@cotal-ai/auth 0.58.0 → 0.59.0

package/dist/session-redemption.d.ts

@@ -0,0 +1,51 @@
+/**
+ * #2312: the identity plane's decision for a user-mode session redemption.
+ *
+ * On a user-auth mesh the CLI holds no seed, so it cannot mint the per-session `session-caller`
+ * credential the static arm signs locally. Instead it presents its bearer identity together with the
+ * session grant, and THIS module decides whether that principal may hold that one session. The
+ * manager signs grants with an in-memory key the auth plane never sees, so the verifiable artifact is
+ * the durable `session.<sessionId>` row the manager's redemption wrote (create-only CAS, then
+ * finalized `active`), read leader-served from the dedicated sessions store. The grant's signature
+ * must equal the row's `grantSig`, so a forged or altered grant that reuses a session id refuses.
+ *
+ * Run at the exchange (before a bearer is signed) and again at the callout mint (before the broker
+ * credential exists), so a session that ends or a manager that restarts in between still refuses.
+ */
+import type { JetStreamManager } from "@nats-io/jetstream";
+import type { UserTokenSession } from "./token.js";
+/** What the verifier reads: the leader-served session row, and the serving manager's current gate. */
+export interface SessionRedemptionReads {
+    jsm: JetStreamManager;
+    space: string;
+    /** The serving manager gate's verdict for (owner, instanceId) and its current process epoch. */
+    managerGate: (owner: string, instanceId: string) => Promise<{
+        verdict: string;
+        processEpoch?: number;
+    }>;
+}
+/**
+ * Decide whether `principal` (owner + actor + lifecycleUid from a validated bearer) may hold the
+ * session named by `claim`. `grantSig` is present at the exchange (the presented grant) and absent at
+ * the callout, which re-checks the same row by its coordinates. Returns the session claim to stamp,
+ * with the expiry taken from the ROW (unix seconds), never from the caller. THROWS to refuse.
+ */
+export declare function verifySessionRedemption(r: SessionRedemptionReads, principal: {
+    owner: string;
+    actor: string;
+    lifecycleUid?: string;
+}, claim: {
+    endpoint: string;
+    sessionId: string;
+    epoch: number;
+    grantSig?: string;
+}, now?: number): Promise<UserTokenSession>;
+/** The grant fields the exchange reads. The grant is never trusted for anything the row does not
+ *  confirm: only its coordinates select the row, and its signature must equal the row's. */
+export declare function grantCoordinates(raw: unknown): {
+    endpoint: string;
+    sessionId: string;
+    epoch: number;
+    grantSig: string;
+};
+//# sourceMappingURL=session-redemption.d.ts.map

package/dist/session-redemption.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-redemption.d.ts","sourceRoot":"","sources":["../src/session-redemption.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,sGAAsG;AACtG,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,gBAAgB,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,gGAAgG;IAChG,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzG;AA8BD;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,CAAC,EAAE,sBAAsB,EACzB,SAAS,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,EAClE,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,EAChF,GAAG,GAAE,MAAmB,GACvB,OAAO,CAAC,gBAAgB,CAAC,CAc3B;AAED;4FAC4F;AAC5F,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAMvH"}

package/dist/session-redemption.js

@@ -0,0 +1,61 @@
+import { EpEnvelopeError, sessionLedgerKey, sessionsBucket } from "@cotal-ai/core";
+const deny = (why) => {
+    throw new EpEnvelopeError("permission-denied", `session redemption refused: ${why}`);
+};
+async function readRow(r, sessionId) {
+    const bucket = sessionsBucket(r.space);
+    let m;
+    try {
+        m = await r.jsm.streams.getMessage(`KV_${bucket}`, { last_by_subj: `$KV.${bucket}.${sessionLedgerKey(sessionId)}` });
+    }
+    catch (e) {
+        if (e.code === 10037)
+            deny(`no session row for ${sessionId}`);
+        throw e;
+    }
+    if (!m)
+        deny(`no session row for ${sessionId}`);
+    if (m.header?.get("KV-Operation"))
+        deny(`the session row for ${sessionId} is deleted`);
+    return JSON.parse(new TextDecoder().decode(m.data));
+}
+/**
+ * Decide whether `principal` (owner + actor + lifecycleUid from a validated bearer) may hold the
+ * session named by `claim`. `grantSig` is present at the exchange (the presented grant) and absent at
+ * the callout, which re-checks the same row by its coordinates. Returns the session claim to stamp,
+ * with the expiry taken from the ROW (unix seconds), never from the caller. THROWS to refuse.
+ */
+export async function verifySessionRedemption(r, principal, claim, now = Date.now()) {
+    const row = await readRow(r, claim.sessionId);
+    if (row.state !== "active")
+        deny(`session ${claim.sessionId} is "${row.state}", not active`);
+    if (claim.grantSig !== undefined && row.grantSig !== claim.grantSig)
+        deny("the presented grant is not the one this session was redeemed with");
+    const holder = `${principal.owner}.${principal.actor}`;
+    if (row.holder.principal !== holder)
+        deny(`session ${claim.sessionId} was issued to ${row.holder.principal}, not ${holder}`);
+    if (principal.lifecycleUid === undefined || row.holder.lifecycleUid !== principal.lifecycleUid)
+        deny("the bearer's lifecycle is not the session holder's");
+    if (row.endpoint !== claim.endpoint)
+        deny(`session ${claim.sessionId} is on endpoint ${row.endpoint}, not ${claim.endpoint}`);
+    if (row.serving.epoch !== claim.epoch)
+        deny(`session ${claim.sessionId} is pinned to serving epoch ${row.serving.epoch}, not ${claim.epoch}`);
+    if (row.exp <= now)
+        deny(`session ${claim.sessionId} expired at ${new Date(row.exp).toISOString()}`);
+    const gate = await r.managerGate(principal.owner, row.serving.instanceId);
+    if (gate.verdict !== "candidate")
+        deny(`the serving manager ${row.serving.instanceId} is ${gate.verdict}`);
+    if (gate.processEpoch !== row.serving.epoch)
+        deny(`the serving manager's epoch is ${String(gate.processEpoch)}, not the session's ${row.serving.epoch}`);
+    return { endpoint: row.endpoint, sessionId: row.sessionId, epoch: row.serving.epoch, exp: Math.floor(row.exp / 1000) };
+}
+/** The grant fields the exchange reads. The grant is never trusted for anything the row does not
+ *  confirm: only its coordinates select the row, and its signature must equal the row's. */
+export function grantCoordinates(raw) {
+    const g = raw;
+    if (!g || typeof g !== "object" || typeof g.sessionId !== "string" || typeof g.endpoint !== "string" ||
+        typeof g.sig !== "string" || typeof g.serving?.epoch !== "number")
+        throw new Error("sessionGrant is not a session grant");
+    return { endpoint: g.endpoint, sessionId: g.sessionId, epoch: g.serving.epoch, grantSig: g.sig };
+}
+//# sourceMappingURL=session-redemption.js.map

package/dist/session-redemption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-redemption.js","sourceRoot":"","sources":["../src/session-redemption.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,cAAc,EAAqB,MAAM,gBAAgB,CAAC;AAqBtG,MAAM,IAAI,GAAG,CAAC,GAAW,EAAS,EAAE;IAClC,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,+BAA+B,GAAG,EAAE,CAAC,CAAC;AACvF,CAAC,CAAC;AAEF,KAAK,UAAU,OAAO,CAAC,CAAyB,EAAE,SAAiB;IACjE,MAAM,MAAM,GAAG,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,CAAC;IACN,IAAI,CAAC;QACH,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,MAAM,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,MAAM,IAAI,gBAAgB,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;IACvH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAK,CAAwB,CAAC,IAAI,KAAK,KAAK;YAAE,IAAI,CAAC,sBAAsB,SAAS,EAAE,CAAC,CAAC;QACtF,MAAM,CAAC,CAAC;IACV,CAAC;IACD,IAAI,CAAC,CAAC;QAAE,IAAI,CAAC,sBAAsB,SAAS,EAAE,CAAC,CAAC;IAChD,IAAI,CAAE,CAAC,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC;QAAE,IAAI,CAAC,uBAAuB,SAAS,aAAa,CAAC,CAAC;IACxF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAE,CAAC,IAAI,CAAC,CAAQ,CAAC;AAC9D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,CAAyB,EACzB,SAAkE,EAClE,KAAgF,EAChF,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,IAAI,CAAC,WAAW,KAAK,CAAC,SAAS,QAAQ,GAAG,CAAC,KAAK,eAAe,CAAC,CAAC;IAC7F,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QAAE,IAAI,CAAC,mEAAmE,CAAC,CAAC;IAC/I,MAAM,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;IACvD,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,MAAM;QAAE,IAAI,CAAC,WAAW,KAAK,CAAC,SAAS,kBAAkB,GAAG,CAAC,MAAM,CAAC,SAAS,SAAS,MAAM,EAAE,CAAC,CAAC;IAC7H,IAAI,SAAS,CAAC,YAAY,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,YAAY;QAAE,IAAI,CAAC,oDAAoD,CAAC,CAAC;IAC3J,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QAAE,IAAI,CAAC,WAAW,KAAK,CAAC,SAAS,mBAAmB,GAAG,CAAC,QAAQ,SAAS,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9H,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;QAAE,IAAI,CAAC,WAAW,KAAK,CAAC,SAAS,+BAA+B,GAAG,CAAC,OAAO,CAAC,KAAK,SAAS,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IAC9I,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG;QAAE,IAAI,CAAC,WAAW,KAAK,CAAC,SAAS,eAAe,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACrG,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1E,IAAI,IAAI,CAAC,OAAO,KAAK,WAAW;QAAE,IAAI,CAAC,uBAAuB,GAAG,CAAC,OAAO,CAAC,UAAU,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3G,IAAI,IAAI,CAAC,YAAY,KAAK,GAAG,CAAC,OAAO,CAAC,KAAK;QAAE,IAAI,CAAC,kCAAkC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,uBAAuB,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IACzJ,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC;AACzH,CAAC;AAED;4FAC4F;AAC5F,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,MAAM,CAAC,GAAG,GAAmC,CAAC;IAC9C,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAChG,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,KAAK,KAAK,QAAQ;QACnE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;AACnG,CAAC"}

package/dist/token.d.ts

@@ -13,18 +13,26 @@ export declare const MAX_TOKEN_TTL_SEC = 900;
  *  instead of `agent`. A closed enum on BOTH the mint and validate side — an unknown view fails
  *  closed, never falls back to a profile. Deliberately NOT a generic `view=<profile>` passthrough:
  *  most profiles are daemon/provisioning surfaces that must never become human-requestable. */
-export declare const USER_TOKEN_VIEWS: readonly ["admin", "purger", "channel-purger", "channel-writer", "deployer", "manager-service", "manager-caller"];
+export declare const USER_TOKEN_VIEWS: readonly ["admin", "purger", "channel-purger", "channel-writer", "deployer", "manager-service", "manager-caller", "session-caller"];
 export type UserTokenView = (typeof USER_TOKEN_VIEWS)[number];
 /** Views the public exchange face will mint (still ledger-gated). Every other
  *  {@link USER_TOKEN_VIEWS} value stays loopback-only. An actor-secret exchange may request
  *  only manager-caller, which narrows its existing command authority to one instance. */
-export declare const PUBLIC_EXCHANGE_VIEWS: readonly ["channel-writer", "channel-purger", "manager-caller"];
+export declare const PUBLIC_EXCHANGE_VIEWS: readonly ["channel-writer", "channel-purger", "manager-caller", "session-caller"];
 /** The ONE central view policy table: which ledger capability each view's exchange requires (and
  *  the callout re-asserts, defense in depth). `admin` = operator authority (god-view read +
  *  destructive space writes); `deployer` is spawn-grade — deploying YOUR OWN team's manifest rides
  *  the same owner-domain model as own-agent stop/attach (the manager still enforces owner equality
  *  at launch, and the view's control grant is the PRIVILEGED tier, never the admin bypass). */
 export declare const VIEW_REQUIRED_SCOPE: Record<UserTokenView, "admin" | "spawn" | "supervise" | undefined>;
+/** The ONE §13.6 session a `session-caller` bearer may open: the rail coordinates plus the grant
+ *  expiry (unix seconds) the minted connection is bound to, exactly what the static arm mints. */
+export interface UserTokenSession {
+    endpoint: string;
+    sessionId: string;
+    epoch: number;
+    exp: number;
+}
 /** The server-authored actor claim. `owner` restates `sub` (cross-checked); `actor` is the
  *  ledger-derived agent-instance id; `parent` is at most ONE spawner audit link; `view` is the
  *  exchange-authorized elevated profile request (absent = the agent profile). */
@@ -48,6 +56,8 @@ export interface UserTokenActor {
     view?: UserTokenView;
     /** The one manager instance a manager-caller bearer may address. */
     managerInstanceId?: string;
+    /** The one session a session-caller bearer may open (#2312). */
+    session?: UserTokenSession;
 }
 /** A fully validated user token, reduced to what the callout needs. */
 export interface ValidatedUserToken {
@@ -72,6 +82,9 @@ export interface ValidatedUserToken {
  *  `cred.<uid>.<credid>` tail grammar; the STATE match is the connect boundary's job). Shared by
  *  the mint side (the issuer, so the mint ↔ validate inverse holds) and this validator. THROWS. */
 export declare function assertCredentialIdClaim(v: unknown): asserts v is string;
+/** Assert a `session` claim is the closed `{endpoint, sessionId, epoch, exp}` shape. Shared by the
+ *  issuer (mint side) and the validator so the inverse holds. THROWS. */
+export declare function assertSessionClaim(v: unknown): asserts v is UserTokenSession;
 export interface ValidateUserTokenOpts {
     /** The pinned verification key path: a `createRemoteJWKSet(new URL(<pinned origin>))` resolver
      *  or a local public key. The token itself NEVER influences where the key comes from. */

package/dist/token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAGvD;4EAC4E;AAC5E,eAAO,MAAM,cAAc,IAAI,CAAC;AAEhC;8CAC8C;AAC9C,eAAO,MAAM,iBAAiB,MAAM,CAAC;AAErC;;;;;;;+FAO+F;AAC/F,eAAO,MAAM,gBAAgB,mHAAoH,CAAC;AAClJ,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D;;yFAEyF;AACzF,eAAO,MAAM,qBAAqB,iEAAqG,CAAC;AAExI;;;;+FAI+F;AAC/F,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,aAAa,EAAE,OAAO,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,CAQlG,CAAC;AAEF;;iFAEiF;AACjF,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,mGAAmG;IACnG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;2EAEuE;IACvE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;kFAI8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4FAA4F;IAC5F,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,oEAAoE;IACpE,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,uEAAuE;AACvE,MAAM,WAAW,kBAAkB;IACjC,4DAA4D;IAC5D,KAAK,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,iCAAiC;IACjC,GAAG,EAAE,cAAc,CAAC;IACpB;6FACyF;IACzF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uDAAuD;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ;iGAC6F;IAC7F,GAAG,EAAE,MAAM,CAAC;CACb;AAMD;;mGAEmG;AACnG,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,IAAI,MAAM,CAGvE;AAED,MAAM,WAAW,qBAAqB;IACpC;6FACyF;IACzF,GAAG,EAAE,eAAe,GAAG,SAAS,CAAC;IACjC,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,uFAAuF;IACvF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;mBAEmB;AACnB,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAsG/G"}
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAGvD;4EAC4E;AAC5E,eAAO,MAAM,cAAc,IAAI,CAAC;AAEhC;8CAC8C;AAC9C,eAAO,MAAM,iBAAiB,MAAM,CAAC;AAErC;;;;;;;+FAO+F;AAC/F,eAAO,MAAM,gBAAgB,qIAAsI,CAAC;AACpK,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D;;yFAEyF;AACzF,eAAO,MAAM,qBAAqB,mFAAuH,CAAC;AAE1J;;;;+FAI+F;AAC/F,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,aAAa,EAAE,OAAO,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,CAWlG,CAAC;AAEF;kGACkG;AAClG,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;iFAEiF;AACjF,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,mGAAmG;IACnG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;2EAEuE;IACvE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;kFAI8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4FAA4F;IAC5F,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,oEAAoE;IACpE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gEAAgE;IAChE,OAAO,CAAC,EAAE,gBAAgB,CAAC;CAC5B;AAED,uEAAuE;AACvE,MAAM,WAAW,kBAAkB;IACjC,4DAA4D;IAC5D,KAAK,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,iCAAiC;IACjC,GAAG,EAAE,cAAc,CAAC;IACpB;6FACyF;IACzF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uDAAuD;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ;iGAC6F;IAC7F,GAAG,EAAE,MAAM,CAAC;CACb;AAMD;;mGAEmG;AACnG,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,IAAI,MAAM,CAGvE;AAED;yEACyE;AACzE,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,IAAI,gBAAgB,CAQ5E;AAED,MAAM,WAAW,qBAAqB;IACpC;6FACyF;IACzF,GAAG,EAAE,eAAe,GAAG,SAAS,CAAC;IACjC,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,uFAAuF;IACvF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;mBAEmB;AACnB,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA4G/G"}

package/dist/token.js

@@ -33,11 +33,11 @@ export const MAX_TOKEN_TTL_SEC = 900;
  *  instead of `agent`. A closed enum on BOTH the mint and validate side — an unknown view fails
  *  closed, never falls back to a profile. Deliberately NOT a generic `view=<profile>` passthrough:
  *  most profiles are daemon/provisioning surfaces that must never become human-requestable. */
-export const USER_TOKEN_VIEWS = ["admin", "purger", "channel-purger", "channel-writer", "deployer", "manager-service", "manager-caller"];
+export const USER_TOKEN_VIEWS = ["admin", "purger", "channel-purger", "channel-writer", "deployer", "manager-service", "manager-caller", "session-caller"];
 /** Views the public exchange face will mint (still ledger-gated). Every other
  *  {@link USER_TOKEN_VIEWS} value stays loopback-only. An actor-secret exchange may request
  *  only manager-caller, which narrows its existing command authority to one instance. */
-export const PUBLIC_EXCHANGE_VIEWS = ["channel-writer", "channel-purger", "manager-caller"];
+export const PUBLIC_EXCHANGE_VIEWS = ["channel-writer", "channel-purger", "manager-caller", "session-caller"];
 /** The ONE central view policy table: which ledger capability each view's exchange requires (and
  *  the callout re-asserts, defense in depth). `admin` = operator authority (god-view read +
  *  destructive space writes); `deployer` is spawn-grade — deploying YOUR OWN team's manifest rides
@@ -51,6 +51,9 @@ export const VIEW_REQUIRED_SCOPE = {
     deployer: "spawn",
     "manager-service": "supervise",
     "manager-caller": undefined, // baseline self calls are allowed; command grants still derive from scope
+    // #2312: no ledger scope. The grant itself is the authority: the auth plane verifies the redeemed
+    // `session.<id>` row names THIS principal as holder, at the exchange and again at the callout mint.
+    "session-caller": undefined,
 };
 /** A KV-safe key segment: the ledger's `cred.` key alphabet. Kept local to the validator (not
  *  imported from the credential ledger) so the trust boundary carries no KV dependency. */
@@ -62,6 +65,23 @@ export function assertCredentialIdClaim(v) {
     if (typeof v !== "string" || v.length === 0 || v.length > 256 || !v.split(".").every((s) => CREDENTIAL_ID_SEGMENT.test(s)))
         throw new Error(`user token: act.credentialId ${JSON.stringify(v)} is not a bounded dotted KV-safe credential id`);
 }
+/** Assert a `session` claim is the closed `{endpoint, sessionId, epoch, exp}` shape. Shared by the
+ *  issuer (mint side) and the validator so the inverse holds. THROWS. */
+export function assertSessionClaim(v) {
+    const o = v;
+    if (!o || typeof o !== "object" || Array.isArray(o))
+        throw new Error("user token: act.session must be an object");
+    for (const k of Object.keys(o))
+        if (!["endpoint", "sessionId", "epoch", "exp"].includes(k))
+            throw new Error(`user token: act.session carries the unknown field "${k}"`);
+    if (typeof o.endpoint !== "string" || !/^[A-Za-z0-9_-]{1,64}$/.test(o.endpoint))
+        throw new Error("user token: act.session.endpoint is not an endpoint token");
+    if (typeof o.sessionId !== "string" || !/^[A-Za-z0-9_-]{22,128}$/.test(o.sessionId))
+        throw new Error("user token: act.session.sessionId is not a session id");
+    for (const k of ["epoch", "exp"])
+        if (typeof o[k] !== "number" || !Number.isSafeInteger(o[k]) || o[k] < 0)
+            throw new Error(`user token: act.session.${k} is not an unsigned integer`);
+}
 /** Validate a user bearer token. Returns the reduced, validated claims or THROWS — there is no
  *  partially-valid result and no fallback (a validation failure at the callout is a denied
  *  connection). */
@@ -139,6 +159,13 @@ export async function validateUserToken(token, opts) {
         throw new Error('user token: view "manager-caller" requires act.managerInstanceId');
     if (act.managerInstanceId !== undefined && act.view !== "manager-caller")
         throw new Error('user token: act.managerInstanceId is valid only with view "manager-caller"');
+    if (act.view === "session-caller" && act.session === undefined)
+        throw new Error('user token: view "session-caller" requires act.session');
+    if (act.session !== undefined) {
+        if (act.view !== "session-caller")
+            throw new Error('user token: act.session is valid only with view "session-caller"');
+        assertSessionClaim(act.session);
+    }
     // Lifecycle claim (SPEC 13.1): grammar-asserted when present. Presence/absence POLICY lives at the
     // connect boundary (ledgerAuthorizeConnect requires it on EVERY bearer, views included) and the
     // mint boundary (the idp bridge and the agent exchange stamp it from the grant row); the validator
@@ -163,7 +190,7 @@ export async function validateUserToken(token, opts) {
         owner,
         space: opts.audience,
         scope,
-        act: { owner: act.owner, actor: act.actor, scope: act.scope, parent: act.parent, lifecycleUid: act.lifecycleUid, credentialId: act.credentialId, view: act.view, managerInstanceId: act.managerInstanceId },
+        act: { owner: act.owner, actor: act.actor, scope: act.scope, parent: act.parent, lifecycleUid: act.lifecycleUid, credentialId: act.credentialId, view: act.view, managerInstanceId: act.managerInstanceId, ...(act.session ? { session: act.session } : {}) },
         credentialId: act.credentialId,
         ver: USER_TOKEN_VER,
         exp: payload.exp,

package/dist/token.js.map

@@ -1 +1 @@
-{"version":3,"file":"token.js","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAExD,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAEtG;4EAC4E;AAC5E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAEhC;8CAC8C;AAC9C,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAErC;;;;;;;+FAO+F;AAC/F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,UAAU,EAAE,iBAAiB,EAAE,gBAAgB,CAAU,CAAC;AAGlJ;;yFAEyF;AACzF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,CAA6C,CAAC;AAExI;;;;+FAI+F;AAC/F,MAAM,CAAC,MAAM,mBAAmB,GAAuE;IACrG,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,OAAO;IACf,gBAAgB,EAAE,OAAO;IACzB,gBAAgB,EAAE,OAAO;IACzB,QAAQ,EAAE,OAAO;IACjB,iBAAiB,EAAE,WAAW;IAC9B,gBAAgB,EAAE,SAAS,EAAE,0EAA0E;CACxG,CAAC;AA+CF;2FAC2F;AAC3F,MAAM,qBAAqB,GAAG,kBAAkB,CAAC;AAEjD;;mGAEmG;AACnG,MAAM,UAAU,uBAAuB,CAAC,CAAU;IAChD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxH,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,gDAAgD,CAAC,CAAC;AACvH,CAAC;AAgBD;;mBAEmB;AACnB,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAa,EAAE,IAA2B;IAChF,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;QAC9G,MAAM,IAAI,KAAK,CAAC,yGAAyG,CAAC,CAAC;IAC7H,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAEzG,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,GAAsB,EAAE;QACtE,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,cAAc,EAAE,IAAI,CAAC,iBAAiB,IAAI,CAAC;KAC5C,CAAC,CAAC;IAEH,8FAA8F;IAC9F,+FAA+F;IAC/F,2DAA2D;IAC3D,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC;QAChI,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IACrG,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IACjH,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACpF,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACpF,+FAA+F;IAC/F,2FAA2F;IAC3F,+FAA+F;IAC/F,8FAA8F;IAC9F,6CAA6C;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,IAAI,iBAAiB,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,IAAI,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,OAAO,CAAC,GAAG,GAAG,GAAG,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACjF,IAAI,OAAO,CAAC,GAAG,GAAG,GAAG,GAAG,MAAM,GAAG,GAAG;QAClC,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,8DAA8D,CAAC,CAAC;IAC5H,IAAI,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,GAAG,MAAM;QACpC,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,iBAAiB,MAAM,qDAAqD,CAAC,CAAC;IAEjJ,IAAI,OAAO,CAAC,GAAG,KAAK,cAAc;QAChC,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,cAAc,qDAAqD,CAAC,CAAC;IAEpI,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IACjI,MAAM,KAAK,GAAG,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEnD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAiC,CAAC;IACtD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACxH,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,4BAA4B,CAAC,CAAC;IACpI,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;IACrI,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QACzG,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,6FAA6F;QAC7F,yFAAyF;QACzF,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;YAChC,MAAM,IAAI,KAAK,CAAC,8FAA8F,CAAC,CAAC;QAClH,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,MAAM,iDAAiD,CAAC,CAAC;QAC1G,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,yBAAyB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,0BAA0B,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B,CAC9H,CAAC;IACJ,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACxC,IAAI,OAAO,GAAG,CAAC,iBAAiB,KAAK,QAAQ;YAC3C,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;QAC3F,oBAAoB,CAAC,GAAG,CAAC,iBAAiB,EAAE,kCAAkC,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS;QACtE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB;QACtE,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,mGAAmG;IACnG,gGAAgG;IAChG,mGAAmG;IACnG,+FAA+F;IAC/F,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACnC,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ;YACtC,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACtF,oBAAoB,CAAC,GAAG,CAAC,YAAY,EAAE,6BAA6B,CAAC,CAAC;IACxE,CAAC;IACD,iGAAiG;IACjG,gGAAgG;IAChG,yFAAyF;IACzF,6FAA6F;IAC7F,0FAA0F;IAC1F,kFAAkF;IAClF,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS;QAAE,uBAAuB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAE9E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/D,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAE1E,OAAO;QACL,KAAK;QACL,KAAK,EAAE,IAAI,CAAC,QAAQ;QACpB,KAAK;QACL,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,EAAE;QAC3M,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,GAAG,EAAE,cAAc;QACnB,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAExD,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAEtG;4EAC4E;AAC5E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAEhC;8CAC8C;AAC9C,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAErC;;;;;;;+FAO+F;AAC/F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,UAAU,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,gBAAgB,CAAU,CAAC;AAGpK;;yFAEyF;AACzF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,CAA6C,CAAC;AAE1J;;;;+FAI+F;AAC/F,MAAM,CAAC,MAAM,mBAAmB,GAAuE;IACrG,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,OAAO;IACf,gBAAgB,EAAE,OAAO;IACzB,gBAAgB,EAAE,OAAO;IACzB,QAAQ,EAAE,OAAO;IACjB,iBAAiB,EAAE,WAAW;IAC9B,gBAAgB,EAAE,SAAS,EAAE,0EAA0E;IACvG,kGAAkG;IAClG,oGAAoG;IACpG,gBAAgB,EAAE,SAAS;CAC5B,CAAC;AA0DF;2FAC2F;AAC3F,MAAM,qBAAqB,GAAG,kBAAkB,CAAC;AAEjD;;mGAEmG;AACnG,MAAM,UAAU,uBAAuB,CAAC,CAAU;IAChD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxH,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,gDAAgD,CAAC,CAAC;AACvH,CAAC;AAED;yEACyE;AACzE,MAAM,UAAU,kBAAkB,CAAC,CAAU;IAC3C,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAClH,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,GAAG,CAAC,CAAC;IACxK,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC9J,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC9J,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAU;QACvC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAK,CAAC,CAAC,CAAC,CAAY,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,6BAA6B,CAAC,CAAC;AACpK,CAAC;AAgBD;;mBAEmB;AACnB,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAa,EAAE,IAA2B;IAChF,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;QAC9G,MAAM,IAAI,KAAK,CAAC,yGAAyG,CAAC,CAAC;IAC7H,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAEzG,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,GAAsB,EAAE;QACtE,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,cAAc,EAAE,IAAI,CAAC,iBAAiB,IAAI,CAAC;KAC5C,CAAC,CAAC;IAEH,8FAA8F;IAC9F,+FAA+F;IAC/F,2DAA2D;IAC3D,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC;QAChI,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IACrG,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IACjH,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACpF,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACpF,+FAA+F;IAC/F,2FAA2F;IAC3F,+FAA+F;IAC/F,8FAA8F;IAC9F,6CAA6C;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,IAAI,iBAAiB,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,IAAI,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,OAAO,CAAC,GAAG,GAAG,GAAG,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACjF,IAAI,OAAO,CAAC,GAAG,GAAG,GAAG,GAAG,MAAM,GAAG,GAAG;QAClC,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,8DAA8D,CAAC,CAAC;IAC5H,IAAI,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,GAAG,MAAM;QACpC,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,iBAAiB,MAAM,qDAAqD,CAAC,CAAC;IAEjJ,IAAI,OAAO,CAAC,GAAG,KAAK,cAAc;QAChC,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,cAAc,qDAAqD,CAAC,CAAC;IAEpI,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IACjI,MAAM,KAAK,GAAG,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEnD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAiC,CAAC;IACtD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACxH,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,4BAA4B,CAAC,CAAC;IACpI,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;IACrI,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QACzG,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,6FAA6F;QAC7F,yFAAyF;QACzF,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;YAChC,MAAM,IAAI,KAAK,CAAC,8FAA8F,CAAC,CAAC;QAClH,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,MAAM,iDAAiD,CAAC,CAAC;QAC1G,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,yBAAyB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,0BAA0B,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B,CAC9H,CAAC;IACJ,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACxC,IAAI,OAAO,GAAG,CAAC,iBAAiB,KAAK,QAAQ;YAC3C,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;QAC3F,oBAAoB,CAAC,GAAG,CAAC,iBAAiB,EAAE,kCAAkC,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS;QACtE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB;QACtE,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;QAC5D,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB;YAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACvH,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IACD,mGAAmG;IACnG,gGAAgG;IAChG,mGAAmG;IACnG,+FAA+F;IAC/F,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACnC,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ;YACtC,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACtF,oBAAoB,CAAC,GAAG,CAAC,YAAY,EAAE,6BAA6B,CAAC,CAAC;IACxE,CAAC;IACD,iGAAiG;IACjG,gGAAgG;IAChG,yFAAyF;IACzF,6FAA6F;IAC7F,0FAA0F;IAC1F,kFAAkF;IAClF,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS;QAAE,uBAAuB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAE9E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/D,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAE1E,OAAO;QACL,KAAK;QACL,KAAK,EAAE,IAAI,CAAC,QAAQ;QACpB,KAAK;QACL,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QAC7P,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,GAAG,EAAE,cAAc;QACnB,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cotal-ai/auth",
   "description": "Cotal per-user auth bridge: opaque owner-token derivation and strict user-token validation for the NATS auth-callout cutover (Plane 1 ↔ Plane 2).",
-  "version": "0.58.0",
+  "version": "0.59.0",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -18,8 +18,8 @@
     }
   },
   "dependencies": {
-    "@cotal-ai/core": "0.58.0",
-    "@cotal-ai/workspace": "0.58.0",
+    "@cotal-ai/core": "0.59.0",
+    "@cotal-ai/workspace": "0.59.0",
     "@nats-io/jwt": "0.0.10-5",
     "@nats-io/nkeys": "^2.0.3",
     "@nats-io/transport-node": "^3.4.0",