@registrystack/client 0.43.0 → 0.45.0

package/coordinator/client.js

@@ -0,0 +1,140 @@
+'use strict';
+
+const { types: { isProxy } } = require('node:util');
+const native = require('./index');
+
+const MAX_JSON_DEPTH = 64;
+const MAX_JSON_NODES = 20_000;
+const MAX_JSON_STRING_BYTES = 1024 * 1024;
+
+class CoordinatorClientError extends Error {
+  constructor(envelope) {
+    super(envelope.message);
+    this.name = 'CoordinatorClientError';
+    this.kind = envelope.kind;
+    this.outcomeUnknown = envelope.outcomeUnknown === true;
+    for (const field of ['code', 'status', 'transportKind', 'protocolFailure']) {
+      if (envelope[field] !== undefined && envelope[field] !== null) this[field] = envelope[field];
+    }
+  }
+}
+
+const FALLBACK_MESSAGES = {
+  configuration: 'Coordinator client configuration is invalid',
+  'invalid-request': 'Coordinator client arguments are invalid',
+  protocol: 'Registry Coordinator client failed',
+};
+
+function normalized(error, fallbackKind) {
+  if (error instanceof CoordinatorClientError) return error;
+  if (error instanceof Error && typeof error.message === 'string') {
+    try {
+      const envelope = JSON.parse(error.message);
+      if (envelope && typeof envelope.kind === 'string') return new CoordinatorClientError(envelope);
+    } catch {
+      // napi argument conversion errors have no mapped envelope.
+    }
+  }
+  if (fallbackKind) {
+    return new CoordinatorClientError({
+      kind: fallbackKind,
+      message: FALLBACK_MESSAGES[fallbackKind],
+      outcomeUnknown: fallbackKind === 'protocol',
+    });
+  }
+  return error;
+}
+
+function cloneJson(value, budget, depth, kind) {
+  if (depth > MAX_JSON_DEPTH || ++budget.nodes > MAX_JSON_NODES) throw normalized({}, kind);
+  if (value === null || typeof value === 'boolean') return value;
+  if (typeof value === 'string') {
+    budget.bytes += Buffer.byteLength(value, 'utf8');
+    if (budget.bytes > MAX_JSON_STRING_BYTES) throw normalized({}, kind);
+    return value;
+  }
+  if (typeof value === 'number') {
+    if (!Number.isFinite(value) || (Number.isInteger(value) && !Number.isSafeInteger(value))) {
+      throw normalized({}, kind);
+    }
+    return value;
+  }
+  if (value === undefined || typeof value !== 'object' || isProxy(value)) throw normalized({}, kind);
+  const array = Array.isArray(value);
+  const prototype = Object.getPrototypeOf(value);
+  if (array ? prototype !== Array.prototype : prototype !== Object.prototype && prototype !== null) {
+    throw normalized({}, kind);
+  }
+  if (budget.active.has(value)) throw normalized({}, kind);
+  budget.active.add(value);
+  try {
+    if (array) {
+      if (value.length > MAX_JSON_NODES - budget.nodes) throw normalized({}, kind);
+      const keys = Reflect.ownKeys(value);
+      if (keys.length !== value.length + 1) throw normalized({}, kind);
+      const result = new Array(value.length);
+      for (let index = 0; index < value.length; index += 1) {
+        const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+        if (!descriptor || !Object.hasOwn(descriptor, 'value')) throw normalized({}, kind);
+        result[index] = cloneJson(descriptor.value, budget, depth + 1, kind);
+      }
+      return result;
+    }
+    const result = Object.create(null);
+    for (const key of Reflect.ownKeys(value)) {
+      if (typeof key !== 'string') throw normalized({}, kind);
+      const descriptor = Object.getOwnPropertyDescriptor(value, key);
+      if (!descriptor || !Object.hasOwn(descriptor, 'value')) throw normalized({}, kind);
+      if (descriptor.enumerable) {
+        budget.bytes += Buffer.byteLength(key, 'utf8');
+        if (budget.bytes > MAX_JSON_STRING_BYTES) throw normalized({}, kind);
+        result[key] = cloneJson(descriptor.value, budget, depth + 1, kind);
+      }
+    }
+    return result;
+  } finally {
+    budget.active.delete(value);
+  }
+}
+
+function sanitize(value, kind) {
+  return cloneJson(value, { nodes: 0, bytes: 0, active: new WeakSet() }, 0, kind);
+}
+
+const NativeCoordinatorClient = native.CoordinatorClient;
+
+class CoordinatorClient {
+  constructor(config) {
+    try {
+      this.native = new NativeCoordinatorClient(sanitize(config, 'configuration'));
+    } catch (error) {
+      throw normalized(error, 'configuration');
+    }
+  }
+}
+
+for (const [method, jsonIndexes] of [
+  ['start', [2]],
+  ['workflow', []],
+  ['status', []],
+  ['inspect', []],
+  ['reconcile', []],
+  ['list', []],
+  ['retrySame', []],
+  ['cancel', []],
+]) {
+  CoordinatorClient.prototype[method] = function (...args) {
+    try {
+      for (const index of jsonIndexes) {
+        if (args[index] !== undefined && args[index] !== null) {
+          args[index] = sanitize(args[index], 'invalid-request');
+        }
+      }
+      return this.native[method](...args).catch((error) => { throw normalized(error, 'protocol'); });
+    } catch (error) {
+      throw normalized(error, 'invalid-request');
+    }
+  };
+}
+
+module.exports = { CoordinatorClient, CoordinatorClientError };

package/coordinator/index.d.ts

@@ -0,0 +1,19 @@
+/* auto-generated by NAPI-RS */
+/* eslint-disable */
+
+export declare class CoordinatorClient {
+  constructor(config: import('./client').CoordinatorClientConfig)
+  start(token: string, idempotencyKey: string, request: import('./client').StartRunRequest): Promise<import('./client').CoordinatorOutcome<import('./client').RunStatus>>
+  workflow(token: string, workflow: string): Promise<import('./client').CoordinatorOutcome<import('./client').WorkflowContract>>
+  status(token: string, runId: import('./client').RunId): Promise<import('./client').CoordinatorOutcome<import('./client').RunStatus>>
+  inspect(token: string, runId: import('./client').RunId): Promise<import('./client').CoordinatorOutcome<import('./client').RunInspection>>
+  reconcile(token: string, runId: import('./client').RunId, reason: string): Promise<import('./client').CoordinatorOutcome<import('./client').RunInspection>>
+  list(token: string, limit: number, cursor?: string | null, state?: import('./client').RunListState | null, attention?: boolean | null, proposal?: string | null, turn?: import('./client').ProposalTurn | null): Promise<import('./client').CoordinatorOutcome<import('./client').RunList>>
+  retrySame(token: string, runId: import('./client').RunId, reason: string): Promise<import('./client').CoordinatorOutcome<import('./client').RetryScheduled>>
+  cancel(token: string, runId: import('./client').RunId, reason: string): Promise<import('./client').CoordinatorOutcome<import('./client').RunStatus>>
+}
+
+export interface CoordinatorOutcome {
+  kind: 'complete'
+  value: unknown
+}

package/coordinator/index.js

@@ -0,0 +1,3 @@
+'use strict';
+
+module.exports = require('../native').load('coordinator');

package/discovery/client.d.ts

@@ -2,10 +2,10 @@ export type ServiceKind = 'evidence';
 
 export interface DiscoveryClientOptions {
   baseUrl: string;
-  requestTimeoutMilliseconds?: number;
+  attemptTimeoutMilliseconds?: number;
   connectTimeoutMilliseconds?: number;
   maximumResponseBytes?: number;
-  trustedRootCertificates?: Buffer;
+  trustedRootCertificates?: string;
 }
 
 export interface EvidenceTypeResolveRequest {

package/discovery/client.js

@@ -158,7 +158,7 @@ function configurationValue(options) {
   }
   const allowed = new Set([
     'baseUrl',
-    'requestTimeoutMilliseconds',
+    'attemptTimeoutMilliseconds',
     'connectTimeoutMilliseconds',
     'maximumResponseBytes',
     'trustedRootCertificates',
@@ -172,10 +172,10 @@ function configurationValue(options) {
     }
     const value = descriptor.value;
     if (key === 'trustedRootCertificates') {
-      if (!Buffer.isBuffer(value) || value.length > 4 * 1024 * 1024) {
+      if (typeof value !== 'string' || Buffer.byteLength(value, 'utf8') > 4 * 1024 * 1024) {
         throw inputError('configuration');
       }
-      copy[key] = Buffer.from(value);
+      copy[key] = value;
     } else if (key === 'baseUrl') {
       if (typeof value !== 'string') throw inputError('configuration');
       copy[key] = value;

package/discovery/index.d.ts

@@ -13,10 +13,10 @@ export declare class DiscoveryClient {
 
 export interface DiscoveryClientOptions {
   baseUrl: string
-  requestTimeoutMilliseconds?: number
+  attemptTimeoutMilliseconds?: number
   connectTimeoutMilliseconds?: number
   maximumResponseBytes?: number
-  trustedRootCertificates?: Buffer
+  trustedRootCertificates?: string
 }
 
 export declare function renewUnchangedSelection(previous: any, current: any): any

package/evidence/client.d.ts

@@ -73,7 +73,7 @@ export type ProgressiveResult =
   | ({ readonly responseFormat: 'sd-jwt-vc' } & ProgressiveVerifiedAudienceScopedCredential)
 
 export type AudienceScopedRequest = {
-  requirement: string
+  handle: string
   responseFormat?: EvidenceResponseFormat
   /** One request-origin subject. Node keeps the selector map explicit. */
   selectors?: Readonly<Record<string, string | number | boolean>>
@@ -120,8 +120,8 @@ export interface PrivateKeyJwtConfig {
   scopes?: ReadonlyArray<string>
   assertionLifetimeSeconds?: number
   refreshMarginSeconds?: number
-  requestTimeoutMs?: number
-  connectTimeoutMs?: number
+  attemptTimeoutMilliseconds?: number
+  connectTimeoutMilliseconds?: number
   userAgent?: string
   /** Additional trust roots for the token endpoint, as a PEM bundle. */
   trustedRootCertificates?: string
@@ -151,11 +151,8 @@ export interface EvidenceExchangeContext {
  * This is not a `PrivateKeyJwtConfig`, even though the two describe the same
  * kind of client: an exchange is pinned to one resource and scope set, so both
  * are required here, and the object is read by the shared exchange
- * configuration parser rather than by the binding's own reader, so its timeout
- * members are the full-word ones that parser accepts. State at most one of
- * `requestTimeoutMilliseconds` and `requestTimeoutSeconds`, and at most one of
- * `connectTimeoutMilliseconds` and `connectTimeoutSeconds`; naming both of a
- * pair is refused.
+ * configuration parser rather than by the binding's own reader. Node exposes
+ * both timeout controls in milliseconds.
  */
 export interface EvidenceExchangeClientConfig {
   tokenEndpoint: string
@@ -180,10 +177,8 @@ export interface EvidenceExchangeClientConfig {
   scopes: ReadonlyArray<string>
   assertionLifetimeSeconds?: number
   refreshMarginSeconds?: number
-  requestTimeoutMilliseconds?: number
-  requestTimeoutSeconds?: number
+  attemptTimeoutMilliseconds?: number
   connectTimeoutMilliseconds?: number
-  connectTimeoutSeconds?: number
   userAgent?: string
   /** Additional trust roots for the token endpoint, as a PEM bundle. */
   trustedRootCertificates?: string
@@ -195,10 +190,8 @@ export interface EvidenceExchangeRemoteSourceConfig {
   bootstrap: EvidenceExchangeClientConfig
   bootstrapResource: string
   bootstrapScope: string
-  requestTimeoutMilliseconds?: number
-  requestTimeoutSeconds?: number
+  attemptTimeoutMilliseconds?: number
   connectTimeoutMilliseconds?: number
-  connectTimeoutSeconds?: number
   userAgent?: string
   /** Additional trust roots for the authority, as a PEM bundle. */
   trustedRootCertificates?: string
@@ -220,12 +213,12 @@ export interface EvidenceClientConfig {
   /** Configure exactly one of `token` or `authorization`. */
   token?: EvidenceTokenConfig
   authorization?: { exchange: EvidenceExchangeAuthorizationConfig }
-  requestTimeoutMs?: number
-  connectTimeoutMs?: number
+  attemptTimeoutMilliseconds?: number
+  connectTimeoutMilliseconds?: number
   userAgent?: string
   /** Additional trust roots for the deployment, as a PEM bundle. */
   trustedRootCertificates?: string
-  maxResponseBytes?: number
+  maximumResponseBytes?: number
   maxMetadataBytes?: number
 }
 
@@ -340,18 +333,18 @@ export interface EvidenceRequestBatchSpec {
 }
 
 /**
- * The stable eight-kind error envelope every mapped Evidence Node failure
+ * The stable ten-kind error envelope every mapped Evidence Node failure
  * carries, as properties on a thrown `Error` (see `src/lib.rs`'s
  * `to_napi_error` and `src/convert.rs`'s `map_client_error` for the Rust side
  * of this contract).
  *
  * `kind` is always present. The rest are present only when the underlying
  * failure carries them:
- * - `status`: `denied`, `protocol`, and any `token` failure whose `tokenKind`
+ * - `status`: `denied`, `invalid-request`, `unavailable`, `protocol`, and any `token` failure whose `tokenKind`
  *   is `protocol`
- * - `code`: `denied`, `protocol` (optional), `verification`, and any `token`
+ * - `code`: `denied`, `invalid-request`, `unavailable`, `protocol` (optional), `verification`, and any `token`
  *   failure whose `tokenKind` is `refused`
- * - `traceId`: `denied`, `not-available`, `protocol` (all optional)
+ * - `traceId`: `denied`, `not-available`, `invalid-request`, `unavailable`, `protocol` (all optional)
  * - `retryAfterSeconds`: `denied`, `protocol` (both optional)
  * - `transportKind`: `transport`, and any `token` failure whose `tokenKind`
  *   is `transport`

package/evidence/client.js

@@ -9,7 +9,7 @@
 const native = require('./index');
 
 /**
- * The stable eight-kind error envelope every mapped Evidence Node failure
+ * The stable ten-kind error envelope every mapped Evidence Node failure
  * carries (see `crates/registry-evidence-client-node/src/convert.rs`'s
  * `map_client_error`), as properties on a thrown `Error` rather than as JSON
  * text a caller has to `JSON.parse` out of `.message`.
@@ -45,7 +45,7 @@ class EvidenceClientError extends Error {
  * serialization defect, a caught panic, napi's own argument-type checking)
  * throws a plain, non-JSON reason instead, and is left exactly as thrown:
  * only a recognized envelope becomes an `EvidenceClientError`, so a caller
- * cannot mistake "some other native failure" for one of the eight stable
+ * cannot mistake "some other native failure" for one of the ten stable
  * kinds.
  */
 function normalize(error) {

package/evidence/index.d.ts

@@ -26,7 +26,7 @@ export declare class EvidenceClient {
    * mandatory trust inputs. A key set or revoked-key list the verifier could
    * never use is refused, exactly as the Rust configuration refuses it.
    *
-   * `maxResponseBytes` bounds the signed response `send` reads.
+   * `maximumResponseBytes` bounds the signed response `send` reads.
    * `maxMetadataBytes` bounds the documents `discover` and `fetchJwks` read,
    * which are neither signed nor verified, and is a separate decision.
    */

package/index.d.ts

@@ -1,3 +1,4 @@
+import * as coordinator from './coordinator/client'
 import * as discovery from './discovery/client'
 import * as evidence from './evidence/client'
 import * as breg from './breg/client'
@@ -5,4 +6,4 @@ import * as casework from './casework/client'
 import * as messaging from './messaging/client'
 import * as scheduling from './scheduling/client'
 
-export { discovery, evidence, breg, casework, messaging, scheduling }
+export { discovery, evidence, breg, casework, messaging, scheduling, coordinator }

package/index.js

@@ -2,10 +2,11 @@
 
 // One assignment per namespace, never a `module.exports` object literal: Node
 // scans this file for these statements to synthesise the named exports an ESM
-// consumer imports, and `require()` sees the same six properties either way.
+// consumer imports, and `require()` sees the same product properties either way.
 exports.discovery = require('./discovery/client');
 exports.evidence = require('./evidence/client');
 exports.breg = require('./breg/client');
 exports.casework = require('./casework/client');
 exports.messaging = require('./messaging/client');
 exports.scheduling = require('./scheduling/client');
+exports.coordinator = require('./coordinator/client');

package/messaging/client.d.ts

@@ -9,18 +9,19 @@ export type JsonValue = JsonScalar | ReadonlyArray<JsonValue> | { readonly [key:
 
 export interface MessagingClientConfig {
   baseUrl: string
-  requestTimeoutMilliseconds?: SafeInteger | null
-  connectTimeoutMilliseconds?: SafeInteger | null
-  maxResponseBytes?: SafeInteger | null
-  userAgent?: string | null
-  trustedRootCertificates?: string | null
+  attemptTimeoutMilliseconds?: SafeInteger
+  connectTimeoutMilliseconds?: SafeInteger
+  maximumResponseBytes?: SafeInteger
+  userAgent?: string
+  /** Additional trust roots for the deployment, as PEM text. */
+  trustedRootCertificates?: string
   /**
    * How many times a submission whose outcome is unknown is resent,
    * identically and under the same idempotency key, before its error is
    * returned: a whole number from 0 to 2, default 2; 0 sends it once. Any
    * other value is a `configuration` error.
    */
-  maxMutationRetries?: SafeInteger | null
+  maximumMutationRetries?: SafeInteger
 }
 
 export type Channel = 'email' | 'sms'

package/native.js

@@ -1,7 +1,7 @@
 'use strict';
 
-const PACKAGE_VERSION = '0.43.0';
-const PRODUCTS = new Set(['discovery', 'evidence', 'breg', 'casework', 'messaging', 'scheduling']);
+const PACKAGE_VERSION = '0.45.0';
+const PRODUCTS = new Set(["breg", "casework", "coordinator", "discovery", "evidence", "messaging", "scheduling"]);
 
 function target() {
   if (process.platform === 'darwin' && process.arch === 'arm64') return 'darwin-arm64';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@registrystack/client",
-  "version": "0.43.0",
+  "version": "0.45.0",
   "description": "Unified Node.js client for Registry Stack products.",
   "license": "Apache-2.0",
   "homepage": "https://docs.registrystack.org/reference/client-api/",
@@ -15,7 +15,9 @@
     "breg",
     "casework",
     "messaging",
-    "scheduling"
+    "scheduling",
+    "render",
+    "coordinator"
   ],
   "publishConfig": {
     "access": "public",
@@ -32,18 +34,25 @@
     ".": {
       "types": "./index.d.ts",
       "default": "./index.js"
+    },
+    "./compatibility.json": "./compatibility.json",
+    "./coordinator": {
+      "types": "./coordinator/client.d.ts",
+      "default": "./coordinator/client.js"
     }
   },
   "files": [
     "index.js",
     "index.d.ts",
     "native.js",
+    "compatibility.json",
     "discovery",
     "evidence",
     "breg",
     "casework",
     "messaging",
-    "scheduling"
+    "scheduling",
+    "coordinator"
   ],
   "engines": {
     "node": ">=24.11.0"
@@ -59,8 +68,8 @@
     "typescript": "6.0.3"
   },
   "optionalDependencies": {
-    "@registrystack/client-darwin-arm64": "0.43.0",
-    "@registrystack/client-linux-arm64-gnu": "0.43.0",
-    "@registrystack/client-linux-x64-gnu": "0.43.0"
+    "@registrystack/client-darwin-arm64": "0.45.0",
+    "@registrystack/client-linux-arm64-gnu": "0.45.0",
+    "@registrystack/client-linux-x64-gnu": "0.45.0"
   }
 }