borgmcp-server 0.1.1 → 0.1.5

package/README.md

@@ -6,16 +6,23 @@ HTTPS.
 
 ## Release status
 
-The current source is the unpublished `0.1.1-preview` recovery release candidate.
-Purpose-bound owner enrollment, idempotent multi-cube creation, and stable
-prior-seat reattachment have completed coordinated client/server security
-review and process dogfood against the audited exact `borgmcp-shared@0.3.0`
-registry release.
+The current public preview is `borgmcp-server@0.1.4`, published on npm.
+Versions `0.1.2` and `0.1.3` were not published; their immutable tags are
+internal failed-release evidence and are not installation or dogfood targets.
+Version `0.1.4` retains the
+reviewed owner-enrollment, idempotent multi-cube creation, and stable prior-seat
+reattachment baseline, and adds managed role creation and updates, fail-closed
+setup reinitialization, opt-in redacted debug logging, live-safe invitation
+minting, and atomic cube-scoped invitations with enforced observer posture.
+The published `0.1.4` package consumes the audited exact
+`borgmcp-shared@0.3.0` registry release. Current source consumes the audited
+exact `borgmcp-shared@0.4.0` release for the clean-slate protocol generation.
 
 Setup prepares local identity and storage and prints one-time recovery and
-owner-enrollment secrets; it creates no cube. The package remains unreleased
-until the exact release commit and tagged artifact complete the documented
-review, authorization, and protected-publication gates.
+owner-enrollment secrets; it creates no cube. Version `0.1.1` completed the
+documented exact-source, tagged-artifact, and protected-publication gates.
+Version `0.1.4` completed a fresh exact-source, tagged-artifact, tokenless OIDC
+publication, provenance, signature, and attestation gate chain.
 
 ## Requirements
 
@@ -23,12 +30,9 @@ review, authorization, and protected-publication gates.
 - npm 10 or later
 - A private local data directory with sufficient disk space
 
-## Install after publication
+## Install
 
-The global package command becomes available only after the pending npm release
-completes. Until then, source and preview reviewers should follow the release
-status above and the [release runbook](docs/releasing.md), not expect this
-registry install to succeed.
+Install the current public preview from npm:
 
 ```sh
 npm install --global borgmcp-server
@@ -38,15 +42,20 @@ npm install --global borgmcp-server
 
 The default data directory is `~/.borg/server`. Setup creates the local
 database, credential-digest key, local certificate authority, server
-certificate, one recovery credential, and one enrollment invitation. It creates
-no cube. Run it in a private terminal because both secrets are printed only
-once.
+certificate, one recovery credential, and one owner enrollment invitation. It
+creates no cube. Run it in a private terminal because both secrets are shown
+once; the owner enrollment invitation is single-use and enrolls the owner client.
 
 ```sh
 borg-mcp-server setup
 borg-mcp-server start
 ```
 
+Running `setup` again refuses to change an existing installation. After stopping
+the server, `borg-mcp-server setup --reinitialize` explicitly destroys and
+recreates the server identity and database; use it only when prior state may be
+discarded.
+
 The server listens on `https://127.0.0.1:7091` by default. Use
 `BORG_SERVER_DATA_DIR` to select another data directory.
 
@@ -68,23 +77,62 @@ TLS files may instead be supplied explicitly with
 `BORG_SERVER_TLS_CA_FILE`. Run `borg-mcp-server help` for the complete command
 summary.
 
-## Offline credential administration
+## Debugging
+
+Debug diagnostics are off by default. A local operator can enable centrally
+redacted, one-line JSON records on stderr for one server run:
+
+```sh
+borg-mcp-server start --log-level debug
+```
+
+Records include normalized routes, principal and coordination IDs, authorization
+outcomes, recipient fan-out, cursor replay, SSE lifecycle, and credential-session
+events. They never include authorization headers, credentials, invitations,
+recovery material, request or message bodies, decision text, tokens, raw paths, or
+exceptions. Operational IDs are still private data; capture stderr only in a
+private local sink. The log level cannot be changed through the network API.
+
+## Local credential administration
 
-Stop the server before all offline client administration:
+Invitation minting is an additive local operation and may run while the server is
+live. Rotation, revocation, and grant changes remain exclusive: stop the server
+before running those commands.
 
 ```sh
 borg-mcp-server client-rotate <client-id>
 borg-mcp-server client-revoke <client-id>
 borg-mcp-server client-invite
+borg-mcp-server client-invite <cube-name-or-id> [--access <read|write|manage>]
 borg-mcp-server owner-invite
 borg-mcp-server client-grant <client-id> <cube-id> <read|write|manage>
 borg-mcp-server client-ungrant <client-id> <cube-id>
 ```
 
-Invitation commands read the recovery credential from a private hidden terminal
-prompt, never argv or environment. Rotation and invitation commands print their
-replacement secret once. Treat setup, enrollment, invitation, and rotation
-output as secrets; do not paste it into issues, logs, or chat.
+Invitation commands visibly prompt with `Recovery credential (hidden input):`
+before reading the recovery credential from a private hidden terminal, never argv
+or environment. `owner-invite` prints an owner enrollment invitation. A plain
+`client-invite` remains an enroll-only invitation with no cube grant. Supplying a
+cube selector atomically binds one grant to the invitation. `read` attaches an
+observer that can discover the cube and read shared activity, but cannot post,
+acknowledge, claim, administer, be selected as a direct recipient, or receive
+directed stream events. `write` attaches a participant that can coordinate and is
+the default; explicit `manage` adds cube administration. Attach responses and
+drone listings identify the effective `observer` or `participant` posture. The
+command prints the resolved display name, full cube ID,
+effective access, and capability summary before the single-use invitation.
+
+For automation and duplicate-name environments, use the full lowercase canonical
+cube UUID. A display name must match exactly and case-sensitively. Unknown names,
+UUID-like malformed selectors, and duplicate names fail without creating or
+printing an invitation; duplicate-name errors list the candidate IDs so the
+operator can rerun unambiguously. Claiming a scoped invitation atomically creates
+the client credential binding and exactly that cube grant. It grants no server
+capability and no access to any other cube.
+
+Both invitation forms are single-use and shown once. Treat setup, enrollment,
+invitation, and rotation output as secrets; do not paste it into issues, logs, or
+chat.
 
 ## Capacity controls
 

package/THIRD_PARTY_NOTICES.md

@@ -21,6 +21,7 @@ refer to each installed package for its complete license text.
 | `@peculiar/utils` | 2.0.3 | MIT |
 | `@peculiar/x509` | 1.14.3 | MIT |
 | `asn1js` | 3.0.10 | BSD-3-Clause |
+| `borgmcp-shared` | 0.4.0 | Apache-2.0 |
 | `bytestreamjs` | 2.0.1 | BSD-3-Clause |
 | `pkijs` | 3.4.0 | BSD-3-Clause |
 | `pvtsutils` | 1.3.6 | MIT |

package/dist/cli.js

@@ -1,38 +1,50 @@
 const usage = `Usage: borg-mcp-server <command> [options]
 
 Commands:
-  setup    Prepare an offline server installation
+  setup [--reinitialize]  Prepare an offline server installation
   start    Start the server process
   client-rotate <client-id>  Rotate one client credential offline
   client-revoke <client-id>  Revoke one client and its credentials offline
   client-grant <client-id> <cube-id> <read|write|manage>  Set one offline cube grant
   client-ungrant <client-id> <cube-id>  Remove one offline cube grant
-  client-invite  Create one ordinary client invitation using a private recovery prompt
-  owner-invite   Replace the unclaimed owner invitation using a private recovery prompt
+  client-invite [<cube-name-or-id>] [--access <read|write|manage>]
+             Create a client invitation; scoped invitations default to write
+  owner-invite   Replace the unclaimed owner enrollment invitation using a hidden recovery prompt
   help     Show this help
 
 Start options:
   --host <ip>      Explicit bind address (default: 127.0.0.1)
   --port <number>  Listen port (default: 7091)
   --lan            Consent to this start on a private LAN address
+  --log-level debug  Emit centrally redacted structured diagnostics to stderr
+
+Setup options:
+  --reinitialize   Destroy and recreate the existing server identity and database
 
 TLS files:
   BORG_SERVER_DATA_DIR (default: ~/.borg/server), or explicit
   BORG_SERVER_TLS_KEY_FILE, BORG_SERVER_TLS_CERT_FILE, and BORG_SERVER_TLS_CA_FILE
 
-Stop the server before running offline client administration commands.`;
+Invitation commands may run alongside a live server. Stop the server before
+setup, rotation, revocation, grant changes, or reinitialization.
+
+Invitation access:
+  read    observe: discover, attach as observer, and read
+  write   coordinate: attach, read, post, acknowledge, and receive directed wakes (default)
+  manage  administer: coordinate plus cube administration; explicit only`;
 export async function runCli(args, service, io) {
     const [command, ...extraArgs] = args;
     switch (command) {
         case "setup":
-            if (extraArgs.length !== 0)
+            if (extraArgs.length > 1 || (extraArgs.length === 1 && extraArgs[0] !== "--reinitialize")) {
                 return invalidArguments(io);
+            }
             if (service.setup === undefined) {
                 io.stderr("Server setup is unavailable.");
                 return 1;
             }
-            const result = await service.setup();
-            io.stdout(`Server setup complete.\nRecovery credential (shown once): ${result.recoveryCredential}\nInitial enrollment invitation (shown once): ${result.initialInvitation}`);
+            const result = await service.setup({ reinitialize: extraArgs[0] === "--reinitialize" });
+            io.stdout(`Server setup complete.\nRecovery credential (shown once; keep offline): ${result.recoveryCredential}\nOwner enrollment invitation (single-use, shown once; enroll the owner client): ${result.initialInvitation}\nSetup created no cube.\nNext: start the server with \`borg-mcp-server start\`.`);
             return 0;
         case "start":
             await service.start(extraArgs);
@@ -66,16 +78,33 @@ export async function runCli(args, service, io) {
             return 0;
         case "client-invite":
         case "owner-invite": {
-            if (extraArgs.length !== 0 || io.readSecret === undefined)
+            if (io.readSecret === undefined)
                 return invalidArguments(io);
+            const scoped = command === "client-invite" ? parseClientInviteArguments(extraArgs) : null;
+            if ((command === "owner-invite" && extraArgs.length !== 0) || scoped === undefined) {
+                return invalidArguments(io);
+            }
             const operation = command === "client-invite"
                 ? service.createClientInvitation
                 : service.replaceOwnerInvitation;
             if (operation === undefined)
                 return invalidArguments(io);
-            const recovery = await io.readSecret("Recovery credential: ");
-            const invitation = await operation(recovery);
-            io.stdout(`Enrollment invitation (shown once): ${invitation}`);
+            const recovery = await io.readSecret("Recovery credential (hidden input): ");
+            const result = command === "client-invite"
+                ? scoped?.cubeSelector === undefined
+                    ? await operation(recovery)
+                    : await operation(recovery, scoped.cubeSelector, scoped.access)
+                : await operation(recovery);
+            if (typeof result === "string") {
+                io.stdout(command === "client-invite"
+                    ? `Client enrollment invitation (single-use, shown once): ${result}`
+                    : `Owner enrollment invitation (single-use, shown once): ${result}`);
+            }
+            else {
+                io.stdout(`Cube: ${JSON.stringify(result.cubeName)} (${result.cubeId})\n` +
+                    `Grant: ${grantSummary(result.access)}\n` +
+                    `Client enrollment invitation (single-use, shown once): ${result.invitation}`);
+            }
             return 0;
         }
         case "help":
@@ -89,6 +118,28 @@ export async function runCli(args, service, io) {
             return 1;
     }
 }
+function parseClientInviteArguments(args) {
+    if (args.length === 0)
+        return {};
+    const cubeSelector = args[0];
+    if (cubeSelector === undefined || cubeSelector.startsWith("--"))
+        return undefined;
+    if (args.length === 1)
+        return { cubeSelector };
+    if (args.length !== 3 || args[1] !== "--access")
+        return undefined;
+    const access = args[2];
+    if (access !== "read" && access !== "write" && access !== "manage")
+        return undefined;
+    return { cubeSelector, access };
+}
+function grantSummary(access) {
+    if (access === "read")
+        return "read (observe - discover, attach as observer, and read)";
+    if (access === "manage")
+        return "manage (administer - coordinate plus cube administration)";
+    return "write (coordinate - attach, read, post, acknowledge, and receive directed wakes)";
+}
 function invalidArguments(io) {
     io.stderr("Invalid command arguments.");
     return 1;

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAQA,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;;;;uEAsByD,CAAC;AAExE,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,IAAuB,EACvB,OAAsB,EACtB,EAAS;IAET,MAAM,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC;IAErC,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,OAAO;YACV,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,gBAAgB,CAAC,EAAE,CAAC,CAAC;YACxD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAChC,EAAE,CAAC,MAAM,CAAC,8BAA8B,CAAC,CAAC;gBAC1C,OAAO,CAAC,CAAC;YACX,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;YACrC,EAAE,CAAC,MAAM,CAAC,6DAA6D,MAAM,CAAC,kBAAkB,iDAAiD,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC;YAC7K,OAAO,CAAC,CAAC;QACX,KAAK,OAAO;YACV,MAAM,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC/B,OAAO,CAAC,CAAC;QACX,KAAK,eAAe;YAClB,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;gBAAE,OAAO,gBAAgB,CAAC,EAAE,CAAC,CAAC;YAC9F,EAAE,CAAC,MAAM,CAAC,2CAA2C,MAAM,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC,CAAC;YAClG,OAAO,CAAC,CAAC;QACX,KAAK,eAAe;YAClB,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;gBAAE,OAAO,gBAAgB,CAAC,EAAE,CAAC,CAAC;YAC9F,MAAM,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC,CAAC;YAC1C,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAC7B,OAAO,CAAC,CAAC;QACX,KAAK,cAAc,EAAE,CAAC;YACpB,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;gBAAE,OAAO,gBAAgB,CAAC,EAAE,CAAC,CAAC;YAC7F,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,QAAQ;gBAAE,OAAO,gBAAgB,CAAC,EAAE,CAAC,CAAC;YAChG,MAAM,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAE,EAAE,SAAS,CAAC,CAAC,CAAE,EAAE,MAAM,CAAC,CAAC;YAChE,EAAE,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC;YACxC,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,gBAAgB;YACnB,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS;gBAAE,OAAO,gBAAgB,CAAC,EAAE,CAAC,CAAC;YAC/F,MAAM,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAE,EAAE,SAAS,CAAC,CAAC,CAAE,CAAC,CAAC;YAC1D,EAAE,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC;YACxC,OAAO,CAAC,CAAC;QACX,KAAK,eAAe,CAAC;QACrB,KAAK,cAAc,EAAE,CAAC;YACpB,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS;gBAAE,OAAO,gBAAgB,CAAC,EAAE,CAAC,CAAC;YACvF,MAAM,SAAS,GAAG,OAAO,KAAK,eAAe;gBAC3C,CAAC,CAAC,OAAO,CAAC,sBAAsB;gBAChC,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC;YACnC,IAAI,SAAS,KAAK,SAAS;gBAAE,OAAO,gBAAgB,CAAC,EAAE,CAAC,CAAC;YACzD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;YAC9D,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC;YAC7C,EAAE,CAAC,MAAM,CAAC,uCAAuC,UAAU,EAAE,CAAC,CAAC;YAC/D,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ,CAAC;QACd,KAAK,IAAI,CAAC;QACV,KAAK,SAAS;YACZ,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACjB,OAAO,CAAC,CAAC;QACX;YACE,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAC9B,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,EAAS;IACjC,EAAE,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC;IACxC,OAAO,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAQA,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yEAiC2D,CAAC;AAE1E,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,IAAuB,EACvB,OAAsB,EACtB,EAAS;IAET,MAAM,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC;IAErC,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,OAAO;YACV,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,gBAAgB,CAAC,EAAE,CAAC;gBAC1F,OAAO,gBAAgB,CAAC,EAAE,CAAC,CAAC;YAC9B,CAAC;YACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBAChC,EAAE,CAAC,MAAM,CAAC,8BAA8B,CAAC,CAAC;gBAC1C,OAAO,CAAC,CAAC;YACX,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,gBAAgB,EAAE,CAAC,CAAC;YACxF,EAAE,CAAC,MAAM,CAAC,2EAA2E,MAAM,CAAC,kBAAkB,oFAAoF,MAAM,CAAC,iBAAiB,kFAAkF,CAAC,CAAC;YAC9S,OAAO,CAAC,CAAC;QACX,KAAK,OAAO;YACV,MAAM,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC/B,OAAO,CAAC,CAAC;QACX,KAAK,eAAe;YAClB,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;gBAAE,OAAO,gBAAgB,CAAC,EAAE,CAAC,CAAC;YAC9F,EAAE,CAAC,MAAM,CAAC,2CAA2C,MAAM,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC,CAAC;YAClG,OAAO,CAAC,CAAC;QACX,KAAK,eAAe;YAClB,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;gBAAE,OAAO,gBAAgB,CAAC,EAAE,CAAC,CAAC;YAC9F,MAAM,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC,CAAC;YAC1C,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAC7B,OAAO,CAAC,CAAC;QACX,KAAK,cAAc,EAAE,CAAC;YACpB,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;gBAAE,OAAO,gBAAgB,CAAC,EAAE,CAAC,CAAC;YAC7F,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,QAAQ;gBAAE,OAAO,gBAAgB,CAAC,EAAE,CAAC,CAAC;YAChG,MAAM,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAE,EAAE,SAAS,CAAC,CAAC,CAAE,EAAE,MAAM,CAAC,CAAC;YAChE,EAAE,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC;YACxC,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,gBAAgB;YACnB,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS;gBAAE,OAAO,gBAAgB,CAAC,EAAE,CAAC,CAAC;YAC/F,MAAM,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAE,EAAE,SAAS,CAAC,CAAC,CAAE,CAAC,CAAC;YAC1D,EAAE,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC;YACxC,OAAO,CAAC,CAAC;QACX,KAAK,eAAe,CAAC;QACrB,KAAK,cAAc,EAAE,CAAC;YACpB,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS;gBAAE,OAAO,gBAAgB,CAAC,EAAE,CAAC,CAAC;YAC7D,MAAM,MAAM,GAAG,OAAO,KAAK,eAAe,CAAC,CAAC,CAAC,0BAA0B,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC1F,IAAI,CAAC,OAAO,KAAK,cAAc,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACnF,OAAO,gBAAgB,CAAC,EAAE,CAAC,CAAC;YAC9B,CAAC;YACD,MAAM,SAAS,GAAG,OAAO,KAAK,eAAe;gBAC3C,CAAC,CAAC,OAAO,CAAC,sBAAsB;gBAChC,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC;YACnC,IAAI,SAAS,KAAK,SAAS;gBAAE,OAAO,gBAAgB,CAAC,EAAE,CAAC,CAAC;YACzD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,sCAAsC,CAAC,CAAC;YAC7E,MAAM,MAAM,GAAG,OAAO,KAAK,eAAe;gBACxC,CAAC,CAAC,MAAM,EAAE,YAAY,KAAK,SAAS;oBAClC,CAAC,CAAC,MAAM,SAAS,CAAC,QAAQ,CAAC;oBAC3B,CAAC,CAAC,MAAM,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC;gBACjE,CAAC,CAAC,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC;YAC9B,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC/B,EAAE,CAAC,MAAM,CAAC,OAAO,KAAK,eAAe;oBACnC,CAAC,CAAC,0DAA0D,MAAM,EAAE;oBACpE,CAAC,CAAC,yDAAyD,MAAM,EAAE,CAAC,CAAC;YACzE,CAAC;iBAAM,CAAC;gBACN,EAAE,CAAC,MAAM,CACP,SAAS,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,MAAM,KAAK;oBAC/D,UAAU,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI;oBACzC,0DAA0D,MAAM,CAAC,UAAU,EAAE,CAC9E,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ,CAAC;QACd,KAAK,IAAI,CAAC;QACV,KAAK,SAAS;YACZ,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACjB,OAAO,CAAC,CAAC;QACX;YACE,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAC9B,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CACjC,IAAuB;IAEvB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAClF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,YAAY,EAAE,CAAC;IAC/C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACrF,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,YAAY,CAAC,MAAmC;IACvD,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,yDAAyD,CAAC;IACxF,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO,2DAA2D,CAAC;IAC5F,OAAO,kFAAkF,CAAC;AAC5F,CAAC;AAED,SAAS,gBAAgB,CAAC,EAAS;IACjC,EAAE,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC;IACxC,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/coordination-api.d.ts

@@ -1,4 +1,5 @@
 import type { Principal } from "./principal.js";
+import { type DebugLogger } from "./debug-log.js";
 import type { CredentialAuthority } from "./credentials.js";
 import { type StoreRuntime } from "./store.js";
 export interface CoordinationRequest {
@@ -7,6 +8,7 @@ export interface CoordinationRequest {
     readonly principal: Principal;
     readonly body?: unknown;
     readonly cursor?: string;
+    readonly since?: string;
     readonly signal: AbortSignal;
 }
 export interface CoordinationResponse {
@@ -16,7 +18,7 @@ export interface CoordinationResponse {
 }
 export declare class CoordinationApi {
     #private;
-    constructor(runtime: StoreRuntime, authority: CredentialAuthority);
+    constructor(runtime: StoreRuntime, authority: CredentialAuthority, debugLogger?: DebugLogger, streamHeartbeatMs?: number);
     armReplayTransition(): {
         readonly reached: Promise<void>;
         readonly release: () => void;