@cotal-ai/auth 0.0.0 → 0.11.0

package/dist/idp.js

@@ -0,0 +1,125 @@
+/**
+ * Plane-1 IdP bridge — the token exchange that turns an EXTERNAL IdP-authenticated human into a
+ * Cotal user bearer (the plan's §"Plane 1"): verify the IdP's JWT offline against its pinned JWKS,
+ * derive the opaque per-space owner from the IdP subject, authorize the requested actor against
+ * the operator's ledger, and mint the bearer through the {@link UserTokenIssuer}.
+ *
+ * The bridge is IdP-GENERIC on purpose (pluggable edges): any IdP that publishes an EdDSA/Ed25519
+ * JWKS and mints `iss`/`aud`/`sub`/`exp` JWTs plugs in via {@link IdpConfig} — Better Auth (JWT
+ * plugin) is the reference IdP, and the integration smoke runs a real instance. Nothing
+ * Better-Auth-specific leaks in here.
+ *
+ * Trust-boundary order inside {@link IdpBridge.exchange} (each step fail-loud, no fallback):
+ *  1. the requested actor is grammar-asserted BEFORE anything else touches it;
+ *  2. the IdP token verifies against the PINNED key path only — `alg` pinned to EdDSA, embedded
+ *     key material (`jku`/`jwk`/`x5u`/`x5c`) rejected outright, exact `iss`/`aud`, `exp` and a
+ *     non-post-dated `iat` required, `sub` a non-empty string (no coercion);
+ *  3. the owner derives from the JSON-array encoding of [idp issuer, sub] — issuer-namespaced so
+ *     the same `sub` from two IdPs can never collide, INJECTIVE by construction (JSON escaping —
+ *     no delimiter an issuer/sub pair could straddle), and deterministic so re-login re-lands in
+ *     the same lanes. This encoding is FROZEN: changing it (or the IdP issuer string) re-keys
+ *     every owner in the space — a migration, like rotating the space secret;
+ *  4. the ledger hook AUTHORIZES (owner, actor) and is the ONLY source of `scope`/`parent` — the
+ *     request cannot carry them (server-authored `act`, no confused deputy). The hook must return
+ *     an explicit grant object; anything else is a deny;
+ *  5. the issuer mints (which re-asserts every claim shape — the issuer ↔ validator inverse).
+ */
+import { decodeJwt, decodeProtectedHeader, jwtVerify } from "jose";
+import { assertValidOwnerToken } from "@cotal-ai/core";
+import { deriveOwnerForIdpSubject } from "./derive.js";
+import { MAX_TOKEN_TTL_SEC, USER_TOKEN_VIEWS, VIEW_REQUIRED_SCOPE } from "./token.js";
+/** Verify an external IdP JWT against the pinned config and return its `sub` AND `exp`. Same pinning
+ *  posture as `validateUserToken`, minus the Cotal claim shape (an IdP token has no `ver`/`act`; its
+ *  lifetime is the IdP's session policy — but it must expire and must not be post-dated). The `exp` is
+ *  returned so `exchange` can CAP the minted Cotal bearer to the upstream proof's remaining life. */
+async function verifyIdpToken(token, idp) {
+    const header = decodeProtectedHeader(token);
+    if (header.jku !== undefined || header.jwk !== undefined || header.x5u !== undefined || header.x5c !== undefined)
+        throw new Error("idp token: embedded key material (jku/jwk/x5u/x5c) is rejected - keys resolve only via the pinned JWKS");
+    if (header.alg !== "EdDSA")
+        throw new Error(`idp token: alg must be EdDSA (got ${String(header.alg)})`);
+    const tol = idp.clockToleranceSec ?? 5;
+    const { payload } = await jwtVerify(token, idp.key, {
+        algorithms: ["EdDSA"],
+        issuer: idp.issuer,
+        audience: idp.audience,
+        clockTolerance: tol,
+    });
+    // jose's `audience` option is SET-MEMBERSHIP (an aud array containing the expected value
+    // passes) — exact means the token's audience set is exactly {configured}: the plain string, or
+    // a singleton array of it. A multi-audience session proof minted for other services too must
+    // not be exchangeable here.
+    if (payload.aud !== idp.audience && !(Array.isArray(payload.aud) && payload.aud.length === 1 && payload.aud[0] === idp.audience))
+        throw new Error("idp token: aud must be exactly the configured audience - a multi-audience session proof is rejected");
+    if (typeof payload.exp !== "number")
+        throw new Error("idp token: exp is required - an IdP session proof must expire");
+    if (typeof payload.iat !== "number")
+        throw new Error("idp token: iat is required");
+    if (payload.iat > Math.floor(Date.now() / 1000) + tol)
+        throw new Error("idp token: iat is in the future");
+    if (typeof payload.sub !== "string" || !payload.sub)
+        throw new Error("idp token: sub must be a non-empty string user id - no coercion at a trust boundary");
+    return { sub: payload.sub, exp: payload.exp };
+}
+/** Build an {@link IdpBridge}. Misconfig fails HERE, at construction — an empty pin would
+ *  otherwise fail closed on every exchange with a far worse operator signal. */
+export function createIdpBridge(opts) {
+    if (!opts.space)
+        throw new Error("idp bridge: a space is required");
+    if (typeof opts.idp?.issuer !== "string" || !opts.idp.issuer)
+        throw new Error("idp bridge: idp.issuer (the exact iss pin) is required");
+    if (typeof opts.idp.audience !== "string" || !opts.idp.audience)
+        throw new Error("idp bridge: idp.audience (the exact aud pin) is required");
+    if (!opts.idp.key)
+        throw new Error("idp bridge: idp.key (the pinned JWKS resolver / public key) is required");
+    if (typeof opts.authorizeActor !== "function")
+        throw new Error("idp bridge: an authorizeActor ledger hook is required - there is no allow-by-default");
+    return {
+        exchange: async (idpToken, req) => {
+            assertValidOwnerToken(req.actor);
+            const { sub, exp: idpExp } = await verifyIdpToken(idpToken, opts.idp);
+            // The (issuer, sub) → derivation-input encoding lives in ONE place (deriveOwnerForIdpSubject),
+            // shared with the operator grant command — the ledger's grant-time owner and the exchange-time
+            // owner must be the same bytes or every grant silently misses.
+            const owner = deriveOwnerForIdpSubject(opts.spaceSecret, opts.idp.issuer, sub);
+            const grant = await opts.authorizeActor(owner, req.actor);
+            if (grant === null || typeof grant !== "object" || Array.isArray(grant))
+                throw new Error("idp bridge: authorizeActor must return a grant object - anything else is a deny");
+            if (req.view !== undefined) {
+                // An elevated view is authorized against the FRESH grant just read, per the central
+                // policy table (admin-gated operator views; spawn-gated deployer). The refusal names the
+                // exact re-grant (ADD to the current list — the upsert replaces it), mirroring the
+                // control-op copy.
+                if (!USER_TOKEN_VIEWS.includes(req.view))
+                    throw new Error(`view "${String(req.view)}" is not a known view (${USER_TOKEN_VIEWS.join(", ")})`);
+                const need = VIEW_REQUIRED_SCOPE[req.view];
+                if (!(grant.scope ?? []).includes(need))
+                    throw new Error(`the "${req.view}" view needs scope "${need}", which your grant lacks. Ask the mesh operator to re-grant with "${need}" ADDED to your current scope: ` +
+                        `cotal actor grant ${req.actor} --owner ${owner} --scope ${[...(grant.scope ?? []), need].join(",")}  (the upsert replaces the scope list; the operator can confirm with \`cotal actor list\`)`);
+            }
+            // Cap the minted bearer's lifetime to the IdP proof's REMAINING life: the Cotal bearer must not
+            // outlive the session proof it rests on. Otherwise a near-expired (or stolen just-before-expiry)
+            // IdP JWT would exchange for a full MAX_TOKEN_TTL_SEC bearer, widening authority past the upstream
+            // proof and defeating the "revocation bites when the IdP session lapses" model. An already-lapsed
+            // proof cannot mint anything (fail-loud).
+            const idpRemaining = idpExp - Math.floor(Date.now() / 1000);
+            if (idpRemaining <= 0)
+                throw new Error("idp bridge: the IdP session proof has expired - cannot mint a bearer");
+            const ttlSec = Math.min(req.ttlSec ?? MAX_TOKEN_TTL_SEC, idpRemaining);
+            const token = await opts.issuer.issue({
+                owner,
+                space: opts.space,
+                actor: req.actor,
+                scope: grant.scope,
+                parent: grant.parent,
+                view: req.view,
+                ttlSec,
+            });
+            const { exp } = decodeJwt(token);
+            if (typeof exp !== "number")
+                throw new Error("idp bridge: minted bearer is missing exp - issuer contract violated");
+            return { token, owner, exp };
+        },
+    };
+}
+//# sourceMappingURL=idp.js.map

package/dist/idp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"idp.js","sourceRoot":"","sources":["../src/idp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAEnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAEvD,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAsB,MAAM,YAAY,CAAC;AA2D1G;;;qGAGqG;AACrG,KAAK,UAAU,cAAc,CAAC,KAAa,EAAE,GAAc;IACzD,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;QAC9G,MAAM,IAAI,KAAK,CAAC,wGAAwG,CAAC,CAAC;IAC5H,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAExG,MAAM,GAAG,GAAG,GAAG,CAAC,iBAAiB,IAAI,CAAC,CAAC;IACvC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,GAAsB,EAAE;QACrE,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,cAAc,EAAE,GAAG;KACpB,CAAC,CAAC;IAEH,yFAAyF;IACzF,+FAA+F;IAC/F,6FAA6F;IAC7F,4BAA4B;IAC5B,IAAI,OAAO,CAAC,GAAG,KAAK,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,QAAQ,CAAC;QAC9H,MAAM,IAAI,KAAK,CAAC,qGAAqG,CAAC,CAAC;IACzH,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACtH,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACnF,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC1G,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG;QACjD,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;IACzG,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;AAChD,CAAC;AAED;gFACgF;AAChF,MAAM,UAAU,eAAe,CAAC,IAAyB;IACvD,IAAI,CAAC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACpE,IAAI,OAAO,IAAI,CAAC,GAAG,EAAE,MAAM,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM;QAC1D,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,IAAI,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ;QAC7D,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC9G,IAAI,OAAO,IAAI,CAAC,cAAc,KAAK,UAAU;QAC3C,MAAM,IAAI,KAAK,CAAC,sFAAsF,CAAC,CAAC;IAC1G,OAAO;QACL,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE;YAChC,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YACtE,+FAA+F;YAC/F,+FAA+F;YAC/F,+DAA+D;YAC/D,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC/E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YAC1D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBACrE,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;YACrG,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC3B,oFAAoF;gBACpF,yFAAyF;gBACzF,mFAAmF;gBACnF,mBAAmB;gBACnB,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;oBACtC,MAAM,IAAI,KAAK,CAAC,SAAS,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,0BAA0B,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACrG,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC3C,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;oBACrC,MAAM,IAAI,KAAK,CACb,QAAQ,GAAG,CAAC,IAAI,uBAAuB,IAAI,sEAAsE,IAAI,iCAAiC;wBACpJ,qBAAqB,GAAG,CAAC,KAAK,YAAY,KAAK,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,4FAA4F,CAClM,CAAC;YACN,CAAC;YACD,gGAAgG;YAChG,iGAAiG;YACjG,mGAAmG;YACnG,kGAAkG;YAClG,0CAA0C;YAC1C,MAAM,YAAY,GAAG,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC5D,IAAI,YAAY,IAAI,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;YAC1F,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,iBAAiB,EAAE,YAAY,CAAC,CAAC;YACvE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBACpC,KAAK;gBACL,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,MAAM;aACP,CAAC,CAAC;YACH,MAAM,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;YACpH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QAC/B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,13 @@
+export { deriveOwnerToken, deriveOwnerForIdpSubject } from "./derive.js";
+export { AUTH_CALLOUT_SUBJECT, createCalloutAuth, startAuthCallout, type CalloutAuth, type CalloutProvisionInput, type CalloutConnection, type CalloutMsg, type StartAuthCalloutOpts, } from "./callout.js";
+export { validateUserToken, USER_TOKEN_VER, MAX_TOKEN_TTL_SEC, USER_TOKEN_VIEWS, VIEW_REQUIRED_SCOPE, type UserTokenActor, type UserTokenView, type ValidatedUserToken, type ValidateUserTokenOpts, } from "./token.js";
+export { USER_TOKEN_ALG, createUserTokenIssuer, generateSigningKey, exportSigningKey, importSigningKey, pinnedJwksResolver, type SigningKey, type SerializedSigningKey, type IssueClaims, type UserTokenIssuer, type CreateIssuerOpts, } from "./issuer.js";
+export { createIdpBridge, type IdpConfig, type ActorGrant, type CreateIdpBridgeOpts, type ExchangeResult, type IdpBridge, } from "./idp.js";
+export { deviceLogin, establishIdpSession, fetchIdpJwt, revokeIdpSession, loadIdpSession, saveIdpSession, deleteIdpSession, requireIdpSession, normalizeIdpUrl, probeIdpJwks, type IdpSession, type DeviceLoginOpts, type DeviceLoginPrompt, } from "./login.js";
+export { calloutPermissions, type AclResolver } from "./permissions.js";
+export { clearAuthServiceInfo, ensureCalloutAuth, ensureIssuer, ensureOwnerSecret, ensurePinnedIdp, loadAuthServiceInfo, loadCalloutAuth, loadIssuer, loadOwnerSecret, loadPinnedIdp, loadServiceKeys, saveAuthServiceInfo, saveServiceKeys, spaceIssuer, type AuthServiceInfo, type PinnedIdp, type ServiceKeys, } from "./store.js";
+export { actorLedgerDir, managedActorLedgerDir, findInteractiveActor, findManagedActor, findActorUnified, grantActor, grantManagedActor, ledgerAclResolver, ledgerAuthorizeConnect, ledgerAuthorizeGrant, ledgerAuthorizeAgentExchange, ledgerRowFilename, loadActorLedger, revokeActor, revokeManagedActor, newActorToken, hashActorToken, AGENT_BEARER_TTL_SEC, type ActorKind, type ActorRow, } from "./ledger.js";
+export { runAuthService, JWKS_MAX_AGE_SEC } from "./service.js";
+export { cotalAuthProvider } from "./provider.js";
+import "./commands.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,WAAW,EAChB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,oBAAoB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,GAC3B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,UAAU,EACf,KAAK,oBAAoB,EACzB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,eAAe,EACf,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,SAAS,GACf,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAE,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,UAAU,EACV,eAAe,EACf,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,WAAW,EACX,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,WAAW,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,oBAAoB,EACpB,4BAA4B,EAC5B,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,oBAAoB,EACpB,KAAK,SAAS,EACd,KAAK,QAAQ,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,eAAe,CAAC"}

package/dist/index.js

@@ -0,0 +1,13 @@
+export { deriveOwnerToken, deriveOwnerForIdpSubject } from "./derive.js";
+export { AUTH_CALLOUT_SUBJECT, createCalloutAuth, startAuthCallout, } from "./callout.js";
+export { validateUserToken, USER_TOKEN_VER, MAX_TOKEN_TTL_SEC, USER_TOKEN_VIEWS, VIEW_REQUIRED_SCOPE, } from "./token.js";
+export { USER_TOKEN_ALG, createUserTokenIssuer, generateSigningKey, exportSigningKey, importSigningKey, pinnedJwksResolver, } from "./issuer.js";
+export { createIdpBridge, } from "./idp.js";
+export { deviceLogin, establishIdpSession, fetchIdpJwt, revokeIdpSession, loadIdpSession, saveIdpSession, deleteIdpSession, requireIdpSession, normalizeIdpUrl, probeIdpJwks, } from "./login.js";
+export { calloutPermissions } from "./permissions.js";
+export { clearAuthServiceInfo, ensureCalloutAuth, ensureIssuer, ensureOwnerSecret, ensurePinnedIdp, loadAuthServiceInfo, loadCalloutAuth, loadIssuer, loadOwnerSecret, loadPinnedIdp, loadServiceKeys, saveAuthServiceInfo, saveServiceKeys, spaceIssuer, } from "./store.js";
+export { actorLedgerDir, managedActorLedgerDir, findInteractiveActor, findManagedActor, findActorUnified, grantActor, grantManagedActor, ledgerAclResolver, ledgerAuthorizeConnect, ledgerAuthorizeGrant, ledgerAuthorizeAgentExchange, ledgerRowFilename, loadActorLedger, revokeActor, revokeManagedActor, newActorToken, hashActorToken, AGENT_BEARER_TTL_SEC, } from "./ledger.js";
+export { runAuthService, JWKS_MAX_AGE_SEC } from "./service.js";
+export { cotalAuthProvider } from "./provider.js"; // self-registers the "auth-provider" extension
+import "./commands.js"; // self-registers `login` / `logout` / `actor` / `auth-service` into the core Registry
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,GAMjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,mBAAmB,GAKpB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,GAMnB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,eAAe,GAMhB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,YAAY,GAIb,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAoB,MAAM,kBAAkB,CAAC;AACxE,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,UAAU,EACV,eAAe,EACf,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,WAAW,GAIZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,oBAAoB,EACpB,4BAA4B,EAC5B,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,oBAAoB,GAGrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC,CAAC,+CAA+C;AAClG,OAAO,eAAe,CAAC,CAAC,sFAAsF"}

package/dist/issuer.d.ts

@@ -0,0 +1,78 @@
+import type { CryptoKey, JWK, JWTVerifyGetKey } from "jose";
+import { type UserTokenView } from "./token.js";
+/** The one signing algorithm — Ed25519. Pinned on both mint and verify. */
+export declare const USER_TOKEN_ALG = "EdDSA";
+/** An active signing key: the private `CryptoKey` for minting + its published public JWK. The `kid`
+ *  is the RFC 7638 thumbprint of the public key (stable, collision-free, verifier-recomputable). */
+export interface SigningKey {
+    kid: string;
+    privateKey: CryptoKey;
+    /** Public JWK as published in the set (carries `kid`/`alg`/`use`; never `d`). */
+    publicJwk: JWK;
+}
+/** A signing key serialized for persistence — the PRIVATE JWK (with `d`) plus its kid. Guard this at
+ *  rest like any signing secret; `importSigningKey` restores it (kid integrity re-checked). */
+export interface SerializedSigningKey {
+    kid: string;
+    privateJwk: JWK;
+}
+/** Mint a fresh Ed25519 signing key (extractable, so it can be persisted with {@link exportSigningKey}). */
+export declare function generateSigningKey(): Promise<SigningKey>;
+/** Serialize a signing key (private JWK + kid) for persistence. */
+export declare function exportSigningKey(key: SigningKey): Promise<SerializedSigningKey>;
+/** Restore a persisted signing key; re-derives the kid from the public projection and refuses a
+ *  serialized blob whose stored kid doesn't match (tamper / corruption fail-loud). */
+export declare function importSigningKey(s: SerializedSigningKey): Promise<SigningKey>;
+/** The claims a caller supplies to mint a bearer — the owner is already derived and the actor is
+ *  already ledger-authorized upstream; the issuer only stamps and signs. */
+export interface IssueClaims {
+    /** The opaque derived owner (`u_…`; format-asserted). */
+    owner: string;
+    /** The space the bearer is scoped to (becomes `aud`). */
+    space: string;
+    /** The ledger-authorized agent-instance id (becomes `act.actor`; grammar-asserted). */
+    actor: string;
+    /** Capability scope. */
+    scope?: string[];
+    /** At most one spawner audit link, `<owner>.<actor>` dot-form. */
+    parent?: string;
+    /** Exchange-authorized elevated view (already ledger-checked upstream; the issuer only stamps —
+     *  and re-asserts the closed enum, mint ↔ validate inverse). */
+    view?: UserTokenView;
+    /** Requested lifetime; capped at {@link MAX_TOKEN_TTL_SEC} (an overlong ask THROWS). */
+    ttlSec?: number;
+}
+/** A running issuer: mints bearers with the active key, publishes the public JWKS, and rotates. */
+export interface UserTokenIssuer {
+    /** The `iss` every bearer carries (verifiers pin this). */
+    readonly issuer: string;
+    /** The active signing kid. */
+    activeKid(): string;
+    /** Mint a bearer for a validated (owner, actor). Returns the compact JWS. */
+    issue(claims: IssueClaims): Promise<string>;
+    /** The public JWK Set to publish for offline verification (all live kids, public members only). */
+    jwks(): {
+        keys: JWK[];
+    };
+    /** Add a key and make it the active signer; prior keys stay published until {@link retire}. */
+    rotate(key: SigningKey): void;
+    /** Drop a retired kid from the set — after that, tokens it signed no longer verify. */
+    retire(kid: string): void;
+    /** A verifier over the CURRENT key set (reflects rotate/retire live) — for a co-located callout
+     *  or tests. Same `JWTVerifyGetKey` shape {@link validateUserToken} accepts. */
+    localKeySet(): JWTVerifyGetKey;
+}
+export interface CreateIssuerOpts {
+    /** Exact issuer string minted into `iss` (verifiers pin it). */
+    issuer: string;
+    /** The initial (active) signing key. */
+    key: SigningKey;
+}
+/** Build a {@link UserTokenIssuer}. */
+export declare function createUserTokenIssuer(opts: CreateIssuerOpts): UserTokenIssuer;
+/** Build the callout's pinned key resolver: a `createRemoteJWKSet` locked to ONE origin. The token
+ *  never influences where the key comes from — jose fetches only this URL and ignores any embedded
+ *  `jku`/`jwk` (and {@link validateUserToken} rejects those headers outright). HTTPS is required
+ *  except for loopback (dev). */
+export declare function pinnedJwksResolver(jwksUri: string): JWTVerifyGetKey;
+//# sourceMappingURL=issuer.d.ts.map

package/dist/issuer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"issuer.d.ts","sourceRoot":"","sources":["../src/issuer.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAE5D,OAAO,EAAuD,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAErG,2EAA2E;AAC3E,eAAO,MAAM,cAAc,UAAU,CAAC;AAEtC;oGACoG;AACpG,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,SAAS,CAAC;IACtB,iFAAiF;IACjF,SAAS,EAAE,GAAG,CAAC;CAChB;AAED;+FAC+F;AAC/F,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,GAAG,CAAC;CACjB;AAeD,4GAA4G;AAC5G,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,UAAU,CAAC,CAG9D;AAED,mEAAmE;AACnE,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAErF;AAED;sFACsF;AACtF,wBAAsB,gBAAgB,CAAC,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,UAAU,CAAC,CAKnF;AAED;4EAC4E;AAC5E,MAAM,WAAW,WAAW;IAC1B,yDAAyD;IACzD,KAAK,EAAE,MAAM,CAAC;IACd,yDAAyD;IACzD,KAAK,EAAE,MAAM,CAAC;IACd,uFAAuF;IACvF,KAAK,EAAE,MAAM,CAAC;IACd,wBAAwB;IACxB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;oEACgE;IAChE,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,mGAAmG;AACnG,MAAM,WAAW,eAAe;IAC9B,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8BAA8B;IAC9B,SAAS,IAAI,MAAM,CAAC;IACpB,6EAA6E;IAC7E,KAAK,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,mGAAmG;IACnG,IAAI,IAAI;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE,CAAC;IACxB,+FAA+F;IAC/F,MAAM,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IAC9B,uFAAuF;IACvF,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;oFACgF;IAChF,WAAW,IAAI,eAAe,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,wCAAwC;IACxC,GAAG,EAAE,UAAU,CAAC;CACjB;AAED,uCAAuC;AACvC,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,gBAAgB,GAAG,eAAe,CAgE7E;AAED;;;iCAGiC;AACjC,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,CAMnE"}

package/dist/issuer.js

@@ -0,0 +1,137 @@
+/**
+ * Plane-1 user-bearer ISSUER — the server-side piece that turns an already-authenticated human
+ * (an owner) into the short-lived Cotal user bearer an agent presents to the callout (the plan's
+ * §"Plane 1"; the exact claim shape {@link validateUserToken} enforces on the other side).
+ *
+ * This is the production form of what the callout E2E smoke hand-rolls: an EdDSA (Ed25519) signer
+ * whose public keys are published as a JWKS the callout verifies against OFFLINE. It is deliberately
+ * NOT the Better-Auth binding (that's Plane-1's IdP adapter, a later slice) — an issuer takes an
+ * ALREADY-derived owner + a ledger-authorized actor and mints; deriving the owner and authorizing
+ * the actor happen upstream.
+ *
+ * Load-bearing properties:
+ *  - `alg` is EdDSA only; every token carries a `kid` so verifiers pick the right key across rotation;
+ *  - the minted claims are exactly {@link validateUserToken}'s reject matrix inverse — a token this
+ *    issuer produces MUST validate, and the round-trip smoke pins that (issuer ↔ validator agree);
+ *  - the lifetime is capped at {@link MAX_TOKEN_TTL_SEC} at MINT (fail loud on an overlong ask) — the
+ *    validator caps on the read side too, but a mint that quietly exceeded the cap would be dead JWTs;
+ *  - rotation is real: multiple keys live in the JWKS at once (sign with the newest, verify any
+ *    still-published kid), and a retired kid stops verifying — that's the revocation seam for the
+ *    signing key, distinct from the per-token exp lever.
+ *
+ * NOTHING here leaks private material: `jwks()` exports public JWKs only; the private key stays a
+ * `CryptoKey` in memory (or a persisted private JWK the operator controls).
+ */
+import { SignJWT, calculateJwkThumbprint, createRemoteJWKSet, exportJWK, generateKeyPair, importJWK } from "jose";
+import { assertDerivedOwnerToken, assertValidOwnerToken } from "@cotal-ai/core";
+import { MAX_TOKEN_TTL_SEC, USER_TOKEN_VER, USER_TOKEN_VIEWS } from "./token.js";
+/** The one signing algorithm — Ed25519. Pinned on both mint and verify. */
+export const USER_TOKEN_ALG = "EdDSA";
+function publicMembers(jwk) {
+    // OKP public projection — the members a verifier (and the thumbprint) needs; drop the private `d`.
+    if (jwk.kty !== "OKP" || jwk.crv !== "Ed25519" || typeof jwk.x !== "string")
+        throw new Error(`signing key must be an Ed25519 OKP JWK (got kty=${String(jwk.kty)} crv=${String(jwk.crv)})`);
+    return { kty: jwk.kty, crv: jwk.crv, x: jwk.x };
+}
+async function toSigningKey(privateKey, privateJwk) {
+    const pub = publicMembers(privateJwk);
+    const kid = await calculateJwkThumbprint(pub);
+    return { kid, privateKey, publicJwk: { ...pub, kid, alg: USER_TOKEN_ALG, use: "sig" } };
+}
+/** Mint a fresh Ed25519 signing key (extractable, so it can be persisted with {@link exportSigningKey}). */
+export async function generateSigningKey() {
+    const { privateKey } = await generateKeyPair(USER_TOKEN_ALG, { extractable: true });
+    return toSigningKey(privateKey, await exportJWK(privateKey));
+}
+/** Serialize a signing key (private JWK + kid) for persistence. */
+export async function exportSigningKey(key) {
+    return { kid: key.kid, privateJwk: await exportJWK(key.privateKey) };
+}
+/** Restore a persisted signing key; re-derives the kid from the public projection and refuses a
+ *  serialized blob whose stored kid doesn't match (tamper / corruption fail-loud). */
+export async function importSigningKey(s) {
+    const privateKey = (await importJWK(s.privateJwk, USER_TOKEN_ALG));
+    const key = await toSigningKey(privateKey, s.privateJwk);
+    if (key.kid !== s.kid)
+        throw new Error(`signing key kid mismatch: serialized ${s.kid} != recomputed ${key.kid}`);
+    return key;
+}
+/** Build a {@link UserTokenIssuer}. */
+export function createUserTokenIssuer(opts) {
+    if (!opts.issuer)
+        throw new Error("issuer: an `iss` string is required");
+    const keys = new Map([[opts.key.kid, opts.key]]);
+    let active = opts.key.kid;
+    const issue = async (claims) => {
+        // Every claim is RUNTIME-shape-checked, not just TS-typed: C2 feeds this from IdP/session JSON,
+        // and a mis-shaped claim must fail HERE — signing it would mint a dead bearer the validator
+        // rejects, silently breaking the issuer ↔ validator inverse.
+        assertDerivedOwnerToken(claims.owner);
+        assertValidOwnerToken(claims.actor);
+        if (typeof claims.space !== "string" || !claims.space)
+            throw new Error("issue: space (aud) must be a non-empty string");
+        if (claims.scope !== undefined && !(Array.isArray(claims.scope) && claims.scope.every((s) => typeof s === "string")))
+            throw new Error("issue: scope must be a string list when present");
+        if (claims.parent !== undefined) {
+            if (typeof claims.parent !== "string")
+                throw new Error("issue: parent must be a string principal (<owner>.<actor>)");
+            const parts = claims.parent.split(".");
+            if (parts.length !== 2)
+                throw new Error(`issue: parent "${claims.parent}" is not a principal (<owner>.<actor>)`);
+            assertDerivedOwnerToken(parts[0]);
+            assertValidOwnerToken(parts[1]);
+        }
+        if (claims.view !== undefined && !USER_TOKEN_VIEWS.includes(claims.view))
+            throw new Error(`issue: view "${String(claims.view)}" is not a known view (${USER_TOKEN_VIEWS.join(", ")}) - the enum is closed on the mint side too`);
+        const ttl = claims.ttlSec ?? MAX_TOKEN_TTL_SEC;
+        if (typeof ttl !== "number" || !Number.isFinite(ttl) || !(ttl > 0) || ttl > MAX_TOKEN_TTL_SEC)
+            throw new Error(`issue: ttlSec ${ttl} out of range (0, ${MAX_TOKEN_TTL_SEC}] - the cap is the revocation lever`);
+        const signer = keys.get(active);
+        if (!signer)
+            throw new Error("issue: no active signing key");
+        const now = Math.floor(Date.now() / 1000);
+        return new SignJWT({
+            scope: claims.scope ?? [],
+            ver: USER_TOKEN_VER,
+            act: { owner: claims.owner, actor: claims.actor, ...(claims.scope ? { scope: claims.scope } : {}), ...(claims.parent ? { parent: claims.parent } : {}), ...(claims.view ? { view: claims.view } : {}) },
+        })
+            .setProtectedHeader({ alg: USER_TOKEN_ALG, kid: signer.kid })
+            .setSubject(claims.owner)
+            .setIssuer(opts.issuer)
+            .setAudience(claims.space)
+            .setIssuedAt(now)
+            .setNotBefore(now)
+            .setExpirationTime(now + ttl)
+            .sign(signer.privateKey);
+    };
+    return {
+        issuer: opts.issuer,
+        activeKid: () => active,
+        issue,
+        jwks: () => ({ keys: [...keys.values()].map((k) => k.publicJwk) }),
+        rotate: (key) => { keys.set(key.kid, key); active = key.kid; },
+        retire: (kid) => {
+            if (kid === active)
+                throw new Error(`issuer: refusing to retire the active kid ${kid} - rotate to a new key first`);
+            keys.delete(kid);
+        },
+        localKeySet: () => async (header) => {
+            const jwk = header.kid ? keys.get(header.kid)?.publicJwk : undefined;
+            if (!jwk)
+                throw new Error(`no published signing key for kid ${String(header.kid)}`);
+            return (await importJWK(jwk, USER_TOKEN_ALG));
+        },
+    };
+}
+/** Build the callout's pinned key resolver: a `createRemoteJWKSet` locked to ONE origin. The token
+ *  never influences where the key comes from — jose fetches only this URL and ignores any embedded
+ *  `jku`/`jwk` (and {@link validateUserToken} rejects those headers outright). HTTPS is required
+ *  except for loopback (dev). */
+export function pinnedJwksResolver(jwksUri) {
+    const url = new URL(jwksUri);
+    const loopback = url.hostname === "127.0.0.1" || url.hostname === "localhost" || url.hostname === "[::1]";
+    if (url.protocol !== "https:" && !loopback)
+        throw new Error(`JWKS origin must be https (or loopback for dev), got ${url.protocol}//${url.hostname}`);
+    return createRemoteJWKSet(url);
+}
+//# sourceMappingURL=issuer.js.map

package/dist/issuer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issuer.js","sourceRoot":"","sources":["../src/issuer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAElH,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,gBAAgB,EAAsB,MAAM,YAAY,CAAC;AAErG,2EAA2E;AAC3E,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AAkBtC,SAAS,aAAa,CAAC,GAAQ;IAC7B,mGAAmG;IACnG,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ;QACzE,MAAM,IAAI,KAAK,CAAC,mDAAmD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChH,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,UAAqB,EAAE,UAAe;IAChE,MAAM,GAAG,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC9C,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;AAC1F,CAAC;AAED,4GAA4G;AAC5G,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,eAAe,CAAC,cAAc,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACpF,OAAO,YAAY,CAAC,UAAuB,EAAE,MAAM,SAAS,CAAC,UAAuB,CAAC,CAAC,CAAC;AACzF,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAe;IACpD,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AACvE,CAAC;AAED;sFACsF;AACtF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,CAAuB;IAC5D,MAAM,UAAU,GAAG,CAAC,MAAM,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,cAAc,CAAC,CAAc,CAAC;IAChF,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;IACzD,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC,GAAG,kBAAkB,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;IACjH,OAAO,GAAG,CAAC;AACb,CAAC;AAgDD,uCAAuC;AACvC,MAAM,UAAU,qBAAqB,CAAC,IAAsB;IAC1D,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrE,IAAI,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAE1B,MAAM,KAAK,GAAG,KAAK,EAAE,MAAmB,EAAmB,EAAE;QAC3D,gGAAgG;QAChG,4FAA4F;QAC5F,6DAA6D;QAC7D,uBAAuB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtC,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK;YACnD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;YAClH,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;gBACnC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;YAChF,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,CAAC,MAAM,wCAAwC,CAAC,CAAC;YACjH,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAClC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;YACtE,MAAM,IAAI,KAAK,CACb,gBAAgB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,6CAA6C,CACtI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,IAAI,iBAAiB,CAAC;QAC/C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,GAAG,GAAG,iBAAiB;YAC3F,MAAM,IAAI,KAAK,CAAC,iBAAiB,GAAG,qBAAqB,iBAAiB,qCAAqC,CAAC,CAAC;QACnH,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,OAAO,IAAI,OAAO,CAAC;YACjB,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE;YACzB,GAAG,EAAE,cAAc;YACnB,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SACxM,CAAC;aACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;aAC5D,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC;aACxB,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC;aACtB,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC;aACzB,WAAW,CAAC,GAAG,CAAC;aAChB,YAAY,CAAC,GAAG,CAAC;aACjB,iBAAiB,CAAC,GAAG,GAAG,GAAG,CAAC;aAC5B,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC7B,CAAC,CAAC;IAEF,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM;QACvB,KAAK;QACL,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;QAClE,MAAM,EAAE,CAAC,GAAe,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1E,MAAM,EAAE,CAAC,GAAW,EAAE,EAAE;YACtB,IAAI,GAAG,KAAK,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,GAAG,8BAA8B,CAAC,CAAC;YACpH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QACD,WAAW,EAAE,GAAoB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACnD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YACrE,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACpF,OAAO,CAAC,MAAM,SAAS,CAAC,GAAG,EAAE,cAAc,CAAC,CAAc,CAAC;QAC7D,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;iCAGiC;AACjC,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;IAC1G,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ;QACxC,MAAM,IAAI,KAAK,CAAC,wDAAwD,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3G,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC"}

package/dist/ledger.d.ts

@@ -0,0 +1,108 @@
+import type { ActorGrant } from "./idp.js";
+import type { ValidatedUserToken } from "./token.js";
+import type { AclResolver } from "./permissions.js";
+/** The two row spaces. The KIND is the directory — never a field a partial write could flip. */
+export type ActorKind = "interactive" | "managed-agent";
+/** One granted (owner, actor) row — everything the two trust boundaries mint from. */
+export interface ActorRow {
+    /** The opaque derived owner (`u_…`) this actor belongs to. */
+    owner: string;
+    /** The agent-instance id under that owner. */
+    actor: string;
+    /** Capability scope the bearer carries (`act.scope`, e.g. `["spawn"]`). Explicit; default none. */
+    scope: string[];
+    /** Channel read ACL minted at connect. Explicit at grant time — the resolver invents no default. */
+    allowSubscribe: string[];
+    /** Channel post ACL minted at connect. Explicit at grant time (empty = cannot post anywhere). */
+    allowPublish: string[];
+    /** Role (scopes the TASK-queue consumer), when the actor serves one. */
+    role?: string;
+    /** The spawning principal (`<owner>.<actor>` dot-form) when the ledger records one (audit link). */
+    parent?: string;
+    /** Operator-chosen display label for `list` legibility (e.g. "david laptop"). NEVER the IdP
+     *  subject/email — the ledger stays as non-PII as the wire. */
+    label?: string;
+    /** SHA-256 hex of the per-agent exchange secret. REQUIRED in a managed-agent row (its space's
+     *  defining shape), REFUSED in an interactive row (readRow fails closed on either violation).
+     *  The plaintext secret is returned ONCE at grant time and never persisted. */
+    tokenHash?: string;
+    /** ISO timestamp of the grant (audit). */
+    grantedAt: string;
+}
+/** Every granted row in BOTH spaces, read fresh, tagged with its kind. Missing dirs = EMPTY ledger
+ *  (deny-all). A row that cannot be read throws (fail closed) rather than being silently omitted
+ *  from an authorization listing. */
+export declare function loadActorLedger(dir: string): Array<ActorRow & {
+    kind: ActorKind;
+}>;
+export declare function findInteractiveActor(dir: string, owner: string, actor: string): ActorRow | undefined;
+export declare function findManagedActor(dir: string, owner: string, actor: string): ActorRow | undefined;
+/** The CONNECT boundary's unified read — a bearer minted by EITHER exchange path authorizes here,
+ *  so both spaces are consulted. A (owner, actor) present in BOTH is a broken ledger (the writers
+ *  refuse it; only manual tampering produces it) and DENIES, fail-closed, naming both files. */
+export declare function findActorUnified(dir: string, owner: string, actor: string): (ActorRow & {
+    kind: ActorKind;
+}) | undefined;
+/** Grant (or update — an upsert, so re-granting narrows/widens in place) an INTERACTIVE (owner,
+ *  actor) row. Refuses a token hash (that's the managed space's shape, written only by the spawn
+ *  path) and refuses to shadow an existing managed-agent row — the two spaces stay disjoint at the
+ *  write, so the read sides never disambiguate.
+ *
+ *  NOT attenuated by design: interactive rows are OPERATOR-authored (the local `cotal actor grant`
+ *  CLI is the only writer), and the operator is the authority the envelope rule bottoms out in. An
+ *  optional `parent` here is an audit link only — do not build a delegated-USER write path on this
+ *  function; user-authored delegation belongs in the managed space, where the chain walk enforces
+ *  the envelope (an interactive row that carries a parent still gets link-checked when a managed
+ *  chain passes THROUGH it). */
+export declare function grantActor(dir: string, row: Omit<ActorRow, "grantedAt">): ActorRow;
+/** Author a MANAGED-AGENT row (spawn path only): the same upsert semantics, in the managed space,
+ *  with the secret hash REQUIRED — and never shadowing an interactive row. */
+export declare function grantManagedActor(dir: string, row: Omit<ActorRow, "grantedAt"> & {
+    tokenHash: string;
+}): ActorRow;
+/** Revoke a row in one space. Returns false when there was nothing to revoke. NOTE: this stops NEW
+ *  bearer mints and NEW connects immediately (both boundaries read fresh); an ALREADY-LIVE
+ *  connection dies at its bearer-bound JWT expiry — live eviction is the D5 lever, not the ledger's. */
+export declare function revokeActor(dir: string, owner: string, actor: string): boolean;
+export declare function revokeManagedActor(dir: string, owner: string, actor: string): boolean;
+/** The IdP bridge's `authorizeActor` hook (bearer-MINT boundary) — INTERACTIVE rows only, by
+ *  construction. A name that exists only as a managed agent gets the exact managed-path answer
+ *  (never "not granted", which would read as a permissions problem, and never a mint). */
+export declare function ledgerAuthorizeGrant(dir: string): (owner: string, actor: string) => ActorGrant;
+/** The callout's `authorizeActor` hook (CONNECT boundary): the row must still exist — in EITHER
+ *  space (bearers from both exchange paths connect here) — and the bearer's `act.scope` must sit
+ *  within the row's CURRENT scope — a bearer minted before a scope narrowing is refused at
+ *  connect, not honored until expiry. */
+export declare function ledgerAuthorizeConnect(dir: string): (t: ValidatedUserToken) => void;
+/** The channel-ACL resolver over this ledger — the ONE resolver both the callout permission
+ *  supplier uses today and the IdP bridge shares when it needs channel authority (gate 4's "shared
+ *  by both"). Serves bearers from both spaces (unified read). A missing row throws (the callout
+ *  turns it into a signed deny). */
+export declare function ledgerAclResolver(dir: string): AclResolver;
+/** Ensure a filename-hostile owner/actor can never traverse (defense-in-depth behind the grammar
+ *  asserts in {@link rowPath}) — exported for the smoke that pins the property. */
+export declare function ledgerRowFilename(owner: string, actor: string): string;
+/** Where the per-row files live under a provider state dir (for tooling/tests). */
+export declare function actorLedgerDir(dir: string): string;
+/** The managed-agent row space (for tooling/tests). */
+export declare function managedActorLedgerDir(dir: string): string;
+/** Agent bearers are SHORT by design — a spawned agent's endpoint re-exchanges ahead of every
+ *  expiry, so revocation (row deletion) bites a live connection within this window even before
+ *  live eviction lands. There is no upstream IdP proof to cap to; this constant is that cap. */
+export declare const AGENT_BEARER_TTL_SEC = 300;
+/** Generate a fresh per-agent exchange secret (returned to the spawner ONCE) + its ledger hash. */
+export declare function newActorToken(): {
+    actorToken: string;
+    tokenHash: string;
+};
+export declare function hashActorToken(actorToken: string): string;
+/** Authorize one AGENT exchange (`{ owner, actor, actorToken }`, no IdP proof) — MANAGED rows only,
+ *  by construction. The presented secret must hash to the row's (constant-time over the two fixed
+ *  32-byte digests). Every failure is the SAME sentence — a prober must not learn whether an
+ *  (owner, actor) row exists, lives in the other space, or got the secret wrong (the sentence
+ *  still names the operator's likely fix: respawn). */
+export declare function ledgerAuthorizeAgentExchange(dir: string, owner: string, actor: string, actorToken: string): {
+    scope: string[];
+    parent?: string;
+};
+//# sourceMappingURL=ledger.d.ts.map

package/dist/ledger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger.d.ts","sourceRoot":"","sources":["../src/ledger.ts"],"names":[],"mappings":"AA8CA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAMpD,gGAAgG;AAChG,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,eAAe,CAAC;AAExD,sFAAsF;AACtF,MAAM,WAAW,QAAQ;IACvB,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd,8CAA8C;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,mGAAmG;IACnG,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,oGAAoG;IACpG,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,iGAAiG;IACjG,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,wEAAwE;IACxE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oGAAoG;IACpG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;mEAC+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;mFAE+E;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;CACnB;AA2CD;;qCAEqC;AACrC,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,KAAK,CAAC,QAAQ,GAAG;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC,CASlF;AAUD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAEpG;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAEhG;AAED;;gGAEgG;AAChG,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,CAAC,QAAQ,GAAG;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC,GAAG,SAAS,CAUxH;AAoCD;;;;;;;;;;gCAUgC;AAChC,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAkBlF;AAwGD;8EAC8E;AAC9E,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,QAAQ,CAgBjH;AAED;;wGAEwG;AACxG,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAE9E;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAErF;AASD;;0FAE0F;AAC1F,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,UAAU,CAY9F;AAED;;;yCAGyC;AACzC,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,kBAAkB,KAAK,IAAI,CASnF;AAED;;;oCAGoC;AACpC,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,CAM1D;AAED;mFACmF;AACnF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAItE;AAED,mFAAmF;AACnF,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,uDAAuD;AACvD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;gGAEgG;AAChG,eAAO,MAAM,oBAAoB,MAAM,CAAC;AAExC,mGAAmG;AACnG,wBAAgB,aAAa,IAAI;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAGzE;AAED,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;;;uDAIuD;AACvD,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,GACjB;IAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAmBtC"}