@uns-kit/core 3.0.28 → 3.0.30

package/MIGRATIONS.md

@@ -9,6 +9,106 @@ Agents must inspect the application's existing ownership and shutdown flow
 before editing it. The examples below describe the intended behavior, not a
 mechanical search-and-replace operation.
 
+## 3.0.30 - Optional MQTT output buffering and durable admission
+
+When crossing `<3.0.30` to `>=3.0.30`, output persistence remains optional.
+Registry3.0.29 must not be assumed to contain these APIs. Ordinary
+applications require no migration and keep the old publisher behavior.
+
+Opt-in TypeScript applications may configure `output.publishQueue` and pass it via
+standard MQTT channel resolution. `buffered` uses RAM with spill-on-failure/overflow;
+`durable` acknowledges local admission only after a SQLite WAL/FULL commit. Both
+require QoS1/2, serial output and an explicit private persistent directory. A publish
+call acknowledges admission; `flush()` includes retained records and waits for broker
+completion. Unknown delivery outcomes can replay. Input MQTT ACKs are not changed.
+
+Use one owner with `handover=false`. Legacy RAM hash handover cannot transfer the
+outbox. Preserve existing application journals/Archiver spools; do not reinterpret,
+move or delete them as part of this opt-in. Host migration/automatic backup, Python,
+SQL writers and non-MQTT destinations remain outside this capability. See the source
+`docs/mqtt-output-persistence.md` and two unrelated examples before enabling it.
+
+### Shared bounded journal backup coverage in 3.0.30
+
+Consume `runtime/process-group-backup-contract.js` for public coverage validation,
+and vendor the matching standalone exporter plus contract JSON with source/digest
+provenance in native helpers. The fixed contract supports32 journals while keeping
+512MiB snapshot and1GiB capsule bounds. Do not take limits from an operation request.
+Old two-argument exporter callers keep their nine-journal limit; archives through9
+remain compatible. Older readers may reject larger new captures, so coordinate the
+host/helper rollout. Preserve all source journals and reject overflow without partial
+success. See `docs/process-group-backup-capacity.md`. This follow-up is not
+part of source3.0.29; use the coordinated3.0.30 SDK, host and helper before rollout.
+
+## 3.0.29 - Optional configuration resources and reviewed journal transitions
+
+Release preparation: source/packaged local acceptance is complete; npm publication
+is a separate owner-operated step. These APIs are not in registry3.0.28.
+
+When crossing `<3.0.29` to `>=3.0.29`, existing applications and file policies need
+no migration. Opt-in applications can declare `processGroupConfigurationRuntime`
+protocol2 and use `runtime/configuration-group-contract.js`, immutable opaque JSON
+resources, journal contract2 and policy schema4. Applications own business validation;
+SDK owns common validation/hash/identity rules; hosts own authenticated review,
+durable operations and launch control. Never add named-application lifecycle code.
+
+Use `configurationGroupSnapshot` to bind plain JSON resources and retain its SDK-issued
+proof. Validate the resolved application resources against the authorized raw snapshot.
+Keep runtime group snapshots immutable. No mapping, unit or topic is inferred by the
+host. See [the configuration guide](https://github.com/uns-openhub/uns-kit/blob/master/docs/process-group-configuration-runtime.md)
+and [worked unrelated adapter example](https://github.com/uns-openhub/uns-kit/blob/master/docs/examples/configuration-process-group.md).
+
+Keep file protocol1/policy3 and frozen historical policies1/2 unchanged. New journals
+store profile bindings as `{processName, resourceSha256, dataGroup}`. Host inspection,
+reservations, staging, supervision and standalone snapshots understand both formats;
+ordinary undeclared Node/Python services retain their current behavior. Hosts must
+pin group/generation in configured launch reservations and share these helpers rather
+than reconstruct the validation or execute application JavaScript.
+
+### Resource changes require separate generations
+
+The paired management envelope stays protocol1. Its nested protocol2 input reviews
+four placements, separate source/target journals and explicit input-pause,
+resource-review and possible-broker-replay acknowledgements. Use the shared
+`process-group-generation.js` review; stop receiver first, finish admitted old work,
+prove publisher exit, then launch the reviewed new receiver and publisher. Rollback
+symmetrically drains the successor generation before restoring the old pair.
+
+Never relabel an old journal or reinterpret pending payloads, even when it is empty.
+UUIDs, contracts, checkpoints and canonical policies remain separate and retained.
+Unknown initialization/stop/start outcomes require reconciliation of the same durable
+operation. Do not initialize a replacement journal or retry an unconfirmed launch.
+See [generation preparation and limits](https://github.com/uns-openhub/uns-kit/blob/master/docs/process-group-generations.md).
+
+### Version changes can retain an unchanged generation
+
+`reviewInstalledProcessGroupUpgrade` supports file groups and configured pairs through
+the existing nested protocol1 version input. Configured review adds `retainedJournal`
+(contract2); all resources, process/profile/input/broker identities, capacity,
+journal directory/UUID and generation must stay unchanged. A resource change belongs
+to the separate-generation path. No initializer runs during this version-only step.
+
+The SDK validates staged schema4 target policy data without issuing live authority.
+After both prior owners have proven clean exits, the host compares/swaps the canonical
+policy and starts receiver before publisher with one-use launch identities. Both old
+and new policy byte snapshots remain available for rollback; pending records and
+completed checkpoints stay valid in that same journal. Recheck its integrity before
+policy replacement and launch. See [paired-version guide and request example](https://github.com/uns-openhub/uns-kit/blob/master/docs/process-group-version-upgrade.md).
+
+### Packaging and limits
+
+Local Linux acceptance covers pending tasks, interruption, lost response, same-operation
+reconciliation, exact outputs and rollback. The shared snapshot reader accepts journal
+contracts1/2 and verifies resource/checkpoint bindings; sync native helpers from the
+exact installed SDK asset/version/hash. Existing backup bounds remain9 journals total,
+unique flat snapshot group identifiers across namespaces, and archiver spool exclusion.
+
+Publish the coordinated SDK before pinning downstream registry versions/lockfiles;
+keep Zod resolution compatible and regenerate schemas/typecheck from frozen installs.
+Hosts/helpers require their own compatible releases. This does not authorize a
+production rollout, cross-host queue transfer, exactly-once output, automatic unknown
+outcome resolution or recovery of MQTT input never admitted by the receiver.
+
 ## 3.0.28 - Paired process-group version upgrades
 
 When crossing `<3.0.28` to `>=3.0.28`, shared schemas and installed-resource review support a

package/README.md

@@ -273,6 +273,16 @@ and apply only the migrations whose version boundaries are crossed. The
 `3.0.0` migration documents the MQTT table-column object contract, while the
 `2.0.71` migration documents MQTT publish and shutdown ownership changes.
 
+## Optional configuration-owned process groups
+
+Version3.0.29 adds optional shared contracts for immutable application-owned JSON
+resources, reviewed journal generations and same-generation paired version upgrades.
+Existing file groups and ordinary services need no migration. Applications validate
+business resources; hosts enforce authenticated durable lifecycle operations.
+See the [guide and example](https://github.com/uns-openhub/uns-kit/blob/master/docs/process-group-configuration-runtime.md)
+and the3.0.29 entry in `MIGRATIONS.md`. Source preparation is not npm publication or
+production activation.
+
 ## Sync UNS schema from the controller
 
 `sync-uns-schema` fetches the canonical UNS dictionary and measurements from the controller REST API and refreshes local JSON files and generated TypeScript artifacts.

package/dist/config/app-config.d.ts

@@ -112,6 +112,20 @@ export interface ProjectAppConfig {
         cert?: string | undefined;
         key?: string | undefined;
         servername?: string | undefined;
+        /** Opt-in MQTT output persistence; does not persist input subscriptions. */
+        publishQueue?: {
+            mode: "buffered" | "durable";
+            directory: string;
+            maxRecords?: number;
+            maxBytes?: number;
+            memoryRecords?: number;
+            memoryBytes?: number;
+            maxMessageBytes?: number;
+            maxDiskBytes?: number;
+            minFreeBytes?: number;
+            retryIntervalMs?: number;
+            publishTimeoutMs?: number;
+        } | undefined;
     } | undefined;
     infra: {
         host?: string | undefined;

package/dist/config/app-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-config.d.ts","sourceRoot":"","sources":["../../src/config/app-config.ts"],"names":[],"mappings":"AACA,MAAM,WAAW,gBAAgB;IAC7B,GAAG,EAAE;QACD,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,2EAA2E;QAC3E,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC3B,8EAA8E;QAC9E,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC3B,0DAA0D;QAC1D,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC9B,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,UAAU,CAAC;QAC7C,iDAAiD;QACjD,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,2DAA2D;QAC3D,gBAAgB,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;QAC/C,+EAA+E;QAC/E,UAAU,CAAC,EAAE;YACT,uEAAuE;YACvE,OAAO,CAAC,EAAE,OAAO,CAAC;YAClB,8DAA8D;YAC9D,aAAa,CAAC,EAAE,OAAO,CAAC;YACxB,sDAAsD;YACtD,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;YACjC,2GAA2G;YAC3G,kBAAkB,CAAC,EAAE,OAAO,CAAC;YAC7B,6FAA6F;YAC7F,gBAAgB,CAAC,EAAE,MAAM,CAAC;YAC1B,qFAAqF;YACrF,iBAAiB,CAAC,EAAE,MAAM,CAAC;SAC9B,GAAG,SAAS,CAAC;QACd,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACtC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACrC,GAAG,CAAC,EAAE,KAAK,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;KAC7C,CAAC;IACF,OAAO,CAAC,EAAE;QACN,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;KAC9E,GAAG,SAAS,CAAC;IACd,KAAK,CAAC,EAAE;QACJ,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC1B,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;QAC7B,OAAO,CAAC,EAAE;YACN,IAAI,EAAE,MAAM,CAAC;YACb,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;YAC1B,QAAQ,CAAC,EAAE,CAAC,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,GAAG,SAAS,CAAC;SAC5E,EAAE,GAAG,SAAS,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC1B,QAAQ,CAAC,EAAE,CAAC,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,GAAG,SAAS,CAAC;QACzE,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC9B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC9B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC9B,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC/B,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACpC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACrC,uBAAuB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QAC9C,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QAClC,YAAY,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QACnC,kBAAkB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QACzC,UAAU,CAAC,EAAE;YACT,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;YAC3C,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;YACpC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;YACvC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;YACvC,0BAA0B,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;YACjD,yBAAyB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;YAChD,cAAc,CAAC,EAAE;gBACb,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;aACvB,GAAG,SAAS,CAAC;SACjB,GAAG,SAAS,CAAC;QACd,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACxB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC1B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACzB,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KACnC,GAAG,SAAS,CAAC;IACd,MAAM,CAAC,EAAE;QACL,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC1B,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;QAC7B,OAAO,CAAC,EAAE;YACN,IAAI,EAAE,MAAM,CAAC;YACb,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;YAC1B,QAAQ,CAAC,EAAE,CAAC,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,GAAG,SAAS,CAAC;SAC5E,EAAE,GAAG,SAAS,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC1B,QAAQ,CAAC,EAAE,CAAC,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,GAAG,SAAS,CAAC;QACzE,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC9B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC9B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC9B,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC/B,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACpC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACrC,uBAAuB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QAC9C,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QAClC,YAAY,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QACnC,kBAAkB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QACzC,UAAU,CAAC,EAAE;YACT,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;YAC3C,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;YACpC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;YACvC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;YACvC,0BAA0B,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;YACjD,yBAAyB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;YAChD,cAAc,CAAC,EAAE;gBACb,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;aACvB,GAAG,SAAS,CAAC;SACjB,GAAG,SAAS,CAAC;QACd,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACxB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC1B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACzB,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KACnC,GAAG,SAAS,CAAC;IACd,KAAK,EAAE;QACH,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC1B,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;QAC7B,OAAO,CAAC,EAAE;YACN,IAAI,EAAE,MAAM,CAAC;YACb,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;YAC1B,QAAQ,CAAC,EAAE,CAAC,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,GAAG,SAAS,CAAC;SAC5E,EAAE,GAAG,SAAS,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC1B,QAAQ,CAAC,EAAE,CAAC,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,GAAG,SAAS,CAAC;QACzE,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC9B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC9B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC9B,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC/B,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACpC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACrC,uBAAuB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QAC9C,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QAClC,YAAY,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QACnC,kBAAkB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QACzC,UAAU,CAAC,EAAE;YACT,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;YAC3C,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;YACpC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;YACvC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;YACvC,0BAA0B,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;YACjD,yBAAyB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;YAChD,cAAc,CAAC,EAAE;gBACb,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;aACvB,GAAG,SAAS,CAAC;SACjB,GAAG,SAAS,CAAC;QACd,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACxB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC1B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACzB,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KACnC,CAAC;IACF,MAAM,CAAC,EAAE;QACL,QAAQ,CAAC,EAAE,cAAc,CAAC;QAC1B,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAChC,GAAG,SAAS,CAAC;CACjB;AAED,MAAM,WAAW,SAAU,SAAQ,gBAAgB;CAAG"}
+{"version":3,"file":"app-config.d.ts","sourceRoot":"","sources":["../../src/config/app-config.ts"],"names":[],"mappings":"AACA,MAAM,WAAW,gBAAgB;IAC7B,GAAG,EAAE;QACD,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,2EAA2E;QAC3E,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC3B,8EAA8E;QAC9E,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC3B,0DAA0D;QAC1D,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC9B,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,UAAU,CAAC;QAC7C,iDAAiD;QACjD,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,2DAA2D;QAC3D,gBAAgB,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;QAC/C,+EAA+E;QAC/E,UAAU,CAAC,EAAE;YACT,uEAAuE;YACvE,OAAO,CAAC,EAAE,OAAO,CAAC;YAClB,8DAA8D;YAC9D,aAAa,CAAC,EAAE,OAAO,CAAC;YACxB,sDAAsD;YACtD,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;YACjC,2GAA2G;YAC3G,kBAAkB,CAAC,EAAE,OAAO,CAAC;YAC7B,6FAA6F;YAC7F,gBAAgB,CAAC,EAAE,MAAM,CAAC;YAC1B,qFAAqF;YACrF,iBAAiB,CAAC,EAAE,MAAM,CAAC;SAC9B,GAAG,SAAS,CAAC;QACd,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACtC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACrC,GAAG,CAAC,EAAE,KAAK,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;KAC7C,CAAC;IACF,OAAO,CAAC,EAAE;QACN,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;KAC9E,GAAG,SAAS,CAAC;IACd,KAAK,CAAC,EAAE;QACJ,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC1B,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;QAC7B,OAAO,CAAC,EAAE;YACN,IAAI,EAAE,MAAM,CAAC;YACb,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;YAC1B,QAAQ,CAAC,EAAE,CAAC,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,GAAG,SAAS,CAAC;SAC5E,EAAE,GAAG,SAAS,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC1B,QAAQ,CAAC,EAAE,CAAC,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,GAAG,SAAS,CAAC;QACzE,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC9B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC9B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC9B,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC/B,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACpC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACrC,uBAAuB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QAC9C,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QAClC,YAAY,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QACnC,kBAAkB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QACzC,UAAU,CAAC,EAAE;YACT,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;YAC3C,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;YACpC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;YACvC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;YACvC,0BAA0B,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;YACjD,yBAAyB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;YAChD,cAAc,CAAC,EAAE;gBACb,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;aACvB,GAAG,SAAS,CAAC;SACjB,GAAG,SAAS,CAAC;QACd,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACxB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC1B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACzB,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KACnC,GAAG,SAAS,CAAC;IACd,MAAM,CAAC,EAAE;QACL,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC1B,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;QAC7B,OAAO,CAAC,EAAE;YACN,IAAI,EAAE,MAAM,CAAC;YACb,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;YAC1B,QAAQ,CAAC,EAAE,CAAC,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,GAAG,SAAS,CAAC;SAC5E,EAAE,GAAG,SAAS,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC1B,QAAQ,CAAC,EAAE,CAAC,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,GAAG,SAAS,CAAC;QACzE,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC9B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC9B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC9B,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC/B,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACpC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACrC,uBAAuB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QAC9C,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QAClC,YAAY,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QACnC,kBAAkB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QACzC,UAAU,CAAC,EAAE;YACT,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;YAC3C,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;YACpC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;YACvC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;YACvC,0BAA0B,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;YACjD,yBAAyB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;YAChD,cAAc,CAAC,EAAE;gBACb,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;aACvB,GAAG,SAAS,CAAC;SACjB,GAAG,SAAS,CAAC;QACd,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACxB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC1B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACzB,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAChC,4EAA4E;QAC5E,YAAY,CAAC,EAAE;YACX,IAAI,EAAE,UAAU,GAAG,SAAS,CAAC;YAC7B,SAAS,EAAE,MAAM,CAAC;YAClB,UAAU,CAAC,EAAE,MAAM,CAAC;YACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,aAAa,CAAC,EAAE,MAAM,CAAC;YACvB,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB,eAAe,CAAC,EAAE,MAAM,CAAC;YACzB,YAAY,CAAC,EAAE,MAAM,CAAC;YACtB,YAAY,CAAC,EAAE,MAAM,CAAC;YACtB,eAAe,CAAC,EAAE,MAAM,CAAC;YACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;SAC7B,GAAG,SAAS,CAAC;KACjB,GAAG,SAAS,CAAC;IACd,KAAK,EAAE;QACH,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC1B,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;QAC7B,OAAO,CAAC,EAAE;YACN,IAAI,EAAE,MAAM,CAAC;YACb,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;YAC1B,QAAQ,CAAC,EAAE,CAAC,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,GAAG,SAAS,CAAC;SAC5E,EAAE,GAAG,SAAS,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC1B,QAAQ,CAAC,EAAE,CAAC,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,GAAG,SAAS,CAAC;QACzE,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC9B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC9B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC9B,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC/B,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACpC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACrC,uBAAuB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QAC9C,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QAClC,YAAY,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QACnC,kBAAkB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;QACzC,UAAU,CAAC,EAAE;YACT,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;YAC3C,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;YACpC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;YACvC,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;YACvC,0BAA0B,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;YACjD,yBAAyB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;YAChD,cAAc,CAAC,EAAE;gBACb,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;aACvB,GAAG,SAAS,CAAC;SACjB,GAAG,SAAS,CAAC;QACd,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACxB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC1B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACzB,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KACnC,CAAC;IACF,MAAM,CAAC,EAAE;QACL,QAAQ,CAAC,EAAE,cAAc,CAAC;QAC1B,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KAChC,GAAG,SAAS,CAAC;CACjB;AAED,MAAM,WAAW,SAAU,SAAQ,gBAAgB;CAAG"}

package/dist/config/app-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-config.js","sourceRoot":"","sources":["../../src/config/app-config.ts"],"names":[],"mappings":"","sourcesContent":["/* Auto-generated. Do not edit by hand. */\nexport interface ProjectAppConfig {\n    uns: {\n        graphql: string;\n        rest: string;\n        /** Bearer token used for service-to-service access to the UNS instance. */\n        token?: string | undefined;\n        /** Email used when authenticating to graphql endpoint of the UNS instance. */\n        email?: string | undefined;\n        /** Password or secret value paired with the UNS email. */\n        password?: string | undefined;\n        instanceMode?: \"wait\" | \"force\" | \"handover\";\n        /** Process name used in MQTT topics and logs. */\n        processName: string;\n        handover?: boolean;\n        /** Opt-in controller-correlated MQTT handover protocol. */\n        handoverProtocol?: \"correlated-v1\" | undefined;\n        /** Optional PM2/controller supervisor guard settings for this RTT instance. */\n        supervisor?: {\n            /** Enable controller/PM2 supervisor handling for this RTT instance. */\n            enabled?: boolean;\n            /** Let PM2 restart the process when it exits unexpectedly. */\n            restartOnExit?: boolean;\n            /** Optional PM2 memory restart limit in megabytes. */\n            maxMemoryMb?: number | undefined;\n            /** Let the controller auto-start this instance when required system-service runtime signals are absent. */\n            restartOnUnhealthy?: boolean;\n            /** How long runtime signals must stay unhealthy before the controller supervisor can act. */\n            unhealthyAfterMs?: number;\n            /** Minimum time between controller supervisor restart attempts for this instance. */\n            restartCooldownMs?: number;\n        } | undefined;\n        jwksWellKnownUrl?: string | undefined;\n        kidWellKnownUrl?: string | undefined;\n        env?: \"dev\" | \"staging\" | \"test\" | \"prod\";\n    };\n    logging?: {\n        adapter?: string;\n        host: string;\n        port?: number;\n        level?: \"error\" | \"warn\" | \"info\" | \"http\" | \"verbose\" | \"debug\" | \"silly\";\n    } | undefined;\n    input?: {\n        host?: string | undefined;\n        hosts?: string[] | undefined;\n        servers?: {\n            host: string;\n            port?: number | undefined;\n            protocol?: (\"mqtt\" | \"mqtts\" | \"ws\" | \"wss\" | \"tcp\" | \"ssl\") | undefined;\n        }[] | undefined;\n        port?: number | undefined;\n        protocol?: (\"mqtt\" | \"mqtts\" | \"ws\" | \"wss\" | \"tcp\" | \"ssl\") | undefined;\n        username?: string | undefined;\n        password?: string | undefined;\n        clientId?: string | undefined;\n        clean?: boolean | undefined;\n        keepalive?: number | undefined;\n        connectTimeout?: number | undefined;\n        reconnectPeriod?: number | undefined;\n        reconnectOnConnackError?: boolean | undefined;\n        resubscribe?: boolean | undefined;\n        queueQoSZero?: boolean | undefined;\n        rejectUnauthorized?: boolean | undefined;\n        properties?: {\n            sessionExpiryInterval?: number | undefined;\n            receiveMaximum?: number | undefined;\n            maximumPacketSize?: number | undefined;\n            topicAliasMaximum?: number | undefined;\n            requestResponseInformation?: boolean | undefined;\n            requestProblemInformation?: boolean | undefined;\n            userProperties?: {\n                [x: string]: string;\n            } | undefined;\n        } | undefined;\n        ca?: string | undefined;\n        cert?: string | undefined;\n        key?: string | undefined;\n        servername?: string | undefined;\n    } | undefined;\n    output?: {\n        host?: string | undefined;\n        hosts?: string[] | undefined;\n        servers?: {\n            host: string;\n            port?: number | undefined;\n            protocol?: (\"mqtt\" | \"mqtts\" | \"ws\" | \"wss\" | \"tcp\" | \"ssl\") | undefined;\n        }[] | undefined;\n        port?: number | undefined;\n        protocol?: (\"mqtt\" | \"mqtts\" | \"ws\" | \"wss\" | \"tcp\" | \"ssl\") | undefined;\n        username?: string | undefined;\n        password?: string | undefined;\n        clientId?: string | undefined;\n        clean?: boolean | undefined;\n        keepalive?: number | undefined;\n        connectTimeout?: number | undefined;\n        reconnectPeriod?: number | undefined;\n        reconnectOnConnackError?: boolean | undefined;\n        resubscribe?: boolean | undefined;\n        queueQoSZero?: boolean | undefined;\n        rejectUnauthorized?: boolean | undefined;\n        properties?: {\n            sessionExpiryInterval?: number | undefined;\n            receiveMaximum?: number | undefined;\n            maximumPacketSize?: number | undefined;\n            topicAliasMaximum?: number | undefined;\n            requestResponseInformation?: boolean | undefined;\n            requestProblemInformation?: boolean | undefined;\n            userProperties?: {\n                [x: string]: string;\n            } | undefined;\n        } | undefined;\n        ca?: string | undefined;\n        cert?: string | undefined;\n        key?: string | undefined;\n        servername?: string | undefined;\n    } | undefined;\n    infra: {\n        host?: string | undefined;\n        hosts?: string[] | undefined;\n        servers?: {\n            host: string;\n            port?: number | undefined;\n            protocol?: (\"mqtt\" | \"mqtts\" | \"ws\" | \"wss\" | \"tcp\" | \"ssl\") | undefined;\n        }[] | undefined;\n        port?: number | undefined;\n        protocol?: (\"mqtt\" | \"mqtts\" | \"ws\" | \"wss\" | \"tcp\" | \"ssl\") | undefined;\n        username?: string | undefined;\n        password?: string | undefined;\n        clientId?: string | undefined;\n        clean?: boolean | undefined;\n        keepalive?: number | undefined;\n        connectTimeout?: number | undefined;\n        reconnectPeriod?: number | undefined;\n        reconnectOnConnackError?: boolean | undefined;\n        resubscribe?: boolean | undefined;\n        queueQoSZero?: boolean | undefined;\n        rejectUnauthorized?: boolean | undefined;\n        properties?: {\n            sessionExpiryInterval?: number | undefined;\n            receiveMaximum?: number | undefined;\n            maximumPacketSize?: number | undefined;\n            topicAliasMaximum?: number | undefined;\n            requestResponseInformation?: boolean | undefined;\n            requestProblemInformation?: boolean | undefined;\n            userProperties?: {\n                [x: string]: string;\n            } | undefined;\n        } | undefined;\n        ca?: string | undefined;\n        cert?: string | undefined;\n        key?: string | undefined;\n        servername?: string | undefined;\n    };\n    devops?: {\n        provider?: \"azure-devops\";\n        organization: string;\n        project?: string | undefined;\n    } | undefined;\n}\n\nexport interface AppConfig extends ProjectAppConfig {}\n"]}
+{"version":3,"file":"app-config.js","sourceRoot":"","sources":["../../src/config/app-config.ts"],"names":[],"mappings":"","sourcesContent":["/* Auto-generated. Do not edit by hand. */\nexport interface ProjectAppConfig {\n    uns: {\n        graphql: string;\n        rest: string;\n        /** Bearer token used for service-to-service access to the UNS instance. */\n        token?: string | undefined;\n        /** Email used when authenticating to graphql endpoint of the UNS instance. */\n        email?: string | undefined;\n        /** Password or secret value paired with the UNS email. */\n        password?: string | undefined;\n        instanceMode?: \"wait\" | \"force\" | \"handover\";\n        /** Process name used in MQTT topics and logs. */\n        processName: string;\n        handover?: boolean;\n        /** Opt-in controller-correlated MQTT handover protocol. */\n        handoverProtocol?: \"correlated-v1\" | undefined;\n        /** Optional PM2/controller supervisor guard settings for this RTT instance. */\n        supervisor?: {\n            /** Enable controller/PM2 supervisor handling for this RTT instance. */\n            enabled?: boolean;\n            /** Let PM2 restart the process when it exits unexpectedly. */\n            restartOnExit?: boolean;\n            /** Optional PM2 memory restart limit in megabytes. */\n            maxMemoryMb?: number | undefined;\n            /** Let the controller auto-start this instance when required system-service runtime signals are absent. */\n            restartOnUnhealthy?: boolean;\n            /** How long runtime signals must stay unhealthy before the controller supervisor can act. */\n            unhealthyAfterMs?: number;\n            /** Minimum time between controller supervisor restart attempts for this instance. */\n            restartCooldownMs?: number;\n        } | undefined;\n        jwksWellKnownUrl?: string | undefined;\n        kidWellKnownUrl?: string | undefined;\n        env?: \"dev\" | \"staging\" | \"test\" | \"prod\";\n    };\n    logging?: {\n        adapter?: string;\n        host: string;\n        port?: number;\n        level?: \"error\" | \"warn\" | \"info\" | \"http\" | \"verbose\" | \"debug\" | \"silly\";\n    } | undefined;\n    input?: {\n        host?: string | undefined;\n        hosts?: string[] | undefined;\n        servers?: {\n            host: string;\n            port?: number | undefined;\n            protocol?: (\"mqtt\" | \"mqtts\" | \"ws\" | \"wss\" | \"tcp\" | \"ssl\") | undefined;\n        }[] | undefined;\n        port?: number | undefined;\n        protocol?: (\"mqtt\" | \"mqtts\" | \"ws\" | \"wss\" | \"tcp\" | \"ssl\") | undefined;\n        username?: string | undefined;\n        password?: string | undefined;\n        clientId?: string | undefined;\n        clean?: boolean | undefined;\n        keepalive?: number | undefined;\n        connectTimeout?: number | undefined;\n        reconnectPeriod?: number | undefined;\n        reconnectOnConnackError?: boolean | undefined;\n        resubscribe?: boolean | undefined;\n        queueQoSZero?: boolean | undefined;\n        rejectUnauthorized?: boolean | undefined;\n        properties?: {\n            sessionExpiryInterval?: number | undefined;\n            receiveMaximum?: number | undefined;\n            maximumPacketSize?: number | undefined;\n            topicAliasMaximum?: number | undefined;\n            requestResponseInformation?: boolean | undefined;\n            requestProblemInformation?: boolean | undefined;\n            userProperties?: {\n                [x: string]: string;\n            } | undefined;\n        } | undefined;\n        ca?: string | undefined;\n        cert?: string | undefined;\n        key?: string | undefined;\n        servername?: string | undefined;\n    } | undefined;\n    output?: {\n        host?: string | undefined;\n        hosts?: string[] | undefined;\n        servers?: {\n            host: string;\n            port?: number | undefined;\n            protocol?: (\"mqtt\" | \"mqtts\" | \"ws\" | \"wss\" | \"tcp\" | \"ssl\") | undefined;\n        }[] | undefined;\n        port?: number | undefined;\n        protocol?: (\"mqtt\" | \"mqtts\" | \"ws\" | \"wss\" | \"tcp\" | \"ssl\") | undefined;\n        username?: string | undefined;\n        password?: string | undefined;\n        clientId?: string | undefined;\n        clean?: boolean | undefined;\n        keepalive?: number | undefined;\n        connectTimeout?: number | undefined;\n        reconnectPeriod?: number | undefined;\n        reconnectOnConnackError?: boolean | undefined;\n        resubscribe?: boolean | undefined;\n        queueQoSZero?: boolean | undefined;\n        rejectUnauthorized?: boolean | undefined;\n        properties?: {\n            sessionExpiryInterval?: number | undefined;\n            receiveMaximum?: number | undefined;\n            maximumPacketSize?: number | undefined;\n            topicAliasMaximum?: number | undefined;\n            requestResponseInformation?: boolean | undefined;\n            requestProblemInformation?: boolean | undefined;\n            userProperties?: {\n                [x: string]: string;\n            } | undefined;\n        } | undefined;\n        ca?: string | undefined;\n        cert?: string | undefined;\n        key?: string | undefined;\n        servername?: string | undefined;\n        /** Opt-in MQTT output persistence; does not persist input subscriptions. */\n        publishQueue?: {\n            mode: \"buffered\" | \"durable\";\n            directory: string;\n            maxRecords?: number;\n            maxBytes?: number;\n            memoryRecords?: number;\n            memoryBytes?: number;\n            maxMessageBytes?: number;\n            maxDiskBytes?: number;\n            minFreeBytes?: number;\n            retryIntervalMs?: number;\n            publishTimeoutMs?: number;\n        } | undefined;\n    } | undefined;\n    infra: {\n        host?: string | undefined;\n        hosts?: string[] | undefined;\n        servers?: {\n            host: string;\n            port?: number | undefined;\n            protocol?: (\"mqtt\" | \"mqtts\" | \"ws\" | \"wss\" | \"tcp\" | \"ssl\") | undefined;\n        }[] | undefined;\n        port?: number | undefined;\n        protocol?: (\"mqtt\" | \"mqtts\" | \"ws\" | \"wss\" | \"tcp\" | \"ssl\") | undefined;\n        username?: string | undefined;\n        password?: string | undefined;\n        clientId?: string | undefined;\n        clean?: boolean | undefined;\n        keepalive?: number | undefined;\n        connectTimeout?: number | undefined;\n        reconnectPeriod?: number | undefined;\n        reconnectOnConnackError?: boolean | undefined;\n        resubscribe?: boolean | undefined;\n        queueQoSZero?: boolean | undefined;\n        rejectUnauthorized?: boolean | undefined;\n        properties?: {\n            sessionExpiryInterval?: number | undefined;\n            receiveMaximum?: number | undefined;\n            maximumPacketSize?: number | undefined;\n            topicAliasMaximum?: number | undefined;\n            requestResponseInformation?: boolean | undefined;\n            requestProblemInformation?: boolean | undefined;\n            userProperties?: {\n                [x: string]: string;\n            } | undefined;\n        } | undefined;\n        ca?: string | undefined;\n        cert?: string | undefined;\n        key?: string | undefined;\n        servername?: string | undefined;\n    };\n    devops?: {\n        provider?: \"azure-devops\";\n        organization: string;\n        project?: string | undefined;\n    } | undefined;\n}\n\nexport interface AppConfig extends ProjectAppConfig {}\n"]}

package/dist/index.d.ts

@@ -15,4 +15,6 @@ export { UnsClient, LastValueResult, ClientError, RangeResult, BatchRangeTopicRe
 export type { LastValuePayload, CatchAllTimeField, CatchAllAggregate, RangeQueryOptions, RangeColumn, RangeStats, RangePayload, BatchRangeTopicPayload, BatchRangeResponsePayload, ProviderAssetIdentity, AssetIdentityPublicationMetadata, AssetProviderIdentityPublicationMetadata, AssetIdentityPublicationEvidenceMetadata, } from "./tools/datahub/datahub-client.js";
 export { registerService } from "./tools/datahub/runtime-service-registration.js";
 export type { RegisterServiceOptions, RuntimeServiceDescriptor, RuntimeServiceRegistration, RuntimeServiceRegistrationClient, } from "./tools/datahub/runtime-service-registration.js";
+export { mqttPublishQueueSchema } from "./uns-mqtt/publish-queue-contract.js";
+export type { MqttPublishQueueOptions, MqttPublishQueueStatus } from "./uns-mqtt/publish-queue-contract.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,4BAA4B,CAAC;AACxE,YAAY,EACV,qBAAqB,EACrB,wBAAwB,EACxB,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,4BAA4B,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,YAAY,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACxE,cAAc,2BAA2B,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,OAAO,IAAI,MAAM,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AACzF,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAC3F,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AACzE,YAAY,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAC9F,OAAO,EACL,SAAS,EACT,eAAe,EACf,WAAW,EACX,WAAW,EACX,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACV,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,WAAW,EACX,UAAU,EACV,YAAY,EACZ,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,gCAAgC,EAChC,wCAAwC,EACxC,wCAAwC,GACzC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,iDAAiD,CAAC;AAClF,YAAY,EACV,sBAAsB,EACtB,wBAAwB,EACxB,0BAA0B,EAC1B,gCAAgC,GACjC,MAAM,iDAAiD,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,4BAA4B,CAAC;AACxE,YAAY,EACV,qBAAqB,EACrB,wBAAwB,EACxB,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,4BAA4B,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,YAAY,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACxE,cAAc,2BAA2B,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,OAAO,IAAI,MAAM,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AACzF,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAC3F,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AACzE,YAAY,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAC9F,OAAO,EACL,SAAS,EACT,eAAe,EACf,WAAW,EACX,WAAW,EACX,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACV,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,WAAW,EACX,UAAU,EACV,YAAY,EACZ,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,gCAAgC,EAChC,wCAAwC,EACxC,wCAAwC,GACzC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,iDAAiD,CAAC;AAClF,YAAY,EACV,sBAAsB,EACtB,wBAAwB,EACxB,0BAA0B,EAC1B,gCAAgC,GACjC,MAAM,iDAAiD,CAAC;AAEzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,YAAY,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC"}

package/dist/index.js

@@ -9,4 +9,5 @@ export { mqttChannelParameters, resolveMqttChannel } from "./uns-config/mqtt-cha
 export { AuthClient, ServiceTokenProvider } from "./tools/auth/index.js";
 export { UnsClient, LastValueResult, ClientError, RangeResult, BatchRangeTopicResult, BatchRangeResponse, } from "./tools/datahub/datahub-client.js";
 export { registerService } from "./tools/datahub/runtime-service-registration.js";
+export { mqttPublishQueueSchema } from "./uns-mqtt/publish-queue-contract.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAOxE,cAAc,yBAAyB,CAAC;AAExC,cAAc,2BAA2B,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,OAAO,IAAI,MAAM,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAEzF,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAEzE,OAAO,EACL,SAAS,EACT,eAAe,EACf,WAAW,EACX,WAAW,EACX,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,mCAAmC,CAAC;AAgB3C,OAAO,EAAE,eAAe,EAAE,MAAM,iDAAiD,CAAC","sourcesContent":["export { default as UnsProxyProcess } from \"./uns/uns-proxy-process.js\";\nexport type {\n  UnsProxyProcessPlugin,\n  UnsProxyProcessPluginApi,\n  UnsProxyProcessPluginMethod,\n  UnsProxyProcessPluginMethods,\n} from \"./uns/uns-proxy-process.js\";\nexport * from \"./uns/uns-interfaces.js\";\nexport type { HandoverShutdownHooks } from \"./uns/handover-shutdown.js\";\nexport * from \"./uns/service-metadata.js\";\nexport { ConfigFile } from \"./config-file.js\";\nexport { default as logger } from \"./logger.js\";\nexport { getLogger } from \"./logger.js\";\nexport { resolveInfisicalConfig } from \"./uns-config/secret-resolver.js\";\nexport { mqttChannelParameters, resolveMqttChannel } from \"./uns-config/mqtt-channel.js\";\nexport type { MqttChannelConfig, ResolvedMqttChannel } from \"./uns-config/mqtt-channel.js\";\nexport { AuthClient, ServiceTokenProvider } from \"./tools/auth/index.js\";\nexport type { AccessTokenProvider, ServiceTokenProviderOptions } from \"./tools/auth/index.js\";\nexport {\n  UnsClient,\n  LastValueResult,\n  ClientError,\n  RangeResult,\n  BatchRangeTopicResult,\n  BatchRangeResponse,\n} from \"./tools/datahub/datahub-client.js\";\nexport type {\n  LastValuePayload,\n  CatchAllTimeField,\n  CatchAllAggregate,\n  RangeQueryOptions,\n  RangeColumn,\n  RangeStats,\n  RangePayload,\n  BatchRangeTopicPayload,\n  BatchRangeResponsePayload,\n  ProviderAssetIdentity,\n  AssetIdentityPublicationMetadata,\n  AssetProviderIdentityPublicationMetadata,\n  AssetIdentityPublicationEvidenceMetadata,\n} from \"./tools/datahub/datahub-client.js\";\nexport { registerService } from \"./tools/datahub/runtime-service-registration.js\";\nexport type {\n  RegisterServiceOptions,\n  RuntimeServiceDescriptor,\n  RuntimeServiceRegistration,\n  RuntimeServiceRegistrationClient,\n} from \"./tools/datahub/runtime-service-registration.js\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAOxE,cAAc,yBAAyB,CAAC;AAExC,cAAc,2BAA2B,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,OAAO,IAAI,MAAM,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAEzF,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAEzE,OAAO,EACL,SAAS,EACT,eAAe,EACf,WAAW,EACX,WAAW,EACX,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,mCAAmC,CAAC;AAgB3C,OAAO,EAAE,eAAe,EAAE,MAAM,iDAAiD,CAAC;AAQlF,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC","sourcesContent":["export { default as UnsProxyProcess } from \"./uns/uns-proxy-process.js\";\nexport type {\n  UnsProxyProcessPlugin,\n  UnsProxyProcessPluginApi,\n  UnsProxyProcessPluginMethod,\n  UnsProxyProcessPluginMethods,\n} from \"./uns/uns-proxy-process.js\";\nexport * from \"./uns/uns-interfaces.js\";\nexport type { HandoverShutdownHooks } from \"./uns/handover-shutdown.js\";\nexport * from \"./uns/service-metadata.js\";\nexport { ConfigFile } from \"./config-file.js\";\nexport { default as logger } from \"./logger.js\";\nexport { getLogger } from \"./logger.js\";\nexport { resolveInfisicalConfig } from \"./uns-config/secret-resolver.js\";\nexport { mqttChannelParameters, resolveMqttChannel } from \"./uns-config/mqtt-channel.js\";\nexport type { MqttChannelConfig, ResolvedMqttChannel } from \"./uns-config/mqtt-channel.js\";\nexport { AuthClient, ServiceTokenProvider } from \"./tools/auth/index.js\";\nexport type { AccessTokenProvider, ServiceTokenProviderOptions } from \"./tools/auth/index.js\";\nexport {\n  UnsClient,\n  LastValueResult,\n  ClientError,\n  RangeResult,\n  BatchRangeTopicResult,\n  BatchRangeResponse,\n} from \"./tools/datahub/datahub-client.js\";\nexport type {\n  LastValuePayload,\n  CatchAllTimeField,\n  CatchAllAggregate,\n  RangeQueryOptions,\n  RangeColumn,\n  RangeStats,\n  RangePayload,\n  BatchRangeTopicPayload,\n  BatchRangeResponsePayload,\n  ProviderAssetIdentity,\n  AssetIdentityPublicationMetadata,\n  AssetProviderIdentityPublicationMetadata,\n  AssetIdentityPublicationEvidenceMetadata,\n} from \"./tools/datahub/datahub-client.js\";\nexport { registerService } from \"./tools/datahub/runtime-service-registration.js\";\nexport type {\n  RegisterServiceOptions,\n  RuntimeServiceDescriptor,\n  RuntimeServiceRegistration,\n  RuntimeServiceRegistrationClient,\n} from \"./tools/datahub/runtime-service-registration.js\";\n\nexport { mqttPublishQueueSchema } from \"./uns-mqtt/publish-queue-contract.js\";\nexport type { MqttPublishQueueOptions, MqttPublishQueueStatus } from \"./uns-mqtt/publish-queue-contract.js\";\n"]}

package/dist/runtime/configuration-group-authorization.d.ts

@@ -0,0 +1,50 @@
+import { z } from "zod";
+import type { ProcessGroupAuthorizationContext } from "./process-group-authorization.js";
+export declare const configurationGroupAuthorizationSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<4>;
+    kind: z.ZodLiteral<"uns-process-group-runtime-authorization">;
+    protocolVersion: z.ZodLiteral<2>;
+    packageName: z.ZodString;
+    namespace: z.ZodString;
+    groupId: z.ZodString;
+    generationId: z.ZodString;
+    descriptorSha256: z.ZodString;
+    controllerName: z.ZodString;
+    packageRoot: z.ZodString;
+    artifactSha256: z.ZodString;
+    groupSha256: z.ZodString;
+    channelsSha256: z.ZodString;
+    stateRoot: z.ZodString;
+    directory: z.ZodString;
+    journalId: z.ZodNullable<z.ZodString>;
+    placements: z.ZodArray<z.ZodObject<{
+        instanceId: z.ZodString;
+        processName: z.ZodString;
+        role: z.ZodEnum<{
+            source: "source";
+            target: "target";
+            receiver: "receiver";
+        }>;
+        configurationSha256: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type ConfigurationGroupAuthorizationPolicy = z.infer<typeof configurationGroupAuthorizationSchema>;
+/** Canonical policy selection uses the reviewed generation, not an app-selected policy path. */
+export declare function configurationGroupPolicyIdentity(packageRoot: string, raw: Record<string, unknown>): {
+    namespace: string;
+    generationId: string;
+} | undefined;
+/** Data-only verifier. Its result alone is not runtime authority; the common issuer owns that boundary. */
+export declare function verifyConfigurationGroupPolicy(context: ProcessGroupAuthorizationContext, bytes: Buffer, root: string, file: string): Readonly<{
+    sha256: string;
+    file: string;
+    directory: string;
+    journalId: string;
+    role: "source" | "target" | "receiver";
+    groupId: string;
+    groupProcessName: string;
+    namespace: string;
+    generationId: string;
+    configurationGroupSha256: string;
+}>;
+//# sourceMappingURL=configuration-group-authorization.d.ts.map

package/dist/runtime/configuration-group-authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"configuration-group-authorization.d.ts","sourceRoot":"","sources":["../../src/runtime/configuration-group-authorization.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,kCAAkC,CAAC;AAgBzF,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA4BhD,CAAC;AACH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAE1G,gGAAgG;AAChG,wBAAgB,gCAAgC,CAC9C,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAE1B;IACE,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB,GACD,SAAS,CAMZ;AAED,2GAA2G;AAC3G,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,gCAAgC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;;;;;;;;;;;GAsElI"}

package/dist/runtime/configuration-group-authorization.js

@@ -0,0 +1,113 @@
+import path from "node:path";
+import { z } from "zod";
+import { configurationGroupJournalSchema, configurationResourceHash, selectedConfigurationGroup } from "./configuration-group-contract.js";
+import { readConfigurationSelector } from "./process-group-contract.js";
+import { assertPrivateProcessGroupDirectory, groupArtifactHash, groupChannelsHash, readProcessGroupResource, sha256, } from "./process-group-resources.js";
+const digest = z.string().regex(/^[a-f0-9]{64}$/), identity = z.string().regex(/^[a-z][a-z0-9-]{0,99}$/);
+const absolute = z
+    .string()
+    .max(512)
+    .refine((v) => path.isAbsolute(v) && path.resolve(v) === v);
+export const configurationGroupAuthorizationSchema = z.strictObject({
+    schemaVersion: z.literal(4),
+    kind: z.literal("uns-process-group-runtime-authorization"),
+    protocolVersion: z.literal(2),
+    packageName: z.string().min(1).max(214),
+    namespace: identity,
+    groupId: identity,
+    generationId: identity,
+    descriptorSha256: digest,
+    controllerName: z.string().min(1).max(100),
+    packageRoot: absolute,
+    artifactSha256: digest,
+    groupSha256: digest,
+    channelsSha256: digest,
+    stateRoot: absolute,
+    directory: absolute,
+    journalId: z.string().uuid().nullable(),
+    placements: z
+        .array(z.strictObject({
+        instanceId: z.string().regex(/^[a-zA-Z0-9-]{1,100}$/),
+        processName: identity,
+        role: z.enum(["source", "target", "receiver"]),
+        configurationSha256: digest,
+    }))
+        .min(4)
+        .max(18),
+});
+/** Canonical policy selection uses the reviewed generation, not an app-selected policy path. */
+export function configurationGroupPolicyIdentity(packageRoot, raw) {
+    const selected = selectedConfigurationGroup(packageRoot, raw);
+    if (!selected)
+        return undefined;
+    const journal = configurationGroupJournalSchema.parse(readConfigurationSelector(raw, selected.descriptor.journalPath));
+    if (journal.groupSha256 !== selected.snapshot.sha256)
+        throw Error("Configuration group journal differs from the selected revision");
+    return { namespace: selected.descriptor.namespace, generationId: journal.generationId };
+}
+/** Data-only verifier. Its result alone is not runtime authority; the common issuer owns that boundary. */
+export function verifyConfigurationGroupPolicy(context, bytes, root, file) {
+    const p = configurationGroupAuthorizationSchema.parse(JSON.parse(bytes.toString()));
+    const selected = selectedConfigurationGroup(context.packageRoot, context.rawConfiguration);
+    if (!selected)
+        throw Error("Configuration group capability required");
+    const { descriptor: d, snapshot } = selected, group = snapshot.group;
+    const pkg = JSON.parse(readProcessGroupResource(path.join(context.packageRoot, "package.json")).toString());
+    const declaration = pkg.unsDatahub?.processGroupConfigurationRuntime;
+    if (p.packageName !== pkg.name ||
+        p.namespace !== d.namespace ||
+        p.descriptorSha256 !== configurationResourceHash(declaration) ||
+        p.packageRoot !== context.packageRoot ||
+        p.controllerName !== context.controllerName ||
+        p.stateRoot !== root ||
+        p.groupId !== group.id ||
+        p.groupSha256 !== snapshot.sha256 ||
+        file !== path.join(root, d.namespace, "authorizations", p.generationId + ".json") ||
+        p.directory !== path.join(root, d.namespace, "admission", p.generationId))
+        throw Error("Reviewed configuration group placement differs");
+    assertPrivateProcessGroupDirectory(root);
+    assertPrivateProcessGroupDirectory(path.dirname(file));
+    if (groupArtifactHash(context.packageRoot) !== p.artifactSha256 || groupChannelsHash(context.channels) !== p.channelsSha256)
+        throw Error("Reviewed artifact or channels differ");
+    const expected = new Map([
+        ...group.profiles.map((member) => [member.processName, "source"]),
+        [group.processName, "target"],
+        [group.receiverProcessName, "receiver"],
+    ]);
+    if (p.placements.length !== expected.size ||
+        new Set(p.placements.map((x) => x.instanceId)).size !== expected.size ||
+        new Set(p.placements.map((x) => x.processName)).size !== expected.size ||
+        p.placements.some((x) => expected.get(x.processName) !== x.role))
+        throw Error("Reviewed process roles differ");
+    const entry = p.placements.find((x) => context.instanceDirectory === path.join(context.packageRoot, "instances", x.instanceId));
+    const raw = context.rawConfiguration, uns = raw["uns"];
+    const journal = configurationGroupJournalSchema.parse(readConfigurationSelector(raw, d.journalPath));
+    const role = readConfigurationSelector(raw, d.runtimeRolePath), memberId = readConfigurationSelector(raw, d.memberPath);
+    if (!entry ||
+        entry.processName !== uns?.["processName"] ||
+        entry.configurationSha256 !== configurationResourceHash(raw) ||
+        journal.directory !== p.directory ||
+        journal.generationId !== p.generationId ||
+        journal.groupSha256 !== p.groupSha256 ||
+        (journal.journalId ?? null) !== p.journalId)
+        throw Error("Reviewed configuration or journal differs");
+    if (context.initialize ? p.journalId !== null || entry.role !== "receiver" : p.journalId === null)
+        throw Error("Only a reviewed unbound receiver can initialize");
+    if (entry.role === "receiver" ? role !== d.receiverRole : role !== undefined && role !== "publisher")
+        throw Error("Reviewed runtime role differs");
+    if (entry.role === "source" ? !group.profiles.some((x) => x.id === memberId && x.processName === entry.processName) : memberId !== undefined)
+        throw Error("Reviewed member selection differs");
+    return Object.freeze({
+        sha256: sha256(bytes),
+        file,
+        directory: p.directory,
+        journalId: p.journalId,
+        role: entry.role,
+        groupId: p.groupId,
+        groupProcessName: group.processName,
+        namespace: d.namespace,
+        generationId: p.generationId,
+        configurationGroupSha256: p.groupSha256,
+    });
+}
+//# sourceMappingURL=configuration-group-authorization.js.map

package/dist/runtime/configuration-group-authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configuration-group-authorization.js","sourceRoot":"","sources":["../../src/runtime/configuration-group-authorization.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,+BAA+B,EAAE,yBAAyB,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AAE3I,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EACL,kCAAkC,EAClC,iBAAiB,EACjB,iBAAiB,EACjB,wBAAwB,EACxB,MAAM,GACP,MAAM,8BAA8B,CAAC;AAEtC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAC/C,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;AACxD,MAAM,QAAQ,GAAG,CAAC;KACf,MAAM,EAAE;KACR,GAAG,CAAC,GAAG,CAAC;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9D,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,YAAY,CAAC;IAClE,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,yCAAyC,CAAC;IAC1D,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC,SAAS,EAAE,QAAQ;IACnB,OAAO,EAAE,QAAQ;IACjB,YAAY,EAAE,QAAQ;IACtB,gBAAgB,EAAE,MAAM;IACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1C,WAAW,EAAE,QAAQ;IACrB,cAAc,EAAE,MAAM;IACtB,WAAW,EAAE,MAAM;IACnB,cAAc,EAAE,MAAM;IACtB,SAAS,EAAE,QAAQ;IACnB,SAAS,EAAE,QAAQ;IACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACvC,UAAU,EAAE,CAAC;SACV,KAAK,CACJ,CAAC,CAAC,YAAY,CAAC;QACb,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC;QACrD,WAAW,EAAE,QAAQ;QACrB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC9C,mBAAmB,EAAE,MAAM;KAC5B,CAAC,CACH;SACA,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,CAAC;CACX,CAAC,CAAC;AAGH,gGAAgG;AAChG,MAAM,UAAU,gCAAgC,CAC9C,WAAmB,EACnB,GAA4B;IAO5B,MAAM,QAAQ,GAAG,0BAA0B,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC9D,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,OAAO,GAAG,+BAA+B,CAAC,KAAK,CAAC,yBAAyB,CAAC,GAAG,EAAE,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;IACvH,IAAI,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,QAAQ,CAAC,MAAM;QAAE,MAAM,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpI,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;AAC1F,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,8BAA8B,CAAC,OAAyC,EAAE,KAAa,EAAE,IAAY,EAAE,IAAY;IACjI,MAAM,CAAC,GAAG,qCAAqC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IACpF,MAAM,QAAQ,GAAG,0BAA0B,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3F,IAAI,CAAC,QAAQ;QAAE,MAAM,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACtE,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAC1C,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IACzB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5G,MAAM,WAAW,GAAG,GAAG,CAAC,UAAU,EAAE,gCAAgC,CAAC;IACrE,IACE,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,IAAI;QAC1B,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS;QAC3B,CAAC,CAAC,gBAAgB,KAAK,yBAAyB,CAAC,WAAW,CAAC;QAC7D,CAAC,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW;QACrC,CAAC,CAAC,cAAc,KAAK,OAAO,CAAC,cAAc;QAC3C,CAAC,CAAC,SAAS,KAAK,IAAI;QACpB,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,EAAE;QACtB,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,MAAM;QACjC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC,YAAY,GAAG,OAAO,CAAC;QACjF,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC,YAAY,CAAC;QAEzE,MAAM,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAChE,kCAAkC,CAAC,IAAI,CAAC,CAAC;IACzC,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,IAAI,iBAAiB,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,cAAc,IAAI,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,cAAc;QACzH,MAAM,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;QACvB,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAU,CAAC;QAC1E,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAU;QACtC,CAAC,KAAK,CAAC,mBAAmB,EAAE,UAAU,CAAU;KACjD,CAAC,CAAC;IACH,IACE,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI;QACrC,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;QACrE,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;QACtE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;QAEhE,MAAM,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,iBAAiB,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IAChI,MAAM,GAAG,GAAG,OAAO,CAAC,gBAAgB,EAClC,GAAG,GAAG,GAAG,CAAC,KAAK,CAAwC,CAAC;IAC1D,MAAM,OAAO,GAAG,+BAA+B,CAAC,KAAK,CAAC,yBAAyB,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;IACrG,MAAM,IAAI,GAAG,yBAAyB,CAAC,GAAG,EAAE,CAAC,CAAC,eAAe,CAAC,EAC5D,QAAQ,GAAG,yBAAyB,CAAC,GAAG,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;IAC1D,IACE,CAAC,KAAK;QACN,KAAK,CAAC,WAAW,KAAK,GAAG,EAAE,CAAC,aAAa,CAAC;QAC1C,KAAK,CAAC,mBAAmB,KAAK,yBAAyB,CAAC,GAAG,CAAC;QAC5D,OAAO,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS;QACjC,OAAO,CAAC,YAAY,KAAK,CAAC,CAAC,YAAY;QACvC,OAAO,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW;QACrC,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS;QAE3C,MAAM,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI;QAC/F,MAAM,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACjE,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,WAAW;QAAE,MAAM,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnJ,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS;QAC1I,MAAM,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC;QACrB,IAAI;QACJ,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,gBAAgB,EAAE,KAAK,CAAC,WAAW;QACnC,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,wBAAwB,EAAE,CAAC,CAAC,WAAW;KACxC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import path from \"node:path\";\nimport { z } from \"zod\";\n\nimport { configurationGroupJournalSchema, configurationResourceHash, selectedConfigurationGroup } from \"./configuration-group-contract.js\";\nimport type { ProcessGroupAuthorizationContext } from \"./process-group-authorization.js\";\nimport { readConfigurationSelector } from \"./process-group-contract.js\";\nimport {\n  assertPrivateProcessGroupDirectory,\n  groupArtifactHash,\n  groupChannelsHash,\n  readProcessGroupResource,\n  sha256,\n} from \"./process-group-resources.js\";\n\nconst digest = z.string().regex(/^[a-f0-9]{64}$/),\n  identity = z.string().regex(/^[a-z][a-z0-9-]{0,99}$/);\nconst absolute = z\n  .string()\n  .max(512)\n  .refine((v) => path.isAbsolute(v) && path.resolve(v) === v);\nexport const configurationGroupAuthorizationSchema = z.strictObject({\n  schemaVersion: z.literal(4),\n  kind: z.literal(\"uns-process-group-runtime-authorization\"),\n  protocolVersion: z.literal(2),\n  packageName: z.string().min(1).max(214),\n  namespace: identity,\n  groupId: identity,\n  generationId: identity,\n  descriptorSha256: digest,\n  controllerName: z.string().min(1).max(100),\n  packageRoot: absolute,\n  artifactSha256: digest,\n  groupSha256: digest,\n  channelsSha256: digest,\n  stateRoot: absolute,\n  directory: absolute,\n  journalId: z.string().uuid().nullable(),\n  placements: z\n    .array(\n      z.strictObject({\n        instanceId: z.string().regex(/^[a-zA-Z0-9-]{1,100}$/),\n        processName: identity,\n        role: z.enum([\"source\", \"target\", \"receiver\"]),\n        configurationSha256: digest,\n      }),\n    )\n    .min(4)\n    .max(18),\n});\nexport type ConfigurationGroupAuthorizationPolicy = z.infer<typeof configurationGroupAuthorizationSchema>;\n\n/** Canonical policy selection uses the reviewed generation, not an app-selected policy path. */\nexport function configurationGroupPolicyIdentity(\n  packageRoot: string,\n  raw: Record<string, unknown>,\n):\n  | {\n      namespace: string;\n      generationId: string;\n    }\n  | undefined {\n  const selected = selectedConfigurationGroup(packageRoot, raw);\n  if (!selected) return undefined;\n  const journal = configurationGroupJournalSchema.parse(readConfigurationSelector(raw, selected.descriptor.journalPath));\n  if (journal.groupSha256 !== selected.snapshot.sha256) throw Error(\"Configuration group journal differs from the selected revision\");\n  return { namespace: selected.descriptor.namespace, generationId: journal.generationId };\n}\n\n/** Data-only verifier. Its result alone is not runtime authority; the common issuer owns that boundary. */\nexport function verifyConfigurationGroupPolicy(context: ProcessGroupAuthorizationContext, bytes: Buffer, root: string, file: string) {\n  const p = configurationGroupAuthorizationSchema.parse(JSON.parse(bytes.toString()));\n  const selected = selectedConfigurationGroup(context.packageRoot, context.rawConfiguration);\n  if (!selected) throw Error(\"Configuration group capability required\");\n  const { descriptor: d, snapshot } = selected,\n    group = snapshot.group;\n  const pkg = JSON.parse(readProcessGroupResource(path.join(context.packageRoot, \"package.json\")).toString());\n  const declaration = pkg.unsDatahub?.processGroupConfigurationRuntime;\n  if (\n    p.packageName !== pkg.name ||\n    p.namespace !== d.namespace ||\n    p.descriptorSha256 !== configurationResourceHash(declaration) ||\n    p.packageRoot !== context.packageRoot ||\n    p.controllerName !== context.controllerName ||\n    p.stateRoot !== root ||\n    p.groupId !== group.id ||\n    p.groupSha256 !== snapshot.sha256 ||\n    file !== path.join(root, d.namespace, \"authorizations\", p.generationId + \".json\") ||\n    p.directory !== path.join(root, d.namespace, \"admission\", p.generationId)\n  )\n    throw Error(\"Reviewed configuration group placement differs\");\n  assertPrivateProcessGroupDirectory(root);\n  assertPrivateProcessGroupDirectory(path.dirname(file));\n  if (groupArtifactHash(context.packageRoot) !== p.artifactSha256 || groupChannelsHash(context.channels) !== p.channelsSha256)\n    throw Error(\"Reviewed artifact or channels differ\");\n  const expected = new Map([\n    ...group.profiles.map((member) => [member.processName, \"source\"] as const),\n    [group.processName, \"target\"] as const,\n    [group.receiverProcessName, \"receiver\"] as const,\n  ]);\n  if (\n    p.placements.length !== expected.size ||\n    new Set(p.placements.map((x) => x.instanceId)).size !== expected.size ||\n    new Set(p.placements.map((x) => x.processName)).size !== expected.size ||\n    p.placements.some((x) => expected.get(x.processName) !== x.role)\n  )\n    throw Error(\"Reviewed process roles differ\");\n  const entry = p.placements.find((x) => context.instanceDirectory === path.join(context.packageRoot, \"instances\", x.instanceId));\n  const raw = context.rawConfiguration,\n    uns = raw[\"uns\"] as Record<string, unknown> | undefined;\n  const journal = configurationGroupJournalSchema.parse(readConfigurationSelector(raw, d.journalPath));\n  const role = readConfigurationSelector(raw, d.runtimeRolePath),\n    memberId = readConfigurationSelector(raw, d.memberPath);\n  if (\n    !entry ||\n    entry.processName !== uns?.[\"processName\"] ||\n    entry.configurationSha256 !== configurationResourceHash(raw) ||\n    journal.directory !== p.directory ||\n    journal.generationId !== p.generationId ||\n    journal.groupSha256 !== p.groupSha256 ||\n    (journal.journalId ?? null) !== p.journalId\n  )\n    throw Error(\"Reviewed configuration or journal differs\");\n  if (context.initialize ? p.journalId !== null || entry.role !== \"receiver\" : p.journalId === null)\n    throw Error(\"Only a reviewed unbound receiver can initialize\");\n  if (entry.role === \"receiver\" ? role !== d.receiverRole : role !== undefined && role !== \"publisher\") throw Error(\"Reviewed runtime role differs\");\n  if (entry.role === \"source\" ? !group.profiles.some((x) => x.id === memberId && x.processName === entry.processName) : memberId !== undefined)\n    throw Error(\"Reviewed member selection differs\");\n  return Object.freeze({\n    sha256: sha256(bytes),\n    file,\n    directory: p.directory,\n    journalId: p.journalId,\n    role: entry.role,\n    groupId: p.groupId,\n    groupProcessName: group.processName,\n    namespace: d.namespace,\n    generationId: p.generationId,\n    configurationGroupSha256: p.groupSha256,\n  });\n}\n"]}

package/dist/runtime/configuration-group-contract.d.ts

@@ -0,0 +1,75 @@
+import { z } from "zod";
+/** Versioned canonical JSON: binary key order, no locale, executable values or accessors. */
+export declare function configurationResourceJson(value: unknown): string;
+export declare function configurationResourceHash(value: unknown): string;
+export declare const configurationGroupProfileSchema: z.ZodObject<{
+    id: z.ZodString;
+    processName: z.ZodString;
+    dataGroup: z.ZodString;
+    resource: z.ZodUnknown;
+}, z.core.$strict>;
+export declare const configurationGroupSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<2>;
+    id: z.ZodString;
+    inputTopic: z.ZodString;
+    processName: z.ZodString;
+    receiverProcessName: z.ZodString;
+    profiles: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        processName: z.ZodString;
+        dataGroup: z.ZodString;
+        resource: z.ZodUnknown;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const configurationGroupDescriptorSchema: z.ZodObject<{
+    protocolVersion: z.ZodLiteral<2>;
+    namespace: z.ZodString;
+    publisherPath: z.ZodArray<z.ZodString>;
+    groupPath: z.ZodArray<z.ZodString>;
+    memberPath: z.ZodArray<z.ZodString>;
+    journalPath: z.ZodArray<z.ZodString>;
+    runtimeRolePath: z.ZodArray<z.ZodString>;
+    receiverRole: z.ZodString;
+    match: z.ZodOptional<z.ZodObject<{
+        path: z.ZodArray<z.ZodString>;
+        value: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type ConfigurationGroupDescriptor = z.infer<typeof configurationGroupDescriptorSchema>;
+export type ConfigurationGroup = z.infer<typeof configurationGroupSchema>;
+export interface ConfigurationGroupProfile {
+    readonly id: string;
+    readonly processName: string;
+    readonly dataGroup: string;
+    readonly resourceSha256: string;
+    readonly resource: unknown;
+}
+export interface ConfigurationGroupSnapshot {
+    readonly group: Readonly<ConfigurationGroup>;
+    readonly sha256: string;
+    readonly profiles: readonly ConfigurationGroupProfile[];
+}
+export declare function configurationGroupSnapshot(value: unknown): ConfigurationGroupSnapshot;
+export declare function assertConfigurationGroupSnapshot(value: ConfigurationGroupSnapshot): void;
+/** Optional data-only capability; packages without it keep their existing behavior. */
+export declare function configurationGroupDescriptor(packageRoot: string): ConfigurationGroupDescriptor | undefined;
+export declare function selectedConfigurationGroup(packageRoot: string, raw: Record<string, unknown>): {
+    descriptor: ConfigurationGroupDescriptor;
+    snapshot: ConfigurationGroupSnapshot;
+} | undefined;
+export declare const configurationGroupJournalSchema: z.ZodObject<{
+    directory: z.ZodString;
+    journalId: z.ZodOptional<z.ZodString>;
+    generationId: z.ZodString;
+    groupSha256: z.ZodString;
+    minFreeBytes: z.ZodDefault<z.ZodNumber>;
+    maxRecords: z.ZodDefault<z.ZodNumber>;
+    maxBytes: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strict>;
+export type ConfigurationGroupJournal = z.infer<typeof configurationGroupJournalSchema>;
+export declare function configurationGroupJournalContract(snapshot: ConfigurationGroupSnapshot, sourceIdentity: string, config: ConfigurationGroupJournal, profiles: readonly {
+    processName: string;
+    resourceSha256: string;
+    dataGroup: string;
+}[]): string;
+//# sourceMappingURL=configuration-group-contract.d.ts.map

package/dist/runtime/configuration-group-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"configuration-group-contract.d.ts","sourceRoot":"","sources":["../../src/runtime/configuration-group-contract.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAkBxB,6FAA6F;AAC7F,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAgEhE;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEhE;AAED,eAAO,MAAM,+BAA+B;;;;;kBAK1C,CAAC;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;kBAWnC,CAAC;AACH,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;kBA2B3C,CAAC;AACL,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAC9F,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAC1E,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AACD,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,SAAS,yBAAyB,EAAE,CAAC;CACzD;AASD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,0BAA0B,CAUrF;AACD,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,0BAA0B,GAAG,IAAI,CAExF;AAED,uFAAuF;AACvF,wBAAgB,4BAA4B,CAAC,WAAW,EAAE,MAAM,GAAG,4BAA4B,GAAG,SAAS,CAkB1G;AACD,wBAAgB,0BAA0B,CACxC,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAE1B;IACE,UAAU,EAAE,4BAA4B,CAAC;IACzC,QAAQ,EAAE,0BAA0B,CAAC;CACtC,GACD,SAAS,CAQZ;AAED,eAAO,MAAM,+BAA+B;;;;;;;;kBAkB1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,wBAAgB,iCAAiC,CAC/C,QAAQ,EAAE,0BAA0B,EACpC,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,yBAAyB,EACjC,QAAQ,EAAE,SAAS;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EAAE,GACtF,MAAM,CAkBR"}