Skip to content
Whisker

@nike/whisker-service-kit

Shared runtime for WhiskerPlatform backend services. Owns the cross-cutting concerns every Nike-internal Node service re-implements: auth (CORPORATE Okta + STORE retail tokens, hybrid service-level + per-route gating), OSCAR service-to-service tokens, OTel-aligned observability, layered CORS, native-fetch HTTP client, and the local-dev whisker-service CLI.

What you get out of the box

Section titled “What you get out of the box”
  • startService(opts?) — boots an Express app pre-wired with auth, CORS, helmet, audit, error handling, request logging, and your file-based routes.
  • fetchFromService<T>(url, opts) — single unified native-fetch helper. Three auth modes (OSCAR default, PASS_THROUGH, NONE), four parse modes, verb-aware retry, 30s default timeout (60s ceiling per Nike Compliance), automatic OTel W3C trace context propagation.
  • req.principal — typed discriminated union (CORPORATE | STORE). Token detection, validation, and store-role parsing all happen in middleware.
  • Per-route guards — requireGroup, requireMinStoreRole, requireUserType, requireAny, requireAll compose on top of the service-level gate.
  • getLogger() — ECS-shaped winston with active trace/span IDs.
  • whisker-service CLI — setup, dev, doctor, build commands replace per-service shell scripts.

What stays out

Section titled “What stays out”
  • HTTP libraries other than native fetch (no axios, no ky).
  • Cache / batch / poll / response-helper abstractions — services compose from native primitives.
  • Hardcoded Okta group names, OSCAR scopes, or caller IDs — all service-owned via config/whisker.config.json#service.

See whisker-docs → Service Kit for the full design.