@opsimathically/nodenetproccalld 0.0.1

package/dist/index.d.ts

@@ -0,0 +1,246 @@
+import { privilege_name_t, networkprocedurecall_auth_callback_t, tls_min_version_t, networkprocedurecall_abuse_controls_t, networkprocedurecall_auth_success_t, networkprocedurecall_abuse_metrics_t } from '@opsimathically/networkprocedurecall';
+import { workerprocedurecall_constructor_params_t, start_workers_params_t } from '@opsimathically/workerprocedurecall';
+
+type daemon_tls_file_config_t = {
+  key_file: string;
+  cert_file: string;
+  ca_file: string;
+  crl_file?: string;
+  min_version?: tls_min_version_t;
+  cipher_suites?: string;
+  handshake_timeout_ms?: number;
+  request_timeout_ms?: number;
+  max_frame_bytes?: number;
+};
+
+type daemon_worker_config_t = {
+  count: number;
+  constructor_options?: workerprocedurecall_constructor_params_t;
+  start_options?: Omit<start_workers_params_t, 'count'>;
+};
+
+type daemon_observability_config_t = {
+  enable_console_log?: boolean;
+  log_worker_events?: boolean;
+  metrics_log_interval_ms?: number;
+};
+
+type daemon_server_config_file_t = {
+  information: {
+    server_name: string;
+  };
+  network: {
+    bind_addr: string;
+    tcp_listen_port: number;
+  };
+  tls_mtls: daemon_tls_file_config_t;
+  workerprocedurecall: daemon_worker_config_t;
+  abuse_controls?: networkprocedurecall_abuse_controls_t;
+  observability?: daemon_observability_config_t;
+};
+
+type daemon_api_key_identity_constraints_t = {
+  remote_address_regex?: string;
+  tls_peer_subject_regex?: string;
+  tls_peer_san_regex?: string;
+  tls_peer_fingerprint256_regex?: string;
+  tls_peer_serial_number_regex?: string;
+};
+
+type daemon_api_key_entry_t = {
+  key_id: string;
+  api_key: string;
+  privileges: privilege_name_t[];
+  enabled?: boolean;
+  identity_constraints?: daemon_api_key_identity_constraints_t;
+};
+
+type daemon_api_keys_config_file_t = {
+  api_keys: daemon_api_key_entry_t[];
+};
+
+type daemon_compiled_identity_constraints_t = {
+  remote_address_regex?: RegExp;
+  tls_peer_subject_regex?: RegExp;
+  tls_peer_san_regex?: RegExp;
+  tls_peer_fingerprint256_regex?: RegExp;
+  tls_peer_serial_number_regex?: RegExp;
+};
+
+type daemon_runtime_api_key_entry_t = Omit<
+  daemon_api_key_entry_t,
+  'identity_constraints' | 'enabled'
+> & {
+  enabled: boolean;
+  identity_constraints?: daemon_compiled_identity_constraints_t;
+};
+
+type daemon_resolved_tls_mtls_t = {
+  key_pem: string;
+  cert_pem: string;
+  ca_pem: string;
+  crl_pem?: string;
+  min_version?: tls_min_version_t;
+  cipher_suites?: string;
+  handshake_timeout_ms?: number;
+  request_timeout_ms?: number;
+  max_frame_bytes?: number;
+};
+
+type daemon_runtime_config_t = {
+  server_config: Omit<daemon_server_config_file_t, 'tls_mtls'> & {
+    tls_mtls: daemon_resolved_tls_mtls_t;
+  };
+  api_keys_config: {
+    api_keys: daemon_runtime_api_key_entry_t[];
+  };
+};
+
+type daemon_config_paths_t = {
+  server_config_path: string;
+  api_keys_config_path: string;
+};
+
+type daemon_tls_generation_options_t = {
+  enabled: boolean;
+  output_dir: string;
+  overwrite: boolean;
+  ca_common_name: string;
+  server_common_name: string;
+  client_common_name: string;
+  valid_days: number;
+};
+
+type daemon_generated_tls_material_t = {
+  output_dir: string;
+  ca_key_path: string;
+  ca_cert_path: string;
+  server_key_path: string;
+  server_cert_path: string;
+  client_key_path: string;
+  client_cert_path: string;
+};
+
+type daemon_cli_options_t = daemon_config_paths_t & {
+  help: boolean;
+  tls_generation: daemon_tls_generation_options_t;
+};
+
+type daemon_auth_callback_params_t = Parameters<networkprocedurecall_auth_callback_t>[0];
+
+declare class ApiKeyAuthorizer {
+    private readonly api_key_entries;
+    constructor(params: {
+        api_key_entries: daemon_runtime_api_key_entry_t[];
+    });
+    authenticate(params: {
+        auth_callback_params: daemon_auth_callback_params_t;
+    }): Promise<'failed' | networkprocedurecall_auth_success_t>;
+    private matchesIdentityConstraints;
+    private matchOptionalValue;
+}
+
+declare class ConfigValidator {
+    validateServerConfig(params: {
+        server_config_raw: unknown;
+    }): daemon_server_config_file_t;
+    validateApiKeysConfig(params: {
+        api_keys_config_raw: unknown;
+    }): daemon_api_keys_config_file_t;
+    toRuntimeApiKeysConfig(params: {
+        api_keys_config: daemon_api_keys_config_file_t;
+    }): daemon_runtime_api_key_entry_t[];
+    private compileIdentityConstraints;
+    private assertUniqueApiKeys;
+    private assertUniqueKeyIds;
+}
+
+declare class ConfigFileLoader {
+    private readonly config_validator;
+    constructor(params?: {
+        config_validator?: ConfigValidator;
+    });
+    loadDaemonConfig(params: {
+        config_paths: daemon_config_paths_t;
+    }): daemon_runtime_config_t;
+    private readJson5File;
+    private resolveTlsMaterial;
+    private readPemFile;
+}
+
+declare class DaemonCli {
+    parseOptions(): daemon_cli_options_t;
+    printHelp(): void;
+}
+
+declare class DaemonProcess {
+    private readonly daemon;
+    private is_running;
+    private stop_in_progress;
+    private stop_resolve;
+    private readonly stop_waiter;
+    constructor(params: {
+        config_paths: daemon_config_paths_t;
+    });
+    run(): Promise<void>;
+    private attachProcessHandlers;
+    private detachProcessHandlers;
+    private readonly handleSignal;
+    private readonly handleUncaughtException;
+    private readonly handleUnhandledRejection;
+    private requestStop;
+}
+
+type daemon_lifecycle_state_t = 'stopped' | 'starting' | 'running' | 'stopping';
+type daemon_runtime_snapshot_t = {
+    lifecycle_state: daemon_lifecycle_state_t;
+    server_name?: string;
+    bind_addr?: string;
+    tcp_listen_port?: number;
+    worker_health_states?: unknown;
+    abuse_metrics?: networkprocedurecall_abuse_metrics_t;
+};
+declare class NetworkProcedureCallDaemon {
+    private readonly config_paths;
+    private readonly config_file_loader;
+    private lifecycle_state;
+    private daemon_config;
+    private workerprocedurecall;
+    private networkprocedurecall;
+    private api_key_authorizer;
+    private worker_event_listener_id;
+    private metrics_log_interval_handle;
+    constructor(params: {
+        config_paths: daemon_config_paths_t;
+        config_file_loader?: ConfigFileLoader;
+    });
+    start(): Promise<void>;
+    stop(): Promise<void>;
+    getRuntimeSnapshot(): daemon_runtime_snapshot_t;
+    private createAuthCallback;
+    private buildServerStartParams;
+    private startMetricsLogging;
+    private clearMetricsLoggingInterval;
+    private stopBestEffort;
+    private requireDaemonConfig;
+    private requireApiKeyAuthorizer;
+    private logWorkerEvent;
+    private logMessage;
+}
+
+declare class TlsMaterialGenerator {
+    generateTlsMaterial(params: {
+        tls_generation_options: daemon_tls_generation_options_t;
+    }): daemon_generated_tls_material_t;
+    private assertOpenSslAvailable;
+    private buildTlsFileMap;
+    private assertTargetFilesAreWritable;
+    private generateCa;
+    private generateServerCertificate;
+    private generateClientCertificate;
+    private cleanupIntermediateFiles;
+    private runOpenSslCommand;
+    private getErrorMessage;
+}
+
+export { ApiKeyAuthorizer, ConfigFileLoader, ConfigValidator, DaemonCli, DaemonProcess, NetworkProcedureCallDaemon, TlsMaterialGenerator, type daemon_api_key_entry_t, type daemon_api_key_identity_constraints_t, type daemon_api_keys_config_file_t, type daemon_cli_options_t, type daemon_config_paths_t, type daemon_generated_tls_material_t, type daemon_observability_config_t, type daemon_runtime_api_key_entry_t, type daemon_runtime_config_t, type daemon_server_config_file_t, type daemon_tls_file_config_t, type daemon_tls_generation_options_t, type daemon_worker_config_t };