@cotal-ai/auth 0.0.0 → 0.11.0

package/dist/commands.js

@@ -0,0 +1,359 @@
+/**
+ * Self-registering `login` / `logout` commands (the delivery-daemon pattern): importing
+ * `@cotal-ai/auth` registers them into the core `Registry`, and the `cotal` binary pulls the
+ * package in at its composition root. Session state lives under the workspace's `homeCotalDir()`
+ * (`~/.cotal`, `COTAL_HOME`-overridable) — per human, per machine, NOT per checkout: you are
+ * logged in as YOU across every repo on this box.
+ */
+import { readFileSync, writeFileSync } from "node:fs";
+import { CotalEndpoint, mintCreds, newIdentity, registry } from "@cotal-ai/core";
+import { authDir, CLI_USER_ACTOR, findCotalRoot, homeCotalDir, loadMeshes, loadSpaceAuth, resolveSpace, userAuthStateDir } from "@cotal-ai/workspace";
+import { deleteIdpSession, establishIdpSession, loadIdpSession, normalizeIdpUrl, revokeIdpSession, } from "./login.js";
+import { deriveOwnerForIdpSubject } from "./derive.js";
+import { findManagedActor, grantActor, loadActorLedger, revokeActor } from "./ledger.js";
+import { runAuthService } from "./service.js";
+import { loadAuthServiceInfo, loadOwnerSecret, loadPinnedIdp } from "./store.js";
+const DEFAULT_CLIENT_ID = "cotal-cli";
+/** Every operational failure in these commands is a deliberately-legible thrown sentence
+ *  (a refused client id, a revoked session, a malformed IdP response …) — the CLI's generic
+ *  catch would re-throw it into a raw stack trace. Print the sentence, exit 1. */
+async function legibly(fn) {
+    try {
+        await fn();
+    }
+    catch (e) {
+        console.error(e instanceof Error ? e.message : String(e));
+        process.exit(1);
+    }
+}
+async function runLogin(args) {
+    const values = args.values;
+    if (!values.idp) {
+        console.error("usage: cotal login --idp <auth base URL> [--client-id <id>]   (Better Auth: <origin>/api/auth)");
+        process.exit(1);
+    }
+    const idpArg = values.idp;
+    await legibly(async () => {
+        const idp = normalizeIdpUrl(idpArg);
+        // establishIdpSession proves the session mints user JWTs BEFORE persisting it — a failed
+        // proof leaves no cache entry to fool requireIdpSession later.
+        const { session, sub, label } = await establishIdpSession({
+            dir: homeCotalDir(),
+            idpUrl: idp,
+            clientId: values["client-id"] ?? DEFAULT_CLIENT_ID,
+            onPrompt: (p) => {
+                console.log(`\nTo approve this sign-in, open:\n\n    ${p.verificationUriComplete}\n`);
+                console.log(`(or go to ${p.verificationUri} and enter the code ${p.userCode})\n`);
+                console.log(`Waiting for approval - the code expires in ${Math.ceil(p.expiresInSec / 60)} min. Ctrl-C to abort.`);
+            },
+        });
+        // WHO signed in must be human-readable (per-user auth exists for operator-visible identity):
+        // prefer the IdP's email/name claim; the raw `sub` stays as the stable id (dim when secondary).
+        const who = label ? `${label} (${sub})` : sub;
+        console.log(`\nLogged in to ${idp} as ${who}. Session cached in ${homeCotalDir()} until ${new Date(session.expiresAt * 1000).toISOString()}.`);
+        // Signing in proves WHO you are; each mesh separately lets you in. Hand the human the exact
+        // next step — their sub is the one thing the operator needs from them.
+        console.log(`Not yet on a mesh? Its operator lets you in with: cotal actor grant ${CLI_USER_ACTOR} --sub ${sub}   (that's the full grant - all channels, may spawn; narrow with --allow-subscribe/--allow-publish/--scope)`);
+    });
+}
+async function runLogout(args) {
+    const values = args.values;
+    if (!values.idp) {
+        console.error("usage: cotal logout --idp <auth base URL>");
+        process.exit(1);
+    }
+    const idpArg = values.idp;
+    await legibly(async () => {
+        const idp = normalizeIdpUrl(idpArg);
+        const dir = homeCotalDir();
+        const session = loadIdpSession(dir, idp);
+        if (!session) {
+            console.log(`not logged in to ${idp} - nothing to clear`);
+            return;
+        }
+        try {
+            await revokeIdpSession(idp, session.token);
+        }
+        catch (e) {
+            // KEEP the local session on a failed revoke: the cached token is the only handle that can
+            // retry the revoke from the CLI, and a still-live server-side session that can no longer be
+            // revoked is worse than a lingering local cache. Fail loud with the recourse; the operator
+            // re-runs `cotal logout`.
+            throw new Error(`could not revoke the server-side session at ${idp} (${e instanceof Error ? e.message : String(e)}). ` +
+                `Your local login is kept so you can retry \`cotal logout --idp ${idp}\`; if it keeps failing, revoke the session from the IdP directly.`);
+        }
+        deleteIdpSession(dir, idp);
+        console.log(`Logged out of ${idp} - server-side session revoked, local cache cleared.`);
+    });
+}
+/** The space-scoped provider state dir the `actor` commands operate on (`userAuthStateDir` — the
+ *  multi-space-ready layout; nothing user-auth lives flat in `.cotal/auth/`). */
+function actorStateDir(space) {
+    const s = space ?? resolveSpace(process.cwd());
+    return { dir: userAuthStateDir(findCotalRoot(), s), space: s };
+}
+/** Resolve the operator's target (owner) for `actor grant`/`revoke`: an explicit derived `--owner`
+ *  token, or `--sub` (the IdP subject `cotal login` prints) derived through the SAME frozen encoding
+ *  the bridge exchange uses. BOTH require the space's owner secret + IdP pin under `dir` — i.e. this
+ *  IS the machine that ran `cotal up --user-auth`, where the authoritative ledger lives. Without
+ *  them a grant would write an INERT LOCAL row and print a misleading success while the mesh's real
+ *  ledger is untouched (an off-machine `--owner` cannot mutate authority), so we refuse instead. */
+function resolveGrantOwner(dir, values) {
+    if (values.owner && values.sub)
+        throw new Error("pass --owner OR --sub, not both");
+    if (!values.owner && !values.sub)
+        throw new Error("say who: --sub <IdP subject> (shown by `cotal login`) or --owner <u_…>");
+    const secret = loadOwnerSecret(dir);
+    const idp = loadPinnedIdp(dir);
+    if (!secret || !idp)
+        throw new Error(`user auth is not enabled for this space here (no owner secret/IdP pin under ${dir}). The actor ledger lives on the machine that ran \`cotal up --user-auth --idp <url>\`; run the \`actor\` commands there`);
+    if (values.owner)
+        return values.owner;
+    return deriveOwnerForIdpSubject(secret, idp.issuer, values.sub);
+}
+const csv = (s, dflt) => s === undefined ? dflt : s.split(",").map((x) => x.trim()).filter(Boolean);
+/** Close a revoked principal's LIVE window (D5 acceptance gate: removal stops live delivery
+ *  IMMEDIATELY, not at bearer expiry): mint an ephemeral supervisor cred from the local signer and
+ *  request the delivery daemon's `evictPrincipal` (privileged delivery-admin rail — scan→KICK→
+ *  verify). BEST-EFFORT with honest copy: deny-new is already committed by the ledger revoke
+ *  before this runs, so a missing daemon/signer/registry only widens the end back to the bearer's
+ *  own expiry — reported, never silent, and never a reason to fail the revoke. */
+async function evictRevokedPrincipal(space, principal) {
+    const fallback = (why) => `live-connection eviction skipped (${why}) - deny-new is committed and the revoke cannot be re-run; the already-open connection ends at its current bearer's expiry. To evict live connections at revoke time, run \`cotal actor revoke\` from the mesh root (local signer + registry).`;
+    const root = findCotalRoot();
+    const auth = loadSpaceAuth(authDir(root));
+    if (!auth)
+        return fallback("no local signer here");
+    const mesh = loadMeshes().find((m) => m.space === space);
+    if (!mesh)
+        return fallback("mesh not in the local registry");
+    const id = newIdentity();
+    const ep = new CotalEndpoint({
+        space,
+        servers: mesh.server,
+        creds: await mintCreds(auth, id, "supervisor"),
+        card: { id: id.id, name: "revoke-evict", kind: "endpoint" },
+        channels: [],
+        consume: false,
+        watchChannels: false,
+        watchPresence: false,
+        registerPresence: false,
+    });
+    ep.on("error", () => { });
+    try {
+        await ep.start();
+        const r = await ep.requestDeliveryAdmin("evictPrincipal", { principal }, 15_000);
+        if (!r.ok)
+            return `live-connection eviction refused: ${r.error}`;
+        const d = (r.data ?? {});
+        return d.verifiedGone
+            ? `live connections closed now (${d.kicked ?? 0} kicked, verified gone)`
+            : `live-connection eviction INCOMPLETE (${d.kicked ?? 0} kicked, ${d.remaining ?? "?"} still live) - run \`cotal doctor auth\``;
+    }
+    catch (e) {
+        return fallback(e instanceof Error ? e.message : String(e));
+    }
+    finally {
+        await ep.stop().catch(() => { });
+    }
+}
+async function runActor(args) {
+    const [sub, actor] = args.positionals;
+    const values = args.values;
+    const { dir, space } = actorStateDir(values.space);
+    await legibly(async () => {
+        if (sub === "list") {
+            const rows = loadActorLedger(dir);
+            if (!rows.length) {
+                console.log("no actors granted - grant one with: cotal actor grant <actor> --sub <IdP subject>");
+                return;
+            }
+            for (const r of rows.sort((a, b) => (a.owner + a.actor).localeCompare(b.owner + b.actor)))
+                console.log(`${r.owner}.${r.actor}${r.label ? `  (${r.label})` : ""}  kind=${r.kind}  role=${r.role ?? "-"}  scope=[${r.scope.join(",")}]  read=[${r.allowSubscribe.join(",")}]  post=[${r.allowPublish.join(",")}]`);
+            return;
+        }
+        if (sub === "grant") {
+            if (!actor)
+                throw new Error("usage: cotal actor grant <actor> --sub <IdP subject> [--scope a,b] [--allow-subscribe a,b] [--allow-publish a,b] [--role r] [--label l]");
+            const owner = resolveGrantOwner(dir, values);
+            // Default = the FULL grant (all channels, spawn + the stock role): `actor grant` is an
+            // operator act of letting a user in, so omitting flags means "fully", and narrowing is the
+            // explicit choice (`--allow-subscribe general --scope ''`). The user's agents are still
+            // attenuated from whatever this row says (the envelope rule).
+            const row = grantActor(dir, {
+                owner,
+                actor,
+                scope: csv(values.scope, ["spawn", "role:default"]),
+                allowSubscribe: csv(values["allow-subscribe"], [">"]),
+                allowPublish: csv(values["allow-publish"], [">"]),
+                ...(values.role ? { role: values.role } : {}),
+                ...(values.label ? { label: values.label } : {}),
+                ...(values.parent ? { parent: values.parent } : {}),
+            });
+            console.log(`✓ granted ${row.owner}.${row.actor} - read [${row.allowSubscribe.join(", ")}], post [${row.allowPublish.join(", ")}]${row.scope.length ? `, scope [${row.scope.join(", ")}]` : ""}`);
+            return;
+        }
+        if (sub === "revoke") {
+            if (!actor)
+                throw new Error("usage: cotal actor revoke <actor> --sub <IdP subject>|--owner <u_…>");
+            const owner = resolveGrantOwner(dir, values);
+            if (!revokeActor(dir, owner, actor)) {
+                if (findManagedActor(dir, owner, actor))
+                    throw new Error(`${owner}.${actor} is a managed agent - its grant lives with its process: stop it if manager-owned (\`cotal stop --name ${actor}\`), or if it was a killed foreground spawn, respawn the same name (\`cotal spawn\`) to rotate the grant`);
+                console.log(`no grant for ${owner}.${actor} - nothing to revoke`);
+                return;
+            }
+            // Deny-new is immediate at both boundaries (exchange + connect). The LIVE window no longer
+            // rides the bearer's expiry by default: the flip wires revoke → the delivery daemon's
+            // evictPrincipal (scan→KICK→verify on the privileged rail), best-effort with honest copy —
+            // a human bearer can otherwise carry up to the IdP session cap, far beyond the agents' TTL.
+            console.log(`✓ revoked ${owner}.${actor} - new exchanges and new connects are denied now`);
+            console.log(`  ${await evictRevokedPrincipal(space, `${owner}.${actor}`)}`);
+            return;
+        }
+        throw new Error("usage: cotal actor <grant <actor> | revoke <actor> | list>");
+    });
+}
+/** `cotal agent-bearer` — the ONE thing a spawned user-mode agent execs to refresh its auth: read
+ *  its spawn-time secret from the 0600 token file, exchange it at the space's auth service (agent
+ *  grant type), print the fresh bearer to STDOUT, exit. Machine-facing: stdout carries the bearer
+ *  and NOTHING else; every failure is a stderr sentence + exit 1 (the endpoint surfaces it as a
+ *  loud "error" event and retries). The secret rides a file, never argv (ps-visible) or env. */
+async function runAgentBearer(args) {
+    const v = args.values;
+    const { dir, space, owner, actor } = v;
+    const tokenFile = v["token-file"];
+    if (!dir || !space || !owner || !actor || !tokenFile)
+        throw new Error("usage: cotal agent-bearer --dir <state-dir> --space <s> --owner <u_…> --actor <a> --token-file <path> [--health-file <path>]");
+    // Every attempt's outcome lands in the manager-composed health file (core's AgentAuthHealth) —
+    // the `ps` window into a detached agent's bearer life. Best-effort: health reporting must never
+    // turn a successful exchange into a failure.
+    const health = (state, reason) => {
+        const path = v["health-file"];
+        if (!path)
+            return;
+        try {
+            writeFileSync(path, JSON.stringify({ state, at: new Date().toISOString(), ...(reason ? { reason } : {}) }));
+        }
+        catch { /* the exchange outcome still stands */ }
+    };
+    try {
+        let actorToken;
+        try {
+            actorToken = readFileSync(tokenFile, "utf8").trim();
+        }
+        catch (e) {
+            throw new Error(`agent-bearer: can't read the actor token file at ${tokenFile} (${e instanceof Error ? e.message : String(e)}) - respawn this agent to re-provision it`);
+        }
+        const info = loadAuthServiceInfo(dir);
+        const alive = (pid) => { try {
+            process.kill(pid, 0);
+            return true;
+        }
+        catch {
+            return false;
+        } };
+        if (!info || !alive(info.pid))
+            throw new Error(`agent-bearer: the user-auth service for space "${space}" is not running - restart it with \`cotal up\``);
+        let res;
+        try {
+            res = await fetch(`${info.url}/exchange`, {
+                method: "POST",
+                headers: { "content-type": "application/json", authorization: `Bearer ${info.cap}` },
+                body: JSON.stringify({ owner, actor, actorToken }),
+                signal: AbortSignal.timeout(15_000),
+            });
+        }
+        catch (e) {
+            throw new Error(`agent-bearer: the user-auth service did not answer at ${info.url} (${e instanceof Error ? e.message : String(e)}) - restart it with \`cotal up\``);
+        }
+        if (!res.ok) {
+            const body = (await res.json().catch(() => ({})));
+            throw new Error(`agent-bearer: exchange refused: ${body.error ?? `HTTP ${res.status}`}`);
+        }
+        const out = (await res.json().catch(() => ({})));
+        if (typeof out.token !== "string" || !out.token)
+            throw new Error("agent-bearer: the auth service's exchange returned no token - its build may be stale; restart it with `cotal up`");
+        health("ok");
+        process.stdout.write(`${out.token}\n`);
+    }
+    catch (e) {
+        health("failed", e instanceof Error ? e.message : String(e));
+        throw e;
+    }
+}
+const authCommands = [
+    {
+        kind: "command",
+        name: "auth-service",
+        group: "Manager",
+        summary: "run the user-auth service daemon - NATS auth callout + token exchange/JWKS --space <s> --server <url> [--port <n>]",
+        flags: [
+            { name: "space", type: "string", value: "<s>", description: "space to serve (required)" },
+            { name: "server", type: "string", value: "<url>", description: "broker URL the callout serves (required)" },
+            { name: "port", type: "string", value: "<n>", description: "loopback HTTP port for /exchange + /jwks (default: ephemeral)" },
+        ],
+        run: (args) => legibly(() => runAuthService(args)),
+    },
+    {
+        kind: "command",
+        name: "actor",
+        group: "Identity",
+        summary: "manage the space's actor ledger - grant/revoke which (user, actor) pairs may run agents",
+        usage: "actor <grant <actor> | revoke <actor> | list> [--sub <IdP subject>|--owner <u_…>] [--space <s>] [--scope a,b] [--allow-subscribe a,b] [--allow-publish a,b] [--role r] [--label l]",
+        positionals: "<grant <actor> | revoke <actor> | list>",
+        flags: [
+            { name: "space", type: "string", value: "<s>", description: "space whose ledger to manage (default: the folder's)" },
+            { name: "sub", type: "string", value: "<subject>", description: "the IdP subject (shown by `cotal login`) the actor belongs to" },
+            { name: "owner", type: "string", value: "<u_…>", description: "the derived owner token (alternative to --sub)" },
+            { name: "scope", type: "string", value: "<a,b>", description: "capability scope for the bearer (default: spawn,role:default; '' = none; spawn = may run agents, role:<r> = may delegate role r)" },
+            { name: "allow-subscribe", type: "string", value: "<a,b>", description: "channel read ACL (default: > = all channels) - the user's envelope: their agents can never read beyond it" },
+            { name: "allow-publish", type: "string", value: "<a,b>", description: "channel post ACL (default: > = all channels) - also the envelope for their agents' posting" },
+            { name: "role", type: "string", value: "<r>", description: "role (scopes the task-queue consumer)" },
+            { name: "label", type: "string", value: "<l>", description: "display label for `actor list` (never the IdP subject)" },
+            { name: "parent", type: "string", value: "<owner.actor>", description: "spawning principal audit link (operator grants are authority - this does not attenuate)" },
+        ],
+        run: runActor,
+    },
+    {
+        kind: "command",
+        name: "agent-bearer",
+        group: "Manager",
+        summary: "print one fresh agent bearer for a spawned user-mode agent (machine-facing; exec'd by agent endpoints)",
+        usage: "agent-bearer --dir <state-dir> --space <s> --owner <u_…> --actor <a> --token-file <path>",
+        flags: [
+            { name: "dir", type: "string", value: "<state-dir>", description: "the space's user-auth state dir" },
+            { name: "space", type: "string", value: "<s>", description: "the space the bearer is scoped to" },
+            { name: "owner", type: "string", value: "<u_…>", description: "the agent's owner token" },
+            { name: "actor", type: "string", value: "<a>", description: "the agent's actor token" },
+            { name: "token-file", type: "string", value: "<path>", description: "0600 file holding the spawn-time agent secret" },
+            { name: "health-file", type: "string", value: "<path>", description: "write each attempt's outcome here (read by the manager's ps)" },
+        ],
+        run: (args) => legibly(() => runAgentBearer(args)),
+    },
+    {
+        kind: "command",
+        name: "login",
+        group: "Identity",
+        summary: "sign in to a space's IdP (device code) and cache the session --idp <auth base URL> [--client-id <id>]",
+        usage: "login --idp <auth base URL> [--client-id <id>]",
+        flags: [
+            { name: "idp", type: "string", value: "<auth base URL>", description: "Auth base URL, e.g. <origin>/api/auth" },
+            { name: "client-id", type: "string", value: "<id>", description: "OAuth device-flow client id" },
+        ],
+        run: runLogin,
+    },
+    {
+        kind: "command",
+        name: "logout",
+        group: "Identity",
+        summary: "revoke the IdP session and clear the cached login --idp <auth base URL>",
+        usage: "logout --idp <auth base URL>",
+        flags: [
+            { name: "idp", type: "string", value: "<auth base URL>", description: "Auth base URL, e.g. <origin>/api/auth" },
+        ],
+        run: runLogout,
+    },
+];
+registry.register(...authCommands);
+//# sourceMappingURL=commands.js.map

package/dist/commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../src/commands.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAiC,MAAM,gBAAgB,CAAC;AAChH,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAwB,MAAM,qBAAqB,CAAC;AAC5K,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACzF,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEjF,MAAM,iBAAiB,GAAG,WAAW,CAAC;AAEtC;;kFAEkF;AAClF,KAAK,UAAU,OAAO,CAAC,EAAuB;IAC5C,IAAI,CAAC;QACH,MAAM,EAAE,EAAE,CAAC;IACb,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAgB;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAgD,CAAC;IACrE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,gGAAgG,CAAC,CAAC;QAChH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC;IAC1B,MAAM,OAAO,CAAC,KAAK,IAAI,EAAE;QACvB,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QACpC,yFAAyF;QACzF,+DAA+D;QAC/D,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,MAAM,mBAAmB,CAAC;YACxD,GAAG,EAAE,YAAY,EAAE;YACnB,MAAM,EAAE,GAAG;YACX,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,iBAAiB;YAClD,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE;gBACd,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC,uBAAuB,IAAI,CAAC,CAAC;gBACtF,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,eAAe,uBAAuB,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC;gBAClF,OAAO,CAAC,GAAG,CAAC,8CAA8C,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,GAAG,EAAE,CAAC,wBAAwB,CAAC,CAAC;YACpH,CAAC;SACF,CAAC,CAAC;QACH,6FAA6F;QAC7F,gGAAgG;QAChG,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAC9C,OAAO,CAAC,GAAG,CACT,kBAAkB,GAAG,OAAO,GAAG,uBAAuB,YAAY,EAAE,UAAU,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,GAAG,CAClI,CAAC;QACF,4FAA4F;QAC5F,uEAAuE;QACvE,OAAO,CAAC,GAAG,CACT,uEAAuE,cAAc,UAAU,GAAG,6GAA6G,CAChN,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAgB;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,MAA0B,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC;IAC1B,MAAM,OAAO,CAAC,KAAK,IAAI,EAAE;QACvB,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,qBAAqB,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,0FAA0F;YAC1F,4FAA4F;YAC5F,2FAA2F;YAC3F,0BAA0B;YAC1B,MAAM,IAAI,KAAK,CACb,+CAA+C,GAAG,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;gBACpG,kEAAkE,GAAG,oEAAoE,CAC5I,CAAC;QACJ,CAAC;QACD,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,iBAAiB,GAAG,sDAAsD,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;AACL,CAAC;AAED;iFACiF;AACjF,SAAS,aAAa,CAAC,KAAc;IACnC,MAAM,CAAC,GAAG,KAAK,IAAI,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/C,OAAO,EAAE,GAAG,EAAE,gBAAgB,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AACjE,CAAC;AAED;;;;;oGAKoG;AACpG,SAAS,iBAAiB,CAAC,GAAW,EAAE,MAAwC;IAC9E,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACnF,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC5H,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG;QACjB,MAAM,IAAI,KAAK,CACb,+EAA+E,GAAG,0HAA0H,CAC7M,CAAC;IACJ,IAAI,MAAM,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC;IACtC,OAAO,wBAAwB,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAI,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,CAAqB,EAAE,IAAc,EAAY,EAAE,CAC9D,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAE7E;;;;;kFAKkF;AAClF,KAAK,UAAU,qBAAqB,CAAC,KAAa,EAAE,SAAiB;IACnE,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAE,EAAE,CAC/B,qCAAqC,GAAG,gPAAgP,CAAC;IAC3R,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI;QAAE,OAAO,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IACzD,IAAI,CAAC,IAAI;QAAE,OAAO,QAAQ,CAAC,gCAAgC,CAAC,CAAC;IAC7D,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;IACzB,MAAM,EAAE,GAAG,IAAI,aAAa,CAAC;QAC3B,KAAK;QACL,OAAO,EAAE,IAAI,CAAC,MAAM;QACpB,KAAK,EAAE,MAAM,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,YAAY,CAAC;QAC9C,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE;QAC3D,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,KAAK;QACd,aAAa,EAAE,KAAK;QACpB,aAAa,EAAE,KAAK;QACpB,gBAAgB,EAAE,KAAK;KACxB,CAAC,CAAC;IACH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,oBAAoB,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;QACjF,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,qCAAqC,CAAC,CAAC,KAAK,EAAE,CAAC;QACjE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAoE,CAAC;QAC5F,OAAO,CAAC,CAAC,YAAY;YACnB,CAAC,CAAC,gCAAgC,CAAC,CAAC,MAAM,IAAI,CAAC,yBAAyB;YACxE,CAAC,CAAC,wCAAwC,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,SAAS,IAAI,GAAG,0CAA0C,CAAC;IACpI,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,QAAQ,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAgB;IACtC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,MAGnB,CAAC;IACF,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnD,MAAM,OAAO,CAAC,KAAK,IAAI,EAAE;QACvB,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACnB,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACjB,OAAO,CAAC,GAAG,CAAC,mFAAmF,CAAC,CAAC;gBACjG,OAAO;YACT,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;gBACvF,OAAO,CAAC,GAAG,CACT,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,IAAI,IAAI,GAAG,YAAY,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CACzM,CAAC;YACJ,OAAO;QACT,CAAC;QACD,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACpB,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,yIAAyI,CAAC,CAAC;YACvK,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAC7C,uFAAuF;YACvF,2FAA2F;YAC3F,wFAAwF;YACxF,8DAA8D;YAC9D,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC1B,KAAK;gBACL,KAAK;gBACL,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;gBACnD,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;gBACrD,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;gBACjD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpD,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,YAAY,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClM,OAAO;QACT,CAAC;QACD,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrB,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;YACnG,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAC7C,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;gBACpC,IAAI,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC;oBACrC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,KAAK,yGAAyG,KAAK,0GAA0G,CAAC,CAAC;gBAC7P,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,IAAI,KAAK,sBAAsB,CAAC,CAAC;gBAClE,OAAO;YACT,CAAC;YACD,2FAA2F;YAC3F,sFAAsF;YACtF,2FAA2F;YAC3F,4FAA4F;YAC5F,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,IAAI,KAAK,kDAAkD,CAAC,CAAC;YAC3F,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,qBAAqB,CAAC,KAAK,EAAE,GAAG,KAAK,IAAI,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;YAC5E,OAAO;QACT,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;gGAIgG;AAChG,KAAK,UAAU,cAAc,CAAC,IAAgB;IAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,MAGd,CAAC;IACF,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC;IAClC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS;QAClD,MAAM,IAAI,KAAK,CAAC,8HAA8H,CAAC,CAAC;IAClJ,+FAA+F;IAC/F,gGAAgG;IAChG,6CAA6C;IAC7C,MAAM,MAAM,GAAG,CAAC,KAAsB,EAAE,MAAe,EAAE,EAAE;QACzD,MAAM,IAAI,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,IAAI,CAAC;YACH,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAA4B,CAAC,CAAC,CAAC;QACxI,CAAC;QAAC,MAAM,CAAC,CAAC,uCAAuC,CAAC,CAAC;IACrD,CAAC,CAAC;IACF,IAAI,CAAC;QACH,IAAI,UAAkB,CAAC;QACvB,IAAI,CAAC;YACH,UAAU,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,oDAAoD,SAAS,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC;QAC3K,CAAC;QACD,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,EAAE,GAAG,IAAI,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC;QACtG,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,kDAAkD,KAAK,iDAAiD,CAAC,CAAC;QAC5H,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,WAAW,EAAE;gBACxC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,GAAG,EAAE,EAAE;gBACpF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;gBAClD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,yDAAyD,IAAI,CAAC,GAAG,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC;QACtK,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuB,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,CAAC,KAAK,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuB,CAAC;QACvE,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,KAAK;YAC7C,MAAM,IAAI,KAAK,CAAC,kHAAkH,CAAC,CAAC;QACtI,MAAM,CAAC,IAAI,CAAC,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,QAAQ,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED,MAAM,YAAY,GAAc;IAC9B;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE,SAAS;QAChB,OAAO,EAAE,oHAAoH;QAC7H,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,2BAA2B,EAAE;YACzF,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,0CAA0C,EAAE;YAC3G,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,+DAA+D,EAAE;SAC7H;QACD,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;KACnD;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE,yFAAyF;QAClG,KAAK,EAAE,oLAAoL;QAC3L,WAAW,EAAE,yCAAyC;QACtD,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,sDAAsD,EAAE;YACpH,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,+DAA+D,EAAE;YACjI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,gDAAgD,EAAE;YAChH,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,kIAAkI,EAAE;YAClM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,2GAA2G,EAAE;YACrL,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,4FAA4F,EAAE;YACpK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,uCAAuC,EAAE;YACpG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,wDAAwD,EAAE;YACtH,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,yFAAyF,EAAE;SACnK;QACD,GAAG,EAAE,QAAQ;KACd;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE,SAAS;QAChB,OAAO,EAAE,wGAAwG;QACjH,KAAK,EAAE,0FAA0F;QACjG,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,iCAAiC,EAAE;YACrG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,mCAAmC,EAAE;YACjG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,yBAAyB,EAAE;YACzF,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,yBAAyB,EAAE;YACvF,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,+CAA+C,EAAE;YACrH,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,8DAA8D,EAAE;SACtI;QACD,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;KACnD;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE,uGAAuG;QAChH,KAAK,EAAE,gDAAgD;QACvD,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,uCAAuC,EAAE;YAC/G,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,6BAA6B,EAAE;SACjG;QACD,GAAG,EAAE,QAAQ;KACd;IACD;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE,yEAAyE;QAClF,KAAK,EAAE,8BAA8B;QACrC,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,uCAAuC,EAAE;SAChH;QACD,GAAG,EAAE,SAAS;KACf;CACF,CAAC;AAEF,QAAQ,CAAC,QAAQ,CAAC,GAAG,YAAY,CAAC,CAAC"}

package/dist/derive.d.ts

@@ -0,0 +1,15 @@
+/** Derive the opaque per-space owner token for an authenticated IdP subject.
+ *
+ *  `spaceSecret` is the space's owner-derivation secret (≥32 bytes, operator-held, never on the
+ *  wire); `externalSubject` is the IdP-authenticated stable subject (e.g. Better Auth `sub`) —
+ *  ALREADY VERIFIED by the caller (this function derives, it does not authenticate). Truncation
+ *  to 128 bits keeps the token subject-sized while leaving collision odds negligible for any
+ *  realistic owner population (birthday bound 2^64). Fails loud on weak/empty inputs. */
+export declare function deriveOwnerToken(spaceSecret: string | Uint8Array, externalSubject: string): string;
+/** Derive the owner for an IdP-authenticated subject — the ONE encoding of (idp issuer, sub) into
+ *  the derivation input, shared by the bridge exchange and the operator grant command so the two can
+ *  never drift. JSON-array encoding, NOT `${issuer}|${sub}`: a bare-delimiter concat is non-injective
+ *  (("a","b|c") and ("a|b","c") would collide). FROZEN once real owners exist — changing it (or the
+ *  IdP issuer string) re-keys every owner in the space. */
+export declare function deriveOwnerForIdpSubject(spaceSecret: string | Uint8Array, idpIssuer: string, sub: string): string;
+//# sourceMappingURL=derive.d.ts.map

package/dist/derive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"derive.d.ts","sourceRoot":"","sources":["../src/derive.ts"],"names":[],"mappings":"AA8CA;;;;;;yFAMyF;AACzF,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,UAAU,EAAE,eAAe,EAAE,MAAM,GAAG,MAAM,CAUlG;AAED;;;;2DAI2D;AAC3D,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,MAAM,GAAG,UAAU,EAChC,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,GACV,MAAM,CAIR"}

package/dist/derive.js

@@ -0,0 +1,72 @@
+/**
+ * Owner-token derivation — the server-side step that turns an authenticated IdP subject into the
+ * opaque, per-space `owner` the wire grammar carries (see `assertDerivedOwnerToken` in core for
+ * the format contract this emits).
+ *
+ * Properties, by construction:
+ *  - **Opaque / non-PII**: a keyed HMAC of the IdP subject — the token reveals nothing about the
+ *    subject (email, name, global id) without the per-space secret, so it is safe in subjects,
+ *    JetStream metadata, logs, and history filters.
+ *  - **Per-space**: the secret is per-space, so the same human gets unlinkable owners across
+ *    spaces.
+ *  - **Deterministic**: same (secret, subject) → same owner, so re-login re-lands in the same
+ *    lanes with no mapping table.
+ *  - **nkey-disjoint**: the emitted format (`u_` + lowercase base32) can never be an nkey — the
+ *    flip's acceptance criterion 2, asserted on every return value.
+ */
+import { createHmac } from "node:crypto";
+import { assertDerivedOwnerToken, DERIVED_OWNER_PREFIX } from "@cotal-ai/core";
+/** Domain-separation context — versioned so a future derivation change cannot silently collide
+ *  with v1 tokens. Changing this re-keys every owner in the space; treat it as a migration. */
+const DERIVATION_CONTEXT = "cotal-owner-v1";
+/** Minimum secret size. 32 bytes = the HMAC-SHA256 block-security sweet spot; anything shorter
+ *  is a config mistake (a guessable secret makes owners linkable/reversible offline). */
+const MIN_SECRET_BYTES = 32;
+const BASE32_LOWER = "abcdefghijklmnopqrstuvwxyz234567";
+/** RFC 4648 base32 (lowercased, unpadded) — 16 bytes → 26 chars, matching the format contract. */
+function base32LowerNoPad(bytes) {
+    let out = "";
+    let bits = 0;
+    let acc = 0;
+    for (const b of bytes) {
+        acc = (acc << 8) | b;
+        bits += 8;
+        while (bits >= 5) {
+            out += BASE32_LOWER[(acc >>> (bits - 5)) & 31];
+            bits -= 5;
+        }
+    }
+    if (bits > 0)
+        out += BASE32_LOWER[(acc << (5 - bits)) & 31];
+    return out;
+}
+/** Derive the opaque per-space owner token for an authenticated IdP subject.
+ *
+ *  `spaceSecret` is the space's owner-derivation secret (≥32 bytes, operator-held, never on the
+ *  wire); `externalSubject` is the IdP-authenticated stable subject (e.g. Better Auth `sub`) —
+ *  ALREADY VERIFIED by the caller (this function derives, it does not authenticate). Truncation
+ *  to 128 bits keeps the token subject-sized while leaving collision odds negligible for any
+ *  realistic owner population (birthday bound 2^64). Fails loud on weak/empty inputs. */
+export function deriveOwnerToken(spaceSecret, externalSubject) {
+    const secret = typeof spaceSecret === "string" ? new TextEncoder().encode(spaceSecret) : spaceSecret;
+    if (secret.byteLength < MIN_SECRET_BYTES)
+        throw new Error(`deriveOwnerToken: spaceSecret must be at least ${MIN_SECRET_BYTES} bytes (got ${secret.byteLength}) - ` +
+            `a short secret makes owner tokens offline-reversible/linkable`);
+    if (!externalSubject)
+        throw new Error("deriveOwnerToken: externalSubject must be a non-empty IdP subject");
+    const mac = createHmac("sha256", secret).update(`${DERIVATION_CONTEXT}:${externalSubject}`).digest();
+    return assertDerivedOwnerToken(DERIVED_OWNER_PREFIX + base32LowerNoPad(mac.subarray(0, 16)));
+}
+/** Derive the owner for an IdP-authenticated subject — the ONE encoding of (idp issuer, sub) into
+ *  the derivation input, shared by the bridge exchange and the operator grant command so the two can
+ *  never drift. JSON-array encoding, NOT `${issuer}|${sub}`: a bare-delimiter concat is non-injective
+ *  (("a","b|c") and ("a|b","c") would collide). FROZEN once real owners exist — changing it (or the
+ *  IdP issuer string) re-keys every owner in the space. */
+export function deriveOwnerForIdpSubject(spaceSecret, idpIssuer, sub) {
+    if (!idpIssuer)
+        throw new Error("deriveOwnerForIdpSubject: idpIssuer must be a non-empty string");
+    if (!sub)
+        throw new Error("deriveOwnerForIdpSubject: sub must be a non-empty string");
+    return deriveOwnerToken(spaceSecret, JSON.stringify([idpIssuer, sub]));
+}
+//# sourceMappingURL=derive.js.map

package/dist/derive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"derive.js","sourceRoot":"","sources":["../src/derive.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAE/E;+FAC+F;AAC/F,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AAE5C;yFACyF;AACzF,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAE5B,MAAM,YAAY,GAAG,kCAAkC,CAAC;AAExD,kGAAkG;AAClG,SAAS,gBAAgB,CAAC,KAAiB;IACzC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACrB,IAAI,IAAI,CAAC,CAAC;QACV,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC;YACjB,GAAG,IAAI,YAAY,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YAC/C,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IACD,IAAI,IAAI,GAAG,CAAC;QAAE,GAAG,IAAI,YAAY,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5D,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;yFAMyF;AACzF,MAAM,UAAU,gBAAgB,CAAC,WAAgC,EAAE,eAAuB;IACxF,MAAM,MAAM,GAAG,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;IACrG,IAAI,MAAM,CAAC,UAAU,GAAG,gBAAgB;QACtC,MAAM,IAAI,KAAK,CACb,kDAAkD,gBAAgB,eAAe,MAAM,CAAC,UAAU,MAAM;YACtG,+DAA+D,CAClE,CAAC;IACJ,IAAI,CAAC,eAAe;QAAE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IAC3G,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,kBAAkB,IAAI,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACrG,OAAO,uBAAuB,CAAC,oBAAoB,GAAG,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED;;;;2DAI2D;AAC3D,MAAM,UAAU,wBAAwB,CACtC,WAAgC,EAChC,SAAiB,EACjB,GAAW;IAEX,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IAClG,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IACtF,OAAO,gBAAgB,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC"}

package/dist/idp.d.ts

@@ -0,0 +1,63 @@
+import type { CryptoKey, JWTVerifyGetKey } from "jose";
+import type { UserTokenIssuer } from "./issuer.js";
+import { type UserTokenView } from "./token.js";
+/** The pinned identity of ONE external IdP. All fields are operator config — nothing in here is
+ *  ever read from a presented token. */
+export interface IdpConfig {
+    /** Exact `iss` the IdP mints (Better Auth default: its base-URL origin). */
+    issuer: string;
+    /** Exact `aud` the IdP mints (Better Auth default: its base-URL origin). */
+    audience: string;
+    /** The pinned verification key path over the IdP's JWKS — a {@link pinnedJwksResolver} on the
+     *  IdP's JWKS URL, or a local public key. The token never influences key resolution. */
+    key: JWTVerifyGetKey | CryptoKey;
+    /** Clock skew tolerance in seconds (default 5). */
+    clockToleranceSec?: number;
+}
+/** What the operator's ledger grants a (owner, actor) pair — the ONLY source of `scope`/`parent`
+ *  in the minted bearer. Returned by {@link CreateIdpBridgeOpts.authorizeActor}; the hook throws
+ *  to deny. */
+export interface ActorGrant {
+    scope?: string[];
+    /** The spawning principal (`<owner>.<actor>` dot-form), when the ledger records one. */
+    parent?: string;
+}
+export interface CreateIdpBridgeOpts {
+    /** The one IdP this bridge trusts. */
+    idp: IdpConfig;
+    /** The space every minted bearer is scoped to (`aud`). One bridge per space. */
+    space: string;
+    /** The space's owner-derivation secret (≥32 bytes, operator-held). */
+    spaceSecret: string | Uint8Array;
+    /** The Plane-1 issuer that mints the Cotal bearer. */
+    issuer: UserTokenIssuer;
+    /** The ledger authority: is `actor` a live, ledger-authorized instance of `owner`, and what does
+     *  it get? MUST return an {@link ActorGrant} object to allow; throw to deny. There is no
+     *  allow-by-default — a hook that returns anything else fails the exchange. */
+    authorizeActor: (owner: string, actor: string) => ActorGrant | Promise<ActorGrant>;
+}
+/** A successful exchange: the minted bearer plus what a caller needs to cache/refresh it. */
+export interface ExchangeResult {
+    /** The Cotal user bearer (compact JWS) the agent presents in `auth_token`. */
+    token: string;
+    /** The derived opaque owner the bearer is bound to. */
+    owner: string;
+    /** Bearer expiry (unix seconds) — schedule re-mint before this. */
+    exp: number;
+}
+export interface IdpBridge {
+    /** Exchange a verified IdP token for a Cotal user bearer bound to (derived owner, actor).
+     *  `view` requests an elevated per-connection profile ({@link USER_TOKEN_VIEWS}); it is
+     *  authorized HERE against the fresh ledger grant — scope must contain `admin` — and minted as
+     *  the server-authored `act.view` claim. Human exchanges only; the managed (agent-secret)
+     *  exchange path rejects views before it ever reaches a bridge. */
+    exchange(idpToken: string, req: {
+        actor: string;
+        ttlSec?: number;
+        view?: UserTokenView;
+    }): Promise<ExchangeResult>;
+}
+/** Build an {@link IdpBridge}. Misconfig fails HERE, at construction — an empty pin would
+ *  otherwise fail closed on every exchange with a far worse operator signal. */
+export declare function createIdpBridge(opts: CreateIdpBridgeOpts): IdpBridge;
+//# sourceMappingURL=idp.d.ts.map

package/dist/idp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"idp.d.ts","sourceRoot":"","sources":["../src/idp.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAGvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAA4D,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAE1G;wCACwC;AACxC,MAAM,WAAW,SAAS;IACxB,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;IACjB;4FACwF;IACxF,GAAG,EAAE,eAAe,GAAG,SAAS,CAAC;IACjC,mDAAmD;IACnD,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;eAEe;AACf,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IAClC,sCAAsC;IACtC,GAAG,EAAE,SAAS,CAAC;IACf,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,WAAW,EAAE,MAAM,GAAG,UAAU,CAAC;IACjC,sDAAsD;IACtD,MAAM,EAAE,eAAe,CAAC;IACxB;;mFAE+E;IAC/E,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CACpF;AAED,6FAA6F;AAC7F,MAAM,WAAW,cAAc;IAC7B,8EAA8E;IAC9E,KAAK,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,SAAS;IACxB;;;;uEAImE;IACnE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,aAAa,CAAA;KAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACpH;AAkCD;gFACgF;AAChF,wBAAgB,eAAe,CAAC,IAAI,EAAE,mBAAmB,GAAG,SAAS,CAyDpE"}