kadi-harness-runtime 0.1.8

package/dist/scheduling/request-store.js

@@ -0,0 +1,173 @@
+import { createHash, randomUUID } from "node:crypto";
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { RunRequestSchema, } from "@kadi.build/kadi-harness-contracts";
+/** Maximum size of the serialized request kept in the request store. */
+export const MAX_REQUEST_PAYLOAD_BYTES = 64 * 1024;
+const SENSITIVE_KEY = /token|secret|password|authorization|credential|api[-_]?key|private[-_]?key/i;
+export class ScheduledRequestStoreError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = "ScheduledRequestStoreError";
+        this.code = code;
+    }
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function assertSerializable(value, path) {
+    if (value === null || typeof value === "string" || typeof value === "boolean")
+        return;
+    if (typeof value === "number") {
+        if (Number.isFinite(value))
+            return;
+        throw new ScheduledRequestStoreError("invalid_request", `${path} must contain finite numbers`);
+    }
+    if (Array.isArray(value)) {
+        value.forEach((item, index) => assertSerializable(item, `${path}[${index}]`));
+        return;
+    }
+    if (!isRecord(value) || Object.getPrototypeOf(value) !== Object.prototype) {
+        throw new ScheduledRequestStoreError("invalid_request", `${path} must be JSON-serializable`);
+    }
+    for (const [key, child] of Object.entries(value)) {
+        if (child === undefined) {
+            throw new ScheduledRequestStoreError("invalid_request", `${path}.${key} cannot be undefined`);
+        }
+        if (SENSITIVE_KEY.test(key)) {
+            throw new ScheduledRequestStoreError("sensitive_data", `${path}.${key} contains credential material and cannot be scheduled`);
+        }
+        assertSerializable(child, `${path}.${key}`);
+    }
+}
+function validateSpec(spec) {
+    if (!isRecord(spec)) {
+        throw new ScheduledRequestStoreError("invalid_request", "ScheduledRunSpec must be an object");
+    }
+    if (!spec.idempotencyPrefix || typeof spec.idempotencyPrefix !== "string") {
+        throw new ScheduledRequestStoreError("invalid_request", "idempotencyPrefix is required");
+    }
+    try {
+        RunRequestSchema.parse(spec.run);
+    }
+    catch (error) {
+        throw new ScheduledRequestStoreError("invalid_request", `run request failed contract validation: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    assertSerializable(spec, "spec");
+}
+/**
+ * Serialize JSON with recursively sorted object keys. This produces the same
+ * bytes across processes and languages for the same scheduled request.
+ */
+export function canonicalizeJson(value) {
+    assertSerializable(value, "value");
+    const encode = (input) => {
+        if (input === null || typeof input === "string" || typeof input === "boolean") {
+            return JSON.stringify(input);
+        }
+        if (typeof input === "number")
+            return JSON.stringify(input);
+        if (Array.isArray(input))
+            return `[${input.map(encode).join(",")}]`;
+        return `{${Object.keys(input).sort().map((key) => `${JSON.stringify(key)}:${encode(input[key])}`).join(",")}}`;
+    };
+    return encode(value);
+}
+export function sha256Digest(canonicalPayload) {
+    return createHash("sha256").update(canonicalPayload, "utf8").digest("hex");
+}
+/** In-memory reference store used by tests and embedders that provide a durable wrapper. */
+export class InMemoryScheduledRequestStore {
+    records = new Map();
+    refFactory;
+    clock;
+    constructor(options = {}) {
+        this.refFactory = options.refFactory ?? randomUUID;
+        this.clock = options.clock ?? (() => new Date());
+    }
+    async put(spec, options = {}) {
+        validateSpec(spec);
+        const canonicalPayload = canonicalizeJson(spec);
+        if (Buffer.byteLength(canonicalPayload, "utf8") > MAX_REQUEST_PAYLOAD_BYTES) {
+            throw new ScheduledRequestStoreError("request_too_large", `serialized request exceeds the ${MAX_REQUEST_PAYLOAD_BYTES}-byte limit`);
+        }
+        const record = {
+            requestRef: options.requestRef ?? this.refFactory(),
+            canonicalPayload,
+            payloadDigest: sha256Digest(canonicalPayload),
+            spec,
+            createdAt: (options.createdAt ?? this.clock()).toISOString(),
+        };
+        if (this.records.has(record.requestRef)) {
+            throw new ScheduledRequestStoreError("invalid_request", `request reference already exists: ${record.requestRef}`);
+        }
+        this.records.set(record.requestRef, record);
+        return record;
+    }
+    async get(requestRef) {
+        return this.records.get(requestRef);
+    }
+}
+/**
+ * Small durable request store for a runner host. Deployments can replace this
+ * with an encrypted KADI artifact/database implementation without changing
+ * signing or verification.
+ */
+export class FileScheduledRequestStore {
+    directory;
+    refFactory;
+    clock;
+    constructor(options) {
+        this.directory = options.directory;
+        this.refFactory = options.refFactory ?? randomUUID;
+        this.clock = options.clock ?? (() => new Date());
+    }
+    async put(spec, options = {}) {
+        validateSpec(spec);
+        const canonicalPayload = canonicalizeJson(spec);
+        if (Buffer.byteLength(canonicalPayload, "utf8") > MAX_REQUEST_PAYLOAD_BYTES) {
+            throw new ScheduledRequestStoreError("request_too_large", `serialized request exceeds the ${MAX_REQUEST_PAYLOAD_BYTES}-byte limit`);
+        }
+        const record = {
+            requestRef: options.requestRef ?? this.refFactory(),
+            canonicalPayload,
+            payloadDigest: sha256Digest(canonicalPayload),
+            spec,
+            createdAt: (options.createdAt ?? this.clock()).toISOString(),
+        };
+        const path = this.pathFor(record.requestRef);
+        await mkdir(this.directory, { recursive: true, mode: 0o700 });
+        try {
+            await readFile(path);
+            throw new ScheduledRequestStoreError("invalid_request", `request reference already exists: ${record.requestRef}`);
+        }
+        catch (error) {
+            if (!(error instanceof Error) || !("code" in error) || error.code !== "ENOENT")
+                throw error;
+        }
+        const temporaryPath = `${path}.${randomUUID()}.tmp`;
+        await writeFile(temporaryPath, JSON.stringify(record), { encoding: "utf8", mode: 0o600 });
+        await rename(temporaryPath, path);
+        return record;
+    }
+    async get(requestRef) {
+        const path = this.pathFor(requestRef);
+        try {
+            const content = await readFile(path, "utf8");
+            return JSON.parse(content);
+        }
+        catch (error) {
+            if (error instanceof Error && "code" in error && error.code === "ENOENT")
+                return undefined;
+            throw error;
+        }
+    }
+    pathFor(requestRef) {
+        if (!/^[A-Za-z0-9._:-]+$/.test(requestRef)) {
+            throw new ScheduledRequestStoreError("invalid_request", "request reference contains unsafe path characters");
+        }
+        return join(this.directory, `${requestRef}.json`);
+    }
+}
+//# sourceMappingURL=request-store.js.map

package/dist/scheduling/request-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-store.js","sourceRoot":"","sources":["../../src/scheduling/request-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,gBAAgB,GAIjB,MAAM,oCAAoC,CAAC;AAE5C,wEAAwE;AACxE,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnD,MAAM,aAAa,GAAG,6EAA6E,CAAC;AA6BpG,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IACnC,IAAI,CAA6D;IAEjF,YACE,IAAgE,EAChE,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;QACzC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc,EAAE,IAAY;IACtD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO;IACtF,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO;QACnC,MAAM,IAAI,0BAA0B,CAAC,iBAAiB,EAAE,GAAG,IAAI,8BAA8B,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;QAC9E,OAAO;IACT,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;QAC1E,MAAM,IAAI,0BAA0B,CAAC,iBAAiB,EAAE,GAAG,IAAI,4BAA4B,CAAC,CAAC;IAC/F,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,0BAA0B,CAAC,iBAAiB,EAAE,GAAG,IAAI,IAAI,GAAG,sBAAsB,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,0BAA0B,CAClC,gBAAgB,EAChB,GAAG,IAAI,IAAI,GAAG,uDAAuD,CACtE,CAAC;QACJ,CAAC;QACD,kBAAkB,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAsB;IAC1C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,0BAA0B,CAAC,iBAAiB,EAAE,oCAAoC,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,OAAO,IAAI,CAAC,iBAAiB,KAAK,QAAQ,EAAE,CAAC;QAC1E,MAAM,IAAI,0BAA0B,CAAC,iBAAiB,EAAE,+BAA+B,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,CAAC;QACH,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,0BAA0B,CAClC,iBAAiB,EACjB,2CAA2C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACpG,CAAC;IACJ,CAAC;IACD,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAEnC,MAAM,MAAM,GAAG,CAAC,KAAgB,EAAU,EAAE;QAC1C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9E,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC5D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QACpE,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAE,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAClH,CAAC,CAAC;IAEF,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,gBAAwB;IACnD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,4FAA4F;AAC5F,MAAM,OAAO,6BAA6B;IACvB,OAAO,GAAG,IAAI,GAAG,EAAkC,CAAC;IACpD,UAAU,CAAe;IACzB,KAAK,CAAa;IAEnC,YAAmB,UAA+E,EAAE;QAClG,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,UAAU,CAAC;QACnD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;IAEM,KAAK,CAAC,GAAG,CACd,IAAsB,EACtB,UAAkC,EAAE;QAEpC,YAAY,CAAC,IAAI,CAAC,CAAC;QACnB,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,MAAM,CAAC,UAAU,CAAC,gBAAgB,EAAE,MAAM,CAAC,GAAG,yBAAyB,EAAE,CAAC;YAC5E,MAAM,IAAI,0BAA0B,CAClC,mBAAmB,EACnB,kCAAkC,yBAAyB,aAAa,CACzE,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAA2B;YACrC,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,EAAE;YACnD,gBAAgB;YAChB,aAAa,EAAE,YAAY,CAAC,gBAAgB,CAAC;YAC7C,IAAI;YACJ,SAAS,EAAE,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE;SAC7D,CAAC;QACF,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,0BAA0B,CAAC,iBAAiB,EAAE,qCAAqC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QACpH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC5C,OAAO,MAAM,CAAC;IAChB,CAAC;IAEM,KAAK,CAAC,GAAG,CAAC,UAAkB;QACjC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACtC,CAAC;CACF;AAQD;;;;GAIG;AACH,MAAM,OAAO,yBAAyB;IACnB,SAAS,CAAS;IAClB,UAAU,CAAe;IACzB,KAAK,CAAa;IAEnC,YAAmB,OAAyC;QAC1D,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,UAAU,CAAC;QACnD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;IAEM,KAAK,CAAC,GAAG,CACd,IAAsB,EACtB,UAAkC,EAAE;QAEpC,YAAY,CAAC,IAAI,CAAC,CAAC;QACnB,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,MAAM,CAAC,UAAU,CAAC,gBAAgB,EAAE,MAAM,CAAC,GAAG,yBAAyB,EAAE,CAAC;YAC5E,MAAM,IAAI,0BAA0B,CAClC,mBAAmB,EACnB,kCAAkC,yBAAyB,aAAa,CACzE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAA2B;YACrC,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,EAAE;YACnD,gBAAgB;YAChB,aAAa,EAAE,YAAY,CAAC,gBAAgB,CAAC;YAC7C,IAAI;YACJ,SAAS,EAAE,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE;SAC7D,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC7C,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;YACrB,MAAM,IAAI,0BAA0B,CAAC,iBAAiB,EAAE,qCAAqC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QACpH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QACzH,CAAC;QACD,MAAM,aAAa,GAAG,GAAG,IAAI,IAAI,UAAU,EAAE,MAAM,CAAC;QACpD,MAAM,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1F,MAAM,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QAClC,OAAO,MAAM,CAAC;IAChB,CAAC;IAEM,KAAK,CAAC,GAAG,CAAC,UAAkB;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAA2B,CAAC;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAC;YACtH,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,OAAO,CAAC,UAAkB;QAChC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,0BAA0B,CAAC,iBAAiB,EAAE,mDAAmD,CAAC,CAAC;QAC/G,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,UAAU,OAAO,CAAC,CAAC;IACpD,CAAC;CACF"}

package/dist/scheduling/signing.d.ts

@@ -0,0 +1,57 @@
+import { type KeyLike } from "node:crypto";
+import { type ScheduledRunSpec, type ScheduledRequestStore, type StoredScheduledRequest } from "./request-store.js";
+export declare const RUNNER_AUDIENCE = "kadi-harness-runner";
+export interface SigningKey {
+    readonly keyId: string;
+    readonly privateKey: KeyLike;
+    readonly publicKey?: KeyLike;
+}
+/** Adapter for secret-ability or another durable KADI key-management service. */
+export interface SigningKeyProvider {
+    getActiveKey(): Promise<SigningKey>;
+    getPublicKey(keyId: string): Promise<KeyLike | undefined>;
+}
+export interface ReplayGuard {
+    claim(idempotencyKey: string, expiresAt: string): Promise<boolean>;
+}
+export declare class InMemoryReplayGuard implements ReplayGuard {
+    private readonly claims;
+    private readonly now;
+    constructor(now?: () => number);
+    claim(idempotencyKey: string, expiresAt: string): Promise<boolean>;
+}
+export interface SignedScheduledRequest {
+    readonly requestRef: string;
+    readonly payloadDigest: string;
+    readonly keyId: string;
+    readonly audience: string;
+    readonly createdAt: string;
+    readonly expiresAt: string;
+    readonly idempotencyKey: string;
+    readonly signature: string;
+}
+export interface CreateSignedRequestOptions {
+    readonly expiresAt: Date | string;
+    readonly createdAt?: Date | string;
+    readonly idempotencyKey?: string;
+    readonly firingId?: string;
+    readonly audience?: string;
+    readonly requestRef?: string;
+}
+export interface VerifySignedRequestOptions {
+    readonly store: ScheduledRequestStore;
+    readonly keyProvider: SigningKeyProvider;
+    readonly replayGuard: ReplayGuard;
+    readonly now?: () => Date;
+    readonly audience?: string;
+}
+export declare class ScheduledRequestSigningError extends Error {
+    readonly code: "invalid_signature" | "unknown_key" | "expired" | "wrong_audience" | "request_not_found" | "payload_mismatch" | "replayed" | "invalid_envelope";
+    constructor(code: ScheduledRequestSigningError["code"], message: string);
+}
+export declare function createSignedScheduledRequest(store: ScheduledRequestStore, keyProvider: SigningKeyProvider, spec: ScheduledRunSpec, options: CreateSignedRequestOptions): Promise<{
+    readonly reference: SignedScheduledRequest;
+    readonly stored: StoredScheduledRequest;
+}>;
+export declare function verifySignedScheduledRequest(reference: SignedScheduledRequest, options: VerifySignedRequestOptions): Promise<StoredScheduledRequest>;
+//# sourceMappingURL=signing.d.ts.map

package/dist/scheduling/signing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../../src/scheduling/signing.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,OAAO,EACb,MAAM,aAAa,CAAC;AACrB,OAAO,EAAkC,KAAK,gBAAgB,EAAE,KAAK,qBAAqB,EAAE,KAAK,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAEpJ,eAAO,MAAM,eAAe,wBAAwB,CAAC;AAErD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,iFAAiF;AACjF,MAAM,WAAW,kBAAkB;IACjC,YAAY,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;IACpC,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;CAC3D;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACpE;AAED,qBAAa,mBAAoB,YAAW,WAAW;IACrD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;IACpD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEhB,GAAG,GAAE,MAAM,MAAiB;IAIlC,KAAK,CAAC,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAShF;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,SAAS,EAAE,IAAI,GAAG,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;IACnC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAC;IACzC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,SAAgB,IAAI,EAChB,mBAAmB,GACnB,aAAa,GACb,SAAS,GACT,gBAAgB,GAChB,mBAAmB,GACnB,kBAAkB,GAClB,UAAU,GACV,kBAAkB,CAAC;gBAGrB,IAAI,EAAE,4BAA4B,CAAC,MAAM,CAAC,EAC1C,OAAO,EAAE,MAAM;CAMlB;AAgDD,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,qBAAqB,EAC5B,WAAW,EAAE,kBAAkB,EAC/B,IAAI,EAAE,gBAAgB,EACtB,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC;IAAE,QAAQ,CAAC,SAAS,EAAE,sBAAsB,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,CAAC,CAuBlG;AAED,wBAAsB,4BAA4B,CAChD,SAAS,EAAE,sBAAsB,EACjC,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,sBAAsB,CAAC,CA6CjC"}

package/dist/scheduling/signing.js

@@ -0,0 +1,142 @@
+import { sign as ed25519Sign, timingSafeEqual, verify as ed25519Verify, } from "node:crypto";
+import { canonicalizeJson, sha256Digest } from "./request-store.js";
+export const RUNNER_AUDIENCE = "kadi-harness-runner";
+export class InMemoryReplayGuard {
+    claims = new Map();
+    now;
+    constructor(now = Date.now) {
+        this.now = now;
+    }
+    async claim(idempotencyKey, expiresAt) {
+        const now = this.now();
+        for (const [key, expiry] of this.claims) {
+            if (expiry <= now)
+                this.claims.delete(key);
+        }
+        if (this.claims.has(idempotencyKey))
+            return false;
+        this.claims.set(idempotencyKey, Date.parse(expiresAt));
+        return true;
+    }
+}
+export class ScheduledRequestSigningError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = "ScheduledRequestSigningError";
+        this.code = code;
+    }
+}
+function canonicalClaims(input) {
+    return JSON.stringify({
+        audience: input.audience,
+        createdAt: input.createdAt,
+        expiresAt: input.expiresAt,
+        idempotencyKey: input.idempotencyKey,
+        keyId: input.keyId,
+        payloadDigest: input.payloadDigest,
+        requestRef: input.requestRef,
+    });
+}
+function cryptoBytes(value, encoding = "utf8") {
+    const source = Buffer.from(value, encoding);
+    const copy = new Uint8Array(source.byteLength);
+    copy.set(source);
+    return copy;
+}
+function asIso(value, field) {
+    const date = value instanceof Date ? value : new Date(value);
+    if (Number.isNaN(date.getTime()))
+        throw new ScheduledRequestSigningError("invalid_envelope", `${field} must be a valid date`);
+    return date.toISOString();
+}
+function constantTimeEqual(left, right) {
+    const a = cryptoBytes(left);
+    const b = cryptoBytes(right);
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+function resolveIdempotencyKey(spec, options, requestRef) {
+    const key = options.idempotencyKey ?? spec.run.idempotencyKey ??
+        `${spec.idempotencyPrefix}:${options.firingId ?? spec.scheduleId ?? requestRef}`;
+    if (!key || key.length > 512)
+        throw new ScheduledRequestSigningError("invalid_envelope", "idempotency key is required and must be <= 512 characters");
+    return key;
+}
+export async function createSignedScheduledRequest(store, keyProvider, spec, options) {
+    const stored = await store.put(spec, { requestRef: options.requestRef, createdAt: options.createdAt instanceof Date ? options.createdAt : options.createdAt ? new Date(options.createdAt) : undefined });
+    const key = await keyProvider.getActiveKey();
+    if (!key.keyId || !key.privateKey)
+        throw new ScheduledRequestSigningError("invalid_envelope", "active signing key must include keyId and privateKey");
+    const audience = options.audience ?? RUNNER_AUDIENCE;
+    const createdAt = stored.createdAt;
+    const expiresAt = asIso(options.expiresAt, "expiresAt");
+    if (Date.parse(expiresAt) <= Date.parse(createdAt))
+        throw new ScheduledRequestSigningError("invalid_envelope", "expiresAt must be after createdAt");
+    const idempotencyKey = resolveIdempotencyKey(spec, options, stored.requestRef);
+    const claims = canonicalClaims({
+        requestRef: stored.requestRef,
+        payloadDigest: stored.payloadDigest,
+        keyId: key.keyId,
+        audience,
+        createdAt,
+        expiresAt,
+        idempotencyKey,
+    });
+    const signature = ed25519Sign(null, cryptoBytes(claims), key.privateKey).toString("base64url");
+    return {
+        stored,
+        reference: { requestRef: stored.requestRef, payloadDigest: stored.payloadDigest, keyId: key.keyId, audience, createdAt, expiresAt, idempotencyKey, signature },
+    };
+}
+export async function verifySignedScheduledRequest(reference, options) {
+    const audience = options.audience ?? RUNNER_AUDIENCE;
+    if (reference.audience !== audience)
+        throw new ScheduledRequestSigningError("wrong_audience", `expected audience ${audience}`);
+    if (!reference.requestRef || !reference.payloadDigest || !reference.keyId || !reference.signature || !reference.idempotencyKey) {
+        throw new ScheduledRequestSigningError("invalid_envelope", "signed request is missing required fields");
+    }
+    const expiresAt = Date.parse(reference.expiresAt);
+    const createdAt = Date.parse(reference.createdAt);
+    const now = (options.now ?? (() => new Date()))().getTime();
+    if (!Number.isFinite(createdAt) || !Number.isFinite(expiresAt) || expiresAt <= createdAt) {
+        throw new ScheduledRequestSigningError("invalid_envelope", "signed request has invalid timestamps");
+    }
+    if (createdAt > now)
+        throw new ScheduledRequestSigningError("invalid_envelope", "scheduled request was created in the future");
+    if (expiresAt <= now)
+        throw new ScheduledRequestSigningError("expired", "scheduled request has expired");
+    const stored = await options.store.get(reference.requestRef);
+    if (!stored)
+        throw new ScheduledRequestSigningError("request_not_found", `request reference not found: ${reference.requestRef}`);
+    try {
+        const canonicalPayload = canonicalizeJson(stored.spec);
+        if (canonicalPayload !== stored.canonicalPayload ||
+            !constantTimeEqual(sha256Digest(canonicalPayload), stored.payloadDigest) ||
+            !constantTimeEqual(stored.payloadDigest, reference.payloadDigest)) {
+            throw new ScheduledRequestSigningError("payload_mismatch", "stored request contents do not match the signed digest");
+        }
+    }
+    catch (error) {
+        if (error instanceof ScheduledRequestSigningError)
+            throw error;
+        throw new ScheduledRequestSigningError("payload_mismatch", "stored request contents are invalid");
+    }
+    const publicKey = await options.keyProvider.getPublicKey(reference.keyId);
+    if (!publicKey)
+        throw new ScheduledRequestSigningError("unknown_key", `unknown signing key: ${reference.keyId}`);
+    const claims = canonicalClaims(reference);
+    let valid = false;
+    try {
+        valid = ed25519Verify(null, cryptoBytes(claims), publicKey, cryptoBytes(reference.signature, "base64url"));
+    }
+    catch {
+        valid = false;
+    }
+    if (!valid)
+        throw new ScheduledRequestSigningError("invalid_signature", "signed request signature is invalid");
+    if (!(await options.replayGuard.claim(reference.idempotencyKey, reference.expiresAt))) {
+        throw new ScheduledRequestSigningError("replayed", `idempotency key already consumed: ${reference.idempotencyKey}`);
+    }
+    return stored;
+}
+//# sourceMappingURL=signing.js.map

package/dist/scheduling/signing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing.js","sourceRoot":"","sources":["../../src/scheduling/signing.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,IAAI,IAAI,WAAW,EACnB,eAAe,EACf,MAAM,IAAI,aAAa,GAExB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAkF,MAAM,oBAAoB,CAAC;AAEpJ,MAAM,CAAC,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAkBrD,MAAM,OAAO,mBAAmB;IACb,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACnC,GAAG,CAAe;IAEnC,YAAmB,MAAoB,IAAI,CAAC,GAAG;QAC7C,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAEM,KAAK,CAAC,KAAK,CAAC,cAAsB,EAAE,SAAiB;QAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACxC,IAAI,MAAM,IAAI,GAAG;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC;YAAE,OAAO,KAAK,CAAC;QAClD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AA8BD,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACrC,IAAI,CAQG;IAEvB,YACE,IAA0C,EAC1C,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;QAC3C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,SAAS,eAAe,CAAC,KAQxB;IACC,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,KAAa,EAAE,WAA2B,MAAM;IACnE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC/C,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,KAAK,CAAC,KAAoB,EAAE,KAAa;IAChD,MAAM,IAAI,GAAG,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7D,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAAE,MAAM,IAAI,4BAA4B,CAAC,kBAAkB,EAAE,GAAG,KAAK,uBAAuB,CAAC,CAAC;IAC9H,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,KAAa;IACpD,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAsB,EAAE,OAAmC,EAAE,UAAkB;IAC5G,MAAM,GAAG,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC,GAAG,CAAC,cAAc;QAC3D,GAAG,IAAI,CAAC,iBAAiB,IAAI,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,IAAI,UAAU,EAAE,CAAC;IACnF,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,4BAA4B,CAAC,kBAAkB,EAAE,2DAA2D,CAAC,CAAC;IACtJ,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,KAA4B,EAC5B,WAA+B,EAC/B,IAAsB,EACtB,OAAmC;IAEnC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IACzM,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,YAAY,EAAE,CAAC;IAC7C,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,UAAU;QAAE,MAAM,IAAI,4BAA4B,CAAC,kBAAkB,EAAE,sDAAsD,CAAC,CAAC;IACtJ,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,eAAe,CAAC;IACrD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IACnC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,4BAA4B,CAAC,kBAAkB,EAAE,mCAAmC,CAAC,CAAC;IACpJ,MAAM,cAAc,GAAG,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAC/E,MAAM,MAAM,GAAG,eAAe,CAAC;QAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ;QACR,SAAS;QACT,SAAS;QACT,cAAc;KACf,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/F,OAAO;QACL,MAAM;QACN,SAAS,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE;KAC/J,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,SAAiC,EACjC,OAAmC;IAEnC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,eAAe,CAAC;IACrD,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,4BAA4B,CAAC,gBAAgB,EAAE,qBAAqB,QAAQ,EAAE,CAAC,CAAC;IAC/H,IAAI,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,SAAS,CAAC,aAAa,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC;QAC/H,MAAM,IAAI,4BAA4B,CAAC,kBAAkB,EAAE,2CAA2C,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;IAC5D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,SAAS,EAAE,CAAC;QACzF,MAAM,IAAI,4BAA4B,CAAC,kBAAkB,EAAE,uCAAuC,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,SAAS,GAAG,GAAG;QAAE,MAAM,IAAI,4BAA4B,CAAC,kBAAkB,EAAE,6CAA6C,CAAC,CAAC;IAC/H,IAAI,SAAS,IAAI,GAAG;QAAE,MAAM,IAAI,4BAA4B,CAAC,SAAS,EAAE,+BAA+B,CAAC,CAAC;IAEzG,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC7D,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,4BAA4B,CAAC,mBAAmB,EAAE,gCAAgC,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC;IACjI,IAAI,CAAC;QACH,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvD,IACE,gBAAgB,KAAK,MAAM,CAAC,gBAAgB;YAC5C,CAAC,iBAAiB,CAAC,YAAY,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC,aAAa,CAAC;YACxE,CAAC,iBAAiB,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,aAAa,CAAC,EACjE,CAAC;YACD,MAAM,IAAI,4BAA4B,CAAC,kBAAkB,EAAE,wDAAwD,CAAC,CAAC;QACvH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,4BAA4B;YAAE,MAAM,KAAK,CAAC;QAC/D,MAAM,IAAI,4BAA4B,CAAC,kBAAkB,EAAE,qCAAqC,CAAC,CAAC;IACpG,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1E,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,4BAA4B,CAAC,aAAa,EAAE,wBAAwB,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;IACjH,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,aAAa,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IAC7G,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,GAAG,KAAK,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,4BAA4B,CAAC,mBAAmB,EAAE,qCAAqC,CAAC,CAAC;IAC/G,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACtF,MAAM,IAAI,4BAA4B,CAAC,UAAU,EAAE,qCAAqC,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC;IACtH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/package.json

@@ -0,0 +1,47 @@
+{
+  "name": "kadi-harness-runtime",
+  "version": "0.1.8",
+  "description": "Frontend-neutral KADI harness execution runtime API",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "bin": {
+    "kadi-harness-runner": "./dist/runner/cli.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "clean": "rm -rf dist",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  },
+  "keywords": [
+    "kadi",
+    "harness",
+    "runtime",
+    "adapter",
+    "execution"
+  ],
+  "author": "KADI Team",
+  "license": "MIT",
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "typescript": "^5.9.2",
+    "vitest": "^3.2.7"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "dependencies": {
+    "@kadi.build/kadi-harness-contracts": "^0.1.4"
+  }
+}