@cotal-ai/auth 0.0.0 → 0.11.1

package/dist/provider.js

@@ -0,0 +1,213 @@
+/**
+ * The core `auth-provider` extension — how a composition root gets user-mode auth WITHOUT importing
+ * this package from the CLI (`bin/cotal.ts` imports `@cotal-ai/auth`; `@cotal-ai/cli` resolves the
+ * provider from the registry, generically).
+ *
+ * `prepareServer` is the `cotal up --user-auth` hook. It receives the NARROW provisioning input
+ * (core's {@link AuthPrepareInput}: operator seed + data-account pub/signingSeed + the space-scoped
+ * state dir — never the whole space bundle), makes all persisted material exist, projects the ONE
+ * signing seed the daemon may hold into `service-keys.json`, and hands back:
+ *  - the callout account for the broker config preload,
+ *  - the non-secret client metadata (trust pins) the workstation registry records ({@link
+ *    assertUserAuthInfo} shape — typed in workspace, opaque to core),
+ *  - the service handle: the `auth-service` command name + the readiness contract (poll the
+ *    discovery file the daemon writes only after BOTH planes are bound, then confirm /health).
+ */
+import { registry } from "@cotal-ai/core";
+import { assertUserAuthInfo, homeCotalDir } from "@cotal-ai/workspace";
+import { fetchIdpJwt, loadIdpSession, probeIdpJwks, requireIdpSession } from "./login.js";
+import { deriveOwnerForIdpSubject } from "./derive.js";
+import { findActorUnified, findInteractiveActor, grantManagedActor, newActorToken, revokeManagedActor } from "./ledger.js";
+import { ensureCalloutAuth, ensureIssuer, ensureOwnerSecret, ensurePinnedIdp, loadAuthServiceInfo, loadCalloutAuth, loadOwnerSecret, loadPinnedIdp, saveServiceKeys, } from "./store.js";
+const READY_TIMEOUT_MS = 15_000;
+function pidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export const cotalAuthProvider = {
+    kind: "auth-provider",
+    name: "cotal",
+    async prepareServer(input) {
+        const { space, dir, idpUrl } = input;
+        // On a FRESH enable, prove the IdP actually serves a JWKS before we pin + provision a space
+        // around it — a dead or typo'd `--idp` must fail loud here, not silently boot a broken space
+        // that only errors at the first user connect. Skip on re-up (an already-pinned IdP was validated
+        // at first enable; re-probing every boot would couple mesh liveness to IdP liveness).
+        if (idpUrl && !loadPinnedIdp(dir))
+            await probeIdpJwks(idpUrl);
+        // Pin the IdP FIRST, so a fresh `up --user-auth` without --idp fails on the config error before
+        // any key material is generated.
+        const idp = ensurePinnedIdp(dir, idpUrl);
+        ensureOwnerSecret(dir);
+        await ensureIssuer(dir, space);
+        const callout = await ensureCalloutAuth(dir, { space, operatorSeed: input.operatorSeed, accountPub: input.account.pub });
+        // The daemon's ONLY signing material: the data-account user-minting seed. Written by this
+        // (briefly privileged) call; the long-lived service loads this file, never the space bundle.
+        saveServiceKeys(dir, { dataAccount: { pub: input.account.pub, signingSeed: input.account.signingSeed } });
+        const publicAuth = assertUserAuthInfo({
+            provider: "cotal",
+            idp: { url: idp.url, issuer: idp.issuer, audience: idp.audience },
+        });
+        return {
+            extraAccounts: [{ pub: callout.account.pub, jwt: callout.account.jwt }],
+            publicAuth: publicAuth,
+            service: {
+                command: "auth-service",
+                // Readiness = the daemon wrote its discovery file (which it does only after the callout SUB
+                // is flushed AND the HTTP listener is bound) and /health answers. Poll until timeoutMs, then
+                // THROW with the reason — the caller (`up`) surfaces it loudly (U5), never records a usable
+                // user mesh on a half-started service.
+                async ready({ dir: stateDir, timeoutMs = READY_TIMEOUT_MS }) {
+                    const deadline = Date.now() + timeoutMs;
+                    let lastReason = "the auth service has not written its discovery file yet";
+                    while (Date.now() < deadline) {
+                        try {
+                            const info = loadAuthServiceInfo(stateDir);
+                            if (info && pidAlive(info.pid)) {
+                                // pid-liveness first: a STALE file from a dead prior daemon must never satisfy
+                                // this poll (the daemon also scrubs it at startup and on exit — belt and braces).
+                                const res = await fetch(`${info.url}/health`, { signal: AbortSignal.timeout(2000) });
+                                if (res.ok)
+                                    return { url: info.url };
+                                lastReason = `health probe at ${info.url}/health returned HTTP ${res.status}`;
+                            }
+                            else if (info) {
+                                lastReason = `discovery file names pid ${info.pid}, which is not running (stale entry)`;
+                            }
+                        }
+                        catch (e) {
+                            lastReason = e instanceof Error ? e.message : String(e);
+                        }
+                        await new Promise((r) => setTimeout(r, 200));
+                    }
+                    // No log-path guess here — the CALLER owns the daemon's log location and appends it.
+                    throw new Error(`auth service not ready after ${timeoutMs}ms (${lastReason})`);
+                },
+            },
+        };
+    },
+    /** Client side: this machine's login session → a fresh IdP JWT → the local auth service's
+     *  exchange → the Cotal bearer, plus the space's sentinel creds. NO fallback anywhere; each
+     *  failure is one sentence with the exact operator action (U1/U10/U11 acceptance strings). */
+    async userCredentials({ dir, space, actor, view }) {
+        const idp = loadPinnedIdp(dir);
+        const callout = loadCalloutAuth(dir);
+        if (!idp || !callout)
+            throw new Error(`space "${space}" has no user-auth material on this machine - user-mode connects run where \`cotal up --user-auth\` provisioned the space (remote discovery is not supported yet)`);
+        // The no-fallback login gate: throws the exact `cotal login --idp …` line when not signed in.
+        const session = requireIdpSession(homeCotalDir(), idp.url);
+        // Daemon liveness BEFORE the IdP round-trip: a down auth service must surface its exact
+        // restart recovery (U10) without spending an IdP /token call — and without an unrelated
+        // IdP/network failure masking it. Missing-login stays primary (the session gate above).
+        const info = loadAuthServiceInfo(dir);
+        if (!info || !pidAlive(info.pid))
+            throw new Error(`the user-auth service for space "${space}" is not running - restart it with \`cotal up\` (or \`cotal auth-service --space ${space} --server <broker>\`)`);
+        // Fresh short-lived IdP proof per connect — IdP-side revocation bites HERE, at the next fetch.
+        const idpJwt = await fetchIdpJwt(idp.url, session.token);
+        let res;
+        try {
+            res = await fetch(`${info.url}/exchange`, {
+                method: "POST",
+                headers: { "content-type": "application/json", authorization: `Bearer ${info.cap}` },
+                body: JSON.stringify({ idpToken: idpJwt, actor, ...(view !== undefined ? { view } : {}) }),
+                signal: AbortSignal.timeout(15_000),
+            });
+        }
+        catch (e) {
+            throw new Error(`the user-auth service for space "${space}" did not answer at ${info.url} (${e instanceof Error ? e.message : String(e)}) - restart it with \`cotal up\``);
+        }
+        if (!res.ok) {
+            const body = (await res.json().catch(() => ({})));
+            // A refused exchange is an authenticated denial with the reason (an ungranted actor names
+            // the grant command); surface it verbatim — the service's copy is already operator-exact.
+            throw new Error(`signed in, but the exchange for actor "${actor}"${view ? ` (view "${view}")` : ""} was refused: ${body.error ?? `HTTP ${res.status}`}`);
+        }
+        const out = (await res.json().catch(() => ({})));
+        if (typeof out.token !== "string" || !out.token)
+            throw new Error(`the auth service's exchange returned no token - its build may be stale; restart it with \`cotal up\``);
+        return { bearer: out.token, sentinelCreds: callout.sentinelCreds };
+    },
+    /** WHO the local login is, as this space's derived owner — offline (cached session sub + the
+     *  space's owner secret; no IdP round trip). The spawn paths' "whose agents are these" answer. */
+    async ownerForLogin({ dir, space }) {
+        const idp = loadPinnedIdp(dir);
+        const secret = loadOwnerSecret(dir);
+        if (!idp || !secret)
+            throw new Error(`space "${space}" has no user-auth material on this machine - spawns for a user-auth space run where \`cotal up --user-auth\` provisioned it`);
+        const session = requireIdpSession(homeCotalDir(), idp.url);
+        if (!session.sub)
+            throw new Error(`your cached login for ${idp.url} predates this build (no subject recorded) - re-run \`cotal login --idp ${idp.url}\``);
+        return deriveOwnerForIdpSubject(secret, idp.issuer, session.sub);
+    },
+    /** Offline status read: the pinned IdP, this machine's cached login, and (when the local ledger
+     *  has material) the actor's grant row. No IdP round trip, no service call, no mint — `cotal
+     *  status` must be able to say "not signed in" without becoming a connect. */
+    async userStatus({ dir, space, actor }) {
+        const idp = loadPinnedIdp(dir);
+        if (!idp)
+            throw new Error(`space "${space}" has no user-auth material on this machine - user-mode status reads run where \`cotal up --user-auth\` provisioned the space`);
+        const session = loadIdpSession(homeCotalDir(), idp.url);
+        if (!session?.sub)
+            return { idpUrl: idp.url };
+        const login = { sub: session.sub, expiresAt: session.expiresAt };
+        const secret = loadOwnerSecret(dir);
+        if (!secret)
+            return { idpUrl: idp.url, login };
+        const owner = deriveOwnerForIdpSubject(secret, idp.issuer, session.sub);
+        const row = findInteractiveActor(dir, owner, actor);
+        return {
+            idpUrl: idp.url,
+            login,
+            owner,
+            grant: row
+                ? {
+                    scope: row.scope,
+                    allowSubscribe: row.allowSubscribe,
+                    allowPublish: row.allowPublish,
+                    ...(row.role ? { role: row.role } : {}),
+                    ...(row.label ? { label: row.label } : {}),
+                }
+                : "not-granted",
+        };
+    },
+    /** Spawn-path grant authorship: one atomic MANAGED-AGENT row (its own row space — never
+     *  IdP-exchangeable by construction) carrying the agent's ACLs + the hash of a fresh per-agent
+     *  secret. Upsert semantics rotate the secret on respawn — a captured old secret dies the moment
+     *  its agent is respawned. */
+    async grantAgent({ dir, space, owner, actor, scope, allowSubscribe, allowPublish, role, parent, label }) {
+        const callout = loadCalloutAuth(dir);
+        if (!callout)
+            throw new Error(`space "${space}" has no user-auth material under ${dir} - enable it with \`cotal up --user-auth --idp <url>\` before spawning user-mode agents`);
+        const { actorToken, tokenHash } = newActorToken();
+        grantManagedActor(dir, {
+            owner,
+            actor,
+            scope,
+            allowSubscribe,
+            allowPublish,
+            ...(role ? { role } : {}),
+            ...(parent ? { parent } : {}),
+            ...(label ? { label } : {}),
+            tokenHash,
+        });
+        return { actorToken, sentinelCreds: callout.sentinelCreds };
+    },
+    async revokeAgent({ dir, owner, actor }) {
+        return revokeManagedActor(dir, owner, actor);
+    },
+    /** Fresh read across BOTH row spaces (actor names are disjoint between them, so the unified
+     *  lookup is unambiguous): the manager's control authorization must see an operator's
+     *  `actor grant` scope edit — or a revoke — on the very next stop/attach, hence no caching. */
+    async actorScope({ dir, owner, actor }) {
+        const row = findActorUnified(dir, owner, actor);
+        return row ? [...row.scope] : undefined;
+    },
+    agentBearerCommand: "agent-bearer",
+};
+registry.register(cotalAuthProvider);
+//# sourceMappingURL=provider.js.map

package/dist/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,QAAQ,EAA+D,MAAM,gBAAgB,CAAC;AACvG,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAqB,MAAM,qBAAqB,CAAC;AAC1F,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC1F,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC3H,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,aAAa,EACb,eAAe,GAChB,MAAM,YAAY,CAAC;AAEpB,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC,SAAS,QAAQ,CAAC,GAAW;IAC3B,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAiB;IAC7C,IAAI,EAAE,eAAe;IACrB,IAAI,EAAE,OAAO;IACb,KAAK,CAAC,aAAa,CAAC,KAAuB;QACzC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;QACrC,4FAA4F;QAC5F,6FAA6F;QAC7F,iGAAiG;QACjG,sFAAsF;QACtF,IAAI,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;YAAE,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;QAC9D,gGAAgG;QAChG,iCAAiC;QACjC,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACzC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACvB,MAAM,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACzH,0FAA0F;QAC1F,6FAA6F;QAC7F,eAAe,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAE1G,MAAM,UAAU,GAAiB,kBAAkB,CAAC;YAClD,QAAQ,EAAE,OAAO;YACjB,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE;SAClE,CAAC,CAAC;QACH,OAAO;YACL,aAAa,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACvE,UAAU,EAAE,UAAgD;YAC5D,OAAO,EAAE;gBACP,OAAO,EAAE,cAAc;gBACvB,4FAA4F;gBAC5F,6FAA6F;gBAC7F,4FAA4F;gBAC5F,uCAAuC;gBACvC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,GAAG,gBAAgB,EAAE;oBACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;oBACxC,IAAI,UAAU,GAAG,yDAAyD,CAAC;oBAC3E,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;wBAC7B,IAAI,CAAC;4BACH,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;4BAC3C,IAAI,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gCAC/B,+EAA+E;gCAC/E,kFAAkF;gCAClF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,SAAS,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gCACrF,IAAI,GAAG,CAAC,EAAE;oCAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;gCACrC,UAAU,GAAG,mBAAmB,IAAI,CAAC,GAAG,yBAAyB,GAAG,CAAC,MAAM,EAAE,CAAC;4BAChF,CAAC;iCAAM,IAAI,IAAI,EAAE,CAAC;gCAChB,UAAU,GAAG,4BAA4B,IAAI,CAAC,GAAG,sCAAsC,CAAC;4BAC1F,CAAC;wBACH,CAAC;wBAAC,OAAO,CAAC,EAAE,CAAC;4BACX,UAAU,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;wBAC1D,CAAC;wBACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;oBAC/C,CAAC;oBACD,qFAAqF;oBACrF,MAAM,IAAI,KAAK,CAAC,gCAAgC,SAAS,OAAO,UAAU,GAAG,CAAC,CAAC;gBACjF,CAAC;aACF;SACF,CAAC;IACJ,CAAC;IAED;;kGAE8F;IAC9F,KAAK,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAgE;QAC7G,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO;YAClB,MAAM,IAAI,KAAK,CACb,UAAU,KAAK,mKAAmK,CACnL,CAAC;QACJ,8FAA8F;QAC9F,MAAM,OAAO,GAAG,iBAAiB,CAAC,YAAY,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3D,wFAAwF;QACxF,wFAAwF;QACxF,wFAAwF;QACxF,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,oCAAoC,KAAK,oFAAoF,KAAK,uBAAuB,CAC1J,CAAC;QACJ,+FAA+F;QAC/F,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,WAAW,EAAE;gBACxC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,GAAG,EAAE,EAAE;gBACpF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC1F,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,oCAAoC,KAAK,uBAAuB,IAAI,CAAC,GAAG,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,kCAAkC,CAC1J,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuB,CAAC;YACxE,0FAA0F;YAC1F,0FAA0F;YAC1F,MAAM,IAAI,KAAK,CACb,0CAA0C,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,IAAI,CAAC,KAAK,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,CACxI,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuB,CAAC;QACvE,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,KAAK;YAC7C,MAAM,IAAI,KAAK,CAAC,sGAAsG,CAAC,CAAC;QAC1H,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;IACrE,CAAC;IAED;sGACkG;IAClG,KAAK,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE;QAChC,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM;YACjB,MAAM,IAAI,KAAK,CAAC,UAAU,KAAK,8HAA8H,CAAC,CAAC;QACjK,MAAM,OAAO,GAAG,iBAAiB,CAAC,YAAY,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3D,IAAI,CAAC,OAAO,CAAC,GAAG;YACd,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,GAAG,2EAA2E,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;QAC1I,OAAO,wBAAwB,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACnE,CAAC;IAED;;kFAE8E;IAC9E,KAAK,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE;QACpC,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG;YACN,MAAM,IAAI,KAAK,CACb,UAAU,KAAK,+HAA+H,CAC/I,CAAC;QACJ,MAAM,OAAO,GAAG,cAAc,CAAC,YAAY,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO,EAAE,GAAG;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;QACjE,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,wBAAwB,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACxE,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACpD,OAAO;YACL,MAAM,EAAE,GAAG,CAAC,GAAG;YACf,KAAK;YACL,KAAK;YACL,KAAK,EAAE,GAAG;gBACR,CAAC,CAAC;oBACE,KAAK,EAAE,GAAG,CAAC,KAAK;oBAChB,cAAc,EAAE,GAAG,CAAC,cAAc;oBAClC,YAAY,EAAE,GAAG,CAAC,YAAY;oBAC9B,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC3C;gBACH,CAAC,CAAC,aAAa;SAClB,CAAC;IACJ,CAAC;IAED;;;kCAG8B;IAC9B,KAAK,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;QACrG,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO;YACV,MAAM,IAAI,KAAK,CAAC,UAAU,KAAK,qCAAqC,GAAG,yFAAyF,CAAC,CAAC;QACpK,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,aAAa,EAAE,CAAC;QAClD,iBAAiB,CAAC,GAAG,EAAE;YACrB,KAAK;YACL,KAAK;YACL,KAAK;YACL,cAAc;YACd,YAAY;YACZ,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3B,SAAS;SACV,CAAC,CAAC;QACH,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE;QACrC,OAAO,kBAAkB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;IAED;;mGAE+F;IAC/F,KAAK,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE;QACpC,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAChD,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1C,CAAC;IAED,kBAAkB,EAAE,cAAc;CACnC,CAAC;AAEF,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC"}

package/dist/service.d.ts

@@ -0,0 +1,10 @@
+import { type ParsedArgs } from "@cotal-ai/core";
+/** JWKS max-age seconds — the cache contract's knob. Exported so a rotation tool can compute the
+ *  retire floor (max-age + max bearer TTL) from it. */
+export declare const JWKS_MAX_AGE_SEC = 300;
+/** Run the auth service. Flags: `--space` (required), `--server` (broker URL, required), `--port`
+ *  (loopback HTTP port; default ephemeral). All persisted material must already exist in the
+ *  space-scoped state dir (the provider's `prepareServer` ran at `cotal up`) — a missing piece is a
+ *  fail-loud config error naming the fix, never a silent partial service. */
+export declare function runAuthService(args: ParsedArgs): Promise<void>;
+//# sourceMappingURL=service.d.ts.map

package/dist/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAyCA,OAAO,EAAe,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AA0B9D;uDACuD;AACvD,eAAO,MAAM,gBAAgB,MAAM,CAAC;AAapC;;;6EAG6E;AAC7E,wBAAsB,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CA4FpE"}

package/dist/service.js

@@ -0,0 +1,288 @@
+/**
+ * The AUTH SERVICE daemon — the one server-side process a user-auth space runs alongside its broker
+ * (the delivery-daemon pattern: spawned detached by `cotal up`, pid-filed per space, torn down by
+ * `cotal down`). It hosts BOTH halves of the identity plane, which share state and so belong in one
+ * isolated process rather than smeared across the manager/delivery daemons:
+ *
+ *  - **Plane 2 — the NATS auth callout** ({@link startAuthCallout}): answers `$SYS.REQ.USER.AUTH`
+ *    over its own callout-account connection, validating bearers offline against the LOCAL issuer
+ *    key set and minting scoped data-account user JWTs.
+ *  - **Plane 1 — the token exchange + JWKS, over loopback HTTP**: `POST /exchange` turns a fresh
+ *    IdP JWT (from `cotal login`'s cached session) into a Cotal user bearer via the pinned
+ *    {@link createIdpBridge}; `GET /jwks` publishes the issuer's public keys.
+ *
+ * Least-privilege by construction: the daemon loads ONLY provider-owned projected files from its
+ * space-scoped state dir (`.cotal/auth/<space>/`) — the data-account signing seed arrives via
+ * `service-keys.json` (minting scoped users IS this service's function); the space's operator seed
+ * and account seed never enter this process (`prepareServer` wrote the projection and kept the rest).
+ *
+ * The exchange surface is LOCAL-V1, hardened: loopback bind only; `POST /exchange` requires the
+ * per-start high-entropy capability (`Authorization: Bearer <cap>` — readable only from the 0600
+ * discovery file, so same-user file ACL is the boundary); requests carrying an `Origin` header are
+ * rejected (a browser page can reach loopback; it must not be able to drive the exchange); bodies
+ * must be `application/json`; failed exchanges are rate-limited and logged. No CORS headers, ever.
+ * Remote/cross-machine exchange is explicitly NOT this surface.
+ *
+ * Both trust boundaries authorize against the SAME actor ledger, read fresh per request — a revoke
+ * bites at the next exchange AND the next connect with no restart.
+ *
+ * JWKS cache contract (gate 4, explicit): responses carry `Cache-Control: max-age=300`. A verifier
+ * may cache the set for up to 5 minutes, so a rotated-out (retired) kid MUST stay published for at
+ * least (300s + the max bearer TTL) after rotation before `retire` — otherwise still-live bearers
+ * signed by it fail verification at a cold cache. The local callout uses `issuer.localKeySet()`
+ * (live, in-process) and is exempt.
+ *
+ * Readiness contract: the discovery file (`auth-service.json`) is written only AFTER the callout
+ * subscription is FLUSHED to the broker and the HTTP listener is bound — its existence (plus a
+ * /health probe) IS the readiness signal the provider's `ready()` polls.
+ */
+import { randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+import { connect, credsAuthenticator } from "@nats-io/transport-node";
+import { isReachable } from "@cotal-ai/core";
+import { findCotalRoot, userAuthStateDir } from "@cotal-ai/workspace";
+import { decodeJwt } from "jose";
+import { startAuthCallout } from "./callout.js";
+import { createIdpBridge } from "./idp.js";
+import { pinnedJwksResolver } from "./issuer.js";
+import { calloutPermissions } from "./permissions.js";
+import { AGENT_BEARER_TTL_SEC, ledgerAclResolver, ledgerAuthorizeAgentExchange, ledgerAuthorizeConnect, ledgerAuthorizeGrant, } from "./ledger.js";
+import { clearAuthServiceInfo, loadCalloutAuth, loadIssuer, loadOwnerSecret, loadPinnedIdp, loadServiceKeys, saveAuthServiceInfo, spaceIssuer, } from "./store.js";
+/** JWKS max-age seconds — the cache contract's knob. Exported so a rotation tool can compute the
+ *  retire floor (max-age + max bearer TTL) from it. */
+export const JWKS_MAX_AGE_SEC = 300;
+/** Failed-exchange rate limit: at most this many REFUSED exchanges per rolling minute; further
+ *  attempts get 429 until the window drains. Successes are unthrottled (the CLI's normal path). */
+const FAILED_EXCHANGE_PER_MIN = 30;
+/** Invalid-capability attempts get their OWN window (same size): an unauthenticated local prober
+ *  is throttled AND audited, but never consumes the refused-exchange budget of a caller holding
+ *  the real capability — a cap-less process must not be able to starve legitimate exchanges. */
+const BAD_CAP_PER_MIN = 30;
+/** Run the auth service. Flags: `--space` (required), `--server` (broker URL, required), `--port`
+ *  (loopback HTTP port; default ephemeral). All persisted material must already exist in the
+ *  space-scoped state dir (the provider's `prepareServer` ran at `cotal up`) — a missing piece is a
+ *  fail-loud config error naming the fix, never a silent partial service. */
+export async function runAuthService(args) {
+    const v = args.values;
+    const space = v.space;
+    if (!space)
+        throw new Error("auth-service: --space is required");
+    const server = v.server;
+    if (!server)
+        throw new Error("auth-service: --server is required (the broker this callout serves)");
+    const port = v.port === undefined ? 0 : Number(v.port);
+    if (!Number.isInteger(port) || port < 0 || port > 65535)
+        throw new Error(`auth-service: --port must be a port number, got "${v.port}"`);
+    // The provider's space-scoped state dir — every file this daemon reads lives here. The layout
+    // fact is workspace-owned (userAuthStateDir); this daemon never touches `.cotal/auth/auth.json`.
+    const dir = userAuthStateDir(findCotalRoot(), space);
+    // Scrub any stale discovery file FIRST — a dead prior daemon's entry must never satisfy a
+    // readiness poll for THIS start (the provider's ready() also pid-checks; belt and braces).
+    clearAuthServiceInfo(dir);
+    const keys = loadServiceKeys(dir);
+    const callout = loadCalloutAuth(dir);
+    const issuer = await loadIssuer(dir);
+    const ownerSecret = loadOwnerSecret(dir);
+    const idp = loadPinnedIdp(dir);
+    if (!keys || !callout || !issuer || !ownerSecret || !idp)
+        throw new Error(`auth-service: user-auth material is missing under ${dir} - enable it with \`cotal up --user-auth --idp <url>\``);
+    if (issuer.issuer !== spaceIssuer(space))
+        throw new Error(`auth-service: issuer pin ${issuer.issuer} does not match space "${space}"`);
+    if (!(await isReachable(server, { creds: callout.calloutCreds })))
+        throw new Error(`auth-service: can't reach the broker at ${server} with the callout creds - is the mesh up (with the callout account preloaded)?`);
+    // ---- Plane 2: the callout, on its own callout-account connection ----
+    const nc = await connect({
+        servers: server,
+        authenticator: credsAuthenticator(new TextEncoder().encode(callout.calloutCreds)),
+        name: `cotal:auth-service:${space}`,
+    });
+    startAuthCallout(nc, {
+        xkeySeed: callout.xkey.seed,
+        authAccount: { pub: callout.account.pub, signingSeed: callout.account.signingSeed },
+        dataAccount: { pub: keys.dataAccount.pub, signingSeed: keys.dataAccount.signingSeed },
+        space,
+        token: { key: issuer.localKeySet(), issuer: issuer.issuer },
+        authorizeActor: ledgerAuthorizeConnect(dir),
+        permissionsFor: calloutPermissions(ledgerAclResolver(dir)),
+        log: (l) => console.error(l),
+    });
+    // The subscription must be ON the broker before readiness is signaled — an `up` that recorded a
+    // usable user mesh while the SUB was still in flight would intermittently deny first connects.
+    await nc.flush();
+    // ---- Plane 1: the exchange + JWKS, loopback HTTP ----
+    const bridge = createIdpBridge({
+        idp: { issuer: idp.issuer, audience: idp.audience, key: pinnedJwksResolver(idp.jwksUri) },
+        space,
+        spaceSecret: ownerSecret,
+        issuer,
+        authorizeActor: ledgerAuthorizeGrant(dir),
+    });
+    const cap = randomBytes(32).toString("hex"); // per-start exchange capability (rotates with the daemon)
+    const failures = []; // rolling-window timestamps of REFUSED exchanges
+    const badCaps = []; // rolling-window timestamps of invalid-capability attempts
+    const http = createServer((req, res) => void handle(req, res, { issuer, bridge, cap, failures, badCaps, space, dir }));
+    await new Promise((resolvePort, reject) => {
+        http.once("error", reject);
+        http.listen(port, "127.0.0.1", () => resolvePort());
+    });
+    const addr = http.address();
+    const boundPort = typeof addr === "object" && addr ? addr.port : port;
+    const url = `http://127.0.0.1:${boundPort}`;
+    // Both planes bound — NOW write the discovery file (its existence is the readiness signal).
+    saveAuthServiceInfo(dir, { url, pid: process.pid, cap });
+    console.log(`✓ auth service up (space ${space}) - callout on ${server}, exchange/JWKS at ${url}`);
+    const stop = async () => {
+        clearAuthServiceInfo(dir); // a dead service must not satisfy the next start's readiness poll
+        http.close();
+        await nc.close().catch(() => { });
+        process.exit(0);
+    };
+    process.on("SIGINT", () => void stop());
+    process.on("SIGTERM", () => void stop());
+    // A dropped broker connection is fatal-loud, not a zombie: the supervising `up`/`down` lifecycle
+    // owns restarts, and a callout that silently stopped answering would hang every user connect.
+    await nc.closed().then((err) => {
+        clearAuthServiceInfo(dir);
+        if (err) {
+            console.error(`✗ auth-service: broker connection closed (${err.message}) - exiting`);
+            process.exit(1);
+        }
+        process.exit(0);
+    });
+}
+/** Route one HTTP request. Local-only surface: /jwks (public keys, cacheable), /exchange (IdP JWT →
+ *  bearer; capability-gated), /health. Anything else 404s. Errors are JSON `{ error }`. */
+async function handle(req, res, ctx) {
+    const send = (status, body, headers = {}) => {
+        // No CORS headers, ever — a browser context must never be granted a readable response here.
+        res.writeHead(status, { "content-type": "application/json", ...headers });
+        res.end(JSON.stringify(body));
+    };
+    try {
+        if (req.url === "/health")
+            return send(200, { ok: true, issuer: ctx.issuer.issuer });
+        if (req.url === "/jwks") {
+            if (req.method !== "GET")
+                return send(405, { error: "GET only" });
+            // The explicit cache contract (see the module doc): max-age bounds how stale a verifier's set
+            // may be, which in turn floors how long a retired kid must stay published after rotation.
+            return send(200, ctx.issuer.jwks(), { "cache-control": `max-age=${JWKS_MAX_AGE_SEC}` });
+        }
+        if (req.url === "/exchange") {
+            if (req.method !== "POST")
+                return send(405, { error: "POST only" });
+            // Browser exclusion: a cross-site page CAN reach loopback, but its requests carry `Origin`
+            // (and can't strip it). The CLI never sends one. Reject before touching anything else.
+            if (req.headers.origin !== undefined)
+                return send(403, { error: "browser-origin requests are not served here" });
+            if (!/^application\/json\b/.test(req.headers["content-type"] ?? ""))
+                return send(415, { error: "content-type must be application/json" });
+            // The capability gate: same-user file ACL on the 0600 discovery file is the boundary. An
+            // invalid/missing cap is still a failed exchange attempt — audited and throttled, in its own
+            // window (see BAD_CAP_PER_MIN), before anything downstream is touched.
+            const auth = req.headers.authorization ?? "";
+            if (auth !== `Bearer ${ctx.cap}`) {
+                const now = Date.now();
+                while (ctx.badCaps.length && now - ctx.badCaps[0] > 60_000)
+                    ctx.badCaps.shift();
+                ctx.badCaps.push(now);
+                console.error("auth-service: rejected an exchange with a missing/invalid capability");
+                if (ctx.badCaps.length > BAD_CAP_PER_MIN)
+                    return send(429, { error: "too many invalid-capability attempts - wait a minute and retry" });
+                return send(401, { error: "missing/invalid exchange capability - read it from the space's auth-service.json" });
+            }
+            // Refused-exchange rate limit (probing protection): count only FAILURES.
+            const now = Date.now();
+            while (ctx.failures.length && now - ctx.failures[0] > 60_000)
+                ctx.failures.shift();
+            if (ctx.failures.length >= FAILED_EXCHANGE_PER_MIN)
+                return send(429, { error: "too many refused exchanges - wait a minute and retry" });
+            const body = await readJsonBody(req);
+            const { idpToken, actor, actorToken, owner, ttlSec, view } = body;
+            if (ttlSec !== undefined && typeof ttlSec !== "number")
+                return send(400, { error: "ttlSec must be a number" });
+            if (view !== undefined && typeof view !== "string")
+                return send(400, { error: "view must be a string when present" });
+            // TWO grant types, disjoint by construction: a HUMAN exchange proves an IdP session
+            // (idpToken), an AGENT exchange proves a spawn-time ledger secret (owner + actorToken).
+            // A request presenting both is malformed — refuse rather than pick.
+            if (idpToken !== undefined && actorToken !== undefined)
+                return send(400, { error: "exchange takes idpToken (human) OR owner+actorToken (agent), never both" });
+            if (actorToken !== undefined) {
+                // Elevated views are for signed-in HUMANS only: an agent's secret exchange never mints one,
+                // whatever its ledger row carries (v1 — agents hold no god views).
+                if (view !== undefined)
+                    return send(400, { error: "the managed (agent-secret) exchange never mints elevated views - views ride a signed-in human exchange" });
+                if (typeof owner !== "string" || !owner || typeof actor !== "string" || !actor || typeof actorToken !== "string" || !actorToken)
+                    return send(400, { error: "agent exchange needs { owner: string, actor: string, actorToken: string, ttlSec?: number }" });
+                try {
+                    const grant = ledgerAuthorizeAgentExchange(ctx.dir, owner, actor, actorToken);
+                    const token = await ctx.issuer.issue({
+                        owner,
+                        space: ctx.space,
+                        actor,
+                        scope: grant.scope,
+                        parent: grant.parent,
+                        ttlSec: Math.min(ttlSec ?? AGENT_BEARER_TTL_SEC, AGENT_BEARER_TTL_SEC),
+                    });
+                    const { exp } = decodeJwt(token);
+                    return send(200, { token, owner, exp });
+                }
+                catch (e) {
+                    ctx.failures.push(Date.now());
+                    const reason = e instanceof Error ? e.message : String(e);
+                    console.error(`auth-service: refused an agent exchange: ${reason}`);
+                    return send(401, { error: reason });
+                }
+            }
+            if (typeof idpToken !== "string" || !idpToken || typeof actor !== "string" || !actor)
+                return send(400, { error: "exchange needs { idpToken: string, actor: string, ttlSec?: number, view?: string }" });
+            try {
+                // The bridge validates `view` against the closed enum and the fresh ledger grant — an
+                // unknown or under-scoped view is a refused exchange (audited + throttled like any other).
+                const r = await ctx.bridge.exchange(idpToken, { actor, ttlSec, view: view });
+                return send(200, r);
+            }
+            catch (e) {
+                // A refused exchange (bad IdP token, ungranted actor, expired proof) is an AUTHENTICATED
+                // denial with the reason — the client shows it to the operator verbatim.
+                ctx.failures.push(Date.now());
+                const reason = e instanceof Error ? e.message : String(e);
+                console.error(`auth-service: refused an exchange: ${reason}`);
+                return send(401, { error: reason });
+            }
+        }
+        return send(404, { error: "unknown path - /health, /jwks, /exchange" });
+    }
+    catch (e) {
+        send(400, { error: e instanceof Error ? e.message : String(e) });
+    }
+}
+/** Read + parse a small JSON body, bounded — the exchange payload is an IdP JWT plus an actor name;
+ *  64 KB clears any sane JWT while keeping the loopback surface un-floodable. */
+function readJsonBody(req) {
+    const MAX = 64 * 1024;
+    return new Promise((resolve, reject) => {
+        let size = 0;
+        const chunks = [];
+        req.on("data", (c) => {
+            size += c.length;
+            if (size > MAX) {
+                reject(new Error("request body too large"));
+                req.destroy();
+                return;
+            }
+            chunks.push(c);
+        });
+        req.on("end", () => {
+            try {
+                resolve(JSON.parse(Buffer.concat(chunks).toString("utf8")));
+            }
+            catch {
+                reject(new Error("request body is not valid JSON"));
+            }
+        });
+        req.on("error", reject);
+    });
+}
+//# sourceMappingURL=service.js.map

package/dist/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AACpF,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAuB,MAAM,yBAAyB,CAAC;AAC3F,OAAO,EAAE,WAAW,EAAmB,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,eAAe,EAAkB,MAAM,UAAU,CAAC;AAE3D,OAAO,EAAE,kBAAkB,EAAwB,MAAM,aAAa,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,4BAA4B,EAC5B,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,UAAU,EACV,eAAe,EACf,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,WAAW,GACZ,MAAM,YAAY,CAAC;AAEpB;uDACuD;AACvD,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAEpC;mGACmG;AACnG,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAEnC;;gGAEgG;AAChG,MAAM,eAAe,GAAG,EAAE,CAAC;AAI3B;;;6EAG6E;AAC7E,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAgB;IACnD,MAAM,CAAC,GAAG,IAAI,CAAC,MAAgB,CAAC;IAChC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IACtB,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACxB,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACpG,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK;QACrD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;IAEjF,8FAA8F;IAC9F,iGAAiG;IACjG,MAAM,GAAG,GAAG,gBAAgB,CAAC,aAAa,EAAE,EAAE,KAAK,CAAC,CAAC;IACrD,0FAA0F;IAC1F,2FAA2F;IAC3F,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG;QACtD,MAAM,IAAI,KAAK,CAAC,qDAAqD,GAAG,wDAAwD,CAAC,CAAC;IACpI,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,KAAK,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,4BAA4B,MAAM,CAAC,MAAM,0BAA0B,KAAK,GAAG,CAAC,CAAC;IAE/F,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,gFAAgF,CAAC,CAAC;IAErJ,wEAAwE;IACxE,MAAM,EAAE,GAAmB,MAAM,OAAO,CAAC;QACvC,OAAO,EAAE,MAAM;QACf,aAAa,EAAE,kBAAkB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACjF,IAAI,EAAE,sBAAsB,KAAK,EAAE;KACpC,CAAC,CAAC;IACH,gBAAgB,CAAC,EAAW,EAAE;QAC5B,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI;QAC3B,WAAW,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE;QACnF,WAAW,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE;QACrF,KAAK;QACL,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;QAC3D,cAAc,EAAE,sBAAsB,CAAC,GAAG,CAAC;QAC3C,cAAc,EAAE,kBAAkB,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC1D,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;KAC7B,CAAC,CAAC;IACH,gGAAgG;IAChG,+FAA+F;IAC/F,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IAEjB,wDAAwD;IACxD,MAAM,MAAM,GAAG,eAAe,CAAC;QAC7B,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,EAAE,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;QACzF,KAAK;QACL,WAAW,EAAE,WAAW;QACxB,MAAM;QACN,cAAc,EAAE,oBAAoB,CAAC,GAAG,CAAC;KAC1C,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,0DAA0D;IACvG,MAAM,QAAQ,GAAa,EAAE,CAAC,CAAC,iDAAiD;IAChF,MAAM,OAAO,GAAa,EAAE,CAAC,CAAC,2DAA2D;IACzF,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACvH,MAAM,IAAI,OAAO,CAAO,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE;QAC9C,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,MAAM,GAAG,GAAG,oBAAoB,SAAS,EAAE,CAAC;IAE5C,4FAA4F;IAC5F,mBAAmB,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,4BAA4B,KAAK,kBAAkB,MAAM,sBAAsB,GAAG,EAAE,CAAC,CAAC;IAElG,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;QACtB,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,kEAAkE;QAC7F,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACxC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAEzC,iGAAiG;IACjG,8FAA8F;IAC9F,MAAO,EAA0C,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;QACtE,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,GAAG,EAAE,CAAC;YACR,OAAO,CAAC,KAAK,CAAC,6CAA6C,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC;YACrF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAaD;2FAC2F;AAC3F,KAAK,UAAU,MAAM,CAAC,GAAoB,EAAE,GAAmB,EAAE,GAAe;IAC9E,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,IAAa,EAAE,UAAkC,EAAE,EAAE,EAAE;QACnF,4FAA4F;QAC5F,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;QAC1E,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC;IACF,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACrF,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;YACxB,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;YAClE,8FAA8F;YAC9F,0FAA0F;YAC1F,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,eAAe,EAAE,WAAW,gBAAgB,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,GAAG,CAAC,GAAG,KAAK,WAAW,EAAE,CAAC;YAC5B,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YACpE,2FAA2F;YAC3F,uFAAuF;YACvF,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC,CAAC;YACjH,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;gBACjE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAC;YACvE,yFAAyF;YACzF,6FAA6F;YAC7F,uEAAuE;YACvE,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;YAC7C,IAAI,IAAI,KAAK,UAAU,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC;gBACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBACvB,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM;oBAAE,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBAChF,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACtB,OAAO,CAAC,KAAK,CAAC,sEAAsE,CAAC,CAAC;gBACtF,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,eAAe;oBACtC,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,gEAAgE,EAAE,CAAC,CAAC;gBAChG,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,kFAAkF,EAAE,CAAC,CAAC;YAClH,CAAC;YACD,yEAAyE;YACzE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,OAAO,GAAG,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,MAAM;gBAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnF,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,IAAI,uBAAuB;gBAChD,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,sDAAsD,EAAE,CAAC,CAAC;YACtF,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;YACrC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAO5D,CAAC;YACF,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,MAAM,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC/G,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;YACtH,oFAAoF;YACpF,wFAAwF;YACxF,oEAAoE;YACpE,IAAI,QAAQ,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS;gBACpD,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,yEAAyE,EAAE,CAAC,CAAC;YACzG,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,4FAA4F;gBAC5F,mEAAmE;gBACnE,IAAI,IAAI,KAAK,SAAS;oBACpB,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,wGAAwG,EAAE,CAAC,CAAC;gBACxI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU;oBAC7H,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,4FAA4F,EAAE,CAAC,CAAC;gBAC5H,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,4BAA4B,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;oBAC9E,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;wBACnC,KAAK;wBACL,KAAK,EAAE,GAAG,CAAC,KAAK;wBAChB,KAAK;wBACL,KAAK,EAAE,KAAK,CAAC,KAAK;wBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,oBAAoB,EAAE,oBAAoB,CAAC;qBACvE,CAAC,CAAC;oBACH,MAAM,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;oBACjC,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC1C,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;oBAC9B,MAAM,MAAM,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBAC1D,OAAO,CAAC,KAAK,CAAC,4CAA4C,MAAM,EAAE,CAAC,CAAC;oBACpE,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC;YACD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK;gBAClF,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,oFAAoF,EAAE,CAAC,CAAC;YACpH,IAAI,CAAC;gBACH,sFAAsF;gBACtF,2FAA2F;gBAC3F,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAiC,EAAE,CAAC,CAAC;gBAC1G,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACtB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,yFAAyF;gBACzF,yEAAyE;gBACzE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC9B,MAAM,MAAM,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC1D,OAAO,CAAC,KAAK,CAAC,sCAAsC,MAAM,EAAE,CAAC,CAAC;gBAC9D,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED;iFACiF;AACjF,SAAS,YAAY,CAAC,GAAoB;IACxC,MAAM,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC;IACtB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;YAC3B,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC;YACjB,IAAI,IAAI,GAAG,GAAG,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC;gBAC5C,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;YACtD,CAAC;QACH,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/store.d.ts

@@ -0,0 +1,82 @@
+import { type CalloutAuth, type CalloutProvisionInput } from "./callout.js";
+import { type UserTokenIssuer } from "./issuer.js";
+/** The pinned `iss` for a space's Cotal user bearers — a stable URN, deliberately NOT the auth
+ *  service's URL (the service port is ephemeral; an issuer pin must never change across restarts).
+ *  Both the issuer (mint) and the callout (validate) take it from here — one source, no drift. */
+export declare function spaceIssuer(space: string): string;
+/** Load the persisted callout account material, or undefined if this space never enabled user auth. */
+export declare function loadCalloutAuth(dir: string): CalloutAuth | undefined;
+/** Load-or-create the callout account: first call on a space mints it (operator seed required)
+ *  and persists; every later call returns the SAME account, so the broker config preload and
+ *  previously-issued sentinel creds stay valid. Idempotent. */
+export declare function ensureCalloutAuth(dir: string, input: CalloutProvisionInput): Promise<CalloutAuth>;
+/** Load the persisted issuer (all published kids live; the persisted active kid signs), or undefined
+ *  if this space never enabled user auth. */
+export declare function loadIssuer(dir: string): Promise<UserTokenIssuer | undefined>;
+/** Load-or-create the space's user-bearer issuer: first call generates the Ed25519 signing key and
+ *  persists it under the pinned {@link spaceIssuer} `iss`; later calls return the SAME keys, so
+ *  outstanding bearers keep verifying. A persisted `iss` that disagrees with the space's pin fails
+ *  loud (the material belongs to another space/layout — never sign under a mismatched issuer). */
+export declare function ensureIssuer(dir: string, space: string): Promise<UserTokenIssuer>;
+/** Load the owner-derivation secret, or undefined if this space never enabled user auth. */
+export declare function loadOwnerSecret(dir: string): Uint8Array | undefined;
+/** Load-or-create the per-space owner-derivation secret. There is deliberately NO regenerate path:
+ *  a new secret re-keys every owner in the space (a migration, never an accident). */
+export declare function ensureOwnerSecret(dir: string): Uint8Array;
+/** The persisted pin of THE external IdP this space trusts (plan gate 4: "pin IdP JWKS/issuer/
+ *  audience"). All four strings are frozen at `up --user-auth --idp <url>` time; nothing here is
+ *  ever read from a presented token. Better Auth conventions seed the derivation (issuer/audience =
+ *  the base URL's origin, JWKS under `<base>/jwks`) — a strict-OIDC IdP with different values plugs
+ *  in by editing the pin file deliberately, not by the client guessing. */
+export interface PinnedIdp {
+    /** The auth base URL as given (normalized; the `cotal login --idp` target). */
+    url: string;
+    /** Exact `iss` the IdP mints. */
+    issuer: string;
+    /** Exact `aud` the IdP mints. */
+    audience: string;
+    /** The pinned JWKS URL keys resolve from — the ONLY key path. */
+    jwksUri: string;
+}
+/** Load the pinned IdP, or undefined if this space never pinned one. */
+export declare function loadPinnedIdp(dir: string): PinnedIdp | undefined;
+/** Pin-or-verify the space's IdP. First call REQUIRES a URL (there is no default IdP); later calls
+ *  either omit it (reuse the pin) or must MATCH it — re-pointing a space at a different IdP re-keys
+ *  every derived owner (the issuer is part of the derivation input), a migration this refuses to do
+ *  as a flag side-effect. */
+export declare function ensurePinnedIdp(dir: string, idpUrl?: string): PinnedIdp;
+/** EXACTLY what the long-lived auth service may hold of the space's signing material: the data
+ *  account's pub + user-minting signing seed (minting scoped users at connect time IS the service's
+ *  function) — and nothing else. Written by `prepareServer` (which may briefly see more), loaded by
+ *  the daemon INSTEAD of the space's full trust bundle: the operator seed and the account seed never
+ *  enter the service process. */
+export interface ServiceKeys {
+    dataAccount: {
+        pub: string;
+        signingSeed: string;
+    };
+}
+export declare function loadServiceKeys(dir: string): ServiceKeys | undefined;
+/** Write (or refresh) the service's key projection. Idempotent overwrite — the projection carries
+ *  no identity of its own, it IS the (stable) data-account signing material, so rewriting from the
+ *  same space bundle is a no-op in content. */
+export declare function saveServiceKeys(dir: string, keys: ServiceKeys): void;
+/** Where the RUNNING auth service listens — written by the daemon only after EVERY plane is bound
+ *  (its existence is the readiness signal), read by user-mode connects from other directories on
+ *  this machine. Runtime state, not a trust pin: the port and capability rotate per start.
+ *  `cap` is the per-start exchange capability: /exchange requires `Authorization: Bearer <cap>`,
+ *  so a local process can only exchange if it can read this 0600 file — same-user file ACL is the
+ *  boundary, and browser/off-user processes are shut out of the loopback port. */
+export interface AuthServiceInfo {
+    /** The local exchange/JWKS base URL, e.g. `http://127.0.0.1:53200`. */
+    url: string;
+    pid: number;
+    /** High-entropy per-start exchange capability (hex). NEVER copied into the mesh registry. */
+    cap: string;
+}
+export declare function loadAuthServiceInfo(dir: string): AuthServiceInfo | undefined;
+export declare function saveAuthServiceInfo(dir: string, info: AuthServiceInfo): void;
+/** Remove the discovery file (daemon shutdown / CLI pre-start scrub) so a stale entry can never
+ *  satisfy a readiness poll for the NEXT start. */
+export declare function clearAuthServiceInfo(dir: string): void;
+//# sourceMappingURL=store.d.ts.map