@cotal-ai/auth 0.56.1 → 0.58.0

package/dist/auth-admin.d.ts

@@ -1,3 +1,4 @@
+import { type EpServeGrant } from "@cotal-ai/core";
 import { runAgentRetirementBarrier, type RetirementDeps } from "./retirement-barrier.js";
 import { type LifecycleRegistry } from "./lifecycle-registry.js";
 /** The LISTENER profile (SPEC 13.9 "Auth endpoint rail" row): serve + bounded replies on the auth
@@ -42,6 +43,15 @@ export declare function openAuthAdminListener(opts: {
     reg: LifecycleRegistry;
     retirement: RetirementDeps;
     barrierFlight: RetirementFlights;
+    /** The plane's #399 M2-registered instance id and current process epoch (`authServeGrant.epoch`)
+     *  — the SAME instance/epoch the registration ceremony fenced. The gate's process-epoch reader is
+     *  the fence now; there is no separate fixed responder identity to mint. */
+    instanceId: string;
+    epoch: number;
+    /** The M2-authorized serve artifact for this instance/epoch (`authServeGrant`, `service.ts:513`)
+     *  — `serveEndpoint` consumes it directly; it is the ONE authority source for what this
+     *  credential may serve (SPEC 13.9). */
+    grant: EpServeGrant;
     log: (line: string) => void;
 }): Promise<AuthAdminListener>;
 //# sourceMappingURL=auth-admin.d.ts.map

package/dist/auth-admin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-admin.d.ts","sourceRoot":"","sources":["../src/auth-admin.ts"],"names":[],"mappings":"AAwEA,OAAO,EAAE,yBAAyB,EAAE,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAA8C,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAW7G;;gEAEgE;AAChE,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,SAAS,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAyB5C;AAyDD;;iFAEiF;AACjF,wBAAgB,4BAA4B,CAAC,kBAAkB,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAI3F;AAED,0FAA0F;AAC1F,MAAM,MAAM,iBAAiB,GAAG,GAAG,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,UAAU,CAAC,OAAO,yBAAyB,CAAC,CAAA;CAAE,CAAC,CAAC;AAE3J;mGACmG;AACnG,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,iBAAiB,EAC1B,GAAG,EAAE,iBAAiB,EACtB,EAAE,EAAE,UAAU,CAAC,OAAO,yBAAyB,CAAC,CAAC,CAAC,CAAC,EACnD,UAAU,EAAE,cAAc,GACzB,UAAU,CAAC,OAAO,yBAAyB,CAAC,GAAG,SAAS,CAQ1D;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,GAAG,EAAE,iBAAiB,CAAC;IACvB,UAAU,EAAE,cAAc,CAAC;IAC3B,aAAa,EAAE,iBAAiB,CAAC;IACjC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAkL7B"}
+{"version":3,"file":"auth-admin.d.ts","sourceRoot":"","sources":["../src/auth-admin.ts"],"names":[],"mappings":"AAkDA,OAAO,EAYL,KAAK,YAAY,EAElB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,yBAAyB,EAAE,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAA8C,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE7G;;gEAEgE;AAChE,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,SAAS,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAuB5C;AAeD;;iFAEiF;AACjF,wBAAgB,4BAA4B,CAAC,kBAAkB,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAI3F;AAED,0FAA0F;AAC1F,MAAM,MAAM,iBAAiB,GAAG,GAAG,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,UAAU,CAAC,OAAO,yBAAyB,CAAC,CAAA;CAAE,CAAC,CAAC;AAE3J;mGACmG;AACnG,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,iBAAiB,EAC1B,GAAG,EAAE,iBAAiB,EACtB,EAAE,EAAE,UAAU,CAAC,OAAO,yBAAyB,CAAC,CAAC,CAAC,CAAC,EACnD,UAAU,EAAE,cAAc,GACzB,UAAU,CAAC,OAAO,yBAAyB,CAAC,GAAG,SAAS,CAQ1D;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,GAAG,EAAE,iBAAiB,CAAC;IACvB,UAAU,EAAE,cAAc,CAAC;IAC3B,aAAa,EAAE,iBAAiB,CAAC;IACjC;;gFAE4E;IAC5E,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd;;4CAEwC;IACxC,KAAK,EAAE,YAAY,CAAC;IACpB,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA6I7B"}

package/dist/auth-admin.js

@@ -1,29 +1,75 @@
+/**
+ * The AUTH service's ENDPOINT listener (#29 piece 3; Cotal #350): the GENERIC "retire a lifecycle
+ * (owner, actor, lifecycleUid)" operation, served by the auth plane itself — the despawn→retirement
+ * trigger's serve side, and the D5 split's other half (retirement is the AUTH plane's operation; it
+ * never rides the DELIVERY daemon's rail).
+ *
+ * THE RAIL: `ep.one.auth.retire-lifecycle.handle.<tO>.<tA>.<tUid>.<cO>.<cA>.<cUid>.<nonce>`.
+ * It used to serve on `ctl.auth-admin.<owner>.<actor>`. §13.11 retires the v0 `ctl` rail in full
+ * ("MUST NOT be handled") and grants it no scoping language, so the rows serving this rail there
+ * were defects — new normative rows written onto a deleted rail — and #350 ruled them rewritten
+ * onto the v0.4 endpoint surface rather than carved out of the cut.
+ *
+ * AUTHZ (RAIL-TIME, fresh per request, never mint-only):
+ *  - Caller attribution is SUBJECT-derived and broker-enforced: the caller triple
+ *    `<cO>.<cA>.<cUid>` rides the subject, and only a credential minted with that triple's
+ *    request-publish grant can reach it (the `retirement-requester` profile).
+ *  - The SERVE-ISSUANCE GATE check: the caller names a gate row by (serveEndpoint,
+ *    serveInstanceId) and declares its epoch. The row must exist, not be retired, and carry the
+ *    declared epoch — a superseded predecessor (a restart advanced the epoch) is refused.
+ *  - THE PRINCIPAL CROSS-CHECK: the named row's `principal` must equal the SUBJECT-derived caller
+ *    principal. This is what makes the two body fields safe to keep: they only SELECT a row, they
+ *    no longer authorize, so naming a foreign row buys a refusal rather than an authorization.
+ *    Before #350 the two-token `ctl` subject could not express the caller's identity beyond an
+ *    alias, and the rail accepted ANY registered instance's gate — a holder of the manager
+ *    principal could be authorized by a row belonging to someone else.
+ *  - This is ALIAS-LEVEL binding, not incarnation-level: the gate row is keyed by the PERSISTED
+ *    `instanceId` (stable across restarts) and its schema is closed with no uid field, while the
+ *    caller triple's `<cUid>` is per-process. A same-principal zombie predecessor that learns the
+ *    current epoch value still passes both checks. Binding the publishing incarnation needs a
+ *    gate-row schema change — deliberately out of this cut, and its own decision.
+ *  - The GENERIC surface never names a caller class (a manager despawn is ONE caller); the gate
+ *    check is this service's serve-time authz, not subject grammar.
+ *
+ * IDEMPOTENCE (the confirmed four-outcome table, surfaced as OPERATOR results): already-retired
+ * (uid match) → success; a frozen gate under the SAME opId → the barrier resumes it; a FOREIGN
+ * operation holding the gate → refuse naming the operation; a different current uid → refuse
+ * (stale trigger). The requester sends a STABLE opId across retries, so an epCall retry never
+ * mints a second operation.
+ *
+ * UX (the piece-3 faces): every refusal is WHAT/WHY/NEXT in operator vocabulary — each authz
+ * refusal states the despawn was a FULL NO-OP (the target is unchanged and still running,
+ * nothing was applied) with `cotal supervise` → retry as the NEXT; the vocabulary bridge
+ * ("despawn started this agent's retirement") lives at the CLI surface that renders these.
+ *
+ * SEAL COMPOSITION (critic's three checks): the listener holds NO scanner/plane authority — the
+ * retirement runs through the injected {@link RetirementDeps}, whose drain rides the plane's ONE
+ * sealed records scanner exactly like the boot resume; the gate read is a leader read, no
+ * consumer-create anywhere; the requester credential is request + reply-inbox ONLY.
+ */
 import { Kvm } from "@nats-io/kv";
-import { AUTH_ENDPOINT, EP_CMD_RETIRE_LIFECYCLE, EpEnvelopeError, assertLifecycleToken, deriveReplySubject, endpointToken, epAuthBucket, epClassQueueGroup, epResponderReplyPattern, assertCommandToken, spacePrefix, mintLifecycleUid, managedRetirementOpId, parseEpSubject, principalKey, retirementFrontierStreams, serveIssuanceGateKv, } from "@cotal-ai/core";
+import { AUTH_ENDPOINT, EP_CMD_RETIRE_LIFECYCLE, EpEnvelopeError, epAuthBucket, epServeGrantRows, managedRetirementOpId, principalKey, retirementFrontierStreams, serveEndpoint, serveIssuanceGateKv, } from "@cotal-ai/core";
+import { authCommandDefs } from "./auth-service-contract.js";
 import { openAuthorityClient } from "./authority-client.js";
 import { runAgentRetirementBarrier } from "./retirement-barrier.js";
 import { observeGate, readLifecycleHeadForOperation } from "./lifecycle-registry.js";
-const enc = new TextEncoder();
-const dec = new TextDecoder();
-/** The auth endpoint's one class rail, per-command (never a cross-command `>`): the grant and the
- *  runtime subscription are built from THIS, so a widened subscription cannot outrun its grant. */
-function authClassRail(space) {
-    return `${spacePrefix(space)}.ep.one.${endpointToken(AUTH_ENDPOINT)}.${assertCommandToken(EP_CMD_RETIRE_LIFECYCLE)}.>`;
-}
 /** The LISTENER profile (SPEC 13.9 "Auth endpoint rail" row): serve + bounded replies on the auth
  *  endpoint's class rail, plus the ONE leader-served gate read the authz check performs.
  *  No store writes, no consumer authority, no scanner reach. */
 export function authAdminListenerGrants(space, connId, responder) {
+    // The generic serve rows for this instance/epoch (reply plane, events, timer schedule, record
+    // writes on publish; the class/all/inst rails plus the derived `describe` and the epoch-pinned
+    // timer fire row on subscribe) — the SAME assembly `serveEndpoint` callers use, replacing the
+    // hand-built reply-pattern/class-rail rows above (M3, #399).
+    const serveRows = epServeGrantRows(space, {
+        endpoint: AUTH_ENDPOINT,
+        instanceId: responder.instanceId,
+        epoch: responder.epoch,
+        ephemeralCommands: [EP_CMD_RETIRE_LIFECYCLE],
+    });
     return {
         publish: [
-            // REPLIES ONLY, and on the REPLY PLANE — which is a stronger statement than the `ctl` rail
-            // could make. There, request and reply shared one subtree, so the grant had to carve replies
-            // out of it by shape (`*.*.reply.>`) to stop a compromised listener self-publishing a request
-            // as the lease holder and passing its own subject-derived check (self-forge). Here the planes
-            // are DISJOINT: `ep.reply.…` cannot express a request subject at all, so the self-forge is
-            // closed by the grammar rather than by a pattern. The instance triple and epoch are pinned;
-            // only the caller suffixes span (addressing is confined by nonce possession, §13.2).
-            epResponderReplyPattern(space, AUTH_ENDPOINT, responder.instanceId, responder.epoch),
+            ...serveRows.pub,
             "$JS.API.INFO",
             // The ONE leader-served read the authz check performs: the serve-issuance GATE, a point-get
             // of `epgate.<endpoint>.<instanceId>` proving the requesting manager instance's serve grant
@@ -31,52 +77,7 @@ export function authAdminListenerGrants(space, connId, responder) {
             // authority, no store writes.
             `$JS.API.STREAM.MSG.GET.KV_${epAuthBucket(space)}`,
         ],
-        // The class rail, QUEUE-QUALIFIED and per-command (§13.9, `endpoint-grants.ts:293-300`): the
-        // NATS `"<subject> <queue>"` grant form. A PLAIN subject row would let this credential
-        // plain-subscribe the class rail and observe EVERY request's nonce — the property the queue
-        // qualification exists to protect. The runtime's queue subscription is not a substitute: it
-        // constrains what this process does, not what the credential permits.
-        subscribe: [`${authClassRail(space)} ${epClassQueueGroup(AUTH_ENDPOINT)}`, `_INBOX_${connId}.>`],
-    };
-}
-const RETIRE_ARG_KEYS = ["opId", "serveEndpoint", "serveInstanceId", "serveEpoch"];
-/** The request id a reply MUST echo. This is the MINIMAL correctness guard from the full
- *  `EndpointRequest`/`EndpointReply` envelope, which this rail does NOT yet carry (named residual:
- *  the rail moved to `ep` SUBJECTS while still exchanging the ctl-era `{op,args}` / `{ok,data,error}`
- *  bodies, and SPEC 1421 states those envelopes are DELETED). Without the echo, a caller binding a
- *  reply on (endpoint, nonce) alone can accept a malformed or WRONG-ID `{ok:true}` and clear a
- *  retirement hold on it. The full envelope migration is its own cut; this edge is not deferrable. */
-function parseRequestId(raw) {
-    if (typeof raw !== "string" || !/^[A-Za-z0-9_-]{1,64}$/.test(raw))
-        throw new EpEnvelopeError("failed-precondition", `the request requires an "id" ([A-Za-z0-9_-]{1,64}); the reply echoes it so a caller cannot accept another request's answer`);
-    return raw;
-}
-function parseRetireArgs(raw) {
-    const shape = "{ opId, serveEndpoint, serveInstanceId, serveEpoch }";
-    if (raw === null || typeof raw !== "object")
-        throw new EpEnvelopeError("failed-precondition", `retireLifecycle requires args ${shape}`);
-    const a = raw;
-    // The TARGET (owner, actor, lifecycleUid) is no longer an argument: `handle` mode carries it in
-    // the subject, broker-enforced and grant-pinned, so the handler reads it from there. Sending it
-    // in the body is now a CLOSED-SHAPE violation rather than a redundancy to reconcile — which
-    // removes the whole body-vs-subject mismatch class instead of managing it.
-    for (const k of Object.keys(a))
-        if (!RETIRE_ARG_KEYS.includes(k))
-            throw new EpEnvelopeError("failed-precondition", `retireLifecycle args carry the unknown field "${k}" (closed shape; the target rides the SUBJECT)`);
-    if (typeof a.opId !== "string" ||
-        typeof a.serveEndpoint !== "string" || typeof a.serveInstanceId !== "string" ||
-        typeof a.serveEpoch !== "number" || !Number.isInteger(a.serveEpoch) || a.serveEpoch < 0)
-        throw new EpEnvelopeError("failed-precondition", `retireLifecycle requires args ${shape} (serveEpoch a non-negative integer)`);
-    return {
-        // opId is OPERATION IDENTITY, not an authz input: the terminal rail independently derives it
-        // from the broker-pinned lifecycle target below. This parse only enforces the token grammar.
-        opId: assertLifecycleToken(a.opId, "opId"),
-        // LOOKUP COORDINATES, not authz inputs: they select WHICH gate row to read. The row they
-        // select must then survive the principal cross-check below, so naming a foreign row buys a
-        // refusal, never an authorization.
-        serveEndpoint: endpointToken(a.serveEndpoint),
-        serveInstanceId: assertLifecycleToken(a.serveInstanceId, "serveInstanceId"),
-        serveEpoch: a.serveEpoch,
+        subscribe: [...serveRows.sub, `_INBOX_${connId}.>`],
     };
 }
 /** The terminal rail's operation-identity authorization. The requester credential pins the target
@@ -106,13 +107,11 @@ export function joinOrStartRetirement(flights, reg, op, retirement) {
  */
 export async function openAuthAdminListener(opts) {
     const { space, log } = opts;
-    // The auth plane's responder identity. The plane is SINGLE per space by construction (§13.13:
-    // at most one authority plane holds the sealed scanners, by a broker-visible claim), so the
-    // instance id is per-process and the epoch is fixed: there is no successor to fence and no
-    // registration whose epoch could advance beneath us. It exists because the reply plane pins the
-    // responder triple in the grant; callers read replies through a filter that wildcards these
-    // positions (`ep.reply.*.*.*.<cO>.<cA>.<cUid>.*`), so they never need to learn it.
-    const responder = { instanceId: mintLifecycleUid(), epoch: 0 };
+    // The auth plane's responder identity is the #399 M2-registered instance/epoch (the SAME triple
+    // `registerServiceInstance` fenced and `authorizeServeGrant` minted a serve grant for). The reply
+    // plane pins this triple in the grant; callers read replies through a filter that wildcards the
+    // caller-suffix positions (`ep.reply.*.*.*.<cO>.<cA>.<cUid>.*`), so they never need to learn it.
+    const responder = { instanceId: opts.instanceId, epoch: opts.epoch };
     const client = await openAuthorityClient({
         server: opts.server, space, dataAccount: opts.dataAccount,
         label: `cotal:auth-admin:${space}`,
@@ -129,56 +128,6 @@ export async function openAuthAdminListener(opts) {
         await client.close();
         throw e;
     }
-    const sub = client.nc.subscribe(authClassRail(space), {
-        queue: epClassQueueGroup(AUTH_ENDPOINT),
-        callback: (err, msg) => {
-            if (err)
-                return;
-            void (async () => {
-                // The reply target is DERIVED from the parsed request, never taken from the wire. On the
-                // `ctl` rail this was a guard: the listener held a subtree-wide reply grant, so a
-                // caller-selected foreign reply target had to be refused by inspecting `msg.reply`. Here
-                // there is no argument through which a payload-supplied reply target could arrive — the
-                // guard became structural, so the check it replaced cannot be forgotten.
-                const parsed = parseEpSubject(msg.subject);
-                if (parsed === null || parsed.plane !== "request") {
-                    // null = MUST NOT handle (§13.2). Never a reply: an unparseable subject has no
-                    // derivable reply target, and answering one would be the confused deputy itself.
-                    log(`auth-admin: dropped an unparseable request subject ${msg.subject}`);
-                    return;
-                }
-                const request = parsed;
-                // The echoed id is stamped HERE, outside the handler, so EVERY reply carries it - including
-                // the thrown-error path. A reply the caller cannot bind to its own request is one it must
-                // ignore, so an unstamped error reply would silently become a timeout instead of a refusal.
-                let echoId;
-                try {
-                    echoId = parseRequestId(JSON.parse(dec.decode(msg.data)).id);
-                }
-                catch {
-                    echoId = undefined;
-                }
-                let reply;
-                try {
-                    reply = await handle(request, msg.data);
-                }
-                catch (e) {
-                    reply = { ok: false, error: e instanceof Error ? e.message : String(e) };
-                }
-                // A request with no usable id gets an unbindable reply BY CONSTRUCTION: the caller requires
-                // the echo, so it will refuse this answer rather than accept an unattributable one.
-                if (echoId !== undefined)
-                    reply.id = echoId;
-                const target = deriveReplySubject(space, request, responder);
-                try {
-                    client.nc.publish(target, enc.encode(JSON.stringify(reply)));
-                }
-                catch (e) {
-                    log(`auth-admin: reply publish failed on ${target}: ${e instanceof Error ? e.message : String(e)}`);
-                }
-            })();
-        },
-    });
     // SINGLE-FLIGHT the barrier EXECUTION per opId (audit #1): each request still runs its OWN fresh
     // lease re-check + idempotence, but concurrent same-opId requests (a manager nudge + a retry, or a boot
     // resume racing the rail) share ONE runAgentRetirementBarrier, so the barrier body never dual-executes
@@ -190,103 +139,103 @@ export async function openAuthAdminListener(opts) {
     // Owned by the plane and shared with the loopback managed-retire door, so the rail and the door
     // never run two barrier executions of one opId in this process (#2070).
     const barrierFlight = opts.barrierFlight;
-    const handle = async (request, body) => {
-        if (request.command !== EP_CMD_RETIRE_LIFECYCLE)
-            return { ok: false, error: `command "${request.command}" not supported on the auth endpoint` };
-        // The TARGET comes from the subject (`handle` mode, arity 3) — broker-enforced and
-        // grant-pinned, so it is not a claim the caller can vary independently of what it may publish.
-        if (request.target === null || request.target.mode !== "handle")
-            return { ok: false, error: `retire-lifecycle requires a handle target (<owner>.<actor>.<lifecycleUid>) in the subject` };
-        const target = { owner: request.target.tOwner, actor: request.target.tActor, lifecycleUid: request.target.tUid };
-        // The CALLER principal likewise comes from the subject, and is now an AUTHZ INPUT (the
-        // cross-check below), not just the audit line it was on the `ctl` rail.
-        const requester = principalKey(request.caller.owner, request.caller.actor).key;
-        let req;
-        try {
-            req = JSON.parse(dec.decode(body));
-        }
-        catch {
-            return { ok: false, error: "auth-admin: the request body is not JSON" };
-        }
-        if (req.op !== "retireLifecycle")
-            return { ok: false, error: `op "${String(req.op)}" not supported on the auth admin service` };
-        const args = parseRetireArgs(req.args);
-        // TARGET comes from the broker-authorized subject. Bind the body's opId to it BEFORE the serve
-        // gate, lifecycle head, intent, or barrier is touched, so mint-time validation is not the only
-        // fence and the same target can never start a second durable terminal operation.
-        authorizeRetirementOperation(target.lifecycleUid, args.opId);
-        // THE RAIL-TIME REGISTRATION RE-CHECK (fresh, leader-served, fail-closed) — P2 item 3 (3b-3):
-        // the requesting manager instance's SERVE GRANT must be current. Read the serve-issuance gate
-        // (registration-record-derived, REPLACING the old name-derived manager-lease holder check): the
-        // requester declares its (serveEndpoint, serveInstanceId, serveEpoch); an absent/retired gate means
-        // no registered instance, and a gate whose current processEpoch moved past the declared one means
-        // the requester was SUPERSEDED (a deposed predecessor after a restart) — refused as a full no-op.
-        // The row this NAMES must also BELONG to the subject-derived caller principal (the cross-check
-        // below). Before #350 it did not have to: every instance of one space shares the manager
-        // principal, and the two-token `ctl` subject could not express the caller beyond that alias, so
-        // any current instance's gate authorized. That is no longer true, and the coordinates above no
-        // longer authorize — they only select which row to read.
-        // ALIAS-LEVEL, not incarnation-level: a DIFFERENT INSTANCE OF THE SAME PRINCIPAL still passes
-        // (the gate is keyed by the persisted instanceId and its row carries no lifecycle uid). What is
-        // refused is a row belonging to a DIFFERENT PRINCIPAL.
-        let serveGate;
-        try {
-            serveGate = await serveIssuanceGateKv(epAuthKv, space, { endpoint: args.serveEndpoint, instanceId: args.serveInstanceId }).observe();
-        }
-        catch (e) {
-            return { ok: false, error: `the retirement request cannot be authorized right now: the manager serve-issuance gate could not be read (${e instanceof Error ? e.message : String(e)}). Nothing was applied - the agent is unchanged. NEXT: check the broker and retry the despawn.` };
-        }
-        if (serveGate === null || serveGate.state === "retired")
-            return { ok: false, error: `no manager instance currently holds a serve registration for "${space}" (instance ${args.serveInstanceId} is ${serveGate === null ? "unregistered" : "retired"}), so nothing may retire agents. The despawn was a FULL no-op - the agent is unchanged and still running. NEXT: start or recover the manager (\`cotal supervise\`), then retry the despawn.` };
-        // THE PRINCIPAL CROSS-CHECK (#350). The two serve coordinates above only SELECTED this row;
-        // they do not authorize. The row must belong to the SUBJECT-derived caller principal — which
-        // the broker enforced when it admitted the publish. Without this, naming any currently
-        // registered instance's row authorizes the caller, which is what the `ctl` rail did: its
-        // two-token subject could not express the caller beyond an alias, so there was nothing to
-        // compare the row against.
-        // ALIAS-LEVEL, not incarnation-level: the gate is keyed by the PERSISTED instanceId and its
-        // schema carries no uid, while the caller triple's uid is per-process. A same-principal zombie
-        // predecessor holding the current epoch value still passes. Closing that needs a gate-row
-        // schema change; it is deliberately not in this cut.
-        if (serveGate.principal !== requester)
-            return { ok: false, error: `the retirement request was REFUSED: the serve registration named (${args.serveEndpoint}/${args.serveInstanceId}) belongs to ${serveGate.principal}, not to the requesting principal ${requester}. A caller may only be authorized by its OWN serve registration. The despawn was a FULL no-op - the agent is unchanged and still running. NEXT: name your OWN principal's serve registration (any current instance of ${requester} will do), or call as the principal that owns this one.` };
-        if (serveGate.processEpoch !== args.serveEpoch)
-            return { ok: false, error: `the requesting manager instance ${args.serveInstanceId} was SUPERSEDED (it registered at epoch ${args.serveEpoch}, the current serve grant is epoch ${serveGate.processEpoch}), so this despawn was REFUSED as a FULL no-op - the agent is unchanged and still running, nothing was torn down. NEXT: recover the manager (\`cotal supervise\`), then retry the despawn under the current serving instance.` };
-        // IDEMPOTENCE (the four-outcome table, in operator vocabulary).
-        const head = await readLifecycleHeadForOperation(opts.reg, target.owner, target.actor);
-        if (head === undefined)
-            return { ok: false, error: `no lifecycle exists for "${target.owner}/${target.actor}"; there is nothing to retire.` };
-        if (head.mapping.state === "retired" && head.mapping.lifecycleUid === target.lifecycleUid)
-            return { ok: true, data: { alreadyRetired: true, lifecycleUid: target.lifecycleUid } };
-        if (head.mapping.lifecycleUid !== target.lifecycleUid)
-            return { ok: false, error: `the despawn names a stale incarnation of "${target.owner}/${target.actor}" (current is ${head.mapping.lifecycleUid}); nothing was retired. NEXT: refresh the agent list and retry against the current incarnation.` };
-        const gate = await observeGate(opts.reg, target.lifecycleUid);
-        if (gate !== undefined && gate.row.state === "frozen" && gate.row.op !== undefined && gate.row.op.opId !== args.opId)
-            return { ok: false, error: `another operation (${gate.row.op.kind} ${gate.row.op.opId}) already holds "${target.owner}/${target.actor}"; this despawn did not start a second one. NEXT: wait for that operation to finish (or its resume on the next auth-service boot), then retry.` };
-        // EXECUTE (create-or-resume: the barrier's own freeze CAS + durable intent make the same
-        // opId resumable and a re-request idempotent). The drain, cleaner, and repair credentials
-        // all come from the plane's reviewed deps - this listener holds none of those rights.
-        const existing = barrierFlight.get(args.opId);
-        // A despawn cannot know the target's pool work, and the barrier never takes a pool hint: it
-        // DISCOVERS the real (endpoint, pools) cleaner inventory from the target's own accepted pool
-        // obligations (#F). Discovery is never a gap - the barrier never closes a frontier over
-        // un-cleaned accepted pool work (SPEC 13.1/13.9).
-        const flight = joinOrStartRetirement(barrierFlight, opts.reg, {
-            owner: target.owner, actor: target.actor, lifecycleUid: target.lifecycleUid, opId: args.opId,
-            frontierStreams: retirementFrontierStreams(space),
-        }, opts.retirement);
-        if (flight === undefined)
-            return { ok: false, error: `operation id ${args.opId} is already in flight for a different lifecycle (${existing?.owner}/${existing?.actor} ${existing?.lifecycleUid}); this despawn of "${target.owner}/${target.actor}" (${target.lifecycleUid}) was a FULL no-op - nothing was retired and it is still running. NEXT: retry the despawn (the manager derives a distinct operation id per lifecycle).` };
-        const result = await flight;
-        log(`auth-admin: retired ${target.owner}/${target.actor} (${target.lifecycleUid}) by despawn request from ${requester} (op ${args.opId})`);
-        return { ok: true, data: { retired: true, lifecycleUid: target.lifecycleUid, opId: result.opId, evictedPrincipals: result.evictedPrincipals } };
+    // The FRESH target resolver (§13.3/§13.9) for the `exact`-mode `retire-lifecycle` target: the
+    // lifecycle registry's own leader-served mapping read is the current-mapping authority.
+    const resolveTarget = async (t) => {
+        const head = await readLifecycleHeadForOperation(opts.reg, t.owner, t.actor);
+        return head === undefined ? undefined : { lifecycleUid: head.mapping.lifecycleUid, mappingRevision: head.revision };
     };
-    return {
-        close: async () => {
+    const handlers = {
+        retireLifecycle: async (ctx) => {
+            // The TARGET comes from the subject (`exact` mode, arity 3) — broker-enforced and
+            // grant-pinned, not a claim the caller can vary independently of what it may publish.
+            const t = ctx.subject.target;
+            if (t === null || t.mode !== "exact")
+                throw new EpEnvelopeError("failed-precondition", `retire-lifecycle requires an exact target (<owner>.<actor>.<lifecycleUid>) in the subject`);
+            const target = { owner: t.tOwner, actor: t.tActor, lifecycleUid: t.tUid };
+            // The CALLER principal likewise comes from the subject, and is an AUTHZ INPUT (the
+            // cross-check below), not just an audit line.
+            const requester = principalKey(ctx.subject.caller.owner, ctx.subject.caller.actor).key;
+            const args = ctx.request.args;
+            // TARGET comes from the broker-authorized subject. Bind the body's opId to it BEFORE the
+            // serve gate, lifecycle head, intent, or barrier is touched, so mint-time validation is not
+            // the only fence and the same target can never start a second durable terminal operation.
+            authorizeRetirementOperation(target.lifecycleUid, args.opId);
+            // THE RAIL-TIME REGISTRATION RE-CHECK (fresh, leader-served, fail-closed) — P2 item 3 (3b-3):
+            // the requesting manager instance's SERVE GRANT must be current. Read the serve-issuance gate
+            // (registration-record-derived, REPLACING the old name-derived manager-lease holder check): the
+            // requester declares its (serveEndpoint, serveInstanceId, serveEpoch); an absent/retired gate means
+            // no registered instance, and a gate whose current processEpoch moved past the declared one means
+            // the requester was SUPERSEDED (a deposed predecessor after a restart) — refused as a full no-op.
+            // The row this NAMES must also BELONG to the subject-derived caller principal (the cross-check
+            // below). Before #350 it did not have to: every instance of one space shares the manager
+            // principal, and the two-token `ctl` subject could not express the caller beyond that alias, so
+            // any current instance's gate authorized. That is no longer true, and the coordinates above no
+            // longer authorize — they only select which row to read.
+            // ALIAS-LEVEL, not incarnation-level: a DIFFERENT INSTANCE OF THE SAME PRINCIPAL still passes
+            // (the gate is keyed by the persisted instanceId and its row carries no lifecycle uid). What is
+            // refused is a row belonging to a DIFFERENT PRINCIPAL.
+            let serveGate;
             try {
-                sub.unsubscribe();
+                serveGate = await serveIssuanceGateKv(epAuthKv, space, { endpoint: args.serveEndpoint, instanceId: args.serveInstanceId }).observe();
+            }
+            catch (e) {
+                throw new EpEnvelopeError("unavailable", `the retirement request cannot be authorized right now: the manager serve-issuance gate could not be read (${e instanceof Error ? e.message : String(e)}). Nothing was applied - the agent is unchanged. NEXT: check the broker and retry the despawn.`);
             }
-            catch { /* connection already down */ }
+            if (serveGate === null || serveGate.state === "retired")
+                throw new EpEnvelopeError("failed-precondition", `no manager instance currently holds a serve registration for "${space}" (instance ${args.serveInstanceId} is ${serveGate === null ? "unregistered" : "retired"}), so nothing may retire agents. The despawn was a FULL no-op - the agent is unchanged and still running. NEXT: start or recover the manager (\`cotal supervise\`), then retry the despawn.`);
+            // THE PRINCIPAL CROSS-CHECK (#350). The two serve coordinates above only SELECTED this row;
+            // they do not authorize. The row must belong to the SUBJECT-derived caller principal — which
+            // the broker enforced when it admitted the publish. Without this, naming any currently
+            // registered instance's row authorizes the caller, which is what the `ctl` rail did: its
+            // two-token subject could not express the caller beyond an alias, so there was nothing to
+            // compare the row against.
+            // ALIAS-LEVEL, not incarnation-level: the gate is keyed by the PERSISTED instanceId and its
+            // schema carries no uid, while the caller triple's uid is per-process. A same-principal zombie
+            // predecessor holding the current epoch value still passes. Closing that needs a gate-row
+            // schema change; it is deliberately not in this cut.
+            if (serveGate.principal !== requester)
+                throw new EpEnvelopeError("permission-denied", `the retirement request was REFUSED: the serve registration named (${args.serveEndpoint}/${args.serveInstanceId}) belongs to ${serveGate.principal}, not to the requesting principal ${requester}. A caller may only be authorized by its OWN serve registration. The despawn was a FULL no-op - the agent is unchanged and still running. NEXT: name your OWN principal's serve registration (any current instance of ${requester} will do), or call as the principal that owns this one.`);
+            if (serveGate.processEpoch !== args.serveEpoch)
+                throw new EpEnvelopeError("expired", `the requesting manager instance ${args.serveInstanceId} was SUPERSEDED (it registered at epoch ${args.serveEpoch}, the current serve grant is epoch ${serveGate.processEpoch}), so this despawn was REFUSED as a FULL no-op - the agent is unchanged and still running, nothing was torn down. NEXT: recover the manager (\`cotal supervise\`), then retry the despawn under the current serving instance.`);
+            // IDEMPOTENCE (the four-outcome table, in operator vocabulary).
+            const head = await readLifecycleHeadForOperation(opts.reg, target.owner, target.actor);
+            if (head === undefined)
+                throw new EpEnvelopeError("failed-precondition", `no lifecycle exists for "${target.owner}/${target.actor}"; there is nothing to retire.`);
+            if (head.mapping.state === "retired" && head.mapping.lifecycleUid === target.lifecycleUid)
+                return { retired: true, lifecycleUid: target.lifecycleUid, opId: args.opId, evictedPrincipals: [] };
+            if (head.mapping.lifecycleUid !== target.lifecycleUid)
+                throw new EpEnvelopeError("expired", `the despawn names a stale incarnation of "${target.owner}/${target.actor}" (current is ${head.mapping.lifecycleUid}); nothing was retired. NEXT: refresh the agent list and retry against the current incarnation.`);
+            const gate = await observeGate(opts.reg, target.lifecycleUid);
+            if (gate !== undefined && gate.row.state === "frozen" && gate.row.op !== undefined && gate.row.op.opId !== args.opId)
+                throw new EpEnvelopeError("conflict", `another operation (${gate.row.op.kind} ${gate.row.op.opId}) already holds "${target.owner}/${target.actor}"; this despawn did not start a second one. NEXT: wait for that operation to finish (or its resume on the next auth-service boot), then retry.`);
+            // EXECUTE (create-or-resume: the barrier's own freeze CAS + durable intent make the same
+            // opId resumable and a re-request idempotent). The drain, cleaner, and repair credentials
+            // all come from the plane's reviewed deps - this listener holds none of those rights.
+            const existing = barrierFlight.get(args.opId);
+            // A despawn cannot know the target's pool work, and the barrier never takes a pool hint: it
+            // DISCOVERS the real (endpoint, pools) cleaner inventory from the target's own accepted pool
+            // obligations (#F). Discovery is never a gap - the barrier never closes a frontier over
+            // un-cleaned accepted pool work (SPEC 13.1/13.9).
+            const flight = joinOrStartRetirement(barrierFlight, opts.reg, {
+                owner: target.owner, actor: target.actor, lifecycleUid: target.lifecycleUid, opId: args.opId,
+                frontierStreams: retirementFrontierStreams(space),
+            }, opts.retirement);
+            if (flight === undefined)
+                throw new EpEnvelopeError("conflict", `operation id ${args.opId} is already in flight for a different lifecycle (${existing?.owner}/${existing?.actor} ${existing?.lifecycleUid}); this despawn of "${target.owner}/${target.actor}" (${target.lifecycleUid}) was a FULL no-op - nothing was retired and it is still running. NEXT: retry the despawn (the manager derives a distinct operation id per lifecycle).`);
+            const result = await flight;
+            log(`auth-admin: retired ${target.owner}/${target.actor} (${target.lifecycleUid}) by despawn request from ${requester} (op ${args.opId})`);
+            return { retired: true, lifecycleUid: target.lifecycleUid, opId: result.opId, evictedPrincipals: result.evictedPrincipals };
+        },
+    };
+    // §13.9: the descriptor is PUBLIC. The broker grant on the request subject (who holds the
+    // caller triple's request-publish row, minted only by the `retirement-requester` profile) is the
+    // load-bearing authority tier; describe merely lists command names/schemas, which leaks nothing
+    // a holder of that grant does not already need to know to call successfully.
+    const handle = serveEndpoint(client.nc, space, opts.grant, authCommandDefs(handlers), { public: true }, { resolveTarget });
+    return {
+        close: async () => {
+            await handle.stop();
             await client.close();
         },
     };

package/dist/auth-admin.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-admin.js","sourceRoot":"","sources":["../src/auth-admin.ts"],"names":[],"mappings":"AAkDA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,uBAAuB,EACvB,kBAAkB,EAClB,WAAW,EACX,gBAAgB,EAChB,qBAAqB,EACrB,cAAc,EACd,YAAY,EACZ,yBAAyB,EACzB,mBAAmB,GAEpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAwB,MAAM,uBAAuB,CAAC;AAClF,OAAO,EAAE,yBAAyB,EAAuB,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAAE,WAAW,EAAE,6BAA6B,EAA0B,MAAM,yBAAyB,CAAC;AAE7G,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAC9B,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAE9B;mGACmG;AACnG,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,WAAW,aAAa,CAAC,aAAa,CAAC,IAAI,kBAAkB,CAAC,uBAAuB,CAAC,IAAI,CAAC;AACzH,CAAC;AAED;;gEAEgE;AAChE,MAAM,UAAU,uBAAuB,CACrC,KAAa,EACb,MAAc,EACd,SAAgD;IAEhD,OAAO;QACL,OAAO,EAAE;YACP,2FAA2F;YAC3F,6FAA6F;YAC7F,8FAA8F;YAC9F,8FAA8F;YAC9F,2FAA2F;YAC3F,4FAA4F;YAC5F,qFAAqF;YACrF,uBAAuB,CAAC,KAAK,EAAE,aAAa,EAAE,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC;YACpF,cAAc;YACd,4FAA4F;YAC5F,4FAA4F;YAC5F,2FAA2F;YAC3F,8BAA8B;YAC9B,6BAA6B,YAAY,CAAC,KAAK,CAAC,EAAE;SACnD;QACD,6FAA6F;QAC7F,uFAAuF;QACvF,4FAA4F;QAC5F,4FAA4F;QAC5F,sEAAsE;QACtE,SAAS,EAAE,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,aAAa,CAAC,EAAE,EAAE,UAAU,MAAM,IAAI,CAAC;KACjG,CAAC;AACJ,CAAC;AAeD,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,iBAAiB,EAAE,YAAY,CAAC,CAAC;AAEnF;;;;;sGAKsG;AACtG,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC;QAC/D,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,4HAA4H,CAAC,CAAC;IACjL,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,GAAY;IACnC,MAAM,KAAK,GAAG,sDAAsD,CAAC;IACrE,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QACzC,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,iCAAiC,KAAK,EAAE,CAAC,CAAC;IAC7F,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,gGAAgG;IAChG,gGAAgG;IAChG,4FAA4F;IAC5F,2EAA2E;IAC3E,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC9D,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,iDAAiD,CAAC,gDAAgD,CAAC,CAAC;IACvJ,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAC1B,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ;QAC5E,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,GAAG,CAAC;QACzF,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,iCAAiC,KAAK,sCAAsC,CAAC,CAAC;IACjI,OAAO;QACL,6FAA6F;QAC7F,6FAA6F;QAC7F,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC;QAC1C,yFAAyF;QACzF,2FAA2F;QAC3F,mCAAmC;QACnC,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC;QAC7C,eAAe,EAAE,oBAAoB,CAAC,CAAC,CAAC,eAAe,EAAE,iBAAiB,CAAC;QAC3E,UAAU,EAAE,CAAC,CAAC,UAAU;KACzB,CAAC;AACJ,CAAC;AAED;;iFAEiF;AACjF,MAAM,UAAU,4BAA4B,CAAC,kBAA0B,EAAE,IAAY;IACnF,MAAM,QAAQ,GAAG,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;IAC3D,IAAI,IAAI,KAAK,QAAQ;QACnB,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,6BAA6B,IAAI,0CAA0C,QAAQ,kBAAkB,kBAAkB,uBAAuB,CAAC,CAAC;AACnM,CAAC;AAKD;mGACmG;AACnG,MAAM,UAAU,qBAAqB,CACnC,OAA0B,EAC1B,GAAsB,EACtB,EAAmD,EACnD,UAA0B;IAE1B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,QAAQ,KAAK,SAAS;QACxB,OAAO,QAAQ,CAAC,KAAK,KAAK,EAAE,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,KAAK,EAAE,CAAC,KAAK,IAAI,QAAQ,CAAC,YAAY,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAChJ,MAAM,MAAM,GAAG,yBAAyB,CAAC,GAAG,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC;IAC9D,KAAK,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,KAAK,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtH,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3G,OAAO,MAAM,CAAC;AAChB,CAAC;AAMD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAQ3C;IACC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC5B,8FAA8F;IAC9F,4FAA4F;IAC5F,2FAA2F;IAC3F,gGAAgG;IAChG,4FAA4F;IAC5F,mFAAmF;IACnF,MAAM,SAAS,GAAG,EAAE,UAAU,EAAE,gBAAgB,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAC/D,MAAM,MAAM,GAAoB,MAAM,mBAAmB,CAAC;QACxD,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW;QACzD,KAAK,EAAE,oBAAoB,KAAK,EAAE;QAClC,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,uBAAuB,CAAC,KAAK,EAAE,EAAE,EAAE,SAAS,CAAC;QAC7D,GAAG;KACJ,CAAC,CAAC;IACH,IAAI,QAAkC,CAAC;IACvC,IAAI,CAAC;QACH,+FAA+F;QAC/F,yFAAyF;QACzF,QAAQ,GAAG,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,CAAC,CAAC;IACV,CAAC;IACD,MAAM,GAAG,GAAiB,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE;QAClE,KAAK,EAAE,iBAAiB,CAAC,aAAa,CAAC;QACvC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACrB,IAAI,GAAG;gBAAE,OAAO;YAChB,KAAK,CAAC,KAAK,IAAI,EAAE;gBACf,yFAAyF;gBACzF,kFAAkF;gBAClF,yFAAyF;gBACzF,wFAAwF;gBACxF,yEAAyE;gBACzE,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC3C,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;oBAClD,+EAA+E;oBAC/E,iFAAiF;oBACjF,GAAG,CAAC,sDAAsD,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;oBACzE,OAAO;gBACT,CAAC;gBACD,MAAM,OAAO,GAAoB,MAAM,CAAC;gBACxC,4FAA4F;gBAC5F,0FAA0F;gBAC1F,4FAA4F;gBAC5F,IAAI,MAA0B,CAAC;gBAC/B,IAAI,CAAC;oBAAC,MAAM,GAAG,cAAc,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAsB,CAAC,EAAE,CAAC,CAAC;gBAAC,CAAC;gBAC3F,MAAM,CAAC;oBAAC,MAAM,GAAG,SAAS,CAAC;gBAAC,CAAC;gBAC7B,IAAI,KAAmE,CAAC;gBACxE,IAAI,CAAC;oBACH,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC1C,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,KAAK,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3E,CAAC;gBACD,4FAA4F;gBAC5F,oFAAoF;gBACpF,IAAI,MAAM,KAAK,SAAS;oBAAE,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC;gBAC5C,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;gBAC7D,IAAI,CAAC;oBACH,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC/D,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,GAAG,CAAC,uCAAuC,MAAM,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACtG,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;KACF,CAAC,CAAC;IAEH,iGAAiG;IACjG,wGAAwG;IACxG,uGAAuG;IACvG,wGAAwG;IACxG,EAAE;IACF,mGAAmG;IACnG,kGAAkG;IAClG,mGAAmG;IACnG,gGAAgG;IAChG,wEAAwE;IACxE,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;IAEzC,MAAM,MAAM,GAAG,KAAK,EAAE,OAAwB,EAAE,IAAgB,EAAyE,EAAE;QACzI,IAAI,OAAO,CAAC,OAAO,KAAK,uBAAuB;YAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,OAAO,CAAC,OAAO,sCAAsC,EAAE,CAAC;QACjG,mFAAmF;QACnF,+FAA+F;QAC/F,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ;YAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2FAA2F,EAAE,CAAC;QAC3H,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACjH,uFAAuF;QACvF,wEAAwE;QACxE,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC;QAC/E,IAAI,GAAmD,CAAC;QACxD,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAqC,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC;QAC1E,CAAC;QACD,IAAI,GAAG,CAAC,EAAE,KAAK,iBAAiB;YAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,2CAA2C,EAAE,CAAC;QAChG,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,+FAA+F;QAC/F,+FAA+F;QAC/F,iFAAiF;QACjF,4BAA4B,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAE7D,8FAA8F;QAC9F,8FAA8F;QAC9F,gGAAgG;QAChG,oGAAoG;QACpG,kGAAkG;QAClG,kGAAkG;QAClG,+FAA+F;QAC/F,yFAAyF;QACzF,gGAAgG;QAChG,+FAA+F;QAC/F,yDAAyD;QACzD,8FAA8F;QAC9F,gGAAgG;QAChG,uDAAuD;QACvD,IAAI,SAAiF,CAAC;QACtF,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QACvI,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6GAA6G,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,gGAAgG,EAAE,CAAC;QACvR,CAAC;QACD,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS;YACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iEAAiE,KAAK,eAAe,IAAI,CAAC,eAAe,OAAO,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,6LAA6L,EAAE,CAAC;QAC5X,4FAA4F;QAC5F,6FAA6F;QAC7F,uFAAuF;QACvF,yFAAyF;QACzF,0FAA0F;QAC1F,2BAA2B;QAC3B,4FAA4F;QAC5F,+FAA+F;QAC/F,0FAA0F;QAC1F,qDAAqD;QACrD,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS;YACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qEAAqE,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,eAAe,gBAAgB,SAAS,CAAC,SAAS,qCAAqC,SAAS,yNAAyN,SAAS,yDAAyD,EAAE,CAAC;QAC3f,IAAI,SAAS,CAAC,YAAY,KAAK,IAAI,CAAC,UAAU;YAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,IAAI,CAAC,eAAe,2CAA2C,IAAI,CAAC,UAAU,sCAAsC,SAAS,CAAC,YAAY,+NAA+N,EAAE,CAAC;QAE5a,gEAAgE;QAChE,MAAM,IAAI,GAAG,MAAM,6BAA6B,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACvF,IAAI,IAAI,KAAK,SAAS;YACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,gCAAgC,EAAE,CAAC;QACxH,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY;YACvF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC;QACzF,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY;YACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6CAA6C,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,iBAAiB,IAAI,CAAC,OAAO,CAAC,YAAY,iGAAiG,EAAE,CAAC;QACpP,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAC9D,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;YAClH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,oBAAoB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,gJAAgJ,EAAE,CAAC;QAE1R,yFAAyF;QACzF,0FAA0F;QAC1F,sFAAsF;QACtF,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,4FAA4F;QAC5F,6FAA6F;QAC7F,wFAAwF;QACxF,kDAAkD;QAClD,MAAM,MAAM,GAAG,qBAAqB,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE;YAC5D,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI;YAC5F,eAAe,EAAE,yBAAyB,CAAC,KAAK,CAAC;SAClD,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACpB,IAAI,MAAM,KAAK,SAAS;YACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,IAAI,CAAC,IAAI,oDAAoD,QAAQ,EAAE,KAAK,IAAI,QAAQ,EAAE,KAAK,IAAI,QAAQ,EAAE,YAAY,uBAAuB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,MAAM,MAAM,CAAC,YAAY,wJAAwJ,EAAE,CAAC;QAC7Y,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC;QAC5B,GAAG,CAAC,uBAAuB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,YAAY,6BAA6B,SAAS,QAAQ,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;QAC3I,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,EAAE,CAAC;IAClJ,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,IAAI,CAAC;gBAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,6BAA6B,CAAC,CAAC;YAClE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"auth-admin.js","sourceRoot":"","sources":["../src/auth-admin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,YAAY,EACZ,yBAAyB,EACzB,aAAa,EACb,mBAAmB,GAIpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,eAAe,EAA4B,MAAM,4BAA4B,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAwB,MAAM,uBAAuB,CAAC;AAClF,OAAO,EAAE,yBAAyB,EAAuB,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAAE,WAAW,EAAE,6BAA6B,EAA0B,MAAM,yBAAyB,CAAC;AAE7G;;gEAEgE;AAChE,MAAM,UAAU,uBAAuB,CACrC,KAAa,EACb,MAAc,EACd,SAAgD;IAEhD,8FAA8F;IAC9F,+FAA+F;IAC/F,8FAA8F;IAC9F,6DAA6D;IAC7D,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,EAAE;QACxC,QAAQ,EAAE,aAAa;QACvB,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,iBAAiB,EAAE,CAAC,uBAAuB,CAAC;KAC7C,CAAC,CAAC;IACH,OAAO;QACL,OAAO,EAAE;YACP,GAAG,SAAS,CAAC,GAAG;YAChB,cAAc;YACd,4FAA4F;YAC5F,4FAA4F;YAC5F,2FAA2F;YAC3F,8BAA8B;YAC9B,6BAA6B,YAAY,CAAC,KAAK,CAAC,EAAE;SACnD;QACD,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC,GAAG,EAAE,UAAU,MAAM,IAAI,CAAC;KACpD,CAAC;AACJ,CAAC;AAeD;;iFAEiF;AACjF,MAAM,UAAU,4BAA4B,CAAC,kBAA0B,EAAE,IAAY;IACnF,MAAM,QAAQ,GAAG,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;IAC3D,IAAI,IAAI,KAAK,QAAQ;QACnB,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,6BAA6B,IAAI,0CAA0C,QAAQ,kBAAkB,kBAAkB,uBAAuB,CAAC,CAAC;AACnM,CAAC;AAKD;mGACmG;AACnG,MAAM,UAAU,qBAAqB,CACnC,OAA0B,EAC1B,GAAsB,EACtB,EAAmD,EACnD,UAA0B;IAE1B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,QAAQ,KAAK,SAAS;QACxB,OAAO,QAAQ,CAAC,KAAK,KAAK,EAAE,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,KAAK,EAAE,CAAC,KAAK,IAAI,QAAQ,CAAC,YAAY,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAChJ,MAAM,MAAM,GAAG,yBAAyB,CAAC,GAAG,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC;IAC9D,KAAK,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,KAAK,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtH,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,CAAC,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3G,OAAO,MAAM,CAAC;AAChB,CAAC;AAMD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAiB3C;IACC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC5B,gGAAgG;IAChG,kGAAkG;IAClG,gGAAgG;IAChG,iGAAiG;IACjG,MAAM,SAAS,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IACrE,MAAM,MAAM,GAAoB,MAAM,mBAAmB,CAAC;QACxD,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW;QACzD,KAAK,EAAE,oBAAoB,KAAK,EAAE;QAClC,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,uBAAuB,CAAC,KAAK,EAAE,EAAE,EAAE,SAAS,CAAC;QAC7D,GAAG;KACJ,CAAC,CAAC;IACH,IAAI,QAAkC,CAAC;IACvC,IAAI,CAAC;QACH,+FAA+F;QAC/F,yFAAyF;QACzF,QAAQ,GAAG,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,CAAC,CAAC;IACV,CAAC;IACD,iGAAiG;IACjG,wGAAwG;IACxG,uGAAuG;IACvG,wGAAwG;IACxG,EAAE;IACF,mGAAmG;IACnG,kGAAkG;IAClG,mGAAmG;IACnG,gGAAgG;IAChG,wEAAwE;IACxE,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;IAEzC,8FAA8F;IAC9F,wFAAwF;IACxF,MAAM,aAAa,GAAG,KAAK,EAAE,CAAmC,EAA0E,EAAE;QAC1I,MAAM,IAAI,GAAG,MAAM,6BAA6B,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAC7E,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,eAAe,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;IACtH,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAwB;QACpC,eAAe,EAAE,KAAK,EAAE,GAAmB,EAAE,EAAE;YAC7C,kFAAkF;YAClF,sFAAsF;YACtF,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;YAC7B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO;gBAClC,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,2FAA2F,CAAC,CAAC;YAChJ,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1E,mFAAmF;YACnF,8CAA8C;YAC9C,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC;YACvF,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAA6B,CAAC;YACvD,yFAAyF;YACzF,4FAA4F;YAC5F,0FAA0F;YAC1F,4BAA4B,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAE7D,8FAA8F;YAC9F,8FAA8F;YAC9F,gGAAgG;YAChG,oGAAoG;YACpG,kGAAkG;YAClG,kGAAkG;YAClG,+FAA+F;YAC/F,yFAAyF;YACzF,gGAAgG;YAChG,+FAA+F;YAC/F,yDAAyD;YACzD,8FAA8F;YAC9F,gGAAgG;YAChG,uDAAuD;YACvD,IAAI,SAAiF,CAAC;YACtF,IAAI,CAAC;gBACH,SAAS,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YACvI,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,6GAA6G,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,gGAAgG,CAAC,CAAC;YACpS,CAAC;YACD,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS;gBACrD,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,iEAAiE,KAAK,eAAe,IAAI,CAAC,eAAe,OAAO,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,6LAA6L,CAAC,CAAC;YACjZ,4FAA4F;YAC5F,6FAA6F;YAC7F,uFAAuF;YACvF,yFAAyF;YACzF,0FAA0F;YAC1F,2BAA2B;YAC3B,4FAA4F;YAC5F,+FAA+F;YAC/F,0FAA0F;YAC1F,qDAAqD;YACrD,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS;gBACnC,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,qEAAqE,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,eAAe,gBAAgB,SAAS,CAAC,SAAS,qCAAqC,SAAS,yNAAyN,SAAS,yDAAyD,CAAC,CAAC;YAC9gB,IAAI,SAAS,CAAC,YAAY,KAAK,IAAI,CAAC,UAAU;gBAC5C,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,mCAAmC,IAAI,CAAC,eAAe,2CAA2C,IAAI,CAAC,UAAU,sCAAsC,SAAS,CAAC,YAAY,+NAA+N,CAAC,CAAC;YAErb,gEAAgE;YAChE,MAAM,IAAI,GAAG,MAAM,6BAA6B,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YACvF,IAAI,IAAI,KAAK,SAAS;gBACpB,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,4BAA4B,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,gCAAgC,CAAC,CAAC;YAC7I,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY;gBACvF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAC;YACtG,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY;gBACnD,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,6CAA6C,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,iBAAiB,IAAI,CAAC,OAAO,CAAC,YAAY,iGAAiG,CAAC,CAAC;YAC7P,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;YAC9D,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;gBAClH,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,sBAAsB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,oBAAoB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,gJAAgJ,CAAC,CAAC;YAEpS,yFAAyF;YACzF,0FAA0F;YAC1F,sFAAsF;YACtF,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9C,4FAA4F;YAC5F,6FAA6F;YAC7F,wFAAwF;YACxF,kDAAkD;YAClD,MAAM,MAAM,GAAG,qBAAqB,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE;gBAC5D,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI;gBAC5F,eAAe,EAAE,yBAAyB,CAAC,KAAK,CAAC;aAClD,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACpB,IAAI,MAAM,KAAK,SAAS;gBACtB,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,gBAAgB,IAAI,CAAC,IAAI,oDAAoD,QAAQ,EAAE,KAAK,IAAI,QAAQ,EAAE,KAAK,IAAI,QAAQ,EAAE,YAAY,uBAAuB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,MAAM,MAAM,CAAC,YAAY,wJAAwJ,CAAC,CAAC;YACvZ,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC;YAC5B,GAAG,CAAC,uBAAuB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,YAAY,6BAA6B,SAAS,QAAQ,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;YAC3I,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC9H,CAAC;KACF,CAAC;IAEF,0FAA0F;IAC1F,iGAAiG;IACjG,gGAAgG;IAChG,6EAA6E;IAC7E,MAAM,MAAM,GAA2C,aAAa,CAClE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,aAAa,EAAE,CAC7F,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACpB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/auth-service-contract.d.ts

@@ -0,0 +1,64 @@
+/**
+ * The AUTH plane's v0.4 SERVICE CONTRACT (#399 M2): the §13.7 cluster document + compiled command
+ * contract for the `retire-lifecycle` op the auth plane serves on the `ep.*` rails. Shaped like
+ * `implementations/manager/src/manager-service-contract.ts` (the manager's own contract module):
+ * ONE `CommandRow`, its compiled input/output pair, and the cluster-document/artifact/command-def
+ * builders a `serveEndpoint` registration needs.
+ *
+ * This module is PURE DATA + schema (no broker, no barrier, no wire I/O): the registration and
+ * serve WIRING lives in the plane (`openAuthAuthorityPlane` / `openAuthAdminListener`).
+ */
+import { type CompiledContract, type EpAuthzMode, type EpCommandDef, type EpServeContext } from "@cotal-ai/core";
+/** The auth plane's endpoint NAME (matches `AUTH_ENDPOINT` in `@cotal-ai/core`). */
+export declare const AUTH_SERVICE_ENDPOINT = "auth";
+/** The auth cluster document's URN (§13.7 content-addressed authority). */
+export declare const AUTH_CLUSTER_URN = "ai.cotal.auth";
+/** Per-command compiled contract pairs, exported for CALLERS (mirrors `MANAGER_CONTRACTS`). Lazy:
+ *  a pair compiles on its first access, so importing the module alone pays no Ajv compile. */
+export declare const AUTH_CONTRACTS: Readonly<Record<string, {
+    input: CompiledContract;
+    output: CompiledContract;
+}>>;
+/** Every §13.7 contract artifact the auth plane PUBLISHES to the EPC store at registration: each
+ *  DISTINCT schema root plus its single-member closure manifest. */
+export declare function authContractArtifactValues(): unknown[];
+/** The §13.7 cluster DOCUMENT: the content-addressed authority for the auth plane's served
+ *  command surface. Revision 1: the single `retire-lifecycle` command. */
+export declare function authClusterDocument(): {
+    urn: string;
+    revision: number;
+    attributes: unknown[];
+    events: unknown[];
+    commands: Array<{
+        name: string;
+        class: "ephemeral";
+        targeted: boolean;
+        modes?: EpAuthzMode[];
+        capability: string;
+        inputDigest: string;
+        outputDigest: string;
+    }>;
+};
+/** The two-digest §13.7 content addressing for the auth document (mirrors
+ *  `managerClusterArtifacts`): both artifacts publish to the `epc` store at their own digest;
+ *  `clusterDigests` in the service spec carries the closure digest. */
+export declare function authClusterArtifacts(): {
+    document: ReturnType<typeof authClusterDocument>;
+    rootDigest: string;
+    manifest: {
+        v: 1;
+        root: string;
+        members: string[];
+    };
+    closureDigest: string;
+};
+/** The handler the auth plane supplies to back `retire-lifecycle`. Receives the serve CONTEXT
+ *  (broker-authenticated subject shape beside the validated args/target); returns the command's
+ *  output value (the compiled output contract validates it at the serve boundary). Kept as a
+ *  narrow interface so the contract module stays broker-free. */
+export interface AuthServiceHandlers {
+    retireLifecycle(ctx: EpServeContext): unknown | Promise<unknown>;
+}
+/** Build the `EpCommandDef[]` `serveEndpoint` consumes. */
+export declare function authCommandDefs(handlers: AuthServiceHandlers): EpCommandDef[];
+//# sourceMappingURL=auth-service-contract.d.ts.map

package/dist/auth-service-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-service-contract.d.ts","sourceRoot":"","sources":["../src/auth-service-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAGL,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,cAAc,EACpB,MAAM,gBAAgB,CAAC;AAExB,oFAAoF;AACpF,eAAO,MAAM,qBAAqB,SAAS,CAAC;AAE5C,2EAA2E;AAC3E,eAAO,MAAM,gBAAgB,kBAAkB,CAAC;AAsEhD;8FAC8F;AAC9F,eAAO,MAAM,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,CAAC,CAMvG,CAAC;AAEL;oEACoE;AACpE,wBAAgB,0BAA0B,IAAI,OAAO,EAAE,CAYtD;AAED;0EAC0E;AAC1E,wBAAgB,mBAAmB,IAAI;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,OAAO,EAAE,CAAC;IACtB,MAAM,EAAE,OAAO,EAAE,CAAC;IAClB,QAAQ,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,WAAW,CAAC;QACnB,QAAQ,EAAE,OAAO,CAAC;QAClB,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;QACtB,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC,CAAC;CACJ,CAgBA;AAED;;uEAEuE;AACvE,wBAAgB,oBAAoB,IAAI;IACtC,QAAQ,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE;QAAE,CAAC,EAAE,CAAC,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACpD,aAAa,EAAE,MAAM,CAAC;CACvB,CAMA;AAED;;;iEAGiE;AACjE,MAAM,WAAW,mBAAmB;IAClC,eAAe,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAClE;AAED,2DAA2D;AAC3D,wBAAgB,eAAe,CAAC,QAAQ,EAAE,mBAAmB,GAAG,YAAY,EAAE,CAS7E"}