } from './SsrfPolicy';\n\n/**\n * Reads {@link WebpiecesCoreHeaders.OVERRIDE_BASE_URL} out of the ambient RequestContext and points\n * THIS ONE CALL at it. Ships in the box, and is the whole of the runtime-base-URL feature:\n *\n * ```ts\n * const partner = factory.createRpcClient(PartnerWebhookApi, new ClientConfig('partner-webhooks'), [\n *     new ClientFilterDefinition(1000, new ContextBaseUrlFilter()),\n * ]);\n *\n * for (const webhook of webhooks) {\n *     await RequestContext.run(() => {\n *         RequestContext.putUntrusted(WebpiecesCoreHeaders.OVERRIDE_BASE_URL, webhook.url);\n *         return partner.deliver(envelope);\n *     });\n * }\n * ```\n *\n * ## INSTALLING IT IS THE OPT-IN\n *\n * There is no client-level setting saying \"this one may be re-pointed\", because installing this\n * filter IS that statement, written at the one place a reader looks. A client with no\n * `ContextBaseUrlFilter` ignores an ambient `OVERRIDE_BASE_URL` entirely — which is what stops a\n * value set for a partner delivery from silently re-pointing every other client in the same\n * request at the partner's server. `grep -rn ContextBaseUrlFilter` enumerates every client in a\n * codebase that can be re-pointed at all, which is the question a security review actually asks.\n *\n * ## PER-ENDPOINT, if a contract mixes them\n *\n * `request.route` carries `methodName`, `path`, `httpMethod` and `authMeta`, so a subclass can\n * re-point some endpoints of a contract and leave the rest on the configured host, with no API\n * change:\n *\n * ```ts\n * class DeliverOnlyBaseUrlFilter extends ContextBaseUrlFilter {\n *     override async filter(request: ClientRequest, next: Service<ClientRequest, Response>) {\n *         if (request.route.methodName !== 'deliver') return next.invoke(request);\n *         return super.filter(request, next);\n *     }\n * }\n * ```\n *\n * ## Scope, and why it cannot leak\n *\n * It mutates the per-call {@link ClientRequest} and nothing else. The client is untouched, so the\n * next call through the same client starts from its configured host again; and the context entry is\n * scoped to whatever `RequestContext.run(...)` the caller established, so a fan-out loop that sets\n * a different URL per partner gets exactly the URL it set, per iteration.\n *\n * ## The SSRF guard is NOT registered here\n *\n * Re-pointing arms it by itself — `ClientRequest.pointAtBaseUrl` flips\n * `destinationCameFromData`, and the framework's own guard sits beneath every app filter and reads\n * that. So this filter cannot forget to bring the guard along, and an app cannot install this one\n * without it. The only thing this class carries is WHICH policy the guard applies, and only\n * because the single legitimate relaxation ({@link SsrfTestingPolicy}) belongs at the same\n * construction site as the decision to be re-pointable at all.\n */\nexport class ContextBaseUrlFilter extends Filter<ClientRequest, Response> {\n    constructor(\n        /**\n         * What the framework's SSRF guard holds this client's re-pointed URLs to.\n         *\n         * Defaulted to {@link SsrfPolicy} (the strict one), and that default is the SAFE branch, so the\n         * omitted argument can never be the permissive one — the widening has to be typed out, with\n         * a reason, as `new ContextBaseUrlFilter(new SsrfTestingPolicy('<why>'))`.\n         */\n        readonly ssrfPolicy: SsrfPolicy = new SsrfPolicy(),\n    ) {\n        super();\n    }\n\n    override async filter(request: ClientRequest, nextFilter: Service<ClientRequest, Response>): Promise<Response> {\n        const override = RequestContext.getUntrusted(WebpiecesCoreHeaders.OVERRIDE_BASE_URL);\n        if (override === undefined || override === '') {\n            throw new MissingRuntimeBaseUrlError(\n                `${request.contractName}.${request.route.methodName} runs behind a ContextBaseUrlFilter, so ` +\n                    `its destination must be supplied per call, but no ` +\n                    `WebpiecesCoreHeaders.OVERRIDE_BASE_URL was found in the RequestContext. Set it around ` +\n                    `the call:\\n` +\n                    `    RequestContext.putUntrusted(WebpiecesCoreHeaders.OVERRIDE_BASE_URL, webhook.url);\\n` +\n                    `Refusing rather than falling back to this client's configured service URL is ` +\n                    `deliberate: a silent fallback would send a partner's payload to one of our own services.`,\n                `${request.contractName}.${request.route.methodName}`,\n            );\n        }\n        request.pointAtBaseUrl(override);\n        return nextFilter.invoke(request);\n    }\n}\n"]}

package/src/CreateRpcClientCompileAssertions.d.ts

@@ -0,0 +1,17 @@
+/**
+ * COMPILE-TIME assertions pinning `createRpcClient`'s filters argument to ONE spelling per decision.
+ *
+ * A CLASS is one shape and cannot express "absent, or at least one" — so the argument is a NON-EMPTY
+ * tuple, and the empty array that used to mean the same thing as omitting it is a COMPILE error. See
+ * `.claude/review/backwards-compatibility.md` shim shape #1: the fix for two spellings is to make the
+ * type unsatisfiable in the bad case, not to document a preference.
+ *
+ * WHY THIS FILE AND NOT A SPEC. `tsconfig.lib.json` EXCLUDES `*.spec.ts`, and vitest strips types
+ * with esbuild rather than checking them — so a `@ts-expect-error` in a spec is inert and the suite
+ * passes whether or not the bad case still compiles. Here it is compiled by the build: if any line
+ * below ever starts compiling, tsc fails with TS2578 ("Unused '@ts-expect-error' directive"). That
+ * failure IS the test. Mirrors `core-util/src/http/AuthJwtCompileAssertions.ts`.
+ *
+ * Nothing here runs. The class is never constructed and never exported from the barrel.
+ */
+export {};

package/src/CreateRpcClientCompileAssertions.js

@@ -0,0 +1,50 @@
+"use strict";
+/**
+ * COMPILE-TIME assertions pinning `createRpcClient`'s filters argument to ONE spelling per decision.
+ *
+ * A CLASS is one shape and cannot express "absent, or at least one" — so the argument is a NON-EMPTY
+ * tuple, and the empty array that used to mean the same thing as omitting it is a COMPILE error. See
+ * `.claude/review/backwards-compatibility.md` shim shape #1: the fix for two spellings is to make the
+ * type unsatisfiable in the bad case, not to document a preference.
+ *
+ * WHY THIS FILE AND NOT A SPEC. `tsconfig.lib.json` EXCLUDES `*.spec.ts`, and vitest strips types
+ * with esbuild rather than checking them — so a `@ts-expect-error` in a spec is inert and the suite
+ * passes whether or not the bad case still compiles. Here it is compiled by the build: if any line
+ * below ever starts compiling, tsc fails with TS2578 ("Unused '@ts-expect-error' directive"). That
+ * failure IS the test. Mirrors `core-util/src/http/AuthJwtCompileAssertions.ts`.
+ *
+ * Nothing here runs. The class is never constructed and never exported from the barrel.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const http_client_core_1 = require("@webpieces/http-client-core");
+const ClientConfig_1 = require("./ClientConfig");
+const ContextBaseUrlFilter_1 = require("./ContextBaseUrlFilter");
+class CreateRpcClientCompileAssertions {
+    /** ✅ No app filters — the ONE spelling for it is omitting the argument. */
+    noFilters() {
+        factory.createRpcClient(someApi, new ClientConfig_1.ClientConfig('server2'));
+    }
+    /** ✅ One app filter. */
+    oneFilter() {
+        factory.createRpcClient(someApi, new ClientConfig_1.ClientConfig('partner-webhooks'), [
+            new http_client_core_1.ClientFilterDefinition(1000, new ContextBaseUrlFilter_1.ContextBaseUrlFilter()),
+        ]);
+    }
+    /** ✅ Several app filters. */
+    severalFilters() {
+        factory.createRpcClient(someApi, new ClientConfig_1.ClientConfig('partner-webhooks'), [
+            new http_client_core_1.ClientFilterDefinition(1000, new ContextBaseUrlFilter_1.ContextBaseUrlFilter()),
+            new http_client_core_1.ClientFilterDefinition(500, new ContextBaseUrlFilter_1.ContextBaseUrlFilter()),
+        ]);
+    }
+    /**
+     * ❌ `[]` is a SECOND way to say what omitting the argument already says. Deleting it by type is
+     * what keeps "this client has no app filters" to one spelling.
+     */
+    emptyArrayDoesNotCompile() {
+        // @ts-expect-error - pass no third argument instead; [] is a second spelling of that
+        factory.createRpcClient(someApi, new ClientConfig_1.ClientConfig('server2'), []);
+    }
+}
+void CreateRpcClientCompileAssertions;
+//# sourceMappingURL=CreateRpcClientCompileAssertions.js.map

package/src/CreateRpcClientCompileAssertions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CreateRpcClientCompileAssertions.js","sourceRoot":"","sources":["../../../../../packages/http/http-client-node/src/CreateRpcClientCompileAssertions.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;AAEH,kEAAqE;AACrE,iDAA8C;AAE9C,iEAA8D;AAM9D,MAAM,gCAAgC;IAClC,2EAA2E;IAC3E,SAAS;QACL,OAAO,CAAC,eAAe,CAAC,OAAO,EAAE,IAAI,2BAAY,CAAC,SAAS,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,wBAAwB;IACxB,SAAS;QACL,OAAO,CAAC,eAAe,CAAC,OAAO,EAAE,IAAI,2BAAY,CAAC,kBAAkB,CAAC,EAAE;YACnE,IAAI,yCAAsB,CAAC,IAAI,EAAE,IAAI,2CAAoB,EAAE,CAAC;SAC/D,CAAC,CAAC;IACP,CAAC;IAED,6BAA6B;IAC7B,cAAc;QACV,OAAO,CAAC,eAAe,CAAC,OAAO,EAAE,IAAI,2BAAY,CAAC,kBAAkB,CAAC,EAAE;YACnE,IAAI,yCAAsB,CAAC,IAAI,EAAE,IAAI,2CAAoB,EAAE,CAAC;YAC5D,IAAI,yCAAsB,CAAC,GAAG,EAAE,IAAI,2CAAoB,EAAE,CAAC;SAC9D,CAAC,CAAC;IACP,CAAC;IAED;;;OAGG;IACH,wBAAwB;QACpB,qFAAqF;QACrF,OAAO,CAAC,eAAe,CAAC,OAAO,EAAE,IAAI,2BAAY,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;IACtE,CAAC;CACJ;AAED,KAAK,gCAAgC,CAAC","sourcesContent":["/**\n * COMPILE-TIME assertions pinning `createRpcClient`'s filters argument to ONE spelling per decision.\n *\n * A CLASS is one shape and cannot express \"absent, or at least one\" — so the argument is a NON-EMPTY\n * tuple, and the empty array that used to mean the same thing as omitting it is a COMPILE error. See\n * `.claude/review/backwards-compatibility.md` shim shape #1: the fix for two spellings is to make the\n * type unsatisfiable in the bad case, not to document a preference.\n *\n * WHY THIS FILE AND NOT A SPEC. `tsconfig.lib.json` EXCLUDES `*.spec.ts`, and vitest strips types\n * with esbuild rather than checking them — so a `@ts-expect-error` in a spec is inert and the suite\n * passes whether or not the bad case still compiles. Here it is compiled by the build: if any line\n * below ever starts compiling, tsc fails with TS2578 (\"Unused '@ts-expect-error' directive\"). That\n * failure IS the test. Mirrors `core-util/src/http/AuthJwtCompileAssertions.ts`.\n *\n * Nothing here runs. The class is never constructed and never exported from the barrel.\n */\n\nimport { ClientFilterDefinition } from '@webpieces/http-client-core';\nimport { ClientConfig } from './ClientConfig';\nimport { ClientHttpFactory } from './ClientHttpFactory';\nimport { ContextBaseUrlFilter } from './ContextBaseUrlFilter';\n\n/** Stand-in for a real contract; only its TYPE is used, and only by tsc. */\ndeclare const someApi: Parameters<ClientHttpFactory['createRpcClient']>[0];\ndeclare const factory: ClientHttpFactory;\n\nclass CreateRpcClientCompileAssertions {\n    /** ✅ No app filters — the ONE spelling for it is omitting the argument. */\n    noFilters(): void {\n        factory.createRpcClient(someApi, new ClientConfig('server2'));\n    }\n\n    /** ✅ One app filter. */\n    oneFilter(): void {\n        factory.createRpcClient(someApi, new ClientConfig('partner-webhooks'), [\n            new ClientFilterDefinition(1000, new ContextBaseUrlFilter()),\n        ]);\n    }\n\n    /** ✅ Several app filters. */\n    severalFilters(): void {\n        factory.createRpcClient(someApi, new ClientConfig('partner-webhooks'), [\n            new ClientFilterDefinition(1000, new ContextBaseUrlFilter()),\n            new ClientFilterDefinition(500, new ContextBaseUrlFilter()),\n        ]);\n    }\n\n    /**\n     * ❌ `[]` is a SECOND way to say what omitting the argument already says. Deleting it by type is\n     * what keeps \"this client has no app filters\" to one spelling.\n     */\n    emptyArrayDoesNotCompile(): void {\n        // @ts-expect-error - pass no third argument instead; [] is a second spelling of that\n        factory.createRpcClient(someApi, new ClientConfig('server2'), []);\n    }\n}\n\nvoid CreateRpcClientCompileAssertions;\n"]}

package/src/MissingRuntimeBaseUrlError.d.ts

@@ -0,0 +1,20 @@
+/**
+ * A client carrying a {@link ContextBaseUrlFilter} was called with no
+ * `WebpiecesCoreHeaders.OVERRIDE_BASE_URL` in the ambient RequestContext, so this call has nowhere
+ * to go.
+ *
+ * It is a THROW rather than a fallback to the client's configured service URL, deliberately: a
+ * silent fallback would send a partner's payload to one of our own services, which is a worse
+ * outcome than a loud failure by every measure.
+ *
+ * Its OWN type, not a bare Error and NOT an {@link SsrfRefusedError}: a delivery worker has to tell
+ * "we were misconfigured" (page somebody; retrying is pointless) from "the partner registered
+ * something hostile" (dead-letter it). Different owners, different cures.
+ */
+export declare class MissingRuntimeBaseUrlError extends Error {
+    /** `Contract.method`, so the log line names the call that had nowhere to go. */
+    readonly endpoint: string;
+    constructor(message: string, 
+    /** `Contract.method`, so the log line names the call that had nowhere to go. */
+    endpoint: string);
+}

package/src/MissingRuntimeBaseUrlError.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MissingRuntimeBaseUrlError = void 0;
+/**
+ * A client carrying a {@link ContextBaseUrlFilter} was called with no
+ * `WebpiecesCoreHeaders.OVERRIDE_BASE_URL` in the ambient RequestContext, so this call has nowhere
+ * to go.
+ *
+ * It is a THROW rather than a fallback to the client's configured service URL, deliberately: a
+ * silent fallback would send a partner's payload to one of our own services, which is a worse
+ * outcome than a loud failure by every measure.
+ *
+ * Its OWN type, not a bare Error and NOT an {@link SsrfRefusedError}: a delivery worker has to tell
+ * "we were misconfigured" (page somebody; retrying is pointless) from "the partner registered
+ * something hostile" (dead-letter it). Different owners, different cures.
+ */
+class MissingRuntimeBaseUrlError extends Error {
+    endpoint;
+    constructor(message, 
+    /** `Contract.method`, so the log line names the call that had nowhere to go. */
+    endpoint) {
+        super(message);
+        this.endpoint = endpoint;
+        this.name = 'MissingRuntimeBaseUrlError';
+    }
+}
+exports.MissingRuntimeBaseUrlError = MissingRuntimeBaseUrlError;
+//# sourceMappingURL=MissingRuntimeBaseUrlError.js.map

package/src/MissingRuntimeBaseUrlError.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MissingRuntimeBaseUrlError.js","sourceRoot":"","sources":["../../../../../packages/http/http-client-node/src/MissingRuntimeBaseUrlError.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;GAYG;AACH,MAAa,0BAA2B,SAAQ,KAAK;IAI7B;IAHpB,YACI,OAAe;IACf,gFAAgF;IAChE,QAAgB;QAEhC,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,aAAQ,GAAR,QAAQ,CAAQ;QAGhC,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC7C,CAAC;CACJ;AATD,gEASC","sourcesContent":["/**\n * A client carrying a {@link ContextBaseUrlFilter} was called with no\n * `WebpiecesCoreHeaders.OVERRIDE_BASE_URL` in the ambient RequestContext, so this call has nowhere\n * to go.\n *\n * It is a THROW rather than a fallback to the client's configured service URL, deliberately: a\n * silent fallback would send a partner's payload to one of our own services, which is a worse\n * outcome than a loud failure by every measure.\n *\n * Its OWN type, not a bare Error and NOT an {@link SsrfRefusedError}: a delivery worker has to tell\n * \"we were misconfigured\" (page somebody; retrying is pointless) from \"the partner registered\n * something hostile\" (dead-letter it). Different owners, different cures.\n */\nexport class MissingRuntimeBaseUrlError extends Error {\n    constructor(\n        message: string,\n        /** `Contract.method`, so the log line names the call that had nowhere to go. */\n        public readonly endpoint: string,\n    ) {\n        super(message);\n        this.name = 'MissingRuntimeBaseUrlError';\n    }\n}\n"]}

package/src/NodeProxyClient.d.ts

@@ -1,8 +1,10 @@
-import { AuthMeta, DestinationTrust, RouteMetadata, Secrets } from '@webpieces/core-util';
+import { DestinationTrust, RouteMetadata, Secrets } from '@webpieces/core-util';
 import { RequestContextHeaders } from '@webpieces/core-context';
 import { GcpOidc } from '@webpieces/gcp-identity';
 import { ApiPrototype, ClientFilterDefinition, ProxyClient, TranslatedFailure } from '@webpieces/http-client-core';
+import { AddressResolver } from './AddressResolver';
 import { ClientConfig } from './ClientConfig';
+import { WebhookSignerCallback } from './WebhookSignerCallback';
 /**
  * The server-side {@link ProxyClient}. Everything a browser cannot do lives here: reading the
  * ambient RequestContext, minting OIDC tokens, holding shared secrets, and recording test cases.
@@ -14,15 +16,14 @@ import { ClientConfig } from './ClientConfig';
 export declare class NodeProxyClient extends ProxyClient {
     private readonly headers;
     private readonly gcpOidc;
+    private readonly addressResolver;
     private readonly secrets?;
+    private readonly webhookSigner?;
     private config;
-    constructor(headers: RequestContextHeaders, gcpOidc: GcpOidc, secrets?: Secrets | undefined);
+    constructor(headers: RequestContextHeaders, gcpOidc: GcpOidc, addressResolver: AddressResolver, secrets?: Secrets | undefined, webhookSigner?: WebhookSignerCallback | undefined);
     /**
-     * Bind this client to one API contract + target, with the app's outbound filters.
-     *
-     * `appFilters` is REQUIRED, not defaulted: an empty array is a statement that this client signs
-     * nothing and rewrites nothing, and it should be written down rather than inferred from an
-     * omitted argument.
+     * Bind this client to one API contract + target, with the app's outbound filters (url
+     * rewriting, header editing, logging, per-call re-pointing).
      */
     init(apiPrototype: ApiPrototype<object>, config: ClientConfig, appFilters: ClientFilterDefinition[]): void;
     /**
@@ -35,12 +36,26 @@ export declare class NodeProxyClient extends ProxyClient {
      */
     protected resolveBaseUrl(): Promise<string>;
     /**
-     * The framework filters this client's {@link HostPolicy} demands — none for a deployed service,
-     * the context override plus the SSRF guard for a runtime host. Delegated rather than decided
-     * here so the two halves of "where does this go" (resolution and enforcement) cannot drift
-     * apart into different policies.
+     * The two framework built-ins, installed on EVERY client this package builds and ordered
+     * beneath every app filter by {@link ProxyClient.initRoutes}.
+     *
+     * They are unconditional rather than opt-in because neither costs anything on the path that
+     * does not need it: the SSRF guard steps aside when nothing re-pointed the request, and the
+     * auth filter does nothing for a `@Public` endpoint. An app therefore cannot forget to install
+     * the guard on the one client that takes runtime URLs — the ACT of re-pointing is what arms it.
      */
     protected clientFilters(): ClientFilterDefinition[];
+    /**
+     * WHICH policy the guard applies when something does re-point this client.
+     *
+     * Read off an installed {@link ContextBaseUrlFilter}, because that filter is where an app says
+     * "this client may be re-pointed", and the single legitimate relaxation
+     * ({@link SsrfTestingPolicy}) belongs at the same construction site as that decision rather
+     * than in a second place a reader has to correlate. No such filter — or one built with the
+     * default — means {@link SsrfPolicy} (the strict one), so the safe answer is what an app gets by saying
+     * nothing.
+     */
+    private ssrfPolicy;
     /**
      * Straight from the RequestContext. Throws when there is no active request scope.
      *
@@ -50,15 +65,6 @@ export declare class NodeProxyClient extends ProxyClient {
      * friends instead of shipping headers that endpoint's AuthFilter is obliged to reject.
      */
     protected outboundContextHeaders(destination: DestinationTrust): Map<string, string>;
-    /**
-     * Attach the outbound credential for the endpoint's AuthMode: an @AuthOidc bearer minted as
-     * this caller's runtime SA (audience = the callee base URL — the server verifies the signature
-     * + caller allow-list), or the @AuthSharedSecret(key) value THIS client sends from its bound
-     * {@link Secrets}. Both ride in the ONE `Authorization` header under their own scheme —
-     * `Bearer <oidc>` / `Webpieces <secret>` — which is never a context key, so it cannot leak onto
-     * the next hop. Never reads process.env.
-     */
-    protected attachOutboundAuth(route: RouteMetadata, baseUrl: string, httpHeaders: Map<string, string>): Promise<void>;
     /**
      * Test-case recording hook (mirror of Java HttpsJsonClientInvokeHandler): if a recorder is
      * travelling in the magic context, capture this outbound call + its result so it becomes a mock
@@ -72,13 +78,6 @@ export declare class NodeProxyClient extends ProxyClient {
      * from the call path — a logging backend stamps its own fields and never sees this.
      */
     private recordCall;
-    /**
-     * A server can satisfy every auth mode when it is talking to a peer it CHOSE, so the deployed
-     * policy rejects nothing. A runtime-host policy does reject: an OIDC token's audience and a
-     * shared secret both name a peer, and a destination that arrives per call has no honest one —
-     * see {@link HostPolicy.assertEndpointSupported}.
-     */
-    protected assertEndpointSupported(authMeta: AuthMeta | undefined, methodName: string): void;
     /**
      * SERVER-TO-SERVER: a 4xx received from a dependency becomes THIS server's own 500.
      *

package/src/NodeProxyClient.js

@@ -7,6 +7,21 @@ const core_util_1 = require("@webpieces/core-util");
 const core_context_1 = require("@webpieces/core-context");
 const gcp_identity_1 = require("@webpieces/gcp-identity");
 const http_client_core_1 = require("@webpieces/http-client-core");
+const AddressResolver_1 = require("./AddressResolver");
+const ContextBaseUrlFilter_1 = require("./ContextBaseUrlFilter");
+const OutboundAuthFilter_1 = require("./OutboundAuthFilter");
+const SsrfGuardFilter_1 = require("./SsrfGuardFilter");
+const SsrfPolicy_1 = require("./SsrfPolicy");
+const WebhookSignerCallback_1 = require("./WebhookSignerCallback");
+/**
+ * The two framework built-ins' priorities, RELATIVE TO EACH OTHER and to nothing else — they are
+ * ordered beneath every app filter structurally, not by number (see `ProxyClient.initRoutes`).
+ *
+ * The guard is OUTSIDE the minter deliberately: a destination that is going to be refused must be
+ * refused BEFORE a credential is minted for it, so a hostile URL never causes a token to exist.
+ */
+const SSRF_GUARD_PRIORITY = 900;
+const OUTBOUND_AUTH_PRIORITY = 800;
 /**
  * The server-side {@link ProxyClient}. Everything a browser cannot do lives here: reading the
  * ambient RequestContext, minting OIDC tokens, holding shared secrets, and recording test cases.
@@ -18,20 +33,21 @@ const http_client_core_1 = require("@webpieces/http-client-core");
 let NodeProxyClient = class NodeProxyClient extends http_client_core_1.ProxyClient {
     headers;
     gcpOidc;
+    addressResolver;
     secrets;
+    webhookSigner;
     config;
-    constructor(headers, gcpOidc, secrets) {
+    constructor(headers, gcpOidc, addressResolver, secrets, webhookSigner) {
         super();
         this.headers = headers;
         this.gcpOidc = gcpOidc;
+        this.addressResolver = addressResolver;
         this.secrets = secrets;
+        this.webhookSigner = webhookSigner;
     }
     /**
-     * Bind this client to one API contract + target, with the app's outbound filters.
-     *
-     * `appFilters` is REQUIRED, not defaulted: an empty array is a statement that this client signs
-     * nothing and rewrites nothing, and it should be written down rather than inferred from an
-     * omitted argument.
+     * Bind this client to one API contract + target, with the app's outbound filters (url
+     * rewriting, header editing, logging, per-call re-pointing).
      */
     init(apiPrototype, config, appFilters) {
         this.config = config;
@@ -46,16 +62,40 @@ let NodeProxyClient = class NodeProxyClient extends http_client_core_1.ProxyClie
      * read beneath a deriver is memoized process-wide, so only the first call pays.
      */
     resolveBaseUrl() {
-        return this.config.hostPolicy.resolveBaseUrl(this.config.svcName);
+        return core_util_1.ClientRegistry.resolve(this.config.svcName);
     }
     /**
-     * The framework filters this client's {@link HostPolicy} demands — none for a deployed service,
-     * the context override plus the SSRF guard for a runtime host. Delegated rather than decided
-     * here so the two halves of "where does this go" (resolution and enforcement) cannot drift
-     * apart into different policies.
+     * The two framework built-ins, installed on EVERY client this package builds and ordered
+     * beneath every app filter by {@link ProxyClient.initRoutes}.
+     *
+     * They are unconditional rather than opt-in because neither costs anything on the path that
+     * does not need it: the SSRF guard steps aside when nothing re-pointed the request, and the
+     * auth filter does nothing for a `@Public` endpoint. An app therefore cannot forget to install
+     * the guard on the one client that takes runtime URLs — the ACT of re-pointing is what arms it.
      */
     clientFilters() {
-        return this.config.hostPolicy.builtInFilters();
+        return [
+            new http_client_core_1.ClientFilterDefinition(SSRF_GUARD_PRIORITY, new SsrfGuardFilter_1.SsrfGuardFilter(this.ssrfPolicy(), this.addressResolver)),
+            new http_client_core_1.ClientFilterDefinition(OUTBOUND_AUTH_PRIORITY, new OutboundAuthFilter_1.OutboundAuthFilter(this.gcpOidc, this.secrets, this.webhookSigner)),
+        ];
+    }
+    /**
+     * WHICH policy the guard applies when something does re-point this client.
+     *
+     * Read off an installed {@link ContextBaseUrlFilter}, because that filter is where an app says
+     * "this client may be re-pointed", and the single legitimate relaxation
+     * ({@link SsrfTestingPolicy}) belongs at the same construction site as that decision rather
+     * than in a second place a reader has to correlate. No such filter — or one built with the
+     * default — means {@link SsrfPolicy} (the strict one), so the safe answer is what an app gets by saying
+     * nothing.
+     */
+    ssrfPolicy() {
+        for (const definition of this.appFilters) {
+            const filter = definition.filter;
+            if (filter instanceof ContextBaseUrlFilter_1.ContextBaseUrlFilter)
+                return filter.ssrfPolicy;
+        }
+        return new SsrfPolicy_1.SsrfPolicy();
     }
     /**
      * Straight from the RequestContext. Throws when there is no active request scope.
@@ -68,29 +108,6 @@ let NodeProxyClient = class NodeProxyClient extends http_client_core_1.ProxyClie
     outboundContextHeaders(destination) {
         return this.headers.buildOutboundHeaders(destination);
     }
-    /**
-     * Attach the outbound credential for the endpoint's AuthMode: an @AuthOidc bearer minted as
-     * this caller's runtime SA (audience = the callee base URL — the server verifies the signature
-     * + caller allow-list), or the @AuthSharedSecret(key) value THIS client sends from its bound
-     * {@link Secrets}. Both ride in the ONE `Authorization` header under their own scheme —
-     * `Bearer <oidc>` / `Webpieces <secret>` — which is never a context key, so it cannot leak onto
-     * the next hop. Never reads process.env.
-     */
-    async attachOutboundAuth(route, baseUrl, httpHeaders) {
-        const mode = route.authMeta?.mode;
-        if (mode?.kind === 'oidc') {
-            httpHeaders.set('Authorization', `Bearer ${await this.gcpOidc.mintIdToken(baseUrl)}`);
-        }
-        else if (mode?.kind === 'shared-secret') {
-            const secret = this.secrets?.get(mode.secretKey);
-            if (!secret) {
-                throw new Error(`No shared secret configured for @AuthSharedSecret('${mode.secretKey}') endpoint ${route.methodName}`);
-            }
-            // Same header as a JWT/OIDC token, but its OWN scheme, so a secret can never be
-            // mistaken for a token nor accepted where one was expected.
-            httpHeaders.set('Authorization', `Webpieces ${secret}`);
-        }
-    }
     /**
      * Test-case recording hook (mirror of Java HttpsJsonClientInvokeHandler): if a recorder is
      * travelling in the magic context, capture this outbound call + its result so it becomes a mock
@@ -134,15 +151,6 @@ let NodeProxyClient = class NodeProxyClient extends http_client_core_1.ProxyClie
             throw err;
         }
     }
-    /**
-     * A server can satisfy every auth mode when it is talking to a peer it CHOSE, so the deployed
-     * policy rejects nothing. A runtime-host policy does reject: an OIDC token's audience and a
-     * shared secret both name a peer, and a destination that arrives per call has no honest one —
-     * see {@link HostPolicy.assertEndpointSupported}.
-     */
-    assertEndpointSupported(authMeta, methodName) {
-        this.config.hostPolicy.assertEndpointSupported(authMeta, methodName, this.contractName());
-    }
     /**
      * SERVER-TO-SERVER: a 4xx received from a dependency becomes THIS server's own 500.
      *
@@ -208,11 +216,16 @@ exports.NodeProxyClient = NodeProxyClient = tslib_1.__decorate([
     (0, core_context_1.provideFrameworkTransient)(),
     tslib_1.__param(0, (0, inversify_1.inject)(core_context_1.RequestContextHeaders)),
     tslib_1.__param(1, (0, inversify_1.inject)(gcp_identity_1.GcpOidc)),
-    tslib_1.__param(2, (0, inversify_1.optional)()),
-    tslib_1.__param(2, (0, inversify_1.inject)(core_util_1.SECRETS)),
+    tslib_1.__param(2, (0, inversify_1.inject)(AddressResolver_1.AddressResolver)),
+    tslib_1.__param(3, (0, inversify_1.optional)()),
+    tslib_1.__param(3, (0, inversify_1.inject)(core_util_1.SECRETS)),
+    tslib_1.__param(4, (0, inversify_1.optional)()),
+    tslib_1.__param(4, (0, inversify_1.inject)(WebhookSignerCallback_1.WEBHOOK_SIGNER_CALLBACK)),
     tslib_1.__metadata("design:paramtypes", [core_context_1.RequestContextHeaders,
         gcp_identity_1.GcpOidc,
-        core_util_1.Secrets])
+        AddressResolver_1.AddressResolver,
+        core_util_1.Secrets,
+        WebhookSignerCallback_1.WebhookSignerCallback])
 ], NodeProxyClient);
 /**
  * DI token for the `Provider<NodeProxyClient>` that hands out RPC clients — one per API contract.