@layerzerolabs/common-canton 1.2.61 → 1.2.63

package/dist/{AM6OIKMW.js → DPBZHN57.js}

@@ -1,5 +1,5 @@
-import { createContractAddressResolver } from './75B7Y26B.js';
 import { substituteRefsToCids } from './WLHCBBAJ.js';
+import { createContractAddressResolver } from './75B7Y26B.js';
 import { AMULET_INSTRUMENT_ID } from './SEKD553P.js';
 import { __name } from './VUOMXK5T.js';
 
@@ -67,5 +67,5 @@ var resolveCantonTransaction = /* @__PURE__ */ __name(async ({ unresolvedCommand
 }, "resolveCantonTransaction");
 
 export { resolveCantonTransaction };
-//# sourceMappingURL=AM6OIKMW.js.map
-//# sourceMappingURL=AM6OIKMW.js.map
+//# sourceMappingURL=DPBZHN57.js.map
+//# sourceMappingURL=DPBZHN57.js.map

package/dist/{AM6OIKMW.js.map → DPBZHN57.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/refresh/resolve.ts"],"names":["resolveCantonTransaction","unresolvedCommands","unresolvedDisclosedContracts","senderParty","signingParties","client","nextDisclosed","disclosedContractIds","Set","map","contractId","appendDisclosures","disclosures","disclosure","has","add","push","resolveActiveContractId","resolveActiveContractIds","requireSenderParty","createContractAddressResolver","amuletBundlePromise","getAmuletBundle","dsoParty","getDsoParty","amuletContext","disclosedContracts","bundle","externalPartyAmuletRulesCid","getAmuletContextWithExternalRules","admin","id","AMULET_INSTRUMENT_ID","resolveRef","ref","type","resolvedCommands","substituteRefsToCids","resolvedDisclosedContracts","index","length","commands"],"mappings":";;;;;;AAgBO,IAAMA,wBAAAA,iCAAkC,EAC3CC,kBAAAA,EACAC,8BACAC,WAAAA,EACAC,cAAAA,EACAC,QAAM,KACmB;AAIzB,EAAA,MAAMC,aAAAA,GAAgB;AAAIJ,IAAAA,GAAAA;;AAC1B,EAAA,MAAMK,oBAAAA,GAAuB,IAAIC,GAAAA,CAC7BN,4BAAAA,CAA6BO,GAAAA,CAAI,CAAC,EAAEC,UAAAA,EAAU,KAAOA,UAAAA,CAAAA,CAAAA;AAEzD,EAAA,MAAMC,iBAAAA,2BAAqBC,WAAAA,KAAAA;AACvB,IAAA,KAAA,MAAWC,cAAcD,WAAAA,EAAa;AAClC,MAAA,IAAI,CAACL,oBAAAA,CAAqBO,GAAAA,CAAID,UAAAA,CAAWH,UAAU,CAAA,EAAG;AAClDH,QAAAA,oBAAAA,CAAqBQ,GAAAA,CAAIF,WAAWH,UAAU,CAAA;AAC9CJ,QAAAA,aAAAA,CAAcU,KAAKH,UAAAA,CAAAA;AACvB,MAAA;AACJ,IAAA;EACJ,CAAA,EAP0B,mBAAA,CAAA;AAS1B,EAAA,MAAM,EAAEI,uBAAAA,EAAyBC,wBAAAA,EAA0BC,kBAAAA,KACvDC,6BAAAA,CAA8B;AAC1Bf,IAAAA,MAAAA;AACAF,IAAAA,WAAAA;AACAC,IAAAA,cAAAA;AACAO,IAAAA;GACJ,CAAA;AAEJ,EAAA,IAAIU,mBAAAA;AAOJ,EAAA,MAAMC,kCAAkB,MAAA,CAAA,YAAA;AACpB,IAAA,IAAI,CAACD,mBAAAA,EAAqB;AACtBA,MAAAA,mBAAAA,GAAAA,CAAuB,YAAA;AACnB,QAAA,MAAME,QAAAA,GAAW,MAAMlB,MAAAA,CAAOmB,WAAAA,EAAW;AACzC,QAAA,MAAM,EACFC,eACAC,kBAAAA,EAAoBC,MAAAA,EACpBC,6BAA2B,GAC3B,MAAMvB,OAAOwB,iCAAAA,CAAkC;UAC/CC,KAAAA,EAAOP,QAAAA;UACPQ,EAAAA,EAAIC;SACR,CAAA;AACArB,QAAAA,iBAAAA,CAAkBgB,MAAAA,CAAAA;AAClB,QAAA,OAAO;AAAEF,UAAAA,aAAAA;AAAeG,UAAAA;AAA4B,SAAA;MACxD,CAAA,GAAA;AACJ,IAAA;AACA,IAAA,OAAOP,mBAAAA;EACX,CAAA,EAjBwB,iBAAA,CAAA;AAmBxB,EAAA,MAAMY,UAAAA,iCAAoBC,GAAAA,KAAAA;AACtB,IAAA,QAAQA,IAAIC,IAAAA;MACR,KAAK,aAAA;AACD,QAAA,OAAOhB,kBAAAA,CAAmBe,IAAIC,IAAI,CAAA;MACtC,KAAK,kBAAA;AACD,QAAA,OAAOlB,wBAAwBiB,GAAAA,CAAAA;MACnC,KAAK,mBAAA;AACD,QAAA,OAAOhB,yBAAyBgB,GAAAA,CAAAA;MACpC,KAAK,gBAAA;AACD,QAAA,OAAA,CAAQ,MAAMZ,iBAAAA,EAAmBM,2BAAAA;MACrC,KAAK,eAAA;AACD,QAAA,OAAA,CAAQ,MAAMN,iBAAAA,EAAmBG,aAAAA;AACzC;EACJ,CAAA,EAbmB,YAAA,CAAA;AAenB,EAAA,MAAMW,gBAAAA,GAAmB,MAAMC,oBAAAA,CAAqBpC,kBAAAA,EAAoBgC,UAAAA,CAAAA;AACxE,EAAA,MAAMK,6BAAuD,EAAA;AAC7D,EAAA,KAAA,IAASC,KAAAA,GAAQ,CAAA,EAAGA,KAAAA,GAAQjC,aAAAA,CAAckC,QAAQD,KAAAA,EAAAA,EAAS;AACvDD,IAAAA,0BAAAA,CAA2BtB,KACvB,MAAMqB,oBAAAA,CAAqB/B,cAAciC,KAAAA,CAAAA,EAASN,UAAAA,CAAAA,CAAAA;AAE1D,EAAA;AAEA,EAAA,OAAO;IACHQ,QAAAA,EAAUL,gBAAAA;IACVV,kBAAAA,EAAoBY;AACxB,GAAA;AACJ,CAAA,EApFwC,0BAAA","file":"AM6OIKMW.js","sourcesContent":["import { AMULET_INSTRUMENT_ID, type ChoiceContext } from '../client/amulet';\nimport type { ICantonClient } from '../client/interface';\nimport type { CantonDeferredValue } from '../deferredValue';\nimport type { CantonCommands, CantonDisclosedContracts } from '../transaction';\nimport { createContractAddressResolver } from './address-resolver';\nimport { substituteRefsToCids } from './reverse-substitute';\n\nexport interface ResolveCantonAddressParams {\n    unresolvedCommands: CantonCommands;\n    unresolvedDisclosedContracts: CantonDisclosedContracts;\n    senderParty?: string;\n    /** A contract is only disclosed when none of these parties is already a stakeholder on it. */\n    signingParties: string[];\n    client: ICantonClient;\n}\n\nexport const resolveCantonTransaction = async ({\n    unresolvedCommands,\n    unresolvedDisclosedContracts,\n    senderParty,\n    signingParties,\n    client,\n}: ResolveCantonAddressParams): Promise<{\n    commands: CantonCommands;\n    disclosedContracts: CantonDisclosedContracts;\n}> => {\n    const nextDisclosed = [...unresolvedDisclosedContracts];\n    const disclosedContractIds = new Set(\n        unresolvedDisclosedContracts.map(({ contractId }) => contractId),\n    );\n    const appendDisclosures = (disclosures: CantonDisclosedContracts): void => {\n        for (const disclosure of disclosures) {\n            if (!disclosedContractIds.has(disclosure.contractId)) {\n                disclosedContractIds.add(disclosure.contractId);\n                nextDisclosed.push(disclosure);\n            }\n        }\n    };\n\n    const { resolveActiveContractId, resolveActiveContractIds, requireSenderParty } =\n        createContractAddressResolver({\n            client,\n            senderParty,\n            signingParties,\n            appendDisclosures,\n        });\n\n    let amuletBundlePromise:\n        | Promise<{\n              amuletContext: ChoiceContext;\n              externalPartyAmuletRulesCid: string;\n          }>\n        | undefined;\n\n    const getAmuletBundle = async () => {\n        if (!amuletBundlePromise) {\n            amuletBundlePromise = (async () => {\n                const dsoParty = await client.getDsoParty();\n                const {\n                    amuletContext,\n                    disclosedContracts: bundle,\n                    externalPartyAmuletRulesCid,\n                } = await client.getAmuletContextWithExternalRules({\n                    admin: dsoParty,\n                    id: AMULET_INSTRUMENT_ID,\n                });\n                appendDisclosures(bundle);\n                return { amuletContext, externalPartyAmuletRulesCid };\n            })();\n        }\n        return amuletBundlePromise;\n    };\n\n    const resolveRef = async (ref: CantonDeferredValue): Promise<unknown> => {\n        switch (ref.type) {\n            case 'senderParty':\n                return requireSenderParty(ref.type);\n            case 'activeContractId':\n                return resolveActiveContractId(ref);\n            case 'activeContractIds':\n                return resolveActiveContractIds(ref);\n            case 'amuletRulesCid':\n                return (await getAmuletBundle()).externalPartyAmuletRulesCid;\n            case 'amuletContext':\n                return (await getAmuletBundle()).amuletContext;\n        }\n    };\n\n    const resolvedCommands = await substituteRefsToCids(unresolvedCommands, resolveRef);\n    const resolvedDisclosedContracts: CantonDisclosedContracts = [];\n    for (let index = 0; index < nextDisclosed.length; index++) {\n        resolvedDisclosedContracts.push(\n            await substituteRefsToCids(nextDisclosed[index]!, resolveRef),\n        );\n    }\n\n    return {\n        commands: resolvedCommands,\n        disclosedContracts: resolvedDisclosedContracts,\n    };\n};\n"]}
+{"version":3,"sources":["../src/refresh/resolve.ts"],"names":["resolveCantonTransaction","unresolvedCommands","unresolvedDisclosedContracts","senderParty","signingParties","client","nextDisclosed","disclosedContractIds","Set","map","contractId","appendDisclosures","disclosures","disclosure","has","add","push","resolveActiveContractId","resolveActiveContractIds","requireSenderParty","createContractAddressResolver","amuletBundlePromise","getAmuletBundle","dsoParty","getDsoParty","amuletContext","disclosedContracts","bundle","externalPartyAmuletRulesCid","getAmuletContextWithExternalRules","admin","id","AMULET_INSTRUMENT_ID","resolveRef","ref","type","resolvedCommands","substituteRefsToCids","resolvedDisclosedContracts","index","length","commands"],"mappings":";;;;;;AAgBO,IAAMA,wBAAAA,iCAAkC,EAC3CC,kBAAAA,EACAC,8BACAC,WAAAA,EACAC,cAAAA,EACAC,QAAM,KACmB;AAIzB,EAAA,MAAMC,aAAAA,GAAgB;AAAIJ,IAAAA,GAAAA;;AAC1B,EAAA,MAAMK,oBAAAA,GAAuB,IAAIC,GAAAA,CAC7BN,4BAAAA,CAA6BO,GAAAA,CAAI,CAAC,EAAEC,UAAAA,EAAU,KAAOA,UAAAA,CAAAA,CAAAA;AAEzD,EAAA,MAAMC,iBAAAA,2BAAqBC,WAAAA,KAAAA;AACvB,IAAA,KAAA,MAAWC,cAAcD,WAAAA,EAAa;AAClC,MAAA,IAAI,CAACL,oBAAAA,CAAqBO,GAAAA,CAAID,UAAAA,CAAWH,UAAU,CAAA,EAAG;AAClDH,QAAAA,oBAAAA,CAAqBQ,GAAAA,CAAIF,WAAWH,UAAU,CAAA;AAC9CJ,QAAAA,aAAAA,CAAcU,KAAKH,UAAAA,CAAAA;AACvB,MAAA;AACJ,IAAA;EACJ,CAAA,EAP0B,mBAAA,CAAA;AAS1B,EAAA,MAAM,EAAEI,uBAAAA,EAAyBC,wBAAAA,EAA0BC,kBAAAA,KACvDC,6BAAAA,CAA8B;AAC1Bf,IAAAA,MAAAA;AACAF,IAAAA,WAAAA;AACAC,IAAAA,cAAAA;AACAO,IAAAA;GACJ,CAAA;AAEJ,EAAA,IAAIU,mBAAAA;AAOJ,EAAA,MAAMC,kCAAkB,MAAA,CAAA,YAAA;AACpB,IAAA,IAAI,CAACD,mBAAAA,EAAqB;AACtBA,MAAAA,mBAAAA,GAAAA,CAAuB,YAAA;AACnB,QAAA,MAAME,QAAAA,GAAW,MAAMlB,MAAAA,CAAOmB,WAAAA,EAAW;AACzC,QAAA,MAAM,EACFC,eACAC,kBAAAA,EAAoBC,MAAAA,EACpBC,6BAA2B,GAC3B,MAAMvB,OAAOwB,iCAAAA,CAAkC;UAC/CC,KAAAA,EAAOP,QAAAA;UACPQ,EAAAA,EAAIC;SACR,CAAA;AACArB,QAAAA,iBAAAA,CAAkBgB,MAAAA,CAAAA;AAClB,QAAA,OAAO;AAAEF,UAAAA,aAAAA;AAAeG,UAAAA;AAA4B,SAAA;MACxD,CAAA,GAAA;AACJ,IAAA;AACA,IAAA,OAAOP,mBAAAA;EACX,CAAA,EAjBwB,iBAAA,CAAA;AAmBxB,EAAA,MAAMY,UAAAA,iCAAoBC,GAAAA,KAAAA;AACtB,IAAA,QAAQA,IAAIC,IAAAA;MACR,KAAK,aAAA;AACD,QAAA,OAAOhB,kBAAAA,CAAmBe,IAAIC,IAAI,CAAA;MACtC,KAAK,kBAAA;AACD,QAAA,OAAOlB,wBAAwBiB,GAAAA,CAAAA;MACnC,KAAK,mBAAA;AACD,QAAA,OAAOhB,yBAAyBgB,GAAAA,CAAAA;MACpC,KAAK,gBAAA;AACD,QAAA,OAAA,CAAQ,MAAMZ,iBAAAA,EAAmBM,2BAAAA;MACrC,KAAK,eAAA;AACD,QAAA,OAAA,CAAQ,MAAMN,iBAAAA,EAAmBG,aAAAA;AACzC;EACJ,CAAA,EAbmB,YAAA,CAAA;AAenB,EAAA,MAAMW,gBAAAA,GAAmB,MAAMC,oBAAAA,CAAqBpC,kBAAAA,EAAoBgC,UAAAA,CAAAA;AACxE,EAAA,MAAMK,6BAAuD,EAAA;AAC7D,EAAA,KAAA,IAASC,KAAAA,GAAQ,CAAA,EAAGA,KAAAA,GAAQjC,aAAAA,CAAckC,QAAQD,KAAAA,EAAAA,EAAS;AACvDD,IAAAA,0BAAAA,CAA2BtB,KACvB,MAAMqB,oBAAAA,CAAqB/B,cAAciC,KAAAA,CAAAA,EAASN,UAAAA,CAAAA,CAAAA;AAE1D,EAAA;AAEA,EAAA,OAAO;IACHQ,QAAAA,EAAUL,gBAAAA;IACVV,kBAAAA,EAAoBY;AACxB,GAAA;AACJ,CAAA,EApFwC,0BAAA","file":"DPBZHN57.js","sourcesContent":["import { AMULET_INSTRUMENT_ID, type ChoiceContext } from '../client/amulet';\nimport type { ICantonClient } from '../client/interface';\nimport type { CantonDeferredValue } from '../deferredValue';\nimport type { CantonCommands, CantonDisclosedContracts } from '../transaction';\nimport { createContractAddressResolver } from './address-resolver';\nimport { substituteRefsToCids } from './reverse-substitute';\n\nexport interface ResolveCantonAddressParams {\n    unresolvedCommands: CantonCommands;\n    unresolvedDisclosedContracts: CantonDisclosedContracts;\n    senderParty?: string;\n    /** A contract is only disclosed when none of these parties is already a stakeholder on it. */\n    signingParties: string[];\n    client: ICantonClient;\n}\n\nexport const resolveCantonTransaction = async ({\n    unresolvedCommands,\n    unresolvedDisclosedContracts,\n    senderParty,\n    signingParties,\n    client,\n}: ResolveCantonAddressParams): Promise<{\n    commands: CantonCommands;\n    disclosedContracts: CantonDisclosedContracts;\n}> => {\n    const nextDisclosed = [...unresolvedDisclosedContracts];\n    const disclosedContractIds = new Set(\n        unresolvedDisclosedContracts.map(({ contractId }) => contractId),\n    );\n    const appendDisclosures = (disclosures: CantonDisclosedContracts): void => {\n        for (const disclosure of disclosures) {\n            if (!disclosedContractIds.has(disclosure.contractId)) {\n                disclosedContractIds.add(disclosure.contractId);\n                nextDisclosed.push(disclosure);\n            }\n        }\n    };\n\n    const { resolveActiveContractId, resolveActiveContractIds, requireSenderParty } =\n        createContractAddressResolver({\n            client,\n            senderParty,\n            signingParties,\n            appendDisclosures,\n        });\n\n    let amuletBundlePromise:\n        | Promise<{\n              amuletContext: ChoiceContext;\n              externalPartyAmuletRulesCid: string;\n          }>\n        | undefined;\n\n    const getAmuletBundle = async () => {\n        if (!amuletBundlePromise) {\n            amuletBundlePromise = (async () => {\n                const dsoParty = await client.getDsoParty();\n                const {\n                    amuletContext,\n                    disclosedContracts: bundle,\n                    externalPartyAmuletRulesCid,\n                } = await client.getAmuletContextWithExternalRules({\n                    admin: dsoParty,\n                    id: AMULET_INSTRUMENT_ID,\n                });\n                appendDisclosures(bundle);\n                return { amuletContext, externalPartyAmuletRulesCid };\n            })();\n        }\n        return amuletBundlePromise;\n    };\n\n    const resolveRef = async (ref: CantonDeferredValue): Promise<unknown> => {\n        switch (ref.type) {\n            case 'senderParty':\n                return requireSenderParty(ref.type);\n            case 'activeContractId':\n                return resolveActiveContractId(ref);\n            case 'activeContractIds':\n                return resolveActiveContractIds(ref);\n            case 'amuletRulesCid':\n                return (await getAmuletBundle()).externalPartyAmuletRulesCid;\n            case 'amuletContext':\n                return (await getAmuletBundle()).amuletContext;\n        }\n    };\n\n    const resolvedCommands = await substituteRefsToCids(unresolvedCommands, resolveRef);\n    const resolvedDisclosedContracts: CantonDisclosedContracts = [];\n    for (let index = 0; index < nextDisclosed.length; index++) {\n        resolvedDisclosedContracts.push(\n            await substituteRefsToCids(nextDisclosed[index]!, resolveRef),\n        );\n    }\n\n    return {\n        commands: resolvedCommands,\n        disclosedContracts: resolvedDisclosedContracts,\n    };\n};\n"]}

package/dist/{JRWFKJNA.js → UVTS5LAN.js}

@@ -1,7 +1,7 @@
 import { CantonClient } from './46AEW4RY.js';
 import { Configuration } from './KBNUN3MF.js';
 import { CantonGrpcClient } from './BFQYTMKD.js';
-import { LocalTokenProvider } from './SCEF7TLZ.js';
+import { LocalTokenProvider } from './YF7P4UQM.js';
 import { ClientCredentialsTokenProvider } from './V2H2WXKE.js';
 import { __name } from './VUOMXK5T.js';
 
@@ -99,5 +99,5 @@ function createTokenProvider(params, isLocal) {
 __name(createTokenProvider, "createTokenProvider");
 
 export { createCantonChainProvider, parseCantonChainUri };
-//# sourceMappingURL=JRWFKJNA.js.map
-//# sourceMappingURL=JRWFKJNA.js.map
+//# sourceMappingURL=UVTS5LAN.js.map
+//# sourceMappingURL=UVTS5LAN.js.map

package/dist/{JRWFKJNA.js.map → UVTS5LAN.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/provider.ts"],"names":["parseCantonChainUri","uri","url","URL","adminApiHost","searchParams","get","Error","userId","actAsParam","actAs","split","map","party","trim","filter","length","walletUrl","tokenUrl","undefined","clientId","clientSecret","process","env","CANTON_CLIENT_SECRET","scope","audience","key","delete","jsonApiUrl","toString","replace","oauth2","createCantonChainProvider","isLocal","params","tokenProvider","createTokenProvider","configuration","Configuration","basePath","accessToken","getToken","client","CantonClient","grpcClient","CantonGrpcClient","host","insecureTransport","LocalTokenProvider","admin","ClientCredentialsTokenProvider"],"mappings":";;;;;;;;AA6DO,SAASA,oBAAoBC,GAAAA,EAAW;AAC3C,EAAA,MAAMC,GAAAA,GAAM,IAAIC,GAAAA,CAAIF,GAAAA,CAAAA;AAEpB,EAAA,MAAMG,YAAAA,GAAeF,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,WAAA,CAAA;AAC1C,EAAA,IAAI,CAACF,YAAAA,EAAc;AACf,IAAA,MAAM,IAAIG,MAAM,kEAAA,CAAA;AACpB,EAAA;AAEA,EAAA,MAAMC,MAAAA,GAASN,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,SAAA,CAAA,IAAc,mBAAA;AAClD,EAAA,MAAMG,UAAAA,GAAaP,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,QAAA,CAAA;AACxC,EAAA,MAAMI,QACFD,UAAAA,EACME,KAAAA,CAAM,GAAA,CAAA,CACPC,GAAAA,CAAI,CAACC,KAAAA,KAAUA,KAAAA,CAAMC,MAAI,CAAA,CACzBC,OAAO,CAACF,KAAAA,KAAUA,MAAMG,MAAAA,GAAS,CAAA,KAAM,EAAA;AAChD,EAAA,MAAMC,SAAAA,GAAYf,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,YAAA,CAAA;AACvC,EAAA,IAAI,CAACW,SAAAA,EAAW;AACZ,IAAA,MAAM,IAAIV,MAAM,mEAAA,CAAA;AACpB,EAAA;AACA,EAAA,MAAMW,QAAAA,GAAWhB,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,WAAA,CAAA,IAAgBa,MAAAA;AACtD,EAAA,MAAMC,QAAAA,GAAWlB,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,WAAA,CAAA,IAAgBa,MAAAA;AAEtD,EAAA,MAAME,YAAAA,GACFnB,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,eAAA,CAAA;AAErBgB,EAAAA,OAAAA,CAAQC,IAAIC,oBAAAA,IACZL,MAAAA;AACJ,EAAA,MAAMM,KAAAA,GAAQvB,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,OAAA,CAAA,IAAYa,MAAAA;AAC/C,EAAA,MAAMO,QAAAA,GAAWxB,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,UAAA,CAAA,IAAea,MAAAA;AAErD,EAAA,KAAA,MAAWQ,GAAAA,IAAO;AACd,IAAA,WAAA;AACA,IAAA,SAAA;AACA,IAAA,QAAA;AACA,IAAA,YAAA;AACA,IAAA,eAAA;AACA,IAAA,sBAAA;AACA,IAAA,kBAAA;AACA,IAAA,WAAA;AACA,IAAA,WAAA;AACA,IAAA,eAAA;AACA,IAAA,OAAA;AACA,IAAA;AACD,GAAA,EAAA;AACCzB,IAAAA,GAAAA,CAAIG,YAAAA,CAAauB,OAAOD,GAAAA,CAAAA;AAC5B,EAAA;AAEA,EAAA,MAAME,aAAa3B,GAAAA,CAAI4B,QAAAA,EAAQ,CAAGC,OAAAA,CAAQ,OAAO,EAAA,CAAA;AAEjD,EAAA,MAAMC,MAAAA,GACFd,QAAAA,IAAYE,QAAAA,IAAYC,YAAAA,GAClB;AAAEH,IAAAA,QAAAA;AAAUE,IAAAA,QAAAA;AAAUC,IAAAA,YAAAA;AAAcI,IAAAA,KAAAA;AAAOC,IAAAA;GAAS,GACpDP,MAAAA;AAEV,EAAA,OAAO;AACHU,IAAAA,UAAAA;AACAzB,IAAAA,YAAAA;AACAI,IAAAA,MAAAA;AACAE,IAAAA,KAAAA;AACAO,IAAAA,SAAAA;AACAe,IAAAA;AACJ,GAAA;AACJ;AA9DgBhC,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;AAmFT,SAASiC,yBAAAA,CAA0B,EACtChC,GAAAA,EACAiC,OAAAA,EAAO,EACwB;AAC/B,EAAA,MAAMC,MAAAA,GAASnC,oBAAoBC,GAAAA,CAAAA;AAEnC,EAAA,MAAMmC,aAAAA,GAAgBC,mBAAAA,CAAoBF,MAAAA,EAAQD,OAAAA,CAAAA;AAGlD,EAAA,MAAMI,aAAAA,GAAgB,IAAIC,aAAAA,CAAc;AACpCC,IAAAA,QAAAA,EAAUL,MAAAA,CAAON,UAAAA;IACjBY,WAAAA,kBAAa,MAAA,CAAA,MAAML,aAAAA,CAAcM,QAAAA,EAAQ,EAA5B,aAAA;GACjB,CAAA;AACA,EAAA,MAAMC,MAAAA,GAAS,IAAIC,YAAAA,CAAaN,aAAAA,EAAeH,OAAO3B,MAAAA,EAAQ;AAC1DS,IAAAA,SAAAA,EAAWkB,MAAAA,CAAOlB,SAAAA;AAClBmB,IAAAA;GACJ,CAAA;AAGA,EAAA,MAAMS,UAAAA,GAAa,IAAIC,gBAAAA,CAAiB;AACpCC,IAAAA,IAAAA,EAAMZ,MAAAA,CAAO/B,YAAAA;AACbgC,IAAAA,aAAAA;IACAY,iBAAAA,EAAmBd;GACvB,CAAA;AAEA,EAAA,OAAO;AACHS,IAAAA,MAAAA;AACAE,IAAAA,UAAAA;AACAT,IAAAA,aAAAA;AACAnB,IAAAA,SAAAA,EAAWkB,MAAAA,CAAOlB;AACtB,GAAA;AACJ;AA/BgBgB,MAAAA,CAAAA,yBAAAA,EAAAA,2BAAAA,CAAAA;AAiChB,SAASI,mBAAAA,CAAoBF,QAA8BD,OAAAA,EAAgB;AACvE,EAAA,IAAIA,OAAAA,EAAS;AACT,IAAA,OAAO,IAAIe,kBAAAA,CAAmB;AAC1BzC,MAAAA,MAAAA,EAAQ2B,MAAAA,CAAO3B,MAAAA;AACfE,MAAAA,KAAAA,EAAOyB,MAAAA,CAAOzB,KAAAA;MACdwC,KAAAA,EAAO;KACX,CAAA;AACJ,EAAA;AAGA,EAAA,IAAI,CAACf,OAAOH,MAAAA,EAAQ;AAChB,IAAA,MAAM,IAAIzB,MACN,kHAAA,CAAA;AAER,EAAA;AAEA,EAAA,OAAO,IAAI4C,8BAAAA,CAA+BhB,MAAAA,CAAOH,MAAM,CAAA;AAC3D;AAjBSK,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA","file":"JRWFKJNA.js","sourcesContent":["import {\n    ClientCredentialsTokenProvider,\n    type ClientCredentialsTokenProviderConfig,\n} from './auth/client-credentials-token-provider';\nimport { LocalTokenProvider } from './auth/local-token-provider';\nimport type { TokenProvider } from './auth/token-provider';\nimport { CantonClient } from './client/canton-client';\nimport { CantonGrpcClient } from './client/grpc';\nimport type { ICantonClient } from './client/interface';\nimport { Configuration } from './open-api/runtime';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Provider Type\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * - {@link client} — JSON Ledger API (commands, queries, updates)\n * - {@link grpcClient} — gRPC Admin API (topology transactions, namespace queries)\n * - {@link tokenProvider} — Shared Bearer-token source used by both transports\n * - {@link walletUrl} — Canton Network validator wallet (scan-proxy CIP-56 endpoints)\n */\nexport type CantonChainProvider = {\n    client: ICantonClient;\n    grpcClient: CantonGrpcClient;\n    tokenProvider: TokenProvider;\n    /** Validator wallet URL for scan-proxy CIP-56 endpoints. Required. */\n    walletUrl: string;\n};\n\n// ─────────────────────────────────────────────────────────────────────────────\n// URI Parsing\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport type CantonChainUriParams = {\n    /** Base URL of the JSON Ledger API (e.g. \"http://localhost:5975\") */\n    jsonApiUrl: string;\n    /** Host:port of the gRPC Admin API (e.g. \"localhost:5076\") */\n    adminApiHost: string;\n    /** Ledger API user ID (default: \"participant_admin\") */\n    userId: string;\n    /** Parties granted `actAs` on localnet tokens (comma-separated in the URI). */\n    actAs: string[];\n    /** Validator wallet URL for scan-proxy CIP-56 endpoints (e.g. \"http://localhost:7201\"). Required. */\n    walletUrl: string;\n    /** OAuth2 client credentials config — present only for non-local environments */\n    oauth2?: ClientCredentialsTokenProviderConfig;\n};\n\n/**\n * Parse a Canton chain provider URI into its constituent parts.\n *\n * URI format:\n *   `<json-api-base>?admin-api=<host:port>&user-id=<id>&wallet-url=<url>[&token-url=...&client-id=...&client-secret=...&scope=...&audience=...]`\n *\n * The base URL (everything before the query string) is the JSON Ledger API endpoint.\n * Canton-specific params are extracted and removed; any remaining query params are\n * preserved on the JSON API URL.\n *\n * When `client-secret` is omitted from the URI, `CANTON_CLIENT_SECRET` is read from the\n * environment.\n */\nexport function parseCantonChainUri(uri: string): CantonChainUriParams {\n    const url = new URL(uri);\n\n    const adminApiHost = url.searchParams.get('admin-api');\n    if (!adminApiHost) {\n        throw new Error('Canton provider URI missing required \"admin-api\" query parameter');\n    }\n\n    const userId = url.searchParams.get('user-id') ?? 'participant_admin';\n    const actAsParam = url.searchParams.get('act-as');\n    const actAs =\n        actAsParam\n            ?.split(',')\n            .map((party) => party.trim())\n            .filter((party) => party.length > 0) ?? [];\n    const walletUrl = url.searchParams.get('wallet-url');\n    if (!walletUrl) {\n        throw new Error('Canton provider URI missing required \"wallet-url\" query parameter');\n    }\n    const tokenUrl = url.searchParams.get('token-url') ?? undefined;\n    const clientId = url.searchParams.get('client-id') ?? undefined;\n    // Prefer URI param; fall back to env so secrets are not committed in provider configs.\n    const clientSecret =\n        url.searchParams.get('client-secret') ??\n        // eslint-disable-next-line turbo/no-undeclared-env-vars -- runtime OAuth secret, not a turbo task input\n        process.env.CANTON_CLIENT_SECRET ??\n        undefined;\n    const scope = url.searchParams.get('scope') ?? undefined;\n    const audience = url.searchParams.get('audience') ?? undefined;\n\n    for (const key of [\n        'admin-api',\n        'user-id',\n        'act-as',\n        'wallet-url',\n        'sequencer-url',\n        'sequencer-validators',\n        'sequencer-quorum',\n        'token-url',\n        'client-id',\n        'client-secret',\n        'scope',\n        'audience',\n    ]) {\n        url.searchParams.delete(key);\n    }\n\n    const jsonApiUrl = url.toString().replace(/\\/$/, '');\n\n    const oauth2 =\n        tokenUrl && clientId && clientSecret\n            ? { tokenUrl, clientId, clientSecret, scope, audience }\n            : undefined;\n\n    return {\n        jsonApiUrl,\n        adminApiHost,\n        userId,\n        actAs,\n        walletUrl,\n        oauth2,\n    };\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Provider Factory\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport type CreateCantonChainProviderOptions = {\n    /** Raw provider URI (from provider config) */\n    uri: string;\n    /** When true, uses LocalTokenProvider (self-signed JWTs) instead of OAuth2 */\n    isLocal: boolean;\n};\n\n/**\n * Create a {@link CantonChainProvider} from a provider URI.\n *\n * - **isLocal=true**: Uses {@link LocalTokenProvider} with admin-level access (self-signed JWTs)\n *   over an unencrypted admin channel, allowed for a loopback admin host only.\n * - **isLocal=false**: Uses {@link ClientCredentialsTokenProvider} with OAuth2 client\n *   credentials extracted from the URI query parameters, over a TLS admin channel.\n */\nexport function createCantonChainProvider({\n    uri,\n    isLocal,\n}: CreateCantonChainProviderOptions): CantonChainProvider {\n    const params = parseCantonChainUri(uri);\n\n    const tokenProvider = createTokenProvider(params, isLocal);\n\n    // ── JSON Ledger API Client ──────────────────────────────────────────\n    const configuration = new Configuration({\n        basePath: params.jsonApiUrl,\n        accessToken: () => tokenProvider.getToken(),\n    });\n    const client = new CantonClient(configuration, params.userId, {\n        walletUrl: params.walletUrl,\n        tokenProvider,\n    });\n\n    // ── gRPC Admin API Client ───────────────────────────────────────────\n    const grpcClient = new CantonGrpcClient({\n        host: params.adminApiHost,\n        tokenProvider,\n        insecureTransport: isLocal,\n    });\n\n    return {\n        client,\n        grpcClient,\n        tokenProvider,\n        walletUrl: params.walletUrl,\n    };\n}\n\nfunction createTokenProvider(params: CantonChainUriParams, isLocal: boolean): TokenProvider {\n    if (isLocal) {\n        return new LocalTokenProvider({\n            userId: params.userId,\n            actAs: params.actAs,\n            admin: true,\n        });\n    }\n\n    // TODO(canton): add other prod auth methods (direct JWT passthrough, etc.).\n    if (!params.oauth2) {\n        throw new Error(\n            'Canton provider requires OAuth2 credentials (token-url, client-id, client-secret in URI or CANTON_CLIENT_SECRET)',\n        );\n    }\n\n    return new ClientCredentialsTokenProvider(params.oauth2);\n}\n"]}
+{"version":3,"sources":["../src/provider.ts"],"names":["parseCantonChainUri","uri","url","URL","adminApiHost","searchParams","get","Error","userId","actAsParam","actAs","split","map","party","trim","filter","length","walletUrl","tokenUrl","undefined","clientId","clientSecret","process","env","CANTON_CLIENT_SECRET","scope","audience","key","delete","jsonApiUrl","toString","replace","oauth2","createCantonChainProvider","isLocal","params","tokenProvider","createTokenProvider","configuration","Configuration","basePath","accessToken","getToken","client","CantonClient","grpcClient","CantonGrpcClient","host","insecureTransport","LocalTokenProvider","admin","ClientCredentialsTokenProvider"],"mappings":";;;;;;;;AA6DO,SAASA,oBAAoBC,GAAAA,EAAW;AAC3C,EAAA,MAAMC,GAAAA,GAAM,IAAIC,GAAAA,CAAIF,GAAAA,CAAAA;AAEpB,EAAA,MAAMG,YAAAA,GAAeF,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,WAAA,CAAA;AAC1C,EAAA,IAAI,CAACF,YAAAA,EAAc;AACf,IAAA,MAAM,IAAIG,MAAM,kEAAA,CAAA;AACpB,EAAA;AAEA,EAAA,MAAMC,MAAAA,GAASN,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,SAAA,CAAA,IAAc,mBAAA;AAClD,EAAA,MAAMG,UAAAA,GAAaP,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,QAAA,CAAA;AACxC,EAAA,MAAMI,QACFD,UAAAA,EACME,KAAAA,CAAM,GAAA,CAAA,CACPC,GAAAA,CAAI,CAACC,KAAAA,KAAUA,KAAAA,CAAMC,MAAI,CAAA,CACzBC,OAAO,CAACF,KAAAA,KAAUA,MAAMG,MAAAA,GAAS,CAAA,KAAM,EAAA;AAChD,EAAA,MAAMC,SAAAA,GAAYf,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,YAAA,CAAA;AACvC,EAAA,IAAI,CAACW,SAAAA,EAAW;AACZ,IAAA,MAAM,IAAIV,MAAM,mEAAA,CAAA;AACpB,EAAA;AACA,EAAA,MAAMW,QAAAA,GAAWhB,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,WAAA,CAAA,IAAgBa,MAAAA;AACtD,EAAA,MAAMC,QAAAA,GAAWlB,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,WAAA,CAAA,IAAgBa,MAAAA;AAEtD,EAAA,MAAME,YAAAA,GACFnB,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,eAAA,CAAA;AAErBgB,EAAAA,OAAAA,CAAQC,IAAIC,oBAAAA,IACZL,MAAAA;AACJ,EAAA,MAAMM,KAAAA,GAAQvB,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,OAAA,CAAA,IAAYa,MAAAA;AAC/C,EAAA,MAAMO,QAAAA,GAAWxB,GAAAA,CAAIG,YAAAA,CAAaC,GAAAA,CAAI,UAAA,CAAA,IAAea,MAAAA;AAErD,EAAA,KAAA,MAAWQ,GAAAA,IAAO;AACd,IAAA,WAAA;AACA,IAAA,SAAA;AACA,IAAA,QAAA;AACA,IAAA,YAAA;AACA,IAAA,eAAA;AACA,IAAA,sBAAA;AACA,IAAA,kBAAA;AACA,IAAA,WAAA;AACA,IAAA,WAAA;AACA,IAAA,eAAA;AACA,IAAA,OAAA;AACA,IAAA;AACD,GAAA,EAAA;AACCzB,IAAAA,GAAAA,CAAIG,YAAAA,CAAauB,OAAOD,GAAAA,CAAAA;AAC5B,EAAA;AAEA,EAAA,MAAME,aAAa3B,GAAAA,CAAI4B,QAAAA,EAAQ,CAAGC,OAAAA,CAAQ,OAAO,EAAA,CAAA;AAEjD,EAAA,MAAMC,MAAAA,GACFd,QAAAA,IAAYE,QAAAA,IAAYC,YAAAA,GAClB;AAAEH,IAAAA,QAAAA;AAAUE,IAAAA,QAAAA;AAAUC,IAAAA,YAAAA;AAAcI,IAAAA,KAAAA;AAAOC,IAAAA;GAAS,GACpDP,MAAAA;AAEV,EAAA,OAAO;AACHU,IAAAA,UAAAA;AACAzB,IAAAA,YAAAA;AACAI,IAAAA,MAAAA;AACAE,IAAAA,KAAAA;AACAO,IAAAA,SAAAA;AACAe,IAAAA;AACJ,GAAA;AACJ;AA9DgBhC,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA;AAmFT,SAASiC,yBAAAA,CAA0B,EACtChC,GAAAA,EACAiC,OAAAA,EAAO,EACwB;AAC/B,EAAA,MAAMC,MAAAA,GAASnC,oBAAoBC,GAAAA,CAAAA;AAEnC,EAAA,MAAMmC,aAAAA,GAAgBC,mBAAAA,CAAoBF,MAAAA,EAAQD,OAAAA,CAAAA;AAGlD,EAAA,MAAMI,aAAAA,GAAgB,IAAIC,aAAAA,CAAc;AACpCC,IAAAA,QAAAA,EAAUL,MAAAA,CAAON,UAAAA;IACjBY,WAAAA,kBAAa,MAAA,CAAA,MAAML,aAAAA,CAAcM,QAAAA,EAAQ,EAA5B,aAAA;GACjB,CAAA;AACA,EAAA,MAAMC,MAAAA,GAAS,IAAIC,YAAAA,CAAaN,aAAAA,EAAeH,OAAO3B,MAAAA,EAAQ;AAC1DS,IAAAA,SAAAA,EAAWkB,MAAAA,CAAOlB,SAAAA;AAClBmB,IAAAA;GACJ,CAAA;AAGA,EAAA,MAAMS,UAAAA,GAAa,IAAIC,gBAAAA,CAAiB;AACpCC,IAAAA,IAAAA,EAAMZ,MAAAA,CAAO/B,YAAAA;AACbgC,IAAAA,aAAAA;IACAY,iBAAAA,EAAmBd;GACvB,CAAA;AAEA,EAAA,OAAO;AACHS,IAAAA,MAAAA;AACAE,IAAAA,UAAAA;AACAT,IAAAA,aAAAA;AACAnB,IAAAA,SAAAA,EAAWkB,MAAAA,CAAOlB;AACtB,GAAA;AACJ;AA/BgBgB,MAAAA,CAAAA,yBAAAA,EAAAA,2BAAAA,CAAAA;AAiChB,SAASI,mBAAAA,CAAoBF,QAA8BD,OAAAA,EAAgB;AACvE,EAAA,IAAIA,OAAAA,EAAS;AACT,IAAA,OAAO,IAAIe,kBAAAA,CAAmB;AAC1BzC,MAAAA,MAAAA,EAAQ2B,MAAAA,CAAO3B,MAAAA;AACfE,MAAAA,KAAAA,EAAOyB,MAAAA,CAAOzB,KAAAA;MACdwC,KAAAA,EAAO;KACX,CAAA;AACJ,EAAA;AAGA,EAAA,IAAI,CAACf,OAAOH,MAAAA,EAAQ;AAChB,IAAA,MAAM,IAAIzB,MACN,kHAAA,CAAA;AAER,EAAA;AAEA,EAAA,OAAO,IAAI4C,8BAAAA,CAA+BhB,MAAAA,CAAOH,MAAM,CAAA;AAC3D;AAjBSK,MAAAA,CAAAA,mBAAAA,EAAAA,qBAAAA,CAAAA","file":"UVTS5LAN.js","sourcesContent":["import {\n    ClientCredentialsTokenProvider,\n    type ClientCredentialsTokenProviderConfig,\n} from './auth/client-credentials-token-provider';\nimport { LocalTokenProvider } from './auth/local-token-provider';\nimport type { TokenProvider } from './auth/token-provider';\nimport { CantonClient } from './client/canton-client';\nimport { CantonGrpcClient } from './client/grpc';\nimport type { ICantonClient } from './client/interface';\nimport { Configuration } from './open-api/runtime';\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Provider Type\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * - {@link client} — JSON Ledger API (commands, queries, updates)\n * - {@link grpcClient} — gRPC Admin API (topology transactions, namespace queries)\n * - {@link tokenProvider} — Shared Bearer-token source used by both transports\n * - {@link walletUrl} — Canton Network validator wallet (scan-proxy CIP-56 endpoints)\n */\nexport type CantonChainProvider = {\n    client: ICantonClient;\n    grpcClient: CantonGrpcClient;\n    tokenProvider: TokenProvider;\n    /** Validator wallet URL for scan-proxy CIP-56 endpoints. Required. */\n    walletUrl: string;\n};\n\n// ─────────────────────────────────────────────────────────────────────────────\n// URI Parsing\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport type CantonChainUriParams = {\n    /** Base URL of the JSON Ledger API (e.g. \"http://localhost:5975\") */\n    jsonApiUrl: string;\n    /** Host:port of the gRPC Admin API (e.g. \"localhost:5076\") */\n    adminApiHost: string;\n    /** Ledger API user ID (default: \"participant_admin\") */\n    userId: string;\n    /** Parties granted `actAs` on localnet tokens (comma-separated in the URI). */\n    actAs: string[];\n    /** Validator wallet URL for scan-proxy CIP-56 endpoints (e.g. \"http://localhost:7201\"). Required. */\n    walletUrl: string;\n    /** OAuth2 client credentials config — present only for non-local environments */\n    oauth2?: ClientCredentialsTokenProviderConfig;\n};\n\n/**\n * Parse a Canton chain provider URI into its constituent parts.\n *\n * URI format:\n *   `<json-api-base>?admin-api=<host:port>&user-id=<id>&wallet-url=<url>[&token-url=...&client-id=...&client-secret=...&scope=...&audience=...]`\n *\n * The base URL (everything before the query string) is the JSON Ledger API endpoint.\n * Canton-specific params are extracted and removed; any remaining query params are\n * preserved on the JSON API URL.\n *\n * When `client-secret` is omitted from the URI, `CANTON_CLIENT_SECRET` is read from the\n * environment.\n */\nexport function parseCantonChainUri(uri: string): CantonChainUriParams {\n    const url = new URL(uri);\n\n    const adminApiHost = url.searchParams.get('admin-api');\n    if (!adminApiHost) {\n        throw new Error('Canton provider URI missing required \"admin-api\" query parameter');\n    }\n\n    const userId = url.searchParams.get('user-id') ?? 'participant_admin';\n    const actAsParam = url.searchParams.get('act-as');\n    const actAs =\n        actAsParam\n            ?.split(',')\n            .map((party) => party.trim())\n            .filter((party) => party.length > 0) ?? [];\n    const walletUrl = url.searchParams.get('wallet-url');\n    if (!walletUrl) {\n        throw new Error('Canton provider URI missing required \"wallet-url\" query parameter');\n    }\n    const tokenUrl = url.searchParams.get('token-url') ?? undefined;\n    const clientId = url.searchParams.get('client-id') ?? undefined;\n    // Prefer URI param; fall back to env so secrets are not committed in provider configs.\n    const clientSecret =\n        url.searchParams.get('client-secret') ??\n        // eslint-disable-next-line turbo/no-undeclared-env-vars -- runtime OAuth secret, not a turbo task input\n        process.env.CANTON_CLIENT_SECRET ??\n        undefined;\n    const scope = url.searchParams.get('scope') ?? undefined;\n    const audience = url.searchParams.get('audience') ?? undefined;\n\n    for (const key of [\n        'admin-api',\n        'user-id',\n        'act-as',\n        'wallet-url',\n        'sequencer-url',\n        'sequencer-validators',\n        'sequencer-quorum',\n        'token-url',\n        'client-id',\n        'client-secret',\n        'scope',\n        'audience',\n    ]) {\n        url.searchParams.delete(key);\n    }\n\n    const jsonApiUrl = url.toString().replace(/\\/$/, '');\n\n    const oauth2 =\n        tokenUrl && clientId && clientSecret\n            ? { tokenUrl, clientId, clientSecret, scope, audience }\n            : undefined;\n\n    return {\n        jsonApiUrl,\n        adminApiHost,\n        userId,\n        actAs,\n        walletUrl,\n        oauth2,\n    };\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Provider Factory\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport type CreateCantonChainProviderOptions = {\n    /** Raw provider URI (from provider config) */\n    uri: string;\n    /** When true, uses LocalTokenProvider (self-signed JWTs) instead of OAuth2 */\n    isLocal: boolean;\n};\n\n/**\n * Create a {@link CantonChainProvider} from a provider URI.\n *\n * - **isLocal=true**: Uses {@link LocalTokenProvider} with admin-level access (self-signed JWTs)\n *   over an unencrypted admin channel, allowed for a loopback admin host only.\n * - **isLocal=false**: Uses {@link ClientCredentialsTokenProvider} with OAuth2 client\n *   credentials extracted from the URI query parameters, over a TLS admin channel.\n */\nexport function createCantonChainProvider({\n    uri,\n    isLocal,\n}: CreateCantonChainProviderOptions): CantonChainProvider {\n    const params = parseCantonChainUri(uri);\n\n    const tokenProvider = createTokenProvider(params, isLocal);\n\n    // ── JSON Ledger API Client ──────────────────────────────────────────\n    const configuration = new Configuration({\n        basePath: params.jsonApiUrl,\n        accessToken: () => tokenProvider.getToken(),\n    });\n    const client = new CantonClient(configuration, params.userId, {\n        walletUrl: params.walletUrl,\n        tokenProvider,\n    });\n\n    // ── gRPC Admin API Client ───────────────────────────────────────────\n    const grpcClient = new CantonGrpcClient({\n        host: params.adminApiHost,\n        tokenProvider,\n        insecureTransport: isLocal,\n    });\n\n    return {\n        client,\n        grpcClient,\n        tokenProvider,\n        walletUrl: params.walletUrl,\n    };\n}\n\nfunction createTokenProvider(params: CantonChainUriParams, isLocal: boolean): TokenProvider {\n    if (isLocal) {\n        return new LocalTokenProvider({\n            userId: params.userId,\n            actAs: params.actAs,\n            admin: true,\n        });\n    }\n\n    // TODO(canton): add other prod auth methods (direct JWT passthrough, etc.).\n    if (!params.oauth2) {\n        throw new Error(\n            'Canton provider requires OAuth2 credentials (token-url, client-id, client-secret in URI or CANTON_CLIENT_SECRET)',\n        );\n    }\n\n    return new ClientCredentialsTokenProvider(params.oauth2);\n}\n"]}

package/dist/{SCEF7TLZ.js → YF7P4UQM.js}

@@ -54,7 +54,7 @@ var LocalTokenProvider = class {
         participantId: null,
         applicationId: null,
         actAs: this.#config.actAs,
-        readAs: [],
+        readAs: this.#config.actAs,
         admin: this.#config.admin
       }
     };
@@ -65,5 +65,5 @@ var LocalTokenProvider = class {
 };
 
 export { LocalTokenProvider };
-//# sourceMappingURL=SCEF7TLZ.js.map
-//# sourceMappingURL=SCEF7TLZ.js.map
+//# sourceMappingURL=YF7P4UQM.js.map
+//# sourceMappingURL=YF7P4UQM.js.map

package/dist/YF7P4UQM.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/auth/local-token-provider.ts"],"names":["DEFAULT_SECRET","DEFAULT_AUDIENCE","DEFAULT_EXPIRES_IN","BUFFER_SECONDS","base64UrlEncode","data","base64","Buffer","from","toString","replace","generateJwt","payload","secret","header","alg","typ","headerEncoded","JSON","stringify","payloadEncoded","signatureInput","signature","crypto","createHmac","update","digest","LocalTokenProvider","config","userId","actAs","audience","expiresIn","admin","getToken","nowSeconds","Math","floor","Date","now","sub","aud","iat","exp","ledgerId","participantId","applicationId","readAs","delayMs","setTimeout"],"mappings":";;;AAcA,IAAMA,cAAAA,GAAiB,QAAA;AACvB,IAAMC,gBAAAA,GAAmB,+BAAA;AACzB,IAAMC,kBAAAA,GAAqB,IAAA;AAC3B,IAAMC,cAAAA,GAAiB,EAAA;AAMvB,SAASC,gBAAgBC,IAAAA,EAAqB;AAC1C,EAAA,MAAMC,SAASC,MAAAA,CAAOC,IAAAA,CAAKH,IAAAA,CAAAA,CAAMI,SAAS,QAAA,CAAA;AAC1C,EAAA,OAAOH,MAAAA,CAAOI,OAAAA,CAAQ,KAAA,EAAO,GAAA,CAAA,CAAKA,OAAAA,CAAQ,KAAA,EAAO,GAAA,CAAA,CAAKA,OAAAA,CAAQ,IAAA,EAAM,EAAA,CAAA;AACxE;AAHSN,MAAAA,CAAAA,eAAAA,EAAAA,iBAAAA,CAAAA;AAKT,SAASO,WAAAA,CAAYC,SAAiBC,MAAAA,EAAc;AAChD,EAAA,MAAMC,MAAAA,GAAS;IAAEC,GAAAA,EAAK,OAAA;IAASC,GAAAA,EAAK;AAAM,GAAA;AAC1C,EAAA,MAAMC,aAAAA,GAAgBb,eAAAA,CAAgBc,IAAAA,CAAKC,SAAAA,CAAUL,MAAAA,CAAAA,CAAAA;AACrD,EAAA,MAAMM,cAAAA,GAAiBhB,eAAAA,CAAgBc,IAAAA,CAAKC,SAAAA,CAAUP,OAAAA,CAAAA,CAAAA;AACtD,EAAA,MAAMS,cAAAA,GAAiB,CAAA,EAAGJ,aAAAA,CAAAA,CAAAA,EAAiBG,cAAAA,CAAAA,CAAAA;AAC3C,EAAA,MAAME,SAAAA,GAAYC,OAAOC,UAAAA,CAAW,QAAA,EAAUX,MAAAA,CAAAA,CAAQY,MAAAA,CAAOJ,cAAAA,CAAAA,CAAgBK,MAAAA,EAAM;AACnF,EAAA,OAAO,GAAGT,aAAAA,CAAAA,CAAAA,EAAiBG,cAAAA,CAAAA,CAAAA,EAAkBhB,eAAAA,CAAgBkB,SAAAA,CAAAA,CAAAA,CAAAA;AACjE;AAPSX,MAAAA,CAAAA,WAAAA,EAAAA,aAAAA,CAAAA;AAgBF,IAAMgB,qBAAN,MAAMA;EA5Cb;;;AA6Ca,EAAA,OAAA;EACT,MAAA,GAAwB,IAAA;AAExB,EAAA,WAAA,CAAYC,MAAAA,EAAkC;AAC1C,IAAA,IAAA,CAAK,OAAA,GAAU;AACXC,MAAAA,MAAAA,EAAQD,MAAAA,CAAOC,MAAAA;AACfC,MAAAA,KAAAA,EAAOF,MAAAA,CAAOE,KAAAA;AACdjB,MAAAA,MAAAA,EAAQe,OAAOf,MAAAA,IAAUb,cAAAA;AACzB+B,MAAAA,QAAAA,EAAUH,OAAOG,QAAAA,IAAY9B,gBAAAA;AAC7B+B,MAAAA,SAAAA,EAAWJ,OAAOI,SAAAA,IAAa9B,kBAAAA;AAC/B+B,MAAAA,KAAAA,EAAOL,OAAOK,KAAAA,IAAS;AAC3B,KAAA;AACJ,EAAA;AAEA,EAAA,MAAMC,QAAAA,GAA4B;AAC9B,IAAA,IAAA,CAAK,MAAA,KAAW,KAAK,cAAA,EAAc;AACnC,IAAA,OAAO,IAAA,CAAK,MAAA;AAChB,EAAA;EAEA,cAAA,GAAc;AACV,IAAA,MAAMC,aAAaC,IAAAA,CAAKC,KAAAA,CAAMC,IAAAA,CAAKC,GAAAA,KAAQ,GAAA,CAAA;AAC3C,IAAA,MAAM3B,OAAAA,GAAU;AACZ4B,MAAAA,GAAAA,EAAK,KAAK,OAAA,CAAQX,MAAAA;AAClBY,MAAAA,GAAAA,EAAK,KAAK,OAAA,CAAQV,QAAAA;MAClBW,GAAAA,EAAKP,UAAAA;MACLQ,GAAAA,EAAKR,UAAAA,GAAa,KAAK,OAAA,CAAQH,SAAAA;MAC/B,6BAAA,EAA+B;QAC3BY,QAAAA,EAAU,IAAA;QACVC,aAAAA,EAAe,IAAA;QACfC,aAAAA,EAAe,IAAA;AACfhB,QAAAA,KAAAA,EAAO,KAAK,OAAA,CAAQA,KAAAA;AACpBiB,QAAAA,MAAAA,EAAQ,KAAK,OAAA,CAAQjB,KAAAA;AACrBG,QAAAA,KAAAA,EAAO,KAAK,OAAA,CAAQA;AACxB;AACJ,KAAA;AACA,IAAA,MAAMe,OAAAA,GAAAA,CAAW,IAAA,CAAK,OAAA,CAAQhB,SAAAA,GAAY7B,cAAAA,IAAkB,GAAA;AAC5D8C,IAAAA,UAAAA,CAAW,MAAO,IAAA,CAAK,MAAA,GAAS,IAAA,EAAOD,OAAAA,CAAAA;AACvC,IAAA,OAAOrC,WAAAA,CAAYC,OAAAA,EAAS,IAAA,CAAK,OAAA,CAAQC,MAAM,CAAA;AACnD,EAAA;AACJ","file":"YF7P4UQM.js","sourcesContent":["import crypto from 'node:crypto';\n\nimport type { TokenProvider } from './token-provider';\n\nexport interface LocalTokenProviderConfig {\n    userId: string;\n    actAs: string[];\n    secret?: string;\n    audience?: string;\n    /** Token lifetime in seconds. */\n    expiresIn?: number;\n    admin?: boolean;\n}\n\nconst DEFAULT_SECRET = 'unsafe';\nconst DEFAULT_AUDIENCE = 'https://canton.network.global';\nconst DEFAULT_EXPIRES_IN = 3600; // 1 hour\nconst BUFFER_SECONDS = 60;\n\n// ─────────────────────────────────────────────────────────────────────────────\n// JWT helpers (HMAC-SHA256, Canton \"unsafe\" mode)\n// ─────────────────────────────────────────────────────────────────────────────\n\nfunction base64UrlEncode(data: string | Buffer): string {\n    const base64 = Buffer.from(data).toString('base64');\n    return base64.replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=/g, '');\n}\n\nfunction generateJwt(payload: object, secret: string): string {\n    const header = { alg: 'HS256', typ: 'JWT' };\n    const headerEncoded = base64UrlEncode(JSON.stringify(header));\n    const payloadEncoded = base64UrlEncode(JSON.stringify(payload));\n    const signatureInput = `${headerEncoded}.${payloadEncoded}`;\n    const signature = crypto.createHmac('sha256', secret).update(signatureInput).digest();\n    return `${headerEncoded}.${payloadEncoded}.${base64UrlEncode(signature)}`;\n}\n\n/**\n * Token provider for local development and sandbox environments.\n *\n * Generates short-lived HMAC-SHA256 JWTs on the fly using the Canton\n * participant node's \"unsafe\" identity provider manager shared secret.\n * Tokens are cached in memory and regenerated automatically before expiry.\n */\nexport class LocalTokenProvider implements TokenProvider {\n    readonly #config: Required<LocalTokenProviderConfig>;\n    #token: string | null = null;\n\n    constructor(config: LocalTokenProviderConfig) {\n        this.#config = {\n            userId: config.userId,\n            actAs: config.actAs,\n            secret: config.secret ?? DEFAULT_SECRET,\n            audience: config.audience ?? DEFAULT_AUDIENCE,\n            expiresIn: config.expiresIn ?? DEFAULT_EXPIRES_IN,\n            admin: config.admin ?? true,\n        };\n    }\n\n    async getToken(): Promise<string> {\n        this.#token ??= this.#generateToken();\n        return this.#token;\n    }\n\n    #generateToken(): string {\n        const nowSeconds = Math.floor(Date.now() / 1000);\n        const payload = {\n            sub: this.#config.userId,\n            aud: this.#config.audience,\n            iat: nowSeconds,\n            exp: nowSeconds + this.#config.expiresIn,\n            'https://daml.com/ledger-api': {\n                ledgerId: null,\n                participantId: null,\n                applicationId: null,\n                actAs: this.#config.actAs,\n                readAs: this.#config.actAs,\n                admin: this.#config.admin,\n            },\n        };\n        const delayMs = (this.#config.expiresIn - BUFFER_SECONDS) * 1000;\n        setTimeout(() => (this.#token = null), delayMs);\n        return generateJwt(payload, this.#config.secret);\n    }\n}\n"]}

package/dist/auth/index.js

@@ -1,6 +1,6 @@
 import '../35ELVFTS.js';
 import '../RSV7WS7X.js';
-export { LocalTokenProvider } from '../SCEF7TLZ.js';
+export { LocalTokenProvider } from '../YF7P4UQM.js';
 export { ClientCredentialsTokenProvider } from '../V2H2WXKE.js';
 import '../VUOMXK5T.js';
 //# sourceMappingURL=index.js.map

package/dist/auth/local-token-provider.js

@@ -1,4 +1,4 @@
-export { LocalTokenProvider } from '../SCEF7TLZ.js';
+export { LocalTokenProvider } from '../YF7P4UQM.js';
 import '../VUOMXK5T.js';
 //# sourceMappingURL=local-token-provider.js.map
 //# sourceMappingURL=local-token-provider.js.map

package/dist/index.js

@@ -1,16 +1,16 @@
 import './5GUYLHA7.js';
 export { CantonSdk } from './D52OIJDY.js';
 import './AQJMQQ4W.js';
-export { buildCantonDeployedContractAddressRef, qualifiedTemplateName, templateIdMatches } from './XWKAFAGE.js';
-export { resolveCantonTransaction } from './AM6OIKMW.js';
-export { createContractAddressResolver, isConcreteActiveContractRef, isRefAlive, matchesContractStateFilter, queryLiveContractIdsForRef, queryLiveContractsForRef, resolveContractStateFilter, resolveExpectedSignatories } from './75B7Y26B.js';
 export { wrapLzSdk } from './HF5HP2EX.js';
+export { buildCantonDeployedContractAddressRef, qualifiedTemplateName, templateIdMatches } from './XWKAFAGE.js';
+export { resolveCantonTransaction } from './DPBZHN57.js';
 export { substituteCidsToRefs, substituteRefsToCids } from './WLHCBBAJ.js';
+export { createContractAddressResolver, isConcreteActiveContractRef, isRefAlive, matchesContractStateFilter, queryLiveContractIdsForRef, queryLiveContractsForRef, resolveContractStateFilter, resolveExpectedSignatories } from './75B7Y26B.js';
 import './7JX6NIYS.js';
 export { buildMultiTransactionSignatures, buildSignedTransaction } from './WKC6X2E3.js';
 import './IIWYAFUO.js';
 export { parseMinFeeValue } from './M3GPMXME.js';
-export { createCantonChainProvider, parseCantonChainUri } from './JRWFKJNA.js';
+export { createCantonChainProvider, parseCantonChainUri } from './UVTS5LAN.js';
 export { CantonClient } from './46AEW4RY.js';
 import './5HH7PZW3.js';
 import './6CPYXAOF.js';
@@ -306,7 +306,7 @@ export { areExpectedSignatories, getCreateArgumentField, isSignatoryOrigin, isTr
 export { CommandStatus, IntLikeSchema, buildTemplateId, canonicalizeDamlDecimal, smallestUnitsToDamlDecimal } from './4WZTQJXP.js';
 import './35ELVFTS.js';
 import './RSV7WS7X.js';
-export { LocalTokenProvider } from './SCEF7TLZ.js';
+export { LocalTokenProvider } from './YF7P4UQM.js';
 export { ClientCredentialsTokenProvider } from './V2H2WXKE.js';
 export { parseAmuletAmount, parseAmuletDecimal } from './CXTOAS7N.js';
 export { CANTON_CID_ADDRESS_PREFIX, CANTON_PARTY_ADDRESS_PREFIX, cantonCidAddress, cantonDeferredAddress, cantonPartyAddress, isCantonAddress, toCantonAddress } from './FADZDRWB.js';

package/dist/provider.js

@@ -1,4 +1,4 @@
-export { createCantonChainProvider, parseCantonChainUri } from './JRWFKJNA.js';
+export { createCantonChainProvider, parseCantonChainUri } from './UVTS5LAN.js';
 import './46AEW4RY.js';
 import './5HH7PZW3.js';
 import './6CPYXAOF.js';
@@ -290,7 +290,7 @@ import './RVQWP4JU.js';
 import './VJ4PVZYL.js';
 import './PL4H5XEA.js';
 import './WLV6EHDB.js';
-import './SCEF7TLZ.js';
+import './YF7P4UQM.js';
 import './V2H2WXKE.js';
 import './CMDFOA7C.js';
 import './3K5JL2TP.js';

package/dist/refresh/index.js

@@ -1,9 +1,9 @@
 import '../AQJMQQ4W.js';
-export { buildCantonDeployedContractAddressRef, qualifiedTemplateName, templateIdMatches } from '../XWKAFAGE.js';
-export { resolveCantonTransaction } from '../AM6OIKMW.js';
-export { createContractAddressResolver, isConcreteActiveContractRef, isRefAlive, matchesContractStateFilter, queryLiveContractIdsForRef, queryLiveContractsForRef, resolveContractStateFilter, resolveExpectedSignatories } from '../75B7Y26B.js';
 export { wrapLzSdk } from '../HF5HP2EX.js';
+export { buildCantonDeployedContractAddressRef, qualifiedTemplateName, templateIdMatches } from '../XWKAFAGE.js';
+export { resolveCantonTransaction } from '../DPBZHN57.js';
 export { substituteCidsToRefs, substituteRefsToCids } from '../WLHCBBAJ.js';
+export { createContractAddressResolver, isConcreteActiveContractRef, isRefAlive, matchesContractStateFilter, queryLiveContractIdsForRef, queryLiveContractsForRef, resolveContractStateFilter, resolveExpectedSignatories } from '../75B7Y26B.js';
 import '../SEKD553P.js';
 import '../SWY4QT4I.js';
 import '../QSQZYJB6.js';

package/dist/refresh/resolve.js

@@ -1,6 +1,6 @@
-export { resolveCantonTransaction } from '../AM6OIKMW.js';
-import '../75B7Y26B.js';
+export { resolveCantonTransaction } from '../DPBZHN57.js';
 import '../WLHCBBAJ.js';
+import '../75B7Y26B.js';
 import '../SEKD553P.js';
 import '../SWY4QT4I.js';
 import '../QSQZYJB6.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@layerzerolabs/common-canton",
-  "version": "1.2.61",
+  "version": "1.2.63",
   "private": false,
   "description": "Canton VM client and utilities",
   "license": "MIT",
@@ -37,10 +37,10 @@
     "@protobuf-ts/runtime-rpc": "^2.11.1",
     "es-toolkit": "^1.39.10",
     "zod": "4.3.5",
-    "@layerzerolabs/common-chain-model": "1.2.61",
-    "@layerzerolabs/common-encoding-utils": "1.2.61",
-    "@layerzerolabs/typescript-utils": "1.2.61",
-    "@layerzerolabs/common-error-utils": "1.2.61"
+    "@layerzerolabs/common-chain-model": "1.2.63",
+    "@layerzerolabs/common-error-utils": "1.2.63",
+    "@layerzerolabs/common-encoding-utils": "1.2.63",
+    "@layerzerolabs/typescript-utils": "1.2.63"
   },
   "devDependencies": {
     "@vitest/coverage-v8": "4.1.10",
@@ -48,11 +48,11 @@
     "tsup": "^8.4.0",
     "typescript": "^6.0.3",
     "vitest": "^4.1.10",
-    "@layerzerolabs/eslint-configuration": "^1.2.61",
-    "@layerzerolabs/tsup-configuration": "1.2.61",
-    "@layerzerolabs/typescript-configuration": "1.2.61",
-    "@layerzerolabs/vm-tooling-canton": "1.2.61",
-    "@layerzerolabs/vitest-configuration": "1.2.61"
+    "@layerzerolabs/eslint-configuration": "^1.2.63",
+    "@layerzerolabs/tsup-configuration": "1.2.63",
+    "@layerzerolabs/typescript-configuration": "1.2.63",
+    "@layerzerolabs/vitest-configuration": "1.2.63",
+    "@layerzerolabs/vm-tooling-canton": "1.2.63"
   },
   "publishConfig": {
     "access": "public",

package/src/auth/local-token-provider.ts

@@ -74,7 +74,7 @@ export class LocalTokenProvider implements TokenProvider {
                 participantId: null,
                 applicationId: null,
                 actAs: this.#config.actAs,
-                readAs: [],
+                readAs: this.#config.actAs,
                 admin: this.#config.admin,
             },
         };

package/test/auth/local-token-provider.test.ts

@@ -38,7 +38,7 @@ describe('LocalTokenProvider', () => {
                 participantId: null,
                 applicationId: null,
                 actAs: ['party1::abc', 'party2::def'],
-                readAs: [],
+                readAs: ['party1::abc', 'party2::def'],
                 admin: true,
             },
         });

package/dist/SCEF7TLZ.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/auth/local-token-provider.ts"],"names":["DEFAULT_SECRET","DEFAULT_AUDIENCE","DEFAULT_EXPIRES_IN","BUFFER_SECONDS","base64UrlEncode","data","base64","Buffer","from","toString","replace","generateJwt","payload","secret","header","alg","typ","headerEncoded","JSON","stringify","payloadEncoded","signatureInput","signature","crypto","createHmac","update","digest","LocalTokenProvider","config","userId","actAs","audience","expiresIn","admin","getToken","nowSeconds","Math","floor","Date","now","sub","aud","iat","exp","ledgerId","participantId","applicationId","readAs","delayMs","setTimeout"],"mappings":";;;AAcA,IAAMA,cAAAA,GAAiB,QAAA;AACvB,IAAMC,gBAAAA,GAAmB,+BAAA;AACzB,IAAMC,kBAAAA,GAAqB,IAAA;AAC3B,IAAMC,cAAAA,GAAiB,EAAA;AAMvB,SAASC,gBAAgBC,IAAAA,EAAqB;AAC1C,EAAA,MAAMC,SAASC,MAAAA,CAAOC,IAAAA,CAAKH,IAAAA,CAAAA,CAAMI,SAAS,QAAA,CAAA;AAC1C,EAAA,OAAOH,MAAAA,CAAOI,OAAAA,CAAQ,KAAA,EAAO,GAAA,CAAA,CAAKA,OAAAA,CAAQ,KAAA,EAAO,GAAA,CAAA,CAAKA,OAAAA,CAAQ,IAAA,EAAM,EAAA,CAAA;AACxE;AAHSN,MAAAA,CAAAA,eAAAA,EAAAA,iBAAAA,CAAAA;AAKT,SAASO,WAAAA,CAAYC,SAAiBC,MAAAA,EAAc;AAChD,EAAA,MAAMC,MAAAA,GAAS;IAAEC,GAAAA,EAAK,OAAA;IAASC,GAAAA,EAAK;AAAM,GAAA;AAC1C,EAAA,MAAMC,aAAAA,GAAgBb,eAAAA,CAAgBc,IAAAA,CAAKC,SAAAA,CAAUL,MAAAA,CAAAA,CAAAA;AACrD,EAAA,MAAMM,cAAAA,GAAiBhB,eAAAA,CAAgBc,IAAAA,CAAKC,SAAAA,CAAUP,OAAAA,CAAAA,CAAAA;AACtD,EAAA,MAAMS,cAAAA,GAAiB,CAAA,EAAGJ,aAAAA,CAAAA,CAAAA,EAAiBG,cAAAA,CAAAA,CAAAA;AAC3C,EAAA,MAAME,SAAAA,GAAYC,OAAOC,UAAAA,CAAW,QAAA,EAAUX,MAAAA,CAAAA,CAAQY,MAAAA,CAAOJ,cAAAA,CAAAA,CAAgBK,MAAAA,EAAM;AACnF,EAAA,OAAO,GAAGT,aAAAA,CAAAA,CAAAA,EAAiBG,cAAAA,CAAAA,CAAAA,EAAkBhB,eAAAA,CAAgBkB,SAAAA,CAAAA,CAAAA,CAAAA;AACjE;AAPSX,MAAAA,CAAAA,WAAAA,EAAAA,aAAAA,CAAAA;AAgBF,IAAMgB,qBAAN,MAAMA;EA5Cb;;;AA6Ca,EAAA,OAAA;EACT,MAAA,GAAwB,IAAA;AAExB,EAAA,WAAA,CAAYC,MAAAA,EAAkC;AAC1C,IAAA,IAAA,CAAK,OAAA,GAAU;AACXC,MAAAA,MAAAA,EAAQD,MAAAA,CAAOC,MAAAA;AACfC,MAAAA,KAAAA,EAAOF,MAAAA,CAAOE,KAAAA;AACdjB,MAAAA,MAAAA,EAAQe,OAAOf,MAAAA,IAAUb,cAAAA;AACzB+B,MAAAA,QAAAA,EAAUH,OAAOG,QAAAA,IAAY9B,gBAAAA;AAC7B+B,MAAAA,SAAAA,EAAWJ,OAAOI,SAAAA,IAAa9B,kBAAAA;AAC/B+B,MAAAA,KAAAA,EAAOL,OAAOK,KAAAA,IAAS;AAC3B,KAAA;AACJ,EAAA;AAEA,EAAA,MAAMC,QAAAA,GAA4B;AAC9B,IAAA,IAAA,CAAK,MAAA,KAAW,KAAK,cAAA,EAAc;AACnC,IAAA,OAAO,IAAA,CAAK,MAAA;AAChB,EAAA;EAEA,cAAA,GAAc;AACV,IAAA,MAAMC,aAAaC,IAAAA,CAAKC,KAAAA,CAAMC,IAAAA,CAAKC,GAAAA,KAAQ,GAAA,CAAA;AAC3C,IAAA,MAAM3B,OAAAA,GAAU;AACZ4B,MAAAA,GAAAA,EAAK,KAAK,OAAA,CAAQX,MAAAA;AAClBY,MAAAA,GAAAA,EAAK,KAAK,OAAA,CAAQV,QAAAA;MAClBW,GAAAA,EAAKP,UAAAA;MACLQ,GAAAA,EAAKR,UAAAA,GAAa,KAAK,OAAA,CAAQH,SAAAA;MAC/B,6BAAA,EAA+B;QAC3BY,QAAAA,EAAU,IAAA;QACVC,aAAAA,EAAe,IAAA;QACfC,aAAAA,EAAe,IAAA;AACfhB,QAAAA,KAAAA,EAAO,KAAK,OAAA,CAAQA,KAAAA;AACpBiB,QAAAA,MAAAA,EAAQ,EAAA;AACRd,QAAAA,KAAAA,EAAO,KAAK,OAAA,CAAQA;AACxB;AACJ,KAAA;AACA,IAAA,MAAMe,OAAAA,GAAAA,CAAW,IAAA,CAAK,OAAA,CAAQhB,SAAAA,GAAY7B,cAAAA,IAAkB,GAAA;AAC5D8C,IAAAA,UAAAA,CAAW,MAAO,IAAA,CAAK,MAAA,GAAS,IAAA,EAAOD,OAAAA,CAAAA;AACvC,IAAA,OAAOrC,WAAAA,CAAYC,OAAAA,EAAS,IAAA,CAAK,OAAA,CAAQC,MAAM,CAAA;AACnD,EAAA;AACJ","file":"SCEF7TLZ.js","sourcesContent":["import crypto from 'node:crypto';\n\nimport type { TokenProvider } from './token-provider';\n\nexport interface LocalTokenProviderConfig {\n    userId: string;\n    actAs: string[];\n    secret?: string;\n    audience?: string;\n    /** Token lifetime in seconds. */\n    expiresIn?: number;\n    admin?: boolean;\n}\n\nconst DEFAULT_SECRET = 'unsafe';\nconst DEFAULT_AUDIENCE = 'https://canton.network.global';\nconst DEFAULT_EXPIRES_IN = 3600; // 1 hour\nconst BUFFER_SECONDS = 60;\n\n// ─────────────────────────────────────────────────────────────────────────────\n// JWT helpers (HMAC-SHA256, Canton \"unsafe\" mode)\n// ─────────────────────────────────────────────────────────────────────────────\n\nfunction base64UrlEncode(data: string | Buffer): string {\n    const base64 = Buffer.from(data).toString('base64');\n    return base64.replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=/g, '');\n}\n\nfunction generateJwt(payload: object, secret: string): string {\n    const header = { alg: 'HS256', typ: 'JWT' };\n    const headerEncoded = base64UrlEncode(JSON.stringify(header));\n    const payloadEncoded = base64UrlEncode(JSON.stringify(payload));\n    const signatureInput = `${headerEncoded}.${payloadEncoded}`;\n    const signature = crypto.createHmac('sha256', secret).update(signatureInput).digest();\n    return `${headerEncoded}.${payloadEncoded}.${base64UrlEncode(signature)}`;\n}\n\n/**\n * Token provider for local development and sandbox environments.\n *\n * Generates short-lived HMAC-SHA256 JWTs on the fly using the Canton\n * participant node's \"unsafe\" identity provider manager shared secret.\n * Tokens are cached in memory and regenerated automatically before expiry.\n */\nexport class LocalTokenProvider implements TokenProvider {\n    readonly #config: Required<LocalTokenProviderConfig>;\n    #token: string | null = null;\n\n    constructor(config: LocalTokenProviderConfig) {\n        this.#config = {\n            userId: config.userId,\n            actAs: config.actAs,\n            secret: config.secret ?? DEFAULT_SECRET,\n            audience: config.audience ?? DEFAULT_AUDIENCE,\n            expiresIn: config.expiresIn ?? DEFAULT_EXPIRES_IN,\n            admin: config.admin ?? true,\n        };\n    }\n\n    async getToken(): Promise<string> {\n        this.#token ??= this.#generateToken();\n        return this.#token;\n    }\n\n    #generateToken(): string {\n        const nowSeconds = Math.floor(Date.now() / 1000);\n        const payload = {\n            sub: this.#config.userId,\n            aud: this.#config.audience,\n            iat: nowSeconds,\n            exp: nowSeconds + this.#config.expiresIn,\n            'https://daml.com/ledger-api': {\n                ledgerId: null,\n                participantId: null,\n                applicationId: null,\n                actAs: this.#config.actAs,\n                readAs: [],\n                admin: this.#config.admin,\n            },\n        };\n        const delayMs = (this.#config.expiresIn - BUFFER_SECONDS) * 1000;\n        setTimeout(() => (this.#token = null), delayMs);\n        return generateJwt(payload, this.#config.secret);\n    }\n}\n"]}