@ontemper/sdk 0.5.0 → 0.6.0-pr-7774.1

package/dist/As2.js

@@ -0,0 +1,708 @@
+import { Config, Context, Duration, Effect, Layer, Option, Predicate, Redacted, Schema, Stream } from 'effect';
+import { FetchHttpClient, HttpClient, HttpClientError, HttpClientRequest, HttpServerResponse, } from 'effect/http';
+import { isPublicDestination, lookupAllAddresses } from './As2Destination.js';
+import { As2Error } from './As2Error.js';
+import { As2IdentityResource, As2PartnerResource } from './As2Resource.js';
+import { isTransientStatus } from './EdiError.js';
+import { Invocation } from './Invocation.js';
+import { CurrentLogContext, TRACE_HEADER, withSpanLines } from './LogContext.js';
+import { registerSecrets } from './Redaction.js';
+export { As2Error } from './As2Error.js';
+export { As2Route } from './As2Route.js';
+export { As2IdentityResource, As2PartnerResource } from './As2Resource.js';
+/** The route an async receipt is posted to, under the sending workflow's own URL. */
+export const AS2_ASYNC_RECEIPT_PATH = '/as2/mdn';
+/** RFC 2045 quoted-string unquote for AS2-From and AS2-To: a bare token passes through. */
+export const unquoteAs2Id = (value) => {
+    const trimmed = (value ?? '').trim();
+    if (trimmed.length < 2 || !trimmed.startsWith('"') || !trimmed.endsWith('"'))
+        return trimmed;
+    return trimmed.slice(1, -1).replace(/\\(.)/g, '$1');
+};
+/** Runs `effect` on the exchange's verified trace; with none, on the current one. */
+export const withExchangeTrace = (customerTraceId) => (effect) => customerTraceId === null
+    ? effect
+    : Effect.withFiber((fiber) => Effect.provideService(effect, CurrentLogContext, {
+        ...fiber.getRef(CurrentLogContext),
+        traceId: customerTraceId,
+    }));
+// Must stay in lockstep with AS2_HEADER_NAMES in apps/api/src/Platform/As2/Domain.ts; scripts/check-sdk-consistency.ts pins the sets.
+const AS2_HEADERS = new Set([
+    'as2-from',
+    'as2-to',
+    'as2-version',
+    'content-transfer-encoding',
+    'content-type',
+    'disposition-notification-options',
+    'disposition-notification-to',
+    'message-id',
+    'mime-version',
+    'receipt-delivery-option',
+    'subject',
+]);
+/** Inbound headers are untrusted and may carry credentials: only protocol headers reach the platform. */
+const protocolHeaders = (headers) => Object.fromEntries(Object.entries(headers).flatMap(([name, value]) => value !== undefined && AS2_HEADERS.has(name.toLowerCase()) ? [[name.toLowerCase(), value]] : []));
+const headerOf = (headers, name) => Object.entries(headers).find(([key]) => key.toLowerCase() === name)?.[1];
+/** A partner's largest legitimate answer is a signed MDN of some KiB; a gateway that streams more fails the delivery. */
+const MAX_PARTNER_RESPONSE_BYTES = 8 * 1024 * 1024;
+/** ENGINE_BUSY answers 503 before any work, so a bounded retry is safe; every AS2 call is idempotent. */
+const CAPACITY_RETRIES = 3;
+const CAPACITY_BACKOFF_MS = 500;
+const HeaderMap = Schema.Record(Schema.String, Schema.String);
+const MdnMode = Schema.Literals(['sync', 'async']);
+const ReceiveAnswer = Schema.Union([
+    Schema.Struct({
+        kind: Schema.Literal('received'),
+        messageId: Schema.String,
+        payloadB64: Schema.String,
+        payloadContentType: Schema.NullOr(Schema.String),
+        mic: Schema.String,
+        deliveryToken: Schema.String,
+        mdnMode: MdnMode,
+        customerTraceId: Schema.NullOr(Schema.String),
+    }),
+    Schema.Struct({
+        kind: Schema.Literal('duplicate'),
+        messageId: Schema.String,
+        mic: Schema.String,
+        mdnHeaders: Schema.NullOr(HeaderMap),
+        mdnBodyB64: Schema.NullOr(Schema.String),
+        mdnMode: MdnMode,
+        mdnDeliveryUrl: Schema.NullOr(Schema.String),
+        customerTraceId: Schema.NullOr(Schema.String),
+    }),
+    Schema.Struct({ kind: Schema.Literal('inFlight'), messageId: Schema.String }),
+    Schema.Struct({ kind: Schema.Literal('parked'), messageId: Schema.String }),
+]);
+const AcknowledgeAnswer = Schema.Struct({
+    messageId: Schema.String,
+    mic: Schema.String,
+    mdnHeaders: Schema.NullOr(HeaderMap),
+    mdnBodyB64: Schema.NullOr(Schema.String),
+    mdnMode: MdnMode,
+    mdnDeliveryUrl: Schema.NullOr(Schema.String),
+    alreadyAcknowledged: Schema.Boolean,
+    customerTraceId: Schema.NullOr(Schema.String),
+});
+const PackAnswer = Schema.Struct({
+    messageId: Schema.String,
+    as2Headers: HeaderMap,
+    envelopeBodyB64: Schema.String,
+    mic: Schema.String,
+    partnerUrl: Schema.NullOr(Schema.String),
+    mdnMode: Schema.Literals(['none', 'sync', 'async']),
+    replayed: Schema.Boolean,
+    customerTraceId: Schema.NullOr(Schema.String),
+});
+const ConfirmAnswer = Schema.Struct({
+    outcome: Schema.Literals(['confirmed', 'failed']),
+    messageId: Schema.String,
+    disposition: Schema.NullOr(Schema.String),
+    receivedMic: Schema.NullOr(Schema.String),
+    packMic: Schema.NullOr(Schema.String),
+    micMatched: Schema.Boolean,
+    originatingTraceId: Schema.NullOr(Schema.String),
+});
+const SettleAnswer = Schema.Struct({
+    outcome: Schema.Literal('confirmed'),
+    messageId: Schema.String,
+    customerTraceId: Schema.NullOr(Schema.String),
+});
+const ErrorAnswer = Schema.Struct({
+    error: Schema.Struct({ code: Schema.String, message: Schema.String }),
+});
+const Settings = Config.all({
+    apiUrl: Config.option(Config.String('UNNBOUND_API_URL')),
+    // Hosts other than Firecracker pass no Run token; their workflow token is in the environment.
+    envToken: Config.option(Config.Redacted('TEMPER_RUN_TOKEN')),
+    sandboxToken: Config.option(Config.Redacted('UNNBOUND_SANDBOX_JWT')),
+    workflowUrl: Config.option(Config.String('UNNBOUND_WORKFLOW_URL')),
+});
+const present = (token) => Option.filter(token, (value) => Redacted.value(value).length > 0);
+const toBase64 = (bytes) => Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength).toString('base64');
+const fromBase64 = (text) => new Uint8Array(Buffer.from(text, 'base64'));
+const bytesOf = (value) => Predicate.isString(value) ? new TextEncoder().encode(value) : value;
+const keyPairSecrets = (slots) => [
+    slots.privateKey,
+    slots.secondaryPrivateKey,
+];
+const tlsSecrets = (tls) => [
+    tls?.clientKey,
+    tls?.clientKeyPassphrase,
+];
+/** Every secret field of the two records: the wire carries them in clear, so each becomes a log mask first. */
+const secretsOf = ({ partner, identity }) => [
+    ...(identity.keys.mode === 'combined'
+        ? keyPairSecrets(identity.keys)
+        : [...keyPairSecrets(identity.keys.signing), ...keyPairSecrets(identity.keys.encryption)]),
+    partner.httpAuth.type === 'basic' ? partner.httpAuth.password : undefined,
+    ...tlsSecrets(partner.tls),
+    partner.proxy?.auth.type === 'basic' ? partner.proxy.auth.password : undefined,
+    ...tlsSecrets(partner.proxy?.tls),
+].flatMap((secret) => (secret === undefined ? [] : [Redacted.value(secret)]));
+const partiesOf = (operation, options) => Effect.gen(function* () {
+    const identity = options.identity ?? options.partner.identity;
+    // The decoded record always carries one; a hand-built value may not.
+    if (!Predicate.isObject(identity)) {
+        return yield* new As2Error({
+            operation,
+            code: 'NOT_CONFIGURED',
+            retryable: false,
+            message: 'An AS2 identity is required: pass one, or resolve a partner record that references one.',
+        });
+    }
+    return { partner: options.partner, identity };
+});
+/** The platform wants the partner without its inlined identity, and the identity beside it. */
+const wireParties = ({ partner, identity }) => Effect.gen(function* () {
+    yield* registerSecrets(secretsOf({ partner, identity }));
+    const { identity: _inlined, ...wirePartner } = Schema.encodeSync(As2PartnerResource)(partner);
+    return { partner: wirePartner, identity: Schema.encodeSync(As2IdentityResource)(identity) };
+});
+const isHttpUrl = (value) => {
+    if (!URL.canParse(value))
+        return false;
+    const protocol = new URL(value).protocol;
+    return protocol === 'http:' || protocol === 'https:';
+};
+// Userinfo, query, and fragment can carry credentials, so they never reach a log line.
+const endpointOf = (url) => {
+    if (!isHttpUrl(url))
+        return {};
+    const parsed = new URL(url);
+    const scheme = parsed.protocol === 'https:' ? 'https' : 'http';
+    const port = parsed.port !== '' ? Number(parsed.port) : scheme === 'https' ? 443 : 80;
+    return { host: parsed.host, url: `${parsed.protocol}//${parsed.hostname}:${port}${parsed.pathname}`, scheme, port };
+};
+// A partner-chosen async-MDN URL can carry a credential in its path, so only its origin is logged.
+const originOf = (url) => {
+    const endpoint = endpointOf(url);
+    if (endpoint.scheme === undefined)
+        return {};
+    return { ...endpoint, url: `${endpoint.scheme}://${new URL(url).hostname}:${endpoint.port}` };
+};
+const as2Line = (fields) => {
+    const as2 = {};
+    for (const [key, value] of Object.entries(fields))
+        if (value !== undefined)
+            as2[key] = value;
+    return { type: 'as2', as2 };
+};
+/** Answers each `As2Error` with the status a partner reads; every other failure passes through unchanged. */
+const answerAs2Failures = (effect) => Effect.catch(effect, (error) => error instanceof As2Error
+    ? Effect.succeed(as2FailureResponse(error))
+    : // SAFETY: the instanceof check above took every As2Error out of this branch.
+        Effect.fail(error));
+const isEmptyBody = (error) => HttpClientError.isHttpClientError(error) && error.reason._tag === 'EmptyBodyError';
+/** The outcome fields of a span's end line: none while it runs, else its outcome and, on failure, the error code. */
+const endOf = (outcome, success) => outcome === undefined
+    ? {}
+    : outcome.error === undefined
+        ? { outcome: success }
+        : { outcome: 'failed', errorCode: outcome.error instanceof As2Error ? outcome.error.code : 'UNKNOWN' };
+/** A fetch error can quote the URL, so a failure keeps only a symbolic code from its cause chain. */
+const symbolicCause = (error) => {
+    let current = error;
+    for (let depth = 0; depth < 8 && current !== undefined; depth++) {
+        const code = Predicate.hasProperty(current, 'code') ? current.code : undefined;
+        if (Predicate.isString(code) && /^[A-Z][A-Z0-9_]*$/.test(code))
+            return code;
+        current = current.cause instanceof Error ? current.cause : undefined;
+    }
+    return 'unknown';
+};
+const retryLater = () => HttpServerResponse.text('AS2 message is being processed; retry later', {
+    status: 503,
+    headers: { 'retry-after': '60' },
+});
+const receiptResponse = (mdnMode, mdn) => mdnMode === 'async' || mdn === null
+    ? HttpServerResponse.empty({ status: 200 })
+    : HttpServerResponse.uint8Array(mdn.body, {
+        status: 200,
+        headers: mdn.headers,
+        contentType: headerOf(mdn.headers, 'content-type'),
+    });
+const RETRYABLE_WIRE = [502, 503, 504];
+const PERMANENT_WIRE = [400, 413, 422];
+/** Legacy `as2Endpoint`: a partner decides whether to resend from the status, so it gets the status and a generic message. */
+export const as2FailureResponse = (error) => {
+    const status = error.status;
+    if (status !== undefined && RETRYABLE_WIRE.includes(status))
+        return HttpServerResponse.jsonUnsafe({ message: 'AS2 message could not be processed; retry later' }, { status });
+    if (status !== undefined && PERMANENT_WIRE.includes(status))
+        return HttpServerResponse.jsonUnsafe({ message: 'AS2 message was rejected and should not be resent' }, { status });
+    return HttpServerResponse.jsonUnsafe({ message: 'Internal server error' }, { status: 500 });
+};
+const makeAs2 = (lookupAddresses) => Effect.gen(function* () {
+    const client = yield* HttpClient.HttpClient;
+    const settings = (operation) => Settings.pipe(Effect.mapError((cause) => new As2Error({
+        operation,
+        code: 'NOT_CONFIGURED',
+        retryable: false,
+        message: `AS2 settings are unreadable: ${cause.message}`,
+    })));
+    /** One call to `/api/v2/internal/as2/<path>` with the Run token, retried while the engine answers 503. */
+    const platform = (operation, path, body, answer) => Effect.gen(function* () {
+        const config = yield* settings(operation);
+        const invocation = yield* Invocation;
+        const apiUrl = Option.filter(config.apiUrl, (url) => url.length > 0);
+        if (Option.isNone(apiUrl)) {
+            return yield* new As2Error({
+                operation,
+                code: 'NOT_CONFIGURED',
+                retryable: false,
+                message: 'UNNBOUND_API_URL is not set; the AS2 service is unreachable.',
+            });
+        }
+        const token = invocation.token.length > 0
+            ? Option.some(invocation.token)
+            : Option.orElse(present(config.envToken), () => present(config.sandboxToken));
+        if (Option.isNone(token)) {
+            return yield* new As2Error({
+                operation,
+                code: 'NOT_CONFIGURED',
+                retryable: false,
+                message: 'AS2 requires a Run token or a workflow-scoped sandbox token.',
+            });
+        }
+        const url = `${apiUrl.value.replace(/\/+$/u, '')}/api/v2/internal/as2/${path}`;
+        const request = HttpClientRequest.post(url).pipe(HttpClientRequest.bearerToken(token.value), HttpClientRequest.bodyJsonUnsafe(body));
+        for (let attempt = 0;; attempt++) {
+            const response = yield* client.execute(request).pipe(
+            // Bodies carry decrypted documents, envelopes, receipts, and delivery tokens; the AS2 lines tell the story.
+            Effect.provideService(HttpClient.TracerDisabledWhen, () => true), 
+            // A redirect must not carry the Run token or the body elsewhere.
+            Effect.provideService(FetchHttpClient.RequestInit, { redirect: 'error' }), Effect.mapError((cause) => new As2Error({
+                operation,
+                code: 'NETWORK_ERROR',
+                retryable: true,
+                message: `The AS2 service did not answer: ${symbolicCause(cause)}`,
+            })));
+            if (response.status === 503 && attempt < CAPACITY_RETRIES) {
+                const seconds = Number(response.headers['retry-after'] ?? Number.NaN);
+                const wait = Number.isFinite(seconds) && seconds >= 0
+                    ? Math.min(seconds, 30) * 1000
+                    : CAPACITY_BACKOFF_MS * (attempt + 1);
+                yield* Effect.ignore(response.text);
+                yield* Effect.sleep(Duration.millis(wait));
+                continue;
+            }
+            if (response.status < 200 || response.status >= 300) {
+                const status = response.status;
+                const failure = yield* response.json.pipe(Effect.flatMap(Schema.decodeUnknownEffect(ErrorAnswer)), Effect.map((body) => body.error), Effect.orElseSucceed(() => undefined));
+                return yield* new As2Error({
+                    operation,
+                    code: failure?.code ?? (status === 401 || status === 403 ? 'UNAUTHORIZED' : 'API_ERROR'),
+                    retryable: isTransientStatus(status),
+                    status,
+                    message: failure?.message ?? `The AS2 service answered HTTP ${status}.`,
+                });
+            }
+            return yield* response.json.pipe(Effect.flatMap(Schema.decodeUnknownEffect(answer)), Effect.mapError(() => new As2Error({
+                operation,
+                code: 'INVALID_API_RESPONSE',
+                retryable: false,
+                status: response.status,
+                message: 'The AS2 service answered an unexpected body.',
+            })));
+        }
+    });
+    const mdnOf = (headers, bodyB64, operation) => {
+        if (headers === null && bodyB64 === null)
+            return Effect.succeed(null);
+        if (headers === null || bodyB64 === null) {
+            return Effect.fail(new As2Error({
+                operation,
+                code: 'INVALID_API_RESPONSE',
+                retryable: false,
+                message: 'The AS2 service answered an incomplete MDN.',
+            }));
+        }
+        return Effect.succeed({ headers, body: fromBase64(bodyB64) });
+    };
+    /** One milestone line, on the exchange's trace when the ledger names one. */
+    const milestone = (message, fields, customerTraceId = null) => Effect.logInfo(message, as2Line(fields)).pipe(withExchangeTrace(customerTraceId));
+    const warn = (message, fields) => Effect.logWarning(message, as2Line({ ...fields, outcome: 'failed' }));
+    const acknowledge = (deliveryToken) => Effect.gen(function* () {
+        const answer = yield* platform('acknowledge', 'acknowledge', { deliveryToken }, AcknowledgeAnswer);
+        const mdn = yield* mdnOf(answer.mdnHeaders, answer.mdnBodyB64, 'acknowledge');
+        yield* milestone('AS2 MDN generated.', {
+            operation: 'mdn-generate',
+            messageId: answer.messageId,
+            mdnMode: answer.mdnMode,
+            outcome: 'generated',
+            replayed: answer.alreadyAcknowledged,
+            byteLength: mdn?.body.byteLength,
+        }, answer.customerTraceId);
+        return {
+            messageId: answer.messageId,
+            mic: answer.mic,
+            mdn,
+            mdnMode: answer.mdnMode,
+            mdnDeliveryUrl: answer.mdnDeliveryUrl,
+            alreadyAcknowledged: answer.alreadyAcknowledged,
+            customerTraceId: answer.customerTraceId,
+            response: receiptResponse(answer.mdnMode, mdn),
+        };
+    }).pipe(Effect.tapError((error) => warn('AS2 acknowledgement failed.', { operation: 'mdn-generate', errorCode: error.code })));
+    const readRequest = (operation, request) => request.arrayBuffer.pipe(Effect.map((buffer) => new Uint8Array(buffer)), Effect.mapError(() => new As2Error({
+        operation,
+        code: 'BAD_REQUEST',
+        retryable: false,
+        status: 400,
+        message: 'The request body could not be read.',
+    })));
+    const receive = (options) => Effect.gen(function* () {
+        const headers = options.request.headers;
+        const proto = headers['x-forwarded-proto']?.split(',')[0]?.trim().toLowerCase();
+        const transportScheme = proto === 'http' || proto === 'https' ? proto : undefined;
+        const body = yield* readRequest('receive', options.request);
+        const fields = {
+            operation: 'receive',
+            scheme: transportScheme,
+            port: transportScheme === undefined ? undefined : transportScheme === 'https' ? 443 : 80,
+            clientIp: headers['x-forwarded-for']?.split(',')[0]?.trim(),
+            as2From: headers['as2-from'],
+            as2To: headers['as2-to'],
+            partner: options.partner.as2Id,
+            byteLength: body.byteLength,
+        };
+        const answer = yield* Effect.gen(function* () {
+            const parties = yield* wireParties(yield* partiesOf('receive', options));
+            return yield* platform('receive', 'receive', { ...parties, headers: protocolHeaders(headers), transportScheme, bodyB64: toBase64(body) }, ReceiveAnswer);
+        }).pipe(Effect.tapError((error) => warn('AS2 receive failed.', { ...fields, errorCode: error.code })));
+        if (answer.kind === 'inFlight' || answer.kind === 'parked') {
+            yield* milestone(answer.kind === 'inFlight' ? 'AS2 message already processing.' : 'AS2 message parked.', {
+                ...fields,
+                messageId: answer.messageId,
+                outcome: answer.kind,
+            });
+            return { kind: answer.kind, messageId: answer.messageId, response: retryLater() };
+        }
+        if (answer.kind === 'duplicate') {
+            const mdn = yield* mdnOf(answer.mdnHeaders, answer.mdnBodyB64, 'receive');
+            yield* milestone('AS2 duplicate message answered.', { ...fields, messageId: answer.messageId, mdnMode: answer.mdnMode, outcome: 'duplicate' }, answer.customerTraceId);
+            return {
+                kind: 'duplicate',
+                messageId: answer.messageId,
+                mic: answer.mic,
+                mdn,
+                mdnMode: answer.mdnMode,
+                mdnDeliveryUrl: answer.mdnDeliveryUrl,
+                alreadyAcknowledged: true,
+                customerTraceId: answer.customerTraceId,
+                response: receiptResponse(answer.mdnMode, mdn),
+            };
+        }
+        yield* milestone('AS2 message received.', {
+            ...fields,
+            messageId: answer.messageId,
+            contentType: answer.payloadContentType ?? undefined,
+            mdnMode: answer.mdnMode,
+            outcome: 'received',
+        }, answer.customerTraceId);
+        return {
+            kind: 'received',
+            messageId: answer.messageId,
+            payload: fromBase64(answer.payloadB64),
+            contentType: answer.payloadContentType,
+            mic: answer.mic,
+            mdnMode: answer.mdnMode,
+            customerTraceId: answer.customerTraceId,
+            acknowledge: acknowledge(answer.deliveryToken),
+        };
+    });
+    const confirm = (options) => Effect.gen(function* () {
+        const mdn = options.mdn ?? {
+            headers: { ...options.request.headers },
+            body: yield* readRequest('confirm', options.request),
+        };
+        const answer = yield* Effect.gen(function* () {
+            const parties = yield* wireParties(yield* partiesOf('confirm', options));
+            return yield* platform('confirm', 'confirm', {
+                ...parties,
+                originalMessageId: options.originalMessageId ?? null,
+                mdnHeaders: protocolHeaders(mdn.headers),
+                mdnBodyB64: toBase64(mdn.body),
+            }, ConfirmAnswer);
+        }).pipe(Effect.tapError((error) => warn('AS2 MDN verification failed.', {
+            operation: 'mdn-verify',
+            originalMessageId: options.originalMessageId,
+            partner: options.partner.as2Id,
+            errorCode: error.code,
+        })));
+        // The current trace (an async callback's own) logs it, with a link to the sending trace; it never re-binds.
+        const line = as2Line({
+            operation: 'mdn-verify',
+            originalMessageId: answer.messageId,
+            partner: options.partner.as2Id,
+            outcome: answer.outcome,
+            disposition: answer.disposition ?? undefined,
+            micMatched: answer.micMatched,
+            originatingTraceId: answer.originatingTraceId ?? undefined,
+            byteLength: mdn.body.byteLength,
+        });
+        yield* answer.outcome === 'confirmed'
+            ? Effect.logInfo('AS2 MDN verified.', line)
+            : Effect.logWarning('AS2 MDN verified.', line);
+        return answer;
+    });
+    const deliveryFailure = (code, operation, cause) => new As2Error({ operation, code, retryable: true, message: `request failed: ${symbolicCause(cause)}` });
+    /** The partner's answer, read up to the cap; a longer answer fails the delivery. */
+    const readCapped = (response, operation, code) => Effect.gen(function* () {
+        const declared = Number(response.headers['content-length'] ?? Number.NaN);
+        const tooLarge = new As2Error({
+            operation,
+            code,
+            retryable: false,
+            status: response.status,
+            message: 'The partner answered more than 8 MiB.',
+        });
+        if (Number.isFinite(declared) && declared > MAX_PARTNER_RESPONSE_BYTES)
+            return yield* tooLarge;
+        const chunks = [];
+        let size = 0;
+        yield* Stream.runForEach(response.stream, (chunk) => {
+            size += chunk.byteLength;
+            chunks.push(chunk);
+            return size > MAX_PARTNER_RESPONSE_BYTES ? Effect.fail(tooLarge) : Effect.void;
+        }).pipe(
+        // A response without a body is an empty answer, such as an async partner's bare 200.
+        Effect.catchIf(isEmptyBody, () => Effect.void), Effect.mapError((cause) => (cause instanceof As2Error ? cause : deliveryFailure(code, operation, cause))));
+        const bytes = new Uint8Array(size);
+        let offset = 0;
+        for (const chunk of chunks) {
+            bytes.set(chunk, offset);
+            offset += chunk.byteLength;
+        }
+        return bytes;
+    });
+    const deliverMdn = (mdn, url) => {
+        let status;
+        const refuseMdn = (code, message) => Effect.fail(new As2Error({ operation: 'deliverMdn', code, retryable: false, message }));
+        return Effect.gen(function* () {
+            if (!isHttpUrl(url))
+                return yield* refuseMdn('MDN_DELIVERY_FAILED', 'The MDN destination is not an http(s) URL.');
+            const parsed = new URL(url);
+            if (parsed.username !== '' || parsed.password !== '')
+                return yield* refuseMdn('MDN_DELIVERY_FAILED', 'The MDN destination carries credentials.');
+            const allowed = yield* Effect.tryPromise({
+                try: () => isPublicDestination(parsed.hostname, lookupAddresses),
+                catch: (cause) => deliveryFailure('MDN_DELIVERY_FAILED', 'deliverMdn', cause instanceof Error ? cause : new Error('lookup failed')),
+            });
+            if (!allowed) {
+                return yield* refuseMdn('MDN_DESTINATION_BLOCKED', 'The MDN destination resolves to a private or reserved address.');
+            }
+            const response = yield* client
+                .execute(HttpClientRequest.post(url).pipe(HttpClientRequest.bodyUint8Array(mdn.body, headerOf(mdn.headers, 'content-type')), HttpClientRequest.setHeaders(mdn.headers)))
+                .pipe(Effect.provideService(HttpClient.TracerDisabledWhen, () => true), 
+            // The partner controls the URL; a redirect would send the POST where the destination check never looked.
+            Effect.provideService(FetchHttpClient.RequestInit, { redirect: 'manual' }), Effect.mapError((cause) => deliveryFailure('MDN_DELIVERY_FAILED', 'deliverMdn', cause)));
+            status = response.status;
+            yield* readCapped(response, 'deliverMdn', 'MDN_DELIVERY_FAILED');
+            if (response.status < 200 || response.status >= 300) {
+                return yield* new As2Error({
+                    operation: 'deliverMdn',
+                    code: 'MDN_DELIVERY_FAILED',
+                    retryable: isTransientStatus(response.status),
+                    status: response.status,
+                    message: `The partner answered HTTP ${response.status}.`,
+                });
+            }
+        }).pipe(withSpanLines('AS2 MDN delivery', (outcome) => as2Line({
+            operation: 'mdn-deliver',
+            ...originOf(url),
+            as2From: headerOf(mdn.headers, 'as2-from'),
+            as2To: headerOf(mdn.headers, 'as2-to'),
+            byteLength: mdn.body.byteLength,
+            status,
+            ...endOf(outcome, 'delivered'),
+        })), Effect.asVoid);
+    };
+    const refuse = (code, message) => Effect.fail(new As2Error({ operation: 'send', code, retryable: false, message }));
+    const hasTls = (tls) => tls !== undefined && Object.values(tls).some((value) => value !== undefined);
+    /** Checks that run before pack: pack records a pending message, so a refusal after it would strand that row. */
+    const checkDestination = (url, options) => Effect.gen(function* () {
+        const { partner } = options;
+        if (!isHttpUrl(url))
+            return yield* refuse('INVALID_PARTNER_URL', 'The partner URL must be an http(s) URL.');
+        const parsed = new URL(url);
+        if (parsed.username !== '' || parsed.password !== '')
+            return yield* refuse('INVALID_PARTNER_URL', 'The partner URL must not carry credentials.');
+        const basic = partner.httpAuth.type === 'basic';
+        const configured = partner.url;
+        if (options.url !== undefined &&
+            basic &&
+            (configured === undefined || parsed.origin !== new URL(configured).origin)) {
+            return yield* refuse('PARTNER_CREDENTIAL_ORIGIN_MISMATCH', 'Partner credentials go only to the origin of the partner URL.');
+        }
+        if (basic && parsed.protocol !== 'https:')
+            return yield* refuse('INSECURE_CREDENTIAL_TRANSPORT', 'HTTP Basic delivery auth requires an https:// partner URL.');
+        // The workflow fetch sends no client certificate, custom CA, SNI name, or proxy: refusing beats skipping them.
+        if (hasTls(partner.tls) || partner.proxy !== undefined) {
+            return yield* refuse('UNSUPPORTED_TRANSPORT', 'Partner TLS settings and proxies are not supported by @temper/workflow AS2 yet.');
+        }
+    });
+    const receiptUrlFor = (partner, options) => Effect.gen(function* () {
+        if (partner.receipt !== 'async')
+            return null;
+        if (options.receiptUrl !== undefined) {
+            if (!isHttpUrl(options.receiptUrl))
+                return yield* refuse('NOT_CONFIGURED', 'receiptUrl must be an http(s) URL.');
+            return options.receiptUrl;
+        }
+        const workflowUrl = Option.getOrUndefined((yield* settings('send')).workflowUrl)?.trim() ?? '';
+        // Partners reach workflows over HTTPS only, so a scheme-less value gets https://.
+        const href = /^https?:\/\//iu.test(workflowUrl) ? workflowUrl : `https://${workflowUrl}`;
+        if (workflowUrl === '' || !isHttpUrl(href)) {
+            return yield* refuse('NOT_CONFIGURED', 'The partner asks for async receipts, but neither receiptUrl nor UNNBOUND_WORKFLOW_URL is set.');
+        }
+        return `${href.replace(/\/+$/u, '')}${AS2_ASYNC_RECEIPT_PATH}`;
+    });
+    const deliver = (url, envelope, as2Headers, parties, messageId) => {
+        let status;
+        const auth = parties.partner.httpAuth;
+        return Effect.gen(function* () {
+            if (auth.type === 'basic')
+                yield* registerSecrets([Redacted.value(auth.password)]);
+            const response = yield* client
+                .execute(HttpClientRequest.post(url).pipe(HttpClientRequest.bodyUint8Array(envelope, headerOf(as2Headers, 'content-type')), HttpClientRequest.setHeaders(as2Headers), (request) => auth.type === 'basic'
+                ? HttpClientRequest.basicAuth(request, auth.username, Redacted.value(auth.password))
+                : request))
+                .pipe(Effect.provideService(HttpClient.TracerDisabledWhen, () => true), 
+            // AS2 endpoints are fixed, agreed URLs; a redirect would send the envelope where the partner's gateway chose.
+            Effect.provideService(FetchHttpClient.RequestInit, { redirect: 'manual' }), Effect.mapError((cause) => deliveryFailure('DELIVERY_FAILED', 'send', cause)));
+            status = response.status;
+            const body = yield* readCapped(response, 'send', 'DELIVERY_FAILED');
+            if (response.status < 200 || response.status >= 300) {
+                return yield* new As2Error({
+                    operation: 'send',
+                    code: 'DELIVERY_FAILED',
+                    retryable: isTransientStatus(response.status),
+                    status: response.status,
+                    message: `The partner answered HTTP ${response.status}.`,
+                });
+            }
+            return { headers: { ...response.headers }, body };
+        }).pipe(withSpanLines('AS2 delivery', (outcome) => as2Line({
+            operation: 'deliver',
+            messageId,
+            as2From: parties.identity.as2Id,
+            as2To: parties.partner.as2Id,
+            partner: parties.partner.as2Id,
+            ...endpointOf(url),
+            byteLength: envelope.byteLength,
+            attempt: 1,
+            status,
+            ...endOf(outcome, 'delivered'),
+        })));
+    };
+    const send = (payloadInput, options) => {
+        const payload = bytesOf(payloadInput);
+        const summary = {
+            operation: 'send',
+            partner: options.partner.as2Id,
+            as2To: options.partner.as2Id,
+            byteLength: payload.byteLength,
+            contentType: options.contentType,
+        };
+        return Effect.gen(function* () {
+            const intended = options.url ?? options.partner.url;
+            if (intended === undefined)
+                return yield* refuse('NO_PARTNER_URL', 'The partner record has no URL and the call passed none.');
+            Object.assign(summary, endpointOf(intended));
+            yield* checkDestination(intended, options);
+            const parties = yield* partiesOf('send', options);
+            summary.as2From = parties.identity.as2Id;
+            const receiptUrl = yield* receiptUrlFor(parties.partner, options);
+            const wire = yield* wireParties(parties);
+            const packed = yield* platform('send', 'pack', {
+                ...wire,
+                payloadB64: toBase64(payload),
+                payloadContentType: options.contentType,
+                subject: options.subject ?? null,
+                idempotencyKey: options.idempotencyKey ?? null,
+                receiptUrl,
+            }, PackAnswer);
+            const url = options.url ?? packed.partnerUrl ?? intended;
+            summary.messageId = packed.messageId;
+            summary.replayed = packed.replayed;
+            if (packed.mdnMode !== 'none')
+                summary.mdnMode = packed.mdnMode;
+            // On a replay the ledger names the first send's trace: a link from this trace, never a re-bind.
+            if (packed.replayed && packed.customerTraceId !== null)
+                summary.originatingTraceId = packed.customerTraceId;
+            Object.assign(summary, endpointOf(url));
+            const delivered = yield* deliver(url, fromBase64(packed.envelopeBodyB64), packed.as2Headers, parties, packed.messageId);
+            const result = (outcome, disposition, customerTraceId) => {
+                summary.outcome = outcome;
+                return {
+                    messageId: packed.messageId,
+                    mic: packed.mic,
+                    replayed: packed.replayed,
+                    outcome,
+                    disposition,
+                    customerTraceId,
+                };
+            };
+            if (packed.mdnMode === 'none') {
+                const settled = yield* platform('send', 'settle-delivery', { ...wire, messageId: packed.messageId }, SettleAnswer);
+                return result('confirmed', null, settled.customerTraceId);
+            }
+            if (!/multipart\/(signed|report)|pkcs7/iu.test(headerOf(delivered.headers, 'content-type') ?? '')) {
+                if (packed.mdnMode === 'sync') {
+                    return yield* new As2Error({
+                        operation: 'send',
+                        code: 'MDN_MISSING',
+                        retryable: false,
+                        message: 'The partner answered success without the synchronous MDN it owes.',
+                    });
+                }
+                return result('pending', null, packed.customerTraceId);
+            }
+            const confirmed = yield* confirm({
+                partner: options.partner,
+                identity: parties.identity,
+                originalMessageId: packed.messageId,
+                mdn: delivered,
+            }).pipe(Effect.mapError((error) => new As2Error({
+                operation: 'send',
+                code: error.code,
+                retryable: error.retryable,
+                status: error.status,
+                message: error.message,
+            })));
+            summary.disposition = confirmed.disposition ?? undefined;
+            summary.micMatched = confirmed.micMatched;
+            return result(confirmed.outcome, confirmed.disposition, packed.customerTraceId);
+        }).pipe(withSpanLines('AS2 send', (outcome) => as2Line(outcome?.error === undefined ? summary : { ...summary, ...endOf(outcome, undefined) })));
+    };
+    const inbound = (options, handle) => Effect.gen(function* () {
+        const partner = yield* options.partner(unquoteAs2Id(options.request.headers['as2-from']));
+        const received = yield* receive({ request: options.request, partner, identity: options.identity });
+        if (received.kind !== 'received' && received.kind !== 'duplicate')
+            return received.response;
+        const response = yield* Effect.gen(function* () {
+            const receipt = received.kind === 'received' ? yield* Effect.andThen(handle(received), received.acknowledge) : received;
+            if (receipt.mdnMode === 'async' && receipt.mdn !== null && receipt.mdnDeliveryUrl !== null)
+                yield* deliverMdn(receipt.mdn, receipt.mdnDeliveryUrl);
+            return receipt.response;
+        }).pipe(answerAs2Failures, withExchangeTrace(received.customerTraceId));
+        return received.customerTraceId === null
+            ? response
+            : HttpServerResponse.setHeader(response, TRACE_HEADER, received.customerTraceId);
+    }).pipe(
+    // Partner selection and verification fail before any exchange trace: the partner still reads the status.
+    answerAs2Failures);
+    return { receive, inbound, send, confirm, deliverMdn };
+});
+/**
+ * First-party AS2 on the workflow's `HttpClient`, logger, and Run token: `yield* As2` in a handler layer and
+ * provide `As2.layer`. All S/MIME crypto runs on the platform; the SDK carries bytes and records.
+ */
+export class As2 extends Context.Service()('@temper/workflow/As2') {
+    static layer = Layer.effect(As2, makeAs2(lookupAllAddresses));
+    /** `layer` with a replaced name lookup for the async-MDN destination check. */
+    static layerWith = (options) => Layer.effect(As2, makeAs2(options.lookupAddresses));
+}
+//# sourceMappingURL=As2.js.map