@serve.zone/cli 33.9.0 → 33.11.0

package/dist_ts_cliclient/classes.cliclient.d.ts

@@ -9,5 +9,17 @@ export declare class CliClient {
      * the caller's to wipe; the API client seals its own copy and never logs or keeps it.
      */
     bootstrapGateway(targetArg: plugins.servezoneApi.IExternalGatewayBootstrapTarget, bootstrapTokenArg: Uint8Array): Promise<void>;
+    /**
+     * Writes one cluster relay's bearer to a new 0600 file and prints what describes the file:
+     * the cluster, the generation, the size, the SHA-256 and the audit receipt, never the bearer.
+     */
+    exportRelayAuthorization(requestArg: plugins.servezoneInterfaces.data.IClusterRelayAuthorizationExportRequest, outputPathArg: string): Promise<void>;
+    /**
+     * Stores the Corestore control token while it is still exactly at `expectedArg` and prints the
+     * state and the receipt the set produced, never the token. The token is the caller's to wipe.
+     */
+    setCorestoreControlToken(expectedArg: plugins.servezoneInterfaces.data.TCorestoreControlTokenState, tokenArg: Uint8Array): Promise<void>;
+    /** Prints whether Cloudly holds the Corestore control token, its revision and its receipts. */
+    getCorestoreControlTokenState(): Promise<void>;
     getGatewayStatus(): Promise<void>;
 }

package/dist_ts_cliclient/classes.cliclient.js

@@ -1,5 +1,7 @@
 import * as plugins from './plugins.js';
 import { CloudlyApiClient } from '@serve.zone/api';
+import { exportRelayAuthorizationToFile } from './relayauthorization.js';
+import { getCorestoreControlTokenState, setCorestoreControlToken } from './corestorecontroltoken.js';
 export class CliClient {
     constructor(cloudlyApiClientArg) {
         this.cloudlyApiClient = cloudlyApiClientArg;
@@ -19,9 +21,29 @@ export class CliClient {
         });
         console.log(JSON.stringify(state, null, 2));
     }
+    /**
+     * Writes one cluster relay's bearer to a new 0600 file and prints what describes the file:
+     * the cluster, the generation, the size, the SHA-256 and the audit receipt, never the bearer.
+     */
+    async exportRelayAuthorization(requestArg, outputPathArg) {
+        const output = await exportRelayAuthorizationToFile(this.cloudlyApiClient, requestArg, outputPathArg);
+        console.log(JSON.stringify({ ok: true, command: 'relay export-authorization', ...output }));
+    }
+    /**
+     * Stores the Corestore control token while it is still exactly at `expectedArg` and prints the
+     * state and the receipt the set produced, never the token. The token is the caller's to wipe.
+     */
+    async setCorestoreControlToken(expectedArg, tokenArg) {
+        const output = await setCorestoreControlToken(this.cloudlyApiClient, expectedArg, tokenArg);
+        console.log(JSON.stringify(output));
+    }
+    /** Prints whether Cloudly holds the Corestore control token, its revision and its receipts. */
+    async getCorestoreControlTokenState() {
+        console.log(JSON.stringify(await getCorestoreControlTokenState(this.cloudlyApiClient)));
+    }
     async getGatewayStatus() {
         const { state } = await this.cloudlyApiClient.settings.getExternalGatewayEnrollmentState();
         console.log(JSON.stringify(state, null, 2));
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5jbGljbGllbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90c19jbGljbGllbnQvY2xhc3Nlcy5jbGljbGllbnQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFDeEMsT0FBTyxFQUFFLGdCQUFnQixFQUFFLE1BQU0saUJBQWlCLENBQUM7QUFFbkQsTUFBTSxPQUFPLFNBQVM7SUFHcEIsWUFBWSxtQkFBcUM7UUFDL0MsSUFBSSxDQUFDLGdCQUFnQixHQUFHLG1CQUFtQixDQUFDO0lBQzlDLENBQUM7SUFFTSxLQUFLLENBQUMsV0FBVztRQUN0QixNQUFNLFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxPQUFPLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDbkUsT0FBTyxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUN4QixDQUFDO0lBRUQ7OztPQUdHO0lBQ0ksS0FBSyxDQUFDLGdCQUFnQixDQUMzQixTQUErRCxFQUMvRCxpQkFBNkI7UUFFN0IsTUFBTSxFQUFFLEtBQUssRUFBRSxHQUFHLE1BQU0sSUFBSSxDQUFDLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxrQ0FBa0MsQ0FBQztZQUN4RixNQUFNLEVBQUUsU0FBUztZQUNqQixjQUFjLEVBQUUsaUJBQWlCO1NBQ2xDLENBQUMsQ0FBQztRQUNILE9BQU8sQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxLQUFLLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDOUMsQ0FBQztJQUVNLEtBQUssQ0FBQyxnQkFBZ0I7UUFDM0IsTUFBTSxFQUFFLEtBQUssRUFBRSxHQUFHLE1BQU0sSUFBSSxDQUFDLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxpQ0FBaUMsRUFBRSxDQUFDO1FBQzNGLE9BQU8sQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxLQUFLLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDOUMsQ0FBQztDQUNGIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5jbGljbGllbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90c19jbGljbGllbnQvY2xhc3Nlcy5jbGljbGllbnQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFDeEMsT0FBTyxFQUFFLGdCQUFnQixFQUFFLE1BQU0saUJBQWlCLENBQUM7QUFDbkQsT0FBTyxFQUFFLDhCQUE4QixFQUFFLE1BQU0seUJBQXlCLENBQUM7QUFDekUsT0FBTyxFQUFFLDZCQUE2QixFQUFFLHdCQUF3QixFQUFFLE1BQU0sNEJBQTRCLENBQUM7QUFFckcsTUFBTSxPQUFPLFNBQVM7SUFHcEIsWUFBWSxtQkFBcUM7UUFDL0MsSUFBSSxDQUFDLGdCQUFnQixHQUFHLG1CQUFtQixDQUFDO0lBQzlDLENBQUM7SUFFTSxLQUFLLENBQUMsV0FBVztRQUN0QixNQUFNLFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxPQUFPLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDbkUsT0FBTyxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUN4QixDQUFDO0lBRUQ7OztPQUdHO0lBQ0ksS0FBSyxDQUFDLGdCQUFnQixDQUMzQixTQUErRCxFQUMvRCxpQkFBNkI7UUFFN0IsTUFBTSxFQUFFLEtBQUssRUFBRSxHQUFHLE1BQU0sSUFBSSxDQUFDLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxrQ0FBa0MsQ0FBQztZQUN4RixNQUFNLEVBQUUsU0FBUztZQUNqQixjQUFjLEVBQUUsaUJBQWlCO1NBQ2xDLENBQUMsQ0FBQztRQUNILE9BQU8sQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxLQUFLLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDOUMsQ0FBQztJQUVEOzs7T0FHRztJQUNJLEtBQUssQ0FBQyx3QkFBd0IsQ0FDbkMsVUFBb0YsRUFDcEYsYUFBcUI7UUFFckIsTUFBTSxNQUFNLEdBQUcsTUFBTSw4QkFBOEIsQ0FDakQsSUFBSSxDQUFDLGdCQUFnQixFQUFFLFVBQVUsRUFBRSxhQUFhLENBQUMsQ0FBQztRQUNwRCxPQUFPLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxFQUFFLEVBQUUsSUFBSSxFQUFFLE9BQU8sRUFBRSw0QkFBNEIsRUFBRSxHQUFHLE1BQU0sRUFBRSxDQUFDLENBQUMsQ0FBQztJQUM5RixDQUFDO0lBRUQ7OztPQUdHO0lBQ0ksS0FBSyxDQUFDLHdCQUF3QixDQUNuQyxXQUF5RSxFQUN6RSxRQUFvQjtRQUVwQixNQUFNLE1BQU0sR0FBRyxNQUFNLHdCQUF3QixDQUFDLElBQUksQ0FBQyxnQkFBZ0IsRUFBRSxXQUFXLEVBQUUsUUFBUSxDQUFDLENBQUM7UUFDNUYsT0FBTyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7SUFDdEMsQ0FBQztJQUVELCtGQUErRjtJQUN4RixLQUFLLENBQUMsNkJBQTZCO1FBQ3hDLE9BQU8sQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLDZCQUE2QixDQUFDLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUMxRixDQUFDO0lBRU0sS0FBSyxDQUFDLGdCQUFnQjtRQUMzQixNQUFNLEVBQUUsS0FBSyxFQUFFLEdBQUcsTUFBTSxJQUFJLENBQUMsZ0JBQWdCLENBQUMsUUFBUSxDQUFDLGlDQUFpQyxFQUFFLENBQUM7UUFDM0YsT0FBTyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLEtBQUssRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUM5QyxDQUFDO0NBQ0YifQ==

package/dist_ts_cliclient/commands.d.ts

@@ -1,4 +1,4 @@
-import type * as plugins from './plugins.js';
+import * as plugins from './plugins.js';
 /** What one invocation of the CLI asks for, parsed before anything is read or connected. */
 export type TCliCommand = 
 /** No arguments: the default action, listing the clusters. */
@@ -9,6 +9,17 @@ export type TCliCommand =
 } | {
     kind: 'gateway-bootstrap';
     target: plugins.servezoneApi.IExternalGatewayBootstrapTarget;
+} | {
+    kind: 'relay-export-authorization';
+    request: plugins.servezoneInterfaces.data.IClusterRelayAuthorizationExportRequest;
+    /** A normalized absolute path in a private directory; the file must not exist yet. */
+    outputPath: string;
+} | {
+    kind: 'corestore-set-control-token';
+    /** Exactly the state the administrator last read; never a minimum. */
+    expected: plugins.servezoneInterfaces.data.TCorestoreControlTokenState;
+} | {
+    kind: 'corestore-control-token-state';
 };
 export declare const cliUsage: string;
 /**

package/dist_ts_cliclient/commands.js

@@ -1,9 +1,15 @@
+import * as plugins from './plugins.js';
 export const cliUsage = [
     'Usage:',
     '  servezone',
     '  servezone gateway status',
     '  servezone gateway bootstrap --gateway-url <https url> --client-id <id>',
     '    The dcrouter admin token is read from stdin, never from arguments or the environment.',
+    '  servezone relay export-authorization --cluster-id <id> --expected-generation <n> --output <absolute path>',
+    '    Writes the relay bearer to a new 0600 file in a directory only you can write; never to stdout.',
+    '  servezone corestore set-control-token --stdin --expect absent|<revision>',
+    '    The Corestore control token is read from stdin, never from arguments or the environment.',
+    '  servezone corestore control-token-state',
 ].join('\n');
 /**
  * An invocation the CLI does not run. It never quotes what it was given, because an argument may
@@ -37,6 +43,10 @@ export const parseCliCommand = (argsArg) => {
     if (argsArg.length === 0)
         return { kind: 'clusters' };
     const [group, action, ...rest] = argsArg;
+    if (group === 'relay')
+        return parseRelayCommand(action, rest);
+    if (group === 'corestore')
+        return parseCorestoreCommand(action, rest);
     requireUsage(group === 'gateway');
     if (action === 'status') {
         requireUsage(rest.length === 0);
@@ -49,4 +59,49 @@ export const parseCliCommand = (argsArg) => {
         target: { gatewayUrl: options['--gateway-url'], gatewayClientId: options['--client-id'] },
     };
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29tbWFuZHMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90c19jbGljbGllbnQvY29tbWFuZHMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBU0EsTUFBTSxDQUFDLE1BQU0sUUFBUSxHQUFHO0lBQ3RCLFFBQVE7SUFDUixhQUFhO0lBQ2IsNEJBQTRCO0lBQzVCLDBFQUEwRTtJQUMxRSwyRkFBMkY7Q0FDNUYsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7QUFFYjs7O0dBR0c7QUFDSCxNQUFNLE9BQU8sYUFBYyxTQUFRLEtBQUs7SUFDdEM7UUFDRSxLQUFLLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDaEIsSUFBSSxDQUFDLElBQUksR0FBRyxlQUFlLENBQUM7SUFDOUIsQ0FBQztDQUNGO0FBRUQsU0FBUyxZQUFZLENBQUMsWUFBcUI7SUFDekMsSUFBSSxDQUFDLFlBQVk7UUFBRSxNQUFNLElBQUksYUFBYSxFQUFFLENBQUM7QUFDL0MsQ0FBQztBQUVELG1GQUFtRjtBQUNuRixNQUFNLFlBQVksR0FBRyxDQUNuQixPQUEwQixFQUMxQixRQUEwQixFQUNILEVBQUU7SUFDekIsTUFBTSxPQUFPLEdBQUcsSUFBSSxHQUFHLEVBQWtCLENBQUM7SUFDMUMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxNQUFNLEtBQUssUUFBUSxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUMsQ0FBQztJQUNyRCxLQUFLLElBQUksS0FBSyxHQUFHLENBQUMsRUFBRSxLQUFLLEdBQUcsT0FBTyxDQUFDLE1BQU0sRUFBRSxLQUFLLElBQUksQ0FBQyxFQUFFLENBQUM7UUFDdkQsTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQzVCLE1BQU0sS0FBSyxHQUFHLE9BQU8sQ0FBQyxLQUFLLEdBQUcsQ0FBQyxDQUFDLENBQUM7UUFDakMsWUFBWSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLE9BQU8sS0FBSyxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQztRQUNqRixZQUFZLENBQUMsS0FBSyxDQUFDLE1BQU0sR0FBRyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUM7UUFDMUQsT0FBTyxDQUFDLEdBQUcsQ0FBQyxJQUFJLEVBQUUsS0FBSyxDQUFDLENBQUM7SUFDM0IsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDLFdBQVcsQ0FBQyxPQUFPLENBQTBCLENBQUM7QUFDOUQsQ0FBQyxDQUFDO0FBRUYsa0ZBQWtGO0FBQ2xGLE1BQU0sQ0FBQyxNQUFNLGVBQWUsR0FBRyxDQUFDLE9BQTBCLEVBQWUsRUFBRTtJQUN6RSxJQUFJLE9BQU8sQ0FBQyxNQUFNLEtBQUssQ0FBQztRQUFFLE9BQU8sRUFBRSxJQUFJLEVBQUUsVUFBVSxFQUFFLENBQUM7SUFDdEQsTUFBTSxDQUFDLEtBQUssRUFBRSxNQUFNLEVBQUUsR0FBRyxJQUFJLENBQUMsR0FBRyxPQUFPLENBQUM7SUFDekMsWUFBWSxDQUFDLEtBQUssS0FBSyxTQUFTLENBQUMsQ0FBQztJQUNsQyxJQUFJLE1BQU0sS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUN4QixZQUFZLENBQUMsSUFBSSxDQUFDLE1BQU0sS0FBSyxDQUFDLENBQUMsQ0FBQztRQUNoQyxPQUFPLEVBQUUsSUFBSSxFQUFFLGdCQUFnQixFQUFFLENBQUM7SUFDcEMsQ0FBQztJQUNELFlBQVksQ0FBQyxNQUFNLEtBQUssV0FBVyxDQUFDLENBQUM7SUFDckMsTUFBTSxPQUFPLEdBQUcsWUFBWSxDQUFDLElBQUksRUFBRSxDQUFDLGVBQWUsRUFBRSxhQUFhLENBQUMsQ0FBQyxDQUFDO0lBQ3JFLE9BQU87UUFDTCxJQUFJLEVBQUUsbUJBQW1CO1FBQ3pCLE1BQU0sRUFBRSxFQUFFLFVBQVUsRUFBRSxPQUFPLENBQUMsZUFBZSxDQUFDLEVBQUUsZUFBZSxFQUFFLE9BQU8sQ0FBQyxhQUFhLENBQUMsRUFBRTtLQUMxRixDQUFDO0FBQ0osQ0FBQyxDQUFDIn0=
+/** A positive integer without leading zeros, as a generation or a revision is named. */
+const parseCounter = (valueArg) => {
+    requireUsage(/^[1-9][0-9]{0,15}$/.test(valueArg) && Number.isSafeInteger(Number(valueArg)));
+    return Number(valueArg);
+};
+/** `relay export-authorization`: the cluster, the exact generation and a normalized absolute output. */
+const parseRelayCommand = (actionArg, restArg) => {
+    requireUsage(actionArg === 'export-authorization');
+    const options = parseOptions(restArg, ['--cluster-id', '--expected-generation', '--output']);
+    const generation = parseCounter(options['--expected-generation']);
+    const outputPath = options['--output'];
+    requireUsage(plugins.path.isAbsolute(outputPath) && plugins.path.normalize(outputPath) === outputPath
+        && !outputPath.endsWith(plugins.path.sep));
+    return {
+        kind: 'relay-export-authorization',
+        request: { clusterId: options['--cluster-id'], expectedGeneration: generation },
+        outputPath,
+    };
+};
+/**
+ * `corestore set-control-token --stdin --expect absent|<revision>` and
+ * `corestore control-token-state`.
+ *
+ * `--stdin` names where the token comes from, so no invocation reads it from anywhere else, and
+ * `--expect` is the state `control-token-state` answered: `absent`, or the stored revision.
+ */
+const parseCorestoreCommand = (actionArg, restArg) => {
+    if (actionArg === 'control-token-state') {
+        requireUsage(restArg.length === 0);
+        return { kind: 'corestore-control-token-state' };
+    }
+    requireUsage(actionArg === 'set-control-token');
+    // `--stdin` is a flag in an option's place, either before or after `--expect <value>`.
+    requireUsage(restArg.length === 3);
+    const stdinIndex = restArg[0] === '--stdin' ? 0 : 2;
+    requireUsage(restArg[stdinIndex] === '--stdin');
+    const options = parseOptions(restArg.filter((_argArg, indexArg) => indexArg !== stdinIndex), ['--expect']);
+    const expected = options['--expect'];
+    return {
+        kind: 'corestore-set-control-token',
+        expected: expected === 'absent'
+            ? { state: 'absent' }
+            : { state: 'present', revision: parseCounter(expected) },
+    };
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29tbWFuZHMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90c19jbGljbGllbnQvY29tbWFuZHMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFxQnhDLE1BQU0sQ0FBQyxNQUFNLFFBQVEsR0FBRztJQUN0QixRQUFRO0lBQ1IsYUFBYTtJQUNiLDRCQUE0QjtJQUM1QiwwRUFBMEU7SUFDMUUsMkZBQTJGO0lBQzNGLDZHQUE2RztJQUM3RyxvR0FBb0c7SUFDcEcsNEVBQTRFO0lBQzVFLDhGQUE4RjtJQUM5RiwyQ0FBMkM7Q0FDNUMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7QUFFYjs7O0dBR0c7QUFDSCxNQUFNLE9BQU8sYUFBYyxTQUFRLEtBQUs7SUFDdEM7UUFDRSxLQUFLLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDaEIsSUFBSSxDQUFDLElBQUksR0FBRyxlQUFlLENBQUM7SUFDOUIsQ0FBQztDQUNGO0FBRUQsU0FBUyxZQUFZLENBQUMsWUFBcUI7SUFDekMsSUFBSSxDQUFDLFlBQVk7UUFBRSxNQUFNLElBQUksYUFBYSxFQUFFLENBQUM7QUFDL0MsQ0FBQztBQUVELG1GQUFtRjtBQUNuRixNQUFNLFlBQVksR0FBRyxDQUNuQixPQUEwQixFQUMxQixRQUEwQixFQUNILEVBQUU7SUFDekIsTUFBTSxPQUFPLEdBQUcsSUFBSSxHQUFHLEVBQWtCLENBQUM7SUFDMUMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxNQUFNLEtBQUssUUFBUSxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUMsQ0FBQztJQUNyRCxLQUFLLElBQUksS0FBSyxHQUFHLENBQUMsRUFBRSxLQUFLLEdBQUcsT0FBTyxDQUFDLE1BQU0sRUFBRSxLQUFLLElBQUksQ0FBQyxFQUFFLENBQUM7UUFDdkQsTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQzVCLE1BQU0sS0FBSyxHQUFHLE9BQU8sQ0FBQyxLQUFLLEdBQUcsQ0FBQyxDQUFDLENBQUM7UUFDakMsWUFBWSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLE9BQU8sS0FBSyxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQztRQUNqRixZQUFZLENBQUMsS0FBSyxDQUFDLE1BQU0sR0FBRyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUM7UUFDMUQsT0FBTyxDQUFDLEdBQUcsQ0FBQyxJQUFJLEVBQUUsS0FBSyxDQUFDLENBQUM7SUFDM0IsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDLFdBQVcsQ0FBQyxPQUFPLENBQTBCLENBQUM7QUFDOUQsQ0FBQyxDQUFDO0FBRUYsa0ZBQWtGO0FBQ2xGLE1BQU0sQ0FBQyxNQUFNLGVBQWUsR0FBRyxDQUFDLE9BQTBCLEVBQWUsRUFBRTtJQUN6RSxJQUFJLE9BQU8sQ0FBQyxNQUFNLEtBQUssQ0FBQztRQUFFLE9BQU8sRUFBRSxJQUFJLEVBQUUsVUFBVSxFQUFFLENBQUM7SUFDdEQsTUFBTSxDQUFDLEtBQUssRUFBRSxNQUFNLEVBQUUsR0FBRyxJQUFJLENBQUMsR0FBRyxPQUFPLENBQUM7SUFDekMsSUFBSSxLQUFLLEtBQUssT0FBTztRQUFFLE9BQU8saUJBQWlCLENBQUMsTUFBTSxFQUFFLElBQUksQ0FBQyxDQUFDO0lBQzlELElBQUksS0FBSyxLQUFLLFdBQVc7UUFBRSxPQUFPLHFCQUFxQixDQUFDLE1BQU0sRUFBRSxJQUFJLENBQUMsQ0FBQztJQUN0RSxZQUFZLENBQUMsS0FBSyxLQUFLLFNBQVMsQ0FBQyxDQUFDO0lBQ2xDLElBQUksTUFBTSxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQ3hCLFlBQVksQ0FBQyxJQUFJLENBQUMsTUFBTSxLQUFLLENBQUMsQ0FBQyxDQUFDO1FBQ2hDLE9BQU8sRUFBRSxJQUFJLEVBQUUsZ0JBQWdCLEVBQUUsQ0FBQztJQUNwQyxDQUFDO0lBQ0QsWUFBWSxDQUFDLE1BQU0sS0FBSyxXQUFXLENBQUMsQ0FBQztJQUNyQyxNQUFNLE9BQU8sR0FBRyxZQUFZLENBQUMsSUFBSSxFQUFFLENBQUMsZUFBZSxFQUFFLGFBQWEsQ0FBQyxDQUFDLENBQUM7SUFDckUsT0FBTztRQUNMLElBQUksRUFBRSxtQkFBbUI7UUFDekIsTUFBTSxFQUFFLEVBQUUsVUFBVSxFQUFFLE9BQU8sQ0FBQyxlQUFlLENBQUMsRUFBRSxlQUFlLEVBQUUsT0FBTyxDQUFDLGFBQWEsQ0FBQyxFQUFFO0tBQzFGLENBQUM7QUFDSixDQUFDLENBQUM7QUFFRix3RkFBd0Y7QUFDeEYsTUFBTSxZQUFZLEdBQUcsQ0FBQyxRQUFnQixFQUFVLEVBQUU7SUFDaEQsWUFBWSxDQUFDLG9CQUFvQixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsSUFBSSxNQUFNLENBQUMsYUFBYSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDNUYsT0FBTyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUM7QUFDMUIsQ0FBQyxDQUFDO0FBRUYsd0dBQXdHO0FBQ3hHLE1BQU0saUJBQWlCLEdBQUcsQ0FBQyxTQUE2QixFQUFFLE9BQTBCLEVBQWUsRUFBRTtJQUNuRyxZQUFZLENBQUMsU0FBUyxLQUFLLHNCQUFzQixDQUFDLENBQUM7SUFDbkQsTUFBTSxPQUFPLEdBQUcsWUFBWSxDQUFDLE9BQU8sRUFBRSxDQUFDLGNBQWMsRUFBRSx1QkFBdUIsRUFBRSxVQUFVLENBQUMsQ0FBQyxDQUFDO0lBQzdGLE1BQU0sVUFBVSxHQUFHLFlBQVksQ0FBQyxPQUFPLENBQUMsdUJBQXVCLENBQUMsQ0FBQyxDQUFDO0lBQ2xFLE1BQU0sVUFBVSxHQUFHLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUN2QyxZQUFZLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsVUFBVSxDQUFDLElBQUksT0FBTyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsVUFBVSxDQUFDLEtBQUssVUFBVTtXQUNoRyxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQzdDLE9BQU87UUFDTCxJQUFJLEVBQUUsNEJBQTRCO1FBQ2xDLE9BQU8sRUFBRSxFQUFFLFNBQVMsRUFBRSxPQUFPLENBQUMsY0FBYyxDQUFDLEVBQUUsa0JBQWtCLEVBQUUsVUFBVSxFQUFFO1FBQy9FLFVBQVU7S0FDWCxDQUFDO0FBQ0osQ0FBQyxDQUFDO0FBRUY7Ozs7OztHQU1HO0FBQ0gsTUFBTSxxQkFBcUIsR0FBRyxDQUFDLFNBQTZCLEVBQUUsT0FBMEIsRUFBZSxFQUFFO0lBQ3ZHLElBQUksU0FBUyxLQUFLLHFCQUFxQixFQUFFLENBQUM7UUFDeEMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxNQUFNLEtBQUssQ0FBQyxDQUFDLENBQUM7UUFDbkMsT0FBTyxFQUFFLElBQUksRUFBRSwrQkFBK0IsRUFBRSxDQUFDO0lBQ25ELENBQUM7SUFDRCxZQUFZLENBQUMsU0FBUyxLQUFLLG1CQUFtQixDQUFDLENBQUM7SUFDaEQsdUZBQXVGO0lBQ3ZGLFlBQVksQ0FBQyxPQUFPLENBQUMsTUFBTSxLQUFLLENBQUMsQ0FBQyxDQUFDO0lBQ25DLE1BQU0sVUFBVSxHQUFHLE9BQU8sQ0FBQyxDQUFDLENBQUMsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ3BELFlBQVksQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLEtBQUssU0FBUyxDQUFDLENBQUM7SUFDaEQsTUFBTSxPQUFPLEdBQUcsWUFBWSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FBQyxPQUFPLEVBQUUsUUFBUSxFQUFFLEVBQUUsQ0FBQyxRQUFRLEtBQUssVUFBVSxDQUFDLEVBQUUsQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDO0lBQzNHLE1BQU0sUUFBUSxHQUFHLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUNyQyxPQUFPO1FBQ0wsSUFBSSxFQUFFLDZCQUE2QjtRQUNuQyxRQUFRLEVBQUUsUUFBUSxLQUFLLFFBQVE7WUFDN0IsQ0FBQyxDQUFDLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRTtZQUNyQixDQUFDLENBQUMsRUFBRSxLQUFLLEVBQUUsU0FBUyxFQUFFLFFBQVEsRUFBRSxZQUFZLENBQUMsUUFBUSxDQUFDLEVBQUU7S0FDM0QsQ0FBQztBQUNKLENBQUMsQ0FBQyJ9

package/dist_ts_cliclient/corestorecontroltoken.d.ts

@@ -0,0 +1,33 @@
+import * as plugins from './plugins.js';
+type TCorestoreControlTokenSetRefusal = plugins.servezoneInterfaces.data.TCorestoreControlTokenSetRefusal;
+/** Cloudly did not store the token, for one of the contract's refusals, which it names. */
+export declare class CorestoreControlTokenSetRefusedError extends Error {
+    readonly refusal: TCorestoreControlTokenSetRefusal;
+    constructor(refusal: TCorestoreControlTokenSetRefusal);
+}
+/**
+ * The contract refusal an error is, or `undefined` for every other error.
+ *
+ * Cloudly answers a refusal by its name and nothing else, so the name is the whole of the error's
+ * message; any other message, Cloudly's one denial text included, is not a refusal.
+ */
+export declare const nameCorestoreControlTokenSetRefusal: (errorArg: unknown) => TCorestoreControlTokenSetRefusal | undefined;
+/** What the CLI prints about a stored token: the state it produced and its receipt, never the token. */
+export interface ICorestoreControlTokenSetOutput extends plugins.servezoneInterfaces.data.ICorestoreControlTokenSetResult {
+    ok: true;
+    command: 'corestore set-control-token';
+}
+/** What the CLI prints about the token's state: the state and its value-free receipts. */
+export interface ICorestoreControlTokenStateOutput extends plugins.servezoneInterfaces.data.ICorestoreControlTokenStateRead {
+    ok: true;
+    command: 'corestore control-token-state';
+}
+/**
+ * Stores the token through the API client while it is still exactly at `expected`, answering only
+ * the state and the receipt. The token bytes are the caller's to wipe; the text the request needs
+ * is decoded from them here and never printed, logged or put into an error.
+ */
+export declare const setCorestoreControlToken: (apiClientArg: plugins.servezoneApi.CloudlyApiClient, expectedArg: plugins.servezoneInterfaces.data.TCorestoreControlTokenState, tokenArg: Uint8Array) => Promise<ICorestoreControlTokenSetOutput>;
+/** Whether Cloudly holds the token, at which revision, and its receipts, oldest first. */
+export declare const getCorestoreControlTokenState: (apiClientArg: plugins.servezoneApi.CloudlyApiClient) => Promise<ICorestoreControlTokenStateOutput>;
+export {};

package/dist_ts_cliclient/corestorecontroltoken.js

@@ -0,0 +1,48 @@
+import * as plugins from './plugins.js';
+import { decodeCorestoreControlToken } from './tokeninput.js';
+/** Cloudly did not store the token, for one of the contract's refusals, which it names. */
+export class CorestoreControlTokenSetRefusedError extends Error {
+    constructor(refusal) {
+        super(`The Corestore control token was not stored: ${refusal}.`);
+        this.refusal = refusal;
+        this.name = 'CorestoreControlTokenSetRefusedError';
+    }
+}
+/**
+ * The contract refusal an error is, or `undefined` for every other error.
+ *
+ * Cloudly answers a refusal by its name and nothing else, so the name is the whole of the error's
+ * message; any other message, Cloudly's one denial text included, is not a refusal.
+ */
+export const nameCorestoreControlTokenSetRefusal = (errorArg) => {
+    if (!(errorArg instanceof Error))
+        return undefined;
+    return plugins.servezoneInterfaces.data.corestoreControlTokenSetRefusals
+        .find((refusalArg) => refusalArg === errorArg.message);
+};
+/**
+ * Stores the token through the API client while it is still exactly at `expected`, answering only
+ * the state and the receipt. The token bytes are the caller's to wipe; the text the request needs
+ * is decoded from them here and never printed, logged or put into an error.
+ */
+export const setCorestoreControlToken = async (apiClientArg, expectedArg, tokenArg) => {
+    try {
+        const { state, receipt } = await apiClientArg.platform.setCorestoreControlToken({
+            token: decodeCorestoreControlToken(tokenArg),
+            expected: expectedArg,
+        });
+        return { ok: true, command: 'corestore set-control-token', state, receipt };
+    }
+    catch (error) {
+        const refusal = nameCorestoreControlTokenSetRefusal(error);
+        if (refusal !== undefined)
+            throw new CorestoreControlTokenSetRefusedError(refusal);
+        throw error;
+    }
+};
+/** Whether Cloudly holds the token, at which revision, and its receipts, oldest first. */
+export const getCorestoreControlTokenState = async (apiClientArg) => {
+    const { state, receipts } = await apiClientArg.platform.getCorestoreControlTokenState();
+    return { ok: true, command: 'corestore control-token-state', state, receipts };
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29yZXN0b3JlY29udHJvbHRva2VuLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHNfY2xpY2xpZW50L2NvcmVzdG9yZWNvbnRyb2x0b2tlbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQUN4QyxPQUFPLEVBQUUsMkJBQTJCLEVBQUUsTUFBTSxpQkFBaUIsQ0FBQztBQUk5RCwyRkFBMkY7QUFDM0YsTUFBTSxPQUFPLG9DQUFxQyxTQUFRLEtBQUs7SUFDN0QsWUFBNEIsT0FBeUM7UUFDbkUsS0FBSyxDQUFDLCtDQUErQyxPQUFPLEdBQUcsQ0FBQyxDQUFDO1FBRHZDLFlBQU8sR0FBUCxPQUFPLENBQWtDO1FBRW5FLElBQUksQ0FBQyxJQUFJLEdBQUcsc0NBQXNDLENBQUM7SUFDckQsQ0FBQztDQUNGO0FBRUQ7Ozs7O0dBS0c7QUFDSCxNQUFNLENBQUMsTUFBTSxtQ0FBbUMsR0FBRyxDQUNqRCxRQUFpQixFQUM2QixFQUFFO0lBQ2hELElBQUksQ0FBQyxDQUFDLFFBQVEsWUFBWSxLQUFLLENBQUM7UUFBRSxPQUFPLFNBQVMsQ0FBQztJQUNuRCxPQUFPLE9BQU8sQ0FBQyxtQkFBbUIsQ0FBQyxJQUFJLENBQUMsZ0NBQWdDO1NBQ3JFLElBQUksQ0FBQyxDQUFDLFVBQVUsRUFBRSxFQUFFLENBQUMsVUFBVSxLQUFLLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQztBQUMzRCxDQUFDLENBQUM7QUFnQkY7Ozs7R0FJRztBQUNILE1BQU0sQ0FBQyxNQUFNLHdCQUF3QixHQUFHLEtBQUssRUFDM0MsWUFBbUQsRUFDbkQsV0FBeUUsRUFDekUsUUFBb0IsRUFDc0IsRUFBRTtJQUM1QyxJQUFJLENBQUM7UUFDSCxNQUFNLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxHQUFHLE1BQU0sWUFBWSxDQUFDLFFBQVEsQ0FBQyx3QkFBd0IsQ0FBQztZQUM5RSxLQUFLLEVBQUUsMkJBQTJCLENBQUMsUUFBUSxDQUFDO1lBQzVDLFFBQVEsRUFBRSxXQUFXO1NBQ3RCLENBQUMsQ0FBQztRQUNILE9BQU8sRUFBRSxFQUFFLEVBQUUsSUFBSSxFQUFFLE9BQU8sRUFBRSw2QkFBNkIsRUFBRSxLQUFLLEVBQUUsT0FBTyxFQUFFLENBQUM7SUFDOUUsQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDZixNQUFNLE9BQU8sR0FBRyxtQ0FBbUMsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUMzRCxJQUFJLE9BQU8sS0FBSyxTQUFTO1lBQUUsTUFBTSxJQUFJLG9DQUFvQyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ25GLE1BQU0sS0FBSyxDQUFDO0lBQ2QsQ0FBQztBQUNILENBQUMsQ0FBQztBQUVGLDBGQUEwRjtBQUMxRixNQUFNLENBQUMsTUFBTSw2QkFBNkIsR0FBRyxLQUFLLEVBQ2hELFlBQW1ELEVBQ1AsRUFBRTtJQUM5QyxNQUFNLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRSxHQUFHLE1BQU0sWUFBWSxDQUFDLFFBQVEsQ0FBQyw2QkFBNkIsRUFBRSxDQUFDO0lBQ3hGLE9BQU8sRUFBRSxFQUFFLEVBQUUsSUFBSSxFQUFFLE9BQU8sRUFBRSwrQkFBK0IsRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFLENBQUM7QUFDakYsQ0FBQyxDQUFDIn0=

package/dist_ts_cliclient/index.d.ts

@@ -1,3 +1,5 @@
 export { CliUsageError, parseCliCommand, type TCliCommand } from './commands.js';
-export { BootstrapTokenInputError, readBootstrapTokenInput, type TBootstrapTokenInputRefusal, } from './tokeninput.js';
+export { RelayAuthorizationOutputError, exportRelayAuthorizationToFile, requirePrivateOutputDirectory, writeRelayAuthorization, type IRelayAuthorizationOutput, type TRelayAuthorizationOutputRefusal, } from './relayauthorization.js';
+export { BootstrapTokenInputError, CorestoreControlTokenInputError, TokenInputError, readBootstrapTokenInput, readCorestoreControlTokenInput, type TBootstrapTokenInputRefusal, type TTokenInputRefusal, } from './tokeninput.js';
+export { CorestoreControlTokenSetRefusedError, getCorestoreControlTokenState, nameCorestoreControlTokenSetRefusal, setCorestoreControlToken, type ICorestoreControlTokenSetOutput, type ICorestoreControlTokenStateOutput, } from './corestorecontroltoken.js';
 export declare const runCli: () => Promise<void>;

package/dist_ts_cliclient/index.js

@@ -1,18 +1,32 @@
 import * as plugins from './plugins.js';
 import { CliClient } from './classes.cliclient.js';
 import { parseCliCommand } from './commands.js';
-import { readBootstrapTokenInput } from './tokeninput.js';
+import { readBootstrapTokenInput, readCorestoreControlTokenInput } from './tokeninput.js';
+import { requirePrivateOutputDirectory } from './relayauthorization.js';
 export { CliUsageError, parseCliCommand } from './commands.js';
-export { BootstrapTokenInputError, readBootstrapTokenInput, } from './tokeninput.js';
+export { RelayAuthorizationOutputError, exportRelayAuthorizationToFile, requirePrivateOutputDirectory, writeRelayAuthorization, } from './relayauthorization.js';
+export { BootstrapTokenInputError, CorestoreControlTokenInputError, TokenInputError, readBootstrapTokenInput, readCorestoreControlTokenInput, } from './tokeninput.js';
+export { CorestoreControlTokenSetRefusedError, getCorestoreControlTokenState, nameCorestoreControlTokenSetRefusal, setCorestoreControlToken, } from './corestorecontroltoken.js';
+/** Reads the token the command needs from stdin, before anything connects. */
+const readInvocation = async (commandArg) => {
+    if (commandArg.kind === 'gateway-bootstrap') {
+        return { ...commandArg, bootstrapToken: await readBootstrapTokenInput(process.stdin) };
+    }
+    if (commandArg.kind === 'corestore-set-control-token') {
+        return { ...commandArg, controlToken: await readCorestoreControlTokenInput(process.stdin) };
+    }
+    return commandArg;
+};
 export const runCli = async () => {
     // The command and the token are settled before anything connects, so a wrong invocation or a
     // token that could never be one fails without reaching Cloudly.
     let command;
     try {
-        const parsed = parseCliCommand(process.argv.slice(2));
-        command = parsed.kind === 'gateway-bootstrap'
-            ? { ...parsed, bootstrapToken: await readBootstrapTokenInput(process.stdin) }
-            : parsed;
+        command = await readInvocation(parseCliCommand(process.argv.slice(2)));
+        // An output the bearer could not be written to fetches no bearer and records no export.
+        if (command.kind === 'relay-export-authorization') {
+            await requirePrivateOutputDirectory(command.outputPath);
+        }
     }
     catch (error) {
         console.error(error.message);
@@ -31,12 +45,21 @@ export const runCli = async () => {
             if (command.kind === 'gateway-bootstrap') {
                 await cliClient.bootstrapGateway(command.target, command.bootstrapToken);
             }
+            else if (command.kind === 'relay-export-authorization') {
+                await cliClient.exportRelayAuthorization(command.request, command.outputPath);
+            }
+            else if (command.kind === 'corestore-set-control-token') {
+                await cliClient.setCorestoreControlToken(command.expected, command.controlToken);
+            }
+            else if (command.kind === 'corestore-control-token-state') {
+                await cliClient.getCorestoreControlTokenState();
+            }
             else {
                 await cliClient.getGatewayStatus();
             }
         }
         catch (error) {
-            // Cloudly answers a refusal by name; it never carries the token.
+            // Cloudly answers a refusal by name; it never carries a token or a bearer.
             console.error(error.message);
             process.exitCode = 1;
         }
@@ -47,6 +70,8 @@ export const runCli = async () => {
     finally {
         if (command.kind === 'gateway-bootstrap')
             command.bootstrapToken.fill(0);
+        if (command.kind === 'corestore-set-control-token')
+            command.controlToken.fill(0);
     }
 };
 /** The API client, started and signed in the way every command of this CLI signs in. */
@@ -82,4 +107,4 @@ const connect = async () => {
     }
     return apiClient;
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90c19jbGljbGllbnQvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFDeEMsT0FBTyxFQUFFLFNBQVMsRUFBRSxNQUFNLHdCQUF3QixDQUFDO0FBQ25ELE9BQU8sRUFBRSxlQUFlLEVBQW9CLE1BQU0sZUFBZSxDQUFDO0FBQ2xFLE9BQU8sRUFBRSx1QkFBdUIsRUFBRSxNQUFNLGlCQUFpQixDQUFDO0FBRTFELE9BQU8sRUFBRSxhQUFhLEVBQUUsZUFBZSxFQUFvQixNQUFNLGVBQWUsQ0FBQztBQUNqRixPQUFPLEVBQ0wsd0JBQXdCLEVBQ3hCLHVCQUF1QixHQUV4QixNQUFNLGlCQUFpQixDQUFDO0FBT3pCLE1BQU0sQ0FBQyxNQUFNLE1BQU0sR0FBRyxLQUFLLElBQUksRUFBRTtJQUMvQiw2RkFBNkY7SUFDN0YsZ0VBQWdFO0lBQ2hFLElBQUksT0FBdUIsQ0FBQztJQUM1QixJQUFJLENBQUM7UUFDSCxNQUFNLE1BQU0sR0FBRyxlQUFlLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUN0RCxPQUFPLEdBQUcsTUFBTSxDQUFDLElBQUksS0FBSyxtQkFBbUI7WUFDM0MsQ0FBQyxDQUFDLEVBQUUsR0FBRyxNQUFNLEVBQUUsY0FBYyxFQUFFLE1BQU0sdUJBQXVCLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxFQUFFO1lBQzdFLENBQUMsQ0FBQyxNQUFNLENBQUM7SUFDYixDQUFDO0lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztRQUNmLE9BQU8sQ0FBQyxLQUFLLENBQUUsS0FBZSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ3hDLE9BQU8sQ0FBQyxRQUFRLEdBQUcsQ0FBQyxDQUFDO1FBQ3JCLE9BQU87SUFDVCxDQUFDO0lBRUQsSUFBSSxDQUFDO1FBQ0gsTUFBTSxTQUFTLEdBQUcsTUFBTSxPQUFPLEVBQUUsQ0FBQztRQUNsQyxNQUFNLFNBQVMsR0FBRyxJQUFJLFNBQVMsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUMzQyxJQUFJLE9BQU8sQ0FBQyxJQUFJLEtBQUssVUFBVSxFQUFFLENBQUM7WUFDaEMseUVBQXlFO1lBQ3pFLE1BQU0sU0FBUyxDQUFDLFdBQVcsRUFBRSxDQUFDO1lBQzlCLE9BQU87UUFDVCxDQUFDO1FBQ0QsSUFBSSxDQUFDO1lBQ0gsSUFBSSxPQUFPLENBQUMsSUFBSSxLQUFLLG1CQUFtQixFQUFFLENBQUM7Z0JBQ3pDLE1BQU0sU0FBUyxDQUFDLGdCQUFnQixDQUFDLE9BQU8sQ0FBQyxNQUFNLEVBQUUsT0FBTyxDQUFDLGNBQWMsQ0FBQyxDQUFDO1lBQzNFLENBQUM7aUJBQU0sQ0FBQztnQkFDTixNQUFNLFNBQVMsQ0FBQyxnQkFBZ0IsRUFBRSxDQUFDO1lBQ3JDLENBQUM7UUFDSCxDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLGlFQUFpRTtZQUNqRSxPQUFPLENBQUMsS0FBSyxDQUFFLEtBQWUsQ0FBQyxPQUFPLENBQUMsQ0FBQztZQUN4QyxPQUFPLENBQUMsUUFBUSxHQUFHLENBQUMsQ0FBQztRQUN2QixDQUFDO2dCQUFTLENBQUM7WUFDVCxNQUFNLFNBQVMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUN6QixDQUFDO0lBQ0gsQ0FBQztZQUFTLENBQUM7UUFDVCxJQUFJLE9BQU8sQ0FBQyxJQUFJLEtBQUssbUJBQW1CO1lBQUUsT0FBTyxDQUFDLGNBQWMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDM0UsQ0FBQztBQUNILENBQUMsQ0FBQztBQUVGLHdGQUF3RjtBQUN4RixNQUFNLE9BQU8sR0FBRyxLQUFLLElBQW9ELEVBQUU7SUFDekUsNkZBQTZGO0lBQzdGLDhGQUE4RjtJQUM5RixnR0FBZ0c7SUFDaEcsMEZBQTBGO0lBQzFGLE1BQU0sT0FBTyxHQUFHLElBQUksT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRSxFQUFFLFNBQVMsRUFBRSxLQUFLLENBQUMsQ0FBQztJQUN2RSxNQUFNLFVBQVUsR0FBRyxNQUFNLE9BQU8sQ0FBQyxpQkFBaUIsQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUNsRSxNQUFNLEtBQUssR0FBRyxPQUFPLENBQUMsR0FBRyxDQUFDLGFBQWEsQ0FBQztJQUN4QyxNQUFNLFFBQVEsR0FBRyxPQUFPLENBQUMsR0FBRyxDQUFDLGdCQUFnQixDQUFDO0lBQzlDLE1BQU0sUUFBUSxHQUFHLE9BQU8sQ0FBQyxHQUFHLENBQUMsZ0JBQWdCLENBQUM7SUFFOUMsTUFBTSxTQUFTLEdBQUcsSUFBSSxPQUFPLENBQUMsWUFBWSxDQUFDLGdCQUFnQixDQUFDO1FBQzFELFVBQVUsRUFBRSxLQUFLO1FBQ2pCLFVBQVU7S0FDWCxDQUFDLENBQUM7SUFDSCxNQUFNLFNBQVMsQ0FBQyxLQUFLLEVBQUUsQ0FBQztJQUV4QixJQUFJLENBQUM7UUFDSCxJQUFJLEtBQUssRUFBRSxDQUFDO1lBQ1YsTUFBTSxTQUFTLENBQUMsa0JBQWtCLENBQUMsS0FBSyxFQUFFLEVBQUUsYUFBYSxFQUFFLElBQUksRUFBRSxpQkFBaUIsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQzlGLENBQUM7YUFBTSxJQUFJLFFBQVEsSUFBSSxRQUFRLEVBQUUsQ0FBQztZQUNoQyxNQUFNLFNBQVMsQ0FBQyw0QkFBNEIsQ0FBQyxRQUFRLEVBQUUsUUFBUSxDQUFDLENBQUM7UUFDbkUsQ0FBQzthQUFNLENBQUM7WUFDTixPQUFPLENBQUMsR0FBRyxDQUFDLGtGQUFrRixDQUFDLENBQUM7UUFDbEcsQ0FBQztJQUNILENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsTUFBTSxTQUFTLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDdkIsTUFBTSxLQUFLLENBQUM7SUFDZCxDQUFDO0lBQ0QsT0FBTyxTQUFTLENBQUM7QUFDbkIsQ0FBQyxDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90c19jbGljbGllbnQvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFDeEMsT0FBTyxFQUFFLFNBQVMsRUFBRSxNQUFNLHdCQUF3QixDQUFDO0FBQ25ELE9BQU8sRUFBRSxlQUFlLEVBQW9CLE1BQU0sZUFBZSxDQUFDO0FBQ2xFLE9BQU8sRUFBRSx1QkFBdUIsRUFBRSw4QkFBOEIsRUFBRSxNQUFNLGlCQUFpQixDQUFDO0FBQzFGLE9BQU8sRUFBRSw2QkFBNkIsRUFBRSxNQUFNLHlCQUF5QixDQUFDO0FBRXhFLE9BQU8sRUFBRSxhQUFhLEVBQUUsZUFBZSxFQUFvQixNQUFNLGVBQWUsQ0FBQztBQUNqRixPQUFPLEVBQ0wsNkJBQTZCLEVBQzdCLDhCQUE4QixFQUM5Qiw2QkFBNkIsRUFDN0IsdUJBQXVCLEdBR3hCLE1BQU0seUJBQXlCLENBQUM7QUFDakMsT0FBTyxFQUNMLHdCQUF3QixFQUN4QiwrQkFBK0IsRUFDL0IsZUFBZSxFQUNmLHVCQUF1QixFQUN2Qiw4QkFBOEIsR0FHL0IsTUFBTSxpQkFBaUIsQ0FBQztBQUN6QixPQUFPLEVBQ0wsb0NBQW9DLEVBQ3BDLDZCQUE2QixFQUM3QixtQ0FBbUMsRUFDbkMsd0JBQXdCLEdBR3pCLE1BQU0sNEJBQTRCLENBQUM7QUFXcEMsOEVBQThFO0FBQzlFLE1BQU0sY0FBYyxHQUFHLEtBQUssRUFBRSxVQUF1QixFQUEyQixFQUFFO0lBQ2hGLElBQUksVUFBVSxDQUFDLElBQUksS0FBSyxtQkFBbUIsRUFBRSxDQUFDO1FBQzVDLE9BQU8sRUFBRSxHQUFHLFVBQVUsRUFBRSxjQUFjLEVBQUUsTUFBTSx1QkFBdUIsQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztJQUN6RixDQUFDO0lBQ0QsSUFBSSxVQUFVLENBQUMsSUFBSSxLQUFLLDZCQUE2QixFQUFFLENBQUM7UUFDdEQsT0FBTyxFQUFFLEdBQUcsVUFBVSxFQUFFLFlBQVksRUFBRSxNQUFNLDhCQUE4QixDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO0lBQzlGLENBQUM7SUFDRCxPQUFPLFVBQVUsQ0FBQztBQUNwQixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxNQUFNLEdBQUcsS0FBSyxJQUFJLEVBQUU7SUFDL0IsNkZBQTZGO0lBQzdGLGdFQUFnRTtJQUNoRSxJQUFJLE9BQXVCLENBQUM7SUFDNUIsSUFBSSxDQUFDO1FBQ0gsT0FBTyxHQUFHLE1BQU0sY0FBYyxDQUFDLGVBQWUsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDdkUsd0ZBQXdGO1FBQ3hGLElBQUksT0FBTyxDQUFDLElBQUksS0FBSyw0QkFBNEIsRUFBRSxDQUFDO1lBQ2xELE1BQU0sNkJBQTZCLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBQzFELENBQUM7SUFDSCxDQUFDO0lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztRQUNmLE9BQU8sQ0FBQyxLQUFLLENBQUUsS0FBZSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ3hDLE9BQU8sQ0FBQyxRQUFRLEdBQUcsQ0FBQyxDQUFDO1FBQ3JCLE9BQU87SUFDVCxDQUFDO0lBRUQsSUFBSSxDQUFDO1FBQ0gsTUFBTSxTQUFTLEdBQUcsTUFBTSxPQUFPLEVBQUUsQ0FBQztRQUNsQyxNQUFNLFNBQVMsR0FBRyxJQUFJLFNBQVMsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUMzQyxJQUFJLE9BQU8sQ0FBQyxJQUFJLEtBQUssVUFBVSxFQUFFLENBQUM7WUFDaEMseUVBQXlFO1lBQ3pFLE1BQU0sU0FBUyxDQUFDLFdBQVcsRUFBRSxDQUFDO1lBQzlCLE9BQU87UUFDVCxDQUFDO1FBQ0QsSUFBSSxDQUFDO1lBQ0gsSUFBSSxPQUFPLENBQUMsSUFBSSxLQUFLLG1CQUFtQixFQUFFLENBQUM7Z0JBQ3pDLE1BQU0sU0FBUyxDQUFDLGdCQUFnQixDQUFDLE9BQU8sQ0FBQyxNQUFNLEVBQUUsT0FBTyxDQUFDLGNBQWMsQ0FBQyxDQUFDO1lBQzNFLENBQUM7aUJBQU0sSUFBSSxPQUFPLENBQUMsSUFBSSxLQUFLLDRCQUE0QixFQUFFLENBQUM7Z0JBQ3pELE1BQU0sU0FBUyxDQUFDLHdCQUF3QixDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsT0FBTyxDQUFDLFVBQVUsQ0FBQyxDQUFDO1lBQ2hGLENBQUM7aUJBQU0sSUFBSSxPQUFPLENBQUMsSUFBSSxLQUFLLDZCQUE2QixFQUFFLENBQUM7Z0JBQzFELE1BQU0sU0FBUyxDQUFDLHdCQUF3QixDQUFDLE9BQU8sQ0FBQyxRQUFRLEVBQUUsT0FBTyxDQUFDLFlBQVksQ0FBQyxDQUFDO1lBQ25GLENBQUM7aUJBQU0sSUFBSSxPQUFPLENBQUMsSUFBSSxLQUFLLCtCQUErQixFQUFFLENBQUM7Z0JBQzVELE1BQU0sU0FBUyxDQUFDLDZCQUE2QixFQUFFLENBQUM7WUFDbEQsQ0FBQztpQkFBTSxDQUFDO2dCQUNOLE1BQU0sU0FBUyxDQUFDLGdCQUFnQixFQUFFLENBQUM7WUFDckMsQ0FBQztRQUNILENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsMkVBQTJFO1lBQzNFLE9BQU8sQ0FBQyxLQUFLLENBQUUsS0FBZSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1lBQ3hDLE9BQU8sQ0FBQyxRQUFRLEdBQUcsQ0FBQyxDQUFDO1FBQ3ZCLENBQUM7Z0JBQVMsQ0FBQztZQUNULE1BQU0sU0FBUyxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ3pCLENBQUM7SUFDSCxDQUFDO1lBQVMsQ0FBQztRQUNULElBQUksT0FBTyxDQUFDLElBQUksS0FBSyxtQkFBbUI7WUFBRSxPQUFPLENBQUMsY0FBYyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUN6RSxJQUFJLE9BQU8sQ0FBQyxJQUFJLEtBQUssNkJBQTZCO1lBQUUsT0FBTyxDQUFDLFlBQVksQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDbkYsQ0FBQztBQUNILENBQUMsQ0FBQztBQUVGLHdGQUF3RjtBQUN4RixNQUFNLE9BQU8sR0FBRyxLQUFLLElBQW9ELEVBQUU7SUFDekUsNkZBQTZGO0lBQzdGLDhGQUE4RjtJQUM5RixnR0FBZ0c7SUFDaEcsMEZBQTBGO0lBQzFGLE1BQU0sT0FBTyxHQUFHLElBQUksT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRSxFQUFFLFNBQVMsRUFBRSxLQUFLLENBQUMsQ0FBQztJQUN2RSxNQUFNLFVBQVUsR0FBRyxNQUFNLE9BQU8sQ0FBQyxpQkFBaUIsQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUNsRSxNQUFNLEtBQUssR0FBRyxPQUFPLENBQUMsR0FBRyxDQUFDLGFBQWEsQ0FBQztJQUN4QyxNQUFNLFFBQVEsR0FBRyxPQUFPLENBQUMsR0FBRyxDQUFDLGdCQUFnQixDQUFDO0lBQzlDLE1BQU0sUUFBUSxHQUFHLE9BQU8sQ0FBQyxHQUFHLENBQUMsZ0JBQWdCLENBQUM7SUFFOUMsTUFBTSxTQUFTLEdBQUcsSUFBSSxPQUFPLENBQUMsWUFBWSxDQUFDLGdCQUFnQixDQUFDO1FBQzFELFVBQVUsRUFBRSxLQUFLO1FBQ2pCLFVBQVU7S0FDWCxDQUFDLENBQUM7SUFDSCxNQUFNLFNBQVMsQ0FBQyxLQUFLLEVBQUUsQ0FBQztJQUV4QixJQUFJLENBQUM7UUFDSCxJQUFJLEtBQUssRUFBRSxDQUFDO1lBQ1YsTUFBTSxTQUFTLENBQUMsa0JBQWtCLENBQUMsS0FBSyxFQUFFLEVBQUUsYUFBYSxFQUFFLElBQUksRUFBRSxpQkFBaUIsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQzlGLENBQUM7YUFBTSxJQUFJLFFBQVEsSUFBSSxRQUFRLEVBQUUsQ0FBQztZQUNoQyxNQUFNLFNBQVMsQ0FBQyw0QkFBNEIsQ0FBQyxRQUFRLEVBQUUsUUFBUSxDQUFDLENBQUM7UUFDbkUsQ0FBQzthQUFNLENBQUM7WUFDTixPQUFPLENBQUMsR0FBRyxDQUFDLGtGQUFrRixDQUFDLENBQUM7UUFDbEcsQ0FBQztJQUNILENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsTUFBTSxTQUFTLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDdkIsTUFBTSxLQUFLLENBQUM7SUFDZCxDQUFDO0lBQ0QsT0FBTyxTQUFTLENBQUM7QUFDbkIsQ0FBQyxDQUFDIn0=

package/dist_ts_cliclient/plugins.d.ts

@@ -1,6 +1,12 @@
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+export { crypto, fs, path, };
 import * as servezoneApi from '@serve.zone/api';
 import * as servezoneInterfaces from '@serve.zone/interfaces';
-export { servezoneApi, servezoneInterfaces };
+import * as servezoneInterfacesRuntime from '@serve.zone/interfaces/runtime';
+export { servezoneApi, servezoneInterfaces, servezoneInterfacesRuntime, };
 import * as projectinfo from '@push.rocks/projectinfo';
 import * as qenv from '@push.rocks/qenv';
-export { projectinfo, qenv, };
+import * as smartfs from '@push.rocks/smartfs';
+export { projectinfo, qenv, smartfs, };

package/dist_ts_cliclient/plugins.js

@@ -1,9 +1,16 @@
+// node native scope
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+export { crypto, fs, path, };
 // @serve.zone scope
 import * as servezoneApi from '@serve.zone/api';
 import * as servezoneInterfaces from '@serve.zone/interfaces';
-export { servezoneApi, servezoneInterfaces };
+import * as servezoneInterfacesRuntime from '@serve.zone/interfaces/runtime';
+export { servezoneApi, servezoneInterfaces, servezoneInterfacesRuntime, };
 // @push.rocks scope
 import * as projectinfo from '@push.rocks/projectinfo';
 import * as qenv from '@push.rocks/qenv';
-export { projectinfo, qenv, };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzX2NsaWNsaWVudC9wbHVnaW5zLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLG9CQUFvQjtBQUNwQixPQUFPLEtBQUssWUFBWSxNQUFNLGlCQUFpQixDQUFDO0FBQ2hELE9BQU8sS0FBSyxtQkFBbUIsTUFBTSx3QkFBd0IsQ0FBQztBQUU5RCxPQUFPLEVBQ0wsWUFBWSxFQUNaLG1CQUFtQixFQUNwQixDQUFBO0FBRUQsb0JBQW9CO0FBQ3BCLE9BQU8sS0FBSyxXQUFXLE1BQU0seUJBQXlCLENBQUM7QUFDdkQsT0FBTyxLQUFLLElBQUksTUFBTSxrQkFBa0IsQ0FBQztBQUV6QyxPQUFPLEVBQ0wsV0FBVyxFQUNYLElBQUksR0FDTCxDQUFBIn0=
+import * as smartfs from '@push.rocks/smartfs';
+export { projectinfo, qenv, smartfs, };
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzX2NsaWNsaWVudC9wbHVnaW5zLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLG9CQUFvQjtBQUNwQixPQUFPLEtBQUssTUFBTSxNQUFNLGFBQWEsQ0FBQztBQUN0QyxPQUFPLEtBQUssRUFBRSxNQUFNLGtCQUFrQixDQUFDO0FBQ3ZDLE9BQU8sS0FBSyxJQUFJLE1BQU0sV0FBVyxDQUFDO0FBRWxDLE9BQU8sRUFDTCxNQUFNLEVBQ04sRUFBRSxFQUNGLElBQUksR0FDTCxDQUFBO0FBRUQsb0JBQW9CO0FBQ3BCLE9BQU8sS0FBSyxZQUFZLE1BQU0saUJBQWlCLENBQUM7QUFDaEQsT0FBTyxLQUFLLG1CQUFtQixNQUFNLHdCQUF3QixDQUFDO0FBQzlELE9BQU8sS0FBSywwQkFBMEIsTUFBTSxnQ0FBZ0MsQ0FBQztBQUU3RSxPQUFPLEVBQ0wsWUFBWSxFQUNaLG1CQUFtQixFQUNuQiwwQkFBMEIsR0FDM0IsQ0FBQTtBQUVELG9CQUFvQjtBQUNwQixPQUFPLEtBQUssV0FBVyxNQUFNLHlCQUF5QixDQUFDO0FBQ3ZELE9BQU8sS0FBSyxJQUFJLE1BQU0sa0JBQWtCLENBQUM7QUFDekMsT0FBTyxLQUFLLE9BQU8sTUFBTSxxQkFBcUIsQ0FBQztBQUUvQyxPQUFPLEVBQ0wsV0FBVyxFQUNYLElBQUksRUFDSixPQUFPLEdBQ1IsQ0FBQSJ9

package/dist_ts_cliclient/relayauthorization.d.ts

@@ -0,0 +1,48 @@
+import * as plugins from './plugins.js';
+/** Why the relay bearer was not written, named without quoting the bearer. */
+export type TRelayAuthorizationOutputRefusal = 
+/** The output's directory does not exist, or a component of its path is not a directory. */
+'output-directory-missing'
+/**
+ * The output's directory is not a private directory of the caller: it is reached through a
+ * symbolic link, owned by another user, or writable by its group or by other users.
+ */
+ | 'output-directory-not-private'
+/** Something already exists at the output path; it is left untouched. */
+ | 'output-exists';
+export declare class RelayAuthorizationOutputError extends Error {
+    readonly refusal: TRelayAuthorizationOutputRefusal;
+    constructor(refusal: TRelayAuthorizationOutputRefusal);
+}
+/** What the CLI prints about the file it wrote: metadata only, never a byte of the bearer. */
+export interface IRelayAuthorizationOutput {
+    clusterId: string;
+    generation: number;
+    outputPath: string;
+    byteLength: number;
+    /** Hex SHA-256 of the file's bytes, as `sha256sum` prints it for the same file. */
+    sha256: string;
+    /** The audit receipt Cloudly recorded for this export. */
+    receiptId: string;
+}
+/**
+ * Refuses an output whose directory is not a private directory of the caller, or that exists.
+ *
+ * Exclusive creation guards only the file's own name, so the directory is checked here: its path
+ * resolves to itself (no symbolic link anywhere on it), it is a directory owned by the caller,
+ * and neither its group nor other users can write it. Checked before Cloudly is asked, so a bad
+ * output fetches no bearer and writes no audit receipt.
+ */
+export declare const requirePrivateOutputDirectory: (outputPathArg: string) => Promise<void>;
+/**
+ * Writes the bearer as a new file, mode 0600 whatever the umask, whole or not at all.
+ *
+ * The write is exclusive and atomic: an existing entry at the path is never replaced or
+ * followed, and the bytes go to a private temporary file that is linked into place.
+ */
+export declare const writeRelayAuthorization: (outputPathArg: string, bearerArg: Uint8Array) => Promise<void>;
+/**
+ * Fetches one cluster relay's bearer through the API client and writes it to the operator's
+ * file, answering only what describes the file.
+ */
+export declare const exportRelayAuthorizationToFile: (apiClientArg: plugins.servezoneApi.CloudlyApiClient, requestArg: plugins.servezoneInterfaces.data.IClusterRelayAuthorizationExportRequest, outputPathArg: string) => Promise<IRelayAuthorizationOutput>;

package/dist_ts_cliclient/relayauthorization.js

@@ -0,0 +1,95 @@
+import * as plugins from './plugins.js';
+export class RelayAuthorizationOutputError extends Error {
+    constructor(refusal) {
+        super(`The relay bearer was not written: ${refusal}.`);
+        this.refusal = refusal;
+        this.name = 'RelayAuthorizationOutputError';
+    }
+}
+const errorCodeOf = (errorArg) => errorArg instanceof Error && 'code' in errorArg && typeof errorArg.code === 'string'
+    ? errorArg.code : undefined;
+/** A directory that is not there, or not reachable as one, is the operator's to create. */
+const refuseMissingDirectory = (errorArg) => {
+    const code = errorCodeOf(errorArg);
+    if (code === 'ENOENT' || code === 'ENOTDIR') {
+        throw new RelayAuthorizationOutputError('output-directory-missing');
+    }
+    throw errorArg;
+};
+/**
+ * Refuses an output whose directory is not a private directory of the caller, or that exists.
+ *
+ * Exclusive creation guards only the file's own name, so the directory is checked here: its path
+ * resolves to itself (no symbolic link anywhere on it), it is a directory owned by the caller,
+ * and neither its group nor other users can write it. Checked before Cloudly is asked, so a bad
+ * output fetches no bearer and writes no audit receipt.
+ */
+export const requirePrivateOutputDirectory = async (outputPathArg) => {
+    const directory = plugins.path.dirname(outputPathArg);
+    const stats = await plugins.fs.lstat(directory).catch(refuseMissingDirectory);
+    const resolved = await plugins.fs.realpath(directory).catch(refuseMissingDirectory);
+    // A symbolic link anywhere on the path is a directory someone else could redirect.
+    if (resolved !== directory)
+        throw new RelayAuthorizationOutputError('output-directory-not-private');
+    if (!stats.isDirectory())
+        throw new RelayAuthorizationOutputError('output-directory-missing');
+    if (stats.uid !== process.getuid?.() || (stats.mode & 0o022) !== 0) {
+        throw new RelayAuthorizationOutputError('output-directory-not-private');
+    }
+    try {
+        await plugins.fs.lstat(outputPathArg);
+    }
+    catch (error) {
+        if (errorCodeOf(error) === 'ENOENT')
+            return;
+        throw error;
+    }
+    throw new RelayAuthorizationOutputError('output-exists');
+};
+/**
+ * Writes the bearer as a new file, mode 0600 whatever the umask, whole or not at all.
+ *
+ * The write is exclusive and atomic: an existing entry at the path is never replaced or
+ * followed, and the bytes go to a private temporary file that is linked into place.
+ */
+export const writeRelayAuthorization = async (outputPathArg, bearerArg) => {
+    await requirePrivateOutputDirectory(outputPathArg);
+    const smartFs = new plugins.smartfs.SmartFs(new plugins.smartfs.SmartFsProviderNode());
+    const bytes = Buffer.from(bearerArg);
+    try {
+        await smartFs.file(outputPathArg).mode(0o600).exclusive().atomic().write(bytes);
+    }
+    catch (error) {
+        if (error instanceof plugins.smartfs.SmartFsExclusiveWriteError) {
+            throw new RelayAuthorizationOutputError(error.code === 'EEXIST' ? 'output-exists' : 'output-directory-missing');
+        }
+        throw error;
+    }
+    finally {
+        bytes.fill(0);
+    }
+};
+/**
+ * Fetches one cluster relay's bearer through the API client and writes it to the operator's
+ * file, answering only what describes the file.
+ */
+export const exportRelayAuthorizationToFile = async (apiClientArg, requestArg, outputPathArg) => {
+    await requirePrivateOutputDirectory(outputPathArg);
+    const exported = await apiClientArg.cluster.exportClusterRelayAuthorization(requestArg);
+    const bearer = new TextEncoder().encode(exported.authorization);
+    try {
+        await writeRelayAuthorization(outputPathArg, bearer);
+        return {
+            clusterId: exported.credential.clusterId,
+            generation: exported.credential.generation,
+            outputPath: outputPathArg,
+            byteLength: bearer.byteLength,
+            sha256: plugins.crypto.createHash('sha256').update(bearer).digest('hex'),
+            receiptId: exported.receipt.id,
+        };
+    }
+    finally {
+        bearer.fill(0);
+    }
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVsYXlhdXRob3JpemF0aW9uLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHNfY2xpY2xpZW50L3JlbGF5YXV0aG9yaXphdGlvbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQWN4QyxNQUFNLE9BQU8sNkJBQThCLFNBQVEsS0FBSztJQUN0RCxZQUE0QixPQUF5QztRQUNuRSxLQUFLLENBQUMscUNBQXFDLE9BQU8sR0FBRyxDQUFDLENBQUM7UUFEN0IsWUFBTyxHQUFQLE9BQU8sQ0FBa0M7UUFFbkUsSUFBSSxDQUFDLElBQUksR0FBRywrQkFBK0IsQ0FBQztJQUM5QyxDQUFDO0NBQ0Y7QUFjRCxNQUFNLFdBQVcsR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FDNUQsUUFBUSxZQUFZLEtBQUssSUFBSSxNQUFNLElBQUksUUFBUSxJQUFJLE9BQU8sUUFBUSxDQUFDLElBQUksS0FBSyxRQUFRO0lBQ2xGLENBQUMsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7QUFFaEMsMkZBQTJGO0FBQzNGLE1BQU0sc0JBQXNCLEdBQUcsQ0FBQyxRQUFpQixFQUFTLEVBQUU7SUFDMUQsTUFBTSxJQUFJLEdBQUcsV0FBVyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ25DLElBQUksSUFBSSxLQUFLLFFBQVEsSUFBSSxJQUFJLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDNUMsTUFBTSxJQUFJLDZCQUE2QixDQUFDLDBCQUEwQixDQUFDLENBQUM7SUFDdEUsQ0FBQztJQUNELE1BQU0sUUFBUSxDQUFDO0FBQ2pCLENBQUMsQ0FBQztBQUVGOzs7Ozs7O0dBT0c7QUFDSCxNQUFNLENBQUMsTUFBTSw2QkFBNkIsR0FBRyxLQUFLLEVBQUUsYUFBcUIsRUFBaUIsRUFBRTtJQUMxRixNQUFNLFNBQVMsR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUN0RCxNQUFNLEtBQUssR0FBRyxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxzQkFBc0IsQ0FBQyxDQUFDO0lBQzlFLE1BQU0sUUFBUSxHQUFHLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLENBQUMsS0FBSyxDQUFDLHNCQUFzQixDQUFDLENBQUM7SUFDcEYsbUZBQW1GO0lBQ25GLElBQUksUUFBUSxLQUFLLFNBQVM7UUFBRSxNQUFNLElBQUksNkJBQTZCLENBQUMsOEJBQThCLENBQUMsQ0FBQztJQUNwRyxJQUFJLENBQUMsS0FBSyxDQUFDLFdBQVcsRUFBRTtRQUFFLE1BQU0sSUFBSSw2QkFBNkIsQ0FBQywwQkFBMEIsQ0FBQyxDQUFDO0lBQzlGLElBQUksS0FBSyxDQUFDLEdBQUcsS0FBSyxPQUFPLENBQUMsTUFBTSxFQUFFLEVBQUUsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLEdBQUcsS0FBSyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDbkUsTUFBTSxJQUFJLDZCQUE2QixDQUFDLDhCQUE4QixDQUFDLENBQUM7SUFDMUUsQ0FBQztJQUNELElBQUksQ0FBQztRQUNILE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsYUFBYSxDQUFDLENBQUM7SUFDeEMsQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDZixJQUFJLFdBQVcsQ0FBQyxLQUFLLENBQUMsS0FBSyxRQUFRO1lBQUUsT0FBTztRQUM1QyxNQUFNLEtBQUssQ0FBQztJQUNkLENBQUM7SUFDRCxNQUFNLElBQUksNkJBQTZCLENBQUMsZUFBZSxDQUFDLENBQUM7QUFDM0QsQ0FBQyxDQUFDO0FBRUY7Ozs7O0dBS0c7QUFDSCxNQUFNLENBQUMsTUFBTSx1QkFBdUIsR0FBRyxLQUFLLEVBQzFDLGFBQXFCLEVBQ3JCLFNBQXFCLEVBQ04sRUFBRTtJQUNqQixNQUFNLDZCQUE2QixDQUFDLGFBQWEsQ0FBQyxDQUFDO0lBQ25ELE1BQU0sT0FBTyxHQUFHLElBQUksT0FBTyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxPQUFPLENBQUMsT0FBTyxDQUFDLG1CQUFtQixFQUFFLENBQUMsQ0FBQztJQUN2RixNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQ3JDLElBQUksQ0FBQztRQUNILE1BQU0sT0FBTyxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsU0FBUyxFQUFFLENBQUMsTUFBTSxFQUFFLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ2xGLENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsSUFBSSxLQUFLLFlBQVksT0FBTyxDQUFDLE9BQU8sQ0FBQywwQkFBMEIsRUFBRSxDQUFDO1lBQ2hFLE1BQU0sSUFBSSw2QkFBNkIsQ0FDckMsS0FBSyxDQUFDLElBQUksS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLGVBQWUsQ0FBQyxDQUFDLENBQUMsMEJBQTBCLENBQUMsQ0FBQztRQUM1RSxDQUFDO1FBQ0QsTUFBTSxLQUFLLENBQUM7SUFDZCxDQUFDO1lBQVMsQ0FBQztRQUNULEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDaEIsQ0FBQztBQUNILENBQUMsQ0FBQztBQUVGOzs7R0FHRztBQUNILE1BQU0sQ0FBQyxNQUFNLDhCQUE4QixHQUFHLEtBQUssRUFDakQsWUFBbUQsRUFDbkQsVUFBb0YsRUFDcEYsYUFBcUIsRUFDZSxFQUFFO0lBQ3RDLE1BQU0sNkJBQTZCLENBQUMsYUFBYSxDQUFDLENBQUM7SUFDbkQsTUFBTSxRQUFRLEdBQUcsTUFBTSxZQUFZLENBQUMsT0FBTyxDQUFDLCtCQUErQixDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ3hGLE1BQU0sTUFBTSxHQUFHLElBQUksV0FBVyxFQUFFLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUNoRSxJQUFJLENBQUM7UUFDSCxNQUFNLHVCQUF1QixDQUFDLGFBQWEsRUFBRSxNQUFNLENBQUMsQ0FBQztRQUNyRCxPQUFPO1lBQ0wsU0FBUyxFQUFFLFFBQVEsQ0FBQyxVQUFVLENBQUMsU0FBUztZQUN4QyxVQUFVLEVBQUUsUUFBUSxDQUFDLFVBQVUsQ0FBQyxVQUFVO1lBQzFDLFVBQVUsRUFBRSxhQUFhO1lBQ3pCLFVBQVUsRUFBRSxNQUFNLENBQUMsVUFBVTtZQUM3QixNQUFNLEVBQUUsT0FBTyxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUM7WUFDeEUsU0FBUyxFQUFFLFFBQVEsQ0FBQyxPQUFPLENBQUMsRUFBRTtTQUMvQixDQUFDO0lBQ0osQ0FBQztZQUFTLENBQUM7UUFDVCxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ2pCLENBQUM7QUFDSCxDQUFDLENBQUMifQ==

package/dist_ts_cliclient/tokeninput.d.ts

@@ -1,25 +1,42 @@
-/** Why the admin token piped in was not taken, named without quoting any of it. */
-export type TBootstrapTokenInputRefusal = 
+/** Why a token piped in was not taken, named without quoting any of it. */
+export type TTokenInputRefusal = 
 /** stdin is a terminal, which would echo a token typed into it; pipe the token in instead. */
 'token-input-terminal'
 /** stdin carried more bytes than a token and one line break. */
  | 'token-input-oversized'
-/** What stdin carried is not a token: empty, or a byte outside visible ASCII, a space included. */
+/** What stdin carried is not a token by the token's own rule: empty, or a byte the rule refuses. */
  | 'token-input-invalid';
-export declare class BootstrapTokenInputError extends Error {
-    readonly refusal: TBootstrapTokenInputRefusal;
-    constructor(refusal: TBootstrapTokenInputRefusal);
+/** Why the dcrouter admin token piped into `gateway bootstrap` was not taken. */
+export type TBootstrapTokenInputRefusal = TTokenInputRefusal;
+/** A refused token input: which token, and why, never a byte of what was read. */
+export declare class TokenInputError extends Error {
+    readonly refusal: TTokenInputRefusal;
+    constructor(refusal: TTokenInputRefusal, subjectArg: string);
 }
-/** What the token is read from: the command's stdin, or a stream a test hands in. */
-export type TBootstrapTokenInput = AsyncIterable<Uint8Array> & {
+export declare class BootstrapTokenInputError extends TokenInputError {
+    constructor(refusalArg: TTokenInputRefusal);
+}
+export declare class CorestoreControlTokenInputError extends TokenInputError {
+    constructor(refusalArg: TTokenInputRefusal);
+}
+/** What a token is read from: the command's stdin, or a stream a test hands in. */
+export type TTokenInput = AsyncIterable<Uint8Array> & {
     isTTY?: boolean;
 };
+export type TBootstrapTokenInput = TTokenInput;
+/**
+ * The dcrouter admin token piped into `gateway bootstrap`: at most the bootstrap contract's
+ * `maximumTokenBytes` of visible ASCII.
+ */
+export declare const readBootstrapTokenInput: (inputArg: TTokenInput) => Promise<Uint8Array>;
+/**
+ * The token as text, exactly as its bytes say: invalid UTF-8 throws, and a leading byte order mark
+ * is kept, so the contract judges and Cloudly receives every character that was piped in.
+ */
+export declare const decodeCorestoreControlToken: (tokenArg: Uint8Array) => string;
 /**
- * The dcrouter admin token piped into `gateway bootstrap`, as bytes the caller wipes.
- *
- * stdin is the only source: an argument would sit in the process list and the shell history, and
- * the environment leaks into child processes. One trailing line break, `\n` or `\r\n`, is what
- * `echo` or a file adds and is not part of the token; everything else must pass the contract's
- * token rule. Every byte read is wiped before this answers, whatever it answers.
+ * The Corestore control token piped into `corestore set-control-token`: what the contract's
+ * `isCorestoreControlToken` accepts, so at most `corestoreCredentialRuntimeLimits
+ * .maximumControlTokenBytes` of UTF-8 without whitespace.
  */
-export declare const readBootstrapTokenInput: (inputArg: TBootstrapTokenInput) => Promise<Uint8Array>;
+export declare const readCorestoreControlTokenInput: (inputArg: TTokenInput) => Promise<Uint8Array>;