@cratis/chronicle 0.1.0 → 0.2.1

package/dist/compliance/pii.js

@@ -0,0 +1,106 @@
+// Copyright (c) Cratis. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+import 'reflect-metadata';
+import { ComplianceMetadataType } from './ComplianceMetadataType';
+import { TypeIntrospector } from '../types';
+/** Metadata key for PII decorator on properties. */
+const PII_PROPERTY_METADATA_KEY = 'chronicle:compliance:pii:property';
+/** Metadata key for PII decorator on types. */
+const PII_TYPE_METADATA_KEY = 'chronicle:compliance:pii:type';
+/**
+ * Decorator that marks a property or type as containing Personal Identifiable Information (PII)
+ * according to the GDPR definition. When applied to read model properties or ConceptAs types,
+ * the Chronicle Kernel will encrypt the values using compliance-aware encryption.
+ *
+ * This decorator can be used in two ways:
+ * - As a property decorator: `@pii('details') propertyName: type`
+ * - As a class decorator: `@pii('details') class TypeName { }`
+ *
+ * @param details - Optional details explaining why or to what extent the property/type is classified as PII.
+ * @returns A decorator function that can be applied to either properties or classes (but not both on the same target).
+ *
+ * @example
+ * Property usage:
+ * ```typescript
+ * @readModel()
+ * class Employee {
+ *     @pii('Employee social security number')
+ *     ssn: string = '';
+ *
+ *     @pii('Personal email address')
+ *     email: string = '';
+ * }
+ * ```
+ *
+ * @example
+ * Type usage with ConceptAs:
+ * ```typescript
+ * @pii('Customer email address')
+ * class CustomerEmailConcept extends ConceptAs<string> {}
+ * export type CustomerEmail = CustomerEmailConcept | string;
+ *
+ * @readModel()
+ * class Customer {
+ *     @field(CustomerEmailConcept)
+ *     email: CustomerEmail = '';
+ * }
+ * ```
+ */
+export function pii(details) {
+    return (target, propertyKey) => {
+        // Class decorator usage (for types like ConceptAs)
+        if (typeof target === 'function' && propertyKey === undefined) {
+            const metadata = {
+                metadataType: ComplianceMetadataType.PII,
+                details: details ?? ''
+            };
+            Reflect.defineMetadata(PII_TYPE_METADATA_KEY, metadata, target);
+            return;
+        }
+        // Property decorator usage
+        if (propertyKey !== undefined) {
+            const key = propertyKey.toString();
+            TypeIntrospector.trackProperty(target.constructor, key);
+            const metadata = {
+                metadataType: ComplianceMetadataType.PII,
+                details: details ?? ''
+            };
+            Reflect.defineMetadata(PII_PROPERTY_METADATA_KEY, metadata, target, key);
+        }
+    };
+}
+/**
+ * Gets the PII compliance metadata for a property.
+ * @param target - The class prototype.
+ * @param propertyKey - The property name.
+ * @returns The compliance metadata, or undefined if not decorated with @pii.
+ */
+export function getPIIMetadata(target, propertyKey) {
+    return Reflect.getMetadata(PII_PROPERTY_METADATA_KEY, target, propertyKey);
+}
+/**
+ * Checks whether a property has been decorated with @pii.
+ * @param target - The class prototype.
+ * @param propertyKey - The property name.
+ * @returns True if the property has @pii decorator; false otherwise.
+ */
+export function hasPIIMetadata(target, propertyKey) {
+    return Reflect.hasMetadata(PII_PROPERTY_METADATA_KEY, target, propertyKey);
+}
+/**
+ * Gets the PII compliance metadata for a type.
+ * @param type - The type constructor.
+ * @returns The compliance metadata, or undefined if not decorated with @pii.
+ */
+export function getTypePIIMetadata(type) {
+    return Reflect.getMetadata(PII_TYPE_METADATA_KEY, type);
+}
+/**
+ * Checks whether a type has been decorated with @pii.
+ * @param type - The type constructor.
+ * @returns True if the type has @pii decorator; false otherwise.
+ */
+export function isPII(type) {
+    return Reflect.hasMetadata(PII_TYPE_METADATA_KEY, type);
+}
+//# sourceMappingURL=pii.js.map

package/dist/compliance/pii.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pii.js","sourceRoot":"","sources":["../../compliance/pii.ts"],"names":[],"mappings":"AAAA,6CAA6C;AAC7C,qGAAqG;AAErG,OAAO,kBAAkB,CAAC;AAE1B,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAE5C,oDAAoD;AACpD,MAAM,yBAAyB,GAAG,mCAAmC,CAAC;AAEtE,+CAA+C;AAC/C,MAAM,qBAAqB,GAAG,+BAA+B,CAAC;AAE9D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,UAAU,GAAG,CAAC,OAAgB;IAChC,OAAO,CAAC,MAAyB,EAAE,WAA6B,EAAE,EAAE;QAChE,mDAAmD;QACnD,IAAI,OAAO,MAAM,KAAK,UAAU,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC5D,MAAM,QAAQ,GAAuB;gBACjC,YAAY,EAAE,sBAAsB,CAAC,GAAG;gBACxC,OAAO,EAAE,OAAO,IAAI,EAAE;aACzB,CAAC;YACF,OAAO,CAAC,cAAc,CAAC,qBAAqB,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YAChE,OAAO;QACX,CAAC;QAED,2BAA2B;QAC3B,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,WAAW,CAAC,QAAQ,EAAE,CAAC;YACnC,gBAAgB,CAAC,aAAa,CAAE,MAAoC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YACvF,MAAM,QAAQ,GAAuB;gBACjC,YAAY,EAAE,sBAAsB,CAAC,GAAG;gBACxC,OAAO,EAAE,OAAO,IAAI,EAAE;aACzB,CAAC;YACF,OAAO,CAAC,cAAc,CAAC,yBAAyB,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QAC7E,CAAC;IACL,CAAC,CAAC;AACN,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,WAAmB;IAC9D,OAAO,OAAO,CAAC,WAAW,CAAC,yBAAyB,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,WAAmB;IAC9D,OAAO,OAAO,CAAC,WAAW,CAAC,yBAAyB,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;AAC/E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAc;IAC7C,OAAO,OAAO,CAAC,WAAW,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,KAAK,CAAC,IAAc;IAChC,OAAO,OAAO,CAAC,WAAW,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;AAC5D,CAAC"}

package/dist/connection/ChronicleConnection.d.ts

@@ -1,117 +1,91 @@
-import { type ChronicleConnectionOptions, type ChronicleServices } from '@cratis/chronicle.contracts';
-import type { ConnectionServiceClient } from '@cratis/chronicle.contracts';
+import type { ChannelCredentials } from '@grpc/grpc-js';
+import { type ConnectionServiceClient } from '@cratis/chronicle.contracts';
+import { ChronicleConnectionString } from './ChronicleConnectionString';
+import { ChronicleServices } from './ChronicleServices';
 /**
- * Wraps the contracts connection and allows recreating the underlying channel
- * during reconnect while keeping a stable object reference for consumers.
+ * Configuration options for Chronicle connection.
  */
-export declare class ChronicleConnection implements ChronicleServices {
-    private readonly _options;
-    private _inner;
-    private _authenticatedConnectionService?;
+export interface ChronicleConnectionOptions {
     /**
-     * Creates a new {@link ChronicleConnection}.
-     * @param _options - Connection options used to create and recreate the underlying connection.
+     * The connection string used to connect to Chronicle.
      */
-    constructor(_options: ChronicleConnectionOptions);
+    connectionString?: string | ChronicleConnectionString;
     /**
-     * Gets the connection string currently used by the inner connection.
+     * The host and port of the Chronicle server. Used if connectionString is not provided.
      */
-    get connectionString(): import("@cratis/chronicle.contracts").ChronicleConnectionString;
+    serverAddress?: string;
     /**
-     * Gets whether the current inner connection is connected.
+     * Optional gRPC credentials. Defaults to credentials based on the connection string.
      */
-    get isConnected(): boolean;
+    credentials?: ChannelCredentials;
     /**
-     * Event stores service.
+     * Optional connection timeout in milliseconds. Defaults to 10000.
      */
-    get eventStores(): import("@cratis/chronicle.contracts").EventStoresClient<{}>;
+    connectTimeout?: number;
     /**
-     * Namespaces service.
+     * Optional maximum receive message size in bytes.
      */
-    get namespaces(): import("@cratis/chronicle.contracts").NamespacesClient<{}>;
+    maxReceiveMessageSize?: number;
     /**
-     * Recommendations service.
+     * Optional maximum send message size in bytes.
      */
-    get recommendations(): import("@cratis/chronicle.contracts").RecommendationsClient<{}>;
+    maxSendMessageSize?: number;
     /**
-     * Identities service.
+     * Optional correlation ID for tracking requests.
      */
-    get identities(): import("@cratis/chronicle.contracts").IdentitiesClient<{}>;
+    correlationId?: string;
     /**
-     * Event sequences service.
+     * Optional authentication authority URL. If not set, uses the Chronicle server itself.
      */
-    get eventSequences(): import("@cratis/chronicle.contracts").EventSequencesClient<{}>;
+    authority?: string;
     /**
-     * Event types service.
+     * Optional management port for authentication endpoint. Defaults to 8080.
      */
+    managementPort?: number;
+}
+/**
+ * Manages the gRPC connection to Chronicle and exposes the generated service clients.
+ */
+export declare class ChronicleConnection implements ChronicleServices {
+    private readonly _options;
+    private _channel;
+    private _services;
+    private _connections;
+    private readonly _connectionString;
+    private readonly _tokenProvider;
+    private _isConnected;
+    constructor(_options: ChronicleConnectionOptions);
+    get connectionString(): ChronicleConnectionString;
+    get isConnected(): boolean;
+    get eventStores(): import("@cratis/chronicle.contracts").EventStoresClient<{}>;
+    get namespaces(): import("@cratis/chronicle.contracts").NamespacesClient<{}>;
+    get recommendations(): import("@cratis/chronicle.contracts").RecommendationsClient<{}>;
+    get identities(): import("@cratis/chronicle.contracts").IdentitiesClient<{}>;
+    get eventSequences(): import("@cratis/chronicle.contracts").EventSequencesClient<{}>;
     get eventTypes(): import("@cratis/chronicle.contracts").EventTypesClient<{}>;
-    /**
-     * Constraints service.
-     */
     get constraints(): import("@cratis/chronicle.contracts").ConstraintsClient<{}>;
-    /**
-     * Observers service.
-     */
     get observers(): import("@cratis/chronicle.contracts").ObserversClient<{}>;
-    /**
-     * Failed partitions service.
-     */
+    get eventStoreSubscriptions(): import("../eventStoreSubscriptions/contracts").EventStoreSubscriptionsClient<{}>;
     get failedPartitions(): import("@cratis/chronicle.contracts").FailedPartitionsClient<{}>;
-    /**
-     * Reactors service.
-     */
     get reactors(): import("@cratis/chronicle.contracts").ReactorsClient<{}>;
-    /**
-     * Reducers service.
-     */
     get reducers(): import("@cratis/chronicle.contracts").ReducersClient<{}>;
-    /**
-     * Projections service.
-     */
     get projections(): import("@cratis/chronicle.contracts").ProjectionsClient<{}>;
-    /**
-     * Read models service.
-     */
     get readModels(): import("@cratis/chronicle.contracts").ReadModelsClient<{}>;
-    /**
-     * Jobs service.
-     */
+    get materializedReadModels(): import("@cratis/chronicle.contracts").MaterializedReadModelsClient<{}>;
     get jobs(): import("@cratis/chronicle.contracts").JobsClient<{}>;
-    /**
-     * Event seeding service.
-     */
+    get webhooks(): import("@cratis/chronicle.contracts").WebhooksClient<{}>;
     get eventSeeding(): import("@cratis/chronicle.contracts").EventSeedingClient<{}>;
-    /**
-     * Server service.
-     */
     get server(): import("@cratis/chronicle.contracts").ServerClient<{}>;
-    /**
-     * Connection service — used to register this client with the kernel keep-alive mechanism.
-     * Uses an authenticated client (same auth middleware as all other services).
-     */
+    get compliance(): import("../compliance/ComplianceContracts").ComplianceClient<{}>;
     get connections(): ConnectionServiceClient;
-    /**
-     * Connects the current inner connection.
-     */
     connect(): Promise<void>;
-    /**
-     * Recreates the inner connection (new gRPC channel) without calling connect().
-     * Use this before probing with a real RPC call to ensure a fresh IDLE channel.
-     */
     resetChannel(): void;
-    /**
-     * Recreates and connects the inner connection.
-     */
     reconnect(): Promise<void>;
-    /**
-     * Disconnects the current inner connection.
-     */
     disconnect(): void;
-    /**
-     * Disposes the current inner connection.
-     */
     dispose(): void;
-    private createInnerConnection;
+    private createClients;
+    private createTokenProvider;
+    private createOAuthTokenProvider;
+    private createAuthMiddleware;
 }
-export type { ChronicleConnectionOptions } from '@cratis/chronicle.contracts';
 //# sourceMappingURL=ChronicleConnection.d.ts.map

package/dist/connection/ChronicleConnection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ChronicleConnection.d.ts","sourceRoot":"","sources":["../../connection/ChronicleConnection.ts"],"names":[],"mappings":"AAGA,OAAO,EAGN,KAAK,0BAA0B,EAC/B,KAAK,iBAAiB,EACtB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAG3E;;;GAGG;AACH,qBAAa,mBAAoB,YAAW,iBAAiB;IAQhD,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAPrC,OAAO,CAAC,MAAM,CAA+B;IAC7C,OAAO,CAAC,+BAA+B,CAAC,CAA0B;IAElE;;;OAGG;gBAC0B,QAAQ,EAAE,0BAA0B;IAIjE;;OAEG;IACH,IAAI,gBAAgB,oEAEnB;IAED;;OAEG;IACH,IAAI,WAAW,IAAI,OAAO,CAEzB;IAED;;OAEG;IACH,IAAI,WAAW,gEAEd;IAED;;OAEG;IACH,IAAI,UAAU,+DAEb;IAED;;OAEG;IACH,IAAI,eAAe,oEAElB;IAED;;OAEG;IACH,IAAI,UAAU,+DAEb;IAED;;OAEG;IACH,IAAI,cAAc,mEAEjB;IAED;;OAEG;IACH,IAAI,UAAU,+DAEb;IAED;;OAEG;IACH,IAAI,WAAW,gEAEd;IAED;;OAEG;IACH,IAAI,SAAS,8DAEZ;IAED;;OAEG;IACH,IAAI,gBAAgB,qEAEnB;IAED;;OAEG;IACH,IAAI,QAAQ,6DAEX;IAED;;OAEG;IACH,IAAI,QAAQ,6DAEX;IAED;;OAEG;IACH,IAAI,WAAW,gEAEd;IAED;;OAEG;IACH,IAAI,UAAU,+DAEb;IAED;;OAEG;IACH,IAAI,IAAI,yDAEP;IAED;;OAEG;IACH,IAAI,YAAY,iEAEf;IAED;;OAEG;IACH,IAAI,MAAM,2DAET;IAED;;;OAGG;IACH,IAAI,WAAW,IAAI,uBAAuB,CAWzC;IAED;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAI9B;;;OAGG;IACH,YAAY,IAAI,IAAI;IAUpB;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAWhC;;OAEG;IACH,UAAU,IAAI,IAAI;IAIlB;;OAEG;IACH,OAAO,IAAI,IAAI;IAIf,OAAO,CAAC,qBAAqB;CAG7B;AAED,YAAY,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"ChronicleConnection.d.ts","sourceRoot":"","sources":["../../connection/ChronicleConnection.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAW,kBAAkB,EAAkB,MAAM,eAAe,CAAC;AACjF,OAAO,EAoBH,KAAK,uBAAuB,EAC/B,MAAM,6BAA6B,CAAC;AAMrC,OAAO,EAAsB,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAGxD;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACvC;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,yBAAyB,CAAC;IAEtD;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;OAEG;IACH,WAAW,CAAC,EAAE,kBAAkB,CAAC;IAEjC;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;OAEG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAE/B;;OAEG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;GAEG;AACH,qBAAa,mBAAoB,YAAW,iBAAiB;IAQ7C,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAPrC,OAAO,CAAC,QAAQ,CAAW;IAC3B,OAAO,CAAC,SAAS,CAAqB;IACtC,OAAO,CAAC,YAAY,CAA2B;IAC/C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA4B;IAC9D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,YAAY,CAAS;gBAEA,QAAQ,EAAE,0BAA0B;IAejE,IAAI,gBAAgB,IAAI,yBAAyB,CAEhD;IAED,IAAI,WAAW,IAAI,OAAO,CAEzB;IAED,IAAI,WAAW,gEAEd;IAED,IAAI,UAAU,+DAEb;IAED,IAAI,eAAe,oEAElB;IAED,IAAI,UAAU,+DAEb;IAED,IAAI,cAAc,mEAEjB;IAED,IAAI,UAAU,+DAEb;IAED,IAAI,WAAW,gEAEd;IAED,IAAI,SAAS,8DAEZ;IAED,IAAI,uBAAuB,qFAE1B;IAED,IAAI,gBAAgB,qEAEnB;IAED,IAAI,QAAQ,6DAEX;IAED,IAAI,QAAQ,6DAEX;IAED,IAAI,WAAW,gEAEd;IAED,IAAI,UAAU,+DAEb;IAED,IAAI,sBAAsB,2EAEzB;IAED,IAAI,IAAI,yDAEP;IAED,IAAI,QAAQ,6DAEX;IAED,IAAI,YAAY,iEAEf;IAED,IAAI,MAAM,2DAET;IAED,IAAI,UAAU,qEAEb;IAED,IAAI,WAAW,IAAI,uBAAuB,CAEzC;IAEK,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAM9B,YAAY,IAAI,IAAI;IAWd,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAKhC,UAAU,IAAI,IAAI;IAKlB,OAAO,IAAI,IAAI;IAIf,OAAO,CAAC,aAAa;IA0CrB,OAAO,CAAC,mBAAmB;IAuB3B,OAAO,CAAC,wBAAwB;IAsBhC,OAAO,CAAC,oBAAoB;CAoB/B"}

package/dist/connection/ChronicleConnection.js

@@ -1,194 +1,218 @@
 // Copyright (c) Cratis. All rights reserved.
 // Licensed under the MIT license. See LICENSE file in the project root for full license information.
-import { ChronicleConnection as ContractsChronicleConnection, ConnectionServiceDefinition } from '@cratis/chronicle.contracts';
-import { createClientFactory } from 'nice-grpc';
+import { ConnectionServiceDefinition, ConstraintsDefinition, EventSeedingDefinition, EventSequencesDefinition, EventStoresDefinition, EventTypesDefinition, FailedPartitionsDefinition, IdentitiesDefinition, JobsDefinition, MaterializedReadModelsDefinition, NamespacesDefinition, ObserversDefinition, ProjectionsDefinition, ReactorsDefinition, ReadModelsDefinition, RecommendationsDefinition, ReducersDefinition, ServerDefinition, WebhooksDefinition } from '@cratis/chronicle.contracts';
+import { ComplianceDefinition } from '../compliance/ComplianceContracts';
+import { createChannel, createClientFactory, waitForChannelReady } from 'nice-grpc';
+import { Metadata } from 'nice-grpc-common';
+import { EventStoreSubscriptionsDefinition } from '../eventStoreSubscriptions/contracts';
+import { AuthenticationMode, ChronicleConnectionString } from './ChronicleConnectionString';
+import { NoOpTokenProvider, OAuthTokenProvider } from './TokenProvider';
 /**
- * Wraps the contracts connection and allows recreating the underlying channel
- * during reconnect while keeping a stable object reference for consumers.
+ * Manages the gRPC connection to Chronicle and exposes the generated service clients.
  */
 export class ChronicleConnection {
     _options;
-    _inner;
-    _authenticatedConnectionService;
-    /**
-     * Creates a new {@link ChronicleConnection}.
-     * @param _options - Connection options used to create and recreate the underlying connection.
-     */
+    _channel;
+    _services;
+    _connections;
+    _connectionString;
+    _tokenProvider;
+    _isConnected = false;
     constructor(_options) {
         this._options = _options;
-        this._inner = this.createInnerConnection();
+        if (_options.connectionString) {
+            this._connectionString = typeof _options.connectionString === 'string'
+                ? new ChronicleConnectionString(_options.connectionString)
+                : _options.connectionString;
+        }
+        else if (_options.serverAddress) {
+            this._connectionString = new ChronicleConnectionString(`chronicle://${_options.serverAddress}`);
+        }
+        else {
+            this._connectionString = ChronicleConnectionString.Default;
+        }
+        this._tokenProvider = this.createTokenProvider();
+        this.createClients();
     }
-    /**
-     * Gets the connection string currently used by the inner connection.
-     */
     get connectionString() {
-        return this._inner.connectionString;
+        return this._connectionString;
     }
-    /**
-     * Gets whether the current inner connection is connected.
-     */
     get isConnected() {
-        return this._inner.isConnected;
+        return this._isConnected;
     }
-    /**
-     * Event stores service.
-     */
     get eventStores() {
-        return this._inner.eventStores;
+        return this._services.eventStores;
     }
-    /**
-     * Namespaces service.
-     */
     get namespaces() {
-        return this._inner.namespaces;
+        return this._services.namespaces;
     }
-    /**
-     * Recommendations service.
-     */
     get recommendations() {
-        return this._inner.recommendations;
+        return this._services.recommendations;
     }
-    /**
-     * Identities service.
-     */
     get identities() {
-        return this._inner.identities;
+        return this._services.identities;
     }
-    /**
-     * Event sequences service.
-     */
     get eventSequences() {
-        return this._inner.eventSequences;
+        return this._services.eventSequences;
     }
-    /**
-     * Event types service.
-     */
     get eventTypes() {
-        return this._inner.eventTypes;
+        return this._services.eventTypes;
     }
-    /**
-     * Constraints service.
-     */
     get constraints() {
-        return this._inner.constraints;
+        return this._services.constraints;
     }
-    /**
-     * Observers service.
-     */
     get observers() {
-        return this._inner.observers;
+        return this._services.observers;
+    }
+    get eventStoreSubscriptions() {
+        return this._services.eventStoreSubscriptions;
     }
-    /**
-     * Failed partitions service.
-     */
     get failedPartitions() {
-        return this._inner.failedPartitions;
+        return this._services.failedPartitions;
     }
-    /**
-     * Reactors service.
-     */
     get reactors() {
-        return this._inner.reactors;
+        return this._services.reactors;
     }
-    /**
-     * Reducers service.
-     */
     get reducers() {
-        return this._inner.reducers;
+        return this._services.reducers;
     }
-    /**
-     * Projections service.
-     */
     get projections() {
-        return this._inner.projections;
+        return this._services.projections;
     }
-    /**
-     * Read models service.
-     */
     get readModels() {
-        return this._inner.readModels;
+        return this._services.readModels;
+    }
+    get materializedReadModels() {
+        return this._services.materializedReadModels;
     }
-    /**
-     * Jobs service.
-     */
     get jobs() {
-        return this._inner.jobs;
+        return this._services.jobs;
+    }
+    get webhooks() {
+        return this._services.webhooks;
     }
-    /**
-     * Event seeding service.
-     */
     get eventSeeding() {
-        return this._inner.eventSeeding;
+        return this._services.eventSeeding;
     }
-    /**
-     * Server service.
-     */
     get server() {
-        return this._inner.server;
+        return this._services.server;
+    }
+    get compliance() {
+        return this._services.compliance;
     }
-    /**
-     * Connection service — used to register this client with the kernel keep-alive mechanism.
-     * Uses an authenticated client (same auth middleware as all other services).
-     */
     get connections() {
-        if (!this._authenticatedConnectionService) {
-            // The inner connectionService lacks auth middleware. Create a properly
-            // authenticated client using the same factory pattern as createServices().
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
-            const inner = this._inner;
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
-            const factory = createClientFactory().use(inner.createAuthMiddleware());
-            this._authenticatedConnectionService = factory.create(ConnectionServiceDefinition, inner.channel);
-        }
-        return this._authenticatedConnectionService;
+        return this._connections;
     }
-    /**
-     * Connects the current inner connection.
-     */
     async connect() {
-        await this._inner.connect();
+        const deadline = new Date(Date.now() + (this._options.connectTimeout ?? 10_000));
+        await waitForChannelReady(this._channel, deadline);
+        this._isConnected = true;
     }
-    /**
-     * Recreates the inner connection (new gRPC channel) without calling connect().
-     * Use this before probing with a real RPC call to ensure a fresh IDLE channel.
-     */
     resetChannel() {
         try {
-            this._inner.disconnect();
+            this._channel.close();
         }
         catch {
-            // Best-effort disconnect before re-creating the channel.
+            // Best-effort shutdown before recreating the channel.
         }
-        this._inner = this.createInnerConnection();
-        this._authenticatedConnectionService = undefined;
+        this._isConnected = false;
+        this.createClients();
     }
-    /**
-     * Recreates and connects the inner connection.
-     */
     async reconnect() {
-        try {
-            this._inner.disconnect();
-        }
-        catch {
-            // Best-effort disconnect before re-creating the channel.
-        }
-        this._inner = this.createInnerConnection();
-        await this._inner.connect();
+        this.resetChannel();
+        await this.connect();
     }
-    /**
-     * Disconnects the current inner connection.
-     */
     disconnect() {
-        this._inner.disconnect();
+        this._isConnected = false;
+        this._channel.close();
     }
-    /**
-     * Disposes the current inner connection.
-     */
     dispose() {
-        this._inner.dispose();
+        this.disconnect();
     }
-    createInnerConnection() {
-        return new ContractsChronicleConnection(this._options);
+    createClients() {
+        const channelOptions = {};
+        if (this._options.maxReceiveMessageSize !== undefined) {
+            channelOptions['grpc.max_receive_message_length'] = this._options.maxReceiveMessageSize;
+        }
+        if (this._options.maxSendMessageSize !== undefined) {
+            channelOptions['grpc.max_send_message_length'] = this._options.maxSendMessageSize;
+        }
+        const serverAddress = `${this._connectionString.serverAddress.host}:${this._connectionString.serverAddress.port}`;
+        const credentials = this._options.credentials ?? this._connectionString.createCredentials();
+        this._channel = createChannel(serverAddress, credentials, channelOptions);
+        const factory = createClientFactory().use(this.createAuthMiddleware());
+        this._services = {
+            eventStores: factory.create(EventStoresDefinition, this._channel),
+            namespaces: factory.create(NamespacesDefinition, this._channel),
+            recommendations: factory.create(RecommendationsDefinition, this._channel),
+            identities: factory.create(IdentitiesDefinition, this._channel),
+            eventSequences: factory.create(EventSequencesDefinition, this._channel),
+            eventTypes: factory.create(EventTypesDefinition, this._channel),
+            constraints: factory.create(ConstraintsDefinition, this._channel),
+            observers: factory.create(ObserversDefinition, this._channel),
+            eventStoreSubscriptions: factory.create(EventStoreSubscriptionsDefinition, this._channel),
+            failedPartitions: factory.create(FailedPartitionsDefinition, this._channel),
+            reactors: factory.create(ReactorsDefinition, this._channel),
+            reducers: factory.create(ReducersDefinition, this._channel),
+            projections: factory.create(ProjectionsDefinition, this._channel),
+            readModels: factory.create(ReadModelsDefinition, this._channel),
+            materializedReadModels: factory.create(MaterializedReadModelsDefinition, this._channel),
+            jobs: factory.create(JobsDefinition, this._channel),
+            webhooks: factory.create(WebhooksDefinition, this._channel),
+            eventSeeding: factory.create(EventSeedingDefinition, this._channel),
+            server: factory.create(ServerDefinition, this._channel),
+            compliance: factory.create(ComplianceDefinition, this._channel)
+        };
+        this._connections = factory.create(ConnectionServiceDefinition, this._channel);
+    }
+    createTokenProvider() {
+        const hasUsername = !!this._connectionString.username;
+        const hasPassword = !!this._connectionString.password;
+        const hasApiKey = !!this._connectionString.apiKey;
+        if (hasApiKey) {
+            return new NoOpTokenProvider();
+        }
+        if (hasUsername !== hasPassword) {
+            throw new Error('Connection string must contain both username and password, or neither');
+        }
+        if (hasUsername && hasPassword) {
+            return this.createOAuthTokenProvider(this._connectionString.username, this._connectionString.password);
+        }
+        return this.createOAuthTokenProvider(ChronicleConnectionString.DEVELOPMENT_CLIENT, ChronicleConnectionString.DEVELOPMENT_CLIENT_SECRET);
+    }
+    createOAuthTokenProvider(username, password) {
+        const managementPort = this._options.managementPort ?? 8080;
+        let authorityHost;
+        let authorityPort;
+        if (this._options.authority) {
+            const authority = new URL(this._options.authority);
+            authorityHost = authority.hostname;
+            authorityPort = authority.port ? parseInt(authority.port, 10) : managementPort;
+        }
+        else {
+            authorityHost = this._connectionString.serverAddress.host;
+            authorityPort = managementPort;
+        }
+        const scheme = this._connectionString.disableTls ? 'http' : 'https';
+        return new OAuthTokenProvider(`${scheme}://${authorityHost}:${authorityPort}/connect/token`, username, password);
+    }
+    createAuthMiddleware() {
+        const tokenProvider = this._tokenProvider;
+        const connectionString = this._connectionString;
+        return async function* authMiddleware(call, options) {
+            const token = await tokenProvider.getAccessToken();
+            if (token) {
+                const metadata = options.metadata ? Metadata(options.metadata) : Metadata();
+                metadata.set('authorization', `Bearer ${token}`);
+                options.metadata = metadata;
+            }
+            else if (connectionString.authenticationMode === AuthenticationMode.ApiKey && connectionString.apiKey) {
+                const metadata = options.metadata ? Metadata(options.metadata) : Metadata();
+                metadata.set('api-key', connectionString.apiKey);
+                options.metadata = metadata;
+            }
+            return yield* call.next(call.request, options);
+        };
     }
 }
 //# sourceMappingURL=ChronicleConnection.js.map