@calliopelabs/cli 3.5.4 → 3.7.0

package/dist/execution/ledger-protocol.js

@@ -1,13 +1,15 @@
 /** delegation-ledger/v1: one parent reservation ledger shared with children on other hosts (#415).
  * The parent (or an Astrolift-managed service) serves the existing ReservationLedger; children
  * reserve and settle against it with scoped, fenced bearer tokens. Nothing here widens authority. */
-import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+import { createHmac, randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';
 import * as fs from 'node:fs';
 import { join } from 'node:path';
 import { ExecutionLimitError } from './types.js';
-import { uuid, identifier } from './authority.js';
+import { uuid, identifier, hex } from './authority.js';
+import { privateDirectory, readArtifactBytes } from '../orchestration/execution-store.js';
+import { recoverDeadWriterLock } from './writer-recovery.js';
 export const LEDGER_PROTOCOL = 'delegation-ledger/v1';
-export const LEDGER_OPERATIONS = ['hello', 'journal', 'reserve', 'settle', 'grant', 'revoke'];
+export const LEDGER_OPERATIONS = ['hello', 'journal', 'execution', 'reserve', 'settle', 'grant', 'revoke'];
 export const MAX_LEDGER_REQUEST_BYTES = 256 * 1024;
 const b64 = (value) => Buffer.from(value).toString('base64url');
 const sign = (secret, body) => createHmac('sha256', secret).update(body).digest();
@@ -34,15 +36,31 @@ export function verifyLedgerToken(secret, token, runId, now = Date.now()) {
     catch {
         throw denied('Ledger token is malformed.');
     }
-    if (claims?.v !== 1 || claims.run !== runId || !Number.isSafeInteger(claims.exp) || claims.exp <= now)
+    if (!claims || ![1, 2].includes(claims.v) || claims.run !== runId || !Number.isSafeInteger(claims.exp) || claims.exp <= now)
         throw denied('Ledger token expired or belongs to another run.');
+    if (claims.authority !== undefined && (!hex(claims.authority) || claims.v !== 2))
+        throw denied('Ledger token authority binding is malformed.');
     if (claims.role === 'child') {
-        if (!uuid(claims.grant) || !Number.isSafeInteger(claims.epoch) || !Array.isArray(claims.accounts) || !claims.accounts.length)
+        if (claims.v === 2 && !claims.authority || claims.owner !== undefined || !uuid(claims.grant) || !Number.isSafeInteger(claims.epoch) || Number(claims.epoch) < 1 || !Array.isArray(claims.accounts) || !claims.accounts.length)
             throw denied('Child ledger token is malformed.');
         for (const account of claims.accounts)
             identifier(account);
     }
-    else if (claims.role !== 'parent')
+    else if (claims.role === 'parent') {
+        if (claims.v === 2) {
+            try {
+                identifier(claims.owner);
+            }
+            catch {
+                throw denied('Parent ledger token has no valid owner scope.');
+            }
+        }
+        else if (claims.owner !== undefined)
+            throw denied('Scoped parent tokens require version 2.');
+        if (claims.grant !== undefined || claims.epoch !== undefined || claims.accounts !== undefined)
+            throw denied('Parent ledger token is malformed.');
+    }
+    else
         throw denied('Ledger token role is not recognised.');
     return claims;
 }
@@ -60,47 +78,115 @@ export class LedgerServerState {
             if (error.code !== 'EEXIST')
                 throw error;
         }
-        const stat = fs.lstatSync(this.dir);
-        if (!stat.isDirectory() || stat.isSymbolicLink() || stat.mode & 0o077)
+        try {
+            privateDirectory(this.dir);
+        }
+        catch {
             throw new ExecutionLimitError('unavailable', 'Ledger server state directory is not private.');
+        }
     }
     secret() {
         this.ensure();
         const file = join(this.dir, 'server.key');
+        let created = false;
+        if (!fs.existsSync(file) && fs.existsSync(join(this.dir, 'epochs.json')))
+            throw new ExecutionLimitError('unavailable', 'Ledger server key is missing; restore the verified server state.');
         try {
             fs.writeFileSync(file, randomBytes(32), { mode: 0o600, flag: 'wx' });
+            created = true;
         }
         catch (error) {
             if (error.code !== 'EEXIST')
                 throw error;
         }
-        const key = fs.readFileSync(file);
-        if (key.length !== 32 || fs.statSync(file).mode & 0o077)
-            throw new ExecutionLimitError('unavailable', 'Ledger server key is damaged or not private.');
-        return key;
+        if (created)
+            try {
+                fs.writeFileSync(join(this.dir, 'epochs.json'), '{}', { mode: 0o600, flag: 'wx' });
+            }
+            catch (error) {
+                if (error.code !== 'EEXIST')
+                    throw error;
+            }
+        this.epochs();
+        try {
+            const key = readArtifactBytes(file, 32, true);
+            if (key.length === 32)
+                return key;
+        }
+        catch { /* Preserve invalid state. */ }
+        throw new ExecutionLimitError('unavailable', 'Ledger server key is damaged or not private.');
     }
     epochs() {
         this.ensure();
+        const file = join(this.dir, 'epochs.json');
         try {
-            return JSON.parse(fs.readFileSync(join(this.dir, 'epochs.json'), 'utf8'));
-        }
-        catch (error) {
-            if (error.code === 'ENOENT')
-                return {};
-            throw new ExecutionLimitError('unavailable', 'Ledger grant epochs are damaged.');
+            const value = JSON.parse(readArtifactBytes(file, 1024 * 1024, true).toString());
+            if (value && typeof value === 'object' && !Array.isArray(value) && Object.keys(value).length <= 10000 && Object.entries(value).every(([id, epoch]) => uuid(id) && Number.isSafeInteger(epoch) && Number(epoch) >= 1))
+                return value;
         }
+        catch { /* Preserve invalid state. */ }
+        throw new ExecutionLimitError('unavailable', 'Ledger grant epochs are damaged.');
     }
     epoch(grant) { return this.epochs()[grant] ?? 1; }
     /** Revocation is permanent in v1: a revoked grant is never reissued. */
     isRevoked(grant) { return (this.epochs()[grant] ?? 1) > 1; }
     /** Fencing: every token minted for an earlier epoch of this grant stops working. */
     revoke(grant) {
-        const epochs = this.epochs(), next = (epochs[grant] ?? 1) + 1;
-        epochs[grant] = next;
-        const temp = join(this.dir, `epochs.${process.pid}.tmp`);
-        fs.writeFileSync(temp, JSON.stringify(epochs), { mode: 0o600 });
-        fs.renameSync(temp, join(this.dir, 'epochs.json'));
-        return next;
+        if (!uuid(grant))
+            throw denied('Invalid child grant.');
+        this.ensure();
+        const lock = join(this.dir, 'writer.lock');
+        let fd;
+        try {
+            fd = fs.openSync(lock, 'wx', 0o600);
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+            if (!recoverDeadWriterLock(lock))
+                throw new ExecutionLimitError('locked', 'Ledger grant state has another writer.');
+            try {
+                fd = fs.openSync(lock, 'wx', 0o600);
+            }
+            catch {
+                throw new ExecutionLimitError('locked', 'Ledger grant state has another writer.');
+            }
+        }
+        const identity = fs.fstatSync(fd), temp = join(this.dir, `epochs.${randomUUID()}.tmp`);
+        try {
+            fs.writeFileSync(fd, String(process.pid));
+            const epochs = this.epochs(), next = (epochs[grant] ?? 1) + 1;
+            if (!Number.isSafeInteger(next) || !Object.hasOwn(epochs, grant) && Object.keys(epochs).length >= 10000)
+                throw new ExecutionLimitError('limit', 'Ledger revocation retention reached.');
+            epochs[grant] = next;
+            const output = fs.openSync(temp, 'wx', 0o600);
+            try {
+                fs.writeFileSync(output, JSON.stringify(epochs));
+                fs.fsyncSync(output);
+            }
+            finally {
+                fs.closeSync(output);
+            }
+            fs.renameSync(temp, join(this.dir, 'epochs.json'));
+            if (process.platform !== 'win32') {
+                const directory = fs.openSync(this.dir, 'r');
+                try {
+                    fs.fsyncSync(directory);
+                }
+                finally {
+                    fs.closeSync(directory);
+                }
+            }
+            return next;
+        }
+        finally {
+            fs.closeSync(fd);
+            const current = fs.lstatSync(lock);
+            if (current.dev === identity.dev && current.ino === identity.ino) {
+                fs.rmSync(temp, { force: true });
+                fs.unlinkSync(lock);
+            }
+        }
     }
 }
 //# sourceMappingURL=ledger-protocol.js.map

package/dist/execution/ledger-protocol.js.map

@@ -1 +1 @@
-{"version":3,"file":"ledger-protocol.js","sourceRoot":"","sources":["../../src/execution/ledger-protocol.ts"],"names":[],"mappings":"AAAA;;qGAEqG;AACrG,OAAO,EAAC,UAAU,EAAC,WAAW,EAAC,eAAe,EAAC,MAAM,aAAa,CAAC;AACnE,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAC,IAAI,EAAC,MAAM,WAAW,CAAC;AAC/B,OAAO,EAAC,mBAAmB,EAAC,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAC,IAAI,EAAC,UAAU,EAAC,MAAM,gBAAgB,CAAC;AAE/C,MAAM,CAAC,MAAM,eAAe,GAAC,sBAAsB,CAAC;AACpD,MAAM,CAAC,MAAM,iBAAiB,GAAC,CAAC,OAAO,EAAC,SAAS,EAAC,SAAS,EAAC,QAAQ,EAAC,OAAO,EAAC,QAAQ,CAAU,CAAC;AAEhG,MAAM,CAAC,MAAM,wBAAwB,GAAC,GAAG,GAAC,IAAI,CAAC;AAO/C,MAAM,GAAG,GAAC,CAAC,KAAmB,EAAC,EAAE,CAAA,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC1E,MAAM,IAAI,GAAC,CAAC,MAAa,EAAC,IAAW,EAAC,EAAE,CAAA,UAAU,CAAC,QAAQ,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;AAC1F,MAAM,MAAM,GAAC,CAAC,OAAc,EAAC,EAAE,CAAA,IAAI,mBAAmB,CAAC,WAAW,EAAC,OAAO,CAAC,CAAC;AAE5E,MAAM,UAAU,eAAe,CAAC,MAAa,EAAC,MAAwB;IACpE,MAAM,IAAI,GAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAAA,OAAO,GAAG,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,EAAC,IAAI,CAAC,CAAC,EAAE,CAAC;AACpF,CAAC;AACD,iGAAiG;AACjG,MAAM,UAAU,iBAAiB,CAAC,MAAa,EAAC,KAAa,EAAC,KAAY,EAAC,GAAG,GAAC,IAAI,CAAC,GAAG,EAAE;IACvF,IAAG,OAAO,KAAK,KAAG,QAAQ,IAAE,KAAK,CAAC,MAAM,GAAC,IAAI;QAAC,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;IACvF,MAAM,CAAC,IAAI,EAAC,GAAG,EAAC,KAAK,CAAC,GAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAAA,IAAG,CAAC,IAAI,IAAE,CAAC,GAAG,IAAE,KAAK,KAAG,SAAS;QAAC,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;IACrH,MAAM,QAAQ,GAAC,IAAI,CAAC,MAAM,EAAC,IAAI,CAAC,EAAC,KAAK,GAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAC,WAAW,CAAC,CAAC;IACpE,0FAA0F;IAC1F,IAAG,GAAG,CAAC,KAAK,CAAC,KAAG,GAAG,IAAE,KAAK,CAAC,MAAM,KAAG,QAAQ,CAAC,MAAM,IAAE,CAAC,eAAe,CAAC,KAAK,EAAC,QAAQ,CAAC;QAAC,MAAM,MAAM,CAAC,4CAA4C,CAAC,CAAC;IACjJ,IAAI,MAAwB,CAAC;IAAA,IAAG,CAAC;QAAA,MAAM,GAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAAA,CAAC;IAAA,MAAK,CAAC;QAAA,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;IAAA,CAAC;IACtJ,IAAG,MAAM,EAAE,CAAC,KAAG,CAAC,IAAE,MAAM,CAAC,GAAG,KAAG,KAAK,IAAE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,IAAE,MAAM,CAAC,GAAG,IAAE,GAAG;QAAC,MAAM,MAAM,CAAC,iDAAiD,CAAC,CAAC;IACzJ,IAAG,MAAM,CAAC,IAAI,KAAG,OAAO,EAAC,CAAC;QACxB,IAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,IAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM;YAAC,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;QACvK,KAAI,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ;YAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC3D,CAAC;SAAK,IAAG,MAAM,CAAC,IAAI,KAAG,QAAQ;QAAC,MAAM,MAAM,CAAC,sCAAsC,CAAC,CAAC;IACrF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kGAAkG;AAClG,MAAM,OAAO,iBAAiB;IACP,GAAG;IAAxB,YAAqB,GAAU;mBAAV,GAAG;IAAS,CAAC;IAC1B,MAAM;QACZ,IAAG,CAAC;YAAA,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAC,EAAC,IAAI,EAAC,KAAK,EAAC,CAAC,CAAC;QAAA,CAAC;QAAA,OAAM,KAAK,EAAC,CAAC;YAAA,IAAI,KAA+B,CAAC,IAAI,KAAG,QAAQ;gBAAC,MAAM,KAAK,CAAC;QAAA,CAAC;QACvH,MAAM,IAAI,GAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAAA,IAAG,CAAC,IAAI,CAAC,WAAW,EAAE,IAAE,IAAI,CAAC,cAAc,EAAE,IAAE,IAAI,CAAC,IAAI,GAAC,KAAK;YAAC,MAAM,IAAI,mBAAmB,CAAC,aAAa,EAAC,+CAA+C,CAAC,CAAC;IAChM,CAAC;IACD,MAAM;QACJ,IAAI,CAAC,MAAM,EAAE,CAAC;QAAA,MAAM,IAAI,GAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAC,YAAY,CAAC,CAAC;QACrD,IAAG,CAAC;YAAA,EAAE,CAAC,aAAa,CAAC,IAAI,EAAC,WAAW,CAAC,EAAE,CAAC,EAAC,EAAC,IAAI,EAAC,KAAK,EAAC,IAAI,EAAC,IAAI,EAAC,CAAC,CAAC;QAAA,CAAC;QAAA,OAAM,KAAK,EAAC,CAAC;YAAA,IAAI,KAA+B,CAAC,IAAI,KAAG,QAAQ;gBAAC,MAAM,KAAK,CAAC;QAAA,CAAC;QACjJ,MAAM,GAAG,GAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAAA,IAAG,GAAG,CAAC,MAAM,KAAG,EAAE,IAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAC,KAAK;YAAC,MAAM,IAAI,mBAAmB,CAAC,aAAa,EAAC,8CAA8C,CAAC,CAAC;QAAA,OAAO,GAAG,CAAC;IAC1L,CAAC;IACD,MAAM;QACJ,IAAI,CAAC,MAAM,EAAE,CAAC;QAAA,IAAG,CAAC;YAAA,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAC,aAAa,CAAC,EAAC,MAAM,CAAC,CAAC,CAAC;QAAA,CAAC;QAAA,OAAM,KAAK,EAAC,CAAC;YAAA,IAAI,KAA+B,CAAC,IAAI,KAAG,QAAQ;gBAAC,OAAO,EAAE,CAAC;YAAA,MAAM,IAAI,mBAAmB,CAAC,aAAa,EAAC,kCAAkC,CAAC,CAAC;QAAA,CAAC;IACzP,CAAC;IACD,KAAK,CAAC,KAAY,IAAU,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAE,CAAC,CAAC,CAAA,CAAC;IAC5D,wEAAwE;IACxE,SAAS,CAAC,KAAY,IAAW,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAE,CAAC,CAAC,GAAC,CAAC,CAAC,CAAA,CAAC;IACrE,oFAAoF;IACpF,MAAM,CAAC,KAAY;QACjB,MAAM,MAAM,GAAC,IAAI,CAAC,MAAM,EAAE,EAAC,IAAI,GAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAE,CAAC,CAAC,GAAC,CAAC,CAAC;QAAA,MAAM,CAAC,KAAK,CAAC,GAAC,IAAI,CAAC;QACxE,MAAM,IAAI,GAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAC,UAAU,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;QAAA,EAAE,CAAC,aAAa,CAAC,IAAI,EAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAC,EAAC,IAAI,EAAC,KAAK,EAAC,CAAC,CAAC;QAAA,EAAE,CAAC,UAAU,CAAC,IAAI,EAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAC,aAAa,CAAC,CAAC,CAAC;QAAA,OAAO,IAAI,CAAC;IAChL,CAAC;CACF"}
+{"version":3,"file":"ledger-protocol.js","sourceRoot":"","sources":["../../src/execution/ledger-protocol.ts"],"names":[],"mappings":"AAAA;;qGAEqG;AACrG,OAAO,EAAC,UAAU,EAAC,WAAW,EAAC,UAAU,EAAC,eAAe,EAAC,MAAM,aAAa,CAAC;AAC9E,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAC,IAAI,EAAC,MAAM,WAAW,CAAC;AAC/B,OAAO,EAAC,mBAAmB,EAAC,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAC,IAAI,EAAC,UAAU,EAAC,GAAG,EAAC,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAC,gBAAgB,EAAC,iBAAiB,EAAC,MAAM,qCAAqC,CAAC;AACvF,OAAO,EAAC,qBAAqB,EAAC,MAAM,sBAAsB,CAAC;AAE3D,MAAM,CAAC,MAAM,eAAe,GAAC,sBAAsB,CAAC;AACpD,MAAM,CAAC,MAAM,iBAAiB,GAAC,CAAC,OAAO,EAAC,SAAS,EAAC,WAAW,EAAC,SAAS,EAAC,QAAQ,EAAC,OAAO,EAAC,QAAQ,CAAU,CAAC;AAE5G,MAAM,CAAC,MAAM,wBAAwB,GAAC,GAAG,GAAC,IAAI,CAAC;AAW/C,MAAM,GAAG,GAAC,CAAC,KAAmB,EAAC,EAAE,CAAA,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC1E,MAAM,IAAI,GAAC,CAAC,MAAa,EAAC,IAAW,EAAC,EAAE,CAAA,UAAU,CAAC,QAAQ,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;AAC1F,MAAM,MAAM,GAAC,CAAC,OAAc,EAAC,EAAE,CAAA,IAAI,mBAAmB,CAAC,WAAW,EAAC,OAAO,CAAC,CAAC;AAE5E,MAAM,UAAU,eAAe,CAAC,MAAa,EAAC,MAAwB;IACpE,MAAM,IAAI,GAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAAA,OAAO,GAAG,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,EAAC,IAAI,CAAC,CAAC,EAAE,CAAC;AACpF,CAAC;AACD,iGAAiG;AACjG,MAAM,UAAU,iBAAiB,CAAC,MAAa,EAAC,KAAa,EAAC,KAAY,EAAC,GAAG,GAAC,IAAI,CAAC,GAAG,EAAE;IACvF,IAAG,OAAO,KAAK,KAAG,QAAQ,IAAE,KAAK,CAAC,MAAM,GAAC,IAAI;QAAC,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;IACvF,MAAM,CAAC,IAAI,EAAC,GAAG,EAAC,KAAK,CAAC,GAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAAA,IAAG,CAAC,IAAI,IAAE,CAAC,GAAG,IAAE,KAAK,KAAG,SAAS;QAAC,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;IACrH,MAAM,QAAQ,GAAC,IAAI,CAAC,MAAM,EAAC,IAAI,CAAC,EAAC,KAAK,GAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAC,WAAW,CAAC,CAAC;IACpE,0FAA0F;IAC1F,IAAG,GAAG,CAAC,KAAK,CAAC,KAAG,GAAG,IAAE,KAAK,CAAC,MAAM,KAAG,QAAQ,CAAC,MAAM,IAAE,CAAC,eAAe,CAAC,KAAK,EAAC,QAAQ,CAAC;QAAC,MAAM,MAAM,CAAC,4CAA4C,CAAC,CAAC;IACjJ,IAAI,MAAwB,CAAC;IAAA,IAAG,CAAC;QAAA,MAAM,GAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAAA,CAAC;IAAA,MAAK,CAAC;QAAA,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;IAAA,CAAC;IACtJ,IAAG,CAAC,MAAM,IAAE,CAAC,CAAC,CAAC,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAE,MAAM,CAAC,GAAG,KAAG,KAAK,IAAE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,IAAE,MAAM,CAAC,GAAG,IAAE,GAAG;QAAC,MAAM,MAAM,CAAC,iDAAiD,CAAC,CAAC;IAC9K,IAAG,MAAM,CAAC,SAAS,KAAG,SAAS,IAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,IAAE,MAAM,CAAC,CAAC,KAAG,CAAC,CAAC;QAAC,MAAM,MAAM,CAAC,8CAA8C,CAAC,CAAC;IACrI,IAAG,MAAM,CAAC,IAAI,KAAG,OAAO,EAAC,CAAC;QACxB,IAAG,MAAM,CAAC,CAAC,KAAG,CAAC,IAAE,CAAC,MAAM,CAAC,SAAS,IAAE,MAAM,CAAC,KAAK,KAAG,SAAS,IAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,IAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAC,CAAC,IAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM;YAAC,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;QAC1P,KAAI,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ;YAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC3D,CAAC;SAAK,IAAG,MAAM,CAAC,IAAI,KAAG,QAAQ,EAAC,CAAC;QAC/B,IAAG,MAAM,CAAC,CAAC,KAAG,CAAC,EAAC,CAAC;YAAA,IAAG,CAAC;gBAAA,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAAA,CAAC;YAAA,MAAK,CAAC;gBAAA,MAAM,MAAM,CAAC,+CAA+C,CAAC,CAAC;YAAA,CAAC;QAAA,CAAC;aAChH,IAAG,MAAM,CAAC,KAAK,KAAG,SAAS;YAAC,MAAM,MAAM,CAAC,yCAAyC,CAAC,CAAC;QACzF,IAAG,MAAM,CAAC,KAAK,KAAG,SAAS,IAAE,MAAM,CAAC,KAAK,KAAG,SAAS,IAAE,MAAM,CAAC,QAAQ,KAAG,SAAS;YAAC,MAAM,MAAM,CAAC,mCAAmC,CAAC,CAAC;IACvI,CAAC;;QAAK,MAAM,MAAM,CAAC,sCAAsC,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kGAAkG;AAClG,MAAM,OAAO,iBAAiB;IACP,GAAG;IAAxB,YAAqB,GAAU;mBAAV,GAAG;IAAS,CAAC;IAC1B,MAAM;QACZ,IAAG,CAAC;YAAA,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAC,EAAC,IAAI,EAAC,KAAK,EAAC,CAAC,CAAC;QAAA,CAAC;QAAA,OAAM,KAAK,EAAC,CAAC;YAAA,IAAI,KAA+B,CAAC,IAAI,KAAG,QAAQ;gBAAC,MAAM,KAAK,CAAC;QAAA,CAAC;QACvH,IAAG,CAAC;YAAA,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAAA,CAAC;QAAA,MAAK,CAAC;YAAA,MAAM,IAAI,mBAAmB,CAAC,aAAa,EAAC,+CAA+C,CAAC,CAAC;QAAA,CAAC;IACtI,CAAC;IACD,MAAM;QACJ,IAAI,CAAC,MAAM,EAAE,CAAC;QAAA,MAAM,IAAI,GAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAC,YAAY,CAAC,CAAC;QAAA,IAAI,OAAO,GAAC,KAAK,CAAC;QACvE,IAAG,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAC,aAAa,CAAC,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,aAAa,EAAC,kEAAkE,CAAC,CAAC;QACrL,IAAG,CAAC;YAAA,EAAE,CAAC,aAAa,CAAC,IAAI,EAAC,WAAW,CAAC,EAAE,CAAC,EAAC,EAAC,IAAI,EAAC,KAAK,EAAC,IAAI,EAAC,IAAI,EAAC,CAAC,CAAC;YAAA,OAAO,GAAC,IAAI,CAAC;QAAA,CAAC;QAAA,OAAM,KAAK,EAAC,CAAC;YAAA,IAAI,KAA+B,CAAC,IAAI,KAAG,QAAQ;gBAAC,MAAM,KAAK,CAAC;QAAA,CAAC;QAC9J,IAAG,OAAO;YAAC,IAAG,CAAC;gBAAA,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAC,aAAa,CAAC,EAAC,IAAI,EAAC,EAAC,IAAI,EAAC,KAAK,EAAC,IAAI,EAAC,IAAI,EAAC,CAAC,CAAC;YAAA,CAAC;YAAA,OAAM,KAAK,EAAC,CAAC;gBAAA,IAAI,KAA+B,CAAC,IAAI,KAAG,QAAQ;oBAAC,MAAM,KAAK,CAAC;YAAA,CAAC;QACzK,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,IAAG,CAAC;YAAA,MAAM,GAAG,GAAC,iBAAiB,CAAC,IAAI,EAAC,EAAE,EAAC,IAAI,CAAC,CAAC;YAAA,IAAG,GAAG,CAAC,MAAM,KAAG,EAAE;gBAAC,OAAO,GAAG,CAAC;QAAA,CAAC;QAAA,MAAK,CAAC,CAAA,6BAA6B,CAAA,CAAC;QACjH,MAAM,IAAI,mBAAmB,CAAC,aAAa,EAAC,8CAA8C,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM;QACJ,IAAI,CAAC,MAAM,EAAE,CAAC;QAAA,MAAM,IAAI,GAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAC,aAAa,CAAC,CAAC;QACtD,IAAG,CAAC;YACF,MAAM,KAAK,GAAS,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAC,IAAI,GAAC,IAAI,EAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YAClF,IAAG,KAAK,IAAE,OAAO,KAAK,KAAG,QAAQ,IAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,IAAE,KAAK,IAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAC,KAAK,CAAC,EAAC,EAAE,CAAA,IAAI,CAAC,EAAE,CAAC,IAAE,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAE,MAAM,CAAC,KAAK,CAAC,IAAE,CAAC,CAAC;gBAAC,OAAO,KAA8B,CAAC;QACvO,CAAC;QAAA,MAAK,CAAC,CAAA,6BAA6B,CAAA,CAAC;QACrC,MAAM,IAAI,mBAAmB,CAAC,aAAa,EAAC,kCAAkC,CAAC,CAAC;IAClF,CAAC;IACD,KAAK,CAAC,KAAY,IAAU,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAE,CAAC,CAAC,CAAA,CAAC;IAC5D,wEAAwE;IACxE,SAAS,CAAC,KAAY,IAAW,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAE,CAAC,CAAC,GAAC,CAAC,CAAC,CAAA,CAAC;IACrE,oFAAoF;IACpF,MAAM,CAAC,KAAY;QACjB,IAAG,CAAC,IAAI,CAAC,KAAK,CAAC;YAAC,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAAA,IAAI,CAAC,MAAM,EAAE,CAAC;QACnE,MAAM,IAAI,GAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAC,aAAa,CAAC,CAAC;QAAA,IAAI,EAAS,CAAC;QACtD,IAAG,CAAC;YAAA,EAAE,GAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAC,IAAI,EAAC,KAAK,CAAC,CAAC;QAAA,CAAC;QAAA,OAAM,KAAK,EAAC,CAAC;YAChD,IAAI,KAA+B,CAAC,IAAI,KAAG,QAAQ;gBAAC,MAAM,KAAK,CAAC;YAChE,IAAG,CAAC,qBAAqB,CAAC,IAAI,CAAC;gBAAC,MAAM,IAAI,mBAAmB,CAAC,QAAQ,EAAC,wCAAwC,CAAC,CAAC;YACjH,IAAG,CAAC;gBAAA,EAAE,GAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAC,IAAI,EAAC,KAAK,CAAC,CAAC;YAAA,CAAC;YAAA,MAAK,CAAC;gBAAA,MAAM,IAAI,mBAAmB,CAAC,QAAQ,EAAC,wCAAwC,CAAC,CAAC;YAAA,CAAC;QAC/H,CAAC;QACD,MAAM,QAAQ,GAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,EAAC,IAAI,GAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAC,UAAU,UAAU,EAAE,MAAM,CAAC,CAAC;QACjF,IAAG,CAAC;YACF,EAAE,CAAC,aAAa,CAAC,EAAE,EAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YAAA,MAAM,MAAM,GAAC,IAAI,CAAC,MAAM,EAAE,EAAC,IAAI,GAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAE,CAAC,CAAC,GAAC,CAAC,CAAC;YAC9F,IAAG,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAC,KAAK,CAAC,IAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,IAAE,KAAK;gBAAC,MAAM,IAAI,mBAAmB,CAAC,OAAO,EAAC,sCAAsC,CAAC,CAAC;YAC9K,MAAM,CAAC,KAAK,CAAC,GAAC,IAAI,CAAC;YAAA,MAAM,MAAM,GAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAC,IAAI,EAAC,KAAK,CAAC,CAAC;YAC7D,IAAG,CAAC;gBAAA,EAAE,CAAC,aAAa,CAAC,MAAM,EAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;gBAAA,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAAA,CAAC;oBAAO,CAAC;gBAAA,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAAA,CAAC;YACxG,EAAE,CAAC,UAAU,CAAC,IAAI,EAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAC,aAAa,CAAC,CAAC,CAAC;YACjD,IAAG,OAAO,CAAC,QAAQ,KAAG,OAAO,EAAC,CAAC;gBAAA,MAAM,SAAS,GAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAC,GAAG,CAAC,CAAC;gBAAA,IAAG,CAAC;oBAAA,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;gBAAA,CAAC;wBAAO,CAAC;oBAAA,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;gBAAA,CAAC;YAAA,CAAC;YACxI,OAAO,IAAI,CAAC;QACd,CAAC;gBAAO,CAAC;YACP,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAAA,MAAM,OAAO,GAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAClD,IAAG,OAAO,CAAC,GAAG,KAAG,QAAQ,CAAC,GAAG,IAAE,OAAO,CAAC,GAAG,KAAG,QAAQ,CAAC,GAAG,EAAC,CAAC;gBAAA,EAAE,CAAC,MAAM,CAAC,IAAI,EAAC,EAAC,KAAK,EAAC,IAAI,EAAC,CAAC,CAAC;gBAAA,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAAA,CAAC;QAC/G,CAAC;IACH,CAAC;CACF"}

package/dist/execution/ledger-server.d.ts

@@ -2,6 +2,7 @@
  * authority: this adds authentication, per-account ownership, idempotent replay and grant fencing. */
 import * as http from 'node:http';
 import { ReservationLedger } from './ledger.js';
+import { type ChildGrant, type RequestReservation } from './types.js';
 import { LedgerServerState } from './ledger-protocol.js';
 export interface LedgerServerOptions {
     ledger: ReservationLedger;
@@ -9,6 +10,18 @@ export interface LedgerServerOptions {
     cwd: string;
     state: LedgerServerState;
     now?: () => number;
+    /** Restrict this endpoint to one owner subtree, even for otherwise valid tokens. */
+    ownerAgentId?: string;
+    /** Exact reviewed-host audience; authenticated tokens cannot downgrade to raw serving. */
+    authority?: string;
+    /** Trusted reviewed host: target-account lifecycle and existing native grant checks. */
+    assertAccountAuthority?: (agentId: string) => void;
+    assertReservationAuthority?: (reservation: RequestReservation) => void;
+    assertGrantAuthority?: (grant: ChildGrant) => void;
+    /** Trusted owner lifecycle check, e.g. prepareAgentExecution().assertAuthority.
+     * Fences new reservations/grants under the writer lock; reads, replay and
+     * settlement remain available to reconcile already admitted requests. */
+    assertAuthority?: () => void;
 }
 export declare function createLedgerServer(options: LedgerServerOptions): http.Server;
 //# sourceMappingURL=ledger-server.d.ts.map

package/dist/execution/ledger-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ledger-server.d.ts","sourceRoot":"","sources":["../../src/execution/ledger-server.ts"],"names":[],"mappings":"AAAA;sGACsG;AACtG,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAC,iBAAiB,EAAC,MAAM,aAAa,CAAC;AAI9C,OAAO,EAA4D,iBAAiB,EAA0D,MAAM,sBAAsB,CAAC;AAE3K,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAC,iBAAiB,CAAC;IACzB,oFAAoF;IACpF,GAAG,EAAC,MAAM,CAAC;IACX,KAAK,EAAC,iBAAiB,CAAC;IACxB,GAAG,CAAC,EAAC,MAAI,MAAM,CAAC;CACjB;AAID,wBAAgB,kBAAkB,CAAC,OAAO,EAAC,mBAAmB,GAAE,IAAI,CAAC,MAAM,CAwF1E"}
+{"version":3,"file":"ledger-server.d.ts","sourceRoot":"","sources":["../../src/execution/ledger-server.ts"],"names":[],"mappings":"AAAA;sGACsG;AACtG,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAC,iBAAiB,EAAC,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAqB,KAAK,UAAU,EAAC,KAAK,kBAAkB,EAAwB,MAAM,YAAY,CAAC;AAG9G,OAAO,EAA4D,iBAAiB,EAA0D,MAAM,sBAAsB,CAAC;AAE3K,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAC,iBAAiB,CAAC;IACzB,oFAAoF;IACpF,GAAG,EAAC,MAAM,CAAC;IACX,KAAK,EAAC,iBAAiB,CAAC;IACxB,GAAG,CAAC,EAAC,MAAI,MAAM,CAAC;IAChB,oFAAoF;IACpF,YAAY,CAAC,EAAC,MAAM,CAAC;IACrB,0FAA0F;IAC1F,SAAS,CAAC,EAAC,MAAM,CAAC;IAClB,wFAAwF;IACxF,sBAAsB,CAAC,EAAC,CAAC,OAAO,EAAC,MAAM,KAAG,IAAI,CAAC;IAC/C,0BAA0B,CAAC,EAAC,CAAC,WAAW,EAAC,kBAAkB,KAAG,IAAI,CAAC;IACnE,oBAAoB,CAAC,EAAC,CAAC,KAAK,EAAC,UAAU,KAAG,IAAI,CAAC;IAC/C;;6EAEyE;IACzE,eAAe,CAAC,EAAC,MAAI,IAAI,CAAC;CAC3B;AAID,wBAAgB,kBAAkB,CAAC,OAAO,EAAC,mBAAmB,GAAE,IAAI,CAAC,MAAM,CAkH1E"}

package/dist/execution/ledger-server.js

@@ -3,13 +3,20 @@
 import * as http from 'node:http';
 import { canonicalJson } from '../approvals/index.js';
 import { ExecutionLimitError } from './types.js';
-import { accountLineage } from './authority.js';
-import { effectiveExecutionManifest } from './child-grants.js';
+import { accountLineage, identifier, hex, validateExecutionProject } from './authority.js';
+import { effectiveExecutionManifest, executionProjectForAccount } from './child-grants.js';
 import { LEDGER_PROTOCOL, LEDGER_OPERATIONS, MAX_LEDGER_REQUEST_BYTES, mintLedgerToken, verifyLedgerToken } from './ledger-protocol.js';
 const STATUS = { invalid: 400, authority: 403, budget: 409, deadline: 409, conflict: 409, limit: 409, locked: 503, unavailable: 503 };
 export function createLedgerServer(options) {
     const { ledger, cwd, state } = options, now = options.now ?? Date.now, secret = state.secret();
+    if (options.authority !== undefined && !hex(options.authority))
+        throw new ExecutionLimitError('invalid', 'Invalid ledger authority binding.');
     const current = () => ledger.read(cwd);
+    if (options.ownerAgentId !== undefined) {
+        identifier(options.ownerAgentId);
+        const saved = current();
+        accountLineage(effectiveExecutionManifest(saved.manifest, saved.projection), options.ownerAgentId);
+    }
     const journal = () => { const { manifest, events } = current(); return { manifest, events }; };
     const assertActive = (token) => {
         if (token.exp <= now())
@@ -21,7 +28,14 @@ export function createLedgerServer(options) {
         const header = req.headers.authorization ?? '';
         const run = current().manifest.runId;
         const token = verifyLedgerToken(secret, header.startsWith('Bearer ') ? header.slice(7) : undefined, run, now());
+        if (token.authority !== options.authority)
+            throw new ExecutionLimitError('authority', 'Ledger token belongs to another authority binding.');
         assertActive(token);
+        if (options.ownerAgentId !== undefined) {
+            const roots = token.role === 'child' ? token.accounts : token.v === 2 ? [token.owner] : [];
+            if (!roots.length || roots.some(id => !within(id, options.ownerAgentId)))
+                throw new ExecutionLimitError('authority', 'Ledger token belongs to another owner scope.');
+        }
         return token;
     };
     /** Revoking a grant fences every descendant account, whichever token it was minted under. */
@@ -29,17 +43,35 @@ export function createLedgerServer(options) {
         const saved = current(), effective = effectiveExecutionManifest(saved.manifest, saved.projection), records = saved.projection.childGrants ?? [];
         return accounts.some(id => accountLineage(effective, id).some(a => records.some(r => state.isRevoked(r.grant.id) && r.grant.accounts.some(g => g.id === a.id))));
     };
-    /** A child may act only for its own accounts and their descendants (grandchildren it granted). */
+    const within = (agentId, owner) => {
+        const saved = current();
+        return accountLineage(effectiveExecutionManifest(saved.manifest, saved.projection), agentId).some(a => a.id === owner);
+    };
+    /** Token scope survives reuse at another endpoint serving the same run. */
     const owns = (token, agentId) => {
-        if (token.role === 'parent')
-            return;
-        const saved = current(), effective = effectiveExecutionManifest(saved.manifest, saved.projection);
-        if (!accountLineage(effective, agentId).some(a => token.accounts.includes(a.id)))
+        identifier(agentId);
+        if (options.ownerAgentId !== undefined && !within(agentId, options.ownerAgentId))
+            throw new ExecutionLimitError('authority', 'This endpoint cannot act for that account.');
+        if (token.role === 'parent') {
+            if (token.v === 2 && !within(agentId, token.owner))
+                throw new ExecutionLimitError('authority', 'This parent token cannot act for that account.');
+        }
+        else if (!token.accounts.some(owner => within(agentId, owner)))
             throw new ExecutionLimitError('authority', 'This token cannot act for that account.');
     };
     const handlers = {
         hello: async () => { const { manifest } = current(); return { protocol: LEDGER_PROTOCOL, operations: LEDGER_OPERATIONS, runId: manifest.runId }; },
         journal: async () => journal(),
+        execution: async (token, body) => {
+            identifier(body.agentId);
+            owns(token, body.agentId);
+            const project = validateExecutionProject(body.project), saved = current();
+            if (canonicalJson(project) !== canonicalJson(executionProjectForAccount(saved.manifest, saved.projection, body.agentId)))
+                throw new ExecutionLimitError('authority', 'Workspace does not match the owner-declared child project.');
+            options.assertAuthority?.();
+            options.assertAccountAuthority?.(body.agentId);
+            return { ...journal(), binding: { version: 1, agentId: body.agentId, project } };
+        },
         reserve: async (token, body, outcome) => {
             const reservation = body.reservation, hash = String(body.manifestHash);
             owns(token, reservation?.agentId);
@@ -50,8 +82,10 @@ export function createLedgerServer(options) {
                     throw new ExecutionLimitError('conflict', 'Reservation id already admitted a different request.');
                 return { ...journal(), replayed: true };
             }
+            const assertAdmission = () => { assertActive(token); owns(token, reservation.agentId); options.assertAuthority?.(); options.assertAccountAuthority?.(reservation.agentId); options.assertReservationAuthority?.(reservation); };
             try {
-                await ledger.reserve(cwd, hash, reservation, undefined, () => assertActive(token));
+                assertAdmission();
+                await ledger.reserve(cwd, hash, reservation, undefined, assertAdmission);
             }
             catch (error) {
                 // The local operation has finished. Prove non-admission from the same
@@ -74,8 +108,11 @@ export function createLedgerServer(options) {
             owns(token, entry.reservation.agentId);
             if (entry.state !== 'pending') {
                 const settled = saved.events.find(e => e.change.type === 'settle' && e.change.settlement.requestId === settlement.requestId);
-                if (settled && settled.change.type === 'settle' && canonicalJson(settled.change.settlement) === canonicalJson(settlement))
+                if (settled && settled.change.type === 'settle' && canonicalJson(settled.change.settlement) === canonicalJson(settlement)) {
+                    if (saved.manifest.parent)
+                        await ledger.settle(cwd, hash, settlement);
                     return { ...journal(), replayed: true };
+                }
                 throw new ExecutionLimitError('conflict', 'Request was already settled differently.');
             }
             await ledger.settle(cwd, hash, settlement);
@@ -84,24 +121,31 @@ export function createLedgerServer(options) {
         grant: async (token, body) => {
             const grant = body.grant, hash = String(body.manifestHash);
             owns(token, grant?.parentId);
+            if (grant?.version === 2 && token.role !== 'parent')
+                throw new ExecutionLimitError('authority', 'Only the ledger owner can bind a child to another workspace.');
             const assertGrant = () => {
                 assertActive(token);
+                owns(token, grant?.parentId);
+                options.assertAuthority?.();
+                options.assertAccountAuthority?.(grant?.parentId);
+                options.assertGrantAuthority?.(grant);
                 if (grant?.id && state.isRevoked(grant.id))
                     throw new ExecutionLimitError('authority', 'This child grant was revoked and cannot be reissued.');
             };
             assertGrant();
             await ledger.grantChildren(cwd, hash, grant, undefined, assertGrant);
             assertGrant();
-            const deadline = Math.min(...grant.accounts.map(a => a.deadline));
-            const child = mintLedgerToken(secret, { v: 1, run: current().manifest.runId, role: 'child', grant: grant.id, epoch: state.epoch(grant.id), accounts: grant.accounts.map(a => a.id), exp: deadline });
+            const deadline = Math.min(token.exp, ...grant.accounts.map(a => a.deadline));
+            const child = mintLedgerToken(secret, { v: token.authority ? 2 : 1, ...(token.authority ? { authority: token.authority } : {}), run: current().manifest.runId, role: 'child', grant: grant.id, epoch: state.epoch(grant.id), accounts: grant.accounts.map(a => a.id), exp: deadline });
             return { ...journal(), token: child };
         },
         revoke: async (token, body) => {
             if (token.role !== 'parent')
                 throw new ExecutionLimitError('authority', 'Only the parent can revoke a child grant.');
-            const grant = String(body.grant);
-            if (!current().projection.childGrants?.some(r => r.grant.id === grant))
+            const grant = String(body.grant), record = current().projection.childGrants?.find(r => r.grant.id === grant);
+            if (!record)
                 throw new ExecutionLimitError('conflict', 'No such child grant.');
+            owns(token, record.grant.parentId);
             return { grant, epoch: state.revoke(grant) };
         },
     };

package/dist/execution/ledger-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"ledger-server.js","sourceRoot":"","sources":["../../src/execution/ledger-server.ts"],"names":[],"mappings":"AAAA;sGACsG;AACtG,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAC,aAAa,EAAC,MAAM,uBAAuB,CAAC;AAEpD,OAAO,EAAC,mBAAmB,EAAgE,MAAM,YAAY,CAAC;AAC9G,OAAO,EAAC,cAAc,EAAC,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAC,0BAA0B,EAAC,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAC,eAAe,EAAC,iBAAiB,EAAC,wBAAwB,EAAmB,eAAe,EAAC,iBAAiB,EAAwB,MAAM,sBAAsB,CAAC;AAS3K,MAAM,MAAM,GAA4C,EAAC,OAAO,EAAC,GAAG,EAAC,SAAS,EAAC,GAAG,EAAC,MAAM,EAAC,GAAG,EAAC,QAAQ,EAAC,GAAG,EAAC,QAAQ,EAAC,GAAG,EAAC,KAAK,EAAC,GAAG,EAAC,MAAM,EAAC,GAAG,EAAC,WAAW,EAAC,GAAG,EAAC,CAAC;AAG9J,MAAM,UAAU,kBAAkB,CAAC,OAA2B;IAC5D,MAAM,EAAC,MAAM,EAAC,GAAG,EAAC,KAAK,EAAC,GAAC,OAAO,EAAC,GAAG,GAAC,OAAO,CAAC,GAAG,IAAE,IAAI,CAAC,GAAG,EAAC,MAAM,GAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IACjF,MAAM,OAAO,GAAC,GAAE,EAAE,CAAA,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,OAAO,GAAC,GAAE,EAAE,GAAC,MAAM,EAAC,QAAQ,EAAC,MAAM,EAAC,GAAC,OAAO,EAAE,CAAC,CAAA,OAAO,EAAC,QAAQ,EAAC,MAAM,EAAC,CAAC,CAAA,CAAC,CAAC;IAChF,MAAM,YAAY,GAAC,CAAC,KAAuB,EAAC,EAAE;QAC5C,IAAG,KAAK,CAAC,GAAG,IAAE,GAAG,EAAE;YAAC,MAAM,IAAI,mBAAmB,CAAC,WAAW,EAAC,2DAA2D,CAAC,CAAC;QAC3H,IAAG,KAAK,CAAC,IAAI,KAAG,OAAO,IAAE,CAAC,KAAK,CAAC,KAAK,KAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAM,CAAC,IAAE,cAAc,CAAC,KAAK,CAAC,QAAS,CAAC,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,WAAW,EAAC,2FAA2F,CAAC,CAAC;IAC7O,CAAC,CAAC;IACF,MAAM,MAAM,GAAC,CAAC,GAAwB,EAAmB,EAAE;QACzD,MAAM,MAAM,GAAC,GAAG,CAAC,OAAO,CAAC,aAAa,IAAE,EAAE,CAAC;QAAA,MAAM,GAAG,GAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC9E,MAAM,KAAK,GAAC,iBAAiB,CAAC,MAAM,EAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA,CAAC,CAAA,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA,CAAC,CAAA,SAAS,EAAC,GAAG,EAAC,GAAG,EAAE,CAAC,CAAC;QACvG,YAAY,CAAC,KAAK,CAAC,CAAC;QAAA,OAAO,KAAK,CAAC;IACnC,CAAC,CAAC;IACF,6FAA6F;IAC7F,MAAM,cAAc,GAAC,CAAC,QAAiB,EAAS,EAAE;QAChD,MAAM,KAAK,GAAC,OAAO,EAAE,EAAC,SAAS,GAAC,0BAA0B,CAAC,KAAK,CAAC,QAAQ,EAAC,KAAK,CAAC,UAAU,CAAC,EAAC,OAAO,GAAC,KAAK,CAAC,UAAU,CAAC,WAAW,IAAE,EAAE,CAAC;QACrI,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAA,EAAE,CAAA,cAAc,CAAC,SAAS,EAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,IAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,EAAE,KAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACtJ,CAAC,CAAC;IACF,kGAAkG;IAClG,MAAM,IAAI,GAAC,CAAC,KAAuB,EAAC,OAAc,EAAC,EAAE;QACnD,IAAG,KAAK,CAAC,IAAI,KAAG,QAAQ;YAAC,OAAO;QAChC,MAAM,KAAK,GAAC,OAAO,EAAE,EAAC,SAAS,GAAC,0BAA0B,CAAC,KAAK,CAAC,QAAQ,EAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC5F,IAAG,CAAC,cAAc,CAAC,SAAS,EAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,KAAK,CAAC,QAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,WAAW,EAAC,yCAAyC,CAAC,CAAC;IACrK,CAAC,CAAC;IACF,MAAM,QAAQ,GAAiH;QAC7H,KAAK,EAAC,KAAK,IAAE,EAAE,GAAC,MAAM,EAAC,QAAQ,EAAC,GAAC,OAAO,EAAE,CAAC,CAAA,OAAO,EAAC,QAAQ,EAAC,eAAe,EAAC,UAAU,EAAC,iBAAiB,EAAC,KAAK,EAAC,QAAQ,CAAC,KAAK,EAAC,CAAC,CAAA,CAAC;QAChI,OAAO,EAAC,KAAK,IAAE,EAAE,CAAA,OAAO,EAAE;QAC1B,OAAO,EAAC,KAAK,EAAC,KAAK,EAAC,IAAI,EAAC,OAAO,EAAC,EAAE;YACjC,MAAM,WAAW,GAAC,IAAI,CAAC,WAAiC,EAAC,IAAI,GAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAAA,IAAI,CAAC,KAAK,EAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACzH,MAAM,KAAK,GAAC,OAAO,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC3D,0FAA0F;YAC1F,IAAG,KAAK,EAAC,CAAC;gBAAA,IAAG,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,KAAG,aAAa,CAAC,WAAW,CAAC;oBAAC,MAAM,IAAI,mBAAmB,CAAC,UAAU,EAAC,sDAAsD,CAAC,CAAC;gBAAA,OAAO,EAAC,GAAG,OAAO,EAAE,EAAC,QAAQ,EAAC,IAAI,EAAC,CAAC;YAAA,CAAC;YACjN,IAAG,CAAC;gBAAA,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,EAAC,IAAI,EAAC,WAAW,EAAC,SAAS,EAAC,GAAE,EAAE,CAAA,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;YAAA,CAAC;YAClF,OAAM,KAAK,EAAC,CAAC;gBACX,sEAAsE;gBACtE,sEAAsE;gBACtE,IAAG,CAAC;oBAAA,MAAM,KAAK,GAAC,OAAO,EAAE,CAAC;oBAAA,IAAG,KAAK,CAAC,UAAU,CAAC,YAAY,KAAG,IAAI,IAAE,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;wBAAC,OAAO,CAAC,SAAS,GAAC,SAAS,CAAC;gBAAA,CAAC;gBAAA,MAAK,CAAC,CAAA,2BAA2B,CAAA,CAAC;gBAC7K,MAAM,KAAK,CAAC;YACd,CAAC;YACD,OAAO,OAAO,EAAE,CAAC;QACnB,CAAC;QACD,MAAM,EAAC,KAAK,EAAC,KAAK,EAAC,IAAI,EAAC,EAAE;YACxB,MAAM,UAAU,GAAC,IAAI,CAAC,UAA+B,EAAC,IAAI,GAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACrF,MAAM,KAAK,GAAC,OAAO,EAAE,EAAC,KAAK,GAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;YAC7E,IAAG,CAAC,KAAK;gBAAC,MAAM,IAAI,mBAAmB,CAAC,UAAU,EAAC,6BAA6B,CAAC,CAAC;YAAA,IAAI,CAAC,KAAK,EAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YACxH,IAAG,KAAK,CAAC,KAAK,KAAG,SAAS,EAAC,CAAC;gBAC1B,MAAM,OAAO,GAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,MAAM,CAAC,IAAI,KAAG,QAAQ,IAAE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,KAAG,UAAU,CAAC,SAAS,CAAC,CAAC;gBACnH,IAAG,OAAO,IAAE,OAAO,CAAC,MAAM,CAAC,IAAI,KAAG,QAAQ,IAAE,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,KAAG,aAAa,CAAC,UAAU,CAAC;oBAAC,OAAO,EAAC,GAAG,OAAO,EAAE,EAAC,QAAQ,EAAC,IAAI,EAAC,CAAC;gBACrJ,MAAM,IAAI,mBAAmB,CAAC,UAAU,EAAC,0CAA0C,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,EAAC,IAAI,EAAC,UAAU,CAAC,CAAC;YAAA,OAAO,OAAO,EAAE,CAAC;QAC5D,CAAC;QACD,KAAK,EAAC,KAAK,EAAC,KAAK,EAAC,IAAI,EAAC,EAAE;YACvB,MAAM,KAAK,GAAC,IAAI,CAAC,KAAmB,EAAC,IAAI,GAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAAA,IAAI,CAAC,KAAK,EAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAChG,MAAM,WAAW,GAAC,GAAE,EAAE;gBACpB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,IAAG,KAAK,EAAE,EAAE,IAAE,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;oBAAC,MAAM,IAAI,mBAAmB,CAAC,WAAW,EAAC,sDAAsD,CAAC,CAAC;YAC5I,CAAC,CAAC;YACF,WAAW,EAAE,CAAC;YAAA,MAAM,MAAM,CAAC,aAAa,CAAC,GAAG,EAAC,IAAI,EAAC,KAAK,EAAC,SAAS,EAAC,WAAW,CAAC,CAAC;YAAA,WAAW,EAAE,CAAC;YAC7F,MAAM,QAAQ,GAAC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC9D,MAAM,KAAK,GAAC,eAAe,CAAC,MAAM,EAAC,EAAC,CAAC,EAAC,CAAC,EAAC,GAAG,EAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAC,IAAI,EAAC,OAAO,EAAC,KAAK,EAAC,KAAK,CAAC,EAAE,EAAC,KAAK,EAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,EAAC,QAAQ,EAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,EAAE,CAAC,EAAC,GAAG,EAAC,QAAQ,EAAC,CAAC,CAAC;YACjL,OAAO,EAAC,GAAG,OAAO,EAAE,EAAC,KAAK,EAAC,KAAK,EAAC,CAAC;QACpC,CAAC;QACD,MAAM,EAAC,KAAK,EAAC,KAAK,EAAC,IAAI,EAAC,EAAE;YACxB,IAAG,KAAK,CAAC,IAAI,KAAG,QAAQ;gBAAC,MAAM,IAAI,mBAAmB,CAAC,WAAW,EAAC,2CAA2C,CAAC,CAAC;YAChH,MAAM,KAAK,GAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAAA,IAAG,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,KAAK,CAAC,EAAE,KAAG,KAAK,CAAC;gBAAC,MAAM,IAAI,mBAAmB,CAAC,UAAU,EAAC,sBAAsB,CAAC,CAAC;YAClK,OAAO,EAAC,KAAK,EAAC,KAAK,EAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAC,CAAC;QAC3C,CAAC;KACF,CAAC;IACF,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAC,GAAG,EAAC,EAAE;QAClC,MAAM,KAAK,GAAC,CAAC,MAAa,EAAC,KAAa,EAAC,EAAE,GAAC,MAAM,GAAG,GAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA,GAAG,CAAC,SAAS,CAAC,MAAM,EAAC,EAAC,cAAc,EAAC,kBAAkB,EAAC,eAAe,EAAC,UAAU,EAAC,CAAC,CAAC,CAAA,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA,CAAC,CAAC;QAChL,MAAM,EAAE,GAAC,CAAC,GAAG,CAAC,GAAG,IAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAC,EAAE,CAAC,CAAC;QAC7C,IAAG,GAAG,CAAC,MAAM,KAAG,MAAM,IAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAC,EAAE,CAAC,EAAC,CAAC;YAAA,KAAK,CAAC,GAAG,EAAC,EAAC,EAAE,EAAC,KAAK,EAAC,IAAI,EAAC,SAAS,EAAC,OAAO,EAAC,2BAA2B,EAAC,CAAC,CAAC;YAAA,OAAO;QAAA,CAAC;QACtI,MAAM,MAAM,GAAU,EAAE,CAAC;QAAA,IAAI,IAAI,GAAC,CAAC,CAAC;QACpC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAC,CAAC,KAAY,EAAC,EAAE,GAAC,IAAI,IAAE,KAAK,CAAC,MAAM,CAAC,CAAA,IAAG,IAAI,GAAC,wBAAwB,EAAC,CAAC;YAAA,KAAK,CAAC,GAAG,EAAC,EAAC,EAAE,EAAC,KAAK,EAAC,IAAI,EAAC,OAAO,EAAC,OAAO,EAAC,8BAA8B,EAAC,CAAC,CAAC;YAAA,GAAG,CAAC,OAAO,EAAE,CAAC;QAAA,CAAC;;YAAK,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC;QACxM,GAAG,CAAC,EAAE,CAAC,KAAK,EAAC,GAAE,EAAE;YAAC,KAAK,CAAC,KAAK,IAAE,EAAE;gBAC/B,MAAM,OAAO,GAAkB,EAAC,SAAS,EAAC,SAAS,EAAC,CAAC;gBACrD,IAAG,CAAC;oBACF,MAAM,KAAK,GAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAAA,IAAI,IAAY,CAAC;oBAAA,IAAG,CAAC;wBAAA,IAAI,GAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAE,IAAI,CAAC,CAAC;oBAAA,CAAC;oBAAA,MAAK,CAAC;wBAAA,MAAM,IAAI,mBAAmB,CAAC,SAAS,EAAC,6BAA6B,CAAC,CAAC;oBAAA,CAAC;oBAC1L,IAAG,CAAC,IAAI,IAAE,OAAO,IAAI,KAAG,QAAQ,IAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;wBAAC,MAAM,IAAI,mBAAmB,CAAC,SAAS,EAAC,mCAAmC,CAAC,CAAC;oBACnI,KAAK,CAAC,GAAG,EAAC,EAAC,EAAE,EAAC,IAAI,EAAC,GAAG,CAAC,MAAM,QAAQ,CAAC,EAAE,CAAE,CAAC,KAAK,EAAC,IAA8B,EAAC,OAAO,CAAC,CAAW,EAAC,CAAC,CAAC;gBACxG,CAAC;gBAAA,OAAM,KAAK,EAAC,CAAC;oBACZ,wFAAwF;oBACxF,IAAG,KAAK,YAAY,mBAAmB;wBAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAC,EAAC,EAAE,EAAC,KAAK,EAAC,IAAI,EAAC,KAAK,CAAC,IAAI,EAAC,OAAO,EAAC,KAAK,CAAC,OAAO,EAAC,GAAG,CAAC,EAAE,KAAG,SAAS,CAAA,CAAC,CAAA,OAAO,CAAA,CAAC,CAAA,EAAE,CAAC,EAAC,CAAC,CAAC;;wBAC7I,KAAK,CAAC,GAAG,EAAC,EAAC,EAAE,EAAC,KAAK,EAAC,IAAI,EAAC,aAAa,EAAC,OAAO,EAAC,mDAAmD,EAAC,CAAC,CAAC;gBAC5G,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;QAAA,CAAC,CAAC,CAAC;IACV,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"ledger-server.js","sourceRoot":"","sources":["../../src/execution/ledger-server.ts"],"names":[],"mappings":"AAAA;sGACsG;AACtG,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAC,aAAa,EAAC,MAAM,uBAAuB,CAAC;AAEpD,OAAO,EAAC,mBAAmB,EAAgE,MAAM,YAAY,CAAC;AAC9G,OAAO,EAAC,cAAc,EAAC,UAAU,EAAC,GAAG,EAAC,wBAAwB,EAAC,MAAM,gBAAgB,CAAC;AACtF,OAAO,EAAC,0BAA0B,EAAC,0BAA0B,EAAC,MAAM,mBAAmB,CAAC;AACxF,OAAO,EAAC,eAAe,EAAC,iBAAiB,EAAC,wBAAwB,EAAmB,eAAe,EAAC,iBAAiB,EAAwB,MAAM,sBAAsB,CAAC;AAqB3K,MAAM,MAAM,GAA4C,EAAC,OAAO,EAAC,GAAG,EAAC,SAAS,EAAC,GAAG,EAAC,MAAM,EAAC,GAAG,EAAC,QAAQ,EAAC,GAAG,EAAC,QAAQ,EAAC,GAAG,EAAC,KAAK,EAAC,GAAG,EAAC,MAAM,EAAC,GAAG,EAAC,WAAW,EAAC,GAAG,EAAC,CAAC;AAG9J,MAAM,UAAU,kBAAkB,CAAC,OAA2B;IAC5D,MAAM,EAAC,MAAM,EAAC,GAAG,EAAC,KAAK,EAAC,GAAC,OAAO,EAAC,GAAG,GAAC,OAAO,CAAC,GAAG,IAAE,IAAI,CAAC,GAAG,EAAC,MAAM,GAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IACjF,IAAG,OAAO,CAAC,SAAS,KAAG,SAAS,IAAE,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC;QAAC,MAAM,IAAI,mBAAmB,CAAC,SAAS,EAAC,mCAAmC,CAAC,CAAC;IACvI,MAAM,OAAO,GAAC,GAAE,EAAE,CAAA,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,IAAG,OAAO,CAAC,YAAY,KAAG,SAAS,EAAC,CAAC;QAAA,UAAU,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAAA,MAAM,KAAK,GAAC,OAAO,EAAE,CAAC;QAAA,cAAc,CAAC,0BAA0B,CAAC,KAAK,CAAC,QAAQ,EAAC,KAAK,CAAC,UAAU,CAAC,EAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAAA,CAAC;IAC9L,MAAM,OAAO,GAAC,GAAE,EAAE,GAAC,MAAM,EAAC,QAAQ,EAAC,MAAM,EAAC,GAAC,OAAO,EAAE,CAAC,CAAA,OAAO,EAAC,QAAQ,EAAC,MAAM,EAAC,CAAC,CAAA,CAAC,CAAC;IAChF,MAAM,YAAY,GAAC,CAAC,KAAuB,EAAC,EAAE;QAC5C,IAAG,KAAK,CAAC,GAAG,IAAE,GAAG,EAAE;YAAC,MAAM,IAAI,mBAAmB,CAAC,WAAW,EAAC,2DAA2D,CAAC,CAAC;QAC3H,IAAG,KAAK,CAAC,IAAI,KAAG,OAAO,IAAE,CAAC,KAAK,CAAC,KAAK,KAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAM,CAAC,IAAE,cAAc,CAAC,KAAK,CAAC,QAAS,CAAC,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,WAAW,EAAC,2FAA2F,CAAC,CAAC;IAC7O,CAAC,CAAC;IACF,MAAM,MAAM,GAAC,CAAC,GAAwB,EAAmB,EAAE;QACzD,MAAM,MAAM,GAAC,GAAG,CAAC,OAAO,CAAC,aAAa,IAAE,EAAE,CAAC;QAAA,MAAM,GAAG,GAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC9E,MAAM,KAAK,GAAC,iBAAiB,CAAC,MAAM,EAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA,CAAC,CAAA,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA,CAAC,CAAA,SAAS,EAAC,GAAG,EAAC,GAAG,EAAE,CAAC,CAAC;QACvG,IAAG,KAAK,CAAC,SAAS,KAAG,OAAO,CAAC,SAAS;YAAC,MAAM,IAAI,mBAAmB,CAAC,WAAW,EAAC,oDAAoD,CAAC,CAAC;QACvI,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,IAAG,OAAO,CAAC,YAAY,KAAG,SAAS,EAAC,CAAC;YACnC,MAAM,KAAK,GAAC,KAAK,CAAC,IAAI,KAAG,OAAO,CAAA,CAAC,CAAA,KAAK,CAAC,QAAS,CAAA,CAAC,CAAA,KAAK,CAAC,CAAC,KAAG,CAAC,CAAA,CAAC,CAAA,CAAC,KAAK,CAAC,KAAM,CAAC,CAAA,CAAC,CAAA,EAAE,CAAC;YAC/E,IAAG,CAAC,KAAK,CAAC,MAAM,IAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAA,EAAE,CAAA,CAAC,MAAM,CAAC,EAAE,EAAC,OAAO,CAAC,YAAa,CAAC,CAAC;gBAAC,MAAM,IAAI,mBAAmB,CAAC,WAAW,EAAC,8CAA8C,CAAC,CAAC;QAChK,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,6FAA6F;IAC7F,MAAM,cAAc,GAAC,CAAC,QAAiB,EAAS,EAAE;QAChD,MAAM,KAAK,GAAC,OAAO,EAAE,EAAC,SAAS,GAAC,0BAA0B,CAAC,KAAK,CAAC,QAAQ,EAAC,KAAK,CAAC,UAAU,CAAC,EAAC,OAAO,GAAC,KAAK,CAAC,UAAU,CAAC,WAAW,IAAE,EAAE,CAAC;QACrI,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAA,EAAE,CAAA,cAAc,CAAC,SAAS,EAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,IAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,EAAE,KAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACtJ,CAAC,CAAC;IACF,MAAM,MAAM,GAAC,CAAC,OAAc,EAAC,KAAY,EAAS,EAAE;QAClD,MAAM,KAAK,GAAC,OAAO,EAAE,CAAC;QAAA,OAAO,cAAc,CAAC,0BAA0B,CAAC,KAAK,CAAC,QAAQ,EAAC,KAAK,CAAC,UAAU,CAAC,EAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,EAAE,KAAG,KAAK,CAAC,CAAC;IACzI,CAAC,CAAC;IACF,2EAA2E;IAC3E,MAAM,IAAI,GAAC,CAAC,KAAuB,EAAC,OAAc,EAAC,EAAE;QACnD,UAAU,CAAC,OAAO,CAAC,CAAC;QACpB,IAAG,OAAO,CAAC,YAAY,KAAG,SAAS,IAAE,CAAC,MAAM,CAAC,OAAO,EAAC,OAAO,CAAC,YAAY,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,WAAW,EAAC,4CAA4C,CAAC,CAAC;QACnK,IAAG,KAAK,CAAC,IAAI,KAAG,QAAQ,EAAC,CAAC;YACxB,IAAG,KAAK,CAAC,CAAC,KAAG,CAAC,IAAE,CAAC,MAAM,CAAC,OAAO,EAAC,KAAK,CAAC,KAAM,CAAC;gBAAC,MAAM,IAAI,mBAAmB,CAAC,WAAW,EAAC,gDAAgD,CAAC,CAAC;QAC5I,CAAC;aAAK,IAAG,CAAC,KAAK,CAAC,QAAS,CAAC,IAAI,CAAC,KAAK,CAAA,EAAE,CAAA,MAAM,CAAC,OAAO,EAAC,KAAK,CAAC,CAAC;YAAC,MAAM,IAAI,mBAAmB,CAAC,WAAW,EAAC,yCAAyC,CAAC,CAAC;IACpJ,CAAC,CAAC;IACF,MAAM,QAAQ,GAAiH;QAC7H,KAAK,EAAC,KAAK,IAAE,EAAE,GAAC,MAAM,EAAC,QAAQ,EAAC,GAAC,OAAO,EAAE,CAAC,CAAA,OAAO,EAAC,QAAQ,EAAC,eAAe,EAAC,UAAU,EAAC,iBAAiB,EAAC,KAAK,EAAC,QAAQ,CAAC,KAAK,EAAC,CAAC,CAAA,CAAC;QAChI,OAAO,EAAC,KAAK,IAAE,EAAE,CAAA,OAAO,EAAE;QAC1B,SAAS,EAAC,KAAK,EAAC,KAAK,EAAC,IAAI,EAAC,EAAE;YAC3B,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAAA,IAAI,CAAC,KAAK,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAClD,MAAM,OAAO,GAAC,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAC,KAAK,GAAC,OAAO,EAAE,CAAC;YACrE,IAAG,aAAa,CAAC,OAAO,CAAC,KAAG,aAAa,CAAC,0BAA0B,CAAC,KAAK,CAAC,QAAQ,EAAC,KAAK,CAAC,UAAU,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAAC,MAAM,IAAI,mBAAmB,CAAC,WAAW,EAAC,4DAA4D,CAAC,CAAC;YAC5N,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;YAAA,OAAO,CAAC,sBAAsB,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3E,OAAO,EAAC,GAAG,OAAO,EAAE,EAAC,OAAO,EAAC,EAAC,OAAO,EAAC,CAAC,EAAC,OAAO,EAAC,IAAI,CAAC,OAAO,EAAC,OAAO,EAAC,EAAC,CAAC;QACzE,CAAC;QACD,OAAO,EAAC,KAAK,EAAC,KAAK,EAAC,IAAI,EAAC,OAAO,EAAC,EAAE;YACjC,MAAM,WAAW,GAAC,IAAI,CAAC,WAAiC,EAAC,IAAI,GAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAAA,IAAI,CAAC,KAAK,EAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACzH,MAAM,KAAK,GAAC,OAAO,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC3D,0FAA0F;YAC1F,IAAG,KAAK,EAAC,CAAC;gBAAA,IAAG,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,KAAG,aAAa,CAAC,WAAW,CAAC;oBAAC,MAAM,IAAI,mBAAmB,CAAC,UAAU,EAAC,sDAAsD,CAAC,CAAC;gBAAA,OAAO,EAAC,GAAG,OAAO,EAAE,EAAC,QAAQ,EAAC,IAAI,EAAC,CAAC;YAAA,CAAC;YACjN,MAAM,eAAe,GAAC,GAAE,EAAE,GAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAA,IAAI,CAAC,KAAK,EAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAA,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAA,OAAO,CAAC,sBAAsB,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAA,OAAO,CAAC,0BAA0B,EAAE,CAAC,WAAW,CAAC,CAAC,CAAA,CAAC,CAAC;YACrN,IAAG,CAAC;gBAAA,eAAe,EAAE,CAAC;gBAAA,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,EAAC,IAAI,EAAC,WAAW,EAAC,SAAS,EAAC,eAAe,CAAC,CAAC;YAAA,CAAC;YAC5F,OAAM,KAAK,EAAC,CAAC;gBACX,sEAAsE;gBACtE,sEAAsE;gBACtE,IAAG,CAAC;oBAAA,MAAM,KAAK,GAAC,OAAO,EAAE,CAAC;oBAAA,IAAG,KAAK,CAAC,UAAU,CAAC,YAAY,KAAG,IAAI,IAAE,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;wBAAC,OAAO,CAAC,SAAS,GAAC,SAAS,CAAC;gBAAA,CAAC;gBAAA,MAAK,CAAC,CAAA,2BAA2B,CAAA,CAAC;gBAC7K,MAAM,KAAK,CAAC;YACd,CAAC;YACD,OAAO,OAAO,EAAE,CAAC;QACnB,CAAC;QACD,MAAM,EAAC,KAAK,EAAC,KAAK,EAAC,IAAI,EAAC,EAAE;YACxB,MAAM,UAAU,GAAC,IAAI,CAAC,UAA+B,EAAC,IAAI,GAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACrF,MAAM,KAAK,GAAC,OAAO,EAAE,EAAC,KAAK,GAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;YAC7E,IAAG,CAAC,KAAK;gBAAC,MAAM,IAAI,mBAAmB,CAAC,UAAU,EAAC,6BAA6B,CAAC,CAAC;YAAA,IAAI,CAAC,KAAK,EAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YACxH,IAAG,KAAK,CAAC,KAAK,KAAG,SAAS,EAAC,CAAC;gBAC1B,MAAM,OAAO,GAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,MAAM,CAAC,IAAI,KAAG,QAAQ,IAAE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,KAAG,UAAU,CAAC,SAAS,CAAC,CAAC;gBACnH,IAAG,OAAO,IAAE,OAAO,CAAC,MAAM,CAAC,IAAI,KAAG,QAAQ,IAAE,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,KAAG,aAAa,CAAC,UAAU,CAAC,EAAC,CAAC;oBAChH,IAAG,KAAK,CAAC,QAAQ,CAAC,MAAM;wBAAC,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,EAAC,IAAI,EAAC,UAAU,CAAC,CAAC;oBAClE,OAAO,EAAC,GAAG,OAAO,EAAE,EAAC,QAAQ,EAAC,IAAI,EAAC,CAAC;gBACtC,CAAC;gBACD,MAAM,IAAI,mBAAmB,CAAC,UAAU,EAAC,0CAA0C,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,EAAC,IAAI,EAAC,UAAU,CAAC,CAAC;YAAA,OAAO,OAAO,EAAE,CAAC;QAC5D,CAAC;QACD,KAAK,EAAC,KAAK,EAAC,KAAK,EAAC,IAAI,EAAC,EAAE;YACvB,MAAM,KAAK,GAAC,IAAI,CAAC,KAAmB,EAAC,IAAI,GAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAAA,IAAI,CAAC,KAAK,EAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAChG,IAAG,KAAK,EAAE,OAAO,KAAG,CAAC,IAAE,KAAK,CAAC,IAAI,KAAG,QAAQ;gBAAC,MAAM,IAAI,mBAAmB,CAAC,WAAW,EAAC,8DAA8D,CAAC,CAAC;YACvJ,MAAM,WAAW,GAAC,GAAE,EAAE;gBACpB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,IAAI,CAAC,KAAK,EAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;gBAAA,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;gBAAA,OAAO,CAAC,sBAAsB,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;gBAAA,OAAO,CAAC,oBAAoB,EAAE,CAAC,KAAK,CAAC,CAAC;gBAChJ,IAAG,KAAK,EAAE,EAAE,IAAE,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;oBAAC,MAAM,IAAI,mBAAmB,CAAC,WAAW,EAAC,sDAAsD,CAAC,CAAC;YAC5I,CAAC,CAAC;YACF,WAAW,EAAE,CAAC;YAAA,MAAM,MAAM,CAAC,aAAa,CAAC,GAAG,EAAC,IAAI,EAAC,KAAK,EAAC,SAAS,EAAC,WAAW,CAAC,CAAC;YAAA,WAAW,EAAE,CAAC;YAC7F,MAAM,QAAQ,GAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YACxE,MAAM,KAAK,GAAC,eAAe,CAAC,MAAM,EAAC,EAAC,CAAC,EAAC,KAAK,CAAC,SAAS,CAAA,CAAC,CAAA,CAAC,CAAA,CAAC,CAAA,CAAC,EAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAA,CAAC,CAAA,EAAC,SAAS,EAAC,KAAK,CAAC,SAAS,EAAC,CAAA,CAAC,CAAA,EAAE,CAAC,EAAC,GAAG,EAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAC,IAAI,EAAC,OAAO,EAAC,KAAK,EAAC,KAAK,CAAC,EAAE,EAAC,KAAK,EAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,EAAC,QAAQ,EAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,EAAE,CAAC,EAAC,GAAG,EAAC,QAAQ,EAAC,CAAC,CAAC;YACvP,OAAO,EAAC,GAAG,OAAO,EAAE,EAAC,KAAK,EAAC,KAAK,EAAC,CAAC;QACpC,CAAC;QACD,MAAM,EAAC,KAAK,EAAC,KAAK,EAAC,IAAI,EAAC,EAAE;YACxB,IAAG,KAAK,CAAC,IAAI,KAAG,QAAQ;gBAAC,MAAM,IAAI,mBAAmB,CAAC,WAAW,EAAC,2CAA2C,CAAC,CAAC;YAChH,MAAM,KAAK,GAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAC,MAAM,GAAC,OAAO,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,KAAK,CAAC,EAAE,KAAG,KAAK,CAAC,CAAC;YAAA,IAAG,CAAC,MAAM;gBAAC,MAAM,IAAI,mBAAmB,CAAC,UAAU,EAAC,sBAAsB,CAAC,CAAC;YAChL,IAAI,CAAC,KAAK,EAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAAA,OAAO,EAAC,KAAK,EAAC,KAAK,EAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAC,CAAC;QAC7E,CAAC;KACF,CAAC;IACF,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAC,GAAG,EAAC,EAAE;QAClC,MAAM,KAAK,GAAC,CAAC,MAAa,EAAC,KAAa,EAAC,EAAE,GAAC,MAAM,GAAG,GAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA,GAAG,CAAC,SAAS,CAAC,MAAM,EAAC,EAAC,cAAc,EAAC,kBAAkB,EAAC,eAAe,EAAC,UAAU,EAAC,CAAC,CAAC,CAAA,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA,CAAC,CAAC;QAChL,MAAM,EAAE,GAAC,CAAC,GAAG,CAAC,GAAG,IAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAC,EAAE,CAAC,CAAC;QAC7C,IAAG,GAAG,CAAC,MAAM,KAAG,MAAM,IAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAC,EAAE,CAAC,EAAC,CAAC;YAAA,KAAK,CAAC,GAAG,EAAC,EAAC,EAAE,EAAC,KAAK,EAAC,IAAI,EAAC,SAAS,EAAC,OAAO,EAAC,2BAA2B,EAAC,CAAC,CAAC;YAAA,OAAO;QAAA,CAAC;QACtI,MAAM,MAAM,GAAU,EAAE,CAAC;QAAA,IAAI,IAAI,GAAC,CAAC,CAAC;QACpC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAC,CAAC,KAAY,EAAC,EAAE,GAAC,IAAI,IAAE,KAAK,CAAC,MAAM,CAAC,CAAA,IAAG,IAAI,GAAC,wBAAwB,EAAC,CAAC;YAAA,KAAK,CAAC,GAAG,EAAC,EAAC,EAAE,EAAC,KAAK,EAAC,IAAI,EAAC,OAAO,EAAC,OAAO,EAAC,8BAA8B,EAAC,CAAC,CAAC;YAAA,GAAG,CAAC,OAAO,EAAE,CAAC;QAAA,CAAC;;YAAK,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC;QACxM,GAAG,CAAC,EAAE,CAAC,KAAK,EAAC,GAAE,EAAE;YAAC,KAAK,CAAC,KAAK,IAAE,EAAE;gBAC/B,MAAM,OAAO,GAAkB,EAAC,SAAS,EAAC,SAAS,EAAC,CAAC;gBACrD,IAAG,CAAC;oBACF,MAAM,KAAK,GAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAAA,IAAI,IAAY,CAAC;oBAAA,IAAG,CAAC;wBAAA,IAAI,GAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAE,IAAI,CAAC,CAAC;oBAAA,CAAC;oBAAA,MAAK,CAAC;wBAAA,MAAM,IAAI,mBAAmB,CAAC,SAAS,EAAC,6BAA6B,CAAC,CAAC;oBAAA,CAAC;oBAC1L,IAAG,CAAC,IAAI,IAAE,OAAO,IAAI,KAAG,QAAQ,IAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;wBAAC,MAAM,IAAI,mBAAmB,CAAC,SAAS,EAAC,mCAAmC,CAAC,CAAC;oBACnI,KAAK,CAAC,GAAG,EAAC,EAAC,EAAE,EAAC,IAAI,EAAC,GAAG,CAAC,MAAM,QAAQ,CAAC,EAAE,CAAE,CAAC,KAAK,EAAC,IAA8B,EAAC,OAAO,CAAC,CAAW,EAAC,CAAC,CAAC;gBACxG,CAAC;gBAAA,OAAM,KAAK,EAAC,CAAC;oBACZ,wFAAwF;oBACxF,IAAG,KAAK,YAAY,mBAAmB;wBAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAC,EAAC,EAAE,EAAC,KAAK,EAAC,IAAI,EAAC,KAAK,CAAC,IAAI,EAAC,OAAO,EAAC,KAAK,CAAC,OAAO,EAAC,GAAG,CAAC,EAAE,KAAG,SAAS,CAAA,CAAC,CAAA,OAAO,CAAA,CAAC,CAAA,EAAE,CAAC,EAAC,CAAC,CAAC;;wBAC7I,KAAK,CAAC,GAAG,EAAC,EAAC,EAAE,EAAC,KAAK,EAAC,IAAI,EAAC,aAAa,EAAC,OAAO,EAAC,mDAAmD,EAAC,CAAC,CAAC;gBAC5G,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;QAAA,CAAC,CAAC,CAAC;IACV,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/execution/ledger-tunnel.d.ts

@@ -0,0 +1,50 @@
+import { Readable, Writable } from 'node:stream';
+export declare const LEDGER_TUNNEL_CAPABILITY: Readonly<{
+    version: 1;
+    transport: "http-exec-v1";
+    tokenVersion: 2;
+    role: "child";
+    replay: false;
+}>;
+/** Supplied by the trusted dispatch owner from the original admitted credential.
+ * Decoding claims adds restrictions; only the native ledger verifies authority.
+ */
+export interface LedgerTunnelBinding {
+    version: 1;
+    credentialSha256: string;
+    runId: string;
+    grantId: string;
+    authority: string;
+    deadline: number;
+}
+interface TunnelOptions {
+    input: Readable;
+    output: Writable;
+    binding: LedgerTunnelBinding;
+    signal?: AbortSignal;
+    /** Bounds a request and loss-of-owner detection, including stalled stream writes. */
+    timeoutMs?: number;
+}
+export interface LedgerTunnelHandle {
+    close: () => Promise<void>;
+    closed: Promise<void>;
+}
+/** Owner side: accepts HTTP only on the injected private stream. ledgerUrl must
+ * come from the owned prepareReviewedLedger listener, never from a task/model.
+ * The host rechecks its authenticated task/placement lease through assertConnection.
+ */
+export declare function attachLedgerTunnel(options: TunnelOptions & {
+    ledgerUrl: string;
+    assertConnection: () => void;
+}): LedgerTunnelHandle;
+/** Task side: caller must pin the original port and binding before launch. A
+ * conflict never selects another port. Reconnect uses the same token/checkpoint;
+ * it is a new authenticated stream, not a new allowance or token enrollment.
+ */
+export declare function listenLedgerTunnel(options: TunnelOptions & {
+    port: number;
+}): Promise<LedgerTunnelHandle & {
+    url: string;
+}>;
+export {};
+//# sourceMappingURL=ledger-tunnel.d.ts.map

package/dist/execution/ledger-tunnel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger-tunnel.d.ts","sourceRoot":"","sources":["../../src/execution/ledger-tunnel.ts"],"names":[],"mappings":"AAQA,OAAO,EAAkB,QAAQ,EAAC,QAAQ,EAAC,MAAM,aAAa,CAAC;AAS/D,eAAO,MAAM,wBAAwB;;;;;;EAA6F,CAAC;AAQnI;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAC,CAAC,CAAC;IAAA,gBAAgB,EAAC,MAAM,CAAC;IAAA,KAAK,EAAC,MAAM,CAAC;IAAA,OAAO,EAAC,MAAM,CAAC;IAAA,SAAS,EAAC,MAAM,CAAC;IAAA,QAAQ,EAAC,MAAM,CAAC;CAChG;AACD,UAAU,aAAa;IACrB,KAAK,EAAC,QAAQ,CAAC;IAAA,MAAM,EAAC,QAAQ,CAAC;IAAA,OAAO,EAAC,mBAAmB,CAAC;IAAA,MAAM,CAAC,EAAC,WAAW,CAAC;IAC/E,qFAAqF;IACrF,SAAS,CAAC,EAAC,MAAM,CAAC;CACnB;AACD,MAAM,WAAW,kBAAkB;IAAE,KAAK,EAAC,MAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAAA,MAAM,EAAC,OAAO,CAAC,IAAI,CAAC,CAAA;CAAC;AAoFlF;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAC,aAAa,GAAC;IAAC,SAAS,EAAC,MAAM,CAAC;IAAA,gBAAgB,EAAC,MAAI,IAAI,CAAA;CAAC,GAAE,kBAAkB,CAkCxH;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAC,aAAa,GAAC;IAAC,IAAI,EAAC,MAAM,CAAA;CAAC,GAAE,OAAO,CAAC,kBAAkB,GAAC;IAAC,GAAG,EAAC,MAAM,CAAA;CAAC,CAAC,CAwCrH"}