@cotal-ai/auth 0.59.0 → 0.60.0

package/dist/service.d.ts

@@ -1,6 +1,7 @@
 import { type IncomingMessage, type ServerResponse } from "node:http";
-import { type ParsedArgs, type RemoteManagerAdminAuthorizationRequest, type RemoteManagerAuthorityRequest, type RemoteManagerMaintenanceRequest, type RemoteRetainedAgentValidationRequest, type SecretStore } from "@cotal-ai/core";
+import { type EpGateState, type ParsedArgs, type PlatformControlAssignment, type PlatformControlAuthorityRequest, type PlatformControlAuthorityResult, type PlatformControlInnerRequest, type RemoteManagerAdminAuthorizationRequest, type RemoteManagerAuthorityRequest, type RemoteManagerMaintenanceRequest, type RemoteRetainedAgentValidationRequest, type SecretStore } from "@cotal-ai/core";
 import { type HostedContextInputs, type HostedServiceHandle, type ManagerInstanceIdentity } from "@cotal-ai/workspace";
+import { type ManagerAuthorityHolder } from "./platform-control.js";
 import { type IdpBridge } from "./idp.js";
 import { type UserTokenSession, type ValidatedUserToken } from "./token.js";
 import { pinnedJwksResolver, type UserTokenIssuer } from "./issuer.js";
@@ -55,19 +56,13 @@ export interface AuthAuthorityPlane {
         alreadyRetired?: boolean;
     }>;
     retireManagedLifecycle: AuthAuthorityPlane["retireInteractiveLifecycle"];
-    issueManagerServiceAuthority: (args: {
-        owner: string;
-        scope: string[];
+    issueManagerServiceAuthority: (args: ManagerAuthorityHolder & {
         request: RemoteManagerAuthorityRequest;
     }) => Promise<import("@cotal-ai/core").RemoteManagerAuthorityMaterial>;
-    maintainRemoteManager: (args: {
-        owner: string;
-        scope: string[];
+    maintainRemoteManager: (args: ManagerAuthorityHolder & {
         request: RemoteManagerMaintenanceRequest;
     }) => Promise<import("@cotal-ai/core").RemoteManagerMaintenanceResult>;
-    validateRetainedAgent: (args: {
-        owner: string;
-        scope: string[];
+    validateRetainedAgent: (args: ManagerAuthorityHolder & {
         request: RemoteRetainedAgentValidationRequest;
     }) => Promise<RemoteRetainedAgentValidationRequest>;
     /** Authorize one host-owned managed-agent enrollment (#1972). The plane reads the manager gate on
@@ -90,33 +85,31 @@ export interface AuthAuthorityPlane {
         owner: string;
         request: import("@cotal-ai/core").RemoteManagedAgentRuntimeRequest;
     }) => Promise<RemoteManagedAgentRuntimeDecision>;
-    scanManagerGoalIndex: (args: {
-        owner: string;
-        scope: string[];
+    scanManagerGoalIndex: (args: ManagerAuthorityHolder & {
         request: import("@cotal-ai/core").RemoteManagerGoalIndexScanRequest;
     }) => Promise<import("@cotal-ai/core").RemoteManagerGoalIndexScanResult>;
-    authorizeManagerAdmin: (args: {
-        owner: string;
-        scope: string[];
+    authorizeManagerAdmin: (args: ManagerAuthorityHolder & {
         request: RemoteManagerAdminAuthorizationRequest;
     }) => Promise<import("@cotal-ai/core").RemoteManagerAdminAuthorizationResult>;
     /** First-run admission for one hosted run-start, asked by a registered signerless manager. The
      *  plane authenticates the registration, resolves the caller's issued generation on its own issuer
      *  connection with live sources, and creates the admission through a run-admitter credential
      *  pinned to that one run. No ceiling, caller or profile is taken from the request. */
-    admitManagerRun: (args: {
-        owner: string;
-        scope: string[];
+    admitManagerRun: (args: ManagerAuthorityHolder & {
         request: unknown;
     }) => Promise<import("@cotal-ai/core").RemoteRunAdmissionResult>;
     /** First-attempt/resume or operator issuance for one hosted run, asked by a registered signerless manager.
      *  The plane authenticates the registration, derives coordinates from native admission/records/checkpoints,
      *  and signs ONLY the returned fixed grant args. JWT responses contain no seeds. */
-    issueManagerRunAttempt: (args: {
-        owner: string;
-        scope: string[];
+    issueManagerRunAttempt: (args: ManagerAuthorityHolder & {
         request: unknown;
     }) => Promise<import("@cotal-ai/core").RemoteRunAttemptResult>;
+    /** Read-only view of one manager instance for the platform control door: whether its
+     *  `svc.manager` record is current, and its gate. It probes, freezes and writes nothing. */
+    observeManagerInstance: (instanceId: string) => Promise<{
+        registered: boolean;
+        gate: EpGateState | null;
+    }>;
     /** Resolves with the state-3 copy when a mid-life scanner death FENCES the plane (SPEC 13.13):
      *  the plane is no longer whole, `authorizeConnect`/`mintConnectCredential` refuse from that
      *  moment, and the composition root must take the whole service DOWN loud (a fenced plane that
@@ -201,6 +194,15 @@ export declare function runAuthService(args: ParsedArgs, store?: SecretStore): P
 export interface AuthServiceHandle extends HostedServiceHandle {
     readonly url: string;
     readonly publicUrl?: string;
+    /** The platform control door (SPEC 13.1). Present only when `platformControl` was supplied to
+     *  {@link startAuthService}. In-process and typed: no route, no capability, and no signer or
+     *  capability in the result. */
+    platformControlAuthority?<R extends PlatformControlInnerRequest>(request: PlatformControlAuthorityRequest<R>): Promise<PlatformControlAuthorityResult<R>>;
+}
+/** The platform composition's input for the platform control door. */
+export interface PlatformControlInput {
+    /** The one current assignment for this account, or null. Read fresh on every door call. */
+    observeAssignment(space: string, accountPublicKey: string): Promise<PlatformControlAssignment | null>;
 }
 /** Start one account-scoped auth-service context. Every input is explicit: the state dir, the
  *  injected store with its proved identity, the assigned data account and the broker. The context
@@ -210,7 +212,16 @@ export interface AuthServiceHandle extends HostedServiceHandle {
  *  mid-life fence or broker loss makes only this context `unavailable` and closes its resources. */
 export declare function startAuthService(inputs: HostedContextInputs & {
     port?: number;
+    /** Present only in a platform composition. Absent: the handle has no platform control door. */
+    platformControl?: PlatformControlInput;
+    /** Trusted-host only. Forwarded unchanged to {@link openAuthAuthorityPlane}, which bounds it to
+     *  5..86400 seconds. Absent: the 24h default. No CLI flag and no request field sets it. */
+    standingRenewableTtlSeconds?: number;
 }): Promise<AuthServiceHandle>;
+/** The HTTP routes authenticate a human, so they only ever supply the human arm. */
+type HumanHolder = Extract<ManagerAuthorityHolder, {
+    scope: string[];
+}>;
 interface HandlerCtx {
     issuer: UserTokenIssuer;
     bridge: IdpBridge;
@@ -220,16 +231,30 @@ interface HandlerCtx {
         key: ReturnType<typeof pinnedJwksResolver>;
     };
     ownerSecret: string | Uint8Array;
-    managerServiceAuthority: AuthAuthorityPlane["issueManagerServiceAuthority"];
-    maintainRemoteManager: AuthAuthorityPlane["maintainRemoteManager"];
-    validateRetainedAgent: AuthAuthorityPlane["validateRetainedAgent"];
+    managerServiceAuthority: (args: HumanHolder & {
+        request: RemoteManagerAuthorityRequest;
+    }) => ReturnType<AuthAuthorityPlane["issueManagerServiceAuthority"]>;
+    maintainRemoteManager: (args: HumanHolder & {
+        request: RemoteManagerMaintenanceRequest;
+    }) => ReturnType<AuthAuthorityPlane["maintainRemoteManager"]>;
+    validateRetainedAgent: (args: HumanHolder & {
+        request: RemoteRetainedAgentValidationRequest;
+    }) => ReturnType<AuthAuthorityPlane["validateRetainedAgent"]>;
     verifyManagedAgentEnrollment: AuthAuthorityPlane["verifyManagedAgentEnrollment"];
     verifyManagedAgentPrepareRetirement: AuthAuthorityPlane["verifyManagedAgentPrepareRetirement"];
     verifyManagedAgentRuntime: AuthAuthorityPlane["verifyManagedAgentRuntime"];
-    scanManagerGoalIndex: AuthAuthorityPlane["scanManagerGoalIndex"];
-    authorizeManagerAdmin: AuthAuthorityPlane["authorizeManagerAdmin"];
-    admitManagerRun: AuthAuthorityPlane["admitManagerRun"];
-    issueManagerRunAttempt: AuthAuthorityPlane["issueManagerRunAttempt"];
+    scanManagerGoalIndex: (args: HumanHolder & {
+        request: import("@cotal-ai/core").RemoteManagerGoalIndexScanRequest;
+    }) => ReturnType<AuthAuthorityPlane["scanManagerGoalIndex"]>;
+    authorizeManagerAdmin: (args: HumanHolder & {
+        request: RemoteManagerAdminAuthorizationRequest;
+    }) => ReturnType<AuthAuthorityPlane["authorizeManagerAdmin"]>;
+    admitManagerRun: (args: HumanHolder & {
+        request: unknown;
+    }) => ReturnType<AuthAuthorityPlane["admitManagerRun"]>;
+    issueManagerRunAttempt: (args: HumanHolder & {
+        request: unknown;
+    }) => ReturnType<AuthAuthorityPlane["issueManagerRunAttempt"]>;
     secrets: SecretStore;
     retireInteractiveLifecycle: AuthAuthorityPlane["retireInteractiveLifecycle"];
     retireManagedLifecycle: AuthAuthorityPlane["retireManagedLifecycle"];

package/dist/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAuDA,OAAO,EAAgB,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAKpF,OAAO,EAA+oC,KAAK,UAAU,EAAE,KAAK,sCAAsC,EAAE,KAAK,6BAA6B,EAAE,KAAK,+BAA+B,EAAE,KAAK,oCAAoC,EAAE,KAAK,WAAW,EAAgE,MAAM,gBAAgB,CAAC;AACh7C,OAAO,EAA4I,KAAK,mBAAmB,EAAyB,KAAK,mBAAmB,EAA2B,KAAK,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAIjT,OAAO,EAAmC,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAC3E,OAAO,EAAyB,KAAK,gBAAgB,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEvH,OAAO,EAAE,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAIvE,OAAO,EAA2K,KAAK,iCAAiC,EAAE,MAAM,+BAA+B,CAAC;AAYhQ,OAAO,EAA4H,KAAK,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACtL,OAAO,EAAkD,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AA6B7G;uDACuD;AACvD,eAAO,MAAM,gBAAgB,MAAM,CAAC;AAEpC,4HAA4H;AAC5H,eAAO,MAAM,uBAAuB,kCAAkC,CAAC;AAEvE;gGACgG;AAChG,eAAO,MAAM,mBAAmB,8BAA8B,CAAC;AAE/D;;8FAE8F;AAC9F,eAAO,MAAM,sBAAsB,iDAAiD,CAAC;AAqBrF;;;+DAG+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,gBAAgB,EAAE,CAAC,CAAC,EAAE,kBAAkB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,qBAAqB,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACzG,qBAAqB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9E,sBAAsB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E;mGAC+F;IAC/F,aAAa,EAAE,CACb,SAAS,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,EAClE,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,KAC7E,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC/B,0BAA0B,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC;QACpG,OAAO,EAAE,OAAO,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,cAAc,CAAC,EAAE,OAAO,CAAC;KAC1B,CAAC,CAAC;IACH,sBAAsB,EAAE,kBAAkB,CAAC,4BAA4B,CAAC,CAAC;IACzE,4BAA4B,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,6BAA6B,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;IACrL,qBAAqB,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,+BAA+B,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;IAChL,qBAAqB,EAAE,CAAC,IAAI,EAAE;QAC5B,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,oCAAoC,CAAC;KAC/C,KAAK,OAAO,CAAC,oCAAoC,CAAC,CAAC;IACpD;;4FAEwF;IACxF,4BAA4B,EAAE,CAAC,IAAI,EAAE;QACnC,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,gBAAgB,EAAE,mCAAmC,CAAC;KACvE,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,mCAAmC,CAAC,CAAC;IAC5E,+FAA+F;IAC/F,mCAAmC,EAAE,CAAC,IAAI,EAAE;QAC1C,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,gBAAgB,EAAE,0CAA0C,CAAC;KAC9E,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,0CAA0C,CAAC,CAAC;IACnF;0FACsF;IACtF,yBAAyB,EAAE,CAAC,IAAI,EAAE;QAChC,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,OAAO,gBAAgB,EAAE,gCAAgC,CAAC;KACpE,KAAK,OAAO,CAAC,iCAAiC,CAAC,CAAC;IACjD,oBAAoB,EAAE,CAAC,IAAI,EAAE;QAC3B,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,gBAAgB,EAAE,iCAAiC,CAAC;KACrE,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,gCAAgC,CAAC,CAAC;IACzE,qBAAqB,EAAE,CAAC,IAAI,EAAE;QAC5B,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,sCAAsC,CAAC;KACjD,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,qCAAqC,CAAC,CAAC;IAC9E;;;2FAGuF;IACvF,eAAe,EAAE,CAAC,IAAI,EAAE;QACtB,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,CAAC;KAClB,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,wBAAwB,CAAC,CAAC;IACjE;;wFAEoF;IACpF,sBAAsB,EAAE,CAAC,IAAI,EAAE;QAC7B,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,CAAC;KAClB,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,sBAAsB,CAAC,CAAC;IAC/D;;;;uBAImB;IACnB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACxB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,KAAK,oBAAoB,GAAG;IAAE,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9G;sGACsG;AACtG,wBAAgB,gCAAgC,CAAC,IAAI,EAAE;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,oBAAoB,GAAG,IAAI,CAAC;CACnC,GAAG,IAAI,CAUP;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,uFAAuF;IACvF,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B;;wEAEoE;IACpE,YAAY,CAAC,EAAE,cAAc,CAAC;IAC9B;;4EAEwE;IACxE,gBAAgB,CAAC,EAAE,mBAAmB,CAAC;IACvC;;iFAE6E;IAC7E,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;QAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,KAAK,IAAI,CAAC;IAChG;;kGAE8F;IAC9F,YAAY,CAAC,EAAE,MAAM,uBAAuB,GAAG,SAAS,CAAC;IACzD,sGAAsG;IACtG,2BAA2B,CAAC,EAAE,MAAM,CAAC;CACtC,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAy7B9B;AA+DD;;;;;;;;;;;sEAWsE;AACtE,wBAAsB,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAsGzF;AAED,oGAAoG;AACpG,MAAM,WAAW,iBAAkB,SAAQ,mBAAmB;IAC5D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;oGAKoG;AACpG,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,mBAAmB,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAqBlH;AA0ND,UAAU,UAAU;IAClB,MAAM,EAAE,eAAe,CAAC;IACxB,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAA;KAAE,CAAC;IAC5F,WAAW,EAAE,MAAM,GAAG,UAAU,CAAC;IACjC,uBAAuB,EAAE,kBAAkB,CAAC,8BAA8B,CAAC,CAAC;IAC5E,qBAAqB,EAAE,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACnE,qBAAqB,EAAE,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACnE,4BAA4B,EAAE,kBAAkB,CAAC,8BAA8B,CAAC,CAAC;IACjF,mCAAmC,EAAE,kBAAkB,CAAC,qCAAqC,CAAC,CAAC;IAC/F,yBAAyB,EAAE,kBAAkB,CAAC,2BAA2B,CAAC,CAAC;IAC3E,oBAAoB,EAAE,kBAAkB,CAAC,sBAAsB,CAAC,CAAC;IACjE,qBAAqB,EAAE,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACnE,eAAe,EAAE,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;IACvD,sBAAsB,EAAE,kBAAkB,CAAC,wBAAwB,CAAC,CAAC;IACrE,OAAO,EAAE,WAAW,CAAC;IACrB,0BAA0B,EAAE,kBAAkB,CAAC,4BAA4B,CAAC,CAAC;IAC7E,sBAAsB,EAAE,kBAAkB,CAAC,wBAAwB,CAAC,CAAC;IACrE,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,GAAG,EAAE,MAAM,CAAC;IACZ;+CAC2C;IAC3C,qBAAqB,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACzG,qBAAqB,EAAE,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACnE,aAAa,EAAE,kBAAkB,CAAC,eAAe,CAAC,CAAC;CACpD;AAED,kGAAkG;AAClG,wBAAsB,+BAA+B,CACnD,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,GAAG,KAAK,GAAG,SAAS,GAAG,yBAAyB,GAAG,uBAAuB,GAAG,uBAAuB,GAAG,sBAAsB,GAAG,uBAAuB,GAAG,iBAAiB,GAAG,wBAAwB,CAAC,EACpO,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GACzB,OAAO,CAAC,OAAO,CAAC,CA4ClB;AAED;;;;4FAI4F;AAC5F,UAAU,cAAc;IACtB,iGAAiG;IACjG,iBAAiB,EAAE,OAAO,CAAC;IAC3B;;uDAEmD;IACnD,WAAW,EAAE,OAAO,CAAC;IACrB;;gEAE4D;IAC5D,qBAAqB,EAAE,OAAO,CAAC;IAC/B,wDAAwD;IACxD,OAAO,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,CAAC;IACtC,kGAAkG;IAClG,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAClD,yEAAyE;IACzE,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACpD;AAmbD;iGACiG;AACjG,wBAAsB,6BAA6B,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBrJ;AAED;;oFAEoF;AACpF,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUrE;AAED;;;;;;sBAMsB;AACtB,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,aAAa,EAAE,MAAM,CAAC;IACtB;;gGAE4F;IAC5F,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmB1B;AAED;;;mDAGmD;AACnD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAInG;AAED;;;cAGc;AACd,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUzE"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAuDA,OAAO,EAAgB,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAKpF,OAAO,EAA6nC,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,KAAK,yBAAyB,EAAE,KAAK,+BAA+B,EAAE,KAAK,8BAA8B,EAAE,KAAK,2BAA2B,EAAE,KAAK,sCAAsC,EAAE,KAAK,6BAA6B,EAAE,KAAK,+BAA+B,EAAE,KAAK,oCAAoC,EAAE,KAAK,WAAW,EAAgE,MAAM,gBAAgB,CAAC;AAC7jD,OAAO,EAA4I,KAAK,mBAAmB,EAAyB,KAAK,mBAAmB,EAA2B,KAAK,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAGjT,OAAO,EAA+D,KAAK,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAEjI,OAAO,EAAmC,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAC3E,OAAO,EAAyB,KAAK,gBAAgB,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEvH,OAAO,EAAE,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAIvE,OAAO,EAA2K,KAAK,iCAAiC,EAAE,MAAM,+BAA+B,CAAC;AAYhQ,OAAO,EAA4H,KAAK,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACtL,OAAO,EAAkD,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AA6B7G;uDACuD;AACvD,eAAO,MAAM,gBAAgB,MAAM,CAAC;AAEpC,4HAA4H;AAC5H,eAAO,MAAM,uBAAuB,kCAAkC,CAAC;AAEvE;gGACgG;AAChG,eAAO,MAAM,mBAAmB,8BAA8B,CAAC;AAE/D;;8FAE8F;AAC9F,eAAO,MAAM,sBAAsB,iDAAiD,CAAC;AAqBrF;;;+DAG+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,gBAAgB,EAAE,CAAC,CAAC,EAAE,kBAAkB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,qBAAqB,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACzG,qBAAqB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9E,sBAAsB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E;mGAC+F;IAC/F,aAAa,EAAE,CACb,SAAS,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,EAClE,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,KAC7E,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC/B,0BAA0B,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC;QACpG,OAAO,EAAE,OAAO,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,cAAc,CAAC,EAAE,OAAO,CAAC;KAC1B,CAAC,CAAC;IACH,sBAAsB,EAAE,kBAAkB,CAAC,4BAA4B,CAAC,CAAC;IACzE,4BAA4B,EAAE,CAAC,IAAI,EAAE,sBAAsB,GAAG;QAAE,OAAO,EAAE,6BAA6B,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;IAC9K,qBAAqB,EAAE,CAAC,IAAI,EAAE,sBAAsB,GAAG;QAAE,OAAO,EAAE,+BAA+B,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;IACzK,qBAAqB,EAAE,CAAC,IAAI,EAAE,sBAAsB,GAAG;QACrD,OAAO,EAAE,oCAAoC,CAAC;KAC/C,KAAK,OAAO,CAAC,oCAAoC,CAAC,CAAC;IACpD;;4FAEwF;IACxF,4BAA4B,EAAE,CAAC,IAAI,EAAE;QACnC,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,gBAAgB,EAAE,mCAAmC,CAAC;KACvE,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,mCAAmC,CAAC,CAAC;IAC5E,+FAA+F;IAC/F,mCAAmC,EAAE,CAAC,IAAI,EAAE;QAC1C,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,gBAAgB,EAAE,0CAA0C,CAAC;KAC9E,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,0CAA0C,CAAC,CAAC;IACnF;0FACsF;IACtF,yBAAyB,EAAE,CAAC,IAAI,EAAE;QAChC,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,OAAO,gBAAgB,EAAE,gCAAgC,CAAC;KACpE,KAAK,OAAO,CAAC,iCAAiC,CAAC,CAAC;IACjD,oBAAoB,EAAE,CAAC,IAAI,EAAE,sBAAsB,GAAG;QACpD,OAAO,EAAE,OAAO,gBAAgB,EAAE,iCAAiC,CAAC;KACrE,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,gCAAgC,CAAC,CAAC;IACzE,qBAAqB,EAAE,CAAC,IAAI,EAAE,sBAAsB,GAAG;QACrD,OAAO,EAAE,sCAAsC,CAAC;KACjD,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,qCAAqC,CAAC,CAAC;IAC9E;;;2FAGuF;IACvF,eAAe,EAAE,CAAC,IAAI,EAAE,sBAAsB,GAAG;QAC/C,OAAO,EAAE,OAAO,CAAC;KAClB,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,wBAAwB,CAAC,CAAC;IACjE;;wFAEoF;IACpF,sBAAsB,EAAE,CAAC,IAAI,EAAE,sBAAsB,GAAG;QACtD,OAAO,EAAE,OAAO,CAAC;KAClB,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,sBAAsB,CAAC,CAAC;IAC/D;gGAC4F;IAC5F,sBAAsB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,UAAU,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAC3G;;;;uBAImB;IACnB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACxB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,KAAK,oBAAoB,GAAG;IAAE,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9G;sGACsG;AACtG,wBAAgB,gCAAgC,CAAC,IAAI,EAAE;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,oBAAoB,GAAG,IAAI,CAAC;CACnC,GAAG,IAAI,CAUP;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,uFAAuF;IACvF,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B;;wEAEoE;IACpE,YAAY,CAAC,EAAE,cAAc,CAAC;IAC9B;;4EAEwE;IACxE,gBAAgB,CAAC,EAAE,mBAAmB,CAAC;IACvC;;iFAE6E;IAC7E,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;QAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,KAAK,IAAI,CAAC;IAChG;;kGAE8F;IAC9F,YAAY,CAAC,EAAE,MAAM,uBAAuB,GAAG,SAAS,CAAC;IACzD,sGAAsG;IACtG,2BAA2B,CAAC,EAAE,MAAM,CAAC;CACtC,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA47B9B;AA+DD;;;;;;;;;;;sEAWsE;AACtE,wBAAsB,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAsGzF;AAED,oGAAoG;AACpG,MAAM,WAAW,iBAAkB,SAAQ,mBAAmB;IAC5D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;oCAEgC;IAChC,wBAAwB,CAAC,CAAC,CAAC,SAAS,2BAA2B,EAC7D,OAAO,EAAE,+BAA+B,CAAC,CAAC,CAAC,GAC1C,OAAO,CAAC,8BAA8B,CAAC,CAAC,CAAC,CAAC,CAAC;CAC/C;AAED,sEAAsE;AACtE,MAAM,WAAW,oBAAoB;IACnC,2FAA2F;IAC3F,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAAC;CACvG;AAED;;;;;oGAKoG;AACpG,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,mBAAmB,GAAG;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+FAA+F;IAC/F,eAAe,CAAC,EAAE,oBAAoB,CAAC;IACvC;+FAC2F;IAC3F,2BAA2B,CAAC,EAAE,MAAM,CAAC;CACtC,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAyB7B;AAmQD,oFAAoF;AACpF,KAAK,WAAW,GAAG,OAAO,CAAC,sBAAsB,EAAE;IAAE,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC;AAExE,UAAU,UAAU;IAClB,MAAM,EAAE,eAAe,CAAC;IACxB,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAA;KAAE,CAAC;IAC5F,WAAW,EAAE,MAAM,GAAG,UAAU,CAAC;IACjC,uBAAuB,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG;QAAE,OAAO,EAAE,6BAA6B,CAAA;KAAE,KAAK,UAAU,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAC,CAAC;IAC5J,qBAAqB,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG;QAAE,OAAO,EAAE,+BAA+B,CAAA;KAAE,KAAK,UAAU,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC,CAAC;IACrJ,qBAAqB,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG;QAAE,OAAO,EAAE,oCAAoC,CAAA;KAAE,KAAK,UAAU,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAC1J,4BAA4B,EAAE,kBAAkB,CAAC,8BAA8B,CAAC,CAAC;IACjF,mCAAmC,EAAE,kBAAkB,CAAC,qCAAqC,CAAC,CAAC;IAC/F,yBAAyB,EAAE,kBAAkB,CAAC,2BAA2B,CAAC,CAAC;IAC3E,oBAAoB,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG;QAAE,OAAO,EAAE,OAAO,gBAAgB,EAAE,iCAAiC,CAAA;KAAE,KAAK,UAAU,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAC9K,qBAAqB,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG;QAAE,OAAO,EAAE,sCAAsC,CAAA;KAAE,KAAK,UAAU,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAC5J,eAAe,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,UAAU,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACjH,sBAAsB,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,UAAU,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAC,CAAC;IAC/H,OAAO,EAAE,WAAW,CAAC;IACrB,0BAA0B,EAAE,kBAAkB,CAAC,4BAA4B,CAAC,CAAC;IAC7E,sBAAsB,EAAE,kBAAkB,CAAC,wBAAwB,CAAC,CAAC;IACrE,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,GAAG,EAAE,MAAM,CAAC;IACZ;+CAC2C;IAC3C,qBAAqB,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACzG,qBAAqB,EAAE,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACnE,aAAa,EAAE,kBAAkB,CAAC,eAAe,CAAC,CAAC;CACpD;AAED,kGAAkG;AAClG,wBAAsB,+BAA+B,CACnD,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,GAAG,KAAK,GAAG,SAAS,GAAG,yBAAyB,GAAG,uBAAuB,GAAG,uBAAuB,GAAG,sBAAsB,GAAG,uBAAuB,GAAG,iBAAiB,GAAG,wBAAwB,CAAC,EACpO,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GACzB,OAAO,CAAC,OAAO,CAAC,CA4ClB;AAED;;;;4FAI4F;AAC5F,UAAU,cAAc;IACtB,iGAAiG;IACjG,iBAAiB,EAAE,OAAO,CAAC;IAC3B;;uDAEmD;IACnD,WAAW,EAAE,OAAO,CAAC;IACrB;;gEAE4D;IAC5D,qBAAqB,EAAE,OAAO,CAAC;IAC/B,wDAAwD;IACxD,OAAO,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,CAAC;IACtC,kGAAkG;IAClG,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAClD,yEAAyE;IACzE,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACpD;AAmbD;iGACiG;AACjG,wBAAsB,6BAA6B,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBrJ;AAED;;oFAEoF;AACpF,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUrE;AAED;;;;;;sBAMsB;AACtB,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,aAAa,EAAE,MAAM,CAAC;IACtB;;gGAE4F;IAC5F,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmB1B;AAED;;;mDAGmD;AACnD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAInG;AAED;;;cAGc;AACd,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUzE"}

package/dist/service.js

@@ -61,7 +61,8 @@ import { Kvm } from "@nats-io/kv";
 import { contractRefToHex, contractStoreContext, fetchContractArtifact, verifyClusterManifest, verifyClusterRoot, admissionBucket, admissionMediatorGrants, assertDerivedOwnerToken, assertLifecycleToken, assertValidOwnerToken, authorizeTrustedServeSnapshot, commitSiblingIssuance, credsClaims, EpEnvelopeError, ensureAuthorityStores, epAuthBucket, isReachable, jwtFromCreds, managedRetirementOpId, mintCreds, mintPublicUserJwt, newIdentity, observeHostedRunAttempt, openRecordsBucket, parseEndpointGate, parseServiceSpec, parseServiceStatus, rawDigest, parseSecretStoreIdentity, readCheckpointStatus, readRunAdmission, readRunRecord, readSvcRecordLeader, reconcileEndpointGate, sameSecretStoreIdentity, recordSpecKey, recordStatusKey, RECORD_KINDS, recordsBucket, remoteManagerActors, retirementFrontierStreams, runDriverCaller, serveIssuanceGateKv, standaloneConnectOpts, STANDING_RENEWABLE_TTL_SEC, withIssuerSession, authorizeServeGrant, contractArtifactCanonicalBytes, DEV_OWNER, endpointRegistrationBarrier, mintLifecycleUid, principalKey, provisionEndpointGateOpen, publishContractArtifact, registerServiceInstance, SERVICE_READY, writeServiceStatus } from "@cotal-ai/core";
 import { findCotalRoot, loadManagerInstanceIdentity, userAuthStateDir, workspaceSecretStore, createAuthInstanceIdentity, loadAuthInstanceIdentity } from "@cotal-ai/workspace";
 import { decodeJwt } from "jose";
-import { deriveOwnerForIdpSubject } from "./derive.js";
+import { deriveOwnerForIdpSubject, platformControlOwner } from "./derive.js";
+import { makePlatformControlAuthority, requireManagerAuthorityHolder } from "./platform-control.js";
 import { startAuthCallout } from "./callout.js";
 import { createIdpBridge, verifyIdpToken } from "./idp.js";
 import { PUBLIC_EXCHANGE_VIEWS } from "./token.js";
@@ -617,13 +618,12 @@ export async function openAuthAuthorityPlane(opts) {
             await flight;
             return { retired: true, lifecycleUid };
         },
-        issueManagerServiceAuthority: async ({ owner, scope, request }) => {
+        issueManagerServiceAuthority: async (holder) => {
             refuseIfFenced();
+            const { owner } = holder;
             const observeManagerGate = async (instanceId) => (await serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId }).observe()) ?? null;
             return issueRemoteManagerAuthority({
-                owner,
-                scope,
-                request,
+                ...holder,
                 authorizeRenewal: ({ owner: o, request: r }) => authorizeRemoteManagerRenewal({
                     request: r, owner: o, space, accountPublicKey: dataAccount.pub, proofSecret: dataAccount.signingSeed,
                     observeManagerGate,
@@ -821,14 +821,13 @@ export async function openAuthAuthorityPlane(opts) {
                 },
             });
         },
-        maintainRemoteManager: async ({ owner, scope, request }) => {
+        maintainRemoteManager: async (holder) => {
             refuseIfFenced();
+            const { owner } = holder;
             const gateKv = await new Kvm(remoteIssuer.nc).open(epAuthBucket(space));
             const authorized = await authorizeRemoteManagerMaintenance({
-                owner,
-                scope,
+                ...holder,
                 space,
-                request,
                 scanner,
                 observeManagerGate: async (instanceId) => serveIssuanceGateKv(gateKv, space, { endpoint: "manager", instanceId }).observe(),
             });
@@ -876,14 +875,12 @@ export async function openAuthAuthorityPlane(opts) {
             }
             return completeRemoteManagerMaintenance(authorized, owner, { reconciliation: report });
         },
-        validateRetainedAgent: async ({ owner, scope, request }) => {
+        validateRetainedAgent: async (holder) => {
             refuseIfFenced();
             return authorizeRemoteRetainedAgentValidation({
-                owner,
-                scope,
+                ...holder,
                 proofSecret: dataAccount.signingSeed,
                 space,
-                request,
                 observeManagerGate: async (instanceId) => {
                     const gate = serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId });
                     return gate.observe();
@@ -934,10 +931,11 @@ export async function openAuthAuthorityPlane(opts) {
                 ? authorizeRemoteManagedAgentRuntimeStatus({ ...args, request })
                 : authorizeRemoteManagedAgentRuntimeCreate({ ...args, request });
         },
-        scanManagerGoalIndex: async ({ owner, scope, request }) => {
+        scanManagerGoalIndex: async (holder) => {
             refuseIfFenced();
+            const { owner } = holder;
             const authorized = await authorizeRemoteManagerGoalIndexScan({
-                owner, scope, proofSecret: dataAccount.signingSeed, space, request,
+                ...holder, proofSecret: dataAccount.signingSeed, space,
                 observeManagerGate: async (instanceId) => {
                     const gate = serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId });
                     return gate.observe();
@@ -945,11 +943,11 @@ export async function openAuthAuthorityPlane(opts) {
             });
             return completeRemoteManagerGoalIndexScan(authorized, owner, await recordsScanner.scanManagerGoalIndex(owner));
         },
-        authorizeManagerAdmin: async ({ owner, scope, request }) => {
+        authorizeManagerAdmin: async ({ request, ...holder }) => {
             refuseIfFenced();
             return authorizeRemoteManagerAdmin({
-                managerOwner: owner,
-                managerScope: scope,
+                managerOwner: holder.owner,
+                ...(holder.holder === "platform" ? { managerAssignment: holder.assignment } : { managerScope: holder.scope }),
                 proofSecret: dataAccount.signingSeed,
                 space,
                 dir: opts.dir,
@@ -960,10 +958,10 @@ export async function openAuthAuthorityPlane(opts) {
                 },
             });
         },
-        admitManagerRun: async ({ owner, scope, request }) => {
+        admitManagerRun: async ({ request, ...holder }) => {
             refuseIfFenced();
-            if (!scope.includes("supervise"))
-                throw new EpEnvelopeError("permission-denied", 'manager run admission needs scope "supervise"; spawn/admin do not imply it');
+            const { owner } = holder;
+            requireManagerAuthorityHolder(holder, String(request?.instanceId), 'manager run admission needs scope "supervise"; spawn/admin do not imply it');
             const runId = parseRemoteRunAdmissionRequest(request).run.runId;
             const hostAuth = {
                 space,
@@ -997,10 +995,10 @@ export async function openAuthAuthorityPlane(opts) {
                 }
             });
         },
-        issueManagerRunAttempt: async ({ owner, scope, request }) => {
+        issueManagerRunAttempt: async ({ request, ...holder }) => {
             refuseIfFenced();
-            if (!scope.includes("supervise"))
-                throw new EpEnvelopeError("permission-denied", 'manager run attempt needs scope "supervise"; spawn/admin do not imply it');
+            const { owner } = holder;
+            requireManagerAuthorityHolder(holder, String(request?.instanceId), 'manager run attempt needs scope "supervise"; spawn/admin do not imply it');
             const req = parseRemoteRunAttemptRequest(request);
             const recordsKv = await openRecordsBucket(remoteIssuer.nc, space);
             const grant = await authorizeRemoteRunAttempt({
@@ -1078,6 +1076,12 @@ export async function openAuthAuthorityPlane(opts) {
                 credentials: { operator },
             };
         },
+        observeManagerInstance: async (instanceId) => {
+            refuseIfFenced();
+            const gate = await serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId }).observe();
+            const rec = await readSvcRecordLeader(recordsJsm, space, recordSpecKey(RECORD_KINDS.svc, ["manager", instanceId]));
+            return { registered: rec !== undefined && !("deleted" in rec), gate: gate ?? null };
+        },
         fenced,
         close: async () => {
             // Clean-close order (SPEC 13.13): the rail stops answering first, then scan-capable
@@ -1288,6 +1292,8 @@ export async function startAuthService(inputs) {
     const port = inputs.port ?? 0;
     if (!Number.isInteger(port) || port < 0 || port > 65535)
         throw new Error(`auth-service: port must be a port number, got ${port}`);
+    if (inputs.platformControl !== undefined && typeof inputs.platformControl?.observeAssignment !== "function")
+        throw new Error("auth-service: platformControl requires an observeAssignment function");
     const started = await startAuthContext({
         space: inputs.space,
         server: inputs.servers,
@@ -1297,6 +1303,8 @@ export async function startAuthService(inputs) {
         hostedStore: true,
         localManager: () => undefined,
         context: inputs.context,
+        ...(inputs.platformControl !== undefined ? { platformControl: inputs.platformControl } : {}),
+        ...(inputs.standingRenewableTtlSeconds !== undefined ? { standingRenewableTtlSeconds: inputs.standingRenewableTtlSeconds } : {}),
     });
     return started.handle;
 }
@@ -1332,6 +1340,7 @@ async function startAuthContext(o) {
         dataAccount: { pub: keys.dataAccount.pub, signingSeed: keys.dataAccount.signingSeed },
         log: (l) => console.error(l),
         localManager: o.localManager,
+        ...(o.standingRenewableTtlSeconds !== undefined ? { standingRenewableTtlSeconds: o.standingRenewableTtlSeconds } : {}),
     });
     let nc;
     let http;
@@ -1476,9 +1485,46 @@ async function startAuthContext(o) {
             return end;
         });
         const context = o.context ?? { accountPublicKey: keys.dataAccount.pub, lifecycleUid: "" };
+        const platformControl = o.platformControl;
+        // The human route's retained-validation composition, for the platform holder.
+        const validateRetainedForHolder = async (holder, request) => {
+            const retained = await plane.validateRetainedAgent({ ...holder, request });
+            const authority = await validateRetainedManagedAgent({
+                store: secrets,
+                dir,
+                space,
+                owner: retained.target.owner,
+                actor: retained.target.actor,
+                actorToken: retained.actorToken,
+                sentinelCreds: retained.sentinelCreds,
+            });
+            return completeRemoteRetainedAgentValidation(retained, holder.owner, authority);
+        };
         const service = {
             url,
             ...(publicUrl !== undefined ? { publicUrl } : {}),
+            ...(platformControl !== undefined ? {
+                platformControlAuthority: makePlatformControlAuthority({
+                    space,
+                    accountPublicKey: keys.dataAccount.pub,
+                    owner: platformControlOwner(ownerSecret, space, keys.dataAccount.pub),
+                    observeAssignment: (s, a) => platformControl.observeAssignment(s, a),
+                    observeManagerInstance: plane.observeManagerInstance,
+                    dispatch: (holder, request) => {
+                        if (state !== "ready" || closePromise !== undefined)
+                            throw new EpEnvelopeError("unavailable", "auth-service context is not ready");
+                        switch (request.kind) {
+                            case "manager-service-authority": return plane.issueManagerServiceAuthority({ ...holder, request });
+                            case "manager-service-maintenance": return plane.maintainRemoteManager({ ...holder, request });
+                            case "manager-goal-index-scan": return plane.scanManagerGoalIndex({ ...holder, request });
+                            case "manager-admin-authorization": return plane.authorizeManagerAdmin({ ...holder, request });
+                            case "manager-run-admission": return plane.admitManagerRun({ ...holder, request });
+                            case "manager-run-attempt": return plane.issueManagerRunAttempt({ ...holder, request });
+                            case "manager-retained-agent-validation": return validateRetainedForHolder(holder, request);
+                        }
+                    },
+                }),
+            } : {}),
             readiness() {
                 if (state === "unavailable")
                     return { state, context, cause: cause ?? "auth-service context is unavailable" };