@comms-id/sanctions 0.2.0

package/dist/runtime/errors.js

@@ -0,0 +1,40 @@
+// Runtime template: copied into every generated client package as src/runtime/errors.ts.
+// It has no imports, so the copy is identical to this file.
+/**
+ * Every failure of a call. The service sends `code`, `message`, `retryable` and `requestId`.
+ * The client adds the codes INVALID_REQUEST (refused before any request), NETWORK, TIMEOUT,
+ * ABORTED and INVALID_RESPONSE.
+ */
+export class CommsIdError extends Error {
+    code;
+    status;
+    retryable;
+    requestId;
+    /** The structured reply of a status such as 503 whose body is an outcome, not an error body (code HTTP_<status>). */
+    body;
+    constructor(init) {
+        super(init.message);
+        this.name = "CommsIdError";
+        this.code = init.code;
+        this.status = init.status;
+        this.retryable = init.retryable;
+        this.requestId = init.requestId;
+        this.body = init.body;
+    }
+}
+export const isCommsIdError = (value) => value instanceof CommsIdError;
+/** HTTP statuses that say the source or the path to it is down: 502, 503 and 504. The client's own failures have status 0. */
+const GATEWAY_STATUSES = new Set([502, 503, 504]);
+/** Maps an error to the outcome that the reply convention names. A match never reaches this. */
+export const outcomeOf = (error) => {
+    if (!isCommsIdError(error)) {
+        return "failed";
+    }
+    if (error.code === "NOT_FOUND") {
+        return "no-match";
+    }
+    if (error.code === "UNAVAILABLE" || GATEWAY_STATUSES.has(error.status)) {
+        return "source-unavailable";
+    }
+    return "failed";
+};

package/dist/runtime/fixture-core.d.ts

@@ -0,0 +1,7 @@
+import type { TransportConfig } from "./http.js";
+/** Every fixture reply carries this header, and every fixture client exposes it. */
+export declare const FIXTURE_HEADER = "x-comms-id-fixture";
+export declare const FIXTURE_NOTICE = "LOCAL FIXTURE: fake data, no network call was made.";
+/** A fetch that answers each operation path with its canned reply. */
+export declare const createFixtureFetch: (replies: Readonly<Record<string, unknown>>) => typeof fetch;
+export declare const createFixtureTransport: (replies: Readonly<Record<string, unknown>>) => TransportConfig;

package/dist/runtime/fixture-core.js

@@ -0,0 +1,26 @@
+// Runtime template: copied into every generated client package as src/runtime/fixture-core.ts.
+// LOCAL FIXTURES: no network. The client runs the same request and reply checks as a real call.
+/** Every fixture reply carries this header, and every fixture client exposes it. */
+export const FIXTURE_HEADER = "x-comms-id-fixture";
+export const FIXTURE_NOTICE = "LOCAL FIXTURE: fake data, no network call was made.";
+/** A fetch that answers each operation path with its canned reply. */
+export const createFixtureFetch = (replies) => (input) => {
+    const url = new URL(typeof input === "string" || input instanceof URL ? input : input.url, "http://fixture.invalid");
+    const reply = replies[url.pathname];
+    if (reply === undefined) {
+        return Promise.resolve(new Response(JSON.stringify({ code: "NOT_FOUND", message: "No fixture for this operation.", retryable: false }), {
+            status: 404,
+            headers: { "content-type": "application/json", [FIXTURE_HEADER]: FIXTURE_NOTICE },
+        }));
+    }
+    return Promise.resolve(new Response(JSON.stringify(reply), {
+        status: 200,
+        headers: { "content-type": "application/json", [FIXTURE_HEADER]: FIXTURE_NOTICE },
+    }));
+};
+export const createFixtureTransport = (replies) => ({
+    urlFor: (operation) => operation.path,
+    headers: () => Promise.resolve({}),
+    fetch: createFixtureFetch(replies),
+    maxRetries: 0,
+});

package/dist/runtime/http.d.ts

@@ -0,0 +1,34 @@
+import { type Schema } from "./validate.js";
+export type HttpMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
+/** A hand-written check that a schema cannot state. It returns the reason to refuse, or undefined. */
+export type Guard = (input: unknown) => string | undefined;
+/** One hosted operation, as the generator writes it from the OpenAPI document. */
+export interface Operation {
+    /** Run after the schema check and before any request (for example an ABN check digit). */
+    readonly guard?: Guard | undefined;
+    readonly method: HttpMethod;
+    readonly name: string;
+    readonly path: string;
+    readonly request: Schema | undefined;
+    readonly response: Schema;
+    /** From x-comms-id-safe-to-retry: only such an operation is ever sent twice. */
+    readonly safeToRetry: boolean;
+}
+export interface CallOptions {
+    /** Overrides the deadline for this call, in milliseconds. */
+    readonly deadlineMs?: number;
+    /** Cancels the call. The error code is ABORTED. */
+    readonly signal?: AbortSignal;
+}
+export interface TransportConfig {
+    /** The deadline for the whole call, retries included. 10 seconds by default. */
+    readonly deadlineMs?: number;
+    readonly fetch?: typeof fetch;
+    readonly headers: () => Promise<Readonly<Record<string, string>>>;
+    /** Extra tries of a safe operation after a retryable failure. 2 by default. */
+    readonly maxRetries?: number;
+    readonly sleep?: (ms: number, signal: AbortSignal) => Promise<void>;
+    readonly urlFor: (operation: Operation) => string;
+}
+/** Sends one operation and returns its decoded reply, or throws a CommsIdError. */
+export declare const call: <Reply>(transport: TransportConfig, operation: Operation, input: unknown, options?: CallOptions) => Promise<Reply>;

package/dist/runtime/http.js

@@ -0,0 +1,165 @@
+// Runtime template: copied into every generated client package as src/runtime/http.ts.
+// One call: validate the request, send it with a deadline and a cancel signal, retry only an
+// operation that is safe to repeat, validate the reply. No dependencies, no Comms.ID logic
+// beyond the reply convention.
+import { CommsIdError } from "./errors.js";
+import { validate } from "./validate.js";
+const DEFAULT_DEADLINE_MS = 10_000;
+const DEFAULT_MAX_RETRIES = 2;
+const BASE_DELAY_MS = 200;
+const MAX_DELAY_MS = 2000;
+const fail = (code, message, status, retryable, requestId, body) => new CommsIdError({ code, message, status, retryable, requestId, body });
+const summarize = (issues) => issues
+    .slice(0, 3)
+    .map((issue) => `${issue.path} ${issue.message}`)
+    .join("; ");
+const defaultSleep = (ms, signal) => new Promise((resolve, reject) => {
+    const timer = setTimeout(resolve, ms);
+    signal.addEventListener("abort", () => {
+        clearTimeout(timer);
+        reject(signal.reason);
+    }, { once: true });
+});
+const abortError = (user) => user?.aborted === true
+    ? fail("ABORTED", "The call was cancelled.", 0, false)
+    : fail("TIMEOUT", "The call passed its deadline.", 0, true);
+const retryAfterMs = (response) => {
+    const header = response.headers.get("retry-after");
+    const seconds = header === null ? Number.NaN : Number(header);
+    return Number.isInteger(seconds) && seconds >= 0 ? seconds * 1000 : undefined;
+};
+const readFailure = async (response) => {
+    const headerId = response.headers.get("x-request-id") ?? undefined;
+    let body;
+    try {
+        body = await response.json();
+    }
+    catch {
+        body = undefined;
+    }
+    const record = typeof body === "object" && body !== null ? body : {};
+    if (typeof record.code === "string" && typeof record.message === "string" && typeof record.retryable === "boolean") {
+        const requestId = typeof record.requestId === "string" ? record.requestId : headerId;
+        return fail(record.code, record.message, response.status, record.retryable, requestId);
+    }
+    const gateway = response.status >= 502 && response.status <= 504;
+    return fail(`HTTP_${response.status}`, `The service answered ${response.status}.`, response.status, gateway, headerId, 
+    // A structured reply with an error status (an unavailable or partial outcome) keeps its body.
+    Object.keys(record).length > 0 ? record : undefined);
+};
+const readSuccess = async (operation, response) => {
+    const requestId = response.headers.get("x-request-id") ?? undefined;
+    let value;
+    try {
+        value = await response.json();
+    }
+    catch {
+        return {
+            ok: false,
+            error: fail("INVALID_RESPONSE", "The reply is not JSON.", response.status, false, requestId),
+            retryAfterMs: undefined,
+        };
+    }
+    const issues = validate(operation.response, value, "response");
+    if (issues.length > 0) {
+        return {
+            ok: false,
+            error: fail("INVALID_RESPONSE", `The reply does not match the contract: ${summarize(issues)}`, response.status, false, requestId),
+            retryAfterMs: undefined,
+        };
+    }
+    return { ok: true, value };
+};
+/**
+ * Builds the credential headers. A failure here is not a network failure: a CommsIdError (for
+ * example a refused public key) is passed on as it is, and anything else is a configuration
+ * error. Neither is sent anywhere.
+ */
+const credentialHeaders = async (transport) => {
+    try {
+        return { ok: true, headers: await transport.headers() };
+    }
+    catch (cause) {
+        if (cause instanceof CommsIdError) {
+            return { ok: false, error: cause };
+        }
+        const reason = cause instanceof Error ? cause.message : "unknown error";
+        return { ok: false, error: fail("NOT_CONFIGURED", `Could not prepare the credentials: ${reason}`, 0, false) };
+    }
+};
+const attemptOnce = async (transport, operation, body, signal, user) => {
+    if (signal.aborted) {
+        throw abortError(user);
+    }
+    const credentials = await credentialHeaders(transport);
+    // A cancel that arrives while the credentials are built must not reach fetch.
+    if (signal.aborted) {
+        throw abortError(user);
+    }
+    if (!credentials.ok) {
+        return { ok: false, error: credentials.error, retryAfterMs: undefined };
+    }
+    const headers = {
+        accept: "application/json",
+        ...(body === undefined ? {} : { "content-type": "application/json" }),
+        ...credentials.headers,
+    };
+    let response;
+    try {
+        response = await (transport.fetch ?? fetch)(transport.urlFor(operation), {
+            method: operation.method,
+            headers,
+            body,
+            signal,
+        });
+    }
+    catch (cause) {
+        if (signal.aborted) {
+            throw abortError(user);
+        }
+        const reason = cause instanceof Error ? cause.message : "The request failed.";
+        return { ok: false, error: fail("NETWORK", reason, 0, true), retryAfterMs: undefined };
+    }
+    if (response.ok) {
+        return await readSuccess(operation, response);
+    }
+    return { ok: false, error: await readFailure(response), retryAfterMs: retryAfterMs(response) };
+};
+const prepare = (operation, input) => {
+    if (operation.request === undefined) {
+        return undefined;
+    }
+    const issues = validate(operation.request, input, "request");
+    if (issues.length > 0) {
+        throw fail("INVALID_REQUEST", `The request is not valid: ${summarize(issues)}`, 0, false);
+    }
+    const refusal = operation.guard?.(input);
+    if (refusal !== undefined) {
+        throw fail("INVALID_REQUEST", `The request is not valid: ${refusal}`, 0, false);
+    }
+    return JSON.stringify(input);
+};
+/** Sends one operation and returns its decoded reply, or throws a CommsIdError. */
+export const call = async (transport, operation, input, options = {}) => {
+    const body = prepare(operation, input);
+    const deadline = AbortSignal.timeout(options.deadlineMs ?? transport.deadlineMs ?? DEFAULT_DEADLINE_MS);
+    const signal = options.signal === undefined ? deadline : AbortSignal.any([options.signal, deadline]);
+    const maxRetries = operation.safeToRetry ? (transport.maxRetries ?? DEFAULT_MAX_RETRIES) : 0;
+    const sleep = transport.sleep ?? defaultSleep;
+    for (let attempt = 0;; attempt += 1) {
+        const result = await attemptOnce(transport, operation, body, signal, options.signal);
+        if (result.ok) {
+            return result.value;
+        }
+        if (attempt >= maxRetries || !result.error.retryable) {
+            throw result.error;
+        }
+        const delay = result.retryAfterMs ?? Math.min(BASE_DELAY_MS * 2 ** attempt, MAX_DELAY_MS);
+        try {
+            await sleep(delay, signal);
+        }
+        catch {
+            throw abortError(options.signal);
+        }
+    }
+};

package/dist/runtime/server-core.d.ts

@@ -0,0 +1,26 @@
+import { type Environment } from "./environment.js";
+import type { TransportConfig } from "./http.js";
+import { type PrivateJwk } from "./sign.js";
+export declare const DEFAULT_BASE_URL: string;
+export interface ServerOptions {
+    /** Another host. It wins over `environment`. */
+    readonly baseUrl?: string;
+    /** The registered app id (COMMS_ID_CLIENT_ID). */
+    readonly clientId: string;
+    readonly deadlineMs?: number;
+    /** "live" (the default) or "test": synthetic replies for apps registered in the development directory. */
+    readonly environment?: Environment;
+    readonly fetch?: typeof fetch;
+    readonly maxRetries?: number;
+    readonly now?: () => number;
+    /** The app's private Ed25519 key (COMMS_ID_PRIVATE_JWK). */
+    readonly privateJwk: PrivateJwk;
+    /** Seconds each signed token stays valid: 120 by default, 600 at most. */
+    readonly tokenLifetimeSeconds?: number;
+}
+/** What the service verifies: its audience and scope, written into the generated client. */
+export interface ServerTarget {
+    readonly audience: string;
+    readonly scope: string;
+}
+export declare const createServerTransport: (options: ServerOptions, target: ServerTarget) => TransportConfig;

package/dist/runtime/server-core.js

@@ -0,0 +1,39 @@
+// Runtime template: copied into every generated client package as src/runtime/server-core.ts.
+// Server entry only. The private key never leaves the consumer's server.
+import { BASE_URLS, resolveBaseUrl } from "./environment.js";
+import { CommsIdError } from "./errors.js";
+import { createTokenSigner } from "./sign.js";
+export const DEFAULT_BASE_URL = BASE_URLS.live;
+const TRAILING_SLASHES = /\/+$/;
+/** A transport that signs a fresh short-lived token for every call. */
+const notConfigured = (message) => new CommsIdError({ code: "NOT_CONFIGURED", message, status: 0, retryable: false });
+/** A client with no identified caller is a configuration error: it never sends an unsigned request. */
+const requireCaller = (options) => {
+    if (typeof options.clientId !== "string" || options.clientId.trim() === "") {
+        throw notConfigured("clientId is empty: set COMMS_ID_CLIENT_ID to your registered app id.");
+    }
+    const key = options.privateJwk;
+    if (key?.kty !== "OKP" || key.crv !== "Ed25519" || typeof key.x !== "string" || typeof key.d !== "string") {
+        throw notConfigured("privateJwk is missing or not an Ed25519 private key: set COMMS_ID_PRIVATE_JWK.");
+    }
+};
+export const createServerTransport = (options, target) => {
+    requireCaller(options);
+    const sign = createTokenSigner(options.privateJwk);
+    const base = resolveBaseUrl(options.environment, options.baseUrl).replace(TRAILING_SLASHES, "");
+    return {
+        urlFor: (operation) => `${base}${operation.path}`,
+        headers: async () => ({
+            authorization: `Bearer ${await sign({
+                clientId: options.clientId,
+                audience: target.audience,
+                scope: target.scope,
+                ...(options.tokenLifetimeSeconds === undefined ? {} : { lifetimeSeconds: options.tokenLifetimeSeconds }),
+                ...(options.now === undefined ? {} : { now: options.now }),
+            })}`,
+        }),
+        ...(options.fetch === undefined ? {} : { fetch: options.fetch }),
+        ...(options.deadlineMs === undefined ? {} : { deadlineMs: options.deadlineMs }),
+        ...(options.maxRetries === undefined ? {} : { maxRetries: options.maxRetries }),
+    };
+};

package/dist/runtime/sign.d.ts

@@ -0,0 +1,22 @@
+/** An Ed25519 private key as a JWK: the key pair's private half stays on the consumer's server. */
+export interface PrivateJwk {
+    readonly crv: "Ed25519";
+    readonly d: string;
+    readonly kty: "OKP";
+    readonly x: string;
+}
+export interface TokenInput {
+    /** The service the token is for. */
+    readonly audience: string;
+    /** The registered app id, sent as the token issuer. */
+    readonly clientId: string;
+    /** Seconds the token stays valid: 120 by default, 600 at most. */
+    readonly lifetimeSeconds?: number;
+    readonly now?: () => number;
+    readonly scope: string;
+}
+/**
+ * Returns a function that signs one short-lived token for each call. The key is imported once.
+ * The token is a JWT with alg EdDSA and the claims iss, aud, sub, jti, iat, exp and scope.
+ */
+export declare const createTokenSigner: (privateJwk: PrivateJwk) => ((input: TokenInput) => Promise<string>);

package/dist/runtime/sign.js

@@ -0,0 +1,41 @@
+// Runtime template: copied into every generated client package as src/runtime/sign.ts.
+// Server entry only: the browser entry never imports this file. Web Crypto, no dependencies.
+const DEFAULT_LIFETIME_SECONDS = 120;
+const MAX_LIFETIME_SECONDS = 600;
+const encoder = new TextEncoder();
+const base64url = (bytes) => {
+    let binary = "";
+    for (const byte of bytes) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+};
+const encodeJson = (value) => base64url(encoder.encode(JSON.stringify(value)));
+/**
+ * Returns a function that signs one short-lived token for each call. The key is imported once.
+ * The token is a JWT with alg EdDSA and the claims iss, aud, sub, jti, iat, exp and scope.
+ */
+export const createTokenSigner = (privateJwk) => {
+    let key;
+    const importKey = () => {
+        key ??= crypto.subtle.importKey("jwk", privateJwk, { name: "Ed25519" }, false, ["sign"]);
+        return key;
+    };
+    return async (input) => {
+        const lifetime = Math.min(Math.max(input.lifetimeSeconds ?? DEFAULT_LIFETIME_SECONDS, 1), MAX_LIFETIME_SECONDS);
+        const issuedAt = Math.floor((input.now?.() ?? Date.now()) / 1000);
+        const header = encodeJson({ alg: "EdDSA" });
+        const payload = encodeJson({
+            scope: input.scope,
+            iss: input.clientId,
+            aud: input.audience,
+            sub: crypto.randomUUID(),
+            jti: crypto.randomUUID(),
+            iat: issuedAt,
+            exp: issuedAt + lifetime,
+        });
+        const signingInput = `${header}.${payload}`;
+        const signature = await crypto.subtle.sign({ name: "Ed25519" }, await importKey(), encoder.encode(signingInput));
+        return `${signingInput}.${base64url(new Uint8Array(signature))}`;
+    };
+};

package/dist/runtime/validate.d.ts

@@ -0,0 +1,57 @@
+/** The JSON Schema subset that generated clients check, in a compact form the generator writes. */
+export type Schema = {
+    readonly t: "str";
+    readonly min?: number;
+    readonly max?: number;
+    readonly values?: readonly string[];
+    /** A JSON Schema pattern: checked in a request only. */
+    readonly pattern?: string;
+} | {
+    readonly t: "int" | "num";
+    readonly min?: number;
+    readonly max?: number;
+    /** exclusiveMinimum and exclusiveMaximum, checked in a request only. */
+    readonly exMin?: number;
+    readonly exMax?: number;
+    readonly values?: readonly number[];
+} | {
+    readonly t: "bool";
+} | {
+    readonly t: "null";
+} | {
+    readonly t: "any";
+} | {
+    readonly t: "const";
+    readonly value: string | number | boolean | null;
+} | {
+    readonly t: "arr";
+    readonly of: Schema;
+    readonly min?: number;
+    readonly max?: number;
+} | {
+    readonly t: "tup";
+    readonly of: readonly Schema[];
+} | {
+    readonly t: "map";
+    readonly of: Schema;
+} | {
+    readonly t: "obj";
+    readonly props: Readonly<Record<string, Schema>>;
+    readonly req: readonly string[];
+    readonly extra: boolean;
+} | {
+    readonly t: "any_of";
+    readonly of: readonly Schema[];
+};
+/**
+ * A request is checked against every constraint before it leaves the client. A response is
+ * checked for shape only: unknown properties, new enum values and size limits are accepted, so
+ * a service can add to a reply in a minor version without breaking an installed client.
+ */
+export type Mode = "request" | "response";
+export interface Issue {
+    readonly message: string;
+    readonly path: string;
+}
+/** Returns the problems found, at most eight, or an empty array when the value is acceptable. */
+export declare const validate: (schema: Schema, value: unknown, mode: Mode) => readonly Issue[];

package/dist/runtime/validate.js

@@ -0,0 +1,175 @@
+// Runtime template: copied into every generated client package as src/runtime/validate.ts.
+// It has no imports, so the copy is identical to this file.
+const MAX_ISSUES = 8;
+const describe = (value) => {
+    if (value === null) {
+        return "null";
+    }
+    return Array.isArray(value) ? "array" : typeof value;
+};
+const add = (issues, path, message) => {
+    if (issues.length < MAX_ISSUES) {
+        issues.push({ path, message });
+    }
+};
+const strictSize = (mode, size, min, max) => {
+    if (mode !== "request") {
+        return undefined;
+    }
+    if (min !== undefined && size < min) {
+        return `must be at least ${min}`;
+    }
+    if (max !== undefined && size > max) {
+        return `must be at most ${max}`;
+    }
+    return undefined;
+};
+/** A pattern the runtime cannot compile is not checked here: the service checks it. */
+const matches = (pattern, value) => {
+    try {
+        return new RegExp(pattern).test(value);
+    }
+    catch {
+        return true;
+    }
+};
+const checkString = (schema, value, path, mode, issues) => {
+    if (typeof value !== "string") {
+        add(issues, path, `expected a string, got ${describe(value)}`);
+        return;
+    }
+    const size = strictSize(mode, value.length, schema.min, schema.max);
+    if (size !== undefined) {
+        add(issues, path, `length ${size}`);
+    }
+    if (mode === "request" && schema.values !== undefined && !schema.values.includes(value)) {
+        add(issues, path, `must be one of ${schema.values.join(", ")}`);
+    }
+    if (mode === "request" && schema.pattern !== undefined && !matches(schema.pattern, value)) {
+        add(issues, path, `must match the pattern ${schema.pattern}`);
+    }
+};
+const checkNumber = (schema, value, path, mode, issues) => {
+    const ok = typeof value === "number" && Number.isFinite(value) && (schema.t === "num" || Number.isInteger(value));
+    if (!ok) {
+        add(issues, path, `expected ${schema.t === "int" ? "an integer" : "a number"}, got ${describe(value)}`);
+        return;
+    }
+    const size = strictSize(mode, value, schema.min, schema.max);
+    if (size !== undefined) {
+        add(issues, path, `value ${size}`);
+    }
+    if (mode === "request" && schema.exMin !== undefined && value <= schema.exMin) {
+        add(issues, path, `value must be greater than ${schema.exMin}`);
+    }
+    if (mode === "request" && schema.exMax !== undefined && value >= schema.exMax) {
+        add(issues, path, `value must be less than ${schema.exMax}`);
+    }
+    if (mode === "request" && schema.values !== undefined && !schema.values.includes(value)) {
+        add(issues, path, `must be one of ${schema.values.join(", ")}`);
+    }
+};
+const checkArray = (schema, value, path, mode, issues) => {
+    if (!Array.isArray(value)) {
+        add(issues, path, `expected an array, got ${describe(value)}`);
+        return;
+    }
+    const size = strictSize(mode, value.length, schema.min, schema.max);
+    if (size !== undefined) {
+        add(issues, path, `item count ${size}`);
+    }
+    value.forEach((item, index) => {
+        check(schema.of, item, `${path}[${index}]`, mode, issues);
+    });
+};
+const checkTuple = (schema, value, path, mode, issues) => {
+    if (!Array.isArray(value) || value.length !== schema.of.length) {
+        add(issues, path, `expected an array of ${schema.of.length} items`);
+        return;
+    }
+    schema.of.forEach((member, index) => {
+        check(member, value[index], `${path}[${index}]`, mode, issues);
+    });
+};
+const checkObject = (schema, value, path, mode, issues) => {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        add(issues, path, `expected an object, got ${describe(value)}`);
+        return;
+    }
+    const record = value;
+    for (const key of schema.req) {
+        if (!(key in record) || record[key] === undefined) {
+            add(issues, `${path}.${key}`, "is required");
+        }
+    }
+    for (const [key, member] of Object.entries(record)) {
+        const known = schema.props[key];
+        if (known !== undefined) {
+            if (member !== undefined) {
+                check(known, member, `${path}.${key}`, mode, issues);
+            }
+        }
+        else if (mode === "request" && !schema.extra) {
+            add(issues, `${path}.${key}`, "is not a known property");
+        }
+    }
+};
+const checkMap = (schema, value, path, mode, issues) => {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        add(issues, path, `expected an object, got ${describe(value)}`);
+        return;
+    }
+    for (const [key, member] of Object.entries(value)) {
+        if (member !== undefined) {
+            check(schema.of, member, `${path}.${key}`, mode, issues);
+        }
+    }
+};
+const checkUnion = (schema, value, path, mode, issues) => {
+    const matches = schema.of.some((member) => {
+        const nested = [];
+        check(member, value, path, mode, nested);
+        return nested.length === 0;
+    });
+    if (!matches) {
+        add(issues, path, "does not match any allowed shape");
+    }
+};
+const checkers = {
+    str: checkString,
+    int: checkNumber,
+    num: checkNumber,
+    arr: checkArray,
+    tup: checkTuple,
+    map: checkMap,
+    obj: checkObject,
+    any_of: checkUnion,
+};
+const checkSimple = (schema, value, path, issues) => {
+    if (schema.t === "bool" && typeof value !== "boolean") {
+        add(issues, path, `expected a boolean, got ${describe(value)}`);
+    }
+    else if (schema.t === "null" && value !== null) {
+        add(issues, path, `expected null, got ${describe(value)}`);
+    }
+    else if (schema.t === "const" && value !== schema.value) {
+        add(issues, path, `must be ${JSON.stringify(schema.value)}`);
+    }
+};
+const check = (schema, value, path, mode, issues) => {
+    if (issues.length >= MAX_ISSUES || schema.t === "any") {
+        return;
+    }
+    const checker = checkers[schema.t];
+    if (checker === undefined) {
+        checkSimple(schema, value, path, issues);
+        return;
+    }
+    checker(schema, value, path, mode, issues);
+};
+/** Returns the problems found, at most eight, or an empty array when the value is acceptable. */
+export const validate = (schema, value, mode) => {
+    const issues = [];
+    check(schema, value, "$", mode, issues);
+    return issues;
+};

package/dist/server.d.ts

@@ -0,0 +1,9 @@
+import { type SanctionsClient } from "./generated/client.js";
+import { type ServerOptions } from "./runtime/server-core.js";
+export type { Environment } from "./runtime/environment.js";
+export type { PrivateJwk } from "./runtime/sign.js";
+export type { ServerOptions } from "./runtime/server-core.js";
+/** What the service verifies in the token. */
+export declare const AUDIENCE = "dfat-consolidated-list";
+export declare const SCOPE = "dfat-consolidated-list:read";
+export declare const createSanctionsClient: (options: ServerOptions) => SanctionsClient;

package/dist/server.js

@@ -0,0 +1,8 @@
+// Generated by @comms-id/forge-transformers from the service's OpenAPI contract. Do not edit: change the contract and regenerate.
+// Server entry: signs a short-lived token for each call with the app's private key.
+import { buildClient } from "./generated/client.js";
+import { createServerTransport } from "./runtime/server-core.js";
+/** What the service verifies in the token. */
+export const AUDIENCE = "dfat-consolidated-list";
+export const SCOPE = "dfat-consolidated-list:read";
+export const createSanctionsClient = (options) => buildClient(createServerTransport(options, { audience: AUDIENCE, scope: SCOPE }));