@webpieces/http-client-node 0.4.798 → 0.4.800

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webpieces/http-client-node",
-  "version": "0.4.798",
+  "version": "0.4.800",
   "description": "Server-side HTTP client for webpieces: inversify-wired, reads RequestContext directly, mints OIDC/shared-secret delivery auth, resolves Cloud Run URLs from a service name",
   "type": "commonjs",
   "main": "./src/index.js",
@@ -22,10 +22,10 @@
     "access": "public"
   },
   "dependencies": {
-    "@webpieces/core-context": "0.4.798",
-    "@webpieces/core-util": "0.4.798",
-    "@webpieces/gcp-identity": "0.4.798",
-    "@webpieces/http-client-core": "0.4.798",
+    "@webpieces/core-context": "0.4.800",
+    "@webpieces/core-util": "0.4.800",
+    "@webpieces/gcp-identity": "0.4.800",
+    "@webpieces/http-client-core": "0.4.800",
     "inversify": "7.10.4",
     "reflect-metadata": "0.2.2"
   }

package/src/NodeProxyClient.d.ts

@@ -74,6 +74,17 @@ export declare class NodeProxyClient extends ProxyClient {
      * friends instead of shipping headers that endpoint's AuthFilter is obliged to reject.
      */
     protected outboundContextHeaders(destination: DestinationTrust): Map<string, string>;
+    /**
+     * Straight into the ambient RequestContext — the reason a value a callee set climbs the call
+     * tree: after this returns, the CALLER's context holds it, and the caller's own response (and its
+     * own outbound calls) carry it onward.
+     *
+     * `destination` is the trust gate, and it is the mirror of the inbound problem rather than a
+     * restatement of it: a response is another process's ASSERTION. Untrusted response keys are
+     * admitted; a TRUSTED one is admitted only from a destination this client authenticated to, and
+     * is otherwise dropped — see `RequestContextHeaders.acceptResponseHeaders`.
+     */
+    protected acceptResponseContext(headers: Headers, destination: DestinationTrust): void;
     /**
      * Test-case recording hook (mirror of Java HttpsJsonClientInvokeHandler): if a recorder is
      * travelling in the magic context, capture this outbound call + its result so it becomes a mock

package/src/NodeProxyClient.js

@@ -177,6 +177,19 @@ let NodeProxyClient = class NodeProxyClient extends http_client_core_1.ProxyClie
     outboundContextHeaders(destination) {
         return this.headers.buildOutboundHeaders(destination);
     }
+    /**
+     * Straight into the ambient RequestContext — the reason a value a callee set climbs the call
+     * tree: after this returns, the CALLER's context holds it, and the caller's own response (and its
+     * own outbound calls) carry it onward.
+     *
+     * `destination` is the trust gate, and it is the mirror of the inbound problem rather than a
+     * restatement of it: a response is another process's ASSERTION. Untrusted response keys are
+     * admitted; a TRUSTED one is admitted only from a destination this client authenticated to, and
+     * is otherwise dropped — see `RequestContextHeaders.acceptResponseHeaders`.
+     */
+    acceptResponseContext(headers, destination) {
+        this.headers.acceptResponseHeaders(headers, destination);
+    }
     /**
      * Test-case recording hook (mirror of Java HttpsJsonClientInvokeHandler): if a recorder is
      * travelling in the magic context, capture this outbound call + its result so it becomes a mock

package/src/NodeProxyClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"NodeProxyClient.js","sourceRoot":"","sources":["../../../../../packages/http/http-client-node/src/NodeProxyClient.ts"],"names":[],"mappings":";;;;AAAA,yCAA6C;AAC7C,6CAAmC;AACnC,yCAAoE;AACpE,2CAAqD;AACrD,6CAAuC;AACvC,oDAY8B;AAC9B,0DAKiC;AACjC,0DAAkD;AAClD,kEAMqC;AACrC,uDAAoD;AAEpD,iEAA8D;AAC9D,iEAA8D;AAC9D,6DAA0D;AAC1D,uDAAoD;AACpD,6CAA0C;AAC1C,mEAAyF;AAEzF;;;;;;GAMG;AACH,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAEnC;;;;;;;GAOG;AAEI,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,8BAAW;IAKQ;IAEd;IAEQ;IAGI;IAM7B;IAjBb,MAAM,CAAgB;IAE9B,YAEoD,OAA8B,EAE5C,OAAgB,EAER,eAAgC,EAG5B,OAAiB,EAM9C,aAAqC;QAEtD,kFAAkF;QAClF,2FAA2F;QAC3F,wDAAwD;QACxD,KAAK,CAAC,IAAI,0BAAc,CAAC,IAAI,2CAA4B,EAAE,CAAC,CAAC,CAAC;QAlBd,YAAO,GAAP,OAAO,CAAuB;QAE5C,YAAO,GAAP,OAAO,CAAS;QAER,oBAAe,GAAf,eAAe,CAAiB;QAG5B,YAAO,GAAP,OAAO,CAAU;QAM9C,kBAAa,GAAb,aAAa,CAAwB;IAM1D,CAAC;IAED;;;OAGG;IACH,IAAI,CACA,YAAkC,EAClC,MAAoB,EACpB,UAAoC;QAEpC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;;OAOG;IACgB,cAAc;QAC7B,OAAO,0BAAc,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvD,CAAC;IAED,4FAA4F;IACzE,6BAA6B;QAC5C,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;;OAGG;IACgB,sBAAsB,CACrC,OAAsB,EACtB,MAAmB,EACnB,IAAwB;QAExB,OAAO,IAAI,OAAO,CACd,CAAC,OAAqC,EAAE,MAA8B,EAAE,EAAE;YACtE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,oBAAY,CAAC,CAAC,CAAC,mBAAW,CAAC;YACpE,MAAM,QAAQ,GAAG,IAAI,CACjB,GAAG,EACH;gBACI,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,OAAO,CAAC,eAAe,EAAE;gBAClC,MAAM;aACT,EACD,CAAC,QAAyB,EAAQ,EAAE;gBAChC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;gBAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC3D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;wBACvB,KAAK,MAAM,IAAI,IAAI,KAAK;4BAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;oBACzD,CAAC;yBAAM,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;wBAC7B,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;oBAC7B,CAAC;gBACL,CAAC;gBACD,MAAM,YAAY,GAAG,sBAAQ,CAAC,KAAK,CAAC,QAAQ,CAA+B,CAAC;gBAC5E,OAAO,CACH,IAAI,QAAQ,CAAC,YAAY,EAAE;oBACvB,MAAM,EAAE,QAAQ,CAAC,UAAU,IAAI,GAAG;oBAClC,UAAU,EAAE,QAAQ,CAAC,aAAa;oBAClC,OAAO;iBACV,CAAC,CACL,CAAC;YACN,CAAC,CACJ,CAAC;YACF,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC/B,+FAA+F;YAC/F,KAAK,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBAClE,MAAM,KAAK,GAAG,IAAA,mBAAO,EAAC,GAAG,CAAC,CAAC;gBAC3B,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC,CAAC,CAAC;QACP,CAAC,CACJ,CAAC;IACN,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAC9B,IAAwB,EACxB,QAA2C;QAE3C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAChC,8GAA8G;QAC9G,IAAI,CAAC;YACD,SAAS,CAAC;gBACN,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjC,IAAI,IAAI,CAAC,IAAI;oBAAE,MAAM;gBACrB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;oBAAE,MAAM,IAAA,kBAAI,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACnE,CAAC;YACD,QAAQ,CAAC,GAAG,EAAE,CAAC;QACnB,CAAC;gBAAS,CAAC;YACP,MAAM,CAAC,WAAW,EAAE,CAAC;QACzB,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACgB,aAAa;QAC5B,OAAO;YACH,IAAI,yCAAsB,CACtB,mBAAmB,EACnB,IAAI,iCAAe,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,eAAe,CAAC,CAC/D;YACD,IAAI,yCAAsB,CACtB,sBAAsB,EACtB,IAAI,uCAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,CACzE;SACJ,CAAC;IACN,CAAC;IAED;;;;;;;;;;OAUG;IACK,UAAU;QACd,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;YACjC,IAAI,MAAM,YAAY,2CAAoB,IAAI,MAAM,YAAY,2CAAoB,EAAE,CAAC;gBACnF,OAAO,MAAM,CAAC,UAAU,CAAC;YAC7B,CAAC;QACL,CAAC;QACD,OAAO,IAAI,uBAAU,EAAE,CAAC;IAC5B,CAAC;IAED;;;;;;;OAOG;IACgB,sBAAsB,CAAC,WAA6B;QACnE,OAAO,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAC1D,CAAC;IAED;;;;OAIG;IACH,iFAAiF;IAC9D,KAAK,CAAC,OAAO,CAC5B,KAAoB,EACpB,UAAmB;IACnB,iFAAiF;IACjF,MAA8B;QAG9B,yFAAyF;QACzF,IAAI,CAAC,6BAAc,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACX,+EAA+E,CAClF,CAAC;QACN,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QAC7C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACZ,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IAED;;;;;OAKG;IACH,iFAAiF;IACzE,KAAK,CAAC,UAAU,CACpB,QAA0B,EAC1B,KAAoB,EACpB,UAAmB;IACnB,iFAAiF;IACjF,MAA8B;QAG9B,MAAM,WAAW,GAA2B,EAAE,CAAC;QAC/C,KAAK,MAAM,KAAK,IAAI,6BAAc,CAAC,cAAc,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;YAC5D,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,4BAAgB,CACjC,IAAI,CAAC,YAAY,EAAE,EACnB,KAAK,CAAC,UAAU,EAChB,CAAC,UAAU,CAAC,EACZ,WAAW,CACd,CAAC;QACF,QAAQ,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAEnC,4HAA4H;QAC5H,IAAI,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;YAChE,QAAQ,CAAC,eAAe,GAAG,QAAQ,CAAC;YACpC,OAAO,QAAQ,CAAC;QACpB,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAA,mBAAO,EAAC,GAAG,CAAC,CAAC;YAC3B,QAAQ,CAAC,eAAe,GAAG,IAAI,yBAAa,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACxE,MAAM,GAAG,CAAC;QACd,CAAC;IACL,CAAC;CAEJ,CAAA;AAnPY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,wCAAyB,GAAE;IAMnB,mBAAA,IAAA,kBAAM,EAAC,oCAAqB,CAAC,CAAA;IAE7B,mBAAA,IAAA,kBAAM,EAAC,sBAAO,CAAC,CAAA;IAEf,mBAAA,IAAA,kBAAM,EAAC,iCAAe,CAAC,CAAA;IAGvB,mBAAA,IAAA,oBAAQ,GAAE,CAAA;IAAE,mBAAA,IAAA,kBAAM,EAAC,mBAAO,CAAC,CAAA;IAI3B,mBAAA,IAAA,oBAAQ,GAAE,CAAA;IACV,mBAAA,IAAA,kBAAM,EAAC,+CAAuB,CAAC,CAAA;6CAZyB,oCAAqB;QAEnC,sBAAO;QAES,iCAAe;QAGlB,mBAAO;QAM9B,6CAAqB;GAlBjD,eAAe,CAmP3B;AAED;;;;;;;GAOG;AACH,gGAAgG;AACnF,QAAA,0BAA0B,GAAG,MAAM,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC","sourcesContent":["import { inject, optional } from 'inversify';\nimport { once } from 'node:events';\nimport { request as httpRequest, IncomingMessage } from 'node:http';\nimport { request as httpsRequest } from 'node:https';\nimport { Readable } from 'node:stream';\nimport {\n    ClientRegistry,\n    DestinationTrust,\n    ApiImplementationError,\n    RecordedEndpoint,\n    RecordedError,\n    LogApiCallImpl,\n    RouteMetadata,\n    Secrets,\n    SECRETS,\n    TestCaseRecorder,\n    toError,\n} from '@webpieces/core-util';\nimport {\n    RequestContext,\n    RequestContextApiCallContext,\n    RequestContextHeaders,\n    provideFrameworkTransient,\n} from '@webpieces/core-context';\nimport { GcpOidc } from '@webpieces/gcp-identity';\nimport {\n    ApiPrototype,\n    ByteReadableStream,\n    ClientRequest,\n    ClientFilterDefinition,\n    ProxyClient,\n} from '@webpieces/http-client-core';\nimport { AddressResolver } from './AddressResolver';\nimport { ClientConfig } from './ClientConfig';\nimport { ContextBaseUrlFilter } from './ContextBaseUrlFilter';\nimport { ContextFullUrlFilter } from './ContextFullUrlFilter';\nimport { OutboundAuthFilter } from './OutboundAuthFilter';\nimport { SsrfGuardFilter } from './SsrfGuardFilter';\nimport { SsrfPolicy } from './SsrfPolicy';\nimport { WEBHOOK_SIGNER_CALLBACK, WebhookSignerCallback } from './WebhookSignerCallback';\n\n/**\n * The two framework built-ins' priorities, RELATIVE TO EACH OTHER and to nothing else — they are\n * ordered beneath every app filter structurally, not by number (see `ProxyClient.initRoutes`).\n *\n * The guard is OUTSIDE the minter deliberately: a destination that is going to be refused must be\n * refused BEFORE a credential is minted for it, so a hostile URL never causes a token to exist.\n */\nconst SSRF_GUARD_PRIORITY = 900;\nconst OUTBOUND_AUTH_PRIORITY = 800;\n\n/**\n * The server-side {@link ProxyClient}. Everything a browser cannot do lives here: reading the\n * ambient RequestContext, minting OIDC tokens, holding shared secrets, and recording test cases.\n *\n * TRANSIENT on purpose. Every `createRpcClient(api, config)` needs its own instance, because `init()`\n * binds one instance to exactly one API contract and one target. {@link ProxyClientProvider} hands\n * them out — see its doc.\n */\n@provideFrameworkTransient()\nexport class NodeProxyClient extends ProxyClient {\n    private config!: ClientConfig;\n\n    constructor(\n        // webpieces-disable inject-annotation-not-needed-for-concrete-class -- DI-resolved param; the esbuild/vitest path elides type-only imports (no design:paramtypes), so the explicit token is required\n        @inject(RequestContextHeaders) private readonly headers: RequestContextHeaders,\n        // webpieces-disable inject-annotation-not-needed-for-concrete-class -- DI-resolved param; the esbuild/vitest path elides type-only imports (no design:paramtypes), so the explicit token is required\n        @inject(GcpOidc) private readonly gcpOidc: GcpOidc,\n        // webpieces-disable inject-annotation-not-needed-for-concrete-class -- DI-resolved param; the esbuild/vitest path elides type-only imports (no design:paramtypes), so the explicit token is required\n        @inject(AddressResolver) private readonly addressResolver: AddressResolver,\n        // @optional: only @WpAuthSharedSecret endpoints need it; the client sends its bound value.\n        // webpieces-disable inject-annotation-not-needed-for-concrete-class -- DI-resolved param; the esbuild/vitest path elides type-only imports (no design:paramtypes), so the explicit token is required\n        @optional() @inject(SECRETS) private readonly secrets?: Secrets,\n        // @optional: only @WpAuthWebhook endpoints need it, and an unbound one makes them THROW\n        // rather than deliver unsigned — see WebhookSignerCallback.\n        // webpieces-disable inject-annotation-not-needed-for-concrete-class -- DI-resolved param; the esbuild/vitest path elides type-only imports (no design:paramtypes), so the explicit token is required\n        @optional()\n        @inject(WEBHOOK_SIGNER_CALLBACK)\n        private readonly webhookSigner?: WebhookSignerCallback,\n    ) {\n        // This package is node-only and already depends on core-context, so it builds the\n        // RequestContext-backed ApiCallContext itself. No startup install, and therefore nothing a\n        // non-webpieces host (plain NestJS/Express) can forget.\n        super(new LogApiCallImpl(new RequestContextApiCallContext()));\n    }\n\n    /**\n     * Bind this client to one API contract + target, with the app's outbound filters (url\n     * rewriting, header editing, logging, per-call re-pointing).\n     */\n    init(\n        apiPrototype: ApiPrototype<object>,\n        config: ClientConfig,\n        appFilters: ClientFilterDefinition[],\n    ): void {\n        this.config = config;\n        this.initRoutes(apiPrototype, appFilters);\n    }\n\n    /**\n     * The same chain every client runs — a ClientRegistry mapping, else the installed deriver — but\n     * with NODE's fallback: THROW. A server has no \"own origin\" to fall back to the way a browser\n     * does, so an unresolvable peer is a setup bug and must fail loudly (the error names the fixes).\n     *\n     * Resolved per call, never at construction, so building a client stays synchronous. Any metadata\n     * read beneath a deriver is memoized process-wide, so only the first call pays.\n     */\n    protected override resolveBaseUrl(): Promise<string> {\n        return ClientRegistry.resolve(this.config.svcName);\n    }\n\n    /** Node/undici supports a live ReadableStream body when fetch is given `duplex: 'half'`. */\n    protected override supportsConcurrentDuplexFetch(): boolean {\n        return true;\n    }\n\n    /**\n     * Node's native HTTP stream is genuinely concurrent: unlike browser Fetch, an early response\n     * does not cancel the still-open upload. The returned Web Response keeps parsing isomorphic.\n     */\n    protected override sendStreamingTransport(\n        request: ClientRequest,\n        signal: AbortSignal,\n        body: ByteReadableStream,\n    ): Promise<Response> {\n        return new Promise<Response>(\n            (resolve: (response: Response) => void, reject: (error: Error) => void) => {\n                const url = new URL(request.url);\n                const send = url.protocol === 'https:' ? httpsRequest : httpRequest;\n                const outgoing = send(\n                    url,\n                    {\n                        method: 'POST',\n                        headers: request.headersAsRecord(),\n                        signal,\n                    },\n                    (incoming: IncomingMessage): void => {\n                        const headers = new Headers();\n                        for (const [name, value] of Object.entries(incoming.headers)) {\n                            if (Array.isArray(value)) {\n                                for (const item of value) headers.append(name, item);\n                            } else if (value !== undefined) {\n                                headers.set(name, value);\n                            }\n                        }\n                        const responseBody = Readable.toWeb(incoming) as ReadableStream<Uint8Array>;\n                        resolve(\n                            new Response(responseBody, {\n                                status: incoming.statusCode ?? 500,\n                                statusText: incoming.statusMessage,\n                                headers,\n                            }),\n                        );\n                    },\n                );\n                outgoing.once('error', reject);\n                // webpieces-disable no-any-unknown -- a native socket/write rejection is normalized by toError\n                void this.pumpStreamingRequest(body, outgoing).catch((err: unknown) => {\n                    const error = toError(err);\n                    outgoing.destroy(error);\n                });\n            },\n        );\n    }\n\n    private async pumpStreamingRequest(\n        body: ByteReadableStream,\n        outgoing: import('node:http').ClientRequest,\n    ): Promise<void> {\n        const reader = body.getReader();\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions -- socket errors reject writer acknowledgements\n        try {\n            for (;;) {\n                const part = await reader.read();\n                if (part.done) break;\n                if (!outgoing.write(part.value)) await once(outgoing, 'drain');\n            }\n            outgoing.end();\n        } finally {\n            reader.releaseLock();\n        }\n    }\n\n    /**\n     * The two framework built-ins, installed on EVERY client this package builds and ordered\n     * beneath every app filter by {@link ProxyClient.initRoutes}.\n     *\n     * They are unconditional rather than opt-in because neither costs anything on the path that\n     * does not need it: the SSRF guard steps aside when nothing re-pointed the request, and the\n     * auth filter does nothing for a `@WpAuthPublic` endpoint. An app therefore cannot forget to install\n     * the guard on the one client that takes runtime URLs — the ACT of re-pointing is what arms it.\n     */\n    protected override clientFilters(): ClientFilterDefinition[] {\n        return [\n            new ClientFilterDefinition(\n                SSRF_GUARD_PRIORITY,\n                new SsrfGuardFilter(this.ssrfPolicy(), this.addressResolver),\n            ),\n            new ClientFilterDefinition(\n                OUTBOUND_AUTH_PRIORITY,\n                new OutboundAuthFilter(this.gcpOidc, this.secrets, this.webhookSigner),\n            ),\n        ];\n    }\n\n    /**\n     * WHICH policy the guard applies when something does re-point this client.\n     *\n     * Read off an installed {@link ContextBaseUrlFilter} or {@link ContextFullUrlFilter}, because\n     * that filter is where an app says\n     * \"this client may be re-pointed\", and the single legitimate relaxation\n     * ({@link SsrfTestingPolicy}) belongs at the same construction site as that decision rather\n     * than in a second place a reader has to correlate. No such filter — or one built with the\n     * default — means {@link SsrfPolicy} (the strict one), so the safe answer is what an app gets by saying\n     * nothing.\n     */\n    private ssrfPolicy(): SsrfPolicy {\n        for (const definition of this.appFilters) {\n            const filter = definition.filter;\n            if (filter instanceof ContextBaseUrlFilter || filter instanceof ContextFullUrlFilter) {\n                return filter.ssrfPolicy;\n            }\n        }\n        return new SsrfPolicy();\n    }\n\n    /**\n     * Straight from the RequestContext. Throws when there is no active request scope.\n     *\n     * `destination` rides through unchanged: this is the ONE client that can legitimately propagate a\n     * verified identity, and it does so exactly when the callee will authenticate us (@WpAuthOidc /\n     * @WpAuthSharedSecret). Calling a peer's @WpAuthPublic or @WpAuthJwt endpoint now omits `x-user-id` and\n     * friends instead of shipping headers that endpoint's AuthFilter is obliged to reject.\n     */\n    protected override outboundContextHeaders(destination: DestinationTrust): Map<string, string> {\n        return this.headers.buildOutboundHeaders(destination);\n    }\n\n    /**\n     * Test-case recording hook (mirror of Java HttpsJsonClientInvokeHandler): if a recorder is\n     * travelling in the magic context, capture this outbound call + its result so it becomes a mock\n     * in the generated test. Absent a recorder this is exactly the base behavior.\n     */\n    // webpieces-disable no-any-unknown -- DTO types are erased at the proxy boundary\n    protected override async execute(\n        route: RouteMetadata,\n        requestDto: unknown,\n        // webpieces-disable no-any-unknown -- DTO types are erased at the proxy boundary\n        method: () => Promise<unknown>,\n        // webpieces-disable no-any-unknown -- DTO types are erased at the proxy boundary\n    ): Promise<unknown> {\n        // Preserve the context precondition before logging, which also requires an active scope.\n        if (!RequestContext.isActive()) {\n            throw new Error(\n                'No active RequestContext. Run the client call inside RequestContext.run(...).',\n            );\n        }\n        const recorder = this.headers.findRecorder();\n        if (!recorder) {\n            return super.execute(route, requestDto, method);\n        }\n        return this.recordCall(recorder, route, requestDto, method);\n    }\n\n    /**\n     * Execute the call while recording it (args + masked ctx snapshot + result).\n     *\n     * The snapshot is a FIXTURE field, not a log line, so it is built here rather than handed down\n     * from the call path — a logging backend stamps its own fields and never sees this.\n     */\n    // webpieces-disable no-any-unknown -- DTO types are erased at the proxy boundary\n    private async recordCall(\n        recorder: TestCaseRecorder,\n        route: RouteMetadata,\n        requestDto: unknown,\n        // webpieces-disable no-any-unknown -- DTO types are erased at the proxy boundary\n        method: () => Promise<unknown>,\n        // webpieces-disable no-any-unknown -- DTO types are erased at the proxy boundary\n    ): Promise<unknown> {\n        const ctxSnapshot: Record<string, string> = {};\n        for (const entry of RequestContext.buildLogFields().entries()) {\n            ctxSnapshot[entry[0]] = entry[1];\n        }\n        const recorded = new RecordedEndpoint(\n            this.contractName(),\n            route.methodName,\n            [requestDto],\n            ctxSnapshot,\n        );\n        recorder.addEndpointInfo(recorded);\n\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions -- capture failure into the recording, then rethrow unchanged\n        try {\n            const response = await super.execute(route, requestDto, method);\n            recorded.successResponse = response;\n            return response;\n        } catch (err: unknown) {\n            const error = toError(err);\n            recorded.failureResponse = new RecordedError(error.name, error.message);\n            throw err;\n        }\n    }\n\n}\n\n/**\n * DI token for the `Provider<NodeProxyClient>` that hands out RPC clients — one per API contract.\n * `Provider<T>` is erased at runtime, so it cannot be its own token; this Symbol names T.\n *\n * Because NodeProxyClient is bound TRANSIENT, every `get()` constructs a new one. (Were it bound\n * `@provideFrameworkSingleton`, the very same Provider would instead hand back one lazily-created\n * instance — the provider caches nothing, so the target's scope decides.)\n */\n// webpieces-disable no-symbol-di-tokens -- Provider<T> is erased at runtime; the Symbol names T\nexport const NODE_PROXY_CLIENT_PROVIDER = Symbol.for('Provider<NodeProxyClient>');\n"]}
+{"version":3,"file":"NodeProxyClient.js","sourceRoot":"","sources":["../../../../../packages/http/http-client-node/src/NodeProxyClient.ts"],"names":[],"mappings":";;;;AAAA,yCAA6C;AAC7C,6CAAmC;AACnC,yCAAoE;AACpE,2CAAqD;AACrD,6CAAuC;AACvC,oDAY8B;AAC9B,0DAKiC;AACjC,0DAAkD;AAClD,kEAMqC;AACrC,uDAAoD;AAEpD,iEAA8D;AAC9D,iEAA8D;AAC9D,6DAA0D;AAC1D,uDAAoD;AACpD,6CAA0C;AAC1C,mEAAyF;AAEzF;;;;;;GAMG;AACH,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAEnC;;;;;;;GAOG;AAEI,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,8BAAW;IAKQ;IAEd;IAEQ;IAGI;IAM7B;IAjBb,MAAM,CAAgB;IAE9B,YAEoD,OAA8B,EAE5C,OAAgB,EAER,eAAgC,EAG5B,OAAiB,EAM9C,aAAqC;QAEtD,kFAAkF;QAClF,2FAA2F;QAC3F,wDAAwD;QACxD,KAAK,CAAC,IAAI,0BAAc,CAAC,IAAI,2CAA4B,EAAE,CAAC,CAAC,CAAC;QAlBd,YAAO,GAAP,OAAO,CAAuB;QAE5C,YAAO,GAAP,OAAO,CAAS;QAER,oBAAe,GAAf,eAAe,CAAiB;QAG5B,YAAO,GAAP,OAAO,CAAU;QAM9C,kBAAa,GAAb,aAAa,CAAwB;IAM1D,CAAC;IAED;;;OAGG;IACH,IAAI,CACA,YAAkC,EAClC,MAAoB,EACpB,UAAoC;QAEpC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;;OAOG;IACgB,cAAc;QAC7B,OAAO,0BAAc,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvD,CAAC;IAED,4FAA4F;IACzE,6BAA6B;QAC5C,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;;OAGG;IACgB,sBAAsB,CACrC,OAAsB,EACtB,MAAmB,EACnB,IAAwB;QAExB,OAAO,IAAI,OAAO,CACd,CAAC,OAAqC,EAAE,MAA8B,EAAE,EAAE;YACtE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,oBAAY,CAAC,CAAC,CAAC,mBAAW,CAAC;YACpE,MAAM,QAAQ,GAAG,IAAI,CACjB,GAAG,EACH;gBACI,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,OAAO,CAAC,eAAe,EAAE;gBAClC,MAAM;aACT,EACD,CAAC,QAAyB,EAAQ,EAAE;gBAChC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;gBAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC3D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;wBACvB,KAAK,MAAM,IAAI,IAAI,KAAK;4BAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;oBACzD,CAAC;yBAAM,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;wBAC7B,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;oBAC7B,CAAC;gBACL,CAAC;gBACD,MAAM,YAAY,GAAG,sBAAQ,CAAC,KAAK,CAAC,QAAQ,CAA+B,CAAC;gBAC5E,OAAO,CACH,IAAI,QAAQ,CAAC,YAAY,EAAE;oBACvB,MAAM,EAAE,QAAQ,CAAC,UAAU,IAAI,GAAG;oBAClC,UAAU,EAAE,QAAQ,CAAC,aAAa;oBAClC,OAAO;iBACV,CAAC,CACL,CAAC;YACN,CAAC,CACJ,CAAC;YACF,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC/B,+FAA+F;YAC/F,KAAK,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBAClE,MAAM,KAAK,GAAG,IAAA,mBAAO,EAAC,GAAG,CAAC,CAAC;gBAC3B,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC,CAAC,CAAC;QACP,CAAC,CACJ,CAAC;IACN,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAC9B,IAAwB,EACxB,QAA2C;QAE3C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAChC,8GAA8G;QAC9G,IAAI,CAAC;YACD,SAAS,CAAC;gBACN,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjC,IAAI,IAAI,CAAC,IAAI;oBAAE,MAAM;gBACrB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;oBAAE,MAAM,IAAA,kBAAI,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACnE,CAAC;YACD,QAAQ,CAAC,GAAG,EAAE,CAAC;QACnB,CAAC;gBAAS,CAAC;YACP,MAAM,CAAC,WAAW,EAAE,CAAC;QACzB,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACgB,aAAa;QAC5B,OAAO;YACH,IAAI,yCAAsB,CACtB,mBAAmB,EACnB,IAAI,iCAAe,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,eAAe,CAAC,CAC/D;YACD,IAAI,yCAAsB,CACtB,sBAAsB,EACtB,IAAI,uCAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,CACzE;SACJ,CAAC;IACN,CAAC;IAED;;;;;;;;;;OAUG;IACK,UAAU;QACd,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;YACjC,IAAI,MAAM,YAAY,2CAAoB,IAAI,MAAM,YAAY,2CAAoB,EAAE,CAAC;gBACnF,OAAO,MAAM,CAAC,UAAU,CAAC;YAC7B,CAAC;QACL,CAAC;QACD,OAAO,IAAI,uBAAU,EAAE,CAAC;IAC5B,CAAC;IAED;;;;;;;OAOG;IACgB,sBAAsB,CAAC,WAA6B;QACnE,OAAO,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;;;;OASG;IACgB,qBAAqB,CACpC,OAAgB,EAChB,WAA6B;QAE7B,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC7D,CAAC;IAED;;;;OAIG;IACH,iFAAiF;IAC9D,KAAK,CAAC,OAAO,CAC5B,KAAoB,EACpB,UAAmB;IACnB,iFAAiF;IACjF,MAA8B;QAG9B,yFAAyF;QACzF,IAAI,CAAC,6BAAc,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACX,+EAA+E,CAClF,CAAC;QACN,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QAC7C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACZ,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IAED;;;;;OAKG;IACH,iFAAiF;IACzE,KAAK,CAAC,UAAU,CACpB,QAA0B,EAC1B,KAAoB,EACpB,UAAmB;IACnB,iFAAiF;IACjF,MAA8B;QAG9B,MAAM,WAAW,GAA2B,EAAE,CAAC;QAC/C,KAAK,MAAM,KAAK,IAAI,6BAAc,CAAC,cAAc,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;YAC5D,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,4BAAgB,CACjC,IAAI,CAAC,YAAY,EAAE,EACnB,KAAK,CAAC,UAAU,EAChB,CAAC,UAAU,CAAC,EACZ,WAAW,CACd,CAAC;QACF,QAAQ,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAEnC,4HAA4H;QAC5H,IAAI,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;YAChE,QAAQ,CAAC,eAAe,GAAG,QAAQ,CAAC;YACpC,OAAO,QAAQ,CAAC;QACpB,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAA,mBAAO,EAAC,GAAG,CAAC,CAAC;YAC3B,QAAQ,CAAC,eAAe,GAAG,IAAI,yBAAa,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACxE,MAAM,GAAG,CAAC;QACd,CAAC;IACL,CAAC;CAEJ,CAAA;AApQY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,wCAAyB,GAAE;IAMnB,mBAAA,IAAA,kBAAM,EAAC,oCAAqB,CAAC,CAAA;IAE7B,mBAAA,IAAA,kBAAM,EAAC,sBAAO,CAAC,CAAA;IAEf,mBAAA,IAAA,kBAAM,EAAC,iCAAe,CAAC,CAAA;IAGvB,mBAAA,IAAA,oBAAQ,GAAE,CAAA;IAAE,mBAAA,IAAA,kBAAM,EAAC,mBAAO,CAAC,CAAA;IAI3B,mBAAA,IAAA,oBAAQ,GAAE,CAAA;IACV,mBAAA,IAAA,kBAAM,EAAC,+CAAuB,CAAC,CAAA;6CAZyB,oCAAqB;QAEnC,sBAAO;QAES,iCAAe;QAGlB,mBAAO;QAM9B,6CAAqB;GAlBjD,eAAe,CAoQ3B;AAED;;;;;;;GAOG;AACH,gGAAgG;AACnF,QAAA,0BAA0B,GAAG,MAAM,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC","sourcesContent":["import { inject, optional } from 'inversify';\nimport { once } from 'node:events';\nimport { request as httpRequest, IncomingMessage } from 'node:http';\nimport { request as httpsRequest } from 'node:https';\nimport { Readable } from 'node:stream';\nimport {\n    ClientRegistry,\n    DestinationTrust,\n    ApiImplementationError,\n    RecordedEndpoint,\n    RecordedError,\n    LogApiCallImpl,\n    RouteMetadata,\n    Secrets,\n    SECRETS,\n    TestCaseRecorder,\n    toError,\n} from '@webpieces/core-util';\nimport {\n    RequestContext,\n    RequestContextApiCallContext,\n    RequestContextHeaders,\n    provideFrameworkTransient,\n} from '@webpieces/core-context';\nimport { GcpOidc } from '@webpieces/gcp-identity';\nimport {\n    ApiPrototype,\n    ByteReadableStream,\n    ClientRequest,\n    ClientFilterDefinition,\n    ProxyClient,\n} from '@webpieces/http-client-core';\nimport { AddressResolver } from './AddressResolver';\nimport { ClientConfig } from './ClientConfig';\nimport { ContextBaseUrlFilter } from './ContextBaseUrlFilter';\nimport { ContextFullUrlFilter } from './ContextFullUrlFilter';\nimport { OutboundAuthFilter } from './OutboundAuthFilter';\nimport { SsrfGuardFilter } from './SsrfGuardFilter';\nimport { SsrfPolicy } from './SsrfPolicy';\nimport { WEBHOOK_SIGNER_CALLBACK, WebhookSignerCallback } from './WebhookSignerCallback';\n\n/**\n * The two framework built-ins' priorities, RELATIVE TO EACH OTHER and to nothing else — they are\n * ordered beneath every app filter structurally, not by number (see `ProxyClient.initRoutes`).\n *\n * The guard is OUTSIDE the minter deliberately: a destination that is going to be refused must be\n * refused BEFORE a credential is minted for it, so a hostile URL never causes a token to exist.\n */\nconst SSRF_GUARD_PRIORITY = 900;\nconst OUTBOUND_AUTH_PRIORITY = 800;\n\n/**\n * The server-side {@link ProxyClient}. Everything a browser cannot do lives here: reading the\n * ambient RequestContext, minting OIDC tokens, holding shared secrets, and recording test cases.\n *\n * TRANSIENT on purpose. Every `createRpcClient(api, config)` needs its own instance, because `init()`\n * binds one instance to exactly one API contract and one target. {@link ProxyClientProvider} hands\n * them out — see its doc.\n */\n@provideFrameworkTransient()\nexport class NodeProxyClient extends ProxyClient {\n    private config!: ClientConfig;\n\n    constructor(\n        // webpieces-disable inject-annotation-not-needed-for-concrete-class -- DI-resolved param; the esbuild/vitest path elides type-only imports (no design:paramtypes), so the explicit token is required\n        @inject(RequestContextHeaders) private readonly headers: RequestContextHeaders,\n        // webpieces-disable inject-annotation-not-needed-for-concrete-class -- DI-resolved param; the esbuild/vitest path elides type-only imports (no design:paramtypes), so the explicit token is required\n        @inject(GcpOidc) private readonly gcpOidc: GcpOidc,\n        // webpieces-disable inject-annotation-not-needed-for-concrete-class -- DI-resolved param; the esbuild/vitest path elides type-only imports (no design:paramtypes), so the explicit token is required\n        @inject(AddressResolver) private readonly addressResolver: AddressResolver,\n        // @optional: only @WpAuthSharedSecret endpoints need it; the client sends its bound value.\n        // webpieces-disable inject-annotation-not-needed-for-concrete-class -- DI-resolved param; the esbuild/vitest path elides type-only imports (no design:paramtypes), so the explicit token is required\n        @optional() @inject(SECRETS) private readonly secrets?: Secrets,\n        // @optional: only @WpAuthWebhook endpoints need it, and an unbound one makes them THROW\n        // rather than deliver unsigned — see WebhookSignerCallback.\n        // webpieces-disable inject-annotation-not-needed-for-concrete-class -- DI-resolved param; the esbuild/vitest path elides type-only imports (no design:paramtypes), so the explicit token is required\n        @optional()\n        @inject(WEBHOOK_SIGNER_CALLBACK)\n        private readonly webhookSigner?: WebhookSignerCallback,\n    ) {\n        // This package is node-only and already depends on core-context, so it builds the\n        // RequestContext-backed ApiCallContext itself. No startup install, and therefore nothing a\n        // non-webpieces host (plain NestJS/Express) can forget.\n        super(new LogApiCallImpl(new RequestContextApiCallContext()));\n    }\n\n    /**\n     * Bind this client to one API contract + target, with the app's outbound filters (url\n     * rewriting, header editing, logging, per-call re-pointing).\n     */\n    init(\n        apiPrototype: ApiPrototype<object>,\n        config: ClientConfig,\n        appFilters: ClientFilterDefinition[],\n    ): void {\n        this.config = config;\n        this.initRoutes(apiPrototype, appFilters);\n    }\n\n    /**\n     * The same chain every client runs — a ClientRegistry mapping, else the installed deriver — but\n     * with NODE's fallback: THROW. A server has no \"own origin\" to fall back to the way a browser\n     * does, so an unresolvable peer is a setup bug and must fail loudly (the error names the fixes).\n     *\n     * Resolved per call, never at construction, so building a client stays synchronous. Any metadata\n     * read beneath a deriver is memoized process-wide, so only the first call pays.\n     */\n    protected override resolveBaseUrl(): Promise<string> {\n        return ClientRegistry.resolve(this.config.svcName);\n    }\n\n    /** Node/undici supports a live ReadableStream body when fetch is given `duplex: 'half'`. */\n    protected override supportsConcurrentDuplexFetch(): boolean {\n        return true;\n    }\n\n    /**\n     * Node's native HTTP stream is genuinely concurrent: unlike browser Fetch, an early response\n     * does not cancel the still-open upload. The returned Web Response keeps parsing isomorphic.\n     */\n    protected override sendStreamingTransport(\n        request: ClientRequest,\n        signal: AbortSignal,\n        body: ByteReadableStream,\n    ): Promise<Response> {\n        return new Promise<Response>(\n            (resolve: (response: Response) => void, reject: (error: Error) => void) => {\n                const url = new URL(request.url);\n                const send = url.protocol === 'https:' ? httpsRequest : httpRequest;\n                const outgoing = send(\n                    url,\n                    {\n                        method: 'POST',\n                        headers: request.headersAsRecord(),\n                        signal,\n                    },\n                    (incoming: IncomingMessage): void => {\n                        const headers = new Headers();\n                        for (const [name, value] of Object.entries(incoming.headers)) {\n                            if (Array.isArray(value)) {\n                                for (const item of value) headers.append(name, item);\n                            } else if (value !== undefined) {\n                                headers.set(name, value);\n                            }\n                        }\n                        const responseBody = Readable.toWeb(incoming) as ReadableStream<Uint8Array>;\n                        resolve(\n                            new Response(responseBody, {\n                                status: incoming.statusCode ?? 500,\n                                statusText: incoming.statusMessage,\n                                headers,\n                            }),\n                        );\n                    },\n                );\n                outgoing.once('error', reject);\n                // webpieces-disable no-any-unknown -- a native socket/write rejection is normalized by toError\n                void this.pumpStreamingRequest(body, outgoing).catch((err: unknown) => {\n                    const error = toError(err);\n                    outgoing.destroy(error);\n                });\n            },\n        );\n    }\n\n    private async pumpStreamingRequest(\n        body: ByteReadableStream,\n        outgoing: import('node:http').ClientRequest,\n    ): Promise<void> {\n        const reader = body.getReader();\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions -- socket errors reject writer acknowledgements\n        try {\n            for (;;) {\n                const part = await reader.read();\n                if (part.done) break;\n                if (!outgoing.write(part.value)) await once(outgoing, 'drain');\n            }\n            outgoing.end();\n        } finally {\n            reader.releaseLock();\n        }\n    }\n\n    /**\n     * The two framework built-ins, installed on EVERY client this package builds and ordered\n     * beneath every app filter by {@link ProxyClient.initRoutes}.\n     *\n     * They are unconditional rather than opt-in because neither costs anything on the path that\n     * does not need it: the SSRF guard steps aside when nothing re-pointed the request, and the\n     * auth filter does nothing for a `@WpAuthPublic` endpoint. An app therefore cannot forget to install\n     * the guard on the one client that takes runtime URLs — the ACT of re-pointing is what arms it.\n     */\n    protected override clientFilters(): ClientFilterDefinition[] {\n        return [\n            new ClientFilterDefinition(\n                SSRF_GUARD_PRIORITY,\n                new SsrfGuardFilter(this.ssrfPolicy(), this.addressResolver),\n            ),\n            new ClientFilterDefinition(\n                OUTBOUND_AUTH_PRIORITY,\n                new OutboundAuthFilter(this.gcpOidc, this.secrets, this.webhookSigner),\n            ),\n        ];\n    }\n\n    /**\n     * WHICH policy the guard applies when something does re-point this client.\n     *\n     * Read off an installed {@link ContextBaseUrlFilter} or {@link ContextFullUrlFilter}, because\n     * that filter is where an app says\n     * \"this client may be re-pointed\", and the single legitimate relaxation\n     * ({@link SsrfTestingPolicy}) belongs at the same construction site as that decision rather\n     * than in a second place a reader has to correlate. No such filter — or one built with the\n     * default — means {@link SsrfPolicy} (the strict one), so the safe answer is what an app gets by saying\n     * nothing.\n     */\n    private ssrfPolicy(): SsrfPolicy {\n        for (const definition of this.appFilters) {\n            const filter = definition.filter;\n            if (filter instanceof ContextBaseUrlFilter || filter instanceof ContextFullUrlFilter) {\n                return filter.ssrfPolicy;\n            }\n        }\n        return new SsrfPolicy();\n    }\n\n    /**\n     * Straight from the RequestContext. Throws when there is no active request scope.\n     *\n     * `destination` rides through unchanged: this is the ONE client that can legitimately propagate a\n     * verified identity, and it does so exactly when the callee will authenticate us (@WpAuthOidc /\n     * @WpAuthSharedSecret). Calling a peer's @WpAuthPublic or @WpAuthJwt endpoint now omits `x-user-id` and\n     * friends instead of shipping headers that endpoint's AuthFilter is obliged to reject.\n     */\n    protected override outboundContextHeaders(destination: DestinationTrust): Map<string, string> {\n        return this.headers.buildOutboundHeaders(destination);\n    }\n\n    /**\n     * Straight into the ambient RequestContext — the reason a value a callee set climbs the call\n     * tree: after this returns, the CALLER's context holds it, and the caller's own response (and its\n     * own outbound calls) carry it onward.\n     *\n     * `destination` is the trust gate, and it is the mirror of the inbound problem rather than a\n     * restatement of it: a response is another process's ASSERTION. Untrusted response keys are\n     * admitted; a TRUSTED one is admitted only from a destination this client authenticated to, and\n     * is otherwise dropped — see `RequestContextHeaders.acceptResponseHeaders`.\n     */\n    protected override acceptResponseContext(\n        headers: Headers,\n        destination: DestinationTrust,\n    ): void {\n        this.headers.acceptResponseHeaders(headers, destination);\n    }\n\n    /**\n     * Test-case recording hook (mirror of Java HttpsJsonClientInvokeHandler): if a recorder is\n     * travelling in the magic context, capture this outbound call + its result so it becomes a mock\n     * in the generated test. Absent a recorder this is exactly the base behavior.\n     */\n    // webpieces-disable no-any-unknown -- DTO types are erased at the proxy boundary\n    protected override async execute(\n        route: RouteMetadata,\n        requestDto: unknown,\n        // webpieces-disable no-any-unknown -- DTO types are erased at the proxy boundary\n        method: () => Promise<unknown>,\n        // webpieces-disable no-any-unknown -- DTO types are erased at the proxy boundary\n    ): Promise<unknown> {\n        // Preserve the context precondition before logging, which also requires an active scope.\n        if (!RequestContext.isActive()) {\n            throw new Error(\n                'No active RequestContext. Run the client call inside RequestContext.run(...).',\n            );\n        }\n        const recorder = this.headers.findRecorder();\n        if (!recorder) {\n            return super.execute(route, requestDto, method);\n        }\n        return this.recordCall(recorder, route, requestDto, method);\n    }\n\n    /**\n     * Execute the call while recording it (args + masked ctx snapshot + result).\n     *\n     * The snapshot is a FIXTURE field, not a log line, so it is built here rather than handed down\n     * from the call path — a logging backend stamps its own fields and never sees this.\n     */\n    // webpieces-disable no-any-unknown -- DTO types are erased at the proxy boundary\n    private async recordCall(\n        recorder: TestCaseRecorder,\n        route: RouteMetadata,\n        requestDto: unknown,\n        // webpieces-disable no-any-unknown -- DTO types are erased at the proxy boundary\n        method: () => Promise<unknown>,\n        // webpieces-disable no-any-unknown -- DTO types are erased at the proxy boundary\n    ): Promise<unknown> {\n        const ctxSnapshot: Record<string, string> = {};\n        for (const entry of RequestContext.buildLogFields().entries()) {\n            ctxSnapshot[entry[0]] = entry[1];\n        }\n        const recorded = new RecordedEndpoint(\n            this.contractName(),\n            route.methodName,\n            [requestDto],\n            ctxSnapshot,\n        );\n        recorder.addEndpointInfo(recorded);\n\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions -- capture failure into the recording, then rethrow unchanged\n        try {\n            const response = await super.execute(route, requestDto, method);\n            recorded.successResponse = response;\n            return response;\n        } catch (err: unknown) {\n            const error = toError(err);\n            recorded.failureResponse = new RecordedError(error.name, error.message);\n            throw err;\n        }\n    }\n\n}\n\n/**\n * DI token for the `Provider<NodeProxyClient>` that hands out RPC clients — one per API contract.\n * `Provider<T>` is erased at runtime, so it cannot be its own token; this Symbol names T.\n *\n * Because NodeProxyClient is bound TRANSIENT, every `get()` constructs a new one. (Were it bound\n * `@provideFrameworkSingleton`, the very same Provider would instead hand back one lazily-created\n * instance — the provider caches nothing, so the target's scope decides.)\n */\n// webpieces-disable no-symbol-di-tokens -- Provider<T> is erased at runtime; the Symbol names T\nexport const NODE_PROXY_CLIENT_PROVIDER = Symbol.for('Provider<NodeProxyClient>');\n"]}