@cotal-ai/auth 0.66.1 → 0.67.0

package/dist/token.d.ts

@@ -13,18 +13,28 @@ export declare const MAX_TOKEN_TTL_SEC = 900;
  *  instead of `agent`. A closed enum on BOTH the mint and validate side — an unknown view fails
  *  closed, never falls back to a profile. Deliberately NOT a generic `view=<profile>` passthrough:
  *  most profiles are daemon/provisioning surfaces that must never become human-requestable. */
-export declare const USER_TOKEN_VIEWS: readonly ["admin", "purger", "channel-purger", "channel-writer", "deployer", "manager-service", "manager-caller", "session-caller"];
+export declare const USER_TOKEN_VIEWS: readonly ["admin", "purger", "channel-purger", "channel-writer", "deployer", "manager-service", "manager-caller", "session-caller", "transfer-writer"];
 export type UserTokenView = (typeof USER_TOKEN_VIEWS)[number];
 /** Views the public exchange face will mint (still ledger-gated). Every other
  *  {@link USER_TOKEN_VIEWS} value stays loopback-only. An actor-secret exchange may request
  *  only manager-caller, which narrows its existing command authority to one instance. */
-export declare const PUBLIC_EXCHANGE_VIEWS: readonly ["channel-writer", "channel-purger", "manager-caller", "session-caller"];
+export declare const PUBLIC_EXCHANGE_VIEWS: readonly ["channel-writer", "channel-purger", "manager-caller", "session-caller", "transfer-writer"];
 /** The ONE central view policy table: which ledger capability each view's exchange requires (and
  *  the callout re-asserts, defense in depth). `admin` = operator authority (god-view read +
  *  destructive space writes); `deployer` is spawn-grade — deploying YOUR OWN team's manifest rides
  *  the same owner-domain model as own-agent stop/attach (the manager still enforces owner equality
  *  at launch, and the view's control grant is the PRIVILEGED tier, never the admin bypass). */
 export declare const VIEW_REQUIRED_SCOPE: Record<UserTokenView, "admin" | "spawn" | "supervise" | undefined>;
+/** The longest a bearer of `view` may live. A transfer-writer bearer is the user-mode form of the
+ *  one-shot `transfer-writer` credential, so it carries that profile's five minutes, and so does the
+ *  broker credential the callout binds to the bearer's expiry. */
+export declare function viewTtlCapSec(view: UserTokenView | undefined): number;
+/** The ONE object a `transfer-writer` bearer may upload (docs/design/resume-transfer.md section 6):
+ *  the manager instance whose transfer bucket holds it and the transcript's hex digest. */
+export interface UserTokenTransferWriter {
+    instanceId: string;
+    hex: string;
+}
 /** The ONE §13.6 session a `session-caller` bearer may open: the rail coordinates plus the grant
  *  expiry (unix seconds) the minted connection is bound to, exactly what the static arm mints. */
 export interface UserTokenSession {
@@ -58,6 +68,8 @@ export interface UserTokenActor {
     managerInstanceId?: string;
     /** The one session a session-caller bearer may open (#2312). */
     session?: UserTokenSession;
+    /** The one object a transfer-writer bearer may upload (#1499). */
+    transferWriter?: UserTokenTransferWriter;
 }
 /** A fully validated user token, reduced to what the callout needs. */
 export interface ValidatedUserToken {
@@ -85,6 +97,7 @@ export declare function assertCredentialIdClaim(v: unknown): asserts v is string
 /** Assert a `session` claim is the closed `{endpoint, sessionId, epoch, exp}` shape. Shared by the
  *  issuer (mint side) and the validator so the inverse holds. THROWS. */
 export declare function assertSessionClaim(v: unknown): asserts v is UserTokenSession;
+export declare function assertTransferWriterClaim(v: unknown): asserts v is UserTokenTransferWriter;
 export interface ValidateUserTokenOpts {
     /** The pinned verification key path: a `createRemoteJWKSet(new URL(<pinned origin>))` resolver
      *  or a local public key. The token itself NEVER influences where the key comes from. */

package/dist/token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAGvD;4EAC4E;AAC5E,eAAO,MAAM,cAAc,IAAI,CAAC;AAEhC;8CAC8C;AAC9C,eAAO,MAAM,iBAAiB,MAAM,CAAC;AAErC;;;;;;;+FAO+F;AAC/F,eAAO,MAAM,gBAAgB,qIAAsI,CAAC;AACpK,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D;;yFAEyF;AACzF,eAAO,MAAM,qBAAqB,mFAAuH,CAAC;AAE1J;;;;+FAI+F;AAC/F,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,aAAa,EAAE,OAAO,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,CAWlG,CAAC;AAEF;kGACkG;AAClG,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;iFAEiF;AACjF,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,mGAAmG;IACnG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;2EAEuE;IACvE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;kFAI8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4FAA4F;IAC5F,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,oEAAoE;IACpE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gEAAgE;IAChE,OAAO,CAAC,EAAE,gBAAgB,CAAC;CAC5B;AAED,uEAAuE;AACvE,MAAM,WAAW,kBAAkB;IACjC,4DAA4D;IAC5D,KAAK,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,iCAAiC;IACjC,GAAG,EAAE,cAAc,CAAC;IACpB;6FACyF;IACzF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uDAAuD;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ;iGAC6F;IAC7F,GAAG,EAAE,MAAM,CAAC;CACb;AAMD;;mGAEmG;AACnG,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,IAAI,MAAM,CAGvE;AAED;yEACyE;AACzE,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,IAAI,gBAAgB,CAQ5E;AAED,MAAM,WAAW,qBAAqB;IACpC;6FACyF;IACzF,GAAG,EAAE,eAAe,GAAG,SAAS,CAAC;IACjC,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,uFAAuF;IACvF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;mBAEmB;AACnB,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA4G/G"}
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAGvD;4EAC4E;AAC5E,eAAO,MAAM,cAAc,IAAI,CAAC;AAEhC;8CAC8C;AAC9C,eAAO,MAAM,iBAAiB,MAAM,CAAC;AAErC;;;;;;;+FAO+F;AAC/F,eAAO,MAAM,gBAAgB,wJAAyJ,CAAC;AACvL,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D;;yFAEyF;AACzF,eAAO,MAAM,qBAAqB,sGAA0I,CAAC;AAE7K;;;;+FAI+F;AAC/F,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,aAAa,EAAE,OAAO,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,CAclG,CAAC;AAEF;;kEAEkE;AAClE,wBAAgB,aAAa,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,GAAG,MAAM,CAErE;AAED;2FAC2F;AAC3F,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;CACb;AAED;kGACkG;AAClG,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;iFAEiF;AACjF,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,mGAAmG;IACnG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;2EAEuE;IACvE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;kFAI8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4FAA4F;IAC5F,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,oEAAoE;IACpE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gEAAgE;IAChE,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,kEAAkE;IAClE,cAAc,CAAC,EAAE,uBAAuB,CAAC;CAC1C;AAED,uEAAuE;AACvE,MAAM,WAAW,kBAAkB;IACjC,4DAA4D;IAC5D,KAAK,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,iCAAiC;IACjC,GAAG,EAAE,cAAc,CAAC;IACpB;6FACyF;IACzF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uDAAuD;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ;iGAC6F;IAC7F,GAAG,EAAE,MAAM,CAAC;CACb;AAMD;;mGAEmG;AACnG,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,IAAI,MAAM,CAGvE;AAED;yEACyE;AACzE,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,IAAI,gBAAgB,CAQ5E;AAED,wBAAgB,yBAAyB,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,IAAI,uBAAuB,CAO1F;AAED,MAAM,WAAW,qBAAqB;IACpC;6FACyF;IACzF,GAAG,EAAE,eAAe,GAAG,SAAS,CAAC;IACjC,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,uFAAuF;IACvF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;mBAEmB;AACnB,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA+G/G"}

package/dist/token.js

@@ -18,7 +18,7 @@
  *    token would quietly disable it).
  */
 import { decodeProtectedHeader, jwtVerify } from "jose";
-import { assertDerivedOwnerToken, assertLifecycleToken, assertValidOwnerToken } from "@cotal-ai/core";
+import { assertDerivedOwnerToken, assertLifecycleToken, assertValidOwnerToken, credentialLifetime } from "@cotal-ai/core";
 /** Current normative token-shape version. Bump only with a SPEC change; validators reject
  *  anything else (older = downgrade, newer = from-the-future misconfig). */
 export const USER_TOKEN_VER = 1;
@@ -33,11 +33,11 @@ export const MAX_TOKEN_TTL_SEC = 900;
  *  instead of `agent`. A closed enum on BOTH the mint and validate side — an unknown view fails
  *  closed, never falls back to a profile. Deliberately NOT a generic `view=<profile>` passthrough:
  *  most profiles are daemon/provisioning surfaces that must never become human-requestable. */
-export const USER_TOKEN_VIEWS = ["admin", "purger", "channel-purger", "channel-writer", "deployer", "manager-service", "manager-caller", "session-caller"];
+export const USER_TOKEN_VIEWS = ["admin", "purger", "channel-purger", "channel-writer", "deployer", "manager-service", "manager-caller", "session-caller", "transfer-writer"];
 /** Views the public exchange face will mint (still ledger-gated). Every other
  *  {@link USER_TOKEN_VIEWS} value stays loopback-only. An actor-secret exchange may request
  *  only manager-caller, which narrows its existing command authority to one instance. */
-export const PUBLIC_EXCHANGE_VIEWS = ["channel-writer", "channel-purger", "manager-caller", "session-caller"];
+export const PUBLIC_EXCHANGE_VIEWS = ["channel-writer", "channel-purger", "manager-caller", "session-caller", "transfer-writer"];
 /** The ONE central view policy table: which ledger capability each view's exchange requires (and
  *  the callout re-asserts, defense in depth). `admin` = operator authority (god-view read +
  *  destructive space writes); `deployer` is spawn-grade — deploying YOUR OWN team's manifest rides
@@ -54,7 +54,16 @@ export const VIEW_REQUIRED_SCOPE = {
     // #2312: no ledger scope. The grant itself is the authority: the auth plane verifies the redeemed
     // `session.<id>` row names THIS principal as holder, at the exchange and again at the callout mint.
     "session-caller": undefined,
+    // #1499: the bytes a carried resume uploads are announced by `transcript-receive`, a
+    // `manager.admin` row, so writing them needs the same scope.
+    "transfer-writer": "admin",
 };
+/** The longest a bearer of `view` may live. A transfer-writer bearer is the user-mode form of the
+ *  one-shot `transfer-writer` credential, so it carries that profile's five minutes, and so does the
+ *  broker credential the callout binds to the bearer's expiry. */
+export function viewTtlCapSec(view) {
+    return view === "transfer-writer" ? credentialLifetime("transfer-writer").defaultTtlSeconds : MAX_TOKEN_TTL_SEC;
+}
 /** A KV-safe key segment: the ledger's `cred.` key alphabet. Kept local to the validator (not
  *  imported from the credential ledger) so the trust boundary carries no KV dependency. */
 const CREDENTIAL_ID_SEGMENT = /^[A-Za-z0-9_-]+$/;
@@ -82,6 +91,19 @@ export function assertSessionClaim(v) {
         if (typeof o[k] !== "number" || !Number.isSafeInteger(o[k]) || o[k] < 0)
             throw new Error(`user token: act.session.${k} is not an unsigned integer`);
 }
+export function assertTransferWriterClaim(v) {
+    const o = v;
+    if (!o || typeof o !== "object" || Array.isArray(o))
+        throw new Error("user token: act.transferWriter must be an object");
+    for (const k of Object.keys(o))
+        if (!["instanceId", "hex"].includes(k))
+            throw new Error(`user token: act.transferWriter carries the unknown field "${k}"`);
+    if (typeof o.instanceId !== "string")
+        throw new Error("user token: act.transferWriter.instanceId must be a string token");
+    assertLifecycleToken(o.instanceId, "user token act.transferWriter.instanceId");
+    if (typeof o.hex !== "string" || !/^[0-9a-f]{64}$/.test(o.hex))
+        throw new Error("user token: act.transferWriter.hex is not a sha256 hex digest");
+}
 /** Validate a user bearer token. Returns the reduced, validated claims or THROWS — there is no
  *  partially-valid result and no fallback (a validation failure at the callout is a denied
  *  connection). */
@@ -113,7 +135,7 @@ export async function validateUserToken(token, opts) {
     // sails through exp/nbf checks, giving it an effective validity far beyond the cap and quietly
     // defeating the short-lived-token revocation lever. So: iat may not be in the future, and exp
     // may not sit further than the cap from now.
-    const maxTtl = opts.maxTtlSec ?? MAX_TOKEN_TTL_SEC;
+    const maxTtl = Math.min(opts.maxTtlSec ?? MAX_TOKEN_TTL_SEC, viewTtlCapSec(payload.act?.view));
     const tol = opts.clockToleranceSec ?? 5;
     const now = Math.floor(Date.now() / 1000);
     if (payload.iat > now + tol)
@@ -166,6 +188,10 @@ export async function validateUserToken(token, opts) {
             throw new Error('user token: act.session is valid only with view "session-caller"');
         assertSessionClaim(act.session);
     }
+    if ((act.view === "transfer-writer") !== (act.transferWriter !== undefined))
+        throw new Error('user token: view "transfer-writer" and act.transferWriter come together or not at all');
+    if (act.transferWriter !== undefined)
+        assertTransferWriterClaim(act.transferWriter);
     // Lifecycle claim (SPEC 13.1): grammar-asserted when present. Presence/absence POLICY lives at the
     // connect boundary (ledgerAuthorizeConnect requires it on EVERY bearer, views included) and the
     // mint boundary (the idp bridge and the agent exchange stamp it from the grant row); the validator
@@ -190,7 +216,7 @@ export async function validateUserToken(token, opts) {
         owner,
         space: opts.audience,
         scope,
-        act: { owner: act.owner, actor: act.actor, scope: act.scope, parent: act.parent, lifecycleUid: act.lifecycleUid, credentialId: act.credentialId, view: act.view, managerInstanceId: act.managerInstanceId, ...(act.session ? { session: act.session } : {}) },
+        act: { owner: act.owner, actor: act.actor, scope: act.scope, parent: act.parent, lifecycleUid: act.lifecycleUid, credentialId: act.credentialId, view: act.view, managerInstanceId: act.managerInstanceId, ...(act.session ? { session: act.session } : {}), ...(act.transferWriter ? { transferWriter: act.transferWriter } : {}) },
         credentialId: act.credentialId,
         ver: USER_TOKEN_VER,
         exp: payload.exp,

package/dist/token.js.map

@@ -1 +1 @@
-{"version":3,"file":"token.js","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAExD,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAEtG;4EAC4E;AAC5E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAEhC;8CAC8C;AAC9C,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAErC;;;;;;;+FAO+F;AAC/F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,UAAU,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,gBAAgB,CAAU,CAAC;AAGpK;;yFAEyF;AACzF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,CAA6C,CAAC;AAE1J;;;;+FAI+F;AAC/F,MAAM,CAAC,MAAM,mBAAmB,GAAuE;IACrG,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,OAAO;IACf,gBAAgB,EAAE,OAAO;IACzB,gBAAgB,EAAE,OAAO;IACzB,QAAQ,EAAE,OAAO;IACjB,iBAAiB,EAAE,WAAW;IAC9B,gBAAgB,EAAE,SAAS,EAAE,0EAA0E;IACvG,kGAAkG;IAClG,oGAAoG;IACpG,gBAAgB,EAAE,SAAS;CAC5B,CAAC;AA0DF;2FAC2F;AAC3F,MAAM,qBAAqB,GAAG,kBAAkB,CAAC;AAEjD;;mGAEmG;AACnG,MAAM,UAAU,uBAAuB,CAAC,CAAU;IAChD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxH,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,gDAAgD,CAAC,CAAC;AACvH,CAAC;AAED;yEACyE;AACzE,MAAM,UAAU,kBAAkB,CAAC,CAAU;IAC3C,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAClH,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,GAAG,CAAC,CAAC;IACxK,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC9J,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC9J,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAU;QACvC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAK,CAAC,CAAC,CAAC,CAAY,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,6BAA6B,CAAC,CAAC;AACpK,CAAC;AAgBD;;mBAEmB;AACnB,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAa,EAAE,IAA2B;IAChF,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;QAC9G,MAAM,IAAI,KAAK,CAAC,yGAAyG,CAAC,CAAC;IAC7H,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAEzG,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,GAAsB,EAAE;QACtE,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,cAAc,EAAE,IAAI,CAAC,iBAAiB,IAAI,CAAC;KAC5C,CAAC,CAAC;IAEH,8FAA8F;IAC9F,+FAA+F;IAC/F,2DAA2D;IAC3D,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC;QAChI,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IACrG,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IACjH,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACpF,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACpF,+FAA+F;IAC/F,2FAA2F;IAC3F,+FAA+F;IAC/F,8FAA8F;IAC9F,6CAA6C;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,IAAI,iBAAiB,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,IAAI,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,OAAO,CAAC,GAAG,GAAG,GAAG,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACjF,IAAI,OAAO,CAAC,GAAG,GAAG,GAAG,GAAG,MAAM,GAAG,GAAG;QAClC,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,8DAA8D,CAAC,CAAC;IAC5H,IAAI,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,GAAG,MAAM;QACpC,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,iBAAiB,MAAM,qDAAqD,CAAC,CAAC;IAEjJ,IAAI,OAAO,CAAC,GAAG,KAAK,cAAc;QAChC,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,cAAc,qDAAqD,CAAC,CAAC;IAEpI,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IACjI,MAAM,KAAK,GAAG,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEnD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAiC,CAAC;IACtD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACxH,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,4BAA4B,CAAC,CAAC;IACpI,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;IACrI,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QACzG,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,6FAA6F;QAC7F,yFAAyF;QACzF,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;YAChC,MAAM,IAAI,KAAK,CAAC,8FAA8F,CAAC,CAAC;QAClH,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,MAAM,iDAAiD,CAAC,CAAC;QAC1G,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,yBAAyB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,0BAA0B,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B,CAC9H,CAAC;IACJ,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACxC,IAAI,OAAO,GAAG,CAAC,iBAAiB,KAAK,QAAQ;YAC3C,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;QAC3F,oBAAoB,CAAC,GAAG,CAAC,iBAAiB,EAAE,kCAAkC,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS;QACtE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB;QACtE,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;QAC5D,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB;YAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACvH,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IACD,mGAAmG;IACnG,gGAAgG;IAChG,mGAAmG;IACnG,+FAA+F;IAC/F,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACnC,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ;YACtC,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACtF,oBAAoB,CAAC,GAAG,CAAC,YAAY,EAAE,6BAA6B,CAAC,CAAC;IACxE,CAAC;IACD,iGAAiG;IACjG,gGAAgG;IAChG,yFAAyF;IACzF,6FAA6F;IAC7F,0FAA0F;IAC1F,kFAAkF;IAClF,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS;QAAE,uBAAuB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAE9E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/D,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAE1E,OAAO;QACL,KAAK;QACL,KAAK,EAAE,IAAI,CAAC,QAAQ;QACpB,KAAK;QACL,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QAC7P,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,GAAG,EAAE,cAAc;QACnB,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAExD,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAE1H;4EAC4E;AAC5E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAEhC;8CAC8C;AAC9C,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAErC;;;;;;;+FAO+F;AAC/F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,UAAU,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,CAAU,CAAC;AAGvL;;yFAEyF;AACzF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,CAA6C,CAAC;AAE7K;;;;+FAI+F;AAC/F,MAAM,CAAC,MAAM,mBAAmB,GAAuE;IACrG,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,OAAO;IACf,gBAAgB,EAAE,OAAO;IACzB,gBAAgB,EAAE,OAAO;IACzB,QAAQ,EAAE,OAAO;IACjB,iBAAiB,EAAE,WAAW;IAC9B,gBAAgB,EAAE,SAAS,EAAE,0EAA0E;IACvG,kGAAkG;IAClG,oGAAoG;IACpG,gBAAgB,EAAE,SAAS;IAC3B,qFAAqF;IACrF,6DAA6D;IAC7D,iBAAiB,EAAE,OAAO;CAC3B,CAAC;AAEF;;kEAEkE;AAClE,MAAM,UAAU,aAAa,CAAC,IAA+B;IAC3D,OAAO,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC,iBAAkB,CAAC,CAAC,CAAC,iBAAiB,CAAC;AACnH,CAAC;AAmED;2FAC2F;AAC3F,MAAM,qBAAqB,GAAG,kBAAkB,CAAC;AAEjD;;mGAEmG;AACnG,MAAM,UAAU,uBAAuB,CAAC,CAAU;IAChD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxH,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,gDAAgD,CAAC,CAAC;AACvH,CAAC;AAED;yEACyE;AACzE,MAAM,UAAU,kBAAkB,CAAC,CAAU;IAC3C,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAClH,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,GAAG,CAAC,CAAC;IACxK,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC9J,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC9J,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAU;QACvC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAK,CAAC,CAAC,CAAC,CAAY,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,6BAA6B,CAAC,CAAC;AACpK,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,CAAU;IAClD,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACzH,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,GAAG,CAAC,CAAC;IAC3J,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IAC1H,oBAAoB,CAAC,CAAC,CAAC,UAAU,EAAE,0CAA0C,CAAC,CAAC;IAC/E,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;AACnJ,CAAC;AAgBD;;mBAEmB;AACnB,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAa,EAAE,IAA2B;IAChF,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;QAC9G,MAAM,IAAI,KAAK,CAAC,yGAAyG,CAAC,CAAC;IAC7H,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAEzG,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,GAAsB,EAAE;QACtE,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,cAAc,EAAE,IAAI,CAAC,iBAAiB,IAAI,CAAC;KAC5C,CAAC,CAAC;IAEH,8FAA8F;IAC9F,+FAA+F;IAC/F,2DAA2D;IAC3D,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC;QAChI,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IACrG,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IACjH,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACpF,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACpF,+FAA+F;IAC/F,2FAA2F;IAC3F,+FAA+F;IAC/F,8FAA8F;IAC9F,6CAA6C;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,iBAAiB,EAAE,aAAa,CAAE,OAAO,CAAC,GAAkC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC/H,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,IAAI,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,OAAO,CAAC,GAAG,GAAG,GAAG,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACjF,IAAI,OAAO,CAAC,GAAG,GAAG,GAAG,GAAG,MAAM,GAAG,GAAG;QAClC,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,8DAA8D,CAAC,CAAC;IAC5H,IAAI,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,GAAG,MAAM;QACpC,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,iBAAiB,MAAM,qDAAqD,CAAC,CAAC;IAEjJ,IAAI,OAAO,CAAC,GAAG,KAAK,cAAc;QAChC,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,cAAc,qDAAqD,CAAC,CAAC;IAEpI,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IACjI,MAAM,KAAK,GAAG,uBAAuB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEnD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAiC,CAAC;IACtD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACxH,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,4BAA4B,CAAC,CAAC;IACpI,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;IACrI,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QACzG,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,6FAA6F;QAC7F,yFAAyF;QACzF,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;YAChC,MAAM,IAAI,KAAK,CAAC,8FAA8F,CAAC,CAAC;QAClH,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,MAAM,iDAAiD,CAAC,CAAC;QAC1G,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,yBAAyB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,0BAA0B,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B,CAC9H,CAAC;IACJ,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACxC,IAAI,OAAO,GAAG,CAAC,iBAAiB,KAAK,QAAQ;YAC3C,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;QAC3F,oBAAoB,CAAC,GAAG,CAAC,iBAAiB,EAAE,kCAAkC,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS;QACtE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB;QACtE,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;QAC5D,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB;YAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACvH,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC,CAAC;IAC3G,IAAI,GAAG,CAAC,cAAc,KAAK,SAAS;QAAE,yBAAyB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACpF,mGAAmG;IACnG,gGAAgG;IAChG,mGAAmG;IACnG,+FAA+F;IAC/F,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACnC,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ;YACtC,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACtF,oBAAoB,CAAC,GAAG,CAAC,YAAY,EAAE,6BAA6B,CAAC,CAAC;IACxE,CAAC;IACD,iGAAiG;IACjG,gGAAgG;IAChG,yFAAyF;IACzF,6FAA6F;IAC7F,0FAA0F;IAC1F,kFAAkF;IAClF,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS;QAAE,uBAAuB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAE9E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/D,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAE1E,OAAO;QACL,KAAK;QACL,KAAK,EAAE,IAAI,CAAC,QAAQ;QACpB,KAAK;QACL,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QACpU,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,GAAG,EAAE,cAAc;QACnB,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cotal-ai/auth",
   "description": "Cotal per-user auth bridge: opaque owner-token derivation and strict user-token validation for the NATS auth-callout cutover (Plane 1 ↔ Plane 2).",
-  "version": "0.66.1",
+  "version": "0.67.0",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -18,8 +18,8 @@
     }
   },
   "dependencies": {
-    "@cotal-ai/core": "0.66.1",
-    "@cotal-ai/workspace": "0.66.1",
+    "@cotal-ai/core": "0.67.0",
+    "@cotal-ai/workspace": "0.67.0",
     "@nats-io/jwt": "0.0.10-5",
     "@nats-io/nkeys": "^2.0.3",
     "@nats-io/transport-node": "^3.4.0",