@ya-accelerators/web-backend-framework 0.0.143 → 0.0.145

package/@types/general.d.ts

@@ -5,7 +5,6 @@ declare global {
   type JsonValue = JsonPrimitive | JsonObject | JsonArray
 
   type EmptyObject = Record<string, never>
-  const Empty: EmptyObject
 
   type Simplify<T> = { [K in keyof T]: T[K] } & {}
 }

package/dist/connector/google-auth/index.js

@@ -2,39 +2,8 @@ import { z } from 'zod';
 import { constants } from '../../constants.js';
 import { runWithRequestHeaders } from '../../context/request/index.js';
 import { awsSecurityCredentialsSupplier, impersonatedClient, parseWifConfig } from '../../internal/federation/index.js';
+import { jwksVerify } from '../../internal/jwks/index.js';
 import { logger } from '../../logger/index.js';
-import { redis } from '../../repository/redis/index.js';
-const JwkParametersSchema = z.object({
-    alg: z.string().optional(),
-    key_ops: z.array(z.string()).optional(),
-    ext: z.boolean().optional(),
-    use: z.string().optional(),
-    x5c: z.array(z.string()).optional(),
-    x5t: z.string().optional(),
-    'x5t#S256': z.string().optional(),
-    x5u: z.string().optional(),
-    kid: z.string().optional(),
-});
-const AnyPublicJwkSchema = z.discriminatedUnion('kty', [
-    JwkParametersSchema.extend({ kty: z.literal('RSA'), e: z.string(), n: z.string() }),
-    JwkParametersSchema.extend({ kty: z.literal('EC'), crv: z.string(), x: z.string(), y: z.string() }),
-    JwkParametersSchema.extend({ kty: z.literal('OKP'), crv: z.string(), x: z.string() }),
-    JwkParametersSchema.extend({ kty: z.literal('AKP'), alg: z.string(), pub: z.string() }),
-]);
-const JwksResponseSchema = z.object({ keys: z.array(z.unknown()) }).transform(({ keys }) => ({
-    keys: keys.flatMap((key) => {
-        const result = AnyPublicJwkSchema.safeParse(key);
-        return result.success ? [result.data] : [];
-    }),
-    total: keys.length,
-}));
-const GoogleIdTokenClaimsSchema = z.object({
-    sub: z.string(),
-    aud: z.union([z.string(), z.array(z.string())]).optional(),
-    email: z.string().optional(),
-    email_verified: z.boolean().optional(),
-    hd: z.string().optional(),
-});
 export const googleCloudAuth = (wifConfigBase64) => {
     let client;
     let inflight;
@@ -82,27 +51,26 @@ export const googleIdTokenAuth = (wifConfigBase64, audience, forHost) => {
     }
     let cached;
     let inflight;
-    const fetchIdToken = async () => {
-        const { impersonated } = await impersonatedClient({
-            wifConfigBase64,
-            label: 'googleIdTokenAuth',
-            lifetime: constants.ID_TOKEN_TTL_SEC,
-            targetScopes: ['https://www.googleapis.com/auth/cloud-platform'],
-        });
-        return {
-            token: await impersonated.fetchIdToken(audience, { includeEmail: true }).catch((e) => {
-                logger.error('google-auth', { op: 'id-token', error: e });
-                throw e;
-            }),
-            expiresAt: (Math.floor(Date.now() / 1000) + constants.ID_TOKEN_TTL_SEC) * 1000,
-        };
-    };
     const bearer = async () => {
         if (cached !== undefined && Date.now() <= cached.expiresAt - constants.REFRESH_SKEW_MS) {
             return `Bearer ${cached.token}`;
         }
         if (inflight === undefined) {
-            inflight = fetchIdToken().finally(() => {
+            inflight = (async () => {
+                const { impersonated } = await impersonatedClient({
+                    wifConfigBase64,
+                    label: 'googleIdTokenAuth',
+                    lifetime: constants.ID_TOKEN_TTL_SEC,
+                    targetScopes: ['https://www.googleapis.com/auth/cloud-platform'],
+                });
+                return {
+                    token: await impersonated.fetchIdToken(audience, { includeEmail: true }).catch((e) => {
+                        logger.error('google-auth', { op: 'id-token', error: e });
+                        throw e;
+                    }),
+                    expiresAt: (Math.floor(Date.now() / 1000) + constants.ID_TOKEN_TTL_SEC) * 1000,
+                };
+            })().finally(() => {
                 inflight = undefined;
             });
         }
@@ -114,65 +82,24 @@ export const googleIdTokenAuth = (wifConfigBase64, audience, forHost) => {
         withAuth: async (fn) => runWithRequestHeaders({ authorization: await bearer() }, fn, { forHost }),
     };
 };
-export const googleIdTokenVerify = async ({ token, audience, issuer, jwksCacheKey, jwksCacheTtlSec, }) => {
-    const { createLocalJWKSet, errors, jwtVerify } = await import('jose');
-    const fetchJwks = async () => {
-        const res = await fetch('https://www.googleapis.com/oauth2/v3/certs', {
-            cache: 'no-store',
-            signal: AbortSignal.timeout(constants.GOOGLE_JWKS_FETCH_TIMEOUT_MS),
-        }).catch((e) => {
-            logger.error('google-auth', { op: 'jwks-fetch', error: e });
-            throw e;
-        });
-        if (!res.ok) {
-            logger.error('google-auth', { op: 'jwks-fetch', status: res.status });
-            throw new Error(`googleIdTokenVerify: Google JWKS fetch failed (${res.status})`);
-        }
-        const parsed = JwksResponseSchema.safeParse(await res.json().catch((e) => {
-            logger.error('google-auth', { op: 'jwks-fetch', error: e });
-            throw e;
-        }));
-        if (!parsed.success) {
-            logger.error('google-auth', { op: 'jwks-fetch', error: parsed.error });
-            throw parsed.error;
-        }
-        const { keys, total } = parsed.data;
-        if (keys.length !== total || keys.length === 0) {
-            logger.error('google-auth', { op: 'jwks-key-shape', total, kept: keys.length });
-        }
-        if (keys.length === 0) {
-            throw new Error('googleIdTokenVerify: JWKS carries no usable key');
-        }
-        const jwks = { keys };
-        await redis.set(jwksCacheKey, JSON.stringify(jwks), jwksCacheTtlSec).catch(() => undefined);
-        return jwks;
-    };
-    const cached = await redis.get(jwksCacheKey).catch(() => undefined);
-    const cachedJwks = (() => {
-        try {
-            if (cached === undefined) {
-                return undefined;
-            }
-            const { keys } = JwksResponseSchema.parse(JSON.parse(cached));
-            return keys.length === 0 ? undefined : { keys };
-        }
-        catch {
-            return undefined;
-        }
-    })();
-    let jwks = cachedJwks ?? (await fetchJwks());
-    const verify = async () => GoogleIdTokenClaimsSchema.parse((await jwtVerify(token, createLocalJWKSet(jwks), { issuer, audience })).payload);
-    try {
-        return await verify();
-    }
-    catch (e) {
-        if (e instanceof errors.JWKSNoMatchingKey && cachedJwks !== undefined) {
-            jwks = await fetchJwks();
-            return await verify();
-        }
-        throw e;
-    }
-};
+export const googleIdTokenVerify = async ({ token, audience, issuer, jwksCacheKey, jwksCacheTtlSec, }) => z
+    .object({
+    sub: z.string(),
+    aud: z.union([z.string(), z.array(z.string())]).optional(),
+    email: z.string().optional(),
+    email_verified: z.boolean().optional(),
+    hd: z.string().optional(),
+})
+    .parse(await jwksVerify({
+    token,
+    audience,
+    issuer,
+    jwksUri: 'https://www.googleapis.com/oauth2/v3/certs',
+    jwksCacheKey,
+    jwksCacheTtlSec,
+    tag: 'google-auth',
+    label: 'googleIdTokenVerify',
+}));
 export const googleImpersonatedAuth = (wifConfigBase64, { label, lifetime, targetScopes }) => ({
     accessToken: async () => {
         const { impersonated, serviceAccountEmail } = await impersonatedClient({

package/dist/connector/google-auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/connector/google-auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AACtE,OAAO,EAAE,8BAA8B,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAA;AACvH,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,iCAAiC,CAAA;AAEvD,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC3B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC,CAAA;AACF,MAAM,kBAAkB,GAAG,CAAC,CAAC,kBAAkB,CAAC,KAAK,EAAE;IACrD,mBAAmB,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACnF,mBAAmB,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACnG,mBAAmB,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACrF,mBAAmB,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;CACxF,CAAC,CAAA;AACF,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC3F,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACzB,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;QAChD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC5C,CAAC,CAAC;IACF,KAAK,EAAE,IAAI,CAAC,MAAM;CACnB,CAAC,CAAC,CAAA;AACH,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACtC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC1B,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,eAAuB,EAAE,EAAE;IACzD,IAAI,MAA8B,CAAA;IAClC,IAAI,QAAyC,CAAA;IAC7C,MAAM,sBAAsB,GAAG,GAAG,EAAE,CAAC,CAAC;QACpC,GAAG,cAAc,CAAC,eAAe,EAAE,iBAAiB,CAAC;QACrD,iBAAiB,EAAE,SAAS;QAC5B,iCAAiC,EAAE,8BAA8B;QACjE,MAAM,EAAE,CAAC,gDAAgD,CAAC;KAC3D,CAAC,CAAA;IAEF,MAAM,UAAU,GAAG,KAAK,IAAI,EAAE;QAC5B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,MAAM,CAAA;QACf,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,QAAQ,GAAG,CAAC,KAAK,IAAI,EAAE;gBACrB,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAA;gBACzD,OAAO,IAAI,SAAS,CAAC,sBAAsB,EAAE,CAAC,CAAA;YAChD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBAChB,QAAQ,GAAG,SAAS,CAAA;YACtB,CAAC,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,GAAG,MAAM,QAAQ,CAAA;QACvB,OAAO,MAAM,CAAA;IACf,CAAC,CAAA;IAED,OAAO;QACL,UAAU;QACV,gBAAgB,EAAE,sBAAsB;QACxC,MAAM,EAAE,KAAK,IAAI,EAAE;YACjB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,MAAM,UAAU,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;gBACxE,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;gBAC7D,MAAM,CAAC,CAAA;YACT,CAAC,CAAC,CAAA;YACF,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;YAC9D,CAAC;YACD,OAAO,UAAU,KAAK,EAAE,CAAA;QAC1B,CAAC;KACF,CAAA;AACH,CAAC,CAAA;AAED,yGAAyG;AACzG,8GAA8G;AAC9G,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,eAAuB,EAAE,QAAgB,EAAE,OAAe,EAAE,EAAE;IAC9F,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3D,CAAC;IACD,IAAI,MAAwD,CAAA;IAC5D,IAAI,QAAmE,CAAA;IACvE,MAAM,YAAY,GAAG,KAAK,IAAI,EAAE;QAC9B,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,kBAAkB,CAAC;YAChD,eAAe;YACf,KAAK,EAAE,mBAAmB;YAC1B,QAAQ,EAAE,SAAS,CAAC,gBAAgB;YACpC,YAAY,EAAE,CAAC,gDAAgD,CAAC;SACjE,CAAC,CAAA;QACF,OAAO;YACL,KAAK,EAAE,MAAM,YAAY,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;gBACnF,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;gBACzD,MAAM,CAAC,CAAA;YACT,CAAC,CAAC;YACF,SAAS,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC,gBAAgB,CAAC,GAAG,IAAI;SAC/E,CAAA;IACH,CAAC,CAAA;IACD,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE;QACxB,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC,eAAe,EAAE,CAAC;YACvF,OAAO,UAAU,MAAM,CAAC,KAAK,EAAE,CAAA;QACjC,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,QAAQ,GAAG,YAAY,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBACrC,QAAQ,GAAG,SAAS,CAAA;YACtB,CAAC,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,GAAG,MAAM,QAAQ,CAAA;QACvB,OAAO,UAAU,MAAM,CAAC,KAAK,EAAE,CAAA;IACjC,CAAC,CAAA;IAED,OAAO;QACL,MAAM;QACN,QAAQ,EAAE,KAAK,EAAK,EAAoB,EAAE,EAAE,CAC1C,qBAAqB,CAAC,EAAE,aAAa,EAAE,MAAM,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;KAC5E,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,EACxC,KAAK,EACL,QAAQ,EACR,MAAM,EACN,YAAY,EACZ,eAAe,GAOhB,EAAE,EAAE;IACH,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAA;IACrE,MAAM,SAAS,GAAG,KAAK,IAAI,EAAE;QAC3B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,4CAA4C,EAAE;YACpE,KAAK,EAAE,UAAU;YACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,4BAA4B,CAAC;SACpE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;YACb,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;YAC3D,MAAM,CAAC,CAAA;QACT,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;YACrE,MAAM,IAAI,KAAK,CAAC,kDAAkD,GAAG,CAAC,MAAM,GAAG,CAAC,CAAA;QAClF,CAAC;QACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CACzC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;YAC3B,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;YAC3D,MAAM,CAAC,CAAA;QACT,CAAC,CAAC,CACH,CAAA;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAA;YACtE,MAAM,MAAM,CAAC,KAAK,CAAA;QACpB,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,IAAI,CAAA;QACnC,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/C,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;QACjF,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;QACpE,CAAC;QACD,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,CAAA;QACrB,MAAM,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QAC3F,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IACnE,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE;QACvB,IAAI,CAAC;YACH,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,MAAM,EAAE,IAAI,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;YAC7D,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAA;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC,CAAC,EAAE,CAAA;IACJ,IAAI,IAAI,GAAG,UAAU,IAAI,CAAC,MAAM,SAAS,EAAE,CAAC,CAAA;IAC5C,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE,CACxB,yBAAyB,CAAC,KAAK,CAAC,CAAC,MAAM,SAAS,CAAC,KAAK,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;IAClH,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,EAAE,CAAA;IACvB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,MAAM,CAAC,iBAAiB,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YACtE,IAAI,GAAG,MAAM,SAAS,EAAE,CAAA;YACxB,OAAO,MAAM,MAAM,EAAE,CAAA;QACvB,CAAC;QACD,MAAM,CAAC,CAAA;IACT,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,eAAuB,EACvB,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAA+D,EAC9F,EAAE,CAAC,CAAC;IACJ,WAAW,EAAE,KAAK,IAAI,EAAE;QACtB,MAAM,EAAE,YAAY,EAAE,mBAAmB,EAAE,GAAG,MAAM,kBAAkB,CAAC;YACrE,eAAe;YACf,KAAK;YACL,QAAQ;YACR,YAAY;SACb,CAAC,CAAA;QACF,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,YAAY,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;YAChE,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;YACpE,MAAM,CAAC,CAAA;QACT,CAAC,CAAC,CAAA;QACF,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,yCAAyC,CAAC,CAAA;QACpE,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAA;IACvC,CAAC;CACF,CAAC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/connector/google-auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AACtE,OAAO,EAAE,8BAA8B,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAA;AACvH,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAA;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAE9C,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,eAAuB,EAAE,EAAE;IACzD,IAAI,MAA8B,CAAA;IAClC,IAAI,QAAyC,CAAA;IAC7C,MAAM,sBAAsB,GAAG,GAAG,EAAE,CAAC,CAAC;QACpC,GAAG,cAAc,CAAC,eAAe,EAAE,iBAAiB,CAAC;QACrD,iBAAiB,EAAE,SAAS;QAC5B,iCAAiC,EAAE,8BAA8B;QACjE,MAAM,EAAE,CAAC,gDAAgD,CAAC;KAC3D,CAAC,CAAA;IAEF,MAAM,UAAU,GAAG,KAAK,IAAI,EAAE;QAC5B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,MAAM,CAAA;QACf,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,QAAQ,GAAG,CAAC,KAAK,IAAI,EAAE;gBACrB,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAA;gBACzD,OAAO,IAAI,SAAS,CAAC,sBAAsB,EAAE,CAAC,CAAA;YAChD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBAChB,QAAQ,GAAG,SAAS,CAAA;YACtB,CAAC,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,GAAG,MAAM,QAAQ,CAAA;QACvB,OAAO,MAAM,CAAA;IACf,CAAC,CAAA;IAED,OAAO;QACL,UAAU;QACV,gBAAgB,EAAE,sBAAsB;QACxC,MAAM,EAAE,KAAK,IAAI,EAAE;YACjB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,MAAM,UAAU,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC,CAAQ,EAAE,EAAE;gBAC/E,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;gBAC7D,MAAM,CAAC,CAAA;YACT,CAAC,CAAC,CAAA;YACF,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;YAC9D,CAAC;YACD,OAAO,UAAU,KAAK,EAAE,CAAA;QAC1B,CAAC;KACF,CAAA;AACH,CAAC,CAAA;AAED,yGAAyG;AACzG,8GAA8G;AAC9G,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,eAAuB,EAAE,QAAgB,EAAE,OAAe,EAAE,EAAE;IAC9F,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC3D,CAAC;IACD,IAAI,MAAwD,CAAA;IAC5D,IAAI,QAAmE,CAAA;IACvE,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE;QACxB,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC,eAAe,EAAE,CAAC;YACvF,OAAO,UAAU,MAAM,CAAC,KAAK,EAAE,CAAA;QACjC,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,QAAQ,GAAG,CAAC,KAAK,IAAI,EAAE;gBACrB,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,kBAAkB,CAAC;oBAChD,eAAe;oBACf,KAAK,EAAE,mBAAmB;oBAC1B,QAAQ,EAAE,SAAS,CAAC,gBAAgB;oBACpC,YAAY,EAAE,CAAC,gDAAgD,CAAC;iBACjE,CAAC,CAAA;gBACF,OAAO;oBACL,KAAK,EAAE,MAAM,YAAY,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAQ,EAAE,EAAE;wBAC1F,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;wBACzD,MAAM,CAAC,CAAA;oBACT,CAAC,CAAC;oBACF,SAAS,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC,gBAAgB,CAAC,GAAG,IAAI;iBAC/E,CAAA;YACH,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBAChB,QAAQ,GAAG,SAAS,CAAA;YACtB,CAAC,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,GAAG,MAAM,QAAQ,CAAA;QACvB,OAAO,UAAU,MAAM,CAAC,KAAK,EAAE,CAAA;IACjC,CAAC,CAAA;IAED,OAAO;QACL,MAAM;QACN,QAAQ,EAAE,KAAK,EAAK,EAAoB,EAAE,EAAE,CAC1C,qBAAqB,CAAC,EAAE,aAAa,EAAE,MAAM,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;KAC5E,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,EACxC,KAAK,EACL,QAAQ,EACR,MAAM,EACN,YAAY,EACZ,eAAe,GAOhB,EAAE,EAAE,CACH,CAAC;KACE,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACtC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC1B,CAAC;KACD,KAAK,CACJ,MAAM,UAAU,CAAC;IACf,KAAK;IACL,QAAQ;IACR,MAAM;IACN,OAAO,EAAE,4CAA4C;IACrD,YAAY;IACZ,eAAe;IACf,GAAG,EAAE,aAAa;IAClB,KAAK,EAAE,qBAAqB;CAC7B,CAAC,CACH,CAAA;AAEL,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,eAAuB,EACvB,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAA+D,EAC9F,EAAE,CAAC,CAAC;IACJ,WAAW,EAAE,KAAK,IAAI,EAAE;QACtB,MAAM,EAAE,YAAY,EAAE,mBAAmB,EAAE,GAAG,MAAM,kBAAkB,CAAC;YACrE,eAAe;YACf,KAAK;YACL,QAAQ;YACR,YAAY;SACb,CAAC,CAAA;QACF,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,YAAY,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC,CAAQ,EAAE,EAAE;YACvE,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;YACpE,MAAM,CAAC,CAAA;QACT,CAAC,CAAC,CAAA;QACF,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,yCAAyC,CAAC,CAAA;QACpE,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAA;IACvC,CAAC;CACF,CAAC,CAAA"}

package/dist/connector/index.d.ts

@@ -1,2 +1,3 @@
 export * from './google-auth/index.ts';
 export * from './oauth-dev-redirect/index.ts';
+export * from './oidc/index.ts';

package/dist/connector/index.js

@@ -1,3 +1,4 @@
 export * from './google-auth/index.js';
 export * from './oauth-dev-redirect/index.js';
+export * from './oidc/index.js';
 //# sourceMappingURL=index.js.map

package/dist/connector/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/connector/index.ts"],"names":[],"mappings":"AAAA,cAAc,wBAAwB,CAAA;AACtC,cAAc,+BAA+B,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/connector/index.ts"],"names":[],"mappings":"AAAA,cAAc,wBAAwB,CAAA;AACtC,cAAc,+BAA+B,CAAA;AAC7C,cAAc,iBAAiB,CAAA"}

package/dist/connector/oidc/index.d.ts

@@ -0,0 +1,11 @@
+export declare const oidcIdTokenVerify: ({ token, audience, issuer, jwksUri, jwksCacheKey, jwksCacheTtlSec, }: {
+    token: string;
+    audience: string | string[];
+    issuer: string | string[];
+    jwksUri: string;
+    jwksCacheKey: string;
+    jwksCacheTtlSec: number;
+}) => Promise<{
+    [x: string]: unknown;
+    sub: string;
+}>;

package/dist/connector/oidc/index.js

@@ -0,0 +1,13 @@
+import { z } from 'zod';
+import { jwksVerify } from '../../internal/jwks/index.js';
+export const oidcIdTokenVerify = async ({ token, audience, issuer, jwksUri, jwksCacheKey, jwksCacheTtlSec, }) => z.looseObject({ sub: z.string() }).parse(await jwksVerify({
+    token,
+    audience,
+    issuer,
+    jwksUri,
+    jwksCacheKey,
+    jwksCacheTtlSec,
+    tag: 'oidc',
+    label: 'oidcIdTokenVerify',
+}));
+//# sourceMappingURL=index.js.map

package/dist/connector/oidc/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/connector/oidc/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAA;AAEzD,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,EACtC,KAAK,EACL,QAAQ,EACR,MAAM,EACN,OAAO,EACP,YAAY,EACZ,eAAe,GAQhB,EAAE,EAAE,CACH,CAAC,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CACtC,MAAM,UAAU,CAAC;IACf,KAAK;IACL,QAAQ;IACR,MAAM;IACN,OAAO;IACP,YAAY;IACZ,eAAe;IACf,GAAG,EAAE,MAAM;IACX,KAAK,EAAE,mBAAmB;CAC3B,CAAC,CACH,CAAA"}

package/dist/constants.d.ts

@@ -6,7 +6,7 @@ export declare const constants: {
     ID_TOKEN_TTL_SEC: number;
     REFRESH_SKEW_MS: number;
     GOOGLE_ID_TOKEN_ISSUERS: string[];
-    GOOGLE_JWKS_FETCH_TIMEOUT_MS: number;
+    JWKS_FETCH_TIMEOUT_MS: number;
     REQUEST_ID_PATTERN: RegExp;
     UPLOADS_PATH: string;
     UPLOADS_PREFIX: string;

package/dist/constants.js

@@ -5,7 +5,7 @@ export const constants = {
     ID_TOKEN_TTL_SEC: 3600,
     REFRESH_SKEW_MS: 5 * 60 * 1000,
     GOOGLE_ID_TOKEN_ISSUERS: ['https://accounts.google.com', 'accounts.google.com'],
-    GOOGLE_JWKS_FETCH_TIMEOUT_MS: 5000,
+    JWKS_FETCH_TIMEOUT_MS: 5000,
     REQUEST_ID_PATTERN: /^[A-Za-z0-9._-]{1,128}$/,
     UPLOADS_PATH: '/api/uploads',
     UPLOADS_PREFIX: 'uploads/',

package/dist/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAA;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAA;AAErE,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,wBAAwB,EAAE,wEAAwE;IAClG,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;IAC9B,uBAAuB,EAAE,CAAC,6BAA6B,EAAE,qBAAqB,CAAC;IAC/E,4BAA4B,EAAE,IAAI;IAClC,kBAAkB,EAAE,yBAAyB;IAC7C,YAAY,EAAE,cAAc;IAC5B,cAAc,EAAE,UAAU;IAC1B,mBAAmB,EAAE,CAAC;IACtB,mBAAmB,EAAE,EAAE;IACvB,wBAAwB,EAAE,EAAE;IAC5B,eAAe,EAAE,EAAE;IACnB,sBAAsB,EAAE,EAAE;IAC1B,oBAAoB,EAAE,CAAC,GAAG,EAAE;IAC5B,0BAA0B,EAAE,GAAG;IAC/B,8BAA8B,EAAE,GAAG;IACnC,0BAA0B,EAAE,0BAA0B;IACtD,gBAAgB,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;IACnC,wBAAwB,EAAE,EAAE;IAC5B,+BAA+B,EAAE,EAAE;IACnC,gCAAgC,EAAE,EAAE;IACpC,6BAA6B,EAAE,qBAAqB,CAAC,mBAAmB;IACxE,qBAAqB,EAAE,IAAI;IAE3B,2GAA2G;IAC3G,2GAA2G;IAC3G,iBAAiB;IACjB,wBAAwB,EAAE,KAAK;IAC/B,yGAAyG;IACzG,2GAA2G;IAC3G,2FAA2F;IAC3F,qBAAqB,EAAE,KAAK;IAC5B,oBAAoB,EAAE,KAAK;IAE3B,4GAA4G;IAC5G,+FAA+F;IAC/F,4GAA4G;IAC5G,+CAA+C;IAC/C,uBAAuB,EAAE;QACvB,YAAY;QACZ,WAAW;QACX,WAAW;QACX,cAAc;QACd,YAAY;QACZ,YAAY;KACJ;IAEV,GAAG,YAAY;CAChB,CAAA"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAA;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAA;AAErE,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,wBAAwB,EAAE,wEAAwE;IAClG,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;IAC9B,uBAAuB,EAAE,CAAC,6BAA6B,EAAE,qBAAqB,CAAC;IAC/E,qBAAqB,EAAE,IAAI;IAC3B,kBAAkB,EAAE,yBAAyB;IAC7C,YAAY,EAAE,cAAc;IAC5B,cAAc,EAAE,UAAU;IAC1B,mBAAmB,EAAE,CAAC;IACtB,mBAAmB,EAAE,EAAE;IACvB,wBAAwB,EAAE,EAAE;IAC5B,eAAe,EAAE,EAAE;IACnB,sBAAsB,EAAE,EAAE;IAC1B,oBAAoB,EAAE,CAAC,GAAG,EAAE;IAC5B,0BAA0B,EAAE,GAAG;IAC/B,8BAA8B,EAAE,GAAG;IACnC,0BAA0B,EAAE,0BAA0B;IACtD,gBAAgB,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;IACnC,wBAAwB,EAAE,EAAE;IAC5B,+BAA+B,EAAE,EAAE;IACnC,gCAAgC,EAAE,EAAE;IACpC,6BAA6B,EAAE,qBAAqB,CAAC,mBAAmB;IACxE,qBAAqB,EAAE,IAAI;IAE3B,2GAA2G;IAC3G,2GAA2G;IAC3G,iBAAiB;IACjB,wBAAwB,EAAE,KAAK;IAC/B,yGAAyG;IACzG,2GAA2G;IAC3G,2FAA2F;IAC3F,qBAAqB,EAAE,KAAK;IAC5B,oBAAoB,EAAE,KAAK;IAE3B,4GAA4G;IAC5G,+FAA+F;IAC/F,4GAA4G;IAC5G,+CAA+C;IAC/C,uBAAuB,EAAE;QACvB,YAAY;QACZ,WAAW;QACX,WAAW;QACX,cAAc;QACd,YAAY;QACZ,YAAY;KACJ;IAEV,GAAG,YAAY;CAChB,CAAA"}

package/dist/context/audit/index.d.ts

@@ -10,11 +10,11 @@ export declare const getCurrentAuditContext: () => AuditContext | undefined;
 export declare const runWithAuditActorFor: <TReason extends string>() => <T>({ actorUserId, reason }: {
     actorUserId?: string;
     reason?: TReason;
-}, fn: () => Promise<T>) => Promise<T>;
+}, fn: () => PromiseLike<T>) => Promise<T>;
 export declare const runWithAuditActor: <T>({ actorUserId, reason }: {
     actorUserId?: string;
     reason?: AuditOperationReason | undefined;
-}, fn: () => Promise<T>) => Promise<T>;
+}, fn: () => PromiseLike<T>) => Promise<T>;
 export declare const runAsSystemAction: <T>({ reason }: {
     reason?: string;
-}, fn: () => Promise<T>) => Promise<T>;
+}, fn: () => PromiseLike<T>) => Promise<T>;

package/dist/context/audit/index.js

@@ -6,11 +6,13 @@ export const runWithAuditActorFor = () => ({ actorUserId, reason }, fn) => {
         actorUserId,
         reason,
         suppress: auditContextStorage.getStore()?.suppress ?? false,
-    }, fn);
+    }, 
+    // A PrismaPromise starts its query only when `.then` is called, so `fn`'s result is awaited inside the scope.
+    async () => await fn());
 };
 export const runWithAuditActor = runWithAuditActorFor();
 export const runAsSystemAction = ({ reason }, fn) => auditContextStorage.run({
     reason,
     suppress: true,
-}, fn);
+}, async () => await fn());
 //# sourceMappingURL=index.js.map

package/dist/context/audit/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/context/audit/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAyB/C,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,iBAAiB,EAAgB,CAAA;AAExE,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,EAAE,CAAC,mBAAmB,CAAC,QAAQ,EAAE,CAAA;AAE1E,MAAM,CAAC,MAAM,oBAAoB,GAC/B,GAA2B,EAAE,CAC7B,CAAI,EAAE,WAAW,EAAE,MAAM,EAA8C,EAAE,EAAoB,EAAE,EAAE;IAC/F,OAAO,mBAAmB,CAAC,GAAG,CAC5B;QACE,WAAW;QACX,MAAM;QACN,QAAQ,EAAE,mBAAmB,CAAC,QAAQ,EAAE,EAAE,QAAQ,IAAI,KAAK;KAC5D,EACD,EAAE,CACH,CAAA;AACH,CAAC,CAAA;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,EAAwB,CAAA;AAE7E,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAI,EAAE,MAAM,EAAuB,EAAE,EAAoB,EAAE,EAAE,CAC5F,mBAAmB,CAAC,GAAG,CACrB;IACE,MAAM;IACN,QAAQ,EAAE,IAAI;CACf,EACD,EAAE,CACH,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/context/audit/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAyB/C,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,iBAAiB,EAAgB,CAAA;AAExE,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,EAAE,CAAC,mBAAmB,CAAC,QAAQ,EAAE,CAAA;AAE1E,MAAM,CAAC,MAAM,oBAAoB,GAC/B,GAA2B,EAAE,CAC7B,CAAI,EAAE,WAAW,EAAE,MAAM,EAA8C,EAAE,EAAwB,EAAE,EAAE;IACnG,OAAO,mBAAmB,CAAC,GAAG,CAC5B;QACE,WAAW;QACX,MAAM;QACN,QAAQ,EAAE,mBAAmB,CAAC,QAAQ,EAAE,EAAE,QAAQ,IAAI,KAAK;KAC5D;IACD,8GAA8G;IAC9G,KAAK,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CACvB,CAAA;AACH,CAAC,CAAA;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,EAAwB,CAAA;AAE7E,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAI,EAAE,MAAM,EAAuB,EAAE,EAAwB,EAAE,EAAE,CAChG,mBAAmB,CAAC,GAAG,CACrB;IACE,MAAM;IACN,QAAQ,EAAE,IAAI;CACf,EACD,KAAK,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CACvB,CAAA"}

package/dist/context/request/index.d.ts

@@ -13,16 +13,3 @@ export declare const runWithRequestHeaders: <T>(headers: Record<string, string>,
     forHost?: string;
 }) => Promise<T>;
 export declare const runWithRequestPath: <T>(path: string, fn: () => Promise<T> | T) => T | Promise<T>;
-export declare const resolveOutboundHeaders: (store: {
-    headers: Record<string, string>;
-    forwardHeaderScopes?: {
-        headers: Record<string, string>;
-        forHost?: string;
-    }[];
-    nonForwardableHeaders?: ReadonlySet<string>;
-}, options: {
-    allowList: ReadonlySet<string>;
-    targetHost?: string;
-    init?: RequestInit;
-    inputHeaders?: Headers;
-}) => Headers;

package/dist/context/request/index.js

@@ -26,45 +26,4 @@ export const runWithRequestPath = (path, fn) => {
         path,
     }, fn);
 };
-// `requestHost()` derives `targetHost` via `new URL(url).host`, which drops a port equal to the scheme
-// default (`http:` 80 / `https:` 443) — so a caller who writes `forHost: 'api.internal:80'` (as the docs
-// show) would never match the `'api.internal'` that an actual `http://api.internal:80/...` fetch produces.
-// Strip the default ports from both sides before comparing so host-binding works for the common in-mesh
-// case (the BFF listens on port 80).
-const stripDefaultPort = (host) => host.replace(/:(?:80|443)$/, '');
-// Compute the header set for a request-scoped outbound `fetch`. Precedence (highest wins):
-//   1. the caller's own per-call headers — `init.headers`, then the input `Request`'s own headers
-//      (`fetch(new Request(url, { headers }))`; init wins over the Request per the fetch spec)
-//   2. explicit `runWithRequestHeaders` scopes (inner overrides outer; a host-bound scope applies only
-//      when the target host matches — a forwarded credential must not follow a cross-origin redirect)
-//   3. auto-forwarded inbound headers, restricted to `allowList` minus the app's `nonForwardableHeaders`
-// Pure (no I/O / no ALS read) so the branch matrix is unit-testable; `server/express` supplies the store,
-// the framework allow-list, the parsed target host, and the input `Request`'s headers.
-export const resolveOutboundHeaders = (store, options) => {
-    // The caller's own headers = the input Request's headers, then overridden by init.headers. Passing a
-    // rebuilt `headers` in init to `fetch(Request, init)` otherwise drops the Request's own headers, so
-    // they must be carried here.
-    const callerHeaders = new Headers(options.inputHeaders ?? undefined);
-    for (const [key, value] of new Headers(options.init?.headers ?? {})) {
-        callerHeaders.set(key, value);
-    }
-    const headers = new Headers(callerHeaders);
-    for (const [key, value] of Object.entries(store.headers)) {
-        const lower = key.toLowerCase();
-        if (options.allowList.has(lower) && !store.nonForwardableHeaders?.has(lower) && !headers.has(key)) {
-            headers.set(key, value);
-        }
-    }
-    for (const scope of store.forwardHeaderScopes ?? []) {
-        if (scope.forHost !== undefined && stripDefaultPort(scope.forHost) !== stripDefaultPort(options.targetHost ?? '')) {
-            continue;
-        }
-        for (const [key, value] of Object.entries(scope.headers)) {
-            if (!callerHeaders.has(key)) {
-                headers.set(key, value);
-            }
-        }
-    }
-    return headers;
-};
 //# sourceMappingURL=index.js.map

package/dist/context/request/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/context/request/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAE/C,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,iBAAiB,EAKtD,CAAA;AAEJ,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,EAAE,CAAC,qBAAqB,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAA;AAEjF,kGAAkG;AAClG,uGAAuG;AACvG,oGAAoG;AACpG,wCAAwC;AACxC,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,OAA+B,EAC/B,EAAoB,EACpB,OAA8B,EAC9B,EAAE;IACF,MAAM,OAAO,GAAG,qBAAqB,CAAC,QAAQ,EAAE,CAAA;IAChD,OAAO,qBAAqB,CAAC,GAAG,CAC9B;QACE,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE;QAC/B,mBAAmB,EAAE;YACnB,GAAG,CAAC,OAAO,EAAE,mBAAmB,IAAI,EAAE,CAAC;YACvC,OAAO,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE;SACnG;QACD,GAAG,CAAC,OAAO,EAAE,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,EAAE,CAAC;QACjH,GAAG,CAAC,OAAO,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;KAC/D,EACD,EAAE,CACH,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAI,IAAY,EAAE,EAAwB,EAAE,EAAE;IAC9E,MAAM,OAAO,GAAG,qBAAqB,CAAC,QAAQ,EAAE,CAAA;IAChD,OAAO,qBAAqB,CAAC,GAAG,CAC9B;QACE,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE;QAC/B,GAAG,CAAC,OAAO,EAAE,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,EAAE,CAAC;QAC3G,GAAG,CAAC,OAAO,EAAE,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,EAAE,CAAC;QACjH,IAAI;KACL,EACD,EAAE,CACH,CAAA;AACH,CAAC,CAAA;AAED,uGAAuG;AACvG,yGAAyG;AACzG,2GAA2G;AAC3G,wGAAwG;AACxG,qCAAqC;AACrC,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAA;AAE3E,2FAA2F;AAC3F,kGAAkG;AAClG,+FAA+F;AAC/F,uGAAuG;AACvG,sGAAsG;AACtG,yGAAyG;AACzG,0GAA0G;AAC1G,uFAAuF;AACvF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,KAIC,EACD,OAA4G,EAC5G,EAAE;IACF,qGAAqG;IACrG,oGAAoG;IACpG,6BAA6B;IAC7B,MAAM,aAAa,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,YAAY,IAAI,SAAS,CAAC,CAAA;IACpE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QACpE,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC/B,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,aAAa,CAAC,CAAA;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAA;QAC/B,IAAI,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,qBAAqB,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClG,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACzB,CAAC;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,mBAAmB,IAAI,EAAE,EAAE,CAAC;QACpD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,gBAAgB,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;YAClH,SAAQ;QACV,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACzD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/context/request/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAE/C,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,iBAAiB,EAKtD,CAAA;AAEJ,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,EAAE,CAAC,qBAAqB,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAA;AAEjF,kGAAkG;AAClG,uGAAuG;AACvG,oGAAoG;AACpG,wCAAwC;AACxC,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,OAA+B,EAC/B,EAAoB,EACpB,OAA8B,EAC9B,EAAE;IACF,MAAM,OAAO,GAAG,qBAAqB,CAAC,QAAQ,EAAE,CAAA;IAChD,OAAO,qBAAqB,CAAC,GAAG,CAC9B;QACE,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE;QAC/B,mBAAmB,EAAE;YACnB,GAAG,CAAC,OAAO,EAAE,mBAAmB,IAAI,EAAE,CAAC;YACvC,OAAO,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE;SACnG;QACD,GAAG,CAAC,OAAO,EAAE,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,EAAE,CAAC;QACjH,GAAG,CAAC,OAAO,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;KAC/D,EACD,EAAE,CACH,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAI,IAAY,EAAE,EAAwB,EAAE,EAAE;IAC9E,MAAM,OAAO,GAAG,qBAAqB,CAAC,QAAQ,EAAE,CAAA;IAChD,OAAO,qBAAqB,CAAC,GAAG,CAC9B;QACE,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE;QAC/B,GAAG,CAAC,OAAO,EAAE,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,EAAE,CAAC;QAC3G,GAAG,CAAC,OAAO,EAAE,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,EAAE,CAAC;QACjH,IAAI;KACL,EACD,EAAE,CACH,CAAA;AACH,CAAC,CAAA"}

package/dist/coordination/lock/index.js

@@ -23,7 +23,12 @@ export const lock = {
     release: async ({ key, token }) => {
         await redis.invokeScript(RELEASE_SCRIPT, { keys: [key], args: [token] });
     },
-    renew: async ({ key, token, ttlSec }) => (await redis.invokeScript(RENEW_SCRIPT, { keys: [key], args: [token, `${ttlSec}`] })) === 1,
+    renew: async ({ key, token, ttlSec }) => {
+        if (!Number.isInteger(ttlSec) || ttlSec <= 0) {
+            throw new Error(`lock: ttlSec must be a positive integer (got ${ttlSec})`);
+        }
+        return (await redis.invokeScript(RENEW_SCRIPT, { keys: [key], args: [token, `${ttlSec}`] })) === 1;
+    },
     withLock: async ({ key, ttlSec, heartbeat, }, fn) => {
         const token = await lock.acquire({ key, ttlSec });
         if (token === null) {

package/dist/coordination/lock/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/coordination/lock/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAE7C,OAAO,EAAE,KAAK,EAAE,MAAM,iCAAiC,CAAA;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAA;AAE1C,MAAM,cAAc,GAAG,IAAI,MAAM,CAAC;;;;;;CAMjC,CAAC,CAAA;AAEF,MAAM,YAAY,GAAG,IAAI,MAAM,CAAC;;;;;;CAM/B,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,EAAmC,EAAE,EAAE;QAClE,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,CAAA;QAC/B,OAAO,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IACvE,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,KAAK,EAAkC,EAAE,EAAE;QAChE,MAAM,KAAK,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAC1E,CAAC;IACD,KAAK,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAkD,EAAE,EAAE,CACtF,CAAC,MAAM,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,GAAG,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC;IAC7F,QAAQ,EAAE,KAAK,EACb,EACE,GAAG,EACH,MAAM,EACN,SAAS,GACgF,EAC3F,EAAoB,EACpB,EAAE;QACF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAA;QACjD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;QAC5B,CAAC;QACD,IAAI,OAAmD,CAAA;QACvD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,UAAU,GAAG,IAAI,CAAA;YAC1D,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE;gBACzB,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,SAAS,EAAE,CAAC;oBAC5B,aAAa,CAAC,OAAO,CAAC,CAAA;oBACtB,OAAO,GAAG,SAAS,CAAA;oBACnB,OAAM;gBACR,CAAC;gBACD,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;YAC3D,CAAC,EAAE,SAAS,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;QAClC,CAAC;QACD,IAAI,CAAC;YACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;QAC9C,CAAC;gBAAS,CAAC;YACT,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,aAAa,CAAC,OAAO,CAAC,CAAA;YACxB,CAAC;YACD,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QAC3D,CAAC;IACH,CAAC;CACF,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/coordination/lock/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAE7C,OAAO,EAAE,KAAK,EAAE,MAAM,iCAAiC,CAAA;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAA;AAE1C,MAAM,cAAc,GAAG,IAAI,MAAM,CAAC;;;;;;CAMjC,CAAC,CAAA;AAEF,MAAM,YAAY,GAAG,IAAI,MAAM,CAAC;;;;;;CAM/B,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,EAAmC,EAAE,EAAE;QAClE,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,CAAA;QAC/B,OAAO,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IACvE,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,KAAK,EAAkC,EAAE,EAAE;QAChE,MAAM,KAAK,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAC1E,CAAC;IACD,KAAK,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAkD,EAAE,EAAE;QACtF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,gDAAgD,MAAM,GAAG,CAAC,CAAA;QAC5E,CAAC;QACD,OAAO,CAAC,MAAM,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,GAAG,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAA;IACpG,CAAC;IACD,QAAQ,EAAE,KAAK,EACb,EACE,GAAG,EACH,MAAM,EACN,SAAS,GACgF,EAC3F,EAAoB,EACpB,EAAE;QACF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAA;QACjD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;QAC5B,CAAC;QACD,IAAI,OAAmD,CAAA;QACvD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,UAAU,GAAG,IAAI,CAAA;YAC1D,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE;gBACzB,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,SAAS,EAAE,CAAC;oBAC5B,aAAa,CAAC,OAAO,CAAC,CAAA;oBACtB,OAAO,GAAG,SAAS,CAAA;oBACnB,OAAM;gBACR,CAAC;gBACD,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;YAC3D,CAAC,EAAE,SAAS,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;QAClC,CAAC;QACD,IAAI,CAAC;YACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;QAC9C,CAAC;gBAAS,CAAC;YACT,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,aAAa,CAAC,OAAO,CAAC,CAAA;YACxB,CAAC;YACD,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QAC3D,CAAC;IACH,CAAC;CACF,CAAA"}

package/dist/env.js

@@ -1,25 +1,26 @@
 import { z } from 'zod';
 import { constants } from './constants.js';
 import { Util } from './util/index.js';
+const PortSchema = z.string().regex(/^\d+$/).transform(Number).pipe(z.number().int().min(1).max(65535));
 export const defaultEnv = Util.createEnvProxy(z.object({
     AWS_REGION: z.enum(constants.PII_ALLOWED_AWS_REGIONS),
     NODE_ENV: z.enum(['development', 'production']),
     DEPLOY_ENV: z.enum(['dev', 'stg', 'prd']),
     LOG_LEVEL: z.enum(['debug', 'info', 'warn', 'error']).optional(),
     DATABASE_HOST: z.string().min(1),
-    DATABASE_PORT: z.string().min(1).transform(Number),
+    DATABASE_PORT: PortSchema,
     DATABASE_RO_HOST: z.string().min(1),
-    DATABASE_RO_PORT: z.string().min(1).transform(Number),
+    DATABASE_RO_PORT: PortSchema,
     DATABASE_USER: z.string().min(1),
     DATABASE_PASSWORD: z.string().min(1),
     DATABASE_NAME: z.string().min(1).optional(),
-    REDIS_CLUSTER: z.string().transform((val) => val === 'true'),
+    REDIS_CLUSTER: z.enum(['true', 'false']).transform((value) => value === 'true'),
     REDIS_HOST: z.string().min(1),
-    REDIS_PORT: z.string().min(1).transform(Number),
+    REDIS_PORT: PortSchema,
     LOCAL_S3_ENDPOINT: z.url().optional(),
     STORAGE_BUCKET: z.string().min(1),
     SERVICE: z.string().min(1),
-    PORT: z.string().min(1).transform(Number),
+    PORT: PortSchema,
     CORS_ORIGIN: z
         .string()
         .min(1)

package/dist/env.js.map

@@ -1 +1 @@
-{"version":3,"file":"env.js","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AAEtC,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAC3C,CAAC,CAAC,MAAM,CAAC;IACP,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC;IACrD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAC/C,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACzC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC;IAClD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC;IACrD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,MAAM,CAAC;IAC5D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC;IAC/C,iBAAiB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACrC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC;IACzC,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;SACrE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChC,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;CAClB,CAAC,EACF,GAAG,EAAE,CAAC,CAAC;IACL,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;IAClC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ;IAC9B,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;IAClC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS;IAChC,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa;IACxC,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa;IACxC,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;IAC9C,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;IAC9C,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa;IACxC,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;IAChD,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa;IACxC,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa;IACxC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;IAClC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;IAClC,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;IAChD,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc;IAC1C,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;IAC5B,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI;IACtB,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW;IACpC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ;CAC/B,CAAC,CACH,CAAA"}
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AAEtC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAA;AAEvG,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAC3C,CAAC,CAAC,MAAM,CAAC;IACP,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC;IACrD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAC/C,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACzC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,aAAa,EAAE,UAAU;IACzB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,gBAAgB,EAAE,UAAU;IAC5B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,MAAM,CAAC;IAC/E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,UAAU,EAAE,UAAU;IACtB,iBAAiB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACrC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,UAAU;IAChB,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;SACrE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChC,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;CAClB,CAAC,EACF,GAAG,EAAE,CAAC,CAAC;IACL,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;IAClC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ;IAC9B,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;IAClC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS;IAChC,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa;IACxC,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa;IACxC,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;IAC9C,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;IAC9C,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa;IACxC,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;IAChD,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa;IACxC,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa;IACxC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;IAClC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;IAClC,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;IAChD,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc;IAC1C,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;IAC5B,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI;IACtB,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW;IACpC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ;CAC/B,CAAC,CACH,CAAA"}

package/dist/internal/jwks/index.d.ts

@@ -0,0 +1,10 @@
+export declare const jwksVerify: ({ token, audience, issuer, jwksUri, jwksCacheKey, jwksCacheTtlSec, tag, label, }: {
+    token: string;
+    audience: string | string[];
+    issuer: string | string[];
+    jwksUri: string;
+    jwksCacheKey: string;
+    jwksCacheTtlSec: number;
+    tag: string;
+    label: string;
+}) => Promise<import("jose").JWTPayload>;

package/dist/internal/jwks/index.js

@@ -0,0 +1,93 @@
+import { z } from 'zod';
+import { constants } from '../../constants.js';
+import { logger } from '../../logger/index.js';
+import { redis } from '../../repository/redis/index.js';
+const JwkParametersSchema = z.object({
+    alg: z.string().optional(),
+    key_ops: z.array(z.string()).optional(),
+    ext: z.boolean().optional(),
+    use: z.string().optional(),
+    x5c: z.array(z.string()).optional(),
+    x5t: z.string().optional(),
+    'x5t#S256': z.string().optional(),
+    x5u: z.string().optional(),
+    kid: z.string().optional(),
+});
+const JwksResponseSchema = z.object({ keys: z.array(z.unknown()) }).transform(({ keys }) => ({
+    keys: keys.flatMap((key) => {
+        const result = z
+            .discriminatedUnion('kty', [
+            JwkParametersSchema.extend({ kty: z.literal('RSA'), e: z.string(), n: z.string() }),
+            JwkParametersSchema.extend({ kty: z.literal('EC'), crv: z.string(), x: z.string(), y: z.string() }),
+            JwkParametersSchema.extend({ kty: z.literal('OKP'), crv: z.string(), x: z.string() }),
+            JwkParametersSchema.extend({ kty: z.literal('AKP'), alg: z.string(), pub: z.string() }),
+        ])
+            .safeParse(key);
+        return result.success ? [result.data] : [];
+    }),
+    total: keys.length,
+}));
+export const jwksVerify = async ({ token, audience, issuer, jwksUri, jwksCacheKey, jwksCacheTtlSec, tag, label, }) => {
+    if (!Number.isInteger(jwksCacheTtlSec) || jwksCacheTtlSec <= 0) {
+        throw new Error(`${label}: jwksCacheTtlSec must be a positive integer (got ${jwksCacheTtlSec})`);
+    }
+    const { createLocalJWKSet, errors, jwtVerify } = await import('jose');
+    const fetchJwks = async () => {
+        const res = await fetch(jwksUri, {
+            cache: 'no-store',
+            redirect: 'error',
+            signal: AbortSignal.timeout(constants.JWKS_FETCH_TIMEOUT_MS),
+        }).catch((e) => {
+            logger.error(tag, { op: 'jwks-fetch', stage: 'request' });
+            throw e;
+        });
+        if (!res.ok) {
+            logger.error(tag, { op: 'jwks-fetch', status: res.status });
+            throw new Error(`${label}: JWKS fetch failed (${res.status})`);
+        }
+        const parsed = JwksResponseSchema.safeParse(await res.json().catch((e) => {
+            logger.error(tag, { op: 'jwks-fetch', stage: 'body' });
+            throw e;
+        }));
+        if (!parsed.success) {
+            logger.error(tag, { op: 'jwks-fetch', stage: 'shape' });
+            throw parsed.error;
+        }
+        const { keys, total } = parsed.data;
+        if (keys.length !== total || keys.length === 0) {
+            logger.error(tag, { op: 'jwks-key-shape', total, kept: keys.length });
+        }
+        if (keys.length === 0) {
+            throw new Error(`${label}: JWKS carries no usable key`);
+        }
+        const jwks = { keys };
+        await redis.set(jwksCacheKey, JSON.stringify(jwks), jwksCacheTtlSec).catch(() => undefined);
+        return jwks;
+    };
+    const cached = await redis.get(jwksCacheKey).catch(() => undefined);
+    const cachedJwks = (() => {
+        try {
+            if (cached === undefined) {
+                return undefined;
+            }
+            const { keys } = JwksResponseSchema.parse(JSON.parse(cached));
+            return keys.length === 0 ? undefined : { keys };
+        }
+        catch {
+            return undefined;
+        }
+    })();
+    let jwks = cachedJwks ?? (await fetchJwks());
+    const verify = async () => (await jwtVerify(token, createLocalJWKSet(jwks), { issuer, audience })).payload;
+    try {
+        return await verify();
+    }
+    catch (e) {
+        if (e instanceof errors.JWKSNoMatchingKey && cachedJwks !== undefined) {
+            jwks = await fetchJwks();
+            return await verify();
+        }
+        throw e;
+    }
+};
+//# sourceMappingURL=index.js.map

package/dist/internal/jwks/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/internal/jwks/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,iCAAiC,CAAA;AAEvD,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC3B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC,CAAA;AACF,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC3F,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACzB,MAAM,MAAM,GAAG,CAAC;aACb,kBAAkB,CAAC,KAAK,EAAE;YACzB,mBAAmB,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YACnF,mBAAmB,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YACnG,mBAAmB,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YACrF,mBAAmB,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;SACxF,CAAC;aACD,SAAS,CAAC,GAAG,CAAC,CAAA;QACjB,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC5C,CAAC,CAAC;IACF,KAAK,EAAE,IAAI,CAAC,MAAM;CACnB,CAAC,CAAC,CAAA;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAAE,EAC/B,KAAK,EACL,QAAQ,EACR,MAAM,EACN,OAAO,EACP,YAAY,EACZ,eAAe,EACf,GAAG,EACH,KAAK,GAUN,EAAE,EAAE;IACH,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,CAAC,IAAI,eAAe,IAAI,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,qDAAqD,eAAe,GAAG,CAAC,CAAA;IAClG,CAAC;IACD,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAA;IACrE,MAAM,SAAS,GAAG,KAAK,IAAI,EAAE;QAC3B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE;YAC/B,KAAK,EAAE,UAAU;YACjB,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,qBAAqB,CAAC;SAC7D,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;YACb,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;YACzD,MAAM,CAAC,CAAA;QACT,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;YAC3D,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,wBAAwB,GAAG,CAAC,MAAM,GAAG,CAAC,CAAA;QAChE,CAAC;QACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CACzC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;YAC3B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;YACtD,MAAM,CAAC,CAAA;QACT,CAAC,CAAC,CACH,CAAA;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;YACvD,MAAM,MAAM,CAAC,KAAK,CAAA;QACpB,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,IAAI,CAAA;QACnC,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/C,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;QACvE,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAA;QACzD,CAAC;QACD,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,CAAA;QACrB,MAAM,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,eAAe,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QAC3F,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IACnE,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE;QACvB,IAAI,CAAC;YACH,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,MAAM,EAAE,IAAI,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;YAC7D,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAA;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC,CAAC,EAAE,CAAA;IACJ,IAAI,IAAI,GAAG,UAAU,IAAI,CAAC,MAAM,SAAS,EAAE,CAAC,CAAA;IAC5C,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,SAAS,CAAC,KAAK,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,CAAA;IAC1G,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,EAAE,CAAA;IACvB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,MAAM,CAAC,iBAAiB,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YACtE,IAAI,GAAG,MAAM,SAAS,EAAE,CAAA;YACxB,OAAO,MAAM,MAAM,EAAE,CAAA;QACvB,CAAC;QACD,MAAM,CAAC,CAAA;IACT,CAAC;AACH,CAAC,CAAA"}

package/dist/internal/outbound-headers/index.d.ts

@@ -0,0 +1,13 @@
+export declare const resolveOutboundHeaders: (store: {
+    headers: Record<string, string>;
+    forwardHeaderScopes?: {
+        headers: Record<string, string>;
+        forHost?: string;
+    }[];
+    nonForwardableHeaders?: ReadonlySet<string>;
+}, options: {
+    allowList: ReadonlySet<string>;
+    targetHost?: string;
+    init?: RequestInit;
+    inputHeaders?: Headers;
+}) => Headers;