@layerzerolabs/common-canton 1.2.35 → 1.2.36

package/src/client/canton-client.ts

@@ -1003,14 +1003,16 @@ export class CantonClient implements ICantonClient {
      * @param offset - Ledger offset for the snapshot
      * @param opts.templateIds - Optional template IDs to filter by
      * @param opts.limit - Maximum number of contracts to return
+     * @param opts.includeCreatedEventBlob - Include CIP disclosure blobs (default false)
      */
     async queryActiveContracts(
         party: string,
         offset: number,
-        opts?: { templateIds?: string[]; limit?: number },
+        opts?: { templateIds?: string[]; limit?: number; includeCreatedEventBlob?: boolean },
     ): Promise<JsActiveContract[]> {
         return this.queryActiveContractsByParties([party], offset, opts?.templateIds ?? [], {
             limit: opts?.limit,
+            includeCreatedEventBlob: opts?.includeCreatedEventBlob,
         });
     }
 
@@ -1023,17 +1025,18 @@ export class CantonClient implements ICantonClient {
      * @param offset - Ledger offset for the snapshot
      * @param templateIds - Template IDs to filter by
      * @param opts.limit - Maximum number of contracts to return
+     * @param opts.includeCreatedEventBlob - Include CIP disclosure blobs (default false)
      */
     async queryActiveContractsByParties(
         parties: string[],
         offset: number,
         templateIds: string[],
-        opts?: { limit?: number },
+        opts?: { limit?: number; includeCreatedEventBlob?: boolean },
     ): Promise<JsActiveContract[]> {
         return this.#fetchActiveContracts(
             parties,
             offset,
-            this.#buildCumulativeFilters(templateIds),
+            this.#buildCumulativeFilters(templateIds, opts?.includeCreatedEventBlob),
             opts,
         );
     }
@@ -1147,16 +1150,23 @@ export class CantonClient implements ICantonClient {
      * Build cumulative filters for party-based queries.
      * If templateIds provided, filters by those templates; otherwise uses wildcard.
      */
-    #buildCumulativeFilters(templateIds?: string[]): CumulativeFilter[] {
+    #buildCumulativeFilters(
+        templateIds?: string[],
+        includeCreatedEventBlob = false,
+    ): CumulativeFilter[] {
         if (templateIds?.length) {
             return templateIds.map((templateId) => ({
                 identifierFilter: {
-                    templateFilter: { value: { templateId, includeCreatedEventBlob: false } },
+                    templateFilter: { value: { templateId, includeCreatedEventBlob } },
                 },
             }));
         }
         return [
-            { identifierFilter: { wildcardFilter: { value: { includeCreatedEventBlob: false } } } },
+            {
+                identifierFilter: {
+                    wildcardFilter: { value: { includeCreatedEventBlob } },
+                },
+            },
         ];
     }
 

package/src/client/grpc.ts

@@ -68,14 +68,14 @@ export class CantonGrpcClient {
     #synchronizerId?: string;
 
     /**
-     * @param opts - Admin API host, auth, optional synchronizer id, and optional TLS.
+     * @param opts - Admin API host, auth, optional synchronizer id, and transport security.
      */
     constructor(opts: CantonGrpcClientOptions) {
         this.#tokenProvider = opts.tokenProvider;
         this.#synchronizerId = opts.synchronizerId;
         this.#transport = new GrpcTransport({
             host: opts.host,
-            channelCredentials: buildChannelCredentials(opts.host, opts.tls),
+            channelCredentials: buildChannelCredentials(opts.host, opts.insecureTransport),
             clientOptions: opts.grpcClientOptions ?? DEFAULT_GRPC_CLIENT_OPTIONS,
         });
         this.#topologyRead = new TopologyManagerReadServiceClient(this.#transport);
@@ -149,9 +149,11 @@ export class CantonGrpcClient {
         );
 
         const generated = response.generatedTransactions[0];
+
         if (!generated) {
             throw new CantonProtocolError('GenerateTransactions returned no topology transaction');
         }
+
         return generated;
     }
 

package/src/client/index.ts

@@ -18,7 +18,6 @@ export type {
     NamespaceDelegationState,
     PartyToKeyMappingState,
     PartyToParticipantMappingState,
-    TlsOptions,
     UpdateDecentralizedNamespaceDefinitionTxParams,
 } from './topology/types';
 export { computeDecentralizedNamespace, computeMultiTransactionHash } from './topology/utils';

package/src/client/interface.ts

@@ -306,7 +306,7 @@ export interface ICantonClient {
     queryActiveContracts(
         party: string,
         offset: number,
-        opts?: { templateIds?: string[]; limit?: number },
+        opts?: { templateIds?: string[]; limit?: number; includeCreatedEventBlob?: boolean },
     ): Promise<JsActiveContract[]>;
 
     /**
@@ -322,7 +322,7 @@ export interface ICantonClient {
         parties: string[],
         offset: number,
         templateIds: string[],
-        opts?: { limit?: number },
+        opts?: { limit?: number; includeCreatedEventBlob?: boolean },
     ): Promise<JsActiveContract[]>;
 
     /**

package/src/client/topology/types.ts

@@ -104,16 +104,6 @@ export type PartyToParticipantMappingState = {
     serial: number;
 };
 
-/** TLS credentials for Canton admin gRPC connections. */
-export type TlsOptions = {
-    /** CA root certificate for server verification. */
-    rootCert?: Buffer;
-    /** Client private key for mutual TLS. */
-    clientKey?: Buffer;
-    /** Client certificate for mutual TLS. */
-    clientCert?: Buffer;
-};
-
 /** Options for constructing a {@link CantonGrpcClient}. */
 export type CantonGrpcClientOptions = {
     /** Participant admin API host (e.g. `participant.example.com:443`). */
@@ -126,8 +116,8 @@ export type CantonGrpcClientOptions = {
      * is resolved on the first RPC.
      */
     synchronizerId?: string;
-    /** TLS options; omitted for insecure (non-:443) or default SSL on :443. */
-    tls?: TlsOptions;
+    /** Drops transport encryption; loopback hosts only. Defaults to TLS. */
+    insecureTransport?: boolean;
     /** Overrides the default gRPC channel options. */
     grpcClientOptions?: ClientOptions;
 };

package/src/client/topology/utils.ts

@@ -3,8 +3,8 @@ import { ChannelCredentials } from '@grpc/grpc-js';
 
 import { bytesToHex } from '@layerzerolabs/common-encoding-utils';
 
+import { CantonError } from '../../errors';
 import { cantonMultihash } from '../utils';
-import type { TlsOptions } from './types';
 
 /** Canton hash purpose for decentralized namespace derivation. */
 const HASH_PURPOSE_DECENTRALIZED_NAMESPACE = 37;
@@ -77,17 +77,38 @@ export function headStateBaseQuery(synchronizerId: string, proposals = false): B
     });
 }
 
+const LOOPBACK_HOSTNAMES = new Set(['localhost', '::1']);
+const LOOPBACK_IPV4 = /^127(\.\d{1,3}){3}$/;
+
+/**
+ * Whether a `host:port` target addresses the local machine.
+ */
+const isLoopbackHost = (host: string): boolean => {
+    const hostname = host
+        .replace(/:\d+$/, '')
+        .replace(/^\[(.*)\]$/, '$1')
+        .toLowerCase();
+    return LOOPBACK_HOSTNAMES.has(hostname) || LOOPBACK_IPV4.test(hostname);
+};
+
 /**
  * Builds gRPC channel credentials for the Canton admin API.
  *
- * Uses explicit TLS when `tls` is set, default SSL for hosts ending in `:443`,
- * and insecure credentials otherwise.
+ * Encrypted whatever the port, because every admin call carries a reusable bearer token.
+ *
+ * @throws {CantonError} If an unencrypted channel is asked for on a remote host.
  */
-export function buildChannelCredentials(host: string, tls?: TlsOptions): ChannelCredentials {
-    if (tls) {
-        return ChannelCredentials.createSsl(tls.rootCert, tls.clientKey, tls.clientCert);
+export const buildChannelCredentials = (
+    host: string,
+    insecureTransport = false,
+): ChannelCredentials => {
+    if (!insecureTransport) {
+        return ChannelCredentials.createSsl();
+    } else if (!isLoopbackHost(host)) {
+        throw new CantonError(
+            `Canton admin API requires an encrypted channel for a remote host: ${host}`,
+        );
     }
-    return host.endsWith(':443')
-        ? ChannelCredentials.createSsl()
-        : ChannelCredentials.createInsecure();
-}
+
+    return ChannelCredentials.createInsecure();
+};

package/src/provider.ts

@@ -137,9 +137,10 @@ export type CreateCantonChainProviderOptions = {
 /**
  * Create a {@link CantonChainProvider} from a provider URI.
  *
- * - **isLocal=true**: Uses {@link LocalTokenProvider} with admin-level access (self-signed JWTs).
+ * - **isLocal=true**: Uses {@link LocalTokenProvider} with admin-level access (self-signed JWTs)
+ *   over an unencrypted admin channel, allowed for a loopback admin host only.
  * - **isLocal=false**: Uses {@link ClientCredentialsTokenProvider} with OAuth2 client
- *   credentials extracted from the URI query parameters.
+ *   credentials extracted from the URI query parameters, over a TLS admin channel.
  */
 export function createCantonChainProvider({
     uri,
@@ -163,6 +164,7 @@ export function createCantonChainProvider({
     const grpcClient = new CantonGrpcClient({
         host: params.adminApiHost,
         tokenProvider,
+        insecureTransport: isLocal,
     });
 
     return {

package/src/sdk/canton-sdk.ts

@@ -421,7 +421,7 @@ export class CantonSdk {
     queryActiveContracts(
         party: string,
         offset: number,
-        opts?: { templateIds?: string[]; limit?: number },
+        opts?: { templateIds?: string[]; limit?: number; includeCreatedEventBlob?: boolean },
     ): Promise<JsActiveContract[]> {
         return this.#client.queryActiveContracts(party, offset, opts);
     }

package/test/client/topology/utils.test.ts

@@ -0,0 +1,47 @@
+import { describe, expect, it } from 'vitest';
+
+import { buildChannelCredentials } from '../../../src/client/topology/utils';
+
+describe('admin API channel credentials', () => {
+    it('encrypts a conventional admin port', () => {
+        expect(buildChannelCredentials('participant.example.com:5002')._isSecure()).toBe(true);
+    });
+
+    it('encrypts the HTTPS port', () => {
+        expect(buildChannelCredentials('participant.example.com:443')._isSecure()).toBe(true);
+    });
+
+    it('encrypts a loopback host by default', () => {
+        expect(buildChannelCredentials('localhost:2902')._isSecure()).toBe(true);
+    });
+
+    it('drops encryption for a loopback name', () => {
+        expect(buildChannelCredentials('localhost:2902', true)._isSecure()).toBe(false);
+    });
+
+    it('drops encryption for a loopback address', () => {
+        expect(buildChannelCredentials('127.0.0.1:2902', true)._isSecure()).toBe(false);
+    });
+
+    it('drops encryption for a bracketed IPv6 loopback address', () => {
+        expect(buildChannelCredentials('[::1]:2902', true)._isSecure()).toBe(false);
+    });
+
+    it('rejects an unencrypted channel to a remote host', () => {
+        expect(() => buildChannelCredentials('participant.example.com:5002', true)).toThrow(
+            /requires an encrypted channel/,
+        );
+    });
+
+    it('rejects an unencrypted channel to a host merely named after loopback', () => {
+        expect(() => buildChannelCredentials('localhost.example.com:5002', true)).toThrow(
+            /requires an encrypted channel/,
+        );
+    });
+
+    it('rejects an unencrypted channel to a public address in the loopback range shape', () => {
+        expect(() => buildChannelCredentials('128.0.0.1:2902', true)).toThrow(
+            /requires an encrypted channel/,
+        );
+    });
+});

package/test/provider.test.ts

@@ -1,4 +1,10 @@
-import { describe, expect, it, vi } from 'vitest';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+import type { CantonGrpcClientOptions } from '../src/client/topology/types';
+
+const { grpcClientOptions } = vi.hoisted(() => ({
+    grpcClientOptions: [] as CantonGrpcClientOptions[],
+}));
 
 vi.mock('../src/auth/client-credentials-token-provider', () => ({
     ClientCredentialsTokenProvider: class {},
@@ -10,7 +16,11 @@ vi.mock('../src/client/canton-client', () => ({
     CantonClient: class {},
 }));
 vi.mock('../src/client/grpc', () => ({
-    CantonGrpcClient: class {},
+    CantonGrpcClient: class {
+        constructor(options: CantonGrpcClientOptions) {
+            grpcClientOptions.push(options);
+        }
+    },
 }));
 vi.mock('../src/open-api/runtime', () => ({ Configuration: class {} }));
 
@@ -98,3 +108,28 @@ describe('parseCantonChainUri', () => {
         }
     });
 });
+
+describe('createCantonChainProvider', () => {
+    beforeEach(() => {
+        grpcClientOptions.length = 0;
+    });
+
+    it('leaves the admin channel encrypted for a non-local deployment', async () => {
+        const { createCantonChainProvider } = await loadProvider();
+
+        createCantonChainProvider({
+            uri: `${BASE}&token-url=http://token&client-id=cid&client-secret=secret`,
+            isLocal: false,
+        });
+
+        expect(grpcClientOptions[0]?.insecureTransport).toBe(false);
+    });
+
+    it('drops admin channel encryption for a local deployment', async () => {
+        const { createCantonChainProvider } = await loadProvider();
+
+        createCantonChainProvider({ uri: BASE, isLocal: true });
+
+        expect(grpcClientOptions[0]?.insecureTransport).toBe(true);
+    });
+});

package/dist/AH32N3GF.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/provider.ts"],"names":["parseCantonChainUri","uri","url","URL","adminApiHost","searchParams","get","Error","userId","actAsParam","actAs","split","map","party","trim","filter","length","walletUrl","tokenUrl","undefined","clientId","clientSecret","process","env","CANTON_CLIENT_SECRET","scope","audience","key","delete","jsonApiUrl","toString","replace","oauth2","createCantonChainProvider","isLocal","params","tokenProvider","createTokenProvider","configuration","Configuration","basePath","accessToken","getToken","client","CantonClient","grpcClient","CantonGrpcClient","host","LocalTokenProvider","admin","ClientCredentialsTokenProvider"],"mappings":";;;;;;;;AA6DO,SAASA,oBAAoBC,GAAAA,EAAW;AAC3C,EAAA,MAAMC,GAAAA,GAAM,IAAIC,GAAAA,CAAIF,GAAAA,CAAAA;AAEpB,EAAA,MAAMG,YAAAA,GAAeF,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,WAAA,CAAA;AAC1C,EAAA,IAAI,CAACF,YAAAA,EAAc;AACf,IAAA,MAAM,IAAIG,MAAM,kEAAA,CAAA;AACpB,EAAA;AAEA,EAAA,MAAMC,MAAAA,GAASN,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,SAAA,CAAA,IAAc,mBAAA;AAClD,EAAA,MAAMG,UAAAA,GAAaP,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,QAAA,CAAA;AACxC,EAAA,MAAMI,QACFD,UAAAA,EACME,KAAAA,CAAM,GAAA,CAAA,CACPC,GAAAA,CAAI,CAACC,KAAAA,KAAUA,KAAAA,CAAMC,MAAI,CAAA,CACzBC,OAAO,CAACF,KAAAA,KAAUA,MAAMG,MAAAA,GAAS,CAAA,KAAM,EAAA;AAChD,EAAA,MAAMC,SAAAA,GAAYf,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,YAAA,CAAA;AACvC,EAAA,IAAI,CAACW,SAAAA,EAAW;AACZ,IAAA,MAAM,IAAIV,MAAM,mEAAA,CAAA;AACpB,EAAA;AACA,EAAA,MAAMW,QAAAA,GAAWhB,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,WAAA,CAAA,IAAgBa,MAAAA;AACtD,EAAA,MAAMC,QAAAA,GAAWlB,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,WAAA,CAAA,IAAgBa,MAAAA;AAEtD,EAAA,MAAME,YAAAA,GACFnB,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,eAAA,CAAA;AAErBgB,EAAAA,OAAAA,CAAQC,IAAIC,oBAAAA,IACZL,MAAAA;AACJ,EAAA,MAAMM,KAAAA,GAAQvB,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,OAAA,CAAA,IAAYa,MAAAA;AAC/C,EAAA,MAAMO,QAAAA,GAAWxB,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,UAAA,CAAA,IAAea,MAAAA;AAErD,EAAA,KAAA,MAAWQ,GAAAA,IAAO;AACd,IAAA,WAAA;AACA,IAAA,SAAA;AACA,IAAA,QAAA;AACA,IAAA,YAAA;AACA,IAAA,eAAA;AACA,IAAA,sBAAA;AACA,IAAA,kBAAA;AACA,IAAA,WAAA;AACA,IAAA,WAAA;AACA,IAAA,eAAA;AACA,IAAA,OAAA;AACA,IAAA;AACD,GAAA,EAAA;AACCzB,IAAAA,GAAAA,CAAIG,YAAAA,CAAauB,OAAOD,GAAAA,CAAAA;AAC5B,EAAA;AAEA,EAAA,MAAME,aAAa3B,GAAAA,CAAI4B,QAAAA,EAAQ,CAAGC,OAAAA,CAAQ,OAAO,EAAA,CAAA;AAEjD,EAAA,MAAMC,MAAAA,GACFd,QAAAA,IAAYE,QAAAA,IAAYC,YAAAA,GAClB;AAAEH,IAAAA,QAAAA;AAAUE,IAAAA,QAAAA;AAAUC,IAAAA,YAAAA;AAAcI,IAAAA,KAAAA;AAAOC,IAAAA;GAAS,GACpDP,MAAAA;AAEV,EAAA,OAAO;AACHU,IAAAA,UAAAA;AACAzB,IAAAA,YAAAA;AACAI,IAAAA,MAAAA;AACAE,IAAAA,KAAAA;AACAO,IAAAA,SAAAA;AACAe,IAAAA;AACJ,GAAA;AACJ;AA9DgBhC,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;AAkFT,SAASiC,yBAAAA,CAA0B,EACtChC,GAAAA,EACAiC,OAAAA,EAAO,EACwB;AAC/B,EAAA,MAAMC,MAAAA,GAASnC,oBAAoBC,GAAAA,CAAAA;AAEnC,EAAA,MAAMmC,aAAAA,GAAgBC,mBAAAA,CAAoBF,MAAAA,EAAQD,OAAAA,CAAAA;AAGlD,EAAA,MAAMI,aAAAA,GAAgB,IAAIC,aAAAA,CAAc;AACpCC,IAAAA,QAAAA,EAAUL,MAAAA,CAAON,UAAAA;IACjBY,WAAAA,kBAAa,MAAA,CAAA,MAAML,aAAAA,CAAcM,QAAAA,EAAQ,EAA5B,aAAA;GACjB,CAAA;AACA,EAAA,MAAMC,MAAAA,GAAS,IAAIC,YAAAA,CAAaN,aAAAA,EAAeH,OAAO3B,MAAAA,EAAQ;AAC1DS,IAAAA,SAAAA,EAAWkB,MAAAA,CAAOlB,SAAAA;AAClBmB,IAAAA;GACJ,CAAA;AAGA,EAAA,MAAMS,UAAAA,GAAa,IAAIC,gBAAAA,CAAiB;AACpCC,IAAAA,IAAAA,EAAMZ,MAAAA,CAAO/B,YAAAA;AACbgC,IAAAA;GACJ,CAAA;AAEA,EAAA,OAAO;AACHO,IAAAA,MAAAA;AACAE,IAAAA,UAAAA;AACAT,IAAAA,aAAAA;AACAnB,IAAAA,SAAAA,EAAWkB,MAAAA,CAAOlB;AACtB,GAAA;AACJ;AA9BgBgB,MAAAA,CAAAA,yBAAAA,EAAAA,2BAAAA,CAAAA;AAgChB,SAASI,mBAAAA,CAAoBF,QAA8BD,OAAAA,EAAgB;AACvE,EAAA,IAAIA,OAAAA,EAAS;AACT,IAAA,OAAO,IAAIc,kBAAAA,CAAmB;AAC1BxC,MAAAA,MAAAA,EAAQ2B,MAAAA,CAAO3B,MAAAA;AACfE,MAAAA,KAAAA,EAAOyB,MAAAA,CAAOzB,KAAAA;MACduC,KAAAA,EAAO;KACX,CAAA;AACJ,EAAA;AAGA,EAAA,IAAI,CAACd,OAAOH,MAAAA,EAAQ;AAChB,IAAA,MAAM,IAAIzB,MACN,kHAAA,CAAA;AAER,EAAA;AAEA,EAAA,OAAO,IAAI2C,8BAAAA,CAA+Bf,MAAAA,CAAOH,MAAM,CAAA;AAC3D;AAjBSK,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA","file":"AH32N3GF.js","sourcesContent":["import {\n    ClientCredentialsTokenProvider,\n    type ClientCredentialsTokenProviderConfig,\n} from './auth/client-credentials-token-provider';\nimport { LocalTokenProvider } from './auth/local-token-provider';\nimport type { TokenProvider } from './auth/token-provider';\nimport { CantonClient } from './client/canton-client';\nimport { CantonGrpcClient } from './client/grpc';\nimport type { ICantonClient } from './client/interface';\nimport { Configuration } from './open-api/runtime';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Provider Type\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * - {@link client} — JSON Ledger API (commands, queries, updates)\n * - {@link grpcClient} — gRPC Admin API (topology transactions, namespace queries)\n * - {@link tokenProvider} — Shared Bearer-token source used by both transports\n * - {@link walletUrl} — Canton Network validator wallet (scan-proxy CIP-56 endpoints)\n */\nexport type CantonChainProvider = {\n    client: ICantonClient;\n    grpcClient: CantonGrpcClient;\n    tokenProvider: TokenProvider;\n    /** Validator wallet URL for scan-proxy CIP-56 endpoints. Required. */\n    walletUrl: string;\n};\n\n// ─────────────────────────────────────────────────────────────────────────────\n// URI Parsing\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport type CantonChainUriParams = {\n    /** Base URL of the JSON Ledger API (e.g. \"http://localhost:5975\") */\n    jsonApiUrl: string;\n    /** Host:port of the gRPC Admin API (e.g. \"localhost:5076\") */\n    adminApiHost: string;\n    /** Ledger API user ID (default: \"participant_admin\") */\n    userId: string;\n    /** Parties granted `actAs` on localnet tokens (comma-separated in the URI). */\n    actAs: string[];\n    /** Validator wallet URL for scan-proxy CIP-56 endpoints (e.g. \"http://localhost:7201\"). Required. */\n    walletUrl: string;\n    /** OAuth2 client credentials config — present only for non-local environments */\n    oauth2?: ClientCredentialsTokenProviderConfig;\n};\n\n/**\n * Parse a Canton chain provider URI into its constituent parts.\n *\n * URI format:\n *   `<json-api-base>?admin-api=<host:port>&user-id=<id>&wallet-url=<url>[&token-url=...&client-id=...&client-secret=...&scope=...&audience=...]`\n *\n * The base URL (everything before the query string) is the JSON Ledger API endpoint.\n * Canton-specific params are extracted and removed; any remaining query params are\n * preserved on the JSON API URL.\n *\n * When `client-secret` is omitted from the URI, `CANTON_CLIENT_SECRET` is read from the\n * environment.\n */\nexport function parseCantonChainUri(uri: string): CantonChainUriParams {\n    const url = new URL(uri);\n\n    const adminApiHost = url.searchParams.get('admin-api');\n    if (!adminApiHost) {\n        throw new Error('Canton provider URI missing required \"admin-api\" query parameter');\n    }\n\n    const userId = url.searchParams.get('user-id') ?? 'participant_admin';\n    const actAsParam = url.searchParams.get('act-as');\n    const actAs =\n        actAsParam\n            ?.split(',')\n            .map((party) => party.trim())\n            .filter((party) => party.length > 0) ?? [];\n    const walletUrl = url.searchParams.get('wallet-url');\n    if (!walletUrl) {\n        throw new Error('Canton provider URI missing required \"wallet-url\" query parameter');\n    }\n    const tokenUrl = url.searchParams.get('token-url') ?? undefined;\n    const clientId = url.searchParams.get('client-id') ?? undefined;\n    // Prefer URI param; fall back to env so secrets are not committed in provider configs.\n    const clientSecret =\n        url.searchParams.get('client-secret') ??\n        // eslint-disable-next-line turbo/no-undeclared-env-vars -- runtime OAuth secret, not a turbo task input\n        process.env.CANTON_CLIENT_SECRET ??\n        undefined;\n    const scope = url.searchParams.get('scope') ?? undefined;\n    const audience = url.searchParams.get('audience') ?? undefined;\n\n    for (const key of [\n        'admin-api',\n        'user-id',\n        'act-as',\n        'wallet-url',\n        'sequencer-url',\n        'sequencer-validators',\n        'sequencer-quorum',\n        'token-url',\n        'client-id',\n        'client-secret',\n        'scope',\n        'audience',\n    ]) {\n        url.searchParams.delete(key);\n    }\n\n    const jsonApiUrl = url.toString().replace(/\\/$/, '');\n\n    const oauth2 =\n        tokenUrl && clientId && clientSecret\n            ? { tokenUrl, clientId, clientSecret, scope, audience }\n            : undefined;\n\n    return {\n        jsonApiUrl,\n        adminApiHost,\n        userId,\n        actAs,\n        walletUrl,\n        oauth2,\n    };\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Provider Factory\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport type CreateCantonChainProviderOptions = {\n    /** Raw provider URI (from provider config) */\n    uri: string;\n    /** When true, uses LocalTokenProvider (self-signed JWTs) instead of OAuth2 */\n    isLocal: boolean;\n};\n\n/**\n * Create a {@link CantonChainProvider} from a provider URI.\n *\n * - **isLocal=true**: Uses {@link LocalTokenProvider} with admin-level access (self-signed JWTs).\n * - **isLocal=false**: Uses {@link ClientCredentialsTokenProvider} with OAuth2 client\n *   credentials extracted from the URI query parameters.\n */\nexport function createCantonChainProvider({\n    uri,\n    isLocal,\n}: CreateCantonChainProviderOptions): CantonChainProvider {\n    const params = parseCantonChainUri(uri);\n\n    const tokenProvider = createTokenProvider(params, isLocal);\n\n    // ── JSON Ledger API Client ──────────────────────────────────────────\n    const configuration = new Configuration({\n        basePath: params.jsonApiUrl,\n        accessToken: () => tokenProvider.getToken(),\n    });\n    const client = new CantonClient(configuration, params.userId, {\n        walletUrl: params.walletUrl,\n        tokenProvider,\n    });\n\n    // ── gRPC Admin API Client ───────────────────────────────────────────\n    const grpcClient = new CantonGrpcClient({\n        host: params.adminApiHost,\n        tokenProvider,\n    });\n\n    return {\n        client,\n        grpcClient,\n        tokenProvider,\n        walletUrl: params.walletUrl,\n    };\n}\n\nfunction createTokenProvider(params: CantonChainUriParams, isLocal: boolean): TokenProvider {\n    if (isLocal) {\n        return new LocalTokenProvider({\n            userId: params.userId,\n            actAs: params.actAs,\n            admin: true,\n        });\n    }\n\n    // TODO(canton): add other prod auth methods (direct JWT passthrough, etc.).\n    if (!params.oauth2) {\n        throw new Error(\n            'Canton provider requires OAuth2 credentials (token-url, client-id, client-secret in URI or CANTON_CLIENT_SECRET)',\n        );\n    }\n\n    return new ClientCredentialsTokenProvider(params.oauth2);\n}\n"]}

package/dist/IA2UQ4WQ.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/client/grpc.ts"],"names":["DEFAULT_GRPC_CLIENT_OPTIONS","CantonGrpcClient","opts","tokenProvider","synchronizerId","GrpcTransport","host","channelCredentials","buildChannelCredentials","tls","clientOptions","grpcClientOptions","TopologyManagerReadServiceClient","TopologyManagerWriteServiceClient","SynchronizerConnectivityServiceClient","token","getToken","Authorization","response","listConnectedSynchronizers","meta","synchronizer","connectedSynchronizers","CantonProtocolError","mapping","serial","generateTransactions","GenerateTransactionsRequest","create","proposals","GenerateTransactionsRequest_Proposal","operation","Enums_TopologyChangeOp","ADD_REPLACE","store","synchronizerStore","generated","generatedTransactions","getNamespaceDelegation","namespaceFingerprint","listNamespaceDelegation","ListNamespaceDelegationRequest","baseQuery","headStateBaseQuery","filterNamespace","filterTargetKeyFingerprint","results","flatMap","result","item","publicKey","targetKey","namespace","targetKeyFingerprint","computePublicKeyFingerprint","isRootDelegation","context","getDecentralizedNamespaceDefinition","listDecentralizedNamespaceDefinition","ListDecentralizedNamespaceDefinitionRequest","decentralizedNamespace","threshold","owners","getPartyToKeyMapping","partyId","listPartyToKeyMapping","ListPartyToKeyMappingRequest","filterParty","party","signingKeyFingerprints","signingKeys","map","key","getPartyToParticipantMapping","listPartyToParticipant","ListPartyToParticipantRequest","filterParticipant","participants","participant","participantUid","permission","createNamespaceDelegationTx","params","buildNamespaceDelegationMapping","publicKeyDer","createDecentralizedNamespaceDefinitionTx","computeDecentralizedNamespace","buildDecentralizedNamespaceDefinitionMapping","updateDecentralizedNamespaceDefinitionTx","createPartyToKeyTx","buildPartyToKeyMapping","signingPublicKeyDers","createPartyToParticipantTx","buildPartyToParticipantMapping","participantIds","submitTopologyTransactions","transactions","length","CantonError","addTransactions","AddTransactionsRequest","close"],"mappings":";;;;;;;;;AA+CA,IAAMA,2BAAAA,GAA8B;AAChC,EAAA,iCAAA,EAAmC,MAAM,IAAA,GAAO,IAAA;AAChD,EAAA,8BAAA,EAAgC,MAAM,IAAA,GAAO;AACjD,CAAA;AAWO,IAAMC,mBAAN,MAAMA;EA7Db;;;AA8Da,EAAA,UAAA;AACA,EAAA,aAAA;AACA,EAAA,cAAA;AACA,EAAA,aAAA;AACA,EAAA,cAAA;AACT,EAAA,eAAA;;;;AAKA,EAAA,WAAA,CAAYC,IAAAA,EAA+B;AACvC,IAAA,IAAA,CAAK,iBAAiBA,IAAAA,CAAKC,aAAAA;AAC3B,IAAA,IAAA,CAAK,kBAAkBD,IAAAA,CAAKE,cAAAA;AAC5B,IAAA,IAAA,CAAK,UAAA,GAAa,IAAIC,aAAAA,CAAc;AAChCC,MAAAA,IAAAA,EAAMJ,IAAAA,CAAKI,IAAAA;AACXC,MAAAA,kBAAAA,EAAoBC,uBAAAA,CAAwBN,IAAAA,CAAKI,IAAAA,EAAMJ,IAAAA,CAAKO,GAAG,CAAA;AAC/DC,MAAAA,aAAAA,EAAeR,KAAKS,iBAAAA,IAAqBX;KAC7C,CAAA;AACA,IAAA,IAAA,CAAK,aAAA,GAAgB,IAAIY,gCAAAA,CAAiC,IAAA,CAAK,UAAU,CAAA;AACzE,IAAA,IAAA,CAAK,cAAA,GAAiB,IAAIC,iCAAAA,CAAkC,IAAA,CAAK,UAAU,CAAA;AAC3E,IAAA,IAAA,CAAK,aAAA,GAAgB,IAAIC,qCAAAA,CAAsC,IAAA,CAAK,UAAU,CAAA;AAClF,EAAA;;AAGA,EAAA,MAAM,QAAA,GAAQ;AACV,IAAA,MAAMC,KAAAA,GAAQ,MAAM,IAAA,CAAK,cAAA,CAAeC,QAAAA,EAAQ;AAChD,IAAA,OAAO;AAAEC,MAAAA,aAAAA,EAAe,UAAUF,KAAAA,CAAAA;AAAQ,KAAA;AAC9C,EAAA;;;;;;AAOA,EAAA,MAAM,kBAAA,GAAkB;AACpB,IAAA,IAAI,KAAK,eAAA,EAAiB;AACtB,MAAA,OAAO,IAAA,CAAK,eAAA;AAChB,IAAA;AACA,IAAA,IAAA,CAAK,eAAA,GAAkB,MAAM,IAAA,CAAK,uBAAA,EAAuB;AACzD,IAAA,OAAO,IAAA,CAAK,eAAA;AAChB,EAAA;;;;;;AAOA,EAAA,MAAM,uBAAA,GAAuB;AACzB,IAAA,MAAM,EAAEG,UAAQ,GAAK,MAAM,KAAK,aAAA,CAAcC,0BAAAA,CAC1C,EAAC,EACD;MAAEC,IAAAA,EAAM,MAAM,KAAK,QAAA;KAAW,CAAA;AAElC,IAAA,KAAA,MAAWC,YAAAA,IAAgBH,SAASI,sBAAAA,EAAwB;AACxD,MAAA,IAAID,aAAajB,cAAAA,EAAgB;AAC7B,QAAA,OAAOiB,YAAAA,CAAajB,cAAAA;AACxB,MAAA;AACJ,IAAA;AACA,IAAA,MAAM,IAAImB,oBAAoB,kDAAA,CAAA;AAClC,EAAA;;;;;;;;;;EAWA,MAAM,4BAAA,CACFnB,cAAAA,EACAoB,OAAAA,EACAC,MAAAA,EAAc;AAEd,IAAA,MAAM,EAAEP,UAAQ,GAAK,MAAM,KAAK,cAAA,CAAeQ,oBAAAA,CAC3CC,4BAA4BC,MAAAA,CAAO;MAC/BC,SAAAA,EAAW;AACPC,QAAAA,oCAAAA,CAAqCF,MAAAA,CAAO;AACxCG,UAAAA,SAAAA,EAAWC,sBAAAA,CAAuBC,WAAAA;AAClCR,UAAAA,MAAAA;AACAD,UAAAA,OAAAA;AACAU,UAAAA,KAAAA,EAAOC,kBAAkB/B,cAAAA;SAC7B;;AAER,KAAA,CAAA,EACA;MAAEgB,IAAAA,EAAM,MAAM,KAAK,QAAA;KAAW,CAAA;AAGlC,IAAA,MAAMgB,SAAAA,GAAYlB,QAAAA,CAASmB,qBAAAA,CAAsB,CAAA,CAAA;AACjD,IAAA,IAAI,CAACD,SAAAA,EAAW;AACZ,MAAA,MAAM,IAAIb,oBAAoB,uDAAA,CAAA;AAClC,IAAA;AACA,IAAA,OAAOa,SAAAA;AACX,EAAA;;;;;;;;;;AAWA,EAAA,MAAME,uBACFC,oBAAAA,EACmC;AACnC,IAAA,MAAMnC,cAAAA,GAAiB,MAAM,IAAA,CAAK,kBAAA,EAAkB;AACpD,IAAA,MAAM,EAAEc,UAAQ,GAAK,MAAM,KAAK,aAAA,CAAcsB,uBAAAA,CAC1CC,+BAA+Bb,MAAAA,CAAO;AAClCc,MAAAA,SAAAA,EAAWC,mBAAmBvC,cAAAA,CAAAA;MAC9BwC,eAAAA,EAAiBL,oBAAAA;;MAEjBM,0BAAAA,EAA4B;AAChC,KAAA,CAAA,EACA;MAAEzB,IAAAA,EAAM,MAAM,KAAK,QAAA;KAAW,CAAA;AAGlC,IAAA,OAAOF,QAAAA,CAAS4B,OAAAA,CAAQC,OAAAA,CAAQ,CAACC,MAAAA,KAAAA;AAC7B,MAAA,MAAMC,OAAOD,MAAAA,CAAOC,IAAAA;AACpB,MAAA,MAAMC,SAAAA,GAAYD,MAAME,SAAAA,EAAWD,SAAAA;AACnC,MAAA,IAAI,CAACD,IAAAA,IAAQ,CAACC,SAAAA,EAAW;AACrB,QAAA,OAAO,EAAA;AACX,MAAA;AACA,MAAA,OAAO;AACH,QAAA;AACIE,UAAAA,SAAAA,EAAWH,IAAAA,CAAKG,SAAAA;AAChBC,UAAAA,oBAAAA,EAAsBC,4BAA4BJ,SAAAA,CAAAA;AAClDK,UAAAA,gBAAAA,EAAkBN,IAAAA,CAAKM,gBAAAA;UACvB9B,MAAAA,EAAQuB,MAAAA,CAAOQ,SAAS/B,MAAAA,IAAU;AACtC;;IAER,CAAA,CAAA;AACJ,EAAA;;;;;;;;;;AAWA,EAAA,MAAMgC,oCACFlB,oBAAAA,EACgD;AAChD,IAAA,MAAMnC,cAAAA,GAAiB,MAAM,IAAA,CAAK,kBAAA,EAAkB;AACpD,IAAA,MAAM,EAAEc,UAAQ,GAAK,MAAM,KAAK,aAAA,CAAcwC,oCAAAA,CAC1CC,4CAA4C/B,MAAAA,CAAO;AAC/Cc,MAAAA,SAAAA,EAAWC,mBAAmBvC,cAAAA,CAAAA;MAC9BwC,eAAAA,EAAiBL;AACrB,KAAA,CAAA,EACA;MAAEnB,IAAAA,EAAM,MAAM,KAAK,QAAA;KAAW,CAAA;AAGlC,IAAA,OAAOF,QAAAA,CAAS4B,OAAAA,CAAQC,OAAAA,CAAQ,CAACC,MAAAA,KAAAA;AAC7B,MAAA,MAAMC,OAAOD,MAAAA,CAAOC,IAAAA;AACpB,MAAA,IAAI,CAACA,IAAAA,EAAM;AACP,QAAA,OAAO,EAAA;AACX,MAAA;AACA,MAAA,OAAO;AACH,QAAA;AACIG,UAAAA,SAAAA,EAAWH,IAAAA,CAAKW,sBAAAA;AAChBC,UAAAA,SAAAA,EAAWZ,IAAAA,CAAKY,SAAAA;UAChBC,MAAAA,EAAQ;eAAIb,IAAAA,CAAKa;;UACjBrC,MAAAA,EAAQuB,MAAAA,CAAOQ,SAAS/B,MAAAA,IAAU;AACtC;;IAER,CAAA,CAAA;AACJ,EAAA;;;;;;;;;AAUA,EAAA,MAAMsC,qBAAqBC,OAAAA,EAAoD;AAC3E,IAAA,MAAM5D,cAAAA,GAAiB,MAAM,IAAA,CAAK,kBAAA,EAAkB;AACpD,IAAA,MAAM,EAAEc,UAAQ,GAAK,MAAM,KAAK,aAAA,CAAc+C,qBAAAA,CAC1CC,6BAA6BtC,MAAAA,CAAO;AAChCc,MAAAA,SAAAA,EAAWC,mBAAmBvC,cAAAA,CAAAA;MAC9B+D,WAAAA,EAAaH;AACjB,KAAA,CAAA,EACA;MAAE5C,IAAAA,EAAM,MAAM,KAAK,QAAA;KAAW,CAAA;AAGlC,IAAA,OAAOF,QAAAA,CAAS4B,OAAAA,CAAQC,OAAAA,CAAQ,CAACC,MAAAA,KAAAA;AAC7B,MAAA,MAAMC,OAAOD,MAAAA,CAAOC,IAAAA;AACpB,MAAA,IAAI,CAACA,IAAAA,EAAM;AACP,QAAA,OAAO,EAAA;AACX,MAAA;AACA,MAAA,OAAO;AACH,QAAA;AACImB,UAAAA,KAAAA,EAAOnB,IAAAA,CAAKmB,KAAAA;AACZP,UAAAA,SAAAA,EAAWZ,IAAAA,CAAKY,SAAAA;UAChBQ,sBAAAA,EAAwBpB,IAAAA,CAAKqB,YAAYC,GAAAA,CAAI,CAACC,QAC1ClB,2BAAAA,CAA4BkB,GAAAA,CAAItB,SAAS,CAAA,CAAA;UAE7CzB,MAAAA,EAAQuB,MAAAA,CAAOQ,SAAS/B,MAAAA,IAAU;AACtC;;IAER,CAAA,CAAA;AACJ,EAAA;;;;;;;;;;EAWA,MAAMgD,4BAAAA,CACFT,OAAAA,EACAnC,SAAAA,GAAY,KAAA,EAC6B;AACzC,IAAA,MAAMzB,cAAAA,GAAiB,MAAM,IAAA,CAAK,kBAAA,EAAkB;AACpD,IAAA,MAAM,EAAEc,UAAQ,GAAK,MAAM,KAAK,aAAA,CAAcwD,sBAAAA,CAC1CC,8BAA8B/C,MAAAA,CAAO;MACjCc,SAAAA,EAAWC,kBAAAA,CAAmBvC,gBAAgByB,SAAAA,CAAAA;MAC9CsC,WAAAA,EAAaH,OAAAA;;MAEbY,iBAAAA,EAAmB;AACvB,KAAA,CAAA,EACA;MAAExD,IAAAA,EAAM,MAAM,KAAK,QAAA;KAAW,CAAA;AAGlC,IAAA,OAAOF,QAAAA,CAAS4B,OAAAA,CAAQC,OAAAA,CAAQ,CAACC,MAAAA,KAAAA;AAC7B,MAAA,MAAMC,OAAOD,MAAAA,CAAOC,IAAAA;AACpB,MAAA,IAAI,CAACA,IAAAA,EAAM;AACP,QAAA,OAAO,EAAA;AACX,MAAA;AACA,MAAA,OAAO;AACH,QAAA;AACImB,UAAAA,KAAAA,EAAOnB,IAAAA,CAAKmB,KAAAA;AACZP,UAAAA,SAAAA,EAAWZ,IAAAA,CAAKY,SAAAA;AAChBgB,UAAAA,YAAAA,EAAc5B,IAAAA,CAAK4B,YAAAA,CAAaN,GAAAA,CAAI,CAACO,WAAAA,MAAiB;AAClDC,YAAAA,cAAAA,EAAgBD,WAAAA,CAAYC,cAAAA;AAC5BC,YAAAA,UAAAA,EAAYF,WAAAA,CAAYE;WAC5B,CAAA,CAAA;UACAvD,MAAAA,EAAQuB,MAAAA,CAAOQ,SAAS/B,MAAAA,IAAU;AACtC;;IAER,CAAA,CAAA;AACJ,EAAA;;;;;;;;;;AAWA,EAAA,MAAMwD,4BACFC,MAAAA,EACqC;AACrC,IAAA,MAAM9E,cAAAA,GAAiB,MAAM,IAAA,CAAK,kBAAA,EAAkB;AACpD,IAAA,MAAMoB,OAAAA,GAAU2D,+BAAAA,CAAgCD,MAAAA,CAAOE,YAAY,CAAA;AACnE,IAAA,OAAO,KAAK,4BAAA,CAA6BhF,cAAAA,EAAgBoB,OAAAA,EAAS0D,MAAAA,CAAOzD,UAAU,CAAA,CAAA;AACvF,EAAA;;;;;;;;;;AAWA,EAAA,MAAM4D,yCACFH,MAAAA,EACqC;AACrC,IAAA,MAAM9E,cAAAA,GAAiB,MAAM,IAAA,CAAK,kBAAA,EAAkB;AACpD,IAAA,MAAMwD,sBAAAA,GAAyB0B,6BAAAA,CAA8BJ,MAAAA,CAAOpB,MAAM,CAAA;AAC1E,IAAA,MAAMtC,UAAU+D,4CAAAA,CACZ3B,sBAAAA,EACAsB,MAAAA,CAAOrB,SAAAA,EACPqB,OAAOpB,MAAM,CAAA;AAEjB,IAAA,OAAO,KAAK,4BAAA,CAA6B1D,cAAAA,EAAgBoB,OAAAA,EAAS0D,MAAAA,CAAOzD,UAAU,CAAA,CAAA;AACvF,EAAA;AAEA,EAAA,MAAM+D,yCACFN,MAAAA,EACqC;AACrC,IAAA,MAAM9E,cAAAA,GAAiB,MAAM,IAAA,CAAK,kBAAA,EAAkB;AACpD,IAAA,MAAMoB,UAAU+D,4CAAAA,CACZL,MAAAA,CAAO9B,WACP8B,MAAAA,CAAOrB,SAAAA,EACPqB,OAAOpB,MAAM,CAAA;AAEjB,IAAA,OAAO,KAAK,4BAAA,CAA6B1D,cAAAA,EAAgBoB,OAAAA,EAAS0D,MAAAA,CAAOzD,UAAU,CAAA,CAAA;AACvF,EAAA;;;;;;;;;AAUA,EAAA,MAAMgE,mBACFP,MAAAA,EACqC;AACrC,IAAA,MAAM9E,cAAAA,GAAiB,MAAM,IAAA,CAAK,kBAAA,EAAkB;AACpD,IAAA,MAAMoB,UAAUkE,sBAAAA,CACZR,MAAAA,CAAOlB,SACPkB,MAAAA,CAAOS,oBAAAA,EACPT,OAAOrB,SAAS,CAAA;AAEpB,IAAA,OAAO,KAAK,4BAAA,CAA6BzD,cAAAA,EAAgBoB,OAAAA,EAAS0D,MAAAA,CAAOzD,UAAU,CAAA,CAAA;AACvF,EAAA;;;;;;;;;;AAWA,EAAA,MAAMmE,2BACFV,MAAAA,EACqC;AACrC,IAAA,MAAM9E,cAAAA,GAAiB,MAAM,IAAA,CAAK,kBAAA,EAAkB;AACpD,IAAA,MAAMoB,UAAUqE,8BAAAA,CACZX,MAAAA,CAAOlB,SACPkB,MAAAA,CAAOY,cAAAA,EACPZ,OAAOrB,SAAS,CAAA;AAEpB,IAAA,OAAO,KAAK,4BAAA,CAA6BzD,cAAAA,EAAgBoB,OAAAA,EAAS0D,MAAAA,CAAOzD,UAAU,CAAA,CAAA;AACvF,EAAA;;;;;;;;;;;;;;AAeA,EAAA,MAAMsE,2BACFC,YAAAA,EACa;AACb,IAAA,IAAIA,YAAAA,CAAaC,WAAW,CAAA,EAAG;AAC3B,MAAA,MAAM,IAAIC,YAAY,mDAAA,CAAA;AAC1B,IAAA;AACA,IAAA,MAAM9F,cAAAA,GAAiB,MAAM,IAAA,CAAK,kBAAA,EAAkB;AACpD,IAAA,MAAM,IAAA,CAAK,cAAA,CAAe+F,eAAAA,CACtBC,sBAAAA,CAAuBxE,MAAAA,CAAO;MAC1BoE,YAAAA,EAAc;AAAIA,QAAAA,GAAAA;;AAClB9D,MAAAA,KAAAA,EAAOC,kBAAkB/B,cAAAA;AAC7B,KAAA,CAAA,EACA;MAAEgB,IAAAA,EAAM,MAAM,KAAK,QAAA;KAAW,CAAA;AAEtC,EAAA;;EAGAiF,KAAAA,GAAc;AACV,IAAA,IAAA,CAAK,WAAWA,KAAAA,EAAK;AACzB,EAAA;AACJ","file":"IA2UQ4WQ.js","sourcesContent":["import {\n    AddTransactionsRequest,\n    Enums_TopologyChangeOp,\n    GenerateTransactionsRequest,\n    GenerateTransactionsRequest_Proposal,\n    ListDecentralizedNamespaceDefinitionRequest,\n    ListNamespaceDelegationRequest,\n    ListPartyToKeyMappingRequest,\n    ListPartyToParticipantRequest,\n    type SignedTopologyTransaction,\n    TopologyManagerReadServiceClient,\n    TopologyManagerWriteServiceClient,\n    type TopologyMapping,\n} from '@canton-network/core-ledger-proto';\nimport { GrpcTransport } from '@protobuf-ts/grpc-transport';\n\nimport type { TokenProvider } from '../auth/token-provider';\nimport { CantonError, CantonProtocolError } from '../errors';\nimport {\n    buildDecentralizedNamespaceDefinitionMapping,\n    buildNamespaceDelegationMapping,\n    buildPartyToKeyMapping,\n    buildPartyToParticipantMapping,\n} from './topology/mappings';\nimport { SynchronizerConnectivityServiceClient } from './topology/synchronizer-connectivity';\nimport type {\n    CantonGrpcClientOptions,\n    CreateDecentralizedNamespaceDefinitionTxParams,\n    CreateNamespaceDelegationTxParams,\n    CreatePartyToKeyMappingTxParams,\n    CreatePartyToParticipantMappingTxParams,\n    DecentralizedNamespaceDefinitionState,\n    GeneratedTopologyTransaction,\n    NamespaceDelegationState,\n    PartyToKeyMappingState,\n    PartyToParticipantMappingState,\n    UpdateDecentralizedNamespaceDefinitionTxParams,\n} from './topology/types';\nimport {\n    buildChannelCredentials,\n    computeDecentralizedNamespace,\n    headStateBaseQuery,\n    synchronizerStore,\n} from './topology/utils';\nimport { computePublicKeyFingerprint } from './utils';\n\n/** Default gRPC client options: 128 MiB message-size limits for large admin responses. */\nconst DEFAULT_GRPC_CLIENT_OPTIONS = {\n    'grpc.max_receive_message_length': 128 * 1024 * 1024,\n    'grpc.max_send_message_length': 128 * 1024 * 1024,\n} as const;\n\n/**\n * gRPC client for the Canton participant admin Topology Manager API.\n *\n * Exposes read queries for topology mappings and write helpers that call\n * `GenerateTransactions` to produce unsigned topology transactions and\n * `AddTransactions` to submit signed ones.\n *\n * A fresh Bearer token is attached to each RPC via {@link TokenProvider}.\n */\nexport class CantonGrpcClient {\n    readonly #transport: GrpcTransport;\n    readonly #topologyRead: TopologyManagerReadServiceClient;\n    readonly #topologyWrite: TopologyManagerWriteServiceClient;\n    readonly #connectivity: SynchronizerConnectivityServiceClient;\n    readonly #tokenProvider: TokenProvider;\n    #synchronizerId?: string;\n\n    /**\n     * @param opts - Admin API host, auth, optional synchronizer id, and optional TLS.\n     */\n    constructor(opts: CantonGrpcClientOptions) {\n        this.#tokenProvider = opts.tokenProvider;\n        this.#synchronizerId = opts.synchronizerId;\n        this.#transport = new GrpcTransport({\n            host: opts.host,\n            channelCredentials: buildChannelCredentials(opts.host, opts.tls),\n            clientOptions: opts.grpcClientOptions ?? DEFAULT_GRPC_CLIENT_OPTIONS,\n        });\n        this.#topologyRead = new TopologyManagerReadServiceClient(this.#transport);\n        this.#topologyWrite = new TopologyManagerWriteServiceClient(this.#transport);\n        this.#connectivity = new SynchronizerConnectivityServiceClient(this.#transport);\n    }\n\n    /** Returns per-RPC gRPC metadata with a fresh Bearer token. */\n    async #getMeta(): Promise<Record<string, string>> {\n        const token = await this.#tokenProvider.getToken();\n        return { Authorization: `Bearer ${token}` };\n    }\n\n    /**\n     * Returns the client synchronizer id, discovering it on first use when omitted at construction.\n     *\n     * @throws {CantonProtocolError} If the participant exposes no synchronizer store.\n     */\n    async #getSynchronizerId(): Promise<string> {\n        if (this.#synchronizerId) {\n            return this.#synchronizerId;\n        }\n        this.#synchronizerId = await this.#discoverSynchronizerId();\n        return this.#synchronizerId;\n    }\n\n    /**\n     * Resolves the logical id of the first synchronizer the participant is connected to.\n     *\n     * @throws {CantonProtocolError} If the participant is not connected to any synchronizer.\n     */\n    async #discoverSynchronizerId(): Promise<string> {\n        const { response } = await this.#connectivity.listConnectedSynchronizers(\n            {},\n            { meta: await this.#getMeta() },\n        );\n        for (const synchronizer of response.connectedSynchronizers) {\n            if (synchronizer.synchronizerId) {\n                return synchronizer.synchronizerId;\n            }\n        }\n        throw new CantonProtocolError('Participant is not connected to any synchronizer');\n    }\n\n    /**\n     * Calls `GenerateTransactions` for a single ADD_REPLACE mapping.\n     *\n     * @param synchronizerId - Synchronizer store to target.\n     * @param mapping - Topology mapping to encode into the transaction.\n     * @param serial - Topology serial (`0` lets Canton auto-determine).\n     * @returns Unsigned topology transaction (`serializedTransaction`, `transactionHash`).\n     * @throws {CantonProtocolError} If the RPC returns no generated transaction.\n     */\n    async #generateTopologyTransaction(\n        synchronizerId: string,\n        mapping: TopologyMapping,\n        serial: number,\n    ): Promise<GeneratedTopologyTransaction> {\n        const { response } = await this.#topologyWrite.generateTransactions(\n            GenerateTransactionsRequest.create({\n                proposals: [\n                    GenerateTransactionsRequest_Proposal.create({\n                        operation: Enums_TopologyChangeOp.ADD_REPLACE,\n                        serial,\n                        mapping,\n                        store: synchronizerStore(synchronizerId),\n                    }),\n                ],\n            }),\n            { meta: await this.#getMeta() },\n        );\n\n        const generated = response.generatedTransactions[0];\n        if (!generated) {\n            throw new CantonProtocolError('GenerateTransactions returned no topology transaction');\n        }\n        return generated;\n    }\n\n    /**\n     * Lists Namespace Delegation (NSD) mappings for a namespace.\n     *\n     * Queries topology head state on the synchronizer. Returns every result from\n     * the list RPC.\n     *\n     * @param namespaceFingerprint - Namespace to filter on (for root NSD, the owner key fingerprint).\n     * @returns All matching NSD mappings, or an empty array if none exist.\n     */\n    async getNamespaceDelegation(\n        namespaceFingerprint: string,\n    ): Promise<NamespaceDelegationState[]> {\n        const synchronizerId = await this.#getSynchronizerId();\n        const { response } = await this.#topologyRead.listNamespaceDelegation(\n            ListNamespaceDelegationRequest.create({\n                baseQuery: headStateBaseQuery(synchronizerId),\n                filterNamespace: namespaceFingerprint,\n                // Empty string = no target-key filter; return all delegations for this namespace.\n                filterTargetKeyFingerprint: '',\n            }),\n            { meta: await this.#getMeta() },\n        );\n\n        return response.results.flatMap((result) => {\n            const item = result.item;\n            const publicKey = item?.targetKey?.publicKey;\n            if (!item || !publicKey) {\n                return [];\n            }\n            return [\n                {\n                    namespace: item.namespace,\n                    targetKeyFingerprint: computePublicKeyFingerprint(publicKey),\n                    isRootDelegation: item.isRootDelegation,\n                    serial: result.context?.serial ?? 0,\n                },\n            ];\n        });\n    }\n\n    /**\n     * Lists Decentralized Namespace Definition (DND) mappings for a namespace.\n     *\n     * Queries topology head state on the synchronizer. For a party id `hint::1220…`,\n     * pass the `1220…` suffix as `namespaceFingerprint`.\n     *\n     * @param namespaceFingerprint - Decentralized namespace fingerprint to filter on.\n     * @returns All matching DND mappings, or an empty array if none exist.\n     */\n    async getDecentralizedNamespaceDefinition(\n        namespaceFingerprint: string,\n    ): Promise<DecentralizedNamespaceDefinitionState[]> {\n        const synchronizerId = await this.#getSynchronizerId();\n        const { response } = await this.#topologyRead.listDecentralizedNamespaceDefinition(\n            ListDecentralizedNamespaceDefinitionRequest.create({\n                baseQuery: headStateBaseQuery(synchronizerId),\n                filterNamespace: namespaceFingerprint,\n            }),\n            { meta: await this.#getMeta() },\n        );\n\n        return response.results.flatMap((result) => {\n            const item = result.item;\n            if (!item) {\n                return [];\n            }\n            return [\n                {\n                    namespace: item.decentralizedNamespace,\n                    threshold: item.threshold,\n                    owners: [...item.owners],\n                    serial: result.context?.serial ?? 0,\n                },\n            ];\n        });\n    }\n\n    /**\n     * Lists Party-to-Key (PTK) mappings for a party.\n     *\n     * Queries topology head state on the synchronizer.\n     *\n     * @param partyId - Full party identifier (e.g. `hint::1220…`).\n     * @returns All matching PTK mappings, or an empty array if none exist.\n     */\n    async getPartyToKeyMapping(partyId: string): Promise<PartyToKeyMappingState[]> {\n        const synchronizerId = await this.#getSynchronizerId();\n        const { response } = await this.#topologyRead.listPartyToKeyMapping(\n            ListPartyToKeyMappingRequest.create({\n                baseQuery: headStateBaseQuery(synchronizerId),\n                filterParty: partyId,\n            }),\n            { meta: await this.#getMeta() },\n        );\n\n        return response.results.flatMap((result) => {\n            const item = result.item;\n            if (!item) {\n                return [];\n            }\n            return [\n                {\n                    party: item.party,\n                    threshold: item.threshold,\n                    signingKeyFingerprints: item.signingKeys.map((key) =>\n                        computePublicKeyFingerprint(key.publicKey),\n                    ),\n                    serial: result.context?.serial ?? 0,\n                },\n            ];\n        });\n    }\n\n    /**\n     * Lists Party-to-Participant (PTP) mappings for a party.\n     *\n     * Queries topology head state on the synchronizer.\n     *\n     * @param partyId - Full party identifier (e.g. `hint::1220…`).\n     * @param proposals - If `true`, query pending proposals instead of authorized mappings.\n     * @returns All matching PTP mappings, or an empty array if none exist.\n     */\n    async getPartyToParticipantMapping(\n        partyId: string,\n        proposals = false,\n    ): Promise<PartyToParticipantMappingState[]> {\n        const synchronizerId = await this.#getSynchronizerId();\n        const { response } = await this.#topologyRead.listPartyToParticipant(\n            ListPartyToParticipantRequest.create({\n                baseQuery: headStateBaseQuery(synchronizerId, proposals),\n                filterParty: partyId,\n                // Empty string = no participant filter; return all hosting mappings for this party.\n                filterParticipant: '',\n            }),\n            { meta: await this.#getMeta() },\n        );\n\n        return response.results.flatMap((result) => {\n            const item = result.item;\n            if (!item) {\n                return [];\n            }\n            return [\n                {\n                    party: item.party,\n                    threshold: item.threshold,\n                    participants: item.participants.map((participant) => ({\n                        participantUid: participant.participantUid,\n                        permission: participant.permission,\n                    })),\n                    serial: result.context?.serial ?? 0,\n                },\n            ];\n        });\n    }\n\n    /**\n     * Builds an unsigned Namespace Delegation (NSD) topology transaction.\n     *\n     * Calls `GenerateTransactions` with an ADD_REPLACE mapping. The returned\n     * `transactionHash` must be signed by the namespace key.\n     *\n     * @param params - Owner public key and optional serial.\n     * @returns Unsigned topology transaction (`serializedTransaction`, `transactionHash`).\n     */\n    async createNamespaceDelegationTx(\n        params: CreateNamespaceDelegationTxParams,\n    ): Promise<GeneratedTopologyTransaction> {\n        const synchronizerId = await this.#getSynchronizerId();\n        const mapping = buildNamespaceDelegationMapping(params.publicKeyDer);\n        return this.#generateTopologyTransaction(synchronizerId, mapping, params.serial ?? 0);\n    }\n\n    /**\n     * Builds an unsigned Decentralized Namespace Definition (DND) topology transaction.\n     *\n     * The decentralized namespace id is derived from `params.owners`. All owners\n     * must sign the transaction hash.\n     *\n     * @param params - Owner fingerprints, threshold, and optional serial.\n     * @returns Unsigned topology transaction (`serializedTransaction`, `transactionHash`).\n     */\n    async createDecentralizedNamespaceDefinitionTx(\n        params: CreateDecentralizedNamespaceDefinitionTxParams,\n    ): Promise<GeneratedTopologyTransaction> {\n        const synchronizerId = await this.#getSynchronizerId();\n        const decentralizedNamespace = computeDecentralizedNamespace(params.owners);\n        const mapping = buildDecentralizedNamespaceDefinitionMapping(\n            decentralizedNamespace,\n            params.threshold,\n            params.owners,\n        );\n        return this.#generateTopologyTransaction(synchronizerId, mapping, params.serial ?? 0);\n    }\n\n    async updateDecentralizedNamespaceDefinitionTx(\n        params: UpdateDecentralizedNamespaceDefinitionTxParams,\n    ): Promise<GeneratedTopologyTransaction> {\n        const synchronizerId = await this.#getSynchronizerId();\n        const mapping = buildDecentralizedNamespaceDefinitionMapping(\n            params.namespace,\n            params.threshold,\n            params.owners,\n        );\n        return this.#generateTopologyTransaction(synchronizerId, mapping, params.serial ?? 0);\n    }\n\n    /**\n     * Builds an unsigned Party-to-Key (PTK) topology transaction.\n     *\n     * Decentralized namespace owners must sign the transaction hash.\n     *\n     * @param params - Party id, signing keys, threshold, and optional serial.\n     * @returns Unsigned topology transaction (`serializedTransaction`, `transactionHash`).\n     */\n    async createPartyToKeyTx(\n        params: CreatePartyToKeyMappingTxParams,\n    ): Promise<GeneratedTopologyTransaction> {\n        const synchronizerId = await this.#getSynchronizerId();\n        const mapping = buildPartyToKeyMapping(\n            params.partyId,\n            params.signingPublicKeyDers,\n            params.threshold,\n        );\n        return this.#generateTopologyTransaction(synchronizerId, mapping, params.serial ?? 0);\n    }\n\n    /**\n     * Builds an unsigned Party-to-Participant (PTP) topology transaction.\n     *\n     * Party owners sign the transaction hash. On submit, set `proposal: true` on the\n     * signed transaction so the hosting participant can authorize via `Authorize`.\n     *\n     * @param params - Party id, participant ids, threshold, and optional serial.\n     * @returns Unsigned topology transaction (`serializedTransaction`, `transactionHash`).\n     */\n    async createPartyToParticipantTx(\n        params: CreatePartyToParticipantMappingTxParams,\n    ): Promise<GeneratedTopologyTransaction> {\n        const synchronizerId = await this.#getSynchronizerId();\n        const mapping = buildPartyToParticipantMapping(\n            params.partyId,\n            params.participantIds,\n            params.threshold,\n        );\n        return this.#generateTopologyTransaction(synchronizerId, mapping, params.serial ?? 0);\n    }\n\n    /**\n     * Submits signed topology transactions to the synchronizer store.\n     *\n     * Multiple transactions are submitted atomically in one `AddTransactions` call.\n     * When batching, sign `computeMultiTransactionHash` over all transaction hashes\n     * and attach the same `MultiTransactionSignatures` to each entry.\n     *\n     * Set `proposal: true` on a transaction when the hosting participant must\n     * authorize that mapping afterward.\n     *\n     * @param transactions - One or more signed topology transactions.\n     * @throws {CantonError} If `transactions` is empty.\n     */\n    async submitTopologyTransactions(\n        transactions: readonly SignedTopologyTransaction[],\n    ): Promise<void> {\n        if (transactions.length === 0) {\n            throw new CantonError('AddTransactions requires at least one transaction');\n        }\n        const synchronizerId = await this.#getSynchronizerId();\n        await this.#topologyWrite.addTransactions(\n            AddTransactionsRequest.create({\n                transactions: [...transactions],\n                store: synchronizerStore(synchronizerId),\n            }),\n            { meta: await this.#getMeta() },\n        );\n    }\n\n    /** Closes the underlying gRPC transport. */\n    close(): void {\n        this.#transport.close();\n    }\n}\n"]}

package/dist/QAKOQQ7E.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/client/topology/utils.ts"],"names":["HASH_PURPOSE_DECENTRALIZED_NAMESPACE","HASH_PURPOSE_MULTI_TRANSACTION","computeDecentralizedNamespace","owners","sorted","sort","parts","owner","ownerBytes","Buffer","from","lengthPrefix","alloc","writeUInt32BE","length","push","bytesToHex","cantonMultihash","concat","computeMultiTransactionHash","hashes","left","right","compare","countBuffer","hash","lengthBuffer","synchronizerStore","synchronizerId","StoreId","create","store","oneofKind","synchronizer","id","headStateBaseQuery","proposals","BaseQuery","timeQuery","headState","Empty","buildChannelCredentials","host","tls","ChannelCredentials","createSsl","rootCert","clientKey","clientCert","endsWith","createInsecure"],"mappings":";;;;;;AASA,IAAMA,oCAAAA,GAAuC,EAAA;AAG7C,IAAMC,8BAAAA,GAAiC,EAAA;AAQhC,SAASC,8BAA8BC,MAAAA,EAAgB;AAC1D,EAAA,MAAMC,MAAAA,GAAS;AAAID,IAAAA,GAAAA;IAAQE,IAAAA,EAAI;AAC/B,EAAA,MAAMC,QAAkB,EAAA;AACxB,EAAA,KAAA,MAAWC,SAASH,MAAAA,EAAQ;AACxB,IAAA,MAAMI,UAAAA,GAAaC,MAAAA,CAAOC,IAAAA,CAAKH,KAAAA,EAAO,OAAA,CAAA;AACtC,IAAA,MAAMI,YAAAA,GAAeF,MAAAA,CAAOG,KAAAA,CAAM,CAAA,CAAA;AAClCD,IAAAA,YAAAA,CAAaE,aAAAA,CAAcL,WAAWM,MAAM,CAAA;AAC5CR,IAAAA,KAAAA,CAAMS,IAAAA,CAAKJ,cAAcH,UAAAA,CAAAA;AAC7B,EAAA;AACA,EAAA,OAAOQ,WAAWC,eAAAA,CAAgBjB,oCAAAA,EAAsCS,OAAOS,MAAAA,CAAOZ,KAAAA,CAAAA,CAAAA,CAAAA;AAC1F;AAVgBJ,MAAAA,CAAAA,6BAAAA,EAAAA,+BAAAA,CAAAA;AAmBT,SAASiB,4BAA4BC,MAAAA,EAAoB;AAC5D,EAAA,MAAMhB,MAAAA,GAAS;AAAIgB,IAAAA,GAAAA;AAAQf,GAAAA,CAAAA,IAAAA,CAAK,CAACgB,IAAAA,EAAMC,KAAAA,KACnCb,MAAAA,CAAOc,OAAAA,CAAQd,MAAAA,CAAOC,IAAAA,CAAKW,IAAAA,CAAAA,EAAOZ,MAAAA,CAAOC,IAAAA,CAAKY,KAAAA,CAAAA,CAAAA,CAAAA;AAElD,EAAA,MAAMhB,QAAkB,EAAA;AACxB,EAAA,MAAMkB,WAAAA,GAAcf,MAAAA,CAAOG,KAAAA,CAAM,CAAA,CAAA;AACjCY,EAAAA,WAAAA,CAAYX,aAAAA,CAAcT,OAAOU,MAAM,CAAA;AACvCR,EAAAA,KAAAA,CAAMS,KAAKS,WAAAA,CAAAA;AACX,EAAA,KAAA,MAAWC,QAAQrB,MAAAA,EAAQ;AACvB,IAAA,MAAMsB,YAAAA,GAAejB,MAAAA,CAAOG,KAAAA,CAAM,CAAA,CAAA;AAClCc,IAAAA,YAAAA,CAAab,aAAAA,CAAcY,KAAKX,MAAM,CAAA;AACtCR,IAAAA,KAAAA,CAAMS,IAAAA,CAAKW,YAAAA,EAAcjB,MAAAA,CAAOC,IAAAA,CAAKe,IAAAA,CAAAA,CAAAA;AACzC,EAAA;AACA,EAAA,OAAOR,eAAAA,CAAgBhB,8BAAAA,EAAgCQ,MAAAA,CAAOS,MAAAA,CAAOZ,KAAAA,CAAAA,CAAAA;AACzE;AAdgBa,MAAAA,CAAAA,2BAAAA,EAAAA,6BAAAA,CAAAA;AAqBT,SAASQ,kBAAkBC,cAAAA,EAAsB;AACpD,EAAA,OAAOC,QAAQC,MAAAA,CAAO;IAClBC,KAAAA,EAAO;MAAEC,SAAAA,EAAW,cAAA;MAAgBC,YAAAA,EAAc;QAAEC,EAAAA,EAAIN;AAAe;AAAE;GAC7E,CAAA;AACJ;AAJgBD,MAAAA,CAAAA,iBAAAA,EAAAA,mBAAAA,CAAAA;AAWT,SAASQ,kBAAAA,CAAmBP,cAAAA,EAAwBQ,SAAAA,GAAY,KAAA,EAAK;AACxE,EAAA,OAAOC,UAAUP,MAAAA,CAAO;AACpBC,IAAAA,KAAAA,EAAOJ,kBAAkBC,cAAAA,CAAAA;IACzBU,SAAAA,EAAW;MAAEN,SAAAA,EAAW,WAAA;MAAaO,SAAAA,EAAWC,KAAAA,CAAMV,MAAAA,CAAO,EAAC;AAAG,KAAA;AACjEM,IAAAA;GACJ,CAAA;AACJ;AANgBD,MAAAA,CAAAA,kBAAAA,EAAAA,oBAAAA,CAAAA;AAcT,SAASM,uBAAAA,CAAwBC,MAAcC,GAAAA,EAAgB;AAClE,EAAA,IAAIA,GAAAA,EAAK;AACL,IAAA,OAAOC,mBAAmBC,SAAAA,CAAUF,GAAAA,CAAIG,UAAUH,GAAAA,CAAII,SAAAA,EAAWJ,IAAIK,UAAU,CAAA;AACnF,EAAA;AACA,EAAA,OAAON,IAAAA,CAAKO,SAAS,MAAA,CAAA,GACfL,mBAAmBC,SAAAA,EAAS,GAC5BD,mBAAmBM,cAAAA,EAAc;AAC3C;AAPgBT,MAAAA,CAAAA,uBAAAA,EAAAA,yBAAAA,CAAAA","file":"QAKOQQ7E.js","sourcesContent":["import { BaseQuery, Empty, StoreId } from '@canton-network/core-ledger-proto';\nimport { ChannelCredentials } from '@grpc/grpc-js';\n\nimport { bytesToHex } from '@layerzerolabs/common-encoding-utils';\n\nimport { cantonMultihash } from '../utils';\nimport type { TlsOptions } from './types';\n\n/** Canton hash purpose for decentralized namespace derivation. */\nconst HASH_PURPOSE_DECENTRALIZED_NAMESPACE = 37;\n\n/** Canton hash purpose for multi-transaction topology signing. */\nconst HASH_PURPOSE_MULTI_TRANSACTION = 55;\n\n/**\n * Computes the decentralized namespace fingerprint from owner key fingerprints.\n *\n * Owners are sorted lexicographically, then hashed as\n * `1220` + SHA256(purpose=37 || for each owner: len(utf8) || utf8).\n */\nexport function computeDecentralizedNamespace(owners: string[]): string {\n    const sorted = [...owners].sort();\n    const parts: Buffer[] = [];\n    for (const owner of sorted) {\n        const ownerBytes = Buffer.from(owner, 'utf-8');\n        const lengthPrefix = Buffer.alloc(4);\n        lengthPrefix.writeUInt32BE(ownerBytes.length);\n        parts.push(lengthPrefix, ownerBytes);\n    }\n    return bytesToHex(cantonMultihash(HASH_PURPOSE_DECENTRALIZED_NAMESPACE, Buffer.concat(parts)));\n}\n\n/**\n * Combines topology transaction hashes into the digest Canton expects signed.\n *\n * Hashes are sorted lexicographically, count-prefixed, each length-prefixed, then\n * hashed with purpose 55. Pass a single hash when signing one transaction —\n * Canton always uses this multi-transaction format for `AddTransactions`.\n */\nexport function computeMultiTransactionHash(hashes: Uint8Array[]): Uint8Array {\n    const sorted = [...hashes].sort((left, right) =>\n        Buffer.compare(Buffer.from(left), Buffer.from(right)),\n    );\n    const parts: Buffer[] = [];\n    const countBuffer = Buffer.alloc(4);\n    countBuffer.writeUInt32BE(sorted.length);\n    parts.push(countBuffer);\n    for (const hash of sorted) {\n        const lengthBuffer = Buffer.alloc(4);\n        lengthBuffer.writeUInt32BE(hash.length);\n        parts.push(lengthBuffer, Buffer.from(hash));\n    }\n    return cantonMultihash(HASH_PURPOSE_MULTI_TRANSACTION, Buffer.concat(parts));\n}\n\n/**\n * Builds a topology `StoreId` scoped to a synchronizer.\n *\n * Used as the `store` field on topology read/write RPC requests.\n */\nexport function synchronizerStore(synchronizerId: string): StoreId {\n    return StoreId.create({\n        store: { oneofKind: 'synchronizer', synchronizer: { id: synchronizerId } },\n    });\n}\n\n/**\n * Builds a topology `BaseQuery` at synchronizer head state.\n *\n * Used as the `baseQuery` field on topology list RPC requests.\n */\nexport function headStateBaseQuery(synchronizerId: string, proposals = false): BaseQuery {\n    return BaseQuery.create({\n        store: synchronizerStore(synchronizerId),\n        timeQuery: { oneofKind: 'headState', headState: Empty.create({}) },\n        proposals,\n    });\n}\n\n/**\n * Builds gRPC channel credentials for the Canton admin API.\n *\n * Uses explicit TLS when `tls` is set, default SSL for hosts ending in `:443`,\n * and insecure credentials otherwise.\n */\nexport function buildChannelCredentials(host: string, tls?: TlsOptions): ChannelCredentials {\n    if (tls) {\n        return ChannelCredentials.createSsl(tls.rootCert, tls.clientKey, tls.clientCert);\n    }\n    return host.endsWith(':443')\n        ? ChannelCredentials.createSsl()\n        : ChannelCredentials.createInsecure();\n}\n"]}