@distrohelena/canton-typescript-sdk 0.1.5 → 0.1.7

package/dist/transports/grpc/mappers/topology-manager-write-mapper.js

@@ -8,7 +8,9 @@ import { ImportTopologySnapshotResponse } from "../../../core/types/responses/im
 import { ImportTopologySnapshotV2Response } from "../../../core/types/responses/import-topology-snapshot-v2-response.js";
 import { SignTopologyTransactionsResponse } from "../../../core/types/responses/sign-topology-transactions-response.js";
 import { GeneratedTopologyTransaction } from "../../../core/types/topology/generated-topology-transaction.js";
+import { DecentralizedNamespaceDefinition } from "../../../core/types/topology/decentralized-namespace-definition.js";
 import { MultiTopologyTransactionSignature } from "../../../core/types/topology/multi-topology-transaction-signature.js";
+import { NamespaceDelegation, NamespaceDelegationRestrictionKind, } from "../../../core/types/topology/namespace-delegation.js";
 import { PartyToParticipant, PartyToParticipantOnboarding, } from "../../../core/types/topology/party-to-participant.js";
 import { SignedTopologyTransaction } from "../../../core/types/topology/signed-topology-transaction.js";
 import { TopologyForceFlag } from "../../../core/types/topology/topology-force-flag.js";
@@ -18,7 +20,7 @@ import { TopologyTransactionSignature } from "../../../core/types/topology/topol
 import { CryptoKeyFormat, SignatureFormat as GrpcSignatureFormat, SigningAlgorithmSpec, SigningKeyScheme, SigningKeySpec, SigningKeyUsage, } from "../generated/canton/com/digitalasset/canton/crypto/v30/crypto.js";
 import { ForceFlag, } from "../generated/canton/com/digitalasset/canton/topology/admin/v30/topology_manager_write_service.js";
 import { Enums_ParticipantPermission, } from "../generated/canton/com/digitalasset/canton/protocol/v30/topology.js";
-import { mapGrpcTopologyChangeOp, mapGrpcTopologyStoreId, } from "./topology-common-mapper.js";
+import { mapGrpcTopologyChangeOp, mapGrpcTopologyMappingCode, mapGrpcTopologyStoreId, } from "./topology-common-mapper.js";
 export function mapGrpcGenerateTopologyTransactionsRequest(request) {
     return {
         proposals: request.proposals.map(mapGrpcGenerateTopologyTransactionsProposal),
@@ -155,8 +157,64 @@ function mapGrpcTopologyMapping(mapping) {
             },
         };
     }
+    else if (mapping instanceof DecentralizedNamespaceDefinition) {
+        return {
+            mapping: {
+                oneofKind: "decentralizedNamespaceDefinition",
+                decentralizedNamespaceDefinition: mapGrpcDecentralizedNamespaceDefinition(mapping),
+            },
+        };
+    }
+    else if (mapping instanceof NamespaceDelegation) {
+        return {
+            mapping: {
+                oneofKind: "namespaceDelegation",
+                namespaceDelegation: mapGrpcNamespaceDelegation(mapping),
+            },
+        };
+    }
     throw new ValidationError(`Unsupported topology write mapping type: ${mapping.constructor.name}.`);
 }
+function mapGrpcDecentralizedNamespaceDefinition(value) {
+    return {
+        decentralizedNamespace: value.decentralizedNamespace,
+        threshold: value.threshold,
+        owners: [...value.owners],
+    };
+}
+function mapGrpcNamespaceDelegation(value) {
+    return {
+        namespace: value.namespace,
+        targetKey: value.targetKey === undefined
+            ? undefined
+            : mapGrpcSigningPublicKey(value.targetKey),
+        isRootDelegation: value.isRootDelegation,
+        restriction: mapGrpcNamespaceDelegationRestriction(value),
+    };
+}
+function mapGrpcNamespaceDelegationRestriction(value) {
+    switch (value.restriction?.kind) {
+        case NamespaceDelegationRestrictionKind.canSignAllMappings:
+            return {
+                oneofKind: "canSignAllMappings",
+                canSignAllMappings: {},
+            };
+        case NamespaceDelegationRestrictionKind.canSignAllButNamespaceDelegations:
+            return {
+                oneofKind: "canSignAllButNamespaceDelegations",
+                canSignAllButNamespaceDelegations: {},
+            };
+        case NamespaceDelegationRestrictionKind.canSignSpecificMappings:
+            return {
+                oneofKind: "canSignSpecificMapings",
+                canSignSpecificMapings: {
+                    mappings: value.restriction.mappings.map(mapGrpcTopologyMappingCode),
+                },
+            };
+        default:
+            return { oneofKind: undefined };
+    }
+}
 function mapGrpcPartyToParticipant(value) {
     return {
         party: value.party,

package/dist/transports/json/mappers/commands-mapper.js

@@ -2,6 +2,8 @@ import { randomUUID } from "node:crypto";
 import { ValidationError } from "../../../core/errors/validation-error.js";
 import { CreateAndExerciseCommand } from "../../../core/types/commands/create-and-exercise-command.js";
 import { CreateCommand } from "../../../core/types/commands/create-command.js";
+import { DamlNumeric } from "../../../core/types/daml-numeric.js";
+import { DamlParty } from "../../../core/types/daml-party.js";
 import { ExerciseByKeyCommand } from "../../../core/types/commands/exercise-by-key-command.js";
 import { ExerciseCommand } from "../../../core/types/commands/exercise-command.js";
 import { SubmitCommandResponse } from "../../../core/types/responses/submit-command-response.js";
@@ -28,7 +30,7 @@ function mapJsonCommand(command) {
         return {
             CreateCommand: {
                 templateId: command.templateId,
-                createArguments: command.payload,
+                createArguments: mapJsonValue(command.payload),
             },
         };
     }
@@ -38,7 +40,7 @@ function mapJsonCommand(command) {
                 templateId: command.templateId,
                 contractId: command.contractId,
                 choice: command.choice,
-                choiceArgument: command.argument,
+                choiceArgument: mapJsonValue(command.argument),
             },
         };
     }
@@ -46,9 +48,9 @@ function mapJsonCommand(command) {
         return {
             ExerciseByKeyCommand: {
                 templateId: command.templateId,
-                contractKey: command.contractKey,
+                contractKey: mapJsonValue(command.contractKey),
                 choice: command.choice,
-                choiceArgument: command.argument,
+                choiceArgument: mapJsonValue(command.argument),
             },
         };
     }
@@ -56,11 +58,23 @@ function mapJsonCommand(command) {
         return {
             CreateAndExerciseCommand: {
                 templateId: command.templateId,
-                createArguments: command.payload,
+                createArguments: mapJsonValue(command.payload),
                 choice: command.choice,
-                choiceArgument: command.argument,
+                choiceArgument: mapJsonValue(command.argument),
             },
         };
     }
     throw new ValidationError("unsupported submit command type");
 }
+function mapJsonValue(value) {
+    if (value instanceof DamlParty || value instanceof DamlNumeric) {
+        return value.value;
+    }
+    else if (Array.isArray(value)) {
+        return value.map(mapJsonValue);
+    }
+    else if (value !== null && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, mapJsonValue(item)]));
+    }
+    return value;
+}

package/node/.generated/start-local/additional-config.extra-participants.conf

@@ -0,0 +1,37 @@
+canton.participants.extra-1 = $${_participant} {
+  storage.config.properties.databaseName = "participant-extra-1"
+  init {
+    generate-topology-transactions-and-keys = true
+    identity.type = auto
+  }
+  monitoring {
+    http-health-server.port = ${EXTRA_PARTICIPANT_1_HTTP_HEALTHCHECK_PORT}
+    grpc-health-server.port = ${EXTRA_PARTICIPANT_1_GRPC_HEALTHCHECK_PORT}
+  }
+  http-ledger-api.port = ${EXTRA_PARTICIPANT_1_JSON_API_PORT}
+  admin-api.port = ${EXTRA_PARTICIPANT_1_ADMIN_API_PORT}
+  ledger-api.port = ${EXTRA_PARTICIPANT_1_LEDGER_API_PORT}
+  ledger-api {
+    auth-services = [{
+      type = unsafe-jwt-hmac-256
+      target-audience = "${EXTRA_VALIDATOR_1_AUTH_AUDIENCE}"
+      secret = "unsafe"
+    }]
+
+    user-management-service.additional-admin-user-id = "${EXTRA_VALIDATOR_1_USER_NAME}"
+  }
+}
+
+canton.participants.extra-1.ledger-api.auth-services = [
+  {
+    type = unsafe-jwt-hmac-256
+    target-audience = "https://canton.network.global"
+    secret = "unsafe"
+  },
+  {
+    type = jwt-es-256-crt
+    certificate = "/app/es256-certificate.pem"
+    target-audience = "https://canton.network.global/es256"
+  }
+]
+

package/node/.generated/start-local/additional-config.extra-validators.conf

@@ -0,0 +1,35 @@
+canton.validator-apps.extra-1-validator_backend = $${_validator_backend} {
+  onboarding.secret = "${EXTRA_VALIDATOR_1_ONBOARDING_SECRET}"
+  domain-migration-dump-path = "/domain-upgrade-dump/domain_migration_dump-extra-1.json"
+  storage.config.properties.databaseName = "${EXTRA_VALIDATOR_1_DB}"
+  admin-api.port = ${EXTRA_VALIDATOR_1_ADMIN_API_PORT}
+  canton-identifier-config.participant = extra-1
+  participant-client {
+    admin-api.port = ${EXTRA_PARTICIPANT_1_ADMIN_API_PORT}
+    ledger-api {
+      client-config.port = ${EXTRA_PARTICIPANT_1_LEDGER_API_PORT}
+      auth-config = {
+        type = "self-signed"
+        user = "${EXTRA_VALIDATOR_1_USER_NAME}"
+        audience = "${EXTRA_VALIDATOR_1_AUTH_AUDIENCE}"
+        secret = "unsafe"
+      }
+    }
+  }
+  auth = {
+    algorithm = "hs-256-unsafe"
+    audience = "${EXTRA_VALIDATOR_1_AUTH_AUDIENCE}"
+    secret = "unsafe"
+  }
+  ledger-api-user = "${EXTRA_VALIDATOR_1_USER_NAME}"
+  validator-wallet-users.0 = "${EXTRA_VALIDATOR_1_WALLET_ADMIN_USER_NAME}"
+  validator-party-hint = "${EXTRA_VALIDATOR_1_PARTY_HINT}"
+
+  domains.global.buy-extra-traffic {
+    min-topup-interval = ${?MIN_TRAFFIC_TOPUP_INTERVAL}
+    target-throughput = ${?TARGET_TRAFFIC_THROUGHPUT}
+  }
+}
+
+canton.sv-apps.sv.expected-validator-onboardings += { secret = "${EXTRA_VALIDATOR_1_ONBOARDING_SECRET}" }
+

package/node/.generated/start-local/compose-extra-participants.yaml

@@ -0,0 +1,147 @@
+volumes:
+  postgres-pqs-extra-1:
+
+services:
+  postgres:
+    env_file:
+      - ${START_LOCAL_GENERATED_DIR}/extra-participants.env
+  canton:
+    env_file:
+      - ${START_LOCAL_GENERATED_DIR}/extra-participants.env
+    environment:
+      ADDITIONAL_CONFIG_EXTRA_PARTICIPANTS: |
+        canton.participants.extra-1 = $${_participant} {
+          storage.config.properties.databaseName = "participant-extra-1"
+          init {
+            generate-topology-transactions-and-keys = true
+            identity.type = auto
+          }
+          monitoring {
+            http-health-server.port = ${EXTRA_PARTICIPANT_1_HTTP_HEALTHCHECK_PORT}
+            grpc-health-server.port = ${EXTRA_PARTICIPANT_1_GRPC_HEALTHCHECK_PORT}
+          }
+          http-ledger-api.port = ${EXTRA_PARTICIPANT_1_JSON_API_PORT}
+          admin-api.port = ${EXTRA_PARTICIPANT_1_ADMIN_API_PORT}
+          ledger-api.port = ${EXTRA_PARTICIPANT_1_LEDGER_API_PORT}
+          ledger-api {
+            auth-services = [{
+              type = unsafe-jwt-hmac-256
+              target-audience = "${EXTRA_VALIDATOR_1_AUTH_AUDIENCE}"
+              secret = "unsafe"
+            }]
+        
+            user-management-service.additional-admin-user-id = "${EXTRA_VALIDATOR_1_USER_NAME}"
+          }
+        }
+        
+        canton.participants.extra-1.ledger-api.auth-services = [
+          {
+            type = unsafe-jwt-hmac-256
+            target-audience = "https://canton.network.global"
+            secret = "unsafe"
+          },
+          {
+            type = jwt-es-256-crt
+            certificate = "/app/es256-certificate.pem"
+            target-audience = "https://canton.network.global/es256"
+          }
+        ]
+        
+    ports:
+      - "${EXTRA_PARTICIPANT_1_LEDGER_API_PUBLISHED_PORT}:${EXTRA_PARTICIPANT_1_LEDGER_API_PORT}"
+      - "${EXTRA_PARTICIPANT_1_ADMIN_API_PUBLISHED_PORT}:${EXTRA_PARTICIPANT_1_ADMIN_API_PORT}"
+      - "${EXTRA_PARTICIPANT_1_JSON_API_PUBLISHED_PORT}:${EXTRA_PARTICIPANT_1_JSON_API_PORT}"
+  splice:
+    env_file:
+      - ${START_LOCAL_GENERATED_DIR}/extra-participants.env
+    environment:
+      ADDITIONAL_CONFIG_EXTRA_VALIDATORS: |
+        canton.validator-apps.extra-1-validator_backend = $${_validator_backend} {
+          onboarding.secret = "${EXTRA_VALIDATOR_1_ONBOARDING_SECRET}"
+          domain-migration-dump-path = "/domain-upgrade-dump/domain_migration_dump-extra-1.json"
+          storage.config.properties.databaseName = "${EXTRA_VALIDATOR_1_DB}"
+          admin-api.port = ${EXTRA_VALIDATOR_1_ADMIN_API_PORT}
+          canton-identifier-config.participant = extra-1
+          participant-client {
+            admin-api.port = ${EXTRA_PARTICIPANT_1_ADMIN_API_PORT}
+            ledger-api {
+              client-config.port = ${EXTRA_PARTICIPANT_1_LEDGER_API_PORT}
+              auth-config = {
+                type = "self-signed"
+                user = "${EXTRA_VALIDATOR_1_USER_NAME}"
+                audience = "${EXTRA_VALIDATOR_1_AUTH_AUDIENCE}"
+                secret = "unsafe"
+              }
+            }
+          }
+          auth = {
+            algorithm = "hs-256-unsafe"
+            audience = "${EXTRA_VALIDATOR_1_AUTH_AUDIENCE}"
+            secret = "unsafe"
+          }
+          ledger-api-user = "${EXTRA_VALIDATOR_1_USER_NAME}"
+          validator-wallet-users.0 = "${EXTRA_VALIDATOR_1_WALLET_ADMIN_USER_NAME}"
+          validator-party-hint = "${EXTRA_VALIDATOR_1_PARTY_HINT}"
+        
+          domains.global.buy-extra-traffic {
+            min-topup-interval = $${?MIN_TRAFFIC_TOPUP_INTERVAL}
+            target-throughput = $${?TARGET_TRAFFIC_THROUGHPUT}
+          }
+        }
+        
+        canton.sv-apps.sv.expected-validator-onboardings += { secret = "${EXTRA_VALIDATOR_1_ONBOARDING_SECRET}" }
+        
+    ports:
+      - "${EXTRA_VALIDATOR_1_ADMIN_API_PUBLISHED_PORT}:${EXTRA_VALIDATOR_1_ADMIN_API_PORT}"
+  postgres-pqs-extra-1:
+    image: "postgres:${POSTGRES_VERSION}"
+    container_name: postgres-pqs-extra-1
+    volumes:
+      - postgres-pqs-extra-1:/var/lib/postgresql/data
+      - ${LOCALNET_DIR}/docker/postgres/postgres-entrypoint.sh:/postgres-entrypoint.sh
+    environment:
+      POSTGRES_USER: ${DB_USER}
+      POSTGRES_PASSWORD: ${DB_PASSWORD}
+      POSTGRES_DB: postgres
+      CREATE_DATABASE_EXTRA_PQS_1: ${EXTRA_PQS_1_POSTGRES_DB}
+    ports:
+      - "${EXTRA_PQS_1_POSTGRES_PUBLISHED_PORT}:5432"
+    entrypoint: /postgres-entrypoint.sh
+    healthcheck:
+      test: "pg_isready -U ${DB_USER} -d postgres"
+      interval: 10s
+      timeout: 3s
+      retries: 3
+      start_period: 30s
+    user: "postgres"
+    command:
+      - postgres
+      - -c
+      - max_connections=1000
+  pqs-extra-1:
+    image: ${SCRIBE_IMAGE}:${SCRIBE_VERSION}
+    container_name: pqs-extra-1
+    environment:
+      SCRIBE_SOURCE_LEDGER_HOST: canton
+      SCRIBE_SOURCE_LEDGER_PORT: ${EXTRA_PARTICIPANT_1_LEDGER_API_PORT}
+      SCRIBE_SOURCE_LEDGER_AUTH: OAuth
+      SCRIBE_TARGET_POSTGRES_HOST: postgres-pqs-extra-1
+      SCRIBE_TARGET_POSTGRES_PORT: 5432
+      SCRIBE_TARGET_POSTGRES_DATABASE: ${EXTRA_PQS_1_POSTGRES_DB}
+      SCRIBE_TARGET_POSTGRES_USERNAME: ${DB_USER}
+      SCRIBE_TARGET_POSTGRES_PASSWORD: ${DB_PASSWORD}
+      SCRIBE_CONFIG: /onboarding/extra-1-pqs.conf
+    volumes:
+      - onboarding:/onboarding
+    command:
+      - pipeline
+      - ledger
+      - postgres-document
+    depends_on:
+      canton:
+        condition: service_healthy
+      splice-onboarding:
+        condition: service_healthy
+      postgres-pqs-extra-1:
+        condition: service_healthy
+    restart: on-failure:100

package/node/.generated/start-local/extra-participants.env

@@ -0,0 +1,30 @@
+START_LOCAL_GENERATED_DIR=/home/helena/env/daml/typescript-sdk/node/.generated/start-local
+CREATE_DATABASE_EXTRA_1=participant-extra-1
+CREATE_DATABASE_EXTRA_VALIDATOR_1=validator-extra-1
+CREATE_DATABASE_EXTRA_PQS_1=pqs-extra-1
+EXTRA_PARTICIPANT_1_NAME=extra-1
+EXTRA_PARTICIPANT_1_DB=participant-extra-1
+EXTRA_PARTICIPANT_1_PARTY_HINT=extra_1_quickstart-helena-1
+EXTRA_PARTICIPANT_1_LEDGER_API_PORT=5901
+EXTRA_PARTICIPANT_1_ADMIN_API_PORT=5902
+EXTRA_PARTICIPANT_1_JSON_API_PORT=5975
+EXTRA_PARTICIPANT_1_HTTP_HEALTHCHECK_PORT=5900
+EXTRA_PARTICIPANT_1_GRPC_HEALTHCHECK_PORT=5961
+EXTRA_PARTICIPANT_1_LEDGER_API_PUBLISHED_PORT=5901
+EXTRA_PARTICIPANT_1_ADMIN_API_PUBLISHED_PORT=5902
+EXTRA_PARTICIPANT_1_JSON_API_PUBLISHED_PORT=5975
+EXTRA_VALIDATOR_1_DB=validator-extra-1
+EXTRA_VALIDATOR_1_PARTY_HINT=validator_1_quickstart-helena-1
+EXTRA_VALIDATOR_1_ONBOARDING_SECRET=extra-1-validator-onboarding-secret
+EXTRA_VALIDATOR_1_ADMIN_API_PORT=5903
+EXTRA_VALIDATOR_1_ADMIN_API_PUBLISHED_PORT=5903
+EXTRA_VALIDATOR_1_USER_NAME=ledger-api-user
+EXTRA_VALIDATOR_1_WALLET_ADMIN_USER_NAME=extra-1
+EXTRA_VALIDATOR_1_AUTH_AUDIENCE=https://canton.network.global
+EXTRA_VALIDATOR_1_AUTH_MODE=shared-secret
+EXTRA_PQS_1_NAME=pqs-extra-1
+EXTRA_PQS_1_USER_NAME=extra-1-pqs-user
+EXTRA_PQS_1_POSTGRES_NAME=postgres-pqs-extra-1
+EXTRA_PQS_1_POSTGRES_DB=pqs-extra-1
+EXTRA_PQS_1_POSTGRES_PUBLISHED_PORT=5541
+EXTRA_PQS_1_CONFIG_FILE=extra-1-pqs.conf

package/node/es256-jwt.mjs

@@ -0,0 +1,177 @@
+import {
+    createHash,
+    createPrivateKey,
+    createPublicKey,
+    generateKeyPairSync,
+    sign,
+} from "node:crypto";
+import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const maximumTtlSeconds = 600;
+
+function encodeJson(value) {
+    return Buffer.from(JSON.stringify(value)).toString("base64url");
+}
+
+function getKid(jwk) {
+    const thumbprint = JSON.stringify({
+        crv: jwk.crv,
+        kty: jwk.kty,
+        x: jwk.x,
+        y: jwk.y,
+    });
+
+    return createHash("sha256").update(thumbprint).digest("base64url");
+}
+
+function toPublicJwk(publicKey) {
+    const jwk = publicKey.export({ format: "jwk" });
+
+    if (jwk.kty !== "EC" || jwk.crv !== "P-256" || !jwk.x || !jwk.y) {
+        throw new Error("Expected a P-256 public key.");
+    }
+
+    return {
+        alg: "ES256",
+        crv: jwk.crv,
+        kid: getKid(jwk),
+        kty: jwk.kty,
+        use: "sig",
+        x: jwk.x,
+        y: jwk.y,
+    };
+}
+
+async function writePrivateFileAsync(path, content) {
+    await writeFile(path, content, { mode: 0o600 });
+    await chmod(path, 0o600);
+}
+
+async function writePublicFileAsync(path, content) {
+    await writeFile(path, content, { mode: 0o644 });
+    await chmod(path, 0o644);
+}
+
+export async function generateKeyMaterialAsync(runtimeDirectory) {
+    await mkdir(runtimeDirectory, { recursive: true });
+
+    const { privateKey, publicKey } = generateKeyPairSync("ec", {
+        namedCurve: "prime256v1",
+    });
+    const jwk = toPublicJwk(publicKey);
+    const privateKeyPath = join(runtimeDirectory, "es256-private-key.pem");
+    const jwksPath = join(runtimeDirectory, "jwks.json");
+
+    await writePrivateFileAsync(
+        privateKeyPath,
+        privateKey.export({ format: "pem", type: "pkcs8" }),
+    );
+    await writePublicFileAsync(jwksPath, `${JSON.stringify({ keys: [jwk] })}\n`);
+
+    return { jwk, jwks: { keys: [jwk] }, jwksPath, privateKeyPath };
+}
+
+export async function mintTokenAsync({
+    audience,
+    privateKeyPath,
+    subject,
+    ttlSeconds,
+}) {
+    if (!Number.isInteger(ttlSeconds) || ttlSeconds < 1 || ttlSeconds > maximumTtlSeconds) {
+        throw new Error(`TTL must be an integer between 1 and ${maximumTtlSeconds} seconds.`);
+    }
+
+    const privateKey = createPrivateKey(await readFile(privateKeyPath));
+    const jwk = toPublicJwk(createPublicKey(privateKey));
+    const issuedAt = Math.floor(Date.now() / 1000);
+    const encodedHeader = encodeJson({ alg: "ES256", kid: jwk.kid, typ: "JWT" });
+    const encodedPayload = encodeJson({
+        aud: audience,
+        exp: issuedAt + ttlSeconds,
+        iat: issuedAt,
+        nbf: issuedAt,
+        scope: "daml_ledger_api",
+        sub: subject,
+    });
+    const signingInput = `${encodedHeader}.${encodedPayload}`;
+    const signature = sign("sha256", Buffer.from(signingInput), {
+        dsaEncoding: "ieee-p1363",
+        key: privateKey,
+    });
+
+    return `${signingInput}.${signature.toString("base64url")}`;
+}
+
+export async function validateSuppliedKeyAsync({ jwks, privateKeyPath }) {
+    const privateKey = createPrivateKey(await readFile(privateKeyPath));
+    const expectedJwk = toPublicJwk(createPublicKey(privateKey));
+    const matches = jwks.keys.some(
+        (jwk) =>
+            jwk.kid === expectedJwk.kid &&
+            jwk.kty === expectedJwk.kty &&
+            jwk.crv === expectedJwk.crv &&
+            jwk.x === expectedJwk.x &&
+            jwk.y === expectedJwk.y,
+    );
+
+    if (!matches) {
+        throw new Error("Supplied JWKS does not contain a matching P-256 public key.");
+    }
+}
+
+function getArgument(argumentsList, name) {
+    const index = argumentsList.indexOf(name);
+
+    if (index < 0 || argumentsList[index + 1] === undefined) {
+        throw new Error(`Missing ${name}.`);
+    }
+
+    return argumentsList[index + 1];
+}
+
+async function mainAsync() {
+    const [command, ...argumentsList] = process.argv.slice(2);
+
+    if (command === "init") {
+        const material = await generateKeyMaterialAsync(
+            getArgument(argumentsList, "--runtime-dir"),
+        );
+        process.stdout.write(`${JSON.stringify(material)}\n`);
+        return;
+    }
+
+    if (command === "mint") {
+        const token = await mintTokenAsync({
+            audience: getArgument(argumentsList, "--audience"),
+            privateKeyPath: getArgument(argumentsList, "--private-key-path"),
+            subject: getArgument(argumentsList, "--subject"),
+            ttlSeconds: Number.parseInt(getArgument(argumentsList, "--ttl-seconds"), 10),
+        });
+        process.stdout.write(`${token}\n`);
+        return;
+    }
+
+    if (command === "validate-supplied") {
+        const jwks = JSON.parse(
+            await readFile(getArgument(argumentsList, "--jwks-path"), "utf8"),
+        );
+        await validateSuppliedKeyAsync({
+            jwks,
+            privateKeyPath: getArgument(argumentsList, "--private-key-path"),
+        });
+        return;
+    }
+
+    throw new Error("Expected 'init', 'mint', or 'validate-supplied'.");
+}
+
+const scriptPath = fileURLToPath(import.meta.url);
+
+if (process.argv[1] === scriptPath) {
+    mainAsync().catch((error) => {
+        process.stderr.write(`${error.message}\n`);
+        process.exitCode = 1;
+    });
+}