@serve.zone/dcrouter 34.0.0 → 34.2.0

package/dist_ts/index.js

@@ -4,6 +4,7 @@ export * from './00_commitinfo_data.js';
 export { UnifiedEmailServer } from '@push.rocks/smartmta';
 // DcRouter
 import { DcRouter } from './classes.dcrouter.js';
+import { runMigrateCommand } from './migrate-command.js';
 export * from './classes.dcrouter.js';
 // RADIUS module
 export * from './radius/index.js';
@@ -11,25 +12,37 @@ export * from './radius/index.js';
 export * from './remoteingress/index.js';
 // Web Push provider module
 export * from './webpush/index.js';
-export const runCli = async () => {
-    const args = process.argv.slice(2);
-    if (args.includes('--version') || args.includes('version')) {
-        console.log(commitinfo.version);
-        return;
-    }
-    if (args.includes('--help') || args.includes('-h') || args.includes('help')) {
-        console.log(`dcrouter ${commitinfo.version}
-
-Usage:
+const cliUsage = `Usage:
   dcrouter
   dcrouter --version
   dcrouter --help
+  dcrouter migrate --storage-path <absolute path> --to <version> [--db-name <name>] [--plan]
 
 Environment:
   DCROUTER_MODE=OCI_CONTAINER   Start with OCI container configuration
   DCROUTER_DNS_BIND_INTERFACE   Override the embedded DNS UDP bind address
   DATA_DIR=<path>               Override the writable dcrouter data directory
-`);
+`;
+export const runCli = async () => {
+    const args = process.argv.slice(2);
+    if (args[0] === 'migrate') {
+        process.exitCode = await runMigrateCommand(args.slice(1));
+        return;
+    }
+    if (args.includes('--version') || args.includes('version')) {
+        console.log(commitinfo.version);
+        return;
+    }
+    if (args.includes('--help') || args.includes('-h') || args.includes('help')) {
+        console.log(`dcrouter ${commitinfo.version}\n\n${cliUsage}`);
+        return;
+    }
+    // Only a bare `dcrouter` starts the router: an argument this release does not know (a command
+    // a later release added, a typo) must never start it against the data it was meant for.
+    if (args.length > 0) {
+        console.error(`dcrouter: unknown argument${args.length > 1 ? 's' : ''} ${args.map((argArg) => `"${argArg}"`).join(' ')}; `
+            + `nothing was started.\n\n${cliUsage}`);
+        process.exitCode = 2;
         return;
     }
     let options = {};
@@ -49,4 +62,4 @@ Environment:
     process.once('SIGINT', shutdown);
     process.once('SIGTERM', shutdown);
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsVUFBVSxFQUFFLE1BQU0seUJBQXlCLENBQUM7QUFDckQsY0FBYyx5QkFBeUIsQ0FBQztBQUV4QyxxRUFBcUU7QUFDckUsT0FBTyxFQUFFLGtCQUFrQixFQUFFLE1BQU0sc0JBQXNCLENBQUM7QUFHMUQsV0FBVztBQUNYLE9BQU8sRUFBRSxRQUFRLEVBQUUsTUFBTSx1QkFBdUIsQ0FBQztBQUNqRCxjQUFjLHVCQUF1QixDQUFDO0FBRXRDLGdCQUFnQjtBQUNoQixjQUFjLG1CQUFtQixDQUFDO0FBRWxDLHdCQUF3QjtBQUN4QixjQUFjLDBCQUEwQixDQUFDO0FBRXpDLDJCQUEyQjtBQUMzQixjQUFjLG9CQUFvQixDQUFDO0FBS25DLE1BQU0sQ0FBQyxNQUFNLE1BQU0sR0FBRyxLQUFLLElBQUksRUFBRTtJQUMvQixNQUFNLElBQUksR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUVuQyxJQUFJLElBQUksQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLElBQUksSUFBSSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1FBQzNELE9BQU8sQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ2hDLE9BQU87SUFDVCxDQUFDO0lBRUQsSUFBSSxJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxJQUFJLElBQUksQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLElBQUksSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQzVFLE9BQU8sQ0FBQyxHQUFHLENBQUMsWUFBWSxVQUFVLENBQUMsT0FBTzs7Ozs7Ozs7Ozs7Q0FXN0MsQ0FBQyxDQUFDO1FBQ0MsT0FBTztJQUNULENBQUM7SUFFRCxJQUFJLE9BQU8sR0FBcUQsRUFBRSxDQUFDO0lBRW5FLElBQUksT0FBTyxDQUFDLEdBQUcsQ0FBQyxhQUFhLEtBQUssZUFBZSxFQUFFLENBQUM7UUFDbEQsTUFBTSxFQUFFLHFCQUFxQixFQUFFLEdBQUcsTUFBTSxNQUFNLENBQUMsOEJBQThCLENBQUMsQ0FBQztRQUMvRSxPQUFPLEdBQUcscUJBQXFCLEVBQUUsQ0FBQztRQUNsQyxPQUFPLENBQUMsR0FBRyxDQUFDLDhDQUE4QyxDQUFDLENBQUM7SUFDOUQsQ0FBQztJQUVELE1BQU0sUUFBUSxHQUFHLElBQUksUUFBUSxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQ3ZDLE1BQU0sUUFBUSxDQUFDLEtBQUssRUFBRSxDQUFDO0lBQ3ZCLE9BQU8sQ0FBQyxHQUFHLENBQUMscURBQXFELENBQUMsQ0FBQztJQUVuRSxNQUFNLFFBQVEsR0FBRyxLQUFLLElBQUksRUFBRTtRQUMxQixPQUFPLENBQUMsR0FBRyxDQUFDLDZCQUE2QixDQUFDLENBQUM7UUFDM0MsTUFBTSxRQUFRLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDdEIsT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNsQixDQUFDLENBQUM7SUFDRixPQUFPLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxRQUFRLENBQUMsQ0FBQztJQUNqQyxPQUFPLENBQUMsSUFBSSxDQUFDLFNBQVMsRUFBRSxRQUFRLENBQUMsQ0FBQztBQUNwQyxDQUFDLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsVUFBVSxFQUFFLE1BQU0seUJBQXlCLENBQUM7QUFDckQsY0FBYyx5QkFBeUIsQ0FBQztBQUV4QyxxRUFBcUU7QUFDckUsT0FBTyxFQUFFLGtCQUFrQixFQUFFLE1BQU0sc0JBQXNCLENBQUM7QUFHMUQsV0FBVztBQUNYLE9BQU8sRUFBRSxRQUFRLEVBQUUsTUFBTSx1QkFBdUIsQ0FBQztBQUNqRCxPQUFPLEVBQUUsaUJBQWlCLEVBQUUsTUFBTSxzQkFBc0IsQ0FBQztBQUN6RCxjQUFjLHVCQUF1QixDQUFDO0FBRXRDLGdCQUFnQjtBQUNoQixjQUFjLG1CQUFtQixDQUFDO0FBRWxDLHdCQUF3QjtBQUN4QixjQUFjLDBCQUEwQixDQUFDO0FBRXpDLDJCQUEyQjtBQUMzQixjQUFjLG9CQUFvQixDQUFDO0FBS25DLE1BQU0sUUFBUSxHQUFHOzs7Ozs7Ozs7O0NBVWhCLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxNQUFNLEdBQUcsS0FBSyxJQUFJLEVBQUU7SUFDL0IsTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFFbkMsSUFBSSxJQUFJLENBQUMsQ0FBQyxDQUFDLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDMUIsT0FBTyxDQUFDLFFBQVEsR0FBRyxNQUFNLGlCQUFpQixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUMxRCxPQUFPO0lBQ1QsQ0FBQztJQUVELElBQUksSUFBSSxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsSUFBSSxJQUFJLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7UUFDM0QsT0FBTyxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDaEMsT0FBTztJQUNULENBQUM7SUFFRCxJQUFJLElBQUksQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLElBQUksSUFBSSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsSUFBSSxJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDNUUsT0FBTyxDQUFDLEdBQUcsQ0FBQyxZQUFZLFVBQVUsQ0FBQyxPQUFPLE9BQU8sUUFBUSxFQUFFLENBQUMsQ0FBQztRQUM3RCxPQUFPO0lBQ1QsQ0FBQztJQUVELDhGQUE4RjtJQUM5Rix3RkFBd0Y7SUFDeEYsSUFBSSxJQUFJLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3BCLE9BQU8sQ0FBQyxLQUFLLENBQ1gsNkJBQTZCLElBQUksQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsSUFBSSxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxJQUFJLE1BQU0sR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxJQUFJO2NBQzFHLDJCQUEyQixRQUFRLEVBQUUsQ0FDeEMsQ0FBQztRQUNGLE9BQU8sQ0FBQyxRQUFRLEdBQUcsQ0FBQyxDQUFDO1FBQ3JCLE9BQU87SUFDVCxDQUFDO0lBRUQsSUFBSSxPQUFPLEdBQXFELEVBQUUsQ0FBQztJQUVuRSxJQUFJLE9BQU8sQ0FBQyxHQUFHLENBQUMsYUFBYSxLQUFLLGVBQWUsRUFBRSxDQUFDO1FBQ2xELE1BQU0sRUFBRSxxQkFBcUIsRUFBRSxHQUFHLE1BQU0sTUFBTSxDQUFDLDhCQUE4QixDQUFDLENBQUM7UUFDL0UsT0FBTyxHQUFHLHFCQUFxQixFQUFFLENBQUM7UUFDbEMsT0FBTyxDQUFDLEdBQUcsQ0FBQyw4Q0FBOEMsQ0FBQyxDQUFDO0lBQzlELENBQUM7SUFFRCxNQUFNLFFBQVEsR0FBRyxJQUFJLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUN2QyxNQUFNLFFBQVEsQ0FBQyxLQUFLLEVBQUUsQ0FBQztJQUN2QixPQUFPLENBQUMsR0FBRyxDQUFDLHFEQUFxRCxDQUFDLENBQUM7SUFFbkUsTUFBTSxRQUFRLEdBQUcsS0FBSyxJQUFJLEVBQUU7UUFDMUIsT0FBTyxDQUFDLEdBQUcsQ0FBQyw2QkFBNkIsQ0FBQyxDQUFDO1FBQzNDLE1BQU0sUUFBUSxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ3RCLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDbEIsQ0FBQyxDQUFDO0lBQ0YsT0FBTyxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsUUFBUSxDQUFDLENBQUM7SUFDakMsT0FBTyxDQUFDLElBQUksQ0FBQyxTQUFTLEVBQUUsUUFBUSxDQUFDLENBQUM7QUFDcEMsQ0FBQyxDQUFDIn0=

package/dist_ts/migrate-command.d.ts

@@ -0,0 +1,44 @@
+import * as plugins from './plugins.js';
+import type { IDowngradeMigrationRunResult } from '../dist_ts_migrations/index.js';
+/** The prefix of the one line `dcrouter migrate` ends with: the outcome as JSON. */
+export declare const migrateResultLinePrefix = "DCROUTER_MIGRATE_RESULT:";
+export declare const migrateCommandUsage = "Usage:\n  dcrouter migrate --storage-path <absolute path> --to <version> [--db-name <name>] [--plan]\n\nWalks the data of a stopped dcrouter back to an earlier data version, running each\nstep's down handler. Forward migrations happen when dcrouter starts.\n\n  --storage-path <path>   The embedded database's storage root (absolute; no default)\n  --to <version>          The data version to walk back to, a step boundary\n  --db-name <name>        The database inside the root (default: dcrouter)\n  --plan                  Report the steps the downgrade would run, change nothing\n\nThe root must not be in use: the command refuses a root a running dcrouter owns.\nThe last line of the output is DCROUTER_MIGRATE_RESULT:{json}.\n";
+/** A command line `dcrouter migrate` refuses before it opens anything. */
+export declare class MigrateCommandUsageError extends Error {
+    constructor(messageArg: string);
+}
+export interface IMigrateCommandOptions {
+    storagePath: string;
+    targetVersion: string;
+    dbName: string;
+    planOnly: boolean;
+}
+export type TMigrateCommandResult = ({
+    ok: true;
+    plan: boolean;
+    storagePath: string;
+    dbName: string;
+} & IDowngradeMigrationRunResult) | {
+    ok: false;
+    error: {
+        name: string;
+        code?: string;
+        message: string;
+    };
+};
+/**
+ * The stopped-root check's bounds: the largest every input admits (smartdb readme, "Offline
+ * Physical Namespace Inspection"). A root over any of them is refused, never partly inspected: a
+ * data file over `maximumDataFileBytes` fails the whole inspection with `ERESOURCE_LIMIT`
+ * (nosqldb 5.7.1 `rustdb-storage/src/offline_inspection/physical_namespace_inspection.rs:760`).
+ */
+export declare const offlineInspectionLimits: plugins.smartdb.ILocalSmartDbOfflinePhysicalNamespaceInspectionLimits;
+export declare function parseMigrateArguments(argsArg: string[]): IMigrateCommandOptions;
+/**
+ * Runs the downgrade offline: a stopped-root check first, then the engine, whose owner lock refuses
+ * a root a running dcrouter holds, then the reverse migration. Both handles are released before it
+ * returns, whatever happened.
+ */
+export declare function runMigrateCommandOptions(optionsArg: IMigrateCommandOptions): Promise<TMigrateCommandResult>;
+/** `dcrouter migrate …`; resolves to the process exit code and prints the result line last. */
+export declare function runMigrateCommand(argsArg: string[]): Promise<number>;

package/dist_ts/migrate-command.js

@@ -0,0 +1,181 @@
+import * as plugins from './plugins.js';
+import { createDowngradeMigrationRunner, DcRouterMigrationError } from '../dist_ts_migrations/index.js';
+/** The prefix of the one line `dcrouter migrate` ends with: the outcome as JSON. */
+export const migrateResultLinePrefix = 'DCROUTER_MIGRATE_RESULT:';
+export const migrateCommandUsage = `Usage:
+  dcrouter migrate --storage-path <absolute path> --to <version> [--db-name <name>] [--plan]
+
+Walks the data of a stopped dcrouter back to an earlier data version, running each
+step's down handler. Forward migrations happen when dcrouter starts.
+
+  --storage-path <path>   The embedded database's storage root (absolute; no default)
+  --to <version>          The data version to walk back to, a step boundary
+  --db-name <name>        The database inside the root (default: dcrouter)
+  --plan                  Report the steps the downgrade would run, change nothing
+
+The root must not be in use: the command refuses a root a running dcrouter owns.
+The last line of the output is ${migrateResultLinePrefix}{json}.
+`;
+/** A command line `dcrouter migrate` refuses before it opens anything. */
+export class MigrateCommandUsageError extends Error {
+    constructor(messageArg) {
+        super(messageArg);
+        this.name = 'MigrateCommandUsageError';
+    }
+}
+/**
+ * The stopped-root check's bounds: the largest every input admits (smartdb readme, "Offline
+ * Physical Namespace Inspection"). A root over any of them is refused, never partly inspected: a
+ * data file over `maximumDataFileBytes` fails the whole inspection with `ERESOURCE_LIMIT`
+ * (nosqldb 5.7.1 `rustdb-storage/src/offline_inspection/physical_namespace_inspection.rs:760`).
+ */
+export const offlineInspectionLimits = {
+    maximumEntries: 100_000,
+    maximumDatabases: 4_096,
+    maximumCollections: 10_000,
+    maximumIndexes: 100_000,
+    maximumDataFileBytes: 268_435_456,
+    maximumWalFileBytes: 67_108_864,
+    maximumIndexFileBytes: 16_777_216,
+    maximumTotalFileBytes: 1_099_511_627_776,
+    maximumRecordsPerCollection: 1_000_000,
+    maximumRecordBytes: 17_825_792,
+    maximumResultBytes: 16_777_216,
+};
+const offlineInspectionTimeoutMs = 10 * 60_000;
+export function parseMigrateArguments(argsArg) {
+    let storagePath;
+    let targetVersion;
+    let dbName = 'dcrouter';
+    let planOnly = false;
+    const valueOf = (indexArg, flagArg) => {
+        const value = argsArg[indexArg + 1];
+        if (value === undefined || value.startsWith('--')) {
+            throw new MigrateCommandUsageError(`${flagArg} needs a value.`);
+        }
+        return value;
+    };
+    for (let index = 0; index < argsArg.length; index++) {
+        const arg = argsArg[index];
+        switch (arg) {
+            case '--storage-path':
+                storagePath = valueOf(index++, arg);
+                break;
+            case '--to':
+                targetVersion = valueOf(index++, arg);
+                break;
+            case '--db-name':
+                dbName = valueOf(index++, arg);
+                break;
+            case '--plan':
+                planOnly = true;
+                break;
+            default:
+                throw new MigrateCommandUsageError(`Unknown argument "${arg}".`);
+        }
+    }
+    if (!storagePath)
+        throw new MigrateCommandUsageError('--storage-path is required.');
+    if (!plugins.path.isAbsolute(storagePath)) {
+        throw new MigrateCommandUsageError(`--storage-path must be an absolute path, not "${storagePath}".`);
+    }
+    if (!targetVersion)
+        throw new MigrateCommandUsageError('--to is required.');
+    return { storagePath: plugins.path.resolve(storagePath), targetVersion, dbName, planOnly };
+}
+/**
+ * Runs the downgrade offline: a stopped-root check first, then the engine, whose owner lock refuses
+ * a root a running dcrouter holds, then the reverse migration. Both handles are released before it
+ * returns, whatever happened.
+ */
+export async function runMigrateCommandOptions(optionsArg) {
+    // Refuses a root an engine holds (the sidecar takes the shared owner lock), a root that is not a
+    // current SmartDB root, and any file that does not validate, before the engine is started.
+    const inspection = await plugins.smartdb.LocalSmartDb.inspectOfflinePhysicalNamespaces({ folderPath: optionsArg.storagePath, limits: offlineInspectionLimits }, { timeoutMs: offlineInspectionTimeoutMs });
+    const databaseNames = inspection.databases.map((databaseArg) => databaseArg.name);
+    if (!databaseNames.includes(optionsArg.dbName)) {
+        throw new DcRouterMigrationError(`The storage root holds no database "${optionsArg.dbName}" (it holds ${databaseNames.length > 0
+            ? databaseNames.map((nameArg) => `"${nameArg}"`).join(', ')
+            : 'none'}). Nothing was changed.`);
+    }
+    const localSmartDb = new plugins.smartdb.LocalSmartDb({ folderPath: optionsArg.storagePath });
+    let db;
+    let failure;
+    try {
+        const { connectionUri } = await localSmartDb.start();
+        db = new plugins.smartdata.SmartdataDb({ mongoDbUrl: connectionUri, mongoDbName: optionsArg.dbName });
+        await db.init();
+        const runner = await createDowngradeMigrationRunner(db, optionsArg.targetVersion);
+        const result = optionsArg.planOnly ? await runner.plan() : await runner.run();
+        return {
+            ok: true,
+            plan: optionsArg.planOnly,
+            storagePath: optionsArg.storagePath,
+            dbName: optionsArg.dbName,
+            currentVersionBefore: result.currentVersionBefore,
+            currentVersionAfter: result.currentVersionAfter,
+            targetVersion: result.targetVersion,
+            wasUpToDate: result.wasUpToDate,
+            wasFreshInstall: result.wasFreshInstall,
+            totalDurationMs: result.totalDurationMs,
+            stepsApplied: result.stepsApplied.map(({ id, fromVersion, toVersion, status }) => ({ id, fromVersion, toVersion, status })),
+            stepsSkipped: result.stepsSkipped.map(({ id, fromVersion, toVersion, status }) => ({ id, fromVersion, toVersion, status })),
+        };
+    }
+    catch (error) {
+        failure = { error };
+        throw error;
+    }
+    finally {
+        // Both handles are released whatever happened. A cleanup failure after a failed migration is
+        // reported beside it, and the migration's own error stays the one the command answers with.
+        const cleanupErrors = [];
+        for (const release of [() => db?.close(), () => localSmartDb.stop()]) {
+            try {
+                await release();
+            }
+            catch (cleanupError) {
+                cleanupErrors.push(cleanupError);
+            }
+        }
+        if (cleanupErrors.length > 0 && !failure) {
+            throw new AggregateError(cleanupErrors, 'dcrouter migrate could not release the database');
+        }
+        for (const cleanupError of failure ? cleanupErrors : []) {
+            console.error(`dcrouter migrate: releasing the database also failed: ${describeMigrateError(cleanupError).message}`);
+        }
+    }
+}
+const describeMigrateError = (errorArg) => {
+    if (!(errorArg instanceof Error))
+        return { name: 'Error', message: String(errorArg) };
+    const code = errorArg.code;
+    return {
+        name: errorArg.name,
+        ...(typeof code === 'string' ? { code } : {}),
+        message: errorArg.message,
+    };
+};
+/** `dcrouter migrate …`; resolves to the process exit code and prints the result line last. */
+export async function runMigrateCommand(argsArg) {
+    if (argsArg.includes('--help') || argsArg.includes('-h')) {
+        console.log(migrateCommandUsage);
+        return 0;
+    }
+    let result;
+    let exitCode;
+    try {
+        result = await runMigrateCommandOptions(parseMigrateArguments(argsArg));
+        exitCode = 0;
+    }
+    catch (error) {
+        result = { ok: false, error: describeMigrateError(error) };
+        exitCode = error instanceof MigrateCommandUsageError ? 2 : 1;
+        console.error(`dcrouter migrate: ${result.error.message}`);
+        if (error instanceof MigrateCommandUsageError)
+            console.error(migrateCommandUsage);
+    }
+    console.log(`${migrateResultLinePrefix}${JSON.stringify(result)}`);
+    return exitCode;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibWlncmF0ZS1jb21tYW5kLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvbWlncmF0ZS1jb21tYW5kLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sY0FBYyxDQUFDO0FBQ3hDLE9BQU8sRUFBRSw4QkFBOEIsRUFBRSxzQkFBc0IsRUFBRSxNQUFNLDJCQUEyQixDQUFDO0FBR25HLG9GQUFvRjtBQUNwRixNQUFNLENBQUMsTUFBTSx1QkFBdUIsR0FBRywwQkFBMEIsQ0FBQztBQUVsRSxNQUFNLENBQUMsTUFBTSxtQkFBbUIsR0FBRzs7Ozs7Ozs7Ozs7O2lDQVlGLHVCQUF1QjtDQUN2RCxDQUFDO0FBRUYsMEVBQTBFO0FBQzFFLE1BQU0sT0FBTyx3QkFBeUIsU0FBUSxLQUFLO0lBQ2pELFlBQVksVUFBa0I7UUFDNUIsS0FBSyxDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBQ2xCLElBQUksQ0FBQyxJQUFJLEdBQUcsMEJBQTBCLENBQUM7SUFDekMsQ0FBQztDQUNGO0FBYUQ7Ozs7O0dBS0c7QUFDSCxNQUFNLENBQUMsTUFBTSx1QkFBdUIsR0FBMEU7SUFDNUcsY0FBYyxFQUFFLE9BQU87SUFDdkIsZ0JBQWdCLEVBQUUsS0FBSztJQUN2QixrQkFBa0IsRUFBRSxNQUFNO0lBQzFCLGNBQWMsRUFBRSxPQUFPO0lBQ3ZCLG9CQUFvQixFQUFFLFdBQVc7SUFDakMsbUJBQW1CLEVBQUUsVUFBVTtJQUMvQixxQkFBcUIsRUFBRSxVQUFVO0lBQ2pDLHFCQUFxQixFQUFFLGlCQUFpQjtJQUN4QywyQkFBMkIsRUFBRSxTQUFTO0lBQ3RDLGtCQUFrQixFQUFFLFVBQVU7SUFDOUIsa0JBQWtCLEVBQUUsVUFBVTtDQUMvQixDQUFDO0FBQ0YsTUFBTSwwQkFBMEIsR0FBRyxFQUFFLEdBQUcsTUFBTSxDQUFDO0FBRS9DLE1BQU0sVUFBVSxxQkFBcUIsQ0FBQyxPQUFpQjtJQUNyRCxJQUFJLFdBQStCLENBQUM7SUFDcEMsSUFBSSxhQUFpQyxDQUFDO0lBQ3RDLElBQUksTUFBTSxHQUFHLFVBQVUsQ0FBQztJQUN4QixJQUFJLFFBQVEsR0FBRyxLQUFLLENBQUM7SUFDckIsTUFBTSxPQUFPLEdBQUcsQ0FBQyxRQUFnQixFQUFFLE9BQWUsRUFBRSxFQUFFO1FBQ3BELE1BQU0sS0FBSyxHQUFHLE9BQU8sQ0FBQyxRQUFRLEdBQUcsQ0FBQyxDQUFDLENBQUM7UUFDcEMsSUFBSSxLQUFLLEtBQUssU0FBUyxJQUFJLEtBQUssQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztZQUNsRCxNQUFNLElBQUksd0JBQXdCLENBQUMsR0FBRyxPQUFPLGlCQUFpQixDQUFDLENBQUM7UUFDbEUsQ0FBQztRQUNELE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQyxDQUFDO0lBQ0YsS0FBSyxJQUFJLEtBQUssR0FBRyxDQUFDLEVBQUUsS0FBSyxHQUFHLE9BQU8sQ0FBQyxNQUFNLEVBQUUsS0FBSyxFQUFFLEVBQUUsQ0FBQztRQUNwRCxNQUFNLEdBQUcsR0FBRyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDM0IsUUFBUSxHQUFHLEVBQUUsQ0FBQztZQUNaLEtBQUssZ0JBQWdCO2dCQUNuQixXQUFXLEdBQUcsT0FBTyxDQUFDLEtBQUssRUFBRSxFQUFFLEdBQUcsQ0FBQyxDQUFDO2dCQUNwQyxNQUFNO1lBQ1IsS0FBSyxNQUFNO2dCQUNULGFBQWEsR0FBRyxPQUFPLENBQUMsS0FBSyxFQUFFLEVBQUUsR0FBRyxDQUFDLENBQUM7Z0JBQ3RDLE1BQU07WUFDUixLQUFLLFdBQVc7Z0JBQ2QsTUFBTSxHQUFHLE9BQU8sQ0FBQyxLQUFLLEVBQUUsRUFBRSxHQUFHLENBQUMsQ0FBQztnQkFDL0IsTUFBTTtZQUNSLEtBQUssUUFBUTtnQkFDWCxRQUFRLEdBQUcsSUFBSSxDQUFDO2dCQUNoQixNQUFNO1lBQ1I7Z0JBQ0UsTUFBTSxJQUFJLHdCQUF3QixDQUFDLHFCQUFxQixHQUFHLElBQUksQ0FBQyxDQUFDO1FBQ3JFLENBQUM7SUFDSCxDQUFDO0lBQ0QsSUFBSSxDQUFDLFdBQVc7UUFBRSxNQUFNLElBQUksd0JBQXdCLENBQUMsNkJBQTZCLENBQUMsQ0FBQztJQUNwRixJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztRQUMxQyxNQUFNLElBQUksd0JBQXdCLENBQUMsaURBQWlELFdBQVcsSUFBSSxDQUFDLENBQUM7SUFDdkcsQ0FBQztJQUNELElBQUksQ0FBQyxhQUFhO1FBQUUsTUFBTSxJQUFJLHdCQUF3QixDQUFDLG1CQUFtQixDQUFDLENBQUM7SUFDNUUsT0FBTyxFQUFFLFdBQVcsRUFBRSxPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsRUFBRSxhQUFhLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxDQUFDO0FBQzdGLENBQUM7QUFFRDs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLEtBQUssVUFBVSx3QkFBd0IsQ0FBQyxVQUFrQztJQUMvRSxpR0FBaUc7SUFDakcsMkZBQTJGO0lBQzNGLE1BQU0sVUFBVSxHQUFHLE1BQU0sT0FBTyxDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUMsZ0NBQWdDLENBQ3BGLEVBQUUsVUFBVSxFQUFFLFVBQVUsQ0FBQyxXQUFXLEVBQUUsTUFBTSxFQUFFLHVCQUF1QixFQUFFLEVBQ3ZFLEVBQUUsU0FBUyxFQUFFLDBCQUEwQixFQUFFLENBQzFDLENBQUM7SUFDRixNQUFNLGFBQWEsR0FBRyxVQUFVLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxDQUFDLFdBQVcsRUFBRSxFQUFFLENBQUMsV0FBVyxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQ2xGLElBQUksQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQy9DLE1BQU0sSUFBSSxzQkFBc0IsQ0FDOUIsdUNBQXVDLFVBQVUsQ0FBQyxNQUFNLGVBQWUsYUFBYSxDQUFDLE1BQU0sR0FBRyxDQUFDO1lBQzdGLENBQUMsQ0FBQyxhQUFhLENBQUMsR0FBRyxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxJQUFJLE9BQU8sR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQztZQUMzRCxDQUFDLENBQUMsTUFBTSx5QkFBeUIsQ0FDcEMsQ0FBQztJQUNKLENBQUM7SUFFRCxNQUFNLFlBQVksR0FBRyxJQUFJLE9BQU8sQ0FBQyxPQUFPLENBQUMsWUFBWSxDQUFDLEVBQUUsVUFBVSxFQUFFLFVBQVUsQ0FBQyxXQUFXLEVBQUUsQ0FBQyxDQUFDO0lBQzlGLElBQUksRUFBNkMsQ0FBQztJQUNsRCxJQUFJLE9BQXVDLENBQUM7SUFDNUMsSUFBSSxDQUFDO1FBQ0gsTUFBTSxFQUFFLGFBQWEsRUFBRSxHQUFHLE1BQU0sWUFBWSxDQUFDLEtBQUssRUFBRSxDQUFDO1FBQ3JELEVBQUUsR0FBRyxJQUFJLE9BQU8sQ0FBQyxTQUFTLENBQUMsV0FBVyxDQUFDLEVBQUUsVUFBVSxFQUFFLGFBQWEsRUFBRSxXQUFXLEVBQUUsVUFBVSxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUM7UUFDdEcsTUFBTSxFQUFFLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDaEIsTUFBTSxNQUFNLEdBQUcsTUFBTSw4QkFBOEIsQ0FBQyxFQUFFLEVBQUUsVUFBVSxDQUFDLGFBQWEsQ0FBQyxDQUFDO1FBQ2xGLE1BQU0sTUFBTSxHQUFHLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLE1BQU0sTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQyxNQUFNLE1BQU0sQ0FBQyxHQUFHLEVBQUUsQ0FBQztRQUM5RSxPQUFPO1lBQ0wsRUFBRSxFQUFFLElBQUk7WUFDUixJQUFJLEVBQUUsVUFBVSxDQUFDLFFBQVE7WUFDekIsV0FBVyxFQUFFLFVBQVUsQ0FBQyxXQUFXO1lBQ25DLE1BQU0sRUFBRSxVQUFVLENBQUMsTUFBTTtZQUN6QixvQkFBb0IsRUFBRSxNQUFNLENBQUMsb0JBQW9CO1lBQ2pELG1CQUFtQixFQUFFLE1BQU0sQ0FBQyxtQkFBbUI7WUFDL0MsYUFBYSxFQUFFLE1BQU0sQ0FBQyxhQUFhO1lBQ25DLFdBQVcsRUFBRSxNQUFNLENBQUMsV0FBVztZQUMvQixlQUFlLEVBQUUsTUFBTSxDQUFDLGVBQWU7WUFDdkMsZUFBZSxFQUFFLE1BQU0sQ0FBQyxlQUFlO1lBQ3ZDLFlBQVksRUFBRSxNQUFNLENBQUMsWUFBWSxDQUFDLEdBQUcsQ0FBQyxDQUFDLEVBQUUsRUFBRSxFQUFFLFdBQVcsRUFBRSxTQUFTLEVBQUUsTUFBTSxFQUFFLEVBQUUsRUFBRSxDQUFDLENBQUMsRUFBRSxFQUFFLEVBQUUsV0FBVyxFQUFFLFNBQVMsRUFBRSxNQUFNLEVBQUUsQ0FBQyxDQUFDO1lBQzNILFlBQVksRUFBRSxNQUFNLENBQUMsWUFBWSxDQUFDLEdBQUcsQ0FBQyxDQUFDLEVBQUUsRUFBRSxFQUFFLFdBQVcsRUFBRSxTQUFTLEVBQUUsTUFBTSxFQUFFLEVBQUUsRUFBRSxDQUFDLENBQUMsRUFBRSxFQUFFLEVBQUUsV0FBVyxFQUFFLFNBQVMsRUFBRSxNQUFNLEVBQUUsQ0FBQyxDQUFDO1NBQzVILENBQUM7SUFDSixDQUFDO0lBQUMsT0FBTyxLQUFjLEVBQUUsQ0FBQztRQUN4QixPQUFPLEdBQUcsRUFBRSxLQUFLLEVBQUUsQ0FBQztRQUNwQixNQUFNLEtBQUssQ0FBQztJQUNkLENBQUM7WUFBUyxDQUFDO1FBQ1QsNkZBQTZGO1FBQzdGLDRGQUE0RjtRQUM1RixNQUFNLGFBQWEsR0FBYyxFQUFFLENBQUM7UUFDcEMsS0FBSyxNQUFNLE9BQU8sSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDLEVBQUUsRUFBRSxLQUFLLEVBQUUsRUFBRSxHQUFHLEVBQUUsQ0FBQyxZQUFZLENBQUMsSUFBSSxFQUFFLENBQUMsRUFBRSxDQUFDO1lBQ3JFLElBQUksQ0FBQztnQkFDSCxNQUFNLE9BQU8sRUFBRSxDQUFDO1lBQ2xCLENBQUM7WUFBQyxPQUFPLFlBQXFCLEVBQUUsQ0FBQztnQkFDL0IsYUFBYSxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsQ0FBQztZQUNuQyxDQUFDO1FBQ0gsQ0FBQztRQUNELElBQUksYUFBYSxDQUFDLE1BQU0sR0FBRyxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUN6QyxNQUFNLElBQUksY0FBYyxDQUFDLGFBQWEsRUFBRSxpREFBaUQsQ0FBQyxDQUFDO1FBQzdGLENBQUM7UUFDRCxLQUFLLE1BQU0sWUFBWSxJQUFJLE9BQU8sQ0FBQyxDQUFDLENBQUMsYUFBYSxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQztZQUN4RCxPQUFPLENBQUMsS0FBSyxDQUFDLHlEQUF5RCxvQkFBb0IsQ0FBQyxZQUFZLENBQUMsQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDO1FBQ3ZILENBQUM7SUFDSCxDQUFDO0FBQ0gsQ0FBQztBQUVELE1BQU0sb0JBQW9CLEdBQUcsQ0FBQyxRQUFpQixFQUFvRCxFQUFFO0lBQ25HLElBQUksQ0FBQyxDQUFDLFFBQVEsWUFBWSxLQUFLLENBQUM7UUFBRSxPQUFPLEVBQUUsSUFBSSxFQUFFLE9BQU8sRUFBRSxPQUFPLEVBQUUsTUFBTSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7SUFDdEYsTUFBTSxJQUFJLEdBQUksUUFBdUMsQ0FBQyxJQUFJLENBQUM7SUFDM0QsT0FBTztRQUNMLElBQUksRUFBRSxRQUFRLENBQUMsSUFBSTtRQUNuQixHQUFHLENBQUMsT0FBTyxJQUFJLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxFQUFFLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDN0MsT0FBTyxFQUFFLFFBQVEsQ0FBQyxPQUFPO0tBQzFCLENBQUM7QUFDSixDQUFDLENBQUM7QUFFRiwrRkFBK0Y7QUFDL0YsTUFBTSxDQUFDLEtBQUssVUFBVSxpQkFBaUIsQ0FBQyxPQUFpQjtJQUN2RCxJQUFJLE9BQU8sQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLElBQUksT0FBTyxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO1FBQ3pELE9BQU8sQ0FBQyxHQUFHLENBQUMsbUJBQW1CLENBQUMsQ0FBQztRQUNqQyxPQUFPLENBQUMsQ0FBQztJQUNYLENBQUM7SUFDRCxJQUFJLE1BQTZCLENBQUM7SUFDbEMsSUFBSSxRQUFnQixDQUFDO0lBQ3JCLElBQUksQ0FBQztRQUNILE1BQU0sR0FBRyxNQUFNLHdCQUF3QixDQUFDLHFCQUFxQixDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUM7UUFDeEUsUUFBUSxHQUFHLENBQUMsQ0FBQztJQUNmLENBQUM7SUFBQyxPQUFPLEtBQWMsRUFBRSxDQUFDO1FBQ3hCLE1BQU0sR0FBRyxFQUFFLEVBQUUsRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFLG9CQUFvQixDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDM0QsUUFBUSxHQUFHLEtBQUssWUFBWSx3QkFBd0IsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDN0QsT0FBTyxDQUFDLEtBQUssQ0FBQyxxQkFBcUIsTUFBTSxDQUFDLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDO1FBQzNELElBQUksS0FBSyxZQUFZLHdCQUF3QjtZQUFFLE9BQU8sQ0FBQyxLQUFLLENBQUMsbUJBQW1CLENBQUMsQ0FBQztJQUNwRixDQUFDO0lBQ0QsT0FBTyxDQUFDLEdBQUcsQ0FBQyxHQUFHLHVCQUF1QixHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQ25FLE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMifQ==

package/dist_ts/plugins.d.ts

@@ -55,8 +55,9 @@ export { cloudflare, };
 import * as tsclass from '@tsclass/tsclass';
 export { tsclass, };
 import * as argon2 from 'argon2';
+import * as bson from 'bson';
 import * as lruCache from 'lru-cache';
 import ipaddr from 'ipaddr.js';
 import * as uuid from 'uuid';
 import webpush from 'web-push';
-export { argon2, lruCache, ipaddr, uuid, webpush, };
+export { argon2, bson, lruCache, ipaddr, uuid, webpush, };

package/dist_ts/plugins.js

@@ -66,9 +66,10 @@ import * as tsclass from '@tsclass/tsclass';
 export { tsclass, };
 // third party
 import * as argon2 from 'argon2';
+import * as bson from 'bson';
 import * as lruCache from 'lru-cache';
 import ipaddr from 'ipaddr.js';
 import * as uuid from 'uuid';
 import webpush from 'web-push';
-export { argon2, lruCache, ipaddr, uuid, webpush, };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL3BsdWdpbnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsY0FBYztBQUNkLE9BQU8sS0FBSyxHQUFHLE1BQU0sVUFBVSxDQUFDO0FBQ2hDLE9BQU8sS0FBSyxFQUFFLE1BQU0sU0FBUyxDQUFDO0FBQzlCLE9BQU8sS0FBSyxNQUFNLE1BQU0sYUFBYSxDQUFDO0FBQ3RDLE9BQU8sS0FBSyxJQUFJLE1BQU0sV0FBVyxDQUFDO0FBQ2xDLE9BQU8sS0FBSyxLQUFLLE1BQU0sWUFBWSxDQUFDO0FBQ3BDLE9BQU8sS0FBSyxHQUFHLE1BQU0sVUFBVSxDQUFDO0FBQ2hDLE9BQU8sS0FBSyxNQUFNLE1BQU0sYUFBYSxDQUFDO0FBQ3RDLE9BQU8sS0FBSyxFQUFFLE1BQU0sU0FBUyxDQUFDO0FBQzlCLE9BQU8sS0FBSyxJQUFJLE1BQU0sV0FBVyxDQUFDO0FBQ2xDLE9BQU8sS0FBSyxHQUFHLE1BQU0sVUFBVSxDQUFDO0FBQ2hDLE9BQU8sS0FBSyxJQUFJLE1BQU0sV0FBVyxDQUFDO0FBQ2xDLE9BQU8sS0FBSyxHQUFHLE1BQU0sVUFBVSxDQUFDO0FBQ2hDLE9BQU8sS0FBSyxjQUFjLE1BQU0sc0JBQXNCLENBQUM7QUFFdkQsT0FBTyxFQUNMLEdBQUcsRUFDSCxFQUFFLEVBQ0YsTUFBTSxFQUNOLElBQUksRUFDSixLQUFLLEVBQ0wsR0FBRyxFQUNILE1BQU0sRUFDTixFQUFFLEVBQ0YsSUFBSSxFQUNKLEdBQUcsRUFDSCxJQUFJLEVBQ0osR0FBRyxFQUNILGNBQWMsR0FDZixDQUFBO0FBRUQsb0JBQW9CO0FBQ3BCLE9BQU8sS0FBSyxtQkFBbUIsTUFBTSx3QkFBd0IsQ0FBQztBQUM5RCxPQUFPLEtBQUssYUFBYSxNQUFNLDJCQUEyQixDQUFDO0FBRTNELE9BQU8sRUFDTCxtQkFBbUIsRUFDbkIsYUFBYSxHQUNkLENBQUE7QUFFRCxvQkFBb0I7QUFDcEIsT0FBTyxLQUFLLFlBQVksTUFBTSwwQkFBMEIsQ0FBQztBQUN6RCxPQUFPLEtBQUssc0JBQXNCLE1BQU0scUNBQXFDLENBQUM7QUFDOUUsT0FBTyxLQUFLLFdBQVcsTUFBTSx5QkFBeUIsQ0FBQztBQUN2RCxPQUFPLEtBQUssV0FBVyxNQUFNLHlCQUF5QixDQUFDO0FBRXZELE9BQU8sRUFDTCxZQUFZLEVBQ1osc0JBQXNCLEVBQ3RCLFdBQVcsRUFDWCxXQUFXLEdBQ1osQ0FBQTtBQUVELG9CQUFvQjtBQUNwQixPQUFPLEtBQUssWUFBWSxNQUFNLHdCQUF3QixDQUFDO0FBRXZELE9BQU8sRUFDTCxZQUFZLEdBQ2IsQ0FBQTtBQUVELHNCQUFzQjtBQUN0QixnR0FBZ0c7QUFDaEcsbUdBQW1HO0FBQ25HLDJEQUEyRDtBQUMzRCxPQUFPLEtBQUssU0FBUyxNQUFNLDhCQUE4QixDQUFDO0FBRTFELE9BQU8sRUFDTCxTQUFTLEdBQ1YsQ0FBQTtBQUVELG9CQUFvQjtBQUNwQixPQUFPLEtBQUssV0FBVyxNQUFNLHlCQUF5QixDQUFDO0FBQ3ZELE9BQU8sS0FBSyxJQUFJLE1BQU0sa0JBQWtCLENBQUM7QUFDekMsT0FBTyxLQUFLLFNBQVMsTUFBTSx1QkFBdUIsQ0FBQztBQUNuRCxPQUFPLEtBQUssV0FBVyxNQUFNLHlCQUF5QixDQUFDO0FBQ3ZELE9BQU8sS0FBSyxjQUFjLE1BQU0sNEJBQTRCLENBQUM7QUFDN0QsT0FBTyxLQUFLLFFBQVEsTUFBTSxzQkFBc0IsQ0FBQztBQUNqRCxPQUFPLEtBQUssT0FBTyxNQUFNLHFCQUFxQixDQUFDO0FBQy9DLE9BQU8sS0FBSyxVQUFVLE1BQU0sd0JBQXdCLENBQUM7QUFDckQsT0FBTyxLQUFLLFFBQVEsTUFBTSxzQkFBc0IsQ0FBQztBQUNqRCxPQUFPLEtBQUssUUFBUSxNQUFNLHNCQUFzQixDQUFDO0FBQ2pELE9BQU8sS0FBSyxZQUFZLE1BQU0sMEJBQTBCLENBQUM7QUFDekQsT0FBTyxLQUFLLFFBQVEsTUFBTSxzQkFBc0IsQ0FBQztBQUNqRCxPQUFPLEtBQUssUUFBUSxNQUFNLHNCQUFzQixDQUFDO0FBQ2pELE9BQU8sS0FBSyxPQUFPLE1BQU0scUJBQXFCLENBQUM7QUFDL0MsT0FBTyxLQUFLLFlBQVksTUFBTSwwQkFBMEIsQ0FBQztBQUN6RCxPQUFPLEtBQUssU0FBUyxNQUFNLHVCQUF1QixDQUFDO0FBQ25ELE9BQU8sS0FBSyxVQUFVLE1BQU0sd0JBQXdCLENBQUM7QUFDckQsT0FBTyxLQUFLLFlBQVksTUFBTSwwQkFBMEIsQ0FBQztBQUN6RCxPQUFPLEtBQUssUUFBUSxNQUFNLHNCQUFzQixDQUFDO0FBQ2pELE9BQU8sS0FBSyxXQUFXLE1BQU0seUJBQXlCLENBQUM7QUFDdkQsT0FBTyxLQUFLLFlBQVksTUFBTSwwQkFBMEIsQ0FBQztBQUN6RCxPQUFPLEtBQUssT0FBTyxNQUFNLHFCQUFxQixDQUFDO0FBQy9DLE9BQU8sS0FBSyxXQUFXLE1BQU0seUJBQXlCLENBQUM7QUFDdkQsT0FBTyxLQUFLLFVBQVUsTUFBTSx3QkFBd0IsQ0FBQztBQUVyRCxPQUFPLEVBQUUsV0FBVyxFQUFFLElBQUksRUFBRSxTQUFTLEVBQUUsV0FBVyxFQUFFLGNBQWMsRUFBRSxRQUFRLEVBQUUsT0FBTyxFQUFFLFVBQVUsRUFBRSxRQUFRLEVBQUUsUUFBUSxFQUFFLFlBQVksRUFBRSxRQUFRLEVBQUUsT0FBTyxFQUFFLFFBQVEsRUFBRSxZQUFZLEVBQUUsU0FBUyxFQUFFLFVBQVUsRUFBRSxZQUFZLEVBQUUsV0FBVyxFQUFFLFlBQVksRUFBRSxPQUFPLEVBQUUsV0FBVyxFQUFFLFFBQVEsRUFBRSxVQUFVLEVBQUUsQ0FBQztBQUs3UixzQkFBc0I7QUFDdEIsT0FBTyxLQUFLLFVBQVUsTUFBTSwyQkFBMkIsQ0FBQztBQUV4RCxPQUFPLEVBQ0wsVUFBVSxHQUNYLENBQUE7QUFFRCxnQkFBZ0I7QUFDaEIsT0FBTyxLQUFLLE9BQU8sTUFBTSxrQkFBa0IsQ0FBQztBQUU1QyxPQUFPLEVBQ0wsT0FBTyxHQUNSLENBQUE7QUFFRCxjQUFjO0FBQ2QsT0FBTyxLQUFLLE1BQU0sTUFBTSxRQUFRLENBQUM7QUFDakMsT0FBTyxLQUFLLFFBQVEsTUFBTSxXQUFXLENBQUM7QUFDdEMsT0FBTyxNQUFNLE1BQU0sV0FBVyxDQUFDO0FBQy9CLE9BQU8sS0FBSyxJQUFJLE1BQU0sTUFBTSxDQUFDO0FBQzdCLE9BQU8sT0FBTyxNQUFNLFVBQVUsQ0FBQztBQUUvQixPQUFPLEVBQ0wsTUFBTSxFQUNOLFFBQVEsRUFDUixNQUFNLEVBQ04sSUFBSSxFQUNKLE9BQU8sR0FDUixDQUFBIn0=
+export { argon2, bson, lruCache, ipaddr, uuid, webpush, };
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL3BsdWdpbnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsY0FBYztBQUNkLE9BQU8sS0FBSyxHQUFHLE1BQU0sVUFBVSxDQUFDO0FBQ2hDLE9BQU8sS0FBSyxFQUFFLE1BQU0sU0FBUyxDQUFDO0FBQzlCLE9BQU8sS0FBSyxNQUFNLE1BQU0sYUFBYSxDQUFDO0FBQ3RDLE9BQU8sS0FBSyxJQUFJLE1BQU0sV0FBVyxDQUFDO0FBQ2xDLE9BQU8sS0FBSyxLQUFLLE1BQU0sWUFBWSxDQUFDO0FBQ3BDLE9BQU8sS0FBSyxHQUFHLE1BQU0sVUFBVSxDQUFDO0FBQ2hDLE9BQU8sS0FBSyxNQUFNLE1BQU0sYUFBYSxDQUFDO0FBQ3RDLE9BQU8sS0FBSyxFQUFFLE1BQU0sU0FBUyxDQUFDO0FBQzlCLE9BQU8sS0FBSyxJQUFJLE1BQU0sV0FBVyxDQUFDO0FBQ2xDLE9BQU8sS0FBSyxHQUFHLE1BQU0sVUFBVSxDQUFDO0FBQ2hDLE9BQU8sS0FBSyxJQUFJLE1BQU0sV0FBVyxDQUFDO0FBQ2xDLE9BQU8sS0FBSyxHQUFHLE1BQU0sVUFBVSxDQUFDO0FBQ2hDLE9BQU8sS0FBSyxjQUFjLE1BQU0sc0JBQXNCLENBQUM7QUFFdkQsT0FBTyxFQUNMLEdBQUcsRUFDSCxFQUFFLEVBQ0YsTUFBTSxFQUNOLElBQUksRUFDSixLQUFLLEVBQ0wsR0FBRyxFQUNILE1BQU0sRUFDTixFQUFFLEVBQ0YsSUFBSSxFQUNKLEdBQUcsRUFDSCxJQUFJLEVBQ0osR0FBRyxFQUNILGNBQWMsR0FDZixDQUFBO0FBRUQsb0JBQW9CO0FBQ3BCLE9BQU8sS0FBSyxtQkFBbUIsTUFBTSx3QkFBd0IsQ0FBQztBQUM5RCxPQUFPLEtBQUssYUFBYSxNQUFNLDJCQUEyQixDQUFDO0FBRTNELE9BQU8sRUFDTCxtQkFBbUIsRUFDbkIsYUFBYSxHQUNkLENBQUE7QUFFRCxvQkFBb0I7QUFDcEIsT0FBTyxLQUFLLFlBQVksTUFBTSwwQkFBMEIsQ0FBQztBQUN6RCxPQUFPLEtBQUssc0JBQXNCLE1BQU0scUNBQXFDLENBQUM7QUFDOUUsT0FBTyxLQUFLLFdBQVcsTUFBTSx5QkFBeUIsQ0FBQztBQUN2RCxPQUFPLEtBQUssV0FBVyxNQUFNLHlCQUF5QixDQUFDO0FBRXZELE9BQU8sRUFDTCxZQUFZLEVBQ1osc0JBQXNCLEVBQ3RCLFdBQVcsRUFDWCxXQUFXLEdBQ1osQ0FBQTtBQUVELG9CQUFvQjtBQUNwQixPQUFPLEtBQUssWUFBWSxNQUFNLHdCQUF3QixDQUFDO0FBRXZELE9BQU8sRUFDTCxZQUFZLEdBQ2IsQ0FBQTtBQUVELHNCQUFzQjtBQUN0QixnR0FBZ0c7QUFDaEcsbUdBQW1HO0FBQ25HLDJEQUEyRDtBQUMzRCxPQUFPLEtBQUssU0FBUyxNQUFNLDhCQUE4QixDQUFDO0FBRTFELE9BQU8sRUFDTCxTQUFTLEdBQ1YsQ0FBQTtBQUVELG9CQUFvQjtBQUNwQixPQUFPLEtBQUssV0FBVyxNQUFNLHlCQUF5QixDQUFDO0FBQ3ZELE9BQU8sS0FBSyxJQUFJLE1BQU0sa0JBQWtCLENBQUM7QUFDekMsT0FBTyxLQUFLLFNBQVMsTUFBTSx1QkFBdUIsQ0FBQztBQUNuRCxPQUFPLEtBQUssV0FBVyxNQUFNLHlCQUF5QixDQUFDO0FBQ3ZELE9BQU8sS0FBSyxjQUFjLE1BQU0sNEJBQTRCLENBQUM7QUFDN0QsT0FBTyxLQUFLLFFBQVEsTUFBTSxzQkFBc0IsQ0FBQztBQUNqRCxPQUFPLEtBQUssT0FBTyxNQUFNLHFCQUFxQixDQUFDO0FBQy9DLE9BQU8sS0FBSyxVQUFVLE1BQU0sd0JBQXdCLENBQUM7QUFDckQsT0FBTyxLQUFLLFFBQVEsTUFBTSxzQkFBc0IsQ0FBQztBQUNqRCxPQUFPLEtBQUssUUFBUSxNQUFNLHNCQUFzQixDQUFDO0FBQ2pELE9BQU8sS0FBSyxZQUFZLE1BQU0sMEJBQTBCLENBQUM7QUFDekQsT0FBTyxLQUFLLFFBQVEsTUFBTSxzQkFBc0IsQ0FBQztBQUNqRCxPQUFPLEtBQUssUUFBUSxNQUFNLHNCQUFzQixDQUFDO0FBQ2pELE9BQU8sS0FBSyxPQUFPLE1BQU0scUJBQXFCLENBQUM7QUFDL0MsT0FBTyxLQUFLLFlBQVksTUFBTSwwQkFBMEIsQ0FBQztBQUN6RCxPQUFPLEtBQUssU0FBUyxNQUFNLHVCQUF1QixDQUFDO0FBQ25ELE9BQU8sS0FBSyxVQUFVLE1BQU0sd0JBQXdCLENBQUM7QUFDckQsT0FBTyxLQUFLLFlBQVksTUFBTSwwQkFBMEIsQ0FBQztBQUN6RCxPQUFPLEtBQUssUUFBUSxNQUFNLHNCQUFzQixDQUFDO0FBQ2pELE9BQU8sS0FBSyxXQUFXLE1BQU0seUJBQXlCLENBQUM7QUFDdkQsT0FBTyxLQUFLLFlBQVksTUFBTSwwQkFBMEIsQ0FBQztBQUN6RCxPQUFPLEtBQUssT0FBTyxNQUFNLHFCQUFxQixDQUFDO0FBQy9DLE9BQU8sS0FBSyxXQUFXLE1BQU0seUJBQXlCLENBQUM7QUFDdkQsT0FBTyxLQUFLLFVBQVUsTUFBTSx3QkFBd0IsQ0FBQztBQUVyRCxPQUFPLEVBQUUsV0FBVyxFQUFFLElBQUksRUFBRSxTQUFTLEVBQUUsV0FBVyxFQUFFLGNBQWMsRUFBRSxRQUFRLEVBQUUsT0FBTyxFQUFFLFVBQVUsRUFBRSxRQUFRLEVBQUUsUUFBUSxFQUFFLFlBQVksRUFBRSxRQUFRLEVBQUUsT0FBTyxFQUFFLFFBQVEsRUFBRSxZQUFZLEVBQUUsU0FBUyxFQUFFLFVBQVUsRUFBRSxZQUFZLEVBQUUsV0FBVyxFQUFFLFlBQVksRUFBRSxPQUFPLEVBQUUsV0FBVyxFQUFFLFFBQVEsRUFBRSxVQUFVLEVBQUUsQ0FBQztBQUs3UixzQkFBc0I7QUFDdEIsT0FBTyxLQUFLLFVBQVUsTUFBTSwyQkFBMkIsQ0FBQztBQUV4RCxPQUFPLEVBQ0wsVUFBVSxHQUNYLENBQUE7QUFFRCxnQkFBZ0I7QUFDaEIsT0FBTyxLQUFLLE9BQU8sTUFBTSxrQkFBa0IsQ0FBQztBQUU1QyxPQUFPLEVBQ0wsT0FBTyxHQUNSLENBQUE7QUFFRCxjQUFjO0FBQ2QsT0FBTyxLQUFLLE1BQU0sTUFBTSxRQUFRLENBQUM7QUFDakMsT0FBTyxLQUFLLElBQUksTUFBTSxNQUFNLENBQUM7QUFDN0IsT0FBTyxLQUFLLFFBQVEsTUFBTSxXQUFXLENBQUM7QUFDdEMsT0FBTyxNQUFNLE1BQU0sV0FBVyxDQUFDO0FBQy9CLE9BQU8sS0FBSyxJQUFJLE1BQU0sTUFBTSxDQUFDO0FBQzdCLE9BQU8sT0FBTyxNQUFNLFVBQVUsQ0FBQztBQUUvQixPQUFPLEVBQ0wsTUFBTSxFQUNOLElBQUksRUFDSixRQUFRLEVBQ1IsTUFBTSxFQUNOLElBQUksRUFDSixPQUFPLEdBQ1IsQ0FBQSJ9

package/dist_ts_interfaces/data/dns-authority.d.ts

@@ -13,10 +13,15 @@
  * The fix is not to make the declared list editable. A list an operator can
  * simply append to is self-assertion, which is precisely the failure mode that
  * let routes claim domains nobody verified we own. Instead a zone earns
- * authority by *proof*: its public delegation must name our nameservers. That
- * proof is unforgeable by an ops-API caller — you cannot point `example.com`'s
- * NS records at our nameservers unless you actually control the domain — and it
- * is the missing comparison between the two representations.
+ * authority by *proof*: its delegation in the parent zone must name our
+ * nameservers. That proof is unforgeable by an ops-API caller — you cannot point
+ * `example.com`'s delegation at our nameservers unless you actually control the
+ * domain — and it is the missing comparison between the two representations.
+ *
+ * The proof is read from the parent zone's own servers, asked without
+ * recursion, never from a recursive resolver: a recursive lookup of a zone
+ * delegated to us but not claimed yet reaches our servers, which REFUSE it, so
+ * it could never prove the delegation it is supposed to prove.
  *
  * `dnsScopes` is gone entirely. There is exactly one representation of DNS
  * authority now, it lives in the database, and it is the one that carries its
@@ -37,7 +42,10 @@ export interface IDnsAuthorityZone {
     origin: TDnsAuthorityZoneOrigin;
     /** When the delegation proof was observed. */
     verifiedAt?: number;
-    /** Nameservers observed at verification time — the evidence for the proof. */
+    /**
+     * The NS set the parent zone's servers delegated the zone to at verification
+     * time — the evidence for the proof.
+     */
     observedNameservers?: string[];
     /** Operator who performed the verification. */
     verifiedBy?: string;
@@ -62,20 +70,69 @@ export interface IDnsAuthoritySettings {
     updatedBy: string;
 }
 /**
- * Outcome of a delegation probe.
+ * Outcome of a delegation probe, decided by the parent zone's servers alone.
+ *
+ * - 'delegated': at least two of the parent's servers, reached through at least
+ *   two different parent nameserver names, gave the identical referral for the
+ *   zone, and its NS set names at least one of our nameservers. A referral that
+ *   carries a DS sets `dsPresent`, and such a zone cannot be claimed.
+ * - 'not-delegated': the same agreement on a referral that names none of our
+ *   nameservers, or on an authoritative "no such delegation" (NXDOMAIN or NODATA
+ *   with the parent's SOA). Also the verdict for an unusable zone name.
+ * - 'undeterminable': anything less — a failed lookup, fewer than two
+ *   conclusive answers, or any disagreement between them.
  *
  * 'undeterminable' is deliberately distinct from 'not-delegated': a resolver
  * timeout is not evidence that a zone is not ours. Conflating them would let a
  * transient network fault revoke authority, turning a blip into an outage.
  */
 export type TDnsDelegationVerdict = 'delegated' | 'not-delegated' | 'undeterminable';
+/**
+ * How the probe classified one parent server's answer to the non-recursive
+ * NS query for the zone.
+ *
+ * - 'referral': RCODE 0, AA=0, an empty answer section, and an authority
+ *   section whose NS records are all owned by the zone, with an OPT record that
+ *   echoes DO=1 (otherwise a missing DS would prove nothing).
+ * - 'negative': AA=1 NXDOMAIN or NODATA with an empty answer section and the
+ *   parent zone's SOA in the authority section.
+ * - 'inconclusive': everything else, including timeouts, REFUSED, any other
+ *   AA=1 answer (a server that hosts the parent and the child zone answers for
+ *   the child instead of referring) and referrals to any other name.
+ */
+export type TDnsDelegationParentOutcome = 'referral' | 'negative' | 'inconclusive';
+/** One parent server's answer to the non-recursive NS query for the zone. */
+export interface IDnsDelegationParentAnswer {
+    /** The parent server the probe asked, as `ip:port` (`[ip]:port` for IPv6). */
+    server: string;
+    /** The parent nameserver name this address belongs to. */
+    nameserver: string;
+    outcome: TDnsDelegationParentOutcome;
+    /** The referral's NS set, lowercased, trailing-dot stripped and sorted (referral only). */
+    nameservers?: string[];
+    /** Whether the referral carried a DS RRset for the zone (referral only). */
+    dsPresent?: boolean;
+    detail: string;
+}
 export interface IDnsDelegationProbe {
     zone: string;
     verdict: TDnsDelegationVerdict;
-    /** NS records observed for the zone, lowercased and trailing-dot stripped. */
+    /**
+     * The NS set the parent zone's servers delegate the zone to, lowercased and
+     * trailing-dot stripped; empty when there is no agreed referral.
+     */
     observedNameservers: string[];
     expectedNameservers: string[];
     detail: string;
+    /** The parent zone whose servers were asked; absent when it was not found. */
+    parentZone?: string;
+    /**
+     * Whether the agreed referral carried a DS for the zone. Set on a verdict
+     * that rests on a referral; a `delegated` zone with a DS cannot be claimed.
+     */
+    dsPresent?: boolean;
+    /** Every parent server's classified answer, when parent servers were asked. */
+    parentAnswers?: IDnsDelegationParentAnswer[];
 }
 /** A disagreement between claimed authority and what is actually true. */
 export type TDnsAuthorityDriftKind = 

package/dist_ts_interfaces/data/dns-authority.js

@@ -13,14 +13,19 @@
  * The fix is not to make the declared list editable. A list an operator can
  * simply append to is self-assertion, which is precisely the failure mode that
  * let routes claim domains nobody verified we own. Instead a zone earns
- * authority by *proof*: its public delegation must name our nameservers. That
- * proof is unforgeable by an ops-API caller — you cannot point `example.com`'s
- * NS records at our nameservers unless you actually control the domain — and it
- * is the missing comparison between the two representations.
+ * authority by *proof*: its delegation in the parent zone must name our
+ * nameservers. That proof is unforgeable by an ops-API caller — you cannot point
+ * `example.com`'s delegation at our nameservers unless you actually control the
+ * domain — and it is the missing comparison between the two representations.
+ *
+ * The proof is read from the parent zone's own servers, asked without
+ * recursion, never from a recursive resolver: a recursive lookup of a zone
+ * delegated to us but not claimed yet reaches our servers, which REFUSE it, so
+ * it could never prove the delegation it is supposed to prove.
  *
  * `dnsScopes` is gone entirely. There is exactly one representation of DNS
  * authority now, it lives in the database, and it is the one that carries its
  * own evidence.
  */
 export {};
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZG5zLWF1dGhvcml0eS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzX2ludGVyZmFjZXMvZGF0YS9kbnMtYXV0aG9yaXR5LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztHQXVCRyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZG5zLWF1dGhvcml0eS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzX2ludGVyZmFjZXMvZGF0YS9kbnMtYXV0aG9yaXR5LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0dBNEJHIn0=

package/dist_ts_interfaces/requests/dns-authority.d.ts

@@ -12,8 +12,9 @@ export interface IReq_GetDnsAuthority extends plugins.typedrequestInterfaces.imp
     };
 }
 /**
- * Probe a zone's public delegation without changing anything. Lets an operator
- * see the evidence before claiming authority.
+ * Probe a zone's delegation in its parent zone without changing anything. Lets
+ * an operator see the evidence (the parent zone and each parent server's
+ * answer) before claiming authority.
  */
 export interface IReq_ProbeDnsAuthorityZone extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_ProbeDnsAuthorityZone> {
     method: 'probeDnsAuthorityZone';
@@ -27,9 +28,10 @@ export interface IReq_ProbeDnsAuthorityZone extends plugins.typedrequestInterfac
     };
 }
 /**
- * Claim authority over a zone. Succeeds only when the zone's public delegation
- * names our nameservers; the claim is then persisted and reconciled in-process,
- * with no restart.
+ * Claim authority over a zone. Succeeds only on a `delegated` probe without a
+ * DS: the parent zone's servers agree that the zone is delegated to our
+ * nameservers and publish no DS for it. The claim is then persisted and
+ * reconciled in-process, with no restart.
  */
 export interface IReq_VerifyDnsAuthorityZone extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_VerifyDnsAuthorityZone> {
     method: 'verifyDnsAuthorityZone';

package/dist_ts_migrations/index.d.ts

@@ -28,6 +28,29 @@ export interface IMigrationRunner {
     getCurrentVersion(): Promise<string | null>;
     run(): Promise<IMigrationRunResult>;
 }
+/** The result of a downgrade run or plan, as `dcrouter migrate` reports it. */
+export interface IDowngradeMigrationRunResult extends IMigrationRunResult {
+    targetVersion: string;
+    wasUpToDate: boolean;
+    stepsApplied: Array<{
+        id: string;
+        fromVersion: string;
+        toVersion: string;
+        status: string;
+    }>;
+    /** The steps a plan would run; empty after a run. */
+    stepsSkipped: Array<{
+        id: string;
+        fromVersion: string;
+        toVersion: string;
+        status: string;
+    }>;
+}
+export interface IDowngradeMigrationRunner extends IMigrationRunner {
+    run(): Promise<IDowngradeMigrationRunResult>;
+    /** The reverse plan, without the lock and without writing anything. */
+    plan(): Promise<IDowngradeMigrationRunResult>;
+}
 export declare const dcRouterSchemaVersion = "34.0.0";
 export declare function createApplicationMigrationRunner(db: unknown, options?: IDcRouterMigrationOptions): Promise<IMigrationRunner>;
 export interface IDcRouterMigrationOptions {
@@ -60,3 +83,17 @@ export interface IDcRouterMigrationOptions {
  * @param targetVersion - The explicit schema or historical migration test target
  */
 export declare function createMigrationRunner(db: unknown, targetVersion: string, options?: IDcRouterMigrationOptions): Promise<IMigrationRunner>;
+/**
+ * Create the runner `dcrouter migrate` walks the ledger back with.
+ *
+ * It registers the whole chain through `dcRouterSchemaVersion`, so smartmigration plans the
+ * reverse run itself: it refuses a target that is not a step boundary (`TARGET_NOT_REACHABLE`) and
+ * a path across a step without `.down()` (`DOWNGRADE_STEP_IRREVERSIBLE`) before any handler runs.
+ * `run()` and `plan()` refuse by name, before that, a database without a ledger, a ledger a newer
+ * dcrouter wrote and a target ahead of the ledger: a forward migration is what starting dcrouter
+ * does. A target equal to the ledger is the no-op a repeated downgrade is.
+ *
+ * @param db - An initialized SmartdataDb on a storage root no dcrouter is running on
+ * @param targetVersion - The data version to walk the ledger back to
+ */
+export declare function createDowngradeMigrationRunner(db: unknown, targetVersion: string, options?: IDcRouterMigrationOptions): Promise<IDowngradeMigrationRunner>;