@cotal-ai/auth 0.68.0 → 0.70.0

package/dist/retained-manager-validation.js.map

@@ -1 +1 @@
-{"version":3,"file":"retained-manager-validation.js","sourceRoot":"","sources":["../src/retained-manager-validation.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,EACnB,4BAA4B,GAI7B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,EAAE,6BAA6B,EAA+B,MAAM,uBAAuB,CAAC;AAEnG;mFACmF;AACnF,MAAM,UAAU,qCAAqC,CACnD,MAA2B,EAC3B,KAAa,EACb,OAA4H,EAC5H,OAA+D;IAE/D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,CAAC,EAAE,CAAC;QACJ,IAAI,EAAE,8BAA8B;QACpC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,KAAK;QACL,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,YAAY,EAAE,OAAO,CAAC,mBAAmB;QACzC,MAAM,EAAE,mBAAmB,CAAC,OAAO,CAAC,UAAU,CAAC;QAC/C,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;QAClD,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC,CAAC;IACH,OAAO,UAAU,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,yCAAyC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAClI,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,6CAA6C,IAAI,EAAE,CAAC,CAAC;AAChG,CAAC;AAED;;kGAEkG;AAClG,MAAM,UAAU,yCAAyC,CAAC,GAAY,EAAE,OAAoC,EAAE;IAC5G,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,YAAY,CAAC,mBAAmB,CAAC,CAAC;IACrG,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC;QACtB,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,WAAW;QAC/E,mBAAmB,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,eAAe;KACzF,CAAC,CAAC;IACH,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,YAAY,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IAC/I,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,mCAAmC;QAC7D,YAAY,CAAC,gEAAgE,CAAC,CAAC;IACjF,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,WAAW,EAAE,mBAAmB,EAAE,YAAY,EAAE,eAAe,CAAU;QACjJ,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,YAAY,CAAC,sBAAsB,GAAG,EAAE,CAAC,CAAC;IACnG,IAAK,CAAC,CAAC,UAAqB,CAAC,MAAM,GAAG,IAAI,IAAK,CAAC,CAAC,aAAwB,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI;QAC1F,YAAY,CAAC,+CAA+C,CAAC,CAAC;IAChE,qBAAqB,CAAC,CAAC,CAAC,KAAe,CAAC,CAAC;IACzC,oBAAoB,CAAC,CAAC,CAAC,UAAoB,EAAE,wCAAwC,CAAC,CAAC;IACvF,oBAAoB,CAAC,CAAC,CAAC,mBAA6B,EAAE,0CAA0C,CAAC,CAAC;IAClG,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,SAAmB,CAAC;QAAE,YAAY,CAAC,uDAAuD,CAAC,CAAC;IACjI,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,iBAA2B,CAAC;QAAE,YAAY,CAAC,qCAAqC,CAAC,CAAC;IACtH,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,GAAG,CAAC;QAC7F,YAAY,CAAC,gDAAgD,CAAC,CAAC;IAEjE,MAAM,UAAU,GAAG,4BAA4B,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAE5E,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACxB,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC,MAAgB,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,0BAA0B;QAC/E,YAAY,CAAC,uDAAuD,CAAC,CAAC;IACxE,MAAM,CAAC,GAAG,MAAiC,CAAC;IAC5C,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ;QAClG,YAAY,CAAC,2DAA2D,CAAC,CAAC;IAC5E,MAAM,YAAY,GAAG;QACnB,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,KAAK,CAAC;QAC1H,KAAK,EAAE,qBAAqB,CAAC,CAAC,CAAC,KAAK,CAAC;QACrC,YAAY,EAAE,oBAAoB,CAAC,CAAC,CAAC,YAAY,EAAE,iDAAiD,CAAC;KACtG,CAAC;IAEF,OAAO;QACL,CAAC,EAAE,CAAC;QACJ,IAAI,EAAE,mCAAmC;QACzC,KAAK,EAAE,CAAC,CAAC,KAAe;QACxB,KAAK,EAAE,CAAC,CAAC,KAAe;QACxB,UAAU,EAAE,CAAC,CAAC,UAAoB;QAClC,mBAAmB,EAAE,CAAC,CAAC,mBAA6B;QACpD,SAAS,EAAE,CAAC,CAAC,SAAmB;QAChC,iBAAiB,EAAE,CAAC,CAAC,iBAA2B;QAChD,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,UAAU;QACV,MAAM,EAAE,YAAY;QACpB,UAAU,EAAE,CAAC,CAAC,UAAoB;QAClC,aAAa,EAAE,CAAC,CAAC,aAAuB;KACzC,CAAC;AACJ,CAAC;AASD,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,IAAgD;IAEhD,MAAM,CAAC,GAAG,yCAAyC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC,CAAC;IACjH,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK;QACxB,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,yDAAyD,CAAC,CAAC,KAAK,yBAAyB,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACxJ,6BAA6B,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,EAAE,wFAAwF,CAAC,CAAC;IAC5I,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK;QAC/B,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,6EAA6E,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACnK,MAAM,MAAM,GAAG,mBAAmB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACzD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM;QAChC,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,qFAAqF,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IACxJ,MAAM,cAAc,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;IACvD,IAAI,IAAI,CAAC,SAAS,KAAK,cAAc;QACnC,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,qDAAqD,IAAI,CAAC,SAAS,4CAA4C,cAAc,EAAE,CAAC,CAAC;IAClL,IAAI,IAAI,CAAC,YAAY,KAAK,CAAC,CAAC,UAAU;QACpC,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,iDAAiD,CAAC,CAAC,UAAU,yBAAyB,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;IACnJ,MAAM,aAAa,GAAG,qCAAqC,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IACnG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAChF,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,sFAAsF,CAAC,CAAC;IAEzI,OAAO,CAAC,CAAC;AACX,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,qCAAqC,CACnD,CAAuC,EACvC,KAAa,EACb,SAAiC;IAEjC,IAAI,SAAS,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,SAAS,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,SAAS,CAAC,YAAY,KAAK,CAAC,CAAC,MAAM,CAAC,YAAY;QAC9H,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,sFAAsF,CAAC,CAAC;IAChI,OAAO;QACL,CAAC,EAAE,CAAC;QACJ,IAAI,EAAE,mCAAmC;QACzC,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,KAAK;QACL,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;QAC1C,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,iBAAiB,EAAE,CAAC,CAAC,iBAAiB;QACtC,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,SAAS;KACV,CAAC;AACJ,CAAC"}
+{"version":3,"file":"retained-manager-validation.js","sourceRoot":"","sources":["../src/retained-manager-validation.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,EACnB,0BAA0B,GAI3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,EAAE,6BAA6B,EAA+B,MAAM,uBAAuB,CAAC;AAEnG;mFACmF;AACnF,MAAM,UAAU,qCAAqC,CACnD,MAA2B,EAC3B,KAAa,EACb,OAA4H,EAC5H,OAA+D;IAE/D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,CAAC,EAAE,CAAC;QACJ,IAAI,EAAE,8BAA8B;QACpC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,KAAK;QACL,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,YAAY,EAAE,OAAO,CAAC,mBAAmB;QACzC,MAAM,EAAE,mBAAmB,CAAC,OAAO,CAAC,UAAU,CAAC;QAC/C,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;QAClD,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC,CAAC;IACH,OAAO,UAAU,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,yCAAyC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAClI,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,6CAA6C,IAAI,EAAE,CAAC,CAAC;AAChG,CAAC;AAED;;kGAEkG;AAClG,MAAM,UAAU,yCAAyC,CAAC,GAAY,EAAE,OAAoC,EAAE;IAC5G,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,YAAY,CAAC,mBAAmB,CAAC,CAAC;IACrG,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC;QACtB,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,WAAW;QAC/E,mBAAmB,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,eAAe;KACzF,CAAC,CAAC;IACH,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,YAAY,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IAC/I,MAAM,QAAQ,GAAG,0BAA0B,CAAC,CAAC,EAAE,mCAAmC,EAAE,mCAAmC,CAAC,CAAC;IACzH,KAAK,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,eAAe,CAAU;QACxD,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,YAAY,CAAC,sBAAsB,GAAG,EAAE,CAAC,CAAC;IACnG,IAAK,CAAC,CAAC,UAAqB,CAAC,MAAM,GAAG,IAAI,IAAK,CAAC,CAAC,aAAwB,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI;QAC1F,YAAY,CAAC,+CAA+C,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,GAAG,CAAC;QAC7F,YAAY,CAAC,gDAAgD,CAAC,CAAC;IAEjE,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACxB,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC,MAAgB,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,0BAA0B;QAC/E,YAAY,CAAC,uDAAuD,CAAC,CAAC;IACxE,MAAM,CAAC,GAAG,MAAiC,CAAC;IAC5C,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ;QAClG,YAAY,CAAC,2DAA2D,CAAC,CAAC;IAC5E,MAAM,YAAY,GAAG;QACnB,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,KAAK,CAAC;QAC1H,KAAK,EAAE,qBAAqB,CAAC,CAAC,CAAC,KAAK,CAAC;QACrC,YAAY,EAAE,oBAAoB,CAAC,CAAC,CAAC,YAAY,EAAE,iDAAiD,CAAC;KACtG,CAAC;IAEF,OAAO;QACL,CAAC,EAAE,CAAC;QACJ,IAAI,EAAE,mCAAmC;QACzC,GAAG,QAAQ;QACX,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,MAAM,EAAE,YAAY;QACpB,UAAU,EAAE,CAAC,CAAC,UAAoB;QAClC,aAAa,EAAE,CAAC,CAAC,aAAuB;KACzC,CAAC;AACJ,CAAC;AASD,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,IAAgD;IAEhD,MAAM,CAAC,GAAG,yCAAyC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC,CAAC;IACjH,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK;QACxB,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,yDAAyD,CAAC,CAAC,KAAK,yBAAyB,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACxJ,6BAA6B,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,EAAE,wFAAwF,CAAC,CAAC;IAC5I,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK;QAC/B,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,6EAA6E,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACnK,MAAM,MAAM,GAAG,mBAAmB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACzD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM;QAChC,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,qFAAqF,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IACxJ,MAAM,cAAc,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;IACvD,IAAI,IAAI,CAAC,SAAS,KAAK,cAAc;QACnC,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,qDAAqD,IAAI,CAAC,SAAS,4CAA4C,cAAc,EAAE,CAAC,CAAC;IAClL,IAAI,IAAI,CAAC,YAAY,KAAK,CAAC,CAAC,UAAU;QACpC,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,iDAAiD,CAAC,CAAC,UAAU,yBAAyB,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;IACnJ,MAAM,aAAa,GAAG,qCAAqC,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IACnG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAChF,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,sFAAsF,CAAC,CAAC;IAEzI,OAAO,CAAC,CAAC;AACX,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,qCAAqC,CACnD,CAAuC,EACvC,KAAa,EACb,SAAiC;IAEjC,IAAI,SAAS,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,SAAS,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,SAAS,CAAC,YAAY,KAAK,CAAC,CAAC,MAAM,CAAC,YAAY;QAC9H,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,sFAAsF,CAAC,CAAC;IAChI,OAAO;QACL,CAAC,EAAE,CAAC;QACJ,IAAI,EAAE,mCAAmC;QACzC,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,KAAK;QACL,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;QAC1C,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,iBAAiB,EAAE,CAAC,CAAC,iBAAiB;QACtC,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,SAAS;KACV,CAAC;AACJ,CAAC"}

package/dist/serialized.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Run `fn` after every earlier call on `key` in `chains` has settled, whatever it settled to. Each
+ * critical section passes its own module-level map, so separate sections never wait on each other.
+ * The last call off a key's chain removes the key, so a map keyed per agent or per space holds only
+ * the keys with work still queued.
+ */
+export declare function serializedFor<T>(chains: Map<string, Promise<unknown>>, key: string, fn: () => Promise<T>): Promise<T>;
+//# sourceMappingURL=serialized.d.ts.map

package/dist/serialized.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serialized.d.ts","sourceRoot":"","sources":["../src/serialized.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAMrH"}

package/dist/serialized.js

@@ -0,0 +1,15 @@
+/**
+ * Run `fn` after every earlier call on `key` in `chains` has settled, whatever it settled to. Each
+ * critical section passes its own module-level map, so separate sections never wait on each other.
+ * The last call off a key's chain removes the key, so a map keyed per agent or per space holds only
+ * the keys with work still queued.
+ */
+export function serializedFor(chains, key, fn) {
+    const run = (chains.get(key) ?? Promise.resolve()).then(fn, fn);
+    const tail = run.then(() => undefined, () => undefined);
+    chains.set(key, tail);
+    void tail.then(() => { if (chains.get(key) === tail)
+        chains.delete(key); });
+    return run;
+}
+//# sourceMappingURL=serialized.js.map

package/dist/serialized.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serialized.js","sourceRoot":"","sources":["../src/serialized.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAI,MAAqC,EAAE,GAAW,EAAE,EAAoB;IACvG,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACxD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACtB,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI;QAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/service.d.ts

@@ -150,6 +150,8 @@ export interface AuthAuthorityPlane {
      *  kept minting would look healthy while a successor reclaims its scanners). Never resolves on a
      *  clean close. */
     fenced: Promise<string>;
+    /** Clean close (SPEC 13.13). Rejects when the plane did not release its claim; the barrier and
+     *  the remaining clients still close. */
     close(): Promise<void>;
 }
 type RemoteRetirementGate = Pick<EpGateState, "state" | "principal" | "processEpoch">;
@@ -180,6 +182,10 @@ export declare function openAuthAuthorityPlane(opts: {
     space: string;
     /** The provider state dir — the file-ledger connect arm reads it fresh per connect. */
     dir: string;
+    /** The root whose space segment keeps the plane's restart identity: a CLI composition's workspace
+     *  root, a hosted context's state dir. Never derived from `dir`, which for the CLI sits inside the
+     *  `.cotal/auth` an operator copies to another root. */
+    identityRoot: string;
     dataAccount: {
         pub: string;
         signingSeed: string;
@@ -301,7 +307,10 @@ export interface PlatformControlInput {
  *  installs no process signal handler, never exits the process, never selects a root from cwd,
  *  and has no local manager. It returns only after the authority plane, the callout subscription
  *  and the loopback listener are bound. A failed start releases what it acquired and throws. A
- *  mid-life fence or broker loss makes only this context `unavailable` and closes its resources. */
+ *  mid-life fence or broker loss makes only this context `unavailable` and closes its resources.
+ *  `close()` rejects when the context did not release its plane claim (SPEC 13.13): the row was
+ *  no longer its own, or the release write failed. The next start reclaims a row left held through
+ *  the liveness oracle. */
 export declare function startAuthService(inputs: HostedContextInputs & {
     port?: number;
     /** Absent: the handle has no `publicUrl` and nothing serves the discovery bundle. */
@@ -372,8 +381,9 @@ interface HandlerCtx {
     selectManagerInstance: AuthAuthorityPlane["selectManagerInstance"];
     verifySession: AuthAuthorityPlane["verifySession"];
 }
+type ManagerAuthorityDispatchCtx = Pick<HandlerCtx, "space" | "dir" | "secrets" | "managerServiceAuthority" | "maintainRemoteManager" | "validateRetainedAgent" | "enrollManagedAgent" | "prepareManagedAgentRetirement" | "scanManagerGoalIndex" | "authorizeManagerAdmin" | "admitManagerRun" | "issueManagerRunAttempt">;
 /** Dispatch one already-authenticated manager-authority body through the fixed host validator. */
-export declare function dispatchManagerAuthorityRequest(ctx: Pick<HandlerCtx, "space" | "dir" | "secrets" | "managerServiceAuthority" | "maintainRemoteManager" | "validateRetainedAgent" | "enrollManagedAgent" | "prepareManagedAgentRetirement" | "scanManagerGoalIndex" | "authorizeManagerAdmin" | "admitManagerRun" | "issueManagerRunAttempt">, owner: string, body: {
+export declare function dispatchManagerAuthorityRequest(ctx: ManagerAuthorityDispatchCtx, owner: string, body: {
     request: unknown;
 }): Promise<unknown>;
 /** Per-listener policy for `POST /exchange` — how a caller is proven, attributed, and throttled on
@@ -399,9 +409,12 @@ interface ExchangePolicy {
     /** Record a refused exchange against this face's budget (for `peer`). */
     recordFailure(ctx: HandlerCtx, peer: string): void;
 }
+/** What {@link handleManagerServiceAuthority} reads. Exported so a host that serves the route with a
+ *  context it builds itself is held by the compiler to every arm the dispatcher calls. */
+export type ManagerServiceAuthorityCtx = ManagerAuthorityDispatchCtx & Pick<HandlerCtx, "cap" | "bridgeIdp" | "ownerSecret">;
 /** Loopback/operator-only typed manager authority exchange. The public route table never includes
  * this path, and the loopback capability is checked here in addition to the route separation. */
-export declare function handleManagerServiceAuthority(req: IncomingMessage, res: ServerResponse, ctx: HandlerCtx, policy: ExchangePolicy): Promise<void>;
+export declare function handleManagerServiceAuthority(req: IncomingMessage, res: ServerResponse, ctx: ManagerServiceAuthorityCtx, policy: ExchangePolicy): Promise<void>;
 /** The advertised broker address the public bundle carries — the URL participants will dial, so
  *  the same scheme family `cotal meshes add` accepts. Exported for the producer/consumer contract
  *  smoke; returns the refusal sentence, or undefined when the address is usable. */

package/dist/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAwDA,OAAO,EAAgB,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAKpF,OAAO,EAAq+C,KAAK,iBAAiB,EAAiB,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,KAAK,yBAAyB,EAAE,KAAK,+BAA+B,EAAE,KAAK,8BAA8B,EAAE,KAAK,2BAA2B,EAAE,KAAK,mCAAmC,EAAE,KAAK,kCAAkC,EAAE,KAAK,0CAA0C,EAAE,KAAK,yCAAyC,EAAE,KAAK,sCAAsC,EAAE,KAAK,6BAA6B,EAAE,KAAK,+BAA+B,EAAE,KAAK,oCAAoC,EAAE,KAAK,WAAW,EAAgE,MAAM,gBAAgB,CAAC;AAChoE,OAAO,EAA4I,KAAK,mBAAmB,EAAyB,KAAK,mBAAmB,EAA2B,KAAK,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAIjT,OAAO,EAA6F,KAAK,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAE/J,OAAO,EAAmC,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAC3E,OAAO,EAAoD,KAAK,gBAAgB,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAElJ,OAAO,EAAE,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAsB,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAG7E,OAAO,EAA2K,KAAK,kBAAkB,EAAE,KAAK,iCAAiC,EAAE,MAAM,+BAA+B,CAAC;AAYzR,OAAO,EAA4H,KAAK,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACtL,OAAO,EAAkD,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAK7G,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,4BAA4B,CAAC;AA8BjF;uDACuD;AACvD,eAAO,MAAM,gBAAgB,MAAM,CAAC;AAEpC,4HAA4H;AAC5H,eAAO,MAAM,uBAAuB,kCAAkC,CAAC;AAEvE;gGACgG;AAChG,eAAO,MAAM,mBAAmB,8BAA8B,CAAC;AAE/D;;8FAE8F;AAC9F,eAAO,MAAM,sBAAsB,iDAAiD,CAAC;AAoCrF;;;+DAG+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,gBAAgB,EAAE,CAAC,CAAC,EAAE,kBAAkB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,qBAAqB,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACzG,qBAAqB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9E,sBAAsB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E;;sFAEkF;IAClF,eAAe,EAAE,gBAAgB,CAAC;IAClC;mGAC+F;IAC/F,aAAa,EAAE,CACb,SAAS,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,EAClE,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,KAC7E,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC/B,0BAA0B,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC;QACpG,OAAO,EAAE,OAAO,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,cAAc,CAAC,EAAE,OAAO,CAAC;KAC1B,CAAC,CAAC;IACH,sBAAsB,EAAE,kBAAkB,CAAC,4BAA4B,CAAC,CAAC;IACzE;oFACgF;IAChF,wBAAwB,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1G,4BAA4B,EAAE,CAAC,IAAI,EAAE,sBAAsB,GAAG;QAAE,OAAO,EAAE,6BAA6B,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;IAC9K,qBAAqB,EAAE,CAAC,IAAI,EAAE,sBAAsB,GAAG;QAAE,OAAO,EAAE,+BAA+B,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;IACzK,qBAAqB,EAAE,CAAC,IAAI,EAAE,sBAAsB,GAAG;QACrD,OAAO,EAAE,oCAAoC,CAAC;KAC/C,KAAK,OAAO,CAAC,oCAAoC,CAAC,CAAC;IACpD;;4FAEwF;IACxF,4BAA4B,EAAE,CAAC,IAAI,EAAE;QACnC,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,gBAAgB,EAAE,mCAAmC,CAAC;KACvE,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,mCAAmC,CAAC,CAAC;IAC5E,+FAA+F;IAC/F,mCAAmC,EAAE,CAAC,IAAI,EAAE;QAC1C,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,gBAAgB,EAAE,0CAA0C,CAAC;KAC9E,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,0CAA0C,CAAC,CAAC;IACnF;oGACgG;IAChG,kBAAkB,EAAE,CAAC,IAAI,EAAE;QACzB,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,mCAAmC,CAAC;QAC7C,aAAa,EAAE,MAAM,CAAC;QACtB,sBAAsB,EAAE,MAAM,CAAC;KAChC,KAAK,OAAO,CAAC,kCAAkC,CAAC,CAAC;IAClD;qGACiG;IACjG,6BAA6B,EAAE,CAAC,IAAI,EAAE;QACpC,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,0CAA0C,CAAC;KACrD,KAAK,OAAO,CAAC,yCAAyC,CAAC,CAAC;IACzD;0FACsF;IACtF,yBAAyB,EAAE,CAAC,IAAI,EAAE;QAChC,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,OAAO,gBAAgB,EAAE,gCAAgC,CAAC;KACpE,KAAK,OAAO,CAAC,iCAAiC,CAAC,CAAC;IACjD,oBAAoB,EAAE,CAAC,IAAI,EAAE,sBAAsB,GAAG;QACpD,OAAO,EAAE,OAAO,gBAAgB,EAAE,iCAAiC,CAAC;KACrE,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,gCAAgC,CAAC,CAAC;IACzE,qBAAqB,EAAE,CAAC,IAAI,EAAE,sBAAsB,GAAG;QACrD,OAAO,EAAE,sCAAsC,CAAC;KACjD,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,qCAAqC,CAAC,CAAC;IAC9E;;;2FAGuF;IACvF,eAAe,EAAE,CAAC,IAAI,EAAE,sBAAsB,GAAG;QAC/C,OAAO,EAAE,OAAO,CAAC;KAClB,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,wBAAwB,CAAC,CAAC;IACjE;;wFAEoF;IACpF,sBAAsB,EAAE,CAAC,IAAI,EAAE,sBAAsB,GAAG;QACtD,OAAO,EAAE,OAAO,CAAC;KAClB,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,sBAAsB,CAAC,CAAC;IAC/D;gGAC4F;IAC5F,sBAAsB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,UAAU,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAC3G;kGAC8F;IAC9F,oBAAoB,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/G,8FAA8F;IAC9F,mBAAmB,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC3F;;;;uBAImB;IACnB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACxB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,KAAK,oBAAoB,GAAG,IAAI,CAAC,WAAW,EAAE,OAAO,GAAG,WAAW,GAAG,cAAc,CAAC,CAAC;AAEtF;sGACsG;AACtG,wBAAgB,gCAAgC,CAAC,IAAI,EAAE;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,oBAAoB,GAAG,IAAI,CAAC;CACnC,GAAG,IAAI,CAUP;AAuDD;;;;;;;;;;;GAWG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,uFAAuF;IACvF,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B;;wEAEoE;IACpE,YAAY,CAAC,EAAE,cAAc,CAAC;IAC9B;;4EAEwE;IACxE,gBAAgB,CAAC,EAAE,mBAAmB,CAAC;IACvC;;iFAE6E;IAC7E,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;QAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,KAAK,IAAI,CAAC;IAChG;;kGAE8F;IAC9F,YAAY,CAAC,EAAE,MAAM,uBAAuB,GAAG,SAAS,CAAC;IACzD,sGAAsG;IACtG,2BAA2B,CAAC,EAAE,MAAM,CAAC;CACtC,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA6oC9B;AA+DD;;;;;;;;;;;sEAWsE;AACtE,wBAAsB,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAgGzF;AAED;yFACyF;AACzF,MAAM,WAAW,iBAAkB,SAAQ,mBAAmB;IAC5D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;0CAEsC;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;oCAEgC;IAChC,wBAAwB,CAAC,CAAC,CAAC,SAAS,2BAA2B,EAC7D,OAAO,EAAE,+BAA+B,CAAC,CAAC,CAAC,GAC1C,OAAO,CAAC,8BAA8B,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C;;;wEAGoE;IACpE,wBAAwB,CAAC,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC1E;;yEAEqE;IACrE,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC;;;;;;;sEAOkE;IAClE,wBAAwB,CAAC,EAAE,kBAAkB,CAAC,0BAA0B,CAAC,CAAC;IAC1E;;;;;;;;4BAQwB;IACxB,uBAAuB,CAAC,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAAC;IACtF;;iEAE6D;IAC7D,eAAe,CAAC,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAClE;;;;;iBAKa;IACb,cAAc,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACxF;AAED;0EAC0E;AAC1E,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,OAAO,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,sEAAsE;AACtE,MAAM,WAAW,oBAAoB;IACnC,2FAA2F;IAC3F,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAAC;IACtG;;;0DAGsD;IACtD,IAAI,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC;CAC1E;AAED;;;;;oGAKoG;AACpG,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,mBAAmB,GAAG;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qFAAqF;IACrF,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,+FAA+F;IAC/F,eAAe,CAAC,EAAE,oBAAoB,CAAC;IACvC;+FAC2F;IAC3F,2BAA2B,CAAC,EAAE,MAAM,CAAC;CACtC,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAkC7B;AA2UD,oFAAoF;AACpF,KAAK,WAAW,GAAG,OAAO,CAAC,sBAAsB,EAAE;IAAE,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC;AAExE,UAAU,UAAU;IAClB,MAAM,EAAE,eAAe,CAAC;IACxB,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAA;KAAE,CAAC;IAC5F,WAAW,EAAE,MAAM,GAAG,UAAU,CAAC;IACjC,uBAAuB,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG;QAAE,OAAO,EAAE,6BAA6B,CAAA;KAAE,KAAK,UAAU,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAC,CAAC;IAC5J,qBAAqB,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG;QAAE,OAAO,EAAE,+BAA+B,CAAA;KAAE,KAAK,UAAU,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC,CAAC;IACrJ,qBAAqB,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG;QAAE,OAAO,EAAE,oCAAoC,CAAA;KAAE,KAAK,UAAU,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAC1J,4BAA4B,EAAE,kBAAkB,CAAC,8BAA8B,CAAC,CAAC;IACjF,mCAAmC,EAAE,kBAAkB,CAAC,qCAAqC,CAAC,CAAC;IAC/F,yBAAyB,EAAE,kBAAkB,CAAC,2BAA2B,CAAC,CAAC;IAC3E,kBAAkB,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG;QAAE,OAAO,EAAE,mCAAmC,CAAA;KAAE,KAAK,OAAO,CAAC,kCAAkC,CAAC,CAAC;IAC1I,6BAA6B,EAAE,kBAAkB,CAAC,+BAA+B,CAAC,CAAC;IACnF,oBAAoB,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG;QAAE,OAAO,EAAE,OAAO,gBAAgB,EAAE,iCAAiC,CAAA;KAAE,KAAK,UAAU,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAC9K,qBAAqB,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG;QAAE,OAAO,EAAE,sCAAsC,CAAA;KAAE,KAAK,UAAU,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAC5J,eAAe,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,UAAU,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACjH,sBAAsB,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,UAAU,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAC,CAAC;IAC/H,OAAO,EAAE,WAAW,CAAC;IACrB,0BAA0B,EAAE,kBAAkB,CAAC,4BAA4B,CAAC,CAAC;IAC7E,sBAAsB,EAAE,kBAAkB,CAAC,wBAAwB,CAAC,CAAC;IACrE,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,GAAG,EAAE,MAAM,CAAC;IACZ;+CAC2C;IAC3C,qBAAqB,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACzG,qBAAqB,EAAE,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACnE,aAAa,EAAE,kBAAkB,CAAC,eAAe,CAAC,CAAC;CACpD;AAED,kGAAkG;AAClG,wBAAsB,+BAA+B,CACnD,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,GAAG,KAAK,GAAG,SAAS,GAAG,yBAAyB,GAAG,uBAAuB,GAAG,uBAAuB,GAAG,oBAAoB,GAAG,+BAA+B,GAAG,sBAAsB,GAAG,uBAAuB,GAAG,iBAAiB,GAAG,wBAAwB,CAAC,EAC7R,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GACzB,OAAO,CAAC,OAAO,CAAC,CA8ClB;AAED;;;;4FAI4F;AAC5F,UAAU,cAAc;IACtB,iGAAiG;IACjG,iBAAiB,EAAE,OAAO,CAAC;IAC3B;;uDAEmD;IACnD,WAAW,EAAE,OAAO,CAAC;IACrB;;gEAE4D;IAC5D,qBAAqB,EAAE,OAAO,CAAC;IAC/B,wDAAwD;IACxD,OAAO,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,CAAC;IACtC,kGAAkG;IAClG,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAClD,yEAAyE;IACzE,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACpD;AAwbD;iGACiG;AACjG,wBAAsB,6BAA6B,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBrJ;AAED;;oFAEoF;AACpF,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUrE;AAaD;;;;;;sBAMsB;AACtB,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,aAAa,EAAE,MAAM,CAAC;IACtB;;gGAE4F;IAC5F,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmB1B;AAED;;;mDAGmD;AACnD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAInG;AAED;;;cAGc;AACd,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUzE"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAwDA,OAAO,EAAgB,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAKpF,OAAO,EAAq+C,KAAK,iBAAiB,EAAiB,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,KAAK,yBAAyB,EAAE,KAAK,+BAA+B,EAAE,KAAK,8BAA8B,EAAE,KAAK,2BAA2B,EAAE,KAAK,mCAAmC,EAAE,KAAK,kCAAkC,EAAE,KAAK,0CAA0C,EAAE,KAAK,yCAAyC,EAAE,KAAK,sCAAsC,EAAE,KAAK,6BAA6B,EAAE,KAAK,+BAA+B,EAAE,KAAK,oCAAoC,EAAE,KAAK,WAAW,EAAgE,MAAM,gBAAgB,CAAC;AAChoE,OAAO,EAA4I,KAAK,mBAAmB,EAAyB,KAAK,mBAAmB,EAA2B,KAAK,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAIjT,OAAO,EAA6F,KAAK,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAE/J,OAAO,EAAmC,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAC3E,OAAO,EAAoD,KAAK,gBAAgB,EAAsB,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAElJ,OAAO,EAAE,kBAAkB,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EAAsB,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAG7E,OAAO,EAA2K,KAAK,kBAAkB,EAAE,KAAK,iCAAiC,EAAE,MAAM,+BAA+B,CAAC;AAYzR,OAAO,EAA4H,KAAK,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACtL,OAAO,EAAkD,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAM7G,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,4BAA4B,CAAC;AA8BjF;uDACuD;AACvD,eAAO,MAAM,gBAAgB,MAAM,CAAC;AAEpC,4HAA4H;AAC5H,eAAO,MAAM,uBAAuB,kCAAkC,CAAC;AAEvE;gGACgG;AAChG,eAAO,MAAM,mBAAmB,8BAA8B,CAAC;AAE/D;;8FAE8F;AAC9F,eAAO,MAAM,sBAAsB,iDAAiD,CAAC;AA8BrF;;;+DAG+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,gBAAgB,EAAE,CAAC,CAAC,EAAE,kBAAkB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,qBAAqB,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACzG,qBAAqB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9E,sBAAsB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E;;sFAEkF;IAClF,eAAe,EAAE,gBAAgB,CAAC;IAClC;mGAC+F;IAC/F,aAAa,EAAE,CACb,SAAS,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,EAClE,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,KAC7E,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC/B,0BAA0B,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC;QACpG,OAAO,EAAE,OAAO,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,cAAc,CAAC,EAAE,OAAO,CAAC;KAC1B,CAAC,CAAC;IACH,sBAAsB,EAAE,kBAAkB,CAAC,4BAA4B,CAAC,CAAC;IACzE;oFACgF;IAChF,wBAAwB,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1G,4BAA4B,EAAE,CAAC,IAAI,EAAE,sBAAsB,GAAG;QAAE,OAAO,EAAE,6BAA6B,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;IAC9K,qBAAqB,EAAE,CAAC,IAAI,EAAE,sBAAsB,GAAG;QAAE,OAAO,EAAE,+BAA+B,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,8BAA8B,CAAC,CAAC;IACzK,qBAAqB,EAAE,CAAC,IAAI,EAAE,sBAAsB,GAAG;QACrD,OAAO,EAAE,oCAAoC,CAAC;KAC/C,KAAK,OAAO,CAAC,oCAAoC,CAAC,CAAC;IACpD;;4FAEwF;IACxF,4BAA4B,EAAE,CAAC,IAAI,EAAE;QACnC,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,gBAAgB,EAAE,mCAAmC,CAAC;KACvE,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,mCAAmC,CAAC,CAAC;IAC5E,+FAA+F;IAC/F,mCAAmC,EAAE,CAAC,IAAI,EAAE;QAC1C,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,gBAAgB,EAAE,0CAA0C,CAAC;KAC9E,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,0CAA0C,CAAC,CAAC;IACnF;oGACgG;IAChG,kBAAkB,EAAE,CAAC,IAAI,EAAE;QACzB,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,mCAAmC,CAAC;QAC7C,aAAa,EAAE,MAAM,CAAC;QACtB,sBAAsB,EAAE,MAAM,CAAC;KAChC,KAAK,OAAO,CAAC,kCAAkC,CAAC,CAAC;IAClD;qGACiG;IACjG,6BAA6B,EAAE,CAAC,IAAI,EAAE;QACpC,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,0CAA0C,CAAC;KACrD,KAAK,OAAO,CAAC,yCAAyC,CAAC,CAAC;IACzD;0FACsF;IACtF,yBAAyB,EAAE,CAAC,IAAI,EAAE;QAChC,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,OAAO,gBAAgB,EAAE,gCAAgC,CAAC;KACpE,KAAK,OAAO,CAAC,iCAAiC,CAAC,CAAC;IACjD,oBAAoB,EAAE,CAAC,IAAI,EAAE,sBAAsB,GAAG;QACpD,OAAO,EAAE,OAAO,gBAAgB,EAAE,iCAAiC,CAAC;KACrE,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,gCAAgC,CAAC,CAAC;IACzE,qBAAqB,EAAE,CAAC,IAAI,EAAE,sBAAsB,GAAG;QACrD,OAAO,EAAE,sCAAsC,CAAC;KACjD,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,qCAAqC,CAAC,CAAC;IAC9E;;;2FAGuF;IACvF,eAAe,EAAE,CAAC,IAAI,EAAE,sBAAsB,GAAG;QAC/C,OAAO,EAAE,OAAO,CAAC;KAClB,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,wBAAwB,CAAC,CAAC;IACjE;;wFAEoF;IACpF,sBAAsB,EAAE,CAAC,IAAI,EAAE,sBAAsB,GAAG;QACtD,OAAO,EAAE,OAAO,CAAC;KAClB,KAAK,OAAO,CAAC,OAAO,gBAAgB,EAAE,sBAAsB,CAAC,CAAC;IAC/D;gGAC4F;IAC5F,sBAAsB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,UAAU,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAC3G;kGAC8F;IAC9F,oBAAoB,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/G,8FAA8F;IAC9F,mBAAmB,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC3F;;;;uBAImB;IACnB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACxB;6CACyC;IACzC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,KAAK,oBAAoB,GAAG,IAAI,CAAC,WAAW,EAAE,OAAO,GAAG,WAAW,GAAG,cAAc,CAAC,CAAC;AAEtF;sGACsG;AACtG,wBAAgB,gCAAgC,CAAC,IAAI,EAAE;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,oBAAoB,GAAG,IAAI,CAAC;CACnC,GAAG,IAAI,CAUP;AAuDD;;;;;;;;;;;GAWG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,uFAAuF;IACvF,GAAG,EAAE,MAAM,CAAC;IACZ;;4DAEwD;IACxD,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B;;wEAEoE;IACpE,YAAY,CAAC,EAAE,cAAc,CAAC;IAC9B;;4EAEwE;IACxE,gBAAgB,CAAC,EAAE,mBAAmB,CAAC;IACvC;;iFAE6E;IAC7E,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;QAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,KAAK,IAAI,CAAC;IAChG;;kGAE8F;IAC9F,YAAY,CAAC,EAAE,MAAM,uBAAuB,GAAG,SAAS,CAAC;IACzD,sGAAsG;IACtG,2BAA2B,CAAC,EAAE,MAAM,CAAC;CACtC,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAooC9B;AA+DD;;;;;;;;;;;sEAWsE;AACtE,wBAAsB,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAsGzF;AAED;yFACyF;AACzF,MAAM,WAAW,iBAAkB,SAAQ,mBAAmB;IAC5D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;0CAEsC;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;oCAEgC;IAChC,wBAAwB,CAAC,CAAC,CAAC,SAAS,2BAA2B,EAC7D,OAAO,EAAE,+BAA+B,CAAC,CAAC,CAAC,GAC1C,OAAO,CAAC,8BAA8B,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C;;;wEAGoE;IACpE,wBAAwB,CAAC,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC1E;;yEAEqE;IACrE,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC;;;;;;;sEAOkE;IAClE,wBAAwB,CAAC,EAAE,kBAAkB,CAAC,0BAA0B,CAAC,CAAC;IAC1E;;;;;;;;4BAQwB;IACxB,uBAAuB,CAAC,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAAC;IACtF;;iEAE6D;IAC7D,eAAe,CAAC,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAClE;;;;;iBAKa;IACb,cAAc,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACxF;AAED;0EAC0E;AAC1E,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,OAAO,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,sEAAsE;AACtE,MAAM,WAAW,oBAAoB;IACnC,2FAA2F;IAC3F,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAAC;IACtG;;;0DAGsD;IACtD,IAAI,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC;CAC1E;AAED;;;;;;;;2BAQ2B;AAC3B,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,mBAAmB,GAAG;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qFAAqF;IACrF,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,+FAA+F;IAC/F,eAAe,CAAC,EAAE,oBAAoB,CAAC;IACvC;+FAC2F;IAC3F,2BAA2B,CAAC,EAAE,MAAM,CAAC;CACtC,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAmC7B;AAkVD,oFAAoF;AACpF,KAAK,WAAW,GAAG,OAAO,CAAC,sBAAsB,EAAE;IAAE,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC;AAExE,UAAU,UAAU;IAClB,MAAM,EAAE,eAAe,CAAC;IACxB,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAA;KAAE,CAAC;IAC5F,WAAW,EAAE,MAAM,GAAG,UAAU,CAAC;IACjC,uBAAuB,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG;QAAE,OAAO,EAAE,6BAA6B,CAAA;KAAE,KAAK,UAAU,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAC,CAAC;IAC5J,qBAAqB,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG;QAAE,OAAO,EAAE,+BAA+B,CAAA;KAAE,KAAK,UAAU,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC,CAAC;IACrJ,qBAAqB,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG;QAAE,OAAO,EAAE,oCAAoC,CAAA;KAAE,KAAK,UAAU,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAC1J,4BAA4B,EAAE,kBAAkB,CAAC,8BAA8B,CAAC,CAAC;IACjF,mCAAmC,EAAE,kBAAkB,CAAC,qCAAqC,CAAC,CAAC;IAC/F,yBAAyB,EAAE,kBAAkB,CAAC,2BAA2B,CAAC,CAAC;IAC3E,kBAAkB,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG;QAAE,OAAO,EAAE,mCAAmC,CAAA;KAAE,KAAK,OAAO,CAAC,kCAAkC,CAAC,CAAC;IAC1I,6BAA6B,EAAE,kBAAkB,CAAC,+BAA+B,CAAC,CAAC;IACnF,oBAAoB,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG;QAAE,OAAO,EAAE,OAAO,gBAAgB,EAAE,iCAAiC,CAAA;KAAE,KAAK,UAAU,CAAC,kBAAkB,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAC9K,qBAAqB,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG;QAAE,OAAO,EAAE,sCAAsC,CAAA;KAAE,KAAK,UAAU,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAC5J,eAAe,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,UAAU,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACjH,sBAAsB,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,UAAU,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAC,CAAC;IAC/H,OAAO,EAAE,WAAW,CAAC;IACrB,0BAA0B,EAAE,kBAAkB,CAAC,4BAA4B,CAAC,CAAC;IAC7E,sBAAsB,EAAE,kBAAkB,CAAC,wBAAwB,CAAC,CAAC;IACrE,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,GAAG,EAAE,MAAM,CAAC;IACZ;+CAC2C;IAC3C,qBAAqB,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACzG,qBAAqB,EAAE,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACnE,aAAa,EAAE,kBAAkB,CAAC,eAAe,CAAC,CAAC;CACpD;AAED,KAAK,2BAA2B,GAAG,IAAI,CAAC,UAAU,EAAE,OAAO,GAAG,KAAK,GAAG,SAAS,GAAG,yBAAyB,GAAG,uBAAuB,GAAG,uBAAuB,GAAG,oBAAoB,GAAG,+BAA+B,GAAG,sBAAsB,GAAG,uBAAuB,GAAG,iBAAiB,GAAG,wBAAwB,CAAC,CAAC;AAE5T,kGAAkG;AAClG,wBAAsB,+BAA+B,CACnD,GAAG,EAAE,2BAA2B,EAChC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GACzB,OAAO,CAAC,OAAO,CAAC,CA8ClB;AAED;;;;4FAI4F;AAC5F,UAAU,cAAc;IACtB,iGAAiG;IACjG,iBAAiB,EAAE,OAAO,CAAC;IAC3B;;uDAEmD;IACnD,WAAW,EAAE,OAAO,CAAC;IACrB;;gEAE4D;IAC5D,qBAAqB,EAAE,OAAO,CAAC;IAC/B,wDAAwD;IACxD,OAAO,CAAC,GAAG,EAAE,eAAe,GAAG,MAAM,CAAC;IACtC,kGAAkG;IAClG,SAAS,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAClD,yEAAyE;IACzE,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACpD;AAwbD;0FAC0F;AAC1F,MAAM,MAAM,0BAA0B,GAAG,2BAA2B,GAAG,IAAI,CAAC,UAAU,EAAE,KAAK,GAAG,WAAW,GAAG,aAAa,CAAC,CAAC;AAE7H;iGACiG;AACjG,wBAAsB,6BAA6B,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,0BAA0B,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBrK;AAED;;oFAEoF;AACpF,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUrE;AAaD;;;;;;sBAMsB;AACtB,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,aAAa,EAAE,MAAM,CAAC;IACtB;;gGAE4F;IAC5F,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmB1B;AAED;;;mDAGmD;AACnD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAInG;AAED;;;cAGc;AACd,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUzE"}

package/dist/service.js

@@ -90,6 +90,7 @@ import { makeDeliveryAdminEvictor, makeDeliveryAdminHolderEvictor } from "./barr
 import { resumeAgentRetirement, runAgentRetirementBarrier } from "./retirement-barrier.js";
 import { makeRetirementCleaners } from "./retirement-cleaner.js";
 import { makeDrainRepairers } from "./drain-repair.js";
+import { serializedFor } from "./serialized.js";
 import { joinOrStartRetirement, openAuthAdminListener } from "./auth-admin.js";
 import { AUTH_SERVICE_ENDPOINT, authClusterArtifacts, authContractArtifactValues } from "./auth-service-contract.js";
 import { drainTargetForEndpoint, openAdmissionMediator } from "./admission-mediator.js";
@@ -122,20 +123,12 @@ const PUBLIC_PEER_BUCKETS_MAX = 1024; // bounded LRU of per-peer failure buckets
 const PUBLIC_MAX_IN_FLIGHT = 64; // global concurrent-admission cap on the public listener
 const PUBLIC_DEADLINE_MS = 10_000; // hard wall-clock deadline per public request
 const HOST_FENCE_POLL_MS = 1_000; // how often awaitHostFence re-reads the host gate
-const OBSERVED_RUN_REQUEST_WINDOW_MS = 5 * 60_000; // how long an observed served resume or answer can still be forwarded
+const OBSERVED_RUN_REQUEST_WINDOW_MS = 5 * 60_000; // how long an observed served run request can still be forwarded
 /** Enrollment and retirement preparation of one managed agent run one at a time, so neither acts on
  *  a grant the other is still writing or releasing. The chain lives at module level, keyed by the
  *  ledger directory, so two plane instances over one ledger share it. */
 const MANAGED_ALIAS_CHAINS = new Map();
-const serializedForAlias = (dir, owner, actor, fn) => {
-    const key = `${resolve(dir)}:${principalKey(owner, actor).key}`;
-    const run = (MANAGED_ALIAS_CHAINS.get(key) ?? Promise.resolve()).then(fn, fn);
-    const tail = run.then(() => undefined, () => undefined);
-    MANAGED_ALIAS_CHAINS.set(key, tail);
-    void tail.then(() => { if (MANAGED_ALIAS_CHAINS.get(key) === tail)
-        MANAGED_ALIAS_CHAINS.delete(key); });
-    return run;
-};
+const serializedForAlias = (dir, owner, actor, fn) => serializedFor(MANAGED_ALIAS_CHAINS, `${resolve(dir)}:${principalKey(owner, actor).key}`, fn);
 /** Package-internal policy step for the hosted retirement requester. The HTTP production door calls
  * this after deriving the owner and manager actors; broker-free smokes exercise the same decision. */
 export function authorizeRemoteManagerRetirement(args) {
@@ -223,15 +216,15 @@ export async function openAuthAuthorityPlane(opts) {
     }
     // #399 M2: register the auth plane itself as an ordinary `auth` service endpoint — the SAME
     // §13.7 registration ceremony the manager runs (`manager.ts:6562-6690`), before the listener
-    // below serves a single request. The persisted instance id + serve nkey (under the plane's
-    // `dir`, hardened the way the manager's own instance identity is) so a restart re-registers the
+    // below serves a single request. The persisted instance id + serve nkey (in `identityRoot`,
+    // hardened the way the manager's own instance identity is) so a restart re-registers the
     // SAME instance: `registerServiceInstance` advances the process epoch on a re-registration and
     // fences the predecessor; a first registration stays at epoch 0.
     let authServeInstanceId;
     let authServeGrant;
     try {
-        const persisted = loadAuthInstanceIdentity(opts.dir, space);
-        const authIdentity = persisted ?? createAuthInstanceIdentity(opts.dir, space, {
+        const persisted = loadAuthInstanceIdentity(opts.identityRoot, space);
+        const authIdentity = persisted ?? createAuthInstanceIdentity(opts.identityRoot, space, {
             instanceId: mintLifecycleUid(),
             serveIdentity: newIdentity(),
         });
@@ -310,6 +303,9 @@ export async function openAuthAuthorityPlane(opts) {
     let recordsScanner;
     let barrierReg;
     let closing = false;
+    // A failed open throws its own error, so a release failing on the way out is only logged: the
+    // row stays held and the next open reclaims it like a crash.
+    const releaseAfterFailedOpen = async () => hold?.release().catch((r) => log(r.message));
     // The plane-fatal channel (fact HIGH: a fenced plane must never keep serving): the mid-life
     // fence resolves it, every authority operation refuses from then on, and the composition root
     // downs the daemon. A clean close never resolves it.
@@ -349,7 +345,7 @@ export async function openAuthAuthorityPlane(opts) {
         closing = true;
         await recordsCand?.close();
         await ledgerCand?.close();
-        await hold?.release();
+        await releaseAfterFailedOpen();
         await barrier?.close();
         await remoteIssuer.close();
         await reader.close();
@@ -415,7 +411,7 @@ export async function openAuthAuthorityPlane(opts) {
         closing = true;
         await recordsScanner.close();
         await scanner.close();
-        await hold.release();
+        await releaseAfterFailedOpen();
         await barrier.close();
         await remoteIssuer.close();
         await reader.close();
@@ -438,7 +434,7 @@ export async function openAuthAuthorityPlane(opts) {
         closing = true;
         await recordsScanner.close();
         await scanner.close();
-        await hold.release();
+        await releaseAfterFailedOpen();
         await barrier.close();
         await remoteIssuer.close();
         await reader.close();
@@ -552,8 +548,8 @@ export async function openAuthAuthorityPlane(opts) {
         if (fatalReason !== undefined)
             throw new EpEnvelopeError("unavailable", `the auth service for space "${space}" is momentarily unavailable (it detected a fault and is restarting); retry shortly`);
     };
-    // The issuer window's signer: the data account's signing key, the same `hostAuth` shape the run
-    // admission builds.
+    // The plane holds only the data account's signing key. The operator and system halves stay blank
+    // because core's mint reads only the space, the account pub and the signing seed.
     const issuerAuth = () => ({
         space,
         operator: { seed: "", jwt: "" },
@@ -563,10 +559,11 @@ export async function openAuthAuthorityPlane(opts) {
     // The source check the issuing host resolves with: an actor-ledger row is attested here, from the
     // ledger this service owns; every other coordinate goes to core's check (SPEC 13.15).
     const composedSourceIsLive = (session) => (source) => parseActorLedgerSource(source) ? Promise.resolve(ledgerActorSourceIsLive(opts.dir)(source)) : session.sourceIsLive(source);
-    // A served resume or answer is issued only for a request this host saw its caller publish, only
-    // once, and only for what that request's envelope asked (SPEC 14.8): the forward's coordinates
-    // are the manager's word. The manager forwards from inside the handler serving the request, so an
-    // observation older than the window has no forward left to bind; the window also bounds the table.
+    // A served run-start is admitted, and a served resume or answer issued, only for a request this
+    // host saw its caller publish, and only once; a resume or answer only for what that request's
+    // envelope asked (SPEC 14.8): the forward's coordinates are the manager's word. The manager
+    // forwards from inside the handler serving the request, so an observation older than the window
+    // has no forward left to bind; the window also bounds the table.
     const observedRunRequests = new Map();
     for (const subject of servedRunRequestSubjects(space))
         remoteIssuer.nc.subscribe(subject, {
@@ -748,6 +745,7 @@ export async function openAuthAuthorityPlane(opts) {
                 }),
                 issue: async ({ actors, request: r }) => {
                     const signer = { space, account: dataAccount };
+                    const registration = { space: r.space, instanceId: r.instanceId, lifecycleUid: r.managerLifecycleUid, identities: r.identities };
                     const credential = async (key, profile, actor, opts) => mintPublicUserJwt(signer, r.identities[key].id, profile, { ...opts, principal: { owner, actor }, lifecycleUid: r.managerLifecycleUid });
                     const credentials = {};
                     const siblingOn = (gate, observed) => async (key, profile, actor) => {
@@ -795,7 +793,7 @@ export async function openAuthAuthorityPlane(opts) {
                         });
                     }
                     if (r.operation === "session") {
-                        const expectedProof = remoteManagerRegistrationProof(owner, r);
+                        const expectedProof = remoteManagerRegistrationProof(owner, registration);
                         if (r.registrationProof !== expectedProof)
                             throw new EpEnvelopeError("permission-denied", "manager-service session proof does not match this owner/lifecycle");
                         const session = r.session;
@@ -809,14 +807,14 @@ export async function openAuthAuthorityPlane(opts) {
                         return { credentials };
                     }
                     if (r.operation === "transferReader") {
-                        const expectedProof = remoteManagerRegistrationProof(owner, r);
+                        const expectedProof = remoteManagerRegistrationProof(owner, registration);
                         if (r.registrationProof !== expectedProof)
                             throw new EpEnvelopeError("permission-denied", "manager-service transfer reader proof does not match this owner/lifecycle");
                         credentials.transferReader = await mintPublicUserJwt(signer, r.transferReader.id, "transfer-reader", { principal: { owner, actor: actors.serve }, lifecycleUid: r.managerLifecycleUid, transferReader: { instanceId: r.instanceId } });
                         return { credentials };
                     }
                     if (r.operation === "retire") {
-                        const expectedProof = remoteManagerRegistrationProof(owner, r);
+                        const expectedProof = remoteManagerRegistrationProof(owner, registration);
                         if (r.registrationProof !== expectedProof)
                             throw new EpEnvelopeError("permission-denied", "manager-service retirement proof does not match this owner/lifecycle");
                         const retirement = r.retirement;
@@ -904,7 +902,7 @@ export async function openAuthAuthorityPlane(opts) {
                         return { credentials };
                     }
                     if (r.operation === "activate") {
-                        const expectedProof = remoteManagerRegistrationProof(owner, r);
+                        const expectedProof = remoteManagerRegistrationProof(owner, registration, r.contractArtifacts);
                         if (r.registrationProof !== expectedProof)
                             throw new EpEnvelopeError("permission-denied", "manager-service registration proof does not match this owner/lifecycle/artifact set");
                         // The serve JWT is issued from the registered-surface snapshot the participant
@@ -947,20 +945,14 @@ export async function openAuthAuthorityPlane(opts) {
                 scanner,
                 observeManagerGate,
             });
-            const evict = makeDeliveryAdminEvictor({ space, server, dataAccount, log });
+            const evictHolders = makeDeliveryAdminHolderEvictor({ space, server, dataAccount, log });
             if (authorized.operation === "evict-family-principal") {
-                const eviction = await evict(authorized.principal);
-                return completeRemoteManagerMaintenance(authorized, owner, { eviction });
+                const evictions = await evictHolders(authorized.principals);
+                return completeRemoteManagerMaintenance(authorized, owner, { evictions });
             }
             const principalOracle = makeDeliveryAdminPrincipalOracle({ space, server, dataAccount, log });
             const executorIdentity = newIdentity();
-            const hostAuth = {
-                space,
-                operator: { seed: "", jwt: "" },
-                account: { pub: dataAccount.pub, seed: "", jwt: "", signingSeed: dataAccount.signingSeed, signingPub: "" },
-                sys: { pub: "", jwt: "" },
-            };
-            const executorCreds = await mintCreds(hostAuth, executorIdentity, "endpoint-serve-executor", {
+            const executorCreds = await mintCreds(issuerAuth(), executorIdentity, "endpoint-serve-executor", {
                 endpointServeExecutor: { endpoint: "manager", instanceId: authorized.targetInstanceId },
                 expiresInSeconds: 60,
             });
@@ -982,7 +974,7 @@ export async function openAuthAuthorityPlane(opts) {
                         const result = await principalOracle(principal);
                         return { state: result.state, detail: result.note ?? `delivery-daemon principal sweep, sweepComplete=${String(result.sweepComplete)}` };
                     },
-                    evictHolders: makeDeliveryAdminHolderEvictor({ space, server, dataAccount, log }),
+                    evictHolders: async (holders) => (await evictHolders(holders)).map((e) => e.verifiedGone),
                     log,
                 });
             }
@@ -1176,17 +1168,11 @@ export async function openAuthAuthorityPlane(opts) {
             const { owner } = holder;
             requireManagerAuthorityHolder(holder, String(request?.instanceId), 'manager run admission needs scope "supervise"; spawn/admin do not imply it');
             const runId = parseRemoteRunAdmissionRequest(request).run.runId;
-            const hostAuth = {
-                space,
-                operator: { seed: "", jwt: "" },
-                account: { pub: dataAccount.pub, seed: "", jwt: "", signingSeed: dataAccount.signingSeed, signingPub: "" },
-                sys: { pub: "", jwt: "" },
-            };
-            return withIssuerSession({ servers: server, space, auth: hostAuth, tls: false }, async (session) => {
+            return withIssuerSession({ servers: server, space, auth: issuerAuth(), tls: false }, async (session) => {
                 const admitterNc = await connect({
                     servers: server,
                     ...standaloneConnectOpts({
-                        creds: await mintCreds(hostAuth, newIdentity(), "run-admitter", { runAdmitter: { endpoint: "manager", runId }, expiresInSeconds: 60 }),
+                        creds: await mintCreds(issuerAuth(), newIdentity(), "run-admitter", { runAdmitter: { endpoint: "manager", runId }, expiresInSeconds: 60 }),
                         tls: false,
                     }),
                     maxReconnectAttempts: 0,
@@ -1197,6 +1183,7 @@ export async function openAuthAuthorityPlane(opts) {
                         observeManagerGate,
                         issued: session.store,
                         sourceIsLive: composedSourceIsLive(session),
+                        takeObserved: takeObservedRunRequest,
                         admissions: await new Kvm(admitterNc).open(admissionBucket(space)),
                     });
                 }
@@ -1262,21 +1249,15 @@ export async function openAuthAuthorityPlane(opts) {
             const grant = req.attempt?.served !== undefined || req.operator?.served !== undefined
                 ? await withIssuerSession({ servers: server, space, auth: issuerAuth(), tls: false }, (session) => authorize(session))
                 : await authorize();
-            const hostAuth = {
-                space,
-                operator: { seed: "", jwt: "" },
-                account: { pub: dataAccount.pub, seed: "", jwt: "", signingSeed: dataAccount.signingSeed, signingPub: "" },
-                sys: { pub: "", jwt: "" },
-            };
             if (grant.kind === "attempt") {
                 const caller = runDriverCaller(grant.driver.runDriver.runId, owner);
-                const driver = await mintPublicUserJwt(hostAuth, grant.driver.id, "run-driver", {
+                const driver = await mintPublicUserJwt(issuerAuth(), grant.driver.id, "run-driver", {
                     principal: { owner, actor: caller.actor },
                     lifecycleUid: req.managerLifecycleUid,
                     runDriver: grant.driver.runDriver,
                     expiresInSeconds: standingTtl,
                 });
-                const mediator = await mintPublicUserJwt(hostAuth, grant.mediator.id, "run-mediator", {
+                const mediator = await mintPublicUserJwt(issuerAuth(), grant.mediator.id, "run-mediator", {
                     principal: { owner, actor: caller.actor },
                     lifecycleUid: req.managerLifecycleUid,
                     runMediator: grant.mediator.runMediator,
@@ -1299,7 +1280,7 @@ export async function openAuthAuthorityPlane(opts) {
                     credentials: { driver, mediator },
                 };
             }
-            const operator = await mintPublicUserJwt(hostAuth, grant.operator.id, "run-operator", {
+            const operator = await mintPublicUserJwt(issuerAuth(), grant.operator.id, "run-operator", {
                 principal: { owner, actor: req.actor },
                 lifecycleUid: req.managerLifecycleUid,
                 runOperator: grant.operator.runOperator,
@@ -1361,10 +1342,14 @@ export async function openAuthAuthorityPlane(opts) {
             await reader.close();
             await recordsScanner.close();
             await scanner.close();
-            await hold.release();
-            await barrier.close();
-            await remoteIssuer.close();
-            await writer.close();
+            try {
+                await hold.release();
+            }
+            finally {
+                await barrier.close();
+                await remoteIssuer.close();
+                await writer.close();
+            }
         },
     };
 }
@@ -1501,6 +1486,7 @@ export async function runAuthService(args, store) {
         server,
         port,
         dir,
+        identityRoot: root,
         secrets,
         hostedStore: store !== undefined,
         ...(publicFace !== undefined ? { publicFace } : {}),
@@ -1515,7 +1501,13 @@ export async function runAuthService(args, store) {
     // The CLI wrapper, not the context, owns process signals and exit codes.
     const stop = async () => {
         clearAuthServiceInfo(dir); // a dead service must not satisfy the next start's readiness poll
-        await started.handle.close();
+        try {
+            await started.handle.close();
+        }
+        catch (e) {
+            console.error(`✗ auth-service: ${e.message} - exiting`);
+            process.exit(1);
+        }
         process.exit(0);
     };
     process.on("SIGINT", () => void stop());
@@ -1542,7 +1534,10 @@ export async function runAuthService(args, store) {
  *  installs no process signal handler, never exits the process, never selects a root from cwd,
  *  and has no local manager. It returns only after the authority plane, the callout subscription
  *  and the loopback listener are bound. A failed start releases what it acquired and throws. A
- *  mid-life fence or broker loss makes only this context `unavailable` and closes its resources. */
+ *  mid-life fence or broker loss makes only this context `unavailable` and closes its resources.
+ *  `close()` rejects when the context did not release its plane claim (SPEC 13.13): the row was
+ *  no longer its own, or the release write failed. The next start reclaims a row left held through
+ *  the liveness oracle. */
 export async function startAuthService(inputs) {
     if (!inputs.context?.accountPublicKey || !inputs.context.lifecycleUid || !inputs.space || !inputs.servers || !inputs.stateDir)
         throw new Error("auth-service: hosted context needs an account, lifecycle, space, server and stateDir");
@@ -1570,6 +1565,7 @@ export async function startAuthService(inputs) {
         server: inputs.servers,
         port,
         dir: resolve(inputs.stateDir),
+        identityRoot: resolve(inputs.stateDir),
         secrets: inputs.store,
         hostedStore: true,
         localManager: () => undefined,
@@ -1578,7 +1574,7 @@ export async function startAuthService(inputs) {
         ...(inputs.platformControl !== undefined ? { platformControl: inputs.platformControl } : {}),
         ...(inputs.standingRenewableTtlSeconds !== undefined ? { standingRenewableTtlSeconds: inputs.standingRenewableTtlSeconds } : {}),
     });
-    return started.handle;
+    return { ...started.handle, readiness: () => ({ ...started.status(), context: inputs.context }) };
 }
 async function startAuthContext(o) {
     const { space, server, dir, secrets, port } = o;
@@ -1609,6 +1605,7 @@ async function startAuthContext(o) {
         server,
         space,
         dir,
+        identityRoot: o.identityRoot,
         dataAccount: { pub: keys.dataAccount.pub, signingSeed: keys.dataAccount.signingSeed },
         log: (l) => console.error(l),
         localManager: o.localManager,
@@ -1751,8 +1748,12 @@ async function startAuthContext(o) {
             closePromise = (async () => {
                 await Promise.all([closeServer(http), closeServer(publicHttp)]);
                 await reader?.client.then((c) => c.close(), () => { });
-                await plane.close().catch(() => { });
-                await callNc.close().catch(() => { });
+                try {
+                    await plane.close();
+                }
+                finally {
+                    await callNc.close();
+                }
             })();
             return closePromise;
         };
@@ -1764,11 +1765,11 @@ async function startAuthContext(o) {
             if (end.kind === "fenced" || end.cause !== undefined || closePromise === undefined) {
                 state = "unavailable";
                 cause = end.kind === "fenced" ? end.cause : `broker connection closed${end.cause !== undefined ? ` (${end.cause})` : ""}`;
-                void close();
+                // A later close() returns this same promise, so its failure still reaches the host.
+                close().catch(() => { });
             }
             return end;
         });
-        const context = o.context ?? { accountPublicKey: keys.dataAccount.pub, lifecycleUid: "" };
         const platformControl = o.platformControl;
         const host = platformControl?.host;
         // The human route's retained-validation composition, for the platform holder.
@@ -1871,15 +1872,11 @@ async function startAuthContext(o) {
                     }
                 },
             } : {}),
-            readiness() {
-                if (state === "unavailable")
-                    return { state, context, cause: cause ?? "auth-service context is unavailable" };
-                return { state: closePromise === undefined ? "ready" : "draining", context };
-            },
             drain: close,
             close,
         };
-        return { handle: service, ended };
+        const status = () => state === "unavailable" ? { state, cause: cause ?? "auth-service context is unavailable" } : { state: closePromise === undefined ? "ready" : "draining" };
+        return { handle: service, status, ended };
     }
     catch (e) {
         // A failed start releases only what THIS context acquired, in reverse order.