@cotal-ai/auth 0.12.0 → 0.13.0

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 export { deriveOwnerToken, deriveOwnerForIdpSubject } from "./derive.js";
 export { AUTH_CALLOUT_SUBJECT, createCalloutAuth, startAuthCallout, type CalloutAuth, type CalloutProvisionInput, type CalloutConnection, type CalloutMsg, type StartAuthCalloutOpts, } from "./callout.js";
-export { validateUserToken, USER_TOKEN_VER, MAX_TOKEN_TTL_SEC, USER_TOKEN_VIEWS, VIEW_REQUIRED_SCOPE, type UserTokenActor, type UserTokenView, type ValidatedUserToken, type ValidateUserTokenOpts, } from "./token.js";
+export { validateUserToken, assertCredentialIdClaim, USER_TOKEN_VER, MAX_TOKEN_TTL_SEC, USER_TOKEN_VIEWS, VIEW_REQUIRED_SCOPE, type UserTokenActor, type UserTokenView, type ValidatedUserToken, type ValidateUserTokenOpts, } from "./token.js";
 export { USER_TOKEN_ALG, createUserTokenIssuer, generateSigningKey, exportSigningKey, importSigningKey, pinnedJwksResolver, type SigningKey, type SerializedSigningKey, type IssueClaims, type UserTokenIssuer, type CreateIssuerOpts, } from "./issuer.js";
 export { createIdpBridge, type IdpConfig, type ActorGrant, type CreateIdpBridgeOpts, type ExchangeResult, type IdpBridge, } from "./idp.js";
 export { deviceLogin, establishIdpSession, fetchIdpJwt, revokeIdpSession, loadIdpSession, saveIdpSession, deleteIdpSession, requireIdpSession, normalizeIdpUrl, probeIdpJwks, type IdpSession, type DeviceLoginOpts, type DeviceLoginPrompt, } from "./login.js";
@@ -8,7 +8,10 @@ export { calloutPermissions, type AclResolver } from "./permissions.js";
 export { USER_AUTH_TRUST_SCHEME, userAuthTrustFingerprint, validateRetainedManagedAgent, } from "./continuity.js";
 export { authCalloutKey, authIssuerKey, authOwnerSecretKey, authServiceKeysKey, clearAuthServiceInfo, ensureCalloutAuth, ensureIssuer, ensureOwnerSecret, ensurePinnedIdp, loadAuthServiceInfo, loadCalloutAuth, loadIssuer, loadOwnerSecret, loadPinnedIdp, loadServiceKeys, saveAuthServiceInfo, saveServiceKeys, spaceIssuer, type AuthServiceInfo, type PinnedIdp, type ServiceKeys, } from "./store.js";
 export { actorLedgerDir, managedActorLedgerDir, findInteractiveActor, findManagedActor, findActorUnified, grantActor, grantManagedActor, ledgerAclResolver, ledgerAuthorizeConnect, ledgerAuthorizeGrant, ledgerAuthorizeAgentExchange, ledgerRowFilename, loadActorLedger, revokeActor, revokeManagedActor, newActorToken, hashActorToken, AGENT_BEARER_TTL_SEC, type ActorKind, type ActorRow, } from "./ledger.js";
-export { runAuthService, JWKS_MAX_AGE_SEC } from "./service.js";
+export { runAuthService, openAuthAuthorityPlane, JWKS_MAX_AGE_SEC, type AuthAuthorityPlane } from "./service.js";
+export { authConnectReaderGrants, openConnectReader, authorizeConnectCredential, type ConnectReader, } from "./connect-reader.js";
 export { cotalAuthProvider } from "./provider.js";
 import "./commands.js";
+export { openSessionAuthStore, kvSessionLedger, sessionRedemptionHooks, closeSession, sweepSessions, kvServeIssuanceGate, type SessionAuthStore, type EndpointGateRow, type SessionSigner, type SessionHookDeps, type SessionCloser } from "./session-ledger.js";
+export { openLifecycleRegistry, openLifecycleMappingReader, readLifecycleMappingLeader, lifecycleProcessEpochReader, type LifecycleRegistry, type LifecycleMappingReader, type LifecycleMapping, type EpGateRow, } from "./lifecycle-registry.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,WAAW,EAChB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,oBAAoB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,GAC3B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,UAAU,EACf,KAAK,oBAAoB,EACzB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,eAAe,EACf,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,SAAS,GACf,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAE,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,UAAU,EACV,eAAe,EACf,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,WAAW,EACX,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,WAAW,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,oBAAoB,EACpB,4BAA4B,EAC5B,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,oBAAoB,EACpB,KAAK,SAAS,EACd,KAAK,QAAQ,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,WAAW,EAChB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,oBAAoB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,GAC3B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,UAAU,EACf,KAAK,oBAAoB,EACzB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,eAAe,EACf,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,SAAS,GACf,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAE,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,UAAU,EACV,eAAe,EACf,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,WAAW,EACX,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,WAAW,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,oBAAoB,EACpB,4BAA4B,EAC5B,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,oBAAoB,EACpB,KAAK,SAAS,EACd,KAAK,QAAQ,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAKjH,OAAO,EACL,uBAAuB,EAAE,iBAAiB,EAAE,0BAA0B,EACtE,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,eAAe,CAAC;AAIvB,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,sBAAsB,EAAE,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,KAAK,gBAAgB,EAAE,KAAK,eAAe,EAAE,KAAK,aAAa,EAAE,KAAK,eAAe,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAQjQ,OAAO,EACL,qBAAqB,EAAE,0BAA0B,EACjD,0BAA0B,EAAE,2BAA2B,EACvD,KAAK,iBAAiB,EAAE,KAAK,sBAAsB,EAAE,KAAK,gBAAgB,EAAE,KAAK,SAAS,GAC3F,MAAM,yBAAyB,CAAC"}

package/dist/index.js

@@ -1,6 +1,6 @@
 export { deriveOwnerToken, deriveOwnerForIdpSubject } from "./derive.js";
 export { AUTH_CALLOUT_SUBJECT, createCalloutAuth, startAuthCallout, } from "./callout.js";
-export { validateUserToken, USER_TOKEN_VER, MAX_TOKEN_TTL_SEC, USER_TOKEN_VIEWS, VIEW_REQUIRED_SCOPE, } from "./token.js";
+export { validateUserToken, assertCredentialIdClaim, USER_TOKEN_VER, MAX_TOKEN_TTL_SEC, USER_TOKEN_VIEWS, VIEW_REQUIRED_SCOPE, } from "./token.js";
 export { USER_TOKEN_ALG, createUserTokenIssuer, generateSigningKey, exportSigningKey, importSigningKey, pinnedJwksResolver, } from "./issuer.js";
 export { createIdpBridge, } from "./idp.js";
 export { deviceLogin, establishIdpSession, fetchIdpJwt, revokeIdpSession, loadIdpSession, saveIdpSession, deleteIdpSession, requireIdpSession, normalizeIdpUrl, probeIdpJwks, } from "./login.js";
@@ -8,7 +8,34 @@ export { calloutPermissions } from "./permissions.js";
 export { USER_AUTH_TRUST_SCHEME, userAuthTrustFingerprint, validateRetainedManagedAgent, } from "./continuity.js";
 export { authCalloutKey, authIssuerKey, authOwnerSecretKey, authServiceKeysKey, clearAuthServiceInfo, ensureCalloutAuth, ensureIssuer, ensureOwnerSecret, ensurePinnedIdp, loadAuthServiceInfo, loadCalloutAuth, loadIssuer, loadOwnerSecret, loadPinnedIdp, loadServiceKeys, saveAuthServiceInfo, saveServiceKeys, spaceIssuer, } from "./store.js";
 export { actorLedgerDir, managedActorLedgerDir, findInteractiveActor, findManagedActor, findActorUnified, grantActor, grantManagedActor, ledgerAclResolver, ledgerAuthorizeConnect, ledgerAuthorizeGrant, ledgerAuthorizeAgentExchange, ledgerRowFilename, loadActorLedger, revokeActor, revokeManagedActor, newActorToken, hashActorToken, AGENT_BEARER_TTL_SEC, } from "./ledger.js";
-export { runAuthService, JWKS_MAX_AGE_SEC } from "./service.js";
+export { runAuthService, openAuthAuthorityPlane, JWKS_MAX_AGE_SEC } from "./service.js";
+// The R1 connect-arm deny-new READ seam (SPEC 13.1): the reader grant builder, the sealed
+// shape-proved reader, and the pure connect-credential check the production composition runs.
+// The WRITE side (authority-client, root-credential, activateLifecycleAtUid) stays
+// package-internal — the sealed plane is its only production door; smokes import the modules.
+export { authConnectReaderGrants, openConnectReader, authorizeConnectCredential, } from "./connect-reader.js";
 export { cotalAuthProvider } from "./provider.js"; // self-registers the "auth-provider" extension
 import "./commands.js"; // self-registers `login` / `logout` / `actor` / `auth-service` into the core Registry
+// NB: writeEndpointGate (the D14 endpoint-registration stand-in) is deliberately NOT
+// re-exported here (import it directly from the module in smokes/provisioning). The public
+// surface is the store + hooks + close/sweep seams.
+export { openSessionAuthStore, kvSessionLedger, sessionRedemptionHooks, closeSession, sweepSessions, kvServeIssuanceGate } from "./session-ledger.js";
+// NB: the package surface is the sealed contexts + the READ seams only. The activation saga,
+// the UID reservation, the gate primitives (create/observe/freeze/reopen/retire), the
+// normative credential ledger (credential-ledger.ts: rows, source gates, the mint protocol),
+// and the takeover barrier are ALL package-internal: their executor seam is the sealed
+// registry itself, and exposing a public epoch advance / head retirement / bare gate reopen
+// around an incomplete barrier would recreate the half-fence D13 removes. Smokes and
+// provisioning tooling import them directly from the modules.
+export { openLifecycleRegistry, openLifecycleMappingReader, readLifecycleMappingLeader, lifecycleProcessEpochReader, } from "./lifecycle-registry.js";
+// The D13 (4) admission mediator + admission-policy coordinate (SPEC 13.6/13.8/13.9) is
+// PACKAGE-INTERNAL, deliberately: `openAdmissionMediator` requires the BRANDED records
+// scanner (site 3, nats-server#8274), whose constructors are not on the package surface, so
+// a root export would be an unsatisfiable public seam (a mediator you can name but never
+// construct). And a bare `openRecordsScannerCandidate` export is refused too: ONE shared records
+// scanner per space is the composition rule (fact-5; scans serialize module-wide per space,
+// so a stray second instance is safe but never the intended shape), and this package does
+// not own that composition (the #29 slice does). Until it lands, the whole coordinate is
+// reached by importing the module directly (smokes do); nothing of it is on the package
+// surface.
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,GAMjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,mBAAmB,GAKpB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,GAMnB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,eAAe,GAMhB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,YAAY,GAIb,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAoB,MAAM,kBAAkB,CAAC;AACxE,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,UAAU,EACV,eAAe,EACf,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,WAAW,GAIZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,oBAAoB,EACpB,4BAA4B,EAC5B,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,oBAAoB,GAGrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC,CAAC,+CAA+C;AAClG,OAAO,eAAe,CAAC,CAAC,sFAAsF"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,GAMjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,mBAAmB,GAKpB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,GAMnB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,eAAe,GAMhB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,YAAY,GAIb,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAoB,MAAM,kBAAkB,CAAC;AACxE,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,UAAU,EACV,eAAe,EACf,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,WAAW,GAIZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,oBAAoB,EACpB,4BAA4B,EAC5B,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,oBAAoB,GAGrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,gBAAgB,EAA2B,MAAM,cAAc,CAAC;AACjH,0FAA0F;AAC1F,8FAA8F;AAC9F,mFAAmF;AACnF,8FAA8F;AAC9F,OAAO,EACL,uBAAuB,EAAE,iBAAiB,EAAE,0BAA0B,GAEvE,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC,CAAC,+CAA+C;AAClG,OAAO,eAAe,CAAC,CAAC,sFAAsF;AAC9G,qFAAqF;AACrF,2FAA2F;AAC3F,oDAAoD;AACpD,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,sBAAsB,EAAE,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAA6G,MAAM,qBAAqB,CAAC;AACjQ,6FAA6F;AAC7F,sFAAsF;AACtF,6FAA6F;AAC7F,uFAAuF;AACvF,4FAA4F;AAC5F,qFAAqF;AACrF,8DAA8D;AAC9D,OAAO,EACL,qBAAqB,EAAE,0BAA0B,EACjD,0BAA0B,EAAE,2BAA2B,GAExD,MAAM,yBAAyB,CAAC;AACjC,wFAAwF;AACxF,uFAAuF;AACvF,4FAA4F;AAC5F,yFAAyF;AACzF,iGAAiG;AACjG,4FAA4F;AAC5F,0FAA0F;AAC1F,yFAAyF;AACzF,wFAAwF;AACxF,WAAW"}

package/dist/issuer.d.ts

@@ -36,6 +36,14 @@ export interface IssueClaims {
     scope?: string[];
     /** At most one spawner audit link, `<owner>.<actor>` dot-form. */
     parent?: string;
+    /** The ledger row's lifecycle UID (SPEC 13.1) — lifecycle-BINDS the bearer: the callout requires
+     *  exact equality with the CURRENT row at connect, so a predecessor incarnation's still-unexpired
+     *  bearer can never mint the successor's broker authority. Stamped whenever the row carries one. */
+    lifecycleUid?: string;
+    /** The credential-ledger row id (SPEC 13.1: `cred.<uid>.<credid>`) this bearer is issued under.
+     *  Stamped whenever the issuance ledgered a row; the connect boundary leader-reads it and denies
+     *  a revoked/absent-row bearer (deny-new), so the issuer ↔ validator inverse must carry it. */
+    credentialId?: string;
     /** Exchange-authorized elevated view (already ledger-checked upstream; the issuer only stamps —
      *  and re-asserts the closed enum, mint ↔ validate inverse). */
     view?: UserTokenView;

package/dist/issuer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"issuer.d.ts","sourceRoot":"","sources":["../src/issuer.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAE5D,OAAO,EAAuD,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAErG,2EAA2E;AAC3E,eAAO,MAAM,cAAc,UAAU,CAAC;AAEtC;oGACoG;AACpG,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,SAAS,CAAC;IACtB,iFAAiF;IACjF,SAAS,EAAE,GAAG,CAAC;CAChB;AAED;+FAC+F;AAC/F,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,GAAG,CAAC;CACjB;AAeD,4GAA4G;AAC5G,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,UAAU,CAAC,CAG9D;AAED,mEAAmE;AACnE,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAErF;AAED;sFACsF;AACtF,wBAAsB,gBAAgB,CAAC,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,UAAU,CAAC,CAKnF;AAED;4EAC4E;AAC5E,MAAM,WAAW,WAAW;IAC1B,yDAAyD;IACzD,KAAK,EAAE,MAAM,CAAC;IACd,yDAAyD;IACzD,KAAK,EAAE,MAAM,CAAC;IACd,uFAAuF;IACvF,KAAK,EAAE,MAAM,CAAC;IACd,wBAAwB;IACxB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;oEACgE;IAChE,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,mGAAmG;AACnG,MAAM,WAAW,eAAe;IAC9B,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8BAA8B;IAC9B,SAAS,IAAI,MAAM,CAAC;IACpB,6EAA6E;IAC7E,KAAK,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,mGAAmG;IACnG,IAAI,IAAI;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE,CAAC;IACxB,+FAA+F;IAC/F,MAAM,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IAC9B,uFAAuF;IACvF,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;oFACgF;IAChF,WAAW,IAAI,eAAe,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,wCAAwC;IACxC,GAAG,EAAE,UAAU,CAAC;CACjB;AAED,uCAAuC;AACvC,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,gBAAgB,GAAG,eAAe,CAgE7E;AAED;;;iCAGiC;AACjC,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,CAMnE"}
+{"version":3,"file":"issuer.d.ts","sourceRoot":"","sources":["../src/issuer.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAE5D,OAAO,EAAgF,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAE9H,2EAA2E;AAC3E,eAAO,MAAM,cAAc,UAAU,CAAC;AAEtC;oGACoG;AACpG,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,SAAS,CAAC;IACtB,iFAAiF;IACjF,SAAS,EAAE,GAAG,CAAC;CAChB;AAED;+FAC+F;AAC/F,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,GAAG,CAAC;CACjB;AAeD,4GAA4G;AAC5G,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,UAAU,CAAC,CAG9D;AAED,mEAAmE;AACnE,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAErF;AAED;sFACsF;AACtF,wBAAsB,gBAAgB,CAAC,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,UAAU,CAAC,CAKnF;AAED;4EAC4E;AAC5E,MAAM,WAAW,WAAW;IAC1B,yDAAyD;IACzD,KAAK,EAAE,MAAM,CAAC;IACd,yDAAyD;IACzD,KAAK,EAAE,MAAM,CAAC;IACd,uFAAuF;IACvF,KAAK,EAAE,MAAM,CAAC;IACd,wBAAwB;IACxB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;wGAEoG;IACpG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;mGAE+F;IAC/F,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;oEACgE;IAChE,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,mGAAmG;AACnG,MAAM,WAAW,eAAe;IAC9B,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8BAA8B;IAC9B,SAAS,IAAI,MAAM,CAAC;IACpB,6EAA6E;IAC7E,KAAK,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,mGAAmG;IACnG,IAAI,IAAI;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE,CAAC;IACxB,+FAA+F;IAC/F,MAAM,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IAC9B,uFAAuF;IACvF,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;oFACgF;IAChF,WAAW,IAAI,eAAe,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,wCAAwC;IACxC,GAAG,EAAE,UAAU,CAAC;CACjB;AAED,uCAAuC;AACvC,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,gBAAgB,GAAG,eAAe,CAiE7E;AAED;;;iCAGiC;AACjC,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,CAMnE"}

package/dist/issuer.js

@@ -24,7 +24,7 @@
  */
 import { SignJWT, calculateJwkThumbprint, createRemoteJWKSet, exportJWK, generateKeyPair, importJWK } from "jose";
 import { assertDerivedOwnerToken, assertValidOwnerToken } from "@cotal-ai/core";
-import { MAX_TOKEN_TTL_SEC, USER_TOKEN_VER, USER_TOKEN_VIEWS } from "./token.js";
+import { MAX_TOKEN_TTL_SEC, USER_TOKEN_VER, USER_TOKEN_VIEWS, assertCredentialIdClaim } from "./token.js";
 /** The one signing algorithm — Ed25519. Pinned on both mint and verify. */
 export const USER_TOKEN_ALG = "EdDSA";
 function publicMembers(jwk) {
@@ -81,6 +81,8 @@ export function createUserTokenIssuer(opts) {
             assertDerivedOwnerToken(parts[0]);
             assertValidOwnerToken(parts[1]);
         }
+        if (claims.credentialId !== undefined)
+            assertCredentialIdClaim(claims.credentialId); // never sign a credid the validator would reject
         if (claims.view !== undefined && !USER_TOKEN_VIEWS.includes(claims.view))
             throw new Error(`issue: view "${String(claims.view)}" is not a known view (${USER_TOKEN_VIEWS.join(", ")}) - the enum is closed on the mint side too`);
         const ttl = claims.ttlSec ?? MAX_TOKEN_TTL_SEC;
@@ -93,7 +95,7 @@ export function createUserTokenIssuer(opts) {
         return new SignJWT({
             scope: claims.scope ?? [],
             ver: USER_TOKEN_VER,
-            act: { owner: claims.owner, actor: claims.actor, ...(claims.scope ? { scope: claims.scope } : {}), ...(claims.parent ? { parent: claims.parent } : {}), ...(claims.view ? { view: claims.view } : {}) },
+            act: { owner: claims.owner, actor: claims.actor, ...(claims.scope ? { scope: claims.scope } : {}), ...(claims.parent ? { parent: claims.parent } : {}), ...(claims.lifecycleUid ? { lifecycleUid: claims.lifecycleUid } : {}), ...(claims.credentialId ? { credentialId: claims.credentialId } : {}), ...(claims.view ? { view: claims.view } : {}) },
         })
             .setProtectedHeader({ alg: USER_TOKEN_ALG, kid: signer.kid })
             .setSubject(claims.owner)

package/dist/issuer.js.map

@@ -1 +1 @@
-{"version":3,"file":"issuer.js","sourceRoot":"","sources":["../src/issuer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAElH,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,gBAAgB,EAAsB,MAAM,YAAY,CAAC;AAErG,2EAA2E;AAC3E,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AAkBtC,SAAS,aAAa,CAAC,GAAQ;IAC7B,mGAAmG;IACnG,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ;QACzE,MAAM,IAAI,KAAK,CAAC,mDAAmD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChH,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,UAAqB,EAAE,UAAe;IAChE,MAAM,GAAG,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC9C,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;AAC1F,CAAC;AAED,4GAA4G;AAC5G,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,eAAe,CAAC,cAAc,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACpF,OAAO,YAAY,CAAC,UAAuB,EAAE,MAAM,SAAS,CAAC,UAAuB,CAAC,CAAC,CAAC;AACzF,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAe;IACpD,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AACvE,CAAC;AAED;sFACsF;AACtF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,CAAuB;IAC5D,MAAM,UAAU,GAAG,CAAC,MAAM,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,cAAc,CAAC,CAAc,CAAC;IAChF,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;IACzD,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC,GAAG,kBAAkB,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;IACjH,OAAO,GAAG,CAAC;AACb,CAAC;AAgDD,uCAAuC;AACvC,MAAM,UAAU,qBAAqB,CAAC,IAAsB;IAC1D,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrE,IAAI,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAE1B,MAAM,KAAK,GAAG,KAAK,EAAE,MAAmB,EAAmB,EAAE;QAC3D,gGAAgG;QAChG,4FAA4F;QAC5F,6DAA6D;QAC7D,uBAAuB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtC,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK;YACnD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;YAClH,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;gBACnC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;YAChF,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,CAAC,MAAM,wCAAwC,CAAC,CAAC;YACjH,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAClC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;YACtE,MAAM,IAAI,KAAK,CACb,gBAAgB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,6CAA6C,CACtI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,IAAI,iBAAiB,CAAC;QAC/C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,GAAG,GAAG,iBAAiB;YAC3F,MAAM,IAAI,KAAK,CAAC,iBAAiB,GAAG,qBAAqB,iBAAiB,qCAAqC,CAAC,CAAC;QACnH,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,OAAO,IAAI,OAAO,CAAC;YACjB,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE;YACzB,GAAG,EAAE,cAAc;YACnB,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SACxM,CAAC;aACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;aAC5D,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC;aACxB,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC;aACtB,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC;aACzB,WAAW,CAAC,GAAG,CAAC;aAChB,YAAY,CAAC,GAAG,CAAC;aACjB,iBAAiB,CAAC,GAAG,GAAG,GAAG,CAAC;aAC5B,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC7B,CAAC,CAAC;IAEF,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM;QACvB,KAAK;QACL,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;QAClE,MAAM,EAAE,CAAC,GAAe,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1E,MAAM,EAAE,CAAC,GAAW,EAAE,EAAE;YACtB,IAAI,GAAG,KAAK,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,GAAG,8BAA8B,CAAC,CAAC;YACpH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QACD,WAAW,EAAE,GAAoB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACnD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YACrE,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACpF,OAAO,CAAC,MAAM,SAAS,CAAC,GAAG,EAAE,cAAc,CAAC,CAAc,CAAC;QAC7D,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;iCAGiC;AACjC,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;IAC1G,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ;QACxC,MAAM,IAAI,KAAK,CAAC,wDAAwD,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3G,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC"}
+{"version":3,"file":"issuer.js","sourceRoot":"","sources":["../src/issuer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAElH,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,gBAAgB,EAAE,uBAAuB,EAAsB,MAAM,YAAY,CAAC;AAE9H,2EAA2E;AAC3E,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC;AAkBtC,SAAS,aAAa,CAAC,GAAQ;IAC7B,mGAAmG;IACnG,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ;QACzE,MAAM,IAAI,KAAK,CAAC,mDAAmD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChH,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,UAAqB,EAAE,UAAe;IAChE,MAAM,GAAG,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC9C,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;AAC1F,CAAC;AAED,4GAA4G;AAC5G,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,eAAe,CAAC,cAAc,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACpF,OAAO,YAAY,CAAC,UAAuB,EAAE,MAAM,SAAS,CAAC,UAAuB,CAAC,CAAC,CAAC;AACzF,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAe;IACpD,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AACvE,CAAC;AAED;sFACsF;AACtF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,CAAuB;IAC5D,MAAM,UAAU,GAAG,CAAC,MAAM,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,cAAc,CAAC,CAAc,CAAC;IAChF,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;IACzD,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC,GAAG,kBAAkB,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;IACjH,OAAO,GAAG,CAAC;AACb,CAAC;AAwDD,uCAAuC;AACvC,MAAM,UAAU,qBAAqB,CAAC,IAAsB;IAC1D,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrE,IAAI,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAE1B,MAAM,KAAK,GAAG,KAAK,EAAE,MAAmB,EAAmB,EAAE;QAC3D,gGAAgG;QAChG,4FAA4F;QAC5F,6DAA6D;QAC7D,uBAAuB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtC,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK;YACnD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;YAClH,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;gBACnC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;YAChF,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,CAAC,MAAM,wCAAwC,CAAC,CAAC;YACjH,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAClC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS;YAAE,uBAAuB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,iDAAiD;QACtI,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;YACtE,MAAM,IAAI,KAAK,CACb,gBAAgB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,6CAA6C,CACtI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,IAAI,iBAAiB,CAAC;QAC/C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,GAAG,GAAG,iBAAiB;YAC3F,MAAM,IAAI,KAAK,CAAC,iBAAiB,GAAG,qBAAqB,iBAAiB,qCAAqC,CAAC,CAAC;QACnH,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,OAAO,IAAI,OAAO,CAAC;YACjB,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE;YACzB,GAAG,EAAE,cAAc;YACnB,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SACtV,CAAC;aACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;aAC5D,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC;aACxB,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC;aACtB,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC;aACzB,WAAW,CAAC,GAAG,CAAC;aAChB,YAAY,CAAC,GAAG,CAAC;aACjB,iBAAiB,CAAC,GAAG,GAAG,GAAG,CAAC;aAC5B,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC7B,CAAC,CAAC;IAEF,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM;QACvB,KAAK;QACL,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;QAClE,MAAM,EAAE,CAAC,GAAe,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1E,MAAM,EAAE,CAAC,GAAW,EAAE,EAAE;YACtB,IAAI,GAAG,KAAK,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,GAAG,8BAA8B,CAAC,CAAC;YACpH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QACD,WAAW,EAAE,GAAoB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACnD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YACrE,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACpF,OAAO,CAAC,MAAM,SAAS,CAAC,GAAG,EAAE,cAAc,CAAC,CAAc,CAAC;QAC7D,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;iCAGiC;AACjC,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;IAC1G,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ;QACxC,MAAM,IAAI,KAAK,CAAC,wDAAwD,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3G,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC"}

package/dist/ledger-scanner.d.ts

@@ -0,0 +1,98 @@
+import type { NatsConnection } from "@nats-io/transport-node";
+import { type PlaneConnTuple } from "@cotal-ai/core";
+import type { ScanGuard } from "./plane-claim.js";
+/** One raw enumerated entry, WITH its KV operation so the DOMAIN parse layer's fail-loud contract
+ *  can treat a DEL/PURGE marker as corruption (a bucket's own `keys()`/`watch()` would filter
+ *  markers out). SEAM NOTE: consumed ONLY by the domain parse layer that owns this scanner
+ *  (credential-ledger.ts), which turns each entry into a closed parsed row BEFORE anything leaves;
+ *  it is never placed on a barrier/mediator/session dependency (those receive only parsed rows). */
+export interface RawScanEntry {
+    key: string;
+    data: Uint8Array;
+    seq: number;
+    op: string | undefined;
+}
+/** The sealed auth-ledger scanner: CLOSED, validated ops only — no raw prefix, no NATS/JS handle,
+ *  no credential. Each op forces its exact filter from a validated id. */
+export interface AuthLedgerScanner {
+    /** LastPerSubject over `cred.<lifecycleUid>.>` — the current last of every credential row in the
+     *  agent family (markers included). */
+    scanCredentialFamily(lifecycleUid: string): Promise<RawScanEntry[]>;
+    /** LastPerSubject over `bysrc.<issuerKeyId>.<id>.>` — the current last of every lineage-index row
+     *  under one handle. */
+    scanBysrc(issuerKeyId: string, id: string): Promise<RawScanEntry[]>;
+    /** LastPerSubject over `stage.>` — every durable operation intent and session release pin (the
+     *  caller separates the single-segment operation intents from the multi-segment pins). */
+    scanStageFamily(): Promise<RawScanEntry[]>;
+    /** LastPerSubject over `session.>` — the current last of every session-ledger row (markers
+     *  included, so the sweep sees a DEL/PURGE a bucket's own `keys()`/`watch()` would hide). Shares
+     *  this instance's ONE literal consumer name + lock with the credential-ledger scans (fact-5:
+     *  auth-ledger and session operations are one scanner over the one auth stream). */
+    scanSessions(): Promise<RawScanEntry[]>;
+    /** Tear down the owned credential+connection. */
+    close(): Promise<void>;
+}
+/** Assert `scanner` was built by this module for exactly `space` — the registry's space-bond and
+ *  anti-hand-assembly discipline extended to the injected scanner (SPEC 13.12/13.9). */
+export declare function assertScannerSpace(scanner: AuthLedgerScanner, space: string): void;
+/** An INERT plane candidate (#29 HIGH 3, SPEC 13.13): the dedicated scanner connection is OPEN
+ *  (non-reconnecting, identity captured for the plane claim row) but NO branded scan capability
+ *  exists until the claim CAS wins and the composition calls {@link activate} — a losing opener
+ *  closes the candidate having never been able to touch the literal consumer. */
+export interface LedgerScannerCandidate {
+    /** The connection's claim-pinnable broker identity. */
+    tuple: PlaneConnTuple;
+    /** Resolves when the non-reconnecting connection is permanently gone (the fencing signal). */
+    gone: Promise<void>;
+    /** WINNER-ONLY, once: build the branded sealed scanner, its every scan wrapped in the plane
+     *  guard (claim re-validated before AND after, inside the serialized critical section). */
+    activate(guard: ScanGuard): AuthLedgerScanner;
+    close(): Promise<void>;
+}
+/**
+ * Open the sealed auth-ledger scanner CANDIDATE over the space's auth stream: a DEDICATED
+ * self-minted plane-owned connection carrying ONLY {@link authorityScannerGrants}. The connection,
+ * credential, and raw scan are never handed out; the scan capability itself does not exist until
+ * the plane claim is won ({@link LedgerScannerCandidate.activate}).
+ */
+export declare function openAuthLedgerScannerCandidate(opts: {
+    server: string;
+    space: string;
+    dataAccount: {
+        pub: string;
+        signingSeed: string;
+    };
+    log: (line: string) => void;
+}): Promise<LedgerScannerCandidate>;
+/**
+ * TEST/SMOKE-ONLY: build the sealed scanner over an EXISTING connection. A plain-auth test broker
+ * has no data-account signing seed to self-mint a JWT, so the JWT-owning {@link openAuthLedgerScannerCandidate}
+ * (the PRODUCTION seam, which owns a dedicated credential+connection) does not apply. This factory's
+ * `close()` does NOT close the caller's connection (the harness owns it); it is never a production
+ * composition path and is never registered as a mintable profile.
+ */
+export declare function makeLedgerScannerOverConnection(nc: NatsConnection, space: string, probe?: ScannerProbe, guard?: ScanGuard): AuthLedgerScanner;
+/** SMOKE-ONLY probes (precedent: AuthorityClient.probeRenewal). Never set in production.
+ *  - `afterCreate` fires ONCE after the consumer is created + bind-verified but BEFORE the drain,
+ *    forcing the create→drain race: a subject overwritten `active→revoked` (evicting the pre-scan
+ *    revision) is still returned at its CURRENT last.
+ *  - `afterFirstFetch` fires ONCE after the FIRST drain fetch completes, forcing the mid-drain race:
+ *    a subject delivered old in round 1 then overwritten re-appears as pending and is fetched in a
+ *    later round (proving the drain re-reads `num_pending` to a fresh zero, not a stale local count). */
+export interface ScannerProbe {
+    afterCreate?: () => Promise<void>;
+    afterFirstFetch?: () => Promise<void>;
+}
+/**
+ * The SEALED SCANNER's credential grant on the AUTH stream (SPEC 13.9): exactly the ONE literal
+ * enumeration consumer's lifecycle (CREATE/INFO/NEXT/DELETE pinned to {@link SCANNER_CONSUMER_NAME})
+ * + the stream shape read + the scoped inbox. This is the ONLY profile that holds `CONSUMER.CREATE`
+ * on `KV_cotal_auth_<space>`; {@link openAuthLedgerScannerCandidate} opens it for the trusted process and it
+ * is NEVER registered as an external/mintable profile. The bucket is DERIVED from the validated
+ * space and the name is the module constant, so no caller-supplied token forms a privileged subject.
+ */
+export declare function authorityScannerGrants(space: string, connId: string): {
+    publish: string[];
+    subscribe: string[];
+};
+//# sourceMappingURL=ledger-scanner.d.ts.map

package/dist/ledger-scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger-scanner.d.ts","sourceRoot":"","sources":["../src/ledger-scanner.ts"],"names":[],"mappings":"AAiEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAA0E,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAE7H,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAuClD;;;;oGAIoG;AACpG,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,UAAU,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,GAAG,SAAS,CAAC;CACxB;AAED;0EAC0E;AAC1E,MAAM,WAAW,iBAAiB;IAChC;2CACuC;IACvC,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACpE;4BACwB;IACxB,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACpE;8FAC0F;IAC1F,eAAe,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC3C;;;wFAGoF;IACpF,YAAY,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACxC,iDAAiD;IACjD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAgBD;wFACwF;AACxF,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAMlF;AAED;;;iFAGiF;AACjF,MAAM,WAAW,sBAAsB;IACrC,uDAAuD;IACvD,KAAK,EAAE,cAAc,CAAC;IACtB,8FAA8F;IAC9F,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACpB;+FAC2F;IAC3F,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,iBAAiB,CAAC;IAC9C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;GAKG;AACH,wBAAsB,8BAA8B,CAAC,IAAI,EAAE;IACzD,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAyBlC;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,SAAS,GAAG,iBAAiB,CAE7I;AAED;;;;;;yGAMyG;AACzG,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAsKD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAehH"}