@cotal-ai/auth 0.61.0 → 0.63.0

package/dist/authority-client.d.ts

@@ -25,7 +25,7 @@
  * service restart; there is no file-only fallback.
  */
 import { type NatsConnection } from "@nats-io/transport-node";
-import { remoteManagerRegistrationProof, type PlaneConnTuple } from "@cotal-ai/core";
+import { remoteManagerRegistrationProof, type EpCaller, type PlaneConnTuple } from "@cotal-ai/core";
 import { type ConnectReader } from "./connect-reader.js";
 /** Self-minted infra-credential TTL (fact-3 pin: SHORT expiry + in-process renewal, a bounded
  *  in-memory credential that closes with the service — never an unbounded persisted one). */
@@ -61,6 +61,18 @@ export declare function remoteManagerIssuerGrants(space: string, connId: string)
     publish: string[];
     subscribe: string[];
 };
+/** The PLATFORM READINESS reader (SPEC 13.9): `describe` and `status` of one manager instance on
+ * its `inst` rail only, the contract-store read `resolveService` verifies the describe answer with,
+ * and its own reply rail and inbox. No other command, instance, class route or store. */
+export declare function platformReadinessGrants(space: string, connId: string, caller: EpCaller, instanceId: string): {
+    publish: string[];
+    subscribe: string[];
+};
+/** The manager request subjects whose served form a participant manager forwards for a resume or
+ *  an answer (SPEC 14.8), on both routes a caller addresses a manager by. The issuing host reads
+ *  them and never replies: the broker let only the caller's ceiling publish each one, so observing
+ *  it is the host's own evidence that the caller asked. */
+export declare function servedRunRequestSubjects(space: string): string[];
 export { remoteManagerRegistrationProof };
 /**
  * The AUTH PLANE's OWN registration executor grant (#399 M2): the ONE `(auth, instanceId)`

package/dist/authority-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authority-client.d.ts","sourceRoot":"","sources":["../src/authority-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAGzF,OAAO,EAAyQ,8BAA8B,EAA+J,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACzf,OAAO,EAA8C,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAErG;6FAC6F;AAC7F,eAAO,MAAM,wBAAwB,QAAU,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CA0B/G;AAED;;qEAEqE;AACrE,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CA8BnH;AAED,OAAO,EAAE,8BAA8B,EAAE,CAAC;AAE1C;;;;;;;;;;;GAWG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAqC5I;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CA6DhH;AAED;;;;;;;;;;;;;;;;;;;;iGAoBiG;AACjG,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAcvH;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,mGAAmG;IACnG,KAAK,EAAE,MAAM,CAAC;IACd;mDAC+C;IAC/C,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACvE;;;;2GAIuG;IACvG,SAAS,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B;;qDAEiD;IACjD,gBAAgB,CAAC,EAAE,MAAM,IAAI,CAAC;IAC9B;;8DAE0D;IAC1D,YAAY,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACtD;;;;;;;;kFAQ8E;IAC9E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;;;;;;;kGAa8F;IAC9F,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,cAAc,CAAC;IACnB,wFAAwF;IACxF,MAAM,EAAE,MAAM,CAAC;IACf;oFACgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;4EACwE;IACxE,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB;;sDAEkD;IAClD,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACrB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,eAAe,CAAC,CAuE7F;AAED,MAAM,WAAW,uBAAuB;IACtC;;8CAE0C;IAC1C,OAAO,IAAI,aAAa,CAAC;IACzB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,IAAI,CAAC,mBAAmB,EAAE,QAAQ,GAAG,OAAO,CAAC,GAClD,OAAO,CAAC,uBAAuB,CAAC,CAqDlC"}
+{"version":3,"file":"authority-client.d.ts","sourceRoot":"","sources":["../src/authority-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAGzF,OAAO,EAAyQ,8BAA8B,EAAgP,KAAK,QAAQ,EAAE,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACzlB,OAAO,EAA8C,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAErG;6FAC6F;AAC7F,eAAO,MAAM,wBAAwB,QAAU,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CA0B/G;AAED;;qEAEqE;AACrE,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CA8BnH;AAED;;yFAEyF;AACzF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CASvJ;AAED;;;2DAG2D;AAC3D,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAShE;AAED,OAAO,EAAE,8BAA8B,EAAE,CAAC;AAE1C;;;;;;;;;;;GAWG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAqC5I;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CA6DhH;AAED;;;;;;;;;;;;;;;;;;;;iGAoBiG;AACjG,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAcvH;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,mGAAmG;IACnG,KAAK,EAAE,MAAM,CAAC;IACd;mDAC+C;IAC/C,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACvE;;;;2GAIuG;IACvG,SAAS,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B;;qDAEiD;IACjD,gBAAgB,CAAC,EAAE,MAAM,IAAI,CAAC;IAC9B;;8DAE0D;IAC1D,YAAY,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACtD;;;;;;;;kFAQ8E;IAC9E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;;;;;;;kGAa8F;IAC9F,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,cAAc,CAAC;IACnB,wFAAwF;IACxF,MAAM,EAAE,MAAM,CAAC;IACf;oFACgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;4EACwE;IACxE,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB;;sDAEkD;IAClD,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACrB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,eAAe,CAAC,CAuE7F;AAED,MAAM,WAAW,uBAAuB;IACtC;;8CAE0C;IAC1C,OAAO,IAAI,aAAa,CAAC;IACzB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,IAAI,CAAC,mBAAmB,EAAE,QAAQ,GAAG,OAAO,CAAC,GAClD,OAAO,CAAC,uBAAuB,CAAC,CAqDlC"}

package/dist/authority-client.js

@@ -27,7 +27,7 @@
 import { connect, jwtAuthenticator } from "@nats-io/transport-node";
 import { encodeUser } from "@nats-io/jwt";
 import { fromPublic, fromSeed } from "@nats-io/nkeys";
-import { EpEnvelopeError, admissionBucket, sessionsBucket, assertInboxConnId, endpointToken, epAuthBucket, epcStreamName, epfStreamName, newIdentity, recordsBucket, retirementFrontierStreams, spacePrefix, assertPoolToken, principalTags, principalKey, remoteManagerActors, remoteManagerRegistrationProof, AUTH_ENDPOINT, assertLifecycleToken, epcredFamilyPrefix, epgateKey, eprepairKey, GOVERN_HEAD, RECORD_KINDS, recordAtomicKey, recordSpecKey, recordStatusKey } from "@cotal-ai/core";
+import { EpEnvelopeError, admissionBucket, sessionsBucket, assertInboxConnId, endpointToken, epAuthBucket, epcStreamName, epfStreamName, newIdentity, recordsBucket, retirementFrontierStreams, spacePrefix, assertPoolToken, principalTags, principalKey, remoteManagerActors, remoteManagerRegistrationProof, AUTH_ENDPOINT, assertLifecycleToken, epcredFamilyPrefix, epgateKey, eprepairKey, GOVERN_HEAD, RECORD_KINDS, recordAtomicKey, recordSpecKey, recordStatusKey, BASELINE_LIFECYCLE_ENDPOINT, epCallerGrantRows, instanceOnlyManagerCapabilities } from "@cotal-ai/core";
 import { authConnectReaderGrants, openConnectReader } from "./connect-reader.js";
 /** Self-minted infra-credential TTL (fact-3 pin: SHORT expiry + in-process renewal, a bounded
  *  in-memory credential that closes with the service — never an unbounded persisted one). */
@@ -110,9 +110,33 @@ export function remoteManagerIssuerGrants(space, connId) {
             `$JS.API.STREAM.INFO.KV_${sessionsBucket(space)}`,
             `$JS.API.STREAM.MSG.GET.KV_${sessionsBucket(space)}`,
         ],
-        subscribe: base.subscribe,
+        subscribe: [...base.subscribe, ...servedRunRequestSubjects(space)],
     };
 }
+/** The PLATFORM READINESS reader (SPEC 13.9): `describe` and `status` of one manager instance on
+ * its `inst` rail only, the contract-store read `resolveService` verifies the describe answer with,
+ * and its own reply rail and inbox. No other command, instance, class route or store. */
+export function platformReadinessGrants(space, connId, caller, instanceId) {
+    const rows = epCallerGrantRows(space, instanceOnlyManagerCapabilities(["describe", "status"].map((command) => ({ endpoint: BASELINE_LIFECYCLE_ENDPOINT, command })), instanceId), caller);
+    return {
+        publish: [`$JS.API.DIRECT.GET.${epcStreamName(space)}.${spacePrefix(space)}.epc.>`, ...rows.pub],
+        subscribe: [`_INBOX_${assertInboxConnId(connId)}.>`, ...rows.sub],
+    };
+}
+/** The manager request subjects whose served form a participant manager forwards for a resume or
+ *  an answer (SPEC 14.8), on both routes a caller addresses a manager by. The issuing host reads
+ *  them and never replies: the broker let only the caller's ceiling publish each one, so observing
+ *  it is the host's own evidence that the caller asked. */
+export function servedRunRequestSubjects(space) {
+    const p = spacePrefix(space);
+    const m = endpointToken("manager");
+    return [
+        ...["run-resume", "run-answer"].flatMap((c) => [`${p}.ep.v1.inst.${m}.*.${c}.>`, `${p}.ep.v1.one.${m}.${c}.>`]),
+        // A managed seat answers on the legacy rail, the relay path; nothing else served there is forwarded.
+        `${p}.ep.inst.${m}.*.run-answer.>`,
+        `${p}.ep.one.${m}.run-answer.>`,
+    ];
+}
 export { remoteManagerRegistrationProof };
 /**
  * The AUTH PLANE's OWN registration executor grant (#399 M2): the ONE `(auth, instanceId)`

package/dist/authority-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"authority-client.js","sourceRoot":"","sources":["../src/authority-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAuB,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,iBAAiB,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,yBAAyB,EAAE,WAAW,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAE,mBAAmB,EAAE,8BAA8B,EAAE,aAAa,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,eAAe,EAAuB,MAAM,gBAAgB,CAAC;AACzf,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAsB,MAAM,qBAAqB,CAAC;AAErG;6FAC6F;AAC7F,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,EAAE,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,MAAc;IACjE,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7C,gGAAgG;IAChG,2EAA2E;IAC3E,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO;QACL,OAAO,EAAE;YACP,cAAc;YACd,yBAAyB,IAAI,EAAE;YAC/B,yBAAyB,OAAO,EAAE;YAClC,yBAAyB,OAAO,EAAE;YAClC,uBAAuB,IAAI,EAAE;YAC7B,uBAAuB,OAAO,EAAE;YAChC,0BAA0B,IAAI,EAAE;YAChC,0BAA0B,OAAO,EAAE;YACnC,sBAAsB,OAAO,EAAE;YAC/B,sBAAsB,OAAO,IAAI;YACjC,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,UAAU;YACpC,OAAO,aAAa,CAAC,KAAK,CAAC,cAAc;YACzC,OAAO,aAAa,CAAC,KAAK,CAAC,QAAQ;SACpC;QACD,SAAS,EAAE,CAAC,UAAU,KAAK,IAAI,CAAC;KACjC,CAAC;AACJ,CAAC;AAED;;qEAEqE;AACrE,MAAM,UAAU,yBAAyB,CAAC,KAAa,EAAE,MAAc;IACrE,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;IACjD,OAAO;QACL,OAAO,EAAE;YACP,GAAG,IAAI,CAAC,OAAO;YACf,4FAA4F;YAC5F,8FAA8F;YAC9F,6FAA6F;YAC7F,4FAA4F;YAC5F,6FAA6F;YAC7F,oEAAoE;YACpE,OAAO,YAAY,CAAC,KAAK,CAAC,mBAAmB;YAC7C,OAAO,YAAY,CAAC,KAAK,CAAC,mBAAmB;YAC7C,6FAA6F;YAC7F,uFAAuF;YACvF,sBAAsB,aAAa,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,QAAQ;YACxE,sBAAsB,aAAa,CAAC,KAAK,CAAC,EAAE;YAC5C,0FAA0F;YAC1F,uBAAuB,SAAS,EAAE;YAClC,0BAA0B,SAAS,EAAE;YACrC,sBAAsB,SAAS,EAAE;YACjC,sBAAsB,SAAS,IAAI;YACnC,4FAA4F;YAC5F,2FAA2F;YAC3F,0BAA0B,cAAc,CAAC,KAAK,CAAC,EAAE;YACjD,6BAA6B,cAAc,CAAC,KAAK,CAAC,EAAE;SACrD;QACD,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,8BAA8B,EAAE,CAAC;AAE1C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,8BAA8B,CAAC,KAAa,EAAE,MAAc,EAAE,UAAkB;IAC9F,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,SAAS,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,kBAAkB,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,WAAW,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG;QACjB,aAAa,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,aAAa,EAAE,oBAAoB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;QAChG,eAAe,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,aAAa,EAAE,oBAAoB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;QAClG,eAAe,CAAC,WAAW,EAAE,CAAC,aAAa,CAAC,CAAC;KAC9C,CAAC;IACF,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO;QACL,OAAO,EAAE;YACP,cAAc;YACd,0BAA0B,IAAI,EAAE;YAChC,0BAA0B,OAAO,EAAE;YACnC,oGAAoG;YACpG,+FAA+F;YAC/F,+FAA+F;YAC/F,oGAAoG;YACpG,oGAAoG;YACpG,2BAA2B;YAC3B,2BAA2B,IAAI,IAAI;YACnC,yBAAyB,IAAI,IAAI;YACjC,2BAA2B,IAAI,IAAI;YACnC,sBAAsB,aAAa,CAAC,KAAK,CAAC,EAAE;YAC5C,sBAAsB,aAAa,CAAC,KAAK,CAAC,IAAI;YAC9C,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,OAAO,EAAE;YACvC,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,SAAS,EAAE;YACzC,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,UAAU,IAAI;YAC5C,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5D,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ;YAC7B,sBAAsB,aAAa,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,QAAQ;SACzE;QACD,SAAS,EAAE,CAAC,UAAU,KAAK,IAAI,CAAC;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa,EAAE,MAAc;IAClE,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7C,6FAA6F;IAC7F,mEAAmE;IACnE,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxC,sFAAsF;IACtF,0FAA0F;IAC1F,iGAAiG;IACjG,gGAAgG;IAChG,kGAAkG;IAClG,2CAA2C;IAC3C,MAAM,YAAY,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC;IAC7F,OAAO;QACL,OAAO,EAAE;YACP,cAAc;YACd,uBAAuB,IAAI,EAAE;YAC7B,uBAAuB,OAAO,EAAE;YAChC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,uBAAuB,OAAO,EAAE,CAAC;YACrE,0BAA0B,IAAI,EAAE;YAChC,0BAA0B,OAAO,EAAE;YACnC,sBAAsB,OAAO,EAAE;YAC/B,sBAAsB,OAAO,IAAI;YACjC,6FAA6F;YAC7F,4FAA4F;YAC5F,mFAAmF;YACnF,8FAA8F;YAC9F,6FAA6F;YAC7F,0FAA0F;YAC1F,yFAAyF;YACzF,4FAA4F;YAC5F,8FAA8F;YAC9F,2FAA2F;YAC3F,4FAA4F;YAC5F,4FAA4F;YAC5F,yEAAyE;YACzE,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,2FAA2F;YAC3F,0FAA0F;YAC1F,yFAAyF;YACzF,yFAAyF;YACzF,mFAAmF;YACnF,OAAO,YAAY,CAAC,KAAK,CAAC,UAAU;YACpC,2FAA2F;YAC3F,yFAAyF;YACzF,uFAAuF;YACvF,sFAAsF;YACtF,wFAAwF;YACxF,mCAAmC;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,QAAQ;YAClC,OAAO,aAAa,CAAC,KAAK,CAAC,cAAc;YACzC,sFAAsF;YACtF,uFAAuF;YACvF,sFAAsF;YACtF,yFAAyF;YACzF,2EAA2E;YAC3E,OAAO,aAAa,CAAC,KAAK,CAAC,aAAa;SACzC;QACD,SAAS,EAAE,CAAC,UAAU,KAAK,IAAI,CAAC;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;iGAoBiG;AACjG,MAAM,UAAU,+BAA+B,CAAC,KAAa,EAAE,QAAgB,EAAE,KAAe;IAC9F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAC7C,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,gJAAgJ,CAAC,CAAC;IACrM,MAAM,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,CAAC,IAAI,CACV,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAC3C,OAAO,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAChD,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,0BAA0B,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/D,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC;AAsED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAyB;IACjE,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;IAChF,MAAM,IAAI,GAAG,KAAK,IAAqB,EAAE,CACvC,UAAU,CACR,IAAI,CAAC,KAAK,EACV,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,EACvB,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAChC,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE;QAChE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;IAClG,6FAA6F;IAC7F,qFAAqF;IACrF,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,wBAAwB,EAAE,CAC7G,CAAC;IACJ,IAAI,UAAU,GAAG,MAAM,IAAI,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,KAAK,IAAqB,EAAE;QACxC,IAAI,IAAI,CAAC,YAAY,EAAE,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC7E,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;IACF,yFAAyF;IACzF,iEAAiE;IACjE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE;QACjE,KAAK,KAAK,EAAE,CAAC,IAAI,CACf,CAAC,GAAG,EAAE,EAAE,GAAG,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,EAC9B,CAAC,CAAC,EAAE,EAAE;YACJ,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,gCAAiC,CAAW,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,uDAAuD,CAAC,CAAC;YACjJ,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;QAC5B,CAAC,CACF,CAAC;IACJ,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,IAAI,CAAC,wBAAwB,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3E,IAAI,EAAkB,CAAC;IACvB,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,OAAO,CAAC;YACjB,OAAO,EAAE,IAAI,CAAC,MAAM;YACpB,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,aAAa,EAAE,gBAAgB,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC1F,WAAW,EAAE,UAAU,QAAQ,CAAC,EAAE,EAAE;YACpC,+FAA+F;YAC/F,uFAAuF;YACvF,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,EAAE,CAAC;SAC5H,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,OAAO,KAAK,SAAS;YAAE,aAAa,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,CAAC;IACV,CAAC;IACD,IAAI,KAAiC,CAAC;IACtC,IAAI,IAA+B,CAAC;IACpC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,4FAA4F;QAC5F,2EAA2E;QAC3E,MAAM,IAAI,GAAG,EAAE,CAAC,IAA8D,CAAC;QAC/E,IAAI,OAAO,IAAI,EAAE,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YAClE,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC;YACvG,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACjC,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,KAAK,iGAAiG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,gFAAgF,CAAC,CAAC;QACxT,CAAC;QACD,KAAK,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjF,IAAI,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO;QACL,EAAE;QACF,MAAM,EAAE,QAAQ,CAAC,EAAE;QACnB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,IAAI,OAAO,KAAK,SAAS;gBAAE,aAAa,CAAC,OAAO,CAAC,CAAC;YAClD,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnC,CAAC;KACF,CAAC;AACJ,CAAC;AAUD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,IAAmD;IAEnD,MAAM,KAAK,GAAG,qBAAqB,IAAI,CAAC,KAAK,EAAE,CAAC;IAChD,IAAI,MAAiC,CAAC;IACtC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,MAAmC,CAAC;IACxC,MAAM,GAAG,MAAM,mBAAmB,CAAC;QACjC,GAAG,IAAI;QACP,KAAK;QACL,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;QAC/D,sFAAsF;QACtF,4FAA4F;QAC5F,gBAAgB,EAAE,GAAG,EAAE;YACrB,MAAM,GAAG,SAAS,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,yGAAyG,CAAC,CAAC;YAC5H,IAAI,CAAC,MAAM;gBAAE,KAAK,MAAM,EAAE,KAAK,EAAE,CAAC;QACpC,CAAC;KACF,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,MAAM,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,CAAC;IACV,CAAC;IACD,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;YACpC,IAAI,MAAM;gBAAE,MAAM;YAClB,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAClD,MAAM,GAAG,SAAS,CAAC;gBACnB,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,sBAAsB,CAAC,CAAC,IAAI,uDAAuD,CAAC,CAAC;YACxG,CAAC;iBAAM,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAClC,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;oBACnD,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,kDAAkD,CAAC,CAAC;gBACvE,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,GAAG,SAAS,CAAC;oBACnB,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,gCAAiC,CAAW,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC;gBACjH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,OAAO;QACL,OAAO,EAAE,GAAG,EAAE;YACZ,IAAI,MAAM,KAAK,SAAS;gBACtB,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,+KAA+K,CAAC,CAAC;YAC5N,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,GAAG,IAAI,CAAC;YACd,MAAM,GAAG,SAAS,CAAC,CAAC,oEAAoE;YACxF,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"authority-client.js","sourceRoot":"","sources":["../src/authority-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAuB,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,iBAAiB,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,yBAAyB,EAAE,WAAW,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAE,mBAAmB,EAAE,8BAA8B,EAAE,aAAa,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,eAAe,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,+BAA+B,EAAsC,MAAM,gBAAgB,CAAC;AACzlB,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAsB,MAAM,qBAAqB,CAAC;AAErG;6FAC6F;AAC7F,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,EAAE,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,MAAc;IACjE,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7C,gGAAgG;IAChG,2EAA2E;IAC3E,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO;QACL,OAAO,EAAE;YACP,cAAc;YACd,yBAAyB,IAAI,EAAE;YAC/B,yBAAyB,OAAO,EAAE;YAClC,yBAAyB,OAAO,EAAE;YAClC,uBAAuB,IAAI,EAAE;YAC7B,uBAAuB,OAAO,EAAE;YAChC,0BAA0B,IAAI,EAAE;YAChC,0BAA0B,OAAO,EAAE;YACnC,sBAAsB,OAAO,EAAE;YAC/B,sBAAsB,OAAO,IAAI;YACjC,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,UAAU;YACpC,OAAO,aAAa,CAAC,KAAK,CAAC,cAAc;YACzC,OAAO,aAAa,CAAC,KAAK,CAAC,QAAQ;SACpC;QACD,SAAS,EAAE,CAAC,UAAU,KAAK,IAAI,CAAC;KACjC,CAAC;AACJ,CAAC;AAED;;qEAEqE;AACrE,MAAM,UAAU,yBAAyB,CAAC,KAAa,EAAE,MAAc;IACrE,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;IACjD,OAAO;QACL,OAAO,EAAE;YACP,GAAG,IAAI,CAAC,OAAO;YACf,4FAA4F;YAC5F,8FAA8F;YAC9F,6FAA6F;YAC7F,4FAA4F;YAC5F,6FAA6F;YAC7F,oEAAoE;YACpE,OAAO,YAAY,CAAC,KAAK,CAAC,mBAAmB;YAC7C,OAAO,YAAY,CAAC,KAAK,CAAC,mBAAmB;YAC7C,6FAA6F;YAC7F,uFAAuF;YACvF,sBAAsB,aAAa,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,QAAQ;YACxE,sBAAsB,aAAa,CAAC,KAAK,CAAC,EAAE;YAC5C,0FAA0F;YAC1F,uBAAuB,SAAS,EAAE;YAClC,0BAA0B,SAAS,EAAE;YACrC,sBAAsB,SAAS,EAAE;YACjC,sBAAsB,SAAS,IAAI;YACnC,4FAA4F;YAC5F,2FAA2F;YAC3F,0BAA0B,cAAc,CAAC,KAAK,CAAC,EAAE;YACjD,6BAA6B,cAAc,CAAC,KAAK,CAAC,EAAE;SACrD;QACD,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;KACnE,CAAC;AACJ,CAAC;AAED;;yFAEyF;AACzF,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,MAAc,EAAE,MAAgB,EAAE,UAAkB;IACzG,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,EAAE,+BAA+B,CACnE,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,2BAA2B,EAAE,OAAO,EAAE,CAAC,CAAC,EAC7F,UAAU,CACX,EAAE,MAAM,CAAC,CAAC;IACX,OAAO;QACL,OAAO,EAAE,CAAC,sBAAsB,aAAa,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC;QAChG,SAAS,EAAE,CAAC,UAAU,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC;KAClE,CAAC;AACJ,CAAC;AAED;;;2DAG2D;AAC3D,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,CAAC,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACnC,OAAO;QACL,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/G,qGAAqG;QACrG,GAAG,CAAC,YAAY,CAAC,iBAAiB;QAClC,GAAG,CAAC,WAAW,CAAC,eAAe;KAChC,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,8BAA8B,EAAE,CAAC;AAE1C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,8BAA8B,CAAC,KAAa,EAAE,MAAc,EAAE,UAAkB;IAC9F,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,SAAS,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,kBAAkB,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,WAAW,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG;QACjB,aAAa,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,aAAa,EAAE,oBAAoB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;QAChG,eAAe,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,aAAa,EAAE,oBAAoB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;QAClG,eAAe,CAAC,WAAW,EAAE,CAAC,aAAa,CAAC,CAAC;KAC9C,CAAC;IACF,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO;QACL,OAAO,EAAE;YACP,cAAc;YACd,0BAA0B,IAAI,EAAE;YAChC,0BAA0B,OAAO,EAAE;YACnC,oGAAoG;YACpG,+FAA+F;YAC/F,+FAA+F;YAC/F,oGAAoG;YACpG,oGAAoG;YACpG,2BAA2B;YAC3B,2BAA2B,IAAI,IAAI;YACnC,yBAAyB,IAAI,IAAI;YACjC,2BAA2B,IAAI,IAAI;YACnC,sBAAsB,aAAa,CAAC,KAAK,CAAC,EAAE;YAC5C,sBAAsB,aAAa,CAAC,KAAK,CAAC,IAAI;YAC9C,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,OAAO,EAAE;YACvC,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,SAAS,EAAE;YACzC,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,UAAU,IAAI;YAC5C,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5D,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ;YAC7B,sBAAsB,aAAa,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,QAAQ;SACzE;QACD,SAAS,EAAE,CAAC,UAAU,KAAK,IAAI,CAAC;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa,EAAE,MAAc;IAClE,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7C,6FAA6F;IAC7F,mEAAmE;IACnE,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxC,sFAAsF;IACtF,0FAA0F;IAC1F,iGAAiG;IACjG,gGAAgG;IAChG,kGAAkG;IAClG,2CAA2C;IAC3C,MAAM,YAAY,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC;IAC7F,OAAO;QACL,OAAO,EAAE;YACP,cAAc;YACd,uBAAuB,IAAI,EAAE;YAC7B,uBAAuB,OAAO,EAAE;YAChC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,uBAAuB,OAAO,EAAE,CAAC;YACrE,0BAA0B,IAAI,EAAE;YAChC,0BAA0B,OAAO,EAAE;YACnC,sBAAsB,OAAO,EAAE;YAC/B,sBAAsB,OAAO,IAAI;YACjC,6FAA6F;YAC7F,4FAA4F;YAC5F,mFAAmF;YACnF,8FAA8F;YAC9F,6FAA6F;YAC7F,0FAA0F;YAC1F,yFAAyF;YACzF,4FAA4F;YAC5F,8FAA8F;YAC9F,2FAA2F;YAC3F,4FAA4F;YAC5F,4FAA4F;YAC5F,yEAAyE;YACzE,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,2FAA2F;YAC3F,0FAA0F;YAC1F,yFAAyF;YACzF,yFAAyF;YACzF,mFAAmF;YACnF,OAAO,YAAY,CAAC,KAAK,CAAC,UAAU;YACpC,2FAA2F;YAC3F,yFAAyF;YACzF,uFAAuF;YACvF,sFAAsF;YACtF,wFAAwF;YACxF,mCAAmC;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,QAAQ;YAClC,OAAO,aAAa,CAAC,KAAK,CAAC,cAAc;YACzC,sFAAsF;YACtF,uFAAuF;YACvF,sFAAsF;YACtF,yFAAyF;YACzF,2EAA2E;YAC3E,OAAO,aAAa,CAAC,KAAK,CAAC,aAAa;SACzC;QACD,SAAS,EAAE,CAAC,UAAU,KAAK,IAAI,CAAC;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;iGAoBiG;AACjG,MAAM,UAAU,+BAA+B,CAAC,KAAa,EAAE,QAAgB,EAAE,KAAe;IAC9F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAC7C,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,gJAAgJ,CAAC,CAAC;IACrM,MAAM,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,CAAC,IAAI,CACV,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAC3C,OAAO,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAChD,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,0BAA0B,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/D,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC;AAsED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAyB;IACjE,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;IAChF,MAAM,IAAI,GAAG,KAAK,IAAqB,EAAE,CACvC,UAAU,CACR,IAAI,CAAC,KAAK,EACV,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,EACvB,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAChC,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE;QAChE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;IAClG,6FAA6F;IAC7F,qFAAqF;IACrF,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,wBAAwB,EAAE,CAC7G,CAAC;IACJ,IAAI,UAAU,GAAG,MAAM,IAAI,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,KAAK,IAAqB,EAAE;QACxC,IAAI,IAAI,CAAC,YAAY,EAAE,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC7E,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;IACF,yFAAyF;IACzF,iEAAiE;IACjE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE;QACjE,KAAK,KAAK,EAAE,CAAC,IAAI,CACf,CAAC,GAAG,EAAE,EAAE,GAAG,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,EAC9B,CAAC,CAAC,EAAE,EAAE;YACJ,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,gCAAiC,CAAW,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,uDAAuD,CAAC,CAAC;YACjJ,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;QAC5B,CAAC,CACF,CAAC;IACJ,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,IAAI,CAAC,wBAAwB,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3E,IAAI,EAAkB,CAAC;IACvB,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,OAAO,CAAC;YACjB,OAAO,EAAE,IAAI,CAAC,MAAM;YACpB,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,aAAa,EAAE,gBAAgB,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC1F,WAAW,EAAE,UAAU,QAAQ,CAAC,EAAE,EAAE;YACpC,+FAA+F;YAC/F,uFAAuF;YACvF,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,EAAE,CAAC;SAC5H,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,OAAO,KAAK,SAAS;YAAE,aAAa,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,CAAC;IACV,CAAC;IACD,IAAI,KAAiC,CAAC;IACtC,IAAI,IAA+B,CAAC;IACpC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,4FAA4F;QAC5F,2EAA2E;QAC3E,MAAM,IAAI,GAAG,EAAE,CAAC,IAA8D,CAAC;QAC/E,IAAI,OAAO,IAAI,EAAE,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YAClE,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC;YACvG,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACjC,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,KAAK,iGAAiG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,gFAAgF,CAAC,CAAC;QACxT,CAAC;QACD,KAAK,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjF,IAAI,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO;QACL,EAAE;QACF,MAAM,EAAE,QAAQ,CAAC,EAAE;QACnB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,IAAI,OAAO,KAAK,SAAS;gBAAE,aAAa,CAAC,OAAO,CAAC,CAAC;YAClD,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnC,CAAC;KACF,CAAC;AACJ,CAAC;AAUD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,IAAmD;IAEnD,MAAM,KAAK,GAAG,qBAAqB,IAAI,CAAC,KAAK,EAAE,CAAC;IAChD,IAAI,MAAiC,CAAC;IACtC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,MAAmC,CAAC;IACxC,MAAM,GAAG,MAAM,mBAAmB,CAAC;QACjC,GAAG,IAAI;QACP,KAAK;QACL,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;QAC/D,sFAAsF;QACtF,4FAA4F;QAC5F,gBAAgB,EAAE,GAAG,EAAE;YACrB,MAAM,GAAG,SAAS,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,yGAAyG,CAAC,CAAC;YAC5H,IAAI,CAAC,MAAM;gBAAE,KAAK,MAAM,EAAE,KAAK,EAAE,CAAC;QACpC,CAAC;KACF,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,MAAM,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,CAAC;IACV,CAAC;IACD,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;YACpC,IAAI,MAAM;gBAAE,MAAM;YAClB,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAClD,MAAM,GAAG,SAAS,CAAC;gBACnB,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,sBAAsB,CAAC,CAAC,IAAI,uDAAuD,CAAC,CAAC;YACxG,CAAC;iBAAM,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAClC,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;oBACnD,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,kDAAkD,CAAC,CAAC;gBACvE,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,GAAG,SAAS,CAAC;oBACnB,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,gCAAiC,CAAW,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC;gBACjH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,OAAO;QACL,OAAO,EAAE,GAAG,EAAE;YACZ,IAAI,MAAM,KAAK,SAAS;gBACtB,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,+KAA+K,CAAC,CAAC;YAC5N,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,GAAG,IAAI,CAAC;YACd,MAAM,GAAG,SAAS,CAAC,CAAC,oEAAoE;YACxF,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/delegated-user-intent.d.ts

@@ -0,0 +1,125 @@
+/**
+ * Host policy for a delegated user intent (SPEC 13.16): a signed-in user admits one launch or one
+ * retirement, and the platform control holder executes it while the intent and the agent stay the
+ * user's.
+ *
+ * Both decisions write nothing and mint nothing. The host that owns the intent store persists the
+ * admission record, consumes it with one revision-pinned CAS, and runs the enrollment and retirement
+ * writers it already runs for a user's own remote manager, with the decision's owner and parent.
+ * The holder's registration proves only which instance and epoch present the intent: no decision
+ * reads, requires or returns `supervise`.
+ */
+import { type DelegatedUserIntentAdmission, type DelegatedUserIntentRequest, type DelegatedUserLaunchTarget, type RemoteDelegatedUserIntentExecutionRequest, type RemoteDelegatedUserIntentExecutionResult, type RemoteManagedAgentPrepareRetirementRequest } from "@cotal-ai/core";
+import type { ObserveManagerGate } from "./managed-agent-enrollment.js";
+import type { PlatformControlDeps } from "./platform-control.js";
+/** The host's record of one admitted intent. The host is its only writer: create-only at admission,
+ * then one revision-pinned CAS from `admitted` to `consumed` that writes `execution` before any
+ * effect, then revision-pinned CASes only: a sweeper's claim, the one write that sets `outcome`,
+ * and the executor's `released`. */
+export interface DelegatedUserIntentRecord extends Omit<DelegatedUserIntentAdmission, "v" | "kind" | "requestId"> {
+    v: 1;
+    /** `<owner>.<actor>`: the launched agent's ledger parent, and the principal the envelope walk starts from. */
+    parent: string;
+    state: "admitted" | "consumed";
+    /** Written by the consuming CAS and never changed after. Absent while `admitted`. */
+    execution?: DelegatedUserIntentExecutionPin;
+    /** The host incarnation that claimed the execution for its executor because it believes that
+     * executor gone. Absent until a sweeper claims; a later sweeper may replace it. */
+    sweptBy?: DelegatedUserIntentIncarnation;
+    /** Set once, when the pinned execution ends. Absent while it runs or while the host recovers it. */
+    outcome?: "enrolled" | "retired" | "aborted";
+    /** Set once, only by the executor's own flight, after a sweeper's claim: the flight has stopped
+     * and revoked any grant at the pinned UID. Absent on every other record. */
+    released?: true;
+}
+/** One run of one host process, as SPEC §13.7 names an executor. An instance id without its process
+ * epoch names a process, never the run of it that holds a flight. */
+export interface DelegatedUserIntentIncarnation {
+    instanceId: string;
+    /** The process epoch (§13.1) of the host's own serving instance, advanced by every restart. */
+    processEpoch: number;
+}
+/** What the consuming CAS fixes before any effect, so that a retry, a lost answer or a host restart
+ * resumes the same execution at the same lifecycle. */
+export interface DelegatedUserIntentExecutionPin {
+    /** The holder request that consumed the record. Null when the host consumed a holder-gone retirement itself. */
+    requestId: string | null;
+    serveEpoch: number | null;
+    /** Launch: selected by the host before the CAS, and the only UID its writer enrolls. Retire: the target's. */
+    lifecycleUid: string;
+    /** Launch only: the holder's token digest. */
+    tokenHash?: string;
+    /** Retire only: managedRetirementOpId(lifecycleUid). */
+    opId?: string;
+    /** The host incarnation whose flight consumed the record: the execution's only executor. */
+    executor: DelegatedUserIntentIncarnation;
+}
+/** True while `record` holds the alias `(record.owner, record.intent.target.actor)`: consumed with
+ * no `outcome`, or claimed by a sweeper (`sweptBy`) and not yet `released`. */
+export declare function delegatedUserIntentHoldsAlias(record: DelegatedUserIntentRecord): boolean;
+/** In-process executions keyed by intentId, each bound to its pin, as RetirementFlights binds a
+ * retirement to its coordinates. A host process holds at most one flight per intent. */
+export type DelegatedUserIntentFlights = Map<string, {
+    pin: DelegatedUserIntentExecutionPin;
+    promise: Promise<RemoteDelegatedUserIntentExecutionResult>;
+}>;
+/** Join the flight for `intentId`, or start `run` and register it. Returns undefined when that
+ * intent is in flight under a different pin: the caller refuses with `conflict` and starts nothing. */
+export declare function joinOrStartDelegatedUserIntent(flights: DelegatedUserIntentFlights, intentId: string, pin: DelegatedUserIntentExecutionPin, run: () => Promise<RemoteDelegatedUserIntentExecutionResult>): Promise<RemoteDelegatedUserIntentExecutionResult> | undefined;
+/** The platform control door's assignment observer as it shipped, unchanged. It is keyed by account,
+ * which has at most one current row, and both decisions require that row to name the intent's instance. */
+export type ObservePlatformControlAssignment = PlatformControlDeps["observeAssignment"];
+export interface AuthorizeDelegatedUserIntentAdmissionArgs {
+    request: DelegatedUserIntentRequest;
+    space: string;
+    accountPublicKey: string;
+    /** Derived from the verified IdP subject with deriveOwnerForIdpSubject. Never read from the request. */
+    owner: string;
+    /** This host's ledger directory. The decision reads the actor's row itself. */
+    dir: string;
+    observeAssignment: ObservePlatformControlAssignment;
+    observeManagerGate: ObserveManagerGate;
+    /** The host's launch record of this owner whose `execution.lifecycleUid` is `lifecycleUid`, read fresh. Retire only. */
+    observeLaunchRecord(owner: string, lifecycleUid: string): Promise<DelegatedUserIntentRecord | null>;
+    /** The host's records of this owner whose `intent.target.actor` is `actor`, read fresh. Launch only. */
+    observeAliasRecords(owner: string, actor: string): Promise<DelegatedUserIntentRecord[]>;
+    /** platformControlOwner(...) for this space and account. */
+    platformOwner: string;
+    now: number;
+}
+/** Decides one admission. Writes nothing and mints nothing. Returns the record the host persists. */
+export declare function authorizeDelegatedUserIntentAdmission(args: AuthorizeDelegatedUserIntentAdmissionArgs): Promise<DelegatedUserIntentRecord>;
+export interface AuthorizeDelegatedUserIntentExecutionArgs {
+    request: RemoteDelegatedUserIntentExecutionRequest;
+    space: string;
+    accountPublicKey: string;
+    platformOwner: string;
+    /** The host's record for request.intentId, read fresh. Null is an absent intent. */
+    intent: DelegatedUserIntentRecord | null;
+    observeAssignment: ObservePlatformControlAssignment;
+    observeManagerGate: ObserveManagerGate;
+    proofSecret: string | Uint8Array;
+    now: number;
+}
+/** The only facts an execution decision carries, all checked for the current request. */
+export interface DelegatedUserIntentDecision {
+    intentId: string;
+    requestId: string;
+    serveEpoch: number;
+    owner: string;
+    parent: string;
+    instanceId: string;
+    /** True when the request equals the record's `execution` pin: the host joins that execution's
+     * flight, or answers from its outcome, and writes no second CAS. */
+    resume: boolean;
+    operation: "launch" | "retire";
+    target: DelegatedUserLaunchTarget | RemoteManagedAgentPrepareRetirementRequest["target"];
+    /** Launch only. */
+    tokenHash?: string;
+    /** Retire only: managedRetirementOpId(target.lifecycleUid). */
+    opId?: string;
+}
+/** Decides one execution. Writes nothing; the host consumes the record, pinning the execution, before
+ * acting on the decision. */
+export declare function authorizeDelegatedUserIntentExecution(args: AuthorizeDelegatedUserIntentExecutionArgs): Promise<DelegatedUserIntentDecision>;
+//# sourceMappingURL=delegated-user-intent.d.ts.map

package/dist/delegated-user-intent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegated-user-intent.d.ts","sourceRoot":"","sources":["../src/delegated-user-intent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAUL,KAAK,4BAA4B,EACjC,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAE9B,KAAK,yCAAyC,EAC9C,KAAK,wCAAwC,EAC7C,KAAK,0CAA0C,EAChD,MAAM,gBAAgB,CAAC;AAGxB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAGjE;;;oCAGoC;AACpC,MAAM,WAAW,yBAA0B,SAAQ,IAAI,CAAC,4BAA4B,EAAE,GAAG,GAAG,MAAM,GAAG,WAAW,CAAC;IAC/G,CAAC,EAAE,CAAC,CAAC;IACL,8GAA8G;IAC9G,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,UAAU,GAAG,UAAU,CAAC;IAC/B,qFAAqF;IACrF,SAAS,CAAC,EAAE,+BAA+B,CAAC;IAC5C;uFACmF;IACnF,OAAO,CAAC,EAAE,8BAA8B,CAAC;IACzC,oGAAoG;IACpG,OAAO,CAAC,EAAE,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;IAC7C;gFAC4E;IAC5E,QAAQ,CAAC,EAAE,IAAI,CAAC;CACjB;AAED;qEACqE;AACrE,MAAM,WAAW,8BAA8B;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB,+FAA+F;IAC/F,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;uDACuD;AACvD,MAAM,WAAW,+BAA+B;IAC9C,gHAAgH;IAChH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,8GAA8G;IAC9G,YAAY,EAAE,MAAM,CAAC;IACrB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,4FAA4F;IAC5F,QAAQ,EAAE,8BAA8B,CAAC;CAC1C;AAED;+EAC+E;AAC/E,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAExF;AAED;wFACwF;AACxF,MAAM,MAAM,0BAA0B,GAAG,GAAG,CAAC,MAAM,EAAE;IACnD,GAAG,EAAE,+BAA+B,CAAC;IACrC,OAAO,EAAE,OAAO,CAAC,wCAAwC,CAAC,CAAC;CAC5D,CAAC,CAAC;AAQH;uGACuG;AACvG,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,0BAA0B,EACnC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,+BAA+B,EACpC,GAAG,EAAE,MAAM,OAAO,CAAC,wCAAwC,CAAC,GAC3D,OAAO,CAAC,wCAAwC,CAAC,GAAG,SAAS,CAS/D;AAED;2GAC2G;AAC3G,MAAM,MAAM,gCAAgC,GAAG,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;AAExF,MAAM,WAAW,yCAAyC;IACxD,OAAO,EAAE,0BAA0B,CAAC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,wGAAwG;IACxG,KAAK,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,GAAG,EAAE,MAAM,CAAC;IACZ,iBAAiB,EAAE,gCAAgC,CAAC;IACpD,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,wHAAwH;IACxH,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAAC;IACpG,wGAAwG;IACxG,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAAC;IACxF,4DAA4D;IAC5D,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;CACb;AAiBD,qGAAqG;AACrG,wBAAsB,qCAAqC,CACzD,IAAI,EAAE,yCAAyC,GAC9C,OAAO,CAAC,yBAAyB,CAAC,CAgFpC;AAMD,MAAM,WAAW,yCAAyC;IACxD,OAAO,EAAE,yCAAyC,CAAC;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,MAAM,EAAE,yBAAyB,GAAG,IAAI,CAAC;IACzC,iBAAiB,EAAE,gCAAgC,CAAC;IACpD,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,WAAW,EAAE,MAAM,GAAG,UAAU,CAAC;IACjC,GAAG,EAAE,MAAM,CAAC;CACb;AAED,yFAAyF;AACzF,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB;wEACoE;IACpE,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC/B,MAAM,EAAE,yBAAyB,GAAG,0CAA0C,CAAC,QAAQ,CAAC,CAAC;IACzF,mBAAmB;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;6BAC6B;AAC7B,wBAAsB,qCAAqC,CACzD,IAAI,EAAE,yCAAyC,GAC9C,OAAO,CAAC,2BAA2B,CAAC,CAkDtC"}

package/dist/delegated-user-intent.js

@@ -0,0 +1,195 @@
+/**
+ * Host policy for a delegated user intent (SPEC 13.16): a signed-in user admits one launch or one
+ * retirement, and the platform control holder executes it while the intent and the agent stay the
+ * user's.
+ *
+ * Both decisions write nothing and mint nothing. The host that owns the intent store persists the
+ * admission record, consumes it with one revision-pinned CAS, and runs the enrollment and retirement
+ * writers it already runs for a user's own remote manager, with the decision's owner and parent.
+ * The holder's registration proves only which instance and epoch present the intent: no decision
+ * reads, requires or returns `supervise`.
+ */
+import { DELEGATED_USER_INTENT_MAX_TTL_SECONDS, EpEnvelopeError, assertDerivedOwnerToken, managedRetirementOpId, mintLifecycleUid, parseDelegatedUserIntentRequest, parseRemoteDelegatedUserIntentExecutionRequest, remoteManagerActors, resolveReadAcl, } from "@cotal-ai/core";
+import { timingSafeEqual } from "node:crypto";
+import { assertWithinSpawnerGrant, ledgerAuthorizeGrant } from "./ledger.js";
+import { remoteManagerCurrentRegistrationProof } from "./retained-manager-validation.js";
+/** True while `record` holds the alias `(record.owner, record.intent.target.actor)`: consumed with
+ * no `outcome`, or claimed by a sweeper (`sweptBy`) and not yet `released`. */
+export function delegatedUserIntentHoldsAlias(record) {
+    return (record.state === "consumed" && record.outcome === undefined) || (record.sweptBy !== undefined && record.released !== true);
+}
+function samePin(a, b) {
+    return a.requestId === b.requestId && a.serveEpoch === b.serveEpoch && a.lifecycleUid === b.lifecycleUid &&
+        a.tokenHash === b.tokenHash && a.opId === b.opId &&
+        a.executor.instanceId === b.executor.instanceId && a.executor.processEpoch === b.executor.processEpoch;
+}
+/** Join the flight for `intentId`, or start `run` and register it. Returns undefined when that
+ * intent is in flight under a different pin: the caller refuses with `conflict` and starts nothing. */
+export function joinOrStartDelegatedUserIntent(flights, intentId, pin, run) {
+    const existing = flights.get(intentId);
+    if (existing !== undefined)
+        return samePin(existing.pin, pin) ? existing.promise : undefined;
+    // Registered before `run` starts, so a call `run` makes back into this map joins this flight, and
+    // a synchronous throw rejects it.
+    const flight = Promise.resolve().then(run);
+    flights.set(intentId, { pin, promise: flight });
+    void flight.catch(() => { }).finally(() => { if (flights.get(intentId)?.promise === flight)
+        flights.delete(intentId); });
+    return flight;
+}
+/** A read is never a fence and never cached: an observer that fails refuses this call only. */
+async function observe(what, read) {
+    try {
+        return await read();
+    }
+    catch (e) {
+        throw new EpEnvelopeError("unavailable", `delegated user intent ${what} is unreadable: ${e instanceof Error ? e.message : String(e)}`);
+    }
+}
+function isCurrentAssignment(a, space, accountPublicKey, instanceId) {
+    return a !== null && a.v === 1 && a.state === "assigned" && a.space === space && a.accountPublicKey === accountPublicKey && a.instanceId === instanceId;
+}
+/** Decides one admission. Writes nothing and mints nothing. Returns the record the host persists. */
+export async function authorizeDelegatedUserIntentAdmission(args) {
+    const r = parseDelegatedUserIntentRequest(args.request);
+    if (r.space !== args.space || r.accountPublicKey !== args.accountPublicKey)
+        throw new EpEnvelopeError("permission-denied", "delegated user intent names another space or account than this authority context");
+    // Only a human's derived owner admits an intent: a platform or service owner never acts as a user.
+    try {
+        assertDerivedOwnerToken(args.owner);
+    }
+    catch (e) {
+        throw new EpEnvelopeError("permission-denied", e instanceof Error ? e.message : String(e));
+    }
+    let scope;
+    try {
+        scope = ledgerAuthorizeGrant(args.dir)(args.owner, r.actor).scope ?? [];
+    }
+    catch (e) {
+        throw new EpEnvelopeError("permission-denied", `delegated user intent found no ledger grant for actor "${r.actor}": ${e instanceof Error ? e.message : String(e)}`);
+    }
+    if (!scope.includes("spawn"))
+        throw new EpEnvelopeError("permission-denied", `delegated user intent needs scope "spawn" on actor "${r.actor}"`);
+    const parent = `${args.owner}.${r.actor}`;
+    const assignment = await observe("assignment", () => args.observeAssignment(args.space, args.accountPublicKey));
+    const gate = await observe("manager gate", () => args.observeManagerGate(r.instanceId));
+    const servePrincipal = `${args.platformOwner}.${remoteManagerActors(r.instanceId).serve}`;
+    let bound;
+    if (r.intent.operation === "launch") {
+        if (!isCurrentAssignment(assignment, args.space, args.accountPublicKey, r.instanceId))
+            throw new EpEnvelopeError("permission-denied", `platform control instance ${r.instanceId} is not the current assignment's instance for this account`);
+        if (gate && gate.principal !== servePrincipal)
+            throw new EpEnvelopeError("permission-denied", `manager gate belongs to ${gate.principal}, not serve principal ${servePrincipal}`);
+        if (!gate || gate.state !== "open")
+            throw new EpEnvelopeError("failed-precondition", `delegated user intent found no current open manager gate for instance ${r.instanceId}`);
+        const t = r.intent.target;
+        // A dry run of the walk the host's writer repeats at the write, over the read ACL that writer
+        // provisions: refuse before any record exists.
+        try {
+            assertWithinSpawnerGrant(args.dir, {
+                owner: args.owner,
+                actor: t.actor,
+                scope: t.capabilities ?? [],
+                allowSubscribe: resolveReadAcl(t.subscribe ?? [], t.allowSubscribe),
+                allowPublish: t.allowPublish ?? [],
+                parent,
+                ...(t.role !== undefined ? { role: t.role } : {}),
+            }, "spawn");
+        }
+        catch (e) {
+            throw new EpEnvelopeError("permission-denied", e instanceof Error ? e.message : String(e));
+        }
+        const aliasRecords = await observe("alias records", () => args.observeAliasRecords(args.owner, t.actor));
+        if (aliasRecords.some(delegatedUserIntentHoldsAlias))
+            throw new EpEnvelopeError("failed-precondition", `actor "${t.actor}" is held by an unfinished delegated execution`);
+        bound = { managerLifecycleUid: assignment.lifecycleUid, assignmentRevision: assignment.assignmentRevision, serveEpoch: gate.processEpoch };
+    }
+    else {
+        const t = r.intent.target;
+        if (t.owner !== args.owner)
+            throw new EpEnvelopeError("permission-denied", `retirement target owner "${t.owner}" does not match authenticated owner "${args.owner}"`);
+        const launch = await observe("launch record", () => args.observeLaunchRecord(args.owner, t.lifecycleUid));
+        // The launch record's own `actor` admitted the launch; only its target names the agent.
+        if (!launch || launch.owner !== args.owner || launch.intent.operation !== "launch" || launch.outcome !== "enrolled" ||
+            launch.execution?.lifecycleUid !== t.lifecycleUid || launch.intent.target.actor !== t.actor || launch.instanceId !== r.instanceId)
+            throw new EpEnvelopeError("failed-precondition", `lifecycle ${t.lifecycleUid} of "${t.actor}" is no enrolled delegated launch on instance ${r.instanceId}`);
+        const present = isCurrentAssignment(assignment, args.space, args.accountPublicKey, r.instanceId) &&
+            assignment.lifecycleUid === launch.managerLifecycleUid && assignment.assignmentRevision === launch.assignmentRevision &&
+            gatePresents(gate, servePrincipal, launch.serveEpoch);
+        // A gone holder cannot present the intent (execution requires the record's epoch), so the host
+        // consumes it itself.
+        bound = { managerLifecycleUid: launch.managerLifecycleUid, assignmentRevision: launch.assignmentRevision, serveEpoch: present ? launch.serveEpoch : null };
+    }
+    return {
+        v: 1,
+        space: args.space,
+        owner: args.owner,
+        actor: r.actor,
+        parent,
+        intentId: mintLifecycleUid(),
+        accountPublicKey: args.accountPublicKey,
+        instanceId: r.instanceId,
+        ...bound,
+        intent: r.intent,
+        expiresAt: new Date(args.now + DELEGATED_USER_INTENT_MAX_TTL_SECONDS * 1000).toISOString(),
+        state: "admitted",
+    };
+}
+function gatePresents(gate, servePrincipal, serveEpoch) {
+    return gate !== null && gate.state === "open" && gate.principal === servePrincipal && gate.processEpoch === serveEpoch;
+}
+/** Decides one execution. Writes nothing; the host consumes the record, pinning the execution, before
+ * acting on the decision. */
+export async function authorizeDelegatedUserIntentExecution(args) {
+    const r = parseRemoteDelegatedUserIntentExecutionRequest(args.request);
+    if (r.space !== args.space || r.accountPublicKey !== args.accountPublicKey)
+        throw new EpEnvelopeError("permission-denied", "delegated user intent execution names another space or account than this authority context");
+    const rec = args.intent;
+    if (!rec || rec.intentId !== r.intentId || rec.space !== args.space || rec.accountPublicKey !== args.accountPublicKey)
+        throw new EpEnvelopeError("failed-precondition", `delegated user intent ${r.intentId} was never admitted`);
+    let resume = false;
+    if (rec.state === "admitted") {
+        if (Date.parse(rec.expiresAt) <= args.now)
+            throw new EpEnvelopeError("failed-precondition", `delegated user intent ${r.intentId} expired at ${rec.expiresAt}`);
+    }
+    else {
+        // Only the execution the consuming CAS pinned may present a consumed record again.
+        const pin = rec.execution;
+        if (!pin || pin.requestId !== r.requestId || pin.serveEpoch !== r.serveEpoch ||
+            (r.execute.operation === "launch" && pin.tokenHash !== r.execute.target.tokenHash))
+            throw new EpEnvelopeError("failed-precondition", `delegated user intent ${r.intentId} was consumed by another execution`);
+        resume = true;
+    }
+    if (r.instanceId !== rec.instanceId || r.managerLifecycleUid !== rec.managerLifecycleUid ||
+        r.assignmentRevision !== rec.assignmentRevision || r.execute.operation !== rec.intent.operation)
+        throw new EpEnvelopeError("permission-denied", `delegated user intent ${r.intentId} is bound to another instance, lifecycle, revision or operation`);
+    const assignment = await observe("assignment", () => args.observeAssignment(args.space, args.accountPublicKey));
+    if (!isCurrentAssignment(assignment, args.space, args.accountPublicKey, rec.instanceId) ||
+        assignment.assignmentRevision !== rec.assignmentRevision || assignment.lifecycleUid !== rec.managerLifecycleUid)
+        throw new EpEnvelopeError("permission-denied", "platform control assignment no longer names the intent's instance, lifecycle or revision");
+    const gate = await observe("manager gate", () => args.observeManagerGate(r.instanceId));
+    const servePrincipal = `${args.platformOwner}.${remoteManagerActors(r.instanceId).serve}`;
+    if (gate && gate.principal !== servePrincipal)
+        throw new EpEnvelopeError("permission-denied", `manager gate belongs to ${gate.principal}, not serve principal ${servePrincipal}`);
+    if (!gate || gate.state !== "open")
+        throw new EpEnvelopeError("failed-precondition", `delegated user intent execution found no current open manager gate for instance ${r.instanceId}`);
+    if (gate.processEpoch !== r.serveEpoch)
+        throw new EpEnvelopeError("conflict", `manager serve epoch ${r.serveEpoch} is stale; current is ${gate.processEpoch}`);
+    if (r.serveEpoch !== rec.serveEpoch)
+        throw new EpEnvelopeError("permission-denied", `delegated user intent ${r.intentId} is bound to serve epoch ${rec.serveEpoch}, not ${r.serveEpoch}`);
+    const expectedProof = remoteManagerCurrentRegistrationProof(args.proofSecret, args.platformOwner, r, gate);
+    if (!timingSafeEqual(Buffer.from(r.registrationProof), Buffer.from(expectedProof)))
+        throw new EpEnvelopeError("permission-denied", "delegated user intent execution proof does not match current host registration");
+    const base = { intentId: rec.intentId, requestId: r.requestId, serveEpoch: r.serveEpoch, owner: rec.owner, parent: rec.parent, instanceId: rec.instanceId, resume };
+    if (rec.intent.operation === "launch") {
+        if (r.execute.operation !== "launch" || r.execute.target.actor !== rec.intent.target.actor)
+            throw new EpEnvelopeError("permission-denied", `delegated user intent ${r.intentId} names a launch of "${rec.intent.target.actor}" only`);
+        return { ...base, operation: "launch", target: rec.intent.target, tokenHash: r.execute.target.tokenHash };
+    }
+    const want = rec.intent.target;
+    if (r.execute.operation !== "retire" || r.execute.target.owner !== want.owner || r.execute.target.actor !== want.actor ||
+        r.execute.target.lifecycleUid !== want.lifecycleUid)
+        throw new EpEnvelopeError("permission-denied", `delegated user intent ${r.intentId} names another retirement target`);
+    return { ...base, operation: "retire", target: want, opId: managedRetirementOpId(want.lifecycleUid) };
+}
+//# sourceMappingURL=delegated-user-intent.js.map

package/dist/delegated-user-intent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegated-user-intent.js","sourceRoot":"","sources":["../src/delegated-user-intent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EACL,qCAAqC,EACrC,eAAe,EACf,uBAAuB,EACvB,qBAAqB,EACrB,gBAAgB,EAChB,+BAA+B,EAC/B,8CAA8C,EAC9C,mBAAmB,EACnB,cAAc,GAQf,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAG7E,OAAO,EAAE,qCAAqC,EAAE,MAAM,kCAAkC,CAAC;AA+CzF;+EAC+E;AAC/E,MAAM,UAAU,6BAA6B,CAAC,MAAiC;IAC7E,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,UAAU,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC;AACrI,CAAC;AASD,SAAS,OAAO,CAAC,CAAkC,EAAE,CAAkC;IACrF,OAAO,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,YAAY;QACtG,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;QAChD,CAAC,CAAC,QAAQ,CAAC,UAAU,KAAK,CAAC,CAAC,QAAQ,CAAC,UAAU,IAAI,CAAC,CAAC,QAAQ,CAAC,YAAY,KAAK,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;AAC3G,CAAC;AAED;uGACuG;AACvG,MAAM,UAAU,8BAA8B,CAC5C,OAAmC,EACnC,QAAgB,EAChB,GAAoC,EACpC,GAA4D;IAE5D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,kGAAkG;IAClG,kCAAkC;IAClC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3C,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IAChD,KAAK,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,KAAK,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxH,OAAO,MAAM,CAAC;AAChB,CAAC;AAyBD,+FAA+F;AAC/F,KAAK,UAAU,OAAO,CAAI,IAAY,EAAE,IAAsB;IAC5D,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,yBAAyB,IAAI,mBAAmB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACzI,CAAC;AACH,CAAC;AAID,SAAS,mBAAmB,CAAC,CAAmC,EAAE,KAAa,EAAE,gBAAwB,EAAE,UAAkB;IAC3H,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,UAAU,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,gBAAgB,KAAK,gBAAgB,IAAI,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC;AAC1J,CAAC;AAED,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,IAA+C;IAE/C,MAAM,CAAC,GAAG,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,gBAAgB,KAAK,IAAI,CAAC,gBAAgB;QACxE,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,kFAAkF,CAAC,CAAC;IACrI,mGAAmG;IACnG,IAAI,CAAC;QACH,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;IAC1E,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,0DAA0D,CAAC,CAAC,KAAK,MAAM,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtK,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QAC1B,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,uDAAuD,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;IACpH,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;IAC1C,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAChH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IACxF,MAAM,cAAc,GAAG,GAAG,IAAI,CAAC,aAAa,IAAI,mBAAmB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,CAAC;IAC1F,IAAI,KAAmG,CAAC;IACxG,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QACpC,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,UAAU,CAAC;YACnF,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,6BAA6B,CAAC,CAAC,UAAU,4DAA4D,CAAC,CAAC;QACxJ,IAAI,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,cAAc;YAC3C,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,2BAA2B,IAAI,CAAC,SAAS,yBAAyB,cAAc,EAAE,CAAC,CAAC;QACrI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM;YAChC,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,yEAAyE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;QAC5I,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;QAC1B,8FAA8F;QAC9F,+CAA+C;QAC/C,IAAI,CAAC;YACH,wBAAwB,CAAC,IAAI,CAAC,GAAG,EAAE;gBACjC,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,KAAK,EAAE,CAAC,CAAC,YAAY,IAAI,EAAE;gBAC3B,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC;gBACnE,YAAY,EAAE,CAAC,CAAC,YAAY,IAAI,EAAE;gBAClC,MAAM;gBACN,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClD,EAAE,OAAO,CAAC,CAAC;QACd,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACzG,IAAI,YAAY,CAAC,IAAI,CAAC,6BAA6B,CAAC;YAClD,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,UAAU,CAAC,CAAC,KAAK,gDAAgD,CAAC,CAAC;QACtH,KAAK,GAAG,EAAE,mBAAmB,EAAE,UAAU,CAAC,YAAY,EAAE,kBAAkB,EAAE,UAAU,CAAC,kBAAkB,EAAE,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;IAC7I,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK;YACxB,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,4BAA4B,CAAC,CAAC,KAAK,yCAAyC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;QAC5I,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;QAC1G,wFAAwF;QACxF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,KAAK,UAAU;YAC/G,MAAM,CAAC,SAAS,EAAE,YAAY,KAAK,CAAC,CAAC,YAAY,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;YACnI,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,aAAa,CAAC,CAAC,YAAY,QAAQ,CAAC,CAAC,KAAK,iDAAiD,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;QAC9J,MAAM,OAAO,GAAG,mBAAmB,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,UAAU,CAAC;YAC9F,UAAU,CAAC,YAAY,KAAK,MAAM,CAAC,mBAAmB,IAAI,UAAU,CAAC,kBAAkB,KAAK,MAAM,CAAC,kBAAkB;YACrH,YAAY,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QACxD,+FAA+F;QAC/F,sBAAsB;QACtB,KAAK,GAAG,EAAE,mBAAmB,EAAE,MAAM,CAAC,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7J,CAAC;IACD,OAAO;QACL,CAAC,EAAE,CAAC;QACJ,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,MAAM;QACN,QAAQ,EAAE,gBAAgB,EAAE;QAC5B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,GAAG,KAAK;QACR,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,qCAAqC,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QAC1F,KAAK,EAAE,UAAU;KAClB,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,IAAU,EAAE,cAAsB,EAAE,UAAyB;IACjF,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,KAAK,cAAc,IAAI,IAAI,CAAC,YAAY,KAAK,UAAU,CAAC;AACzH,CAAC;AAkCD;6BAC6B;AAC7B,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,IAA+C;IAE/C,MAAM,CAAC,GAAG,8CAA8C,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvE,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,gBAAgB,KAAK,IAAI,CAAC,gBAAgB;QACxE,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,4FAA4F,CAAC,CAAC;IAC/I,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;IACxB,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,gBAAgB,KAAK,IAAI,CAAC,gBAAgB;QACnH,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,yBAAyB,CAAC,CAAC,QAAQ,qBAAqB,CAAC,CAAC;IAC7G,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,GAAG,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG;YACvC,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,yBAAyB,CAAC,CAAC,QAAQ,eAAe,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;IACxH,CAAC;SAAM,CAAC;QACN,mFAAmF;QACnF,MAAM,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC;QAC1B,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,IAAI,GAAG,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;YACxE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;YACpF,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,yBAAyB,CAAC,CAAC,QAAQ,oCAAoC,CAAC,CAAC;QAC5H,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC,mBAAmB,KAAK,GAAG,CAAC,mBAAmB;QACpF,CAAC,CAAC,kBAAkB,KAAK,GAAG,CAAC,kBAAkB,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,KAAK,GAAG,CAAC,MAAM,CAAC,SAAS;QACjG,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,yBAAyB,CAAC,CAAC,QAAQ,iEAAiE,CAAC,CAAC;IACvJ,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAChH,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,gBAAgB,EAAE,GAAG,CAAC,UAAU,CAAC;QACnF,UAAU,CAAC,kBAAkB,KAAK,GAAG,CAAC,kBAAkB,IAAI,UAAU,CAAC,YAAY,KAAK,GAAG,CAAC,mBAAmB;QACjH,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,0FAA0F,CAAC,CAAC;IAC7I,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IACxF,MAAM,cAAc,GAAG,GAAG,IAAI,CAAC,aAAa,IAAI,mBAAmB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,CAAC;IAC1F,IAAI,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,cAAc;QAC3C,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,2BAA2B,IAAI,CAAC,SAAS,yBAAyB,cAAc,EAAE,CAAC,CAAC;IACrI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM;QAChC,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,mFAAmF,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IACtJ,IAAI,IAAI,CAAC,YAAY,KAAK,CAAC,CAAC,UAAU;QACpC,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAC,UAAU,yBAAyB,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;IACzH,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC,UAAU;QACjC,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,yBAAyB,CAAC,CAAC,QAAQ,4BAA4B,GAAG,CAAC,UAAU,SAAS,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IACvJ,MAAM,aAAa,GAAG,qCAAqC,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IAC3G,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAChF,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,gFAAgF,CAAC,CAAC;IACnI,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IACpK,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QACtC,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK;YACxF,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,yBAAyB,CAAC,CAAC,QAAQ,uBAAuB,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC;QAC5I,OAAO,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;IAC5G,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;IAC/B,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK;QAClH,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY;QACrD,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,yBAAyB,CAAC,CAAC,QAAQ,kCAAkC,CAAC,CAAC;IACxH,OAAO,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;AACxG,CAAC"}

package/dist/index.d.ts

@@ -6,10 +6,10 @@ export { validateUserToken, assertCredentialIdClaim, USER_TOKEN_VER, MAX_TOKEN_T
 export { USER_TOKEN_ALG, createUserTokenIssuer, generateSigningKey, exportSigningKey, importSigningKey, pinnedJwksResolver, type SigningKey, type SerializedSigningKey, type IssueClaims, type UserTokenIssuer, type CreateIssuerOpts, } from "./issuer.js";
 export { createIdpBridge, verifyIdpToken, type IdpConfig, type ActorGrant, type CreateIdpBridgeOpts, type ExchangeResult, type IdpBridge, } from "./idp.js";
 export { CATALOG_FRESH_MS, deviceLogin, establishIdpSession, fetchIdpJwt, revokeIdpSession, loadIdpSession, hasIdpSessions, saveIdpSession, deleteIdpSession, deleteIdpSpaceCatalog, hasIdpSpaceCatalog, prepareIdpSpaceCatalogs, requireIdpSession, normalizeIdpUrl, probeIdpJwks, type IdpSession, type DeviceLoginOpts, type DeviceLoginPrompt, } from "./login.js";
-export { calloutPermissions, type AclResolver } from "./permissions.js";
+export { calloutPermissions, type AclResolver, type UserCallerIssuer } from "./permissions.js";
 export { USER_AUTH_TRUST_SCHEME, userAuthTrustFingerprint, validateRetainedManagedAgent, } from "./continuity.js";
 export { AUTH_PROVIDER_NAME, authCalloutKey, authIssuerKey, authOwnerSecretKey, authServiceKeysKey, clearAuthServiceInfo, ensureCalloutAuth, ensureIssuer, ensureOwnerSecret, ensurePinnedIdp, loadAuthServiceInfo, loadCalloutAuth, loadIssuer, loadOwnerSecret, loadPinnedIdp, loadServiceKeys, saveAuthServiceInfo, saveServiceKeys, spaceIssuer, type AuthServiceInfo, type PinnedIdp, type ServiceKeys, } from "./store.js";
-export { actorLedgerDir, managedActorLedgerDir, findInteractiveActor, findManagedActor, findActorUnified, grantActor, grantManagedActor, ledgerAclResolver, ledgerAuthorizeConnect, ledgerAuthorizeGrant, ledgerAuthorizeAgentExchange, ledgerRowFilename, loadActorLedger, revokeActor, revokeManagedActor, newActorToken, hashActorToken, AGENT_BEARER_TTL_SEC, type ActorKind, type ActorRow, } from "./ledger.js";
+export { actorLedgerDir, managedActorLedgerDir, findInteractiveActor, findManagedActor, findActorUnified, grantActor, grantManagedActor, ledgerAclResolver, ledgerActorSourceIsLive, ledgerAuthorizeConnect, ledgerAuthorizeGrant, ledgerAuthorizeAgentExchange, ledgerRowFilename, loadActorLedger, revokeActor, revokeManagedActor, newActorToken, hashActorToken, AGENT_BEARER_TTL_SEC, type ActorKind, type ActorRow, } from "./ledger.js";
 export { runAuthService, startAuthService, type AuthServiceHandle, type PublicFaceInput, type PlatformControlInput, openAuthAuthorityPlane, dispatchManagerAuthorityRequest, handleManagerServiceAuthority, JWKS_MAX_AGE_SEC, INTERACTIVE_RETIRE_PATH, MANAGED_RETIRE_PATH, VERIFY_ENROLLMENT_PATH, composeUserBundle, finalizeUserBundleEndpoint, checkAdvertisedServer, checkAgentProvisioningUrl, type AuthAuthorityPlane } from "./service.js";
 export { remoteManagerIssuerGrants } from "./authority-client.js";
 export { authConnectReaderGrants, openConnectReader, authorizeConnectCredential, type ConnectReader, } from "./connect-reader.js";
@@ -18,6 +18,7 @@ export { parseRemoteManagerMaintenanceRequest, authorizeRemoteManagerMaintenance
 export { parseRemoteRetainedAgentValidationRequest, authorizeRemoteRetainedAgentValidation, completeRemoteRetainedAgentValidation, remoteManagerCurrentRegistrationProof, type AuthorizeRemoteRetainedAgentValidationArgs, } from "./retained-manager-validation.js";
 export { parseRemoteManagerAdminAuthorizationRequest, authorizeRemoteManagerAdmin } from "./manager-admin-authorization.js";
 export { authorizeRemoteManagedAgentEnrollment, authorizeRemoteManagedAgentPrepareRetirement, authorizeRemoteManagedAgentRuntimeCreate, authorizeRemoteManagedAgentRuntimeStatus, type AuthorizeRemoteManagedAgentEnrollmentArgs, type AuthorizeRemoteManagedAgentPrepareRetirementArgs, type AuthorizeRemoteManagedAgentRuntimeArgs, type RemoteManagedAgentRuntimeDecision, type ObserveManagerGate, } from "./managed-agent-enrollment.js";
+export { authorizeDelegatedUserIntentAdmission, authorizeDelegatedUserIntentExecution, delegatedUserIntentHoldsAlias, joinOrStartDelegatedUserIntent, type AuthorizeDelegatedUserIntentAdmissionArgs, type AuthorizeDelegatedUserIntentExecutionArgs, type DelegatedUserIntentDecision, type DelegatedUserIntentExecutionPin, type DelegatedUserIntentFlights, type DelegatedUserIntentIncarnation, type DelegatedUserIntentRecord, type ObservePlatformControlAssignment, } from "./delegated-user-intent.js";
 export { cotalAuthProvider } from "./provider.js";
 import "./commands.js";
 export { openSessionAuthStore, kvSessionLedger, sessionRedemptionHooks, closeSession, sweepSessions, kvServeIssuanceGate, type SessionAuthStore, type EndpointGateRow, type SessionSigner, type SessionHookDeps, type SessionCloser } from "./session-ledger.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAC/F,OAAO,EAAE,oCAAoC,EAAE,KAAK,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC1G,YAAY,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,WAAW,EAChB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,oBAAoB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,GAC3B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,UAAU,EACf,KAAK,oBAAoB,EACzB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,eAAe,EACf,cAAc,EACd,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,SAAS,GACf,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAE,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,UAAU,EACV,eAAe,EACf,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,WAAW,EACX,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,WAAW,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,oBAAoB,EACpB,4BAA4B,EAC5B,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,oBAAoB,EACpB,KAAK,SAAS,EACd,KAAK,QAAQ,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,KAAK,iBAAiB,EAAE,KAAK,eAAe,EAAE,KAAK,oBAAoB,EAAE,sBAAsB,EAAE,+BAA+B,EAAE,6BAA6B,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACnb,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAKlE,OAAO,EACL,uBAAuB,EAAE,iBAAiB,EAAE,0BAA0B,EACtE,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,yBAAyB,EAAE,4BAA4B,EAAE,KAAK,qBAAqB,EAAE,8BAA8B,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,kCAAkC,EAAE,KAAK,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AACnT,OAAO,EAAE,oCAAoC,EAAE,iCAAiC,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AACrJ,OAAO,EACL,yCAAyC,EACzC,sCAAsC,EACtC,qCAAqC,EACrC,qCAAqC,EACrC,KAAK,0CAA0C,GAChD,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,2CAA2C,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC5H,OAAO,EACL,qCAAqC,EACrC,4CAA4C,EAC5C,wCAAwC,EACxC,wCAAwC,EACxC,KAAK,yCAAyC,EAC9C,KAAK,gDAAgD,EACrD,KAAK,sCAAsC,EAC3C,KAAK,iCAAiC,EACtC,KAAK,kBAAkB,GACxB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,eAAe,CAAC;AAIvB,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,sBAAsB,EAAE,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,KAAK,gBAAgB,EAAE,KAAK,eAAe,EAAE,KAAK,aAAa,EAAE,KAAK,eAAe,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAQjQ,OAAO,EACL,qBAAqB,EAAE,0BAA0B,EACjD,0BAA0B,EAAE,2BAA2B,EACvD,KAAK,iBAAiB,EAAE,KAAK,sBAAsB,EAAE,KAAK,gBAAgB,EAAE,KAAK,SAAS,GAC3F,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAC/F,OAAO,EAAE,oCAAoC,EAAE,KAAK,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC1G,YAAY,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,WAAW,EAChB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,oBAAoB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,GAC3B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,UAAU,EACf,KAAK,oBAAoB,EACzB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,eAAe,EACf,cAAc,EACd,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,SAAS,GACf,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAE,KAAK,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,UAAU,EACV,eAAe,EACf,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,WAAW,EACX,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,WAAW,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,4BAA4B,EAC5B,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,oBAAoB,EACpB,KAAK,SAAS,EACd,KAAK,QAAQ,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,KAAK,iBAAiB,EAAE,KAAK,eAAe,EAAE,KAAK,oBAAoB,EAAE,sBAAsB,EAAE,+BAA+B,EAAE,6BAA6B,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACnb,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAKlE,OAAO,EACL,uBAAuB,EAAE,iBAAiB,EAAE,0BAA0B,EACtE,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,yBAAyB,EAAE,4BAA4B,EAAE,KAAK,qBAAqB,EAAE,8BAA8B,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,kCAAkC,EAAE,KAAK,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AACnT,OAAO,EAAE,oCAAoC,EAAE,iCAAiC,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AACrJ,OAAO,EACL,yCAAyC,EACzC,sCAAsC,EACtC,qCAAqC,EACrC,qCAAqC,EACrC,KAAK,0CAA0C,GAChD,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,2CAA2C,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC5H,OAAO,EACL,qCAAqC,EACrC,4CAA4C,EAC5C,wCAAwC,EACxC,wCAAwC,EACxC,KAAK,yCAAyC,EAC9C,KAAK,gDAAgD,EACrD,KAAK,sCAAsC,EAC3C,KAAK,iCAAiC,EACtC,KAAK,kBAAkB,GACxB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,qCAAqC,EACrC,qCAAqC,EACrC,6BAA6B,EAC7B,8BAA8B,EAC9B,KAAK,yCAAyC,EAC9C,KAAK,yCAAyC,EAC9C,KAAK,2BAA2B,EAChC,KAAK,+BAA+B,EACpC,KAAK,0BAA0B,EAC/B,KAAK,8BAA8B,EACnC,KAAK,yBAAyB,EAC9B,KAAK,gCAAgC,GACtC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,eAAe,CAAC;AAIvB,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,sBAAsB,EAAE,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,KAAK,gBAAgB,EAAE,KAAK,eAAe,EAAE,KAAK,aAAa,EAAE,KAAK,eAAe,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAQjQ,OAAO,EACL,qBAAqB,EAAE,0BAA0B,EACjD,0BAA0B,EAAE,2BAA2B,EACvD,KAAK,iBAAiB,EAAE,KAAK,sBAAsB,EAAE,KAAK,gBAAgB,EAAE,KAAK,SAAS,GAC3F,MAAM,yBAAyB,CAAC"}

package/dist/index.js

@@ -8,7 +8,7 @@ export { CATALOG_FRESH_MS, deviceLogin, establishIdpSession, fetchIdpJwt, revoke
 export { calloutPermissions } from "./permissions.js";
 export { USER_AUTH_TRUST_SCHEME, userAuthTrustFingerprint, validateRetainedManagedAgent, } from "./continuity.js";
 export { AUTH_PROVIDER_NAME, authCalloutKey, authIssuerKey, authOwnerSecretKey, authServiceKeysKey, clearAuthServiceInfo, ensureCalloutAuth, ensureIssuer, ensureOwnerSecret, ensurePinnedIdp, loadAuthServiceInfo, loadCalloutAuth, loadIssuer, loadOwnerSecret, loadPinnedIdp, loadServiceKeys, saveAuthServiceInfo, saveServiceKeys, spaceIssuer, } from "./store.js";
-export { actorLedgerDir, managedActorLedgerDir, findInteractiveActor, findManagedActor, findActorUnified, grantActor, grantManagedActor, ledgerAclResolver, ledgerAuthorizeConnect, ledgerAuthorizeGrant, ledgerAuthorizeAgentExchange, ledgerRowFilename, loadActorLedger, revokeActor, revokeManagedActor, newActorToken, hashActorToken, AGENT_BEARER_TTL_SEC, } from "./ledger.js";
+export { actorLedgerDir, managedActorLedgerDir, findInteractiveActor, findManagedActor, findActorUnified, grantActor, grantManagedActor, ledgerAclResolver, ledgerActorSourceIsLive, ledgerAuthorizeConnect, ledgerAuthorizeGrant, ledgerAuthorizeAgentExchange, ledgerRowFilename, loadActorLedger, revokeActor, revokeManagedActor, newActorToken, hashActorToken, AGENT_BEARER_TTL_SEC, } from "./ledger.js";
 export { runAuthService, startAuthService, openAuthAuthorityPlane, dispatchManagerAuthorityRequest, handleManagerServiceAuthority, JWKS_MAX_AGE_SEC, INTERACTIVE_RETIRE_PATH, MANAGED_RETIRE_PATH, VERIFY_ENROLLMENT_PATH, composeUserBundle, finalizeUserBundleEndpoint, checkAdvertisedServer, checkAgentProvisioningUrl } from "./service.js";
 export { remoteManagerIssuerGrants } from "./authority-client.js";
 // The R1 connect-arm deny-new READ seam (SPEC 13.1): the reader grant builder, the sealed
@@ -21,6 +21,7 @@ export { parseRemoteManagerMaintenanceRequest, authorizeRemoteManagerMaintenance
 export { parseRemoteRetainedAgentValidationRequest, authorizeRemoteRetainedAgentValidation, completeRemoteRetainedAgentValidation, remoteManagerCurrentRegistrationProof, } from "./retained-manager-validation.js";
 export { parseRemoteManagerAdminAuthorizationRequest, authorizeRemoteManagerAdmin } from "./manager-admin-authorization.js";
 export { authorizeRemoteManagedAgentEnrollment, authorizeRemoteManagedAgentPrepareRetirement, authorizeRemoteManagedAgentRuntimeCreate, authorizeRemoteManagedAgentRuntimeStatus, } from "./managed-agent-enrollment.js";
+export { authorizeDelegatedUserIntentAdmission, authorizeDelegatedUserIntentExecution, delegatedUserIntentHoldsAlias, joinOrStartDelegatedUserIntent, } from "./delegated-user-intent.js";
 export { cotalAuthProvider } from "./provider.js"; // self-registers the "auth-provider" extension
 import "./commands.js"; // self-registers `login` / `logout` / `actor` / `auth-service` into the core Registry
 // NB: writeEndpointGate (the D14 endpoint-registration stand-in) is deliberately NOT

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAC/F,OAAO,EAAE,oCAAoC,EAA+B,MAAM,uBAAuB,CAAC;AAE1G,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,GAMjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,mBAAmB,GAKpB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,GAMnB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,eAAe,EACf,cAAc,GAMf,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,YAAY,GAIb,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAoB,MAAM,kBAAkB,CAAC;AACxE,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,UAAU,EACV,eAAe,EACf,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,WAAW,GAIZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,EACtB,oBAAoB,EACpB,4BAA4B,EAC5B,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,oBAAoB,GAGrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAA2E,sBAAsB,EAAE,+BAA+B,EAAE,6BAA6B,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,yBAAyB,EAA2B,MAAM,cAAc,CAAC;AACnb,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,0FAA0F;AAC1F,8FAA8F;AAC9F,mFAAmF;AACnF,8FAA8F;AAC9F,OAAO,EACL,uBAAuB,EAAE,iBAAiB,EAAE,0BAA0B,GAEvE,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,yBAAyB,EAAE,4BAA4B,EAA8B,8BAA8B,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,kCAAkC,EAAwC,MAAM,wBAAwB,CAAC;AACnT,OAAO,EAAE,oCAAoC,EAAE,iCAAiC,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AACrJ,OAAO,EACL,yCAAyC,EACzC,sCAAsC,EACtC,qCAAqC,EACrC,qCAAqC,GAEtC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,2CAA2C,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC5H,OAAO,EACL,qCAAqC,EACrC,4CAA4C,EAC5C,wCAAwC,EACxC,wCAAwC,GAMzC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC,CAAC,+CAA+C;AAClG,OAAO,eAAe,CAAC,CAAC,sFAAsF;AAC9G,qFAAqF;AACrF,2FAA2F;AAC3F,oDAAoD;AACpD,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,sBAAsB,EAAE,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAA6G,MAAM,qBAAqB,CAAC;AACjQ,6FAA6F;AAC7F,sFAAsF;AACtF,6FAA6F;AAC7F,uFAAuF;AACvF,4FAA4F;AAC5F,qFAAqF;AACrF,8DAA8D;AAC9D,OAAO,EACL,qBAAqB,EAAE,0BAA0B,EACjD,0BAA0B,EAAE,2BAA2B,GAExD,MAAM,yBAAyB,CAAC;AACjC,wFAAwF;AACxF,uFAAuF;AACvF,4FAA4F;AAC5F,yFAAyF;AACzF,iGAAiG;AACjG,4FAA4F;AAC5F,0FAA0F;AAC1F,yFAAyF;AACzF,wFAAwF;AACxF,WAAW"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAC/F,OAAO,EAAE,oCAAoC,EAA+B,MAAM,uBAAuB,CAAC;AAE1G,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,GAMjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,mBAAmB,GAKpB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,GAMnB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,eAAe,EACf,cAAc,GAMf,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,YAAY,GAIb,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAA2C,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,UAAU,EACV,eAAe,EACf,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,WAAW,GAIZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,4BAA4B,EAC5B,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,oBAAoB,GAGrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAA2E,sBAAsB,EAAE,+BAA+B,EAAE,6BAA6B,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,yBAAyB,EAA2B,MAAM,cAAc,CAAC;AACnb,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,0FAA0F;AAC1F,8FAA8F;AAC9F,mFAAmF;AACnF,8FAA8F;AAC9F,OAAO,EACL,uBAAuB,EAAE,iBAAiB,EAAE,0BAA0B,GAEvE,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,yBAAyB,EAAE,4BAA4B,EAA8B,8BAA8B,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,kCAAkC,EAAwC,MAAM,wBAAwB,CAAC;AACnT,OAAO,EAAE,oCAAoC,EAAE,iCAAiC,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AACrJ,OAAO,EACL,yCAAyC,EACzC,sCAAsC,EACtC,qCAAqC,EACrC,qCAAqC,GAEtC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,2CAA2C,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC5H,OAAO,EACL,qCAAqC,EACrC,4CAA4C,EAC5C,wCAAwC,EACxC,wCAAwC,GAMzC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,qCAAqC,EACrC,qCAAqC,EACrC,6BAA6B,EAC7B,8BAA8B,GAS/B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC,CAAC,+CAA+C;AAClG,OAAO,eAAe,CAAC,CAAC,sFAAsF;AAC9G,qFAAqF;AACrF,2FAA2F;AAC3F,oDAAoD;AACpD,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,sBAAsB,EAAE,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAA6G,MAAM,qBAAqB,CAAC;AACjQ,6FAA6F;AAC7F,sFAAsF;AACtF,6FAA6F;AAC7F,uFAAuF;AACvF,4FAA4F;AAC5F,qFAAqF;AACrF,8DAA8D;AAC9D,OAAO,EACL,qBAAqB,EAAE,0BAA0B,EACjD,0BAA0B,EAAE,2BAA2B,GAExD,MAAM,yBAAyB,CAAC;AACjC,wFAAwF;AACxF,uFAAuF;AACvF,4FAA4F;AAC5F,yFAAyF;AACzF,iGAAiG;AACjG,4FAA4F;AAC5F,0FAA0F;AAC1F,yFAAyF;AACzF,wFAAwF;AACxF,WAAW"}