@cotal-ai/auth 0.11.6 → 0.12.0

package/dist/store.js

@@ -1,35 +1,49 @@
 /**
- * On-disk persistence for a space's USER-AUTH material, under the same `.cotal/auth/` dir as the
- * space trust material (explicit-dir APIs, the auth-paths posture: the caller picks the dir, nothing
- * here discovers paths ambiently). Everything is generate-on-first-use and STABLE thereafter — the
- * callout account identity, the issuer signing keys, and the owner-derivation secret must survive
- * restarts, or previously-minted credentials/owners silently break:
+ * Persistence for a space's USER-AUTH material. Everything is generate-on-first-use and STABLE
+ * thereafter — the callout account identity, the issuer signing keys, and the owner-derivation
+ * secret must survive restarts, or previously-minted credentials/owners silently break:
  *
  *  - `callout.json` — the dedicated auth-callout account ({@link CalloutAuth}: account + signing key,
  *    callout service creds, deny-all sentinel creds, xkey). Regenerating it would orphan the account
  *    the broker config preloads; minting it the first time needs the FULL SpaceAuth (operator seed).
  *  - `issuer.json` — the Cotal user-bearer issuer: its pinned `iss` string plus the serialized
  *    Ed25519 signing keys (private JWKs) and the active kid. Losing these kills every outstanding
- *    bearer (rotation is `rotate`/`retire` on the loaded issuer, then {@link saveIssuerFile}).
+ *    bearer (rotation is `rotate`/`retire` on the loaded issuer plus a re-put of the document).
  *  - `owner-secret.json` — the per-space owner-derivation secret (32 random bytes). REGENERATING IT
  *    RE-KEYS EVERY OWNER in the space (same human → different `u_…`), which is a migration, never an
  *    accident — hence load-or-create with no overwrite path.
  *
- * All files 0600 under a 0700 dir (core's secret-fs helpers), atomic writes, versioned JSON with
- * fail-loud parsing (the login session-cache posture: a torn/hand-edited credential file surfaces as
- * one legible sentence, never a raw SyntaxError downstream).
+ * These SECRET kinds (plus `service-keys.json`, the daemon's key projection) read and write through
+ * the {@link SecretStore} seam — the caller composes the store (locally the workspace's
+ * `.cotal`-rooted filesystem store, so keys land byte-for-byte on today's paths; a hosted
+ * composition injects KMS/Vault) and nothing here discovers one ambiently. The store's atomic
+ * whole-value put replaces the explicit temp+rename here; its adapter owns 0600/0700 hardening.
+ *
+ * The NON-SEAM kinds stay explicit-dir filesystem APIs (the auth-paths posture: the caller picks
+ * the dir): the IdP pin (`idp.json`, a trust pin, not a secret) and the auth-service runtime
+ * discovery file (`auth-service.json`, ephemeral pid/port/capability).
+ *
+ * Versioned JSON with fail-loud parsing everywhere (the login session-cache posture: a torn or
+ * hand-edited credential surfaces as one legible sentence, never a raw SyntaxError downstream).
  */
 import { existsSync, readFileSync, rmSync } from "node:fs";
 import { randomBytes } from "node:crypto";
 import { join } from "node:path";
 import { mkSecretDir, writeSecretFileAtomic } from "@cotal-ai/core";
+import { spaceSegment } from "@cotal-ai/workspace";
 import { createCalloutAuth } from "./callout.js";
 import { normalizeIdpUrl } from "./login.js";
 import { createUserTokenIssuer, exportSigningKey, generateSigningKey, importSigningKey, } from "./issuer.js";
-const CALLOUT_FILE = "callout.json";
-const ISSUER_FILE = "issuer.json";
-const OWNER_SECRET_FILE = "owner-secret.json";
 const STORE_VER = 1;
+/** Canonical {@link SecretStore} keys of the four secret kinds — one builder per kind, mirroring
+ *  today's `.cotal/auth/<space>/<file>` layout so the local filesystem composition is unchanged.
+ *  A hosted adapter treats them as opaque ids (its own resolve adds tenant scope). The space
+ *  segment is workspace's ONE guarded encoder (`spaceSegment`, shared with `userAuthStateDir`):
+ *  a `.`/`..`/empty space is refused before any key or path exists, on both surfaces. */
+export const authCalloutKey = (space) => `auth/${spaceSegment(space)}/callout.json`;
+export const authIssuerKey = (space) => `auth/${spaceSegment(space)}/issuer.json`;
+export const authOwnerSecretKey = (space) => `auth/${spaceSegment(space)}/owner-secret.json`;
+export const authServiceKeysKey = (space) => `auth/${spaceSegment(space)}/service-keys.json`;
 /** The pinned `iss` for a space's Cotal user bearers — a stable URN, deliberately NOT the auth
  *  service's URL (the service port is ephemeral; an issuer pin must never change across restarts).
  *  Both the issuer (mint) and the callout (validate) take it from here — one source, no drift. */
@@ -38,55 +52,67 @@ export function spaceIssuer(space) {
         throw new Error("spaceIssuer: a space is required");
     return `urn:cotal:auth:${space}`;
 }
-/** Fail-loud versioned-JSON read: a missing file is undefined; a torn/edited/unknown-version file is
- *  a legible sentence naming the file and the recovery, never a raw parse error downstream. */
-function readStoreFile(path, what) {
-    if (!existsSync(path))
-        return undefined;
+/** Fail-loud versioned-JSON parse, shared by the store-read and file-read paths: a torn/edited/
+ *  unknown-version document is a legible sentence naming WHERE it lives (a store key or a path)
+ *  and the recovery, never a raw parse error downstream. */
+function parseStoreDoc(raw, where, what) {
     let parsed;
     try {
-        parsed = JSON.parse(readFileSync(path, "utf8"));
+        parsed = JSON.parse(raw);
     }
     catch (e) {
-        throw new Error(`${path}: the ${what} file is not valid JSON (${e instanceof Error ? e.message : String(e)}) - restore it from backup; regenerating breaks existing credentials`);
+        throw new Error(`${where}: the ${what} entry is not valid JSON (${e instanceof Error ? e.message : String(e)}) - restore it from backup; regenerating breaks existing credentials`);
     }
     if (parsed === null || typeof parsed !== "object" || parsed.ver !== STORE_VER)
-        throw new Error(`${path}: unknown ${what} version ${String(parsed?.ver)} (expected ${STORE_VER}) - refusing to guess at credential material`);
+        throw new Error(`${where}: unknown ${what} version ${String(parsed?.ver)} (expected ${STORE_VER}) - refusing to guess at credential material`);
     return parsed;
 }
+/** The store-side read: an absent key is undefined; everything else parses fail-loud. The key names
+ *  the location in errors — under the local filesystem composition it IS the `.cotal`-relative path. */
+async function readStoreValue(store, key, what) {
+    const raw = await store.get(key);
+    return raw === undefined ? undefined : parseStoreDoc(raw, key, what);
+}
+/** The file-side read, for the NON-SEAM kinds only (the IdP pin, service runtime discovery). */
+function readStoreFile(path, what) {
+    if (!existsSync(path))
+        return undefined;
+    return parseStoreDoc(readFileSync(path, "utf8"), path, what);
+}
 /** Load the persisted callout account material, or undefined if this space never enabled user auth. */
-export function loadCalloutAuth(dir) {
-    const f = readStoreFile(join(dir, CALLOUT_FILE), "callout account");
+export async function loadCalloutAuth(store, space) {
+    const key = authCalloutKey(space);
+    const f = await readStoreValue(store, key, "callout account");
     if (!f)
         return undefined;
     const c = f.callout;
     if (!c?.account?.pub || !c.account.jwt || !c.calloutCreds || !c.sentinelCreds || !c.xkey?.seed)
-        throw new Error(`${join(dir, CALLOUT_FILE)}: malformed callout account material - restore it from backup; regenerating orphans the preloaded auth account`);
+        throw new Error(`${key}: malformed callout account material - restore it from backup; regenerating orphans the preloaded auth account`);
     return c;
 }
 /** Load-or-create the callout account: first call on a space mints it (operator seed required)
  *  and persists; every later call returns the SAME account, so the broker config preload and
  *  previously-issued sentinel creds stay valid. Idempotent. */
-export async function ensureCalloutAuth(dir, input) {
-    const existing = loadCalloutAuth(dir);
+export async function ensureCalloutAuth(store, input) {
+    const existing = await loadCalloutAuth(store, input.space);
     if (existing)
         return existing;
     const callout = await createCalloutAuth(input);
-    mkSecretDir(dir); // harden BEFORE the secret lands
-    writeSecretFileAtomic(join(dir, CALLOUT_FILE), JSON.stringify({ ver: STORE_VER, callout }, null, 2));
+    await store.put(authCalloutKey(input.space), JSON.stringify({ ver: STORE_VER, callout }, null, 2));
     return callout;
 }
 /** Load the persisted issuer (all published kids live; the persisted active kid signs), or undefined
  *  if this space never enabled user auth. */
-export async function loadIssuer(dir) {
-    const f = readStoreFile(join(dir, ISSUER_FILE), "issuer key");
+export async function loadIssuer(store, space) {
+    const key = authIssuerKey(space);
+    const f = await readStoreValue(store, key, "issuer key");
     if (!f)
         return undefined;
     if (!f.issuer || !Array.isArray(f.keys) || !f.keys.length || !f.activeKid)
-        throw new Error(`${join(dir, ISSUER_FILE)}: malformed issuer key file - restore it from backup; regenerating kills every outstanding bearer`);
+        throw new Error(`${key}: malformed issuer key material - restore it from backup; regenerating kills every outstanding bearer`);
     const active = f.keys.find((k) => k.kid === f.activeKid);
     if (!active)
-        throw new Error(`${join(dir, ISSUER_FILE)}: active kid ${f.activeKid} is not in the key set - restore it from backup`);
+        throw new Error(`${key}: active kid ${f.activeKid} is not in the key set - restore it from backup`);
     // createUserTokenIssuer starts with one active key; rotate() adds the rest (each rotate re-points
     // active, so feed the non-active keys THROUGH rotate and finish on the persisted active kid).
     const issuer = createUserTokenIssuer({ issuer: f.issuer, key: await importSigningKey(active) });
@@ -101,38 +127,37 @@ export async function loadIssuer(dir) {
  *  persists it under the pinned {@link spaceIssuer} `iss`; later calls return the SAME keys, so
  *  outstanding bearers keep verifying. A persisted `iss` that disagrees with the space's pin fails
  *  loud (the material belongs to another space/layout — never sign under a mismatched issuer). */
-export async function ensureIssuer(dir, space) {
+export async function ensureIssuer(store, space) {
     const iss = spaceIssuer(space);
-    const existing = await loadIssuer(dir);
+    const existing = await loadIssuer(store, space);
     if (existing) {
         if (existing.issuer !== iss)
-            throw new Error(`${join(dir, ISSUER_FILE)}: persisted issuer "${existing.issuer}" != this space's pin "${iss}" - the material belongs to a different space; refusing to mint under it`);
+            throw new Error(`${authIssuerKey(space)}: persisted issuer "${existing.issuer}" != this space's pin "${iss}" - the material belongs to a different space; refusing to mint under it`);
         return existing;
     }
     const key = await generateSigningKey();
-    mkSecretDir(dir);
-    writeSecretFileAtomic(join(dir, ISSUER_FILE), JSON.stringify({ ver: STORE_VER, issuer: iss, activeKid: key.kid, keys: [await exportSigningKey(key)] }, null, 2));
+    await store.put(authIssuerKey(space), JSON.stringify({ ver: STORE_VER, issuer: iss, activeKid: key.kid, keys: [await exportSigningKey(key)] }, null, 2));
     return createUserTokenIssuer({ issuer: iss, key });
 }
 /** Load the owner-derivation secret, or undefined if this space never enabled user auth. */
-export function loadOwnerSecret(dir) {
-    const f = readStoreFile(join(dir, OWNER_SECRET_FILE), "owner secret");
+export async function loadOwnerSecret(store, space) {
+    const key = authOwnerSecretKey(space);
+    const f = await readStoreValue(store, key, "owner secret");
     if (!f)
         return undefined;
     const secret = Buffer.from(f.secretB64 ?? "", "base64");
     if (secret.byteLength !== 32)
-        throw new Error(`${join(dir, OWNER_SECRET_FILE)}: malformed owner secret - restore it from backup; a regenerated secret RE-KEYS EVERY OWNER in the space`);
+        throw new Error(`${key}: malformed owner secret - restore it from backup; a regenerated secret RE-KEYS EVERY OWNER in the space`);
     return new Uint8Array(secret);
 }
 /** Load-or-create the per-space owner-derivation secret. There is deliberately NO regenerate path:
  *  a new secret re-keys every owner in the space (a migration, never an accident). */
-export function ensureOwnerSecret(dir) {
-    const existing = loadOwnerSecret(dir);
+export async function ensureOwnerSecret(store, space) {
+    const existing = await loadOwnerSecret(store, space);
     if (existing)
         return existing;
     const secret = randomBytes(32);
-    mkSecretDir(dir);
-    writeSecretFileAtomic(join(dir, OWNER_SECRET_FILE), JSON.stringify({ ver: STORE_VER, secretB64: Buffer.from(secret).toString("base64") }, null, 2));
+    await store.put(authOwnerSecretKey(space), JSON.stringify({ ver: STORE_VER, secretB64: Buffer.from(secret).toString("base64") }, null, 2));
     return new Uint8Array(secret);
 }
 // ---- the pinned external IdP ----
@@ -169,22 +194,20 @@ export function ensurePinnedIdp(dir, idpUrl) {
     writeSecretFileAtomic(join(dir, IDP_FILE), JSON.stringify({ ver: STORE_VER, ...pin }, null, 2));
     return pin;
 }
-// ---- the auth service's own key projection ----
-const SERVICE_KEYS_FILE = "service-keys.json";
-export function loadServiceKeys(dir) {
-    const f = readStoreFile(join(dir, SERVICE_KEYS_FILE), "service key projection");
+export async function loadServiceKeys(store, space) {
+    const key = authServiceKeysKey(space);
+    const f = await readStoreValue(store, key, "service key projection");
     if (!f)
         return undefined;
     if (!f.dataAccount?.pub || !f.dataAccount.signingSeed)
-        throw new Error(`${join(dir, SERVICE_KEYS_FILE)}: malformed service key projection - re-run \`cotal up --user-auth\` to rewrite it`);
+        throw new Error(`${key}: malformed service key projection - re-run \`cotal up --user-auth\` to rewrite it`);
     return { dataAccount: { pub: f.dataAccount.pub, signingSeed: f.dataAccount.signingSeed } };
 }
 /** Write (or refresh) the service's key projection. Idempotent overwrite — the projection carries
  *  no identity of its own, it IS the (stable) data-account signing material, so rewriting from the
  *  same space bundle is a no-op in content. */
-export function saveServiceKeys(dir, keys) {
-    mkSecretDir(dir);
-    writeSecretFileAtomic(join(dir, SERVICE_KEYS_FILE), JSON.stringify({ ver: STORE_VER, ...keys }, null, 2));
+export async function saveServiceKeys(store, space, keys) {
+    await store.put(authServiceKeysKey(space), JSON.stringify({ ver: STORE_VER, ...keys }, null, 2));
 }
 // ---- the auth-service runtime discovery file ----
 const SERVICE_FILE = "auth-service.json";

package/dist/store.js.map

@@ -1 +1 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAgD,MAAM,cAAc,CAAC;AAC/F,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,GAGjB,MAAM,aAAa,CAAC;AAErB,MAAM,YAAY,GAAG,cAAc,CAAC;AACpC,MAAM,WAAW,GAAG,aAAa,CAAC;AAClC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAC9C,MAAM,SAAS,GAAG,CAAC,CAAC;AAEpB;;kGAEkG;AAClG,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAChE,OAAO,kBAAkB,KAAK,EAAE,CAAC;AACnC,CAAC;AAED;+FAC+F;AAC/F,SAAS,aAAa,CAA4B,IAAY,EAAE,IAAY;IAC1E,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,MAAS,CAAC;IACd,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAM,CAAC;IACvD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,SAAS,IAAI,4BAA4B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,sEAAsE,CAAC,CAAC;IACpL,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;QAC3E,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,aAAa,IAAI,YAAY,MAAM,CAAE,MAA4B,EAAE,GAAG,CAAC,cAAc,SAAS,8CAA8C,CAAC,CAAC;IACvK,OAAO,MAAM,CAAC;AAChB,CAAC;AASD,uGAAuG;AACvG,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,CAAC,GAAG,aAAa,CAAc,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,iBAAiB,CAAC,CAAC;IACjF,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;IACpB,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI;QAC5F,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,gHAAgH,CAAC,CAAC;IAC9J,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;+DAE+D;AAC/D,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAW,EAAE,KAA4B;IAC/E,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC/C,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,iCAAiC;IACnD,qBAAqB,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAwB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3H,OAAO,OAAO,CAAC;AACjB,CAAC;AAWD;6CAC6C;AAC7C,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAW;IAC1C,MAAM,CAAC,GAAG,aAAa,CAAa,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,YAAY,CAAC,CAAC;IAC1E,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,SAAS;QACvE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,mGAAmG,CAAC,CAAC;IAChJ,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM;QACT,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,gBAAgB,CAAC,CAAC,SAAS,iDAAiD,CAAC,CAAC;IACzH,kGAAkG;IAClG,8FAA8F;IAC9F,MAAM,MAAM,GAAG,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAChG,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI;QAAE,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,SAAS;YAAE,MAAM,CAAC,MAAM,CAAC,MAAM,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5F,IAAI,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,SAAS;QAAE,MAAM,CAAC,MAAM,CAAC,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;IACtF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;kGAGkG;AAClG,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW,EAAE,KAAa;IAC3D,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YACzB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,uBAAuB,QAAQ,CAAC,MAAM,0BAA0B,GAAG,0EAA0E,CAAC,CAAC;QAC1L,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,kBAAkB,EAAE,CAAC;IACvC,WAAW,CAAC,GAAG,CAAC,CAAC;IACjB,qBAAqB,CACnB,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,EACtB,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC,EAAuB,EAAE,IAAI,EAAE,CAAC,CAAC,CACvI,CAAC;IACF,OAAO,qBAAqB,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;AACrD,CAAC;AAUD,4FAA4F;AAC5F,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,CAAC,GAAG,aAAa,CAAkB,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,EAAE,cAAc,CAAC,CAAC;IACvF,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE;QAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,0GAA0G,CAAC,CAAC;IAC7J,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED;sFACsF;AACtF,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC/B,WAAW,CAAC,GAAG,CAAC,CAAC;IACjB,qBAAqB,CACnB,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,EAC5B,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAA4B,EAAE,IAAI,EAAE,CAAC,CAAC,CACzH,CAAC;IACF,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,oCAAoC;AAEpC,MAAM,QAAQ,GAAG,UAAU,CAAC;AAsB5B,wEAAwE;AACxE,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,CAAC,GAAG,aAAa,CAAU,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS,CAAC,CAAC;IACjE,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,OAAO;QAClD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,wEAAwE,CAAC,CAAC;IAClH,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;AACpF,CAAC;AAED;;;6BAG6B;AAC7B,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,MAAe;IAC1D,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,QAAQ,CAAC,GAAG;YACjD,MAAM,IAAI,KAAK,CACb,iCAAiC,QAAQ,CAAC,GAAG,WAAW,MAAM,qCAAqC;gBACjG,8CAA8C,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,+BAA+B,CACnG,CAAC;QACJ,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,MAAM;QACT,MAAM,IAAI,KAAK,CAAC,0GAA0G,CAAC,CAAC;IAC9H,0FAA0F;IAC1F,yFAAyF;IACzF,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,MAAM,GAAG,GAAc,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,OAAO,EAAE,CAAC;IACzF,WAAW,CAAC,GAAG,CAAC,CAAC;IACjB,qBAAqB,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,GAAG,EAAoB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAClH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,kDAAkD;AAElD,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAe9C,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,CAAC,GAAG,aAAa,CAAkB,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,EAAE,wBAAwB,CAAC,CAAC;IACjG,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW;QACnD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,oFAAoF,CAAC,CAAC;IACvI,OAAO,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC;AAC7F,CAAC;AAED;;+CAE+C;AAC/C,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,IAAiB;IAC5D,WAAW,CAAC,GAAG,CAAC,CAAC;IACjB,qBAAqB,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,IAAI,EAA4B,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AACtI,CAAC;AAED,oDAAoD;AAEpD,MAAM,YAAY,GAAG,mBAAmB,CAAC;AAoBzC,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,MAAM,CAAC,GAAG,aAAa,CAAc,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,mBAAmB,CAAC,CAAC;IACnF,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,GAAG;QAC/C,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,qFAAqF,CAAC,CAAC;IACnI,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAW,EAAE,IAAqB;IACpE,WAAW,CAAC,GAAG,CAAC,CAAC;IACjB,qBAAqB,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,IAAI,EAAwB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC7H,CAAC;AAED;mDACmD;AACnD,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACnD,CAAC"}
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAoB,MAAM,gBAAgB,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAgD,MAAM,cAAc,CAAC;AAC/F,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,GAGjB,MAAM,aAAa,CAAC;AAErB,MAAM,SAAS,GAAG,CAAC,CAAC;AAEpB;;;;yFAIyF;AACzF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,QAAQ,YAAY,CAAC,KAAK,CAAC,eAAe,CAAC;AACpG,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,QAAQ,YAAY,CAAC,KAAK,CAAC,cAAc,CAAC;AAClG,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,QAAQ,YAAY,CAAC,KAAK,CAAC,oBAAoB,CAAC;AAC7G,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,QAAQ,YAAY,CAAC,KAAK,CAAC,oBAAoB,CAAC;AAE7G;;kGAEkG;AAClG,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAChE,OAAO,kBAAkB,KAAK,EAAE,CAAC;AACnC,CAAC;AAED;;4DAE4D;AAC5D,SAAS,aAAa,CAA4B,GAAW,EAAE,KAAa,EAAE,IAAY;IACxF,IAAI,MAAS,CAAC;IACd,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAM,CAAC;IAChC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,6BAA6B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,sEAAsE,CAAC,CAAC;IACtL,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;QAC3E,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,aAAa,IAAI,YAAY,MAAM,CAAE,MAA4B,EAAE,GAAG,CAAC,cAAc,SAAS,8CAA8C,CAAC,CAAC;IACxK,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;wGACwG;AACxG,KAAK,UAAU,cAAc,CAA4B,KAAkB,EAAE,GAAW,EAAE,IAAY;IACpG,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAI,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;AAC1E,CAAC;AAED,gGAAgG;AAChG,SAAS,aAAa,CAA4B,IAAY,EAAE,IAAY;IAC1E,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,OAAO,aAAa,CAAI,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAClE,CAAC;AASD,uGAAuG;AACvG,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAkB,EAAE,KAAa;IACrE,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,CAAC,GAAG,MAAM,cAAc,CAAc,KAAK,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;IAC3E,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;IACpB,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI;QAC5F,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,gHAAgH,CAAC,CAAC;IAC1I,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;+DAE+D;AAC/D,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAkB,EAAE,KAA4B;IACtF,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3D,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAwB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACzH,OAAO,OAAO,CAAC;AACjB,CAAC;AAWD;6CAC6C;AAC7C,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAkB,EAAE,KAAa;IAChE,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,CAAC,GAAG,MAAM,cAAc,CAAa,KAAK,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;IACrE,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,SAAS;QACvE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,uGAAuG,CAAC,CAAC;IACjI,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM;QACT,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,gBAAgB,CAAC,CAAC,SAAS,iDAAiD,CAAC,CAAC;IACtG,kGAAkG;IAClG,8FAA8F;IAC9F,MAAM,MAAM,GAAG,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAChG,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI;QAAE,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,SAAS;YAAE,MAAM,CAAC,MAAM,CAAC,MAAM,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5F,IAAI,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,SAAS;QAAE,MAAM,CAAC,MAAM,CAAC,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;IACtF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;kGAGkG;AAClG,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAkB,EAAE,KAAa;IAClE,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAChD,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YACzB,MAAM,IAAI,KAAK,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,uBAAuB,QAAQ,CAAC,MAAM,0BAA0B,GAAG,0EAA0E,CAAC,CAAC;QACxL,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,kBAAkB,EAAE,CAAC;IACvC,MAAM,KAAK,CAAC,GAAG,CACb,aAAa,CAAC,KAAK,CAAC,EACpB,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC,EAAuB,EAAE,IAAI,EAAE,CAAC,CAAC,CACvI,CAAC;IACF,OAAO,qBAAqB,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;AACrD,CAAC;AAUD,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAkB,EAAE,KAAa;IACrE,MAAM,GAAG,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,CAAC,GAAG,MAAM,cAAc,CAAkB,KAAK,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;IAC5E,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE;QAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,0GAA0G,CAAC,CAAC;IACpI,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED;sFACsF;AACtF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAkB,EAAE,KAAa;IACvE,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACrD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC/B,MAAM,KAAK,CAAC,GAAG,CACb,kBAAkB,CAAC,KAAK,CAAC,EACzB,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAA4B,EAAE,IAAI,EAAE,CAAC,CAAC,CACzH,CAAC;IACF,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,oCAAoC;AAEpC,MAAM,QAAQ,GAAG,UAAU,CAAC;AAsB5B,wEAAwE;AACxE,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,CAAC,GAAG,aAAa,CAAU,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS,CAAC,CAAC;IACjE,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,OAAO;QAClD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,wEAAwE,CAAC,CAAC;IAClH,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;AACpF,CAAC;AAED;;;6BAG6B;AAC7B,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,MAAe;IAC1D,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,QAAQ,CAAC,GAAG;YACjD,MAAM,IAAI,KAAK,CACb,iCAAiC,QAAQ,CAAC,GAAG,WAAW,MAAM,qCAAqC;gBACjG,8CAA8C,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,+BAA+B,CACnG,CAAC;QACJ,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,MAAM;QACT,MAAM,IAAI,KAAK,CAAC,0GAA0G,CAAC,CAAC;IAC9H,0FAA0F;IAC1F,yFAAyF;IACzF,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,MAAM,GAAG,GAAc,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,OAAO,EAAE,CAAC;IACzF,WAAW,CAAC,GAAG,CAAC,CAAC;IACjB,qBAAqB,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,GAAG,EAAoB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAClH,OAAO,GAAG,CAAC;AACb,CAAC;AAiBD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAkB,EAAE,KAAa;IACrE,MAAM,GAAG,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,CAAC,GAAG,MAAM,cAAc,CAAkB,KAAK,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;IACtF,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW;QACnD,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,oFAAoF,CAAC,CAAC;IAC9G,OAAO,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC;AAC7F,CAAC;AAED;;+CAE+C;AAC/C,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAkB,EAAE,KAAa,EAAE,IAAiB;IACxF,MAAM,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,IAAI,EAA4B,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC7H,CAAC;AAED,oDAAoD;AAEpD,MAAM,YAAY,GAAG,mBAAmB,CAAC;AAoBzC,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,MAAM,CAAC,GAAG,aAAa,CAAc,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,mBAAmB,CAAC,CAAC;IACnF,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,GAAG;QAC/C,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,qFAAqF,CAAC,CAAC;IACnI,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAW,EAAE,IAAqB;IACpE,WAAW,CAAC,GAAG,CAAC,CAAC;IACjB,qBAAqB,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,IAAI,EAAwB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC7H,CAAC;AAED;mDACmD;AACnD,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACnD,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cotal-ai/auth",
   "description": "Cotal per-user auth bridge: opaque owner-token derivation and strict user-token validation for the NATS auth-callout cutover (Plane 1 ↔ Plane 2).",
-  "version": "0.11.6",
+  "version": "0.12.0",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -22,8 +22,8 @@
     "@nats-io/nkeys": "^2.0.3",
     "@nats-io/transport-node": "^3.4.0",
     "jose": "^6.2.3",
-    "@cotal-ai/core": "0.11.6",
-    "@cotal-ai/workspace": "0.11.6"
+    "@cotal-ai/core": "0.12.0",
+    "@cotal-ai/workspace": "0.12.0"
   },
   "devDependencies": {
     "better-auth": "^1.6.23"
@@ -36,6 +36,7 @@
   },
   "scripts": {
     "typecheck": "tsc -p tsconfig.json --noEmit",
-    "build": "tsc -p tsconfig.json"
+    "build": "tsc -p tsconfig.json",
+    "test": "tsx smoke/backup-continuity.smoke.ts && tsx smoke/views.smoke.ts"
   }
 }