@cotal-ai/auth 0.57.0 → 0.58.0

package/dist/auth-service-contract.js

@@ -0,0 +1,131 @@
+/**
+ * The AUTH plane's v0.4 SERVICE CONTRACT (#399 M2): the §13.7 cluster document + compiled command
+ * contract for the `retire-lifecycle` op the auth plane serves on the `ep.*` rails. Shaped like
+ * `implementations/manager/src/manager-service-contract.ts` (the manager's own contract module):
+ * ONE `CommandRow`, its compiled input/output pair, and the cluster-document/artifact/command-def
+ * builders a `serveEndpoint` registration needs.
+ *
+ * This module is PURE DATA + schema (no broker, no barrier, no wire I/O): the registration and
+ * serve WIRING lives in the plane (`openAuthAuthorityPlane` / `openAuthAdminListener`).
+ */
+import { compileContract, contractDigest, } from "@cotal-ai/core";
+/** The auth plane's endpoint NAME (matches `AUTH_ENDPOINT` in `@cotal-ai/core`). */
+export const AUTH_SERVICE_ENDPOINT = "auth";
+/** The auth cluster document's URN (§13.7 content-addressed authority). */
+export const AUTH_CLUSTER_URN = "ai.cotal.auth";
+// ---- input/output schemas (closed shape) --------------------------------------------------------
+/** The `retireLifecycle` args — the shape `parseRetireArgs` (`auth-admin.ts:146`) accepts. The
+ *  target (owner, actor, lifecycleUid) is never an argument: `exact` mode carries it in the
+ *  subject, broker-enforced, so the handler reads it from `ctx.subject.target`. */
+const RETIRE_LIFECYCLE_INPUT_SCHEMA = {
+    type: "object",
+    additionalProperties: false,
+    required: ["opId", "serveEndpoint", "serveInstanceId", "serveEpoch"],
+    properties: {
+        /** The requester's stable operation id (a retry sends the SAME opId). */
+        opId: { type: "string" },
+        /** The serve-issuance gate's endpoint name the requester's serve grant is keyed under. */
+        serveEndpoint: { type: "string" },
+        /** The serve-issuance gate's instance id (lookup coordinate, not an authz input). */
+        serveInstanceId: { type: "string" },
+        /** The declared process epoch (a superseded predecessor is refused). */
+        serveEpoch: { type: "integer", minimum: 0 },
+    },
+};
+/** The `retireLifecycle` output — the object the handler returns (`auth-admin.ts:390`). */
+const RETIRE_LIFECYCLE_OUTPUT_SCHEMA = {
+    type: "object",
+    additionalProperties: false,
+    required: ["retired", "lifecycleUid", "opId", "evictedPrincipals"],
+    properties: {
+        retired: { type: "boolean" },
+        lifecycleUid: { type: "string" },
+        opId: { type: "string" },
+        evictedPrincipals: { type: "array", items: { type: "string" } },
+    },
+};
+const ROWS = [
+    { name: "retire-lifecycle", capability: "auth.admin", input: RETIRE_LIFECYCLE_INPUT_SCHEMA, output: RETIRE_LIFECYCLE_OUTPUT_SCHEMA, targeted: true, modes: ["exact"], handler: "retireLifecycle" },
+];
+const COMPILED = new Map();
+function pairFor(name) {
+    let pair = COMPILED.get(name);
+    if (!pair) {
+        const r = ROWS.find((row) => row.name === name);
+        if (!r)
+            throw new Error(`unknown auth command contract "${name}"`);
+        pair = { input: compileContract({ root: r.input }), output: compileContract({ root: r.output }) };
+        COMPILED.set(name, pair);
+    }
+    return pair;
+}
+/** §13.7 closure digest of a self-contained schema root, WITHOUT compiling. */
+function closureDigestOfSource(root) {
+    return contractDigest({ v: 1, root: contractDigest(root), members: [] });
+}
+/** Per-command compiled contract pairs, exported for CALLERS (mirrors `MANAGER_CONTRACTS`). Lazy:
+ *  a pair compiles on its first access, so importing the module alone pays no Ajv compile. */
+export const AUTH_CONTRACTS = new Proxy({}, {
+    has: (_, name) => ROWS.some((r) => r.name === name),
+    ownKeys: () => ROWS.map((r) => r.name),
+    getOwnPropertyDescriptor: (_, name) => (ROWS.some((r) => r.name === name) ? { configurable: true, enumerable: true, get: () => pairFor(name) } : undefined),
+    get: (_, name) => (typeof name === "string" && ROWS.some((r) => r.name === name) ? pairFor(name) : undefined),
+});
+/** Every §13.7 contract artifact the auth plane PUBLISHES to the EPC store at registration: each
+ *  DISTINCT schema root plus its single-member closure manifest. */
+export function authContractArtifactValues() {
+    const values = [];
+    const seen = new Set();
+    for (const r of ROWS) {
+        for (const source of [r.input, r.output]) {
+            const rootDigest = contractDigest(source);
+            if (seen.has(rootDigest))
+                continue;
+            seen.add(rootDigest);
+            values.push(source, { v: 1, root: rootDigest, members: [] });
+        }
+    }
+    return values;
+}
+/** The §13.7 cluster DOCUMENT: the content-addressed authority for the auth plane's served
+ *  command surface. Revision 1: the single `retire-lifecycle` command. */
+export function authClusterDocument() {
+    return {
+        urn: AUTH_CLUSTER_URN,
+        revision: 1,
+        attributes: [],
+        events: [],
+        commands: ROWS.map((r) => ({
+            name: r.name,
+            class: "ephemeral",
+            targeted: r.targeted,
+            ...(r.modes ? { modes: r.modes } : {}),
+            capability: r.capability,
+            inputDigest: closureDigestOfSource(r.input),
+            outputDigest: closureDigestOfSource(r.output),
+        })),
+    };
+}
+/** The two-digest §13.7 content addressing for the auth document (mirrors
+ *  `managerClusterArtifacts`): both artifacts publish to the `epc` store at their own digest;
+ *  `clusterDigests` in the service spec carries the closure digest. */
+export function authClusterArtifacts() {
+    const document = authClusterDocument();
+    const rootDigest = contractDigest(document);
+    const manifest = { v: 1, root: rootDigest, members: [] };
+    const closureDigest = contractDigest(manifest);
+    return { document, rootDigest, manifest, closureDigest };
+}
+/** Build the `EpCommandDef[]` `serveEndpoint` consumes. */
+export function authCommandDefs(handlers) {
+    // First use MATERIALIZES the compiled pairs (the Proxy compiles lazily; a compile failure
+    // surfaces here, at registration, exactly where serve would need the validators).
+    for (const r of ROWS)
+        pairFor(r.name);
+    return ROWS.map((r) => ({
+        command: r.name,
+        contract: pairFor(r.name),
+        handler: (ctx) => handlers[r.handler](ctx),
+    }));
+}
+//# sourceMappingURL=auth-service-contract.js.map

package/dist/auth-service-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-service-contract.js","sourceRoot":"","sources":["../src/auth-service-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,eAAe,EACf,cAAc,GAKf,MAAM,gBAAgB,CAAC;AAExB,oFAAoF;AACpF,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAE5C,2EAA2E;AAC3E,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAAC;AAEhD,oGAAoG;AAEpG;;mFAEmF;AACnF,MAAM,6BAA6B,GAAG;IACpC,IAAI,EAAE,QAAQ;IACd,oBAAoB,EAAE,KAAK;IAC3B,QAAQ,EAAE,CAAC,MAAM,EAAE,eAAe,EAAE,iBAAiB,EAAE,YAAY,CAAC;IACpE,UAAU,EAAE;QACV,yEAAyE;QACzE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,0FAA0F;QAC1F,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACjC,qFAAqF;QACrF,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACnC,wEAAwE;QACxE,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE;KAC5C;CACO,CAAC;AAEX,2FAA2F;AAC3F,MAAM,8BAA8B,GAAG;IACrC,IAAI,EAAE,QAAQ;IACd,oBAAoB,EAAE,KAAK;IAC3B,QAAQ,EAAE,CAAC,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,mBAAmB,CAAC;IAClE,UAAU,EAAE;QACV,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC5B,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAChC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,iBAAiB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;KAChE;CACO,CAAC;AAYX,MAAM,IAAI,GAAiB;IACzB,EAAE,IAAI,EAAE,kBAAkB,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,6BAA6B,EAAE,MAAM,EAAE,8BAA8B,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE;CACnM,CAAC;AAIF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;AAEjD,SAAS,OAAO,CAAC,IAAY;IAC3B,IAAI,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,GAAG,CAAC,CAAC;QACnE,IAAI,GAAG,EAAE,KAAK,EAAE,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,KAAgC,EAAE,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAiC,EAAE,CAAC,EAAE,CAAC;QACxJ,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,SAAS,qBAAqB,CAAC,IAAa;IAC1C,OAAO,cAAc,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED;8FAC8F;AAC9F,MAAM,CAAC,MAAM,cAAc,GACzB,IAAI,KAAK,CAAC,EAAkC,EAAE;IAC5C,GAAG,EAAE,CAAC,CAAC,EAAE,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;IAC3D,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAA2B;IAChE,wBAAwB,EAAE,CAAC,CAAC,EAAE,IAAY,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACnK,GAAG,EAAE,CAAC,CAAC,EAAE,IAAqB,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;CAC/H,CAAC,CAAC;AAEL;oEACoE;AACpE,MAAM,UAAU,0BAA0B;IACxC,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,KAAK,MAAM,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACzC,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;gBAAE,SAAS;YACnC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;0EAC0E;AAC1E,MAAM,UAAU,mBAAmB;IAejC,OAAO;QACL,GAAG,EAAE,gBAAgB;QACrB,QAAQ,EAAE,CAAC;QACX,UAAU,EAAE,EAAE;QACd,MAAM,EAAE,EAAE;QACV,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACzB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,WAAoB;YAC3B,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtC,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,WAAW,EAAE,qBAAqB,CAAC,CAAC,CAAC,KAAK,CAAC;YAC3C,YAAY,EAAE,qBAAqB,CAAC,CAAC,CAAC,MAAM,CAAC;SAC9C,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED;;uEAEuE;AACvE,MAAM,UAAU,oBAAoB;IAMlC,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAC;IACvC,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,CAAU,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,EAAc,EAAE,CAAC;IAC9E,MAAM,aAAa,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC/C,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC;AAC3D,CAAC;AAUD,2DAA2D;AAC3D,MAAM,UAAU,eAAe,CAAC,QAA6B;IAC3D,0FAA0F;IAC1F,kFAAkF;IAClF,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtB,OAAO,EAAE,CAAC,CAAC,IAAI;QACf,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QACzB,OAAO,EAAE,CAAC,GAAmB,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC;KAC3D,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/authority-client.d.ts

@@ -62,6 +62,22 @@ export declare function remoteManagerIssuerGrants(space: string, connId: string)
     subscribe: string[];
 };
 export { remoteManagerRegistrationProof };
+/**
+ * The AUTH PLANE's OWN registration executor grant (#399 M2): the ONE `(auth, instanceId)`
+ * self-registration this plane performs at boot (`registerServiceInstance` +
+ * `authorizeServeGrant` + `writeServiceStatus` + the §13.7 contract-artifact publish), mirrored
+ * from the manager's `endpointServeExecutorPermissions` (`packages/core/src/provision.ts:2426`)
+ * but built directly (the auth plane self-authorizes its own name with the space signing seed,
+ * exactly as the manager self-authorizes `manager`, so this rides the same self-minted
+ * `openAuthorityClient` door as the writer/barrier connections rather than a `mintCreds` profile).
+ * Key-pinned to exactly this instance's gate/cred/repair rows and its two `svc.auth.<instanceId>`
+ * record keys plus the endpoint's `govern.auth` head; the contract-artifact publish is the same
+ * single-token `epc.*` form {@link contractPublisherGrants} uses (never the wide `epc.>`).
+ */
+export declare function authRegistrationExecutorGrants(space: string, connId: string, instanceId: string): {
+    publish: string[];
+    subscribe: string[];
+};
 /**
  * The BARRIER EXECUTOR's scoped credential grant (SPEC 13.9): the lifecycle-barrier surface —
  * exactly what the takeover barrier (and its retirement sibling) reaches through the sealed

package/dist/authority-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authority-client.d.ts","sourceRoot":"","sources":["../src/authority-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAGzF,OAAO,EAAyN,8BAA8B,EAAE,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC5S,OAAO,EAA8C,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAErG;6FAC6F;AAC7F,eAAO,MAAM,wBAAwB,QAAU,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CA0B/G;AAED;;qEAEqE;AACrE,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAgBnH;AAED,OAAO,EAAE,8BAA8B,EAAE,CAAC;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CA6DhH;AAED;;;;;;;;;;;;;;;;;;;;iGAoBiG;AACjG,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAcvH;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,mGAAmG;IACnG,KAAK,EAAE,MAAM,CAAC;IACd;mDAC+C;IAC/C,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACvE;;;;2GAIuG;IACvG,SAAS,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B;;qDAEiD;IACjD,gBAAgB,CAAC,EAAE,MAAM,IAAI,CAAC;IAC9B;;8DAE0D;IAC1D,YAAY,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACtD;;;;;;;;kFAQ8E;IAC9E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;;;;;;;kGAa8F;IAC9F,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,cAAc,CAAC;IACnB,wFAAwF;IACxF,MAAM,EAAE,MAAM,CAAC;IACf;oFACgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;4EACwE;IACxE,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB;;sDAEkD;IAClD,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACrB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,eAAe,CAAC,CAuE7F;AAED,MAAM,WAAW,uBAAuB;IACtC;;8CAE0C;IAC1C,OAAO,IAAI,aAAa,CAAC;IACzB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,IAAI,CAAC,mBAAmB,EAAE,QAAQ,GAAG,OAAO,CAAC,GAClD,OAAO,CAAC,uBAAuB,CAAC,CAqDlC"}
+{"version":3,"file":"authority-client.d.ts","sourceRoot":"","sources":["../src/authority-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAGzF,OAAO,EAAyP,8BAA8B,EAA+J,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACze,OAAO,EAA8C,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAErG;6FAC6F;AAC7F,eAAO,MAAM,wBAAwB,QAAU,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CA0B/G;AAED;;qEAEqE;AACrE,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CA0BnH;AAED,OAAO,EAAE,8BAA8B,EAAE,CAAC;AAE1C;;;;;;;;;;;GAWG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAqC5I;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CA6DhH;AAED;;;;;;;;;;;;;;;;;;;;iGAoBiG;AACjG,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAcvH;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,mGAAmG;IACnG,KAAK,EAAE,MAAM,CAAC;IACd;mDAC+C;IAC/C,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACvE;;;;2GAIuG;IACvG,SAAS,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B;;qDAEiD;IACjD,gBAAgB,CAAC,EAAE,MAAM,IAAI,CAAC;IAC9B;;8DAE0D;IAC1D,YAAY,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACtD;;;;;;;;kFAQ8E;IAC9E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;;;;;;;kGAa8F;IAC9F,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,cAAc,CAAC;IACnB,wFAAwF;IACxF,MAAM,EAAE,MAAM,CAAC;IACf;oFACgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;4EACwE;IACxE,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB;;sDAEkD;IAClD,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACrB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,eAAe,CAAC,CAuE7F;AAED,MAAM,WAAW,uBAAuB;IACtC;;8CAE0C;IAC1C,OAAO,IAAI,aAAa,CAAC;IACzB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,IAAI,CAAC,mBAAmB,EAAE,QAAQ,GAAG,OAAO,CAAC,GAClD,OAAO,CAAC,uBAAuB,CAAC,CAqDlC"}

package/dist/authority-client.js

@@ -27,7 +27,7 @@
 import { connect, jwtAuthenticator } from "@nats-io/transport-node";
 import { encodeUser } from "@nats-io/jwt";
 import { fromPublic, fromSeed } from "@nats-io/nkeys";
-import { EpEnvelopeError, assertInboxConnId, endpointToken, epAuthBucket, epfStreamName, newIdentity, recordsBucket, retirementFrontierStreams, spacePrefix, assertPoolToken, principalTags, principalKey, remoteManagerActors, remoteManagerRegistrationProof } from "@cotal-ai/core";
+import { EpEnvelopeError, admissionBucket, assertInboxConnId, endpointToken, epAuthBucket, epcStreamName, epfStreamName, newIdentity, recordsBucket, retirementFrontierStreams, spacePrefix, assertPoolToken, principalTags, principalKey, remoteManagerActors, remoteManagerRegistrationProof, AUTH_ENDPOINT, assertLifecycleToken, epcredFamilyPrefix, epgateKey, eprepairKey, GOVERN_HEAD, RECORD_KINDS, recordAtomicKey, recordSpecKey, recordStatusKey } from "@cotal-ai/core";
 import { authConnectReaderGrants, openConnectReader } from "./connect-reader.js";
 /** Self-minted infra-credential TTL (fact-3 pin: SHORT expiry + in-process renewal, a bounded
  *  in-memory credential that closes with the service — never an unbounded persisted one). */
@@ -84,6 +84,7 @@ export function authorityWriterGrants(space, connId) {
  * HTTP handler chooses fixed profiles and caller-generated nkeys. */
 export function remoteManagerIssuerGrants(space, connId) {
     const base = authorityWriterGrants(space, connId);
+    const admission = `KV_${admissionBucket(space)}`;
     return {
         publish: [
             ...base.publish,
@@ -95,11 +96,70 @@ export function remoteManagerIssuerGrants(space, connId) {
             // issuance family is reachable through this server-side connection.
             `$KV.${epAuthBucket(space)}.epgate.manager.>`,
             `$KV.${epAuthBucket(space)}.epcred.manager.>`,
+            // Standing renewal re-derives the serve surface from the registered spec's content-addressed
+            // cluster artifacts: read-only Direct Get on the space's contract store, nothing else.
+            `$JS.API.DIRECT.GET.${epcStreamName(space)}.${spacePrefix(space)}.epc.>`,
+            `$JS.API.DIRECT.GET.${epcStreamName(space)}`,
+            // Run attempt authorization reads the run's admission record from the admission KV store:
+            `$JS.API.STREAM.INFO.${admission}`,
+            `$JS.API.STREAM.MSG.GET.${admission}`,
+            `$JS.API.DIRECT.GET.${admission}`,
+            `$JS.API.DIRECT.GET.${admission}.>`,
         ],
         subscribe: base.subscribe,
     };
 }
 export { remoteManagerRegistrationProof };
+/**
+ * The AUTH PLANE's OWN registration executor grant (#399 M2): the ONE `(auth, instanceId)`
+ * self-registration this plane performs at boot (`registerServiceInstance` +
+ * `authorizeServeGrant` + `writeServiceStatus` + the §13.7 contract-artifact publish), mirrored
+ * from the manager's `endpointServeExecutorPermissions` (`packages/core/src/provision.ts:2426`)
+ * but built directly (the auth plane self-authorizes its own name with the space signing seed,
+ * exactly as the manager self-authorizes `manager`, so this rides the same self-minted
+ * `openAuthorityClient` door as the writer/barrier connections rather than a `mintCreds` profile).
+ * Key-pinned to exactly this instance's gate/cred/repair rows and its two `svc.auth.<instanceId>`
+ * record keys plus the endpoint's `govern.auth` head; the contract-artifact publish is the same
+ * single-token `epc.*` form {@link contractPublisherGrants} uses (never the wide `epc.>`).
+ */
+export function authRegistrationExecutorGrants(space, connId, instanceId) {
+    const auth = `KV_${epAuthBucket(space)}`;
+    const records = `KV_${recordsBucket(space)}`;
+    const gateKey = epgateKey(AUTH_ENDPOINT, instanceId);
+    const credPrefix = epcredFamilyPrefix(AUTH_ENDPOINT, instanceId);
+    const repairKey = eprepairKey(AUTH_ENDPOINT, instanceId);
+    const recordKeys = [
+        recordSpecKey(RECORD_KINDS.svc, [AUTH_ENDPOINT, assertLifecycleToken(instanceId, "instanceId")]),
+        recordStatusKey(RECORD_KINDS.svc, [AUTH_ENDPOINT, assertLifecycleToken(instanceId, "instanceId")]),
+        recordAtomicKey(GOVERN_HEAD, [AUTH_ENDPOINT]),
+    ];
+    const inbox = assertInboxConnId(connId);
+    return {
+        publish: [
+            "$JS.API.INFO",
+            `$JS.API.STREAM.MSG.GET.${auth}`,
+            `$JS.API.STREAM.MSG.GET.${records}`,
+            // Registration Phase 2 enumerates the epcred family (`kv.keys('epcred.<endpoint>.<instanceId>.>')`)
+            // to revoke + verify-evict a superseded serve family before publishing a new spec (SPEC 13.1).
+            // `kv.keys()` opens an ephemeral ordered consumer, so the executor needs CONSUMER lifecycle on
+            // the auth stream, scoped the same as the manager's own mirror (`endpointServeExecutorPermissions`,
+            // provision.ts:2477-2479): the whole bucket, since a subject-wildcard consumer cannot be key-pinned
+            // tighter by a broker ACL.
+            `$JS.API.CONSUMER.CREATE.${auth}.>`,
+            `$JS.API.CONSUMER.INFO.${auth}.>`,
+            `$JS.API.CONSUMER.DELETE.${auth}.>`,
+            `$JS.API.DIRECT.GET.${recordsBucket(space)}`,
+            `$JS.API.DIRECT.GET.${recordsBucket(space)}.>`,
+            `$KV.${epAuthBucket(space)}.${gateKey}`,
+            `$KV.${epAuthBucket(space)}.${repairKey}`,
+            `$KV.${epAuthBucket(space)}.${credPrefix}.>`,
+            ...recordKeys.map((k) => `$KV.${recordsBucket(space)}.${k}`),
+            `${spacePrefix(space)}.epc.*`,
+            `$JS.API.DIRECT.GET.${epcStreamName(space)}.${spacePrefix(space)}.epc.>`,
+        ],
+        subscribe: [`_INBOX_${inbox}.>`],
+    };
+}
 /**
  * The BARRIER EXECUTOR's scoped credential grant (SPEC 13.9): the lifecycle-barrier surface —
  * exactly what the takeover barrier (and its retirement sibling) reaches through the sealed

package/dist/authority-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"authority-client.js","sourceRoot":"","sources":["../src/authority-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAuB,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,yBAAyB,EAAE,WAAW,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAE,mBAAmB,EAAE,8BAA8B,EAAuB,MAAM,gBAAgB,CAAC;AAC5S,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAsB,MAAM,qBAAqB,CAAC;AAErG;6FAC6F;AAC7F,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,EAAE,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,MAAc;IACjE,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7C,gGAAgG;IAChG,2EAA2E;IAC3E,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO;QACL,OAAO,EAAE;YACP,cAAc;YACd,yBAAyB,IAAI,EAAE;YAC/B,yBAAyB,OAAO,EAAE;YAClC,yBAAyB,OAAO,EAAE;YAClC,uBAAuB,IAAI,EAAE;YAC7B,uBAAuB,OAAO,EAAE;YAChC,0BAA0B,IAAI,EAAE;YAChC,0BAA0B,OAAO,EAAE;YACnC,sBAAsB,OAAO,EAAE;YAC/B,sBAAsB,OAAO,IAAI;YACjC,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,UAAU;YACpC,OAAO,aAAa,CAAC,KAAK,CAAC,cAAc;YACzC,OAAO,aAAa,CAAC,KAAK,CAAC,QAAQ;SACpC;QACD,SAAS,EAAE,CAAC,UAAU,KAAK,IAAI,CAAC;KACjC,CAAC;AACJ,CAAC;AAED;;qEAEqE;AACrE,MAAM,UAAU,yBAAyB,CAAC,KAAa,EAAE,MAAc;IACrE,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAClD,OAAO;QACL,OAAO,EAAE;YACP,GAAG,IAAI,CAAC,OAAO;YACf,4FAA4F;YAC5F,8FAA8F;YAC9F,6FAA6F;YAC7F,4FAA4F;YAC5F,6FAA6F;YAC7F,oEAAoE;YACpE,OAAO,YAAY,CAAC,KAAK,CAAC,mBAAmB;YAC7C,OAAO,YAAY,CAAC,KAAK,CAAC,mBAAmB;SAC9C;QACD,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,8BAA8B,EAAE,CAAC;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa,EAAE,MAAc;IAClE,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7C,6FAA6F;IAC7F,mEAAmE;IACnE,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxC,sFAAsF;IACtF,0FAA0F;IAC1F,iGAAiG;IACjG,gGAAgG;IAChG,kGAAkG;IAClG,2CAA2C;IAC3C,MAAM,YAAY,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC;IAC7F,OAAO;QACL,OAAO,EAAE;YACP,cAAc;YACd,uBAAuB,IAAI,EAAE;YAC7B,uBAAuB,OAAO,EAAE;YAChC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,uBAAuB,OAAO,EAAE,CAAC;YACrE,0BAA0B,IAAI,EAAE;YAChC,0BAA0B,OAAO,EAAE;YACnC,sBAAsB,OAAO,EAAE;YAC/B,sBAAsB,OAAO,IAAI;YACjC,6FAA6F;YAC7F,4FAA4F;YAC5F,mFAAmF;YACnF,8FAA8F;YAC9F,6FAA6F;YAC7F,0FAA0F;YAC1F,yFAAyF;YACzF,4FAA4F;YAC5F,8FAA8F;YAC9F,2FAA2F;YAC3F,4FAA4F;YAC5F,4FAA4F;YAC5F,yEAAyE;YACzE,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,2FAA2F;YAC3F,0FAA0F;YAC1F,yFAAyF;YACzF,yFAAyF;YACzF,mFAAmF;YACnF,OAAO,YAAY,CAAC,KAAK,CAAC,UAAU;YACpC,2FAA2F;YAC3F,yFAAyF;YACzF,uFAAuF;YACvF,sFAAsF;YACtF,wFAAwF;YACxF,mCAAmC;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,QAAQ;YAClC,OAAO,aAAa,CAAC,KAAK,CAAC,cAAc;YACzC,sFAAsF;YACtF,uFAAuF;YACvF,sFAAsF;YACtF,yFAAyF;YACzF,2EAA2E;YAC3E,OAAO,aAAa,CAAC,KAAK,CAAC,aAAa;SACzC;QACD,SAAS,EAAE,CAAC,UAAU,KAAK,IAAI,CAAC;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;iGAoBiG;AACjG,MAAM,UAAU,+BAA+B,CAAC,KAAa,EAAE,QAAgB,EAAE,KAAe;IAC9F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAC7C,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,gJAAgJ,CAAC,CAAC;IACrM,MAAM,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,CAAC,IAAI,CACV,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAC3C,OAAO,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAChD,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,0BAA0B,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/D,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC;AAsED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAyB;IACjE,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;IAChF,MAAM,IAAI,GAAG,KAAK,IAAqB,EAAE,CACvC,UAAU,CACR,IAAI,CAAC,KAAK,EACV,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,EACvB,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAChC,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE;QAChE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;IAClG,6FAA6F;IAC7F,qFAAqF;IACrF,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,wBAAwB,EAAE,CAC7G,CAAC;IACJ,IAAI,UAAU,GAAG,MAAM,IAAI,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,KAAK,IAAqB,EAAE;QACxC,IAAI,IAAI,CAAC,YAAY,EAAE,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC7E,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;IACF,yFAAyF;IACzF,iEAAiE;IACjE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE;QACjE,KAAK,KAAK,EAAE,CAAC,IAAI,CACf,CAAC,GAAG,EAAE,EAAE,GAAG,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,EAC9B,CAAC,CAAC,EAAE,EAAE;YACJ,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,gCAAiC,CAAW,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,uDAAuD,CAAC,CAAC;YACjJ,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;QAC5B,CAAC,CACF,CAAC;IACJ,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,IAAI,CAAC,wBAAwB,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3E,IAAI,EAAkB,CAAC;IACvB,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,OAAO,CAAC;YACjB,OAAO,EAAE,IAAI,CAAC,MAAM;YACpB,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,aAAa,EAAE,gBAAgB,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC1F,WAAW,EAAE,UAAU,QAAQ,CAAC,EAAE,EAAE;YACpC,+FAA+F;YAC/F,uFAAuF;YACvF,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,EAAE,CAAC;SAC5H,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,OAAO,KAAK,SAAS;YAAE,aAAa,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,CAAC;IACV,CAAC;IACD,IAAI,KAAiC,CAAC;IACtC,IAAI,IAA+B,CAAC;IACpC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,4FAA4F;QAC5F,2EAA2E;QAC3E,MAAM,IAAI,GAAG,EAAE,CAAC,IAA8D,CAAC;QAC/E,IAAI,OAAO,IAAI,EAAE,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YAClE,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC;YACvG,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACjC,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,KAAK,iGAAiG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,gFAAgF,CAAC,CAAC;QACxT,CAAC;QACD,KAAK,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjF,IAAI,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO;QACL,EAAE;QACF,MAAM,EAAE,QAAQ,CAAC,EAAE;QACnB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,IAAI,OAAO,KAAK,SAAS;gBAAE,aAAa,CAAC,OAAO,CAAC,CAAC;YAClD,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnC,CAAC;KACF,CAAC;AACJ,CAAC;AAUD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,IAAmD;IAEnD,MAAM,KAAK,GAAG,qBAAqB,IAAI,CAAC,KAAK,EAAE,CAAC;IAChD,IAAI,MAAiC,CAAC;IACtC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,MAAmC,CAAC;IACxC,MAAM,GAAG,MAAM,mBAAmB,CAAC;QACjC,GAAG,IAAI;QACP,KAAK;QACL,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;QAC/D,sFAAsF;QACtF,4FAA4F;QAC5F,gBAAgB,EAAE,GAAG,EAAE;YACrB,MAAM,GAAG,SAAS,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,yGAAyG,CAAC,CAAC;YAC5H,IAAI,CAAC,MAAM;gBAAE,KAAK,MAAM,EAAE,KAAK,EAAE,CAAC;QACpC,CAAC;KACF,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,MAAM,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,CAAC;IACV,CAAC;IACD,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;YACpC,IAAI,MAAM;gBAAE,MAAM;YAClB,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAClD,MAAM,GAAG,SAAS,CAAC;gBACnB,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,sBAAsB,CAAC,CAAC,IAAI,uDAAuD,CAAC,CAAC;YACxG,CAAC;iBAAM,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAClC,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;oBACnD,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,kDAAkD,CAAC,CAAC;gBACvE,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,GAAG,SAAS,CAAC;oBACnB,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,gCAAiC,CAAW,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC;gBACjH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,OAAO;QACL,OAAO,EAAE,GAAG,EAAE;YACZ,IAAI,MAAM,KAAK,SAAS;gBACtB,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,+KAA+K,CAAC,CAAC;YAC5N,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,GAAG,IAAI,CAAC;YACd,MAAM,GAAG,SAAS,CAAC,CAAC,oEAAoE;YACxF,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"authority-client.js","sourceRoot":"","sources":["../src/authority-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAuB,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,yBAAyB,EAAE,WAAW,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAE,mBAAmB,EAAE,8BAA8B,EAAE,aAAa,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,eAAe,EAAuB,MAAM,gBAAgB,CAAC;AACze,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAsB,MAAM,qBAAqB,CAAC;AAErG;6FAC6F;AAC7F,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,EAAE,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,MAAc;IACjE,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7C,gGAAgG;IAChG,2EAA2E;IAC3E,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO;QACL,OAAO,EAAE;YACP,cAAc;YACd,yBAAyB,IAAI,EAAE;YAC/B,yBAAyB,OAAO,EAAE;YAClC,yBAAyB,OAAO,EAAE;YAClC,uBAAuB,IAAI,EAAE;YAC7B,uBAAuB,OAAO,EAAE;YAChC,0BAA0B,IAAI,EAAE;YAChC,0BAA0B,OAAO,EAAE;YACnC,sBAAsB,OAAO,EAAE;YAC/B,sBAAsB,OAAO,IAAI;YACjC,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,UAAU;YACpC,OAAO,aAAa,CAAC,KAAK,CAAC,cAAc;YACzC,OAAO,aAAa,CAAC,KAAK,CAAC,QAAQ;SACpC;QACD,SAAS,EAAE,CAAC,UAAU,KAAK,IAAI,CAAC;KACjC,CAAC;AACJ,CAAC;AAED;;qEAEqE;AACrE,MAAM,UAAU,yBAAyB,CAAC,KAAa,EAAE,MAAc;IACrE,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;IACjD,OAAO;QACL,OAAO,EAAE;YACP,GAAG,IAAI,CAAC,OAAO;YACf,4FAA4F;YAC5F,8FAA8F;YAC9F,6FAA6F;YAC7F,4FAA4F;YAC5F,6FAA6F;YAC7F,oEAAoE;YACpE,OAAO,YAAY,CAAC,KAAK,CAAC,mBAAmB;YAC7C,OAAO,YAAY,CAAC,KAAK,CAAC,mBAAmB;YAC7C,6FAA6F;YAC7F,uFAAuF;YACvF,sBAAsB,aAAa,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,QAAQ;YACxE,sBAAsB,aAAa,CAAC,KAAK,CAAC,EAAE;YAC5C,0FAA0F;YAC1F,uBAAuB,SAAS,EAAE;YAClC,0BAA0B,SAAS,EAAE;YACrC,sBAAsB,SAAS,EAAE;YACjC,sBAAsB,SAAS,IAAI;SACpC;QACD,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,8BAA8B,EAAE,CAAC;AAE1C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,8BAA8B,CAAC,KAAa,EAAE,MAAc,EAAE,UAAkB;IAC9F,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,SAAS,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,kBAAkB,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,WAAW,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG;QACjB,aAAa,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,aAAa,EAAE,oBAAoB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;QAChG,eAAe,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,aAAa,EAAE,oBAAoB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;QAClG,eAAe,CAAC,WAAW,EAAE,CAAC,aAAa,CAAC,CAAC;KAC9C,CAAC;IACF,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO;QACL,OAAO,EAAE;YACP,cAAc;YACd,0BAA0B,IAAI,EAAE;YAChC,0BAA0B,OAAO,EAAE;YACnC,oGAAoG;YACpG,+FAA+F;YAC/F,+FAA+F;YAC/F,oGAAoG;YACpG,oGAAoG;YACpG,2BAA2B;YAC3B,2BAA2B,IAAI,IAAI;YACnC,yBAAyB,IAAI,IAAI;YACjC,2BAA2B,IAAI,IAAI;YACnC,sBAAsB,aAAa,CAAC,KAAK,CAAC,EAAE;YAC5C,sBAAsB,aAAa,CAAC,KAAK,CAAC,IAAI;YAC9C,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,OAAO,EAAE;YACvC,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,SAAS,EAAE;YACzC,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,UAAU,IAAI;YAC5C,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5D,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ;YAC7B,sBAAsB,aAAa,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,QAAQ;SACzE;QACD,SAAS,EAAE,CAAC,UAAU,KAAK,IAAI,CAAC;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa,EAAE,MAAc;IAClE,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7C,6FAA6F;IAC7F,mEAAmE;IACnE,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxC,sFAAsF;IACtF,0FAA0F;IAC1F,iGAAiG;IACjG,gGAAgG;IAChG,kGAAkG;IAClG,2CAA2C;IAC3C,MAAM,YAAY,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC;IAC7F,OAAO;QACL,OAAO,EAAE;YACP,cAAc;YACd,uBAAuB,IAAI,EAAE;YAC7B,uBAAuB,OAAO,EAAE;YAChC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,uBAAuB,OAAO,EAAE,CAAC;YACrE,0BAA0B,IAAI,EAAE;YAChC,0BAA0B,OAAO,EAAE;YACnC,sBAAsB,OAAO,EAAE;YAC/B,sBAAsB,OAAO,IAAI;YACjC,6FAA6F;YAC7F,4FAA4F;YAC5F,mFAAmF;YACnF,8FAA8F;YAC9F,6FAA6F;YAC7F,0FAA0F;YAC1F,yFAAyF;YACzF,4FAA4F;YAC5F,8FAA8F;YAC9F,2FAA2F;YAC3F,4FAA4F;YAC5F,4FAA4F;YAC5F,yEAAyE;YACzE,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,2FAA2F;YAC3F,0FAA0F;YAC1F,yFAAyF;YACzF,yFAAyF;YACzF,mFAAmF;YACnF,OAAO,YAAY,CAAC,KAAK,CAAC,UAAU;YACpC,2FAA2F;YAC3F,yFAAyF;YACzF,uFAAuF;YACvF,sFAAsF;YACtF,wFAAwF;YACxF,mCAAmC;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,QAAQ;YAClC,OAAO,aAAa,CAAC,KAAK,CAAC,cAAc;YACzC,sFAAsF;YACtF,uFAAuF;YACvF,sFAAsF;YACtF,yFAAyF;YACzF,2EAA2E;YAC3E,OAAO,aAAa,CAAC,KAAK,CAAC,aAAa;SACzC;QACD,SAAS,EAAE,CAAC,UAAU,KAAK,IAAI,CAAC;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;iGAoBiG;AACjG,MAAM,UAAU,+BAA+B,CAAC,KAAa,EAAE,QAAgB,EAAE,KAAe;IAC9F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAC7C,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,gJAAgJ,CAAC,CAAC;IACrM,MAAM,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,CAAC,IAAI,CACV,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAC3C,OAAO,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAChD,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,0BAA0B,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/D,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC;AAsED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAyB;IACjE,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;IAChF,MAAM,IAAI,GAAG,KAAK,IAAqB,EAAE,CACvC,UAAU,CACR,IAAI,CAAC,KAAK,EACV,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,EACvB,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAChC,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE;QAChE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;IAClG,6FAA6F;IAC7F,qFAAqF;IACrF,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,wBAAwB,EAAE,CAC7G,CAAC;IACJ,IAAI,UAAU,GAAG,MAAM,IAAI,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,KAAK,IAAqB,EAAE;QACxC,IAAI,IAAI,CAAC,YAAY,EAAE,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC7E,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;IACF,yFAAyF;IACzF,iEAAiE;IACjE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE;QACjE,KAAK,KAAK,EAAE,CAAC,IAAI,CACf,CAAC,GAAG,EAAE,EAAE,GAAG,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,EAC9B,CAAC,CAAC,EAAE,EAAE;YACJ,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,gCAAiC,CAAW,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,uDAAuD,CAAC,CAAC;YACjJ,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;QAC5B,CAAC,CACF,CAAC;IACJ,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,IAAI,CAAC,wBAAwB,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3E,IAAI,EAAkB,CAAC;IACvB,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,OAAO,CAAC;YACjB,OAAO,EAAE,IAAI,CAAC,MAAM;YACpB,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,aAAa,EAAE,gBAAgB,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC1F,WAAW,EAAE,UAAU,QAAQ,CAAC,EAAE,EAAE;YACpC,+FAA+F;YAC/F,uFAAuF;YACvF,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,EAAE,CAAC;SAC5H,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,OAAO,KAAK,SAAS;YAAE,aAAa,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,CAAC;IACV,CAAC;IACD,IAAI,KAAiC,CAAC;IACtC,IAAI,IAA+B,CAAC;IACpC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,4FAA4F;QAC5F,2EAA2E;QAC3E,MAAM,IAAI,GAAG,EAAE,CAAC,IAA8D,CAAC;QAC/E,IAAI,OAAO,IAAI,EAAE,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YAClE,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC;YACvG,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACjC,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,KAAK,iGAAiG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,gFAAgF,CAAC,CAAC;QACxT,CAAC;QACD,KAAK,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjF,IAAI,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO;QACL,EAAE;QACF,MAAM,EAAE,QAAQ,CAAC,EAAE;QACnB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,IAAI,OAAO,KAAK,SAAS;gBAAE,aAAa,CAAC,OAAO,CAAC,CAAC;YAClD,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnC,CAAC;KACF,CAAC;AACJ,CAAC;AAUD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,IAAmD;IAEnD,MAAM,KAAK,GAAG,qBAAqB,IAAI,CAAC,KAAK,EAAE,CAAC;IAChD,IAAI,MAAiC,CAAC;IACtC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,MAAmC,CAAC;IACxC,MAAM,GAAG,MAAM,mBAAmB,CAAC;QACjC,GAAG,IAAI;QACP,KAAK;QACL,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;QAC/D,sFAAsF;QACtF,4FAA4F;QAC5F,gBAAgB,EAAE,GAAG,EAAE;YACrB,MAAM,GAAG,SAAS,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,yGAAyG,CAAC,CAAC;YAC5H,IAAI,CAAC,MAAM;gBAAE,KAAK,MAAM,EAAE,KAAK,EAAE,CAAC;QACpC,CAAC;KACF,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,MAAM,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,CAAC;IACV,CAAC;IACD,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;YACpC,IAAI,MAAM;gBAAE,MAAM;YAClB,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAClD,MAAM,GAAG,SAAS,CAAC;gBACnB,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,sBAAsB,CAAC,CAAC,IAAI,uDAAuD,CAAC,CAAC;YACxG,CAAC;iBAAM,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAClC,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;oBACnD,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,kDAAkD,CAAC,CAAC;gBACvE,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,GAAG,SAAS,CAAC;oBACnB,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,gCAAiC,CAAW,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC;gBACjH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,OAAO;QACL,OAAO,EAAE,GAAG,EAAE;YACZ,IAAI,MAAM,KAAK,SAAS;gBACtB,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,+KAA+K,CAAC,CAAC;YAC5N,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,GAAG,IAAI,CAAC;YACd,MAAM,GAAG,SAAS,CAAC,CAAC,oEAAoE;YACxF,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -8,10 +8,10 @@ export { calloutPermissions, type AclResolver } from "./permissions.js";
 export { USER_AUTH_TRUST_SCHEME, userAuthTrustFingerprint, validateRetainedManagedAgent, } from "./continuity.js";
 export { AUTH_PROVIDER_NAME, authCalloutKey, authIssuerKey, authOwnerSecretKey, authServiceKeysKey, clearAuthServiceInfo, ensureCalloutAuth, ensureIssuer, ensureOwnerSecret, ensurePinnedIdp, loadAuthServiceInfo, loadCalloutAuth, loadIssuer, loadOwnerSecret, loadPinnedIdp, loadServiceKeys, saveAuthServiceInfo, saveServiceKeys, spaceIssuer, type AuthServiceInfo, type PinnedIdp, type ServiceKeys, } from "./store.js";
 export { actorLedgerDir, managedActorLedgerDir, findInteractiveActor, findManagedActor, findActorUnified, grantActor, grantManagedActor, ledgerAclResolver, ledgerAuthorizeConnect, ledgerAuthorizeGrant, ledgerAuthorizeAgentExchange, ledgerRowFilename, loadActorLedger, revokeActor, revokeManagedActor, newActorToken, hashActorToken, AGENT_BEARER_TTL_SEC, type ActorKind, type ActorRow, } from "./ledger.js";
-export { runAuthService, openAuthAuthorityPlane, dispatchManagerAuthorityRequest, JWKS_MAX_AGE_SEC, INTERACTIVE_RETIRE_PATH, MANAGED_RETIRE_PATH, VERIFY_ENROLLMENT_PATH, composeUserBundle, finalizeUserBundleEndpoint, checkAdvertisedServer, checkAgentProvisioningUrl, type AuthAuthorityPlane } from "./service.js";
+export { runAuthService, startAuthService, type AuthServiceHandle, openAuthAuthorityPlane, dispatchManagerAuthorityRequest, handleManagerServiceAuthority, JWKS_MAX_AGE_SEC, INTERACTIVE_RETIRE_PATH, MANAGED_RETIRE_PATH, VERIFY_ENROLLMENT_PATH, composeUserBundle, finalizeUserBundleEndpoint, checkAdvertisedServer, checkAgentProvisioningUrl, type AuthAuthorityPlane } from "./service.js";
 export { remoteManagerIssuerGrants } from "./authority-client.js";
 export { authConnectReaderGrants, openConnectReader, authorizeConnectCredential, type ConnectReader, } from "./connect-reader.js";
-export { issueRemoteManagerAuthority, parseRemoteManagerAuthorityRequest, type IssueRemoteManagerAuthorityArgs } from "./manager-authority.js";
+export { admitRemoteRun, authorizeRemoteRunAttempt, parseRemoteRunAttemptRequest, type RemoteRunAttemptGrant, parseRemoteRunAdmissionRequest, authorizeRemoteManagerRenewal, issueRemoteManagerAuthority, parseRemoteManagerAuthorityRequest, type IssueRemoteManagerAuthorityArgs } from "./manager-authority.js";
 export { parseRemoteManagerMaintenanceRequest, authorizeRemoteManagerMaintenance, completeRemoteManagerMaintenance } from "./manager-maintenance.js";
 export { parseRemoteRetainedAgentValidationRequest, authorizeRemoteRetainedAgentValidation, completeRemoteRetainedAgentValidation, remoteManagerCurrentRegistrationProof, type AuthorizeRemoteRetainedAgentValidationArgs, } from "./retained-manager-validation.js";
 export { parseRemoteManagerAdminAuthorizationRequest, authorizeRemoteManagerAdmin } from "./manager-admin-authorization.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,WAAW,EAChB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,oBAAoB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,GAC3B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,UAAU,EACf,KAAK,oBAAoB,EACzB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,eAAe,EACf,cAAc,EACd,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,SAAS,GACf,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAE,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,UAAU,EACV,eAAe,EACf,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,WAAW,EACX,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,WAAW,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,oBAAoB,EACpB,4BAA4B,EAC5B,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,oBAAoB,EACpB,KAAK,SAAS,EACd,KAAK,QAAQ,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,+BAA+B,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACzT,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAKlE,OAAO,EACL,uBAAuB,EAAE,iBAAiB,EAAE,0BAA0B,EACtE,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,2BAA2B,EAAE,kCAAkC,EAAE,KAAK,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AAC/I,OAAO,EAAE,oCAAoC,EAAE,iCAAiC,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AACrJ,OAAO,EACL,yCAAyC,EACzC,sCAAsC,EACtC,qCAAqC,EACrC,qCAAqC,EACrC,KAAK,0CAA0C,GAChD,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,2CAA2C,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC5H,OAAO,EACL,qCAAqC,EACrC,4CAA4C,EAC5C,KAAK,yCAAyC,EAC9C,KAAK,gDAAgD,EACrD,KAAK,kBAAkB,GACxB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,eAAe,CAAC;AAIvB,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,sBAAsB,EAAE,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,KAAK,gBAAgB,EAAE,KAAK,eAAe,EAAE,KAAK,aAAa,EAAE,KAAK,eAAe,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAQjQ,OAAO,EACL,qBAAqB,EAAE,0BAA0B,EACjD,0BAA0B,EAAE,2BAA2B,EACvD,KAAK,iBAAiB,EAAE,KAAK,sBAAsB,EAAE,KAAK,gBAAgB,EAAE,KAAK,SAAS,GAC3F,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,WAAW,EAChB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,oBAAoB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,GAC3B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,UAAU,EACf,KAAK,oBAAoB,EACzB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,eAAe,EACf,cAAc,EACd,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,SAAS,GACf,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAE,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,UAAU,EACV,eAAe,EACf,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,WAAW,EACX,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,WAAW,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,oBAAoB,EACpB,4BAA4B,EAC5B,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,oBAAoB,EACpB,KAAK,SAAS,EACd,KAAK,QAAQ,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,KAAK,iBAAiB,EAAE,sBAAsB,EAAE,+BAA+B,EAAE,6BAA6B,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClY,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAKlE,OAAO,EACL,uBAAuB,EAAE,iBAAiB,EAAE,0BAA0B,EACtE,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,yBAAyB,EAAE,4BAA4B,EAAE,KAAK,qBAAqB,EAAE,8BAA8B,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,kCAAkC,EAAE,KAAK,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AACnT,OAAO,EAAE,oCAAoC,EAAE,iCAAiC,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AACrJ,OAAO,EACL,yCAAyC,EACzC,sCAAsC,EACtC,qCAAqC,EACrC,qCAAqC,EACrC,KAAK,0CAA0C,GAChD,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,2CAA2C,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC5H,OAAO,EACL,qCAAqC,EACrC,4CAA4C,EAC5C,KAAK,yCAAyC,EAC9C,KAAK,gDAAgD,EACrD,KAAK,kBAAkB,GACxB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,eAAe,CAAC;AAIvB,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,sBAAsB,EAAE,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,KAAK,gBAAgB,EAAE,KAAK,eAAe,EAAE,KAAK,aAAa,EAAE,KAAK,eAAe,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAQjQ,OAAO,EACL,qBAAqB,EAAE,0BAA0B,EACjD,0BAA0B,EAAE,2BAA2B,EACvD,KAAK,iBAAiB,EAAE,KAAK,sBAAsB,EAAE,KAAK,gBAAgB,EAAE,KAAK,SAAS,GAC3F,MAAM,yBAAyB,CAAC"}

package/dist/index.js

@@ -8,14 +8,14 @@ export { calloutPermissions } from "./permissions.js";
 export { USER_AUTH_TRUST_SCHEME, userAuthTrustFingerprint, validateRetainedManagedAgent, } from "./continuity.js";
 export { AUTH_PROVIDER_NAME, authCalloutKey, authIssuerKey, authOwnerSecretKey, authServiceKeysKey, clearAuthServiceInfo, ensureCalloutAuth, ensureIssuer, ensureOwnerSecret, ensurePinnedIdp, loadAuthServiceInfo, loadCalloutAuth, loadIssuer, loadOwnerSecret, loadPinnedIdp, loadServiceKeys, saveAuthServiceInfo, saveServiceKeys, spaceIssuer, } from "./store.js";
 export { actorLedgerDir, managedActorLedgerDir, findInteractiveActor, findManagedActor, findActorUnified, grantActor, grantManagedActor, ledgerAclResolver, ledgerAuthorizeConnect, ledgerAuthorizeGrant, ledgerAuthorizeAgentExchange, ledgerRowFilename, loadActorLedger, revokeActor, revokeManagedActor, newActorToken, hashActorToken, AGENT_BEARER_TTL_SEC, } from "./ledger.js";
-export { runAuthService, openAuthAuthorityPlane, dispatchManagerAuthorityRequest, JWKS_MAX_AGE_SEC, INTERACTIVE_RETIRE_PATH, MANAGED_RETIRE_PATH, VERIFY_ENROLLMENT_PATH, composeUserBundle, finalizeUserBundleEndpoint, checkAdvertisedServer, checkAgentProvisioningUrl } from "./service.js";
+export { runAuthService, startAuthService, openAuthAuthorityPlane, dispatchManagerAuthorityRequest, handleManagerServiceAuthority, JWKS_MAX_AGE_SEC, INTERACTIVE_RETIRE_PATH, MANAGED_RETIRE_PATH, VERIFY_ENROLLMENT_PATH, composeUserBundle, finalizeUserBundleEndpoint, checkAdvertisedServer, checkAgentProvisioningUrl } from "./service.js";
 export { remoteManagerIssuerGrants } from "./authority-client.js";
 // The R1 connect-arm deny-new READ seam (SPEC 13.1): the reader grant builder, the sealed
 // shape-proved reader, and the pure connect-credential check the production composition runs.
 // The WRITE side (authority-client, root-credential, activateLifecycleAtUid) stays
 // package-internal — the sealed plane is its only production door; smokes import the modules.
 export { authConnectReaderGrants, openConnectReader, authorizeConnectCredential, } from "./connect-reader.js";
-export { issueRemoteManagerAuthority, parseRemoteManagerAuthorityRequest } from "./manager-authority.js";
+export { admitRemoteRun, authorizeRemoteRunAttempt, parseRemoteRunAttemptRequest, parseRemoteRunAdmissionRequest, authorizeRemoteManagerRenewal, issueRemoteManagerAuthority, parseRemoteManagerAuthorityRequest } from "./manager-authority.js";
 export { parseRemoteManagerMaintenanceRequest, authorizeRemoteManagerMaintenance, completeRemoteManagerMaintenance } from "./manager-maintenance.js";
 export { parseRemoteRetainedAgentValidationRequest, authorizeRemoteRetainedAgentValidation, completeRemoteRetainedAgentValidation, remoteManagerCurrentRegistrationProof, } from "./retained-manager-validation.js";
 export { parseRemoteManagerAdminAuthorizationRequest, authorizeRemoteManagerAdmin } from "./manager-admin-authorization.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,GAMjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,mBAAmB,GAKpB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,GAMnB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,eAAe,EACf,cAAc,GAMf,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,YAAY,GAIb,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAoB,MAAM,kBAAkB,CAAC;AACxE,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,UAAU,EACV,eAAe,EACf,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,WAAW,GAIZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,oBAAoB,EACpB,4BAA4B,EAC5B,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,oBAAoB,GAGrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,+BAA+B,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,yBAAyB,EAA2B,MAAM,cAAc,CAAC;AACzT,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,0FAA0F;AAC1F,8FAA8F;AAC9F,mFAAmF;AACnF,8FAA8F;AAC9F,OAAO,EACL,uBAAuB,EAAE,iBAAiB,EAAE,0BAA0B,GAEvE,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,2BAA2B,EAAE,kCAAkC,EAAwC,MAAM,wBAAwB,CAAC;AAC/I,OAAO,EAAE,oCAAoC,EAAE,iCAAiC,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AACrJ,OAAO,EACL,yCAAyC,EACzC,sCAAsC,EACtC,qCAAqC,EACrC,qCAAqC,GAEtC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,2CAA2C,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC5H,OAAO,EACL,qCAAqC,EACrC,4CAA4C,GAI7C,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC,CAAC,+CAA+C;AAClG,OAAO,eAAe,CAAC,CAAC,sFAAsF;AAC9G,qFAAqF;AACrF,2FAA2F;AAC3F,oDAAoD;AACpD,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,sBAAsB,EAAE,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAA6G,MAAM,qBAAqB,CAAC;AACjQ,6FAA6F;AAC7F,sFAAsF;AACtF,6FAA6F;AAC7F,uFAAuF;AACvF,4FAA4F;AAC5F,qFAAqF;AACrF,8DAA8D;AAC9D,OAAO,EACL,qBAAqB,EAAE,0BAA0B,EACjD,0BAA0B,EAAE,2BAA2B,GAExD,MAAM,yBAAyB,CAAC;AACjC,wFAAwF;AACxF,uFAAuF;AACvF,4FAA4F;AAC5F,yFAAyF;AACzF,iGAAiG;AACjG,4FAA4F;AAC5F,0FAA0F;AAC1F,yFAAyF;AACzF,wFAAwF;AACxF,WAAW"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,GAMjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,mBAAmB,GAKpB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,GAMnB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,eAAe,EACf,cAAc,GAMf,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,YAAY,GAIb,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAoB,MAAM,kBAAkB,CAAC;AACxE,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,UAAU,EACV,eAAe,EACf,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,WAAW,GAIZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,oBAAoB,EACpB,4BAA4B,EAC5B,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,oBAAoB,GAGrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAA0B,sBAAsB,EAAE,+BAA+B,EAAE,6BAA6B,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,yBAAyB,EAA2B,MAAM,cAAc,CAAC;AAClY,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,0FAA0F;AAC1F,8FAA8F;AAC9F,mFAAmF;AACnF,8FAA8F;AAC9F,OAAO,EACL,uBAAuB,EAAE,iBAAiB,EAAE,0BAA0B,GAEvE,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,yBAAyB,EAAE,4BAA4B,EAA8B,8BAA8B,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,kCAAkC,EAAwC,MAAM,wBAAwB,CAAC;AACnT,OAAO,EAAE,oCAAoC,EAAE,iCAAiC,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AACrJ,OAAO,EACL,yCAAyC,EACzC,sCAAsC,EACtC,qCAAqC,EACrC,qCAAqC,GAEtC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,2CAA2C,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC5H,OAAO,EACL,qCAAqC,EACrC,4CAA4C,GAI7C,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC,CAAC,+CAA+C;AAClG,OAAO,eAAe,CAAC,CAAC,sFAAsF;AAC9G,qFAAqF;AACrF,2FAA2F;AAC3F,oDAAoD;AACpD,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,sBAAsB,EAAE,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAA6G,MAAM,qBAAqB,CAAC;AACjQ,6FAA6F;AAC7F,sFAAsF;AACtF,6FAA6F;AAC7F,uFAAuF;AACvF,4FAA4F;AAC5F,qFAAqF;AACrF,8DAA8D;AAC9D,OAAO,EACL,qBAAqB,EAAE,0BAA0B,EACjD,0BAA0B,EAAE,2BAA2B,GAExD,MAAM,yBAAyB,CAAC;AACjC,wFAAwF;AACxF,uFAAuF;AACvF,4FAA4F;AAC5F,yFAAyF;AACzF,iGAAiG;AACjG,4FAA4F;AAC5F,0FAA0F;AAC1F,yFAAyF;AACzF,wFAAwF;AACxF,WAAW"}

package/dist/manager-authority.d.ts

@@ -1,4 +1,28 @@
-import { remoteManagerActors, type RemoteManagerAuthorityMaterial, type RemoteManagerAuthorityRequest } from "@cotal-ai/core";
+import { remoteManagerActors, type RemoteManagerAuthorityMaterial, type RemoteManagerAuthorityRequest, type RemoteRunAdmissionRequest, type RemoteRunAttemptRequest, type RunAdmissionView, type RunStatusValue, type RunDriverGrantArgs, type RunOperatorGrantArgs, type RemoteRunAdmissionResult, type IssuedStore, type IssuedSourceRef } from "@cotal-ai/core";
+import type { KV } from "@nats-io/kv";
+/** Host-only renewal authorization. The embedding host supplies a fresh gate and active run
+ * observation from its authoritative stores, never coordinates asserted by the participant. */
+export declare function authorizeRemoteManagerRenewal(args: {
+    request: RemoteManagerAuthorityRequest;
+    owner: string;
+    space: string;
+    accountPublicKey: string;
+    proofSecret: string | Uint8Array;
+    observeManagerGate: (instanceId: string) => Promise<{
+        state: "open" | "frozen" | "retired";
+        principal: string;
+        processEpoch: number;
+        registrationRevision: number;
+    } | null>;
+    observeRun: (runId: string) => Promise<{
+        state: string;
+        holder: string;
+        takeoverId: string;
+        epoch: number;
+        fencingToken: number;
+        instanceId: string;
+    } | null>;
+}): Promise<void>;
 /** Host-only typed request after the IdP proof and ledger row have been authenticated. */
 export interface IssueRemoteManagerAuthorityArgs {
     request: RemoteManagerAuthorityRequest;
@@ -14,10 +38,87 @@ export interface IssueRemoteManagerAuthorityArgs {
         credentials: RemoteManagerAuthorityMaterial["credentials"];
         nextRegistrationProof?: string;
     }>;
+    /** The host must fresh-read the assigned account, manager gate and, for a run, activated
+     * journal attempt before signing. No callback means the renewal operation is unavailable. */
+    authorizeRenewal?: (args: {
+        owner: string;
+        request: RemoteManagerAuthorityRequest;
+    }) => Promise<void>;
     now?: () => number;
 }
 /** Closed request parser: unknown fields and profile-like extensions are refused, never ignored. */
 export declare function parseRemoteManagerAuthorityRequest(raw: unknown): RemoteManagerAuthorityRequest;
 /** Issue one lifecycle phase after the IdP proof and interactive row were fresh-read. */
 export declare function issueRemoteManagerAuthority(args: IssueRemoteManagerAuthorityArgs): Promise<RemoteManagerAuthorityMaterial>;
+type ManagerGate = {
+    state: "open" | "frozen" | "retired";
+    principal: string;
+    processEpoch: number;
+    registrationRevision: number;
+};
+/** Closed parser for {@link RemoteRunAdmissionRequest}: unknown fields refuse, never ignored. */
+export declare function parseRemoteRunAdmissionRequest(raw: unknown): RemoteRunAdmissionRequest;
+/**
+ * Host-side first-run admission for a registered signerless manager. The manager is trusted only to
+ * forward the `ep.v1` request subject it served (delegation to the registered host, not a proof of
+ * an arbitrary message). Everything else is derived here: the caller and generation come from the
+ * subject, the evidence and live sources from the issued store, the ceiling from that evidence.
+ * Every refusal happens before the create; an exact retry returns the admission already written.
+ */
+export declare function admitRemoteRun(args: {
+    request: unknown;
+    owner: string;
+    space: string;
+    accountPublicKey: string;
+    proofSecret: string | Uint8Array;
+    endpoint: string;
+    observeManagerGate: (instanceId: string) => Promise<ManagerGate | null>;
+    issued: IssuedStore;
+    sourceIsLive: (source: IssuedSourceRef) => Promise<boolean>;
+    admissions: KV;
+    now?: () => number;
+}): Promise<RemoteRunAdmissionResult>;
+/** Closed parser for {@link RemoteRunAttemptRequest}. */
+export declare function parseRemoteRunAttemptRequest(raw: unknown): RemoteRunAttemptRequest;
+/** What the host then signs, and nothing else: one fixed profile per caller-held nkey. */
+export type RemoteRunAttemptGrant = {
+    kind: "attempt";
+    driver: {
+        id: string;
+        profile: "run-driver";
+        runDriver: RunDriverGrantArgs;
+    };
+    mediator: {
+        id: string;
+        profile: "run-mediator";
+        runMediator: RunDriverGrantArgs;
+    };
+} | {
+    kind: "operator";
+    operator: {
+        id: string;
+        profile: "run-operator";
+        runOperator: RunOperatorGrantArgs;
+    };
+};
+/**
+ * Host-only authorization for {@link RemoteRunAttemptRequest}. Every coordinate the returned grant
+ * pins is derived from host stores: the admission must exist unrevoked on this instance, the
+ * attempt must be exactly the next epoch/fencing token the run record implies (1/1 for a first
+ * attempt with no record, as stock `start` launches), and an answer must name a waiting pause.
+ * Refuses before the host signs anything.
+ */
+export declare function authorizeRemoteRunAttempt(args: {
+    request: unknown;
+    owner: string;
+    space: string;
+    accountPublicKey: string;
+    proofSecret: string | Uint8Array;
+    endpoint: string;
+    observeManagerGate: (instanceId: string) => Promise<ManagerGate | null>;
+    readAdmission: (runId: string) => Promise<RunAdmissionView>;
+    readRunStatus: (runId: string) => Promise<RunStatusValue | undefined>;
+    checkpointWaiting: (token: string) => Promise<boolean>;
+}): Promise<RemoteRunAttemptGrant>;
+export {};
 //# sourceMappingURL=manager-authority.d.ts.map

package/dist/manager-authority.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manager-authority.d.ts","sourceRoot":"","sources":["../src/manager-authority.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,mBAAmB,EACnB,KAAK,8BAA8B,EACnC,KAAK,6BAA6B,EACnC,MAAM,gBAAgB,CAAC;AAExB,0FAA0F;AAC1F,MAAM,WAAW,+BAA+B;IAC9C,OAAO,EAAE,6BAA6B,CAAC;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;mEAC+D;IAC/D,KAAK,EAAE,CAAC,IAAI,EAAE;QACZ,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC;QAC/C,OAAO,EAAE,6BAA6B,CAAC;KACxC,KAAK,OAAO,CAAC;QAAE,WAAW,EAAE,8BAA8B,CAAC,aAAa,CAAC,CAAC;QAAC,qBAAqB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9G,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAMD,oGAAoG;AACpG,wBAAgB,kCAAkC,CAAC,GAAG,EAAE,OAAO,GAAG,6BAA6B,CAmF9F;AAED,yFAAyF;AACzF,wBAAsB,2BAA2B,CAAC,IAAI,EAAE,+BAA+B,GAAG,OAAO,CAAC,8BAA8B,CAAC,CA8ChI"}
+{"version":3,"file":"manager-authority.d.ts","sourceRoot":"","sources":["../src/manager-authority.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,mBAAmB,EACnB,KAAK,8BAA8B,EACnC,KAAK,6BAA6B,EAClC,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAE7B,KAAK,WAAW,EAChB,KAAK,eAAe,EAQrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAItC;+FAC+F;AAC/F,wBAAsB,6BAA6B,CAAC,IAAI,EAAE;IACxD,OAAO,EAAE,6BAA6B,CAAC;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,UAAU,CAAC;IACjC,kBAAkB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;QAClD,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,oBAAoB,EAAE,MAAM,CAAC;KAC7G,GAAG,IAAI,CAAC,CAAC;IACV,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;QACrC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;KAC5G,GAAG,IAAI,CAAC,CAAC;CACX,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBhB;AAED,0FAA0F;AAC1F,MAAM,WAAW,+BAA+B;IAC9C,OAAO,EAAE,6BAA6B,CAAC;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;mEAC+D;IAC/D,KAAK,EAAE,CAAC,IAAI,EAAE;QACZ,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC;QAC/C,OAAO,EAAE,6BAA6B,CAAC;KACxC,KAAK,OAAO,CAAC;QAAE,WAAW,EAAE,8BAA8B,CAAC,aAAa,CAAC,CAAC;QAAC,qBAAqB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9G;iGAC6F;IAC7F,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,6BAA6B,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtG,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAMD,oGAAoG;AACpG,wBAAgB,kCAAkC,CAAC,GAAG,EAAE,OAAO,GAAG,6BAA6B,CA6G9F;AAED,yFAAyF;AACzF,wBAAsB,2BAA2B,CAAC,IAAI,EAAE,+BAA+B,GAAG,OAAO,CAAC,8BAA8B,CAAC,CA6DhI;AAED,KAAK,WAAW,GAAG;IAAE,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,oBAAoB,EAAE,MAAM,CAAA;CAAE,CAAC;AAMnI,iGAAiG;AACjG,wBAAgB,8BAA8B,CAAC,GAAG,EAAE,OAAO,GAAG,yBAAyB,CA+BtF;AAuBD;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,UAAU,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACxE,MAAM,EAAE,WAAW,CAAC;IACpB,YAAY,EAAE,CAAC,MAAM,EAAE,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5D,UAAU,EAAE,EAAE,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAoCpC;AAKD,yDAAyD;AACzD,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,OAAO,GAAG,uBAAuB,CAkClF;AAED,0FAA0F;AAC1F,MAAM,MAAM,qBAAqB,GAC7B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,YAAY,CAAC;QAAC,SAAS,EAAE,kBAAkB,CAAA;KAAE,CAAC;IAAC,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,cAAc,CAAC;QAAC,WAAW,EAAE,kBAAkB,CAAA;KAAE,CAAA;CAAE,GACrL;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,cAAc,CAAC;QAAC,WAAW,EAAE,oBAAoB,CAAA;KAAE,CAAA;CAAE,CAAC;AAE/G;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAAC,IAAI,EAAE;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,UAAU,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACxE,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC5D,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACtE,iBAAiB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACxD,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA4BjC"}