Variable: GENERATED_HEADER

const GENERATED_HEADER: "# GENERATED FILE. DO NOT EDIT.\n#\n# Source: packages/contracts/src/permissions/table.ts (and the registry it checks)\n# Regenerate: pnpm --filter @oktoid/contracts generate\n# Checked by: pnpm --filter @oktoid/contracts generate:check, in CI job `generated`;\n# a hand edit fails it.\n#\n# The whole `authorization` block: one user per broker principal, with its\n# permissions. The only thing it does not contain is each principal's public nkey,\n# which is generated per host and reaches the server as an ENVIRONMENT VARIABLE\n# (NATS resolves `$NAME` from the environment; a variable that is missing stops\n# the server at start, loudly). One per principal, named NKEY_<PRINCIPAL> in upper\n# case, hyphens becoming underscores, holding the public key:\n#\n# NKEY_GATEWAY=U...\n#\n# A variable defined in another config file is NOT visible to this one, which is\n# why it is the environment. So nobody can bind a key to the wrong permissions:\n# the pairing is made here. nats.conf must not declare its own `authorization`.\n#\n# A principal is a DEPLOYABLE (gateway, gateway-admin, bootstrap, credential, audit,\n# provisioning) or an AGENT INSTANCE (agent-shared); subjects name MODULES (identity,\n# issuance, ...), and a module is served by the principal that hosts it, so\n# `credential` serves request.*.identity.>. An edge between two modules of one\n# deployable is ABSENT from this file by design: it is carried in process and enforced\n# by the in-process adapter from the same table.\n#\n# An agent is not a module. Its principal, agent-<instanceId>, subscribes to\n# agent.<instanceId>.admin.> and to nothing of any other instance, and it publishes\n# nothing but its answers. A command is granted to its senders one key at a time, and\n# the agent accepts one only inside an envelope signed by the sending deployable, so\n# this file is one of two lines and not the only one.\n#\n# What the table is for: a principal may call only the request subjects listed against\n# it, one by one. A wildcard on another module's request is never granted. It subscribes\n# to an event only where the table lists it as a live (core NATS) subscriber; an event\n# that must not be lost is read through a JetStream consumer instead, below.\n#\n# Replies come back on the caller's OWN inbox, _INBOX.<principal>.>, and the client\n# sets the matching inboxPrefix when it connects (connectNats in packages/messaging).\n# No principal may subscribe to another's inbox, and none may publish on _INBOX at all:\n# a server answers through allow_responses. allow_responses lets a server publish to\n# whatever reply subject a request names, so the server side (serveBroker) answers only\n# on the inbox of a principal that calls the key, and drops the request otherwise.\n#\n# JetStream is the other way to read a subject, because a stream captures whatever\n# subjects it is configured with and the broker does not check that against anybody's\n# subscribe permissions. So no running service may create or update a stream: the\n# streams and their consumers are declared by `bootstrap`, a one-shot whose grant\n# reads no message, and a consumer's service holds only info, pull and ack on its own\n# consumer, and refuses to start when the stream or the consumer is not configured as\n# declared. A leaked bootstrap seed could still point a stream at another subject; the\n# reading service would refuse it at its next start.\n"

Defined in: packages/contracts/src/permissions/generate.ts:330

The text every generated file begins with.