@activeledger/nano-gateway 4.5.0

package/LICENSE

@@ -0,0 +1,20 @@
+MIT License (MIT)
+Copyright (c) 2026 Activeledger
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,56 @@
+# @activeledger/nano-gateway
+
+A lightweight, permissioned SSE + read gateway for [nano](https://github.com/activeledger/nano) light-node clients.
+
+## Why this exists
+
+Activecore (`@activeledger/activecore`, `packages/core`) is nano's originally-planned data source, but it isn't running on the devnet this was built against, and its SSE controller (`controllers/sse.ts`) is written against Node's raw `http.IncomingMessage`/`ServerResponse` API - `res.setHeader()`, `res.write()`, `res.flushHeaders()`, `req.socket.setTimeout()`. The `@activeledger/httpd` this repo actually ships today is built on `uWebSockets.js` (confirmed by reading its published `lib/httpd.js`, not assumed) - route handlers get a raw uWS `HttpResponse`, which has none of those methods. Activecore's SSE path would throw immediately if invoked against it. That's very likely a real, standing cause of Activecore's unreliability, independent of anything else.
+
+This package is a much smaller, purpose-built replacement for just what nano needs: a permissioned SSE subscribe endpoint, and the handful of reads nano's mini-SPI needs. It's modeled directly on `packages/hybrid` - direct database access via `ActiveDSConnect`, no consensus involvement, runs as a companion process alongside a real node.
+
+## What "permissioned" means here
+
+Anyone can read (`GET /api/stream/*`, `POST /api/stream`, `GET /api/tx/*`) - ledger data is public by design, unchanged from how Activecore worked. Only the **subscribe/push channel** is gated: a nano must be on this gateway's allowlist, and must prove it holds the private key for its claimed identity, before it gets a live feed. See `src/auth.ts`.
+
+The handshake: a nano signs `${identity}:${timestamp}` with its own key (the same identity it already onboarded on this ledger and signs attestation transactions with - no separate key-distribution step) and sends `{identity, timestamp, signature}` in the subscribe request body. The gateway checks, in order: is this identity on the allowlist -> is the timestamp fresh (within `authWindowSeconds`, anti-replay) -> does the signature actually verify against a public key read *live off the identity's own `:stream` meta doc* (`meta.authorities[].public`) - not a key handed to the gateway out of band. Revoking a nano is just removing it from the allowlist file.
+
+Auth travels in the POST body, not headers - `@activeledger/httpd`'s `listen()` only forwards a fixed, hardcoded set of headers to route handlers (confirmed by reading its source), and custom `x-nano-*` headers would never arrive.
+
+## Config
+
+On first run, a `config.json` (from `src/default.config.json`) and an empty `nano-allowlist.json` (`[]`) are created next to wherever you run the binary from. Nothing can connect until you add identities to the allowlist:
+
+```json
+[
+  { "identity": "abc123...", "label": "adam's phone", "addedAt": 1788000000000 }
+]
+```
+
+Key config fields (`config.json`):
+
+- `db.url` / `db.database` - **you must fill this in.** Point it at the same datastore your Activeledger node already uses (its self-host port, or wherever its CouchDB-compatible store lives). This package doesn't know how to bootstrap a datastore itself, unlike `activehybrid`'s `selfhost` option - it's meant to run alongside an already-running node.
+- `host` - `0.0.0.0:5270` by default. Change the port if `5270` collides with anything else on the host.
+- `nanoGateway.allowlist` - path to the allowlist file.
+- `nanoGateway.authWindowSeconds` - default `60`.
+- `nanoGateway.heartbeatSeconds` - default `5`. Deliberately short: uWS's default idle timeout is ~10s of no socket traffic, far shorter than Activecore's own 10-*minute* SSE heartbeat (`packages/core/src/heartbeat.ts`) - that mismatch is a second, independent plausible cause of Activecore's SSE being unreliable even where it does run. Don't raise this without checking the uWS idle timeout first.
+
+## Routes
+
+```
+GET  /                       health check
+POST /api/activity/subscribe SSE, permissioned - body: {identity, timestamp, signature, streamIds}
+POST /api/stream              batch read - body: string[] of stream ids -> {streams: [...]}
+GET  /api/stream/:id          single read -> {stream: {...} | null}
+GET  /api/tx/:umid            transaction lookup -> {transaction: {...} | null}
+```
+
+`/api/stream` and `/api/tx/:umid` are **not** wire-compatible with Activecore's equivalents - both had real bugs discovered this session while building the nano client against Activecore's actual source (`getStream()` drops `_id` from its response via a comma-expression bug; `findUmid()` names its response field `umid` when the value is the whole transaction, not a umid string). New code doesn't inherit either. nano's own client (`@activenano/core`'s `MiniSpiClient`/`TransactionResolver`) is written against *this* package's contract.
+
+## Deploying this alongside a running node
+
+1. `npm install -g @activeledger/nano-gateway` (once published) or build from source (`npm run build`, then `node lib/index.js`).
+2. Run it on the same host as your node, or anywhere with network access to the node's real datastore. First run generates `config.json` - edit `db.url`/`db.database` before starting it for real.
+3. Add approved nano identities to `nano-allowlist.json` as they're provisioned.
+4. Expose the port (`5270` by default) the same way the node's own ports are already exposed - a Docker port mapping, and an nginx `location` block proxying to it (SSE needs `proxy_buffering off;` and a long `proxy_read_timeout` - standard nginx SSE config, not anything nano-gateway-specific).
+
+Once this is committed and released, it publishes as its own package with its own bin (`nano-gateway`), so it can run as a sibling process in the same container as the node.

package/es/allowlist.d.ts

@@ -0,0 +1,15 @@
+export interface IAllowlistEntry {
+    identity: string;
+    label?: string;
+    addedAt?: number;
+}
+export declare class Allowlist {
+    private filePath;
+    constructor(filePath: string);
+    isApproved(identity: string): boolean;
+    list(): IAllowlistEntry[];
+    add(entry: IAllowlistEntry): void;
+    remove(identity: string): void;
+    private load;
+}
+//# sourceMappingURL=allowlist.d.ts.map

package/es/allowlist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowlist.d.ts","sourceRoot":"","sources":["../src/allowlist.ts"],"names":[],"mappings":"AAiCA,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAUD,qBAAa,SAAS;IACR,OAAO,CAAC,QAAQ;gBAAR,QAAQ,EAAE,MAAM;IAE7B,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAIrC,IAAI,IAAI,eAAe,EAAE;IAIzB,GAAG,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI;IAOjC,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAKrC,OAAO,CAAC,IAAI;CAQb"}

package/es/allowlist.js

@@ -0,0 +1,35 @@
+import * as fs from "fs";
+export class Allowlist {
+    filePath;
+    constructor(filePath) {
+        this.filePath = filePath;
+    }
+    isApproved(identity) {
+        return this.load().some((entry) => entry.identity === identity);
+    }
+    list() {
+        return this.load();
+    }
+    add(entry) {
+        const current = this.load();
+        if (current.some((e) => e.identity === entry.identity))
+            return;
+        current.push({ ...entry, addedAt: entry.addedAt ?? Date.now() });
+        fs.writeFileSync(this.filePath, JSON.stringify(current, null, 2) + "\n");
+    }
+    remove(identity) {
+        const current = this.load().filter((e) => e.identity !== identity);
+        fs.writeFileSync(this.filePath, JSON.stringify(current, null, 2) + "\n");
+    }
+    load() {
+        if (!fs.existsSync(this.filePath))
+            return [];
+        try {
+            return JSON.parse(fs.readFileSync(this.filePath, "utf8"));
+        }
+        catch {
+            return [];
+        }
+    }
+}
+//# sourceMappingURL=allowlist.js.map

package/es/allowlist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowlist.js","sourceRoot":"","sources":["../src/allowlist.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAwBzB,MAAM,OAAO,SAAS;IACA;IAApB,YAAoB,QAAgB;QAAhB,aAAQ,GAAR,QAAQ,CAAQ;IAAG,CAAC;IAEjC,UAAU,CAAC,QAAgB;QAChC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IAClE,CAAC;IAEM,IAAI;QACT,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC;IAEM,GAAG,CAAC,KAAsB;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC;YAAE,OAAO;QAC/D,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACjE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3E,CAAC;IAEM,MAAM,CAAC,QAAgB;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QACnE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3E,CAAC;IAEO,IAAI;QACV,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QAC7C,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAsB,CAAC;QACjF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;CACF"}

package/es/auth.d.ts

@@ -0,0 +1,12 @@
+import { ActiveDSConnect } from "@activeledger/activeoptions";
+import { Allowlist } from "./allowlist";
+export interface IAuthResult {
+    ok: boolean;
+    reason?: string;
+}
+export declare function verifyHandshake(headers: {
+    identity?: string;
+    timestamp?: string;
+    signature?: string;
+}, allowlist: Allowlist, db: ActiveDSConnect, authWindowSeconds: number): Promise<IAuthResult>;
+//# sourceMappingURL=auth.d.ts.map

package/es/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAQxC,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAgBD,wBAAsB,eAAe,CACnC,OAAO,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EACtE,SAAS,EAAE,SAAS,EACpB,EAAE,EAAE,eAAe,EACnB,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC,WAAW,CAAC,CAwCtB"}

package/es/auth.js

@@ -0,0 +1,38 @@
+import { ActiveCrypto } from "@activeledger/activecrypto";
+export async function verifyHandshake(headers, allowlist, db, authWindowSeconds) {
+    const { identity, timestamp, signature } = headers;
+    if (!identity || !timestamp || !signature) {
+        return { ok: false, reason: "missing x-nano-identity/x-nano-timestamp/x-nano-signature headers" };
+    }
+    if (!allowlist.isApproved(identity)) {
+        return { ok: false, reason: "identity is not on the allowlist" };
+    }
+    const ts = Number(timestamp);
+    if (!Number.isFinite(ts) || Math.abs(Date.now() - ts) > authWindowSeconds * 1000) {
+        return { ok: false, reason: "timestamp is missing, invalid, or outside the allowed window" };
+    }
+    let meta;
+    try {
+        meta = await db.get(`${identity}:stream`);
+    }
+    catch {
+        return { ok: false, reason: "identity has no on-ledger record" };
+    }
+    const authorities = meta.authorities ?? [];
+    if (authorities.length === 0) {
+        return { ok: false, reason: "identity has no registered authorities on-ledger" };
+    }
+    const payload = `${identity}:${timestamp}`;
+    for (const authority of authorities) {
+        try {
+            const key = new ActiveCrypto.KeyPair(authority.type, authority.public);
+            if (key.verify(payload, signature)) {
+                return { ok: true };
+            }
+        }
+        catch {
+        }
+    }
+    return { ok: false, reason: "signature did not verify against any of the identity's registered authorities" };
+}
+//# sourceMappingURL=auth.js.map

package/es/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AA6B1D,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAsE,EACtE,SAAoB,EACpB,EAAmB,EACnB,iBAAyB;IAEzB,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IACnD,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mEAAmE,EAAE,CAAC;IACpG,CAAC;IAED,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;IACnE,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,iBAAiB,GAAG,IAAI,EAAE,CAAC;QACjF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8DAA8D,EAAE,CAAC;IAC/F,CAAC;IAED,IAAI,IAAwC,CAAC;IAC7C,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,QAAQ,SAAS,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;IACnE,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;IAC3C,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kDAAkD,EAAE,CAAC;IACnF,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,SAAS,EAAE,CAAC;IAC3C,KAAK,MAAM,SAAS,IAAI,WAAW,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;YACvE,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;gBACnC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YACtB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;QAET,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+EAA+E,EAAE,CAAC;AAChH,CAAC"}

package/es/changesWatcher.d.ts

@@ -0,0 +1,13 @@
+import { ActiveDSConnect } from "@activeledger/activeoptions";
+export declare class ChangesWatcher {
+    private db;
+    private streamIds;
+    private feed;
+    constructor(db: ActiveDSConnect, streamIds: Set<string>);
+    start(onChange: (doc: Record<string, unknown> & {
+        _id: string;
+        _rev: string;
+    }) => void, onError: (error: unknown) => void): void;
+    stop(): void;
+}
+//# sourceMappingURL=changesWatcher.d.ts.map

package/es/changesWatcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"changesWatcher.d.ts","sourceRoot":"","sources":["../src/changesWatcher.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAsB9D,qBAAa,cAAc;IAGb,OAAO,CAAC,EAAE;IAAmB,OAAO,CAAC,SAAS;IAF1D,OAAO,CAAC,IAAI,CAAmD;gBAE3C,EAAE,EAAE,eAAe,EAAU,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC;IAEhE,KAAK,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,GAAG,IAAI;IAchI,IAAI,IAAI,IAAI;CAIpB"}

package/es/changesWatcher.js

@@ -0,0 +1,30 @@
+function isStateDocChange(change) {
+    return (change.doc._id.indexOf(":") === -1 &&
+        (!change.doc.$activeledger || (!change.doc.$activeledger.delete && !change.doc.$activeledger.rewrite)));
+}
+export class ChangesWatcher {
+    db;
+    streamIds;
+    feed = null;
+    constructor(db, streamIds) {
+        this.db = db;
+        this.streamIds = streamIds;
+    }
+    start(onChange, onError) {
+        const result = this.db.changes({ live: true, since: "now", include_docs: true });
+        this.feed = result;
+        this.feed.on("change", (change) => {
+            if (!isStateDocChange(change))
+                return;
+            if (!this.streamIds.has(change.doc._id))
+                return;
+            onChange(change.doc);
+        });
+        this.feed.on("error", onError);
+    }
+    stop() {
+        this.feed?.cancel();
+        this.feed = null;
+    }
+}
+//# sourceMappingURL=changesWatcher.js.map

package/es/changesWatcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"changesWatcher.js","sourceRoot":"","sources":["../src/changesWatcher.ts"],"names":[],"mappings":"AA+BA,SAAS,gBAAgB,CAAC,MAAyF;IACjH,OAAO,CACL,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CACvG,CAAC;AACJ,CAAC;AASD,MAAM,OAAO,cAAc;IAGL;IAA6B;IAFzC,IAAI,GAA8C,IAAI,CAAC;IAE/D,YAAoB,EAAmB,EAAU,SAAsB;QAAnD,OAAE,GAAF,EAAE,CAAiB;QAAU,cAAS,GAAT,SAAS,CAAa;IAAG,CAAC;IAEpE,KAAK,CAAC,QAAgF,EAAE,OAAiC;QAC9H,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QAEjF,IAAI,CAAC,IAAI,GAAG,MAA4C,CAAC;QAEzD,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,MAAwE,EAAE,EAAE;YAClG,IAAI,CAAC,gBAAgB,CAAC,MAAa,CAAC;gBAAE,OAAO;YAC7C,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO;YAChD,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC;IAEM,IAAI;QACT,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QACpB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF"}

package/es/default.config.json

@@ -0,0 +1,18 @@
+{
+  "debug": true,
+  "host": "0.0.0.0:5270",
+  "db": {
+    "url": "http://[user]:[pass]@[host]:[port]",
+    "database": "activeledger",
+    "event": "activeledgerevents",
+    "error": "activeledgererrors"
+  },
+  "nanoGateway": {
+    "allowlist": "./nano-allowlist.json",
+    "authWindowSeconds": 60,
+    "heartbeatSeconds": 5
+  },
+  "CORS": [
+    "*"
+  ]
+}

package/es/index.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=index.d.ts.map

package/es/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}

package/es/index.js

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+import * as fs from "fs";
+import { ActiveOptions } from "@activeledger/activeoptions";
+import { ActiveLogger } from "@activeledger/activelogger";
+import { NanoGatewayServer } from "./server";
+ActiveOptions.init();
+const configPath = ActiveOptions.get("config", "./config.json");
+if (!fs.existsSync(configPath)) {
+    const defaultConfig = fs.readFileSync(__dirname + "/default.config.json", "utf8");
+    fs.writeFileSync(configPath, defaultConfig);
+    ActiveLogger.info(`Created nano-gateway config file at ${configPath}`);
+}
+ActiveOptions.parseConfig();
+if (!ActiveOptions.get("db", false)) {
+    ActiveLogger.fatal("Configuration file incomplete - no db connection configured");
+    process.exit(1);
+}
+const gatewayConfig = ActiveOptions.get("nanoGateway", { allowlist: "./nano-allowlist.json" });
+if (!fs.existsSync(gatewayConfig.allowlist)) {
+    fs.writeFileSync(gatewayConfig.allowlist, "[]\n");
+    ActiveLogger.info(`Created empty allowlist at ${gatewayConfig.allowlist} - no nanos can connect until you add identities to it`);
+}
+ActiveLogger.enableDebug = ActiveOptions.get("debug", false);
+const server = new NanoGatewayServer();
+server.start(ActiveOptions.get("debug", false));
+//# sourceMappingURL=index.js.map

package/es/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAkCA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAE7C,aAAa,CAAC,IAAI,EAAE,CAAC;AAErB,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAS,QAAQ,EAAE,eAAe,CAAC,CAAC;AACxE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;IAC/B,MAAM,aAAa,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,GAAG,sBAAsB,EAAE,MAAM,CAAC,CAAC;IAClF,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAC5C,YAAY,CAAC,IAAI,CAAC,uCAAuC,UAAU,EAAE,CAAC,CAAC;AACzE,CAAC;AACD,aAAa,CAAC,WAAW,EAAE,CAAC;AAE5B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;IACpC,YAAY,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC;IAClF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,aAAa,GAAG,aAAa,CAAC,GAAG,CAAwB,aAAa,EAAE,EAAE,SAAS,EAAE,uBAAuB,EAAE,CAAC,CAAC;AACtH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;IAC5C,EAAE,CAAC,aAAa,CAAC,aAAa,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAClD,YAAY,CAAC,IAAI,CAAC,8BAA8B,aAAa,CAAC,SAAS,wDAAwD,CAAC,CAAC;AACnI,CAAC;AAED,YAAY,CAAC,WAAW,GAAG,aAAa,CAAC,GAAG,CAAU,OAAO,EAAE,KAAK,CAAC,CAAC;AAEtE,MAAM,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;AACvC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAU,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC"}

package/es/routes/stream.d.ts

@@ -0,0 +1,5 @@
+import { ActiveDSConnect } from "@activeledger/activeoptions";
+import { IActiveHttpIncoming } from "@activeledger/httpd";
+export declare function getStream(incoming: IActiveHttpIncoming, db: ActiveDSConnect): Promise<unknown>;
+export declare function getStreams(incoming: IActiveHttpIncoming, db: ActiveDSConnect): Promise<unknown>;
+//# sourceMappingURL=stream.d.ts.map

package/es/routes/stream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream.d.ts","sourceRoot":"","sources":["../../src/routes/stream.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAU1D,wBAAsB,SAAS,CAAC,QAAQ,EAAE,mBAAmB,EAAE,EAAE,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAOpG;AAQD,wBAAsB,UAAU,CAAC,QAAQ,EAAE,mBAAmB,EAAE,EAAE,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAUrG"}

package/es/routes/stream.js

@@ -0,0 +1,21 @@
+export async function getStream(incoming, db) {
+    try {
+        const doc = await db.get(incoming.url[2]);
+        return { stream: doc };
+    }
+    catch {
+        return { stream: null };
+    }
+}
+export async function getStreams(incoming, db) {
+    const ids = Array.isArray(incoming.body) ? incoming.body : [];
+    if (ids.length === 0) {
+        return { streams: [] };
+    }
+    const result = await db.allDocs({ keys: ids, include_docs: true });
+    const streams = (result?.rows ?? [])
+        .map((row) => row.doc)
+        .filter((doc) => doc !== undefined && doc !== null);
+    return { streams };
+}
+//# sourceMappingURL=stream.js.map

package/es/routes/stream.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream.js","sourceRoot":"","sources":["../../src/routes/stream.ts"],"names":[],"mappings":"AAkCA,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,QAA6B,EAAE,EAAmB;IAChF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC1B,CAAC;AACH,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAA6B,EAAE,EAAmB;IACjF,MAAM,GAAG,GAAa,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACzB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;SACjC,GAAG,CAAC,CAAC,GAAsB,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;SACxC,MAAM,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC;IAC/D,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC"}

package/es/routes/subscribe.d.ts

@@ -0,0 +1,18 @@
+import { ActiveDSConnect } from "@activeledger/activeoptions";
+import { IActiveHttpIncoming } from "@activeledger/httpd";
+import { Allowlist } from "../allowlist";
+import { IWritableHttpResponse } from "../sse";
+export interface ISubscribeRequestBody {
+    identity: string;
+    timestamp: number;
+    signature: string;
+    streamIds: string[];
+}
+export interface ISubscribeOptions {
+    db: ActiveDSConnect;
+    allowlist: Allowlist;
+    authWindowSeconds: number;
+    heartbeatSeconds: number;
+}
+export declare function subscribe(incoming: IActiveHttpIncoming, _req: unknown, res: IWritableHttpResponse, options: ISubscribeOptions): Promise<"handled">;
+//# sourceMappingURL=subscribe.d.ts.map

package/es/routes/subscribe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"subscribe.d.ts","sourceRoot":"","sources":["../../src/routes/subscribe.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzC,OAAO,EAAE,qBAAqB,EAAW,MAAM,QAAQ,CAAC;AAYxD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,eAAe,CAAC;IACpB,SAAS,EAAE,SAAS,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAsB,SAAS,CAC7B,QAAQ,EAAE,mBAAmB,EAC7B,IAAI,EAAE,OAAO,EACb,GAAG,EAAE,qBAAqB,EAC1B,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,SAAS,CAAC,CA0CpB"}

package/es/routes/subscribe.js

@@ -0,0 +1,33 @@
+import { verifyHandshake } from "../auth";
+import { ChangesWatcher } from "../changesWatcher";
+import { NanoSSE } from "../sse";
+export async function subscribe(incoming, _req, res, options) {
+    const body = (incoming.body ?? {});
+    const auth = await verifyHandshake({
+        identity: body.identity,
+        timestamp: body.timestamp !== undefined ? String(body.timestamp) : undefined,
+        signature: body.signature,
+    }, options.allowlist, options.db, options.authWindowSeconds);
+    if (!auth.ok) {
+        res.cork(() => {
+            res.writeStatus("403 Forbidden").writeHeader("Content-Type", "application/json");
+            res.end(JSON.stringify({ error: auth.reason }));
+        });
+        return "handled";
+    }
+    const streamIds = Array.isArray(body.streamIds) ? body.streamIds : [];
+    if (streamIds.length === 0) {
+        res.cork(() => {
+            res.writeStatus("400 Bad Request").writeHeader("Content-Type", "application/json");
+            res.end(JSON.stringify({ error: "streamIds must be a non-empty array" }));
+        });
+        return "handled";
+    }
+    const watcher = new ChangesWatcher(options.db, new Set(streamIds));
+    const sse = new NanoSSE(res, options.heartbeatSeconds, () => watcher.stop());
+    watcher.start((doc) => sse.write({ event: "update", stream: doc, time: Date.now() }), (error) => {
+        sse.write({ event: "error", message: String(error), time: Date.now() });
+    });
+    return "handled";
+}
+//# sourceMappingURL=subscribe.js.map

package/es/routes/subscribe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subscribe.js","sourceRoot":"","sources":["../../src/routes/subscribe.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAyB,OAAO,EAAE,MAAM,QAAQ,CAAC;AA0BxD,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,QAA6B,EAC7B,IAAa,EACb,GAA0B,EAC1B,OAA0B;IAE1B,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAmC,CAAC;IAErE,MAAM,IAAI,GAAG,MAAM,eAAe,CAChC;QACE,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS,EAAE,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;QAC5E,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,EACD,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,EAAE,EACV,OAAO,CAAC,iBAAiB,CAC1B,CAAC;IAEF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE;YACZ,GAAG,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,WAAW,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YACjF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE;YACZ,GAAG,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,WAAW,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;YACnF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAE7E,OAAO,CAAC,KAAK,CACX,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,EACtE,CAAC,KAAK,EAAE,EAAE;QACR,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC,CACF,CAAC;IAEF,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/es/routes/tx.d.ts

@@ -0,0 +1,4 @@
+import { ActiveDSConnect } from "@activeledger/activeoptions";
+import { IActiveHttpIncoming } from "@activeledger/httpd";
+export declare function getTransaction(incoming: IActiveHttpIncoming, db: ActiveDSConnect): Promise<unknown>;
+//# sourceMappingURL=tx.d.ts.map

package/es/routes/tx.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tx.d.ts","sourceRoot":"","sources":["../../src/routes/tx.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAU1D,wBAAsB,cAAc,CAAC,QAAQ,EAAE,mBAAmB,EAAE,EAAE,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAOzG"}

package/es/routes/tx.js

@@ -0,0 +1,10 @@
+export async function getTransaction(incoming, db) {
+    try {
+        const doc = await db.get(`${incoming.url[2]}:umid`);
+        return { transaction: doc.umid ?? null };
+    }
+    catch {
+        return { transaction: null };
+    }
+}
+//# sourceMappingURL=tx.js.map

package/es/routes/tx.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tx.js","sourceRoot":"","sources":["../../src/routes/tx.ts"],"names":[],"mappings":"AAkCA,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAA6B,EAAE,EAAmB;IACrF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACpD,OAAO,EAAE,WAAW,EAAE,GAAG,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC/B,CAAC;AACH,CAAC"}

package/es/server.d.ts

@@ -0,0 +1,8 @@
+export declare class NanoGatewayServer {
+    private httpServer;
+    private db;
+    private allowlist;
+    constructor();
+    start(enableLogs?: boolean): void;
+}
+//# sourceMappingURL=server.d.ts.map

package/es/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAgCA,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,UAAU,CAAqB;IACvC,OAAO,CAAC,EAAE,CAAkB;IAC5B,OAAO,CAAC,SAAS,CAAY;;IAmCtB,KAAK,CAAC,UAAU,UAAQ,GAAG,IAAI;CAKvC"}

package/es/server.js

@@ -0,0 +1,38 @@
+import { ActiveHttpd } from "@activeledger/httpd";
+import { ActiveDSConnect, ActiveOptions } from "@activeledger/activeoptions";
+import { ActiveLogger } from "@activeledger/activelogger";
+import { Allowlist } from "./allowlist";
+import { getStream, getStreams } from "./routes/stream";
+import { getTransaction } from "./routes/tx";
+import { subscribe } from "./routes/subscribe";
+export class NanoGatewayServer {
+    httpServer = new ActiveHttpd();
+    db;
+    allowlist;
+    constructor() {
+        const db = ActiveOptions.get("db", false);
+        this.db = new ActiveDSConnect(`${db.url}/${db.database}`);
+        const gatewayConfig = ActiveOptions.get("nanoGateway", { allowlist: "./nano-allowlist.json", authWindowSeconds: 60, heartbeatSeconds: 5 });
+        this.allowlist = new Allowlist(gatewayConfig.allowlist);
+        this.httpServer.use("/", "GET", () => ({
+            status: "ok",
+            service: "nano-gateway",
+            approvedNanos: this.allowlist.list().length,
+        }));
+        this.httpServer.use("/api/stream", "POST", (incoming) => getStreams(incoming, this.db));
+        this.httpServer.use("/api/stream/*", "GET", (incoming) => getStream(incoming, this.db));
+        this.httpServer.use("/api/tx/*", "GET", (incoming) => getTransaction(incoming, this.db));
+        this.httpServer.use("/api/activity/subscribe", "POST", (incoming, req, res) => subscribe(incoming, req, res, {
+            db: this.db,
+            allowlist: this.allowlist,
+            authWindowSeconds: gatewayConfig.authWindowSeconds,
+            heartbeatSeconds: gatewayConfig.heartbeatSeconds,
+        }));
+    }
+    start(enableLogs = false) {
+        const [, port] = ActiveOptions.get("host", ":5270").split(":");
+        this.httpServer.listen(parseInt(port, 10), enableLogs);
+        ActiveLogger.info(`nano-gateway listening on 0.0.0.0:${port} (${this.allowlist.list().length} approved nanos)`);
+    }
+}
+//# sourceMappingURL=server.js.map

package/es/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,WAAW,EAAuB,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAG/C,MAAM,OAAO,iBAAiB;IACpB,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC;IAC/B,EAAE,CAAkB;IACpB,SAAS,CAAY;IAE7B;QACE,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAoC,IAAI,EAAE,KAAqD,CAAC,CAAC;QAC7H,IAAI,CAAC,EAAE,GAAG,IAAI,eAAe,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;QAE1D,MAAM,aAAa,GAAG,aAAa,CAAC,GAAG,CACrC,aAAa,EACb,EAAE,SAAS,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,CACnF,CAAC;QACF,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAExD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YACrC,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,cAAc;YACvB,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM;SAC5C,CAAC,CAAC,CAAC;QAEJ,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC,QAA6B,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7G,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,QAA6B,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7G,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,QAA6B,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAE9G,IAAI,CAAC,UAAU,CAAC,GAAG,CACjB,yBAAyB,EACzB,MAAM,EACN,CAAC,QAA6B,EAAE,GAAY,EAAE,GAA0B,EAAE,EAAE,CAC1E,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE;YAC5B,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,iBAAiB,EAAE,aAAa,CAAC,iBAAiB;YAClD,gBAAgB,EAAE,aAAa,CAAC,gBAAgB;SACjD,CAAC,CACL,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,UAAU,GAAG,KAAK;QAC7B,MAAM,CAAC,EAAE,IAAI,CAAC,GAAG,aAAa,CAAC,GAAG,CAAS,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;QACvD,YAAY,CAAC,IAAI,CAAC,qCAAqC,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,kBAAkB,CAAC,CAAC;IAClH,CAAC;CACF"}

package/es/sse.d.ts

@@ -0,0 +1,18 @@
+export interface IWritableHttpResponse {
+    writable: boolean;
+    cork(cb: () => void): IWritableHttpResponse;
+    writeStatus(status: string): IWritableHttpResponse;
+    writeHeader(key: string, value: string): IWritableHttpResponse;
+    write(chunk: string): boolean;
+    end(body?: string): IWritableHttpResponse;
+    onAborted(handler: () => void): IWritableHttpResponse;
+}
+export declare class NanoSSE {
+    private res;
+    private heartbeat;
+    private closed;
+    constructor(res: IWritableHttpResponse, heartbeatSeconds: number, onClose?: () => void);
+    write(event: unknown): boolean;
+    close(): void;
+}
+//# sourceMappingURL=sse.d.ts.map

package/es/sse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse.d.ts","sourceRoot":"","sources":["../src/sse.ts"],"names":[],"mappings":"AAsDA,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,EAAE,MAAM,IAAI,GAAG,qBAAqB,CAAC;IAC5C,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,qBAAqB,CAAC;IACnD,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,qBAAqB,CAAC;IAC/D,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,qBAAqB,CAAC;IAC1C,SAAS,CAAC,OAAO,EAAE,MAAM,IAAI,GAAG,qBAAqB,CAAC;CACvD;AAED,qBAAa,OAAO;IAIN,OAAO,CAAC,GAAG;IAHvB,OAAO,CAAC,SAAS,CAA+B;IAChD,OAAO,CAAC,MAAM,CAAS;gBAEH,GAAG,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,IAAI;IA+BvF,KAAK,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;IAQ9B,KAAK,IAAI,IAAI;CAKrB"}

package/es/sse.js

@@ -0,0 +1,43 @@
+export class NanoSSE {
+    res;
+    heartbeat = null;
+    closed = false;
+    constructor(res, heartbeatSeconds, onClose) {
+        this.res = res;
+        res.cork(() => {
+            res
+                .writeStatus("200 OK")
+                .writeHeader("Content-Type", "text/event-stream")
+                .writeHeader("Cache-Control", "no-cache")
+                .writeHeader("Access-Control-Allow-Origin", "*");
+        });
+        res.onAborted(() => {
+            res.writable = false;
+            this.close();
+            onClose?.();
+        });
+        this.heartbeat = setInterval(() => {
+            if (this.closed || !res.writable)
+                return;
+            res.cork(() => {
+                res.write(":\n\n");
+            });
+        }, heartbeatSeconds * 1000);
+    }
+    write(event) {
+        if (this.closed || !this.res.writable)
+            return false;
+        this.res.cork(() => {
+            this.res.write(`data:${JSON.stringify(event)}\n\n`);
+        });
+        return true;
+    }
+    close() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        if (this.heartbeat)
+            clearInterval(this.heartbeat);
+    }
+}
+//# sourceMappingURL=sse.js.map

package/es/sse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse.js","sourceRoot":"","sources":["../src/sse.ts"],"names":[],"mappings":"AAgEA,MAAM,OAAO,OAAO;IAIE;IAHZ,SAAS,GAA0B,IAAI,CAAC;IACxC,MAAM,GAAG,KAAK,CAAC;IAEvB,YAAoB,GAA0B,EAAE,gBAAwB,EAAE,OAAoB;QAA1E,QAAG,GAAH,GAAG,CAAuB;QAC5C,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE;YACZ,GAAG;iBACA,WAAW,CAAC,QAAQ,CAAC;iBACrB,WAAW,CAAC,cAAc,EAAE,mBAAmB,CAAC;iBAChD,WAAW,CAAC,eAAe,EAAE,UAAU,CAAC;iBACxC,WAAW,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YAKjB,GAAG,CAAC,QAAQ,GAAG,KAAK,CAAC;YACrB,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,OAAO,EAAE,EAAE,CAAC;QACd,CAAC,CAAC,CAAC;QAMH,IAAI,CAAC,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;YAChC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ;gBAAE,OAAO;YACzC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE;gBACZ,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;QACL,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC9B,CAAC;IAEM,KAAK,CAAC,KAAc;QACzB,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QACpD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE;YACjB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK;QACV,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,IAAI,CAAC,SAAS;YAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF"}

package/lib/allowlist.d.ts

@@ -0,0 +1,15 @@
+export interface IAllowlistEntry {
+    identity: string;
+    label?: string;
+    addedAt?: number;
+}
+export declare class Allowlist {
+    private filePath;
+    constructor(filePath: string);
+    isApproved(identity: string): boolean;
+    list(): IAllowlistEntry[];
+    add(entry: IAllowlistEntry): void;
+    remove(identity: string): void;
+    private load;
+}
+//# sourceMappingURL=allowlist.d.ts.map

package/lib/allowlist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowlist.d.ts","sourceRoot":"","sources":["../src/allowlist.ts"],"names":[],"mappings":"AAiCA,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAUD,qBAAa,SAAS;IACR,OAAO,CAAC,QAAQ;gBAAR,QAAQ,EAAE,MAAM;IAE7B,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAIrC,IAAI,IAAI,eAAe,EAAE;IAIzB,GAAG,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI;IAOjC,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAKrC,OAAO,CAAC,IAAI;CAQb"}