@cotal-ai/core 0.11.5 → 0.12.0

package/dist/auth-provider.d.ts

@@ -1,4 +1,5 @@
 import { type Extension } from "./registry.js";
+import type { SecretStore } from "./secret-store.js";
 /**
  * The one extension kind an identity/auth implementation registers so a composition root can turn
  * on USER-MODE auth (the human-owner identity plane over per-agent NATS identity) WITHOUT importing
@@ -14,21 +15,29 @@ import { type Extension } from "./registry.js";
  * No provider registered ⇒ user-mode auth is unavailable and requesting it MUST fail loud (no
  * static fallback) — a library root that never imports the auth package simply cannot serve a
  * user-auth space.
+ *
+ * TWO state surfaces, split by the {@link SecretStore} seam: the provider's SECRET material
+ * (callout account, issuer keys, owner secret, service key projection) rides the `store` each
+ * method receives — the CALLER composes it (locally the workspace's `.cotal`-rooted filesystem
+ * store; a hosted composition injects KMS/Vault), the provider never discovers one ambiently.
+ * The provider's NON-SEAM state (the actor ledger, the IdP pin, service runtime discovery)
+ * stays under `dir`, the local state directory.
  */
 export interface AuthProvider extends Extension {
     readonly kind: "auth-provider";
     /**
-     * Ensure this space's user-auth material exists under `input.dir` (generated + persisted on the
-     * first call, reused verbatim after — account identities and signing keys MUST be stable across
-     * restarts or previously-issued credentials break) and describe what the composition root must
-     * wire up. Idempotent. This call may hold the provisioning seeds BRIEFLY; the long-lived service
+     * Ensure this space's user-auth material exists (generated + persisted on the first call, reused
+     * verbatim after — account identities and signing keys MUST be stable across restarts or
+     * previously-issued credentials break) and describe what the composition root must wire up.
+     * Secret material persists through `input.store`; non-seam state under `input.dir`. Idempotent. This call may hold the provisioning seeds BRIEFLY; the long-lived service
      * process must load only provider-owned projected files written here, never the space's full
      * trust bundle.
      */
     prepareServer(input: AuthPrepareInput): Promise<AuthPrepared>;
     /**
      * CLIENT side: produce the connect material for a user-mode space from THIS machine's session
-     * state (the login cache + the provider's space-scoped state under `dir`). `actor` is the
+     * state (the login cache + the provider's space-scoped state — secrets in `store`, the rest
+     * under `dir`). `actor` is the
      * ledger-granted agent-instance the caller connects as. Returns what {@link EndpointOptions}'
      * user mode consumes (`bearer` + `sentinelCreds`). MUST fail loud with the EXACT operator
      * action when anything is missing — not logged in (`cotal login --idp …`), the auth service
@@ -41,6 +50,7 @@ export interface AuthProvider extends Extension {
      * `spawn -f`) ride. An under-scoped or unknown view MUST fail loud with the exact re-grant.
      */
     userCredentials(opts: {
+        store: SecretStore;
         dir: string;
         space: string;
         actor: string;
@@ -54,9 +64,10 @@ export interface AuthProvider extends Extension {
      * offline from the login session + the space's local user-auth material (no IdP round trip).
      * The spawn paths use it to answer "whose agents are these": a foreground/manifest spawn runs
      * the agents under the OPERATOR's owner. MUST fail loud when not logged in (naming the exact
-     * `cotal login --idp …` line) or when the space has no user-auth material under `dir`.
+     * `cotal login --idp …` line) or when the space has no user-auth material (in `store`/`dir`).
      */
     ownerForLogin(opts: {
+        store: SecretStore;
         dir: string;
         space: string;
     }): Promise<string>;
@@ -64,10 +75,11 @@ export interface AuthProvider extends Extension {
      * Read-only OFFLINE introspection for status surfaces (`cotal status`): this machine's cached
      * login for the space and — where the space's ledger is locally readable — whether that login's
      * `actor` is granted. Never network-bound and never a mint; "not signed in" is a REPORTED state
-     * here, not a thrown one. Throws only when the space has no user-auth material under `dir`
+     * here, not a thrown one. Throws only when the space has no user-auth material in `store`/`dir`
      * (there is nothing to report status about).
      */
     userStatus(opts: {
+        store: SecretStore;
         dir: string;
         space: string;
         actor: string;
@@ -78,9 +90,10 @@ export interface AuthProvider extends Extension {
      * connect payloads". Returns the ONE-TIME plaintext agent secret (persisted only as a hash;
      * the caller delivers it to the agent process via a 0600 file and never sees it again) plus
      * the sentinel creds the agent presents alongside its bearers. Upsert — re-granting an actor
-     * rotates its secret. MUST fail loud when the space has no user-auth material under `dir`.
+     * rotates its secret. MUST fail loud when the space has no user-auth material in `store`/`dir`.
      */
     grantAgent(opts: {
+        store: SecretStore;
         dir: string;
         space: string;
         owner: string;
@@ -116,6 +129,45 @@ export interface AuthProvider extends Extension {
         owner: string;
         actor: string;
     }): Promise<string[] | undefined>;
+    /**
+     * Remove this provider's SECRET material for a space from the given store — the DELETE half of
+     * the seam pair (every kind that reads and writes through a {@link SecretStore} must be
+     * deletable through it, or a reset wipes local identity while an injected backend keeps the old
+     * secrets authoritative: split authority, and the next provision mixes a fresh trust bundle
+     * with stale stable identities). Attempts EVERY owned key even when one fails (each delete is
+     * idempotent by the store contract, so a failed pass is retryable as-is), then throws with the
+     * collected failures. Touches ONLY the store — non-seam state (ledger, IdP pin, discovery) is
+     * the caller's local-reset concern, swept only AFTER this succeeds.
+     */
+    deprovisionSecrets(opts: {
+        store: SecretStore;
+        space: string;
+    }): Promise<void>;
+    /**
+     * Read-only OFFLINE continuity commitment for this space's existing user-auth trust state. The
+     * provider defines `scheme`; `value` is safe to place in a backup manifest and MUST commit to the
+     * account identity, owner derivation, IdP/issuer pins, and every interactive + managed authority
+     * row. Missing or malformed state throws. This method must never create, repair, rotate, or mint.
+     */
+    trustFingerprint(opts: {
+        store: SecretStore;
+        dir: string;
+        space: string;
+    }): Promise<AuthTrustFingerprint>;
+    /**
+     * Validate that retained managed-agent material still names the SAME live principal and authority
+     * row. This is the resume path: it must reuse the supplied token/sentinel, never call
+     * {@link grantAgent}, rotate a token, create a row, or provision a replacement identity.
+     */
+    validateRetainedAgent(opts: {
+        store: SecretStore;
+        dir: string;
+        space: string;
+        owner: string;
+        actor: string;
+        actorToken: string;
+        sentinelCreds: string;
+    }): Promise<RetainedAgentAuthority>;
     /**
      * Registry name of the provider's self-registered {@link Command} that prints ONE fresh agent
      * bearer to stdout and exits (flags: `--dir <state-dir> --space <space> --owner <o> --actor <a>
@@ -124,6 +176,21 @@ export interface AuthProvider extends Extension {
      * runtime only runs an argv and reads a line. */
     readonly agentBearerCommand: string;
 }
+/** Provider-defined, versioned manifest-safe commitment. Callers compare both fields exactly. */
+export interface AuthTrustFingerprint {
+    scheme: string;
+    value: string;
+}
+/** Existing managed row returned after retained secret + sentinel validation. */
+export interface RetainedAgentAuthority {
+    owner: string;
+    actor: string;
+    scope: string[];
+    allowSubscribe: string[];
+    allowPublish: string[];
+    role?: string;
+    parent?: string;
+}
 /** The ONE registered auth provider, or a thrown sentence naming the fix. More than one registered
  *  is ambiguous and refuses just as loudly — there is no pick-the-first fallback. Lives in core so
  *  every surface that resolves the provider generically (CLI, manager) shares one resolution. */
@@ -165,8 +232,13 @@ export interface AuthPrepareInput {
         pub: string;
         signingSeed: string;
     };
-    /** The provider's OWN state dir. The caller keys it — today `<root>/.cotal/auth/<space>`; a
-     *  future (broker, space) key is a caller change, never an on-disk format break. */
+    /** Where the provider's SECRET material persists (callout account, issuer keys, owner secret,
+     *  service key projection) — caller-composed, keys are the provider's own. Locally the
+     *  workspace's `.cotal`-rooted filesystem store; a hosted composition injects its backend. */
+    store: SecretStore;
+    /** The provider's OWN state dir for NON-SEAM state (actor ledger, IdP pin, service runtime
+     *  discovery). The caller keys it — today `<root>/.cotal/auth/<space>`; a future
+     *  (broker, space) key is a caller change, never an on-disk format break. */
     dir: string;
     /** The operator's external identity-provider base URL (`up --user-auth --idp <url>`), OPAQUE to
      *  core — the provider pins/persists it (first call requires one; a later call must match the

package/dist/auth-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-provider.d.ts","sourceRoot":"","sources":["../src/auth-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AAEzD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,YAAa,SAAQ,SAAS;IAC7C,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B;;;;;;;OAOG;IACH,aAAa,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC9D;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxI;;;;;;OAMG;IACH,aAAa,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACrE;;;;;;OAMG;IACH,UAAU,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACzF;;;;;;;OAOG;IACH,UAAU,CAAC,IAAI,EAAE;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,cAAc,EAAE,MAAM,EAAE,CAAC;QACzB,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,oFAAoF;QACpF,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3D;;8FAE0F;IAC1F,WAAW,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnF;;;;;;OAMG;IACH,UAAU,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IAC/F;;;;;qDAKiD;IACjD,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED;;iGAEiG;AACjG,wBAAgB,mBAAmB,IAAI,YAAY,CASlD;AAED;iEACiE;AACjE,MAAM,WAAW,cAAc;IAC7B,6FAA6F;IAC7F,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,KAAK,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;6FACyF;IACzF,KAAK,CAAC,EACF;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,EAAE,MAAM,EAAE,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GACpG,aAAa,CAAC;CACnB;AAED;;;0FAG0F;AAC1F,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd;gEAC4D;IAC5D,YAAY,EAAE,MAAM,CAAC;IACrB;8FAC0F;IAC1F,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C;wFACoF;IACpF,GAAG,EAAE,MAAM,CAAC;IACZ;;2FAEuF;IACvF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,+DAA+D;AAC/D,MAAM,WAAW,YAAY;IAC3B;qEACiE;IACjE,aAAa,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnD;;8DAE0D;IAC1D,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,iFAAiF;IACjF,OAAO,EAAE,eAAe,CAAC;CAC1B;AAED;;;uEAGuE;AACvE,MAAM,WAAW,eAAe;IAC9B;8EAC0E;IAC1E,OAAO,EAAE,MAAM,CAAC;IAChB;;+FAE2F;IAC3F,KAAK,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACpF"}
+{"version":3,"file":"auth-provider.d.ts","sourceRoot":"","sources":["../src/auth-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,YAAa,SAAQ,SAAS;IAC7C,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B;;;;;;;OAOG;IACH,aAAa,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC9D;;;;;;;;;;;;;;OAcG;IACH,eAAe,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,WAAW,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5J;;;;;;OAMG;IACH,aAAa,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,WAAW,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACzF;;;;;;OAMG;IACH,UAAU,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,WAAW,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7G;;;;;;;OAOG;IACH,UAAU,CAAC,IAAI,EAAE;QACf,KAAK,EAAE,WAAW,CAAC;QACnB,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,cAAc,EAAE,MAAM,EAAE,CAAC;QACzB,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,oFAAoF;QACpF,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3D;;8FAE0F;IAC1F,WAAW,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnF;;;;;;OAMG;IACH,UAAU,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IAC/F;;;;;;;;;OASG;IACH,kBAAkB,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,WAAW,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E;;;;;OAKG;IACH,gBAAgB,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,WAAW,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC1G;;;;OAIG;IACH,qBAAqB,CAAC,IAAI,EAAE;QAC1B,KAAK,EAAE,WAAW,CAAC;QACnB,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;QACnB,aAAa,EAAE,MAAM,CAAC;KACvB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACpC;;;;;qDAKiD;IACjD,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED,iGAAiG;AACjG,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAED,iFAAiF;AACjF,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;iGAEiG;AACjG,wBAAgB,mBAAmB,IAAI,YAAY,CASlD;AAED;iEACiE;AACjE,MAAM,WAAW,cAAc;IAC7B,6FAA6F;IAC7F,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,KAAK,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;6FACyF;IACzF,KAAK,CAAC,EACF;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,EAAE,MAAM,EAAE,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GACpG,aAAa,CAAC;CACnB;AAED;;;0FAG0F;AAC1F,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd;gEAC4D;IAC5D,YAAY,EAAE,MAAM,CAAC;IACrB;8FAC0F;IAC1F,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C;;kGAE8F;IAC9F,KAAK,EAAE,WAAW,CAAC;IACnB;;iFAE6E;IAC7E,GAAG,EAAE,MAAM,CAAC;IACZ;;2FAEuF;IACvF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,+DAA+D;AAC/D,MAAM,WAAW,YAAY;IAC3B;qEACiE;IACjE,aAAa,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnD;;8DAE0D;IAC1D,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,iFAAiF;IACjF,OAAO,EAAE,eAAe,CAAC;CAC1B;AAED;;;uEAGuE;AACvE,MAAM,WAAW,eAAe;IAC9B;8EAC0E;IAC1E,OAAO,EAAE,MAAM,CAAC;IAChB;;+FAE2F;IAC3F,KAAK,CAAC,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACpF"}

package/dist/auth-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-provider.js","sourceRoot":"","sources":["../src/auth-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAkB,MAAM,eAAe,CAAC;AAsGzD;;iGAEiG;AACjG,MAAM,UAAU,mBAAmB;IACjC,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAe,eAAe,CAAC,CAAC;IAC9D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,yKAAyK,CAC1K,CAAC;IACJ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,uCAAuC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAClI,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC;AACtB,CAAC"}
+{"version":3,"file":"auth-provider.js","sourceRoot":"","sources":["../src/auth-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAkB,MAAM,eAAe,CAAC;AAiKzD;;iGAEiG;AACjG,MAAM,UAAU,mBAAmB;IACjC,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAe,eAAe,CAAC,CAAC;IAC9D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,yKAAyK,CAC1K,CAAC;IACJ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,uCAAuC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAClI,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC;AACtB,CAAC"}

package/dist/backup-config.d.ts

@@ -0,0 +1,55 @@
+import { StoreCompression, type StreamConfig } from "@nats-io/jetstream";
+export type SpaceBackupSelection = "full" | "registry";
+export type SpaceBackupStreamClass = "messages" | "registry" | "authorization";
+export type SpaceBackupExcludedClass = "transient" | "derived" | "lease";
+export interface SpaceBackupStream {
+    name: string;
+    class: SpaceBackupStreamClass;
+}
+export interface SpaceBackupExcludedStream {
+    name: string;
+    class: SpaceBackupExcludedClass;
+}
+export interface SpaceBackupInventory {
+    backedUp: readonly SpaceBackupStream[];
+    excluded: readonly SpaceBackupExcludedStream[];
+    full: readonly string[];
+    registry: readonly string[];
+}
+/** The complete Cotal stream inventory at a stable backup cut. Only the eight `backedUp` streams
+ * enter a full artifact; the four excluded streams are transient, derived, or leases. */
+export declare function spaceBackupInventory(space: string): SpaceBackupInventory;
+/** Reject a missing, foreign, or additional stream before selecting artifact components. */
+export declare function validateSpaceBackupInventory(space: string, actualNames: readonly string[]): SpaceBackupInventory;
+export interface BackupStreamState {
+    messages: number;
+    bytes: number;
+    first_seq: number;
+    last_seq: number;
+    consumer_count: number;
+    first_ts?: string;
+    last_ts?: string;
+    deleted?: number[];
+    num_deleted?: number;
+    num_subjects?: number;
+    subjects?: Record<string, number>;
+    lost?: {
+        msgs?: number[] | null;
+        bytes?: number;
+    };
+}
+/** The NATS 2.10 stream-config surface Cotal permits in an artifact or restore request. */
+export type CanonicalBackupStreamConfig = Pick<StreamConfig, "name" | "subjects" | "retention" | "storage" | "max_consumers" | "max_msgs" | "max_bytes" | "max_age" | "max_msgs_per_subject" | "max_msg_size" | "discard" | "num_replicas" | "duplicate_window" | "allow_direct" | "mirror_direct" | "discard_new_per_subject" | "allow_rollup_hdrs" | "deny_delete" | "deny_purge" | "sealed" | "consumer_limits"> & {
+    no_ack: boolean;
+    compression: typeof StoreCompression.None;
+};
+export declare const BACKUP_MAX_MSGS_PER_SUBJECT = 1000;
+export declare const BACKUP_PLANE3_DEDUP_WINDOW_MS: number;
+/** Current canonical config for one of the eight backed-up streams. Restore callers must use this
+ * config, not the config embedded in untrusted snapshot bytes. */
+export declare function canonicalBackupStreamConfig(space: string, stream: string): CanonicalBackupStreamConfig;
+/** Validate every active and security-sensitive stream setting, including explicit rejection of
+ * mirrors, sources, transforms, republish, placement, sealing, metadata, and future active features. */
+export declare function validateCanonicalBackupStreamConfig(space: string, stream: string, actual: Readonly<Record<string, unknown>>): CanonicalBackupStreamConfig;
+export declare function validateBackupStreamState(state: Readonly<Record<string, unknown>>): BackupStreamState;
+//# sourceMappingURL=backup-config.d.ts.map

package/dist/backup-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-config.d.ts","sourceRoot":"","sources":["../src/backup-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,gBAAgB,EAChB,KAAK,YAAY,EAClB,MAAM,oBAAoB,CAAC;AAkB5B,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,UAAU,CAAC;AACvD,MAAM,MAAM,sBAAsB,GAAG,UAAU,GAAG,UAAU,GAAG,eAAe,CAAC;AAC/E,MAAM,MAAM,wBAAwB,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC;AAEzE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,sBAAsB,CAAC;CAC/B;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,wBAAwB,CAAC;CACjC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,QAAQ,EAAE,SAAS,yBAAyB,EAAE,CAAC;IAC/C,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B;AAED;yFACyF;AACzF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,oBAAoB,CAwBxE;AAED,4FAA4F;AAC5F,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,oBAAoB,CAgBhH;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACnD;AAED,2FAA2F;AAC3F,MAAM,MAAM,2BAA2B,GAAG,IAAI,CAC5C,YAAY,EACV,MAAM,GACN,UAAU,GACV,WAAW,GACX,SAAS,GACT,eAAe,GACf,UAAU,GACV,WAAW,GACX,SAAS,GACT,sBAAsB,GACtB,cAAc,GACd,SAAS,GACT,cAAc,GACd,kBAAkB,GAClB,cAAc,GACd,eAAe,GACf,yBAAyB,GACzB,mBAAmB,GACnB,aAAa,GACb,YAAY,GACZ,QAAQ,GACR,iBAAiB,CACpB,GAAG;IACF,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;CAC3C,CAAC;AAGF,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAChD,eAAO,MAAM,6BAA6B,QAAqB,CAAC;AA+BhE;kEACkE;AAClE,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,2BAA2B,CAuCtG;AAiCD;wGACwG;AACxG,wBAAgB,mCAAmC,CACjD,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACxC,2BAA2B,CA8B7B;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,iBAAiB,CA4DrG"}

package/dist/backup-config.js

@@ -0,0 +1,243 @@
+import { DiscardPolicy, RetentionPolicy, StorageType, StoreCompression, } from "@nats-io/jetstream";
+import { nanos } from "@nats-io/transport-node";
+import { aclBucket, channelBucket, chatStream, deliveryBucket, dlvStream, dmStream, inboxStream, managerBucket, membersBucket, membershipBucket, presenceBucket, spacePrefix, taskStream, } from "./subjects.js";
+/** The complete Cotal stream inventory at a stable backup cut. Only the eight `backedUp` streams
+ * enter a full artifact; the four excluded streams are transient, derived, or leases. */
+export function spaceBackupInventory(space) {
+    const registry = `KV_${channelBucket(space)}`;
+    const backedUp = [
+        { name: registry, class: "registry" },
+        { name: chatStream(space), class: "messages" },
+        { name: dmStream(space), class: "messages" },
+        { name: taskStream(space), class: "messages" },
+        { name: inboxStream(space), class: "messages" },
+        { name: dlvStream(space), class: "messages" },
+        { name: `KV_${aclBucket(space)}`, class: "authorization" },
+        { name: `KV_${membersBucket(space)}`, class: "authorization" },
+    ];
+    const excluded = [
+        { name: `KV_${presenceBucket(space)}`, class: "transient" },
+        { name: `KV_${membershipBucket(space)}`, class: "derived" },
+        { name: `KV_${deliveryBucket(space)}`, class: "lease" },
+        { name: `KV_${managerBucket(space)}`, class: "lease" },
+    ];
+    return {
+        backedUp,
+        excluded,
+        full: backedUp.map((s) => s.name),
+        registry: [registry],
+    };
+}
+/** Reject a missing, foreign, or additional stream before selecting artifact components. */
+export function validateSpaceBackupInventory(space, actualNames) {
+    const inventory = spaceBackupInventory(space);
+    const expected = [...inventory.full, ...inventory.excluded.map((s) => s.name)].sort();
+    const actual = [...actualNames].sort();
+    if (new Set(actual).size !== actual.length)
+        throw new Error("space backup inventory contains duplicate stream names");
+    if (JSON.stringify(actual) !== JSON.stringify(expected)) {
+        const expectedSet = new Set(expected);
+        const actualSet = new Set(actual);
+        const missing = expected.filter((name) => !actualSet.has(name));
+        const unexpected = actual.filter((name) => !expectedSet.has(name));
+        throw new Error(`space backup inventory mismatch: missing [${missing.join(", ")}], unexpected [${unexpected.join(", ")}]`);
+    }
+    return inventory;
+}
+const DEFAULT_DUPLICATE_WINDOW = nanos(2 * 60 * 1000);
+export const BACKUP_MAX_MSGS_PER_SUBJECT = 1000;
+export const BACKUP_PLANE3_DEDUP_WINDOW_MS = 2 * 60 * 60 * 1000;
+const PLANE3_DUPLICATE_WINDOW = nanos(BACKUP_PLANE3_DEDUP_WINDOW_MS);
+function baseConfig(name, subjects) {
+    return {
+        name,
+        subjects,
+        retention: RetentionPolicy.Limits,
+        storage: StorageType.File,
+        max_consumers: -1,
+        max_msgs: -1,
+        max_bytes: -1,
+        max_age: 0,
+        max_msgs_per_subject: -1,
+        max_msg_size: -1,
+        discard: DiscardPolicy.Old,
+        num_replicas: 1,
+        no_ack: false,
+        duplicate_window: DEFAULT_DUPLICATE_WINDOW,
+        compression: StoreCompression.None,
+        allow_direct: false,
+        mirror_direct: false,
+        discard_new_per_subject: false,
+        allow_rollup_hdrs: false,
+        deny_delete: false,
+        deny_purge: false,
+        sealed: false,
+        consumer_limits: {},
+    };
+}
+/** Current canonical config for one of the eight backed-up streams. Restore callers must use this
+ * config, not the config embedded in untrusted snapshot bytes. */
+export function canonicalBackupStreamConfig(space, stream) {
+    const p = spacePrefix(space);
+    if (stream === chatStream(space)) {
+        return {
+            ...baseConfig(stream, [`${p}.chat.>`]),
+            max_msgs_per_subject: BACKUP_MAX_MSGS_PER_SUBJECT,
+            allow_direct: true,
+        };
+    }
+    if (stream === dmStream(space))
+        return baseConfig(stream, [`${p}.inst.>`]);
+    if (stream === taskStream(space)) {
+        return { ...baseConfig(stream, [`${p}.svc.>`]), retention: RetentionPolicy.Workqueue };
+    }
+    if (stream === inboxStream(space)) {
+        return {
+            ...baseConfig(stream, [`${p}.dinbox.>`]),
+            max_msgs_per_subject: BACKUP_MAX_MSGS_PER_SUBJECT,
+            duplicate_window: PLANE3_DUPLICATE_WINDOW,
+        };
+    }
+    if (stream === dlvStream(space)) {
+        return {
+            ...baseConfig(stream, [`${p}.dlv.>`]),
+            max_msgs_per_subject: BACKUP_MAX_MSGS_PER_SUBJECT,
+            duplicate_window: PLANE3_DUPLICATE_WINDOW,
+        };
+    }
+    for (const bucket of [channelBucket(space), aclBucket(space), membersBucket(space)]) {
+        if (stream === `KV_${bucket}`) {
+            return {
+                ...baseConfig(stream, [`$KV.${bucket}.>`]),
+                max_msgs_per_subject: 1,
+                discard: DiscardPolicy.New,
+                allow_direct: true,
+                allow_rollup_hdrs: true,
+            };
+        }
+    }
+    throw new Error(`stream ${JSON.stringify(stream)} is not a backed-up stream for space ${JSON.stringify(space)}`);
+}
+const INERT_CONFIG_DEFAULTS = {
+    description: "",
+    template_owner: "",
+    first_seq: 0,
+    placement: null,
+    mirror: null,
+    sources: [],
+    subject_transform: null,
+    republish: null,
+    metadata: {},
+    allow_msg_ttl: false,
+    subject_delete_marker_ttl: 0,
+    allow_msg_schedules: false,
+    allow_atomic: false,
+    allow_batched: false,
+    allow_msg_counter: false,
+    persist_mode: "",
+};
+function normalize(value) {
+    if (Array.isArray(value))
+        return value.map(normalize);
+    if (value && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value)
+            .sort(([a], [b]) => a.localeCompare(b))
+            .map(([key, item]) => [key, normalize(item)]));
+    }
+    return value;
+}
+/** Validate every active and security-sensitive stream setting, including explicit rejection of
+ * mirrors, sources, transforms, republish, placement, sealing, metadata, and future active features. */
+export function validateCanonicalBackupStreamConfig(space, stream, actual) {
+    const expected = canonicalBackupStreamConfig(space, stream);
+    const known = new Set([...Object.keys(expected), ...Object.keys(INERT_CONFIG_DEFAULTS)]);
+    const unknown = Object.keys(actual).filter((key) => !known.has(key));
+    if (unknown.length)
+        throw new Error(`${stream} config has unsupported fields: ${unknown.sort().join(", ")}`);
+    const comparable = {};
+    for (const [key, expectedValue] of Object.entries(expected))
+        comparable[key] = actual[key] === undefined ? expectedValue : actual[key];
+    for (const [key, expectedValue] of Object.entries(INERT_CONFIG_DEFAULTS)) {
+        const actualValue = actual[key];
+        comparable[key] = actualValue === undefined || actualValue === null ? expectedValue : actualValue;
+    }
+    // Newer servers annotate a request-level floor in their reserved metadata namespace. It is
+    // server-owned protocol bookkeeping, not caller configuration; no other metadata is canonical.
+    if (comparable.metadata &&
+        typeof comparable.metadata === "object" &&
+        !Array.isArray(comparable.metadata) &&
+        Object.entries(comparable.metadata)
+            .every(([key, value]) => key.startsWith("_nats.") && typeof value === "string"))
+        comparable.metadata = {};
+    const target = { ...expected, ...INERT_CONFIG_DEFAULTS };
+    if (JSON.stringify(normalize(comparable)) !== JSON.stringify(normalize(target))) {
+        const drift = Object.keys(target).filter((key) => JSON.stringify(normalize(comparable[key])) !== JSON.stringify(normalize(target[key])));
+        throw new Error(`${stream} config is not canonical: ${drift.map((key) => `${key}=${JSON.stringify(comparable[key])}`).join(", ")}`);
+    }
+    return expected;
+}
+export function validateBackupStreamState(state) {
+    const allowed = new Set([
+        "messages", "bytes", "first_seq", "last_seq", "consumer_count", "first_ts", "last_ts",
+        "deleted", "num_deleted", "num_subjects", "subjects", "lost",
+    ]);
+    const unknown = Object.keys(state).filter((key) => !allowed.has(key));
+    if (unknown.length)
+        throw new Error(`stream state has unsupported fields: ${unknown.sort().join(", ")}`);
+    for (const key of ["messages", "bytes", "first_seq", "last_seq", "consumer_count"]) {
+        const value = state[key];
+        if (!Number.isSafeInteger(value) || value < 0)
+            throw new Error(`stream state ${key} must be a non-negative safe integer`);
+    }
+    const messages = state.messages;
+    const firstSequence = state.first_seq;
+    const lastSequence = state.last_seq;
+    if (messages === 0) {
+        const initial = firstSequence === 0 && lastSequence === 0;
+        const exhausted = lastSequence < Number.MAX_SAFE_INTEGER && firstSequence === lastSequence + 1;
+        if (!initial && !exhausted)
+            throw new Error("empty stream state must be initial or exhausted at last_seq + 1");
+    }
+    else {
+        if (firstSequence < 1 || firstSequence > lastSequence)
+            throw new Error("non-empty stream state has an invalid first/last sequence window");
+        if (messages > lastSequence - firstSequence + 1)
+            throw new Error("stream state messages exceed its first/last sequence window");
+    }
+    for (const seq of state.deleted ?? [])
+        if (!Number.isSafeInteger(seq) || seq < 1)
+            throw new Error("stream state deleted sequences must be positive safe integers");
+    for (const key of ["num_deleted", "num_subjects"]) {
+        const value = state[key];
+        if (value !== undefined && (!Number.isSafeInteger(value) || value < 0))
+            throw new Error(`stream state ${key} must be a non-negative safe integer`);
+    }
+    for (const key of ["first_ts", "last_ts"]) {
+        const value = state[key];
+        if (value !== undefined && (typeof value !== "string" || Number.isNaN(Date.parse(value))))
+            throw new Error(`stream state ${key} must be an ISO timestamp`);
+    }
+    if (state.subjects !== undefined) {
+        if (!state.subjects || typeof state.subjects !== "object" || Array.isArray(state.subjects))
+            throw new Error("stream state subjects must be an object");
+        for (const count of Object.values(state.subjects))
+            if (!Number.isSafeInteger(count) || count < 0)
+                throw new Error("stream state subject counts must be non-negative safe integers");
+    }
+    if (state.lost !== undefined) {
+        if (!state.lost || typeof state.lost !== "object" || Array.isArray(state.lost))
+            throw new Error("stream state lost must be an object");
+        const lost = state.lost;
+        const lostUnknown = Object.keys(lost).filter((key) => key !== "msgs" && key !== "bytes");
+        if (lostUnknown.length)
+            throw new Error(`stream state lost has unsupported fields: ${lostUnknown.join(", ")}`);
+        if (lost.bytes !== undefined && (!Number.isSafeInteger(lost.bytes) || lost.bytes < 0))
+            throw new Error("stream state lost.bytes must be a non-negative safe integer");
+        if (lost.msgs !== undefined && lost.msgs !== null) {
+            if (!Array.isArray(lost.msgs) || lost.msgs.some((seq) => !Number.isSafeInteger(seq) || seq < 1))
+                throw new Error("stream state lost.msgs must contain positive safe integers");
+        }
+    }
+    return state;
+}
+//# sourceMappingURL=backup-config.js.map

package/dist/backup-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-config.js","sourceRoot":"","sources":["../src/backup-config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,eAAe,EACf,WAAW,EACX,gBAAgB,GAEjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAChD,OAAO,EACL,SAAS,EACT,aAAa,EACb,UAAU,EACV,cAAc,EACd,SAAS,EACT,QAAQ,EACR,WAAW,EACX,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,UAAU,GACX,MAAM,eAAe,CAAC;AAuBvB;yFACyF;AACzF,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC9C,MAAM,QAAQ,GAAwB;QACpC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE;QACrC,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE;QAC9C,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE;QAC5C,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE;QAC9C,EAAE,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE;QAC/C,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE;QAC7C,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE;QAC1D,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE;KAC/D,CAAC;IACF,MAAM,QAAQ,GAAgC;QAC5C,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE;QAC3D,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE;QAC3D,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;QACvD,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;KACvD,CAAC;IACF,OAAO;QACL,QAAQ;QACR,QAAQ;QACR,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACjC,QAAQ,EAAE,CAAC,QAAQ,CAAC;KACrB,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,4BAA4B,CAAC,KAAa,EAAE,WAA8B;IACxF,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACtF,MAAM,MAAM,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM;QACxC,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACnE,MAAM,IAAI,KAAK,CACb,6CAA6C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC1G,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AA8CD,MAAM,wBAAwB,GAAG,KAAK,CAAC,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AACtD,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC;AAChD,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAChE,MAAM,uBAAuB,GAAG,KAAK,CAAC,6BAA6B,CAAC,CAAC;AAErE,SAAS,UAAU,CAAC,IAAY,EAAE,QAAkB;IAClD,OAAO;QACL,IAAI;QACJ,QAAQ;QACR,SAAS,EAAE,eAAe,CAAC,MAAM;QACjC,OAAO,EAAE,WAAW,CAAC,IAAI;QACzB,aAAa,EAAE,CAAC,CAAC;QACjB,QAAQ,EAAE,CAAC,CAAC;QACZ,SAAS,EAAE,CAAC,CAAC;QACb,OAAO,EAAE,CAAC;QACV,oBAAoB,EAAE,CAAC,CAAC;QACxB,YAAY,EAAE,CAAC,CAAC;QAChB,OAAO,EAAE,aAAa,CAAC,GAAG;QAC1B,YAAY,EAAE,CAAC;QACf,MAAM,EAAE,KAAK;QACb,gBAAgB,EAAE,wBAAwB;QAC1C,WAAW,EAAE,gBAAgB,CAAC,IAAI;QAClC,YAAY,EAAE,KAAK;QACnB,aAAa,EAAE,KAAK;QACpB,uBAAuB,EAAE,KAAK;QAC9B,iBAAiB,EAAE,KAAK;QACxB,WAAW,EAAE,KAAK;QAClB,UAAU,EAAE,KAAK;QACjB,MAAM,EAAE,KAAK;QACb,eAAe,EAAE,EAAE;KACpB,CAAC;AACJ,CAAC;AAED;kEACkE;AAClE,MAAM,UAAU,2BAA2B,CAAC,KAAa,EAAE,MAAc;IACvE,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,MAAM,KAAK,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO;YACL,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACtC,oBAAoB,EAAE,2BAA2B;YACjD,YAAY,EAAE,IAAI;SACnB,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3E,IAAI,MAAM,KAAK,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,CAAC,SAAS,EAAE,CAAC;IACzF,CAAC;IACD,IAAI,MAAM,KAAK,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO;YACL,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACxC,oBAAoB,EAAE,2BAA2B;YACjD,gBAAgB,EAAE,uBAAuB;SAC1C,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO;YACL,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACrC,oBAAoB,EAAE,2BAA2B;YACjD,gBAAgB,EAAE,uBAAuB;SAC1C,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACpF,IAAI,MAAM,KAAK,MAAM,MAAM,EAAE,EAAE,CAAC;YAC9B,OAAO;gBACL,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,OAAO,MAAM,IAAI,CAAC,CAAC;gBAC1C,oBAAoB,EAAE,CAAC;gBACvB,OAAO,EAAE,aAAa,CAAC,GAAG;gBAC1B,YAAY,EAAE,IAAI;gBAClB,iBAAiB,EAAE,IAAI;aACxB,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,wCAAwC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACnH,CAAC;AAED,MAAM,qBAAqB,GAA4B;IACrD,WAAW,EAAE,EAAE;IACf,cAAc,EAAE,EAAE;IAClB,SAAS,EAAE,CAAC;IACZ,SAAS,EAAE,IAAI;IACf,MAAM,EAAE,IAAI;IACZ,OAAO,EAAE,EAAE;IACX,iBAAiB,EAAE,IAAI;IACvB,SAAS,EAAE,IAAI;IACf,QAAQ,EAAE,EAAE;IACZ,aAAa,EAAE,KAAK;IACpB,yBAAyB,EAAE,CAAC;IAC5B,mBAAmB,EAAE,KAAK;IAC1B,YAAY,EAAE,KAAK;IACnB,aAAa,EAAE,KAAK;IACpB,iBAAiB,EAAE,KAAK;IACxB,YAAY,EAAE,EAAE;CACjB,CAAC;AAEF,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;aAC7C,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;aACtC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAChD,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;wGACwG;AACxG,MAAM,UAAU,mCAAmC,CACjD,KAAa,EACb,MAAc,EACd,MAAyC;IAEzC,MAAM,QAAQ,GAAG,2BAA2B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IACzF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,mCAAmC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAE7G,MAAM,UAAU,GAA4B,EAAE,CAAC;IAC/C,KAAK,MAAM,CAAC,GAAG,EAAE,aAAa,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzD,UAAU,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5E,KAAK,MAAM,CAAC,GAAG,EAAE,aAAa,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACzE,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAChC,UAAU,CAAC,GAAG,CAAC,GAAG,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC;IACpG,CAAC;IACD,2FAA2F;IAC3F,+FAA+F;IAC/F,IACE,UAAU,CAAC,QAAQ;QACnB,OAAO,UAAU,CAAC,QAAQ,KAAK,QAAQ;QACvC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;QACnC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,QAAmC,CAAC;aAC3D,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC;QACjF,UAAU,CAAC,QAAQ,GAAG,EAAE,CAAC;IAC3B,MAAM,MAAM,GAA4B,EAAE,GAAG,QAAQ,EAAE,GAAG,qBAAqB,EAAE,CAAC;IAClF,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CACtC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAC/F,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,6BAA6B,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtI,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAwC;IAChF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC;QACtB,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,SAAS;QACrF,SAAS,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM;KAC7D,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzG,KAAK,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,gBAAgB,CAAU,EAAE,CAAC;QAC5F,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAK,KAAgB,GAAG,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,sCAAsC,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAkB,CAAC;IAC1C,MAAM,aAAa,GAAG,KAAK,CAAC,SAAmB,CAAC;IAChD,MAAM,YAAY,GAAG,KAAK,CAAC,QAAkB,CAAC;IAC9C,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,aAAa,KAAK,CAAC,IAAI,YAAY,KAAK,CAAC,CAAC;QAC1D,MAAM,SAAS,GAAG,YAAY,GAAG,MAAM,CAAC,gBAAgB,IAAI,aAAa,KAAK,YAAY,GAAG,CAAC,CAAC;QAC/F,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS;YACxB,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACvF,CAAC;SAAM,CAAC;QACN,IAAI,aAAa,GAAG,CAAC,IAAI,aAAa,GAAG,YAAY;YACnD,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACtF,IAAI,QAAQ,GAAG,YAAY,GAAG,aAAa,GAAG,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACnF,CAAC;IACD,KAAK,MAAM,GAAG,IAAK,KAAK,CAAC,OAAiC,IAAI,EAAE;QAC9D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAK,GAAc,GAAG,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACrF,KAAK,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,cAAc,CAAU,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAK,KAAgB,GAAG,CAAC,CAAC;YAChF,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,sCAAsC,CAAC,CAAC;IAC/E,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,CAAU,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YACvF,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,2BAA2B,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;YACxF,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAmC,CAAC;YAC1E,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAK,KAAgB,GAAG,CAAC;gBACvD,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;YAC5E,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,KAAK,CAAC,IAA+B,CAAC;QACnD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,OAAO,CAAC,CAAC;QACzF,IAAI,WAAW,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/G,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAK,IAAI,CAAC,KAAgB,GAAG,CAAC,CAAC;YAC/F,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAClD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;gBAC7F,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IACD,OAAO,KAAqC,CAAC;AAC/C,CAAC"}

package/dist/backup.d.ts

@@ -0,0 +1,86 @@
+import { type ConsumerConfig, type ConsumerInfo } from "@nats-io/jetstream";
+import { type NatsConnection } from "@nats-io/transport-node";
+import { type BackupStreamState, type SpaceBackupSelection } from "./backup-config.js";
+export declare class JetStreamBackupError extends Error {
+    readonly code?: number | undefined;
+    readonly errCode?: number | undefined;
+    constructor(message: string, code?: number | undefined, errCode?: number | undefined);
+}
+export interface StreamSnapshotMetadata {
+    config: Record<string, unknown>;
+    state: BackupStreamState;
+}
+export interface DownloadStreamSnapshotOptions {
+    deliverSubject: string;
+    onChunk(chunk: Uint8Array): void | Promise<void>;
+    timeoutMs?: number;
+    /** Per-chunk sink deadline. Must stay below the server's two-second snapshot flow timeout. */
+    sinkTimeoutMs?: number;
+    checkMessages?: boolean;
+}
+/** Download a no-consumer native snapshot through one ordered, deadline-bounded sink. Each ackable
+ * binary chunk is ACKed only after its sink call succeeds. Completion requires a clean empty EOF
+ * after all accepted chunks. */
+export declare function downloadStreamSnapshot(nc: NatsConnection, stream: string, opts: DownloadStreamSnapshotOptions): Promise<StreamSnapshotMetadata>;
+export interface StreamRestoreSession {
+    stream: string;
+    deliverSubject: string;
+}
+/** Initiate restore with caller-supplied, current canonical config and separately validated state.
+ * Snapshot-embedded config is never trusted or sent to the target broker. */
+export declare function initiateStreamRestore(nc: NatsConnection, space: string, stream: string, config: Readonly<Record<string, unknown>>, state: Readonly<Record<string, unknown>>, timeoutMs?: number): Promise<StreamRestoreSession>;
+/** Upload one non-empty binary restore chunk and await the server's storage ACK. */
+export declare function uploadStreamRestoreChunk(nc: NatsConnection, session: StreamRestoreSession, chunk: Uint8Array, timeoutMs?: number): Promise<void>;
+export interface StreamRestoreResult {
+    config: Record<string, unknown>;
+    state: BackupStreamState;
+}
+/** Send the empty EOF request and require the final stream-create response. */
+export declare function finalizeStreamRestore(nc: NatsConnection, session: StreamRestoreSession, timeoutMs?: number): Promise<StreamRestoreResult>;
+export interface PersistentConsumerCheckpoint {
+    stream: string;
+    name: string;
+    ackFloorStreamSequence: number;
+    creationLowerBound: number;
+    streamState: Pick<BackupStreamState, "messages" | "first_seq" | "last_seq">;
+}
+/** Validate one recognized Cotal pull durable. Limits-retention consumers accept the checkpoint
+ * migration shape; TASK remains canonical WorkQueue DeliverAll. */
+export declare function validatePersistentConsumer(space: string, stream: string, info: ConsumerInfo): void;
+/** Validate the complete consumer inventory for all eight streams and extract conservative checkpoints. */
+export declare function validatePersistentConsumerInventory(space: string, consumersByStream: Readonly<Record<string, readonly ConsumerInfo[]>>, statesByStream: Readonly<Record<string, BackupStreamState>>): PersistentConsumerCheckpoint[];
+/** Recreate a validated pull durable. Limits-retention consumers start after the contiguous ACK
+ * floor and original lower bound; TASK uses WorkQueue DeliverAll because ACKed entries left the stream. */
+export declare function consumerConfigFromCheckpoint(space: string, checkpoint: PersistentConsumerCheckpoint): Partial<ConsumerConfig>;
+/** Recreate one validated checkpoint through the NATS 2.10 extended create API, whose subject pins
+ * stream, durable name, and its canonical single filter. */
+export declare function recreateConsumerCheckpoint(nc: NatsConnection, space: string, checkpoint: PersistentConsumerCheckpoint, timeoutMs?: number): Promise<ConsumerInfo>;
+export type BackupPermissionScope = {
+    operation: "snapshot";
+    stream: string;
+    deliverSubject: string;
+} | {
+    operation: "inspect";
+    selection: SpaceBackupSelection;
+};
+export type RestorePermissionScope = {
+    operation: "initiate";
+    stream: string;
+} | {
+    operation: "upload";
+    stream: string;
+    deliverSubject: string;
+} | {
+    operation: "validate";
+    stream: string;
+} | {
+    operation: "checkpoint";
+    checkpoint: PersistentConsumerCheckpoint;
+};
+/** Exact snapshot permission set. It has no stream read/admin verbs beyond one snapshot API; chunk
+ * ACK authority is created dynamically for the exact reply received, never granted as a wildcard. */
+export declare function backupProfilePermissions(space: string, connId: string, scope: BackupPermissionScope): Record<string, unknown>;
+/** Restore initiation, exact-ID upload, stream validation, and one-checkpoint recreation are disjoint
+ * credentials. No phase inherits a body-read verb or another phase's mutation authority. */
+export declare function restoreProfilePermissions(space: string, connId: string, scope: RestorePermissionScope): Record<string, unknown>;
+//# sourceMappingURL=backup.d.ts.map

package/dist/backup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup.d.ts","sourceRoot":"","sources":["../src/backup.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,cAAc,EACnB,KAAK,YAAY,EAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAmB,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,EAKL,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EAC1B,MAAM,oBAAoB,CAAC;AA2B5B,qBAAa,oBAAqB,SAAQ,KAAK;IAChB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM;IAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM;gBAAlE,OAAO,EAAE,MAAM,EAAW,IAAI,CAAC,EAAE,MAAM,YAAA,EAAW,OAAO,CAAC,EAAE,MAAM,YAAA;CAI/E;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,KAAK,EAAE,iBAAiB,CAAC;CAC1B;AAED,MAAM,WAAW,6BAA6B;IAC5C,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8FAA8F;IAC9F,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAwDD;;gCAEgC;AAChC,wBAAsB,sBAAsB,CAC1C,EAAE,EAAE,cAAc,EAClB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,6BAA6B,GAClC,OAAO,CAAC,sBAAsB,CAAC,CA+GjC;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;6EAC6E;AAC7E,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,cAAc,EAClB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACzC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACxC,SAAS,SAA8B,GACtC,OAAO,CAAC,oBAAoB,CAAC,CAe/B;AAED,oFAAoF;AACpF,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,cAAc,EAClB,OAAO,EAAE,oBAAoB,EAC7B,KAAK,EAAE,UAAU,EACjB,SAAS,SAA8B,GACtC,OAAO,CAAC,IAAI,CAAC,CAQf;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,KAAK,EAAE,iBAAiB,CAAC;CAC1B;AAED,+EAA+E;AAC/E,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,cAAc,EAClB,OAAO,EAAE,oBAAoB,EAC7B,SAAS,SAA8B,GACtC,OAAO,CAAC,mBAAmB,CAAC,CAY9B;AAED,MAAM,WAAW,4BAA4B;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,sBAAsB,EAAE,MAAM,CAAC;IAC/B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,WAAW,EAAE,IAAI,CAAC,iBAAiB,EAAE,UAAU,GAAG,WAAW,GAAG,UAAU,CAAC,CAAC;CAC7E;AAiCD;mEACmE;AACnE,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CA+ClG;AAED,2GAA2G;AAC3G,wBAAgB,mCAAmC,CACjD,KAAK,EAAE,MAAM,EACb,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAAC,CAAC,EACpE,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,GAC1D,4BAA4B,EAAE,CAyChC;AAED;2GAC2G;AAC3G,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,4BAA4B,GACvC,OAAO,CAAC,cAAc,CAAC,CA2CzB;AAcD;4DAC4D;AAC5D,wBAAsB,0BAA0B,CAC9C,EAAE,EAAE,cAAc,EAClB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,4BAA4B,EACxC,SAAS,SAA8B,GACtC,OAAO,CAAC,YAAY,CAAC,CAqBvB;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,SAAS,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,GACjE;IAAE,SAAS,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAE9D,MAAM,MAAM,sBAAsB,GAC9B;IAAE,SAAS,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,SAAS,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,GAC/D;IAAE,SAAS,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,SAAS,EAAE,YAAY,CAAC;IAAC,UAAU,EAAE,4BAA4B,CAAA;CAAE,CAAC;AAE1E;qGACqG;AACrG,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,qBAAqB,GAC3B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAiCzB;AAED;4FAC4F;AAC5F,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,sBAAsB,GAC5B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA4BzB"}