@cotal-ai/auth 0.91.0 → 0.92.0

package/dist/authority-client.d.ts

@@ -27,9 +27,14 @@
 import { type NatsConnection } from "@nats-io/transport-node";
 import { remoteManagerRegistrationProof, type EpCaller, type PlaneConnTuple } from "@cotal-ai/core";
 import { type ConnectReader } from "./connect-reader.js";
+import type { ServiceWriteScope } from "./service-write.js";
 /** Self-minted infra-credential TTL (fact-3 pin: SHORT expiry + in-process renewal, a bounded
  *  in-memory credential that closes with the service — never an unbounded persisted one). */
 export declare const AUTHORITY_CLIENT_TTL_SEC: number;
+/** The longest window one service host effect credential covers: one service host invocation. */
+export declare const SERVICE_HOST_INVOCATION_MS = 60000;
+/** The fixed CONNZ name of every service host effect connection in `space`. */
+export declare const serviceHostEffectLabel: (space: string) => string;
 /** Only the auth mint writer records consents. Derived host writers use the shared base without it. */
 export declare function authorityWriterGrants(space: string, connId: string): {
     publish: string[];
@@ -65,6 +70,8 @@ export declare function platformReadinessGrants(space: string, connId: string, c
  *  The issuing host reads them and never replies: the broker let only the caller's ceiling publish
  *  each one, so observing it is the host's own evidence that the caller asked. */
 export declare function servedRunRequestSubjects(space: string): string[];
+/** Cancellation observes only the issued untargeted exact-instance rail. */
+export declare function servedRunCancelRequestSubject(space: string): string;
 export { remoteManagerRegistrationProof };
 /**
  * The registration executor grant for one instance of an endpoint the AUTH PLANE self-authorizes
@@ -141,6 +148,47 @@ export declare function authorityBarrierGrants(space: string, connId: string): {
 export declare function barrierExecutorSettlementGrants(space: string, endpoint: string, pools: string[]): {
     publish: string[];
 };
+/** The SERVICE HOST DISCOVERY reader: `STREAM.INFO` and leader-served `STREAM.MSG.GET` on both
+ *  authority KV streams, and its own inbox. It publishes no `$KV` subject at all.
+ *
+ *  Named residual: `MSG.GET` is body-selected, so its reads are stream-wide on both stores. The
+ *  same reads ride every effect credential; write confinement is exact-key, read confinement is
+ *  not offered. */
+export declare function serviceHostDiscoveryGrants(space: string, connId: string): {
+    publish: string[];
+    subscribe: string[];
+};
+/** One service host invocation's EFFECT credential: the discovery reads, plus a `$KV` publish on
+ *  exactly each key of `keys` and on exactly one more token under each auth family (a root
+ *  credential id minted during the write). No key carries a wildcard, so the grant's subjects can
+ *  never be wider than the scope the engine guards every write with.
+ *
+ *  Named residual: this is publish-subject confinement only. Broker permissions do not restrict
+ *  what a publish on a granted subject does; the engine's own writes are only creates and
+ *  exact-revision CASes. */
+export declare function serviceHostEffectGrants(space: string, connId: string, keys: ServiceWriteScope, reads?: ServiceHostEffectReads): {
+    publish: string[];
+    subscribe: string[];
+};
+/** What a serving effect reads and publishes beyond its writes: exact records keys, granted by
+ *  Direct Get, and exact contract artifacts it publishes create-only and reads back after a lost
+ *  create. The registry's KV handles are bound without Direct Get, so their reads of those records
+ *  keys are leader message gets (`STREAM.MSG.GET` last by subject) under the base grant. */
+export interface ServiceHostEffectReads {
+    readonly records: readonly string[];
+    readonly contract: readonly string[];
+}
+/** The SERVICE CALLOUT writer: the base writer, plus the endpoint gate and endpoint credential
+ *  families a native service connection's mint stages and touches.
+ *
+ *  Named residual: a broker ACL cannot confine one endpoint-token key family to service
+ *  assignments, so these families also cover native control endpoints' rows. The native service
+ *  mint writes only the bearer's own assignment rows, and every service gate parse refuses another
+ *  authority family. */
+export declare function serviceCalloutWriterGrants(space: string, connId: string): {
+    publish: string[];
+    subscribe: string[];
+};
 export interface AuthorityClientOpts {
     /** Package-internal connection custody for an embedded auth context. */
     onConnection?: (nc: NatsConnection, label: string) => void;
@@ -211,6 +259,24 @@ export interface AuthorityClientOpts {
      * A copied JWT plus identity seed loses the old 900-second leak bound: it remains usable
      * until signing-key removal. Service stop closes owned sockets, not an exfiltrated copy. */
     toolResultCustody?: boolean;
+    /** One service host invocation's effect connection only: label {@link serviceHostEffectLabel},
+     *  `noReconnect` required, never a plane, custody or renewing profile. `deadlineMs` is the
+     *  invocation's ORIGINAL deadline: a safe integer after now and at most
+     *  {@link SERVICE_HOST_INVOCATION_MS} ahead. The credential's one fixed `exp` is
+     *  `ceil(deadlineMs / 1000)` whole seconds, so `exp * 1000` is never earlier than that deadline;
+     *  it is never renewed, the connect is bounded by the remaining window, and {@link AuthorityClient.gone}
+     *  resolves when the connection is gone.
+     *
+     *  Broker granularity, disclosed: nats-server checks `exp` in whole seconds against its own clock,
+     *  refuses a connect once its current second is past `exp`, and arms one whole-second timer at
+     *  connect to close a live connection. With a broker clock that agrees with this process's and
+     *  timely broker and client scheduling, that timer fires inside the second after `exp`, up to
+     *  about `deadlineMs + 1999` ms (observed on 2.12.12 and 2.14.0). That is timer granularity, not a
+     *  guaranteed close time: a skewed clock or a paused or late broker or client moves the close
+     *  either way. No close, at any time, proves that an earlier write cannot still settle. */
+    serviceHostInvocation?: {
+        deadlineMs: number;
+    };
 }
 export interface AuthorityClient {
     nc: NatsConnection;
@@ -222,9 +288,10 @@ export interface AuthorityClient {
     /** planeCandidate only: this connection's broker identity, captured from the protocol INFO at
      *  connect — what the plane claim row pins ({@link PlaneConnTuple}). */
     tuple?: PlaneConnTuple;
-    /** planeCandidate only: resolves when the NON-RECONNECTING connection is permanently gone (the
-     *  plane's fencing signal — close() also resolves it; the composition's `closing` flag tells a
-     *  deliberate teardown from a mid-life death). */
+    /** planeCandidate and serviceHostInvocation only: resolves when the NON-RECONNECTING connection
+     *  is permanently gone (the plane's fencing signal and the invocation's latch — close() also
+     *  resolves it; the composition's `closing` flag tells a deliberate teardown from a mid-life
+     *  death). */
     gone?: Promise<void>;
     close(): Promise<void>;
 }

package/dist/authority-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authority-client.d.ts","sourceRoot":"","sources":["../src/authority-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAGzF,OAAO,EAAyQ,8BAA8B,EAAiO,KAAK,QAAQ,EAAE,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAE1kB,OAAO,EAA8C,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGrG;6FAC6F;AAC7F,eAAO,MAAM,wBAAwB,QAAU,CAAC;AAoDhD,uGAAuG;AACvG,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAK/G;AAED;gEACgE;AAChE,wBAAgB,uCAAuC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAWjI;AAED,oGAAoG;AACpG,wBAAgB,sCAAsC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAKhI;AAED;;qEAEqE;AACrE,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CA8BnH;AAED;;yFAEyF;AACzF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CASvJ;AAED;;;kFAGkF;AAClF,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAShE;AAED,OAAO,EAAE,8BAA8B,EAAE,CAAC;AAE1C;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAqC1J;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CA6DhH;AAED;;;;;;;;;;;;;;;;;;;;iGAoBiG;AACjG,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAcvH;AAED,MAAM,WAAW,mBAAmB;IAClC,wEAAwE;IACxE,YAAY,CAAC,EAAE,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,mGAAmG;IACnG,KAAK,EAAE,MAAM,CAAC;IACd;mDAC+C;IAC/C,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACvE;;;;2GAIuG;IACvG,SAAS,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B;;qDAEiD;IACjD,gBAAgB,CAAC,EAAE,MAAM,IAAI,CAAC;IAC9B;;8DAE0D;IAC1D,YAAY,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACtD;;;;;;;;kFAQ8E;IAC9E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;;;;;;;;kGAc8F;IAC9F,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;gGAI4F;IAC5F,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,cAAc,CAAC;IACnB,wFAAwF;IACxF,MAAM,EAAE,MAAM,CAAC;IACf;oFACgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;4EACwE;IACxE,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB;;sDAEkD;IAClD,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACrB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,eAAe,CAAC,CA4E7F;AAED,MAAM,WAAW,uBAAuB;IACtC;;8CAE0C;IAC1C,OAAO,IAAI,aAAa,CAAC;IACzB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,IAAI,CAAC,mBAAmB,EAAE,QAAQ,GAAG,OAAO,CAAC,GAClD,OAAO,CAAC,uBAAuB,CAAC,CA0DlC"}
+{"version":3,"file":"authority-client.d.ts","sourceRoot":"","sources":["../src/authority-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAGzF,OAAO,EAAyQ,8BAA8B,EAAiO,KAAK,QAAQ,EAAE,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAE1kB,OAAO,EAA8C,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAErG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D;6FAC6F;AAC7F,eAAO,MAAM,wBAAwB,QAAU,CAAC;AAEhD,iGAAiG;AACjG,eAAO,MAAM,0BAA0B,QAAS,CAAC;AACjD,+EAA+E;AAC/E,eAAO,MAAM,sBAAsB,GAAI,OAAO,MAAM,WAAyC,CAAC;AAoD9F,uGAAuG;AACvG,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAK/G;AAED;gEACgE;AAChE,wBAAgB,uCAAuC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAWjI;AAED,oGAAoG;AACpG,wBAAgB,sCAAsC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAKhI;AAED;;qEAEqE;AACrE,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CA8BnH;AAED;;yFAEyF;AACzF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CASvJ;AAED;;;kFAGkF;AAClF,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAShE;AAED,4EAA4E;AAC5E,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED,OAAO,EAAE,8BAA8B,EAAE,CAAC;AAE1C;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAqC1J;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CA6DhH;AAED;;;;;;;;;;;;;;;;;;;;iGAoBiG;AACjG,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAcvH;AAED;;;;;mBAKmB;AACnB,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAQpH;AAUD;;;;;;;4BAO4B;AAC5B,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,GAAE,sBAAwC,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAiB3L;AAED;;;4FAG4F;AAC5F,MAAM,WAAW,sBAAsB;IAAG,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE;AAGrH;;;;;;wBAMwB;AACxB,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CAGpH;AAED,MAAM,WAAW,mBAAmB;IAClC,wEAAwE;IACxE,YAAY,CAAC,EAAE,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,mGAAmG;IACnG,KAAK,EAAE,MAAM,CAAC;IACd;mDAC+C;IAC/C,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACvE;;;;2GAIuG;IACvG,SAAS,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B;;qDAEiD;IACjD,gBAAgB,CAAC,EAAE,MAAM,IAAI,CAAC;IAC9B;;8DAE0D;IAC1D,YAAY,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACtD;;;;;;;;kFAQ8E;IAC9E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;;;;;;;;kGAc8F;IAC9F,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;gGAI4F;IAC5F,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;;;;;+FAc2F;IAC3F,qBAAqB,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CAChD;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,cAAc,CAAC;IACnB,wFAAwF;IACxF,MAAM,EAAE,MAAM,CAAC;IACf;oFACgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;4EACwE;IACxE,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB;;;kBAGc;IACd,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACrB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAsBD;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,eAAe,CAAC,CAoF7F;AAED,MAAM,WAAW,uBAAuB;IACtC;;8CAE0C;IAC1C,OAAO,IAAI,aAAa,CAAC;IACzB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,IAAI,CAAC,mBAAmB,EAAE,QAAQ,GAAG,OAAO,CAAC,GAClD,OAAO,CAAC,uBAAuB,CAAC,CA0DlC"}

package/dist/authority-client.js

@@ -34,6 +34,10 @@ import { environmentManagerAdmissionIndexBucket } from "./environment-manager-ad
 /** Self-minted infra-credential TTL (fact-3 pin: SHORT expiry + in-process renewal, a bounded
  *  in-memory credential that closes with the service — never an unbounded persisted one). */
 export const AUTHORITY_CLIENT_TTL_SEC = 15 * 60;
+/** The longest window one service host effect credential covers: one service host invocation. */
+export const SERVICE_HOST_INVOCATION_MS = 60_000;
+/** The fixed CONNZ name of every service host effect connection in `space`. */
+export const serviceHostEffectLabel = (space) => `cotal:service-host-effect:${space}`;
 /**
  * The MINT WRITER's scoped credential grant (SPEC 13.9): the exchange-time issuance executor.
  * Exactly the store-ensure + activation-saga + root-mint surface:
@@ -142,7 +146,7 @@ export function remoteManagerIssuerGrants(space, connId) {
             `$JS.API.STREAM.INFO.KV_${sessionsBucket(space)}`,
             `$JS.API.STREAM.MSG.GET.KV_${sessionsBucket(space)}`,
         ],
-        subscribe: [...base.subscribe, ...servedRunRequestSubjects(space)],
+        subscribe: [...base.subscribe, ...servedRunRequestSubjects(space), servedRunCancelRequestSubject(space)],
     };
 }
 /** The PLATFORM READINESS reader (SPEC 13.9): `describe` and `status` of one manager instance on
@@ -163,12 +167,16 @@ export function servedRunRequestSubjects(space) {
     const p = spacePrefix(space);
     const m = endpointToken("manager");
     return [
-        ...["run-start", "run-resume", "run-answer"].flatMap((c) => [`${p}.ep.v1.inst.${m}.*.${c}.>`, `${p}.ep.v1.one.${m}.${c}.>`]),
+        ...["run-start", "run-resume", "run-answer", "run-start-keyed", "run-submission-status"].flatMap((c) => [`${p}.ep.v1.inst.${m}.*.${c}.>`, `${p}.ep.v1.one.${m}.${c}.>`]),
         // A managed seat answers on the legacy rail, the relay path; nothing else served there is forwarded.
         `${p}.ep.inst.${m}.*.run-answer.>`,
         `${p}.ep.one.${m}.run-answer.>`,
     ];
 }
+/** Cancellation observes only the issued untargeted exact-instance rail. */
+export function servedRunCancelRequestSubject(space) {
+    return `${spacePrefix(space)}.ep.v1.inst.${endpointToken("manager")}.*.run-cancel.>`;
+}
 export { remoteManagerRegistrationProof };
 /**
  * The registration executor grant for one instance of an endpoint the AUTH PLANE self-authorizes
@@ -346,6 +354,89 @@ export function barrierExecutorSettlementGrants(space, endpoint, pools) {
     publish.push(`$JS.API.STREAM.MSG.GET.${epfStreamName(space)}`);
     return { publish };
 }
+/** The SERVICE HOST DISCOVERY reader: `STREAM.INFO` and leader-served `STREAM.MSG.GET` on both
+ *  authority KV streams, and its own inbox. It publishes no `$KV` subject at all.
+ *
+ *  Named residual: `MSG.GET` is body-selected, so its reads are stream-wide on both stores. The
+ *  same reads ride every effect credential; write confinement is exact-key, read confinement is
+ *  not offered. */
+export function serviceHostDiscoveryGrants(space, connId) {
+    const auth = `KV_${epAuthBucket(space)}`;
+    const records = `KV_${recordsBucket(space)}`;
+    return {
+        publish: ["$JS.API.INFO", `$JS.API.STREAM.INFO.${auth}`, `$JS.API.STREAM.INFO.${records}`,
+            `$JS.API.STREAM.MSG.GET.${auth}`, `$JS.API.STREAM.MSG.GET.${records}`],
+        subscribe: [`_INBOX_${assertInboxConnId(connId)}.>`],
+    };
+}
+const KV_KEY = /^[-/=\w]+(\.[-/=\w]+)*$/;
+const KV_FAMILY = /^([-/=\w]+\.)+$/;
+function scopeKey(pattern, key, what) {
+    if (typeof key !== "string" || !pattern.test(key))
+        throw new EpEnvelopeError("bad-request", `a service host effect grant names ${what} ${JSON.stringify(key)} that is not plain dotted key tokens`);
+    return key;
+}
+/** One service host invocation's EFFECT credential: the discovery reads, plus a `$KV` publish on
+ *  exactly each key of `keys` and on exactly one more token under each auth family (a root
+ *  credential id minted during the write). No key carries a wildcard, so the grant's subjects can
+ *  never be wider than the scope the engine guards every write with.
+ *
+ *  Named residual: this is publish-subject confinement only. Broker permissions do not restrict
+ *  what a publish on a granted subject does; the engine's own writes are only creates and
+ *  exact-revision CASes. */
+export function serviceHostEffectGrants(space, connId, keys, reads = NO_EFFECT_READS) {
+    const base = serviceHostDiscoveryGrants(space, connId);
+    const auth = epAuthBucket(space);
+    const records = recordsBucket(space);
+    const epc = epcStreamName(space), prefix = spacePrefix(space);
+    return {
+        publish: [...base.publish,
+            ...keys.records.map((k) => `$KV.${records}.${scopeKey(KV_KEY, k, "the records key")}`),
+            ...keys.auth.map((k) => `$KV.${auth}.${scopeKey(KV_KEY, k, "the auth key")}`),
+            ...keys.authFamilies.map((f) => `$KV.${auth}.${scopeKey(KV_FAMILY, f, "the auth family")}*`),
+            ...reads.records.map((k) => `$JS.API.DIRECT.GET.KV_${records}.$KV.${records}.${scopeKey(KV_KEY, k, "the records read")}`),
+            ...reads.contract.flatMap((hex) => {
+                if (!/^[0-9a-f]{64}$/.test(hex))
+                    throw new EpEnvelopeError("bad-request", "a service host effect grant names a contract artifact that is not a sha256 hex digest");
+                return [`${prefix}.epc.${hex}`, `$JS.API.DIRECT.GET.${epc}.${prefix}.epc.${hex}`];
+            })],
+        subscribe: base.subscribe,
+    };
+}
+const NO_EFFECT_READS = Object.freeze({ records: Object.freeze([]), contract: Object.freeze([]) });
+/** The SERVICE CALLOUT writer: the base writer, plus the endpoint gate and endpoint credential
+ *  families a native service connection's mint stages and touches.
+ *
+ *  Named residual: a broker ACL cannot confine one endpoint-token key family to service
+ *  assignments, so these families also cover native control endpoints' rows. The native service
+ *  mint writes only the bearer's own assignment rows, and every service gate parse refuses another
+ *  authority family. */
+export function serviceCalloutWriterGrants(space, connId) {
+    const base = baseAuthorityWriterGrants(space, connId), auth = epAuthBucket(space);
+    return { publish: [...base.publish, `$KV.${auth}.epgate.*.*`, `$KV.${auth}.epcred.*.*.*`], subscribe: base.subscribe };
+}
+function refuseServiceHostEffect(detail) {
+    throw new EpEnvelopeError("failed-precondition", `a service host effect credential ${detail}`);
+}
+/** The service host effect profile's one fixed `exp`, derived from the original deadline alone. */
+function serviceHostInvocationExpiry(opts) {
+    if (opts.label !== serviceHostEffectLabel(opts.space))
+        refuseServiceHostEffect(`requires the label ${serviceHostEffectLabel(opts.space)}`);
+    if (opts.noReconnect !== true)
+        refuseServiceHostEffect("requires noReconnect");
+    if (opts.planeCandidate || opts.toolResultCustody || opts.probeRenewal !== undefined || opts.onRenewalFailure !== undefined)
+        refuseServiceHostEffect("is never a plane, custody or renewing profile");
+    const deadlineMs = opts.serviceHostInvocation?.deadlineMs, now = Date.now();
+    if (typeof deadlineMs !== "number" || !Number.isSafeInteger(deadlineMs))
+        refuseServiceHostEffect("requires a safe-integer original deadline in milliseconds");
+    if (deadlineMs <= now || deadlineMs > now + SERVICE_HOST_INVOCATION_MS)
+        refuseServiceHostEffect(`requires an original deadline after now and at most ${SERVICE_HOST_INVOCATION_MS} ms ahead`);
+    // Whole seconds, never milliseconds: a millisecond-valued exp would pass the broker as a far-future second.
+    const exp = Math.ceil(deadlineMs / 1000);
+    if (!Number.isSafeInteger(exp) || exp * 1000 < deadlineMs || exp * 1000 - deadlineMs >= 1000)
+        refuseServiceHostEffect("has no exact whole-second expiry");
+    return { exp, deadlineMs };
+}
 /**
  * Open one self-minted data-account connection: a stable user nkey, a short-exp user JWT signed
  * by the data account's signing seed, re-minted in-process at half-life. The authenticator
@@ -355,23 +446,30 @@ export function barrierExecutorSettlementGrants(space, endpoint, pools) {
 export async function openAuthorityClient(opts) {
     if (opts.toolResultCustody && (opts.planeCandidate || !["cotal:tool-result-snapshot", "cotal:tool-result-revocation"].includes(opts.label)))
         throw new Error("tool-result custody requires its dedicated internal reader or writer profile");
+    // Checked before any identity, grant or connection exists.
+    const invocation = opts.serviceHostInvocation === undefined ? undefined : serviceHostInvocationExpiry(opts);
     const uninterrupted = Boolean(opts.planeCandidate || opts.toolResultCustody);
     const identity = newIdentity();
     const grants = opts.grants(identity.id);
     const signer = fromSeed(new TextEncoder().encode(opts.dataAccount.signingSeed));
     const mint = async () => encodeUser(opts.label, fromPublic(identity.id), fromPublic(opts.dataAccount.pub), { pub: { allow: grants.publish }, sub: { allow: grants.subscribe },
         ...(opts.principal ? { tags: principalTags(opts.principal.owner, opts.principal.actor) } : {}) }, 
-    // Plane scanners and the separate custody profile require uninterrupted identities.
-    // Every other authority connection keeps short expiry and half-life renewal.
-    uninterrupted ? { signer } : { signer, exp: Math.floor(Date.now() / 1000) + AUTHORITY_CLIENT_TTL_SEC });
+    // Plane scanners and the separate custody profile require uninterrupted identities. A
+    // service host effect expires at its invocation's original deadline. Every other authority
+    // connection keeps short expiry and half-life renewal.
+    uninterrupted ? { signer } : { signer, exp: invocation ? invocation.exp : Math.floor(Date.now() / 1000) + AUTHORITY_CLIENT_TTL_SEC });
     let currentJwt = await mint();
     const renew = async () => {
         if (opts.probeRenewal?.fail)
             throw new Error("probe-forced renewal failure");
         return mint();
     };
-    // Neither uninterrupted profile can present renewal without its forbidden reconnect.
-    const renewal = uninterrupted ? undefined : setInterval(() => {
+    // No uninterrupted profile can present renewal without its forbidden reconnect, and a service
+    // host effect never outlives its one fixed expiry.
+    const remaining = invocation ? invocation.deadlineMs - Date.now() : undefined;
+    if (remaining !== undefined && remaining <= 0)
+        refuseServiceHostEffect("its original deadline passed before the connect");
+    const renewal = uninterrupted || invocation ? undefined : setInterval(() => {
         void renew().then((jwt) => { currentJwt = jwt; }, (e) => {
             opts.log(`${opts.label}: credential renewal FAILED (${e?.message ?? String(e)}) - failing closed NOW (fail-closed renewal boundary)`);
             opts.onRenewalFailure?.();
@@ -387,6 +485,8 @@ export async function openAuthorityClient(opts) {
             // Custody, plane candidates and per-call repairs never reconnect. Other standing
             // authority connections use stock renewal/reconnect semantics.
             ...(uninterrupted || opts.noReconnect ? { reconnect: false, maxReconnectAttempts: 0 } : { maxReconnectAttempts: -1 }),
+            // A service host effect's handshake never outlasts its invocation.
+            ...(remaining !== undefined ? { timeout: remaining } : {}),
         });
     }
     catch (e) {
@@ -407,8 +507,9 @@ export async function openAuthorityClient(opts) {
             throw new EpEnvelopeError("unavailable", `${opts.label}: the broker INFO carries no usable (server_id, client_id) for the plane claim (got server_id=${JSON.stringify(info?.server_id)}, client_id=${JSON.stringify(info?.client_id)}); an ownership-bearing scanner connection must be claim-pinnable (SPEC 13.13)`);
         }
         tuple = { serverId: info.server_id, cid: info.client_id, userNkey: identity.id };
-        gone = nc.closed().then(() => undefined, () => undefined);
     }
+    if (opts.planeCandidate || invocation)
+        gone = nc.closed().then(() => undefined, () => undefined);
     return {
         nc,
         connId: identity.id,

package/dist/authority-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"authority-client.js","sourceRoot":"","sources":["../src/authority-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAuB,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,iBAAiB,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,yBAAyB,EAAE,WAAW,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAE,mBAAmB,EAAE,8BAA8B,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,eAAe,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,+BAA+B,EAAsC,MAAM,gBAAgB,CAAC;AAC1kB,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAsB,MAAM,qBAAqB,CAAC;AACrG,OAAO,EAAE,sCAAsC,EAAE,MAAM,0CAA0C,CAAC;AAElG;6FAC6F;AAC7F,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,EAAE,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,yBAAyB,CAAC,KAAa,EAAE,MAAc;IAC9D,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7C,gGAAgG;IAChG,2EAA2E;IAC3E,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO;QACL,OAAO,EAAE;YACP,cAAc;YACd,yBAAyB,IAAI,EAAE;YAC/B,yBAAyB,OAAO,EAAE;YAClC,yBAAyB,OAAO,EAAE;YAClC,uBAAuB,IAAI,EAAE;YAC7B,uBAAuB,OAAO,EAAE;YAChC,0BAA0B,IAAI,EAAE;YAChC,0BAA0B,OAAO,EAAE;YACnC,sBAAsB,OAAO,EAAE;YAC/B,sBAAsB,OAAO,IAAI;YACjC,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,UAAU;YACpC,OAAO,YAAY,CAAC,KAAK,CAAC,WAAW;YACrC,OAAO,aAAa,CAAC,KAAK,CAAC,cAAc;YACzC,OAAO,aAAa,CAAC,KAAK,CAAC,QAAQ;SACpC;QACD,SAAS,EAAE,CAAC,UAAU,KAAK,IAAI,CAAC;KACjC,CAAC;AACJ,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,MAAc;IACjE,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACtD,8FAA8F;IAC9F,kGAAkG;IAClG,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,YAAY,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;AACjJ,CAAC;AAED;gEACgE;AAChE,MAAM,UAAU,uCAAuC,CAAC,KAAa,EAAE,MAAc;IACnF,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACtD,OAAO;QACL,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO;YACvB,OAAO,YAAY,CAAC,KAAK,CAAC,mBAAmB;YAC7C,OAAO,YAAY,CAAC,KAAK,CAAC,8BAA8B;YACxD,OAAO,YAAY,CAAC,KAAK,CAAC,mCAAmC;YAC7D,OAAO,YAAY,CAAC,KAAK,CAAC,qCAAqC;SAChE;QACD,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC;AACJ,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,sCAAsC,CAAC,KAAa,EAAE,MAAc;IAClF,MAAM,MAAM,GAAG,sCAAsC,CAAC,KAAK,CAAC,CAAC;IAC7D,OAAO,EAAE,OAAO,EAAE,CAAC,cAAc,EAAE,4BAA4B,MAAM,EAAE,EAAE,0BAA0B,MAAM,EAAE;YACzG,6BAA6B,MAAM,EAAE,EAAE,OAAO,MAAM,YAAY,CAAC;QACnE,SAAS,EAAE,CAAC,UAAU,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;AACzD,CAAC;AAED;;qEAEqE;AACrE,MAAM,UAAU,yBAAyB,CAAC,KAAa,EAAE,MAAc;IACrE,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;IACjD,OAAO;QACL,OAAO,EAAE;YACP,GAAG,IAAI,CAAC,OAAO;YACf,4FAA4F;YAC5F,8FAA8F;YAC9F,6FAA6F;YAC7F,4FAA4F;YAC5F,6FAA6F;YAC7F,oEAAoE;YACpE,OAAO,YAAY,CAAC,KAAK,CAAC,mBAAmB;YAC7C,OAAO,YAAY,CAAC,KAAK,CAAC,mBAAmB;YAC7C,6FAA6F;YAC7F,uFAAuF;YACvF,sBAAsB,aAAa,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,QAAQ;YACxE,sBAAsB,aAAa,CAAC,KAAK,CAAC,EAAE;YAC5C,0FAA0F;YAC1F,uBAAuB,SAAS,EAAE;YAClC,0BAA0B,SAAS,EAAE;YACrC,sBAAsB,SAAS,EAAE;YACjC,sBAAsB,SAAS,IAAI;YACnC,4FAA4F;YAC5F,2FAA2F;YAC3F,0BAA0B,cAAc,CAAC,KAAK,CAAC,EAAE;YACjD,6BAA6B,cAAc,CAAC,KAAK,CAAC,EAAE;SACrD;QACD,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;KACnE,CAAC;AACJ,CAAC;AAED;;yFAEyF;AACzF,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,MAAc,EAAE,MAAgB,EAAE,UAAkB;IACzG,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,EAAE,+BAA+B,CACnE,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,2BAA2B,EAAE,OAAO,EAAE,CAAC,CAAC,EAC7F,UAAU,CACX,EAAE,MAAM,CAAC,CAAC;IACX,OAAO;QACL,OAAO,EAAE,CAAC,sBAAsB,aAAa,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC;QAChG,SAAS,EAAE,CAAC,UAAU,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC;KAClE,CAAC;AACJ,CAAC;AAED;;;kFAGkF;AAClF,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,CAAC,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACnC,OAAO;QACL,GAAG,CAAC,WAAW,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5H,qGAAqG;QACrG,GAAG,CAAC,YAAY,CAAC,iBAAiB;QAClC,GAAG,CAAC,WAAW,CAAC,eAAe;KAChC,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,8BAA8B,EAAE,CAAC;AAE1C;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa,EAAE,MAAc,EAAE,QAAgB,EAAE,UAAkB;IAC5G,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,kBAAkB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG;QACjB,aAAa,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,oBAAoB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;QAC3F,eAAe,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,oBAAoB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;QAC7F,eAAe,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC;KACzC,CAAC;IACF,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO;QACL,OAAO,EAAE;YACP,cAAc;YACd,0BAA0B,IAAI,EAAE;YAChC,0BAA0B,OAAO,EAAE;YACnC,oGAAoG;YACpG,+FAA+F;YAC/F,+FAA+F;YAC/F,oGAAoG;YACpG,oGAAoG;YACpG,2BAA2B;YAC3B,2BAA2B,IAAI,IAAI;YACnC,yBAAyB,IAAI,IAAI;YACjC,2BAA2B,IAAI,IAAI;YACnC,sBAAsB,aAAa,CAAC,KAAK,CAAC,EAAE;YAC5C,sBAAsB,aAAa,CAAC,KAAK,CAAC,IAAI;YAC9C,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,OAAO,EAAE;YACvC,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,SAAS,EAAE;YACzC,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,UAAU,IAAI;YAC5C,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5D,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ;YAC7B,sBAAsB,aAAa,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,QAAQ;SACzE;QACD,SAAS,EAAE,CAAC,UAAU,KAAK,IAAI,CAAC;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa,EAAE,MAAc;IAClE,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7C,6FAA6F;IAC7F,mEAAmE;IACnE,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxC,sFAAsF;IACtF,0FAA0F;IAC1F,iGAAiG;IACjG,gGAAgG;IAChG,kGAAkG;IAClG,2CAA2C;IAC3C,MAAM,YAAY,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC;IAC7F,OAAO;QACL,OAAO,EAAE;YACP,cAAc;YACd,uBAAuB,IAAI,EAAE;YAC7B,uBAAuB,OAAO,EAAE;YAChC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,uBAAuB,OAAO,EAAE,CAAC;YACrE,0BAA0B,IAAI,EAAE;YAChC,0BAA0B,OAAO,EAAE;YACnC,sBAAsB,OAAO,EAAE;YAC/B,sBAAsB,OAAO,IAAI;YACjC,6FAA6F;YAC7F,4FAA4F;YAC5F,mFAAmF;YACnF,8FAA8F;YAC9F,6FAA6F;YAC7F,0FAA0F;YAC1F,yFAAyF;YACzF,4FAA4F;YAC5F,8FAA8F;YAC9F,2FAA2F;YAC3F,4FAA4F;YAC5F,4FAA4F;YAC5F,yEAAyE;YACzE,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,2FAA2F;YAC3F,0FAA0F;YAC1F,yFAAyF;YACzF,yFAAyF;YACzF,mFAAmF;YACnF,OAAO,YAAY,CAAC,KAAK,CAAC,UAAU;YACpC,2FAA2F;YAC3F,yFAAyF;YACzF,uFAAuF;YACvF,sFAAsF;YACtF,wFAAwF;YACxF,mCAAmC;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,QAAQ;YAClC,OAAO,aAAa,CAAC,KAAK,CAAC,cAAc;YACzC,sFAAsF;YACtF,uFAAuF;YACvF,sFAAsF;YACtF,yFAAyF;YACzF,2EAA2E;YAC3E,OAAO,aAAa,CAAC,KAAK,CAAC,aAAa;SACzC;QACD,SAAS,EAAE,CAAC,UAAU,KAAK,IAAI,CAAC;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;iGAoBiG;AACjG,MAAM,UAAU,+BAA+B,CAAC,KAAa,EAAE,QAAgB,EAAE,KAAe;IAC9F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAC7C,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,gJAAgJ,CAAC,CAAC;IACrM,MAAM,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,CAAC,IAAI,CACV,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAC3C,OAAO,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAChD,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,0BAA0B,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/D,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC;AA+ED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAyB;IACjE,IAAI,IAAI,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,CAAC,4BAA4B,EAAE,8BAA8B,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzI,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;IAChF,MAAM,IAAI,GAAG,KAAK,IAAqB,EAAE,CACvC,UAAU,CACR,IAAI,CAAC,KAAK,EACV,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,EACvB,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAChC,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE;QAChE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;IAClG,oFAAoF;IACpF,6EAA6E;IAC7E,aAAa,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,wBAAwB,EAAE,CACvG,CAAC;IACJ,IAAI,UAAU,GAAG,MAAM,IAAI,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,KAAK,IAAqB,EAAE;QACxC,IAAI,IAAI,CAAC,YAAY,EAAE,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC7E,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;IACF,qFAAqF;IACrF,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE;QAC3D,KAAK,KAAK,EAAE,CAAC,IAAI,CACf,CAAC,GAAG,EAAE,EAAE,GAAG,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,EAC9B,CAAC,CAAC,EAAE,EAAE;YACJ,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,gCAAiC,CAAW,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,uDAAuD,CAAC,CAAC;YACjJ,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;QAC5B,CAAC,CACF,CAAC;IACJ,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,IAAI,CAAC,wBAAwB,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3E,IAAI,EAAkB,CAAC;IACvB,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,OAAO,CAAC;YACjB,OAAO,EAAE,IAAI,CAAC,MAAM;YACpB,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,aAAa,EAAE,gBAAgB,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC1F,WAAW,EAAE,UAAU,QAAQ,CAAC,EAAE,EAAE;YACpC,iFAAiF;YACjF,+DAA+D;YAC/D,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,EAAE,CAAC;SACtH,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,OAAO,KAAK,SAAS;YAAE,aAAa,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,CAAC;IACV,CAAC;IACD,IAAI,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,KAAiC,CAAC;IACtC,IAAI,IAA+B,CAAC;IACpC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,4FAA4F;QAC5F,2EAA2E;QAC3E,MAAM,IAAI,GAAG,EAAE,CAAC,IAA8D,CAAC;QAC/E,IAAI,OAAO,IAAI,EAAE,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YAClE,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC;YACvG,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACjC,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,KAAK,iGAAiG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,gFAAgF,CAAC,CAAC;QACxT,CAAC;QACD,KAAK,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjF,IAAI,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO;QACL,EAAE;QACF,MAAM,EAAE,QAAQ,CAAC,EAAE;QACnB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,IAAI,OAAO,KAAK,SAAS;gBAAE,aAAa,CAAC,OAAO,CAAC,CAAC;YAClD,IAAI,CAAC;gBAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;YACzB,OAAO,KAAK,EAAE,CAAC;gBAAC,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,CAAC,KAAK,kBAAkB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAAC,CAAC;YAC9F,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC;QACpB,CAAC;KACF,CAAC;AACJ,CAAC;AAUD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,IAAmD;IAEnD,MAAM,KAAK,GAAG,qBAAqB,IAAI,CAAC,KAAK,EAAE,CAAC;IAChD,IAAI,MAAiC,CAAC;IACtC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,MAAmC,CAAC;IACxC,MAAM,GAAG,MAAM,mBAAmB,CAAC;QACjC,GAAG,IAAI;QACP,KAAK;QACL,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;QAC/D,sFAAsF;QACtF,4FAA4F;QAC5F,gBAAgB,EAAE,GAAG,EAAE;YACrB,MAAM,GAAG,SAAS,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,yGAAyG,CAAC,CAAC;YAC5H,IAAI,CAAC,MAAM;gBAAE,KAAK,MAAM,EAAE,KAAK,EAAE,CAAC;QACpC,CAAC;KACF,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,MAAM,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,CAAC;IACV,CAAC;IACD,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;YACpC,IAAI,MAAM;gBAAE,MAAM;YAClB,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC5B,MAAM,GAAG,SAAS,CAAC;gBACnB,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,uEAAuE,CAAC,CAAC;YAC5F,CAAC;iBAAM,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC9B,+EAA+E;gBAC/E,uFAAuF;gBACvF,wFAAwF;gBACxF,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;YAC1D,CAAC;iBAAM,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAClC,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;oBACnD,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,kDAAkD,CAAC,CAAC;gBACvE,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,GAAG,SAAS,CAAC;oBACnB,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,gCAAiC,CAAW,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC;gBACjH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,OAAO;QACL,OAAO,EAAE,GAAG,EAAE;YACZ,IAAI,MAAM,KAAK,SAAS;gBACtB,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,+KAA+K,CAAC,CAAC;YAC5N,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,GAAG,IAAI,CAAC;YACd,MAAM,GAAG,SAAS,CAAC,CAAC,oEAAoE;YACxF,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"authority-client.js","sourceRoot":"","sources":["../src/authority-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAuB,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,iBAAiB,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,yBAAyB,EAAE,WAAW,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAE,mBAAmB,EAAE,8BAA8B,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,eAAe,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,+BAA+B,EAAsC,MAAM,gBAAgB,CAAC;AAC1kB,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAsB,MAAM,qBAAqB,CAAC;AACrG,OAAO,EAAE,sCAAsC,EAAE,MAAM,0CAA0C,CAAC;AAGlG;6FAC6F;AAC7F,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,EAAE,CAAC;AAEhD,iGAAiG;AACjG,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAC;AACjD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,6BAA6B,KAAK,EAAE,CAAC;AAE9F;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,yBAAyB,CAAC,KAAa,EAAE,MAAc;IAC9D,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7C,gGAAgG;IAChG,2EAA2E;IAC3E,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO;QACL,OAAO,EAAE;YACP,cAAc;YACd,yBAAyB,IAAI,EAAE;YAC/B,yBAAyB,OAAO,EAAE;YAClC,yBAAyB,OAAO,EAAE;YAClC,uBAAuB,IAAI,EAAE;YAC7B,uBAAuB,OAAO,EAAE;YAChC,0BAA0B,IAAI,EAAE;YAChC,0BAA0B,OAAO,EAAE;YACnC,sBAAsB,OAAO,EAAE;YAC/B,sBAAsB,OAAO,IAAI;YACjC,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,UAAU;YACpC,OAAO,YAAY,CAAC,KAAK,CAAC,WAAW;YACrC,OAAO,aAAa,CAAC,KAAK,CAAC,cAAc;YACzC,OAAO,aAAa,CAAC,KAAK,CAAC,QAAQ;SACpC;QACD,SAAS,EAAE,CAAC,UAAU,KAAK,IAAI,CAAC;KACjC,CAAC;AACJ,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,qBAAqB,CAAC,KAAa,EAAE,MAAc;IACjE,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACtD,8FAA8F;IAC9F,kGAAkG;IAClG,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,YAAY,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;AACjJ,CAAC;AAED;gEACgE;AAChE,MAAM,UAAU,uCAAuC,CAAC,KAAa,EAAE,MAAc;IACnF,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACtD,OAAO;QACL,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO;YACvB,OAAO,YAAY,CAAC,KAAK,CAAC,mBAAmB;YAC7C,OAAO,YAAY,CAAC,KAAK,CAAC,8BAA8B;YACxD,OAAO,YAAY,CAAC,KAAK,CAAC,mCAAmC;YAC7D,OAAO,YAAY,CAAC,KAAK,CAAC,qCAAqC;SAChE;QACD,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC;AACJ,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,sCAAsC,CAAC,KAAa,EAAE,MAAc;IAClF,MAAM,MAAM,GAAG,sCAAsC,CAAC,KAAK,CAAC,CAAC;IAC7D,OAAO,EAAE,OAAO,EAAE,CAAC,cAAc,EAAE,4BAA4B,MAAM,EAAE,EAAE,0BAA0B,MAAM,EAAE;YACzG,6BAA6B,MAAM,EAAE,EAAE,OAAO,MAAM,YAAY,CAAC;QACnE,SAAS,EAAE,CAAC,UAAU,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;AACzD,CAAC;AAED;;qEAEqE;AACrE,MAAM,UAAU,yBAAyB,CAAC,KAAa,EAAE,MAAc;IACrE,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;IACjD,OAAO;QACL,OAAO,EAAE;YACP,GAAG,IAAI,CAAC,OAAO;YACf,4FAA4F;YAC5F,8FAA8F;YAC9F,6FAA6F;YAC7F,4FAA4F;YAC5F,6FAA6F;YAC7F,oEAAoE;YACpE,OAAO,YAAY,CAAC,KAAK,CAAC,mBAAmB;YAC7C,OAAO,YAAY,CAAC,KAAK,CAAC,mBAAmB;YAC7C,6FAA6F;YAC7F,uFAAuF;YACvF,sBAAsB,aAAa,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,QAAQ;YACxE,sBAAsB,aAAa,CAAC,KAAK,CAAC,EAAE;YAC5C,0FAA0F;YAC1F,uBAAuB,SAAS,EAAE;YAClC,0BAA0B,SAAS,EAAE;YACrC,sBAAsB,SAAS,EAAE;YACjC,sBAAsB,SAAS,IAAI;YACnC,4FAA4F;YAC5F,2FAA2F;YAC3F,0BAA0B,cAAc,CAAC,KAAK,CAAC,EAAE;YACjD,6BAA6B,cAAc,CAAC,KAAK,CAAC,EAAE;SACrD;QACD,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,wBAAwB,CAAC,KAAK,CAAC,EAAE,6BAA6B,CAAC,KAAK,CAAC,CAAC;KACzG,CAAC;AACJ,CAAC;AAED;;yFAEyF;AACzF,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,MAAc,EAAE,MAAgB,EAAE,UAAkB;IACzG,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,EAAE,+BAA+B,CACnE,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,2BAA2B,EAAE,OAAO,EAAE,CAAC,CAAC,EAC7F,UAAU,CACX,EAAE,MAAM,CAAC,CAAC;IACX,OAAO;QACL,OAAO,EAAE,CAAC,sBAAsB,aAAa,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC;QAChG,SAAS,EAAE,CAAC,UAAU,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC;KAClE,CAAC;AACJ,CAAC;AAED;;;kFAGkF;AAClF,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,CAAC,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACnC,OAAO;QACL,GAAG,CAAC,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,uBAAuB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxK,qGAAqG;QACrG,GAAG,CAAC,YAAY,CAAC,iBAAiB;QAClC,GAAG,CAAC,WAAW,CAAC,eAAe;KAChC,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,6BAA6B,CAAC,KAAa;IACzD,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,eAAe,aAAa,CAAC,SAAS,CAAC,iBAAiB,CAAC;AACvF,CAAC;AAED,OAAO,EAAE,8BAA8B,EAAE,CAAC;AAE1C;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa,EAAE,MAAc,EAAE,QAAgB,EAAE,UAAkB;IAC5G,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,kBAAkB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG;QACjB,aAAa,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,oBAAoB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;QAC3F,eAAe,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,oBAAoB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;QAC7F,eAAe,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC;KACzC,CAAC;IACF,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO;QACL,OAAO,EAAE;YACP,cAAc;YACd,0BAA0B,IAAI,EAAE;YAChC,0BAA0B,OAAO,EAAE;YACnC,oGAAoG;YACpG,+FAA+F;YAC/F,+FAA+F;YAC/F,oGAAoG;YACpG,oGAAoG;YACpG,2BAA2B;YAC3B,2BAA2B,IAAI,IAAI;YACnC,yBAAyB,IAAI,IAAI;YACjC,2BAA2B,IAAI,IAAI;YACnC,sBAAsB,aAAa,CAAC,KAAK,CAAC,EAAE;YAC5C,sBAAsB,aAAa,CAAC,KAAK,CAAC,IAAI;YAC9C,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,OAAO,EAAE;YACvC,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,SAAS,EAAE;YACzC,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,UAAU,IAAI;YAC5C,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5D,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ;YAC7B,sBAAsB,aAAa,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,QAAQ;SACzE;QACD,SAAS,EAAE,CAAC,UAAU,KAAK,IAAI,CAAC;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa,EAAE,MAAc;IAClE,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7C,6FAA6F;IAC7F,mEAAmE;IACnE,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxC,sFAAsF;IACtF,0FAA0F;IAC1F,iGAAiG;IACjG,gGAAgG;IAChG,kGAAkG;IAClG,2CAA2C;IAC3C,MAAM,YAAY,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC;IAC7F,OAAO;QACL,OAAO,EAAE;YACP,cAAc;YACd,uBAAuB,IAAI,EAAE;YAC7B,uBAAuB,OAAO,EAAE;YAChC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,uBAAuB,OAAO,EAAE,CAAC;YACrE,0BAA0B,IAAI,EAAE;YAChC,0BAA0B,OAAO,EAAE;YACnC,sBAAsB,OAAO,EAAE;YAC/B,sBAAsB,OAAO,IAAI;YACjC,6FAA6F;YAC7F,4FAA4F;YAC5F,mFAAmF;YACnF,8FAA8F;YAC9F,6FAA6F;YAC7F,0FAA0F;YAC1F,yFAAyF;YACzF,4FAA4F;YAC5F,8FAA8F;YAC9F,2FAA2F;YAC3F,4FAA4F;YAC5F,4FAA4F;YAC5F,yEAAyE;YACzE,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,SAAS;YACnC,2FAA2F;YAC3F,0FAA0F;YAC1F,yFAAyF;YACzF,yFAAyF;YACzF,mFAAmF;YACnF,OAAO,YAAY,CAAC,KAAK,CAAC,UAAU;YACpC,2FAA2F;YAC3F,yFAAyF;YACzF,uFAAuF;YACvF,sFAAsF;YACtF,wFAAwF;YACxF,mCAAmC;YACnC,OAAO,YAAY,CAAC,KAAK,CAAC,QAAQ;YAClC,OAAO,aAAa,CAAC,KAAK,CAAC,cAAc;YACzC,sFAAsF;YACtF,uFAAuF;YACvF,sFAAsF;YACtF,yFAAyF;YACzF,2EAA2E;YAC3E,OAAO,aAAa,CAAC,KAAK,CAAC,aAAa;SACzC;QACD,SAAS,EAAE,CAAC,UAAU,KAAK,IAAI,CAAC;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;iGAoBiG;AACjG,MAAM,UAAU,+BAA+B,CAAC,KAAa,EAAE,QAAgB,EAAE,KAAe;IAC9F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAC7C,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,gJAAgJ,CAAC,CAAC;IACrM,MAAM,CAAC,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,CAAC,IAAI,CACV,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAC3C,OAAO,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAChD,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,0BAA0B,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/D,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC;AAED;;;;;mBAKmB;AACnB,MAAM,UAAU,0BAA0B,CAAC,KAAa,EAAE,MAAc;IACtE,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7C,OAAO;QACL,OAAO,EAAE,CAAC,cAAc,EAAE,uBAAuB,IAAI,EAAE,EAAE,uBAAuB,OAAO,EAAE;YACvF,0BAA0B,IAAI,EAAE,EAAE,0BAA0B,OAAO,EAAE,CAAC;QACxE,SAAS,EAAE,CAAC,UAAU,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC;KACrD,CAAC;AACJ,CAAC;AAED,MAAM,MAAM,GAAG,yBAAyB,CAAC;AACzC,MAAM,SAAS,GAAG,iBAAiB,CAAC;AACpC,SAAS,QAAQ,CAAC,OAAe,EAAE,GAAW,EAAE,IAAY;IAC1D,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAC/C,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,qCAAqC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;IACnJ,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;4BAO4B;AAC5B,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,MAAc,EAAE,IAAuB,EAAE,QAAgC,eAAe;IAC7I,MAAM,IAAI,GAAG,0BAA0B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAC9D,OAAO;QACL,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO;YACvB,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,iBAAiB,CAAC,EAAE,CAAC;YACtF,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,IAAI,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,cAAc,CAAC,EAAE,CAAC;YAC7E,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,IAAI,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC,EAAE,iBAAiB,CAAC,GAAG,CAAC;YAC5F,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,yBAAyB,OAAO,QAAQ,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,kBAAkB,CAAC,EAAE,CAAC;YACzH,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;gBAChC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;oBAAE,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,uFAAuF,CAAC,CAAC;gBACnK,OAAO,CAAC,GAAG,MAAM,QAAQ,GAAG,EAAE,EAAE,sBAAsB,GAAG,IAAI,MAAM,QAAQ,GAAG,EAAE,CAAC,CAAC;YACpF,CAAC,CAAC,CAAC;QACL,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC;AACJ,CAAC;AAOD,MAAM,eAAe,GAA2B,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AAE3H;;;;;;wBAMwB;AACxB,MAAM,UAAU,0BAA0B,CAAC,KAAa,EAAE,MAAc;IACtE,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAClF,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,OAAO,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;AACzH,CAAC;AAgGD,SAAS,uBAAuB,CAAC,MAAc;IAC7C,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,oCAAoC,MAAM,EAAE,CAAC,CAAC;AACjG,CAAC;AAED,mGAAmG;AACnG,SAAS,2BAA2B,CAAC,IAAyB;IAC5D,IAAI,IAAI,CAAC,KAAK,KAAK,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,uBAAuB,CAAC,sBAAsB,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3I,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI;QAAE,uBAAuB,CAAC,sBAAsB,CAAC,CAAC;IAC/E,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS;QACzH,uBAAuB,CAAC,+CAA+C,CAAC,CAAC;IAC3E,MAAM,UAAU,GAAY,IAAI,CAAC,qBAAqB,EAAE,UAAU,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACrF,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC;QAAE,uBAAuB,CAAC,2DAA2D,CAAC,CAAC;IAC9J,IAAI,UAAU,IAAI,GAAG,IAAI,UAAU,GAAG,GAAG,GAAG,0BAA0B;QACpE,uBAAuB,CAAC,uDAAuD,0BAA0B,WAAW,CAAC,CAAC;IACxH,4GAA4G;IAC5G,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,IAAI,GAAG,UAAU,IAAI,GAAG,GAAG,IAAI,GAAG,UAAU,IAAI,IAAI;QAAE,uBAAuB,CAAC,kCAAkC,CAAC,CAAC;IAC1J,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAyB;IACjE,IAAI,IAAI,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,CAAC,4BAA4B,EAAE,8BAA8B,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzI,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,2DAA2D;IAC3D,MAAM,UAAU,GAAG,IAAI,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC;IAC5G,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;IAChF,MAAM,IAAI,GAAG,KAAK,IAAqB,EAAE,CACvC,UAAU,CACR,IAAI,CAAC,KAAK,EACV,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,EACvB,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAChC,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE;QAChE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;IAClG,sFAAsF;IACtF,2FAA2F;IAC3F,uDAAuD;IACvD,aAAa,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,wBAAwB,EAAE,CACrI,CAAC;IACJ,IAAI,UAAU,GAAG,MAAM,IAAI,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,KAAK,IAAqB,EAAE;QACxC,IAAI,IAAI,CAAC,YAAY,EAAE,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC7E,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;IACF,8FAA8F;IAC9F,mDAAmD;IACnD,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,IAAI,CAAC;QAAE,uBAAuB,CAAC,iDAAiD,CAAC,CAAC;IAC1H,MAAM,OAAO,GAAG,aAAa,IAAI,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE;QACzE,KAAK,KAAK,EAAE,CAAC,IAAI,CACf,CAAC,GAAG,EAAE,EAAE,GAAG,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,EAC9B,CAAC,CAAC,EAAE,EAAE;YACJ,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,gCAAiC,CAAW,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,uDAAuD,CAAC,CAAC;YACjJ,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;QAC5B,CAAC,CACF,CAAC;IACJ,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,IAAI,CAAC,wBAAwB,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3E,IAAI,EAAkB,CAAC;IACvB,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,OAAO,CAAC;YACjB,OAAO,EAAE,IAAI,CAAC,MAAM;YACpB,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,aAAa,EAAE,gBAAgB,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC1F,WAAW,EAAE,UAAU,QAAQ,CAAC,EAAE,EAAE;YACpC,iFAAiF;YACjF,+DAA+D;YAC/D,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,EAAE,CAAC;YACrH,mEAAmE;YACnE,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,OAAO,KAAK,SAAS;YAAE,aAAa,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,CAAC;IACV,CAAC;IACD,IAAI,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,KAAiC,CAAC;IACtC,IAAI,IAA+B,CAAC;IACpC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,4FAA4F;QAC5F,2EAA2E;QAC3E,MAAM,IAAI,GAAG,EAAE,CAAC,IAA8D,CAAC;QAC/E,IAAI,OAAO,IAAI,EAAE,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YAClE,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC;YACvG,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACjC,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,KAAK,iGAAiG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,gFAAgF,CAAC,CAAC;QACxT,CAAC;QACD,KAAK,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;IACnF,CAAC;IACD,IAAI,IAAI,CAAC,cAAc,IAAI,UAAU;QAAE,IAAI,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACjG,OAAO;QACL,EAAE;QACF,MAAM,EAAE,QAAQ,CAAC,EAAE;QACnB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,IAAI,OAAO,KAAK,SAAS;gBAAE,aAAa,CAAC,OAAO,CAAC,CAAC;YAClD,IAAI,CAAC;gBAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;YACzB,OAAO,KAAK,EAAE,CAAC;gBAAC,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,CAAC,KAAK,kBAAkB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAAC,CAAC;YAC9F,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC;QACpB,CAAC;KACF,CAAC;AACJ,CAAC;AAUD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,IAAmD;IAEnD,MAAM,KAAK,GAAG,qBAAqB,IAAI,CAAC,KAAK,EAAE,CAAC;IAChD,IAAI,MAAiC,CAAC;IACtC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,MAAmC,CAAC;IACxC,MAAM,GAAG,MAAM,mBAAmB,CAAC;QACjC,GAAG,IAAI;QACP,KAAK;QACL,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC;QAC/D,sFAAsF;QACtF,4FAA4F;QAC5F,gBAAgB,EAAE,GAAG,EAAE;YACrB,MAAM,GAAG,SAAS,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,yGAAyG,CAAC,CAAC;YAC5H,IAAI,CAAC,MAAM;gBAAE,KAAK,MAAM,EAAE,KAAK,EAAE,CAAC;QACpC,CAAC;KACF,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,MAAM,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,CAAC;IACV,CAAC;IACD,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;YACpC,IAAI,MAAM;gBAAE,MAAM;YAClB,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC5B,MAAM,GAAG,SAAS,CAAC;gBACnB,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,uEAAuE,CAAC,CAAC;YAC5F,CAAC;iBAAM,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC9B,+EAA+E;gBAC/E,uFAAuF;gBACvF,wFAAwF;gBACxF,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;YAC1D,CAAC;iBAAM,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAClC,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;oBACnD,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,kDAAkD,CAAC,CAAC;gBACvE,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,GAAG,SAAS,CAAC;oBACnB,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,gCAAiC,CAAW,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC;gBACjH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,OAAO;QACL,OAAO,EAAE,GAAG,EAAE;YACZ,IAAI,MAAM,KAAK,SAAS;gBACtB,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,+KAA+K,CAAC,CAAC;YAC5N,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,MAAM,GAAG,IAAI,CAAC;YACd,MAAM,GAAG,SAAS,CAAC,CAAC,oEAAoE;YACxF,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../src/commands.ts"],"names":[],"mappings":"AA0ZA;4CAC4C;AAC5C,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,GAAG,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAEhG"}
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../src/commands.ts"],"names":[],"mappings":"AAqaA;4CAC4C;AAC5C,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,GAAG,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAEhG"}

package/dist/commands.js

@@ -9,7 +9,7 @@ import { authServiceFlags } from "./daemon-flags.js";
 import { readFileSync } from "node:fs";
 import * as prompts from "@clack/prompts";
 import { assertDerivedOwnerToken, assertLifecycleToken, assertValidChannel, assertValidOwnerToken, assertValidRole, isLoopbackLiteral, registry, resolveAuthProvider, resolveSpaceCatalogConsumer, writePrivateRecord } from "@cotal-ai/core";
-import { CommandFailure, credentialMintFlags, validateCredentialMintArguments, exportSpaceSigner, signerExportFlags, validateSignerExportInput, inputDisabledByFlag, isWorkspaceTargetError, resolveMeshTarget, targetErrorCode, spaceFlag, isCommandFailure, oneLine, jsonFlag, plainFlag, presentationOf, renderReport, terminalWidth, writeResult, CLI_USER_ACTOR, findCotalRoot, getSpaceAuth, homeCotalDir, loadMeshes, probeLiveness, removeCatalogMeshes, untilInputEnds, userAuthStateDir, deprecatedDaemonEntry, workspaceSecretStore } from "@cotal-ai/workspace";
+import { CommandFailure, credentialMintFlags, validateCredentialMintArguments, exportSpaceSigner, signerExportFlags, validateSignerExportInput, inputDisabledByFlag, isWorkspaceTargetError, resolveMeshTarget, targetErrorCode, spaceFlag, isCommandFailure, oneLine, jsonFlag, plainFlag, presentationOf, renderReport, terminalWidth, writeResult, CLI_USER_ACTOR, findCotalRoot, getSpaceAuth, homeCotalDir, loadMeshes, probeLiveness, removeCatalogMeshes, untilInputEnds, userAuthStateDir, deprecatedDaemonEntry, workspaceErrorParts, workspaceSecretStore } from "@cotal-ai/workspace";
 import { deleteIdpSession, deleteIdpSpaceCatalog, establishIdpSession, IdpUnreachableError, loadIdpSession, listIdpAccounts, normalizeIdpUrl, revokeIdpSession, } from "./login.js";
 import { inspectHandleFile } from "./handle-inspect.js";
 import { checkedEviction } from "./barrier-evict.js";
@@ -238,7 +238,17 @@ async function runLogout(args) {
  *  workstation commands — the ledger machine — so the workspace FS composition IS the correct
  *  one, not a fallback). */
 function actorState(target) {
-    return { dir: userAuthStateDir(target.root, target.space), space: target.space, store: workspaceSecretStore(target.root) };
+    return { dir: userAuthStateDir(target.root, target.space), space: target.space, mode: target.mode, store: workspaceSecretStore(target.root) };
+}
+/** The refusal of a grant read or change on a root that holds no owner secret and IdP pin for the
+ *  space. A static or open space has no user-auth ledger on any machine, so its refusal says grants
+ *  need a user-auth space; another space's ledger may live at another root. `unwritten` says what
+ *  this command did not do. */
+function noLedger(st, unwritten) {
+    const target = { space: st.space };
+    if (st.mode === "auth" || st.mode === "open")
+        return new CommandFailure("refused", "UNSUPPORTED", `space "${st.space}" is ${st.mode === "auth" ? "a static-credential" : "an open"} space and has no user-auth ledger; ${unwritten}`, { target, remedy: "actor grants apply only to a space started with `cotal up --user-auth`" });
+    return new CommandFailure("refused", "UNSUPPORTED", `this root does not hold the space's authoritative user-auth ledger; ${unwritten}`, { target, remedy: "manage grants on the machine and root that host this space's user-auth ledger; a space started without `--user-auth` has none" });
 }
 /** Resolve the operator's target (owner) for `actor grant`/`revoke`: an explicit derived `--owner`
  *  token, or `--sub` (the IdP subject `cotal login` prints) derived through the SAME frozen encoding
@@ -246,11 +256,11 @@ function actorState(target) {
  *  IS the machine that ran `cotal up --user-auth`, where the authoritative ledger lives. Without
  *  them a grant would write an INERT LOCAL row and print a misleading success while the mesh's real
  *  ledger is untouched (an off-machine `--owner` cannot mutate authority), so we refuse instead. */
-async function resolveGrantOwner(st, values) {
+async function resolveGrantOwner(st, values, unwritten) {
     const secret = await loadOwnerSecret(st.store, st.space);
     const idp = loadPinnedIdp(st.dir);
     if (!secret || !idp)
-        throw new CommandFailure("refused", "UNSUPPORTED", "the selected local root has no authoritative user-auth owner secret and IdP pin; no inert grant was written", { target: { space: st.space }, remedy: "manage grants on the machine and root that host this space's user-auth ledger" });
+        throw noLedger(st, unwritten);
     if (values.owner)
         return values.owner;
     return deriveOwnerForIdpSubject(secret, idp.issuer, values.sub);
@@ -324,7 +334,7 @@ async function runActor(args, target, command) {
     await legibly(async () => {
         if (sub === "list") {
             if (!(await loadOwnerSecret(st.store, space)) || !loadPinnedIdp(dir))
-                throw new CommandFailure("refused", "UNSUPPORTED", "this root does not hold the space's authoritative user-auth ledger; an empty grant list was not inferred", { target: { space } });
+                throw noLedger(st, "an empty grant list was not inferred");
             const items = loadActorLedger(dir).sort((a, b) => (a.owner + a.actor).localeCompare(b.owner + b.actor)).map(publicActor);
             writeResult(presentationOf(args.values), { command, target: { space }, result: { kind: "actor-grants", items } }, (result) => grantView(space, result.items));
             return;
@@ -332,7 +342,7 @@ async function runActor(args, target, command) {
         if (sub === "grant") {
             if (!actor)
                 throw new CommandFailure("refused", "USAGE_INVALID", grantUsage(command));
-            const owner = await resolveGrantOwner(st, values);
+            const owner = await resolveGrantOwner(st, values, "no inert grant was written");
             //
             // A re-grant rotates the lifecycle so a copied bearer cannot cross the authorization update.
             // Retire the predecessor through the auth plane first; issuance is not allowed to perform a
@@ -380,7 +390,7 @@ async function runActor(args, target, command) {
         if (sub === "revoke") {
             if (!actor)
                 throw new CommandFailure("refused", "USAGE_INVALID", grantUsage(command));
-            const owner = await resolveGrantOwner(st, values);
+            const owner = await resolveGrantOwner(st, values, "nothing was revoked");
             const current = findInteractiveActor(dir, owner, actor);
             if (!current) {
                 if (findManagedActor(dir, owner, actor))
@@ -732,13 +742,15 @@ function validateGrantUsage(command, mode, actor, extra, flags) {
 function localAuthTarget(values) {
     try {
         const target = resolveMeshTarget(process.cwd(), { ...values, readOnly: true });
-        return { root: target.root, space: target.space };
+        return { root: target.root, space: target.space, mode: target.mode };
     }
     catch (error) {
         if (isWorkspaceTargetError(error)) {
             if (error.code === "not-started" && error.details.root && error.details.space)
                 return { root: error.details.root, space: error.details.space };
-            throw new CommandFailure("refused", targetErrorCode(error.code), "the selected space's local authority root could not be resolved; no different root was selected");
+            // These commands take no --server, so the no-mesh step names only `cotal up`.
+            const remedy = error.code === "no-meshes" ? "run `cotal up` in a project" : workspaceErrorParts({ kind: "target", error }).remedy;
+            throw new CommandFailure("refused", targetErrorCode(error.code), "the selected space's local authority root could not be resolved; no different root was selected", remedy === undefined ? {} : { remedy });
         }
         throw error;
     }
@@ -812,9 +824,24 @@ async function authGroup(args) {
         const expiry = new Date(account.expiresAt * 1000);
         return { provider: account.idp, subject: account.sub ?? null, cachedExpiry: account.expiresAt, cachedExpiryIso: Number.isFinite(expiry.getTime()) ? expiry.toISOString() : null, cachedExpiryPassed: account.expiresAt * 1000 <= Date.now(), verification: "not-checked" };
     });
+    // The Next lines name a real space: the requested one, else the one a bare command resolves. With
+    // none, they point to the space list rather than print an unfilled `--space`.
+    let space = args.values.space;
+    if (space === undefined) {
+        try {
+            space = resolveMeshTarget(process.cwd(), { readOnly: true }).space;
+        }
+        catch (error) {
+            if (!isWorkspaceTargetError(error))
+                throw error;
+        }
+    }
+    const spaceSteps = space === undefined
+        ? [{ command: "cotal space", description: "See registered spaces and choose one" }]
+        : [{ command: `cotal whoami --space ${space}`, description: "Resolve the selected space's actual CLI caller" }, { command: `cotal auth grants --space ${space}`, description: "Read the locally authoritative actor ledger" }];
     writeResult(presentationOf(args.values), { command: "auth", target: { requestedSpace: args.values.space ?? null }, result: { kind: "account-cache", items, liveAuthorization: "not-checked" } }, (result) => ({ sections: [
             { title: "Cached accounts", blocks: [result.items.length ? { kind: "table", columns: [{ key: "provider", label: "Provider" }, { key: "subject", label: "Account subject" }, { key: "expiry", label: "Cached expiry" }, { key: "state", label: "Cache state" }], rows: result.items.map((account) => ({ provider: account.provider, subject: account.subject ?? "not cached", expiry: account.cachedExpiryIso ?? "not representable", state: account.cachedExpiryPassed ? "expiry passed" : "not verified online" })) } : { kind: "lines", lines: ["No cached provider accounts."] }, { kind: "lines", lines: [{ text: "Cache metadata only. A sign-in is not a space grant and this view does not prove current session validity or live authorization. Tokens and grant secrets are not printed.", tone: "hint" }] }] },
-            { title: "Next", blocks: [{ kind: "commands", items: [{ command: "cotal whoami --space <space>", description: "Resolve the selected space's actual CLI caller" }, { command: "cotal auth grants --space <space>", description: "Read the locally authoritative actor ledger" }, { command: "cotal login", description: "Choose a provider and approve sign-in" }] }] },
+            { title: "Next", blocks: [{ kind: "commands", items: [...spaceSteps, { command: "cotal login", description: "Choose a provider and approve sign-in" }] }] },
         ] }));
 }
 const authCommand = {