@clef-sh/runtime 0.1.6-beta.32 → 0.1.12

package/dist/poller.d.ts

@@ -1,6 +1,8 @@
 import { SecretsCache } from "./secrets-cache";
 import { ArtifactSource } from "./sources/types";
 import { DiskCache } from "./disk-cache";
+import { EncryptedArtifactStore } from "./encrypted-artifact-store";
+import { ArtifactDecryptor } from "./artifact-decryptor";
 import { TelemetryEmitter } from "./telemetry";
 /** KMS envelope metadata for artifacts using KMS envelope encryption. */
 export interface ArtifactKmsEnvelope {
@@ -8,6 +10,10 @@ export interface ArtifactKmsEnvelope {
     keyId: string;
     wrappedKey: string;
     algorithm: string;
+    /** Base64-encoded 12-byte AES-GCM initialization vector. */
+    iv: string;
+    /** Base64-encoded 16-byte AES-GCM authentication tag. */
+    authTag: string;
 }
 /** Shape of a packed artifact JSON envelope. */
 export interface ArtifactEnvelope {
@@ -24,6 +30,10 @@ export interface ArtifactEnvelope {
     expiresAt?: string;
     /** ISO-8601 revocation timestamp. Present when the artifact has been revoked. */
     revokedAt?: string;
+    /** Base64-encoded cryptographic signature over the canonical artifact payload. */
+    signature?: string;
+    /** Algorithm used to produce the signature (e.g. "Ed25519", "ECDSA_SHA256"). */
+    signatureAlgorithm?: string;
 }
 export interface PollerOptions {
     /** Artifact source strategy. */
@@ -38,10 +48,17 @@ export interface PollerOptions {
     onRefresh?: (revision: string) => void;
     /** Optional error callback for logging. */
     onError?: (err: Error) => void;
-    /** Max seconds the cache may be served without a successful refresh. */
+    /** Max seconds the cache may be served without a successful refresh. 0 = JIT mode. */
     cacheTtl?: number;
     /** Optional telemetry emitter for event reporting. */
     telemetry?: TelemetryEmitter;
+    /**
+     * Public key for artifact signature verification (base64-encoded DER SPKI).
+     * When set, artifacts without a valid signature are hard-rejected before decryption.
+     */
+    verifyKey?: string;
+    /** Encrypted artifact store for JIT mode. When set, enables fetch-only polling. */
+    encryptedStore?: EncryptedArtifactStore;
 }
 export declare class ArtifactPoller {
     private timer;
@@ -50,17 +67,41 @@ export declare class ArtifactPoller {
     private lastExpiresAt;
     private readonly decryptor;
     private readonly options;
+    private readonly jitMode;
     private telemetryOverride?;
     constructor(options: PollerOptions);
+    /** Get the decryptor instance (for JIT mode server wiring). */
+    getDecryptor(): ArtifactDecryptor;
     /** Set or replace the telemetry emitter (e.g. after resolving token from secrets). */
     setTelemetry(emitter: TelemetryEmitter): void;
     private get telemetry();
-    /** Fetch, validate, decrypt, and cache the artifact. */
+    /**
+     * Fetch, validate, decrypt, and cache the artifact.
+     * Used in cached mode (cacheTtl > 0).
+     */
     fetchAndDecrypt(): Promise<void>;
     /**
-     * Validate the artifact, decrypt it, and swap the cache.
-     * Emits `artifact.invalid` on any validation or decryption failure,
-     * and `artifact.expired` / `artifact.refreshed` on their respective paths.
+     * Fetch and validate the artifact without decrypting.
+     * Stores the validated envelope in the encryptedStore for on-demand decryption.
+     * Used in JIT mode (cacheTtl = 0).
+     */
+    fetchAndValidate(): Promise<void>;
+    /**
+     * Fetch the raw artifact from the source (with disk cache fallback),
+     * parse JSON, and check for revocation.
+     *
+     * Returns null when the content hash is unchanged (short-circuit).
+     */
+    private fetchRaw;
+    /**
+     * Validate the artifact envelope: version, required fields, expiry,
+     * revision dedup, integrity hash, and signature.
+     * Emits `artifact.invalid` / `artifact.expired` telemetry on failure.
+     * Returns the validated artifact, or throws.
+     */
+    private validateArtifact;
+    /**
+     * Validate then decrypt and cache. Used by fetchAndDecrypt (cached mode).
      */
     private validateDecryptAndCache;
     /** Start the polling loop. Performs an initial fetch immediately. */
@@ -75,6 +116,6 @@ export declare class ArtifactPoller {
     private scheduleNext;
     /** Compute ms until next poll: 80% of expiresAt remaining, or cacheTtl / 10 fallback. */
     private computeNextPollMs;
-    private parseAndValidate;
+    private validateEnvelope;
 }
 //# sourceMappingURL=poller.d.ts.map

package/dist/poller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"poller.d.ts","sourceRoot":"","sources":["../src/poller.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,yEAAyE;AACzE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,gDAAgD;AAChD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iFAAiF;IACjF,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,gCAAgC;IAChC,MAAM,EAAE,cAAc,CAAC;IACvB,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,KAAK,EAAE,YAAY,CAAC;IACpB,wCAAwC;IACxC,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,+CAA+C;IAC/C,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,2CAA2C;IAC3C,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,CAAC;IAC/B,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,SAAS,CAAC,EAAE,gBAAgB,CAAC;CAC9B;AASD,qBAAa,cAAc;IACzB,OAAO,CAAC,KAAK,CAA8C;IAC3D,OAAO,CAAC,eAAe,CAAuB;IAC9C,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsB;IAChD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;IACxC,OAAO,CAAC,iBAAiB,CAAC,CAAmB;gBAEjC,OAAO,EAAE,aAAa;IAIlC,sFAAsF;IACtF,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI;IAI7C,OAAO,KAAK,SAAS,GAEpB;IAED,wDAAwD;IAClD,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC;IAwFtC;;;;OAIG;YACW,uBAAuB;IAoGrC,qEAAqE;IAC/D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAM5B,0DAA0D;IAC1D,YAAY,IAAI,IAAI;IAKpB,6BAA6B;IAC7B,IAAI,IAAI,IAAI;IAOZ,+CAA+C;IAC/C,SAAS,IAAI,OAAO;IAIpB,wDAAwD;IACxD,OAAO,CAAC,YAAY;IAapB,yFAAyF;IACzF,OAAO,CAAC,iBAAiB;IAkBzB,OAAO,CAAC,gBAAgB;CAsBzB"}
+{"version":3,"file":"poller.d.ts","sourceRoot":"","sources":["../src/poller.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAG/C,yEAAyE;AACzE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,EAAE,EAAE,MAAM,CAAC;IACX,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,gDAAgD;AAChD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iFAAiF;IACjF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,gCAAgC;IAChC,MAAM,EAAE,cAAc,CAAC;IACvB,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,KAAK,EAAE,YAAY,CAAC;IACpB,wCAAwC;IACxC,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,+CAA+C;IAC/C,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC,2CAA2C;IAC3C,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,CAAC;IAC/B,sFAAsF;IACtF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mFAAmF;IACnF,cAAc,CAAC,EAAE,sBAAsB,CAAC;CACzC;AAaD,qBAAa,cAAc;IACzB,OAAO,CAAC,KAAK,CAA8C;IAC3D,OAAO,CAAC,eAAe,CAAuB;IAC9C,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoB;IAC9C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;IACxC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAU;IAClC,OAAO,CAAC,iBAAiB,CAAC,CAAmB;gBAEjC,OAAO,EAAE,aAAa;IASlC,+DAA+D;IAC/D,YAAY,IAAI,iBAAiB;IAIjC,sFAAsF;IACtF,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI;IAK7C,OAAO,KAAK,SAAS,GAEpB;IAED;;;OAGG;IACG,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC;IAMtC;;;;OAIG;IACG,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IAkBvC;;;;;OAKG;YACW,QAAQ;IA2FtB;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;IAkFxB;;OAEG;YACW,uBAAuB;IAyBrC,qEAAqE;IAC/D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAS5B,0DAA0D;IAC1D,YAAY,IAAI,IAAI;IAKpB,6BAA6B;IAC7B,IAAI,IAAI,IAAI;IAOZ,+CAA+C;IAC/C,SAAS,IAAI,OAAO;IAIpB,wDAAwD;IACxD,OAAO,CAAC,YAAY;IAiBpB,yFAAyF;IACzF,OAAO,CAAC,iBAAiB;IAoBzB,OAAO,CAAC,gBAAgB;CAsBzB"}

package/dist/poller.js

@@ -35,11 +35,15 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ArtifactPoller = void 0;
 const crypto = __importStar(require("crypto"));
-const decrypt_1 = require("./decrypt");
-const kms_1 = require("./kms");
+const artifact_decryptor_1 = require("./artifact-decryptor");
+const signature_1 = require("./signature");
 /**
  * Periodically fetches a published artifact, decrypts it, and swaps the
  * secrets cache when a new revision is detected.
+ *
+ * In JIT mode (cacheTtl=0 with encryptedStore), the poller fetches and
+ * validates the artifact but does NOT decrypt. The encrypted artifact is
+ * stored for on-demand decryption by the request handler.
  */
 /** Minimum poll interval in milliseconds (floor for all scheduling). */
 const MIN_POLL_MS = 5_000;
@@ -48,21 +52,68 @@ class ArtifactPoller {
     lastContentHash = null;
     lastRevision = null;
     lastExpiresAt = null;
-    decryptor = new decrypt_1.AgeDecryptor();
+    decryptor;
     options;
+    jitMode;
     telemetryOverride;
     constructor(options) {
         this.options = options;
+        this.jitMode = !!options.encryptedStore;
+        this.decryptor = new artifact_decryptor_1.ArtifactDecryptor({
+            privateKey: options.privateKey,
+            telemetry: options.telemetry,
+        });
+    }
+    /** Get the decryptor instance (for JIT mode server wiring). */
+    getDecryptor() {
+        return this.decryptor;
     }
     /** Set or replace the telemetry emitter (e.g. after resolving token from secrets). */
     setTelemetry(emitter) {
         this.telemetryOverride = emitter;
+        this.decryptor.setTelemetry(emitter);
     }
     get telemetry() {
         return this.telemetryOverride ?? this.options.telemetry;
     }
-    /** Fetch, validate, decrypt, and cache the artifact. */
+    /**
+     * Fetch, validate, decrypt, and cache the artifact.
+     * Used in cached mode (cacheTtl > 0).
+     */
     async fetchAndDecrypt() {
+        const result = await this.fetchRaw();
+        if (!result)
+            return; // short-circuited (unchanged hash)
+        await this.validateDecryptAndCache(result.artifact, result.contentHash);
+    }
+    /**
+     * Fetch and validate the artifact without decrypting.
+     * Stores the validated envelope in the encryptedStore for on-demand decryption.
+     * Used in JIT mode (cacheTtl = 0).
+     */
+    async fetchAndValidate() {
+        const result = await this.fetchRaw();
+        if (!result)
+            return; // short-circuited (unchanged hash)
+        const artifact = this.validateArtifact(result.artifact);
+        this.options.encryptedStore.swap(artifact);
+        this.lastRevision = artifact.revision;
+        this.lastContentHash = result.contentHash ?? null;
+        this.lastExpiresAt = artifact.expiresAt ?? null;
+        this.options.onRefresh?.(artifact.revision);
+        this.telemetry?.artifactRefreshed({
+            revision: artifact.revision,
+            keyCount: artifact.keys.length,
+            kmsEnvelope: !!artifact.envelope,
+        });
+    }
+    /**
+     * Fetch the raw artifact from the source (with disk cache fallback),
+     * parse JSON, and check for revocation.
+     *
+     * Returns null when the content hash is unchanged (short-circuit).
+     */
+    async fetchRaw() {
         let raw;
         let contentHash;
         try {
@@ -71,7 +122,7 @@ class ArtifactPoller {
             contentHash = result.contentHash;
             // Content-hash short-circuit: skip parse+decrypt if unchanged
             if (contentHash && contentHash === this.lastContentHash)
-                return;
+                return null;
             // Write to disk cache on successful fetch
             this.options.diskCache?.write(raw, contentHash);
         }
@@ -85,8 +136,8 @@ class ArtifactPoller {
             if (this.options.diskCache) {
                 const cached = this.options.diskCache.read();
                 if (cached) {
-                    // Check if disk cache has also expired
-                    if (ttl !== undefined) {
+                    // Check if disk cache has also expired (skip TTL check in JIT mode)
+                    if (ttl !== undefined && ttl > 0) {
                         const fetchedAt = this.options.diskCache.getFetchedAt();
                         if (fetchedAt && (Date.now() - new Date(fetchedAt).getTime()) / 1000 > ttl) {
                             this.options.cache.wipe();
@@ -102,11 +153,11 @@ class ArtifactPoller {
                     contentHash = this.options.diskCache.getCachedSha();
                     // If the cached hash matches, still skip
                     if (contentHash && contentHash === this.lastContentHash)
-                        return;
+                        return null;
                 }
                 else {
-                    // No disk cache content — check in-memory TTL
-                    if (ttl !== undefined && this.options.cache.isExpired(ttl)) {
+                    // No disk cache content — check in-memory TTL (skip in JIT mode)
+                    if (ttl !== undefined && ttl > 0 && this.options.cache.isExpired(ttl)) {
                         this.options.cache.wipe();
                         this.telemetry?.cacheExpired({
                             cacheTtlSeconds: ttl,
@@ -118,8 +169,8 @@ class ArtifactPoller {
                 }
             }
             else {
-                // No disk cache configured — check in-memory TTL
-                if (ttl !== undefined && this.options.cache.isExpired(ttl)) {
+                // No disk cache configured — check in-memory TTL (skip in JIT mode)
+                if (ttl !== undefined && ttl > 0 && this.options.cache.isExpired(ttl)) {
                     this.options.cache.wipe();
                     this.telemetry?.cacheExpired({
                         cacheTtlSeconds: ttl,
@@ -130,11 +181,11 @@ class ArtifactPoller {
                 throw err;
             }
         }
-        // Check for revocation before full validation — a revoked artifact
-        // won't have ciphertext/revision fields.
         const parsed = JSON.parse(raw);
+        // Check for revocation before full validation
         if (parsed.revokedAt) {
             this.options.cache.wipe();
+            this.options.encryptedStore?.wipe();
             this.options.diskCache?.purge();
             this.lastRevision = null;
             this.lastContentHash = null;
@@ -143,18 +194,18 @@ class ArtifactPoller {
             });
             throw new Error(`Artifact revoked: ${parsed.identity}/${parsed.environment} at ${parsed.revokedAt}`);
         }
-        // Validate, decrypt, and cache — emit artifact.invalid on any failure
-        await this.validateDecryptAndCache(raw, contentHash);
+        return { artifact: parsed, contentHash };
     }
     /**
-     * Validate the artifact, decrypt it, and swap the cache.
-     * Emits `artifact.invalid` on any validation or decryption failure,
-     * and `artifact.expired` / `artifact.refreshed` on their respective paths.
+     * Validate the artifact envelope: version, required fields, expiry,
+     * revision dedup, integrity hash, and signature.
+     * Emits `artifact.invalid` / `artifact.expired` telemetry on failure.
+     * Returns the validated artifact, or throws.
      */
-    async validateDecryptAndCache(raw, contentHash) {
+    validateArtifact(parsed) {
         let artifact;
         try {
-            artifact = this.parseAndValidate(raw);
+            artifact = this.validateEnvelope(parsed);
         }
         catch (err) {
             this.telemetry?.artifactInvalid({
@@ -166,13 +217,14 @@ class ArtifactPoller {
         // Check artifact-level expiry
         if (artifact.expiresAt && Date.now() > new Date(artifact.expiresAt).getTime()) {
             this.options.cache.wipe();
+            this.options.encryptedStore?.wipe();
             this.options.diskCache?.purge();
             this.telemetry?.artifactExpired({ expiresAt: artifact.expiresAt });
             throw new Error(`Artifact expired at ${artifact.expiresAt}`);
         }
         // Skip if revision unchanged
         if (artifact.revision === this.lastRevision)
-            return;
+            return artifact;
         // Verify integrity
         const hash = crypto.createHash("sha256").update(artifact.ciphertext).digest("hex");
         if (hash !== artifact.ciphertextHash) {
@@ -183,65 +235,72 @@ class ArtifactPoller {
             });
             throw err;
         }
-        // Resolve the age private key
-        let agePrivateKey;
-        if (artifact.envelope) {
-            // KMS envelope: unwrap the ephemeral private key via KMS
+        // Verify signature when a verify key is configured (hard reject)
+        if (this.options.verifyKey) {
+            if (!artifact.signature) {
+                const err = new Error("Artifact signature verification failed: artifact is unsigned but a verify key is configured. " +
+                    "Only signed artifacts are accepted when signature verification is enabled.");
+                this.telemetry?.artifactInvalid({
+                    reason: "signature_missing",
+                    error: err.message,
+                });
+                throw err;
+            }
+            const payload = (0, signature_1.buildSigningPayload)(artifact);
+            let valid;
             try {
-                const kms = (0, kms_1.createKmsProvider)(artifact.envelope.provider);
-                const wrappedKey = Buffer.from(artifact.envelope.wrappedKey, "base64");
-                const unwrapped = await kms.unwrap(artifact.envelope.keyId, wrappedKey, artifact.envelope.algorithm);
-                // Note: unwrapped Buffer is zeroed below, but the resulting JS string is
-                // immutable and cannot be cleared (inherent V8/Node.js limitation). Accepted risk.
-                agePrivateKey = unwrapped.toString("utf-8");
-                unwrapped.fill(0);
+                valid = (0, signature_1.verifySignature)(payload, artifact.signature, this.options.verifyKey);
             }
-            catch (err) {
+            catch (sigErr) {
+                const err = new Error(`Artifact signature verification error: ${sigErr instanceof Error ? sigErr.message : String(sigErr)}`);
                 this.telemetry?.artifactInvalid({
-                    reason: "kms_unwrap",
-                    error: err instanceof Error ? err.message : String(err),
+                    reason: "signature_error",
+                    error: err.message,
                 });
                 throw err;
             }
-        }
-        else {
-            // Age-only: use the static private key (config error, not artifact.invalid)
-            if (!this.options.privateKey) {
-                throw new Error("Artifact requires an age private key. Set CLEF_AGENT_AGE_KEY or use KMS envelope encryption.");
-            }
-            agePrivateKey = this.options.privateKey;
-        }
-        // Decrypt
-        try {
-            const plaintext = await this.decryptor.decrypt(artifact.ciphertext, agePrivateKey);
-            const values = JSON.parse(plaintext);
-            // Atomic swap
-            this.options.cache.swap(values, artifact.keys, artifact.revision);
-            this.lastRevision = artifact.revision;
-            this.lastContentHash = contentHash ?? null;
-            this.lastExpiresAt = artifact.expiresAt ?? null;
-            this.options.onRefresh?.(artifact.revision);
-            this.telemetry?.artifactRefreshed({
-                revision: artifact.revision,
-                keyCount: artifact.keys.length,
-                kmsEnvelope: !!artifact.envelope,
-            });
-        }
-        catch (err) {
-            // Don't double-emit for errors already classified above
-            if (err instanceof Error && !err.message.includes("integrity check failed")) {
+            if (!valid) {
+                const err = new Error("Artifact signature verification failed: signature does not match the verify key. " +
+                    "The artifact may have been tampered with or signed by a different key.");
                 this.telemetry?.artifactInvalid({
-                    reason: err instanceof SyntaxError ? "payload_parse" : "decrypt",
+                    reason: "signature_invalid",
                     error: err.message,
                 });
+                throw err;
             }
-            throw err;
         }
+        return artifact;
+    }
+    /**
+     * Validate then decrypt and cache. Used by fetchAndDecrypt (cached mode).
+     */
+    async validateDecryptAndCache(parsed, contentHash) {
+        const artifact = this.validateArtifact(parsed);
+        // Skip if revision unchanged (validateArtifact returns but doesn't throw)
+        if (artifact.revision === this.lastRevision)
+            return;
+        // Delegate decryption to the ArtifactDecryptor
+        const { values } = await this.decryptor.decrypt(artifact);
+        // Atomic swap
+        this.options.cache.swap(values, artifact.keys, artifact.revision);
+        this.lastRevision = artifact.revision;
+        this.lastContentHash = contentHash ?? null;
+        this.lastExpiresAt = artifact.expiresAt ?? null;
+        this.options.onRefresh?.(artifact.revision);
+        this.telemetry?.artifactRefreshed({
+            revision: artifact.revision,
+            keyCount: artifact.keys.length,
+            kmsEnvelope: !!artifact.envelope,
+        });
     }
     /** Start the polling loop. Performs an initial fetch immediately. */
     async start() {
-        // Initial fetch — fail fast if source is unreachable
-        await this.fetchAndDecrypt();
+        if (this.jitMode) {
+            await this.fetchAndValidate();
+        }
+        else {
+            await this.fetchAndDecrypt();
+        }
         this.scheduleNext();
     }
     /** Start only the polling schedule (no initial fetch). */
@@ -267,7 +326,12 @@ class ArtifactPoller {
         this.timer = setTimeout(async () => {
             this.timer = null;
             try {
-                await this.fetchAndDecrypt();
+                if (this.jitMode) {
+                    await this.fetchAndValidate();
+                }
+                else {
+                    await this.fetchAndDecrypt();
+                }
             }
             catch (err) {
                 this.options.onError?.(err instanceof Error ? err : new Error(String(err)));
@@ -286,6 +350,9 @@ class ArtifactPoller {
             // Already expired — poll immediately (with floor)
             return MIN_POLL_MS;
         }
+        // JIT mode: 5s interval for fast recovery after rotate + re-enable IAM
+        if (this.jitMode)
+            return MIN_POLL_MS;
         // Fallback: derive from cacheTtl (default 30s if no TTL configured)
         const ttl = this.options.cacheTtl;
         if (ttl !== undefined) {
@@ -293,8 +360,7 @@ class ArtifactPoller {
         }
         return 30_000;
     }
-    parseAndValidate(raw) {
-        const artifact = JSON.parse(raw);
+    validateEnvelope(artifact) {
         if (artifact.version !== 1) {
             throw new Error(`Unsupported artifact version: ${artifact.version}`);
         }
@@ -305,7 +371,9 @@ class ArtifactPoller {
             if (!artifact.envelope.provider ||
                 !artifact.envelope.keyId ||
                 !artifact.envelope.wrappedKey ||
-                !artifact.envelope.algorithm) {
+                !artifact.envelope.algorithm ||
+                !artifact.envelope.iv ||
+                !artifact.envelope.authTag) {
                 throw new Error("Invalid artifact: incomplete envelope fields.");
             }
         }
@@ -324,6 +392,8 @@ function classifyValidationError(err) {
         return "missing_fields";
     if (msg.includes("incomplete envelope"))
         return "incomplete_envelope";
+    if (msg.includes("signature"))
+        return "signature";
     return "unknown";
 }
 //# sourceMappingURL=poller.js.map

package/dist/poller.js.map

@@ -1 +1 @@
-{"version":3,"file":"poller.js","sourceRoot":"","sources":["../src/poller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,+CAAiC;AAEjC,uCAAyC;AAGzC,+BAA0C;AA+C1C;;;GAGG;AACH,wEAAwE;AACxE,MAAM,WAAW,GAAG,KAAK,CAAC;AAE1B,MAAa,cAAc;IACjB,KAAK,GAAyC,IAAI,CAAC;IACnD,eAAe,GAAkB,IAAI,CAAC;IACtC,YAAY,GAAkB,IAAI,CAAC;IACnC,aAAa,GAAkB,IAAI,CAAC;IAC3B,SAAS,GAAG,IAAI,sBAAY,EAAE,CAAC;IAC/B,OAAO,CAAgB;IAChC,iBAAiB,CAAoB;IAE7C,YAAY,OAAsB;QAChC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,sFAAsF;IACtF,YAAY,CAAC,OAAyB;QACpC,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC;IACnC,CAAC;IAED,IAAY,SAAS;QACnB,OAAO,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;IAC1D,CAAC;IAED,wDAAwD;IACxD,KAAK,CAAC,eAAe;QACnB,IAAI,GAAW,CAAC;QAChB,IAAI,WAA+B,CAAC;QAEpC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACjD,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;YACjB,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;YAEjC,8DAA8D;YAC9D,IAAI,WAAW,IAAI,WAAW,KAAK,IAAI,CAAC,eAAe;gBAAE,OAAO;YAEhE,0CAA0C;YAC1C,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC;gBAC1B,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBACvD,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE;aACrD,CAAC,CAAC;YAEH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;YAClC,8BAA8B;YAC9B,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;gBAC7C,IAAI,MAAM,EAAE,CAAC;oBACX,uCAAuC;oBACvC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;wBACtB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;wBACxD,IAAI,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC;4BAC3E,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;4BAC1B,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;4BAC/B,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC;gCAC3B,eAAe,EAAE,GAAG;gCACpB,eAAe,EAAE,IAAI;6BACtB,CAAC,CAAC;4BACH,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;wBAC7E,CAAC;oBACH,CAAC;oBACD,GAAG,GAAG,MAAM,CAAC;oBACb,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;oBACpD,yCAAyC;oBACzC,IAAI,WAAW,IAAI,WAAW,KAAK,IAAI,CAAC,eAAe;wBAAE,OAAO;gBAClE,CAAC;qBAAM,CAAC;oBACN,8CAA8C;oBAC9C,IAAI,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC3D,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;wBAC1B,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC;4BAC3B,eAAe,EAAE,GAAG;4BACpB,eAAe,EAAE,KAAK;yBACvB,CAAC,CAAC;wBACH,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;oBAC7E,CAAC;oBACD,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,iDAAiD;gBACjD,IAAI,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC3D,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;oBAC1B,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC;wBAC3B,eAAe,EAAE,GAAG;wBACpB,eAAe,EAAE,KAAK;qBACvB,CAAC,CAAC;oBACH,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;gBAC7E,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,mEAAmE;QACnE,yCAAyC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;QAC1D,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC;YAChC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;YACzB,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;YAC5B,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC;gBAC9B,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;aACpC,CAAC,CAAC;YACH,MAAM,IAAI,KAAK,CACb,qBAAqB,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,WAAW,OAAO,MAAM,CAAC,SAAS,EAAE,CACpF,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,MAAM,IAAI,CAAC,uBAAuB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACvD,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,uBAAuB,CACnC,GAAW,EACX,WAA+B;QAE/B,IAAI,QAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC;gBAC9B,MAAM,EAAE,uBAAuB,CAAC,GAAG,CAAC;gBACpC,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;YACH,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,8BAA8B;QAC9B,IAAI,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YAC9E,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC;YAChC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,6BAA6B;QAC7B,IAAI,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC,YAAY;YAAE,OAAO;QAEpD,mBAAmB;QACnB,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnF,IAAI,IAAI,KAAK,QAAQ,CAAC,cAAc,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,IAAI,KAAK,CACnB,kDAAkD,QAAQ,CAAC,cAAc,SAAS,IAAI,EAAE,CACzF,CAAC;YACF,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC;gBAC9B,MAAM,EAAE,WAAW;gBACnB,KAAK,EAAE,GAAG,CAAC,OAAO;aACnB,CAAC,CAAC;YACH,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,8BAA8B;QAC9B,IAAI,aAAqB,CAAC;QAC1B,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,yDAAyD;YACzD,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAA,uBAAiB,EAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAC1D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;gBACvE,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,MAAM,CAChC,QAAQ,CAAC,QAAQ,CAAC,KAAK,EACvB,UAAU,EACV,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAC5B,CAAC;gBACF,yEAAyE;gBACzE,mFAAmF;gBACnF,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAC5C,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACpB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC;oBAC9B,MAAM,EAAE,YAAY;oBACpB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACxD,CAAC,CAAC;gBACH,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,4EAA4E;YAC5E,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CACb,8FAA8F,CAC/F,CAAC;YACJ,CAAC;YACD,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;QAC1C,CAAC;QAED,UAAU;QACV,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;YACnF,MAAM,MAAM,GAA2B,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAE7D,cAAc;YACd,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAClE,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC;YACtC,IAAI,CAAC,eAAe,GAAG,WAAW,IAAI,IAAI,CAAC;YAC3C,IAAI,CAAC,aAAa,GAAG,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC;YAChD,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC5C,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC;gBAChC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM;gBAC9B,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ;aACjC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wDAAwD;YACxD,IAAI,GAAG,YAAY,KAAK,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC;gBAC5E,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC;oBAC9B,MAAM,EAAE,GAAG,YAAY,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;oBAChE,KAAK,EAAE,GAAG,CAAC,OAAO;iBACnB,CAAC,CAAC;YACL,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,KAAK,CAAC,KAAK;QACT,qDAAqD;QACrD,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAC7B,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAED,0DAA0D;IAC1D,YAAY;QACV,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QACvB,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAED,6BAA6B;IAC7B,IAAI;QACF,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACzB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACpB,CAAC;IACH,CAAC;IAED,+CAA+C;IAC/C,SAAS;QACP,OAAO,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC;IAC7B,CAAC;IAED,wDAAwD;IAChD,YAAY;QAClB,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,IAAI,EAAE;YACjC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;YAC/B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC9E,CAAC;YACD,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,CAAC,EAAE,OAAO,CAAC,CAAC;IACd,CAAC;IAED,yFAAyF;IACjF,iBAAiB;QACvB,qEAAqE;QACrE,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACxE,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,GAAG,GAAG,EAAE,WAAW,CAAC,CAAC;YAClD,CAAC;YACD,kDAAkD;YAClD,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,oEAAoE;QACpE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QAClC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,WAAW,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,gBAAgB,CAAC,GAAW;QAClC,MAAM,QAAQ,GAAqB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC;QAEvE,IAAI,QAAQ,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;YAC3E,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,IACE,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ;gBAC3B,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK;gBACxB,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU;gBAC7B,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAC5B,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AAzSD,wCAySC;AAED,wFAAwF;AACxF,SAAS,uBAAuB,CAAC,GAAY;IAC3C,IAAI,GAAG,YAAY,WAAW;QAAE,OAAO,YAAY,CAAC;IACpD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,IAAI,GAAG,CAAC,QAAQ,CAAC,8BAA8B,CAAC;QAAE,OAAO,qBAAqB,CAAC;IAC/E,IAAI,GAAG,CAAC,QAAQ,CAAC,yBAAyB,CAAC;QAAE,OAAO,gBAAgB,CAAC;IACrE,IAAI,GAAG,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QAAE,OAAO,qBAAqB,CAAC;IACtE,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"poller.js","sourceRoot":"","sources":["../src/poller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,+CAAiC;AAKjC,6DAAyD;AAEzD,2CAAmE;AA6DnE;;;;;;;GAOG;AACH,wEAAwE;AACxE,MAAM,WAAW,GAAG,KAAK,CAAC;AAE1B,MAAa,cAAc;IACjB,KAAK,GAAyC,IAAI,CAAC;IACnD,eAAe,GAAkB,IAAI,CAAC;IACtC,YAAY,GAAkB,IAAI,CAAC;IACnC,aAAa,GAAkB,IAAI,CAAC;IAC3B,SAAS,CAAoB;IAC7B,OAAO,CAAgB;IACvB,OAAO,CAAU;IAC1B,iBAAiB,CAAoB;IAE7C,YAAY,OAAsB;QAChC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,IAAI,sCAAiB,CAAC;YACrC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,+DAA+D;IAC/D,YAAY;QACV,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,sFAAsF;IACtF,YAAY,CAAC,OAAyB;QACpC,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC;QACjC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAED,IAAY,SAAS;QACnB,OAAO,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;IAC1D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe;QACnB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,mCAAmC;QACxD,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAC1E,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB;QACpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,mCAAmC;QAExD,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAExD,IAAI,CAAC,OAAO,CAAC,cAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC;QACtC,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC;QAClD,IAAI,CAAC,aAAa,GAAG,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC;QAChD,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC;YAChC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM;YAC9B,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ;SACjC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,QAAQ;QAIpB,IAAI,GAAW,CAAC;QAChB,IAAI,WAA+B,CAAC;QAEpC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACjD,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;YACjB,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;YAEjC,8DAA8D;YAC9D,IAAI,WAAW,IAAI,WAAW,KAAK,IAAI,CAAC,eAAe;gBAAE,OAAO,IAAI,CAAC;YAErE,0CAA0C;YAC1C,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC;gBAC1B,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBACvD,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE;aACrD,CAAC,CAAC;YAEH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;YAClC,8BAA8B;YAC9B,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;gBAC7C,IAAI,MAAM,EAAE,CAAC;oBACX,oEAAoE;oBACpE,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;wBACjC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;wBACxD,IAAI,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC;4BAC3E,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;4BAC1B,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;4BAC/B,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC;gCAC3B,eAAe,EAAE,GAAG;gCACpB,eAAe,EAAE,IAAI;6BACtB,CAAC,CAAC;4BACH,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;wBAC7E,CAAC;oBACH,CAAC;oBACD,GAAG,GAAG,MAAM,CAAC;oBACb,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;oBACpD,yCAAyC;oBACzC,IAAI,WAAW,IAAI,WAAW,KAAK,IAAI,CAAC,eAAe;wBAAE,OAAO,IAAI,CAAC;gBACvE,CAAC;qBAAM,CAAC;oBACN,iEAAiE;oBACjE,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;wBACtE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;wBAC1B,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC;4BAC3B,eAAe,EAAE,GAAG;4BACpB,eAAe,EAAE,KAAK;yBACvB,CAAC,CAAC;wBACH,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;oBAC7E,CAAC;oBACD,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,oEAAoE;gBACpE,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;oBACtE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;oBAC1B,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC;wBAC3B,eAAe,EAAE,GAAG;wBACpB,eAAe,EAAE,KAAK;qBACvB,CAAC,CAAC;oBACH,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;gBAC7E,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;QAE1D,8CAA8C;QAC9C,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;YACpC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC;YAChC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;YACzB,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;YAC5B,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC;gBAC9B,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;aACpC,CAAC,CAAC;YACH,MAAM,IAAI,KAAK,CACb,qBAAqB,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,WAAW,OAAO,MAAM,CAAC,SAAS,EAAE,CACpF,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,MAAqC,EAAE,WAAW,EAAE,CAAC;IAC1E,CAAC;IAED;;;;;OAKG;IACK,gBAAgB,CAAC,MAAwB;QAC/C,IAAI,QAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC;gBAC9B,MAAM,EAAE,uBAAuB,CAAC,GAAG,CAAC;gBACpC,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;YACH,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,8BAA8B;QAC9B,IAAI,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YAC9E,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;YACpC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC;YAChC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,6BAA6B;QAC7B,IAAI,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC,YAAY;YAAE,OAAO,QAAQ,CAAC;QAE7D,mBAAmB;QACnB,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnF,IAAI,IAAI,KAAK,QAAQ,CAAC,cAAc,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,IAAI,KAAK,CACnB,kDAAkD,QAAQ,CAAC,cAAc,SAAS,IAAI,EAAE,CACzF,CAAC;YACF,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC;gBAC9B,MAAM,EAAE,WAAW;gBACnB,KAAK,EAAE,GAAG,CAAC,OAAO;aACnB,CAAC,CAAC;YACH,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,iEAAiE;QACjE,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;gBACxB,MAAM,GAAG,GAAG,IAAI,KAAK,CACnB,+FAA+F;oBAC7F,4EAA4E,CAC/E,CAAC;gBACF,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC;oBAC9B,MAAM,EAAE,mBAAmB;oBAC3B,KAAK,EAAE,GAAG,CAAC,OAAO;iBACnB,CAAC,CAAC;gBACH,MAAM,GAAG,CAAC;YACZ,CAAC;YAED,MAAM,OAAO,GAAG,IAAA,+BAAmB,EAAC,QAAQ,CAAC,CAAC;YAC9C,IAAI,KAAc,CAAC;YACnB,IAAI,CAAC;gBACH,KAAK,GAAG,IAAA,2BAAe,EAAC,OAAO,EAAE,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,MAAM,EAAE,CAAC;gBAChB,MAAM,GAAG,GAAG,IAAI,KAAK,CACnB,0CAA0C,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CACtG,CAAC;gBACF,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC;oBAC9B,MAAM,EAAE,iBAAiB;oBACzB,KAAK,EAAE,GAAG,CAAC,OAAO;iBACnB,CAAC,CAAC;gBACH,MAAM,GAAG,CAAC;YACZ,CAAC;YAED,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,GAAG,GAAG,IAAI,KAAK,CACnB,mFAAmF;oBACjF,wEAAwE,CAC3E,CAAC;gBACF,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC;oBAC9B,MAAM,EAAE,mBAAmB;oBAC3B,KAAK,EAAE,GAAG,CAAC,OAAO;iBACnB,CAAC,CAAC;gBACH,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,uBAAuB,CACnC,MAAwB,EACxB,WAA+B;QAE/B,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAE/C,0EAA0E;QAC1E,IAAI,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC,YAAY;YAAE,OAAO;QAEpD,+CAA+C;QAC/C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAE1D,cAAc;QACd,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAClE,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC;QACtC,IAAI,CAAC,eAAe,GAAG,WAAW,IAAI,IAAI,CAAC;QAC3C,IAAI,CAAC,aAAa,GAAG,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC;QAChD,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC;YAChC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM;YAC9B,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ;SACjC,CAAC,CAAC;IACL,CAAC;IAED,qEAAqE;IACrE,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAED,0DAA0D;IAC1D,YAAY;QACV,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QACvB,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAED,6BAA6B;IAC7B,IAAI;QACF,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACzB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACpB,CAAC;IACH,CAAC;IAED,+CAA+C;IAC/C,SAAS;QACP,OAAO,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC;IAC7B,CAAC;IAED,wDAAwD;IAChD,YAAY;QAClB,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,IAAI,EAAE;YACjC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAClB,IAAI,CAAC;gBACH,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;oBACjB,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBAChC,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;gBAC/B,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC9E,CAAC;YACD,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,CAAC,EAAE,OAAO,CAAC,CAAC;IACd,CAAC;IAED,yFAAyF;IACjF,iBAAiB;QACvB,qEAAqE;QACrE,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACxE,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;gBACpB,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,GAAG,GAAG,EAAE,WAAW,CAAC,CAAC;YAClD,CAAC;YACD,kDAAkD;YAClD,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,uEAAuE;QACvE,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,WAAW,CAAC;QACrC,oEAAoE;QACpE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QAClC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,WAAW,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,gBAAgB,CAAC,QAA0B;QACjD,IAAI,QAAQ,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;YAC3E,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,IACE,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ;gBAC3B,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK;gBACxB,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU;gBAC7B,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS;gBAC5B,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;gBACrB,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAC1B,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AAlXD,wCAkXC;AAED,wFAAwF;AACxF,SAAS,uBAAuB,CAAC,GAAY;IAC3C,IAAI,GAAG,YAAY,WAAW;QAAE,OAAO,YAAY,CAAC;IACpD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,IAAI,GAAG,CAAC,QAAQ,CAAC,8BAA8B,CAAC;QAAE,OAAO,qBAAqB,CAAC;IAC/E,IAAI,GAAG,CAAC,QAAQ,CAAC,yBAAyB,CAAC;QAAE,OAAO,gBAAgB,CAAC;IACrE,IAAI,GAAG,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QAAE,OAAO,qBAAqB,CAAC;IACtE,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,WAAW,CAAC;IAClD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/secrets-cache.d.ts

@@ -5,7 +5,7 @@ export declare class SecretsCache {
     swap(values: Record<string, string>, keys: string[], revision: string): void;
     /** Whether the cache has exceeded the given TTL (seconds). */
     isExpired(ttlSeconds: number): boolean;
-    /** Clear the cached snapshot. */
+    /** Clear the cached snapshot, zeroing values first (best-effort). */
     wipe(): void;
     /** Epoch ms when the cache was last swapped, or null if never loaded. */
     getSwappedAt(): number | null;

package/dist/secrets-cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secrets-cache.d.ts","sourceRoot":"","sources":["../src/secrets-cache.ts"],"names":[],"mappings":"AAOA,0DAA0D;AAC1D,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAA8B;IAE9C,mEAAmE;IACnE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI;IAI5E,8DAA8D;IAC9D,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAKtC,iCAAiC;IACjC,IAAI,IAAI,IAAI;IAIZ,yEAAyE;IACzE,YAAY,IAAI,MAAM,GAAG,IAAI;IAI7B,wFAAwF;IACxF,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIpC,oEAAoE;IACpE,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI;IAMvC,kDAAkD;IAClD,OAAO,IAAI,MAAM,EAAE;IAKnB,gEAAgE;IAChE,WAAW,IAAI,MAAM,GAAG,IAAI;IAI5B,uDAAuD;IACvD,OAAO,IAAI,OAAO;CAGnB"}
+{"version":3,"file":"secrets-cache.d.ts","sourceRoot":"","sources":["../src/secrets-cache.ts"],"names":[],"mappings":"AAOA,0DAA0D;AAC1D,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAA8B;IAE9C,mEAAmE;IACnE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI;IAW5E,8DAA8D;IAC9D,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAKtC,qEAAqE;IACrE,IAAI,IAAI,IAAI;IASZ,yEAAyE;IACzE,YAAY,IAAI,MAAM,GAAG,IAAI;IAI7B,wFAAwF;IACxF,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIpC,oEAAoE;IACpE,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI;IAMvC,kDAAkD;IAClD,OAAO,IAAI,MAAM,EAAE;IAKnB,gEAAgE;IAChE,WAAW,IAAI,MAAM,GAAG,IAAI;IAI5B,uDAAuD;IACvD,OAAO,IAAI,OAAO;CAGnB"}

package/dist/secrets-cache.js

@@ -6,6 +6,13 @@ class SecretsCache {
     snapshot = null;
     /** Replace the cached secrets in a single reference assignment. */
     swap(values, keys, revision) {
+        // Zero old values before dropping the reference — defense-in-depth
+        // against plaintext lingering in the heap until GC.
+        if (this.snapshot) {
+            for (const k of Object.keys(this.snapshot.values)) {
+                this.snapshot.values[k] = "";
+            }
+        }
         this.snapshot = { values: { ...values }, keys: [...keys], revision, swappedAt: Date.now() };
     }
     /** Whether the cache has exceeded the given TTL (seconds). */
@@ -14,8 +21,13 @@ class SecretsCache {
             return false;
         return (Date.now() - this.snapshot.swappedAt) / 1000 > ttlSeconds;
     }
-    /** Clear the cached snapshot. */
+    /** Clear the cached snapshot, zeroing values first (best-effort). */
     wipe() {
+        if (this.snapshot) {
+            for (const k of Object.keys(this.snapshot.values)) {
+                this.snapshot.values[k] = "";
+            }
+        }
         this.snapshot = null;
     }
     /** Epoch ms when the cache was last swapped, or null if never loaded. */

package/dist/secrets-cache.js.map

@@ -1 +1 @@
-{"version":3,"file":"secrets-cache.js","sourceRoot":"","sources":["../src/secrets-cache.ts"],"names":[],"mappings":";;;AAOA,0DAA0D;AAC1D,MAAa,YAAY;IACf,QAAQ,GAAyB,IAAI,CAAC;IAE9C,mEAAmE;IACnE,IAAI,CAAC,MAA8B,EAAE,IAAc,EAAE,QAAgB;QACnE,IAAI,CAAC,QAAQ,GAAG,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAC9F,CAAC;IAED,8DAA8D;IAC9D,SAAS,CAAC,UAAkB;QAC1B,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,IAAI,GAAG,UAAU,CAAC;IACpE,CAAC;IAED,iCAAiC;IACjC,IAAI;QACF,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;IACvB,CAAC;IAED,yEAAyE;IACzE,YAAY;QACV,OAAO,IAAI,CAAC,QAAQ,EAAE,SAAS,IAAI,IAAI,CAAC;IAC1C,CAAC;IAED,wFAAwF;IACxF,GAAG,CAAC,GAAW;QACb,OAAO,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IAED,oEAAoE;IACpE,MAAM;QACJ,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QACxB,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,OAAO,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;IACzB,CAAC;IAED,kDAAkD;IAClD,OAAO;QACL,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QACxB,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9B,CAAC;IAED,gEAAgE;IAChE,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,EAAE,QAAQ,IAAI,IAAI,CAAC;IACzC,CAAC;IAED,uDAAuD;IACvD,OAAO;QACL,OAAO,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC;IAChC,CAAC;CACF;AAnDD,oCAmDC"}
+{"version":3,"file":"secrets-cache.js","sourceRoot":"","sources":["../src/secrets-cache.ts"],"names":[],"mappings":";;;AAOA,0DAA0D;AAC1D,MAAa,YAAY;IACf,QAAQ,GAAyB,IAAI,CAAC;IAE9C,mEAAmE;IACnE,IAAI,CAAC,MAA8B,EAAE,IAAc,EAAE,QAAgB;QACnE,mEAAmE;QACnE,oDAAoD;QACpD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YAC/B,CAAC;QACH,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IAC9F,CAAC;IAED,8DAA8D;IAC9D,SAAS,CAAC,UAAkB;QAC1B,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,IAAI,GAAG,UAAU,CAAC;IACpE,CAAC;IAED,qEAAqE;IACrE,IAAI;QACF,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YAC/B,CAAC;QACH,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;IACvB,CAAC;IAED,yEAAyE;IACzE,YAAY;QACV,OAAO,IAAI,CAAC,QAAQ,EAAE,SAAS,IAAI,IAAI,CAAC;IAC1C,CAAC;IAED,wFAAwF;IACxF,GAAG,CAAC,GAAW;QACb,OAAO,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IAED,oEAAoE;IACpE,MAAM;QACJ,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QACxB,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,OAAO,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;IACzB,CAAC;IAED,kDAAkD;IAClD,OAAO;QACL,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QACxB,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9B,CAAC;IAED,gEAAgE;IAChE,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,EAAE,QAAQ,IAAI,IAAI,CAAC;IACzC,CAAC;IAED,uDAAuD;IACvD,OAAO;QACL,OAAO,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC;IAChC,CAAC;CACF;AA/DD,oCA+DC"}

package/dist/signature.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Minimal artifact shape for signature payload construction.
+ * Mirrors the fields from ArtifactEnvelope that the signature covers.
+ */
+interface SignableArtifact {
+    version: number;
+    identity: string;
+    environment: string;
+    revision: string;
+    packedAt: string;
+    ciphertextHash: string;
+    keys: string[];
+    expiresAt?: string;
+    envelope?: {
+        provider: string;
+        keyId: string;
+        wrappedKey: string;
+        algorithm: string;
+        iv?: string;
+        authTag?: string;
+    };
+}
+/**
+ * Build the canonical signing payload from an artifact.
+ *
+ * Must produce the same output as the core signer's buildSigningPayload
+ * to enable cross-package sign/verify. The format is a deterministic
+ * newline-separated string of all security-relevant fields.
+ */
+export declare function buildSigningPayload(artifact: SignableArtifact): Buffer;
+/**
+ * Verify a signature against a public key.
+ *
+ * The algorithm is derived from the key's type (Ed25519 or EC), not from
+ * the artifact's claimed signatureAlgorithm field.
+ *
+ * @param payload - Canonical signing payload
+ * @param signatureBase64 - Base64-encoded signature to verify
+ * @param publicKeyBase64 - Base64-encoded DER SPKI public key
+ * @returns true if the signature is valid
+ */
+export declare function verifySignature(payload: Buffer, signatureBase64: string, publicKeyBase64: string): boolean;
+export {};
+//# sourceMappingURL=signature.d.ts.map

package/dist/signature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature.d.ts","sourceRoot":"","sources":["../src/signature.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,UAAU,gBAAgB;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE;QACT,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,CAmBtE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,eAAe,EAAE,MAAM,EACvB,eAAe,EAAE,MAAM,GACtB,OAAO,CAgBT"}