@learncard/network-brain-service 3.18.0 → 3.19.1

package/src/helpers/share-link-maintenance/runtime.ts

@@ -0,0 +1,334 @@
+import type {
+    CleanupRunnerDependencies,
+    RecoveryRunnerDependencies,
+} from '../share-link-coordinator';
+import type { PruneShareViewReceiptsInput } from '../../accesslayer/share-link/types';
+import type { ShareContentClient } from '../share-content-client/types';
+import { createMaintenancePassBudget, resolveMaintenanceBudgetMs } from './budget';
+import { resolveShareLinkMaintenanceConfig } from './config';
+import { runShareLinkMaintenancePass } from './runner';
+import { safeLogMaintenance } from './telemetry';
+import type {
+    ShareLinkMaintenanceConfigResolution,
+    ShareLinkMaintenanceLogger,
+    ShareLinkMaintenanceRunSummary,
+} from './types';
+
+type MaintenanceClient = Pick<ShareContentClient, 'stat' | 'delete'>;
+
+type ResolvedRunnerDependencies = {
+    recoveryRepository: RecoveryRunnerDependencies['repository'];
+    cleanupRepository: CleanupRunnerDependencies['repository'];
+    pruneReceipts: (input: PruneShareViewReceiptsInput) => Promise<number>;
+    client: MaintenanceClient;
+};
+
+type DependencySetup =
+    | { status: 'ready'; dependencies: ResolvedRunnerDependencies }
+    | { status: 'failed' }
+    | { status: 'expired' };
+
+export type ShareLinkMaintenanceRuntime = {
+    /** Config outcome fixed at construction; never contains raw values. */
+    readonly resolution: ShareLinkMaintenanceConfigResolution;
+    runOnce: (options?: {
+        /**
+         * Live Lambda remaining-time source. A numeric value is accepted as a
+         * backward-compatible test seam; production passes the live
+         * `getRemainingTimeInMillis` callback.
+         */
+        remainingTimeMs?: number | (() => number);
+    }) => Promise<ShareLinkMaintenanceRunSummary>;
+};
+
+export type CreateShareLinkMaintenanceRuntimeOptions = {
+    rawEnvironment?: Record<string, unknown>;
+    logger?: ShareLinkMaintenanceLogger;
+    now?: () => Date;
+    monotonicNow?: () => number;
+    /** Test seam: resolve the transport client without dynamic imports. */
+    createClient?: (
+        config: Extract<ShareLinkMaintenanceConfigResolution, { status: 'enabled' }>['config']
+    ) => Promise<MaintenanceClient>;
+    /** Test seam: resolve the production repositories without loading Neo4j. */
+    createRepositories?: (
+        client: MaintenanceClient,
+        config: Extract<ShareLinkMaintenanceConfigResolution, { status: 'enabled' }>['config']
+    ) => Promise<{
+        recoveryRepository: RecoveryRunnerDependencies['repository'];
+        cleanupRepository: CleanupRunnerDependencies['repository'];
+        pruneReceipts: ResolvedRunnerDependencies['pruneReceipts'];
+    }>;
+};
+
+const inertSummary = (
+    status: 'disabled' | 'invalid_configuration',
+    categories: ShareLinkMaintenanceRunSummary['categories']
+): ShareLinkMaintenanceRunSummary => ({
+    status,
+    durationMs: 0,
+    budgetMs: 0,
+    recovery: null,
+    cleanup: null,
+    receiptPrune: null,
+    categories,
+});
+
+const deadlineSummary = (
+    budget: ReturnType<typeof createMaintenancePassBudget>
+): ShareLinkMaintenanceRunSummary => ({
+    status: 'deadline_exhausted',
+    durationMs: budget.elapsedMs(),
+    budgetMs: budget.configuredMs,
+    recovery: null,
+    cleanup: null,
+    receiptPrune: null,
+    categories: {},
+});
+
+const initializationFailedSummary = (): ShareLinkMaintenanceRunSummary => ({
+    status: 'initialization_failed',
+    durationMs: 0,
+    budgetMs: 0,
+    recovery: null,
+    cleanup: null,
+    receiptPrune: null,
+    categories: { share_link_maintenance_initialization_failed: 1 },
+});
+
+/** Sample a live remaining-time source once; fail closed on a bad value. */
+const sampleRemainingMs = (source: number | (() => number) | undefined): number | undefined => {
+    if (source === undefined) return undefined;
+
+    let value: unknown;
+
+    try {
+        value = typeof source === 'function' ? source() : source;
+    } catch {
+        // A throwing Lambda context must not start work; fail closed.
+        return 0;
+    }
+
+    if (typeof value !== 'number' || !Number.isFinite(value)) return 0;
+
+    return value;
+};
+
+/**
+ * Production composition for the share-link maintenance pass.
+ *
+ * Disabled or malformed configuration resolves to an inert runtime: `runOnce`
+ * returns a fixed summary and never constructs the client, signer, repositories
+ * or any graph/remote dependency. When enabled, composition is lazy on the first
+ * invocation and reuses the existing did:web signing adapter with an explicitly
+ * configured trusted origin/audience/opaque namespace. There is no unsigned or
+ * fresh-key path.
+ *
+ * The invocation budget starts BEFORE dependency initialization: a cold start
+ * consumes the same deadline as the work, and an already-exhausted invocation
+ * performs no dependency/signer/graph setup at all. A successful setup is cached;
+ * a failed or budget-aborted setup is cleared so the next cadence retries.
+ */
+export const createShareLinkMaintenanceRuntime = (
+    options: CreateShareLinkMaintenanceRuntimeOptions = {}
+): ShareLinkMaintenanceRuntime => {
+    const resolution = resolveShareLinkMaintenanceConfig(
+        options.rawEnvironment ?? (process.env as Record<string, unknown>)
+    );
+    const logger = options.logger ?? consoleLogger;
+
+    if (resolution.status === 'disabled') {
+        const summary = inertSummary('disabled', {});
+        return {
+            resolution,
+            runOnce: async () => {
+                safeLogMaintenance(logger, summary);
+
+                return summary;
+            },
+        };
+    }
+
+    if (resolution.status === 'invalid') {
+        const summary = inertSummary('invalid_configuration', {
+            share_link_maintenance_configuration_invalid: 1,
+        });
+        return {
+            resolution,
+            runOnce: async () => {
+                safeLogMaintenance(logger, summary);
+
+                return summary;
+            },
+        };
+    }
+
+    const { config } = resolution;
+    let cached: Promise<DependencySetup> | null = null;
+
+    const buildDependencies = async (
+        budget: ReturnType<typeof createMaintenancePassBudget>
+    ): Promise<DependencySetup> => {
+        try {
+            const client = options.createClient
+                ? await options.createClient(config)
+                : await buildRuntimeClient(config);
+
+            if (budget.exhausted()) return { status: 'expired' };
+
+            const repositories = options.createRepositories
+                ? await options.createRepositories(client, config)
+                : await buildRuntimeRepositories(client, config);
+
+            if (budget.exhausted()) return { status: 'expired' };
+
+            return { status: 'ready', dependencies: { client, ...repositories } };
+        } catch {
+            return { status: 'failed' };
+        }
+    };
+
+    const resolveDependencies = async (
+        budget: ReturnType<typeof createMaintenancePassBudget>
+    ): Promise<DependencySetup> => {
+        if (!cached) {
+            const pending = buildDependencies(budget);
+            cached = pending;
+
+            const result = await pending;
+
+            // Keep a successful/in-flight setup cached; clear a failed or
+            // budget-aborted one so the next cadence can retry.
+            if (result.status !== 'ready' && cached === pending) cached = null;
+
+            return result;
+        }
+
+        return cached;
+    };
+
+    return {
+        resolution,
+        runOnce: async runOptions => {
+            const requestedRemaining = sampleRemainingMs(runOptions?.remainingTimeMs);
+            const budget = createMaintenancePassBudget({
+                budgetMs: resolveMaintenanceBudgetMs(config.budgetMs, requestedRemaining),
+                finalizeReserveMs: config.finalizeReserveMs,
+                monotonicNow: options.monotonicNow,
+            });
+
+            if (budget.exhausted()) {
+                const summary = deadlineSummary(budget);
+                safeLogMaintenance(logger, summary);
+
+                return summary;
+            }
+
+            const setup = await resolveDependencies(budget);
+
+            if (setup.status === 'failed') {
+                const summary = initializationFailedSummary();
+                safeLogMaintenance(logger, summary);
+
+                return summary;
+            }
+
+            if (setup.status === 'expired' || budget.exhausted()) {
+                const summary = deadlineSummary(budget);
+                safeLogMaintenance(logger, summary);
+
+                return summary;
+            }
+
+            return runShareLinkMaintenancePass({
+                config,
+                recoveryRepository: setup.dependencies.recoveryRepository,
+                cleanupRepository: setup.dependencies.cleanupRepository,
+                pruneReceipts: setup.dependencies.pruneReceipts,
+                client: setup.dependencies.client,
+                logger,
+                monotonicNow: options.monotonicNow,
+                now: options.now,
+                budget,
+            });
+        },
+    };
+};
+
+/** Lazy production transport: loads the did:web signer only when enabled. */
+const buildRuntimeClient = async (
+    config: Extract<ShareLinkMaintenanceConfigResolution, { status: 'enabled' }>['config']
+): Promise<MaintenanceClient> => {
+    const [{ getServerDidWebDID }, { createDidWebLearnCardTokenSigner }, clientModule] =
+        await Promise.all([
+            import('../learnCard.helpers'),
+            import('../share-content-client/adapters'),
+            import('../share-content-client'),
+        ]);
+
+    const signerDid = getServerDidWebDID();
+    const clientConfig = clientModule.resolveShareContentClientConfig({
+        enabled: true,
+        origin: config.origin,
+        namespace: config.namespace,
+        audience: config.audience,
+        signerDid,
+        allowInsecureLoopback: config.allowInsecureLoopback,
+        signer: createDidWebLearnCardTokenSigner(),
+        requestTimeoutMs: config.requestTimeoutMs,
+        // Maintenance is one bounded attempt per unit; the scheduler/cadence owns
+        // retry, so a transient failure is re-queued rather than retried inline.
+        maxAttempts: 1,
+        retryBackoffMs: 0,
+    });
+
+    if (!clientConfig.enabled) {
+        throw new Error('share-link maintenance client configuration was rejected');
+    }
+
+    return clientModule.createShareContentClient(clientConfig);
+};
+
+/** Lazy production repositories: imports the Neo4j-backed wiring only when enabled. */
+const buildRuntimeRepositories = async (
+    client: MaintenanceClient,
+    config: Extract<ShareLinkMaintenanceConfigResolution, { status: 'enabled' }>['config']
+): Promise<{
+    recoveryRepository: RecoveryRunnerDependencies['repository'];
+    cleanupRepository: CleanupRunnerDependencies['repository'];
+    pruneReceipts: ResolvedRunnerDependencies['pruneReceipts'];
+}> => {
+    const runtimeModule = await import('../share-link-coordinator/runtime');
+
+    const recoveryDependencies = runtimeModule.createRuntimeRecoveryRunnerDependencies({
+        client,
+        claimant: config.claimant,
+        namespace: config.namespace,
+    });
+    const cleanupDependencies = runtimeModule.createRuntimeCleanupRunnerDependencies({
+        client,
+        claimant: config.claimant,
+        namespace: config.namespace,
+    });
+
+    // Preinitialize the idempotent share-link constraint/index gate once, outside
+    // the per-unit budget, so a maintenance transaction never pays the one-time
+    // schema setup. It is cached in-process and is not a per-pass cost.
+    const { ensureShareLinkConstraints } = await import('../../models/share-link-constraints');
+    await ensureShareLinkConstraints();
+
+    // Load the receipt-prune repository last: it pulls the Neo4j `@instance`, so
+    // it must only be imported when an enabled runtime actually composes work.
+    const { pruneShareViewReceipts } = await import('../../accesslayer/share-link/receipt');
+
+    return {
+        recoveryRepository: recoveryDependencies.repository,
+        cleanupRepository: cleanupDependencies.repository,
+        pruneReceipts: pruneShareViewReceipts,
+    };
+};
+
+const consoleLogger: ShareLinkMaintenanceLogger = {
+    info: event => console.log('[share-link-maintenance]', event),
+    error: event => console.error('[share-link-maintenance]', event),
+};

package/src/helpers/share-link-maintenance/scheduler.ts

@@ -0,0 +1,126 @@
+import { safeLogMaintenance } from './telemetry';
+import type { ShareLinkMaintenanceLogger, ShareLinkMaintenanceRunSummary } from './types';
+
+export type ShareLinkMaintenanceSchedulerDependencies = {
+    runOnce: (options?: { remainingTimeMs?: number }) => Promise<unknown>;
+    intervalMs: number;
+    logger: ShareLinkMaintenanceLogger;
+    setTimeoutFn?: (handler: () => void, timeoutMs: number) => unknown;
+    clearTimeoutFn?: (handle: unknown) => void;
+};
+
+export type ShareLinkMaintenanceScheduler = {
+    /** Idempotent; schedules the first bounded pass one interval from now. */
+    start: () => void;
+    /** Stops scheduling and drains an in-flight pass. */
+    stop: () => Promise<void>;
+    /** Runs one pass now, coalescing with an in-flight pass (no overlap). */
+    trigger: () => Promise<void>;
+    isRunning: () => boolean;
+};
+
+const defaultSetTimeout = (handler: () => void, timeoutMs: number): unknown =>
+    setTimeout(handler, timeoutMs);
+
+const defaultClearTimeout = (handle: unknown): void => {
+    clearTimeout(handle as ReturnType<typeof setTimeout>);
+};
+
+const fixedFailureSummary = (intervalMs: number): ShareLinkMaintenanceRunSummary => ({
+    status: 'failed',
+    durationMs: 0,
+    budgetMs: intervalMs,
+    recovery: null,
+    cleanup: null,
+    receiptPrune: null,
+    categories: { share_link_maintenance_pass_failed: 1 },
+});
+
+/**
+ * Non-overlapping maintenance loop.
+ *
+ * The next tick is scheduled only *after* the awaited pass settles, so a slow
+ * pass can never stack timers. `trigger` coalesces with an in-flight pass, which
+ * is the per-process overlap guard; other processes are fenced by the durable
+ * repository claims. `stop` is terminal: it clears the pending tick, awaits the
+ * in-flight pass, and rejects any later explicit trigger or already-queued timer
+ * callback. Nothing here registers a timer at module import, and a logger failure
+ * cannot corrupt the loop state.
+ */
+export const createShareLinkMaintenanceScheduler = (
+    dependencies: ShareLinkMaintenanceSchedulerDependencies
+): ShareLinkMaintenanceScheduler => {
+    const setTimeoutFn = dependencies.setTimeoutFn ?? defaultSetTimeout;
+    const clearTimeoutFn = dependencies.clearTimeoutFn ?? defaultClearTimeout;
+
+    let started = false;
+    let stopped = false;
+    let timer: unknown = null;
+    let inFlight: Promise<void> | null = null;
+
+    const scheduleNext = (): void => {
+        if (stopped || !started) return;
+
+        timer = setTimeoutFn(() => {
+            void tick();
+        }, dependencies.intervalMs);
+    };
+
+    const tick = async (): Promise<void> => {
+        await trigger();
+        scheduleNext();
+    };
+
+    const trigger = (): Promise<void> => {
+        // Stop is terminal: nothing, including an explicit trigger or an already
+        // queued timer callback, may start work after `stop()`.
+        if (stopped) return Promise.resolve();
+
+        if (inFlight) return inFlight;
+
+        // An `async` wrapper converts a synchronous `runOnce` throw into a
+        // rejected promise, and `.finally` always settles on a microtask, so the
+        // assignment below can never race the clearing callback and leave
+        // `inFlight` stuck on an already-settled promise.
+        const run = async (): Promise<void> => {
+            try {
+                await dependencies.runOnce();
+            } catch {
+                safeLogMaintenance(
+                    dependencies.logger,
+                    fixedFailureSummary(dependencies.intervalMs)
+                );
+            }
+        };
+
+        const pass = run().finally(() => {
+            if (inFlight === pass) inFlight = null;
+        });
+
+        inFlight = pass;
+
+        return pass;
+    };
+
+    return {
+        start: () => {
+            if (started || stopped) return;
+
+            started = true;
+            scheduleNext();
+        },
+        stop: async () => {
+            stopped = true;
+            started = false;
+
+            if (timer !== null) {
+                clearTimeoutFn(timer);
+                timer = null;
+            }
+
+            if (inFlight) await inFlight;
+        },
+        trigger,
+        isRunning: () => inFlight !== null,
+    };
+};

package/src/helpers/share-link-maintenance/telemetry.ts

@@ -0,0 +1,70 @@
+import type { CleanupRunSummary, ShareRecoveryRunSummary } from '../share-link-coordinator';
+import type {
+    ShareLinkMaintenanceLogEvent,
+    ShareLinkMaintenanceLogger,
+    ShareLinkMaintenanceRunSummary,
+} from './types';
+
+/**
+ * Fixed, allowlisted aggregate counters. This is the ONLY surface a maintenance
+ * log may contain: no object ref, share id, owner id, namespace value, title,
+ * note, URL, fragment, key, ciphertext, recovery blob or exception object.
+ */
+const recoveryCounts = (recovery: ShareRecoveryRunSummary | null): Record<string, number> => ({
+    recoveryDiscovered: recovery?.discovered ?? 0,
+    recoveryClaimed: recovery?.claimed ?? 0,
+    recoveryFinalized: recovery?.finalized ?? 0,
+    recoveryAbandoned: recovery?.abandoned ?? 0,
+    recoveryDeferred: recovery?.deferred ?? 0,
+    recoveryClaimLost: recovery?.claimLost ?? 0,
+    recoveryAnomalies: recovery?.anomalies ?? 0,
+});
+
+const cleanupCounts = (cleanup: CleanupRunSummary | null): Record<string, number> => ({
+    cleanupClaimed: cleanup?.claimed ?? 0,
+    cleanupCompleted: cleanup?.completed ?? 0,
+    cleanupRetried: cleanup?.retried ?? 0,
+    cleanupClaimLost: cleanup?.claimLost ?? 0,
+    cleanupSkipped: cleanup?.skipped ?? 0,
+});
+
+export const toMaintenanceLogEvent = (
+    summary: ShareLinkMaintenanceRunSummary
+): ShareLinkMaintenanceLogEvent => ({
+    event: 'share_link_maintenance',
+    status: summary.status,
+    durationMs: Math.max(0, Math.trunc(summary.durationMs)),
+    budgetMs: Math.max(0, Math.trunc(summary.budgetMs)),
+    counts: {
+        ...recoveryCounts(summary.recovery),
+        ...cleanupCounts(summary.cleanup),
+        receiptsPruned: summary.receiptPrune?.pruned ?? 0,
+    },
+    categories: {
+        ...(summary.recovery?.categories ?? {}),
+        ...(summary.cleanup?.categories ?? {}),
+        ...summary.categories,
+    },
+});
+
+/**
+ * Emit one allowlisted event. A throwing logger is swallowed: telemetry must
+ * never corrupt lifecycle state or turn a completed pass into a failure.
+ */
+export const safeLogMaintenance = (
+    logger: ShareLinkMaintenanceLogger,
+    summary: ShareLinkMaintenanceRunSummary
+): void => {
+    try {
+        const event = toMaintenanceLogEvent(summary);
+        if (summary.status === 'failed') logger.error(event);
+        else logger.info(event);
+    } catch {
+        // Intentionally ignored: lifecycle state is authoritative.
+    }
+};
+
+export const createConsoleMaintenanceLogger = (): ShareLinkMaintenanceLogger => ({
+    info: event => console.log('[share-link-maintenance]', event),
+    error: event => console.error('[share-link-maintenance]', event),
+});

package/src/helpers/share-link-maintenance/types.ts

@@ -0,0 +1,89 @@
+import type { ShareRecoveryRunSummary, CleanupRunSummary } from '../share-link-coordinator';
+
+/**
+ * LC-2187 share-link maintenance (scheduling + cleanup integration).
+ *
+ * This module owns the automatically configured, namespace-scoped maintenance pass. It
+ * is deliberately separate from the coordinator barrel so unit tests never load
+ * the Neo4j `@instance` or the LearnCard signing graph.
+ */
+
+/** A fully validated, enabled maintenance configuration. */
+export type ShareLinkMaintenanceConfig = {
+    namespace: string;
+    origin: string;
+    audience: string;
+    allowInsecureLoopback: boolean;
+    claimant: string;
+    recoveryLimit: number;
+    cleanupLimit: number;
+    receiptPruneLimit: number;
+    leaseMs: number;
+    claimMs: number;
+    budgetMs: number;
+    intervalMs: number;
+    requestTimeoutMs: number;
+    finalizeReserveMs: number;
+    graphTimeoutMs: number;
+};
+
+/**
+ * Fixed, non-sensitive configuration outcome. `invalid` never carries the bad
+ * value or an exception, so it is safe to log verbatim.
+ */
+export type ShareLinkMaintenanceConfigResolution =
+    | { status: 'enabled'; config: ShareLinkMaintenanceConfig }
+    | { status: 'disabled' }
+    | { status: 'invalid'; category: 'share_link_maintenance_configuration_invalid' };
+
+/** Fixed pass status. Never carries request/record data. */
+export type ShareLinkMaintenanceStatus =
+    | 'disabled'
+    | 'invalid_configuration'
+    | 'initialization_failed'
+    | 'completed'
+    | 'deadline_exhausted'
+    | 'failed';
+
+/** Fixed failure categories allowed in a maintenance summary/log. */
+export type ShareLinkMaintenanceFailureCategory =
+    | 'share_link_maintenance_pass_failed'
+    | 'share_link_maintenance_recovery_failed'
+    | 'share_link_maintenance_cleanup_failed'
+    | 'share_link_maintenance_receipt_prune_failed'
+    | 'share_link_maintenance_initialization_failed'
+    | 'share_link_maintenance_configuration_invalid';
+
+/**
+ * Aggregate-only result of one maintenance invocation. It contains counts,
+ * durations and fixed categories; it never contains object/share/owner ids,
+ * URLs, keys, ciphertext, recovery, titles, notes or exception objects.
+ */
+export type ShareLinkMaintenanceRunSummary = {
+    status: ShareLinkMaintenanceStatus;
+    durationMs: number;
+    budgetMs: number;
+    recovery: ShareRecoveryRunSummary | null;
+    cleanup: CleanupRunSummary | null;
+    /** Namespace-scoped expired/consumed receipt nodes deleted this pass. */
+    receiptPrune: { pruned: number } | null;
+    categories: Partial<Record<ShareLinkMaintenanceFailureCategory, number>>;
+};
+
+/**
+ * Allowlisted log event shape. The logger is called with this object only; a
+ * throwing logger must never corrupt lifecycle state.
+ */
+export type ShareLinkMaintenanceLogEvent = {
+    event: 'share_link_maintenance';
+    status: ShareLinkMaintenanceStatus;
+    durationMs: number;
+    budgetMs: number;
+    counts: Record<string, number>;
+    categories: Record<string, number>;
+};
+
+export type ShareLinkMaintenanceLogger = {
+    info: (event: ShareLinkMaintenanceLogEvent) => void;
+    error: (event: ShareLinkMaintenanceLogEvent) => void;
+};

package/src/helpers/share-link-owner/config.ts

@@ -0,0 +1,48 @@
+import {
+    hasShareLinkServiceTransportConfig,
+    resolveShareLinkServiceTransportConfig,
+} from '../share-link-maintenance/config';
+
+/**
+ * Available automatically once trusted service configuration is complete.
+ * Namespace, origin and audience come only from server configuration. Missing
+ * wiring is inactive; partial or invalid wiring fails closed.
+ */
+
+export const SHARE_LINK_OWNER_API_ENV = {
+    NAMESPACE: 'SHARE_LINK_OWNER_API_NAMESPACE',
+} as const;
+
+export type ShareLinkOwnerApiConfigResolution =
+    | { status: 'disabled' }
+    | { status: 'invalid' }
+    | {
+          status: 'enabled';
+          namespace: string;
+          origin: string;
+          audience: string;
+          allowInsecureLoopback: boolean;
+      };
+
+export const resolveShareLinkOwnerApiConfig = (raw: unknown): ShareLinkOwnerApiConfigResolution => {
+    if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) return { status: 'invalid' };
+
+    const source = raw as Record<string, unknown>;
+    if (!hasShareLinkServiceTransportConfig(source)) return { status: 'disabled' };
+
+    const transport = resolveShareLinkServiceTransportConfig(source);
+    if (transport.status !== 'enabled') return { status: 'invalid' };
+
+    const ownerNamespace = source[SHARE_LINK_OWNER_API_ENV.NAMESPACE];
+    if (ownerNamespace !== undefined && ownerNamespace !== transport.config.namespace) {
+        return { status: 'invalid' };
+    }
+
+    return {
+        status: 'enabled',
+        namespace: transport.config.namespace,
+        origin: transport.config.origin,
+        audience: transport.config.audience,
+        allowInsecureLoopback: transport.config.allowInsecureLoopback,
+    };
+};