@cotal-ai/auth 0.90.1 → 0.92.0

package/dist/authority-client.d.ts

@@ -27,9 +27,14 @@
 import { type NatsConnection } from "@nats-io/transport-node";
 import { remoteManagerRegistrationProof, type EpCaller, type PlaneConnTuple } from "@cotal-ai/core";
 import { type ConnectReader } from "./connect-reader.js";
+import type { ServiceWriteScope } from "./service-write.js";
 /** Self-minted infra-credential TTL (fact-3 pin: SHORT expiry + in-process renewal, a bounded
  *  in-memory credential that closes with the service — never an unbounded persisted one). */
 export declare const AUTHORITY_CLIENT_TTL_SEC: number;
+/** The longest window one service host effect credential covers: one service host invocation. */
+export declare const SERVICE_HOST_INVOCATION_MS = 60000;
+/** The fixed CONNZ name of every service host effect connection in `space`. */
+export declare const serviceHostEffectLabel: (space: string) => string;
 /** Only the auth mint writer records consents. Derived host writers use the shared base without it. */
 export declare function authorityWriterGrants(space: string, connId: string): {
     publish: string[];
@@ -65,6 +70,8 @@ export declare function platformReadinessGrants(space: string, connId: string, c
  *  The issuing host reads them and never replies: the broker let only the caller's ceiling publish
  *  each one, so observing it is the host's own evidence that the caller asked. */
 export declare function servedRunRequestSubjects(space: string): string[];
+/** Cancellation observes only the issued untargeted exact-instance rail. */
+export declare function servedRunCancelRequestSubject(space: string): string;
 export { remoteManagerRegistrationProof };
 /**
  * The registration executor grant for one instance of an endpoint the AUTH PLANE self-authorizes
@@ -141,6 +148,47 @@ export declare function authorityBarrierGrants(space: string, connId: string): {
 export declare function barrierExecutorSettlementGrants(space: string, endpoint: string, pools: string[]): {
     publish: string[];
 };
+/** The SERVICE HOST DISCOVERY reader: `STREAM.INFO` and leader-served `STREAM.MSG.GET` on both
+ *  authority KV streams, and its own inbox. It publishes no `$KV` subject at all.
+ *
+ *  Named residual: `MSG.GET` is body-selected, so its reads are stream-wide on both stores. The
+ *  same reads ride every effect credential; write confinement is exact-key, read confinement is
+ *  not offered. */
+export declare function serviceHostDiscoveryGrants(space: string, connId: string): {
+    publish: string[];
+    subscribe: string[];
+};
+/** One service host invocation's EFFECT credential: the discovery reads, plus a `$KV` publish on
+ *  exactly each key of `keys` and on exactly one more token under each auth family (a root
+ *  credential id minted during the write). No key carries a wildcard, so the grant's subjects can
+ *  never be wider than the scope the engine guards every write with.
+ *
+ *  Named residual: this is publish-subject confinement only. Broker permissions do not restrict
+ *  what a publish on a granted subject does; the engine's own writes are only creates and
+ *  exact-revision CASes. */
+export declare function serviceHostEffectGrants(space: string, connId: string, keys: ServiceWriteScope, reads?: ServiceHostEffectReads): {
+    publish: string[];
+    subscribe: string[];
+};
+/** What a serving effect reads and publishes beyond its writes: exact records keys, granted by
+ *  Direct Get, and exact contract artifacts it publishes create-only and reads back after a lost
+ *  create. The registry's KV handles are bound without Direct Get, so their reads of those records
+ *  keys are leader message gets (`STREAM.MSG.GET` last by subject) under the base grant. */
+export interface ServiceHostEffectReads {
+    readonly records: readonly string[];
+    readonly contract: readonly string[];
+}
+/** The SERVICE CALLOUT writer: the base writer, plus the endpoint gate and endpoint credential
+ *  families a native service connection's mint stages and touches.
+ *
+ *  Named residual: a broker ACL cannot confine one endpoint-token key family to service
+ *  assignments, so these families also cover native control endpoints' rows. The native service
+ *  mint writes only the bearer's own assignment rows, and every service gate parse refuses another
+ *  authority family. */
+export declare function serviceCalloutWriterGrants(space: string, connId: string): {
+    publish: string[];
+    subscribe: string[];
+};
 export interface AuthorityClientOpts {
     /** Package-internal connection custody for an embedded auth context. */
     onConnection?: (nc: NatsConnection, label: string) => void;
@@ -211,6 +259,24 @@ export interface AuthorityClientOpts {
      * A copied JWT plus identity seed loses the old 900-second leak bound: it remains usable
      * until signing-key removal. Service stop closes owned sockets, not an exfiltrated copy. */
     toolResultCustody?: boolean;
+    /** One service host invocation's effect connection only: label {@link serviceHostEffectLabel},
+     *  `noReconnect` required, never a plane, custody or renewing profile. `deadlineMs` is the
+     *  invocation's ORIGINAL deadline: a safe integer after now and at most
+     *  {@link SERVICE_HOST_INVOCATION_MS} ahead. The credential's one fixed `exp` is
+     *  `ceil(deadlineMs / 1000)` whole seconds, so `exp * 1000` is never earlier than that deadline;
+     *  it is never renewed, the connect is bounded by the remaining window, and {@link AuthorityClient.gone}
+     *  resolves when the connection is gone.
+     *
+     *  Broker granularity, disclosed: nats-server checks `exp` in whole seconds against its own clock,
+     *  refuses a connect once its current second is past `exp`, and arms one whole-second timer at
+     *  connect to close a live connection. With a broker clock that agrees with this process's and
+     *  timely broker and client scheduling, that timer fires inside the second after `exp`, up to
+     *  about `deadlineMs + 1999` ms (observed on 2.12.12 and 2.14.0). That is timer granularity, not a
+     *  guaranteed close time: a skewed clock or a paused or late broker or client moves the close
+     *  either way. No close, at any time, proves that an earlier write cannot still settle. */
+    serviceHostInvocation?: {
+        deadlineMs: number;
+    };
 }
 export interface AuthorityClient {
     nc: NatsConnection;
@@ -222,9 +288,10 @@ export interface AuthorityClient {
     /** planeCandidate only: this connection's broker identity, captured from the protocol INFO at
      *  connect — what the plane claim row pins ({@link PlaneConnTuple}). */
     tuple?: PlaneConnTuple;
-    /** planeCandidate only: resolves when the NON-RECONNECTING connection is permanently gone (the
-     *  plane's fencing signal — close() also resolves it; the composition's `closing` flag tells a
-     *  deliberate teardown from a mid-life death). */
+    /** planeCandidate and serviceHostInvocation only: resolves when the NON-RECONNECTING connection
+     *  is permanently gone (the plane's fencing signal and the invocation's latch — close() also
+     *  resolves it; the composition's `closing` flag tells a deliberate teardown from a mid-life
+     *  death). */
     gone?: Promise<void>;
     close(): Promise<void>;
 }

package/dist/authority-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authority-client.d.ts","sourceRoot":"","sources":["../src/authority-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAGzF,OAAO,EAAyQ,8BAA8B,EAAiO,KAAK,QAAQ,EAAE,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC1kB,OAAO,EAA8C,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGrG;6FAC6F;AAC7F,eAAO,MAAM,wBAAwB,QAAU,CAAC;AAoDhD,uGAAuG;AACvG,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAG/G;AAED;gEACgE;AAChE,wBAAgB,uCAAuC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAWjI;AAED,oGAAoG;AACpG,wBAAgB,sCAAsC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAKhI;AAED;;qEAEqE;AACrE,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CA8BnH;AAED;;yFAEyF;AACzF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CASvJ;AAED;;;kFAGkF;AAClF,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAShE;AAED,OAAO,EAAE,8BAA8B,EAAE,CAAC;AAE1C;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAqC1J;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CA6DhH;AAED;;;;;;;;;;;;;;;;;;;;iGAoBiG;AACjG,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAcvH;AAED,MAAM,WAAW,mBAAmB;IAClC,wEAAwE;IACxE,YAAY,CAAC,EAAE,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,mGAAmG;IACnG,KAAK,EAAE,MAAM,CAAC;IACd;mDAC+C;IAC/C,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACvE;;;;2GAIuG;IACvG,SAAS,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B;;qDAEiD;IACjD,gBAAgB,CAAC,EAAE,MAAM,IAAI,CAAC;IAC9B;;8DAE0D;IAC1D,YAAY,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACtD;;;;;;;;kFAQ8E;IAC9E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;;;;;;;;kGAc8F;IAC9F,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;gGAI4F;IAC5F,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,cAAc,CAAC;IACnB,wFAAwF;IACxF,MAAM,EAAE,MAAM,CAAC;IACf;oFACgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;4EACwE;IACxE,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB;;sDAEkD;IAClD,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACrB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,eAAe,CAAC,CA4E7F;AAED,MAAM,WAAW,uBAAuB;IACtC;;8CAE0C;IAC1C,OAAO,IAAI,aAAa,CAAC;IACzB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,IAAI,CAAC,mBAAmB,EAAE,QAAQ,GAAG,OAAO,CAAC,GAClD,OAAO,CAAC,uBAAuB,CAAC,CA0DlC"}
+{"version":3,"file":"authority-client.d.ts","sourceRoot":"","sources":["../src/authority-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAGzF,OAAO,EAAyQ,8BAA8B,EAAiO,KAAK,QAAQ,EAAE,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAE1kB,OAAO,EAA8C,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAErG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D;6FAC6F;AAC7F,eAAO,MAAM,wBAAwB,QAAU,CAAC;AAEhD,iGAAiG;AACjG,eAAO,MAAM,0BAA0B,QAAS,CAAC;AACjD,+EAA+E;AAC/E,eAAO,MAAM,sBAAsB,GAAI,OAAO,MAAM,WAAyC,CAAC;AAoD9F,uGAAuG;AACvG,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAK/G;AAED;gEACgE;AAChE,wBAAgB,uCAAuC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAWjI;AAED,oGAAoG;AACpG,wBAAgB,sCAAsC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAKhI;AAED;;qEAEqE;AACrE,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CA8BnH;AAED;;yFAEyF;AACzF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CASvJ;AAED;;;kFAGkF;AAClF,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAShE;AAED,4EAA4E;AAC5E,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,OAAO,EAAE,8BAA8B,EAAE,CAAC;AAE1C;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAqC1J;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CA6DhH;AAED;;;;;;;;;;;;;;;;;;;;iGAoBiG;AACjG,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAcvH;AAED;;;;;mBAKmB;AACnB,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAQpH;AAUD;;;;;;;4BAO4B;AAC5B,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,GAAE,sBAAwC,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAiB3L;AAED;;;4FAG4F;AAC5F,MAAM,WAAW,sBAAsB;IAAG,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE;AAGrH;;;;;;wBAMwB;AACxB,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAGpH;AAED,MAAM,WAAW,mBAAmB;IAClC,wEAAwE;IACxE,YAAY,CAAC,EAAE,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,mGAAmG;IACnG,KAAK,EAAE,MAAM,CAAC;IACd;mDAC+C;IAC/C,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACvE;;;;2GAIuG;IACvG,SAAS,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B;;qDAEiD;IACjD,gBAAgB,CAAC,EAAE,MAAM,IAAI,CAAC;IAC9B;;8DAE0D;IAC1D,YAAY,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACtD;;;;;;;;kFAQ8E;IAC9E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;;;;;;;;kGAc8F;IAC9F,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;gGAI4F;IAC5F,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;;;;;+FAc2F;IAC3F,qBAAqB,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CAChD;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,cAAc,CAAC;IACnB,wFAAwF;IACxF,MAAM,EAAE,MAAM,CAAC;IACf;oFACgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;4EACwE;IACxE,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB;;;kBAGc;IACd,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACrB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAsBD;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,eAAe,CAAC,CAoF7F;AAED,MAAM,WAAW,uBAAuB;IACtC;;8CAE0C;IAC1C,OAAO,IAAI,aAAa,CAAC;IACzB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,IAAI,CAAC,mBAAmB,EAAE,QAAQ,GAAG,OAAO,CAAC,GAClD,OAAO,CAAC,uBAAuB,CAAC,CA0DlC"}

package/dist/authority-client.js

@@ -28,11 +28,16 @@ import { connect, jwtAuthenticator } from "@nats-io/transport-node";
 import { encodeUser } from "@nats-io/jwt";
 import { fromPublic, fromSeed } from "@nats-io/nkeys";
 import { EpEnvelopeError, admissionBucket, sessionsBucket, assertInboxConnId, endpointToken, epAuthBucket, epcStreamName, epfStreamName, newIdentity, recordsBucket, retirementFrontierStreams, spacePrefix, assertPoolToken, principalTags, principalKey, remoteManagerActors, remoteManagerRegistrationProof, assertLifecycleToken, epcredFamilyPrefix, epgateKey, eprepairKey, GOVERN_HEAD, RECORD_KINDS, recordAtomicKey, recordSpecKey, recordStatusKey, BASELINE_LIFECYCLE_ENDPOINT, epCallerGrantRows, instanceOnlyManagerCapabilities } from "@cotal-ai/core";
+import { chatAuthorityWriteSubjects } from "./chat-session-store.js";
 import { authConnectReaderGrants, openConnectReader } from "./connect-reader.js";
 import { environmentManagerAdmissionIndexBucket } from "./environment-manager-admission-index.js";
 /** Self-minted infra-credential TTL (fact-3 pin: SHORT expiry + in-process renewal, a bounded
  *  in-memory credential that closes with the service — never an unbounded persisted one). */
 export const AUTHORITY_CLIENT_TTL_SEC = 15 * 60;
+/** The longest window one service host effect credential covers: one service host invocation. */
+export const SERVICE_HOST_INVOCATION_MS = 60_000;
+/** The fixed CONNZ name of every service host effect connection in `space`. */
+export const serviceHostEffectLabel = (space) => `cotal:service-host-effect:${space}`;
 /**
  * The MINT WRITER's scoped credential grant (SPEC 13.9): the exchange-time issuance executor.
  * Exactly the store-ensure + activation-saga + root-mint surface:
@@ -85,7 +90,9 @@ function baseAuthorityWriterGrants(space, connId) {
 /** Only the auth mint writer records consents. Derived host writers use the shared base without it. */
 export function authorityWriterGrants(space, connId) {
     const base = baseAuthorityWriterGrants(space, connId);
-    return { publish: [...base.publish, `$KV.${epAuthBucket(space)}.consent.*`], subscribe: base.subscribe };
+    // Chat admission and the chat sweep run on this writer: the holder index, the owner quota and
+    // the sweep cursor, each an exact-arity family (SPEC 13.9). Derived host writers do not get them.
+    return { publish: [...base.publish, `$KV.${epAuthBucket(space)}.consent.*`, ...chatAuthorityWriteSubjects(space)], subscribe: base.subscribe };
 }
 /** Host-private environment reservation writer. It adds manager gates and multi-segment operation
  * staging, never session release pins or a guest credential. */
@@ -139,7 +146,7 @@ export function remoteManagerIssuerGrants(space, connId) {
             `$JS.API.STREAM.INFO.KV_${sessionsBucket(space)}`,
             `$JS.API.STREAM.MSG.GET.KV_${sessionsBucket(space)}`,
         ],
-        subscribe: [...base.subscribe, ...servedRunRequestSubjects(space)],
+        subscribe: [...base.subscribe, ...servedRunRequestSubjects(space), servedRunCancelRequestSubject(space)],
     };
 }
 /** The PLATFORM READINESS reader (SPEC 13.9): `describe` and `status` of one manager instance on
@@ -160,12 +167,16 @@ export function servedRunRequestSubjects(space) {
     const p = spacePrefix(space);
     const m = endpointToken("manager");
     return [
-        ...["run-start", "run-resume", "run-answer"].flatMap((c) => [`${p}.ep.v1.inst.${m}.*.${c}.>`, `${p}.ep.v1.one.${m}.${c}.>`]),
+        ...["run-start", "run-resume", "run-answer", "run-start-keyed", "run-submission-status"].flatMap((c) => [`${p}.ep.v1.inst.${m}.*.${c}.>`, `${p}.ep.v1.one.${m}.${c}.>`]),
         // A managed seat answers on the legacy rail, the relay path; nothing else served there is forwarded.
         `${p}.ep.inst.${m}.*.run-answer.>`,
         `${p}.ep.one.${m}.run-answer.>`,
     ];
 }
+/** Cancellation observes only the issued untargeted exact-instance rail. */
+export function servedRunCancelRequestSubject(space) {
+    return `${spacePrefix(space)}.ep.v1.inst.${endpointToken("manager")}.*.run-cancel.>`;
+}
 export { remoteManagerRegistrationProof };
 /**
  * The registration executor grant for one instance of an endpoint the AUTH PLANE self-authorizes
@@ -343,6 +354,89 @@ export function barrierExecutorSettlementGrants(space, endpoint, pools) {
     publish.push(`$JS.API.STREAM.MSG.GET.${epfStreamName(space)}`);
     return { publish };
 }
+/** The SERVICE HOST DISCOVERY reader: `STREAM.INFO` and leader-served `STREAM.MSG.GET` on both
+ *  authority KV streams, and its own inbox. It publishes no `$KV` subject at all.
+ *
+ *  Named residual: `MSG.GET` is body-selected, so its reads are stream-wide on both stores. The
+ *  same reads ride every effect credential; write confinement is exact-key, read confinement is
+ *  not offered. */
+export function serviceHostDiscoveryGrants(space, connId) {
+    const auth = `KV_${epAuthBucket(space)}`;
+    const records = `KV_${recordsBucket(space)}`;
+    return {
+        publish: ["$JS.API.INFO", `$JS.API.STREAM.INFO.${auth}`, `$JS.API.STREAM.INFO.${records}`,
+            `$JS.API.STREAM.MSG.GET.${auth}`, `$JS.API.STREAM.MSG.GET.${records}`],
+        subscribe: [`_INBOX_${assertInboxConnId(connId)}.>`],
+    };
+}
+const KV_KEY = /^[-/=\w]+(\.[-/=\w]+)*$/;
+const KV_FAMILY = /^([-/=\w]+\.)+$/;
+function scopeKey(pattern, key, what) {
+    if (typeof key !== "string" || !pattern.test(key))
+        throw new EpEnvelopeError("bad-request", `a service host effect grant names ${what} ${JSON.stringify(key)} that is not plain dotted key tokens`);
+    return key;
+}
+/** One service host invocation's EFFECT credential: the discovery reads, plus a `$KV` publish on
+ *  exactly each key of `keys` and on exactly one more token under each auth family (a root
+ *  credential id minted during the write). No key carries a wildcard, so the grant's subjects can
+ *  never be wider than the scope the engine guards every write with.
+ *
+ *  Named residual: this is publish-subject confinement only. Broker permissions do not restrict
+ *  what a publish on a granted subject does; the engine's own writes are only creates and
+ *  exact-revision CASes. */
+export function serviceHostEffectGrants(space, connId, keys, reads = NO_EFFECT_READS) {
+    const base = serviceHostDiscoveryGrants(space, connId);
+    const auth = epAuthBucket(space);
+    const records = recordsBucket(space);
+    const epc = epcStreamName(space), prefix = spacePrefix(space);
+    return {
+        publish: [...base.publish,
+            ...keys.records.map((k) => `$KV.${records}.${scopeKey(KV_KEY, k, "the records key")}`),
+            ...keys.auth.map((k) => `$KV.${auth}.${scopeKey(KV_KEY, k, "the auth key")}`),
+            ...keys.authFamilies.map((f) => `$KV.${auth}.${scopeKey(KV_FAMILY, f, "the auth family")}*`),
+            ...reads.records.map((k) => `$JS.API.DIRECT.GET.KV_${records}.$KV.${records}.${scopeKey(KV_KEY, k, "the records read")}`),
+            ...reads.contract.flatMap((hex) => {
+                if (!/^[0-9a-f]{64}$/.test(hex))
+                    throw new EpEnvelopeError("bad-request", "a service host effect grant names a contract artifact that is not a sha256 hex digest");
+                return [`${prefix}.epc.${hex}`, `$JS.API.DIRECT.GET.${epc}.${prefix}.epc.${hex}`];
+            })],
+        subscribe: base.subscribe,
+    };
+}
+const NO_EFFECT_READS = Object.freeze({ records: Object.freeze([]), contract: Object.freeze([]) });
+/** The SERVICE CALLOUT writer: the base writer, plus the endpoint gate and endpoint credential
+ *  families a native service connection's mint stages and touches.
+ *
+ *  Named residual: a broker ACL cannot confine one endpoint-token key family to service
+ *  assignments, so these families also cover native control endpoints' rows. The native service
+ *  mint writes only the bearer's own assignment rows, and every service gate parse refuses another
+ *  authority family. */
+export function serviceCalloutWriterGrants(space, connId) {
+    const base = baseAuthorityWriterGrants(space, connId), auth = epAuthBucket(space);
+    return { publish: [...base.publish, `$KV.${auth}.epgate.*.*`, `$KV.${auth}.epcred.*.*.*`], subscribe: base.subscribe };
+}
+function refuseServiceHostEffect(detail) {
+    throw new EpEnvelopeError("failed-precondition", `a service host effect credential ${detail}`);
+}
+/** The service host effect profile's one fixed `exp`, derived from the original deadline alone. */
+function serviceHostInvocationExpiry(opts) {
+    if (opts.label !== serviceHostEffectLabel(opts.space))
+        refuseServiceHostEffect(`requires the label ${serviceHostEffectLabel(opts.space)}`);
+    if (opts.noReconnect !== true)
+        refuseServiceHostEffect("requires noReconnect");
+    if (opts.planeCandidate || opts.toolResultCustody || opts.probeRenewal !== undefined || opts.onRenewalFailure !== undefined)
+        refuseServiceHostEffect("is never a plane, custody or renewing profile");
+    const deadlineMs = opts.serviceHostInvocation?.deadlineMs, now = Date.now();
+    if (typeof deadlineMs !== "number" || !Number.isSafeInteger(deadlineMs))
+        refuseServiceHostEffect("requires a safe-integer original deadline in milliseconds");
+    if (deadlineMs <= now || deadlineMs > now + SERVICE_HOST_INVOCATION_MS)
+        refuseServiceHostEffect(`requires an original deadline after now and at most ${SERVICE_HOST_INVOCATION_MS} ms ahead`);
+    // Whole seconds, never milliseconds: a millisecond-valued exp would pass the broker as a far-future second.
+    const exp = Math.ceil(deadlineMs / 1000);
+    if (!Number.isSafeInteger(exp) || exp * 1000 < deadlineMs || exp * 1000 - deadlineMs >= 1000)
+        refuseServiceHostEffect("has no exact whole-second expiry");
+    return { exp, deadlineMs };
+}
 /**
  * Open one self-minted data-account connection: a stable user nkey, a short-exp user JWT signed
  * by the data account's signing seed, re-minted in-process at half-life. The authenticator
@@ -352,23 +446,30 @@ export function barrierExecutorSettlementGrants(space, endpoint, pools) {
 export async function openAuthorityClient(opts) {
     if (opts.toolResultCustody && (opts.planeCandidate || !["cotal:tool-result-snapshot", "cotal:tool-result-revocation"].includes(opts.label)))
         throw new Error("tool-result custody requires its dedicated internal reader or writer profile");
+    // Checked before any identity, grant or connection exists.
+    const invocation = opts.serviceHostInvocation === undefined ? undefined : serviceHostInvocationExpiry(opts);
     const uninterrupted = Boolean(opts.planeCandidate || opts.toolResultCustody);
     const identity = newIdentity();
     const grants = opts.grants(identity.id);
     const signer = fromSeed(new TextEncoder().encode(opts.dataAccount.signingSeed));
     const mint = async () => encodeUser(opts.label, fromPublic(identity.id), fromPublic(opts.dataAccount.pub), { pub: { allow: grants.publish }, sub: { allow: grants.subscribe },
         ...(opts.principal ? { tags: principalTags(opts.principal.owner, opts.principal.actor) } : {}) }, 
-    // Plane scanners and the separate custody profile require uninterrupted identities.
-    // Every other authority connection keeps short expiry and half-life renewal.
-    uninterrupted ? { signer } : { signer, exp: Math.floor(Date.now() / 1000) + AUTHORITY_CLIENT_TTL_SEC });
+    // Plane scanners and the separate custody profile require uninterrupted identities. A
+    // service host effect expires at its invocation's original deadline. Every other authority
+    // connection keeps short expiry and half-life renewal.
+    uninterrupted ? { signer } : { signer, exp: invocation ? invocation.exp : Math.floor(Date.now() / 1000) + AUTHORITY_CLIENT_TTL_SEC });
     let currentJwt = await mint();
     const renew = async () => {
         if (opts.probeRenewal?.fail)
             throw new Error("probe-forced renewal failure");
         return mint();
     };
-    // Neither uninterrupted profile can present renewal without its forbidden reconnect.
-    const renewal = uninterrupted ? undefined : setInterval(() => {
+    // No uninterrupted profile can present renewal without its forbidden reconnect, and a service
+    // host effect never outlives its one fixed expiry.
+    const remaining = invocation ? invocation.deadlineMs - Date.now() : undefined;
+    if (remaining !== undefined && remaining <= 0)
+        refuseServiceHostEffect("its original deadline passed before the connect");
+    const renewal = uninterrupted || invocation ? undefined : setInterval(() => {
         void renew().then((jwt) => { currentJwt = jwt; }, (e) => {
             opts.log(`${opts.label}: credential renewal FAILED (${e?.message ?? String(e)}) - failing closed NOW (fail-closed renewal boundary)`);
             opts.onRenewalFailure?.();
@@ -384,6 +485,8 @@ export async function openAuthorityClient(opts) {
             // Custody, plane candidates and per-call repairs never reconnect. Other standing
             // authority connections use stock renewal/reconnect semantics.
             ...(uninterrupted || opts.noReconnect ? { reconnect: false, maxReconnectAttempts: 0 } : { maxReconnectAttempts: -1 }),
+            // A service host effect's handshake never outlasts its invocation.
+            ...(remaining !== undefined ? { timeout: remaining } : {}),
         });
     }
     catch (e) {
@@ -404,8 +507,9 @@ export async function openAuthorityClient(opts) {
             throw new EpEnvelopeError("unavailable", `${opts.label}: the broker INFO carries no usable (server_id, client_id) for the plane claim (got server_id=${JSON.stringify(info?.server_id)}, client_id=${JSON.stringify(info?.client_id)}); an ownership-bearing scanner connection must be claim-pinnable (SPEC 13.13)`);
         }
         tuple = { serverId: info.server_id, cid: info.client_id, userNkey: identity.id };
-        gone = nc.closed().then(() => undefined, () => undefined);
     }
+    if (opts.planeCandidate || invocation)
+        gone = nc.closed().then(() => undefined, () => undefined);
     return {
         nc,
         connId: identity.id,

package/dist/authority-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"authority-client.js","sourceRoot":"","sources":["../src/authority-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAuB,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,iBAAiB,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,yBAAyB,EAAE,WAAW,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAE,mBAAmB,EAAE,8BAA8B,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,eAAe,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,+BAA+B,EAAsC,MAAM,gBAAgB,CAAC;AAC1kB,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAsB,MAAM,qBAAqB,CAAC;AACrG,OAAO,EAAE,sCAAsC,EAAE,MAAM,0CAA0C,CAAC;AAElG;6FAC6F;AAC7F,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,EAAE,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,yBAAyB,CAAC,KAAa,EAAE,MAAc;IAC9D,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7C,gGAAgG;IAChG,2EAA2E;IAC3E,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO;QACL,OAAO,EAAE;YACP,cAAc;YACd,yBAAyB,IAAI,EAAE;YAC/B,yBAAyB,OAAO,EAAE;YAClC,yBAAyB,OAAO,EAAE;YAClC,uBAAuB,IAAI,EAAE;YAC7B,uBAAuB,OAAO,EAAE;YAChC,0BAA0B,IAAI,EAAE;YAChC,0BAA0B,OAAO,EAAE;YACnC,sBAAsB,OAAO,EAAE;YAC/B,sBAAsB,OAAO,IAAI;YACjC,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,UAAU;YACpC,OAAO,YAAY,CAAC,KAAK,CAAC,WAAW;YACrC,OAAO,aAAa,CAAC,KAAK,CAAC,cAAc;YACzC,OAAO,aAAa,CAAC,KAAK,CAAC,QAAQ;SACpC;QACD,SAAS,EAAE,CAAC,UAAU,KAAK,IAAI,CAAC;KACjC,CAAC;AACJ,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,MAAc;IACjE,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACtD,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,YAAY,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;AAC3G,CAAC;AAED;gEACgE;AAChE,MAAM,UAAU,uCAAuC,CAAC,KAAa,EAAE,MAAc;IACnF,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACtD,OAAO;QACL,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO;YACvB,OAAO,YAAY,CAAC,KAAK,CAAC,mBAAmB;YAC7C,OAAO,YAAY,CAAC,KAAK,CAAC,8BAA8B;YACxD,OAAO,YAAY,CAAC,KAAK,CAAC,mCAAmC;YAC7D,OAAO,YAAY,CAAC,KAAK,CAAC,qCAAqC;SAChE;QACD,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC;AACJ,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,sCAAsC,CAAC,KAAa,EAAE,MAAc;IAClF,MAAM,MAAM,GAAG,sCAAsC,CAAC,KAAK,CAAC,CAAC;IAC7D,OAAO,EAAE,OAAO,EAAE,CAAC,cAAc,EAAE,4BAA4B,MAAM,EAAE,EAAE,0BAA0B,MAAM,EAAE;YACzG,6BAA6B,MAAM,EAAE,EAAE,OAAO,MAAM,YAAY,CAAC;QACnE,SAAS,EAAE,CAAC,UAAU,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;AACzD,CAAC;AAED;;qEAEqE;AACrE,MAAM,UAAU,yBAAyB,CAAC,KAAa,EAAE,MAAc;IACrE,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;IACjD,OAAO;QACL,OAAO,EAAE;YACP,GAAG,IAAI,CAAC,OAAO;YACf,4FAA4F;YAC5F,8FAA8F;YAC9F,6FAA6F;YAC7F,4FAA4F;YAC5F,6FAA6F;YAC7F,oEAAoE;YACpE,OAAO,YAAY,CAAC,KAAK,CAAC,mBAAmB;YAC7C,OAAO,YAAY,CAAC,KAAK,CAAC,mBAAmB;YAC7C,6FAA6F;YAC7F,uFAAuF;YACvF,sBAAsB,aAAa,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,QAAQ;YACxE,sBAAsB,aAAa,CAAC,KAAK,CAAC,EAAE;YAC5C,0FAA0F;YAC1F,uBAAuB,SAAS,EAAE;YAClC,0BAA0B,SAAS,EAAE;YACrC,sBAAsB,SAAS,EAAE;YACjC,sBAAsB,SAAS,IAAI;YACnC,4FAA4F;YAC5F,2FAA2F;YAC3F,0BAA0B,cAAc,CAAC,KAAK,CAAC,EAAE;YACjD,6BAA6B,cAAc,CAAC,KAAK,CAAC,EAAE;SACrD;QACD,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;KACnE,CAAC;AACJ,CAAC;AAED;;yFAEyF;AACzF,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,MAAc,EAAE,MAAgB,EAAE,UAAkB;IACzG,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,EAAE,+BAA+B,CACnE,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,2BAA2B,EAAE,OAAO,EAAE,CAAC,CAAC,EAC7F,UAAU,CACX,EAAE,MAAM,CAAC,CAAC;IACX,OAAO;QACL,OAAO,EAAE,CAAC,sBAAsB,aAAa,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC;QAChG,SAAS,EAAE,CAAC,UAAU,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC;KAClE,CAAC;AACJ,CAAC;AAED;;;kFAGkF;AAClF,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,CAAC,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACnC,OAAO;QACL,GAAG,CAAC,WAAW,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5H,qGAAqG;QACrG,GAAG,CAAC,YAAY,CAAC,iBAAiB;QAClC,GAAG,CAAC,WAAW,CAAC,eAAe;KAChC,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,8BAA8B,EAAE,CAAC;AAE1C;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa,EAAE,MAAc,EAAE,QAAgB,EAAE,UAAkB;IAC5G,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,kBAAkB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG;QACjB,aAAa,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,oBAAoB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;QAC3F,eAAe,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,oBAAoB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;QAC7F,eAAe,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC;KACzC,CAAC;IACF,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO;QACL,OAAO,EAAE;YACP,cAAc;YACd,0BAA0B,IAAI,EAAE;YAChC,0BAA0B,OAAO,EAAE;YACnC,oGAAoG;YACpG,+FAA+F;YAC/F,+FAA+F;YAC/F,oGAAoG;YACpG,oGAAoG;YACpG,2BAA2B;YAC3B,2BAA2B,IAAI,IAAI;YACnC,yBAAyB,IAAI,IAAI;YACjC,2BAA2B,IAAI,IAAI;YACnC,sBAAsB,aAAa,CAAC,KAAK,CAAC,EAAE;YAC5C,sBAAsB,aAAa,CAAC,KAAK,CAAC,IAAI;YAC9C,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,OAAO,EAAE;YACvC,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,SAAS,EAAE;YACzC,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,UAAU,IAAI;YAC5C,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5D,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ;YAC7B,sBAAsB,aAAa,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,QAAQ;SACzE;QACD,SAAS,EAAE,CAAC,UAAU,KAAK,IAAI,CAAC;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa,EAAE,MAAc;IAClE,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7C,6FAA6F;IAC7F,mEAAmE;IACnE,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxC,sFAAsF;IACtF,0FAA0F;IAC1F,iGAAiG;IACjG,gGAAgG;IAChG,kGAAkG;IAClG,2CAA2C;IAC3C,MAAM,YAAY,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC;IAC7F,OAAO;QACL,OAAO,EAAE;YACP,cAAc;YACd,uBAAuB,IAAI,EAAE;YAC7B,uBAAuB,OAAO,EAAE;YAChC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,uBAAuB,OAAO,EAAE,CAAC;YACrE,0BAA0B,IAAI,EAAE;YAChC,0BAA0B,OAAO,EAAE;YACnC,sBAAsB,OAAO,EAAE;YAC/B,sBAAsB,OAAO,IAAI;YACjC,6FAA6F;YAC7F,4FAA4F;YAC5F,mFAAmF;YACnF,8FAA8F;YAC9F,6FAA6F;YAC7F,0FAA0F;YAC1F,yFAAyF;YACzF,4FAA4F;YAC5F,8FAA8F;YAC9F,2FAA2F;YAC3F,4FAA4F;YAC5F,4FAA4F;YAC5F,yEAAyE;YACzE,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,2FAA2F;YAC3F,0FAA0F;YAC1F,yFAAyF;YACzF,yFAAyF;YACzF,mFAAmF;YACnF,OAAO,YAAY,CAAC,KAAK,CAAC,UAAU;YACpC,2FAA2F;YAC3F,yFAAyF;YACzF,uFAAuF;YACvF,sFAAsF;YACtF,wFAAwF;YACxF,mCAAmC;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,QAAQ;YAClC,OAAO,aAAa,CAAC,KAAK,CAAC,cAAc;YACzC,sFAAsF;YACtF,uFAAuF;YACvF,sFAAsF;YACtF,yFAAyF;YACzF,2EAA2E;YAC3E,OAAO,aAAa,CAAC,KAAK,CAAC,aAAa;SACzC;QACD,SAAS,EAAE,CAAC,UAAU,KAAK,IAAI,CAAC;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;iGAoBiG;AACjG,MAAM,UAAU,+BAA+B,CAAC,KAAa,EAAE,QAAgB,EAAE,KAAe;IAC9F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAC7C,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,gJAAgJ,CAAC,CAAC;IACrM,MAAM,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,CAAC,IAAI,CACV,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAC3C,OAAO,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAChD,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,0BAA0B,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/D,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC;AA+ED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAyB;IACjE,IAAI,IAAI,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,CAAC,4BAA4B,EAAE,8BAA8B,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzI,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;IAChF,MAAM,IAAI,GAAG,KAAK,IAAqB,EAAE,CACvC,UAAU,CACR,IAAI,CAAC,KAAK,EACV,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,EACvB,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAChC,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE;QAChE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;IAClG,oFAAoF;IACpF,6EAA6E;IAC7E,aAAa,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,wBAAwB,EAAE,CACvG,CAAC;IACJ,IAAI,UAAU,GAAG,MAAM,IAAI,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,KAAK,IAAqB,EAAE;QACxC,IAAI,IAAI,CAAC,YAAY,EAAE,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC7E,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;IACF,qFAAqF;IACrF,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE;QAC3D,KAAK,KAAK,EAAE,CAAC,IAAI,CACf,CAAC,GAAG,EAAE,EAAE,GAAG,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,EAC9B,CAAC,CAAC,EAAE,EAAE;YACJ,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,gCAAiC,CAAW,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,uDAAuD,CAAC,CAAC;YACjJ,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;QAC5B,CAAC,CACF,CAAC;IACJ,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,IAAI,CAAC,wBAAwB,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3E,IAAI,EAAkB,CAAC;IACvB,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,OAAO,CAAC;YACjB,OAAO,EAAE,IAAI,CAAC,MAAM;YACpB,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,aAAa,EAAE,gBAAgB,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC1F,WAAW,EAAE,UAAU,QAAQ,CAAC,EAAE,EAAE;YACpC,iFAAiF;YACjF,+DAA+D;YAC/D,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,EAAE,CAAC;SACtH,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,OAAO,KAAK,SAAS;YAAE,aAAa,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,CAAC;IACV,CAAC;IACD,IAAI,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,KAAiC,CAAC;IACtC,IAAI,IAA+B,CAAC;IACpC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,4FAA4F;QAC5F,2EAA2E;QAC3E,MAAM,IAAI,GAAG,EAAE,CAAC,IAA8D,CAAC;QAC/E,IAAI,OAAO,IAAI,EAAE,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YAClE,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC;YACvG,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACjC,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,KAAK,iGAAiG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,gFAAgF,CAAC,CAAC;QACxT,CAAC;QACD,KAAK,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjF,IAAI,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO;QACL,EAAE;QACF,MAAM,EAAE,QAAQ,CAAC,EAAE;QACnB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,IAAI,OAAO,KAAK,SAAS;gBAAE,aAAa,CAAC,OAAO,CAAC,CAAC;YAClD,IAAI,CAAC;gBAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;YACzB,OAAO,KAAK,EAAE,CAAC;gBAAC,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,CAAC,KAAK,kBAAkB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAAC,CAAC;YAC9F,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC;QACpB,CAAC;KACF,CAAC;AACJ,CAAC;AAUD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,IAAmD;IAEnD,MAAM,KAAK,GAAG,qBAAqB,IAAI,CAAC,KAAK,EAAE,CAAC;IAChD,IAAI,MAAiC,CAAC;IACtC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,MAAmC,CAAC;IACxC,MAAM,GAAG,MAAM,mBAAmB,CAAC;QACjC,GAAG,IAAI;QACP,KAAK;QACL,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;QAC/D,sFAAsF;QACtF,4FAA4F;QAC5F,gBAAgB,EAAE,GAAG,EAAE;YACrB,MAAM,GAAG,SAAS,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,yGAAyG,CAAC,CAAC;YAC5H,IAAI,CAAC,MAAM;gBAAE,KAAK,MAAM,EAAE,KAAK,EAAE,CAAC;QACpC,CAAC;KACF,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,MAAM,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,CAAC;IACV,CAAC;IACD,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;YACpC,IAAI,MAAM;gBAAE,MAAM;YAClB,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC5B,MAAM,GAAG,SAAS,CAAC;gBACnB,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,uEAAuE,CAAC,CAAC;YAC5F,CAAC;iBAAM,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC9B,+EAA+E;gBAC/E,uFAAuF;gBACvF,wFAAwF;gBACxF,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;YAC1D,CAAC;iBAAM,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAClC,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;oBACnD,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,kDAAkD,CAAC,CAAC;gBACvE,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,GAAG,SAAS,CAAC;oBACnB,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,gCAAiC,CAAW,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC;gBACjH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,OAAO;QACL,OAAO,EAAE,GAAG,EAAE;YACZ,IAAI,MAAM,KAAK,SAAS;gBACtB,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,+KAA+K,CAAC,CAAC;YAC5N,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,GAAG,IAAI,CAAC;YACd,MAAM,GAAG,SAAS,CAAC,CAAC,oEAAoE;YACxF,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"authority-client.js","sourceRoot":"","sources":["../src/authority-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAuB,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,iBAAiB,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,yBAAyB,EAAE,WAAW,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAE,mBAAmB,EAAE,8BAA8B,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,eAAe,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,+BAA+B,EAAsC,MAAM,gBAAgB,CAAC;AAC1kB,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAsB,MAAM,qBAAqB,CAAC;AACrG,OAAO,EAAE,sCAAsC,EAAE,MAAM,0CAA0C,CAAC;AAGlG;6FAC6F;AAC7F,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,EAAE,CAAC;AAEhD,iGAAiG;AACjG,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAC;AACjD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,6BAA6B,KAAK,EAAE,CAAC;AAE9F;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,yBAAyB,CAAC,KAAa,EAAE,MAAc;IAC9D,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7C,gGAAgG;IAChG,2EAA2E;IAC3E,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO;QACL,OAAO,EAAE;YACP,cAAc;YACd,yBAAyB,IAAI,EAAE;YAC/B,yBAAyB,OAAO,EAAE;YAClC,yBAAyB,OAAO,EAAE;YAClC,uBAAuB,IAAI,EAAE;YAC7B,uBAAuB,OAAO,EAAE;YAChC,0BAA0B,IAAI,EAAE;YAChC,0BAA0B,OAAO,EAAE;YACnC,sBAAsB,OAAO,EAAE;YAC/B,sBAAsB,OAAO,IAAI;YACjC,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,UAAU;YACpC,OAAO,YAAY,CAAC,KAAK,CAAC,WAAW;YACrC,OAAO,aAAa,CAAC,KAAK,CAAC,cAAc;YACzC,OAAO,aAAa,CAAC,KAAK,CAAC,QAAQ;SACpC;QACD,SAAS,EAAE,CAAC,UAAU,KAAK,IAAI,CAAC;KACjC,CAAC;AACJ,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,MAAc;IACjE,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACtD,8FAA8F;IAC9F,kGAAkG;IAClG,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,YAAY,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;AACjJ,CAAC;AAED;gEACgE;AAChE,MAAM,UAAU,uCAAuC,CAAC,KAAa,EAAE,MAAc;IACnF,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACtD,OAAO;QACL,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO;YACvB,OAAO,YAAY,CAAC,KAAK,CAAC,mBAAmB;YAC7C,OAAO,YAAY,CAAC,KAAK,CAAC,8BAA8B;YACxD,OAAO,YAAY,CAAC,KAAK,CAAC,mCAAmC;YAC7D,OAAO,YAAY,CAAC,KAAK,CAAC,qCAAqC;SAChE;QACD,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC;AACJ,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,sCAAsC,CAAC,KAAa,EAAE,MAAc;IAClF,MAAM,MAAM,GAAG,sCAAsC,CAAC,KAAK,CAAC,CAAC;IAC7D,OAAO,EAAE,OAAO,EAAE,CAAC,cAAc,EAAE,4BAA4B,MAAM,EAAE,EAAE,0BAA0B,MAAM,EAAE;YACzG,6BAA6B,MAAM,EAAE,EAAE,OAAO,MAAM,YAAY,CAAC;QACnE,SAAS,EAAE,CAAC,UAAU,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;AACzD,CAAC;AAED;;qEAEqE;AACrE,MAAM,UAAU,yBAAyB,CAAC,KAAa,EAAE,MAAc;IACrE,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;IACjD,OAAO;QACL,OAAO,EAAE;YACP,GAAG,IAAI,CAAC,OAAO;YACf,4FAA4F;YAC5F,8FAA8F;YAC9F,6FAA6F;YAC7F,4FAA4F;YAC5F,6FAA6F;YAC7F,oEAAoE;YACpE,OAAO,YAAY,CAAC,KAAK,CAAC,mBAAmB;YAC7C,OAAO,YAAY,CAAC,KAAK,CAAC,mBAAmB;YAC7C,6FAA6F;YAC7F,uFAAuF;YACvF,sBAAsB,aAAa,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,QAAQ;YACxE,sBAAsB,aAAa,CAAC,KAAK,CAAC,EAAE;YAC5C,0FAA0F;YAC1F,uBAAuB,SAAS,EAAE;YAClC,0BAA0B,SAAS,EAAE;YACrC,sBAAsB,SAAS,EAAE;YACjC,sBAAsB,SAAS,IAAI;YACnC,4FAA4F;YAC5F,2FAA2F;YAC3F,0BAA0B,cAAc,CAAC,KAAK,CAAC,EAAE;YACjD,6BAA6B,cAAc,CAAC,KAAK,CAAC,EAAE;SACrD;QACD,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,wBAAwB,CAAC,KAAK,CAAC,EAAE,6BAA6B,CAAC,KAAK,CAAC,CAAC;KACzG,CAAC;AACJ,CAAC;AAED;;yFAEyF;AACzF,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,MAAc,EAAE,MAAgB,EAAE,UAAkB;IACzG,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,EAAE,+BAA+B,CACnE,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,2BAA2B,EAAE,OAAO,EAAE,CAAC,CAAC,EAC7F,UAAU,CACX,EAAE,MAAM,CAAC,CAAC;IACX,OAAO;QACL,OAAO,EAAE,CAAC,sBAAsB,aAAa,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC;QAChG,SAAS,EAAE,CAAC,UAAU,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC;KAClE,CAAC;AACJ,CAAC;AAED;;;kFAGkF;AAClF,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,CAAC,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACnC,OAAO;QACL,GAAG,CAAC,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,uBAAuB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxK,qGAAqG;QACrG,GAAG,CAAC,YAAY,CAAC,iBAAiB;QAClC,GAAG,CAAC,WAAW,CAAC,eAAe;KAChC,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,6BAA6B,CAAC,KAAa;IACzD,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,eAAe,aAAa,CAAC,SAAS,CAAC,iBAAiB,CAAC;AACvF,CAAC;AAED,OAAO,EAAE,8BAA8B,EAAE,CAAC;AAE1C;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa,EAAE,MAAc,EAAE,QAAgB,EAAE,UAAkB;IAC5G,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,kBAAkB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG;QACjB,aAAa,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,oBAAoB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;QAC3F,eAAe,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,oBAAoB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;QAC7F,eAAe,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC;KACzC,CAAC;IACF,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO;QACL,OAAO,EAAE;YACP,cAAc;YACd,0BAA0B,IAAI,EAAE;YAChC,0BAA0B,OAAO,EAAE;YACnC,oGAAoG;YACpG,+FAA+F;YAC/F,+FAA+F;YAC/F,oGAAoG;YACpG,oGAAoG;YACpG,2BAA2B;YAC3B,2BAA2B,IAAI,IAAI;YACnC,yBAAyB,IAAI,IAAI;YACjC,2BAA2B,IAAI,IAAI;YACnC,sBAAsB,aAAa,CAAC,KAAK,CAAC,EAAE;YAC5C,sBAAsB,aAAa,CAAC,KAAK,CAAC,IAAI;YAC9C,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,OAAO,EAAE;YACvC,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,SAAS,EAAE;YACzC,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,UAAU,IAAI;YAC5C,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5D,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ;YAC7B,sBAAsB,aAAa,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,QAAQ;SACzE;QACD,SAAS,EAAE,CAAC,UAAU,KAAK,IAAI,CAAC;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa,EAAE,MAAc;IAClE,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7C,6FAA6F;IAC7F,mEAAmE;IACnE,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxC,sFAAsF;IACtF,0FAA0F;IAC1F,iGAAiG;IACjG,gGAAgG;IAChG,kGAAkG;IAClG,2CAA2C;IAC3C,MAAM,YAAY,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC;IAC7F,OAAO;QACL,OAAO,EAAE;YACP,cAAc;YACd,uBAAuB,IAAI,EAAE;YAC7B,uBAAuB,OAAO,EAAE;YAChC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,uBAAuB,OAAO,EAAE,CAAC;YACrE,0BAA0B,IAAI,EAAE;YAChC,0BAA0B,OAAO,EAAE;YACnC,sBAAsB,OAAO,EAAE;YAC/B,sBAAsB,OAAO,IAAI;YACjC,6FAA6F;YAC7F,4FAA4F;YAC5F,mFAAmF;YACnF,8FAA8F;YAC9F,6FAA6F;YAC7F,0FAA0F;YAC1F,yFAAyF;YACzF,4FAA4F;YAC5F,8FAA8F;YAC9F,2FAA2F;YAC3F,4FAA4F;YAC5F,4FAA4F;YAC5F,yEAAyE;YACzE,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,2FAA2F;YAC3F,0FAA0F;YAC1F,yFAAyF;YACzF,yFAAyF;YACzF,mFAAmF;YACnF,OAAO,YAAY,CAAC,KAAK,CAAC,UAAU;YACpC,2FAA2F;YAC3F,yFAAyF;YACzF,uFAAuF;YACvF,sFAAsF;YACtF,wFAAwF;YACxF,mCAAmC;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,QAAQ;YAClC,OAAO,aAAa,CAAC,KAAK,CAAC,cAAc;YACzC,sFAAsF;YACtF,uFAAuF;YACvF,sFAAsF;YACtF,yFAAyF;YACzF,2EAA2E;YAC3E,OAAO,aAAa,CAAC,KAAK,CAAC,aAAa;SACzC;QACD,SAAS,EAAE,CAAC,UAAU,KAAK,IAAI,CAAC;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;iGAoBiG;AACjG,MAAM,UAAU,+BAA+B,CAAC,KAAa,EAAE,QAAgB,EAAE,KAAe;IAC9F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAC7C,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,gJAAgJ,CAAC,CAAC;IACrM,MAAM,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,CAAC,IAAI,CACV,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAC3C,OAAO,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAChD,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,0BAA0B,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/D,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC;AAED;;;;;mBAKmB;AACnB,MAAM,UAAU,0BAA0B,CAAC,KAAa,EAAE,MAAc;IACtE,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7C,OAAO;QACL,OAAO,EAAE,CAAC,cAAc,EAAE,uBAAuB,IAAI,EAAE,EAAE,uBAAuB,OAAO,EAAE;YACvF,0BAA0B,IAAI,EAAE,EAAE,0BAA0B,OAAO,EAAE,CAAC;QACxE,SAAS,EAAE,CAAC,UAAU,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC;KACrD,CAAC;AACJ,CAAC;AAED,MAAM,MAAM,GAAG,yBAAyB,CAAC;AACzC,MAAM,SAAS,GAAG,iBAAiB,CAAC;AACpC,SAAS,QAAQ,CAAC,OAAe,EAAE,GAAW,EAAE,IAAY;IAC1D,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAC/C,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,qCAAqC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;IACnJ,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;4BAO4B;AAC5B,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,MAAc,EAAE,IAAuB,EAAE,QAAgC,eAAe;IAC7I,MAAM,IAAI,GAAG,0BAA0B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAC9D,OAAO;QACL,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO;YACvB,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,iBAAiB,CAAC,EAAE,CAAC;YACtF,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,IAAI,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,cAAc,CAAC,EAAE,CAAC;YAC7E,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,IAAI,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC,EAAE,iBAAiB,CAAC,GAAG,CAAC;YAC5F,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,yBAAyB,OAAO,QAAQ,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,kBAAkB,CAAC,EAAE,CAAC;YACzH,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;gBAChC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;oBAAE,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,uFAAuF,CAAC,CAAC;gBACnK,OAAO,CAAC,GAAG,MAAM,QAAQ,GAAG,EAAE,EAAE,sBAAsB,GAAG,IAAI,MAAM,QAAQ,GAAG,EAAE,CAAC,CAAC;YACpF,CAAC,CAAC,CAAC;QACL,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC;AACJ,CAAC;AAOD,MAAM,eAAe,GAA2B,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AAE3H;;;;;;wBAMwB;AACxB,MAAM,UAAU,0BAA0B,CAAC,KAAa,EAAE,MAAc;IACtE,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAClF,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,OAAO,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;AACzH,CAAC;AAgGD,SAAS,uBAAuB,CAAC,MAAc;IAC7C,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,oCAAoC,MAAM,EAAE,CAAC,CAAC;AACjG,CAAC;AAED,mGAAmG;AACnG,SAAS,2BAA2B,CAAC,IAAyB;IAC5D,IAAI,IAAI,CAAC,KAAK,KAAK,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,uBAAuB,CAAC,sBAAsB,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3I,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI;QAAE,uBAAuB,CAAC,sBAAsB,CAAC,CAAC;IAC/E,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS;QACzH,uBAAuB,CAAC,+CAA+C,CAAC,CAAC;IAC3E,MAAM,UAAU,GAAY,IAAI,CAAC,qBAAqB,EAAE,UAAU,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACrF,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC;QAAE,uBAAuB,CAAC,2DAA2D,CAAC,CAAC;IAC9J,IAAI,UAAU,IAAI,GAAG,IAAI,UAAU,GAAG,GAAG,GAAG,0BAA0B;QACpE,uBAAuB,CAAC,uDAAuD,0BAA0B,WAAW,CAAC,CAAC;IACxH,4GAA4G;IAC5G,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,IAAI,GAAG,UAAU,IAAI,GAAG,GAAG,IAAI,GAAG,UAAU,IAAI,IAAI;QAAE,uBAAuB,CAAC,kCAAkC,CAAC,CAAC;IAC1J,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAyB;IACjE,IAAI,IAAI,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,CAAC,4BAA4B,EAAE,8BAA8B,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzI,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,2DAA2D;IAC3D,MAAM,UAAU,GAAG,IAAI,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC;IAC5G,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;IAChF,MAAM,IAAI,GAAG,KAAK,IAAqB,EAAE,CACvC,UAAU,CACR,IAAI,CAAC,KAAK,EACV,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,EACvB,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAChC,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE;QAChE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;IAClG,sFAAsF;IACtF,2FAA2F;IAC3F,uDAAuD;IACvD,aAAa,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,wBAAwB,EAAE,CACrI,CAAC;IACJ,IAAI,UAAU,GAAG,MAAM,IAAI,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,KAAK,IAAqB,EAAE;QACxC,IAAI,IAAI,CAAC,YAAY,EAAE,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC7E,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;IACF,8FAA8F;IAC9F,mDAAmD;IACnD,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,IAAI,CAAC;QAAE,uBAAuB,CAAC,iDAAiD,CAAC,CAAC;IAC1H,MAAM,OAAO,GAAG,aAAa,IAAI,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE;QACzE,KAAK,KAAK,EAAE,CAAC,IAAI,CACf,CAAC,GAAG,EAAE,EAAE,GAAG,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,EAC9B,CAAC,CAAC,EAAE,EAAE;YACJ,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,gCAAiC,CAAW,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,uDAAuD,CAAC,CAAC;YACjJ,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;QAC5B,CAAC,CACF,CAAC;IACJ,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,IAAI,CAAC,wBAAwB,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3E,IAAI,EAAkB,CAAC;IACvB,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,OAAO,CAAC;YACjB,OAAO,EAAE,IAAI,CAAC,MAAM;YACpB,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,aAAa,EAAE,gBAAgB,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC1F,WAAW,EAAE,UAAU,QAAQ,CAAC,EAAE,EAAE;YACpC,iFAAiF;YACjF,+DAA+D;YAC/D,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,EAAE,CAAC;YACrH,mEAAmE;YACnE,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,OAAO,KAAK,SAAS;YAAE,aAAa,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,CAAC;IACV,CAAC;IACD,IAAI,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,KAAiC,CAAC;IACtC,IAAI,IAA+B,CAAC;IACpC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,4FAA4F;QAC5F,2EAA2E;QAC3E,MAAM,IAAI,GAAG,EAAE,CAAC,IAA8D,CAAC;QAC/E,IAAI,OAAO,IAAI,EAAE,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YAClE,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC;YACvG,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACjC,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,KAAK,iGAAiG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,gFAAgF,CAAC,CAAC;QACxT,CAAC;QACD,KAAK,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,IAAI,CAAC,cAAc,IAAI,UAAU;QAAE,IAAI,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACjG,OAAO;QACL,EAAE;QACF,MAAM,EAAE,QAAQ,CAAC,EAAE;QACnB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,IAAI,OAAO,KAAK,SAAS;gBAAE,aAAa,CAAC,OAAO,CAAC,CAAC;YAClD,IAAI,CAAC;gBAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;YACzB,OAAO,KAAK,EAAE,CAAC;gBAAC,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,CAAC,KAAK,kBAAkB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAAC,CAAC;YAC9F,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC;QACpB,CAAC;KACF,CAAC;AACJ,CAAC;AAUD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,IAAmD;IAEnD,MAAM,KAAK,GAAG,qBAAqB,IAAI,CAAC,KAAK,EAAE,CAAC;IAChD,IAAI,MAAiC,CAAC;IACtC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,MAAmC,CAAC;IACxC,MAAM,GAAG,MAAM,mBAAmB,CAAC;QACjC,GAAG,IAAI;QACP,KAAK;QACL,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;QAC/D,sFAAsF;QACtF,4FAA4F;QAC5F,gBAAgB,EAAE,GAAG,EAAE;YACrB,MAAM,GAAG,SAAS,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,yGAAyG,CAAC,CAAC;YAC5H,IAAI,CAAC,MAAM;gBAAE,KAAK,MAAM,EAAE,KAAK,EAAE,CAAC;QACpC,CAAC;KACF,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,MAAM,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,CAAC;IACV,CAAC;IACD,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;YACpC,IAAI,MAAM;gBAAE,MAAM;YAClB,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC5B,MAAM,GAAG,SAAS,CAAC;gBACnB,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,uEAAuE,CAAC,CAAC;YAC5F,CAAC;iBAAM,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC9B,+EAA+E;gBAC/E,uFAAuF;gBACvF,wFAAwF;gBACxF,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;YAC1D,CAAC;iBAAM,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAClC,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;oBACnD,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,kDAAkD,CAAC,CAAC;gBACvE,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,GAAG,SAAS,CAAC;oBACnB,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,gCAAiC,CAAW,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC;gBACjH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,OAAO;QACL,OAAO,EAAE,GAAG,EAAE;YACZ,IAAI,MAAM,KAAK,SAAS;gBACtB,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,+KAA+K,CAAC,CAAC;YAC5N,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,GAAG,IAAI,CAAC;YACd,MAAM,GAAG,SAAS,CAAC,CAAC,oEAAoE;YACxF,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/chat-parent-pin.d.ts

@@ -0,0 +1,43 @@
+import type { JetStreamManager } from "@nats-io/jetstream";
+import { type LifecycleMapping } from "@cotal-ai/core";
+import { type ActorRow } from "./ledger.js";
+import { type ChatParentPin } from "./chat-session-row.js";
+/** The parent interactive actor every chat session hangs off (the signed-in human's own row). */
+export declare const CHAT_PARENT_ACTOR = "cli";
+/** `rowDigest`: the normative field list and canonicalization. `role` is included only when
+ *  present (RFC 8785 cannot carry `undefined`); `label`, `parent` and `grantedAt` are excluded. */
+export declare function chatParentRowDigest(row: Pick<ActorRow, "owner" | "actor" | "scope" | "allowSubscribe" | "allowPublish" | "role" | "lifecycleUid">): string;
+/** The holder index's `parentPinDigest`: SHA-256 over the canonical pin. */
+export declare function chatParentPinDigest(pin: ChatParentPin): string;
+/** Read the parent row, fail-closed. Absent refuses (there is no session without its parent). */
+export declare function readChatParentRow(dir: string, owner: string): ActorRow;
+/** LEADER-SERVED read of the parent head (`STREAM.MSG.GET last_by_subj`, the connect reader's
+ *  discipline). A DEL/PURGE marker refuses inside `readRecordLeader`. */
+export declare function readChatParentHeadLeader(jsm: JetStreamManager, space: string, owner: string): Promise<{
+    mapping: LifecycleMapping;
+    revision: number;
+} | undefined>;
+/** Build the pin from a freshly read row and head (admission precondition 3): the head must be
+ *  `active` at the row's UID. */
+export declare function buildChatParentPin(row: ActorRow, head: {
+    mapping: LifecycleMapping;
+    revision: number;
+} | undefined): ChatParentPin;
+/** Containment: every requested entry is contained in the parent's CURRENT
+ *  list. Nothing is added: no `>` the user did not name, no default. */
+export declare function assertChatListsContained(row: Pick<ActorRow, "allowSubscribe" | "allowPublish">, lists: {
+    read: string[];
+    post: string[];
+}): void;
+/**
+ * The pin CHECK, used at the admission re-check (a5), exchange pre- and post-sign and the connect check before and after signing. Refuses unless the CURRENT row and the
+ * CURRENT leader-read head equal the pin exactly, and the session lists are still contained.
+ */
+export declare function assertChatParentPinCurrent(pin: ChatParentPin, row: ActorRow | undefined, head: {
+    mapping: LifecycleMapping;
+    revision: number;
+} | undefined, lists: {
+    read: string[];
+    post: string[];
+}): void;
+//# sourceMappingURL=chat-parent-pin.d.ts.map

package/dist/chat-parent-pin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chat-parent-pin.d.ts","sourceRoot":"","sources":["../src/chat-parent-pin.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAOL,KAAK,gBAAgB,EACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAwB,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAsB,KAAK,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE/E,iGAAiG;AACjG,eAAO,MAAM,iBAAiB,QAAQ,CAAC;AAIvC;mGACmG;AACnG,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,gBAAgB,GAAG,cAAc,GAAG,MAAM,GAAG,cAAc,CAAC,GAAG,MAAM,CAY1J;AAED,4EAA4E;AAC5E,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,aAAa,GAAG,MAAM,CAE9D;AAED,iGAAiG;AACjG,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,QAAQ,CAKtE;AAED;yEACyE;AACzE,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,gBAAgB,EACrB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC;IAAE,OAAO,EAAE,gBAAgB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CAWtE;AAED;iCACiC;AACjC,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE;IAAE,OAAO,EAAE,gBAAgB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,GAAG,aAAa,CAOlI;AAED;wEACwE;AACxE,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,gBAAgB,GAAG,cAAc,CAAC,EAAE,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,CAQhJ;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,aAAa,EAClB,GAAG,EAAE,QAAQ,GAAG,SAAS,EACzB,IAAI,EAAE;IAAE,OAAO,EAAE,gBAAgB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,EACjE,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GACxC,IAAI,CAYN"}

package/dist/chat-parent-pin.js

@@ -0,0 +1,115 @@
+/**
+ * The chat session's PARENT PIN. A chat session is bound to the exact
+ * parent interactive row `actors/<owner>.cli.json` and the exact revision of its lifecycle head
+ * `lifecycle.<owner>.cli`, as both stood at admission:
+ *
+ *   parentPin = { actor: "cli", lifecycleUid, headRevision, rowDigest }
+ *
+ * - `headRevision` is the head key's STORE revision on a LEADER-SERVED read (`STREAM.MSG.GET`,
+ *   never a follower Direct Get). Any head movement (re-grant, revoke, takeover epoch advance)
+ *   moves it, so every later check refuses.
+ * - `rowDigest` is SHA-256 over the RFC 8785 canonical JSON of the row's authority fields
+ *   `{owner, actor, scope, allowSubscribe, allowPublish, role?, lifecycleUid}`. It is defense in
+ *   depth against an out-of-band file edit, which only this digest bounds.
+ *
+ * Every check here is a READ. A read is never a fence: the residual is that the parent head and the
+ * child gate are separate keys with no cross-key CAS. Callers re-check after
+ * signing and before any byte leaves.
+ */
+import { createHash } from "node:crypto";
+import { EpEnvelopeError, canonicalJson, lifecycleHeadKey, parseLifecycleHead, patternInAllow, readRecordLeader, } from "@cotal-ai/core";
+import { findInteractiveActor } from "./ledger.js";
+import { parseChatParentPin } from "./chat-session-row.js";
+/** The parent interactive actor every chat session hangs off (the signed-in human's own row). */
+export const CHAT_PARENT_ACTOR = "cli";
+const sha256Hex = (s) => createHash("sha256").update(s, "utf8").digest("hex");
+/** `rowDigest`: the normative field list and canonicalization. `role` is included only when
+ *  present (RFC 8785 cannot carry `undefined`); `label`, `parent` and `grantedAt` are excluded. */
+export function chatParentRowDigest(row) {
+    if (typeof row.lifecycleUid !== "string" || row.lifecycleUid === "")
+        throw new EpEnvelopeError("permission-denied", `the parent row "${row.owner}.${row.actor}" carries no lifecycleUid; re-grant it before opening a chat session`);
+    return sha256Hex(canonicalJson({
+        owner: row.owner,
+        actor: row.actor,
+        scope: row.scope,
+        allowSubscribe: row.allowSubscribe,
+        allowPublish: row.allowPublish,
+        ...(row.role !== undefined ? { role: row.role } : {}),
+        lifecycleUid: row.lifecycleUid,
+    }));
+}
+/** The holder index's `parentPinDigest`: SHA-256 over the canonical pin. */
+export function chatParentPinDigest(pin) {
+    return sha256Hex(canonicalJson(parseChatParentPin(pin, "parentPin")));
+}
+/** Read the parent row, fail-closed. Absent refuses (there is no session without its parent). */
+export function readChatParentRow(dir, owner) {
+    const row = findInteractiveActor(dir, owner, CHAT_PARENT_ACTOR);
+    if (!row)
+        throw new EpEnvelopeError("permission-denied", `no interactive "${CHAT_PARENT_ACTOR}" grant for owner ${owner}; a chat session is admitted only under the signed-in human's own row`);
+    return row;
+}
+/** LEADER-SERVED read of the parent head (`STREAM.MSG.GET last_by_subj`, the connect reader's
+ *  discipline). A DEL/PURGE marker refuses inside `readRecordLeader`. */
+export async function readChatParentHeadLeader(jsm, space, owner) {
+    const key = lifecycleHeadKey(owner, CHAT_PARENT_ACTOR);
+    let entry;
+    try {
+        entry = await readRecordLeader(jsm, space, key);
+    }
+    catch (e) {
+        if (e instanceof EpEnvelopeError)
+            throw e;
+        throw new EpEnvelopeError("unavailable", `the leader-served parent head read for ${key} failed; an authority read fails closed: ${e?.message ?? String(e)}`);
+    }
+    if (entry === undefined)
+        return undefined;
+    return { mapping: parseLifecycleHead(new TextEncoder().encode(JSON.stringify(entry.value)), key, owner, CHAT_PARENT_ACTOR), revision: entry.revision };
+}
+/** Build the pin from a freshly read row and head (admission precondition 3): the head must be
+ *  `active` at the row's UID. */
+export function buildChatParentPin(row, head) {
+    if (row.actor !== CHAT_PARENT_ACTOR)
+        throw new EpEnvelopeError("internal", `a chat parent is the "${CHAT_PARENT_ACTOR}" row`);
+    if (head === undefined)
+        throw new EpEnvelopeError("failed-precondition", `the parent lifecycle head for "${row.owner}/${CHAT_PARENT_ACTOR}" is absent; ensure it through the parent's own root-credential path first`);
+    if (head.mapping.state !== "active" || head.mapping.lifecycleUid !== row.lifecycleUid)
+        throw new EpEnvelopeError("permission-denied", `the parent lifecycle head for "${row.owner}/${CHAT_PARENT_ACTOR}" is ${head.mapping.state} at ${head.mapping.lifecycleUid}, not active at the row's ${String(row.lifecycleUid)}`);
+    return { actor: CHAT_PARENT_ACTOR, lifecycleUid: head.mapping.lifecycleUid, headRevision: head.revision, rowDigest: chatParentRowDigest(row) };
+}
+/** Containment: every requested entry is contained in the parent's CURRENT
+ *  list. Nothing is added: no `>` the user did not name, no default. */
+export function assertChatListsContained(row, lists) {
+    const overRead = lists.read.filter((ch) => !patternInAllow(row.allowSubscribe, ch));
+    const overPost = lists.post.filter((ch) => !patternInAllow(row.allowPublish, ch));
+    if (overRead.length || overPost.length)
+        throw new EpEnvelopeError("permission-denied", `the chat session would exceed the parent grant: ${[
+            overRead.length ? `read [${overRead.join(", ")}]` : "",
+            overPost.length ? `post [${overPost.join(", ")}]` : "",
+        ].filter(Boolean).join("; ")}`);
+}
+/**
+ * The pin CHECK, used at the admission re-check (a5), exchange pre- and post-sign and the connect check before and after signing. Refuses unless the CURRENT row and the
+ * CURRENT leader-read head equal the pin exactly, and the session lists are still contained.
+ */
+export function assertChatParentPinCurrent(pin, row, head, lists) {
+    const deny = (why) => {
+        throw new EpEnvelopeError("permission-denied", `the chat session's parent moved (${why}); this session has ended - open a new one`);
+    };
+    if (row === undefined)
+        deny("the parent row is gone");
+    if (row.lifecycleUid !== pin.lifecycleUid)
+        deny("the parent row was re-granted");
+    if (head === undefined)
+        deny("the parent head is absent");
+    if (head.mapping.state !== "active")
+        deny(`the parent head is ${head.mapping.state}`);
+    if (head.mapping.lifecycleUid !== pin.lifecycleUid)
+        deny("the parent head names another incarnation");
+    if (head.revision !== pin.headRevision)
+        deny(`the parent head revision is ${head.revision}, pinned ${pin.headRevision}`);
+    if (chatParentRowDigest(row) !== pin.rowDigest)
+        deny("the parent row's authority fields changed");
+    assertChatListsContained(row, lists);
+}
+//# sourceMappingURL=chat-parent-pin.js.map

package/dist/chat-parent-pin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chat-parent-pin.js","sourceRoot":"","sources":["../src/chat-parent-pin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACd,gBAAgB,GAEjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAiB,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAsB,MAAM,uBAAuB,CAAC;AAE/E,iGAAiG;AACjG,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEvC,MAAM,SAAS,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAE9F;mGACmG;AACnG,MAAM,UAAU,mBAAmB,CAAC,GAA8G;IAChJ,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,IAAI,GAAG,CAAC,YAAY,KAAK,EAAE;QACjE,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,mBAAmB,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,sEAAsE,CAAC,CAAC;IAClK,OAAO,SAAS,CAAC,aAAa,CAAC;QAC7B,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,YAAY,EAAE,GAAG,CAAC,YAAY;KAC/B,CAAC,CAAC,CAAC;AACN,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,mBAAmB,CAAC,GAAkB;IACpD,OAAO,SAAS,CAAC,aAAa,CAAC,kBAAkB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,iBAAiB,CAAC,GAAW,EAAE,KAAa;IAC1D,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,EAAE,KAAK,EAAE,iBAAiB,CAAC,CAAC;IAChE,IAAI,CAAC,GAAG;QACN,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,mBAAmB,iBAAiB,qBAAqB,KAAK,uEAAuE,CAAC,CAAC;IACxL,OAAO,GAAG,CAAC;AACb,CAAC;AAED;yEACyE;AACzE,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,GAAqB,EACrB,KAAa,EACb,KAAa;IAEb,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IACvD,IAAI,KAAuD,CAAC;IAC5D,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,eAAe;YAAE,MAAM,CAAC,CAAC;QAC1C,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,0CAA0C,GAAG,4CAA6C,CAAW,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1K,CAAC;IACD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,EAAE,OAAO,EAAE,kBAAkB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,iBAAiB,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;AACzJ,CAAC;AAED;iCACiC;AACjC,MAAM,UAAU,kBAAkB,CAAC,GAAa,EAAE,IAAiE;IACjH,IAAI,GAAG,CAAC,KAAK,KAAK,iBAAiB;QAAE,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,yBAAyB,iBAAiB,OAAO,CAAC,CAAC;IAC9H,IAAI,IAAI,KAAK,SAAS;QACpB,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,kCAAkC,GAAG,CAAC,KAAK,IAAI,iBAAiB,4EAA4E,CAAC,CAAC;IACjM,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,KAAK,GAAG,CAAC,YAAY;QACnF,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,kCAAkC,GAAG,CAAC,KAAK,IAAI,iBAAiB,QAAQ,IAAI,CAAC,OAAO,CAAC,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,6BAA6B,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACpO,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;AACjJ,CAAC;AAED;wEACwE;AACxE,MAAM,UAAU,wBAAwB,CAAC,GAAsD,EAAE,KAAyC;IACxI,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC;IACpF,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC;IAClF,IAAI,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM;QACpC,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,mDAAmD;YAChG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;YACtD,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;SACvD,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,GAAkB,EAClB,GAAyB,EACzB,IAAiE,EACjE,KAAyC;IAEzC,MAAM,IAAI,GAAG,CAAC,GAAW,EAAS,EAAE;QAClC,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,oCAAoC,GAAG,4CAA4C,CAAC,CAAC;IACtI,CAAC,CAAC;IACF,IAAI,GAAG,KAAK,SAAS;QAAE,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACtD,IAAI,GAAI,CAAC,YAAY,KAAK,GAAG,CAAC,YAAY;QAAE,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAClF,IAAI,IAAI,KAAK,SAAS;QAAE,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAC1D,IAAI,IAAK,CAAC,OAAO,CAAC,KAAK,KAAK,QAAQ;QAAE,IAAI,CAAC,sBAAsB,IAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IACxF,IAAI,IAAK,CAAC,OAAO,CAAC,YAAY,KAAK,GAAG,CAAC,YAAY;QAAE,IAAI,CAAC,2CAA2C,CAAC,CAAC;IACvG,IAAI,IAAK,CAAC,QAAQ,KAAK,GAAG,CAAC,YAAY;QAAE,IAAI,CAAC,+BAA+B,IAAK,CAAC,QAAQ,YAAY,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC;IAC3H,IAAI,mBAAmB,CAAC,GAAI,CAAC,KAAK,GAAG,CAAC,SAAS;QAAE,IAAI,CAAC,2CAA2C,CAAC,CAAC;IACnG,wBAAwB,CAAC,GAAI,EAAE,KAAK,CAAC,CAAC;AACxC,CAAC"}