@amalgm/live 0.2.44 → 0.2.45

package/dist/contracts/content.d.ts

@@ -10,7 +10,7 @@
  * host effects; this file owns the shape and its laws.
  */
 import { type Checked } from './validate.js';
-export declare const CONTENT_CONTRACT = "amalgm-entity-content@3";
+export declare const CONTENT_CONTRACT = "amalgm-entity-content@4";
 export type ContentContract = typeof CONTENT_CONTRACT;
 export declare const MIN_CONTENT_BLOCK_BYTES: number;
 export declare const MAX_CONTENT_BLOCK_BYTES: number;

package/dist/contracts/content.js

@@ -10,7 +10,7 @@
  * host effects; this file owns the shape and its laws.
  */
 import { pass, fail, isRecord } from './validate.js';
-export const CONTENT_CONTRACT = 'amalgm-entity-content@3';
+export const CONTENT_CONTRACT = 'amalgm-entity-content@4';
 export const MIN_CONTENT_BLOCK_BYTES = 4 * 1024 * 1024;
 export const MAX_CONTENT_BLOCK_BYTES = 16 * 1024 * 1024;
 /** Maximum accepted block size. Kept as the public manifest-bound name. */

package/dist/contracts/index.d.ts

@@ -12,6 +12,7 @@ export * from './binding.js';
 export * from './presence.js';
 export * from './docs.js';
 export * from './content.js';
+export * from './protection.js';
 export * from './frames/stream.js';
 export * from './frames/gateway.js';
 export * from './frames/tunnel.js';

package/dist/contracts/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/contracts/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/contracts/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC"}

package/dist/contracts/index.js

@@ -12,6 +12,7 @@ export * from './binding.js';
 export * from './presence.js';
 export * from './docs.js';
 export * from './content.js';
+export * from './protection.js';
 export * from './frames/stream.js';
 export * from './frames/gateway.js';
 export * from './frames/tunnel.js';

package/dist/contracts/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/contracts/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/contracts/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC"}

package/dist/contracts/protection.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Opening sealed private-resource envelopes.
+ *
+ * The gateway is the format's producer: it derives a per-resource key from
+ * its root secret and seals every object it puts in content storage as an
+ * AES-256-GCM envelope whose AAD binds resource, contract, and purpose.
+ * A runtime holding its resource key — handed once over the authenticated
+ * tunnel — opens those objects after fetching them directly from storage.
+ * This module is that opener: portable (WebCrypto, no platform imports) so
+ * any host the SDK supports can consume protected content.
+ */
+export declare const PROTECTED_ENVELOPE_FORMAT = "amalgm.private.entity-content.aes-256-gcm@2";
+export declare const PROTECTED_ENVELOPE_MAGIC = "AMGEC002";
+/** The binding an envelope was sealed under; opening must present the same. */
+export interface ProtectionBinding {
+    readonly resourceId: string;
+    readonly contract: string;
+    readonly purpose: string;
+}
+export declare class ProtectionError extends Error {
+    constructor(message: string);
+}
+/** Open one binary storage envelope to verified plaintext. The fixed layout is
+ * `magic | iv | tag | ciphertext`; content never pays JSON/base64 expansion.
+ * Refuses anything malformed, tampered with, or sealed under a different key
+ * or binding. */
+export declare function openProtectedEnvelopeBytes(key: Uint8Array, bytes: Uint8Array, binding: ProtectionBinding): Promise<Uint8Array>;
+//# sourceMappingURL=protection.d.ts.map

package/dist/contracts/protection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protection.d.ts","sourceRoot":"","sources":["../../src/contracts/protection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,eAAO,MAAM,yBAAyB,gDAAgD,CAAC;AACvF,eAAO,MAAM,wBAAwB,aAAa,CAAC;AAEnD,+EAA+E;AAC/E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,OAAO,EAAE,MAAM;CAI5B;AAOD;;;iBAGiB;AACjB,wBAAsB,0BAA0B,CAC9C,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,UAAU,CAAC,CAyBrB"}

package/dist/contracts/protection.js

@@ -0,0 +1,54 @@
+/**
+ * Opening sealed private-resource envelopes.
+ *
+ * The gateway is the format's producer: it derives a per-resource key from
+ * its root secret and seals every object it puts in content storage as an
+ * AES-256-GCM envelope whose AAD binds resource, contract, and purpose.
+ * A runtime holding its resource key — handed once over the authenticated
+ * tunnel — opens those objects after fetching them directly from storage.
+ * This module is that opener: portable (WebCrypto, no platform imports) so
+ * any host the SDK supports can consume protected content.
+ */
+export const PROTECTED_ENVELOPE_FORMAT = 'amalgm.private.entity-content.aes-256-gcm@2';
+export const PROTECTED_ENVELOPE_MAGIC = 'AMGEC002';
+export class ProtectionError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'ProtectionError';
+    }
+}
+const MAGIC_BYTES = new TextEncoder().encode(PROTECTED_ENVELOPE_MAGIC);
+const IV_BYTES = 12;
+const TAG_BYTES = 16;
+const HEADER_BYTES = MAGIC_BYTES.byteLength + IV_BYTES + TAG_BYTES;
+/** Open one binary storage envelope to verified plaintext. The fixed layout is
+ * `magic | iv | tag | ciphertext`; content never pays JSON/base64 expansion.
+ * Refuses anything malformed, tampered with, or sealed under a different key
+ * or binding. */
+export async function openProtectedEnvelopeBytes(key, bytes, binding) {
+    if (key.byteLength !== 32)
+        throw new ProtectionError('protection key must be exactly 32 bytes');
+    if (bytes.byteLength < HEADER_BYTES
+        || MAGIC_BYTES.some((value, index) => bytes[index] !== value)) {
+        throw new ProtectionError('payload is not a protected envelope');
+    }
+    try {
+        const ivStart = MAGIC_BYTES.byteLength;
+        const tagStart = ivStart + IV_BYTES;
+        const dataStart = tagStart + TAG_BYTES;
+        const iv = bytes.slice(ivStart, tagStart);
+        const tag = bytes.slice(tagStart, dataStart);
+        const data = bytes.slice(dataStart);
+        const sealed = new Uint8Array(data.length + tag.length);
+        sealed.set(data, 0);
+        sealed.set(tag, data.length);
+        const additionalData = new TextEncoder().encode(`${PROTECTED_ENVELOPE_FORMAT}:${binding.resourceId}:${binding.contract}:${binding.purpose}`);
+        const secret = await crypto.subtle.importKey('raw', key.slice(), 'AES-GCM', false, ['decrypt']);
+        const plain = await crypto.subtle.decrypt({ name: 'AES-GCM', iv, additionalData }, secret, sealed);
+        return new Uint8Array(plain);
+    }
+    catch {
+        throw new ProtectionError('protected envelope failed authentication');
+    }
+}
+//# sourceMappingURL=protection.js.map

package/dist/contracts/protection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protection.js","sourceRoot":"","sources":["../../src/contracts/protection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,6CAA6C,CAAC;AACvF,MAAM,CAAC,MAAM,wBAAwB,GAAG,UAAU,CAAC;AASnD,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;AACvE,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,YAAY,GAAG,WAAW,CAAC,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEnE;;;iBAGiB;AACjB,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,GAAe,EACf,KAAiB,EACjB,OAA0B;IAE1B,IAAI,GAAG,CAAC,UAAU,KAAK,EAAE;QAAE,MAAM,IAAI,eAAe,CAAC,yCAAyC,CAAC,CAAC;IAChG,IAAI,KAAK,CAAC,UAAU,GAAG,YAAY;WAC9B,WAAW,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,eAAe,CAAC,qCAAqC,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,CAAC;QACvC,MAAM,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAC;QACpC,MAAM,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;QACvC,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;QACxD,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACpB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,cAAc,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAC7C,GAAG,yBAAyB,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,OAAO,EAAE,CAC5F,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QAChG,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACnG,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CAAC,0CAA0C,CAAC,CAAC;IACxE,CAAC;AACH,CAAC"}

package/dist/transfer/download.d.ts

@@ -5,6 +5,10 @@
  * only the gaps, verifies every fetched chunk, and then asks the cache to seal
  * the complete artifact. Sealing must verify the whole byte count and content
  * hash before returning a local handle.
+ *
+ * Every chunk is one content-addressed storage object, so the host's ports
+ * fetch chunks independently — parallelism, transport, and decryption are the
+ * host's concern; the verification laws here are not.
  */
 import { type ContentManifest } from '../contracts/content.js';
 import type { Sha256Hex } from '../entities/types.js';
@@ -15,12 +19,7 @@ export interface DownloadPorts<LocalArtifact> {
     /** True only when this exact content-addressed chunk is locally verified. */
     hasChunk(artifact: TransferArtifact, manifest: ContentManifest, index: number): Promise<boolean>;
     getChunk(artifact: TransferArtifact, manifest: ContentManifest, index: number): Promise<Uint8Array>;
-    /** Fetch adjacent logical file blocks in one binary response, concatenated
-     * in `indexes` order. */
-    getChunkBatch?(artifact: TransferArtifact, manifest: ContentManifest, indexes: readonly number[]): Promise<Uint8Array>;
     putChunk(artifact: TransferArtifact, manifest: ContentManifest, index: number, bytes: Uint8Array): Promise<void>;
-    /** Persist one already-verified contiguous file batch. */
-    putChunkBatch?(artifact: TransferArtifact, manifest: ContentManifest, indexes: readonly number[], bytes: Uint8Array): Promise<void>;
     /** Verify and expose the complete immutable artifact assembled from cache. */
     sealArtifact(artifact: TransferArtifact, manifest: ContentManifest): Promise<SealedArtifact<LocalArtifact>>;
 }

package/dist/transfer/download.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"download.d.ts","sourceRoot":"","sources":["../../src/transfer/download.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAwB,KAAK,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACrF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAA0B,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAI/E,MAAM,WAAW,aAAa,CAAC,aAAa;IAC1C,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,WAAW,CAAC,QAAQ,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,6EAA6E;IAC7E,QAAQ,CACN,QAAQ,EAAE,gBAAgB,EAC1B,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,QAAQ,CACN,QAAQ,EAAE,gBAAgB,EAC1B,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,UAAU,CAAC,CAAC;IACvB;6BACyB;IACzB,aAAa,CAAC,CACZ,QAAQ,EAAE,gBAAgB,EAC1B,QAAQ,EAAE,eAAe,EACzB,OAAO,EAAE,SAAS,MAAM,EAAE,GACzB,OAAO,CAAC,UAAU,CAAC,CAAC;IACvB,QAAQ,CACN,QAAQ,EAAE,gBAAgB,EAC1B,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,0DAA0D;IAC1D,aAAa,CAAC,CACZ,QAAQ,EAAE,gBAAgB,EAC1B,QAAQ,EAAE,eAAe,EACzB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,8EAA8E;IAC9E,YAAY,CACV,QAAQ,EAAE,gBAAgB,EAC1B,QAAQ,EAAE,eAAe,GACxB,OAAO,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,cAAc,CAAC,aAAa;IAC3C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,eAAe,CAAC,aAAa;IAC5C,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAwBD,yEAAyE;AACzE,wBAAsB,QAAQ,CAAC,aAAa,EAC1C,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,aAAa,CAAC,aAAa,CAAC,EACnC,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,CAwDzC"}
+{"version":3,"file":"download.d.ts","sourceRoot":"","sources":["../../src/transfer/download.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAwB,KAAK,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACrF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAA0B,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAG/E,MAAM,WAAW,aAAa,CAAC,aAAa;IAC1C,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,WAAW,CAAC,QAAQ,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,6EAA6E;IAC7E,QAAQ,CACN,QAAQ,EAAE,gBAAgB,EAC1B,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,QAAQ,CACN,QAAQ,EAAE,gBAAgB,EAC1B,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,UAAU,CAAC,CAAC;IACvB,QAAQ,CACN,QAAQ,EAAE,gBAAgB,EAC1B,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,8EAA8E;IAC9E,YAAY,CACV,QAAQ,EAAE,gBAAgB,EAC1B,QAAQ,EAAE,eAAe,GACxB,OAAO,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,cAAc,CAAC,aAAa;IAC3C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,eAAe,CAAC,aAAa;IAC5C,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,yEAAyE;AACzE,wBAAsB,QAAQ,CAAC,aAAa,EAC1C,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,aAAa,CAAC,aAAa,CAAC,EACnC,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,CAqCzC"}

package/dist/transfer/download.js

@@ -5,29 +5,14 @@
  * only the gaps, verifies every fetched chunk, and then asks the cache to seal
  * the complete artifact. Sealing must verify the whole byte count and content
  * hash before returning a local handle.
+ *
+ * Every chunk is one content-addressed storage object, so the host's ports
+ * fetch chunks independently — parallelism, transport, and decryption are the
+ * host's concern; the verification laws here are not.
  */
 import { checkContentManifest } from '../contracts/content.js';
 import { assertTransferArtifact } from './artifacts.js';
-import { planChunkBatches } from './batches.js';
 import { DEFAULT_TRANSFER_CONCURRENCY, parallelForEach } from './parallel.js';
-const checkedBatchChunks = (bytes, indexes, manifest, sha256Hex) => {
-    const chunks = [];
-    let offset = 0;
-    for (const index of indexes) {
-        const expected = manifest.chunks[index];
-        if (!expected)
-            throw new Error(`download manifest named an unknown chunk index`);
-        const chunk = bytes.subarray(offset, offset + expected.bytes);
-        if (chunk.byteLength !== expected.bytes || sha256Hex(chunk) !== expected.sha256) {
-            throw new Error(`downloaded content chunk ${index} failed verification`);
-        }
-        chunks.push(chunk);
-        offset += expected.bytes;
-    }
-    if (offset !== bytes.byteLength)
-        throw new Error('downloaded file batch has the wrong byte count');
-    return chunks;
-};
 /** Download one immutable artifact, fetching only machine-cache gaps. */
 export async function download(artifact, ports, options = {}) {
     assertTransferArtifact(artifact);
@@ -40,36 +25,18 @@ export async function download(artifact, ports, options = {}) {
         if (!await ports.hasChunk(artifact, manifest, index))
             missing.push(index);
     }
-    if (artifact.kind === 'file' && ports.getChunkBatch) {
-        await parallelForEach(planChunkBatches(missing, manifest), options.concurrency ?? DEFAULT_TRANSFER_CONCURRENCY, async (batch) => {
-            const bytes = await ports.getChunkBatch(artifact, manifest, batch.indexes);
-            if (!(bytes instanceof Uint8Array))
-                throw new Error('downloaded file batch is not binary bytes');
-            const chunks = checkedBatchChunks(bytes, batch.indexes, manifest, ports.sha256Hex);
-            if (ports.putChunkBatch) {
-                await ports.putChunkBatch(artifact, manifest, batch.indexes, bytes);
-            }
-            else {
-                for (let offset = 0; offset < batch.indexes.length; offset += 1) {
-                    await ports.putChunk(artifact, manifest, batch.indexes[offset], chunks[offset]);
-                }
-            }
-        });
-    }
-    else {
-        await parallelForEach(missing, options.concurrency ?? DEFAULT_TRANSFER_CONCURRENCY, async (index) => {
-            const expected = manifest.chunks[index];
-            if (expected === undefined)
-                throw new Error('download manifest named an unknown chunk index');
-            const bytes = await ports.getChunk(artifact, manifest, index);
-            if (!(bytes instanceof Uint8Array)
-                || bytes.byteLength !== expected.bytes
-                || ports.sha256Hex(bytes) !== expected.sha256) {
-                throw new Error(`downloaded content chunk ${index} failed verification`);
-            }
-            await ports.putChunk(artifact, manifest, index, bytes);
-        });
-    }
+    await parallelForEach(missing, options.concurrency ?? DEFAULT_TRANSFER_CONCURRENCY, async (index) => {
+        const expected = manifest.chunks[index];
+        if (expected === undefined)
+            throw new Error('download manifest named an unknown chunk index');
+        const bytes = await ports.getChunk(artifact, manifest, index);
+        if (!(bytes instanceof Uint8Array)
+            || bytes.byteLength !== expected.bytes
+            || ports.sha256Hex(bytes) !== expected.sha256) {
+            throw new Error(`downloaded content chunk ${index} failed verification`);
+        }
+        await ports.putChunk(artifact, manifest, index, bytes);
+    });
     const sealed = await ports.sealArtifact(artifact, manifest);
     if (sealed.bytes !== manifest.bytes || sealed.contentHash !== manifest.contentHash) {
         throw new Error(`downloaded artifact ${artifact.contentHash} failed verification`);

package/dist/transfer/download.js.map

@@ -1 +1 @@
-{"version":3,"file":"download.js","sourceRoot":"","sources":["../../src/transfer/download.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,oBAAoB,EAAwB,MAAM,yBAAyB,CAAC;AAErF,OAAO,EAAE,sBAAsB,EAAyB,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,4BAA4B,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AA6D9E,MAAM,kBAAkB,GAAG,CACzB,KAAiB,EACjB,OAA0B,EAC1B,QAAyB,EACzB,SAAoB,EACG,EAAE;IACzB,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACjF,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9D,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,KAAK,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;YAChF,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,sBAAsB,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,MAAM,IAAI,QAAQ,CAAC,KAAK,CAAC;IAC3B,CAAC;IACD,IAAI,MAAM,KAAK,KAAK,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACnG,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,QAA0B,EAC1B,KAAmC,EACnC,UAA2B,EAAE;IAE7B,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,oBAAoB,CAClC,MAAM,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,EACjC,QAAQ,CAAC,WAAW,CACrB,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC;IAE/B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QACvD,IAAI,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5E,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,eAAe,CACnB,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,EACnC,OAAO,CAAC,WAAW,IAAI,4BAA4B,EACnD,KAAK,EAAE,KAAK,EAAE,EAAE;YACd,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,aAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5E,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YACjG,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YACnF,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;gBACxB,MAAM,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACtE,CAAC;iBAAM,CAAC;gBACN,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC;oBAChE,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAE,EAAE,MAAM,CAAC,MAAM,CAAE,CAAC,CAAC;gBACpF,CAAC;YACH,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,IAAI,4BAA4B,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAClG,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,QAAQ,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;YAC9F,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC9D,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC;mBAC7B,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,KAAK;mBACnC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAChD,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,sBAAsB,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC5D,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,IAAI,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;QACnF,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,CAAC,WAAW,sBAAsB,CAAC,CAAC;IACrF,CAAC;IACD,OAAO;QACL,QAAQ;QACR,QAAQ;QACR,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,gBAAgB,EAAE,OAAO,CAAC,MAAM;QAChC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM;KACtD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"download.js","sourceRoot":"","sources":["../../src/transfer/download.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,oBAAoB,EAAwB,MAAM,yBAAyB,CAAC;AAErF,OAAO,EAAE,sBAAsB,EAAyB,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAAE,4BAA4B,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AA+C9E,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,QAA0B,EAC1B,KAAmC,EACnC,UAA2B,EAAE;IAE7B,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,oBAAoB,CAClC,MAAM,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,EACjC,QAAQ,CAAC,WAAW,CACrB,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC;IAE/B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QACvD,IAAI,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,IAAI,4BAA4B,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QAClG,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,QAAQ,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC9F,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC9D,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC;eAC7B,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,KAAK;eACnC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,sBAAsB,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC5D,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,IAAI,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;QACnF,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,CAAC,WAAW,sBAAsB,CAAC,CAAC;IACrF,CAAC;IACD,OAAO;QACL,QAAQ;QACR,QAAQ;QACR,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,gBAAgB,EAAE,OAAO,CAAC,MAAM;QAChC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM;KACtD,CAAC;AACJ,CAAC"}

package/dist/transfer/index.d.ts

@@ -2,4 +2,5 @@
 export * from './artifacts.js';
 export * from './upload.js';
 export * from './download.js';
+export * from './presign.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/transfer/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/transfer/index.ts"],"names":[],"mappings":"AAAA,wDAAwD;AAExD,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/transfer/index.ts"],"names":[],"mappings":"AAAA,wDAAwD;AAExD,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC"}

package/dist/transfer/index.js

@@ -2,4 +2,5 @@
 export * from './artifacts.js';
 export * from './upload.js';
 export * from './download.js';
+export * from './presign.js';
 //# sourceMappingURL=index.js.map

package/dist/transfer/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/transfer/index.ts"],"names":[],"mappings":"AAAA,wDAAwD;AAExD,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/transfer/index.ts"],"names":[],"mappings":"AAAA,wDAAwD;AAExD,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC"}

package/dist/transfer/presign.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Presigned-URL brokering for direct content-storage fetches.
+ *
+ * Downloads fetch every storage object straight from content storage using
+ * short-lived URLs the gateway signs. Callers ask for one object's URL at a
+ * time; the broker coalesces every request made in the same event-loop turn
+ * into one batched signing call, so thousands of tiny fetches cost a handful
+ * of control-plane round trips. URLs are used immediately and never cached —
+ * their expiry is the gateway's revocation lever.
+ */
+/** One law shared with the gateway: the most objects one signing call may name. */
+export declare const PRESIGN_BATCH_OBJECTS = 2048;
+export interface PresignObject {
+    /** 'manifest' names a whole artifact by content hash; 'block' one chunk by its sha256. */
+    readonly kind: 'manifest' | 'block';
+    readonly sha256: string;
+}
+export interface PresignBrokerPorts {
+    /** Sign every named object, returning URLs aligned by index. */
+    requestUrls(objects: readonly PresignObject[]): Promise<readonly string[]>;
+}
+export interface PresignBroker {
+    url(object: PresignObject): Promise<string>;
+}
+export declare function createPresignBroker(ports: PresignBrokerPorts): PresignBroker;
+//# sourceMappingURL=presign.d.ts.map

package/dist/transfer/presign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"presign.d.ts","sourceRoot":"","sources":["../../src/transfer/presign.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,mFAAmF;AACnF,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAE1C,MAAM,WAAW,aAAa;IAC5B,0FAA0F;IAC1F,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,gEAAgE;IAChE,WAAW,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;CAC5E;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC7C;AAQD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,kBAAkB,GAAG,aAAa,CA+B5E"}

package/dist/transfer/presign.js

@@ -0,0 +1,44 @@
+/**
+ * Presigned-URL brokering for direct content-storage fetches.
+ *
+ * Downloads fetch every storage object straight from content storage using
+ * short-lived URLs the gateway signs. Callers ask for one object's URL at a
+ * time; the broker coalesces every request made in the same event-loop turn
+ * into one batched signing call, so thousands of tiny fetches cost a handful
+ * of control-plane round trips. URLs are used immediately and never cached —
+ * their expiry is the gateway's revocation lever.
+ */
+/** One law shared with the gateway: the most objects one signing call may name. */
+export const PRESIGN_BATCH_OBJECTS = 2048;
+export function createPresignBroker(ports) {
+    let pending = [];
+    let scheduled = false;
+    const flush = async () => {
+        scheduled = false;
+        while (pending.length > 0) {
+            const batch = pending.splice(0, PRESIGN_BATCH_OBJECTS);
+            try {
+                const urls = await ports.requestUrls(batch.map((waiter) => waiter.object));
+                if (urls.length !== batch.length) {
+                    throw new Error('presign returned the wrong number of urls');
+                }
+                batch.forEach((waiter, index) => waiter.resolve(urls[index]));
+            }
+            catch (error) {
+                batch.forEach((waiter) => waiter.reject(error));
+            }
+        }
+    };
+    return {
+        url(object) {
+            return new Promise((resolve, reject) => {
+                pending.push({ object, resolve, reject });
+                if (!scheduled) {
+                    scheduled = true;
+                    setTimeout(() => { void flush(); }, 0);
+                }
+            });
+        },
+    };
+}
+//# sourceMappingURL=presign.js.map

package/dist/transfer/presign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"presign.js","sourceRoot":"","sources":["../../src/transfer/presign.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,mFAAmF;AACnF,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAuB1C,MAAM,UAAU,mBAAmB,CAAC,KAAyB;IAC3D,IAAI,OAAO,GAAa,EAAE,CAAC;IAC3B,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,MAAM,KAAK,GAAG,KAAK,IAAmB,EAAE;QACtC,SAAS,GAAG,KAAK,CAAC;QAClB,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;YACvD,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC3E,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;oBACjC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;gBAC/D,CAAC;gBACD,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAE,CAAC,CAAC,CAAC;YACjE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,GAAG,CAAC,MAAqB;YACvB,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC7C,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC1C,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,SAAS,GAAG,IAAI,CAAC;oBACjB,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACzC,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist-cjs/contracts/content.js

@@ -17,7 +17,7 @@ exports.manifestFromChunks = manifestFromChunks;
 exports.contentBlockSize = contentBlockSize;
 exports.chunkSizes = chunkSizes;
 const validate_js_1 = require("./validate.js");
-exports.CONTENT_CONTRACT = 'amalgm-entity-content@3';
+exports.CONTENT_CONTRACT = 'amalgm-entity-content@4';
 exports.MIN_CONTENT_BLOCK_BYTES = 4 * 1024 * 1024;
 exports.MAX_CONTENT_BLOCK_BYTES = 16 * 1024 * 1024;
 /** Maximum accepted block size. Kept as the public manifest-bound name. */

package/dist-cjs/contracts/index.js

@@ -28,6 +28,7 @@ __exportStar(require("./binding.js"), exports);
 __exportStar(require("./presence.js"), exports);
 __exportStar(require("./docs.js"), exports);
 __exportStar(require("./content.js"), exports);
+__exportStar(require("./protection.js"), exports);
 __exportStar(require("./frames/stream.js"), exports);
 __exportStar(require("./frames/gateway.js"), exports);
 __exportStar(require("./frames/tunnel.js"), exports);

package/dist-cjs/contracts/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/contracts/index.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;AAEH,gDAA8B;AAC9B,iDAA+B;AAC/B,8CAA4B;AAC5B,gDAA8B;AAC9B,+CAA6B;AAC7B,gDAA8B;AAC9B,4CAA0B;AAC1B,+CAA6B;AAC7B,qDAAmC;AACnC,sDAAoC;AACpC,qDAAmC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/contracts/index.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;AAEH,gDAA8B;AAC9B,iDAA+B;AAC/B,8CAA4B;AAC5B,gDAA8B;AAC9B,+CAA6B;AAC7B,gDAA8B;AAC9B,4CAA0B;AAC1B,+CAA6B;AAC7B,kDAAgC;AAChC,qDAAmC;AACnC,sDAAoC;AACpC,qDAAmC"}

package/dist-cjs/contracts/protection.js

@@ -0,0 +1,59 @@
+"use strict";
+/**
+ * Opening sealed private-resource envelopes.
+ *
+ * The gateway is the format's producer: it derives a per-resource key from
+ * its root secret and seals every object it puts in content storage as an
+ * AES-256-GCM envelope whose AAD binds resource, contract, and purpose.
+ * A runtime holding its resource key — handed once over the authenticated
+ * tunnel — opens those objects after fetching them directly from storage.
+ * This module is that opener: portable (WebCrypto, no platform imports) so
+ * any host the SDK supports can consume protected content.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProtectionError = exports.PROTECTED_ENVELOPE_MAGIC = exports.PROTECTED_ENVELOPE_FORMAT = void 0;
+exports.openProtectedEnvelopeBytes = openProtectedEnvelopeBytes;
+exports.PROTECTED_ENVELOPE_FORMAT = 'amalgm.private.entity-content.aes-256-gcm@2';
+exports.PROTECTED_ENVELOPE_MAGIC = 'AMGEC002';
+class ProtectionError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'ProtectionError';
+    }
+}
+exports.ProtectionError = ProtectionError;
+const MAGIC_BYTES = new TextEncoder().encode(exports.PROTECTED_ENVELOPE_MAGIC);
+const IV_BYTES = 12;
+const TAG_BYTES = 16;
+const HEADER_BYTES = MAGIC_BYTES.byteLength + IV_BYTES + TAG_BYTES;
+/** Open one binary storage envelope to verified plaintext. The fixed layout is
+ * `magic | iv | tag | ciphertext`; content never pays JSON/base64 expansion.
+ * Refuses anything malformed, tampered with, or sealed under a different key
+ * or binding. */
+async function openProtectedEnvelopeBytes(key, bytes, binding) {
+    if (key.byteLength !== 32)
+        throw new ProtectionError('protection key must be exactly 32 bytes');
+    if (bytes.byteLength < HEADER_BYTES
+        || MAGIC_BYTES.some((value, index) => bytes[index] !== value)) {
+        throw new ProtectionError('payload is not a protected envelope');
+    }
+    try {
+        const ivStart = MAGIC_BYTES.byteLength;
+        const tagStart = ivStart + IV_BYTES;
+        const dataStart = tagStart + TAG_BYTES;
+        const iv = bytes.slice(ivStart, tagStart);
+        const tag = bytes.slice(tagStart, dataStart);
+        const data = bytes.slice(dataStart);
+        const sealed = new Uint8Array(data.length + tag.length);
+        sealed.set(data, 0);
+        sealed.set(tag, data.length);
+        const additionalData = new TextEncoder().encode(`${exports.PROTECTED_ENVELOPE_FORMAT}:${binding.resourceId}:${binding.contract}:${binding.purpose}`);
+        const secret = await crypto.subtle.importKey('raw', key.slice(), 'AES-GCM', false, ['decrypt']);
+        const plain = await crypto.subtle.decrypt({ name: 'AES-GCM', iv, additionalData }, secret, sealed);
+        return new Uint8Array(plain);
+    }
+    catch {
+        throw new ProtectionError('protected envelope failed authentication');
+    }
+}
+//# sourceMappingURL=protection.js.map

package/dist-cjs/contracts/protection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protection.js","sourceRoot":"","sources":["../../src/contracts/protection.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AA4BH,gEA6BC;AAvDY,QAAA,yBAAyB,GAAG,6CAA6C,CAAC;AAC1E,QAAA,wBAAwB,GAAG,UAAU,CAAC;AASnD,MAAa,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AALD,0CAKC;AAED,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,gCAAwB,CAAC,CAAC;AACvE,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,YAAY,GAAG,WAAW,CAAC,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEnE;;;iBAGiB;AACV,KAAK,UAAU,0BAA0B,CAC9C,GAAe,EACf,KAAiB,EACjB,OAA0B;IAE1B,IAAI,GAAG,CAAC,UAAU,KAAK,EAAE;QAAE,MAAM,IAAI,eAAe,CAAC,yCAAyC,CAAC,CAAC;IAChG,IAAI,KAAK,CAAC,UAAU,GAAG,YAAY;WAC9B,WAAW,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,eAAe,CAAC,qCAAqC,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,CAAC;QACvC,MAAM,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAC;QACpC,MAAM,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;QACvC,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;QACxD,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACpB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,cAAc,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAC7C,GAAG,iCAAyB,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,OAAO,EAAE,CAC5F,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;QAChG,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACnG,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CAAC,0CAA0C,CAAC,CAAC;IACxE,CAAC;AACH,CAAC"}

package/dist-cjs/transfer/download.js

@@ -6,31 +6,16 @@
  * only the gaps, verifies every fetched chunk, and then asks the cache to seal
  * the complete artifact. Sealing must verify the whole byte count and content
  * hash before returning a local handle.
+ *
+ * Every chunk is one content-addressed storage object, so the host's ports
+ * fetch chunks independently — parallelism, transport, and decryption are the
+ * host's concern; the verification laws here are not.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.download = download;
 const content_js_1 = require("../contracts/content.js");
 const artifacts_js_1 = require("./artifacts.js");
-const batches_js_1 = require("./batches.js");
 const parallel_js_1 = require("./parallel.js");
-const checkedBatchChunks = (bytes, indexes, manifest, sha256Hex) => {
-    const chunks = [];
-    let offset = 0;
-    for (const index of indexes) {
-        const expected = manifest.chunks[index];
-        if (!expected)
-            throw new Error(`download manifest named an unknown chunk index`);
-        const chunk = bytes.subarray(offset, offset + expected.bytes);
-        if (chunk.byteLength !== expected.bytes || sha256Hex(chunk) !== expected.sha256) {
-            throw new Error(`downloaded content chunk ${index} failed verification`);
-        }
-        chunks.push(chunk);
-        offset += expected.bytes;
-    }
-    if (offset !== bytes.byteLength)
-        throw new Error('downloaded file batch has the wrong byte count');
-    return chunks;
-};
 /** Download one immutable artifact, fetching only machine-cache gaps. */
 async function download(artifact, ports, options = {}) {
     (0, artifacts_js_1.assertTransferArtifact)(artifact);
@@ -43,36 +28,18 @@ async function download(artifact, ports, options = {}) {
         if (!await ports.hasChunk(artifact, manifest, index))
             missing.push(index);
     }
-    if (artifact.kind === 'file' && ports.getChunkBatch) {
-        await (0, parallel_js_1.parallelForEach)((0, batches_js_1.planChunkBatches)(missing, manifest), options.concurrency ?? parallel_js_1.DEFAULT_TRANSFER_CONCURRENCY, async (batch) => {
-            const bytes = await ports.getChunkBatch(artifact, manifest, batch.indexes);
-            if (!(bytes instanceof Uint8Array))
-                throw new Error('downloaded file batch is not binary bytes');
-            const chunks = checkedBatchChunks(bytes, batch.indexes, manifest, ports.sha256Hex);
-            if (ports.putChunkBatch) {
-                await ports.putChunkBatch(artifact, manifest, batch.indexes, bytes);
-            }
-            else {
-                for (let offset = 0; offset < batch.indexes.length; offset += 1) {
-                    await ports.putChunk(artifact, manifest, batch.indexes[offset], chunks[offset]);
-                }
-            }
-        });
-    }
-    else {
-        await (0, parallel_js_1.parallelForEach)(missing, options.concurrency ?? parallel_js_1.DEFAULT_TRANSFER_CONCURRENCY, async (index) => {
-            const expected = manifest.chunks[index];
-            if (expected === undefined)
-                throw new Error('download manifest named an unknown chunk index');
-            const bytes = await ports.getChunk(artifact, manifest, index);
-            if (!(bytes instanceof Uint8Array)
-                || bytes.byteLength !== expected.bytes
-                || ports.sha256Hex(bytes) !== expected.sha256) {
-                throw new Error(`downloaded content chunk ${index} failed verification`);
-            }
-            await ports.putChunk(artifact, manifest, index, bytes);
-        });
-    }
+    await (0, parallel_js_1.parallelForEach)(missing, options.concurrency ?? parallel_js_1.DEFAULT_TRANSFER_CONCURRENCY, async (index) => {
+        const expected = manifest.chunks[index];
+        if (expected === undefined)
+            throw new Error('download manifest named an unknown chunk index');
+        const bytes = await ports.getChunk(artifact, manifest, index);
+        if (!(bytes instanceof Uint8Array)
+            || bytes.byteLength !== expected.bytes
+            || ports.sha256Hex(bytes) !== expected.sha256) {
+            throw new Error(`downloaded content chunk ${index} failed verification`);
+        }
+        await ports.putChunk(artifact, manifest, index, bytes);
+    });
     const sealed = await ports.sealArtifact(artifact, manifest);
     if (sealed.bytes !== manifest.bytes || sealed.contentHash !== manifest.contentHash) {
         throw new Error(`downloaded artifact ${artifact.contentHash} failed verification`);

package/dist-cjs/transfer/download.js.map

@@ -1 +1 @@
-{"version":3,"file":"download.js","sourceRoot":"","sources":["../../src/transfer/download.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;AA0FH,4BA4DC;AApJD,wDAAqF;AAErF,iDAA+E;AAC/E,6CAAgD;AAChD,+CAA8E;AA6D9E,MAAM,kBAAkB,GAAG,CACzB,KAAiB,EACjB,OAA0B,EAC1B,QAAyB,EACzB,SAAoB,EACG,EAAE;IACzB,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACjF,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9D,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,KAAK,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;YAChF,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,sBAAsB,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,MAAM,IAAI,QAAQ,CAAC,KAAK,CAAC;IAC3B,CAAC;IACD,IAAI,MAAM,KAAK,KAAK,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACnG,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,yEAAyE;AAClE,KAAK,UAAU,QAAQ,CAC5B,QAA0B,EAC1B,KAAmC,EACnC,UAA2B,EAAE;IAE7B,IAAA,qCAAsB,EAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,IAAA,iCAAoB,EAClC,MAAM,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,EACjC,QAAQ,CAAC,WAAW,CACrB,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC;IAE/B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QACvD,IAAI,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5E,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QACpD,MAAM,IAAA,6BAAe,EACnB,IAAA,6BAAgB,EAAC,OAAO,EAAE,QAAQ,CAAC,EACnC,OAAO,CAAC,WAAW,IAAI,0CAA4B,EACnD,KAAK,EAAE,KAAK,EAAE,EAAE;YACd,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,aAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5E,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YACjG,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YACnF,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;gBACxB,MAAM,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACtE,CAAC;iBAAM,CAAC;gBACN,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC;oBAChE,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAE,EAAE,MAAM,CAAC,MAAM,CAAE,CAAC,CAAC;gBACpF,CAAC;YACH,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,IAAA,6BAAe,EAAC,OAAO,EAAE,OAAO,CAAC,WAAW,IAAI,0CAA4B,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAClG,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,QAAQ,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;YAC9F,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC9D,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC;mBAC7B,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,KAAK;mBACnC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAChD,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,sBAAsB,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC5D,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,IAAI,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;QACnF,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,CAAC,WAAW,sBAAsB,CAAC,CAAC;IACrF,CAAC;IACD,OAAO;QACL,QAAQ;QACR,QAAQ;QACR,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,gBAAgB,EAAE,OAAO,CAAC,MAAM;QAChC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM;KACtD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"download.js","sourceRoot":"","sources":["../../src/transfer/download.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;AAqDH,4BAyCC;AA5FD,wDAAqF;AAErF,iDAA+E;AAC/E,+CAA8E;AA+C9E,yEAAyE;AAClE,KAAK,UAAU,QAAQ,CAC5B,QAA0B,EAC1B,KAAmC,EACnC,UAA2B,EAAE;IAE7B,IAAA,qCAAsB,EAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,IAAA,iCAAoB,EAClC,MAAM,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,EACjC,QAAQ,CAAC,WAAW,CACrB,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC;IAE/B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QACvD,IAAI,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,IAAA,6BAAe,EAAC,OAAO,EAAE,OAAO,CAAC,WAAW,IAAI,0CAA4B,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QAClG,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,QAAQ,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC9F,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC9D,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC;eAC7B,KAAK,CAAC,UAAU,KAAK,QAAQ,CAAC,KAAK;eACnC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,sBAAsB,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC5D,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,IAAI,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;QACnF,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,CAAC,WAAW,sBAAsB,CAAC,CAAC;IACrF,CAAC;IACD,OAAO;QACL,QAAQ;QACR,QAAQ;QACR,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,gBAAgB,EAAE,OAAO,CAAC,MAAM;QAChC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM;KACtD,CAAC;AACJ,CAAC"}

package/dist-cjs/transfer/index.js

@@ -18,4 +18,5 @@ Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./artifacts.js"), exports);
 __exportStar(require("./upload.js"), exports);
 __exportStar(require("./download.js"), exports);
+__exportStar(require("./presign.js"), exports);
 //# sourceMappingURL=index.js.map

package/dist-cjs/transfer/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/transfer/index.ts"],"names":[],"mappings":";AAAA,wDAAwD;;;;;;;;;;;;;;;;AAExD,iDAA+B;AAC/B,8CAA4B;AAC5B,gDAA8B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/transfer/index.ts"],"names":[],"mappings":";AAAA,wDAAwD;;;;;;;;;;;;;;;;AAExD,iDAA+B;AAC/B,8CAA4B;AAC5B,gDAA8B;AAC9B,+CAA6B"}

package/dist-cjs/transfer/presign.js

@@ -0,0 +1,48 @@
+"use strict";
+/**
+ * Presigned-URL brokering for direct content-storage fetches.
+ *
+ * Downloads fetch every storage object straight from content storage using
+ * short-lived URLs the gateway signs. Callers ask for one object's URL at a
+ * time; the broker coalesces every request made in the same event-loop turn
+ * into one batched signing call, so thousands of tiny fetches cost a handful
+ * of control-plane round trips. URLs are used immediately and never cached —
+ * their expiry is the gateway's revocation lever.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PRESIGN_BATCH_OBJECTS = void 0;
+exports.createPresignBroker = createPresignBroker;
+/** One law shared with the gateway: the most objects one signing call may name. */
+exports.PRESIGN_BATCH_OBJECTS = 2048;
+function createPresignBroker(ports) {
+    let pending = [];
+    let scheduled = false;
+    const flush = async () => {
+        scheduled = false;
+        while (pending.length > 0) {
+            const batch = pending.splice(0, exports.PRESIGN_BATCH_OBJECTS);
+            try {
+                const urls = await ports.requestUrls(batch.map((waiter) => waiter.object));
+                if (urls.length !== batch.length) {
+                    throw new Error('presign returned the wrong number of urls');
+                }
+                batch.forEach((waiter, index) => waiter.resolve(urls[index]));
+            }
+            catch (error) {
+                batch.forEach((waiter) => waiter.reject(error));
+            }
+        }
+    };
+    return {
+        url(object) {
+            return new Promise((resolve, reject) => {
+                pending.push({ object, resolve, reject });
+                if (!scheduled) {
+                    scheduled = true;
+                    setTimeout(() => { void flush(); }, 0);
+                }
+            });
+        },
+    };
+}
+//# sourceMappingURL=presign.js.map

package/dist-cjs/transfer/presign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"presign.js","sourceRoot":"","sources":["../../src/transfer/presign.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AA0BH,kDA+BC;AAvDD,mFAAmF;AACtE,QAAA,qBAAqB,GAAG,IAAI,CAAC;AAuB1C,SAAgB,mBAAmB,CAAC,KAAyB;IAC3D,IAAI,OAAO,GAAa,EAAE,CAAC;IAC3B,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,MAAM,KAAK,GAAG,KAAK,IAAmB,EAAE;QACtC,SAAS,GAAG,KAAK,CAAC;QAClB,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,6BAAqB,CAAC,CAAC;YACvD,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC3E,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;oBACjC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;gBAC/D,CAAC;gBACD,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAE,CAAC,CAAC,CAAC;YACjE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,GAAG,CAAC,MAAqB;YACvB,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC7C,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC1C,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,SAAS,GAAG,IAAI,CAAC;oBACjB,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBACzC,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amalgm/live",
-  "version": "0.2.44",
+  "version": "0.2.45",
   "description": "Portable realtime SDK for Amalgm — wire contracts, mutation discipline, and delivery state machines behind host-injected adapters.",
   "type": "module",
   "main": "./dist-cjs/index.js",
@@ -91,6 +91,9 @@
   },
   "scripts": {
     "build": "node --input-type=module -e \"import { rmSync } from 'node:fs'; rmSync('dist', { recursive: true, force: true }); rmSync('dist-cjs', { recursive: true, force: true })\" && tsc -p tsconfig.json && tsc -p tsconfig.cjs.json && node --input-type=module -e \"import { writeFileSync } from 'node:fs'; writeFileSync('dist-cjs/package.json', JSON.stringify({ type: 'commonjs' }) + '\\n')\"",
+    "certification:smoke": "node certification/src/release.mjs prepare --profile smoke --amalgm-version latest",
+    "certification:release": "node certification/src/release.mjs prepare --profile certification",
+    "certification:preflight": "node certification/src/release.mjs preflight",
     "test": "npm run build && node --test tests/",
     "test:parity": "npm run build && node --test tests/parity/"
   },