@distrohelena/canton-typescript-sdk 0.1.32 → 0.1.35

package/dist/transports/grpc/mappers/command-deduplication-mapper.js

@@ -0,0 +1,19 @@
+import { ValidationError } from "../../../core/errors/validation-error.js";
+export function mapGrpcDeduplicationPeriod(period, options) {
+    if (period === undefined) {
+        return { oneofKind: undefined };
+    }
+    else if (period.kind === "duration") {
+        return {
+            oneofKind: "deduplicationDuration",
+            deduplicationDuration: { seconds: String(period.seconds), nanos: 0 },
+        };
+    }
+    else if (!options.allowParticipantBegin && period.offset === "0") {
+        throw new ValidationError("interactive command deduplication offsets must be positive");
+    }
+    return {
+        oneofKind: "deduplicationOffset",
+        deduplicationOffset: period.offset,
+    };
+}

package/dist/transports/grpc/mappers/commands-mapper.js

@@ -10,16 +10,15 @@ import { ExerciseByKeyCommand } from "../../../core/types/commands/exercise-by-k
 import { ExerciseCommand } from "../../../core/types/commands/exercise-command.js";
 import { SubmitCommandResponse } from "../../../core/types/responses/submit-command-response.js";
 import { SubmitCommandTransactionResponse } from "../../../core/types/responses/submit-command-transaction-response.js";
+import { mapGrpcDeduplicationPeriod } from "./command-deduplication-mapper.js";
 export function mapGrpcSubmitCommandRequest(request) {
     return {
         commands: {
             workflowId: "",
             userId: request.userId ?? "",
-            commandId: randomUUID(),
+            commandId: request.commandId ?? randomUUID(),
             commands: [mapGrpcLedgerCommand(request.command)],
-            deduplicationPeriod: {
-                oneofKind: undefined,
-            },
+            deduplicationPeriod: mapGrpcDeduplicationPeriod(request.deduplicationPeriod, { allowParticipantBegin: true }),
             actAs: [...request.actAs],
             readAs: [...request.readAs],
             submissionId: "",

package/dist/transports/grpc/mappers/interactive-command-mapper.js

@@ -1,8 +1,12 @@
 import { ValidationError } from "../../../core/errors/validation-error.js";
 import { SubmitCommandResponse } from "../../../core/types/responses/submit-command-response.js";
 import { SignatureFormat, SigningAlgorithmSpec, } from "../generated/canton/com/daml/ledger/api/v2/crypto.js";
+import { mapGrpcDeduplicationPeriod } from "./command-deduplication-mapper.js";
 import { mapGrpcLedgerCommand } from "./commands-mapper.js";
 export function mapGrpcPrepareSubmissionRequest(request, commandId) {
+    mapGrpcDeduplicationPeriod(request.deduplicationPeriod, {
+        allowParticipantBegin: false,
+    });
     return {
         userId: request.userId ?? "",
         commandId,
@@ -22,9 +26,7 @@ export function mapGrpcExecuteSubmissionAndWaitRequest(init) {
         partySignatures: {
             signatures: init.signerResults.map(({ party, result }) => ({ party, signatures: [mapGrpcSignature(result)] })),
         },
-        deduplicationPeriod: {
-            oneofKind: undefined,
-        },
+        deduplicationPeriod: mapGrpcDeduplicationPeriod(init.request.deduplicationPeriod, { allowParticipantBegin: false }),
         submissionId: init.submissionId,
         userId: init.request.userId ?? "",
         hashingSchemeVersion: init.hashingSchemeVersion,

package/dist/transports/grpc/mappers/parties-mapper.d.ts

@@ -1,13 +1,11 @@
-import { GetParticipantIdRequest } from "../../../core/types/requests/get-participant-id-request.js";
 import { GetPartiesRequest } from "../../../core/types/requests/get-parties-request.js";
-import { CreatePartyRequest } from "../../../core/types/requests/create-party-request.js";
+import { AllocatePartyRequest as SdkAllocatePartyRequest } from "../../../core/types/requests/allocate-party-request.js";
 import { ListPartiesRequest } from "../../../core/types/requests/list-parties-request.js";
 import { CreatePartyResponse } from "../../../core/types/responses/create-party-response.js";
-import { GetParticipantIdResponse as SdkGetParticipantIdResponse } from "../../../core/types/responses/get-participant-id-response.js";
 import { GetPartiesResponse as SdkGetPartiesResponse } from "../../../core/types/responses/get-parties-response.js";
 import { ListPartiesResponse } from "../../../core/types/responses/list-parties-response.js";
-import { AllocatePartyRequest, AllocatePartyResponse, GetParticipantIdResponse, GetPartiesResponse, ListKnownPartiesRequest, ListKnownPartiesResponse } from "../generated/canton/com/daml/ledger/api/v2/admin/party_management_service.js";
-export declare function mapGrpcCreatePartyRequest(request: CreatePartyRequest): AllocatePartyRequest;
+import { AllocatePartyRequest, AllocatePartyResponse, GetPartiesResponse, ListKnownPartiesRequest, ListKnownPartiesResponse } from "../generated/canton/com/daml/ledger/api/v2/admin/party_management_service.js";
+export declare function mapGrpcCreatePartyRequest(request: SdkAllocatePartyRequest): AllocatePartyRequest;
 export declare function mapGrpcCreateParty(payload: {
     identifier?: string;
     partyDetails?: {
@@ -16,8 +14,6 @@ export declare function mapGrpcCreateParty(payload: {
 } | AllocatePartyResponse): CreatePartyResponse;
 export declare function mapGrpcListPartiesRequest(request: ListPartiesRequest): ListKnownPartiesRequest;
 export declare function mapGrpcListParties(payload: ListKnownPartiesResponse): ListPartiesResponse;
-export declare function mapGrpcGetParticipantIdRequest(_request: GetParticipantIdRequest): Record<string, never>;
-export declare function mapGrpcGetParticipantId(payload: Partial<GetParticipantIdResponse>): SdkGetParticipantIdResponse;
 export declare function mapGrpcGetPartiesRequest(request: GetPartiesRequest): {
     parties: string[];
     identityProviderId: string;

package/dist/transports/grpc/mappers/parties-mapper.js

@@ -1,6 +1,5 @@
 import { PartyDetails as SdkPartyDetails } from "../../../core/types/party-details.js";
 import { CreatePartyResponse } from "../../../core/types/responses/create-party-response.js";
-import { GetParticipantIdResponse as SdkGetParticipantIdResponse } from "../../../core/types/responses/get-participant-id-response.js";
 import { GetPartiesResponse as SdkGetPartiesResponse } from "../../../core/types/responses/get-parties-response.js";
 import { ListPartiesResponse } from "../../../core/types/responses/list-parties-response.js";
 export function mapGrpcCreatePartyRequest(request) {
@@ -8,7 +7,7 @@ export function mapGrpcCreatePartyRequest(request) {
         partyIdHint: request.partyIdHint ?? "",
         identityProviderId: "",
         synchronizerId: "",
-        userId: "",
+        userId: request.userId ?? "",
     };
 }
 export function mapGrpcCreateParty(payload) {
@@ -37,14 +36,6 @@ export function mapGrpcListParties(payload) {
         nextPageToken: payload.nextPageToken || undefined,
     });
 }
-export function mapGrpcGetParticipantIdRequest(_request) {
-    return {};
-}
-export function mapGrpcGetParticipantId(payload) {
-    return new SdkGetParticipantIdResponse({
-        participantId: payload.participantId ?? "",
-    });
-}
 export function mapGrpcGetPartiesRequest(request) {
     return {
         parties: [...request.parties],

package/dist/transports/json/json-transport.d.ts

@@ -1,18 +1,24 @@
 import { AllocatePartyRequest } from "../../core/types/requests/allocate-party-request.js";
 import { GetActiveContractsRequest } from "../../core/types/requests/get-active-contracts-request.js";
-import { GetParticipantIdRequest } from "../../core/types/requests/get-participant-id-request.js";
+import { GetUserRequest } from "../../core/types/requests/get-user-request.js";
 import { ListKnownPartiesRequest } from "../../core/types/requests/list-known-parties-request.js";
+import { ListPartyToParticipantRequest } from "../../core/types/requests/list-party-to-participant-request.js";
+import { ListUserRightsRequest } from "../../core/types/requests/list-user-rights-request.js";
+import { ListUsersRequest } from "../../core/types/requests/list-users-request.js";
 import { SubmitCommandRequest } from "../../core/types/requests/submit-command-request.js";
 import { AllocatePartyResponse } from "../../core/types/responses/allocate-party-response.js";
+import { GetUserResponse } from "../../core/types/responses/get-user-response.js";
+import { ListPartyToParticipantResponse } from "../../core/types/responses/list-party-to-participant-response.js";
+import { ListUserRightsResponse } from "../../core/types/responses/list-user-rights-response.js";
+import { ListUsersResponse } from "../../core/types/responses/list-users-response.js";
 import type { ListPartiesRequest as TopologyListPartiesRequest, ListPartiesResponse as TopologyListPartiesResponse, ListKeyOwnersRequest, ListKeyOwnersResponse } from "../grpc/generated/canton/com/digitalasset/canton/topology/admin/v30/topology_aggregation_service.js";
 import type { AddTransactionsRequest, AddTransactionsResponse, AuthorizeRequest, AuthorizeResponse, CreateTemporaryTopologyStoreRequest, CreateTemporaryTopologyStoreResponse, DropTemporaryTopologyStoreRequest, DropTemporaryTopologyStoreResponse, GenerateTransactionsRequest, GenerateTransactionsResponse, ImportTopologySnapshotRequest, ImportTopologySnapshotResponse, ImportTopologySnapshotV2Request, ImportTopologySnapshotV2Response, SignTransactionsRequest, SignTransactionsResponse } from "../grpc/generated/canton/com/digitalasset/canton/topology/admin/v30/topology_manager_write_service.js";
 import type { GetContractRequest, GetContractResponse } from "../grpc/generated/canton/com/daml/ledger/api/v2/contract_service.js";
 import type { AddPartyAsyncRequest, AddPartyAsyncResponse, ClearPartyOnboardingFlagRequest, ClearPartyOnboardingFlagResponse, GetHighestOffsetByTimestampRequest, GetHighestOffsetByTimestampResponse } from "../grpc/generated/canton/com/digitalasset/canton/admin/participant/v30/party_management_service.js";
 import type { GetEventsByContractIdRequest, GetEventsByContractIdResponse } from "../grpc/generated/canton/com/daml/ledger/api/v2/event_query_service.js";
 import type { CurrentTimeRequest, CurrentTimeResponse, GetIdRequest, GetIdResponse } from "../grpc/generated/canton/com/digitalasset/canton/topology/admin/v30/initialization_service.js";
-import type { ListAllRequest, ListAllResponse, ListLsuAnnouncementRequest, ListLsuAnnouncementResponse, ListLsuSequencerConnectionSuccessorRequest, ListLsuSequencerConnectionSuccessorResponse, ListMediatorSynchronizerStateRequest, ListMediatorSynchronizerStateResponse, ListSequencingParametersStateRequest, ListSequencingParametersStateResponse, ListSynchronizerParametersStateRequest, ListSynchronizerParametersStateResponse, ListPartyToParticipantRequest, ListPartyToParticipantResponse, ListVettedPackagesRequest as TopologyListVettedPackagesRequest, ListVettedPackagesResponse as TopologyListVettedPackagesResponse, ListPartyHostingLimitsRequest, ListPartyHostingLimitsResponse, ListParticipantSynchronizerPermissionRequest, ListParticipantSynchronizerPermissionResponse, ListSynchronizerTrustCertificateRequest, ListSynchronizerTrustCertificateResponse, ListPartyToKeyMappingRequest, ListPartyToKeyMappingResponse, ListOwnerToKeyMappingRequest, ListOwnerToKeyMappingResponse, ListDecentralizedNamespaceDefinitionRequest, ListDecentralizedNamespaceDefinitionResponse, ListNamespaceDelegationRequest, ListNamespaceDelegationResponse, ListSequencerSynchronizerStateRequest, ListSequencerSynchronizerStateResponse } from "../grpc/generated/canton/com/digitalasset/canton/topology/admin/v30/topology_manager_read_service.js";
-import { GetParticipantIdResponse } from "../../core/types/responses/get-participant-id-response.js";
-import type { GetPartiesRequest, GetPartiesResponse } from "../grpc/generated/canton/com/daml/ledger/api/v2/admin/party_management_service.js";
+import type { ListAllRequest, ListAllResponse, ListLsuAnnouncementRequest, ListLsuAnnouncementResponse, ListLsuSequencerConnectionSuccessorRequest, ListLsuSequencerConnectionSuccessorResponse, ListMediatorSynchronizerStateRequest, ListMediatorSynchronizerStateResponse, ListSequencingParametersStateRequest, ListSequencingParametersStateResponse, ListSynchronizerParametersStateRequest, ListSynchronizerParametersStateResponse, ListVettedPackagesRequest as TopologyListVettedPackagesRequest, ListVettedPackagesResponse as TopologyListVettedPackagesResponse, ListPartyHostingLimitsRequest, ListPartyHostingLimitsResponse, ListParticipantSynchronizerPermissionRequest, ListParticipantSynchronizerPermissionResponse, ListSynchronizerTrustCertificateRequest, ListSynchronizerTrustCertificateResponse, ListPartyToKeyMappingRequest, ListPartyToKeyMappingResponse, ListOwnerToKeyMappingRequest, ListOwnerToKeyMappingResponse, ListDecentralizedNamespaceDefinitionRequest, ListDecentralizedNamespaceDefinitionResponse, ListNamespaceDelegationRequest, ListNamespaceDelegationResponse, ListSequencerSynchronizerStateRequest, ListSequencerSynchronizerStateResponse } from "../grpc/generated/canton/com/digitalasset/canton/topology/admin/v30/topology_manager_read_service.js";
+import type { GetParticipantIdRequest, GetParticipantIdResponse, GetPartiesRequest, GetPartiesResponse } from "../grpc/generated/canton/com/daml/ledger/api/v2/admin/party_management_service.js";
 import type { GetResourceLimitsRequest, GetResourceLimitsResponse } from "../grpc/generated/canton/com/digitalasset/canton/admin/participant/v30/resource_management_service.js";
 import type { GetNoWaitCommitmentsFromRequest, GetNoWaitCommitmentsFromResponse, GetParticipantScheduleRequest as GetParticipantPruningScheduleRequest, GetParticipantScheduleResponse as GetParticipantPruningScheduleResponse, GetScheduleRequest as GetPruningScheduleRequest, GetScheduleResponse as GetPruningScheduleResponse } from "../grpc/generated/canton/com/digitalasset/canton/admin/pruning/v30/pruning.js";
 import type { AllocateExternalPartyRequest, AllocateExternalPartyResponse, GenerateExternalPartyTopologyRequest, GenerateExternalPartyTopologyResponse } from "../grpc/generated/canton/com/daml/ledger/api/v2/admin/party_management_service.js";
@@ -36,7 +42,6 @@ import { ICommandSigner } from "../../core/signing/command-signer.interface.js";
 import { RequestOptions } from "../../core/types/request-options.js";
 import type { ListKnownPackagesRequest, ListKnownPackagesResponse, UploadDarFileRequest } from "../grpc/generated/canton/com/daml/ledger/api/v2/admin/package_management_service.js";
 import { UploadDarFileResponse } from "../grpc/generated/canton/com/daml/ledger/api/v2/admin/package_management_service.js";
-import type { GetUserRequest, GetUserResponse, ListUserRightsRequest, ListUserRightsResponse, ListUsersRequest, ListUsersResponse } from "../grpc/generated/canton/com/daml/ledger/api/v2/admin/user_management_service.js";
 import type { GetCommandStatusRequest, GetCommandStatusResponse } from "../grpc/generated/canton/com/daml/ledger/api/v2/admin/command_inspection_service.js";
 import type { GetActiveContractsPageRequest, GetActiveContractsPageResponse, GetConnectedSynchronizersRequest, GetConnectedSynchronizersResponse, GetLedgerEndRequest, GetLedgerEndResponse, GetLatestPrunedOffsetsRequest, GetLatestPrunedOffsetsResponse } from "../grpc/generated/canton/com/daml/ledger/api/v2/state_service.js";
 import { GetPackageRequest, GetPackageResponse, GetPackageStatusRequest, GetPackageStatusResponse, ListPackagesRequest, ListPackagesResponse, ListVettedPackagesRequest, ListVettedPackagesResponse } from "../grpc/generated/canton/com/daml/ledger/api/v2/package_service.js";

package/dist/transports/json/mappers/commands-mapper.js

@@ -1,4 +1,5 @@
 import { randomUUID } from "node:crypto";
+import { TransportError } from "../../../core/errors/transport-error.js";
 import { ValidationError } from "../../../core/errors/validation-error.js";
 import { CreateAndExerciseCommand } from "../../../core/types/commands/create-and-exercise-command.js";
 import { CreateCommand } from "../../../core/types/commands/create-command.js";
@@ -9,8 +10,11 @@ import { ExerciseByKeyCommand } from "../../../core/types/commands/exercise-by-k
 import { ExerciseCommand } from "../../../core/types/commands/exercise-command.js";
 import { SubmitCommandResponse } from "../../../core/types/responses/submit-command-response.js";
 export function mapJsonSubmitCommandRequest(request) {
+    if (request.deduplicationPeriod !== undefined) {
+        throw new TransportError("command deduplication periods are not supported by the JSON transport");
+    }
     return {
-        commandId: randomUUID(),
+        commandId: request.commandId ?? randomUUID(),
         actAs: request.actAs,
         readAs: request.readAs,
         commands: [mapJsonCommand(request.command)],

package/dist/transports/json/mappers/parties-mapper.d.ts

@@ -13,6 +13,7 @@ export declare function mapJsonCreateParty(payload: {
 }): CreatePartyResponse;
 export declare function mapJsonAllocatePartyRequest(request: AllocatePartyRequest): {
     partyIdHint?: string;
+    userId?: string;
     localMetadata?: {
         attributes: Record<string, string>;
     };

package/dist/transports/json/mappers/parties-mapper.js

@@ -11,6 +11,7 @@ export function mapJsonCreateParty(payload) {
 export function mapJsonAllocatePartyRequest(request) {
     return {
         partyIdHint: request.partyIdHint,
+        userId: request.userId,
         localMetadata: request.displayName === undefined
             ? undefined
             : {

package/node/participant-358-synchronizer.mjs

@@ -0,0 +1,174 @@
+import { createHmac } from "node:crypto";
+import { readFile, writeFile } from "node:fs/promises";
+import { credentials } from "@grpc/grpc-js";
+import { GrpcTransport } from "@protobuf-ts/grpc-transport";
+import { SynchronizerConnectivityServiceClient } from "../dist/transports/grpc/generated/canton/com/digitalasset/canton/admin/participant/v30/synchronizer_connectivity_service.client.js";
+import { ListRegisteredSynchronizersResponse_Status } from "../dist/transports/grpc/generated/canton/com/digitalasset/canton/admin/participant/v30/synchronizer_connectivity_service.js";
+import { SequencerConnectionValidation } from "../dist/transports/grpc/generated/canton/com/digitalasset/canton/admin/sequencer/v30/sequencer_connection.js";
+import { VersionServiceClient } from "../dist/transports/grpc/generated/canton/com/daml/ledger/api/v2/version_service.client.js";
+import { UserManagementServiceClient } from "../dist/transports/grpc/generated/canton/com/daml/ledger/api/v2/admin/user_management_service.client.js";
+import {
+    GrantUserRightsRequest,
+    Right,
+    Right_CanReadAsAnyParty,
+} from "../dist/transports/grpc/generated/canton/com/daml/ledger/api/v2/admin/user_management_service.js";
+
+function getRequiredEnvironment(name) {
+    const value = process.env[name];
+    if (!value) throw new Error(`${name} must be set.`);
+    return value;
+}
+
+function createSharedSecretToken() {
+    const secret = process.env.PARTICIPANT_358_SOURCE_SHARED_SECRET ?? "unsafe";
+    const audience = process.env.PARTICIPANT_358_SOURCE_AUTH_AUDIENCE
+        ?? "https://canton.network.global";
+    const subject = process.env.PARTICIPANT_358_SOURCE_AUTH_SUBJECT
+        ?? "ledger-api-user";
+    const ttlSeconds = Number.parseInt(
+        process.env.PARTICIPANT_358_TOKEN_TTL_SECONDS ?? "300",
+        10,
+    );
+    if (!Number.isSafeInteger(ttlSeconds) || ttlSeconds <= 0) {
+        throw new Error("PARTICIPANT_358_TOKEN_TTL_SECONDS must be a positive integer.");
+    }
+    const issuedAt = Math.floor(Date.now() / 1000);
+    const header = Buffer.from(JSON.stringify({ alg: "HS256", typ: "JWT" })).toString("base64url");
+    const payload = Buffer.from(JSON.stringify({
+        aud: audience,
+        sub: subject,
+        iat: issuedAt,
+        exp: issuedAt + ttlSeconds,
+    })).toString("base64url");
+    const signature = createHmac("sha256", secret)
+        .update(`${header}.${payload}`)
+        .digest("base64url");
+    return `${header}.${payload}.${signature}`;
+}
+
+async function writeLedgerToken() {
+    const targetFile = getRequiredEnvironment("PARTICIPANT_358_LEDGER_TOKEN_FILE");
+    await writeFile(targetFile, `${createSharedSecretToken()}\n`, { mode: 0o600 });
+}
+
+function createClient(endpoint, token) {
+    const transport = new GrpcTransport({
+        host: endpoint.replace(/^https?:\/\//, ""),
+        channelCredentials: credentials.createInsecure(),
+    });
+    const options = token ? { meta: { authorization: `Bearer ${token}` } } : undefined;
+    return { client: new SynchronizerConnectivityServiceClient(transport), options, transport };
+}
+
+function encode(value) {
+    if (value instanceof Uint8Array) return { $bytes: Buffer.from(value).toString("base64") };
+    if (Array.isArray(value)) return value.map(encode);
+    if (value && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value).map(([key, nested]) => [key, encode(nested)]));
+    }
+    return value;
+}
+
+function decode(value) {
+    if (Array.isArray(value)) return value.map(decode);
+    if (value && typeof value === "object") {
+        if (typeof value.$bytes === "string") return Buffer.from(value.$bytes, "base64");
+        return Object.fromEntries(Object.entries(value).map(([key, nested]) => [key, decode(nested)]));
+    }
+    return value;
+}
+
+async function exportSynchronizerConfig() {
+    const targetFile = getRequiredEnvironment("PARTICIPANT_358_SYNCHRONIZER_CONFIG");
+    const sourceEndpoint = getRequiredEnvironment("PARTICIPANT_358_SOURCE_ADMIN_ENDPOINT");
+    const sourceToken = process.env.PARTICIPANT_358_SOURCE_ADMIN_BEARER_TOKEN ?? createSharedSecretToken();
+    const { client, options, transport } = createClient(sourceEndpoint, sourceToken);
+    try {
+        const response = await client.listRegisteredSynchronizers({ allStatuses: false }, options).response;
+        const connected = response.results.filter((result) => result.connected && result.config);
+        if (connected.length !== 1) {
+            throw new Error(`Expected exactly one connected synchronizer from ${sourceEndpoint}; found ${connected.length}. Set PARTICIPANT_358_SOURCE_ADMIN_ENDPOINT to a participant with one connected synchronizer.`);
+        }
+        await writeFile(targetFile, `${JSON.stringify(encode(connected[0].config), null, 2)}\n`, { mode: 0o600 });
+    } finally {
+        transport.close();
+    }
+}
+
+async function connectSynchronizer() {
+    const configFile = getRequiredEnvironment("PARTICIPANT_358_SYNCHRONIZER_CONFIG");
+    const targetEndpoint = getRequiredEnvironment("PARTICIPANT_358_ADMIN_ENDPOINT");
+    const targetToken = process.env.PARTICIPANT_358_ADMIN_BEARER_TOKEN ?? createSharedSecretToken();
+    const config = decode(JSON.parse(await readFile(configFile, "utf8")));
+    const { client, options, transport } = createClient(targetEndpoint, targetToken);
+    try {
+        const connectResponse = await client.connectSynchronizer({
+            config,
+            sequencerConnectionValidation: SequencerConnectionValidation.ALL,
+        }, options).response;
+        if (!connectResponse.connectedSuccessfully) {
+            throw new Error("ConnectSynchronizer completed without a healthy connection.");
+        }
+        const registered = await client.listRegisteredSynchronizers({ allStatuses: false }, options).response;
+        const isHealthy = registered.results.some(
+            (result) => result.connected
+                && result.status === ListRegisteredSynchronizersResponse_Status.ACTIVE
+                && result.config?.synchronizerAlias === config.synchronizerAlias,
+        );
+        if (!isHealthy) throw new Error("Synchronizer did not reach active/connected state.");
+    } finally {
+        transport.close();
+    }
+}
+
+async function readLedgerApiVersion() {
+    const endpoint = getRequiredEnvironment("PARTICIPANT_358_LEDGER_ENDPOINT");
+    const token = process.env.PARTICIPANT_358_LEDGER_BEARER_TOKEN ?? createSharedSecretToken();
+    const { options, transport } = createClient(endpoint, token);
+    try {
+        const response = await new VersionServiceClient(transport)
+            .getLedgerApiVersion({}, options).response;
+        process.stdout.write(`${response.version}\n`);
+    } finally {
+        transport.close();
+    }
+}
+
+async function ensureLedgerUserReadRights() {
+    const endpoint = getRequiredEnvironment("PARTICIPANT_358_LEDGER_ENDPOINT");
+    const token = process.env.PARTICIPANT_358_LEDGER_BEARER_TOKEN ?? createSharedSecretToken();
+    const userId = process.env.PARTICIPANT_358_LEDGER_USER_ID ?? "ledger-api-user";
+    const { options, transport } = createClient(endpoint, token);
+
+    try {
+        const request = GrantUserRightsRequest.create({
+            userId,
+            rights: [Right.create({
+                kind: {
+                    oneofKind: "canReadAsAnyParty",
+                    canReadAsAnyParty: Right_CanReadAsAnyParty.create(),
+                },
+            })],
+        });
+
+        await new UserManagementServiceClient(transport)
+            .grantUserRights(request, options).response;
+    } finally {
+        transport.close();
+    }
+}
+
+const command = process.argv[2];
+if (command === "export") {
+    await exportSynchronizerConfig();
+} else if (command === "connect") {
+    await connectSynchronizer();
+} else if (command === "ledger-api-version") {
+    await readLedgerApiVersion();
+} else if (command === "mint-ledger-token") {
+    await writeLedgerToken();
+} else if (command === "ensure-ledger-user-read-rights") {
+    await ensureLedgerUserReadRights();
+} else {
+    throw new Error("Expected 'export', 'connect', 'ledger-api-version', 'mint-ledger-token', or 'ensure-ledger-user-read-rights'.");
+}

package/node/start-local-participant-358.sh

@@ -0,0 +1,214 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd -- "$SCRIPT_DIR/.." && pwd)"
+RUNTIME_DIR="${PARTICIPANT_358_RUNTIME_DIR:-$REPO_ROOT/.generated/participant-358}"
+PROJECT_NAME="${PARTICIPANT_358_PROJECT_NAME:-canton-participant-358}"
+CANTON_IMAGE="${PARTICIPANT_358_CANTON_IMAGE:-ghcr.io/digital-asset/decentralized-canton-sync/docker/canton:0.6.12}"
+POSTGRES_IMAGE="${PARTICIPANT_358_POSTGRES_IMAGE:-postgres:16}"
+NETWORK_NAME="${PARTICIPANT_358_NETWORK:-quickstart}"
+LEDGER_PORT="${PARTICIPANT_358_LEDGER_PORT:-8901}"
+ADMIN_PORT="${PARTICIPANT_358_ADMIN_PORT:-8902}"
+JSON_PORT="${PARTICIPANT_358_JSON_PORT:-8975}"
+SOURCE_ADMIN_ENDPOINT="${PARTICIPANT_358_SOURCE_ADMIN_ENDPOINT:-localhost:3902}"
+SYNCHRONIZER_CONFIG="$RUNTIME_DIR/registered-synchronizer.json"
+LEDGER_TOKEN_FILE="$RUNTIME_DIR/ledger-api-user.token"
+DOCKER_COMPOSE_CMD=()
+
+print_bearer_token_exports() {
+  local escaped_token_file
+  printf -v escaped_token_file '%q' "$LEDGER_TOKEN_FILE"
+  printf 'export SDK_TEST_LEDGER_BEARER_TOKEN="$(cat %s)"\n' "$escaped_token_file"
+  printf 'export SDK_TEST_LEDGER_ADMIN_BEARER_TOKEN="$(cat %s)"\n' "$escaped_token_file"
+  printf 'export SDK_TEST_PARTICIPANT_ADMIN_BEARER_TOKEN="$(cat %s)"\n' "$escaped_token_file"
+  printf 'export SDK_EXAMPLE_BEARER_TOKEN="$(cat %s)"\n' "$escaped_token_file"
+}
+
+if (( $# > 0 )); then
+  if [[ "$1" != "--refresh-token" || $# -ne 1 ]]; then
+    echo "Usage: $(basename "$0") [--refresh-token]" >&2
+    exit 1
+  elif [[ ! -d "$RUNTIME_DIR" || ! -f "$LEDGER_TOKEN_FILE" ]]; then
+    echo "Participant 3.5.8 runtime token does not exist at $LEDGER_TOKEN_FILE. Start the sidecar first." >&2
+    exit 1
+  fi
+
+  PARTICIPANT_358_LEDGER_TOKEN_FILE="$LEDGER_TOKEN_FILE" \
+    node "$SCRIPT_DIR/participant-358-synchronizer.mjs" mint-ledger-token
+  chmod 600 "$LEDGER_TOKEN_FILE"
+  print_bearer_token_exports
+  exit 0
+fi
+
+resolve_docker_compose_cmd() {
+  if docker compose version >/dev/null 2>&1; then DOCKER_COMPOSE_CMD=(docker compose); return; fi
+  if docker-compose version >/dev/null 2>&1; then DOCKER_COMPOSE_CMD=(docker-compose); return; fi
+  echo "Unable to find a working Docker Compose command." >&2
+  exit 1
+}
+
+validate_port() {
+  local value="$1"
+  [[ "$value" =~ ^[1-9][0-9]{0,4}$ ]] && (( value <= 65535 )) || { echo "Invalid port: $value" >&2; exit 1; }
+}
+
+for port in "$LEDGER_PORT" "$ADMIN_PORT" "$JSON_PORT"; do validate_port "$port"; done
+if [[ "$LEDGER_PORT" == "$ADMIN_PORT" || "$LEDGER_PORT" == "$JSON_PORT" || "$ADMIN_PORT" == "$JSON_PORT" ]]; then
+  echo "Participant 3.5.8 Ledger, Admin, and JSON ports must be distinct." >&2
+  exit 1
+fi
+for normal_port in 3901 3902 3975; do
+  if [[ "$LEDGER_PORT" == "$normal_port" || "$ADMIN_PORT" == "$normal_port" || "$JSON_PORT" == "$normal_port" ]]; then
+    echo "Participant 3.5.8 ports must not collide with CN Quickstart ports." >&2
+    exit 1
+  fi
+done
+
+assert_host_port_available() {
+  local port="$1"
+  if command -v ss >/dev/null 2>&1 && ss -ltn "sport = :$port" | tail -n +2 | grep -q .; then
+    echo "Host port $port is already in use. Set the corresponding PARTICIPANT_358_*_PORT value." >&2
+    exit 1
+  fi
+}
+for port in "$LEDGER_PORT" "$ADMIN_PORT" "$JSON_PORT"; do assert_host_port_available "$port"; done
+
+mkdir -p "$RUNTIME_DIR"
+chmod 700 "$RUNTIME_DIR"
+PARTICIPANT_358_LEDGER_TOKEN_FILE="$LEDGER_TOKEN_FILE" \
+  node "$SCRIPT_DIR/participant-358-synchronizer.mjs" mint-ledger-token
+chmod 600 "$LEDGER_TOKEN_FILE"
+cat > "$RUNTIME_DIR/participant-358.env" <<EOF
+PARTICIPANT_358_SYNCHRONIZER_CONFIG=$SYNCHRONIZER_CONFIG
+PARTICIPANT_358_SOURCE_ADMIN_ENDPOINT=$SOURCE_ADMIN_ENDPOINT
+PARTICIPANT_358_ADMIN_ENDPOINT=localhost:$ADMIN_PORT
+PARTICIPANT_358_LEDGER_TOKEN_FILE=$LEDGER_TOKEN_FILE
+EOF
+chmod 600 "$RUNTIME_DIR/participant-358.env"
+
+cat > "$RUNTIME_DIR/canton.conf" <<EOF
+canton {
+  parameters { manual-start = no }
+  participants.participant358 {
+    storage {
+      type = postgres
+      config {
+        dataSourceClass = "org.postgresql.ds.PGSimpleDataSource"
+        properties {
+          serverName = \${?DB_SERVER}
+          portNumber = 5432
+          databaseName = participant358
+          currentSchema = participant358
+          user = \${?DB_USER}
+          password = \${?DB_PASSWORD}
+        }
+      }
+    }
+    init {
+      generate-topology-transactions-and-keys = true
+      identity.type = auto
+    }
+    admin-api {
+      address = "0.0.0.0"
+      port = 5002
+    }
+    ledger-api {
+      address = "0.0.0.0"
+      port = 5001
+      auth-services = [{
+        type = unsafe-jwt-hmac-256
+        target-audience = "https://canton.network.global"
+        secret = "unsafe"
+      }]
+      user-management-service.additional-admin-user-id = "ledger-api-user"
+    }
+    http-ledger-api {
+      address = "0.0.0.0"
+      port = 7575
+    }
+    monitoring.http-health-server {
+      address = "0.0.0.0"
+      port = 7000
+    }
+  }
+}
+EOF
+
+cat > "$RUNTIME_DIR/compose.yaml" <<EOF
+name: $PROJECT_NAME
+services:
+  postgres:
+    image: $POSTGRES_IMAGE
+    environment:
+      POSTGRES_DB: participant358
+      POSTGRES_USER: participant358
+      POSTGRES_PASSWORD: participant358
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U participant358 -d participant358"]
+      interval: 2s
+      timeout: 3s
+      retries: 30
+  participant358:
+    image: $CANTON_IMAGE
+    depends_on:
+      postgres:
+        condition: service_healthy
+    environment:
+      DB_SERVER: postgres
+      DB_USER: participant358
+      DB_PASSWORD: participant358
+    volumes:
+      - "$RUNTIME_DIR/canton.conf:/app/app.conf:ro"
+    ports:
+      - "127.0.0.1:$LEDGER_PORT:5001"
+      - "127.0.0.1:$ADMIN_PORT:5002"
+      - "127.0.0.1:$JSON_PORT:7575"
+    networks:
+      - default
+      - localnet
+networks:
+  localnet:
+    external: true
+    name: $NETWORK_NAME
+EOF
+
+if [[ "${PARTICIPANT_358_SKIP_SYNCHRONIZER_CONNECT:-0}" != "1" ]]; then
+  PARTICIPANT_358_SYNCHRONIZER_CONFIG="$SYNCHRONIZER_CONFIG" \
+  PARTICIPANT_358_SOURCE_ADMIN_ENDPOINT="$SOURCE_ADMIN_ENDPOINT" \
+  PARTICIPANT_358_SOURCE_ADMIN_BEARER_TOKEN="${PARTICIPANT_358_SOURCE_ADMIN_BEARER_TOKEN:-}" \
+  node "$SCRIPT_DIR/participant-358-synchronizer.mjs" export
+fi
+
+resolve_docker_compose_cmd
+"${DOCKER_COMPOSE_CMD[@]}" --project-name "$PROJECT_NAME" --file "$RUNTIME_DIR/compose.yaml" up -d
+
+if [[ "${PARTICIPANT_358_SKIP_SYNCHRONIZER_CONNECT:-0}" != "1" ]]; then
+  deadline=$((SECONDS + ${PARTICIPANT_358_CONNECT_TIMEOUT_SECONDS:-90}))
+  until PARTICIPANT_358_SYNCHRONIZER_CONFIG="$SYNCHRONIZER_CONFIG" \
+    PARTICIPANT_358_ADMIN_ENDPOINT="localhost:$ADMIN_PORT" \
+    PARTICIPANT_358_ADMIN_BEARER_TOKEN="${PARTICIPANT_358_ADMIN_BEARER_TOKEN:-}" \
+    node "$SCRIPT_DIR/participant-358-synchronizer.mjs" connect
+  do
+    if (( SECONDS >= deadline )); then
+      echo "Participant 3.5.8 sidecar did not become ready. Inspect: ${DOCKER_COMPOSE_CMD[*]} --project-name $PROJECT_NAME --file $RUNTIME_DIR/compose.yaml logs participant358" >&2
+      exit 1
+    fi
+    sleep 2
+  done
+
+  PARTICIPANT_358_LEDGER_ENDPOINT="localhost:$LEDGER_PORT" \
+  PARTICIPANT_358_LEDGER_BEARER_TOKEN="$(cat "$LEDGER_TOKEN_FILE")" \
+    node "$SCRIPT_DIR/participant-358-synchronizer.mjs" ensure-ledger-user-read-rights
+fi
+
+cat <<EOF
+Participant 3.5.8 sidecar is ready.
+export SDK_TEST_LEDGER_ENDPOINT=localhost:$LEDGER_PORT
+export SDK_TEST_LEDGER_ADMIN_ENDPOINT=localhost:$LEDGER_PORT
+export SDK_TEST_PARTICIPANT_ADMIN_ENDPOINT=localhost:$ADMIN_PORT
+export SDK_EXAMPLE_LEDGER_ENDPOINT=localhost:$LEDGER_PORT
+export SDK_EXAMPLE_LEDGER_ADMIN_ENDPOINT=localhost:$LEDGER_PORT
+export SDK_EXAMPLE_PARTICIPANT_ADMIN_ENDPOINT=localhost:$ADMIN_PORT
+EOF
+print_bearer_token_exports

package/node/stop-local-participant-358.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd -- "$SCRIPT_DIR/.." && pwd)"
+RUNTIME_DIR="${PARTICIPANT_358_RUNTIME_DIR:-$REPO_ROOT/.generated/participant-358}"
+PROJECT_NAME="${PARTICIPANT_358_PROJECT_NAME:-canton-participant-358}"
+DOCKER_COMPOSE_CMD=()
+
+if [[ ! -f "$RUNTIME_DIR/compose.yaml" ]]; then
+  echo "Participant 3.5.8 sidecar is not configured. Nothing to stop."
+  exit 0
+fi
+if docker compose version >/dev/null 2>&1; then DOCKER_COMPOSE_CMD=(docker compose); elif docker-compose version >/dev/null 2>&1; then DOCKER_COMPOSE_CMD=(docker-compose); else
+  echo "Unable to find a working Docker Compose command." >&2
+  exit 1
+fi
+"${DOCKER_COMPOSE_CMD[@]}" --project-name "$PROJECT_NAME" --file "$RUNTIME_DIR/compose.yaml" down --volumes --remove-orphans

package/node/test-participant-358-sidecar-smoke.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ "${PARTICIPANT_358_SMOKE_TEST:-0}" != "1" ]]; then
+  echo "Set PARTICIPANT_358_SMOKE_TEST=1 to run this Docker smoke test against an already-running CN Quickstart localnet."
+  exit 0
+fi
+
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd -- "$SCRIPT_DIR/.." && pwd)"
+trap 'bash "$SCRIPT_DIR/stop-local-participant-358.sh"' EXIT
+
+bash "$SCRIPT_DIR/start-local-participant-358.sh"
+version="$(PARTICIPANT_358_LEDGER_ENDPOINT="localhost:${PARTICIPANT_358_LEDGER_PORT:-8901}" node "$SCRIPT_DIR/participant-358-synchronizer.mjs" ledger-api-version)"
+[[ "$version" == 3.5.8* ]] || {
+  echo "Expected Canton 3.5.8 Ledger API response, received: $version" >&2
+  exit 1
+}
+echo "Participant 3.5.8 Ledger API response: $version"