# PSSP Management SDK

Node.js client for PSSP's encrypted server-to-server management listener. It
authenticates an allowed service with its Ed25519 key and pins the Broker's
management X25519 public key. It never opens broker SQLite or invokes broker
CLI commands.

The package exposes `PsspManagementClient` with `provisionPrincipal`,
`listPrincipals`, `updatePrincipal`, and `deletePrincipal`. Generated
passwords are returned only from `provisionPrincipal`.

## Deploy as a local npm package

The SDK can be deployed with WebService without copying the full PSSP project
to the production host. Package it as a tarball from this directory:

```bash
npm pack
```

This creates a versioned archive such as
`oxrecorder-pssp-management-1.0.0.tgz`. Copy it into the WebService repository
(for example, `vendor/oxrecorder-pssp-management-1.0.0.tgz`) and reference that
archive in WebService `package.json`:

```json
{
  "dependencies": {
    "@oxrecorder/pssp-management": "file:vendor/oxrecorder-pssp-management-1.0.0.tgz"
  }
}
```

From the WebService repository, regenerate and commit `package-lock.json`:

```bash
npm install
```

Deploy the tarball with the WebService source. The production host then needs
only the WebService checkout and can install the exact SDK version with:

```bash
npm ci --omit=dev
```

When changing the SDK, bump its version in `package.json`, run `npm pack`
again, replace the vendored tarball, update the `file:` version in WebService,
and run `npm install` there to refresh its lockfile.