@eventsdk/sdk 0.3.1 → 0.4.0

package/dist/contracts/validation/event-link.d.ts

@@ -0,0 +1,9 @@
+import type { EventLinkAuthorizationRequest } from '../generated/event-link-authorization-request.js';
+import type { EventLinkTokenRequest } from '../generated/event-link-token-request.js';
+import type { EventLinkProposal } from '../generated/event-link-proposal.js';
+export declare const validateEventLinkAuthorizationRequest: (value: unknown) => import("./contract-error.js").ValidationResult<EventLinkAuthorizationRequest>;
+export declare const validateEventLinkTokenRequest: (value: unknown) => import("./contract-error.js").ValidationResult<EventLinkTokenRequest>;
+export declare const validateEventLinkProposal: (value: unknown) => import("./contract-error.js").ValidationResult<EventLinkProposal>;
+export declare const parseEventLinkAuthorizationRequest: (value: unknown) => EventLinkAuthorizationRequest;
+export declare const parseEventLinkTokenRequest: (value: unknown) => EventLinkTokenRequest;
+export declare const parseEventLinkProposal: (value: unknown) => EventLinkProposal;

package/dist/event-link/errors.d.ts

@@ -0,0 +1,5 @@
+export declare class EventLinkProtocolError extends Error {
+    readonly code: 'INVALID' | 'FORBIDDEN' | 'EXPIRED' | 'CHANGED' | 'CONFLICT' | 'CODE_INVALID' | 'UNKNOWN';
+    constructor(code: 'INVALID' | 'FORBIDDEN' | 'EXPIRED' | 'CHANGED' | 'CONFLICT' | 'CODE_INVALID' | 'UNKNOWN');
+}
+export declare function eventLinkInput<T>(parse: () => T): T;

package/dist/event-link/exchange.d.ts

@@ -0,0 +1,9 @@
+import { type EventLinkProposal } from '@eventsdk/sdk/contracts';
+import { type EventLinkSenderBinding } from './protocol.js';
+export interface EventLinkExchangeOptions {
+    readonly fetch?: typeof fetch;
+    readonly now?: () => number;
+    readonly signal?: AbortSignal;
+    readonly timeoutMs?: number;
+}
+export declare function exchangeEventLinkCode(binding: EventLinkSenderBinding, code: string, options?: EventLinkExchangeOptions): Promise<EventLinkProposal>;

package/dist/event-link/index.d.ts

@@ -0,0 +1,12 @@
+export { EventLinkProtocolError } from './errors.js';
+export { EVENT_LINK_MAX_BYTES, createEventLinkVerifier, createEventLinkState, eventLinkChallenge, eventLinkHash, } from './primitives.js';
+export { assertEventLinkRegistration, eventLinkRegistrationRevision } from './registration.js';
+export type { EventLinkClientRegistration, EventLinkReceiverRegistration } from './registration.js';
+export { buildEventLinkAuthorizationUrl, parseEventLinkAuthorization, parseEventLinkToken, validateEventLinkCallback, validateEventLinkProposalBinding, } from './protocol.js';
+export type { EventLinkSenderBinding } from './protocol.js';
+export { exchangeEventLinkCode } from './exchange.js';
+export type { EventLinkExchangeOptions } from './exchange.js';
+export { planEventLinkCallback, continueEventLinkAuthorization } from './sender.js';
+export type { EventLinkSenderSnapshot, EventLinkSenderClaim, EventLinkSenderPort, } from './sender.js';
+export { EventLinkReceiver } from './receiver.js';
+export type { EventLinkConsent, EventLinkReceiverActor, EventLinkReceiverState, EventLinkReceiverRecord, EventLinkReceiverTransaction, EventLinkReceiverPort, } from './receiver-ports.js';

package/dist/event-link/index.js

@@ -0,0 +1 @@
+var EventLinkProtocolError=class extends Error{constructor(code){super("EVENT_LINK_"+code);this.code=code;this.name="EventLinkProtocolError"}code};function eventLinkInput(parse){try{return parse()}catch{throw new EventLinkProtocolError("INVALID")}}import{createHash,randomBytes}from"node:crypto";var EVENT_LINK_MAX_BYTES=8192;var eventLinkHash=value=>createHash("sha256").update(value).digest("hex");var createEventLinkVerifier=()=>randomBytes(48).toString("base64url");var createEventLinkState=()=>randomBytes(32).toString("base64url");function eventLinkChallenge(verifier){if(!/^[A-Za-z0-9._~-]{43,128}$/.test(verifier))throw new EventLinkProtocolError("INVALID");return createHash("sha256").update(verifier).digest("base64url")}function eventLinkUrl(value,allowLoopbackHttp=false){const url=new URL(value);const loopback=["localhost","127.0.0.1","[::1]"].includes(url.hostname);if(url.username||url.password||url.hash||url.href!==value||url.protocol!=="https:"&&!(allowLoopbackHttp&&loopback&&url.protocol==="http:"))throw new EventLinkProtocolError("INVALID");return url}function eventLinkOrigin(value,allowLoopbackHttp=false){const url=eventLinkUrl(value+"/",allowLoopbackHttp);if(url.origin!==value)throw new EventLinkProtocolError("INVALID");return url}function eventLinkCallbackUrl(value,allowLoopbackHttp=false){const url=eventLinkUrl(value,allowLoopbackHttp);if(["code","error","state","iss"].some(key=>url.searchParams.has(key)))throw new EventLinkProtocolError("INVALID");return url}function eventLinkFields(params,fields){if(Buffer.byteLength(params.toString())>EVENT_LINK_MAX_BYTES)throw new EventLinkProtocolError("INVALID");const result=Object.create(null);for(const[key,value]of params){if(!fields.includes(key)||Object.hasOwn(result,key))throw new EventLinkProtocolError("INVALID");result[key]=value}return result}function eventLinkSize(value){if(Buffer.byteLength(JSON.stringify(value))>EVENT_LINK_MAX_BYTES)throw new EventLinkProtocolError("INVALID")}import{canonicalJson,parseExchangeRegistration}from"@eventsdk/sdk/contracts";function assertEventLinkRegistration(request,config){eventLinkInput(()=>{eventLinkOrigin(config.origin,config.allowLoopbackHttp);eventLinkCallbackUrl(request.redirect_uri,config.allowLoopbackHttp);const matches=config.clients.filter(client2=>client2.clientId===request.client_id&&client2.redirectUri===request.redirect_uri);if(matches.length!==1)throw new Error("registration");const client=matches[0];if(!client||canonicalJson(client.source)!==canonicalJson(request.source)||!client.eventTypes.includes(request.event_type))throw new Error("binding");parseExchangeRegistration({schemaVersion:1,requestId:request.request_id,expectedRevision:null,source:request.source,target:{serviceRef:config.serviceRef,tenantRef:"registration-validation"},grant:{grantRef:request.grant_ref,version:1,eventType:request.event_type,consumerRef:config.consumerRef},status:"ACTIVE"})})}var eventLinkRegistrationRevision=config=>eventLinkHash(canonicalJson(config));function eventLinkRedirect(request,origin,result){const url=new URL(request.redirect_uri);url.searchParams.set("state",request.state);url.searchParams.set("iss",origin);for(const[key,value]of Object.entries(result))url.searchParams.set(key,value);return url.href}import{canonicalJson as canonicalJson2,parseEventLinkAuthorizationRequest,parseEventLinkTokenRequest,parseEventLinkProposal,parseJsonStrict}from"@eventsdk/sdk/contracts";import{deriveExchangeConnectionRef}from"@eventsdk/sdk/core";import{createHash as createHash2}from"node:crypto";var authorizationFields=["profile","response_type","client_id","redirect_uri","scope","state","code_challenge","code_challenge_method","request_id","source","event_type","grant_ref","grant_version"];var tokenFields=["grant_type","client_id","redirect_uri","code","code_verifier"];function parseEventLinkAuthorization(params,registration){return eventLinkInput(()=>{const fields=eventLinkFields(params,authorizationFields);const request=parseEventLinkAuthorizationRequest({...fields,source:parseJsonStrict(fields.source??"")});assertEventLinkRegistration(request,registration);return request})}function parseEventLinkToken(params){return eventLinkInput(()=>{const value=params instanceof URLSearchParams?eventLinkFields(params,tokenFields):params;eventLinkSize(value);return parseEventLinkTokenRequest(value)})}function buildEventLinkAuthorizationUrl(binding){return eventLinkInput(()=>{eventLinkOrigin(binding.origin,binding.allowLoopbackHttp);eventLinkCallbackUrl(binding.redirectUri,binding.allowLoopbackHttp);const request=parseEventLinkAuthorizationRequest({profile:"event-link/1",response_type:"code",client_id:binding.clientId,redirect_uri:binding.redirectUri,scope:"eventsdk.connection.authorize",state:binding.state,code_challenge:eventLinkChallenge(binding.codeVerifier),code_challenge_method:"S256",request_id:binding.requestId,source:binding.source,event_type:binding.eventType,grant_ref:binding.grantRef,grant_version:"1"});const params=new URLSearchParams({...request,source:JSON.stringify(request.source)});eventLinkFields(params,authorizationFields);return new URL("/eventsdk/connect/authorize?"+params,binding.origin).href})}function validateEventLinkCallback(params,binding){const fields=eventLinkFields(params,["code","error","state","iss"]);if(Object.values(fields).some(value=>value.length>512)||fields.state!==binding.state||fields.iss!==binding.origin||Object.hasOwn(fields,"code")===Object.hasOwn(fields,"error"))throw new EventLinkProtocolError("INVALID");if(fields.error!==void 0){if(fields.error!=="access_denied")throw new EventLinkProtocolError("INVALID");return null}if(!fields.code||!/^[A-Za-z0-9_-]{32,256}$/.test(fields.code))throw new EventLinkProtocolError("INVALID");return fields.code}async function validateEventLinkProposalBinding(raw,binding,now=Date.now()){if(!Number.isSafeInteger(binding.expiresAt)||!Number.isSafeInteger(now))throw new EventLinkProtocolError("INVALID");const proposal=eventLinkInput(()=>{eventLinkSize(raw);return parseEventLinkProposal(raw)});const expected=await deriveExchangeConnectionRef({source:binding.source.source,from:{serviceRef:binding.source.serviceRef,tenantRef:binding.source.tenantRef},to:proposal.target},{sha256:async value=>createHash2("sha256").update(value).digest("hex")});if(proposal.requestId!==binding.requestId||canonicalJson2(proposal.source)!==canonicalJson2(binding.source)||proposal.target.serviceRef!==binding.targetServiceRef||proposal.grant.eventType!==binding.eventType||proposal.grant.grantRef!==binding.grantRef||Date.parse(proposal.expiresAt)<=now||Date.parse(proposal.expiresAt)>binding.expiresAt||proposal.connectionRef!==expected)throw new EventLinkProtocolError("UNKNOWN");return proposal}import{parseJsonStrict as parseJsonStrict2}from"@eventsdk/sdk/contracts";import{boundedOperation}from"@eventsdk/sdk/core";async function readProposal(response,signal){if(!response.ok||!/^application\/json(?:\s*;|$)/i.test(response.headers.get("content-type")??"")||!response.body){void response.body?.cancel().catch(()=>{});throw new EventLinkProtocolError("UNKNOWN")}const reader=response.body.getReader(),chunks=[];const cancel=()=>{void reader.cancel().catch(()=>{})};signal.addEventListener("abort",cancel,{once:true});let size=0;try{signal.throwIfAborted();while(true){const part=await reader.read();signal.throwIfAborted();if(part.done)break;size+=part.value.length;if(size>EVENT_LINK_MAX_BYTES)throw new EventLinkProtocolError("UNKNOWN");chunks.push(part.value)}return parseJsonStrict2(new TextDecoder("utf-8",{fatal:true}).decode(Buffer.concat(chunks)))}finally{signal.removeEventListener("abort",cancel);if(!signal.aborted)cancel();reader.releaseLock()}}async function exchangeEventLinkCode(binding,code,options={}){const timeoutMs=options.timeoutMs??15e3;if(!Number.isSafeInteger(timeoutMs)||timeoutMs<1||timeoutMs>15e3)throw new EventLinkProtocolError("INVALID");try{buildEventLinkAuthorizationUrl(binding);const token=parseEventLinkToken({grant_type:"authorization_code",client_id:binding.clientId,redirect_uri:binding.redirectUri,code,code_verifier:binding.codeVerifier});return await boundedOperation({timeoutMs,...options.signal?{signal:options.signal}:{}},async signal=>{const response=await(options.fetch??fetch)(new URL("/eventsdk/connect/token",binding.origin),{method:"POST",credentials:"omit",redirect:"error",signal,headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:new URLSearchParams({...token})});if(signal.aborted){void response.body?.cancel().catch(()=>{});signal.throwIfAborted()}return validateEventLinkProposalBinding(await readProposal(response,signal),binding,(options.now??Date.now)())})}catch{throw new EventLinkProtocolError("UNKNOWN")}}import{canonicalJson as canonicalJson3}from"@eventsdk/sdk/contracts";function planEventLinkCallback(current,params,now=Date.now()){if(!Number.isSafeInteger(current.binding.expiresAt)||!Number.isSafeInteger(now))throw new EventLinkProtocolError("INVALID");if(current.phase!=="LOGIN"||current.binding.expiresAt<=now)throw new EventLinkProtocolError("CHANGED");const code=validateEventLinkCallback(params,current.binding);return{snapshot:structuredClone(current),code,phase:code===null?"DENIED":"EXCHANGING"}}async function assertCompletion(current,claim,proposal,now){if(current.phase!=="EXCHANGING"||current.binding.expiresAt<=now||canonicalJson3(current.binding)!==canonicalJson3(claim.snapshot.binding))throw new EventLinkProtocolError("CHANGED");await validateEventLinkProposalBinding(proposal,current.binding,now)}async function continueEventLinkAuthorization(port,params,options={}){const now=options.now??Date.now;const claim=await port.claim(current=>planEventLinkCallback(current,params,now()));if(claim.code===null)return{phase:"DENIED",claim};let proposal;try{proposal=await exchangeEventLinkCode(claim.snapshot.binding,claim.code,options)}catch{await port.unknown(claim);return{phase:"UNKNOWN",claim}}try{await port.confirm(claim,proposal,current=>assertCompletion(current,claim,proposal,now()))}catch(error){await port.unknown(claim);throw error}return{phase:"CONFIRM",claim}}import{randomUUID as randomUUID2}from"node:crypto";import{canonicalJson as canonicalJson4,parseEventLinkProposal as parseEventLinkProposal2}from"@eventsdk/sdk/contracts";import{deriveExchangeConnectionRef as deriveExchangeConnectionRef2}from"@eventsdk/sdk/core";import{createHash as createHash3,randomUUID}from"node:crypto";function sameEventLinkActor(a,b){return a!==null&&["actorRef","tenantRef","sessionBinding","authorityVersion"].every(key=>a[key]===b[key])}var eventLinkConsentBinding=(ref,actor)=>eventLinkHash(canonicalJson4([ref,actor]));function eventLinkPending(value,proof,config,now){if(!value||!/^[A-Za-z0-9_-]{43}$/.test(proof)||value.proofHash!==eventLinkHash(proof))throw new EventLinkProtocolError("FORBIDDEN");if(value.expiresAt<=now)throw new EventLinkProtocolError("EXPIRED");if(value.registrationRevision!==eventLinkRegistrationRevision(config))throw new EventLinkProtocolError("CHANGED");assertEventLinkRegistration(value.request,config);return value}async function createEventLinkProposal(value,config,actor,now){const source=value.request.source,target={serviceRef:config.serviceRef,tenantRef:actor.tenantRef};const connectionRef=await deriveExchangeConnectionRef2({source:source.source,from:{serviceRef:source.serviceRef,tenantRef:source.tenantRef},to:target},{sha256:async input=>createHash3("sha256").update(input).digest("hex")});const proposal=parseEventLinkProposal2({schemaVersion:1,requestId:value.request.request_id,source,target,grant:{grantRef:value.request.grant_ref,version:1,eventType:value.request.event_type,consumerRef:config.consumerRef},connectionRef,targetDisplayName:[...actor.tenantDisplayName.trim()].slice(0,160).join(""),approvalRef:"urn:eventsdk:approval:"+randomUUID(),expiresAt:new Date(Math.min(value.expiresAt,now+6e4)).toISOString()});eventLinkSize(proposal);return proposal}var EventLinkReceiver=class{constructor(port,registration,now=Date.now){this.port=port;this.registration=registration;this.now=now}port;registration;now;async begin(params){const config=structuredClone(this.registration()),request=parseEventLinkAuthorization(params,config);const proof=createEventLinkState();const pending={ref:randomUUID2(),proofHash:eventLinkHash(proof),registrationRevision:eventLinkRegistrationRevision(config),request,expiresAt:this.now()+24e4,actor:null,codeHash:null,codeExpiresAt:null,proposal:null,state:"PENDING"};await this.port.transact(async tx=>{if(await tx.requestBySource(request.client_id,request.request_id))throw new EventLinkProtocolError("CONFLICT");await tx.insertRequest(pending)});return{ref:pending.ref,proof}}async consent(ref,proof,actorInput){const actor=structuredClone(actorInput);return this.port.transact(async tx=>{await tx.assertActor(actor);const value=eventLinkPending(await tx.request(ref),proof,this.registration(),this.now());if(value.actor&&!sameEventLinkActor(value.actor,actor))throw new EventLinkProtocolError("CHANGED");if(value.state!=="PENDING")throw new EventLinkProtocolError("CONFLICT");await tx.updateRequest({...value,actor:structuredClone(actor)},"PENDING");await tx.assertActor(actor);eventLinkPending(value,proof,this.registration(),this.now());return{ref,source:value.request.source,eventType:value.request.event_type,expiresAt:value.expiresAt,actor,consentBinding:eventLinkConsentBinding(ref,actor)}})}async decide(ref,proof,actorInput,consentBinding,decision){if(decision!=="allow"&&decision!=="deny")throw new EventLinkProtocolError("INVALID");const actor=structuredClone(actorInput);const config=structuredClone(this.registration()),code=createEventLinkVerifier();return this.port.transact(async tx=>{await tx.assertActor(actor);const value=eventLinkPending(await tx.request(ref),proof,config,this.now());if(value.state!=="PENDING"||!sameEventLinkActor(value.actor,actor)||consentBinding!==eventLinkConsentBinding(ref,actor))throw new EventLinkProtocolError("CHANGED");if(decision==="deny"){await tx.updateRequest({...value,state:"DENIED"},"PENDING");await tx.assertActor(actor);eventLinkPending(value,proof,this.registration(),this.now());return{location:eventLinkRedirect(value.request,config.origin,{error:"access_denied"})}}const proposal=await createEventLinkProposal(value,config,actor,this.now());await tx.approveGrant(proposal,actor,value.request.client_id);await tx.updateRequest({...value,actor:structuredClone(actor),proposal,codeHash:eventLinkHash(code),codeExpiresAt:Date.parse(proposal.expiresAt),state:"APPROVED"},"PENDING");await tx.assertActor(actor);eventLinkPending(value,proof,this.registration(),this.now());if(Date.parse(proposal.expiresAt)<=this.now())throw new EventLinkProtocolError("EXPIRED");return{location:eventLinkRedirect(value.request,config.origin,{code})}})}async exchange(raw){const token=structuredClone(parseEventLinkToken(raw)),config=structuredClone(this.registration());return this.port.transact(async tx=>{const value=await tx.requestByCode(eventLinkHash(token.code));if(!value||value.state!=="APPROVED"||!value.actor||!value.proposal||!value.codeExpiresAt||value.codeExpiresAt<=this.now()||value.expiresAt<=this.now()||value.registrationRevision!==eventLinkRegistrationRevision(config)||token.client_id!==value.request.client_id||token.redirect_uri!==value.request.redirect_uri||eventLinkChallenge(token.code_verifier)!==value.request.code_challenge)throw new EventLinkProtocolError("CODE_INVALID");assertEventLinkRegistration(value.request,config);await tx.assertActor(value.actor);await tx.assertGrant(value.proposal,value.actor);await tx.updateRequest({...value,state:"CONSUMED"},"APPROVED");await tx.assertActor(value.actor);if(value.registrationRevision!==eventLinkRegistrationRevision(this.registration())||value.codeExpiresAt<=this.now())throw new EventLinkProtocolError("CODE_INVALID");return value.proposal})}};export{EVENT_LINK_MAX_BYTES,EventLinkProtocolError,EventLinkReceiver,assertEventLinkRegistration,buildEventLinkAuthorizationUrl,continueEventLinkAuthorization,createEventLinkState,createEventLinkVerifier,eventLinkChallenge,eventLinkHash,eventLinkRegistrationRevision,exchangeEventLinkCode,parseEventLinkAuthorization,parseEventLinkToken,planEventLinkCallback,validateEventLinkCallback,validateEventLinkProposalBinding};

package/dist/event-link/primitives.d.ts

@@ -0,0 +1,10 @@
+export declare const EVENT_LINK_MAX_BYTES = 8192;
+export declare const eventLinkHash: (value: string) => string;
+export declare const createEventLinkVerifier: () => string;
+export declare const createEventLinkState: () => string;
+export declare function eventLinkChallenge(verifier: string): string;
+export declare function eventLinkUrl(value: string, allowLoopbackHttp?: boolean): URL;
+export declare function eventLinkOrigin(value: string, allowLoopbackHttp?: boolean): URL;
+export declare function eventLinkCallbackUrl(value: string, allowLoopbackHttp?: boolean): URL;
+export declare function eventLinkFields(params: URLSearchParams, fields: readonly string[]): Record<string, string>;
+export declare function eventLinkSize(value: unknown): void;

package/dist/event-link/protocol.d.ts

@@ -0,0 +1,21 @@
+import { type EventLinkAuthorizationRequest, type EventLinkTokenRequest, type EventLinkProposal, type ExchangeRegistration } from '@eventsdk/sdk/contracts';
+import { type EventLinkReceiverRegistration } from './registration.js';
+export declare function parseEventLinkAuthorization(params: URLSearchParams, registration: EventLinkReceiverRegistration): EventLinkAuthorizationRequest;
+export declare function parseEventLinkToken(params: URLSearchParams | unknown): EventLinkTokenRequest;
+export interface EventLinkSenderBinding {
+    readonly requestId: string;
+    readonly source: ExchangeRegistration['source'];
+    readonly targetServiceRef: string;
+    readonly origin: string;
+    readonly clientId: string;
+    readonly redirectUri: string;
+    readonly state: string;
+    readonly codeVerifier: string;
+    readonly eventType: string;
+    readonly grantRef: string;
+    readonly expiresAt: number;
+    readonly allowLoopbackHttp?: boolean;
+}
+export declare function buildEventLinkAuthorizationUrl(binding: EventLinkSenderBinding): string;
+export declare function validateEventLinkCallback(params: URLSearchParams, binding: Pick<EventLinkSenderBinding, 'state' | 'origin'>): string | null;
+export declare function validateEventLinkProposalBinding(raw: unknown, binding: EventLinkSenderBinding, now?: number): Promise<EventLinkProposal>;

package/dist/event-link/receiver-ports.d.ts

@@ -0,0 +1,42 @@
+import type { EventLinkAuthorizationRequest, EventLinkProposal } from '@eventsdk/sdk/contracts';
+export interface EventLinkReceiverActor {
+    readonly actorRef: string;
+    readonly tenantRef: string;
+    readonly sessionBinding: string;
+    readonly authorityVersion: string;
+    readonly tenantDisplayName: string;
+}
+export type EventLinkReceiverState = 'PENDING' | 'DENIED' | 'APPROVED' | 'CONSUMED';
+export interface EventLinkReceiverRecord {
+    readonly ref: string;
+    readonly proofHash: string;
+    readonly registrationRevision: string;
+    readonly request: EventLinkAuthorizationRequest;
+    readonly expiresAt: number;
+    readonly actor: EventLinkReceiverActor | null;
+    readonly codeHash: string | null;
+    readonly codeExpiresAt: number | null;
+    readonly proposal: EventLinkProposal | null;
+    readonly state: EventLinkReceiverState;
+}
+export interface EventLinkConsent {
+    readonly ref: string;
+    readonly source: EventLinkAuthorizationRequest['source'];
+    readonly eventType: string;
+    readonly expiresAt: number;
+    readonly actor: EventLinkReceiverActor;
+    readonly consentBinding: string;
+}
+export interface EventLinkReceiverTransaction {
+    assertActor(actor: EventLinkReceiverActor): Promise<void>;
+    request(ref: string): Promise<EventLinkReceiverRecord | null>;
+    requestBySource(clientId: string, requestId: string): Promise<EventLinkReceiverRecord | null>;
+    requestByCode(codeHash: string): Promise<EventLinkReceiverRecord | null>;
+    insertRequest(record: EventLinkReceiverRecord): Promise<void>;
+    updateRequest(record: EventLinkReceiverRecord, expectedState: EventLinkReceiverState): Promise<void>;
+    approveGrant(proposal: EventLinkProposal, actor: EventLinkReceiverActor, clientId: string): Promise<void>;
+    assertGrant(proposal: EventLinkProposal, actor: EventLinkReceiverActor): Promise<void>;
+}
+export interface EventLinkReceiverPort {
+    transact<T>(operation: (tx: EventLinkReceiverTransaction) => Promise<T>): Promise<T>;
+}

package/dist/event-link/receiver.d.ts

@@ -0,0 +1,18 @@
+import type { EventLinkProposal } from '@eventsdk/sdk/contracts';
+import { type EventLinkReceiverRegistration } from './registration.js';
+import type { EventLinkConsent, EventLinkReceiverActor, EventLinkReceiverPort } from './receiver-ports.js';
+export declare class EventLinkReceiver {
+    private readonly port;
+    private readonly registration;
+    private readonly now;
+    constructor(port: EventLinkReceiverPort, registration: () => EventLinkReceiverRegistration, now?: () => number);
+    begin(params: URLSearchParams): Promise<{
+        ref: string;
+        proof: string;
+    }>;
+    consent(ref: string, proof: string, actorInput: EventLinkReceiverActor): Promise<EventLinkConsent>;
+    decide(ref: string, proof: string, actorInput: EventLinkReceiverActor, consentBinding: string, decision: 'allow' | 'deny'): Promise<{
+        location: string;
+    }>;
+    exchange(raw: unknown): Promise<EventLinkProposal>;
+}

package/dist/event-link/registration.d.ts

@@ -0,0 +1,21 @@
+import { type ExchangeRegistration, type EventLinkAuthorizationRequest } from '@eventsdk/sdk/contracts';
+export interface EventLinkClientRegistration {
+    readonly clientId: string;
+    readonly redirectUri: string;
+    readonly source: ExchangeRegistration['source'];
+    readonly eventTypes: readonly string[];
+}
+export interface EventLinkReceiverRegistration {
+    readonly origin: string;
+    readonly serviceRef: string;
+    readonly consumerRef: string;
+    readonly clients: readonly EventLinkClientRegistration[];
+    readonly allowLoopbackHttp?: boolean;
+}
+export declare function assertEventLinkRegistration(request: EventLinkAuthorizationRequest, config: EventLinkReceiverRegistration): void;
+export declare const eventLinkRegistrationRevision: (config: EventLinkReceiverRegistration) => string;
+export declare function eventLinkRedirect(request: EventLinkAuthorizationRequest, origin: string, result: {
+    code: string;
+} | {
+    error: 'access_denied';
+}): string;

package/dist/event-link/sender.d.ts

@@ -0,0 +1,22 @@
+import { type EventLinkProposal } from '@eventsdk/sdk/contracts';
+import { type EventLinkExchangeOptions } from './exchange.js';
+import { type EventLinkSenderBinding } from './protocol.js';
+export interface EventLinkSenderSnapshot {
+    readonly binding: EventLinkSenderBinding;
+    readonly phase: string;
+}
+export interface EventLinkSenderClaim {
+    readonly snapshot: EventLinkSenderSnapshot;
+    readonly code: string | null;
+    readonly phase: 'DENIED' | 'EXCHANGING';
+}
+export interface EventLinkSenderPort<T extends EventLinkSenderClaim> {
+    claim(plan: (current: EventLinkSenderSnapshot) => EventLinkSenderClaim): Promise<T>;
+    confirm(claim: T, proposal: EventLinkProposal, guard: (current: EventLinkSenderSnapshot) => Promise<void>): Promise<void>;
+    unknown(claim: T): Promise<void>;
+}
+export declare function planEventLinkCallback(current: EventLinkSenderSnapshot, params: URLSearchParams, now?: number): EventLinkSenderClaim;
+export declare function continueEventLinkAuthorization<T extends EventLinkSenderClaim>(port: EventLinkSenderPort<T>, params: URLSearchParams, options?: EventLinkExchangeOptions): Promise<{
+    phase: 'DENIED' | 'CONFIRM' | 'UNKNOWN';
+    claim: T;
+}>;

package/dist/index.d.ts

@@ -18,5 +18,7 @@ export * from './node-config/index.js';
 export * as nodeConfig from './node-config/index.js';
 export * from './node-worker/index.js';
 export * as nodeWorker from './node-worker/index.js';
+export * from './event-link/index.js';
+export * as eventLink from './event-link/index.js';
 export type { ResultReadRequest } from './core/index.js';
 export type { ResultReadRequest as IdentityResultReadRequest } from './identity-contracts/index.js';

package/dist/index.js

@@ -18,3 +18,5 @@ export * from './node-config/index.js';
 export * as nodeConfig from './node-config/index.js';
 export * from './node-worker/index.js';
 export * as nodeWorker from './node-worker/index.js';
+export * from './event-link/index.js';
+export * as eventLink from './event-link/index.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eventsdk/sdk",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "private": false,
   "type": "module",
   "license": "Apache-2.0",
@@ -51,6 +51,10 @@
     "./node-worker": {
       "types": "./dist/node-worker/index.d.ts",
       "import": "./dist/node-worker/index.js"
+    },
+    "./event-link": {
+      "types": "./dist/event-link/index.d.ts",
+      "import": "./dist/event-link/index.js"
     }
   },
   "bin": {