@hivemagnus/hive-common 0.0.0-stage → 0.2.0

package/dist/oathweave/verifier.js

@@ -0,0 +1,237 @@
+/**
+ * The Oathweave access-token verifier: RS256 against the issuer's JWKS, exact issuer and
+ * audience, bounded lifetime with clock tolerance, user/service principal rules, and an
+ * optional online session check through userinfo with a short shared cache.
+ *
+ * Failure is closed: every refusal is an `OathweaveError` (401, 403 or 503).
+ */
+import { createHash } from 'node:crypto';
+import { createLocalJWKSet, createRemoteJWKSet, customFetch, decodeProtectedHeader, errors as joseErrors, jwtVerify, } from 'jose';
+import { CLIENT_ID_CLAIMS, principalFromClaims, } from './claims.js';
+import { assertOathweaveEndpoint } from './endpoint.js';
+import { OathweaveError } from './errors.js';
+/** How long a userinfo answer is reused, measured from when its request started. */
+export const OATHWEAVE_SESSION_CACHE_TTL_MS = 10_000;
+/** How often a long-lived connection should re-check its token. */
+export const OATHWEAVE_STREAM_RECHECK_MS = 5_000;
+/** Failed session checks are remembered this long, so one failing request does not verify twice. */
+export const OATHWEAVE_FAILED_CHECK_TTL_MS = 2_000;
+export const OATHWEAVE_SESSION_CACHE_MAX = 5_000;
+export const OATHWEAVE_REQUEST_TIMEOUT_MS = 3_000;
+/** Oathweave access tokens live at most fifteen minutes. */
+export const OATHWEAVE_MAX_LIFETIME_SEC = 900;
+export const OATHWEAVE_DEFAULT_CLOCK_TOLERANCE_SEC = 30;
+/** Longest accepted compact token. Real Oathweave tokens are well under 4 KiB. */
+export const OATHWEAVE_MAX_TOKEN_LENGTH = 16_384;
+const BEARER = /^Bearer[ ]+([A-Za-z0-9\-._~+/]+=*)[ ]*$/i;
+/**
+ * The token in an `Authorization: Bearer` header (RFC 6750). Undefined when there is no
+ * header; throws `malformed_token` when there is one but it is not a single bearer token.
+ */
+export function parseBearerToken(header) {
+    if (header === undefined || header === null || header === '')
+        return undefined;
+    const match = BEARER.exec(header);
+    if (!match?.[1])
+        throw new OathweaveError('malformed_token');
+    return match[1];
+}
+/** Errors from the key source that mean "could not get keys", not "bad token". */
+class KeySourceUnavailable extends Error {
+}
+function keySource(options, request, timeoutMs) {
+    let resolver;
+    if (typeof options.keys === 'function')
+        resolver = options.keys;
+    else if (options.keys)
+        resolver = createLocalJWKSet(options.keys);
+    else {
+        if (!options.jwksUrl)
+            throw new TypeError('Oathweave jwksUrl is required unless keys are given');
+        resolver = createRemoteJWKSet(new URL(options.jwksUrl), {
+            timeoutDuration: timeoutMs,
+            cacheMaxAge: options.jwksCacheMaxAgeMs ?? 10 * 60_000,
+            cooldownDuration: options.jwksCooldownMs ?? 30_000,
+            [customFetch]: (url, init) => request(url, { ...init, redirect: 'error' }),
+        });
+    }
+    return async (header, token) => {
+        try {
+            return await resolver(header, token);
+        }
+        catch (error) {
+            // An unknown kid is the token's problem (after jose's rotation refetch); anything else
+            // (network, timeout, non-200, malformed JWKS) means the keys could not be obtained.
+            if (error instanceof joseErrors.JWKSNoMatchingKey || error instanceof joseErrors.JWKSMultipleMatchingKeys)
+                throw error;
+            throw new KeySourceUnavailable('keys unavailable', { cause: error });
+        }
+    };
+}
+/** Map a jose or key-source failure onto a stable reason. */
+function mapVerifyError(error) {
+    if (error instanceof KeySourceUnavailable)
+        return new OathweaveError('jwks_unavailable', { cause: error.cause });
+    if (error instanceof joseErrors.JWTExpired)
+        return new OathweaveError('expired');
+    if (error instanceof joseErrors.JWTClaimValidationFailed) {
+        if (error.claim === 'nbf' || (error.claim === 'iat' && error.reason === 'check_failed'))
+            return new OathweaveError('not_yet_valid');
+        if (error.claim === 'iss')
+            return new OathweaveError('invalid_issuer');
+        if (error.claim === 'aud')
+            return new OathweaveError('invalid_audience');
+        return new OathweaveError('invalid_claims');
+    }
+    if (error instanceof joseErrors.JWKSNoMatchingKey)
+        return new OathweaveError('unknown_key');
+    if (error instanceof joseErrors.JWSSignatureVerificationFailed || error instanceof joseErrors.JWKSMultipleMatchingKeys) {
+        return new OathweaveError('invalid_signature');
+    }
+    // JOSEAlgNotAllowed cannot occur: the header precheck already refused every algorithm but RS256.
+    return new OathweaveError('malformed_token');
+}
+/** Create a verifier. Throws a TypeError at startup when the configuration is unsafe. */
+export function createOathweaveVerifier(options) {
+    const issuers = typeof options.issuer === 'string' ? [options.issuer] : [...options.issuer];
+    if (!issuers.length)
+        throw new TypeError('At least one Oathweave issuer is required');
+    for (const issuer of issuers)
+        assertOathweaveEndpoint(issuer, 'issuer', options);
+    if (options.jwksUrl !== undefined)
+        assertOathweaveEndpoint(options.jwksUrl, 'jwksUrl', options);
+    if (options.userinfoUrl !== undefined)
+        assertOathweaveEndpoint(options.userinfoUrl, 'userinfoUrl', options);
+    if (typeof options.audience !== 'string' || !options.audience)
+        throw new TypeError('Oathweave audience is required');
+    const clockTolerance = options.clockToleranceSec ?? OATHWEAVE_DEFAULT_CLOCK_TOLERANCE_SEC;
+    const maxLifetimeSec = options.maxLifetimeSec ?? OATHWEAVE_MAX_LIFETIME_SEC;
+    if (!(clockTolerance >= 0 && clockTolerance <= 300))
+        throw new TypeError('clockToleranceSec must be 0-300');
+    if (!(maxLifetimeSec > 0 && maxLifetimeSec <= 86_400))
+        throw new TypeError('maxLifetimeSec must be 1-86400');
+    const requireRoles = options.requireRoles ?? false;
+    const clientIdClaim = options.clientIdClaim ?? 'either';
+    if (typeof requireRoles !== 'boolean')
+        throw new TypeError('requireRoles must be a boolean');
+    if (!CLIENT_ID_CLAIMS.includes(clientIdClaim))
+        throw new TypeError("clientIdClaim must be 'clientId', 'client_id' or 'either'");
+    const defaultAccept = options.accept ?? 'user';
+    const timeoutMs = options.requestTimeoutMs ?? OATHWEAVE_REQUEST_TIMEOUT_MS;
+    const request = options.fetch ?? ((input, init) => fetch(input, init));
+    const now = options.now ?? Date.now;
+    const keys = keySource(options, request, timeoutMs);
+    const sessionTtl = options.sessionCacheTtlMs ?? OATHWEAVE_SESSION_CACHE_TTL_MS;
+    const sessionMax = options.sessionCacheMax ?? OATHWEAVE_SESSION_CACHE_MAX;
+    // Holds only tokens whose signature verified, so garbage can neither fill it nor reach userinfo.
+    const sessions = new Map();
+    async function fetchDisplayName(token, subject) {
+        let response;
+        try {
+            response = await request(options.userinfoUrl, {
+                headers: { authorization: `Bearer ${token}`, accept: 'application/json' },
+                redirect: 'error',
+                signal: AbortSignal.timeout(timeoutMs),
+            });
+        }
+        catch (error) {
+            throw new OathweaveError('identity_unavailable', { cause: error });
+        }
+        if (response.status === 401 || response.status === 403)
+            throw new OathweaveError('session_inactive');
+        if (!response.ok)
+            throw new OathweaveError('identity_unavailable');
+        let user;
+        try {
+            user = await response.json();
+        }
+        catch (error) {
+            throw new OathweaveError('identity_unavailable', { cause: error });
+        }
+        if (!user || typeof user !== 'object' || user.sub !== subject)
+            throw new OathweaveError('subject_mismatch');
+        const name = user.name;
+        return typeof name === 'string' && name ? name : subject;
+    }
+    function sessionCheck(token, subject) {
+        const key = createHash('sha256').update(token).digest('hex');
+        const startedAt = now();
+        const current = sessions.get(key);
+        if (current && startedAt < current.expiresAt)
+            return current.displayName;
+        sessions.delete(key);
+        if (sessions.size >= sessionMax) {
+            for (const [entryKey, entry] of sessions)
+                if (entry.expiresAt <= startedAt)
+                    sessions.delete(entryKey);
+            if (sessions.size >= sessionMax)
+                sessions.delete(sessions.keys().next().value);
+        }
+        // Concurrent callers share one in-flight request; the TTL runs from when it started.
+        const check = { expiresAt: startedAt + sessionTtl, displayName: fetchDisplayName(token, subject) };
+        check.displayName.catch(() => {
+            check.expiresAt = Math.min(check.expiresAt, now() + OATHWEAVE_FAILED_CHECK_TTL_MS);
+        });
+        sessions.set(key, check);
+        return check.displayName;
+    }
+    async function verify(token, verifyOptions = {}) {
+        if (typeof token !== 'string' || !token)
+            throw new OathweaveError('missing_token');
+        if (token.length > OATHWEAVE_MAX_TOKEN_LENGTH || token.split('.').length !== 3)
+            throw new OathweaveError('malformed_token');
+        let alg;
+        try {
+            alg = decodeProtectedHeader(token).alg;
+        }
+        catch {
+            throw new OathweaveError('malformed_token');
+        }
+        // Refuse `none`, HMAC and every other algorithm before any key lookup.
+        if (alg !== 'RS256')
+            throw new OathweaveError('algorithm_not_allowed');
+        let payload;
+        try {
+            ({ payload } = await jwtVerify(token, keys, {
+                algorithms: ['RS256'],
+                issuer: issuers,
+                audience: options.audience,
+                requiredClaims: ['sub', 'iat', 'exp', 'jti'],
+                maxTokenAge: maxLifetimeSec,
+                clockTolerance,
+                currentDate: new Date(now()),
+            }));
+        }
+        catch (error) {
+            throw mapVerifyError(error);
+        }
+        // jose accepts an audience array that contains ours; Oathweave issues exactly one audience.
+        if (payload.aud !== options.audience)
+            throw new OathweaveError('invalid_audience');
+        const principal = principalFromClaims(payload, {
+            accept: verifyOptions.accept ?? defaultAccept,
+            maxLifetimeSec,
+            requireRoles,
+            clientIdClaim,
+        });
+        if (principal.kind === 'user' && options.userinfoUrl) {
+            const displayName = await sessionCheck(token, principal.subject);
+            return { ...principal, displayName, sessionChecked: true };
+        }
+        return principal;
+    }
+    return {
+        issuers,
+        audience: options.audience,
+        verify,
+        verifyUser: token => verify(token, { accept: 'user' }),
+        verifyService: token => verify(token, { accept: 'service' }),
+        async verifyAuthorization(header, verifyOptions) {
+            const token = parseBearerToken(header);
+            if (token === undefined)
+                throw new OathweaveError('missing_token');
+            return verify(token, verifyOptions);
+        },
+        clearSessionCache: () => sessions.clear(),
+    };
+}

package/dist/registry/index.d.ts

@@ -0,0 +1,138 @@
+export interface RegistryInstallation {
+    readonly schema: 1;
+    readonly id: string;
+    /** IDs of installed products visible at this access level. */
+    readonly products: readonly string[];
+    readonly origin?: string | null;
+    readonly profile?: 'core' | 'full' | 'custom' | null;
+    readonly release?: {
+        readonly version: string;
+        readonly manifestDigest: string;
+        readonly planDigest: string;
+    } | null;
+    readonly phase?: string | null;
+    readonly revision?: number;
+    readonly updatedAt?: string | null;
+    readonly hosts?: readonly string[];
+}
+export interface RegistryProductLinks {
+    readonly repository: string | null;
+    readonly documentation: string | null;
+    readonly license: string | null;
+    readonly licenseSpdx: string | null;
+}
+export interface RegistryProductVersion {
+    readonly version: string;
+    readonly image: string;
+    readonly imageDigest: string;
+    readonly storageFormat: string | null;
+    readonly release: string | null;
+    readonly recordedAt: string;
+}
+export interface RegistryProductInstallation {
+    readonly inventoryHost: string | null;
+    readonly version: string | null;
+    readonly image: string | null;
+    readonly imageDigest: string | null;
+    readonly status: 'activating' | 'installed' | 'external' | string;
+    readonly installedAt: string | null;
+    readonly updatedAt: string | null;
+    readonly release: string | null;
+}
+export interface RegistryProduct {
+    readonly id: string;
+    readonly displayName: string;
+    readonly description: string;
+    readonly links: RegistryProductLinks;
+    readonly consoleSection: string | null;
+    readonly required: boolean;
+    /** True only once activation is recorded (or the product is external). */
+    readonly installed: boolean;
+    readonly dependencies: readonly string[];
+    readonly kind?: 'application' | 'datastore' | 'static-ui' | 'ingress' | string;
+    readonly source?: string;
+    readonly public?: boolean;
+    readonly offered?: boolean;
+    readonly versions?: readonly RegistryProductVersion[];
+    readonly installation?: RegistryProductInstallation | null;
+}
+export interface RegistryConnection {
+    readonly id: string;
+    readonly consolePath: string | null;
+    readonly browserPrefix: string | null;
+    /** Public API base URLs on the console origin, by API name. */
+    readonly nativeApis: Readonly<Record<string, string>>;
+    readonly documentation: string | null;
+    readonly inventoryHost?: string | null;
+    /** Private-network endpoints, by name. */
+    readonly internalEndpoints?: Readonly<Record<string, string>>;
+}
+/** TLS trust for reaching a product. The registry stores none, so it comes from local configuration. */
+export interface ProductTrust {
+    /** PEM CA certificate(s) the product's endpoint is signed by. */
+    readonly ca?: string | readonly string[];
+}
+export interface ProductEndpoint {
+    readonly productId: string;
+    readonly name: string;
+    readonly url: string;
+    /** True for a private-network endpoint, false for a public native API. */
+    readonly internal: boolean;
+    readonly trust: ProductTrust;
+}
+export interface CaFetchOptions {
+    /** PEM CA certificate(s) to trust in addition to nothing else: the system store is not used. */
+    readonly ca: string | readonly string[];
+    readonly timeoutMs?: number;
+}
+/**
+ * A minimal `fetch` over `node:https` that trusts only the given CA. Supports what this
+ * package's clients need: any method, headers, string or byte bodies, `signal`; redirects are
+ * returned, never followed. For anything more, inject your own fetch (for example undici's
+ * with a custom dispatcher).
+ */
+export declare function createCaFetch(options: CaFetchOptions): typeof fetch;
+export interface RegistryClientOptions {
+    /**
+     * The registry base URL: the native service (`http://hive-registry:8095` on the private
+     * network, which needs `allowHttp`) or the ingress prefix (`https://hive.example.com/api/registry`).
+     */
+    readonly baseUrl: string;
+    /** The read credential. Omit for the public view. Never use it in browser code. */
+    readonly token?: string;
+    readonly fetch?: typeof fetch;
+    /** PEM CA for an https registry signed by a private CA. Ignored when `fetch` is given. */
+    readonly ca?: string | readonly string[];
+    /** Allow plain http to a non-loopback host, for the registry's private Compose network. */
+    readonly allowHttp?: boolean;
+    readonly timeoutMs?: number;
+    /** TLS trust per product, returned by `endpoint()`. */
+    readonly trust?: Readonly<Record<string, ProductTrust>> | ((productId: string) => ProductTrust | undefined);
+    /** Extra headers on every request, such as `outboundHeaders()` from `/context`. */
+    readonly headers?: () => Record<string, string>;
+}
+export interface EndpointLookup {
+    /** Endpoint name. Defaults to the only one, or to one named after the product. */
+    readonly name?: string;
+    /** Prefer internal endpoints (default, needs a credential) or public native APIs. */
+    readonly prefer?: 'internal' | 'native';
+}
+export interface RegistryClient {
+    installation(): Promise<RegistryInstallation>;
+    /** The catalog, optionally filtered by `installed`. */
+    products(filter?: {
+        readonly installed?: boolean;
+    }): Promise<RegistryProduct[]>;
+    /** Installed products only. */
+    installedProducts(): Promise<RegistryProduct[]>;
+    /** One product, or undefined when the registry does not know it (or hides it at this access level). */
+    product(id: string): Promise<RegistryProduct | undefined>;
+    connection(id: string): Promise<RegistryConnection | undefined>;
+    /** Resolve where to call a product, with its configured TLS trust. Undefined when it has no such endpoint. */
+    endpoint(id: string, lookup?: EndpointLookup): Promise<ProductEndpoint | undefined>;
+    ready(): Promise<{
+        readonly status: string;
+        readonly readOnly: boolean;
+    }>;
+}
+export declare function createRegistryClient(options: RegistryClientOptions): RegistryClient;

package/dist/registry/index.js

@@ -0,0 +1,175 @@
+/**
+ * A typed client for the Hive Registry API: the installation, its product catalog, and how
+ * to reach each product. See the Hive repository's `docs/hive-registry-api.md`.
+ */
+import { request as httpsRequest } from 'node:https';
+import { isProductId } from '../contracts/index.js';
+import { HiveError, parseHiveErrorResponse } from '../errors/index.js';
+import { isLoopbackHost } from '../oathweave/endpoint.js';
+/**
+ * A minimal `fetch` over `node:https` that trusts only the given CA. Supports what this
+ * package's clients need: any method, headers, string or byte bodies, `signal`; redirects are
+ * returned, never followed. For anything more, inject your own fetch (for example undici's
+ * with a custom dispatcher).
+ */
+export function createCaFetch(options) {
+    const ca = typeof options.ca === 'string' ? [options.ca] : [...options.ca];
+    if (!ca.length || ca.some(pem => !pem.includes('-----BEGIN CERTIFICATE-----')))
+        throw new TypeError('ca must be PEM certificates');
+    return (input, init) => new Promise((resolve, reject) => {
+        const url = new URL(typeof input === 'string' ? input : input instanceof URL ? input.href : input.url);
+        if (url.protocol !== 'https:') {
+            reject(new TypeError('createCaFetch only supports https URLs'));
+            return;
+        }
+        const headers = {};
+        new Headers(init?.headers).forEach((value, key) => { headers[key] = value; });
+        const body = init?.body;
+        if (body !== undefined && body !== null && typeof body !== 'string' && !(body instanceof Uint8Array)) {
+            reject(new TypeError('createCaFetch supports string and byte bodies only'));
+            return;
+        }
+        const signals = [init?.signal, options.timeoutMs ? AbortSignal.timeout(options.timeoutMs) : undefined].filter((s) => !!s);
+        const signal = signals.length ? AbortSignal.any(signals) : undefined;
+        if (signal?.aborted) {
+            reject(signal.reason);
+            return;
+        }
+        const request = httpsRequest(url, { method: init?.method ?? 'GET', headers, ca, ...(signal ? { signal } : {}) }, response => {
+            const chunks = [];
+            response.on('data', (chunk) => chunks.push(chunk));
+            response.on('error', reject);
+            response.on('end', () => {
+                const responseHeaders = new Headers();
+                for (const [key, value] of Object.entries(response.headers)) {
+                    if (Array.isArray(value))
+                        value.forEach(item => responseHeaders.append(key, item));
+                    else if (value !== undefined)
+                        responseHeaders.set(key, value);
+                }
+                const status = response.statusCode ?? 502;
+                const nullBody = status === 204 || status === 304 || init?.method === 'HEAD';
+                resolve(new Response(nullBody ? null : Buffer.concat(chunks), { status, statusText: response.statusMessage ?? '', headers: responseHeaders }));
+            });
+        });
+        request.on('error', error => reject(signal?.aborted ? signal.reason : error));
+        if (body !== undefined && body !== null)
+            request.write(body);
+        request.end();
+    });
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function invalid(what) {
+    return new HiveError('invalid_registry_response', `The registry returned an unexpected ${what}`, { status: 502 });
+}
+function checkProduct(value) {
+    if (!isRecord(value) || !isProductId(value['id']) || typeof value['displayName'] !== 'string' || typeof value['installed'] !== 'boolean'
+        || !Array.isArray(value['dependencies']) || !isRecord(value['links']))
+        throw invalid('product');
+    return value;
+}
+function checkConnection(value) {
+    if (!isRecord(value) || !isProductId(value['id']) || !isRecord(value['nativeApis'])
+        || (value['internalEndpoints'] !== undefined && !isRecord(value['internalEndpoints'])))
+        throw invalid('connection');
+    return value;
+}
+export function createRegistryClient(options) {
+    const base = new URL(options.baseUrl);
+    if (base.username || base.password || base.search || base.hash)
+        throw new TypeError('Registry baseUrl must be a plain URL');
+    if (base.protocol !== 'https:' && !(base.protocol === 'http:' && (options.allowHttp || isLoopbackHost(base.hostname)))) {
+        throw new TypeError('Registry baseUrl must use https, or set allowHttp for the private network');
+    }
+    if (options.token !== undefined && !/^[^\s,]+$/.test(options.token))
+        throw new TypeError('Registry token must be a single bearer credential');
+    const prefix = base.href.replace(/\/+$/, '');
+    const timeoutMs = options.timeoutMs ?? 5_000;
+    const request = options.fetch
+        ?? (options.ca ? createCaFetch({ ca: options.ca }) : (input, init) => fetch(input, init));
+    async function get(path, notFoundIsUndefined = false) {
+        const response = await request(`${prefix}${path}`, {
+            method: 'GET',
+            headers: {
+                accept: 'application/json',
+                ...options.headers?.(),
+                ...(options.token ? { authorization: `Bearer ${options.token}` } : {}),
+            },
+            redirect: 'error',
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+        if (notFoundIsUndefined && response.status === 404) {
+            void response.body?.cancel().catch(() => undefined);
+            return undefined;
+        }
+        if (!response.ok)
+            throw await parseHiveErrorResponse(response);
+        try {
+            return await response.json();
+        }
+        catch {
+            throw invalid('body');
+        }
+    }
+    const productPath = (id) => {
+        if (!isProductId(id))
+            throw new HiveError('invalid_product_id', 'Product IDs are lowercase letters, digits and dashes', { status: 400 });
+        return `/v1/products/${id}`;
+    };
+    const trustFor = (id) => {
+        const trust = typeof options.trust === 'function' ? options.trust(id) : options.trust?.[id];
+        return trust ?? {};
+    };
+    const client = {
+        async installation() {
+            const body = await get('/v1/installation');
+            if (!isRecord(body) || body['schema'] !== 1 || typeof body['id'] !== 'string' || !Array.isArray(body['products']))
+                throw invalid('installation');
+            return body;
+        },
+        async products(filter = {}) {
+            const query = filter.installed === undefined ? '' : `?installed=${filter.installed}`;
+            const body = await get(`/v1/products${query}`);
+            if (!isRecord(body) || body['schema'] !== 1 || !Array.isArray(body['products']))
+                throw invalid('product list');
+            return body['products'].map(checkProduct);
+        },
+        installedProducts: () => client.products({ installed: true }),
+        async product(id) {
+            const body = await get(productPath(id), true);
+            return body === undefined ? undefined : checkProduct(body);
+        },
+        async connection(id) {
+            const body = await get(`${productPath(id)}/connection`, true);
+            return body === undefined ? undefined : checkConnection(body);
+        },
+        async endpoint(id, lookup = {}) {
+            const connection = await client.connection(id);
+            if (!connection)
+                return undefined;
+            const sources = [
+                [true, connection.internalEndpoints ?? {}],
+                [false, connection.nativeApis],
+            ];
+            if (lookup.prefer === 'native')
+                sources.reverse();
+            for (const [internal, endpoints] of sources) {
+                const names = Object.keys(endpoints);
+                const name = lookup.name ?? (names.length === 1 ? names[0] : names.includes(id) ? id : undefined);
+                const url = name === undefined ? undefined : endpoints[name];
+                if (name !== undefined && url !== undefined)
+                    return { productId: id, name, url, internal, trust: trustFor(id) };
+            }
+            return undefined;
+        },
+        async ready() {
+            const body = await get('/health/ready');
+            if (!isRecord(body) || typeof body['status'] !== 'string')
+                throw invalid('readiness');
+            return { status: body['status'], readOnly: body['readOnly'] === true };
+        },
+    };
+    return client;
+}

package/package.json

@@ -1,6 +1,128 @@
 {
   "name": "@hivemagnus/hive-common",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.2.0",
+  "description": "Shared server kit for the Hive:Magnus suite: Oathweave token verification, error envelope, health, request context, registry client, logging, events and framework adapters",
+  "keywords": [
+    "hive",
+    "magnus",
+    "oathweave",
+    "jwt",
+    "jwks",
+    "error-envelope",
+    "health",
+    "traceparent",
+    "hono"
+  ],
+  "author": "ChefTaco",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ChefTaco/HiveCommon.git"
+  },
+  "homepage": "https://github.com/ChefTaco/HiveCommon#readme",
+  "bugs": {
+    "url": "https://github.com/ChefTaco/HiveCommon/issues"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    "./oathweave": {
+      "types": "./dist/oathweave/index.d.ts",
+      "default": "./dist/oathweave/index.js"
+    },
+    "./oathweave/conformance": {
+      "types": "./dist/oathweave/conformance.d.ts",
+      "default": "./dist/oathweave/conformance.js"
+    },
+    "./errors": {
+      "types": "./dist/errors/index.d.ts",
+      "default": "./dist/errors/index.js"
+    },
+    "./health": {
+      "types": "./dist/health/index.d.ts",
+      "default": "./dist/health/index.js"
+    },
+    "./context": {
+      "types": "./dist/context/index.d.ts",
+      "default": "./dist/context/index.js"
+    },
+    "./registry": {
+      "types": "./dist/registry/index.d.ts",
+      "default": "./dist/registry/index.js"
+    },
+    "./log": {
+      "types": "./dist/log/index.d.ts",
+      "default": "./dist/log/index.js"
+    },
+    "./events": {
+      "types": "./dist/events/index.d.ts",
+      "default": "./dist/events/index.js"
+    },
+    "./contracts": {
+      "types": "./dist/contracts/index.d.ts",
+      "default": "./dist/contracts/index.js"
+    },
+    "./hono": {
+      "types": "./dist/hono/index.d.ts",
+      "default": "./dist/hono/index.js"
+    },
+    "./node-http": {
+      "types": "./dist/node-http/index.d.ts",
+      "default": "./dist/node-http/index.js"
+    },
+    "./test-vectors/*": "./test-vectors/*",
+    "./package.json": "./package.json"
+  },
+  "engines": {
+    "node": "^24.22.3 || ^26.13.1"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist",
+    "test-vectors",
+    "README.md",
+    "LICENSE",
+    "NOTICE",
+    "CHANGELOG.md"
+  ],
+  "scripts": {
+    "build": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:coverage": "vitest run --coverage",
+    "lint": "eslint src test scripts",
+    "vectors:generate": "node scripts/generate-test-vectors.mjs",
+    "pack:check": "node scripts/check-package.mjs",
+    "scan:secrets": "bash scripts/scan-secrets.sh",
+    "check:private": "bash scripts/check-private-data.sh",
+    "privacy:test": "node --test scripts/test-privacy-policy.mjs scripts/test-publish-environment.mjs scripts/test-publish-package.mjs",
+    "hooks:install": "git config core.hooksPath .githooks",
+    "verify": "npm run privacy:test && npm run scan:secrets && npm run check:private && npm run typecheck && npm run lint && npm test && npm run build && npm run pack:check"
+  },
+  "dependencies": {
+    "jose": "^6.2.15"
+  },
+  "peerDependencies": {
+    "hono": "^4.13.18"
+  },
+  "peerDependenciesMeta": {
+    "hono": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@types/node": "^24.19.2",
+    "@vitest/coverage-v8": "^5.1.0",
+    "eslint": "10.14.0",
+    "hono": "^4.13.18",
+    "typescript": "^6.0.3",
+    "typescript-eslint": "8.72.1",
+    "vitest": "^5.0.5",
+    "yaml": "2.9.1"
+  },
+  "overrides": {
+    "minimatch": "11.0.5"
+  }
+}