@distrohelena/canton-typescript-sdk 0.1.16 → 0.1.18

package/dist/transports/json/json-transport.d.ts

@@ -1,25 +1,26 @@
 import { AllocatePartyRequest } from "../../core/types/requests/allocate-party-request.js";
 import { GetActiveContractsRequest } from "../../core/types/requests/get-active-contracts-request.js";
 import { GetParticipantIdRequest } from "../../core/types/requests/get-participant-id-request.js";
-import { GetPartiesRequest } from "../../core/types/requests/get-parties-request.js";
-import { GrantUserRightsRequest } from "../../core/types/requests/grant-user-rights-request.js";
 import { ListKnownPartiesRequest } from "../../core/types/requests/list-known-parties-request.js";
 import { SubmitCommandRequest } from "../../core/types/requests/submit-command-request.js";
 import { AllocatePartyResponse } from "../../core/types/responses/allocate-party-response.js";
 import type { ListPartiesRequest as TopologyListPartiesRequest, ListPartiesResponse as TopologyListPartiesResponse, ListKeyOwnersRequest, ListKeyOwnersResponse } from "../grpc/generated/canton/com/digitalasset/canton/topology/admin/v30/topology_aggregation_service.js";
-import type { CreateTemporaryTopologyStoreRequest, CreateTemporaryTopologyStoreResponse, DropTemporaryTopologyStoreRequest, DropTemporaryTopologyStoreResponse } from "../grpc/generated/canton/com/digitalasset/canton/topology/admin/v30/topology_manager_write_service.js";
-import type { AddPartyAsyncRequest, AddPartyAsyncResponse, GetContractRequest, GetContractResponse } from "../grpc/generated/canton/com/daml/ledger/api/v2/contract_service.js";
+import type { AddTransactionsRequest, AddTransactionsResponse, AuthorizeRequest, AuthorizeResponse, CreateTemporaryTopologyStoreRequest, CreateTemporaryTopologyStoreResponse, DropTemporaryTopologyStoreRequest, DropTemporaryTopologyStoreResponse, GenerateTransactionsRequest, GenerateTransactionsResponse, ImportTopologySnapshotRequest, ImportTopologySnapshotResponse, ImportTopologySnapshotV2Request, ImportTopologySnapshotV2Response, SignTransactionsRequest, SignTransactionsResponse } from "../grpc/generated/canton/com/digitalasset/canton/topology/admin/v30/topology_manager_write_service.js";
+import type { GetContractRequest, GetContractResponse } from "../grpc/generated/canton/com/daml/ledger/api/v2/contract_service.js";
+import type { AddPartyAsyncRequest, AddPartyAsyncResponse, ClearPartyOnboardingFlagRequest, ClearPartyOnboardingFlagResponse, GetHighestOffsetByTimestampRequest, GetHighestOffsetByTimestampResponse } from "../grpc/generated/canton/com/digitalasset/canton/admin/participant/v30/party_management_service.js";
 import type { GetEventsByContractIdRequest, GetEventsByContractIdResponse } from "../grpc/generated/canton/com/daml/ledger/api/v2/event_query_service.js";
-import type { GetHighestOffsetByTimestampRequest, GetHighestOffsetByTimestampResponse, CurrentTimeRequest, CurrentTimeResponse, GetIdRequest, GetIdResponse } from "../grpc/generated/canton/com/digitalasset/canton/topology/admin/v30/initialization_service.js";
+import type { CurrentTimeRequest, CurrentTimeResponse, GetIdRequest, GetIdResponse } from "../grpc/generated/canton/com/digitalasset/canton/topology/admin/v30/initialization_service.js";
 import type { ListAllRequest, ListAllResponse, ListLsuAnnouncementRequest, ListLsuAnnouncementResponse, ListLsuSequencerConnectionSuccessorRequest, ListLsuSequencerConnectionSuccessorResponse, ListMediatorSynchronizerStateRequest, ListMediatorSynchronizerStateResponse, ListSequencingParametersStateRequest, ListSequencingParametersStateResponse, ListSynchronizerParametersStateRequest, ListSynchronizerParametersStateResponse, ListPartyToParticipantRequest, ListPartyToParticipantResponse, ListVettedPackagesRequest as TopologyListVettedPackagesRequest, ListVettedPackagesResponse as TopologyListVettedPackagesResponse, ListPartyHostingLimitsRequest, ListPartyHostingLimitsResponse, ListParticipantSynchronizerPermissionRequest, ListParticipantSynchronizerPermissionResponse, ListSynchronizerTrustCertificateRequest, ListSynchronizerTrustCertificateResponse, ListPartyToKeyMappingRequest, ListPartyToKeyMappingResponse, ListOwnerToKeyMappingRequest, ListOwnerToKeyMappingResponse, ListDecentralizedNamespaceDefinitionRequest, ListDecentralizedNamespaceDefinitionResponse, ListNamespaceDelegationRequest, ListNamespaceDelegationResponse, ListSequencerSynchronizerStateRequest, ListSequencerSynchronizerStateResponse } from "../grpc/generated/canton/com/digitalasset/canton/topology/admin/v30/topology_manager_read_service.js";
 import { GetParticipantIdResponse } from "../../core/types/responses/get-participant-id-response.js";
-import { GetPartiesResponse } from "../../core/types/responses/get-parties-response.js";
-import type { GetNoWaitCommitmentsFromRequest, GetNoWaitCommitmentsFromResponse, GetParticipantScheduleRequest as GetParticipantPruningScheduleRequest, GetParticipantScheduleResponse as GetParticipantPruningScheduleResponse, GetScheduleRequest as GetPruningScheduleRequest, GetScheduleResponse as GetPruningScheduleResponse, GetResourceLimitsRequest, GetResourceLimitsResponse } from "../grpc/generated/canton/com/digitalasset/canton/admin/participant/v30/resource_management_service.js";
-import { GrantUserRightsResponse } from "../../core/types/responses/grant-user-rights-response.js";
+import type { GetPartiesRequest, GetPartiesResponse } from "../grpc/generated/canton/com/daml/ledger/api/v2/admin/party_management_service.js";
+import type { GetResourceLimitsRequest, GetResourceLimitsResponse } from "../grpc/generated/canton/com/digitalasset/canton/admin/participant/v30/resource_management_service.js";
+import type { GetNoWaitCommitmentsFromRequest, GetNoWaitCommitmentsFromResponse, GetParticipantScheduleRequest as GetParticipantPruningScheduleRequest, GetParticipantScheduleResponse as GetParticipantPruningScheduleResponse, GetScheduleRequest as GetPruningScheduleRequest, GetScheduleResponse as GetPruningScheduleResponse } from "../grpc/generated/canton/com/digitalasset/canton/admin/pruning/v30/pruning.js";
 import type { AllocateExternalPartyRequest, AllocateExternalPartyResponse, GenerateExternalPartyTopologyRequest, GenerateExternalPartyTopologyResponse } from "../grpc/generated/canton/com/daml/ledger/api/v2/admin/party_management_service.js";
-import type { ClearPartyOnboardingFlagRequest, ClearPartyOnboardingFlagResponse, GetSafePruningOffsetRequest, GetSafePruningOffsetResponse, GetSynchronizerIdRequest, GetSynchronizerIdResponse, ListConnectedSynchronizersRequest, ListConnectedSynchronizersResponse } from "../grpc/generated/canton/com/digitalasset/canton/admin/participant/v30/synchronizer_connectivity_service.js";
+import type { GetSynchronizerIdRequest, GetSynchronizerIdResponse, ListConnectedSynchronizersRequest, ListConnectedSynchronizersResponse } from "../grpc/generated/canton/com/digitalasset/canton/admin/participant/v30/synchronizer_connectivity_service.js";
+import type { GetSafePruningOffsetRequest, GetSafePruningOffsetResponse } from "../grpc/generated/canton/com/digitalasset/canton/admin/participant/v30/pruning_service.js";
 import { ListKnownPartiesResponse } from "../../core/types/responses/list-known-parties-response.js";
-import type { ListPendingOperationsRequest, ListPendingOperationsResponse, ListRegisteredSynchronizersRequest, ListRegisteredSynchronizersResponse } from "../grpc/generated/canton/com/digitalasset/canton/admin/participant/v30/synchronizer_connectivity_service.js";
+import type { ListRegisteredSynchronizersRequest, ListRegisteredSynchronizersResponse } from "../grpc/generated/canton/com/digitalasset/canton/admin/participant/v30/synchronizer_connectivity_service.js";
+import type { ListPendingOperationsRequest, ListPendingOperationsResponse } from "../grpc/generated/canton/com/digitalasset/canton/admin/participant/v30/participant_repair_service.js";
 import type { CountInFlightRequest, CountInFlightResponse, GetConfigForSlowCounterParticipantsRequest, GetConfigForSlowCounterParticipantsResponse, GetIntervalsBehindForCounterParticipantsRequest, GetIntervalsBehindForCounterParticipantsResponse, LookupOffsetByTimeRequest, LookupOffsetByTimeResponse, LookupReceivedAcsCommitmentsRequest, LookupReceivedAcsCommitmentsResponse, LookupSentAcsCommitmentsRequest, LookupSentAcsCommitmentsResponse, InspectCommitmentContractsRequest, InspectCommitmentContractsResponse, OpenCommitmentRequest, OpenCommitmentResponse } from "../grpc/generated/canton/com/digitalasset/canton/admin/participant/v30/participant_inspection_service.js";
 import type { GetDarContentsRequest, GetDarContentsResponse, GetDarRequest, GetDarResponse, GetPackageContentsRequest, GetPackageContentsResponse, GetPackageReferencesRequest, GetPackageReferencesResponse, ListDarsRequest, ListDarsResponse, ListPackagesRequest as ParticipantListPackagesRequest, ListPackagesResponse as ParticipantListPackagesResponse } from "../grpc/generated/canton/com/digitalasset/canton/admin/participant/v30/package_service.js";
 import { SubmitCommandResponse } from "../../core/types/responses/submit-command-response.js";
@@ -39,6 +40,7 @@ import type { GetUserRequest, GetUserResponse, ListUserRightsRequest, ListUserRi
 import type { GetCommandStatusRequest, GetCommandStatusResponse } from "../grpc/generated/canton/com/daml/ledger/api/v2/admin/command_inspection_service.js";
 import type { GetActiveContractsPageRequest, GetActiveContractsPageResponse, GetConnectedSynchronizersRequest, GetConnectedSynchronizersResponse, GetLedgerEndRequest, GetLedgerEndResponse, GetLatestPrunedOffsetsRequest, GetLatestPrunedOffsetsResponse } from "../grpc/generated/canton/com/daml/ledger/api/v2/state_service.js";
 import { GetPackageRequest, GetPackageResponse, GetPackageStatusRequest, GetPackageStatusResponse, ListPackagesRequest, ListPackagesResponse, ListVettedPackagesRequest, ListVettedPackagesResponse } from "../grpc/generated/canton/com/daml/ledger/api/v2/package_service.js";
+import type { GrantUserRightsRequest, GrantUserRightsResponse } from "../grpc/generated/canton/com/daml/ledger/api/v2/admin/user_management_service.js";
 import { IJsonHttpClient } from "./json-http-client.js";
 import { CommitmentChunkObserver } from "../../services/participant-inspection/commitment-chunk-observer.interface.js";
 import { ContractObserver } from "../../services/contracts/contract-observer.interface.js";
@@ -110,12 +112,12 @@ export declare class JsonTransport implements ITransport {
     listPartyToKeyMappingAsync(_request: ListPartyToKeyMappingRequest, _options?: RequestOptions): Promise<ListPartyToKeyMappingResponse>;
     listSynchronizerTrustCertificateAsync(_request: ListSynchronizerTrustCertificateRequest, _options?: RequestOptions): Promise<ListSynchronizerTrustCertificateResponse>;
     listParticipantSynchronizerPermissionAsync(_request: ListParticipantSynchronizerPermissionRequest, _options?: RequestOptions): Promise<ListParticipantSynchronizerPermissionResponse>;
-    authorizeTopologyTransactionsAsync(_request: any, _options?: RequestOptions): Promise<any>;
-    addTopologyTransactionsAsync(_request: any, _options?: RequestOptions): Promise<any>;
-    importTopologySnapshotAsync(_request: any, _options?: RequestOptions): Promise<any>;
-    importTopologySnapshotV2Async(_request: any, _options?: RequestOptions): Promise<any>;
-    signTopologyTransactionsAsync(_request: any, _options?: RequestOptions): Promise<any>;
-    generateTopologyTransactionsAsync(_request: any, _options?: RequestOptions): Promise<any>;
+    authorizeTopologyTransactionsAsync(_request: AuthorizeRequest, _options?: RequestOptions): Promise<AuthorizeResponse>;
+    addTopologyTransactionsAsync(_request: AddTransactionsRequest, _options?: RequestOptions): Promise<AddTransactionsResponse>;
+    importTopologySnapshotAsync(_request: ImportTopologySnapshotRequest, _options?: RequestOptions): Promise<ImportTopologySnapshotResponse>;
+    importTopologySnapshotV2Async(_request: ImportTopologySnapshotV2Request, _options?: RequestOptions): Promise<ImportTopologySnapshotV2Response>;
+    signTopologyTransactionsAsync(_request: SignTransactionsRequest, _options?: RequestOptions): Promise<SignTransactionsResponse>;
+    generateTopologyTransactionsAsync(_request: GenerateTransactionsRequest, _options?: RequestOptions): Promise<GenerateTransactionsResponse>;
     createTemporaryTopologyStoreAsync(_request: CreateTemporaryTopologyStoreRequest, _options?: RequestOptions): Promise<CreateTemporaryTopologyStoreResponse>;
     dropTemporaryTopologyStoreAsync(_request: DropTemporaryTopologyStoreRequest, _options?: RequestOptions): Promise<DropTemporaryTopologyStoreResponse>;
     listPartyHostingLimitsAsync(_request: ListPartyHostingLimitsRequest, _options?: RequestOptions): Promise<ListPartyHostingLimitsResponse>;

package/node/start-local.sh

@@ -98,6 +98,167 @@ es256_runtime_dir() {
   printf '%s\n' "${START_LOCAL_ES256_RUNTIME_DIR:-$REPO_ROOT/.generated/localnet-es256}"
 }
 
+resolve_tls_enabled() {
+  local value="${LOCALNET_TLS:-0}"
+  if [[ "$value" != "0" && "$value" != "1" ]]; then
+    echo "LOCALNET_TLS must be 0 or 1." >&2
+    return 1
+  fi
+  printf '%s\n' "$value"
+}
+
+resolve_tls_rotate() {
+  local value="${LOCALNET_TLS_ROTATE:-0}"
+  if [[ "$value" != "0" && "$value" != "1" ]]; then
+    echo "LOCALNET_TLS_ROTATE must be 0 or 1." >&2
+    return 1
+  fi
+  printf '%s\n' "$value"
+}
+
+tls_runtime_dir() {
+  printf '%s\n' "${START_LOCAL_TLS_RUNTIME_DIR:-$REPO_ROOT/.generated/localnet-tls}"
+}
+
+prepare_tls_runtime_files() {
+  local enabled
+  enabled="$(resolve_tls_enabled)"
+  if [[ "$enabled" != "1" ]]; then
+    return 0
+  fi
+
+  local runtime_dir
+  runtime_dir="$(tls_runtime_dir)"
+  local ca_key_path="$runtime_dir/ca.key"
+  local ca_certificate_path="$runtime_dir/ca.crt"
+  local server_key_path="$runtime_dir/server.key"
+  local server_certificate_path="$runtime_dir/server.crt"
+  local compose_file="$runtime_dir/compose-localnet.yaml"
+  local tls_fragment_file="$runtime_dir/canton-tls.conf"
+  local canton_config_file="$runtime_dir/canton-localnet.conf"
+  local supplied_count=0
+
+  [[ -n "${LOCALNET_TLS_CERT_CHAIN_PATH:-}" ]] && ((supplied_count += 1))
+  [[ -n "${LOCALNET_TLS_PRIVATE_KEY_PATH:-}" ]] && ((supplied_count += 1))
+  [[ -n "${LOCALNET_TLS_CA_CERT_PATH:-}" ]] && ((supplied_count += 1))
+
+  mkdir -p "$runtime_dir"
+  if (( supplied_count > 0 )); then
+    if (( supplied_count != 3 )); then
+      echo "LOCALNET_TLS_CERT_CHAIN_PATH, LOCALNET_TLS_PRIVATE_KEY_PATH, and LOCALNET_TLS_CA_CERT_PATH must be set together." >&2
+      return 1
+    fi
+    server_certificate_path="$LOCALNET_TLS_CERT_CHAIN_PATH"
+    server_key_path="$LOCALNET_TLS_PRIVATE_KEY_PATH"
+    ca_certificate_path="$LOCALNET_TLS_CA_CERT_PATH"
+    if [[ ! -r "$server_certificate_path" || ! -r "$server_key_path" || ! -r "$ca_certificate_path" ]]; then
+      echo "Supplied TLS certificate, private key, or CA certificate is not readable." >&2
+      return 1
+    fi
+    if ! openssl x509 -in "$server_certificate_path" -noout >/dev/null 2>&1 \
+      || ! openssl pkey -in "$server_key_path" -noout >/dev/null 2>&1 \
+      || ! openssl x509 -in "$ca_certificate_path" -noout >/dev/null 2>&1 \
+      || ! openssl verify -CAfile "$ca_certificate_path" "$server_certificate_path" >/dev/null 2>&1; then
+      echo "Supplied TLS material is not valid PEM certificate/key material." >&2
+      return 1
+    fi
+    local certificate_public_key private_public_key
+    if ! certificate_public_key="$(openssl x509 -in "$server_certificate_path" -pubkey -noout | openssl pkey -pubin -outform DER | sha256sum | awk '{print $1}')" \
+      || ! private_public_key="$(openssl pkey -in "$server_key_path" -pubout | openssl pkey -pubin -outform DER | sha256sum | awk '{print $1}')" \
+      || [[ "$certificate_public_key" != "$private_public_key" ]]; then
+      echo "Supplied TLS private key does not match the server certificate." >&2
+      return 1
+    fi
+  else
+    if [[ "$(resolve_tls_rotate)" == "1" ]]; then
+      rm -f "$ca_key_path" "$ca_certificate_path" "$server_key_path" "$server_certificate_path"
+    fi
+    if [[ ! -e "$ca_key_path" || ! -e "$ca_certificate_path" ]]; then
+      rm -f "$ca_key_path" "$ca_certificate_path"
+      openssl genrsa -out "$ca_key_path" 2048 >/dev/null 2>&1
+      chmod 600 "$ca_key_path"
+      openssl req -x509 -new -sha256 -days 3650 -key "$ca_key_path" \
+        -subj "/CN=localnet-tls-ca" -out "$ca_certificate_path" >/dev/null 2>&1
+    fi
+    if [[ ! -e "$server_key_path" || ! -e "$server_certificate_path" ]]; then
+      rm -f "$server_key_path" "$server_certificate_path"
+      local csr_path="$runtime_dir/server.csr"
+      local extensions_path="$runtime_dir/server-extensions.cnf"
+      openssl genrsa -out "$server_key_path" 2048 >/dev/null 2>&1
+      chmod 600 "$server_key_path"
+      openssl req -new -sha256 -key "$server_key_path" -subj "/CN=localhost" -out "$csr_path" >/dev/null 2>&1
+      cat > "$extensions_path" <<'EOF'
+[server_ext]
+basicConstraints = CA:FALSE
+keyUsage = digitalSignature, keyEncipherment
+extendedKeyUsage = serverAuth
+subjectAltName = DNS:localhost, DNS:canton, IP:127.0.0.1
+EOF
+      openssl x509 -req -sha256 -days 3650 -in "$csr_path" \
+        -CA "$ca_certificate_path" -CAkey "$ca_key_path" -CAcreateserial \
+        -out "$server_certificate_path" -extfile "$extensions_path" -extensions server_ext >/dev/null 2>&1
+      rm -f "$csr_path" "$extensions_path" "$ca_certificate_path.srl"
+    fi
+    if ! openssl x509 -in "$server_certificate_path" -noout >/dev/null 2>&1 \
+      || ! openssl pkey -in "$server_key_path" -noout >/dev/null 2>&1 \
+      || ! openssl x509 -in "$ca_certificate_path" -noout >/dev/null 2>&1; then
+      echo "Generated TLS material is invalid." >&2
+      return 1
+    fi
+  fi
+
+  cat > "$tls_fragment_file" <<'EOF'
+canton.participants.app-provider.ledger-api.tls {
+  cert-chain-file = "/app/localnet-tls/server.crt"
+  private-key-file = "/app/localnet-tls/server.key"
+  trust-collection-file = "/app/localnet-tls/ca.crt"
+}
+canton.participants.app-provider.admin-api.tls {
+  cert-chain-file = "/app/localnet-tls/server.crt"
+  private-key-file = "/app/localnet-tls/server.key"
+  trust-collection-file = "/app/localnet-tls/ca.crt"
+}
+canton.participants.app-user.ledger-api.tls {
+  cert-chain-file = "/app/localnet-tls/server.crt"
+  private-key-file = "/app/localnet-tls/server.key"
+  trust-collection-file = "/app/localnet-tls/ca.crt"
+}
+canton.participants.app-user.admin-api.tls {
+  cert-chain-file = "/app/localnet-tls/server.crt"
+  private-key-file = "/app/localnet-tls/server.key"
+  trust-collection-file = "/app/localnet-tls/ca.crt"
+}
+canton.participants.sv.ledger-api.tls {
+  cert-chain-file = "/app/localnet-tls/server.crt"
+  private-key-file = "/app/localnet-tls/server.key"
+  trust-collection-file = "/app/localnet-tls/ca.crt"
+}
+canton.participants.sv.admin-api.tls {
+  cert-chain-file = "/app/localnet-tls/server.crt"
+  private-key-file = "/app/localnet-tls/server.key"
+  trust-collection-file = "/app/localnet-tls/ca.crt"
+}
+EOF
+  cat > "$canton_config_file" <<'EOF'
+include file("/app/base-app.conf")
+include file("/app/localnet-tls.conf")
+EOF
+  cat > "$compose_file" <<EOF
+services:
+  canton:
+    volumes:
+      - "${LOCALNET_DIR}/conf/canton/app.conf:/app/base-app.conf:ro"
+      - "$canton_config_file:/app/app.conf:ro"
+      - "$tls_fragment_file:/app/localnet-tls.conf:ro"
+      - "$server_certificate_path:/app/localnet-tls/server.crt:ro"
+      - "$server_key_path:/app/localnet-tls/server.key:ro"
+      - "$ca_certificate_path:/app/localnet-tls/ca.crt:ro"
+EOF
+  export LOCALNET_TLS_COMPOSE_FILE="$compose_file"
+  export LOCALNET_TLS_FRAGMENT_FILE="$tls_fragment_file"
+  export LOCALNET_TLS_CA_CERT_PATH="$ca_certificate_path"
+}
+
 prepare_es256_runtime_files() {
   local runtime_dir
   runtime_dir="$(es256_runtime_dir)"
@@ -150,6 +311,8 @@ prepare_es256_runtime_files() {
   cat > "$canton_config_file" <<EOF
 include file("/app/base-app.conf")
 
+$(if [[ "$(resolve_tls_enabled)" == "1" ]]; then printf 'include file("/app/localnet-tls.conf")\n'; fi)
+
 EOF
   local participant profile
   for participant in app-provider app-user sv; do
@@ -195,6 +358,13 @@ append_es256_args() {
   fi
 }
 
+append_tls_args() {
+  local -n compose_args_ref="$1"
+  if [[ "$(resolve_tls_enabled)" == "1" ]]; then
+    compose_args_ref+=( -f "$LOCALNET_TLS_COMPOSE_FILE" )
+  fi
+}
+
 resolve_docker_compose_cmd() {
   if (( ${#DOCKER_COMPOSE_CMD[@]} > 0 )); then
     return 0
@@ -414,6 +584,25 @@ canton.participants.extra-${index}.ledger-api.auth-services = [
   }
 ]
 
+EOF
+    done
+  fi
+
+  if [[ "$(resolve_tls_enabled)" == "1" ]]; then
+    local index
+    for ((index = 1; index <= count; index++)); do
+      cat >> "$canton_config_file" <<EOF
+canton.participants.extra-${index}.ledger-api.tls {
+  cert-chain-file = "/app/localnet-tls/server.crt"
+  private-key-file = "/app/localnet-tls/server.key"
+  trust-collection-file = "/app/localnet-tls/ca.crt"
+}
+canton.participants.extra-${index}.admin-api.tls {
+  cert-chain-file = "/app/localnet-tls/server.crt"
+  private-key-file = "/app/localnet-tls/server.key"
+  trust-collection-file = "/app/localnet-tls/ca.crt"
+}
+
 EOF
     done
   fi
@@ -808,6 +997,7 @@ start_ledger_stack() {
   export SV_PROFILE=on
   export PQS_SV_PROFILE=on
   load_localnet_common_env "$localnet_dir/env/common.env"
+  prepare_tls_runtime_files
   prepare_es256_runtime_files
   local extra_participants
   extra_participants="$(resolve_extra_participants)"
@@ -841,6 +1031,7 @@ start_ledger_stack() {
   fi
 
   append_extra_participant_args "$extra_participants" "$auth_mode" compose_args
+  append_tls_args compose_args
   append_es256_args compose_args
   docker_compose "${compose_args[@]}" down -v --remove-orphans
   mapfile -t startup_services < <(prerequisite_services "$auth_mode")
@@ -873,12 +1064,16 @@ if [[ ! -f .env.local ]]; then
   make setup
 fi
 
-if [[ "$(resolve_es256_enabled)" != "1" ]] && make_target_exists start-local-ledger; then
+if [[ "$(resolve_es256_enabled)" != "1" && "$(resolve_tls_enabled)" != "1" ]] && make_target_exists start-local-ledger; then
   make start-local-ledger
 else
   auth_mode="$(read_env_value AUTH_MODE || true)"
   auth_mode="${auth_mode:-shared-secret}"
-  echo "start-local-ledger target not found. Starting ledger-only compose stack directly."
+  if [[ "$(resolve_es256_enabled)" == "1" || "$(resolve_tls_enabled)" == "1" ]]; then
+    echo "Generated localnet transport overlay enabled. Starting ledger-only compose stack directly."
+  else
+    echo "start-local-ledger target not found. Starting ledger-only compose stack directly."
+  fi
   start_ledger_stack "$auth_mode"
   if [[ "$(resolve_es256_enabled)" == "1" ]]; then
     echo "ES256 bearer token written to $LOCALNET_ES256_TOKEN_PATH"

package/node/stop-local.sh

@@ -92,6 +92,19 @@ es256_runtime_dir() {
   printf '%s\n' "${START_LOCAL_ES256_RUNTIME_DIR:-$REPO_ROOT/.generated/localnet-es256}"
 }
 
+resolve_tls_enabled() {
+  local value="${LOCALNET_TLS:-0}"
+  if [[ "$value" != "0" && "$value" != "1" ]]; then
+    echo "LOCALNET_TLS must be 0 or 1." >&2
+    return 1
+  fi
+  printf '%s\n' "$value"
+}
+
+tls_runtime_dir() {
+  printf '%s\n' "${START_LOCAL_TLS_RUNTIME_DIR:-$REPO_ROOT/.generated/localnet-tls}"
+}
+
 append_es256_args() {
   local -n compose_args_ref="$1"
   if [[ "$(resolve_es256_enabled)" == "1" ]]; then
@@ -102,6 +115,16 @@ append_es256_args() {
   fi
 }
 
+append_tls_args() {
+  local -n compose_args_ref="$1"
+  if [[ "$(resolve_tls_enabled)" == "1" ]]; then
+    local compose_file="$(tls_runtime_dir)/compose-localnet.yaml"
+    if [[ -f "$compose_file" ]]; then
+      compose_args_ref+=( -f "$compose_file" )
+    fi
+  fi
+}
+
 resolve_docker_compose_cmd() {
   if (( ${#DOCKER_COMPOSE_CMD[@]} > 0 )); then
     return 0
@@ -177,6 +200,7 @@ stop_ledger_stack() {
   fi
 
   append_existing_extra_participant_args compose_args
+  append_tls_args compose_args
   append_es256_args compose_args
   docker_compose "${compose_args[@]}" down -v --remove-orphans
 }
@@ -190,7 +214,7 @@ if [[ ! -f .env.local ]]; then
   exit 0
 fi
 
-if [[ "$(resolve_es256_enabled)" != "1" ]] && make_target_exists stop-local-ledger; then
+if [[ "$(resolve_es256_enabled)" != "1" && "$(resolve_tls_enabled)" != "1" ]] && make_target_exists stop-local-ledger; then
   make stop-local-ledger
 else
   auth_mode="$(read_env_value AUTH_MODE || true)"

package/node/test-start-local.sh

@@ -32,12 +32,17 @@ run_case() {
   local cn_quickstart_dir_override="${6:-}"
   local repo_root_env_contents="${7:-}"
   local es256_enabled="${8:-0}"
+  local tls_enabled="${9:-0}"
+  local tls_cert_chain_path="${10:-}"
+  local tls_private_key_path="${11:-}"
+  local tls_ca_cert_path="${12:-}"
+  local expected_status="${13:-0}"
   local quickstart_dir="$tmpdir/quickstart"
   local quickstart_root_dir="$tmpdir/cn-quickstart"
   local stubbin="$tmpdir/bin"
   local generated_dir="$tmpdir/generated"
 
-  rm -rf "$quickstart_dir" "$quickstart_root_dir" "$stubbin" "$generated_dir"
+  rm -rf "$quickstart_dir" "$quickstart_root_dir" "$stubbin" "$generated_dir" "$tmpdir/tls"
   mkdir -p \
     "$quickstart_root_dir" \
     "$quickstart_dir/docker/modules/localnet/env" \
@@ -145,6 +150,7 @@ EOF
   chmod +x "$stubbin/docker-compose"
 
   local output
+  local status=0
   output="$(
     if [[ -n "$repo_root_env_contents" ]]; then
       printf '%s\n' "$repo_root_env_contents" > "$REPO_ENV_FILE"
@@ -158,20 +164,39 @@ EOF
         TERM="${TERM:-dumb}" \
         START_LOCAL_GENERATED_DIR="$generated_dir" \
         START_LOCAL_ES256_RUNTIME_DIR="$tmpdir/es256" \
+        START_LOCAL_TLS_RUNTIME_DIR="$tmpdir/tls" \
         LOCALNET_ES256_JWT="$es256_enabled" \
+        LOCALNET_TLS="$tls_enabled" \
+        LOCALNET_TLS_CERT_CHAIN_PATH="$tls_cert_chain_path" \
+        LOCALNET_TLS_PRIVATE_KEY_PATH="$tls_private_key_path" \
+        LOCALNET_TLS_CA_CERT_PATH="$tls_ca_cert_path" \
         EXTRA_PARTICIPANTS="$extra_participants" \
         PATH="$stubbin:$PATH" \
-        bash ./start-local.sh
+        bash ./start-local.sh 2>&1
     else
       CN_QUICKSTART_DIR="${cn_quickstart_dir_override:-$quickstart_dir}" \
         START_LOCAL_GENERATED_DIR="$generated_dir" \
         START_LOCAL_ES256_RUNTIME_DIR="$tmpdir/es256" \
+        START_LOCAL_TLS_RUNTIME_DIR="$tmpdir/tls" \
         LOCALNET_ES256_JWT="$es256_enabled" \
+        LOCALNET_TLS="$tls_enabled" \
+        LOCALNET_TLS_CERT_CHAIN_PATH="$tls_cert_chain_path" \
+        LOCALNET_TLS_PRIVATE_KEY_PATH="$tls_private_key_path" \
+        LOCALNET_TLS_CA_CERT_PATH="$tls_ca_cert_path" \
         EXTRA_PARTICIPANTS="$extra_participants" \
         PATH="$stubbin:$PATH" \
-        bash ./start-local.sh
+        bash ./start-local.sh 2>&1
     fi
-  )"
+  )" || status=$?
+
+  if [[ "$expected_status" == "0" && "$status" != "0" ]]; then
+    printf 'expected successful start-local case, got status %s and output:\n%s\n' "$status" "$output" >&2
+    exit 1
+  fi
+  if [[ "$expected_status" != "0" && "$status" == "0" ]]; then
+    printf 'expected failing start-local case, got success and output:\n%s\n' "$output" >&2
+    exit 1
+  fi
 
   if ! grep -Fxq "$expected_output" <<<"$output"; then
     printf 'expected output line %q, got:\n%s\n' "$expected_output" "$output" >&2
@@ -190,6 +215,28 @@ assert_file_contains() {
   fi
 }
 
+assert_file_contains_text() {
+  local path="$1"
+  local expected="$2"
+
+  if ! grep -Fq "$expected" "$path"; then
+    printf 'expected file %s to contain text %q, got:\n' "$path" "$expected" >&2
+    cat "$path" >&2
+    exit 1
+  fi
+}
+
+assert_file_mode() {
+  local path="$1"
+  local expected="$2"
+  local actual
+  actual="$(stat -c '%a' "$path")"
+  if [[ "$actual" != "$expected" ]]; then
+    printf 'expected file %s mode %s, got %s\n' "$path" "$expected" "$actual" >&2
+    exit 1
+  fi
+}
+
 run_repo_root_env_case() {
   local quickstart_dir="$tmpdir/quickstart"
   local quickstart_root_dir="$tmpdir/custom-quickstart-root"
@@ -351,4 +398,54 @@ assert_file_contains "$tmpdir/generated/additional-config.extra-validators.conf"
 assert_file_contains "$tmpdir/generated/additional-config.extra-validators.conf" '  validator-party-hint = "${EXTRA_VALIDATOR_1_PARTY_HINT}"'
 assert_file_contains "$tmpdir/generated/additional-config.extra-validators.conf" '  domains.global.buy-extra-traffic {'
 assert_file_contains "$tmpdir/generated/additional-config.extra-validators.conf" 'canton.sv-apps.sv.expected-validator-onboardings += { secret = "${EXTRA_VALIDATOR_3_ONBOARDING_SECRET}" }'
+run_case $'.PHONY: start-local-ledger\nstart-local-ledger:\n' 'stub docker compose -f compose.yaml -f '"$tmpdir"'/quickstart/docker/modules/localnet/compose.yaml -f '"$tmpdir"'/quickstart/docker/modules/splice-onboarding/compose.yaml -f '"$tmpdir"'/quickstart/docker/modules/pqs/compose.yaml --env-file .env --env-file .env.local --env-file '"$tmpdir"'/quickstart/docker/modules/localnet/compose.env --env-file '"$tmpdir"'/quickstart/docker/modules/localnet/env/common.env --env-file '"$tmpdir"'/quickstart/docker/modules/pqs/compose.env --profile app-provider --profile pqs-app-provider --profile pqs-sv -f '"$tmpdir"'/tls/compose-localnet.yaml down -v --remove-orphans' shared-secret default 0 '' '' 0 1
+assert_file_contains_text "$tmpdir/tls/canton-tls.conf" 'canton.participants.app-provider.ledger-api.tls {'
+assert_file_contains_text "$tmpdir/tls/canton-tls.conf" 'canton.participants.app-provider.admin-api.tls {'
+assert_file_contains_text "$tmpdir/tls/canton-tls.conf" 'canton.participants.app-user.ledger-api.tls {'
+assert_file_contains_text "$tmpdir/tls/canton-tls.conf" 'canton.participants.sv.admin-api.tls {'
+assert_file_contains_text "$tmpdir/tls/compose-localnet.yaml" '/app/localnet-tls/server.key:ro'
+assert_file_contains_text "$tmpdir/tls/compose-localnet.yaml" '/app/localnet-tls/ca.crt:ro'
+assert_file_mode "$tmpdir/tls/server.key" 600
+assert_file_mode "$tmpdir/tls/ca.key" 600
+run_case $'.PHONY: start\nstart:\n' 'stub docker compose -f compose.yaml -f '"$tmpdir"'/quickstart/docker/modules/localnet/compose.yaml -f '"$tmpdir"'/quickstart/docker/modules/splice-onboarding/compose.yaml -f '"$tmpdir"'/quickstart/docker/modules/pqs/compose.yaml --env-file .env --env-file .env.local --env-file '"$tmpdir"'/quickstart/docker/modules/localnet/compose.env --env-file '"$tmpdir"'/quickstart/docker/modules/localnet/env/common.env --env-file '"$tmpdir"'/quickstart/docker/modules/pqs/compose.env --profile app-provider --profile pqs-app-provider --profile pqs-sv -f '"$tmpdir"'/generated/compose-extra-participants.yaml --env-file '"$tmpdir"'/generated/extra-participants.env -f '"$tmpdir"'/tls/compose-localnet.yaml down -v --remove-orphans' shared-secret default 2 '' '' 0 1
+assert_file_contains_text "$tmpdir/generated/additional-config.extra-participants.conf" 'canton.participants.extra-1.ledger-api.tls {'
+assert_file_contains_text "$tmpdir/generated/additional-config.extra-participants.conf" 'canton.participants.extra-2.admin-api.tls {'
+
+mkdir -p "$tmpdir/supplied"
+openssl genrsa -out "$tmpdir/supplied/ca.key" 2048 >/dev/null 2>&1
+openssl req -x509 -new -sha256 -days 3650 \
+  -key "$tmpdir/supplied/ca.key" \
+  -subj '/CN=supplied-localnet-ca' \
+  -addext 'basicConstraints=critical,CA:TRUE' \
+  -addext 'keyUsage=critical,keyCertSign,cRLSign' \
+  -out "$tmpdir/supplied/ca.crt" >/dev/null 2>&1
+openssl genrsa -out "$tmpdir/supplied/server.key" 2048 >/dev/null 2>&1
+openssl req -new -sha256 -key "$tmpdir/supplied/server.key" \
+  -subj '/CN=localhost' -out "$tmpdir/supplied/server.csr" >/dev/null 2>&1
+printf '%s\n' \
+  '[server_ext]' \
+  'basicConstraints = CA:FALSE' \
+  'keyUsage = digitalSignature, keyEncipherment' \
+  'extendedKeyUsage = serverAuth' \
+  'subjectAltName = DNS:localhost, DNS:canton, IP:127.0.0.1' \
+  > "$tmpdir/supplied/server-extensions.cnf"
+openssl x509 -req -sha256 -days 3650 \
+  -in "$tmpdir/supplied/server.csr" \
+  -CA "$tmpdir/supplied/ca.crt" -CAkey "$tmpdir/supplied/ca.key" -CAcreateserial \
+  -out "$tmpdir/supplied/server.crt" \
+  -extfile "$tmpdir/supplied/server-extensions.cnf" -extensions server_ext >/dev/null 2>&1
+run_case $'.PHONY: start\nstart:\n' 'stub docker compose -f compose.yaml -f '"$tmpdir"'/quickstart/docker/modules/localnet/compose.yaml -f '"$tmpdir"'/quickstart/docker/modules/splice-onboarding/compose.yaml -f '"$tmpdir"'/quickstart/docker/modules/pqs/compose.yaml --env-file .env --env-file .env.local --env-file '"$tmpdir"'/quickstart/docker/modules/localnet/compose.env --env-file '"$tmpdir"'/quickstart/docker/modules/localnet/env/common.env --env-file '"$tmpdir"'/quickstart/docker/modules/pqs/compose.env --profile app-provider --profile pqs-app-provider --profile pqs-sv -f '"$tmpdir"'/tls/compose-localnet.yaml down -v --remove-orphans' shared-secret default 0 '' '' 0 1 "$tmpdir/supplied/server.crt" "$tmpdir/supplied/server.key" "$tmpdir/supplied/ca.crt"
+if [[ -e "$tmpdir/tls/server.key" || -e "$tmpdir/tls/ca.key" ]]; then
+  echo 'supplied TLS mode unexpectedly generated private material' >&2
+  exit 1
+fi
+assert_file_contains_text "$tmpdir/tls/compose-localnet.yaml" "$tmpdir/supplied/server.key:/app/localnet-tls/server.key:ro"
+openssl genrsa -out "$tmpdir/supplied/mismatch.key" 2048 >/dev/null 2>&1
+run_case $'.PHONY: start\nstart:\n' 'Supplied TLS private key does not match the server certificate.' shared-secret default 0 '' '' 0 1 "$tmpdir/supplied/server.crt" "$tmpdir/supplied/mismatch.key" "$tmpdir/supplied/ca.crt" 1
+run_case $'.PHONY: start\nstart:\n' 'LOCALNET_TLS_CERT_CHAIN_PATH, LOCALNET_TLS_PRIVATE_KEY_PATH, and LOCALNET_TLS_CA_CERT_PATH must be set together.' shared-secret default 0 '' '' 0 1 "$tmpdir/supplied/server.crt" '' '' 1
+run_case $'.PHONY: start\nstart:\n' 'LOCALNET_TLS must be 0 or 1.' shared-secret default 0 '' '' 0 invalid '' '' '' 1
+run_case $'.PHONY: start\nstart:\n' 'ES256 bearer token written to '"$tmpdir"'/es256/ledger-api-user.token' shared-secret default 0 '' '' 1 1
+assert_file_contains_text "$tmpdir/es256/canton-es256.conf" 'include file("/app/localnet-tls.conf")'
+assert_file_contains_text "$tmpdir/es256/compose-es256.yaml" '/app/es256-certificate.pem:ro'
+assert_file_contains_text "$tmpdir/tls/compose-localnet.yaml" '/app/localnet-tls/server.crt:ro'
 run_repo_root_env_case

package/node/test-stop-local.sh

@@ -14,6 +14,7 @@ run_case() {
   local expected_output="$2"
   local auth_mode="${3:-shared-secret}"
   local docker_mode="${4:-compose-v2}"
+  local tls_enabled="${5:-0}"
   local quickstart_dir="$tmpdir/quickstart"
   local stubbin="$tmpdir/bin"
   local generated_dir="$tmpdir/generated-stop"
@@ -26,6 +27,10 @@ run_case() {
     "$quickstart_dir/docker/modules/keycloak" \
     "$stubbin" \
     "$generated_dir"
+  if [[ "$tls_enabled" == "1" ]]; then
+    mkdir -p "$tmpdir/tls"
+    printf 'services:\n' > "$tmpdir/tls/compose-localnet.yaml"
+  fi
 
   printf '%s\n' "$makefile_targets" > "$quickstart_dir/Makefile"
   printf 'DOCKER_NETWORK=quickstart\nSPLICE_VERSION=0.6.5\n' > "$quickstart_dir/.env"
@@ -95,6 +100,8 @@ EOF
     cd "$SCRIPT_DIR"
     CN_QUICKSTART_DIR="$quickstart_dir" \
       START_LOCAL_GENERATED_DIR="$generated_dir" \
+      START_LOCAL_TLS_RUNTIME_DIR="$tmpdir/tls" \
+      LOCALNET_TLS="$tls_enabled" \
       PATH="$stubbin:$PATH" \
       bash ./stop-local.sh
   )"
@@ -109,4 +116,4 @@ run_case $'.PHONY: stop-local-ledger\nstop-local-ledger:\n' 'stub make stop-loca
 run_case $'.PHONY: stop\nstop:\n' 'stub docker compose -f compose.yaml -f '"$tmpdir"'/quickstart/docker/modules/localnet/compose.yaml -f '"$tmpdir"'/quickstart/docker/modules/splice-onboarding/compose.yaml -f '"$tmpdir"'/quickstart/docker/modules/pqs/compose.yaml --env-file .env --env-file .env.local --env-file '"$tmpdir"'/quickstart/docker/modules/localnet/compose.env --env-file '"$tmpdir"'/quickstart/docker/modules/localnet/env/common.env --env-file '"$tmpdir"'/quickstart/docker/modules/pqs/compose.env --profile app-provider --profile pqs-app-provider --profile pqs-sv down -v --remove-orphans'
 run_case $'.PHONY: stop\nstop:\n' 'stub docker compose -f compose.yaml -f '"$tmpdir"'/quickstart/docker/modules/localnet/compose.yaml -f '"$tmpdir"'/quickstart/docker/modules/splice-onboarding/compose.yaml -f '"$tmpdir"'/quickstart/docker/modules/pqs/compose.yaml --env-file .env --env-file .env.local --env-file '"$tmpdir"'/quickstart/docker/modules/localnet/compose.env --env-file '"$tmpdir"'/quickstart/docker/modules/localnet/env/common.env --env-file '"$tmpdir"'/quickstart/docker/modules/pqs/compose.env --profile app-provider --profile pqs-app-provider --profile pqs-sv -f '"$tmpdir"'/quickstart/docker/modules/keycloak/compose.yaml --env-file '"$tmpdir"'/quickstart/docker/modules/keycloak/compose.env --profile keycloak down -v --remove-orphans' oauth2
 run_case $'.PHONY: stop\nstop:\n' 'stub docker-compose -f compose.yaml -f '"$tmpdir"'/quickstart/docker/modules/localnet/compose.yaml -f '"$tmpdir"'/quickstart/docker/modules/splice-onboarding/compose.yaml -f '"$tmpdir"'/quickstart/docker/modules/pqs/compose.yaml --env-file .env --env-file .env.local --env-file '"$tmpdir"'/quickstart/docker/modules/localnet/compose.env --env-file '"$tmpdir"'/quickstart/docker/modules/localnet/env/common.env --env-file '"$tmpdir"'/quickstart/docker/modules/pqs/compose.env --profile app-provider --profile pqs-app-provider --profile pqs-sv down -v --remove-orphans' shared-secret compose-v1
-
+run_case $'.PHONY: stop-local-ledger\nstop-local-ledger:\n' 'stub docker compose -f compose.yaml -f '"$tmpdir"'/quickstart/docker/modules/localnet/compose.yaml -f '"$tmpdir"'/quickstart/docker/modules/splice-onboarding/compose.yaml -f '"$tmpdir"'/quickstart/docker/modules/pqs/compose.yaml --env-file .env --env-file .env.local --env-file '"$tmpdir"'/quickstart/docker/modules/localnet/compose.env --env-file '"$tmpdir"'/quickstart/docker/modules/localnet/env/common.env --env-file '"$tmpdir"'/quickstart/docker/modules/pqs/compose.env --profile app-provider --profile pqs-app-provider --profile pqs-sv -f '"$tmpdir"'/tls/compose-localnet.yaml down -v --remove-orphans' shared-secret compose-v2 1

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@distrohelena/canton-typescript-sdk",
-    "version": "0.1.16",
+    "version": "0.1.18",
     "license": "Apache-2.0",
     "type": "module",
     "main": "./dist/index.js",

package/dist/core/types/requests/add-topology-transactions-request.d.ts

@@ -1,16 +0,0 @@
-import { SignedTopologyTransaction } from "../topology/signed-topology-transaction.js";
-import { TopologyDuration } from "../topology/topology-duration.js";
-import { TopologyForceFlag } from "../topology/topology-force-flag.js";
-import { TopologyStoreId } from "../topology/topology-store-id.js";
-export declare class AddTopologyTransactionsRequest {
-    readonly transactions: SignedTopologyTransaction[];
-    readonly forceChanges: TopologyForceFlag[];
-    readonly store?: TopologyStoreId;
-    readonly waitToBecomeEffective?: TopologyDuration;
-    constructor(init?: {
-        transactions?: SignedTopologyTransaction[];
-        forceChanges?: TopologyForceFlag[];
-        store?: TopologyStoreId;
-        waitToBecomeEffective?: TopologyDuration;
-    });
-}

package/dist/core/types/requests/add-topology-transactions-request.js

@@ -1,12 +0,0 @@
-export class AddTopologyTransactionsRequest {
-    transactions;
-    forceChanges;
-    store;
-    waitToBecomeEffective;
-    constructor(init = {}) {
-        this.transactions = [...(init.transactions ?? [])];
-        this.forceChanges = [...(init.forceChanges ?? [])];
-        this.store = init.store;
-        this.waitToBecomeEffective = init.waitToBecomeEffective;
-    }
-}

package/dist/core/types/requests/allocate-external-party-request.d.ts

@@ -1,18 +0,0 @@
-import { ExternalPartyOnboardingTransaction } from "../external-party/external-party-onboarding-transaction.js";
-import { ExternalPartySignature } from "../external-party/external-party-signature.js";
-export declare class AllocateExternalPartyRequest {
-    readonly synchronizer: string;
-    readonly onboardingTransactions: ExternalPartyOnboardingTransaction[];
-    readonly multiHashSignatures: ExternalPartySignature[];
-    readonly identityProviderId?: string;
-    readonly waitForAllocation?: boolean;
-    readonly userId?: string;
-    constructor(init?: {
-        synchronizer?: string;
-        onboardingTransactions?: ExternalPartyOnboardingTransaction[];
-        multiHashSignatures?: ExternalPartySignature[];
-        identityProviderId?: string;
-        waitForAllocation?: boolean;
-        userId?: string;
-    });
-}