@cotal-ai/auth 0.61.0 → 0.63.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/authority-client.d.ts +13 -1
- package/dist/authority-client.d.ts.map +1 -1
- package/dist/authority-client.js +26 -2
- package/dist/authority-client.js.map +1 -1
- package/dist/delegated-user-intent.d.ts +125 -0
- package/dist/delegated-user-intent.d.ts.map +1 -0
- package/dist/delegated-user-intent.js +195 -0
- package/dist/delegated-user-intent.js.map +1 -0
- package/dist/index.d.ts +3 -2
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +2 -1
- package/dist/index.js.map +1 -1
- package/dist/ledger.d.ts +15 -0
- package/dist/ledger.d.ts.map +1 -1
- package/dist/ledger.js +15 -2
- package/dist/ledger.js.map +1 -1
- package/dist/manager-authority.d.ts +34 -1
- package/dist/manager-authority.d.ts.map +1 -1
- package/dist/manager-authority.js +122 -13
- package/dist/manager-authority.js.map +1 -1
- package/dist/manager-contract.d.ts +4 -1
- package/dist/manager-contract.d.ts.map +1 -1
- package/dist/manager-contract.js +11 -4
- package/dist/manager-contract.js.map +1 -1
- package/dist/permissions.d.ts +15 -0
- package/dist/permissions.d.ts.map +1 -1
- package/dist/permissions.js +5 -2
- package/dist/permissions.js.map +1 -1
- package/dist/platform-control.d.ts +8 -1
- package/dist/platform-control.d.ts.map +1 -1
- package/dist/platform-control.js +33 -15
- package/dist/platform-control.js.map +1 -1
- package/dist/service.d.ts +27 -2
- package/dist/service.d.ts.map +1 -1
- package/dist/service.js +174 -25
- package/dist/service.js.map +1 -1
- package/package.json +3 -3
|
@@ -1,8 +1,11 @@
|
|
|
1
|
-
import { type EpGateState, type RemoteManagerAuthorityRequest } from "@cotal-ai/core";
|
|
1
|
+
import { type EpCommandAuthority, type EpGateState, type RemoteManagerAuthorityRequest } from "@cotal-ai/core";
|
|
2
2
|
/** Canonical manager surface mirrored from @cotal-ai/manager's contract source. The activation
|
|
3
3
|
* protocol verifies the submitted cluster document matches this exact security-relevant shape;
|
|
4
4
|
* schemas remain content-addressed artifacts and their digests ride each command. */
|
|
5
5
|
export declare function reconstructRemoteManagerServeGrant(request: RemoteManagerAuthorityRequest, owner: string, _serveActor: string, observed: EpGateState): import("@cotal-ai/core").EpServeGrant;
|
|
6
|
+
/** The command declarations of the canonical manager cluster document, in the shape a serve grant
|
|
7
|
+
* pins. */
|
|
8
|
+
export declare function remoteManagerSurface(document: unknown): Record<string, EpCommandAuthority>;
|
|
6
9
|
/** One grant derivation for activation (the submitted canonical document) and standing renewal
|
|
7
10
|
* (the document the registered service spec names in the content store). Renewal carries no
|
|
8
11
|
* artifacts, so the same surface is re-derived from registered state rather than from the request. */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"manager-contract.d.ts","sourceRoot":"","sources":["../src/manager-contract.ts"],"names":[],"mappings":"AAAA,OAAO,
|
|
1
|
+
{"version":3,"file":"manager-contract.d.ts","sourceRoot":"","sources":["../src/manager-contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,6BAA6B,EACnC,MAAM,gBAAgB,CAAC;AAExB;;qFAEqF;AACrF,wBAAgB,kCAAkC,CAChD,OAAO,EAAE,6BAA6B,EACtC,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,WAAW,yCAQtB;AAED;WACW;AACX,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CA0B1F;AAED;;sGAEsG;AACtG,wBAAgB,kCAAkC,CAChD,OAAO,EAAE,IAAI,CAAC,6BAA6B,EAAE,OAAO,GAAG,YAAY,CAAC,EACpE,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,WAAW,yCAuBtB"}
|
package/dist/manager-contract.js
CHANGED
|
@@ -6,10 +6,9 @@ export function reconstructRemoteManagerServeGrant(request, owner, _serveActor,
|
|
|
6
6
|
const artifacts = request.contractArtifacts ?? [];
|
|
7
7
|
return remoteManagerServeGrantFromCluster(request, owner, artifacts.find((value) => value && typeof value === "object" && value.urn === "ai.cotal.manager"), observed);
|
|
8
8
|
}
|
|
9
|
-
/**
|
|
10
|
-
*
|
|
11
|
-
|
|
12
|
-
export function remoteManagerServeGrantFromCluster(request, owner, document, observed) {
|
|
9
|
+
/** The command declarations of the canonical manager cluster document, in the shape a serve grant
|
|
10
|
+
* pins. */
|
|
11
|
+
export function remoteManagerSurface(document) {
|
|
13
12
|
const cluster = document;
|
|
14
13
|
if (!cluster || !Number.isSafeInteger(cluster.revision) || !Array.isArray(cluster.commands) || cluster.commands.length === 0)
|
|
15
14
|
throw new Error("manager-service activation did not carry the canonical manager cluster document");
|
|
@@ -31,6 +30,14 @@ export function remoteManagerServeGrantFromCluster(request, owner, document, obs
|
|
|
31
30
|
traits: command.traits ?? [],
|
|
32
31
|
};
|
|
33
32
|
}
|
|
33
|
+
return surface;
|
|
34
|
+
}
|
|
35
|
+
/** One grant derivation for activation (the submitted canonical document) and standing renewal
|
|
36
|
+
* (the document the registered service spec names in the content store). Renewal carries no
|
|
37
|
+
* artifacts, so the same surface is re-derived from registered state rather than from the request. */
|
|
38
|
+
export function remoteManagerServeGrantFromCluster(request, owner, document, observed) {
|
|
39
|
+
const surface = remoteManagerSurface(document);
|
|
40
|
+
const cluster = document;
|
|
34
41
|
const actors = remoteManagerActors(request.instanceId);
|
|
35
42
|
void actors;
|
|
36
43
|
return authorizeTrustedServeSnapshot({
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"manager-contract.js","sourceRoot":"","sources":["../src/manager-contract.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,6BAA6B,EAC7B,cAAc,EACd,mBAAmB,GAIpB,MAAM,gBAAgB,CAAC;AAExB;;qFAEqF;AACrF,MAAM,UAAU,kCAAkC,CAChD,OAAsC,EACtC,KAAa,EACb,WAAmB,EACnB,QAAqB;IAErB,MAAM,SAAS,GAAG,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC;IAClD,OAAO,kCAAkC,CACvC,OAAO,EAAE,KAAK,EACd,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAK,KAA2B,CAAC,GAAG,KAAK,kBAAkB,CAAC,EACxH,QAAQ,CACT,CAAC;AACJ,CAAC;AAED
|
|
1
|
+
{"version":3,"file":"manager-contract.js","sourceRoot":"","sources":["../src/manager-contract.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,6BAA6B,EAC7B,cAAc,EACd,mBAAmB,GAIpB,MAAM,gBAAgB,CAAC;AAExB;;qFAEqF;AACrF,MAAM,UAAU,kCAAkC,CAChD,OAAsC,EACtC,KAAa,EACb,WAAmB,EACnB,QAAqB;IAErB,MAAM,SAAS,GAAG,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC;IAClD,OAAO,kCAAkC,CACvC,OAAO,EAAE,KAAK,EACd,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAK,KAA2B,CAAC,GAAG,KAAK,kBAAkB,CAAC,EACxH,QAAQ,CACT,CAAC;AACJ,CAAC;AAED;WACW;AACX,MAAM,UAAU,oBAAoB,CAAC,QAAiB;IACpD,MAAM,OAAO,GAAG,QAIH,CAAC;IACd,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAC1H,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IACrG,MAAM,OAAO,GAAuC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxE,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACvC,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,KAAK,WAAW,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,SAAS;YAC1G,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ;YAC/H,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;QAChG,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5G,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG;YACtB,aAAa,EAAE,cAAc,CAAC,OAAO,CAAC;YACtC,KAAK,EAAE,WAAW;YAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,KAAK,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAgC;YAC3D,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;SAC7B,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;sGAEsG;AACtG,MAAM,UAAU,kCAAkC,CAChD,OAAoE,EACpE,KAAa,EACb,QAAiB,EACjB,QAAqB;IAErB,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,QAAmC,CAAC;IACpD,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACvD,KAAK,MAAM,CAAC;IACZ,OAAO,6BAA6B,CAAC;QACnC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,KAAK,EAAE,QAAQ,CAAC,YAAY;QAC5B,KAAK;QACL,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;QACnD,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB;QACrD,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QAC9B,OAAO;QACP,UAAU,EAAE;YACV,QAAQ,EAAE,SAAS;YACnB,KAAK;YACL,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;YAClG,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE;SACnB;KACF,CAAC,CAAC;AACL,CAAC"}
|
package/dist/permissions.d.ts
CHANGED
|
@@ -20,6 +20,17 @@ export type SessionVerifier = (principal: {
|
|
|
20
20
|
/** Out-of-band key on a session-caller permission set: the grant expiry (unix seconds) the callout
|
|
21
21
|
* binds the minted JWT to, instead of the bearer's. Stripped before the JWT is encoded. */
|
|
22
22
|
export declare const SESSION_EXP = "__cotalSessionExp";
|
|
23
|
+
/** The callout's issuing seam for an interactive user's `manager-caller` view (SPEC 13.15). `mint`
|
|
24
|
+
* builds the view's permission set for the given `issued` pair, so the evidence is the set that is signed.
|
|
25
|
+
* Issues a fresh generation, or renews the generation the connection's accepted row already names. */
|
|
26
|
+
export type UserCallerIssuer = (args: {
|
|
27
|
+
t: ValidatedUserToken;
|
|
28
|
+
connId: string;
|
|
29
|
+
mint: (issued: {
|
|
30
|
+
generation: string;
|
|
31
|
+
acceptedToken: string;
|
|
32
|
+
}) => Record<string, unknown>;
|
|
33
|
+
}) => Promise<Record<string, unknown>>;
|
|
23
34
|
/** The per-agent channel/role ACL a user-mode grant needs — resolved SERVER-SIDE (the spawn ledger /
|
|
24
35
|
* persona registry, keyed by the authenticated principal), because the user token carries the identity
|
|
25
36
|
* and capabilities but NOT the channel read/post ACL. Injected by the composition root that launches the
|
|
@@ -28,6 +39,9 @@ export type AclResolver = (t: ValidatedUserToken) => Pick<MintOpts, "allowSubscr
|
|
|
28
39
|
/** The actor's CURRENT capability grant (the row's scope), so the mint can re-contain the
|
|
29
40
|
* bearer's capabilities against the row AS OF THE MINT, not only as of the connect gate. */
|
|
30
41
|
scope: string[];
|
|
42
|
+
/** The row space the actor was found in. Only an `interactive` row's `manager-caller` view is
|
|
43
|
+
* issued (SPEC 13.15). */
|
|
44
|
+
kind?: "interactive" | "managed-agent";
|
|
31
45
|
};
|
|
32
46
|
/**
|
|
33
47
|
* Build the callout's `permissionsFor` hook. Maps `ValidatedUserToken` → `MintPrincipal` → core's
|
|
@@ -44,4 +58,5 @@ export type AclResolver = (t: ValidatedUserToken) => Pick<MintOpts, "allowSubscr
|
|
|
44
58
|
export declare function calloutPermissions(resolveAcl: AclResolver): (t: ValidatedUserToken, connId: string) => Record<string, unknown>;
|
|
45
59
|
export declare function calloutPermissions(resolveAcl: AclResolver, authorizeManagerCaller: (owner: string, instanceId: string) => Promise<void>): (t: ValidatedUserToken, connId: string) => Record<string, unknown> | Promise<Record<string, unknown>>;
|
|
46
60
|
export declare function calloutPermissions(resolveAcl: AclResolver, authorizeManagerCaller: (owner: string, instanceId: string) => Promise<void>, verifySession: SessionVerifier): (t: ValidatedUserToken, connId: string) => Record<string, unknown> | Promise<Record<string, unknown>>;
|
|
61
|
+
export declare function calloutPermissions(resolveAcl: AclResolver, authorizeManagerCaller: (owner: string, instanceId: string) => Promise<void>, verifySession: SessionVerifier, issueUserCaller: UserCallerIssuer): (t: ValidatedUserToken, connId: string) => Record<string, unknown> | Promise<Record<string, unknown>>;
|
|
47
62
|
//# sourceMappingURL=permissions.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAA+D,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE5G,OAAO,KAAK,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEvE,kFAAkF;AAClF,MAAM,MAAM,eAAe,GAAG,CAC5B,SAAS,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,EAClE,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,KAC1D,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAE/B;4FAC4F;AAC5F,eAAO,MAAM,WAAW,sBAAsB,CAAC;AAE/C;;;8FAG8F;AAC9F,MAAM,MAAM,WAAW,GAAG,CACxB,CAAC,EAAE,kBAAkB,KAClB,IAAI,CAAC,QAAQ,EAAE,gBAAgB,GAAG,cAAc,GAAG,MAAM,GAAG,cAAc,CAAC,GAAG;IACjF;iGAC6F;IAC7F,KAAK,EAAE,MAAM,EAAE,CAAC;
|
|
1
|
+
{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAA+D,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE5G,OAAO,KAAK,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEvE,kFAAkF;AAClF,MAAM,MAAM,eAAe,GAAG,CAC5B,SAAS,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,EAClE,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,KAC1D,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAE/B;4FAC4F;AAC5F,eAAO,MAAM,WAAW,sBAAsB,CAAC;AAE/C;;uGAEuG;AACvG,MAAM,MAAM,gBAAgB,GAAG,CAAC,IAAI,EAAE;IACpC,CAAC,EAAE,kBAAkB,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1F,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEvC;;;8FAG8F;AAC9F,MAAM,MAAM,WAAW,GAAG,CACxB,CAAC,EAAE,kBAAkB,KAClB,IAAI,CAAC,QAAQ,EAAE,gBAAgB,GAAG,cAAc,GAAG,MAAM,GAAG,cAAc,CAAC,GAAG;IACjF;iGAC6F;IAC7F,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;+BAC2B;IAC3B,IAAI,CAAC,EAAE,aAAa,GAAG,eAAe,CAAC;CACxC,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,WAAW,GAAG,CAAC,CAAC,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAChI,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,WAAW,EACvB,sBAAsB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAC3E,CAAC,CAAC,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AACzG,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,WAAW,EACvB,sBAAsB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,EAC5E,aAAa,EAAE,eAAe,GAC7B,CAAC,CAAC,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AACzG,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,WAAW,EACvB,sBAAsB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,EAC5E,aAAa,EAAE,eAAe,EAC9B,eAAe,EAAE,gBAAgB,GAChC,CAAC,CAAC,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC"}
|
package/dist/permissions.js
CHANGED
|
@@ -10,7 +10,7 @@ import { VIEW_REQUIRED_SCOPE } from "./token.js";
|
|
|
10
10
|
/** Out-of-band key on a session-caller permission set: the grant expiry (unix seconds) the callout
|
|
11
11
|
* binds the minted JWT to, instead of the bearer's. Stripped before the JWT is encoded. */
|
|
12
12
|
export const SESSION_EXP = "__cotalSessionExp";
|
|
13
|
-
export function calloutPermissions(resolveAcl, authorizeManagerCaller, verifySession) {
|
|
13
|
+
export function calloutPermissions(resolveAcl, authorizeManagerCaller, verifySession, issueUserCaller) {
|
|
14
14
|
return (t, connId) => {
|
|
15
15
|
assertDerivedOwnerToken(t.owner); // user-mode owners are derived — never `local`, never an nkey
|
|
16
16
|
const caps = t.act.scope ?? [];
|
|
@@ -72,7 +72,10 @@ export function calloutPermissions(resolveAcl, authorizeManagerCaller, verifySes
|
|
|
72
72
|
const instanceId = t.act.managerInstanceId;
|
|
73
73
|
if (!authorizeManagerCaller)
|
|
74
74
|
throw new Error("callout permissions: manager-caller needs the server-side manager gate authorizer");
|
|
75
|
-
|
|
75
|
+
const mint = (issued) => permissionsFor("manager-caller", t.space, { ...principal, lifecycleUid: t.act.lifecycleUid }, { capabilities: caps, lifecycleUid: t.act.lifecycleUid, managerInstanceId: instanceId, ...(issued ? { issued } : {}) });
|
|
76
|
+
// An interactive user's view is issued (SPEC 13.15): its run commands ride `ep.v1` under a
|
|
77
|
+
// generation bound to this row. A managed row's view keeps the legacy rail.
|
|
78
|
+
return authorizeManagerCaller(t.owner, instanceId).then(() => acl.kind === "interactive" && issueUserCaller ? issueUserCaller({ t, connId, mint }) : mint());
|
|
76
79
|
}
|
|
77
80
|
return permissionsFor(t.act.view, t.space,
|
|
78
81
|
// The bearer's ledger lifecycle claim rides the principal: an operator INSTRUMENT view
|
package/dist/permissions.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,cAAc,EAAE,uBAAuB,EAAqC,MAAM,gBAAgB,CAAC;AAC5G,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AASjD;4FAC4F;AAC5F,MAAM,CAAC,MAAM,WAAW,GAAG,mBAAmB,CAAC;
|
|
1
|
+
{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,cAAc,EAAE,uBAAuB,EAAqC,MAAM,gBAAgB,CAAC;AAC5G,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AASjD;4FAC4F;AAC5F,MAAM,CAAC,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAsD/C,MAAM,UAAU,kBAAkB,CAChC,UAAuB,EACvB,sBAA6E,EAC7E,aAA+B,EAC/B,eAAkC;IAElC,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QACnB,uBAAuB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,8DAA8D;QAChG,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;QAC/B,qGAAqG;QACrG,uGAAuG;QACvG,MAAM,IAAI,GAAG,CAAC,EAAY,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,kGAAkG,CACnG,CAAC;QACJ,MAAM,SAAS,GAAkB,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChF,2FAA2F;QAC3F,sFAAsF;QACtF,oBAAoB;QACpB,IAAI,CAAC,CAAC,GAAG,CAAC,YAAY,KAAK,SAAS;YAClC,MAAM,IAAI,KAAK,CAAC,qHAAqH,CAAC,CAAC;QACzI,+EAA+E;QAC/E,kFAAkF;QAClF,yFAAyF;QACzF,4FAA4F;QAC5F,yFAAyF;QACzF,0FAA0F;QAC1F,2FAA2F;QAC3F,yFAAyF;QACzF,6CAA6C;QAC7C,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,GAAG,CAAC,YAAY;YACzC,MAAM,IAAI,KAAK,CAAC,gJAAgJ,CAAC,CAAC;QACpK,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,IAAI;YAClB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,8EAA8E,CAAC,CAAC;QAChJ,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,wFAAwF;YACxF,sFAAsF;YACtF,qFAAqF;YACrF,qFAAqF;YACrF,0FAA0F;YAC1F,MAAM,IAAI,GAAG,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAC5C,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,GAAG,CAAC,IAAI,yBAAyB,IAAI,mCAAmC,CAAC,CAAC;YAC5H,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,iBAAiB;gBAClC,MAAM,IAAI,KAAK,CAAC,0HAA0H,CAAC,CAAC;YAC9I,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBACpC,sFAAsF;gBACtF,yFAAyF;gBACzF,iFAAiF;gBACjF,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,OAAQ,CAAC;gBAC7B,IAAI,CAAC,aAAa;oBAChB,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;gBAChG,OAAO,aAAa,CAClB,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,EACxE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAC7E,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;oBACX,IAAI,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;wBAAE,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;oBAC5H,OAAO;wBACL,GAAG,cAAc,CAAC,gBAAgB,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,aAAa,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;wBAC5I,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,GAAG;qBACrB,CAAC;gBACJ,CAAC,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBACpC,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,iBAAkB,CAAC;gBAC5C,IAAI,CAAC,sBAAsB;oBACzB,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;gBACvG,MAAM,IAAI,GAAG,CAAC,MAAsD,EAAE,EAAE,CAAC,cAAc,CACrF,gBAAgB,EAChB,CAAC,CAAC,KAAK,EACP,EAAE,GAAG,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,EAClD,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CACvH,CAAC;gBACF,2FAA2F;gBAC3F,4EAA4E;gBAC5E,OAAO,sBAAsB,CAAC,CAAC,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAC3D,GAAG,CAAC,IAAI,KAAK,aAAa,IAAI,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACnG,CAAC;YACD,OAAO,cAAc,CACnB,CAAC,CAAC,GAAG,CAAC,IAAI,EACV,CAAC,CAAC,KAAK;YACP,uFAAuF;YACvF,yFAAyF;YACzF,oFAAoF;YACpF,EAAE,GAAG,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE;YAClD,sFAAsF;YACtF,+EAA+E;YAC/E,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,YAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CACxE,CAAC;QACJ,CAAC;QACD,gGAAgG;QAChG,mFAAmF;QACnF,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,GAAG,GAAG,CAAC;QAC7C,OAAO,cAAc,CACnB,OAAO,EACP,CAAC,CAAC,KAAK,EACP,EAAE,GAAG,SAAS,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,EAChD,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CACnC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}
|
|
@@ -5,7 +5,7 @@
|
|
|
5
5
|
* no capability and no IdP input, and it adds no request kind: each inner request goes through the
|
|
6
6
|
* same parser and plane function the human route uses, with the assignment in place of `supervise`.
|
|
7
7
|
*/
|
|
8
|
-
import { type PlatformControlAssignment, type PlatformControlAuthorityRequest, type PlatformControlAuthorityResult, type PlatformControlInnerRequest } from "@cotal-ai/core";
|
|
8
|
+
import { type EpAttributedReply, type PlatformControlAssignment, type PlatformControlAuthorityRequest, type PlatformControlAuthorityResult, type PlatformControlInnerRequest } from "@cotal-ai/core";
|
|
9
9
|
/** Who an issuance is for. A human holder carries its fresh ledger scope; a platform holder carries
|
|
10
10
|
* the assignment the door read for this call. The platform arm never carries a scope. */
|
|
11
11
|
export type ManagerAuthorityHolder = {
|
|
@@ -42,6 +42,13 @@ export interface PlatformControlDeps {
|
|
|
42
42
|
holder: "platform";
|
|
43
43
|
}>, request: PlatformControlInnerRequest): Promise<unknown>;
|
|
44
44
|
}
|
|
45
|
+
type AssignmentDeps = Omit<PlatformControlDeps, "dispatch">;
|
|
45
46
|
/** Build the door. Every refusal below runs before dispatch and writes nothing. */
|
|
46
47
|
export declare function makePlatformControlAuthority(deps: PlatformControlDeps): <R extends PlatformControlInnerRequest>(raw: PlatformControlAuthorityRequest<R>) => Promise<PlatformControlAuthorityResult<R>>;
|
|
48
|
+
/** Build the readiness read: the `status` answer of the assigned instance, under the same fresh
|
|
49
|
+
* assignment and owner checks as the door. `readStatus` holds the only caller rights. */
|
|
50
|
+
export declare function makePlatformControlReadiness(deps: AssignmentDeps & {
|
|
51
|
+
readStatus(instanceId: string): Promise<EpAttributedReply>;
|
|
52
|
+
}): (instanceId: string) => Promise<EpAttributedReply>;
|
|
53
|
+
export {};
|
|
47
54
|
//# sourceMappingURL=platform-control.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"platform-control.d.ts","sourceRoot":"","sources":["../src/platform-control.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAIL,KAAK,yBAAyB,EAC9B,KAAK,+BAA+B,EACpC,KAAK,8BAA8B,EACnC,KAAK,2BAA2B,EACjC,MAAM,gBAAgB,CAAC;AAExB;yFACyF;AACzF,MAAM,MAAM,sBAAsB,GAC9B;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GACpD;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,yBAAyB,CAAA;CAAE,CAAC;AAEjF;;cAEc;AACd,wBAAgB,6BAA6B,CAAC,CAAC,EAAE,sBAAsB,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAQvH;AAwBD;;qEAEqE;AACrE,wBAAgB,oCAAoC,CAAC,GAAG,EAAE,OAAO,GAAG,+BAA+B,CAuBlG;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAAC;IACtG,yGAAyG;IACzG,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAChI,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,sBAAsB,EAAE;QAAE,MAAM,EAAE,UAAU,CAAA;KAAE,CAAC,EAAE,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnI;AAED,mFAAmF;AACnF,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,mBAAmB,IACtD,CAAC,SAAS,2BAA2B,EAAE,KAAK,+BAA+B,CAAC,CAAC,CAAC,KAAG,OAAO,CAAC,8BAA8B,CAAC,CAAC,CAAC,CAAC,
|
|
1
|
+
{"version":3,"file":"platform-control.d.ts","sourceRoot":"","sources":["../src/platform-control.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAIL,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,+BAA+B,EACpC,KAAK,8BAA8B,EACnC,KAAK,2BAA2B,EACjC,MAAM,gBAAgB,CAAC;AAExB;yFACyF;AACzF,MAAM,MAAM,sBAAsB,GAC9B;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GACpD;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,yBAAyB,CAAA;CAAE,CAAC;AAEjF;;cAEc;AACd,wBAAgB,6BAA6B,CAAC,CAAC,EAAE,sBAAsB,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAQvH;AAwBD;;qEAEqE;AACrE,wBAAgB,oCAAoC,CAAC,GAAG,EAAE,OAAO,GAAG,+BAA+B,CAuBlG;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAAC;IACtG,yGAAyG;IACzG,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAChI,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,sBAAsB,EAAE;QAAE,MAAM,EAAE,UAAU,CAAA;KAAE,CAAC,EAAE,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnI;AAED,KAAK,cAAc,GAAG,IAAI,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC;AAuB5D,mFAAmF;AACnF,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,mBAAmB,IACtD,CAAC,SAAS,2BAA2B,EAAE,KAAK,+BAA+B,CAAC,CAAC,CAAC,KAAG,OAAO,CAAC,8BAA8B,CAAC,CAAC,CAAC,CAAC,CAuB1I;AAED;yFACyF;AACzF,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,cAAc,GAAG;IAAE,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAA;CAAE,IAClH,YAAY,MAAM,KAAG,OAAO,CAAC,iBAAiB,CAAC,CAO9D"}
|
package/dist/platform-control.js
CHANGED
|
@@ -75,22 +75,34 @@ export function parsePlatformControlAuthorityRequest(raw) {
|
|
|
75
75
|
badRequest("inner session must be exactly { id, endpoint, sessionId, epoch, exp } (the protocol is closed)");
|
|
76
76
|
return o;
|
|
77
77
|
}
|
|
78
|
+
/** The account's current assignment, read fresh on every call. */
|
|
79
|
+
async function observeCurrentAssignment(deps) {
|
|
80
|
+
let assignment;
|
|
81
|
+
try {
|
|
82
|
+
assignment = await deps.observeAssignment(deps.space, deps.accountPublicKey);
|
|
83
|
+
}
|
|
84
|
+
catch (e) {
|
|
85
|
+
throw new EpEnvelopeError("unavailable", `platform control assignment is unreadable: ${e?.message ?? String(e)}`);
|
|
86
|
+
}
|
|
87
|
+
if (!assignment || assignment.state !== "assigned")
|
|
88
|
+
throw new EpEnvelopeError("permission-denied", "platform control has no current assignment for this account");
|
|
89
|
+
return assignment;
|
|
90
|
+
}
|
|
91
|
+
/** The assigned instance's gate, when it exists, must name this owner's serve principal: the door
|
|
92
|
+
* never acts for an instance another owner registered. */
|
|
93
|
+
async function requireOwnInstance(deps, instanceId) {
|
|
94
|
+
const own = await deps.observeManagerInstance(instanceId);
|
|
95
|
+
if (own.gate && own.gate.principal !== `${deps.owner}.${remoteManagerActors(instanceId).serve}`)
|
|
96
|
+
throw new EpEnvelopeError("permission-denied", `platform control instance ${instanceId} is registered to another principal`);
|
|
97
|
+
}
|
|
78
98
|
/** Build the door. Every refusal below runs before dispatch and writes nothing. */
|
|
79
99
|
export function makePlatformControlAuthority(deps) {
|
|
80
100
|
return async (raw) => {
|
|
81
101
|
const envelope = parsePlatformControlAuthorityRequest(raw);
|
|
82
102
|
if (envelope.space !== deps.space || envelope.accountPublicKey !== deps.accountPublicKey)
|
|
83
103
|
throw new EpEnvelopeError("permission-denied", "platform control request names another space or account than this authority context");
|
|
84
|
-
|
|
85
|
-
try {
|
|
86
|
-
assignment = await deps.observeAssignment(deps.space, deps.accountPublicKey);
|
|
87
|
-
}
|
|
88
|
-
catch (e) {
|
|
89
|
-
throw new EpEnvelopeError("unavailable", `platform control assignment is unreadable: ${e?.message ?? String(e)}`);
|
|
90
|
-
}
|
|
104
|
+
const assignment = await observeCurrentAssignment(deps);
|
|
91
105
|
const inner = envelope.request;
|
|
92
|
-
if (!assignment || assignment.state !== "assigned")
|
|
93
|
-
throw new EpEnvelopeError("permission-denied", "platform control has no current assignment for this account");
|
|
94
106
|
if (assignment.v !== 1 || assignment.space !== deps.space || assignment.accountPublicKey !== deps.accountPublicKey ||
|
|
95
107
|
assignment.assignmentRevision !== envelope.assignmentRevision)
|
|
96
108
|
throw new EpEnvelopeError("permission-denied", "platform control request does not match the current assignment's account or revision");
|
|
@@ -98,12 +110,7 @@ export function makePlatformControlAuthority(deps) {
|
|
|
98
110
|
throw new EpEnvelopeError("permission-denied", "platform control request names an instance or lifecycle the current assignment does not");
|
|
99
111
|
if (inner.space !== deps.space || (inner.accountPublicKey !== undefined && inner.accountPublicKey !== deps.accountPublicKey))
|
|
100
112
|
throw new EpEnvelopeError("permission-denied", "platform control inner request names another space or account");
|
|
101
|
-
|
|
102
|
-
// never issues for an instance another owner registered.
|
|
103
|
-
const own = await deps.observeManagerInstance(assignment.instanceId);
|
|
104
|
-
const servePrincipal = `${deps.owner}.${remoteManagerActors(assignment.instanceId).serve}`;
|
|
105
|
-
if (own.gate && own.gate.principal !== servePrincipal)
|
|
106
|
-
throw new EpEnvelopeError("permission-denied", `platform control instance ${assignment.instanceId} is registered to another principal`);
|
|
113
|
+
await requireOwnInstance(deps, assignment.instanceId);
|
|
107
114
|
if (inner.kind === "manager-service-authority" && (inner.operation === "prepare" || inner.operation === "activate") &&
|
|
108
115
|
assignment.predecessorInstanceId !== undefined) {
|
|
109
116
|
// Read-only: the door never probes, freezes, evicts, revokes or deregisters the predecessor.
|
|
@@ -114,4 +121,15 @@ export function makePlatformControlAuthority(deps) {
|
|
|
114
121
|
return await deps.dispatch({ holder: "platform", owner: deps.owner, assignment }, inner);
|
|
115
122
|
};
|
|
116
123
|
}
|
|
124
|
+
/** Build the readiness read: the `status` answer of the assigned instance, under the same fresh
|
|
125
|
+
* assignment and owner checks as the door. `readStatus` holds the only caller rights. */
|
|
126
|
+
export function makePlatformControlReadiness(deps) {
|
|
127
|
+
return async (instanceId) => {
|
|
128
|
+
const assignment = await observeCurrentAssignment(deps);
|
|
129
|
+
if (assignment.v !== 1 || assignment.space !== deps.space || assignment.accountPublicKey !== deps.accountPublicKey || assignment.instanceId !== instanceId)
|
|
130
|
+
throw new EpEnvelopeError("permission-denied", `platform control instance ${instanceId} is not the current assignment's instance`);
|
|
131
|
+
await requireOwnInstance(deps, instanceId);
|
|
132
|
+
return await deps.readStatus(instanceId);
|
|
133
|
+
};
|
|
134
|
+
}
|
|
117
135
|
//# sourceMappingURL=platform-control.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"platform-control.js","sourceRoot":"","sources":["../src/platform-control.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,mBAAmB,
|
|
1
|
+
{"version":3,"file":"platform-control.js","sourceRoot":"","sources":["../src/platform-control.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,mBAAmB,GAMpB,MAAM,gBAAgB,CAAC;AAQxB;;cAEc;AACd,MAAM,UAAU,6BAA6B,CAAC,CAAyB,EAAE,UAAkB,EAAE,YAAoB;IAC/G,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC5B,wBAAwB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,KAAK,UAAU,IAAI,CAAC,CAAC,UAAU,CAAC,UAAU,KAAK,UAAU;YAC7E,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,6BAA6B,UAAU,2CAA2C,CAAC,CAAC;QACrI,OAAO;IACT,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,YAAY,CAAC,CAAC;AACnG,CAAC;AAED,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,2BAA2B;IAC3B,6BAA6B;IAC7B,mCAAmC;IACnC,yBAAyB;IACzB,6BAA6B;IAC7B,uBAAuB;IACvB,qBAAqB;CACtB,CAAC,CAAC;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,kCAAkC;IAClC,0CAA0C;IAC1C,sCAAsC;IACtC,sCAAsC;CACvC,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,iCAAiC,CAAC;AAEzD,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,4BAA4B,IAAI,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED;;qEAEqE;AACrE,MAAM,UAAU,oCAAoC,CAAC,GAAY;IAC/D,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,UAAU,CAAC,mBAAmB,CAAC,CAAC;IACnG,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,SAAS,CAAC,CAAC,CAAC;IACrG,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,UAAU,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IAC7I,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,4BAA4B;QAAE,UAAU,CAAC,yDAAyD,CAAC,CAAC;IAChI,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC;IACxF,IAAI,OAAO,CAAC,CAAC,gBAAgB,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC;QAAE,UAAU,CAAC,gCAAgC,CAAC,CAAC;IACxI,IAAI,OAAO,CAAC,CAAC,kBAAkB,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,kBAAkB,GAAG,CAAC;QACrH,UAAU,CAAC,oDAAoD,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC;IACxB,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,UAAU,CAAC,kCAAkC,CAAC,CAAC;IACxH,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAC;IAChD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC;QAC3D,MAAM,IAAI,eAAe,CAAC,eAAe,EAAE,oGAAoG,CAAC,CAAC;IACnJ,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,UAAU,CAAC,8BAA8B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzH,IAAK,KAA6B,CAAC,KAAK,KAAK,KAAK;QAAE,UAAU,CAAC,yDAAyD,CAAC,CAAC;IAC1H,KAAK,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,qBAAqB,CAAU;QAC9D,IAAI,OAAQ,KAAiC,CAAC,GAAG,CAAC,KAAK,QAAQ;YAAE,UAAU,CAAC,0BAA0B,GAAG,EAAE,CAAC,CAAC;IAC/G,MAAM,OAAO,GAAI,KAA+B,CAAC,OAAO,CAAC;IACzD,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,cAAc,CAAC;QACxI,UAAU,CAAC,gGAAgG,CAAC,CAAC;IAC/G,OAAO,CAA+C,CAAC;AACzD,CAAC;AAcD,kEAAkE;AAClE,KAAK,UAAU,wBAAwB,CAAC,IAAoB;IAC1D,IAAI,UAA4C,CAAC;IACjD,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC/E,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,8CAA+C,CAAW,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/H,CAAC;IACD,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,KAAK,KAAK,UAAU;QAChD,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,6DAA6D,CAAC,CAAC;IAChH,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;0DAC0D;AAC1D,KAAK,UAAU,kBAAkB,CAAC,IAAoB,EAAE,UAAkB;IACxE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAC1D,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,mBAAmB,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE;QAC7F,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,6BAA6B,UAAU,qCAAqC,CAAC,CAAC;AACjI,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,4BAA4B,CAAC,IAAyB;IACpE,OAAO,KAAK,EAAyC,GAAuC,EAA8C,EAAE;QAC1I,MAAM,QAAQ,GAAG,oCAAoC,CAAC,GAAG,CAAC,CAAC;QAC3D,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,gBAAgB,KAAK,IAAI,CAAC,gBAAgB;YACtF,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,qFAAqF,CAAC,CAAC;QACxI,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,QAAQ,CAAC,OAA0J,CAAC;QAClL,IAAI,UAAU,CAAC,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,gBAAgB,KAAK,IAAI,CAAC,gBAAgB;YAC9G,UAAU,CAAC,kBAAkB,KAAK,QAAQ,CAAC,kBAAkB;YAC/D,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,sFAAsF,CAAC,CAAC;QACzI,IAAI,KAAK,CAAC,UAAU,KAAK,UAAU,CAAC,UAAU,IAAI,KAAK,CAAC,mBAAmB,KAAK,UAAU,CAAC,YAAY;YACrG,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,yFAAyF,CAAC,CAAC;QAC5I,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,gBAAgB,KAAK,SAAS,IAAI,KAAK,CAAC,gBAAgB,KAAK,IAAI,CAAC,gBAAgB,CAAC;YAC1H,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,+DAA+D,CAAC,CAAC;QAClH,MAAM,kBAAkB,CAAC,IAAI,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;QACtD,IAAI,KAAK,CAAC,IAAI,KAAK,2BAA2B,IAAI,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,UAAU,CAAC;YAC/G,UAAU,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;YACnD,6FAA6F;YAC7F,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;YACxF,IAAI,WAAW,CAAC,UAAU,IAAI,WAAW,CAAC,IAAI,EAAE,KAAK,KAAK,QAAQ;gBAChE,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,gCAAgC,UAAU,CAAC,qBAAqB,yEAAyE,CAAC,CAAC;QAChM,CAAC;QACD,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,KAAK,CAAsC,CAAC;IAChI,CAAC,CAAC;AACJ,CAAC;AAED;yFACyF;AACzF,MAAM,UAAU,4BAA4B,CAAC,IAAqF;IAChI,OAAO,KAAK,EAAE,UAAkB,EAA8B,EAAE;QAC9D,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,UAAU,CAAC,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,gBAAgB,KAAK,IAAI,CAAC,gBAAgB,IAAI,UAAU,CAAC,UAAU,KAAK,UAAU;YACxJ,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,6BAA6B,UAAU,2CAA2C,CAAC,CAAC;QACrI,MAAM,kBAAkB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC3C,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAC3C,CAAC,CAAC;AACJ,CAAC"}
|
package/dist/service.d.ts
CHANGED
|
@@ -1,11 +1,12 @@
|
|
|
1
1
|
import { type IncomingMessage, type ServerResponse } from "node:http";
|
|
2
|
-
import { type EpGateState, type ParsedArgs, type PlatformControlAssignment, type PlatformControlAuthorityRequest, type PlatformControlAuthorityResult, type PlatformControlInnerRequest, type RemoteManagerAdminAuthorizationRequest, type RemoteManagerAuthorityRequest, type RemoteManagerMaintenanceRequest, type RemoteRetainedAgentValidationRequest, type SecretStore } from "@cotal-ai/core";
|
|
2
|
+
import { type EpAttributedReply, type EpGateState, type ParsedArgs, type PlatformControlAssignment, type PlatformControlAuthorityRequest, type PlatformControlAuthorityResult, type PlatformControlInnerRequest, type RemoteManagerAdminAuthorizationRequest, type RemoteManagerAuthorityRequest, type RemoteManagerMaintenanceRequest, type RemoteRetainedAgentValidationRequest, type SecretStore } from "@cotal-ai/core";
|
|
3
3
|
import { type HostedContextInputs, type HostedServiceHandle, type ManagerInstanceIdentity } from "@cotal-ai/workspace";
|
|
4
4
|
import { type ManagerAuthorityHolder } from "./platform-control.js";
|
|
5
5
|
import { type IdpBridge } from "./idp.js";
|
|
6
6
|
import { type UserTokenSession, type ValidatedUserToken } from "./token.js";
|
|
7
7
|
import { pinnedJwksResolver, type UserTokenIssuer } from "./issuer.js";
|
|
8
|
-
import { type
|
|
8
|
+
import { type UserCallerIssuer } from "./permissions.js";
|
|
9
|
+
import { type ObserveManagerGate, type RemoteManagedAgentRuntimeDecision } from "./managed-agent-enrollment.js";
|
|
9
10
|
import { type PlaneLivenessOracle } from "./plane-claim.js";
|
|
10
11
|
import { type EvictPrincipal } from "./credential-ledger.js";
|
|
11
12
|
/** JWKS max-age seconds — the cache contract's knob. Exported so a rotation tool can compute the
|
|
@@ -33,6 +34,10 @@ export interface AuthAuthorityPlane {
|
|
|
33
34
|
}) => Promise<string>;
|
|
34
35
|
selectManagerInstance: (owner: string, requested?: string) => Promise<string>;
|
|
35
36
|
authorizeManagerCaller: (owner: string, instanceId: string) => Promise<void>;
|
|
37
|
+
/** The callout's issuance of an interactive user's `manager-caller` view (SPEC 13.15): one
|
|
38
|
+
* issuer window that stages and releases evidence bound to the actor-ledger row and writes the
|
|
39
|
+
* connection's accepted row, or renews the generation that row already names. */
|
|
40
|
+
issueUserCaller: UserCallerIssuer;
|
|
36
41
|
/** #2312: may this principal hold this one session? Leader-reads the redeemed `session.<id>` row
|
|
37
42
|
* and the serving manager gate; returns the session claim (expiry from the row) or throws. */
|
|
38
43
|
verifySession: (principal: {
|
|
@@ -56,6 +61,13 @@ export interface AuthAuthorityPlane {
|
|
|
56
61
|
alreadyRetired?: boolean;
|
|
57
62
|
}>;
|
|
58
63
|
retireManagedLifecycle: AuthAuthorityPlane["retireInteractiveLifecycle"];
|
|
64
|
+
/** Activate a managed agent's lifecycle at the uid its grant carries, under the same minting
|
|
65
|
+
* authority its first bearer exchange names, and mint nothing (SPEC 13.16). */
|
|
66
|
+
activateManagedLifecycle: (args: {
|
|
67
|
+
owner: string;
|
|
68
|
+
actor: string;
|
|
69
|
+
lifecycleUid: string;
|
|
70
|
+
}) => Promise<void>;
|
|
59
71
|
issueManagerServiceAuthority: (args: ManagerAuthorityHolder & {
|
|
60
72
|
request: RemoteManagerAuthorityRequest;
|
|
61
73
|
}) => Promise<import("@cotal-ai/core").RemoteManagerAuthorityMaterial>;
|
|
@@ -203,6 +215,19 @@ export interface AuthServiceHandle extends HostedServiceHandle {
|
|
|
203
215
|
* {@link startAuthService}. In-process and typed: no route, no capability, and no signer or
|
|
204
216
|
* capability in the result. */
|
|
205
217
|
platformControlAuthority?<R extends PlatformControlInnerRequest>(request: PlatformControlAuthorityRequest<R>): Promise<PlatformControlAuthorityResult<R>>;
|
|
218
|
+
/** The platform readiness read (SPEC 13.9). Present only with `platformControl`. Answers the
|
|
219
|
+
* `status` of the currently assigned manager instance and refuses any other instance. It reads
|
|
220
|
+
* over this context's own connection, whose grant is that instance's `describe` and `status`;
|
|
221
|
+
* neither the connection nor its credential leaves the process. */
|
|
222
|
+
platformControlReadiness?(instanceId: string): Promise<EpAttributedReply>;
|
|
223
|
+
/** The manager gate the delegated user intent decisions read (SPEC 13.16). Present only with
|
|
224
|
+
* `platformControl`. It reads over the context's own authority connection, so a host opens no
|
|
225
|
+
* second data-account connection, and it returns the gate alone. */
|
|
226
|
+
observeManagerGate?: ObserveManagerGate;
|
|
227
|
+
/** The activation a delegated launch runs at its pinned uid before any row or durable, and its
|
|
228
|
+
* compensation runs before the terminal barrier (SPEC 13.16). Present only with
|
|
229
|
+
* `platformControl`. It refuses every state in which a retirement at that uid has begun. */
|
|
230
|
+
activateManagedLifecycle?: AuthAuthorityPlane["activateManagedLifecycle"];
|
|
206
231
|
}
|
|
207
232
|
/** The optional public exchange face: the CLI's `--exchange-public-*`, `--advertised-server` and
|
|
208
233
|
* `--agent-provisioning-url` flags, or the hosted `publicFace` input. */
|
package/dist/service.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAwDA,OAAO,EAAgB,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAKpF,OAAO,
|
|
1
|
+
{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAwDA,OAAO,EAAgB,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAKpF,OAAO,EAAw3C,KAAK,iBAAiB,EAAiB,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,KAAK,yBAAyB,EAAE,KAAK,+BAA+B,EAAE,KAAK,8BAA8B,EAAE,KAAK,2BAA2B,EAAE,KAAK,sCAAsC,EAAE,KAAK,6BAA6B,EAAE,KAAK,+BAA+B,EAAE,KAAK,oCAAoC,EAAE,KAAK,WAAW,EAAgE,MAAM,gBAAgB,CAAC;AAC/1D,OAAO,EAA4I,KAAK,mBAAmB,EAAyB,KAAK,mBAAmB,EAA2B,KAAK,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAGjT,OAAO,EAA6F,KAAK,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAE/J,OAAO,EAAmC,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAC3E,OAAO,EAAyB,KAAK,gBAAgB,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEvH,OAAO,EAAE,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAsB,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAG7E,OAAO,EAA2K,KAAK,kBAAkB,EAAE,KAAK,iCAAiC,EAAE,MAAM,+BAA+B,CAAC;AAYzR,OAAO,EAA4H,KAAK,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACtL,OAAO,EAAkD,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AA+B7G;uDACuD;AACvD,eAAO,MAAM,gBAAgB,MAAM,CAAC;AAEpC,4HAA4H;AAC5H,eAAO,MAAM,uBAAuB,kCAAkC,CAAC;AAEvE;gGACgG;AAChG,eAAO,MAAM,mBAAmB,8BAA8B,CAAC;AAE/D;;8FAE8F;AAC9F,eAAO,MAAM,sBAAsB,iDAAiD,CAAC;AAsBrF;;;+DAG+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,gBAAgB,EAAE,CAAC,CAAC,EAAE,kBAAkB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,qBAAqB,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACzG,qBAAqB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9E,sBAAsB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E;;sFAEkF;IAClF,eAAe,EAAE,gBAAgB,CAAC;IAClC;mGAC+F;IAC/F,aAAa,EAAE,CACb,SAAS,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,EAClE,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,KAC7E,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC/B,0BAA0B,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC;QACpG,OAAO,EAAE,OAAO,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,cAAc,CAAC,EAAE,OAAO,CAAC;KAC1B,CAAC,CAAC;IACH,sBAAsB,EAAE,kBAAkB,CAAC,4BAA4B,CAAC,CAAC;IACzE;oFACgF;IAChF,wBAAwB,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1G,4BAA4B,EAAE,CAAC,IAAI,EAAE,sBAAsB,GAAG;QAAE,OAAO,EAAE,6BAA6B,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;IAC9K,qBAAqB,EAAE,CAAC,IAAI,EAAE,sBAAsB,GAAG;QAAE,OAAO,EAAE,+BAA+B,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;IACzK,qBAAqB,EAAE,CAAC,IAAI,EAAE,sBAAsB,GAAG;QACrD,OAAO,EAAE,oCAAoC,CAAC;KAC/C,KAAK,OAAO,CAAC,oCAAoC,CAAC,CAAC;IACpD;;4FAEwF;IACxF,4BAA4B,EAAE,CAAC,IAAI,EAAE;QACnC,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,gBAAgB,EAAE,mCAAmC,CAAC;KACvE,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,mCAAmC,CAAC,CAAC;IAC5E,+FAA+F;IAC/F,mCAAmC,EAAE,CAAC,IAAI,EAAE;QAC1C,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,gBAAgB,EAAE,0CAA0C,CAAC;KAC9E,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,0CAA0C,CAAC,CAAC;IACnF;0FACsF;IACtF,yBAAyB,EAAE,CAAC,IAAI,EAAE;QAChC,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,OAAO,gBAAgB,EAAE,gCAAgC,CAAC;KACpE,KAAK,OAAO,CAAC,iCAAiC,CAAC,CAAC;IACjD,oBAAoB,EAAE,CAAC,IAAI,EAAE,sBAAsB,GAAG;QACpD,OAAO,EAAE,OAAO,gBAAgB,EAAE,iCAAiC,CAAC;KACrE,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,gCAAgC,CAAC,CAAC;IACzE,qBAAqB,EAAE,CAAC,IAAI,EAAE,sBAAsB,GAAG;QACrD,OAAO,EAAE,sCAAsC,CAAC;KACjD,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,qCAAqC,CAAC,CAAC;IAC9E;;;2FAGuF;IACvF,eAAe,EAAE,CAAC,IAAI,EAAE,sBAAsB,GAAG;QAC/C,OAAO,EAAE,OAAO,CAAC;KAClB,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,wBAAwB,CAAC,CAAC;IACjE;;wFAEoF;IACpF,sBAAsB,EAAE,CAAC,IAAI,EAAE,sBAAsB,GAAG;QACtD,OAAO,EAAE,OAAO,CAAC;KAClB,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,sBAAsB,CAAC,CAAC;IAC/D;gGAC4F;IAC5F,sBAAsB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,UAAU,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAC3G;;;;uBAImB;IACnB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACxB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,KAAK,oBAAoB,GAAG;IAAE,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9G;sGACsG;AACtG,wBAAgB,gCAAgC,CAAC,IAAI,EAAE;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,oBAAoB,GAAG,IAAI,CAAC;CACnC,GAAG,IAAI,CAUP;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,uFAAuF;IACvF,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B;;wEAEoE;IACpE,YAAY,CAAC,EAAE,cAAc,CAAC;IAC9B;;4EAEwE;IACxE,gBAAgB,CAAC,EAAE,mBAAmB,CAAC;IACvC;;iFAE6E;IAC7E,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;QAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,KAAK,IAAI,CAAC;IAChG;;kGAE8F;IAC9F,YAAY,CAAC,EAAE,MAAM,uBAAuB,GAAG,SAAS,CAAC;IACzD,sGAAsG;IACtG,2BAA2B,CAAC,EAAE,MAAM,CAAC;CACtC,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAkiC9B;AA+DD;;;;;;;;;;;sEAWsE;AACtE,wBAAsB,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAgGzF;AAED;yFACyF;AACzF,MAAM,WAAW,iBAAkB,SAAQ,mBAAmB;IAC5D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;0CAEsC;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;oCAEgC;IAChC,wBAAwB,CAAC,CAAC,CAAC,SAAS,2BAA2B,EAC7D,OAAO,EAAE,+BAA+B,CAAC,CAAC,CAAC,GAC1C,OAAO,CAAC,8BAA8B,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C;;;wEAGoE;IACpE,wBAAwB,CAAC,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC1E;;yEAEqE;IACrE,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC;;iGAE6F;IAC7F,wBAAwB,CAAC,EAAE,kBAAkB,CAAC,0BAA0B,CAAC,CAAC;CAC3E;AAED;0EAC0E;AAC1E,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,OAAO,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,sEAAsE;AACtE,MAAM,WAAW,oBAAoB;IACnC,2FAA2F;IAC3F,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAAC;CACvG;AAED;;;;;oGAKoG;AACpG,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,mBAAmB,GAAG;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qFAAqF;IACrF,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,+FAA+F;IAC/F,eAAe,CAAC,EAAE,oBAAoB,CAAC;IACvC;+FAC2F;IAC3F,2BAA2B,CAAC,EAAE,MAAM,CAAC;CACtC,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA4B7B;AA4SD,oFAAoF;AACpF,KAAK,WAAW,GAAG,OAAO,CAAC,sBAAsB,EAAE;IAAE,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC;AAExE,UAAU,UAAU;IAClB,MAAM,EAAE,eAAe,CAAC;IACxB,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAA;KAAE,CAAC;IAC5F,WAAW,EAAE,MAAM,GAAG,UAAU,CAAC;IACjC,uBAAuB,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG;QAAE,OAAO,EAAE,6BAA6B,CAAA;KAAE,KAAK,UAAU,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAC,CAAC;IAC5J,qBAAqB,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG;QAAE,OAAO,EAAE,+BAA+B,CAAA;KAAE,KAAK,UAAU,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC,CAAC;IACrJ,qBAAqB,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG;QAAE,OAAO,EAAE,oCAAoC,CAAA;KAAE,KAAK,UAAU,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAC1J,4BAA4B,EAAE,kBAAkB,CAAC,8BAA8B,CAAC,CAAC;IACjF,mCAAmC,EAAE,kBAAkB,CAAC,qCAAqC,CAAC,CAAC;IAC/F,yBAAyB,EAAE,kBAAkB,CAAC,2BAA2B,CAAC,CAAC;IAC3E,oBAAoB,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG;QAAE,OAAO,EAAE,OAAO,gBAAgB,EAAE,iCAAiC,CAAA;KAAE,KAAK,UAAU,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAC9K,qBAAqB,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG;QAAE,OAAO,EAAE,sCAAsC,CAAA;KAAE,KAAK,UAAU,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAC5J,eAAe,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,UAAU,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACjH,sBAAsB,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,UAAU,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAC,CAAC;IAC/H,OAAO,EAAE,WAAW,CAAC;IACrB,0BAA0B,EAAE,kBAAkB,CAAC,4BAA4B,CAAC,CAAC;IAC7E,sBAAsB,EAAE,kBAAkB,CAAC,wBAAwB,CAAC,CAAC;IACrE,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,GAAG,EAAE,MAAM,CAAC;IACZ;+CAC2C;IAC3C,qBAAqB,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACzG,qBAAqB,EAAE,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACnE,aAAa,EAAE,kBAAkB,CAAC,eAAe,CAAC,CAAC;CACpD;AAED,kGAAkG;AAClG,wBAAsB,+BAA+B,CACnD,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,GAAG,KAAK,GAAG,SAAS,GAAG,yBAAyB,GAAG,uBAAuB,GAAG,uBAAuB,GAAG,sBAAsB,GAAG,uBAAuB,GAAG,iBAAiB,GAAG,wBAAwB,CAAC,EACpO,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GACzB,OAAO,CAAC,OAAO,CAAC,CA+ClB;AAED;;;;4FAI4F;AAC5F,UAAU,cAAc;IACtB,iGAAiG;IACjG,iBAAiB,EAAE,OAAO,CAAC;IAC3B;;uDAEmD;IACnD,WAAW,EAAE,OAAO,CAAC;IACrB;;gEAE4D;IAC5D,qBAAqB,EAAE,OAAO,CAAC;IAC/B,wDAAwD;IACxD,OAAO,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,CAAC;IACtC,kGAAkG;IAClG,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAClD,yEAAyE;IACzE,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACpD;AAmbD;iGACiG;AACjG,wBAAsB,6BAA6B,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBrJ;AAED;;oFAEoF;AACpF,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUrE;AAaD;;;;;;sBAMsB;AACtB,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,aAAa,EAAE,MAAM,CAAC;IACtB;;gGAE4F;IAC5F,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmB1B;AAED;;;mDAGmD;AACnD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAInG;AAED;;;cAGc;AACd,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUzE"}
|