@parmana/shared 0.0.0-stage → 2.0.0

package/dist/config/Config.d.ts

@@ -0,0 +1,227 @@
+import type { CryptoMode, HashAlgorithm, SignatureAlgorithm } from "./CryptoAlgorithms.js";
+import type { StorageProvider } from "./StorageProviders.js";
+import type { KeyProvider } from "./KeyProviders.js";
+import type { SecretsProvider } from "./SecretsProviders.js";
+import type { TrustProfile } from "./TrustProfiles.js";
+import type { ApiKeyEntry } from "./ApiKeyEntry.js";
+/**
+ * Fail-closed by design, same discipline as caller authentication
+ * (see createCallerAuthenticator.ts): refuses to start rather than let
+ * an unset policy directory surface later as a raw filesystem error
+ * (ERR_INVALID_ARG_TYPE from path.join(undefined, ...)) inside
+ * FilePolicyRepository.load at request time.
+ */
+export declare function requirePolicyDirectory(): string;
+/**
+ * Parmana Configuration.
+ *
+ * Centralized immutable configuration.
+ *
+ * This is the only configuration model used by
+ * Parmana. Environment variables are converted
+ * into strongly typed values through the
+ * ConfigValidation module.
+ */
+/**
+ * Root configuration.
+ */
+export interface Config {
+    readonly environment: EnvironmentConfig;
+    readonly storage: StorageConfig;
+    readonly crypto: CryptoConfig;
+    readonly keys: KeyConfig;
+    readonly secrets: SecretsConfig;
+    readonly authorization: AuthorizationConfig;
+    readonly policy: PolicyConfig;
+    readonly trust: TrustConfig;
+    readonly api: ApiConfig;
+    readonly auth: ApiAuthConfig;
+    readonly rateLimit: RateLimitConfig;
+    readonly logging: LoggingConfig;
+}
+/**
+ * Runtime environment.
+ */
+export interface EnvironmentConfig {
+    readonly nodeEnv: string;
+}
+/**
+ * Storage configuration.
+ */
+export interface StorageConfig {
+    readonly provider: StorageProvider;
+    readonly databaseUrl?: string;
+}
+/**
+ * Cryptographic configuration.
+ */
+export interface CryptoConfig {
+    /**
+     * Crypto operating mode.
+     */
+    readonly mode: CryptoMode;
+    /**
+     * Hash algorithm.
+     */
+    readonly hashProvider: HashAlgorithm;
+    /**
+     * Primary signature algorithm.
+     */
+    readonly primarySignatureProvider: SignatureAlgorithm;
+    /**
+     * Secondary signature algorithm.
+     *
+     * Required only in hybrid mode.
+     */
+    readonly secondarySignatureProvider?: SignatureAlgorithm;
+    /**
+     * When true, verification of a hybrid-schema-capable artifact
+     * (an ExecutionTrustRecord) MUST find a valid `signatures` array
+     * covering every configured algorithm -- a record with `signatures`
+     * absent, empty, or partial is rejected outright, never silently
+     * verified via the legacy single signature alone.
+     *
+     * Off by default so no already-issued record (hybrid or not) is
+     * affected by turning CRYPTO_MODE=hybrid on: a deployment opts into
+     * this once it is confident every record going forward is genuinely
+     * hybrid-signed. See VerificationCrypto.verifySignature()'s own
+     * comment for the exact downgrade this closes.
+     */
+    readonly requireHybridSignature: boolean;
+    /**
+     * Cutover (ADR-0016, option 2): a record created at or after this ISO-8601
+     * UTC instant must carry a valid hybrid envelope. Unset means no cutover.
+     * The same instant belongs in the offline verifier's trust file.
+     */
+    readonly hybridRequiredFrom?: string;
+    /**
+     * Schema version that hybrid signatures are made under (ADR-0016).
+     *
+     * 2 (default) signs the canonical fields plus schemaVersion. 3 signs
+     * every top-level field except the signature envelope and the
+     * post-signing fields (verifications, receipts). Records made under 3
+     * are not readable by verifiers that implement only version 2, so
+     * switch to 3 only once those consumers are updated.
+     */
+    readonly hybridSchemaVersion: 2 | 3;
+}
+/**
+ * Key management.
+ */
+export interface KeyConfig {
+    readonly provider: KeyProvider;
+    /**
+     * Root directory containing all Parmana keys.
+     */
+    readonly keyDirectory: string;
+}
+/**
+ * Secrets backend configuration (ADR-0009). Selects where connector
+ * credentials that are opaque bearer values -- not signing keys, see
+ * KeyConfig/Signer for those -- are resolved from at request time.
+ * "env" (default) is an identity pass-through: the value each
+ * connector's own env var already holds IS the secret. In
+ * "aws-secrets-manager" mode, that same env var's value is instead
+ * treated as the Secrets Manager secret's name/ARN to fetch.
+ */
+export interface SecretsConfig {
+    readonly provider: SecretsProvider;
+}
+/**
+ * Execution authorization configuration.
+ */
+export interface AuthorizationConfig {
+    /**
+     * Default TTL, in seconds, applied to a signed
+     * Execution Authorization when the caller does
+     * not specify one.
+     */
+    readonly ttlSeconds: number;
+}
+/**
+ * Policy configuration.
+ */
+export interface PolicyConfig {
+    /**
+     * Root directory containing policy files.
+     */
+    readonly directory: string;
+}
+/**
+ * Trust profile configuration.
+ */
+export interface TrustConfig {
+    readonly profile: TrustProfile;
+    readonly receiptVersion: string;
+}
+/**
+ * API configuration.
+ */
+export interface ApiConfig {
+    readonly port: number;
+}
+/**
+ * API caller authentication.
+ *
+ * Fail-closed by design: an empty `keys` array means the
+ * caller-authenticator bootstrap refuses to start the
+ * server unless `disabled` is explicitly true (local
+ * development and tutorials only).
+ */
+export interface ApiAuthConfig {
+    readonly keys: readonly ApiKeyEntry[];
+    readonly disabled: boolean;
+}
+/**
+ * Rate limiting configuration.
+ *
+ * Both are per-caller/per-IP-per-minute ceilings applied by
+ * packages/api/src/middleware/rate-limit.ts; see that file for exactly
+ * where and how each is keyed.
+ */
+export interface RateLimitConfig {
+    /**
+     * POST /execute, keyed by authenticated caller identity.
+     */
+    readonly executePerMinute: number;
+    /**
+     * GET /health and GET /ready, keyed by IP.
+     */
+    readonly healthPerMinute: number;
+    /**
+     * The unauthenticated verify routes, /handbook and key discovery,
+     * keyed by IP (G-78).
+     */
+    readonly publicPerMinute: number;
+    /**
+     * Failed caller authentications (401) on every authenticated route,
+     * keyed by IP. Each one writes a signed audit event, so an unlimited
+     * stream of bad keys would spend signing capacity real requests need.
+     */
+    readonly authFailurePerMinute: number;
+}
+/**
+ * Logging configuration.
+ */
+export interface LoggingConfig {
+    readonly level: string;
+}
+/**
+ * Loads the immutable Parmana configuration.
+ *
+ * This is the only location where process.env
+ * should be accessed.
+ */
+/**
+ * HYBRID_SCHEMA_VERSION: unset means 2. Any other value must be exactly
+ * 2 or 3, and anything else throws, so a typo cannot pick a schema
+ * version silently.
+ */
+export declare function parseHybridSchemaVersion(value: string | undefined, acknowledged: string | undefined): 2 | 3;
+/**
+ * HYBRID_REQUIRED_FROM: unset or blank means no cutover. Otherwise it must be
+ * an ISO-8601 UTC timestamp ending in "Z", so it means the same time everywhere.
+ */
+export declare function parseHybridRequiredFrom(value: string | undefined): string | undefined;
+export declare function loadConfig(): Readonly<Config>;
+//# sourceMappingURL=Config.d.ts.map

package/dist/config/Config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Config.d.ts","sourceRoot":"","sources":["../../src/config/Config.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,UAAU,EACV,aAAa,EACb,kBAAkB,EACnB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAI7D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAwEpD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,CAa/C;AAED;;;;;;;;;GASG;AAEH;;GAEG;AACH,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IAExC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAEhC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAE9B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAEzB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAEhC,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC;IAE5C,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAE9B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAE5B,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IAExB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAE7B,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IAEpC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;CACjC;AACD;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IAEnC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC;IAErC;;OAEG;IACH,QAAQ,CAAC,wBAAwB,EAAE,kBAAkB,CAAC;IAEtD;;;;OAIG;IACH,QAAQ,CAAC,0BAA0B,CAAC,EAAE,kBAAkB,CAAC;IAEzD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;IAEzC;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAErC;;;;;;;;OAQG;IACH,QAAQ,CAAC,mBAAmB,EAAE,CAAC,GAAG,CAAC,CAAC;CACrC;AACD;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAE/B;;OAEG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AACD;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AACD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAE/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,SAAS,WAAW,EAAE,CAAC;IAEtC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAElC;;OAEG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IAEjC;;;OAGG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IAEjC;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;CACvC;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;;;GAKG;AACH;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,CAAC,GAAG,CAAC,CA0BP;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,MAAM,GAAG,SAAS,CAYpB;AAED,wBAAgB,UAAU,IAAI,QAAQ,CAAC,MAAM,CAAC,CAiG7C"}

package/dist/config/Config.js

@@ -0,0 +1,172 @@
+import dotenv from "dotenv";
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { optionalProperty } from "./ConfigUtils.js";
+import { parseStorageProvider, parseCryptoMode, parseHashAlgorithm, parseSignatureAlgorithm, parseKeyProvider, parseSecretsProvider, parseTrustProfile, parseApiKeys, } from "./ConfigValidation.js";
+/**
+ * Resolve the repository .env file.
+ *
+ * This implementation is independent of the
+ * current working directory, allowing every
+ * Parmana package to share the same
+ * configuration.
+ */
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+function findEnvFile() {
+    let current = __dirname;
+    while (true) {
+        const candidate = join(current, ".env");
+        if (existsSync(candidate)) {
+            return candidate;
+        }
+        const parent = dirname(current);
+        if (parent === current) {
+            return undefined;
+        }
+        current = parent;
+    }
+}
+//
+// The .env file is read on first use of loadConfig(), not when this module
+// is imported. Importing a package (for example the offline verifier) then
+// reads no file from the working tree.
+//
+let dotEnvLoaded = false;
+function loadDotEnvOnce() {
+    // Test runs set PARMANA_SKIP_DOTENV so a local .env cannot leak into them.
+    if (dotEnvLoaded || process.env.PARMANA_SKIP_DOTENV === "1") {
+        return;
+    }
+    dotEnvLoaded = true;
+    const envFile = findEnvFile();
+    if (envFile) {
+        dotenv.config({
+            path: envFile,
+            quiet: true,
+        });
+    }
+    else {
+        dotenv.config({ quiet: true });
+    }
+}
+/**
+ * Fail-closed by design, same discipline as caller authentication
+ * (see createCallerAuthenticator.ts): refuses to start rather than let
+ * an unset policy directory surface later as a raw filesystem error
+ * (ERR_INVALID_ARG_TYPE from path.join(undefined, ...)) inside
+ * FilePolicyRepository.load at request time.
+ */
+export function requirePolicyDirectory() {
+    const directory = process.env.PARMANA_POLICY_DIR;
+    if (directory === undefined || directory.trim() === "") {
+        throw new Error("PARMANA_POLICY_DIR is not set. Refusing to start without a " +
+            "configured policy directory; the server cannot load or evaluate " +
+            "policies without it. Set PARMANA_POLICY_DIR to the directory " +
+            "containing policy files (e.g. ./policies).");
+    }
+    return directory;
+}
+/**
+ * Loads the immutable Parmana configuration.
+ *
+ * This is the only location where process.env
+ * should be accessed.
+ */
+/**
+ * HYBRID_SCHEMA_VERSION: unset means 2. Any other value must be exactly
+ * 2 or 3, and anything else throws, so a typo cannot pick a schema
+ * version silently.
+ */
+export function parseHybridSchemaVersion(value, acknowledged) {
+    if (value === undefined || value.trim() === "") {
+        return 2;
+    }
+    if (value === "2") {
+        return 2;
+    }
+    if (value === "3") {
+        //
+        // Schema version 3 records are not readable by the SDKs and by
+        // the published third-party verifier until those are updated (ADR-0016 issuance gate).
+        // Refuse to start unless the operator also sets the acknowledgement,
+        // so a stray value cannot switch v3 on.
+        //
+        if (acknowledged !== "true") {
+            throw new Error("HYBRID_SCHEMA_VERSION=3 is refused unless HYBRID_SCHEMA_V3_ACKNOWLEDGED=true is also set (ADR-0016 issuance gate).");
+        }
+        return 3;
+    }
+    throw new Error(`HYBRID_SCHEMA_VERSION must be 2 or 3, got "${value}".`);
+}
+/**
+ * HYBRID_REQUIRED_FROM: unset or blank means no cutover. Otherwise it must be
+ * an ISO-8601 UTC timestamp ending in "Z", so it means the same time everywhere.
+ */
+export function parseHybridRequiredFrom(value) {
+    if (value === undefined || value.trim() === "") {
+        return undefined;
+    }
+    if (!value.endsWith("Z") || Number.isNaN(Date.parse(value))) {
+        throw new Error(`HYBRID_REQUIRED_FROM must be an ISO-8601 UTC timestamp ending in "Z", got "${value}".`);
+    }
+    return value;
+}
+export function loadConfig() {
+    loadDotEnvOnce();
+    return Object.freeze({
+        environment: Object.freeze({
+            nodeEnv: process.env.NODE_ENV ?? "development",
+        }),
+        storage: Object.freeze({
+            provider: parseStorageProvider(process.env.PARMANA_STORAGE),
+            ...optionalProperty("databaseUrl", process.env.DATABASE_URL),
+        }),
+        crypto: Object.freeze({
+            mode: parseCryptoMode(process.env.CRYPTO_MODE),
+            hashProvider: parseHashAlgorithm(process.env.HASH_PROVIDER),
+            primarySignatureProvider: parseSignatureAlgorithm(process.env.PRIMARY_SIGNATURE_PROVIDER),
+            ...optionalProperty("secondarySignatureProvider", process.env.SECONDARY_SIGNATURE_PROVIDER
+                ? parseSignatureAlgorithm(process.env.SECONDARY_SIGNATURE_PROVIDER, "SECONDARY_SIGNATURE_PROVIDER")
+                : undefined),
+            requireHybridSignature: process.env.HYBRID_SIGNATURE_REQUIRED === "true",
+            ...optionalProperty("hybridRequiredFrom", parseHybridRequiredFrom(process.env.HYBRID_REQUIRED_FROM)),
+            hybridSchemaVersion: parseHybridSchemaVersion(process.env.HYBRID_SCHEMA_VERSION, process.env.HYBRID_SCHEMA_V3_ACKNOWLEDGED),
+        }),
+        keys: Object.freeze({
+            provider: parseKeyProvider(process.env.KEY_PROVIDER),
+            keyDirectory: process.env.PARMANA_KEY_DIR,
+        }),
+        secrets: Object.freeze({
+            provider: parseSecretsProvider(process.env.PARMANA_SECRETS_PROVIDER),
+        }),
+        authorization: Object.freeze({
+            ttlSeconds: Number(process.env.EXECUTION_AUTHORIZATION_TTL_SECONDS ?? 120),
+        }),
+        policy: Object.freeze({
+            directory: requirePolicyDirectory(),
+        }),
+        trust: Object.freeze({
+            profile: parseTrustProfile(process.env.TRUST_PROFILE),
+            receiptVersion: process.env.RECEIPT_VERSION ?? "1",
+        }),
+        api: Object.freeze({
+            port: Number(process.env.PORT ?? 3000),
+        }),
+        auth: Object.freeze({
+            keys: parseApiKeys(process.env.PARMANA_API_KEYS),
+            disabled: process.env.PARMANA_AUTH_DISABLED === "true",
+        }),
+        rateLimit: Object.freeze({
+            executePerMinute: Number(process.env.RATE_LIMIT_EXECUTE_PER_MINUTE ?? 30),
+            healthPerMinute: Number(process.env.RATE_LIMIT_HEALTH_PER_MINUTE ?? 300),
+            publicPerMinute: Number(process.env.RATE_LIMIT_PUBLIC_PER_MINUTE ?? 60),
+            authFailurePerMinute: Number(process.env.RATE_LIMIT_AUTH_FAILURE_PER_MINUTE ?? 30),
+        }),
+        logging: Object.freeze({
+            level: process.env.LOG_LEVEL ?? "info",
+        }),
+    });
+}
+//# sourceMappingURL=Config.js.map

package/dist/config/Config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Config.js","sourceRoot":"","sources":["../../src/config/Config.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAUzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAUpD,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,gBAAgB,EAChB,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,GACb,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;GAOG;AACH,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AAElD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AAEtC,SAAS,WAAW;IAClB,IAAI,OAAO,GAAG,SAAS,CAAC;IAExB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAExC,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAEhC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;AACH,CAAC;AAED,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,uCAAuC;AACvC,EAAE;AACF,IAAI,YAAY,GAAG,KAAK,CAAC;AAEzB,SAAS,cAAc;IACrB,2EAA2E;IAC3E,IAAI,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,GAAG,EAAE,CAAC;QAC5D,OAAO;IACT,CAAC;IAED,YAAY,GAAG,IAAI,CAAC;IAEpB,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAE9B,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,CAAC,MAAM,CAAC;YACZ,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAEjD,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CACb,6DAA6D;YAC3D,kEAAkE;YAClE,+DAA+D;YAC/D,4CAA4C,CAC/C,CAAC;IACJ,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAsOD;;;;;GAKG;AACH;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAAyB,EACzB,YAAgC;IAEhC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC/C,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;QAClB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;QAClB,EAAE;QACF,+DAA+D;QAC/D,uFAAuF;QACvF,qEAAqE;QACrE,wCAAwC;QACxC,EAAE;QACF,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,oHAAoH,CACrH,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,8CAA8C,KAAK,IAAI,CAAC,CAAC;AAC3E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAAyB;IAEzB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC/C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,8EAA8E,KAAK,IAAI,CACxF,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,cAAc,EAAE,CAAC;IAEjB,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC;YACzB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,aAAa;SAC/C,CAAC;QAEF,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;YACrB,QAAQ,EAAE,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;YAE3D,GAAG,gBAAgB,CAAC,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;SAC7D,CAAC;QAEF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;YACpB,IAAI,EAAE,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;YAE9C,YAAY,EAAE,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;YAE3D,wBAAwB,EAAE,uBAAuB,CAC/C,OAAO,CAAC,GAAG,CAAC,0BAA0B,CACvC;YAED,GAAG,gBAAgB,CACjB,4BAA4B,EAC5B,OAAO,CAAC,GAAG,CAAC,4BAA4B;gBACtC,CAAC,CAAC,uBAAuB,CACrB,OAAO,CAAC,GAAG,CAAC,4BAA4B,EACxC,8BAA8B,CAC/B;gBACH,CAAC,CAAC,SAAS,CACd;YAED,sBAAsB,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB,KAAK,MAAM;YAExE,GAAG,gBAAgB,CACjB,oBAAoB,EACpB,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAC1D;YAED,mBAAmB,EAAE,wBAAwB,CAC3C,OAAO,CAAC,GAAG,CAAC,qBAAqB,EACjC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAC1C;SACF,CAAC;QAEF,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;YAClB,QAAQ,EAAE,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;YAEpD,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,eAAgB;SAC3C,CAAC;QAEF,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;YACrB,QAAQ,EAAE,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;SACrE,CAAC;QAEF,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC;YAC3B,UAAU,EAAE,MAAM,CAChB,OAAO,CAAC,GAAG,CAAC,mCAAmC,IAAI,GAAG,CACvD;SACF,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;YACpB,SAAS,EAAE,sBAAsB,EAAE;SACpC,CAAC;QAEF,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;YACnB,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;YAErD,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,GAAG;SACnD,CAAC;QAEF,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC;YACjB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC;SACvC,CAAC;QAEF,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;YAClB,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;YAEhD,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,MAAM;SACvD,CAAC;QAEF,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;YACvB,gBAAgB,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,IAAI,EAAE,CAAC;YAEzE,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,GAAG,CAAC;YAExE,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,EAAE,CAAC;YAEvE,oBAAoB,EAAE,MAAM,CAC1B,OAAO,CAAC,GAAG,CAAC,kCAAkC,IAAI,EAAE,CACrD;SACF,CAAC;QAEF,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;YACrB,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,MAAM;SACvC,CAAC;KACH,CAAC,CAAC;AACL,CAAC"}

package/dist/config/ConfigLoader.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Returns the immutable Parmana configuration.
+ */
+export declare function getConfig(): Readonly<import("./Config.js").Config>;
+//# sourceMappingURL=ConfigLoader.d.ts.map

package/dist/config/ConfigLoader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConfigLoader.d.ts","sourceRoot":"","sources":["../../src/config/ConfigLoader.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,wBAAgB,SAAS,2CAExB"}

package/dist/config/ConfigLoader.js

@@ -0,0 +1,8 @@
+import { loadConfig } from "./Config.js";
+/**
+ * Returns the immutable Parmana configuration.
+ */
+export function getConfig() {
+    return loadConfig();
+}
+//# sourceMappingURL=ConfigLoader.js.map

package/dist/config/ConfigLoader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConfigLoader.js","sourceRoot":"","sources":["../../src/config/ConfigLoader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;GAEG;AACH,MAAM,UAAU,SAAS;IACvB,OAAO,UAAU,EAAE,CAAC;AACtB,CAAC"}

package/dist/config/ConfigUtils.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Returns an object containing the property only when
+ * the value is defined.
+ */
+export declare function optionalProperty<T>(key: string, value: T | undefined): Record<string, T>;
+//# sourceMappingURL=ConfigUtils.d.ts.map

package/dist/config/ConfigUtils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConfigUtils.d.ts","sourceRoot":"","sources":["../../src/config/ConfigUtils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAChC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,CAAC,GAAG,SAAS,GACnB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAEnB"}

package/dist/config/ConfigUtils.js

@@ -0,0 +1,8 @@
+/**
+ * Returns an object containing the property only when
+ * the value is defined.
+ */
+export function optionalProperty(key, value) {
+    return value === undefined ? {} : { [key]: value };
+}
+//# sourceMappingURL=ConfigUtils.js.map

package/dist/config/ConfigUtils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConfigUtils.js","sourceRoot":"","sources":["../../src/config/ConfigUtils.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAW,EACX,KAAoB;IAEpB,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC;AACrD,CAAC"}

package/dist/config/ConfigValidation.d.ts

@@ -0,0 +1,30 @@
+import { type CryptoMode, type HashAlgorithm, type SignatureAlgorithm } from "./CryptoAlgorithms.js";
+import { type StorageProvider } from "./StorageProviders.js";
+import { type KeyProvider } from "./KeyProviders.js";
+import { type SecretsProvider } from "./SecretsProviders.js";
+import { type TrustProfile } from "./TrustProfiles.js";
+import type { ApiKeyEntry } from "./ApiKeyEntry.js";
+export declare const parseStorageProvider: (value?: string) => StorageProvider;
+export declare const parseCryptoMode: (value?: string) => CryptoMode;
+export declare const parseHashAlgorithm: (value?: string) => HashAlgorithm;
+export declare const parseSignatureAlgorithm: (value?: string, variable?: string) => SignatureAlgorithm;
+export declare const parseKeyProvider: (value?: string) => KeyProvider;
+/**
+ * Unlike the other settings, an invalid value is not echoed: a value set
+ * in the wrong variable can be a real secret (a token pasted into
+ * PARMANA_SECRETS_PROVIDER, say), and this message reaches logs. Kept
+ * separate from parse() so the value never reaches its message.
+ */
+export declare const parseSecretsProvider: (value?: string) => SecretsProvider;
+export declare const parseTrustProfile: (value?: string) => TrustProfile;
+/**
+ * Parses PARMANA_API_KEYS: a JSON array of
+ * { "callerId": string, "keyHash": string } entries.
+ *
+ * Returns an empty array when unset — callers of this
+ * function decide what an empty result means (the
+ * caller-authenticator bootstrap treats it as "refuse to
+ * start unless auth is explicitly disabled").
+ */
+export declare function parseApiKeys(value?: string): ApiKeyEntry[];
+//# sourceMappingURL=ConfigValidation.d.ts.map

package/dist/config/ConfigValidation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConfigValidation.d.ts","sourceRoot":"","sources":["../../src/config/ConfigValidation.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,UAAU,EAEf,KAAK,aAAa,EAElB,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE/E,OAAO,EAAgB,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEnE,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE/E,OAAO,EAAiB,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAItE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AA8CpD,eAAO,MAAM,oBAAoB,WAAY,MAAM,KAAG,eAarD,CAAC;AAEF,eAAO,MAAM,eAAe,WAAY,MAAM,KAAG,UAK9C,CAAC;AAEJ,eAAO,MAAM,kBAAkB,WAAY,MAAM,KAAG,aAKjD,CAAC;AAgBJ,eAAO,MAAM,uBAAuB,WAC1B,MAAM,wBAEb,kBAYA,CAAC;AAEJ,eAAO,MAAM,gBAAgB,WAAY,MAAM,KAAG,WAK/C,CAAC;AAEJ;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,WAAY,MAAM,KAAG,eAerD,CAAC;AAEF,eAAO,MAAM,iBAAiB,WAAY,MAAM,KAAG,YACa,CAAC;AAIjE;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,WAAW,EAAE,CAuJ1D"}