@cotal-ai/auth 0.59.0 → 0.61.0

package/dist/service.d.ts

@@ -1,6 +1,7 @@
 import { type IncomingMessage, type ServerResponse } from "node:http";
-import { type ParsedArgs, type RemoteManagerAdminAuthorizationRequest, type RemoteManagerAuthorityRequest, type RemoteManagerMaintenanceRequest, type RemoteRetainedAgentValidationRequest, type SecretStore } from "@cotal-ai/core";
+import { type EpGateState, type ParsedArgs, type PlatformControlAssignment, type PlatformControlAuthorityRequest, type PlatformControlAuthorityResult, type PlatformControlInnerRequest, type RemoteManagerAdminAuthorizationRequest, type RemoteManagerAuthorityRequest, type RemoteManagerMaintenanceRequest, type RemoteRetainedAgentValidationRequest, type SecretStore } from "@cotal-ai/core";
 import { type HostedContextInputs, type HostedServiceHandle, type ManagerInstanceIdentity } from "@cotal-ai/workspace";
+import { type ManagerAuthorityHolder } from "./platform-control.js";
 import { type IdpBridge } from "./idp.js";
 import { type UserTokenSession, type ValidatedUserToken } from "./token.js";
 import { pinnedJwksResolver, type UserTokenIssuer } from "./issuer.js";
@@ -55,19 +56,13 @@ export interface AuthAuthorityPlane {
         alreadyRetired?: boolean;
     }>;
     retireManagedLifecycle: AuthAuthorityPlane["retireInteractiveLifecycle"];
-    issueManagerServiceAuthority: (args: {
-        owner: string;
-        scope: string[];
+    issueManagerServiceAuthority: (args: ManagerAuthorityHolder & {
         request: RemoteManagerAuthorityRequest;
     }) => Promise<import("@cotal-ai/core").RemoteManagerAuthorityMaterial>;
-    maintainRemoteManager: (args: {
-        owner: string;
-        scope: string[];
+    maintainRemoteManager: (args: ManagerAuthorityHolder & {
         request: RemoteManagerMaintenanceRequest;
     }) => Promise<import("@cotal-ai/core").RemoteManagerMaintenanceResult>;
-    validateRetainedAgent: (args: {
-        owner: string;
-        scope: string[];
+    validateRetainedAgent: (args: ManagerAuthorityHolder & {
         request: RemoteRetainedAgentValidationRequest;
     }) => Promise<RemoteRetainedAgentValidationRequest>;
     /** Authorize one host-owned managed-agent enrollment (#1972). The plane reads the manager gate on
@@ -90,33 +85,31 @@ export interface AuthAuthorityPlane {
         owner: string;
         request: import("@cotal-ai/core").RemoteManagedAgentRuntimeRequest;
     }) => Promise<RemoteManagedAgentRuntimeDecision>;
-    scanManagerGoalIndex: (args: {
-        owner: string;
-        scope: string[];
+    scanManagerGoalIndex: (args: ManagerAuthorityHolder & {
         request: import("@cotal-ai/core").RemoteManagerGoalIndexScanRequest;
     }) => Promise<import("@cotal-ai/core").RemoteManagerGoalIndexScanResult>;
-    authorizeManagerAdmin: (args: {
-        owner: string;
-        scope: string[];
+    authorizeManagerAdmin: (args: ManagerAuthorityHolder & {
         request: RemoteManagerAdminAuthorizationRequest;
     }) => Promise<import("@cotal-ai/core").RemoteManagerAdminAuthorizationResult>;
     /** First-run admission for one hosted run-start, asked by a registered signerless manager. The
      *  plane authenticates the registration, resolves the caller's issued generation on its own issuer
      *  connection with live sources, and creates the admission through a run-admitter credential
      *  pinned to that one run. No ceiling, caller or profile is taken from the request. */
-    admitManagerRun: (args: {
-        owner: string;
-        scope: string[];
+    admitManagerRun: (args: ManagerAuthorityHolder & {
         request: unknown;
     }) => Promise<import("@cotal-ai/core").RemoteRunAdmissionResult>;
     /** First-attempt/resume or operator issuance for one hosted run, asked by a registered signerless manager.
      *  The plane authenticates the registration, derives coordinates from native admission/records/checkpoints,
      *  and signs ONLY the returned fixed grant args. JWT responses contain no seeds. */
-    issueManagerRunAttempt: (args: {
-        owner: string;
-        scope: string[];
+    issueManagerRunAttempt: (args: ManagerAuthorityHolder & {
         request: unknown;
     }) => Promise<import("@cotal-ai/core").RemoteRunAttemptResult>;
+    /** Read-only view of one manager instance for the platform control door: whether its
+     *  `svc.manager` record is current, and its gate. It probes, freezes and writes nothing. */
+    observeManagerInstance: (instanceId: string) => Promise<{
+        registered: boolean;
+        gate: EpGateState | null;
+    }>;
     /** Resolves with the state-3 copy when a mid-life scanner death FENCES the plane (SPEC 13.13):
      *  the plane is no longer whole, `authorizeConnect`/`mintConnectCredential` refuse from that
      *  moment, and the composition root must take the whole service DOWN loud (a fenced plane that
@@ -197,10 +190,33 @@ export declare function openAuthAuthorityPlane(opts: {
  *  NON-SEAM state (the actor ledger, the IdP pin, the discovery file) still lives in the local
  *  state dir either way — hosting those is a later, separate seam. */
 export declare function runAuthService(args: ParsedArgs, store?: SecretStore): Promise<void>;
-/** An embedded auth-service context: the loopback exchange URL plus the hosted lifecycle handle. */
+/** An embedded auth-service context: what `runAuthService` writes to `auth-service.json` (the
+ *  loopback URL, the public URL and the capability) plus the hosted lifecycle handle. */
 export interface AuthServiceHandle extends HostedServiceHandle {
     readonly url: string;
     readonly publicUrl?: string;
+    /** The per-start loopback capability. It alone authorizes the loopback host actions (lifecycle
+     *  retirement, managed-agent enrollment verification), so it stays in the authority process and
+     *  never reaches a control worker. */
+    readonly cap: string;
+    /** The platform control door (SPEC 13.1). Present only when `platformControl` was supplied to
+     *  {@link startAuthService}. In-process and typed: no route, no capability, and no signer or
+     *  capability in the result. */
+    platformControlAuthority?<R extends PlatformControlInnerRequest>(request: PlatformControlAuthorityRequest<R>): Promise<PlatformControlAuthorityResult<R>>;
+}
+/** The optional public exchange face: the CLI's `--exchange-public-*`, `--advertised-server` and
+ *  `--agent-provisioning-url` flags, or the hosted `publicFace` input. */
+export interface PublicFaceInput {
+    port: number;
+    url?: string;
+    trustedProxy: boolean;
+    advertisedServer?: string;
+    agentProvisioningUrl?: string;
+}
+/** The platform composition's input for the platform control door. */
+export interface PlatformControlInput {
+    /** The one current assignment for this account, or null. Read fresh on every door call. */
+    observeAssignment(space: string, accountPublicKey: string): Promise<PlatformControlAssignment | null>;
 }
 /** Start one account-scoped auth-service context. Every input is explicit: the state dir, the
  *  injected store with its proved identity, the assigned data account and the broker. The context
@@ -210,7 +226,18 @@ export interface AuthServiceHandle extends HostedServiceHandle {
  *  mid-life fence or broker loss makes only this context `unavailable` and closes its resources. */
 export declare function startAuthService(inputs: HostedContextInputs & {
     port?: number;
+    /** Absent: the handle has no `publicUrl` and nothing serves the discovery bundle. */
+    publicFace?: PublicFaceInput;
+    /** Present only in a platform composition. Absent: the handle has no platform control door. */
+    platformControl?: PlatformControlInput;
+    /** Trusted-host only. Forwarded unchanged to {@link openAuthAuthorityPlane}, which bounds it to
+     *  5..86400 seconds. Absent: the 24h default. No CLI flag and no request field sets it. */
+    standingRenewableTtlSeconds?: number;
 }): Promise<AuthServiceHandle>;
+/** The HTTP routes authenticate a human, so they only ever supply the human arm. */
+type HumanHolder = Extract<ManagerAuthorityHolder, {
+    scope: string[];
+}>;
 interface HandlerCtx {
     issuer: UserTokenIssuer;
     bridge: IdpBridge;
@@ -220,16 +247,30 @@ interface HandlerCtx {
         key: ReturnType<typeof pinnedJwksResolver>;
     };
     ownerSecret: string | Uint8Array;
-    managerServiceAuthority: AuthAuthorityPlane["issueManagerServiceAuthority"];
-    maintainRemoteManager: AuthAuthorityPlane["maintainRemoteManager"];
-    validateRetainedAgent: AuthAuthorityPlane["validateRetainedAgent"];
+    managerServiceAuthority: (args: HumanHolder & {
+        request: RemoteManagerAuthorityRequest;
+    }) => ReturnType<AuthAuthorityPlane["issueManagerServiceAuthority"]>;
+    maintainRemoteManager: (args: HumanHolder & {
+        request: RemoteManagerMaintenanceRequest;
+    }) => ReturnType<AuthAuthorityPlane["maintainRemoteManager"]>;
+    validateRetainedAgent: (args: HumanHolder & {
+        request: RemoteRetainedAgentValidationRequest;
+    }) => ReturnType<AuthAuthorityPlane["validateRetainedAgent"]>;
     verifyManagedAgentEnrollment: AuthAuthorityPlane["verifyManagedAgentEnrollment"];
     verifyManagedAgentPrepareRetirement: AuthAuthorityPlane["verifyManagedAgentPrepareRetirement"];
     verifyManagedAgentRuntime: AuthAuthorityPlane["verifyManagedAgentRuntime"];
-    scanManagerGoalIndex: AuthAuthorityPlane["scanManagerGoalIndex"];
-    authorizeManagerAdmin: AuthAuthorityPlane["authorizeManagerAdmin"];
-    admitManagerRun: AuthAuthorityPlane["admitManagerRun"];
-    issueManagerRunAttempt: AuthAuthorityPlane["issueManagerRunAttempt"];
+    scanManagerGoalIndex: (args: HumanHolder & {
+        request: import("@cotal-ai/core").RemoteManagerGoalIndexScanRequest;
+    }) => ReturnType<AuthAuthorityPlane["scanManagerGoalIndex"]>;
+    authorizeManagerAdmin: (args: HumanHolder & {
+        request: RemoteManagerAdminAuthorizationRequest;
+    }) => ReturnType<AuthAuthorityPlane["authorizeManagerAdmin"]>;
+    admitManagerRun: (args: HumanHolder & {
+        request: unknown;
+    }) => ReturnType<AuthAuthorityPlane["admitManagerRun"]>;
+    issueManagerRunAttempt: (args: HumanHolder & {
+        request: unknown;
+    }) => ReturnType<AuthAuthorityPlane["issueManagerRunAttempt"]>;
     secrets: SecretStore;
     retireInteractiveLifecycle: AuthAuthorityPlane["retireInteractiveLifecycle"];
     retireManagedLifecycle: AuthAuthorityPlane["retireManagedLifecycle"];

package/dist/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAuDA,OAAO,EAAgB,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAKpF,OAAO,EAA+oC,KAAK,UAAU,EAAE,KAAK,sCAAsC,EAAE,KAAK,6BAA6B,EAAE,KAAK,+BAA+B,EAAE,KAAK,oCAAoC,EAAE,KAAK,WAAW,EAAgE,MAAM,gBAAgB,CAAC;AACh7C,OAAO,EAA4I,KAAK,mBAAmB,EAAyB,KAAK,mBAAmB,EAA2B,KAAK,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAIjT,OAAO,EAAmC,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAC3E,OAAO,EAAyB,KAAK,gBAAgB,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEvH,OAAO,EAAE,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAIvE,OAAO,EAA2K,KAAK,iCAAiC,EAAE,MAAM,+BAA+B,CAAC;AAYhQ,OAAO,EAA4H,KAAK,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACtL,OAAO,EAAkD,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AA6B7G;uDACuD;AACvD,eAAO,MAAM,gBAAgB,MAAM,CAAC;AAEpC,4HAA4H;AAC5H,eAAO,MAAM,uBAAuB,kCAAkC,CAAC;AAEvE;gGACgG;AAChG,eAAO,MAAM,mBAAmB,8BAA8B,CAAC;AAE/D;;8FAE8F;AAC9F,eAAO,MAAM,sBAAsB,iDAAiD,CAAC;AAqBrF;;;+DAG+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,gBAAgB,EAAE,CAAC,CAAC,EAAE,kBAAkB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,qBAAqB,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACzG,qBAAqB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9E,sBAAsB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E;mGAC+F;IAC/F,aAAa,EAAE,CACb,SAAS,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,EAClE,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,KAC7E,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC/B,0BAA0B,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC;QACpG,OAAO,EAAE,OAAO,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,cAAc,CAAC,EAAE,OAAO,CAAC;KAC1B,CAAC,CAAC;IACH,sBAAsB,EAAE,kBAAkB,CAAC,4BAA4B,CAAC,CAAC;IACzE,4BAA4B,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,6BAA6B,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;IACrL,qBAAqB,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,+BAA+B,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;IAChL,qBAAqB,EAAE,CAAC,IAAI,EAAE;QAC5B,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,oCAAoC,CAAC;KAC/C,KAAK,OAAO,CAAC,oCAAoC,CAAC,CAAC;IACpD;;4FAEwF;IACxF,4BAA4B,EAAE,CAAC,IAAI,EAAE;QACnC,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,gBAAgB,EAAE,mCAAmC,CAAC;KACvE,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,mCAAmC,CAAC,CAAC;IAC5E,+FAA+F;IAC/F,mCAAmC,EAAE,CAAC,IAAI,EAAE;QAC1C,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,gBAAgB,EAAE,0CAA0C,CAAC;KAC9E,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,0CAA0C,CAAC,CAAC;IACnF;0FACsF;IACtF,yBAAyB,EAAE,CAAC,IAAI,EAAE;QAChC,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,OAAO,gBAAgB,EAAE,gCAAgC,CAAC;KACpE,KAAK,OAAO,CAAC,iCAAiC,CAAC,CAAC;IACjD,oBAAoB,EAAE,CAAC,IAAI,EAAE;QAC3B,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,gBAAgB,EAAE,iCAAiC,CAAC;KACrE,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,gCAAgC,CAAC,CAAC;IACzE,qBAAqB,EAAE,CAAC,IAAI,EAAE;QAC5B,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,sCAAsC,CAAC;KACjD,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,qCAAqC,CAAC,CAAC;IAC9E;;;2FAGuF;IACvF,eAAe,EAAE,CAAC,IAAI,EAAE;QACtB,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,CAAC;KAClB,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,wBAAwB,CAAC,CAAC;IACjE;;wFAEoF;IACpF,sBAAsB,EAAE,CAAC,IAAI,EAAE;QAC7B,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,CAAC;KAClB,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,sBAAsB,CAAC,CAAC;IAC/D;;;;uBAImB;IACnB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACxB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,KAAK,oBAAoB,GAAG;IAAE,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9G;sGACsG;AACtG,wBAAgB,gCAAgC,CAAC,IAAI,EAAE;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,oBAAoB,GAAG,IAAI,CAAC;CACnC,GAAG,IAAI,CAUP;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,uFAAuF;IACvF,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B;;wEAEoE;IACpE,YAAY,CAAC,EAAE,cAAc,CAAC;IAC9B;;4EAEwE;IACxE,gBAAgB,CAAC,EAAE,mBAAmB,CAAC;IACvC;;iFAE6E;IAC7E,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;QAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,KAAK,IAAI,CAAC;IAChG;;kGAE8F;IAC9F,YAAY,CAAC,EAAE,MAAM,uBAAuB,GAAG,SAAS,CAAC;IACzD,sGAAsG;IACtG,2BAA2B,CAAC,EAAE,MAAM,CAAC;CACtC,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAy7B9B;AA+DD;;;;;;;;;;;sEAWsE;AACtE,wBAAsB,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAsGzF;AAED,oGAAoG;AACpG,MAAM,WAAW,iBAAkB,SAAQ,mBAAmB;IAC5D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;oGAKoG;AACpG,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,mBAAmB,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAqBlH;AA0ND,UAAU,UAAU;IAClB,MAAM,EAAE,eAAe,CAAC;IACxB,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAA;KAAE,CAAC;IAC5F,WAAW,EAAE,MAAM,GAAG,UAAU,CAAC;IACjC,uBAAuB,EAAE,kBAAkB,CAAC,8BAA8B,CAAC,CAAC;IAC5E,qBAAqB,EAAE,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACnE,qBAAqB,EAAE,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACnE,4BAA4B,EAAE,kBAAkB,CAAC,8BAA8B,CAAC,CAAC;IACjF,mCAAmC,EAAE,kBAAkB,CAAC,qCAAqC,CAAC,CAAC;IAC/F,yBAAyB,EAAE,kBAAkB,CAAC,2BAA2B,CAAC,CAAC;IAC3E,oBAAoB,EAAE,kBAAkB,CAAC,sBAAsB,CAAC,CAAC;IACjE,qBAAqB,EAAE,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACnE,eAAe,EAAE,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;IACvD,sBAAsB,EAAE,kBAAkB,CAAC,wBAAwB,CAAC,CAAC;IACrE,OAAO,EAAE,WAAW,CAAC;IACrB,0BAA0B,EAAE,kBAAkB,CAAC,4BAA4B,CAAC,CAAC;IAC7E,sBAAsB,EAAE,kBAAkB,CAAC,wBAAwB,CAAC,CAAC;IACrE,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,GAAG,EAAE,MAAM,CAAC;IACZ;+CAC2C;IAC3C,qBAAqB,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACzG,qBAAqB,EAAE,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACnE,aAAa,EAAE,kBAAkB,CAAC,eAAe,CAAC,CAAC;CACpD;AAED,kGAAkG;AAClG,wBAAsB,+BAA+B,CACnD,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,GAAG,KAAK,GAAG,SAAS,GAAG,yBAAyB,GAAG,uBAAuB,GAAG,uBAAuB,GAAG,sBAAsB,GAAG,uBAAuB,GAAG,iBAAiB,GAAG,wBAAwB,CAAC,EACpO,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GACzB,OAAO,CAAC,OAAO,CAAC,CA4ClB;AAED;;;;4FAI4F;AAC5F,UAAU,cAAc;IACtB,iGAAiG;IACjG,iBAAiB,EAAE,OAAO,CAAC;IAC3B;;uDAEmD;IACnD,WAAW,EAAE,OAAO,CAAC;IACrB;;gEAE4D;IAC5D,qBAAqB,EAAE,OAAO,CAAC;IAC/B,wDAAwD;IACxD,OAAO,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,CAAC;IACtC,kGAAkG;IAClG,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAClD,yEAAyE;IACzE,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACpD;AAmbD;iGACiG;AACjG,wBAAsB,6BAA6B,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBrJ;AAED;;oFAEoF;AACpF,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUrE;AAED;;;;;;sBAMsB;AACtB,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,aAAa,EAAE,MAAM,CAAC;IACtB;;gGAE4F;IAC5F,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmB1B;AAED;;;mDAGmD;AACnD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAInG;AAED;;;cAGc;AACd,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUzE"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAwDA,OAAO,EAAgB,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAKpF,OAAO,EAA6nC,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,KAAK,yBAAyB,EAAE,KAAK,+BAA+B,EAAE,KAAK,8BAA8B,EAAE,KAAK,2BAA2B,EAAE,KAAK,sCAAsC,EAAE,KAAK,6BAA6B,EAAE,KAAK,+BAA+B,EAAE,KAAK,oCAAoC,EAAE,KAAK,WAAW,EAAgE,MAAM,gBAAgB,CAAC;AAC7jD,OAAO,EAA4I,KAAK,mBAAmB,EAAyB,KAAK,mBAAmB,EAA2B,KAAK,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAGjT,OAAO,EAA+D,KAAK,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAEjI,OAAO,EAAmC,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAC3E,OAAO,EAAyB,KAAK,gBAAgB,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEvH,OAAO,EAAE,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAIvE,OAAO,EAA2K,KAAK,iCAAiC,EAAE,MAAM,+BAA+B,CAAC;AAYhQ,OAAO,EAA4H,KAAK,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACtL,OAAO,EAAkD,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AA6B7G;uDACuD;AACvD,eAAO,MAAM,gBAAgB,MAAM,CAAC;AAEpC,4HAA4H;AAC5H,eAAO,MAAM,uBAAuB,kCAAkC,CAAC;AAEvE;gGACgG;AAChG,eAAO,MAAM,mBAAmB,8BAA8B,CAAC;AAE/D;;8FAE8F;AAC9F,eAAO,MAAM,sBAAsB,iDAAiD,CAAC;AAqBrF;;;+DAG+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,gBAAgB,EAAE,CAAC,CAAC,EAAE,kBAAkB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,qBAAqB,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACzG,qBAAqB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9E,sBAAsB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E;mGAC+F;IAC/F,aAAa,EAAE,CACb,SAAS,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,EAClE,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,KAC7E,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC/B,0BAA0B,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC;QACpG,OAAO,EAAE,OAAO,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,cAAc,CAAC,EAAE,OAAO,CAAC;KAC1B,CAAC,CAAC;IACH,sBAAsB,EAAE,kBAAkB,CAAC,4BAA4B,CAAC,CAAC;IACzE,4BAA4B,EAAE,CAAC,IAAI,EAAE,sBAAsB,GAAG;QAAE,OAAO,EAAE,6BAA6B,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;IAC9K,qBAAqB,EAAE,CAAC,IAAI,EAAE,sBAAsB,GAAG;QAAE,OAAO,EAAE,+BAA+B,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;IACzK,qBAAqB,EAAE,CAAC,IAAI,EAAE,sBAAsB,GAAG;QACrD,OAAO,EAAE,oCAAoC,CAAC;KAC/C,KAAK,OAAO,CAAC,oCAAoC,CAAC,CAAC;IACpD;;4FAEwF;IACxF,4BAA4B,EAAE,CAAC,IAAI,EAAE;QACnC,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,gBAAgB,EAAE,mCAAmC,CAAC;KACvE,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,mCAAmC,CAAC,CAAC;IAC5E,+FAA+F;IAC/F,mCAAmC,EAAE,CAAC,IAAI,EAAE;QAC1C,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,gBAAgB,EAAE,0CAA0C,CAAC;KAC9E,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,0CAA0C,CAAC,CAAC;IACnF;0FACsF;IACtF,yBAAyB,EAAE,CAAC,IAAI,EAAE;QAChC,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,OAAO,gBAAgB,EAAE,gCAAgC,CAAC;KACpE,KAAK,OAAO,CAAC,iCAAiC,CAAC,CAAC;IACjD,oBAAoB,EAAE,CAAC,IAAI,EAAE,sBAAsB,GAAG;QACpD,OAAO,EAAE,OAAO,gBAAgB,EAAE,iCAAiC,CAAC;KACrE,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,gCAAgC,CAAC,CAAC;IACzE,qBAAqB,EAAE,CAAC,IAAI,EAAE,sBAAsB,GAAG;QACrD,OAAO,EAAE,sCAAsC,CAAC;KACjD,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,qCAAqC,CAAC,CAAC;IAC9E;;;2FAGuF;IACvF,eAAe,EAAE,CAAC,IAAI,EAAE,sBAAsB,GAAG;QAC/C,OAAO,EAAE,OAAO,CAAC;KAClB,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,wBAAwB,CAAC,CAAC;IACjE;;wFAEoF;IACpF,sBAAsB,EAAE,CAAC,IAAI,EAAE,sBAAsB,GAAG;QACtD,OAAO,EAAE,OAAO,CAAC;KAClB,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,sBAAsB,CAAC,CAAC;IAC/D;gGAC4F;IAC5F,sBAAsB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,UAAU,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAC3G;;;;uBAImB;IACnB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACxB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,KAAK,oBAAoB,GAAG;IAAE,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9G;sGACsG;AACtG,wBAAgB,gCAAgC,CAAC,IAAI,EAAE;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,oBAAoB,GAAG,IAAI,CAAC;CACnC,GAAG,IAAI,CAUP;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,uFAAuF;IACvF,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B;;wEAEoE;IACpE,YAAY,CAAC,EAAE,cAAc,CAAC;IAC9B;;4EAEwE;IACxE,gBAAgB,CAAC,EAAE,mBAAmB,CAAC;IACvC;;iFAE6E;IAC7E,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;QAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,KAAK,IAAI,CAAC;IAChG;;kGAE8F;IAC9F,YAAY,CAAC,EAAE,MAAM,uBAAuB,GAAG,SAAS,CAAC;IACzD,sGAAsG;IACtG,2BAA2B,CAAC,EAAE,MAAM,CAAC;CACtC,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA47B9B;AA+DD;;;;;;;;;;;sEAWsE;AACtE,wBAAsB,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAgGzF;AAED;yFACyF;AACzF,MAAM,WAAW,iBAAkB,SAAQ,mBAAmB;IAC5D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;0CAEsC;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;oCAEgC;IAChC,wBAAwB,CAAC,CAAC,CAAC,SAAS,2BAA2B,EAC7D,OAAO,EAAE,+BAA+B,CAAC,CAAC,CAAC,GAC1C,OAAO,CAAC,8BAA8B,CAAC,CAAC,CAAC,CAAC,CAAC;CAC/C;AAED;0EAC0E;AAC1E,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,OAAO,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,sEAAsE;AACtE,MAAM,WAAW,oBAAoB;IACnC,2FAA2F;IAC3F,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAAC;CACvG;AAED;;;;;oGAKoG;AACpG,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,mBAAmB,GAAG;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qFAAqF;IACrF,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,+FAA+F;IAC/F,eAAe,CAAC,EAAE,oBAAoB,CAAC;IACvC;+FAC2F;IAC3F,2BAA2B,CAAC,EAAE,MAAM,CAAC;CACtC,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA4B7B;AAoQD,oFAAoF;AACpF,KAAK,WAAW,GAAG,OAAO,CAAC,sBAAsB,EAAE;IAAE,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC;AAExE,UAAU,UAAU;IAClB,MAAM,EAAE,eAAe,CAAC;IACxB,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAA;KAAE,CAAC;IAC5F,WAAW,EAAE,MAAM,GAAG,UAAU,CAAC;IACjC,uBAAuB,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG;QAAE,OAAO,EAAE,6BAA6B,CAAA;KAAE,KAAK,UAAU,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAC,CAAC;IAC5J,qBAAqB,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG;QAAE,OAAO,EAAE,+BAA+B,CAAA;KAAE,KAAK,UAAU,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC,CAAC;IACrJ,qBAAqB,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG;QAAE,OAAO,EAAE,oCAAoC,CAAA;KAAE,KAAK,UAAU,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAC1J,4BAA4B,EAAE,kBAAkB,CAAC,8BAA8B,CAAC,CAAC;IACjF,mCAAmC,EAAE,kBAAkB,CAAC,qCAAqC,CAAC,CAAC;IAC/F,yBAAyB,EAAE,kBAAkB,CAAC,2BAA2B,CAAC,CAAC;IAC3E,oBAAoB,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG;QAAE,OAAO,EAAE,OAAO,gBAAgB,EAAE,iCAAiC,CAAA;KAAE,KAAK,UAAU,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAC9K,qBAAqB,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG;QAAE,OAAO,EAAE,sCAAsC,CAAA;KAAE,KAAK,UAAU,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAC5J,eAAe,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,UAAU,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACjH,sBAAsB,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,UAAU,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAC,CAAC;IAC/H,OAAO,EAAE,WAAW,CAAC;IACrB,0BAA0B,EAAE,kBAAkB,CAAC,4BAA4B,CAAC,CAAC;IAC7E,sBAAsB,EAAE,kBAAkB,CAAC,wBAAwB,CAAC,CAAC;IACrE,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,GAAG,EAAE,MAAM,CAAC;IACZ;+CAC2C;IAC3C,qBAAqB,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACzG,qBAAqB,EAAE,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACnE,aAAa,EAAE,kBAAkB,CAAC,eAAe,CAAC,CAAC;CACpD;AAED,kGAAkG;AAClG,wBAAsB,+BAA+B,CACnD,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,GAAG,KAAK,GAAG,SAAS,GAAG,yBAAyB,GAAG,uBAAuB,GAAG,uBAAuB,GAAG,sBAAsB,GAAG,uBAAuB,GAAG,iBAAiB,GAAG,wBAAwB,CAAC,EACpO,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GACzB,OAAO,CAAC,OAAO,CAAC,CA4ClB;AAED;;;;4FAI4F;AAC5F,UAAU,cAAc;IACtB,iGAAiG;IACjG,iBAAiB,EAAE,OAAO,CAAC;IAC3B;;uDAEmD;IACnD,WAAW,EAAE,OAAO,CAAC;IACrB;;gEAE4D;IAC5D,qBAAqB,EAAE,OAAO,CAAC;IAC/B,wDAAwD;IACxD,OAAO,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,CAAC;IACtC,kGAAkG;IAClG,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAClD,yEAAyE;IACzE,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACpD;AAmbD;iGACiG;AACjG,wBAAsB,6BAA6B,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBrJ;AAED;;oFAEoF;AACpF,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUrE;AAaD;;;;;;sBAMsB;AACtB,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,aAAa,EAAE,MAAM,CAAC;IACtB;;gGAE4F;IAC5F,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmB1B;AAED;;;mDAGmD;AACnD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAInG;AAED;;;cAGc;AACd,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUzE"}

package/dist/service.js

@@ -18,7 +18,8 @@
  *
  * The exchange surface is LOCAL-V1, hardened: loopback bind only; `POST /exchange` requires the
  * per-start high-entropy capability (`Authorization: Bearer <cap>` — readable only from the 0600
- * discovery file, so same-user file ACL is the boundary); requests carrying an `Origin` header are
+ * discovery file, so same-user file ACL is the boundary, or from a hosted context's handle inside
+ * the host process); requests carrying an `Origin` header are
  * rejected (a browser page can reach loopback; it must not be able to drive the exchange); bodies
  * must be `application/json`; failed exchanges are rate-limited and logged. No CORS headers, ever.
  *
@@ -61,7 +62,8 @@ import { Kvm } from "@nats-io/kv";
 import { contractRefToHex, contractStoreContext, fetchContractArtifact, verifyClusterManifest, verifyClusterRoot, admissionBucket, admissionMediatorGrants, assertDerivedOwnerToken, assertLifecycleToken, assertValidOwnerToken, authorizeTrustedServeSnapshot, commitSiblingIssuance, credsClaims, EpEnvelopeError, ensureAuthorityStores, epAuthBucket, isReachable, jwtFromCreds, managedRetirementOpId, mintCreds, mintPublicUserJwt, newIdentity, observeHostedRunAttempt, openRecordsBucket, parseEndpointGate, parseServiceSpec, parseServiceStatus, rawDigest, parseSecretStoreIdentity, readCheckpointStatus, readRunAdmission, readRunRecord, readSvcRecordLeader, reconcileEndpointGate, sameSecretStoreIdentity, recordSpecKey, recordStatusKey, RECORD_KINDS, recordsBucket, remoteManagerActors, retirementFrontierStreams, runDriverCaller, serveIssuanceGateKv, standaloneConnectOpts, STANDING_RENEWABLE_TTL_SEC, withIssuerSession, authorizeServeGrant, contractArtifactCanonicalBytes, DEV_OWNER, endpointRegistrationBarrier, mintLifecycleUid, principalKey, provisionEndpointGateOpen, publishContractArtifact, registerServiceInstance, SERVICE_READY, writeServiceStatus } from "@cotal-ai/core";
 import { findCotalRoot, loadManagerInstanceIdentity, userAuthStateDir, workspaceSecretStore, createAuthInstanceIdentity, loadAuthInstanceIdentity } from "@cotal-ai/workspace";
 import { decodeJwt } from "jose";
-import { deriveOwnerForIdpSubject } from "./derive.js";
+import { deriveOwnerForIdpSubject, platformControlOwner } from "./derive.js";
+import { makePlatformControlAuthority, requireManagerAuthorityHolder } from "./platform-control.js";
 import { startAuthCallout } from "./callout.js";
 import { createIdpBridge, verifyIdpToken } from "./idp.js";
 import { PUBLIC_EXCHANGE_VIEWS } from "./token.js";
@@ -617,13 +619,12 @@ export async function openAuthAuthorityPlane(opts) {
             await flight;
             return { retired: true, lifecycleUid };
         },
-        issueManagerServiceAuthority: async ({ owner, scope, request }) => {
+        issueManagerServiceAuthority: async (holder) => {
             refuseIfFenced();
+            const { owner } = holder;
             const observeManagerGate = async (instanceId) => (await serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId }).observe()) ?? null;
             return issueRemoteManagerAuthority({
-                owner,
-                scope,
-                request,
+                ...holder,
                 authorizeRenewal: ({ owner: o, request: r }) => authorizeRemoteManagerRenewal({
                     request: r, owner: o, space, accountPublicKey: dataAccount.pub, proofSecret: dataAccount.signingSeed,
                     observeManagerGate,
@@ -821,14 +822,13 @@ export async function openAuthAuthorityPlane(opts) {
                 },
             });
         },
-        maintainRemoteManager: async ({ owner, scope, request }) => {
+        maintainRemoteManager: async (holder) => {
             refuseIfFenced();
+            const { owner } = holder;
             const gateKv = await new Kvm(remoteIssuer.nc).open(epAuthBucket(space));
             const authorized = await authorizeRemoteManagerMaintenance({
-                owner,
-                scope,
+                ...holder,
                 space,
-                request,
                 scanner,
                 observeManagerGate: async (instanceId) => serveIssuanceGateKv(gateKv, space, { endpoint: "manager", instanceId }).observe(),
             });
@@ -876,14 +876,12 @@ export async function openAuthAuthorityPlane(opts) {
             }
             return completeRemoteManagerMaintenance(authorized, owner, { reconciliation: report });
         },
-        validateRetainedAgent: async ({ owner, scope, request }) => {
+        validateRetainedAgent: async (holder) => {
             refuseIfFenced();
             return authorizeRemoteRetainedAgentValidation({
-                owner,
-                scope,
+                ...holder,
                 proofSecret: dataAccount.signingSeed,
                 space,
-                request,
                 observeManagerGate: async (instanceId) => {
                     const gate = serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId });
                     return gate.observe();
@@ -934,10 +932,11 @@ export async function openAuthAuthorityPlane(opts) {
                 ? authorizeRemoteManagedAgentRuntimeStatus({ ...args, request })
                 : authorizeRemoteManagedAgentRuntimeCreate({ ...args, request });
         },
-        scanManagerGoalIndex: async ({ owner, scope, request }) => {
+        scanManagerGoalIndex: async (holder) => {
             refuseIfFenced();
+            const { owner } = holder;
             const authorized = await authorizeRemoteManagerGoalIndexScan({
-                owner, scope, proofSecret: dataAccount.signingSeed, space, request,
+                ...holder, proofSecret: dataAccount.signingSeed, space,
                 observeManagerGate: async (instanceId) => {
                     const gate = serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId });
                     return gate.observe();
@@ -945,11 +944,11 @@ export async function openAuthAuthorityPlane(opts) {
             });
             return completeRemoteManagerGoalIndexScan(authorized, owner, await recordsScanner.scanManagerGoalIndex(owner));
         },
-        authorizeManagerAdmin: async ({ owner, scope, request }) => {
+        authorizeManagerAdmin: async ({ request, ...holder }) => {
             refuseIfFenced();
             return authorizeRemoteManagerAdmin({
-                managerOwner: owner,
-                managerScope: scope,
+                managerOwner: holder.owner,
+                ...(holder.holder === "platform" ? { managerAssignment: holder.assignment } : { managerScope: holder.scope }),
                 proofSecret: dataAccount.signingSeed,
                 space,
                 dir: opts.dir,
@@ -960,10 +959,10 @@ export async function openAuthAuthorityPlane(opts) {
                 },
             });
         },
-        admitManagerRun: async ({ owner, scope, request }) => {
+        admitManagerRun: async ({ request, ...holder }) => {
             refuseIfFenced();
-            if (!scope.includes("supervise"))
-                throw new EpEnvelopeError("permission-denied", 'manager run admission needs scope "supervise"; spawn/admin do not imply it');
+            const { owner } = holder;
+            requireManagerAuthorityHolder(holder, String(request?.instanceId), 'manager run admission needs scope "supervise"; spawn/admin do not imply it');
             const runId = parseRemoteRunAdmissionRequest(request).run.runId;
             const hostAuth = {
                 space,
@@ -997,10 +996,10 @@ export async function openAuthAuthorityPlane(opts) {
                 }
             });
         },
-        issueManagerRunAttempt: async ({ owner, scope, request }) => {
+        issueManagerRunAttempt: async ({ request, ...holder }) => {
             refuseIfFenced();
-            if (!scope.includes("supervise"))
-                throw new EpEnvelopeError("permission-denied", 'manager run attempt needs scope "supervise"; spawn/admin do not imply it');
+            const { owner } = holder;
+            requireManagerAuthorityHolder(holder, String(request?.instanceId), 'manager run attempt needs scope "supervise"; spawn/admin do not imply it');
             const req = parseRemoteRunAttemptRequest(request);
             const recordsKv = await openRecordsBucket(remoteIssuer.nc, space);
             const grant = await authorizeRemoteRunAttempt({
@@ -1078,6 +1077,12 @@ export async function openAuthAuthorityPlane(opts) {
                 credentials: { operator },
             };
         },
+        observeManagerInstance: async (instanceId) => {
+            refuseIfFenced();
+            const gate = await serveIssuanceGateKv(await new Kvm(remoteIssuer.nc).open(epAuthBucket(space)), space, { endpoint: "manager", instanceId }).observe();
+            const rec = await readSvcRecordLeader(recordsJsm, space, recordSpecKey(RECORD_KINDS.svc, ["manager", instanceId]));
+            return { registered: rec !== undefined && !("deleted" in rec), gate: gate ?? null };
+        },
         fenced,
         close: async () => {
             // Clean-close order (SPEC 13.13): the rail stops answering first, then scan-capable
@@ -1188,27 +1193,19 @@ export async function runAuthService(args, store) {
     if (publicPort !== undefined && (!Number.isInteger(publicPort) || publicPort < 0 || publicPort > 65535))
         throw new Error(`auth-service: --exchange-public-port must be a port number, got "${publicPortRaw}"`);
     const publicUrlFlag = v["exchange-public-url"];
-    if (publicUrlFlag !== undefined && !/^https:\/\//.test(publicUrlFlag))
-        throw new Error(`auth-service: --exchange-public-url must be an https:// URL (TLS terminates at the reverse proxy), got "${publicUrlFlag}"`);
     const trustedProxy = v["exchange-trusted-proxy"] !== undefined;
     if (publicPort === undefined && (publicUrlFlag !== undefined || trustedProxy))
         throw new Error("auth-service: --exchange-public-url/--exchange-trusted-proxy require --exchange-public-port");
     const advertisedServer = v["advertised-server"];
     if (advertisedServer !== undefined && publicPort === undefined)
         throw new Error("auth-service: --advertised-server rides the public bundle - it requires --exchange-public-port");
-    if (advertisedServer !== undefined) {
-        const badAdvertised = checkAdvertisedServer(advertisedServer);
-        if (badAdvertised)
-            throw new Error(badAdvertised);
-    }
     const agentProvisioningUrl = v["agent-provisioning-url"];
     if (agentProvisioningUrl !== undefined && publicPort === undefined)
         throw new Error("auth-service: --agent-provisioning-url rides the public bundle - it requires --exchange-public-port");
-    if (agentProvisioningUrl !== undefined) {
-        const badProvisioning = checkAgentProvisioningUrl(agentProvisioningUrl);
-        if (badProvisioning)
-            throw new Error(badProvisioning);
-    }
+    const publicFace = publicPort === undefined ? undefined : { port: publicPort, url: publicUrlFlag, trustedProxy, advertisedServer, agentProvisioningUrl };
+    const badFace = publicFace && checkPublicFace(publicFace);
+    if (badFace)
+        throw new Error(badFace);
     // The provider's space-scoped state dir for NON-SEAM material (ledger, IdP pin, discovery). The
     // layout fact is workspace-owned (userAuthStateDir); this daemon never touches `.cotal/auth/auth.json`.
     const root = findCotalRoot();
@@ -1238,14 +1235,15 @@ export async function runAuthService(args, store) {
         dir,
         secrets,
         hostedStore: store !== undefined,
-        ...(publicPort !== undefined ? { publicFace: { port: publicPort, urlFlag: publicUrlFlag, trustedProxy, advertisedServer, agentProvisioningUrl } } : {}),
+        ...(publicFace !== undefined ? { publicFace } : {}),
         // The CLI composition's local manager is this workspace root's persisted instance, re-read per
         // selection exactly as before. A hosted context passes no local manager at all.
         localManager: () => loadManagerInstanceIdentity(root, space),
     });
     // All planes bound — NOW write the discovery file (its existence is the readiness signal).
-    saveAuthServiceInfo(dir, { url: started.url, pid: process.pid, cap: started.cap, ...(started.publicUrl !== undefined ? { publicUrl: started.publicUrl } : {}) });
-    console.log(`✓ auth service up (space ${space}) - callout on ${server}, exchange/JWKS at ${started.url}${started.publicUrl !== undefined ? `, public exchange at ${started.publicUrl}` : ""}`);
+    const { url, publicUrl, cap } = started.handle;
+    saveAuthServiceInfo(dir, { url, pid: process.pid, cap, ...(publicUrl !== undefined ? { publicUrl } : {}) });
+    console.log(`✓ auth service up (space ${space}) - callout on ${server}, exchange/JWKS at ${url}${publicUrl !== undefined ? `, public exchange at ${publicUrl}` : ""}`);
     // The CLI wrapper, not the context, owns process signals and exit codes.
     const stop = async () => {
         clearAuthServiceInfo(dir); // a dead service must not satisfy the next start's readiness poll
@@ -1288,6 +1286,11 @@ export async function startAuthService(inputs) {
     const port = inputs.port ?? 0;
     if (!Number.isInteger(port) || port < 0 || port > 65535)
         throw new Error(`auth-service: port must be a port number, got ${port}`);
+    if (inputs.platformControl !== undefined && typeof inputs.platformControl?.observeAssignment !== "function")
+        throw new Error("auth-service: platformControl requires an observeAssignment function");
+    const badFace = inputs.publicFace && checkPublicFace(inputs.publicFace);
+    if (badFace)
+        throw new Error(badFace);
     const started = await startAuthContext({
         space: inputs.space,
         server: inputs.servers,
@@ -1297,6 +1300,9 @@ export async function startAuthService(inputs) {
         hostedStore: true,
         localManager: () => undefined,
         context: inputs.context,
+        ...(inputs.publicFace !== undefined ? { publicFace: inputs.publicFace } : {}),
+        ...(inputs.platformControl !== undefined ? { platformControl: inputs.platformControl } : {}),
+        ...(inputs.standingRenewableTtlSeconds !== undefined ? { standingRenewableTtlSeconds: inputs.standingRenewableTtlSeconds } : {}),
     });
     return started.handle;
 }
@@ -1332,6 +1338,7 @@ async function startAuthContext(o) {
         dataAccount: { pub: keys.dataAccount.pub, signingSeed: keys.dataAccount.signingSeed },
         log: (l) => console.error(l),
         localManager: o.localManager,
+        ...(o.standingRenewableTtlSeconds !== undefined ? { standingRenewableTtlSeconds: o.standingRenewableTtlSeconds } : {}),
     });
     let nc;
     let http;
@@ -1444,7 +1451,7 @@ async function startAuthContext(o) {
             });
             const paddr = pub.address();
             const boundPublic = typeof paddr === "object" && paddr ? paddr.port : face.port;
-            publicUrl = face.urlFlag ?? `http://127.0.0.1:${boundPublic}`;
+            publicUrl = face.url ?? `http://127.0.0.1:${boundPublic}`;
             finalizeUserBundleEndpoint(bundle, publicUrl);
         }
         const callNc = nc;
@@ -1476,9 +1483,47 @@ async function startAuthContext(o) {
             return end;
         });
         const context = o.context ?? { accountPublicKey: keys.dataAccount.pub, lifecycleUid: "" };
+        const platformControl = o.platformControl;
+        // The human route's retained-validation composition, for the platform holder.
+        const validateRetainedForHolder = async (holder, request) => {
+            const retained = await plane.validateRetainedAgent({ ...holder, request });
+            const authority = await validateRetainedManagedAgent({
+                store: secrets,
+                dir,
+                space,
+                owner: retained.target.owner,
+                actor: retained.target.actor,
+                actorToken: retained.actorToken,
+                sentinelCreds: retained.sentinelCreds,
+            });
+            return completeRemoteRetainedAgentValidation(retained, holder.owner, authority);
+        };
         const service = {
             url,
             ...(publicUrl !== undefined ? { publicUrl } : {}),
+            cap,
+            ...(platformControl !== undefined ? {
+                platformControlAuthority: makePlatformControlAuthority({
+                    space,
+                    accountPublicKey: keys.dataAccount.pub,
+                    owner: platformControlOwner(ownerSecret, space, keys.dataAccount.pub),
+                    observeAssignment: (s, a) => platformControl.observeAssignment(s, a),
+                    observeManagerInstance: plane.observeManagerInstance,
+                    dispatch: (holder, request) => {
+                        if (state !== "ready" || closePromise !== undefined)
+                            throw new EpEnvelopeError("unavailable", "auth-service context is not ready");
+                        switch (request.kind) {
+                            case "manager-service-authority": return plane.issueManagerServiceAuthority({ ...holder, request });
+                            case "manager-service-maintenance": return plane.maintainRemoteManager({ ...holder, request });
+                            case "manager-goal-index-scan": return plane.scanManagerGoalIndex({ ...holder, request });
+                            case "manager-admin-authorization": return plane.authorizeManagerAdmin({ ...holder, request });
+                            case "manager-run-admission": return plane.admitManagerRun({ ...holder, request });
+                            case "manager-run-attempt": return plane.issueManagerRunAttempt({ ...holder, request });
+                            case "manager-retained-agent-validation": return validateRetainedForHolder(holder, request);
+                        }
+                    },
+                }),
+            } : {}),
             readiness() {
                 if (state === "unavailable")
                     return { state, context, cause: cause ?? "auth-service context is unavailable" };
@@ -1487,7 +1532,7 @@ async function startAuthContext(o) {
             drain: close,
             close,
         };
-        return { url, ...(publicUrl !== undefined ? { publicUrl } : {}), cap, handle: service, ended };
+        return { handle: service, ended };
     }
     catch (e) {
         // A failed start releases only what THIS context acquired, in reverse order.
@@ -2009,6 +2054,16 @@ export function checkAdvertisedServer(raw) {
         return `auth-service: --advertised-server must be a broker URL (nats://, tls://, ws:// or wss://), got ${u.protocol}//`;
     return undefined;
 }
+/** The public face's value rules, one set for the CLI flags and the hosted input. A public face
+ *  without a port has no listener for the rest to apply to. */
+function checkPublicFace(face) {
+    if (!Number.isInteger(face.port) || face.port < 0 || face.port > 65535)
+        return `auth-service: a public face needs a port number, got ${face.port}`;
+    if (face.url !== undefined && !/^https:\/\//.test(face.url))
+        return `auth-service: --exchange-public-url must be an https:// URL (TLS terminates at the reverse proxy), got "${face.url}"`;
+    return (face.advertisedServer !== undefined ? checkAdvertisedServer(face.advertisedServer) : undefined)
+        ?? (face.agentProvisioningUrl !== undefined ? checkAgentProvisioningUrl(face.agentProvisioningUrl) : undefined);
+}
 /** Compose the user bundle the public face serves at /.well-known/cotal-mesh. ONE producer,
  *  exported so the consumer contract (`checkUserBundle` in the CLI) can be asserted against the
  *  real composition rather than a copy. The trust pins ride a `userAuth` arm because that is the