@cotal-ai/core 0.90.1 → 0.92.0

package/dist/space-initialization-observation.js

@@ -0,0 +1,133 @@
+import { Kvm } from "@nats-io/kv";
+import { CHANNEL_DEFAULTS_KEY, channelBucket, isConcreteChannel } from "./subjects.js";
+import { validateChannelConfig, validateChannelDefaults } from "./channels.js";
+import { spaceInitializationDefinitions } from "./space-resource-definitions.js";
+import { spaceSchemaReadFailure } from "./space-schema-observation.js";
+/** Bind the selected existing registry on this connection through the public native API.
+ *  No bucket creation or stream override. Names are not server/account or write authority. */
+export async function spaceInitializationReadPort(nc, space) {
+    const bucket = channelBucket(space), stream = `KV_${bucket}`;
+    const kv = await new Kvm(nc).open(bucket);
+    return Object.freeze({ bucket, stream, get: (key) => kv.get(key) });
+}
+function object(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+export function validateSpaceInitializationInputs(deliveryClass, seed) {
+    try {
+        if (deliveryClass !== "live" && deliveryClass !== "durable")
+            throw new Error();
+        validateChannelDefaults({ deliveryClass });
+        if (seed === undefined)
+            return;
+        if (!object(seed) || Object.keys(seed).some((key) => key !== "defaults" && key !== "channels"))
+            throw new Error();
+        if (seed.defaults !== undefined) {
+            if (!object(seed.defaults))
+                throw new Error();
+            validateChannelDefaults(seed.defaults);
+        }
+        if (seed.channels !== undefined) {
+            if (!object(seed.channels) || Object.keys(seed.channels).length > 1024)
+                throw new Error();
+            for (const [key, patch] of Object.entries(seed.channels)) {
+                if (key === CHANNEL_DEFAULTS_KEY || !isConcreteChannel(key) || !object(patch))
+                    throw new Error();
+                validateChannelConfig(patch);
+            }
+        }
+    }
+    catch {
+        throw new Error("initialization observation requires valid native profile/patch inputs and at most 1024 concrete nonreserved channel keys; no registry read was attempted");
+    }
+}
+/** Observe only the requested seed keys and defaults. Native validation precedes reads. The
+ *  five-second/8 MiB budget leaves unvisited rows explicit; expiry does not cancel an in-flight
+ *  request. The caller retains connection custody. No row absence authorizes creation. */
+export async function observeSpaceInitialization(reads, space, deliveryClass, seed) {
+    validateSpaceInitializationInputs(deliveryClass, seed);
+    const definitions = spaceInitializationDefinitions(space, deliveryClass, seed);
+    if (reads.bucket !== definitions.registry.bucket || reads.stream !== definitions.registry.stream)
+        throw new Error("initialization read-port target does not match the selected registry; no key was read");
+    const keys = [...new Set([...definitions.seed.entries.map((entry) => entry.key), definitions.profileDefault.key])];
+    const observations = [];
+    const deadline = performance.now() + 5000, decoder = new TextDecoder("utf-8", { fatal: true });
+    let bytes = 0, deadlineReached = false;
+    for (const key of keys) {
+        const row = { key, operation: "kv-get" }, remaining = deadline - performance.now();
+        if (remaining <= 0)
+            deadlineReached = true;
+        if (deadlineReached || bytes >= 8 * 1024 * 1024) {
+            observations.push({ ...row, state: "not-observed-budget" });
+            continue;
+        }
+        let timer;
+        try {
+            const result = await Promise.race([
+                reads.get(key).then((entry) => ({ kind: "read", entry })),
+                new Promise((resolve) => { timer = setTimeout(() => resolve({ kind: "deadline" }), remaining); }),
+            ]);
+            if (result.kind === "deadline") {
+                deadlineReached = true;
+                observations.push({ ...row, state: "observation-failed" });
+                continue;
+            }
+            const entry = result.entry;
+            if (entry === null) {
+                observations.push({ ...row, state: "reported-not-found" });
+                continue;
+            }
+            if (entry.bucket !== reads.bucket || entry.key !== key) {
+                observations.push({ ...row, state: "target-mismatch" });
+                continue;
+            }
+            if (!Number.isSafeInteger(entry.revision) || entry.revision <= 0) {
+                observations.push({ ...row, state: "observation-failed" });
+                continue;
+            }
+            if (entry.operation === "DEL" || entry.operation === "PURGE") {
+                observations.push({ ...row, state: "observed-tombstone", revision: entry.revision, marker: entry.operation });
+                continue;
+            }
+            if (entry.operation !== "PUT" || !(entry.value instanceof Uint8Array)) {
+                observations.push({ ...row, state: "observation-failed" });
+                continue;
+            }
+            bytes += entry.value.byteLength;
+            if (entry.value.byteLength > 65536 || bytes > 8 * 1024 * 1024) {
+                observations.push({ ...row, state: "observation-failed" });
+                continue;
+            }
+            const value = JSON.parse(decoder.decode(entry.value));
+            if (!object(value)) {
+                observations.push({ ...row, state: "observation-failed" });
+                continue;
+            }
+            if (key === CHANNEL_DEFAULTS_KEY)
+                validateChannelDefaults(value);
+            else
+                validateChannelConfig(value);
+            observations.push({ ...row, state: "present", revision: entry.revision, value });
+        }
+        catch (error) {
+            const state = spaceSchemaReadFailure(error);
+            observations.push({ ...row, state: state === "reported-not-found" ? "registry-unavailable" : state });
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    return {
+        kind: "space-initialization-observations",
+        space, registry: definitions.registry, observations,
+        scope: "provided registry handle and requested keys; observations can be stale and are not a revision-guarded write plan",
+        byteBudget: 8 * 1024 * 1024, deadlineMs: 5000, deadlineReached,
+        fullFieldPolicyApplied: false,
+        readerRequestCancellationEstablished: false,
+        connectionAuthorityChecked: false,
+        absenceAuthoritativelyProven: false,
+        applyPermitted: false,
+        writes: [],
+    };
+}
+//# sourceMappingURL=space-initialization-observation.js.map

package/dist/space-initialization-observation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"space-initialization-observation.js","sourceRoot":"","sources":["../src/space-initialization-observation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAgB,MAAM,aAAa,CAAC;AAEhD,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACvF,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAA4B,MAAM,eAAe,CAAC;AAEzG,OAAO,EAAE,8BAA8B,EAAE,MAAM,iCAAiC,CAAC;AACjF,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAQvE;8FAC8F;AAC9F,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,EAAkB,EAAE,KAAa;IACjF,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,MAAM,EAAE,CAAC;IAC7D,MAAM,EAAE,GAAG,MAAM,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAC9E,CAAC;AAUD,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,aAA4B,EAAE,IAA0B;IACxG,IAAI,CAAC;QACH,IAAI,aAAa,KAAK,MAAM,IAAI,aAAa,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QAC/E,uBAAuB,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC;QAC3C,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO;QAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,UAAU,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QAClH,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YAC9C,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,IAAI;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;YAC1F,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzD,IAAI,GAAG,KAAK,oBAAoB,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;oBAAE,MAAM,IAAI,KAAK,EAAE,CAAC;gBACjG,qBAAqB,CAAC,KAAK,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,0JAA0J,CAAC,CAAC;IAAC,CAAC;AAC1L,CAAC;AAED;;0FAE0F;AAC1F,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAAkC,EAAE,KAAa,EAAE,aAA4B,EAAE,IAA0B;IAC1J,iCAAiC,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACvD,MAAM,WAAW,GAAG,8BAA8B,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC;IAC/E,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,QAAQ,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,QAAQ,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC,CAAC;IAC3M,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACnH,MAAM,YAAY,GAAqC,EAAE,CAAC;IAC1D,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,OAAO,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/F,IAAI,KAAK,GAAG,CAAC,EAAE,eAAe,GAAG,KAAK,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,QAAiB,EAAE,EAAE,SAAS,GAAG,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAC5F,IAAI,SAAS,IAAI,CAAC;YAAE,eAAe,GAAG,IAAI,CAAC;QAC3C,IAAI,eAAe,IAAI,KAAK,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;YAAC,YAAY,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAC3H,IAAI,KAAgD,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;gBAChC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,KAAK,EAAE,CAAC,CAAC;gBAClE,IAAI,OAAO,CAAuB,CAAC,OAAO,EAAE,EAAE,GAAG,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;aACxH,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAAC,eAAe,GAAG,IAAI,CAAC;gBAAC,YAAY,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YACjI,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAC3B,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBAAC,YAAY,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC7F,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;gBAAC,YAAY,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC9H,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC;gBAAC,YAAY,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC3I,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;gBAAC,YAAY,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC1L,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,YAAY,UAAU,CAAC,EAAE,CAAC;gBAAC,YAAY,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YAChJ,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;YAChC,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,GAAG,KAAK,IAAI,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;gBAAC,YAAY,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YACxI,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBAAC,YAAY,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC7F,IAAI,GAAG,KAAK,oBAAoB;gBAAE,uBAAuB,CAAC,KAAK,CAAC,CAAC;;gBAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC;YACpG,YAAY,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACnF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC5C,YAAY,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,KAAK,KAAK,oBAAoB,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACxG,CAAC;gBAAS,CAAC;YAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;IACpC,CAAC;IACD,OAAO;QACL,IAAI,EAAE,mCAA4C;QAClD,KAAK,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,YAAY;QACnD,KAAK,EAAE,kHAA2H;QAClI,UAAU,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,eAAe;QAC9D,sBAAsB,EAAE,KAAc;QACtC,oCAAoC,EAAE,KAAc;QACpD,0BAA0B,EAAE,KAAc;QAC1C,4BAA4B,EAAE,KAAc;QAC5C,cAAc,EAAE,KAAc;QAC9B,MAAM,EAAE,EAAW;KACpB,CAAC;AACJ,CAAC"}

package/dist/space-resource-definitions.d.ts

@@ -0,0 +1,86 @@
+import { type StreamConfig } from "@nats-io/jetstream";
+import { type Kvm } from "@nats-io/kv";
+import type { Objm } from "@nats-io/obj";
+import { type ChannelRegistryFile } from "./channels.js";
+import type { DeliveryClass } from "./types.js";
+import { type EndpointStreamOptions } from "./endpoint-binding.js";
+export type SpaceResourceDefinition = {
+    kind: "stream";
+    stream: string;
+    config: Partial<StreamConfig> & {
+        name: string;
+    };
+    verification: "canonical-backup" | "declared-fields" | "contract";
+} | {
+    kind: "kv";
+    stream: string;
+    bucket: string;
+    createOptions: NonNullable<Parameters<Kvm["create"]>[1]>;
+    hardenAfterCreate?: Partial<StreamConfig>;
+    verification: "native-runtime-check-required" | "records" | "auth" | "sessions" | "issued" | "admission";
+} | {
+    kind: "object-store";
+    stream: string;
+    bucket: string;
+    createOptions: NonNullable<Parameters<Objm["create"]>[1]>;
+    verification: "artifact";
+};
+/** Project only explicit public KV/object option fields used by native bootstrap. No SDK
+ *  default, private constructor or unspecified option is expanded into an observed fact. */
+export declare function explicitSpaceResourceFields(resource: SpaceResourceDefinition): {
+    config: Partial<StreamConfig> & {
+        name: string;
+    };
+    unexpanded: string[];
+};
+/** Only public scalar KV input defaults. No constructor, server feature probe or effective
+ *  stream-default expansion is performed. Unsupported public defaults fail closed. */
+export declare function nativeKvScalarInputDefaults(): Partial<StreamConfig>;
+/** Desired first-party configuration for one explicit native STREAM.CREATE. Store subjects,
+ *  public scalar options and hardening share the bootstrap definitions; hardening is present at
+ *  creation, not applied after adopting an existing bucket. This is never a repair/update plan. */
+export declare function spaceResourceCreationConfig(resource: SpaceResourceDefinition): Partial<StreamConfig> & {
+    name: string;
+};
+/** Collect the native bootstrap inputs without opening a connection or deriving SDK defaults.
+ *  Definitions describe creation, not safe updates: authority and artifact verifiers still own
+ *  their guards. Neither this value nor its hardening fields authorize provisioning or repair. */
+export declare function spaceResourceDefinitions(space: string, options?: EndpointStreamOptions): {
+    kind: "native-space-resource-definitions";
+    space: string;
+    resources: SpaceResourceDefinition[];
+    scope: "native creation inputs; not an ordered mutation plan or full effective schema";
+    pendingPolicy: readonly ["full-effective-field-policy", "registry-seed", "default-delivery", "observation-classification", "reconciliation-allowlist", "privileged-apply"];
+    completeSpaceSchema: false;
+    sdkDefaultsExpanded: false;
+    connectionAuthorityChecked: false;
+    absenceAuthoritativelyProven: false;
+    applyPermitted: false;
+    writes: readonly [];
+};
+/** Describe native seed/profile precedence without deciding that any row may be written.
+ *  The caller supplies the deployment profile; no missing daemon or credential selects it.
+ *  Revision-bound observation, validation and guarded application remain separate work. */
+export declare function spaceInitializationDefinitions(space: string, deliveryClass: DeliveryClass, seed?: ChannelRegistryFile): {
+    kind: "native-space-initialization-definitions";
+    space: string;
+    registry: {
+        bucket: string;
+        stream: string;
+    };
+    seed: {
+        entries: import("./channels.js").ChannelRegistrySeedEntry[];
+        merge: "specified-fields-overwrite-existing";
+    };
+    profileDefault: {
+        key: string;
+        patch: import("./types.js").ChannelDefaults;
+        condition: "deliveryClass-is-absent";
+    };
+    order: "seed-before-profile-default; explicit-existing-class-wins";
+    scope: "native patch inputs and precedence; not observed rows or a revision-bound write plan";
+    observationsComplete: false;
+    applyPermitted: false;
+    writes: readonly [];
+};
+//# sourceMappingURL=space-resource-definitions.d.ts.map

package/dist/space-resource-definitions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"space-resource-definitions.d.ts","sourceRoot":"","sources":["../src/space-resource-definitions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAqB,KAAK,GAAG,EAAE,MAAM,aAAa,CAAC;AAG1D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAA2D,KAAK,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAClH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAKL,KAAK,qBAAqB,EAC3B,MAAM,uBAAuB,CAAC;AAW/B,MAAM,MAAM,uBAAuB,GAC/B;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,YAAY,EAAE,kBAAkB,GAAG,iBAAiB,GAAG,UAAU,CAAA;CAAE,GACvJ;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAAC,YAAY,EAAE,+BAA+B,GAAG,SAAS,GAAG,MAAM,GAAG,UAAU,GAAG,QAAQ,GAAG,WAAW,CAAA;CAAE,GAC7P;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAAC,YAAY,EAAE,UAAU,CAAA;CAAE,CAAC;AAElJ;4FAC4F;AAC5F,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,uBAAuB,GAAG;IAAE,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CAiBzJ;AAGD;sFACsF;AACtF,wBAAgB,2BAA2B,IAAI,OAAO,CAAC,YAAY,CAAC,CAInE;AAED;;mGAEmG;AACnG,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,uBAAuB,GAAG,OAAO,CAAC,YAAY,CAAC,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAUvH;AAED;;kGAEkG;AAClG,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B;;;;;;;;;;;;EAmC1F;AAED;;2FAE2F;AAC3F,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,mBAAmB;;;;;;;;;;;;;;;;;;;;;EAarH"}

package/dist/space-resource-definitions.js

@@ -0,0 +1,133 @@
+import { DiscardPolicy } from "@nats-io/jetstream";
+import { defaultBucketOpts } from "@nats-io/kv";
+import { nanos } from "@nats-io/transport-node";
+import { spaceStreamCreationBase } from "./backup-config.js";
+import { CHANNEL_DEFAULTS_KEY, channelBucket, objectStoreStream } from "./subjects.js";
+import { channelDeliveryDefaultPatch, channelRegistrySeedEntries } from "./channels.js";
+import { endpointAuthorityStoreDefinitions, endpointContractStreamConfig, endpointDataStreamConfigs, endpointSessionStoreDefinition, } from "./endpoint-binding.js";
+import { issuedStoreDefinitions } from "./issued-authority.js";
+import { admissionStoreDefinition } from "./run-admission.js";
+import { artifactStoreDefinition, membershipStoreDefinition, spaceMessageStreamConfigs, spaceRegistryStreamConfigs, ttlBuckets, } from "./streams.js";
+/** Project only explicit public KV/object option fields used by native bootstrap. No SDK
+ *  default, private constructor or unspecified option is expanded into an observed fact. */
+export function explicitSpaceResourceFields(resource) {
+    if (resource.kind === "stream")
+        return { config: resource.config, unexpanded: [] };
+    const config = { name: resource.stream, subjects: resource.kind === "kv" ? [`$KV.${resource.bucket}.>`] : [`$O.${resource.bucket}.C.>`, `$O.${resource.bucket}.M.>`] };
+    const unexpanded = [];
+    for (const [field, value] of Object.entries(resource.createOptions)) {
+        if (value === undefined)
+            continue;
+        if (field === "max_bytes" && typeof value === "number" && Number.isFinite(value)) {
+            config.max_bytes = value;
+            continue;
+        }
+        if (resource.kind === "kv") {
+            if (field === "allow_direct" && typeof value === "boolean") {
+                config.allow_direct = value;
+                continue;
+            }
+            if (field === "storage" && (value === "file" || value === "memory")) {
+                config.storage = value;
+                continue;
+            }
+            if (field === "history" && typeof value === "number" && Number.isSafeInteger(value) && value > 0) {
+                config.max_msgs_per_subject = value;
+                continue;
+            }
+            if (field === "ttl" && typeof value === "number" && Number.isSafeInteger(value) && value >= 0) {
+                config.max_age = nanos(value);
+                continue;
+            }
+            if (field === "markerTTL" && typeof value === "number" && Number.isSafeInteger(value) && value > 0) {
+                config.allow_msg_ttl = true;
+                config.subject_delete_marker_ttl = nanos(value);
+                continue;
+            }
+        }
+        unexpanded.push(field);
+    }
+    return { config: { ...config, ...(resource.kind === "kv" ? resource.hardenAfterCreate : {}), name: resource.stream }, unexpanded };
+}
+/** Only public scalar KV input defaults. No constructor, server feature probe or effective
+ *  stream-default expansion is performed. Unsupported public defaults fail closed. */
+export function nativeKvScalarInputDefaults() {
+    const defaults = defaultBucketOpts();
+    if (typeof defaults.history !== "number" || !Number.isSafeInteger(defaults.history) || defaults.history <= 0 || typeof defaults.replicas !== "number" || !Number.isSafeInteger(defaults.replicas) || defaults.replicas <= 0 || typeof defaults.maxValueSize !== "number" || !Number.isFinite(defaults.maxValueSize) || typeof defaults.max_bytes !== "number" || !Number.isFinite(defaults.max_bytes) || defaults.storage !== "file" && defaults.storage !== "memory")
+        throw new Error("native KV input defaults do not supply the required supported scalar fields");
+    return { max_msgs_per_subject: defaults.history, num_replicas: defaults.replicas, max_msg_size: defaults.maxValueSize, max_bytes: defaults.max_bytes, storage: defaults.storage };
+}
+/** Desired first-party configuration for one explicit native STREAM.CREATE. Store subjects,
+ *  public scalar options and hardening share the bootstrap definitions; hardening is present at
+ *  creation, not applied after adopting an existing bucket. This is never a repair/update plan. */
+export function spaceResourceCreationConfig(resource) {
+    const fields = explicitSpaceResourceFields(resource);
+    if (fields.unexpanded.length || fields.config.name !== resource.stream || !Array.isArray(fields.config.subjects))
+        throw new Error("resource creation requires fully mapped native inputs; no unknown option was ignored");
+    const base = spaceStreamCreationBase(resource.stream, fields.config.subjects);
+    const config = resource.kind === "stream" ? { ...base, ...fields.config }
+        : { ...base, discard: DiscardPolicy.New, allow_direct: true, allow_rollup_hdrs: true, ...(resource.kind === "kv" ? nativeKvScalarInputDefaults() : {}), ...fields.config };
+    const age = config.max_age, window = config.duplicate_window;
+    if (typeof age !== "number" || !Number.isFinite(age) || age < 0 || typeof window !== "number" || !Number.isFinite(window) || window < 0)
+        throw new Error("resource creation requires explicit valid age and duplicate-window fields");
+    if (age > 0)
+        config.duplicate_window = Math.min(window, age);
+    return config;
+}
+/** Collect the native bootstrap inputs without opening a connection or deriving SDK defaults.
+ *  Definitions describe creation, not safe updates: authority and artifact verifiers still own
+ *  their guards. Neither this value nor its hardening fields authorize provisioning or repair. */
+export function spaceResourceDefinitions(space, options = {}) {
+    const streams = [
+        ...[...spaceMessageStreamConfigs(space), ...spaceRegistryStreamConfigs(space)].map((config) => ({ config, verification: "canonical-backup" })),
+        ...endpointDataStreamConfigs(space, options).map((config) => ({ config, verification: "declared-fields" })),
+        { config: endpointContractStreamConfig(space), verification: "contract" },
+    ];
+    const authority = endpointAuthorityStoreDefinitions(space);
+    const buckets = [
+        ...ttlBuckets(space).map(([bucket, ttl, storage]) => ({ bucket, createOptions: { ttl, storage }, verification: "native-runtime-check-required" })),
+        { ...membershipStoreDefinition(space), verification: "native-runtime-check-required" },
+        { ...authority.records, verification: "records" },
+        { ...authority.auth, verification: "auth" },
+        ...issuedStoreDefinitions(space).map((definition) => ({ ...definition, verification: "issued" })),
+        { ...admissionStoreDefinition(space), verification: "admission" },
+        { ...endpointSessionStoreDefinition(space), verification: "sessions" },
+    ];
+    const artifact = artifactStoreDefinition(space);
+    const resources = [
+        ...streams.map(({ config, verification }) => ({ kind: "stream", stream: config.name, config, verification })),
+        ...buckets.map((definition) => ({ kind: "kv", stream: `KV_${definition.bucket}`, ...definition })),
+        { kind: "object-store", stream: objectStoreStream(artifact.bucket), ...artifact, verification: "artifact" },
+    ];
+    return {
+        kind: "native-space-resource-definitions",
+        space,
+        resources,
+        scope: "native creation inputs; not an ordered mutation plan or full effective schema",
+        pendingPolicy: ["full-effective-field-policy", "registry-seed", "default-delivery", "observation-classification", "reconciliation-allowlist", "privileged-apply"],
+        completeSpaceSchema: false,
+        sdkDefaultsExpanded: false,
+        connectionAuthorityChecked: false,
+        absenceAuthoritativelyProven: false,
+        applyPermitted: false,
+        writes: [],
+    };
+}
+/** Describe native seed/profile precedence without deciding that any row may be written.
+ *  The caller supplies the deployment profile; no missing daemon or credential selects it.
+ *  Revision-bound observation, validation and guarded application remain separate work. */
+export function spaceInitializationDefinitions(space, deliveryClass, seed) {
+    return {
+        kind: "native-space-initialization-definitions",
+        space,
+        registry: { bucket: channelBucket(space), stream: `KV_${channelBucket(space)}` },
+        seed: { entries: channelRegistrySeedEntries(seed ?? {}), merge: "specified-fields-overwrite-existing" },
+        profileDefault: { key: CHANNEL_DEFAULTS_KEY, patch: channelDeliveryDefaultPatch(deliveryClass), condition: "deliveryClass-is-absent" },
+        order: "seed-before-profile-default; explicit-existing-class-wins",
+        scope: "native patch inputs and precedence; not observed rows or a revision-bound write plan",
+        observationsComplete: false,
+        applyPermitted: false,
+        writes: [],
+    };
+}
+//# sourceMappingURL=space-resource-definitions.js.map

package/dist/space-resource-definitions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"space-resource-definitions.js","sourceRoot":"","sources":["../src/space-resource-definitions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAqB,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAY,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAChD,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAE7D,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACvF,OAAO,EAAE,2BAA2B,EAAE,0BAA0B,EAA4B,MAAM,eAAe,CAAC;AAElH,OAAO,EACL,iCAAiC,EACjC,4BAA4B,EAC5B,yBAAyB,EACzB,8BAA8B,GAE/B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,yBAAyB,EACzB,0BAA0B,EAC1B,UAAU,GACX,MAAM,cAAc,CAAC;AAOtB;4FAC4F;AAC5F,MAAM,UAAU,2BAA2B,CAAC,QAAiC;IAC3E,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IACnF,MAAM,MAAM,GAA4B,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,MAAM,MAAM,EAAE,MAAM,QAAQ,CAAC,MAAM,MAAM,CAAC,EAAE,CAAC;IAChM,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACpE,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,KAAK,KAAK,WAAW,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAAC,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC;YAAC,SAAS;QAAC,CAAC;QACzH,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC3B,IAAI,KAAK,KAAK,cAAc,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;gBAAC,MAAM,CAAC,YAAY,GAAG,KAAK,CAAC;gBAAC,SAAS;YAAC,CAAC;YACtG,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,QAAQ,CAAC,EAAE,CAAC;gBAAC,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC1G,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBAAC,MAAM,CAAC,oBAAoB,GAAG,KAAK,CAAC;gBAAC,SAAS;YAAC,CAAC;YACpJ,IAAI,KAAK,KAAK,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;gBAAC,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC3I,IAAI,KAAK,KAAK,WAAW,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBAAC,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;gBAAC,MAAM,CAAC,yBAAyB,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;QACjM,CAAC;QACD,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,EAA8C,EAAE,UAAU,EAAE,CAAC;AACjL,CAAC;AAGD;sFACsF;AACtF,MAAM,UAAU,2BAA2B;IACzC,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,IAAI,CAAC,IAAI,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,IAAI,CAAC,IAAI,OAAO,QAAQ,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,OAAO,KAAK,MAAM,IAAI,QAAQ,CAAC,OAAO,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IACtiB,OAAO,EAAE,oBAAoB,EAAE,QAAQ,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;AACpL,CAAC;AAED;;mGAEmG;AACnG,MAAM,UAAU,2BAA2B,CAAC,QAAiC;IAC3E,MAAM,MAAM,GAAG,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sFAAsF,CAAC,CAAC;IAC1N,MAAM,IAAI,GAAG,uBAAuB,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE;QACvE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,aAAa,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,2BAA2B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;IAC7K,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,gBAAgB,CAAC;IAC7D,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;IACtO,IAAI,GAAG,GAAG,CAAC;QAAE,MAAM,CAAC,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;kGAEkG;AAClG,MAAM,UAAU,wBAAwB,CAAC,KAAa,EAAE,UAAiC,EAAE;IACzF,MAAM,OAAO,GAAG;QACd,GAAG,CAAC,GAAG,yBAAyB,CAAC,KAAK,CAAC,EAAE,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,kBAA2B,EAAE,CAAC,CAAC;QACvJ,GAAG,yBAAyB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,iBAA0B,EAAE,CAAC,CAAC;QACpH,EAAE,MAAM,EAAE,4BAA4B,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,UAAmB,EAAE;KACnF,CAAC;IACF,MAAM,SAAS,GAAG,iCAAiC,CAAC,KAAK,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG;QACd,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,+BAAwC,EAAE,CAAC,CAAC;QAC3J,EAAE,GAAG,yBAAyB,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,+BAAwC,EAAE;QAC/F,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,YAAY,EAAE,SAAkB,EAAE;QAC1D,EAAE,GAAG,SAAS,CAAC,IAAI,EAAE,YAAY,EAAE,MAAe,EAAE;QACpD,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,YAAY,EAAE,QAAiB,EAAE,CAAC,CAAC;QAC1G,EAAE,GAAG,wBAAwB,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,WAAoB,EAAE;QAC1E,EAAE,GAAG,8BAA8B,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,UAAmB,EAAE;KAChF,CAAC;IACF,MAAM,QAAQ,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,SAAS,GAA8B;QAC3C,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAA2B,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QACtI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,EAA2B,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC;QAC3H,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE;KAC5G,CAAC;IACF,OAAO;QACL,IAAI,EAAE,mCAA4C;QAClD,KAAK;QACL,SAAS;QACT,KAAK,EAAE,+EAAwF;QAC/F,aAAa,EAAE,CAAC,6BAA6B,EAAE,eAAe,EAAE,kBAAkB,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,kBAAkB,CAAU;QAC1K,mBAAmB,EAAE,KAAc;QACnC,mBAAmB,EAAE,KAAc;QACnC,0BAA0B,EAAE,KAAc;QAC1C,4BAA4B,EAAE,KAAc;QAC5C,cAAc,EAAE,KAAc;QAC9B,MAAM,EAAE,EAAW;KACpB,CAAC;AACJ,CAAC;AAED;;2FAE2F;AAC3F,MAAM,UAAU,8BAA8B,CAAC,KAAa,EAAE,aAA4B,EAAE,IAA0B;IACpH,OAAO;QACL,IAAI,EAAE,yCAAkD;QACxD,KAAK;QACL,QAAQ,EAAE,EAAE,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE;QAChF,IAAI,EAAE,EAAE,OAAO,EAAE,0BAA0B,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,qCAA8C,EAAE;QAChH,cAAc,EAAE,EAAE,GAAG,EAAE,oBAAoB,EAAE,KAAK,EAAE,2BAA2B,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,yBAAkC,EAAE;QAC/I,KAAK,EAAE,2DAAoE;QAC3E,KAAK,EAAE,sFAA+F;QACtG,oBAAoB,EAAE,KAAc;QACpC,cAAc,EAAE,KAAc;QAC9B,MAAM,EAAE,EAAW;KACpB,CAAC;AACJ,CAAC"}

package/dist/space-schema-diff.d.ts

@@ -0,0 +1,45 @@
+import { type SpaceResourceDefinition } from "./space-resource-definitions.js";
+import { type EndpointStreamOptions } from "./endpoint-binding.js";
+import type { SpaceSchemaObservation } from "./space-schema-observation.js";
+import { type StreamSchemaRow } from "./stream-schema-diff.js";
+export interface SpaceSchemaDiffRow extends Omit<StreamSchemaRow, "state" | "uninspectedFields"> {
+    kind: SpaceResourceDefinition["kind"];
+    state: StreamSchemaRow["state"] | "native-store-verification-required" | "native-store-invariants-match" | "native-store-verification-unconfirmed" | "unclassified-stream-settings" | "creation-options-policy-required";
+    /** Outside the declarative field comparison; a separate native check can inspect more fields. */
+    uncomparedFields: string[];
+    /** A match covers that native check, not complete effective schema or connection authority. */
+    nativeVerification: "not-checked" | "invariants-match" | "not-confirmed";
+    nativeInvariantFields: readonly string[];
+    unexpandedCreationOptions: readonly string[];
+    reconciliation: {
+        state: "not-evaluated" | "no-declared-change" | "native-guard-required" | "migration-required";
+        nativeGuard: "ttl-enforcement" | "artifact-legacy-cap" | "contract-shadow" | null;
+        fields: readonly string[];
+        nonAllowlistedFields: readonly string[];
+    };
+    observedExtraFields: {
+        status: "checked" | "not-modeled" | "failed";
+        matchesPolicy: string[];
+        nondefaultUndeclared: string[];
+        unmodeled: string[];
+    };
+}
+/** Compare only explicit native stream fields and post-create hardening. KV/object-store
+ *  creation options are not expanded into guessed SDK/server defaults. Pure native invariant
+ *  checks run where declared; runtime checks and complete field policy stay separate. No
+ *  mutating create-or-verify helper, canary, repair or migration is invoked. */
+export declare function diffSpaceResources(space: string, observations: readonly SpaceSchemaObservation[], options?: EndpointStreamOptions): {
+    kind: "space-resource-schema-diff";
+    space: string;
+    rows: SpaceSchemaDiffRow[];
+    scope: "explicit stream/public store-option fields, hardening and pure native invariants; unspecified SDK defaults, runtime checks and full field policy remain unestablished";
+    pendingPolicy: readonly ["full-effective-field-policy", "registry-seed", "default-delivery", "observation-classification", "reconciliation-allowlist", "privileged-apply"];
+    completeSpaceSchema: false;
+    sdkDefaultsExpanded: false;
+    sdkInputDefaultsUsedForReadPolicy: true;
+    connectionAuthorityChecked: false;
+    absenceAuthoritativelyProven: false;
+    applyPermitted: false;
+    writes: readonly [];
+};
+//# sourceMappingURL=space-schema-diff.d.ts.map

package/dist/space-schema-diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"space-schema-diff.d.ts","sourceRoot":"","sources":["../src/space-schema-diff.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsF,KAAK,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AACnK,OAAO,EAAyG,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAQ1K,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,EAA2D,KAAK,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAExH,MAAM,WAAW,kBAAmB,SAAQ,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,mBAAmB,CAAC;IAC9F,IAAI,EAAE,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACtC,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,GAAG,oCAAoC,GAAG,+BAA+B,GAAG,uCAAuC,GAAG,8BAA8B,GAAG,kCAAkC,CAAC;IACzN,iGAAiG;IACjG,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,+FAA+F;IAC/F,kBAAkB,EAAE,aAAa,GAAG,kBAAkB,GAAG,eAAe,CAAC;IACzE,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,yBAAyB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,cAAc,EAAE;QACd,KAAK,EAAE,eAAe,GAAG,oBAAoB,GAAG,uBAAuB,GAAG,oBAAoB,CAAC;QAC/F,WAAW,EAAE,iBAAiB,GAAG,qBAAqB,GAAG,iBAAiB,GAAG,IAAI,CAAC;QAClF,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;QAC1B,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;KACzC,CAAC;IACF,mBAAmB,EAAE;QACnB,MAAM,EAAE,SAAS,GAAG,aAAa,GAAG,QAAQ,CAAC;QAC7C,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB,oBAAoB,EAAE,MAAM,EAAE,CAAC;QAC/B,SAAS,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;CACH;AAkGD;;;gFAGgF;AAChF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,sBAAsB,EAAE,EAAE,OAAO,GAAE,qBAA0B;;;;;;;;;;;;;EAgDrI"}