@cotal-ai/core 0.15.0 → 0.17.0

package/dist/session-browser.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The BROWSER-SAFE subset of the §13.6 session composite, for the manager console's session-client
+ * bundle (P2 item 6): the rails + the terminal-session frame codec, with ZERO node-only
+ * dependencies. The console bundle (esbuild) imports ONLY this subpath
+ * (`@cotal-ai/core/session-browser`), NEVER the package root — the root pulls `node:crypto` through
+ * the grant mint/verify/redeem + the KV ledger, which a browser has no business bundling.
+ *
+ * This is a re-export barrel over the two already-split node-free modules; it adds no logic, so the
+ * SAME core rail + frame codec that runs on the manager runs in the browser (the point of item 6:
+ * a remote holder speaks the identical wire).
+ */
+export { openSessionRail, encodeSessionFrame, parseSessionFrame, assertWindow, SESSION_WINDOW_DEFAULT, SESSION_WINDOW_MAX, type SessionFrame, type SessionRail, type SessionRailOpts, type SessionRole, } from "./endpoint-session-rail.js";
+export { encodeTerminalData, terminalFrameBytes, decodeTerminalFrame, type TerminalFrame, } from "./session-terminal-frames.js";
+export type { SessionGrant } from "./endpoint-session.js";
+//# sourceMappingURL=session-browser.d.ts.map

package/dist/session-browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-browser.d.ts","sourceRoot":"","sources":["../src/session-browser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,EACZ,sBAAsB,EACtB,kBAAkB,EAClB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,WAAW,GACjB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,aAAa,GACnB,MAAM,8BAA8B,CAAC;AAEtC,YAAY,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/session-browser.js

@@ -0,0 +1,14 @@
+/**
+ * The BROWSER-SAFE subset of the §13.6 session composite, for the manager console's session-client
+ * bundle (P2 item 6): the rails + the terminal-session frame codec, with ZERO node-only
+ * dependencies. The console bundle (esbuild) imports ONLY this subpath
+ * (`@cotal-ai/core/session-browser`), NEVER the package root — the root pulls `node:crypto` through
+ * the grant mint/verify/redeem + the KV ledger, which a browser has no business bundling.
+ *
+ * This is a re-export barrel over the two already-split node-free modules; it adds no logic, so the
+ * SAME core rail + frame codec that runs on the manager runs in the browser (the point of item 6:
+ * a remote holder speaks the identical wire).
+ */
+export { openSessionRail, encodeSessionFrame, parseSessionFrame, assertWindow, SESSION_WINDOW_DEFAULT, SESSION_WINDOW_MAX, } from "./endpoint-session-rail.js";
+export { encodeTerminalData, terminalFrameBytes, decodeTerminalFrame, } from "./session-terminal-frames.js";
+//# sourceMappingURL=session-browser.js.map

package/dist/session-browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-browser.js","sourceRoot":"","sources":["../src/session-browser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,EACZ,sBAAsB,EACtB,kBAAkB,GAKnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC"}

package/dist/session-terminal-frames.d.ts

@@ -0,0 +1,36 @@
+/** One terminal-session frame carried in a §13.6 rail data payload. `end.reason` is an
+ *  APPLICATION-defined bounded token (the reference manager uses `process-exit` / `closed` /
+ *  `expired` / `target-despawn` / `manager-restart`); the vocabulary is not fixed by the wire, so
+ *  a different endpoint can surface its own terminal causes without a core change. */
+export type TerminalFrame = {
+    k: "ready";
+} | {
+    k: "data";
+    b: string;
+} | {
+    k: "resize";
+    cols: number;
+    rows: number;
+} | {
+    k: "end";
+    reason: string;
+} | {
+    k: "drop";
+    bytes: number;
+};
+/** Encode raw terminal bytes as a `data` frame (the ruled base64-in-JSON form). Accepts any
+ *  Uint8Array (a node Buffer is one). FAIL-LOUD on a non-Uint8Array: a STRING (e.g. xterm's onData
+ *  keystroke, which is a string, not bytes) would `base64Encode` its chars as NaN→0 and silently
+ *  ship NUL bytes the pty ignores — the browser must UTF-8-encode first. Throwing turns that trap
+ *  into an immediate error instead of a byte stream that vanishes into the terminal (§13.6). */
+export declare function encodeTerminalData(bytes: Uint8Array): TerminalFrame;
+/** The bytes carried by a decoded `data` frame, as a Uint8Array (a node Buffer is one; the manager
+ *  bridge decodes utf8 via TextDecoder, the browser writes the bytes straight to xterm). */
+export declare function terminalFrameBytes(frame: Extract<TerminalFrame, {
+    k: "data";
+}>): Uint8Array;
+/** Fail-loud closed-schema parse of a terminal-session frame from a rail's opaque `data`. An
+ *  unknown kind, an extra field, or a malformed value THROWS — the rail turns that into a protocol
+ *  error, so a corrupt frame can never reach the terminal as a partial write. */
+export declare function decodeTerminalFrame(data: unknown): TerminalFrame;
+//# sourceMappingURL=session-terminal-frames.d.ts.map

package/dist/session-terminal-frames.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-terminal-frames.d.ts","sourceRoot":"","sources":["../src/session-terminal-frames.ts"],"names":[],"mappings":"AA0BA;;;sFAGsF;AACtF,MAAM,MAAM,aAAa,GACrB;IAAE,CAAC,EAAE,OAAO,CAAA;CAAE,GACd;IAAE,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,GACxB;IAAE,CAAC,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,CAAC,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC5B;IAAE,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AA+DjC;;;;gGAIgG;AAChG,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,UAAU,GAAG,aAAa,CAMnE;AAED;4FAC4F;AAC5F,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,aAAa,EAAE;IAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,UAAU,CAE3F;AAED;;iFAEiF;AACjF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,aAAa,CAyBhE"}

package/dist/session-terminal-frames.js

@@ -0,0 +1,149 @@
+/**
+ * The §13.6 TERMINAL-SESSION PROFILE: the normative application framing for streaming an
+ * interactive terminal (a PTY) over a §13.6 bidirectional session. It rides inside the session
+ * rail's opaque `data` field (`SessionFrame` `{t:"f",seq,data}`); the rail owns ordering, the
+ * bounded flow window, credits, and its own `close`, and this profile is what a terminal attach
+ * puts on top.
+ *
+ * This is WIRE, not a client concern: a remote holder on another machine (the whole point of the
+ * mesh attach — no `127.0.0.1`) MUST speak exactly this codec to drive or watch the terminal, and
+ * an extension attaches through the same frames. It therefore lives in core (extensions peer-depend
+ * core only) with ZERO dependency on any implementation, as a tightly-bound vocabulary.
+ *
+ * The ratified session-plane ruling: raw-binary DATA payloads + structured JSON CONTROL frames.
+ * The rail encodes every frame as JSON, so raw terminal bytes cannot ride uninterpreted — they take
+ * the ruled base64-in-JSON form (`{k:"data",b:<base64>}`), keeping the bytes on the SAME
+ * subject/grant as the control frames rather than weakening the ACL to carry a second binary rail.
+ * Control frames (`ready`/`resize`/`end`/`drop`) stay structured, bounded, and authenticated.
+ *
+ * Directions (the rail already scopes who may send on which subject):
+ *   caller  → serving: `ready` (subscribed — replay backlog + stream live), `data` (keystrokes),
+ *                      `resize` (pty geometry).
+ *   serving → caller:  `data` (pty output, incl. the reconstructed backlog), `drop` (a
+ *                      backpressure drop-notice — never a silent loss), `end` (a terminal reason).
+ */
+import { EpEnvelopeError } from "./endpoint-error.js";
+const isRec = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+function invalid(what) {
+    throw new EpEnvelopeError("contract-invalid", `${what} (SPEC 13.6 terminal-session frame)`);
+}
+/** Standard base64 (the rail is JSON; base64 is the compact interop form), validated
+ *  DETERMINISTICALLY by grammar — `Buffer.from(_, "base64")` is lenient (it drops invalid chars),
+ *  so a garbled byte payload would decode to silent garbage; a strict grammar + length check
+ *  rejects it LOUD (a protocol error the rail surfaces), never a partial terminal write. */
+const BASE64 = /^[A-Za-z0-9+/]*={0,2}$/;
+/** Ceiling for a single data payload's base64 text (well under the rail's 1 MiB default). */
+const MAX_B64_CHARS = 4 * 1024 * 1024;
+function assertBase64(v) {
+    if (typeof v !== "string")
+        invalid("data payload is not a string");
+    if (v.length > MAX_B64_CHARS)
+        invalid(`data payload is ${v.length} base64 chars, over the ${MAX_B64_CHARS} ceiling`);
+    if (v.length % 4 !== 0 || !BASE64.test(v))
+        invalid("data payload is not valid base64");
+    return v;
+}
+/** A bounded terminal-cause token: lowercase kebab, 1..48 chars. Keeps `end.reason` generic
+ *  (no fixed enum) while refusing an unbounded/hostile string. */
+const REASON = /^[a-z][a-z0-9-]{0,47}$/;
+function assertReason(v) {
+    if (typeof v !== "string" || !REASON.test(v))
+        invalid(`end reason ${JSON.stringify(v)} is not a bounded kebab-case cause token`);
+    return v;
+}
+// STANDARD base64 (RFC 4648 §4: the standard alphabet + `=` padding — BYTE-EXACT with node's
+// `Buffer.toString("base64")` / `Buffer.from(_, "base64")`), implemented Buffer-free so the codec
+// runs unchanged in the browser console bundle. NOT url-safe (the rail's JSON carries `+`/`/`
+// fine). Both ends run this same code, so the wire stays identical either way.
+const B64_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+const B64_INV = (() => { const m = new Int16Array(128).fill(-1); for (let i = 0; i < B64_ALPHABET.length; i++)
+    m[B64_ALPHABET.charCodeAt(i)] = i; return m; })();
+function base64Encode(bytes) {
+    let out = "";
+    for (let i = 0; i < bytes.length; i += 3) {
+        const b0 = bytes[i];
+        const has1 = i + 1 < bytes.length, has2 = i + 2 < bytes.length;
+        const b1 = has1 ? bytes[i + 1] : 0, b2 = has2 ? bytes[i + 2] : 0;
+        out += B64_ALPHABET[b0 >> 2];
+        out += B64_ALPHABET[((b0 & 0x03) << 4) | (b1 >> 4)];
+        out += has1 ? B64_ALPHABET[((b1 & 0x0f) << 2) | (b2 >> 6)] : "=";
+        out += has2 ? B64_ALPHABET[b2 & 0x3f] : "=";
+    }
+    return out;
+}
+/** Decode STANDARD base64 (already grammar-validated by {@link assertBase64}) to bytes. */
+function base64Decode(s) {
+    const clean = s.endsWith("==") ? s.slice(0, -2) : s.endsWith("=") ? s.slice(0, -1) : s;
+    const out = new Uint8Array((clean.length * 6) >> 3);
+    let o = 0, acc = 0, bits = 0;
+    for (let i = 0; i < clean.length; i++) {
+        acc = (acc << 6) | (B64_INV[clean.charCodeAt(i)] & 0x3f);
+        bits += 6;
+        if (bits >= 8) {
+            bits -= 8;
+            out[o++] = (acc >> bits) & 0xff;
+        }
+    }
+    return out;
+}
+/** Encode raw terminal bytes as a `data` frame (the ruled base64-in-JSON form). Accepts any
+ *  Uint8Array (a node Buffer is one). FAIL-LOUD on a non-Uint8Array: a STRING (e.g. xterm's onData
+ *  keystroke, which is a string, not bytes) would `base64Encode` its chars as NaN→0 and silently
+ *  ship NUL bytes the pty ignores — the browser must UTF-8-encode first. Throwing turns that trap
+ *  into an immediate error instead of a byte stream that vanishes into the terminal (§13.6). */
+export function encodeTerminalData(bytes) {
+    // ArrayBuffer.isView is cross-realm safe (a browser/vm-sandbox/node Uint8Array all pass; a string
+    // or plain object does not) — unlike `instanceof Uint8Array`, which fails across realms.
+    if (!ArrayBuffer.isView(bytes))
+        invalid(`encodeTerminalData expects raw bytes (Uint8Array); got ${typeof bytes} — UTF-8-encode a string keystroke first`);
+    return { k: "data", b: base64Encode(bytes) };
+}
+/** The bytes carried by a decoded `data` frame, as a Uint8Array (a node Buffer is one; the manager
+ *  bridge decodes utf8 via TextDecoder, the browser writes the bytes straight to xterm). */
+export function terminalFrameBytes(frame) {
+    return base64Decode(frame.b);
+}
+/** Fail-loud closed-schema parse of a terminal-session frame from a rail's opaque `data`. An
+ *  unknown kind, an extra field, or a malformed value THROWS — the rail turns that into a protocol
+ *  error, so a corrupt frame can never reach the terminal as a partial write. */
+export function decodeTerminalFrame(data) {
+    if (!isRec(data))
+        invalid("frame is not an object");
+    const o = data;
+    switch (o.k) {
+        case "ready":
+            for (const key of Object.keys(o))
+                if (key !== "k")
+                    invalid(`ready frame carries the unknown field "${key}"`);
+            return { k: "ready" };
+        case "data":
+            for (const key of Object.keys(o))
+                if (key !== "k" && key !== "b")
+                    invalid(`data frame carries the unknown field "${key}"`);
+            return { k: "data", b: assertBase64(o.b) };
+        case "resize":
+            for (const key of Object.keys(o))
+                if (key !== "k" && key !== "cols" && key !== "rows")
+                    invalid(`resize frame carries the unknown field "${key}"`);
+            if (!Number.isInteger(o.cols) || o.cols < 1 || o.cols > 100_000)
+                invalid("resize cols is not a bounded positive integer");
+            if (!Number.isInteger(o.rows) || o.rows < 1 || o.rows > 100_000)
+                invalid("resize rows is not a bounded positive integer");
+            return { k: "resize", cols: o.cols, rows: o.rows };
+        case "end":
+            for (const key of Object.keys(o))
+                if (key !== "k" && key !== "reason")
+                    invalid(`end frame carries the unknown field "${key}"`);
+            return { k: "end", reason: assertReason(o.reason) };
+        case "drop":
+            for (const key of Object.keys(o))
+                if (key !== "k" && key !== "bytes")
+                    invalid(`drop frame carries the unknown field "${key}"`);
+            if (!Number.isInteger(o.bytes) || o.bytes < 1)
+                invalid("drop frame bytes is not a positive integer");
+            return { k: "drop", bytes: o.bytes };
+        default:
+            invalid(`unknown terminal-session frame kind ${JSON.stringify(o.k)}`);
+    }
+}
+//# sourceMappingURL=session-terminal-frames.js.map

package/dist/session-terminal-frames.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-terminal-frames.js","sourceRoot":"","sources":["../src/session-terminal-frames.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAatD,MAAM,KAAK,GAAG,CAAC,CAAU,EAAgC,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACrH,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,GAAG,IAAI,qCAAqC,CAAC,CAAC;AAC9F,CAAC;AAED;;;4FAG4F;AAC5F,MAAM,MAAM,GAAG,wBAAwB,CAAC;AACxC,6FAA6F;AAC7F,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACtC,SAAS,YAAY,CAAC,CAAU;IAC9B,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,8BAA8B,CAAC,CAAC;IACnE,IAAI,CAAC,CAAC,MAAM,GAAG,aAAa;QAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC,MAAM,2BAA2B,aAAa,UAAU,CAAC,CAAC;IACrH,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,kCAAkC,CAAC,CAAC;IACvF,OAAO,CAAC,CAAC;AACX,CAAC;AAED;kEACkE;AAClE,MAAM,MAAM,GAAG,wBAAwB,CAAC;AACxC,SAAS,YAAY,CAAC,CAAU;IAC9B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC;IACjI,OAAO,CAAC,CAAC;AACX,CAAC;AAED,6FAA6F;AAC7F,kGAAkG;AAClG,8FAA8F;AAC9F,+EAA+E;AAC/E,MAAM,YAAY,GAAG,kEAAkE,CAAC;AACxF,MAAM,OAAO,GAAe,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE;IAAE,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAE7K,SAAS,YAAY,CAAC,KAAiB;IACrC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACpB,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;QAC/D,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,GAAG,IAAI,YAAY,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QAC7B,GAAG,IAAI,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACpD,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACjE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2FAA2F;AAC3F,SAAS,YAAY,CAAC,CAAS;IAC7B,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvF,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC;IAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACzD,IAAI,IAAI,CAAC,CAAC;QACV,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;YAAC,IAAI,IAAI,CAAC,CAAC;YAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC;QAAC,CAAC;IAChE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;gGAIgG;AAChG,MAAM,UAAU,kBAAkB,CAAC,KAAiB;IAClD,kGAAkG;IAClG,yFAAyF;IACzF,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC;QAC5B,OAAO,CAAC,0DAA0D,OAAO,KAAK,0CAA0C,CAAC,CAAC;IAC5H,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED;4FAC4F;AAC5F,MAAM,UAAU,kBAAkB,CAAC,KAA4C;IAC7E,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED;;iFAEiF;AACjF,MAAM,UAAU,mBAAmB,CAAC,IAAa;IAC/C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACpD,MAAM,CAAC,GAAG,IAAI,CAAC;IACf,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACZ,KAAK,OAAO;YACV,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,IAAI,GAAG,KAAK,GAAG;oBAAE,OAAO,CAAC,0CAA0C,GAAG,GAAG,CAAC,CAAC;YAC7G,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;QACxB,KAAK,MAAM;YACT,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG;oBAAE,OAAO,CAAC,yCAAyC,GAAG,GAAG,CAAC,CAAC;YAC3H,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,KAAK,QAAQ;YACX,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,MAAM;oBAAE,OAAO,CAAC,2CAA2C,GAAG,GAAG,CAAC,CAAC;YAClJ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAK,CAAC,CAAC,IAAe,GAAG,CAAC,IAAK,CAAC,CAAC,IAAe,GAAG,OAAO;gBAAE,OAAO,CAAC,+CAA+C,CAAC,CAAC;YAClJ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAK,CAAC,CAAC,IAAe,GAAG,CAAC,IAAK,CAAC,CAAC,IAAe,GAAG,OAAO;gBAAE,OAAO,CAAC,+CAA+C,CAAC,CAAC;YAClJ,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAc,EAAE,IAAI,EAAE,CAAC,CAAC,IAAc,EAAE,CAAC;QACzE,KAAK,KAAK;YACR,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,QAAQ;oBAAE,OAAO,CAAC,wCAAwC,GAAG,GAAG,CAAC,CAAC;YAC/H,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QACtD,KAAK,MAAM;YACT,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,OAAO;oBAAE,OAAO,CAAC,yCAAyC,GAAG,GAAG,CAAC,CAAC;YAC/H,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAK,CAAC,CAAC,KAAgB,GAAG,CAAC;gBAAE,OAAO,CAAC,4CAA4C,CAAC,CAAC;YACjH,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,KAAe,EAAE,CAAC;QACjD;YACE,OAAO,CAAC,uCAAuC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC"}

package/dist/spaces.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spaces.d.ts","sourceRoot":"","sources":["../src/spaces.ts"],"names":[],"mappings":"AA4BA,qCAAqC;AACrC,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;2EAE2E;AAC3E,wBAAsB,UAAU,CAAC,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAmDnF;AAED;;0FAE0F;AAC1F,wBAAsB,WAAW,CAAC,IAAI,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA8B1G"}
+{"version":3,"file":"spaces.d.ts","sourceRoot":"","sources":["../src/spaces.ts"],"names":[],"mappings":"AA8BA,qCAAqC;AACrC,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;2EAE2E;AAC3E,wBAAsB,UAAU,CAAC,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAmDnF;AAED;;0FAE0F;AAC1F,wBAAsB,WAAW,CAAC,IAAI,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAmC1G"}

package/dist/spaces.js

@@ -7,7 +7,7 @@ import { connect, credsAuthenticator } from "@nats-io/transport-node";
 import { jetstreamManager } from "@nats-io/jetstream";
 import { Kvm } from "@nats-io/kv";
 import { DEFAULT_SERVER } from "./endpoint.js";
-import { parseSubject, chatStream, dmStream, taskStream, inboxStream, dlvStream, presenceBucket, channelBucket, membersBucket, aclBucket, membershipBucket, deliveryBucket, managerBucket, } from "./subjects.js";
+import { parseSubject, chatStream, dmStream, taskStream, inboxStream, dlvStream, presenceBucket, channelBucket, membersBucket, aclBucket, membershipBucket, deliveryBucket, managerBucket, artifactBucket, objectStoreStream, } from "./subjects.js";
 import { idFromCreds } from "./identity.js";
 /** Connect opts for a possibly-scoped cred: an authenticator plus the per-id `inboxPrefix` a scoped
  *  cred needs (its `sub.allow` is `_INBOX_<id>.>`, so JS API replies must land there, not the default
@@ -107,6 +107,11 @@ export async function deleteSpace(opts) {
             `KV_${membershipBucket(opts.space)}`,
             `KV_${deliveryBucket(opts.space)}`,
             `KV_${managerBucket(opts.space)}`,
+            // The artifact Object Store's backing stream. It must be named HERE and not swept by
+            // prefix: `$O.<bucket>.>` lives outside the `cotal.<space>.>` grammar, so a subject-based
+            // sweep of the space never sees it. Teardown is the sole STREAM.DELETE holder, so a stream
+            // missing from this list is not merely un-deleted - nothing in the system can ever reap it.
+            objectStoreStream(artifactBucket(opts.space)),
         ];
         for (const s of streams)
             await jsm.streams.delete(s).catch(() => { });

package/dist/spaces.js.map

@@ -1 +1 @@
-{"version":3,"file":"spaces.js","sourceRoot":"","sources":["../src/spaces.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,+FAA+F;AAC/F,2FAA2F;AAC3F,+FAA+F;AAC/F,wFAAwF;AAExF,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EACL,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EACtE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,gBAAgB,EACzE,cAAc,EAAE,aAAa,GAC9B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE5C;;8FAE8F;AAC9F,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,OAAO;QACL,aAAa,EAAE,kBAAkB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClE,WAAW,EAAE,UAAU,WAAW,CAAC,KAAK,CAAC,EAAE;KAC5C,CAAC;AACJ,CAAC;AAgBD;;2EAE2E;AAC3E,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAA0B,EAAE;IAC3D,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,cAAc;QACvC,OAAO,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;QAC/B,SAAS,EAAE,KAAK;QAChB,oBAAoB,EAAE,CAAC;QACvB,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;KACjC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAqB,CAAC;QAC7C,MAAM,GAAG,GAAG,CAAC,KAAa,EAAa,EAAE;YACvC,IAAI,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC3B,IAAI,CAAC,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YACjF,OAAO,CAAC,CAAC;QACX,CAAC,CAAC;QAEF,yFAAyF;QACzF,4BAA4B;QAC5B,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;YAC7C,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,CAAC,CAAC;gBAAE,SAAS;YACjB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC;gBACpE,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;gBACjC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;gBAChC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;oBAC7D,MAAM,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;oBAChC,IAAI,CAAC,EAAE,IAAI,KAAK,MAAM;wBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC5C,CAAC;gBACD,CAAC,CAAC,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,uDAAuD;YACzD,CAAC;QACH,CAAC;QAED,0CAA0C;QAC1C,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,MAAM,EAAE,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC1C,MAAM,CAAC,GAAG,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;gBAClD,IAAI,CAAC;oBAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC;YACtC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,+DAA+D;QACjE,CAAC;QAED,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9E,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;0FAE0F;AAC1F,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAyD;IACzF,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,cAAc;QACvC,SAAS,EAAE,KAAK;QAChB,oBAAoB,EAAE,CAAC;QACvB,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;KACjC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACvC,sGAAsG;QACtG,qGAAqG;QACrG,+FAA+F;QAC/F,MAAM,OAAO,GAAG;YACd,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;YACtB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;YACpB,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;YACtB,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;YACvB,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;YACrB,MAAM,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YAClC,MAAM,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YACjC,MAAM,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YACjC,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YAC7B,MAAM,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YACpC,MAAM,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YAClC,MAAM,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;SAClC,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACvE,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;AACH,CAAC"}
+{"version":3,"file":"spaces.js","sourceRoot":"","sources":["../src/spaces.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,+FAA+F;AAC/F,2FAA2F;AAC3F,+FAA+F;AAC/F,wFAAwF;AAExF,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EACL,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EACtE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,EAAE,gBAAgB,EACzE,cAAc,EAAE,aAAa,EAC7B,cAAc,EACd,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE5C;;8FAE8F;AAC9F,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,OAAO;QACL,aAAa,EAAE,kBAAkB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClE,WAAW,EAAE,UAAU,WAAW,CAAC,KAAK,CAAC,EAAE;KAC5C,CAAC;AACJ,CAAC;AAgBD;;2EAE2E;AAC3E,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAA0B,EAAE;IAC3D,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,cAAc;QACvC,OAAO,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;QAC/B,SAAS,EAAE,KAAK;QAChB,oBAAoB,EAAE,CAAC;QACvB,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;KACjC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAqB,CAAC;QAC7C,MAAM,GAAG,GAAG,CAAC,KAAa,EAAa,EAAE;YACvC,IAAI,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC3B,IAAI,CAAC,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YACjF,OAAO,CAAC,CAAC;QACX,CAAC,CAAC;QAEF,yFAAyF;QACzF,4BAA4B;QAC5B,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;YAC7C,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,CAAC,CAAC;gBAAE,SAAS;YACjB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC;gBACpE,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;gBACjC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;gBAChC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;oBAC7D,MAAM,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;oBAChC,IAAI,CAAC,EAAE,IAAI,KAAK,MAAM;wBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC5C,CAAC;gBACD,CAAC,CAAC,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,uDAAuD;YACzD,CAAC;QACH,CAAC;QAED,0CAA0C;QAC1C,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,MAAM,EAAE,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC1C,MAAM,CAAC,GAAG,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;gBAClD,IAAI,CAAC;oBAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC;YACtC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,+DAA+D;QACjE,CAAC;QAED,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9E,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;0FAE0F;AAC1F,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAyD;IACzF,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,cAAc;QACvC,SAAS,EAAE,KAAK;QAChB,oBAAoB,EAAE,CAAC;QACvB,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;KACjC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACvC,sGAAsG;QACtG,qGAAqG;QACrG,+FAA+F;QAC/F,MAAM,OAAO,GAAG;YACd,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;YACtB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;YACpB,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;YACtB,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;YACvB,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;YACrB,MAAM,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YAClC,MAAM,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YACjC,MAAM,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YACjC,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YAC7B,MAAM,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YACpC,MAAM,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YAClC,MAAM,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YACjC,qFAAqF;YACrF,0FAA0F;YAC1F,2FAA2F;YAC3F,4FAA4F;YAC5F,iBAAiB,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC9C,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACvE,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/streams.d.ts

@@ -1,4 +1,5 @@
 import { type ConsumerConfig, type JetStreamManager } from "@nats-io/jetstream";
+import { type NatsConnection } from "@nats-io/transport-node";
 /** Per-(sender,channel)-subject retention cap on the chat stream — the bound past which the
  *  oldest message on a subject is discarded (`DiscardPolicy.Old`). Also the horizon of focus
  *  recall: only the last {@link MAX_MSGS_PER_SUBJECT} per sender-subject are recallable. */
@@ -34,6 +35,19 @@ export declare const MANAGER_LEASE_TTL_MS = 10000;
  *  far above any realistic readership while keeping the bucket from growing unbounded. A deliberate cap,
  *  not a guess at scale — the design is cap-safe by construction (per-agent, store-patterns-not-expanded). */
 export declare const MEMBERSHIP_MAX_BYTES: number;
+/** Bucket-level `max_bytes` cap on the per-space artifact Object Store (`cotal_artifacts_<space>`).
+ *
+ *  THIS NUMBER IS THE ONLY THING BOUNDING ARTIFACT STORAGE, so it is a decision rather than a
+ *  default. A fresh Object Store bucket ships `max_bytes: -1`, and the space account is provisioned
+ *  `disk_storage: -1`, so nothing above it says no: without this cap an artifact flood grows until
+ *  the disk does, starving the chat/DM/delivery streams that share it.
+ *
+ *  4 GiB is roughly sixteen artifacts at the 256 MiB per-artifact ceiling, which is generous for the
+ *  transfer use case (screenshots, reports, build outputs) and small enough that filling it is a
+ *  visible event rather than a silent disk exhaustion. `discard: new` on the bucket means hitting it
+ *  REFUSES the write rather than evicting older artifacts — the loud failure, not the silent one
+ *  where a reference published yesterday quietly stops resolving. */
+export declare const ARTIFACT_STORE_MAX_BYTES: number;
 export interface ClearSpaceHistoryResult {
     chat: number;
     dm?: number;
@@ -45,6 +59,24 @@ export interface StandaloneAuth {
     creds?: string;
     bearer?: string;
     sentinelCreds?: string;
+    /** Whether this connection must REQUIRE TLS rather than merely tolerate it.
+     *
+     *  REQUIRED, and it is the point of the field. This helper is the STANDALONE connect path, and it
+     *  was derived from the endpoint path's auth half without its transport half: `authOpts`,
+     *  `probeConnect` and `RawAuth` all carry a TLS requirement, and this one did not. Every caller
+     *  of it therefore built connect options that carried the credentials and dropped the thing that
+     *  protects them in transit.
+     *
+     *  Made required rather than optional because the omitted case is the dangerous one. A client
+     *  with no TLS requirement still connects to a TLS broker — it upgrades the same socket once it
+     *  reads `tls_required` in the server's unauthenticated INFO — so nothing looks wrong until an
+     *  on-path attacker forges an INFO without it and collects the credentials in the clear. An
+     *  optional field would leave the seam LOOKING transport-aware while callers kept omitting it.
+     *
+     *  Note the honest limit of the compile error: smoke files are outside the tsconfigs, so the type
+     *  forces every TYPECHECKED caller to state a transport, not every caller. That is why
+     *  `standaloneConnectOpts` also throws at runtime — see there. */
+    tls: boolean;
 }
 /** Connection options for a privileged STANDALONE helper (`setupSpaceStreams`, `clearSpaceHistory`,
  *  `clearChannel`, the channel-registry helpers): pin the reply inbox to the connection's own
@@ -56,7 +88,7 @@ export interface StandaloneAuth {
  *  sentinel creds land the connection in the callout account, the bearer rides `auth_token`, and a
  *  client-chosen inbox NONCE goes out as the connect `name` — the callout scopes `_INBOX_<nonce>.>`
  *  from it (the client cannot know its nkey pre-connect). Open mode (no auth) connects bare. */
-export declare function standaloneConnectOpts(auth?: StandaloneAuth): Record<string, unknown>;
+export declare function standaloneConnectOpts(auth: StandaloneAuth): Record<string, unknown>;
 /**
  * Create (idempotently) the five message streams for a space.
  *
@@ -124,6 +156,26 @@ export declare function fanoutDurableConfig(space: string, opts?: {
 }): Partial<ConsumerConfig>;
 /** Connect with the given (privileged) creds, create the space's streams, and disconnect.
  *  Used by `cotal up` to pre-create streams once at setup. */
+/**
+ * Create the space's artifact Object Store, or VERIFY an existing one — never silently adopt it.
+ *
+ * `Objm.create(bucket, { max_bytes })` is create-if-MISSING. Measured on nats-server 2.14.4 with
+ * `@nats-io/obj` 3.4.0: creating at `max_bytes: 1024`, then calling create again with `4096`, leaves
+ * the stream at **1024** — it neither updates the config nor refuses. A bare `create()` with no
+ * options does the same.
+ *
+ * That makes create-alone actively dangerous here, because {@link setupSpaceStreams} is idempotent
+ * and re-runs on every `cotal up`. A store that predates this cap, or that an operator widened by
+ * hand, would be adopted forever: the code would look like it enforces a 4 GiB ceiling while the
+ * broker enforced whatever was there first, and nothing would ever say so. The cap is the ONLY thing
+ * bounding artifact storage (account disk is provisioned unlimited), so an unenforced cap is not a
+ * smaller cap — it is no cap.
+ *
+ * So: create, then read the config back and refuse loudly on drift. Same create-or-verify discipline
+ * `ensureAuthorityStores` already uses, and the same reason: an idempotent setup path must either
+ * converge the resource or report that it cannot.
+ */
+export declare function ensureArtifactStore(nc: NatsConnection, space: string): Promise<void>;
 export declare function setupSpaceStreams(opts: {
     servers: string;
     space: string;

package/dist/streams.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"streams.d.ts","sourceRoot":"","sources":["../src/streams.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAC;AA4C5B;;4FAE4F;AAC5F,eAAO,MAAM,oBAAoB,OAA8B,CAAC;AAEhE;;;;;;;;;0GAS0G;AAC1G,eAAO,MAAM,sBAAsB,QAAgC,CAAC;AAEpE;oFACoF;AACpF,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAE3C;;;;;mHAKmH;AACnH,eAAO,MAAM,YAAY,QAAS,CAAC;AAEnC;;;oEAGoE;AACpE,eAAO,MAAM,oBAAoB,QAAS,CAAC;AAE3C;;;8GAG8G;AAC9G,eAAO,MAAM,oBAAoB,QAAmB,CAAC;AAErD,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED;;+CAE+C;AAC/C,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;gGASgG;AAChG,wBAAgB,qBAAqB,CAAC,IAAI,GAAE,cAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAkBxF;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAGf;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EACpB,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAO,GAC3F,OAAO,CAAC,cAAc,CAAC,CAsBzB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAChC,OAAO,CAAC,cAAc,CAAC,CAOzB;AAID;;;;uDAIuD;AACvD,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GACjE,OAAO,CAAC,cAAc,CAAC,CASzB;AAED;;;;kBAIkB;AAClB,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EACpB,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAAO,GAC9D,OAAO,CAAC,cAAc,CAAC,CAYzB;AAED;;yGAEyG;AACzG,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GACjE,OAAO,CAAC,cAAc,CAAC,CAQzB;AAED;8DAC8D;AAC9D,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,oGAAoG;IACpG,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmChB;AAED;kDACkD;AAClD,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gGAAgG;IAChG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAWnC;AAED;;;;;oFAKoF;AACpF,wBAAsB,YAAY,CAAC,IAAI,EAAE;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wGAAwG;IACxG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAmB/C;AAED;;;;;;;;;;;;;uGAauG;AACvG,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBhB"}
+{"version":3,"file":"streams.d.ts","sourceRoot":"","sources":["../src/streams.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAA0D,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AA8CtH;;4FAE4F;AAC5F,eAAO,MAAM,oBAAoB,OAA8B,CAAC;AAEhE;;;;;;;;;0GAS0G;AAC1G,eAAO,MAAM,sBAAsB,QAAgC,CAAC;AAEpE;oFACoF;AACpF,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAE3C;;;;;mHAKmH;AACnH,eAAO,MAAM,YAAY,QAAS,CAAC;AAEnC;;;oEAGoE;AACpE,eAAO,MAAM,oBAAoB,QAAS,CAAC;AAE3C;;;8GAG8G;AAC9G,eAAO,MAAM,oBAAoB,QAAmB,CAAC;AAErD;;;;;;;;;;;qEAWqE;AACrE,eAAO,MAAM,wBAAwB,QAAyB,CAAC;AAE/D,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED;;+CAE+C;AAC/C,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;;;;;;sEAgBkE;IAClE,GAAG,EAAE,OAAO,CAAC;CACd;AAED;;;;;;;;;gGASgG;AAChG,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAoCnF;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAGf;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EACpB,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAO,GAC3F,OAAO,CAAC,cAAc,CAAC,CAsBzB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAChC,OAAO,CAAC,cAAc,CAAC,CAOzB;AAID;;;;uDAIuD;AACvD,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GACjE,OAAO,CAAC,cAAc,CAAC,CASzB;AAED;;;;kBAIkB;AAClB,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EACpB,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAAO,GAC9D,OAAO,CAAC,cAAc,CAAC,CAYzB;AAED;;yGAEyG;AACzG,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GACjE,OAAO,CAAC,cAAc,CAAC,CAQzB;AAED;8DAC8D;AAC9D;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA4D1F;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,oGAAoG;IACpG,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4ChB;AAED;kDACkD;AAClD,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gGAAgG;IAChG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAWnC;AAED;;;;;oFAKoF;AACpF,wBAAsB,YAAY,CAAC,IAAI,EAAE;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wGAAwG;IACxG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAmB/C;AAED;;;;;;;;;;;;;uGAauG;AACvG,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBhB"}

package/dist/streams.js

@@ -1,9 +1,11 @@
-import { jetstreamManager, AckPolicy, DeliverPolicy, } from "@nats-io/jetstream";
+import { jetstream, jetstreamManager, AckPolicy, DeliverPolicy, } from "@nats-io/jetstream";
 import { randomUUID } from "node:crypto";
 import { connect, credsAuthenticator, tokenAuthenticator, nanos } from "@nats-io/transport-node";
 import { Kvm } from "@nats-io/kv";
-import { spacePrefix, chatStream, chatSubject, chatWildcard, isConcreteChannel, dmStream, dmDurable, unicastRecvFilter, taskStream, taskDurable, anycastServeFilter, presenceBucket, channelBucket, membersBucket, aclBucket, membershipBucket, deliveryBucket, managerBucket, inboxStream, dlvStream, dlvSubject, dlvDurable, fanoutDurable, readerDurable, DEV_OWNER, principalKey, deprovisionTargetPrincipal, } from "./subjects.js";
+import { Objm } from "@nats-io/obj";
+import { spacePrefix, artifactBucket, objectStoreStream, chatStream, chatSubject, chatWildcard, isConcreteChannel, dmStream, dmDurable, unicastRecvFilter, taskStream, taskDurable, anycastServeFilter, presenceBucket, channelBucket, membersBucket, aclBucket, membershipBucket, deliveryBucket, managerBucket, inboxStream, dlvStream, dlvSubject, dlvDurable, fanoutDurable, readerDurable, DEV_OWNER, principalKey, deprovisionTargetPrincipal, } from "./subjects.js";
 import { idFromCreds } from "./identity.js";
+import { ensureAuthorityStores } from "./endpoint-binding.js";
 import { openAclRegistry, deleteAcl } from "./acls.js";
 import { BACKUP_MAX_MSGS_PER_SUBJECT, BACKUP_PLANE3_DEDUP_WINDOW_MS, canonicalBackupStreamConfig, } from "./backup-config.js";
 /** Default presence-bucket entry TTL (ms) — matches the endpoint's default liveness window. */
@@ -43,6 +45,19 @@ export const MANAGER_LEASE_TTL_MS = 10_000;
  *  far above any realistic readership while keeping the bucket from growing unbounded. A deliberate cap,
  *  not a guess at scale — the design is cap-safe by construction (per-agent, store-patterns-not-expanded). */
 export const MEMBERSHIP_MAX_BYTES = 64 * 1024 * 1024;
+/** Bucket-level `max_bytes` cap on the per-space artifact Object Store (`cotal_artifacts_<space>`).
+ *
+ *  THIS NUMBER IS THE ONLY THING BOUNDING ARTIFACT STORAGE, so it is a decision rather than a
+ *  default. A fresh Object Store bucket ships `max_bytes: -1`, and the space account is provisioned
+ *  `disk_storage: -1`, so nothing above it says no: without this cap an artifact flood grows until
+ *  the disk does, starving the chat/DM/delivery streams that share it.
+ *
+ *  4 GiB is roughly sixteen artifacts at the 256 MiB per-artifact ceiling, which is generous for the
+ *  transfer use case (screenshots, reports, build outputs) and small enough that filling it is a
+ *  visible event rather than a silent disk exhaustion. `discard: new` on the bucket means hitting it
+ *  REFUSES the write rather than evicting older artifacts — the loud failure, not the silent one
+ *  where a reference published yesterday quietly stops resolving. */
+export const ARTIFACT_STORE_MAX_BYTES = 4 * 1024 * 1024 * 1024;
 /** Connection options for a privileged STANDALONE helper (`setupSpaceStreams`, `clearSpaceHistory`,
  *  `clearChannel`, the channel-registry helpers): pin the reply inbox to the connection's own
  *  identity. A scoped cred (provisioner/purger/operator) subscribes only `_INBOX_<id>.>`, so without
@@ -53,7 +68,21 @@ export const MEMBERSHIP_MAX_BYTES = 64 * 1024 * 1024;
  *  sentinel creds land the connection in the callout account, the bearer rides `auth_token`, and a
  *  client-chosen inbox NONCE goes out as the connect `name` — the callout scopes `_INBOX_<nonce>.>`
  *  from it (the client cannot know its nkey pre-connect). Open mode (no auth) connects bare. */
-export function standaloneConnectOpts(auth = {}) {
+export function standaloneConnectOpts(auth) {
+    // The `= {}` default is deliberately GONE. It was the omission hole: it let a caller build
+    // connect options without ever naming a transport, and the result silently connected non-strict.
+    //
+    // The throw exists because the type alone does not reach far enough. Smoke files sit outside the
+    // tsconfigs, so 16 of this seam's 28 call sites are never typechecked - the compile error covers
+    // every TYPECHECKED caller, not every caller. Without this guard those would keep passing no
+    // transport and degrade to non-strict in silence, which is precisely the defect being fixed.
+    // Positioned BEFORE the options are built and before any connect: a guard only fences what comes
+    // after it.
+    if (auth?.tls === undefined)
+        throw new Error("standaloneConnectOpts requires an explicit `tls` boolean: pass `tls: true` to REQUIRE TLS, " +
+            "or `tls: false` for a plaintext broker. It has no default, because defaulting it would " +
+            "silently connect without the requirement that protects the credentials being passed.");
+    const tlsOpt = auth.tls ? { tls: {} } : {};
     if (auth.bearer !== undefined) {
         if (!auth.sentinelCreds)
             throw new Error("user-mode standalone connect requires sentinelCreds alongside the bearer");
@@ -64,14 +93,16 @@ export function standaloneConnectOpts(auth = {}) {
             name: nonce,
             inboxPrefix: `_INBOX_${nonce}`,
             authenticator: [credsAuthenticator(new TextEncoder().encode(auth.sentinelCreds)), tokenAuthenticator(auth.bearer)],
+            ...tlsOpt,
         };
     }
     return auth.creds
         ? {
             authenticator: credsAuthenticator(new TextEncoder().encode(auth.creds)),
             inboxPrefix: `_INBOX_${idFromCreds(auth.creds)}`,
+            ...tlsOpt,
         }
-        : {};
+        : { ...tlsOpt };
 }
 /**
  * Create (idempotently) the five message streams for a space.
@@ -187,8 +218,95 @@ export function fanoutDurableConfig(space, opts = {}) {
 }
 /** Connect with the given (privileged) creds, create the space's streams, and disconnect.
  *  Used by `cotal up` to pre-create streams once at setup. */
+/**
+ * Create the space's artifact Object Store, or VERIFY an existing one — never silently adopt it.
+ *
+ * `Objm.create(bucket, { max_bytes })` is create-if-MISSING. Measured on nats-server 2.14.4 with
+ * `@nats-io/obj` 3.4.0: creating at `max_bytes: 1024`, then calling create again with `4096`, leaves
+ * the stream at **1024** — it neither updates the config nor refuses. A bare `create()` with no
+ * options does the same.
+ *
+ * That makes create-alone actively dangerous here, because {@link setupSpaceStreams} is idempotent
+ * and re-runs on every `cotal up`. A store that predates this cap, or that an operator widened by
+ * hand, would be adopted forever: the code would look like it enforces a 4 GiB ceiling while the
+ * broker enforced whatever was there first, and nothing would ever say so. The cap is the ONLY thing
+ * bounding artifact storage (account disk is provisioned unlimited), so an unenforced cap is not a
+ * smaller cap — it is no cap.
+ *
+ * So: create, then read the config back and refuse loudly on drift. Same create-or-verify discipline
+ * `ensureAuthorityStores` already uses, and the same reason: an idempotent setup path must either
+ * converge the resource or report that it cannot.
+ */
+export async function ensureArtifactStore(nc, space) {
+    const bucket = artifactBucket(space);
+    const stream = objectStoreStream(bucket);
+    await new Objm(jetstream(nc)).create(bucket, { max_bytes: ARTIFACT_STORE_MAX_BYTES });
+    const { config } = await (await jetstreamManager(nc)).streams.info(stream);
+    const drift = [];
+    // SUBJECTS FIRST, because they decide whether this is an object store AT ALL. A stream created
+    // under the right name with the right cap and the right discard, but bound to other subjects, is
+    // adopted by a cap-only check while artifact puts can never land - and setup reports success.
+    // (Measured: a stream named OBJ_<bucket> over `foreign.capture.>` survived setup untouched.)
+    const want = [`$O.${bucket}.C.>`, `$O.${bucket}.M.>`];
+    if (JSON.stringify(config.subjects ?? []) !== JSON.stringify(want))
+        drift.push(`subjects are ${JSON.stringify(config.subjects ?? [])}, expected ${JSON.stringify(want)}`);
+    // A MIRROR or SOURCE under this name makes the space's artifact store a view of someone else's
+    // stream. Nothing about the cap would look wrong; the bytes would simply not be the space's own.
+    if (config.mirror)
+        drift.push("it is a MIRROR of another stream");
+    if (config.sources?.length)
+        drift.push(`it SOURCES ${config.sources.length} other stream(s)`);
+    if (config.max_bytes !== ARTIFACT_STORE_MAX_BYTES)
+        drift.push(`max_bytes is ${config.max_bytes}, expected ${ARTIFACT_STORE_MAX_BYTES}`);
+    // `discard: new` is what makes a full store REFUSE a put instead of evicting a live artifact whose
+    // reference is already published. Drift here is silent data loss, not a capacity difference.
+    if (String(config.discard) !== "new")
+        drift.push(`discard is ${config.discard}, expected new`);
+    // File storage: memory-backed artifacts vanish on a broker restart while every published reference
+    // survives, which turns a restart into a wave of unresolvable references.
+    if (String(config.storage) !== "file")
+        drift.push(`storage is ${config.storage}, expected file`);
+    // Limits retention: any interest/work-queue retention DELETES messages once consumed, so a fetch
+    // would destroy the artifact it just read.
+    if (String(config.retention) !== "limits")
+        drift.push(`retention is ${config.retention}, expected limits`);
+    // Rollup headers: WRITE-CRITICAL, and measured rather than assumed. With `allow_rollup_hdrs:false`
+    // on an otherwise canonical store, `put` fails outright with "rollup not permitted" - the object
+    // store uses a rollup to replace an object's metadata. So a store drifted here accepts setup and
+    // then rejects every artifact, which is the worst shape: green provisioning, broken feature.
+    //
+    // `allow_direct` is deliberately NOT checked. Measured on the same probe: with it false, put and
+    // get both still succeed, because this client's info path uses STREAM.MSG.GET rather than
+    // DIRECT.GET. Asserting it would refuse a store that works.
+    if (config.allow_rollup_hdrs !== true)
+        drift.push("allow_rollup_hdrs is false, expected true (put fails without it)");
+    // max_age: SILENT DATA LOSS, measured. With max_age 1s on an otherwise canonical store, a put
+    // succeeds and the object is GONE 1.8s later (stream messages back to 0) - while every reference
+    // already published to a channel survives forever. That is the dangling-reference wave this design
+    // refuses everywhere else, arriving from a config field rather than from GC.
+    if (config.max_age !== 0)
+        drift.push(`max_age is ${config.max_age}, expected 0 (a non-zero age silently deletes stored artifacts)`);
+    // sealed: cheap to check, and the mechanism is NOT the one it is usually described by. Measured:
+    // the broker REFUSES to create a sealed stream at all ("stream configuration for create can not be
+    // sealed"), so a sealed store cannot arrive through the create path - only by a later update. That
+    // narrows it to a deliberate operator action, which is exactly the drift worth naming.
+    if (config.sealed === true)
+        drift.push("the stream is SEALED (writes permanently refused)");
+    // The message-count and size limits must stay unbounded, because THE CAP IS SUPPOSED TO BE THE
+    // OPERATIVE BOUND. Reproduced: max_msgs=2 accepts setup, the first 1-byte object succeeds (chunk +
+    // meta = 2 messages), and the second fails "maximum messages exceeded" with 4 GiB still free. A
+    // hidden limit that overrides the advertised capacity makes the number this code reports a lie -
+    // loud rather than silent, but still a bound nobody configured deliberately.
+    for (const [field, value] of [["max_msgs", config.max_msgs], ["max_msgs_per_subject", config.max_msgs_per_subject],
+        ["max_msg_size", config.max_msg_size]])
+        if (value !== -1)
+            drift.push(`${field} is ${value}, expected -1 (max_bytes is the only bound this store advertises)`);
+    if (drift.length)
+        throw new Error(`artifact store ${stream} has drifted: ${drift.join("; ")} - refusing to adopt a store whose ` +
+            `bounds are not the ones this space enforces (delete it, or reconcile it deliberately)`);
+}
 export async function setupSpaceStreams(opts) {
-    const nc = await connect({ servers: opts.servers, ...standaloneConnectOpts({ creds: opts.creds }) });
+    const nc = await connect({ servers: opts.servers, ...standaloneConnectOpts({ creds: opts.creds, /* not yet wired to a recorded transport - see broker-policy/MeshEntry work */ tls: false }) });
     try {
         const jsm = await jetstreamManager(nc);
         await createSpaceStreams(jsm, opts.space);
@@ -219,6 +337,15 @@ export async function setupSpaceStreams(opts) {
         // Config matches `managerLeaseRegistry()`'s create-first exactly, so that path stays idempotent until
         // the supervisor profile drops bucket-create. Idempotent.
         await kvm.create(managerBucket(opts.space), { ttl: MANAGER_LEASE_TTL_MS });
+        // The two §13.12 AUTHORITY stores (records + auth): every auth-mode mesh now carries a
+        // lifecycle registry — user mode's service re-ensures at its own boot, the STATIC manager's
+        // start reconcile re-ensures for pre-existing spaces (Unit B) — and the up-time seed creates
+        // them so neither daemon needs first-write stream creation. Create-or-verify, idempotent,
+        // drift fails loud.
+        await ensureAuthorityStores(jsm, kvm, opts.space);
+        // Artifact Object Store (SPEC section 5): the bytes an `artifact` reference part points at.
+        // Create-or-VERIFY, drift fails loud - see ensureArtifactStore for why create alone is not enough.
+        await ensureArtifactStore(nc, opts.space);
     }
     finally {
         await nc.drain();
@@ -227,7 +354,7 @@ export async function setupSpaceStreams(opts) {
 /** Purge retained message history for a running space. This intentionally leaves TASK alone:
  *  anycast is queued work, not replay history. */
 export async function clearSpaceHistory(opts) {
-    const nc = await connect({ servers: opts.servers, ...standaloneConnectOpts(opts) });
+    const nc = await connect({ servers: opts.servers, ...standaloneConnectOpts({ ...opts, /* not yet wired to a recorded transport - see broker-policy/MeshEntry work */ tls: false }) });
     try {
         const jsm = await jetstreamManager(nc);
         const chat = (await jsm.streams.purge(chatStream(opts.space))).purged;
@@ -249,7 +376,7 @@ export async function clearSpaceHistory(opts) {
 export async function clearChannel(opts) {
     if (!isConcreteChannel(opts.channel))
         throw new Error(`"${opts.channel}" is a wildcard, not a deletable channel`);
-    const nc = await connect({ servers: opts.servers, ...standaloneConnectOpts(opts) });
+    const nc = await connect({ servers: opts.servers, ...standaloneConnectOpts({ ...opts, /* not yet wired to a recorded transport - see broker-policy/MeshEntry work */ tls: false }) });
     try {
         const jsm = await jetstreamManager(nc);
         const { purged } = await jsm.streams.purge(chatStream(opts.space), {
@@ -285,7 +412,7 @@ export async function clearChannel(opts) {
 export async function deprovisionAgent(opts) {
     const nc = await connect({
         servers: opts.servers,
-        ...standaloneConnectOpts({ creds: opts.creds }),
+        ...standaloneConnectOpts({ creds: opts.creds, /* not yet wired to a recorded transport - see broker-policy/MeshEntry work */ tls: false }),
         // This is a detached, fire-and-forget teardown — it must FAIL FAST, never hang, so the caller's
         // fail-loud `.catch` is load-bearing: no reconnect loop (a wedged broker rejects promptly instead of
         // looping silently) and a bounded initial connect. Without this a broker-down deprovision would sit