@iwentsourcing/core 0.1.0

package/dist/management/registry/registry-stream.js

@@ -0,0 +1,157 @@
+import { defineStream } from '../../stream/define-stream.js';
+import { iwentsourcingRealm } from '../system/iwentsourcing-realm.js';
+import { isCompatibleJsonSchemaDescription } from '../../storage/memory/is-compatible-state-definitions.js';
+import { CustomError } from '../../error/custom-error.js';
+import { RegistryEvents } from './registry-events.js';
+import { RegistryState } from './registry-state.js';
+import { getAuthId } from '../../authentication/get-auth-id.js';
+import { PermissionEvents } from '../../runtime/runtime-result.js';
+import { recordEntries, recordValues } from '../../utils/iter-record.js';
+import { isConfiguredReservedTenantAdmin } from './reserved-tenant-admins-from-env.js';
+export const registryStream = defineStream(iwentsourcingRealm, {
+    events: RegistryEvents,
+    state: RegistryState,
+    stateGrant: [
+        {
+            state: 'tenantMembership',
+            access: 'read',
+            methods: ['range', 'observeRange', 'iterate'],
+            filters: [{ field: 'authId', value: '$(auth.id)' }],
+        },
+        {
+            state: 'realm',
+            access: 'read',
+            methods: ['range', 'observeRange', 'iterate', 'get'],
+            filters: [],
+        },
+        {
+            state: 'streams',
+            access: 'read',
+            methods: ['range', 'observeRange', 'iterate', 'get'],
+            filters: [],
+        },
+        {
+            state: 'aggregations',
+            access: 'read',
+            methods: ['range', 'observeRange', 'iterate', 'get'],
+            filters: [],
+        },
+    ],
+    outputs: {
+        'grant-access': PermissionEvents['grant-access'],
+        'revoke-access': PermissionEvents['revoke-access'],
+    },
+    auth: { allowAnonymous: false },
+    pattern: 'registry',
+    handle: {
+        'upload-definition': async (evt, ctx) => {
+            const authId = await getAuthId(ctx.env, ctx.metadata.auth);
+            const tenantMember = await ctx.snapshot('tenantMembership').get({
+                tenant: evt.tenant,
+                authId,
+            });
+            const isAdmin = isConfiguredReservedTenantAdmin(ctx.env, ctx.metadata.auth);
+            if (!tenantMember && !isAdmin) {
+                throw new CustomError('tenant permission is missing', {});
+            }
+            await ctx.state('auth').upsert({
+                realm: evt.name,
+                providers: evt.authsProviders,
+            });
+            await ctx.state('realm').upsert({
+                name: evt.name,
+            });
+            for (const agg of evt.aggregations) {
+                const streamSources = recordValues(agg.events).reduce((array, e) => {
+                    const key = `${e.stream.pattern}:${e.stream.version}`;
+                    if (array.indexOf(key) === -1) {
+                        return [...array, key];
+                    }
+                    return array;
+                }, []);
+                await ctx.state('aggregations').upsert({
+                    realm: evt.name,
+                    version: agg.version,
+                    pattern: agg.pattern,
+                    runtime: agg.runtime,
+                    streamSources: {
+                        streams: streamSources,
+                    },
+                });
+                for (const eventSrc of recordValues(agg.events)) {
+                    // TODO merge (remove old previous sources)
+                    await ctx.state('aggregationStreamSources').upsert({
+                        realm: agg.realm,
+                        version: agg.version,
+                        pattern: agg.pattern,
+                        streamPattern: eventSrc.stream.pattern,
+                        streamVersion: eventSrc.stream.version,
+                        streamEvent: 'event' in eventSrc ? eventSrc.event : eventSrc.output,
+                    });
+                }
+            }
+            for (const stream of evt.streams) {
+                const id = {
+                    realm: evt.name,
+                    tenant: evt.tenant,
+                    version: stream.version,
+                    pattern: stream.pattern,
+                };
+                for (const [evtName, streamEvt] of recordEntries(stream.events)) {
+                    const existing = await ctx.snapshot('streamEvents').get({
+                        event: evtName,
+                        realm: id.realm,
+                        version: id.version,
+                        pattern: id.pattern,
+                    });
+                    if (existing) {
+                        if (!isCompatibleJsonSchemaDescription(existing.data.schema, streamEvt.schema)) {
+                            throw new CustomError('event not backward compatible', {
+                                evtName,
+                            });
+                        }
+                    }
+                    await ctx.state('streamEvents').upsert({
+                        realm: id.realm,
+                        version: id.version,
+                        pattern: id.pattern,
+                        event: evtName,
+                        schema: streamEvt.schema,
+                    });
+                }
+                await ctx.state('streams').upsert({
+                    realm: id.realm,
+                    version: id.version,
+                    pattern: id.pattern,
+                    runtime: stream.runtime,
+                });
+            }
+        },
+        'register-tenant': async (evt, ctx) => {
+            const isAdmin = isConfiguredReservedTenantAdmin(ctx.env, ctx.metadata.auth);
+            // Only reserved admins may bootstrap the iwentsourcing tenant
+            // (the management plane). Regular users register their own tenants.
+            if (evt.tenant === iwentsourcingRealm.name && !isAdmin) {
+                throw new CustomError('reserved tenant cannot be registered', {
+                    tenant: evt.tenant,
+                });
+            }
+            const authId = await getAuthId(ctx.env, ctx.metadata.auth);
+            const tenant = evt.tenant;
+            const existingTenant = await ctx.snapshot('tenants').get({ tenant });
+            if (existingTenant) {
+                throw new CustomError('tenant is already registered', {});
+            }
+            await ctx.state('tenants').insert({
+                tenant,
+                recordedAt: ctx.metadata.createdAt,
+            });
+            await ctx.state('tenantMembership').insert({
+                tenant,
+                authId,
+                recordedAt: ctx.metadata.createdAt,
+            });
+        },
+    },
+});
+//# sourceMappingURL=registry-stream.js.map

package/dist/management/registry/registry-stream.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-stream.js","sourceRoot":"","sources":["../../../src/management/registry/registry-stream.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAEtE,OAAO,EAAE,iCAAiC,EAAE,MAAM,yDAAyD,CAAC;AAC5G,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AAEvF,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAC,kBAAkB,EAAE;IAC7D,MAAM,EAAE,cAAc;IACtB,KAAK,EAAE,aAAa;IACpB,UAAU,EAAE;QACV;YACE,KAAK,EAAE,kBAAkB;YACzB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,SAAS,CAAC;YAC7C,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;SACpD;QACD;YACE,KAAK,EAAE,OAAO;YACd,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,CAAC;YACpD,OAAO,EAAE,EAAE;SACZ;QACD;YACE,KAAK,EAAE,SAAS;YAChB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,CAAC;YACpD,OAAO,EAAE,EAAE;SACZ;QACD;YACE,KAAK,EAAE,cAAc;YACrB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,CAAC;YACpD,OAAO,EAAE,EAAE;SACZ;KACF;IACD,OAAO,EAAE;QACP,cAAc,EAAE,gBAAgB,CAAC,cAAc,CAAC;QAChD,eAAe,EAAE,gBAAgB,CAAC,eAAe,CAAC;KACnD;IACD,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE;IAC/B,OAAO,EAAE,UAAU;IACnB,MAAM,EAAE;QACN,mBAAmB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACtC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC3D,MAAM,YAAY,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC;gBAC9D,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,MAAM;aACP,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,+BAA+B,CAC7C,GAAG,CAAC,GAAG,EACP,GAAG,CAAC,QAAQ,CAAC,IAAI,CAClB,CAAC;YACF,IAAI,CAAC,YAAY,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC9B,MAAM,IAAI,WAAW,CAAC,8BAA8B,EAAE,EAAE,CAAC,CAAC;YAC5D,CAAC;YAED,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;gBAC7B,KAAK,EAAE,GAAG,CAAC,IAAI;gBACf,SAAS,EAAE,GAAG,CAAC,cAAc;aAC9B,CAAC,CAAC;YAEH,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;gBAC9B,IAAI,EAAE,GAAG,CAAC,IAAI;aACf,CAAC,CAAC;YAEH,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;gBACnC,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CACnD,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;oBACX,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBACtD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;wBAC9B,OAAO,CAAC,GAAG,KAAK,EAAE,GAAG,CAAC,CAAC;oBACzB,CAAC;oBACD,OAAO,KAAK,CAAC;gBACf,CAAC,EACD,EAAE,CACH,CAAC;gBACF,MAAM,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC;oBACrC,KAAK,EAAE,GAAG,CAAC,IAAI;oBACf,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,aAAa,EAAE;wBACb,OAAO,EAAE,aAAa;qBACvB;iBACF,CAAC,CAAC;gBACH,KAAK,MAAM,QAAQ,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBAChD,2CAA2C;oBAC3C,MAAM,GAAG,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC,MAAM,CAAC;wBACjD,KAAK,EAAE,GAAG,CAAC,KAAK;wBAChB,OAAO,EAAE,GAAG,CAAC,OAAO;wBACpB,OAAO,EAAE,GAAG,CAAC,OAAO;wBACpB,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO;wBACtC,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO;wBACtC,WAAW,EAAE,OAAO,IAAI,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM;qBACpE,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;gBACjC,MAAM,EAAE,GAAyB;oBAC/B,KAAK,EAAE,GAAG,CAAC,IAAI;oBACf,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;iBACxB,CAAC;gBAEF,KAAK,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;oBAChE,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC;wBACtD,KAAK,EAAE,OAAO;wBACd,KAAK,EAAE,EAAE,CAAC,KAAK;wBACf,OAAO,EAAE,EAAE,CAAC,OAAO;wBACnB,OAAO,EAAE,EAAE,CAAC,OAAO;qBACpB,CAAC,CAAC;oBAEH,IAAI,QAAQ,EAAE,CAAC;wBACb,IACE,CAAC,iCAAiC,CAChC,QAAQ,CAAC,IAAI,CAAC,MAAM,EACpB,SAAS,CAAC,MAAM,CACjB,EACD,CAAC;4BACD,MAAM,IAAI,WAAW,CAAC,+BAA+B,EAAE;gCACrD,OAAO;6BACR,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;oBAED,MAAM,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC;wBACrC,KAAK,EAAE,EAAE,CAAC,KAAK;wBACf,OAAO,EAAE,EAAE,CAAC,OAAO;wBACnB,OAAO,EAAE,EAAE,CAAC,OAAO;wBACnB,KAAK,EAAE,OAAO;wBACd,MAAM,EAAE,SAAS,CAAC,MAAM;qBACzB,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;oBAChC,KAAK,EAAE,EAAE,CAAC,KAAK;oBACf,OAAO,EAAE,EAAE,CAAC,OAAO;oBACnB,OAAO,EAAE,EAAE,CAAC,OAAO;oBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;iBACxB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,iBAAiB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACpC,MAAM,OAAO,GAAG,+BAA+B,CAC7C,GAAG,CAAC,GAAG,EACP,GAAG,CAAC,QAAQ,CAAC,IAAI,CAClB,CAAC;YACF,8DAA8D;YAC9D,oEAAoE;YACpE,IAAI,GAAG,CAAC,MAAM,KAAK,kBAAkB,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACvD,MAAM,IAAI,WAAW,CAAC,sCAAsC,EAAE;oBAC5D,MAAM,EAAE,GAAG,CAAC,MAAM;iBACnB,CAAC,CAAC;YACL,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC3D,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;YAE1B,MAAM,cAAc,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;YACrE,IAAI,cAAc,EAAE,CAAC;gBACnB,MAAM,IAAI,WAAW,CAAC,8BAA8B,EAAE,EAAE,CAAC,CAAC;YAC5D,CAAC;YAED,MAAM,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;gBAChC,MAAM;gBACN,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,SAAS;aACnC,CAAC,CAAC;YAEH,MAAM,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAAC;gBACzC,MAAM;gBACN,MAAM;gBACN,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,SAAS;aACnC,CAAC,CAAC;QACL,CAAC;KACF;CACF,CAAC,CAAC"}

package/dist/management/registry/reserved-tenant-admins-from-env.d.ts

@@ -0,0 +1,10 @@
+import { EventAuth } from '../../event-store/event-auth.js';
+import { RuntimeEnv } from '../../environment/runtime-env.js';
+export declare const RESERVED_TENANT_ADMINS_ENV = "IWENTSOURCING_RESERVED_TENANT_ADMINS";
+export type ReservedTenantAdminClaim = {
+    iss: string;
+    sub: string;
+    aud: string;
+};
+export declare function parseReservedTenantAdminsFromEnv(env: RuntimeEnv): ReadonlyArray<ReservedTenantAdminClaim>;
+export declare function isConfiguredReservedTenantAdmin(env: RuntimeEnv, auth: EventAuth): boolean;

package/dist/management/registry/reserved-tenant-admins-from-env.js

@@ -0,0 +1,42 @@
+import { CustomError } from '../../error/custom-error.js';
+export const RESERVED_TENANT_ADMINS_ENV = 'IWENTSOURCING_RESERVED_TENANT_ADMINS';
+export function parseReservedTenantAdminsFromEnv(env) {
+    const raw = env.env(RESERVED_TENANT_ADMINS_ENV);
+    if (raw == null || raw.trim() === '') {
+        return [];
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new CustomError(`${RESERVED_TENANT_ADMINS_ENV} must be valid JSON`, {});
+    }
+    if (!Array.isArray(parsed)) {
+        throw new CustomError(`${RESERVED_TENANT_ADMINS_ENV} must be a JSON array`, {});
+    }
+    const out = [];
+    for (const entry of parsed) {
+        if (entry == null || typeof entry !== 'object' || Array.isArray(entry)) {
+            throw new CustomError(`${RESERVED_TENANT_ADMINS_ENV} entries must be objects with iss, sub, aud`, {});
+        }
+        const iss = entry.iss;
+        const sub = entry.sub;
+        const aud = entry.aud;
+        if (typeof iss !== 'string' ||
+            typeof sub !== 'string' ||
+            typeof aud !== 'string' ||
+            iss === '' ||
+            sub === '' ||
+            aud === '') {
+            throw new CustomError(`${RESERVED_TENANT_ADMINS_ENV} entries require non-empty iss, sub, and aud strings`, {});
+        }
+        out.push({ iss, sub, aud });
+    }
+    return out;
+}
+export function isConfiguredReservedTenantAdmin(env, auth) {
+    const admins = parseReservedTenantAdminsFromEnv(env);
+    return admins.some((a) => a.iss === auth.iss && a.sub === auth.sub && a.aud === auth.aud);
+}
+//# sourceMappingURL=reserved-tenant-admins-from-env.js.map

package/dist/management/registry/reserved-tenant-admins-from-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reserved-tenant-admins-from-env.js","sourceRoot":"","sources":["../../../src/management/registry/reserved-tenant-admins-from-env.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAE1D,MAAM,CAAC,MAAM,0BAA0B,GACrC,sCAAsC,CAAC;AAQzC,MAAM,UAAU,gCAAgC,CAC9C,GAAe;IAEf,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;IAChD,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CACnB,GAAG,0BAA0B,qBAAqB,EAClD,EAAE,CACH,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,WAAW,CACnB,GAAG,0BAA0B,uBAAuB,EACpD,EAAE,CACH,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAA+B,EAAE,CAAC;IAC3C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,WAAW,CACnB,GAAG,0BAA0B,6CAA6C,EAC1E,EAAE,CACH,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAI,KAA2B,CAAC,GAAG,CAAC;QAC7C,MAAM,GAAG,GAAI,KAA2B,CAAC,GAAG,CAAC;QAC7C,MAAM,GAAG,GAAI,KAA2B,CAAC,GAAG,CAAC;QAC7C,IACE,OAAO,GAAG,KAAK,QAAQ;YACvB,OAAO,GAAG,KAAK,QAAQ;YACvB,OAAO,GAAG,KAAK,QAAQ;YACvB,GAAG,KAAK,EAAE;YACV,GAAG,KAAK,EAAE;YACV,GAAG,KAAK,EAAE,EACV,CAAC;YACD,MAAM,IAAI,WAAW,CACnB,GAAG,0BAA0B,sDAAsD,EACnF,EAAE,CACH,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,GAAe,EACf,IAAe;IAEf,MAAM,MAAM,GAAG,gCAAgC,CAAC,GAAG,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,IAAI,CAChB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,CACtE,CAAC;AACJ,CAAC"}

package/dist/management/registry/reserved-tenant-admins-from-env.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/management/registry/reserved-tenant-admins-from-env.test.js

@@ -0,0 +1,61 @@
+import { describe, it } from 'node:test';
+import { deepEqual, throws } from 'node:assert';
+import { parseReservedTenantAdminsFromEnv, isConfiguredReservedTenantAdmin, RESERVED_TENANT_ADMINS_ENV, } from './reserved-tenant-admins-from-env.js';
+function mockEnv(map) {
+    return {
+        env(name) {
+            return map[name] ?? null;
+        },
+        platform() {
+            return 'linux';
+        },
+        decoder() {
+            throw new Error('not implemented');
+        },
+        encoder() {
+            throw new Error('not implemented');
+        },
+        crypto() {
+            throw new Error('not implemented');
+        },
+    };
+}
+describe('reserved-tenant-admins-from-env', () => {
+    it('returns empty when unset', () => {
+        deepEqual(parseReservedTenantAdminsFromEnv(mockEnv({})), []);
+    });
+    it('parses a valid JSON array', () => {
+        const json = JSON.stringify([
+            { iss: 'https://a', sub: 'u1', aud: 'api' },
+            { iss: 'https://b', sub: 'u2', aud: 'api2' },
+        ]);
+        deepEqual(parseReservedTenantAdminsFromEnv(mockEnv({ [RESERVED_TENANT_ADMINS_ENV]: json })), [
+            { iss: 'https://a', sub: 'u1', aud: 'api' },
+            { iss: 'https://b', sub: 'u2', aud: 'api2' },
+        ]);
+    });
+    it('matches auth triples', () => {
+        const env = mockEnv({
+            [RESERVED_TENANT_ADMINS_ENV]: JSON.stringify([
+                { iss: 'i', sub: 's', aud: 'a' },
+            ]),
+        });
+        deepEqual(isConfiguredReservedTenantAdmin(env, {
+            iss: 'i',
+            sub: 's',
+            aud: 'a',
+        }), true);
+        deepEqual(isConfiguredReservedTenantAdmin(env, {
+            iss: 'i',
+            sub: 'other',
+            aud: 'a',
+        }), false);
+    });
+    it('throws when JSON is invalid', () => {
+        throws(() => parseReservedTenantAdminsFromEnv(mockEnv({ [RESERVED_TENANT_ADMINS_ENV]: 'not-json' })), /must be valid JSON/);
+    });
+    it('throws when value is not an array', () => {
+        throws(() => parseReservedTenantAdminsFromEnv(mockEnv({ [RESERVED_TENANT_ADMINS_ENV]: '{}' })), /must be a JSON array/);
+    });
+});
+//# sourceMappingURL=reserved-tenant-admins-from-env.test.js.map

package/dist/management/registry/reserved-tenant-admins-from-env.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reserved-tenant-admins-from-env.test.js","sourceRoot":"","sources":["../../../src/management/registry/reserved-tenant-admins-from-env.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EACL,gCAAgC,EAChC,+BAA+B,EAC/B,0BAA0B,GAC3B,MAAM,sCAAsC,CAAC;AAG9C,SAAS,OAAO,CAAC,GAAuC;IACtD,OAAO;QACL,GAAG,CAAC,IAAY;YACd,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;QAC3B,CAAC;QACD,QAAQ;YACN,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,OAAO;YACL,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACrC,CAAC;QACD,OAAO;YACL,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACrC,CAAC;QACD,MAAM;YACJ,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACrC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,SAAS,CAAC,gCAAgC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1B,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE;YAC3C,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE;SAC7C,CAAC,CAAC;QACH,SAAS,CACP,gCAAgC,CAC9B,OAAO,CAAC,EAAE,CAAC,0BAA0B,CAAC,EAAE,IAAI,EAAE,CAAC,CAChD,EACD;YACE,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE;YAC3C,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE;SAC7C,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAC9B,MAAM,GAAG,GAAG,OAAO,CAAC;YAClB,CAAC,0BAA0B,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC;gBAC3C,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;aACjC,CAAC;SACH,CAAC,CAAC;QACH,SAAS,CACP,+BAA+B,CAAC,GAAG,EAAE;YACnC,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,GAAG;SACT,CAAC,EACF,IAAI,CACL,CAAC;QACF,SAAS,CACP,+BAA+B,CAAC,GAAG,EAAE;YACnC,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,GAAG;SACT,CAAC,EACF,KAAK,CACN,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,CACJ,GAAG,EAAE,CACH,gCAAgC,CAC9B,OAAO,CAAC,EAAE,CAAC,0BAA0B,CAAC,EAAE,UAAU,EAAE,CAAC,CACtD,EACH,oBAAoB,CACrB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CACJ,GAAG,EAAE,CACH,gCAAgC,CAC9B,OAAO,CAAC,EAAE,CAAC,0BAA0B,CAAC,EAAE,IAAI,EAAE,CAAC,CAChD,EACH,sBAAsB,CACvB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/management/registry/system-realm.d.ts

@@ -0,0 +1,2 @@
+import { StaticRealmDefinition } from '../../registry/static-realm-definition.js';
+export declare const systemRealm: StaticRealmDefinition;

package/dist/management/registry/system-realm.js

@@ -0,0 +1,11 @@
+import { iwentsourcingRealm } from '../system/iwentsourcing-realm.js';
+import { registryStream } from './registry-stream.js';
+import { authenticationStream } from '../authentication/authentication-stream.js';
+import { accessStream } from '../access/access-stream.js';
+import { permissionAggregation } from '../permission/permission-aggregation.js';
+export const systemRealm = {
+    realm: iwentsourcingRealm,
+    streams: [registryStream, authenticationStream, accessStream],
+    aggregations: [permissionAggregation],
+};
+//# sourceMappingURL=system-realm.js.map

package/dist/management/registry/system-realm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-realm.js","sourceRoot":"","sources":["../../../src/management/registry/system-realm.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AAClF,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAEhF,MAAM,CAAC,MAAM,WAAW,GAA0B;IAChD,KAAK,EAAE,kBAAkB;IACzB,OAAO,EAAE,CAAC,cAAc,EAAE,oBAAoB,EAAE,YAAY,CAAC;IAC7D,YAAY,EAAE,CAAC,qBAAqB,CAAC;CACtC,CAAC"}

package/dist/management/replay-result.d.ts

@@ -0,0 +1,5 @@
+import { TypeOf } from '../typing/type-of.js';
+export declare const ReplayResult: import("../typing/object-type-description.js").ObjectTypeDescription<{
+    run: number;
+}>;
+export type ReplayResult = TypeOf<typeof ReplayResult>;

package/dist/management/replay-result.js

@@ -0,0 +1,6 @@
+import { object } from '../typing/object.js';
+import { number } from '../typing/number.js';
+export const ReplayResult = object('ReplayResult', {
+    run: number(),
+});
+//# sourceMappingURL=replay-result.js.map

package/dist/management/replay-result.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay-result.js","sourceRoot":"","sources":["../../src/management/replay-result.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAG7C,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,cAAc,EAAE;IACjD,GAAG,EAAE,MAAM,EAAE;CACd,CAAC,CAAC"}

package/dist/management/resolve-read-policy.d.ts

@@ -0,0 +1,13 @@
+import { Lazy } from '../lazy/lazy.js';
+import { UserContext } from './user-context.js';
+import { SequencerPartition } from '../sequencer/sequencer-partition.js';
+import { PermissionState } from './permission/permission-aggregation.js';
+import { AggregateInterface } from '../aggregation/aggregate-interface.js';
+import { StateReadVariant } from './state-read-policy.js';
+export declare function resolveStateReadVariants(opts: {
+    permission: AggregateInterface<PermissionState>;
+    lazyContext: Lazy<UserContext>;
+    lazyPartition: Lazy<SequencerPartition>;
+    stateName: string;
+    signal: AbortSignal;
+}): Promise<StateReadVariant[]>;

package/dist/management/resolve-read-policy.js

@@ -0,0 +1,18 @@
+import { parseStateReadPolicyJson, readPermissionRowPolicyJson, } from './state-read-policy.js';
+export async function resolveStateReadVariants(opts) {
+    const [partition, context] = await Promise.all([
+        opts.lazyPartition.resolve(),
+        opts.lazyContext.resolve(),
+    ]);
+    const perm = await opts.permission.snapshot('permissions').get({
+        streamVersion: partition.version,
+        streamName: partition.name,
+        type: `state`,
+        identifier: opts.stateName,
+        authId: context.authId,
+        run: partition.run,
+        realm: partition.realm,
+    }, { signal: opts.signal });
+    return parseStateReadPolicyJson(readPermissionRowPolicyJson(perm));
+}
+//# sourceMappingURL=resolve-read-policy.js.map

package/dist/management/resolve-read-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-read-policy.js","sourceRoot":"","sources":["../../src/management/resolve-read-policy.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,wBAAwB,EACxB,2BAA2B,GAE5B,MAAM,wBAAwB,CAAC;AAEhC,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,IAM9C;IACC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC7C,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE;QAC5B,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE;KAC3B,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,GAAG,CAC5D;QACE,aAAa,EAAE,SAAS,CAAC,OAAO;QAChC,UAAU,EAAE,SAAS,CAAC,IAAI;QAC1B,IAAI,EAAE,OAAO;QACb,UAAU,EAAE,IAAI,CAAC,SAAS;QAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,KAAK,EAAE,SAAS,CAAC,KAAK;KACvB,EACD,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CACxB,CAAC;IACF,OAAO,wBAAwB,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC;AACrE,CAAC"}

package/dist/management/runtime-options.d.ts

@@ -0,0 +1,19 @@
+import { Lock } from '../lock/lock.js';
+import { Queue } from '../queue/queue.js';
+import { RuntimeEnv } from '../environment/runtime-env.js';
+import { PartitionBuilder } from '../storage/partition/partition-builder.js';
+import { StorageBuilder } from '../storage/versioned/storage-builder.js';
+import { MigrationStorageBuilder } from '../storage/versioned/create-migration-storage-builder.js';
+import { RuntimeFactory } from '../runtime/runtime-factory.js';
+import { Telemetry } from '../tracer/telemetry.js';
+export interface RuntimeOptions {
+    lock: Lock;
+    queue: Queue;
+    telemetry: Telemetry;
+    env: RuntimeEnv;
+    partitionBuilder: PartitionBuilder;
+    storageBuilder: StorageBuilder;
+    migrationBuilder: MigrationStorageBuilder;
+    runtimeFactory: RuntimeFactory;
+    seed: string;
+}

package/dist/management/runtime-options.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=runtime-options.js.map

package/dist/management/runtime-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-options.js","sourceRoot":"","sources":["../../src/management/runtime-options.ts"],"names":[],"mappings":""}

package/dist/management/state-read-policy.d.ts

@@ -0,0 +1,27 @@
+import type { StateDefinition } from '../storage/state-declaration.js';
+import type { SnapshotClient } from '../storage/snapshot-client.js';
+import type { ObservedClient } from '../storage/observer/observed-client.js';
+import type { UserContext } from './user-context.js';
+import type { Lazy } from '../lazy/lazy.js';
+import type { SequencerPartition } from '../sequencer/sequencer-partition.js';
+export type StateReadVariant = {
+    methods: string[];
+    filters: {
+        field: string;
+        value: string;
+    }[];
+};
+export declare function readPermissionRowPolicyJson(perm: {
+    data: {
+        policyJson?: unknown;
+    };
+} | null | undefined): string | undefined;
+export type StateReadPolicyScope = {
+    lazyPartition: Lazy<SequencerPartition>;
+    stateName: string;
+};
+export declare function parseStateReadPolicyJson(raw: string | undefined | null): StateReadVariant[];
+export declare function buildPolicyPlaceholderMap(context: UserContext): Record<string, string>;
+export declare function resolvePolicyTemplate(template: string, context: UserContext): string;
+export declare function wrapSnapshotClientWithReadPolicy<TState extends StateDefinition<any, any, any>>(inner: SnapshotClient<TState>, variants: StateReadVariant[], lazyContext: Lazy<UserContext>, stateDef: TState, scope: StateReadPolicyScope): SnapshotClient<TState>;
+export declare function wrapObservedClientWithReadPolicy<TState extends StateDefinition<any, any, any>>(inner: ObservedClient<TState>, variants: StateReadVariant[], lazyContext: Lazy<UserContext>, stateDef: TState, scope: StateReadPolicyScope): ObservedClient<TState>;

package/dist/management/state-read-policy.enforcement.test.d.ts

@@ -0,0 +1 @@
+export {};