@cotal-ai/auth 0.29.2 → 0.30.0

package/dist/provider.js

@@ -22,7 +22,7 @@ import { fetchIdpJwt, loadIdpSession, probeIdpJwks, requireIdpSession } from "./
 import { deriveOwnerForIdpSubject } from "./derive.js";
 import { findActorUnified, findInteractiveActor, grantManagedActor, newActorToken, revokeManagedActor } from "./ledger.js";
 import { userAuthTrustFingerprint, validateRetainedManagedAgent } from "./continuity.js";
-import { authCalloutKey, authIssuerKey, authOwnerSecretKey, authServiceKeysKey, ensureCalloutAuth, ensureIssuer, ensureOwnerSecret, ensurePinnedIdp, loadAuthServiceInfo, loadCalloutAuth, loadOwnerSecret, loadPinnedIdp, saveServiceKeys, } from "./store.js";
+import { AUTH_PROVIDER_NAME, authCalloutKey, authIssuerKey, authOwnerSecretKey, authServiceKeysKey, ensureCalloutAuth, ensureIssuer, ensureOwnerSecret, ensurePinnedIdp, loadAuthServiceInfo, loadCalloutAuth, loadOwnerSecret, loadPinnedIdp, saveServiceKeys, } from "./store.js";
 const READY_TIMEOUT_MS = 15_000;
 /** Present only if PROVEN present. `probeLiveness` resolves EPERM (another user's process) to
  *  `alive`, which is the defect this fixes: the old two-state probe called that dead. `unknown`
@@ -33,7 +33,7 @@ function pidAlive(pid) {
 }
 export const cotalAuthProvider = {
     kind: "auth-provider",
-    name: "cotal",
+    name: AUTH_PROVIDER_NAME,
     async prepareServer(input) {
         const { space, store, dir, idpUrl } = input;
         // Fail BEFORE mutation: a degenerate space (`.`/`..`/empty) must be refused before the IdP
@@ -56,7 +56,7 @@ export const cotalAuthProvider = {
         // (briefly privileged) call; the long-lived service loads this projection, never the space bundle.
         await saveServiceKeys(store, space, { dataAccount: { pub: input.account.pub, signingSeed: input.account.signingSeed } });
         const publicAuth = assertUserAuthInfo({
-            provider: "cotal",
+            provider: AUTH_PROVIDER_NAME,
             idp: { url: idp.url, issuer: idp.issuer, audience: idp.audience },
         });
         return {
@@ -152,6 +152,48 @@ export const cotalAuthProvider = {
             throw new Error(`the auth service's exchange returned no token - its build may be stale; restart it with \`cotal up\``);
         return { bearer: out.token, sentinelCreds: callout.sentinelCreds };
     },
+    async managerServiceAuthority({ store, dir, request }) {
+        const idp = loadPinnedIdp(dir);
+        const callout = await loadCalloutAuth(store, request.space);
+        let idpUrl;
+        let endpoint;
+        let authorization;
+        if (idp && callout) {
+            const info = loadAuthServiceInfo(dir);
+            if (!info || !pidAlive(info.pid))
+                throw new Error(`the user-auth service for space "${request.space}" is not running - restart it with \`cotal up\` before requesting manager-service authority`);
+            idpUrl = idp.url;
+            endpoint = `${info.url}/manager-service-authority`;
+            authorization = `Bearer ${info.cap}`;
+        }
+        else {
+            const entry = findMesh(request.space);
+            const ua = entry?.mode === "user" ? entry.userAuth : undefined;
+            if (ua?.remote !== true || typeof ua.endpoints?.url !== "string")
+                throw new Error(`space "${request.space}" has no pinned remote manager-authority endpoint - re-register it with \`cotal meshes add ${request.space} --from <url>\``);
+            idpUrl = ua.idp.url;
+            const base = pinnedExchangeUrl(ua.endpoints.url, request.space).replace(/\/exchange$/, "");
+            endpoint = ua.endpoints.managerAuthorityUrl ?? `${base}/manager-service-authority`;
+        }
+        const session = requireIdpSession(homeCotalDir(), idpUrl);
+        const idpJwt = await fetchIdpJwt(idpUrl, session.token);
+        let res;
+        try {
+            res = await fetch(endpoint, {
+                method: "POST",
+                headers: { "content-type": "application/json", ...(authorization ? { authorization } : {}) },
+                body: JSON.stringify({ idpToken: idpJwt, request }),
+                signal: AbortSignal.timeout(30_000),
+            });
+        }
+        catch (e) {
+            throw new Error(`the manager-service authority endpoint for space "${request.space}" did not answer at ${endpoint} (${e instanceof Error ? e.message : String(e)})`);
+        }
+        const body = await res.json().catch(() => ({}));
+        if (!res.ok)
+            throw new Error(`signed in, but manager-service authority was refused: ${body.error ?? `HTTP ${res.status}`}`);
+        return body;
+    },
     /** WHO the local login is, as this space's derived owner — offline (cached session sub + the
      *  space's owner secret; no IdP round trip). The spawn paths' "whose agents are these" answer. */
     async ownerForLogin({ store, dir, space }) {

package/dist/provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider.js","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,QAAQ,EAAiF,MAAM,gBAAgB,CAAC;AACzH,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAqB,MAAM,qBAAqB,CAAC;AACjI,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC1F,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC3H,OAAO,EAAE,wBAAwB,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AACzF,OAAO,EACL,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,aAAa,EACb,eAAe,GAChB,MAAM,YAAY,CAAC;AAEpB,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC;;;mFAGmF;AACnF,SAAS,QAAQ,CAAC,GAAW;IAC3B,OAAO,aAAa,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC;AACxC,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAiB;IAC7C,IAAI,EAAE,eAAe;IACrB,IAAI,EAAE,OAAO;IACb,KAAK,CAAC,aAAa,CAAC,KAAuB;QACzC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;QAC5C,2FAA2F;QAC3F,8FAA8F;QAC9F,4FAA4F;QAC5F,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,4FAA4F;QAC5F,6FAA6F;QAC7F,iGAAiG;QACjG,sFAAsF;QACtF,IAAI,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;YAAE,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;QAC9D,gGAAgG;QAChG,iCAAiC;QACjC,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACtC,MAAM,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3H,0FAA0F;QAC1F,mGAAmG;QACnG,MAAM,eAAe,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAEzH,MAAM,UAAU,GAAiB,kBAAkB,CAAC;YAClD,QAAQ,EAAE,OAAO;YACjB,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE;SAClE,CAAC,CAAC;QACH,OAAO;YACL,aAAa,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACvE,UAAU,EAAE,UAAgD;YAC5D,OAAO,EAAE;gBACP,OAAO,EAAE,cAAc;gBACvB,4FAA4F;gBAC5F,6FAA6F;gBAC7F,4FAA4F;gBAC5F,uCAAuC;gBACvC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,GAAG,gBAAgB,EAAE;oBACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;oBACxC,IAAI,UAAU,GAAG,yDAAyD,CAAC;oBAC3E,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;wBAC7B,IAAI,CAAC;4BACH,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;4BAC3C,IAAI,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gCAC/B,+EAA+E;gCAC/E,kFAAkF;gCAClF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,SAAS,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gCACrF,iFAAiF;gCACjF,kFAAkF;gCAClF,IAAI,GAAG,CAAC,EAAE;oCAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;gCAC7G,UAAU,GAAG,mBAAmB,IAAI,CAAC,GAAG,yBAAyB,GAAG,CAAC,MAAM,EAAE,CAAC;4BAChF,CAAC;iCAAM,IAAI,IAAI,EAAE,CAAC;gCAChB,gFAAgF;gCAChF,oFAAoF;gCACpF,wFAAwF;gCACxF,UAAU;oCACR,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,SAAS;wCACnC,CAAC,CAAC,4BAA4B,IAAI,CAAC,GAAG,+IAA+I;wCACrL,CAAC,CAAC,4BAA4B,IAAI,CAAC,GAAG,sCAAsC,CAAC;4BACnF,CAAC;wBACH,CAAC;wBAAC,OAAO,CAAC,EAAE,CAAC;4BACX,UAAU,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;wBAC1D,CAAC;wBACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;oBAC/C,CAAC;oBACD,qFAAqF;oBACrF,MAAM,IAAI,KAAK,CAAC,gCAAgC,SAAS,OAAO,UAAU,GAAG,CAAC,CAAC;gBACjF,CAAC;aACF;SACF,CAAC;IACJ,CAAC;IAED;;kGAE8F;IAC9F,KAAK,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAoF;QACxI,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACpD,2FAA2F;QAC3F,6FAA6F;QAC7F,+FAA+F;QAC/F,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO;YAAE,OAAO,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC5E,8FAA8F;QAC9F,MAAM,OAAO,GAAG,iBAAiB,CAAC,YAAY,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3D,wFAAwF;QACxF,wFAAwF;QACxF,wFAAwF;QACxF,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,IAAI,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,SAAS;YAC/C,MAAM,IAAI,KAAK,CACb,oCAAoC,KAAK,iBAAiB,IAAI,CAAC,GAAG,yKAAyK;gBACzO,iEAAiE,IAAI,CAAC,GAAG,gCAAgC,CAC5G,CAAC;QACJ,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,oCAAoC,KAAK,oFAAoF,KAAK,uBAAuB,CAC1J,CAAC;QACJ,+FAA+F;QAC/F,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,WAAW,EAAE;gBACxC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,GAAG,EAAE,EAAE;gBACpF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC1F,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,oCAAoC,KAAK,uBAAuB,IAAI,CAAC,GAAG,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,kCAAkC,CAC1J,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuB,CAAC;YACxE,0FAA0F;YAC1F,0FAA0F;YAC1F,MAAM,IAAI,KAAK,CACb,0CAA0C,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,IAAI,CAAC,KAAK,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,CACxI,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuB,CAAC;QACvE,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,KAAK;YAC7C,MAAM,IAAI,KAAK,CAAC,sGAAsG,CAAC,CAAC;QAC1H,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;IACrE,CAAC;IAED;sGACkG;IAClG,KAAK,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE;QACvC,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM;YACjB,MAAM,IAAI,KAAK,CAAC,UAAU,KAAK,8HAA8H,CAAC,CAAC;QACjK,MAAM,OAAO,GAAG,iBAAiB,CAAC,YAAY,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3D,IAAI,CAAC,OAAO,CAAC,GAAG;YACd,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,GAAG,2EAA2E,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;QAC1I,OAAO,wBAAwB,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACnE,CAAC;IAED;;;;oEAIgE;IAChE,KAAK,CAAC,qBAAqB,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAkD;QAChG,8FAA8F;QAC9F,MAAM,OAAO,GAAG,iBAAiB,CAAC,YAAY,EAAE,EAAE,MAAM,CAAC,CAAC;QAC1D,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBACrB,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,QAAQ;gBAClB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE,EAAE;gBACzF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;gBAC/B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,4DAA4D,GAAG,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACrI,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;YACvC,MAAM,IAAI,KAAK,CACb,mDAAmD,GAAG,CAAC,MAAM,2BAA2B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,gFAAgF,CAC1N,CAAC;QACJ,MAAM,IAAI,GAAY,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACzD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,MAAM,GAAI,IAA2B,CAAC,KAAK,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;YAC1E,sFAAsF;YACtF,MAAM,IAAI,KAAK,CACb,GAAG,CAAC,MAAM,KAAK,GAAG;gBAChB,CAAC,CAAC,uDAAuD,MAAM,gEAAgE,MAAM,IAAI;gBACzI,CAAC,CAAC,wCAAwC,KAAK,MAAM,MAAM,EAAE,CAChE,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;kFAE8E;IAC9E,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE;QAC3C,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG;YACN,MAAM,IAAI,KAAK,CACb,UAAU,KAAK,+HAA+H,CAC/I,CAAC;QACJ,MAAM,OAAO,GAAG,cAAc,CAAC,YAAY,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO,EAAE,GAAG;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;QACjE,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,wBAAwB,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACxE,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACpD,OAAO;YACL,MAAM,EAAE,GAAG,CAAC,GAAG;YACf,KAAK;YACL,KAAK;YACL,KAAK,EAAE,GAAG;gBACR,CAAC,CAAC;oBACE,KAAK,EAAE,GAAG,CAAC,KAAK;oBAChB,cAAc,EAAE,GAAG,CAAC,cAAc;oBAClC,YAAY,EAAE,GAAG,CAAC,YAAY;oBAC9B,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC3C;gBACH,CAAC,CAAC,aAAa;SAClB,CAAC;IACJ,CAAC;IAED;;;kCAG8B;IAC9B,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE;QAC1H,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO;YACV,MAAM,IAAI,KAAK,CAAC,UAAU,KAAK,qCAAqC,GAAG,yFAAyF,CAAC,CAAC;QACpK,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,aAAa,EAAE,CAAC;QAClD,iBAAiB,CAAC,GAAG,EAAE;YACrB,KAAK;YACL,KAAK;YACL,KAAK;YACL,cAAc;YACd,YAAY;YACZ,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3B,SAAS;YACT,YAAY;SACb,CAAC,CAAC;QACH,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE;QACrC,OAAO,kBAAkB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;IAED;;mGAE+F;IAC/F,KAAK,CAAC,kBAAkB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE;QACvC,MAAM,IAAI,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;QACjH,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM;YACjB,MAAM,IAAI,KAAK,CACb,sCAAsC,QAAQ,CAAC,MAAM,OAAO,IAAI,CAAC,MAAM,UAAU,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,kDAAkD,CACvJ,CAAC;IACN,CAAC;IAED;;mGAE+F;IAC/F,KAAK,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE;QACpC,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAChD,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE;QAC1C,OAAO,wBAAwB,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,IAAI;QAC9B,OAAO,4BAA4B,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED,kBAAkB,EAAE,cAAc;CACnC,CAAC;AAEF,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;AAErC;;;;4EAI4E;AAC5E,SAAS,iBAAiB,CAAC,QAAgB;IACzC,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACzD,IAAI,MAAM,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACd,IAAI,CAAC,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAC7B,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACxD,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;sEAGsE;AACtE,SAAS,iBAAiB,CAAC,IAAY,EAAE,KAAa;IACpD,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,UAAU,KAAK,oCAAoC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,2CAA2C,KAAK,iBAAiB,CACzI,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACvF,MAAM,IAAI,KAAK,CACb,UAAU,KAAK,gCAAgC,IAAI,mIAAmI,KAAK,uBAAuB,CACnN,CAAC;IACJ,CAAC,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC;IACzD,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC;IACd,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;IACZ,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;AACtB,CAAC;AAED;;;;;;4FAM4F;AAC5F,KAAK,UAAU,qBAAqB,CAClC,GAAW,EACX,KAAa,EACb,KAAa,EACb,IAAa;IAEb,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,EAAE,GAAG,KAAK,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,+FAA+F;IAC/F,gFAAgF;IAChF,MAAM,KAAK,GACT,EAAE,EAAE,MAAM,KAAK,IAAI;QACnB,OAAO,EAAE,CAAC,SAAS,EAAE,GAAG,KAAK,QAAQ;QACrC,OAAO,EAAE,CAAC,iBAAiB,KAAK,QAAQ;QACxC,OAAO,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;IAC/D,IAAI,CAAC,KAAK;QACR,MAAM,IAAI,KAAK,CACb,UAAU,KAAK,0JAA0J,KAAK,kEAAkE,CACjP,CAAC;IACJ,MAAM,MAAM,GAAG,EAA8E,CAAC;IAC9F,IAAI,aAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,aAAa,GAAG,YAAY,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,UAAU,KAAK,wEAAwE,MAAM,CAAC,iBAAiB,oBAAoB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,2CAA2C,KAAK,iBAAiB,CAC/O,CAAC;IACJ,CAAC;IACD,6FAA6F;IAC7F,+FAA+F;IAC/F,MAAM,WAAW,GAAG,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACnE,gGAAgG;IAChG,MAAM,OAAO,GAAG,iBAAiB,CAAC,YAAY,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClE,+FAA+F;IAC/F,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE;YAC7B,MAAM,EAAE,MAAM;YACd,2FAA2F;YAC3F,0FAA0F;YAC1F,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YAC1F,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,2BAA2B,KAAK,uBAAuB,WAAW,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,iEAAiE,KAAK,mCAAmC,CAC3N,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuB,CAAC;QACxE,2FAA2F;QAC3F,wFAAwF;QACxF,sDAAsD;QACtD,MAAM,IAAI,KAAK,CACb,0CAA0C,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,IAAI,CAAC,KAAK,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,CACxI,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuB,CAAC;IACvE,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,KAAK;QAC7C,MAAM,IAAI,KAAK,CAAC,mBAAmB,WAAW,iEAAiE,CAAC,CAAC;IACnH,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,QAAQ,EAA0J,MAAM,gBAAgB,CAAC;AAClM,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAqB,MAAM,qBAAqB,CAAC;AACjI,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC1F,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC3H,OAAO,EAAE,wBAAwB,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AACzF,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,aAAa,EACb,eAAe,GAChB,MAAM,YAAY,CAAC;AAEpB,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC;;;mFAGmF;AACnF,SAAS,QAAQ,CAAC,GAAW;IAC3B,OAAO,aAAa,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC;AACxC,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAiB;IAC7C,IAAI,EAAE,eAAe;IACrB,IAAI,EAAE,kBAAkB;IACxB,KAAK,CAAC,aAAa,CAAC,KAAuB;QACzC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;QAC5C,2FAA2F;QAC3F,8FAA8F;QAC9F,4FAA4F;QAC5F,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,4FAA4F;QAC5F,6FAA6F;QAC7F,iGAAiG;QACjG,sFAAsF;QACtF,IAAI,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;YAAE,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;QAC9D,gGAAgG;QAChG,iCAAiC;QACjC,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACtC,MAAM,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3H,0FAA0F;QAC1F,mGAAmG;QACnG,MAAM,eAAe,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAEzH,MAAM,UAAU,GAAiB,kBAAkB,CAAC;YAClD,QAAQ,EAAE,kBAAkB;YAC5B,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE;SAClE,CAAC,CAAC;QACH,OAAO;YACL,aAAa,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACvE,UAAU,EAAE,UAAgD;YAC5D,OAAO,EAAE;gBACP,OAAO,EAAE,cAAc;gBACvB,4FAA4F;gBAC5F,6FAA6F;gBAC7F,4FAA4F;gBAC5F,uCAAuC;gBACvC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,GAAG,gBAAgB,EAAE;oBACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;oBACxC,IAAI,UAAU,GAAG,yDAAyD,CAAC;oBAC3E,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;wBAC7B,IAAI,CAAC;4BACH,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;4BAC3C,IAAI,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gCAC/B,+EAA+E;gCAC/E,kFAAkF;gCAClF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,SAAS,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gCACrF,iFAAiF;gCACjF,kFAAkF;gCAClF,IAAI,GAAG,CAAC,EAAE;oCAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;gCAC7G,UAAU,GAAG,mBAAmB,IAAI,CAAC,GAAG,yBAAyB,GAAG,CAAC,MAAM,EAAE,CAAC;4BAChF,CAAC;iCAAM,IAAI,IAAI,EAAE,CAAC;gCAChB,gFAAgF;gCAChF,oFAAoF;gCACpF,wFAAwF;gCACxF,UAAU;oCACR,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,SAAS;wCACnC,CAAC,CAAC,4BAA4B,IAAI,CAAC,GAAG,+IAA+I;wCACrL,CAAC,CAAC,4BAA4B,IAAI,CAAC,GAAG,sCAAsC,CAAC;4BACnF,CAAC;wBACH,CAAC;wBAAC,OAAO,CAAC,EAAE,CAAC;4BACX,UAAU,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;wBAC1D,CAAC;wBACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;oBAC/C,CAAC;oBACD,qFAAqF;oBACrF,MAAM,IAAI,KAAK,CAAC,gCAAgC,SAAS,OAAO,UAAU,GAAG,CAAC,CAAC;gBACjF,CAAC;aACF;SACF,CAAC;IACJ,CAAC;IAED;;kGAE8F;IAC9F,KAAK,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAoF;QACxI,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACpD,2FAA2F;QAC3F,6FAA6F;QAC7F,+FAA+F;QAC/F,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO;YAAE,OAAO,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC5E,8FAA8F;QAC9F,MAAM,OAAO,GAAG,iBAAiB,CAAC,YAAY,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3D,wFAAwF;QACxF,wFAAwF;QACxF,wFAAwF;QACxF,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,IAAI,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,SAAS;YAC/C,MAAM,IAAI,KAAK,CACb,oCAAoC,KAAK,iBAAiB,IAAI,CAAC,GAAG,yKAAyK;gBACzO,iEAAiE,IAAI,CAAC,GAAG,gCAAgC,CAC5G,CAAC;QACJ,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,oCAAoC,KAAK,oFAAoF,KAAK,uBAAuB,CAC1J,CAAC;QACJ,+FAA+F;QAC/F,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACzD,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,WAAW,EAAE;gBACxC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,GAAG,EAAE,EAAE;gBACpF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC1F,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,oCAAoC,KAAK,uBAAuB,IAAI,CAAC,GAAG,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,kCAAkC,CAC1J,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuB,CAAC;YACxE,0FAA0F;YAC1F,0FAA0F;YAC1F,MAAM,IAAI,KAAK,CACb,0CAA0C,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,IAAI,CAAC,KAAK,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,CACxI,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuB,CAAC;QACvE,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,KAAK;YAC7C,MAAM,IAAI,KAAK,CAAC,sGAAsG,CAAC,CAAC;QAC1H,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAA+E;QAChI,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5D,IAAI,MAAc,CAAC;QACnB,IAAI,QAAgB,CAAC;QACrB,IAAI,aAAiC,CAAC;QACtC,IAAI,GAAG,IAAI,OAAO,EAAE,CAAC;YACnB,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,oCAAoC,OAAO,CAAC,KAAK,6FAA6F,CAAC,CAAC;YAClK,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC;YACjB,QAAQ,GAAG,GAAG,IAAI,CAAC,GAAG,4BAA4B,CAAC;YACnD,aAAa,GAAG,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACtC,MAAM,EAAE,GAAG,KAAK,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;YAC/D,IAAI,EAAE,EAAE,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,CAAC,SAAS,EAAE,GAAG,KAAK,QAAQ;gBAC9D,MAAM,IAAI,KAAK,CAAC,UAAU,OAAO,CAAC,KAAK,8FAA8F,OAAO,CAAC,KAAK,iBAAiB,CAAC,CAAC;YACvK,MAAM,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;YACpB,MAAM,IAAI,GAAG,iBAAiB,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;YAC3F,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,mBAAmB,IAAI,GAAG,IAAI,4BAA4B,CAAC;QACrF,CAAC;QACD,MAAM,OAAO,GAAG,iBAAiB,CAAC,YAAY,EAAE,EAAE,MAAM,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACxD,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;gBAC1B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;gBAC5F,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;gBACnD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,qDAAqD,OAAO,CAAC,KAAK,uBAAuB,QAAQ,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACvK,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG,CAAC,EAAE;YACT,MAAM,IAAI,KAAK,CAAC,yDAA0D,IAA2B,CAAC,KAAK,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACzI,OAAO,IAAsC,CAAC;IAChD,CAAC;IAED;sGACkG;IAClG,KAAK,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE;QACvC,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM;YACjB,MAAM,IAAI,KAAK,CAAC,UAAU,KAAK,8HAA8H,CAAC,CAAC;QACjK,MAAM,OAAO,GAAG,iBAAiB,CAAC,YAAY,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3D,IAAI,CAAC,OAAO,CAAC,GAAG;YACd,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,GAAG,2EAA2E,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;QAC1I,OAAO,wBAAwB,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACnE,CAAC;IAED;;;;oEAIgE;IAChE,KAAK,CAAC,qBAAqB,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAkD;QAChG,8FAA8F;QAC9F,MAAM,OAAO,GAAG,iBAAiB,CAAC,YAAY,EAAE,EAAE,MAAM,CAAC,CAAC;QAC1D,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBACrB,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,QAAQ;gBAClB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE,EAAE;gBACzF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;gBAC/B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,4DAA4D,GAAG,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACrI,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;YACvC,MAAM,IAAI,KAAK,CACb,mDAAmD,GAAG,CAAC,MAAM,2BAA2B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,gFAAgF,CAC1N,CAAC;QACJ,MAAM,IAAI,GAAY,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACzD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,MAAM,GAAI,IAA2B,CAAC,KAAK,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;YAC1E,sFAAsF;YACtF,MAAM,IAAI,KAAK,CACb,GAAG,CAAC,MAAM,KAAK,GAAG;gBAChB,CAAC,CAAC,uDAAuD,MAAM,gEAAgE,MAAM,IAAI;gBACzI,CAAC,CAAC,wCAAwC,KAAK,MAAM,MAAM,EAAE,CAChE,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;kFAE8E;IAC9E,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE;QAC3C,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG;YACN,MAAM,IAAI,KAAK,CACb,UAAU,KAAK,+HAA+H,CAC/I,CAAC;QACJ,MAAM,OAAO,GAAG,cAAc,CAAC,YAAY,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO,EAAE,GAAG;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;QACjE,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,wBAAwB,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACxE,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACpD,OAAO;YACL,MAAM,EAAE,GAAG,CAAC,GAAG;YACf,KAAK;YACL,KAAK;YACL,KAAK,EAAE,GAAG;gBACR,CAAC,CAAC;oBACE,KAAK,EAAE,GAAG,CAAC,KAAK;oBAChB,cAAc,EAAE,GAAG,CAAC,cAAc;oBAClC,YAAY,EAAE,GAAG,CAAC,YAAY;oBAC9B,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC3C;gBACH,CAAC,CAAC,aAAa;SAClB,CAAC;IACJ,CAAC;IAED;;;kCAG8B;IAC9B,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE;QAC1H,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO;YACV,MAAM,IAAI,KAAK,CAAC,UAAU,KAAK,qCAAqC,GAAG,yFAAyF,CAAC,CAAC;QACpK,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,aAAa,EAAE,CAAC;QAClD,iBAAiB,CAAC,GAAG,EAAE;YACrB,KAAK;YACL,KAAK;YACL,KAAK;YACL,cAAc;YACd,YAAY;YACZ,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3B,SAAS;YACT,YAAY;SACb,CAAC,CAAC;QACH,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE;QACrC,OAAO,kBAAkB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;IAED;;mGAE+F;IAC/F,KAAK,CAAC,kBAAkB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE;QACvC,MAAM,IAAI,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;QACjH,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM;YACjB,MAAM,IAAI,KAAK,CACb,sCAAsC,QAAQ,CAAC,MAAM,OAAO,IAAI,CAAC,MAAM,UAAU,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,kDAAkD,CACvJ,CAAC;IACN,CAAC;IAED;;mGAE+F;IAC/F,KAAK,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE;QACpC,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAChD,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE;QAC1C,OAAO,wBAAwB,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,IAAI;QAC9B,OAAO,4BAA4B,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED,kBAAkB,EAAE,cAAc;CACnC,CAAC;AAEF,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;AAErC;;;;4EAI4E;AAC5E,SAAS,iBAAiB,CAAC,QAAgB;IACzC,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACzD,IAAI,MAAM,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACd,IAAI,CAAC,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAC7B,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACxD,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;sEAGsE;AACtE,SAAS,iBAAiB,CAAC,IAAY,EAAE,KAAa;IACpD,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,UAAU,KAAK,oCAAoC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,2CAA2C,KAAK,iBAAiB,CACzI,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACvF,MAAM,IAAI,KAAK,CACb,UAAU,KAAK,gCAAgC,IAAI,mIAAmI,KAAK,uBAAuB,CACnN,CAAC;IACJ,CAAC,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC;IACzD,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC;IACd,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;IACZ,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;AACtB,CAAC;AAED;;;;;;4FAM4F;AAC5F,KAAK,UAAU,qBAAqB,CAClC,GAAW,EACX,KAAa,EACb,KAAa,EACb,IAAa;IAEb,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,EAAE,GAAG,KAAK,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,+FAA+F;IAC/F,gFAAgF;IAChF,MAAM,KAAK,GACT,EAAE,EAAE,MAAM,KAAK,IAAI;QACnB,OAAO,EAAE,CAAC,SAAS,EAAE,GAAG,KAAK,QAAQ;QACrC,OAAO,EAAE,CAAC,iBAAiB,KAAK,QAAQ;QACxC,OAAO,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;IAC/D,IAAI,CAAC,KAAK;QACR,MAAM,IAAI,KAAK,CACb,UAAU,KAAK,0JAA0J,KAAK,kEAAkE,CACjP,CAAC;IACJ,MAAM,MAAM,GAAG,EAA8E,CAAC;IAC9F,IAAI,aAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,aAAa,GAAG,YAAY,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,UAAU,KAAK,wEAAwE,MAAM,CAAC,iBAAiB,oBAAoB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,2CAA2C,KAAK,iBAAiB,CAC/O,CAAC;IACJ,CAAC;IACD,6FAA6F;IAC7F,+FAA+F;IAC/F,MAAM,WAAW,GAAG,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACnE,gGAAgG;IAChG,MAAM,OAAO,GAAG,iBAAiB,CAAC,YAAY,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClE,+FAA+F;IAC/F,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE;YAC7B,MAAM,EAAE,MAAM;YACd,2FAA2F;YAC3F,0FAA0F;YAC1F,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YAC1F,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,2BAA2B,KAAK,uBAAuB,WAAW,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,iEAAiE,KAAK,mCAAmC,CAC3N,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuB,CAAC;QACxE,2FAA2F;QAC3F,wFAAwF;QACxF,sDAAsD;QACtD,MAAM,IAAI,KAAK,CACb,0CAA0C,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,IAAI,CAAC,KAAK,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,CACxI,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuB,CAAC;IACvE,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,KAAK;QAC7C,MAAM,IAAI,KAAK,CAAC,mBAAmB,WAAW,iEAAiE,CAAC,CAAC;IACnH,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,CAAC;AAC9C,CAAC"}

package/dist/service.d.ts

@@ -1,4 +1,4 @@
-import { type ParsedArgs, type SecretStore } from "@cotal-ai/core";
+import { type ParsedArgs, type RemoteManagerAuthorityRequest, type SecretStore } from "@cotal-ai/core";
 import type { ValidatedUserToken } from "./token.js";
 import { type PlaneLivenessOracle } from "./plane-claim.js";
 import { type EvictPrincipal } from "./credential-ledger.js";
@@ -16,6 +16,11 @@ export interface AuthAuthorityPlane {
         actor: string;
         lifecycleUid: string;
     }) => Promise<string>;
+    issueManagerServiceAuthority: (args: {
+        owner: string;
+        scope: string[];
+        request: RemoteManagerAuthorityRequest;
+    }) => Promise<import("@cotal-ai/core").RemoteManagerAuthorityMaterial>;
     /** Resolves with the state-3 copy when a mid-life scanner death FENCES the plane (SPEC 13.13):
      *  the plane is no longer whole, `authorizeConnect`/`mintConnectCredential` refuse from that
      *  moment, and the composition root must take the whole service DOWN loud (a fenced plane that

package/dist/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAyDA,OAAO,EAAgF,KAAK,UAAU,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAKjJ,OAAO,KAAK,EAAiB,kBAAkB,EAAE,MAAM,YAAY,CAAC;AASpE,OAAO,EAA0F,KAAK,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACpJ,OAAO,EAAkD,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAyB7G;uDACuD;AACvD,eAAO,MAAM,gBAAgB,MAAM,CAAC;AAqBpC;;;+DAG+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,gBAAgB,EAAE,CAAC,CAAC,EAAE,kBAAkB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,qBAAqB,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACzG;;;;uBAImB;IACnB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACxB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,uFAAuF;IACvF,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B;;wEAEoE;IACpE,YAAY,CAAC,EAAE,cAAc,CAAC;IAC9B;;4EAEwE;IACxE,gBAAgB,CAAC,EAAE,mBAAmB,CAAC;IACvC;;iFAE6E;IAC7E,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;QAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,KAAK,IAAI,CAAC;CACjG,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA8M9B;AAiCD;;;;;;;;;;;sEAWsE;AACtE,wBAAsB,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CA0LzF;AAkPD;;oFAEoF;AACpF,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUrE;AAED;;;;;;sBAMsB;AACtB,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,aAAa,EAAE,MAAM,CAAC;IACtB;;gGAE4F;IAC5F,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAiB1B;AAED;;;mDAGmD;AACnD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAEnG;AAED;;;cAGc;AACd,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUzE"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAyDA,OAAO,EAAmO,KAAK,UAAU,EAAE,KAAK,6BAA6B,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAMxU,OAAO,KAAK,EAAiB,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAWpE,OAAO,EAA0F,KAAK,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACpJ,OAAO,EAAkD,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AA0B7G;uDACuD;AACvD,eAAO,MAAM,gBAAgB,MAAM,CAAC;AAqBpC;;;+DAG+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,gBAAgB,EAAE,CAAC,CAAC,EAAE,kBAAkB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,qBAAqB,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACzG,4BAA4B,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,6BAA6B,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;IACrL;;;;uBAImB;IACnB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACxB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,uFAAuF;IACvF,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B;;wEAEoE;IACpE,YAAY,CAAC,EAAE,cAAc,CAAC;IAC9B;;4EAEwE;IACxE,gBAAgB,CAAC,EAAE,mBAAmB,CAAC;IACvC;;iFAE6E;IAC7E,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;QAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,KAAK,IAAI,CAAC;CACjG,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAqU9B;AAiCD;;;;;;;;;;;sEAWsE;AACtE,wBAAsB,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CA2LzF;AAySD;;oFAEoF;AACpF,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUrE;AAED;;;;;;sBAMsB;AACtB,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,aAAa,EAAE,MAAM,CAAC;IACtB;;gGAE4F;IAC5F,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmB1B;AAED;;;mDAGmD;AACnD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAInG;AAED;;;cAGc;AACd,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUzE"}

package/dist/service.js

@@ -55,14 +55,17 @@ import { createServer } from "node:http";
 import { connect, credsAuthenticator } from "@nats-io/transport-node";
 import { jetstreamManager } from "@nats-io/jetstream";
 import { Kvm } from "@nats-io/kv";
-import { admissionMediatorGrants, EpEnvelopeError, ensureAuthorityStores, isReachable } from "@cotal-ai/core";
+import { admissionMediatorGrants, authorizeTrustedServeSnapshot, commitSiblingIssuance, EpEnvelopeError, ensureAuthorityStores, epAuthBucket, isReachable, mintPublicUserJwt, rawDigest, serveIssuanceGateKv, STANDING_RENEWABLE_TTL_SEC } from "@cotal-ai/core";
 import { findCotalRoot, userAuthStateDir, workspaceSecretStore } from "@cotal-ai/workspace";
 import { decodeJwt } from "jose";
+import { deriveOwnerForIdpSubject } from "./derive.js";
 import { startAuthCallout } from "./callout.js";
-import { createIdpBridge } from "./idp.js";
+import { createIdpBridge, verifyIdpToken } from "./idp.js";
 import { pinnedJwksResolver } from "./issuer.js";
 import { calloutPermissions } from "./permissions.js";
-import { authorityBarrierGrants, authorityWriterGrants, openAuthorityClient, openSupervisedConnectReader } from "./authority-client.js";
+import { issueRemoteManagerAuthority } from "./manager-authority.js";
+import { reconstructRemoteManagerServeGrant } from "./manager-contract.js";
+import { authorityBarrierGrants, authorityWriterGrants, openAuthorityClient, openSupervisedConnectReader, remoteManagerIssuerGrants, remoteManagerRegistrationProof } from "./authority-client.js";
 import { authorizeConnectCredential } from "./connect-reader.js";
 import { ensureRootCredential } from "./root-credential.js";
 import { observeGate, openLifecycleRegistry } from "./lifecycle-registry.js";
@@ -77,7 +80,7 @@ import { makeDrainRepairers } from "./drain-repair.js";
 import { openAuthAdminListener } from "./auth-admin.js";
 import { drainTargetForEndpoint, openAdmissionMediator } from "./admission-mediator.js";
 import { AGENT_BEARER_TTL_SEC, ledgerAclResolver, ledgerAuthorizeAgentExchange, ledgerAuthorizeConnect, ledgerAuthorizeGrant, } from "./ledger.js";
-import { clearAuthServiceInfo, loadCalloutAuth, loadIssuer, loadOwnerSecret, loadPinnedIdp, loadServiceKeys, saveAuthServiceInfo, spaceIssuer, } from "./store.js";
+import { AUTH_PROVIDER_NAME, clearAuthServiceInfo, loadCalloutAuth, loadIssuer, loadOwnerSecret, loadPinnedIdp, loadServiceKeys, saveAuthServiceInfo, spaceIssuer, } from "./store.js";
 /** JWKS max-age seconds — the cache contract's knob. Exported so a rotation tool can compute the
  *  retire floor (max-age + max bearer TTL) from it. */
 export const JWKS_MAX_AGE_SEC = 300;
@@ -127,6 +130,19 @@ export async function openAuthAuthorityPlane(opts) {
         await writer.close();
         throw e;
     }
+    // The typed remote-manager issuer is a distinct self-minted connection. It adds only the
+    // endpoint-manager gate/credential family to the root issuance surface and is never exposed as
+    // a generic mint endpoint. Its JWTs are signed for caller-generated public nkeys; private seeds
+    // stay on the participant machine.
+    let remoteIssuer;
+    try {
+        remoteIssuer = await openAuthorityClient({ server, space, dataAccount, label: `cotal:remote-manager-issuer:${space}`, grants: (id) => remoteManagerIssuerGrants(space, id), log });
+    }
+    catch (e) {
+        await reader.close();
+        await writer.close();
+        throw e;
+    }
     // The BARRIER EXECUTOR: the third self-minted connection, with its own registry bind — the
     // mint writer stays the minimal issuance credential ("barriers are NOT this credential's
     // job") and the barrier's stage-write authority lives here alone. The barrier profile holds NO
@@ -197,6 +213,7 @@ export async function openAuthAuthorityPlane(opts) {
         await ledgerCand?.close();
         await hold?.release();
         await barrier?.close();
+        await remoteIssuer.close();
         await reader.close();
         await writer.close();
         throw e;
@@ -262,6 +279,7 @@ export async function openAuthAuthorityPlane(opts) {
         await scanner.close();
         await hold.release();
         await barrier.close();
+        await remoteIssuer.close();
         await reader.close();
         await writer.close();
         throw e;
@@ -281,6 +299,7 @@ export async function openAuthAuthorityPlane(opts) {
         await scanner.close();
         await hold.release();
         await barrier.close();
+        await remoteIssuer.close();
         await reader.close();
         await writer.close();
         throw e;
@@ -304,6 +323,90 @@ export async function openAuthAuthorityPlane(opts) {
             refuseIfFenced();
             return ensureRootCredential(registry, { ...args, managerInstance: `auth-service:${space}` });
         },
+        issueManagerServiceAuthority: async ({ owner, scope, request }) => {
+            refuseIfFenced();
+            return issueRemoteManagerAuthority({
+                owner,
+                scope,
+                request,
+                issue: async ({ actors, request: r }) => {
+                    const credential = async (key, profile, actor, opts) => mintPublicUserJwt({ space, account: { pub: dataAccount.pub, signingSeed: dataAccount.signingSeed } }, r.identities[key].id, profile, { ...opts, principal: { owner, actor }, lifecycleUid: r.managerLifecycleUid });
+                    const credentials = {};
+                    if (r.operation === "prepare" || r.operation === "renew") {
+                        credentials.supervisor = await credential("supervisor", "remote-manager", actors.supervisor, {
+                            remoteManager: { instanceId: r.instanceId, owner, actor: actors.supervisor },
+                            expiresInSeconds: STANDING_RENEWABLE_TTL_SEC,
+                        });
+                        // The registration executor intentionally receives the SAME exact instance-scoped
+                        // grant surface as the supervisor credential, but under a separate nkey and bounded
+                        // five-minute lifetime. It is used only for prepare→activate and then discarded.
+                        credentials.executor = await credential("executor", "remote-manager", actors.executor, {
+                            remoteManager: { instanceId: r.instanceId, owner, actor: actors.executor },
+                            expiresInSeconds: 5 * 60,
+                        });
+                    }
+                    if (r.operation === "session") {
+                        const expectedProof = remoteManagerRegistrationProof(owner, r);
+                        if (r.registrationProof !== expectedProof)
+                            throw new EpEnvelopeError("permission-denied", "manager-service session proof does not match this owner/lifecycle");
+                        const session = r.session;
+                        const exp = Math.min(session.exp, Math.floor(Date.now() / 1000) + 24 * 60 * 60);
+                        credentials.sessionServing = await mintPublicUserJwt({ space, account: { pub: dataAccount.pub, signingSeed: dataAccount.signingSeed } }, session.id, "session-serving", {
+                            principal: { owner, actor: actors.serve },
+                            lifecycleUid: r.managerLifecycleUid,
+                            sessionServing: { endpoint: "manager", sessionId: session.sessionId, epoch: session.epoch },
+                            expiresAt: exp,
+                        });
+                        return { credentials };
+                    }
+                    if (r.operation === "activate") {
+                        const expectedProof = remoteManagerRegistrationProof(owner, r);
+                        if (r.registrationProof !== expectedProof)
+                            throw new EpEnvelopeError("permission-denied", "manager-service registration proof does not match this owner/lifecycle/artifact set");
+                        // The serve JWT is issued from the registered-surface snapshot the participant
+                        // returned from the branded local core path. That brand is process-local and cannot
+                        // cross HTTP, so the host independently validates the deterministic proof + canonical
+                        // artifact set and scopes the JWT to the already-registered instance rails. The grant
+                        // rows are reconstructed from the canonical manager command set by the host protocol.
+                        const gate = serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId: r.instanceId });
+                        const observed = await gate.observe();
+                        if (!observed)
+                            throw new EpEnvelopeError("failed-precondition", "manager-service activation found no issuance gate");
+                        credentials.serve = await mintPublicUserJwt({ space, account: { pub: dataAccount.pub, signingSeed: dataAccount.signingSeed } }, r.identities.serve.id, "endpoint-serve", {
+                            principal: { owner, actor: actors.serve },
+                            lifecycleUid: r.managerLifecycleUid,
+                            expiresInSeconds: STANDING_RENEWABLE_TTL_SEC,
+                            endpointServe: reconstructRemoteManagerServeGrant(r, owner, actors.serve, observed),
+                            serveIssuance: gate,
+                        });
+                        if (!observed)
+                            throw new EpEnvelopeError("failed-precondition", "manager-service activation found no issuance gate");
+                        const sibling = async (key, profile, actor) => {
+                            const issued = await credential(key, profile, actor, profile === "goal-writer" ? { goalWriter: { endpoint: "manager" }, expiresInSeconds: STANDING_RENEWABLE_TTL_SEC } : { expiresInSeconds: STANDING_RENEWABLE_TTL_SEC });
+                            await commitSiblingIssuance(gate, observed, {
+                                credentialId: rawDigest(issued.jwt).replace("sha256:", "sha256-"),
+                                credentialKey: r.identities[key].id,
+                                holderPrincipal: `${owner}.${actor}`,
+                                endpoint: "manager",
+                                lifecycleUid: r.instanceId,
+                                sourceChain: ["root"],
+                                state: "active",
+                                exp: issued.exp,
+                                generation: observed.generation,
+                                processEpoch: observed.processEpoch,
+                                registrationRevision: observed.registrationRevision,
+                                nameAuthorityRevision: observed.nameAuthorityRevision,
+                            });
+                            return issued;
+                        };
+                        credentials.goalWriter = await sibling("goalWriter", "goal-writer", actors.goalWriter);
+                        credentials.sessionLedger = await sibling("sessionLedger", "session-ledger", actors.sessionLedger);
+                        return { credentials };
+                    }
+                    return { credentials };
+                },
+            });
+        },
         fenced,
         close: async () => {
             // Clean-close order (SPEC 13.13): the rail stops answering first, then scan-capable
@@ -316,6 +419,7 @@ export async function openAuthAuthorityPlane(opts) {
             await scanner.close();
             await hold.release();
             await barrier.close();
+            await remoteIssuer.close();
             await writer.close();
         },
     };
@@ -460,8 +564,9 @@ export async function runAuthService(args, store) {
     // usable user mesh while the SUB was still in flight would intermittently deny first connects.
     await nc.flush();
     // ---- Plane 1: the exchange + JWKS, loopback HTTP ----
+    const bridgeIdp = { issuer: idp.issuer, audience: idp.audience, key: pinnedJwksResolver(idp.jwksUri) };
     const bridge = createIdpBridge({
-        idp: { issuer: idp.issuer, audience: idp.audience, key: pinnedJwksResolver(idp.jwksUri) },
+        idp: bridgeIdp,
         space,
         spaceSecret: ownerSecret,
         issuer,
@@ -471,7 +576,7 @@ export async function runAuthService(args, store) {
     const cap = randomBytes(32).toString("hex"); // per-start exchange capability (rotates with the daemon)
     const failures = []; // rolling-window timestamps of REFUSED exchanges
     const badCaps = []; // rolling-window timestamps of invalid-capability attempts
-    const ctx = { issuer, bridge, cap, failures, badCaps, space, dir, mintConnectCredential: plane.mintConnectCredential };
+    const ctx = { issuer, bridge, bridgeIdp, ownerSecret, managerServiceAuthority: plane.issueManagerServiceAuthority, cap, failures, badCaps, space, dir, mintConnectCredential: plane.mintConnectCredential };
     const http = createServer((req, res) => void handle(req, res, ctx));
     await new Promise((resolvePort, reject) => {
         http.once("error", reject);
@@ -548,6 +653,7 @@ export async function runAuthService(args, store) {
 const LOOPBACK_POLICY = {
     requireCapability: true,
     refuseViews: false,
+    allowManagerAuthority: true,
     peerKey: (req) => req.socket.remoteAddress ?? "loopback",
     throttled: (ctx) => {
         const now = Date.now();
@@ -580,6 +686,7 @@ function makePublicPolicy(trustedProxy) {
     return {
         requireCapability: false,
         refuseViews: true,
+        allowManagerAuthority: true,
         peerKey: (req) => {
             if (trustedProxy) {
                 const xff = req.headers["x-forwarded-for"];
@@ -636,13 +743,14 @@ const ROUTES = new Map([
         },
     ],
     ["/exchange", (req, res, ctx) => handleExchange(req, res, ctx, LOOPBACK_POLICY)],
+    ["/manager-service-authority", (req, res, ctx) => handleManagerServiceAuthority(req, res, ctx, LOOPBACK_POLICY)],
 ]);
 /** Route one HTTP request against the loopback route table. Errors are JSON `{ error }`. */
 async function handle(req, res, ctx) {
     try {
         const route = ROUTES.get(req.url ?? "");
         if (!route)
-            return send(res, 404, { error: "unknown path - /health, /jwks, /exchange" });
+            return send(res, 404, { error: "unknown path - /health, /jwks, /exchange, /manager-service-authority" });
         await route(req, res, ctx);
     }
     catch (e) {
@@ -677,9 +785,20 @@ async function handleExchange(req, res, ctx, policy) {
         }
     }
     // Refused-exchange rate limit (probing protection): count only FAILURES, on THIS face's budget.
+    //
+    // The gate is evaluated here but NOT enforced here. Enforcing before the body was read meant a
+    // full bucket refused every request from that peer key, including ones carrying a valid IdP JWT
+    // or actor token - and on the public face the default peer key is the socket address, so in the
+    // reverse-proxy topology `run-a-mesh.md` recommends, every client shares one bucket. Thirty
+    // unauthenticated garbage POSTs then denied the public mint path for a rolling minute (#802).
+    //
+    // Throttling exists to slow PROBING, and a valid credential is not probing. So a throttled peer
+    // still gets its credential evaluated: if it is good, it mints; if it is bad, the refusal arms
+    // below answer 429 instead of the specific reason, because the reason is what makes probing
+    // cheap and withholding it is the whole point of the budget. Nothing that would have succeeded
+    // is refused.
     const peer = policy.peerKey(req);
-    if (policy.throttled(ctx, peer))
-        return send(res, 429, { error: "too many refused exchanges - wait a minute and retry" });
+    const peerThrottled = policy.throttled(ctx, peer);
     const body = await readJsonBody(req);
     const { idpToken, actor, actorToken, owner, ttlSec, view } = body;
     if (ttlSec !== undefined && typeof ttlSec !== "number")
@@ -731,6 +850,8 @@ async function handleExchange(req, res, ctx, policy) {
             policy.recordFailure(ctx, peer);
             const reason = e instanceof Error ? e.message : String(e);
             console.error(`auth-service: refused an agent exchange: ${reason}`);
+            if (peerThrottled)
+                return send(res, 429, { error: "too many refused exchanges - wait a minute and retry" });
             return send(res, 401, { error: reason });
         }
     }
@@ -748,9 +869,43 @@ async function handleExchange(req, res, ctx, policy) {
         policy.recordFailure(ctx, peer);
         const reason = e instanceof Error ? e.message : String(e);
         console.error(`auth-service: refused an exchange: ${reason}`);
+        if (peerThrottled)
+            return send(res, 429, { error: "too many refused exchanges - wait a minute and retry" });
         return send(res, 401, { error: reason });
     }
 }
+/** Loopback/operator-only typed manager authority exchange. The public route table never includes
+ * this path, and the loopback capability is checked here in addition to the route separation. */
+async function handleManagerServiceAuthority(req, res, ctx, policy) {
+    if (req.method !== "POST")
+        return send(res, 405, { error: "POST only" });
+    if (req.headers.origin !== undefined)
+        return send(res, 403, { error: "browser-origin requests are not served here" });
+    if (!/^application\/json\b/.test(req.headers["content-type"] ?? ""))
+        return send(res, 415, { error: "content-type must be application/json" });
+    if (!policy.allowManagerAuthority)
+        return send(res, 403, { error: "manager-service authority is not enabled on this exchange face" });
+    if (policy.requireCapability && req.headers.authorization !== `Bearer ${ctx.cap}`)
+        return send(res, 401, { error: "missing/invalid exchange capability - manager-service authority requires the operator exchange capability on this face" });
+    const body = await readJsonBody(req);
+    if (typeof body.idpToken !== "string" || !body.idpToken)
+        return send(res, 400, { error: "manager-service authority needs { idpToken, request }" });
+    try {
+        const verified = await verifyIdpToken(body.idpToken, ctx.bridgeIdp);
+        const owner = deriveOwnerForIdpSubject(ctx.ownerSecret, ctx.bridgeIdp.issuer, verified.sub);
+        if (body.request === null || typeof body.request !== "object" || Array.isArray(body.request))
+            throw new Error("manager-service authority request must be an object");
+        const request = body.request;
+        const row = ledgerAuthorizeGrant(ctx.dir)(owner, request.actor);
+        const material = await ctx.managerServiceAuthority({ owner, scope: row.scope ?? [], request });
+        return send(res, 200, material);
+    }
+    catch (e) {
+        const reason = e instanceof Error ? e.message : String(e);
+        console.error(`auth-service: refused manager-service authority: ${reason}`);
+        return send(res, 403, { error: reason });
+    }
+}
 /** The advertised broker address the public bundle carries — the URL participants will dial, so
  *  the same scheme family `cotal meshes add` accepts. Exported for the producer/consumer contract
  *  smoke; returns the refusal sentence, or undefined when the address is usable. */
@@ -779,12 +934,14 @@ export function composeUserBundle(args) {
         server: args.server,
         tlsRequired: true,
         userAuth: {
-            // The same provider name the LOCAL arm records (provider.ts registers publicAuth with
-            // provider "cotal") — a remote entry must dispatch to the same provider a local one does.
-            provider: "cotal",
+            // The same provider name the LOCAL arm records — one exported constant rather than a
+            // literal repeated here and in provider.ts, so a remote entry cannot come to name a
+            // different provider than the one that serves it.
+            provider: AUTH_PROVIDER_NAME,
             idp: args.idp,
             endpoints: {
                 url: "",
+                managerAuthorityUrl: "",
                 ...(args.agentProvisioningUrl ? { agentProvisioningUrl: args.agentProvisioningUrl } : {}),
             },
         },
@@ -796,7 +953,9 @@ export function composeUserBundle(args) {
  *  than replacing the endpoints object — replacement once silently dropped every sibling field
  *  the composer had set (agentProvisioningUrl). */
 export function finalizeUserBundleEndpoint(bundle, publicUrl) {
-    bundle.userAuth.endpoints.url = publicUrl;
+    const endpoints = bundle.userAuth.endpoints;
+    endpoints.url = publicUrl;
+    endpoints.managerAuthorityUrl = `${publicUrl.replace(/\/$/, "")}/manager-service-authority`;
 }
 /** The advertised agent-provisioning endpoint: HTTPS only — spawn sends the login bearer to it,
  *  and a plaintext or non-URL value must be refused at startup, not discovered by a participant.
@@ -837,6 +996,7 @@ function makePublicHandler(ctx, policy, bundle) {
             },
         ],
         ["/exchange", (req, res, c) => handleExchange(req, res, c, policy)],
+        ["/manager-service-authority", (req, res, c) => handleManagerServiceAuthority(req, res, c, policy)],
         [
             "/.well-known/cotal-mesh",
             (req, res) => {
@@ -869,7 +1029,7 @@ function makePublicHandler(ctx, policy, bundle) {
             try {
                 const route = routes.get(req.url ?? "");
                 if (!route)
-                    return send(res, 404, { error: "unknown path - /health, /jwks, /exchange, /.well-known/cotal-mesh" });
+                    return send(res, 404, { error: "unknown path - /health, /jwks, /exchange, /manager-service-authority, /.well-known/cotal-mesh" });
                 await route(req, res, ctx);
             }
             catch (e) {