@cotal-ai/auth 0.17.0 → 0.18.0

package/dist/auth-admin.d.ts

@@ -1,9 +1,12 @@
 import { type RetirementDeps } from "./retirement-barrier.js";
 import { type LifecycleRegistry } from "./lifecycle-registry.js";
-/** The LISTENER profile (SPEC 13.9 "Auth control rail" row): serve + bounded replies on the
- *  auth-admin control subtree, plus the ONE leader-served lease read the holder-check performs.
+/** The LISTENER profile (SPEC 13.9 "Auth endpoint rail" row): serve + bounded replies on the auth
+ *  endpoint's class rail, plus the ONE leader-served gate read the authz check performs.
  *  No store writes, no consumer authority, no scanner reach. */
-export declare function authAdminListenerGrants(space: string, connId: string): {
+export declare function authAdminListenerGrants(space: string, connId: string, responder: {
+    instanceId: string;
+    epoch: number;
+}): {
     publish: string[];
     subscribe: string[];
 };

package/dist/auth-admin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-admin.d.ts","sourceRoot":"","sources":["../src/auth-admin.ts"],"names":[],"mappings":"AAmDA,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAA8C,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAK7G;;gEAEgE;AAChE,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAmBjH;AAwCD,MAAM,WAAW,iBAAiB;IAChC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,GAAG,EAAE,iBAAiB,CAAC;IACvB,UAAU,EAAE,cAAc,CAAC;IAC3B,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAwI7B"}
+{"version":3,"file":"auth-admin.d.ts","sourceRoot":"","sources":["../src/auth-admin.ts"],"names":[],"mappings":"AAuEA,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAA8C,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAW7G;;gEAEgE;AAChE,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,SAAS,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAyB5C;AA2DD,MAAM,WAAW,iBAAiB;IAChC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,GAAG,EAAE,iBAAiB,CAAC;IACvB,UAAU,EAAE,cAAc,CAAC;IAC3B,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAuL7B"}

package/dist/auth-admin.js

@@ -1,50 +1,81 @@
 import { Kvm } from "@nats-io/kv";
-import { CONTROL_AUTH_ADMIN, EpEnvelopeError, assertBoundedOwner, assertLifecycleToken, endpointToken, epAuthBucket, principalKey, retirementFrontierStreams, serveIssuanceGateKv, spacePrefix, } from "@cotal-ai/core";
+import { AUTH_ENDPOINT, EP_CMD_RETIRE_LIFECYCLE, EpEnvelopeError, assertLifecycleToken, deriveReplySubject, endpointToken, epAuthBucket, epClassQueueGroup, epResponderReplyPattern, assertCommandToken, spacePrefix, mintLifecycleUid, parseEpSubject, principalKey, retirementFrontierStreams, serveIssuanceGateKv, } from "@cotal-ai/core";
 import { openAuthorityClient } from "./authority-client.js";
 import { runAgentRetirementBarrier } from "./retirement-barrier.js";
 import { observeGate, readLifecycleHeadForOperation } from "./lifecycle-registry.js";
 const enc = new TextEncoder();
 const dec = new TextDecoder();
-/** The LISTENER profile (SPEC 13.9 "Auth control rail" row): serve + bounded replies on the
- *  auth-admin control subtree, plus the ONE leader-served lease read the holder-check performs.
+/** The auth endpoint's one class rail, per-command (never a cross-command `>`): the grant and the
+ *  runtime subscription are built from THIS, so a widened subscription cannot outrun its grant. */
+function authClassRail(space) {
+    return `${spacePrefix(space)}.ep.one.${endpointToken(AUTH_ENDPOINT)}.${assertCommandToken(EP_CMD_RETIRE_LIFECYCLE)}.>`;
+}
+/** The LISTENER profile (SPEC 13.9 "Auth endpoint rail" row): serve + bounded replies on the auth
+ *  endpoint's class rail, plus the ONE leader-served gate read the authz check performs.
  *  No store writes, no consumer authority, no scanner reach. */
-export function authAdminListenerGrants(space, connId) {
+export function authAdminListenerGrants(space, connId, responder) {
     return {
         publish: [
-            // REPLIES ONLY. The handler only ever `msg.respond`s to `<request-subject>.reply.…` (boundReply,
-            // below), so the listener never needs to publish a bare REQUEST subject. Granting the request
-            // subtree (`…auth-admin.>`) would let a compromised listener credential self-publish a
-            // `retireLifecycle` as the lease holder and pass its own subject-derived lease check (self-forge);
-            // scoping to `*.*.reply.>` closes that. The requester credential (provision.ts) is already
-            // broker-bound to publish only its OWN `<owner>.<actor>` request subject.
-            `${spacePrefix(space)}.ctl.${CONTROL_AUTH_ADMIN}.*.*.reply.>`,
+            // REPLIES ONLY, and on the REPLY PLANE — which is a stronger statement than the `ctl` rail
+            // could make. There, request and reply shared one subtree, so the grant had to carve replies
+            // out of it by shape (`*.*.reply.>`) to stop a compromised listener self-publishing a request
+            // as the lease holder and passing its own subject-derived check (self-forge). Here the planes
+            // are DISJOINT: `ep.reply.…` cannot express a request subject at all, so the self-forge is
+            // closed by the grammar rather than by a pattern. The instance triple and epoch are pinned;
+            // only the caller suffixes span (addressing is confined by nonce possession, §13.2).
+            epResponderReplyPattern(space, AUTH_ENDPOINT, responder.instanceId, responder.epoch),
             "$JS.API.INFO",
-            // The ONE leader-served read the holder-check performs: the serve-issuance GATE (P2 item 3
-            // 3b-3), a point-get of `epgate.<endpoint>.<instanceId>` proving the requesting manager
-            // instance's serve grant is CURRENT (registration-record-derived, replacing the old
-            // name-derived manager-lease read). No consumer authority, no store writes.
+            // The ONE leader-served read the authz check performs: the serve-issuance GATE, a point-get
+            // of `epgate.<endpoint>.<instanceId>` proving the requesting manager instance's serve grant
+            // is CURRENT and that the row belongs to the SUBJECT-derived caller principal. No consumer
+            // authority, no store writes.
             `$JS.API.STREAM.MSG.GET.KV_${epAuthBucket(space)}`,
         ],
-        subscribe: [`${spacePrefix(space)}.ctl.${CONTROL_AUTH_ADMIN}.*.*`, `_INBOX_${connId}.>`],
+        // The class rail, QUEUE-QUALIFIED and per-command (§13.9, `endpoint-grants.ts:293-300`): the
+        // NATS `"<subject> <queue>"` grant form. A PLAIN subject row would let this credential
+        // plain-subscribe the class rail and observe EVERY request's nonce — the property the queue
+        // qualification exists to protect. The runtime's queue subscription is not a substitute: it
+        // constrains what this process does, not what the credential permits.
+        subscribe: [`${authClassRail(space)} ${epClassQueueGroup(AUTH_ENDPOINT)}`, `_INBOX_${connId}.>`],
     };
 }
+const RETIRE_ARG_KEYS = ["opId", "serveEndpoint", "serveInstanceId", "serveEpoch"];
+/** The request id a reply MUST echo. This is the MINIMAL correctness guard from the full
+ *  `EndpointRequest`/`EndpointReply` envelope, which this rail does NOT yet carry (named residual:
+ *  the rail moved to `ep` SUBJECTS while still exchanging the ctl-era `{op,args}` / `{ok,data,error}`
+ *  bodies, and SPEC 1421 states those envelopes are DELETED). Without the echo, a caller binding a
+ *  reply on (endpoint, nonce) alone can accept a malformed or WRONG-ID `{ok:true}` and clear a
+ *  retirement hold on it. The full envelope migration is its own cut; this edge is not deferrable. */
+function parseRequestId(raw) {
+    if (typeof raw !== "string" || !/^[A-Za-z0-9_-]{1,64}$/.test(raw))
+        throw new EpEnvelopeError("failed-precondition", `the request requires an "id" ([A-Za-z0-9_-]{1,64}); the reply echoes it so a caller cannot accept another request's answer`);
+    return raw;
+}
 function parseRetireArgs(raw) {
-    const shape = "{ owner, actor, lifecycleUid, opId, serveEndpoint, serveInstanceId, serveEpoch }";
+    const shape = "{ opId, serveEndpoint, serveInstanceId, serveEpoch }";
     if (raw === null || typeof raw !== "object")
         throw new EpEnvelopeError("failed-precondition", `retireLifecycle requires args ${shape}`);
     const a = raw;
+    // The TARGET (owner, actor, lifecycleUid) is no longer an argument: `handle` mode carries it in
+    // the subject, broker-enforced and grant-pinned, so the handler reads it from there. Sending it
+    // in the body is now a CLOSED-SHAPE violation rather than a redundancy to reconcile — which
+    // removes the whole body-vs-subject mismatch class instead of managing it.
     for (const k of Object.keys(a))
-        if (!["owner", "actor", "lifecycleUid", "opId", "serveEndpoint", "serveInstanceId", "serveEpoch"].includes(k))
-            throw new EpEnvelopeError("failed-precondition", `retireLifecycle args carry the unknown field "${k}" (closed shape)`);
-    if (typeof a.owner !== "string" || typeof a.actor !== "string" || typeof a.lifecycleUid !== "string" || typeof a.opId !== "string" ||
+        if (!RETIRE_ARG_KEYS.includes(k))
+            throw new EpEnvelopeError("failed-precondition", `retireLifecycle args carry the unknown field "${k}" (closed shape; the target rides the SUBJECT)`);
+    if (typeof a.opId !== "string" ||
         typeof a.serveEndpoint !== "string" || typeof a.serveInstanceId !== "string" ||
         typeof a.serveEpoch !== "number" || !Number.isInteger(a.serveEpoch) || a.serveEpoch < 0)
         throw new EpEnvelopeError("failed-precondition", `retireLifecycle requires args ${shape} (serveEpoch a non-negative integer)`);
     return {
-        owner: assertBoundedOwner(a.owner, "owner"),
-        actor: assertBoundedOwner(a.actor, "actor"),
-        lifecycleUid: assertLifecycleToken(a.lifecycleUid, "lifecycleUid"),
+        // opId is OPERATION IDENTITY, not an authz input: it is the stable per-lifecycle id that makes
+        // a retry, a same-name-spawn nudge, and a boot resume converge on ONE operation. It has no
+        // subject counterpart to be cross-checked against (the subject's nonce varies per request,
+        // which is the opposite property), and it authorizes nothing.
         opId: assertLifecycleToken(a.opId, "opId"),
+        // LOOKUP COORDINATES, not authz inputs: they select WHICH gate row to read. The row they
+        // select must then survive the principal cross-check below, so naming a foreign row buys a
+        // refusal, never an authorization.
         serveEndpoint: endpointToken(a.serveEndpoint),
         serveInstanceId: assertLifecycleToken(a.serveInstanceId, "serveInstanceId"),
         serveEpoch: a.serveEpoch,
@@ -57,10 +88,17 @@ function parseRetireArgs(raw) {
  */
 export async function openAuthAdminListener(opts) {
     const { space, log } = opts;
+    // The auth plane's responder identity. The plane is SINGLE per space by construction (§13.13:
+    // at most one authority plane holds the sealed scanners, by a broker-visible claim), so the
+    // instance id is per-process and the epoch is fixed: there is no successor to fence and no
+    // registration whose epoch could advance beneath us. It exists because the reply plane pins the
+    // responder triple in the grant; callers read replies through a filter that wildcards these
+    // positions (`ep.reply.*.*.*.<cO>.<cA>.<cUid>.*`), so they never need to learn it.
+    const responder = { instanceId: mintLifecycleUid(), epoch: 0 };
     const client = await openAuthorityClient({
         server: opts.server, space, dataAccount: opts.dataAccount,
         label: `cotal:auth-admin:${space}`,
-        grants: (id) => authAdminListenerGrants(space, id),
+        grants: (id) => authAdminListenerGrants(space, id, responder),
         log,
     });
     let epAuthKv;
@@ -73,31 +111,52 @@ export async function openAuthAdminListener(opts) {
         await client.close();
         throw e;
     }
-    const prefix = `${spacePrefix(space)}.ctl.${CONTROL_AUTH_ADMIN}.`;
-    const sub = client.nc.subscribe(`${prefix}*.*`, {
+    const sub = client.nc.subscribe(authClassRail(space), {
+        queue: epClassQueueGroup(AUTH_ENDPOINT),
         callback: (err, msg) => {
             if (err)
                 return;
             void (async () => {
-                // boundReply (the serveControl discipline): the reply target must live under the
-                // SENDER'S OWN request subject — the listener holds a subtree-wide reply grant, so a
-                // caller-selected foreign reply target is refused here, never published to.
-                if (msg.reply === undefined || !msg.reply.startsWith(`${msg.subject}.reply.`)) {
-                    log(`auth-admin: dropped a request on ${msg.subject} with an unbound reply target (${msg.reply ?? "none"})`);
+                // The reply target is DERIVED from the parsed request, never taken from the wire. On the
+                // `ctl` rail this was a guard: the listener held a subtree-wide reply grant, so a
+                // caller-selected foreign reply target had to be refused by inspecting `msg.reply`. Here
+                // there is no argument through which a payload-supplied reply target could arrive — the
+                // guard became structural, so the check it replaced cannot be forgotten.
+                const parsed = parseEpSubject(msg.subject);
+                if (parsed === null || parsed.plane !== "request") {
+                    // null = MUST NOT handle (§13.2). Never a reply: an unparseable subject has no
+                    // derivable reply target, and answering one would be the confused deputy itself.
+                    log(`auth-admin: dropped an unparseable request subject ${msg.subject}`);
                     return;
                 }
+                const request = parsed;
+                // The echoed id is stamped HERE, outside the handler, so EVERY reply carries it - including
+                // the thrown-error path. A reply the caller cannot bind to its own request is one it must
+                // ignore, so an unstamped error reply would silently become a timeout instead of a refusal.
+                let echoId;
+                try {
+                    echoId = parseRequestId(JSON.parse(dec.decode(msg.data)).id);
+                }
+                catch {
+                    echoId = undefined;
+                }
                 let reply;
                 try {
-                    reply = await handle(msg.subject.slice(prefix.length), msg.data);
+                    reply = await handle(request, msg.data);
                 }
                 catch (e) {
                     reply = { ok: false, error: e instanceof Error ? e.message : String(e) };
                 }
+                // A request with no usable id gets an unbindable reply BY CONSTRUCTION: the caller requires
+                // the echo, so it will refuse this answer rather than accept an unattributable one.
+                if (echoId !== undefined)
+                    reply.id = echoId;
+                const target = deriveReplySubject(space, request, responder);
                 try {
-                    msg.respond(enc.encode(JSON.stringify(reply)));
+                    client.nc.publish(target, enc.encode(JSON.stringify(reply)));
                 }
                 catch (e) {
-                    log(`auth-admin: reply publish failed on ${msg.subject}: ${e instanceof Error ? e.message : String(e)}`);
+                    log(`auth-admin: reply publish failed on ${target}: ${e instanceof Error ? e.message : String(e)}`);
                 }
             })();
         },
@@ -115,11 +174,17 @@ export async function openAuthAdminListener(opts) {
     // same-opId join whose coordinates differ is REFUSED as a full no-op; only a coordinate-IDENTICAL
     // request (the intended nudge/retry) joins the in-flight barrier.
     const barrierFlight = new Map();
-    const handle = async (principalTail, body) => {
-        const tokens = principalTail.split(".");
-        if (tokens.length !== 2)
-            return { ok: false, error: `auth-admin: the request subject must carry exactly <owner>.<actor>` };
-        const requester = principalKey(tokens[0], tokens[1]).key;
+    const handle = async (request, body) => {
+        if (request.command !== EP_CMD_RETIRE_LIFECYCLE)
+            return { ok: false, error: `command "${request.command}" not supported on the auth endpoint` };
+        // The TARGET comes from the subject (`handle` mode, arity 3) — broker-enforced and
+        // grant-pinned, so it is not a claim the caller can vary independently of what it may publish.
+        if (request.target === null || request.target.mode !== "handle")
+            return { ok: false, error: `retire-lifecycle requires a handle target (<owner>.<actor>.<lifecycleUid>) in the subject` };
+        const target = { owner: request.target.tOwner, actor: request.target.tActor, lifecycleUid: request.target.tUid };
+        // The CALLER principal likewise comes from the subject, and is now an AUTHZ INPUT (the
+        // cross-check below), not just the audit line it was on the `ctl` rail.
+        const requester = principalKey(request.caller.owner, request.caller.actor).key;
         let req;
         try {
             req = JSON.parse(dec.decode(body));
@@ -136,9 +201,14 @@ export async function openAuthAdminListener(opts) {
         // requester declares its (serveEndpoint, serveInstanceId, serveEpoch); an absent/retired gate means
         // no registered instance, and a gate whose current processEpoch moved past the declared one means
         // the requester was SUPERSEDED (a deposed predecessor after a restart) — refused as a full no-op.
-        // Every instance of one space shares the manager principal (the broker ACL already confines the
-        // requester to it), so ANY current instance's gate authorizes (accept any registered instance with
-        // a current serve grant — pin 5). The requester principal is still recorded on the audit line below.
+        // The row this NAMES must also BELONG to the subject-derived caller principal (the cross-check
+        // below). Before #350 it did not have to: every instance of one space shares the manager
+        // principal, and the two-token `ctl` subject could not express the caller beyond that alias, so
+        // any current instance's gate authorized. That is no longer true, and the coordinates above no
+        // longer authorize — they only select which row to read.
+        // ALIAS-LEVEL, not incarnation-level: a DIFFERENT INSTANCE OF THE SAME PRINCIPAL still passes
+        // (the gate is keyed by the persisted instanceId and its row carries no lifecycle uid). What is
+        // refused is a row belonging to a DIFFERENT PRINCIPAL.
         let serveGate;
         try {
             serveGate = await serveIssuanceGateKv(epAuthKv, space, { endpoint: args.serveEndpoint, instanceId: args.serveInstanceId }).observe();
@@ -148,26 +218,38 @@ export async function openAuthAdminListener(opts) {
         }
         if (serveGate === null || serveGate.state === "retired")
             return { ok: false, error: `no manager instance currently holds a serve registration for "${space}" (instance ${args.serveInstanceId} is ${serveGate === null ? "unregistered" : "retired"}), so nothing may retire agents. The despawn was a FULL no-op - the agent is unchanged and still running. NEXT: start or recover the manager (\`cotal supervise\`), then retry the despawn.` };
+        // THE PRINCIPAL CROSS-CHECK (#350). The two serve coordinates above only SELECTED this row;
+        // they do not authorize. The row must belong to the SUBJECT-derived caller principal — which
+        // the broker enforced when it admitted the publish. Without this, naming any currently
+        // registered instance's row authorizes the caller, which is what the `ctl` rail did: its
+        // two-token subject could not express the caller beyond an alias, so there was nothing to
+        // compare the row against.
+        // ALIAS-LEVEL, not incarnation-level: the gate is keyed by the PERSISTED instanceId and its
+        // schema carries no uid, while the caller triple's uid is per-process. A same-principal zombie
+        // predecessor holding the current epoch value still passes. Closing that needs a gate-row
+        // schema change; it is deliberately not in this cut.
+        if (serveGate.principal !== requester)
+            return { ok: false, error: `the retirement request was REFUSED: the serve registration named (${args.serveEndpoint}/${args.serveInstanceId}) belongs to ${serveGate.principal}, not to the requesting principal ${requester}. A caller may only be authorized by its OWN serve registration. The despawn was a FULL no-op - the agent is unchanged and still running. NEXT: name your OWN principal's serve registration (any current instance of ${requester} will do), or call as the principal that owns this one.` };
         if (serveGate.processEpoch !== args.serveEpoch)
             return { ok: false, error: `the requesting manager instance ${args.serveInstanceId} was SUPERSEDED (it registered at epoch ${args.serveEpoch}, the current serve grant is epoch ${serveGate.processEpoch}), so this despawn was REFUSED as a FULL no-op - the agent is unchanged and still running, nothing was torn down. NEXT: recover the manager (\`cotal supervise\`), then retry the despawn under the current serving instance.` };
         // IDEMPOTENCE (the four-outcome table, in operator vocabulary).
-        const head = await readLifecycleHeadForOperation(opts.reg, args.owner, args.actor);
+        const head = await readLifecycleHeadForOperation(opts.reg, target.owner, target.actor);
         if (head === undefined)
-            return { ok: false, error: `no lifecycle exists for "${args.owner}/${args.actor}"; there is nothing to retire.` };
-        if (head.mapping.state === "retired" && head.mapping.lifecycleUid === args.lifecycleUid)
-            return { ok: true, data: { alreadyRetired: true, lifecycleUid: args.lifecycleUid } };
-        if (head.mapping.lifecycleUid !== args.lifecycleUid)
-            return { ok: false, error: `the despawn names a stale incarnation of "${args.owner}/${args.actor}" (current is ${head.mapping.lifecycleUid}); nothing was retired. NEXT: refresh the agent list and retry against the current incarnation.` };
-        const gate = await observeGate(opts.reg, args.lifecycleUid);
+            return { ok: false, error: `no lifecycle exists for "${target.owner}/${target.actor}"; there is nothing to retire.` };
+        if (head.mapping.state === "retired" && head.mapping.lifecycleUid === target.lifecycleUid)
+            return { ok: true, data: { alreadyRetired: true, lifecycleUid: target.lifecycleUid } };
+        if (head.mapping.lifecycleUid !== target.lifecycleUid)
+            return { ok: false, error: `the despawn names a stale incarnation of "${target.owner}/${target.actor}" (current is ${head.mapping.lifecycleUid}); nothing was retired. NEXT: refresh the agent list and retry against the current incarnation.` };
+        const gate = await observeGate(opts.reg, target.lifecycleUid);
         if (gate !== undefined && gate.row.state === "frozen" && gate.row.op !== undefined && gate.row.op.opId !== args.opId)
-            return { ok: false, error: `another operation (${gate.row.op.kind} ${gate.row.op.opId}) already holds "${args.owner}/${args.actor}"; this despawn did not start a second one. NEXT: wait for that operation to finish (or its resume on the next auth-service boot), then retry.` };
+            return { ok: false, error: `another operation (${gate.row.op.kind} ${gate.row.op.opId}) already holds "${target.owner}/${target.actor}"; this despawn did not start a second one. NEXT: wait for that operation to finish (or its resume on the next auth-service boot), then retry.` };
         // EXECUTE (create-or-resume: the barrier's own freeze CAS + durable intent make the same
         // opId resumable and a re-request idempotent). The drain, cleaner, and repair credentials
         // all come from the plane's reviewed deps - this listener holds none of those rights.
         const existing = barrierFlight.get(args.opId);
         if (existing !== undefined &&
-            (existing.owner !== args.owner || existing.actor !== args.actor || existing.lifecycleUid !== args.lifecycleUid))
-            return { ok: false, error: `operation id ${args.opId} is already in flight for a different lifecycle (${existing.owner}/${existing.actor} ${existing.lifecycleUid}); this despawn of "${args.owner}/${args.actor}" (${args.lifecycleUid}) was a FULL no-op - nothing was retired and it is still running. NEXT: retry the despawn (the manager derives a distinct operation id per lifecycle).` };
+            (existing.owner !== target.owner || existing.actor !== target.actor || existing.lifecycleUid !== target.lifecycleUid))
+            return { ok: false, error: `operation id ${args.opId} is already in flight for a different lifecycle (${existing.owner}/${existing.actor} ${existing.lifecycleUid}); this despawn of "${target.owner}/${target.actor}" (${target.lifecycleUid}) was a FULL no-op - nothing was retired and it is still running. NEXT: retry the despawn (the manager derives a distinct operation id per lifecycle).` };
         let flight = existing?.promise;
         if (flight === undefined) {
             // A despawn cannot know the target's pool work, and the barrier never takes a pool hint: it
@@ -175,17 +257,17 @@ export async function openAuthAdminListener(opts) {
             // obligations (#F). Discovery is never a gap - the barrier never closes a frontier over
             // un-cleaned accepted pool work (SPEC 13.1/13.9).
             flight = runAgentRetirementBarrier(opts.reg, {
-                owner: args.owner, actor: args.actor, lifecycleUid: args.lifecycleUid, opId: args.opId,
+                owner: target.owner, actor: target.actor, lifecycleUid: target.lifecycleUid, opId: args.opId,
                 frontierStreams: retirementFrontierStreams(space),
             }, opts.retirement);
             const settle = flight;
             void settle.catch(() => { }).finally(() => { if (barrierFlight.get(args.opId)?.promise === settle)
                 barrierFlight.delete(args.opId); });
-            barrierFlight.set(args.opId, { owner: args.owner, actor: args.actor, lifecycleUid: args.lifecycleUid, promise: flight });
+            barrierFlight.set(args.opId, { owner: target.owner, actor: target.actor, lifecycleUid: target.lifecycleUid, promise: flight });
         }
         const result = await flight;
-        log(`auth-admin: retired ${args.owner}/${args.actor} (${args.lifecycleUid}) by despawn request from ${requester} (op ${args.opId})`);
-        return { ok: true, data: { retired: true, lifecycleUid: args.lifecycleUid, opId: result.opId, evictedPrincipals: result.evictedPrincipals } };
+        log(`auth-admin: retired ${target.owner}/${target.actor} (${target.lifecycleUid}) by despawn request from ${requester} (op ${args.opId})`);
+        return { ok: true, data: { retired: true, lifecycleUid: target.lifecycleUid, opId: result.opId, evictedPrincipals: result.evictedPrincipals } };
     };
     return {
         close: async () => {

package/dist/auth-admin.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-admin.js","sourceRoot":"","sources":["../src/auth-admin.ts"],"names":[],"mappings":"AAqCA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,yBAAyB,EACzB,mBAAmB,EACnB,WAAW,GACZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAwB,MAAM,uBAAuB,CAAC;AAClF,OAAO,EAAE,yBAAyB,EAAuB,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAAE,WAAW,EAAE,6BAA6B,EAA0B,MAAM,yBAAyB,CAAC;AAE7G,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAC9B,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAE9B;;gEAEgE;AAChE,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,MAAc;IACnE,OAAO;QACL,OAAO,EAAE;YACP,iGAAiG;YACjG,8FAA8F;YAC9F,uFAAuF;YACvF,mGAAmG;YACnG,2FAA2F;YAC3F,0EAA0E;YAC1E,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,kBAAkB,cAAc;YAC7D,cAAc;YACd,2FAA2F;YAC3F,wFAAwF;YACxF,oFAAoF;YACpF,4EAA4E;YAC5E,6BAA6B,YAAY,CAAC,KAAK,CAAC,EAAE;SACnD;QACD,SAAS,EAAE,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,kBAAkB,MAAM,EAAE,UAAU,MAAM,IAAI,CAAC;KACzF,CAAC;AACJ,CAAC;AAkBD,SAAS,eAAe,CAAC,GAAY;IACnC,MAAM,KAAK,GAAG,kFAAkF,CAAC;IACjG,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QACzC,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,iCAAiC,KAAK,EAAE,CAAC,CAAC;IAC7F,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,eAAe,EAAE,iBAAiB,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC3I,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,iDAAiD,CAAC,kBAAkB,CAAC,CAAC;IACzH,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAC9H,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ;QAC5E,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,GAAG,CAAC;QACzF,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,iCAAiC,KAAK,sCAAsC,CAAC,CAAC;IACjI,OAAO;QACL,KAAK,EAAE,kBAAkB,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC;QAC3C,KAAK,EAAE,kBAAkB,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC;QAC3C,YAAY,EAAE,oBAAoB,CAAC,CAAC,CAAC,YAAY,EAAE,cAAc,CAAC;QAClE,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC;QAC1C,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC;QAC7C,eAAe,EAAE,oBAAoB,CAAC,CAAC,CAAC,eAAe,EAAE,iBAAiB,CAAC;QAC3E,UAAU,EAAE,CAAC,CAAC,UAAU;KACzB,CAAC;AACJ,CAAC;AAMD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAO3C;IACC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC5B,MAAM,MAAM,GAAoB,MAAM,mBAAmB,CAAC;QACxD,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW;QACzD,KAAK,EAAE,oBAAoB,KAAK,EAAE;QAClC,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,uBAAuB,CAAC,KAAK,EAAE,EAAE,CAAC;QAClD,GAAG;KACJ,CAAC,CAAC;IACH,IAAI,QAAkC,CAAC;IACvC,IAAI,CAAC;QACH,+FAA+F;QAC/F,yFAAyF;QACzF,QAAQ,GAAG,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,CAAC,CAAC;IACV,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,kBAAkB,GAAG,CAAC;IAClE,MAAM,GAAG,GAAiB,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,MAAM,KAAK,EAAE;QAC5D,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACrB,IAAI,GAAG;gBAAE,OAAO;YAChB,KAAK,CAAC,KAAK,IAAI,EAAE;gBACf,iFAAiF;gBACjF,qFAAqF;gBACrF,4EAA4E;gBAC5E,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,OAAO,SAAS,CAAC,EAAE,CAAC;oBAC9E,GAAG,CAAC,oCAAoC,GAAG,CAAC,OAAO,kCAAkC,GAAG,CAAC,KAAK,IAAI,MAAM,GAAG,CAAC,CAAC;oBAC7G,OAAO;gBACT,CAAC;gBACD,IAAI,KAAsD,CAAC;gBAC3D,IAAI,CAAC;oBACH,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;gBACnE,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,KAAK,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3E,CAAC;gBACD,IAAI,CAAC;oBACH,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACjD,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,GAAG,CAAC,uCAAuC,GAAG,CAAC,OAAO,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC3G,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;KACF,CAAC,CAAC;IAEH,iGAAiG;IACjG,wGAAwG;IACxG,uGAAuG;IACvG,wGAAwG;IACxG,EAAE;IACF,yGAAyG;IACzG,qGAAqG;IACrG,uGAAuG;IACvG,wGAAwG;IACxG,yGAAyG;IACzG,kGAAkG;IAClG,kEAAkE;IAClE,MAAM,aAAa,GAAG,IAAI,GAAG,EAAyH,CAAC;IAEvJ,MAAM,MAAM,GAAG,KAAK,EAAE,aAAqB,EAAE,IAAgB,EAA4D,EAAE;QACzH,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oEAAoE,EAAE,CAAC;QAC3H,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAE,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC,GAAG,CAAC;QAC3D,IAAI,GAAqC,CAAC;QAC1C,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAqC,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC;QAC1E,CAAC;QACD,IAAI,GAAG,CAAC,EAAE,KAAK,iBAAiB;YAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,2CAA2C,EAAE,CAAC;QAChG,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEvC,8FAA8F;QAC9F,8FAA8F;QAC9F,gGAAgG;QAChG,oGAAoG;QACpG,kGAAkG;QAClG,kGAAkG;QAClG,gGAAgG;QAChG,mGAAmG;QACnG,qGAAqG;QACrG,IAAI,SAAiF,CAAC;QACtF,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QACvI,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6GAA6G,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,gGAAgG,EAAE,CAAC;QACvR,CAAC;QACD,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS;YACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iEAAiE,KAAK,eAAe,IAAI,CAAC,eAAe,OAAO,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,6LAA6L,EAAE,CAAC;QAC5X,IAAI,SAAS,CAAC,YAAY,KAAK,IAAI,CAAC,UAAU;YAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,IAAI,CAAC,eAAe,2CAA2C,IAAI,CAAC,UAAU,sCAAsC,SAAS,CAAC,YAAY,+NAA+N,EAAE,CAAC;QAE5a,gEAAgE;QAChE,MAAM,IAAI,GAAG,MAAM,6BAA6B,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACnF,IAAI,IAAI,KAAK,SAAS;YACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,gCAAgC,EAAE,CAAC;QACpH,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY;YACrF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;QACvF,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY;YACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6CAA6C,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,iBAAiB,IAAI,CAAC,OAAO,CAAC,YAAY,iGAAiG,EAAE,CAAC;QAChP,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5D,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;YAClH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,oBAAoB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,gJAAgJ,EAAE,CAAC;QAEtR,yFAAyF;QACzF,0FAA0F;QAC1F,sFAAsF;QACtF,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,SAAS;YACtB,CAAC,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY,CAAC;YACjH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,IAAI,CAAC,IAAI,oDAAoD,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,YAAY,uBAAuB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,YAAY,wJAAwJ,EAAE,CAAC;QACpY,IAAI,MAAM,GAAG,QAAQ,EAAE,OAAO,CAAC;QAC/B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,4FAA4F;YAC5F,6FAA6F;YAC7F,wFAAwF;YACxF,kDAAkD;YAClD,MAAM,GAAG,yBAAyB,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC3C,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI;gBACtF,eAAe,EAAE,yBAAyB,CAAC,KAAK,CAAC;aAClD,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACpB,MAAM,MAAM,GAAG,MAAM,CAAC;YACtB,KAAK,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,KAAK,MAAM;gBAAE,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACtI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3H,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC;QAC5B,GAAG,CAAC,uBAAuB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,YAAY,6BAA6B,SAAS,QAAQ,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;QACrI,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,EAAE,CAAC;IAChJ,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,IAAI,CAAC;gBAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,6BAA6B,CAAC,CAAC;YAClE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"auth-admin.js","sourceRoot":"","sources":["../src/auth-admin.ts"],"names":[],"mappings":"AAkDA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,uBAAuB,EACvB,kBAAkB,EAClB,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,YAAY,EACZ,yBAAyB,EACzB,mBAAmB,GAEpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAwB,MAAM,uBAAuB,CAAC;AAClF,OAAO,EAAE,yBAAyB,EAAuB,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAAE,WAAW,EAAE,6BAA6B,EAA0B,MAAM,yBAAyB,CAAC;AAE7G,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAC9B,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAE9B;mGACmG;AACnG,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,WAAW,aAAa,CAAC,aAAa,CAAC,IAAI,kBAAkB,CAAC,uBAAuB,CAAC,IAAI,CAAC;AACzH,CAAC;AAED;;gEAEgE;AAChE,MAAM,UAAU,uBAAuB,CACrC,KAAa,EACb,MAAc,EACd,SAAgD;IAEhD,OAAO;QACL,OAAO,EAAE;YACP,2FAA2F;YAC3F,6FAA6F;YAC7F,8FAA8F;YAC9F,8FAA8F;YAC9F,2FAA2F;YAC3F,4FAA4F;YAC5F,qFAAqF;YACrF,uBAAuB,CAAC,KAAK,EAAE,aAAa,EAAE,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC;YACpF,cAAc;YACd,4FAA4F;YAC5F,4FAA4F;YAC5F,2FAA2F;YAC3F,8BAA8B;YAC9B,6BAA6B,YAAY,CAAC,KAAK,CAAC,EAAE;SACnD;QACD,6FAA6F;QAC7F,uFAAuF;QACvF,4FAA4F;QAC5F,4FAA4F;QAC5F,sEAAsE;QACtE,SAAS,EAAE,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,aAAa,CAAC,EAAE,EAAE,UAAU,MAAM,IAAI,CAAC;KACjG,CAAC;AACJ,CAAC;AAeD,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,iBAAiB,EAAE,YAAY,CAAC,CAAC;AAEnF;;;;;sGAKsG;AACtG,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC;QAC/D,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,4HAA4H,CAAC,CAAC;IACjL,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,GAAY;IACnC,MAAM,KAAK,GAAG,sDAAsD,CAAC;IACrE,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QACzC,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,iCAAiC,KAAK,EAAE,CAAC,CAAC;IAC7F,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,gGAAgG;IAChG,gGAAgG;IAChG,4FAA4F;IAC5F,2EAA2E;IAC3E,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC9D,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,iDAAiD,CAAC,gDAAgD,CAAC,CAAC;IACvJ,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAC1B,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ;QAC5E,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,GAAG,CAAC;QACzF,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,iCAAiC,KAAK,sCAAsC,CAAC,CAAC;IACjI,OAAO;QACL,+FAA+F;QAC/F,2FAA2F;QAC3F,2FAA2F;QAC3F,8DAA8D;QAC9D,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC;QAC1C,yFAAyF;QACzF,2FAA2F;QAC3F,mCAAmC;QACnC,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC;QAC7C,eAAe,EAAE,oBAAoB,CAAC,CAAC,CAAC,eAAe,EAAE,iBAAiB,CAAC;QAC3E,UAAU,EAAE,CAAC,CAAC,UAAU;KACzB,CAAC;AACJ,CAAC;AAMD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAO3C;IACC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC5B,8FAA8F;IAC9F,4FAA4F;IAC5F,2FAA2F;IAC3F,gGAAgG;IAChG,4FAA4F;IAC5F,mFAAmF;IACnF,MAAM,SAAS,GAAG,EAAE,UAAU,EAAE,gBAAgB,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAC/D,MAAM,MAAM,GAAoB,MAAM,mBAAmB,CAAC;QACxD,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW;QACzD,KAAK,EAAE,oBAAoB,KAAK,EAAE;QAClC,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,uBAAuB,CAAC,KAAK,EAAE,EAAE,EAAE,SAAS,CAAC;QAC7D,GAAG;KACJ,CAAC,CAAC;IACH,IAAI,QAAkC,CAAC;IACvC,IAAI,CAAC;QACH,+FAA+F;QAC/F,yFAAyF;QACzF,QAAQ,GAAG,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,CAAC,CAAC;IACV,CAAC;IACD,MAAM,GAAG,GAAiB,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE;QAClE,KAAK,EAAE,iBAAiB,CAAC,aAAa,CAAC;QACvC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACrB,IAAI,GAAG;gBAAE,OAAO;YAChB,KAAK,CAAC,KAAK,IAAI,EAAE;gBACf,yFAAyF;gBACzF,kFAAkF;gBAClF,yFAAyF;gBACzF,wFAAwF;gBACxF,yEAAyE;gBACzE,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC3C,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;oBAClD,+EAA+E;oBAC/E,iFAAiF;oBACjF,GAAG,CAAC,sDAAsD,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;oBACzE,OAAO;gBACT,CAAC;gBACD,MAAM,OAAO,GAAoB,MAAM,CAAC;gBACxC,4FAA4F;gBAC5F,0FAA0F;gBAC1F,4FAA4F;gBAC5F,IAAI,MAA0B,CAAC;gBAC/B,IAAI,CAAC;oBAAC,MAAM,GAAG,cAAc,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAsB,CAAC,EAAE,CAAC,CAAC;gBAAC,CAAC;gBAC3F,MAAM,CAAC;oBAAC,MAAM,GAAG,SAAS,CAAC;gBAAC,CAAC;gBAC7B,IAAI,KAAmE,CAAC;gBACxE,IAAI,CAAC;oBACH,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC1C,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,KAAK,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3E,CAAC;gBACD,4FAA4F;gBAC5F,oFAAoF;gBACpF,IAAI,MAAM,KAAK,SAAS;oBAAE,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC;gBAC5C,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;gBAC7D,IAAI,CAAC;oBACH,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC/D,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,GAAG,CAAC,uCAAuC,MAAM,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACtG,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;KACF,CAAC,CAAC;IAEH,iGAAiG;IACjG,wGAAwG;IACxG,uGAAuG;IACvG,wGAAwG;IACxG,EAAE;IACF,yGAAyG;IACzG,qGAAqG;IACrG,uGAAuG;IACvG,wGAAwG;IACxG,yGAAyG;IACzG,kGAAkG;IAClG,kEAAkE;IAClE,MAAM,aAAa,GAAG,IAAI,GAAG,EAAyH,CAAC;IAEvJ,MAAM,MAAM,GAAG,KAAK,EAAE,OAAwB,EAAE,IAAgB,EAAyE,EAAE;QACzI,IAAI,OAAO,CAAC,OAAO,KAAK,uBAAuB;YAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,OAAO,CAAC,OAAO,sCAAsC,EAAE,CAAC;QACjG,mFAAmF;QACnF,+FAA+F;QAC/F,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ;YAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2FAA2F,EAAE,CAAC;QAC3H,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACjH,uFAAuF;QACvF,wEAAwE;QACxE,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC;QAC/E,IAAI,GAAmD,CAAC;QACxD,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAqC,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC;QAC1E,CAAC;QACD,IAAI,GAAG,CAAC,EAAE,KAAK,iBAAiB;YAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,2CAA2C,EAAE,CAAC;QAChG,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEvC,8FAA8F;QAC9F,8FAA8F;QAC9F,gGAAgG;QAChG,oGAAoG;QACpG,kGAAkG;QAClG,kGAAkG;QAClG,+FAA+F;QAC/F,yFAAyF;QACzF,gGAAgG;QAChG,+FAA+F;QAC/F,yDAAyD;QACzD,8FAA8F;QAC9F,gGAAgG;QAChG,uDAAuD;QACvD,IAAI,SAAiF,CAAC;QACtF,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QACvI,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6GAA6G,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,gGAAgG,EAAE,CAAC;QACvR,CAAC;QACD,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS;YACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iEAAiE,KAAK,eAAe,IAAI,CAAC,eAAe,OAAO,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,6LAA6L,EAAE,CAAC;QAC5X,4FAA4F;QAC5F,6FAA6F;QAC7F,uFAAuF;QACvF,yFAAyF;QACzF,0FAA0F;QAC1F,2BAA2B;QAC3B,4FAA4F;QAC5F,+FAA+F;QAC/F,0FAA0F;QAC1F,qDAAqD;QACrD,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS;YACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qEAAqE,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,eAAe,gBAAgB,SAAS,CAAC,SAAS,qCAAqC,SAAS,yNAAyN,SAAS,yDAAyD,EAAE,CAAC;QAC3f,IAAI,SAAS,CAAC,YAAY,KAAK,IAAI,CAAC,UAAU;YAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,IAAI,CAAC,eAAe,2CAA2C,IAAI,CAAC,UAAU,sCAAsC,SAAS,CAAC,YAAY,+NAA+N,EAAE,CAAC;QAE5a,gEAAgE;QAChE,MAAM,IAAI,GAAG,MAAM,6BAA6B,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACvF,IAAI,IAAI,KAAK,SAAS;YACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,gCAAgC,EAAE,CAAC;QACxH,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY;YACvF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC;QACzF,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY;YACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6CAA6C,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,iBAAiB,IAAI,CAAC,OAAO,CAAC,YAAY,iGAAiG,EAAE,CAAC;QACpP,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAC9D,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;YAClH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,oBAAoB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,gJAAgJ,EAAE,CAAC;QAE1R,yFAAyF;QACzF,0FAA0F;QAC1F,sFAAsF;QACtF,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,SAAS;YACtB,CAAC,QAAQ,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY,CAAC;YACvH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,IAAI,CAAC,IAAI,oDAAoD,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,YAAY,uBAAuB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,MAAM,MAAM,CAAC,YAAY,wJAAwJ,EAAE,CAAC;QAC1Y,IAAI,MAAM,GAAG,QAAQ,EAAE,OAAO,CAAC;QAC/B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,4FAA4F;YAC5F,6FAA6F;YAC7F,wFAAwF;YACxF,kDAAkD;YAClD,MAAM,GAAG,yBAAyB,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC3C,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI;gBAC5F,eAAe,EAAE,yBAAyB,CAAC,KAAK,CAAC;aAClD,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACpB,MAAM,MAAM,GAAG,MAAM,CAAC;YACtB,KAAK,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,KAAK,MAAM;gBAAE,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACtI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACjI,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC;QAC5B,GAAG,CAAC,uBAAuB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,YAAY,6BAA6B,SAAS,QAAQ,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;QAC3I,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,EAAE,CAAC;IAClJ,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,IAAI,CAAC;gBAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,6BAA6B,CAAC,CAAC;YAClE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cotal-ai/auth",
   "description": "Cotal per-user auth bridge: opaque owner-token derivation and strict user-token validation for the NATS auth-callout cutover (Plane 1 ↔ Plane 2).",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -24,8 +24,8 @@
     "jose": "^6.2.3",
     "@nats-io/jetstream": "^3.4.0",
     "@nats-io/kv": "^3.4.0",
-    "@cotal-ai/core": "0.17.0",
-    "@cotal-ai/workspace": "0.17.0"
+    "@cotal-ai/core": "0.18.0",
+    "@cotal-ai/workspace": "0.18.0"
   },
   "devDependencies": {
     "better-auth": "^1.6.23"