# Inter-app + external API showcase

`GET /api/product-summary?sku=starter` demonstrates one request handler making:

1. an RPC request to the `catalog` app (`getProduct`);
2. an external HTTPS request to GitHub's public REST API; and
3. an RPC request to the `audit` app (`recordLookup`).

The handler deliberately forwards `as: ctx` only to WRNexus peer apps. The RPC package turns that into a short-lived subject/tenant token; it is never forwarded to GitHub. Each peer app must implement the same contract from `app/lib/contracts.ts` (normally a shared workspace package) under `app/services/`, and must authorize its own procedures.

Before running this app, configure all three apps with the same private internal-origin map and a distinct, 32+ character RPC secret:

```sh
WRNEXUS_RPC_SECRET=replace-with-a-private-32-character-minimum-secret
WRNEXUS_APP_NAME=product-summary
WRNEXUS_INTERNAL_ORIGINS={"catalog":"http://127.0.0.1:4101","audit":"http://127.0.0.1:4102"}
```

The peer app processes must remain private; the public gateway blocks the RPC route by design. Run with `bun run --cwd examples/inter-app-api-showcase dev`.