@parmana/shared 0.0.0-stage → 2.0.0

package/dist/config/ConfigValidation.js

@@ -0,0 +1,191 @@
+import { CryptoModes, HashAlgorithms, SignatureAlgorithms, } from "./CryptoAlgorithms.js";
+import { StorageProviders } from "./StorageProviders.js";
+import { KeyProviders } from "./KeyProviders.js";
+import { SecretsProviders } from "./SecretsProviders.js";
+import { TrustProfiles } from "./TrustProfiles.js";
+import { createPublicKey } from "node:crypto";
+import { AuthorityType } from "../domain/authority.js";
+function parse(value, values, name, defaultValue) {
+    const resolved = value ?? defaultValue;
+    if (Object.values(values).includes(resolved)) {
+        return resolved;
+    }
+    throw new Error(`Invalid ${name}: ${resolved}`);
+}
+/**
+ * A value can be a documented name that no runtime implements yet. Refuse it
+ * at startup, naming what works, rather than accepting it and failing later
+ * or quietly using a different provider (#222). Called after parse(), so the
+ * value is already a known name and is safe to echo.
+ */
+function requireImplemented(name, value, implemented) {
+    if (implemented.includes(value)) {
+        return value;
+    }
+    throw new Error(`${name}=${value} is not implemented in this build. Use one of: ${implemented.join(", ")}.`);
+}
+const IMPLEMENTED_CRYPTO_MODES = [CryptoModes.SINGLE, CryptoModes.HYBRID];
+const IMPLEMENTED_HASH_ALGORITHMS = [HashAlgorithms.SHA256];
+const IMPLEMENTED_SIGNATURE_ALGORITHMS = [
+    SignatureAlgorithms.ED25519,
+    SignatureAlgorithms.DILITHIUM3,
+];
+const IMPLEMENTED_KEY_PROVIDERS = [KeyProviders.LOCAL, KeyProviders.AWS_KMS];
+export const parseStorageProvider = (value) => {
+    if (process.env.DATABASE_PROVIDER !== undefined) {
+        throw new Error("DATABASE_PROVIDER is no longer read; set PARMANA_STORAGE instead.");
+    }
+    return parse(value, StorageProviders, "PARMANA_STORAGE", StorageProviders.MEMORY);
+};
+export const parseCryptoMode = (value) => requireImplemented("CRYPTO_MODE", parse(value, CryptoModes, "CRYPTO_MODE", CryptoModes.SINGLE), IMPLEMENTED_CRYPTO_MODES);
+export const parseHashAlgorithm = (value) => requireImplemented("HASH_PROVIDER", parse(value, HashAlgorithms, "HASH_PROVIDER", HashAlgorithms.SHA256), IMPLEMENTED_HASH_ALGORITHMS);
+/**
+ * Accepted input aliases for a SignatureAlgorithm config value, resolved
+ * to the canonical internal identifier before validation. Additive only:
+ * the canonical identifiers themselves (SignatureAlgorithms' own values,
+ * e.g. "dilithium3") are never renamed, so an existing
+ * PRIMARY_SIGNATURE_PROVIDER=dilithium3 deployment is unaffected. Lets a
+ * new deployment use "ml-dsa-65" (the NIST/FIPS 204 standard name this
+ * codebase's own docs already use when describing "dilithium3" to
+ * readers) without a breaking rename of the internal identifier itself.
+ */
+const SIGNATURE_ALGORITHM_ALIASES = {
+    "ml-dsa-65": SignatureAlgorithms.DILITHIUM3,
+};
+export const parseSignatureAlgorithm = (value, variable = "PRIMARY_SIGNATURE_PROVIDER") => requireImplemented(variable, parse(value !== undefined
+    ? (SIGNATURE_ALGORITHM_ALIASES[value] ?? value)
+    : value, SignatureAlgorithms, "SIGNATURE_PROVIDER", SignatureAlgorithms.ED25519), IMPLEMENTED_SIGNATURE_ALGORITHMS);
+export const parseKeyProvider = (value) => requireImplemented("KEY_PROVIDER", parse(value, KeyProviders, "KEY_PROVIDER", KeyProviders.LOCAL), IMPLEMENTED_KEY_PROVIDERS);
+/**
+ * Unlike the other settings, an invalid value is not echoed: a value set
+ * in the wrong variable can be a real secret (a token pasted into
+ * PARMANA_SECRETS_PROVIDER, say), and this message reaches logs. Kept
+ * separate from parse() so the value never reaches its message.
+ */
+export const parseSecretsProvider = (value) => {
+    const accepted = Object.values(SecretsProviders);
+    const match = accepted.find((provider) => provider === value);
+    if (value === undefined) {
+        return SecretsProviders.ENV;
+    }
+    if (match === undefined) {
+        throw new Error(`Invalid PARMANA_SECRETS_PROVIDER: expected one of ${accepted.join(", ")}`);
+    }
+    return match;
+};
+export const parseTrustProfile = (value) => parse(value, TrustProfiles, "TRUST_PROFILE", TrustProfiles.V1);
+const API_KEY_HASH_PATTERN = /^[0-9a-f]{64}$/;
+/**
+ * Parses PARMANA_API_KEYS: a JSON array of
+ * { "callerId": string, "keyHash": string } entries.
+ *
+ * Returns an empty array when unset — callers of this
+ * function decide what an empty result means (the
+ * caller-authenticator bootstrap treats it as "refuse to
+ * start unless auth is explicitly disabled").
+ */
+export function parseApiKeys(value) {
+    if (value === undefined || value.trim() === "") {
+        return [];
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch {
+        throw new Error("PARMANA_API_KEYS is not valid JSON. Expected an array of " +
+            '{ "callerId": string, "keyHash": string } entries.');
+    }
+    if (!Array.isArray(parsed)) {
+        throw new Error("PARMANA_API_KEYS must be a JSON array of " +
+            '{ "callerId": string, "keyHash": string } entries.');
+    }
+    return parsed.map((entry, index) => {
+        const record = entry;
+        const validEntry = typeof entry === "object" &&
+            entry !== null &&
+            typeof record.callerId === "string" &&
+            record.callerId !== "" &&
+            typeof record.keyHash === "string" &&
+            API_KEY_HASH_PATTERN.test(record.keyHash);
+        if (!validEntry) {
+            throw new Error(`PARMANA_API_KEYS[${index}] is invalid. Each entry must be ` +
+                '{ "callerId": non-empty string, "keyHash": 64-character lowercase hex }.');
+        }
+        const allowedPrincipalIds = record.allowedPrincipalIds;
+        if (allowedPrincipalIds !== undefined) {
+            const validAllowedPrincipalIds = Array.isArray(allowedPrincipalIds) &&
+                allowedPrincipalIds.every((id) => typeof id === "string" && id !== "");
+            if (!validAllowedPrincipalIds) {
+                throw new Error(`PARMANA_API_KEYS[${index}].allowedPrincipalIds must be an array ` +
+                    "of non-empty strings when present.");
+            }
+        }
+        const allowedCapabilities = record.allowedCapabilities;
+        if (allowedCapabilities !== undefined) {
+            const validAllowedCapabilities = Array.isArray(allowedCapabilities) &&
+                allowedCapabilities.every((capability) => typeof capability === "string" && capability !== "");
+            if (!validAllowedCapabilities) {
+                throw new Error(`PARMANA_API_KEYS[${index}].allowedCapabilities must be an array ` +
+                    'of non-empty strings when present. Use "*" as an entry to ' +
+                    "grant every capability.");
+            }
+        }
+        const allowedTenantIds = record.allowedTenantIds;
+        if (allowedTenantIds !== undefined) {
+            const validAllowedTenantIds = Array.isArray(allowedTenantIds) &&
+                allowedTenantIds.every((id) => typeof id === "string" && id !== "");
+            if (!validAllowedTenantIds) {
+                throw new Error(`PARMANA_API_KEYS[${index}].allowedTenantIds must be an array ` +
+                    "of non-empty strings when present.");
+            }
+        }
+        const credentialHolderType = record.credentialHolderType;
+        if (credentialHolderType !== undefined) {
+            const validCredentialHolderType = typeof credentialHolderType === "string" &&
+                Object.values(AuthorityType).includes(credentialHolderType);
+            if (!validCredentialHolderType) {
+                throw new Error(`PARMANA_API_KEYS[${index}].credentialHolderType must be one of ` +
+                    `${Object.values(AuthorityType).join(", ")} when present.`);
+            }
+        }
+        const stepUpPublicKey = record.stepUpPublicKey;
+        if (stepUpPublicKey !== undefined) {
+            const validShape = typeof stepUpPublicKey === "string" && stepUpPublicKey.trim() !== "";
+            let validKey = false;
+            if (validShape) {
+                try {
+                    const keyObject = createPublicKey(stepUpPublicKey);
+                    validKey = keyObject.asymmetricKeyType === "ed25519";
+                }
+                catch {
+                    validKey = false;
+                }
+            }
+            if (!validShape || !validKey) {
+                throw new Error(`PARMANA_API_KEYS[${index}].stepUpPublicKey must be a PEM-encoded ` +
+                    "Ed25519 public key when present.");
+            }
+        }
+        return {
+            callerId: record.callerId,
+            keyHash: record.keyHash,
+            ...(allowedPrincipalIds !== undefined
+                ? { allowedPrincipalIds: allowedPrincipalIds }
+                : {}),
+            ...(allowedCapabilities !== undefined
+                ? { allowedCapabilities: allowedCapabilities }
+                : {}),
+            ...(allowedTenantIds !== undefined
+                ? { allowedTenantIds: allowedTenantIds }
+                : {}),
+            ...(credentialHolderType !== undefined
+                ? { credentialHolderType: credentialHolderType }
+                : {}),
+            ...(stepUpPublicKey !== undefined
+                ? { stepUpPublicKey: stepUpPublicKey }
+                : {}),
+        };
+    });
+}
+//# sourceMappingURL=ConfigValidation.js.map

package/dist/config/ConfigValidation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConfigValidation.js","sourceRoot":"","sources":["../../src/config/ConfigValidation.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EAEX,cAAc,EAEd,mBAAmB,GAEpB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,gBAAgB,EAAwB,MAAM,uBAAuB,CAAC;AAE/E,OAAO,EAAE,YAAY,EAAoB,MAAM,mBAAmB,CAAC;AAEnE,OAAO,EAAE,gBAAgB,EAAwB,MAAM,uBAAuB,CAAC;AAE/E,OAAO,EAAE,aAAa,EAAqB,MAAM,oBAAoB,CAAC;AAEtE,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG9C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,SAAS,KAAK,CACZ,KAAyB,EACzB,MAAyB,EACzB,IAAY,EACZ,YAAe;IAEf,MAAM,QAAQ,GAAG,KAAK,IAAI,YAAY,CAAC;IAEvC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAa,CAAC,EAAE,CAAC;QAClD,OAAO,QAAa,CAAC;IACvB,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,QAAQ,EAAE,CAAC,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CACzB,IAAY,EACZ,KAAQ,EACR,WAAyB;IAEzB,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,IAAI,KAAK,kDAAkD,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC5F,CAAC;AACJ,CAAC;AAED,MAAM,wBAAwB,GAAG,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;AAC1E,MAAM,2BAA2B,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;AAC5D,MAAM,gCAAgC,GAAG;IACvC,mBAAmB,CAAC,OAAO;IAC3B,mBAAmB,CAAC,UAAU;CAC/B,CAAC;AACF,MAAM,yBAAyB,GAAG,CAAC,YAAY,CAAC,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;AAE7E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,KAAc,EAAmB,EAAE;IACtE,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CACV,KAAK,EACL,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,CAAC,MAAM,CACxB,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAc,EAAc,EAAE,CAC5D,kBAAkB,CAChB,aAAa,EACb,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,EAC5D,wBAAwB,CACzB,CAAC;AAEJ,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,KAAc,EAAiB,EAAE,CAClE,kBAAkB,CAChB,eAAe,EACf,KAAK,CAAC,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,EACpE,2BAA2B,CAC5B,CAAC;AAEJ;;;;;;;;;GASG;AACH,MAAM,2BAA2B,GAAuC;IACtE,WAAW,EAAE,mBAAmB,CAAC,UAAU;CAC5C,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,KAAc,EACd,QAAQ,GAAG,4BAA4B,EACnB,EAAE,CACtB,kBAAkB,CAChB,QAAQ,EACR,KAAK,CACH,KAAK,KAAK,SAAS;IACjB,CAAC,CAAC,CAAC,2BAA2B,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;IAC/C,CAAC,CAAC,KAAK,EACT,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,CAAC,OAAO,CAC5B,EACD,gCAAgC,CACjC,CAAC;AAEJ,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAc,EAAe,EAAE,CAC9D,kBAAkB,CAChB,cAAc,EACd,KAAK,CAAC,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,YAAY,CAAC,KAAK,CAAC,EAC9D,yBAAyB,CAC1B,CAAC;AAEJ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,KAAc,EAAmB,EAAE;IACtE,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC;IAE9D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,gBAAgB,CAAC,GAAG,CAAC;IAC9B,CAAC;IAED,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,qDAAqD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3E,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAAc,EAAgB,EAAE,CAChE,KAAK,CAAC,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC;AAEjE,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAE9C;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC/C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,MAAe,CAAC;IAEpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,2DAA2D;YACzD,oDAAoD,CACvD,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,2CAA2C;YACzC,oDAAoD,CACvD,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAe,EAAE;QAC9C,MAAM,MAAM,GAAG,KAAgC,CAAC;QAEhD,MAAM,UAAU,GACd,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,KAAK,IAAI;YACd,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;YACnC,MAAM,CAAC,QAAQ,KAAK,EAAE;YACtB,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;YAClC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAE5C,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,oBAAoB,KAAK,mCAAmC;gBAC1D,0EAA0E,CAC7E,CAAC;QACJ,CAAC;QAED,MAAM,mBAAmB,GAAG,MAAM,CAAC,mBAAmB,CAAC;QAEvD,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,wBAAwB,GAC5B,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC;gBAClC,mBAAmB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAEzE,IAAI,CAAC,wBAAwB,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CACb,oBAAoB,KAAK,yCAAyC;oBAChE,oCAAoC,CACvC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,mBAAmB,GAAG,MAAM,CAAC,mBAAmB,CAAC;QAEvD,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,wBAAwB,GAC5B,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC;gBAClC,mBAAmB,CAAC,KAAK,CACvB,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,EAAE,CACpE,CAAC;YAEJ,IAAI,CAAC,wBAAwB,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CACb,oBAAoB,KAAK,yCAAyC;oBAChE,4DAA4D;oBAC5D,yBAAyB,CAC5B,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC;QAEjD,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,qBAAqB,GACzB,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC;gBAC/B,gBAAgB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAEtE,IAAI,CAAC,qBAAqB,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,oBAAoB,KAAK,sCAAsC;oBAC7D,oCAAoC,CACvC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,oBAAoB,GAAG,MAAM,CAAC,oBAAoB,CAAC;QAEzD,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACvC,MAAM,yBAAyB,GAC7B,OAAO,oBAAoB,KAAK,QAAQ;gBACxC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,QAAQ,CACnC,oBAAqC,CACtC,CAAC;YAEJ,IAAI,CAAC,yBAAyB,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CACb,oBAAoB,KAAK,wCAAwC;oBAC/D,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAC7D,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;QAE/C,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,UAAU,GACd,OAAO,eAAe,KAAK,QAAQ,IAAI,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;YAEvE,IAAI,QAAQ,GAAG,KAAK,CAAC;YAErB,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,CAAC;oBACH,MAAM,SAAS,GAAG,eAAe,CAAC,eAAyB,CAAC,CAAC;oBAC7D,QAAQ,GAAG,SAAS,CAAC,iBAAiB,KAAK,SAAS,CAAC;gBACvD,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ,GAAG,KAAK,CAAC;gBACnB,CAAC;YACH,CAAC;YAED,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CACb,oBAAoB,KAAK,0CAA0C;oBACjE,kCAAkC,CACrC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,QAAkB;YACnC,OAAO,EAAE,MAAM,CAAC,OAAiB;YACjC,GAAG,CAAC,mBAAmB,KAAK,SAAS;gBACnC,CAAC,CAAC,EAAE,mBAAmB,EAAE,mBAAwC,EAAE;gBACnE,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,mBAAmB,KAAK,SAAS;gBACnC,CAAC,CAAC,EAAE,mBAAmB,EAAE,mBAAwC,EAAE;gBACnE,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,gBAAgB,KAAK,SAAS;gBAChC,CAAC,CAAC,EAAE,gBAAgB,EAAE,gBAAqC,EAAE;gBAC7D,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,oBAAoB,KAAK,SAAS;gBACpC,CAAC,CAAC,EAAE,oBAAoB,EAAE,oBAAqC,EAAE;gBACjE,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,eAAe,KAAK,SAAS;gBAC/B,CAAC,CAAC,EAAE,eAAe,EAAE,eAAyB,EAAE;gBAChD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/config/CryptoAlgorithms.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Canonical hash algorithms supported by Parmana.
+ *
+ * New algorithms are additive.
+ */
+export declare const HashAlgorithms: {
+    readonly SHA256: "sha256";
+    readonly SHA3512: "sha3-512";
+    readonly BLAKE3: "blake3";
+};
+export type HashAlgorithm = (typeof HashAlgorithms)[keyof typeof HashAlgorithms];
+/**
+ * Canonical signature algorithms.
+ */
+export declare const SignatureAlgorithms: {
+    readonly ED25519: "ed25519";
+    readonly ECDSA_P256: "ecdsa-p256";
+    readonly DILITHIUM3: "dilithium3";
+    readonly DILITHIUM5: "dilithium5";
+    readonly SPHINCS_PLUS: "sphincs-plus";
+};
+export type SignatureAlgorithm = (typeof SignatureAlgorithms)[keyof typeof SignatureAlgorithms];
+/**
+ * Crypto signing modes.
+ *
+ * single: exactly one SignatureProvider (PRIMARY_SIGNATURE_PROVIDER)
+ * signs and verifies everything -- today's behavior, unchanged.
+ *
+ * hybrid: PRIMARY_SIGNATURE_PROVIDER and SECONDARY_SIGNATURE_PROVIDER
+ * both sign Execution Trust Records and Receipts; verification
+ * requires both to pass. See HybridSignatureProvider (@parmana/crypto).
+ */
+export declare const CryptoModes: {
+    readonly SINGLE: "single";
+    readonly HYBRID: "hybrid";
+};
+export type CryptoMode = (typeof CryptoModes)[keyof typeof CryptoModes];
+//# sourceMappingURL=CryptoAlgorithms.d.ts.map

package/dist/config/CryptoAlgorithms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CryptoAlgorithms.d.ts","sourceRoot":"","sources":["../../src/config/CryptoAlgorithms.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,cAAc;aACzB,MAAM,EAAE,QAAQ;aAChB,OAAO,EAAE,UAAU;aACnB,MAAM,EAAE,QAAQ;CACR,CAAC;AAEX,MAAM,MAAM,aAAa,GACvB,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,OAAO,cAAc,CAAC,CAAC;AAEvD;;GAEG;AACH,eAAO,MAAM,mBAAmB;aAC9B,OAAO,EAAE,SAAS;aAClB,UAAU,EAAE,YAAY;aAKxB,UAAU,EAAE,YAAY;aACxB,UAAU,EAAE,YAAY;aACxB,YAAY,EAAE,cAAc;CACpB,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAC5B,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAC;AAEjE;;;;;;;;;GASG;AACH,eAAO,MAAM,WAAW;aACtB,MAAM,EAAE,QAAQ;aAChB,MAAM,EAAE,QAAQ;CACR,CAAC;AAEX,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,OAAO,WAAW,CAAC,CAAC"}

package/dist/config/CryptoAlgorithms.js

@@ -0,0 +1,38 @@
+/**
+ * Canonical hash algorithms supported by Parmana.
+ *
+ * New algorithms are additive.
+ */
+export const HashAlgorithms = {
+    SHA256: "sha256",
+    SHA3512: "sha3-512",
+    BLAKE3: "blake3",
+};
+/**
+ * Canonical signature algorithms.
+ */
+export const SignatureAlgorithms = {
+    ED25519: "ed25519",
+    ECDSA_P256: "ecdsa-p256",
+    //
+    // Post-Quantum Ready
+    //
+    DILITHIUM3: "dilithium3",
+    DILITHIUM5: "dilithium5",
+    SPHINCS_PLUS: "sphincs-plus",
+};
+/**
+ * Crypto signing modes.
+ *
+ * single: exactly one SignatureProvider (PRIMARY_SIGNATURE_PROVIDER)
+ * signs and verifies everything -- today's behavior, unchanged.
+ *
+ * hybrid: PRIMARY_SIGNATURE_PROVIDER and SECONDARY_SIGNATURE_PROVIDER
+ * both sign Execution Trust Records and Receipts; verification
+ * requires both to pass. See HybridSignatureProvider (@parmana/crypto).
+ */
+export const CryptoModes = {
+    SINGLE: "single",
+    HYBRID: "hybrid",
+};
+//# sourceMappingURL=CryptoAlgorithms.js.map

package/dist/config/CryptoAlgorithms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CryptoAlgorithms.js","sourceRoot":"","sources":["../../src/config/CryptoAlgorithms.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,UAAU;IACnB,MAAM,EAAE,QAAQ;CACR,CAAC;AAKX;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,OAAO,EAAE,SAAS;IAClB,UAAU,EAAE,YAAY;IAExB,EAAE;IACF,qBAAqB;IACrB,EAAE;IACF,UAAU,EAAE,YAAY;IACxB,UAAU,EAAE,YAAY;IACxB,YAAY,EAAE,cAAc;CACpB,CAAC;AAKX;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;CACR,CAAC"}

package/dist/config/Doctor.d.ts

@@ -0,0 +1,46 @@
+/**
+ * One check from the configuration doctor. "pass" means the setting is valid,
+ * "warn" means it works but needs attention, and "fail" means the server would
+ * refuse to start, or would refuse requests. A fail always carries a fix.
+ */
+export interface DoctorCheck {
+    readonly name: string;
+    readonly level: "pass" | "warn" | "fail";
+    readonly message: string;
+    readonly fix?: string;
+}
+export interface DoctorReaders {
+    readonly directoryExists: (path: string) => boolean;
+    /** Names of the entries in a folder. Empty when the folder cannot be read. */
+    readonly listDirectory: (path: string) => string[];
+    readonly readFile: (path: string) => string;
+}
+export interface DoctorOptions {
+    /**
+     * Apply the production rules as well. The server refuses several settings
+     * when NODE_ENV=production, and some storage and key choices are only valid
+     * in production. Without this, the local rules apply.
+     */
+    readonly production: boolean;
+}
+type Env = Readonly<Record<string, string | undefined>>;
+/**
+ * Every PARMANA_ name read by this repository. A name outside this list is
+ * reported as a probable typo, because the server ignores it without a word.
+ */
+export declare const KNOWN_PARMANA_SETTINGS: readonly string[];
+/**
+ * Runs the configuration checks and returns every result, not just the first
+ * failure. With `production: true`, the production rules are added and the
+ * stage 1 "not yet checked" warnings are replaced by real checks.
+ *
+ * Each setting is checked with the same parser the server uses, so a check
+ * cannot pass here and fail at startup. Parser error messages are never shown,
+ * because some of them echo the value they rejected. Messages name the setting
+ * and the allowed values only.
+ */
+export declare function diagnoseConfiguration(env: Env, readers: DoctorReaders, options?: DoctorOptions): DoctorCheck[];
+/** The known setting within two edits of the given name, if there is one. */
+export declare function closestSetting(name: string): string | undefined;
+export {};
+//# sourceMappingURL=Doctor.d.ts.map

package/dist/config/Doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Doctor.d.ts","sourceRoot":"","sources":["../../src/config/Doctor.ts"],"names":[],"mappings":"AAqBA;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACpD,8EAA8E;IAC9E,QAAQ,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;IACnD,QAAQ,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CAC7C;AAED,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED,KAAK,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AAYxD;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EA0BnD,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,aAAa,EACtB,OAAO,GAAE,aAAqC,GAC7C,WAAW,EAAE,CAsBf;AAoyBD,6EAA6E;AAC7E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAW/D"}