@cotal-ai/core 0.90.1 → 0.92.0

package/dist/sealed-reply.js

@@ -0,0 +1,75 @@
+/**
+ * One-time sealing of a reply to its caller. The caller mints a {@link SealRecipient}, sends only
+ * its public `X…` curve key, and keeps the private half in memory. The replier calls
+ * {@link sealJson}, which seals under a fresh one-time sender key and clears that key before it
+ * returns, and sends the sender's public key beside the sealed bytes. Only the recipient opens
+ * them.
+ *
+ * The cryptography is `@nats-io/nkeys` curve keys, unchanged: NaCl box (X25519 and
+ * XSalsa20-Poly1305) framed as `xkv1`, a random 24-byte nonce, then the box. That is the xkey format
+ * NATS uses to seal auth-callout responses. A sealed reply is confidential to its recipient. It
+ * does not identify the replier, because the sender key is one-time, so the rail that carried the
+ * reply stays the trust anchor and the opener checks every field it expects inside.
+ */
+import { createCurve, fromPublic } from "@nats-io/nkeys";
+import { base64url, fromBase64url } from "./base64url.js";
+/** Whether `key` is an encoded curve public key: `X`, 55 more base32 characters and a valid
+ *  checksum. */
+export function isCurvePublicKey(key) {
+    if (!/^X[A-Z2-7]{55}$/.test(key))
+        return false;
+    try {
+        fromPublic(key);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Seal `value`, as JSON, to the curve key `recipient` under a one-time sender key. `sealed` is
+ *  base64url. Throws for a recipient that is not a curve public key. */
+export function sealJson(value, recipient) {
+    if (!isCurvePublicKey(recipient))
+        throw new Error("the seal recipient is not a curve public key");
+    const sender = createCurve();
+    try {
+        const sealed = sender.seal(new TextEncoder().encode(JSON.stringify(value)), recipient);
+        return { sealer: sender.getPublicKey(), sealed: base64url(sealed) };
+    }
+    finally {
+        sender.clear();
+    }
+}
+/** A one-time curve key for receiving one sealed reply. It opens at most once and is cleared
+ *  then, or by {@link SealRecipient.clear}. */
+export class SealRecipient {
+    publicKey;
+    key;
+    constructor() {
+        this.key = createCurve();
+        this.publicKey = this.key.getPublicKey();
+    }
+    /** The JSON value `sealer` sealed to this key, or undefined when the bytes do not open or are
+     *  not JSON, or this key was already used or cleared. */
+    openJson(sealed, sealer) {
+        const key = this.key;
+        this.key = undefined;
+        if (!key)
+            return undefined;
+        try {
+            const opened = key.open(fromBase64url(sealed), sealer);
+            return opened ? JSON.parse(new TextDecoder().decode(opened)) : undefined;
+        }
+        catch {
+            return undefined;
+        }
+        finally {
+            key.clear();
+        }
+    }
+    clear() {
+        this.key?.clear();
+        this.key = undefined;
+    }
+}
+//# sourceMappingURL=sealed-reply.js.map

package/dist/sealed-reply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sealed-reply.js","sourceRoot":"","sources":["../src/sealed-reply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAgB,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE1D;gBACgB;AAChB,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,CAAC;QACH,UAAU,CAAC,GAAG,CAAC,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;wEACwE;AACxE,MAAM,UAAU,QAAQ,CAAC,KAAc,EAAE,SAAiB;IACxD,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClG,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACvF,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;IACtE,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC;AACH,CAAC;AAED;+CAC+C;AAC/C,MAAM,OAAO,aAAa;IACf,SAAS,CAAS;IACnB,GAAG,CAAsB;IAEjC;QACE,IAAI,CAAC,GAAG,GAAG,WAAW,EAAE,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;IAC3C,CAAC;IAED;6DACyD;IACzD,QAAQ,CAAC,MAAc,EAAE,MAAc;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACrB,IAAI,CAAC,GAAG,GAAG,SAAS,CAAC;QACrB,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;YACvD,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;gBAAS,CAAC;YACT,GAAG,CAAC,KAAK,EAAE,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK;QACH,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC;QAClB,IAAI,CAAC,GAAG,GAAG,SAAS,CAAC;IACvB,CAAC;CACF"}

package/dist/secret-fs.d.ts

@@ -1,7 +1,10 @@
 /**
  * Lock a file or directory down to the current user (+ SYSTEM + Administrators) only.
  *
- * POSIX: `chmod` (0o600 file / 0o700 dir), which also tightens a path that already existed.
+ * POSIX: a file takes {@link openPrivate}'s rule, so a symlink, a non-regular file or another user's
+ * file is refused with `EPERM` and left unchanged, and an owned file is set to 0o600 through the
+ * descriptor. A directory is set to 0o700 with `chmod` by path, which follows a symlinked directory:
+ * a symlinked `~/.cotal` or project `.cotal` is a working setup, so it is not refused.
  * win32: harden the NTFS ACL with `icacls`: `/inheritance:r` drops inherited ACEs; `/remove:g` drops
  * any pre-existing EXPLICIT broad grant (Everyone / Authenticated Users / Users) that `/grant:r`
  * alone would leave intact (e.g. on a pre-planted or pre-existing target); `/grant:r` then sets ONLY
@@ -13,12 +16,32 @@
  */
 export declare function hardenPrivate(path: string, kind: "file" | "dir"): void;
 /**
- * Write a private secret file: mode 0o600 on the descriptor before the bytes, whether or not the
- * name already existed, then {@link hardenPrivate} for the win32 ACL. FAIL-CLOSED — if hardening
- * throws, the hardening error propagates (the caller never proceeds as if the secret were safe) and
- * the just-written file is best-effort deleted so it isn't left readable.
+ * Open a private log for appending under {@link openPrivate}'s rule: created 0o600, never through a
+ * final symlink, refused unless it is this user's regular file, and an owned log set to 0o600. The
+ * caller owns the returned descriptor.
+ */
+export declare function openPrivateAppend(path: string): number;
+/**
+ * Write a private secret file through {@link openPrivate}: mode 0o600 on the descriptor before the
+ * bytes, whether or not the name already existed, and on POSIX a refusal for a final symlink, a
+ * non-regular file or a file another user owns. Then {@link hardenPrivate} for the win32 ACL.
+ * FAIL-CLOSED — if hardening throws, the hardening error propagates (the caller never proceeds as if
+ * the secret were safe) and the just-written file is best-effort deleted so it isn't left readable.
  */
 export declare function writeSecretFile(path: string, data: string | Buffer): void;
+/**
+ * Write an owner-private record in place under {@link openPrivate}'s rule, without the win32 ACL
+ * step {@link writeSecretFile} adds: for a record that is not a secret, such as a pid identity pin
+ * or a process marker. On POSIX a symlink, a non-regular file or a file another user owns is refused
+ * with `EPERM` and left unchanged.
+ */
+export declare function writePrivateRecord(path: string, data: string | Buffer): void;
+/**
+ * Create an owner-private record that must not exist yet, under {@link openPrivate}'s rule with
+ * `O_EXCL` and without the win32 ACL step: for a temporary that a rename then publishes. On POSIX any
+ * existing name, a symlink included, fails with `EEXIST` and is left as it was.
+ */
+export declare function createPrivateRecord(path: string, data: string | Buffer): void;
 /**
  * Like {@link writeSecretFile} but ATOMIC: write a private temp sibling (same 0o600 + win32-ACL
  * hardening), then rename it over the target. `renameSync` is an atomic replace on POSIX and via
@@ -51,7 +74,7 @@ export declare function __setPublishLinkForTest(fn: ((from: string, to: string)
  * two creators that collided on the name would plain-overwrite each other's bytes, and then the
  * one whose `link` succeeded would return the candidate IT minted while the published file held
  * the OTHER one's identity: the exact split this function exists to prevent, reintroduced one
- * step earlier. `wx` on the temp makes a collision fail loudly instead of silently swapping bytes.
+ * step earlier. `O_EXCL` on the temp makes a collision fail loudly instead of silently swapping bytes.
  */
 export declare function writeSecretFileCreateOnly(path: string, data: string | Buffer): void;
 /** Create a private directory chain (recursive) and harden it — call BEFORE writing secrets into it

package/dist/secret-fs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-fs.d.ts","sourceRoot":"","sources":["../src/secret-fs.ts"],"names":[],"mappings":"AAkDA;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,IAAI,CA2BtE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAEzE;AA0BD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAa/E;AAiDD;wEACwE;AACxE,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,GAAG,IAAI,CAElG;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgCnF;AAED;;2EAE2E;AAC3E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAG9C"}
+{"version":3,"file":"secret-fs.d.ts","sourceRoot":"","sources":["../src/secret-fs.ts"],"names":[],"mappings":"AAqDA;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,IAAI,CA4BtE;AAkDD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAEzE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE5E;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAE7E;AA+BD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAa/E;AAiDD;wEACwE;AACxE,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,GAAG,IAAI,CAElG;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiCnF;AAED;;2EAE2E;AAC3E,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAG9C"}

package/dist/secret-fs.js

@@ -8,9 +8,9 @@
  * path). The fix is to harden the NTFS ACL explicitly with the built-in `icacls` (no new
  * dependency). See {@link hardenPrivate}.
  */
-import { chmodSync, closeSync, fchmodSync, linkSync, lstatSync, mkdirSync, openSync, renameSync, unlinkSync, writeFileSync, } from "node:fs";
+import { chmodSync, closeSync, constants, fchmodSync, fstatSync, ftruncateSync, linkSync, lstatSync, mkdirSync, openSync, renameSync, unlinkSync, writeFileSync, } from "node:fs";
 import { execFileSync } from "node:child_process";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 const isWin = process.platform === "win32";
 /** Absolute path to a System32 tool — `icacls`/`whoami` are resolved from `%SystemRoot%` (not PATH)
  *  so a hijacked PATH can't substitute a malicious binary during the secret-hardening window. */
@@ -36,7 +36,10 @@ const BROAD_SIDS = ["S-1-1-0", "S-1-5-11", "S-1-5-32-545"];
 /**
  * Lock a file or directory down to the current user (+ SYSTEM + Administrators) only.
  *
- * POSIX: `chmod` (0o600 file / 0o700 dir), which also tightens a path that already existed.
+ * POSIX: a file takes {@link openPrivate}'s rule, so a symlink, a non-regular file or another user's
+ * file is refused with `EPERM` and left unchanged, and an owned file is set to 0o600 through the
+ * descriptor. A directory is set to 0o700 with `chmod` by path, which follows a symlinked directory:
+ * a symlinked `~/.cotal` or project `.cotal` is a working setup, so it is not refused.
  * win32: harden the NTFS ACL with `icacls`: `/inheritance:r` drops inherited ACEs; `/remove:g` drops
  * any pre-existing EXPLICIT broad grant (Everyone / Authenticated Users / Users) that `/grant:r`
  * alone would leave intact (e.g. on a pre-planted or pre-existing target); `/grant:r` then sets ONLY
@@ -48,7 +51,10 @@ const BROAD_SIDS = ["S-1-1-0", "S-1-5-11", "S-1-5-32-545"];
  */
 export function hardenPrivate(path, kind) {
     if (!isWin) {
-        chmodSync(path, kind === "dir" ? 0o700 : 0o600);
+        if (kind === "file")
+            closeSync(openPrivate(path, constants.O_RDONLY));
+        else
+            chmodSync(path, 0o700);
         return;
     }
     const perm = kind === "dir" ? "(OI)(CI)(F)" : "(F)";
@@ -69,27 +75,109 @@ export function hardenPrivate(path, kind) {
             `Cotal will not leave a secret with a permissive ACL - ensure the path is on an NTFS volume and %SystemRoot%\\System32\\icacls.exe is available.`);
     }
 }
+/** A refused private open. The name was left as it was. */
+function notPrivate(path, why) {
+    const refused = new Error(`refusing to write "${path}": it ${why}; it was left unchanged`);
+    refused.code = "EPERM";
+    return refused;
+}
+/**
+ * Open `path` for writing as this user's private file, mode 0o600 when the open creates it.
+ *
+ * POSIX: the open never follows a final symlink (`O_NOFOLLOW`) and never waits on a FIFO
+ * (`O_NONBLOCK`). The opened inode must be a regular file this user owns; anything else is refused
+ * with code `EPERM` and left unchanged. An owned file is then set to 0o600 through the descriptor,
+ * which names no path, so a name swapped after the open cannot redirect the change.
+ *
+ * win32: POSIX owners, modes and `O_NOFOLLOW` are not that platform's protection model; its boundary
+ * is the NTFS ACL (see {@link hardenPrivate}). So the open there takes mode 0o600 with no owner check.
+ */
+function openPrivate(path, flags) {
+    if (isWin) {
+        const fd = openSync(path, flags, 0o600);
+        try {
+            fchmodSync(fd, 0o600);
+        }
+        catch (e) {
+            closeSync(fd);
+            throw e;
+        }
+        return fd;
+    }
+    let fd;
+    try {
+        fd = openSync(path, flags | constants.O_NOFOLLOW | constants.O_NONBLOCK, 0o600);
+    }
+    catch (e) {
+        if (e.code === "ELOOP")
+            throw notPrivate(path, "is a symlink");
+        throw e;
+    }
+    try {
+        const info = fstatSync(fd);
+        if (!info.isFile())
+            throw notPrivate(path, "is not a regular file");
+        if (info.uid !== process.getuid())
+            throw notPrivate(path, `is owned by uid ${info.uid}, not this user`);
+        fchmodSync(fd, 0o600);
+        return fd;
+    }
+    catch (e) {
+        closeSync(fd);
+        throw e;
+    }
+}
+/**
+ * Open a private log for appending under {@link openPrivate}'s rule: created 0o600, never through a
+ * final symlink, refused unless it is this user's regular file, and an owned log set to 0o600. The
+ * caller owns the returned descriptor.
+ */
+export function openPrivateAppend(path) {
+    return openPrivate(path, constants.O_WRONLY | constants.O_CREAT | constants.O_APPEND);
+}
 /**
- * Write a private secret file: mode 0o600 on the descriptor before the bytes, whether or not the
- * name already existed, then {@link hardenPrivate} for the win32 ACL. FAIL-CLOSED — if hardening
- * throws, the hardening error propagates (the caller never proceeds as if the secret were safe) and
- * the just-written file is best-effort deleted so it isn't left readable.
+ * Write a private secret file through {@link openPrivate}: mode 0o600 on the descriptor before the
+ * bytes, whether or not the name already existed, and on POSIX a refusal for a final symlink, a
+ * non-regular file or a file another user owns. Then {@link hardenPrivate} for the win32 ACL.
+ * FAIL-CLOSED — if hardening throws, the hardening error propagates (the caller never proceeds as if
+ * the secret were safe) and the just-written file is best-effort deleted so it isn't left readable.
  */
 export function writeSecretFile(path, data) {
-    writePrivate(path, data, "w");
+    writePrivate(path, data, false);
 }
-/** The fail-closed write {@link writeSecretFile} documents, with the open flag as a parameter so
- *  {@link writeSecretFileCreateOnlyRaw} can pass `wx`. */
-function writePrivate(path, data, flag) {
-    const fd = openSync(path, flag, 0o600);
+/**
+ * Write an owner-private record in place under {@link openPrivate}'s rule, without the win32 ACL
+ * step {@link writeSecretFile} adds: for a record that is not a secret, such as a pid identity pin
+ * or a process marker. On POSIX a symlink, a non-regular file or a file another user owns is refused
+ * with `EPERM` and left unchanged.
+ */
+export function writePrivateRecord(path, data) {
+    writeBytes(path, data, false);
+}
+/**
+ * Create an owner-private record that must not exist yet, under {@link openPrivate}'s rule with
+ * `O_EXCL` and without the win32 ACL step: for a temporary that a rename then publishes. On POSIX any
+ * existing name, a symlink included, fails with `EEXIST` and is left as it was.
+ */
+export function createPrivateRecord(path, data) {
+    writeBytes(path, data, true);
+}
+/** {@link openPrivate}, then truncate and write the bytes; the descriptor is closed on every path. */
+function writeBytes(path, data, exclusive) {
+    // No O_TRUNC: a name openPrivate refuses keeps its bytes, so truncation waits until it passed.
+    const fd = openPrivate(path, constants.O_WRONLY | constants.O_CREAT | (exclusive ? constants.O_EXCL : 0));
     try {
-        // The open mode applies only when the open creates the file; an existing one keeps its own.
-        fchmodSync(fd, 0o600);
+        ftruncateSync(fd);
         writeFileSync(fd, data);
     }
     finally {
         closeSync(fd);
     }
+}
+/** The fail-closed write {@link writeSecretFile} documents, with exclusive create as a parameter so
+ *  {@link writeSecretFileCreateOnlyRaw} can ask for `O_EXCL`. */
+function writePrivate(path, data, exclusive) {
+    writeBytes(path, data, exclusive);
     if (!isWin)
         return;
     try {
@@ -167,7 +255,7 @@ function writeSecretFileCreateOnlyRaw(path, data) {
             throw taken;
         }
     }
-    writePrivate(path, data, "wx");
+    writePrivate(path, data, true);
 }
 /**
  * Publish a completed temp inode at its final name. Separated from {@link writeSecretFileCreateOnly}
@@ -201,10 +289,11 @@ export function __setPublishLinkForTest(fn) {
  * two creators that collided on the name would plain-overwrite each other's bytes, and then the
  * one whose `link` succeeded would return the candidate IT minted while the published file held
  * the OTHER one's identity: the exact split this function exists to prevent, reintroduced one
- * step earlier. `wx` on the temp makes a collision fail loudly instead of silently swapping bytes.
+ * step earlier. `O_EXCL` on the temp makes a collision fail loudly instead of silently swapping bytes.
  */
 export function writeSecretFileCreateOnly(path, data) {
-    const tmp = `${path}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
+    // Keep the sibling name independent of the destination, which may already fill NAME_MAX.
+    const tmp = join(dirname(path), `.cotal-create.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`);
     // Exclusive, so EEXIST here means the temp name belongs to ANOTHER creator. Cleanup below must
     // never run in that case: unlinking it would delete a live creator's bytes out from under it.
     writeSecretFileCreateOnlyRaw(tmp, data);

package/dist/secret-fs.js.map

@@ -1 +1 @@
-{"version":3,"file":"secret-fs.js","sourceRoot":"","sources":["../src/secret-fs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,SAAS,EACT,SAAS,EACT,UAAU,EACV,QAAQ,EACR,SAAS,EACT,SAAS,EACT,QAAQ,EACR,UAAU,EACV,UAAU,EACV,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;AAE3C;iGACiG;AACjG,SAAS,KAAK,CAAC,GAAW;IACxB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,aAAa,CAAC;IAC3E,OAAO,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;AACrC,CAAC;AAED;2FAC2F;AAC3F,IAAI,SAA6B,CAAC;AAClC,SAAS,QAAQ;IACf,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACpG,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtE,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,oEAAoE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrG,SAAS,GAAG,GAAG,CAAC;IAChB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,cAAc,CAAU,CAAC;AAEpE;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,IAAoB;IAC9D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,SAAS,CAAC,IAAI,EAAE,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAChD,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC;IACpD,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,CAAC,GAAW,EAAY,EAAE,CAAC,CAAC,UAAU,EAAE,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC;IACzE,IAAI,CAAC;QACH,YAAY,CACV,KAAK,CAAC,YAAY,CAAC,EACnB;YACE,IAAI;YACJ,gBAAgB;YAChB,GAAG,WAAW;YACd,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;YACpB,GAAG,KAAK,CAAC,UAAU,CAAC;YACpB,GAAG,KAAK,CAAC,cAAc,CAAC;SACzB,EACD,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CACxC,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,oBAAoB,IAAI,KAAK,IAAI,4BAA6B,CAAW,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI;YAC1F,iJAAiJ,CACpJ,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,IAAqB;IACjE,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AAChC,CAAC;AAED;0DAC0D;AAC1D,SAAS,YAAY,CAAC,IAAY,EAAE,IAAqB,EAAE,IAAgB;IACzE,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,4FAA4F;QAC5F,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACtB,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAC1B,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,IAAI,CAAC;QACH,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,yEAAyE;QAC7F,CAAC;QAAC,MAAM,CAAC;YACP,kFAAkF;QACpF,CAAC;QACD,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,IAAqB;IACvE,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;IACvD,IAAI,CAAC;QACH,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,2EAA2E;QACvG,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC;YACH,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,iDAAiD;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,sDAAsD;QACxD,CAAC;QACD,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,4BAA4B,CAAC,IAAY,EAAE,IAAqB;IACvE,iEAAiE;IACjE,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC;YACH,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,wEAAwE;QAC3F,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,CAAC,CAAC;YAC5D,MAAM,GAAG,KAAK,CAAC;QACjB,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,KAAK,GAA0B,IAAI,KAAK,CAAC,sCAAsC,IAAI,GAAG,CAAC,CAAC;YAC9F,KAAK,CAAC,IAAI,GAAG,QAAQ,CAAC;YACtB,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IACD,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,IAAI,WAAW,GAAuC,QAAQ,CAAC;AAE/D;wEACwE;AACxE,MAAM,UAAU,uBAAuB,CAAC,EAAoD;IAC1F,WAAW,GAAG,EAAE,IAAI,QAAQ,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAY,EAAE,IAAqB;IAC3E,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IAC9F,+FAA+F;IAC/F,8FAA8F;IAC9F,4BAA4B,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,IAAI,CAAC;YACH,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,GAAI,CAA2B,CAAC,IAAI,CAAC;YAC/C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAChE,MAAM,GAAG,GAA0B,IAAI,KAAK,CAC1C,8CAA8C,IAAI,uCAAuC,IAAI,GAAG,CACjG,CAAC;gBACF,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;gBAChB,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC;YACH,UAAU,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,yDAAyD;QAC3D,CAAC;QACD,MAAM,CAAC,CAAC;IACV,CAAC;IACD,IAAI,CAAC;QACH,UAAU,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;IACxE,CAAC;AACH,CAAC;AAED;;2EAE2E;AAC3E,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC7B,CAAC"}
+{"version":3,"file":"secret-fs.js","sourceRoot":"","sources":["../src/secret-fs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,SAAS,EACT,SAAS,EACT,SAAS,EACT,UAAU,EACV,SAAS,EACT,aAAa,EACb,QAAQ,EACR,SAAS,EACT,SAAS,EACT,QAAQ,EACR,UAAU,EACV,UAAU,EACV,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;AAE3C;iGACiG;AACjG,SAAS,KAAK,CAAC,GAAW;IACxB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,aAAa,CAAC;IAC3E,OAAO,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;AACrC,CAAC;AAED;2FAC2F;AAC3F,IAAI,SAA6B,CAAC;AAClC,SAAS,QAAQ;IACf,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACpG,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtE,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,oEAAoE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrG,SAAS,GAAG,GAAG,CAAC;IAChB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,cAAc,CAAU,CAAC;AAEpE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,IAAoB;IAC9D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAI,IAAI,KAAK,MAAM;YAAE,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;;YACjE,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC5B,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC;IACpD,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,CAAC,GAAW,EAAY,EAAE,CAAC,CAAC,UAAU,EAAE,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC;IACzE,IAAI,CAAC;QACH,YAAY,CACV,KAAK,CAAC,YAAY,CAAC,EACnB;YACE,IAAI;YACJ,gBAAgB;YAChB,GAAG,WAAW;YACd,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;YACpB,GAAG,KAAK,CAAC,UAAU,CAAC;YACpB,GAAG,KAAK,CAAC,cAAc,CAAC;SACzB,EACD,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CACxC,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,oBAAoB,IAAI,KAAK,IAAI,4BAA6B,CAAW,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI;YAC1F,iJAAiJ,CACpJ,CAAC;IACJ,CAAC;AACH,CAAC;AAED,2DAA2D;AAC3D,SAAS,UAAU,CAAC,IAAY,EAAE,GAAW;IAC3C,MAAM,OAAO,GAA0B,IAAI,KAAK,CAAC,sBAAsB,IAAI,SAAS,GAAG,yBAAyB,CAAC,CAAC;IAClH,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC;IACvB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,WAAW,CAAC,IAAY,EAAE,KAAa;IAC9C,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC;YACH,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,SAAS,CAAC,EAAE,CAAC,CAAC;YACd,MAAM,CAAC,CAAC;QACV,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAClF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAK,CAA2B,CAAC,IAAI,KAAK,OAAO;YAAE,MAAM,UAAU,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAC1F,MAAM,CAAC,CAAC;IACV,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,MAAM,UAAU,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;QACpE,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,MAAO,EAAE;YAAE,MAAM,UAAU,CAAC,IAAI,EAAE,mBAAmB,IAAI,CAAC,GAAG,iBAAiB,CAAC,CAAC;QACzG,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACtB,OAAO,EAAE,CAAC;IACZ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,SAAS,CAAC,EAAE,CAAC,CAAC;QACd,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,IAAqB;IACjE,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;AAClC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,IAAqB;IACpE,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,IAAqB;IACrE,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,sGAAsG;AACtG,SAAS,UAAU,CAAC,IAAY,EAAE,IAAqB,EAAE,SAAkB;IACzE,+FAA+F;IAC/F,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1G,IAAI,CAAC;QACH,aAAa,CAAC,EAAE,CAAC,CAAC;QAClB,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAC1B,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED;iEACiE;AACjE,SAAS,YAAY,CAAC,IAAY,EAAE,IAAqB,EAAE,SAAkB;IAC3E,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,IAAI,CAAC;QACH,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,yEAAyE;QAC7F,CAAC;QAAC,MAAM,CAAC;YACP,kFAAkF;QACpF,CAAC;QACD,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,IAAqB;IACvE,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;IACvD,IAAI,CAAC;QACH,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,2EAA2E;QACvG,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC;YACH,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,iDAAiD;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,sDAAsD;QACxD,CAAC;QACD,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,4BAA4B,CAAC,IAAY,EAAE,IAAqB;IACvE,iEAAiE;IACjE,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC;YACH,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,wEAAwE;QAC3F,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,CAAC,CAAC;YAC5D,MAAM,GAAG,KAAK,CAAC;QACjB,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,KAAK,GAA0B,IAAI,KAAK,CAAC,sCAAsC,IAAI,GAAG,CAAC,CAAC;YAC9F,KAAK,CAAC,IAAI,GAAG,QAAQ,CAAC;YACtB,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IACD,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,IAAI,WAAW,GAAuC,QAAQ,CAAC;AAE/D;wEACwE;AACxE,MAAM,UAAU,uBAAuB,CAAC,EAAoD;IAC1F,WAAW,GAAG,EAAE,IAAI,QAAQ,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAY,EAAE,IAAqB;IAC3E,yFAAyF;IACzF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,iBAAiB,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACzH,+FAA+F;IAC/F,8FAA8F;IAC9F,4BAA4B,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,IAAI,CAAC;YACH,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,GAAI,CAA2B,CAAC,IAAI,CAAC;YAC/C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAChE,MAAM,GAAG,GAA0B,IAAI,KAAK,CAC1C,8CAA8C,IAAI,uCAAuC,IAAI,GAAG,CACjG,CAAC;gBACF,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;gBAChB,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC;YACH,UAAU,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,yDAAyD;QAC3D,CAAC;QACD,MAAM,CAAC,CAAC;IACV,CAAC;IACD,IAAI,CAAC;QACH,UAAU,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;IACxE,CAAC;AACH,CAAC;AAED;;2EAE2E;AAC3E,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC7B,CAAC"}

package/dist/space-deletion-targets.d.ts

@@ -0,0 +1,4 @@
+/** Native streams belonging to one space, including the backing streams of its KV and object buckets.
+ * A transfer stream is included only when its exact name was observed on this broker. */
+export declare function spaceDeletionStreams(space: string, observedNames?: readonly string[]): string[];
+//# sourceMappingURL=space-deletion-targets.d.ts.map

package/dist/space-deletion-targets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"space-deletion-targets.d.ts","sourceRoot":"","sources":["../src/space-deletion-targets.ts"],"names":[],"mappings":"AAOA;yFACyF;AACzF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,GAAE,SAAS,MAAM,EAAO,GAAG,MAAM,EAAE,CASnG"}

package/dist/space-deletion-targets.js

@@ -0,0 +1,15 @@
+import { aclBucket, artifactBucket, channelBucket, chatStream, deliveryBucket, dlvStream, dmStream, inboxStream, isTransferStream, managerBucket, membershipBucket, membersBucket, objectStoreStream, presenceBucket, taskStream, } from "./subjects.js";
+import { endpointPlaneStreamNames } from "./endpoint-binding.js";
+/** Native streams belonging to one space, including the backing streams of its KV and object buckets.
+ * A transfer stream is included only when its exact name was observed on this broker. */
+export function spaceDeletionStreams(space, observedNames = []) {
+    const base = [
+        chatStream(space), dmStream(space), taskStream(space), inboxStream(space), dlvStream(space),
+        `KV_${presenceBucket(space)}`, `KV_${channelBucket(space)}`, `KV_${membersBucket(space)}`,
+        `KV_${aclBucket(space)}`, `KV_${membershipBucket(space)}`,
+        `KV_${deliveryBucket(space)}`, `KV_${managerBucket(space)}`,
+        ...endpointPlaneStreamNames(space), objectStoreStream(artifactBucket(space)),
+    ];
+    return [...base, ...observedNames.filter((name) => isTransferStream(space, name))];
+}
+//# sourceMappingURL=space-deletion-targets.js.map

package/dist/space-deletion-targets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"space-deletion-targets.js","sourceRoot":"","sources":["../src/space-deletion-targets.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ,EACzF,WAAW,EAAE,gBAAgB,EAAE,aAAa,EAAE,gBAAgB,EAAE,aAAa,EAC7E,iBAAiB,EAAE,cAAc,EAAE,UAAU,GAC9C,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAEjE;yFACyF;AACzF,MAAM,UAAU,oBAAoB,CAAC,KAAa,EAAE,gBAAmC,EAAE;IACvF,MAAM,IAAI,GAAG;QACX,UAAU,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,KAAK,CAAC;QAC3F,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE;QACzF,MAAM,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,gBAAgB,CAAC,KAAK,CAAC,EAAE;QACzD,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE;QAC3D,GAAG,wBAAwB,CAAC,KAAK,CAAC,EAAE,iBAAiB,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;KAC7E,CAAC;IACF,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AACrF,CAAC"}

package/dist/space-initialization-diff.d.ts

@@ -0,0 +1,47 @@
+import { type SpaceInitializationObservation } from "./space-initialization-observation.js";
+import type { ChannelRegistryFile } from "./channels.js";
+import type { ChannelConfig, ChannelDefaults, DeliveryClass } from "./types.js";
+type RegistryValue = ChannelConfig | ChannelDefaults;
+export interface SpaceInitializationDiffRow {
+    key: string;
+    state: SpaceInitializationObservation["state"] | "not-observed" | "field-policy-required" | "observed-fields-match" | "patch-differs";
+    observedRevision: number | null;
+    seedRequested: boolean;
+    profileDefault: "not-applicable" | "not-established" | "preserve-explicit" | "propose-profile";
+    changedFields: readonly string[];
+    unmodeledFieldCount: number;
+    /** Private proposed data, not an accepted plan. The observed revision can already be stale. */
+    candidate: {
+        expectedRevision: number;
+        value: RegistryValue;
+    } | null;
+}
+/** Compare native seed-before-profile semantics against observed existing rows. Only present,
+ *  closed, valid values receive a private candidate pinned to their observed revision. Missing,
+ *  deleted, unreadable or unvisited rows never become empty values or create requests. This
+ *  pure result carries no connection, current authority, accepted write plan or apply port. */
+export declare function diffSpaceInitialization(space: string, deliveryClass: DeliveryClass, observed: {
+    space: string;
+    registry: {
+        bucket: string;
+        stream: string;
+    };
+    observations: readonly SpaceInitializationObservation[];
+}, seed?: ChannelRegistryFile): {
+    kind: "space-initialization-diff";
+    space: string;
+    registry: {
+        bucket: string;
+        stream: string;
+    };
+    rows: SpaceInitializationDiffRow[];
+    scope: "existing-row native seed/profile comparison; private revision candidates are not accepted write plans";
+    registryFieldPolicy: "closed-native-fields";
+    revisionGuardsApplied: false;
+    connectionAuthorityChecked: false;
+    absenceAuthoritativelyProven: false;
+    applyPermitted: false;
+    writes: readonly [];
+};
+export {};
+//# sourceMappingURL=space-initialization-diff.d.ts.map

package/dist/space-initialization-diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"space-initialization-diff.d.ts","sourceRoot":"","sources":["../src/space-initialization-diff.ts"],"names":[],"mappings":"AAIA,OAAO,EAAqC,KAAK,8BAA8B,EAAE,MAAM,uCAAuC,CAAC;AAC/H,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAKhF,KAAK,aAAa,GAAG,aAAa,GAAG,eAAe,CAAC;AAErD,MAAM,WAAW,0BAA0B;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,8BAA8B,CAAC,OAAO,CAAC,GAAG,cAAc,GAAG,uBAAuB,GAAG,uBAAuB,GAAG,eAAe,CAAC;IACtI,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,EAAE,gBAAgB,GAAG,iBAAiB,GAAG,mBAAmB,GAAG,iBAAiB,CAAC;IAC/F,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,+FAA+F;IAC/F,SAAS,EAAE;QAAE,gBAAgB,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,aAAa,CAAA;KAAE,GAAG,IAAI,CAAC;CACtE;AAiBD;;;+FAG+F;AAC/F,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,aAAa,EAC5B,QAAQ,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,YAAY,EAAE,SAAS,8BAA8B,EAAE,CAAA;CAAE,EAClI,IAAI,CAAC,EAAE,mBAAmB;;;;;;;;;;;;;;;EAwD3B"}

package/dist/space-initialization-diff.js

@@ -0,0 +1,100 @@
+import { canonicalJson } from "./canonical.js";
+import { validateChannelConfig, validateChannelDefaults } from "./channels.js";
+import { CHANNEL_DEFAULTS_KEY } from "./subjects.js";
+import { spaceInitializationDefinitions } from "./space-resource-definitions.js";
+import { validateSpaceInitializationInputs } from "./space-initialization-observation.js";
+const DEFAULT_FIELDS = { replay: true, replayWindow: true, deliveryClass: true };
+const CHANNEL_FIELDS = { ...DEFAULT_FIELDS, description: true, instructions: true };
+/** Reject unmodeled fields instead of dropping them from a proposed value. Native validators
+ *  retain their existing compatibility behavior; this closed policy belongs to inspection. */
+function registryValue(value, key) {
+    let unmodeledFieldCount = 0;
+    try {
+        const encoded = canonicalJson(value);
+        if (value === null || typeof value !== "object" || Array.isArray(value) || new TextEncoder().encode(encoded).byteLength > 65536)
+            return { valid: false, unmodeledFieldCount };
+        const fields = key === CHANNEL_DEFAULTS_KEY ? DEFAULT_FIELDS : CHANNEL_FIELDS;
+        unmodeledFieldCount = Object.keys(value).filter((field) => !Object.hasOwn(fields, field)).length;
+        if (unmodeledFieldCount)
+            return { valid: false, unmodeledFieldCount };
+        if (key === CHANNEL_DEFAULTS_KEY)
+            validateChannelDefaults(value);
+        else
+            validateChannelConfig(value);
+        return { valid: true, unmodeledFieldCount };
+    }
+    catch {
+        return { valid: false, unmodeledFieldCount };
+    }
+}
+/** Compare native seed-before-profile semantics against observed existing rows. Only present,
+ *  closed, valid values receive a private candidate pinned to their observed revision. Missing,
+ *  deleted, unreadable or unvisited rows never become empty values or create requests. This
+ *  pure result carries no connection, current authority, accepted write plan or apply port. */
+export function diffSpaceInitialization(space, deliveryClass, observed, seed) {
+    validateSpaceInitializationInputs(deliveryClass, seed);
+    const definitions = spaceInitializationDefinitions(space, deliveryClass, seed);
+    if (observed.space !== space || observed.registry.bucket !== definitions.registry.bucket || observed.registry.stream !== definitions.registry.stream)
+        throw new Error("initialization comparison requires observations of the selected registry; no different target was adopted");
+    const patches = new Map(definitions.seed.entries.map((entry) => [entry.key, entry.patch]));
+    const keys = [...new Set([...patches.keys(), definitions.profileDefault.key])];
+    const requested = new Set(keys), observations = new Map();
+    for (const row of observed.observations) {
+        if (!requested.has(row.key) || observations.has(row.key) || row.operation !== "kv-get")
+            throw new Error("initialization comparison requires unique native observations of the requested keys; no foreign or duplicate row was adopted");
+        observations.set(row.key, row);
+    }
+    const rows = keys.map((key) => {
+        const observation = observations.get(key), patch = patches.get(key);
+        const row = {
+            key, state: observation?.state ?? "not-observed", observedRevision: null,
+            seedRequested: patches.has(key), profileDefault: key === CHANNEL_DEFAULTS_KEY ? "not-established" : "not-applicable",
+            changedFields: [], unmodeledFieldCount: 0, candidate: null,
+        };
+        if (!observation)
+            return row;
+        if ("revision" in observation) {
+            if (!Number.isSafeInteger(observation.revision) || observation.revision <= 0)
+                return { ...row, state: "observation-failed" };
+            row.observedRevision = observation.revision;
+        }
+        if (observation.state !== "present")
+            return row;
+        const currentPolicy = registryValue(observation.value, key), patchPolicy = registryValue(patch ?? {}, key);
+        row.unmodeledFieldCount = currentPolicy.unmodeledFieldCount + patchPolicy.unmodeledFieldCount;
+        if (!currentPolicy.valid || !patchPolicy.valid)
+            return { ...row, state: "field-policy-required" };
+        const current = observation.value;
+        const value = { ...observation.value, ...patch };
+        if (key === CHANNEL_DEFAULTS_KEY) {
+            if (value.deliveryClass === undefined) {
+                Object.assign(value, definitions.profileDefault.patch);
+                row.profileDefault = "propose-profile";
+            }
+            else
+                row.profileDefault = "preserve-explicit";
+        }
+        if (!registryValue(value, key).valid)
+            return { ...row, state: "field-policy-required" };
+        const next = value;
+        row.changedFields = Object.keys(key === CHANNEL_DEFAULTS_KEY ? DEFAULT_FIELDS : CHANNEL_FIELDS).filter((field) => {
+            const before = Object.hasOwn(current, field), after = Object.hasOwn(next, field);
+            return before !== after || (before && after && canonicalJson(current[field]) !== canonicalJson(next[field]));
+        });
+        if (row.changedFields.length === 0)
+            return { ...row, state: "observed-fields-match" };
+        return { ...row, state: "patch-differs", candidate: { expectedRevision: observation.revision, value } };
+    });
+    return {
+        kind: "space-initialization-diff",
+        space, registry: definitions.registry, rows,
+        scope: "existing-row native seed/profile comparison; private revision candidates are not accepted write plans",
+        registryFieldPolicy: "closed-native-fields",
+        revisionGuardsApplied: false,
+        connectionAuthorityChecked: false,
+        absenceAuthoritativelyProven: false,
+        applyPermitted: false,
+        writes: [],
+    };
+}
+//# sourceMappingURL=space-initialization-diff.js.map

package/dist/space-initialization-diff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"space-initialization-diff.js","sourceRoot":"","sources":["../src/space-initialization-diff.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AACjF,OAAO,EAAE,iCAAiC,EAAuC,MAAM,uCAAuC,CAAC;AAI/H,MAAM,cAAc,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAyD,CAAC;AACxI,MAAM,cAAc,GAAG,EAAE,GAAG,cAAc,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAuD,CAAC;AAgBzI;8FAC8F;AAC9F,SAAS,aAAa,CAAC,KAAoB,EAAE,GAAW;IACtD,IAAI,mBAAmB,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,UAAU,GAAG,KAAK;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;QAC9K,MAAM,MAAM,GAAG,GAAG,KAAK,oBAAoB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC;QAC9E,mBAAmB,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACjG,IAAI,mBAAmB;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;QACtE,IAAI,GAAG,KAAK,oBAAoB;YAAE,uBAAuB,CAAC,KAAK,CAAC,CAAC;;YAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACpG,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;IAAC,CAAC;AAC3D,CAAC;AAED;;;+FAG+F;AAC/F,MAAM,UAAU,uBAAuB,CACrC,KAAa,EACb,aAA4B,EAC5B,QAAkI,EAClI,IAA0B;IAE1B,iCAAiC,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACvD,MAAM,WAAW,GAAG,8BAA8B,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC;IAC/E,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,KAAK,WAAW,CAAC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,KAAK,WAAW,CAAC,QAAQ,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,2GAA2G,CAAC,CAAC;IACnR,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3F,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,YAAY,GAAG,IAAI,GAAG,EAA0C,CAAC;IAClG,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QACxC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,SAAS,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,8HAA8H,CAAC,CAAC;QACxO,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAA8B,EAAE;QACxD,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpE,MAAM,GAAG,GAA+B;YACtC,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,IAAI,cAAc,EAAE,gBAAgB,EAAE,IAAI;YACxE,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,cAAc,EAAE,GAAG,KAAK,oBAAoB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,gBAAgB;YACpH,aAAa,EAAE,EAAE,EAAE,mBAAmB,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI;SAC3D,CAAC;QACF,IAAI,CAAC,WAAW;YAAE,OAAO,GAAG,CAAC;QAC7B,IAAI,UAAU,IAAI,WAAW,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,WAAW,CAAC,QAAQ,IAAI,CAAC;gBAAE,OAAO,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YAC7H,GAAG,CAAC,gBAAgB,GAAG,WAAW,CAAC,QAAQ,CAAC;QAC9C,CAAC;QACD,IAAI,WAAW,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO,GAAG,CAAC;QAChD,MAAM,aAAa,GAAG,aAAa,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,WAAW,GAAG,aAAa,CAAC,KAAK,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3G,GAAG,CAAC,mBAAmB,GAAG,aAAa,CAAC,mBAAmB,GAAG,WAAW,CAAC,mBAAmB,CAAC;QAC9F,IAAI,CAAC,aAAa,CAAC,KAAK,IAAI,CAAC,WAAW,CAAC,KAAK;YAAE,OAAO,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;QAClG,MAAM,OAAO,GAAG,WAAW,CAAC,KAA2C,CAAC;QACxE,MAAM,KAAK,GAAkB,EAAE,GAAG,WAAW,CAAC,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC;QAChE,IAAI,GAAG,KAAK,oBAAoB,EAAE,CAAC;YACjC,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;gBACtC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;gBACvD,GAAG,CAAC,cAAc,GAAG,iBAAiB,CAAC;YACzC,CAAC;;gBAAM,GAAG,CAAC,cAAc,GAAG,mBAAmB,CAAC;QAClD,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK;YAAE,OAAO,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;QACxF,MAAM,IAAI,GAAG,KAA2C,CAAC;QACzD,GAAG,CAAC,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YAC/G,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACjF,OAAO,MAAM,KAAK,KAAK,IAAI,CAAC,MAAM,IAAI,KAAK,IAAI,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/G,CAAC,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;QACtF,OAAO,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,EAAE,gBAAgB,EAAE,WAAW,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC;IAC1G,CAAC,CAAC,CAAC;IACH,OAAO;QACL,IAAI,EAAE,2BAAoC;QAC1C,KAAK,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,IAAI;QAC3C,KAAK,EAAE,uGAAgH;QACvH,mBAAmB,EAAE,sBAA+B;QACpD,qBAAqB,EAAE,KAAc;QACrC,0BAA0B,EAAE,KAAc;QAC1C,4BAA4B,EAAE,KAAc;QAC5C,cAAc,EAAE,KAAc;QAC9B,MAAM,EAAE,EAAW;KACpB,CAAC;AACJ,CAAC"}

package/dist/space-initialization-observation.d.ts

@@ -0,0 +1,52 @@
+import { type KvEntry } from "@nats-io/kv";
+import type { NatsConnection } from "@nats-io/transport-node";
+import { type ChannelRegistryFile } from "./channels.js";
+import type { ChannelConfig, ChannelDefaults, DeliveryClass } from "./types.js";
+export interface SpaceInitializationReadPort {
+    readonly bucket: string;
+    readonly stream: string;
+    readonly get: (key: string) => Promise<KvEntry | null>;
+}
+/** Bind the selected existing registry on this connection through the public native API.
+ *  No bucket creation or stream override. Names are not server/account or write authority. */
+export declare function spaceInitializationReadPort(nc: NatsConnection, space: string): Promise<SpaceInitializationReadPort>;
+/** Values are private planning data and can contain model-facing text. Never serialize these
+ *  rows wholesale into public diagnostics, operation receipts or an authority artifact. */
+export type SpaceInitializationObservation = {
+    key: string;
+    operation: "kv-get";
+} & ({
+    state: "present";
+    revision: number;
+    value: ChannelConfig | ChannelDefaults;
+} | {
+    state: "observed-tombstone";
+    revision: number;
+    marker: "DEL" | "PURGE";
+} | {
+    state: "reported-not-found" | "registry-unavailable" | "permission-denied" | "target-mismatch" | "observation-failed" | "not-observed-budget";
+});
+export declare function validateSpaceInitializationInputs(deliveryClass: DeliveryClass, seed?: ChannelRegistryFile): void;
+/** Observe only the requested seed keys and defaults. Native validation precedes reads. The
+ *  five-second/8 MiB budget leaves unvisited rows explicit; expiry does not cancel an in-flight
+ *  request. The caller retains connection custody. No row absence authorizes creation. */
+export declare function observeSpaceInitialization(reads: SpaceInitializationReadPort, space: string, deliveryClass: DeliveryClass, seed?: ChannelRegistryFile): Promise<{
+    kind: "space-initialization-observations";
+    space: string;
+    registry: {
+        bucket: string;
+        stream: string;
+    };
+    observations: SpaceInitializationObservation[];
+    scope: "provided registry handle and requested keys; observations can be stale and are not a revision-guarded write plan";
+    byteBudget: number;
+    deadlineMs: number;
+    deadlineReached: boolean;
+    fullFieldPolicyApplied: false;
+    readerRequestCancellationEstablished: false;
+    connectionAuthorityChecked: false;
+    absenceAuthoritativelyProven: false;
+    applyPermitted: false;
+    writes: readonly [];
+}>;
+//# sourceMappingURL=space-initialization-observation.d.ts.map

package/dist/space-initialization-observation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"space-initialization-observation.d.ts","sourceRoot":"","sources":["../src/space-initialization-observation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAO,KAAK,OAAO,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAE9D,OAAO,EAAkD,KAAK,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACzG,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAIhF,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;CACxD;AAED;8FAC8F;AAC9F,wBAAsB,2BAA2B,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAIzH;AAED;2FAC2F;AAC3F,MAAM,MAAM,8BAA8B,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,QAAQ,CAAA;CAAE,GAAG,CAChF;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,aAAa,GAAG,eAAe,CAAA;CAAE,GAC9E;IAAE,KAAK,EAAE,oBAAoB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,KAAK,GAAG,OAAO,CAAA;CAAE,GAC1E;IAAE,KAAK,EAAE,oBAAoB,GAAG,sBAAsB,GAAG,mBAAmB,GAAG,iBAAiB,GAAG,oBAAoB,GAAG,qBAAqB,CAAA;CAAE,CACpJ,CAAC;AAMF,wBAAgB,iCAAiC,CAAC,aAAa,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAkBhH;AAED;;0FAE0F;AAC1F,wBAAsB,0BAA0B,CAAC,KAAK,EAAE,2BAA2B,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,mBAAmB;;;;;;;;;;;;;;;;;;GAgD3J"}