@cotal-ai/core 0.15.0 → 0.17.0

package/dist/acls.d.ts

@@ -59,6 +59,27 @@ export declare function readAclForAlias(kv: KV, principal: string): Promise<{
  * effect: writing the same `allowSubscribe` is harmless. Use `allowSubscribe: []` to revoke all reads
  * (the reader then DROPS the owner's entries) — distinct from {@link deleteAcl}, which removes the row.
  */
+/**
+ * Raise the mint-time history ceiling (`issuedAllowSubscribe`) to match `allowSubscribe`.
+ *
+ * CALL PATH: only {@link provisionAgent} (and tests of that path). Ordinary registry writers use
+ * {@link commitAcl}, which cannot raise the ceiling — a boolean flag on commitAcl would let any
+ * DurableProvisioner holder re-open the ACL-authority hole. Separate function = separate call path.
+ *
+ * PROCESS DISCIPLINE, NOT CRYPTO BINDING: this write does not verify that a broader JWT was minted.
+ * A caller who can reach `reissueAcl` can raise the ceiling while leaving the live credential
+ * narrow, and mediated history will then serve channels `channelHistory` still broker-denies.
+ * That is accepted residual: whoever holds the provisioner can already mint arbitrary JWTs. The
+ * obligation is that `reissueAcl` may ONLY ride the same act that bakes `allowSubscribe` into the
+ * user JWT (provision/remint). Do not call it from revoke, repair, or any path that does not also
+ * remint. Docs must not claim the ceiling is bound to credential bytes.
+ */
+export declare function reissueAcl(kv: KV, owner: string, lifecycleUid: string, allowSubscribe: string[]): Promise<AclRecord>;
+/**
+ * Write the live read ACL. Never raises the mint-time ceiling: create sets ceiling = allow;
+ * updates that exceed the ceiling throw. For a legitimate broaden that also remints the JWT, use
+ * {@link reissueAcl} from the provisioning path only.
+ */
 export declare function commitAcl(kv: KV, owner: string, lifecycleUid: string, allowSubscribe: string[]): Promise<AclRecord>;
 /** Permanently remove one LIFECYCLE's ACL row (GC / footprint deletion — revocation deletes the
  *  footprint AFTER invalidating creds). Lifecycle-exact by construction: a replayed delete for a

package/dist/acls.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"acls.d.ts","sourceRoot":"","sources":["../src/acls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAO,KAAK,EAAE,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C;mGACmG;AACnG,wBAAsB,eAAe,CACnC,EAAE,EAAE,OAAO,yBAAyB,EAAE,cAAc,EACpD,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GAC9B,OAAO,CAAC,EAAE,CAAC,CAGb;AAED;;;;;;GAMG;AACH,wBAAsB,OAAO,CAC3B,EAAE,EAAE,EAAE,EACN,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CAU9D;AAED;;wFAEwF;AACxF,qBAAa,iBAAkB,SAAQ,KAAK;IAExC,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,EAAE;gBADvB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE;CAOnC;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CACnC,EAAE,EAAE,EAAE,EACN,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CAuBpF;AAsBD;;;;;;GAMG;AACH,wBAAsB,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CA+CzH;AAED;;;;uCAIuC;AACvC,wBAAsB,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1F"}
+{"version":3,"file":"acls.d.ts","sourceRoot":"","sources":["../src/acls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAO,KAAK,EAAE,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAG5C;mGACmG;AACnG,wBAAsB,eAAe,CACnC,EAAE,EAAE,OAAO,yBAAyB,EAAE,cAAc,EACpD,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GAC9B,OAAO,CAAC,EAAE,CAAC,CAGb;AAED;;;;;;GAMG;AACH,wBAAsB,OAAO,CAC3B,EAAE,EAAE,EAAE,EACN,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CAU9D;AAED;;wFAEwF;AACxF,qBAAa,iBAAkB,SAAQ,KAAK;IAExC,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,EAAE;gBADvB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,EAAE;CAOnC;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CACnC,EAAE,EAAE,EAAE,EACN,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CA6BpF;AA8BD;;;;;;GAMG;AACH;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,UAAU,CAC9B,EAAE,EAAE,EAAE,EACN,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EACpB,cAAc,EAAE,MAAM,EAAE,GACvB,OAAO,CAAC,SAAS,CAAC,CAEpB;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAC7B,EAAE,EAAE,EAAE,EACN,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EACpB,cAAc,EAAE,MAAM,EAAE,GACvB,OAAO,CAAC,SAAS,CAAC,CAEpB;AA2ED;;;;uCAIuC;AACvC,wBAAsB,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1F"}

package/dist/acls.js

@@ -14,7 +14,8 @@
  * record (a genuinely-unknown owner — the reader DEFERS, never drops).
  */
 import { Kvm } from "@nats-io/kv";
-import { aclBucket, aclKey, aclAliasFilter, parseLifecycleSubjectKey } from "./subjects.js";
+import { aclBucket, aclKey, aclAliasFilter, parseLifecycleSubjectKey, patternInAllow } from "./subjects.js";
+import { liveKvEntries } from "./kv-scan.js";
 /** Open the ACL registry bucket. Auth mode OPENs the bucket pre-created at `cotal up`; a privileged
  *  caller may pass `{ create: true }` to lazily CREATE it. Mirrors {@link openMembersRegistry}. */
 export async function openAclRegistry(nc, space, opts = {}) {
@@ -81,6 +82,12 @@ export async function readAclForAlias(kv, principal) {
     // makes it absent (defer). Two live rows in EITHER pass refuse. Bounded at two passes — an
     // alias replaced BETWEEN the passes (disjoint singles) also refuses, and the caller's retry
     // resolves against the settled state; anything stronger is the P2 occupancy reservation.
+    // DO NOT COLLAPSE THESE TWO CALLS. `enumerateLiveAclRows` is single-pass, which makes it look like
+    // calling it twice is redundant work to optimize away. It is not: the second enumerate is the
+    // TOCTOU barrier. Each pass is bounded by the stream sequence at ITS OWN consumer-create, so a
+    // successor row committed after the first pass is invisible to it and only the second can see it.
+    // One enumerate silently disables AmbiguousAclAlias detection and lets a respawn inherit a
+    // predecessor's ACL — a lifecycle-safety regression, not a speedup.
     const second = await enumerateLiveAclRows(kv, principal);
     if (second.length > 1)
         throw new AmbiguousAclAlias(principal, second.map((l) => l.lifecycleUid).sort());
@@ -90,21 +97,34 @@ export async function readAclForAlias(kv, principal) {
         throw new AmbiguousAclAlias(principal, [first[0].lifecycleUid, second[0].lifecycleUid].sort());
     return { record: second[0].record, revision: second[0].revision, lifecycleUid: second[0].lifecycleUid };
 }
-/** One live-row enumeration pass for {@link readAclForAlias}: LIVE rows, not keys — each candidate
- *  key is resolved through {@link readAcl} (which filters DEL/PURGE markers and garbled values)
- *  BEFORE it counts toward ambiguity. The pinned @nats-io/kv keys() already skips DEL/PURGE
- *  markers, so the re-read is belt-and-suspenders — but the refusal invariant is ">=2 LIVE rows",
- *  and counting raw iterator keys would let a client-version drift (a keys() that surfaces
- *  markers) fail-closed the NORMAL deprovision-then-respawn path. */
+/** One live-row enumeration pass for {@link readAclForAlias}: LIVE rows, not keys — DEL/PURGE
+ *  markers and garbled values are excluded BEFORE anything counts toward ambiguity, because the
+ *  refusal invariant is ">=2 LIVE rows" and counting raw keys would fail-closed the NORMAL
+ *  deprovision-then-respawn path.
+ *
+ *  ONE filtered pass. This used to be `keys(filter)` plus a per-key `readAcl()` get, and
+ *  {@link readAclForAlias} calls it TWICE, so it cost 2N round trips on the durable-join re-auth
+ *  path. The marker/garble exclusion that the per-key read provided is now split: DEL/PURGE is the
+ *  collapse's job (which also closes the resurrection case a per-key read could not see), and an
+ *  undecodable value is dropped here. */
 async function enumerateLiveAclRows(kv, principal) {
     const live = [];
-    for await (const key of await kv.keys(aclAliasFilter(principal))) {
-        const parsed = parseLifecycleSubjectKey(key);
+    for (const e of await liveKvEntries(kv, aclAliasFilter(principal))) {
+        const parsed = parseLifecycleSubjectKey(e.key);
         if (!parsed || `${parsed.owner}.${parsed.actor}` !== principal)
             continue;
-        const row = await readAcl(kv, principal, parsed.lifecycleUid);
-        if (row !== undefined)
-            live.push({ lifecycleUid: parsed.lifecycleUid, ...row });
+        let record;
+        try {
+            record = e.json();
+        }
+        catch {
+            continue;
+        } // a garbled value is never a live row
+        // Same half/garbled rejection {@link readAcl} applies: a record without its `allowSubscribe`
+        // array is UNKNOWN (the reader DEFERS), not a live row, and must not count toward ambiguity.
+        if (!Array.isArray(record.allowSubscribe))
+            continue;
+        live.push({ lifecycleUid: parsed.lifecycleUid, record, revision: e.revision });
     }
     return live;
 }
@@ -115,13 +135,56 @@ async function enumerateLiveAclRows(kv, principal) {
  * effect: writing the same `allowSubscribe` is harmless. Use `allowSubscribe: []` to revoke all reads
  * (the reader then DROPS the owner's entries) — distinct from {@link deleteAcl}, which removes the row.
  */
+/**
+ * Raise the mint-time history ceiling (`issuedAllowSubscribe`) to match `allowSubscribe`.
+ *
+ * CALL PATH: only {@link provisionAgent} (and tests of that path). Ordinary registry writers use
+ * {@link commitAcl}, which cannot raise the ceiling — a boolean flag on commitAcl would let any
+ * DurableProvisioner holder re-open the ACL-authority hole. Separate function = separate call path.
+ *
+ * PROCESS DISCIPLINE, NOT CRYPTO BINDING: this write does not verify that a broader JWT was minted.
+ * A caller who can reach `reissueAcl` can raise the ceiling while leaving the live credential
+ * narrow, and mediated history will then serve channels `channelHistory` still broker-denies.
+ * That is accepted residual: whoever holds the provisioner can already mint arbitrary JWTs. The
+ * obligation is that `reissueAcl` may ONLY ride the same act that bakes `allowSubscribe` into the
+ * user JWT (provision/remint). Do not call it from revoke, repair, or any path that does not also
+ * remint. Docs must not claim the ceiling is bound to credential bytes.
+ */
+export async function reissueAcl(kv, owner, lifecycleUid, allowSubscribe) {
+    return writeAcl(kv, owner, lifecycleUid, allowSubscribe, { reissue: true });
+}
+/**
+ * Write the live read ACL. Never raises the mint-time ceiling: create sets ceiling = allow;
+ * updates that exceed the ceiling throw. For a legitimate broaden that also remints the JWT, use
+ * {@link reissueAcl} from the provisioning path only.
+ */
 export async function commitAcl(kv, owner, lifecycleUid, allowSubscribe) {
+    return writeAcl(kv, owner, lifecycleUid, allowSubscribe, { reissue: false });
+}
+async function writeAcl(kv, owner, lifecycleUid, allowSubscribe, opts) {
     const key = aclKey(owner, lifecycleUid);
     let lastErr;
     for (let attempt = 0; attempt < 5; attempt++) {
         const cur = await readAcl(kv, owner, lifecycleUid);
+        // Ceiling is writable ONLY by create and by reissueAcl (provision/remint). Plain commitAcl
+        // MUST NOT raise it. Legacy rows missing the field treat their then-current allowSubscribe
+        // as the ceiling.
+        let issued;
+        if (opts.reissue || !cur) {
+            issued = [...allowSubscribe];
+        }
+        else {
+            issued = [...(cur.record.issuedAllowSubscribe ?? cur.record.allowSubscribe)];
+            const excess = allowSubscribe.filter((a) => !patternInAllow(issued, a));
+            if (excess.length > 0) {
+                throw new Error(`commitAcl: cannot raise ACL above mint-time ceiling without reissue ` +
+                    `(entries [${excess.join(", ")}] not within ceiling [${issued.join(", ")}]); ` +
+                    `use reissueAcl from the provisioning path that also remints the JWT`);
+            }
+        }
         const next = {
             allowSubscribe: [...allowSubscribe],
+            issuedAllowSubscribe: issued,
             revision: (cur?.record.revision ?? 0) + 1,
             updatedAt: Date.now(),
         };

package/dist/acls.js.map

@@ -1 +1 @@
-{"version":3,"file":"acls.js","sourceRoot":"","sources":["../src/acls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,GAAG,EAAW,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAG5F;mGACmG;AACnG,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAoD,EACpD,KAAa,EACb,OAA6B,EAAE;IAE/B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;IACxB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,EAAM,EACN,KAAa,EACb,YAAoB;IAEpB,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC;IACpD,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,KAAK,KAAK,IAAI,CAAC,CAAC,SAAS,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IAC7E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,EAAa,CAAC;QACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC;YAAE,OAAO,SAAS,CAAC,CAAC,0CAA0C;QACvG,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;wFAEwF;AACxF,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAE/B;IACA;IAFX,YACW,SAAiB,EACjB,aAAuB;QAEhC,KAAK,CACH,mBAAmB,SAAS,iBAAiB,aAAa,CAAC,MAAM,yBAAyB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;YACrH,wGAAwG,CAC3G,CAAC;QANO,cAAS,GAAT,SAAS,CAAQ;QACjB,kBAAa,GAAb,aAAa,CAAU;IAMlC,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAM,EACN,SAAiB;IAEjB,wFAAwF;IACxF,2FAA2F;IAC3F,4FAA4F;IAC5F,6FAA6F;IAC7F,4FAA4F;IAC5F,sFAAsF;IACtF,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IACxD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACtG,yFAAyF;IACzF,6FAA6F;IAC7F,6FAA6F;IAC7F,8FAA8F;IAC9F,0FAA0F;IAC1F,2FAA2F;IAC3F,4FAA4F;IAC5F,yFAAyF;IACzF,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACxG,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY;QACxE,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACjG,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;AAC1G,CAAC;AAED;;;;;qEAKqE;AACrE,KAAK,UAAU,oBAAoB,CACjC,EAAM,EACN,SAAiB;IAEjB,MAAM,IAAI,GAAoE,EAAE,CAAC;IACjF,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACjE,MAAM,MAAM,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,EAAE,KAAK,SAAS;YAAE,SAAS;QACzE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAC9D,IAAI,GAAG,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAAM,EAAE,KAAa,EAAE,YAAoB,EAAE,cAAwB;IACnG,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACxC,IAAI,OAAgB,CAAC;IACrB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;QAC7C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QACnD,MAAM,IAAI,GAAc;YACtB,cAAc,EAAE,CAAC,GAAG,cAAc,CAAC;YACnC,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC;YACzC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC3B,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,GAAG,CAAC,CAAC;gBACZ,yFAAyF;gBACzF,qFAAqF;gBACrF,uFAAuF;gBACvF,oFAAoF;gBACpF,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAC9B,IAAI,GAAG,EAAE,CAAC;wBACR,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;wBACzC,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;gBAAC,OAAO,EAAE,EAAE,CAAC;oBACZ,OAAO,GAAG,EAAE,CAAC;gBACf,CAAC;gBACD,SAAS,CAAC,gDAAgD;YAC5D,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;YACzC,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,GAAG,CAAC,CAAC,CAAC,8CAA8C;YAC3D,SAAS;QACX,CAAC;IACH,CAAC;IACD,+FAA+F;IAC/F,6EAA6E;IAC7E,MAAM,IAAI,KAAK,CACb,iCAAiC,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,kBAAkB,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAC1I,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAC1D,CAAC;AACJ,CAAC;AAED;;;;uCAIuC;AACvC,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAAM,EAAE,KAAa,EAAE,YAAoB;IACzE,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"acls.js","sourceRoot":"","sources":["../src/acls.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,GAAG,EAAW,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,wBAAwB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE5G,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C;mGACmG;AACnG,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAoD,EACpD,KAAa,EACb,OAA6B,EAAE;IAE/B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;IACxB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,EAAM,EACN,KAAa,EACb,YAAoB;IAEpB,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC;IACpD,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,KAAK,KAAK,IAAI,CAAC,CAAC,SAAS,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IAC7E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,EAAa,CAAC;QACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC;YAAE,OAAO,SAAS,CAAC,CAAC,0CAA0C;QACvG,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;wFAEwF;AACxF,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAE/B;IACA;IAFX,YACW,SAAiB,EACjB,aAAuB;QAEhC,KAAK,CACH,mBAAmB,SAAS,iBAAiB,aAAa,CAAC,MAAM,yBAAyB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;YACrH,wGAAwG,CAC3G,CAAC;QANO,cAAS,GAAT,SAAS,CAAQ;QACjB,kBAAa,GAAb,aAAa,CAAU;IAMlC,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAM,EACN,SAAiB;IAEjB,wFAAwF;IACxF,2FAA2F;IAC3F,4FAA4F;IAC5F,6FAA6F;IAC7F,4FAA4F;IAC5F,sFAAsF;IACtF,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IACxD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACtG,yFAAyF;IACzF,6FAA6F;IAC7F,6FAA6F;IAC7F,8FAA8F;IAC9F,0FAA0F;IAC1F,2FAA2F;IAC3F,4FAA4F;IAC5F,yFAAyF;IACzF,mGAAmG;IACnG,8FAA8F;IAC9F,+FAA+F;IAC/F,kGAAkG;IAClG,2FAA2F;IAC3F,oEAAoE;IACpE,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACxG,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY;QACxE,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACjG,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;AAC1G,CAAC;AAED;;;;;;;;;yCASyC;AACzC,KAAK,UAAU,oBAAoB,CACjC,EAAM,EACN,SAAiB;IAEjB,MAAM,IAAI,GAAoE,EAAE,CAAC;IACjF,KAAK,MAAM,CAAC,IAAI,MAAM,aAAa,CAAC,EAAE,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,MAAM,GAAG,wBAAwB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,EAAE,KAAK,SAAS;YAAE,SAAS;QACzE,IAAI,MAAiB,CAAC;QACtB,IAAI,CAAC;YAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAa,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,SAAS;QAAC,CAAC,CAAC,sCAAsC;QAChG,6FAA6F;QAC7F,6FAA6F;QAC7F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC;YAAE,SAAS;QACpD,IAAI,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAM,EACN,KAAa,EACb,YAAoB,EACpB,cAAwB;IAExB,OAAO,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,EAAM,EACN,KAAa,EACb,YAAoB,EACpB,cAAwB;IAExB,OAAO,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,EAAM,EACN,KAAa,EACb,YAAoB,EACpB,cAAwB,EACxB,IAA0B;IAE1B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACxC,IAAI,OAAgB,CAAC;IACrB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;QAC7C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QACnD,2FAA2F;QAC3F,2FAA2F;QAC3F,kBAAkB;QAClB,IAAI,MAAgB,CAAC;QACrB,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;YACzB,MAAM,GAAG,CAAC,GAAG,cAAc,CAAC,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,oBAAoB,IAAI,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;YAC7E,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;YACxE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CACb,sEAAsE;oBACpE,aAAa,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;oBAC9E,qEAAqE,CACxE,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAc;YACtB,cAAc,EAAE,CAAC,GAAG,cAAc,CAAC;YACnC,oBAAoB,EAAE,MAAM;YAC5B,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC;YACzC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC3B,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,GAAG,CAAC,CAAC;gBACZ,yFAAyF;gBACzF,qFAAqF;gBACrF,uFAAuF;gBACvF,oFAAoF;gBACpF,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAC9B,IAAI,GAAG,EAAE,CAAC;wBACR,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;wBACzC,OAAO,IAAI,CAAC;oBACd,CAAC;gBACH,CAAC;gBAAC,OAAO,EAAE,EAAE,CAAC;oBACZ,OAAO,GAAG,EAAE,CAAC;gBACf,CAAC;gBACD,SAAS,CAAC,gDAAgD;YAC5D,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;YACzC,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,GAAG,CAAC,CAAC,CAAC,8CAA8C;YAC3D,SAAS;QACX,CAAC;IACH,CAAC;IACD,+FAA+F;IAC/F,6EAA6E;IAC7E,MAAM,IAAI,KAAK,CACb,iCAAiC,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,kBAAkB,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAC1I,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAC1D,CAAC;AACJ,CAAC;AAED;;;;uCAIuC;AACvC,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAAM,EAAE,KAAa,EAAE,YAAoB;IACzE,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC;AAC9C,CAAC"}

package/dist/artifact.d.ts

@@ -0,0 +1,45 @@
+/** The core part kind. Bare (not reverse-DNS) because this is Cotal's own reserved primitive, not
+ *  a wrapped external vocabulary — SPEC §5's reserved slot, now defined. */
+export declare const ARTIFACT_PART_KIND: "artifact";
+/**
+ * Convert an object-store digest header to Cotal's `sha256:<hex>` identity form.
+ *
+ * CONVERT BY DECODING. NEVER BY RE-ENCODING. The obvious implementation — hash the bytes, encode
+ * the hash, compare the strings — is wrong, and wrong in a way that passes its first test:
+ * measured over 2000 digests, re-encoding to standard base64 mismatches **1490 of 2000** (every
+ * digest whose bytes land on `+` or `/`), and re-encoding to base64url mismatches **2000 of 2000**
+ * (Node strips the padding the store emits). Decoding to hex matched 2000 of 2000. The failure is
+ * in the digest CONTENT, not on a branch a smoke would naturally reach, so a re-encoding
+ * comparison looks correct until roughly three quarters of real artifacts fail to verify.
+ *
+ * The base64 form never escapes this function: everything above it speaks `sha256:<hex>`.
+ */
+export declare function fromObjectStoreDigest(osDigest: string): string;
+/**
+ * A reference to bytes in the space's artifact store (SPEC §5).
+ *
+ * There is deliberately no location field. The digest IS the identity: content-addressed, so a
+ * re-put of identical bytes is idempotent, and resolution can move from a JetStream Object Store
+ * to anything else without a message-shape change.
+ */
+export interface ArtifactPart {
+    kind: typeof ARTIFACT_PART_KIND;
+    /** Human name, e.g. `coverage-report.html`. A publisher's claim (see the module doc). */
+    name: string;
+    /** MIME type. A publisher's claim. */
+    mediaType: string;
+    /** `sha256:<hex>` over the RAW bytes — the artifact's identity. Self-verifying. */
+    digest: string;
+    /** Size in bytes. A publisher's claim: never preallocate from it. */
+    size: number;
+}
+/**
+ * Structural guard for an `artifact` part.
+ *
+ * It validates the digest FORM, not just the field's type, because a malformed digest is not a
+ * reference to anything — it is a lookup that can only ever fail, and admitting it here would push
+ * the refusal to a fetch that reads as "missing artifact" instead of "malformed message". Same
+ * reason `size` must be a non-negative safe integer: `-1`, `NaN`, and `1e30` are all "a number".
+ */
+export declare function isArtifactPart(value: unknown): value is ArtifactPart;
+//# sourceMappingURL=artifact.d.ts.map

package/dist/artifact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact.d.ts","sourceRoot":"","sources":["../src/artifact.ts"],"names":[],"mappings":"AAmBA;4EAC4E;AAC5E,eAAO,MAAM,kBAAkB,EAAG,UAAmB,CAAC;AAmBtD;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAa9D;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,OAAO,kBAAkB,CAAC;IAChC,yFAAyF;IACzF,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAQpE"}

package/dist/artifact.js

@@ -0,0 +1,82 @@
+/**
+ * The `artifact` reference part and the object-store digest boundary (SPEC §5).
+ *
+ * An artifact is bytes that do not fit in a message. The message carries a REFERENCE — identity
+ * and size, never a location — so the backing store can change without touching a single message
+ * shape. Resolution is the reader's job.
+ *
+ * THE PART IS A CLAIM, NOT A FACT. `name`, `mediaType`, and `size` are whatever the publisher
+ * wrote. Only `digest` is self-verifying, because the bytes either hash to it or they do not. A
+ * receiver that preallocates from the part's `size`, or trusts its `mediaType` to decide how to
+ * handle the bytes, has taken a hostile publisher's word for it; the store's commit-time metadata
+ * is the one that was checked.
+ *
+ * This module deliberately holds the store boundary and NOT the digest primitives: `rawDigest` /
+ * `verifyRawBytes` live in `canonical.ts`, which knows nothing about any store and must stay that
+ * way.
+ */
+import { DIGEST_PREFIX, isContractDigest } from "./canonical.js";
+/** The core part kind. Bare (not reverse-DNS) because this is Cotal's own reserved primitive, not
+ *  a wrapped external vocabulary — SPEC §5's reserved slot, now defined. */
+export const ARTIFACT_PART_KIND = "artifact";
+/**
+ * The object-store digest header form, MEASURED rather than assumed (nats-server 2.14.4,
+ * `@nats-io/obj` 3.4.0): `SHA-256=` followed by the **base64url alphabet WITH `=` padding** —
+ * e.g. `SHA-256=vSqOx0BLVInPlO4PJ1RvMKaI4Y5g1Uhfr-Jthge1elc=`. Over 200 blobs, `-` and `_`
+ * appeared and `+` and `/` never did.
+ *
+ * That form is neither of the two things Node's `createHash(...).digest()` produces, which is the
+ * whole reason this function exists. See {@link fromObjectStoreDigest}.
+ */
+const OS_DIGEST_PREFIX = "SHA-256=";
+/** 32 bytes of SHA-256 is 43 significant base64 characters plus one optional `=` pad. The
+ *  alphabet is deliberately BOTH spellings (`-_` and `+/`): they decode to the same bytes, so
+ *  accepting both is correct parsing of an unambiguous superset, not a fallback. Anything else —
+ *  wrong length, stray character, no prefix — is refused loudly. */
+const OS_DIGEST_BODY_RE = /^[A-Za-z0-9_-]{43}=?$|^[A-Za-z0-9+/]{43}=?$/;
+/**
+ * Convert an object-store digest header to Cotal's `sha256:<hex>` identity form.
+ *
+ * CONVERT BY DECODING. NEVER BY RE-ENCODING. The obvious implementation — hash the bytes, encode
+ * the hash, compare the strings — is wrong, and wrong in a way that passes its first test:
+ * measured over 2000 digests, re-encoding to standard base64 mismatches **1490 of 2000** (every
+ * digest whose bytes land on `+` or `/`), and re-encoding to base64url mismatches **2000 of 2000**
+ * (Node strips the padding the store emits). Decoding to hex matched 2000 of 2000. The failure is
+ * in the digest CONTENT, not on a branch a smoke would naturally reach, so a re-encoding
+ * comparison looks correct until roughly three quarters of real artifacts fail to verify.
+ *
+ * The base64 form never escapes this function: everything above it speaks `sha256:<hex>`.
+ */
+export function fromObjectStoreDigest(osDigest) {
+    if (typeof osDigest !== "string" || !osDigest.startsWith(OS_DIGEST_PREFIX))
+        throw new Error(`fromObjectStoreDigest: expected a ${JSON.stringify(OS_DIGEST_PREFIX)}-prefixed digest, got ${JSON.stringify(osDigest)}`);
+    const body = osDigest.slice(OS_DIGEST_PREFIX.length);
+    // Validate BEFORE decoding: Node's base64 decoder silently skips characters it does not
+    // recognize, so garbage can decode to a plausible 32 bytes. The shape check is what makes the
+    // length assertion below meaningful rather than decorative.
+    if (!OS_DIGEST_BODY_RE.test(body))
+        throw new Error(`fromObjectStoreDigest: ${JSON.stringify(osDigest)} is not 32 bytes of base64 SHA-256 (expected 43 characters plus optional padding)`);
+    const bytes = Buffer.from(body, "base64url");
+    if (bytes.length !== 32)
+        throw new Error(`fromObjectStoreDigest: ${JSON.stringify(osDigest)} decoded to ${bytes.length} bytes, not 32`);
+    return DIGEST_PREFIX + bytes.toString("hex");
+}
+/**
+ * Structural guard for an `artifact` part.
+ *
+ * It validates the digest FORM, not just the field's type, because a malformed digest is not a
+ * reference to anything — it is a lookup that can only ever fail, and admitting it here would push
+ * the refusal to a fetch that reads as "missing artifact" instead of "malformed message". Same
+ * reason `size` must be a non-negative safe integer: `-1`, `NaN`, and `1e30` are all "a number".
+ */
+export function isArtifactPart(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const p = value;
+    return p.kind === ARTIFACT_PART_KIND &&
+        typeof p.name === "string" && p.name.length > 0 &&
+        typeof p.mediaType === "string" && p.mediaType.length > 0 &&
+        typeof p.digest === "string" && isContractDigest(p.digest) &&
+        typeof p.size === "number" && Number.isSafeInteger(p.size) && p.size >= 0;
+}
+//# sourceMappingURL=artifact.js.map

package/dist/artifact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact.js","sourceRoot":"","sources":["../src/artifact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEjE;4EAC4E;AAC5E,MAAM,CAAC,MAAM,kBAAkB,GAAG,UAAmB,CAAC;AAEtD;;;;;;;;GAQG;AACH,MAAM,gBAAgB,GAAG,UAAU,CAAC;AAEpC;;;oEAGoE;AACpE,MAAM,iBAAiB,GAAG,6CAA6C,CAAC;AAExE;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,gBAAgB,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC5I,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACrD,wFAAwF;IACxF,8FAA8F;IAC9F,4DAA4D;IAC5D,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,mFAAmF,CAAC,CAAC;IACzJ,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;QACrB,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,eAAe,KAAK,CAAC,MAAM,gBAAgB,CAAC,CAAC;IACjH,OAAO,aAAa,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC/C,CAAC;AAqBD;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,OAAO,CAAC,CAAC,IAAI,KAAK,kBAAkB;QAClC,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;QAC/C,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;QACzD,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1D,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;AAC9E,CAAC"}

package/dist/backup-config.d.ts

@@ -1,7 +1,11 @@
 import { StoreCompression, type StreamConfig } from "@nats-io/jetstream";
 export type SpaceBackupSelection = "full" | "registry";
 export type SpaceBackupStreamClass = "messages" | "registry" | "authorization";
-export type SpaceBackupExcludedClass = "transient" | "derived" | "lease";
+/** Why a stream is outside the backup artifact. `artifact` is its own class deliberately: object
+ *  bytes are neither transient (they outlive a session), derived (nothing can recompute them),
+ *  nor a lease. Excluding them is a RETENTION decision — pin extends lifetime, not durability —
+ *  and giving it an honest name keeps a later reader from reading it as "derived, so recoverable".*/
+export type SpaceBackupExcludedClass = "transient" | "derived" | "lease" | "artifact";
 export interface SpaceBackupStream {
     name: string;
     class: SpaceBackupStreamClass;
@@ -17,7 +21,10 @@ export interface SpaceBackupInventory {
     registry: readonly string[];
 }
 /** The complete Cotal stream inventory at a stable backup cut. Only the eight `backedUp` streams
- * enter a full artifact; the four excluded streams are transient, derived, or leases. */
+ * enter a full artifact; the five excluded streams are transient, derived, leases, or the artifact
+ * object store. EVERY stream a space owns must appear in one list or the other:
+ * {@link validateSpaceBackupInventory} is exact set-equality, so an unenumerated stream fails
+ * validation for the WHOLE space, and a missing one fails it the same way. */
 export declare function spaceBackupInventory(space: string): SpaceBackupInventory;
 /** Reject a missing, foreign, or additional stream before selecting artifact components. */
 export declare function validateSpaceBackupInventory(space: string, actualNames: readonly string[]): SpaceBackupInventory;

package/dist/backup-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"backup-config.d.ts","sourceRoot":"","sources":["../src/backup-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,gBAAgB,EAChB,KAAK,YAAY,EAClB,MAAM,oBAAoB,CAAC;AAkB5B,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,UAAU,CAAC;AACvD,MAAM,MAAM,sBAAsB,GAAG,UAAU,GAAG,UAAU,GAAG,eAAe,CAAC;AAC/E,MAAM,MAAM,wBAAwB,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC;AAEzE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,sBAAsB,CAAC;CAC/B;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,wBAAwB,CAAC;CACjC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,QAAQ,EAAE,SAAS,yBAAyB,EAAE,CAAC;IAC/C,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B;AAED;yFACyF;AACzF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,oBAAoB,CAwBxE;AAED,4FAA4F;AAC5F,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,oBAAoB,CAgBhH;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACnD;AAED,2FAA2F;AAC3F,MAAM,MAAM,2BAA2B,GAAG,IAAI,CAC5C,YAAY,EACV,MAAM,GACN,UAAU,GACV,WAAW,GACX,SAAS,GACT,eAAe,GACf,UAAU,GACV,WAAW,GACX,SAAS,GACT,sBAAsB,GACtB,cAAc,GACd,SAAS,GACT,cAAc,GACd,kBAAkB,GAClB,cAAc,GACd,eAAe,GACf,yBAAyB,GACzB,mBAAmB,GACnB,aAAa,GACb,YAAY,GACZ,QAAQ,GACR,iBAAiB,CACpB,GAAG;IACF,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;CAC3C,CAAC;AAGF,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAChD,eAAO,MAAM,6BAA6B,QAAqB,CAAC;AA+BhE;kEACkE;AAClE,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,2BAA2B,CAuCtG;AAiCD;wGACwG;AACxG,wBAAgB,mCAAmC,CACjD,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACxC,2BAA2B,CA8B7B;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,iBAAiB,CA4DrG"}
+{"version":3,"file":"backup-config.d.ts","sourceRoot":"","sources":["../src/backup-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,gBAAgB,EAChB,KAAK,YAAY,EAClB,MAAM,oBAAoB,CAAC;AAoB5B,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,UAAU,CAAC;AACvD,MAAM,MAAM,sBAAsB,GAAG,UAAU,GAAG,UAAU,GAAG,eAAe,CAAC;AAC/E;;;qGAGqG;AACrG,MAAM,MAAM,wBAAwB,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,GAAG,UAAU,CAAC;AAEtF,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,sBAAsB,CAAC;CAC/B;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,wBAAwB,CAAC;CACjC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,QAAQ,EAAE,SAAS,yBAAyB,EAAE,CAAC;IAC/C,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B;AAED;;;;8EAI8E;AAC9E,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,oBAAoB,CAyBxE;AAED,4FAA4F;AAC5F,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,oBAAoB,CAgBhH;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACnD;AAED,2FAA2F;AAC3F,MAAM,MAAM,2BAA2B,GAAG,IAAI,CAC5C,YAAY,EACV,MAAM,GACN,UAAU,GACV,WAAW,GACX,SAAS,GACT,eAAe,GACf,UAAU,GACV,WAAW,GACX,SAAS,GACT,sBAAsB,GACtB,cAAc,GACd,SAAS,GACT,cAAc,GACd,kBAAkB,GAClB,cAAc,GACd,eAAe,GACf,yBAAyB,GACzB,mBAAmB,GACnB,aAAa,GACb,YAAY,GACZ,QAAQ,GACR,iBAAiB,CACpB,GAAG;IACF,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC;CAC3C,CAAC;AAGF,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAChD,eAAO,MAAM,6BAA6B,QAAqB,CAAC;AA+BhE;kEACkE;AAClE,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,2BAA2B,CAuCtG;AAiCD;wGACwG;AACxG,wBAAgB,mCAAmC,CACjD,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACxC,2BAA2B,CA8B7B;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,iBAAiB,CA4DrG"}

package/dist/backup-config.js

@@ -1,8 +1,11 @@
 import { DiscardPolicy, RetentionPolicy, StorageType, StoreCompression, } from "@nats-io/jetstream";
 import { nanos } from "@nats-io/transport-node";
-import { aclBucket, channelBucket, chatStream, deliveryBucket, dlvStream, dmStream, inboxStream, managerBucket, membersBucket, membershipBucket, presenceBucket, spacePrefix, taskStream, } from "./subjects.js";
+import { aclBucket, channelBucket, chatStream, deliveryBucket, dlvStream, dmStream, inboxStream, managerBucket, membersBucket, membershipBucket, presenceBucket, spacePrefix, taskStream, artifactBucket, objectStoreStream, } from "./subjects.js";
 /** The complete Cotal stream inventory at a stable backup cut. Only the eight `backedUp` streams
- * enter a full artifact; the four excluded streams are transient, derived, or leases. */
+ * enter a full artifact; the five excluded streams are transient, derived, leases, or the artifact
+ * object store. EVERY stream a space owns must appear in one list or the other:
+ * {@link validateSpaceBackupInventory} is exact set-equality, so an unenumerated stream fails
+ * validation for the WHOLE space, and a missing one fails it the same way. */
 export function spaceBackupInventory(space) {
     const registry = `KV_${channelBucket(space)}`;
     const backedUp = [
@@ -20,6 +23,7 @@ export function spaceBackupInventory(space) {
         { name: `KV_${membershipBucket(space)}`, class: "derived" },
         { name: `KV_${deliveryBucket(space)}`, class: "lease" },
         { name: `KV_${managerBucket(space)}`, class: "lease" },
+        { name: objectStoreStream(artifactBucket(space)), class: "artifact" },
     ];
     return {
         backedUp,

package/dist/backup-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"backup-config.js","sourceRoot":"","sources":["../src/backup-config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,eAAe,EACf,WAAW,EACX,gBAAgB,GAEjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAChD,OAAO,EACL,SAAS,EACT,aAAa,EACb,UAAU,EACV,cAAc,EACd,SAAS,EACT,QAAQ,EACR,WAAW,EACX,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,UAAU,GACX,MAAM,eAAe,CAAC;AAuBvB;yFACyF;AACzF,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC9C,MAAM,QAAQ,GAAwB;QACpC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE;QACrC,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE;QAC9C,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE;QAC5C,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE;QAC9C,EAAE,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE;QAC/C,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE;QAC7C,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE;QAC1D,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE;KAC/D,CAAC;IACF,MAAM,QAAQ,GAAgC;QAC5C,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE;QAC3D,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE;QAC3D,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;QACvD,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;KACvD,CAAC;IACF,OAAO;QACL,QAAQ;QACR,QAAQ;QACR,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACjC,QAAQ,EAAE,CAAC,QAAQ,CAAC;KACrB,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,4BAA4B,CAAC,KAAa,EAAE,WAA8B;IACxF,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACtF,MAAM,MAAM,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM;QACxC,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACnE,MAAM,IAAI,KAAK,CACb,6CAA6C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC1G,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AA8CD,MAAM,wBAAwB,GAAG,KAAK,CAAC,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AACtD,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC;AAChD,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAChE,MAAM,uBAAuB,GAAG,KAAK,CAAC,6BAA6B,CAAC,CAAC;AAErE,SAAS,UAAU,CAAC,IAAY,EAAE,QAAkB;IAClD,OAAO;QACL,IAAI;QACJ,QAAQ;QACR,SAAS,EAAE,eAAe,CAAC,MAAM;QACjC,OAAO,EAAE,WAAW,CAAC,IAAI;QACzB,aAAa,EAAE,CAAC,CAAC;QACjB,QAAQ,EAAE,CAAC,CAAC;QACZ,SAAS,EAAE,CAAC,CAAC;QACb,OAAO,EAAE,CAAC;QACV,oBAAoB,EAAE,CAAC,CAAC;QACxB,YAAY,EAAE,CAAC,CAAC;QAChB,OAAO,EAAE,aAAa,CAAC,GAAG;QAC1B,YAAY,EAAE,CAAC;QACf,MAAM,EAAE,KAAK;QACb,gBAAgB,EAAE,wBAAwB;QAC1C,WAAW,EAAE,gBAAgB,CAAC,IAAI;QAClC,YAAY,EAAE,KAAK;QACnB,aAAa,EAAE,KAAK;QACpB,uBAAuB,EAAE,KAAK;QAC9B,iBAAiB,EAAE,KAAK;QACxB,WAAW,EAAE,KAAK;QAClB,UAAU,EAAE,KAAK;QACjB,MAAM,EAAE,KAAK;QACb,eAAe,EAAE,EAAE;KACpB,CAAC;AACJ,CAAC;AAED;kEACkE;AAClE,MAAM,UAAU,2BAA2B,CAAC,KAAa,EAAE,MAAc;IACvE,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,MAAM,KAAK,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO;YACL,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACtC,oBAAoB,EAAE,2BAA2B;YACjD,YAAY,EAAE,IAAI;SACnB,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3E,IAAI,MAAM,KAAK,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,CAAC,SAAS,EAAE,CAAC;IACzF,CAAC;IACD,IAAI,MAAM,KAAK,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO;YACL,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACxC,oBAAoB,EAAE,2BAA2B;YACjD,gBAAgB,EAAE,uBAAuB;SAC1C,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO;YACL,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACrC,oBAAoB,EAAE,2BAA2B;YACjD,gBAAgB,EAAE,uBAAuB;SAC1C,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACpF,IAAI,MAAM,KAAK,MAAM,MAAM,EAAE,EAAE,CAAC;YAC9B,OAAO;gBACL,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,OAAO,MAAM,IAAI,CAAC,CAAC;gBAC1C,oBAAoB,EAAE,CAAC;gBACvB,OAAO,EAAE,aAAa,CAAC,GAAG;gBAC1B,YAAY,EAAE,IAAI;gBAClB,iBAAiB,EAAE,IAAI;aACxB,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,wCAAwC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACnH,CAAC;AAED,MAAM,qBAAqB,GAA4B;IACrD,WAAW,EAAE,EAAE;IACf,cAAc,EAAE,EAAE;IAClB,SAAS,EAAE,CAAC;IACZ,SAAS,EAAE,IAAI;IACf,MAAM,EAAE,IAAI;IACZ,OAAO,EAAE,EAAE;IACX,iBAAiB,EAAE,IAAI;IACvB,SAAS,EAAE,IAAI;IACf,QAAQ,EAAE,EAAE;IACZ,aAAa,EAAE,KAAK;IACpB,yBAAyB,EAAE,CAAC;IAC5B,mBAAmB,EAAE,KAAK;IAC1B,YAAY,EAAE,KAAK;IACnB,aAAa,EAAE,KAAK;IACpB,iBAAiB,EAAE,KAAK;IACxB,YAAY,EAAE,EAAE;CACjB,CAAC;AAEF,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;aAC7C,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;aACtC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAChD,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;wGACwG;AACxG,MAAM,UAAU,mCAAmC,CACjD,KAAa,EACb,MAAc,EACd,MAAyC;IAEzC,MAAM,QAAQ,GAAG,2BAA2B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IACzF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,mCAAmC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAE7G,MAAM,UAAU,GAA4B,EAAE,CAAC;IAC/C,KAAK,MAAM,CAAC,GAAG,EAAE,aAAa,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzD,UAAU,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5E,KAAK,MAAM,CAAC,GAAG,EAAE,aAAa,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACzE,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAChC,UAAU,CAAC,GAAG,CAAC,GAAG,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC;IACpG,CAAC;IACD,2FAA2F;IAC3F,+FAA+F;IAC/F,IACE,UAAU,CAAC,QAAQ;QACnB,OAAO,UAAU,CAAC,QAAQ,KAAK,QAAQ;QACvC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;QACnC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,QAAmC,CAAC;aAC3D,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC;QACjF,UAAU,CAAC,QAAQ,GAAG,EAAE,CAAC;IAC3B,MAAM,MAAM,GAA4B,EAAE,GAAG,QAAQ,EAAE,GAAG,qBAAqB,EAAE,CAAC;IAClF,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CACtC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAC/F,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,6BAA6B,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtI,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAwC;IAChF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC;QACtB,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,SAAS;QACrF,SAAS,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM;KAC7D,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzG,KAAK,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,gBAAgB,CAAU,EAAE,CAAC;QAC5F,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAK,KAAgB,GAAG,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,sCAAsC,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAkB,CAAC;IAC1C,MAAM,aAAa,GAAG,KAAK,CAAC,SAAmB,CAAC;IAChD,MAAM,YAAY,GAAG,KAAK,CAAC,QAAkB,CAAC;IAC9C,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,aAAa,KAAK,CAAC,IAAI,YAAY,KAAK,CAAC,CAAC;QAC1D,MAAM,SAAS,GAAG,YAAY,GAAG,MAAM,CAAC,gBAAgB,IAAI,aAAa,KAAK,YAAY,GAAG,CAAC,CAAC;QAC/F,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS;YACxB,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACvF,CAAC;SAAM,CAAC;QACN,IAAI,aAAa,GAAG,CAAC,IAAI,aAAa,GAAG,YAAY;YACnD,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACtF,IAAI,QAAQ,GAAG,YAAY,GAAG,aAAa,GAAG,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACnF,CAAC;IACD,KAAK,MAAM,GAAG,IAAK,KAAK,CAAC,OAAiC,IAAI,EAAE;QAC9D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAK,GAAc,GAAG,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACrF,KAAK,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,cAAc,CAAU,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAK,KAAgB,GAAG,CAAC,CAAC;YAChF,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,sCAAsC,CAAC,CAAC;IAC/E,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,CAAU,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YACvF,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,2BAA2B,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;YACxF,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAmC,CAAC;YAC1E,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAK,KAAgB,GAAG,CAAC;gBACvD,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;YAC5E,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,KAAK,CAAC,IAA+B,CAAC;QACnD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,OAAO,CAAC,CAAC;QACzF,IAAI,WAAW,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/G,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAK,IAAI,CAAC,KAAgB,GAAG,CAAC,CAAC;YAC/F,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAClD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;gBAC7F,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IACD,OAAO,KAAqC,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"backup-config.js","sourceRoot":"","sources":["../src/backup-config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,eAAe,EACf,WAAW,EACX,gBAAgB,GAEjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAChD,OAAO,EACL,SAAS,EACT,aAAa,EACb,UAAU,EACV,cAAc,EACd,SAAS,EACT,QAAQ,EACR,WAAW,EACX,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,UAAU,EACV,cAAc,EACd,iBAAiB,GAClB,MAAM,eAAe,CAAC;AA2BvB;;;;8EAI8E;AAC9E,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC9C,MAAM,QAAQ,GAAwB;QACpC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE;QACrC,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE;QAC9C,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE;QAC5C,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE;QAC9C,EAAE,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE;QAC/C,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE;QAC7C,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE;QAC1D,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE;KAC/D,CAAC;IACF,MAAM,QAAQ,GAAgC;QAC5C,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE;QAC3D,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE;QAC3D,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;QACvD,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;QACtD,EAAE,IAAI,EAAE,iBAAiB,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE;KACtE,CAAC;IACF,OAAO;QACL,QAAQ;QACR,QAAQ;QACR,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACjC,QAAQ,EAAE,CAAC,QAAQ,CAAC;KACrB,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,4BAA4B,CAAC,KAAa,EAAE,WAA8B;IACxF,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACtF,MAAM,MAAM,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM;QACxC,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACnE,MAAM,IAAI,KAAK,CACb,6CAA6C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC1G,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AA8CD,MAAM,wBAAwB,GAAG,KAAK,CAAC,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AACtD,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC;AAChD,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAChE,MAAM,uBAAuB,GAAG,KAAK,CAAC,6BAA6B,CAAC,CAAC;AAErE,SAAS,UAAU,CAAC,IAAY,EAAE,QAAkB;IAClD,OAAO;QACL,IAAI;QACJ,QAAQ;QACR,SAAS,EAAE,eAAe,CAAC,MAAM;QACjC,OAAO,EAAE,WAAW,CAAC,IAAI;QACzB,aAAa,EAAE,CAAC,CAAC;QACjB,QAAQ,EAAE,CAAC,CAAC;QACZ,SAAS,EAAE,CAAC,CAAC;QACb,OAAO,EAAE,CAAC;QACV,oBAAoB,EAAE,CAAC,CAAC;QACxB,YAAY,EAAE,CAAC,CAAC;QAChB,OAAO,EAAE,aAAa,CAAC,GAAG;QAC1B,YAAY,EAAE,CAAC;QACf,MAAM,EAAE,KAAK;QACb,gBAAgB,EAAE,wBAAwB;QAC1C,WAAW,EAAE,gBAAgB,CAAC,IAAI;QAClC,YAAY,EAAE,KAAK;QACnB,aAAa,EAAE,KAAK;QACpB,uBAAuB,EAAE,KAAK;QAC9B,iBAAiB,EAAE,KAAK;QACxB,WAAW,EAAE,KAAK;QAClB,UAAU,EAAE,KAAK;QACjB,MAAM,EAAE,KAAK;QACb,eAAe,EAAE,EAAE;KACpB,CAAC;AACJ,CAAC;AAED;kEACkE;AAClE,MAAM,UAAU,2BAA2B,CAAC,KAAa,EAAE,MAAc;IACvE,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,MAAM,KAAK,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO;YACL,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACtC,oBAAoB,EAAE,2BAA2B;YACjD,YAAY,EAAE,IAAI;SACnB,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3E,IAAI,MAAM,KAAK,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,CAAC,SAAS,EAAE,CAAC;IACzF,CAAC;IACD,IAAI,MAAM,KAAK,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO;YACL,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACxC,oBAAoB,EAAE,2BAA2B;YACjD,gBAAgB,EAAE,uBAAuB;SAC1C,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO;YACL,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACrC,oBAAoB,EAAE,2BAA2B;YACjD,gBAAgB,EAAE,uBAAuB;SAC1C,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACpF,IAAI,MAAM,KAAK,MAAM,MAAM,EAAE,EAAE,CAAC;YAC9B,OAAO;gBACL,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,OAAO,MAAM,IAAI,CAAC,CAAC;gBAC1C,oBAAoB,EAAE,CAAC;gBACvB,OAAO,EAAE,aAAa,CAAC,GAAG;gBAC1B,YAAY,EAAE,IAAI;gBAClB,iBAAiB,EAAE,IAAI;aACxB,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,wCAAwC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACnH,CAAC;AAED,MAAM,qBAAqB,GAA4B;IACrD,WAAW,EAAE,EAAE;IACf,cAAc,EAAE,EAAE;IAClB,SAAS,EAAE,CAAC;IACZ,SAAS,EAAE,IAAI;IACf,MAAM,EAAE,IAAI;IACZ,OAAO,EAAE,EAAE;IACX,iBAAiB,EAAE,IAAI;IACvB,SAAS,EAAE,IAAI;IACf,QAAQ,EAAE,EAAE;IACZ,aAAa,EAAE,KAAK;IACpB,yBAAyB,EAAE,CAAC;IAC5B,mBAAmB,EAAE,KAAK;IAC1B,YAAY,EAAE,KAAK;IACnB,aAAa,EAAE,KAAK;IACpB,iBAAiB,EAAE,KAAK;IACxB,YAAY,EAAE,EAAE;CACjB,CAAC;AAEF,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;aAC7C,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;aACtC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAChD,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;wGACwG;AACxG,MAAM,UAAU,mCAAmC,CACjD,KAAa,EACb,MAAc,EACd,MAAyC;IAEzC,MAAM,QAAQ,GAAG,2BAA2B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IACzF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,mCAAmC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAE7G,MAAM,UAAU,GAA4B,EAAE,CAAC;IAC/C,KAAK,MAAM,CAAC,GAAG,EAAE,aAAa,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzD,UAAU,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5E,KAAK,MAAM,CAAC,GAAG,EAAE,aAAa,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACzE,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAChC,UAAU,CAAC,GAAG,CAAC,GAAG,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC;IACpG,CAAC;IACD,2FAA2F;IAC3F,+FAA+F;IAC/F,IACE,UAAU,CAAC,QAAQ;QACnB,OAAO,UAAU,CAAC,QAAQ,KAAK,QAAQ;QACvC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;QACnC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,QAAmC,CAAC;aAC3D,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC;QACjF,UAAU,CAAC,QAAQ,GAAG,EAAE,CAAC;IAC3B,MAAM,MAAM,GAA4B,EAAE,GAAG,QAAQ,EAAE,GAAG,qBAAqB,EAAE,CAAC;IAClF,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CACtC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAC/F,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,6BAA6B,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtI,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAwC;IAChF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC;QACtB,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,SAAS;QACrF,SAAS,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM;KAC7D,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzG,KAAK,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,gBAAgB,CAAU,EAAE,CAAC;QAC5F,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAK,KAAgB,GAAG,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,sCAAsC,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAkB,CAAC;IAC1C,MAAM,aAAa,GAAG,KAAK,CAAC,SAAmB,CAAC;IAChD,MAAM,YAAY,GAAG,KAAK,CAAC,QAAkB,CAAC;IAC9C,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,aAAa,KAAK,CAAC,IAAI,YAAY,KAAK,CAAC,CAAC;QAC1D,MAAM,SAAS,GAAG,YAAY,GAAG,MAAM,CAAC,gBAAgB,IAAI,aAAa,KAAK,YAAY,GAAG,CAAC,CAAC;QAC/F,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS;YACxB,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACvF,CAAC;SAAM,CAAC;QACN,IAAI,aAAa,GAAG,CAAC,IAAI,aAAa,GAAG,YAAY;YACnD,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACtF,IAAI,QAAQ,GAAG,YAAY,GAAG,aAAa,GAAG,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACnF,CAAC;IACD,KAAK,MAAM,GAAG,IAAK,KAAK,CAAC,OAAiC,IAAI,EAAE;QAC9D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAK,GAAc,GAAG,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACrF,KAAK,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,cAAc,CAAU,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAK,KAAgB,GAAG,CAAC,CAAC;YAChF,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,sCAAsC,CAAC,CAAC;IAC/E,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,CAAU,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YACvF,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,2BAA2B,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;YACxF,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAmC,CAAC;YAC1E,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAK,KAAgB,GAAG,CAAC;gBACvD,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;YAC5E,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,KAAK,CAAC,IAA+B,CAAC;QACnD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,OAAO,CAAC,CAAC;QACzF,IAAI,WAAW,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/G,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAK,IAAI,CAAC,KAAgB,GAAG,CAAC,CAAC;YAC/F,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAClD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;gBAC7F,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IACD,OAAO,KAAqC,CAAC;AAC/C,CAAC"}

package/dist/broker-tls.d.ts

@@ -0,0 +1,70 @@
+/** How the broker serves its client port. Every `serverConfig` render must state one explicitly. */
+export type BrokerTransport = {
+    readonly kind: "plaintext";
+} | {
+    readonly kind: "tls-required";
+    readonly certFile: string;
+    readonly keyFile: string;
+};
+export type TlsRequired = Extract<BrokerTransport, {
+    kind: "tls-required";
+}>;
+/** What a validated cert/key pair turned out to be. Returned so callers can log or compare it —
+ *  notably the rotation path, which must prove the SERVED leaf matches the file on disk. */
+export interface TlsMaterial {
+    readonly notBefore: Date;
+    readonly notAfter: Date;
+    /** Colon-separated uppercase SHA-256 of the DER, exactly as `X509Certificate.fingerprint256`
+     *  and `tls.PeerCertificate.fingerprint256` render it, so the two are directly comparable. */
+    readonly fingerprint256: string;
+    readonly subject: string;
+}
+/** Thrown for every rejected cert/key pair. A distinct type so callers can surface a
+ *  CERTIFICATE cause to the operator rather than a generic "broker unreachable" — a TLS failure
+ *  reported as unreachability invites exactly the wrong remedy. */
+export declare class TlsMaterialError extends Error {
+    constructor(message: string);
+}
+export declare function validateTlsMaterial(t: TlsRequired, opts?: {
+    dialHost?: string;
+    now?: Date;
+}): TlsMaterial;
+/** What the broker is actually serving right now, read off the wire. */
+export interface ServedCert {
+    readonly fingerprint256: string;
+    readonly validTo: string;
+    readonly subject: string;
+}
+/**
+ * Open a real NATS STARTTLS connection and report the leaf certificate the broker is SERVING.
+ *
+ * This is the only honest proof that a rotation took effect. Renewing the files on disk does not
+ * reload nats-server: the reference deployment renews its Let's Encrypt material on a timer and
+ * the broker process has gone on serving the previous certificate for weeks, because nothing
+ * signalled it. Comparing file mtimes, or trusting that a reload command exited zero, would both
+ * have reported success there. Only reading back what the listener presents catches it.
+ *
+ * `rejectUnauthorized` is false on purpose: this call answers "which certificate is being served",
+ * not "do I trust it". The caller compares the returned fingerprint to the file it intended to
+ * install, which is a stronger and more specific check than chain validation.
+ */
+export declare function probeServedCert(opts: {
+    host: string;
+    port: number;
+    /** SNI/verification name, when it differs from the dial host. */
+    servername?: string;
+    timeoutMs?: number;
+}): Promise<ServedCert>;
+/**
+ * Assert that the broker is serving exactly the certificate in `expected`. This is the rotation
+ * gate: validate the new pair, install it, signal the broker, then call this. A mismatch means the
+ * reload did not take, and the caller must fail loud and leave the previous listener in place —
+ * never fall back to plaintext.
+ */
+export declare function assertServedCertMatches(expected: TlsMaterial, where: {
+    host: string;
+    port: number;
+    servername?: string;
+    timeoutMs?: number;
+}): Promise<ServedCert>;
+//# sourceMappingURL=broker-tls.d.ts.map

package/dist/broker-tls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker-tls.d.ts","sourceRoot":"","sources":["../src/broker-tls.ts"],"names":[],"mappings":"AAeA,oGAAoG;AACpG,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3F,MAAM,MAAM,WAAW,GAAG,OAAO,CAAC,eAAe,EAAE;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,CAAC,CAAC;AAE7E;4FAC4F;AAC5F,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB;kGAC8F;IAC9F,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;mEAEmE;AACnE,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI5B;AAwBD,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CAAO,GAAG,WAAW,CA+E7G;AAED,wEAAwE;AACxE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,UAAU,CAAC,CAyDtB;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,WAAW,EACrB,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7E,OAAO,CAAC,UAAU,CAAC,CASrB"}