@eventsdk/sdk 0.0.0-stage → 0.3.1

package/dist/identity-verifier/origin/event-origin-policy.d.ts

@@ -0,0 +1,36 @@
+import type { JSONWebKeySet } from 'jose';
+import { type CloudEvent } from '@eventsdk/sdk/contracts';
+import type { VerifiedOrigin } from '@eventsdk/sdk/identity-contracts';
+export type EventOriginAlgorithm = 'RS256' | 'PS256' | 'ES256' | 'EdDSA';
+export interface EventOriginBinding {
+    readonly issuer: string;
+    readonly subject: string;
+    readonly serviceRef: string;
+    readonly source: string;
+    readonly keysValidUntil: string;
+    readonly verificationTtlMs?: number;
+    readonly clock: () => Date;
+}
+export interface EventOriginSignerPolicy extends EventOriginBinding {
+    readonly keyId: string;
+    readonly algorithm: EventOriginAlgorithm;
+    readonly privateKeyPkcs8: string;
+    readonly audiences: readonly string[];
+}
+export interface EventOriginVerifierPolicy extends EventOriginBinding {
+    readonly audience: string;
+    readonly algorithms: readonly EventOriginAlgorithm[];
+    readonly jwks: JSONWebKeySet;
+}
+export declare class EventOriginError extends Error {
+    readonly code: 'INVALID_ORIGIN_POLICY' | 'ORIGIN_PROOF_REJECTED' | 'TRUST_SNAPSHOT_EXPIRED' | 'ORIGIN_PROOF_NOT_YET_VALID';
+    constructor(code: 'INVALID_ORIGIN_POLICY' | 'ORIGIN_PROOF_REJECTED' | 'TRUST_SNAPSHOT_EXPIRED' | 'ORIGIN_PROOF_NOT_YET_VALID');
+}
+export declare const eventOriginTyp = "eventsdk-origin+jws";
+export declare const originAlgorithms: readonly string[];
+export declare function validateOriginBinding(policy: EventOriginBinding): void;
+export declare function validatePublicOriginKeys(jwks: JSONWebKeySet): void;
+export declare function ref(value: unknown): value is string;
+export declare function assertCurrentOriginTrust(policy: EventOriginBinding, now: Date): void;
+export declare function assertOriginEvent(policy: EventOriginBinding, event: CloudEvent): void;
+export declare function freshEventOrigin(policy: EventOriginBinding, audience: string): VerifiedOrigin;

package/dist/identity-verifier/origin/event-origin-signer.d.ts

@@ -0,0 +1,6 @@
+import { type CloudEvent } from '@eventsdk/sdk/contracts';
+import { type EventOriginSignerPolicy } from './event-origin-policy.js';
+export declare function createEventOriginSigner(input: EventOriginSignerPolicy): Promise<{
+    currentOrigin: (audience: string) => import("@eventsdk/sdk/identity-contracts").VerifiedOrigin;
+    sign(raw: CloudEvent, signal: AbortSignal): Promise<string>;
+}>;

package/dist/identity-verifier/origin/event-origin-verifier.d.ts

@@ -0,0 +1,6 @@
+import { type CloudEvent } from '@eventsdk/sdk/contracts';
+import type { OriginVerification } from '@eventsdk/sdk/identity-contracts';
+import { type EventOriginVerifierPolicy } from './event-origin-policy.js';
+export declare function createEventOriginVerifier(input: EventOriginVerifierPolicy): {
+    verify(eventInput: CloudEvent, proof: string, signal: AbortSignal): Promise<OriginVerification>;
+};

package/dist/index.d.ts

@@ -0,0 +1,22 @@
+export * from './contracts/index.js';
+export * as contracts from './contracts/index.js';
+export * from './identity-contracts/index.js';
+export * as identityContracts from './identity-contracts/index.js';
+export * from './core/index.js';
+export * as core from './core/index.js';
+export * from './transport-nats/index.js';
+export * as transportNats from './transport-nats/index.js';
+export * from './identity-verifier/index.js';
+export * as identityVerifier from './identity-verifier/index.js';
+export * from './compatibility-http/index.js';
+export * as compatibilityHttp from './compatibility-http/index.js';
+export * from './provisioner/index.js';
+export * as provisioner from './provisioner/index.js';
+export * from './conformance/index.js';
+export * as conformance from './conformance/index.js';
+export * from './node-config/index.js';
+export * as nodeConfig from './node-config/index.js';
+export * from './node-worker/index.js';
+export * as nodeWorker from './node-worker/index.js';
+export type { ResultReadRequest } from './core/index.js';
+export type { ResultReadRequest as IdentityResultReadRequest } from './identity-contracts/index.js';

package/dist/index.js

@@ -0,0 +1,20 @@
+export * from './contracts/index.js';
+export * as contracts from './contracts/index.js';
+export * from './identity-contracts/index.js';
+export * as identityContracts from './identity-contracts/index.js';
+export * from './core/index.js';
+export * as core from './core/index.js';
+export * from './transport-nats/index.js';
+export * as transportNats from './transport-nats/index.js';
+export * from './identity-verifier/index.js';
+export * as identityVerifier from './identity-verifier/index.js';
+export * from './compatibility-http/index.js';
+export * as compatibilityHttp from './compatibility-http/index.js';
+export * from './provisioner/index.js';
+export * as provisioner from './provisioner/index.js';
+export * from './conformance/index.js';
+export * as conformance from './conformance/index.js';
+export * from './node-config/index.js';
+export * as nodeConfig from './node-config/index.js';
+export * from './node-worker/index.js';
+export * as nodeWorker from './node-worker/index.js';

package/dist/node-config/configuration-error.d.ts

@@ -0,0 +1,4 @@
+export declare class EventSdkConfigurationError extends Error {
+    readonly code: string;
+    constructor(code: string);
+}

package/dist/node-config/diagnostics/check-configuration.d.ts

@@ -0,0 +1,40 @@
+export declare function checkNodeConnectionConfiguration(file: string | undefined, expectedServiceRef?: string, checkFiles?: boolean): Promise<{
+    status: "DISABLED";
+    configured: boolean;
+    connected: false;
+    serviceRef?: never;
+    mode?: never;
+    revision?: never;
+    roles?: never;
+    originProof?: never;
+    trustedSources?: never;
+    filesChecked?: never;
+    code?: never;
+} | {
+    status: "DISABLED" | "ASSETS_VALID" | "PROFILE_VALID";
+    configured: boolean;
+    connected: false;
+    serviceRef: string;
+    mode: "DISABLED" | "SHADOW" | "ACTIVE";
+    revision: string;
+    roles: {
+        publisher: boolean;
+        consumer: boolean;
+    };
+    originProof: "eventsdk-origin/1";
+    trustedSources: number;
+    filesChecked: boolean;
+    code?: never;
+} | {
+    status: "INVALID";
+    configured: boolean;
+    connected: false;
+    code: string;
+    serviceRef?: never;
+    mode?: never;
+    revision?: never;
+    roles?: never;
+    originProof?: never;
+    trustedSources?: never;
+    filesChecked?: never;
+}>;

package/dist/node-config/identity/load-identity.d.ts

@@ -0,0 +1,14 @@
+import type { LoadedNodeProfile } from '../profile/load-profile.js';
+export declare function loadNodeConnectionIdentity(loaded: LoadedNodeProfile, clock?: () => Date, inspectionOnly?: boolean): Promise<Readonly<{
+    profile: import("@eventsdk/sdk/contracts").NodeConnectionProfile;
+    revision: string;
+    signer: {
+        currentOrigin: (audience: string) => import("@eventsdk/sdk/identity-contracts").VerifiedOrigin;
+        sign(raw: import("@eventsdk/sdk/contracts").CloudEvent, signal: AbortSignal): Promise<string>;
+    } | null;
+    verifyOrigin: (event: import("@eventsdk/sdk/contracts").CloudEvent, proof: string, signal: AbortSignal) => Promise<import("@eventsdk/sdk/identity-contracts").OriginVerification>;
+    withBrokerCredentials<T>(run: (value: {
+        credential: Uint8Array;
+        ca?: string;
+    }) => Promise<T>): Promise<T>;
+}>>;

package/dist/node-config/identity/local-recovery-origin.d.ts

@@ -0,0 +1,3 @@
+import type { CloudEvent } from '@eventsdk/sdk/contracts';
+import type { VerifiedOrigin } from '@eventsdk/sdk/identity-contracts';
+export declare function loadNodeLocalRecoveryOrigin(file: string, serviceRef: string, event: CloudEvent): Promise<VerifiedOrigin>;

package/dist/node-config/identity/public-identity.d.ts

@@ -0,0 +1,87 @@
+export declare function loadNodePublicIdentity(file: string | undefined, expectedServiceRef: string, now?: number): Promise<{
+    schemaVersion: 1;
+    profile: "eventsdk-origin/1";
+    serviceRef: string;
+    source: string;
+    issuer: string;
+    subject: string;
+    jwksUri: string;
+    validUntil: string;
+    jwks: {
+        keys: [({
+            kty: "RSA";
+            kid: string;
+            alg?: "RS256" | "PS256";
+            use?: "sig";
+            key_ops?: ["verify"];
+            ext?: boolean;
+            x5c?: [] | [string] | [string, string] | [string, string, string] | [string, string, string, string] | [string, string, string, string, string] | [string, string, string, string, string, string] | [string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string];
+            x5t?: string;
+            "x5t#S256"?: string;
+            n: string;
+            e: string;
+        } | {
+            kty: "EC";
+            kid: string;
+            alg?: "ES256";
+            use?: "sig";
+            key_ops?: ["verify"];
+            ext?: boolean;
+            x5c?: [] | [string] | [string, string] | [string, string, string] | [string, string, string, string] | [string, string, string, string, string] | [string, string, string, string, string, string] | [string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string];
+            x5t?: string;
+            "x5t#S256"?: string;
+            crv: "P-256";
+            x: string;
+            y: string;
+        } | {
+            kty: "OKP";
+            kid: string;
+            alg?: "EdDSA";
+            use?: "sig";
+            key_ops?: ["verify"];
+            ext?: boolean;
+            x5c?: [] | [string] | [string, string] | [string, string, string] | [string, string, string, string] | [string, string, string, string, string] | [string, string, string, string, string, string] | [string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string];
+            x5t?: string;
+            "x5t#S256"?: string;
+            crv: "Ed25519";
+            x: string;
+        }), ...({
+            kty: "RSA";
+            kid: string;
+            alg?: "RS256" | "PS256";
+            use?: "sig";
+            key_ops?: ["verify"];
+            ext?: boolean;
+            x5c?: [] | [string] | [string, string] | [string, string, string] | [string, string, string, string] | [string, string, string, string, string] | [string, string, string, string, string, string] | [string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string];
+            x5t?: string;
+            "x5t#S256"?: string;
+            n: string;
+            e: string;
+        } | {
+            kty: "EC";
+            kid: string;
+            alg?: "ES256";
+            use?: "sig";
+            key_ops?: ["verify"];
+            ext?: boolean;
+            x5c?: [] | [string] | [string, string] | [string, string, string] | [string, string, string, string] | [string, string, string, string, string] | [string, string, string, string, string, string] | [string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string];
+            x5t?: string;
+            "x5t#S256"?: string;
+            crv: "P-256";
+            x: string;
+            y: string;
+        } | {
+            kty: "OKP";
+            kid: string;
+            alg?: "EdDSA";
+            use?: "sig";
+            key_ops?: ["verify"];
+            ext?: boolean;
+            x5c?: [] | [string] | [string, string] | [string, string, string] | [string, string, string, string] | [string, string, string, string, string] | [string, string, string, string, string, string] | [string, string, string, string, string, string, string] | [string, string, string, string, string, string, string, string];
+            x5t?: string;
+            "x5t#S256"?: string;
+            crv: "Ed25519";
+            x: string;
+        })[]];
+    };
+} | null>;

package/dist/node-config/identity/public-snapshot.d.ts

@@ -0,0 +1,2 @@
+import { type PublicJwksSnapshot } from '@eventsdk/sdk/contracts';
+export declare function loadPublicTrustSnapshot(file: string, issuer: string, jwksUri?: string, now?: number): Promise<PublicJwksSnapshot>;

package/dist/node-config/identity/signing-identity.d.ts

@@ -0,0 +1,5 @@
+import type { NodeConnectionProfile } from '@eventsdk/sdk/contracts';
+export declare function loadSigningIdentity(profile: NodeConnectionProfile, clock: () => Date): Promise<{
+    currentOrigin: (audience: string) => import("@eventsdk/sdk/identity-contracts").VerifiedOrigin;
+    sign(raw: import("@eventsdk/sdk/contracts").CloudEvent, signal: AbortSignal): Promise<string>;
+} | null>;

package/dist/node-config/index.d.ts

@@ -0,0 +1,12 @@
+export { EventSdkConfigurationError } from './configuration-error.js';
+export { validateNodeProfile } from './profile/validate-profile.js';
+export { loadNodeConnectionProfile } from './profile/load-profile.js';
+export type { LoadedNodeProfile } from './profile/load-profile.js';
+export { loadPublicTrustSnapshot } from './identity/public-snapshot.js';
+export { loadNodePublicIdentity } from './identity/public-identity.js';
+export { loadNodeLocalRecoveryOrigin } from './identity/local-recovery-origin.js';
+export { loadNodeConnectionIdentity } from './identity/load-identity.js';
+export { loadSigningIdentity as loadNodeSigningIdentity } from './identity/signing-identity.js';
+export { checkNodeConnectionConfiguration } from './diagnostics/check-configuration.js';
+export { exportOwnPublicSnapshot } from './operations/export-own-public.js';
+export { refreshTrustedPublicSnapshots, type TrustRefreshOptions, } from './operations/refresh-trust.js';

package/dist/node-config/index.js

@@ -0,0 +1 @@
+var EventSdkConfigurationError=class extends Error{constructor(code){super(code);this.code=code}code};import{isIP}from"node:net";import{isAbsolute}from"node:path";import{parseNodeConnectionProfile}from"@eventsdk/sdk/contracts";function validateNodeProfile(raw,expectedServiceRef){let profile;try{profile=parseNodeConnectionProfile(structuredClone(raw))}catch{throw new EventSdkConfigurationError("PROFILE_INVALID")}if(expectedServiceRef&&profile.serviceRef!==expectedServiceRef)fail("SERVICE_IDENTITY_MISMATCH");broker(profile);identity(profile);const source=new URL(profile.installationSource);if(source.username||source.password||source.search||source.hash)fail("INSTALLATION_SOURCE_INVALID");if(profile.publisher&&(!profile.identity.signer||!subject(profile.publisher.subject)||!entity(profile.publisher.expectedStream)))fail("PUBLISHER_IDENTITY_REQUIRED");if(profile.consumer&&(!profile.identity.trustedSources.length||!subject(profile.consumer.subject)||!entity(profile.consumer.stream)||!entity(profile.consumer.durableName)))fail("CONSUMER_IDENTITY_REQUIRED");if(!profile.publisher&&!profile.consumer)fail("CAPABILITY_ROLE_REQUIRED");routing(profile);return deepFreeze(profile)}function routing(profile){const publisher=profile.publisher;const audiences=profile.identity.signer?.audiences??[];if(publisher){const routes=publisher.audienceRoutes;if(!routes&&audiences.length!==1)fail("PUBLISHER_AUDIENCE_ROUTES_REQUIRED");if(routes&&(routes.length!==audiences.length||new Set(routes.map(r=>r.audience)).size!==routes.length||new Set(routes.map(r=>r.subject)).size!==routes.length||routes.some(r=>!audiences.includes(r.audience)||!subject(r.subject)||!entity(r.expectedStream))||routes[0]?.subject!==publisher.subject||routes[0]?.expectedStream!==publisher.expectedStream))fail("PUBLISHER_AUDIENCE_ROUTES_INVALID")}const consumer=profile.consumer;if(consumer){const bindings=[consumer,...consumer.additionalBindings??[]];if(new Set(bindings.map(b=>JSON.stringify([b.stream,b.durableName]))).size!==bindings.length||new Set(bindings.map(b=>b.subject)).size!==bindings.length||bindings.some(b=>!subject(b.subject)||!entity(b.stream)||!entity(b.durableName))||bindings.length*consumer.batchSize*profile.broker.timeoutMs>3e5)fail("CONSUMER_BINDINGS_INVALID")}}function broker(profile){const b=profile.broker,url=new URL(b.serverUrl);if(url.protocol!=="tls:"||url.username||url.password||url.search||url.hash||!["","/"].includes(url.pathname)||isIP(url.hostname.replace(/^\[|\]$/g,""))||url.hostname.length>253||url.hostname.split(".").some(label=>!/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label))||b.expectedDnsName!==url.hostname)fail("BROKER_TLS_IDENTITY_REQUIRED");files([b.credentialsFile,...b.caFile?[b.caFile]:[]]);if(profile.consumer&&(profile.consumer.fetchExpiresMs>=b.timeoutMs||profile.consumer.batchSize*b.timeoutMs>3e5))fail("CONSUMER_BOUNDS_INVALID")}function identity(profile){const signer=profile.identity.signer;if(signer){https(signer.issuer);https(signer.jwksUri);files([signer.privateKeyFile,signer.publicSnapshotFile])}const seen=new Set;for(const trust of profile.identity.trustedSources){https(trust.issuer);https(trust.jwksUri);files([trust.publicSnapshotFile]);const key=JSON.stringify([trust.source,trust.serviceRef,trust.audience]);if(seen.has(key)||trust.audience!==profile.serviceRef)fail("TRUST_BINDING_AMBIGUOUS");seen.add(key)}}function https(value){const url=new URL(value);if(url.protocol!=="https:"||url.username||url.password||url.search||url.hash)fail("ISSUER_HTTPS_REQUIRED")}function files(values){if(values.some(path=>!isAbsolute(path)||path.includes("\0")))fail("FILE_REFERENCE_INVALID")}function subject(value){return/^[^\s.*>]+(?:\.[^\s.*>]+)*$/u.test(value)}function entity(value){return/^[^\s.*>/\\]+$/u.test(value)}function fail(code){throw new EventSdkConfigurationError(code)}function deepFreeze(value){if(value&&typeof value==="object"&&!Object.isFrozen(value)){Object.freeze(value);Object.values(value).forEach(deepFreeze)}return value}import{createHash}from"node:crypto";import{canonicalJson,parseJsonStrict}from"@eventsdk/sdk/contracts";import{constants}from"node:fs";import{open}from"node:fs/promises";import{isAbsolute as isAbsolute2}from"node:path";async function readConfigurationFile(path,privateFile=false){if(!isAbsolute2(path)||path.includes("\0"))throw new EventSdkConfigurationError("FILE_REFERENCE_INVALID");try{const file=await open(path,constants.O_RDONLY|constants.O_NOFOLLOW);try{const stat=await file.stat();if(!stat.isFile()||stat.nlink!==1||stat.size<1||stat.size>65536||(stat.mode&18)!==0||privateFile&&(stat.mode&63)!==0)throw new EventSdkConfigurationError("FILE_PROTECTION_REQUIRED");const bytes=Buffer.alloc(65537);const read=await file.read(bytes,0,bytes.length,0);if(read.bytesRead>65536||read.bytesRead!==stat.size)throw new EventSdkConfigurationError("FILE_CHANGED");const after=await file.stat();if(after.size!==stat.size||after.mtimeMs!==stat.mtimeMs||after.ctimeMs!==stat.ctimeMs||after.nlink!==1)throw new EventSdkConfigurationError("FILE_CHANGED");return new TextDecoder("utf-8",{fatal:true}).decode(bytes.subarray(0,read.bytesRead))}finally{await file.close()}}catch(error){if(error instanceof EventSdkConfigurationError)throw error;throw new EventSdkConfigurationError("FILE_UNAVAILABLE")}}async function loadNodeConnectionProfile(path,expectedServiceRef){const text=await readConfigurationFile(path);try{const profile=validateNodeProfile(parseJsonStrict(text),expectedServiceRef);return Object.freeze({profile,revision:`sha256:${createHash("sha256").update(canonicalJson(profile)).digest("hex")}`})}catch(error){if(error instanceof EventSdkConfigurationError)throw error;throw new EventSdkConfigurationError("PROFILE_INVALID")}}import{parsePublicJwksSnapshot,parseJsonStrict as parseJsonStrict2}from"@eventsdk/sdk/contracts";import{validatePublicOriginKeys}from"@eventsdk/sdk/identity-verifier";async function loadPublicTrustSnapshot(file,issuer,jwksUri,now=Date.now()){try{const snapshot=parsePublicJwksSnapshot(parseJsonStrict2(await readConfigurationFile(file)));const fetched=Date.parse(snapshot.fetchedAt),until=Date.parse(snapshot.validUntil);if(snapshot.issuer!==issuer||jwksUri&&snapshot.jwksUri!==jwksUri)fail2("TRUST_ISSUER_MISMATCH");const uri=new URL(snapshot.jwksUri);if(uri.protocol!=="https:"||uri.username||uri.password||uri.search||uri.hash)fail2("TRUST_URI_INVALID");if(!Number.isFinite(now)||fetched>now||now>=until||until<=fetched||until-fetched>864e5)fail2("TRUST_SNAPSHOT_EXPIRED");validatePublicOriginKeys(snapshot.jwks);return snapshot}catch(error){if(error instanceof EventSdkConfigurationError)throw error;throw new EventSdkConfigurationError("TRUST_SNAPSHOT_INVALID")}}function fail2(code){throw new EventSdkConfigurationError(code)}async function loadNodePublicIdentity(file,expectedServiceRef,now=Date.now()){if(!file)return null;const{profile}=await loadNodeConnectionProfile(file,expectedServiceRef),signer=profile.identity.signer;if(!signer)return null;const snapshot=await loadPublicTrustSnapshot(signer.publicSnapshotFile,signer.issuer,signer.jwksUri,now);return{schemaVersion:1,profile:profile.identity.originProof,serviceRef:profile.serviceRef,source:profile.installationSource,issuer:signer.issuer,subject:signer.subject,jwksUri:snapshot.jwksUri,validUntil:snapshot.validUntil,jwks:snapshot.jwks}}async function loadNodeLocalRecoveryOrigin(file,serviceRef,event){const now=Date.now(),{profile}=await loadNodeConnectionProfile(file,serviceRef);const identity2=await loadNodePublicIdentity(file,serviceRef,now);if(!identity2||profile.mode!=="ACTIVE"||identity2.source!==event.source||identity2.serviceRef!==event.serviceorigin||!profile.identity.signer?.audiences.includes(event.audience))throw new EventSdkConfigurationError("LOCAL_RECOVERY_IDENTITY_MISMATCH");return{serviceRef,issuer:identity2.issuer,subject:identity2.subject,audience:[event.audience],verifiedAt:new Date(now).toISOString(),expiresAt:identity2.validUntil}}import{createPublicKey}from"node:crypto";import{createEventOriginSigner}from"@eventsdk/sdk/identity-verifier";async function loadSigningIdentity(profile,clock){const config=profile.identity.signer;if(!config)return null;const snapshot=await loadPublicTrustSnapshot(config.publicSnapshotFile,config.issuer,config.jwksUri,clock().getTime());const privateKeyPkcs8=await readConfigurationFile(config.privateKeyFile,true);assertKeyPair(config,snapshot.jwks.keys,privateKeyPkcs8);try{return await createEventOriginSigner({issuer:config.issuer,subject:config.subject,serviceRef:profile.serviceRef,source:profile.installationSource,keyId:config.keyId,algorithm:config.algorithm,privateKeyPkcs8,audiences:config.audiences,keysValidUntil:snapshot.validUntil,clock})}catch{throw new EventSdkConfigurationError("SIGNING_IDENTITY_INVALID")}}function assertKeyPair(config,keys,pem){try{const expected=keys.find(key=>key.kid===config.keyId);const actual=createPublicKey(pem).export({format:"jwk"});if(!expected||expected.alg!==void 0&&expected.alg!==config.algorithm||expected.kty!==actual.kty)throw new Error("mismatch");const fields=actual.kty==="RSA"?["n","e"]:actual.kty==="EC"?["crv","x","y"]:["crv","x"];if(fields.some(field=>expected[field]!==actual[field]))throw new Error("mismatch")}catch{throw new EventSdkConfigurationError("SIGNING_KEY_PAIR_MISMATCH")}}import{createEventOriginVerifier}from"@eventsdk/sdk/identity-verifier";async function loadTrustedSources(profile,clock){for(const binding of profile.identity.trustedSources)await verifier(binding,clock);return async(event,proof,signal)=>{signal.throwIfAborted();const selected=profile.identity.trustedSources.find(binding=>binding.source===event.source&&binding.serviceRef===event.serviceorigin&&binding.audience===event.audience);if(!selected)return{verified:false,reasonCode:"SOURCE_NOT_ENROLLED"};try{return await(await verifier(selected,clock)).verify(event,proof,signal)}catch(error){return{verified:false,reasonCode:signal.aborted?"CANCELLED":error instanceof EventSdkConfigurationError?error.code:"TRUST_SNAPSHOT_INVALID"}}}}async function verifier(binding,clock){const snapshot=await loadPublicTrustSnapshot(binding.publicSnapshotFile,binding.issuer,binding.jwksUri,clock().getTime());return createEventOriginVerifier({source:binding.source,serviceRef:binding.serviceRef,issuer:binding.issuer,subject:binding.subject,audience:binding.audience,algorithms:binding.algorithms,jwks:snapshot.jwks,keysValidUntil:snapshot.validUntil,clock})}async function loadNodeConnectionIdentity(loaded,clock=()=>new Date,inspectionOnly=false){if(loaded.profile.mode==="DISABLED"&&!inspectionOnly)throw new EventSdkConfigurationError("PROFILE_DISABLED");const config=loaded.profile.broker;await readConfigurationFile(config.credentialsFile,true);if(config.caFile)await readConfigurationFile(config.caFile);const signer=await loadSigningIdentity(loaded.profile,clock);const verifyOrigin=await loadTrustedSources(loaded.profile,clock);return Object.freeze({profile:loaded.profile,revision:loaded.revision,signer,verifyOrigin,async withBrokerCredentials(run){const credential=await readConfigurationFile(config.credentialsFile,true);const ca=config.caFile?await readConfigurationFile(config.caFile):void 0;return run({credential:new TextEncoder().encode(credential),...ca?{ca}:{}})}})}async function checkNodeConnectionConfiguration(file,expectedServiceRef,checkFiles=false){if(!file)return{status:"DISABLED",configured:false,connected:false};try{const loaded=await loadNodeConnectionProfile(file,expectedServiceRef),p=loaded.profile;if(checkFiles)await loadNodeConnectionIdentity(loaded,()=>new Date,true);return{status:p.mode==="DISABLED"?"DISABLED":checkFiles?"ASSETS_VALID":"PROFILE_VALID",configured:true,connected:false,serviceRef:p.serviceRef,mode:p.mode,revision:loaded.revision,roles:{publisher:p.publisher!==null,consumer:p.consumer!==null},originProof:p.identity.originProof,trustedSources:p.identity.trustedSources.length,filesChecked:checkFiles}}catch(error){return{status:"INVALID",configured:true,connected:false,code:error instanceof EventSdkConfigurationError?error.code:"CONFIGURATION_UNAVAILABLE"}}}import{createPrivateKey,createPublicKey as createPublicKey2}from"node:crypto";import{parseJsonStrict as parseJsonStrict3,parsePublicJwksSnapshot as parsePublicJwksSnapshot3}from"@eventsdk/sdk/contracts";import{constants as constants2}from"node:fs";import{lstat,open as open2,rename,unlink}from"node:fs/promises";import{dirname,isAbsolute as isAbsolute3}from"node:path";import{randomUUID}from"node:crypto";async function updatePublicConfiguration(file,update){if(!isAbsolute3(file)||file.includes("\0"))throw new EventSdkConfigurationError("FILE_REFERENCE_INVALID");const lock=`${file}.lock`,temporary=`${file}.${randomUUID()}.tmp`;let locked=false;try{const parent=await lstat(dirname(file));if(!parent.isDirectory()||(parent.mode&18)!==0)throw new Error("directory");const handle=await open2(lock,constants2.O_CREAT|constants2.O_EXCL|constants2.O_WRONLY|constants2.O_NOFOLLOW,384);locked=true;await handle.close();const previous=await existing(file);const output=update(previous);if(Buffer.byteLength(output)>65536)throw new Error("size");const next=await open2(temporary,constants2.O_CREAT|constants2.O_EXCL|constants2.O_WRONLY|constants2.O_NOFOLLOW,384);try{await next.writeFile(output,"utf8");await next.sync()}finally{await next.close()}await rename(temporary,file);const directory=await open2(dirname(file),constants2.O_RDONLY);try{await directory.sync()}finally{await directory.close()}}catch(error){if(error instanceof EventSdkConfigurationError)throw error;throw new EventSdkConfigurationError("PUBLIC_SNAPSHOT_UPDATE_FAILED")}finally{await unlink(temporary).catch(()=>void 0);if(locked)await unlink(lock).catch(()=>void 0)}}async function existing(file){try{await lstat(file)}catch(error){if(error.code==="ENOENT")return null;throw error}return readConfigurationFile(file)}import{parsePublicJwksSnapshot as parsePublicJwksSnapshot2}from"@eventsdk/sdk/contracts";import{validatePublicOriginKeys as validatePublicOriginKeys2}from"@eventsdk/sdk/identity-verifier";function snapshotValue(issuer,jwksUri,jwks,now,ttlMs){if(!Number.isFinite(now)||!Number.isSafeInteger(ttlMs)||ttlMs<6e4||ttlMs>864e5)throw new EventSdkConfigurationError("SNAPSHOT_LIFETIME_INVALID");try{const value=parsePublicJwksSnapshot2({schemaVersion:1,issuer,jwksUri,fetchedAt:new Date(now).toISOString(),validUntil:new Date(now+ttlMs).toISOString(),jwks});validatePublicOriginKeys2(value.jwks);return value}catch{throw new EventSdkConfigurationError("PUBLIC_JWKS_INVALID")}}async function exportOwnPublicSnapshot(file,options={}){const{profile}=await loadNodeConnectionProfile(file);const config=profile.identity.signer;if(!config)throw new EventSdkConfigurationError("SIGNER_NOT_CONFIGURED");const pem=await readConfigurationFile(config.privateKeyFile,true);let key;try{const privateKey=createPrivateKey(pem);const publicKey=createPublicKey2(privateKey).export({format:"jwk"});const expected=config.algorithm==="EdDSA"?"OKP":config.algorithm==="ES256"?"EC":"RSA";if(!pem.startsWith("-----BEGIN PRIVATE KEY-----")||publicKey.kty!==expected||expected==="OKP"&&publicKey.crv!=="Ed25519"||expected==="EC"&&publicKey.crv!=="P-256"||expected==="RSA"&&(privateKey.asymmetricKeyDetails?.modulusLength??0)<2048)throw new Error("algorithm");key={...publicKey,kid:config.keyId,alg:config.algorithm,use:"sig"}}catch{throw new EventSdkConfigurationError("SIGNING_KEY_INVALID")}const now=options.now??Date.now(),ttl=options.ttlMs??36e5;await updatePublicConfiguration(config.publicSnapshotFile,previous=>{const keys=retained(previous,config.issuer,config.jwksUri);const same=keys.find(item=>item.kid===key.kid);if(same&&!samePublicKey(same,key))throw new EventSdkConfigurationError("KEY_ID_REUSE_REJECTED");const snapshot=snapshotValue(config.issuer,config.jwksUri,{keys:same?keys.map(item=>item===same?key:item):[...keys,key]},now,ttl);return JSON.stringify(snapshot,null,2)+"\n"});return{status:"PUBLIC_SNAPSHOT_EXPORTED",serviceRef:profile.serviceRef,keyId:config.keyId}}function samePublicKey(old,key){const fields=key.kty==="RSA"?["kty","n","e"]:key.kty==="EC"?["kty","crv","x","y"]:["kty","crv","x"];return fields.every(field=>old[field]===key[field])&&(old.alg===void 0||old.alg===key.alg)}function retained(previous,issuer,uri){if(!previous)return[];try{const parsed=parsePublicJwksSnapshot3(parseJsonStrict3(previous));if(parsed.issuer!==issuer||parsed.jwksUri!==uri)throw new Error("binding");return snapshotValue(issuer,uri,parsed.jwks,0,6e4).jwks.keys}catch{throw new EventSdkConfigurationError("EXISTING_PUBLIC_SNAPSHOT_INVALID")}}import{parseJsonStrict as parseJsonStrict4}from"@eventsdk/sdk/contracts";async function refreshTrustedPublicSnapshots(file,options={}){const{profile}=await loadNodeConnectionProfile(file);let refreshed=0;for(const binding of profile.identity.trustedSources){await refresh(binding,options);refreshed+=1}return{status:"TRUST_SNAPSHOTS_REFRESHED",serviceRef:profile.serviceRef,refreshed}}async function refresh(binding,options){try{const signal=AbortSignal.timeout(5e3);const response=await(options.fetch??globalThis.fetch)(binding.jwksUri,{method:"GET",redirect:"error",signal,headers:{accept:"application/json"}});if(!response.ok||response.redirected||!response.body)throw new Error("response");const reader=response.body.getReader(),chunks=[];let size=0;try{while(true){signal.throwIfAborted();const result=await reader.read();if(result.done)break;size+=result.value.byteLength;if(size>65536)throw new Error("size");chunks.push(result.value)}}finally{await reader.cancel().catch(()=>void 0);reader.releaseLock()}const raw=parseJsonStrict4(new TextDecoder("utf-8",{fatal:true}).decode(Buffer.concat(chunks)));const snapshot=snapshotValue(binding.issuer,binding.jwksUri,raw,options.now??Date.now(),options.ttlMs??36e5);await updatePublicConfiguration(binding.publicSnapshotFile,()=>JSON.stringify(snapshot,null,2)+"\n")}catch(error){if(error instanceof EventSdkConfigurationError)throw error;throw new EventSdkConfigurationError("TRUST_REFRESH_FAILED")}}export{EventSdkConfigurationError,checkNodeConnectionConfiguration,exportOwnPublicSnapshot,loadNodeConnectionIdentity,loadNodeConnectionProfile,loadNodeLocalRecoveryOrigin,loadNodePublicIdentity,loadSigningIdentity as loadNodeSigningIdentity,loadPublicTrustSnapshot,refreshTrustedPublicSnapshots,validateNodeProfile};

package/dist/node-config/main.js

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import{createHash}from"node:crypto";import{canonicalJson,parseJsonStrict}from"@eventsdk/sdk/contracts";import{constants}from"node:fs";import{open}from"node:fs/promises";import{isAbsolute}from"node:path";var EventSdkConfigurationError=class extends Error{constructor(code){super(code);this.code=code}code};async function readConfigurationFile(path,privateFile=false){if(!isAbsolute(path)||path.includes("\0"))throw new EventSdkConfigurationError("FILE_REFERENCE_INVALID");try{const file=await open(path,constants.O_RDONLY|constants.O_NOFOLLOW);try{const stat=await file.stat();if(!stat.isFile()||stat.nlink!==1||stat.size<1||stat.size>65536||(stat.mode&18)!==0||privateFile&&(stat.mode&63)!==0)throw new EventSdkConfigurationError("FILE_PROTECTION_REQUIRED");const bytes=Buffer.alloc(65537);const read=await file.read(bytes,0,bytes.length,0);if(read.bytesRead>65536||read.bytesRead!==stat.size)throw new EventSdkConfigurationError("FILE_CHANGED");const after=await file.stat();if(after.size!==stat.size||after.mtimeMs!==stat.mtimeMs||after.ctimeMs!==stat.ctimeMs||after.nlink!==1)throw new EventSdkConfigurationError("FILE_CHANGED");return new TextDecoder("utf-8",{fatal:true}).decode(bytes.subarray(0,read.bytesRead))}finally{await file.close()}}catch(error){if(error instanceof EventSdkConfigurationError)throw error;throw new EventSdkConfigurationError("FILE_UNAVAILABLE")}}import{isIP}from"node:net";import{isAbsolute as isAbsolute2}from"node:path";import{parseNodeConnectionProfile}from"@eventsdk/sdk/contracts";function validateNodeProfile(raw,expectedServiceRef){let profile;try{profile=parseNodeConnectionProfile(structuredClone(raw))}catch{throw new EventSdkConfigurationError("PROFILE_INVALID")}if(expectedServiceRef&&profile.serviceRef!==expectedServiceRef)fail("SERVICE_IDENTITY_MISMATCH");broker(profile);identity(profile);const source=new URL(profile.installationSource);if(source.username||source.password||source.search||source.hash)fail("INSTALLATION_SOURCE_INVALID");if(profile.publisher&&(!profile.identity.signer||!subject(profile.publisher.subject)||!entity(profile.publisher.expectedStream)))fail("PUBLISHER_IDENTITY_REQUIRED");if(profile.consumer&&(!profile.identity.trustedSources.length||!subject(profile.consumer.subject)||!entity(profile.consumer.stream)||!entity(profile.consumer.durableName)))fail("CONSUMER_IDENTITY_REQUIRED");if(!profile.publisher&&!profile.consumer)fail("CAPABILITY_ROLE_REQUIRED");routing(profile);return deepFreeze(profile)}function routing(profile){const publisher=profile.publisher;const audiences=profile.identity.signer?.audiences??[];if(publisher){const routes=publisher.audienceRoutes;if(!routes&&audiences.length!==1)fail("PUBLISHER_AUDIENCE_ROUTES_REQUIRED");if(routes&&(routes.length!==audiences.length||new Set(routes.map(r=>r.audience)).size!==routes.length||new Set(routes.map(r=>r.subject)).size!==routes.length||routes.some(r=>!audiences.includes(r.audience)||!subject(r.subject)||!entity(r.expectedStream))||routes[0]?.subject!==publisher.subject||routes[0]?.expectedStream!==publisher.expectedStream))fail("PUBLISHER_AUDIENCE_ROUTES_INVALID")}const consumer=profile.consumer;if(consumer){const bindings=[consumer,...consumer.additionalBindings??[]];if(new Set(bindings.map(b=>JSON.stringify([b.stream,b.durableName]))).size!==bindings.length||new Set(bindings.map(b=>b.subject)).size!==bindings.length||bindings.some(b=>!subject(b.subject)||!entity(b.stream)||!entity(b.durableName))||bindings.length*consumer.batchSize*profile.broker.timeoutMs>3e5)fail("CONSUMER_BINDINGS_INVALID")}}function broker(profile){const b=profile.broker,url=new URL(b.serverUrl);if(url.protocol!=="tls:"||url.username||url.password||url.search||url.hash||!["","/"].includes(url.pathname)||isIP(url.hostname.replace(/^\[|\]$/g,""))||url.hostname.length>253||url.hostname.split(".").some(label=>!/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label))||b.expectedDnsName!==url.hostname)fail("BROKER_TLS_IDENTITY_REQUIRED");files([b.credentialsFile,...b.caFile?[b.caFile]:[]]);if(profile.consumer&&(profile.consumer.fetchExpiresMs>=b.timeoutMs||profile.consumer.batchSize*b.timeoutMs>3e5))fail("CONSUMER_BOUNDS_INVALID")}function identity(profile){const signer=profile.identity.signer;if(signer){https(signer.issuer);https(signer.jwksUri);files([signer.privateKeyFile,signer.publicSnapshotFile])}const seen=new Set;for(const trust of profile.identity.trustedSources){https(trust.issuer);https(trust.jwksUri);files([trust.publicSnapshotFile]);const key=JSON.stringify([trust.source,trust.serviceRef,trust.audience]);if(seen.has(key)||trust.audience!==profile.serviceRef)fail("TRUST_BINDING_AMBIGUOUS");seen.add(key)}}function https(value){const url=new URL(value);if(url.protocol!=="https:"||url.username||url.password||url.search||url.hash)fail("ISSUER_HTTPS_REQUIRED")}function files(values){if(values.some(path=>!isAbsolute2(path)||path.includes("\0")))fail("FILE_REFERENCE_INVALID")}function subject(value){return/^[^\s.*>]+(?:\.[^\s.*>]+)*$/u.test(value)}function entity(value){return/^[^\s.*>/\\]+$/u.test(value)}function fail(code){throw new EventSdkConfigurationError(code)}function deepFreeze(value){if(value&&typeof value==="object"&&!Object.isFrozen(value)){Object.freeze(value);Object.values(value).forEach(deepFreeze)}return value}async function loadNodeConnectionProfile(path,expectedServiceRef){const text=await readConfigurationFile(path);try{const profile=validateNodeProfile(parseJsonStrict(text),expectedServiceRef);return Object.freeze({profile,revision:`sha256:${createHash("sha256").update(canonicalJson(profile)).digest("hex")}`})}catch(error){if(error instanceof EventSdkConfigurationError)throw error;throw new EventSdkConfigurationError("PROFILE_INVALID")}}import{createPublicKey}from"node:crypto";import{createEventOriginSigner}from"@eventsdk/sdk/identity-verifier";import{parsePublicJwksSnapshot,parseJsonStrict as parseJsonStrict2}from"@eventsdk/sdk/contracts";import{validatePublicOriginKeys}from"@eventsdk/sdk/identity-verifier";async function loadPublicTrustSnapshot(file,issuer,jwksUri,now=Date.now()){try{const snapshot=parsePublicJwksSnapshot(parseJsonStrict2(await readConfigurationFile(file)));const fetched=Date.parse(snapshot.fetchedAt),until=Date.parse(snapshot.validUntil);if(snapshot.issuer!==issuer||jwksUri&&snapshot.jwksUri!==jwksUri)fail2("TRUST_ISSUER_MISMATCH");const uri=new URL(snapshot.jwksUri);if(uri.protocol!=="https:"||uri.username||uri.password||uri.search||uri.hash)fail2("TRUST_URI_INVALID");if(!Number.isFinite(now)||fetched>now||now>=until||until<=fetched||until-fetched>864e5)fail2("TRUST_SNAPSHOT_EXPIRED");validatePublicOriginKeys(snapshot.jwks);return snapshot}catch(error){if(error instanceof EventSdkConfigurationError)throw error;throw new EventSdkConfigurationError("TRUST_SNAPSHOT_INVALID")}}function fail2(code){throw new EventSdkConfigurationError(code)}async function loadSigningIdentity(profile,clock){const config=profile.identity.signer;if(!config)return null;const snapshot=await loadPublicTrustSnapshot(config.publicSnapshotFile,config.issuer,config.jwksUri,clock().getTime());const privateKeyPkcs8=await readConfigurationFile(config.privateKeyFile,true);assertKeyPair(config,snapshot.jwks.keys,privateKeyPkcs8);try{return await createEventOriginSigner({issuer:config.issuer,subject:config.subject,serviceRef:profile.serviceRef,source:profile.installationSource,keyId:config.keyId,algorithm:config.algorithm,privateKeyPkcs8,audiences:config.audiences,keysValidUntil:snapshot.validUntil,clock})}catch{throw new EventSdkConfigurationError("SIGNING_IDENTITY_INVALID")}}function assertKeyPair(config,keys,pem){try{const expected=keys.find(key=>key.kid===config.keyId);const actual=createPublicKey(pem).export({format:"jwk"});if(!expected||expected.alg!==void 0&&expected.alg!==config.algorithm||expected.kty!==actual.kty)throw new Error("mismatch");const fields=actual.kty==="RSA"?["n","e"]:actual.kty==="EC"?["crv","x","y"]:["crv","x"];if(fields.some(field=>expected[field]!==actual[field]))throw new Error("mismatch")}catch{throw new EventSdkConfigurationError("SIGNING_KEY_PAIR_MISMATCH")}}import{createEventOriginVerifier}from"@eventsdk/sdk/identity-verifier";async function loadTrustedSources(profile,clock){for(const binding of profile.identity.trustedSources)await verifier(binding,clock);return async(event,proof,signal)=>{signal.throwIfAborted();const selected=profile.identity.trustedSources.find(binding=>binding.source===event.source&&binding.serviceRef===event.serviceorigin&&binding.audience===event.audience);if(!selected)return{verified:false,reasonCode:"SOURCE_NOT_ENROLLED"};try{return await(await verifier(selected,clock)).verify(event,proof,signal)}catch(error){return{verified:false,reasonCode:signal.aborted?"CANCELLED":error instanceof EventSdkConfigurationError?error.code:"TRUST_SNAPSHOT_INVALID"}}}}async function verifier(binding,clock){const snapshot=await loadPublicTrustSnapshot(binding.publicSnapshotFile,binding.issuer,binding.jwksUri,clock().getTime());return createEventOriginVerifier({source:binding.source,serviceRef:binding.serviceRef,issuer:binding.issuer,subject:binding.subject,audience:binding.audience,algorithms:binding.algorithms,jwks:snapshot.jwks,keysValidUntil:snapshot.validUntil,clock})}async function loadNodeConnectionIdentity(loaded,clock=()=>new Date,inspectionOnly=false){if(loaded.profile.mode==="DISABLED"&&!inspectionOnly)throw new EventSdkConfigurationError("PROFILE_DISABLED");const config=loaded.profile.broker;await readConfigurationFile(config.credentialsFile,true);if(config.caFile)await readConfigurationFile(config.caFile);const signer=await loadSigningIdentity(loaded.profile,clock);const verifyOrigin=await loadTrustedSources(loaded.profile,clock);return Object.freeze({profile:loaded.profile,revision:loaded.revision,signer,verifyOrigin,async withBrokerCredentials(run){const credential=await readConfigurationFile(config.credentialsFile,true);const ca=config.caFile?await readConfigurationFile(config.caFile):void 0;return run({credential:new TextEncoder().encode(credential),...ca?{ca}:{}})}})}async function checkNodeConnectionConfiguration(file,expectedServiceRef,checkFiles=false){if(!file)return{status:"DISABLED",configured:false,connected:false};try{const loaded=await loadNodeConnectionProfile(file,expectedServiceRef),p=loaded.profile;if(checkFiles)await loadNodeConnectionIdentity(loaded,()=>new Date,true);return{status:p.mode==="DISABLED"?"DISABLED":checkFiles?"ASSETS_VALID":"PROFILE_VALID",configured:true,connected:false,serviceRef:p.serviceRef,mode:p.mode,revision:loaded.revision,roles:{publisher:p.publisher!==null,consumer:p.consumer!==null},originProof:p.identity.originProof,trustedSources:p.identity.trustedSources.length,filesChecked:checkFiles}}catch(error){return{status:"INVALID",configured:true,connected:false,code:error instanceof EventSdkConfigurationError?error.code:"CONFIGURATION_UNAVAILABLE"}}}import{createPrivateKey,createPublicKey as createPublicKey2}from"node:crypto";import{parseJsonStrict as parseJsonStrict3,parsePublicJwksSnapshot as parsePublicJwksSnapshot3}from"@eventsdk/sdk/contracts";import{constants as constants2}from"node:fs";import{lstat,open as open2,rename,unlink}from"node:fs/promises";import{dirname,isAbsolute as isAbsolute3}from"node:path";import{randomUUID}from"node:crypto";async function updatePublicConfiguration(file,update){if(!isAbsolute3(file)||file.includes("\0"))throw new EventSdkConfigurationError("FILE_REFERENCE_INVALID");const lock=`${file}.lock`,temporary=`${file}.${randomUUID()}.tmp`;let locked=false;try{const parent=await lstat(dirname(file));if(!parent.isDirectory()||(parent.mode&18)!==0)throw new Error("directory");const handle=await open2(lock,constants2.O_CREAT|constants2.O_EXCL|constants2.O_WRONLY|constants2.O_NOFOLLOW,384);locked=true;await handle.close();const previous=await existing(file);const output=update(previous);if(Buffer.byteLength(output)>65536)throw new Error("size");const next=await open2(temporary,constants2.O_CREAT|constants2.O_EXCL|constants2.O_WRONLY|constants2.O_NOFOLLOW,384);try{await next.writeFile(output,"utf8");await next.sync()}finally{await next.close()}await rename(temporary,file);const directory=await open2(dirname(file),constants2.O_RDONLY);try{await directory.sync()}finally{await directory.close()}}catch(error){if(error instanceof EventSdkConfigurationError)throw error;throw new EventSdkConfigurationError("PUBLIC_SNAPSHOT_UPDATE_FAILED")}finally{await unlink(temporary).catch(()=>void 0);if(locked)await unlink(lock).catch(()=>void 0)}}async function existing(file){try{await lstat(file)}catch(error){if(error.code==="ENOENT")return null;throw error}return readConfigurationFile(file)}import{parsePublicJwksSnapshot as parsePublicJwksSnapshot2}from"@eventsdk/sdk/contracts";import{validatePublicOriginKeys as validatePublicOriginKeys2}from"@eventsdk/sdk/identity-verifier";function snapshotValue(issuer,jwksUri,jwks,now,ttlMs){if(!Number.isFinite(now)||!Number.isSafeInteger(ttlMs)||ttlMs<6e4||ttlMs>864e5)throw new EventSdkConfigurationError("SNAPSHOT_LIFETIME_INVALID");try{const value=parsePublicJwksSnapshot2({schemaVersion:1,issuer,jwksUri,fetchedAt:new Date(now).toISOString(),validUntil:new Date(now+ttlMs).toISOString(),jwks});validatePublicOriginKeys2(value.jwks);return value}catch{throw new EventSdkConfigurationError("PUBLIC_JWKS_INVALID")}}async function exportOwnPublicSnapshot(file,options={}){const{profile}=await loadNodeConnectionProfile(file);const config=profile.identity.signer;if(!config)throw new EventSdkConfigurationError("SIGNER_NOT_CONFIGURED");const pem=await readConfigurationFile(config.privateKeyFile,true);let key;try{const privateKey=createPrivateKey(pem);const publicKey=createPublicKey2(privateKey).export({format:"jwk"});const expected=config.algorithm==="EdDSA"?"OKP":config.algorithm==="ES256"?"EC":"RSA";if(!pem.startsWith("-----BEGIN PRIVATE KEY-----")||publicKey.kty!==expected||expected==="OKP"&&publicKey.crv!=="Ed25519"||expected==="EC"&&publicKey.crv!=="P-256"||expected==="RSA"&&(privateKey.asymmetricKeyDetails?.modulusLength??0)<2048)throw new Error("algorithm");key={...publicKey,kid:config.keyId,alg:config.algorithm,use:"sig"}}catch{throw new EventSdkConfigurationError("SIGNING_KEY_INVALID")}const now=options.now??Date.now(),ttl=options.ttlMs??36e5;await updatePublicConfiguration(config.publicSnapshotFile,previous=>{const keys=retained(previous,config.issuer,config.jwksUri);const same=keys.find(item=>item.kid===key.kid);if(same&&!samePublicKey(same,key))throw new EventSdkConfigurationError("KEY_ID_REUSE_REJECTED");const snapshot=snapshotValue(config.issuer,config.jwksUri,{keys:same?keys.map(item=>item===same?key:item):[...keys,key]},now,ttl);return JSON.stringify(snapshot,null,2)+"\n"});return{status:"PUBLIC_SNAPSHOT_EXPORTED",serviceRef:profile.serviceRef,keyId:config.keyId}}function samePublicKey(old,key){const fields=key.kty==="RSA"?["kty","n","e"]:key.kty==="EC"?["kty","crv","x","y"]:["kty","crv","x"];return fields.every(field=>old[field]===key[field])&&(old.alg===void 0||old.alg===key.alg)}function retained(previous,issuer,uri){if(!previous)return[];try{const parsed=parsePublicJwksSnapshot3(parseJsonStrict3(previous));if(parsed.issuer!==issuer||parsed.jwksUri!==uri)throw new Error("binding");return snapshotValue(issuer,uri,parsed.jwks,0,6e4).jwks.keys}catch{throw new EventSdkConfigurationError("EXISTING_PUBLIC_SNAPSHOT_INVALID")}}import{parseJsonStrict as parseJsonStrict4}from"@eventsdk/sdk/contracts";async function refreshTrustedPublicSnapshots(file,options={}){const{profile}=await loadNodeConnectionProfile(file);let refreshed=0;for(const binding of profile.identity.trustedSources){await refresh(binding,options);refreshed+=1}return{status:"TRUST_SNAPSHOTS_REFRESHED",serviceRef:profile.serviceRef,refreshed}}async function refresh(binding,options){try{const signal=AbortSignal.timeout(5e3);const response=await(options.fetch??globalThis.fetch)(binding.jwksUri,{method:"GET",redirect:"error",signal,headers:{accept:"application/json"}});if(!response.ok||response.redirected||!response.body)throw new Error("response");const reader=response.body.getReader(),chunks=[];let size=0;try{while(true){signal.throwIfAborted();const result2=await reader.read();if(result2.done)break;size+=result2.value.byteLength;if(size>65536)throw new Error("size");chunks.push(result2.value)}}finally{await reader.cancel().catch(()=>void 0);reader.releaseLock()}const raw=parseJsonStrict4(new TextDecoder("utf-8",{fatal:true}).decode(Buffer.concat(chunks)));const snapshot=snapshotValue(binding.issuer,binding.jwksUri,raw,options.now??Date.now(),options.ttlMs??36e5);await updatePublicConfiguration(binding.publicSnapshotFile,()=>JSON.stringify(snapshot,null,2)+"\n")}catch(error){if(error instanceof EventSdkConfigurationError)throw error;throw new EventSdkConfigurationError("TRUST_REFRESH_FAILED")}}async function runConfigurationCheck(args){if(args.length===2&&args[1]&&["export-own-public","refresh-trust"].includes(args[0]??"")){try{return args[0]==="export-own-public"?await exportOwnPublicSnapshot(args[1]):await refreshTrustedPublicSnapshots(args[1])}catch(error){return{status:"INVALID",code:error instanceof EventSdkConfigurationError?error.code:"CONFIGURATION_OPERATION_FAILED"}}}if(args[0]!=="check"||!args[1]||args.slice(2).some(arg=>arg!=="--check-files")||args.length>3)return{status:"INVALID",code:"USAGE",usage:"eventsdk-config check <absolute-profile-file> [--check-files] | export-own-public <file> | refresh-trust <file>"};return checkNodeConnectionConfiguration(args[1],void 0,args.includes("--check-files"))}var result=await runConfigurationCheck(process.argv.slice(2));process.stdout.write(`${JSON.stringify(result)}
+`);if(result.status==="INVALID")process.exitCode=1;

package/dist/node-config/operations/export-own-public.d.ts

@@ -0,0 +1,8 @@
+export declare function exportOwnPublicSnapshot(file: string, options?: {
+    now?: number;
+    ttlMs?: number;
+}): Promise<{
+    status: "PUBLIC_SNAPSHOT_EXPORTED";
+    serviceRef: string;
+    keyId: string;
+}>;

package/dist/node-config/operations/refresh-trust.d.ts

@@ -0,0 +1,10 @@
+export interface TrustRefreshOptions {
+    now?: number;
+    ttlMs?: number;
+    fetch?: typeof globalThis.fetch;
+}
+export declare function refreshTrustedPublicSnapshots(file: string, options?: TrustRefreshOptions): Promise<{
+    status: "TRUST_SNAPSHOTS_REFRESHED";
+    serviceRef: string;
+    refreshed: number;
+}>;

package/dist/node-config/profile/load-profile.d.ts

@@ -0,0 +1,6 @@
+import { type NodeConnectionProfile } from '@eventsdk/sdk/contracts';
+export interface LoadedNodeProfile {
+    readonly profile: NodeConnectionProfile;
+    readonly revision: string;
+}
+export declare function loadNodeConnectionProfile(path: string, expectedServiceRef?: string): Promise<LoadedNodeProfile>;

package/dist/node-config/profile/validate-profile.d.ts

@@ -0,0 +1,2 @@
+import { type NodeConnectionProfile } from '@eventsdk/sdk/contracts';
+export declare function validateNodeProfile(raw: unknown, expectedServiceRef?: string): NodeConnectionProfile;

package/dist/node-worker/index.d.ts

@@ -0,0 +1,3 @@
+export { openNodeWorkerSession, type NodeWorkerSession } from './session.js';
+export { createNativeRouteScheduler, type NativeRouteFault } from './route-scheduler.js';
+export { runNodeEventWorker, type NodeWorkerState, type NodeWorkerTask, type NodeWorkerOptions, } from './lifecycle.js';

package/dist/node-worker/index.js

@@ -0,0 +1 @@
+import{loadNodeConnectionProfile,loadNodeConnectionIdentity,loadNodeSigningIdentity}from"@eventsdk/sdk/node-config";import{openNatsDeliverySession,credsAuthenticator,nkeyAuthenticator}from"@eventsdk/sdk/transport-nats";import{CoreError}from"@eventsdk/sdk/core";import{EventSdkConfigurationError}from"@eventsdk/sdk/node-config";function createNativeRouteScheduler(options={}){const now=options.now??Date.now,retryMs=options.retryMs??3e4,capacity=options.capacity??1024;if(!Number.isSafeInteger(retryMs)||retryMs<100||retryMs>3e5||!Number.isSafeInteger(capacity)||capacity<1||capacity>1e4)throw new Error("ROUTE_SCHEDULER_BOUNDS_INVALID");const retries=new Map;return{async run(routeRef,work,signal){signal.throwIfAborted();if((retries.get(routeRef)??0)>now())return false;try{await work();retries.delete(routeRef);return true}catch(error){signal.throwIfAborted();const retryAt=now()+retryMs;retries.delete(routeRef);while(retries.size>=capacity){const oldest=retries.keys().next().value;if(oldest===void 0)break;retries.delete(oldest)}retries.set(routeRef,retryAt);const code=error instanceof CoreError||error instanceof EventSdkConfigurationError?error.code:"ROUTE_UNAVAILABLE";options.fault?.({routeRef,reasonCode:/^[A-Z][A-Z0-9_]{0,63}$/.test(code)?code:"ROUTE_UNAVAILABLE",retryAt});return false}},held(){return[...retries].map(([routeRef,retryAt])=>({routeRef,retryAt}))}}}function routedPublisher(transport,profile,originProof){const publisher=profile.publisher;if(!publisher)return null;const audiences=profile.identity.signer?.audiences??[];const routes=publisher.audienceRoutes??audiences.map(audience=>({audience,subject:publisher.subject,expectedStream:publisher.expectedStream}));const ports=new Map(routes.map(route=>[route.audience,transport.publisher({subject:route.subject,expectedStream:route.expectedStream,timeoutMs:profile.broker.timeoutMs,maxPayloadBytes:profile.broker.maxPayloadBytes,...originProof?{originProof}:{}})]));return{async publish(event,context){const port=ports.get(event.audience);if(!port)throw Error("PUBLISH_AUDIENCE_NOT_CONFIGURED");return port.publish(event,context)}}}async function routedConsumer(transport,profile,signal){const consumer=profile.consumer;if(!consumer)return null;const bindings=[consumer,...consumer.additionalBindings??[]];const faults=new Map;const scheduler=createNativeRouteScheduler({capacity:bindings.length,retryMs:1e3,fault:value=>faults.set(value.routeRef,value)});const ports=[];for(const binding of bindings)ports.push(await openBinding(transport,profile,consumer,binding,signal));return{async consumeBatch(accept,child){let total=0;for(const[index,port]of ports.entries()){child.throwIfAborted();const binding=bindings[index];if(!binding)throw Error("CONSUMER_BINDING_MISSING");const ref=`${binding.stream}/${binding.durableName}`;if(ports.length===1){total+=await port.consumeBatch(accept,child);continue}if(await scheduler.run(ref,async()=>{total+=await port.consumeBatch(accept,child)},child))faults.delete(ref)}return total},heldRoutes(){return[...faults.values()]}}}function openBinding(transport,profile,consumer,binding,signal){return transport.consumer(binding.stream,{consumerName:binding.durableName,expectedStream:binding.stream,expectedSubject:binding.subject,deploymentDomainRef:profile.broker.deploymentDomainRef,timeoutMs:profile.broker.timeoutMs,maxPayloadBytes:profile.broker.maxPayloadBytes,retryDelayMs:1e3,batchSize:consumer.batchSize,fetchExpiresMs:consumer.fetchExpiresMs},signal)}async function openNodeWorkerSession(file,serviceRef,signal){const loaded=await loadNodeConnectionProfile(file,serviceRef);const identity=await loadNodeConnectionIdentity(loaded);const profile=loaded.profile;const transport=await openTransport(identity,signal);try{const signer=async()=>{const current=await loadNodeSigningIdentity(profile,()=>new Date);if(!current)throw new Error("SIGNER_NOT_CONFIGURED");return current};const publisher=routedPublisher(transport,profile,async(event,child)=>(await signer()).sign(event,child));const consumer=await routedConsumer(transport,profile,signal);return{profile,revision:loaded.revision,publisher,consumer,verifyOrigin:identity.verifyOrigin,refreshOrigin:async event=>(await signer()).currentOrigin(event.audience),isClosed:transport.isClosed,close:transport.close}}catch(error){await transport.close();throw error}}async function openTransport(identity,signal){const broker=identity.profile.broker;return identity.withBrokerCredentials(({credential,ca})=>openNatsDeliverySession({serverUrl:broker.serverUrl,expectedDnsName:broker.expectedDnsName,timeoutMs:broker.timeoutMs,signal,...ca?{caPem:ca}:{},authenticator:broker.authentication==="NATS_CREDS"?credsAuthenticator(credential):nkeyAuthenticator(new TextEncoder().encode(new TextDecoder().decode(credential).trim()))}))}import{loadNodeConnectionProfile as loadNodeConnectionProfile2,EventSdkConfigurationError as EventSdkConfigurationError2}from"@eventsdk/sdk/node-config";async function runNodeEventWorker(options,signal){const interval=bounded(options.intervalMs??1e3,100,3e4),retry=bounded(options.reconnectMs??2e3,100,3e4);const state=async(status,revision)=>options.state?.({schemaVersion:1,status,connected:status==="CONNECTED",at:new Date().toISOString(),...revision?{revision}:{}});try{while(!signal.aborted){const config=await loadNodeConnectionProfile2(options.file,options.serviceRef);if(config.profile.mode==="DISABLED"){await state("DISABLED",config.revision);return}try{await connected(options,signal,interval,state)}catch{if(signal.aborted)break;await state("RECONNECTING");await pause(retry,signal)}}}finally{await state("STOPPED")}}async function connected(options,signal,interval,state){const session=await(options.open??openNodeWorkerSession)(options.file,options.serviceRef,signal);let task;let closing;const close=()=>closing??=session.close();const abort=()=>{void close()};signal.addEventListener("abort",abort,{once:true});try{task=await options.tasks(session);if(session.isClosed())throw new Error("CONNECTION_CLOSED");await state("CONNECTED",session.revision);let heartbeatAt=Date.now();const heartbeatMs=bounded(options.heartbeatMs??3e4,100,3e5);while(!signal.aborted&&!session.isClosed()){const current=await loadNodeConnectionProfile2(options.file,options.serviceRef);if(current.revision!==session.revision)throw new EventSdkConfigurationError2("CONFIGURATION_CHANGED");await task.tick(signal);if(!signal.aborted&&!session.isClosed()&&Date.now()-heartbeatAt>=heartbeatMs){await state("CONNECTED",session.revision);heartbeatAt=Date.now()}await pause(interval,signal)}if(!signal.aborted)throw new Error("CONNECTION_CLOSED")}finally{signal.removeEventListener("abort",abort);await close();await task?.close()}}function bounded(value,min,max){if(!Number.isSafeInteger(value)||value<min||value>max)throw new EventSdkConfigurationError2("WORKER_BOUNDS_INVALID");return value}async function pause(ms,signal){if(signal.aborted)return;await new Promise(resolve=>{const finish=()=>{clearTimeout(timer);signal.removeEventListener("abort",finish);resolve()};const timer=setTimeout(finish,ms);signal.addEventListener("abort",finish,{once:true})})}export{createNativeRouteScheduler,openNodeWorkerSession,runNodeEventWorker};

package/dist/node-worker/lifecycle.d.ts

@@ -0,0 +1,19 @@
+import { openNodeWorkerSession, type NodeWorkerSession } from './session.js';
+import type { NodeWorkerObservation } from '@eventsdk/sdk/contracts';
+export type NodeWorkerState = NodeWorkerObservation;
+export interface NodeWorkerTask {
+    tick(signal: AbortSignal): Promise<void>;
+    close(): Promise<void>;
+}
+export interface NodeWorkerOptions {
+    file: string;
+    serviceRef: string;
+    intervalMs?: number;
+    reconnectMs?: number;
+    heartbeatMs?: number;
+    tasks(session: NodeWorkerSession): Promise<NodeWorkerTask>;
+    state?(state: NodeWorkerState): Promise<void> | void;
+    open?: typeof openNodeWorkerSession;
+}
+export declare function runNodeEventWorker(options: NodeWorkerOptions, signal: AbortSignal): Promise<void>;
+export declare function pause(ms: number, signal: AbortSignal): Promise<void>;

package/dist/node-worker/route-scheduler.d.ts

@@ -0,0 +1,17 @@
+export interface NativeRouteFault {
+    routeRef: string;
+    reasonCode: string;
+    retryAt: number;
+}
+export declare function createNativeRouteScheduler(options?: {
+    now?: () => number;
+    retryMs?: number;
+    capacity?: number;
+    fault?: (value: NativeRouteFault) => void;
+}): {
+    run(routeRef: string, work: () => Promise<unknown>, signal: AbortSignal): Promise<boolean>;
+    held(): {
+        routeRef: string;
+        retryAt: number;
+    }[];
+};

package/dist/node-worker/session.d.ts

@@ -0,0 +1,15 @@
+import type { CloudEvent } from '@eventsdk/sdk/contracts';
+export declare function openNodeWorkerSession(file: string, serviceRef: string, signal: AbortSignal): Promise<{
+    profile: import("@eventsdk/sdk/contracts").NodeConnectionProfile;
+    revision: string;
+    publisher: import("@eventsdk/sdk/core").PublishPort | null;
+    consumer: {
+        consumeBatch(accept: import("@eventsdk/sdk/transport-nats").AcceptDelivery, child: AbortSignal): Promise<number>;
+        heldRoutes(): import("./route-scheduler.js").NativeRouteFault[];
+    } | null;
+    verifyOrigin: (event: import("@eventsdk/sdk/contracts").CloudEvent, proof: string, signal: AbortSignal) => Promise<import("@eventsdk/sdk/identity-contracts").OriginVerification>;
+    refreshOrigin: (event: CloudEvent) => Promise<import("@eventsdk/sdk/identity-contracts").VerifiedOrigin>;
+    isClosed: () => boolean;
+    close: () => Promise<void>;
+}>;
+export type NodeWorkerSession = Awaited<ReturnType<typeof openNodeWorkerSession>>;

package/dist/provisioner/application/apply.d.ts

@@ -0,0 +1,11 @@
+import type { ProvisioningPlan } from '../planning/plan.js';
+import type { ApplyResult, DeploymentJournal, BrokerManagementPort, DeploymentAuthorization } from './ports.js';
+export interface ApplyRequest {
+    readonly manifest: unknown;
+    readonly journal?: DeploymentJournal;
+    readonly plan: ProvisioningPlan;
+    readonly authorization: DeploymentAuthorization;
+    readonly broker: BrokerManagementPort;
+    readonly signal: AbortSignal;
+}
+export declare function applyProvisioning(input: ApplyRequest): Promise<ApplyResult>;

package/dist/provisioner/application/ports.d.ts

@@ -0,0 +1,44 @@
+import type { ResourceConfig, ResourceSnapshot } from '../manifest/types.js';
+export interface DeploymentAuthorization {
+    readonly role: 'deployment';
+    readonly subject: string;
+    readonly deploymentDomainRef: string;
+    readonly allowedResourceKeys: readonly string[];
+    readonly allowedSubjects: readonly string[];
+}
+export interface ManagementLease {
+    readonly generation: string;
+    release(): Promise<void>;
+}
+export interface BrokerReadPort {
+    read(signal: AbortSignal): Promise<readonly ResourceSnapshot[]>;
+}
+export interface BrokerManagementPort extends BrokerReadPort {
+    read(signal: AbortSignal): Promise<readonly ResourceSnapshot[]>;
+    acquireLease(domain: string, signal: AbortSignal): Promise<ManagementLease>;
+    create(config: ResourceConfig, lease: ManagementLease, signal: AbortSignal): Promise<void>;
+    update(config: ResourceConfig, expectedDigest: string, lease: ManagementLease, signal: AbortSignal): Promise<void>;
+}
+export interface OperationReceipt {
+    readonly resourceKey: string;
+    readonly action: string;
+    readonly outcome: 'VERIFIED' | 'UNKNOWN' | 'BLOCKED';
+    readonly reason: string;
+    readonly observedDigest?: string;
+    readonly nativeConfigDigest?: string;
+    readonly journalPersisted?: boolean;
+}
+export interface ApplyResult {
+    readonly planRef: string;
+    readonly state: 'VERIFIED' | 'PARTIAL' | 'BLOCKED';
+    readonly receipts: readonly OperationReceipt[];
+    readonly leaseReleased?: boolean;
+}
+export interface DeploymentJournal {
+    append(entry: {
+        readonly planRef: string;
+        readonly resourceKey: string;
+        readonly phase: 'INTENT' | 'RESULT';
+        readonly receipt?: OperationReceipt;
+    }, signal: AbortSignal): Promise<void>;
+}

package/dist/provisioner/application/verify.d.ts

@@ -0,0 +1,7 @@
+import type { ProvisioningPlan } from '../planning/plan.js';
+import type { BrokerReadPort } from './ports.js';
+export declare function verifyProvisioning(manifest: unknown, broker: BrokerReadPort, signal: AbortSignal): Promise<{
+    verified: boolean;
+    plan: ProvisioningPlan;
+}>;
+export declare function provisioningStatus(broker: BrokerReadPort, signal: AbortSignal): Promise<readonly import("../index.js").ResourceSnapshot[]>;

package/dist/provisioner/cli/arguments.d.ts

@@ -0,0 +1,9 @@
+export interface CliArguments {
+    readonly command: 'validate' | 'plan' | 'apply' | 'verify' | 'status' | 'conformance';
+    readonly manifestPath?: string;
+    readonly snapshotPath?: string;
+    readonly adapterPath?: string;
+    readonly planPath?: string;
+    readonly timeoutMs: number;
+}
+export declare function parseArguments(args: readonly string[]): CliArguments;

package/dist/provisioner/cli/live-command.d.ts

@@ -0,0 +1,7 @@
+import type { CapabilityManifest } from '../manifest/types.js';
+import type { CliArguments } from './arguments.js';
+export interface CliResult {
+    readonly value: unknown;
+    readonly exitCode: number;
+}
+export declare function runLiveCommand(args: CliArguments, manifest: CapabilityManifest | undefined, signal: AbortSignal): Promise<CliResult>;