@layerzerolabs/common-canton 1.2.61 → 1.2.62

package/dist/{JRWFKJNA.js → UVTS5LAN.js}

@@ -1,7 +1,7 @@
 import { CantonClient } from './46AEW4RY.js';
 import { Configuration } from './KBNUN3MF.js';
 import { CantonGrpcClient } from './BFQYTMKD.js';
-import { LocalTokenProvider } from './SCEF7TLZ.js';
+import { LocalTokenProvider } from './YF7P4UQM.js';
 import { ClientCredentialsTokenProvider } from './V2H2WXKE.js';
 import { __name } from './VUOMXK5T.js';
 
@@ -99,5 +99,5 @@ function createTokenProvider(params, isLocal) {
 __name(createTokenProvider, "createTokenProvider");
 
 export { createCantonChainProvider, parseCantonChainUri };
-//# sourceMappingURL=JRWFKJNA.js.map
-//# sourceMappingURL=JRWFKJNA.js.map
+//# sourceMappingURL=UVTS5LAN.js.map
+//# sourceMappingURL=UVTS5LAN.js.map

package/dist/{JRWFKJNA.js.map → UVTS5LAN.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/provider.ts"],"names":["parseCantonChainUri","uri","url","URL","adminApiHost","searchParams","get","Error","userId","actAsParam","actAs","split","map","party","trim","filter","length","walletUrl","tokenUrl","undefined","clientId","clientSecret","process","env","CANTON_CLIENT_SECRET","scope","audience","key","delete","jsonApiUrl","toString","replace","oauth2","createCantonChainProvider","isLocal","params","tokenProvider","createTokenProvider","configuration","Configuration","basePath","accessToken","getToken","client","CantonClient","grpcClient","CantonGrpcClient","host","insecureTransport","LocalTokenProvider","admin","ClientCredentialsTokenProvider"],"mappings":";;;;;;;;AA6DO,SAASA,oBAAoBC,GAAAA,EAAW;AAC3C,EAAA,MAAMC,GAAAA,GAAM,IAAIC,GAAAA,CAAIF,GAAAA,CAAAA;AAEpB,EAAA,MAAMG,YAAAA,GAAeF,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,WAAA,CAAA;AAC1C,EAAA,IAAI,CAACF,YAAAA,EAAc;AACf,IAAA,MAAM,IAAIG,MAAM,kEAAA,CAAA;AACpB,EAAA;AAEA,EAAA,MAAMC,MAAAA,GAASN,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,SAAA,CAAA,IAAc,mBAAA;AAClD,EAAA,MAAMG,UAAAA,GAAaP,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,QAAA,CAAA;AACxC,EAAA,MAAMI,QACFD,UAAAA,EACME,KAAAA,CAAM,GAAA,CAAA,CACPC,GAAAA,CAAI,CAACC,KAAAA,KAAUA,KAAAA,CAAMC,MAAI,CAAA,CACzBC,OAAO,CAACF,KAAAA,KAAUA,MAAMG,MAAAA,GAAS,CAAA,KAAM,EAAA;AAChD,EAAA,MAAMC,SAAAA,GAAYf,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,YAAA,CAAA;AACvC,EAAA,IAAI,CAACW,SAAAA,EAAW;AACZ,IAAA,MAAM,IAAIV,MAAM,mEAAA,CAAA;AACpB,EAAA;AACA,EAAA,MAAMW,QAAAA,GAAWhB,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,WAAA,CAAA,IAAgBa,MAAAA;AACtD,EAAA,MAAMC,QAAAA,GAAWlB,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,WAAA,CAAA,IAAgBa,MAAAA;AAEtD,EAAA,MAAME,YAAAA,GACFnB,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,eAAA,CAAA;AAErBgB,EAAAA,OAAAA,CAAQC,IAAIC,oBAAAA,IACZL,MAAAA;AACJ,EAAA,MAAMM,KAAAA,GAAQvB,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,OAAA,CAAA,IAAYa,MAAAA;AAC/C,EAAA,MAAMO,QAAAA,GAAWxB,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,UAAA,CAAA,IAAea,MAAAA;AAErD,EAAA,KAAA,MAAWQ,GAAAA,IAAO;AACd,IAAA,WAAA;AACA,IAAA,SAAA;AACA,IAAA,QAAA;AACA,IAAA,YAAA;AACA,IAAA,eAAA;AACA,IAAA,sBAAA;AACA,IAAA,kBAAA;AACA,IAAA,WAAA;AACA,IAAA,WAAA;AACA,IAAA,eAAA;AACA,IAAA,OAAA;AACA,IAAA;AACD,GAAA,EAAA;AACCzB,IAAAA,GAAAA,CAAIG,YAAAA,CAAauB,OAAOD,GAAAA,CAAAA;AAC5B,EAAA;AAEA,EAAA,MAAME,aAAa3B,GAAAA,CAAI4B,QAAAA,EAAQ,CAAGC,OAAAA,CAAQ,OAAO,EAAA,CAAA;AAEjD,EAAA,MAAMC,MAAAA,GACFd,QAAAA,IAAYE,QAAAA,IAAYC,YAAAA,GAClB;AAAEH,IAAAA,QAAAA;AAAUE,IAAAA,QAAAA;AAAUC,IAAAA,YAAAA;AAAcI,IAAAA,KAAAA;AAAOC,IAAAA;GAAS,GACpDP,MAAAA;AAEV,EAAA,OAAO;AACHU,IAAAA,UAAAA;AACAzB,IAAAA,YAAAA;AACAI,IAAAA,MAAAA;AACAE,IAAAA,KAAAA;AACAO,IAAAA,SAAAA;AACAe,IAAAA;AACJ,GAAA;AACJ;AA9DgBhC,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;AAmFT,SAASiC,yBAAAA,CAA0B,EACtChC,GAAAA,EACAiC,OAAAA,EAAO,EACwB;AAC/B,EAAA,MAAMC,MAAAA,GAASnC,oBAAoBC,GAAAA,CAAAA;AAEnC,EAAA,MAAMmC,aAAAA,GAAgBC,mBAAAA,CAAoBF,MAAAA,EAAQD,OAAAA,CAAAA;AAGlD,EAAA,MAAMI,aAAAA,GAAgB,IAAIC,aAAAA,CAAc;AACpCC,IAAAA,QAAAA,EAAUL,MAAAA,CAAON,UAAAA;IACjBY,WAAAA,kBAAa,MAAA,CAAA,MAAML,aAAAA,CAAcM,QAAAA,EAAQ,EAA5B,aAAA;GACjB,CAAA;AACA,EAAA,MAAMC,MAAAA,GAAS,IAAIC,YAAAA,CAAaN,aAAAA,EAAeH,OAAO3B,MAAAA,EAAQ;AAC1DS,IAAAA,SAAAA,EAAWkB,MAAAA,CAAOlB,SAAAA;AAClBmB,IAAAA;GACJ,CAAA;AAGA,EAAA,MAAMS,UAAAA,GAAa,IAAIC,gBAAAA,CAAiB;AACpCC,IAAAA,IAAAA,EAAMZ,MAAAA,CAAO/B,YAAAA;AACbgC,IAAAA,aAAAA;IACAY,iBAAAA,EAAmBd;GACvB,CAAA;AAEA,EAAA,OAAO;AACHS,IAAAA,MAAAA;AACAE,IAAAA,UAAAA;AACAT,IAAAA,aAAAA;AACAnB,IAAAA,SAAAA,EAAWkB,MAAAA,CAAOlB;AACtB,GAAA;AACJ;AA/BgBgB,MAAAA,CAAAA,yBAAAA,EAAAA,2BAAAA,CAAAA;AAiChB,SAASI,mBAAAA,CAAoBF,QAA8BD,OAAAA,EAAgB;AACvE,EAAA,IAAIA,OAAAA,EAAS;AACT,IAAA,OAAO,IAAIe,kBAAAA,CAAmB;AAC1BzC,MAAAA,MAAAA,EAAQ2B,MAAAA,CAAO3B,MAAAA;AACfE,MAAAA,KAAAA,EAAOyB,MAAAA,CAAOzB,KAAAA;MACdwC,KAAAA,EAAO;KACX,CAAA;AACJ,EAAA;AAGA,EAAA,IAAI,CAACf,OAAOH,MAAAA,EAAQ;AAChB,IAAA,MAAM,IAAIzB,MACN,kHAAA,CAAA;AAER,EAAA;AAEA,EAAA,OAAO,IAAI4C,8BAAAA,CAA+BhB,MAAAA,CAAOH,MAAM,CAAA;AAC3D;AAjBSK,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA","file":"JRWFKJNA.js","sourcesContent":["import {\n    ClientCredentialsTokenProvider,\n    type ClientCredentialsTokenProviderConfig,\n} from './auth/client-credentials-token-provider';\nimport { LocalTokenProvider } from './auth/local-token-provider';\nimport type { TokenProvider } from './auth/token-provider';\nimport { CantonClient } from './client/canton-client';\nimport { CantonGrpcClient } from './client/grpc';\nimport type { ICantonClient } from './client/interface';\nimport { Configuration } from './open-api/runtime';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Provider Type\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * - {@link client} — JSON Ledger API (commands, queries, updates)\n * - {@link grpcClient} — gRPC Admin API (topology transactions, namespace queries)\n * - {@link tokenProvider} — Shared Bearer-token source used by both transports\n * - {@link walletUrl} — Canton Network validator wallet (scan-proxy CIP-56 endpoints)\n */\nexport type CantonChainProvider = {\n    client: ICantonClient;\n    grpcClient: CantonGrpcClient;\n    tokenProvider: TokenProvider;\n    /** Validator wallet URL for scan-proxy CIP-56 endpoints. Required. */\n    walletUrl: string;\n};\n\n// ─────────────────────────────────────────────────────────────────────────────\n// URI Parsing\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport type CantonChainUriParams = {\n    /** Base URL of the JSON Ledger API (e.g. \"http://localhost:5975\") */\n    jsonApiUrl: string;\n    /** Host:port of the gRPC Admin API (e.g. \"localhost:5076\") */\n    adminApiHost: string;\n    /** Ledger API user ID (default: \"participant_admin\") */\n    userId: string;\n    /** Parties granted `actAs` on localnet tokens (comma-separated in the URI). */\n    actAs: string[];\n    /** Validator wallet URL for scan-proxy CIP-56 endpoints (e.g. \"http://localhost:7201\"). Required. */\n    walletUrl: string;\n    /** OAuth2 client credentials config — present only for non-local environments */\n    oauth2?: ClientCredentialsTokenProviderConfig;\n};\n\n/**\n * Parse a Canton chain provider URI into its constituent parts.\n *\n * URI format:\n *   `<json-api-base>?admin-api=<host:port>&user-id=<id>&wallet-url=<url>[&token-url=...&client-id=...&client-secret=...&scope=...&audience=...]`\n *\n * The base URL (everything before the query string) is the JSON Ledger API endpoint.\n * Canton-specific params are extracted and removed; any remaining query params are\n * preserved on the JSON API URL.\n *\n * When `client-secret` is omitted from the URI, `CANTON_CLIENT_SECRET` is read from the\n * environment.\n */\nexport function parseCantonChainUri(uri: string): CantonChainUriParams {\n    const url = new URL(uri);\n\n    const adminApiHost = url.searchParams.get('admin-api');\n    if (!adminApiHost) {\n        throw new Error('Canton provider URI missing required \"admin-api\" query parameter');\n    }\n\n    const userId = url.searchParams.get('user-id') ?? 'participant_admin';\n    const actAsParam = url.searchParams.get('act-as');\n    const actAs =\n        actAsParam\n            ?.split(',')\n            .map((party) => party.trim())\n            .filter((party) => party.length > 0) ?? [];\n    const walletUrl = url.searchParams.get('wallet-url');\n    if (!walletUrl) {\n        throw new Error('Canton provider URI missing required \"wallet-url\" query parameter');\n    }\n    const tokenUrl = url.searchParams.get('token-url') ?? undefined;\n    const clientId = url.searchParams.get('client-id') ?? undefined;\n    // Prefer URI param; fall back to env so secrets are not committed in provider configs.\n    const clientSecret =\n        url.searchParams.get('client-secret') ??\n        // eslint-disable-next-line turbo/no-undeclared-env-vars -- runtime OAuth secret, not a turbo task input\n        process.env.CANTON_CLIENT_SECRET ??\n        undefined;\n    const scope = url.searchParams.get('scope') ?? undefined;\n    const audience = url.searchParams.get('audience') ?? undefined;\n\n    for (const key of [\n        'admin-api',\n        'user-id',\n        'act-as',\n        'wallet-url',\n        'sequencer-url',\n        'sequencer-validators',\n        'sequencer-quorum',\n        'token-url',\n        'client-id',\n        'client-secret',\n        'scope',\n        'audience',\n    ]) {\n        url.searchParams.delete(key);\n    }\n\n    const jsonApiUrl = url.toString().replace(/\\/$/, '');\n\n    const oauth2 =\n        tokenUrl && clientId && clientSecret\n            ? { tokenUrl, clientId, clientSecret, scope, audience }\n            : undefined;\n\n    return {\n        jsonApiUrl,\n        adminApiHost,\n        userId,\n        actAs,\n        walletUrl,\n        oauth2,\n    };\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Provider Factory\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport type CreateCantonChainProviderOptions = {\n    /** Raw provider URI (from provider config) */\n    uri: string;\n    /** When true, uses LocalTokenProvider (self-signed JWTs) instead of OAuth2 */\n    isLocal: boolean;\n};\n\n/**\n * Create a {@link CantonChainProvider} from a provider URI.\n *\n * - **isLocal=true**: Uses {@link LocalTokenProvider} with admin-level access (self-signed JWTs)\n *   over an unencrypted admin channel, allowed for a loopback admin host only.\n * - **isLocal=false**: Uses {@link ClientCredentialsTokenProvider} with OAuth2 client\n *   credentials extracted from the URI query parameters, over a TLS admin channel.\n */\nexport function createCantonChainProvider({\n    uri,\n    isLocal,\n}: CreateCantonChainProviderOptions): CantonChainProvider {\n    const params = parseCantonChainUri(uri);\n\n    const tokenProvider = createTokenProvider(params, isLocal);\n\n    // ── JSON Ledger API Client ──────────────────────────────────────────\n    const configuration = new Configuration({\n        basePath: params.jsonApiUrl,\n        accessToken: () => tokenProvider.getToken(),\n    });\n    const client = new CantonClient(configuration, params.userId, {\n        walletUrl: params.walletUrl,\n        tokenProvider,\n    });\n\n    // ── gRPC Admin API Client ───────────────────────────────────────────\n    const grpcClient = new CantonGrpcClient({\n        host: params.adminApiHost,\n        tokenProvider,\n        insecureTransport: isLocal,\n    });\n\n    return {\n        client,\n        grpcClient,\n        tokenProvider,\n        walletUrl: params.walletUrl,\n    };\n}\n\nfunction createTokenProvider(params: CantonChainUriParams, isLocal: boolean): TokenProvider {\n    if (isLocal) {\n        return new LocalTokenProvider({\n            userId: params.userId,\n            actAs: params.actAs,\n            admin: true,\n        });\n    }\n\n    // TODO(canton): add other prod auth methods (direct JWT passthrough, etc.).\n    if (!params.oauth2) {\n        throw new Error(\n            'Canton provider requires OAuth2 credentials (token-url, client-id, client-secret in URI or CANTON_CLIENT_SECRET)',\n        );\n    }\n\n    return new ClientCredentialsTokenProvider(params.oauth2);\n}\n"]}
+{"version":3,"sources":["../src/provider.ts"],"names":["parseCantonChainUri","uri","url","URL","adminApiHost","searchParams","get","Error","userId","actAsParam","actAs","split","map","party","trim","filter","length","walletUrl","tokenUrl","undefined","clientId","clientSecret","process","env","CANTON_CLIENT_SECRET","scope","audience","key","delete","jsonApiUrl","toString","replace","oauth2","createCantonChainProvider","isLocal","params","tokenProvider","createTokenProvider","configuration","Configuration","basePath","accessToken","getToken","client","CantonClient","grpcClient","CantonGrpcClient","host","insecureTransport","LocalTokenProvider","admin","ClientCredentialsTokenProvider"],"mappings":";;;;;;;;AA6DO,SAASA,oBAAoBC,GAAAA,EAAW;AAC3C,EAAA,MAAMC,GAAAA,GAAM,IAAIC,GAAAA,CAAIF,GAAAA,CAAAA;AAEpB,EAAA,MAAMG,YAAAA,GAAeF,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,WAAA,CAAA;AAC1C,EAAA,IAAI,CAACF,YAAAA,EAAc;AACf,IAAA,MAAM,IAAIG,MAAM,kEAAA,CAAA;AACpB,EAAA;AAEA,EAAA,MAAMC,MAAAA,GAASN,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,SAAA,CAAA,IAAc,mBAAA;AAClD,EAAA,MAAMG,UAAAA,GAAaP,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,QAAA,CAAA;AACxC,EAAA,MAAMI,QACFD,UAAAA,EACME,KAAAA,CAAM,GAAA,CAAA,CACPC,GAAAA,CAAI,CAACC,KAAAA,KAAUA,KAAAA,CAAMC,MAAI,CAAA,CACzBC,OAAO,CAACF,KAAAA,KAAUA,MAAMG,MAAAA,GAAS,CAAA,KAAM,EAAA;AAChD,EAAA,MAAMC,SAAAA,GAAYf,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,YAAA,CAAA;AACvC,EAAA,IAAI,CAACW,SAAAA,EAAW;AACZ,IAAA,MAAM,IAAIV,MAAM,mEAAA,CAAA;AACpB,EAAA;AACA,EAAA,MAAMW,QAAAA,GAAWhB,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,WAAA,CAAA,IAAgBa,MAAAA;AACtD,EAAA,MAAMC,QAAAA,GAAWlB,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,WAAA,CAAA,IAAgBa,MAAAA;AAEtD,EAAA,MAAME,YAAAA,GACFnB,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,eAAA,CAAA;AAErBgB,EAAAA,OAAAA,CAAQC,IAAIC,oBAAAA,IACZL,MAAAA;AACJ,EAAA,MAAMM,KAAAA,GAAQvB,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,OAAA,CAAA,IAAYa,MAAAA;AAC/C,EAAA,MAAMO,QAAAA,GAAWxB,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,UAAA,CAAA,IAAea,MAAAA;AAErD,EAAA,KAAA,MAAWQ,GAAAA,IAAO;AACd,IAAA,WAAA;AACA,IAAA,SAAA;AACA,IAAA,QAAA;AACA,IAAA,YAAA;AACA,IAAA,eAAA;AACA,IAAA,sBAAA;AACA,IAAA,kBAAA;AACA,IAAA,WAAA;AACA,IAAA,WAAA;AACA,IAAA,eAAA;AACA,IAAA,OAAA;AACA,IAAA;AACD,GAAA,EAAA;AACCzB,IAAAA,GAAAA,CAAIG,YAAAA,CAAauB,OAAOD,GAAAA,CAAAA;AAC5B,EAAA;AAEA,EAAA,MAAME,aAAa3B,GAAAA,CAAI4B,QAAAA,EAAQ,CAAGC,OAAAA,CAAQ,OAAO,EAAA,CAAA;AAEjD,EAAA,MAAMC,MAAAA,GACFd,QAAAA,IAAYE,QAAAA,IAAYC,YAAAA,GAClB;AAAEH,IAAAA,QAAAA;AAAUE,IAAAA,QAAAA;AAAUC,IAAAA,YAAAA;AAAcI,IAAAA,KAAAA;AAAOC,IAAAA;GAAS,GACpDP,MAAAA;AAEV,EAAA,OAAO;AACHU,IAAAA,UAAAA;AACAzB,IAAAA,YAAAA;AACAI,IAAAA,MAAAA;AACAE,IAAAA,KAAAA;AACAO,IAAAA,SAAAA;AACAe,IAAAA;AACJ,GAAA;AACJ;AA9DgBhC,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;AAmFT,SAASiC,yBAAAA,CAA0B,EACtChC,GAAAA,EACAiC,OAAAA,EAAO,EACwB;AAC/B,EAAA,MAAMC,MAAAA,GAASnC,oBAAoBC,GAAAA,CAAAA;AAEnC,EAAA,MAAMmC,aAAAA,GAAgBC,mBAAAA,CAAoBF,MAAAA,EAAQD,OAAAA,CAAAA;AAGlD,EAAA,MAAMI,aAAAA,GAAgB,IAAIC,aAAAA,CAAc;AACpCC,IAAAA,QAAAA,EAAUL,MAAAA,CAAON,UAAAA;IACjBY,WAAAA,kBAAa,MAAA,CAAA,MAAML,aAAAA,CAAcM,QAAAA,EAAQ,EAA5B,aAAA;GACjB,CAAA;AACA,EAAA,MAAMC,MAAAA,GAAS,IAAIC,YAAAA,CAAaN,aAAAA,EAAeH,OAAO3B,MAAAA,EAAQ;AAC1DS,IAAAA,SAAAA,EAAWkB,MAAAA,CAAOlB,SAAAA;AAClBmB,IAAAA;GACJ,CAAA;AAGA,EAAA,MAAMS,UAAAA,GAAa,IAAIC,gBAAAA,CAAiB;AACpCC,IAAAA,IAAAA,EAAMZ,MAAAA,CAAO/B,YAAAA;AACbgC,IAAAA,aAAAA;IACAY,iBAAAA,EAAmBd;GACvB,CAAA;AAEA,EAAA,OAAO;AACHS,IAAAA,MAAAA;AACAE,IAAAA,UAAAA;AACAT,IAAAA,aAAAA;AACAnB,IAAAA,SAAAA,EAAWkB,MAAAA,CAAOlB;AACtB,GAAA;AACJ;AA/BgBgB,MAAAA,CAAAA,yBAAAA,EAAAA,2BAAAA,CAAAA;AAiChB,SAASI,mBAAAA,CAAoBF,QAA8BD,OAAAA,EAAgB;AACvE,EAAA,IAAIA,OAAAA,EAAS;AACT,IAAA,OAAO,IAAIe,kBAAAA,CAAmB;AAC1BzC,MAAAA,MAAAA,EAAQ2B,MAAAA,CAAO3B,MAAAA;AACfE,MAAAA,KAAAA,EAAOyB,MAAAA,CAAOzB,KAAAA;MACdwC,KAAAA,EAAO;KACX,CAAA;AACJ,EAAA;AAGA,EAAA,IAAI,CAACf,OAAOH,MAAAA,EAAQ;AAChB,IAAA,MAAM,IAAIzB,MACN,kHAAA,CAAA;AAER,EAAA;AAEA,EAAA,OAAO,IAAI4C,8BAAAA,CAA+BhB,MAAAA,CAAOH,MAAM,CAAA;AAC3D;AAjBSK,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA","file":"UVTS5LAN.js","sourcesContent":["import {\n    ClientCredentialsTokenProvider,\n    type ClientCredentialsTokenProviderConfig,\n} from './auth/client-credentials-token-provider';\nimport { LocalTokenProvider } from './auth/local-token-provider';\nimport type { TokenProvider } from './auth/token-provider';\nimport { CantonClient } from './client/canton-client';\nimport { CantonGrpcClient } from './client/grpc';\nimport type { ICantonClient } from './client/interface';\nimport { Configuration } from './open-api/runtime';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Provider Type\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * - {@link client} — JSON Ledger API (commands, queries, updates)\n * - {@link grpcClient} — gRPC Admin API (topology transactions, namespace queries)\n * - {@link tokenProvider} — Shared Bearer-token source used by both transports\n * - {@link walletUrl} — Canton Network validator wallet (scan-proxy CIP-56 endpoints)\n */\nexport type CantonChainProvider = {\n    client: ICantonClient;\n    grpcClient: CantonGrpcClient;\n    tokenProvider: TokenProvider;\n    /** Validator wallet URL for scan-proxy CIP-56 endpoints. Required. */\n    walletUrl: string;\n};\n\n// ─────────────────────────────────────────────────────────────────────────────\n// URI Parsing\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport type CantonChainUriParams = {\n    /** Base URL of the JSON Ledger API (e.g. \"http://localhost:5975\") */\n    jsonApiUrl: string;\n    /** Host:port of the gRPC Admin API (e.g. \"localhost:5076\") */\n    adminApiHost: string;\n    /** Ledger API user ID (default: \"participant_admin\") */\n    userId: string;\n    /** Parties granted `actAs` on localnet tokens (comma-separated in the URI). */\n    actAs: string[];\n    /** Validator wallet URL for scan-proxy CIP-56 endpoints (e.g. \"http://localhost:7201\"). Required. */\n    walletUrl: string;\n    /** OAuth2 client credentials config — present only for non-local environments */\n    oauth2?: ClientCredentialsTokenProviderConfig;\n};\n\n/**\n * Parse a Canton chain provider URI into its constituent parts.\n *\n * URI format:\n *   `<json-api-base>?admin-api=<host:port>&user-id=<id>&wallet-url=<url>[&token-url=...&client-id=...&client-secret=...&scope=...&audience=...]`\n *\n * The base URL (everything before the query string) is the JSON Ledger API endpoint.\n * Canton-specific params are extracted and removed; any remaining query params are\n * preserved on the JSON API URL.\n *\n * When `client-secret` is omitted from the URI, `CANTON_CLIENT_SECRET` is read from the\n * environment.\n */\nexport function parseCantonChainUri(uri: string): CantonChainUriParams {\n    const url = new URL(uri);\n\n    const adminApiHost = url.searchParams.get('admin-api');\n    if (!adminApiHost) {\n        throw new Error('Canton provider URI missing required \"admin-api\" query parameter');\n    }\n\n    const userId = url.searchParams.get('user-id') ?? 'participant_admin';\n    const actAsParam = url.searchParams.get('act-as');\n    const actAs =\n        actAsParam\n            ?.split(',')\n            .map((party) => party.trim())\n            .filter((party) => party.length > 0) ?? [];\n    const walletUrl = url.searchParams.get('wallet-url');\n    if (!walletUrl) {\n        throw new Error('Canton provider URI missing required \"wallet-url\" query parameter');\n    }\n    const tokenUrl = url.searchParams.get('token-url') ?? undefined;\n    const clientId = url.searchParams.get('client-id') ?? undefined;\n    // Prefer URI param; fall back to env so secrets are not committed in provider configs.\n    const clientSecret =\n        url.searchParams.get('client-secret') ??\n        // eslint-disable-next-line turbo/no-undeclared-env-vars -- runtime OAuth secret, not a turbo task input\n        process.env.CANTON_CLIENT_SECRET ??\n        undefined;\n    const scope = url.searchParams.get('scope') ?? undefined;\n    const audience = url.searchParams.get('audience') ?? undefined;\n\n    for (const key of [\n        'admin-api',\n        'user-id',\n        'act-as',\n        'wallet-url',\n        'sequencer-url',\n        'sequencer-validators',\n        'sequencer-quorum',\n        'token-url',\n        'client-id',\n        'client-secret',\n        'scope',\n        'audience',\n    ]) {\n        url.searchParams.delete(key);\n    }\n\n    const jsonApiUrl = url.toString().replace(/\\/$/, '');\n\n    const oauth2 =\n        tokenUrl && clientId && clientSecret\n            ? { tokenUrl, clientId, clientSecret, scope, audience }\n            : undefined;\n\n    return {\n        jsonApiUrl,\n        adminApiHost,\n        userId,\n        actAs,\n        walletUrl,\n        oauth2,\n    };\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Provider Factory\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport type CreateCantonChainProviderOptions = {\n    /** Raw provider URI (from provider config) */\n    uri: string;\n    /** When true, uses LocalTokenProvider (self-signed JWTs) instead of OAuth2 */\n    isLocal: boolean;\n};\n\n/**\n * Create a {@link CantonChainProvider} from a provider URI.\n *\n * - **isLocal=true**: Uses {@link LocalTokenProvider} with admin-level access (self-signed JWTs)\n *   over an unencrypted admin channel, allowed for a loopback admin host only.\n * - **isLocal=false**: Uses {@link ClientCredentialsTokenProvider} with OAuth2 client\n *   credentials extracted from the URI query parameters, over a TLS admin channel.\n */\nexport function createCantonChainProvider({\n    uri,\n    isLocal,\n}: CreateCantonChainProviderOptions): CantonChainProvider {\n    const params = parseCantonChainUri(uri);\n\n    const tokenProvider = createTokenProvider(params, isLocal);\n\n    // ── JSON Ledger API Client ──────────────────────────────────────────\n    const configuration = new Configuration({\n        basePath: params.jsonApiUrl,\n        accessToken: () => tokenProvider.getToken(),\n    });\n    const client = new CantonClient(configuration, params.userId, {\n        walletUrl: params.walletUrl,\n        tokenProvider,\n    });\n\n    // ── gRPC Admin API Client ───────────────────────────────────────────\n    const grpcClient = new CantonGrpcClient({\n        host: params.adminApiHost,\n        tokenProvider,\n        insecureTransport: isLocal,\n    });\n\n    return {\n        client,\n        grpcClient,\n        tokenProvider,\n        walletUrl: params.walletUrl,\n    };\n}\n\nfunction createTokenProvider(params: CantonChainUriParams, isLocal: boolean): TokenProvider {\n    if (isLocal) {\n        return new LocalTokenProvider({\n            userId: params.userId,\n            actAs: params.actAs,\n            admin: true,\n        });\n    }\n\n    // TODO(canton): add other prod auth methods (direct JWT passthrough, etc.).\n    if (!params.oauth2) {\n        throw new Error(\n            'Canton provider requires OAuth2 credentials (token-url, client-id, client-secret in URI or CANTON_CLIENT_SECRET)',\n        );\n    }\n\n    return new ClientCredentialsTokenProvider(params.oauth2);\n}\n"]}

package/dist/{SCEF7TLZ.js → YF7P4UQM.js}

@@ -54,7 +54,7 @@ var LocalTokenProvider = class {
         participantId: null,
         applicationId: null,
         actAs: this.#config.actAs,
-        readAs: [],
+        readAs: this.#config.actAs,
         admin: this.#config.admin
       }
     };
@@ -65,5 +65,5 @@ var LocalTokenProvider = class {
 };
 
 export { LocalTokenProvider };
-//# sourceMappingURL=SCEF7TLZ.js.map
-//# sourceMappingURL=SCEF7TLZ.js.map
+//# sourceMappingURL=YF7P4UQM.js.map
+//# sourceMappingURL=YF7P4UQM.js.map

package/dist/YF7P4UQM.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/auth/local-token-provider.ts"],"names":["DEFAULT_SECRET","DEFAULT_AUDIENCE","DEFAULT_EXPIRES_IN","BUFFER_SECONDS","base64UrlEncode","data","base64","Buffer","from","toString","replace","generateJwt","payload","secret","header","alg","typ","headerEncoded","JSON","stringify","payloadEncoded","signatureInput","signature","crypto","createHmac","update","digest","LocalTokenProvider","config","userId","actAs","audience","expiresIn","admin","getToken","nowSeconds","Math","floor","Date","now","sub","aud","iat","exp","ledgerId","participantId","applicationId","readAs","delayMs","setTimeout"],"mappings":";;;AAcA,IAAMA,cAAAA,GAAiB,QAAA;AACvB,IAAMC,gBAAAA,GAAmB,+BAAA;AACzB,IAAMC,kBAAAA,GAAqB,IAAA;AAC3B,IAAMC,cAAAA,GAAiB,EAAA;AAMvB,SAASC,gBAAgBC,IAAAA,EAAqB;AAC1C,EAAA,MAAMC,SAASC,MAAAA,CAAOC,IAAAA,CAAKH,IAAAA,CAAAA,CAAMI,SAAS,QAAA,CAAA;AAC1C,EAAA,OAAOH,MAAAA,CAAOI,OAAAA,CAAQ,KAAA,EAAO,GAAA,CAAA,CAAKA,OAAAA,CAAQ,KAAA,EAAO,GAAA,CAAA,CAAKA,OAAAA,CAAQ,IAAA,EAAM,EAAA,CAAA;AACxE;AAHSN,MAAAA,CAAAA,eAAAA,EAAAA,iBAAAA,CAAAA;AAKT,SAASO,WAAAA,CAAYC,SAAiBC,MAAAA,EAAc;AAChD,EAAA,MAAMC,MAAAA,GAAS;IAAEC,GAAAA,EAAK,OAAA;IAASC,GAAAA,EAAK;AAAM,GAAA;AAC1C,EAAA,MAAMC,aAAAA,GAAgBb,eAAAA,CAAgBc,IAAAA,CAAKC,SAAAA,CAAUL,MAAAA,CAAAA,CAAAA;AACrD,EAAA,MAAMM,cAAAA,GAAiBhB,eAAAA,CAAgBc,IAAAA,CAAKC,SAAAA,CAAUP,OAAAA,CAAAA,CAAAA;AACtD,EAAA,MAAMS,cAAAA,GAAiB,CAAA,EAAGJ,aAAAA,CAAAA,CAAAA,EAAiBG,cAAAA,CAAAA,CAAAA;AAC3C,EAAA,MAAME,SAAAA,GAAYC,OAAOC,UAAAA,CAAW,QAAA,EAAUX,MAAAA,CAAAA,CAAQY,MAAAA,CAAOJ,cAAAA,CAAAA,CAAgBK,MAAAA,EAAM;AACnF,EAAA,OAAO,GAAGT,aAAAA,CAAAA,CAAAA,EAAiBG,cAAAA,CAAAA,CAAAA,EAAkBhB,eAAAA,CAAgBkB,SAAAA,CAAAA,CAAAA,CAAAA;AACjE;AAPSX,MAAAA,CAAAA,WAAAA,EAAAA,aAAAA,CAAAA;AAgBF,IAAMgB,qBAAN,MAAMA;EA5Cb;;;AA6Ca,EAAA,OAAA;EACT,MAAA,GAAwB,IAAA;AAExB,EAAA,WAAA,CAAYC,MAAAA,EAAkC;AAC1C,IAAA,IAAA,CAAK,OAAA,GAAU;AACXC,MAAAA,MAAAA,EAAQD,MAAAA,CAAOC,MAAAA;AACfC,MAAAA,KAAAA,EAAOF,MAAAA,CAAOE,KAAAA;AACdjB,MAAAA,MAAAA,EAAQe,OAAOf,MAAAA,IAAUb,cAAAA;AACzB+B,MAAAA,QAAAA,EAAUH,OAAOG,QAAAA,IAAY9B,gBAAAA;AAC7B+B,MAAAA,SAAAA,EAAWJ,OAAOI,SAAAA,IAAa9B,kBAAAA;AAC/B+B,MAAAA,KAAAA,EAAOL,OAAOK,KAAAA,IAAS;AAC3B,KAAA;AACJ,EAAA;AAEA,EAAA,MAAMC,QAAAA,GAA4B;AAC9B,IAAA,IAAA,CAAK,MAAA,KAAW,KAAK,cAAA,EAAc;AACnC,IAAA,OAAO,IAAA,CAAK,MAAA;AAChB,EAAA;EAEA,cAAA,GAAc;AACV,IAAA,MAAMC,aAAaC,IAAAA,CAAKC,KAAAA,CAAMC,IAAAA,CAAKC,GAAAA,KAAQ,GAAA,CAAA;AAC3C,IAAA,MAAM3B,OAAAA,GAAU;AACZ4B,MAAAA,GAAAA,EAAK,KAAK,OAAA,CAAQX,MAAAA;AAClBY,MAAAA,GAAAA,EAAK,KAAK,OAAA,CAAQV,QAAAA;MAClBW,GAAAA,EAAKP,UAAAA;MACLQ,GAAAA,EAAKR,UAAAA,GAAa,KAAK,OAAA,CAAQH,SAAAA;MAC/B,6BAAA,EAA+B;QAC3BY,QAAAA,EAAU,IAAA;QACVC,aAAAA,EAAe,IAAA;QACfC,aAAAA,EAAe,IAAA;AACfhB,QAAAA,KAAAA,EAAO,KAAK,OAAA,CAAQA,KAAAA;AACpBiB,QAAAA,MAAAA,EAAQ,KAAK,OAAA,CAAQjB,KAAAA;AACrBG,QAAAA,KAAAA,EAAO,KAAK,OAAA,CAAQA;AACxB;AACJ,KAAA;AACA,IAAA,MAAMe,OAAAA,GAAAA,CAAW,IAAA,CAAK,OAAA,CAAQhB,SAAAA,GAAY7B,cAAAA,IAAkB,GAAA;AAC5D8C,IAAAA,UAAAA,CAAW,MAAO,IAAA,CAAK,MAAA,GAAS,IAAA,EAAOD,OAAAA,CAAAA;AACvC,IAAA,OAAOrC,WAAAA,CAAYC,OAAAA,EAAS,IAAA,CAAK,OAAA,CAAQC,MAAM,CAAA;AACnD,EAAA;AACJ","file":"YF7P4UQM.js","sourcesContent":["import crypto from 'node:crypto';\n\nimport type { TokenProvider } from './token-provider';\n\nexport interface LocalTokenProviderConfig {\n    userId: string;\n    actAs: string[];\n    secret?: string;\n    audience?: string;\n    /** Token lifetime in seconds. */\n    expiresIn?: number;\n    admin?: boolean;\n}\n\nconst DEFAULT_SECRET = 'unsafe';\nconst DEFAULT_AUDIENCE = 'https://canton.network.global';\nconst DEFAULT_EXPIRES_IN = 3600; // 1 hour\nconst BUFFER_SECONDS = 60;\n\n// ─────────────────────────────────────────────────────────────────────────────\n// JWT helpers (HMAC-SHA256, Canton \"unsafe\" mode)\n// ─────────────────────────────────────────────────────────────────────────────\n\nfunction base64UrlEncode(data: string | Buffer): string {\n    const base64 = Buffer.from(data).toString('base64');\n    return base64.replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=/g, '');\n}\n\nfunction generateJwt(payload: object, secret: string): string {\n    const header = { alg: 'HS256', typ: 'JWT' };\n    const headerEncoded = base64UrlEncode(JSON.stringify(header));\n    const payloadEncoded = base64UrlEncode(JSON.stringify(payload));\n    const signatureInput = `${headerEncoded}.${payloadEncoded}`;\n    const signature = crypto.createHmac('sha256', secret).update(signatureInput).digest();\n    return `${headerEncoded}.${payloadEncoded}.${base64UrlEncode(signature)}`;\n}\n\n/**\n * Token provider for local development and sandbox environments.\n *\n * Generates short-lived HMAC-SHA256 JWTs on the fly using the Canton\n * participant node's \"unsafe\" identity provider manager shared secret.\n * Tokens are cached in memory and regenerated automatically before expiry.\n */\nexport class LocalTokenProvider implements TokenProvider {\n    readonly #config: Required<LocalTokenProviderConfig>;\n    #token: string | null = null;\n\n    constructor(config: LocalTokenProviderConfig) {\n        this.#config = {\n            userId: config.userId,\n            actAs: config.actAs,\n            secret: config.secret ?? DEFAULT_SECRET,\n            audience: config.audience ?? DEFAULT_AUDIENCE,\n            expiresIn: config.expiresIn ?? DEFAULT_EXPIRES_IN,\n            admin: config.admin ?? true,\n        };\n    }\n\n    async getToken(): Promise<string> {\n        this.#token ??= this.#generateToken();\n        return this.#token;\n    }\n\n    #generateToken(): string {\n        const nowSeconds = Math.floor(Date.now() / 1000);\n        const payload = {\n            sub: this.#config.userId,\n            aud: this.#config.audience,\n            iat: nowSeconds,\n            exp: nowSeconds + this.#config.expiresIn,\n            'https://daml.com/ledger-api': {\n                ledgerId: null,\n                participantId: null,\n                applicationId: null,\n                actAs: this.#config.actAs,\n                readAs: this.#config.actAs,\n                admin: this.#config.admin,\n            },\n        };\n        const delayMs = (this.#config.expiresIn - BUFFER_SECONDS) * 1000;\n        setTimeout(() => (this.#token = null), delayMs);\n        return generateJwt(payload, this.#config.secret);\n    }\n}\n"]}

package/dist/auth/index.js

@@ -1,6 +1,6 @@
 import '../35ELVFTS.js';
 import '../RSV7WS7X.js';
-export { LocalTokenProvider } from '../SCEF7TLZ.js';
+export { LocalTokenProvider } from '../YF7P4UQM.js';
 export { ClientCredentialsTokenProvider } from '../V2H2WXKE.js';
 import '../VUOMXK5T.js';
 //# sourceMappingURL=index.js.map

package/dist/auth/local-token-provider.js

@@ -1,4 +1,4 @@
-export { LocalTokenProvider } from '../SCEF7TLZ.js';
+export { LocalTokenProvider } from '../YF7P4UQM.js';
 import '../VUOMXK5T.js';
 //# sourceMappingURL=local-token-provider.js.map
 //# sourceMappingURL=local-token-provider.js.map

package/dist/index.js

@@ -10,7 +10,7 @@ import './7JX6NIYS.js';
 export { buildMultiTransactionSignatures, buildSignedTransaction } from './WKC6X2E3.js';
 import './IIWYAFUO.js';
 export { parseMinFeeValue } from './M3GPMXME.js';
-export { createCantonChainProvider, parseCantonChainUri } from './JRWFKJNA.js';
+export { createCantonChainProvider, parseCantonChainUri } from './UVTS5LAN.js';
 export { CantonClient } from './46AEW4RY.js';
 import './5HH7PZW3.js';
 import './6CPYXAOF.js';
@@ -306,7 +306,7 @@ export { areExpectedSignatories, getCreateArgumentField, isSignatoryOrigin, isTr
 export { CommandStatus, IntLikeSchema, buildTemplateId, canonicalizeDamlDecimal, smallestUnitsToDamlDecimal } from './4WZTQJXP.js';
 import './35ELVFTS.js';
 import './RSV7WS7X.js';
-export { LocalTokenProvider } from './SCEF7TLZ.js';
+export { LocalTokenProvider } from './YF7P4UQM.js';
 export { ClientCredentialsTokenProvider } from './V2H2WXKE.js';
 export { parseAmuletAmount, parseAmuletDecimal } from './CXTOAS7N.js';
 export { CANTON_CID_ADDRESS_PREFIX, CANTON_PARTY_ADDRESS_PREFIX, cantonCidAddress, cantonDeferredAddress, cantonPartyAddress, isCantonAddress, toCantonAddress } from './FADZDRWB.js';

package/dist/provider.js

@@ -1,4 +1,4 @@
-export { createCantonChainProvider, parseCantonChainUri } from './JRWFKJNA.js';
+export { createCantonChainProvider, parseCantonChainUri } from './UVTS5LAN.js';
 import './46AEW4RY.js';
 import './5HH7PZW3.js';
 import './6CPYXAOF.js';
@@ -290,7 +290,7 @@ import './RVQWP4JU.js';
 import './VJ4PVZYL.js';
 import './PL4H5XEA.js';
 import './WLV6EHDB.js';
-import './SCEF7TLZ.js';
+import './YF7P4UQM.js';
 import './V2H2WXKE.js';
 import './CMDFOA7C.js';
 import './3K5JL2TP.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@layerzerolabs/common-canton",
-  "version": "1.2.61",
+  "version": "1.2.62",
   "private": false,
   "description": "Canton VM client and utilities",
   "license": "MIT",
@@ -37,10 +37,10 @@
     "@protobuf-ts/runtime-rpc": "^2.11.1",
     "es-toolkit": "^1.39.10",
     "zod": "4.3.5",
-    "@layerzerolabs/common-chain-model": "1.2.61",
-    "@layerzerolabs/common-encoding-utils": "1.2.61",
-    "@layerzerolabs/typescript-utils": "1.2.61",
-    "@layerzerolabs/common-error-utils": "1.2.61"
+    "@layerzerolabs/common-encoding-utils": "1.2.62",
+    "@layerzerolabs/common-chain-model": "1.2.62",
+    "@layerzerolabs/typescript-utils": "1.2.62",
+    "@layerzerolabs/common-error-utils": "1.2.62"
   },
   "devDependencies": {
     "@vitest/coverage-v8": "4.1.10",
@@ -48,11 +48,11 @@
     "tsup": "^8.4.0",
     "typescript": "^6.0.3",
     "vitest": "^4.1.10",
-    "@layerzerolabs/eslint-configuration": "^1.2.61",
-    "@layerzerolabs/tsup-configuration": "1.2.61",
-    "@layerzerolabs/typescript-configuration": "1.2.61",
-    "@layerzerolabs/vm-tooling-canton": "1.2.61",
-    "@layerzerolabs/vitest-configuration": "1.2.61"
+    "@layerzerolabs/eslint-configuration": "^1.2.62",
+    "@layerzerolabs/typescript-configuration": "1.2.62",
+    "@layerzerolabs/vitest-configuration": "1.2.62",
+    "@layerzerolabs/tsup-configuration": "1.2.62",
+    "@layerzerolabs/vm-tooling-canton": "1.2.62"
   },
   "publishConfig": {
     "access": "public",

package/src/auth/local-token-provider.ts

@@ -74,7 +74,7 @@ export class LocalTokenProvider implements TokenProvider {
                 participantId: null,
                 applicationId: null,
                 actAs: this.#config.actAs,
-                readAs: [],
+                readAs: this.#config.actAs,
                 admin: this.#config.admin,
             },
         };

package/test/auth/local-token-provider.test.ts

@@ -38,7 +38,7 @@ describe('LocalTokenProvider', () => {
                 participantId: null,
                 applicationId: null,
                 actAs: ['party1::abc', 'party2::def'],
-                readAs: [],
+                readAs: ['party1::abc', 'party2::def'],
                 admin: true,
             },
         });

package/dist/SCEF7TLZ.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/auth/local-token-provider.ts"],"names":["DEFAULT_SECRET","DEFAULT_AUDIENCE","DEFAULT_EXPIRES_IN","BUFFER_SECONDS","base64UrlEncode","data","base64","Buffer","from","toString","replace","generateJwt","payload","secret","header","alg","typ","headerEncoded","JSON","stringify","payloadEncoded","signatureInput","signature","crypto","createHmac","update","digest","LocalTokenProvider","config","userId","actAs","audience","expiresIn","admin","getToken","nowSeconds","Math","floor","Date","now","sub","aud","iat","exp","ledgerId","participantId","applicationId","readAs","delayMs","setTimeout"],"mappings":";;;AAcA,IAAMA,cAAAA,GAAiB,QAAA;AACvB,IAAMC,gBAAAA,GAAmB,+BAAA;AACzB,IAAMC,kBAAAA,GAAqB,IAAA;AAC3B,IAAMC,cAAAA,GAAiB,EAAA;AAMvB,SAASC,gBAAgBC,IAAAA,EAAqB;AAC1C,EAAA,MAAMC,SAASC,MAAAA,CAAOC,IAAAA,CAAKH,IAAAA,CAAAA,CAAMI,SAAS,QAAA,CAAA;AAC1C,EAAA,OAAOH,MAAAA,CAAOI,OAAAA,CAAQ,KAAA,EAAO,GAAA,CAAA,CAAKA,OAAAA,CAAQ,KAAA,EAAO,GAAA,CAAA,CAAKA,OAAAA,CAAQ,IAAA,EAAM,EAAA,CAAA;AACxE;AAHSN,MAAAA,CAAAA,eAAAA,EAAAA,iBAAAA,CAAAA;AAKT,SAASO,WAAAA,CAAYC,SAAiBC,MAAAA,EAAc;AAChD,EAAA,MAAMC,MAAAA,GAAS;IAAEC,GAAAA,EAAK,OAAA;IAASC,GAAAA,EAAK;AAAM,GAAA;AAC1C,EAAA,MAAMC,aAAAA,GAAgBb,eAAAA,CAAgBc,IAAAA,CAAKC,SAAAA,CAAUL,MAAAA,CAAAA,CAAAA;AACrD,EAAA,MAAMM,cAAAA,GAAiBhB,eAAAA,CAAgBc,IAAAA,CAAKC,SAAAA,CAAUP,OAAAA,CAAAA,CAAAA;AACtD,EAAA,MAAMS,cAAAA,GAAiB,CAAA,EAAGJ,aAAAA,CAAAA,CAAAA,EAAiBG,cAAAA,CAAAA,CAAAA;AAC3C,EAAA,MAAME,SAAAA,GAAYC,OAAOC,UAAAA,CAAW,QAAA,EAAUX,MAAAA,CAAAA,CAAQY,MAAAA,CAAOJ,cAAAA,CAAAA,CAAgBK,MAAAA,EAAM;AACnF,EAAA,OAAO,GAAGT,aAAAA,CAAAA,CAAAA,EAAiBG,cAAAA,CAAAA,CAAAA,EAAkBhB,eAAAA,CAAgBkB,SAAAA,CAAAA,CAAAA,CAAAA;AACjE;AAPSX,MAAAA,CAAAA,WAAAA,EAAAA,aAAAA,CAAAA;AAgBF,IAAMgB,qBAAN,MAAMA;EA5Cb;;;AA6Ca,EAAA,OAAA;EACT,MAAA,GAAwB,IAAA;AAExB,EAAA,WAAA,CAAYC,MAAAA,EAAkC;AAC1C,IAAA,IAAA,CAAK,OAAA,GAAU;AACXC,MAAAA,MAAAA,EAAQD,MAAAA,CAAOC,MAAAA;AACfC,MAAAA,KAAAA,EAAOF,MAAAA,CAAOE,KAAAA;AACdjB,MAAAA,MAAAA,EAAQe,OAAOf,MAAAA,IAAUb,cAAAA;AACzB+B,MAAAA,QAAAA,EAAUH,OAAOG,QAAAA,IAAY9B,gBAAAA;AAC7B+B,MAAAA,SAAAA,EAAWJ,OAAOI,SAAAA,IAAa9B,kBAAAA;AAC/B+B,MAAAA,KAAAA,EAAOL,OAAOK,KAAAA,IAAS;AAC3B,KAAA;AACJ,EAAA;AAEA,EAAA,MAAMC,QAAAA,GAA4B;AAC9B,IAAA,IAAA,CAAK,MAAA,KAAW,KAAK,cAAA,EAAc;AACnC,IAAA,OAAO,IAAA,CAAK,MAAA;AAChB,EAAA;EAEA,cAAA,GAAc;AACV,IAAA,MAAMC,aAAaC,IAAAA,CAAKC,KAAAA,CAAMC,IAAAA,CAAKC,GAAAA,KAAQ,GAAA,CAAA;AAC3C,IAAA,MAAM3B,OAAAA,GAAU;AACZ4B,MAAAA,GAAAA,EAAK,KAAK,OAAA,CAAQX,MAAAA;AAClBY,MAAAA,GAAAA,EAAK,KAAK,OAAA,CAAQV,QAAAA;MAClBW,GAAAA,EAAKP,UAAAA;MACLQ,GAAAA,EAAKR,UAAAA,GAAa,KAAK,OAAA,CAAQH,SAAAA;MAC/B,6BAAA,EAA+B;QAC3BY,QAAAA,EAAU,IAAA;QACVC,aAAAA,EAAe,IAAA;QACfC,aAAAA,EAAe,IAAA;AACfhB,QAAAA,KAAAA,EAAO,KAAK,OAAA,CAAQA,KAAAA;AACpBiB,QAAAA,MAAAA,EAAQ,EAAA;AACRd,QAAAA,KAAAA,EAAO,KAAK,OAAA,CAAQA;AACxB;AACJ,KAAA;AACA,IAAA,MAAMe,OAAAA,GAAAA,CAAW,IAAA,CAAK,OAAA,CAAQhB,SAAAA,GAAY7B,cAAAA,IAAkB,GAAA;AAC5D8C,IAAAA,UAAAA,CAAW,MAAO,IAAA,CAAK,MAAA,GAAS,IAAA,EAAOD,OAAAA,CAAAA;AACvC,IAAA,OAAOrC,WAAAA,CAAYC,OAAAA,EAAS,IAAA,CAAK,OAAA,CAAQC,MAAM,CAAA;AACnD,EAAA;AACJ","file":"SCEF7TLZ.js","sourcesContent":["import crypto from 'node:crypto';\n\nimport type { TokenProvider } from './token-provider';\n\nexport interface LocalTokenProviderConfig {\n    userId: string;\n    actAs: string[];\n    secret?: string;\n    audience?: string;\n    /** Token lifetime in seconds. */\n    expiresIn?: number;\n    admin?: boolean;\n}\n\nconst DEFAULT_SECRET = 'unsafe';\nconst DEFAULT_AUDIENCE = 'https://canton.network.global';\nconst DEFAULT_EXPIRES_IN = 3600; // 1 hour\nconst BUFFER_SECONDS = 60;\n\n// ─────────────────────────────────────────────────────────────────────────────\n// JWT helpers (HMAC-SHA256, Canton \"unsafe\" mode)\n// ─────────────────────────────────────────────────────────────────────────────\n\nfunction base64UrlEncode(data: string | Buffer): string {\n    const base64 = Buffer.from(data).toString('base64');\n    return base64.replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=/g, '');\n}\n\nfunction generateJwt(payload: object, secret: string): string {\n    const header = { alg: 'HS256', typ: 'JWT' };\n    const headerEncoded = base64UrlEncode(JSON.stringify(header));\n    const payloadEncoded = base64UrlEncode(JSON.stringify(payload));\n    const signatureInput = `${headerEncoded}.${payloadEncoded}`;\n    const signature = crypto.createHmac('sha256', secret).update(signatureInput).digest();\n    return `${headerEncoded}.${payloadEncoded}.${base64UrlEncode(signature)}`;\n}\n\n/**\n * Token provider for local development and sandbox environments.\n *\n * Generates short-lived HMAC-SHA256 JWTs on the fly using the Canton\n * participant node's \"unsafe\" identity provider manager shared secret.\n * Tokens are cached in memory and regenerated automatically before expiry.\n */\nexport class LocalTokenProvider implements TokenProvider {\n    readonly #config: Required<LocalTokenProviderConfig>;\n    #token: string | null = null;\n\n    constructor(config: LocalTokenProviderConfig) {\n        this.#config = {\n            userId: config.userId,\n            actAs: config.actAs,\n            secret: config.secret ?? DEFAULT_SECRET,\n            audience: config.audience ?? DEFAULT_AUDIENCE,\n            expiresIn: config.expiresIn ?? DEFAULT_EXPIRES_IN,\n            admin: config.admin ?? true,\n        };\n    }\n\n    async getToken(): Promise<string> {\n        this.#token ??= this.#generateToken();\n        return this.#token;\n    }\n\n    #generateToken(): string {\n        const nowSeconds = Math.floor(Date.now() / 1000);\n        const payload = {\n            sub: this.#config.userId,\n            aud: this.#config.audience,\n            iat: nowSeconds,\n            exp: nowSeconds + this.#config.expiresIn,\n            'https://daml.com/ledger-api': {\n                ledgerId: null,\n                participantId: null,\n                applicationId: null,\n                actAs: this.#config.actAs,\n                readAs: [],\n                admin: this.#config.admin,\n            },\n        };\n        const delayMs = (this.#config.expiresIn - BUFFER_SECONDS) * 1000;\n        setTimeout(() => (this.#token = null), delayMs);\n        return generateJwt(payload, this.#config.secret);\n    }\n}\n"]}