@cotal-ai/auth 0.90.0 → 0.91.0

package/dist/handle-verification.js

@@ -0,0 +1,135 @@
+import { jetstreamManager } from "@nats-io/jetstream";
+import { EpEnvelopeError, RECORD_KINDS, assertHandleContainedIn, assertIssuerScopeCoversHandle, canonicalJson, contractDigest, dialerFor, mintCreds, newIdentity, observeBrokerConnectionIdentity, readRecordLeader, recordSpecKey, recordStatusKey, requireBrokerFloor, resolveAnchorForUse, standaloneConnectOpts, validateSpaceAuth, verifyArtifactSignature, } from "@cotal-ai/core";
+import { CommandFailure, getSpaceAuth, hasUserAuthState, isCommandFailure, isWorkspaceTargetError, resolveMeshTarget, resolveNativeServiceTarget, targetErrorCode, workspaceSecretStore, } from "@cotal-ai/workspace";
+import { handleFileMetadata, readHandleFile } from "./handle-inspect.js";
+const object = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+/** Inspect signatures, issuer scope and registry revocation, never present or redeem a handle.
+ * Holder/process currency and equivalent-mint use authorization are deliberately not asserted. */
+export async function inspectHandleFileOnline(file, space) {
+    const captured = readHandleFile(file), target = { space, path: captured.path };
+    if (captured.handles.some((handle) => handle.space !== space))
+        throw new CommandFailure("refused", "CONFLICT", "every presented handle must name the explicitly selected verification space; no cross-space anchor was read", { target });
+    let selected, native;
+    try {
+        selected = resolveMeshTarget(process.cwd(), { space, readOnly: true });
+        native = resolveNativeServiceTarget(selected.root, space);
+    }
+    catch (error) {
+        throw new CommandFailure("refused", isWorkspaceTargetError(error) ? targetErrorCode(error.code) : "TARGET_UNAVAILABLE", "online verification needs one existing registered target; no different root or broker was substituted", { target });
+    }
+    if (native.mode !== "auth" || hasUserAuthState(native.root, space, { readOnly: true }))
+        throw new CommandFailure("refused", "UNSUPPORTED", "this online inspector requires the selected static space's native operator reader; open registries and user-auth roots need their own trusted read path, not a substituted signer", { target });
+    let auth;
+    try {
+        auth = validateSpaceAuth(await getSpaceAuth(workspaceSecretStore(native.root), space), space);
+        if (!selected.auth || selected.auth.account.pub !== auth.account.pub)
+            throw new Error();
+    }
+    catch {
+        throw new CommandFailure("refused", "AUTH_REQUIRED", "the selected root did not supply matching validated static reader authority; no other signer or caller was substituted", { target });
+    }
+    const identity = newIdentity();
+    let creds;
+    try {
+        creds = await mintCreds(auth, identity, "provisioner");
+    }
+    catch {
+        throw new CommandFailure("refused", "AUTH_REQUIRED", "the selected native static reader could not be minted; no handle was redeemed or caller substituted", { target });
+    }
+    let nc;
+    try {
+        nc = await dialerFor(native.server)({ servers: native.server, ...standaloneConnectOpts({ creds, tls: native.tlsRequired }), inboxPrefix: `_INBOX_${identity.id}`, reconnect: false, maxReconnectAttempts: 0 });
+    }
+    catch {
+        throw new CommandFailure("refused", "TARGET_UNAVAILABLE", "the registered verification connection did not establish; no credential, server or transport fallback was attempted", { target });
+    }
+    let failure, readerClosed = false;
+    const observations = [];
+    const startedAt = new Date().toISOString();
+    try {
+        try {
+            requireBrokerFloor(nc);
+        }
+        catch {
+            throw new CommandFailure("refused", "UNSUPPORTED", "the verification broker did not meet the native version floor; no signer or revocation record was read", { target });
+        }
+        const broker = await observeBrokerConnectionIdentity(nc, { user: identity.id, account: auth.account.pub });
+        if (broker.state !== "matched")
+            throw new EpEnvelopeError("permission-denied", "the native current-connection account and reader identity did not match");
+        const manager = await jetstreamManager(nc), deadline = performance.now() + 5_000;
+        const read = async (key) => {
+            const remaining = deadline - performance.now();
+            if (remaining <= 0)
+                throw new EpEnvelopeError("unavailable", "the whole-chain registry inspection budget expired");
+            let timer;
+            try {
+                return await Promise.race([
+                    readRecordLeader(manager, space, key),
+                    new Promise((_, reject) => { timer = setTimeout(() => reject(new EpEnvelopeError("unavailable", "a native registry read exceeded the remaining whole-chain budget")), remaining); }),
+                ]);
+            }
+            finally {
+                clearTimeout(timer);
+            }
+        };
+        const pair = async (kind, qualifiers) => {
+            const definition = RECORD_KINDS[kind];
+            if (!definition || definition.kind !== kind)
+                throw new EpEnvelopeError("failed-precondition", "the native record family is unavailable");
+            const spec = await read(recordSpecKey(definition, qualifiers)), status = await read(recordStatusKey(definition, qualifiers));
+            if (spec && Buffer.byteLength(canonicalJson(spec.value), "utf8") > 256 * 1024 || status && Buffer.byteLength(canonicalJson(status.value), "utf8") > 256 * 1024)
+                throw new EpEnvelopeError("resource-exhausted", "a native registry record exceeds this inspector's 256 KiB bound");
+            if (!spec || !status || !object(spec.value) || !object(status.value) || !Number.isSafeInteger(status.value.observedSpecRevision) || status.value.observedSpecRevision !== spec.revision || typeof status.value.revoked !== "boolean")
+                throw new EpEnvelopeError("failed-precondition", "the native signer/revocation pair is missing, malformed or not observed at its current spec revision");
+            return { spec: spec.value, status: status.value, specRevision: spec.revision, statusRevision: status.revision };
+        };
+        const now = Date.now();
+        for (const [index, handle] of captured.handles.entries()) {
+            const parent = captured.handles[index + 1], rawParent = captured.artifacts[index + 1];
+            if (handle.parentDigest === undefined ? parent !== undefined : parent === undefined || contractDigest(rawParent) !== handle.parentDigest)
+                throw new EpEnvelopeError("permission-denied", "the presented signature chain does not terminate at its declared root");
+            if (parent)
+                assertHandleContainedIn(handle, parent);
+            const signer = await pair("signer", [handle.issuer.keyId]);
+            if (signer.spec.keyId !== undefined && signer.spec.keyId !== handle.issuer.keyId)
+                throw new EpEnvelopeError("permission-denied", "the signer record names another key");
+            const anchor = await resolveAnchorForUse(() => ({ ...signer.spec, keyId: handle.issuer.keyId, revoked: signer.status.revoked }), { keyId: handle.issuer.keyId, role: "handles", at: now });
+            if (parent && (anchor.owner !== parent.holder.id || anchor.ownerLifecycleUid !== parent.holder.lifecycleUid))
+                throw new EpEnvelopeError("permission-denied", "the child issuer is not bound to its parent's holder lifecycle");
+            assertIssuerScopeCoversHandle(anchor, handle);
+            verifyArtifactSignature(captured.artifacts[index], anchor);
+            let revocation;
+            if (handle.sturdy) {
+                revocation = await pair("handle", [handle.issuer.keyId, handle.id]);
+                if (revocation.status.revoked !== false)
+                    throw new EpEnvelopeError("permission-denied", "a presented sturdy handle is revoked");
+            }
+            observations.push({ handleId: handle.id, issuerKeyId: handle.issuer.keyId, signerSpecRevision: signer.specRevision, signerStatusRevision: signer.statusRevision, handleSpecRevision: revocation?.specRevision ?? null, handleStatusRevision: revocation?.statusRevision ?? null });
+        }
+    }
+    catch (error) {
+        const code = error instanceof EpEnvelopeError ? error.code : undefined;
+        failure = isCommandFailure(error) ? error : new CommandFailure("refused", code === "permission-denied" ? "PERMISSION_DENIED" : code === "contract-invalid" ? "SCHEMA_INVALID" : "DEPENDENCY_UNAVAILABLE", "online inspection did not verify every presented signature, issuer scope and required revocation record; no claim was promoted to authority", { target, ...(code ? { native: { code } } : {}), remedy: "inspect this space's native signer and issuer-namespaced revocation records; no offline success, alternate key or credential fallback was used" });
+    }
+    finally {
+        try {
+            await nc.close();
+            readerClosed = nc.isClosed();
+        }
+        catch {
+            readerClosed = false;
+        }
+    }
+    if (failure)
+        throw failure;
+    const metadata = handleFileMetadata(captured);
+    return {
+        ...metadata, kind: "online-handle-signature-inspection", space,
+        items: metadata.items.map((item) => ({ ...item, signature: "verified", issuerAuthority: "verified", revocation: item.sturdy ? "checked-not-revoked" : "anchor-checked-live-epoch-unchecked" })),
+        chainVerification: "signature-links-and-containment-only", brokerContacted: true,
+        credentialIssued: true, credentialKind: "ephemeral-provisioner-reader", credentialPersisted: false,
+        holderCredentialIssued: false, redeemed: false,
+        verification: { startedAt, endedAt: new Date().toISOString(), atomicSnapshot: false, account: auth.account.pub, signature: "verified", issuerScope: "verified", anchorRevocation: "checked-not-revoked", sturdyHandleRevocation: captured.handles.some((handle) => handle.sturdy) ? "checked-not-revoked" : "not-applicable", holderCurrency: "not-checked", presenterBinding: "not-checked", useAuthorization: "not-established", readerClosed, observations },
+    };
+}
+//# sourceMappingURL=handle-verification.js.map

package/dist/handle-verification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handle-verification.js","sourceRoot":"","sources":["../src/handle-verification.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,EACL,eAAe,EAAE,YAAY,EAAE,uBAAuB,EAAE,6BAA6B,EACrF,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,+BAA+B,EACjG,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,kBAAkB,EAAE,mBAAmB,EACzF,qBAAqB,EAAE,iBAAiB,EAAE,uBAAuB,GAClE,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,cAAc,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,iBAAiB,EAC3G,0BAA0B,EAAE,eAAe,EAAE,oBAAoB,GAClE,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAEzE,MAAM,MAAM,GAAG,CAAC,KAAc,EAAoC,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAE1I;kGACkG;AAClG,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,IAAY,EAAE,KAAa;IACvE,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/E,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,KAAK,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,UAAU,EAAE,6GAA6G,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1O,IAAI,QAA8C,EAAE,MAAqD,CAAC;IAC1G,IAAI,CAAC;QACH,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACvE,MAAM,GAAG,0BAA0B,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,oBAAoB,EAAE,uGAAuG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAAC,CAAC;IACjQ,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,aAAa,EAAE,mLAAmL,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5U,IAAI,IAA0C,CAAC;IAC/C,IAAI,CAAC;QACH,IAAI,GAAG,iBAAiB,CAAC,MAAM,YAAY,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;QAC9F,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;IAC1F,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,eAAe,EAAE,wHAAwH,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAAC,CAAC;IACvM,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QAAC,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;IAAC,CAAC;IAC/D,MAAM,CAAC;QAAC,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,eAAe,EAAE,qGAAqG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAAC,CAAC;IAClL,IAAI,EAAkB,CAAC;IACvB,IAAI,CAAC;QAAC,EAAE,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,qBAAqB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,WAAW,EAAE,UAAU,QAAQ,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;IACvN,MAAM,CAAC;QAAC,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,oBAAoB,EAAE,qHAAqH,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAAC,CAAC;IACvM,IAAI,OAAmC,EAAE,YAAY,GAAG,KAAK,CAAC;IAC9D,MAAM,YAAY,GAAuL,EAAE,CAAC;IAC5M,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,IAAI,CAAC;QACH,IAAI,CAAC;YAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;QAC/B,MAAM,CAAC;YAAC,MAAM,IAAI,cAAc,CAAC,SAAS,EAAE,aAAa,EAAE,wGAAwG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAAC,CAAC;QACnL,MAAM,MAAM,GAAG,MAAM,+BAA+B,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3G,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,yEAAyE,CAAC,CAAC;QAC1J,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,EAAE,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QACjF,MAAM,IAAI,GAAG,KAAK,EAAE,GAAW,EAAE,EAAE;YACjC,MAAM,SAAS,GAAG,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAC/C,IAAI,SAAS,IAAI,CAAC;gBAAE,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,oDAAoD,CAAC,CAAC;YACnH,IAAI,KAAgD,CAAC;YACrD,IAAI,CAAC;gBACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;oBACxB,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC;oBACrC,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,aAAa,EAAE,kEAAkE,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;iBAC5L,CAAC,CAAC;YACL,CAAC;oBAAS,CAAC;gBAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC;QACpC,CAAC,CAAC;QACF,MAAM,IAAI,GAAG,KAAK,EAAE,IAAyB,EAAE,UAAoB,EAAE,EAAE;YACrE,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,KAAK,IAAI;gBAAE,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,yCAAyC,CAAC,CAAC;YACzI,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;YAC7H,IAAI,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,GAAG,GAAG,GAAG,IAAI,IAAI,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,GAAG,GAAG,GAAG,IAAI;gBAAE,MAAM,IAAI,eAAe,CAAC,oBAAoB,EAAE,iEAAiE,CAAC,CAAC;YACnR,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,oBAAoB,KAAK,IAAI,CAAC,QAAQ,IAAI,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS;gBAAE,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,sGAAsG,CAAC,CAAC;YAC/X,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QAClH,CAAC,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACzD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YACtF,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,cAAc,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,YAAY;gBAAE,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,uEAAuE,CAAC,CAAC;YAClQ,IAAI,MAAM;gBAAE,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC3D,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,KAAK;gBAAE,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,qCAAqC,CAAC,CAAC;YACxK,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAA4B,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YACtN,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,iBAAiB,KAAK,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;gBAAE,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,gEAAgE,CAAC,CAAC;YAC/N,6BAA6B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC9C,uBAAuB,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAA4B,EAAE,MAAM,CAAC,CAAC;YACtF,IAAI,UAAwD,CAAC;YAC7D,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAClB,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;gBACpE,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,KAAK,KAAK;oBAAE,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,sCAAsC,CAAC,CAAC;YAClI,CAAC;YACD,YAAY,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,kBAAkB,EAAE,MAAM,CAAC,YAAY,EAAE,oBAAoB,EAAE,MAAM,CAAC,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,YAAY,IAAI,IAAI,EAAE,oBAAoB,EAAE,UAAU,EAAE,cAAc,IAAI,IAAI,EAAE,CAAC,CAAC;QACrR,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,KAAK,YAAY,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,SAAS,EAAE,IAAI,KAAK,mBAAmB,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,wBAAwB,EAAE,6IAA6I,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,gJAAgJ,EAAE,CAAC,CAAC;IACxiB,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;YAAC,YAAY,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,YAAY,GAAG,KAAK,CAAC;QAAC,CAAC;IACzF,CAAC;IACD,IAAI,OAAO;QAAE,MAAM,OAAO,CAAC;IAC3B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC9C,OAAO;QACL,GAAG,QAAQ,EAAE,IAAI,EAAE,oCAAoC,EAAE,KAAK;QAC9D,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,qCAAqC,EAAE,CAAC,CAAC;QAC/L,iBAAiB,EAAE,sCAAsC,EAAE,eAAe,EAAE,IAAI;QAChF,gBAAgB,EAAE,IAAI,EAAE,cAAc,EAAE,8BAA8B,EAAE,mBAAmB,EAAE,KAAK;QAClG,sBAAsB,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK;QAC9C,YAAY,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,gBAAgB,EAAE,cAAc,EAAE,aAAa,EAAE,gBAAgB,EAAE,aAAa,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,YAAY,EAAE,YAAY,EAAE;KAChc,CAAC;AACJ,CAAC"}

package/dist/idp.d.ts

@@ -62,6 +62,11 @@ export interface CreateIdpBridgeOpts {
         actor: string;
         lifecycleUid: string;
     }) => Promise<string>;
+    /** The dedicated `aud` of `dm-reader` proofs (#4189), from the same pinned IdP issuer and keys.
+     *  Explicit operator config: it is never derived from, or defaulted to, `idp.audience`, and
+     *  construction refuses it when it equals `idp.audience`, so every exact-audience verifier of
+     *  ordinary proofs refuses a `dm-reader` proof. Absent: the bridge refuses the `dm-reader` view. */
+    dmReaderAudience?: string;
 }
 /** A successful exchange: the minted bearer plus what a caller needs to cache/refresh it. */
 export interface ExchangeResult {
@@ -102,11 +107,28 @@ export interface VerifiedIdpToken {
     auth_time?: number;
     amr?: readonly string[];
 }
+/** The one `purpose` value a purpose-bound proof may carry (#4189). */
+export declare const DM_READER_PURPOSE = "dm-reader";
+/** A verified `dm-reader` proof: the human, the proof's expiry, and the three claims that bind it to
+ *  one reader incarnation in one space. */
+export interface DmReaderProof {
+    sub: string;
+    exp: number;
+    actor: string;
+    lifecycle: string;
+    space: string;
+}
 /** Verify an external IdP JWT against the pinned config and return its `sub` AND `exp`. Same pinning
  *  posture as `validateUserToken`, minus the Cotal claim shape (an IdP token has no `ver`/`act`; its
  *  lifetime is the IdP's session policy — but it must expire and must not be post-dated). The `exp` is
- *  returned so `exchange` can CAP the minted Cotal bearer to the upstream proof's remaining life. */
+ *  returned so `exchange` can CAP the minted Cotal bearer to the upstream proof's remaining life.
+ *  A token carrying a `purpose` claim is refused: a purpose-bound proof is accepted only by the one
+ *  exchange its purpose names, never as a general human proof (#4189). */
 export declare function verifyIdpToken(token: string, idp: IdpConfig): Promise<VerifiedIdpToken>;
+/** Verify a `dm-reader` proof (#4189): the same pinned issuer and keys as every IdP proof, the
+ *  dedicated `audience`, `purpose` exactly {@link DM_READER_PURPOSE}, and non-empty string `actor`,
+ *  `lifecycle` and `space` claims. Matching those claims to the request is the exchange's job. */
+export declare function verifyDmReaderProof(token: string, idp: IdpConfig, audience: string): Promise<DmReaderProof>;
 /** A private-result consent proof, not consent or permission to read any result. */
 export interface ToolResultHumanProof {
     readonly sub: string;

package/dist/idp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"idp.d.ts","sourceRoot":"","sources":["../src/idp.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAGvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAA6E,KAAK,gBAAgB,EAAE,KAAK,uBAAuB,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAGhL;wCACwC;AACxC,MAAM,WAAW,SAAS;IACxB,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;IACjB;4FACwF;IACxF,GAAG,EAAE,eAAe,GAAG,SAAS,CAAC;CAClC;AAED;;eAEe;AACf,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;;qFAIiF;IACjF,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;kGAC8F;IAC9F,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,sCAAsC;IACtC,GAAG,EAAE,SAAS,CAAC;IACf,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,WAAW,EAAE,MAAM,GAAG,UAAU,CAAC;IACjC,sDAAsD;IACtD,MAAM,EAAE,eAAe,CAAC;IACxB;;mFAE+E;IAC/E,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACnF;;;;;;;;;;2FAUuF;IACvF,qBAAqB,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC1G;AAED,6FAA6F;AAC7F,MAAM,WAAW,cAAc;IAC7B,8EAA8E;IAC9E,KAAK,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,SAAS;IACxB;;;;yCAIqC;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE;QAC9B,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,aAAa,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QACjF;mGAC2F;QAC3F,aAAa,CAAC,EAAE,CAAC,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACzG,yFAAyF;QACzF,cAAc,CAAC,EAAE,uBAAuB,CAAC;KAC1C,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC7B;AAED;6EAC6E;AAC7E,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACzB;AAED;;;qGAGqG;AACrG,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA+B7F;AAED,oFAAoF;AACpF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;sDAEsD;AACtD,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,GAAE,MAAM,MAAiB,GAC1D,OAAO,CAAC,oBAAoB,CAAC,CAQ/B;AAwCD;gFACgF;AAChF,wBAAgB,eAAe,CAAC,IAAI,EAAE,mBAAmB,GAAG,SAAS,CA6FpE"}
+{"version":3,"file":"idp.d.ts","sourceRoot":"","sources":["../src/idp.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,SAAS,EAAc,eAAe,EAAE,MAAM,MAAM,CAAC;AAGnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAA6E,KAAK,gBAAgB,EAAE,KAAK,uBAAuB,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAGhL;wCACwC;AACxC,MAAM,WAAW,SAAS;IACxB,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;IACjB;4FACwF;IACxF,GAAG,EAAE,eAAe,GAAG,SAAS,CAAC;CAClC;AAED;;eAEe;AACf,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;;qFAIiF;IACjF,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;kGAC8F;IAC9F,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,sCAAsC;IACtC,GAAG,EAAE,SAAS,CAAC;IACf,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,WAAW,EAAE,MAAM,GAAG,UAAU,CAAC;IACjC,sDAAsD;IACtD,MAAM,EAAE,eAAe,CAAC;IACxB;;mFAE+E;IAC/E,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACnF;;;;;;;;;;2FAUuF;IACvF,qBAAqB,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACzG;;;wGAGoG;IACpG,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,6FAA6F;AAC7F,MAAM,WAAW,cAAc;IAC7B,8EAA8E;IAC9E,KAAK,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,SAAS;IACxB;;;;yCAIqC;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE;QAC9B,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,aAAa,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;QACjF;mGAC2F;QAC3F,aAAa,CAAC,EAAE,CAAC,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACzG,yFAAyF;QACzF,cAAc,CAAC,EAAE,uBAAuB,CAAC;KAC1C,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC7B;AAED;6EAC6E;AAC7E,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACzB;AAED,uEAAuE;AACvE,eAAO,MAAM,iBAAiB,cAAc,CAAC;AAE7C;2CAC2C;AAC3C,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AA+BD;;;;;0EAK0E;AAC1E,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAW7F;AAED;;kGAEkG;AAClG,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAQjH;AAED,oFAAoF;AACpF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;sDAEsD;AACtD,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,GAAE,MAAM,MAAiB,GAC1D,OAAO,CAAC,oBAAoB,CAAC,CAQ/B;AAwCD;gFACgF;AAChF,wBAAgB,eAAe,CAAC,IAAI,EAAE,mBAAmB,GAAG,SAAS,CAiHpE"}

package/dist/idp.js

@@ -29,11 +29,11 @@ import { assertValidOwnerToken } from "@cotal-ai/core";
 import { deriveOwnerForIdpSubject } from "./derive.js";
 import { CLOCK_TOLERANCE_SEC, USER_TOKEN_VIEWS, VIEW_REQUIRED_SCOPE, viewTtlCapSec } from "./token.js";
 import { grantCommandLine } from "./grant-command.js";
-/** Verify an external IdP JWT against the pinned config and return its `sub` AND `exp`. Same pinning
- *  posture as `validateUserToken`, minus the Cotal claim shape (an IdP token has no `ver`/`act`; its
- *  lifetime is the IdP's session policy — but it must expire and must not be post-dated). The `exp` is
- *  returned so `exchange` can CAP the minted Cotal bearer to the upstream proof's remaining life. */
-export async function verifyIdpToken(token, idp) {
+/** The one `purpose` value a purpose-bound proof may carry (#4189). */
+export const DM_READER_PURPOSE = "dm-reader";
+/** The pinning shared by every IdP proof: alg, key path, exact issuer, exact single `audience`,
+ *  a bounded lifetime and a string subject. Returns the verified payload. */
+async function verifyPinnedIdpJwt(token, idp, audience) {
     const header = decodeProtectedHeader(token);
     if (header.jku !== undefined || header.jwk !== undefined || header.x5u !== undefined || header.x5c !== undefined)
         throw new Error("idp token: embedded key material (jku/jwk/x5u/x5c) is rejected - keys resolve only via the pinned JWKS");
@@ -42,14 +42,14 @@ export async function verifyIdpToken(token, idp) {
     const { payload } = await jwtVerify(token, idp.key, {
         algorithms: ["EdDSA"],
         issuer: idp.issuer,
-        audience: idp.audience,
+        audience,
         clockTolerance: CLOCK_TOLERANCE_SEC,
     });
     // jose's `audience` option is SET-MEMBERSHIP (an aud array containing the expected value
     // passes) — exact means the token's audience set is exactly {configured}: the plain string, or
     // a singleton array of it. A multi-audience session proof minted for other services too must
     // not be exchangeable here.
-    if (payload.aud !== idp.audience && !(Array.isArray(payload.aud) && payload.aud.length === 1 && payload.aud[0] === idp.audience))
+    if (payload.aud !== audience && !(Array.isArray(payload.aud) && payload.aud.length === 1 && payload.aud[0] === audience))
         throw new Error("idp token: aud must be exactly the configured audience - a multi-audience session proof is rejected");
     if (typeof payload.exp !== "number")
         throw new Error("idp token: exp is required - an IdP session proof must expire");
@@ -59,6 +59,18 @@ export async function verifyIdpToken(token, idp) {
         throw new Error("idp token: iat is in the future");
     if (typeof payload.sub !== "string" || !payload.sub)
         throw new Error("idp token: sub must be a non-empty string user id - no coercion at a trust boundary");
+    return payload;
+}
+/** Verify an external IdP JWT against the pinned config and return its `sub` AND `exp`. Same pinning
+ *  posture as `validateUserToken`, minus the Cotal claim shape (an IdP token has no `ver`/`act`; its
+ *  lifetime is the IdP's session policy — but it must expire and must not be post-dated). The `exp` is
+ *  returned so `exchange` can CAP the minted Cotal bearer to the upstream proof's remaining life.
+ *  A token carrying a `purpose` claim is refused: a purpose-bound proof is accepted only by the one
+ *  exchange its purpose names, never as a general human proof (#4189). */
+export async function verifyIdpToken(token, idp) {
+    const payload = await verifyPinnedIdpJwt(token, idp, idp.audience);
+    if (Object.hasOwn(payload, "purpose"))
+        throw new Error("idp token: a token carrying a purpose claim is not a general human proof - it is accepted only by the exchange its purpose names");
     return {
         sub: payload.sub, exp: payload.exp,
         ...(typeof payload.auth_time === "number" && Number.isSafeInteger(payload.auth_time) && payload.auth_time >= 0
@@ -67,6 +79,18 @@ export async function verifyIdpToken(token, idp) {
             ? { amr: Object.freeze([...payload.amr]) } : {}),
     };
 }
+/** Verify a `dm-reader` proof (#4189): the same pinned issuer and keys as every IdP proof, the
+ *  dedicated `audience`, `purpose` exactly {@link DM_READER_PURPOSE}, and non-empty string `actor`,
+ *  `lifecycle` and `space` claims. Matching those claims to the request is the exchange's job. */
+export async function verifyDmReaderProof(token, idp, audience) {
+    const payload = await verifyPinnedIdpJwt(token, idp, audience);
+    if (payload.purpose !== DM_READER_PURPOSE)
+        throw new Error(`dm-reader proof: purpose must be "${DM_READER_PURPOSE}" - an absent, unknown or malformed purpose is refused`);
+    for (const claim of ["actor", "lifecycle", "space"])
+        if (typeof payload[claim] !== "string" || !payload[claim])
+            throw new Error(`dm-reader proof: the ${claim} claim must be a non-empty string`);
+    return { sub: payload.sub, exp: payload.exp, actor: payload.actor, lifecycle: payload.lifecycle, space: payload.space };
+}
 /** Verify the pinned signed proof before applying the consent-only, five-minute password rule.
  * The host clock returns integer milliseconds and is read after verification;
  * no rounding or JWT tolerance widens this window. */
@@ -127,12 +151,32 @@ export function createIdpBridge(opts) {
         throw new Error("idp bridge: an authorizeActor ledger hook is required - there is no allow-by-default");
     if (typeof opts.mintConnectCredential !== "function")
         throw new Error("idp bridge: a mintConnectCredential hook is required (SPEC 13.1, R1) - the v0.4 bridge must stamp every bearer's incarnation root credential; a claimless mint would silently disable deny-new in any composition without the connect arm");
+    const dmReaderAudience = opts.dmReaderAudience;
+    if (dmReaderAudience !== undefined) {
+        if (typeof dmReaderAudience !== "string" || !dmReaderAudience)
+            throw new Error("idp bridge: dmReaderAudience must be a non-empty string when present");
+        if (dmReaderAudience === opts.idp.audience)
+            throw new Error("idp bridge: dmReaderAudience must differ from idp.audience - a dm-reader proof on the ordinary audience would pass every exact-audience verifier of ordinary proofs");
+    }
     return {
         exchange: async (idpToken, req) => {
             if (req.view === "service-endpoint")
                 throw new Error("service-endpoint requires the dedicated service authority exchange");
             assertValidOwnerToken(req.actor);
-            const { sub, exp: idpExp } = await verifyIdpToken(idpToken, opts.idp);
+            // A dm-reader view rides ONLY a dm-reader proof, and a dm-reader proof rides only that view:
+            // the generic verifier refuses its audience and its purpose claim, and the dedicated verifier
+            // refuses an ordinary token's audience and missing purpose.
+            let dmProof;
+            if (req.view === "dm-reader") {
+                if (dmReaderAudience === undefined)
+                    throw new Error('the "dm-reader" view needs a dedicated proof audience (dmReaderAudience), and this bridge has none configured');
+                dmProof = await verifyDmReaderProof(idpToken, opts.idp, dmReaderAudience);
+                if (dmProof.actor !== req.actor)
+                    throw new Error("dm-reader proof: its actor claim is not the requested actor");
+                if (dmProof.space !== opts.space)
+                    throw new Error("dm-reader proof: its space claim is not this bridge's space");
+            }
+            const { sub, exp: idpExp } = dmProof ?? await verifyIdpToken(idpToken, opts.idp);
             // The (issuer, sub) → derivation-input encoding lives in ONE place (deriveOwnerForIdpSubject),
             // shared with the operator grant command — the ledger's grant-time owner and the exchange-time
             // owner must be the same bytes or every grant silently misses.
@@ -161,6 +205,8 @@ export function createIdpBridge(opts) {
             // cannot mint - minting claimless would only defer the same refusal to every connect.
             if (typeof grant.lifecycleUid !== "string" || !grant.lifecycleUid)
                 throw new Error(`idp bridge: the grant for actor "${req.actor}" carries no lifecycleUid - re-grant it (bearers are lifecycle-bound from v0.4)`);
+            if (dmProof && dmProof.lifecycle !== grant.lifecycleUid)
+                throw new Error("dm-reader proof: its lifecycle claim is not the current grant's - an old lifecycle's proof mints nothing");
             // Cap the minted bearer's lifetime to the IdP proof's REMAINING life: the Cotal bearer must not
             // outlive the session proof it rests on. Otherwise a near-expired (or stolen just-before-expiry)
             // IdP JWT would exchange for a full MAX_TOKEN_TTL_SEC bearer, widening authority past the upstream

package/dist/idp.js.map

@@ -1 +1 @@
-{"version":3,"file":"idp.js","sourceRoot":"","sources":["../src/idp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAEnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAEvD,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,aAAa,EAA2E,MAAM,YAAY,CAAC;AAChL,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAkGtD;;;qGAGqG;AACrG,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAa,EAAE,GAAc;IAChE,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;QAC9G,MAAM,IAAI,KAAK,CAAC,wGAAwG,CAAC,CAAC;IAC5H,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAExG,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,GAAsB,EAAE;QACrE,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,cAAc,EAAE,mBAAmB;KACpC,CAAC,CAAC;IAEH,yFAAyF;IACzF,+FAA+F;IAC/F,6FAA6F;IAC7F,4BAA4B;IAC5B,IAAI,OAAO,CAAC,GAAG,KAAK,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,QAAQ,CAAC;QAC9H,MAAM,IAAI,KAAK,CAAC,qGAAqG,CAAC,CAAC;IACzH,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACtH,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACnF,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,mBAAmB;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC1H,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG;QACjD,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;IACzG,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG;QAClC,GAAG,CAAC,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,SAAS,IAAI,CAAC;YAC5G,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;YACtI,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAa,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC;AACJ,CAAC;AASD;;sDAEsD;AACtD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAAa,EAAE,GAAc,EAAE,MAAoB,IAAI,CAAC,GAAG;IAE3D,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAClD,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC;IAC9B,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC;IACjB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,GAAG,IAAI,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,OAAO;QACrG,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE;QAC7D,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,aAAa,CAAC,KAAa,EAAE,KAAa,EAAE,KAAiB,EAAE,IAAY;IAClF,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3D,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;QACxE,OAAO,CACL,qGAAqG;YACrG,4FAA4F;YAC5F,qFAAqF;YACrF,kFAAkF;YAClF,IAAI,IAAI,wFAAwF,CACjG,CAAC;IACJ,OAAO,CACL,2FAA2F;QAC3F,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE;YAC7B,KAAK;YACL,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C,CAAC;QACF,gGAAgG;QAChG,6EAA6E,CAC9E,CAAC;AACJ,CAAC;AAED;gFACgF;AAChF,MAAM,UAAU,eAAe,CAAC,IAAyB;IACvD,IAAI,CAAC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACpE,IAAI,OAAO,IAAI,CAAC,GAAG,EAAE,MAAM,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM;QAC1D,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,IAAI,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ;QAC7D,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC9G,IAAI,OAAO,IAAI,CAAC,cAAc,KAAK,UAAU;QAC3C,MAAM,IAAI,KAAK,CAAC,sFAAsF,CAAC,CAAC;IAC1G,IAAI,OAAO,IAAI,CAAC,qBAAqB,KAAK,UAAU;QAClD,MAAM,IAAI,KAAK,CAAC,2OAA2O,CAAC,CAAC;IAC/P,OAAO;QACL,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE;YAChC,IAAI,GAAG,CAAC,IAAI,KAAK,kBAAkB;gBAAE,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;YAC3H,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACjC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YACtE,+FAA+F;YAC/F,+FAA+F;YAC/F,+DAA+D;YAC/D,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC/E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YAC1D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBACrE,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;YACrG,IAAI,GAAG,CAAC,IAAI,KAAK,iBAAiB;gBAChC,MAAM,IAAI,KAAK,CAAC,kGAAkG,CAAC,CAAC;YACtH,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC3B,oFAAoF;gBACpF,yFAAyF;gBACzF,mFAAmF;gBACnF,mBAAmB;gBACnB,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;oBACtC,MAAM,IAAI,KAAK,CAAC,SAAS,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,0BAA0B,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACrG,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC3C,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAC3D,MAAM,IAAI,KAAK,CACb,QAAQ,GAAG,CAAC,IAAI,uBAAuB,IAAI,oFAAoF,IAAI,kDAAkD;wBACnL,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAC/C,CAAC;YACN,CAAC;YACD,0FAA0F;YAC1F,0FAA0F;YAC1F,oFAAoF;YACpF,0FAA0F;YAC1F,sFAAsF;YACtF,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,YAAY;gBAC/D,MAAM,IAAI,KAAK,CACb,oCAAoC,GAAG,CAAC,KAAK,iFAAiF,CAC/H,CAAC;YACJ,gGAAgG;YAChG,iGAAiG;YACjG,mGAAmG;YACnG,kGAAkG;YAClG,kGAAkG;YAClG,6FAA6F;YAC7F,kGAAkG;YAClG,IAAI,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAClC,MAAM,YAAY,GAAG,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC5D,IAAI,YAAY,IAAI,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;YAC1F,IAAI,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;YAC3E,IAAI,OAAqC,CAAC;YAC1C,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBAClC,IAAI,CAAC,GAAG,CAAC,aAAa;oBAAE,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC,CAAC;gBACjI,OAAO,GAAG,MAAM,GAAG,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;gBACjG,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBACpF,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YAC7C,CAAC;YACD,wFAAwF;YACxF,sFAAsF;YACtF,qFAAqF;YACrF,uFAAuF;YACvF,oEAAoE;YACpE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;YACrH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBACpC,KAAK;gBACL,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,YAAY;gBACZ,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;gBACxC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/B,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrE,MAAM;gBACN,QAAQ;aACT,CAAC,CAAC;YACH,MAAM,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;YACpH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC/G,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"idp.js","sourceRoot":"","sources":["../src/idp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAEnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAEvD,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,aAAa,EAA2E,MAAM,YAAY,CAAC;AAChL,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAuGtD,uEAAuE;AACvE,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAC;AAY7C;6EAC6E;AAC7E,KAAK,UAAU,kBAAkB,CAAC,KAAa,EAAE,GAAc,EAAE,QAAgB;IAC/E,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;QAC9G,MAAM,IAAI,KAAK,CAAC,wGAAwG,CAAC,CAAC;IAC5H,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAExG,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,GAAsB,EAAE;QACrE,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,QAAQ;QACR,cAAc,EAAE,mBAAmB;KACpC,CAAC,CAAC;IAEH,yFAAyF;IACzF,+FAA+F;IAC/F,6FAA6F;IAC7F,4BAA4B;IAC5B,IAAI,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC;QACtH,MAAM,IAAI,KAAK,CAAC,qGAAqG,CAAC,CAAC;IACzH,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACtH,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACnF,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,mBAAmB;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC1H,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG;QACjD,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;IACzG,OAAO,OAAiE,CAAC;AAC3E,CAAC;AAED;;;;;0EAK0E;AAC1E,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAa,EAAE,GAAc;IAChE,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnE,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,kIAAkI,CAAC,CAAC;IACtJ,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG;QAClC,GAAG,CAAC,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,SAAS,IAAI,CAAC;YAC5G,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;YACtI,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAa,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC;AACJ,CAAC;AAED;;kGAEkG;AAClG,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAa,EAAE,GAAc,EAAE,QAAgB;IACvF,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC/D,IAAI,OAAO,CAAC,OAAO,KAAK,iBAAiB;QACvC,MAAM,IAAI,KAAK,CAAC,qCAAqC,iBAAiB,wDAAwD,CAAC,CAAC;IAClI,KAAK,MAAM,KAAK,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,CAAU;QAC1D,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,wBAAwB,KAAK,mCAAmC,CAAC,CAAC;IACtF,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAe,EAAE,SAAS,EAAE,OAAO,CAAC,SAAmB,EAAE,KAAK,EAAE,OAAO,CAAC,KAAe,EAAE,CAAC;AACxJ,CAAC;AASD;;sDAEsD;AACtD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAAa,EAAE,GAAc,EAAE,MAAoB,IAAI,CAAC,GAAG;IAE3D,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAClD,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC;IAC9B,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC;IACjB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,GAAG,IAAI,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,OAAO;QACrG,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE;QAC7D,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,aAAa,CAAC,KAAa,EAAE,KAAa,EAAE,KAAiB,EAAE,IAAY;IAClF,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3D,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;QACxE,OAAO,CACL,qGAAqG;YACrG,4FAA4F;YAC5F,qFAAqF;YACrF,kFAAkF;YAClF,IAAI,IAAI,wFAAwF,CACjG,CAAC;IACJ,OAAO,CACL,2FAA2F;QAC3F,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE;YAC7B,KAAK;YACL,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C,CAAC;QACF,gGAAgG;QAChG,6EAA6E,CAC9E,CAAC;AACJ,CAAC;AAED;gFACgF;AAChF,MAAM,UAAU,eAAe,CAAC,IAAyB;IACvD,IAAI,CAAC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACpE,IAAI,OAAO,IAAI,CAAC,GAAG,EAAE,MAAM,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM;QAC1D,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,IAAI,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ;QAC7D,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC9G,IAAI,OAAO,IAAI,CAAC,cAAc,KAAK,UAAU;QAC3C,MAAM,IAAI,KAAK,CAAC,sFAAsF,CAAC,CAAC;IAC1G,IAAI,OAAO,IAAI,CAAC,qBAAqB,KAAK,UAAU;QAClD,MAAM,IAAI,KAAK,CAAC,2OAA2O,CAAC,CAAC;IAC/P,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC;IAC/C,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,IAAI,OAAO,gBAAgB,KAAK,QAAQ,IAAI,CAAC,gBAAgB;YAC3D,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;QAC1F,IAAI,gBAAgB,KAAK,IAAI,CAAC,GAAG,CAAC,QAAQ;YACxC,MAAM,IAAI,KAAK,CAAC,qKAAqK,CAAC,CAAC;IAC3L,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE;YAChC,IAAI,GAAG,CAAC,IAAI,KAAK,kBAAkB;gBAAE,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;YAC3H,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACjC,6FAA6F;YAC7F,8FAA8F;YAC9F,4DAA4D;YAC5D,IAAI,OAAkC,CAAC;YACvC,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC7B,IAAI,gBAAgB,KAAK,SAAS;oBAChC,MAAM,IAAI,KAAK,CAAC,+GAA+G,CAAC,CAAC;gBACnI,OAAO,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;gBAC1E,IAAI,OAAO,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK;oBAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;gBAChH,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK;oBAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;YACnH,CAAC;YACD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,IAAI,MAAM,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YACjF,+FAA+F;YAC/F,+FAA+F;YAC/F,+DAA+D;YAC/D,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC/E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YAC1D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBACrE,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;YACrG,IAAI,GAAG,CAAC,IAAI,KAAK,iBAAiB;gBAChC,MAAM,IAAI,KAAK,CAAC,kGAAkG,CAAC,CAAC;YACtH,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC3B,oFAAoF;gBACpF,yFAAyF;gBACzF,mFAAmF;gBACnF,mBAAmB;gBACnB,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;oBACtC,MAAM,IAAI,KAAK,CAAC,SAAS,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,0BAA0B,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACrG,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC3C,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAC3D,MAAM,IAAI,KAAK,CACb,QAAQ,GAAG,CAAC,IAAI,uBAAuB,IAAI,oFAAoF,IAAI,kDAAkD;wBACnL,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAC/C,CAAC;YACN,CAAC;YACD,0FAA0F;YAC1F,0FAA0F;YAC1F,oFAAoF;YACpF,0FAA0F;YAC1F,sFAAsF;YACtF,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,YAAY;gBAC/D,MAAM,IAAI,KAAK,CACb,oCAAoC,GAAG,CAAC,KAAK,iFAAiF,CAC/H,CAAC;YACJ,IAAI,OAAO,IAAI,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,YAAY;gBACrD,MAAM,IAAI,KAAK,CAAC,0GAA0G,CAAC,CAAC;YAC9H,gGAAgG;YAChG,iGAAiG;YACjG,mGAAmG;YACnG,kGAAkG;YAClG,kGAAkG;YAClG,6FAA6F;YAC7F,kGAAkG;YAClG,IAAI,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAClC,MAAM,YAAY,GAAG,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC5D,IAAI,YAAY,IAAI,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;YAC1F,IAAI,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;YAC3E,IAAI,OAAqC,CAAC;YAC1C,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBAClC,IAAI,CAAC,GAAG,CAAC,aAAa;oBAAE,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC,CAAC;gBACjI,OAAO,GAAG,MAAM,GAAG,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;gBACjG,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBACpF,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YAC7C,CAAC;YACD,wFAAwF;YACxF,sFAAsF;YACtF,qFAAqF;YACrF,uFAAuF;YACvF,oEAAoE;YACpE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;YACrH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBACpC,KAAK;gBACL,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,YAAY;gBACZ,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;gBACxC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/B,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrE,MAAM;gBACN,QAAQ;aACT,CAAC,CAAC;YACH,MAAM,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;YACpH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC/G,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -5,13 +5,13 @@ export type { PlatformControlAssignment } from "@cotal-ai/core";
 export { AUTH_CALLOUT_SUBJECT, createCalloutAuth, startAuthCallout, type CalloutAuth, type CalloutProvisionInput, type CalloutConnection, type CalloutMsg, type StartAuthCalloutOpts, } from "./callout.js";
 export { validateUserToken, assertCredentialIdClaim, USER_TOKEN_VER, MAX_TOKEN_TTL_SEC, USER_TOKEN_VIEWS, PUBLIC_EXCHANGE_VIEWS, VIEW_REQUIRED_SCOPE, type UserTokenActor, type UserTokenService, type UserTokenView, type ValidatedUserToken, type ValidateUserTokenOpts, } from "./token.js";
 export { USER_TOKEN_ALG, createUserTokenIssuer, generateSigningKey, exportSigningKey, importSigningKey, pinnedJwksResolver, type SigningKey, type SerializedSigningKey, type IssueClaims, type ServiceAccessClaims, type UserTokenIssuer, type CreateIssuerOpts, } from "./issuer.js";
-export { createIdpBridge, verifyIdpToken, verifyToolResultHumanProof, type VerifiedIdpToken, type ToolResultHumanProof, type IdpConfig, type ActorGrant, type CreateIdpBridgeOpts, type ExchangeResult, type IdpBridge, } from "./idp.js";
+export { createIdpBridge, verifyIdpToken, verifyToolResultHumanProof, verifyDmReaderProof, DM_READER_PURPOSE, type VerifiedIdpToken, type ToolResultHumanProof, type IdpConfig, type ActorGrant, type CreateIdpBridgeOpts, type ExchangeResult, type IdpBridge, } from "./idp.js";
 export { CATALOG_FRESH_MS, deviceLogin, establishIdpSession, fetchIdpJwt, revokeIdpSession, loadIdpSession, hasIdpSessions, saveIdpSession, deleteIdpSession, deleteIdpSpaceCatalog, hasIdpSpaceCatalog, prepareIdpSpaceCatalogs, requireIdpSession, normalizeIdpUrl, probeIdpJwks, type IdpSession, type DeviceLoginOpts, type DeviceLoginPrompt, } from "./login.js";
 export { calloutPermissions, type AclResolver, type UserCallerIssuer } from "./permissions.js";
 export { USER_AUTH_TRUST_SCHEME, userAuthTrustFingerprint, validateRetainedManagedAgent, } from "./continuity.js";
 export { AUTH_PROVIDER_NAME, authCalloutKey, authInstanceKey, authIssuerKey, authOwnerSecretKey, authServiceKeysKey, clearAuthServiceInfo, ensureCalloutAuth, ensureIssuer, ensureOwnerSecret, ensurePinnedIdp, loadAuthServiceInfo, loadCalloutAuth, loadIssuer, loadOwnerSecret, loadPinnedIdp, loadServiceKeys, saveAuthServiceInfo, saveServiceKeys, spaceIssuer, type AuthServiceInfo, type PinnedIdp, type ServiceKeys, } from "./store.js";
 export { actorLedgerDir, managedActorLedgerDir, findInteractiveActor, findManagedActor, findActorUnified, grantActor, grantManagedActor, ledgerAclResolver, ledgerActorSourceIsLive, ledgerAuthorizeConnect, ledgerAuthorizeGrant, ledgerAuthorizeAgentExchange, ledgerRowFilename, loadActorLedger, revokeActor, revokeManagedActor, newActorToken, hashActorToken, AGENT_BEARER_TTL_SEC, type ActorKind, type ActorRow, } from "./ledger.js";
-export { runAuthService, startAuthService, type AuthServiceHandle, type PublicFaceInput, type PlatformControlInput, openAuthAuthorityPlane, dispatchManagerAuthorityRequest, handleManagerServiceAuthority, type ManagerServiceAuthorityCtx, handleToolResultHumanProof, type ToolResultHumanProofCtx, TOOL_RESULT_HUMAN_PROOF_PATH, handleToolResultConsent, TOOL_RESULT_CONSENT_PATH, JWKS_MAX_AGE_SEC, INTERACTIVE_RETIRE_PATH, MANAGED_RETIRE_PATH, VERIFY_ENROLLMENT_PATH, composeUserBundle, finalizeUserBundleEndpoint, checkAdvertisedServer, checkAgentProvisioningUrl, type AuthAuthorityPlane } from "./service.js";
+export { runAuthService, startAuthService, type AuthServiceRuntimeOptions, type OpenAuthAuthorityPlaneOptions, type AuthServiceHandle, type PublicFaceInput, type PlatformControlInput, openAuthAuthorityPlane, dispatchManagerAuthorityRequest, handleManagerServiceAuthority, type ManagerServiceAuthorityCtx, handleToolResultHumanProof, type ToolResultHumanProofCtx, TOOL_RESULT_HUMAN_PROOF_PATH, handleToolResultConsent, TOOL_RESULT_CONSENT_PATH, JWKS_MAX_AGE_SEC, INTERACTIVE_RETIRE_PATH, CHAT_SESSION_PATHS, MANAGED_RETIRE_PATH, VERIFY_ENROLLMENT_PATH, composeUserBundle, finalizeUserBundleEndpoint, checkAdvertisedServer, checkAgentProvisioningUrl, type AuthAuthorityPlane } from "./service.js";
 export { remoteManagerIssuerGrants } from "./authority-client.js";
 export { PLANE_CLAIM_REFUSED, PLANE_CLAIM_KEY, readPlaneClaim, planeClaimRefusal, type PlaneClaimRefusal, type PlaneClaimRow } from "./plane-claim.js";
 export { authConnectReaderGrants, openConnectReader, authorizeConnectCredential, type ConnectReader, } from "./connect-reader.js";
@@ -22,6 +22,7 @@ export { parseRemoteManagerAdminAuthorizationRequest, authorizeRemoteManagerAdmi
 export { authorizeRemoteManagedAgentEnrollment, authorizeRemoteManagedAgentPrepareRetirement, authorizeRemoteManagedAgentRuntimeCreate, authorizeRemoteManagedAgentRuntimeStatus, type AuthorizeRemoteManagedAgentEnrollmentArgs, type AuthorizeRemoteManagedAgentPrepareRetirementArgs, type AuthorizeRemoteManagedAgentRuntimeArgs, type RemoteManagedAgentRuntimeDecision, type ObserveManagerGate, } from "./managed-agent-enrollment.js";
 export { authorizeDelegatedUserIntentAdmission, authorizeDelegatedUserIntentExecution, delegatedUserIntentHoldsAlias, joinOrStartDelegatedUserIntent, type AuthorizeDelegatedUserIntentAdmissionArgs, type AuthorizeDelegatedUserIntentExecutionArgs, type DelegatedUserIntentDecision, type DelegatedUserIntentExecutionPin, type DelegatedUserIntentFlights, type DelegatedUserIntentIncarnation, type DelegatedUserIntentRecord, type ObservePlatformControlAssignment, } from "./delegated-user-intent.js";
 export { cotalAuthProvider } from "./provider.js";
+import "./service-adapter.js";
 import "./commands.js";
 export { openSessionAuthStore, kvSessionLedger, sessionRedemptionHooks, closeSession, sweepSessions, kvServeIssuanceGate, type SessionAuthStore, type EndpointGateRow, type SessionSigner, type SessionHookDeps, type SessionCloser } from "./session-ledger.js";
 export { openLifecycleRegistry, openLifecycleMappingReader, readLifecycleMappingLeader, lifecycleProcessEpochReader, type LifecycleRegistry, type LifecycleMappingReader, type LifecycleMapping, type EpGateRow, } from "./lifecycle-registry.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAC/F,OAAO,EAAE,oCAAoC,EAAE,KAAK,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC1G,OAAO,EAAE,uCAAuC,EAAE,KAAK,4BAA4B,EAAE,KAAK,kCAAkC,EAAE,KAAK,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAC7L,YAAY,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,WAAW,EAChB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,oBAAoB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,GAC3B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,UAAU,EACf,KAAK,oBAAoB,EACzB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,eAAe,EACf,cAAc,EACd,0BAA0B,EAC1B,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,SAAS,GACf,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAE,KAAK,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,UAAU,EACV,eAAe,EACf,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,WAAW,EACX,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,WAAW,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,4BAA4B,EAC5B,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,oBAAoB,EACpB,KAAK,SAAS,EACd,KAAK,QAAQ,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,KAAK,iBAAiB,EAAE,KAAK,eAAe,EAAE,KAAK,oBAAoB,EAAE,sBAAsB,EAAE,+BAA+B,EAAE,6BAA6B,EAAE,KAAK,0BAA0B,EAAE,0BAA0B,EAAE,KAAK,uBAAuB,EAAE,4BAA4B,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAC/lB,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,cAAc,EAAE,iBAAiB,EAAE,KAAK,iBAAiB,EAAE,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAKvJ,OAAO,EACL,uBAAuB,EAAE,iBAAiB,EAAE,0BAA0B,EACtE,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,2BAA2B,EAAE,cAAc,EAAE,yBAAyB,EAAE,4BAA4B,EAAE,KAAK,qBAAqB,EAAE,8BAA8B,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,kCAAkC,EAAE,KAAK,+BAA+B,EAAE,KAAK,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AACzX,OAAO,EAAE,oCAAoC,EAAE,iCAAiC,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AACrJ,OAAO,EACL,yCAAyC,EACzC,sCAAsC,EACtC,qCAAqC,EACrC,qCAAqC,EACrC,KAAK,0CAA0C,GAChD,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,2CAA2C,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC5H,OAAO,EACL,qCAAqC,EACrC,4CAA4C,EAC5C,wCAAwC,EACxC,wCAAwC,EACxC,KAAK,yCAAyC,EAC9C,KAAK,gDAAgD,EACrD,KAAK,sCAAsC,EAC3C,KAAK,iCAAiC,EACtC,KAAK,kBAAkB,GACxB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,qCAAqC,EACrC,qCAAqC,EACrC,6BAA6B,EAC7B,8BAA8B,EAC9B,KAAK,yCAAyC,EAC9C,KAAK,yCAAyC,EAC9C,KAAK,2BAA2B,EAChC,KAAK,+BAA+B,EACpC,KAAK,0BAA0B,EAC/B,KAAK,8BAA8B,EACnC,KAAK,yBAAyB,EAC9B,KAAK,gCAAgC,GACtC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,eAAe,CAAC;AAIvB,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,sBAAsB,EAAE,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,KAAK,gBAAgB,EAAE,KAAK,eAAe,EAAE,KAAK,aAAa,EAAE,KAAK,eAAe,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAQjQ,OAAO,EACL,qBAAqB,EAAE,0BAA0B,EACjD,0BAA0B,EAAE,2BAA2B,EACvD,KAAK,iBAAiB,EAAE,KAAK,sBAAsB,EAAE,KAAK,gBAAgB,EAAE,KAAK,SAAS,GAC3F,MAAM,yBAAyB,CAAC;AAYjC,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAErF,OAAO,EAAE,6BAA6B,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,oBAAoB,EAAE,KAAK,sBAAsB,EAAE,KAAK,8BAA8B,EAAE,KAAK,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAG7P,OAAO,EAAE,iCAAiC,EAAE,0BAA0B,EAAE,6BAA6B,EAAE,yBAAyB,EAAE,kCAAkC,EAAE,KAAK,2BAA2B,EAAE,KAAK,yBAAyB,EAAE,KAAK,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAE/S,cAAc,4BAA4B,CAAC;AAE3C,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,KAAK,oBAAoB,EAAE,KAAK,uBAAuB,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAC/F,OAAO,EAAE,oCAAoC,EAAE,KAAK,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC1G,OAAO,EAAE,uCAAuC,EAAE,KAAK,4BAA4B,EAAE,KAAK,kCAAkC,EAAE,KAAK,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAC7L,YAAY,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,WAAW,EAChB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,oBAAoB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,GAC3B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,UAAU,EACf,KAAK,oBAAoB,EACzB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,eAAe,EACf,cAAc,EACd,0BAA0B,EAC1B,mBAAmB,EACnB,iBAAiB,EACjB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,SAAS,GACf,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAE,KAAK,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,UAAU,EACV,eAAe,EACf,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,WAAW,EACX,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,WAAW,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,4BAA4B,EAC5B,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,oBAAoB,EACpB,KAAK,SAAS,EACd,KAAK,QAAQ,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,KAAK,yBAAyB,EAAE,KAAK,6BAA6B,EAAE,KAAK,iBAAiB,EAAE,KAAK,eAAe,EAAE,KAAK,oBAAoB,EAAE,sBAAsB,EAAE,+BAA+B,EAAE,6BAA6B,EAAE,KAAK,0BAA0B,EAAE,0BAA0B,EAAE,KAAK,uBAAuB,EAAE,4BAA4B,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACvrB,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,cAAc,EAAE,iBAAiB,EAAE,KAAK,iBAAiB,EAAE,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAKvJ,OAAO,EACL,uBAAuB,EAAE,iBAAiB,EAAE,0BAA0B,EACtE,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,2BAA2B,EAAE,cAAc,EAAE,yBAAyB,EAAE,4BAA4B,EAAE,KAAK,qBAAqB,EAAE,8BAA8B,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,kCAAkC,EAAE,KAAK,+BAA+B,EAAE,KAAK,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AACzX,OAAO,EAAE,oCAAoC,EAAE,iCAAiC,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AACrJ,OAAO,EACL,yCAAyC,EACzC,sCAAsC,EACtC,qCAAqC,EACrC,qCAAqC,EACrC,KAAK,0CAA0C,GAChD,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,2CAA2C,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC5H,OAAO,EACL,qCAAqC,EACrC,4CAA4C,EAC5C,wCAAwC,EACxC,wCAAwC,EACxC,KAAK,yCAAyC,EAC9C,KAAK,gDAAgD,EACrD,KAAK,sCAAsC,EAC3C,KAAK,iCAAiC,EACtC,KAAK,kBAAkB,GACxB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,qCAAqC,EACrC,qCAAqC,EACrC,6BAA6B,EAC7B,8BAA8B,EAC9B,KAAK,yCAAyC,EAC9C,KAAK,yCAAyC,EAC9C,KAAK,2BAA2B,EAChC,KAAK,+BAA+B,EACpC,KAAK,0BAA0B,EAC/B,KAAK,8BAA8B,EACnC,KAAK,yBAAyB,EAC9B,KAAK,gCAAgC,GACtC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,sBAAsB,CAAC;AAC9B,OAAO,eAAe,CAAC;AAIvB,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,sBAAsB,EAAE,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,KAAK,gBAAgB,EAAE,KAAK,eAAe,EAAE,KAAK,aAAa,EAAE,KAAK,eAAe,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAQjQ,OAAO,EACL,qBAAqB,EAAE,0BAA0B,EACjD,0BAA0B,EAAE,2BAA2B,EACvD,KAAK,iBAAiB,EAAE,KAAK,sBAAsB,EAAE,KAAK,gBAAgB,EAAE,KAAK,SAAS,GAC3F,MAAM,yBAAyB,CAAC;AAYjC,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAErF,OAAO,EAAE,6BAA6B,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,oBAAoB,EAAE,KAAK,sBAAsB,EAAE,KAAK,8BAA8B,EAAE,KAAK,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAG7P,OAAO,EAAE,iCAAiC,EAAE,0BAA0B,EAAE,6BAA6B,EAAE,yBAAyB,EAAE,kCAAkC,EAAE,KAAK,2BAA2B,EAAE,KAAK,yBAAyB,EAAE,KAAK,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAE/S,cAAc,4BAA4B,CAAC;AAE3C,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,KAAK,oBAAoB,EAAE,KAAK,uBAAuB,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/index.js

@@ -4,13 +4,13 @@ export { parsePlatformSupervisorAuthorityRequest } from "./platform-supervisor.j
 export { AUTH_CALLOUT_SUBJECT, createCalloutAuth, startAuthCallout, } from "./callout.js";
 export { validateUserToken, assertCredentialIdClaim, USER_TOKEN_VER, MAX_TOKEN_TTL_SEC, USER_TOKEN_VIEWS, PUBLIC_EXCHANGE_VIEWS, VIEW_REQUIRED_SCOPE, } from "./token.js";
 export { USER_TOKEN_ALG, createUserTokenIssuer, generateSigningKey, exportSigningKey, importSigningKey, pinnedJwksResolver, } from "./issuer.js";
-export { createIdpBridge, verifyIdpToken, verifyToolResultHumanProof, } from "./idp.js";
+export { createIdpBridge, verifyIdpToken, verifyToolResultHumanProof, verifyDmReaderProof, DM_READER_PURPOSE, } from "./idp.js";
 export { CATALOG_FRESH_MS, deviceLogin, establishIdpSession, fetchIdpJwt, revokeIdpSession, loadIdpSession, hasIdpSessions, saveIdpSession, deleteIdpSession, deleteIdpSpaceCatalog, hasIdpSpaceCatalog, prepareIdpSpaceCatalogs, requireIdpSession, normalizeIdpUrl, probeIdpJwks, } from "./login.js";
 export { calloutPermissions } from "./permissions.js";
 export { USER_AUTH_TRUST_SCHEME, userAuthTrustFingerprint, validateRetainedManagedAgent, } from "./continuity.js";
 export { AUTH_PROVIDER_NAME, authCalloutKey, authInstanceKey, authIssuerKey, authOwnerSecretKey, authServiceKeysKey, clearAuthServiceInfo, ensureCalloutAuth, ensureIssuer, ensureOwnerSecret, ensurePinnedIdp, loadAuthServiceInfo, loadCalloutAuth, loadIssuer, loadOwnerSecret, loadPinnedIdp, loadServiceKeys, saveAuthServiceInfo, saveServiceKeys, spaceIssuer, } from "./store.js";
 export { actorLedgerDir, managedActorLedgerDir, findInteractiveActor, findManagedActor, findActorUnified, grantActor, grantManagedActor, ledgerAclResolver, ledgerActorSourceIsLive, ledgerAuthorizeConnect, ledgerAuthorizeGrant, ledgerAuthorizeAgentExchange, ledgerRowFilename, loadActorLedger, revokeActor, revokeManagedActor, newActorToken, hashActorToken, AGENT_BEARER_TTL_SEC, } from "./ledger.js";
-export { runAuthService, startAuthService, openAuthAuthorityPlane, dispatchManagerAuthorityRequest, handleManagerServiceAuthority, handleToolResultHumanProof, TOOL_RESULT_HUMAN_PROOF_PATH, handleToolResultConsent, TOOL_RESULT_CONSENT_PATH, JWKS_MAX_AGE_SEC, INTERACTIVE_RETIRE_PATH, MANAGED_RETIRE_PATH, VERIFY_ENROLLMENT_PATH, composeUserBundle, finalizeUserBundleEndpoint, checkAdvertisedServer, checkAgentProvisioningUrl } from "./service.js";
+export { runAuthService, startAuthService, openAuthAuthorityPlane, dispatchManagerAuthorityRequest, handleManagerServiceAuthority, handleToolResultHumanProof, TOOL_RESULT_HUMAN_PROOF_PATH, handleToolResultConsent, TOOL_RESULT_CONSENT_PATH, JWKS_MAX_AGE_SEC, INTERACTIVE_RETIRE_PATH, CHAT_SESSION_PATHS, MANAGED_RETIRE_PATH, VERIFY_ENROLLMENT_PATH, composeUserBundle, finalizeUserBundleEndpoint, checkAdvertisedServer, checkAgentProvisioningUrl } from "./service.js";
 export { remoteManagerIssuerGrants } from "./authority-client.js";
 export { PLANE_CLAIM_REFUSED, PLANE_CLAIM_KEY, readPlaneClaim, planeClaimRefusal } from "./plane-claim.js";
 // The R1 connect-arm deny-new READ seam (SPEC 13.1): the reader grant builder, the sealed
@@ -25,6 +25,7 @@ export { parseRemoteManagerAdminAuthorizationRequest, authorizeRemoteManagerAdmi
 export { authorizeRemoteManagedAgentEnrollment, authorizeRemoteManagedAgentPrepareRetirement, authorizeRemoteManagedAgentRuntimeCreate, authorizeRemoteManagedAgentRuntimeStatus, } from "./managed-agent-enrollment.js";
 export { authorizeDelegatedUserIntentAdmission, authorizeDelegatedUserIntentExecution, delegatedUserIntentHoldsAlias, joinOrStartDelegatedUserIntent, } from "./delegated-user-intent.js";
 export { cotalAuthProvider } from "./provider.js"; // self-registers the "auth-provider" extension
+import "./service-adapter.js"; // self-registers the native auth service preset and child
 import "./commands.js"; // self-registers `login` / `logout` / `actor` / `auth-service` into the core Registry
 // NB: writeEndpointGate (the D14 endpoint-registration stand-in) is deliberately NOT
 // re-exported here (import it directly from the module in smokes/provisioning). The public

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAC/F,OAAO,EAAE,oCAAoC,EAA+B,MAAM,uBAAuB,CAAC;AAC1G,OAAO,EAAE,uCAAuC,EAA4G,MAAM,0BAA0B,CAAC;AAE7L,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,GAMjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,mBAAmB,GAMpB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,GAOnB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,eAAe,EACf,cAAc,EACd,0BAA0B,GAQ3B,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,YAAY,GAIb,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAA2C,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,UAAU,EACV,eAAe,EACf,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,WAAW,GAIZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,4BAA4B,EAC5B,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,oBAAoB,GAGrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAA2E,sBAAsB,EAAE,+BAA+B,EAAE,6BAA6B,EAAmC,0BAA0B,EAAgC,4BAA4B,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,yBAAyB,EAA2B,MAAM,cAAc,CAAC;AAC/lB,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,cAAc,EAAE,iBAAiB,EAA8C,MAAM,kBAAkB,CAAC;AACvJ,0FAA0F;AAC1F,8FAA8F;AAC9F,mFAAmF;AACnF,8FAA8F;AAC9F,OAAO,EACL,uBAAuB,EAAE,iBAAiB,EAAE,0BAA0B,GAEvE,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,2BAA2B,EAAE,cAAc,EAAE,yBAAyB,EAAE,4BAA4B,EAA8B,8BAA8B,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,kCAAkC,EAAgE,MAAM,wBAAwB,CAAC;AACzX,OAAO,EAAE,oCAAoC,EAAE,iCAAiC,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AACrJ,OAAO,EACL,yCAAyC,EACzC,sCAAsC,EACtC,qCAAqC,EACrC,qCAAqC,GAEtC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,2CAA2C,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC5H,OAAO,EACL,qCAAqC,EACrC,4CAA4C,EAC5C,wCAAwC,EACxC,wCAAwC,GAMzC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,qCAAqC,EACrC,qCAAqC,EACrC,6BAA6B,EAC7B,8BAA8B,GAS/B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC,CAAC,+CAA+C;AAClG,OAAO,eAAe,CAAC,CAAC,sFAAsF;AAC9G,qFAAqF;AACrF,2FAA2F;AAC3F,oDAAoD;AACpD,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,sBAAsB,EAAE,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAA6G,MAAM,qBAAqB,CAAC;AACjQ,6FAA6F;AAC7F,sFAAsF;AACtF,6FAA6F;AAC7F,uFAAuF;AACvF,4FAA4F;AAC5F,qFAAqF;AACrF,8DAA8D;AAC9D,OAAO,EACL,qBAAqB,EAAE,0BAA0B,EACjD,0BAA0B,EAAE,2BAA2B,GAExD,MAAM,yBAAyB,CAAC;AAcjC,OAAO,EAAE,6BAA6B,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,oBAAoB,EAAoG,MAAM,0BAA0B,CAAC;AAE7P,yFAAyF;AACzF,OAAO,EAAE,iCAAiC,EAAE,0BAA0B,EAAE,6BAA6B,EAAE,yBAAyB,EAAE,kCAAkC,EAAoG,MAAM,gCAAgC,CAAC;AAE/S,cAAc,4BAA4B,CAAC;AAE3C,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAA2D,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAC/F,OAAO,EAAE,oCAAoC,EAA+B,MAAM,uBAAuB,CAAC;AAC1G,OAAO,EAAE,uCAAuC,EAA4G,MAAM,0BAA0B,CAAC;AAE7L,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,GAMjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,mBAAmB,GAMpB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,GAOnB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,eAAe,EACf,cAAc,EACd,0BAA0B,EAC1B,mBAAmB,EACnB,iBAAiB,GAQlB,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,YAAY,GAIb,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAA2C,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,UAAU,EACV,eAAe,EACf,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,WAAW,GAIZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,4BAA4B,EAC5B,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,oBAAoB,GAGrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAA+I,sBAAsB,EAAE,+BAA+B,EAAE,6BAA6B,EAAmC,0BAA0B,EAAgC,4BAA4B,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,yBAAyB,EAA2B,MAAM,cAAc,CAAC;AACvrB,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,cAAc,EAAE,iBAAiB,EAA8C,MAAM,kBAAkB,CAAC;AACvJ,0FAA0F;AAC1F,8FAA8F;AAC9F,mFAAmF;AACnF,8FAA8F;AAC9F,OAAO,EACL,uBAAuB,EAAE,iBAAiB,EAAE,0BAA0B,GAEvE,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,2BAA2B,EAAE,cAAc,EAAE,yBAAyB,EAAE,4BAA4B,EAA8B,8BAA8B,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,kCAAkC,EAAgE,MAAM,wBAAwB,CAAC;AACzX,OAAO,EAAE,oCAAoC,EAAE,iCAAiC,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AACrJ,OAAO,EACL,yCAAyC,EACzC,sCAAsC,EACtC,qCAAqC,EACrC,qCAAqC,GAEtC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,2CAA2C,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC5H,OAAO,EACL,qCAAqC,EACrC,4CAA4C,EAC5C,wCAAwC,EACxC,wCAAwC,GAMzC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,qCAAqC,EACrC,qCAAqC,EACrC,6BAA6B,EAC7B,8BAA8B,GAS/B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC,CAAC,+CAA+C;AAClG,OAAO,sBAAsB,CAAC,CAAC,0DAA0D;AACzF,OAAO,eAAe,CAAC,CAAC,sFAAsF;AAC9G,qFAAqF;AACrF,2FAA2F;AAC3F,oDAAoD;AACpD,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,sBAAsB,EAAE,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAA6G,MAAM,qBAAqB,CAAC;AACjQ,6FAA6F;AAC7F,sFAAsF;AACtF,6FAA6F;AAC7F,uFAAuF;AACvF,4FAA4F;AAC5F,qFAAqF;AACrF,8DAA8D;AAC9D,OAAO,EACL,qBAAqB,EAAE,0BAA0B,EACjD,0BAA0B,EAAE,2BAA2B,GAExD,MAAM,yBAAyB,CAAC;AAcjC,OAAO,EAAE,6BAA6B,EAAE,6BAA6B,EAAE,2BAA2B,EAAE,oBAAoB,EAAoG,MAAM,0BAA0B,CAAC;AAE7P,yFAAyF;AACzF,OAAO,EAAE,iCAAiC,EAAE,0BAA0B,EAAE,6BAA6B,EAAE,yBAAyB,EAAE,kCAAkC,EAAoG,MAAM,gCAAgC,CAAC;AAE/S,cAAc,4BAA4B,CAAC;AAE3C,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAA2D,MAAM,sBAAsB,CAAC"}

package/dist/ledger.d.ts

@@ -1,4 +1,4 @@
-import { type IssuedSourceRef } from "@cotal-ai/core";
+import { type IssuedSourceRef, type ManagedGrantCustody } from "@cotal-ai/core";
 import type { ActorGrant } from "./idp.js";
 import type { ValidatedUserToken } from "./token.js";
 import type { AclResolver } from "./permissions.js";
@@ -50,6 +50,13 @@ export interface ActorRow {
      *  next mint can never name the successor's broker resources. Absent on legacy/interactive rows:
      *  the callout refuses to mint agent creds without one (the v0.4 hard cut). */
     lifecycleUid?: string;
+    /** Who holds this managed lifecycle, recorded by the writer that granted it: a manager on this
+     *  host attesting its own logical instance id, the auth service enrolling for an authenticated
+     *  remote manager, or a foreground spawn with no manager. REQUIRED on every managed row written
+     *  by this version, REFUSED on an interactive row. A managed row written before this field
+     *  existed reads with it absent; a reader that needs the binding must refuse such a row rather
+     *  than infer one. */
+    custody?: ManagedGrantCustody;
     /** ISO timestamp of the grant (audit). */
     grantedAt: string;
 }
@@ -88,11 +95,16 @@ export declare function grantActor(dir: string, row: Omit<ActorRow, "grantedAt">
  *  ({@link ledgerAuthorizeAgentExchange}) — so narrowing or revoking a spawner bites its agents at
  *  their next refresh (≤ {@link AGENT_BEARER_TTL_SEC}s), instead of leaving them orphaned. */
 export declare function assertWithinSpawnerGrant(dir: string, row: Pick<ActorRow, "owner" | "actor" | "scope" | "allowSubscribe" | "allowPublish" | "parent" | "role">, boundary: "spawn" | "exchange"): void;
-/** Author a MANAGED-AGENT row (spawn path only): the same upsert semantics, in the managed space,
- *  with the secret hash REQUIRED — and never shadowing an interactive row. */
-export declare function grantManagedActor(dir: string, row: Omit<ActorRow, "grantedAt"> & {
+/** The managed-row input: every grant field plus the REQUIRED secret hash and custody. */
+export type ManagedGrantInput = Omit<ActorRow, "grantedAt" | "custody"> & {
     tokenHash: string;
-}): ActorRow;
+    custody: ManagedGrantCustody;
+};
+/** Author a MANAGED-AGENT row (spawn path only): the same upsert semantics, in the managed space,
+ *  with the secret hash and custody REQUIRED — and never shadowing an interactive row. Takes the
+ *  managed-grant lock for this one write; a caller that must decide on a read first uses
+ *  {@link withManagedGrantTransaction} instead. */
+export declare function grantManagedActor(dir: string, row: ManagedGrantInput): ActorRow;
 /** Revoke a row in one space. Returns false when there was nothing to revoke. NOTE: this stops NEW
  *  bearer mints and NEW connects immediately (both boundaries read fresh); an ALREADY-LIVE
  *  connection dies at its bearer-bound JWT expiry — live eviction is the D5 lever, not the ledger's. */
@@ -101,6 +113,47 @@ export declare function revokeManagedActor(dir: string, owner: string, actor: st
 /** Revoke a managed row only while it still names `lifecycleUid`: a caller releasing one lifecycle
  *  must never remove the grant a same-name successor holds. */
 export declare function revokeManagedActorAt(dir: string, owner: string, actor: string, lifecycleUid: string): boolean;
+/** The outcome of a custody-pinned revoke. Only `revoked` removed a row. */
+export type ManagedRevokeIfResult = "revoked" | "absent" | "superseded" | "custody-mismatch";
+/** Revoke a managed row only while it still names BOTH `lifecycleUid` and exactly `custody`, read
+ *  under the managed-grant lock. A row at another uid is a successor (`superseded`); a row at the
+ *  same uid with another custody, or with none, is not this caller's (`custody-mismatch`). */
+export declare function revokeManagedActorIf(dir: string, owner: string, actor: string, expected: {
+    lifecycleUid: string;
+    custody: ManagedGrantCustody;
+}): ManagedRevokeIfResult;
+/** The ledger operations a transaction body may perform. Every one runs under the lock the
+ *  transaction holds. The object is valid only while its body runs: once the body returns or
+ *  throws, every method refuses. It cannot be constructed outside {@link withManagedGrantTransaction}. */
+export interface ManagedGrantTransaction {
+    /** The unified fresh read: interactive or managed row, or undefined. Same fail-closed rules as
+     *  {@link findActorUnified}. */
+    read(owner: string, actor: string): (ActorRow & {
+        kind: ActorKind;
+    }) | undefined;
+    grantManaged(row: ManagedGrantInput): ActorRow;
+    grantInteractive(row: Omit<ActorRow, "grantedAt">): ActorRow;
+    revokeInteractive(owner: string, actor: string): boolean;
+    revokeManaged(owner: string, actor: string): boolean;
+    revokeManagedAt(owner: string, actor: string, lifecycleUid: string): boolean;
+    revokeManagedIf(owner: string, actor: string, expected: {
+        lifecycleUid: string;
+        custody: ManagedGrantCustody;
+    }): ManagedRevokeIfResult;
+}
+/**
+ * Run one synchronous read-decide-write over the actor ledger under the managed-grant lock,
+ * taken exactly once. This is a CALLER CONTRACT, not a sandbox:
+ *
+ *  - The body MUST be synchronous: ledger reads, the decision, and ledger writes only. Async work
+ *    (callout loading, broker provisioning, footprint removal) runs before or after it.
+ *  - A body that returns a thenable is refused once it returns: the lock is released and the
+ *    transaction is closed. That cannot undo or cancel anything the body already started, so it is
+ *    a refusal, never a rollback.
+ *  - A second transaction on the same `dir` from inside a body, in this process, throws instead of
+ *    waiting on its own lock. There is no reentry and no "already locked" option.
+ */
+export declare function withManagedGrantTransaction<T>(dir: string, body: (tx: ManagedGrantTransaction) => T): T;
 /** The IdP bridge's `authorizeActor` hook (bearer-MINT boundary) — INTERACTIVE rows only, by
  *  construction. A name that exists only as a managed agent gets the exact managed-path answer
  *  (never "not granted", which would read as a permissions problem, and never a mint). */

package/dist/ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ledger.d.ts","sourceRoot":"","sources":["../src/ledger.ts"],"names":[],"mappings":"AAsCA,OAAO,EAUL,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAMpD,gGAAgG;AAChG,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,eAAe,CAAC;AAExD,sFAAsF;AACtF,MAAM,WAAW,QAAQ;IACvB,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd,8CAA8C;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd;4GACwG;IACxG,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;;;;;;;;;;;;4FAcwF;IACxF,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB;;qCAEiC;IACjC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,wEAAwE;IACxE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oGAAoG;IACpG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;mEAC+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;mFAE+E;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;mFAI+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;CACnB;AA0DD;;qCAEqC;AACrC,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,KAAK,CAAC,QAAQ,GAAG;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC,CAmBlF;AAgBD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAEpG;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAEhG;AAED;;gGAEgG;AAChG,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,CAAC,QAAQ,GAAG;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC,GAAG,SAAS,CAUxH;AAoCD;;;;;;;;;;gCAUgC;AAChC,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAuBlF;AAED;;;;;;;8FAO8F;AAC9F,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,gBAAgB,GAAG,cAAc,GAAG,QAAQ,GAAG,MAAM,CAAC,EACxG,QAAQ,EAAE,OAAO,GAAG,UAAU,GAC7B,IAAI,CA+DN;AAsBD;8EAC8E;AAC9E,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,QAAQ,CAqBjH;AAED;;wGAEwG;AACxG,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAE9E;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAErF;AAED;+DAC+D;AAC/D,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAG7G;AASD;;0FAE0F;AAC1F,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,UAAU,CA6B9F;AAED;;;yCAGyC;AACzC,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,kBAAkB,KAAK,IAAI,CAsBnF;AAED;;;oCAGoC;AACpC,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,CAkC1D;AAED;;;mDAGmD;AACnD,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,eAAe,KAAK,OAAO,CAMzF;AAED;mFACmF;AACnF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAItE;AAED,mFAAmF;AACnF,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,uDAAuD;AACvD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;gGAEgG;AAChG,eAAO,MAAM,oBAAoB,MAAM,CAAC;AAExC,mGAAmG;AACnG,wBAAgB,aAAa,IAAI;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAGzE;AAED,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;;;uDAIuD;AACvD,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,GACjB;IACD,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CA4BA"}
+{"version":3,"file":"ledger.d.ts","sourceRoot":"","sources":["../src/ledger.ts"],"names":[],"mappings":"AAsCA,OAAO,EAaL,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACzB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAMpD,gGAAgG;AAChG,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,eAAe,CAAC;AAExD,sFAAsF;AACtF,MAAM,WAAW,QAAQ;IACvB,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd,8CAA8C;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd;4GACwG;IACxG,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;;;;;;;;;;;;4FAcwF;IACxF,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB;;qCAEiC;IACjC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,wEAAwE;IACxE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oGAAoG;IACpG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;mEAC+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;mFAE+E;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;mFAI+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;0BAKsB;IACtB,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAC9B,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;CACnB;AAgED;;qCAEqC;AACrC,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,KAAK,CAAC,QAAQ,GAAG;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC,CAmBlF;AAgBD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAEpG;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAEhG;AAED;;gGAEgG;AAChG,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,CAAC,QAAQ,GAAG;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC,GAAG,SAAS,CAiBxH;AA4CD;;;;;;;;;;gCAUgC;AAChC,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAElF;AA8BD;;;;;;;8FAO8F;AAC9F,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,gBAAgB,GAAG,cAAc,GAAG,QAAQ,GAAG,MAAM,CAAC,EACxG,QAAQ,EAAE,OAAO,GAAG,UAAU,GAC7B,IAAI,CA+DN;AAsBD,0FAA0F;AAC1F,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,GAAG,SAAS,CAAC,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,mBAAmB,CAAA;CAAE,CAAC;AAE9H;;;mDAGmD;AACnD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,iBAAiB,GAAG,QAAQ,CAE/E;AA6BD;;wGAEwG;AACxG,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAE9E;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAErF;AAED;+DAC+D;AAC/D,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAE7G;AAED,4EAA4E;AAC5E,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,QAAQ,GAAG,YAAY,GAAG,kBAAkB,CAAC;AAE7F;;8FAE8F;AAC9F,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,mBAAmB,CAAA;CAAE,GAAG,qBAAqB,CAEvK;AA6BD;;0GAE0G;AAC1G,MAAM,WAAW,uBAAuB;IACtC;oCACgC;IAChC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,CAAC,QAAQ,GAAG;QAAE,IAAI,EAAE,SAAS,CAAA;KAAE,CAAC,GAAG,SAAS,CAAC;IACjF,YAAY,CAAC,GAAG,EAAE,iBAAiB,GAAG,QAAQ,CAAC;IAC/C,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC;IAC7D,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IACzD,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IACrD,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;IAC7E,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,mBAAmB,CAAA;KAAE,GAAG,qBAAqB,CAAC;CACxI;AAMD;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,uBAAuB,KAAK,CAAC,GAAG,CAAC,CAiCvG;AAED;;0FAE0F;AAC1F,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,UAAU,CAgC9F;AAED;;;yCAGyC;AACzC,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,kBAAkB,KAAK,IAAI,CAsBnF;AAED;;;oCAGoC;AACpC,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,CAkC1D;AAED;;;mDAGmD;AACnD,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,eAAe,KAAK,OAAO,CAMzF;AAED;mFACmF;AACnF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAItE;AAED,mFAAmF;AACnF,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,uDAAuD;AACvD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;gGAEgG;AAChG,eAAO,MAAM,oBAAoB,MAAM,CAAC;AAExC,mGAAmG;AACnG,wBAAgB,aAAa,IAAI;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAGzE;AAED,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;;;uDAIuD;AACvD,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,GACjB;IACD,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CA+BA"}