@formancy/data-server 0.0.0-stage → 0.1.0

package/dist/identity-keys-cli.d.mts

@@ -0,0 +1 @@
+export {}

package/dist/identity-keys-cli.mjs

@@ -0,0 +1,69 @@
+import { i as oneKeySet, n as openKeySetFile, s as isKeySetAlgorithm } from "./secrets-DhKHG-Y9.mjs";
+import { n as oneKey, t as identityKeySource } from "./identity-settings-BlQY9gHy.mjs";
+import { readFile } from "node:fs/promises";
+//#region src/identity-keys-tool.ts
+const USAGE = "Usage: identity-keys-cli.mjs check <file> <RS256|ES256|EdDSA|HS256>\n       identity-keys-cli.mjs convert <kid>";
+/** The server's own sentence: readKeySet's, resolveSecret's, jose's or the file system's, none of which repeats a key or a secret. */
+function sentence(error) {
+	return error instanceof Error ? error.message : "the key could not be read";
+}
+async function check(path, algorithm, io) {
+	if (!isKeySetAlgorithm(algorithm)) {
+		io.stderr("The algorithm is RS256, ES256, EdDSA or HS256, as FORMANCY_DATA_IDENTITY_ALGORITHM will say.\n");
+		return 1;
+	}
+	try {
+		const set = (await openKeySetFile(path, algorithm)).current();
+		const leftOut = set.leftOut.map((key) => `${key.key} (${key.because})`).join(", ");
+		io.stdout(`in force: ${set.kids.join(", ")}\nleft out: ${leftOut === "" ? "none" : leftOut}\n`);
+		return 0;
+	} catch (error) {
+		io.stderr(`${sentence(error)}\n`);
+		return 1;
+	}
+}
+async function convert(kid, env, io) {
+	const setting = identityKeySource(env);
+	if (!setting.ok) {
+		io.stderr(`${setting.problem}\n`);
+		return 1;
+	}
+	const { source } = setting;
+	if (source.kind === "key-set") {
+		io.stderr("This environment already names a key set file (FORMANCY_DATA_IDENTITY_KEYS_FILE); convert writes one from FORMANCY_DATA_IDENTITY_SECRET or FORMANCY_DATA_IDENTITY_PUBLIC_KEY_FILE.\n");
+		return 1;
+	}
+	try {
+		const set = await oneKeySet(await oneKey(source, {
+			env,
+			readFile: (path) => io.readFile(path)
+		}));
+		const document = await set.document(kid);
+		const was = source.kind === "secret" ? "FORMANCY_DATA_IDENTITY_SECRET" : "FORMANCY_DATA_IDENTITY_PUBLIC_KEY_FILE";
+		io.stdout(document);
+		io.stderr(`Set FORMANCY_DATA_IDENTITY_KEYS_FILE to where this set is, FORMANCY_DATA_IDENTITY_ALGORITHM=${set.algorithm}, and unset ${was}.\n`);
+		return 0;
+	} catch (error) {
+		io.stderr(`${sentence(error)}\n`);
+		return 1;
+	}
+}
+/** The tool's exit status for `argv` (without node and the script). */
+async function runKeysTool(argv, env, io) {
+	const [command, ...rest] = argv;
+	if (command === "check" && rest.length === 2) return check(rest[0], rest[1], io);
+	if (command === "convert" && rest.length === 1) return convert(rest[0], env, io);
+	io.stderr(`${USAGE}\n`);
+	return 1;
+}
+//#endregion
+//#region src/identity-keys-cli.ts
+process.exitCode = await runKeysTool(process.argv.slice(2), process.env, {
+	stdout: (text) => process.stdout.write(text),
+	stderr: (text) => process.stderr.write(text),
+	readFile: (path) => readFile(path, "utf8")
+});
+//#endregion
+export {};
+
+//# sourceMappingURL=identity-keys-cli.mjs.map

package/dist/identity-keys-cli.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-keys-cli.mjs","names":[],"sources":["../src/identity-keys-tool.ts","../src/identity-keys-cli.ts"],"sourcesContent":["import { oneKeySet } from './identity.js'\nimport { openKeySetFile } from './identity-file.js'\nimport { isKeySetAlgorithm } from './identity-keys.js'\nimport { identityKeySource, oneKey } from './identity-settings.js'\n\n/**\n * The key set file tool the image ships as `dist/identity-keys-cli.mjs`\n * (0059), over the server's own functions:\n *\n *   check <file> <algorithm>   readKeySet over the file: what is in force, what is left out; exit 1 with its sentence if refused\n *   convert <kid>              the key FORMANCY_DATA_IDENTITY_SECRET or _PUBLIC_KEY_FILE names, as a one-key set on stdout\n *\n * `check` is what an operator's job runs before it renames a file into place:\n * a refused file left there stops the server's next start. `convert` reads\n * the setting through identityKeySource and resolveSecret, as main.ts does,\n * so the key it writes is the key the server verifies with today.\n *\n * Nothing it prints to stderr holds key material; `convert`'s stdout is key\n * material, the file the operator asked for.\n */\n\nexport interface KeysToolIo {\n  stdout(text: string): void\n  stderr(text: string): void\n  readFile(path: string): Promise<string>\n}\n\nconst USAGE = 'Usage: identity-keys-cli.mjs check <file> <RS256|ES256|EdDSA|HS256>\\n       identity-keys-cli.mjs convert <kid>'\n\n/** The server's own sentence: readKeySet's, resolveSecret's, jose's or the file system's, none of which repeats a key or a secret. */\nfunction sentence(error: unknown): string {\n  return error instanceof Error ? error.message : 'the key could not be read'\n}\n\nasync function check(path: string, algorithm: string, io: KeysToolIo): Promise<number> {\n  if (!isKeySetAlgorithm(algorithm)) {\n    io.stderr('The algorithm is RS256, ES256, EdDSA or HS256, as FORMANCY_DATA_IDENTITY_ALGORITHM will say.\\n')\n    return 1\n  }\n  try {\n    // Read as the server reads it, through readKeySetText: a path that is\n    // not a regular file is refused here as it would be on SIGHUP.\n    const set = (await openKeySetFile(path, algorithm)).current()\n    const leftOut = set.leftOut.map((key) => `${key.key} (${key.because})`).join(', ')\n    io.stdout(`in force: ${set.kids.join(', ')}\\nleft out: ${leftOut === '' ? 'none' : leftOut}\\n`)\n    return 0\n  } catch (error) {\n    io.stderr(`${sentence(error)}\\n`)\n    return 1\n  }\n}\n\nasync function convert(kid: string, env: Readonly<Record<string, string | undefined>>, io: KeysToolIo): Promise<number> {\n  const setting = identityKeySource(env)\n  if (!setting.ok) {\n    io.stderr(`${setting.problem}\\n`)\n    return 1\n  }\n  const { source } = setting\n  if (source.kind === 'key-set') {\n    io.stderr('This environment already names a key set file (FORMANCY_DATA_IDENTITY_KEYS_FILE); convert writes one from FORMANCY_DATA_IDENTITY_SECRET or FORMANCY_DATA_IDENTITY_PUBLIC_KEY_FILE.\\n')\n    return 1\n  }\n  try {\n    const set = await oneKeySet(await oneKey(source, { env, readFile: (path) => io.readFile(path) }))\n    const document = await set.document(kid)\n    const was = source.kind === 'secret' ? 'FORMANCY_DATA_IDENTITY_SECRET' : 'FORMANCY_DATA_IDENTITY_PUBLIC_KEY_FILE'\n    io.stdout(document)\n    io.stderr(`Set FORMANCY_DATA_IDENTITY_KEYS_FILE to where this set is, FORMANCY_DATA_IDENTITY_ALGORITHM=${set.algorithm}, and unset ${was}.\\n`)\n    return 0\n  } catch (error) {\n    io.stderr(`${sentence(error)}\\n`)\n    return 1\n  }\n}\n\n/** The tool's exit status for `argv` (without node and the script). */\nexport async function runKeysTool(argv: readonly string[], env: Readonly<Record<string, string | undefined>>, io: KeysToolIo): Promise<number> {\n  const [command, ...rest] = argv\n  if (command === 'check' && rest.length === 2) return check(rest[0] as string, rest[1] as string, io)\n  if (command === 'convert' && rest.length === 1) return convert(rest[0] as string, env, io)\n  io.stderr(`${USAGE}\\n`)\n  return 1\n}\n","import { readFile } from 'node:fs/promises'\nimport { runKeysTool } from './identity-keys-tool.js'\n\n// `node dist/identity-keys-cli.mjs check <file> <algorithm> | convert <kid>`:\n// the image's key set file tool (0059), an entry beside main.mjs. What it\n// does is runKeysTool's, which its tests drive; this only hands it the process.\nprocess.exitCode = await runKeysTool(process.argv.slice(2), process.env, {\n  stdout: (text) => process.stdout.write(text),\n  stderr: (text) => process.stderr.write(text),\n  readFile: (path) => readFile(path, 'utf8'),\n})\n"],"mappings":";;;;AA2BA,MAAM,QAAQ;;AAGd,SAAS,SAAS,OAAwB;CACxC,OAAO,iBAAiB,QAAQ,MAAM,UAAU;AAClD;AAEA,eAAe,MAAM,MAAc,WAAmB,IAAiC;CACrF,IAAI,CAAC,kBAAkB,SAAS,GAAG;EACjC,GAAG,OAAO,gGAAgG;EAC1G,OAAO;CACT;CACA,IAAI;EAGF,MAAM,OAAO,MAAM,eAAe,MAAM,SAAS,EAAA,CAAG,QAAQ;EAC5D,MAAM,UAAU,IAAI,QAAQ,KAAK,QAAQ,GAAG,IAAI,IAAI,IAAI,IAAI,QAAQ,EAAE,CAAC,CAAC,KAAK,IAAI;EACjF,GAAG,OAAO,aAAa,IAAI,KAAK,KAAK,IAAI,EAAE,cAAc,YAAY,KAAK,SAAS,QAAQ,GAAG;EAC9F,OAAO;CACT,SAAS,OAAO;EACd,GAAG,OAAO,GAAG,SAAS,KAAK,EAAE,GAAG;EAChC,OAAO;CACT;AACF;AAEA,eAAe,QAAQ,KAAa,KAAmD,IAAiC;CACtH,MAAM,UAAU,kBAAkB,GAAG;CACrC,IAAI,CAAC,QAAQ,IAAI;EACf,GAAG,OAAO,GAAG,QAAQ,QAAQ,GAAG;EAChC,OAAO;CACT;CACA,MAAM,EAAE,WAAW;CACnB,IAAI,OAAO,SAAS,WAAW;EAC7B,GAAG,OAAO,sLAAsL;EAChM,OAAO;CACT;CACA,IAAI;EACF,MAAM,MAAM,MAAM,UAAU,MAAM,OAAO,QAAQ;GAAE;GAAK,WAAW,SAAS,GAAG,SAAS,IAAI;EAAE,CAAC,CAAC;EAChG,MAAM,WAAW,MAAM,IAAI,SAAS,GAAG;EACvC,MAAM,MAAM,OAAO,SAAS,WAAW,kCAAkC;EACzE,GAAG,OAAO,QAAQ;EAClB,GAAG,OAAO,+FAA+F,IAAI,UAAU,cAAc,IAAI,IAAI;EAC7I,OAAO;CACT,SAAS,OAAO;EACd,GAAG,OAAO,GAAG,SAAS,KAAK,EAAE,GAAG;EAChC,OAAO;CACT;AACF;;AAGA,eAAsB,YAAY,MAAyB,KAAmD,IAAiC;CAC7I,MAAM,CAAC,SAAS,GAAG,QAAQ;CAC3B,IAAI,YAAY,WAAW,KAAK,WAAW,GAAG,OAAO,MAAM,KAAK,IAAc,KAAK,IAAc,EAAE;CACnG,IAAI,YAAY,aAAa,KAAK,WAAW,GAAG,OAAO,QAAQ,KAAK,IAAc,KAAK,EAAE;CACzF,GAAG,OAAO,GAAG,MAAM,GAAG;CACtB,OAAO;AACT;;;AC7EA,QAAQ,WAAW,MAAM,YAAY,QAAQ,KAAK,MAAM,CAAC,GAAG,QAAQ,KAAK;CACvE,SAAS,SAAS,QAAQ,OAAO,MAAM,IAAI;CAC3C,SAAS,SAAS,QAAQ,OAAO,MAAM,IAAI;CAC3C,WAAW,SAAS,SAAS,MAAM,MAAM;AAC3C,CAAC"}

package/dist/identity-settings-BlQY9gHy.mjs

@@ -0,0 +1,165 @@
+import { n as openKeySetFile, r as createIdentityVerifier, s as isKeySetAlgorithm, t as resolveSecret } from "./secrets-DhKHG-Y9.mjs";
+import { isAbsolute } from "node:path";
+//#region src/identity-settings.ts
+function identityKeySource(env) {
+	const reference = env["FORMANCY_DATA_IDENTITY_SECRET"];
+	const publicKeyFile = env["FORMANCY_DATA_IDENTITY_PUBLIC_KEY_FILE"];
+	const keysFile = env["FORMANCY_DATA_IDENTITY_KEYS_FILE"];
+	const algorithm = env["FORMANCY_DATA_IDENTITY_ALGORITHM"];
+	if ([
+		reference,
+		publicKeyFile,
+		keysFile
+	].filter((value) => value !== void 0).length !== 1) return {
+		ok: false,
+		problem: "Set exactly one of FORMANCY_DATA_IDENTITY_SECRET, FORMANCY_DATA_IDENTITY_PUBLIC_KEY_FILE and FORMANCY_DATA_IDENTITY_KEYS_FILE."
+	};
+	if (reference !== void 0) return {
+		ok: true,
+		source: {
+			kind: "secret",
+			reference
+		}
+	};
+	if (publicKeyFile !== void 0) {
+		if (algorithm === void 0 || algorithm === "") return {
+			ok: false,
+			problem: "FORMANCY_DATA_IDENTITY_ALGORITHM is required."
+		};
+		if (algorithm === "HS256") return {
+			ok: false,
+			problem: "HS256 is a shared secret: it is FORMANCY_DATA_IDENTITY_SECRET or a key set, never a public key file."
+		};
+		if (algorithm !== "RS256" && algorithm !== "ES256" && algorithm !== "EdDSA") return {
+			ok: false,
+			problem: "FORMANCY_DATA_IDENTITY_ALGORITHM is RS256, ES256 or EdDSA."
+		};
+		return {
+			ok: true,
+			source: {
+				kind: "public-key",
+				path: publicKeyFile,
+				algorithm
+			}
+		};
+	}
+	const path = keysFile;
+	if (algorithm === void 0 || algorithm === "") return {
+		ok: false,
+		problem: "FORMANCY_DATA_IDENTITY_ALGORITHM is required with FORMANCY_DATA_IDENTITY_KEYS_FILE: RS256, ES256, EdDSA or HS256, for every key in the set."
+	};
+	if (!isKeySetAlgorithm(algorithm)) return {
+		ok: false,
+		problem: "FORMANCY_DATA_IDENTITY_ALGORITHM is RS256, ES256, EdDSA or HS256 for a key set."
+	};
+	if (!isAbsolute(path)) return {
+		ok: false,
+		problem: "FORMANCY_DATA_IDENTITY_KEYS_FILE is an absolute path: the file is read again, on SIGHUP, from wherever the server then runs."
+	};
+	return {
+		ok: true,
+		source: {
+			kind: "key-set",
+			path,
+			algorithm
+		}
+	};
+}
+/** The one key a secret or a public key file names, read as main.ts reads it: the secret through resolveSecret, the PEM as the file's text. */
+async function oneKey(source, io) {
+	if (source.kind === "secret") return {
+		kind: "secret",
+		secret: await resolveSecret(source.reference, io)
+	};
+	let pem;
+	try {
+		pem = await io.readFile(source.path);
+	} catch {
+		throw new Error(`the identity public key file ${source.path} cannot be read`);
+	}
+	return {
+		kind: "public-key",
+		pem,
+		algorithm: source.algorithm
+	};
+}
+/**
+* The verifier main.ts serves with, and the key set file it reads again on
+* SIGHUP when the setting names one. Every refusal of the key at start -- a
+* secret or a file that cannot be read, a secret under 32 bytes, a public key
+* that does not import, a key set refused -- is the problem, one sentence
+* main.ts prints before it exits 1, never an exception: a short secret and a
+* PEM that did not import used to be thrown by createIdentityVerifier, outside
+* main's handling, as a stack trace. The key set file is read through
+* readKeySetText, never `io`, so a path that is not a regular file is refused
+* at start as it is on SIGHUP.
+*/
+async function openIdentity(source, io, claims) {
+	try {
+		let key;
+		let file;
+		if (source.kind === "key-set") {
+			file = await openKeySetFile(source.path, source.algorithm);
+			key = {
+				kind: "key-set",
+				keys: file.current
+			};
+		} else key = await oneKey(source, io);
+		return {
+			ok: true,
+			verifyIdentity: await createIdentityVerifier({
+				...claims,
+				key
+			}),
+			file
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			problem: error instanceof Error ? error.message : "the identity key could not be opened"
+		};
+	}
+}
+/**
+* Reads the key set file again on every SIGHUP, and says what happened in
+* one line on the server's log: the kids in force and what was added,
+* removed and replaced; that nothing changed; or, at `error`, that nothing
+* was read and why, the set in force unchanged. No line holds key material,
+* and none a hash of the file, which for HS256 would let a reader of the log
+* check a guess at the secret.
+*
+* The listener is installed whatever the setting, so a SIGHUP never stops
+* the server -- Node's default for it is to terminate -- and with a one-key
+* setting it says that nothing was read.
+*/
+function readAgainOnSignal(signals, file, log) {
+	signals.on("SIGHUP", () => {
+		if (file === void 0) {
+			log.warn("SIGHUP: the identity key is not a key set file; nothing was read again");
+			return;
+		}
+		file.readAgain().then((outcome) => {
+			if (!outcome.read) log.error({ identityKeys: {
+				kids: outcome.kids,
+				problem: outcome.problem
+			} }, "identity keys not read again; the set in force is unchanged");
+			else if (outcome.changed) {
+				const { kids, added, removed, replaced, leftOut } = outcome;
+				log.info({ identityKeys: {
+					kids,
+					added,
+					removed,
+					replaced,
+					leftOut
+				} }, "identity keys read again");
+			} else log.info({ identityKeys: {
+				kids: outcome.kids,
+				leftOut: outcome.leftOut
+			} }, "identity keys read again; nothing changed");
+		});
+	});
+}
+//#endregion
+export { readAgainOnSignal as i, oneKey as n, openIdentity as r, identityKeySource as t };
+
+//# sourceMappingURL=identity-settings-BlQY9gHy.mjs.map

package/dist/identity-settings-BlQY9gHy.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-settings-BlQY9gHy.mjs","names":[],"sources":["../src/identity-settings.ts"],"sourcesContent":["import { isAbsolute } from 'node:path'\nimport { createIdentityVerifier } from './identity.js'\nimport type { IdentityOptions, IdentityVerifier, OneKey } from './identity.js'\nimport { openKeySetFile } from './identity-file.js'\nimport type { KeySetFile } from './identity-file.js'\nimport { isKeySetAlgorithm } from './identity-keys.js'\nimport type { KeySetAlgorithm, PublicKeyAlgorithm } from './identity-keys.js'\nimport { resolveSecret } from './secrets.js'\nimport type { SecretSource } from './secrets.js'\n\n/**\n * Where the host identity's key comes from, as the environment names it, and\n * what a SIGHUP does with it (0014, 0059). Read by the composition root\n * (main.ts) and by `identity-keys-cli.mjs convert`, so the two never read the\n * settings differently, and parsed and opened here, so the rules and every\n * refusal at start are tested without starting a process.\n *\n *   FORMANCY_DATA_IDENTITY_SECRET           a secret reference, env:NAME or file:/path (HS256)\n *   FORMANCY_DATA_IDENTITY_PUBLIC_KEY_FILE  or a PEM public key, with FORMANCY_DATA_IDENTITY_ALGORITHM RS256, ES256 or EdDSA\n *   FORMANCY_DATA_IDENTITY_KEYS_FILE        or the absolute path of a JSON Web Key Set, with FORMANCY_DATA_IDENTITY_ALGORITHM\n *                                           RS256, ES256, EdDSA or HS256, pinned for the whole set and read again on SIGHUP\n *\n * Exactly one of the three; \"set\" means defined, as it always has. No\n * sentence repeats a setting's value.\n */\nexport type IdentityKeySource =\n  | { kind: 'secret'; reference: string }\n  | { kind: 'public-key'; path: string; algorithm: PublicKeyAlgorithm }\n  | { kind: 'key-set'; path: string; algorithm: KeySetAlgorithm }\n\nexport type IdentityKeySetting = { ok: true; source: IdentityKeySource } | { ok: false; problem: string }\n\ntype Environment = Readonly<Record<string, string | undefined>>\n\nexport function identityKeySource(env: Environment): IdentityKeySetting {\n  const reference = env['FORMANCY_DATA_IDENTITY_SECRET']\n  const publicKeyFile = env['FORMANCY_DATA_IDENTITY_PUBLIC_KEY_FILE']\n  const keysFile = env['FORMANCY_DATA_IDENTITY_KEYS_FILE']\n  const algorithm = env['FORMANCY_DATA_IDENTITY_ALGORITHM']\n  if ([reference, publicKeyFile, keysFile].filter((value) => value !== undefined).length !== 1) {\n    return { ok: false, problem: 'Set exactly one of FORMANCY_DATA_IDENTITY_SECRET, FORMANCY_DATA_IDENTITY_PUBLIC_KEY_FILE and FORMANCY_DATA_IDENTITY_KEYS_FILE.' }\n  }\n  if (reference !== undefined) return { ok: true, source: { kind: 'secret', reference } }\n\n  if (publicKeyFile !== undefined) {\n    if (algorithm === undefined || algorithm === '') return { ok: false, problem: 'FORMANCY_DATA_IDENTITY_ALGORITHM is required.' }\n    // A PEM's text taken as an HMAC secret verifies any token its reader signs with it.\n    if (algorithm === 'HS256') return { ok: false, problem: 'HS256 is a shared secret: it is FORMANCY_DATA_IDENTITY_SECRET or a key set, never a public key file.' }\n    if (algorithm !== 'RS256' && algorithm !== 'ES256' && algorithm !== 'EdDSA') return { ok: false, problem: 'FORMANCY_DATA_IDENTITY_ALGORITHM is RS256, ES256 or EdDSA.' }\n    return { ok: true, source: { kind: 'public-key', path: publicKeyFile, algorithm } }\n  }\n\n  const path = keysFile as string\n  if (algorithm === undefined || algorithm === '') {\n    return { ok: false, problem: 'FORMANCY_DATA_IDENTITY_ALGORITHM is required with FORMANCY_DATA_IDENTITY_KEYS_FILE: RS256, ES256, EdDSA or HS256, for every key in the set.' }\n  }\n  if (!isKeySetAlgorithm(algorithm)) return { ok: false, problem: 'FORMANCY_DATA_IDENTITY_ALGORITHM is RS256, ES256, EdDSA or HS256 for a key set.' }\n  if (!isAbsolute(path)) return { ok: false, problem: 'FORMANCY_DATA_IDENTITY_KEYS_FILE is an absolute path: the file is read again, on SIGHUP, from wherever the server then runs.' }\n  return { ok: true, source: { kind: 'key-set', path, algorithm } }\n}\n\n/** The one key a secret or a public key file names, read as main.ts reads it: the secret through resolveSecret, the PEM as the file's text. */\nexport async function oneKey(source: Exclude<IdentityKeySource, { kind: 'key-set' }>, io: SecretSource): Promise<OneKey> {\n  if (source.kind === 'secret') return { kind: 'secret', secret: await resolveSecret(source.reference, io) }\n  let pem: string\n  try {\n    pem = await io.readFile(source.path)\n  } catch {\n    // Named as resolveSecret names a secret file; the error's own text is not passed on.\n    throw new Error(`the identity public key file ${source.path} cannot be read`)\n  }\n  return { kind: 'public-key', pem, algorithm: source.algorithm }\n}\n\nexport type OpenedIdentity = { ok: true; verifyIdentity: IdentityVerifier; file: KeySetFile | undefined } | { ok: false; problem: string }\n\n/**\n * The verifier main.ts serves with, and the key set file it reads again on\n * SIGHUP when the setting names one. Every refusal of the key at start -- a\n * secret or a file that cannot be read, a secret under 32 bytes, a public key\n * that does not import, a key set refused -- is the problem, one sentence\n * main.ts prints before it exits 1, never an exception: a short secret and a\n * PEM that did not import used to be thrown by createIdentityVerifier, outside\n * main's handling, as a stack trace. The key set file is read through\n * readKeySetText, never `io`, so a path that is not a regular file is refused\n * at start as it is on SIGHUP.\n */\nexport async function openIdentity(source: IdentityKeySource, io: SecretSource, claims: Omit<IdentityOptions, 'key'>): Promise<OpenedIdentity> {\n  try {\n    let key: IdentityOptions['key']\n    let file: KeySetFile | undefined\n    if (source.kind === 'key-set') {\n      file = await openKeySetFile(source.path, source.algorithm)\n      key = { kind: 'key-set', keys: file.current }\n    } else {\n      key = await oneKey(source, io)\n    }\n    return { ok: true, verifyIdentity: await createIdentityVerifier({ ...claims, key }), file }\n  } catch (error) {\n    // Each sentence above is resolveSecret's, readKeySet's or the builders',\n    // none of which repeats a key or a secret.\n    return { ok: false, problem: error instanceof Error ? error.message : 'the identity key could not be opened' }\n  }\n}\n\n/** Where a signal comes from: `process` in the server, an EventEmitter in a test. */\nexport interface SignalSource {\n  on(signal: 'SIGHUP', listener: () => void): unknown\n}\n\n/** The server's log, as much of it as this writes to. */\nexport interface KeysLog {\n  info(fields: Record<string, unknown>, message: string): void\n  warn(message: string): void\n  error(fields: Record<string, unknown>, message: string): void\n}\n\n/**\n * Reads the key set file again on every SIGHUP, and says what happened in\n * one line on the server's log: the kids in force and what was added,\n * removed and replaced; that nothing changed; or, at `error`, that nothing\n * was read and why, the set in force unchanged. No line holds key material,\n * and none a hash of the file, which for HS256 would let a reader of the log\n * check a guess at the secret.\n *\n * The listener is installed whatever the setting, so a SIGHUP never stops\n * the server -- Node's default for it is to terminate -- and with a one-key\n * setting it says that nothing was read.\n */\nexport function readAgainOnSignal(signals: SignalSource, file: KeySetFile | undefined, log: KeysLog): void {\n  signals.on('SIGHUP', () => {\n    if (file === undefined) {\n      log.warn('SIGHUP: the identity key is not a key set file; nothing was read again')\n      return\n    }\n    void file.readAgain().then((outcome) => {\n      if (!outcome.read) {\n        log.error({ identityKeys: { kids: outcome.kids, problem: outcome.problem } }, 'identity keys not read again; the set in force is unchanged')\n      } else if (outcome.changed) {\n        const { kids, added, removed, replaced, leftOut } = outcome\n        log.info({ identityKeys: { kids, added, removed, replaced, leftOut } }, 'identity keys read again')\n      } else {\n        log.info({ identityKeys: { kids: outcome.kids, leftOut: outcome.leftOut } }, 'identity keys read again; nothing changed')\n      }\n    })\n  })\n}\n"],"mappings":";;;AAkCA,SAAgB,kBAAkB,KAAsC;CACtE,MAAM,YAAY,IAAI;CACtB,MAAM,gBAAgB,IAAI;CAC1B,MAAM,WAAW,IAAI;CACrB,MAAM,YAAY,IAAI;CACtB,IAAI;EAAC;EAAW;EAAe;CAAQ,CAAC,CAAC,QAAQ,UAAU,UAAU,KAAA,CAAS,CAAC,CAAC,WAAW,GACzF,OAAO;EAAE,IAAI;EAAO,SAAS;CAAiI;CAEhK,IAAI,cAAc,KAAA,GAAW,OAAO;EAAE,IAAI;EAAM,QAAQ;GAAE,MAAM;GAAU;EAAU;CAAE;CAEtF,IAAI,kBAAkB,KAAA,GAAW;EAC/B,IAAI,cAAc,KAAA,KAAa,cAAc,IAAI,OAAO;GAAE,IAAI;GAAO,SAAS;EAAgD;EAE9H,IAAI,cAAc,SAAS,OAAO;GAAE,IAAI;GAAO,SAAS;EAAuG;EAC/J,IAAI,cAAc,WAAW,cAAc,WAAW,cAAc,SAAS,OAAO;GAAE,IAAI;GAAO,SAAS;EAA6D;EACvK,OAAO;GAAE,IAAI;GAAM,QAAQ;IAAE,MAAM;IAAc,MAAM;IAAe;GAAU;EAAE;CACpF;CAEA,MAAM,OAAO;CACb,IAAI,cAAc,KAAA,KAAa,cAAc,IAC3C,OAAO;EAAE,IAAI;EAAO,SAAS;CAA8I;CAE7K,IAAI,CAAC,kBAAkB,SAAS,GAAG,OAAO;EAAE,IAAI;EAAO,SAAS;CAAkF;CAClJ,IAAI,CAAC,WAAW,IAAI,GAAG,OAAO;EAAE,IAAI;EAAO,SAAS;CAA+H;CACnL,OAAO;EAAE,IAAI;EAAM,QAAQ;GAAE,MAAM;GAAW;GAAM;EAAU;CAAE;AAClE;;AAGA,eAAsB,OAAO,QAAyD,IAAmC;CACvH,IAAI,OAAO,SAAS,UAAU,OAAO;EAAE,MAAM;EAAU,QAAQ,MAAM,cAAc,OAAO,WAAW,EAAE;CAAE;CACzG,IAAI;CACJ,IAAI;EACF,MAAM,MAAM,GAAG,SAAS,OAAO,IAAI;CACrC,QAAQ;EAEN,MAAM,IAAI,MAAM,gCAAgC,OAAO,KAAK,gBAAgB;CAC9E;CACA,OAAO;EAAE,MAAM;EAAc;EAAK,WAAW,OAAO;CAAU;AAChE;;;;;;;;;;;;AAeA,eAAsB,aAAa,QAA2B,IAAkB,QAA+D;CAC7I,IAAI;EACF,IAAI;EACJ,IAAI;EACJ,IAAI,OAAO,SAAS,WAAW;GAC7B,OAAO,MAAM,eAAe,OAAO,MAAM,OAAO,SAAS;GACzD,MAAM;IAAE,MAAM;IAAW,MAAM,KAAK;GAAQ;EAC9C,OACE,MAAM,MAAM,OAAO,QAAQ,EAAE;EAE/B,OAAO;GAAE,IAAI;GAAM,gBAAgB,MAAM,uBAAuB;IAAE,GAAG;IAAQ;GAAI,CAAC;GAAG;EAAK;CAC5F,SAAS,OAAO;EAGd,OAAO;GAAE,IAAI;GAAO,SAAS,iBAAiB,QAAQ,MAAM,UAAU;EAAuC;CAC/G;AACF;;;;;;;;;;;;;AA0BA,SAAgB,kBAAkB,SAAuB,MAA8B,KAAoB;CACzG,QAAQ,GAAG,gBAAgB;EACzB,IAAI,SAAS,KAAA,GAAW;GACtB,IAAI,KAAK,wEAAwE;GACjF;EACF;EACA,KAAU,UAAU,CAAC,CAAC,MAAM,YAAY;GACtC,IAAI,CAAC,QAAQ,MACX,IAAI,MAAM,EAAE,cAAc;IAAE,MAAM,QAAQ;IAAM,SAAS,QAAQ;GAAQ,EAAE,GAAG,6DAA6D;QACtI,IAAI,QAAQ,SAAS;IAC1B,MAAM,EAAE,MAAM,OAAO,SAAS,UAAU,YAAY;IACpD,IAAI,KAAK,EAAE,cAAc;KAAE;KAAM;KAAO;KAAS;KAAU;IAAQ,EAAE,GAAG,0BAA0B;GACpG,OACE,IAAI,KAAK,EAAE,cAAc;IAAE,MAAM,QAAQ;IAAM,SAAS,QAAQ;GAAQ,EAAE,GAAG,2CAA2C;EAE5H,CAAC;CACH,CAAC;AACH"}